From ecd1aa46b676d80c663ce4a2b6225d88d8ddcec2 Mon Sep 17 00:00:00 2001 From: Mahyuddin Susanto Date: Thu, 5 Nov 2026 08:32:35 +0700 Subject: [PATCH] Tambah panduan A+ SSL Labs untuk nginx dan Apache (EN dan ID) Empat post baru: konfigurasi TLS nginx dan Apache httpd untuk nilai A+ di Qualys SSL Labs, masing-masing dalam bahasa Inggris dan Indonesia, plus diagram hero di img/. --- .../2026-11-05-ssl-labs-a-plus-apache-id.md | 390 +++++++++++++++++ _posts/2026-11-05-ssl-labs-a-plus-apache.md | 390 +++++++++++++++++ _posts/2026-11-05-ssl-labs-a-plus-nginx-id.md | 403 ++++++++++++++++++ _posts/2026-11-05-ssl-labs-a-plus-nginx.md | 403 ++++++++++++++++++ img/ssl-labs-a-plus-apache-id.png | Bin 0 -> 51600 bytes img/ssl-labs-a-plus-apache.png | Bin 0 -> 49450 bytes img/ssl-labs-a-plus-nginx-id.png | Bin 0 -> 51737 bytes img/ssl-labs-a-plus-nginx.png | Bin 0 -> 49547 bytes 8 files changed, 1586 insertions(+) create mode 100644 _posts/2026-11-05-ssl-labs-a-plus-apache-id.md create mode 100644 _posts/2026-11-05-ssl-labs-a-plus-apache.md create mode 100644 _posts/2026-11-05-ssl-labs-a-plus-nginx-id.md create mode 100644 _posts/2026-11-05-ssl-labs-a-plus-nginx.md create mode 100644 img/ssl-labs-a-plus-apache-id.png create mode 100644 img/ssl-labs-a-plus-apache.png create mode 100644 img/ssl-labs-a-plus-nginx-id.png create mode 100644 img/ssl-labs-a-plus-nginx.png diff --git a/_posts/2026-11-05-ssl-labs-a-plus-apache-id.md b/_posts/2026-11-05-ssl-labs-a-plus-apache-id.md new file mode 100644 index 0000000..4ebc14c --- /dev/null +++ b/_posts/2026-11-05-ssl-labs-a-plus-apache-id.md @@ -0,0 +1,390 @@ +--- +layout: post +title: "Cara Mendapat A+ di SSL Labs dengan Apache (Panduan 2026)" +description: "Konfigurasi mod_ssl Apache untuk nilai A+ di SSL Labs: TLS 1.3, cipher ECDHE, full chain, HSTS dengan Header always, dan jebakan configtest." +image: "/img/ssl-labs-a-plus-apache-id.png" +date: 2026-11-05 +categories: + - Linux +tags: + - apache + - tls + - ssl + - security + - hsts +--- + +Untuk dapat A+ di [SSL Labs Server Test](https://www.ssllabs.com/ssltest/) dari Qualys dengan Apache httpd, syaratnya sama dengan web server lain: hanya TLS 1.2 dan TLS 1.3, cipher ECDHE dengan AEAD (GCM atau ChaCha20-Poly1305), sertifikat dikirim bersama chain lengkapnya, header HSTS dengan `max-age` minimal enam bulan, dan konfigurasi yang sama di semua alamat IP hostname tersebut. Di Apache, ada dua hal yang menentukan berhasil atau tidaknya: header HSTS harus memakai `Header always set`, bukan `Header set`, dan virtual host yang punya `SSLProtocol` atau `SSLCipherSuite` sendiri akan diam-diam mengalahkan pengaturan global. + +Tulisan ini memberi konfigurasi yang bisa langsung dipasang di Apache Debian atau Ubuntu, menjelaskan tiap barisnya, dan menunjukkan cara mengecek hasilnya sebelum menjalankan SSL Labs. + +Konfigurasi di bawah sudah diuji di Apache 2.4.69 dengan OpenSSL 3.5.7, memakai layout `/etc/apache2` bawaan Debian 13 dengan modul, `tls.conf`, dan file site dari tulisan ini diaktifkan, lalu dicek dengan `openssl s_client` dan `curl`. + +**Read in English:** [How to Get an A+ on SSL Labs with Apache httpd]({% post_url 2026-11-05-ssl-labs-a-plus-apache %}). Pakai nginx? Lihat [Cara Mendapat A+ di SSL Labs dengan nginx]({% post_url 2026-11-05-ssl-labs-a-plus-nginx-id %}). + +![Tangga grade SSL Labs untuk Apache: apa yang menahan server di B atau A-, dan syarat A+](/img/ssl-labs-a-plus-apache-id.png) + +
+Daftar isi + +* TOC +{:toc} +
+ +## Cara SSL Labs memberi nilai + +SSL Labs menilai dukungan protokol (30%), key exchange (30%), dan kekuatan cipher (40%), lalu memberlakukan batas atas (cap) untuk masalah tertentu. A+ adalah bonus untuk server ber-grade A tanpa warning. Aturan yang berlaku sekarang adalah versi 2009r dari [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), tertanggal 16 Mei 2025. Batas-batas yang relevan untuk server Apache pada umumnya: + +| Masalah | Grade maksimal | +|---|---| +| SSLv2, SSLv3 sebagai protokol terbaik, cipher export, bug sekelas Heartbleed | F | +| Tidak mendukung TLS 1.2 | C | +| TLS 1.0 atau TLS 1.1 aktif | B | +| Tanpa forward secrecy (tanpa ECDHE/DHE) | B | +| Tanpa cipher AEAD (GCM atau ChaCha20-Poly1305) | B | +| Chain sertifikat tidak lengkap | B | +| Key atau parameter DH di bawah 2048 bit | B | +| Tidak mendukung TLS 1.3 | A- | +| HSTS tidak ada atau tidak valid | A- | + +Untuk A+, panduan itu mensyaratkan konfigurasi tanpa warning dan HSTS dengan `max-age` minimal enam bulan (15768000 detik). Sejak revisi Mei 2025, sekadar dapat A pun butuh TLS 1.3 sekaligus header HSTS yang valid, dan `TLS_FALLBACK_SCSV` tidak dihitung lagi. + +Sertifikat ECDSA P-256 atau RSA 2048 sudah cukup. Nilai key exchange-nya 90 dan tetap dapat A+. + +## Cek versi Apache dan OpenSSL dulu + +```bash +apache2 -v +apache2ctl -M | grep -e ssl -e headers -e rewrite -e http2 +``` + +Versi OpenSSL yang dipakai Apache tercetak di error log saat start, di baris seperti `Apache/2.4.69 (Debian) OpenSSL/3.5.7 configured -- resuming normal operations`. + +| Fitur | Butuh | +|---|---| +| TLS 1.3 (dan baris `SSLCipherSuite TLSv1.3 ...`) | Apache 2.4.37+ dengan OpenSSL 1.1.1+ (dukungan TLS 1.3 tercatat di 2.4.36, versi yang tidak pernah dirilis) | +| Intermediate di `SSLCertificateFile` (tanpa `SSLCertificateChainFile`) | Apache 2.4.8+ | +| `SSLOpenSSLConfCmd` (dipakai di sini untuk mengatur kurva) | Apache 2.4.8+ dengan OpenSSL 1.0.2+ | +| `Protocols h2 http/1.1` (HTTP/2) | Apache 2.4.17+ | +| `SSLProtocol` per virtual host dihormati saat ada SNI | Apache 2.4.42+ dengan OpenSSL 1.1.1+ | +| Grup hybrid post-quantum `X25519MLKEM768` | OpenSSL 3.5+ | + +## Langkah 1: Sertifikat dan full chain + +Dengan Let's Encrypt dan Certbot, ambil sertifikatnya saja, lalu tulis konfigurasi TLS sendiri: + +```bash +sudo certbot certonly --apache -d example.com -d www.example.com +``` + +Certbot 2.0 ke atas membuat key ECDSA secara default. + +Arahkan Apache ke `fullchain.pem`: + +```apache +SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem +``` + +Sejak Apache 2.4.8, `SSLCertificateFile` boleh berisi sertifikat intermediate setelah sertifikat utama, dan [dokumentasi mod_ssl](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile) menyebut `SSLCertificateChainFile` sudah usang. Kalau `SSLCertificateFile` diarahkan ke `cert.pem` dan chain file dibuang, intermediate-nya hilang. Browser sering melengkapinya sendiri, tapi SSL Labs akan menulis "Chain issues: Incomplete" dan membatasi grade di B. + +Kalau memakai installer Certbot (`certbot --apache` tanpa `certonly`), ia menambahkan `Include /etc/letsencrypt/options-ssl-apache.conf` di dalam virtual host. File itu mengatur protokol dan cipher sendiri, dan karena letaknya di virtual host, ia mengalahkan file global dari Langkah 2. Hapus baris include itu, tapi lihat dulu apa lagi yang diatur file tersebut: [`options-ssl-apache.conf`](https://github.com/certbot/certbot/blob/main/certbot/src/certbot/_internal/plugins/apache/tls_configs/current-options-ssl-apache.conf) versi sekarang diawali `SSLEngine on`. Cek dengan `grep -n SSLEngine /etc/letsencrypt/options-ssl-apache.conf` dan, kalau ada, tambahkan `SSLEngine on` ke virtual host itu sendiri. Tanpa baris itu, Apache melayani HTTP biasa di port 443 tanpa pesan error. + +## Langkah 2: Aktifkan modul dan atur TLS secara global + +Aktifkan modul yang dipakai di tulisan ini: + +```bash +sudo a2enmod ssl headers rewrite http2 +``` + +`a2enmod ssl` sekaligus mengaktifkan `socache_shmcb` untuk session cache. Di Debian 13, `/etc/apache2/mods-available/ssl.conf` bawaan lalu berisi baris-baris ini (komentar dibuang): + +```apache +SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000) +SSLSessionCacheTimeout 300 +SSLCipherSuite HIGH:!aNULL +SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +SSLSessionTickets off +``` + +Protokolnya sudah benar. Daftar cipher-nya yang terlalu longgar. Dengan pengaturan bawaan saja, server tes masih menerima suite CBC, key exchange RSA biasa tanpa forward secrecy, dan DHE: + +```text +-cipher 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' -> Cipher is ECDHE-ECDSA-AES128-SHA +-cipher 'AES256-GCM-SHA384' -> Cipher is AES256-GCM-SHA384 +-cipher 'DHE-RSA-AES256-GCM-SHA384' -> Cipher is DHE-RSA-AES256-GCM-SHA384 +``` + +SSL Labs menandai suite CBC dan RSA biasa dengan label WEAK di daftar cipher-nya, dan TLSRef tidak memasukkan DHE sama sekali. Tidak ada alasan untuk tetap menawarkan semuanya. Rilis lain bisa punya nilai bawaan berbeda, jadi cek punya Anda dengan `grep -v '^\s*#' /etc/apache2/mods-available/ssl.conf`. + +Biarkan `ssl.conf` apa adanya, lalu taruh pengaturan di `/etc/apache2/conf-available/tls.conf`: + +```apache +# Pengaturan TLS untuk semua virtual host HTTPS (konteks server config) +SSLProtocol -all +TLSv1.2 +TLSv1.3 + +# OpenSSL 3.5+: grup hybrid post-quantum di depan. +# Di OpenSSL 3.0-3.4, hapus X25519MLKEM768 dari daftar ini. +SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1:secp384r1 + +# TLS 1.2: hanya key exchange ECDHE + AEAD. TLS 1.3: tiga suite standar. +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 +SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 +SSLHonorCipherOrder off +SSLSessionTickets off +``` + +Aktifkan: + +```bash +sudo a2enconf tls +``` + +`apache2.conf` di Debian membaca `mods-enabled/*.conf` lebih dulu dan `conf-enabled/*.conf` belakangan. Untuk directive-directive ini, nilai global yang datang belakangan menggantikan yang sebelumnya, jadi `tls.conf` menang atas `ssl.conf` tanpa perlu mengedit file itu. Di server tes, ketiga suite lemah di atas ditolak begitu `tls.conf` aktif. + +Penjelasan per baris: + +- **`SSLProtocol -all +TLSv1.2 +TLSv1.3`** mulai dari kosong dan hanya mengizinkan TLS 1.2 dan 1.3. TLS 1.0 atau 1.1 membuat grade mentok di B; tanpa TLS 1.3 mentok di A-. +- **`SSLOpenSSLConfCmd Curves`** meneruskan daftar grup key exchange ke OpenSSL. Daftarnya diambil dari [TLSRef guideline 6.0](https://data.tlsref.org/guidelines/6.0.json), penerus Server Side TLS guidelines dari Mozilla, dan sama dengan yang dihasilkan [TLSRef Configurator](https://configurator.tlsref.org/) untuk Apache. `X25519MLKEM768` menggabungkan X25519 dengan algoritma post-quantum ML-KEM; klien yang belum mendukungnya turun ke X25519. +- **`SSLCipherSuite` pertama** hanya berisi suite ECDHE dengan GCM atau ChaCha20-Poly1305: forward secrecy dan AEAD, tidak ada yang lain. Menurut TLSRef, klien tertua yang masih bisa tersambung adalah Firefox 31, Chrome 49, Safari 9, Android 4.4.2, IE 11 di Windows 10, dan Java 8u161. +- **`SSLCipherSuite TLSv1.3 ...`** mengatur suite TLS 1.3. Ketiganya memang default OpenSSL; baris ini membuatnya eksplisit. +- **`SSLHonorCipherOrder off`** membiarkan klien memilih dari daftar. Semua pilihan sudah kuat, dan ponsel tanpa akselerasi AES di hardware akan memilih ChaCha20. +- **`SSLSessionTickets off`**. Dokumentasi mod_ssl memperingatkan bahwa ticket yang dipakai tanpa me-restart web server secara berkala (misalnya harian) merusak forward secrecy. Apache tidak merotasi key ticket sendiri, jadi TLSRef mematikannya. Session resumption tetap jalan lewat session cache `shmcb` dari `ssl.conf`. +- **Tanpa parameter DH.** Daftar cipher tidak berisi suite DHE, jadi parameter DH tidak perlu ditambahkan ke file sertifikat. + +## Langkah 3: Virtual host, HSTS, dan redirect HTTP + +Buat `/etc/apache2/sites-available/example.com.conf`: + +```apache + + ServerName example.com + ServerAlias www.example.com + + RewriteEngine On + RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ + RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=308,QSA,L] + + + + ServerName example.com + ServerAlias www.example.com + DocumentRoot /var/www/example.com + + SSLEngine on + SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem + + Protocols h2 http/1.1 + + # HSTS: 2 tahun. "always" juga mengirimnya di redirect dan halaman error. + Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" + +``` + +Lalu aktifkan site-nya dan reload: + +```bash +sudo a2ensite example.com +sudo apache2ctl configtest && sudo systemctl reload apache2 +``` + +Baris `RewriteCond` membiarkan `/.well-known/acme-challenge/` tetap di HTTP biasa, supaya validasi HTTP-01 Let's Encrypt dijawab langsung di port 80, tanpa bergantung pada redirect dan konfigurasi HTTPS. Redirect-nya 308, sama dengan config TLSRef. + +### Kenapa harus `Header always set` + +`mod_headers` menyimpan dua daftar header respons. Daftar default (`onsuccess`) dipakai untuk respons normal; [dokumentasi mod_headers](https://httpd.apache.org/docs/2.4/mod/mod_headers.html#header) menyebut bahwa untuk respons non-2xx yang dibuat server sendiri, seperti redirect, hanya daftar `always` yang dipakai. + +Di server tes, dengan `Header set` alih-alih `Header always set` dan baris `Redirect 302 /old /` di virtual host `*:443`: + +```text +GET / -> HTTP/2 200 strict-transport-security: max-age=63072000; includeSubDomains +GET /old -> HTTP/2 302 (tanpa header HSTS) +GET /nope -> HTTP/2 404 (tanpa header HSTS) +``` + +Dengan `Header always set`, ketiga respons membawa header itu. Ini paling terasa kalau halaman utama Anda me-redirect, misalnya `/` ke `/en/` atau ke halaman login: respons HTTPS pertama yang diterima pengunjung adalah redirect itu, dan tanpa `always` ia tidak membawa HSTS. + +Catatan HSTS lainnya: + +- **`max-age=63072000`** sama dengan dua tahun, nilai dari TLSRef. SSL Labs butuh minimal 15768000 (enam bulan) untuk A+. +- **`includeSubDomains`** membuat semua subdomain wajib HTTPS di browser yang pernah menerima header ini. Jangan dipasang sebelum itu benar untuk semua subdomain. +- Header ini hanya di virtual host `*:443`. Browser mengabaikan HSTS lewat HTTP biasa, dan [RFC 6797 bagian 7.2](https://www.rfc-editor.org/rfc/rfc6797#section-7.2) melarang server mengirimnya di sana. + +Apache tidak punya masalah pewarisan `add_header` seperti nginx. `Header set Cache-Control ...` di dalam blok `` ditambahkan ke header dari virtual host; di server tes, header HSTS tetap ada di respons tersebut. + +## Langkah 4: Waspadai virtual host yang menimpa pengaturan global + +`tls.conf` mengatur nilai default untuk seluruh server. Virtual host yang punya `SSLProtocol`, `SSLCipherSuite` sendiri, atau meng-`Include` file yang mengaturnya, akan memakai nilai itu. Sejak Apache 2.4.42 dengan OpenSSL 1.1.1 ke atas, [dokumentasi SSLProtocol](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol) menyebut `SSLProtocol` milik tiap virtual host name-based dihormati kalau klien mengirim SNI. Sebelum itu, protokol dari virtual host pertama di IP dan port tersebut berlaku untuk semuanya. + +Cari semua tempat yang mengatur opsi TLS: + +```bash +grep -rn -e SSLProtocol -e SSLCipherSuite -e SSLHonorCipherOrder -e options-ssl-apache /etc/apache2/ +apache2ctl -S +``` + +Perintah pertama seharusnya hanya menampilkan `mods-available/ssl.conf` dan `tls.conf` Anda. Perintah kedua menunjukkan virtual host mana yang menjawab di alamat mana, berguna kalau SSL Labs memberi nilai berbeda untuk IP yang berbeda. + +## Langkah 5: OCSP stapling dan Let's Encrypt + +`SSLUseStapling` mati secara default di Apache, dan untuk sertifikat Let's Encrypt sebaiknya tetap begitu. Let's Encrypt [menghentikan dukungan OCSP](https://letsencrypt.org/2024/12/05/ending-ocsp/): sejak 7 Mei 2025 sertifikatnya tidak lagi memuat URL OCSP, dan responder-nya dimatikan pada 6 Agustus 2025. Tidak ada yang bisa di-staple. (Tulisan saya tahun 2015, [OCSP Stapling di nginx]({% post_url 2015-04-12-ocsp-stapling-di-nginx %}), ditulis sebelum perubahan ini.) OCSP stapling juga tidak memengaruhi grade SSL Labs. + +Untuk sertifikat dari CA yang masih menjalankan OCSP, aktifkan di server config (di luar ``), misalnya di akhir `tls.conf`: + +```apache +SSLUseStapling on +SSLStaplingCache "shmcb:${APACHE_RUN_DIR}/ssl_stapling(32768)" +``` + +## Langkah 6: Jebakan configtest + +`apache2ctl configtest` hanya mengecek sintaks, bukan apakah OpenSSL menerima nilai yang Anda tulis. Di server tes, nama kurva yang tidak dikenal OpenSSL lolos cek sintaks lalu menghentikan Apache: + +```text +$ apache2ctl configtest +Syntax OK +$ apache2ctl graceful +# error log: +[ssl:emerg] AH02407: "SSLOpenSSLConfCmd Curves FakeGroup999:X25519:prime256v1:secp384r1" failed for example.test:443 +[ssl:emerg] AH02312: Fatal error initialising mod_ssl, exiting. +[:emerg] AH00020: Configuration Failed, exiting +``` + +Graceful reload tidak menyelamatkan Anda di sini. Setelah reload itu, tidak ada satu pun proses Apache yang tersisa, jadi HTTP biasa ikut mati. OpenSSL sebelum 3.5 tidak mengenal `X25519MLKEM768`, jadi nama itu bisa memicu kegagalan yang sama. + +Karena itu, cek nama grup ke OpenSSL sebelum reload. Di server tes (OpenSSL 3.5.7): + +```bash +openssl list -tls-groups | tr ':' '\n' | grep -x X25519MLKEM768 +``` + +Kalau tidak ada output, atau `openssl` Anda tidak mengenal opsi `-tls-groups`, hapus `X25519MLKEM768` dari `tls.conf`. Debian dan Ubuntu membangun Apache dengan OpenSSL sistem, jadi perintah `openssl` mengecek library yang sama; untuk build sendiri, bandingkan dengan versi di baris log saat Apache start. Setiap kali mengubah TLS, reload lalu pastikan situs masih menjawab (`curl -sI https://example.com/`) sebelum logout. + +## Langkah 7: Uji di lokal, lalu jalankan SSL Labs + +Ganti `example.com` dengan host Anda: + +```bash +# TLS 1.1 harus ditolak. SECLEVEL=0 supaya klien modern mau mencobanya. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' &1 | grep -E 'alert|Cipher is' + +# TLS 1.3 harus jalan. Dengan OpenSSL 3.5+ di kedua sisi, grupnya X25519MLKEM768. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_3 &1 | grep -E 'Negotiated TLS1.3 group|Cipher is' + +# Suite CBC, RSA biasa, dan DHE harus ditolak. +for c in 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384; do + openssl s_client -connect example.com:443 -servername example.com -tls1_2 \ + -cipher "$c" &1 | grep -E 'alert|Cipher is' | head -1 +done + +# Full chain: server harus mengirim minimal 2 sertifikat (milik Anda + intermediate). +openssl s_client -connect example.com:443 -servername example.com -showcerts /dev/null | grep -c 'BEGIN CERTIFICATE' + +# HSTS di halaman normal dan halaman error, plus redirect HTTP. +curl -sI https://example.com/ | grep -i strict-transport-security +curl -sI https://example.com/does-not-exist | grep -i -e '^HTTP' -e strict-transport-security +curl -sI http://example.com/ | grep -i -e '^HTTP' -e '^location' +``` + +Di server tes, hasilnya seperti ini (diringkas): + +```text +tls1_1 : tlsv1 alert protocol version ... Cipher is (NONE) +tls1_3 : Negotiated TLS1.3 group: X25519MLKEM768 + New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 +CBC : ssl/tls alert handshake failure +RSA : ssl/tls alert handshake failure +DHE : ssl/tls alert handshake failure +404 : HTTP/2 404 + strict-transport-security: max-age=63072000; includeSubDomains +HTTP : HTTP/1.1 308 Permanent Redirect +``` + +Setelah itu buka [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest/), masukkan hostname, dan centang "Do not show the results on the boards" kalau tidak ingin hasilnya tampil di daftar publik. Setelah mengubah konfigurasi, klik "Clear cache" di halaman hasil supaya scan diulang. + +## Troubleshooting: arti pesan di laporan dan cara memperbaikinya + +| Yang muncul | Penyebab | Perbaikan | +|---|---|---| +| Grade B, "This server supports TLS 1.0 and TLS 1.1" | Ada virtual host atau include yang mengatur `SSLProtocol` sendiri | Jalankan `grep` dari Langkah 4; hapus pengaturan itu | +| Suite WEAK (CBC, `TLS_RSA_*`) di daftar cipher | `SSLCipherSuite` bawaan distro, atau pengaturan di virtual host | Aktifkan `tls.conf`; cek dengan `grep` dari Langkah 4 | +| Grade B, "Chain issues: Incomplete" | `SSLCertificateFile` mengarah ke `cert.pem` | Pakai `fullchain.pem` | +| Grade A-, "This server does not support TLS 1.3" | Apache sebelum 2.4.37, OpenSSL sebelum 1.1.1, atau `SSLProtocol` tanpa `+TLSv1.3` | Upgrade; cek kedua versi di baris log saat Apache start | +| Grade A-, HSTS tidak terdeteksi padahal sudah dipasang | `mod_headers` belum aktif, header dipasang di virtual host yang salah, atau `Header set` tanpa `always` di halaman yang me-redirect | `a2enmod headers`; pasang `Header always set` di virtual host `*:443` | +| `Invalid command 'Header'` atau `'RewriteEngine'` | Modul belum aktif | `a2enmod headers rewrite` | +| Apache berhenti setelah reload padahal `configtest` bilang Syntax OK (`AH02407`, `AH02312`) | OpenSSL menolak suatu nilai, sering `X25519MLKEM768` di OpenSSL sebelum 3.5 | Hapus grup itu, start Apache lagi; lihat Langkah 6 | +| A+ di satu IP, A- di IP lain | IPv6 dilayani virtual host atau mesin lain | Cek `apache2ctl -S` dan record AAAA | +| Grade tidak berubah walau Apache sudah diubah | Yang diuji CDN, bukan server Anda | Lihat di bawah | + +**Pakai Cloudflare atau CDN lain?** Kalau proxy aktif, SSL Labs menguji edge CDN, bukan Apache Anda. Grade-nya bergantung pada pengaturan CDN (versi TLS minimum, TLS 1.3, HSTS). Tetap pasang konfigurasi di atas di server origin dan pakai mode "Full (strict)" di Cloudflare supaya koneksi ke server Anda juga diverifikasi. + +## Opsional: HSTS preload + +HSTS preload memasukkan domain Anda ke daftar yang ditanam di dalam browser. SSL Labs tidak mensyaratkannya untuk A+. [hstspreload.org](https://hstspreload.org/) mensyaratkan `max-age` minimal satu tahun, `includeSubDomains`, `preload`, HTTPS di semua subdomain, dan redirect HTTP ke HTTPS di host yang sama. Keluar dari daftar itu butuh berbulan-bulan sampai ke pengguna, jadi daftarkan hanya domain yang pasti tetap HTTPS-only di semua subdomain. + +```apache +Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" +``` + +## Konfigurasi lengkap + +```apache +# /etc/apache2/conf-available/tls.conf (a2enconf tls) +SSLProtocol -all +TLSv1.2 +TLSv1.3 +SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1:secp384r1 +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 +SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 +SSLHonorCipherOrder off +SSLSessionTickets off +``` + +```apache +# /etc/apache2/sites-available/example.com.conf (a2ensite example.com) + + ServerName example.com + ServerAlias www.example.com + RewriteEngine On + RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ + RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=308,QSA,L] + + + + ServerName example.com + ServerAlias www.example.com + DocumentRoot /var/www/example.com + SSLEngine on + SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem + Protocols h2 http/1.1 + Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" + +``` + +Modul: `a2enmod ssl headers rewrite http2`. + +Untuk melayani sertifikat ECDSA dan RSA sekaligus, ulangi pasangan sertifikat di virtual host yang sama; mod_ssl memilih yang cocok untuk tiap klien: + +```apache +# Pasangan ECDSA, dari Langkah 1 +SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem +# Pasangan RSA +SSLCertificateFile /etc/letsencrypt/live/example.com-rsa/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com-rsa/privkey.pem +``` + +Di server tes, klien TLS 1.2 yang hanya menawarkan `ECDHE-RSA-AES128-GCM-SHA256` menerima sertifikat RSA 2048 bit, sementara klien lain mendapat ECDSA. Dengan Certbot, jalankan sekali lagi dengan `--key-type rsa --cert-name example.com-rsa` untuk mendapat pasangan RSA. + +*Mahyuddin Susanto adalah sysadmin Linux dan jaringan yang mengelola server sendiri dan menulis soal Apache di blog ini sejak 2007, dimulai dari [Apache server dengan module OpenSSL]({% post_url 2007-09-27-apache-server-dengan-module-openssl %}). [Tentang penulis](/about) · [Kontak](/contact)* + +## Sumber + +- Qualys SSL Labs, [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), versi 2009r, 16 Mei 2025 +- TLSRef, [Server Side TLS guideline 6.0](https://data.tlsref.org/guidelines/6.0.json) dan [TLS Configurator](https://configurator.tlsref.org/) +- Apache HTTP Server 2.4, [mod_ssl](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html) dan [mod_headers](https://httpd.apache.org/docs/2.4/mod/mod_headers.html) +- Let's Encrypt, [Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) +- [HSTS Preload List Submission](https://hstspreload.org/) +- IETF, [RFC 6797: HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797) diff --git a/_posts/2026-11-05-ssl-labs-a-plus-apache.md b/_posts/2026-11-05-ssl-labs-a-plus-apache.md new file mode 100644 index 0000000..976e31c --- /dev/null +++ b/_posts/2026-11-05-ssl-labs-a-plus-apache.md @@ -0,0 +1,390 @@ +--- +layout: post +title: "How to Get an A+ on SSL Labs with Apache httpd (2026 Guide)" +description: "Apache mod_ssl config for an A+ on the Qualys SSL Labs test: TLS 1.3, ECDHE ciphers, full chain, HSTS with Header always, and the configtest trap." +image: "/img/ssl-labs-a-plus-apache.png" +date: 2026-11-05 +categories: + - Linux +tags: + - apache + - tls + - ssl + - security + - hsts +--- + +To get an A+ on the [Qualys SSL Labs server test](https://www.ssllabs.com/ssltest/) with Apache httpd, you need the same five things as on any web server: TLS 1.2 and TLS 1.3 only, ECDHE key exchange with AEAD ciphers (GCM or ChaCha20-Poly1305), a certificate served with its full chain, an HSTS header with a `max-age` of at least six months, and the same setup on every IP address your hostname resolves to. On Apache, two details decide whether you get there: the HSTS header needs `Header always set`, not `Header set`, and a virtual host with its own `SSLProtocol` or `SSLCipherSuite` silently overrides your global settings. + +This guide gives you a config you can paste into a Debian or Ubuntu Apache, explains each line, and shows how to check the result before you run SSL Labs. + +The configuration below was tested on Apache 2.4.69 with OpenSSL 3.5.7, using the stock Debian 13 `/etc/apache2` layout with the modules, `tls.conf` and site file from this guide enabled, and checked with `openssl s_client` and `curl`. + +**Baca dalam Bahasa Indonesia:** [Cara Mendapat A+ di SSL Labs dengan Apache]({% post_url 2026-11-05-ssl-labs-a-plus-apache-id %}). Running nginx? See [How to Get an A+ on SSL Labs with nginx]({% post_url 2026-11-05-ssl-labs-a-plus-nginx %}). + +![SSL Labs grade ladder for Apache: what caps a server at B or A-, and what an A+ needs](/img/ssl-labs-a-plus-apache.png) + +
+Contents + +* TOC +{:toc} +
