From c1afffbb30dfcb7b2dc97755d9649920f65efbd9 Mon Sep 17 00:00:00 2001 From: Samuel Hassine Date: Fri, 28 Jul 2023 08:29:57 +0100 Subject: [PATCH] Deployed ea631a1 to 5.9.X with MkDocs 1.4.3 and mike 1.2.0.dev0 --- 5.9.X/administration/assets/rbac.png | Bin 272528 -> 286058 bytes 5.9.X/administration/users/index.html | 64 +- 5.9.X/search/search_index.json | 2 +- 5.9.X/sitemap.xml | 148 +- 5.9.X/sitemap.xml.gz | Bin 783 -> 782 bytes 5.9.X/usage/exploring-analysis/index.html | 4 +- 5.9.X/usage/exploring-cases/index.html | 349 +- latest | 1 + latest/404.html | 3724 --------- .../assets/Settings_customize.png | Bin 80977 -> 0 bytes latest/administration/assets/audit.png | Bin 66169 -> 0 bytes .../assets/audit_configuration.png | Bin 16522 -> 0 bytes .../broadcast_message_configuration.png | Bin 29042 -> 0 bytes .../broadcast_message_display_dismissible.png | Bin 30342 -> 0 bytes ...oadcast_message_display_notdismissible.png | Bin 30119 -> 0 bytes .../assets/enterprise-activate.png | Bin 39669 -> 0 bytes .../administration/assets/enterprise-eula.png | Bin 46384 -> 0 bytes .../assets/hidden_entities_platform.png | Bin 64186 -> 0 bytes .../assets/hidden_entities_role.png | Bin 60990 -> 0 bytes .../mandatory_and_default_attributes.png | Bin 76477 -> 0 bytes .../administration/assets/platform_banner.png | Bin 51591 -> 0 bytes .../assets/platform_message_examples.png | Bin 83557 -> 0 bytes latest/administration/assets/rbac.png | Bin 272528 -> 0 bytes .../administration/assets/system_settings.png | Bin 140593 -> 0 bytes latest/administration/assets/workflow.png | Bin 56864 -> 0 bytes .../audit/configuration/index.html | 3950 ---------- latest/administration/audit/events/index.html | 4041 ---------- .../administration/audit/overview/index.html | 4808 ------------ .../administration/audit/triggers/index.html | 4096 ---------- latest/administration/enterprise/index.html | 4097 ---------- latest/administration/entities/index.html | 4139 ---------- latest/administration/introduction/index.html | 3947 ---------- latest/administration/merging/index.html | 3929 ---------- latest/administration/ontologies/index.html | 3929 ---------- latest/administration/parameters/index.html | 4091 ---------- latest/administration/policies/index.html | 4117 ---------- latest/administration/reasoning/index.html | 3946 ---------- latest/administration/retentions/index.html | 3946 ---------- latest/administration/segregation/index.html | 3946 ---------- latest/administration/sourcing/index.html | 3946 ---------- latest/administration/users/index.html | 4014 ---------- latest/assets/css/custom.css | 161 - latest/assets/images/favicon.png | Bin 24630 -> 0 bytes .../assets/javascripts/bundle.7c5c0157.min.js | 3 - latest/assets/javascripts/glightbox.min.js | 1 - .../javascripts/lunr/min/lunr.ar.min.js | 1 - .../javascripts/lunr/min/lunr.da.min.js | 18 - .../javascripts/lunr/min/lunr.de.min.js | 18 - .../javascripts/lunr/min/lunr.du.min.js | 18 - .../javascripts/lunr/min/lunr.es.min.js | 18 - .../javascripts/lunr/min/lunr.fi.min.js | 18 - .../javascripts/lunr/min/lunr.fr.min.js | 18 - .../javascripts/lunr/min/lunr.hi.min.js | 1 - .../javascripts/lunr/min/lunr.hu.min.js | 18 - .../javascripts/lunr/min/lunr.hy.min.js | 1 - .../javascripts/lunr/min/lunr.it.min.js | 18 - .../javascripts/lunr/min/lunr.ja.min.js | 1 - .../javascripts/lunr/min/lunr.jp.min.js | 1 - .../javascripts/lunr/min/lunr.kn.min.js | 1 - .../javascripts/lunr/min/lunr.ko.min.js | 1 - .../javascripts/lunr/min/lunr.multi.min.js | 1 - .../javascripts/lunr/min/lunr.nl.min.js | 18 - .../javascripts/lunr/min/lunr.no.min.js | 18 - .../javascripts/lunr/min/lunr.pt.min.js | 18 - .../javascripts/lunr/min/lunr.ro.min.js | 18 - .../javascripts/lunr/min/lunr.ru.min.js | 18 - .../javascripts/lunr/min/lunr.sa.min.js | 1 - .../lunr/min/lunr.stemmer.support.min.js | 1 - .../javascripts/lunr/min/lunr.sv.min.js | 18 - .../javascripts/lunr/min/lunr.ta.min.js | 1 - .../javascripts/lunr/min/lunr.te.min.js | 1 - .../javascripts/lunr/min/lunr.th.min.js | 1 - .../javascripts/lunr/min/lunr.tr.min.js | 18 - .../javascripts/lunr/min/lunr.vi.min.js | 1 - .../javascripts/lunr/min/lunr.zh.min.js | 1 - latest/assets/javascripts/lunr/tinyseg.js | 206 - latest/assets/javascripts/lunr/wordcut.js | 6708 ----------------- .../workers/search.6c7302c4.min.js | 2 - latest/assets/logo.png | Bin 84136 -> 0 bytes latest/assets/stylesheets/glightbox.min.css | 1 - .../assets/stylesheets/main.3a36e643.min.css | 1 - .../stylesheets/palette.ecc776e4.min.css | 1 - latest/css/timeago.css | 15 - latest/deployment/assets/architecture.png | Bin 463985 -> 0 bytes latest/deployment/assets/cluster-mode.png | Bin 31674 -> 0 bytes latest/deployment/assets/cluster.png | Bin 736187 -> 0 bytes .../deployment/assets/connectors-status.png | Bin 116691 -> 0 bytes latest/deployment/assets/connectors.png | Bin 370468 -> 0 bytes latest/deployment/assets/create-user.png | Bin 37770 -> 0 bytes latest/deployment/assets/csv.png | Bin 34749 -> 0 bytes latest/deployment/assets/indices.png | Bin 58094 -> 0 bytes latest/deployment/assets/playground-auth.png | Bin 60279 -> 0 bytes .../deployment/assets/playground-schema.png | Bin 321080 -> 0 bytes latest/deployment/assets/playground.png | Bin 310983 -> 0 bytes latest/deployment/assets/rollover.png | Bin 92260 -> 0 bytes latest/deployment/assets/streams.png | Bin 41442 -> 0 bytes latest/deployment/assets/taxii.png | Bin 57817 -> 0 bytes latest/deployment/assets/user-groups.png | Bin 24557 -> 0 bytes latest/deployment/assets/user-token.png | Bin 19529 -> 0 bytes latest/deployment/authentication/index.html | 4667 ------------ latest/deployment/clustering/index.html | 4280 ----------- latest/deployment/configuration/index.html | 5418 ------------- latest/deployment/connectors/index.html | 4523 ----------- latest/deployment/installation/index.html | 5054 ------------- latest/deployment/integrations/index.html | 4350 ----------- latest/deployment/overview/index.html | 4296 ----------- latest/deployment/resources/index.html | 4123 ---------- latest/deployment/rollover/index.html | 4122 ---------- latest/deployment/troubleshooting/index.html | 4229 ----------- latest/deployment/upgrade/index.html | 4096 ---------- latest/development/api-usage/index.html | 3909 ---------- latest/development/connectors/index.html | 4907 ------------ .../development/environment_ubuntu/index.html | 4097 ---------- .../environment_windows/index.html | 4129 ---------- latest/development/platform/index.html | 4717 ------------ latest/development/python/index.html | 3921 ---------- latest/index.html | 4071 ---------- latest/js/timeago.min.js | 2 - latest/js/timeago_mkdocs_material.js | 18 - latest/plugins/social/layouts/default.yml | 221 - .../plugins/social/layouts/default/accent.yml | 211 - .../plugins/social/layouts/default/invert.yml | 221 - .../social/layouts/default/only/image.yml | 73 - .../social/layouts/default/variant.yml | 232 - latest/reference/api/index.html | 3938 ---------- latest/reference/csv-feeds/index.html | 3938 ---------- latest/reference/data-intelligence/index.html | 3938 ---------- latest/reference/data-model/index.html | 3943 ---------- latest/reference/graph/index.html | 3938 ---------- latest/reference/security/index.html | 3921 ---------- latest/reference/streaming/index.html | 4464 ----------- latest/reference/taxii-feeds/index.html | 3938 ---------- latest/reference/taxonomy/index.html | 3938 ---------- latest/search/search_index.json | 1 - latest/sitemap.xml | 373 - latest/sitemap.xml.gz | Bin 783 -> 0 bytes latest/usage/assets/advanced-search.png | Bin 25939 -> 0 bytes latest/usage/assets/analyses-graphview.png | Bin 612338 -> 0 bytes latest/usage/assets/analysis-default-page.png | Bin 101840 -> 0 bytes latest/usage/assets/analysis.png | Bin 85190 -> 0 bytes latest/usage/assets/basic.png | Bin 82984 -> 0 bytes latest/usage/assets/bulk-result.png | Bin 75640 -> 0 bytes latest/usage/assets/bulk-search.png | Bin 25998 -> 0 bytes latest/usage/assets/campaigns-cards.png | Bin 153255 -> 0 bytes latest/usage/assets/cards-threat-group.png | Bin 161743 -> 0 bytes latest/usage/assets/container-filters.png | Bin 10821 -> 0 bytes latest/usage/assets/contextual-search.png | Bin 56897 -> 0 bytes latest/usage/assets/dashboard.png | Bin 376298 -> 0 bytes latest/usage/assets/details.png | Bin 49615 -> 0 bytes latest/usage/assets/entities.png | Bin 175545 -> 0 bytes latest/usage/assets/entity-data-tab.png | Bin 55396 -> 0 bytes latest/usage/assets/entity_analysis-tab.png | Bin 661505 -> 0 bytes latest/usage/assets/graph.png | Bin 577107 -> 0 bytes latest/usage/assets/hide-global.png | Bin 12010 -> 0 bytes latest/usage/assets/hide-roles.png | Bin 39068 -> 0 bytes latest/usage/assets/history.png | Bin 480006 -> 0 bytes latest/usage/assets/instrusion-set-cards.png | Bin 158191 -> 0 bytes .../assets/intrusionset_knowledge_view.png | Bin 96496 -> 0 bytes .../investigation-bottom-right-menu.png | Bin 7895 -> 0 bytes .../investigation-create-relationship.png | Bin 91695 -> 0 bytes .../assets/investigation-expand-entity.png | Bin 45921 -> 0 bytes latest/usage/assets/investigation-export.png | Bin 4373 -> 0 bytes .../usage/assets/investigation-workspace.png | Bin 87088 -> 0 bytes latest/usage/assets/investigation.png | Bin 112175 -> 0 bytes latest/usage/assets/latest_additions.png | Bin 30384 -> 0 bytes latest/usage/assets/live-stream.png | Bin 130436 -> 0 bytes latest/usage/assets/magic-wand-icon.png | Bin 901 -> 0 bytes .../usage/assets/malwareanalysis-overview.png | Bin 111289 -> 0 bytes latest/usage/assets/manage-access-button.png | Bin 6135 -> 0 bytes latest/usage/assets/manage-access-dialog.png | Bin 29114 -> 0 bytes latest/usage/assets/menu.png | Bin 17056 -> 0 bytes latest/usage/assets/notifications.png | Bin 33504 -> 0 bytes latest/usage/assets/ref_and_history.png | Bin 47164 -> 0 bytes .../assets/report-content-mapping-view.png | Bin 113246 -> 0 bytes .../usage/assets/report-correlation-view.png | Bin 546415 -> 0 bytes latest/usage/assets/report-graph-view.png | Bin 111907 -> 0 bytes latest/usage/assets/report-matrix-view.png | Bin 164167 -> 0 bytes latest/usage/assets/report-timeline-view.png | Bin 106738 -> 0 bytes latest/usage/assets/schema.png | Bin 164601 -> 0 bytes latest/usage/assets/search-bar.png | Bin 2602 -> 0 bytes latest/usage/assets/search-filters.png | Bin 89230 -> 0 bytes latest/usage/assets/search-graph.png | Bin 435284 -> 0 bytes latest/usage/assets/stix.png | Bin 73313 -> 0 bytes latest/usage/assets/taxii-collection.png | Bin 197072 -> 0 bytes .../usage/assets/top-menu-investigation.png | Bin 6597 -> 0 bytes latest/usage/assets/top-menu.png | Bin 5528 -> 0 bytes latest/usage/assets/use-cases.png | Bin 670290 -> 0 bytes latest/usage/case-management/index.html | 3929 ---------- latest/usage/containers/index.html | 4233 ----------- latest/usage/dashboards/index.html | 4016 ---------- latest/usage/data-model/index.html | 4180 ---------- latest/usage/deduplication/index.html | 4265 ----------- latest/usage/enrichment/index.html | 3929 ---------- latest/usage/exploring-analysis/index.html | 4372 ----------- latest/usage/exploring-arsenal/index.html | 3946 ---------- latest/usage/exploring-cases/index.html | 3946 ---------- latest/usage/exploring-entities/index.html | 3946 ---------- latest/usage/exploring-events/index.html | 3946 ---------- latest/usage/exploring-locations/index.html | 3946 ---------- .../usage/exploring-observations/index.html | 3946 ---------- latest/usage/exploring-techniques/index.html | 3946 ---------- latest/usage/exploring-threats/index.html | 4236 ----------- latest/usage/export-documents/index.html | 3929 ---------- latest/usage/export-structured/index.html | 3929 ---------- latest/usage/feeds/index.html | 4151 ---------- latest/usage/getting-started/index.html | 4143 ---------- latest/usage/import-automated/index.html | 3929 ---------- latest/usage/import-files/index.html | 3929 ---------- latest/usage/inferences/index.html | 3929 ---------- latest/usage/manual-creation/index.html | 3929 ---------- latest/usage/merging/index.html | 3929 ---------- latest/usage/nested/index.html | 4197 ----------- latest/usage/notifications/index.html | 4082 ---------- latest/usage/overview/index.html | 4385 ----------- latest/usage/pivoting/index.html | 4063 ---------- latest/usage/search/index.html | 4098 ---------- latest/usage/workbench/index.html | 3929 ---------- latest/usage/workflows/index.html | 3929 ---------- 218 files changed, 480 insertions(+), 317617 deletions(-) create mode 120000 latest delete mode 100755 latest/404.html delete mode 100755 latest/administration/assets/Settings_customize.png delete mode 100755 latest/administration/assets/audit.png delete mode 100755 latest/administration/assets/audit_configuration.png delete mode 100755 latest/administration/assets/broadcast_message_configuration.png delete mode 100755 latest/administration/assets/broadcast_message_display_dismissible.png delete mode 100755 latest/administration/assets/broadcast_message_display_notdismissible.png delete mode 100755 latest/administration/assets/enterprise-activate.png delete mode 100755 latest/administration/assets/enterprise-eula.png delete mode 100755 latest/administration/assets/hidden_entities_platform.png delete mode 100755 latest/administration/assets/hidden_entities_role.png delete mode 100755 latest/administration/assets/mandatory_and_default_attributes.png delete mode 100755 latest/administration/assets/platform_banner.png delete mode 100755 latest/administration/assets/platform_message_examples.png delete mode 100755 latest/administration/assets/rbac.png delete mode 100755 latest/administration/assets/system_settings.png delete mode 100755 latest/administration/assets/workflow.png delete mode 100755 latest/administration/audit/configuration/index.html delete mode 100755 latest/administration/audit/events/index.html delete mode 100755 latest/administration/audit/overview/index.html delete mode 100755 latest/administration/audit/triggers/index.html delete mode 100755 latest/administration/enterprise/index.html delete mode 100755 latest/administration/entities/index.html delete mode 100755 latest/administration/introduction/index.html delete mode 100755 latest/administration/merging/index.html delete mode 100755 latest/administration/ontologies/index.html delete mode 100755 latest/administration/parameters/index.html delete mode 100755 latest/administration/policies/index.html delete mode 100755 latest/administration/reasoning/index.html delete mode 100755 latest/administration/retentions/index.html delete mode 100755 latest/administration/segregation/index.html delete mode 100755 latest/administration/sourcing/index.html delete mode 100755 latest/administration/users/index.html delete mode 100755 latest/assets/css/custom.css delete mode 100755 latest/assets/images/favicon.png delete mode 100755 latest/assets/javascripts/bundle.7c5c0157.min.js delete mode 100755 latest/assets/javascripts/glightbox.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ar.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.da.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.de.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.du.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.es.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.fi.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.fr.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.hi.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.hu.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.hy.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.it.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ja.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.jp.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.kn.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ko.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.multi.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.nl.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.no.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.pt.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ro.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ru.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.sa.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.stemmer.support.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.sv.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.ta.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.te.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.th.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.tr.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.vi.min.js delete mode 100755 latest/assets/javascripts/lunr/min/lunr.zh.min.js delete mode 100755 latest/assets/javascripts/lunr/tinyseg.js delete mode 100755 latest/assets/javascripts/lunr/wordcut.js delete mode 100755 latest/assets/javascripts/workers/search.6c7302c4.min.js delete mode 100755 latest/assets/logo.png delete mode 100755 latest/assets/stylesheets/glightbox.min.css delete mode 100755 latest/assets/stylesheets/main.3a36e643.min.css delete mode 100755 latest/assets/stylesheets/palette.ecc776e4.min.css delete mode 100755 latest/css/timeago.css delete mode 100755 latest/deployment/assets/architecture.png delete mode 100755 latest/deployment/assets/cluster-mode.png delete mode 100755 latest/deployment/assets/cluster.png delete mode 100755 latest/deployment/assets/connectors-status.png delete mode 100755 latest/deployment/assets/connectors.png delete mode 100755 latest/deployment/assets/create-user.png delete mode 100755 latest/deployment/assets/csv.png delete mode 100755 latest/deployment/assets/indices.png delete mode 100755 latest/deployment/assets/playground-auth.png delete mode 100755 latest/deployment/assets/playground-schema.png delete mode 100755 latest/deployment/assets/playground.png delete mode 100755 latest/deployment/assets/rollover.png delete mode 100755 latest/deployment/assets/streams.png delete mode 100755 latest/deployment/assets/taxii.png delete mode 100755 latest/deployment/assets/user-groups.png delete mode 100755 latest/deployment/assets/user-token.png delete mode 100755 latest/deployment/authentication/index.html delete mode 100755 latest/deployment/clustering/index.html delete mode 100755 latest/deployment/configuration/index.html delete mode 100755 latest/deployment/connectors/index.html delete mode 100755 latest/deployment/installation/index.html delete mode 100755 latest/deployment/integrations/index.html delete mode 100755 latest/deployment/overview/index.html delete mode 100755 latest/deployment/resources/index.html delete mode 100755 latest/deployment/rollover/index.html delete mode 100755 latest/deployment/troubleshooting/index.html delete mode 100755 latest/deployment/upgrade/index.html delete mode 100755 latest/development/api-usage/index.html delete mode 100755 latest/development/connectors/index.html delete mode 100755 latest/development/environment_ubuntu/index.html delete mode 100755 latest/development/environment_windows/index.html delete mode 100755 latest/development/platform/index.html delete mode 100755 latest/development/python/index.html delete mode 100755 latest/index.html delete mode 100755 latest/js/timeago.min.js delete mode 100755 latest/js/timeago_mkdocs_material.js delete mode 100755 latest/plugins/social/layouts/default.yml delete mode 100755 latest/plugins/social/layouts/default/accent.yml delete mode 100755 latest/plugins/social/layouts/default/invert.yml delete mode 100755 latest/plugins/social/layouts/default/only/image.yml delete mode 100755 latest/plugins/social/layouts/default/variant.yml delete mode 100755 latest/reference/api/index.html delete mode 100755 latest/reference/csv-feeds/index.html delete mode 100755 latest/reference/data-intelligence/index.html delete mode 100755 latest/reference/data-model/index.html delete mode 100755 latest/reference/graph/index.html delete mode 100755 latest/reference/security/index.html delete mode 100755 latest/reference/streaming/index.html delete mode 100755 latest/reference/taxii-feeds/index.html delete mode 100755 latest/reference/taxonomy/index.html delete mode 100755 latest/search/search_index.json delete mode 100755 latest/sitemap.xml delete mode 100755 latest/sitemap.xml.gz delete mode 100755 latest/usage/assets/advanced-search.png delete mode 100755 latest/usage/assets/analyses-graphview.png delete mode 100755 latest/usage/assets/analysis-default-page.png delete mode 100755 latest/usage/assets/analysis.png delete mode 100755 latest/usage/assets/basic.png delete mode 100755 latest/usage/assets/bulk-result.png delete mode 100755 latest/usage/assets/bulk-search.png delete mode 100755 latest/usage/assets/campaigns-cards.png delete mode 100755 latest/usage/assets/cards-threat-group.png delete