+ +## How SSL Labs grades your server + +SSL Labs scores protocol support (30%), key exchange (30%) and cipher strength (40%), then applies caps for specific problems. The A+ is a bonus on top of an A with no warnings. The current rules are version 2009r of the [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), dated 16 May 2025. The caps that matter for a typical Apache server: + +| Problem | Grade limit | +|---|---| +| SSLv2, SSLv3 as the best protocol, export ciphers, Heartbleed-class bugs | F | +| TLS 1.2 not supported | C | +| TLS 1.0 or TLS 1.1 enabled | B | +| No forward secrecy (no ECDHE/DHE) | B | +| No AEAD cipher (GCM or ChaCha20-Poly1305) | B | +| Incomplete certificate chain | B | +| Key or DH parameters under 2048 bits | B | +| TLS 1.3 not supported | A- | +| HSTS missing or invalid | A- | + +For the A+, the guide asks for a configuration with no warnings and HSTS with a `max-age` of at least six months (15768000 seconds). Since the May 2025 revision, a plain A needs both TLS 1.3 and a valid HSTS header, and `TLS_FALLBACK_SCSV` no longer counts. + +An ECDSA P-256 or RSA 2048 certificate is enough. It scores 90 on key exchange and still gets an A+. + +## Check your Apache and OpenSSL versions first + +```bash +apache2 -v +apache2ctl -M | grep -e ssl -e headers -e rewrite -e http2 +``` + +The OpenSSL version that Apache uses is printed in the error log at startup, in a line like `Apache/2.4.69 (Debian) OpenSSL/3.5.7 configured -- resuming normal operations`. + +| Feature | Needs | +|---|---| +| TLS 1.3 (and the `SSLCipherSuite TLSv1.3 ...` line) | Apache 2.4.37+ with OpenSSL 1.1.1+ (TLS 1.3 support is listed under 2.4.36, which was never released) | +| Intermediates in `SSLCertificateFile` (no `SSLCertificateChainFile`) | Apache 2.4.8+ | +| `SSLOpenSSLConfCmd` (used here to set curves) | Apache 2.4.8+ with OpenSSL 1.0.2+ | +| `Protocols h2 http/1.1` (HTTP/2) | Apache 2.4.17+ | +| Per-virtual-host `SSLProtocol` honored with SNI | Apache 2.4.42+ with OpenSSL 1.1.1+ | +| Hybrid post-quantum group `X25519MLKEM768` | OpenSSL 3.5+ | + +## Step 1: Get a certificate and serve the full chain + +With Let's Encrypt and Certbot, get the certificate only and write the TLS config yourself: + +```bash +sudo certbot certonly --apache -d example.com -d www.example.com +``` + +Certbot 2.0 and newer create an ECDSA key by default. + +Point Apache at `fullchain.pem`: + +```apache +SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem +``` + +Since Apache 2.4.8, `SSLCertificateFile` can hold the intermediate certificates after your own certificate, and the [mod_ssl documentation](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcertificatefile) marks `SSLCertificateChainFile` as obsolete. If you point `SSLCertificateFile` at `cert.pem` and drop the chain file, the intermediate is missing. Browsers often fill it in themselves, but SSL Labs reports "Chain issues: Incomplete" and caps the grade at B. + +If you use Certbot's installer (`certbot --apache` without `certonly`), it adds `Include /etc/letsencrypt/options-ssl-apache.conf` inside your virtual host. That file sets its own protocols and ciphers, and because it sits in the virtual host, it wins over the global file from Step 2. Remove the include, but first look at what else the file sets: the current [`options-ssl-apache.conf`](https://github.com/certbot/certbot/blob/main/certbot/src/certbot/_internal/plugins/apache/tls_configs/current-options-ssl-apache.conf) starts with `SSLEngine on`. Check with `grep -n SSLEngine /etc/letsencrypt/options-ssl-apache.conf` and, if it is there, add `SSLEngine on` to the virtual host itself. Without it, Apache serves plain HTTP on port 443 and reports no error. + +## Step 2: Enable the modules and set TLS globally + +Enable the modules this guide uses: + +```bash +sudo a2enmod ssl headers rewrite http2 +``` + +`a2enmod ssl` also enables `socache_shmcb` for the session cache. On Debian 13, the stock `/etc/apache2/mods-available/ssl.conf` then contains these lines (comments removed): + +```apache +SSLSessionCache shmcb:${APACHE_RUN_DIR}/ssl_scache(512000) +SSLSessionCacheTimeout 300 +SSLCipherSuite HIGH:!aNULL +SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +SSLSessionTickets off +``` + +The protocols are already fine. The cipher list is wider than it needs to be. With only these defaults, the test server accepted CBC suites, plain RSA key exchange without forward secrecy, and DHE: + +```text +-cipher 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' -> Cipher is ECDHE-ECDSA-AES128-SHA +-cipher 'AES256-GCM-SHA384' -> Cipher is AES256-GCM-SHA384 +-cipher 'DHE-RSA-AES256-GCM-SHA384' -> Cipher is DHE-RSA-AES256-GCM-SHA384 +``` + +SSL Labs marks CBC and plain RSA suites as WEAK in its cipher list, and TLSRef leaves DHE out entirely. There is no reason to keep offering any of them. Other releases may ship different defaults, so check yours with `grep -v '^\s*#' /etc/apache2/mods-available/ssl.conf`. + +Leave `ssl.conf` as it is and put your settings in `/etc/apache2/conf-available/tls.conf`: + +```apache +# TLS settings for every HTTPS virtual host (server config context) +SSLProtocol -all +TLSv1.2 +TLSv1.3 + +# OpenSSL 3.5+: hybrid post-quantum group first. +# On OpenSSL 3.0-3.4, remove X25519MLKEM768 from this list. +SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1:secp384r1 + +# TLS 1.2: ECDHE key exchange + AEAD only. TLS 1.3: the three standard suites. +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 +SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 +SSLHonorCipherOrder off +SSLSessionTickets off +``` + +Enable it: + +```bash +sudo a2enconf tls +``` + +Debian's `apache2.conf` reads `mods-enabled/*.conf` first and `conf-enabled/*.conf` later. For these directives, the later global value replaces the earlier one, so `tls.conf` wins over `ssl.conf` without any edits there. On the test server, the three weak suites above were refused once `tls.conf` was enabled. + +Line by line: + +- **`SSLProtocol -all +TLSv1.2 +TLSv1.3`** starts from nothing and allows only TLS 1.2 and 1.3. TLS 1.0 or 1.1 would cap you at B; missing TLS 1.3 caps you at A-. +- **`SSLOpenSSLConfCmd Curves`** passes the key exchange groups to OpenSSL. The list comes from the [TLSRef guideline 6.0](https://data.tlsref.org/guidelines/6.0.json), the successor of Mozilla's Server Side TLS guidelines, and matches what the [TLSRef Configurator](https://configurator.tlsref.org/) generates for Apache. `X25519MLKEM768` combines X25519 with the ML-KEM post-quantum algorithm; clients without it fall back to X25519. +- **The first `SSLCipherSuite`** lists only ECDHE suites with GCM or ChaCha20-Poly1305: forward secrecy and AEAD, nothing else. TLSRef lists the oldest clients this still serves as Firefox 31, Chrome 49, Safari 9, Android 4.4.2, IE 11 on Windows 10 and Java 8u161. +- **`SSLCipherSuite TLSv1.3 ...`** sets the TLS 1.3 suites. These three are OpenSSL's defaults anyway; the line makes them explicit. +- **`SSLHonorCipherOrder off`** lets the client choose from the list. Every option is strong, and phones without AES hardware pick ChaCha20. +- **`SSLSessionTickets off`**. The mod_ssl documentation warns that tickets used "without restarting the web server with an appropriate frequency (e.g. daily)" compromise forward secrecy. Apache does not rotate the ticket key on its own, so TLSRef turns tickets off. Session resumption still works through the `shmcb` session cache from `ssl.conf`. +- **No DH parameters.** The list has no DHE suites, so you do not need to append DH parameters to the certificate file. + +## Step 3: The virtual hosts, HSTS and the HTTP redirect + +Create `/etc/apache2/sites-available/example.com.conf`: + +```apache + + ServerName example.com + ServerAlias www.example.com + + RewriteEngine On + RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ + RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=308,QSA,L] + + + + ServerName example.com + ServerAlias www.example.com + DocumentRoot /var/www/example.com + + SSLEngine on + SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem + + Protocols h2 http/1.1 + + # HSTS: 2 years. "always" also sends it on redirects and error pages. + Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" + +``` + +Then enable the site and reload: + +```bash +sudo a2ensite example.com +sudo apache2ctl configtest && sudo systemctl reload apache2 +``` + +The `RewriteCond` line keeps `/.well-known/acme-challenge/` on plain HTTP, so Let's Encrypt HTTP-01 validation is answered directly on port 80 and does not depend on the redirect or the HTTPS setup. The redirect is a 308, as in the TLSRef config. + +### Why `Header always set` matters + +`mod_headers` keeps two lists of response headers. The default one (`onsuccess`) is used for normal responses; the [mod_headers documentation](https://httpd.apache.org/docs/2.4/mod/mod_headers.html#header) says that for a locally generated non-2xx response, "such as a redirect", only the `always` list is used. + +On the test server, with `Header set` instead of `Header always set` and a `Redirect 302 /old /` line in the `*:443` virtual host: + +```text +GET / -> HTTP/2 200 strict-transport-security: max-age=63072000; includeSubDomains +GET /old -> HTTP/2 302 (no HSTS header) +GET /nope -> HTTP/2 404 (no HSTS header) +``` + +With `Header always set`, all three responses carried the header. This matters most when your home page redirects, for example `/` to `/en/` or to a login page: the first HTTPS response a visitor gets is that redirect, and without `always` it has no HSTS header. + +Other HSTS notes: + +- **`max-age=63072000`** is two years, the TLSRef value. SSL Labs needs at least 15768000 (six months) for the A+. +- **`includeSubDomains`** makes every subdomain HTTPS-only in browsers that have seen the header. Leave it out until that is true for all of them. +- The header belongs only in the `*:443` virtual host. Browsers ignore HSTS on plain HTTP, and [RFC 6797, section 7.2](https://www.rfc-editor.org/rfc/rfc6797#section-7.2) says servers must not send it there. + +Apache does not have nginx's `add_header` inheritance problem. A `Header set Cache-Control ...` inside a `` block is added to the headers from the virtual host; on the test server the HSTS header stayed on those responses. + +## Step 4: Watch for virtual hosts that override the global settings + +`tls.conf` sets the server-wide default. Any virtual host that has its own `SSLProtocol`, `SSLCipherSuite` or an `Include` of a file that sets them uses those values instead. Since Apache 2.4.42 with OpenSSL 1.1.1 or newer, the [SSLProtocol documentation](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocol) says each name-based virtual host's own `SSLProtocol` is honored when the client sends SNI. Before that, the protocol of the first virtual host on the IP and port applied to all of them. + +Find every place that sets TLS options: + +```bash +grep -rn -e SSLProtocol -e SSLCipherSuite -e SSLHonorCipherOrder -e options-ssl-apache /etc/apache2/ +apache2ctl -S +``` + +The first command should show only `mods-available/ssl.conf` and your `tls.conf`. The second lists which virtual host answers on which address, which helps when SSL Labs grades one IP differently from another. + +## Step 5: OCSP stapling and Let's Encrypt + +`SSLUseStapling` is off by default in Apache, and for Let's Encrypt certificates it should stay off. Let's Encrypt [ended OCSP support](https://letsencrypt.org/2024/12/05/ending-ocsp/): from 7 May 2025 its certificates no longer contain an OCSP URL, and the responders were switched off on 6 August 2025. There is nothing to staple. (My 2015 post on [OCSP stapling in nginx]({% post_url 2015-04-12-ocsp-stapling-di-nginx %}) predates this change.) OCSP stapling has no effect on the SSL Labs grade. + +For a certificate from a CA that still runs OCSP, enable it in the server config (outside any ``), for example at the end of `tls.conf`: + +```apache +SSLUseStapling on +SSLStaplingCache "shmcb:${APACHE_RUN_DIR}/ssl_stapling(32768)" +``` + +## Step 6: The configtest trap + +`apache2ctl configtest` checks the syntax, not whether OpenSSL accepts your values. On the test server, a curve name that OpenSSL does not know passed the syntax check and then stopped Apache: + +```text +$ apache2ctl configtest +Syntax OK +$ apache2ctl graceful +# error log: +[ssl:emerg] AH02407: "SSLOpenSSLConfCmd Curves FakeGroup999:X25519:prime256v1:secp384r1" failed for example.test:443 +[ssl:emerg] AH02312: Fatal error initialising mod_ssl, exiting. +[:emerg] AH00020: Configuration Failed, exiting +``` + +A graceful reload does not protect you here. After that reload, no Apache process was left running, so plain HTTP was down too. OpenSSL older than 3.5 does not know `X25519MLKEM768`, so that name can cause the same failure there. + +So check the group names against OpenSSL before you reload. On the test server (OpenSSL 3.5.7): + +```bash +openssl list -tls-groups | tr ':' '\n' | grep -x X25519MLKEM768 +``` + +If that prints nothing, or your `openssl` does not know the `-tls-groups` option, remove `X25519MLKEM768` from `tls.conf`. Debian and Ubuntu build Apache against the system OpenSSL, so the `openssl` command checks the same library; on a custom build, compare with the version in Apache's startup log line. After any TLS change, reload and then confirm the site still answers (`curl -sI https://example.com/`) before you log out. + +## Step 7: Test locally, then run SSL Labs + +Replace `example.com` with your host: + +```bash +# TLS 1.1 must be refused. SECLEVEL=0 lets a modern client even try it. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' &1 | grep -E 'alert|Cipher is' + +# TLS 1.3 must work. With OpenSSL 3.5+ on both sides the group is X25519MLKEM768. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_3 &1 | grep -E 'Negotiated TLS1.3 group|Cipher is' + +# CBC, plain RSA and DHE suites must be refused. +for c in 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' AES256-GCM-SHA384 DHE-RSA-AES256-GCM-SHA384; do + openssl s_client -connect example.com:443 -servername example.com -tls1_2 \ + -cipher "$c" &1 | grep -E 'alert|Cipher is' | head -1 +done + +# Full chain: the server must send at least 2 certificates (yours + intermediate). +openssl s_client -connect example.com:443 -servername example.com -showcerts /dev/null | grep -c 'BEGIN CERTIFICATE' + +# HSTS on a normal page and on an error page, plus the HTTP redirect. +curl -sI https://example.com/ | grep -i strict-transport-security +curl -sI https://example.com/does-not-exist | grep -i -e '^HTTP' -e strict-transport-security +curl -sI http://example.com/ | grep -i -e '^HTTP' -e '^location' +``` + +On the test setup, the output looked like this (condensed): + +```text +tls1_1 : tlsv1 alert protocol version ... Cipher is (NONE) +tls1_3 : Negotiated TLS1.3 group: X25519MLKEM768 + New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 +CBC : ssl/tls alert handshake failure +RSA : ssl/tls alert handshake failure +DHE : ssl/tls alert handshake failure +404 : HTTP/2 404 + strict-transport-security: max-age=63072000; includeSubDomains +HTTP : HTTP/1.1 308 Permanent Redirect +``` + +Then open [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest/), enter your hostname, and tick "Do not show the results on the boards" if you do not want the result listed. After a config change, use "Clear cache" on the results page to force a new scan. + +## Troubleshooting: what the report says and how to fix it + +| What you see | Cause | Fix | +|---|---|---| +| Grade B, "This server supports TLS 1.0 and TLS 1.1" | A virtual host or include sets its own `SSLProtocol` | Run the `grep` from Step 4; remove the override | +| WEAK suites (CBC, `TLS_RSA_*`) in the cipher list | Distribution default `SSLCipherSuite`, or an override in a virtual host | Enable `tls.conf`; check with the `grep` from Step 4 | +| Grade B, "Chain issues: Incomplete" | `SSLCertificateFile` points to `cert.pem` | Use `fullchain.pem` | +| Grade A-, "This server does not support TLS 1.3" | Apache older than 2.4.37, OpenSSL older than 1.1.1, or `SSLProtocol` without `+TLSv1.3` | Upgrade; check both versions in the startup line of the error log | +| Grade A-, HSTS missing although it is configured | `mod_headers` not enabled, the header set in the wrong virtual host, or `Header set` without `always` on a redirecting page | `a2enmod headers`; put `Header always set` in the `*:443` virtual host | +| `Invalid command 'Header'` or `'RewriteEngine'` | Module not enabled | `a2enmod headers rewrite` | +| Apache stops after a reload although `configtest` said Syntax OK (`AH02407`, `AH02312`) | OpenSSL rejects a value, often `X25519MLKEM768` on OpenSSL older than 3.5 | Remove that group, start Apache again; see Step 6 | +| A+ on one IP, A- on another | IPv6 served by another virtual host or machine | Check `apache2ctl -S` and the AAAA record | +| Grade does not change after you edit Apache | You are testing a CDN, not your server | See below | + +**Behind Cloudflare or another CDN?** With the proxy on, SSL Labs tests the CDN's edge, not your Apache. The grade then depends on the CDN settings (minimum TLS version, TLS 1.3, HSTS). Keep the setup above on the origin and use Cloudflare's "Full (strict)" mode so the connection to your server is checked too. + +## Optional: HSTS preload + +HSTS preload puts your domain on a list built into browsers. SSL Labs does not need it for an A+. [hstspreload.org](https://hstspreload.org/) requires a `max-age` of at least one year, `includeSubDomains`, `preload`, HTTPS on every subdomain, and an HTTP to HTTPS redirect on the same host. Removal takes months to reach users, so only submit a domain that will stay HTTPS-only everywhere. + +```apache +Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" +``` + +## The complete config + +```apache +# /etc/apache2/conf-available/tls.conf (a2enconf tls) +SSLProtocol -all +TLSv1.2 +TLSv1.3 +SSLOpenSSLConfCmd Curves X25519MLKEM768:X25519:prime256v1:secp384r1 +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305 +SSLCipherSuite TLSv1.3 TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 +SSLHonorCipherOrder off +SSLSessionTickets off +``` + +```apache +# /etc/apache2/sites-available/example.com.conf (a2ensite example.com) + + ServerName example.com + ServerAlias www.example.com + RewriteEngine On + RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/ + RewriteRule ^.*$ https://%{HTTP_HOST}%{REQUEST_URI} [R=308,QSA,L] + + + + ServerName example.com + ServerAlias www.example.com + DocumentRoot /var/www/example.com + SSLEngine on + SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem + SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem + Protocols h2 http/1.1 + Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains" + +``` + +Modules: `a2enmod ssl headers rewrite http2`. + +To serve both ECDSA and RSA certificates, repeat the certificate pair in the same virtual host; mod_ssl picks the right one per client: + +```apache +# ECDSA pair, from Step 1 +SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem +# RSA pair +SSLCertificateFile /etc/letsencrypt/live/example.com-rsa/fullchain.pem +SSLCertificateKeyFile /etc/letsencrypt/live/example.com-rsa/privkey.pem +``` + +On the test server, a TLS 1.2 client that only offered `ECDHE-RSA-AES128-GCM-SHA256` received the 2048-bit RSA certificate, and other clients got ECDSA. With Certbot, run it again with `--key-type rsa --cert-name example.com-rsa` for the RSA pair. + +*Mahyuddin Susanto is a Linux and networking sysadmin who runs his own servers and has written about Apache on this blog since 2007, starting with [Apache server dengan module OpenSSL]({% post_url 2007-09-27-apache-server-dengan-module-openssl %}). [About](/about) · [Contact](/contact)* + +## Sources + +- Qualys SSL Labs, [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), version 2009r, 16 May 2025 +- TLSRef, [Server Side TLS guideline 6.0](https://data.tlsref.org/guidelines/6.0.json) and [TLS Configurator](https://configurator.tlsref.org/) +- Apache HTTP Server 2.4, [mod_ssl](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html) and [mod_headers](https://httpd.apache.org/docs/2.4/mod/mod_headers.html) +- Let's Encrypt, [Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) +- [HSTS Preload List Submission](https://hstspreload.org/) +- IETF, [RFC 6797: HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797) diff --git a/_posts/2026-11-05-ssl-labs-a-plus-nginx-id.md b/_posts/2026-11-05-ssl-labs-a-plus-nginx-id.md new file mode 100644 index 0000000..fbb7c57 --- /dev/null +++ b/_posts/2026-11-05-ssl-labs-a-plus-nginx-id.md @@ -0,0 +1,403 @@ +--- +layout: post +title: "Cara Mendapat A+ di SSL Labs dengan nginx (Panduan 2026)" +description: "Konfigurasi TLS nginx langkah demi langkah untuk nilai A+ di SSL Labs: TLS 1.3, cipher ECDHE, full chain, HSTS, perubahan OCSP, dan jebakan add_header." +image: "/img/ssl-labs-a-plus-nginx-id.png" +date: 2026-11-05 +categories: + - Linux +tags: + - nginx + - tls + - ssl + - security + - hsts +--- + +Untuk dapat A+ di [SSL Labs Server Test](https://www.ssllabs.com/ssltest/) dari Qualys dengan nginx, ada lima syarat: hanya TLS 1.2 dan TLS 1.3, cipher ECDHE dengan AEAD (GCM atau ChaCha20-Poly1305), sertifikat dikirim bersama chain lengkapnya, header HSTS dengan `max-age` minimal enam bulan, dan konfigurasi yang sama di semua alamat IP hostname tersebut. Tanpa TLS 1.3 atau tanpa HSTS, nilainya mentok di A-. Kalau TLS 1.0 atau 1.1 masih aktif, nilainya mentok di B. + +Tulisan ini membahas tiap syarat itu satu per satu, lengkap dengan konfigurasi yang bisa langsung dipakai. Ada juga dua perubahan yang bikin banyak tutorial lama jadi usang: Let's Encrypt mematikan OCSP di 2025, dan SSL Labs mengubah aturan penilaiannya di Mei 2025. + +Konfigurasi di bawah sudah diuji di nginx 1.26.3 dengan OpenSSL 3.5.7, memakai `nginx.conf` bawaan Debian 13 (dua baris SSL-nya diberi `#`) ditambah file-file dari tulisan ini, lalu dicek dengan `openssl s_client` dan `curl`. + +**Read in English:** [How to Get an A+ on SSL Labs with nginx]({% post_url 2026-11-05-ssl-labs-a-plus-nginx %}). Pakai Apache? Lihat [Cara Mendapat A+ di SSL Labs dengan Apache]({% post_url 2026-11-05-ssl-labs-a-plus-apache-id %}). + +![Tangga grade SSL Labs untuk nginx: apa yang menahan server di B atau A-, dan syarat A+](/img/ssl-labs-a-plus-nginx-id.png) + +
+Daftar isi + +* TOC +{:toc} +
+ +## Cara SSL Labs memberi nilai + +SSL Labs menilai tiga kategori: dukungan protokol (30%), key exchange (30%), dan kekuatan cipher (40%). Skor 80 ke atas berarti A. Setelah itu berlaku batas atas (cap): masalah tertentu membatasi grade setinggi apa pun skornya. A+ adalah bonus untuk server ber-grade A yang tidak punya warning. + +Aturan yang berlaku sekarang adalah versi 2009r dari [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), tertanggal 16 Mei 2025. Ini batas-batas yang relevan untuk server nginx pada umumnya: + +| Masalah | Grade maksimal | +|---|---| +| SSLv2, SSLv3 sebagai protokol terbaik, cipher export, bug sekelas Heartbleed | F | +| Tidak mendukung TLS 1.2 | C | +| TLS 1.0 atau TLS 1.1 aktif | B | +| Tanpa forward secrecy (tanpa ECDHE/DHE) | B | +| Tanpa cipher AEAD (GCM atau ChaCha20-Poly1305) | B | +| RC4 aktif | B | +| Chain sertifikat tidak lengkap | B | +| Key atau parameter DH di bawah 2048 bit | B | +| Tidak mendukung TLS 1.3 | A- | +| HSTS tidak ada atau tidak valid | A- | + +Untuk A+, panduan itu mensyaratkan konfigurasi tanpa warning dan HSTS dengan `max-age` minimal enam bulan (15768000 detik). + +Ada dua perubahan di 2025: sekadar dapat A sekarang butuh TLS 1.3 sekaligus header HSTS yang valid, dan `TLS_FALLBACK_SCSV` tidak dihitung lagi. Kalau ada artikel lama yang menyuruh mengurus fallback SCSV, bagian itu bisa dilewati. + +Nilai 100 di semua kategori tidak diperlukan. Sertifikat ECDSA P-256 atau RSA 2048 dapat 90 di key exchange, dan selama AES-128 masih ditawarkan, kekuatan cipher juga 90. Keduanya tetap dapat A+. Pindah ke RSA 4096 cuma bikin handshake lebih lambat. + +## Cek versi nginx dan OpenSSL dulu + +Beberapa directive bergantung pada versi yang terpasang: + +```bash +nginx -V 2>&1 | head -3 +openssl version +``` + +| Fitur | Butuh | +|---|---| +| TLS 1.3 (`TLSv1.3` di `ssl_protocols`) | OpenSSL 1.1.1+; jadi default sejak nginx 1.23.4 | +| `http2 on;` sebagai directive terpisah | nginx 1.25.1+ (versi lama: `listen 443 ssl http2;`) | +| Rotasi otomatis key session ticket | nginx 1.23.2+ dengan `ssl_session_cache` shared | +| Grup hybrid post-quantum `X25519MLKEM768` | OpenSSL 3.5+ | +| `add_header_inherit merge;` | nginx 1.29.3+ | + +Yang penting di output `nginx -V` adalah baris `built with OpenSSL ...`. Itu library yang benar-benar dipakai nginx, dan bisa berbeda dengan perintah `openssl` di server yang sama. + +## Langkah 1: Sertifikat dan full chain + +Sertifikat apa pun yang dipercaya publik bisa dipakai. Dengan Let's Encrypt dan Certbot, ambil sertifikatnya saja, lalu tulis konfigurasi TLS sendiri: + +```bash +sudo certbot certonly --nginx -d example.com -d www.example.com +``` + +Certbot versi baru sudah memakai key ECDSA secara default, dan itu yang dibutuhkan. Arahkan nginx ke `fullchain.pem`, bukan `cert.pem`: + +```nginx +ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; +``` + +`cert.pem` hanya berisi sertifikat leaf. Browser sering melengkapi intermediate yang hilang sendiri, jadi situs terlihat normal, tapi SSL Labs akan menulis "Chain issues: Incomplete" dan membatasi grade di B. [Dokumentasi nginx](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) juga bilang begitu: sertifikat server ditaruh paling atas di file, diikuti sertifikat intermediate. + +Kalau memakai installer Certbot (`certbot --nginx` tanpa `certonly`), ia menambahkan `include /etc/letsencrypt/options-ssl-nginx.conf;` ke server block. File itu juga mengatur protokol dan cipher. Hapus baris include tersebut supaya hanya pengaturan dari tulisan ini yang berlaku. + +## Langkah 2: Taruh pengaturan TLS di satu file bersama + +Debian dan Ubuntu memuat semua file di `/etc/nginx/conf.d/` di dalam blok `http`, jadi satu file di sana berlaku untuk semua situs HTTPS. + +Pertama, bereskan dulu baris SSL yang sudah dipasang paket di `/etc/nginx/nginx.conf`. File bawaan Debian 13 punya blok ini di dalam `http { }`: + +```nginx +## +# SSL Settings +## + +ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3 (POODLE), TLS 1.0, 1.1 +ssl_prefer_server_ciphers off; # Don't force server cipher order. +``` + +File di `conf.d/` masuk ke blok `http` yang sama, jadi baris-baris ini akan bentrok. nginx menolak `ssl_prefer_server_ciphers` kedua di level yang sama: + +```text +nginx: [emerg] "ssl_prefer_server_ciphers" directive is duplicate in /etc/nginx/conf.d/tls.conf +``` + +`ssl_protocols` kedua juga tidak menimpa yang pertama. nginx menggabungkan kedua daftar dan hanya memberi peringatan seperti `[warn] duplicate value "TLSv1.2"`, bukan error. Beri tanda `#` pada kedua baris itu (isinya bisa berbeda di rilis lain), lalu pastikan tidak ada file lain yang mengaturnya: + +```bash +grep -rn -e ssl_protocols -e ssl_prefer_server_ciphers -e ssl_ciphers /etc/nginx/ +``` + +Sekarang buat `/etc/nginx/conf.d/tls.conf`: + +```nginx +# Pengaturan TLS untuk semua server block (konteks http) +ssl_protocols TLSv1.2 TLSv1.3; + +# OpenSSL 3.5+: grup hybrid post-quantum di depan. +# Di OpenSSL 3.0-3.4, hapus X25519MLKEM768 dari daftar ini. +ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; + +# Cipher TLS 1.2: hanya key exchange ECDHE + AEAD. +# Suite TLS 1.3 diatur OpenSSL dan semuanya AEAD. +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; +ssl_prefer_server_ciphers off; + +ssl_session_timeout 1d; +ssl_session_cache shared:TLS:10m; # sekitar 40000 sesi +``` + +Penjelasan per baris: + +- **`ssl_protocols TLSv1.2 TLSv1.3`** mematikan TLS 1.0 dan 1.1 (penyebab cap B) dan mengaktifkan TLS 1.3 (tanpanya grade mentok di A-). Ini sudah default sejak nginx 1.23.4, tapi ditulis eksplisit supaya jelas. Baris ini tidak menimpa `ssl_protocols` lain di blok yang sama, karena itu baris lama tadi harus dimatikan. +- **`ssl_ecdh_curve`** menentukan grup key exchange. Daftarnya diambil dari [TLSRef guideline 6.0](https://data.tlsref.org/guidelines/6.0.json), penerus Server Side TLS guidelines dari Mozilla. `X25519MLKEM768` menggabungkan X25519 klasik dengan algoritma post-quantum ML-KEM. Klien yang belum mendukungnya otomatis turun ke X25519. +- **`ssl_ciphers`** hanya berisi suite ECDHE, yang memberi forward secrecy, dan hanya GCM atau ChaCha20-Poly1305, yang termasuk AEAD. Tidak ada CBC, tidak ada key exchange RSA, tidak ada 3DES. Menurut TLSRef, klien tertua yang masih bisa tersambung dengan profil ini adalah Firefox 31, Chrome 49, Safari 9, Android 4.4.2, IE 11 di Windows 10, dan Java 8u161. Daftar ini sekaligus menggantikan daftar cipher di tulisan saya tahun 2015, [ssl_cipher di nginx]({% post_url 2015-04-12-ssl_cipher-di-nginx %}), yang sudah usang. +- **`ssl_prefer_server_ciphers off`** membiarkan klien yang memilih. Karena semua pilihan di daftar sudah kuat, klien paling tahu mana yang cocok: ponsel tanpa akselerasi AES di hardware akan memilih ChaCha20. +- **Tanpa `ssl_dhparam`.** Daftar cipher tidak berisi suite DHE, jadi file parameter DH tidak diperlukan. Risiko lama "parameter DH di bawah 2048 bit" ikut hilang. +- **Session ticket** dibiarkan default (`on`). Sejak nginx 1.23.2, key ticket dirotasi otomatis selama `ssl_session_cache` memakai shared memory, seperti di file di atas. Karena itu TLSRef hanya menambahkan `ssl_session_tickets off;` untuk versi yang lebih lama. + +Mozilla SSL Configuration Generator sekarang dialihkan ke [TLSRef Configurator](https://configurator.tlsref.org/). File di atas sama dengan profil "Intermediate" di sana, pilihan yang tepat untuk website publik. Profil "Modern" (hanya TLS 1.3) juga dapat A+, tapi memutus klien lama seperti Android 4.4 dan IE 11. + +## Langkah 3: Server block, HSTS, dan redirect HTTP + +Sekarang konfigurasi situsnya, misalnya `/etc/nginx/sites-available/example.com` yang di-link ke `sites-enabled/`: + +```nginx +# Port 80: semua dialihkan ke HTTPS +server { + listen 80; + listen [::]:80; + server_name example.com www.example.com; + + return 308 https://$host$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; # nginx < 1.25.1: "listen 443 ssl http2;" + server_name example.com www.example.com; + + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; + + # HSTS: 2 tahun. "always" juga mengirimnya di respons 3xx/4xx/5xx. + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + root /var/www/example.com; + index index.html; +} +``` + +Catatan soal baris HSTS: + +- **`max-age=63072000`** sama dengan dua tahun, nilai dari TLSRef. SSL Labs butuh minimal 15768000 (enam bulan) untuk A+. Nilai yang lebih pendek atau salah ketik membuat grade turun ke A-. +- **`always`** penting. Tanpa itu, nginx hanya menambahkan header di respons 200, 201, 204, 206, 301, 302, 303, 304, 307, dan 308. Dengan `always`, halaman error juga membawa header ini. +- **`includeSubDomains`** memberi tahu browser bahwa semua subdomain juga wajib HTTPS. Jangan dipasang sebelum yakin itu benar. Kalau `intranet.example.com` masih HTTP biasa, browser yang pernah menerima header ini akan menolak membukanya. +- Header hanya dipasang di server HTTPS. Browser mengabaikan HSTS yang dikirim lewat HTTP biasa, dan spesifikasi HSTS ([RFC 6797 bagian 7.2](https://www.rfc-editor.org/rfc/rfc6797#section-7.2)) melarang server mengirimnya di sana. + +Dua baris `listen` di tiap blok memang disengaja. Kalau domain punya record AAAA tapi nginx hanya listen di IPv4, SSL Labs akan menguji alamat IPv6 dan mendapat jawaban berbeda. Penjelasannya ada di tabel troubleshooting. + +## Langkah 4: OCSP stapling dan Let's Encrypt + +Banyak panduan A+ masih menyuruh menambahkan `ssl_stapling on;`, termasuk tulisan saya sendiri tahun 2015, [OCSP Stapling di nginx]({% post_url 2015-04-12-ocsp-stapling-di-nginx %}). Untuk sertifikat Let's Encrypt, baris itu sebaiknya dibuang. + +Let's Encrypt [menghentikan dukungan OCSP](https://letsencrypt.org/2024/12/05/ending-ocsp/): sejak 7 Mei 2025 sertifikatnya tidak lagi memuat URL OCSP, dan responder OCSP dimatikan pada 6 Agustus 2025. Pengecekan revokasi sekarang lewat CRL. Dengan stapling aktif dan sertifikat Let's Encrypt yang baru, nginx menulis peringatan seperti ini setiap kali reload: + +```text +[warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate +``` + +Situs tetap jalan, tapi log jadi kotor. Hapus `ssl_stapling` dan `ssl_stapling_verify`. OCSP stapling tidak memengaruhi grade SSL Labs. + +Kalau sertifikat berasal dari CA yang masih menjalankan OCSP, stapling tetap berguna. Yang dibutuhkan adalah resolver dan chain penerbit: + +```nginx +ssl_stapling on; +ssl_stapling_verify on; +ssl_trusted_certificate /etc/ssl/certs/ca-chain.pem; # root + intermediate +resolver 127.0.0.53 valid=300s; # contoh: systemd-resolved; ganti dengan resolver server Anda +``` + +## Langkah 5: Hindari jebakan add_header + +Di nginx, `add_header` hanya diwarisi dari blok luar kalau blok saat ini tidak punya `add_header` sendiri. Begitu satu header ditambahkan di sebuah `location`, semua header dari blok `server` hilang di location itu, termasuk HSTS. Kalau location itu `/`, grade turun ke A-. Kalau di path lain, laporan tetap A+ padahal sebagian situs jalan tanpa header itu. + +Ini hasil uji di server tes (port 8443) dengan konfigurasi di atas ditambah satu location: + +```nginx +location /assets/ { + add_header Cache-Control "public, max-age=3600"; +} +``` + +```text +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/ | grep -i strict +strict-transport-security: max-age=63072000; includeSubDomains + +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/assets/x | grep -i -e strict -e cache +cache-control: public, max-age=3600 +``` + +Respons kedua tidak punya HSTS. + +Ada tiga cara memperbaikinya, urut dari yang paling disarankan: + +1. **nginx 1.29.3 ke atas:** pasang `add_header_inherit merge;` di blok `http`. Header dari level luar akan ditambahkan ke header yang diset di blok dalam ([dokumentasi](https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header_inherit)). +2. **nginx lama:** pindahkan header keamanan ke snippet, lalu include di setiap tempat yang memakai `add_header` (contoh di bawah). +3. **Kalau hanya untuk cache:** pakai `expires 1h;`, bukan `add_header Cache-Control`. Directive ini mengirim `Cache-Control` dan `Expires` sendiri, dan berbeda dengan `add_header`, tidak memutus header warisan dari blok `server`. + +Cara snippet kira-kira seperti ini: + +```nginx +# /etc/nginx/snippets/security-headers.conf +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; +``` + +```nginx +location /assets/ { + include snippets/security-headers.conf; + add_header Cache-Control "public, max-age=3600"; +} +``` + +Dan hasil `location /assets/ { expires 1h; }` di server tes yang sama: + +```text +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/assets/x.css +HTTP/2 200 +expires: Thu, 05 Nov 2026 01:41:51 GMT +cache-control: max-age=3600 +strict-transport-security: max-age=63072000; includeSubDomains +``` + +Aturan pewarisan yang sama berlaku untuk blok `if` dan location bertingkat. + +## Langkah 6: Uji di lokal, lalu jalankan SSL Labs + +Cek sintaks lalu reload: + +```bash +sudo nginx -t && sudo systemctl reload nginx +``` + +Sebelum ke SSL Labs, cek poin-poin penting dari terminal sendiri. Ganti `example.com` dengan host Anda: + +```bash +# TLS 1.1 harus ditolak. SECLEVEL=0 supaya klien modern mau mencobanya. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' &1 | grep -E 'alert|Cipher is' + +# TLS 1.3 harus jalan. Dengan OpenSSL 3.5+ di kedua sisi, grupnya X25519MLKEM768. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_3 &1 | grep -E 'Negotiated TLS1.3 group|Cipher is' + +# Suite CBC harus ditolak (berlaku untuk sertifikat ECDSA maupun RSA). +openssl s_client -connect example.com:443 -servername example.com -tls1_2 \ + -cipher 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' &1 | grep -E 'alert|Cipher is' + +# Full chain: harus ada baris "depth=1" (intermediate yang dikirim server). +openssl s_client -connect example.com:443 -servername example.com &1 | grep depth + +# Header HSTS dan redirect. +curl -sI https://example.com/ | grep -i strict-transport-security +curl -sI http://example.com/ | grep -i -e '^HTTP' -e '^location' +``` + +Di server tes, hasilnya seperti ini (diringkas): + +```text +tls1_1 : tlsv1 alert protocol version ... Cipher is (NONE) +tls1_3 : Negotiated TLS1.3 group: X25519MLKEM768 + New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 +CBC : ssl/tls alert handshake failure ... Cipher is (NONE) +HSTS : strict-transport-security: max-age=63072000; includeSubDomains +HTTP : HTTP/1.1 308 Permanent Redirect +``` + +Kalau semuanya sudah sesuai, buka [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest/), masukkan hostname, dan centang "Do not show the results on the boards" kalau tidak ingin hasilnya tampil di daftar publik. SSL Labs menyimpan hasil scan untuk beberapa waktu. Setelah mengubah konfigurasi, klik tautan "Clear cache" di halaman hasil supaya scan diulang. Satu scan penuh butuh beberapa menit, lebih lama kalau hostname punya beberapa alamat IP. + +## Troubleshooting: arti pesan di laporan dan cara memperbaikinya + +| Yang muncul | Penyebab | Perbaikan | +|---|---|---| +| Grade B, "This server supports TLS 1.0 and TLS 1.1" | Ada baris `ssl_protocols` lama, sering di `nginx.conf` atau include dari Certbot | Jalankan `grep` dari Langkah 2 dan sisakan hanya `tls.conf` | +| `nginx -t`: `"ssl_prefer_server_ciphers" directive is duplicate` | `nginx.conf` bawaan masih mengaturnya di blok `http` yang sama | Beri tanda `#` di `nginx.conf` (Langkah 2) | +| Grade B, "Chain issues: Incomplete" | `ssl_certificate` mengarah ke `cert.pem` | Pakai `fullchain.pem` | +| Grade B, warning cipher soal forward secrecy atau CBC | Daftar `ssl_ciphers` lama | Pakai daftar dari Langkah 2 | +| Grade A-, "This server does not support TLS 1.3" | OpenSSL lebih lama dari 1.1.1, atau `ssl_protocols` tanpa `TLSv1.3` | Upgrade OS atau build nginx; cek `nginx -V` | +| Grade A-, warning HSTS atau "HSTS not set" | Header tidak ada di halaman yang diuji, `max-age` terlalu pendek, atau kena jebakan add_header | Cek dengan `curl -sI`; lihat Langkah 5 | +| A+ di satu IP, A- di IP lain | IPv6 dilayani server block lain atau mesin lain | Tambahkan `listen [::]:443 ssl;` di semua blok, atau perbaiki record AAAA | +| Grade tidak berubah walau nginx sudah diubah | Yang diuji CDN, bukan server Anda | Lihat di bawah | +| `nginx -t` menulis `SSL_CTX_set1_curves_list(...) failed` | OpenSSL di balik nginx tidak mengenal salah satu grup di `ssl_ecdh_curve`, biasanya `X25519MLKEM768` di OpenSSL sebelum 3.5 | Hapus grup itu dari daftar | + +**Pakai Cloudflare atau CDN lain?** Kalau proxy Cloudflare (awan oranye) aktif, SSL Labs menguji edge Cloudflare, bukan nginx Anda. Grade-nya bergantung pada pengaturan di Cloudflare: versi TLS minimum, TLS 1.3, dan HSTS di menu SSL/TLS > Edge Certificates. Konfigurasi nginx tetap penting untuk koneksi antara Cloudflare dan server origin, jadi pakai mode "Full (strict)" dan tetap pasang konfigurasi di atas di origin. (Blog ini juga ada di belakang Cloudflare; ceritanya ada di [Migrasi ke Cloudflare]({% post_url 2014-11-10-migrasi-ke-cloudflare %}).) + +## Opsional: HSTS preload + +Dengan HSTS preload, domain Anda masuk ke daftar HTTPS-only yang ditanam di dalam browser, jadi kunjungan pertama pun tidak pernah lewat HTTP. SSL Labs tidak mensyaratkannya untuk A+. Syarat di [hstspreload.org](https://hstspreload.org/) lebih ketat daripada syarat A+: + +- `max-age` minimal 31536000 (satu tahun), `includeSubDomains`, dan `preload` di header +- semua subdomain dilayani lewat HTTPS, termasuk subdomain internal +- HTTP dialihkan ke HTTPS di host yang sama terlebih dulu + +```nginx +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; +``` + +Keluar dari daftar itu butuh waktu berbulan-bulan sampai ke pengguna lewat update browser, dan browser lain belum tentu ikut menghapus. Daftarkan hanya domain yang pasti tetap HTTPS-only di semua subdomain. + +## Konfigurasi lengkap + +Sebagai rujukan, ini dua file yang dipakai saat pengujian di atas (sesuaikan path dan nama). Ditambah dua baris yang diberi `#` di `nginx.conf` pada Langkah 2, itulah seluruh perubahannya: + +```nginx +# /etc/nginx/conf.d/tls.conf +ssl_protocols TLSv1.2 TLSv1.3; +ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; +ssl_prefer_server_ciphers off; +ssl_session_timeout 1d; +ssl_session_cache shared:TLS:10m; +# add_header_inherit merge; # nginx 1.29.3+ +``` + +```nginx +# /etc/nginx/sites-available/example.com +server { + listen 80; + listen [::]:80; + server_name example.com www.example.com; + return 308 https://$host$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name example.com www.example.com; + + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; + + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + root /var/www/example.com; + index index.html; +} +``` + +Kalau perlu melayani klien ECDSA dan RSA sekaligus, nginx bisa memuat dua sertifikat di server block yang sama dan memilih yang cocok untuk tiap klien: + +```nginx +ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # ECDSA, dari Langkah 1 +ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; +ssl_certificate /etc/letsencrypt/live/example.com-rsa/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/example.com-rsa/privkey.pem; +``` + +Di server tes, klien TLS 1.2 yang hanya menawarkan `ECDHE-RSA-AES128-GCM-SHA256` menerima sertifikat RSA 2048 bit, sementara klien lain mendapat ECDSA. Dengan Certbot, jalankan sekali lagi dengan `--key-type rsa --cert-name example.com-rsa` untuk mendapat pasangan RSA. + +*Mahyuddin Susanto adalah sysadmin Linux dan jaringan yang mengelola server sendiri dan menulis soal nginx di blog ini sejak 2009, dimulai dari [nginx, dari nol]({% post_url 2009-05-09-nginx-dari-nol %}). [Tentang penulis](/about) · [Kontak](/contact)* + +## Sumber + +- Qualys SSL Labs, [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), versi 2009r, 16 Mei 2025 +- TLSRef, [Server Side TLS guideline 6.0](https://data.tlsref.org/guidelines/6.0.json) dan [TLS Configurator](https://configurator.tlsref.org/) +- nginx, [ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html), [ngx_http_headers_module](https://nginx.org/en/docs/http/ngx_http_headers_module.html), dan [CHANGES](https://nginx.org/en/CHANGES) +- Let's Encrypt, [Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) +- [HSTS Preload List Submission](https://hstspreload.org/) +- IETF, [RFC 6797: HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797) diff --git a/_posts/2026-11-05-ssl-labs-a-plus-nginx.md b/_posts/2026-11-05-ssl-labs-a-plus-nginx.md new file mode 100644 index 0000000..2688fd6 --- /dev/null +++ b/_posts/2026-11-05-ssl-labs-a-plus-nginx.md @@ -0,0 +1,403 @@ +--- +layout: post +title: "How to Get an A+ on SSL Labs with nginx (2026 Guide)" +description: "Step-by-step nginx TLS config for an A+ on the Qualys SSL Labs test: TLS 1.3, ECDHE ciphers, full chain, HSTS, the OCSP change, and the add_header trap." +image: "/img/ssl-labs-a-plus-nginx.png" +date: 2026-11-05 +categories: + - Linux +tags: + - nginx + - tls + - ssl + - security + - hsts +--- + +To get an A+ on the [Qualys SSL Labs server test](https://www.ssllabs.com/ssltest/) with nginx, you need five things: TLS 1.2 and TLS 1.3 only, ECDHE key exchange with AEAD ciphers (GCM or ChaCha20-Poly1305), a certificate served with its full chain, an HSTS header with a `max-age` of at least six months, and the same setup on every IP address your hostname resolves to. Miss TLS 1.3 or HSTS and you land on A-. Leave TLS 1.0 or 1.1 on and you are stuck at B. + +This guide walks through each piece, gives you a config you can paste, and covers the two changes that break older tutorials: Let's Encrypt shutting down OCSP in 2025, and the grading update SSL Labs shipped in May 2025. + +The configuration below was tested on nginx 1.26.3 with OpenSSL 3.5.7, using the stock Debian 13 `nginx.conf` with its two SSL lines commented out and the files from this guide added, and checked with `openssl s_client` and `curl`. + +**Baca dalam Bahasa Indonesia:** [Cara Mendapat A+ di SSL Labs dengan nginx]({% post_url 2026-11-05-ssl-labs-a-plus-nginx-id %}). Running Apache? See [How to Get an A+ on SSL Labs with Apache httpd]({% post_url 2026-11-05-ssl-labs-a-plus-apache %}). + +![SSL Labs grade ladder for nginx: what caps a server at B or A-, and what an A+ needs](/img/ssl-labs-a-plus-nginx.png) + +
+Contents + +* TOC +{:toc} +
+ +## How SSL Labs grades your server + +SSL Labs scores three categories: protocol support (30%), key exchange (30%) and cipher strength (40%). A score of 80 or more is an A. Then it applies caps: specific problems limit the grade no matter how high the score is. The A+ is a bonus on top of an A with no warnings. + +The current rules are version 2009r of the [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), dated 16 May 2025. These are the caps that matter for a typical nginx server: + +| Problem | Grade limit | +|---|---| +| SSLv2, SSLv3 as the best protocol, export ciphers, Heartbleed-class bugs | F | +| TLS 1.2 not supported | C | +| TLS 1.0 or TLS 1.1 enabled | B | +| No forward secrecy (no ECDHE/DHE) | B | +| No AEAD cipher (GCM or ChaCha20-Poly1305) | B | +| RC4 enabled | B | +| Incomplete certificate chain | B | +| Key or DH parameters under 2048 bits | B | +| TLS 1.3 not supported | A- | +| HSTS missing or invalid | A- | + +For the A+, the guide asks for a configuration with no warnings and HSTS with a `max-age` of at least six months (15768000 seconds). + +Two things changed in 2025: a plain A now needs both TLS 1.3 and a valid HSTS header, and `TLS_FALLBACK_SCSV` no longer counts. If an older article tells you to chase fallback SCSV, skip that part. + +You do not need 100 in every category. An ECDSA P-256 or RSA 2048 certificate scores 90 on key exchange, and offering AES-128 keeps cipher strength at 90. Both still get an A+. Switching to RSA 4096 only makes handshakes slower. + +## Check your nginx and OpenSSL versions first + +A few directives depend on the version you run: + +```bash +nginx -V 2>&1 | head -3 +openssl version +``` + +| Feature | Needs | +|---|---| +| TLS 1.3 (`TLSv1.3` in `ssl_protocols`) | OpenSSL 1.1.1+; default since nginx 1.23.4 | +| `http2 on;` as a separate directive | nginx 1.25.1+ (older: `listen 443 ssl http2;`) | +| Automatic session ticket key rotation | nginx 1.23.2+ with a shared `ssl_session_cache` | +| Hybrid post-quantum group `X25519MLKEM768` | OpenSSL 3.5+ | +| `add_header_inherit merge;` | nginx 1.29.3+ | + +The `nginx -V` line that matters is `built with OpenSSL ...`. That is the library nginx actually uses, and it can differ from the `openssl` command on the same box. + +## Step 1: Get a certificate and serve the full chain + +Any publicly trusted certificate works. With Let's Encrypt and Certbot, get the certificate only and write the TLS config yourself: + +```bash +sudo certbot certonly --nginx -d example.com -d www.example.com +``` + +Recent Certbot releases issue ECDSA keys by default, which is what you want. Point nginx at `fullchain.pem`, not `cert.pem`: + +```nginx +ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; +``` + +`cert.pem` holds only your leaf certificate. Browsers often fill in the missing intermediate on their own, so the site looks fine, but SSL Labs reports "Chain issues: Incomplete" and caps the grade at B. The [nginx docs](https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_certificate) say the same: the server certificate comes first in the file, followed by the intermediates. + +If you use Certbot's own installer (`certbot --nginx` without `certonly`), it adds `include /etc/letsencrypt/options-ssl-nginx.conf;` to your server block. That file sets protocols and ciphers too. Remove the include so your own settings are the only ones in play. + +## Step 2: Put the TLS settings in one shared file + +Debian and Ubuntu load every file in `/etc/nginx/conf.d/` inside the `http` block, so a single file there applies to all your HTTPS sites. + +First, clear the SSL lines that the package already put in `/etc/nginx/nginx.conf`. The stock Debian 13 file has this block inside `http { }`: + +```nginx +## +# SSL Settings +## + +ssl_protocols TLSv1.2 TLSv1.3; # Dropping SSLv3 (POODLE), TLS 1.0, 1.1 +ssl_prefer_server_ciphers off; # Don't force server cipher order. +``` + +Your `conf.d/` file lands in the same `http` block, so these lines would collide with it. nginx refuses a second `ssl_prefer_server_ciphers` at the same level: + +```text +nginx: [emerg] "ssl_prefer_server_ciphers" directive is duplicate in /etc/nginx/conf.d/tls.conf +``` + +A second `ssl_protocols` does not replace the first one either. nginx merges the two lists and only prints warnings such as `[warn] duplicate value "TLSv1.2"`, not an error. Comment out both lines with `#` (your release may have different values there), then check that nothing else sets them: + +```bash +grep -rn -e ssl_protocols -e ssl_prefer_server_ciphers -e ssl_ciphers /etc/nginx/ +``` + +Now create `/etc/nginx/conf.d/tls.conf`: + +```nginx +# TLS settings for every server block (http context) +ssl_protocols TLSv1.2 TLSv1.3; + +# OpenSSL 3.5+: hybrid post-quantum group first. +# On OpenSSL 3.0-3.4, remove X25519MLKEM768 from this list. +ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; + +# TLS 1.2 ciphers: ECDHE key exchange + AEAD only. +# TLS 1.3 suites are managed by OpenSSL and are all AEAD. +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; +ssl_prefer_server_ciphers off; + +ssl_session_timeout 1d; +ssl_session_cache shared:TLS:10m; # about 40000 sessions +``` + +Line by line: + +- **`ssl_protocols TLSv1.2 TLSv1.3`** turns off TLS 1.0 and 1.1 (the B cap) and turns on TLS 1.3 (without it you stop at A-). It is the default since nginx 1.23.4, but writing it here makes the intent clear. It does not override other `ssl_protocols` lines in the same block, which is why you removed them above. +- **`ssl_ecdh_curve`** sets the key exchange groups. The list comes from the [TLSRef guideline 6.0](https://data.tlsref.org/guidelines/6.0.json), the successor of Mozilla's Server Side TLS guidelines. `X25519MLKEM768` combines classic X25519 with the ML-KEM post-quantum algorithm. Clients that do not support it fall back to X25519. +- **`ssl_ciphers`** lists only ECDHE suites, which gives forward secrecy, and only GCM or ChaCha20-Poly1305, which are AEAD. No CBC, no RSA key exchange, no 3DES. TLSRef lists the oldest clients this profile still serves as Firefox 31, Chrome 49, Safari 9, Android 4.4.2, IE 11 on Windows 10 and Java 8u161. It also replaces the cipher list from my [2015 post on ssl_cipher in nginx]({% post_url 2015-04-12-ssl_cipher-di-nginx %}) (in Indonesian), which is out of date now. +- **`ssl_prefer_server_ciphers off`** lets the client pick. With an all-strong list, the client knows best: phones without AES hardware choose ChaCha20. +- **No `ssl_dhparam`.** The list has no DHE suites, so you do not need a DH parameters file. That also removes the old "DH parameters under 2048 bits" risk. +- **Session tickets** stay at the default (`on`). Since nginx 1.23.2 the ticket keys rotate automatically when `ssl_session_cache` uses shared memory, as it does here. That is why TLSRef only adds `ssl_session_tickets off;` for older versions. + +The Mozilla SSL Configuration Generator now redirects to the [TLSRef Configurator](https://configurator.tlsref.org/). This file matches its "Intermediate" profile, which is the right choice for public websites. The "Modern" profile (TLS 1.3 only) also gets an A+, but cuts off older clients such as Android 4.4 and IE 11. + +## Step 3: The server blocks, HSTS and the HTTP redirect + +Now the site itself, for example `/etc/nginx/sites-available/example.com`, linked into `sites-enabled/`: + +```nginx +# Port 80: redirect everything to HTTPS +server { + listen 80; + listen [::]:80; + server_name example.com www.example.com; + + return 308 https://$host$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; # nginx < 1.25.1: "listen 443 ssl http2;" + server_name example.com www.example.com; + + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; + + # HSTS: 2 years. "always" also sends it on 3xx/4xx/5xx responses. + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + root /var/www/example.com; + index index.html; +} +``` + +Notes on the HSTS line: + +- **`max-age=63072000`** is two years, the TLSRef value. SSL Labs needs at least 15768000 (six months) for the A+. A shorter value or a typo drops you to A-. +- **`always`** matters. Without it, nginx adds the header only to 200, 201, 204, 206, 301, 302, 303, 304, 307 and 308 responses. With `always`, error pages carry it too. +- **`includeSubDomains`** tells browsers that every subdomain is HTTPS-only as well. Leave it out until you are sure that is true. If `intranet.example.com` still serves plain HTTP, browsers that have seen the header will refuse to load it. +- The header goes only on the HTTPS server. Browsers ignore HSTS on plain HTTP, and the HSTS spec ([RFC 6797, section 7.2](https://www.rfc-editor.org/rfc/rfc6797#section-7.2)) says servers must not send it there. + +Both `listen` lines in each block are deliberate. If your domain has an AAAA record and nginx listens only on IPv4, SSL Labs tests the IPv6 address and gets a different answer. More on that in the troubleshooting table. + +## Step 4: OCSP stapling and Let's Encrypt + +Many A+ guides still tell you to add `ssl_stapling on;`, including my own [OCSP stapling post from 2015]({% post_url 2015-04-12-ocsp-stapling-di-nginx %}). For Let's Encrypt certificates, drop it. + +Let's Encrypt [ended OCSP support](https://letsencrypt.org/2024/12/05/ending-ocsp/): from 7 May 2025 its certificates no longer contain an OCSP URL, and the OCSP responders were switched off on 6 August 2025. Revocation now goes through CRLs. With stapling on and a current Let's Encrypt certificate, nginx logs a warning like this on every reload: + +```text +[warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate +``` + +The site keeps working, but the line is noise. Remove `ssl_stapling` and `ssl_stapling_verify`. OCSP stapling has no effect on the SSL Labs grade. + +If your certificate comes from a CA that still runs OCSP, stapling is still useful. You need a resolver and the issuer chain: + +```nginx +ssl_stapling on; +ssl_stapling_verify on; +ssl_trusted_certificate /etc/ssl/certs/ca-chain.pem; # root + intermediates +resolver 127.0.0.53 valid=300s; # e.g. systemd-resolved; use your server's resolver +``` + +## Step 5: Avoid the add_header trap + +In nginx, `add_header` is inherited from the outer block only if the current block has no `add_header` of its own. Add one header in a `location` and every header from the `server` block disappears in that location, HSTS included. If that location is `/`, the grade drops to A-. If it is another path, the report stays A+ while part of the site runs without the header. + +Here is the result on the test server (port 8443) with the config above plus one extra location: + +```nginx +location /assets/ { + add_header Cache-Control "public, max-age=3600"; +} +``` + +```text +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/ | grep -i strict +strict-transport-security: max-age=63072000; includeSubDomains + +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/assets/x | grep -i -e strict -e cache +cache-control: public, max-age=3600 +``` + +The second response has no HSTS. + +Three fixes, in order of preference: + +1. **nginx 1.29.3 or newer:** put `add_header_inherit merge;` in the `http` block. Headers from outer levels are then added to the ones you set in the inner block ([docs](https://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header_inherit)). +2. **Older nginx:** move the security headers into a snippet and include it wherever you use `add_header` (example below). +3. **For caching only:** use `expires 1h;` instead of `add_header Cache-Control`. It sets `Cache-Control` and `Expires` itself and, unlike `add_header`, does not cancel the headers inherited from the `server` block. + +The snippet approach looks like this: + +```nginx +# /etc/nginx/snippets/security-headers.conf +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; +``` + +```nginx +location /assets/ { + include snippets/security-headers.conf; + add_header Cache-Control "public, max-age=3600"; +} +``` + +And `location /assets/ { expires 1h; }` on the same test server: + +```text +$ curl -sk -D- -o /dev/null https://127.0.0.1:8443/assets/x.css +HTTP/2 200 +expires: Thu, 05 Nov 2026 01:41:51 GMT +cache-control: max-age=3600 +strict-transport-security: max-age=63072000; includeSubDomains +``` + +The same inheritance rule applies to `if` blocks and nested locations. + +## Step 6: Test locally, then run SSL Labs + +Check the syntax and reload: + +```bash +sudo nginx -t && sudo systemctl reload nginx +``` + +Before you go to SSL Labs, check the important points from your own terminal. Replace `example.com` with your host: + +```bash +# TLS 1.1 must be refused. SECLEVEL=0 lets a modern client even try it. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_1 -cipher 'DEFAULT@SECLEVEL=0' &1 | grep -E 'alert|Cipher is' + +# TLS 1.3 must work. With OpenSSL 3.5+ on both sides the group is X25519MLKEM768. +openssl s_client -connect example.com:443 -servername example.com \ + -tls1_3 &1 | grep -E 'Negotiated TLS1.3 group|Cipher is' + +# CBC suites must be refused (covers both ECDSA and RSA certificates). +openssl s_client -connect example.com:443 -servername example.com -tls1_2 \ + -cipher 'ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA' &1 | grep -E 'alert|Cipher is' + +# Full chain: there must be a "depth=1" line (the intermediate sent by the server). +openssl s_client -connect example.com:443 -servername example.com &1 | grep depth + +# HSTS header and redirect. +curl -sI https://example.com/ | grep -i strict-transport-security +curl -sI http://example.com/ | grep -i -e '^HTTP' -e '^location' +``` + +On the test setup, the output looked like this (condensed): + +```text +tls1_1 : tlsv1 alert protocol version ... Cipher is (NONE) +tls1_3 : Negotiated TLS1.3 group: X25519MLKEM768 + New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384 +CBC : ssl/tls alert handshake failure ... Cipher is (NONE) +HSTS : strict-transport-security: max-age=63072000; includeSubDomains +HTTP : HTTP/1.1 308 Permanent Redirect +``` + +When all of that looks right, open [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest/), enter your hostname, and tick "Do not show the results on the boards" if you do not want the result listed publicly. SSL Labs caches results for a while. After a config change, use the "Clear cache" link on the results page to force a new scan. A full scan takes a few minutes, longer when the hostname has several IP addresses. + +## Troubleshooting: what the report says and how to fix it + +| What you see | Cause | Fix | +|---|---|---| +| Grade B, "This server supports TLS 1.0 and TLS 1.1" | Old `ssl_protocols` line somewhere, often in `nginx.conf` or a Certbot include | Run the `grep` from Step 2 and keep only `tls.conf` | +| `nginx -t`: `"ssl_prefer_server_ciphers" directive is duplicate` | The stock `nginx.conf` still sets it in the same `http` block | Comment it out in `nginx.conf` (Step 2) | +| Grade B, "Chain issues: Incomplete" | `ssl_certificate` points to `cert.pem` | Use `fullchain.pem` | +| Grade B, cipher warnings about forward secrecy or CBC | Old `ssl_ciphers` list | Use the list from Step 2 | +| Grade A-, "This server does not support TLS 1.3" | OpenSSL older than 1.1.1, or `ssl_protocols` without `TLSv1.3` | Upgrade the OS or nginx build; check `nginx -V` | +| Grade A-, HSTS warning or "HSTS not set" | Header missing on the tested page, `max-age` too short, or the add_header trap | Check with `curl -sI`; see Step 5 | +| A+ on one IP, A- on another | IPv6 handled by a different server block or a different machine | Add `listen [::]:443 ssl;` everywhere, or fix the AAAA record | +| Grade does not change after you edit nginx | You are testing a CDN, not your server | See below | +| `nginx -t` says `SSL_CTX_set1_curves_list(...) failed` | The OpenSSL behind nginx does not know a group in `ssl_ecdh_curve`, usually `X25519MLKEM768` on OpenSSL older than 3.5 | Remove that group from the list | + +**Behind Cloudflare or another CDN?