mode 100755 latest/usage/assets/container-filters.png delete mode 100755 latest/usage/assets/contextual-search.png delete mode 100755 latest/usage/assets/dashboard.png delete mode 100755 latest/usage/assets/details.png delete mode 100755 latest/usage/assets/entities.png delete mode 100755 latest/usage/assets/entity-data-tab.png delete mode 100755 latest/usage/assets/entity_analysis-tab.png delete mode 100755 latest/usage/assets/graph.png delete mode 100755 latest/usage/assets/hide-global.png delete mode 100755 latest/usage/assets/hide-roles.png delete mode 100755 latest/usage/assets/history.png delete mode 100755 latest/usage/assets/instrusion-set-cards.png delete mode 100755 latest/usage/assets/intrusionset_knowledge_view.png delete mode 100755 latest/usage/assets/investigation-bottom-right-menu.png delete mode 100755 latest/usage/assets/investigation-create-relationship.png delete mode 100755 latest/usage/assets/investigation-expand-entity.png delete mode 100755 latest/usage/assets/investigation-export.png delete mode 100755 latest/usage/assets/investigation-workspace.png delete mode 100755 latest/usage/assets/investigation.png delete mode 100755 latest/usage/assets/latest_additions.png delete mode 100755 latest/usage/assets/live-stream.png delete mode 100755 latest/usage/assets/magic-wand-icon.png delete mode 100755 latest/usage/assets/malwareanalysis-overview.png delete mode 100755 latest/usage/assets/manage-access-button.png delete mode 100755 latest/usage/assets/manage-access-dialog.png delete mode 100755 latest/usage/assets/menu.png delete mode 100755 latest/usage/assets/notifications.png delete mode 100755 latest/usage/assets/ref_and_history.png delete mode 100755 latest/usage/assets/report-content-mapping-view.png delete mode 100755 latest/usage/assets/report-correlation-view.png delete mode 100755 latest/usage/assets/report-graph-view.png delete mode 100755 latest/usage/assets/report-matrix-view.png delete mode 100755 latest/usage/assets/report-timeline-view.png delete mode 100755 latest/usage/assets/schema.png delete mode 100755 latest/usage/assets/search-bar.png delete mode 100755 latest/usage/assets/search-filters.png delete mode 100755 latest/usage/assets/search-graph.png delete mode 100755 latest/usage/assets/stix.png delete mode 100755 latest/usage/assets/taxii-collection.png delete mode 100755 latest/usage/assets/top-menu-investigation.png delete mode 100755 latest/usage/assets/top-menu.png delete mode 100755 latest/usage/assets/use-cases.png delete mode 100755 latest/usage/case-management/index.html delete mode 100755 latest/usage/containers/index.html delete mode 100755 latest/usage/dashboards/index.html delete mode 100755 latest/usage/data-model/index.html delete mode 100755 latest/usage/deduplication/index.html delete mode 100755 latest/usage/enrichment/index.html delete mode 100755 latest/usage/exploring-analysis/index.html delete mode 100755 latest/usage/exploring-arsenal/index.html delete mode 100755 latest/usage/exploring-cases/index.html delete mode 100755 latest/usage/exploring-entities/index.html delete mode 100755 latest/usage/exploring-events/index.html delete mode 100755 latest/usage/exploring-locations/index.html delete mode 100755 latest/usage/exploring-observations/index.html delete mode 100755 latest/usage/exploring-techniques/index.html delete mode 100755 latest/usage/exploring-threats/index.html delete mode 100755 latest/usage/export-documents/index.html delete mode 100755 latest/usage/export-structured/index.html delete mode 100755 latest/usage/feeds/index.html delete mode 100755 latest/usage/getting-started/index.html delete mode 100755 latest/usage/import-automated/index.html delete mode 100755 latest/usage/import-files/index.html delete mode 100755 latest/usage/inferences/index.html delete mode 100755 latest/usage/manual-creation/index.html delete mode 100755 latest/usage/merging/index.html delete mode 100755 latest/usage/nested/index.html delete mode 100755 latest/usage/notifications/index.html delete mode 100755 latest/usage/overview/index.html delete mode 100755 latest/usage/pivoting/index.html delete mode 100755 latest/usage/search/index.html delete mode 100755 latest/usage/workbench/index.html delete mode 100755 latest/usage/workflows/index.html diff --git a/5.9.X/administration/assets/rbac.png b/5.9.X/administration/assets/rbac.png index e2d10e62cdc6ac331df9824b0045c0690c3939bc..b1c600cae715666b8d70658f98bce26bb1d15419 100755 GIT binary patch literal 286058 zcmeFZbyU<_^fx>Lf`GJwARU5q$IuN5NJ>aJbobCH-5}jk(nw1PC>_$>CEXw({eB0p z-s|(+XT9sU*8BYPu6ynRhwnLOpM5@i@6X=n%*+jvmy<+8AwU6vKxooZVu~Qp!$1%S zh2|b2@I>3u&lLnBSanfWvsZ*Tl3LqZ8Jd_IklH(28;}|}nHYjVPE$Ea8#aVI)qXcE z!7O(!bkWBG4_<#w-y@BFAe~Pku_rxCsZ!L9uxlF^!hRumBe1G-+4WQfM=8H{#rzEC zm3iZlXjOl@M-%w*-uOlC%lJ9frUpwl_xWAtr~CY$NILr+PY=#7yd(BXj+D-AGr;pY zp?gin2WNd@jXLWM3IoA>f<>nyI}P&t{Y*2i-q%ILt1o-T8A7kzJOyujy>G%AznSbw z%v?;T--P?E7q_~CTXqwd;87BZyKpC@7Z2oUU!V6sT_0^%?xD&4}(_WKxy?<@Tusc^h zX|g*@>!=<6(WRq}kmPKuY1K;5I$YxmPg^-3@@uU*x(RyG#9`Gr35gkJpCn5!!RzbG ztWSun2@edaq$o<4Yg?su@vwc9*FQhTnNKISH)y~k6`KK_SUzEk2X7IV~1&)<%rzRHVjvs_#-#FfR2nH0bE*YnVvL{B*2XA4r)%&hFe|8y(=aP+IKu_?j@Z%_SC6@@ zrKQq23d}l-?zKcPFG(4GQ;;CC_%40+m3#PW#aHn3cF%{>&k?bz>d>mukJB+j;k-Ma zdP?edJZP$Lz6MdJx^?I0rd}sjaTPaRU4<0Ya+zHlKC_}vS6?1g6kuFLpqA#LfXsKXm%cenxUP)RVQ~>s8aC;j_y)t{czZ z6ot)eR=cLPofqn_GBcdnPV6(@n8ME@J?LFp3Z!xr^q=i=(5cT%(qyIjfOU$TI^D;E z62_tX$SAzkF!+^S8EeVptAtki)R7*ZTFTi`!#IzV{9eM@!jcuqS+@8U?EMb(!vU*I zGkB>-(?^T4)G_l+2by1sR)UF2QWFjr;3!nC=gWM#!B}c{XXRt2N5ZvQA;k}0eHcFe zltRLXpEd7*g{>Qc>F-}i~jdcoBe1+s^BB zWu%82?`KQ-uwOg4KI2Ba-dm1|;fh6~nE8>dq`~N)v(pQg{w{VIrLe%W(JD7(EPtg{ zh&6MCD26O&W}Nw{ugG{#ePp@bVOEC3lQP@vcYDk)3DF>UCR;KTSnX`^my?ELXi^+! zY<{12DjKv4o+k?WeL$JyhDIKZAT1VAl`cv}oYbxQyRK{lRpX#TQcMefR#&EatcuhZ>!@=QoSmy{m8~8T4MNY{2M$J9jV*Gu7|t@o!;f);?dLCLEOB_42$F%qSgerj2(F-7N40?GI;?^ zZD_Q3LUnZ|c8}4{^u$nIx8C!W*ZCv(9Pk$3pOB^rS%UDsxGJJ-FWWxH;L##YdAHpA zjiq9ak5V;~YF^SLF?1@gP@?p-H#;u$`+*?b{vEGy0SB^*h1E9$8U`-HHlJQP)lZ5^v7rJT>s!FH2ZD2S{D zqotAhbk6?(&&&b;^y1ESm7@SBE0GX4=F_s>FhpVjae4N23#Yk2a~y4x7iG!aqu#Q# zS)6a(NedOSv&Ipsw#&rJR|mj%)ZS&o4P^#K6O2)OJL_mDLuSJ`>LeAXI%XX?@asn#P)vA}@xGVE zNw0GdQ#=c)vUJajs2->@;-!x>zMwj@?z$H!^1(~_aerLR_ga~CQIY(rN~~=W#kb{_ zgKKc6bzg7S<~Ml;KRdd40@G0;piDMjPA!E`ytQ`_SPiL z-MzVc0dJx5!fKFeFl6Lng3bKfj?=Q`(@xL1P(MvOlWeC=#N8+QL$-HuKg>bR1*SplJ7g9GYzb&lB2hxcVN z8D+Lqsxy>b7DrTiKhhBD+TVHgV5@|54#7HAOz=>7TkcipV+KtEMC1%Pp?yJ3WWl#u zhE@8(Lx+Y^#;e;?P_`(iq18OB@;lLR4UWsuLLy#dIX(HvT0c7`Bt7|M8fsCb;@5XT zz7zuX%TJ{Bnn*m~WL+DgT3OrXQiIR+yFhP6d-Y$t;Haa4u&G3&@@eFCp0qkKz%w@= zw>YuBi(T|VX3GfYo@!QI>Y5sytPIF~rF3jcD6&ZTJfHfWC;S)di}WL0OgWOXlB(B-!wfpeb>U<991_SY4+va@vlZI#9)p;(9}FsxgW*@3F#GhV;-QKGjKbm)qaPTBoR*2}x`&n)?h808C>jty%EAS*2fP;0f_nvge$-7zTgTs5pu<>4Z<9~c zA7U=AU1uu3?rrj+o?ZB-seoJ)q zGg>MgU3ClL@;$DCF%l%Ptln7r8g`j1LC?OH=aZ@_!(RkXK=_T&ePtyFTC67=-2~(A ze0?lN8^wtI&@OdE8Wm04Ulir7RZ=Zq196EPspD%y9M4H_7xui;J4`~9BxZ0W`fsdQ zs%4*!=k`5?$7u5E=qi&48vxzO#;z+M!eKaW^4)6i%iAA;^Lf*F&a9d@2Z_qbX(VlY z;*-R23FmgiyM&6*wCX8&DY3L};Or^HjV1gxVk37msvC?KhF(zb5~&@;2V+&$6jMBcZld=Br;Y+4noE|#v(AlRUb8GbaojtNKQ zHTg)*{sg|ACNvJWFsUf}qejL^*sHlfw9kl=gV+v5gPHh_OZTU(LC;Wn=1d`{B6^2d zX4<5RLSVhRNi1HB9Y~l^z`dxbS_QJ+Ua9X$Rmk<-aLw9Sx$pS;{5~L~$BFJ$cb(|o zt$D5I>NtdaIlvW2US#}*QVUJQtYgvSaW=l;Wya?F#+sA>W^C4Gk_squZB{I6i~>i4 z@OOgHAlh#yqiTmAmjo&w%(5FanS{tUNPcQYbLwxz6sULfbrrsYkjF3qy`NLBPf>^1 zeaBaYlZEAnb0nz}zIlM+y*FcYXB^fB2ASj&i|F6fyvRuMY83>Fsd=>7vXI)Vmc;Up zwFFJH?!75#8I2l2uY=@f;}1&Kya|@tuDP3ghh$gHK#_wANhia)R1b+XrgBlVH0rrs zY7u@6)7x;&NaO)Ep@`iu#{SZa5nrzvSHCXC{Ch7w$X2z^>#e~7s8&+}L;Z*gv9o@@ zZrDm9J8_I{zJ&KVc6_BlZtKY?n=&)B5Zn{R_V3!`2A0tuy66ryxBB4_++Ouj01}J*)6|+@`!ByqU=q-Szc-;wMB0pF={%S=ypNp8+LC0|hC~iV-K| z4CA@H4HP`;Jd7C^(S)c`91@<1?0_g5%?E-xnH$Fh8S{7i@(%cLaHtT1M4A>4trPbN zHs+IL^}a=}jbQoSsYXeNDH$1z`y}0^8CD}fiMuD5;55Nz)*0B|AgU(nrutRs`5Rqt zgH+^oWwt!pHI<&UrPybiWImT>qQ;=MG4q(+ghy|bWeZ8)E~EPz>W$=Ct0TmH|)Lt zIBIxtfSsVz29MHCNX8H?+U7I<7x9uPac_DH(i420*Wb^p{N(JE9V08{nd&N&Mc?uX zz&%vv%qdo)@<)zXQrdVY9q|%YHh(;BS*DCw+lVsoOUHQmTqa^V) z%1SDPh|hWJVy32g378PhatmXTE;6Gc1|-%hn@AuP*OeS_qfgZ4u?T((;w45eA3QV? zy&ETtN!u#%7;822fW2|B0&eJqc&E-rOkgSQl5mK4z&R=PIt_Lr3F+9x#+0HjlZe*Q zI5rg@d#jzqF&l3j(r_knMfg4J>h$9wIU14~8=L{AJMQyBE!vlpVRN+su7S$T6JqD^ z19C0ipTK;gk3m8_HP;or$lmcN^pbYMm9p;PeSA~41VomDYWs+7NZ04tIHGF!;z>lP z`fciK!ju=`tR1^9mYn3w@HJyPc1z>Pv!ratks7ycMMcG|x9kKWX7ohv-ETe%1)ci)vVUqPd(*>u zchq!9Z;3dO^Dg1(kTiWJVHJFv`S%0OqKcSbgg{>VU4Z zXKcz>_Y$@gwdb5#ex%!@SoXrbxjFh?ED8ZSo$-%2UQ@iZLpZ;w2{j`6o*3@-R_?_; z!u&qRmZ0}&1Cf2PF7(8A-Qj9AiTBEOg{$?q_~(uY!m^%_R<1=xy;S6V8y+OWZXinR zQUc%Xmp$3+ZMBZ4Nw^>wDH~`=&&&>HU;J+R;{n#Hp1dpCg~S(1pA7irFYOZB$9$+W zis>!52s188q#{aGvG>kC)6g`bi$JKxviIWY^*A&w)xYDVhOc135l!gbbD73JML6Y2 zmmyJZPv!rnh=+T>>iHS>)Sz!cOGnu&N{W8vMf>J~cKCc`olv8>q!ToKBn}}GqlIu| z@F=wPQr$c*xpHKL3_Xy-R~_pD<6B*o8-ngrCr14{sTuIwltUtB{wxc@r7aX+WU_HZ zoZAOp@2xR4HV6=RemG4aa6mRi1yfqmBN;#FVc{7rvnR3fsmj2&$LIJ!@imNh2#4`d zN$8;#e&m>=@xTTsIk;%=YmNIo#nE|6d#JI*O~tHW$0mth4ZCQ*zd2VEb?}4zuQXKV z?Qz(n*@B`~8Dy1^LceFz;AF78fuv-O%88~Hbw-VZDDoYp7?x(D8E%))C@FWvyoi%D zPa=rZj@8#ctaOeKNd@1F#JZm{Q`RO$KTSgq73I+iCukVYM#KQ4ewIwp-60r4=JJa& zdv@|Ri>#L#be&*v=^tRt`z9>ro#TK?Y^A+l+2W?zOcj|q96kbm73cQWvjWeVr}sdm zD^D)p8tZ>q{C3gVTJc#@oi9^FZT<|~Ngq2ij95we zYK^Y$N-KZn4q>FYOrqEL$^}RIMMxmhVk}}JFHd|MEJy7X5MxR(p_7+wQHJJ4K)Gxa zQ}pPiEy*3+v$?E!4_A#Kf#mn%LThnmA`@1T@C9fFGH!Vf*-}9Z;ocI{D2Z~5Q1(-s z8kZNZ;8@s_l$HseWv7%*x~@va2_e$g7hxPey5qJhDy`}a5(n#R=D!R(Nb0_uNZswx zCyed{Pfg}k8svc98We6Tr8{14hz96PomVI25G_etn!13mM1Fzl%bZrkl4^ z(&FJWWNS3eF{3=VcMD?OsWLvYl`UtFHkapm2b~Ej8#!JkRtvtwKX`o{8lI~SRmR=G zxyR9|KHFo-uRDat0M~M#Tz5Ulg(Ub{LTgvt^Dnr_z-j0kcuk)%^<|Va^gf`|-&Z)LJ*yl>TdAU75ko07$m0p{vhJ$5H zPfa-DjrER}L6os**u7EHyiY}<^Z_!7v_cyw>eZo#lDV(nvD^7n{lE;ie1jdH?Mg&3 zblDlGk%d^N*$}nM2eyIk5?564_XNi^l2 z@mcpSPRH&u_Md|LVG%4>{+T(oaMO!Xuvtlu0~DGvzRqqdT#g=6Bq~kzaL?lKtpWsI zh1$af9i-#M9qBdxpeRpzHyH~#34!5<%f@6m!b^YGqSlABRUT@ohEz2qqKRdS8|3fc zDFVjB?1isA-W^Rlqd)I)X?z?rjKh|Jzg}XB&DDUY?4ph2k~LX~9&2x1)WG<77y0x7 zwV6HW1gbG*L-s??V_K-eD_nd;)um%gnnb1QZo&yi$48t&EYVj&6d6~>hIw7{_))|| zSzi`CNS)=WGSR@O84XLK{%kXlhXurDcI&)bLcSJ6{GVvROaW}E%Czf->=1FhYSHWr zvtVa4IP!_1t|oUEGbwT1JujX!ugzVssun(oCOHtl2`V70Va=aF&4&{h+LkRvzwT{` z?6QqB7ekWX)4YCj6~!<$~YFBGiGT zkyt}49izkFe{>a>M+>{sr3k40V&o$6%;@cj;p6~*Hyj@MDot(v+AuhI{5zup;mC{| z29*CqVp-w=+^A_RrAR@GCU8>-*4bO(;XPdD+1!!3Fe1gM?~%q*zNdl#x9Mj89N&?N zv5UY)DW;vQhP4DL`vs#t#3g~MT)UFxNdN=I^>Ju=-*)t9t}&ysbLpqdjPpS@VTscL zQFAw`SC*S<=D4G^{5u$^o6@~T=Lrbxdv=7_+UDXSMjQD&M|_pG{RhYQX-Jy|MQZ}2 zA0kEdZQt~)e6?#Ji67SEH|jh6@p*d9#f7kdBejVkn=4!{SDoaAazdd2|ARL&+C)sQ z{sulm7_`qCx%oc+P}4Vlj^PwV!_Uvf(MN|X#nOroeTF_TJ5Zj6umGo1{9dk2_nFY6 z9CWZ?#H01D+#jD`llIKb808D3<)5Ds^-d+FRg)-FP1vk;I)aslUEkAhealx{e!Q7% z@NQvfY~4)^MF>lN;G*Bt&Lk)F)xo4i z3a6R9zyN{n_?n1{%1eui{(8p?c%Li9J&IqdMgD=`3#A-#26P9^jmQkJI_5)Y3@z># z5fi$~&DV!Rg2qFU*)`lKC3lfLaSPEI`|7|oC~p=p0t-W;GecsWbQF!TmVJ6Ixc5?9 z+)wX_RCFs>7!k^I^hi-J=`uFaB5Gp^`O^C02PL|&RwVeXo!13K>^ZWet+?;?KU73{ z0`EqCKsbyR;^gDxGCahyhZCT#t{B)K)N$W5@<-HGd5=}fb97WbHgo;qqgIG+*+`o$ zUPXBZ_6sb@hbmcaWNYQk&LI^V#T5?emwsQ~RKHyWs~{lLlLb8x>&(k~LrdRkJTAo& z_5P?Pz;ogtx05Qm5Kbce?#Me4+sg&deb;J38{1}Cly>hqyy@#lci`%U3L(?;9o4ho zJD2^RW5*80lRj@#Z-j;8^1~rkdxva=KiRtz&--~Gni2mk#aX_uE|!yEmQ^>r&qtw~ zB;JoFJaQyn^u4BMh}_%=63=5Ab`N$NcWbX)bNQP{vZHM4zu-C80`E*Zm;moUs>#ZL z^{gxyA^KLj28>P?*1$WIAP}FRlQl%o%)p*h*TBfclAnC9zKNXFM4z8rl|z_oS z*hI?3)w zBNGej+gSkEe~h#@G5i~>KXilj+-~QeiU8Ap%l%{Yuf5+621d!sg2k-#pfL5M#rVl# z>x1>J^i1@@KVLHIb8{QAvN3S!8FDeOL)f_)boF%g7z}whS$K2}beY+i_5UGC+S1M* zVyR~U69ouoGy&xBurV|1>+2dYurcd#GqAHj*cf>9SoIi~xp@p&^trgXAP}~HhcR_J`Xp96T)*VN?#8w zVP$Ip0nBM)0WmUQvbHq3?SKIe7M7RhCue13{`-l%ImF%&m;l6piKV`kqut+K$|e>D zO7;*Ko-CX^%p9!T94ySt%&a^doPQ5`X<%yy_##Xy3o|1d>unFrFkoOi0JIR8rvd_Q zp98xAi`p7M?5%8-t*p%X$ze*7!e;*NmIVSzA7T#?gV-AYLYZ0Fz|34=R&Hfx9xw|B z@S2X970mpP@mBgKhR*+QqhaAg%Jh=oBWG2aOxTu>g#iGF>o2M=rXYL=<6~- zI5?RZ47s=sIP`cRoNUaxwtuugx;S7~|J&`I!DUJos)0{DWeEc|V^4)CDjh({C#L3ok&||C{YE zJN(~Vf|T^XMgB+l{s-58aQ%-E_#X}a&%6GE>wkp6|7h@k-u3?(Tqu7ZrVK2B3dj*S zDt*t+;sB0Wh`P@u#XvW(|K2s^Mgvcft) za*Pd5ygSqG!u7fg$PT5aa0`)SblQ(VEOszUY=G&|@43o)SP z|K2*(hz_{L8x$qa`3g4Yxe$Fk!#e09K2~sAIJf<%4U(umaCp#`{HFAOp9ws9RY-B| ztf#lUw{+0mZ8(1AMCx$6?xjVr)3gKJzs(6P3I1Vm(?rs6r1#;*n$+QPrZq^S3RB_5 zgvh@Q_gX7IJZ^6{=hId{yGCtG*K{#G{KQTFZ$m$qBytZL)3eLTrrlhlZt&hb7UUvB zNBy^ozlH%l6SjMu~GZCVP5=fHkpHJfd@ecxjHoI9z)z5XEwnH^5Wk2pb`Ow4*axuuAf76*$bzI@}hKqcYq=|CrpuN4FDOh6C$)e|RoZiyE zn|wM-QH-Vfj0$TxtlX_Qko?*$q+Wb#3HU_xzce?BSUs%#iOVE%50&h|4cQO0j~#IS zWgO_WvUu%A5A?xW2v}FQB4h|RR{h_Gfv%OGt-OqvdGJ&hSaw4C-^O?;SPVMIVlDe= z{j2|Vijv~~+cZ)f?|=6J83f&bg^m>~@b13}>JLLR z=s&9X4aI*{@e7LosNxqAp#P}iHx&O-#cwG7ql#Zp{QsFM@GE{-*MvsUdYog_)V%4` z!06&UoozAq@`pC%4+qV~XRpt=@X~>Q%_rFbR3`jKw$KHg%W+MvB3k-gXQdh}vyZC+ zKlqajtIk@L01~}OUYEd*gsv@`cnb@dzf1Uq&cfv4yeCHF+Uxf*P#On<&cD_!E(!x9 zUt7&Zcy75nHiT^{eR!OIS}#@jJnDLY$m4Q$Xn%kV7$JG%o?Xibyx6|Eu(8wff~QF3 z=BVAM;O3B<0xk)DHuSLE0K~2Q#6|Bf`KSt9uQ*}fGeys@Y{WG=4w32!iFz5IsiqY? zvNiPx&{FiPCLYiqjtht@9)0|R(=!gG_1AgEI$?B2PMN7!0=l}rKd|ueI+!0AYt5dc z%{3ISBX(d7aVoWjcD)B4624xogY{h|Y{9w33;jMfOFo-57e5{{A2I5a;NV|dAO!|t z=8uQzo(X3MpepcbgjO~hDgh5!S;t{^XzbU-*)cN-1+9$?uTEhw=G zO}`?CoEPxAU3E?EFHxJd+`t2hB^M+Y2S&G?{(#oAT{_wRsH&UAZ@g~q&+;h4IS?_L z_aw%|Qkbhh-i9d+dUdO`S5})Q-s|-Adbl#+*=-{fgH}8oWn$`B=x3C4Kc7kSY#P~; zIJbQ|w22qxGE4I^-XG~6(S6`j!3+Mt?#=o4$-EcWHyy)knZP>78xMMWiKy5l+p0LjB$G$a&Yg}n|yETE1B0OQ2! zk>cOB^Ldw)67+@6N}K}<8Q)8FnU%s=%lcv4rQ?SLjHf8Ebj$<;qBm;uat%+uy@ojN z#lial7A@1i4ZCebz@bT;IRAF$$YE_lQkg9?titCC0x1zoi*Ix`0qni>iU3hbNkLzF zK1lF$R1}^v?#%}OwDgoQuyv`QE^_j=meK2PzfRmfxzh~9)W)J)%&C>6h86+w6WC?V zkGQ(YV88`#6*J1RtaeywY+E~GIhmXf!3TCK8GakUrSpKR>Rnvo{N{z%fjRwyW%m=s{DAb&p|MBQ|O=Uc$z3!`S*N>T>TwA<>TdakFpSq!=*l8`) z{LL}1bpZFh&)D$Lrc^QL&m#L;*nGZ<&oCdJvx=tPL z@rcaGPG9(5w9Bl~t!>fafBH@-GY}%*DrEn*ZG)n0pV&<=M*2D@3nHRytL59Xde1%QKG=a}&d$R_}CwD(gjWDrOnPzMk}sIpr38AA1UY?R!B zaz$E@kIJjD2OzG&kz;aUa_0a0ELgd6dz=_%oOGth*vIiIk5r$!}|%24dDBPxPSA(wi-ab zH{&FdKn#7W0$BI3A|mtB?TZ9#+W}JmG!T6gBqWrcTbH6x{9r}_I08T9c27Y1B6RzQ zEGZ5ioGUKLo9CM*?hL_xFS1ga@J-x%Z)HhJ+{BtG^lAqI`kH8MLbER8BQo7+YJiB? zX1v{^*B%hz=>H%}i80SBE|vsWy>HOAHB=xzB(H73FqrgValoV%vbnSpH6A`&OT04s zm=g=wh~9H65AH*zrr0B{tWT~KL+44d zu-Fbyy`~%2wcaR>8q3ypbV>kHA0mJx17Vf04l~hi!Pb`L%i&A z2p-^tw=KN%daDWG#c>G@rM~&lGSBlZ8jmJjU_QWPO#JF0w%5afF_~#elP7hintu1>flH?Jj2) z3=4#NuH8|HK_coRBZ4vA6e73Suad-;%`S4T&2MO&fhN@YS zJ&o^k!R#R#9MvMxQ*htrzkDQydugZ?<`}R`odhs1n zwk}I5oKyKy>$>dD)jceh%b?M`(9*BT<6ZWVZN4y_!>?X>*TE_-5J>3xyAsre7;9d% z0F&Q=4(q_w<>Rd1d_r$AGTc{8XGpj0m&iIwMCJ|a1Azn*(8oFtzihqjqI{uS;Q3fw ztb3N%=cjZ^gsL!ieCQ(OyH-U0A_%LKI7 z-yb1jC;X^3HT@p{`k>4=O8mC-=PxhPg-w2;K9-{^9Wgb9g3`N=onK|me)h>47T9-w za!#FTV59W(h(|_^2Y{+{4ftB$^aQq1p}>q=(g5Q35ZIKpVoj=l3;XZn1`~4cPD!N< zk7VE5=H{#5j}P!V&$r!KRaD>d-LBw;qYqZ2IP!;kO0St#q3C9{pWf#Cz5zXn59WMi zzJD3vbH1n+o=`}Z@b3Z>=oK=y%Q5J7?z!KzTwI9TU1wV@1C^Be`7V?Y8_OtB)Y-5j zRkUcV*fV)`-(m+7_;|^a$Ne>q*$<*vY^#Zy&=LZU#TR|X( zub-Cn5jKFfMC$a*9q!2h3bFJ4FA5Q>?%lBsPgzkd${)&rSqBh; z4HQE_vwoXEOT_BAUkBJHJ5Vb9V0R9mRVAkT(}mev*a!q8L_SW?!w?(*irQnyx0cDbay} z#%;d&D9bqkl;&-gCrp}P+lK2B%x$GRRvYeka<&op5_mJtDBz{toY zIT@8%-yDxN|6Zb}M-Co0F!kWje!0hjgchDx6CV@_t>aJH96)h4cNmpbqmAg@WgDy0 ztp*}33OHM1TAQcpvYWOt&tBIj>+fNkJ-XO&oHw(XLt!}I3MrUT6$hA2sMGpq$fw%? zblAKa7Lz|DJOnK41rq*?@krU_$L}s+=%DE`#GO=|_t)8`(@7zK z#CNTeFUE&DjMnFPC2604%Lk_&gM-Ev=$Mq2c#JlDBC1V2p=i>;Nm;o6Q?Xb%G@4qV zi@8s4>&c?Fye2UJ_Ok#=^-_s~?h$|?L7?16zbr8z0$Ae3|2fCpX&!a;O3_=r2xU_N zKR7Y2mZ@Tw0Rq>XqIQkP#pXcscs*@^{>b7&H^3jgNz~vW`dgs(eUnB_t_a16>&A)y z#>Q#BD+TacBDvR0mf$n(3{oS&(bUpVzf4QQ&C%0vZ~mn9K=5 zYt)9Om(zXu1GS z3;ITAW3x^DCS_-?_Adsg)8jTPc66f50ffKH#G-G=hw-gxn?70tY9m13ue<_JergCf z6QJQ6ITi&CZlk*Q^IY0St&@+dio5iO@NFEfR{hDq6n!OCH&gGxxzX8hfQ@09+sBPP zkRzH5*yFF}^?9{ya)p3(%qZn73tC>JE!GT#w-8IROxXDb^n#-2(P-kl54az04Zy8TB9VuSddU4Y5?I+V4pttEG+~B6QO=s*W!Fy z$#ZDMB)^w6ebRi43h({;UdUSa*i(N5cmP5%075-A`W=hmP&k=5=JJ0Mxpi>OxnVbS zW53}aQ%caZD|AhI?=@-z%@-pEwnf8V zK0;&yXeDkmL<;z@hA|6^LKK*5gAlED(-y6VF#CHW-o{LJ#Y0@fsH=i4m}VP>vmp#0COi$B?y+PNhhE@z3-8pgdX6Zu7ump-s}_RVDu`i zwX&zq6*e&vJ4F*a={I&edTiNUAW_ff@9%R`0u=-T6)^b{LIo4_yLoqvaw(Nm(gTig zB=Htlcz_)27(Cco)}(aup(F~h(pSTy2tCR0k^JvHL`j@x-Y@YQcc9_ngM*s`bFRaq z07D-ScBG%X%TOf?Dy+=82UkH&tv^{fJ%-UwZOg?{^B4Rpj;rhX5ni5+n(+nN-ix$T;uK?lWwZt z0P|nD2}lFQtuRpFfIJhV|FG?XjTY~iQ7ANaFEJz@dp*2miz~v z?XsiYSf^@<@EQd(o%3YNN8rd1VA)E7-!6GJjZX=?5Hgm4m5f5AW;nR-ldWpnnGMIH zpWBa<5a*8*p5zvop|6)95s#*?@>_6^?|IlYOi7AGIsq{k0}$5!nd6%Wzl{mJK){97 zm1UD?dH^A-zhoi@NaLM)6&l8P%t2PA+n_mgYpTu2?IO^jecnuyvBjovl(ukm>GZ(Q zPu-wO!+m>rV>w~^e5QZWC^aMZ+NglIX3fDbAixd+)JreFlutPhKaJ>R9FJuAsXOAW z?ld((`L~(qR6Tw$>bG^=`N`-qsb|N*tgpGrWLPrYDQqJ(CA*?;U1AB?=m0F?-21bl zh70U4jIXzP-_P9>tPYdRPFK;D?b<$#9cK&f6)^u%_&P8xg_>fQZp8Rer3v05BCMhg;CI0lUes0zF zd(PzK(!e_!AZxgvq(8{ZBW=;#{3-lqXOC%Pf3d}*-|?GN>NWeG2~R4Tp!tY7XJN-A zG9_?ML|_1-D0JZW1tko8Qm-2S(5MbWu22>{yv}lGqAtLrdpDOt6xj`C@+2&VS1SAb zmoHAo^K7kR#}8mN;&ku$MMG2a2a?SFed`a);Z{vbJ70YK?OGkGIW`IRKJ6H4xhbIF z0jC(_hhL|k>0fvLaHM!4mOV2bN_LwEkbxTp5J;rWxxvMWX!=?u@%nfUDJ-obuSN{0 zwmvKyrD93K(3a2oS(7Nj6#dmO9|6}8nkMT0EbpfX)K!@%VO}yh>v_8OaInN8t2(F( z%4$BLan*t`C0{;i9j>DzC>EcSb3UWmB+xXl)6~luI(gED-r`@0wKLT{#`0ca?Ge_X z9EMCyDk_j?DhbA7EA$JBSwd~Jd76#b=wR!j0g3<$ODhMQXm@mXI~Ekwy&tr@wtn|= zx{3Y>>|w~)1bjHoYXKL|23nwy(%lML)efc=LR^B)LXZvrQl+M)9M|BS;)E%(tC*{KrQWM--~yEw?# zDNl>Y;T6`d{L z!qK5@X9@~lC!&jt>bO=Q)kOkBKKBp)>B=B(tCS_S_Hq}pAV4ew`NlR|@~0iBs*VYF zquscp%Whlz%8AqcW!=oI7#=6Dw3{A!_x=8x;dZX0e`uC z&&gCd&iI(PoA7SY<&df3C@)G_Ve5nLJo5PV^ZwH z#}CR6wP0cAivWb3NBEz|qTB>t7L{F8#7FJGl}7mkyvW=9RR`S}`etF(2np=pA-O!l zp}krv#O1vnVsbE^8}7$%Pw~(wLezASjy@ec{;tLd(C0vb8s~>-pdy5X0;Ty3zoInk z)0hiLx5@T_`}eLj?GA9enA!TfJ7H;TMr!YMd0nmOFWOWMZdJPvQ!V&!)ewSag7hk# zc3V2GxLl|7v4NyAfKqc|cph3Nz!fV76#Tf$_O(f$ER+M#&qq0$*hBMYUgcc8?;VV) zt1}cl5e@Ao=epfEd=Y;F1p=xL6JlPLf?dXfAju(zz(FjX-ZesRO9MY8^!wn#aUfJ1Dyr`$!RBS`o~i1ae=>!FM{6<)mW=gBav z6kI!TV!yslq;=9ug=oTxvtzFD^npf)wAbN)hH`g-!Y#2H|EA=d+%|<{gz~M`AN^#n z(UMu$%GF}>56iQ44uil^mUe8cYfV#2*TO|_MR5`g{Z4SS``*)R{G;n_s67Qj?efQ| z*B>b_1zbYbnEuT|y(;h)+p2?>h!@5ezE1VF!W;V z-Rn$+ql#8D=By?Q5915gM-4We`_%pI_*spjW{5F@fNFybR&7X^zXi~k8Yc6Ctum>Ob%;ay`T}ajF9x(nqLtCIH35g^Q$14 z>1W@hWsa}ismme&!vgFEtD-@d_iw{)b8d1!1NiYiKW*qV`>Kv?qj9k9=3c!+SL|t& z<=|GK^hBB;r@qi?^De-ZT0oAxf2ySXNg61<6MSJ50-Q3uC=>rEs6OW}5-eRH&&8>P zNCAd2w&8W$dAV4JW9H>zsL3T;zsJ}_&}eyS9fGJon~7xDr?i2m)3bB%W2Sw>ek0j7 zU^ksbG9Ha+QPoZjr~ziA^+u_xkAVN3ui(pu{O$%7P2lagccbMc+UsoXvs}@D$${MR z)1789kW4wwGA0Z7ojRFIWYrQ}sHr!0r>zDrC9mH(M_dYjyg7MtEGKt3Nq8b;QM{Xc zoiJmGfebTM2wK$%cPau%sQnys=r@la?!ph zD7cymnAC-x+)@U3RCWu8L_Iy;+$K;{ph{%5V7pH3ie(W=3zWJIno9(j&AhU%ueyw2 zmADSZjXC|tj;xE^{?R7E>lE1WB@%Xp7W-#>xB;a!aLffZf_9e@$Z;v`K!q@S{5h-p zqUVMtQ)^nns%h<_p$>WpZ(INPBWY{QNF`{v z@}AO|1@GQ*KZEkz)+fhBg?I&wHu>W=u=>QE%|N|A#zn5bfOtKxP zNtAtWm^i$1U_6HNywYhB1^YfwJ#E$r<*`No5hc<6&>giF8`yD67Z)2S3!=@Si!N8Y zeS*dvTo1#hN{VJOQh0ZVsnab`YwTQZS{Pv3Pt|VKOQa8va?O@BAMe@1O4fI;fqQtR zoEB!lS3+)mMer}JW-KEN`?T@|`S>IQFh~Rz&ph&qN3-nG$G+BvNC7uMpFM#)L6J)< z&>zQq?%J84pJ2v~qDlieb5o(rsTG=8)@gZqnuGxf8nO-Wtwx=B4kK|w@$p_GN$J}6 zvFSE~6#i$h5$MF=Z*14G95*8i+k-I0HG%tQ(mb^>Mm9pn4(cu-f8VMJ6v;r^zy#2z zj;9~*ZE8}TZlX0i zVj($)IP9f}CVY2KXc%AzIa{C$F4U~^k@J$P3lWzJSYM0h)%!XMSk0Y+t#VO#d}wC1 zK~gxU+_6sM7w|D^dMEDNV59r!xx*=Ou}6gz*Nw+pZKn+mA_2l5^RG^Jr$5B&xIVvY zHrBm!NJCraBg48OrIl*x!ToOUba!~`<}%*4eJbf)A zq!SyfB5Wr|L_THWd5kgjN`>mP(BIX=!^oZ?9S!_Rn59jZ~A6f)y)v^V?j#5=RqC- z8zNA@m=$iZp?mr(tVr2g#ejRirAJ{kPq#YW7YoM6-vk@>sb`m?NJg)caGBP$hY>GA zuk}#0bqWp6?$SCfx2DM_@)&!yhY^%~_i(?z9M1WEcI2BKP$L-2{XcxY2RxPk`#-Kd zwS=N*7-c3ayGcl7?^%&`$UbI+NGP&b60*sjrxLO=k9m;o;MfPp_+9r=@Av!r`9B{2 z`|%K+ai7d z7vwxjzKA_%af}iP$$iS#iex9pt{9YD6R~}r<&At-L0-djc_p_Z-^GtN^O;=Hu&LJoc4wDBV z4Q73h|-}D4wTglf)82!o>-ZW_TJIVa_q8hctrJknoh#>B{;k;w>TsTp^B@)1s}i8 zx;$m|f089+{*4}=t3P)YQbLm!oup7e{~EJNF3zwQVHy6Rr(Aff{Rx?MoDRC?iTa;lPC!;WCL>|6MLS3R?>ya)8+ zD|hcF`96dgTluD}btkjairQ3Nt~|hT>?hbx$V@(PW zjp$5TYE;WtdMW5JnjjToF0^fa}o~kw7Q2* z%pk?UGNM=>3^qEP-DUT1l&&Hy>kbiy2FS`ulCrvb*zf5i_9Ek>8tISAa@W#X8iE`f z!|9@|!@0_5T^=pUD<%0q;6(SnI>OkI@_k8DXC)sL#aq+s%O#S6Z!G8;GT2*5wIj9@ z_=B(PU6j6ExDB?;h0>i8nbmeBQEsOFs*3P-;n_pdVBZ3PPa)VPYmPi95qROR#h&*N2;nKu z1>c|~W7h{bD9`d;hjLS078BUpiWdlfadomxRYk|B^Ngx+_b+}{5!s0+)q**|~QH?u0HR8+3w%idJISiR4;NZvvA3>Fm?c0<2z6kCs<+W^>F z$;>#B(2jc2jyGG<84<^fUb9`v!fnkOaiYy5xG=c^Y(&-MMc=b%GTV((9<B&=6eTJl~ zkqyv3yICVWc1dXBOrOxaU`n#k2RTO9G+OA^fLYZ>aBMgLRL8!6i^u(EMqqdLm#43q zMzdO)t1{~5^_mMGT=aJqV_{Q-d=#wG=8hh&FFF*Q_1&%43}Sx8PWukQA_beK68Mpl z?nlh$(seau)$$-;SXPSKF`-EnpF5z^WBqcY?v)xkTDRra?BTul3r? zkLXe|@@gEFD^hakck_jGOLuKRQOuDLy=LAMigukAS?f8p^~?Xu!6GpRE+#-Qrid!p zU8>6PqCZ{z?*83gi@C}phwIXaFzM|}mo`=)8UA9g38FjTEa!8(IPGJ1P@Ll<&wj+Q ziHd61NE@@WiYQfF%~Unks=q7}^7H3%ZDCqwM&Y7iaBzU?18bjoJtv(l4z^K0FaW|x zk7@o#Tw{`sEC>-;LEm(#pfvP-E&GWDr`P^|k0~zyw4mvaW}~_D+?eYSv!%`Cx&^I> zpfJ-@MqQ;L08%|@jPum_ILzK!ZcWP-uYAOT*1BYf&^O4ip{*11LV5)mNl&_mt?BIh z^g)9@`qM@{UP}$h$MLAsiL1UbtqZGr)+X^!D=d&ypX`p-=9f70tIPqH=xuKSdbI6k zk&p0J?`^qL3tFy)k5Wh1M^I~HJ(X)9Vfg}N&6NqE-1C&4lj+_RqK-lrT5tFL1SGXv zrfg|6XgxT_M`@@O7(^#3r3YyL_6v22>p9!aga?j}gOr(+8vUNx5jsQC5 z%TuWre)_!ojw(!e@z@I zY8PC3j&3mMV+deyHch7CSk;SdFlb;2vMhJ=?kHc6dTLpFuyZs^0?LLqv46w4OlP(f zxi5{z*Pyg@qNNwJF1HZtmhsI+*TvxVX8FSmUFW$c(3qOv8#xWzzFS!7PIA+o=QHnj zAa$MMJb6xSKYw<#$ON;gW+~(`@+^R-@nd`*ZEQ2YTEaeMo6cBYZ<8dm3>me-T4uE6 zw|F^CK_Sb+c0$jxf==X`t_Bx2_~zpIZJIhTd7_094adO{dmYyc!QMmcWg2Vw+Vh(qI1$Md!Hhx z4-uaMc^`ycx^=wdB|yt|CXCG-Hf|V)ST?ru_JV%3l&1u75QC%@d-4Zg`@Cs;l4RF$ zy019J=w90ah7uL5&Vua5{5+prgs`mBYUa=Bx!FXdp$)Wrf1G>fJJ^lw!|Ee~t3lm} zEIU8d1dzgH@ny26D9Q^9;;!p^TxL_iRtXSsNMFu8UfBRXi5nwqL)*RW$6w@`+tIeP9n zO3rM=l*CaFNaTU-rVk>suH>0vRr{!lFLyj{?J}-Rl{GiEn>xjrQ`0u=8rkp|iB>3I zbi`Luha-Qe&ZM_6GKOcWaC6KTH{}lwM({1GMmMLY&bT{f*w1t~R05>dq^ujwdrHT_ zWDBEAs`V`3^XpPKqjV0;Eu%A0U7EEoj678R5$Lyn4`fsmT)o64R*@X(9uXa`vaN5A zT?<#0T=O^BgWcxx#8=HD`?nY-Pg11=lmpp35gp?i!nIbpT6}3lTO&P0GDgao(`D+s z4!HhItdJBx|2{{XKaG!h`gCt2>o(}Dqo-=cXQG$%5YBn5BWsEo( z*QOVhq?eeKjGsv2Pc|@bl+%ELr34VfU}9+F)a%!R6FDv1!Jvp&ta?2%QSa4(|*&CBSn>?$gPBJa!BS0evY$ z5LZ#e-t6n_+p{9CN8}|EZ|vf-XcO3HYL++YSCBW^u!OehD`8zk#Ue8|n|(y&$K8b! zkiOd1RUNFZohMRM0Q|4;hr+nQ&*Orh<>*sq+y)-BGl>46hhTnA1F4bkUvZg&PXn>9 z^nFvSG=NVZi2})KrEWKPMoMF9&+vVyA#t)hT$%_>4F-}a+53Kks10ldmYoXFnzGdT zQ!U#i_;3o3kgwNEo8T+EVr}%&lAUH$!Oc6Bk@r70;$_=6>B?r^Q6H#Z@uBVC!_{liuPYOcD3cnrZrhKJkA*vb&2gL%aI26 zDyu>$2PVMy=T~;y29*i)YM%R3#DJ>bN}bZRPhTwcFBuAacwP?j;(kMNJ2{K~Y5NGB zb1Grq^BJ5{a&@emE@;}VtbU*03G@)J7HE0majjY?+EghbFF%J_mgSa3K4_DN3+jMz z=;^Jz67QYAj1qwJX|~xt8<2vk|L6F{1QFihoDTBgGeLi44bP!Z46-mo5YS*4AT2Me zGWuZ$9oo+8#P3N7YF=QE*706uzz<8qVJGf5{YKOIYYAjBOT+)V{0iqZ!{t~oL+r#E z-ZL1;`F7J!BlK*9qPaGl>yk|Aagst6UTnslzmx)BfW4B(Ki`Fc4?M2`(CMpOCATv- zhlvTXJ!MHP1SHQsGS-np7W&IHtX7t?TFl24*&K@JbY!7^%ChLPtZFLJ-T=tR6Kmb_ zkm2;U<;>dqt8>MD3ikZ^Etkg}@4f<6QOKZ%WJoqLQ7x4?+^ zez*Tj&G~hR2qk|@OqJ)-uy2X1Kq~=%{`mVupNK_%RRCQ^S8Gz6?`c6ac~tqjFNnxw z9Xau}A|jGR^i|R(^0DEjmrwZLU=HWE3f_|L2-$&Qf;`;I;De>*Z#laz%()JT1d6 zsGj`%x$wu>GF)oL_~%QIXOvL7mK4CWIcv@uLq7(_wvq!0u+R^ykmdOBE;yRbJwcGL z1@JCOUBcGq5uY9EBq&SDWs8a_KI$&@f4E}@2Qy5y>?^nI(oAX4l8r25VW6T;1{4n> z217w6FlobQYXNL@pm$g$D56Gy1f`g3w1$bPlf=^rq4fzaJQZwh`P3Iye|0wm4^>W zd#jg~XOz&R`=>WEu4Z9!ip1EsR_|_P6loCBbQ3dl?x)hW#<{)(aBJj>1l#{7I7|-A zQPLg@;2fP}7URroCe;^RPQ{r)vj9W)L#8DpJyvi9ZEO2U`I|GKNKLP5?9J~_X^^S8 z5Ceh8NGEZnUt{&A*?a^SRm)cJk96NBJuFTwUm(Ciz<7NA{IR!xFc0<6v_WR<`^g&S zy7vVi2VO1*0fL04DZripY#7izsD4jIqwb`qoUY5Zkrm2J!ivf$e#4vP>DN5P5LDiN z`c5qyj3ca&m?Zmom#T>uAy(n}e706zSl6);Ov`Xo)$Kc`y`Kl^1ko?CtG>9NPt8;e z5b(Ezy21fwRm}}mM)J*8J#ZuNLbQO=Lzx-eVO7QvL(GD<;krL}UtyK;JzT$D^SIAZ zfwc`tE%RthW45+<(Zg_ESJ$(CZ#`JZRQGvwGlo^y89(iTIzm!{W>*K^tiL&3P)`q4 zZ!RE6s!#^nfDAdGEBsHR%p{Fdi@tnNY%K9!Y|rTZGd-Uxc>|SIbXo^~r&z~Jt@ORO zA0OC3S-vSJusq!DOQyyK!bd3 zpw#+)AutzEHz!<-L6jg=Rq71&kDyq(3asDrE&#?TOW$9Q1-WLI_$!DIwE5aFV^f2g z8wjbNp;92v>nF1Ft>Er3_BFx7^0Ke!33X|Bks50n6(_0?X4Ca~<5NK@2YReHCAQy`) zh~71tV%vzZ%@tS8%#P+2FIaaJmAX6dw%!Mce>aTZUw`Xf^{*yuk_PUPl43Sl76YAY zkaaDsvK64-9aQ6ZFvCPRg!bq3Fukk0$-bnE;5`5!;TT)*xB+qAjK_a2sO z;V{1k=cN-gy&YfB0DggY+kgjw4;JTtWbj{H@>g4@ber&EG95PC+l5c22wI#?;bj&6G=Wa5lPM}=im16FLmfs zfK=)9qCvMhfG%z>Uh?yJS$u<<(Z>tHPj%%nG_$8Fhev1uOQ+&)A`J^fF$dzM3|all z!Ri2`vL?BfU*As4c%vM%!M6`N@*SU>wSH^}qlAA=kgr#-PbM&wfBJgUEY z=N%=wCk)QB_~BQNNpHkDt}orDvmd=r=e)@9g1K%Nmpgk%qngZ9#h?O-kXYHhj|JBT zb0vvaSH3vn4l^&6b&q9>@w!U}HKkte;SlK5gCKk~;?J0=g>sUYzTYx6p~Q#&-u8CW zeC(kyow!F)p8K-Lb(jg=UP}4_By#>UrNUS99MXo3QsRlF#r%gOWa+15d z-^cii?MNkkRW2h%uTs9YCS0)*Z4OR8l_&i~*X`N-yxwYd+!N4~5WlKvOrwniC)&(e zKvIxj_m+HQ77cai=Ygd>H;g;PYeG^2XxKmS>p4ksbKRWtS_!~A zliBt4Jja>CnME#7Ypz1&&?KAzq1wVK7E+v4K-0kb{g6GfA?)0k56_IuSJ0=#3?>7x ze%PkefTkO;5{Mn1^)$@dTJsjS_;OcWG++KVvytoxCE)2#t`DEs|BwvEK9~G%@m(5@ z-Rey7FN*7D1nb@0^S@gntzzf57k912tU?u4TYFYQ0KHL!tC6nNGANw}Z5XY?G@R+o z7?BR^nPY*1K{H}@J`NZQgm`WkrhGO)vXZdsmN~dmLchsbbFxjy*?8!c*N}*VD|WmT zICHK*;_D_q+7sPVOb7N~abiEnxB5*ZC1n#eR1DSh^=sM1NqT%~$0CG9hI3NGvM_4q z6Az_j0Vob$efCXra$M~GPDS+n9eIEpcu2VPDL+bCiDE(&KHg>AM1yeum*7m(u3EKQ!by5=8*({g z)F2uC0-TzFJFQ!-0m5YnWMwGD?N%-Weixx!U>+YR@i3R&3VS3mrlb4!~(f z;u>V2*G?w+gBujAvbQLu6XF|`+;M43N%`iSDlkF8w{pEVk#De++(QWZRCBbk1*pZO zV8S%E8ZUsG=~vHs*frN+P^K+U86Eo$HzwfHUlrsgTIetu<%z@=_I=0r`g4u#VAGXw zmW+*UCf-xI8C9mc&`tG3|M1I$ivs>Xdv}^{IbDkv|qzyfF6-b@U zRFm9i*x3aw6VYh~c-UWl+g}urWDvO?5S@zZjDp7MeG8ms3iM5@IhAY5rx}=k2$uZ{ z1BWYJ-wBVwPZK+f+&8wS`sB^uJ4A4=y}D#PBgd!0C1?BT!JZ_v&G5Z5;eJp2n{CfN zY{At0R+H4tbmfgn*M2lkuSj;O6hk1Hh?j4! zMLMpK!V6u;HoeqM_EMNLZaI%dQpdVaG{3n3aD^f(ZfeD71UE2*anyOIzw2`QkUMUw z*F~FgW8L#B_MR{`XM-H`t&6co!?dqnx%PhCD{a?{Tim;UJZ?$8=3=GyruU2%vG}Zb zF6Lo0n`aW&>DaJ0b3QeJ=cB@H+2-sHg_jA{}gv#Wq$4xHtq1?Bf-%&Jq?2|NUG~y?9{V8ZdS1#>YuOcAtl12K~j%4 zpKC`p{0-~A^G5!j++Od*qcWxir@M+! zx{gy)&JLN*oSG4`m@&m0MI*iCHW*v6NHyc^rSFFG`rpT1+z5Tsw`$mKx@Lt=e7G{@ z+!xKWfY-Z&&9-O!{!+$uxe61N_JqDbHVUt8l>gA`%G)WCjB+wCq4z82GS}f|N4x|% zuDhz}++MNZv3Jo@hG75-3W4_t{pk!CP4U|^b7oyBhmJh+dlaYerb}vp`{k=qoa0=< z)YJ1xV4~l+hQS{sb0<;*Ekn=#9l_uL%9J|_MwesLiN{5 z_Gb6B+g&`XWhECe4n*RlxcJ;T%l;xpxEDog8efQQ8fk2*tTgPJJ~ZNaqTgc4Zik13 zp^M?w;?2x0XRT7Kp2P~_{xym$v2pzO5T<`7b3ZgPU;q>hck+CA%BCts(Q6P|sGJ9TKO+T*g1)st<>qcZ>MQ#cYBgVGabYz*Uoq@z;SuKvU$KK%MRw~k zyz}h#;1~1s)dP5$KVb{M^FM_KBd0=+59JIP#Sz046z6x~juiSv-E-BeubU*?*G^8Kj(O zi`e_p|BZj;&vEr(x}0o$dg3(~6Za`o%hw^JiLW#3_#Y49(#^8Ru2<(D;)`}w9_?+v zCQ;|PgZrSjXA602U=^L87VQkoPW&^Cu3+5Gm6&4BgN!Uuq=lv&I-nNoePOq%Kv7s8$ z%bUKkt=tYsrp@ivO!LlK7Ylf`=GC1`0uXQNndH^vy6%M4lH<2X(%w&a?xB8Zqfd3) zesYNY5<}l3D?tv#e#_{}F^Bb<3-InvaQI}k7E_AIdPrP9Kj~@j7F{X{r)7wYj^sYg z)HQG48uGcaVj?^+AoNf>2XlXi=KS28&prsd#L3xB)mF&NLsUV{3!7ag-3#}-j&FL| zbswG93f>r@%duYi-K4h?+7m9fxJLHtv(AHa_k@ET>FME%p-ep&7JMOxwD-PW$q6;9 zmvlp!`8dr5OT5g|UL(Jm-CSX7BpgCB1iu?GRNK}uGz+Iw-{LX6* znAsKB%9?4*PsC8BhkV#DKQFo_HEcjY=`6vD@>%W>)lq>yW7P74i91Ag$_EVWRQkO= zec@BuXG9d&csJ^J+^@u)**2j7JD4!=UlX?Vum{tgP%YCEL{^&?bhe*{dWV1yu~;M? zukKvQvymh(X=%LdSzXP_@Sd{h%;~f2tJ)bn^h8TQk7Z+zT9OMLY_6f5g{d%)(~&~z zvObz8t5RXk?XqZ4LsYbk#K$RqMI|h}l}w0QX5ew$&YC>;KQ1Pt!%JN$vXaTT>pK*2UM)lTW;ct(v+1G4; zue5Ez{fJoF%6jb5MxKa0NQx9$=f&LkskizEBtl%>stYPta>_BPm(*|RoSn8_YF$vN zmfNsop*iUJlfPV7K!N|a^oJ*{?ruqw%WI_jlJKgJV)ZVaG@5kK6Wbt|k~RjP`G-Zs zTrSIOW&H^Lse@OYaOK()7IJ7ZDmpR%YQ7;IZSU5EV4E5EjQ!$*nlvmP*U=o)i(M&+6pPOXF< zg`za?TwM%Vb9{a7-4{~&B2EC=n!3GLxZ54AvscQ53Whu7?^jNjjNG!4SRJnzpBC5M zba7cd2LZwwmxID+db5JOY|oqrIRjT92`En#t0FuyR15wu80US zZY{NSo!Y2O2y7ao%b~8YjO`fztxySfUKQs#y^A(eS=1qX_X2aW5h3O^;uV%-zWjBB zzG#yeQLR=#h9mUHt({iTi_2%Y=^G=YlWN7)EG#JxAGuSWo@YL88Hh%zT2pe)rowkN zcR^%&-ec)w<{_OeN?WA#|t9Gkf3_rgZ z)jt1ndMFU|8D0otIC|8UgZ+&y>|G48sp{)MFr|pp-o3932MjH$1)tiOYb>cp1h5~d zgRDFB!iHABR!-J6CS;*&_^GMZh$$K*X6!sH<8R&B&URaJy80IzxlIKsPOMBK-?)X+>fJ2IZ&}? zkA!yQ!=kgtP{INa$EO!yiAaT4d2uuJy9R`?&Sum)7n4BEW=ubEBo%Aa)NlJ^WDp-Y zX;Zj(I&En~{N76V%0O>5f4hynr8pX%U~k2_y*Rwt|8GETSw9Wk<|78Hu7?CdAnYOF z`<>0LvrmBmB{m2yT4oUYw45l+X`mJtE^N-4h$C0JUbhbrh(@SU%_k*DAAZQ=N;gJZ zhoArkc;4heDA1`AXUynE9-m+()X3tF=~X)B^o5Lqh?tJ-xbxJ$zLk#GHdI8TVtnxN zM*RCwqdl4zv0*yP*}Mjv~ zZTse|+J6ht_ATb;0nn{4<4hn~GP}vS_tyjl^q1S{-Pq2A`oaH}*zG5DUbs4;49Ok1 zNaXJVqGWsl$+3M-O+t*ZD7uR_hCbHu7|=ax&=ZhDwX5!bLMn@Ykr=(A+lgmobUj6| zbEq<|z#5sNSsstY>@FXrLn?zGAd{b;l$Zvck@{s?L%ygwIiq^QZLp`ypXcfUzhqX%; zZ4{;eWHCmS9D|<^Z^_T3$nw%vMK=1ML%&RWW6{OdE*E@#`4;J7>)Y4hS=9UV_aKSl z;o<_qN7bs|!LN|BB9QNl9Ll}HU$Yf1vHkgSjWnMBn-9JgJBpvNmoB$(fNMMNNx{ws zIrO595zkd&8i*m-sS82(@7%h@_K(B%mSPIFSCrNGKQ3XGp$*@Bk!l1vY|cm8bNf*q zl;i*M2J%fEig{L@b+C7F3fn9ZZq?U1_KydXACwkuI+%4)u=+RTx|7giA|IUs|NDv; zq_3GnIzG5`gF_Ojydz9_T)-|hY^GMM%EEH(e*cat*zd@soLr~k9e;^Y4=h5r98^SaJ| zmJllm*}u*{WHVh>P`itPS_$`gZCgA?G2-9(2DFU}tur`kQCIYA2E0n5fra^J#e417FZT+Wd91=zLA6UewU{BfL| zm{fHD8tYVd#}_0iT|(Yu@qdr6yt<0;aQ(dD9!>Zf?7^_rrA&ZZpRE48K#BNT5u6oH z$EjV8z6C6}^F8opBvA?pGWV3;_g3L`OylLN#YnxFMMb?S^F`IdaoXTG=I zIbTE;LJduMxf}oI(i8-j_IpJ~#Q3~w)k6rHI>*V_b%G%e&7n#-6ZL82q~t@uJ4VU) z;srLZA3$^OG?9#{|2p=EorpJmeGTY;oFH<%tS_1$1K)u&UxVRh{L!}f=Geb}(Rn+? z^M}2isFU{HzxKH9g!rikbxlEDRlDpMFw)2sen4_O_G7+<;=(M){=}BL9XQBOf`uQV zd6hL(-sAz~2PoA?LNp>EdE)dQxHh^2K7S)h{WN(|UmpImD4#0sldl1JNrEwT{%%Ls zB;;IR7y%$uyfeG!R#69;7ZH032)zOCB8?70%izHFS@rq*N|&GH@?kWr>!B@gIP_81~HkiKvv#J z-&_xZdmLDd64shyIrN7o{FCEm-;kA(yD12VA&5M%>ji+t0|oCNyRm@X-sqBYEx(aZ zY_v!lYN&5@2^R6d3RJ|8V{KjD-s8d@y7Q|U{;UDSQg>Cju8qEDr(Z1ATu^&i z8f1{`LhauTjK@ZYI!lraP0^Bn?)KnscVBx5s4>)W9V#%^ebouBx2nPz9R=tHp@HB4 z{GR3ho4*xHi^k3hw(S11T5s;Fgj}PTnGd`Yvs&y6bLGqY6JlQ@ zz`NL&d1D2w=48On%N~Z|r{Y%ub-byo5WE0V0bIEJ$&Z=&x;&tF7I( z>R29QubMT_2!!u;Is!BGEymubIZ^`o_gOpv=z~IyRp%II-zDBB<7Oy%W2o+|V1*Nt zLUsa@mj1!6<*D&v8E$CZxNR#!o|Hm1epUO)nyr1V$Ym&@yZ*H~H(4eV4F>QD!rD9OBpGoD02bA5PuXY=-l-(# zVPJZ9wkCpnswlP3yiT47e?%C=#0W=z7VLI2iACN5$}e-`g!5oL?>~-jPEXE8Nx+M5 zTN>vN+aRq2WJx5Gzt`bm_ikJBX}3m1|0|AN^AKGIa zxAL}A0h|B?(?`tk8v+DkQe$})y!6=Lnx0lt@oHJ^EU$>5UV%q4#1(i20(xH$+4Bol z{%jbTj!!7M45qB)f#j-E5Clke`331hf4&IL@gnIvd>ln(*jk?&0J$n)3-{!jn7S>~ zp}ZiF7bMKi_VvfZbb4uhZG^|b{(;2TByFkQ3hV~;mxo_0=i>%sT9YT1DZ-Y3mmxK) zL{rHwe1O-~#JMdv_h^8H@R?&ng9Oa$Id0aW9u;dWvcXpX-Tyxb!lA6cTmo`~5i9&9iNj=MCLi*#Qg{rb*Ux9Dc z#LO*Jm)TC4Y4pg1WKez1k8bo|?p#t;g5t>4MH@?2E?8X~U-d^vqBGkYKPg$S{3?eB zw6+#0PO8UXboDvSz~pU`h?gD%sq4MYFGpbNKzcLC-~)D1Nhv6%$6RY%a5a5F>AJ*^u23Ve|1A?15}n{08J z5WhA%;J;kY3K@d`JCSOhmm~~@!vaAX0f$P+IP^QP&HfLW$}o`t!Pc74k(V+Qv0NH- zX&|lJ8cNw*s5?+Q=d`UwpOmF0pq)-7U~9|QP|4(RTjOJPna<3zJMyC?!~;z-M4jtp z7m)1M19<&iGmk+wMV2Qde|n&uAf+%Im)|+p6h%@u025PmBCHo+#g9XR&pDEmxh;~3 zYhAN`{FD^wc@8?0h5PotnzZNbd>XiD&%X3Fw6R$+vm_9>GB{?E5h#N{p2hdsMYBu$ z8zql6>2YUix}qU{JVKJzR{;=A#dTJeN?9p`*@@C%kks%LGN71D6jsG0+!c*EyzccEwx>lE~i%185%5abr5D*q0HLZimQw z>y-(&2Wt{+?auf>SV*LkOl!8QF01Yb_2~@cOraVvN3A!XV<~S?Qiyr(J}e zSpPz*7#XeA>{o{ZeMuhiAaffv?ig;8He_y{hw#>0s#`%g7!o= zP~WnRxIO8+)$}|e4$5K`1m-yw#W1^;M?0Mhp`lM z5fHWN*GJWOz;qzIw7HT}n|X2jH!xmaiz%f|$rG6&8{N=$b$6I>fy!0DMsS+g8=cCp z2B#S&qt?!HBscVHp^uM1%L6Ik$oME6S?3{5WD1WC(omkXFuCih_QD(pxkcq*)^T<% zmkxmGNQ;PQ)#)yQ?OK^GYX zu^A;uA!k`FdJ4H-`~xh~f7=;5pfcA~L(MkQx4Qdm`|KW+kSUWV!-8MNSUyCQlxyaJ z!c5s&E2uiO4mNwacwbP+LX8w7qMNd~hj*uW!JZX!u9U1ztQNmK&6>A(`Z)5zeQ?X;5ggl5`cBnWC>XBIsuWsh1p5<6jB$jKb3jZiuq4y-ex*t9AuCW?~I(S&H z^>@%gDq)UA6tjBq2sNhd)#=~*$;8^kz;FN~_SZJ{z>CryAx-taP7QUNVcIT^Sq4kQX!TZrNswRW3S8MsZWxmT zO{*l*1;h^P1=`S#;k}7X*c4pZT=FCBCIte1ci<$zC&+5zX<)`9WE#>LgJWN)SO+x{ zNtM^P7y8xfo$a?)!?;4`{w-&*Xgj@g>SkdxE#FHtIiO;Ia-iqFAqRg#<^DJ_Er{4W zagPhF+ol0HQ*rZ??-BBHO+Nru_eU3C%`zNr|LE5dW*lJ>(&%f01{xY~8$rD*+^lPY zf`q7d1fpyx`pNV@V&$O2GV4r28Mf~ULZFuxmwB^CC;C-|WE(?b4-mcIo`z)5 zaqVOQ0mtopzgW0C9?tjC0wy6Ke8xanFF1PZG{~nsSJ#}nJflDnMARp$rUVG*vc77g zf#1Oq0SQ~SU#vRe;>LyS@~57EPpJHei043#d%n2;`I^ekD4gu6BhF9> z4;`-s-S3QIx-DjChCxRcT5|#jm`BeJ@wgqh1wfPA0BqU$vnJvVa z$cj{k{1igjpP)pOA;FlE^}OQxVCd8Xy4sv5LNfg4Bm|mb2)7qYx0D#6v8a9v0c860 zY{ZHUq=DIcM(NzPee`cVF}X`~tfa7TIy#f?6zy>+?5Cmdw4M9{GX9B%;Or7&{19uBDLNCmT5xe_ zi=`HyLECX@TdxDauhx*9@7p5#s|zILVi=uB#HA9S{I&Renx!+Z_GS3$}(%vNyejt3-w z2qs>(Y;IY+^r+G~^t!&W07xK)26O$U-BQ5(d?uqmb#T{bev1o>Cb0lSFQ4p$ost4c zMQ{|z2S0ffAU|#$*T>9QaOICQrf(Al2&Ks@vwEpHd)_yjMMk2xrB}IiX9hHCsQl=Q zglNQ)8d-2NWSNn4?ZSlzcc=Q7qfZ_q^`5!5%~N7m_<^2+>f(Kf(N*2f9C49-#CF^G zE~Z182z9ELm(X2yo&gGhq)R(~)Za^MkETcd}3PVUwq{R;yZ$j}vLglx#}-vG)v;MfRDFHLzwUbu2CH;rMq zr9mgCmXI#4RyEU`DRjoZ2I=41m+LN-awQob24qrC?z;5ILUU$HXXroSssExx)J1Ih z%(yo&E7OB$9mTrmMF2xTRvNP(*jR`DgAYyfH1z*np5F=TK?D=CgRgYv0Y?>zx?F7T z%wR0Q=1wz>jSVi=fAM#&0nq(%RdHst=+D(M*fSS){RX9ry}SBu0{t8Di~S*`p&jnR z8rP;kNRIe!5NkJ@#K<~%J|7D7=$OSsRW!7FN~Y+Q8ynj@7%iOe4Jk&J{i}v|2>AKg zrQ0^lHKia+Op-~MIj_#y1X`4zyr_EfP5>+9Lsbt}iFAHKs1KK%89~=KiP+2xQJ+<6 zp^sQ5MqfE_!EmZ^;}N&Gc8WvbLVL^lW5E2y45Z(NaYqQ4HN$EzulLBuxWVx?QPJ$J z$z?3n%X+9JKKVe?PV|K#o3eLrCI=}D;uT3flZAk7%-qCPPaH1M4&PnY7_7^irErO* zxXApLWJ`^-1z4XneR2(?4&jGea;}*5*=^JLfDO#8G%e90rp2 zt~qadnnhzu5Jq9DW^j7VZdI%-M$mo&v_f6YxhEt;<@$_dUd!8dP)xY=${z4r32uj{ z4z1`Y?q`N0JtWqE%IAbuiY!gG4dnZ>w0xl9oYjoXa=eRV@2T1n5vDnsy4#(Li-qKG z1GweqbQ-Q-7JciN4Dw=e3TckJ>JT_Ak^_m&t-YyI@!FK;l$lVV*Se|*sy$yR;FlqV zz8wtRbZkf3JDmo(NAx^qu0&zPcpjY7@|E5)wAy8Xud_g6>`;NS3}alGTs=@cL0%wa zPD0ZM$+N-y=?{Q9HydKmeQ#|+fI-5>y54kmh@~1-#s~c81TK7pMD}Cp{+DZC5>^|i zxx0}b?mHpD?|VE{7Gy>|Uy5vA0vXeT^Ck#`>bImVJvvv1F7jB-)xNe26M`n9lFClQ zAej~=gh9QFT$=p94+-JnA!I^f>g*J9t#GJTATuL`KAljDhQ@R^Ode=Q{Fx8(_87}r_Lu2} zZpcBXLsAL19XW(GJHU}p`l^)|EL(26f0o`alNI+ka3OG820*BKhRXJ7^?Od0*kDXo zCKS1+p>=HGt=k=NVzCW4+eb^1bJ)2~dytt^H_L&rv~e!l3vC)0UOmFtt!I4?S`}|} zOOQTl8Ud1@*3a!6Q0;!1>X?ZASov@A3#28mIpFtFICgYKlki_Yq-qDOYQTj7IZmtF zM6^kntbxptX_lam_aQ+m*uiAX@KQ{4r2NSfk!JN(^(Z%LHHi(Ub`MPo{b@0`^!Y6b z!b<*UV4CJfp?!V*EN9=9oCvVyN<)7@6|00uPDWWSIEo5t=JatMpbk1_%6Z}_OwlC4 zRe!d&xG@+XU-SJ*&(UdLr0Wcs(^U$=1HsD!V?L*#tp@E;R^3yFDAM93sN2As(h-?i{njB*!*z)lx2y-_kEZ%JKxu-K zStb?@jj9)je*gmEpH5(=JOeFfJk9;?x98ppNSjQ{G&DA3lC+B;Q385XlaSvY#Jeq8 zbYonxiND5AY=;LYsQd!VWUrEgiK|DE3~s~Z?C?4BtUKF}p@T5X#YsQcG`X9?+#JQU zfA2;`{2JFA=dgjjNqKui6mi%Cv;w2{kBtNdix^_V?v<)rOV{CQT-ZR3mg0(ll5^+MrN~M|rC4 zpor8fihL_>W}i{MBRePcn7WK7I#ZES;u_JKkMGk*ygKQNZY(HJ89b!#zbg^Nz@Av{ z2|TYmg_CJLo&Xfy{5Y~y;qjH4WW;$oPOh(}B}8)PGj?w+X3v2tkMx84${3aGGzFuc z9J`hu1OAGXXheAJ8>{W?BUzIgUBw(II;X&YWYLJys_%^W51P9J891RhXILG}#?9oi zuBrNt!h@0%8#YC%HH<6Yac~L85X_loSO%SXKj^JY=9h&OM1Cwt;)T>i!;9He0ctl^ zr@Q|Eg|g~&LF!rL1J|d;LbR7QSb&JR*1Q`9tS98*Yg;Z6NJ|Qt)oLu z;WD4Y%RZC9|7p*Ui~;}z$l8lNH@O;u0jFO<8sjU|ea#?0XFvdN4+@b-NX?H*T*`4o znXa){k}du@$COqH2FfY&q|rl2&VJ0uOz%u;+_>Fi0fVBDbDN~qFCN-yDELWJT&sx= z#zJ8Fg*+2OOAUpsx!sWoWXm5=rV$}fqk133`#IB*fmf#IH6h(;kgo(8M@0rMR(`xt znMhay=R(OR>2}i~vm_Ftzm9K<)IP`$iV6Cmqj}%BHzJylQbFpMw&n^4-Ak< z8`2pSA>CjtK4Zc5Gf}WkWnpBC0y85$s&Dp0;pY=t!DYvET z{At${CrMqiOV?~>oQnDHu!YPSSBc&|0AlmD|Z|Xh$ zKajtm?K=)=6u1Vyd;?liVkRD&w`WiBj%+41~dRh%PM0q6Y6=onlKblxHjQbiQ8$D08=8( zi?OkbI!TGflf@gbp9uT|CGU~|h51foCa(+;>a)a#ahF^l$h3IAC!3Q=ZQ8OY0A>e0 zA{xXaGU?U}@#!p{DM6o}efWM&u)yo(j_jqwhZ(?{VAP+$|A3pnIyxNy$=EJj77^!w zDgQkhFzhls%WRn-R`v7tT&@eIUC~xfeQ_|CCU<_gZavCO42i5XJRA6`i{)rfdwD zh}UOlYAGpv{M=X1fkP^v3F991S zB_=$-r3>*#?Zq|5yXTi9LF?7&u-Agw3E*{ru4$w6Db&4SzM3t0xd*1-&1oR7WG%HV z>AfCwVmOUe(lca6%$y&& zVyAjHF}*zFwqI{EdN!YmfV}lMTR}aDSl%W}zdD2YJIx1U5d@3$aL>mcow}a(T~1iubIZp_6Iw9BYd4{X5Rd2bNhf-3Z8(u?hvZriJK>}7Ruq(9HQ=W^fS&}QvHkG88sr1^naeB_u6LLS zIxJnfVrw4&QXs+^^zbUJOHRD(N4hWwB9_lysFs4H5ll_o;nXs8@5DXr%%VV)S-P-b zP(3vO%?ThK%>N9O=<_RU-R&Iz{)FOl`*ew(GNtDmZ>Y1!_xanicODd5=c)(sLgfq= z#&BJC8U~zA7JdvAZqBd(5O}l7qk9=VB^FJnvRzJ@y25&P*5jaz{J8nuvm_W;LCiSn zM#cjGIc<}3W|?Z>aJ|TzeX{Z(C4NnOmy2readoNO5doRxc+E{S@EBw&cd`((o{Gtk z{W;kg&7HFMhve;#k(?|=K4xGj%(TdH<3^n;(rTBmVd=tZ09sb+Fl+eYDZ+d^US*dd zJ)PqH!xZM%A=BHHeS%ECeJl}MB-C^t&aUK{i@LQ}wo)kg!uow^=Am21syQoZ7n+H? zt4x4)m}+h;Q21eDzUo=Ex|@xeV=4PyfVZa{!lg`1&uA|!1Uef%`j$_Y^Oz0|N6VZV zFD_KSXB&gSm6PiSDN+Z3kUEy;JY8w`M{zLira-XX9*+iKh4e!wDy(DeNHerPRiKw?6zC4*j2S>zJq7p6mOWgqb4a&leG|9I zz}&+~k(G^bN0xuLk$P$+|CC61x{JZq5H=EqnN0cMZBi!MP#lXnKlC(m9o2)LB7rMf zZ}~zl2!U$c(eixDIWMcJj?c{!Yq*~3)!eK^T2*c){SmRD!Cv#rvEuJcv^jmHfF3EI zRcg{?4o6ATbnm3t%9yT|lYtn^n+vRM0letx?aA3o>CKz+1C!b7R@w%DTyHXh0ThfiQ}?G*@+cJt@_fs zO&@z=MpPeYzt^>&*UpF?$RCRAL?vFVz)f~D%DT@#>?{#W;vH}ssCY8n?WX$EHYegd zrrIM!d%DiJGp9xOs*W9AgilI8C;2ZLyIatA+LZEem0%=aPrp# zuB?o~ud<5yyKu5=PSc9|ZuDCq4*QaBu;o>uezC^f*R3?{3aNC(D(ic|$-O=nGiv3Z zYMu%BIcfR{$KkY*uFBo{3l&~McKjrSC7SwD*JfX}2h|rBd*i$46dy=v;*2nGP2NL% zcWA9lq~x4~oh)8EXefx8Y0RlBt;q2R#%b)H4vN1vpfKWi0|#p9QPGT=g)GDTff@Z! zzMnU~5o?raTW{ps(}5|cu8EV zE&gpVeWh7iiEh(HzOi~ftR(Soy@0|NqfQ5mgtq#Zv0_&TTtq0}fm>Ge3;4q9de_>) zgS4nWl-m*}vYiiT&yuug-0`u}^2r>!Mk8*B_oOul_?j&J^dL zW^aFRi6(t#a9Ukutw>P00uL{#-hHlVVH%4%6kx%I8r#wnq_Vg$St33ColW++f!lJE z<3P+45#F8nCrPc(t;gpXMZ&u?&v9gNkcBZ$vx)@W?>c;1E6r81epMxUo!Dm>NugWn zi^H1D+WQKMt}QHQsdn4>SoS~FmCCVL#`n8JZ|u{>?a&3T$WEB=y_*<*c>wS7ow#Tk z`P@KPoDnTsh#ExejTudZ`xnbxpGE%y>6aUKR+^EzYSCeEiFy+{_TojFc!PqGFNwLP zsc2SM;*-7%UyAM?m~c>Sea}v+&m#8s)0s|&Zgm&gnk-V7%q^>@p_(xfU?8n4VpSaG z$M$HtU(+CUkux}Z(Agm(jXSMaC^}8UsK7*BCc*=sfGEPdmEpLXbV|gSWB5kfqbEFa z9(^y?t<=HU3}jgJTlbC^is)(0jbsU(|&@|_Xbr-d1 z4e*$FEKo)Pi}zmHo@FM_FQJnn@^NpgxK1(crlZm5{hI&Uj!79aQdz&auspk%M<#WJ zzAy|Z7PwB>(la4j*8Y0BEjNjL5E!zz3M1ZtcOv(F4N0tZA%xBjc#xYX$e6s_7o?U= z=iU54Oc}G)rW!Z*6b21dH=8LLr0qoqdV4o0f*qi*)!KXvttHE_iCJQNy}fzEIN;xy z!An(!9 z(UNSNNao8l@fRfC1dt{0O^K$e^3si%k_oE0OV+bwgn-;Y^mt%NPsre7s>Z(``A^p|uuV8j;&%mVeyS6?b@a)27hc zM#g<*tS|UcU9&4gs{WZuE=fWKSd)qy=4a@HXf2SrkXK1(+Onj3kXU(73hvZHzs)XU z-a>PaKA&%{6g{27pNNq$lwS+L^?^KfifX47By4eF^O{eqxO75=d1$n}+_17Y2wS={ z{n%L5m)ce7uDe8@+Yg>N*$e}uk7}PKCbEeQwcem-%eawV7&`Dn`^8OugAhL=4xKXU z)V6E>z?6G4%vc=1RGx?G7YQ5;sL}k|pKU zPHS`iNfTvSZTCkM5#dRO*wykg{DcUlJvPK`ZSv~@XK6y)QDE}io3oPNM%j|4Wxw?)A zUoPSfA$}U27#X~NVT2mM>vOHl5cuc zTIgQ9U03RJ`0+TuZwCA-%pEfeo#B7yltIsk#^tz93^;A230DO3QQdIjj3%j?9B8Vo|84aHUM(6W2WaH@6MW56oLvTIE?(F|6BUQB zTymx7Syg`re;9@sWtHeS6g^tyhNxM3Y38@YmN?p;a z1fL`SpM>8{WWEt|Ve!(lneE$X%pUd+x+21flzmG!xHiCT=rvk+;@no6m5+i_ z`t$ftH++8;Ts#kfGYoMioi3&)*t9=70c#Gq^vg?SW;vbf03&mp^x{%MH-_F!FSya; zTm(B)IN@g&WnELpU1vgKr8q$4`e5V=2KNPRgW%~ca&fQ6&U;+jz)g2TLSEdo$_2FG zXEU^~yA$_b-|qe|5I77|J~30Bi*>_t{?x0}4e5r>Uc* zZSgo$5AB!D?kwM(q*Sk#+z2EgUdL0 z^JnF6BxX${wYNVIOdoi^@I~=(0Lbq1FSdWJtzV@3rg> zwE4F?gbnx-5N0l&BQ-mbrz1&D$XrEC@@VADzS(_{Jw|YI6HjqA>~>a%uZ$d?>O|k2 zT$)akK6_W3;`&rH+-+5PWZdQ=a=GbdGbX?F2l65~7qki9xVWQpkCByXPc#tJmQrr;_=L z&7Dlh!@rTMYV<=!r11x8 z8I~cg9&7c&WT^dZUg^CSj6%=cdKYjfb?KF%Q|I9)NWC&DrZHpUrWLx*&B$jDjc3VG z%BK;c7_03*c${2+vFG07@w$q{+&E)NPWHNkl=>U5`oYfY^Y}W&*N8VZ2!!$^d{OWI zuYw=42wl|nS?=!LMDYHGe2ugUyOG6o&!Ce576ut@r-d}no&;K-uhPod>P7mvp43Hc zd!;7uiV5R*6EppW@}kj?eIspn1c}uvsGVj73fwM&VnZ2_8!{A+>l>EF8KRoRzb}?c zN3*Cv451?Vro_7!GdbLe5!J49kD;?4!M`YvBiL>M7sRpQf_PsQI~GugJsmJ90K`G` zN}QR(GokO?joq~qm;>1c9E@TF{U>i?PT-x}GOzN_Hw(SZm;iSSM5({cl}4D;#U1$O zIUJHRctz#U4&aZ+CjMNrA2e$2Jj10EEhuFP-W9&ze-Utw?WZMNq#%b1Wuhw7iAsV< zWKV5~A4uHetO&u7u2b@U4M9>d@oEctKq7SDT ztO9IL8q6!(FKq={JYQ0$d-##wu)$7h5fety<`L5L{NI|iXX0v z+xGu_XNO_T8T+^ki}AYx*eL3^`#QLnPZt&wO*4nMK{zy%%aWPY2_HZvyeVhh9ujbZ z>(;w8=hz~mCsmpD3|Oe%D3(6O#6{&*-V^Gr8py3|XV=u%vqkB^AeYd*`x}RDms{zA znIfml`U4k#vgHAHDr!AEq$aU1lbi=f=RZQfb_u?|iV}kQ^U8vn-k*Nq;Qf)Q7!-Fc z<+YW2d-M6CHuPI1vx(z|-Z5YAlQ@|@A!3mtJT#s%0yZWsV1rL}y6hfS2yI=R*LkY= z&wR6c?2A0hNNJxDNGYfp?;J}d>M5djrHMBbD!JGbNW_@BxjV;VKHi2xh2A&n_@eoI zdp>Lskn$k^9|tGG9~8wgym`QZU3XfU7ZnY%b3Z{<^N?Q!a{vAV&uCGaXHHEW6KBYo z8`A0r+gacCT9;AuhVO0Q^d-eavi>O{>4TRO?!o2PCUEtSC|@ZE1>Dj_x+S*GPkiFQ z70f_4Eg~=)&jKEI-0*W#U8|Ri-S%7z*OaSQ|($9^md^UUAVz4Z0Vv86Z#F|u)pnDQ_6&r~XBPuQk6#tP0$8cTCQbiC(8lZ1V4^{@Bzujb2~nNGWx1O#3KNqglmeZv!3aJE?qXxdMFh z+h8?4c#Xi~1@~ql@SF!CrOYWbcinVqeSC@5<|g`1EH^c+qtQUZJMvsrwcX=FQWqN~ z1B3%|L*F7Iz3<#E84als%T+XS>`I5DGz+h0+VCf>Tt1G50P=Y}%ZSX#>5C8mflMUffg609JLtTuA>SV%tj9(D-0o=6Hn-bWY1EZg;0b=moZ&V@=zJ zZAPxi)D&v)h1Wzxo&^_m?+BIe*)aH-O+nx>2=3eRqX!i>FH|}FK_+i7XmAgEb1*r@Ln)6%i@Qbv0D6?_IpsuvNKd_ETLrN2q!wtcj zg))&~oi4YtHIn!=N4_(*ac|b11<03SYoFyt_$}c{v9Tx=Xh`-Z|K!yYF0t=&LLM-- zn>M=0B7mYHwh17n2d7_Lxl*C!(DxG24_Ycbn*%rXmno5N_92=vmhjXMZ^S%9>WD7XX8{u2Ho)j=OOkp?jw11Qm zXqOfoP%)*Ic@Ggk`2#}4DpUA?h)bJ@Xe&jPaJ0X`!Sn%Dr);$X1SBSmaF#xpexM(0 zmW#a(wpQvX^Z6Dbd;1>v&@WU^UknMoaOfsA5qpStq*zS1`_@pC^GF~5H_^C>>2Ob+vy87oVSR>ip2JD)sHiQ%FDV3|P4I zwY)&Y)@+XKGX+IR5j9+2qbfFA+ z34iIEe1e$Q;A{}=BojrT`ZHAfPrU?vd>H9mYXSK!LP8=zY*l4@?Bp8=UmV|7SH zFhYP6?n0U;>1B9`w)QUFcWEQ8fc16w-}}}~vM95a*MGprhCUekl19YU!0 z&mY@V6$c`QZMY2qB;=*~cqnaAS?Vdfkn2UI5RyN+S_21-liu|#Yv4PyjL6&e4 z(CVVhTPw@83IBl@P1glv!YdOYOF@4P?NmY~Wypg8b}d?MqiUQwc)Y7`x(M^VpGP0t zjj6!1Sk9$ZvSImSRVaMvyI$x5^or{K#^m$}2Nxc4W)7*cAm3vs#eI5`e-bCL2a=7k z0t0;C2#Yu|6dCp=RgGG%f)>n+47V`fw9-TpB)9XcKA}1JZphhF-~htVd0Ql)uO9?3 z3MAM-#m%nUs%P9Ru-LJK243C{rD~K0qEQsfJ;J$an(3LgP4|#kvts2)q>^<6>B<38 ztv3$r-ZTCycHR6i3SuF3OuK+(@i^>Js!$4G;{Hz36lX8L3d*8HN3OZw4|&*hPmiE< zrGiD=MoKU^4!MtJnC@-ww3h4Az3v$0YTcvMxNy%K$qA_RJpkV!;e&{GoxW?4l&CQ# z*G;Is>aho6P0?P&0Sw?|k1R@7S>3;|zxn+(l6UYH^33gZnJ*g{lLhf}5{LKfdZ$d%P zl~@wFf{0)(Q}Jv@Vtn41;f4xnal02Vdu*1R6D(Eau&xi#>c>*$qH=t|B3VxFQC;W47v z#1aJgq9eT#Py$_k{+FWP!-_C%9f~YC*A&H!5}^qG3KD`PiA2*u8K3cI+&u72KN=c# zD_**Psnk)T^u2d5j1oojJl!Dx6;J^Gx-@=>gV+36G-e2)^JX{p{85B+2`xo(d1pC5 zG@LHepKn9A7RMiC{ z-Yy`4O&cmf7Y72Ruamx$M97wFO3VcMbBUtDQ96*5L^!KZGVwJbMCBiF;P9=9c4=9T zEkw#A(jH%#+QHR(#v%e32xsWbPI^GZXn^(fx+EKDNO4%EQ!5U#Pjg(@i*6-g(onjif=sq zMS%20E_a1^iIPLvo&;Pnn`T2{>R+o6=krxA=AB%ekfO>93Nf`qoe!D&gCP1rPB%kg zz-*B4A09EZtdA55Ia3a~9ugk_)D2I12vJ2%5Bb5;s0d}*VO_0Tl%CC4o8fvdRpp5N znmrEo5|YnSU3cS-3~$~mNf=>@){>vWvXgP7&HpJ61FWI$p?@FgU8noyB}g2zkLaJV+_tJUo-3y8klCR1c67sxm{?-dGAoWKX zlH$R_R<{)E+YI(V`T;hQ2+tnS)s zPr)$DF3J=E{scK*>mQ4uIJq?g4d+HucVI{%z39YlPlqe1XoVTFjLs6OHTVD>FALl+ z_iQ=B@GSGR;$plxs~@P+NNmF;G1<0E?7=&6vffZ;b5}(~((I8&73lyLDu92q;3X0f zD70>Wrb$r$S#03`m}#L}i?Yu=%P}3+*Z8W}>iJ%}StZTaWFrzjjP^Bld2)2d!4*lP z@^WEz88W$Z9Ah?tspxL~oyyNa;VJ-@ThF!s6nyH?1O+b0Ua}IP~BTHS4k9wE7a5DJP z#>ZcD%a^()vY@ll8gQ51{F7QVJWL*hjIg~1b^N?L`RWvBKnJ(nPPlguF6w$snK3J1 zl^@z?n9AwbVH(X!T^JLhG0-HCr7&p2b_cnTpVSt`Ry@=9cmYjba9SSnSeDXvnKz;6 z7@QtHi%{*^u?yMucdc~~R;863f=4aLcn>o2umrNY)5gZVi}I!du#8&wc@X^ng6=>G z>`1e+?uTJvr(`YzS>y{K&!Kn!-i#ZxX+;wjZ@n zc-v|j;>X@GoN$aYdn;Yt_Aa_{ePKM~C4YI(J0_t=9WQ?6NZ@^Z=e6JMhHYW*E;0t} z|D;{c?MaDJ!p6+CxkC`RMD8RBV;5C}Rv}(lL#TBj0?my+C7d z(4hU0UU)?$9_N*nnOT6pGIY6VNwQ>Q_IDVKAYkWE zwj9m%B(U}_>vzeSYMi~v$($d70o7)aVtSn;Gpz#d^DQ};G&mHX8sYuLfWsoseeYhF z*>q2Du7F;|{Zj`d?eVt0;gUDSFb?Ctf{e2~LU|Qo>zzp_4AvtrCf@9f>7AAL%F5k- zAy$VMkqY*vhEc<5Aw>>o`WirQ30Zc4Mbe?*K0N*$Cq6v<&9DxGV!u#D%$3q4E7JB? z;m9n;LszX>pZR&8WFPjaW(zhRF(7L(FLyonFh{r6V|kWuN&H|`!jc6lzejZ3bU9~R zBwG^6YgLeQVXLAso;1OmHWC~x;}_$x(jVLV(>szgX>3+mpDeX=q8{B+{xke3?lY5@ zziXe1wBtg2jQIHQluyw2Z%gM+dDunA5GadMRD$7u{E0QK*RO%=-W7Ye)LPe`SClzn zrHfIMvl|~DIq6|%+%$YQdXXfo?xHRrA(fY6s>4tr>XP%eIXk|tzSWQ8+;VRae*BvvEn}4j_J|y@sCq28 zzg8*IV$nAh6}kRJTPk@)ZflskE$72y(!xxmDgQh>Fs}-k(IBg2tM~~WH#HZ0Qpk*^ zSPoM!50#&}^Zo|#noiEg94oaCE2f(ywn~RhVrxdV`%Qt4#iTKn zp@S%Aq3MGb?(Mw@-C1a=ITbZQ3x5&LnH`t8V0yEWKPyc9u89d?NOYf#m zTwEslxx$7Q#Bh{jOfTuJv&+Yyo!wJ~O2ys4axJlv%z^{`t(F#TD366W5C6WM%H{9~ z8TGpW{0vpLPIq-|ZVnDIa%I)`edSNRpr$N(N~*Azh>oyid6rUFj|_^&WZ>GWpW-x! zzvb>%UivDAHI2zJ86Qt5j~|;W4r#-R?O{}Rh+g`1pqV>c3!KErjPia0hyRGn z{Ovkj(I(;Nw?