** If the orange cloud is on, SSL Labs tests Cloudflare's edge, not your nginx. The grade then depends on your Cloudflare settings: minimum TLS version, TLS 1.3, and HSTS under SSL/TLS > Edge Certificates. Your nginx config still matters for the connection between Cloudflare and your origin, so use "Full (strict)" mode and keep the setup above on the origin. (This blog sits behind Cloudflare too; the move is described in [Migrasi ke Cloudflare]({% post_url 2014-11-10-migrasi-ke-cloudflare %}), in Indonesian.) + +## Optional: HSTS preload + +With HSTS preload, browsers ship with your domain on a built-in HTTPS-only list, so even the very first visit never uses HTTP. SSL Labs does not need it for an A+. The requirements on [hstspreload.org](https://hstspreload.org/) are stricter than the A+ ones: + +- `max-age` of at least 31536000 (one year), `includeSubDomains`, and `preload` in the header +- every subdomain served over HTTPS, including internal ones +- HTTP redirected to HTTPS on the same host first + +```nginx +add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always; +``` + +Getting off the list takes months to reach users through browser updates, and other browsers are not guaranteed to follow. Only submit a domain you know will stay HTTPS-only on every subdomain. + +## The complete config + +For reference, here are the two files used in the test above (adjust paths and names). Together with the two commented lines in `nginx.conf` from Step 2, that is the whole change: + +```nginx +# /etc/nginx/conf.d/tls.conf +ssl_protocols TLSv1.2 TLSv1.3; +ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1; +ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305; +ssl_prefer_server_ciphers off; +ssl_session_timeout 1d; +ssl_session_cache shared:TLS:10m; +# add_header_inherit merge; # nginx 1.29.3+ +``` + +```nginx +# /etc/nginx/sites-available/example.com +server { + listen 80; + listen [::]:80; + server_name example.com www.example.com; + return 308 https://$host$request_uri; +} + +server { + listen 443 ssl; + listen [::]:443 ssl; + http2 on; + server_name example.com www.example.com; + + ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; + + add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; + + root /var/www/example.com; + index index.html; +} +``` + +If you need to support both ECDSA and RSA clients, nginx can load two certificates in the same server block, and it picks the right one per client: + +```nginx +ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # ECDSA, from Step 1 +ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; +ssl_certificate /etc/letsencrypt/live/example.com-rsa/fullchain.pem; +ssl_certificate_key /etc/letsencrypt/live/example.com-rsa/privkey.pem; +``` + +On the test server, a TLS 1.2 client that only offered `ECDHE-RSA-AES128-GCM-SHA256` received the 2048-bit RSA certificate, and everyone else got ECDSA. With Certbot, run it a second time with `--key-type rsa --cert-name example.com-rsa` to get the RSA pair. + +*Mahyuddin Susanto is a Linux and networking sysadmin who runs his own servers and has written about nginx on this blog since 2009, starting with [nginx, dari nol]({% post_url 2009-05-09-nginx-dari-nol %}). [About](/about) · [Contact](/contact)* + +## Sources + +- Qualys SSL Labs, [SSL Server Rating Guide](https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide), version 2009r, 16 May 2025 +- TLSRef, [Server Side TLS guideline 6.0](https://data.tlsref.org/guidelines/6.0.json) and [TLS Configurator](https://configurator.tlsref.org/) +- nginx, [ngx_http_ssl_module](https://nginx.org/en/docs/http/ngx_http_ssl_module.html), [ngx_http_headers_module](https://nginx.org/en/docs/http/ngx_http_headers_module.html) and [CHANGES](https://nginx.org/en/CHANGES) +- Let's Encrypt, [Ending OCSP Support in 2025](https://letsencrypt.org/2024/12/05/ending-ocsp/) +- [HSTS Preload List Submission](https://hstspreload.org/) +- IETF, [RFC 6797: HTTP Strict Transport Security](https://www.rfc-editor.org/rfc/rfc6797) diff --git a/img/ssl-labs-a-plus-apache-id.png b/img/ssl-labs-a-plus-apache-id.png new file mode 100644 index 0000000000000000000000000000000000000000..809aae444a44f39d517aeb7e0c71639fa7cb4b19 GIT binary patch literal 51600 zcmeFZWn5L=w+4!+C?ze@AR*l$El784Kw7%HTR~cyO?UUEJEW1=bZxpDq+=6z`M&>i z?z!J?eLVBi{J~nRIp?TnJY!5kl@uh=Q3z2G5D?I%rNmSa5MERwARxNFMg)HH>-`}r z0s zi!1V}>&?Xji&q1SZB@%5b0r+!OqQ0OobGM9eJeaV%#klQrCDqrjpZznN!u{XJfP?to1NncZAz(v49jMC5P(DggbF;aXoEqaI zs>dMX3d9REZ23yAPe@3}b`6cMug4bFn$}{pfxpKM}%|;)3c>(Ga9|BFo(q>-sHAJM15ER<;N<_u{5bwjEXc2GBq|P<@Md3 z3w2_NRaMc?rxx_v)2S$H(u~CZCk~RyR z+D)dYs^9KhO6?XZsr)kM`cEmQQ`nTk48eeW5kBdG=*i1)4?kFr)e*UAHJre=k6P{p zaWZHoKKNyNx|E1>T8&le$;-+*siOhwtZjBS&(F@Lm{!!1Ls zq<Y=i~-}JaslDvk-kihC_VZebjN$rt6M=d4Z-Tf+yw}A#i z{XgFw?^Kw|l4Ns`lds+czW%bTUFp+G@9xp;rEbrl3mcs1T3lS58XNnhuc)Z6 zuc)u6p{S@RDG5Jnxt^c5b6jrqxTF`nau6Nf_+SRrjZ~B}Mp0T`%6GfI$_59Nl`~q~ z$V`?^PI6?>w14#2zfU-VPflTH&Vr+bTQ>!{1KUb>N>UkH2O->g0KyPXKP z`aP{J!LKzn=l2Mbiy;#m8<~PXLtCE6gYG!QOEj6LmZ1{6-b#*qWNAWIXb1xNNt zKG7R=Qgr&7kQ_xs{FIZAh(JTHu6ERGl>-FemmKT5G1Hdbf^oLw_`ZfczueQ=W;VGT zds^Bv!~68?Qq_!kx#cP38N#R2T)t-%x@%(Su@q5y#HKIuOu~ao6CRaU&1w21E)0fe z7HR~xWQ#@{>{g(6a@~vp( zk}20-Fuc5#zcX=n2g`__^l)&pWla*JXoKJ+{}EANsFI1g`cb&1i5? z<_Z*u=WDe2+aD#MCc0@uGZmUHi$&j`$`(JG-lNe_yYcL-1$fm(nwJ$8GJKqp7=;!5 ztdo2>3mAobGVA(PI@}4LIdOxR00CiB)J2QHhoKp5dZ7^J6N7_{~PNvbuKa3PIY`hwVOQQG!~ch z$#)}=0|mX8%+9)zj$5pb@hlYE3UIg#`Jl*URM@VwggR1-#FO5?Q9I%$}5$H#n_S z6t%Tei<{XfkvQ>mU1+At^!+MybLknB;}hP+d%PPArz*r3&EEU2YlW-q#B7?|)D*wa zdc{(_K1!c0qRR(_u{SS&;m%KNn^e=Q!os>-O1RB{aEn$n6~2e+J=kG;WCOx#QLkM`suDze~W0MTJ? zq>fmXnLaT-JJR`Pb=fdzVmS{XN#!L2@$=_CCAx0Tl_tOvr$GCHKNeh%6Z7uDhBe#r z`{TiIuD#nKBA%0s7I!c^XL9nq93r4Bf4rX_1?l;=*S8K>^a~2|3feru8E5oIdo?=} z5<&IxJXO`N(UHv;E4jDE#pSaVN8k9dXqWCL@Sej>4p%Qz-L|&3w@;)mk!y=Y`~9$= ztS4s#9TYQ!WW66h9v6p(#^eT&h zb2?dtv-3WM2b0g#xRge_{=}%nYJ#QP#l_R@f9&wX~s1_hr8l=nib0v9Po0`)SmGD zb)YdS#oz3^x0gs@5+HQcgnbQ=sB~rm6CpH>`*@&=V@Tb$(fd-JEg8#u=)v{!?&!0m z!qKABm)-Q{cyxJ1KY0=WjHU4IoGc6S4JWhdnLiNqf-Vn0_)bRJ-)R$TJPwvylrfHl zLrzaiR`thAor2Zz2E$wJ!nWt~jSjdD8n#X}JD2i7bQJwd!5Cx*+t+kd2Va^k?>sfKP55ApIUQSIrEYfBa?@qATv*c`0WK3;6{`>=1I^v$lE&_J-c z9?yw^t~`9~+gOv%ylsw^j@eU_`wUt5x$vZvS6cm_`E!jKhz@z}T5`~(l{zwdv-1|s zbA)d>xhl^n2>5;bes^mdGt?Ij;cc1jI$d>vS4^2(ea~$jl44SF(Goxui(%8Lbmvt2 z39W+^&)8r6fMcZZ^0*U2kXG+|tu8d{To(rOoqB3LJ{IX~w5Jsn%_j8pQR9BGljALS z!mpSJrc?R)jYXV4C+N%;Ym?9Y1_VuQ5Ita`J3gAq-dcP)luS>^{z=CxyDDmf|MK14 zN9ONvE=tPtnWG{#s|JO8kGVgcZF!!U73P0KJ)}EYmbWnR)F_ych=3id-3MOpG@30v z`8ce97Y9xUyxtQAjgma9QTe%v@6L;9Se@m{2R6E7_~qsv>IJX;?&k6lgSc+j;?f}U zk+ARKS7l+%8Uy~`VbNF0TxUOuogR~TMRv!KH-fk#qfdQ(5fGwL!Ja|UO39~l$Q+t$ zQ?D@ueeG2{meaqmC1FV&406Q;j(|9!#-dM@o*f{VLG=QGR;J`F zCN@2??NatiO%HyVz3J1HY*dAf=HH!d8OWs-iA26}m7@tyEXUz+-U~xF3{rnQ4ej(& zj`|@4H8%fhzdtY|xS;-%h%2Ooyd+p7!EWIKdtzoL(tPIA)R@n!DCDcfwv&*eQ#yR+ z-`Zd1wt9a47Z*?K{(4?md6KoY-jEtU#&7hCjRhHBzdex^`MaaO@r z6LjCPy$IjLrAbJdpDxoov&~0BP@*nz9ipB6J&AuWx{t9xTkaNh73e{CJ8ZF0^zL#k zxAA=@7UrNokBv_M=~K z*8PbN*hepNPP+zMa>QnQK=pATPy^x_sRWrGSqYDndkQWQzTbiCRCaEmxXIyWNPT5f z(|{>*gEh_s^8nyo+1c5}+Y;KecesuEM!%Mb%Q=g5F5h>khdk01rW{Nqhr3wGUhH?} zsFh&{cw>APLE&oymA^k$K3~f%9Pp+rqAKFPJju5bLzkDv(`2H%Af2TL2Z%+G0eGaB zSx)`fmKn(M!Xi;-FwgGWtZhD-=N|h=9`d^jFvupT3tnD0OJbbpubRuG#=uaJuU6U} zEOahzJGLKY3e6-->Wb94@^Yera|6mlt70}G_N?)A$&p*=jd`m-1KMEg3WC-O`z7~W>qi8alvuCzHWdAs{CCXbV1qqSnF^_CPcBX zfi*&ed+ugE@T*tTcn_oZ&&z~Eon|felrdUB>5qdcqC^#0Y?-&jA{3>!F6L$BVvd*m zXbUJZ4-a{AkoFD^kguFw6WYd9TPJ1`{@Ek_s~C?j?GWrq=a1rIT%nu{ z$nPEQF26}v2){;@N1=C(AYd ztsbiOVf2o@On;Gqu?%lpQc{SwqMW+=8&%fRk>>WeGZKLUnm#!;07L@mBQD7_#%m9# zUL(87T`STEU+TQO>gLtxV8k_9kJMQ=jH{I0g4RZY9so=5v11ni!&kq*+#Xp#?8m}E zdPj7+^SZS8&oGQ}ZUTf5*&ih222=A5qBA}2_q zo_Sr6)=e}Qm0225RN650y~ZMTz#_)ytu#G3u~*9TyeJs2^+VBLclbUG<{3~mmrseZ zb9^?SMfjwwGGg``wf1Dy;Z7+S0P!m{QE#6Fq7sAQ3hIkyd9e~tQ&IapUz8^&CmHOC zNl0Q?$gwm6Id^#*=1+Sy`By z*2GQtjv{2TF<_W0!n;*)=+zCJ^<|d$(VURsd{{(|L=xu_#$BcV6hu26l0E((mLMO; zX|#}PBpEgjHt5yHqCryL^m<2sbP<~jrnZa@?;`!Jiph2W@TAl!&4BK1&_JWbmeT-q3RJw6qMs z&wW}M+&vo;-JG)1a;O|$Zpky;xi3a|4s3p}-jg%XsxznhjHYBA+B849xCl~Iyx!t$sdxMl^x_O>pqVn%+BBgVVb;&^}lS_Mv~bJV>$NrBd z&$JQ}65Eqz(m6qcr|LZUBT_G4gjHk#0j;^{knoiDWN|$a;gKCfT$xMXlK9l5G+=|!D7lFo$tG}f8~l&R-eOKEE}vYr>29m5M;k| z#ng*du2HDP78Mb0W*B{9P*giPv{#eZi$*dBDXmir_1Nf2KGzUKcXX~~a&Y?v$T&*o z< z$lnbU5x%q5ymr%+jJdYy`#^;vw9#PKU-Ia~cd)m|{`+Gh&aJ{xTAKgDI!iRb`gPxN zCHpJqtB&j&$f>1$^w66kmzN*0AxZ=uR54(`OWIOl)YOT~P$3|vYB&~KYA5o6LmxCO2rMiJ6mc?DZv}O~0SH@y(@v?-REnDxO#^nP!LWB|s{S>Nciy6xP>Yr6q4H z)G32f<3NX4x*IHm(m#0R|Nk|YV@6CrXfgWpBZmZu(Ys1CXrDi z1~@rWdV|}2c_wX6T&}61?uUyQCRq*ZJf|)o;nPh|zo+-)vQmMV*7?guhN-hDqMh-f zfjvAm|I7~BrZ2n;bN~G#C`iJ%v;cj7da=>uI#<%+R1v56J#=CsCoS$XK#r6cbaIsh zs$e~5Al+uxQP9=~#SMVC_aA2mI}*#`XItS(p`Z%fu`=nUf{23zhJ#P~c8ksZ2nbnH z#l8%=@tGB>3~54gH2kh)vG#I+?a7M?hhTAqR7-*=D!nhafvl~!M=1M-p7mGZXJb@9 zVY>pU<%})ARCcYiQ(@oxTF)bO<h8R(Vl zohx%EepC*AA4#3U*P0a*^11U~TX#`6HzW=5d3x-=(tVZOQ?$OdzC{$D`IfKNp&RzH z{+FhT(pqmDJc|C#J%q4xc-R@>s><@{9z#W#gR|KcS%Bni)@G5eopiWou1E|NFX(sb zcz)HEBXdVPqL|E@BRT5|WbIL*5ryUWMEHtzogmJyc4h~fog+(2O*v78s+wMZX%l2U zehTQptR|>&2v^a9gI**ulTT5tZ1KIZ2q=`zT1oM)((o|qcBrT0UCIzZ82BVz&~~RJ zWOSnRk9Tr&QUSm@&Wu?m)kN6-CJ)Ff9ouZQxR)zEcvO+&{2rY83-WU;f62TD%b|&4 ze5TISGac5$)uQ_(0&xXZ({+rXmgDX!ix`6$d%XZgYZMU6<}a%cVt03!2U%-4@qg%F z=Z_Q_XP501Idrh?l`l00{GL8;lQf>=2a@)@G+Napx04mc_*IkRm;12dh@@!KlSd;t z8UAbH94aPD^HlYc$=YGS&jG3d&1-OwWkU}QclyWwZBC*xd88^lY-9+SQ0uF!yB@sp z>Fs#)3IRdp?Ta7pBknxz){F|1*Xe8|sG*^%JHXN|;CjEwJE}iGq4;)QW|PSu2ztkY=>U-GW5PI7no1wlqQuc`?pFdSP+kI0XY%? z8A1MlPv-D@l4Xu66qfg1u3Cr&a6M2)!IDe5Z~4)?-_+Dp^Q3b>nN%!C1C&q(75pY3#`%21jOCj+Jptud?-K37n3`nf|7p|DjO~f=V0X6i7y8#?U{F)SP4u;D1ng z2|D#V@dx>4d<@6VpfYOrx%T~|h?4+;^@QcGN56~r{tF7azzG@St@5KQrcCiyo1ZR| z!xPHpDMp^Bg-LMzz+Hjr*RD?%jsmNe`3O`$@SkcbY&YIK%Z@O8sJglNea_Aa^8lP% z6^`jmFlW}Vm_rhl(lD_)$NK2Yr;t%srHTs815%Ei`w`r208FpdX_N4}N(_G_6Y?hJ zaiDp5D_53qNey?K0?3_p zS`-=L66|ZZZ2ZY~DY9g;$j8Cgw_1z}iI+5}EJT6DZ&-gD2b5TFMPI%;kiflkC*M*s z6_)hTMZv+V?3;qVYQZQfnpLg+sU_Qq7A`#lL#m}YU0Kjz#=0G#S_1sb{s-Ice0M0`3UL%b)5J>GD}vTI z=6|ak%Ub;vwv|TwGveoNtbwt4G#Gp?z`Nz3BcRJ@{3Y>yc6m98Ixj0HRiz`fpY{T~ z^BPCCY*q{fWH51NeXk~Ot{)kLOt9Vk_O1=yh=_=QOG!_PiHPt?n!@ALYoJDT<}U#d zkAKJi&t>oUAPWMPzokH6?7!mr@$bwMg8q&ox)=XEW}g({ z@Lya20>b~TSN`8THZj3bZHk~2eWly%x(gdA)@kDBv15-0`^;Bw&?r=>c67G!H>`Ac z^@n{oY?MMknPALOYgqOXXl;e)Hw_=qP5(wW1NsT3Rl|yNd;@|Lm^32!m@|ak%uh)F zvu{Mup9E!8Sq589DMUp7cavZL*(L({rY!ROEa^JQU`I&F#PpG9}=&cg8_laniL9+P?EKkDmU^T)={3l)$f7u#hu^o5@q z=aQzM7;9=8Fd&*k#c4I|-=94QJf3b$euxCZW%|hnt^8WV08yQ#C8n}6IeB@DO^g%Z zOyJBk+iRhe!Hyl2mej|Ce z+&LsMAMA1obJ5XRLPJB3%@mIExLI9qs_{P%ALIjBxgWQd z2R!`B?zY%%T`|k=@a#p2^_wxVwl1A6QG?D;j}5S1ZVll`Mk)Cnn{yV)ToOW=p}1|6 zGrsOmkAY5R1aM~SSi)(`nXJ$+iF7vBhA9~d5*zw$?ir779m`Q`81UG9=C4v{RgOl; zu2bZfzbiq97uQd7B@Z+p#?`hA!PO?E>ZJxoW{G|TC|dT?ZVlFXT6sCJfWTxHsL{u$ z(3O&r_gaBL!5!|8-lz9XW#oM{G=g_mg-%_mX=#_G>SK^R63uab-Lq40wBa)Z8D_vU z7t@S&PlodyFRxFb``%sbjR%-FYk^RT89B)}9b8yen!GSbbajt4%<%E=8ofYsm7bR^ z4R&Wyn#GP^Y7)xNuG!eR3ls^oiOBR<@MPbbnVGOv3Hjb*y6h+@Nl7Vf4T`eJg1bv5 zxb`;sqj)NG88+pPh>5)}j?Dh(zbp<2rp6-21Dt&fw_ zSTAukdThH~%K}W_+ko~ViUg0#ZQiwEGf(&L@v@KN@35uyCtb9t;1X%`Yq_DEtEj4| zKh?x{2@puA!$d%zg7W{|U#%b=I{M== z>`c+Q&KLXoX81P_-S6Ktrlz=R+}5z4GAaD7NA=#P`nQsgcUuSL2eYL8ea3nDCMG66 zkN3Z4X4?G|HKe}ap~{wqaK~6_Fq*w=a(*P%O<-hVS`ri>6ZRbFcnjvm5R_PIy4*V7 z=^BooDOJ5bW{JgCBo$1FjkPv3lxWJgc@)sFzTUoi+gS?1hv{q| zFMTQ+f|Pf`8W80s8MQ%+moHu|-Ji$|f846;^Fewu#lt#0I4IzA=q`F6mzGvGkw5f8 z<4ryuGDMH#K~3vX!$P`cCTzJRETf&4{X||@R}f}}te7#TL#xp*>&spi9#`WuRByvO z^oP-oK(CdRlap~LwgIiq5;eWWx<%WOol!;kNF;eD{QMo%sQO4o7L`gd{v?mx5^QdcikW+Rd%AQ{XwSmJK&`9J#kt+j z45U54BLv<~sH$S);t2O5ZgCjdPdhxcTWR-kf65S*9K_VPz+mOzQS^OGqv?W6pM~#W zT6iEo1fP_b%?U4{kHlw?5|YBCb2rwfVUkWO5e9jb90GYc3dAtNcEPT ztFj|)hvzY@6@2+O>5bptaNRtJ|o}jJ{inmg0zUZwnbKh_~oC%O|jmw~Z zJiitltn(fkdAK+=vK*9!8Om#knQyA$=r*~F#Jahjo63jRnshet1-@_9QShvG(e-DDaJ>2F=m0kgFDe)Vi<|ZLQ1DNHSe2H3W{Tq|?YIY9%2i{=z zQ%;)lmp0#%f-yMjYSVOeh7y=035p^59fS4%EwIB8vNu1bOV3OnKH~+~9!wN#W8kPx z;!8_E-Ct^`Z(F4hf?En(~_SBPQDdnyr-U0hTICC6fgTy|%* z)#W%R_;$qo!^vX1xS!AcLv8I3jo=CJW5_RgevD&DYQc>u+Pjx8*pUT1h=)e(!1Z*L zzi%{HbaOiJ1O(9|ex6-pAaAvD1Xx;}?JOIo?lssoy}CZ!KJYlWbGfrJG|VY1>_7Uf z!Nu;WHAz#@buqZBWuv`2(k*i52=uGaH3DIvC@Eo9v;c8$NcDbk3uYc@p^YV~2 z>^=C*)*96z>_W`%9KwF=Jz0po!lK{)?j1q1hx==&R&3qd&&=9&MFsjvZFCo(Fco*3 zzkJc0=jU@wSQ{{C_u8RFXt_2L`YF4;#6&^xRvJyb5L5GCHGleWRIzD6I38Q_iC{9z zWVy+tCPebR34!KWZ=CBTHJLv0zlxr&Ey19HT-ZS-km|2oFA}Sj zkWWwjaiqQPIB6m2q{YT2re^KFBeQYWAZhPKoOTgj-ZWA5=bxVs3Om@%I@sG!O>M@j z3;5nk+21wkI|1~pwaw8m6XOk%bmNRp*h0x*a(h zf6{}H?1b!H&#dadCl)Gu>!q}PyDrdYPa5Z;vEAzcGKIA%>R+Rf;uhGh)UxsIXAn!M z4~kIT-pEM(b>1;yFMc>Xl)QWQi3AsYd;3wzGBx&${nA8+Ks)tY*4ON3*+tqy)o08f z5@yr^jNba*%n5a^K(UM0ieyfYY=eOr(?N>}6 z10Gw%`v(R-a-1~V?yUYg;_w}W$Z?`Nb^eSOvl_u|RRgp7WTVvZ^l}nXOgD$a=m`0Otp|DvU_DLEw>+3Ky_=iM8^72XFft|wuTs%oihl%BK4z`#JG z>#5;>>C|D_Y<%kd*)1wM$w%)W4}OV$(mL(-*_IJ0wNikS^BCo^d=YFG()w zXPmJ&3(@ZxdF()<;!1uS$HP_w#cKf(J~4r_l{;@u6Wk;dHfy$_-{2ix4JH1CEHVaH z+rigendPyrx;-obL6vIJ9&WNyLE`k)g0ygHq#ZV1)wS~^rD8g|J0v8|x@L5uLaGkA z5I>cH7_cj*G*^3$>VI}<@YOyau|GT98Ni!3l97Kdd1_d3_=K*xGs=do^{Sf70|ciz zRr>c$WI0~iDpgfh8&3@U{vGLY@oQ+ILB;%?ZbGY%Pcb8tJKb8k)}f`G~3HYe^Ij(Q23*^_>*gS+psjr##&;M+< zPOv_Ke=$SGQ!vPcU+a;krKLBi#j7+qen0OK^}xWu!I_L^g?>K5$jx18^GWq1ZW@hO zlwm6dWMgA9d$yH~Nb6Zj?|GL)YiK9a!rZD((Avs? zqA=1uBwJaSgjBYtYewoG0qs$Q11|yMF3`UMYVM`~2@t zD9H01g^mN@4R(6?T+p@!KnX{NN1C!JGhvs6e=bi?uNx|B4TbA9?u&z z3yMD;>m14vpDSC>IutX7lqKz{A3vb&8Ez}pTPKpX?XsjF0BKBD>8$laHqMY$7Kf^FHyY`5StFfDfs@p862<56RTmjHur#{bR;fwy{b< z@9o-PKB_+@tzm(;A*sMzjgc3SuK;;nZYwUt?=UxbMmoe?g?TaD2y7--kPwOW`3tmy@-%t!eh^boFAD*|Ybw#S+Y2lVAU11wu03 zpWemK3e5o+#LadITX=hEp@EisYG&pN<4wEgUhph>Z@=K<4kU1m%SySay8XKdkVh*T z8UclC=(WF*=*uIBUOu-iY;h2#rJ;D@;wiDXk%VeC8e)0g_DNsJuifuj;cGr-$*)$2 zqmr?|CL%Hm(NXZZt(K|VH?g)E86MWlFIety+gWcqC)G=9*=zT{ec$gP9qH(PZaQi` zSLQKay@mD@4H(6kcisIM5ET_YAwLmu1hOZq9bF^<#mmfDaj@!0lN3cUjnC~0_L{2f3Tyd_6pSeI}DnYDFK^b&~Nd!IDwLsB^9eR z_$~#ZPwM4EpM1Cjuob{prhwz0IpPNbu_^TDO1tlE*Ax&GUv_z*y};W6Y&FZ6{tOlx zTiROqK{pO)(Q!S#uuvaXqW%p2V>yLIg4dh%L$#`HZ+%n>E?DAY23xlo0ZLM4d z-RG3uJa&!>WWs$}n@YiLn$TXZ4>b0i5I5WT`^y6jB`?aW_7gKY-(5I#I+&350sq$jw%opxwUx$#~iaP zk)jy81W|VNY5y<_p+gArKUa-DF{-`Jwyy2CsQzsljbVccV+0s{V0@~@Cd0I>JfS?~ zxZv#I7zpMbP`o0jb@+R!0Jt^rnp%jQ5ppe^t{sEbJ+#VULyVNgin=`-*6d}`dnR5s zMk7xs8wYE*iCE40^{J!IDj`j%?rAwaoD-T8*ufEvT~CpjMeYZCb8&iM4|K-LQ1piv zC>d7dh0z?9ZMk5pU(l$LQMdCBqTGcbiRVP%oGVBD2A7wQR8h82kv(k$M}bAHRQp#& zeC{rfL`X&``KYJ_82$uTR6x6f(d`|W%`8nV0jfG3e9p(gz$Ez486YVcmEnG~%NB>0 zZgv0g;O#BYCcyBKpWnj5;`FUF_XGSg@379Psk(rMW;8Yydp)y!rICw%|ND);{EZ2y z#kKqmDIeeQPO+mtYZJui6pK*HVsE{vRszj9(B`$$unnxTYc_Fm6FyVk;+uLJTr}>U zsLa+QC$int>T}J^!NDLXNXf*s(HoxVbxq=ZM)m#KHx#6?Bh8~#?_-A8~v zzEBZN4}OJC>TtqORjP9_+COcAe;!;?9Pph9At)eMQcV4! zP{13Ph~(kVavK~AOFos`;?G0N&nWfCCl4wfLIKaisbj%c>l>LfWmwA)eK%RuaBA6Y z*W(EmAwBo(;;5*^+_t5b>yyz(e9S?&&dra-IqWtt>$^Xfd9N22h64CzZ08&wyG)QK zy18G_Zo_JAMf_^mYet5FI=>vP7Qg#$(M_h5du~MQwxPAL*sOkkbz}weRtk@uv7t3F zDQUgS!9K<3{>5gOM3E|r3z?F$8l)y#K#(4EwW;q_2-2}{)%&W9f+trb*{YVBF>d~> zJ#W}KT5#K|aoFJI=TB9p43_ywheAihY1s>hwQ5o(B#N6(0BMHRd^LfKPP?bkMN;Tu zh}C%l3D9%;sM-9jA~Bu60ndfIOuL2eq0RTGqn)cbasnazYCM1mEk-Wdt-Kp}v4ENNu~Y++kRSNc z<#4g-X&?q?O1a6g5)7t}W8j5Sb8uMA9C|Eir_4-w(v_^m7#7klUOshq5wtglf~g*^6&SCk|rgHg7YfF?7?vrSF)R-oyw!Fs+{ z#Xc)HSJ#5U3P*J#?T{x~Q!^2wqhD!XJa(f)`^u}O*Y9cX@Gw3jhRtyEg%^KnG6#** zD-SO(v84yUudQ|~*{3*uMjq(#;`O#7(_Jw(Et9huf-U!))(CdBT%~W%o4ZSK0j9HAZ;H|zPO0M^f2VzTu1dkOJtnWI|z@O_raV ze?3d`V`^;`Y<96Y(H`%I77T9<%_5-@Hn|KD0{6oJA~}`MMg37fU7)?e*}`hye6}4P z5M0&z7(qA<_nDaj?o{p9rED7S;5xFrX2!6qjh6X-w9o)tG^nCe<$JVPFIF|vfGiE< zX_T5?&XlJ%HS%d|e^H82@-*Epjn{BHUexX|(C#~!^`^A4u(&*)247Xj)x_21n;5EK zA05~%T#wy|eo(;sSc{Jsa8E*VXb}bYJZ@^*njAo#m&~xEH))}Yu~hU&gr~aFO?iUMFQlta1EDFhC2^JhXA})~8_U~>Ut282(<3*LL`Giue=aspsKB{C7Vq%YUDUp@nB_Ly z457G%Cut{*_xI-OL=dh$++oPddF!o;(cgKpd|@3LoM5L|oBt(3nb{##|HLxDQg5tx z3WP;*R6iaz?rooZ#oVAv&r1SEXSdlhWgF;WvFF`W{R7deevFVoHrSVt>v3xcw}~+p zba#C)Un*&~d=^cP`jkcfWI95~qE%~sP_HZMC$5?A;Z%6O-`#ZmVWrt67_lo0q2u02 zh0K<7;G?p+`Qx`}?JjH__zxoVYSFUlv8}cJISR+AfzHCa>(M2ti?^wZ;p6;Yglc}*tbeuW7#ky;Oc?m z%V%=WK##xj_?rKeq`@U4Nw*eFW7EM-rxSRCEj(7sQjyQH-*1biZtY*Da#{V**49)Z z%>5YmTdaLSmA6nnJ5Ml-S}x~Im(n5%wJG|Fsw~Unrro0)w=#>`VJqXTUpt zer@{M!zs3jk&)yQ!ne#?G#?-1>5L#NjcuMILA$%}UcG9uoGwKpolA8@>ln>|SBX22`Dv7In2HI3vu*8$ZLjN3k>Q78@gY zgiHuDn4ZF``D?)mjG7+jGwDBmh*??57FI`of99(`lYm_T@!xLoIDdok+5$dXuDa0^ zb^TF^9M;Oa6S@U7i|(u(Vyi4X=MaYR=gWZqb`(`C!JB*l)FzQl2<8I4L0%WC(Qrpe z89Lu#X(U-*#xs8NntCN8OqMn9L$@-c0XBGpP})mp^Fz0InrzTNUO|cc#Sf*!pQJn< zo%hL$)kmSCRzHAC!~g!jfDK8E{T2A~!|n%%Q(RR%wE)xOttTdDMMeC_3-7xFIX<;< zf&@rMZf-zS)Xw$E3f*W=SetxmgB|Stb0)*A?N~6hB>XM(O(`*>(DhiZcE3S4l2SzH zT6e!6sjxg2Qz1i$HG{%!FHk+dAp7VK=c2h{o5od+F%CegqkNx&qNi_h&tb-bM!**Y z2YbQQ2Zun-gDP|C9ll3K{R()FF;s=6h5Yx0-=|IwHC2Km+gAMCM~^bo(j0-vv&7G% zv~7A(WN^fPf!Xo)Nx!vpR@m<`2MCKBJ5a|&dFZn*p-{+HUGr4k4uWkq_7|9}= z`)hGY(1JAC@p<>HvhI6vlj35?`vsTL;oq z@kD`7pt^N&CPslp2`tF+#Z3=INr_ z;`#gch8O&5FXQRq$Do0B0cQi{LC36d7(xUKi|ob$R?H(a@bZ|rUmvwK9+Bs_%W^@NcR?9%)$m^2Ssj?lno2Q zKDK9oaAm{`8Ba#OmW_o|HASy}Dj~~?G#Q%xlOw_$<_#cOQIcgnJOTQ~^9Q9}EzIV* zl{TW@boK@eYNV%DCClsM2gOVp6>5X6)&()?k(9NI#QkX&-KIg5_r8Bk8}EaMr~O;s z`D(Ct!#kyDO0{PZ1qE*(Mjle&mqQw-Mkz_}ROJa>81<_C@jXu&HJi_X7O!|zh~Ci( z&o$6LJyWV3$FZBK*6N+-E;_4`eZG{eQI4y}HPu%j_xM}xshT;muu?~Y7@**U1m-!=CmESRKViC|M6SYh zk8F9=#fWA_lLls}LZCj?Z?KEwrmIeqqptn#2+`B>?>$fjqrR)~hD$-wwas#)M~h1S zuW#SN79kX1M7q~`vNz$I@!Ab1USlcm&M)`gZd23Ty{~;i8DTd?w>F z_D)V~OEQ=@EA@PC3KKLTffW$ZotBedYuN#C<(E<|0|}^anYON+?JEo0et#T)d{!Vu z@BOtte6y8#cVwX<_)P0?bH45RlddIhULrToM{1}IJ_(Fma44&HaZ9RA17g4gYH0)D{0|qe_!BXHgwrzD_t0! zjC@YQe?70@Q5$#AswWep;pyNfS#{{!x7&COo~r%G-wPzeKft<%o;1ywnwcDzyLWXK z`xp_QtR#(3*SDxI7#WYkobvP9u@93U^$9EM*E=HUkHCN65vr<_Ux02n(B+8Lk$k;) zY+8We2kx7j)3`CWklqgh4{n^V9{UYB*u}V?ylw|0o;`ReuWoK>K6ZA`jSZ%KTQgm@ zS)Q#}vYxKCP>L3I8~*i4Atf7u{b|%h8}N4<`|HDJdfiMH$eWv+iE@TOS@OZ_G|bnh zW%A5PgF@($PCRt#X`m{uHB~CqOb-e0jpg*F{`K`w+%>>gzB^vTP=i%jt$Rh!ZC;qP;$Fo(M%6bmukfELDQO|g^^>5ie4#Z zP>uae;jYjhNSMau!`Gv<>@8kMbh3@}B+*^l5+4cLQ7@)MGfRqT*DJdZ!Al)r3UDBOH zBi-HIjFQsQ(%mK9-8pBW&-3ng@BQp^uIsnYbz9GVt$HT!JM87)SdU|x;*%nBe!x1I6iU}jBEY7?(RX=p{$Bnks zc#)=jE)X#@4qem`J3r}ew4YjrtdJ?$RsMW*O!@4^gdr>05=`o%KC7P zLRpj7rFcARV(cm{Z4YUDLKCD|*?4(2hzc`(t8o3oY^p9($B(sqd~>wWc6)-7mbMtH zm#w#Rd(K(f@~vL}smJ7ZEp-mrk8{XG-}k(qd{`mV>*jc#qb2Us*T%h>|NRiPst0_mL=7>d&_!j|st(nzeqwbh|izg#)zxf@^+ z$+x7`H`a<%u|4JJ^owPCN!|W*=j=FPA4ElsM{fMIqP=!ZO)2Cu%JEt^N)I@g3d<`L zE)LB+`5)ZB{+?TTOh~QzU20p6is&rx^3p-36W%+D;#qt%@RmI4K&!}&TRztAddg7mdMYqQL*&OXQEH)GQsOz+-B zsj`c-wO?qWke(?>iY~tE(J|8!#L+g>C+2BN=)d3A)@D7eo+g`)%hF5@|7fg8W3)Y| zXB$Uu^X=z0S2U&tN&{<|_CnE$%ZT#eq%fstKrpkjy-l(};NF~@`Rjrka=W*jg zpip3CjQ?qm-TkJbh^DUv#%F%L;8P19F)l+RY~<(e`Sb6KB&fG6F4zCQN?bV;$pb4I zFUn}5S`8}V7AX0!Mj%UjQhe@4h zk3AY1+_FWJwpQ|))|5qlEj0PxTQ8z@z(PYtUch1sjEFj}bME)J+l}2B_WE(a$^02U z`5CnV#K;h5|{hSE`bgjOLI7{}Ev^1RUO!Zky;m}G$mp^Q_ zp{-soL~694G&KyIQMN%HIJCUc*n92OkdP3+zqmH>LQ=uMqy+73Vc~vTJJ*68bM&hv zIx~)d)V))Jq(m7bO=(s-;tWdL)J6-+l}3F5-JFz1WYNtQgqiB!w3DHlnCYpY5*>If zfjh2KD!Z;G7>eJlKJN}XOx$=*J?gZ%8Ku7tkC&7Pn)xwo2<;xCi1X9f z1(Kq5m&ac`+@*0))a$7GxOAs8(7in6khpM>%;><6U$%m)03P`$^23xOTJk%lYyHt#t}BC8 z>#KC0g}H{*y7@s7#$7NnMnvFdjbMts=r(hFvu&0BkVVN z96LsWRbi0eh3LYhF%tlY+`rFm`o@A^=w&tZFc_~Ybp^gYnWJKKaI}->ixo`E5jEpE z2Bw%LCz$P3vb%k=6lTLwnL?;#QE9Zdj|M}(n>%e!Fv$9fioGQ5IqR7`^7rp&VPUyC z+j$wGG*V%!n*P#!Nw)t%nZy>>jG+4|;q!}!tKaHaUvx)NN+|4#lOZJpR##7c|Hfl! zJuTngsMVrKM*aJ$^aSH2m4#JR2|1n-?%t%k2$$tV2-+WV1i(`sJqhzJ$F>9oaX_D+ z`-{hqqd#OuRZf4cUTun~G|84m@$8tvihn*`)qI8i$e*yYig^l#2kT=A#_G5UU9#_ zIteptr_O8?gTqB!JSaH{f8+S@Ow;;1=4*_E{qDStMoGirf@&p=Y1$g68eU$YyS7hw zXG!DQ>yjJ|i>Vfo(;o^LXx^KvPKPw6+}>hVqra3BAYQ4ayfB@wY^Tz6MvTnqNn5md z&EI0Gs${=0)7M>iUm`UmZJ?{E#rGIyJLQ0gEsJ=x(g4X22qcqt7HnF8*P{QZ!}f-B z;0=93fZLO2^fd^#69;mHbJi+DW@AM}k^cB=&8`OGiL6g`I#77NLQHZ)!bg}m*LuUW zbcTj6RM{im-TV2KYbEg$+Dq=f;PPar<#MyXR|shcF%V`G z+{cJGC8lc;`8as-b`+OnqDkHX3FFX(0n-{=nSJ z0cpbMOns5_IZVjs@ZxHHV{33F;7nm3h##b0Li{!5xx~4uuRIVSD)n^+5)+ zQRF_ZJZYy?Y|Qh9kL=D$X%tT3GHCMF6pW!W<+_axUz!v)gB=G2@p=hLCa{Hw{JQZw zbG<}YWiwYCEl6*?e&;E=F;+a^OklIT?$7O7BeO4Ft#E1KygO}gc-=Z5x9A^VtEQ-i z0YWnp-)vM>Pe*SK{fz}c`X0j$8n}_j1%p%K8bhtH{H@+mD;8}{mNBh(+-fkB!(P>d z4a?Y(@6~$_)wo{mHcG^~ojaUd!ZZo5FNW8q&vyM3(DaiqT{_3%YKRptj^nL|4X)Ys zkEH>W28rogJINKjI@zikDSAq`U=tLC3Midd2%s9y5`AGEoaUV8)Z?9!2Ua# zb3f3WqI7fAWZ-xsl0yC^lhcd&f$nAvB;qKHRk8FzcQ>wTi6472)v=vkxG&>u%$6JO zA0Hc87E3`c&o^c+#B81x$W=ejrV z(wLKyZs`cA9eYqzQ1JwRIFBzaCHbgh`5^+aG+HU_$J2!*dvp%Y7~AqP+RXfX5kGs$ z)5M;lq{O%8(D|>V)fU+4%^yo`NLTE)MoON(ST-;*d1gz0dD%P7X}`PV?13Kbt^6^e z(HVBTJsENQkxB0y6t8H6tZ7AFUg_Zrf!Lj((pRg}DqJo$DywsWx%0k;#U0_POHh7h zWoFI_Za?hW;jrChGJH?Z!=oui9mvNG`($dG9XqbO*z59^G=Ru$*Gkz^M0&2!em*^! zv*P6Jh=G+Mz~8^ta_KZ8yU?Lnk-{+?i$=w1X)Kxdfs?ALYC?Scx4QO7Sy{QYUR4@Z zX5kXe#!l1zux6eH1WB{mx)#*OM{mhnGQTLymD-XEr2GR+zrM9Zdhy}*{0Q1%iCEsP zrryQQ!Lhu$s;{pHB6xUDQdO&VpY%MFD@IoE3%NE5gF@db48$kIMNugPP(1-d(AL_X z{LV23D(iz}LOgA^H(DkpotCPj{HV6BQhYI`b-uyY{Af&FTst7eT(U1QGPh6qvpBi# z?rR@Ui%(b-#86!i*}*1H+>TrV(e#9p63K2XiLsLDo~-mQ)zSx#qB&>kogr%_uAZR| zmLiF8S+gltQf~m@;dHX8kSl2lwx!I%VgkIgEat}kt*Wh<_f*;zWq zV@QVG6_B)jN%e1Z*IytYJ;A|YFlvqiXQ|*sLD_pe)N@!psS34 z+80sp?N&PXH;F{%A`{$ul#@WMj0gwku#b|SQ8!boW(ZL?apbl}X_Je#kUUbJK{(@m z`n`A!5W|>`XmBfOrFH=bU_Yp|Oa3YJ-SSfbI|-aS22xcJRhOUcQ}jkRxy^2jG+}15 z8D9_Li>s@gY=fd{_eT%lp7*tmWVzK(@jp7r-Yr|B`%d;jSgTw89B)xh`CqLo7YPTSn$(I|Ds^*uk2nwqUzQ{%RPY&M6*x2WYF4%YI!u zn}HhYJqJ(4jN`=145G)-YbM5hd|0du7<)dVSMrbjD)~)u?VfI@I^ML#_An#BZR$=~ z=vASky`tAr*kr);dGHL*9r<25zI+noL&P9=E_nxi_`yxqZ_*#m%1==+nq+G%-uZQc zi*UeSrmeOI#*d>HOe6&_tLq6h-f8`LZ5sl3Ha*HedwSn7dTgG-=H%~RJh;!dGFWDP zaHG?ht}5`yEF_KcD@KO>``bFL)A~S|+u+EMy#?$5AcU_XyHNpiB!(X^0rJ1Txt!0`JMxM%pfOM85%*KO`0{LAq5 zoa>=C((#GuSZt4y=gkSensVn`qs6$q+Sp1{_3nTw_#=ZstCEimAnge}euRQ)aNh_g z!7wovYa5!M-TUX81>oN2gSXmdlQo1%ZFK%oOQhw2(fuMTs2@TgG*Jb39K+LD5J!3U zxcgO;R@~?3dK)si4<=XA~&VKz2s`*D(@m_}iecp$8D;+n&{mUVu zoK0ZFa5~%E+*?~(-qtlWijRu|%wd)3RSH<)4uY#c-4=m*NVDFq%s!O}9K`Ln#)v2e z=0|!+RtJ{?V@paj$_~1*iJGhpg)M4Ni)Yo6O}nB(APEkeBa@>hZ@~ewSh*t3x6*Wc zXCbo#o-WI)es-}DW@Be3+W+$fgHT)D*CTDkG&@qa=UBOhc;4SmnN|W}UYCZ_&i}fnQg*^~xSO+~e8u_XL z<@VBS?CaqngI9koghHpVIiIz)qMX9b+jNgwN%-J?P(Z^RGFDG%X}P$t1FOZr&o%m6 z)74z{=`Z20eU}M`XPSfVzyaft$9vCcLkGpCX!Q z5F52g<`Ar@W|up!vKVBXiv#Ce0#1E4+YbU)qbP1`cvDi4IqVSRnH@NEjWv!usNZPi{~{ksBRzY62gk)}Dj zW^V@9D>TfcSG2Hyrj@3rJC4pKRvPKAxL$jV|REDbE)hZ2!7u%1a|e&3J$cbTz>`1^%JBi(yo6_I9EU(O( zy(t|yh7#XG5H+O=jDi|qVH`j|)BV?Yjy&<4Ilpu=F}4bLL8n$n#dh4{hyGj+*taJp zCl66Y#l%8GrG9P2M;z{D+Dl66RWInlquXCz0Yxsg5)@gIhia2|m<;vd6$I9IQCO_L znF_)3_I)TP&7rp`ZU$gKj|SegK2wwN0y8~5Eo0+?+}uP+USy=#FR7tnriZbqcNlfF zAHb-8FG^`2f%DaBX+t?>+Vb#RgCTPg5P>HmBCe!tDo*VtW_}gX@Kr6NZSlAI4Sko_ z8)d)FLBt=U7Be#&4N}L!Y0OBMp4_z>@ejONE@N@J{(=Z=_dwr)i&L8Nvm>5|z zgrVk*FBw8p)#@AsKv0i*GSAwz;LN{c%C&DGTBa5n=> zMjW!M4QM%F%I1IknAZ#-l%;j+B>+`QZEJTZb-YbFvU<#9Ef+BJFqhteoC^CaW^kmu zoR?paUbFJY+??I*O#EvhDK`6E;`z7+ZVh>UVFGZba5^O6ZQgi>H$B96HN7_KBg;ip z@aS$mOLO3xh5sq>SsednbaXWTB?uRO#Q;^tE+G0W-5By~;OoGX10E?+r@8vIAGuP` zK!(-Y4SS|crjyHS2L}r?$L!1ZO@?o1Xj&(J3Xeq5($d_&ttE~2izyQwm2R(&#oQyh z%L8}U21ezdy~(vQGj=ROp}2w!7?D+pRl6iykS4ah9CHAIBtybNLzOCwn=_?%cam^} zjx+&?IKF$6nMt^@ZrGp1o$q+me$mm>*O%V-{9NJqq;G!y{rsopFTCPK4fVB$Cq{Ec z;a*(1vIjrXb^c>!95Neq^?>~6$;rv>f1Nxf#Mz3!#wEm$0D;25kGbip;%^wUx`7U< z+-?b}XLgT(4rObc1{JmV!!vr-v2=;TRk7F}PW#&kl4qSgJ)4sz`^BpE73Jl3y0t62 zVn?stnFb+bDT1TbzO>tNtmAz3!l_jW>f@8+rNu=7iAZ8`bNYT#2uzuh%{`;zaM#S$ z$v%&d8p{D`Mm2Bp71lmxw8$P&kJ?R3WdJ6hewYKXw|CRkWV1D z#Ez#)@Xy?ElxxaQ&NT%?3|?0+-H)fRlDQIyL2ME{mJ^9!cJxlWXvmZ{n+^ z>dex)-HvK)HOF)mB>{~2U?jf`ta3o=Mb>RHwCXr#n!V_Hd+hilEgaHwQS4T)0uH_` z%*<-w;B%5YRp;%U3lxtOTfaUT>YgtO99EdT9XFlma;2_+A@gng> zTWjm=cT4BaAq7Lp-yb!A=}u=_L^7>L)G55h`9N!K)!62XrS7KIdYBs+Zs${)e4`^f zapnI~Ip5uBQOu;bIL+9p6*yngxbc9JpujXSX2kNc2mVh*7eRSY6~qnuSm4=kt?8JH zYq<0#y6kgj9jE=CW{u5>hI~1oA=uYSqdo7}*lm3>){i*2Jc%Hs{$nl|&S`ywvSx*{ z71wC+3dIyZ#|l3gzfeB^oyB|lhFh=}iQk-@oe_rpshUU>79TXL?j2{&ZCv8IY45+D zqA9nG>%w_!X9X~f2JVzQR$wbIma_j@>U_hq3jLiNbVBYocV7c8?4!TAystNIJ)UNz zG^$cTR%d^a0^_T@8xRi8aq!NcPdand&ym{50C_EsaXX(NKP)#X_@}me&#dtHac2v< z6O<#S3B3M~E}+ry@`cL~-9c{-)>tAG7t&bH7G?COq=0Lc4R;TFcai5z*D)ZlXN{Ar zmQ#{3w;?G^BeB5ndkKT1_(JuL|7VBfRaxi)x%q=WAp*}9rPPXy`7Oc5;d&VFS(^dD zpD})ggNgE2!+`e~#;~6Rzdy8l&Ho&0@PCp~@c+xZQMJiSx?gZAElI5eadYCivJQ9Z z70?|;jty6FNX>7&bIf$+91iPkG^;W z|Ct@yQRnUhDm<|sk0;oE|G_JSxtT}5fBNq!7XQ1;Ey@t)?qd-BRa5E zzedyF6PM4QZDgB9-*D22>#rw8yxhNj!c9Q}Esjp8GRHvmoPXWdXRP7HRUECp3m8EaqzP;K%&{^Fo zn&^-MCvDn`L%4lmD{1jWjt0FC&o=i@3W?d|BU-Y;a%mh1{H00At{Dr|YZV`%6A+vo z$%FYs3@jh+CGo)uZJyTsWA{!ff_ob4dUfG^#;T;wZf~4G33YV&@ngbpM{h4XO}Q*s z%oav*g&7F~5H7lG^v3F)h0NxX{jfm5<3wlYH&ExAjG3iy?$PI{fqK|%=sT~?apoz( z!4oJ)#JE<5xALoEtZ1r*^kYCG1kOMwp2EQaRDi~vzqk)q^t3kwr z{+aGtM@NOnDEoykUy_ZEL`2HH(+-O z$_3ucEDUCIbx-f}N#nA=Bokmmmd>lGC>);O8aF?%BZPx{>?5ex%3zJmYInG@bwR{M zsoz~rZ_el)yxjta)YR5iU0#7{o5W$OVMyj{d@UGs?SqL|{tkeTS!kh$hU9Qj9}xXS z{5dgrrAOjula&2nP_M9vNh{kA%!p&wyV*M3LzVuwZY84u< z$1OPjFoeF;th2E_NeBiZzfV~j8X;}}sZgl1G&mTFc3A>;RZ+oFw3(3dV-!U`Lu0G1 zXl|GDpGZQ7>cizCUU$;z+WLB~jNMzF7NCasEu9|PTUX~CudS^%o3B>dC(8p2CA}(R zD2GbrEM3`uYhO) z>9DMNq8&UE?`$`>H!JYk=xUz_M#0`3AA)mZcD=a(A!j0EEWIY)8$%K~I8uDF!vr4^ zBio^@Z{fwN(h9n|)4MJ_vBn*pTg$7T%&X4#c#@NohnN@zgOc8}WM~U2@_9y?VuggD z*}x4g*Z~cB&JbsFSJ&as^yHcvj=QYAw~fOt54g# z`+VWd%oW=Otlq=tHo=@CiemEx*abTop|wn!~85e)7OF_FCrR4t9@`>)zrF1 z^MGdo_O-QjjSuqTA2ANBAuFj~+|kvZl!9Dn#|`d((*RqMw31tJ^6`7xZBMiWaN#8~ zHhJ8RSjv4ak-<2eWf5q|B$aC6=GGX_xfNfa_?J`{0yM%*`hC4Tr6^mY-}smF!o3`6 zGaVdba;2ohU;&uKc=!><;SLm5DR1p-JR0tu75X;M^%Z!xWU=A<5ACv5XI=bvh$W&e z6zctua@q+X7lE?B>YWGq=y7BzS2>BfxR!=is4I*W&ByBQB)_(WtItvIjFD$453JPq zWOUgUK%_eVdx{9tk77;Z=nal`JZqG>?$;+RfrLYm$Hn+Z=%Wm@>N&E*BPLfk%NN%d zTTT2zP>uS7<4J3zp1FV0$~T13!0wfY(lq-k{Yq;4SZf-l(1XuQ@FOieetoJ zQ{|BPvx!NWP3JqgXG==ZA;pp@u;L{H-H_RC3GM3y!E(cybk{_XKKj;dhV016$H(XT z-7fj&mj;+clV*2DCSgKiqD=3PFHgN{Y>en_7P8ez=BWDPxDQT?oeLGs9iAVtk*}f3 zz4&|DD^TFrsVxk<{0BzF>AJrEEn@ovDT(mpSfSYt?(x}-PxlP8p#C))KAY&h^vrto z>|by-&ks>eC(`I{>MagLFCn9|0i0Z2U#sEL*xrNd=>m*=?JY6rn}ofv?1+h4nyqWL{bR=GT42;r>&M6kiLKW~cn?8*T+JmjUP z(s*~kCg6FGC>XN3?L)*5t5<$|YKiYEtC2HQF+bm5<#sdG5t2-`OiVevZW)Q)liFDv z7SHB(oOWBkHyi4Pfi1md>-dwVhWs&oVF4HnSY_X1don)9M=aJ=3W_%Z{;p{ebhMOQ+G!D z)y@=E?Q%*($;xVWQ=`X+tuZCASZsCMB29I5`Z?y5T$D{b;8ZwDs{@m<_w2u8R%> zz#!v{bq@|Ub#xqEo$Ymmrt1615!7iOtc1=gj;ITLR%hxsP(crRsGn9*&yL1_odyD8)F2d%yGz z$OJ3K-59QJ0awTiaX)W~vja`l8z1xZOX zPacswq-_mqCMqIwu}7|VahSicf#bOpSu1mvKi1qfnZF;HrE6oW*{DVBn%7z-I@(o2 zx8mvb07NQ_#a6y#{BGXjYYR9*Rr#HHo9!M)8$}_dj?qcVS3eq^tI(pU;1S?2`s3K` z!D3rvv0Q5sU?C(H=j-ZPUoCN{_T53jg19`8(i(*DXd4(LHa0GAtt=>~tdQm&VM8BF z!un?O5Kzwp>vdI0+B+@vk+@Ju2j6Az^EET2d*w(F%rj>A5Afd2#Lc^zXekoCS}j#; zViJ3~mI|K^Ya@tdMH?#H%y*;;5EV>2x37J89mx z3KRFqn3}`*K#6IR>=Y`gA{J-+tEU1GU|)ngpAoij2x~0y6b1@xa16SWfc_*wqg|; zC3H!uZKaH5KHS$aN!PMpb3q_VbhwP}&LY*q8=1p!ik1+apq>X=0+?RN7xnFNDYNr+uG!4lYnuqJs5BQeseqOmh2Z{0vCFJg@Fy3 z%D;AgqM&4#hb?vHn%wnl-LN#Vp$*iPX{n)sk*<07N7oG7YlBZF7-#ild}xT~ zni%s=^oc@vaI~wA7leY^QmCLMfcxZddAUycoA%ANvRqyrI|<4950BU4WS|0I6yK>` zZ}$*0GGd?t$oPjSwn1{s$vMasuM*iAYWEMr!ozH zPC`n`vU%GAwwZEca3b@8^a;_WaJzQxP^eEObc#0A3i{^j>8%WC$~}A5#Cv*bC(eM8 zVr9mgyZ-IB!0;30juRwTcy}Y=nkBKq)!7cTi3mGg~C`Ku&2oVV} ztcE|=SGut#rlGu&XFe*Nw5dcb3OR!<<)+r z_>QB4#V%K7q317BavBXBl5OF7WJ-YyEbzwZ;jPbSL)rQ<>Zclm&*AJKML$? zd6e2*^(N;eAq^CETYyZ~l3~1@% zigYJfj2uIkKV`YoSmLhz%*UD1)Q^#hY`dXc4vYYD}6YfM&3}3Q&_lwO}{;O zx<7?fMhGYoY;9~o?h9ko*8x!<%`D<{@0Je@Wltg%eIm3vI>T10?e~q|^g-m;CM%p_ z>+3>*{$$FPG6vgtq&o&iR(V;TOlCp4N7GhNPj@U75lvx~psCDYp6GJR&>S0A#UBqV zh08wtej6WMy0`9x+V6~qWdqG(g2+dHxCHS|wboa2piIcqnVZ4cnXafTD@&K!Q5j`5 zS4oHFrozH~`7%s$t76w88ev)Q@YRPX_@#)tqB@s8YRHXq+HK3+5_gJ=$x$;hF1Gq} zL9TC2ZZ0dTccwVmCj9*Tg7L0~qbPaG>XdMcl*{}n5u%?6&DMWN<$d6Mb!<8(M@dz;F9*1y4GBA+=EQCMhQRYHITJ6X#gUW;!QPhgD1ipDZO>q7RX5Iywv_HqG+N}GhU z*)h_2gxy)TMiaN+{c|Y0xC6#$^$xFdCly$R4F`ULiiUwbeX;*v41l>+;BN+?l~|dC zp|#G-dCI(zoNGy~n-bUPPSl1~^S7vN8ZWJ`_HR*}Oj!HXRHb^AU+7D0HUe`f((zLc z3Lvwasz{81e(Xl#^;HLJ&z%(QuFMrHU#c_ND3)$zfwZ}2olqVQy_0J6c+ z+#2NHtAH3InF)a)b2oBUhd zn@d_?ti-ko4+z6YeZ~Uo_IVf5XAHfAYc<9Yz zkvAx^f8td-I5JpOI7W9cft1spXGcf0umQlhE)KRAxHt_C;VwHQRquDYvP!*Jui)4JnK55QaW(5G7dbbuVvm?u{ zV<51bbM+l5mMe3CuR_9{K}AK$V|>GK&~}uyR<%1bU4P|1p!7|KHbX;0H40=!hU?M| z?c!1i?Tu9Tr`@Z+zILH4ra6D<8m=WouU-k(P_QFb(8}cml~me&o{9AG3o)H4uNRH( z5)Tg{;JK56hV!5vo}A>Uu*p4(l+6|$#F7+tzqtVG#*pTxwQ0b3fPW! zSG7Su(d*$>x!k@IjoQKS4l%mGEEljREps9t7%4peb1`hbqQ7813}tVWA^N#4!;gxJ z8cU;2sqX?-=S~A&1zD_^)xEh!9%|xO@(Tn9ugVLE%#kP>R&6EMptagEN!akDvPMWWe1jt&AI}r1X z$d3c0)_AL5~-EezC*&wjP&crNFO|wKy=N+APWUg*P&9cmV2 zyPc6lifIkxzp)G7Fm^XM z)e(q4E&cg;FF^dl{;7#qtNj$p!*`He*R6_sf0&0S>8+2vQyYxvLMU%e@Vu@Ky=a0c zZ!Yj~qyI1!;qpYEgq@&e>`h6$+~vF)bsZ0WM`^>o3W-SxXQ94WoZHlM9Xe#b$}2uq z&^B*0ED9>)h&Jx}GswT0F_OCB`Y8Q%-Q!7>J!%koQ+lF5Qx)u*2^t05J&-cARN4dc zvGD5qQ*sEY<6Ms4To@LocFU_z2^GiT*9%Q1^>>GUmjDtt@F2+sSi|q1;DqlNOW*(f z z>htHa2n$x+=hNwxwGC!AEsy6IWFFD=`Xl1iEoH)5h^o zZ|-Jec4ITN#W5SvNI*d8Bz})f0-yice5EZd_1yFN@bnK)64bJ}-rtdEE|;Lo5)<4L zZ@b)(naxO7eM zA&S$qt>W`+TP=797+cf1&M-Hw@`?&aR~nk$jiuF9d@PlGiNr7a#;7FmXaYiqR8KV< z&8h((bIT2*jS%yCvm~0lNp!M_@&Fzwbp*`XYA|TSuO3)+sn%zt0aS2 zOy2es6|w7jm5&Dr;k|MHd=t~#?tzy{+p>x zXQ9hZP}Olm!h1$ANp=1$wrNI<%-km)`4l(rfus6WfE^Z`^y1w&dju2AX0AAQa=VG? z9+y)R%T3nI)KjWth~7Wc3;2`{nvu6=A?oDm4E&P$&yh{ha(^P5Z1}F3&JN8qG%zVT zH2>$wrYn0gkbDF9Nc)3@mbkbHHYKIln5Po2RhaF*Rwc9Rh<5bV^SGS<2uP?KI|EnM z0Q8x2JhIzfa+unnq=W*<-Shr6XxlBoK&034>{+DU_DuIOZ?mWlpKS_+Hc76s=z%Sd zYr=Qn6F|Do*yCYlX52q6k}lMDsIRGLX=%CZ6kz`)A@E!H(`?d$3maR?@jA!X0ahF2 zs#PT~8Etxi9x1*~q`^)g4;ZJ8-%>M8_keziJ>D4=pr8wY`J-$p#8p!`LNWb~hV_U2 zJZd7Yr^t_dJ~qTEk+$5spT_q1u^#q`j6gg{!B{lZfO?*T>e&;jripJY8+(~? z6K1oI_W6qb8{ufvYw{n2B9f2@qLib9x=UL%UNc7Eq3+IETdWpU z*DZ%1T-s_c9%Twim8jSHds-hna|F6M_|s!8$3hXzbf7(zb^rEhw@5Ku9nf*g-^gP} zn)xZSwD|ibw+F&?=H^mBvPS}osr0A3oaO4g9~uvyNQI0y5GTO{#?nw;Q1ISq%AB6s zg%fwbWU{T($`<A)u&5F1ED4+~xYc zDfY`h5jS&;3xRE#=|m2yK`Vxgyg5;A&0{YoUxNQxPp@-XG{m||_IGYRHcy{cnKchO0jwB4UHTn|ZlWFj98_q!u*qr=HJW@ot zrdI%ByVfHUPL0pMdH@{teZmHP2`lmfq244THgy2s|5&{19e1mghM3NKFL!wM8zd_y0VdJZ{}|tz2QEkXtYajz7YTayW*+)0;-; z`#U-(JEw*i87L{q$jqisxj@9z5}sV8Pr6moKZwzePYzVdj2Tc(r%Mt^isRTOrfF}l zqznvlft%{-YjWvetVlQHHBC1Va0Og2*%hp;3>hc&j!S)u+0@9540<`SAAEF`RxIdwqG&Jnw0VrPe$Py;X?I9UuA73~_`GgryO1o_^I1J(R7~ z6O|KE5%l-}gzU9A_v<}m^Sh&JKDwDgp<){lf^%w8wd-4*9O`wAZoM@bdt6mn3Oc+B zK1G(pi?T(A;&!o}l;p0P+bQ;ed@hRNnIgy6>hE&HvE54_+$>Xzsxy>nkg(kdeH@V>2Xyk`l#N zS^P6|oHB$-jU@X0w9^C&&>gXKn)wQH%Lmgn3f5CgAOK*tehscF)Fl+2n}G8}2rhfv zxOiWq5zS9X8`1^yH-t2_Cr`RE;*}%-P0Q_Yvh0RLE@ZVbIlDHQkCwwTf~|~~@U}?$ zWIq!brPb-5S<}TM*+;w}7Ong%b8d*W0X^fWz_^P2+co$1Fti;NIUhK^b(lt75@opF zoFLgjfaBzkzcYG9s9t@>8H`G_ovv`^sp@ay@1T&kF0U%Y$7prchfeef&^ZU+Z&c`p zWz=neXr0)9iVnJdTY>uz>U#ykzts2p{0hW%3?Ti+X@6j_P|5tA>uFMRkiGf5qqCzt zD!R#NLB3c0jyIytBW>1x+&k#p*W8Lp5x-U-a>t$jG2$-BxTj zc?s$3=QQ!&z7|5;7!nx5a|PZtZtF|k0;HTaJPw!7l6|nm?HE(!;luxdrl!1wxt@;D zsb77|NCWp3zJcYhA2LXfH_nTngKP?V*m&VBK zkkEJoA*+gVT09^0x;$&J=eZP7yRJr#4OF%El>au+C}qDXEa6(Av&Nkh;6NX;ba{Qz z-4>_>a;&I2s($QDmno0Dn%mKh!Ga-pTUs87-@6OpS^Jc7mV_7SfQU@eIfa=n7|f>p zwrl91)C}OEIqs>=x2wIl{)nSlDtAR%%6UCm`oWTr46`uuaDyDZhPTKG<}o{Dq4d}J zbJhW(0m!e%yW?>a9cB9cnO%hlsK!Dcm_ers)2TYw;ZVGdt_r;4^dI_z&66NqffU`B zG&NsdFc_b2@KtidzjBCJ86y634w3Mb4-RY8Gc}NRwK=8(cV;Gzv}V`>dZ5=j4pWK5 zd=;t+Y4JrJ7#iYmIX~}T$~~yh{ZL6O-u;K%?yzXIGS`uGjOQ>})dewNmnSBKoOS`2 z2`J>Kq-s~oEP+epeY$mS5{P zWeuNoOD%KnVgwd7!4q=;^PO#u+U{(Ul85f?fKv7rn*x(aC1^e;B-hHMD-!^=Wo&iU zeC#$hHc_x2B&G&t9YHu;=0j_P2g%dO?H*hb}< zN%`WGBm#VTVDBZW>IOf2*uTdS-ATv8nq2W%i-z;9=ZVpO=u4)4AnhGtxH^N6rBjc- z_5(Y!>Ko1T?kJG2m$8fF2$BC7?F7ulIszV7d^`l|1WE?E?r^Z(Sq}Mv=P#Zw^XRP3 z00TXPW7u-AUEL$+B2iTa_^*|ft9Br4QNtoHjx>qY)}{LknRq#0187o_4+JA?q@;jd zCChy;^e*`T1po<$Q=}0z}Uw4idzOjBPb*&Nk;nRBovyN)(h=%tpw6yA9lQ%^U`|Lo2m z?z{&3tLJcNfYU&^e;9U}HDUSq7~M%f4>AxhQBou`+Unodka079)+)%snvx!v&AYM@ zwYRj>K72JT!jCx4?bxfmR&tZfQJK9|C6eh>YX`e3dIj%iyJaPc6N1m)Id14#7Xm~x z@4BtW*RR{CJ^A-$f{h2#&>p}cf|HJlm==_92D?}DNd;^Hr@=k!NOhj$@#Ad1?4YYN znCi*q-+@FGsCR)x1r-lS(=fIsnQ|?l%%H|Dy9*iF%-aW@*E^1ZuIFdMXrK``kTUEa z#~*>{b%yLOp|H0mE8raV{Kw$IeCMjJ9@EKt)CTwok>nO+*y|L7HB5AKn zjFv8aKF{-|-`yoghebaQ&Ae9?<%EezPoh8d9|w)kpqUiH=IcZYE3Z?1#xgXEn@pkv zLYShHa@QJ_C<<^fm=cPMgFhoLZ8le%zd5pv8OR;cXb{(Hw$Mz(eetW~rpDpGieWJA zvnm@1LaI{C$+7Cw2g){iF-7m*U@OXnDW#vv{{yvco*%vRZNEkLXy~J&e&ql&pwJ`k zx$8c8BHB?HRQM_GjPmR##JS_#$*kJiL9JLr1y|+58G+M*QhE5<3FVf z6@9tS7k~gsWvKwC2~z>!NLD!>=Mfjpl}tT5S!zTUYk=Y^B?0>yFv+KKnIK`F`FcMj zV6*V16qt#G5E3j`B++RC3U?