-%Y&%2bkr_Lz9M=e~`+w-|V_XS)v$1WMdLdU*5-=Om3v!Aa);X${m ztCi(HyOCZ-Uu)kO95gPFV&qs}DSkc2A(7Wlur;ycUGfiiJ#f~Iv;zKJ0Vv+hmAAqn z;*L`2{rMOh;WM2i#z?UG^_ot=eL`b~z;1Q8GyGjL_DSk@f=n*2vfNS6f^tq;6xs2m$vbjO zjAS>-V7Kt@4;sN{*2}*_%F+IZmePCOi2E=r&njYKZA5fx8y`o+5>$@8e*t_vOIj+z z9(!K~j5GRX*WK3sOMHCsg+aNkQ|zKM39sCjB}#YVcN2H1EexWH&NJn~eshccbFK|Q zTKTW}TDHoa?2F$_gnS5^z-8crUH|0|?Mr6v%7?IoStBKal`BdoOg{@$%Av*p%&zC@ zG-x8kh^8O+LQmTS=s4%V{6K5%Orw4r%ae4Uzxz4cMATQ>t)QjR2KX4?y{%K@v>4NUKl8(PgtbO$8UN*$D={p1* z`Dovhxd$>`+gZ$!U|HPV(0t3+EgYx# zfy>I+zF~1>lt%%=PV~=CMqF{Q2k&&3Pj#Vy{p8Q58Keuej9W8^5-;Eu4jBy3T*v$@ z0X$TiM~T<`w-f$2qLaXZwV_sdV2Ea1o4pdNmzJhRE9ToWzyKCWm(vib%`5p{*WNX< zU6A+n-&GQHWcO-oF4cB)fl=$=_^ zo9=JY>WL{bTZJEOyCIzVH}rlfM+5fxC@99^u`-4=LL^}d(Q?=BL)o6EYD|O#T*&tO zJ7#?%H30<8boa;ewT{Z1fyjb{zM%*{4?PDD@`on?JP7R`xG|mSZ z+OzfQD$Mlcby~9JwU!F5FUmPrDDeW=f1`T=LXhiH;TZuptJvP+7>woPwl{9pBTePv z;}Cq1I09C+8^=y09=2?K@+`n;pt0lWEI3ggUC~*d6H>xI3>>hwi(?k(TY#Dtvcvd` zE$ds5WyOuwCb=fQwpU;&TDSC)=)UF@SIUi7m2vN@B9I>(NmP9xYC>BJF5oc+EScg~ z@4JN$&0k#{V_`qsbyi0F2M2g|F3!Gh9~j0a!}!pj=T_)ENEv+Yoh?E47u`38gWo(I zcvfrHI@#%YH^ej~e#~|ZD(!UqF6DZRzK{-ZBx4oYplGI}KOG(UmU*5-f@SYs&_TP$ ztuLeJ1`5-V^L(^+KqN^y)LJdlfGcwt@VKmdv^QMN4M~b1p;d28ey#BnrXRe zMm_k*MxpfC{Sq@i{Z@jLIw4^JHC=%3)vQ#1Wrnb@4yP5mFEI%5dN`=Lio(~}x=w{r zw~AUD>+@PE(UaF~f5o!ng1izzY-hEMo?a50nOW^I{jmLh-8H&J2QAuzJ5gXn1`Q!A zIhN)RqhzlXOS4rb)@HveX>~r50~&T_#}K0W2>P4zMgDjFeXMlij@4pdy2;!8MG8h@ z*nOy5_~9+U6rk=qu#4gXpFzUM-O)X10hX)>*(ER>fMx2Q#+*F01p6R;@|qe$&>%!M zgKC?uQ|O=JX)sqkIq?x)tGh-smVFD%ksb$DII<7qv9rtUeJ#dU^~s#6n*+R7#L1Oyq;enHkqGOct*?Sj=O8!!<>?wS`j|e%2v6=$eHc;-L45s z*J@b_%HAgwgeutkx>Z(HDvm0A0T-(W7rtp7gLP3u8=aMWWc6*e*=IWNuBuq)br7yk zLZN_!>&M9~fLF%0cg`LlEgL7pNU}L(9*he=_AEwFFT!WU#cyjy(?A;dK|L`HxX2iQ z;csz=tH287<;TZdWg!r%M55lBIXXdV03EA#p@z_x!Lo@E9-Oa6vll*(Tf8puBWuI~(z1#;<}~5ry8wRxYA|v|?`>$5 z;y?YFuDs+FSETMe7FCP+_eJrLm<_x$GqEhWoeUZc0_t?HqS~^ri$V82#~g@L<|Bo% zxcYK{3gY50xO?jAx)=Q3!#nMN9H9t)HF5nx0dl!^I6!s7lJ11 z!lE(@TBeAF?$agpE*Dz*6LfYL@By8R+oyZL6fLA{>&mRyWcuOeU}v;fMGUZLc4&UN zg5T&@-L_|dBn=ralNnb(bc_tyma^uf9PcA+2vp_!e5f*+ibDk+4W3uBZu5@p3*ngC zUA~a5!&|QoLSI3#de?Nh8fn=Zm7sX&1(2=b^36k{iw3Zy*vhs#img>(KkUGiB2IPjhf5=O+$w2D( zA7oN4$G$2u5sklv#A5vfhy|)B`Z;+>b#ii)<>i;t^Y+udP`bW2IjvMB4)6wrZeoO} z@+(ueema;tJKmL$$G4@xedWbzY(2Mv6oB>X!{1u{a`%aKe|NRgh7cV&QCkqF+G;cy zrpVikMWXnQqY<NCcMBmX+EsbC9b6{f1#KkHagcFj(G^`JMq&1mwyZ`D z&*DDStbySx3z5O{3oZ{43BlFjUr|;dy9L#-ZARD(dFoN*|M3%ked!y2rnCK~;bw1~ z3wc+QW8@;2=W96=@>ijPrfCBw@*B0K$E_Iz@^`w~oX6aUi>v40hoS14i$abWYC^>z z+BT~5{Kggk(ZQKF&K0*eR#4kq))Wo7qmAjQKS%ao8#j-iTZ8tw%~Z@$L1m8ej9?zFI<|*3t!~5(TAbx8ooo0 z8CIQ|x37ZgOgS2`KJO+k?DF)t$zB0FfC>PcyUe3OhXWh+9#82DYo#{m&Xe6_yer}4 z=OIQ}fD!WZm+Lt<#FK9NoAix+=_9=mKQAuOmbYYJL*QT;(so70P=t1ZJ3#^>O z*Eh|AF08mV8;U-pt&C8#setS;w)HvXeJ^AncoZsUvrY88MZmX&E2o0ucCO%h;bMEp z84>=xTO17Z+DK`8QjTpV<4nfev*z;h5U8PSpa446w;`yhmfr@5F&EjzwikdqH$a@{ zZ<|HvHmti;M`aDIlhK%!as|7X#WD|MJ^NFxxz%0u5Ahh^)6cnFj3tbf)VVl!zub0r z>-Q~1I~2C~T>5jLXxjbIo|}Kce(zD0bCq`*o~qPw_5`x36svXJFUnxbRYTo8ZU4Zc z(7n-D_=P+3=N|&-HXVJ6NdF2+Je@f(!`tzlm15N z)L3*~=P3W}S^caV<&S&kb(Bs>bkJQNpLAZnb>ZarE3>j(< zcLvF)hEH4@pL|ZbP;4e+HC*EtUw5g8dOcHN;YSDDr1%W!kH<(HD>^&-B0EoX`KIr3 z?-=lj>Cd*t8Oh8*w8>aUoN0{!N=y9+Tt;mXXVyE~Jpgpd{$%40VBfnFiM@0}D6JQr z9t#qchoyWQ%Rl{NE0fuuCsL(AjlrZkk2P=Iht=Q*(s* z6O&b6C2>18;zdtBKC&tvbV>gPpK$ZwynrkPBaKmBfVb)*R)&6}S@TC$>x_blq>q(*cO1dRLw^=WHjN&#Ipt1e$Q;&l&A zsr;$Dm_HdDQ=Bgp>?ZhqPWjvw#@C`9Hu{AeLx*w5!KS(>hZTs_XJ?lq3m-f39d`vn1 zx+86FBATV(k#Y0Orq^4a_0Q6o250+$j)~hZiTSLMhlUck$+{sa3cUtcrExL$Aq}`O zD4Tt$=SG*yRC@0U(9!p+w0F2WS5l$_t80hy?K-IAz&o37-c>Yne-x8kr(t|&ZVXhn zITp(-hFTC_BGLf{RpcyC ziNhf7WoI7Zg=A1umwmCtOvOZdv0cb22Y&qdbYX7aAakUGyP{||78rk<_f?tni|*R3 z1~7wBw_gq|0r}c2_dxU|M05kF%*WfM!%f7P@%zH{4E~^HT`OIvwQ8JbJ6FgdZW`qC390x zJk3fqQEA*F72MK)AFQf;o=Et2{?dan<-FFB5Dqn*71FO%7U|`WoFHX*Hn<{o%N3Z$ z7;94d*>+78@b=S-URh{czb``E|8DqmbH=nYs{zyeYW<(CH|{1`k4M{F4}EvzEa*pD zpQV2OJC@j6q3?V@)V7YflW@2(q>FuJ(zNJ90iad-BhK^@GJ&l0lJFH;u4n^A6TEe) z8BB;&vb6!*s?#bKSzB436nUa03v2*BjhLQnVamrgD>T5=>KHxQ<)1r-FGr!wPI=)OgK1Dhg+YbW<1lh`a!Bb z=$Q`;S4CX04&y)b%boeREw5vcbi1|K=&5oCcB!o~7r`HrVr_kDh3s8QW6q`SajGgK z;Cr)MtZ7YBgbM(ga{QCONDZf~}IBEkV;n{&CjxAyp~} zJFTD>`APca;WlTt=EZvcmVFnzUUV0N3s-N&w7l{$Qq?q)4s%kRk0EHOOgsaVV0_{d zrq_=tE@YxS?ToO|kZwJ0hRJ93rq};jh8)&Wf{~GLaYx?W!gVI=<~G+W8HGuFpG1r- z{*Gz2JVEG2SvmbRv}}}O=_i44x2afJ-lw4x>bM`m4!40r4ztGl!sW5X^5_DWZ$p_r zk5lR=gT1{wqm6wg$U%GbJ2LtXx2mhU2kxJg1ndzgX{-`%5c*EpRo3y>%GT!qN~kT} zYlC}H;K`o$rh}Tb*-YJQI*Qa>OYuKpqRal~-Omg@Z3|5u2$%$AX6%&2CZh0j1X&)U zM5Ip1Vby0PS3L~;BO`Xst>i}N)wblM9M9_O7>J!b3RP7SM_7b`TDnDJv22?2t0E5f zgaHP#0tK~)Q;md;<;0xW*0-xviE4ny!0Hvhb9Oz21fN(0w@vM=#(k?KxfMo3#1Ega zI`Py&4X1g^PFpEzM9p)wrnG+f`;wVz{TpL)i9@7o@&2E;LXs3rU2ely!vk!Z?}ab+ zULGE8oL;QZHrg|G)QR9AZkCyJO{=3vqIp(KK zWbM*c^;N1sXm8d5lpF$PP%dW#SU5R93hMY>;CN5nnmFyHk%J}};Ngl0z2_P9DLZht z2AR#w+)-+ar;Z-6uVS-XiB&(Z`+Cb=fRGvKTJZJTt+h)*z*H>5aWA)=>=P)(QRN-} zZY>?zu|>HvB@fu=Rc;k>w6ct9hp0?O?q6CLUTMqJdbF-Q2*^q#?*ov6c&6?bb$<*3&##wnft zww`}Ny5~h#qAmD=l>A91ey+7d(Y)`-n^y<-IfW*v3hQc7#~HS6-lh~p7n z9Jiz8B=0X_6jxy^O?~)|58<F3QLr5sPBbKJC zENu^g4oQZN!6Ch@ND^$~Se7Bk_VddIvri z2!5Nr^p%70!TvpAbEM&48C*Uea>71D=v>!6Ybg`#R_QErrRZ+fD?#8@ zKl&cJ1B5=>aVD$zr-Rtr_6K_R%y1^1D44LvwZfr=ga=hWolu&Wx7v8mW{S0wXHn!nRud-sz?5?)n|gsgJpJV zonPj+*I;PRaaMqd8O30u5G$AvM5uqAZpZDY`ad7qe`fA$j5B3===GVvBZkV$d!WLv zCmz;j`s;h^ZnV-)3q7?^$Dipb78m6nn&cFuF1m?7Jhoj`j9FM4vUvniLl&Va9XDt3 z=@}fM+A6$q%3Bmml_ADm#}JD=ZMgnpfB%Vf&eR-;+DQgFHgd2io=J zHA6ZVy>U;d34&z+UENYoPvEk$tSQg~uL~*e#>N<;?b!7PC&zH@}UWQ)#$UNHsP2i#<`=5waeEvyZCh2m=e&lS8oQ zv$;psZNt%5fwHdbRaeO;<{do@th$!_`fMVVI#?mlV9x%qmu4;2ytQ*ineJo?bSOx) zfxNy?QxfCtpWF1riYOz_WXy0_v?y3%UODkH#MYU}lFQ>LkloLy?&H)*mUR0Y4$LGL zMeem)(J>nOZeHdr?5sH7TiTmv+dH0UJYZu5WuCjuhHap{>Ra!Nz4+3^jikd*ZS=L` zd3BnOKZ9`ytm7eQ{`V@o7WCAX@C~m$JN$F8$|*yD3f+t2&?ss()>Eb00}D=V>II5~ z^AM9F73`xju=E9Fos4C-xehWmNyW@PcM)8Y?~9w0OLblLbc%#=s<%6{#7d&3}e?e@J4<(fx9(x8osBo$>bO z8!3PgJJQjJT32;iDUd&4L;|w++ZHtIvX!u};0U70RvkqeojM$mWFBf6?TQp;yZ{pL zH&#&yS(MgUYIbGySAGnncs>*0Odu1d6orn+$dGRV;Sbn{^semMUq6(oBlu?4=`@ru z(g<^4O$CECtJoSc3at3NRMaFS-3fxo8*K#h984Yi)K081Oy961SKwq z%D(UuW^>h6GG?cF2=`&$RjOIdy!jpgGOUN6sH>z^HA!H#rGGe~zeJBY4+i7$fcIOo zbJrEL&2>GRDP0?Hf7_-H=^e6=)#DR@_Bc=_Bhh+exL<8y1d^ZYq45l?7G~A*iY~ox z(?&puz`26hJ)zH#910hCx(f}ps8N3MP`>P}QY#5!X)jWQ zqqfdE>`Iv|xz>Qqeu3zrb{vw??Ifs^l;b^Iqt&h9qMmJM>>Vl)6Rp~bE8_l!%(tcY z=7O{%WV=uZeGYo)3n>;X&xvdLAz`+}?K96V;mBGA0N#_V>VR9W?l`0(Idm&#TL!q} zkF)1!Tljc>8o@GlEHM{KKjf0`hDD9u%X&IGLK*4TUL=HY7(IwRl&e@3O0TS!0D)*x z*Z!6cq+34;vPy)e@lX-t`+5YNix|{!RR^^|XHD=!??O*ifmexK4F6eUJ(EBFS^`r@ ze%M}cta;$pQ2t&h6*Uw(ICNtcsRcRJ!Os}koy`sUTJ|e3p(^!n`r{(q{WEA8R=%8~ z@WxPS8Y>3TX1OnoOvLUEpo8jyr{=!~QE;}jGJmlm4nRUwYO(P2N&KNh*N(tpE!vGG zz^-L|$W?lnleU$Y#I7#pO&Kw{*dNacSiY@{uy#|^w_Xos+eQIXKnZ7B>%NiN<4xDV zubVGh%AHIt$3v!qR8ZHeAe8HSn7G$gS@fekRCjo@7m~02$B28@YJvQXsQK|L=8+Mn z&LD5PZfff!T|`REEw3(1X@E)}*>nZ`+Ght!gEUWOE)-W-n~aFM#^y(sKR{z0_W*|L44er0thYdjTF)y^e^xNaJa`iSXs`=KmMr zd-ftVJ|HupiWX|hP}kZ2T;&7Qr>$iVV4M)pH>JFZc5NL&p9wk=gY4#EK@B&`_J4P% zZ82K8c<=WMg4VFx?}usHj;zV?KTe2#Tc78qGwF7AV56`o0B+vf`yEn^Rz3$}8y@Ly^F4TXfQU=57Pb5Id>w)_h$d;IdO5Vti6e((gU`SdLHfqOagy2*2 zlZcyC-!r)ou5*2SM7zZvsvg{9uNB!;iNK8e|Q zuBG|uN+T#83rgrvzk^i@>jKnQ0g=hM5+b94(5cw8+rQU@)3hUDQ42|=E#0T@L!G`= z+ERwF(1n!63#S{PK=|X~IFNdsG#Lg;?b-Ah4BWTZ0@2bbq+_dyo zHA~(3c6QyjW6{7>LMjx1OK6at2h2w??hf;PN}ZZY{V`sJ8iR>Y(S>y=WPONj5{-4U zo__0*;{pqefZW_-%|L^X!qZkcQR@YnO%xc8CBOnC=rz)ZmzOq(8_<6Fvnu~%PlMed zDVgl{V1b&#(^htns=$;Dm=l86Gl(9@<)3rz0x-?Ao@on&^rCs5y!^EtscPOBObm;? z3yk~pv<%rh_}g&n^$<5#6l80#b|DX#R}TviT`bL=)rFou`TnwhuE)VbC|?*8$a&@~ zz&D^eFwdQmEOxUK4ojJzMfE4#PC?4E2UjGnV6V#DDg?}}^4?%}Uiq*UM0GI0V!r*N zAV;X?`xxUVJK4b$ZxV)TA6hIV!ESF!W~!YG0Eh^8u%AKQh{m1DK*roBmx&@&}raUr>^`^DwxzE@%p9Bn8Ov}*!JtfKK@AzUD z2eDm#hor&}iQj_iG*X;>R{Z@Uh{hNp5p)#_w`r1A(nk~dYx<{}`(aCHH``RcJ+=uE zu)uV6S3R#iPTL`Bq-u!20w9}Re?@tJR0k|O0Ipp+(g?ULnIvX69v8boY`UP<9_f+iSIXP#_#-&26yFN@TY*hEYkmWyI5S{2T$(^p) zmCJO{5>d#S+}r84VOs9L((G@`bmJO?_WF%UHPA+0T!T<(yOK75b zJ(yu^yqD_XY2t+38?}TVE$m=rEe9Ij#5Nv*Nij%&jl;}gV$UkRMNma8fjV)g{}Yk;`9Ef*zB35@9z0D z-Lr%>yoEJj?IU9ysn&>Q7;q_mv|u15x-XU7zE%)U+PJE#R=WLv1Kwqc5C zmu9k9H?*2&e=)ni-}=Yvn;I!6-&>!7nF^|n1zgIx!*^e7W?0mC{ph-qbgOV8?I>4y z>&72$>c0PC-I#taK%Wz(bGnFf0WLpM93?UcV5%F&JH> zcKLhl;Qe=Ul!5uT8E1>~D1!6z?tJe$Wi8QtO?fgLcsS^?1J`*PSUW*96#})(LoU=6 zwj<7`-*dfhY}y-(1a7NabNd(||0JE(!td z0=C?mr+z0b66kyQ3EdB^i9TwS&iL_d{27*{Rf_N8^?nPlY^^0MB8_u8^?S}4E;1*H zeyEPr^1VcHs9R>^%rHF%yj}O-fPene{S*OGK+QaH-k}^TyXP(!cnkpdnJ54*1KFTX zz+3#(OI^^Pf;fQMp3Nhroc>!MsFyU#(>8Dr4;RfXB*pemX9x)5^Zv$?w@(ol8SgsO zH~;mhnK*LiDb@Rud4&vqsYgS(;WYZ9_QjU6W-^Y)cxCeepF8enT6wY))B2|n`%PMI zT*ELkz-zx^uR~}26VDpx8%b5vFjpPXU4&TUJqZ90p<4dun|Ls=dVjw&CA5SNHfd*> zLDdW}HZ>Ny7!DHt4f4S>?~80=uZ%!NW3bln0MNUR-5Vgu^J2)#hFd(GM7S5=ZN+l> z9Y`N7ni({Q90B^zFEYwL|B#@#-UHNtAz4AwRWb<)xThK<0Ey5d7T6P{xO<5afW*R0 z3E>Aq;D~a%u_AiM`%Yt7!t4KUWaXMDsGcZYsQ*k#duX1&%A zjxH?4s$EnKC)RxY+y(PzmXOC%2^$W|dVrz?7p#TtSENj^xvT!PG$wV#o?z(J`8e(+ zegcqR1r4&ju_ene!SuNk5tW3WM5UlA)*-dAf+zLR!v4|)&`Imi06vXkl7UNhe#R;q5dww~ zaoJ-g8UW?>rpL6@#9}gr5RQaE5@{QV(AXvQHd|L<9ow!4CO&itJMcAKrTN*SBQTBQ z4g!d1jIx8vSOQ*tI6avsJ`SntADZE}b?E!1zzqQb*_<$jeAu@fSO)cW=A$<}o_LfN z0Pkxw-+B(Y6A7iSGq;RaFD&s$279?}Y8dqLEmoY*Lehhr)${toOZjhas+FQ0lf;U^ zxDegQpS}#10q-5nS5Q=+inVK_J1YuUDHXpKo3!Er-MyqXi=p$oJh!{0k56xWizN+Z z?iE>Emq>+{nb|hd+}t&TRf)2uR7A0S9YGA#59?p&2{k_J9~WnaIM{)=Sj@?X8paPE zWgHxbHZLl(87=UK;fG#cK-XJ(nT>VJD0Whr1C{2_q=MLW~1EK%Lz z?rF-D3DZ-MGr%35@tfo~zz|4GOLiVVC5+-df3bWF`Vy9odyf?n!3DTZdt2 z#k4q_%t@8mvBuVkcd}lYJLS5lIB3U-?*~EwDt-NWQ`8TFni_JjXzIK77r9)b(yEjt z))`<9BJ&YbWa~%c2lu8C2kPNb30x!`g4Vvw34CXmj%#WRu%Hhm?6C5>#dgyA^pooC zFdS5V`aO>dh@`xcKo-w^_%Hg>rNOs*OwRNKK*8rMqkM87R?er%b(F}@{?Bm6<_F=w zZj%Wx5sESq;@OqA6JdghkpLB3QEr%w?z{Zmri{{5VD~OQLsj0B9?EeOkvF?hi zLKCsoP~XqbJaI;h$egclP=8Rmhyctcjz#4BwG}J<IR$L$0$Y(m5p(6LrruxO!}~I-;UXP|6=HW|9H883REP} zJg5W=14Bj`V?98sL+kn~gUCarV_PuYoPVp=vHU>j*PwAgWR9-=kKuobM6Q2EDYMZ` zFcS=2{=0A$(3ncDA;bxqg9pK;5wwFrEE*b<8G<%H%u(+0*p7Al@$U;(2O1X67+3uM zZ;=W1)2;Pr1(1~b~r@-L+c{DQvwzrjd!i~mPf@qf1f@%;Mw#By2h*DS#Q z2SWRbj)l8OC~f>BKw{dDf#sdOBFE#~1D`_%rxHJ2h_}4C>&r_jh8Fo?`KbBN&#ONF zwe8{kKC=O_%HD^!w%J~>x)LSd>npvdj>$~p<9U6?@3^;DmE@lt^Hh>$eY(5tQ;BEl zq&=(rizZq8qmgx|qe5+K-b>y){bClE|BqGy?DwhHzi>40eMy$zpZWPE82G>U@6V$A z_IJ}jJuWyM8)(6Jf9dhhK6)0r^@IOhWGRVP2LAS8yhj4h)KBW0z~M=2 z&j^;IU*8GMbVa=CZ!Z~Xtdi&9>{(rXzkh`AxxaOQq7gTM4o^T|<(DGh#ZbS#$_1}8 zz-{&&tt&YAdm|nE%v6Z)+F10&Zwq{bl|0m*hQ~a-$ z4WkFv^}W^y{0j&l>U{U(obh3Vd@Y~VAF~E)1OC=7`ad^eR{Q&k%C4Y#?@5ohnsG39 z^`z0ssftuS7sN)OuL&>V--cpDWzlDM9c{IWO8oV0;$OdiqGxk|+5L5vVFR0&z&hlA z-`;0-vIKJUe*eV&-#>8_eZV8P{r3+j|Neo{Xe1%3&$?XIH+_EU=IHj{mHv@@zob`UmZwsOF{$0=smyuP;eZBRY zvQDu4*HUYrvjR0?C1m+sVQq*9PHyw?@bUu6I&eU5W8p9NpG%H=`d_Q3{x6-N4Z4Z1 zE#zuNx~w-HPiFkBZawowTN&osALzM^5W@-rg<0Z8NZBp)K@x3VrF~v>nbI5ftg|zk z74}>P@idRtYgg@s$}-HVsO5ZCziy!IuO7F64Rf6uaKhJ2%~r z9#iVzC-0`?H$Ttf+nQaTH0!Nt!(q(AWNJg(&txjK(Na)ShXO}=Un#uOY<0?sVzE)P zzD6@vI=`5qGd8kULPBeby9w=gf7!GE(uCW(tHk|%|7=DCO6DG|zv`0j6z_hZmK&tp z!hjxa*t6=m;*e0HAjrR3-k!UVS960z*ZJ|PQCgkqO`U)@tv34bq0kYrT(V-Q=EQLS z(GWX$EPH4>ebaJ-woT0WFFJp%b|vQ^GiLqK=NeD5+%mCkxAo1m!=14kbkDTfOMI=; z>h|q|r8Pa`F(WT6VZE>aAM12G2tk7Vsd7vFTy#-Q?D<2{V~>2%u2n8R!ZrC1iHb2F z?3FJ1__4m`zE0rBWci@m;Xc8eF1m92 zA8kkm83l^+Mp!)Z+(uB^`9wn;E@TH|uk%s2QTWvVdg`=bf|VifsaWot!Q0%#mns~w z(P*;dv%-JcGBI#G74$t-H{H`WOXQXLqp~F;%A45aQIkBv8k;gX?kb|C=eraS(vLh? zfcJURT55Mon<$;@xH_3P6>X9Ekc5oG>||_;w4Yr+VPxU*V&lwI`>aEPYJIY0Ytyrsb)N zZ}9~OmcLm{uak~~wQjs+=={#iYRaFGQ{1EDl{<7^ORzt(;P)l`#+Bi}4!kVAct zAr9H?Xbt3%8fs2-%w~YO1o0UrEZ^1Dlq|uXb+MlTx%`KaP1fo=T|Jjp(!zB|ORG^)L6SJ|hrvrXqQNn4un!HLfbZ$1szncbrA^?@DhBAzsS$T2<`Qa>@9bFVX{A?> z-?T*GyV##_ph#gI*&+T(-tLxw)x=33rUh{6v9c3!8OeQ|`yAW*NgpJt!u8UZzk!f1 zDIcZTW%PNsW#@{fQ9*|ELP%xJjqs8>GSJZr0gvYsri>n22GeDUP1!s6=rkTrV~7_! z-mpz_3^ED4SN$ujuH5Bkjv4L0@wmgQk2Tx9FvcNG$P8%+Q(@Set@1am3GN_051#+2 zN1>TBSI)D<6kWX0VPxr}Hys_g&o|FC2^XJvI+E5`c&IgvmaArqiY8>U&}U@rp5grI zT@G_~f_j0m@RFQM7Srs9O1j5W3w%G6&GjWNRnm{FeFh`Dc)-i!mdj(MmU!oh*1L_& z{R`H&Ps^*~9&(+E<O27*|3U?4{p?9C*=@Njl|DUE)7H+i zIw*I|0wUqZVDdZMh*G*16;;_GLCW>;r}=f!n`w_MF6_fTUPL$KCEw2HXE@V$boZ(t zI*R3?17ptk{9$mb1`>_|q1xEa^272y)lp(P+p!ahM+`Sli`@O})td)Qdntq^wzH zyP7XLL?Z#v+!IO1jmoLxKFTdC4y7LC=&A8A>5c)RqqdB85OVHoW<9U($9?xvx&;B^ zC{Ni8#+QGsS8xH=JM?qCEjueNex%hWTM%`0YG)af#W7?$CwzLjYp&n8U)4cDqPm$j zc4iCRNiZ6}Bjf-W_seLQT9nyrlYcJmHn_Pr95m`jL>g&vaCt*sU0lj}HNNbb+0L4A z{}|@T^i1i6?;a_-t2Gz4o;eHXjgFmc>XL_lV)&kRQ#RYrIwmucX^?S!gwqy@s>W6v0xmtP$K8#`Atr37Udz<+F>|gbUzpX9&>7Mc;m8Zv zL^-fdvpz-FMdWqCAAe&f1VB+f4dk%!^}^5aC=yt4|KX;2sR(S%&QcbLkzkx$CWuL7 z%&v~}61xkW4y>OX=mkk4|#duT!LEZL7rNWh9}1?A#xisM|mTcK$8P*OPuEKQr>V1OQI{bfE1=mi7t)rUS>n$Tlg+b@u%c1Xn&}%ZSH;jXXyKA zb|6TD>|9{1@0s9gHjvvE=bwKEr^PuSr=@`M1p6UK-xve7r|#(BHzb7lfPUTHmr872 zh3?PI%pLc}meQM=tbfU)G&`36dhyG$Y^wunHS6hCzbah25yo&7E?Ca-AH!voNXoI| zt8!U?@#jHuaCf_9OwLAU>^D~{d2`{{g(3LtSTJ}kIM84^y=e3JMt%+zg^TmY?V4~+ ztQ)+b!+vUER8*{hP;Hcche3!GQlqIz@n`vGP?3H|zwf3WOzi!&Vh8U{f!+o{>u!H+ zA)89jc3B%N)yf`SQLMwBX!JG^S4>#d3fQLK0omisn@vR%JvT$G%4LyX*MO6>N}LZe ziht4ZiAPQLpza=ka=m}47+tk|I7cSt`KN-?505RArB3DrZZJD8GTphZ!@X~< zH+<%-fQiEJz4A{!?*iCwT)OyT=d*i9pP#%PcjN9w8F^0O7i{)sreKW(?s#+mEIrRqFUwPI#zF^7=;$ZS@D* z?iw9_Wx7=1x*ZIuZ8s008Z&FJQI&%C#Aq!pz|N8ZOO$fgz~ns6qZlGNrb13`=*lVL zl}9R)693fAXr!$aZbJD>KT?jzEI?yX+bA%yEo~`0U{dG~R4G~Bo4_Vnd(&*nW0MxYh zDyd_imA_(;@MMl|?3>h=2eCx`^^iKj)g|t2o^t!J?q7Smik4?z=G%sxs+L4n`H)UzqX3_|1;&tSh#o zH8l!lZ`vi4OzuP<_HI4RhVq)e$j5fUimKFHN9SN;hqj0y%`%MvtmD=>a6K9FeX$eH zNMn+%Q~TF(ht0~e@2RnNRNcarJw|d+aX8eg6Qr@O!PeEylI8_{fXK6m#=B1-9bJrpP~k3kS5FbeF^s^z;8wd4BdV3NBO>Zc#)onS^pJAR9?iH zr65yj&6y4nd0;e1Je-qy*o?;_bPN0}G!x1Bh8Rulkgp)W-}R9{UPtZ7R+$KVRd!4u zhObeY3@C5EYNV~!IoHR_h}r(R*I-M>tyP6hv%4*gZjn;B9@SM`!zgric6E<;&u7&m z@6p&y(CCDh(Q1w?ryfJ?GxMO)sbH$O*LM%>_SleIvD*5~mrPs9`51~|q1)i9S(zxo zNLmQz!)mX+cTt=w4+;{wYczPo^9l;UDk?e7H`&79nwij~5qDnO0s={v2)GR1cXJ1w!}3AhTRL>nLNV-=FS>z>kCl5Qi->{Qpl5)OlXG@%$OJWBG~MP>Z;P4$&Pbn8K!DKiZc{R=vnv^C-k&vv&WO1*TPLgmURTh z!ZIy7&WY>m59&1^;ElUg!o1(hOO~r>of*z{{J3GQ?yg~9q^n2O-b>9->u;xuOh_`K zX8)0#v4KK}AYbN;rA(T%uWZwgY(^r!uxVsx$?=Fi8y=jcEpo5EOzbsemAFeXFT;^7 zEZwW(do@c_=fT?6(*pcYT7OW(W#tBhF1UPtS~I<}=t?okyxe|H3jR82_33C{mT>Ut z?kLLrq0=KNJFEt9cTmwM zH%!3?5<_~p4!D^sK|ssre~1VVw~t9k_Y)_USDw`DWv1^`rF48q@ZmxxDg`E*p?lCf zd?WcFBnB)r+Vxxj<2g1fcTZ`T*keH;E{<+F8(S&R;ww$#dsMqa`$rOCQHv5!R-P!@ zHB43Re=@%&&ysgH;MEq4I&q`bvC6ZL)VDNPEy2K3R>(WdsX;fVH5IUzUO;vqrlOj| zT6KB&)o$M^_VXfONoG`dfkls7m@}&(sr0moyzEeZ2I}uz*Yubi<|2n5$|AC^a zq?&!qw98dVE;@E5wUa^GUk*VeIJ7sEX#8?V_UBc~msfp@WazKW@z_+`l`Xn2HKp5CTBwV1KgJ}bQRXy~@#8uYzEK+`%k@Cv zPdD>RNZp;{ft%jgN=`!g9vk=fM2=4RRLn{TX?7g~2N&S?Mozgzy9^;~?|mN#S3%6@ z&q5|z&*>Zd;LC#hdPp#Ji`?Rzvb)A>ou6_3u6BGbs|oj!%o;Ed+=t8ODkDOa15~Gl zg={+?jfita)(sgn{3SBbMNd=VzJLAl*)484VVUW^{%XcDVAJv0{NYMg>XKOgPNZiV z(6gJBikcdwXX$v{^K;({?Wd1T`)qNXVj8n4ZX6$*b{>r(w(fp3Q%OrmO>VDp$Llin z7k^)!8Sh_f`(qm>@;BP$=gd_)FaY7Pzg+H-cPZtl^@^ski5$&Fb0z0mW*8}Tk6z87xSJc9Z`x`tCUX5x#8fFp(`>hF}Q$Lq+XZV$DehHrd zrs86omhPXcOuEJ(F;!#VOi%3O=(e}2SF;?u-XBOm+|Q(=!y|hhQ?UhrkZt*WBHpr= zcw3ckj%w$&IK6uZc1yad0Vw$RZac~OvcjqviNS&^Z$~zd@Q5iN;Y(VXMb1A9zske^ zq`tk)eC9kkQ#&}m3gfvEj&gT?1OOhR%gWwPhH6dpcWHu0CzfOqG~5_BI+HGNww@9( zxo8v+d*d88E~_&f)@-{2KeJ$2b&`@msAgo$>`Kp9uFDr&lRd{c-zIJ`w@j<+#oX(l zuI;qUpZ%IZQrL>A+&DWOd7zWvVEN|mhMz3gi_^ETd3rFYQDtySNnxS+uXa^j?XDuW znU2@-Z!)jZR}5Pf(GfQYgeL01NE=MwlboYgSOg1Co;|KtxKMwMrrvw-OPH*U-IY_Y zhb$cgJ_T)zjAWEMR}ATQN3!OUP9}kJ1uLn?4)#h@8fj2Lu#wc?bg}u=q!G)*YC_saBTgcwZ_n9(Q!axy)tL% zqu=R)moiLzC&A|IK_NAQ0@Qw2Z0w}#r3tJ}oyTBfC~pA6f8V5 zaqsZ*y4l`KWgKIdeT4$Er9%-u?l}^EU?fea`{nzfn@RJa`{n^gj*)+(Xe4sYwxR<< zk@{ODO<5F(OrjH??3y@mq~hu`0VSM(mH&rb_+=4tFxLBwN!F(IJ`7)4vXrT=4iG-I zk8z_xoU4S`IWq8sx$j80tDVxDM{v4>eW?Vuech1NOj^I_5p`WY!Kp$=OPfqR3y7b= zV8Goi3aK@{TS7MB!l50Kc;qY_@!%?*KGm@rtq1pWI;J#^uMQp_nIE4kney>nDgE@#v-GrX!J=-a{aPih zo?q`G{hcr1NpdIzEZL!49A$H%De@^%%1{F~7^iJ!p3s3HWB-ptSsPnfjx3$K2jm~( zzKzox5L!B=r(L3d7BG-6UKNzxexM*aHTwKPPg8cg>5ln(o%x>3-WGb!hCNmzxS(1i z2fy*g9oZz4dNt+h{T4XBGQq`Rjb+c{3LKb9@Y!l*--(o++YP~yRjr%sw=-h-FHnZ# z0)vXXO7w7jU~TI3J$EE@$kZgFn?Z(Q;BY_R9SvTW1R{4xXaKqZ9_F9 zrQ)p7M~jgmkaez^=F;Ea+AW>EBm2t9_+W4{|unC;PTr z4iAPn_A=P^t}IxNzbDZq1T0H2oOihR$+W0M-@3zm?4jc{wc7DmhB{YUEho}PUqk!m z3mi1q3E|YX;dt88A#hvko^!Qe?Y2T>$b9r=6L;A{X0rD)Q%m619VmBW zp;3Sl;1;^)xa~gIK-vvH1I3ajd4*VOirx17bc$?VgAZISHmp8?jusGK0OYwtJ15S7GxO#cCQ?LBr!t9DTyySuHE`tPR(n>*E zuZ%n~G)_+iCD+d^iMf>_TXXvkxA*c_%k-Z}@pjhahO2>(OV_s=7avCFrl>R>ie^-` z{xC1w_8Ix>X9kMqR-DwB+|m;-aNg!YQ0$wbZ&l)O<5SQcXRlMW81KY-b@e+4 z5Q}T`F8;T+U@KQpH7%&Xb0nORpBKyqFd1ehxQX`6b|RZf*;n+AoIVjEZMI64wkB)H z%p!zL;+a4y42W(JIR&a)d8-Yu2L%tnpFvXkC0FFP3~`G%ST*e%uVv>#bumQAoVib3 z#)M|$Xl5Q8JNX@0xxiC13tz}AtY9TfhOmgB)z5>nT!m8aK`4_5I>cqQPvX=WTxv?< z$0jZO+uQbgiP>iQ(hA=9qtzV^AWDcHlCL*aXME_aVUm>8-9x+0tgoDmi&_}2&n!qgsdt7C-*VA`9w8CM>EYV8U2U+)fPwQ;tE%mQz8oYn5z-$id3!G2gE9{?yO9vvPFMFZs1{ICA!x8#TI z$PP_MSy{&KG+oH(#AkCx__$lVL$mhDb|FrvX4&BPJMJLo*PY69Y?Z0&NgG%>%@Y7P zIJoak~i_0d438VJe$59E~d zMU@dvUYRd*Jl@fFlpsEZlh;Cp3d|R2jeej@U7lR_YBS6MScQ*QA(LBC_;ao#MrwXx zA=}fuoXPTl?Arorzgqr%zCB+#P%K}GMtYOr$E~MZcKi2xJ5wx>cFtegF-<#X-01ht zqDLJdwNEk<%FtK2r z_A#tRy-Igs8yf?bVvk~kic8KVnJQquSoO5p)0UtfROPe2%I4d16kXIUhP}IcrHw5= zpIbmFnz8dGEBpRY!Fwm;dIrbofz;3r;_18{q@C)8_zuZ_w(f2g&?*#;Ooo8X0It@~ z9EYX#BgH&33V(d5z`nCf$IjdIjxHTSQSS(gvowbIRRF7OXM47sA1>ZO4J`%#ncQYRT=7KO@R_&6ZIF*c_=&R}(1rB<_ zh7z$p$N7pSfKXMvzAguq*M}l%hGv^^_jN?GUqd%zu}tXU_wa!qhDtt>_wR8P;!yn= zu<=#ao8p%(dX@=zDgrq>zqgqmwIQ%k8SkkK*~VB%Kz*?vVui=vL+y0>QTYuhrE-EH zuRvb+=x>><>&Zj!XmH~Sg9t3;_>CYB&INe~5(cK9hR7YWt5C1%Mc6t75+GVv--{(( zjXJ*|KjW%wN2Al95GckJB5rp-%6Y?YRJXuo4xbxbTWG&>Gh0p3e&Vn*x5mnGYZSd8(k`6R4bgyex(~>A*0c*s0Sx&jXoJWhvk;Uj zuza~39M_>qk3hcLGKzjq=Fup!YAHZc`Wh=fmrCitP%@RIh1hqqnPU8UFFhf@gl0j= zrRxeo5gcTOY**)Qdj?E6TX!@Bq(lgx44yOrLIL8lJX{*+1!nJt0NqMsrQ$Q-O>zub zw_}B`N){oS0%FWJ!TGCpC5Y&bbA6>1xjSG4)oMLDYe;RIq7mOqI!G}=8mFSlUNlo1Y>lSdRBF`8CANK|e0vQ}(s%Nz`M5kv3M)JV;RbWt2r{!ct(j80m-#rv(Q+D8 zL3a$s6|5Tv8gkk3_*_@c==^SuDkV$#aa<&08uO3u_9GW8_zz-|mFUB6Up8@#u}oS1 zQhnM=mm4C0-8S084bMSRRjhXTP7n8{gnRFXN+e#-DwV}9X9srTVT3}`tgf1XDP)A4 zFwJwxU+wP$QAgjy1`CmlMaH_;{LORExaEXQL2s)?_s#ja#7Jk+Xr)T6Mb}(!414_- zvc?JfO%NPM#?}+fRh4d9V(A9$13-dZ-_jX8;8?Za2Y+}aTtYWa<0snx}N#n za$>9@Z#_Snxa-=_DUuy!^-6e(<;^lA$(IBct&&iw~! zGlEv8xl&uO+tZn@j@(3-NmE^7hv|-q!_lY1=U4M>4-383YhMhj60BOc>!ZpmnVQY1 zjvaGqtJn${yvWHC`ce~?qChGGrew{#n}NIlhl<)CR=wkG3qoOXiL4>D#5&unsYZ=> z{1>Iv?bvHivb^acc-2_ih2Gqa8qNY$V~Nv=hC%@0xg9RWX%n()nCxs{(P*<+N?rg= z({dYt!y3nZy(Abby7sq3rmk9kqjUd-y_t96RhikZ4gG=0`>0FyN%QT7z=6u4gk_4d z5l_MW-W8^5T|WIrm+l67U5TvfY`plYASGOBFM_fi8wfwy&JV_0dQWlJ--0YUyYb<2 zMSG*jX`Al53BG;kqu)6EY zVHSL??tLp^_2L^PM2Y7bSR4!B;Zs5}rVKR8UFT75^+9OfKCwT2qA0(|=CjtSxd`iv zCqyBl=kXhne`0a3QF<#UhA^LdrCtvY%tLQ0RTwhT!F^&&j7=- zyUP2=X$-`&~?B1AC2O62sVU$)gTfoJ@< z)JJ`(Z|zBXU)2SRUJ0nPm+n-@xZE*EBnQVnU~X66PRF%Z4$($aF6Mpm4v`>! zljU%1Zx~fv#fg`#^(R-eN?3R+JFl_MyzbJh{R8~T;g*X=cmKWfO}*4Vt%(kNz4~LngsN@hYK`i2=L8`zk916TbV?u_!n-V(Be>09yhVWY z0RN0WibbI*PDZdd2V9X?hJh(WVmX^jcd;|s^=uVW=iE&9biIx~Omx2{cj>y75b+KT zvNgL$#-0!@ByYZE&N9|^X%cR-ovyd+s%7>sF7D00E4Dh-d_Y}iHnDI{M!i~f+BJ|I zr%*%vM&^kl;g9+&;@j!4Rv^9QZh&q5Mc7FTL)g?QL)AkI^v20AUI-O?`i^F-zT@Jc z!ctD4n9Hem?M#&i-~-8HNEKowc?-w02WBM9ZOxLSO$Gp3Rt_r9r(ZEU8|1~~{EZK+ zV$~*)7q7X|UAS15$N`nI9NEIm5xR9;dpm%yC6kM<;sx(RM~=M&Z&L7_*m-59dv&_w zbyXH=N@rT=%zfO($EBNf{xk1XJ>|{;5Jkik-}onB!l?Y~qnvI5H_Ntni30NB71X>C zq?s~_Ic0U|5KzCxgsIsTe`{o3z}kb&;O&33qYVkACUR}Bw)X!(WdJFw9z~!NoFTOp z!g`U1i=13?2_lnk)wGFuJeTL#N2=qVv{UQ!y8v-0QEYohLB#OtyTV+&DC^k>KfqD1 z!%!5T$HUA3WNr{{*)506BOXu!{k5V#eK3hPN{yw|*eG|_0_Bc^>?Z2~*%0y;`<~4W0@F~5U%Qcig$h%# zbRi{Q&z|@u^Kp3DWo0n%K5?dBw3sDEW9ScREN&LH>46Y>_q^vZ+1Tud%20ZjRF%-3 zpDP?2_SkMHzC2?{5R@q4clpsP5B05~K}}@efs)C5(^7}VUc*t>ecsA356sp^U&s^e zDNOXWH?SXef-=?cup-S z;L5sTT@$GQ+21x8SZe^oceMd}LY94c<|qrxm#dN|KkjF|IVf*&vx)L443@QW+4WF< z*ymtcE72%e>Z0#7y3NzvcEVAx*MJ2AdMJvFIF|VAkt(HS=OCwh; z6E*KbkFO(j_t^sB0HL+sNXG8lUsXbY#3uJvMEA(u zd!|{I0zh)~#1%-@x<#3YYWRFQ+LUx8R)`R_M2Jdn; zxz+-W4bBM!5%8-x{U-p4*iT2uR=lLZv$}LyUD9?QQ(tLeAbMYCv>Y(r5D^#JXeo4T z;@N0oAhMgrIGj&%9*VT=c@tQ3s9V0G4tWCoKMq{`^&h-CYr{HCp0HTC}rl zsTOCHD6+VMf5Q{rSiLyh#{fg(#)Mja*C2iPB$=AiI*vF%D1fRGX$49ioxoJAg1w~} zvPh8$w;QfoE(T_J+u_G2ak}tgEmvxIpAwz!@8+&L!X(Io*?aIk)^>vJLCl*Sy$UyDT7h30lF!hPFyO`&yE4w9; z!%pQ}$dg06m@!G}rB(|UdKf9-t{t)MDP$#l{x;n)(Xkd*0;^VzkOYaaha>Dse@-eG z?RJV48LC-OLtbN56Qww1b&S*HHx5?yG?~WB38xJv{ysSqagSDNq|2C{2Gi$5Wrlv; zZD?0?6@qvDBCkUQakpZhFX!=8@wl!f2pJ3>3sN9vP^-4j@l*)n=Wy`GlYqd({bd4e zi`l#r_>a&U8}+FsBqYaB6O=^7TuMi2ak}~6By{O%oo4(BNe#>u^E^%*-@n`Pr9xjt zE>D0KXK7rP&waL9F@!V40C0!ZtUHlsZM*v5D^|=+?rGi7K=5fi?YLm6#??ksyfZ~* z0p4ZmPWAbAae7)EhrHTt*z1c1tv-JdmaA?BLpix-&5VGDzVDD#QQ=(Q>VUbYzptUv zTISN&`hFVo*%x&qgjBpuRrKNpXO)wa6@yd7QsJVpJR2nzhmkSW*-j{PfT3zCd=U`> zjOB^L{uW(4FL;C{T=GVTg(e3BH%%Skp-(s4t3@t5vo(~A&W^5`l6vF#!s{xPr(Ms8 zJI#*GJPvd^HHEXdVsy4smuq$9LZ+{EatsZAqqcsg$uPjDOUIVC7UY21pes+tDqU$A z&z(gy>7LiuGvt{DzZ-VW`5h~;l*FE4krCZQB zld0#TD4JdTp<)Ym{a8^>`d53H!b5aA3}FG6kz$2X*}CES%3jOGc)be5Hf44@W|Da_ z#nnm5g>AZwna=fTtPu)Txvq}lG1_z25C`RwJ+D6FWLE&!oexG}z${|o`AKO*M4~s1 zy`YCT>!vxj-nVRMX&#_t7U9svjWFSK?|*o*m)Gvy`=zRa%--SlLnBtpOUqyMDtTNN zBIz6lYlNof)C@@PEGAlWR`)pRXxmjv&wM6raC5(S^svXV|4T>KEq9=} zwk?1EWr^wrXg0{bkJ|-|&6V1{N3K2)ZR&i9ZN;uVqaVquFcx2!=`jB4I`Ly``K?or*`3WSJ(5k)WFJ-WT$v#|6A5Y+C7h^oo5n# zGrjsV?43%)M^Iy8J0$Faw|(@K0rZq4=coU^P|3s8%i`Mlaq04Cu(d0Y!q z;U<$(i{v>X@%+2mCL4Qdw_>)12mnEWIkHl!4cHIib;AImQck_aEvtCpVb|%L4!{5w zTd_DJ)Dv<3FppY2?+T$o6{IaH2*5RX$91-o+e3q)tbcFO@vM$*Czf)ajF6XRr>C+e zV=X`ay)^4eQV%5XWjtpz-!EZ+%sNC{r_fu?rCbsvVYD`Y%k*U2<=EL2!m8J=vLr|h z4wEf{Rl*mE1GxTL&)v*|A0Zu1T?%2}{d#il!mbl1-Jeh~D811wi4Q3fc$KDHJap%R_ z7cNGfyREr4)0kFJM?`Zf7EvU4_iro7+vYs3^Eq`OiC2j<;K4zGrD#g?_>EW2aD#$! zekw?btROq`DApCO7nI%&`^a0@&xMW<$hzRJHW>xH_JVec-&));kN!7lH>f6UV9=}< z@aE|Nv1LCEu;*?Yk<32pz@?36dcKX$D;2UFg7~^0EzOM;J7YJTL>I!9D7RtP(g8>} zQQFNx)Pb_?_47?Z3`wE9?^6e?C@RnK=^`R5t>@))kdRKK2nrqs*yS5_p6iy~Qn%ULYhM_vy22p7U z9WY){d%`wY#bCh@(#3&;`$d;j7)Ysngq3M+1{4xqZjNlY_tWW#EPkR}f4oTJ=eQD) z$7?xDI}p^L2c(Ugm+TwOgS2tycPk@IW2D2YWK{mT zT1P9BkK=+lD6uLShLr{mk4-)Q3f(m!WN<|nR%scOGjxxE-MZTK2j>e}t)-INGf>98 zl^&PnIK(>vozj!BFAh{Qu0NJd-aXCq2Ift8hySjfsrbGR-Us=^&b#3~-hX!64!J`x zd&>)nFYZV$ie$Bc%v#i$3sbRcJ%4Y*sAZ5HIE2wds8Cp083XDoG>U@B=>(Jgk7M3o z3#wyn!yO$$CHe|KMVu4&9-1M+suSE_dUdS+z<%)D5Z$O2ni!=dl(9SGOX^5YQ!N@R z1m?;>+D`$2&Pyrr^|xsIN%{=J8&p8cVH=7AweRbrV6Zrd4HDNKhy{|=#lW)z$9QdR z-05YBNSWihC?yD;0p;t_Zv_v2^&HLgXkgqB+U@{wW63=w-KD~-P+Y;>_Z6CJD*!Ir*GR{FTIu!}NqTodqkdH1Jy#-Pde%|3X^>CapP?zbw=)6QZQ}KGE zWND(QnkkSqAhKm-I2R@qUI|vGYcl|K*NUdSQ||C(mWgv0&wsZsD=8V!)#8Zszo)lx zM|%Os{QNFZk|?T_54&zNCO2h&6HqzLmHYzfc-)VfL~X*E15i%k6%PnvZYE*1MufC*f$DU-KFV0A4wpW!_S2*8-9*lu((Pr3HVb=RkgRKy)#5-Q zv1FIH3>!XEWMptVJ6q2a%jh_vyO>iQMzWRGel)3FyJbZYQMkPSblK9O%NF48 zpS!zi@JXQmwKPLjmF(DUP#4xrYpM&CdtU;odUkDhFJx#uV>{_bn-HPJdnPC$aP(n9 z2ULoTa~61!GQL%cnFmk=N~AQS$@3uA{t+MOKaj<4A> zBS$SX=-=PbVyIx-QX$J7Ll27I>Anj%=ERp}FTXx8m<$20`Ak6`VVUd6tmYSN2uzR= zIx9~6w!ac0Q{i%l#D?(w;ynJ0G8bLZ^-r3Bfk)E}wug3|7X~`bWOL|UvWPrM;tH*# zE}M|Qw+72=L4ZHu2$8gFg5W!?N5dDHnO3;41q*#`V`^UUa2{z)SGyPRtDz6bQGCFZWBfNeuGt_?9PC(q-S*f(|l&#f4IKToydt{v(6wF;VXO2dA zX)D2V9Bvyb^Y04{6kkF*-*i0~BqR$#5r#meP4TI1cgQXnr?MAV&&<;zgQj>s148B=P?}=P>0gXWm=>O@#RYV@uWKwadT-7)0Tz zTDI39K4+N?Q;r4>xFaQCGKaU&z5v0N4E@)3B6f!jsT7mfLO0{Z=G1wl^W%FyQ~;q? ztOd#&v|y2cTr1#2V(ovwjv^&KXo#)&G}c1*C*noPvg;{Z3qxN9(qu$Vdzqd5gBMcX zd|^K?N(DbG9>C%-YpUi0O9WD+5bOs713h^!!n++6@19+oPwsj`DDJW)6g#aIq1Knv zg4bK8gV!4qSU26Z?$Vq(?mGLBo=DxJZ02NOFD;yH+L|BZZrR&Tzt&gAK`pE=1Kk^M z!^@h+Ls0(As*WE>!t+J0I%j#~uj`g8+?_3Q?H5~efjsKbTl13QNH?fdYr4*GCy)N7 z;FT7$z5%>K*8o(T=z{KX=>2ISF@J>A22Y73>7VFAR+J$0K=A_7TXDIV_5cDGugO;j z>l7_B0&u)Sgc*nbCqS$)H@)hzdHuu)G`AWIy1QVm_nk-=90@L=ucqy6>L0n9#%VE= zbxi(wSBW3(n=<@M!{?)=VTI2<9n_`ct=?W1Hd&Nj?0Z`qw7qKL? zrRuT3d0>b<-l^?!yP|IZq|Ei{f@c=ZGrf+nzWh&GUVU0`el9Y>d2ys0SG;@Ipk+;$ zcDA+B++;+V*b1x-;kQ(ZjcOEi!j|$cytsgN5+yRZDWfBc*Cs@kT8Lv%?3QW>;b~0V zLaKHAG1@Kh6T7y-i|97$-E7(9Xl)HAK0=MVfH|0np1}60ANSc~nboK^Fv*eD z;`5p8)VgW8-lAs{; z)#=sS*AX1-p*W27Zd;NB2n3$s@J^Q-s?Z3um^t^}NA?S>3;J_yd9Ka#<)_`kp4h^s z{<_Z`X{L3qaekI6m?$3}!Ounff%+B^Aw;RPulew$%sc_Ji26H7w0IbiZ`@Dtm9i$LZ!@Rm2}R z$=A1Y-O)w)VoZlr#y{I)MF;{|_xVNVre!EDAy?PZgR>%M36?rq&kGHo+~qoe(pG=? z!W5r6dULD$WBiw>jR8F8Je71>nY~JEE{gY9zn`G$)^^#~5H!m{f^&4kOICW>ZMPt* zy3o4@GiE2A<0te#^Y`SXJ<&QG$ZltzyWIT~4lvQe>}2+{3K|g!^Yukr?<-~`^@J7{ zeby(ph^(jtxmX1mHimYBr+T49<^~4?r|_wVipbMtypEK9|8QAn_)s}!Fk9|+#npcw z;nCGnEF?6Nu#88WFu_CB1|;~&xu6GHH!7cgWo#7QR{ObNq^3&yBci99Zl4-Q#`G=S zts#<%PY>#AjRhJtt=-Xi6@J`EmLFStF)ufBaw94lE2dwbec^Ovth@Gt`zD7@qw|}j zS6v(%8n~C^wR|EcMo+va*W-i7pPbirKeeDVWSQ4V`*XZJpXpj5MhaO_N=7!5GErjQ zCcGX$#Jktv@$$bnAvV{55i9(}tY~NIa&uGSi5CE3bU_K`rEHaoHS;Lyu&MWXo7Uz6&kj`Nl4bumrG zF3Xv4PNB^1*Ss)xx42l`arA7lE^fIF+qpd7{Z(|(6({=3bz2Eisi{?C30~RN44E_Y zjafI|O%Bh^whdzK&R8sR8``^-Qz~U@&+OQYewu%=9yV&Yp!UfeHProe&2!pmz`6@= zJS*TdwrJD`w;aHBcD-f0e&cjn-H(O<_4Vgw6&4=Kmw^kxRX-=~8N*SyO=K#l{?TxC z)~it**;(ShU0H^!F@j;Y+UzHv2@dqNo+f$o8B90dzb_IQun61ApLrk+FJJw;aeQA6 zm>T)rn~&x)n+w^Cw#s~47YB-7H|)LrHQC6(nExDXU0-*au4lD%pX5H1<*5=k8u1}={ks>VCJ8WX^O7t?xSyURn7jJfkA=G)Fu`7HI zo+IGbWY;LZQi;q8nYCMX1PO)Cv>9e$n!%mNX3Z9++b;KSBUvE}Wy&Zo)#%vm)$2Bx zgV_4NH=OSZg)eUIch>J-N}Y<}UtXrM_08d!5^&}<`e}?JvER$XQ8R5lU2v%w{Tvws z@2{yB<==TGly$q$Jsd4Hn4~~y_5RWVx53T0Z#`ujwbA6>iZEUyzu&zV=$soY5W>$m zjIGboT)j$(QTvi}f6knBy?FcVYCMMb9pBdKJ+X#|G=9FV0^Zu;D>3!wsEIJ-H@QD^ zXvbK^{&LRn+57%W58Ldut$vqb^gKP)2r{!TY|_D@7mag zQpD2rKXVXe==8G!pVv`fN2BE>M)RLm#5Lot-*PEWd=eEIgA9F+;BWQw)&=;M_LOuv z;XHFo)VHjkLXPF?bc}uKm-`$YM5C5Zm3a0XyUVvsk}n{%XmtB?o3 ziFce0E_8l)yW+rq9R>OKmAgWVY1nD1K1XBejtsgffx+OGiudlxzFA!Sg#AiZexHX( zw2*NgisRU#@o4PMVt}8(U9V;Gp=2>8ja659c{GP2@-~HzGd+(QG$RXeR2PE%yUHEa znh01my-SDvu7sN!udgk==vvG7sy*C3Li9~mcS^E0UZ(WqNsdFF!ihuI>BjNrlcdra zdfj_9KUnKhHXNiLR~)$duU*KyLNy1BHS^8gMjqFpV_`s(`35yHTg^QO^gBDR#-n(% z&AVNq8cs}a2nQz}e}-c@q1jW&u945x07sq8x~-*lA|Ff7y#)R==GKT645whCr*x5@ zGjAkrC%G(yzZVEE?|A#BJK!D_wTi`Xd$QMz87BG|3NexIwz+nmX}>Q^58}IM#WqKL ze|S;d|98Z=GJbgO?2e1!?JzScZ~43eskAa4&B!PN>E$(Ja~Z*#3@O{+xcMY&2Xr9R zz3$YNQ@t!);5j6<5+l0SmJ{q=VsoHs-q?EhnzfNZv3xZ-(RpZ>m8k$ zb#u@e5NjVeQ}#7j($pyGeRf3~P4xm>Xiry zg_U_2^XqW`EW~gSaEfBxEOhx6oQ2!cG#Eu#&O=5ftj5#o!#tw7o=q&uYA%aAi2UV0 zR|i%ahpj5p>U?EoDUM_s#~Dp{V+_YIU?%YIOSc5`&7IYPZ*-A}4xCzH7%kzh92Cd! zSdJlkY3LgtwNUbcRA=tgIOHpxP`c|g*-O7USGR%`f)Fe~s;(ECwHy^uDKE%4hp{uK#a2)vaZ!@XmI??Bv#hfl(ytsz%Et|E6+#R|mw!KXqqx7pvOEUIGd2nLD9)W(9q8e&3?b%jp5)!kQ%<;HBlniHaOg>;ZczHeU-sZnA<0(iFhJa7(L42#s%oC7;>NrW&TM z<)=V4a5SpTne+3A;BX!+`eAhGqKg8P?NWCeo$iAw04H9(ZElx#!=3Z9deVP-0bWci za-YwCMbr^rJ^r5qdXWc(%lzKPotrQlg^8Uw%FyU2EQgk=TDYsY1L}9z$5Q&41eAjX z4h^=;)!xk+#y&GW>#ywE`=}uq5Xt1TsXf^d&DozCA6kK%H@l}ik*w{4|5l@4;tU^a z4d<`=OhFLlNRLBqm2#M85K8;KKTd?RZ#_=;@}l}*Mt#Lls`lcp7dzr!#_tISC!Z8? z7p@h>#Sa(>HAr5 znYtBE2qT?#`GTy{g^B}L{+%~+5U5n-HdOC3DPnKly#(3Z&e5Stjo_Q`ym#q#$KCS# zICr%6m*~~J032T$M==OOdkxZ}v$OZHLXWdwSssp{a zot^c@;4uU8@L2<<$;^}}dT_ta*MZ32{Bw1sf#V}i1iYx!Tn9inglX2Aa*tDR+jVaX zbd4GM%CfHuHPzQAlh3wabbT4_h18;xUz${O{c8E9%2P}!6MWR)zpJ@aT$1eIx$CC{qfVDGJqmfIx+*|(PT;g& zKSPuAY=1OGe95x-8&8qbxy#GPjy=@V(pt!!cS^YKYndjdjK&urdBI2e{ozAoT?^ZO zo;`G5gLfL(i5o)2+w>oS;3=D8*xhyhPHup@yA%7iC5qwM|LyV@Wh_kAkZEIkq z_ALmOm8O?2`g%m@t{Nc`QG_C-su7DC%hY1G;{Nyz{UvJ33EwA4>o>h7`;K>|B!g=& z8E@&%d^yPqPWACjI}fL$1VmaLRxthc`*-47eQ%fByCLGAnbGQ3ShJJb846MfZnnsF?WaZ=X2H*%9yU9;n<@z}0<6HHvPr7g%&HuPw1Gxcc9<1y-Gg2On;0piZ zVhITe;ZL95KotM!=Ikl|__KRBss?~A)4*4DU=|PcO4b?6J-AOqaN;>B_slsH%oBUU zDFT}s4VOK_^3Fbi*8uKQV!qL~a$n_h`Yo}Yg+=GmhCePF^pre8#Wmi2mQh( zlD}eT6gt|AiZ%>m>3O~4_hb(?T|@Lovb5I0UlOICJ(mi71{I3S$r%(I2X~}B3l*)s z%L$=M@gv)*^$~BNcUhM+ln44K)&k5^!PTc?b537 z?9XQ1ZpdbJ?kr!}39cF>ialVtMy6j$jNSRVb8{Q3uuT9@5-Fh~Gnd-g=&D^L1^2^e z*FB?ym`Ki=w{L&cSjU#L7jBbF{%Zohhb_tG3{6LtZ%Ca+z^r04rh!g($L7xIiUTYE zhEHVrtQtiucpb-{1q26qWVuZEr#oY=yaV`;06D$4<`NClg;CK zE8z|D@f2A|aI|~P@B9lfBmah6F(>}*a9`q%Cn=RYHdIf8C8N zMsYd%&+Df>%63(w@420xGiwI<%hvYw&NCbi$+R9M^h5+edvR_U!o0L05af zJ6`NV1Lc@7zRUTzF%1%t)p}%d81RtWVo^YQexnt)WCMeIw&$RwA+oF5pDSz6E^SJ2 z00=VKRUib)r+=N;j>-y1P>ye5h0X5uUFtW85#@z^XPKfsJ>`e96wbstrRe`7VerQ7 z3K|Ue0EPm>44H4**X%fDdZhn8>tBIeUk4ayHI~|5LI+-J`uKC)yv$R`8q>{he(X_A zgdql2#7f*>lxyo*Vp+S>^scg}(!MR*QEhgxgcW{ZF={G8#uKAHp)3UhgXpzEy`c}) z!u>&e>njq95B@U;@VtsQ5r^t}3(@?h_4u7{rOhXensoYXVm(b=o>hCh!Jsy`^d&C+ zdA9~2U84h;X5fWmnhPX^~d{YmTx z-|UlBO|^!-H$a`}sg$1_XsnQ#Gj}!Z4v0amKV8@ibF)lt0UAC6-wwIQDJ{6%_8TiT zpc+WjfK>ioFLF+Ri+%T9YidTNpfiJF9I=+E*nY>2R{w@r)Fe;Rky&Ij6*97)UtyF0 zq|hoDgv&V^`Rz5VY~L}eJQ}M@xDD!~^6foWP8V+7h6D`A>r^b{I5blYnyIm>&kdF| zPn({2{k{s5EwZhzwUkJs{xXq`^On@360qF1ch_Bs%J7>ESRAFUCBx z-e{&)&uao+`}Y#QhlELnffllnOuFMpSp&h5^|VJzz^r`geA9_OoduFGKhHc5TJ8V& zwIuhFRTnN4$SVwpi#F4P@IDlbcfu1q>XQriqvlbN7T&K}_s{%#`D2F0{-8hmvX#dd zGF**swc^C$VZWRIHK|#vNW6&~sbRh<$GG0w(svRpmbP5l(MVeOlhY{>HBatV5y`}T z0IB(7VCYPks_zuUo%yI_G_(KW-YehP zQN~Wc)&n|!Moampl30`G-boPVPhMtdYD zw;nj0ZfrEXls~Q~CPXN}l1?FtuKP6t&j4V#rmd-J`PC@BdfvZt03)u%c@6H8)(8;f z2q16-d4Z%IN}=*sQ#pKe_p@Yl&s4g$|o?y>ehMv#_U0yuKFD`o(8M>zKXZv1wK#r7OlEd)_1CjAAGC6>FF zxZ!SSPjP@J%Ek@7Tb~}VZeHjFb_JoLVF=mv9?;F|}IM2|*?9F$P zv>{V!J7(S1&c3E43NUb{a_UnwmgRh0+_^@1@>u6nXE2!}myuwL)F2SH7Tg&X4>F{! zZMTf4=<$f=o8-!SfWsJXCKSXI6{Wd(*&bNlSe@K?z5Q}#`i}`B_oqc@^$V)U00lQG zEG6($Pb3RKnL7+dj9e*kpq)&XY)u8~6(Fut>&pw72v3@lB;S*vj!3wx4D6GSz&{ZT zn|P`tFBm=H^5@l%pI4nh^4@nT;AkSxaJiBNa&zYC>)9{`@z1rE7R5ShrP!8@W@Ozh zegy1h3;jy?gwCQFj71+ag?@vniDiAsd_`5_-haHiYh)Kfo1a8TUM?rT7LJXkwCwCs z99Z~`a98`?(SQOGJH%rF3Qla3(UYwiKS<54TOsXo|3i2DjI&Su1qr?if(m?q^}0l% z(wTxQPj)am*`uq~Pdw)Gwq9n9>M7LBZk2BCKErq451=g7Skxh*VaZHzZC=Tm>}_S= zR_Pt&mH%8_BM7|6`m!~c@I-Q-!6k$0eWA86)l&G>C+~W?Ra@2|E+ApJlmy=4#^oe3 z-*--9Ioq68?s2Ku%&b3Br3iPHK#+yMKTP*I_i$020xmtliQuvlSrqHBV?fo|J93$H zZwbW)fky8CW%yebBxJbK>cJs#uZ)R=xxnoThAVRk*%u-TLYUnhFAJ_63i&g&f1WcR zMSl`}g`uv`Eq??L`Q{|SlDY=ONY#_;8yUa{-0ZeV2t}gmA%ouBXh$1>8UQnD(;w{2Zhyt#rg1*-U?k-OrO#N;-VKl9sa$#!FBmQZT-eQ z>DcLc;iDiQ!Ja+lkfM33ZgSq6Gk;x&_Mio>BsDm$pt7s}lEtLYR2JC!RwVcILUrU= z?v?uso$iz3P2;ggbVEQPv?aM=AN1s(CfXp7k02p1gYM~x$yjdJq>stSwO#HG?K#cs zS@yf>%RpsEN+-jd;7}cxWB-2{WQGp{gw`vd91>rWn_xh+GM7Py5UJHbkVyT0DIVko z$X15k-)C&XH=v;R2ByWZ-zX_~;~o@3rA>{@>@Xx$#iiX*5ay#i2DbPb_+XAbsDzUE z3O?S;m-2FXaK*sM5KYvc$o5AD2!wLrtnmP25LFSL@Ym20Jpf!E;y@0{Fb0Z-uI3S( zwSm5fY=fjUnY@B(&_!&07n+)kM)}Gk0`$Z-uY&zS2}Zr$$3G7c5b$5GUcf6kBOV{X z;NnrJ(uyhwWQMWdvOYZFSi^w%f(j7`|7Ng*=@*!3S8`W?zyr}+INar}sg?T{dOT=O zU}p9&fUE%rb1r|sQEy_&Q8GU`YFg0tK-sqJnsoHWYJwH0W2*14fZl#>^nNOkcYWfz z?QY>}--u;}#L>`^Z%iYd7T@&2l&9QheDj>gl2C+#j?PF?8(y}3(R5SZIfvcc+$m4L zj1k}jq)u9*2VL4=^|Wy|FUeUi3Mbf6jhEgoXGY{bQn}myf?eaR8KwE^0!n@z1{JN+2KyU!OTgmSQk( zwdXB%(EUA;&mf7w0Ue!tl{LS3yoz~mlz`%Rmm8A&!L_SD`rJ(@VH-9;3ap886-2~0 zL}{u{tefre z)#h`7(q`x;hh7jyE*9l9_+F2cHcJw@TV8rj7lcJ|$l7xV;>dn0 z&-e(U7@%Br2#Aj=_V*2X1sM&C?c@(_($gMmkArGITj}SWmqk9|C!k?L6-v5`oIS5; zdYrO;ycB@y2wIEZylN!wrE3AII?A)J$dGAW@35v08bQ&}LorgJ_W)%w)L~lr7?S=? zzSyARo~kra+q5!vju^2Mfa2Q@LbEH2ogP5XuHqH%+-|^>xFi0MS$9zpEZ)q!r@&m{l1wA6sJRa8{H&ic8b1OaWpY zLUkaBq1AVk0n7rUd40mU$Isv|qktk3Bh<8=x7^L$*iVn`==N{T)~EFb09r}_eh}F4 z+6xb*NNwn`;K{QEx(A6VKVu+H#4Tp-LWZMO7mz7XqnRN5)}PMTJ!Fq{qhLVD%7!;B zMWyJ*=0Iz00%C=|%k2l!ae@=`zSZT-ASUY+SZk?Ml7^s80k|p~SPBAM{~{F6tU08* zE1{!fpcAV{k=6>i%GcMbWbjXtP&p3!#;sfM#{b?Y!FlE4kvIEZu%m%cKrZ7b?w37) zc7SGUfGMnk!GE-|oz$02>{jL>5D4pN-iS~K^tWnQe_wef62eO5hx7?Vm*|0__3M!# zCZWhg(p%S3wf}L6(nZ&C#SlrWg9{+rRCbE$ z+D|H9fEfi|PX{{fsVS^<2T7ZoSGd1m0mS`u>Tb8SvufT-KOPe)(3F0p+d4Y&7gsMB zWP48QeJiL&;*O?R*d}G?aZAD&29d2-J_|G4(mhoeraZ?6|!eUz@crtfK8w+tbk*?xBDs?-L)xv z8`yGnpLPf7_HIZ`3r6xG@0PiHaBNO ztCA$lofB?yxKMpW|5r#;EFxr^9@%{eCk}`}KTjX+g$mcei!L{kP((A4mhvu((fZRb zgj3tI^`naQxG#Md3fpho)44vJ1>=ddrC{LHCGRT$g2F^j7Qs|{EJEv$uuV={c`W!L z8!HVRw7p{Z*habRTd{=n!FIj`*Avy1A=bhMA?ddscoLu2aC88{S{0vcC~IO z2X2v^tc|LNFlRg%skdhK`=5EN&eLILguvGFba^@p*gWDBP zIX0hO%Os=PF7*}Y`VQ)>g^*wExka-hI^SQMpJw#q4||O3DN8w+a(J*w;-u3HIwr8!W|6M5KH$Zz~XO(+^*`BJuH6#!YX%Xq@0`!|X`8@y#NvZ9M zbt&O1eL+>xERg%exj%`QH7a1^eFX!Ec|k8jI8U-KpOB_O8zG-Q5J&U+S;&~7Axa|#DYaJWlDnd#lelE)i``=TCLpi5oNeJ3G`H*NHvJh=1?0?k%@)p^WH|2t?H zpntbv!!|LIi*zAqD}>bxtDQ?9%ML&ODI9R{NmL-@-9*5^vfES-$=g9YivT1vrd)(N0oa%@Dhw-1C7BK-aoG?d77 ze3W{Az#mp<2K)iy*v6nCu1&5F6EGiUdJr^sO*=o)tc)*mWI{{raQ-+z>h(s*BjrS> z-&W5o9lttcX)c3WcaGCWQcCh*Y*Nnsyn-;hXcdUTQL#D!v9nXk!`)6`WLXcOqTcK} zt&Yh3`6%Ecw14P>inKTz6xIutvlaD8(A(o*uKIv1tDTM9IZUvG02UAFl-*R<8p3#8)K2t9pH>pA~yC=>z_R=^z0$YH}q zp~`(eaeQ@7vf$nz$v}R*70CF5m9re0dJbR+zvbs(`Ph4(@cjy4Qw>uTM!EHF5klwl zp*n83CwpTa8oTh}B6chW*_`o;GT-5uw#UZ0Ve89U=Br3u?KMe7M2DOhR!=LXl18$c zagxY8kE{+Tolf+I^U^U zT`@m3qNJ$3^L_QR`&&SZ!&vlq~7Oe=|)H3=3Mwdf^w0E7{s*=Tnn8UO{^si11B?U4mNHFYEU=*n(=3oGe%JOsg34)6kNG*oT7FMZui3PJ2g(lhJX7Euw;+$;MH=FyNaU zv>p@2TYiEFT_SD#9G%HPLdO;rLd76_a1vb)$M6C061MVs{8Cn<*hqPL z{ST>BSJ-QiNo=jTf7cmVAj?uZ5l28mRT@rAOU+J;|0#GpkZy@3$uQKIid zp*p+?WQz8IRBwn5NKNg#Y9iBTdDF>>xzFxQ?2Ww%7~Vx?eih92r!RWRtTyI8UegFS z1JuDvo$PMo_2bTCO*5(l%>Xy|^UxTBsIqTx2YuYr*gURz<4zwYmbg3;KI;J9zMc36 zAaVbC)zh;s#IeBXO`r)Yr6s41Yo^4Y?T*(dmB*%&g4cA4&p_f&Q45zz*ImY@8m@m9q;iqNFP zc1AgJrq}^grN!5*^h>&)(3Qb*MpY0oEu5(KbM>X))`Ac#$vp|s{L1RWXe_cFqwb=U zJ&1+SMP8-k4nbkzEZVR0%n_uAiRLO}jdwuZCumgJ#%uFJBxH>|`&St0h3m8$jdwF;U z%+(dd$YH*yv|X3-Ain7~k0nIuWQz}c^sN-tQn(m@@j^Dl-oRJO>_{Um=yb~+ivV}P zU+zXFh_LlAiXt=R3l!}zO3ws{c1vtX)od^GZsEjJ8nRQv03(PV2)vbK=Dz0C@494O z@dPj0mYs&50L>$CM+7vm4}AM|O78Hq&`^JONe3K(sG_lZuvegkXB`iHaH2P-tXy|d zCK+!A=x6P5U6r>F)a?0QlMh@6$noKAGv@@8_B~NhK|y5vuu}J0jLsDcH5A1>nr4ur zSU#=H;t`GdFFxaGjq!uy$c7x}uBZNzTh$+V+-%{|;jG_?yRnXizZ?a9j=Ai%ZOwviWW2E4?~* zJ{r^PK!#8O?B+b{KRtcP(BZ7uevujEA#G?TUums~uD=4@xVM0Wlws64EUU9C%-Ya_%mp`3}A zh6?lPiK9JL-hQ&Dzc1(;^MMO!B`o|8UTGo1K zp3-6z&hR=JTARc=Bgt=W_#wSC&<8c=yWVxZ?=x$-4f}KBE%p2{p(wMyEx;L;HF<7YWA}|hVD3vV^ zh6NIc63XQFV~u9On&$6l%8yG*iu0swL|vqzD7*NSl1zObp%I=7n}K?rOHzxs1vd`x zqH9|2kNF%pF2P3a%g()Ea0zVM=^8%PT?4}v3%nX?MP4+Ap|KA{)rT#2UqV%>*>%&Y z+4d92>UC%y)t7GswK33BwQ`vpu2A7KNQC zllJ_2XHPKF{yy5+hu5f=uugKhar1P)bH|)Iu8xezq0|3iI15zB=aX~qz0Rq|X;}onp-nvqX%X8WKF5Js$ypGjt9! z0UR8A@*qyPaqv<#N}!>e?pG6O?w`@u-a%bHl@D6L3XQho;Gg=|3we12TvnWv?+%X|gP0&Z&k zD2hSEitj;CAk0V`Jz%WlBM$Nw_Whpuc3{M+)mCQ zvYt%q>&nU*MBmvHI8JSIdFg=0HtLs^+FZ8d4!7qgYXR?9m*|L|_&(A_t55U513(7x zJ)9)M*2UP-e&rK8v+`b z?6&Z35d~>CfVRPz=jRxAHXkF!et;E_yBSsYzo4?5!l+!Ro_9wg#e0YpCBG&~{_2cJ zOJIqVGroMVi0I?R`ree<`IjXBY>iS1+U^R;46z_mu8GB+?j(nNI$`wq!Hx7+Na1cq z_DZnOEx|Cp^A5QW=IfWuXuga&l$KfO^#1VQIw8iU(_5Pwt7fP{8=2wCv!`iPa_6Co5p^TMM}1hxxsTgr*fGsQ$T0F1bY)yhhR5*rBf zIw3p6imIm-+feZAy1&0liN_QZ9pIyO_*Fc~gKI>{Gh@$pRaIzYU*4yiME(1^qqNNR zm$^Z`y7r-+8mTWU04Z`KWCK}q);trF>A9;CZj|g1fs&XMI5>2ZrS|NJAQShX>^)3D zehN7R9gYvT=6zjU++)}fcJ;PvKK_cH-Y-PuvrM){Y0bG4GN&tO-v72Z8AJt509wk~ zZyUv0`BWX)(N@?JRAg_E=fHqwR%5zEuVRXD%q-T>Eb7FaDnU)RZ$sxZZK5m z9sy)gq0WzvZlGgpXy4)(+ax}#1NlW8os)!&lM?WZ=s#ML3+fD+el&YOjk$@XOCKzI z%IXRi1E@B5A6tbq9<0;sarfF9-hilF^L?DgX3d0}YA_ho>rIcGVb73VT~)dyEK_cf zbg}7kNlN(v=*Ct6pH7%)uJqbBiW%%UDdzH2|16ogMACpUyWs*JiNKJ;)ZE$Z?GG_O zjb^vsZxvX)RXH>U;#>$+P3m*7VSJJC<3Y*%&8@T$(-1F)8ecnz(F|2T7BCn0clNZ4dW#hbF&8+ag;>iQ8dyeOp_;0;({ET5`7Aim4O_f>e`#4PH~8 zph;gV+>w0wqDzdpA1PHi>E0BNu1+8E&#WSp0o)(R zLVCCFd#t8Iv2m`5F@HbM2<1BBScb0EOr zih4KBbFRN;%8LxLx=TKdOXitR=(Z&^~b^ zZa=7zJ{CR{GaUzAV9h+cycmC!&gQ&K-Ja~J5~?gGW}N2$lI?8-mvU-fabs`?ZKq<=lG7i_+Du4cy>T2rUd2$ z;+V&&_2!3bw*%z%$->tLL9YpmHCc)hC6(lX8h11CYanDBf{;B6u?}<>_ER#aviV_e zFWe>Usyai#l?3RDK~#&Snzi`aUuPOhULoZVD7oy-+FSMl8;RE(M3gR=8SS5FK zk$x_)4_#p~sIq&PyPbkHFCgx;#JTd4gAIOolx^Jw#FXD|?5T=^pRQ-Z(FkxPoVU*o-js$eoE%j$-{ zUD;_n^~eh9n1VlrES|^#H&%qEynB!fUp6|jaqBPxSz6lhY z$|I$3++Chl8fx*P567uXa6`w2v!J;UX-m^1l?>*I(fW)NkByfyp@HAwED2@MaIdo7f(plWbO~{snfunq|S2S?fS)~4$ zDm`dEWhINYdr;Q2h?X2aIzP+ z>nNh>av*&}NBqt~Iry$stexIbi2vNYm*rw6ZS$aFiY%9&1O^EiiB|AKH#mAIrV@H) zeDZvtxgc(m7m5K4@w&en!#kLhp<^$r8;MtKZs9?Z_?+won{5gVy{<)IWcixk88UMO z$s(8z`m2Tyv+dm4N&ksHKwcXOR_!}1u+reUs@c4KC3c z8E$!7y#A66(io>^!Ll>XSPlBGC3c3Ws9}L5 z@?f=#r?Q~42PxkL`e2oGp>$Zd(ftv$XaC>7*%R9WME1O>Kk@S;5&sG5DM;`5Bx$F+ zB=%GOk}#g2_r5J*N``kb0A)8mRLDzP zoLkUQOb$IMiZdd1tz(H-+T(kf^EaXgH=;+EMar>ODPl7?cL@h?KH+@o#X_N{q?xyF zg5?tY2LjK)Mj9`U&GM#iJ$4bEo0(y_Fi!!FcXEA`ZE!dX9T~+Kp6PVQEkxDC?YsCk zvqJUg{O`VJ?w2H-p7|_pCEqQ_e~^h)?{&J0>(SyVI3yjv^kNxl0IWZ|C;J*pvQ?~X z&IM9PUSi{gA63u>RX16yj`?Y5)18I+wR_&?pGK+Ot)Y=tj>F_J)5I@M**NzvT809Vh z@(uy5iWJh4>PrLRF9+t`^;lQ-?^6huo8b1M7&tlbroKl?2D7tG5m0^N_-p2;a-*W9 zxkdMcE$M~&_2B^`&N75ya%lACo$b6Z@oN6@vZyYCvKqu*yUt2&blft!!0 zBVbJ4eep1vnZ59tUJ^OW_q-YpT`uxg+R7O-Kh9(CLT&Y=;)Tk`kG5}!aG2psiYN}8 zG9H<*5a=8z#^W>9g)hhr5V>yJNBQ2Vi;U1ajR>YtdUCN}n5pY@V2_r-rnt|7w|YsQb0WwGZrFQXltf zZ8dG`^d1DYzvnVXgj+w^ zr}*|i`}kW;?Sa}X_r+j9w!9(TySg(tj{U&+}F~;#=IVnd^Jj%_nvAXS8 z^6ty)mX7YIX4jqG_g`&LWh%B&FzJ=sbY*e9AMSfu$~A6E$rPL`_H4bN<{_r>+`XUa zU_EDV9~V~}=Ox%obmi;St5W;O6fcM7G4tr5dyX{A{2kPb8CI{>bl5n~2GD)meokom zHZg;dPG4#sGFJVP^>ZNo3r&0bvqifkny#{&yli0gIjE?|^tbJ5dRtESnzBuVp55u$ z=DhQS>_%`x;W}exAimb8c8)ilyL9F#j7eLpVCvRq_4=QR<^BgRfcGIg;uS3v>X^`< zIC1R9W8hSWe_7_%|NJePWbtJ2l{Ts0UZZrTmta4bpi;C%yti1W!^M?IC#a=|d;6|| zzG#R1)V0+kzW)AY9V}Xl`>_>qvztzXNe`z=xMi7uc!*c0#UD~sKDVSbS9h*1LG>PE zUJD3j%4DABQ@9sfyZb&Ydav%Jtz#lG-lUFeyS|1!&z*mtO(b&^e)u{1Y@6^*D;xEh2P_tgNS#|8R-*>*$F_|j8b@&BgXM)B=?+Fvmh^<3O zC-FkWFLo1WH!wbHy<%CZ+2^9<6o6Cm&)N?_-NlWcXVI!w9U8;zW=m& z<`K0h0|c9w1Iyf31NS19%HdF1yV;8I81K1^zyUIHUKZb_(CY6u%@+Md7 z;J2=?uT7nvoO!k=b6(*`)WaC>J?;Pk$gbVpUlpJ7N%wNqigwBGlH~`NAo+;vGDxJ8X;yI|9BGaoAt&?Q1ZgR^8TL zzc?Yt91ntKQ$=wqd+H?TAY!}yD$FBH+J{vtlFw6cVmdg&0J(mWLDCRRHtHFEd@ssd z3UnI*vCWYm@}_6 zROcIwc!nQZ9XFgN1x3bvQIav@;)adZE_DBn-zdI*9PxG7M{9)v8JibkM^DyH(dZHt zl6duB`3m|?l)1D^9(w$FHR$bUOIy4a@gU^0=Ao2{ax~iZ=UCSbDvgm2?yIi^u}3!} zXf#)A-25mfMqGo6%_~c^nfIi8o|&?Hd zeq?DX#{I4Jx9la@=kT^N^K9_bQ!K@kW#|(5plUYT*4U?{{+V0qhRYQR?Ky+tEEXIW zm!4Y{*kqyVMYW3x&Noe5)hH@>`&`DHEk=>W+O?14E(Tryl=12S%*$Da2iztY-MsBj zFygR;r`2lz^iayt;l@d`9ooPSlBeg8$?bAVhdlc=;|Kd!L^MAJMD=_*%2*)h+;TCn zwOC4rb?~<1$NHVi?$^rF%aWYR9nX^pqJ%x2_sCerGzE{hmwE_>e|@fP^>E%k=Fv?! zXW*-AP#-CZ`pjX9U?hEN+49x4Vmcg6l&^Cm?IbnLhZj8C<2%D!f1rnDl%Gw6*%v@& zOC|j=lWVXNsJiod=eNq{Q0dH2;rcQ785SS0qslB?f>BX+%xtC86_qMU6pf!7<+%hL zct-IS1sdb?(I!b2DtE2r`r!eD_qaYy5yQRh+7$G2TV=)%Bre4MFkrYv9EjccfU!!( zm&96Di$5kKv(8eUS5T4s#D<`np^t+H+bUj`wj7RlV?pvcAV|hyUl@?8(Jwd@l>PXw z=?(rZZS@Tz+j;G<)MLPLL(qIC`$VUcR5OLbc72P?`f>XChFpXuAV!6^E`b-<37 z?_N-K#>sDQ58)z`zoAKx?rEFnzo0QPM9og0+s+Hd?O9krXDx2jb(Xm{{jc{S+uXj* zeAhrCZto1sw7vZ^J58trgH08U3i zqedW^gK0G79zV2r+R5tHYJW*Thlx|?1uA>y*8EuipPQW*HY}GZ;A=)`_VduoG=%BK z{x8|nwS{VmV%e>pjm!zhGaq3*Je*#y8E5H z5cCee)TuK5z~;F*;nr&g_1lB#Z_vb;5N_2`!%Hp&tw^F3gy*S~qQ+2bbS5dbKff-^5eHt#(@scn=(T<3 zUraVeGGhvrvA47tf=#6rcu5cp5Ex6|DnM0Z^+`A`giUWfhwc+;Jpdpy7e`oP*PqD6cu z;xFv1c+GRA;-?w$hbf)HN&qo$i)ZP7DV54YM&t_K{q*D%E$-yq%ulAa}qPSnjhQhIYKQ+VY{_Y+&_x zwD_7}Bela2h3z5j-g3w@HH~=Fl|DE9hUb`XD(Mx)v7h_3H@3Y=cUN0Y!V1*su_u$L z`y@hbY{St~qAOv!IPc0eH6_e$YhBOMbE3M+_R=OOE~XDveJusc`AfVl@6cWg|EWq( z${$V?uO_}C#64OwuPhw+=`cS|5VN}5pIRMyYDI$p9_RxHXa&Dx`*0w2L(5b3-Mv;L zk8e^AfKG!UUZ-FA_HWSJ@!sQl)2zXvpC11LfT&IAxsWEMoO|`Z?F)y)O!=t{pZc&Z zUMWB492OdUE*9e|u2AneVSGuQDp{yiR3fp4I$^+xgd)_PPx*MCh|4#|X`+^swpFKSz+#eY3G-})8FGb8J71@~$W zS(f?k$Oh&R)(7KLH$66K94B~}i5;@jEug=?5-2AYmu;I(uHfo_pVk^bHSbeeT)|d= z9o|NF%s#V;s+hM=cYkg%%--mkUf~ni<5jQm(lUqhpDHYK{~&qnzRB%RrNhI55@V5c zfV*L_V%a)He+W{12464Gs%d{}km6)|@oY|Sqgd(ap-Sd2g-e*45y~s=<~ClH7+yg! zj36Bsx%oF)&%CV?ajm7vCkt96X-T~~64P%h=GUsfIyBe;>RHM*KX%EqQMcdc)GhbA z8$XNzjllM>55g4;{Hcm+x5+MJ{lA6QC;`6O`ov56R{@6dBibtRGFoC-*t3Ys22#6G znHKi2C1CHnp=>gJ$n}ql@PkYvREq%n|G8pZ3kBtqRf*L^iwf|kq;V&c&4YfyyP~Y8 zQIZ!1-0w*|ZrHSb`~R)@4%fTGB;Pmn2?DG<7lD%4solK&Ch_96f;sLtN9*d43q zxa<@YR$TGp?SZh+)7H8=hnsvgAGP{#8IgU`&omSOhG2#<8Em=A)rM*}7Jg7);S6dV zW#GV)&q+y=fFI8cOj_EeMqJ|bShdn09;@cFZkqKP@zi%5iI2@mFnfHcHn~6f%!YRg zTQ^o{r@p6|8Kta$i5`v^^?T;4k!)oBesejPBW#dNA>i$xz ze^Zzf(BtQD+MT9i#8#8m(j?Ph#%5W(O!<*@yAB$OJ+4-|P@!$8N+6|GfqE5DR-0N4 znU|aKQZ}rlfXRhcAXs8)(9M32zN=2Y1lrYBzBhTx@)&FN;XA9_OF61{3LVSD+5Q%v zkqr;ba*TY^s2uYEqrEm`%7E?J;7aAL`9%f3rQCBWNJfRXS}tflcAHRoxQz?H$Z5MN zni&^=!b|};=NuR>#9Vk++MX0V76bVk%Dyw=Sq$V#O;FUwT_i5q9=`W7jYunYT@kQo zWzi{KV2BzX2$)NxsBA4|K_O=j)c#RYXiE0&u2_|DwG#bwa!Aii#{_T?18M!WYL5Q= z#lA3zE?1~K{l9mfseG{9uRu=V-Q6_p!=hfz2v=*>-TgZKxZJSRSeyMZKmA41d|h<@ zP9^xxERWde_>(d%=FMJ;<0^zgoxl{iWRo z!2sWtxbLFhs6&Jbo;-6IR$3KdRGt%?^rZHSEF@bRmp^g z?|N`!;<(v+)#S+4p*z`1l!NrD;w#G!_t2;6bD*+}MsEaQ0}pnSu!xZ#_K$ti6LHh2SQWm03-5A zSsO?Wq0yOkPl>^Tj!Wx&a6+|*$ho|@0uApUQ?Q~a)I1zmy>4uM?W2}w;c)JHZ?NFx z$$6kxT1R)KtAg(YyTnH)Mx^D_9e5;05a_X&PH9p7qMj6SlLY4qlW+6dE|A3kwnwj% zCB$_2Gh!nvv2h*ZPYOx^IOn(%SJ6@}m_-be6+756EUylFmGcO+z9?hPK5zV(p>e#2 zPoQ3uZf0X7c02BgM}je+_e<%uw+MpOdWW**Gm37J?J*TqL=rcZrdC;klp_h=bv5CjS>IVQdz529mCjV$}# zVu|m405%rJU$n;fk zT?vJ@=Ba_tGv$AKldE|7%08kstsrj@R?nJ3k-0kV{d*?&cE>Htz9lfHSD4+qN0efJqMzWSXlkBLz#gYY(PHob5~g*JAv?nlNv zEo=0{i)*K}(Htq8c9_v}RXNLz~Q<+Z5g(;;!7Z!|dciOGVtCpc&sA^uGhl~rE zs4`OXx=p+K6k`J{3X~Ph%R-Ftj!MCe%c{aSlkP@>Yshn+Olk*5-f!;)m?eYvk@VU7 z@73>QTI68N#9t^rTEB3j60@c_GhX|Y^M?%AJvh_Z?Vtpqj)=Q~cTJ4(*|9fp9jm3i z7r-U2W5)fmgP`e4N2u-!x7@&NJVJyYcGLe6Re23r&F#+KgY19e3fAnVwOXtvpeH~)IY;{v+2RF z?E%q6L8V~vA$j!aWu+L7$&<5>CX(4nXUx_UuV*~1;K}Tk4be|dT~6vKB?V&wl7Yph zoto~_6)3&ti}%*&_j$cRV89sptdqn)EBIC2X2OObn3dlqxYrIJUky{zc=;`>v*^gr zyRe)F;9Eaj<0YE<`jkj}1bY&rCL8mF6y-#0isf^UeHY*O0dz1F&HOJp7Z+)Gg#>PR z$H*4%hC=*3m%RB4U)?-vz}XmCmNFhQQhTui2M?_vO&KPz1Mq<&%!Q%&zw0h}&VsCe z6dvhc5Bn!XX*OnB!z`}OS>V9CjXK2LR(Dgvy|RC7qAhd4%C%9-%rUYjnSF^#=-)bd zbn;fO!M;*bu*7+Lo{rmHk-Cmhm3 zpTOM$qK!do^!N^-<7w(BXg~m;%WL2LcduJ}nPMz7826*Q8mFgcy;CS2r=|C#OrY<* z$~ja;e7O(@DP0!#e(ZfaM<~~z2A}>`+lX#76=f)NGqU|T59K|S0nvN%;O~*f8i2=F zd8sdge_swaI56&~cZ=&DFtC^?g#gB%TryDe=4H|0mS91z_@Yu`tGNP_XaaR6f3Hy8 z+PCe}ZR$)}yQvn_`cyOlaBy0w{^l43F7j8$ic~rVTd}P^U4et@vQ^Rd?f{r5D?7p@ zt9f6EvVQa0{>MedccMn*-Nfqh1gKvrGnX?o;W^G{x> zKnsq07yTVPsQRLE<1nVk%Z;md<%n=l1FFD8H);#dA(%e3VOy06)Ocwmwn75kw;$Pa z)ZjM2R$v0dO@AyJGfToFFO;ExDUC0okIUR$7Y8yM$a)HAyQ>n=x^dE@jEeRomM`(& zeH4~^jFe(^x2`+-aAGaMmG<(5?O0pDwhs=nBIB%=?a?OIlUHJ64KlvTzmo6N3mz>M zaqsLMldqlrmG(`=Liv>T!GUPjE6a#%py-8!@vn>8b4uV=XtdGC-tV@-K$qyljA*n_mV4rd_nf#5kj}vPjmNro@mhgpiN2I zX>pw`MBhO6NjM}(XtboS>H)wgh`TcVEp2}^M7wG+62_k|g1ZG6=R^N>Qo4Nhe)hyR zMJjHmnB4@00qZ_O;vhx;w3*r_(=EFJJEpj`7p_@;52LX*i%TkF;Xr8u_|^fiCFh-Z z$k>YjqTf$Vdyg0WICgu^Z=fQ6vbpgU^hj3hBjS89(9aMJQ}W@x0Zi_UHO5O|a$@Rw zZCpp|G%uY;WvGPsBV2>`6XltV#%K(B@fk6;6cv?WV2*3x6`PH{opK2=yr&)!=evtj zn3O)^cxt*k@uCCe^I6fO%9@K3Co*^Gq8nb$6yzU+(zUtKrP!sgVqx&n8D_*FqQK?X zIq081gfefJ>&?pOUU>aQ3qtcnC82@SC+-vJ_>}zaJ-fd(7W+^4D*Cj`4F=hhqdSCm zkWQB4GUqLuIG)_R;(Nf#oFmp&R8-$8*K?;oIYMz_dJ>XNXMbYM=>i~0pzXgWNzO>r z9DUS33s4%%?eQDvso(hGV zJf`sKn#%kY8Z~XrcIQ%NTY|#D8-2iCO(9YCZ={Ar&5X#eQr(L7QdaKc@rsfkgIEJQ zo^Fi6*F%Gfd2^a#cYIPItx0j)od;wHD=XLi55@qa105gQAk|CcV|8Puis+1)2wnD# z&BQi0O=BL868G`+pSj74$_Fbz*uCYbNuH8~8<$B9W|1re-b-_1EAgTtJl+Uth9WP& zDml6m%M*gHgC2X&r{Nuz6$sBM4falppYg-1TS)x?xMN-bYxPYLw>@Psp^^$%2ZPcI zVmhY3^ZP{%le_W04|L4Jbt?q!;|SIbe=fGTC-^$Hjt|K{_KGic-fn8$FM6`-y6Y`C z@tJzI9a^9Pf#n%{ZwP3hZw3s>LD{Wu!kED03|HD= zfDHV2$R(u!&DbCn-MOJD8u3Vv6a4v;Mz)I^`XQOs=ak3E-otA7oG6VYaz25tX_w!*~51 z0_?Y!O0fGpofc5_0Q{$zjg_4~Sza5Dz9%u! zoBq0eFaMz49260}_8X-$OrZ;w#b-AYHInL}W(%1ac$8R0F}8o_dwgHQSlYn0EiiP@ zysevbc@5mw!}`;V9*wMBdrm%DAXY-e21w!+<=Q2@1CZcg@KroSC!btixA7|Be3AGo zd<%R9KA+M%Rzg;PEi_1GpSf2hn3)I27Y<)CoP#@eLI8ZK^HQdS3{3GhBTLZR5u3 zQL2M{w_VmA9d^Q@1- zZSeDO?r+gF12l+Y*5`G%iJyaIYa!