+XPJ1jPXi*lKerpV*g6?t>J%mTNjHca^jzfUMmqwknYV ziY}_UHLEtJb10>x5w@V1SfsxOD=Mm`shQktLio3*ruBcZ;4&X?Lbp{vj;wZV^{a1d z3xH`ksc-o=`#oS3KYeb!RHrh3C4+v*vrRj%L&S5yDOS03|2-G*eM+wV$noUrZ=3JA z4r{4q;&c8R3m9iQk!X)LI4g)j{y8t_Wn_bB%(`=qfxsvtA`)B!dsAffwZ1qwCMIS% zH0md^`X?XYps>jfR<+8t>Wrza=#-`Jlb9iALys65?# z@lH4D6SBDHnHH61^YDil>{*3;Ma`$Q>^%J@haEjLQH%GQHUg*a&rGAp4G$rp;?%oL z-gkDMzOXh3!RK0-VZYT+(wl2$t<3g0t?DmC&UR`hhQ55B1&S1uvWcp_0jU-Q5am!| zHk#BWNJ)c&xQZX~2n{Cvq2#*`5#?UEl{GRGmF=Q$>;*f;svQPg^xZD^zB&eLj<0KJ ztJ<$V!9{Yv1sm0>;;@Ne$49n3;pp)s$N~st#hq!;>0hQ~ic_)bH=*#foHHivN3rp^ z{b|zSS#p!<=8}p@_)IQxFf+@f$>sPb(Tqxw>lHfF$&c=u;*Z}#j9>Y<^(C#82h3zy za*^qGCR2Fx2pA|m~@XZWDINJdJ^ZXJ&SvvF%GpYB{U$g8^tn~mt=?^Y(=Q-~KhdD(m) z+?M1!G;a7GT<&QLKuNtd=X~ z<5hrZb9=ZJuj=am>h7(hs_OoBZxjVZKpLe%lrCwI7LXQcDW$tZ8kJ5#y1PT9a|_bl z-AKo#*=%5QCVJn$=l;FpIp;a!ecmzNGtT~tvDap?nQP9q=A7T_`dsaynzDhQFwPe< zVW#ym_?c4fB^5^mkb>&gn@M?liQmsPwX))}+EJKoFj6%-^~2DNcQqNQyIU<1afK>A zf7~-S4e+8R8ks~4^7aucI&N538*6?1qeEr-S?=4o-^+QUC!?l{H@1@@LfJE5^-`wi zjY(@&pKt@UVQh8de_89YE&oR6XE9hUu9(*kcXSlK>u7_^%B4Pm(Sx(yx#&^_Akrq;;Z;#V#U#}i7XiajyjO2PP(E=h?9?eeJ-X)o z(v&^nIZ@@C*)p4z_FdzF$h=IY+$v@4WG}3?OF+|og!BsKRyy9>i*B7aDY{vyNx>N^ zfiXF%VBaec*9`%?ngDY(`*Q3k#Rm@`W->1RE}}~eOcYJE;(bPA%-qw-7)blr=pt|= z`FVTXS~1(?^#*)6+VLL+bw=oE1Hk)!M0VYsFKh1Vihwg-7*{Sb@lBK_Wk}svuIbua z#AS3F7AtTE3k*k!HC0dc<|+Yc1_1B?c4lxsp40vi?$}dX`UB_l;Zq>1oURCb#BT)q zc%{kj7?PDT#cS<{PW;nNCZ*dvj!;fqC?GK0i{2~=0J%Lr447Jc(Ihkwi`XDWA7(2pdr__u=o%uldkwrtNwV*zk9(hg!2%N}r;sptF*XtO5VYs-;>b3lRZPmaygnCR^-N@+v^fa2KG&Qc|>bfzw1>LY@jdn11_dAwh;Nddet z{jUVz_Umy|`}pocB1o{<77Uf#01d4=hv*rKk^OXJlB1N(xyCb!1)d;&0uWttxUSV- zyjFpGqaq+=l-76f%^179DCM24e~2WE^TF@+8zXr8Nq5hBQ-TE9Scn70yk}%t@^Pem z@3!k-6q;<`=U!0|!s&O%Ahc?oMV+c5^j12p*oxwkzmqqNXgl`T>LPe3HTZ5$XA5}T z=}3P*^o{KQGDC>t%y*!~-nR{~COQ zj|}#w+7)1qEi9S6Oue+1J-YPNgm}9H2oFRj_Gci2j%CsOvF&xf6$*eegJi}@?8djO zc|Ke(d88tK67(mE({073O1`$FjP5QIwRq2`rVw{LGb?25bN!*zLV5JFVkXUZs;3?1 zsl!ILzc!?T@_<3$(fWM=T@X^+D6@h0)^4&RNZ4Izv&(*yZNTOhQFd7ZXUk)xS4g+g zv!>ykc6vD7H18 zuhH~L(-&>e4+TZpH!=>k>@s|$>Abf)?;*UQS&&Dd$WkiO0vxrhzUfcnSxw=a?Caa3 z`KC%a6`{#;kIl`ypS-yS!k$#1_k?wgL{@wec{(0N+~jtK0Ak8JsTPWs*e=!ciYh-u zhA`mvihe22!@zbQlO~5oy%qacKdLpVE}gHGq;IgLfDfV3)#*Oku|4DVyV!}ESF>MX zGu3;R^Yj-zT=^w*|G5l88WHs1XBOC;_E$7di)aFB*yP-w*4^n( zG?_^wL`vP23L@o`W%ewj{IiKa#Vh%X2le0gj3*x)-2Vfp=}K*P_hig>s(iZ4*FY8dN7r9(xbX&I9!*%f8bEiVrhq`!6VXkIoCQcY;{Yc6I5QsH! z$Jb$KJ`x@h;bT;dVT$KY^I`$iNzjsjp54@>1MpopnJ4-2QUI1O6H{c+MjVNYl!yF6 zj5dN`zVeP+imP3y)LQS?ZBpcf{gaUWeD;-5JCro~El!gzq#&Z<_hri)ztpp(SHZL6 z;Kb|vx#3nR1akd)mRL>9?lzL6H&M%{F~^7H>~u_%*CxH<&*JsVM5ia1jjh!BcyG8R zd3m<_G(g11%FK+=Ovxhb0`3^i1_Q(3m}Intch8WJI`5j@doV6PX^vbj)RgTi^elcQ zoCR`m+5B2EwbV-!g0hZlb(0;V;=n?mAXxO_5m$qH!!9yXT8#)pCOu|x$nR>dH*L)g zXa>B5<$&M$_fM~t?)~LP{qF?j{Kwfq#LOi^@E=Y`iLQtDMt~R6=Wj1$p0F@1`ahhI zK=5!6Vwi>_OKm~&`x{|p{+hrNyt-sUK6xkV?sgT;1(t?4FRb)m)z9J4t0^BY1kU(B zyPJIeMdsFnMfdxtw@JbNbRe|U-kt@bf8*qY#@Fcn`Da`I7=jnh)M`P^djza!2Z!Hn zfz1?a-GQbn1QvJj@758%1yXl@z3RC-g?;riq{F~v$|-4TgdIBSV#&MtaN7rsK=-OhatJ@kKn7%5V*?XL(XB~vj@jp1$$L}Oebs;SbN=%A!rshZ>XXtKW%P_rI*XA`V-k@! znKU9g|1{=})MVfO?h%U$DM!WrE9%V9FPh^~in4JZ3+G6zu(|P~?U^vFuYABWYs)bJhrHcamuH?9%??&VYmB5K0h<^!osX z=uNlOApWNg=bY20N&@{QOqJ*_g-U?(vaalPF~?pI9v$IdN%a(O!7s))aUm-X4*n4j z1^Bh|{*e;=e>1}VHC~nJP|kf~k9g*+gYwcpK4^cLP5oDXR5ZBbkUQKjVm2~?e&GY! zD)16kp`f@FVv_5-2gPE0QgMJWHu$ℑTnRrR&PGLbLbpsEvGvC31@0=|TI%14}O# zkTLAejDN#npzTam{V141wug>{MiracRFlkiqi5(Tx7>c4qXkl=GR|)(Omwn}#YDnG zE$lwm6U`8_k1Gzx4;LOg`r=O?j$hTIPWb_T8 zD-ThS>^T2j|KJnGZn*^mHR`;d6Qx0muchSmKoC<$*p42~#UI7Qo4(t^q&~jBK57^s zr4m$|5my}#>ALcr_vRKVT-*Rw2n9(T6)4IqLi)C9&Ix$lem?YEgZssk&$GQNvQ7oA z)sw;T@wJoj&+3zZ?*){BqDXjRqP@CFHkTz;OCjgGr{n*Y*(CeS%8Gf`J&rMs0a2vE<3(~eANnJX$XnoHB@8RI z65*6KH9I)DgfqpK=33G1mWXf?Xz{d;>io;d+tB!*8hP7CbrQ#!Hmt$UP<(BEe*FD5 zA7EiNOl$vR$Zh-li>54=Md^+?;gcs%p2FKuZZTWa*WYh6+LRnobC>xxgE;!y%&d%nud1Q_NwaeoL1deT}X7_mOR?QcDjTMehZc5N0b<@>$ z+D#&JpUp#Gq>VGZR&3^~e!`@kQDwu(*c(nZpPidq4@g50!cr`fW&ll&5aS0hu(iGm zx3PrKQAu50h+$7o^e1Fe(p_myjl?*jbpuFOZ+D&hDjaA;?%Jz?aa5pP2nU!ix3kB~ ztGh$RGHwe&f=*n9%(_kO9y}t4_qi;G->rpo&01Mohv(H_Lmpc!G>NUyAlj)1|ECE& zMOf4tRV@~EfRa@2xQ&IkVQprFbF^^)N~LP0Q!s!|Rb2VQ0xO23hL;5@%F53Ep@DUA zH=zepkB&2$H@xV9PF7lPjRIvu>VK74#Cn&S-jsVTOG^KVW_21oqqAzxa2}xr{7$>m z)lT+~RsW1I0&K)eqcJ_A8(DP=w+ha`Y{cirlx7CvxqP)>PpMUZm3Kng0Dr8`d3SMr zUEj#)l$sflif=BTEI2?KisHC4*e;ZoQR&;3IoSc6A8#vNkrzgK-s~2o{E2~bluhPx z1M-z~)W?sBtmeMgS!nnJzhjlk9W#OZ|s?I%VeH-P0^aI#2g5Q7D-1 z_#{m{lz^kTe9@olV?TE8Nqzu|;%*T7Ow5u@n~3~EAJ`o$$v-(pXe8Gs+r79n1Fu;} zDomfG-+B+={|?O`&JY5IXV<$Ue-ey3*s57G!-HjN0j&Gtg#1~7;&Z;Xfkgf};RWxD z=(DX?@ier^1^3ZQfhPrI>19BsG&#S>X z%+yQOQkyGK@7{oY|0k?9s#x)E=y)+d9u~@7*eX;CM9EOxFT_a@qCmfYKLf&6rU2eh z63$qTa2mM}xR?I3%Cf9HH3Z%%9>@>5_3FVb zO7mS@dKkPpFRHbkg_kKV)eBC`#?V+4uYyR=4wX%GLD_Y)`J7)!*hP1iNd|+t0;XEW zRGaB`)tuWY8J^eu*#;NXyFMV22o%tGY!59EB2kSuqyk40AV>Lurc}RkjMO^Ixq)YzJx8IzW1B46TQJBaNhqA^{LVv?7t*OM6~CsQXV9&_ zYx2CRGe7gRN(I^|Md1w-Yc*c#0BMZ)B5Dn;c<#BRsS&alAsS`wyPr|noSdqZDW>!F zvl0{8SG)d~fkuZ^{|Yq1A*T<{eroIF^c{Hmv=7C8@|2=@9Gw=IMJQ%dTt_op>)s~a z(2cNd>74NePDq?+i$rTAjM&&aUzx(Ze;`4yg)lOZ4ZvQ> z*A$^tZtH`&Jd?!XY<{N@i@Acwq>;r`36@iJU%9bOoyR9_zgAmoE9J;;3a!anPc(JR zI43z(%~V*4Y>SiPeV7dniZNKqPA)~4N|wh2cr12KHqR4!%hdu5ZtHm|c~2?L!2T|5 zCL(8(g*A=kBj9gh>*_Q#4^C~;k|*s}z=_OcjYgC;blfd2E{30M%463Dmn%sasa}5d z=}{}OoGFu>{w%t`rPL@9ErQIWMqbC`v@Ph}rTKSv+kS+_JZZ0R%&BuWULPwlVbXui zaBbs=d9Uj)zcrIf@<097UVAO8pmc*4rofA0HBSo&@Vdh4KyzjFQ~|MloYObMZHah~ zrdBeS_E39~kSU2&l~>)wKz!o!pI9OZn_FPfZ9&AjJW4;ZN`D2>Y@;2|b`@1({|d_c zUFOUgoei7JIt|1BsNa`=udoIla(G$X*HlY(->y;&##OLGL! zx97?xZ!RytzHem}O`4fmj zUq$;wA6el(lD)rD)Iu z9yON>l9f~sqi2=MF!3!}O*^^Ax?<63%BWKBT9yICz#3HS#8K_=`G|v#cCDEJ_x6DO z+Kza;>G6VmWMJ@=23`{)+PPY24DHP-iVFVL=4N|`(ACKVZ_%JnznWi`m7bnfwLC_@ zLQD}B`gsha_W9z`F zbUq&JBkZ<*xw2ut?SN5)I5Ui}#;$q(LE=l}gRioeH4vapuW(taa*I_z5EJRY(J<(n zzE{jPGgOPUYi__C$8BJ<;D@p8urRlZ1?~CbiaA<0d@_QSZ$QyoP>u zWUP~o7f1_W>GA)x-LpKpvE2tpfglqEWZmgb7putQieQVjLo2-($NKhW^=D)OAt7mL z*%~7fXs$+ql75_WGBSj-4s>*M*H>ALx+uZ)LcUg8H~xI}(ck`j>W%iknH#759pzu1 z82NawX1a0U=wry(t)R$^DMSNkVLi86E+7yqm02)+>&{-G!*-*H}(vJDl` zVkL0V?P&H30O^1+2%5ofP6y#iw$^x{TB%GU@rM=VgPHJ0Pa%pb<%aY1qq}iLLW0Em zN4g3+nVg>-@hW^bOY`&Z-<3IsI>o#dL~$NJE(JAR>FDVukAaE>&vj1^ ztg8UQ&CN|vHFI?M2A!{5`R=7E!y{)}3WjgRpW*BM%~G85sV_hD!1%M%0;HP|E7A#} z(sswk?CHwMHn3~k*K2Dh=U(#-@t4Nzj4&vP&E0iKN?$?4HA1Hyz z#%C9hV@!|tlckU>`&J#{8c?d;iMO!6B{Sp-yd60~cbIfg9x* zD$Z*PfRV~FSa0K%qHNfq7h?(SnWilb|-y}%%uX*spHz?wQ6 z`Iin2_dK>hxQDW;$*hKfq0xh6al1pACCD4;0wt3B3VPy#!D^QXBMWcR z6ZyN*^VqNMVNo$*Nh!Qic*Szlhd0@!d4E(;6o? zP+uRFE@7(j%oMl3$piTF>Y=mF^H zGE5d1h@zx~&KD53#j?^St=;VvcH1`%c8HJtlH{eeOYrk$Z_l;fe899C-*m7q9d@QU z8uJ=YIQ_J{v{`n^G7uPQZKT>CtLvE@b87D-ZzbUxW8#DhEjhpZEP{;6!GAV9ymr=% zsW7Nx&zwj(U4-{jpJtRsK^;dU+Zn23IhmhN=YKsylvsVDd0LpS9upU}?NCyzOD!WM zP!REsK2 z>uM@QCOUFblS7}fjoF%O`+sZ1uK!m4O;Mk-GJ(FFbD^V5UozkHbsU%F_jdkOlEhNv zLf3b~&f>@bK$&BqxNSbOv{~KtlJ8x#Nd(W4rm`|4S7-K9!@kqP_=xDIx0jxJT+mOO z&R^s`NK;?R8KEO`_`XX#$e543RGgWsL0}~<$6Qdv%Fs*4GJk$lCUemiM-aqvWT~Gc zbecSdYA?mW&CPP&Idq^ed4m2BH)4Qe6Bw6)M-q5IVdiVvbhnpQWBah&ZnOR9NG)PZ zZdt5(WGgD)P;*xOFz^XY`KCE!G56}3NgoLY;Z7ju`n3646MT9h+G+6pwW<1tSLLe$ z7{&{2@o!h|gT-!EYikx=tUQr`-DC%OabR#LHp9RvDf~e}k91EMsQ@-Hp@8jjjgG*{ z2%e=Dl`xUy&bI_pwfOj{W#{TW#PXxI@2gpIh~SVA#vnIsXiI!<<;)pLqZ4aFqeO}=U3>4D9lCE6FB z!$noQtX1~rP^h)Y`?7;2;ql265|&*z^7O2i*OQc9LJ%WAX#S=|cYn19GGo_Feh3dO z#Of7$IC&B-XU5(@syZSrTVyOF{Vh~3R?g%bLWFd66+cFjH??#~x0l`X@{z3pm~KTc zpM)jXx0OX~vMMUV8N6DX^H$r{Lh`tpr`kT==NjFPooyQngT4wUd%sm|ehr`KZWdcf zyqc=B%zd;N#LFJ7`mM~uQpa)p4$2+$>KZOt_u^%YhwnHV~PVDMv|F*>~yZ20wnxTc0XVsEx3`tYMQb%rAd^ zJa;W$=I;Dy>4PyphzvifU`HX%O zX3-W+Snd|#*ogjNtC7>*x12@@q#nch$%XUL15C{C?%Wx<2$B)H;28?b!KO3CE zb4CMedYTRuIorzotEU*OPpm1Dh}rpCCv;7dbr2uRQ8CR=i*2o6>>(zp%!Qyd7M!Ft z3&Ap$=4@r#(Mr zKO)|e#_)&f@$(zl6q(k>t$cpSsIs&E5B?H^6`Bx~u9N z2cGs%d{ntwOgE@Z?eZtD(=|Z3J6&;hb~bmWT3B9l!F+_eKJPwqGKYM;9e(N`o5!)| zfp>)>2YC_@8v2I6m=i~Lps-|g^sd_aq%%@g7x6voM_h`g54gi@F2BvYY-%|ID*a5& z!Gf2^xk9;-oYL8NMw|6=>w(vYpGP3n}M0YMsXI0 zVZ*vF%=0 zxD9+SU1q03JqYb-Wi?Cfd3^54Knq_|lHRnr{0#H(=7?#$2HaC_G$*jp?b53;sZt=dqaBQV3b z%b>2UJ$I;fJi#73;ILZH&`M{+7A)vN)vAVoT3?D=E_1DfIL>s3PKrN&fXcJ~K2S+} zi*%^;+R_(}4i5rkKv&p(Hd0%w?QFtS%kXo)ssa|bwE;b5y>4BPGI$BUH7S=xz#|zp z4uwE_8@=#!!=tIr7=IvR)ub=20Pi!;c}J44(H>PE z087YhX+pQuZ8?8EA-T=x{t6X3H?_sockMEHlGOmQ$BL%0@+ph!P~(Q#A?81$jL7yS z?AP~o@GrEq9+mb>%Of_^{ZpSanI4HtOY>!=+$T7&h9a&V3v@J<5*=Wju(C{a_CB_4 zX#G#KoW?+VG?vE8>CX>miHQlXPK9*1W1v%s-^|8n^cvqBr^**rz0$0*@1s%P)_ zdQRK0%>kCCf=RK9c}cb%do?duygF{HM)CE|Cyt$!@p@yl8t(1nI z-f+QKs)4cQu2*GIk^9J6v086DlZ2u*T?MtM{@dvRNd5KRe530*3=UT2(3#j8yOZ3< zk1?J4O`&(%=FJa6t63T^s?xtiLZ7B}Yi0;YNe>DZSN$=JJxvj2|2ZY+hQ`eE-2EU95^43WOk%SP(%VpeGGbGl9MQ-Sx8Iek8}PExWa#o%#FeZu8xM2N)KYSZm1Zq={VSuT zN4w-PrQzXV>F&mEdz19^%+TVpQg-C}kYV)MAjs=C}mceKawf1)^fwR}YN zf;j9ist>VlK-bsT)}9gN4-fZ~2u0MHj#Pd6L_kLUBpnlm@I0IIQ_44u)#cJ}?Mzox zL_R!1lg~*Zpy8eYXmhpkV1W zt=b>+r~=Ln6S{7;)1zH(XHS`Hud30QpPgNu_Rqx5y06K$N2{@LFgcgtqnkujs*oZr zB0YvuhM=Ppj}$@-&)5CWDtPv|g`TPt$nOx3)oXsa-DlL7L_hov1ZAT#@E@WJixY|vnE99G88l!}`0HZCzTc4)aq zC?~a-k!feuYo2Mdgqc~UT~@aWp>&t&;OH!o(|+1R2KxHgIcuk4r&U897*zx{UxQvs zgO=7Tq}l+CP7z?IgiK!k;N)P_O$s{n#DBrz=mar$i548BTJ)jA;)5zH51pIZ?>~<2 z^T3beh@|+029s{ug2x3Gqqycw$wES;Kw&YIGDqA>rtP8qMhiZ%YE8=;$9tiMmZtGC zH2?-HJDc@L)NqlP-z)cWt^HmwT$F^5F5f->yO}n@4EVEOVkI=ci8mq7r2KU9R*&!` z3x$K(bq!N)7_Etv;(J@WZUt+|m53{!vp#Yd>}RIJK&p_njaCJmqP{3;w)eO<>vI=? zAu6gwhX{~mmg}jYdSg;(Q(T?|bjA2SRaxgsc~N9izBl)7P@t-w_txqJK0lrr5s~ zF2Zl_h~5;!zuYXhO4u77%(^+~ji07q|CmIRskrc#S0m6f2i{5>l#%YI8(xEv#eX*bXcXXRr#P#jFRw$eMhIdfaKFF2|% zrSIOH=I!z_IZ>tqGlnNw=zBqobU3-VpN+asVGn<9kH9*;XY3gL&BxN@Xwd&~K$r|5 zE59MqUnQbhTt_5Q0K^>-WGT+y2@>)pSxb(i~?9MAD^ zQei7~UQqCeU~W=?m3C!)M4DzyfMUPkJlOr}^84_>BxlBHH(Q}fuEYb%n?LocTkb|% zLgC+Szb>eIlJaS-Q-ikx>!vq&XPMkYl6a4TaGo{hhV+^|lOyMaf~O^X6D|*|M>icV zoS~QJqf(Wu&*@!Z8@Bg__WED(kCpt)O@3ij_d&o_TsDqx#pE#k3F^bRm;vpY8sJ*0 zFCCA=AmOFuqu|MEDB=*JxtNSFDE9)n!s|iiB|ZJUla+>66r}z6^;C+8378Lc6_x|DgNk+>yGB1lDZS*)$w zL?xy-$(^l~-fADUCzLf-NFe5Jx4!#GNomDb-H@~s^;2rSy9a-}NJT!la%=S7O=tb` z*2BZY_Wk>_AHv+pZXROEwD&PF2;*Ni+{1Xt-5&Yn8`-k6j+2qw!%`lzjXXBwO#QKm zTOUQ1X?QqfdjdS*;$e^Ybz0d^6u5PD$#oY7_sNJSJS-E^Uc7jbGtl(C5OVEhj7{>w z@HFXU;j%uXq4)Hdfhi-QyDVX-rb0(&euO!3Wo-}9qkiRfx_7h^R?Hj!I7on`M8#Ny z;^so^9NOC>e-;yU^D#Ee3KkOk=?Y?Z@PDoQ`kg4FnwY)$Br3|#-NP`DyzRY2I>^NO z`d3VQyTs6!xD=;?va);yh-U`pz}Q%2Q$~M#K!%1zYuo{b&=+lK$yoNI-T^k?{awP;1oXU`b;rnq8P{yiaqDB7t+ zg{DQ|cav*-%2&ZiapuLY*m)R>YVueau0nFv2q9K;FQtTEf62{VpK6#5dpv&&8AUvJ zfzBV3L_w;gpr|OngzrG9J0h!&ttVbaGLqFD+Nr`x~Em z|G<@0IS$-X765qJBU0u-+ zysG%Rq$)?Etgk;|sHs9FdW{g=06}#b7hfH+`&;XBuv5_IEO?7(HtFWtesUTESLWpK)U+z=`*4`o$kJO! zsz3KB>69fSt_WFC(Vq_nQYsD&WzRjYde$z^7hCV%IV2s*SZ#h= z3hnOc+1lQE0zVCY{9KkpCD35f>)mL;&`KYQ68SI|ze8)wA0YkF45pF+5hD$tmt&jt-pmkT z@$BX(ua+g3wLV?Qub9X>&BoWidj~}>MQ}uYcyu(b##jxIlFPEDeAyBM^eeYs{(kBp z9Uo#0aOIU2GIS1b6Qpp05rs#PfD#C91skmjbTix~16{p&#f40aJc)L+re{@sF`u6z zYPP}SCg^b35AK)I@=0G36FONTGDN{})jQ2H5zrNMsbsvtoL!Lx8|_+gtFl()INIL_ z!F}HYU>j$4corE11s~^%gN*taXxZj2_S5BNgLX5Uu`V$uJ7=gC{ zZIrJ8?cZJ%<}1N}dvt!@Z~y5DNRX1e{--x8kAwvKPp=B=|6T?N;{OWdzo#LwIxv4` z`zb2tYfQ;(CPP$F^CTfXFfbt0#WNTff%Hp6U+iYy{TcMq&7(bqzJclP{`U64>F)cX z5&ys}m>DRl%J6cIUW z9^>QF^2@_z|I_nVw&Uj`?wgXOx@yxSFv_Ni97F!MX0-*jM{=;;vc76;X0kuz(=KnYq|eg$!RmNx=VT$WO&7i&o|M!> zeMO}vN2u1vtQyd}jV6GZ^4IRVz$U0jOB$)QmbX3aiy_d&Zs2)Ul2RcA?D=#fF^aDz zo5Vd3PAUGqSQWT9?~!M@#J!DyGBzC^7OS`AZ7ZcN+8zE|x{@^tV6Rw4IW#0i zcsTPFs&KiUfT#o_6?W-bazhW~ZQjDY{da;Kv`W<>Zw?ovx@SW|2H^t2iSKXp_p_=# z%RngdcpRPVpsU8pZDY$LwYn5m;Sn^j=ZbFWeZVW}WH4s-m40nO(olYKIhZ%wcOm2= zNa0V-RT=u6M%1|>Pnp#k%7$PU{*?nvXKaCYnc5VINfy0U%W}p*`XVlaA0j26Sf;eI z*oJ>KxjMVWbX{6?H3cogUkULx*368J$?bk7BvU70#d!7aGSrX1f2)>|%&BA@!4cG6 zNm<;$%=wYeHi&C~Z-TtQY^O%Jk;Iz}H|G{nbB$FnCG}(ej}+KdEWoEyU4vu=`No^M$c6@Q_l8ww2#MMFnJLq|tLzXX2! zV`(4Ow+asr7gH7&^JFGAjw!mA8@(Pk>wP;vf2oB8t77v5jgyD~9kHrh+EGbZh=6N0Lk4F??nZnu)u0pyO$@aaj4ksK2_dL0=yR)oC zxN^;=vazc$TuIx8xrT<6E-rU-ob_{aoH7stjVAl2LqFQQVGZYpYeEIM#&b3gHwVl4 z{IJy2;@F(7fF_;>Dk2`q7U#R}YfVJmjbmnX8q2&05dCsyGxgYbp)z_2o>uHIBkm4L zE+ysmb}nVN2w;!Ua0riE+%w0~+*Tobt>p^sd1lb~q?5>)>rAOSbCHOcm^I9i==@t| zg^6%tenW$u(d|!pJY06i<6|2}mdgzTfZ3-4DRW0DmkmW3Mt4{I`0Ggsl~g~gGW z2t{@X;kBES?&j49f5_fgHLoyv`}>5tM(4UlmV9Ni!5O&t()r7an7NqN zKP-aGc@aF^qJFqma!WB(haVSPMNfzbP1HMk)YR2c_yl&xs+X#?DL-<08txnmHC_|R za~=3_XWd^Ne__(F7V+SAoaL9834?INQui(lcuf9&1`K1=fs}80`Ooz7@N{035nx4L zNi6sCSL)0=^x(DBk1#ObW75<_w8ciyuP%yvL90L0zuG%EP)F9f&ZQI|;MOmD>unt&Rr2q2S|y3xj7R3@s|#rF{bCJe1&a+X{KvbG7wvurkz`Y_ zQ2S|q&P15Nk2%&p8ySp#vCNVE#)BWz+uoic9ZP_V;lXanp#VR>mKSE3Rn;iQLKQM? zA^URdR$E$DU2eFq>@H0jtKHO3Jt$?e$S!25c^CicYv5Qq2Th^*RMXn}-9)29m_F!T zid@C#Eav^&HmP%noQR0O*U0l#d!Ob~V^#DA^q{PE$9WS($71kG1}w~|ZO&(ska|K| zi$0kI zC3FLn(jQFB^*a^w#D?=h*u3G#D`FWWUEPx3bf$#Dh-SrTy8+vn`fD2|!7+-^*te6R zNZfYj4{;8t3$){8;4yk6#jg2z+lzVlif9EU-O8Y4q5+&IXkK2==C(qgUEky0csGDG zd}Z3~;3fxihHCnV=7;bmua`7e$3s3Ui==5ff&o=9IMcd@ z^*~7zy5E745Dha7j4V`s>Z^y($^pBntlL~W|FH&tjp^RuNjG}9`I6%Bj8%~7w{)5q zYht!KTm=+DzV~{57u$OucPGd}>-ptb2)H{H-@0X-r%F_%=4UOqZ|rzulH$ST=-B8E zR7WmkF)AxnhAkjabir%HFA3a!)PCn_F)9Ia58q$s>D6=SORa7lRt~IEmBGgI}j}|7zj<{2cIAeK5rZoqH#rc{FNmL?53JF{0&< zyZFB{Gut@YW>@wuFV{2`qg$w{guXR7S%rd6h~&mml#F-m=yD_2t(J-IZ?dauDYE8k z7t365X`4OobV5LUGF$fMGqxkoTLLI`SG3X5=TeoMv|$M zIq{}^E$}cf;Qm+btOvDDM_8(~O$CCjnN1@5^VJq?NAXq|AGunL_mb>zOK_s$zj`HQNw7@D|BoFUAB zsMe*%-hz^it^wuXxT1QS3pUMdFc^ol4c2~AzZJ}`b6M8@+Basa%6`lLV8%)_yyd+b zMVaT)X-hL#pYvHbJ>nI-Z`To)d|%hV*q~IP?N5KS!#@2?JM*iCVyBbt&pcv5Ee1?f`veC+&(yxFK`N?CyjY58(M>N;!Q}H2jeYZ_$4|88Sh41B{sy@DCk?IZV zxNVH0Je99{g*z|BFIRhu&o<_v`${oykN}i)I{j@0?{WvAezxUYzmx>-aD<%O+G$(! z_wktVB)Y(0nJ;CF3FDHVWwg`7pbBEK0@}n3CVKD;4>s4w{7KOdg1Yq-UCm34HOZVt zjI^PYVZ_uM11vOWyURDU-`-n{j5FtZJ>{l~%A_P-^o)!LxtP@6>@Vv~%@<4BRCQi! zB2ZHBuRptO&YJ9BA97dNUC5i%Qd=>w=Mw#u;M6}7G+Fm81p?eeth>8Ab*IDR#{o#Y ziwF?t2Vy)wr1*fwTL`%&_t-uwI*Ul9d=;FR0T<0lGFEoVDTeUu?cjMyCV#Ry%(iN^ zdwOVl!sSNGQ}5%V4_}b59G){L&Gq^>4M7>}erZoF zI9`>(C}$0q_?`@Wa`PC?&5OcXA0!?sMrHmCOt4ao#$&_rHiGE7GBJNm7%?DYxV$_! zi}{3q#q0V`fuCb(z>+Tj|2;AlLCn0&?O_-$+VehD9G9Y*3HKo;A zse7zkc_Cn^YadH~t*ekl*a{RgGul#IgbsNbDe&o_2BnN+B(|mgA!YfV?)YO5*pv zY02?y)#gHZ2lQ)(^mp{BX(ooe3WEWWnz;F&?Iq0torsnz4g&L+F==sm*m2sF;X|Nc z>aqnO#_z?Tb#?2#5ZXu4PWJoC#l^JzCOwk?5Bpu|QW^P`TvAoJ(oeXAb#U=QcXJk% zbobT|-7nQJ1z&?Uv7)~D;g*hLHB$@wDl;=N#azF4-F>v0|ClRH!;_`2@ny!Uv$qZh zMMI;RO9$X56f>%tnff_x5A9{IC_4~uh(>EAbWA-Gt_NykNL_a<-6I*0e*4v{7UH1) zdi7*(QCwX7WoT&V3*F$*kd%~E$W~F6f(X6@0?4y(*g(77^}?4?XkY>KhBN=Q_jx`1 zOO9>eW{fCiGD()MkE=sF^gUVzrgtY|pUoMva;fkMx3i=grj(yChPoQ4_=j}|B{Hk~ zM<7WO5y`Et&gq0)9*@~Pc0!Bnp{nGH^Hf3CF9}cKmymNxl`4Jou0NPPNgoKN^1)l} zIcAcUiq}^+?bzepxxA5Tzdvn+cD7T2^CCuxVX9e>ljo7sZMV)W0l&IZtz%KXO=ruRr@FRO@5^FTTVv2`aCiFvkH7w z(3U(y9}>=aHB+RGczqzUg;8y$RQhps<8bqbp(&Zy`#0Sncwel-0prfZv*=q~dd+w? zFwgZunG1V#_%DyUB%KTo*Y8757xA+MJ>iE7UroPznd}+H?oNK&rwxwLc}Hlc?9OqN zvh?s0dtKPeCKc>LKmf9Kicfloj!B_;B#i$q8V-qN1dqu)0MR~q)_m;Yp@vBokWnSz zV-+fhZQ+)Bt671xh%Co*^CUC%KI^CQ`{m6ugSxxq#eftE4+bV*(BusgCje}RQ(iI2 zGD9_l4lBjc-?34nh~%U(Usdu`%$q6;4*087~(4^ zjA>l(?>xTudVy7V8%yl(|N5E5|Y#IoX=mxEmiqeQDLV)ycj|)=tz;mz&bmOLhJcYkdYgi9F>?jIc-o;p`Xe_ zlks0OuVDlKqptv=@#?cQYRW3&ubcO=E_wkWj14PIUJ3d-9@oO8LXgCev#| z0-xNQVxb6Hm8dka-5$&d{hcau%wMT)hZ=0RvcZgGXIqS*=WC+VA>vl4sOvL%AIcD- znv*|cjpa9q`}V)h=`FAkc34{C{T(WU=ESc+l1o>Zvq2V!lnrt5KbtBTai4@65~`*bJDQJZ?vV3g>5g zJkFMBFiz1ZOHI0bM{lon!XPgBNLp)!=R_E{(?+xc5pwGWmORDj?lZci!{LzyYD)Jv zSM+Dj`Y8VTjFg`npGO?ROy5tn7|5nWGA-1`FE5N_OlC6+$0r_+U(OL7ibw#W;~mtPh4I!ET!0fCuH}EEB$rmWj80oGOP439a8P)!2X$Fn zdH!m#rrUSbwUFO1j4g`T_$n_l@;F8gQAqkYxNBfqE-x<+SBw19pVp|-a3^5~4A4d2 zgygFnCR)VX#osL*iawZ&k{0u|7A4&=~B$eH3ZwiPin;%C1G_a zh*jg3c3Xl*AQHtXA>cnDwQ1U5sx{Ye!!1PIale%h_zIeO9`pjKq+;d`XK}GXKITw&QumyUDtF;(?(2F zq4}hGhezBtMfx=U|G3A{rI_{OK3D7}v(Kyu%QQ}ZVLN{`qW|w4eSm1`c%{BUuQ5*2 z=Kg+5-@QMUdOFIt8z+0{FsHT0;VHK$w@`7JBQ_)B8-$3^K=Nz8cCGDJKZwBX$e#(_ zLT_1>(KsmrX z5pI>$Dpqd>jIJF|#-%feYb?i9M54ED*53n((Y$201enQGqpYUpOPRX}GOvE__r~wl zv5eQ5KhYz8t2YSl&xjTjI5$i5ut^Sq6g0B{&mApyCX$8lj!7_!XlcIB`RH`9s}K-d zOo`fv?Ufo~oJ{cdlgRcce{u$ert3IKZmFDB5^e z=k^b7*QJ3@!{aLr?{wg$PYyO%FK+snC^>8oCCBK+xcl;dwM5lU9$rKFWn@JgkL-(- z8Is9~1{F+3{FS^KIV3!+m`NGM9|>AD)#K3dW;+DJ_Nh3JE#=jFhWn`Nz)!CdlRmJU z$%jMny2P&beJjUxPduSg`+IwP7Md?I6yjFMHOBL+4`<|w_Ubh!1{AV3e13|~XQt=5 zRW^l1_^J;#d;eJd)Y@z1>xFWYz8FZ4g!vb(j+&!c1`8~Mf*SK_Z|Y2!=zAd7BjhUk z3)Odcp{AB+Y<8rW_{C>Fkc)oP%Z+sw(eoLfM zV?KvBLFss$U&8fSz1DcM+-d3GKvZeSP?`fIyI0RoZg|X4xnj^kT&P;L z@#gmW_m^h(E6RUl|5P0!@7kdAgtVU^Ut_-Vc_#*6JtFS+U#bR+!k)^^>+JmM;mya; z&_4|J~xiey!EM zGd>q{vMFLUDC=Kg6B0g`uXB@WNtZzoM1OZm~p25HH}yK+op` z`bBM){xj>B6$OKp)lENaO9?&p2OzLPOiGQ|y1V$&pKAc{L-4UA0pV$xWMFz`m5 z?z~OJ4n-dx^sdR~qa{+_Qd@4#(@EykobaS~ zj&Zs^qUBI0&NsPV?IUvH+cC(N9uwv?r-?cq^L1iXIrQ*x<>Z9M%C#8=3K^(sx}p#C zDYY4;uv;zB)uUHn@BD*1zaaA5gYXs~1VEiVunFJXw0rV9Z8HT4854IYqAMDe1xVGypB zT)oz)2TF@bh+tBaGpmb&?xW^dlLZ5wTh?oFkCBI^0cvo;t9Fytmz*e! zA>vOt_6NMSUHei+`M9s6Js&lP(axKin)bYgUko2dB&nGS?$hP4%ANKZ5BnzUDFZwZ z!`UpBet}LCTxIvK8~a+Jn^l4NszXCcrr5cN7{tm{6m(@~rIY^ep;XY?pGxT1cI=ra zlUDOCK#(tKgY{ZE`OHaQ@udiJ0l~zE!;i)N%=9p~(3V_e>i;+?mj%J}R>&sF2T|jt>eCGJD*^HG`0t;)M zs{#lI3!ve<2G_30UQ#Z?4`08|8BufEl`t{OW$Ten2{j&l{*$r6l$bf=m@!ihtzG$^K&T(nqVZn4d z{Bdmuuj@$fb;I5hivd{7`J(R*pNtz_<#dDw0S1O9Q_pgz2gHE* zaL!twd}i%rV`t-N1N~v9XJBY*YH4W-q(BM&X^glGD|Pl;2o$&gL^9<75xLp`5c+!a zX=-Yw93Gl$rhE(u4P~mVU}mm7>Fh3DsM{EA{hXLPnsj-xlp}KWmaE@>QM<`KHZARp zgxcYyEsNWUIBHBjkpmU=VillNh#9P8ZUA-`AR^b%gPUEixaj#9w;d1ff|aRVLan5N zIVB`6fP|C0y$~MZc2-3_F*z|QF>!Ni%V=lQ&}e6L&*n<)a?dVaCbiyM5K~Dt>@$nz zf4G2peeeQU>Qh(}quE-_-o@(|rM0espxxZ>25GDXO2`Xg3haDDXGBXCz7oesZ`iS2G^)zn|MH;}n11&x0?cV{Q8B@OouK3&3P+&>_>3GKp z3j8hq{WmVNA3S;l{L$ZLOdRw7>7)PmCt838$EfLgje>>}79OnmJVJ&btE*&fgLgee zwV!zPV6`U$VWLZ4lcG<%2?9qRwUe9XQGOnQFiU(bbI^Y%`~7<|Cg!fvC`j^TcXKh* zfq+0={k?($Az^BQ`q%;Zi;*d%o(J&30?{CM0hL_I#6E>wAR^Liu=ecPmRf&*NyyVV z&`5T5xKe#^*|)L&J|y|}mtT&-`qP61&f^daOjTfEvfE2W$1YC)-^b9#-g=*Q1Ym^A z%cp8;QmK-gG=)_L)6VQ{?~xL{1$0b-MT{2%^MqMyZ?s-Qta`r>BN}Ho8F*0k=%40H z@qsujbV^=#Yv-31MC8D`I~RQQDvm`0pr*`H%F@JiPr~T)s{P#2v73^TLA&WK(boQU zZfPli(*$sEaLVi$XDi_Is}0xVmBznSe&`Z+jofFxlmRAgmrG+ocb*9nlY_s?gAc~1 zi50JVp^m#aFZsmOzcdj1+`ZKDM8-bTJKMY5Ca3?3hE4xbw>uyZ;{%L0TX|K*rWOuB z?dSkEr^kYX1)NW`w1`evKhrn7-#%_5h)PI^aE9E7M$w9S1v83? zfZ(q&A_{m17_|c66KHNjMx`#91qqFm*}G{4LuRHXP|@Dx{yrP*d;fFH&~Q5r44#Zm zAi07QG$UBxLdSP?c9nzO$cl-X<*qe(1Jnc}-N$LOa52?VGo@$=2<+_agvhgIO0}BZ z&zRV*hg%V^w>)kcCND9H7K@#TOCVt9e&QFUQm4JgJ3@6fMowSh$?Mb0s&Z;81HHe6 z;G&&GadC_h2-nr4i+|=p$GZ~hv2sDb->z5G(z)8aAgP=m53{WS-)rJGl*;8pld2C7 zk0hmrj4y*1Q;G(Q5Cf5Sq*L9W?yEzt@>q6#`}pH%m5)bTJU)j#)AIS02ln|AduIO( z=H;$Q<@Qkfni8h`{pmgo8*p@o)ZSiEadA;8?&r5-?4??PgF2nNjBmoQhar4)&(cZB z0X=_o$n$qbOcWqS*}*5U+-`2qMAnsMRSixz$NO6ns^2s;mQ1Hh^mbN%=;)kX_C>3+ zmqIvQ`rDvCJNM~PHR3V@!Z$Y8y)X5c=)9uyvzbzg`x~u|!`ONuMk~ceyZmj_cc@qV6a1>fKj&Ip83J2<|%hV}80z!@AF z?$<5&VPG)#?NJ`ZtG_NU z<0y`c!6G;iX)TLl5XxJsfc1xEKB4)W`J`Uj7~}<|0TBWKqGRviPeLAa@ulFi2b=!TLq($o1;O33Gc8d#UCIg6kg9u;ZYV zs^0KqHR1a99lK95A_HH{H7sct(bB`ExRf-P?dcD-d2(iERM7o|{2}2-z|$(!C;sTi zIN{f5wm;L-Fz>E3QdLzwS#EZ)&X?^QDRp(0LRll@7C{!QPS{O;-xCHdq2v`3>S!Yu zk)MyWUBNh7cpy3R6me|`41`vPqQf`jZX1G%!h5gfeXaSQm(R#wa(P|#4RzKw4rYp! z%xIqXrweb^@4S$6v#EYcpmr}c3q^jwrrOdsQUz-Hs_F`2)KS*)yNA$dthc~`+r#a0 zqnoI{`4m3uuGQsL;mJz#hW}{)M3U@CbdQOf(~+2zG`&JD8pRg1g@umET#G_{RaMnw z_9rmM{XK%BVyyEEAE5@9&TEPIwuyn{>(5u8c%7|(j2w%G%kO>6>KH4~) zgt1Jw)uOUR+jXQxih=R~wX?SW$msgz$?171}jB<8f$j&9SF(Kt4NrLcoCTZX6u0C#76QU`r=o6H?=6 zpO3gOzx4L?Z6nCLymBC$f}^SBt7>jXm*xD-`=e>6Ly4VZgOnQ z2!5joaB(57^HGct)I2;|kbGm0Wb9!aIMvZE{7O*mtumk8eP>?0+tp=%mH9+m?e9F9 z?U6)rSRVG2>431k{IivDOOy9=mTiliMb`Q0N@JAu$<>w}&MWDZPZu{l$6J36olYz@ z8qas-`jz#%scXLoV`vYsHQ~NciD^CFtSlx<+H_yh##0v%KMxrPN?1+h(lOu<4yN4f zpwR?wA>`&}XXl!`+?^XdiG(Jzn0+Jl`4N*D!w0w3v>r37ABg!LbJsp|&=1tof|X|j z$J^v0x3ag-;Nj*ZR5GO5-94cI+a96cp^Lh_ zZ+vv5en7jff%>@1hZdKC$K$+n^v~$lMSNe2=kw*w(n75Ux)P|U9*w3++1ML&{ErMJ zW1=txukV-z8%H4Txav6$04Q<20?86N^QXm!Yy_bP){f+{(O_m*2_&S(lIQ0N8~>o3 z(KE21)3`yvX7Zg1LdyRr+4ZWso6=w)7W+B2TFM2?L0?j$A#+Gr&$Jq=0$KcsyfAQk zvM6s8m)iX6hnPIs37rN_PZkq;P!CbgrvZfkUnH7di{%1V?Bgk0aRVFttRI)!F8gD?u=KZ*zZx`q3Po8Ut)Ozz@@`6 zYH^PN;lW}igrC^5??^~}P@vxtxHvfv&iSFuPA4U|GUt4oIeGkc*4CT*>hejLM(HWa zDVWJ$gajXX8BT(Zi6AZXxv#i{goL;vZSCx+Pid`;b~MX%F<+|fFc`E(6JkDPh^*^6 zl#as0E&_2SOnL$pFKostv!D#a$?m~S{TDA#3@W8F;18~k)RzIIeq&-1{_@~0YmBe+ z^D?Cjmw|suMJO`lM|w`|Rr)(}D3!N3X}+nTiS%$&kiM~nT?HyVk)kEABZD)zmAJ^l z!rtD#&bADQ!{OW<*)5lUIx^KlAUx7;5zhRiYtN~>>OYlx^|KVOrX+9=Sd3MwMbN(q zsAPfZf|Rs2w?(vDNt-w?Z=M=&O1n(oQ|#?QOi^<5*=awb1Y##GFZWR`UeZ z^!WR`=S1$AO*yOSG?t=bhe!06@>d1_vyg;g*SsL_T;&9Iw})T6PlK;N@ySc`Q`}Pd z^`Ii%LE6L~yd%ysOK&RTZtA7QG&P&kJRTHK7|6*t))Sd!()jv@U8SM&C_ju3%jB|X z-KD*7{Yxy{rZjO}Jw7oA?qr4CqNH$nexc;z$_F9kL}@N99eq567RptEw=V{Z38wpu zyM<=!C-TguibYM%Mu@5Q6^n-prMJiZ?AnhqJsuMn^eBlh_`|VXjTA((Osl-ILxKH` z6biod6MFqoHGtED96F3fDoPZT2U151&Dm}x$p3X>&Ffez`gl||E>GLl89t=S8C1Ae zT|H-+Ee|#}_7XO>HW^I3s1g##6JQjQ#BsBdNH;&j{7rx{0yfWn+d~FE{ar3cW5ao2 z(3s5@qA#*`t_0DiPqKiR_G}Ke(P_;HDDfF-I@+MGl&3n+g;ANiv2v+B%F8MuI8xjkzS1(QZ!*{K;O+H1^L{53eiQ5N4o&~VKoS8iRWIe6 z@Oo0+)Z-7dwXM)QS-!r&D8j*!hRyK$K@yuIi>Xm}^ew8*>s^(3eFY_DE<=m?)6ZE> zE?eG_@fSDk7&F)Jx;m&gYxy93o*lZe*-l@~`}H}L{$^X~?%Kw*&o#jjF@4FcuB&)X z?%s%VC|Qfw%X56-io^gqHJXF=JCJ$w`Jmi?xPS`tn~h_5#gfB4&9n9TN_)5r=F?@( z<$)@zmF6u=>NIRxwX<+aYzcXozL=auH@|MI=l>EMHB`|*y0?`0XOzZrEX^L^wLBi! zSgG%Vk#DQN)w#L4oG-j5KhwoVpy`iXi6X#e`ki-5wUGiM>hy|=@1dQP&;PVR%}?^_ z8>v!a!AyXjsVQZ-cYDuD_}Ox2^nKgHgVPDspXGXof$O2B?kvF9!hciq8HQ|o(5j5} z^b8I*xpI_pC2}(|#vJ0LZO`q1mptHJb?&U5;Pzf+^Gm%)8(e4KHtY+(6IQggHKYL~ zsvaAZ{rIUkAw5>YkIMD-HAL$EP8kQ191elp{^@}>MdX^#Rs1XzsQ#-|*`1UF-BbAc z`)kL?TT(9cO-=*+?99C$HK6iL#Fs9yK;qzj8Ri=lrAV(azj`>TW?4X;WMjv%-+Deb zLZ{EHsLgA}{jbD8*l{Xs*wfA_9&tgf#^ofKcffm&4xWz=HHR-4L}~VRAWu=wkdA;z-)Llk}4-nN^3p zv-Vhz^5f@lV%~MrFpG(jUl}?&9n3aVx+wX)6tn4nPr5KX%8%zsGuxhiL*Oexw-0|LCQ#obUAZ7ttN6e}vN{kdBHn=vdu`F9Tc4*T<|$vf2p z@vjwXj0y07&DGXo`Nf2#LGEgyDD?De@7@tMo>F>7CMU;TC-jAyd1b1Fehq?BabT5B zylnJ@yEz@F6U{4EVW(*=1I$2`9G~YixkzY61SLPe*G)}vJAcM`kTQdd$%NL^y+Vp= zjfScO?EyZk*%dJl%XT+f`tMlRCOP#;gHJiOTc^Lp@)PDg%zG_~|t zhbXtv$eU#@*}aMMHS+xQ!0ER3ai(n3>J}mY?!}OqEtw2G@O zAF^#7<~8lr-Vm_PuMXf^dZjQ~^b<2bpcC~gHX{egTSgl=KlA)58=30v?CC+V82II6 zwZg>#UL`XMB!1g3qj!T68&PgNwG6wdK?Ue?zWCmqe}so+XhgqX-3#Sn{HX^?PTwLg zzY-%uF}$GP=Jw{{d`-1So-`J6)ybr=^X<4WDwq8}%`=e0Te6tXFAfeCi3j6M+Q2cS z^0(>@P~xHX5BIBaI7!D7@lw0Y*9eJ5mfJv*os@MwIILD$mg^iDD3m-NpZo$8dRetc{^cc* zek+rfmuIC?S>T~)1h8@Q5|TN8okkvD3?g%Hrys*H_I~h+-7=5|n&n5(I%KEIWq`#y zO%Am(Fqv?Q=efO8Pz?YXrxO9kEc7AjTDUt{gGtt*(D=L1xu3{cAoU*k(E7D%Y){SiG|5ECdrkb{`fYsgKVnr zaH%=?)mL^548RGfy{1UgZgCbr+i$L$MKzM%+1_RnKIIc=ut^<{2UZFos(x1Wg%R;3 zIPrvFwXnYJWbn}WAt|h%YSufSiL0p< z&pR9u68g=w0klvRM3#!%?7qsdc%iPY4lnTo9vG_Elj?fn$N#Jhz#W(?d1gi0!@YAcBLTb+D$@It!t`y)&?QGSdc=BN?C8{OZ?F=%m3Nf3S+&hv%UWJt)}pY21x=2RLB0Nvp|hxk|&4G`_^A z2YYb4pJMTJhQthReLZvT^Zis!ltYM z1tB9@)efn`79!GW;$o8_VLut;l4i}qIkkXlXV^FnPVGwO{GSZ;61 z>d&uEU$^q|aN?XeI_2s4{_drLO3MxrfRL)M=j?eytV;n&4lt6I9i^w3N#N$kS8mPN%qRaA%~}Qbn69Y3EsQ|K%SVJw^n$ zi>kSINXqs0bT{MI++*&hM5Y6+@^rrH#N5!(@NnAM`k#2Eo)<)|abx^)N<%m)>ff#$ zKfZHYdMF)O@=~WicBq$N2>G`P;_d#oBBElVqkP?wfU?&ja*|Nfa8a-bfwIXg$G3A3 z|Fc4h(j$L5<6=>yzSw@|%H!VOVWcxuXDf~D3O?jn@@2pOcO3JW=6_kJCH z>J>mbim;;5A05{D=jAZ+F}L1jnQiJ8CBh;I{8>&_cK>x77I0gU{%>PhnnU0?3eX}l zIuU(+x~X1A_xHTzM*L?io8}CCT8YWELm()~IT7dIG1@cO3T<=${p10@Z!9u8VTLqIOZB#RGJW2D z^{)j`8NPj6kWk_i+2Rx2k{W#aCmxyctWtDqk!$4N$pxV|F%=+p6FtWo9ordmNBkpN z7%T!LB-ZbFlB%VpMrvS-UYPVxNXW=)^}224S&dd&{O>(B4x8#*nU8Sr@g*O8xU`9_ z5MXj9H~Zf2GOaY3z{4>{dwr1MHk#;;Ey7A!~Y5r}dy zi+hc5FE`R1y5O05A5hiz+Q}17fAHI0PLuN;6Eia{aBOa_GGubHhui6>*^56C*edr4 z2}x;nJKu1QeZ=~y0iin=`xhZMS~YYD><)?sks^d0TM@05D|&x}dqBfmto9Ti-*g(9O+?9KrS;Q8j_#$urc3+)W57}=1-YKBJ4c-=ju&g7}i zOcwG?#BU=4Onlzr^_v_9YW$FThn*9633`o&^W!6K1Q>{mi;J}lzR7geSk+!7aIOR3 zjSQ(NySpbjxs_G{?=Dk2kvAfhcy9#SCr6OY_DsIk8^Dp$(>-?Fn+}J?!T`SJ%gc}i z${Xm#osOTy)0_4835ZklW3X!*JtjWiScMTpgoUNkSkhdn=($|>ztE;oh7yE)Wc=-# z|G~N^jCZV7Hy>-bF*6>bofARx&4H{PJ82^wd`DN^C&7V!ugUgm$kF%`?^n*jpWZr{m+d7>sQtV_~oTnq_Qp((rxl%ko!%ey#VWnyV)ivR9ii_OM)q;@Dkf+4`|dEOatIiLv$TZ_aZAt6m|oeg(k z!U=jTprGj|ebvEwY9=6`89iQBCQ;+wmN2Lz=z#!CezJ{d{=@lg-! zU4FsJ`B~3iIHezW@~v(x<*;yu6Yta?^3z7ra)2{Vw`j5b`2z={$Wfx3h0o1Nt76dM!ryGg)qVwp-4nWzW|OU)IiRX_ZTex!hx1)mW^|^^HHB z)mGo01mm}5X7!hVbt4ma;02d9+rfV8@WqTq}EZVbj zcmH|omeCWIYC2T`EsvCQcAg>^l?e)QaC9tC9D8_rxDgFY`9a|mt>DMk+yE}x+*&)1 zgTzB3ZdZqwW^)Fnvx5mEIV-))WLw{CwPAeVh^i?Eh`?G1Ta8{{o294;S5rL zfBz%kfFhW+b8fD@DYQ7T-bC8b(hxiiYz)~R)TBzwA#?M19j#P~GoB+MYQ=!z)_9JL z5fw(nTkgK4mRom!wQs*WI^Qv|G~FLmAvey<49Vqf_I%pjXH8~Gc6rmqDZI@Z?US)63Gz%IU`nj@oXKsuzQL#-P^JqXTKCL!sd%`>_^} zgG?GP;nmewk0)C>LUPeZ%PcGKEL)`|}ABg%ibYb^QI zlggy=kQN9nG?v@QrQT!NZl7yp`^`aMVLdMk)6-#4QG*}OkYB#2+FZ_3TQcEK6`S>} z(!}m<+p!-n_eC4U(`l2RqZgbO{rp9%P{Xiam z(`tnQCj{3PAzQdQI=VVttUj1rYrH|(hdt=;`+6w(p)nB(U2UCYwVJMb`SXru&h&1l zbn%|{dp&U6S5*tS*=&Mok-F(r59{*D+ zw{RF9ul(&!92jTP#kp>(n1Io_cSc;C`n(h)Pkko8Tu%h4z&`V8tytgqG>Rf%-R0NmDZqybz76o7_x=@ca23g}foG#QOO7 zp3+vyOsv=+zgt?cv8nD5ZyV~kFz_E)qpjSOS~R#wUwCa(qCAS#SmQsubqq5V6>kR4 zfy;@&(58^p)8~iKXX2d12K+*Fu@ccY+DhScOT%<5USLty5y%hA;qgpyTpN#dbs#sl zDB63gkOGi|!uIb~^CXchFhll+#NgQm?o+!%f&>q(QVETLo~8dgtMIsZJDXVrePu8$_(_NpH3_y3L^R zbzpJua&N*&ky3#BbS$e!YdP(ROkKFfVys%CCqSIqY{n8(QU*E6AowNo67eVp9yLy@ z-j$b;v2S{MeyWQz8x#>*T%EE|n7akIW4~8|^Dm+J(@!@8H?OD=j3@kWVo%mOdVHN4 zF%r-XO?^Zk+PRb@->{|IxcsPvTY(y!@8xAFT zk#lvoxZhbWWpY(nNy*7R^iC77Sz<$`Wca1(?C<8!vCVXKbyHJ5n$18tb!TCco^ST} zZw^@#u)jZZ_oX!>LZdYY@-uHJOk(O}`dzGJxtS^Co$g^b1H5J7X-4=+M)Xg{i7CD$ z^rn++v^?1iADU=*&SJdpK__Nf-Toiky=6euYr8k9q9_QWq_ikK0@B?AN;lF%{Q}Uh+m6W&|hL| z_nblMt`8txj67}&M{Tf{01QF*`GFdT-Oeb8X3eM5Y?;X_4;4|*_1$Xwg!@<}xUsAy^ucerOIKO`tdU-@o%wPL@CNL+3198w_Co0(dlXU~_E=9khWKj_Y#57bo( zdj?5TEH10Fw%*qYeVIeAa)(e5X0W8TI8*P~iJ3VdyHN?X^j1)Rp5>Oz=SVbMC1+%W z&ly@EK@Wk{KvOJ5?;|JSyP@xge);K}sww3u#Oz$%d+X8>ku9rN^nIX0O{TMskhE#p ztpAJ-^pKWXDV-YOH2gH03fctS37qMONGJT-P6v!N9)s+-N%RJoVb&%O?*!Otz*4tlkE05$DRn~v)RStjeRaj9SCT~WD7da*1E=eSHvHOFu;BA*zApj+fwN=X-i}@?tU#Hs zhM6|yu%TY|*?TUpE6w1lgPl0Hbru#bM+FTdUs+zhx^CqQ^N2)~bhof5%yaR>3r;*# zbGlm2IeNavmYoRQCsh1pzbMYeX>9o*iQ(s^ycv+KW06rRP<+6=Hc!vgse5oPW!P`r ztNZ>Qx7z})Lq}CjjbBJqg+S!J#my$oGqHeZf80)`&!bMef`ouK8pq?McKgu5!2yA~Tk9Je z&y6c`*=%}r*O4(P0|9NHlj(|rIy%*gRSNJGvm_075W@xD@{iy24h>0|s==o1Y;DmV z7JRyHG(6@u39Pr*q*P{QVcY1>Q2Kgq4<0u#qhi)eLu#sd{Fsy{&QDKO4K53IhX~P( zw~)mBG6@_82UVYv2-XJf)!6OV;z33wBwD|XK5s(9I2s*ZHk3&gctO#Z)tPwg6BFZ` zddk0aSkL3AIAi8aWeL-WsWI=phKXZjZ=LlhY_GV;R`77Eq-L~#?!P8eH4(GXwhLY; zw~7G0jeuKF(w#|%9Y25nOeMH|!OB4WRWyRMvGJuChvuZ5?kb3a@uw3b<-AQ8Sy?^o zBpPkIa-jQCa<`X8E}4pw?{S=tJVDauecaK$Z&g)(?ILD9Db*!vm ziNmdnFac)6DH=Q;+ej|fhX{Fj$X%~^`IfE;^P!hHvM-=FV^_;pnixyser?k=C$?9~ z$vaBdCtn2x4^I;mMDea9YhESuokhZ4nuH47<-BxkA$Y3;%IS`%tGrd+l6;8(iX8OX z`&~fzMpe-l1$vZ01KIT1x7qxT^a8HutJ)vTGnNX}{r_X|+CnwL7C~R&`)FOxBO(Rb zJn68|XtsC92Xd*F!K70=P_JFk*Z1DCBlNM(G%KzU`b{FEfAdXOd6W(TVou7{ain#y zDQSQ5cFgJUPKHEC+*Gl4&Hl+H)z|yTG~_CWhawc0YG4nTE*|JSr>eiCjojZ^zEZkux)In?QrT<#pA zrAyeBeYWY@u}s8SEWzIzl7cVbNy&45e0AYx$5CO{pBWnEk!Mfm>4dQP@gq)g$Qmb9 zysAL6h|_@EnDM4L{pi}|Tw25)Ln~9l76*n#eR22%US9qL?Li8E)Fst}=ET68X$jyx zH5~e!x0dvpL#12B?;`WkIM~M6h=Krp!{>{1}SxjFEak{j7yqzP9qIhp@j z$Z;Z2d!wugw;~QqgtHV}(tW3{yVK6?o;9lLCdu@iSJUhsHtsWPWUCdPzmL~Jx&Wi| z#Za6rX!YFc1tJMH7Zg1%jsx$!`3db@kGZgIfgLH!zICm&m@NMF>wXAX4i!z-0EX#S zbTYIK3|d-=xcU0>5mI^b^Mk}+OFBkqGlCPoy#Biy|GgXH z+w(ch)GJwGy_uxBod2=wFTKy}XS9<2%T=-GYr#>RdaSo6DrllS5;EcqXZa4-1*@HW zWOZ70+=4AoW7YCruo$Y_68C;UOp{D|dMFMIB)^`m#?i?zyLaDN@_inqHWii=(WJx# z*}t#={@yNnsJT)}dd%qo@T3d$vIPPCJFAc@pC)$`J*Lrkg(u(!)PkYlTR1%S=Gz_B) zanspviYpfoDZ*qKoSkddmE6q+3i(gM;P?Kg%#l8^h}XJQHPTI1G)pDj$!XR2BDQDctHj%KT`e!Fno zoz*Z8N~g@GT*tFpXWmhj(I}pc8#GO$;%09ien}u@{ds4MH!_B+_6`C!xC70Q^IOi} z>p|t@tu@to*Ih#SyukeB)jC;!8NrgPmDp&xV;D9$luT=qFP8(waC{$P+1~A%R$>xr z>v2P>7BwdXDZ!|vz9dLAaSeW0R|qvRc~?Zlv~PWMN~elV$uGU)L^K3@AyDB~Cr7jG zTGGqmkA_)@h{w0ye-0bz>kz)pZmycK%6ZSj(+HJmAEF7M&YC;#2?*2< zVT)NV$Sv>fZD=tEh=dCuw0_l<(xl@fw7Hg-mX>yA>f8@Pl-!bz?_Z5hHA;sL1q3Wd z4FjM2qCh2syw+t-NQq|q6YjS7kn@-t$A`OFOg#9wQWD~ToB|fHY}ew^*R0C+1By;b z7ykC`;VJ->r25n*nKhCXNX!~uL;K0~8bcV3s75aTa$|%N9Q6x(QzaEY z@(&F4zXztQ%SX7kLcWuVi0x7a>Q3TApHx@V$0aP4EB3o8YWWGU3ZvfjGNUXCLkoBh z3|}e*8iog%`<~fGVr-^bDFu!b$8YG9gq{<_b+SPi?w+|H;=a+%U{d{1}j+TWT2bAzZx$4 z#%kjPs*jEc$YeJ;jE=0b zD?4Lg{7X5#)egJLvWUbzTFF=5hmhBFlpP)OPBX4k4y)^?tqO^%# zI+<*5btw69D*4Ap>zSJFZ+k)GIaixQmAmSVy2Z0!{$t)UJMLf*^+_4LNf_y_I$;43 zE0h;-P&>7;UUS;uuNZ+R{W`x|&L7fmOx^b7i+qqkZJSdH-Mq6p3XL49;@bL#n3&l0 z#cr^m+l?+Lnk(_C*FNDtc_J%!l;UY zSh9Amt%JjIIk8T8M`7F`KpyDA_Inqi8V5%UGz0cEfFw9JWMoO5Sp`I<@SmVZ2LudO zmj`SP<%t=lMShTz_;58rRaOErUs#R0483jFFBK-d06@s9GT3llVEV+)EGzS1!+btJ zXuczzJBCr$_3%6h9zzqe-QgX4XB0N=(gd>yI8UB7k3%YZTCwoe#O5diGux}c5V`m0 z>6n+c)KC-N%;QaXjm#Vm7IuZ z3MO|#?j9?2)9sQ>b=fnsl#<;K|L#(YJfeaOn*JT{RapyfCRgPGak>dJ-S@`{GPk1jv0X13vWo%?y% zXd^{)`hl`;=33IyTOuaIH-m$;#aSthT{7nyc`E{R>6s~U&oJvLlwa`cm;Q*xo{<6O z7duv`X8*tyKld}_$&znv%*YyZUzw?>pZ%2k>E4Iq#Cyg)Z5JQNrg>cHRdC7l-kS*Z zy8U!-o_rl`GyyIB@xumycf6KcYC~u~G&z~UPq}5e?uq&#_COxwYDLIUonC(YaKC;| z^h@<&m@bx_+zDc}`!ShVh{eSA=vmMTo+i;dcXoz_iE`o;vq|TxmBy?adTIBQeSpF(F_Ssxp62UOi>CSvwIMJv6!92Bh6c`9l4C(86&Fo73Ryo!RSms(Z4=fblCuADTT=?C1a`g&$lKg0$(EGS)=Wc>X0XJzrp0CnKDka?qkVQOk9 z+@5r&l#lku#;p5kBwYlZGMV6xd05FR<*+VO7;3asUVGZt3v2ry(CO+3Ja54Gmz#N8 z2Q`!OQWrEX!J#wBeD={hllGfKEUcWJXFrBj2_4)d!yMK}$h@%B*P zd$8H2D7Ow5y#=MU*!7g-{=sr)JEG^(*6ddd)KoEhc+6U`jrBg*J?}rd=Cyhc?U2m= z9KvHcSFC+OeZ5zJZ5tsD&Zs9;S6z2a0UH@+3ugwnzl{4YA#_PhEJ6+*&(Y)5n$m#M zjIT+>#XAL~FmP(Kmf93+RaH23`$%}Zr9&)!HfBYBf{vwHzA*{?`qlNQJ61}q*kZa` zDl?CSUZdnkh0EE-FxvX<5BqG!GmU^E!XoEs0LW5fqvyW);9KVdgOS2BZ+H61iHWCs zo8mRkk5n_w^6amM;okskW`#$ucuJ!f)-Vhit@`aGl@MY%x|D^}Lr+o5#u7acnXQ7|`vG*8G+sqo}B-?Sc`4*O!|*E_zn- zUvhjCN=tE~HjIr7`Ca3Mms5y2EuY9mDwSa2`39dEeFj-LhF%E?aZz+iK0n|%IOHuY z&E(uRBALp*EL`b4$n{y6vB{gz(twB;h;!f53$)SV87+i0aYRCOOhQD2^U|8Nf6zL0 zi>o4S@u@CB*kwcVqXiweul+22*O~G%xWgx~1(cU?z<1TR#K^L&XDS-Vaac2>WjAcV`=gr|3>ff~&V=`>z6 zs;AW_Pq|!7Zcc8f1K?5h`p?v}Xw zVcn!hE7Y@4q(j<7qoT)KoFq| zJ{}&omuPR9s))k z!dF(5D1DZ+6v`eQrFbTWr_+Zty-Xwq^7+GobHlPN>}0p@XkB>}j9R|Ve^~Z9q6JAu z)YaRoTP3+++*`@$kAEx(a;-(WJ9=w44+}!bmt4_qOXlJ;@UT3_At5<^$*(^gkBO05 z#>&cRK2Z5nt?9nPjbB7gRvoO(N*kAb%N-qI__a860u-#LrG;_jUlkaKpt85tDaoHfn?JYV0Pd3IvfTeLIv zWZoRuw*-V4GO|d_2tg(u_%gNoOOpfsG}Zrx>-FDh5`a>I>A>#k8;_(vx&s!VvUr8m zR!3EQzxvmE_<{lC71EAMJ|4JZ+<$%NnW!Ju1G$x_tf6=Q7FQV1?%$ptj`8VdLK1#U zn-<~yOUwlPI0{5&gws(U8il%|?O1>NB0+>&QnH6117u!tCdxUc*HdPO<@94S&SA#* zw}?OLkm!NOkHdLkn8}Dy%vVmDs++{BU011xC;A1hakONAiH5%1i46Y|I^~|>&eA&8 zG?%1Z#g|=_uDc;8NiR3g{I`JOTX0npIYgVJv;N^Lw@v7;%`yrumvdRBl_<9^sVhww zQfW3y|F5@n>wwPtZ!ht!HqlMNsy~0BPxb$TL~_G-c}mR(Svl*PoDmK?)VnV`mP-a0 z4~u5L5-gL|zH|^&yV1!0`;mo){PoBfJ|bta3XTfX$2GHy7Hp1ITPFmZHKYF)n7sa@ z0YYxu)bBf+K~FtQna!