|;{mB=EY74cCzK1NII{t`xvHTtMg^Me3|m3en4Yub2ZU)y`Ka%OAW*1)ZLQD)R14{^Hp!ZGdaX0aUz%Q2I~pk`hk@9a5fGw7 zMaAMmyH7}-hL)^M$0j2~MoHtlXAf~wmb29)_kDcgzX0WqyeQd$WEHvoMPoki%wH(6 zPC{26WH)IfVMb7Elfg=!IjqR~_1O#K3ks797qSW*gP>P7mR}<8T%xs9YK%y>0OcRS z13BQgD=+fEO4r92qjHmgIcb5KYo1#o4!Rib@4n{%IFetXTt;uAi$-g*e(|H**w3vB ze}ul8OFaLgv6IB{!fJ7@_Eyf8){%9q$=_>}jUO9~#;i5~LO{%IyDH*)Rr8PIJ*3^) zWRna9e>%pdtfNY}bkzo1JGMR1X5Q!BD95+a!pm2q`}pAb+UL*xZ2si|tg^OY8|^a< z-r@aud9Q%?k6wjE8$Lzl&`MrZL(`-AcV?%!a%jDHt?K-wVd|c1Ds~wPqLT5;w*A`J zAzkUNBwr|4j;E)xA`ehA0Y)I>9Dz_!y(a4GsSI4`1J%XdolLbUouShx`5zzpH9GAy zFR17b*sZM`B&_x}l!oScyKJ4EsrJTboE=vf9T#X`F*2?gpWH3Gt^|IOv$Dz@wCC+dQO%G*mRDb8DUx|LrE z7*Xk5`&>Dcu(9*Rilb0tv3r;VC9k+n@syeXFKc0<+3mV6LVa-(`YlCx;HRHah%7Y3 zjrWPW|BMED^3$9d`Gk+>CZWQ&mE9I!@e#;y(!7=jNbg}3(>GO^=az7StJa=}Tq#K6 zJd@vv%(wP*U#tofB`h4Hc<~W79gQn$@YX=3hZ2bpq~t<6lcJzkOQ$)%7hAxH4YABL zDEUTEC=0Vbf1)l!M}bfR8wfnz_b0@(e?yz6paJL<#`AmURZlUA$84D6avnUFFH*)e zsTUqNpGl^zW6blQY&g36MHQqxU>Jpk{nkHHoNxJ%B6%NCJdx3EX(=nj5BdLI?y~_x z8UG3xI&`j?SCc1LM75EG=pnBrM6DCEEkr8$UZm-R9|EyAuo1% zV_8P6=|sJr4b1Lb8Uq_)4`ibVZg$VD6n^P9AoqA)%r^8~3$)IJ*-=YUt7Flx{WMdU z03f|fEj#ACo~hm!jYOOPB8zVBNKVskq;^thtiODkIZKQPrKNfBg0L7dYlec42IP zLQ-6VpK{ZHFx|JKUf(JjltDCQTImydfsZxfu`f`|rN&NoKSE3OoyzTJfE4O}`;+oP z*S;QdL8G-gQqS~~Z;bKi8yCtsm&7J&1!P|)RD9#L4HS<&ups9i<-Phd4~U#;8YnDr?a&6{#hpN#?6fj z{bUkZy(QmUCi?a`e)xV%%L(RDQ?F&)tU=m%=^paSsaG)mlrAI(M|@NmsY(pQjv7GP z^!3|7Iu>}H7PrpH^FxFvS)PL$;r^O?dAG<=`7J5;tr%Jy1|%T#uQ^prjhxJrpYZt`D)Wj*jnZg%t^!#}-{#ud^k_z** z@-NIx-R%nz%LWEf**ev?;HW9&RkXcc>oaOi;w%0@3h}lkDny%?{s$fxZ8G=CF-e61 z=~X9~bp`4|o2&aTyu}Zx>8IL#yl~3z>|WW~qtYMPK7Yjo$0^Iph58MAP?zs-1A65w zwB4U$Z04?(hT}knVKXy|mv-(d5<>kNS z88~A8OdX!xUc_cXyAe2#>dpZ`svw*O-bf9&F`{!xC;VRQ77WeujMhg0fzBR>O0U}# zWzR6X(`F4ytRL+nZ~iyNBF7IZ&>CLlRwMGNB*j0$(C-Wq0_BxKqxnP0C$5eMWT!wp zy>T~4{J{{SPcMQ@&gF1e`LCzu@7^yx#Ym|9-HFgB{5`Y#D??G#G_%2zAa(|qX}9G} zYA-EzU#O%)yf%6%fGJYCeZxUqV1-M8BV6dBpjkcEoPTv3snS6d^A<#huWIjViQgSi z8{-=_5}Td_DjaH`TQ{131t!<<%mD?(gSi}Tlj)Tzw@O{7rzlgIY0TvyU*9+Vn5Qtz=En)Br4fPrp!9X=1FwJD@s<<|m;mdMZF>W_G|WL6#K-O(H0_ezX{Mw(}{X zpA;JS+)=*aR}_)ki|J#eA!pSC#%)u0xi|%AX#TRnBRBkC2x@A7Eqgzy6I1Z`@*fpS z#3~J0k=1gTnO~3-sb~g@7@41yzU#lAsf%<7#a}Unxmu~Kvt!bJd)frvFIkA>4Cra_ zS^K1UE9xz#M4+NxX^N&^x@%cRMIV~En>29>OCQ_|eM2fLBLXYR{$x>`5|pg(RaT9B z#jZwzB|Q#kYDR;5g0;C#hZs!BvC$H$~@;=1k+Jer25)x+d| zSBt10$m2EeAqZL)b0_Nhl0L%PhHe$q{5+>rOfM*YRoywF(IIytdiO&#fYh{`9f-P? z)Wii&{(S9Vryc}cGjzw*S15p2A`%J!t{}Rm8&pw6Q(LCn)e1|V4Qn?V4E#F>|6oIt zvmC>Nf{NW;pIgoXRxo?}xWEA7?s+oe6cc7^VS>UAp>R}sHk994!uvb9D+0rMwLl;L zht^W8_WE~8y=XA5iFkd&TR~(Er`gGsYf%HD}<-}>A6b{VWEFxuV=apl(XIa%deabf`ECKF|#{7 zV#EsxUvrDP9g-T3WTk!?F*PeOQ!2|w-fCYPgWX|3sC7i-k}?8VxOrZ{RiDKj_#U9N z;_VRB@$24^Ve_kvFZ7#h)m@a#`Xi>>JDLGav0Y)~+JeRLUeZLpVb%`24|$v=e=q^A zA>4LV@K=DGy9WzDvk{KLoTUroz{uVMwjed>spgU&xwSNW{JbA)g4Ch<0K?sN^H*IC z$v)888OgHaI<$%0!)n9OL0cUH+}VCn8)q0+{4HWEo?qgA?hRP0Q_W3R=%Uh@5n+q= zvg7OdlgEsntI9~;kRQ_VrRg1giZ0Q?rm`R-1Y_jtwM(xB@P|iI>v(4$$+Lb{XYb*9 zH$dWi>&^iXhal&KuAY+q3o~#6KUMsL?orBS2;D}!eDm`Z&&hK{DNLCGBM{Zj?I}RL z1q;85{WURJ^bA;s)JyDx${Jp?h_!z4z)Q9SP890cwnBM<3CM zul9nw*bST^56cv@GMcJ*v{l_Fcxt=F$$-nl`#0t$D>7UV#ziMHQ_n4C5D-LN8nx5( z-_t_{Qvg!301Pg)>87;@&j!B1EfV-&SX;8%s||T4`r$zNk=obm8MCh*Afs=Rz~|FK z;3UAZfh3Xyl7cs`2dOuIdit)8bB}HPOo2Ckytpn4wfy~i6{A7OhuDjj4ZtejnQ zmbN@gd}>lFp_-yanpr)<_Q|B87)Y36bj8H5>TO1Ar8-4u! ziCUv#6t?1#X#yYbRrRg+3|9p_fqDdzD4HT6zwrIJ(MHr;+e(7M`0-9T$hz`m#~R34B@FWAB#me{1Z06KIT=#*5r4;}HvQp6D<;8aWXnTUEY~kiR$fC7ciQLwE$E)8RpB*gpkRY#AI>q|YtQ|H@`r${3T z%5%4mHXi+at6T>Xol)!N>V{cgvL5RV0Lf3RZ7!h|8AKfyxoIBD`R*I6z_tmSbZgK& zIZO|k+^I>HKQ+56yA${c*n|08VW?knhhsXtJK6bblB0l`+L%2^L`&gD$lNTO%r0|) zsjRp+;h5fUY)OG9X3UF}BFK%)7D6i(z<&yboM zh2k~yAirdxNPj9?^r!SS0#>RA`pF}d-8B-w?9mP+cQ(rPj0$>5sS;y#*cU-%oD|$t z|KdwU#8L@tU>h6?c2s_1fN%cKeSjXMU&Gy;EI-2@P0_-#zc#|Q9HHIO?N~cC!K5$#`b0s^r%9CL5ByXC62Q%c}auR=Fy<^trh2{*?AsD zlJYEbe2Qb&$&SUrvEt7b@9Oi5^lF;mw^JZxA4P)VM>& z=f@6?4HK~qMo>xYrW!+}EDxOz)gc=Yr1m{ehn9~#&gCc6t%gl^b=Jo;hE`S*=W`{D zK{f0)(m_tK)={JOf$I<`^3fy58yzqLgwl==J&5ju)z1^t%)|#F~FxdrEzD(q_twgRQO? zD*|c+$uwvFn&UCs$$GSf9AM!Ad+*~I>+bZ3tJ`;q1tX@*`*hM98OEo%!%3lh4KHJrQBP~9jsOR z1n-{Q_EsYlC_d-51vS_7*!Slv7kg_!CS&*TNk=s3X796I-2@a*RgvJH40IlA_-lxK zEtqNu2lC5_4?gea7{>sx>vBB?kB@)WdC2)R_+}D8I-F)26pBpg)c8|swCpiuRp{oh zTWdhY1gP-$yu-ZBBB)|~4b~9(i^nQd71MvdtCp2sP(3q!`2y^M`>m%;Jd;=W-gIhR z26lT2?u+a}>&rUEg7O1!lIkn%7fEyiW^8;u(2$7WTZSZyr^fehq#wIj!*cKsDF4zh-Ic&*`J@mXmyq%J=HuV#!Sq&$!a8iY5OnciS4;3Z^2KNHqAz z#x>9er?@rh)M!>|?*f5l-F@@hweOb*q5^sj*f`Z9&YvTSx()HpCvn%{AJb15HK_i5 zTdVh%%d57+ZFs8XI?a)VgbM#EtQfa%PK{;hyp}Qvk=HFs_^scEJNTFmKkogz!i@;G zFsst`_Dv!bF`I6&4abyuK>-zW%Eh%|MiXdMd;sdv%zQY7%USJx!u-qeHM2A%q@0>Xj>vE~hp-d^bX%?q&7txD(} zpSMLyEzqJyj~4+s&|$kiUQipa(&ndm0Wpv1n?E0Gx?pzQFyE8-gu*~3;r1*xTm;Co z*VZQF0x<>RNoNY%OrEuy=q_EML5evlETR}3_oW{dX(*oOgIZU;_4fNALEKG#4v6H< z*0jJa;ij^n8r3J(7+<_nqHZrBC=b$-=0;rr4@$Ft6HlhxTB=I()-%R$HXeG@x<`<}LxDCMhAU}i8lzaBV)>N%=)N+qOy6X>{Ybh_ z-)h>AQ#G3)r{4VM;zj5-(0GqLZ5y`Vx0HJ-4#t=H{&0o#IMSk|!l8jITTl`zTH!+) z$b2=A?I&A4ZL}1*^~b1)poer2T^b0gVFSwdF<*${$iEZJ;&{)PB)yNz8(1VqrJJF( zM5abJZ^&IEF!h5F3!4-(A0KpRjV>dklgpy}f9VCR&AH|oF7HsPB2c`BGh_CW69Osl z@^AP*JoEN4KG=SB%LsBwF(}&p$Q1tGf)&Ng4D2RU2;W|GK)ii=xk2+G31gI?4$?N} zIy-Z~_ZXPp+lCQk_H5$>+3f3=U(n!t&ihK2W&FdXRnxqK71g=Q%z7IH_7o$TOg zS(?{?cM$vBal%i58R4+*ij?Etw*S6|k|zYLuM>zf)naSgH|_ttRMjo_Z-E|_mFP-s z3TPktR7745b8BSh5QT4w`O%`m@*UNyR}HfJH24ja=y)EiQ%*Re=92sFf0QLc+uSqQY<<&Ke_HAj zDuxe-sp-}rIwa^y%^o-cy8Fo8K~R&PVr%y$CABKc*cGIoD9J44SbD=<0XeCo^(ZMj zv{1H4UyP}tg&LFtf5RYPe+oMs*VoH{j)_gWH~nX}_+LLq*aqa4Qgk$?^~O!cRJ8f5 zOL0iRG39rFPZE5_IiWojP*Vo<2M8AG>92;)^=^YQBLX&(6s}^o1l@Nqp!|RW(%Rhb zX?91R?JLBER<^gCuctQ{Wo%sKhBO}#SeFsj0!cC*3tL8v3fji`ye~c~b|)TqmYLIv znuR84{o2?`_tO+%^%s%q41CkU57QMmN^xR?+8npwc9XB;m?uj9K~bvA##XkOQvD|5 zoqtEo5AH>Cn0Clc1=(k3vEJf7-Ne%i_>oCg$kFk%7;tm45;4+Ny6UkR;-8I0f}B`^ zy!@K~#jiC|R^cTDEmyR&YLBsMfw>_hz^8L(j-3O!r{HZ%w>hHvFo5;>argC+ zMi7)DVzJao8Ng1+Hpmshux@(FzWgkn^(kmZW6h%pH_ib85m1VapRIsBPdlbpQnyj^ z-4CU5W){^9cFmbm6lkE6v67ucG~GFAI%tEmS&RA@h7)V$FV5pfhEm=ym8i!9(e6Kz45)M~>uXGKS4jI5 zl%=3vX5=R?`GW|_p|J^e$*EbcjdUSihgct^n-6;$S*jy?R)ehT78G3t%4sughOnz>?&dZb5 z|Lz{b{8%eJ@q4_4oLjfHQ)6HJfx_0fiK9Zs;d1N#I>vhhm~wEavTzZ&;z+A4`i6&h z(cISS#^rZVRZiEewjIv=_}+H1 zs?fa|E72ZHTi85=Y*hPM(j0&A=Nm;hu-DPbnkZ&#D2iRbeaJQo1Vd2 zwg)fN?`r)uh#_Zkzl&?^o$yVHmP#Ja_=cZhl>9)80k&m3kixl)&pKeLX8&dU2}0CV z8xC7Lgu&s)X{=K0;TX6hvKHJ_2;l}usJCoU(b5IvI$QMN(|Nv?(ozJh8~{lG{WcAk zs3Y2}Q5OYi>F*Kr(932Rx0VG-860oIAoX&Yy*e+PUV;U{5@_q7hHM!Mw@%1U1etXd zOi3HoVEEJzgo4_WUD&g+W;R*wV1VN|$Q3D>-ey7Rg>=;>^zIF^wS0jJpFUtJCi@rR%=pTF|SLUu`d}57tYAV3hIP}hI zh(A9-sv>pQNX#b24G4%~pdp#6s7#M8Z-~$6kHw6ipGp}ye?BC5t54z_oRM?*hLff7 zi1xTt5Xw>y2B3qxC6|W$idE-`qeY?Q>G6pplva~-TK)?U_M0fW0CfS=e ztt2tN+gIDB(pxYnq52`bb6z`V=|EL;W*u$5r>M zJNCQ`0wjf#!uxt&)ApP6X;jA1qey`C49zt`lNS^T9rvBUL@b5U0<0M#rT2t_}f*VaKNYm z5P4@`&&=1;CM#t}H;r(!T{@dO)g*Ymo0cM!R*gA8UzleU^VYIz<8@(RtrOQrg!r2a z(K}b~Tz;DZMbd05G2}KiX&~aFYmd4;P#r0b81UEBR5;rANeb>1>ezH`8}P}}{rera4CZ6>~zCajR?Deof_ zg+c|sMDFEmX)Br|;#t3oZnvnnN-8Rdf}69xKq70)YosjchWP%tjn|(i%!do<%r)>C zO0u>{GZ!!MEOo|5F2#(L>c@;G_y*sUG;Q(HV4IiC728=6*!b1BD=uN)f|U!oztuc8 z_}$GS#5ho>6Y=<~V!)hYO9WjHZ6uuU7F_mo!$}BC`eMGI-wurK{;HKn2D|o6y`CFB z5+G@1$7VG>438{f>P`M3+k70+Hq@XRkiex>$% z2kQyYD0PVa z^R*9)Gk$a%*srs(4I@U4{1xbaFhh7W?_a{|vyC#+x7zhz&m?4=gKzqJ$09*Lw1K$5 zrFu*m#`<-&8}AU5H;|dOD`)DJXPWK`v(kQa{R6*HnkK65B)z)PZmdLjPQm!?xBa-S z>m}v8yKnw-hqDDiN7GGI`w?Hn!(}fYwqgv~{a$fYK&+pp+pDC&$%ovs8#^&*j3csx z2$h&Vxno}S$5JU(IsgfTbc*!I^rzsCM%Fx9J!Y@C@#TvBu|FbU%^nI8d$ViZ!yJ2L zQ@e{wmTNVK6Y8QH9YbjQogBl?+#Y#%Z9GB2RrjXL<7i5)w#iQ) zcE0E6kybJH%7^Odyv;|Z@bf*3RLZRoTWN5D-d$MI!DKF(?P~sdLc^5(?X)-d#1Bi1 z8!w;q!*t>&WRBF^4n-nzVCxrjGUlIaiE)GWZ3BzM5fuiiH&7Up!;XjbxWB8#Yu9nk zEEs;3rG@tfzN#U<2Hf=$xE9O(jhbAww2iKeYYudOp)Yd&S~57gp&(9Dc6QJ#h)I8(j6@eCZq|Qu^VNN2~s&B+CtTmWI#) zb(Rrs3{0c(0X>Z$;+LJK%J+8kL-pXq4b;F-@Pvjkmf*D>dZosT1|9I9twG}kGK0u} zIPu)N2H$55Cv|KVfI?0C^{v-ccsp|R{i%SLewqW}f~u(lbYY9@M!7*jBZ-R<)t*vo za50oeXM!00n_`Vh{p80S%coin;y;Lnqr+fi&sPK^v~mmSB~;uH$nS?~%nad<@o- zX|Q`w3Xml#{59f-aA*k4Dv zZnSi7mXR%{Qaod8GYcj-tZyn5{~%8<|Gp`O9)k+nysV3Q^pQ~ymL2)=7U^n_hi zOiY@Ps|o=UKQLEmJMK*`wW!oojTE}C$qe@D*iQ}JWg6y3o&rB`?Pwhj(hwI~X-|!LC?eP1jy;;PG5lEO{`|wMW zaC#7O8%+?qr4OQqt4ZslAMm(Xf5Qhd;}m?T>=Z+$l~V7A3n#CYt&48|-}W3@DHCKp zC^_4THH7nje~Ws^Cj+I#TCIZ}9vbDH{`Oi%3v)*Jld+gq~p#0Or4hKB)uDgb~`HA=WE zhGuVO+wX1caM1R@sm7!jAZpi}M%s~lh=befA^y;>ap^3QcqvhBk>Dyip5xtl;%70W8p4Gnr-J+m4%0?GTzonxB21gHjGowl9#^>JudiQN%sxP@ zHy86{=~~;*H@H3s&w*HOYZ|S{&qRfuh13~Jh7Y;FK0}K48v`S9T0Kfu!ueP5k!jQ% zxqCy(68I_~cW|NBUHQ;aUDcbE7mgV{c{`rsZ*&XqEIu6t(QM-(@Mn`TgAk}K%HeZg zlMrte;~S?7iWe@N?Qh8+vkct3ZAGeGjOyi3MIwDc`41uVsMAyS4%P}z*f6`hVcS|ilCsS-QkF5xiT)siuTACa5ICS|KiqzmP9P2 zPWUBMb#(tL?W5=xA`;m1Fw=3=wmD{u~0_PNq{Ce3q-4~>z~q`y#%`M+K>ANJim={y9GA(XId;9KjWV@ z02%%H3s$z|gHx^fGSZ7-{{lGC*+MjL>1e zr}epR`SuP)z*Mb)Y=&;Ii51_waDi(O4#bgL=bd*G?=tR=c&Ko1@yEQ}r-w8nJFj4M z`o==RNaD_;{#=F-_Elra;K=5F$daqq(*DmxhocU`YJ7-*+5=^qb+nyvjJO7bLFV@mCzIv(}^-4{iIz}Z`{ zD%BREuHtbW2J=-CfTadXh!_~)J5hnsM-gc`$@OFf#1`=L58qgQpF#kb_&<|4EW|AV zmS3|^7rTYEXEuTeC9?aeB#@$(ncml>Y?E6QnQN~Sz&-Yx#TRk+HX`WSBxoES5Z7!gIg-GC6}W+{-H{nvIAu^hef zB21;)D!1VK{RsX6FF}_0jgo)uF(g(nVQ9R>nPMKcv7UlAd@g|0QUqV`?ke;59BSzW znCDy~-c0P?B97?_VQ{&};(VMQ7Eqh}`oM(#JXr5M^0Lax$gA+4n?wKJ@1UmR1vb>uH8AYYzDMa$ zAJYEU!!EES39*wwr(PpU6H3bVWt8XcSpcd?2n2Yx`1cuvBt7pe_$w+v2jF5+A$2UN zAd(}{?F3&5AR?kpN*!5)6nKi=XJiUA{+EW(L#wCAkWtRnBz=EUX2r9e=GZ=us=*0? zB=v9C$=W)nFG&eueUFMG#D%Q!ekm&nmr;cPk=NGrEZ2esYI`F|5)>U$$-zB}A^zxw z_+yQeQ6()aBNGCH4S#LXka$`%yvtMcC-lJ;1E}w8iwWzibMiE_S&*))bJA#oA`WGE zlXAZ;s@;AjExmG`8>v102{HTbFr0zjz(#QAj=WuSv?{DF2h&g@pl-WC z^!X7Ozf4eW$^1c^=lDq!VFTFZS(2k6dBKowmczu6JlvS_x~1<{g7)rq;dBtx4~78! z9hpAS6L~*k&2_!5b**`6EIJCtFrqOZ?7m(*9YnN^dpTW9P_b!_5xe1f3pZ%oI7HmA zapB$uX+L6ti7?Umz<1J^Gk_YJ+Yg*gz<|8nwo_GKADKdG;9FEk`@6JX*< zA#Yd?35F(D|E|$BMhDx2+eJCH>_~+8O0ck#@WxIv<>fH;z5jdN{D17dc|6qX8$Yc5oU|MzOO#TQ5{a_YLMlp9A!`(}@B5%d z$X;2po(RcKc81DQ#3ZusgGqyl!C)-Ub&t^bp5O0}=a1+0{B!QttJ3&wR7C z_x+g}I*?g{iV7MhXDf#)45b!9S#hjDrCtj+Am?uW;v?)#-+dzCZAfK?(?uM`?A^{| z??1RLPWmwS36~~Sd~5Ec)mUOS*GB#r8#17-&XpomOs;{JAt+ELq-05iLE8dRfyv@Lm<;D5}z+<}th+^?f$%m4;DFGQ&1{_P^H9u<5ssj=Mv#!CsL2S8I`Q zp%kqm0=>+dc^9o4dYFk&9hM!|7{v5MlOt5KWS3mpF_|n)WtpBbcpJoTJ;9Fv(1<<< z!k37EJ2+TOMn%8Bf-ZS{Jkx@9Iqb*-GJ%ISkDh}WMFr= zsO-WepvEFpt44l)ip_zjB^w55mc)CN>A}&!Z~dSjx7|m3h31>n+F%J)2(2%tAI~|F zoe#vJT&!Y->N>?Lu7PVHVtFYPyn?O{{JSe}80&zv1T)ylNsJFFN9^=@A+7253-q!c z$S)t?1fRkenahB@h$EZ<7Tfoc=CvN{_a>tN_(v=2eOhEK`EZ9FVz7r)muSn5Z$%w;0g8r>0?XKFz}7)c*D=f&J+7xa8+&shfe{!Znalo z+y&QuPcGT`;k?Y9E_I&{oGUv_h@Wh3NF1qT#NzquzHCS zmL(#03skBK6h(V|pms_%7>t|g@X(BEpZ-nx*|72d5dGI$CqZjUmw_#Q8y(esBkU4# zKk@YQ;3hQ6Z7y>y^)MgwY_Si(t=?(&`rBy9ouETCr#~}k=FFbb?;q7rxvta0_5Wh) zS@r_p`4vzmbe+&0H@8RvlE5kFB5Cv_*1(scFS)Stx zK#7s!M}c+z5&bw^T;_^$7HW3qpn{qnHn<8o+irdYk$|F18rM7B3<&h9Dj`nPc|TAJ z5XPKcYhP(R$pm%f`q9l>wlo<;BWT?Begk^*gpM>K4yY9Y?>kQs>-Q-;xK!S5;2xfXx z@ALyUKx)@ec^>5$_EH0G;M7IIxVk z?-!Goj1e>1-Om0 zSXQ7)g^ILZ)TS>1ON`?NC=cC{15sj@7KEL-#zAV%f>}iKqM0og(^CAzn9*sME8eu;SO0Ryp#y?WjVF+} zffNZ5m?)AhT*nyO(-$X(Nv@+!`Ue+hl&GcZBW0@ZP>>#HflXiHIc6jxcftY8c>5-% zjZ|55khMZ}&dL8Pa({Bc)+`0a+lRU_k~>qMkvC0|zj_Z{fL^eF?Pg;b=?M)uI`Xq6 z;3xysSZ{*86pgo^yZsbitI&4X0)w~Q=8%dG5D7P5#2ZR|jhpejogUNO!sS1BU_MTd zq5E)dv-EioJ)io0`-m;t@xtm8{}vV}cu(@`deKkrd+t`pe}v8KDp@$rdnzj2kylzA z5ZTv_X)gkbEji%C!<9yNx->0!vgo|}S1P3|e0u#T2#DT*MSx;&{bQaCeiD4Ijv!W3 z9{TR!2L&_as;bT%C^7#zIGs}nx)&n|bz$xY-9-J^nc)|p#-VTSqia#R2FG4{Cr>~e zKm@JzmH1apP!JdSpcD%Z! z#OS`~-?rGM0K!2l&ryjNfR z54iO8%}4Ln4#S(G|7VG(wSUnS;GJ$iHD=YWnm7q{Z}XE3UmVWV8`*%L@d6hzM!PmT z)i*Z8{6I4~7`K;tu&?2kIGtS))2FInyW=J~v4(V;F8s@%k7qpkLL2Y{A1ZDCrAyw%!z%wj@5I5vU2w9ykM5$(nd|=xinMwD=UV^RuK(iWALf|-|2)X27l%8g zP1p>gt9m&MJ_a3Tmf%tDB*lT=o z#!Nk08E5Y3?FwTw`4TH*C8A=L4=&K_|AJGTYyUTQ zEiK*qkN>SgmtH@}`7cI8`^A3)thmg7CR#DYe_pg~iqroE+OjGBgNkKK(ESG$E2j7l zDwa+0A5<(`g6==4STV(aP_bf)|Da;o6#qX$MI$_2|EqB)Hrp_ z$%$%%xWmrrdbyHMtehFY>F6T0kJg_4)=^B7?QW&TIiowtK1z#kZCRdzh)2g)XRsJA z@uTx*qZ^Zd6ue1WimhUzNJYT;)RWdJ?8{%>&`s;CUr~hf8;xptf8?c~x3eDmX?_Oj zQTaAmR~Xb1y(&kN8OHK-Ow3stQdN|u9>b!}FY9nUjjP1WVyIEf@3ouj$shJ9D~xmNgFS^QOF{rY?g@ng|3B{Y7| zg&)#Xsh1slEACheC#dsRtV~vfVU;FosOIQ1O%{#3?k?cmjO5x#uQ`3easF@yZ5Q^2 zuH%OyieS#VE3}e5VwHL_U+L2HpKZ%Aba6dtBtNqWLjr&J7E^9=+~4SWB{;|%Hx@5P z@-1)?{=LCUBf+j{n|^M~iI<3VoMx3aX7)@!N&X-mb-poV{9~K!osqtugh9_4slU5S zOE8CP?^yr!ED?s+qI#fhLCxaeZ&UwcY3hb4nm%*-AutL2BTTht`y38dB;1#;Y!AXL7f`DaMSU9&emg%3juyPc0x^U0>l8kjvjY) z*YP*+%K6bl1E{&%?^yA?9*vqdzt`!SK7Dx{vZg%J!Iamt&%zcQSq7#K>$g+EMRq&@ zP0C#`1)^bi>vp#mrhs(Ei;G-1N%g8!=fig6Hp10i#vhgg{b$IkR}kJ` z^t_#{#0uUn(Awb#k$l}bJ_t6@J?~x1r$IBc*V3l4^L4?myRkcR^cS=!t~;MZnU(m? zFS_i7K(#qH6jR{gRhQy(u{X-mO?(?oMr2(aRF`dg!<3<+4WXE`Md!!h%UnpJP?Ez5BZ4NSO32ir69OYSu=D z5lPS@xx$$(56xrb=BJ=bQ@Jipsj2zh#wZ>=R)UF7^!{?sbaj!s^D(h-uCAnB9e@dd zAm|@5Qz&)bb=TbRI&|1me%<-5!YO;btO7Pb23-u-kIsSDIX-%w>6uOb#qCc%HJtGk zc0I8SRb^ZUR^$6c5CGoHfKj7ZMJ7pr%~x-(UsfSz^n8xWZggNRawB^|WQt>v1)>Yg zQ2u_lI`eEMjN&m#M4R`}FDgu`^CUXJMXii$|4P@Vt<;Jb=qb|vvr)-aSh-f`J)79X zA?i0GbyX_gDBTyf4W=EJX?JY5eLKt}z$GR{S%&=1NTIOCG9z;*?3xCxTi9j#-^}}J zH$^P-XAu$E!&ZxhW>n*@N4jLQqfAXI{=1%-0<@8G`yl8N6z%p0&H<0BwpHlU;wVm|h$*g0`uxc-7Gw(4de;8tt&;<7&5Q=vX}CcsO^aN58SHBB+kgd6Rc>AzP%S#Tx>NwrHdW6>V;ICCUdH4}RYtHJVQB>ar!W$*lXWaa{bK3lnOShuqok-_rwVh!mqm}Px zFA0s#iy76rjAjE?^>;S)KD5b|xIlXYE9#W~{?*XCqJh`qW+HWqe0|ZX!%hvz1N7aB@}$NsaApC=LNnTIJIL;*h>JqFRKn1aR?# z^c)X3Fd)YZYRCK8Nv}VGmO8CZ_hiybu1Y2x$6hEjppWXN969aZ6{ak8+pcd#l9Adv|ei5qN%fEl~*8e zS^gfkInZnK$DXh){x3ILzH<3;ZNHj|<#&e%HyZsal#BeMkTl@)0{HH>rgsoj~l#0tDB4_f0D*s$W2uWsb0iMWnyFXSDb zzNplMdQjHB@(0>E9q-Qx2Xl2U*QZ)b6Q9sJMYm@>VqDEHPpwesx({5uxLkvkjmNGc z0qf=_#;zk9)wG}5rYv1KCm8Xx<^3dAUfqUNo*k$NL#=Gb)s=)=wk0`+TCjBWU9()S zOyg+z&FCG&sOkK9coqM*aVaifQrhxQ5k&?v&~InVPjO|+vNcz(Tbzh_wESpm#>dqO zTd03}=EkvIVrIKq)nz}$Bc3Qrs~$3Q6$RsW#^@QjoFKM5eO&6(_c-Ryl|dPJRtDY2 z$+?+BD@s|^M5cV2wDI`|gc7_5ggvp|W8L$jiJ8fZJPfjI9E`s{;gYV5Q)y*sry0|Z z`o~C6$dQ$uQL z+U4c(rGLOf2Xs0wW=HX*mGIJ?Ju3OwgH3O*Z$_`9ro*s$dp<5$VuqrWfBSNi<<8KB z9o>Uh_oCUKcBM|0@b^&z(hc^gytOoy_^G&fQ3u_P8ok1qm952?+_bHv<-(;LOvr>~7~MJhbpo~+PJGyd zld_o!@z<8EM)!}~Updq$>V2!sQLDl<2r!~hMO)n?C2&%T6~E`9TGcL74YrD{(mPq; zWz@DrR8S<7@jp_cc6R9F#6+d%>tG~{AyMIUWv?a zc8Kl&wdp?Q?$!rVwg7t>y^aM{RjoI zMNCBTl&ylstbCJYa>P*&^crf%x35NjiUmRp#uWZfB7=jI-qYarw0lp>%vlJ&B)%{| zbRFX7l2yI{!_v+0!NRMduljCt^DenhA>cR|=iYAG2xX?q_-6uL0%5iq7eC-)buI^$ zE#EnMf7S7KrL5ShTXVtKrQ7}-ZF@UzgRRwYY`ao;o;>AV)LPkd%5M(08A0?D4)svW z&yCY}kiWf0VY@Hh+-;Er`~JdG;o^sG*>{DytA-BxZR|HNc9#Fl=vQqNDzs|?zt-|| z>-K%s&hl4pxW=;_;O?TUzLK$a7l0MoA9ibq_0?hHNZ{rPX$II&SL-Wt&>pQ0`}>l= z-`Dg`(OUw@K%be;1{F7gpV_I~VTU#3rV zi)U8DWV6!B?g75&jkl@Lc2DPum1ya8KwHL?qcj9S^E>T-6CMriS*V}t>$+fep+ms* zjt%d&`PncF^jkWe4Tl}aU#93`F(mpkD5fkF;YXk8Pi|@vmI`BfMBVoVD@%<;GtLia zY&P|uP0g`aU}Isw`3ne+o<=a7BVf%__4|~1q7`Bcj#OJny?NDZFxDAgTHZMQstgT` zTGnC4LgufzCDU$Qx1KS_Ea z`ES&37&9P`e-d#gYZasUYN`yRUk&#fjrz(>aWtgq#!@_%Zd2*jnw77dk!5R=f!}Ue z4);KhRhPJ%1}-63SL%r2Je2Oc84+Z6$4PK3Kk!Chy_=G`S7;juuhXghHqA;D=awN) z{U9qF9Q%QO?cN%`JI0qJwP0K+P;v6EQbxjsl~`r{{njU^(rU#9+bP(;Xq1({kBVhu zB``yL-w2q$zB1fD?#T)^hAbqOfQ|fhlP*GF$B|@Ty(h-i>sOZcTXfxh14#&#KKL;2 znr7PS%O1?8nG50PV*QNc0EhlY(?;#9Di^@T=uM@YyH9?*p`@(2YuDX)ffHg(7!_(9 z$;i#u*T1&L`k?T^SXX1y=b^#pW!3J<$ZXlNwW_Sg!iF-z*J6C><{{34{R|8Y2jcX` zT6-+!91TTg)27;g(gxramyM{-_J2`)Vrkcz8Yvu$Cleq@^!_xl{D9N#`vtS;>c9tR zf6S5(AN9*+rkp1WikpY#cBRIVqYR}N^kG!oy&0;yebs_w?Y&UxRN_PF@`Adw@3TL@ zN|q#4j%>{=wY6_F?~JtUNY!mq9Gq*TO+kl;(R}7!C?l4(dc#S`iO9L2aK2ZS z(l)K5;DvkuwSDnt0pkB+P|{Xmi_vnGHg+_YZ>alTI_LUUqEjS!fMnje2fg05ZM5dr zHa3R(eEisV7ov<^=<>NCsF6cw{SXs#ygGlUPm#6VxN{;}uu9mWuiQ9N2lmx)|iA z)bmR&5t}bMaTyGv&z}7zL1D%Fcxc#w3l0sf9NH;Im}qG*XRo~#+cwpQHN0n}AnvAP zD6;YKV?98hk+3^=IqOPoITLNc3r>V|Zrid|&R)?R9OHcVw*}vtAs6CS@ufvO8h_K1 zt`*T1rR5VJo=`TXT}M|c=L`3O;j&S4@V>m7>qX8^aj>~E&{api025fV@w!R{**W|` z!F~aJCj4JW_+;fLLGwfnyQ~uorkf}Uk#R`KMVGDz~+cf<&8!QV8JA} zqRo8$$(pR%itRqm${`=@Fb+IdqNSKSB})XGGUM+Vye$#2mLw8S$ze1{e5+`CRCevC zsxo6T1gyv)^{6l{&dOq;mL@6{bItqtK`8q{Ee08OH9>OlAQVJl@bzewZhM*mzW+rY ziX!k_WR^$?vfXu4M@~}#W4!<4w>20e=O2#zC04v`0WpPf?58+&bu2`*oCdzNkl*({ z4={F25Wo{(LokFSL$Hc3-G2(7_*KfF@PRsQwyKvPA$=A@#n}Ut z{&kc(*=G+K&loFRe(^W$3ixXjRmtuSqh-A!j)NMN0-mmuKYY(NdwGTbkozi?U`fRb zCiwaK-^HZ)*QGtbn>J}15f_^xG=evJll+yJ6qUmI%DGMU!iUVW+)9k)m{@sOp<3{N`W!icIDK||u zA}klm2Z(2BE57K`EWBHmwN5+r4Udnxn>6p?U+Z?~K#Aite5dY+qNt?Wi^6@mMTx?( z24=WmBS&k@=Y^(0b>dT5IRh0N8@tvow7dFq-fvA_N-D5KCR#Mg>t>k?^~LPCM_^9l z_kJ+RB``VgDC5^4bgowq!!$x}S)J3ZEFI7Ks>W{sn|YVP1a|uS;`F?sW1+y2!3+)B z^&h!qx2Jy+Ssa}FbAUz#d0#|m>q|@L{2qtWG|TZOK z;Yh9)JYseBtxK5>@WoRw)WF4U;Bg=tSoInZKEXQe$x>;S?kCI7)A!^eV9f|TQhf>E zHzPRK78J@{%x-rJY=2#H3Z)f7vA>`A-hc*f|MQDgBsqvzQxV!i#;-wHg6OT~=YB%> z5@vFpoRP-XiIiGkE;6R@>{!OkvhAo)a`&(qd*AvxDeaP|IUrV{^z6Zn8x5EWnj~f~ z2$`9Ok;&V(Y?J#I!X0brd`?I@Taa*<>*!8cy!Kn65nt1y=-PriOBEi|x!%VoSqa^s z!5~USgKI8Za*aA6=|t!7YeW3QF--UC6;C*e$~*ek@ks)AMTa3v4m zg$O}l1NZ|bh{L9xif$WoFnN=9N&S}iF|`+70OOS*rk5cB>+2z}rVC`wVk+MTA32Kt zGya~kh$kMdQ~j&x=4uT|qc9mdkc=V(Ou^@JN1RRpJ~P{Do&o_bG%y<55q#oM&q8kP=$_wh5Dx*W&Pkcn&}>lJo?+PYGBY0Vpj_;e};J zWp?yGmg#!lMzfH`;t>Gq4aQGS_}c@jfIL(gw%O+a_i@umV0K;C5Et&)KH zKHU`tDHLcW;y5?m(Sxo-aINRZ|1S3h}#(LFHR8Ba{s$O;20q zQ;U>CzS>b-o{rn1iPDwn9@Pjf;MKD-)VP5D-yi(xrTK|EoLwD~y;19N%|y`6`zWYB zQ^aw01OR2d7HUXx z6uB6b!y&G_qw|KCZ;UniR~-NZKAnp%wQmih4b$&Ivv6q=O&D~S5S$#4shsg3?po0i zWl%w)vnEQyn(tQhJ>UMvjRVP(>cTju7egT@O>y*|_&$$po~m!=of63e6Sw*6Hjyez zWahN%;ag~tMso=?RQh=IS&RWTNvZckGVM*rXaavR(0uwORJs+pnz%~HMJaoQkBhLk z+et=PbtU|G6S=p&-qE}wZ7EZi-lH9*(8tE6T>pda^R0KYpEqOz*wH#Xt@UDdyaWYJa0T=C1K_R1Mv*!tmyXHZy-JarZqG0XlWPZkrWrZ)%a^2zlO?= zXLaUl`g8gpKl*EF&N}yZJ)i5WO!8g#r1=75j+^f0Ql(F=W`B4J|B19~rWwkZV`TF5{oa1fAPjuI>!`%dK;`Q z=YT|W9H@VR-Xvl8XU;Q;1i6Zz5pol1ylLa(*Y?vLKe~Y^f8zIPE8~UXvgwOKfpp^< zmu-VrCcG>Ixy$AbF=Hh*l?^kdeA0M|io+#1y_Orn28s#8j?>ZYua*^XrpRSBs(R;S zfE4F?I{kPH%-~aB6E5_{b95Qk6SAU;W|xM`8o#|Cy$F%JR(V;o^D$Ajy>b0{@aDDd zk-Jik)=B8NT%$!Zue^sbphbUC_>Uw1zD>T2`8!>hA}q%Pb$D8<5J)h7ZY}tzV=6Z7 z<{#))82^uDaja~|PcAV!{c{&-s(H;fP?{=dU{gKT2Uc~={mQ#co-4~)JE;!g8(8$7 z7eXUl@eh>$-RFc{l{eDWsN$!pXv4y5J}U|j?|ncsC8e83evM5xel6=n?_eUD2h8Nc z>P+sL88NP<6Xk(Yz_ASE;iaq+UTrn{riWYh?AnjYleX2jX?cK7Cv%y7yK{Zbk2?eL z>XT%-q#g7pnh?@9H^BuTRgNi=pif%keR=~@9BS_IO4@m%kf#A{6b!F};v>IS(;*C1y)L+q$*k-RMC`N1>)v|<)K8mOh(O^G zyF~tF?G@8|XkFdU+0(&|jP34xU0X$5uMJ8Y0CswA9GCDxeGMEFLteVxIy%+EE35au z@jSQ^6_mit-os>Me-$G2bD!%VYeY4im|bY$aN9d8v8}}Fb12vNRj5whg_t@Ews+^$ zSc}xPq=!((`YXSyc45Y(1iJEo^CeP zjkm&gD|g8xK`jCkao-TX9Bt!epc+_?e{SbvS_^Y|14R+i80MR5Da9$_a>=oS^>5U* zpR+tQ#fr{X*1zt)RkW{0YyRh(I>SDdJ)uTY+k(znLUHQI<2j#+ z+vvGr3%Zc}dZeNxs3Y(%WMpW(YnB`p-2WpCp?t*+IPDLj(T4TV$yE?+VA-(wwe(qY zLG=Rr(P>7RL=r3u*dh4|M~zxDHAJwC0mMKb?e1f@;UaZjs&UxhHvw)~f1* zs~tG2wx9QHgZbPc(=%sIA(94}V#^lSz3?MSMxf{bg-xf7uHD1TuO-3;bOZ*z|L!&# zIIw|~*g)7o_tB+T0@G*MHsic)?#L{EDgWW6VO3ABI7N^xWdbqxDsT+JL8!RLw6~A? zol9rm$yjzGFh!w!sM&2NWOq54a&ugy^%hTw8?aQ61t8nNo0swaRf~9XE7TQ;uR&L3 zfqnHe7ElIlIO^%=#lkYH@e#(nGXW;fEX@(+v!J!z~uXq_H5-Ty+d&^w%)R3TNRjxe)B%u9_nOGUd`>qfZknq@1nxs{r$VI5Ch?r#xogIF+MbOW2k#TEYY1c~^z*-sWcjpP0!-m*v#D)E!Oo3Lyz%VAgSh^?-DJ^Q z2HU!lXM$N9q8A44J5WBz=Pi~3#fb)hJNYf(mFATyH#hF7;_2iRoQl#-Ct}XGZwVMo zLxTB&WEEUu)#{!u7JB`0f*Caaif8D)5Mi8`1XiHxKnq5KBMho7>r7vw5-GgN(F4y;>Zn zs#V!gTuvmH%JmnHBv{*?MFlyn`Iv)ZHN}2Gdv6Pj0h{*c=6wMGQRji7vo@%Q z@5WEC$!%C)bN!dr7wL)@zE^Yc6K^R0@i|o}V-b-<^36@@VxBj-5|-3%m|_L`vzVF6 z6YlD`4|E)q1Z2Boq;?6xpgf(L+r(3`X4Y-|v+Fw25kQQ5thq!EEy)H8`SfDci>Tj7 zQ5%OQht>|O=pv9TydJ=3Ktkn7G7lVUOW!W*7{Y(8gxbqR1qk8Iw1Ff1&(8rJD(DRw z>ZC!wvWX@G($le7 z1*F00W}m1`#x&qVC?qYV5 zs{;?IPM}-9*Q`91h_|ZEPAD|Gg1Zqk@c1(&8Kea3Bc3ICRE`d2hL`Z^bT?U664fK9 z9B9JlctzcFW@&(T%Z1dP)!B68jcDJ25P(np==+l^GvkCrcN_bnN~eCzrz~U;IEPZJ z+6w5`P%5!c9+ok9IoGNMpa_Yn>o@$BSBH<1cIGs#ub$}6h$@Aw<6iOYYa`3C%i;|S zSXc0}`pI`3eU*Nh7j7Pk)!()uEn7XNH8g2Tb3{?xyzuk58Cc6_s>rM>3Ni^s(-crf z7(a<>6mn`2K3*F)8fl(2E*;VUtW1+*Za?H)bHWSoIbggz^iD@Xuqj9qxDxFsK49FH zOKfFrsHv&xn`;%;S0H^Kegcp@>PYRV=C-|U3}9hngWcK5F}aYz7oV9_c*Hb1QE~1N zKydA}3jt0A?6e?%6;oltz^~eI-@d*Tgw#%6z}TaO)VBs(Eh@ZeY8@8>jIk`>$v}+{>5NyQuvQI zDC2VH>;M!Zx@vqzu_9k)k;gW4ULh>Fc_<>0y zX}(t_!JQRQ(5>$@q??Rojx1youfSy3bb)(gcqib@{-w^tJ3gu;K1 zW2>|1IjMrM0Dh!*o_=Jd>fQ>D+y^ksiu29|ZM;yb_#iqvQN05peND?*@VJOX9Q%}+ z^EP&W(8KD4?W0p6sXNTJuB#7ybHVz1lUtVN_UC4uuFiuRO#~^Ba16yA2q&iiw#Nd1 z;9pc8eQ~9Fys@Z?9X{IovY+6kd&X}#K1IxPY2G#l_pEFd*8J`?qb+72A*KAuu%$bFzqr{hRF2Z5>5^?O2f6FWaS!F*?6 z+(VKsq%L}$XB^%|rETWeWk6lOxCaj;zCgfn&9?UE?ON97o?I=%Q6SSpCga zSOR*{(K_t8;bZ5-){EJ}AM}r2K;(|8Qn{V&+9DR_a;3QqqAhzL@g%4=P}0Wpc}96a z5r)vwV_9LlxS3)lODE@N(mS4upUzi6^JKnZ@j zrk@93Z4RA%fnIaMbz@Pxv7DAaF!0{ac{SS)AJnQkSoZ8fY?-1U%6obgDzTfi=lLAd zphT!1f-sgZ)B@QFi9(d(NLa%6@5A9^{LJLBx$H^8yGGe4Ku~#XI*6D&^y=bbMOIi# zN`X-8Vhm5Ue1j%;;~Y+p%&vToK&Co2OICq&YIUy9-%Z}KWX?}0{_Tv#$U=hl_4rmT zw~vmjur8iF(=4mOt&hL%Do;4VbJvVCiA|2FGh*$OjCqA2(b3g(ANj?CPcPhqEXv7= zBGK+Mk{$Es$IzZ~m5NKy*@yG}ZRjXwt5jigzrv*Y@O_WwddK7r(a;?Pq$Fs=hlnE1 z&dUjvLjht%kgN5Nd0eF#d}jZRvF{)K(nD;b%sN;!zYH`te>)E;0i7}?{E)jA^6Z3i z;rpiCht$5ArcP0Q?r)B9F^SJalH&7En6$V6VGG>_MiGL_n98>+=_ealN`TxeuN7+S8h3)$^c)0Rpmi zj4e(NN&gRzoo!<1wLaC~O0^Q*yNUL3scq#CwRUux=n`98d4ji%4q*rRM?YfF;?0TD4DGUsciyx0+25 zs>sY%iUw}*?X8!^NSns^p_;3wR4L-^x&0H0 z)hFHp(L@pn!WTH&%(o$s!0R|bO87@ldGf%$ zQX4_^l!Duw5S(?yQRBM4j}B=DUdw8nZ=Y|>_C=cbyRvJ<1 z^XLS60QM|q2%b}T;Ii>Wx^0wJH%^Mp|ESxn%^5el!6Wea1e^zWT`qlHJw0ROR1#{m zXx7mcIOTJ{0c3UkNwpIrp-&cDI1a?c1OcqasFHiK0t#-ykmrb}L#oBkGz|i2JObx_e{SEm{jj&kfB}tEiLiqh zQ7e{f>HMKMB>Njg6X;wGA%>l)psKufe0yZKy~JJwA4u^jm9#d~lA;em4;Tph*BR&L zU9uI%&5X5gjEM>@PNWyS6>g``OD&`dfU_=I40o|I2&6lL0gWIp}&eraj(M6oerAJ@qw}eZbDnW%=oA21d=TZDLw9WxDL|Gh4 zJ&@z`m`h&U&l22nZL!WVtSszWjn=2LJ5>Q|K(E_Vocfote@O`Wi(jU?+fyKm_>W z!(&=mf#EpfWUaD!vTI(!j<&~a(1ynp9PAnBH-FninBdR#MQ6*8v+j7**lx zAu$6eOvR>AG7s=~D~tXNI63Md0e*lz>>)|UC@9=Kq`MeB*ixG4_-V5u2st~8{juvJ1)Dq22kv=f^Vb!LCaJB;T zt(7h1K>~MRs~?-*J-0<|9;niQHg>T#$U({QC0(o5q4qLHGxb3W2Z{e)-AM67b@DyJ zfRWCZ?zbUl(}YEEb|ycCFVd;9t}ww9=vgZMl5r!Ag4uh(IG8_eeZjvT9+ruXAHO+t z9vzS^30Z|dH|cnzfFhLIVt3LqZ5TRX14;{ZfT%RiB_woyI=g2k?+Wk5cQ>)n1#pj@ zYVvM`!ePWi;jl52P?qj8_*m@?;=#;yU1ZA)sO+`G$E~1T86ZL9!@%sCR`>W&>IS&N7+6UurwXi|PL?czBNH2Qd{ zO(h(d)j4O5oSmPGe{3RWSMG{WgErQw)!;RT16@{tDF{I<~;{GtKLRX0wITwK36 zy|b{uyJqxGSNnlYRoMuDtaXf}0+GXZ_f0ujBkt9^$C+D+aw5Sp5 zCm6G!A#%fF$$~j%gIafQkm98TrXjs^na3)}{$kqMn?Xmxkt23D%Mlh-@IO4FrxzDU zi$}Y}X3v9>J0%Ia_`#cS5qw!^pHu{wNY=fEzJg}w_9kZ6pXT$S>3_1+e$e3GdaP-3 zq#!rQfMIjqyj4jTHNd(N`-T7c2D-g|!I$7>)CLSpTsXzFq}esO6{}w4S=000YkS)( zF3hlX(M)K;f=p)F%j(w~R38=@?VUO19X2~a~wPm)bHdWqAoauneiDxz!+A3>P>k{|(E?o1S&kn;I z6BZ=v9d&xoF0`qu>smR9ZQCO%MRJ5q^A}8Hn(|m5wP^}8?B-AQJ|`CQ{P!Ml5HV?c zkr%MbRD%CJ$K@DplQ~CXF~=*D*XcgpS|jR#Qsc0_uP?<9&hI%anZSGfsE+sWJ z2I3E5?1>u;MAw_l#2+!WMEk0@_uswzE@pY_I3ktLz3;yZaI@GdFh3q+YhhqdGe193V66x=6wqn9Hf#P$K!KVHak#sq)9_onN}un9qsJWjwbxMjM!hZNkLggeFN>R(a&&(l>Z+CREPl%cs z-EG1#Ff}O50aB+4XmR{rO{%!`+74L3w&)Y=f1yu@Q6O-SzGvz{GVM( z8|XbT)7FdB`zoOtCHqzAS-Uh2Q%c=R3wvUyC^9%Ww#qIB85q?vCBNjuL_i*RDm70g>&G;jIpOf7DYsKww#wF=kH@kPG>-_xO zq|$Hk-w_%9kP~iRLhh{d(CT*CTQ<^BYH$X3kG`OjsomiZpNqK`EnZZ9t#IOiJe_=$ zjw-DBup)SHMOUY(^faYzUHYLyreK_8KYe_b)f9E@(=Pt2{>^cmqum5);;e*l>EsJ= zOz=+*6Y`tuvUTtU9!=M)a*x&4cUnu~ogjnH_mIPP3(Jgz58qCT?+_-}U)2^)@9r8b zO3x!j&TCb6X&>v#(4tc{TK-JWGS1`2MJDzgwu9|^YjW=ShtRYP$K!27;_y$d#9)U6#1dq7r8X1XkavnLV ztQ7o4^^2!>UH@N)MUIOw&WB3-g5yp@lpjhoh&^(H0oQoFsyijg-&9@u<8Iff3^z$z z-i@cQVPw@XySbRI3v=$8PObc!*r|tDwcs~ik7o-bt11M|IeZEU+PvSV!id@2i3WYy zW8NenbHPcfD%zperS0wYOn^(|H0LzT9JNMMoooZ}I>4CF(U`w~YSdK}f6nDaow3zc z^Jv&F`B3S(x^@0wNd)JKo+k-ABU`)Lo;C<9cBJ#22M^5NOIFVns>)^7z93PWP`R}p zo6Y6K&)c!i9x#DXVhg46qoEm9`?77_{njDR8&#FkF)AD}>DO4c3!9l~23l^Yu2q-Y zK49azzRVt{z8*2~(~fR=irUJqs>=As-#ZqKDye_8+vncFteJ`vQn_l>F5ezU>@Q+X zfAN-N;+^M@RmyF*9Ud&-p0@wwNi#2qK=SOKL}K}nn)d7r#7bCr_(hxUd&>A(5$hkS zjcG~#;D42+tkZ^uP0oUR#r6nvP7+QPyIrB{3`9u1#+I)!a?}_0N!<~Q82ecUA zKdogmHh#LHyw3L7lt$qdEL*2R-Q8kuEWiK?%h=X5wWR7t24Qpg{Lk8I{7@5^T&yq4iC=vKiW(*{FpF+0)KgDu!Nx}&!nI`ZP<->-A`;v~5&zl_g zIp)u{Ov~6ri9`vooNRU?utmO@c=>)b+PdCWcgjXwb-B?B@*YL6=BSQQ%Ummobe}QwB!U^xUV^#w2+H1#L3Op@>7Wes&kp* zMg<85B_Uma#EnhY<(j?iOUZ1fA!mqfFW&8JpBFq=Sj*(~!qsu0PGxGoC(jSTcGs=8 zcX<~z3g>!L+7qFOu>2lsUgzYOX?NK+B{|*M;+RpI6HFqYq)0nDr&P%F7KbKxSJWiQ zAlY=*iKx+BQRG}#(dEz4^$d`Uxj7v=F1!U}=9-%NFYV2X4>2Vp?Zl+)p%RPw8lE*e3@aZ^ z>~mGDY#%3PXS3byOnCceqzc!Tn-`p-ZF@_Uy>SHnB5#*mJ5BB@a^~F?s8mX+3ED*Y;hu>!e&%z6K6>d8Iu|j3bs8 zZP-Ik{)QE#J~RNA$s8l3dIxX}kw|*N+&jL--!-<@y8qzfT6zcxU9!KXsK@4GjpN)& z&S37HeuSaBu89N<4a}lRtY>}rsnh@wwaEFGl(TN^vjY)o0lP{t^Y!h`98h%WHF?fq z`D1k2sf0g2?cECxfj{XHr)uBsohLdCa8uto>%ysiWbSJb6ZtftU?_)dNi=yI~dIa1)x~ZW}Jx|V=IK{Hi zX{c~TQO>lsLDn%zCv##-bMDM(lk$1@`g$TqIoMJa~rYSZKf@yStt40 zF3Z8jOoTnYk`rsmp3O<{4K#ua3k|k?6M4-et}WV-_R7CegvkGe&|_vCyaw9w*WjXSA5H(u0?Gk2++KmfT4X8B^=6)(Qb0D&5lJ z#C2E6nxl|9vvY|fMBKeO*Nn7osr-}e>nyj|2s;$sYj`YE6Nt;=FCS-~&1bb-+@Az) zA^Ek81ejq7UL3hF*b^j7;=t`(Z#cNyBtodz(cz8|fO)Vr2P@m6L|rk4*SNi8k12u& z%aZKLA{*&XgqQh%X(BfLwK6rGS@APL8*R1*_*T9nUE|x9|7|zMtn0Cx_>CJs;O& z-XD+0^?Y6ypKYI|n*oq0tJlJF7hhf^6z%OWi!4qHuL75u@IB8c!PQ8%J~njkc@BOE z((!AFVSe+`W<{CX4>JnS3_Uawn(1Mw0CO8=!|#rQ?KA9Z8x8F9kENv&3Wi-i6lZc0 zRxF94qcJ!x;05K5z(N{`IU@gs&=&|Eiz4ekFjn+6)>i${?_Vmah9&olz}-sBRXs75e7#p_i(Y!T$&@=oE)7u7Y1XdEN+Il+lj+p5|ShQNLcqx_qW<-X~7E zB4p82+R^Lu&#D9X_2eG0L9WLvPG=_}r<;AF#1&q0xU$X*zi(iE;UxKVZ+2o{T#X2y zXwc%aThs4qKnvc1%US2XHTLF$>PajEU*1-OLASb28a_FeSg9C@)a- zUnMpifb5WjrN-Fs@plG%r`vG&#m1HDV(^2U*t^_ekP)y)51#K%XoX)#;rak3KAU~6 zoK5!aTBF^MyV@mVx5*D*wZ!|2SzdMNapo(cUeO;IYL#%E{L0zqN1#hjv;&6`>#y+i zCn2Jkku%mTX3Q;YEq`!`zF?-;0XmyQb|wFiDdwxfIXc+It_3+b7oVuohtln2h7OPn zH}-aN56|_IuQg^&y}NjUri#kGJu^{INkFHqs(Ciw#2K_ZU%v22^bYO1d|}^Zx_76q z2PFs0?)-*wK3HnXN9RCp_Ptk>WIsKr3uv1aqozF)>jkm!eSk+IU)pZabKpy>{*_?Q z(is!6KE>}O?BqNFTsrvs_Bh-MZ>b-ZQm7%E@qP_ z=1o?ea=5VHbv-wa>L=Zx*glK7RrUeqJjxmQ$X7*xC})ruOW`OU*i+zrbS5?l`}YyWygM0$XAHX!FEgFrH!j0V#4nN;LI+@YcNips zJO3nt(8Lt~bnBMMm4m|kkP#M@Jjdm>C9*LZ?vXTiHgTo{fa9Cp3r<=oXSzHdSO5D9 z%MHdi$#RL~WWS%_+CLmKi-aE8?A{E9f@P-*;RVF%EYRQ7U;1qj+>}CpzDU;mdwbHW z;O+FSX|H1(+D(y0XL8TZP;$q)n7a_VoOG>NEAGhOcKv#KpjpO$} zU5#v&j;a+cY0G>RD=MIt_f>4lErzKyFZ)Z)YR3B0Mp3A=#O5y1oB%TsLl}(g?U%gs;={^bglqEn(a%&Tzqa~ zyB%QJ!{M~>;!8QKgF(}*2Z9ZXcc@Ol#>U`M0l+Kw?s8|L&hF>Ek4G9_16qIm`dKd5 z3_^T8&g_O=PaBP(i?Du100aLO;r2y*R}pxN#+F>so7ue55IRMZ$68wCR=*EP$X&f! z2~+Oq;-vlqWcJM4^*zJotA11KYjM4 zkJn)TT!LqE79Z#NmiSHWmC+B)zVi0SlkHhA0O-v^5>oF7{S|qITMKm%CU5+$H^u23 z?b*fsYho;LGRA|EGvpuFeY@Q>gNL70Tw>+Cxc)tr$sNk}(JuTyAg$_JtE1!OS!KT! zH*&G$sTHK7_bTxexI6i-*C6N}csQ$5te4^dnJ_p{9queGuZCw+3#^pzH_4*MBC8Xw zIB20}Yof9ucKIj>u(NAHLP3!=Hc_DduAvZk{xOU^PBHi&MX5*PUyfg%A!{@%=!&-` zzLm`s{Ye`k`dewi^(6hS*sA>4lU@9rT4&_?e}Y4bUn_iV{V!Dza`FwVu%F}UfsM3{ zj7*Z5jw&ph>AsiD!=_-`BMl69)ijhX2FS=qEf4w$fteZ{X}wVm;*f1gLxmM^Unsv- z`fpH=OYnNkKFMBq|1I9Wqh2yN>aCx@!lAo;bn*ucOJpL}qWX^ER~W0*^A0~K4*7TN z%(vyhUH#aOEWWJGxjI;IKh4KEr+d zM~=is%wO<#Ik_|A^x$x4K_|q^4<@cCkA)wh0yZ7@IP083!?HtY=%-Id+gv#!nO+1X zru``(6*S!Y%soJC5Q4>o}@|7lsztU)_{Pi zAT8tqM+~b!Z?lsI0tgsiO68jQi{E3x|CIHv7RJ@M>EGsUELH*aH7=25oMls{TwHA6 z78wfk#}O`z@{f@J3ur{vz66>_+zc0Kt`O~8i)|PB+M7y>>B$TjZ68cNJG2@tIV4PbM#jPm;EE_zmi9jhSo6Ai@;|RSK9Q!;6>QN0i2sC!Rv zh7`%zvM0t-6m=KuetduzR>Wy;rv2IWO-AN%63i{;^)}B}N{-QZ9se;k{6FP?ZHGdb zSMj2J`M1S}Fi9vJL-owOyZh$X{!g#29{G`)U|9xI{*j}$67Oo{Yi)l3K#e2Q?AzJ| zPNYFDHfs-m3BQxpVSiUGsnXyiuK~sUt14GKy^$2N0 z`DpgJ^opdDwjsQD^HXLc3nCN$Yp172c_QSDN(FMqj4r-lNQGjNX3^IZOna*(UR+}J zwKLC!RzPEBVxGBKA!NjmTNMA!a!NacdL5ATOG35K&Ulv%UBf)ST|>Ihsy69%#pkzE zvHs9~7!6U>UH7=|I6o6=@(H5wE_z{L4mfadt9G}wv z&06^x*c}fYm6!Otu-(J2@brfB+S?unf9DG|VoAUj-Jd~t z26qzC?n~^djfF@S)%r~=GOG^2%dYG3&@p+c>^0C{=bbzE(bIZhF#$mB0sVnzjL)4c z7Hcwc60W{@;r`}Y;*tH4dp+w6XaEcAEjh%N`S%5)s0`(~s&>LB=Oij#MY}C64k!&z z-;~z4@YxboOLElkKOotI45x6fb_K(AN86?y>OxRgJw<2#za;=`@J;%73;0L?XwI+y zeA_Sjc|y8*1QkS}K|x8ki)l?m17F_}_!snXD#zSHP!Axb@?*thLF8Gv^z=1Q6L#!0Dc!iLah-yz_&V{JC~-= zk_MR53D*k6jLMI=^J%}fBTb68-w{X$_`!D9zvQ~(@5k?V$o#ENeG~LA{_6-R5vpY2 zM5ELmgWuOjX^L~bw1n_~ep+fob10t49*Pl-93ZYr0fWoi>vjrVI))$O=~#SbexW>2 zuTSoL3DdEfXncsrXM4z^pnUMnWawDc0@OFudB^Zp>M0OBBiDl`tU;HHbiU`4BxpAs z1Q)3u?A{0t5_%ui?S`OUxA$Byb4-)}NS^%K+BLpE4Q>SG5Vrxq3>v&lVcd#7kU|g{(K<02y3o3q{I}uA>g91O|Pf zhy6#szf&YY@5LK%(v2>ENEg7wTkWCF>gygmIbQZk+%&eTcrEzf#WNpXzaIZ9 z1H=t^L)q;IXKzrw>pOXvKP;a~->_^=_v1?o>f2qdOkLSB4=Jdxfs<$@t9x1b-h39d zyipWNzGAR9LwoW4d7(@9SM?w4uLr|Osq}@!9P;z3{0RUi)VKRIp$%hPD|c`xhUt)- z;~+(J;+MXMxU&J4HyN#)9F2t^NwchVY2xdr{%u~=DIRkE^AaMNV&+EQ3wEErMzU@d zD>~4X%_l7ZeW^T1k8(eW)1dkt>cyFMLDeGO-uvMPXsOkN4MCW%dmNEuvv;&`8sAvv zn)P%WFLgmi19RrWTc(d?vONH=0rW^+3Ue=Bub36z{#0=K{XeUrnGoDjPqTurs3c$g z$@FbhEuGi$D=O%^yYSD@kvT1>J$7XmKUvESKDu9|$kI?q%>7?+#b$Kq*{Po35iJ%qrv?0`~+rzZ8<7|LI$we9NI8S>#aMcc; zewWFec2r_X=Hq_oNEY|itkY#)g?ue1Oh`X81*D%J@d;VT>|E=N?{c1p2 z3l?3^aRL?=SLX{ab%i}=a(x4HK$Cz?l`1@qiTrJMS7X?sXtu**&1|Q1vE}LSPTDoX z*|H3-npriO=koqe z`1TQ~ywZb*)EXQikLR=iW!2Bi?a=3(i#QmB>o>YrBDa#0_s9#{T}*ElVWzr*DJV%w zH^17my(^Zg0NM*@1{?v2{jd!K;(m$RiYj%v;APQ93Pqjp-tZ@(u_Nr=+rpp%6?gjdO?f8o0wfN zta&%ukw3k`HEGyoH_Pt(S9a)UO_^6M+X52#u~IT$N2}Y}+nLF9QO{FaRHh{j8eD=N zVG!{H$B3=epp=qY1VT;Q!7S&oUq=MD_X4z@Dg5ji{zi6ZPL<2W37eg3><(Hx|9)?q zIt-?TV>w))2yM%Qo}Jo`Q!4To(gD!dIhCZ;W~9&Q5Z)!bE`H39y_!8KW16Qjc(2gX zR5P~OesrQBqIm`?yt0Q_Bef?jG@er|1_Jayx%cMP^HPINu{I)xd_WTH7kc#B@E04n za_{Ul$P1X$T+>{I7j4-Gj%{#dODPqwjJk@dYS}k(5nK86RHyT%W;5i@w6Grr^-Rr{ z?MvJQ(u#3>O8akv?nVjPu|o;Z+u>e)d1?RGl)v61j)LDrer};@A!SzHGZNJ<8y6k| zM-2CTiB7dgy_F(Y>fznLQz4H;UKgAyVDVcQ!f@*)H>O=wh;5`zw<~iJ7$<0=V4X!`U!DUui~fabqkb%??VUwrB9>1HZCiH#)+5 zD=g7d*MdcROP~?nJ0eKU?6w|nZC;re4 z{%1Zey4(ddbafq|s<_Xqm?Vmd8rN5g+tc_G6=jR#QTAMYEO(XJ*_ zvzYpV;=Vq&Wyj&#yeacVrW&1Hw4<^9(4_L^p3+>L@LUYN2wRKJBW<$AyJXko$A07R zc5nBB{JYl=wl=YuijcnsV;rAw6tpgNfTA^5A}OXLd7pKa{it z3q%RgKVD^}*|&j6-LElkY=j5&^bpz)sPRq3K0X#5Gplst8C2ubhvpZT{|yi=6a{Fm zHP^+_cDBI_|JUd14c{nTZkV>IRJPZ3f4TyFBBW5>m)dO3p%f6h#Gb!`oqt=2wtj1q zobpIiLXAh%dW+ijo-q;JV$|QozUR^gZRr5E`#>{c=mdnas6(rw4aHpeDq`CwUKFz_O*EzaJ7(>adr}J{K~)sw-D_7QW@$}`Bd6&T!s-B zc2U6T8kEx{qu~W;5kZj<2X(Vz*uod(poO#!$2qfnH6w8OXLmU9XW59f_M#2#zVPZA z?88~e&AE4P(e$Mlv^xlP=|ROI%{UfyrJ&b$_PZI9ICMi%!9KV%U}`Rk^X5_;)H_j9 zuha#6E5zU8x_GDgm zg!Mwg5dU7(N}tnr3x3yRC#G?4z%ipfCtp4$V3Ma?gc^5f;QKYF8(7+nmia`8lwy$e z(Sj;K^#RrKeW=Km-a%%w>!44VMKm9wF!xqYVhYqv9(ab$L#6Tve@+F!nD}?OVX1Xa zIMrj9+R#p#`A}EM2}{|JQ0eidVugw>JvhdbYR%A0B5!SIz7T*aoO}eQkKyO&4LhKI z69-@TA9MuiM=iC7Sc;qH?`snw>NQ@9N1Y*L3 z8bIsmcCM1I-|-_~dqA@#Ag7?#QO_LK@C+!t@s7|2CI>+|=hwi~Y4pw!cCnr$wFTTy z!gd}Bw2kKI;cUfY2Hs*gY>TJn?*=!4@$B{&YKduoszgq04yZP=Kp%j5;Qxu^85v!p z=BHriKrP$cd$`HTvhwbKI5MTBVmN{R0`)A^ z9s_R`wKyYMSUa+R>d4NANs)Z1v2DZPQY3mRsL3<;zWy8=$sM^nZy-|URR#eRzys0v~x((NS ztWS$&((|CgRZ3!n@fM3L-%{(gSiIBYZSYpDR?xL$l+t>tmEJ?IF*1r^+WX?FvN8_} zh0`5Iv6ZM|R4RSxBt^{gy*pC?|F_u}(Or$?Llv8VbI-kPOY#px(}~07>qK3H{NNobt3XD2$fmNXd9jPey9 zMrC3Mf)HxuR~?{k)X>R@dTJBIyvKW(M|O~Ru=w^QHFdp&0+056_jQl!iRw=E9N(?l zKfo?%#CdhG5-x7qtCDmBjM}}LE8_PG7NO0WZ%L@}ZU#iaF(3@_2G#IqMIR@&y?AZC zwr1DeKO*}v7xS$8rh>IDMjHKANAi}hn^1AeKDMy zek+bR-8^;(eYD7haYtO4i1l2D`a;Va!6cmBU`Xy_xrN6A$z+IYt!pV~Xkmjcke;gVSfTT{+ zd}@U~Rj}1pucu*@f!(=mO)>M@ZgFi>ycuLK4_(g{X*I2xLSiZk{R-%yW-BnP6+T^T zoLamOffs5r41R6=Qd0U$UBpnE!&dh+R|)rOTVv^QRCn0XR*_e)46m5F!1my07Ts*2 zZhbAegpV_?8j_l7)J^Ta#rk``JIsMIy)Nu_caqwyd+mq4i|ZhT$2L~$G#t3GemoPr zH@Mo3A5yItLFTRNZS@x_P9WyEto!gdP54)xPLl{5)Jhj+z_~A1QSC3#^xoifbywy$ zHtb`=?!h0%t17wWOB}`mj&Fo%*%(q!;Gn~BO&3iPIo5QJGw;cNi+#QbW-1M4*$n1! zEj{@m)-#zbjLIj_L#_meAK94g_LkeqdJ62+uvZgVWjnU%O}RK}1pOh({p98bAu@6A zf<>{Z+fl`mpX?Mln%SpXGqEL)7%0b!@X7N3xoO_q$~`+@oSy}R-o^G zpzD8FQPzW>iS%m@7t6YWt<t!>yot!3N}pUG9nEq|&>00bX+Gi61zmG9(hzMRX4i z9(4GBTk5}=+YQ*AO+ztRDP9XpU$(9oaqvJ}S+Psv5lM8JR>QLzG)bJemC8Sq-^jiv zSuwI$yehT9b+U^jT5jY5E${q(Dx_Y+XuVQBbM7sVe2MLB*rsay&-9B(Gt$2t%*Gf= zZc+Z6(I_frf}isbG46?5W~a$rT%Vn&zRs3YH8Gl@)+;@cIMq$oY!NEeq|1t3#Yj!; zP0AY8bVc}r1*p|0V3J<>^KUd=-9=8aFaA8|e;45}Cf{9P$D$wk)66YJ5#93ik$K7W zlgmXLALY}1z2!N~@SN-LoVJv8GOk?A?t3%YyZU}}%`UPe9zDy&m-BC$gG!1f-mzi? zS2e@Exr9X0`R(G*azjq?>i@*KYOXJNCtFPYDtAHwzvZcoE=OsOTB8T(-TGdDEo$d2 z6zdjky)u)eTArDtdI~Ge1;U<3#+ntOZ_y3J^`)WZ^&Q;!lo^>K^JGsx#bR-8bVi*I zaV7U6lFaYR96ImM56l(l^wzHkQKKPnm0mkeGGD*dpTsq|h4RKH>|=Xz?W%k)!G@e? z8!**D1Agx(K_`R3`Z`c8Bl14<7k534yajK+<`SBibj{U)Nj&m8gqAnp zxld!=vHl=+!l3>QTx>o(W7kG?^?#o+Nu4tQX33L%qvOdnOaU0YDa~TP2&_$p=L}5N zY5YHr8;bls;@8Xwo1%e^(i538%dxkk+=iReH|@LMc?+YTfjA7Jie2hP)wAz;U>tiF z7nZ7hfUQk5D5Fm2j@&x)(PWET7R7_3iK!PrC?dn9E|3y4-R)U=69YH8x|iq7)_Z_3 zXo+D9--dcqg{*-T?(7@Ot05Tur4Md)JgF8~t54FYEYfgT-$?-D{)fmHmWYG6lw%}g zpsKC53#CcwD<&jvs%q_4gUb&&dDQ-Y$;;sWNbU;?pM@+id zs^8-OZh2a}j@xWfF8GuRKDHyL*QFe%&0G)8U|n7Qg_O z4Dvyq zm)S_MO`Q~{+Cpu2v_eS$(r5Gcqa|yhe+G)Jlq-NA$N$8HyUCv?TSO??zc4QbRsaDv z15|ijgcpRfr&-n?xmuY{OvaokqID;UR`q`fGm&EDAQSHF}282&if-%pA84` z#GRx)l0P`xh)=WX0^O#S*L77}_2iQOh?v`&^rpI9zP#zYOOIPG`gZ-XzKjKL^^65; zOfE+`*;+*z))nFZCYPP0yjWd=Fwlmp?HrOWS$d7}_DT5loo*UeW{!{!rXV%=OOM-t zh74e;`d)8>0x=d_h`2oHps;G1>v8=^%QWJtNmpx)48&J-*&N+;%eq0!fjUGkvq;9Z zA4%&Xkyp+6cH3gM&XVwQQyPLK|Nrg_xSp{;CajK^0NXubk^BX`t4y(Qn=83qiSP*WpzbMdb4cB1hl#cqH$(2s7BUZDrnm0Zz{fkLET^xJ z^iy5?f%7*|NUd%kiX6lFIO}w)Zgd>ng|{ftOM=U!VJqL;=fu-tBFhnaC~Td5i_G&a zp$k{lIf-P7$qJGDC1i^djG`#90B)q+5PZ+{0R1XY(@ z{I;|6JE5@Kvablj`;N97mRM#?Uzga<==xjk9QzMlgXT?_5G%f^3jGJ)N*f${t05f| z>1x9ttZH}`F`_rp)dl~BCnRekd56cQ28rG$sr*T`6muz&RjZdLCI*8R@6cib_44}S z%zt8JkWpB9kFS7w2QQ`~FkdMP=?ui&ZBh+73{K3rIfL6hPT1G0HLXnwXn2Z%2ny^} zFGPX>J?ZE^HSvx<|EiU-6Ag8uc}HZ}cu6d81PW?#(f$C7j@<{0hhk^N6erxI%(_!j5&M`(w3X%fnB)XcW4VBuEV1bxJiSete3~>CQq`&*huX zKB61aygu~!wT2W($FSiGxNdauZ8Ql>Pi^6h-a<*2*F6=t-*TN*3G)+u7-juF5l${b z!SaNUJoCwZjSigHBG9B()uiM1(jrV1B{DLd2J=!1_SZ@49NrB#^as~C^CwLAuLKSI zgw}y5FTP-Ruk!I?=%3LR1Du8>2s<%V;a3ft5-rcj%qYXqlGR4wP_VT5&RHkt&eVlS7qH zf9CTMj2<*FigaeCJKJPGJ{A*ET3&ZRp+mDSx`SG?w}56j0SHnnqAmYe{c4k0^%0xQ zBFiB5NVRO@wNbtJ7BUxi@;A%L6qx?LeJnY?wxF=dtfk!~5qX&^mi=0;(T}ze zfn#tTda*@O%e6)ac2qh9*xAo@iAjpE`fa4aziCL?xc|Tb104U}V&aIpkw%{z_r~*X;#D8?TFq6!uPz?l}k#9Gc_cBy+jIr3~We+c^&z1^?XGd}^ z&S^8*b_5yuhSnjI-6-6a8Zm9!QK^o=5+R8dFC-l!E3|w|T>`!<2inzrkI{2tP&$SK zU-07{dMLWKm|tlL&&ot>JOdTjHMY+|phW(lXX;}~Kf-dL)P_DqY$Kg!N{GIvQqlXK zQ4(|1XOcrIZY{>F9iG=V5m=v{%>C4s17F2d_Vhl!ASLa2K>{049~e@0tB)8Tci|T4 zev-=dr=RyLBV1S~{=xoDSCi{V64FwfslM1kY>9B|jUaV+ru&G@R4s!LoFfC0uSw>U zdb~+DH;L{5-Wxayd>_5oK_Q|-iC2n{C3?Pl1JhW2tiWEOKT zQ44->Uur>TvI6Xi8A1`~B36G_V5FfNh80aW;69mX#qG7aTfgm87{**WtMq{nU-D-w z5R;cK-*6Beis=v4aE*(rH({Gfz`MWSo4BgGf6nPN4Kz;68wCTk(d;?^Kl^)mcYEE#p6>wyhjn) z4NR%Lh7823wIW5-GAv>XMS6B@81IXky#CNcMlFGMJg#3+uO8;yZ!gSo92Y_!%cWh^ zFMM~U6#9GGhZG@3aMKEh9{YP?2CkYzTG&UD_put?3*NMlaDJ$G?R4Mi75^#!mk>N9^?nb`n)nr^d1SoIe9 z*CIwZqlO0(J%o7YsjrW24ZqfTr=oVCtI^SFt<1sqTPm!T1tS?v zsA)xVlu>ywjFn%C3qRHs^kG)N&+JSNgwK12-V!-|LdA}t+Da~OuqrJCSP8;g&J)jS zDHV@4>v&F_meXCX?+nuu*oh-SY@3W-CYlF4Fa$tMDugm&fCQS%+ z7j_oMnGY3fX7I|AJyY~*nL`b{{trGv zYOUxEpYcZ*o_+{H`pY#k1+d~22D_u2V-JF=umXZvnKXc~9Dx{!uJ9+M2&t^J$EV$S zL7z9=vP{mBE7;yG9`8SSkvHbde;CjnZcTc8YfOm-0v5muZ1HG{+%nSoBHnhh{)mc+?g`)PN8ifxDU@ zUpq&2!ep4m4c;!?545Nhl|!iWvstriNvO_+VWmbvADWDX%`0I)_Hn?kYf+}^WrSIO z2zgQ)8Dj2n5`hBz;FGzuy8@m8Z^JEJR9N{Y1{+s~?x;L0hcQU7^H%2QIH7(yuzTa~ z5~@1SiOWNofo}35r}Yc-DR;0%l4jQ1GP47+wN*VKBsIp~rDUU*(ZWsg$R$V2Ip`H; z)BjubE4Uc~00-!qz;Ni_ z4SbUOX$#eDZVW!r5IMkvU7KcsSYxo9UN-$q!g-h(u$F|#8$Wa~?y84_QhUXWzcFEE z<+a4E6MH|u16F{(`XRuIE_adysV@P&0E?trwY-L4jA-GsOoQxD=3)l;X&D>~2*ER> z{d;>q46~9v8Ewex<|IP9FHO=u$<9=%{l8lqUW1IFPqK1NRs$RhD8(VRNWh9>f`{<( z>uMoES7BU3ke6%ilgQ&b=m&y#mt`N}O_-j)_)_*gigHczZlhDjcB5nmU8SB|oaC|V z503+IaAEYZxI28pBv!ukB&0_6osF7zN^t2j-&m`0J^rKLSl{?7f!6UOUw9_sWvEns zi_e@qTT{V%&s*(0|9z5@Xi4C%c&njQ*dB0C@h~IyAfTk=%4Uk;PClW96b@pG{;M2E z(--Xydmm;v@lNUBh&S`Nd`#6PvNDK#hc$Mg<7r9-LANiTce?Fx6Cm~FaKjS?&F9}A z9&fmQ1g}(hxMHvz;(4OwhFHm@NeM~+wd8*#RURG(J_p%R$LG1601p<`fj5v%{StQb zfS7LuQ0x5jmVmvwga~Uq!*xp{djbQ!)U7wStQ{TG55dQO$lUcW-!v)HTv(X8!IaA0 zlv8q)d1Nr??(-=f*)At0%LcbI5beN49!|HA?&zD|vjMOAB}nR(dl$s@bS)b6_QY7d z^z1F6%*jWa#e9b2#Mn$f|{{R!Z2KI_QMa%#kHV%ex&B&?S92okKUe9D1ush`!&9Yn!@1ONRI zxh{%e9n&jg5h*3!AhHdQ?XG;11TjLD_xJ!a{o1l2XdK7iJBHLWL5NXCh<`s!p=mv@ zOE=J06fpYJP0nrcJXkR6#uB1vwovimUOI3KJu1M<>+WmHjwW;7Nu5CWa?Dx8hO|!& zJN_MrSaoBm_E$oR3<Se;Rixv;&Pe3*q6{0= zEHxEDG?^twzP?N&m^Ox|0`zcaRvGw<45eNUz zfK7({A1-aO0)F^Es8WEPM9g`g${w6oYYewp?S|m(1=Ue0k<tAO-KX&>hJ+cx;wA5SU|xl>%Z zX>z;A<8r6d%VK~d<=H3hi z!#<>_;Zj;~*c=LVFGHjU5F+OO43j|l%zox`vbn=|PVMx?YE~V8z_}hMiW$} zC9_+6#@kZ8bov6;;XNbh%_>23CLmoWKomiXY_{0Z(cT4y1l=STYe3b4d-Qce8sAgM+eXFLy0}FVTn{9{$UJ z@)KU?3Xk@Y3aEQOUDN8@l%qVU_UtZu%p|eVu{{8?57`c;kKvgZn<;0ARD@~QAJ@XV;0N3)GJUla*Zvhne-~$A=ZBsD( zL`TqHo5#2HdFVGMc0h7?T;sX_%jnoq=cH)in|fRsA=ydQ>MeX*G%iC*5+Q+M)H zfU|ow{G=Sdx5R3}g9tri$=Z{ZgNs1mF8JyaS?S5&XXrE*ASKPGJm7hu4RV-uNQ*Q5 z*bZvgX@ZtDko7_lDFk-mLP-`yU47#bssenga6_p5_L~2?5+7TK=(pGGB zpp8&IIf&_MfXY-T*9{zf$b8!YIAa`#<(;$N{T1%r86eE7!!Ih#K0}q^&}NG{_XjDX z5eSDW5>$j{q;=e8-fyNZ*_ieGZtN}B+gD6H1qLp;p6p1Ar9-P?$VP*812p&hP;7p$ zrN6rh`fkK;;h@ZnYkt53&|Nt=u>^3KP$pVWvanhV&-L{xOK=`LkXtTi zIh}A3L4Q<66*aGfMwy(p`H_vyLH#}?|ExROWY1&B&=*kga15x1L}R@Yup3pbT_&l%PNn<+99 zVx;%ED&+K`IPb{M8UMo~I8^LW+2Eb*7Bgx{LyaLEjx9KEyv)G^Ucx4G_Z=F3(ca20 z3k61so`!sKF4QrA#T-t*L$k3{q(7LHVf4S3xoJ}ChQGdE#Dk6+^kPss{Rup=)I$YK zaJYmpWqhU&O4mQUFJ?fdgxUcGJQzRsRsM^XkFNhIA+ke_^+Qaz|I3irU)t+6sqzwY z$s#pctjhU&OM#2g^#E349I}DD`_p&MrW=dCch{$c8phx2*0Mw#@4;C;U5sW~YG_WS zGQI!q$&V*r_B%bMyv@9OFk6=^&HIhjH*PKl-_EO_^6OdOD-$vnD3!gV1Uo)2}uSncC+aDn~U!xtBl@p)pm zg{uC!$?<}*r)li^&u#OIvmaC}DJ|v~8)w~sICq+yU;0ylD;#YKE4dlH@2#hW9tQ38 z--Qay5e{c2#OT9y1S#gb!ldssXZi%zd}x&>^d1>#BIuO=A`s79{27@w$vZmZ4Xs zW$^bE`CDn+S=JpUEPY^SLLA9mt$t>_+A<~GbgjeRfjf0RV~JC(GI6cMr*Vy_DsL|5;=MYwsGK{-slKZj? ze+*DrIO|BjnG@?1k-5_*kT_`)G|1CvHRTVSeECEF%I5^@45Onyu9iFZ!`=OixgUsk z{pO1(mnVTIEoygb<1MCq^8-#QIcADAJ&2tCGbLHe1HTPCLYAxgEKHM~Q1dP1v?s?x zbRaqLm4YCOJ>oRw#k1DmBgFzUdimKznY%KWXo;C8g2ST7HW}wmVqBWctCQ6Jusc-7 z%(c8ybERHab7`pRGUuV~=uv0yH+?le6f+*!xRwNSHQy8~HcG%ciioDT(NmjFS+|;- zpI2f)CoL_PE}K`Fmb!R(_OQs(V=Q(tk2DdQ2l#tv7{E(5-(>V94u1=}(RfrC%>tME z=~pCXoqDa2!%Hicbvn4hTyi#1*(3LNU95D*6vuZ&znoIWlnap9z;?#_>P!d7^i8rx zj*25T5B%r)6_Nx)R2`IU2d9cMe%Q2Ugg5w6hwt{^g|*9Qk@Bt*o2Wss$;P5pMkjC} z9fxLa>=|e-l^5rc?O@kg8aw`T(r&{$PRB6z;Ld|JaR|U4+)bWR`B;w#Jv`u{*J7!m z-N>~Z&6co#fPZ#_(Q)@!HyISC7sBCLv@||ued9Y~ZK+=#i2bF99{Y;AhUDy(P2Be; zkR+Yc+|O*MjMRjyIxjybP}U7Qr1|CB$!FZLjT;j=$Jw0qE-p60SNJ3+6J4sT8Or3ziX_5-DrE8`(%cUs8I1@b1=mQ04b&0;v6X9>=>9W`6`JaroJSGxJd_t z93O(`5O|Ay1~6_#?iCXsQcUWn4ZE;yj4)hxFNyK}4!qsY3G2(JS{SbYMB=yLyk<(aSPNDPu?TD6TOpAB>z(KjHyeChGy(R=V8f!$$?|DkRGx^$^XHgoj&aWEPc6==7E zsq3tp@19e8G(q0!*Lk~sXJmt`q}r(Lm9i^sI#Kc4H*Fdnr~E1Fw83PNQ$}}*`=0_= z;M-8F-Dv(9IoQER8-?z(H z16>xc+}~U>I*$3zMXtG)y(ncUiAIC#PTW;}3H>GcPWVD>Kt{MHOH_?LySF5xb4lr+ z5oCrDn*wy-o^q$BN&UlwD@8p-6#Y5;I@5-HefyRTp8mUwqW+s@o@ge$@Agf~ACf3% zR|K!e>yl#eDX;0bF>(VZiWCo_rI!i^QTZr2z7cEs-ni4~h<%zLQ!M2s=XR4g_fGtq zr3QnH+1evpYUh8C)6-HO#)d0{N59xGMp18YbL<4pvVcUr*B0toa}v+l@Mp;h@aGfn zBDSv&z7AFuUd$u#T{Bx>W-z-@S{LTTE}qR}rQxt_ETC%i@qh1DpXvaw|DhD!GlUqa zayKLnMZBh93N$6UN_jUA*Cu;c%08-1Bcq=^E@$G%d&bR35t%a?xy1J>!evkCntG;X z^T7hOT^qd`-RC4VQx~_143pHV4Bk0>W?{F)dEV1!VW|7|;~a+)zRs>Zvh4^s8Pqky zuqkf26I;YB0r9~%nq61V^}(;&9Ym$}6?1*>j<={eVN$gdC7kHeeNHkx z^`oOX9Dy&hir1+IzlkE0`*u^9YJ+NCm%^*qTF~HTiA^U`y6s8V2X>6t4iL?#Q6^Bj zEewSG%gOaqUcOzMWVU`rDH?^YSNFF_Nw+ckCq=#Aq!|6k*W`ET&s4d3eajG!DjwPH z5!%8gS`x7l!=pJx{K2g&nLLT#8N1JB!q-bImLKti?<+pA!J^!Fi1mI9F8ZJH!1gg$ zhDON+kr?a5+8pfLeU-z&2w@l#q6v1FV(ZU`mJ;VR3Cx#}CQYcbZ{)!4r?!y0k7LEL z>k-eoy(dcm&E?epvP5Zou*f5kxRo;@6Y6w!V`*$c2+=|O{tqd)yN@4WL%lu?1EWlO z+2dUq>YK_Ff}Lh>Dn8rv%2>N|a16_p;*RHCtznMJYv(!2ik8Ft6QBr1J$q-irXu?P zv-@(3p(>?okL<<$bZc=Y$6jG#>e4p_w?ic>Re?VmIYm{@>2$RfFMTc0X|q)jqncpr zbU_s{GO{<~U>tdoH>>Lp;p-7Z!T53ZROmRHfl!zP=qI+aIH^4B8F!Gfxu0J6RYK6b z+gmu@6G;3q89m*iA6UEGHV^-lr4=|7Mj}ERF!asR05Q2K60*n8(@++**snA)vEh?#*-3=jF7R z!J2qv5tqP|4&E_6C8P|#tGqbp5emDdPgOEYo6t8EfgGij?q=7j7@8&cxv{^R`i@0H_%IAZ+LL_kgi%BJK;KHi z+q8xSnWx_JF~WpYBmKc~!9D?O6@tNl7{Enk@&I~8PzQUuX2_L=XMe0`ot#Ts$)UuL zQy0^UG)xtYu9!zlJo_~$(=dzw@m|NV1*?An3_xONx~XGtI2U^B0t#nmIRL(C*^5*e zB}~3DfY03l;j{x=S=cQS>*gr05U*l0GZ>>FHhu(4D9=_>S!ih67Xh@@=Zrmo38Fb3 zoFK%TOrE@}>o6jYYF*L`m^RU#Rbx?#62_uv@}7=>a>#hXqXG7Ph(n8xPz~Q(tYj}z zaGVkT_J@>pX?9>o#haFy$4XewU>(*t`$0YqwgPQ1g&!I3v72>o`WLw{H(ksam+QI8 z@n`%`Y$+XB@?rV~xUxAO5JOO8-0cM9SmM{;_ecR~S;HB7N+<*%H+ZOZ9w)5xSO^oj z|Fe-0R{0o2FIh{NIRp_SgnuzxGAvV{iZo~oap4=ibCVhSRr0Mg)LV~mLi~vPx2{Fz z5Q_pf*t9|7CoKpUWu=(9&?v1dUUmIoD+hKIC0UC=8$UpiT6PqF6cb+InS4T6u+dp8 z;CUb=GBA?Tp;7~rj?6LSat7BK;!Zn^t^V2i>f7&k`8s$OPl7x!T(PTHFr#tJn=O{?l!G4Arz#3WhWpL1t`8~W zD?ink&kSL|Fbjo%1nU5-t!?)zP2bwj2P>}(ZO2w3SMrju67XSM{0!$wFoVAoTnB>Q z#z;InjWMOaQ&ZS(+$WH~`<=D`ndW;r*)vqQk$vDzVq7>X?loZ1+?^&I{2*j#*X@T= zIahg`j-AUO%lfix3C~X}!$=O5<)p4oGm-$hXFr4X3fzn7iY66t@FFcB&v| z1D{5mOT6z3V9CH}bc64;C)TAVilnB?@GNap$8~r+=95xR10w#Q$SxG3m80^-Wqjj7OyngRs`5)jt;h4%B zy=N$?eHq>IjtrAroQ=%dJiSTB{V1JW^lMP>*SU_P?Uam`xwnd}$RaXN>a6MlG*Q#y zglq=F?z)lMGUu4w;Juq(IC>8foqF8&qzBuQkJY2Ms^Kcll0nMY=KWv99J#ES#!C*1 zpzLhP!N}vT3K}n$UwOGGOXw@VOyys_C(w7uL_g#!42s)U^|gOVXV>uYyx;ag4PSMc zE_gGCI0SaI+~vIynG7t^k9 zZ1{z$p#%nHx=)~Iz2Ca`H!cTWnZ9o@u>BpQv5fxOo&oH{)Y4kVMc2j5K1ZwTW#7{5 zC&hTQsk)p`d$-jyH3~&YOuc53I#YeH|0d{EFUP~HYLU1)zT zHy0a3U3#0<%VRsMg@tcZK8MoHJj24>*;!YSS)7gS#q;w?=HDBzq^x8H85a_ozt9N@ zXdf1`!r<6B)~<})@fGzx4a@@LP9NH_E2!(k_?xk3+&{rwOIMqV+5NlPUS$-g9*QO! zuj<3Bx&-6;z&^5}w(^YfUySlU+I7nubn417K2HBoCrgvR0C3bqU-@aPh4IqgIeP!WPlCvHTHMEdTsr2PN+mH%Qlz}{ zw@2m}MbB>Vs>v30dk*9fl}@#mi1~LBS+8T*lw8qSmUe>UfR>prG)csw%3g%XxGYx6 z(5>8HmRemADz$_(bXKLalPb|pBYy5XFsDfAD9}=BDWlO9pX=mYHZ%eIi3F{gxIGvB z!^`*X+4Udj^sbZ3=8)fYJoCPSy;iK7Eq9kE!C|4G>7o)y1-KH0m9@s(E2vvSeD57l%i_8Y90DUA3vj?zFAl z`!n9YKNS7;DN<^(kmkJ8{`J?(y;!BDbPqPrRe?;dQ<1Z4?$Ucvk?4O_sk4PLai66U z7USf6@0LG5+%=u&MIY;1>wO|fu#l76RXP;ypsmfQ^>JBVwEZ0Jfq;5|R^zuEY{ z-}kNmf3L-Q)+6Vz@0hvfnrmk7yV0M?dNs%q!~UL^_t)aw6L1SMn&3Yn-vfUPO8TE2 zXAhL}KiAlQajqc%enb(VXaNwou`#{2-rZNcF1k4#mYi)hy~NJ<=pe2*FtS)O9NO1>|5CXQhrTI6faM;c6^0l@1_x{iFcf6O~qWT4kFt&uV8UIo} z?KQZGKNntd0w+SWGkHSn z_x;5ARMIf%@6zrcqE(_l-Rk|wR1I~8_r`53-;j@T&yT4Gt%f9n*Bf@ckfpl!>CG{B zwM*?0WP;{mh@X8fH$IPs!27QkAi=e@U6S(ivp){VJY)Hc>#h=LH&_Sya7WKRuo zO(wkm?6r`}afxU`#*oZxsd_)wDfY8&1v((uY6r z)jfpx10d*8)nT=o4`xrWK7YwNaQ+DMG^^%%$c{<(VcD=&m+NAv;TA#E)bD179jYdl zAl%t62)8V#$d>|g8BL!YdRg(P`!J!%eR}I;nwBE?&j7)V&4YD7G?gjDBRAEN1tGCW zC_0XmRI`cR`2lUk%ahkg>alA{{t?ldHG*S)@%C~>O7P#Uz4C%38{w^K$&3HutpX45 zx=5jeZw1_Q&f6C*d~M<3unN+{{E<-8wgAfDi<(*18s*QzP(EIEk+ zydxi-keeXL#HoiaNy@Kg2NaJ?aOmB-23@t_q)b7$=F;wEMUd!TCtr}MTy(^!#kS1)DCi~}*BP1w}z%6s7> zLu354x3c4k-*Lpq``N9){%VtqHJ4g*QvDK6bzoFRyWpX!l!!;~rzEsU*EdB2Eam*A z9E+>iwb-0Qr{3r;e=~or@zdU_kJ3MEmpZY%im8)Y_TVA9GVPcDC9`XOOd+Ni6M)zs zm?7ZnygOdmu$UGTTTy2BeDu6jv; zgo^`&$=fB5%DrWhLi%^!9<34ALpArD;_i<`>!&yzKxhpvKDE+HzGn)256)*fl z;-|^qI-7Eu^qhpdpVB@Co~e@U_4qR(YBnG4OkGB{K6(=QsH0PM3!jnesX`laYY22Z zmu_`BFcAIPUoRMdEtrD1ahFef*r7&=xMHoBfyO=m_CZGzWg29(-!3F&TXF3)bI8eX zS=vu(Gr-ZlI}?Tf;sxH#YweF=ADUUWVKqJGRN+<7fFWs%YM2QHM_49 z)KPoq`c5We<}vGb_fZP_hb5lH%kK9)HBR}cajQ8F{+!%%msVgMs^(8;AnrW@(g0(#>U^|DpzkWXCNU=MFk@9`aSxDg>rIhKc z%1`>wU_&dFE`8>Gg2Dd#=SP{Ot~XafBfj|TPsMM@_H{Fs+1@S)*nPb7w^|YbqvAt) zovQ0yeZ|bedI$H|%~kflYC^a=~ykkd;10)$YhggHsZA+4@~Dl{1w{&PKE^xV=I zzwX^(hr2``_ydio3WwJMK+#sh2UM7eOX=^>aQD*xj4gOkfu(bbK z`rWoVh`op1|4pI}pcKF)v>)>om7!kdFn*aY>l&dL ziG?2N`uvU|Fgm$?0mP6_!&|x#GJ9Lk@UC%xVaS8_;a^8FmJ+LcddDuy-xsA?0uEaO3cxFPZl zJ8vTE@OKQqDda4we1VUarW8yeREC)kEB^TvKcxDm?VCfryzagWE|r zZ!!3?6t6zCfZ-SoMLiaBY8?1@;pq+H)9#htwcpLMmZO5(2?INkcjL+v$zav&I!cxj zPJ(4$Eb6O~K9gLJ6rA3ei~syoz|wx|`5&4J)?