_itBX+e&6zLk* z4a&HDX!!GrOb8~0vg6m2>1kHN2Wg}tHQs;z!5g&&6cN&6Ym;VUR44M^KVr#TV4dLp zTU_LiP5#&^zIJ#;!@wZd;5hozqd$Wcnhs{NPB!$PGuiXYWAFEhAO2$=*MD&O#mDl` zd0ocdrT^^Sr@w^ix7xl$U;KG*|H}#V%7myk-w%oiuMzH9LHyj=PCHGSe?Cs?YhkoB zt;7vvDDy~`wcwu>B0uo#*~{4A;$+t#4i;)F3}~;N-5;rw5b&>ke;@oLsU!Yfdu(c= zqoeQlPZ&ar)N;v>fv{&q1`-<&;wX6{`_hYMQteaau(5Mkc$2l^_Y;Q z5(>bld!mJf40(qKHdt5%BPIFvhj6e^yjN&W_2o>*5)UJiM@8sgBIgS+b!<$ouHj zI{q`YtFrRa(%Z#6$tf^iR9lM z_IsdaVi`h~HC;tafMdJ5(ybX5R-{q>@f<`4XIDDx&VbYOyd%oo`UKmACNqoQ{=^Ei z2z#hX$=M(6;&?qeGP2fiQ#M;2amkXz^H=IRE@$&uU#B}v{=6k?ViE}1gqXd)e7}YF z94w2O+5H?fU$o~aq%YFTD4q>{LBkR6p9N%o-35m0)j2!o9;k?iinMFm`}^ItVqr^( zcvXk18NXAQi9TgdE6fx9#S-Ifpz0Qj%jJG)VU(u3aVVxXQa17ZVt6-5mu9v5$Q=ej}QC^F4 zbFSGtpM6I47UJH~>ir#ABeJ$}z@n;yaC@2IhLaSaH)N$ejS zB<@3~fugverl6?YUeU(p+8X+i+KE4GApBC^Kti<|i($ zYQ{z)H-eCm$od9}wU@-|e10@*3{$Vkv(9h=e7ec|)ZTw;30zN(leWf#Nm+k5z=|71 z6N504AY48^sKif+t~p$zv6VXTv9Z~pJG(~N*`7CwqqXXb*C-Nv?$=^6QvB5pM66DC z?=eidU%5aO2{g((2B`A$E_{K+59U5ghU$arNs*@dvrG(N%(0x%{uY_=g7`x9(w4$F zrMs;n*C+nVv!9k#rN4N#l&J&ot;7C+SbR$+wJU( z7s@2}Gt_@ZXQ=#Rzn5%m-k=e>T;Z>I)rDvDWs-L!b#+0FdHcbGESm>VnwiV@;9TLx z`W%E_T@g-jcI3#M!ijuXax`ovL52A_p4>BDiy$+6TVA$AG<+k@b7D2AS zne(-t_sV-c12)5srNdPwCf#}t0fC>LlZSvj5zW6FbZx}7ye4<UhuA{HZJW$rHl`#su~zcoEI4vS=2*+6>!gdY9#*+CYz5`HBG zYxa%Jh3r;%GXy#tY;R|ms^`BmonBizMR%DoK>srm0I~6}l261`?T)sq+!?A}FN(dr z9f$konDxbvx5mBmL?T)+eXtgnhbSreV%eR4cCTsTDl1`s`lq0yF$yx;%=uv>lDt^E z?ycc>2mM_DWp-3?ox!!M@Ni0udxg;-(CNWc%R90i!u#KfF$|S}7(;D1?PVzH z4&KH)uglfIuV1ek@0E6SOQ#69iZ{2}Iq^9i#aiP2cijbS?XSVEmh_ZS-8l!wsBR%4 zS{3gJ?Bs8?Ct`xmc21?nOC}|{_TobC-uz39P<;4b#0cP)jT$GFc}1=$O}Nq9_o*p! z2#{PL2;>A)0GpkaQ#KL6ohIdWvKiu>wYm8%PTQN;$08XM_bc)~G+tR+IbLHv9o|%9 zqo?6r%}L1tS|(MrVv_NStgSEKCGlp|V1&IXA(v)Tlbp~h5BTmc1&6ggh2`v*R-z_Y z7=*{`8sCCyB*X$ZMn(Vw`7Q7xRbs={dBM*kPU;oQ-Fnd~_#&<8n=E|XfMQ*EAYS}` z)kMr4lP$Wh*#ouMw&tk3X?tafuEY9-nhOrNr-1(e;yrs3Z95sI!~DeehF`X|bD|?( zCISEXZ3;YQh1bIT&c|f97+P?*!)l~%*Zk#gWdo1fA7#TxE}4_Z&Ar0(dP4TZeTW4% zuKHkFW>G*ufNq`H6Qzz~(oMW8KQLtUx?Y!~5Ao&(r{~%uaukv-42+DdQL4^Af*59S z8gtmm14H8@G;uno$|$aH{>9<%Bcf`4Z-%VkI5YrdiG?ST|D&r@=Cd)gpEuzlMc6lK z+9roAKG_)P6jW5@`pUbr#$9Q(XP1{Q5c5u;wK_l9Ew?%IeBtZxh-gfrQuzBqD&R?u zk3UHZ1HuYd93AU7m~&=JKzPGGl+~&Fuo1OqAIJFV?h7`F@zUYp;l=Jt(HY+pa%J|c zk7X2y8ww2sBSG}o#5<)p6wXXV5D~4Y)O+bIB~~Am{@8Bzx~Z`5x5i+A^)HP<+e`+R z*>XJQ(BiIIdrr6sQqV45A&*okF>$i^$lveubbrz9I@oONd-3(^s2_Kjg{HMFuU+ok z`|DFbB|yi(?@v!p$1bdaXo)>l`~LK-=go$k8TyaN1zOm|zz!G1B+_Hs($!U_&{RFd z>i!cu?9~6|yUHVwA_im~AhqSCl^-@19Q(e)x{BiYpIMKVX3&G_ycs=AKp0Ete2pxn z{OPWn-C{_i#d?zaoG-|dTQtXspKPnO2_{cFU*ps*zLEPX)2N6jnaon9KoxE8gaM#= zOW%aM^m4V}WFQ%#V?E~3&Y?(=s#0#ZcsSqN%Li31iKDckx510w@!%!J zyhodm@HF1SG6zuR4(i(4vPwp`e_q{~K$@IO@tUnKI6_p5LxO{!R&1|Vy8B}bSxfT<)&ke$6a zlVTN-T#{fYh8e+7P`~O+DJa@FihH=gn%1lkxVpSNzqa;_PwV>k*{*CE^^T$##B20n z-1Q3Q9trQeoXfCHZ@(%#gr-__cP)}T=2+1cKJCu* zBAuP8<<4fYuCE1VbZUFIGlz9j2_tjdR(JS8Y&-vVy)ze$to{sNQeHQ3zmBm@&-^+o znvzY}44~b~1!ZvvqmrV!kz*4RZRihR)2GhY;Xl8g%Lhu5F1nYAmylx$TCIJX86w1A>g;ai`eEjNcj!SEP5J0LG!~BkXca{ zHc%G#3AcaKQMD}zi>*98y-VMKmQT``E~X?bG?uRZ0{uyzL?)GVwE_MOYfMK{X19zy z%ul3JG%hNRVP9SVY}$DDFsC5OKOS)R66(4&i06_hwoHK@>fRMPsU_8;bnJp(3V&vB z10(}Gwi@-DujAS7Y7gjkhhGDA?lspe=X~` zWl-|nqJA@#f(JxmCO?_9>hN3>8pVDZD1WI0oZ)2D%-xFH{y^rvn*j4AdP-zxGHW!W zd(+1UE+$Hw2l%=7TbqXp5YJ zxdjCmE69W--eYvRmBl7rm&g$UEUd<+0$W%ty)SQMruCxJg8nj-rYa|x*F*4cm1CdJ z3t+m%vac)o1|ff+aM-{ni2LAy*ti;0si&3?1hQm1=%(7pIKZ1MF(<#WFP?jf zuNw65p<>u5~HAkovIe)2a-z*3qzH;BY(2rD>%IXK#o-R?uaPhnK>Bc&nd%+QJUBP z8@t)|vprAb_3KkOPW{<>&hAsh%rPEhgc+GSb+krooVOVNWL4hNwCQ{qhf%I~6%=UQY$7Np{^@n3 zGS{X=q{2LAlkj4I&FETL8BX*D>N@GdEG?>qEdb@YVvEND9{BR3bdf&~yq@AxL>;H| zAgw!&eoPIj-O_i|w0R?tEqJZ+7$vS-?&e@~w;ju|T}$#gr^ST4-ZGM0z$KR7_$T38 zl`N^(Xt*hoy0zyffJD6QGlu|OcD*fp4xQujie7=nTKSXgPDj)xK9hR8|7{$l#b}0j z0B4A};ASngxbv#}(Wxx=&1Vd{r|=scJ-E3w+Z?d+z$c}~$`QGN379v%+7pV0!y*m; zhHRvJ&tsb#`4#V86l~1nt3?Ga->TT+qJqC!^e=>{xX_vN1n);*f;)zv0@LSkvmP3 zq&GHXW)4LzMHY-gEobXM!a}!BlX0)As>Wr3DW4Cu;2Zuva_MWY;_2U4Iqs34v+2W{LSfhK9@)t=x%+n}* zAS~DJ5$lSB?;Q+pHu*mKUS3}D{rh`zL4n>b$v;$}7#?Q6esjgg>2ZXvT(Nc~zw@Iv z$wr;QK&Azf;5QbQ3_j{5#-Fb(G(!qTK1yF-UcLM9ajcS^f}%t!CU{1NtkIVR?B=Fk zpt2Wp<4xy_l!}4<&FDonf^^j1jGm={pC6X~;z9@scUbbZZonf+lHYs5pQ-5yP;wu# z8M7Z8B2nGbBk`Z68a2yo0-QD70w(tYw#d)zZc>bEn4hDh%nG<#+B|W8J9bsZi$Z%` zPsAPDQ9~vmZ8^LW;82l~{+vdRDCLZ=K&*f^47&6idrsZk!<=^yB;jMIrF40FbJ`Vs z$35YbDg0Cjk`nL3(SvczAYHFPmUNPNhWBH-E~7OjeW6axlm2JmcfasFdv+OO9^oNf z$UdVMvb#!6pj9reI@Qccn3pbUZ?8>s0=!@2>Gw)~9<7rra|;3S=g=?8SA8(ul$`|5 zqF3-&ou98=etKp-AH0A6zJOHkyK*Cxzu%wtim$^Y=-#C}#>C@3FVQ9aj z`0M848^7DPQc4SKL1pcOiPuf*c*(WBdUJKXfrNz314YMQBugp>EyZP~%Ntg3R4g>5 zXiao39UdLH?R$uS+8OacKE1W)$~)h>&3oL^O0#rGl_S6dJX@Fdq$Vpii?j2Iescpt zsF9D|7L;K%rwu1er2|ls4+oAm_U9)m_{4dVAP;R*$ZVoYnm*1i#lkYU4 z^VJali&zjMs%80o6E1kh|I1;r|3Rze0dB&mPE;C#_b*04egVZNlVJIuqyz{}otOH> z_n)+c;XAaGxhw$`y6?7sy*(ixY+aGh+f@n!oj)*sW!AoQMpixf2gw0Fv|nwFz6tFW zdb%B2RkA$0oT2!KCJfDIyNl5d>nM^dGkE6p>CFbjv!*s<`4R zvOzr_YNzUY)Gd{n)+4^Z|C|yX+5`K`qs|f5{{F!a8X=!Ni)-Aj3tWydm?{2x*lmjR z0wt`23`&Es9*<`pF^dKX|MmT6Ql{SsJJ{Iz=>mTIWa@iFH`w6y*W$SKM(qHl@xW<9 zH6Sq2jM=C10Y^ z{>+2_eQwQLsVVDVr{4W7u_pAx?4;bzpXvN%;Xaj@_b^puTwn>msOI0_)I+=dAq|Mr z%J=eK=zDUwApzj{H@UX|^~-npiTiA2Y-|zC9z`XF=Ci+VuJ$hp4NZ-L;FIuHgVLF` zpR=bY;euCbYKgpM5Xxzxr9Ritm;jve@!R3ehp|r5$$TCw2**KmRgE_SJm{82CMK_B zrRN;Czux%M{A7y2quU2GM4ht)tPk@$z5rl#XTS>Nkw_dE!&AFx!sP)VMw2?ii z433Wvj;tKIUC&s6WOlwO62NV`wRS4UiaNC}Akp!6X!(}9xY@>HQqA!UBBjlsI4v;Z zI3|UrBH-g&exUj^WKz2>f?#isyaWye{d+|!6mY5atTy+d$jA7q7W0>Jb|tTFMbUTh zd%ft*kY8W@0jR$(1DLnd4muLvjUsb3<_s`v^EIEw8`bp~K7;>H2L1l9e3lh8n1&V* z{LWLPsI_O9M)=IS9BxmKrMsKuTRC4Gty70T&uRK#WVW%fF_rsa8h9jn6OjZE^fDrp z^OKF~nu3zBu=lBHVHEc^C{#RYwe8Q3s<>?lI=D!1Hx*a6lszt>vjWp=G)mdmapC9R zOd&i$Ra`-A<`X6pN9v$SmmWqh#Vsdemn>IeduqGcGy5@ zn#u2oEZbvR>WHhcNt}tgCASH=*4ZR|jc4LP_(h?IkmvZV>ix^a?-TOW`Cv$0l}m<* z^C`F9W2Ah`QZT7=I<%RRn(wH1ZFyDAPx12q+r_`x*bD*Iiz-_h4i3hd!NCk|gMzjS zhD3TU>4bA7I2j5c*Sh`V^D9n(lL82J>ur`brt0qUteKk1P4jDs7TmSp8A{d@kqoAx zqJoZBN91`XdbfCW@ZH4oHZ?c_B`XL|MlZiKcWmh}*RtiYeb zFJ;`EEZKv9n@2RBeQ~-Q+>8lg6#(awYG06j&&P~N$NxMyJ|RIWj-^)OgSZna3N457 zDecQfv0FlZUnC79m9soyh@_mhhR7`%1gYlvrG3TPui$z&J)Ezv$;fuVzLC4S)~|&9 za4Pri$D`QYxR(AyMJ^)TcO^FbQJ>}IGs^fzPQA6yN z-lq+&4ssxm!Wy1QZ&0mb`cvppBvm_-55irA%nKP@gVoiM4nC@`uDxgh_io0b#>K}5 zk^$6z)-Z|t0!pZ~Vz4S-)_}`wdwe+x`@Ei}T2!`g9ye0-IVi7XIv~gLWCjK7wHer@ zxxr!5S<3a1jpXHSS5D%yTvCQbQ|@Xn6M9viy-o5fVa6PwpXq9`?s#sC&Xp*dknI{bB<|I8mFqNs8PXIM4kO=PWm^qrAG}m{i)0tl zlw>96$wZW)6>D?9#laxy)2w0$eeP-y!8yu|cQ{_gGX; zvN55?zI0Y4-0aOOq*hh-dGEGCu69i}U^(Gh9dILha#JDWf$h~q7BD^Ks&O_B4r=QnNTLeQ@1K6! znYz}ze(3gGM8q?i;UZwcLUNXvn6TenBKT>UX%jjGA~oO6UmHVB->%Qxnaj#^ghnngaXA(EZzKEE*TXI8e8}TOo1pL+geetsBnaZFsj-aJ*!YSNagQJzp?Hh8wGn|=T8>G4)x z8oYyjkM^atoaQZga%K9Az~JzB@+s%l%vAS_q8BgB?Q!B#Mc+qUImofnwpBvi6Iq>! z49}EKntoX~`C?Q$LRQ>d8rug~hZN8ZKFI4_hkCf?`eK`DR_y3yg{97O^#B`mZz8v# z!;A=C#T~eLtCML4kNr+}xu@Y()e?n(fJdINO-Ihi!yh}mgIW6$BceTw*?)n=2r6yc#UomGawZvbF2XIqn0I+YSt<zFfM78N4D$w``cA1)DlUO$gW>bZDUH7j3? z8J?Ip<%<=uxUg`K=_y3g&-oiFnK#v%>BC!Q-q<4E>QCcGkhm6ZdoM29>X@@y15BN0i!8#Kf)ar)k#3YU0WKeo1go*s0Ah{$HvCe z)!CVFIas#Px8h|K2~m?hB$pm=TX9khSBfLzdwZdr57jFaBgjiZgun@4^#xZKSZJtV zGv4p}FcXl3Bp&ML>@)VxuFs16kzu5-KV7N7zoEVdJi%^a}9$v!>GObA(| z=T*i{ZuuVQ7L&Rn#b{{=o(W;0PH7lV2Sc%XflrRF=5W5solDow7&s}no_whhX3fb{ z<)zzWWk9x{ljxLvBd`ka(u14tz#(F5BxQNl(a`to+{X(wqtTp$G2daV67}le(~Gu? z*%s1xOQ!uh`-^g;F*1(C*{Bs26w+G=q*chDu%`uEot);zuwI-Y9O>eMSF+E*lpRSZ{c-S&o;eM_f>e(b7 zw4vDRfg1LmDU9I$*MWsJ{)^8L^RqK3mJ#LGCw8ot)stk*btziq5BnA|GBpxZas%F;x zA`aX(Q~J6298>e1sRZ{jXl^v&Znmwmb-T^8qr<~MKJ_%~X>2wnrHiB#H?PWjv$?HH z(+Y0&acN$8o*KYk4B1|ut^=b4dWe5;eRm!9RK6IFDwmnIBpt7rTYW7P#cZ8(FP>HV z3z@9~k?`dG#LbfOvt1btU>M_vEGBPv@z{Rp5<9F)v_XI1j`4FtYcn@rm=F@RU|Hz9l zxZ`fc6dxsv6*yXFM|NR388m#~^CJ*7QA!K8AmjB};6QMOxI5f+k_a?o-zM0{%i;=Y zt@_`W8r4G6IV`6*c46+Zp21|icu$p;08yAgq?Q8KK9!WJ+|4#kM*>WT->x?qMf%0U zuKT&2yu3=anM&?l8}ipofHA1Pd+>#MYCr;zR>I>2aF7BUX?S=f!Vvg-Hw4U{FDo>5 ztgSPv4EC#hPKHw5W4P(wvmG8$ZoC1!ALtvE6v?5J6%gkApBb&D?QipxKT7GtKkBHz z4Kos3*2=Xx-sU9%1*gU^y%!s<@+dE`t_INTc3C z*}YpqK=Z2S}2*P z6z`iN3OKAl%FblP?wS1tx%36!=e;kR{RU_hRG84IS}}fm^HCP~D}8!Hb91FSrw5Dh zR=jT5CpluP^^fCgUb}tu43N7>1~C)~21tN|K0%olll0?&{KsPKfhR$hzwMvdia?U5 zoGi}&LOfWz)?gVSAv;x1+Sx1{7}LJc;2)%2bF3iiTU=}j6kbmSQF5JBW)x;hZvwQ` zkQNFoHxNT9$V0{#qFxbBGxGA0U>b;BgAXeM900c@%gc~4q2#k;yqD`CG|e>{me?CT zmgHaH;t!j9qEFD&0r3Z}GR;=kVr#3Tt9I-RCU=kTC<{MX<(S3BiM(NxMRVWVEJ^j6 z80&vwC~ah9$pLIo(oYs!0++DeYd-B7PY8$h==?BOc-rV9C5N*!*i&!6r6!sHZwt4c~1b8>UI zZ^ZP_AJTDUKDJ&Bu4|0Qg9ZQ>D6F$?<0Wu`a(6EXfx&$4GI8gN55+TOp@%6G6)ln# z)sQ(8)%r9wOjJeXKW0n7u5V&|9H^}K^(975`3336Q(4qOEOxL=7HYeIp*x3MZP@*ul3{7r><#;TCtKG z+)^Q*!LOrd17=W(mDw#giH#i*N?+p`C>lCzzs%KE1Hpy zPZ#!^lxk1K+>F5@8;WTG*Lt&FZ#q&?2sim0&(<3T6%?>ysvq^*{Cuc!C#HuyOTFkF zM@n8RP;x0LIYxoNn^ChxA43$>qkN^D=%}cyfB+n@t7czSIt}X;*Rc@NK2gtbGWoX_ zzbcqM&1jWnW{ znW)s`Qu1CAD3>`3(y3*@L}o&S#V=|Rm*>t0qB=ZZuyrEqW8T%AfG8NFUUe&RMejN6 z-*jZo00HurpYjNk+~OP_Jr}xawpuUake{3=;n+O8N`#^OQ~Gh8g+RCF43nkls-Q0o&*%`K%6dImVwo_G;xcmK9bR@W~lBrZuGOd zNWI4IK$4a$mh%MBBKT>S`@8Y3Full!e4q;-K-}!nDN#E+I|h@Vl(&u9t}-!$cH)2F z9gQB5@Ud74LFp3=F9{r)p{Hik>HkSZ{>$WeT4hV12Acs1k9P-g@dVHVte)JGzod8; zsg{#!w9t)3-}*gJ0FR@%wl=~e_F+sh#$OIWqVSqhH>pt0e_;XtN4MaH^qo74oGi@m z=i0fCHEj`^_@veFe_qYLD%b_{QV`#5E&Ws+^S zPV+z{#Q0acGojwAi9Es$hgwELWfIfP{TG+4ms<15hEGp6n!nTg;9+ zqk{qvAbm8=ev@OgFt3>Nh7LiUuat6q+*&?D*D6eMwn<;Bd7V$f}Zg^JZ%x zD+3;Lf7%%PpNetm7i@d9zd$#77v%M_**Pdh*oYRziEojAe^utWRv+(ZvkYyG?zo=M z6#t6IAJ#UQtMcWXD1O>Lv^#yr!tvfCf2}`O1=bYfauYl%~r3I_q?iiZ`G@M|54r5i(YfhUTe;8 zjPd(cY@Z}y&u@gO*4w_4c9rxne~wGc0y1u-_wVymA7xL-d;7i(OP zz{UWnjZK>D@gG|d`mCv-j@7+-EBaZXtcYSPg4cH{lzYlIWqy(OLw{<514$mYFl`_* zijchcpOL9RjPB};D(EjUx(+nNL5xE|&%a0SzPj(h|5XPhMqklOLKpo9*LVqv&S4Kt z{9^g$@j;?nQhf6tno1hQdHHwOPYyQ?XHlmiw@hURZ}m4HZ`(A2z@3_bzU{)|VO^aS z{cW7;;4Rj!KX4KQ!I%aJrxkfimuF1$H*yW8o+Ye~tfIBcjXgK!3$5*J_DX-Kcu11M z_jwZZ9L`T?HWZ=#ZwIv}s5pW{9P90HOP|vL)U@}cX$7vz6k&0i9R{62v*`a zu|tz5hj}Q6`6$s+O7a`^j)k!><=u0m3l*~W&_CwrFM;-{-k=EFb26RT5u09mv+lBp zok8dYd8my>o!;G`!aeL~d{eBG-gM~~X+}`P!03|E%0U241!>5O`k6z>pOLs*-gZOo z=ktchFhJV({al81pxXVk)#K^kc-tUR$-NvK>7>zfH#h!?w|(_%Y?4(xkERo$QC9xc z#3VE5&!gsG5(_Mk;~QGhGB7MnJ{|n4BKT%@#OJT`n4ZM?jphqJSBF1SsxRbx&7wFO z*=PL1snAG0?oQ@~8c2;sYbqfOB&A5*y%LNXVRbhT|C^e+{zHdnc;fM~>YRx1Dy*!S z#Hvjoll0CI0Ou}!kJLkB?Wwdt+t|HfLWaAq;XZI5v^zSowt01(+ZC0h{V6Ii@Xt^o z1r9noEK@|1miiUeQ><{vTQg$GZ`}Kg4hJ5<)CDn9Cb^LSDdqszlF$3>2z=bWya)rp zK0Mf));roBdoP>pG3WTf&GDIuy`?Pzb;n4)5+?qdzz2{*zXaQ#CvbkbfG>m! zmWYlMA8o}%ohdA0{wXR4mR$dizAZ4watHAa=-BSrgbX(kP?RB3tT#2~(8h7fNJs>I zK>&G%pe!6*^tnxy?1fxN;o$QR)vkvlHOH}_)P;YSN=_V$Rc1OuqA@Q4)NC4*07i|* z&o5fKy1w}%2$g08WQZk3079wXgxR30@py`XX!kVT^u=2^$&mk2tCMFTP<(*>C>+Aw z|EW8l&5d5s5>QA%8U1Dyt~nVoz&WP@ZvkMbHT% zzyWILJb69uW@JB3Puf**A~}O(qv*JLvdwDTOgoq0KMP5%9zaO?OmNgiKbWm8X*m}h zA^CSL?dkNtXlayb!jkbm=0C%4RX8Z!KdW%#JaqSknLr`Kjgxposam%=dvFy$D;n^Q zNpHIIC4YXou-l$-1I1Aw8-Yehwbj)g@{dc3%XQ(B^3l;<2ZRQUq#6^)j$N*8U&6CJ z8s_1m`2KvOCuV;`W7=*mxUtbpa@l<(KgN&+JfwP}{%fwaA5I_w?!DG~tt2{~dzd6o z*GVt^eM7aze#5X)8XOK!yooc3SoR7(*$WGA7(7^ln?Q-^+>^CB$TQxhVt7MIeVy4H z%b>pOCqbmY+ca1D7iM&|o@fApoQZMpD5B(qy?qt5vOGBgm&}^HROE>fftTZ4X)Kde?i8ji?Bi^gyijkEuzk3L82Q> z%pSBRVFP8l^n_lui>U@Ia{QS(hec3KdQVSZD1IFYppM@)baZ6BD`eBqhqKYHE9JT} z1~Xv4#I|;K0TaIwGHAO!0onJ~;FC`RVhkwQgXLVTN>uAiz1_-|=Q8yOXpWW8p$X!% zz;16fzYuW`UZ9hcm^>57#nC2Tv7@VbnwFEElVtyAd@V4VKKEL0`LpR3dwcP5z3wlWJr65RNEN>PQHx~A=4Q;K?>RNZtDZrZsD z$m@5@O7Fck2C?LU_XVrb6MojRwTScaMCfw@cxsZ8?x4rY^_hoTWFCv-7B=K*z{W_q zws}OSweZy6gOWbZi21+ww?_+CAsT4u35jme4Iqv>F9lq!gb*4#3kzW}m#J(KP@z&C zk4;*0Xq7rjc>&P=KtKl|U~?Ng;OY|>77q*vm@RX7q(&f$aWFOY;L^J}ABVh7cM*?X z1J~7z;sQH3?8-^V7hYj5Kl=?KvsMe7vO`TSjZy`e*huu$fmdiB&&^^Dg%PsW_wPwA zp`#zf5PwGs-;?Uhp>AK__1esAg>RzcW^Uh6<2${dah&z~4UnLYiP-JKVY+{ij(0`@ z=@`oSq7L*;_k<+NeFfWIbh--7y4O5W=JueDL~$JuP}|q~&J+7T4H70~2cG{+UNAZN z=idW^4;8u<&pwP)%Pd9pzw&f51@M=6Z*P_98jNq=&b0Y8)u1;(cg*|NU%!1W3+=n& zsKyfy`qBWz1L(+e>gdto`JhSV>0la*BmDMPK<+P zr2-;7>+NQg1kQ&m+h>o%kiR2DORq+x;5}T-oOb&&u!v42nNpzRPi8F;!)ihnCNXbj zT0-d(k?q0bB-Ae_H=FN^C0|dls54C_`IJp2q)9_wbli$x4$ahaC1XeXfusjIdI{=1 zO|YZn&m^6;@6HXl9{N@*q_j?l`>sj5D>ka~1ZCRhl3~yh2ZCL~W$fDHFb>J|Bd*aoj#2 zIE>+r{}DMn`juwgc2=x0J|2MEk11tEB#|Wh{r33&t)X6txa0p zC|h5is39XC<|O~rZu`D9Uh01q2bhEAL5Eg&bTVZ7)3p{s(t}e|aflIh_0CFJ6W=0c z(k)Gm?d^|u8?L<^0R=Vsa5N<n`F;5U8=2Er_G(6)HnTbrkuUole8yDn58;z3Ntlh@=j zLc4^kAEmHYibasa4_%zWQCK1(DpgWpEWq2fsA3hHHyz^9fk=3RYIRAuk+<1ISv;X4h&jUwR4N@nmz0Qa z_p@I6QHQ2`KV2@8?(;-eP)hDUTi(=jF$~GeLhkE(~**>^)y2 zTnoC;#Xn|uj+!c;bO+XLi)PBMlg{N$V5(2PS_E*ooq_VgtyUb@pnR1^hv^IYRfl~B zo1?XOh@GQ-Kn~`j!$kKYxj2YwvQtmF28+R>ov(*KU5KDv&bWA6?w){H)%ng*mU^RU z^jTc4>^w7V*#6Zyz)9D;97Ylf@?{S_1Fa=+0taekdjkM^+q|vNUM9FzoKS>ZT2+-D znj_zI7n9gSbMUVsZGn3IPg(9||D<^5rL_*JS?8|n(~INSX78X6=AQ^jcm6?Q z-qA{X2}p4XEA#Wpq*a!mCnK9E75IY8bahA0%-mFK?4L(GlFptR+vhyHu(wK{Xt?(N zIP)rkyMLL=QRF%Wxo7CO(Wg-O4te(>T z;QO2pi;byOyIoXW6}wYdI56cx)4@$C6ZR1vXVHYr` zxv+a9{q`83pa2_Gky8-&02NzEm?7T&QU@ba^G5_Es(cK3$&_zAZomLY@dVwKUfFlC z)_R?)GiIKHEbT@*$F93dh#uRyRur~OWg!K+I&E$olz2%bh6HPVWQ*RRQdfTtcIu*J zI5Sh9Wfmx~6D*yCU~+P&`IN5~2d6s2DN7v=12tT)<1cr&qiO+&KQoB%GJ>&C7i#Jc zQ=(gCM|M-9bm`67_?iEEYRKg~oL^+cBae70kzak2jxtOg<<}z*L)?R{Q42_4y`VX! zpf3JXTsHW*iA5xAJJpy7>`*g6T?Y4iP-sVcHjrpq?%IGuNzRssuzPq)eKpz);3j|N zK8sOdqrR0BbUKiA{&cabmzf`c6BZPAXt7XX_bz$6Dwgvfz zY5JKW6swbyl8T@{NhMD;QW1aMfGk13{n+?9`{4DazD%iX68K{7KPz+R!i4h4@jUpcwKd|%$$>+?fVM_ka|MKI5U@jY|IeI7dq zgsc**yoD1Pa~#d7Ss~@mU%98G58u;lG(>56^xQYd6}I8|>qmQabSCjs{^mS6d$1|i zbuQ$}v~h*t9<{u(Prc*oKwBvwhU@jfVmsymuIPAUqyU$o&UHEx&W#hvKs;fgo+36Z z-s)65&duHI<41gGvf%P-Y}8^*3d(5cve~Dk-8FrB_0!72*-X*3G;g7UZn5a=ib)iT{R3C@rP!sKvy^ zb)F56$l$_3GqB}I=W5DwAS@zK%icP#Q(cqAbM?W0{?i|rj)S*z+- zE>vSr&~o1a1Aa*5f#d1ZoSfSMe$6pAZ9*ZYT522CROekd5gYrF&wf$bnx3*UXQPVw zahl#|qzTec{^kG!gSj}V_qW6OGOa$MQ!;NL+p_9x50`^vH`4@t_hSmTI5g>N;|uzT zwUZu~=!(xBIX{wOFl)iWZ14dP?IW!c@aPXVe&i8h1IJOh<#MOA;46KmUChRj^^IX3 z9^PEZzT;R+=J2@FFHpsyep-HV2h5viZw8WFpY0bPZw{|G?)bYzfwOYzZudS-O0VK! zPse<&9#4Hn3kyBNVf^hmRp#r_w+gbacr4z)MFMUG5-^L-!a-QlO^iy^RoZ01P-&|CR&gP#sIh_m zQVq{w+OMnKllFu2 zzUOsqC3G6sh3g~*Up<0<)lppM^%a&F+jZlADKsTsG#%WpUA0Idb_74g>ZfG73pT zix;Z!-&}ParKN=fp3@cRO=c8 zm6i9!1ZiF%k$OV8cM|gh=0vYmAoVYc@|1dUZ;?bcT|ZdbI|y0X$e&vhzkI zcDeRbK>4&e(z6t;$HSx5c{5&%b(WRG8?*?C-ipo(6UD{k!mOZq&Gq1cpRr#GS}{-Z zaDy^b0VmN#I9Hx#LOEZAc7iWYgpUim@}ew->jma#ES?wcG><=Gmgt2ByF|bK5S_ai zWuq&|Pqun`-L1zF&3HOfZDpyqbKO^c8uvA@;q6dj-|6<{NlfMSBh+{Am;%2CNVzG> zeUnTS_G2r+#tVq<+NlxSF1c|U9T-SS;9|4ZAM%2zC%n~GHa8DeYzB{v>lMO6AG^_! zk&|vlw_-~J+tIP)?mYfMoV{GwRm%V=#0Lkxa=g@aZ^cWYuD-6;*3rVk(9qbimkEJ? zYD{W#q>e?WGaUwVP0_-;Hvj3LtB|eNXM3>6+vs>z?A`jnB7^SbNBG_r-;T;D=TsJR z1yMB%qW1^s%SV@|rks}cr!j5~zgIh-SV#ELu8wos8NW~EZ!5T7HSGWOVrHvIvmbEp zt}bU2q*NB4aV_Rx6h_5d{7g)66*Vq1T=MZFU~sw6LE|vrO$~zazdfD@#BPLEbyWMu zY-9U3IE^vccnX|1(BTdIqjDRY#*1U5VxoP0`sMF@| zSu1Tv$6|}BUv@w5RUCN(=d6R1m|$OgYSzVRSH6ZJ@A_!HyIA?>&76s&;m@i$75o}TX|b=pQ+v9jF=ORTFpV+)sJ_BL4@w0t>BMpK}QtL z;L6>rw~G<57s>?J?Da-5bXh?*s|+R+*fv{9Wo6|js#kxj1sti9VR@4+oN3S0y@&Qi ztq{+dal{tmMMrx#?%3ufTg<}D*z!$H4STy;9mkij_bYw4>Vup=ovg16O`6>(>HCOp z)wPPzUhOrDQM+C~TD~m(V6sYGm{-3X8LOp5cYdkS$Ve1D#>R1awZWTl4?o__Cox_0J;X@q>s)7fB1u1p)8O1Xt5@7rS=y?=I)WeX(7q zTWm$9(<)lcGOU43jn~G8*Up8}oMu12o~z-J2F~obnWt;fKaw?=&|44U+~2xxY!Ij$ zhpIdGsy68L;Vty^*44SW&X;(xNMa>!nm(#|LlB@v*s#|u{HV@D%=r2yrafskq`_$V zB4FiUk-Vf8_wrZgqmQXO`IWHK+`@wG*-<&;8%e~>5-WN3t0s@2Nl{KyIQYs- zI68z-gr-FCsD7I>?o0bxrz;kR36V=_90M9A7ZN|>bxv4SkQAgP*_S2l@aU)tR%4{D zahWjyy}o1|st-qGjHjF8jIt06fQ;CYzdCV-%vfKRu$hSo3lDid&|rtQeYhFLLnC4@ z+v=U<;kEhl<%_VB6Q7Qpg-}P19Q|0$VQFpK4A}HeO%=j+p?0VNeh0%BxY*dP`+RK^ z$ApK6mphmzDJ8IgN~@AS8YM?w<8IP<%?n12Ws}*4#q!bFC^n}It&Il@aqCZ5hZ7U7 zRcysgEv0$7edhc7rL+hO@^YwXnSI)Z0|;kn&rAyul9Nf)GdSQGX?k0?J>heX@&k5# zjT^1kQ$mVg(aaia@x(2lgX_+=Q)A}X{=*&m5iKC_JEE11O}<%HA%}*Hl3aX9NVVy; ziW-}D)tGt{$HNP4}<>``2^CnWV&t!uVpVsN#N*k!zD&u-8==qUky z3S1S7Pg^}PZH@XmOV0odfcssoN9&72n0&aCG&r!~+_{C?xXw7k3fEXo4FZ$T6op(9 z4|jUHI7ZVc`-WSWD}=1D;ZRS5hI4o77Dv)79xw22XAYB*wM|&*Rma3e&#piSNG0@}>HdIl3C+mSvQT^lOZP$rw@$N(g` zcE9JiA8a<3YIo|&WgMiW_IIByyko-1q&a20!mJSETgzu|Z}K6&%sp&qvRd%Jen0niOs9Yrducx9=(g+B2oY3qUFK zy?{OJK9hulGk&S|;%eRFsTy)F!G?5cDfXr@t3^>owbbVPuuaDUo*zF;0*N+D6ZyHQ zoGIYo-i4Gwr5t{Dfj{Bg6Ml{T(LbGw1pQV_cP~S{)7xKA-Y2=0w*~$Fh=7N_{NwGk zfAe-6C;GcGinYfPw~6y4J#k`0H53#iN3P}DgROZEKH?GMOa1y>@(u;Go^p_W9YDiz`MK@QH{hrWOh;c3?@I3^5CWc-jeiXGK+pv&LB3*#Ss zdh>*BUU__}p;7V6Ln)F1Ik7)p7hOz8k&8>rsN>FtRPdkG=zk_wDz5KXtFHaAD4Tv~ z8>lCE{YCOOKEYJ4Z23c{@=FJb5=+{gV;IwDewq5M$-=#%>VZcqI5Spja-kWq$|7Ke61^e*Q4*UY@H*Q$&dWU z{OuIGy&x~VFKTM+M(Q(?*evByY5$z!%81~-7t9bysF%(e@2q!UJ7KkFt{uZpH^YLOl8QYtLP712r)#cg;)~WV(Xmxsh%$^nAVA>; zb;Q$0MPIRsnGux`gH7{5=Vd}R+H{$+M*cgRmkc(8-jRx{1N-*0gB{rx-o zaK-F=?b}4m#tc+r764JVa-ULFHeDr%1S6S(!&!?id^4Jf#*oGoSFI9#s)QN2K5VT{4ZLd z!=#YBr9ZV+QMoL_c=gdJAvZU-xFQ|;l&^HmLkL=4fnSRH{7pD?B#x69Kh6L7JLjdb zDqoq546|wD1O_d^vgADD)e2g#66yTJn=0S1qxpGl%(iD^ht;e<8)ql=t3N9Q=$=Fz zs(f$D>xTbOUz5+QeLb^72-Y$45Hob#!z(e}v!{Iv0#CA<J0OwBuCDW@j3B_PB$W5j2@W34Mst&z*tSj1 zN(O%jf2``pzEb8HTtS{CKB6%HXn-0b@MbPD=J2gOk(|! zKO&oSo#%8;Cz?RQp$6AwyeZyP@};%%@rZXn4R9?CihsSkC_>z?to7EDEZP~`*CuU! zro>mKB&Q(f8I38Do!xS8aFTm-)`CpWR6I~;K6)!`kxYH!^1IokSGGteh;# z8{98B>FMKF;fTs9k9*q{Cbz$bW%lhIA5K=RzdBa^oiL`%I8tch`SZmD8g1eSCsqMG zOhb<4VFKIH9IRx|+i5$%7@tAWsO_TMBx~3CAYXZ5dplLJXGhuQW!c@sE(Ik=kcr<@0JVSp*u*4Xht$(h^RsN3 zzrT?W$Ck5>oQPFea|Xl+5^qKs8mg0=%m1oLqO|oW03|@V5e_4lX3#%&Zf9o5hziWh z$fM7s!$G+}*m8!lUSP zu{u5y<7!e+8yRh{*?nxmv{>V0<={^3&*E;?9E{CQr93-xC7+3E8nAn*rDl>})%g0| zNXeTv>&L3QhB-OmfyvJn!eQtiu0mTLQ`QbtBoyWpS>nbTf^$Ye9XU6=rWNsO55zom zIq@~@xIOU)JYc}NvYEmm5Qw(`zb``8z(Qf|8_IVmHg61#zaEI0T8tg(GBXdi;c6f4 zVOT7N^2tO9dc93;6RkQb5f97$#?(SChW{*aZF})m2GKKUa4?hlx=3&KqSm?A0{HFu zuCUnIp|x7SP0(M9J@^*wM|*@30u{gh*$~gxDJ-0q*p(4e>}taIYNMOF5Xt{L=C;GV zFWfSEJ&#A$2?z=Okd5)jns2{p+@15*nu4A(kjaKyN&4s*$0)_7prV35_t?nH49`S9 zFdCE~A^O)>G7uM81A@c)VSV;Un>PjvX=iEs`?DW0LJYq)PS$5eU5lP%W4sawhz)*e zYM5-`?89*(nVnw%)3S5y4A0h5wlwM9f646>_> zx`%Y-blxZ;JO=jw+l?;m^=uWt-epK76Jcjp;IrPTdTpoC4u+E*R@WtSlb&;VZ6nX* ztCs$}_{jsw(?1B2MP4)*pn)sy2BpTW$ku0TOK zHi(79f3Q-1Ad+ej_x;F31=)lsLcQ8u*#?*Hp60bx%^UF5;C@v9=0Uvud!gl_UPP)`^J#@%>%y*rk-c{KA8Xouy;F`=G`nMrU zO-}aepQeiHn>R21X=z}+6#w^I?4Ymj{%MIy{m)~6C*pr5I}{jTk7sh={nj7ywVeMwLx7+hppU54q!HV+P;+ z>#QtbKC(Q)72y{CDKsP;qC672f?|t-a?~XDN<aNOYC=01m=#Gl1;LQ|_chd8@(*-@&CW1hrvb_#!fL+{6 zjT}t%m%8T0{V6aE?X=X{M9#_^)0s)66Q6^myM%|xAv74=z{ljl= zPE-17;7!&Sx8nsZMMcHp%$m1$kgTsNotFpKnDCyz{`CyO7ul6D+0e-N5izU`F6+^F z*_Dmm@QdsygT>$c9=7_;953nIjmO$BKS7Jz(xKSc5gh+a#3`7TtfsmahigYx10`;( zQBh!59e6fjnW`~Sni|~$bS=lS*_WJ}oRXA;x4XN$XKAy)W4Ui>V`XEL$Xs&!^rw4Z zz(f0Zsl_vn;E|JMZ@1b7x2&tHlLMh}XK$h$RIpO~0%r@Nm9S|!Ra9g(yl$8-?BX;( z6i8oWr670ZK1DoN>+0@IXJP!2(XvllT0i|jIkQT{@9u={e!cquom9m9^JfSopSDdl zGSc^ymtku)mu_zut4L|kh|oqpJJ529=Xjx<7=wxThr4!k*`dXN_HPa4#Hj4SlnIxT z9b0>I6I)ww${qKi-CbZvGzhxr{+`lYg8m2d9TD5W#5zAAZjqwwUWA#=$fPTD^)KA9g~n5YOlni2WZ zQLYffA6$#UwR6*ZzRjwSOYknXqHa)=nT%)zwtq7kc$)#o!^4xWoF6u1Y^S@>cy2V2 zRD{*Vq5a=Ojb1CEUaTkn&c0$Q))Lf3w=ZUuSZsN8sdu#1Ae~^9^1ghr!gMYo2%O$d zHC15IjkF#dJ{Nm9&)McnYqF6=Ib1J^JyY`82FW0E@or}N7btc_@WKCKlpAUVR;rcZm16$~s- zDNDj>rnwfkAX5ZyEz4{ufuV49A}awFr>#o)JSgf1!>4sF-?Jpl5bo*H_f&`SUQ!ae zx+R|DcR9gFBCaOaOMfy&{NM9~f3NG1YbN*2GUa`<6C3p-}{Z>mezMd6L5(j&~Z z;SL{UuSBw*t>zaM$vT~_w(K(v3?_ZHlpo6E(0)ijIk{#@)>UJf|IY4JcPL1d^0t2_J10ksU-KRXMVb?crsDL^p!hx!9;p68g`c8qR~}xf^9#hw<1RVD(*lXw;wN362dP8> zniqzo$_%=3p9j`o^Tcm3Yk!{qJTX%Q1pgp3b~ZMhr)k^lz<`&&($PD^l1aiYiAi->nUamx z!1&0B5r#|2Mzi%Uk*dW0MDbLcGOkuttpj5ffASw`p}k@#E{REeln4?1ktTICehI~kACe8gDq!ir~t<#6Zey)%Bm3UqIJUMP4i z^23btam?I8Ss!t%Co23*g6pgn^Yl~A6}(y+J>GE@(kZhwIK*`;oA_n$%1?|St%rDf zYOEceZy(5_U2%&`M=8q?@g7(JIfg7ntyZGm^jb`INiS!nRP#LeV%10S%kACN;XN*k zVZnr*mlsW(D3G}8>Dojn*!RvRQ_Br$X{igEJ>ya?Xf|)d6YuW4w6I!}QW0O@a@nXw zkL~0@M%t7u`e;C|gK5ov#3HuqQ$h_54b4JD^|3gbJ2%57hPJb8&~(>N`=cGvouU?FZWWo0={?k^7GGWkl?Ac zF>lXdOw|Py($<{rk-@>qh!?&5t*CqLe)LW!S0_uOt*W{<2i;6{IOXZQ5_4OtbjkJd zE**oN@+RT_@NTe4Ix2m(<+yN!){UMr z9BlfHf>hdJvGv)nBR3>Ehc09ZRwWG^vSZYA#o-bjtn^NF-{(GBIn?f*EKMe!5_i-;K5Ea6^mc|Ms+e~ork=UP)^Jz5B4Ch|T4l-Sv@BGwvzx zui+;9L+ciA*LUYLRO!CrftgCi&<@b=i=)R7vuE3SkLS@#T@NeyyL+!%yTuwWM>s~$ zjao(CkCEwn+xwdvba_fl{0~5?*qZKjv9&AR8ce3LM&{UJ>M99@gHs{PM}E_LgT$ds zx=5p2*HTx9Lv6R~@-$YvY{A^>dG9Bi6cd(vqgedTesT`l8ZRUz6bs_&QQrD`0^}w5 zkjDXLqvkKSh`v*$%avZYdTg4}Xv8yttYlb|wz94Ydfzs?G!(p6$K38dNS$4uLpC6V z*$dlJd}yRXahFFeBhK<+-c9cI9R8znkceP(98ka6#rRBFi?m>5=(>-hynLGrj|q@N z)MOXHynjAL}vi74Ph+iCI3sFj+3hH#skB z2@wgsgB=PFCFr%-69!30yuM;mjW+0aN_AABS}1u|rbV;M)(u`6A&2)O67qBZeY2XA zLBQ*G_OO<3gAWHMDhA#o78jS|S(j?_BF~;9Z>L3fz@I5+WPHK#(n`OHylT<9uiAn= zyQ=-j_am~fy6W%)NH#tcUv>VYM z2wA^%;b3@$c^UV>%=eQJ)me3@r=!TF6V?Oj*r-?hBJ|~EW160#q+qVnD!I^|#-O8( zfcF9SZ`^oc#z;=3K^Awy?(~$_n`2OwIFh#P|9D1iaTrY8DNOmZZ@mytHSoX|nyipe zHbZ8^Iqw@ z2D4Xx5Cmdw+255DOv39UUa`Fd-_0Lt`8y-PSot~(ONpZrqD(@mTkVXkpUxgjL5*Ln zwmIkQ^Cf<&f2K!eVnpaZT6KfTdgnKF$$SvEI*7G1*@>|3U{$by`Nxp3D)!dS{w~s0 zsiyiu|BQe;sn-*Q*u)6md19UQXvKFdSf5ksNp`>{kjH~E;(_=f?tgZQ3;MK;x!aPv#w zW+5h~fdK`@hzJzLh)CcQU=LJ2&I%w|)Yp)D>vYdxpcIcjOnlDab;lAnD;=iT2F zQEhb;y|uF1%^|=%o`pWvBXJ}<7ZFfZef#dP+{*l56Tg$W70;c?=g}Z06iTqb_^mMQ z;dpaj5>-*okJ9>GdO?5?aVPgXuay&7Hi@E*lhL>Wlf4)Q_OnHrfZ%7&-sS1}C8e>4 zQhfi1Akga3zbxf6dlEp!P$-xCMAl1b#wz@x(k#*C^wh*| zNrMNQ_T$HU*X)5aAUrd8H_XoJ;1le~Kas>_D7+x=+*_OH%*ANi=Q#$FFy6i0yys8Z zuD&Y0%ayMHlfW5HC2@OR*rlBRh`P_na1k4hb|}d$B7=|9ES0WTcM7;+Buv_8@ zH}_|Es(f<8=;QZA13^g=Q5@ahiI0dxuyj>-%n?{+!3TYF5g z<0bzcjt>t2u8ocGIr=?`5FUTtsSgCUcV=jB_^ya~mvWB_k?kjSVaH95y~RK$2>E+Z`vw}QaAz6!JAcs!{b&p|v~^iY@}W8jUi+r5e%9{D9Yk%dl*?ALd_ z*c1?5h#~(F2P4h1o$8cyJ@?f(c;MfSyvY>t#p(WM1lffh4tE1V2vG?){0+xOnznxc z_KGZV3ol-Fo>-=sUYX_8Z{L-Wfz|L>?REY~S~d2e0s!0!1ONriFDNSV{Cpf-QOEqL z((C%j_uKjpBzTmI+kLo!-d-fq=hPcDX*R%V%@qiFygvKWIOq%1z1JkBU_Ojm43T{N z8Fibtfu$<(XAb+E1T4@_mMI_mRV9`w7-K(jW@USSx?F+aE+;eD=aN4edqe6$Uh8F# zN9vEW>#$3WJ6gXqu|NLVqA38Fl932{DQ@r@Et81H*j%QiuDw<_o!>?Ep@+o2th8fT zhCcGqiYz{~at#92KQYxe>kqU2D!Bt6hb0Cu((zQR*%Cf{5w9P*)D|?LL-Euw0!bUE z^|khhJQ-C|`S*iXKf6$^Kb!#h>;7n|1}C^pzr zbq&$5kQzIku^V~Zp~B_T>H+FVAHhY&Fe|vM50ode%>iw(QfNO%Pa-`(IL9TdioAn#>8fgqP;bxD(y~;S&ro5p zj!3AfPQ?FoF2gs!)d~|3Bjgx##Cx{4Wve?;xY(IiNc3J>Ht<(`@z$L6{K?xzG@ z&D5I>Lj}-p3|80@J<=Jcv=C^QJ6}bb6oY%buKhMsm?L#uYu%A;N9%B*698N)GiakU zhDXA>)4Gb)#SX`+W(%^KZ=_eJNYIa1nncUYtgm1LI^MYctsFBbgLD(l0&R5N+&YU- zl|*$bq1%29jfpdM4($HW<4T|B2-{2}(SkN1ii$uvBt8u%Qi?vQnqXiHglry1FKN@p7?2K@HYwe|+ zkC&p5mw-NYINenJosy7Xr`)h1>z5wD#o<^0=o5XkJkzS^vg@CCEt6XKaYLq2R2~EH z3QcqRJMsZ<^p0AoqrJ6`4LND)CJ^k(1=n3#)4Xt`FU@(eab1hWQTh z%*x99m`MH~vvO)y6Ilt7wJ*b=bP9V*4b18|JRMWy3s7}JHVMM1@*;&wCvsu|zbI!3 zNmOF~LfXx`9|Zh%YV{dqJt1$vh{VhqJG6tWp8(m;vznF-=xHyVrs&S5w$)^nh`qk> zf~IYNf=a(RYA2`m6DLhwy?I_=hv02;>b>Fw83#w4IYRt!Pgd%T5k&oy4V#36%q(1J z*5tlqD~1(0e*;sz(xEOJf;yz}BdMSd1w^pT{&3HP#Oz>}IilTP*yn)`vZX*N5eVNj z#jCaAa2a!kYpz7PEVgT1j%|G?a$Yo|ypts%t?Z9A3PD&*ZFEaGx&nko26-e>d^e}E zlk4Bh>m-KRZM6~sZ;6%{2hE;H<2oZ8?+!NC(qpVK#v{Z4JDYvwD2N0}HXYWK^OR{* z;SH$2=&VEapPvu)vFG4sd1@71p96OhPqd|O47>7ay}PB+)Y58KG{Nc-H7u9SS z;SO{(-ET1g+PSsDeT=txxPIve$lS5CVAzj{vs35mq64M-me?5(4j?g6&WulXI=T0-ntnuE@Lrjz(|>Kh z9Quv}f&bS>lwD?POB1zryISl*-}x;QQu+(2cs=!8MSsUmI1p_pPm$D7YS;yFor*rukr zncXPH#RYbj;~DxvBBdGWk44KXl^TNep7Tq=mo~`0FOsTCrponHN{sIT2L4wr7zMY@ zBFQOFmlKMU(!}X|N6YY<15rRqQaB8Q>xZ0Cp`QKb926jFp<#X>PvhG%LE9Bm7*oG# zIRL=ercBIudjm$(ZSrd>%--69`~@KBn-|i8J{XsrSF#!kYx^5{8$94_BMTeF2BgX2 zJDBy7jHNc_?Za(D^}-6j(fcoL0z+O5gy`Hf-hdM3Cu{)l@PJ%RS2rDYf3Iiq zb$}gwwJcsj%l_i9Y|eCN!=>I#k*Z4Xd^RA(U;;IAV05L6w~Qp33lT1Tb?>r@e9Ell zQqK#@LXRWq`~!%XrH%m74hVdZL>2Nqs;W7i&(1B7Liiqxcn9cZ^EGa)>d5MTsW6*< zXVuPZvWAxX=vwP36@}0eIt};5mhh8n@6AbJi^?n?Ooj!_%e|E%4&1-0#(g{syN1q} z&&ytlisYKQLA7>Hw|!8zRCjj38t+FAzRMW4`4RJ5o4n^lQ2oropihT}e|~QI|@m_wNjZ&fU340ky}^2jv_?2K5xymPLMl909(8E!9k~7<2+3^89=H zeCzPu1@}ku+`!W#E+6+Npla9m`bD;ksb8|wMThoZWj$9dg#C9>y=-x2>0*V14>5Mm z4|?SC7RiZ?*bdreLQeL6)kPT9*A~_P%~#W==o8 zR5IWy0nr-{rO}7uyCg8_HmDY7s^Cd%mZA7b;u9(AxQWm=7Lyo&#Uzp~8K-U8-Y<$; zy1R2Trt^DPF6NsSj)*O{`VtDRf%rRLy?$i#pY81D`Ti8vM>q}DGs-IO2B!48YVlXc zDN_H%#`CY(bLTgS`d(;;FsIjyNBHd>^!^=!-YmUIfRy60#r$Zsz)6G2wu!{~gW?Kp zF_@}N)(nH!`9WblVUg}zKUSdlxFOAOLccMlT8kXQ>ln=>5)n_O;txstzl>v0Y1ORq zVr!dDfa-_qiY)uqJvwQ~BN(^q!#ncQ{j8W(_3wy+dLBm~IW4D>)%*4~ELp8)Dp5zJ9L3+tzdN*`++hmsX-@w#54Q}SX<#qqjZ+Gvt`$%4gMTK*{+`exYwXd;=kgE?fGp_33(5q{?#yq{NG1wb%3Ui4?Gci-P+ zXSkcq@Rd#tx+^=sK8R&xd=i_Vlj5v*VtG6KmT&VDD#>k0 zVToMol%iKQssexoKMn$QTXh4Vx=@UGtD2J?(30NL5*gG`l>O~nOw5bp{yXqWz0>~F z;QTc`RM|t1CXOOCrq8)#W1$>m@!EU-Y?JxG4tjCnI?lm9KF&cZ-3iEJ#{hjREgXrx zIGioA{wZ>3Hg~LX5SNm2CHOQsx^4k1A97)a6;oT=js3%;t*y1agHNNAy`2p&6@NOU zMUz(NnyyihN&!?qgo3l#Mkm${*=DlQjB+k@%bcdhg+4;oJC)>?&TFy}`nQ@u<^UQ# z#GRa2T0rRkTe|>!F^f!&SaAz^VG!^E-7@dSZ@XcR`%b;Pxpo){sr7u6C9!q z<(8p*6Ol2q`P;u$(=1x_%m?(2|WueB;#TMUvPdz5LSFbe9{(S|R=7iApQQm9%N=o@GsGkbJ{}74O$cxA5V_-&!@6eQc^Sn z0$DToD0!U=01egG$22E*>Z$toTo+BAl70ws6n|sm#raHu@^A+K>EpdeYo;Z5^aTBl zv%4D?7Y`3RdrnNXh~LA>lZ3{^x_WoihTkBwBT{XxTbFW%TAl4IrgT)Ah>M)#DMsg(un3@+k5%)>;qtrmVp6g>&cSijf0$$g4CNcvx#--MAkH1Jyw%rm29s;olR(I zL}cVL6|IPm33VGjBk!h`*n3DOLbuZxz!o1250-z1yQ8A zPido;DwjI7#OXxzUIkFVWPbqC$#JDWLp5nVRiubnNoP3pYlM!AI;gA7@0Q|`c|!-+ z9K>L9S9Qpxnm3m!a>UjDfSDao8M-@8tIS=dKlpi3tM2NG%X+G=rfy3=H~>d)Y>}C; z2&bt2%E)*td>^mObPZ+=I7B-+dAUKWUZbNhX!LcT!GR7;V;5G%pyfq_r-T z5`7*hcuiiw$*}_Yq=;%{a50eoXt|e>@ZsV1JWe{s6;_C$p=l}Fvw5IXsaw8eR$Ies zNSvOwv%aTgH9l8My41E#TrD?g%{*VTd6?^9B$|1qm0+;6RFc3vIM8Ec;(G@sb~-i? zRZ$V0EEac=*DRUL@*V?{i~VA~YEQDx{M;qU2bJr#muj@QxOX=QTH3eQhBbI1r69*8 zCd<~eaAlkGLQZn)Ak2hzKz2d97Rp{8lqw-?jR}hW@%HYT82z>}e9PXKQ`bDt}kr za(vDw9qsW(^`yi!aLrZbCe~K(2j`e{NrWgvurw2#Xi+Xu@;5Sir$6H2;^MIQa2?=x zd}W9HhJJlyXo;NsDQLt{^)B>iYS<(rL%^4To^5nwCMlAI|JXmD^BSf^OKASypzv-W3-hW#(% z@!8IJ8gb&&;Y?Bi*AHx`*o#{998FTG+~C!|Jn3pk#QY9z^l+wdd~B>*nO*~gS$F)f z!OSu>X=lfsSfBvX%I9qKTypbDNFwm3PHl-+xfnfj+pn+l&x@hj27XYnXL1Qw*GqQx zvEd9}eB65`M#fydhO=*)fmTxD)|0Znalhxm2{ks*9cb~+ZaBsH(!|&pqy^{t0Dmw@ z&28b2a(gt*HfSO0pV5vlb)Xkbgi369#sa71kt6OVhVPu4dN$hri z=cbf70R~%7N^tfkJU*qXT9Gf`fKzps#>RSPc(<%Bw%ly0**V&L?-L$RDTAWGWMv2Y z7Pcm_H)qs}-|yo(K&+(F!g<+XcsW?4L&GvV2ZxDi#+aqww{KXU!oFwUA(Vc6%WeMK zIz6dR;IuUA>59pRJG+*X0o0{7zX*XY56!w}&$mn00<8q{w9pFl$b%cY}i*OiXgh9lq>$ zaUJE&)g2qz9RG~TX#KpTC)Y8aRD)B4kV7J(Ha+6#>Rbma7ey*6H*D*xn+jVh4$Ekz zV?P)qRr+3Qb7t`<@jj$xf2`KRL4q1MDJ(^f^ja_SIkRK*GEg)Z3eBv1O&gsC3cnk6;`s- zrO_!d3^wBF?rv^5kOaL624x-MtC?7PZ>G!jvfJVp7B4R@J?~#5Y}Y1><#RR{@ywdv z9qJyf`g-4bEj4(?JrNKPSligR+>PiD&e1qDr3-o`9bZO(H#VAJ_H4VOrO~8(9rN2Z zN<(qoo_tj_5E=_5l5P1Z5w8<6f7yWsU%KGyv&;M_AOWfTPItHiucyYv<(8ChuWixr z+Q?4npfuP{uBG@HUqMDN#RRkWO|0$hO)U~(DBV$KLITn+W&%majfvQg?U8ybWK8Jp z-o&{56Nj$+$ByL6aI)%zWJt0lxx8wy&149`x(SAHPC(M5u{V@8W7 zC3YOH3J!W+i`4LcxxcI35;H;2^o1~ZnlTv&-Qm?xDj8KWZ0OI0`X7un0Q{J?V^qBozHH{Dwv z*Qcv}hwus+^^KI!Sxk(-09*A3kh=Q1IbUj03Mw9V8ar|Fo5ol!Co#Sh5BsG;&2m4Z z$>N21wMhaly33QN#ik$L*PhY|c94a6^789vAr>hQNu`i{O#`{pKlj%@)U-tSziHI6 zN)^b<=llnTywSG%6Ip#ObvID&j^7je`UYM++&9)jnG1%$7qzjCDk#3fRKtLBsh?;u z2kgGpOlqNrjJ+wEl6qi&1F6s^cZYrd{E13S;eQVw^J9*FvY|IPx0+*n{`Al5&R1X5 zBK0_FV>Z@t+yAa70(x1|9qrlFJ~(XysQ|HW6wU$ZdU_ENkwKboAvCT&wa1>1latRP z8v6RV-p8%3-ZJv?O-{GYXQ>+l5ioGdz-_FAL`VdI-TCsNAqI$5zgV>ijX5?o#Nz2b z()yd2Cu{9;vtRsmJ7KcL-K9-b{p>U7TOR+o(HV{TRD(&P++kb(*f=Zi;=oyEPpr>W z8ouKb=tfKP}2F}YZ zkyp1F$>n$ruJLC2$gT; zzy@D&AM3vn^7UbZ_pe~+U&$9Tpg zqOD%_p7y}_?+86T+L$lY8-LfgDmYsW-`5x3VmfTX>F(wf$@JsfN5>4S)3@(1cnI+D zkO%i%&IfG9eqJjXr5jo)UKQB3&j$wPQWpGBW0+>yY^hWk9UL4Pp)1r`l0S^5q!elP z9~OvOu;`;@=8E5x?k6!Y2#{cG?Ee%gP2S=cKV4V}fk0e3!xUa%wP<1s`Kn@7^5pB| z+Cx!DGU5>mwzgKuXVgcVbc3ZB%7p07eVm9*>!VJ8+Lf4_nX?#HohYhdn5AFrOfN5v zmwceaotD+eigoOG2?wU@d-qOFm~^}Iu?gl7MzGz!*c|pMQc;07n=;c2mGJ!X^z4$0 zi^D=>N;@U}Iqc0M5)-u4Q<_B`qHsQCmvnK)!03G*jMHkc-j#;XC6!hPX6YBpYxT(nQ_I&~>(aF^u zNM};Cv&C|QDRpfBPs;iiX8&vkE0oDkXB|TB~6xQDT^x< zrC$BlKICKVxHJUp}wXNssx8(}~3pzNBP+c+$@co^QvPkX7mod48u z<99vkJ7e5ghlT{V`t_Czlu0l9y$}=AV3#FL42utrAcAVv9qdnsDtM*oRFr6-LhczC zbJj9W+d{K{B%k#SK6>5!65h+2B>iApFM%LESY;L&5$XE~e}|4QJ|Br4N36>;9+sMt z97S-=L48(gXUpp_XK7_M%G~VUf++DZaw_36-A~FvQ%czoOX@(;YI+lhvLRQS%6>`U7fs~{l-=v45Gsm1b3PC>#$B&GC8%;^7w)Sgr zUbm!lYMV8)AyC+VXsPw~gZ{;$ppd7(xV>&_{C~87eB{(===$L~3*-K;j72*E*DTkM z^JwW`?#m4-OZ7vB6ufvG^lWBIwPzowe%CT4zLHkyP`H&8@~Qz?M1tMioPb7F4HnG* zBCZ>EC~ZqH;BxcaLaSy80?F%0WfOGZ+wF@BBw$OwvTtiUyF))d1ExPNb z?B?hBcv0}~p3Q!ErNK}#43+{!RCkUNjAO!V(E9`p^|~F2*AESQpm)ILhT7-Sow*WN zYKU}dMHGQq-$GAx7Jy9gSOXClkp50auj(HB@2?Mc?XAB3EgsuZH*CktEfO!Xfko$F zv~tNP!pVb0cz%)Dh7&STB!Aln@M3^T3x!7sd)!eO!gqgXpIdI0wV%p~ZwLxXsJoh< zs7WeNO&rR^)ZF&|22cXeFV7kN@nj6Yn%&kLN1Qf<)x~(q^%ead8~-mv*Pg^vd3Nu zd8-GzHTbT7bXHS~OsQptLOm1P`=&llDCf;Bx@IIyj^#wnSg}FYHxW89dLRNfOOXe7h(u+tGJC*DCo2JAI@#C+Jii_2+NtT3LHC#m-QcG`8 z9_bh6y0*F|8Sg!gO{f(X5hDpWtzyq;JXc9w@W9S}H9U{-B{lmKw~tL8E*4KuT(luY zAN0DBzwhI{Vd(uk_3zbV&1vPz!;X$zmG7<&=Yy&(w2>r&P$ng;)uca5z6w-R>b-)* zg)=_3e7PzOlMbYQRc5Nv2;TThD0axnn7DP!Y6TfU_G8TmZX#ZIE!7#2L4{VlAYB;wf9f1(-W|>3qVp$FuTXQOUA%43GAz_ zOb&ljl?6xQz_I*1;z~F;>Q^s+uU!D};|7;?D2+EGIi@{qGU0L`AZqrYZ1LN(1g19p z{Ryx}pG}+3s@~DG9%4T76%7`(UU!x&J>TD%LCPMB|GOgxxC+_LER#t7ZGZmyKSyJL znfQM_3G#nCQWS42R}l8pEyr(|R@267;>*^_ejY zh;zWco!$@VUCt=${Hp+pGEpPFNyW23tsWZbAdHC^{a9#yLN6rEjL1g*&uf0^ zz4^zf`HKkf#DsKo29b#0-f3Kc0=p~p^b)`r&ex9R8#_B$+1c&-RI?}qGa<3lQP>BO zD5!>1R2`kIGxeU{k{y(%Z7DbVNm0b}B*M-Q+lG){-}a5xC~9d($M{Y8?QsIOpV)Qe zqDU~aaR!IuW`<>$!}9t4fQVFNS4(6Vxj8cX@aAI(`tB}1a9Dz#-U<*ym;6^wsx6#Q z;J`9P=x9VrVeex@0M~BjI>Q>eQV+3;%e|!7*yC2M*^-=9-kSwy)2VozV~QS zf)ROYywhPUBqZ?i-XEA8(6ZM)2hNITIcZcpeeDs1;hQ`EHl1tfyL=)jYVYnhOCZ6Bh~(sxbqY~Pn;on^6c>Nye?(V4=8ZFA(XJ=>AGCYo#3Wm1^1xlgJ-QS~sI;vr*aof)&+}CRM zLzqND2l6aTOco%D@_Y4Ok5e;FalG%Rr|gorVAkbi`JlnL z*3j(z{B##Nf02FUuT@6Ko8>XhVvL2uk|NS%_vso8)n03K% zq!AB_Tx@bPfm6AQzrzq$Vb_4`*_EL;Mj#LqdvU=-L!))lFj8&7T4%ZRNf`vwsr@x> z!E%CHTU`y+80Dg+-M-j8Fa10|I%+izk%|}f7ZBKY-ogp~h^U=>JjTIZX3*4NdFq^f z+MrU$JthB~vAwhNGbMqW-zO)scC$2Doi|WWXp!RRS>%JT<4VtW*|zEjGVjiF8Rrol(!<3iXEQevNI=oE=i#lM#rSfOTxdtI` zceImhE_Ut+ud|D@_Xf-z|2njX>XD+FeKPv zxo+rB%UYSxYlvd%;C;zB?R6rfg%~lhz@^s(Z_0d|)p)S~Kt@7ps&0w>dFeo@_z^<; z=4up^*#(aMP>iEi>;-W z*MvNWGT!$I4xdp`BmI26M-1E@T`N9tge%Kr`L>vD3lkXbbQHmbTm|@lEl-D{9>!dg zF40och(!1_o6XxFAxOtw#vl6tr`@7R7jvP|TA$98w!|`whlYH!TT^NGQ3YJ48}C8> z-MZqwj3ghOI!kf?+{~^KTE5M}!WfB~n!ey#bp1LXt~k<$VY8>-`L#BaBcqd6qdBJ! z2>xu^vaLecPQMOjTSg~4J-3e@1C+1-M#Ro4go#mzK2PH@2a=34&Ux&{yLk7=o1;9U zu?*Y*s@WTHi$U^9sZV0NKbt&GZCzfxdnewDalP!u!AoZ}UFKWbQBl_yu8}E;RI~_2 zM&cs|wjcyZ(Ay*&VWN{rw)*Oh+1%{TkaPN6I4%j(K)NoRoQqYO+6E_27iBXxER?aNcC%ihwK;3tlwNdp>(Fz zG#aQhs9Ci?;4hpx4xRUU94+L2{qSoz#6w~4Pbi|c0T#gk;X7yNPdPc6PB~&)KQwU~ z1&Q?eLn4t#yPz3i3A7I6@ID}DY#9lJZS{}$)y}|tw-Ts(s4ImgADSzHK+_!9+$;!D zz7N7kSrEq7*WVd$)~1}xQqRDL&V{KM;Y7E5j>onQkuQ`fS_`R8P~TXZoMHS;{5Ps$&@A;Upui} zFSo|KUrTWl?;V2)OO1BfaL&rkty-Hn{r`^ zdR15rRdSOpV_A8LfXC2=;h$bWC*l*eIF zzsX+x^Jg#=>Ncn|8G^biO&=_>rLezbYP5u*q58*5BIF`BYG!8pEe?zKyVIY2 z0d$3UJm!+OXPY!ic$nu*T8`D@Is<8JyGQA-ZKmvV9^MbJ(13mAZ4_rKwX_lzI9(lU zi{ckCcah&6&n9+;0n0FF0{d1yvLZWdWYbn^zDnmor z%mkxJglfD!=rdf-iw-(N5z7tQq-Ix@GbCwS<%(6>6I6z-LrD8etS%E-b&Wn-o@^;1 zW7mu!Dk%6IuI(+*)JR$Go2LuZ`oDj61~S^hDSdCf`KBRwAsbp_JG(dUan#w_srxAj z*rafKf19M6BwOE#EGCvV@gFT9<#-C(L`Rl)xSZv8s4gPBF8a-~M9b5GDO1oh!J}GU z#!OkkpvI#QOn(m0aUpMX=Q|={=Kyi8KAS=UtY4lM$P|pHy7W!07_Lae#PR7oWhk)t4dT`C(-hK97e7wk^#IZT`~Om z=H_Io$-Xy}<+j&j<*W%>d5rH8@pu|LdB4tU$QSKE-J%3(VhXa0B$yO%T2mm$m37vc z)5-NC5GQ6epmIGLJ2t(NR(kH}$eV{99WJ(nV(^%DM;uHvz;0@9p4ar-Za3wXfZelP zHd^zQrmO`PS#1tW0JP$B6g}<}Hoy{hTxzSW_)u_Q02KTmmB>Nb6K6j&Kcbr5*0Nmg za3sYQNz%jXEbr{#Dg9(37ZGtt$UNro>6jVLe6rj5At$i=$J0LvH=bHeBO&d9rqmQD z?x83tE2V$J$4_qYcEcCU8jhi)tq-J8z>`Q#LAK*}JM339R>$G>{XT`vXzh#5x%~Ql zOd1hCf8OoO-@&N+&Q-l%))j8m?l7yZ#t|%evyJmrIFuBM z5%XVd*c5=a8h#|6oGq*2#y!9=%_x@-i+1`UbnI!J7$iB)dX!efZySEDQj}Kh{xk`Z zGt278-nY81$nYP~mqdyI&UqxKBu^9(kHH+GFKrUjg&X`upADK1F>z2!&Ng|8@t=j3 zx@bAt+C2T-c$;~L!^h%z$i-BZi?P1BY_mEiERR+OjJ&rbrd1~3@w)i1_o>xnus*YZ zu3PidL)bX~)9E%wYX&${&YyW;kd74W@Q!#u<6ZZ3T$MQeK6n#`(uLe26Z;nVqTuYs z-ls}uVjhBxtR9O;h~32Mu4*qdmT?(9s0<-H_3`okeHuMb#A;tjC6zl|^gg*g|H433 zn(~}PSENq+{YkCiF5YHZTdbqJs&F&=fXV~b9AsE&!nI6^h_xXTFP2+YCg$(bw&gc? z%iyOVApy@In;VtiujM4cT4vS{0`}Pisjb#pKg~NwH#BJfL3BGqe5?*mjlxpixnpo` zZ8{H+7q@<;tCO&OxXjWvwJG3n{MPrUK{j~3p||2=P-aoh#+Ucz3~6Ze>~!ScV}IC# z2zl%ZqLYiPE(tW#(-~eN-g$a9ss~@37{jM<7A@D#!{Hk&C(h1aC@6)rwq}gHzi@Ti zId1ZJP^NLzQEc|vC19j>b#nz!wMw}?vx|#5B_-t{={PbPT3xdtUp&;>I^lLZQ>tC; z8+a#;-wtORQGHLQc8!Rhz9>Kwfr^^?@fy>+HIL71_$^dt#jiu6ugT5XmF|H;c4(~Ixv;=k^}yKM*)KlS>U~W~z*9C%<#KIckR^|s zImwt$)kR>j7RZPO1Z27kQ!J;x~r?IDjHP^+Fq59;xoFpb+9+WUvQc=S=6a#+v zSYff}-~Ba+@7Yv?-r>85Lt0we@3Tx6NRETOokJCK?1rt~nMoiZOux00VB$WyZOffK zYr{!RpsBiBE}6DRC7DQkNsE3R7EL1k8Z`J8&wg8E%Xhu&u+C2B)vFulu8Zqo0du;q z8;=dPf6bAWPNeO}u^_%Is-)mENacQg^a$Ws0^TfKW)TZ)6Vps}u*_q0I`5$G4{-hV z|Kjc~!>at+eNhxd1SOOZ5JBk>q#G2ZyPGLp(%ncZNOyNhOu9qq?(XjHW)IN+TJPHD zUDsaMx%T;T<|mv^nDd$A8Dre{uLh}`qRaG8O%i>bV^c1Dctei2} zAQNsr0k3vv^0ac~#jtKm-4FXrTak^);lx~H&G-6fGu{h3X-ZeBHhNoUElyR6)cBx& z|7LfzrSz&hi?5j9D_2P@*>YY!B_ceyU7HvTL(1P_aQW6@{%07<{tN>i7zW0*9Y(_= z8pqQw1EYgT*-G&k8XwLstPe(^kj^l2Eq$`91*0#TO>i+CS&(|BbfV|##9U5i-@@&5 zN;`UDFWJ?+AaxG4dc9vODptQkL!U1|q(xUVxd}*qLk*- z-7=azxEjM~EchTD#w<%EyYu`^Q8Feu-LFONbH;!DN^68v%YOqqMCn0F}qE8Y%irxr|K!k zgeU!+fFR6Wr#K;B3sK*6buu%MH9DIWI~zhLZ80EI1ZmctsSd(W+H<5M_@0)w^vx$Q zNA6ikVNu#ApyV*@$eZ&E{)IiX%@eQa7W*~mO{Rwww6|@*-h?V;R_noiY{RkYE5tlk#?& z^5g{s6Y@`JRMJj753h$uMvBVHL`6jxa5r}LO~1=r`Pq^9PnPeFWUCbmyX}s=tFGbT zTzgt;M!QS<6ZDa!fvKFeQ@lLxtX`pE#$A)|!=@Bi-@Mt?dHq60OBmJi`HLDj5iTV3 z7cV-qZNFN08IB@nKVO4n%0Cn7Jh0RiHy%oRx60X7v1%Xd_gsD0h$$q^WU1mRWUNSs z5f2ZK$myZvnH4(6EU3=Z>YQrj^EQlmRU|)*l?cI36qHz&n@l#N^H)lA>2~8{u^>;& zPm~(hex9EdmG_PH^YXHnl$`OH4SOc+)=oSPUdy_;@rHTok&T>_NlLrN2S z;Ne57r*`7JohIdmn96+ZI^#d@UFtiCTeSE3ARv$_9A0y|9BqlEWH7f9fd$(qr?N+( znx~9P8mkoM=^0sj@znl?BjMqXM~Avh#uJieaZ^zHOA)bJyL?v774;~LNZ;t}?AgHX zqr$5p#p5fI2D?~xN_ReA*Wh34SqkM5bA46Th8AoI&0Kl|73PG{kv>qD4d*B%qd$N2 zbxIfBbfx?=nrt&S!LLBJ9nQ1lY^zGB#g%KIsrl>ZMVVCZEv%*7T-(Peuj4s%T6T+X z(xCh;-cx6+Y!uL}Pa-)~tIP8b`C2&^txAFj=BZ8Cd=qzj)a+4G2kMfvRrU3eHtOuw zg$G=RecMDCB}6;C=4<$?4Ts@P6E}FcS9>5SXfe!2ZQAL5l|P>0_bAQ6-qsGjfyFM% zbV7+*y2>Oo_VmKuIY)69=1~Xsh_~#Ih={huRJ{S%JNSkG{$WE(((00u{S8{q$Tc>4 znsCzW()Yy*W9mbLp#tj6vWr%!{#^Y$<=S8#F5t_lbFMl(DK9Ge5(jxUz5gQ9es(Nh zt=c;we`m7f2y`(818y=>6l!Laj*bT>na*fj4q1JPW(jAKTK2b60|f%mj{p!Qdm6>4 zWsxJ_ea0`|?yB&6Oz=!3%9liUhc36G3;t;H_h=@-=i;6h^9qQgFTb6xyqvRlDU@Cn z-#!;-wzMoRGd`pUazaHTH}*bVrnDDee`kMcVs9)8JO{VBPoZkPIkhd^zgl~_p~&#! zYi-1*a&^|5JAPM5?qXYj}el@ zx=n2(jf;3)ZS^EHxi2IKVa0Lhs`>0Ja${q|1O5oHqjzJXE>#j*Zl1OBeY{T1NSye? zV-!Cp*uzgQct4gqBU9hnlDv4--Q3i4wz|)4E9NMt9bR|+c;EE;!Rx58R?)-_x8@(Y80;JQMQ85 zH(la*lTtf$&KtvdmDZgUc*gNjQDYA?gAx+@Gj|IB8VfvBS4`UqF$lYTOKCMViZLYb zxHBm>c&hBTpBnpH8$}4y6-8BIxik}hvL%;5In{CPO>OixF%5%TpM|atk#iSc_4$>n z`@B_5i;H{J!>f66Ql`QL&6Uf6$8a80T}zv+vd6%i1jdtCc3axe=kX*okYzcHU)fCF zGWk8`ha>S4(gK+Jz0g}T-&^dODxyN z1}`f2bBl>Y{pl*!@B}F{J0V3_qo<@9a4|~)GQoiWj=dzG{nixU7|*y$&Ac9wX_2xccN~e1 zt_c3wmWai%+&@?Vr%e~ah1n%(jT7USGsT%$YT~G$a?dpF$2TJVKL1{#%LY*ht6gdg z`=fgn%Ty#+I9y-7EH5%M(x2hsaM=&^iax|I=03q^u-JDWXEcPnz39~MNS`b)$JOgA zT+F;U-4*&xpDw@NxNbl9EBHyMi=Hp3?v90$xlqmRp2ot`>}qc;_Q9g1GrIT>Z1(Tv z68%)q)9vK*Ci*fZn1x}lYqhC&395nzm27D0)jk?b*E-(LQiv9FgO>Yt#iQQo#^UsM zqoEwE(hOqVN)C(~T8`7nlo#Mv{BhYE20O14mys&3v-?~YTa2v@eFRzXoMCHMx^a-Y zzhsnjRwR-ho_u$~q1RY2Mdyu)!jUP;{8gansdGp8KAn`Qd;B!-CZn5uO*@%Pr+tBS>gF*D9=p|Cz*mGY z_g4(sR)Xr29sxEWQcQk%czAgIsHejzG9lRd@?_dSwu~5aheY;eX9P6k$mH6g^cvO) z(1V1pKh4xQ+n(;gIz2m+6pzY|Zubeq?@go;gEGpv(@^i6X9as~8yf>HsCun%jrrn< zx7Z{xR4jHm^YSsuvs=rZT`T7F0woEFKqj2d-tx_fyxYFt&dyFX-Cbfx=Qkc+UX?a3 z;or;cUkju2UQI0*ErcYMDAYe7tg_zzPiTL0WLl?l)XXT4Y=KX?MEg9C{nQ(IM^8gT z_sf^A14;>DVR7|>&)Hx42`cRmnKHR}5pT~ZSSl?qUy~9n<%xTXpykvUUz+%Guv;7M zZY*dk)v0bBp3&>|K-KEUCp&o$zF)EKLNjU2OFHA?DaOXfSAYjoPaEV2@h>NWy6w5> z3z=*r3?C3KF*G?Din#XU=`&E}^FBf_H>XKS(GpMO>Q%_%iDuNmb2#1}jAqjRN9d#*2y_j(>{c9I*MFqmPplJQ+7x7*O}bh(UfpJM^PN#2iBP71=>h z;fcD&x1Ty;%mhmou_Zkz`9UcgYn8mAfhM2%(w7Mx;rRj%*4b^ofZZ{Dp0I^h(ygGN zul+@9dVRP4$lD)uXG-m5`tw^3)<$ae=GBnf`KL)k6SYRXdukV2g|v%G(Xn|=>2)$%6tv3TDoH1Y(w@WRCo|7Q_Av9L#y_^4u={}|0~s_vzE_^P*>< z`!ZB8^DP-R>+;G=B;_@hHhA~f$iN|n_#ioDO_BY{_APnkT7vl_N%?2E32W!fJ}fQ64Tzn@@Byd?@hbFcU}-9OI~!wMt#HH_w#3?W?>LpZhm zJ_`??<-z8qkCa0C`K2avb?YuE4m^b6;XL^SCMVi2dp#Ve!~eL2K0I*~;9s8mokbFj zLVbJ5r^eel!q?m1SS80zSg-7)Wr!2ajuL(S*@_;xlE6c9N|J}nbk?GHF;%*E*BNz& z<9rSN_dI_cqra2kouv+3@PfCSb`ggagJdw6n2?&vYp6W2w)g#xwN7ATV>6y8$$GwKs;8&cGu6=7MnHL} z=D^=FY{ZQ9PCX$${+;f*voodb=ET>LiC>b5Bc~^Mjv|pz%&M#VtGd%ArR;I8T26!$ zK2cezb#+K2XQ!bFTpx5Xw?20r#Q94nrEasIbj2}3)}TN#5p! zVgMdbqX5b(-eA*E6qmR-253XES@gA?u0)bwGudkTa8;gBR#lLj7i|SDP>gcdIFM7o94R1P=maAU8ezNWO{X0}m zHGa~w48eFh*D~{jW&vU{Q{%C#a8Xrdxhm><#9}zyaUA%XPf0~ZidGHq@6^-*=r`}w zi`?0D^OPA|0&)59(9i-gZ%Y^YQ%PG|_`g1=o1bq4TQ$)<&j?h(XygYuTNPW09U;Ge zZ-+xG-qCXBXrn*?u#Rtn_&D@7XS>_qgN=Fof~94~Dq|ChVsR`czueH=U!*N3vRPks ztJsd_PoiUE>lhiS70VxM@Lt$ERNm6+DWATEy`PI8zI(b!A_@tN4ElW4*J|*QVTk%q zw7wU7kU>&H!eUz}wa4QlR*NM#Thzyo#6h2q%b?A$Y9xC!2;b9AliKB9+T-=pq6 z$g9K6h8iGNRI_VcCOgFlYzj5&NHwviYvxD6sie`0hK7crr2e>^4lk|2KBha>D|43e zk+vtkJ}M~av>+>0>(TFI&=#l^m|;UCC=7l$okg+5Fqr(hzx#!W!cg6(>>M3`=B(<_ zs#ZCvncZ30n`Nn~#YaZuojjzarM0vc&m2gIuP-;^Jv=x`YjT%Xgk1q;xgqPvf5ZB~GBC1hwA zGj|YriH4HB*Vo?v_0M+$?(B~yQ`3|dY~qPiG`b9wlp=LpAP5&uKt#;3bG_g_^Rg8S zJL|ygQ8_k*%N6a_?eV5I$&VQ28Hg)4e$OaCV12*C$H(I-+!ROo67%{0$~*B^=)j$) z`9?yT*#}`~R{>1FEc0FFHw-cAL!Ka9dYKnO{Dap}3i15jhKC%~jN*ckqcL7=y9!_X z>-?exRi}`gVV!-C;Gb^c9UqN@n;Nc_JV(xEW@^?TE)uG~J8nrpy<@+yndW(>usc(q znOtp?50&kg8+z-z-mCQG?w#D8BRqK1CN_0w7lA)52OVGY8+$3iL<3o2MArDC`6)Pd z?&wkCr{y^gx|p~SI;*p>a7xVaF~xUr+>}mRO-NYOhyLr^%O8n7hiJc?fmo>pqByR? z5(?6idNCIzvhWuvcEHgLHZYPfHMglx0?mDpcX>snJU?k4ed~pecnKrmGXJDuDN!~H zI!h!as@WRWYdc)spO{caTIv2WQSxRM!NkNqutwTG=`(|3o^sIFy1FcKki&a%eJV(S z^-k{?=Qq`^l6(p8eXuhz5D^B&0?41`*f0Q(K17p<#I$^OO2qEmcezw-R!T-D)HWzG zQlLAg0T`(k;|!^G>j8%Nx)z>~pNm{Y-g4weJ6KT`@#yL4{cfb^6vih*%j@$4OwQJl zMROlqJM0~U#G33pG4c6=e< z(=zpr*4eju;xB>0s$T4}RHoHt>f`ASSCUs|z@tMwX;)>Wi=iA9%gqQmwh1;`+QO6! zA+(H4pUa~9Rkgq`#krvmTi}7 zpS$E37`K6pp?co44L=fCG+DhxMa3vv{aJ6eo`mYVFaU5H(WT!6_eUmn$PNU%hT3*~ zWkQx=ql|b5(lF=4DM#@?ecISumoqDYKA#&+)zc%?YAh)?jeMul{m*Z6eXa;fSD0NQ zgw@bre4nnh`dOjYVfc;5<-xJ*HJibNsjE|0%kTSF6J$%{qs};kO-x$`@yO;^EjE(K(oh4Z?=^WyZ=x&y$9nm&NOxt^U{*7hr%y(1 z-~XKnge?(>nc6E>>we!+rq(*{kV<9i*A;lO2O+t`VAaZ6RPUDu6M`}3pJs$W8K`)N$4-A^$drJYH1`o#Te2B_g5~dTd4e01 zZPQhLSy{U&OZzOE>2Ix%nmqK_lNvtp1%_nexq zY5()z_^8TjOLV9YaR202G=1oFzJDnU1>%D@_dmJ$@_e}8KVXtl?jl3(9$92?p7%fe zk6-rlDeRM|Dh24tB)JqXjpyT9$NixD+5skv0z~b9GmbaW^qyeeYW(wOg>m6LAIZp! z7UWI{cOi@nPtY+k{%zEL0#`$nwcukhXBk?;Fh&YJj4AI2ZXGHmW;RXNly}V*vHAx$ zns*e=Q`4&0=!xy2t%K@gm0Izhi=9TT;U!w7V<>`K2vQ^xI07OST9+624w!>04`KLz zv3ou$&K{QvF;|C7H_Ez&hcAEElFnVv+>(%U-=x)fbGU(mJK;L#HZ#;uQDO<&f`_ha zTU#uKOP@(w5&2vALG%canwbvLOH0e(b2?aDon^NIAfUZ3Z*+9DwX<`&u{I<%)x+D{ z`-|fzhy>LBumu$30F46S_ar1O`N-hKgeOxbGGIj9 zd5KxY5bfJTMxzm$H5Z^-!2Ioa*0!JM8r=exNI39~_0g3vKvm5)#v7o)8FfNEmsaqS z`mh(L0O~CVAqC}u+0jp&RaIZ*JW?>2>vs}!`e}v(2&@nU+cMcj* zH{)p&L!2v>b;lirx`d4wwvHDKg>X?5QXy}(zn8VNyDCGO79%SoA}Z=|MZ`vTuQ zM1STC*vmv6AazS|?5?0$ss@4P282Y!wdPh92z!U?W6AHDJ%JABd!WQvsUtTm+4GP@ z61v3V1I`!CQC!Z*&M(_yBO`s{{g3Yuy<03)Umv_T7+)hE95?LK9Kz6JI6q7t@jq;XYg%JmIZgoLl^=qvN!0hW$L!S6NE-ji+5)s zkZGgYEc{u5Y6s5Od3ddJ-2aE3oI0vY8O*TSs?z+~ifQQWo-l@*mxm_deFE5Xm z)|V+qK_3_w8cKLCOP;Q>**o5+dp{KD>s#r(IWw@FbKVjOd~Gi=*v;6ar3V$slk*cI zp<(gY-!TG~sx$ZwTZ(nX=dBzas`#dEUEOzoeI}ifhb0!F}`mb*^U-2D`nZm)v=gWa5vLkdo8W31VI^x#}zF6sriR0+~c$_#RbL1 z=`VuB%Lg-i>C

fGWK;U~6Q6qS|VF1E`&l@aC8HYjrxplxnn_JLEQ(OFa)JRAD3m zua7Pyrq)>Hzz)3hy(TI3P-+vbrwGP8Y#hqW3GGJ#5z-s~tuPqzI=Q~SH>BD1CC*E; z`hiS?P;ci;6vs<>!ER1#!_hc)y_m89rq!H8Q=JQ0r2GR=-vT>DyH2n#zv`D)nS}p{ zlZ#8J@Yi-l@XDJraERZ`s>y7zD<5c$b#`i9lt9Q{EuUnsZSW)lq5!aNdMml-HH4i7 z>i=kdv6~xf-#P;ijzZpZrTHLPzb3xmL-%ufAd6y!45N>*8KK3I5YLN-*|fGVM?tr? zEA{)oSkf0)RABLXd)GUKlevIY83G*@C{W@Jpqwd_?;(x2hC0HVU<*YVcX_>+8@T$~s z`9dHtB{wgRjHcKq@;w%o00nFshxqUPOmRHd!;$IIO(s5m{_zRr(Ofy_u^^WO^&Qu) z=#kpiUkx-%NADMcBg+KgIE66*_|dz%2=e1OYMT|9eP>H@Uu zM=lTmX?qc#=d)U!u{bv=yi}~YABO)iJjA))npVA5M6nMpE759*b9e0!BtBV!o67EErIqZew`a$W?t#37kt$mn= z<%17GZf=r9u`xW<>h`^UH>CRm;;ViA59>F+xdj<@j>M~!-Sn;ABQ&v7A!%gL3q<7%ismAnQ_(t^9W)`HIdEHyBOi^}5X&@H*dH_7T8ZTy% zXE~T=Y_3iv=Jsy&M9J)LUPlxAJ&upep+1ST-2()0qW&x~~J*D|DUp(`Jp-Rx)02Pu-sbLEi>c!=yBo}%o z%6G7mXtotpfQpKls1Pj!KFPROc*P5Xf543kQ=1*k>2$$dhuBUzQ(_$Y*FAa#cL zBZq;Nepznr^4&vSY2w>KbChlYk2e($$mfAf(woL^d#JOdG-R<^Sh2JFsct>q5>KYPS69>QMNa7=fG z7r*5C@*$MuxY`C+QuTP&YCYm~1LXS@^#mZhxYX4;*yKy!NpEbyN;_%0rQt;gR^%V- z$_-j$fP#}D?oIC;eMHJr9raxA5As)YO$?!7KJ}%#HLJ2akC{8#oetEWisGIWDdW?$ zC-1RJ&P*m!_Oc1^b9`gf_ouYPV#`7h4_#n;p)+RwN*eDlu6&viB!?aLrpzUMKs?SA zk8M^7AbR8VI%uHB-D6OAX<1}caXu^suh6mgcfK0i%e75r(+RWQ8P{2iw7G(h9yM3- zz>;-X`XT3AXKGh05{xep3(n^nAsD#4-=}bOU|yf#s&jk4TmA;m6W-Grb9S_tI?3>6 zZM&X(nl+RhNl&je{FW-?Et(XeSk^=qu;l;lT+P}zv*aO zmER_te2anAF~VuLN0u2I;nZRp3XE4kG~tTFs3_a~n$N?+6;KhviM&36c`DUmm#W_o}-RO3(86 z2MdUZI#Vvl1lcgb5%OP-7cjv*Zn~St0Ya`_mK4|fr-$=SYE@S0Py3TnPy|V?9ismc zp!TSK_LA|n`6Mbz72a?zdtx|}OUq2~WhCu^*SDeHqk_5a)PY6D)G%aEP*D*z=H`fB zt~hs|Uu|&Q`cZ?~E4Rg^(6p|YrGCQrH4yk{#rZ1xp8 zy4hMEEy;`X9USb86E&;lUpfp7QDHd*Tp0bOt(0}XDJ$`ny?gI;d65w#Lb)Z8oJnTE?7N$|VF$xunc6$PSj?d-P zgqR6tYyenAr9UVV_w`OpfHR49?LC1MZ*bNJEzoYVQ)5j zC)#rfa)7uq>s>C-ilX)M@GpL5k29|wYA?cNOw`nJkl}`~c|XG^R9yTvN2o_v{1#8t!E4|5T>4tu3XV z-`m^WYr&JqpSkO~2ql6J;DF{D^byx8_{+?NW z7{fGsEVb8&|7@lB$@(wZ1Q0z|tY@WwTC*&hgV|&sz()#SDBE-lBATW*>yvk?`>1DdY}PlIT~d5yi!nY~fl#&~48O)Ot|Y zU(w~z11QpfEqi;`R#9DqEaA_E!+Bm&c_@c7QnVrpOm?+2K+$B3qoeKlsI6?Xx3=3S zAqoP_PDhd?3a}T)bDM*}v!N1O({v5+XkVRRZ5iS|(}O1Ssf^ll21CWs_Uwn&909(% z#2&zS0PtYe>2i~4jiL~Z(X^%d5WO$jWRcnCm@|Wec?+)l?;dXlN4&$KZ?3TAc9+4r z!%fK{slWEq)u1ZnJ9T!!AMoz92sv^Qwy4X=pvsm8OF!ma8)1v786cPZ_hukH8&aHc zm0cN69ZhO$Bh~3N?1`bRl*`c-eR%(^_)U}=t*vj=iHX!Z9DC16>P(}lULwCruD4+t z`TbjtMPvRPDUw{0YU#PK;6GEsg^7`!&b}aT+AF)v(H7t7;wYL8sNlx4wb+e}ME(T| zuYoe4Kc8mjtNW@Q^uHx4- z8p;OBKx^~z!~_LP6I*W?tT$+=>V-V4H_P5PC%szucB!yNZzafWB2iUpI$31{;1LE{ zh(zE80C6ubFP~yh+3x0x0h!v6UNg7RqeQej@tm09bWHlA9tCf;(6})v`C6pIZu znyw*mPEflLX?G%Xs`z$Hn6ib9&DMD8;XwULJgZ|cdDl{QvA&eS{>jb^gZ^iH;C}V? zwjXAFiH$p;+4u8~Lb$50!cS9!0?ocX&`X{V|29=D{$YbJ7I%V$r{#Lf2u$oEUXV0R zDY(q|(iFJ)TQY{7GGoJV#GyuMZ-#rbG zrl~|k+f?$K^ZJwFAjJh_3J_l);DtpWn_OSKqg2S#^CD=>XSKPKy}jYQvjyoVqhzjrg%uzXy-@Sc zzN20SSMb6_)0R3x0bX&9@|w+NZO@znP16_cnnAarX_n-Mtp!luD?PYANFf@v0HA-b zwNhiQC13|Q-(sgX<=o+kU#2SZKwZc~ElnG;XppjYw;J$Wf11D}jr5yr-3q*Z?5|q$ z*~TB|cl`}r3}QCZmnjn6yUs5?#tR%9TKe-N6_k^6-gK6HGvLe|PeLXlD>Dt-j9u`BQm5o|ALU)2GL&DViqJRn=e4aZIe~`053VDqRjwfHRKw zK$*j`q`17ei~^dUFaF&lx65`NTM1Of(-j7|nHLo)N6UwifW2VOf@EqEM+%3l9$Q&w zzkknlGu-JJX}iNYR(%@Omob)wF2!C?-2uFZLUdRLw$GMRZMR2U*XHWDxMp-$GMu1w zZ3U^3P{l(aWy)7$52Jyoi^$Nkt&GnTl7i@2rCJBM3_()ygi8BO@iPhD+FH(R^q#i9 z0?}x?60gMt^-p}Qaa_(^jEs5jH%pB#cgDsl#N#Kbt5}pGXs|9hZn~lmjYdsRP7Z=P z-(u9hWf5CqN7`@wNj9*`NSe1stc3~El`ytA5b zZj#?^n{EN1;yTMU&6@Y!_veXH^6AGvZ8yNnBX?x1EWiB_dxIpWHNvVjN>G;|VcQ)r z!=!eFGF^4EGDQ*xU7Zw&%onF#VSZArZlT>_1hg^78zWVKf%l?(DjfA+)K$C0m@qJv zshZm$BqM>{)!^(K$hLqX^0q~|l^E?9ALDBi>4nnlQtXurF{2=!Fj(j0Ynimd$Ue_( zIlR+S;lR1QmECQT2sJEa{i;M61vzxg887qU^D{G4|F?{{AK)cA{C3xV;21 z6;AsPXafbufN~5x2>7w(J2-EXnm@pOd3FB`YU)rV>Wp&^?(N6WuWpg}47)YMeHq-x=QoA0A9{NR>Xf%czXv49(y&0yUn*ijUw>1j zV1Q<&)}}@8neC!P3+HsN0yB_agQlW50dBpjXd@ih(R1SI;WLs&NF zVY1v2JKkS90rfr@r&7_-)tvc4wtX)&cAgX|UNvJ&n#2kZVe3u+jpXqXa zv$A=L#rh9Z*nxqHlND)@1U1QSm;GLqz&1$PNfDO5V=BZ7k*L+%t^31(xw+pB)BE(K zoqV~B?BuFoco_}D3!IIei7l<2(;?M=879Nm$}!eQ!wf@F9jX3FJ6Xrui_8)3QTO@? zm?kM-g{`Njy<~ z-eJSw;Gn8-6605Y--_psSnH(J=)^v7|Cf7OGLOUeF<(Q=A4ZB+*!f8a4&v`mjsN+? zuOyRiqf4Lu<0XA`e_s24d+;e5lgxfjC~%Ek(tzVrsdlf)&aq+dFP6++l1EW7-YNDQ z_5^1V@!uzdQBg5{y{q`?%at|x^_Qg-#Kipn@@gCi2uSI93eGR^cxee0*P=_Tpnwlg z3i}tP%$L^wz%J&d2X8a#p=bg_07;$JrGtDCxdS0@Ho=iu_zBz-guV3r^~If)4ww&A zHN1*s#U6`ApQ5ABy%Lfzm+-3r1*UdykmVgu#b;20_2n9!TyAP#tZs+ zupP6r%D<;$0!Bd)@9hwq5F8S7vDP2D*eb#4au6ouy#rTQ$EB{m100R7@bEw{R^dm4 z0Zf$sILt}k!;0TC(=#%@AL@mq9UWppsnp6gI#+3OwSz`40PoLeI>Yk**J#g7Ps7wu zQxnVOU?z|m^-Cn?saDD#Y}3G>2BB(Qo^aOpUda^H`hT4*Laznz`{~8AQM` zJkd4u_VN->U#bzFEN zvIpybGMvzt2PFO_!O1?!o-)BH!kL0|!BwwhNr@GINg8wOe;F#FOta(18?)Oq0 z6{h*_-jIY|xN}CT&RofKzjorBbQo2LaVtRhfzR!G!}Z;FXWZyLb5oV$DVH;o>5PW4 zF)N9ar)Ox2qxxcoaV12h^oy{oPR`1z#!_mjQ8^$+gC~881q%xc=Tm)TW(=VTY5;xh z)?VIRtTk^$9DlvL6tZ}6Q*40;NfZc{ShKw7vZwH5pkqk-R9W+or~UfEh=mkqs(N=X zcl@x@M_^*Ie1D%N5TCo&FTAF7wAcFn{d>Z)yIi}E%2BN-`as|DuDkoig%U-Bap*@sMQR|@h=YbWjC zY}7oJ`fy>6tj5eDQke%O*QQIP9n%z;$3_>)d9jZlFLS1eeVtt*r}upQ8vXg{8t2)^ zPifkr+5pQhUZrBO*+RFLDU>@kiI3Va7%Rw+&L+3snsE*)CjTk_jDeY1%YwMI@-y`7 z0lB*)lfTs8T?$!4xcS;RLYmx4jk`cc44e_C{G*r*XmuGoz^*Vdd>?E&rn^5c70` zvR7JMT3A|Ye>?9it$EPc)~Zsr9pH~4?I`x&>A2hH@dSX$R4f)#?jcAO$?c3*d5MFq zty3q`+g9PQy^_-0`ABBzF99lS+5iYpAd0?cfwS~Wfaf8kOBNnz@UAaT0NHEtPk_@m zU*GXU%h_5-l(UvFV+}I=Osz~C>YjlA5)D;b%Q2FtB+SchwM8!Uj^uv}(Rv%MPrF|J ze)r(=LVjnY6gIE)Ycf~f?zYNl1T{qM%%8mYZN+K35oTDRy9<@;EmUPiAd)$*!mI z%!S_*d|4d+Jg{Gncz6=y`|Xlu8{-vvfzc?J{DPEn$4@8L4M8DFMzk*)l2f?%BhuJ zwVT_gNXDWU45lOcmjRq0T#06>LGn)X{<0Z94*D;W_hE?K|0a2_WPH+I~G49CVfvpK0f4hhrMZ? zaMtpxL}ZT!5Ph5Hw4a~8MA}m;73Px5eUSAK&a+5=T}q(f{I`H<0;gz)NU*A-`K^v_ zQC>gFG9RV`i5SH&%f-@j*g|z;63!oXOUv8+73R(Yq&`5?zccAtvBa=Jkfqm4ouNxI zWIlhTlTov#zPYimwz@l6sl`r#ngn+}E22>JRy(3TSSVK$2iNZW03)+;usB5ck*6__ zidl$>h($x*b+&iok?Eu2A7p4eSyoV57{g*d<@O+?4oZA3ny#s%Q|UDR5FEwGY$`1e z9S1vCZBx@Ib$(CWMiHB>;qBX-WgrpJR*zCHHT;1ec{-r{sVTMDHP7y7?R#ON)MqzS zyR*HWX=3NT@;{tya>{4r8no0FJ)P_N4wLb+_wR0pvKK)DPqoc-Mq3-1ippk8=}#2g zfxv~^KPgZIl*oK$yP=Cz$arkx58lMrgLOe)0mJjmA>72$=anu-6WPU`+23+=M4ar;eq2RbH-O(LbQEYSE zfJJap#_GYckzXWLq!y*w;}c^H#&4G_(b4Pm4>SOuBID*6c^knRwN$^_LZsgCP^ieJ zIm=+MCJmQ(y+Wuwl(bj+mxP9EPJ~#qr=fISWS1qH#FctzpXU=TGMqH8^`TN4=7zKb z#0%9LD>*YKMBFv>m;Y)$n3wx&KJeyMDchMkSmdv=S;TZED^U6qwiNQXF{D?P;@;aJ z7zr&1s0H;S3n#1G4{dGjlbvCmJvT0Jh|nBzh>Zq+KpRs2Tf)SnEzYPz1`;pJ5{*QT z?=w|8{zM{U)q0V^0Q(0g4E>30I-ej9HbxpeNc@9=#6ja)qe9h5dlML&M_a3O(oF5^JmA_U&`oNQenb*7Y zQ7@(jXipaSc&x0tTAtA*V8Kuzgm(ybE4C(;(Yqdc%#Pdk9HzWd*~LS<(rEM@J}R}s zM)w@h-fncbp|wR@)^WK!@$Z=37(!m3EN{Ii?F71i?j%>58Tc??w0AALgCvr5jOjpQ z7ccjGB9074r!(T+1r~_`yCs`CNsT6AP+VBodf%u_a_CUwp#Nd+9Pp-8aNhY77PQsf zD@2;Q!>v zATlkLzQW9y>~Qz$Jadpf$H1U1ycI6@k3tPs=TYmFNGksRNQxmAb0^?^avMvDnN$X)7g5u04+#SR)alC`$^iTZMFb$MMqKd$*d5{cY2 zQGV%mM~Sj_57Dj$@+su2Mqc>-lG*@0p zPv9{(_pCZ6yF&H?KI$C1<;WFSP~Y1JrSY-v_;Ic*cSS!`R8%x$n{hoOW0CE8{ug&iK{3ZJIff|qb^yVnVEz*#1v{ZOpEgr zB&zfwHPtwvy3tmN5!!QCDkftg3vwUG9@O2B zVB8PZK$4*??elft5#UG@sR~Vn4ShULjdQoQjZ)d{vW}ICJZ5u^Wj3zR+pXV4lr|en z`lwFbSg4hGP9YXFTKTK9yY{V~Kec)t3Cq#U^*50CM-LMO^N=UI6m8^c?yKOyPsT-6Sc(I_>u6>iM8OJpuGCu}jgAiM_$B-zkRdWDmo%IQ2$kd*W9T!#B%7 z&PW)ZP8}EMdbxa%@m0!g$hY15Q+?t%ZTGul(dCIWwQj|f$Hyn$KPo7`v@KG?juvH< z9LUpXWE(QynMwzC>OS!Kav%6tU_i*?KNw37Y20W(HEzQC`3eDkG2&Z za}qJAp>cETqhK&Be^WfhV>O5~C9Jf>BGX=3ee39xlJbT&70}%sW$$~$?R%erfB@8s zh>6Y7cF~vO#o0G5Tyap5$b9q{&pOJyWM&XdOX*lycMWy*^hDCNn-!4F?;IM0E7vRx`b zZueXlZT@~zmoT}5cU@@$dB*r`CgE#YLO@2Dxv36ROe9=t!hC2Aaf6DL1Eo%HghdB?yn#f~Z#? zWIQdtw=3iIP-F`uU@ODLH4+z)eUc-^Z!UnuygpLI_d+}t)gAZ)x3-OuWF92(tV*BN zW@O~Q*_Pn)%k$**f6=#u^|KcQ7NxuW*TAA8M?oOhM1>Lh^idXs7YUKyhZhkWC?ABG zWk}E0MN%g0xXPIeSHH)>*$_P{%Fh0tV;S2qa`f!TVDs6_G4_r1;?9N+SMAw`6ea~1 z*B;GCvb$T<7!zz3X>J9=N%(3Jtl`|uoixYJFZaKl>X@DvLy)sdZ(-4CjFP+ej~^Li+2u60tzKie8bpY?i)4xUa(SUAA$tU`JC11_Zqkm9sM z$b+$}es{&w$ICDY+NS_uBs4n#9PMPu))8L(na@ia7sNiNH3@9TFtQBC(VZ6-yhlMi z&^zz8lq$rKdDiX8S;LW4TFr)A#FNA2i8kU_Ouswf6hI2t&{DceAlkTBnU zl#n~)`zKsJN=FL`t;JVs`3~LuzFF<(IxgYdEhPNtC=wB*Z< z_51)r4r=oZRZ?-g_D*@)z)%=6V!)g~5-u${K@Y*7?JJ##CC7r}cIqb(P@&=IS0`J3 zccA{p5isKW{2uJK+p%=kBr-zz=NNniHS&2&(QedziRZ_PeYLJ#f!j*^v~(a{#SKp9Tnx*w|f*tX^~J$6h#_Dnjxf>MoK_HKynD_4iQ9B8tLxto>97ymZ7AZ zp&RCG@b}a??|a^J-u0|?)|tOpbKi5%&7M7b@7dq$`dmv9dXzkl5jhwZ1LniIxXRb* z_iQ#@wF}yN;yB-zzFvMiUpktqpJ>IW@$yc!R7(#tQvI$}I##A+3V=h0c#hn3Q?>d=rn?TX(Iw}s?iI*#S_g)H^WRa8`vbjOXA)1wHecS*R| zIrmSIp~@^8y{pHv1|(`g#LnR5l2l&ih?;2{v$>a(W>O}>1V0uAnc09Qa)5+%LtvW_5l7D-$j>?J}K2rU2q$f-ETxD5!c1GLk zJl4P+7D*GI>F2lIH|H^%&dEN&&TWq9RTc%iB)r7_6#Ps(DLTC)EIP2a2?$R0SFr&U zhX{bF0rj@DU>2>$dCkO-m>9J$vVN0*e_MaPQjJR`5D|%HD`K@eOaU=WSAT@qxU+DO z;DUKfTxGw82rb%_0(Rh7P9MpX_$+`v0u^_|;Xf63Wp44k+96lqP#y`FN_aXqosuW}fS0sDfSv3Wle%;@9nLHxM7O zQk`xocIz-#1LJ$gWfMXy$80*Ce2&|B88u>zv!UKTK8bu4$UY%==uq|pT2f)mijWY~ zh#T>I`}d-BR*q}!G{5O7d^P~ig*{TfbgC*^OO9&YIW7Z#44*>QN%bmoEy#x#mSnj_ zS#3L1eY=N;q|d97Q(AEp6zkc2{vIP(f~hvU2-4UgV7rddV*<*>;k

xfE|61VYK z_jBi=T$QGwp=PkPbe{YT4{3L%Ixyi4^n_ zM-x*1?jJZB(Wd%ZfxtjqdciDcBiNYk7FWALJ+&mCbZ@b0^Tikk`6zRi=f|gVS*E9z z1yQV;A7)a;hHEqbZV4=xbdNh=G=H`EFsAC6__xFdn_U-)lGpCGJOQ3?x^U=fM3TC@ z=1s4Ca{80fR>d2Kg5uq?osnztSTPbo_sybFa>%K3-{V%riJB0Q!31zSX^Z8A-1+Jf z+)R9}%Xs2>AZgNuSDp&Eq_*%<(gW>q$W$ZxY&c~nO;@2SFcg!%z)D8Kw?*eH)P-bY zK)oh5%>|tsYkA}HUlf8Y(YO5pANCKZ%J%0~=INWzNijFGWTsi2iJ@hd2z||6u8?hDg=? zc}FB;sX7J3J(k*3UYQ?dMlA9CZmMBq z&*|D?UpE~hg(e!7Jb%YAcQSLJ`XLNhJWRDB9(Ynel^PZQ6^Qb(bo4zB9(}-*e9{-Kr(Aqbxr+x8p+wxB0$AyT?~{viLj|WH9u~PiK$|fx_Q~R zMAr~UfCY_-GRdy0q9w*5BPENXSNhzW36%JX{cIp*mGyneab^!hFR}Fxn;kw7KKyr=ksVcWzS<)%~-m zK&J6?|FwC%Hr$E&F=J9g_TyP)=x*wb%JqNiD-LUIONH_YJJ4Bb=1zK(OE$cH(pv0kAf0 z&CTvz(OV4LAT0nO5G*D$p)-u#z|vat0#o+~9~PAB+3uhV!=Zi{@A2NMFYB1If!)!G z!1Q&X=rNqr7YlM;hc0WUwUDXEI}6=DVyImLclri@=c{>|>ge^kvG z_OHzxeyza~`~LUZuE&dS{@)~@{7tPOig~@U=%0_fy*OgV^?66FJ9l+!K=J_h-a3x9 zG@-jiI6FRG1d?k09JrkUkLoXCIvhGh)=ZObCF6#<%nFF6|0$ZM(uu})SKc$jB z-k$CRz<{f>LZ#fA_NF^$a$bg7D~kNF@Lpyxg{&AqzjKo~=&DzF8fV87UY-6z{BJM( z_k`F->VAKm?lnI4QAr$kUx$N*njXlgE+2F^Bko)z*Lg6riJsmZHoAHat@HY|889E^ z`8s3xk)|{_6vxJrfdKpRjSp^TH!Kej zWbXVul4*V8Pb5=dfZL2le@jzZ7(7Y7AjDK=p~7-B_QEjTh%D|tDJl7D8ONh`D+~s+ zlRe%&U4`c_-3eSkK1s1H8xxZ)5Nr>z+5Y+lqn)+5me(!L*!~$-OSzh(TEstc%xPyt}CVr^->*GSdhaKDcwvTK72CQ z_B9nQpPK4&Ko*~n(6e&M;XN^%s&7IdtYwaFXEuV#7u2ltq7K?i2on=G!E_7~WCA_! zB+t`%1>7$TM|MBK^@;aUC#HU`qSV2RtL zIZE=IFHeu;KD@V-cF9EilY_S=he8`8U|7%==(q>*s%d6DVx3mcpHPuC-Ei+>&`gE$G*lUk+@K*+RN4A?Jy=yT`sNvv`kIF2`jQ(u+V}4Y#HhORY~!d z37DPb%FeLsTvzc+5%YfuEgDAwE80S*x`JezT*Cu_;Kc(=MEML=S=Peh;z;f|KO=hp z{qN*3`$5@6e!+Y#C<80j+E3}ljXnYjqF*ISkb6dwT{{bUNo`5IHh`AYGo}4tZG-ma z0qEdrMcNL_LyU}T2}dd+8+;F&Qsk<_E~Ap{I)3#3XzXSZeDtwU4r0Fv5L(y511YL1 z-}atdr+ppa>s<~Uw305~BgVtAxH9ff>QDbE$f$2Z^&de-Rbca$ZI{7rlpD?D(Zg=2 z`?GG%_5ccUi=;I8_@>rfoZFCNWhxs-be{kjm6n!PD?YDJ*X=hDYQK*xr!$lI+=9Jg zNSI?mur=g!MGAQZOT`=A_L^YImiLMB62G!(`EW2);6ll{_1?I9OG_`u;&#C(CAen%r+3%ZpD5c#F^@e!< zd^a^f;iih0)kvlR7*MJY$hs=|0EF|nW+u_)O7%?)p{BV5vT7(9(&PCYJs_-Kf z`m>zMB!KlVh8HRrE-_P8>1fS+5pWa|qWVFBI4W9zOj>+aM(zpxv|T)>4tDJ&_O(aQ zC1R#uXYa&bpPi37aemWry?7${czEhpyn`{XTUylSwObD+^>SBL^ah%~NNP_#2qGVK zu(bwxPe|CgZ_D&`;D8aomQoO;^68{PK0&Y#@+E8(;0iK=K^4_niTGcWj7AUt#W@|@ z-t0GrfpcePGYAyN|9FdE@FvTrChlY^K1uq0nPjB&EtVhP?2?JPFI58T0_`g{N9~wc zw>Ql4^Du5I6g~=%eA4xFH!}`mbduJln5SCku}9a5K=?lwtFyY-=D+d|)*jw}b0j`1>QqwxBsduFGL}fw{X<24rtoxwhh=h+4$XIm{Z-V`i_=q8 zLnqz&$wo_3#aoePadLDWw6F72aiwCFB>%(mI)u$B`#Dn(7bbKG4+%XeDOrU0ExN-(cy$4sf?mZ8igg6P)3w5VbyguyJbAkp1cUS74P5 zW2!ITjhs=)3TWCfzy@5_srpyy4TgiDK5~~(XHYd2YW*+4NHWi@#}KnwtkKev{Zx0u z(w;?Ll$?#;WM=BVb$}Ens0&XM)o_+rFRKP=7VEz%O2~n=Gsem3qO3<(??-fJwS(={?wfM`0vY^t$SA%-9k|jF^J5S>`P{r# zMDG3km-=^crRY~c!p$#w%AHB>e}IHC58TN(BNo&GJD4Ss)$1KY?@&^fS$*0XrjJdN z3q(Jyd`|z$g&_Rngpsi3`d$onn)^x2?mi%Kiuwlg+MD6~yy%MV?Q=dX)U5glc+vw8 z8SW?XnS*S2^vHPcN{imOlW2RRj4Y$TQ>V_=Na<|;5UHDOfpPOdu8TPwOd;^&kRs>) z0PtCfy2%`UKoE6w01?+gYRlr@{LpN8Xy{m-TJ#U}6AE5yFUU*&8Z-0l!RW4xv}JtE zj>xLBL(E|Lu`x~VqEs{B)zZ|W#L6%o&Yeng$)X=L1p8~EJ0@5Sr}c8(b*BnXx*ZNf z1N7jqYjm->Y7AgeI{G5{SXfG-5PpvOV&HaBmgX8;b4+f$@{Cxb#_ca1fsYe_9I|t= z=O{taEvFx>jj}-8tWlm94UXfJv%eB_-jck2{A-|;-x6hSt}!qTaX>03y*0}HhTV;uCpISvM@wtb4i}sM zbLbIk+7i$^GmaMC<5>`Spgdqv+bEO%T3ii_Ia_qgJO(7OeWeiSzzWKg?{EX*N_w0+ zy#fYn3L_ZdpIyK59f!?OtFD(NGgmrxSWgKmYdbItvB{1OgVYM^u#2}q%wXsgd7&x& z+=>kXIJoegq=T&2!VDA1sUqg)1z;x*e$Ew59Q*UQ^FuZ{85u{m4g^WtrHc946|k!> z&W^DcI)`)B6JANAXvTFQ2Naony}kGL_jxD*E;-Y9>vxL2fHQ8PcA8=vi`z)y_|E>C z8pBWmhgH6Em3YmB+kEO1ooTf6)Kwa9x7?vYh9(ao*j=h~Y5|{9P6nFo-aH-;a!H_8 z;OIKoD%w9(2`#w&mYj?Id#m58rw2>$7MzV*yY1jxYHvD3g?leW4Elzq8VwREMp;-N zKe}rtZYocJz*f(vva1doT%LypYv{hg!S}g-HV;+nzljq^O@22sH~0FqtNjd^sP0Vf z+5IoEN|yI8z4rkT2V4RN@I(6>9nXYGZE>JoJ5+l7JNkB}E{9ZD*w`7#83qBFSk6X% z(w{jmB?uF?z^#uuZ%$X8|X8*UrC_VlsPeP-B3P2G^A`>8o zvZ!PudhOB5vZkoai|p4xUUcQOA0HdDy0qHwN_T)E?%N@*yHqR{pLM-URWMjBXq}B> z^`^N|Ldr8V9Z$w_I(g<3p2`|62n8^URSkZ3lRovOc}1ummt;nGM&)vN?SXjAk(Fzh z>?5BW1L!wG5=F2Dh*s!Qlf9B1of#PXvm6evoU;<0eHShg9hY)Ah>7>*ZbVK&MLh4A ze0CeWvam0!qc3)XC(+6$_S6mTY_4~oEhad%sm^jNMbOW+1Z<2usHrNG z!Dxct^(M-a1hDC!43Xe^ADm~YkMU;uIKel&(9zEVr#gE&l*p)q<(iSj#Vn~Sq8{4t z8U~N)i(kGZQ?$Y9j~h?FsCtDyF3-9g1%H)p~Kpqd!F@{b06`dNR*7*}( zw6@jf=NDs1a((xSi6b*7O^EIh=doT#N8gh~*?UkWIoWsAqVfsUMe5y`5)3ja*$dym zm`-*qlDtW|dm27G8Xh@Dl;rxZ^%~ICCi)WZiiJn$B^c(IW5)s|U}>IMS~D$8?6qNw zk5j1MkJB8~3N^}pPt`S>%(l0~{D;jDrySUl)39qnVSINE@K;R9b{U|#LXgs~><{7- z!O>Y0nO3lMtnpCY2A5;sCkxyj9;$ejBUO?1;E_P>p!?VSU^VbmKKRc^Fr zvVN|KlAC=&2lq(L#dtLCPmow`gj5|I>wPQXJi_Sr{3oPiL^Hf-auS187hXwGaml=c1=a85^LeYL zp6@0&pbE=9RZrzbMLv-+A@d=pEWJak@;|wd)F3nSE8Kp)_|YfWk*m4#d+#?+_L~FR z3Rp2@rTWzo$8Kd{%r>G@vFbCESu=$(32y0W6R1wKg|+m3xn~sC>;Jh2><DAi{gDcfbEpC8BOC4oh=tX}`OvgSFGcv~O{HNGpADE(Fyh{lKZU8X)!uqW zrkyoZA7HzcTsivl8hV!X7)0ann9PLS4%*x((f!d-w-bin)sRqU{Dfd5 zW@RM?-mo;2WXt`M)phH^K4LxUTM=d6$%@h|gt(mpId|sA1W32Z3KFS3IoS@QbOpnU z%rx#=zCfGp$UN6e?EL9dI)rO>gGHH*XbCg_MDCjM`1}FxGiu9+@uX}_?c-`Du`IBQ z!4n+Qt%6Xb5b|V#-$tlQzlt1hVlGIW1OtZU5<$vkyES_+X+#KPw0(%4aOeR_9;6?h zY#vb70dp1Dd%GvNrD?U!A_Y6^Jo;R#H~9$ms~2yX%H$2p;!*Ql0MYmu+mE-CJ{Q2S zO_bLIv&%$e{HWa*iXk^lD-3V_{rh2mcgC--#!^m~VfC%=UUh*|7PZ^X6?U7xxa69~ zp$F>%*>W4)4yIIMBrZo^E|@EJ{gxl0-;#v7Bq*loV>7o#-gP*7X&PI36WM!g6U3Jt z=$j*01&tG6hIE zI)gC{jZEYj{eO@M)W6v9fh&$`6`3DOpDhgW?$ScIEf5;onH!2*t>mnAOh-UL< zg0)IN@{+vwB=*H~O?R_uhajobr{e&(yLXRO%Xuf~UbAg;O#%0`V+PG4bUGJy1lB4w zU+6s!dscn$ry#~Z(b%F=p^0~wem7(6t`$Yy`i3MElVd(VCpL#txgM1`vKbxZkLqYL z^)mX&+KRo0x1qM$^}n(ZEeN6N4dg}L$l~Vmf(F+KU{YTx}8c@ z54T;b)Een7G+&3Hbvq8tZ6a+2?(`x znASA3AY`o^#TRfaLO^%9aTD&zNcTDJvLYLf&IpBtKeF@ zTO{mdwz87Ar#(=UAFo}^W{aF<`%HVlXMCcy%|DQ&Nq)r{oD3;8AD3(4w~Ba-XCRiL z1+gdxq0<-El5u|xXUzmN0RcL0E-P#LEO0)?M>Em1NzNU`>0|fk!G!Dl^i4Ay-S=WN z$63Wd<*Z~bO#)}Qhhs1sjs$~Q)YD%2`s0y0dH#!+@0E`vQI7IDFyxE%Toq`ubB3`{ z!c+55AOSc=tVt)iuPU+yc(@;Jq6|xr$=_Ozph10^ycUy)27}-yzkdvq0d;Rw#5j#{}g;sXi0=dlYlX(_2Hvq|@+Jrg~m{U{M7YL2J0NvLyue7lW- zmacI|0fD*SKdK}1;4-omWj1n}v~&mByU2Qve$hi*ieJ-0-;4TBZx~K;X!R!`b>Og2 z-_S2<6jrv&o16B#-Q=qIXCnP}s7bleZLN5)WkT{s`)V!{E7jWip61XCH~;xP`#^9i zOOB?cwUzaBi*WD)7UvL(N9nJGPcL@HzREZIVS<434w*geph$q#O~1LgboQmi-nt64 zKB$P-r(O_ER%_Rm#V8oZZ&jbVru$5R)Y58Isath*qDIrp@b$-6xCTkQP zRs^@O-V6D7ezM=&(F+N;m5ZO4sJ6<}gRC72Hu|EDp3u@7U7U@3efl)1r6o_Bpas`W zYtLq5dz>Gy6*uO9w#ajgAxRg!J|J*TJig(6G)$n|5QwESezMUO2P@^Dg^o^M>{YM_ zVL3ca`nD&ZR~XZOx;)|or{vQ{8GYp@$snm}XX#uUys?nG*Mo?3b3Q!ToL;-f>LeRF z70+8n0zb0V74F|7wJ~%1X|v{noa6?n>JGo(O?aJpWc@bXSw=pn_xLe+k0rgg+N4mo zM!(?Qi?r^7RWvk6yCc3XD=K70%Q-g6!_7=5ZLaW?W~BTBz#VEqZqOAYzzi!!mYR~F|N{ZpZ(s4Tqtf9~I2!ZH5Mt3fVLrIKH^(p}>6nQYpJ-{Bq3$703P1B<&Zw)=L9y4yO@ zu%Z`6o#k=F-%WKV8};-g_|Ja2Ni4*~s282B6qN2fPqS8i#zUv6W{2iUnU3u}dPr$D z1k2KJpq4A?Jqh=fMc2iL|Hc$Zt4t6mOlG@z?1SkCcirpvk09D?#aQ27XO}kYOB@zr zc`A*FE^>b<}y$jTaB(xzXolD~@f6AN4z?)Sh*BN(82NRFHp6>i2Dd0~hBpSYt5F6D~yB^3U1c!oz9FJJObLep{G+eSBIErsbOhL{h}Jr#zl z=Mys%9Fk{`IGh%w)Md@Hqr)W*XcGT;v#B#inBQ|_65`|5;;^w%F<9rpi!aCl$+B`q2nrr@PV z;Q!@){5Rj5W1}9O__FcL`(hBEicS`-6X)S9EHY}Ng`a=)C}F8SmmU5!DC@-V z9tJmhc@+pfvv#X@ zxtts42{9$VQt_I-5wzJn%gybif@?xKJ`}-b+&>Cu(6sQzkkWpoy?2V_J< zvok9yua)U8h(uRupU;idJV;FR_ZynGIdwoP#J=4PJcfm*vsa zGhy%(QZ|+=t)U3%VMK7B#~ra3w07ZEQr^6?*Cmr0+X;&;u{IIl=cm=?o@^Q3A1!gV z-$aK@nB)K!{w_w{UBAlcuwZzYF> zxGSRT9d4-JI+}@N#m!pJ@0W?^YpBg!eB+v5Q!}o?KEi6Q@G|?p!F1t<)7Tg_n*<)& z1aJO$a?0bffx)%4wFr_zm0OJhm;En9OV04~5hW4g)j9jKC+Woxg#;G7>Lejac$8v( zIxjry>Rc@BRo8GVeW%=-T9D0YzVb9rBcdZ!R3nluXto_)-=;l2@cUwIWyf1=v^1tf z>%X%Lg_`czlznY}(B9d78w<~Bq+&EDmw{1?th@6i;DwQN!Hvcj5eS6m_lN9+_8>>I zG`!WRZ=?sIZ1lN+Q~!KmWOx|ZNNrSWjZ+F(SQsYi+@S8-g$^#rUR^EXyfLjjJa3ZA z8KIqpmR9<{W?r{ zriMKW1BcYmNsQAWD2~5k#=*@k01Inqlv+VWO>JfRuCO%64<~0QZl2jMY;*O9s_9bQ z1ZU=K-pY}{eQC{*Bvu4I?sUTkt`4Dx3LYJKoS=8y62ZP4LDRG9WE8z|5A7car=-Zq z$&JOtPzNbTMCS#m2|q$Khs7jLNi~fFjG4o>CWkI5iGOB&?5aee8Hksu+$vlvI{b~P zqM{;!92ptrb_@ErrXUe2FI*Qse zlT&KV3{88p)YY}B8ZrjaELvvBxw4D#qIH;C|4XDhfq?Vj_kw!@!v3O_XJoW;t;myXC-zvXbpyL__ zt-iLjgk0Fre>2daMzvknFQ|xn)djAmD>|QJC(vq-5^BF-WXI>D>~+I3T!w^`w&)f{ zCk9NL)*_>#hLlIW?T`d)??Q}o?{*X$CAs%ENs!`Z3Z_4@erG$~egTFny>=LZq9Xb& z#-LYxZXz-|IQ;MDjr%EIt@53Wi1(hryiv zd=A@sIaLm)CnwJRhQoYKIznrz$OFMR?tI1}f!&76%%|JGWoEzTJgverm!((N)@Bbja&mI|qdBUdNf4G4f&0Ch znmkp5H^(qIhlibbc~2VOYQ?E2y2Ersj1y+|<$|UZ$JPxWiy2vJNp4(fDMd;2ctwcT@%1!&QgKLr4<#V}C zLksq~8Up^?i^Bh6&G`S%;e8Zn4HSwY;dw3i1LJZfg^rdI!TIIry!-QIOT7}86Dt&X H=k-4TOnbL< literal 0 HcmV?d00001 diff --git a/img/ssl-labs-a-plus-nginx.png b/img/ssl-labs-a-plus-nginx.png new file mode 100644 index 0000000000000000000000000000000000000000..c31de452a16c6104b7d26c35d751ccecdb4e4963 GIT binary patch literal 49547 zcmeFYRZv_}*ER?t2?P=#xC9T@SdidOaCd^cyE_C89^BnMjXMeM?$*JzacG=5yzhK9 zGgWgjH8oXp^Pj6z&FN;Jz1Lprk+s7V($Y*pbEN>5EgcUH9X|`cyFzx_qe9D=c!{XbexlwhiLrS!!)Znp}AcE0r(%l1= z@#_6$MdV1uWn|>#rL%Tifp*Y_lJI%UV zt=&qjiiPu9;io2BWwsrgM2njZ>@kKF@8x?~B$U6EQU#yS`%!I`xFzTUP+rk!$3nG+ zSij%@H2v>SC&uBRx3o4}FW9?Bzcyd`l?t|1DPk8%Oq#^=f({01i1*m??nW zLM2oR3;#c3!lW!yN`?1n8Ny3XO7cA&24_%NWYB7kEfv}fspqKHq2c{}?dzSWS^1yW zrYZmSCMc2ajWnUl{!r9)CZcJlCj;-7bpvvjE)jySCD@Z?lG9=?m6Z(NKWd;0t{+Sm zW=2Ox3kz6~Olr%*lL?X?%=%#g35q66N>0$+z;;J_PH}?EF;U znNCi2H`Ujc$Hw}WhNh;bRu&cpCjR`HnD{dx2>J6TM<#WuTDNm>WMph;%=d}+>$R`& z$Ri@PTxN{Cgt4WP6l^_ z-S+mrshO25p?R-Oe(d_P+sRso2kdTinZs_a!}o%Uf`auc!{g$`%*~Cso6&|XBrJDb zCi7sfOl@vZXoE)ca@&gIFi0JfL^QO*tPxe&Y|KnEELtb9WnC5YM*aP}f_w{GQ%h6R zxb*bo)Wpox)T;;4rNUv3F`YKgyQ5y%iNKeyzZ+}!r)!ntL+YVWn@V~HM@OgqJog)# z{i(!s9#@jcFrPo+a9=BplcR0YI4V!H#v-a@QBW>sW|A$Krt|Yo81(A*SAxqc%;|6t zQQ_dE3V>;y5>Z*Ap`6+iH4qY9YOrYWo+P=IGc~moCNheK_uW32Efo?uKR=htY_GHK z4dJ_gHUSB*LyjQ6mP<`lr-GP96bCD-+BDvG5c$m~%{s@a@y=nc?jeJ}@qT#ty7@Id z^DI$OktOlh;Qf%%))4Ot1m$A6*vi5vZs)D7K~`MKw?Ut4bWj-HBhkISizZ;sF}ZkK zD4mRhFN*N~{UvR$eDgc!Ch=N$thMUZCZneSY^?QR)(cf>vqpY)S}8)JAH!-C&D~pnnob>qRBDJ+O39R64-@WH|H9shcA@Ob8Yx{8b9(L` zi^#MDw$7`RV}Kk~45#9kJ}jFVn=%98-7F=?kYC;LWG$c4smG=E9{2T|-12hik4tIW zPK`DiN9)H!$n<$G@wNS~KfeWTgrFV!T&?(8ys_#kk|FkTKWWkYT26Bpn`Np1H=Xw# z!NSN5%GYMo&u?L(jYT|qcTCB zhf6RN3peaFc9;3;+v~#yyM8GxLMt`AnYuWwIfk^aPBlj-;BMi-r`68&^jsf}kNI&v z!iyq=jYmn>7mKWZj=!>EB+YW_%zrVSb_Dj361;|^IRiE=-st#U;=t;x$NZcLJScpQ zt$|b_?Cn+8^J-(3FxFzc&)ubDUrFBwD<-X**2Kg&@qx+3%MBl%6~guU*g9n&e@qpL zvSMvHn=fbR?SX{UuFHK8V@x_deIB;BECfzwgtS1$ z4f1Pg`0kormE{tuJ&VFfs6v1Jg99}fS}M@cd6~U{d*17Ju)ojTe47N*Y|$^O1G`wM zlT0+y(JgV;#cO7cbRdWe_&!MR@xUZ}&?;3U#2k|nv90*mh+7-z>GVIcVVj&R+{7HM zQf@w6UOPj6A22NzH~u7;?ecWC=~t1xpp#r=Q>9Zk4o^AjJh7UuAh)TAypiQ1Sf)N% zYd`s_kM)?ynKZ@>ip9Ylg`?Ebv&uKL?f%40)kMxo%H%}ShUoEF{vYwE}58kw_@-GTAGs* zIURs)Bh=k#1YiXsDHWce^hRjx?l5KesAi-2HzF7WC|uRr?H&h5qEf3x#bzvA=GH=_ zf?P1gNoKQgJ>R>_??bh?gG9B%hh2L7L<8)7tJ`zc%2Fxr=7(G?F{&fRl$)bX;S{Q0?~?tyQLYZ zHd;q~_A0L1B%rPBeKjEO7*UVakjwN*DQ#UJ%5SDz$NKzJt6EhmH^mNfsL9QRPecsi zFz;WDC10*jxYp(1CwdJx!A=Px)owKqPmcchwOn0kPn~frdPdRo;*u6Z#OrN%R#U&r zq)SJR6418N7LiXU$n?cIqV>|}ZyW`Rj*dZ8>c+azRz zZ^yMmcV~MPBHL;!w%Y7N9df=T0=jWKnX2;UVzQW?#_)2s>2w@5UH`G|!z-N_XTRF+ zb6;f;!Pv$1rW(@bk#?@_PO!u%1)VKbtrV-5np*py9M({oE=4HXFMQL<10x17&y=T9 z38NW9S}$thaH~u7FXq4H^L98)I$jrZL@gtg74*U)ul7p@eGwhI_Hy3?uNj5ON)xf$Xm@fBjNj-#vWn%p(86`SkG8Be{Bw9vNlI5v!9HtBXMgOjaN)2xGLN zjIPuy%$tH=&w6}DC3wor@jts7j`kE3+BSF4K!kJT}T8pcZr>N6`;8Ck9z=Ll%n z)Ga7dd+1JsgA`bdGyHT$mG)fjRo z^wXndT=kC;)S2MuvL9oL-xiXjmQPryfxSDezQP?XXUOaG+ePB;nf>`CfzJL2Zt z--V<&$4(ud$C6P{)LNty2jmF<>ngNjiH;656|h!Yms(oVP$o;M%bws`>=-5$Vxtkf zrH%J}(lKJ%9ukp7Jf4Gk2|RqRS1KR1!j-Zz+fXz-&-n;pg@c=5p=2QatU@YM3h((F z9FTf@i00$z3M~4o;FYMbc=n;*#V}fvzZcO9kDDsUE zIiM?Tm#yILlAu~wch%rB5|zZMLTT~3xTS!uW1rAo#N!1Yg{4cZ_ruf3!wG{%tV($o zP#QA2^KM7}tn-Io++I9{McmHL#%)B*hmwf@qXqo7+4aT8{#d=-#Cj_kUI%8`_=K-k z4H;|aWRUCI);F{sVUq}^``(&VA>YJdw|sx97*_{oHDmbY4v&L;Mbxxi&MxUi*flXB zxN(}1k>MNIuM{~12PZh3P^T`&B_5Ogu4>ACAxHP|-kDLN5^cKJTb!#N$jsPx0sa~( z>GjrYq?`kgxw$0(IrYQlPoN$a%YE6h7`g}wl>|GS%~y#-1)Q}tmlT7|(X=$B zDsSyKP2VN1Ir-wd!KPL-Qv$kDW-g+lj=Y1|luc&~ZI9 zPUz`$zYVDaZ-60v3|=YTpNNhuRZtFB`5f1>l?`pPI9vQS2i6}8f^|WY;Px4H9NKPj z&|TJz{SucK>H{5A{bOZ1))_l{!oPL0uP|z6TCQ~i{?VyVJPvYw8lnQwR+sy#$TTk& z*4o0TI5njL)G{5(#pFMgC9N_=h-k!Ma=}$Z#{1br0HwA0Jqu-p$!Bm2crIyDr`K@ya)kus34As;$Uq6EmV##bkKA7iqgLHc zOX?JPT%~-h5|HJzq@Gu*Qdl@x6WKxcvxG?`i`aMR>8Z@316BQ3^>3HI#|qWcS)S7pSJpd)ASI<4=P)~44T z*sh}s#x4sC&#iV~QjDV=&Q}g%<$~WNx&usMt<$L9an`y-!S%Y_yV&DV(-KeLl3X(# z(jP<8FLRT9q$G|nBO6)##NvC|h>%j|ayX;5RP0dK0KksKYZ2~U<*fE!?Cdo@WF$g~ ztchy`1-y%hH553kti5Sz-i)kO1A~JGqW+fZQ{V1*;s@ok!4JGr-Xq~~qo0~OajWyD z1Qw^?6QA+DnF6?KT_Vn#pf1-F9v0t?y3;#o*{sFm33$4O`Wkj+AnGebIn|^XSRxaN z&5jWGpf>?h7PG{rz|c!6Kq^yzRvg!(frvqZCPjRPy_gd%NhW2MXqLjIi(vyL^}Rw; zP6P##-P~yp+Oi17pXWYM&R#JIUzZPun_>+x+C7{KRdKwXm93|vrFia@iiXi!TUUJl zn3IaIdwlQ-;}fYDLD+{y1UUa|n$*OhffL=4KvW$>rte>r#h4T76W`E%iDD?}`NG2T z33Smr;DlRcyU=!V+};F$u^_z;tiOUqGW)q$I$;SOWcPXYstpb6hT`(_ zcH42^advLof>z44LgR~>tRWu$K;crGn!*tN2zlfbdD%Yuw8$tRcyi6J%*;tk$6am$ za(2X%PNR2F^{Q2jTdaPuS(hqKuBBa`sK^{ev2FD4i`7Z=dXOd)4(f3!hUKfGD9w7? z!`p~?V?XWBg1L6Vf{Ch063m3k>8>_uV2p2KBc^s{@phElRg5Mkk+QPNUOF|sI;Kf8 zR^h^=ZmBN6Fm`LAWq3v&uI{}f5V@RupBKmH(_e-uEI1IKl*E|7T4v3~j|{Q|hACW_ ztd_~;<}ry;D*Jq!qAY6Gwr{R?yWWx z4ht4}fzga33(4K^jfjqHtmaC3>I4DG3zUagCqq`{cvWdr!hy3cpkyZS0(g}7x0P&Y z0|VAG(Mck^Mbtp7GdSrp!2WD@NFOOj2pjVXpQCTxy;u@i*x2?~+XExty}gEN7Rgvx z7*#_O>KmpM*8WE8AeN4NDN*X?yDwxvAT?s5EpX^wGRgduvZRpvJ%$mgAt^N38VTlW z9pu)EjEdxz@UzQ^zHi6-K8gA(FjQ{9T-$fypKgLUh0PH_@^eN0NO2GOoxX4NUq z%_ZF?jnm||j_4OT8580ILt20fYcioL^u@5C<6AHPHAbY#`jt-7B}%u=TSqL4^uuB3 z@XxANHygT5oxO|XD&~RlLk>IRnG8U)Y4JLAM01;LAg5I~TuOLHB(0s?6Xj`B27(T)k$x%-f25Bv03iK)u~*?;tIH+y9N-uD`) z*$gXhEU58E@e*LMnr}Iw$?p!#8#AM?02!e-&;w+-&~#^~j$3+S(?|Vz4a;89D5f zo*%TYj^pxrUSFp8V1NJuU2kD19Gkl(1-`K z{T3hu^qQPkmzKx@!Z3P}Sb8HWCg=#$T>(lj-hctDgCa~)-gv85LnFnH!n-_Vdm!5dqX`M0z&A=lxwvZlXYvz{L@ z_48#yo+j8bz7EXJu7+^uS{QwPly3`(XeRMvqBRqJ)aLrF9plb~=nIJ&t<`fz!iQYOvpSWuqzY+A)8~qLW8-2cywRV{VQUmD z1oo`V>;#WcxT2pxIW#71%=UeB>fI2)N6PKu!_P*2;x<}~(sFBhiZ$}9!uzzh1Iq1M z20-zJnJoSn=T|T9ngfNR4_%*|^sRIzF~8{C;jt9`a>^geTgz*Ez$$rH(BB<1VDh6F zt_YJxzR|O5$Kq((=#6#UQi}?G?F^!F)lwRpqe)CN>?p`JF(-(Dl#TW4{zSv=(gz-m zurFu35K!^<4dLndNM)f`Tmy_Oax> z^C`rr_*u72>Qt}gtD?pFQ)c<+BuDWEE061y#6+vcF94@_W$r3m27qn@3TlfSS|p%+ zy618lAGvk1^j2y%CYE9q@+5L{_seAz`u{2&1%kylA)guMeRVV^v_zO?JfGDqBed*# zT&%3Qq=AoZjl-kzX{mX4qQV;6yU*kBx*dS2tO^sSiUPU{zX`G&1Z4Pp4>Ib&y>}?x z-&v`Xq@5kYK-N20fXTt~I!Gz%(f8m-cYo@gg|$#G zs)@x(qOMEmH##-DB%S3THWsP3#{v>~oX%YUQc7K6)a_WyKanV6uWP{cyL)svS60(! zA+X6;Fq_v6M(C=mbB-P737#!eTwEIqNyGw3M7`xa4`2h(`C}F{)g4dZW?R$#s1Z$T zICcO;eGjT4YoZ}fts3w4!b?+8NQcjGcrhco>7#;Bjex+L_d1U~w6y30qB7tM8Vn3h&cQJNRAQ$y!=2 zb@yx`ghoS`oHWEP!ZzsXM??Z1ynWhz+IRt=;OW&o{a&=l<6_6gT3h%sGX*8NN--$J zPBwxQsB}P$3{|iGgtcd7WMlGwHDW}I5wTS>x%{>-7b9veI0b#ivKJ^TOWOhKA&uLK zA9&3PDoWlLyB*zpvEnaKrVHE2*9uf&fJz4dDL9(|DHA~I)F@M4?e;%f03RRbBq^ z6`7^iAUiMsdvY}X(B;28JzIj);J0h}*UxSxvcnNNH+!gvwn0KkMd>#(NPDumzjFZi z4;YhWVRh_xobt+9>hJ8r?404@1W^(Vfid=yU}GrFcgo`yT~m8(_pPy@MwM z22}qpzKDd+Hw55i=9Djk%V{@#YSv#IiUM}3pw@p{2yC1;=Q08Dy~BYu?d3UUJ_JlH zV1NoMymE5QxP)eg)>}IV73Fkxg^L~@9@OL78NAyuz`m65xCWFbICG8}7NB*aH$6Dm zV|IuPI}iZ@Vdy^T;{4iiH>A_=`GuN(UtCQ6Uah2*)h{3;|9`hO6yp8dU&%L9u$R!b9trouVf8mGuP8s9uoF`nKZ2MR@cWI``G;^c zo3GJniq%yT>(X)2TKrvE4ERw=zNCtRChz;;{x{=0`7{q#E1TWyQs3NM&y0$=IQ5h)HJBU1&C`y?O2P_QUlxtvDZ|>j}TpLD0?X zO{ynz1B=wte}AWf{eZZ%+1NRrv>Q-p31)fu8L3`=(viVIk8{q&-qFOkuW@~cO-(Hh zKF7LQ8}PZQsa&FgGZ$ah;inU>Gr2?6s^Ttb93~&Q-optZe^{X-Xfzj^)ZfSt6-Pbt z!^{4aoLmkTjp%Ow2rR^fR2N-78s-KqXH8p#M zKR2{x3(Q~qd-8b;ryvYnY|i99Th~rnEH&!i*xX2YE2;ILxBVTbP%85fI1bKel=p~L zBwky)a>k~tbmLtbh0F!Ovvhqv04*+yLtT2%hR%7n!iUVv@xJngrfHuLL zoII+z940frpvkZO3JSUjLTuv@Zuj>7M)gmZP1f^L;xrEn&OhnPmoHnM{D89uH=#ti zo~ZcOEa*5d`{O}VQ!}gXN5hP&EL{Z&B+*DS`An=xc2?HLx|+PKAoo%dbj{_3xhlw? z>EU!_ylh_IPfjq@(e>%#>Nt7N!b{=qGKD$|6C)#ATU&GE%j?nf`D)$%o|Q+~zo(Uq zXW>!*9Aq7@tDQTG;Nqtya!Xy-ey&YFYNi-#J-ao#WnTN2&TvdV=~eejnOH9vPI zmPT^-YIG{4aZqB;l93(;K=4!pf=NuRq_<3Jl z+{odAO{c1R4%5R5dq-8SUGG`m01fgpH?)+>Y|j_bSD2UzMqy!PNdakmUv@rP%4|^i zQsBHll|bO+;8a^*uT$?V2|wRIT&xXS^BLMZbb2m4S3U6d9&B()(<>hz-<$t8&$U{iF<=EK z3~)ITv}EuG4}tgf2XiKE<4D7+ExwtAdxOvZr<2{U@1zSQ?bh0Ix6%Uhm4~LOS6&}y zwcRKzAqHW2IUla_aM7Oa<%-bK%8!iD)9lMjJJ>r{5bH(^jlNdi@g8Y*y`6eoNU6hR zVqsz7_jW(o(`abx^h-SWN)r^Zhfa$$o0o4Z`-w-hIqmZOhYyG!NQ5lJhkOLu{2<*y zh!&-#R8&QC?Ce;3X=&-SV1Dvt>5pB3P50E%PwD4dVX48v)!Ba2NtGoxsRkA{HYPT*WQ7u4I(bgT@`{4yHa5`BL$~KOomg;UnOb3| zB1e_a!|4w~VLEv$VZQOKqNC+@Rxa97l~SdIgyOpT;6f9?I8s(pio?YG{&(+?P(e|( z3s3~?_k%vt>%3*MBU#FxiN85r|J&}B#Vc9l6p1Q6++b7sTcX*7*7IhCmv_naXh17e z{J}*+j-8#o$SJ)M_3A)cy9FG!@1HC3Au5uUWh#b*Uzl?1`*(a-*K1%{`SHAMuB$V< zOpJP*;|YbA_%yrN#XVHgSh$!X)5=^7P;{ZBP_$=df+Dk^v#^e~Q8n$R~r zERBxdav?zKeM6dcf07^M-svwGj`0SbO#Ot0a+}guP~yi#JCEBOz249x2gB7H6R-5N z)R3SM)lx+f&RDnYsW%5fe$x9Y2S72oLnY82n;-9;WuQI#NS87P9ULHq>g43q z^h4#Bu+B&(j|{3alDUt0m};3S?mHw4A?@3d)c9<@0u3Fg4v#n`=WuBBAP$&Y-4bgF#owSWcI=haVtmK*9h0pwPv9)r)cf zcKU7h#z@~-CD%~&fXmyylaxRu;pl2`c$kOgI`3cRvZ7>+`{4Ay@Z5kO+%0X%gcpt% zO)cIDPG>7zeOA}q;|o3C+&P1PUM7c+HL04k%@nuRM=@MIc%9~u5^O0jj}01$0seQqK`M|!>;xC>md5k;<}5!p4BS}Fq+I_nCfHo{GLZy#TyD20>Kwi8 zoc32!y}RRC_yl+@zPBuk;{yIqzV6Ri<+)N}Uz3G`VaOj828mwgF#IQmlJG!>x0v}e zFpp;HxIirdddZN65J-B?;vBTWWM^lOD`KK;2{=fstTnG^>ySRk?0QyIR0bce$bGY;QHNp8bn0*0Fb?B0DGj{vpEI>UV>NE}Snnle z{J1VW0-0lwNK=j*sFr;xOrm^V-y~PkL=5|2 z!5xrDuQO_<`UFOuCDBFd|j`v`L~BC&-Hj^(tRFxfLjn+nEEs-nppn$j^fNyxR+?A}DIfLG?BV#=Ifc&@c;*%+eD*g; zAY^?dq_Q-Hv|5yEa(vC@ijjv1#6&F;3#YMvCx}*BghWI{RiEgAT@>gAW3!ygaAj%C z&gPT#NI50tfBL&xvK*j3V4SaVRX?0;Id7*>YN;wDs8Me!8?LHrVkW-YMBB!73EK>f zvFo+Oq%1AXwn8p6=Agqv4#Q4c`x}eb~BdKs=J-!`vpGhwq&Dqg) z$CK*mL4YbVvG5!|*U>B|Lp=i{onAy+MrPBLfu;dm-&pLZlYQRy@bk6rbddv?S=DL= zT}7qaC!QYss*K#FdIB!-zxDGcjS&30U-m~&Wx>7Uzd+e6zy8dxC?`O9LlfMOf^?hx zSK{9P*I8b5OidE3P)4zIs zW&1R%gX8Y=nMrszKKceZgWrLd8w6@Hq$!MB<>fshA}T4@%s0IozO*5nA2#n3SpYDk z#TgR`&4Ef;SGnBIdGAFRG|%TQf!c^F`@AC(+tW;0EZ?%uuOQ0ve&?%l5aYDb zP+SAOC|dTB%S5b-bQw5|HeO_(#Uw>3fgfSJeFF<(j8D_xaerKy`-4n9mj?H$xA#1+ z0}%{%mUeJ;DP-Y8k(NH5RzoIDowBNm^$IpE*#bHr;owAtfF7{h?2r7e4o;iu*!i1% zXh@r#a>=|v-1<+f4qseXrmM}d%di=$gycJYuPO_}j=(L9XlFMyQJyfQ8>>yg>hoJ1 znHq|V)0X*gXk=hQ=D-O%&=>P88ZdKYnpOgkcM5m-r=j~hMWG*l`skIq^I7d?Pj?Xm z{k|9`CV`)({#u4 zX;y2Ydm^1#uRxj#y(Ii+{}EJz=VNB{bB&(zYrCq*-10kxn2F^k+$1#%cxW+_=cy2mfEML)8q+ zbV;I1OH+GZAw%H&`n)jZ4-oB01iW+LyyhD!c^Xa$V%S-jab8>8w%CWjD)qVa^jKLh zK(ijRgDX+dMaGS%Y)l<>2gkU0H2k4(&!kn_z04-3exU={VJXQ}%*msDXUWUNxt{A&-V; zM>6EJ-mdjjm@0H!s~V2YcgrLu^`N2Ro7Sve68;duI6x%09}FDu@GncK@IM{i<#Qoq zH_k4{ek@a`k}A-R;=k?LOIPq@96B% zPI=12;_TPRXSFh^iNWsPAZLYdYbtea_LmoE#^K7Br4R;LCmV1g*lsLLINB%UQG30tO~?Z)-~2ES~+!H^@nptZSmA{#tFsA^Sd}mC`o<= zsb0ZlG+=YeW4JeZG{AntQV2sv+T7e|vYcoJV8K~=7iLm&@_h>Arba&?pp!*BcL341 ze1q@)3awnJx2Gq8`^0fO)R#xIQzo@o?|>7#PgTgk#74E)SA>wqgARM8!2%(X0S^z) zo7L7E!0Sh!j;=1H94f68NasT!ye*E0-MObB8-+k7b0Cpbq`}s0we4qIZSv6Vbo~Cs z1cG@}eb$f&)Cm(Q2` z(;YfIrJ>i@Ho?h_F+YBg*(6l^{W*;_qA392%5tqw`l)A2 zKSL0{wK&qv#bCjyT;lQ1KzReK)mK_B2zm`u!_k)b-A(ra3Plbhbs{e3YuPnyTN_5PLH4C{m$rHS)iRV^{ee#2Dk0MZ4_Kr+f{la zp;UbQh@DaBN;@K@{Bqq1DGU3x^u@7M1={Z8ePj9@G{2zCPSF3<9`x&bqhsMIx(Gtx z#E>dTy_||4Q|hEjt3Hl)>mF8Nf!z4AE<>r=V zWf>YgxzNoSaQ;ep0hZ!`fCwcj2{Z$m&e32o|F?J4=HKtp1mdB=gCD-6wn(scDaD&8>B)*HqDC^bw#5HPj){=K(;xb8cS2k_fG0|)@I_@VX{VG8%D|H(d~uVs8$0|=4Uy+ zxTmJ!xC!ix3}Q|ZI0F9Qs$T7r^-M)-dU|VVbMr$rR1tnjuhukpzI1bcTXu0bNi8W7 z_V(X&=ouO#l4?)h-W}2e>g{f|$GXd*qCs+Q>}34b7EmIoqlrJ3%9%p4Ry*!tA zIH$;ICLiu*t-{q$`untby{LG2(rE)=@Kd9N2_4=*o==pm#?fG z%*?l!v?thhx%>C7Q1r03T*dOA#)n3btJUYHx&oxWl-z9JZPO()W#O`YD+MJpW%ylR zTKwNgKlgVRc}U!7+ZMFnQZPbK4hp5mm6R<1NB@Z)Gbwxw5?)+nE#|P9U7DR;9q0k1 z6%Bd$nDCrz<@K>mW00W_^~?Zb=6jRND}1JS%IHBMKymN|($ssj<9?M54gyII^w`F? z00V6D|FZrA*>Y@Vp*`=PF}-HJ8ypudAV0%d<{8;m+Y`N4=yE=uWToK@lG0Ios7=8R z0q7HFB7@idL$l6uLrq+sZg<~@batP!hs6wtX^kNubZlQ|wzdt8J^3tEbCD!I@c#GY zN=}@bFjB7^mw-U{+Y8_r1(Cp*6f#Ju{G)D!XI?(mQ$Z!t`Q^?m*yHZT;aeau0yxU| zuY_sX?o2Kp=~T>@@+hw$%|wa1ztQTDrN=uS0YU|d3G=x7-0Yk>HK)c-yr%0yz{bYH zJT^AQ?Ys4b?rDXuy{4vSESsL6Xr6T+WASYC@+}1nGSZ-~OArsw*<`*^D4NN6dK^>qT(zcZz1Rm_ zH#aXY#J&iGX(hb^rPTFBWokz!an1c>3w4bYXY3Us9dosKWp?f)Ur|F7eS zzvk_? z`Mx%;tHXILrKZ$Zj3lL@<-TYndysvcKj{zWiwJ;pf8ctX}wr7Kqxo^mcoodwpg+(>%?P^AQJSKqRF)RF5sQNT(sdnf*NE0 z+S%vHDFQnu5tjfj;pGwxe=#&TzOm6@yZ#5N!wo1LA#{-%VFgHTTm8&@$)0dr z4~GcbjYvhg+GJh?S~$2V?0f%-8mt4^*rAR{wZK!x1l}KMi%s$f^RlnI9XCk&w?0@D64vQHHNmXY4j|Ak8Dr8O7 z{omouUK1BZt*xH^e+MV}Ru_Nvwb8gga_u!w1OA`?ej5J%br3-Gm0GrE z2pZuRbA6Hn3!+I%vUSA{fy?uAyjv)`Jer#miW8<${zzm+@;*M3lJdz)v)kT8r`yS@ z*?De{m4t-7eol6$o(CEl2Ol5bUl6U?X-)?g$i1mGEj^V_N=oXdU!Cb{QAr6;jo;V( zP;e%9{c_{;gd5~J?;KnCmR-2sG7*;{Mbs+}-v9IAJmUxC^WrSo^oD0{D4Iq5yWk{2c$57Od>-A{^tR&$H zDk<^B`S}-}dcNkW~v>AWvgQU6z<~k z{_ZWiJ?l1IZfuv6toiA~od!2HQsWlK7ReIGWpnXxa3q&%3MCmDTFYccIDJ3v^zn4# zbJ}^BvGC)U^X-B|o{iiWs5f8x%zdZ3TjhfPEclAEQW8+ppbjLpYl4gC(#{T!DOM$P*-zqHe#@KVo2oSPSLR&tkcje#=t1m2g^V z8V}Ap%9cqs{k$U-;&*B<=&xrV{6~!;eT%Tn!ku=pT34sdIg$I|*=%q~2;tuOkU-L4 zedRmrlIXSj8F?Z++#lQ$6)~MP{;*_Ta`~&1*@VwoS;Vdl>@!YB3l>5*pChHZ#bR!M zSZKp+iG~x_MXLRZ{znUF@8UMnVc%c$MBzu;rRT>)^jjBimOH0a+r!YIQb6|q3k0#q$ zfvrMDL#Bc&LM8S1J|+$({`K`$FXrK-YFTU^a;M#q z61{5n?Y}URF98i;^=d|gTrwaYm|@4+d~OcCLoRi*6>tgZoezghRdx{K{0<`Wo0Fk! zl-G~5R&1VEclCJ@=xeW^;UKzv+=!}3&W^tY{GO(M85ptKXz!n>+a6x8c0RC(+^CDk z9M#m;7G}w1dO?~A>G0MnzUMtKV?#c^_NPbBkk^PU9!-myTGUjO0GYK}tBEg4 z=5zuH<>jLj-~h9i6g^NrU#*nI+e+l)_Sk0=5TTL)E5J-2%ovUsUp%m@DjB5w+^aPKg~=XK`2)hKdxHT=!>r$&=GzA{lF zlgV7h8yCxY02W#=)(loG`hf!!XJrNZ$dMggaJNEuJ<@qy9$ALqySu{Z*lg0Cn61zzLKI{+;=`^b4R*(G*IQLKebW<+u6d(E! z>Q6ELSM_p4WgY*`K_IZRtqH${qdg>~E3a7Lt2PEPxs_O|b~V_p4u-#{7S}ECWD*mG z7O6-KTs1XGxRa!uH}6M#AF5prC+}Ab5b~DTb@H!%c>m$GNLPh$SC_D6y(Pcj(}rw1 zrTP~_0s>yYH9OOyqJU?m`3j4CUxbiycNxJ1o2{c&RPm=D>FdL5See4ndZ2p|F>FIX4%u}JjPFWdm z`sX|Q7T2&(Jf=-KQq-CxYf>S>^g3l4tD;8zk$bbX5vS<56e7tra%^-6A|fF0M`F>^ zM%qsAlT9ckp3+!#Y}M3Y zu2_5JgWur=_On!6doRs;10}z8%O3_-6pcIoPS+?o-+| zI!TuAEd&5dcoNAEpSN9SGXIc1Q^^vzySLaZwHX1`FIcyqf-<_9?Jfcr!*RN_Vsmxb z?ULSsk&cYiTB8&7kx%v00o6;j`b$?CL;(j*NEgoZm3UDygQ&=UwZo5uv(wGSm zwJd>v{XY&2x6+;~ve|O=+ox8=8BCx1s5Axw)AM_r_FrCe%BcU*Ixi*w~uhJ=~&zFms4*wg#2$NU9q?GEgkB zolG@%1Ls{2=WK9fv;QId7qT`9=OCV^vMqqCHChQFgK>oba0awrtujkB{mTI{>1MR8J{#rApCVXtDzS(@emGQl6B@MDA?xf{rkhyeX78?j|iRn}H3t9^Z26E>%LL0`Ex|LsKwMgaO5YP9%4`{4=hlF?y4DdlC z-bE&(>_bExW>ja~ZqZ}e<}h~aMVnu#+~W0aYaQX1=3DhlR=c&yjbGTPMP&QIZ-zq1 znRsI@wd+X(EibRJ8p-l{|GxM0;?UZ6$jA-@kQ5&O^sF>9Hy64p9kV}LVg31P!g{L0>(}H-lY>8} zgiv29d!^gB1iIqj$V6Z$9!KbrISsl&wqj3A4LciK_|tD|O6B^`S2tq7=gr+XAJqFO z&4?3R^cTOSk<1z!tTY}Z<2sX(9b7`RI}~(es;dv zTo<`%n`-iJOz$Ha;hc=>X$C@NMMY(!Gf`VV9WC?DhHj3#TZ4SM z?)xNcpk?byUtUmSbqAGcu?cx9%$GhbwC-V; z1!Oi8Ohz58Df7HYfG)E^w{84v4?;$G=&8kh*r||(VqIVbgP}n z&K_OHUC6PSuL=t;bhYG29xKL|@y>s9J?9_thL2JvWnG2?4bAze96b4o z4^R(RT8PUL(^q|0WIN2Bv7zztOh`RPJqMA!fvl;Kkp#KvSmlRhg`?L4t-`%Phs>|X zzo(I^*;rm)4$c62>oLAwg#1_2udPZo;u^zrOR#h*6McP~4-e0wiNU4X5bC2fdwCmzl&>BSI!F@ z>l-f!FO4pVdr}TCr=9lW3<@jl)j1PGarO=j5mcxqg>%Jpp0b11W^ZG1in{FM_K#N>v&D!M2rASpW;ft4riZm>oZfky?+SZB zg}!bfI1UHl$l9WY#U~}nw~-&W(8mZ$ag!yo3@LR7r@G!EDOyyq;&$089zpQlwKpV=^G zztV=gOeU6*vCr)i$#49zcRlQ>8g9Hs9BJMKEiG9TwJ-tu1JmfnhH*EcSbK03zX3<_ z2E%Km&L6^VEbK>#ADAGoY&A9UzkWJwx9`^dEZ5h4x#$^9udN{x76*1p1I6*V=sMXR z?{z9?BW#=WG^@vtSv!ApGjB%l$gj>cg)0_Kd{~lG`0#u4z}Z6AT;JlAP9fsx2mZ^` ztx8ZVC}c~>uV=J9dGn?}K}``C6>lsZNnGJL3K*lxNEs+aRg&B}i1;Qa=;jc~Hk$ir zypM~;8FcLibhpmpQb$6%`l2;_9wCTn-7;$VXQb;j9ut2!GVjXHbb zlM!e)ys`!(lR9+%_C%N{SnPOcjC66 zb^<%0qN+Y@atOCpgxxqTIy%}|zV<++R3pDA6P~08M+B%Uyx9OJ3!nP}P#I^G)n z_7D3tG1rcSlozqE`jx{LDsd@^3P{^p;^nBi=Qhg$d1_H#k-PIp_=mTxzY1-yHkF)2A7m{B3i#YbD@yYG z5)IAXMgKb8a~1HdEbH|`E=8;gb~Ncm%6@A!l~!0t$c7n0+V^Nq$5vWZWu{uRlcw$OjCvFn74l5-B(N6TC!_5} z{llcF@fu|dpxYC#uNY!84(Dubs-oUCy@6nc_dGFV|B}0z{GLs@Ut0M>+_wF??-8zC zerUnkT8nh3I8XiRL_GH3vm$IFYeI!y?mBFE!|4-RtL_1>>~fPx`>!wp)%HkY+H#bp z4k*rd6Hl4P%|+HGCTjIe3`e%RZKf)(Uh_(Z1>_~AmvLU)M+_7Dki4cc+jVtPx{vJn&?#5{wcG70s~uss!C?5ZothFn{K&n zDqn{cwdikRbKY&;{n+BBxRy;dxiTr-_MJ z!*%jJCF{41jENN>||($Wn7p)#OJY{Gk3Hzfb5a5mOUjf9HdUES!CX*FC#%E+XmA8t9*_U9 zll{(}9Dk{%s_K0BV?p_HS}2JPXY+=WJa0Q|Z>R-Tb+SFhQ-SXjcVB7X#KJM@Z(xO9Q03!2 zuwwavgXmzq7iWap*vM#meO)l__oDahKulkk=?L1#+&gQ9K&Rr{E63NH_?v{lCGRU}o%Ts6f60FV+BL)ibQO(T}|o-g@OldZJsMZu2`$AhC( z-ZO1eE+;uyJPppr7Ywo|lcS@BD%B&kWQZ{9;HLg&vk&!JHyD;PRcQ~Ake>~Tncan8 z1@2@}^CbqiU|=vb7p()iiS^X9L*uvY;&JI%^PUcSE_Bq z%JaC#aj4xWU1M7%aYs&Bg3Y&biS46WR0`^4gQ@n7Da3rOACHR-P8C&U`#Fy~p0Uh_ z>U<^5bX}o_+{K=LxfsFYK}=*ZB`y!Y0Y^NCJx&S_?LnZc!_Fz4u8hkUpY#VjHwZ8+ zYYg?oEoLKQ0|QjTG2^)@>pTn;S-0=p9&PWIF;U3x3RH_*TdF*>_OTSli^2)`njN;b zTRa=xU0tC(Fz03Y)2Wb*Ad||==QwlFEqm+=|5g_~ z%YxOv$B>}+ev{j++sJQS<690o=uRyQ^{Cly9no5XZ-(8GMxR+8KOXPO-gyad|6E=@Vub7fBs2no0dx1EU+v@V-NQPn zsuv*IQaxdM3s)T+>Y#sGje5v898+U6%p}pso~KL6@@8sym}Fb!bggi*)^e6^MCln; zv6{Lj2*X^@I{j2;lE~#f9AnNNfVyREZf>ck_w%xPD~sEm&HeoIXTBIqOG}hX$4qT3 zH(G`2v4*>C&9=2()p}$sYA8m&*wV~6z7{`~R&pp@JN}a=Xrf+RZR69^Q*G}!uDZby zqgp!u+FN;bh0SV4m_jt757@WC30;+~_w+FaY( zUs;jLzTU#c1<7&pR~tFfn(Y{CO1nbs=^sT44VH=mqwL2jz#n2ISsHz*Y;);Xu+W9;#ws#DkAk&u(+V2$~l;b>WRoT*2( zr>!-6XS0GJU?=*U+)I~@PI^;g<)OFb+#2(?hH19Zwcwa+{0lsB`!bM{kx|IvrQR`R zy7r3oL>t0se3+dWU-M{k-koE=%FRco{NX5HR|cz|nB!mug^K6V$oL(+$XmF*0CYjD zytkr0Dgk^=9_Pm^B#7i1VKzE@23o5Rh<}U|)fvrGWHsZO!D;D;dxUElr{@#){lSQ3pcWb z8$VT{zkd|SM0Bk7rQ01*x5&fD>kWqOy{!}uu1f*^p`hJG@lT*s@ew(YH23@!Jk7!B z%~w5>8ona%_dTLdo;>dMb-vE62<1WLor>!=oT1sSzRP;gg&gr$O~mi@*Gj&kbS;#2 zbOT4GlZ*Ou`2@{v*!nb6cW2S7Fcq4P0vJv3ij;kV@=xYDKcNQfuiXOfQ;i`1Uqwh- z_VedJvkP7()c1Dg`u`tZ1n%v-|xZ;5}ccg)#D(#rM?9J#8fx;^gpyd zZV643>ly|IRMzJyPS5^%gc)GoF612i+boU#^y#_(2L-*2KVRt+N_&f*TN^jihyVIB zFL4!XpCK{Azf?n?VsHL_`~Tfo^Z(6!e2{)_S9V+|f9nmCz;`#3irE#d{b!Pve?}Lq ze>b^D|FOtCv*qs)r_~AY$MX?r^8^+Y8%ixHH4}^u>;3&=?Z^*Xp&b6sZ!Go6KYnIf zcM2Z|+f-N*x2xb-zdfiN4a{=N5d=sQp{p*OJxT1v*ZdO}7XQKm%+fvw^1gZFmyy=OVW%_dWmmnWY8=%=<+quZDXKWDDbY? z{eU+Ljod^~@H0rx1BjTrOWoGi))N(R5{ixvIt`Y5Ou%h#>w~y=Q`4jK`9^?Em0u9O zQLhlZJ9_}9cRYui17#|=eE)R&333SuuS$x${|Gz%6%Lpxa#AG3eSt0hzS90sU!>XK zFv%n}kU>7ckA?VblgC9a6{Iab4FKhZ!p7d7e6z;dGXm09bJnlMyqKuLn9fwi&Icu0 z70RDf2K&aw`unr>d^u@VE#p~l7!ctSvkTmXm+8ThPkVmCHw7UXMDnFSxG$H8>cPs1duYstW_MEdxF9&b;8XfT>b*@^7IImUZLPJdA|A^yAv z7!;vdkPCf%_cOxd^F2+grL!IOe9c;`%BZMcQ;dsU9JCU@SWPEn4i_hi6NhyPvd!SG zjk_hjk~n7^$UC1-iPQM8urpiEHzcgX3&L6Ew7LtE{2448K!2#eX`)SNKnOzdNJ_-4 zwC(BKWf8|fVxoE}D~raZiNDR^v|B}dMII^vy_c_G;a2g+(Q9WDF52aJKH#@!u_>i; zy8r%g1cHoTwPyZ-&&anmXg5@o07+i>GImcLy%K>?{^>V_4T^h8qFO$J>8%l zw4ST0HriXSiere0S6KP%$DZZEk*d?&;O8F@uNmJy*XVsd*N#Oy=?T4*_c#GrLu2{& z?$!)wNbZf7fkB<&$y()R+Hz?yAXzc7=#*(j))5W_Ncv3ST93QCTiwRmdOIa|lRJaa z^l^2*K4r`y#U;|^`SvhJo?u#(@9ot|TmT9_*~b?>mW@zaih+)f>!mwO5YLGHM(e)X z4#IfFQI!eIz9;JpIu+3uTSe*Vdb2fj01E@8X+>o@&|vrX^vMi%z4Kl^o^uU(E%I(9 zEBRyAe~DO-i6nBU@#<9btX~|bGJ}wa+nY0#C(j&CY$~g3WTYg5gMwz83@Nptf!0IWGM+G6{ktO~BEe@8EFu-K+|S=QJ1|R^bEt^u)Xziw?mQ8GK1r#Ek^ z=*{$YXhX#R5t965n$BK|XP}1*OyJz2GaPrg&=_Z#gkB_o-Y^+RI#5thjr+bAw?$X@ z2OtinUL+;t=PyCVSj}hh7C$XB=z1xSDgfD3XDFeJz|#v|Z;0KPzj8sHMZVeg9f>c} z+1_Msqfffe2eEkN$CmPiD*YRSx=p5)zY8eL$MQJcCzO7cN5Y!*uWGgHu`troj^?hO zV*aQFnh7AVXwf#GDd*te;Bwku3vk$e$!K)?c-iz#@teGpQ-@MTN{^u>YYYq`W<$q4 zbPlIJ8v$k7R5U}iE`@OdiD@wX2PS3O5&At z(IQEB$Cjd=1HGk#SG1kN2l*^Th+$=vzPb#?MZx zT3zjq5F++~YaZ;lwq-svER-sE@SKLOreAcBzWfJIepGTUa1^w1M~6Ok}C7{ z7^}a3i?w6UH;A~oyUSgQW-EWD1~@E-9``{=5zv30+-Z1h4Df&}3MBMMK6Zp|4reke z`geqFqv7}T<_AT1zjGgG)s(NL&dYhdds)6XH9ISv_>OH~06JdC-o~ysGe%UZ+bC>U zcA>v-Y-re9|L*TIEO$O2L4HiFU#gYAvPL^8+`(o!5_y-x;VvMzaJeir&~h6{uhVpV zIJ}xGtEdBUBUn1nWNvb6bfQb{<&;Te@mk_1hjj=m$8sw|OOmK&DT;m1^2+4VM zz<&I}O&IO|VGk>#TU6NnSzw4@f%Qy$JAD7Unc=!UidnOXR3zlK0OMinL%fT5S^EvC z4ZCFT@9(UpmhNh;MESmi@HwtStIYxOlRtM|E$RCiiU7MkTwVnT_j5{-_!ISjO z{mpVkGEvXY+Y6vg`xOwz<6^@_UV}{+9}|;2-+Yq>gb71=0FzJkPT1etQen&z1k`v1 zd}}b4t8Q~nvj@jYlI_7_^9JHVJ-+1pGFfMI64N4TI?r2|%?)!BigR8px*0W1c2fmD z(u{1IhZnQfh{KDUo9@lmD9a1snOP(;8gg$M^lt4`K3pSSlZm2cr-(*;YjD^b+~eth z4ee~l-~+5Id*qw#N66k>cElyc_jj&FZS2U91Gz8$2zhckuTM~cyORDB&IzXYW%!R7OO4Slm!gn}j!Fa58FIQD(UQ<=% z2#IUr;N#aCo$2R916cvpH3mqkQEGX7RfHzW9CqJLgAw9vOy1WbC zJW~KD%J{fH1?u|9wL16DNRP?uiG?L9H*?R^Di^$bxnyi?%%y+%BS#wFVTV_4fQC`2 z#N2ry#M|(+*TuC?x#;CcqiS4FjL@%E!5rz-m;>VvttmY2FNk1r25D*g$VYZbfVtl) zt*^%=?=@($cf1wByv-)4w&;e&6tcY+77iIB%>)O|aBzEPNNjjcR+bG9AQ!b}%DMT@ z#6{0r+k01-gMu4ID})6!FPt22pvV{gPtmb$&m_MlCN=If$Cqvwi@PV#w>&wHw4aU9 zVYHpCIoO)0&dd)I4>1a>Ik4rH`A*!_f#(Ii*-v;+JSEbtG~4P;o!S@6oic}^9}Ae73Z0ik#qztNzt9MIXMXGVLf$?J>s8GoJ6u8D$wua7W9g za2xsyzyqV+8^HnljtHW%7c_y$W- zS?IjzrWEG073XX@SJWx#;_tOn4t>@9GH=Eg=?R&rH!N6pTD9kt3mF9WNb-;)2$JhYq`1ZK=0;tyO`D7$Tm@= zE?rL@Gy8nGdVF-$a70x{R20GSWF1_ggLiXul6@^+M7Y!^MQ&dIceVwcA8a(UYSb$T z3uHd-zw$4v&D@u(qlynjE{6d&92t#}k`E{zkMf2WowrAFMfy7gezN9;1Sz*zqV3B` zC}Pq?j)4iaCEVpYpr)zL#PQNIze;8JS8Kc{V1aLYmIN^Xac{Od1vbgYGDs66 zXnMH-ALvi{6!|ollx!Q9SHH+5OcY^ySzNq3bTR7zmL#~^ikwL$#ZCrw2>kZNA!06F zT)0$jMe>E^+-He2ZuiA;a0xoFGviQ^U}k2nDpmSkerPN+qN{0naqvDnN zxfu1ff51!meTKlwuTon7BMmzDw&0gEKY()O$M4jfJI-6Q>(YAv1Y)S1o5b4dXP%n~^4l6NKiUv6wH!AC3Ng zQu{9~Ac<&feBATm9E365_)(smtr74_?1Tg&0XgZi4x{ojXDabb5y$q<9^INEtG}&4 zIiu~VsxCxo?{NEAs&sQ%WrdigK>~E*TExVdYjW9+xb|EsZxJU9Eos?|(&~C*Xk=1Y zbcVdjzkmYG6{sQx=i}8>Sf-}b&^8xCb|7|Zc(esn{XJ(Mmxlt%iZs8stMSDnT>a7K z8y(T};~C!$K~(6lUNZuP*jc3Rm*H%Cq_2u!o+&mu6~BZa3Y)UVL zDFPEvec9pf{L0c6D^4b6=8!vu*K&VJ)*pamRePXSZ+H8GuWfIlm@MW3Iif&~vCgf! zM~dve=WLrD4oi|Bu02o~tSevC&{SXJYR>qxgg0qG=Ao_6Cpjg6jKtHto80Q*w{>f9 z11&%7uJI&d@ouut)|1}O#)%%EQ0KPsNv795y;)l8xz=+g#Y4r;v%Su-U1!wB5&dDN zPOlw^FHMSq${ANDchP~`+(8UNpgGxav=gZX9Yj82F9poezww8x{QtopzV%9`mzQ_O zOjaOYfVlGo>Yj1aS@rh_V|K?UBs4T|jv~L&cy}|lWk2HOa@ESn`3l%*yPRJT@p*mc z*|6SDpDxj@&2rjHR8ffqiVO!*OSRhQksc7Q2!ZiNn11h3-JPos(Gq${2ElD*H7Wl% z$@|sRN(*upuFE{Mt3Jxn~Kfj_~(%JLTTZbmMs|H>ZQ+8*R(mg=-b(j#+5 zJ75jP++65FQURfF>IV*de|N4#=!pa8XNNH-3r#K;xy8sxF$$Z3mJvWA22OoeN9 ze;kbgCeK_C!Fzud;0q0Y>LGL)GeQyTq}LAyUCC6rXNYBE&zop8^^zjqr*Azs7kaHZ zLZ-tM_pM7hktI^i)l)`h;CubkL5TtyZBmJ}%UIaK=*gDo1BNAd9>i*O;!ac6xclZu=j&~*}0`80tMuad52zcXeAB0ajM zQ|DHF3k4Et^9hS0#YT$NW;FFQ?1%pot}*&y4s)Ochnk+;RWJd!Lv(Ns{6i1i(kD?H zE2?d)zbTo$Q@OSR8J(O!WbRAmuVKppxjEUW_-sbU5sT#y-+8T!0b5r%(FH0&&mUe9 z7+25zQH$A1cm2A<&E9NXAB+S*ltGzia=b7>VLCpVD^5SBSv zG*6{N7uewG0!xQ|dI2QdbgB!D9q@<+0zMo#sglTd)?a~#AylB5Y+Rz2} zxBzGm)L6hBlYdFdL$-Q#QWb(zYB5vAs%|pb&6kZ_tX<2o@8yv@u-Dwo{p#NtH`JX; zL+CXP;fXFSR@yf;c&}`Kz|uw9zp&q6Xt3MsC?mPGv@8bhlBrx-hEZmP6rLm=cL65Ji1XlsD~|A)|1c=wmk8}6qB4n`@9x#3JoMMaqT zut3nCgUlobAcAT`jJ1t2Y2j>BUZHnFx4Du47njj>cJ6XV8J`>4#gfV=waO21)0m~^*2a= zLA=M##~y&xo;f_U5BkMNEw0zZT-2}vRwjLhW=TnGf`Y=GnLHx+PYl=$-+2sdAWO(T zoSd9F6chpici_&rG*^8L%P$!Kw2ew2(j}6vNI};8Pd5 zTYsOdtV8I}+=B*~xtWZ94WhtZYRzex0cgbGi-|}#fJ7nCgIdrsenGJw%cA=O&{qpQ zSvGb`mqsn>4My{JawUoyJfTHuL&BSOS3?>%g!^$Z@0aSdJBNdVliC><4gC$hl6;Cy zZ$4U+lvrQ}qH^KjaODIq6YS@$R^a(s2E>|Oqq{eztKsVpbO53BWuRWBwh9OX;4b@1 z6+7?Wo@T;Nmr4H04EH{v0uIjfu;(wS_J5AA0siFpqX&$|N>dzvK9X3d9PK5#ZVaHy z|3xv}8RQ&n4f~tHxua1CRcNX}tA{Z~N_B&GB!1-4mMjx44=pkpKLT z$230wkYsRO@YQnvKc&$AC-h#vLQ&hWEp72fU5U<|=n_k6g3ND3N9)Z4H>ac}3 z8yu;Go(6vg0q&Su{Xu%ZRek_P!?WxJwqe!@!w$oEciink$*cI21KQZ+Kl2q_!;@+J zLBChxkv8A0LVuq_|5-ftDC6+x8S@8gJHG7ozmMS0W6E1C)omyV3Qu`9>Q;r}z;k-C z@Vgx6U-tS~^rN8U1gm_!4ivvbr!Tl>D1S#@T|%%=uD~Zq#xxq$%il>X|C-_-2Ytf| z(es%tQ%yQ1yAj7X(p-Umr=plV;NrAz(5LJI3jUoo8!Hz*O8d82&LA)%Koalp@6+C) z|1jbEf4v1>gW~U4{J(v{r|Xjr4P#=i0Git-G3jQ&ETs#<7Cnd4_RPQ#$_HiRA36IJpWEVx^SiAV-2hi7OeE z#l~R&bkmMm3q(8ocWJ=S?2B;Eya^-Yemn@Vz?Z>JT4u7pK>MVkW~ z1fgW9b_;iRYt-$!|F;%?LtsTe8_TbBKImv`>j2$A%^x7T9$bsKHR`oL(+r!fwN}?t z96$H^4{8#L=Rc`QvF@XPm`UZx%At6U73c4YV{&_+- zY^UsGJfp4P=DF6;jB3vtwC=kg^jYP|?7V}#t8(q+ucG)(B8QF z7vi=CuUiU7V10D5vwO+4j?ZB%j8;$4Kl9{nwn3S>Ll(x^J|Esvso#E$K`Hw*z@`wB zh=>nRJv~x;^MyOW2Nho-_}O=&NT+CSC;1`G+=6#(5hku3scdu_#6JcyEIB z+r!ZMN~5Zf-J=y@8roweyPC&CxFc262Uaz(rR7g>_qAQI23t3~(&(YWnDf}*Py!z0 z`%nV@uj#F#dVsAx4%}S*7Zv~)jG#o5nH6k!`*64UJtFUb2ixjpMVvLWFs0M+2~N_> z*T<))WtG+GDIYs!B;VL%qL&SS^!k7&Iw-kpBKKjf099#4fCuoe+we0 z)0VF`Bge-#&rzV!3O0*Kte@Tp{%Ln|{E~k-%|}%4D|nWl*1=Ao5Er?=0)Mf{bp~K* zo^J(_TN>pY@EmfnuP0A3E`Lu@@=2#do;^F4;@aFk-p2+z$b#fd!mn52=}*{FQHn4I&i zaYqol;$)=@l7)jXIxnoWYArycPmRD}dwsm-kt3b#vH9ct=>|-@T7UT-_2+xC`VtS% zX%COXed4rOQzeA)Y z&dA6hnaA134cwU4p(IKmNu4hmM%o7y+khr(vP!mLU_kS{Wm2lZd%k(ED?GSlxD0xX zimKBBWeBdN_O!Mzcn>3B^jKOCqXppy{**goj4L-!z$GhrLO!pwB^*{WASo&PfI_rd ztci8U(DbsSSMma9(Z)b8C;3dRxirV)zx1qfCw9>047uHK>vS02grl=F>suCZ?L9kC zxj@!$OL7a-m7)*{{oD6VpTgbe4&W9;cY@jZTsE$JXQ^$+?3ai8I}--qcg)~vveD^A z33z==&6*2u5aI!N#8i!=V`sP}YXWtlA2>BM)K5nEb7fKt$#K?h6~EH-YpR;i?VZb5-0 zMS&?b0=HRjTqzL63}<82;?gZyB_WN;t|z32MBm|cwUUoag0*;rZx~!hU2rx(N!gxYBf(kWfecl}*YaPrHr>i)|tT!Qsxhk+dJ zUeJ&FjnLbw`Nua{GJcdh>IwPa1XhMozsuHcuWHHDk!jKJSGk{3Tkn7t#x|x-ENjS# zx*2oYfT()KWCh$c)hFzpV_)m_*@m6*h|v+$@E?r{xi>?Gl}4M(>5bZDm?{1Nsf0NbhuHj^l$Mpe&(&Z8hJ( zkxbK?nfK^hhV(YDrAKnsh_zAO&2BZJeY<(KJVV^w)8lnYMa{-0bNIPDBf2ioWJz8v zG^GYEO$DU1#DltsfMIwYiLYFC?k3|qD*Jf|tW3Uso8npoz+qE1+cl2}+7;EGKo=9`ouY#|^L;3k$*{-d&R2Y9P-}2C z%OD4FP=PmYJL#qQu<$m~(#~ps;lcI~pI@JSQh7Z&J^U{8jhnBl&rna*ee$iT$#?Un zr_|WZ)Z*N*?<%#PqxOifr~WlAha_597SYks9Vh?#!yytf>mCu`&J)%X5nY-(#^VMP(dQA|{B}@Ku<7ybY(6Uh` ziss)FtYJ^)sgL)LHY;QY`#kUhU>#Wi8i2F}fP(rd4_p$jBhy;6;$Yw6dJ31b{2dYS z-kR^f>Za4heTnyeK6>bb(ivVD@(ux8i2ww+37fd*XjD+P<_jg)deZguNJeu8XR2Je z6cJoCs@$(nPtFWK8vh#m0WKNb0TESUmuk4?@7CgiEXg$9ZXr)SOV=2TmHFBvA_2;P z8SleFhE(U>8GKw^Jv0500>jE;O=k&cG4#F&>Y}*G!{SQEqP5}4mFb>M+zG+SKRU`V zJfo&gWx!@?q;-&stR zJv)2F?V^;WtgLML^{p=7f^QPG!}Tu0Q91A>v6_y2qL!(5|8l=quH5gHK*#N09Rrr} zzR9rGFCJ%Eu}jNHCNy+Q5%pI0^H=fA&UzPw@Ux=lq2Vo}@cC7GV_hUghnt(5P_|VZ zdiBG>Z!!36R)*vRYteux^u7(CBj7x5AiCfO1}DH3M(ck_L??oA(5-=3oP3{<-i>J^ zLj$Hg{;ge5K`0CcVHg8&oPnE$X8YNNgbnbrs{hP$yq|toH%Bdg(8Fai)gR;$nB}F& z;$}0FC7l!N5O&k%Chqh7`S;?`PjI^K?p*NY3hK;?iaFc@;6F?2g^XKiy4ABBUi2e1V=8Xojz9g!t`9(CL`;q)4t`;qCo9~ne2GFyZ*3LZ=OmxWu_ zm7w74m1#WOjP2ql$QdOo!h$#a%l^f=^>A`-=937-GDx68dF_#LP^}irFD6aB-|n3p zE(?{2Mv?nPvoyKxuz~JHc@*>n`O(G2(lIpYp^Jp7n2;GB%OBa5hM5?^4a8OiH&%;@ z`l>nrQ3j4)*9{pI94J?2`xS52?mSDEI}vJjhbF2faDT7segpvm9jqsEDhdwE8@bo(;`*zEHav7|Uox;( zc6!~*{a473dVC61OGz1zso#M71l~Vn;VMK-N{<8~5R-I&re4;C>C94oCGNtpUNu>G z>^FO^I_CXB^97WSLvJ7XA)D-L_D-mEt2iTk@7u+5Q8gqMUX#G0l*O|)psFAE@o(f` zjymb^QZ($gqv~5&*x9GM=DIst)e=V323zLsw~%1S7dAStt1F}+${>hty>c&(3Q9il z1~)htT9V!ts59%ZeEXVG@3cpeL%>;Oo!M)x?>@+z&v0w!KD)3`0;r@SDmvkhqG4RW z0O=x(*OEJ{R2WMWKHZhP>8@J3kd{)SO{T1g9+S{byPfqmUr-Lj2RD4_2qo+Yj!$lM z9d`f`bs+qV2?slc+fgMe<@K56a18Av5syShiq$-4a8<8rxxNj66cR-42f!c|oV2cw zA7c&iid}uT)BF0fKvq2Z<^RA9mJFCn;QI%v=DuDUPdiOi0KxZRo6-6%aCk_wqWkJ5B zY&d%7$~_HP%?W78l~!+7=gtyO($PHY5MD3ng$WPay$KSeN(zv z|IiX}@R?;p;Hk(tfJ)L;{beE>jcRhfAoHRIsCh~k;{4o3Vu&+67ykMW zPwXd0MKK%iw^n|mc@$>?z`K?;NCA>qR)v=<9ukA*gm@X#y(d-11Fz>tiH;DfIwC^) zw>|O)cWe1k?}8PUL7%Q$;ee(10yp1wvjlpy`FU;Xpf`6> zl(Guz1Dbh5|J|mi5Rcadal})sG-9Ps26|y?+^A;ni#x#JI;>CTYmfHLy`eoRWXL|5 zr*~u!E*6z8vjWLlIZf!nNb7?)rAHAw?r8h-&R>G%;tR+rc=thZIhG&g+0@(-aie0e zd-XIfK>;W?60UCM#Q8$YD=U*Pf5it`ps;hZ(pgTGF-Cbq!?E7ATc`aC3t+sr^$kIA zV)~ixLK;`tJ*usSk1%p`WNz%Cb=D6b-hu!`QNV>>N#1jznv_7&g-qn{U-uY}>iYTf zp2Ckdibv~6F`%qUMaEavo^I#w1NmWpy@IG9KK_5@6~u6)c;It{pRmdI;XTlW^~PM# z>n?Oob$yYbL&u0BqU33DTAc_da3^Pz6wdyF>7g(H-_8`HCPiCc*#njH|H_Vtfg>Sz zt!6P_6LJoB(NbPj5IWu<{O?>P<-GBK7!-k4;gG5goGXujQHRyRS@FNMcUDnxHT$-Q z5TXzy5JDhWg1Zx(-~@LkNN{(z1b6A+PUFzQ-QC^Y-L=uPAlcvf_8oiQ{c_L48RM>( zFuLi*N>z2OS~chV{Uhjj^I`IOyb&8^_bLa(W`^X?`kPpj7^xl#7Iq1u5Va_DdLdEm+tTRYwKGv}V4z zG%j z$}WH6v(8t(uip*Yf6};zr%FYXAte7=WT#*?rvQ8b@R7)CkQ50UVtTg2MIWs`Iw*E9 z2QlZs>`?Yk!M6`mBMiyMXU~qug{6x}p-ZEmV?RTaZEMccjbfX=&h3 z^Q><`v-0MlE4*SQJ;&qqS7}Nm| zvJp2YpbK^!6EN@JI=$bPX4Q2RRaph9gia>3N=q{RZcXSgZTYz#VPIuJfsDcXc4^jN zuuUl*OHX&-%?ZQ$a72iM1XocYJ5b&eIPj9f-~Nfyxnqlb2LI8uk{|ysi`M-cU9i)F zwzrtJr5=b8X#A(Et}ZD&8xe^!KzDG2dByXYy83yWUE;g|60-^*j^Y0I(17T3j#C(*$4bvr!&l~zp-2Uur zfBFwkuFx!+v;UPDzX&J*_4C6ALkoa-Ue7NEI0MN+l80A>e7ZjURvG`_r|mvB&ANmj zT`EmY3{)$ z!$|0&EbC=n!_N}jnQCdZMmG*UgfCs9+O3nnef!yZzcsk;u-sCN{~X2pC{F)-$3Rj- z(j4)y5OCdosDHn-xoB#tX{u!$854F&$FabL}o#)7#9(!lKSSFx=$$ zc-K9RBdH#Cl64V`q!`8q`ti4CjBxmKbBU@9La|H+EG}z1Gc&646S|^z+5E>ugM;U+ zcDvm$-2DI7jGiWZng>6(6t}}`G(>@UfEd^W#-P@?S1e_+QK4ug9RfhTklTYB{maU) zzA0fTfa#w*IVmpp7(o0gc6#c-+%rR6$H?=*lL-dpsy?~@jLNrr;hdiA8fR9eTXuv1Wc*mT>rFFr*l|okqG?>6_u(+?=icH`1 ze7&=N>%!FHD7*|n(k4)^di&tvvERaEa^A@vUVl;XjARTT$UOQR);d|YukTybEj`3o zNpK5DNHoM0V*t390tjS(Z||Kv?L^yHEbM*M_(Dlg7{Y&JYk7`zI^~bBgQof#HigD9 zi`k?r*Ujdxu^ATD70_4!np*0jJ2DJ|cGHirlXG=ZW5^uu98fGBvF4u@D|woCijUFY z(R?DwTEF~A2fx{;Ch`wR;k}e%xB%SMxNfnI2MhI{iy^qgNj%)Il4m8e5hT9pL0-Hv zC4hTPFYU%z^l4YD?4pI|RRKbs{zz70DG2@4c)HBTsZBOtxwGwwLl6vMP-do2LO$Xt zHk++7a?W#r68`NZ8dnik|0{|lUvylI1xKZW1HwpNe2Cq#ZcrAm_YBu`U$mO{Ieuo8 zrY(*V01P&Su{UOn)J=i>~j?e>!{mLUY>l6CPC0Gk_7{edik z*4`|a)83LlXd8I)=vbk#>kGU*HPooFE(Hv7NB!-SmB#ytYF(i7vlH|F?%n_id;4?s zo}yJFnbmGm>I)ot1_q$LzO9O+P*I87GL-?mx(7f8<~p@%BA^=Ee^#}pzkzdhI^DpQ z#UJQwyam?PGkV1Sdr!l7z6$;#$Epqs69AojVMh@t=jrowxWl)pHtzvL;`EM zbE|R~QVKe2oy*nP+tXd-E$Fwd9>9$EJcN#xX|BY=D>v85@@P0X!RbC;HTRgmpFB7f z1AcILczYhACuE)+=M$G-YNI7BEh;**M#;80^wmFfeT`^>3)?iGI_C=9Yv(I@ZD6_h2Xf+qu%sVJr>bT>MyerGj&~cB&!G-a91&a@XHg@1W z#|7urIeOlj)>sIz(>GIyQWsAz$m^fBJ4TYY*Ya^prE~Zp&0DHjuB?$YIFW`T2M$)QRp9W zL91JI`ZvxYHh&_3Nh-=plIxqB>Y3sf$&K?OxuyjIK{>!PFe4qq(k=NMU8cxc<~9B1 zT>diPR<6Y8uSjT^rU#KxsgQl@*4>FlsdcnP!CBJM*^nOdJFE9dSp=kon4-wJ`@S8g z3e#>!z>qCHa?o!6{F7=_@>ce<^P_Q@e36N?47X5u zM~++*36?}+jASq=_$xd64EFo?iJUjrc{%b4<15-{xe9>i5d^dmzZ9@@c`1ng-cVNE4DE-mBsB^DpZkC-^>NV95R zPnhlO?h=V%V*$LEtx>EZ421)Zv%lvDwPTyN6(B&_10!z*v+)8jV6hO6XhXuj2x{q# z{{xH`*sqPgTIy5+?MOiNq^oVkM9gI*WJeMl+$e!Cc_L8n9{ekmR$Jg?V^GPt?;h{m z4uu9NkVIU})lLw1lJ4#G{ScW`ucwmSZ4}v;{={77cuF?!#_aEyYBry6HNFJYaQON2 zjqELr;|Yx)R_?1#329To+2;sHW<%-fFXsNr2zdBpPG|H2LDs3vsaX8c!e>*RGMVCa z=8Ika=m61wsn(@NAP5^(nb!U!OVgTE?B4*G4W@sGK_Amgom_}t>}68M$q(`0wC~HX z+3Yog9BuUHy~_d|Nd}z(kXj;0!Mf649W8L4yCc=BxVKj{iOY?rmCpLk;b?_)m$0f< zu*6^vY~>^97c!nd9lxK`eO7JeIeXum~ujz2_O38*`y|q;yDWPt1VYDXIx$sr4_O3vzeZ?-LyPOHgZ6QrVX-cZ4m=itC$d zjsfP7PjF5D8NMuxrtt9#5`C8@I1%tm7d}c`9|jVcPyWb;oZpTn|B6dq!=}U^5B>{K zG->zQpIqei@}FGfPAj@|NdEk>-4?oAMTPG`lHP3xqHaKPlvO7%3C&u6Co$2RhyDaWIGaOJ}n= zue>FH3%1LS$6_-C{1Xs+nb1~otS`jU#>UuDIr2?=30P=1ofZ48v21#*3N%N{Ef&pB z&g*U1E_qb1v+39G>vYKStOg_}IG;>pho#jm-#RU~Z3>FMg~+naMi zwxg9sx$LhOJwLI|eJhQhD)w?QGB>pys1KukZO28aLYLG9mo00)bAfx~>{20Va_7-Z zupb7j&MnbvN#54ae79}=9oEbkU3+3#dhvf`HN%DE?x&?{U|JfiO&`d~IUVEMdCytT zezdnc4OkJR^IC7lCp$t@ho?%7PId;NnHswBTyDa*4sWiDq%Y&8M!&11RAyhjg+-$> zfylNE4OFBk9)FJvRJS=zU#QQ$*bnyC-@`J@G3zLab91LYKkD&-^MQvm*tcMA|4lVk z<6{z;ovXp*=a3`wvg9R+e!e*GY_~IUe4t5y?jW~Xe6sy^#Gg(74({rptTmohV9;500D|w`jswwYb^tN zQbDOP+mM=;G&g5YCBn~-c6>OM|F!=Uz;ZTGd>;Ca5zB6C%C5ER6!3k>-a?ntEi8ex zEqr}mB&VM2>4Lnzsn^j3%)na{YWy9Q$~srl!IIX>mI=X4>c@9M4u>nsmY?;NkQNOP zz5w-$l&|)WrLhz$Xq=T5l_ZFgF7|JK(w0qoJH(kKX!A>CcGw2q1uxw~aw(<@jm&g( z9=Co3%vce}=>Ym!PKeB-d@3Ij$EC2n8L?yFKz&` znzh1T3dBv9>z#`~hK3(O2}PNi6((br{QKHRd%dtM7n{Bv#;DdFK|$iocH>U8=P{!2 z^V$O50zhG!JPk-$P!I@E?Hk91VVRlr4!tsJMKR_@HOVHEEc?>gxwumio{>?bCkX>L zm7kP+(^U1Y-!b^7Cnu#Vd%NVYQd3jqR1n=!t7ZFwPVb|nSWfp^Z_G>uW^1i)R@NAb z8Y(J|FgD}wM@}JZ{@g;{U81eL{5->vysgzu^=#?Z1{kiX!vB`d!E&|)#G_P8z#NC> z?T3IStNcMdneVCBZ7hIyev5alUV_?g2UJ0bWNda36}khuK&Wsi*5|-7o@ay~jmrgb=g{ld^$x_rhD#9OUjWRrftqc|iXFZ>55xpDh7wumjjNxs)UiX60o>HZj_00DC* z#IzJ}-;xklE6dHT?<+tdK5A9grE1eZflYy#$dr_tSXmNmt(?%Koyv=b5$b+%6)bWh z+)wMvJ!U8uv(@J_X;S}4rhbExF5sl46|W>YlntpoMR8WArl6!u^2e1c;#!UOiz40+ z7j=ulr!`stqOD7C5P)cS?g<7YBVeOu7guCpKs(VJm)%)*g+V^jvRXDJ2oR|wD+(VH zs~$tVfC#^EX>go*yWb9Ts{#iQ9m4A0p(0W&K?5+B;3_|oss(yN%;D+i=_+vms51|D z*399z>yYQ?J5xfNU$>GtoHSKcYdRk1%2OfSRC$sN71?A0aeXwk0#pnyTrP;m;Wmlx zkkoV32w^W~X3R*=7x3vV>eBjhqmD*e*Sr#~?y4NTz;~X2&h|7m=;rFIq@?KCGm`!l z`Gane&A+b(D@s`L5G>8nk&frqomK6YOFA0l6eMnEveFXw6wD^%tqu>%Y<<7TD0!*1 zemTxS%og%Lj7wNhPDB<=@y*RGW*@B^qy*(6dgTHSV}ViZOGR%bk~os$;c3|fRmA0-FQAGpj(xR^fK7+VL(wpMq7~nqvt-YZxttB^V zZL~CC>IS7tNQ95UR6-?R6crKAa35%%P3X*Dhyo3*2j<|+`1gtBw?9iZH?ZNJD7SPu z^blN5Rj+d(q&qOMy^QfW-?G1aiIhIgS5Jmm$CX?u(BL1rrUk+AOH&*913f^(m=oiVyk+ENe}@$1IzS8MXO{FUUbZRzIKF@{GUG(UX| z1Rlq-U#nM2>(5Rx0yh>t@vBOUVOxTvq7LENY6eo$n8V!sObQq(G15GDFjY=?_z}g{ z*(_kS0@+v(3=c<4EGQ0Y{NNM8)i5*bPa={?PQ0=}%KBOiWI};25{d&kL}4F4M;RE> z{7t-bv))53jE0O<9ZnZHwUxrMzRXm>;?goVCs-wd+fcbGS&hJeVJ76O9?^@9h=zkcNi;#sIzsI)Wbii)ZPR2*tG1HRxo3e z`HuxG`;LbQ)!#>>d%^*z8PyC?gBJ#mgVxm6##z4oJ%WJgsP33;!>H zm{+^g<{A_GlXmyIHIxx|YI<6V^i4$bq*cvS=Z5fP8XKfAk9_>r$k8_!51)YoC_4{% zg-(UsHU9FJ8Rm_K`WV@Zg8Q6t((nwBGv?8*!^Xnew%t{xbp?kFZ9$P!PH?(c+JjD- zU+};-H5-5)TmyapR`Mgq8Ys?Ye@r-ispb_XvfBh41eMf4 zgmYWSi>oOOaDru65@(=*$mQbM4Qe{F$p`LX)E*Jlw1uKd?-YNaMzYm$-LQC!{qzS_ zFm1R2MoHR3i)?AIYusT#JUTvEl`0{XKNfQu@Gu8X1eX1!Wzsv#xp&2O#0yf9KDh0~ zlQWYaSEjH(x+52aas%tr+;g+h+TuAJXqk9TVVlFwHxDOC1z&XGz_CA+EbE>cj9NR7|q*P5+HPU_`!IdAy8_93-93yY#*Ip}f+LNx{xf^6;V#*;N zINQc3UEEawijQHVp^=Ooe!FGTO2bmiF1hU+2_wmf8;n zX~DOcw4HR%PaedUN7-G8Q&Wkb+MH6qZEx^>yT8$~Q$GcrFfA-m(5)Z^rEN_M(4 z$%Nyw!Ysjgm=%pTHo^ZxzX6ktX)$=(4CU#be<68rnqWwrgxlA7;D@t3hh?y-LPln; ztnsJ*yHcBOOga|bU94RG58v$zZ>|KXRax$m?(D@)g6v>|as}9z%S>?ZRws#D1abv} zv$E=BGE~nFc+a_RFZR*2arXfAUD9~fJ@c0b;y&bJRJ69@vb8>6zC9U|Q*hgBrr^8k zo79=;aEZimSi|H@@&godr^FthcvKI-j#r}WK7I^Dvm$L1KsvNayts9~t7XJbunSHt z+K-A;GvqDYR&U5rF6!f-+Wm(wz*a8*^1h4x*1Dq9UDd7&%^R;X6IDrFg;32zc6>FF zX5986dnyE7%w}_Y3%Lu}zj`Mu;C|Vj!?IuqL+}w!&Jx&+OSF(u!Grz7)kU|Smx^{& zfFVM*{gsHQ=$00pg+4(rmu`QeL+eQAE$nSZF=lmWxaG>UX}jU}8SX{h@Rs+bcjSn6 zl-OJ1+czj#+hItebrUtad(~zy5ud+dGqaF+$pzIJ_Mg8Kh92$+&74jd8SPgrkMVq` zg09cI(O}0+u+<$bZ8f*SKB3f62}RdvfFws!nfrR^wnbO)Y|5 z%W-ia(klNdYp8`fBGGvZ`qa%S$-WR$bM2Y!ygvtN4M?!{a&cWO`oSXkI%)gW(<+*` z2wGTm2hAc+*}dfQT-?O82lhp$YE5qhWT1W#n_2-b#;d%kQs;eaZnu})M!Q!v{-?Mv z7OfrI`~{Pc+pAM!gs_yM6?*r~jY-$=YVoPb^6s96Ow)?OnVC#F?fiuo ziEH}ZPO+)LEV2*LQYcWuZrOVq;$XDPCSvyrTS)#~nxLno()>>HNRx3+aV{Zn;&|3_ zd$#-M+$Td>XLF%}Rx5*<05>=2LP|66BKo^`Gno>&U@*8OuO|7I`Djj5-Yj%dRU6m& zz(RhEx&C%^$W=_ae3tzPrhyodW30}B@;m*vOBpk^lrlBmJ^w+G=H zu7hDHngs;~jHQg|>*U>C+iPHYEiKiYuXUFz)fvrEJ{`5jr`|g5FHh|3sB-MfqtzA!paB(G zzdmw&kV(&=RIw%D3dfnf?^VT999Z#oLcAUxK~#?PON>MR)4Hm4iPx#xQ)rxk8roi7 zH+~u@(O0?INM2wj6CG)zwMPCX;ZFN#E9i?UE_3h6enV!|YJ9oAoe||c^X@OCC-HqQ zcX!>@`&GL;lkrCDl+wmU=8M;$5KcvTWzO>{ud(2duT+0fUGu`iY=CrXylIG7oSjFK z&sO&{_jYaPBtqnv5TRZ0J4|BE z5m#jsXXl;w}=uZx_fDd-jIDVC5lDy((p&>E8Os;65Z%2c9b#lNP zLa9i@#c5i>%C2VW+E}?`Md}k$;9$gSlF#RI_lU?DP{QTIsE}`sdq&Q@R!c{xhh)&Z zjaePCa#F;%7e`$?AAfFWln%+TnU?r~ht3IjRdR)|iEh+oDSJ{^H!JPQ$rL^iN7nV^({4)G1wY{PR?gb8G55 zEXi}E?oXb~Mg^-`D6&7avOkEuH;p#tD5LYt2ZR{gWGKc{np*+U2Raf4rh%@O=C>Dx z0{;r#?*1h_%18M3{|fp4PS1xEJp6)t`m+b}Gal*xfBU|9{!_CI*&Fbp-~VFmV2u|u z(mPg)n-z;w4P1?RXn+|a!mCawk<2Fe(RWXX$}h$3{iHaTu^dcFNIX;N)`&j-?{Qm6 zdVhiyNg1`9+bU*sYrej&6t6!+`{jKnr32|v+ndz5Zjmo`&bJz+Epp4OZiD&ng4P-m zA$6Z33f{CKU~yg!`8_?~?d)V7P8-$(C(&utc4TdI4(lbbIIc`A@~*9pQ&)jgQf`mk z+y-=)qEni`f3^XkuLm3*i{r3Ot+ifWT&f>OB&{WMPbO6K*35KI>uvZ}gd!)nef{d9 zrj}i|($RQR%E-8t=E2igTo7Z&v@P1@;c}SPzG=NU$61HI`fW*r7Hoh&K3CB(-7aWA zOiXSyufPU+S>PbkYh7DL1nc72qSMHl5Z9JZ!$nQW2(BuU-c;2C4V&b%GCqvAbX}Ua zT_=|f3tyRos#CJ1B7b=E`-&3WJ`3=rX+>4DPp_cvVH+PFCNF!(XnGyG_+g~}yC-i8 zB?HAwIOY{nASV4H9ZLU*+iZ!lMm`e-f#r0DM9=F;AD{M~$?;40$Ie%1DJjFc{j*1# z?Q$S=HR}2dHCdTSdHOd6`Q_#PfuF2qXJ+f;j3nn>Z_alw>F!j6wGiWsMwK3>9=z&Q zPtOHOHANjhQ}MD3W(xKq;69(8MMF^oVdeP}fSUR;HzzMIyTG>LglXe7HihLEE30CC zp`Je0;hC8sw*~IO*!8U~!z{xcErCG_Cf)0AVnN;`yiZRF`9bUb=g$#>_qe_u983V) z*@Pyu#<6s%W+inM_Ty)imrDfsNp~HE%QlOP%}W9}GglziMmMe*{W=|mAl)`OD=b9s zk;v}}9Mz?a+R&-3rVlL?PIfLz(uyRg%f3GbUDB?I1LG7!g<`zk|D+AdjX}}mb zwJFUE$$bAsc+a*CztF;T&-BWUIN_5`sw%{c?(Ipdmk-h&bw~fOmsj<>>1|oWQyT)r zH!G`5Oicc#^9dFC+1aEYWyd=`)iOkrR#PozYqeF3a<+dwTssppGoi`6YACs~K30EJ z)GpN0r!HM_J98InR-!Pvw{(l|;fn)Yy8jElvOzC?-}+e&cDV1J5=lbj6#Bhnsl7R= zHS9gnivEFwucGIkDBq3Ie=4S<>v>5(ED?n5WH3&jQ)#r7m&@wPfR|iTB739qIH#@c z$uKX0z8?__u7-&Zy?8X;=y<=`Rffc<6%U)XNv~pE8Q8H_pNqlmWG5zYAyjgh6!P;| zrF_CO%KHg3H1UvuABBm%w#Ehp1z_xXL7@aeBco$EK?+p|V=duHaofq8`Rl8zq$Y-chNK0TIr^Rgp>sc&em5ykaG* zuXSTgzh$Sme+u=}09HXB@}q&PM%%l~)0)C!LFm-OYsxkRB@g!tk(5I%rZ7=!O_a-} zrL~MPS3y1s6rWpO!4?CCcZ^vq#*VLT7~pZ|aa*vo6)$=C@(OZL&!bveqA_04sXrPo z?K-jq+vxi!w&J8dRYm2}o!M*2U+?}x8Q+={Tj*@^-P6;h^mdI9PRrZ(%JhnlQO^n( zx(`!Da^&WhckkXceMsYjla*>LSBpk_>%;n%j$Ir|RSx{!h_0>|ylME34Gj}v&r`ES zJ~s34dIwdW6fs3)e`g4M%c#5IYj1{&OS?KSQBfh42HMk!=fwX>4OB|8DAEtMvOAXy z#8~$8uJenMkjYC4@U5{PTD`K{rJ$lHai+>OY&$AN56T)Yh<*JAlW^+z(dA?DSWbEp zmWqOcGQ4qr4-Vr3IpQYLG+=OW=Y}_V3Tb0RdO_#a3yGB1b8^T^mFod@dQf*YdJ~f9 zmNwS!2254mf!cM^c23rXqr^~!UqnmIlJ2dfSK+6=&p3&R5s+xocPB(*af564#~z#0HLRdjMg!=S zf2F4&wJIz%*)dR!Doa*