>Sn8bjY{ux$pjdpydG6o0G;>w{hh(V_q|TyvvX$cAnUPDZ*GzA4b~Y8olTdbjs!TLqlgsktQ(%B@TSK+l zKX64az_MlS+cTE)MH<5KPemM=M+38-Kl_WX8F^_@c;L%sKPS~MA4v8yQ-;75C3-TF z)Os4L5ii({pl&(cQ@867+Q15*oQ|XE(xhfX1IFdz0`jt^PS1ozHspz#|S27bg|rR0Fv#)R^AtR2Ct1=5X~vqAhNEY?frKFkdkpX?C%QXr56j~y0<^-z&YmqUqKVOE&6v0w!To*mDgTx@Y|_f zt1BSk3bU$(U?QWFcDbRPw)ez>q*~UM8>r2$oQgGKc7Z2;Jv{Q~WtRn2O z*HOTyfvxR(Gp7mc%L0f)V2HPOsG>*Wn#zmUg`=IU(g|N^810g#q`9_!vD^QiN^fPA zxfgBxoYOvRl*Fk+lma;XgER2wNt4Q>c1}k^PLZ`24Y(qHvIyQgn}CCwjn~;-4xUYx zdwDt%KooN*$0(jhsXT{RXg6`3|J)|MGCBzsrmt#nZ~5&Y88gFw{;Ke~g8W%lr%s=g z4I_w%dpNF5kD2KX5m&5MD-r%@EXsbX)HSoK77=S!4){o?tl*0Jmu06rndRUI3hXG+N_B_u=B)ne$>Q6|Rfwj~$SD z%{jhN3VKsa&1GNK|6^91GJRgp<+4tG$EcqKSWJ~C%XL;4thjhrpVTkC;^dL7Kypb%_OE3{?<6Lis#(psH^)0Z5?g7uO3u*Y*5MN>ux9gjvfSF#Kd zamhDxURxz7b(Kl{u%IPO0CWrLlW(`hFKpnXFji?F<0d_Mq%bL((pOx1RNEcS!XovA zDrBVQq$mMtv13K?7UA}O|H>SU`h}n76 z%XE4FfanK&iKVB^?V%&4IdWj1qgVp!XUxJ9YnhGH=od=szpv4R9AkNC_NH|G2v7fu zLF54QW-#N}&Z?^@##AqjpDzv@6RMIo><88pJ|Lctg&4SY{kQN>1Lb^gBr1YB(ZvN- zQIHr_Zq%wn1h|GVH9r5ZFi?;yi6n2NmFXYr`h-uO8~gmt`U`TwN2vy%?};B%V0alV z1My?D^~0-~t|H_V%2zM`+oAfx|J|WcSA5^`-qUmq$;DlQUX=r!{hkgrEb$FbcCp{89h}+E>Hb(5#?>{R}jw+oUgM;4q0>1<^{g! z%d)?JWTEHDgkSl0t0=Ng{L#^r6Q3Y<^soL+aEi6#lGTUpNImFd;oPSbgG-CNN#h_VF6I}YLS6AZq2%JEA zJdd=w=?CF|X#)t8LIUGZl$_9bY#6`oiTcQ)kFn8sru7hxY}l!WAXs;5hDpFF$PWL| zlXRF8ti4^ns2B3*TDH zJl{4)@Vd+RHqZzv;gvw|@*zw+8U)VSa%=;k70+UP7 zkdiIr$8sM1wU}*HeW_-XXM&hxU&!K}>H@Jb=`e&QCx5xeR^-Y5gorlxY$PcoT zqTKDjm-b~N>vn2H$SkbORer0?*KW#7%>AN#_NNSi8~tdL4$KN)!jgRPM=#;x6KqtW zMb1u1OcZa`;W35pMs8H@QGCba!ywl2-yXkGw5Io1$7`lyst9}+daJ$>%a1B%xmM3T zXQXlGBBIAV4Nj=;ZvwRW9u{0cf|b{~c0C0tg(V_>ViTPf;yiA?V2y@K#i)!&;_9b> z2%w`XMl0t8r&ud!15Z3oe1e4IPm~AkL4J{CBwEuu9@|?AI8NQ0lo4KEJMIrK`js(G z!~mrmK;(qg{ao=K4|!$JwgCX_soC3;SPI*){}f?9OKUl$NWa4IBKIyH-dFLWT+6pO z9X_ny+u^kJu+&KF0t2zWCgNc`5mw;$4bU3Eo`1-_+vwnP7;@U{z0n=ktaZ1Ns{W=bqq^>-#&c&9i9XAGUX_3%c;fgM>5+Z4e4ai?>8iWuNtt?l8BL zO9~CE9V0Hi{mpT6JC9FlzrI5~`)=H7uuIj{0K9_bw4X0poZc_6qdGc7_#8{FnI~vj zjy6nq1f|cMZupM#F4zy4(m*QZ^%8>faloM^Z}GUhjF9bkO)$Yp=efijYje@n8lU}b z#P}NHPr^=wy!TpsLTrTAX{RM}k812zN8GOCpd2of^O2Sca__o4D{AB5s8vA?PukJzzxuVy;@Yx(?_y3(umYI$_M?;FwISshE zw`!r#;lR-lSL60Tv5sectdnF^uvmV7Z@lf;+=PPOruyb{UvgeWfn`BZHYg0RYK3;7 zgX7Vz4e<{budT@E)j7;%hT*@*7d{jcSiaMQ|0oMKeI)(BShO`~{Xm8I- z)STqzyX|&K`R;(!p@{c!DZ!t(dk&`XE?h=kiH!aD=n4uI=)mV+hi^M;%zCpqC5MLg zF}AO$ZPF0hs{1#=>TTBCKbrKYNB21=^K_z;e$d`*atQhg--63ma(G5cp_TmYVs%&Q z$Mpte%$(Zr@Z`+Yi|z#SA#ga@2R6QiP7rN$b`?$%%Mk>T^=?y~Y&Lh^|1IaDGcEQ+}G5%cdK`wl9q zy6HiSRm2Q|cEen~))`h7S`~fPBRAxg3e$_Ttyb)5rzljiEZp*S3eM~b!pfQ?rPgm9 z4(&AEyLk)Od%o|*!;q~`&SqG~I+-Z4Vy)dK)d$Tt(kfCLl?Az{`C-$&{4annSAM4N z75RfBcQZYqT$N{A=qn}a2D|8}Cx6y%Wzk;a8*^c!Z?>n4hfeYMgu*XZvp7s_4so3B1fw&C&sVV6k(Y6EBGA078Ap;=OA7qifwf;Q&yQKQ~t4PI! zQj8Gu&5T^1#+7cBbr(wI9X?ic$+7Rw@@Q&!s;;Vy4Xq&bE@ zVa$Z4wtj{VEZPPsdvc1=@A43>muq}}`x!&|0x9GDKX4r`*M(K33gQJ`p59w>uXPn- z9&R6?l47^Ig|24&~6>aZwvAL^Hw?{Qr98#ERTHG(M_*dVY^#CxBpUVa9(@jr3~_UGUhjUc;yy-w^R-XRH+a5Mc8#V{L%vIbP@ADL2tDlbYSG4kB51G zt=ZcY9F&4}HGf$qJ{_;mP0e@_RV%r$xQ=@%8YZuDviBsJVGtg(`uP=2S(27ACj4ik zlaT71{<6EP#(RpL6@%MmbT^wB=VICFoX0|+upbXe|9Fj}Yfw?{KkNBBG&TKGz&hxJ zXUYBQ`g$tR&eN*!hRt$&;Vkct_Um;9A;!q=S5p&ZaCNT z$2J?Rlp0zcquEf}Z++E&^85hxKrHLC5c6XKVFkL57n+zOJ@2HBahF_c3clNawslHf zr95`2f5+nLb!EBvWw_Ax?B~S2>yI+7(Ab^ZMOrd-NuzX#oB+;1$<22w_ zmj`E;So!{z;h}B_)100X3huzka^>npx~{9tSW_yT-|1chDe!$>pve}q^Io~^!o{uR zj`7qUW?G8Ag9D7WQ>?d&sN2T)7Kf;Z_$}RoU%e&-nB1DKbJlJ(G;C}NiU!pwUVl_I z*uVQ2{4__i91^)O!O#4zO>8%T#o~6@A^v<%EA_GhOr8s;-?B}6n%q_4cj?--7W?lK zuwPuwUTKOZ!!DVQ+Z*?z2+nw1F~mmYo6+h2K)e2>3wq%jG^KJz5k(dYrt9`L@~q`_ zTk}(K_ZXVnw=XPCVv#SH4V9Y-8!7l6L{FNTr>LVigW5CeGkGO585)%<$~`>${h)U1 zoBzrdeq}>P#rqpwU$7EkPivl}jv~CzyoPzm*~EZsHgbt4zIdn3J((LSZXUyW(vH5uE~@bYOi z>i4UYe(F=Bms`E#fmze(EjRrpv&3tyc$gj)upLuU>GPqwaFNn{a)oc-2E;VX-n2K=D2|Dc0qxY}dh;vA#(01hfRb}E8WS!s>NzATedPeqVdi3xRm z^Da+jf_rY)GxqZb-?4IjcxI~?zrKOb)xq1<)z|)t0;T_PBW{%eR1sgUpwm^Dc#$MN znTG%YDFDH!+W$Dh%Gn2oRdXT3_Zat8b|Z9y&ejrR8(xWWU*k|b*|My2{%0#>eAcn6 zM}MdfQfaNbJ53k2A~?KN`D$z)G%Zzl?ic7jx9X0nsa73~*UZxCMVCA77fh~wSz7EH zU)z_MnXM?=;*ja>>dP4$tA1B9Ek7nImGc8z*yXR3uxhoG%ddl^h7ig|d;n8}Yi&HS z#|wjtT1BA=SSZ7oPwxhH66J|jaZy}B@6=J9Q)cF>Ls__3bD?}g#b#A^y1JRhLL8RU zl`aiC?r!~i!+hX%7__e&M6K(v0)~&wbmL>Y&;Qr+FTTWkxz!3aW~t(L{Vod|CYa3^XT2s_ zS$TE~^?GZBwu5y=J#No$$1W{)j(MH?csO`2LT^j1cTF^{l@a?{zz1WGc$$ML)80Ir zFp3?Or57Ey6$~F>Q-krnj+psR5XX%-7#@=+Nw>NE!X4#1@QnB>s}9~S82V^l4rHA- zULmuO6C};OL+e^-MMThn=eJ8z{SZ-`Q28&BJ-!9_YxTJgi7Z$rIkEr|k0fB~(wo5# z#maAAIc=f?DA086&?wrIc(Yjkd}PPKG+uQ?PLj>H_I%)D?R9xMZW4S}sW)NSi0z;r zy#}lIsoJ1Cn3?qHo35zN)$obDp2@S7UbgnDqzFUnofTYhvB-G;9%jVhQI!9c`Fj&T z{ABJOEj!qIZ4S2_Y#CzercaXkbww!;0thly1T<*-<&Tfow#GZk(cbk><= z8tlt;;I4Oji(S^;x5pzNcLGfOl9gPpYYlQN`u3!qs@(!bXaSLwP>#n5&L+xlkF}f) zLniO5_!gOcB(jVkP)13uU zh9W)~8<{>%@ADKvadu4;8hIb}ShK}?Oidn<%dD*rSs7%Z2rq%P*N&LJ1+z(q@KIMr zJDG#+qHdr}V9^Hm78nz`P`V3BFxxG7fY zYP$bK=>_c@(M;tZlbRQRjQ%h`oVBr7_`uO*PJJA8*Sqg;{6Ta0Ns1{&*nHPatD+Ze zjn8zf_uo1SmEJy!Rh`1^2oA3&yK|Vw04Ot)Ua=F zR<$p%`t4@9wC-Hxc@Qil_v@Z*p5j>d7lZM$-7DcXyq43Yy)>M!o0?v{3RzrS_e1x! z$Fe~LZU#$i+akA5!ml2$aQ8G9_I?20+MqIvOidTa+NOC2Swh=Zk*`&Gg%`vmsvV0@ zgV*Bd-@C=<(?yHKS>ABuFq#cE*j~%mUeZ4(VGu}p!iBE(+jQs^4(9rn(oP+*Yy524 ze%6@TM>i)H5}xh8@2_aiHGJzUc19PW&k5ttbhN72+wb8pXblbZ4)uu`Vp=|hJ8kPV zw2{B+Yj^k)4Mbx`q=$drZTP);6!$IGjJdDC?t?CD;>7uAhLvQ_)DyvYftA0isqQQ# zYQ`9)?DX$w$tyXix9d$(Ojl8V@!#a6&WD(p>nhrC@M<>G?K_ty*A~|ofTcXLio1wf&pBqTvX|YUEM~Qk zRH!dR0uFKotMW8v*~@Na-pv)&7i?sx$*3O4tdusS!>ar|lcHsP(e?4*9cv+#A8Gv_ zK5q=@0vT>n<)|29R8Q?M=bLv}tV6+rW6Z^C91C+Ny-5UP|TT*M(Rp-@gl9wuJ}w!4EHAJxNr>J1k{9g9;3mG1WYa+4o2_ zK3jELB17l$;SQOfzJrG<#cQ_@Rg0b) z(?vG=QirvusO$3w$b7ESAIO~nI#X9I?7za2VUFH;|5t~|Zq_&*$k6qNeZfUEHvKt^ zLwRim)alM>(OpN`?H84gW$Lb$@)B-MvapfeA>3{I zDO&5QeEf%Pa$gtFC~54k2KpO*CZERfYGmv=zNv$UcR10wO3~@^8GnV zRABX__V^8mDnI!8x1AkXY&yH%&7vod4*5_&-*#1s)QJ&FWw`cbpbv?d$W9HQmP}#0 zUZkubI2UhagW>s?&*#o!tv8&s*Za1TlW@*%o6N>s2tdcKDF0BZV1};*GTX!o<_2YG zvNN%%PIg6bU4u}@-Z;E1wr)N{DwIZx>8_dIm}xy_mp4*8ozV6F;}Ur(v-yAhkD~5ccbTiD;#Fi_uf`Bcrg?vk`14$yAyUn#r|p6*TyAi8+)*- z_n~LV*>GTZ7Od{DGc^EB-QN-~ss>}_G{u^t0>J0oGA-7hD<|ni$3&=+bq2tDdvo@+ zKabh4Q1yA}vRF(+`kZcvZ@%H^@fozU=A~ib<>hdPnE01irTA)Zxl$lX^_I9+83?ux zJ_#AlR|XyhToz^cBRxuRi_b*x?q=GsM|{exuKcHD~xijE#2do zuhNibTo!~fN-$F^Zv3gLp)pNK;Z8fmc5;RiqVdnl9GZBL6cVOXC}l^BT&!##KlDOt zzum-pi|c#k5ipqNZVA>k2A@AN4EMe(Rscf$NP=?l$JJw}6{_On^)JArs0BA-V(u;v zb7v`3h%HrfSrVeoGThP=o&A_|TM-48d9Wi+G_VL4NBZ7A2_6_p{V*WvQ>0&Psaa^yd@_I zQs5+%!g$vpjC?9LyJvZy;JL?4n8eJrzhnIU$p{Fp`aRY>h)Om$vrt1M4Dg)b^RRC> zMGQQ-qkRf=s>TQIL(EJRm;0gx=~qTdyVZdUV5th)VY4@HfTT4NLhEBLEV>qie_TF? z&l6)FCCb5z+fs zc20R^Agha~wXR^SuXv}Fvb9dQ0snPC0C$qGX09Td+xE9!>7S0)ka>Zg_vZbObBO;r z7(!3}+TXOV>#NZmesU=@_Y&XNzDsHb-vj+Ou>)^Il$mImyJPw!68x=(;zEU0_rcfM zg@1OsvE)5I(ON1_*oyd43?VF!r zvwC%VhM0`@jA-V^Z3dqSL~2`_i(~Z4t$cd2RwIw_8KWuTeNP*+wQ8J$ejgw4_)2;m zA52v17L*_IAgYM7&h8Ug$=3hzuWpQ;qq~+WIs1%gvb8OjZgeDB>_7Yr4u&$vV z#Iw4~yHK1pHEFvf!pRQF0H~TbXw+FSTncOLl|M>H!f@6^HLsW9Oj;LiT-c{VO)N%p zkOvgvCbG8Y@LUSceoxj4F-PDj{k0DoHKwLNAMoq=;aD-Qoy{q zbJrxL1|7HP0LWX zFBl7ca;`fZqP8i$c+jU4ecp`c^JQmS5cX0Zt_v%6(!J zkXpl4t6tI?{?%^*&ST!kDQ5k()cs;w)vZH`8@@#NmMeYtyTnX9;a=;@$igquBPD*& zVC-AEHN!EIt5-~=wwXJ`1jZjoIZdOL?sA;+180kZm~ zb)vssBp4rxag#bwHck%9Tq@$xEptbW=9s6z0QJf8T6TCNLc8_%9c>cm2 z+ib^e`)&gZQ1T%SikNHSg5Tz@%7YR_mF^7U)}PpL6L+ugeUzQoWNG=jYqY?h?gamC ze}48x=trQ;N<1z}Pq=uh%LsTgDpGIFj_-opT1R6&)QfpGLY0}EDf1G)eR**`9i6QM z^SHm8X$y1>$ur-DhFdgVl~^PO(*Kx;t{-5E;MJvo6(F~@-|IG!6Em8(H|Jycip^B;lr#zQg;1vEdM`K}3~Y(^ zUS#LU7+*_ef;{!M`t7}sdq2-s6`IS}I%B#Ed-+`6T*Y5Yehw*jb9WCLI5Mm-vVkn; zFQ5oLREe)$A-qV(kn0$Is2fb*t1V^;Q<3gx#P^19K4JW4tosA(d7_lz9uqn6e1lu{FWV}&Gh?+PMaQhX0I6Z}R8%4OJ zt%0$B!d)$qx|a%(zEFYl)M|+8QUlNyAnw3cO4T}h z?M5^Wbv5DmL$HqlDuPI;2S$YF4D#W|c6Vv-lAkwl_Era#zI*d`y^LB0I(sxvN5d`I zd~pX+o9kAPGM3@shtl);+WZ{-$`zpEXC##OZMnC$u+9kBw<)_ObI(bqJlr+*u&)5R}aM=g3^66)lGGyl%Zbycuo9 zF|393b z0H0|}Dl@$>yCu4MH9F0qwY$gCJaoRTITEsD{ofo2h8_v29{%wzBjCA1fbB~*70nbe zyG`k%YAyM0ju`8oQi57#MWfG=V}fO$>Bx>Bsj{wDLe2Z zR5vf44OKo2^pDUL=uo4m@$UW`_NxL)8r$Le7G5iBq`4#dcLv~yT79}Vd%?qfX z!*iSfDMAvVn90eDE5x`cLj{m8sltz5h_1y&wNU(5!3|V1xs0dDU#J)Q=3$8xIfoVd zyvk(Qo4_+uBod+x!PSHNi>+M8hKr@tGRV1Ufm+?72L>dbvr1|whm-`uUwuY)xuKHt zX6n=-$|jVih$y$(Giv!h?)V6)VMh-kJ=O`Dki)Ew=>K~(` z9YXCUVh;6g>O3c!YaiwYo5#Hud4)wm_OPW`t;H@= zC#Qa&7)NYm9%5ZZW9q7PyspS-`sykTh)PQlp-%DX6ofEd)GO;MU3%7kmK(^WH(DIcEvJ|LOuozM7}A_VBZl(gHSQ=VaY5l?`Xd z(EWGps6Za5gtV&gJN|zB&niLrzhX*!HAWO*XhL&vr^Ucer3m&e%d-TDKqGPaLN0Pr z1)nmEEVMkDayxscm7v^eH!#$87oQN-AF}!FtVIK5{}i?Z4|^_^s{Sg30>>UYZDBHS zix_h?r8$~D0Uxz(T|~g*so`vujjjU7tjO5GUvdgkvr;&8kUxhMs#K*vu$vn+jfJ+q z!||YJr{Z~TC1}8JYL_&Gt8YnO%1Fw@P@K}9J*A>82pY4PB@@EZ*exXA?NYsf#2dNR z+fTs*14ut%Aq`S1^UC4RN7(Cu^t46~)-X3Ww-^;57+k{o>(b)4eDtOPa?y5*(uOsqR^l z5o&FTz33AuaBAzT0P`)p{q8V>SX=HKu%h!pjqHn>quFlx9eQH z?YVce9iJ^SATXH7_KtiCH@V$bU1>jXJp+e8{WMXihC}e?d0#JC(lHI&O3xt&v=7``?|99>o3dNw~7XACjCyc!; zRe6Zf2fbuBjJ6u~6dYztwvEgz-pZ3+`T>R%dH?6s&=0q=gYf3?vF*)@XQm5@w086T zHQUIcwuEYI*PxTc@YR?G`j&o0b=l(r-qna1Y`!Q!U=$fr`w8Z~I7b;!4~-9XS7rO4 zWCa)iUVnLz5$e#5${uZJzlD(MFuv@0`oWU;f-jgP*R}H$t=M1ca!B6t@DN!p0Wo!$ zn>gApOBq7`%7**utANWmhTK5ulxX*Nbycf9e(nU6)a^OFrD6J=vshI()X*o|Mu7G6 z)&t~;KEfp`qMK@w<9Vay7`)T7U|?)&PC6fhd}6+yk^t3_(bOQ*?8S1)U%svn*zSr~ zor(Yge~D(Z<*aWO-F*txVZxHJ-D*6064FcMmOu7(7l+3+kprW}viJl~IucciZHMFV zRkAF%Vgt(E?+tm|(>MXaHSo5s*yX?)8?Yso3=4^@)n^B`Kz9)}jH|bO0!3#GVIwWY zdww(Qe@d7jIs}61C%}k{ADC@c+~gHIybqIy%T^e&zmZ0Etl^~KsA>lr(R%EuOKKmv zG7ym|N{KKpWag#(8+nz}N%q?p+;M7bOd%*cs;=}XB?p)Knf=pC%eZXf;y}u-(qn%D zW@K-D#UOfcQov4<7eoJnAJ3omVFRkMS;?7umr;)%s)cdr(@~DGcmFKw9_}P}_*MZ4 ziqeXvu4P!+3NN>wfbCz~0o}ri;cG+=5d|CXG1f(?=^8r1v*w-NTV^UNu01`~*uLKh zk$2(ws{e^*Dl5PVaB$T5&_Z$bzi*K}i*En&HRtV%VIk1YjBcQ@r=)J&tbN{x6drl; z0xV1fhNZv<#I&_ki`3t|dFYdF{8YLC_$JHnlROcKW1>J8z+QPO`+5#15-CcI$Z?U! zk_hi2W~;jU$C$i$-PzH9`~K@^*o&@zC%4hI?ad#cf(L=?=B?qJzTfZfnKX^dJSkQb zLix9yF_`jS=V5NnlatZ%XtOFAoM`VO8+I-n9_^ieyLfc{=0eNJyAn@cjkAQ6RqFoQ}$ zpwn3Bw})kIuSZN$QqwW>-HM~LfBqzuj_Sb%laS1^LJ8&0vvy9Bw2P=fn#Syg>q)te zv2UtYp74yVs$VMR@u11_@igrzVHfy;m7lK<0l=g!mdjXuTEWZevE6&fd8Ep(jt#pX zy#}2IF9cUV5bCsGgclkgHAhhM7u6vGY93;%$aO|}-SVaO;6EG#VFN0VZco-ZZ_v@$ znvf@|uHBfv)qYDzMd};a!H5U+z+5E?iN6d4Z0XqJ0CODTaDbsS?Ooed@`MuiEJM-Vj5XuJqwav}!6L|b4{TaL zY$rbh76Dd6hxiNWC>FFiP$I&7(9{iV11$ZlSdR*$wUMRhd-Zv8YP+AgN=EZNtsRqw zW~h@5YQF<3T4=9)U^QH%3ylSMt@pV9$wT0vKuTJ=9c3ZYn@)&BwUL*m%xVhlp-Wy^ z*w<&4?!Zlb|2jNbQaf&|-R*Jhkb%0^e{nsfG)!wopqFE==v%HJs4_FLvr%&&{a#`j zQ9*2rI53@~bXkr6YXZ!G)7f+WRmt;(sG6^4v{Jq7;kOndcjdbdZ^`u_ojF&D>UNbU zhf@R`hwn<%^4ip3if`+9YvopXtA5F?%Gn$hc0Z2FJ`hzwFRrYZn1U%OvahF0S8;pE z*YbibML9LzLBc0WUlQ>fT*!tXfC>8J4}oPVHC_4m!B}ZDjvDHsDbToorGIqv;T6s# zq-`sCJFh3Le>#>k*kaH6rcVU%+-*4sSH}O8dX3UT`nb6{Ml*vZon$kdj&C5Ipq?<9GSdvD>3m+}g zQ;md^3AX=dkSq~aK1fE`#fHidswCpm5rG~ROaaXW&|mcxsth;oG&+)yrU7QK=v2iT z;=FUb3CwMbT7RTT4RqR5TQ`_Sp#Bi27z*PcU_L-N3|xf75W*&%ZqD7UfrOp-BH47{ zi-xprm-zLlgR9=fpC4f1zIuEGOc5pZ=)N+{aW3^_r^tJ=1s)fzR-!F6v6r>%cKF4v zsjhq@evRFk5XcGl)%c7a!S3BNmfbEV_8Km1iKot=^AO}#^$(v!>hk0u_q{-p2wLPV z5Wg07py+(>@0J0&a^N;Z=1S@p4+m*Q9`?eupRy>CP(JE4gb-IB6v+RY1RZjgYy>QA>Rkg|>3wxO8`8rdi zboYOK|N80PGW_L9JKfu>w0OZLRFh;X2u*8cK0nalz7d_p!2>O}C{9M1Jz&&0>^Yd9-_C({q5&r>nphnCoBR24`*bWjRE=5oQ zbZgZgi?NAE0B55tmf9P%hL%N?Vf%2^+G{JFnnR3+*YURi^wJt{n*R5Zw3?{5*Eq}_ z_N_tO>>XZvz2;Sg*%5Rk1|$1F76ES}!jrdSzknvYuAO){;;F z!DjVgh}v9SsB*;}8+j-?#y}kix|~V7?A}8cLpF39jf&4EpgO9iDtr>WYedc0rn4_z+sdxl*Rskzvim)mr)n_~MjLgzN)G9m;i_{l(1;9w zk;}dPi~WPo%MgS{qwK7QQ=AYe6L^L#4!RNSdG&E81nNn5Q1%u7a)Q*~49&^|IhGzb zVbKU*wZ#hB$c0pW?Tr!)ex*vCz7svXx@zt4Eth64vv2TKyIPWu}(fi(f+nB&VN5uRE+PKOTpcSQrf>b6c}1p=q+$wYazF|pUKWq{5g*HdNI-@UhGu@&4>z6K*>nwKKb%D zAd3B)FDmEGg*RTV8du_xR!hRWb4A|&;rp|ZUWk1_CMu!vaKb{4c{({E%liUuu%fnA zLt3Yck5ugpB91)=y$oi-nE3g6czE~&O&c4Vc%*5FU9Un)WL)dYus0x^$jR@Lt*s8> z>$&t?cG|Tw;@8XJFLy#464%J)yv4uxfQEk7S(X$`gc<*>&_ z$xPNUOz)8UTj5g)QH2kWS>2%H75GHQh%y>(Wqhd$O+hI?MiR}6&Stv{-jl=q*l5Va z;Xe!9cRk~>W{KU~vaxj(uH+#){g7e)bbyYZip$OsRnH#-+@kCjdI58 z)fH}X#t2(X9kD>O=DbhI zvUNAMh)ptI7fKd}KCisa9sxuiBAbZq<7i|6eEdHg(E!~_v=^f^OMDt4FOa=DA6TFE zTU7AxHC%R6K@%&pB*gTeK`{sC_DMH^JoS!+Yv|o2ZUWDTNDtPq_3n3Zl2XijR7TLQs*g12me_+hX|%<&lWl-vAU(wut;} zuBB?ddcW-D`PJ4`z2rn-oY6*Q6XDxs zwVSLyv)YjAp9UpDpaEYrD;<+X_VO#XzK4w_1A%)=j8dF~{&8rMNEvdE2~AHKvvMD` zCNi-5uvPcva~(|^(zq3o!`QYW-rQVQLptOBm2P>schqY2P^<1TDVvVYgInjH)og8% z6*o)9Uvan}k*E^Y>^tCL$fi#;siI|iR22eRzbc#7oveO57X=HsFJ=4RZBHRKubmt^ z>rz66O`q)KS%?gHn5E^0R@gq}-o{rWEbe?*hE>}%6rz=*Tha5RN)Dv zSEICfA#)$=In$6d82M+_{(9Ey`7hXF7t~r@&2fWyptW;$d;HlEZXe(vJOTmj)v1-a zXSBVSJ`%8Sab0K2jo5zk$zXU@UU2TUiSTqo2=}GH75<0F**Sr7eUS~mtr(Eq{~ujn z9TwI0hKnL{OhhRIP!R!9K@n-NK$H^cMv!ihj=?}0q@@J}Bu79xRYG#4n?bsUZW!i% zdpPHJ&b`lb_aEorFf**Z))(*hzTes_K2|0HzTcgGROjd(S=^PX3o=%MmKLOq5&maIeR^ju zNcX+j58H~CJ7@1m3^S1=*^qVP;I2*`g}D5GK{(1k!sbVc1og_~Lpx;>+;6>y9_g}* zm@1w_$}$WgcTH}9R{tORh2bovwKlA1-L!m(%hf9aBxHF zY>L(B!2&)h;)Kd}g*4~Jn4auO5eZo&HZGH#(g0|Iw8NKNe4x@;pmdl%uCsHreWRgS zsEiL}m@i-ZzJCTlV%E;DfE#dGGoavLe-3_Tm7`ToU%LZMzc&n|6~*(jKumfgxjr^p69O!RyFZA z#mypSNAg!VyMSfU`^iwzAsZS5&B5jFwHTAzU~_G8Ep;~%3Hc`u_;z$oEeEhv$;tC1!5NhJZNSW%wt@3Z>>dnfAb4^w}g1U4S}Z6LA-POXJ6WL^^36j3OR9xA@1wwrWiHtaQA#yr;TRJF-^iRYQHo*UtNlcD@xKIsRpD!9{3<2IRXDxx^%rvo>PWTTg5JQc zCun=HHW-?Al)K_1O?qnk+Qh+atG+BYh8MW=ymr}+yPz=F3qDx15)%1haNf6qPtmUub|pG)t-qd)+^%0mVMjj_n~Hz?0%p|PUerDVkz3)K(wl%$NkjE1g*v5&?Pz!*Xw zDD2O&HPB3$zBrxJ0^~+;@xAIcZlxa-kla8A)&L<_DbVBfC@T!7Fr{zpPnz9elvDBq z(m~n4?iU@UXok8oW%DW0>KAB-{2#e{bn~E*%n1+suAqrVUT#vc(HGZE?+hOX^~a~d zVF)A{(N4{<>?0KvSci(r+hQ;4^La(CO(tk`I>RnE_4b_(;ug&BowpWhZCc%5uLMPI zL$w0CsRCi&9DTd44k!LI2#_=_@fpyK^Q-;k&3n$nyYZk2tyU0o?Zp9_mN_0%n_*r= zA3-j!%s%~$rz_hB-&bW9m1^moP|rA6dlaal_HFBfB5Q+vW8vd(0uf)8{SG~!Xt%AE zhd1M6@m5m!-{h~hJG&pa`OE0LT%YU5FRgxiK~~)dyp_IWJk8hU6^?Ih_W}G%=BY0} z;oz1yz+l)RA|!D{Mi$9oU}RCDSJWQ;Xb0jjtkBR%xof3-`6-0!JF&v z=-wCGKF&A!QuO8EcZU9M2KGPCV238OLP!=;=vBTPiW9qM>Q%Souba$vi6K5IYz31i zMON|tb_*F-7n!r^Vdpvc@Z%f51wO!L!eWMBJQ^z>wk_XLxtS#g2+PsRql)dCW)YdN zpC{Aih5g3bEL{eOh}WQQNV8l6m63a{p9!G3pj2H4Xedhj{OH5WDaQ|ez{XuQkS@5b zA4Oq`PP1urE|DWn#k>Buy{}1iOrmaps1ZwiiR6@u25qtdO1JgLE5Zk}nD%XE=q~Z2 zzR>KYLJXsa_ugndXncXhTQPsaUVKQ2+Qc-nTH4#F~V8T(kv9R25xqpJr)i-Ol-W-xWc!U@q!DD?lf@Np=krb- zJjYx!2rC45lmBQ~ULbPw`47i*QB!Gq+!1 zvnFi4K2>1Za{w5bpGUnk*g2c%JN$dJb<)-T&JkBVij#Qjt}VnkvypLI_C`loy>}uH|~u$kX;DwvMGgV z8N$}w%7OmtMcrqu>1H+Zgwvo77Z_Wf)H3XxWOP!dph9lMm)7ok#jriI zs%U0tjVebyw-)ce1G|V^=PN)RZr?-&&its6_e@g9UrYC=}7(5-?pE98N`JB>@mD1Xf7unLuL+O!}#w2>5ADH`s_-vvk@WS$v z*Q*}gt1pt@282O$rc^_HInd%&0gV0S)2Gi*5BG}4`Wnv+QZm+&x7c#qwjP;WyTe^) zraUcvDF5{S<}j~2N_NBUJ)~yH-6PjUr;?lJv_cx_sNO1=WEImU{b2}t8C;C0h@5s_8$ z%N|_HU%|D0ptJl`e`A&NGn_1{ALsy>PQGGgwp!~JU1*pF3qYxYn!vqV4!8=Eql&cCShXPsv~LB-MI z?>W4DRj+I;W`d%p)>ZKJzVVY>Og9c73-EjO4`w+C`6dK3irc2Tj%ks^WRtq3RA;-c zu2gkbf`&t0M`uxsrdYRjb#|{5OmgSsonOVjlYzCpsZk*~wh-sIW{dBfz%_7er<_AA z4U~psS{jZ!Im51HX|3&DgM)}L*kJR{5w;xC3H|Mjyh$QV|9In<#khHSQ3YJ5c8|En zsgqmVsJ}FiZJ21Cw>!V^M+@BZDY9{84fbuMJB%L&yBvpi8U$Y8+9lR)4@98f%d?!3 z{LPy|&vR&Jk-wTj*M`qr%&b#{$OfdkT*A*K{fk%b4kUO(Ys8npt-mlIg$His0FYk!FjF)YA}(7p~(YM4PpUnQfDC z+eWM6o6#qG^+Z5_^N8UmoAUHksb%?v$^ndVD?MYf`2~5ft^LmG^0ajM za>H4KyvGDhd^{pU|JNMyynw|vW~8PQb5i}ly_~jQkB1#(er~^U(_G7O1?1V47GrxU zl>fI%?aVJRg@nlmXAEINqIOsX70tlCkOT=VnB+sQ?WJ0N{E} zL*p`R)Nil*o)4Y}-GA3jM_(!hVitLQUTGaq!32cquJqkn`lBbBf{A!tyJCoY3kX;q zb`=pd(^w10sWecH0(Nm@71A_Y^3_C4)&OSy$}tW4BcTX_&0L>>9UnI#(n$6XErsf6e+ix z{-=1f>We|~ba?+k&9nl)^D<$lY%L;$ZV<*2DoJ9Y@0IyZF~S(og$Y~F$^$rOiN?7; zEZFK!jcbjlsOVbdpL~gWAVTP7oGu({zlPtVShc}W!Y+UlCITU*3+?F^f}g2j^XgV? z;aYv=W*KY|Zs}N1y+MN;ESHKeCA2>*m|iMRD_!7tzJo?dq{0}Jo?-`>XEe&(ej(&% zN!qIez}Sih-;6anyE?fL8~g-r=6J#tqOyau~UrY7q8!Y z@cxRl-pgWJ?=MSU1*8QD-lwfCa(ThECw(dG9wpoTF>H!OVN}u8|z+NrsS- zTf+sU=I11%6eV{b2)syaQcjsDIM(@D@ktx&kC`Iwi&x&>yBNDe{=KH)8-|A8i)ngA zh25lPZgOr#09(F6Y5D|f)2W~&ChDm2>Xlthj&5vgUzb~fc&?F_W_Vg>OQyF9mx)eS zKKDYV(1@vuo-obD!2H?#lJw(%4>+l%V4SsuuctVBM{4V}a!g|lzNZbJ|yXtzyhkVwpJx@kof3-OJaFd+Gvg_#? z*L0W1mhD}ogf>*8D84;fc}>&(B7iWzJcQ<6e&3p9Y5YV|U1*V9ewBXSdz7N`Cab&P zdmwPF0ai^mRJl&FpJU zQ1+ai!XozFXfa&VSu5;AEuSR%SU!z~Rg?75rN?eUUFI%V&qcSn%1buOXwjqh##>m= z@|age(pIj;ZWc-?@?HXsmxU|;wo_Nx2j0;=YLdxKGCmS(c#J)C=u~V+Pt*k%+F_;H*9!5IaJaLz47%0Y#cLnAspXSH2)QBH6q^ z^>{W21b5;sr>DM5952irsNB}E`o>^OIJ&G-@J5+YR%|c!n^M;ma}M5tY;{r+y4LOO zZJm{ZSZ^-5Ygg-p8pA&iO~$*7dK9h1VJ6Ei+`T+9yrDL#BF+7>Jvmr-prL5$a}oSFN09Tb~i3QWbN%)8~sOTeCO1^$w9S#k^5o zmd0YP5~_^9V;9bxCgB_@|28SGG#I|X+%m9dVG%H^FDa8>iE>$qPeLz@;F<8aQI?Tr zlyHpkI+F-KWN87l)m0tYtyaOPh0X8x1_-X~u~QjVRBoZ_{{hAsGb7X%Qlx=Qzuyhp zm5G(4`4PNbGt z@S>KWt?PTt(DdYqsjY%urfRWZ=UnzBs%k|gh1$MOirVzBMjOS`(RL#J6t>k={A}^WOvZ?B#=L*9 z)#%~99ZfAQmp>9Rwe@nTF~Dbeg--}8=x>`MQG+jpFUW!hLNg?*= z5d>D#p~a~W4T^|s7H6GLbW+vp>a9&tN?LoiLneZmk5x-b+@16MlLdEe_t|CWb!Lf$ z<8_r+Ch71lS7`>Qel9kaXEeP4Cx%tY%a+`$YUxU%%zAwE5Rzr9m^;A*R0FSKQ@4A# z&))z3SIWikvfz5fQ~h0+ufV=G$BABa9ky)U-kU4rs4*r2gsKjQJ9AC!=QyU~)hu(P7T z9`U%5o#WBqz;{>11oQd1o*i0&L_2+{^eyh$_>$p#vkCavhKUTH}PXQ#>x~K zan3j3GU!#;m(t5eoEH_q?2{TIxyqNEWlRGqB$p|I2Y7c3M!D==_${>R(5@2%Z<*a6 zYbuj*J*$tcW;)pR?~8&N^-)&8A?yK|iuL3p>nCC_!h=shk>gah47*gGP2rh}FR$L)t=vP-gD+EoM(GC1lqEfl_f^fcmBR#uBkm(BDcOTJvnvsejMa7@8M8$wfU5UV&`&jI5 z3@%NpnV+*v`TCWUVauOz0lV`(aD?N0^s+HNes{`$$%EYO#?fOT78l{I1g>+MeWUKA zu%YyR!JD4ICK~Xb4_vN~gC%Z5goR*9GUm|3$rvlW7}%8{f+b_ zkR>X|bmRsWU}eSGZLVzX8UN`x4Q6sL4#5w{uJLDOr@Ks|XlGt~GL{YpcfxMho}%&I z`y$ziWplB%T9$lsqtQD3HYX6DyVhTxVagZ);gnWRbh?+oO!NejdliP}GTDKWHkHSI zX+cyxA8Ev0&tjq`K@~G~nhKuplwVLzNtpirc%&(EsJa-Q8|8%-E*Ewi@uARM=GI#J zp0?DP+FkQ4e)HMLK)syM5~Gsv1(D4c(WECx{H~F)lq3#YE^{awq+pQa?LM4w^$da4 zdFq?^>6!G@`nPTW*g!!;;Mfe%0@$AXmGgIg6OI?|$25(Z% zr^&?@VSJe&+`CJp7UXhR?d+|;nVJeegRH_JAlV2Z|qc{n#>SWM?C?OO5u3jnBV&|r> z5TXCTVG^=gghnPT_W>tW1v$3Ll7l#+{s)1W4O); zb}x@0IOE%qNlitpAom1`dr&qS&CzA%a&>P8O}INd$0F?H>Z03UyE#mLlX2bFP5Y^+ zi&^97(y?xWdRK2bYVbl}_Kqt#EeT!z(LUAFh3v=?-PUOv{`1v14<*g3S4c>HF(Koe zv!STT#RySldG>KM*nr>ro_Dj7y;Js$C3Qz5&rPmlU^5M|FW=mGFeqiq{#ZWte6ouu z>QEYHbIb+48}Lmx(=t-8MCjcqq}@LWs4Q2cQ7FT7qs)Cb8De!SkD1tVz0(&_ad7R8 z^`$dQ3rf3UWm_1}yq1<&d|nQYJ+P*OjrwOn1%=!2vZ2HJ#^{+!OV_Sm9>R3iX8w*+ zo%ejm$?GJX#?%+2_w?qQLfMfge~(FG|BU7O{YYa5KXe!T263xnU@R}agid+Q)e7-ugJh=sjPa; zuF|@U%j))KEu-*R2{&9fM<2&djE&Tq!qVePLg~^v;ZKma#o36Xt1y}GV5k!3FUCTsdD)mXmi)?+{ZMpiHr=68BAsme)EaQ@IrZQP9z4 ze1oBZ-x*(-?N4iO8lV^N%(~Y-R9V3~8@ZC#U9+CrC1$HoB0!?GyNn`2^NR=EWzoZy z)=y9c$bnEKZ-e+^)Wc;R#`TZ|qx`gWPhtS2ZT9Gqd}xFy+~5}gZV(3-c2yo5C=u(m zmh2wXCuX;fF5%4NuXrOflRz^w0||2?ey;9pzlLQi7AllF`Kz)Gr^6C6yn-9AFw`}*n@gi-CQ-Rgs=K`f=<1(ZPPYpLOSz@Eg!Z2Qgep-&`|jI=@Y__=-dxbh0=(&erv0atav#121z#c zilMEouIt1HWqgon87xc}-?TGb8;{Hs&AqqBMs;B8qRIWtgC|I|{kCy+cWa~8qDMN? z1P`HxUU_&O?G`#d zq_9SH_Ph9J@cs{MHzXL46O#R2m{cy4BcVL`n)i+C*ZokXi-dspxJt(J6`Na|!yS#} zc$bjI#u0m^L0Tye{FCb+3CCoWKjPz0u$0KuHgE{i$l(9PKY|M3w`Tc4fwO|Er!<@h<1UeYxv@}5E%4W0Fgo|$P~4CL@}Xt9 zoWFh@Q+ay(Xh7K|CTQdBFEcZsqM<AU})-d zX0TpFT*&IjyUofObFUpjyTQn$3EF>Tnv$d8iHMN7Y8wupar zl?kZ`wokI4#3SAiS@>nqrB!e5e$2})PKcjHJ%EE8cLD=w{*Ip=LE|gDEIXYC>4K=L zgK2Lk!!UEhOreN55M7A#LpjYF3g*xM`KTV3{c`SoJlY?U@XeFoTsZcoWcCE15}h1f zYz?q)c3C8q8xh%U%gUL;-ta@MaWS6lh?0(*@use;Q+z;MS)Tx$*0II=+v_|DB7(i>RcZGrH*hZMW1%DGcrtY;(k z&}$wZ9=8^@<9!{w2?JyzC>hN3riIo{p2KF2ztyI=C+R_w4^l?O$6>Z&>R)Y$O<2n4 z6pOXW$oO#~2hPGOzdM>5cGY}Apl$SF0Q_?-okM15$m;q2$s0`VW6#f4iOaJd6nl3D z`9RACYH!POU`0*KkFYV1^;^Jyvh9i6*b&*4-EBaXi9iN9hdifSMA7oIkfZjGD*y#a z_-rSf>&_I?O09&bBR8t9T9aSTn9^rI^%=zkZpK2vW#vE6)Ky;Kqr035 zl8|iPzM7DioVZ+O2+V}{5Gb#X9j%sI;WR!$f-;vH-EP-7h&0k*uYgG6^v^Gk(b zND;oL{vcurBp)IIY+10SQR-3qK6#e%s5EktFr8mWs&q|@M(HRquiMnh)ZO4|4%FIO zt@NH2aa5>W!4m!ij#Mt}*_k>`1de)|;SL@mp?hb#k$w9Na*Q!aaku>!0W0S}-`ZGN zZ}>oA3swjr_%2zpsH~vtb0`h)bx^ujdHrs^u@5ff3Y?XwlW)I4d<}w_4iXazvG|?M z{)IhPmuc^2S*X6^EA;NW?AG>L<)*UOEo@IXN~UaXRF13|obj4?t|V-YZy{?awC@WM-goh?n~YD-}$rpOCBTS;XPsVj7s9 zXsO1H8aF2G7cLMtqeoOi&J=FU2>~gwf4RFM^Syu3y>`l@s-}T-{^wicKCkhWReI^Q zXgPTx(VmdEePY~?6v)qFpDKO|wK^~2sw0E97*9d91dnV?EGiJRa$ZQ7|8-%0|8#bE z^`3~2DDqq6;=CQp=OE~lB6H5txpno4EKFA9yygqU9xPh{Ow<&ePrcF-GvxgD5z`M8 zWHQQFcZ9lnsi7D+*wU^$vk8>T;{Iut#BY2MJG7$cr{z%N-hT`Vwawbb(bc#@;+j;6 z%Bicx*-l8>q<%u)tNqTncjt#_uZ3=VM$T|S^1+Hjb|_bquHYW-S)Q7xy7<$uFvmk4 z5KA581AdZ`^FvcYn|32jMO5R!PQe{e)$nM>6_rC+|L;v!kq}J}c?XG~b}G^NrQ)eX z+gbL{S@%su0)Ct@n^lUz0wo0e{p$)V%|Aa@{j!}1OA1nP5QTX-!7HaOzz0~27DfbN zQz>`RCzESl3VCyq?BGCej`L(!rVUasoQqx`pK~M_Zv=daRS7Y+gAz}9z1Z^t7%~an zfusLUy|rG6^Qfea0o==Z4w>s8kfnD&hAcr%I}0;1>342>Iuj@E18K&*T3pG6g8VEY z28YdC3GjET{z^dXmUwBu6TmkFK|%tLav2>bdi%vxACtx;NOB`h(@FuvyS_*semy-< zfqmgAcYkXyH8NU2l82BMB&K)!Km&esr_6@QoD%4W<&|6ZrhsRtAR*;k<)Y7i^x7Ei zC;kDt#F_L4<$P<$8HC>Q>3WERg9_l&pOvB3+P|2zFhfaJz2Djn5JPX`^qHiMVJo6} zalRZiFA{`;7|hFQPl~t#V^s+I2ZUgHFL$7YkH1>MG5;82(>|W5I$#h}gpuwM1R3sM zoY!I;#|>Z7Xi~y$leU1#iN-jLkpDn}yY??1i!v~MY!CyZA~Kx6XYgen)DW2}gwWr= zilN}+o2oP2TV~36*_!nO#x9=r>_0XNE=-Kv*C92zTNz7 zamX4}ow}|f&q$<$kR>uFG?hOf&IQ!u$fw|{Vzts=XwBprrPaJdj1=!bU#SsFk;7E7 zA^&v0gcLLR8H|!bl~7`f&L-G>CoXdGzl$6?B`|OX!jN zL3{&D$lr9o)KhL_0)z8vN4tI}mt)Wo|_*+?7&2VEkxXZ+~XQjjN8|~2l#DXcC znJpgOA3`Cg4Qf#(w~_CMJXQs7BN4v?qg64GcGI|oK;J44)%@k`FL8>I#&*rXpN)p& z9P{^9y5rC_`PAcjx3~Umia7@$tIohK#Usp$#nI#NhujZ@UEh61C3)jX3}5+%;XhDz_+X~8)8kC#65dWz zV41+yJ3hpr5ehatUD720_zO~VG%JU1jqgkny!w&bMyztj*e#3M&0)$PA#T7@c;?2V zV63tNc~@sFq8M#$CaV>c6vS#A_2MU?%obfSK|e;yPSZYGU=`l0&+~S;V3Z&w1Bp<% zfC;3Z^?4t$e%y$0vLC+imWHv4tR@Zoj_9<9r(M6@>$WA~WVO^q@0UkJanpi?KhM?KC{XJqEAHy0qGQ>j{frz4qC$q*B++M$v@OUoR;sohm9C;Sd6 z^M>Cb5(UUAa?J?&^QM3P!m`ax@M)k%qBaG&dEC;m`9rRg^f{Xm=D5OBOD_4{osV#~ z+_I<@7N*O<OkN7lg-{Gjy5_qxizg2YD+bDyFPTOqE>dRe_&rP z<1mAyq2%^3l|MnJ>=ZUHHgd~U!)uQ;d1~!WeJtApxvv^Mq#3{Ml9rt=s3y&CAq^_f zZk>9p4v|+^zg@2kXXl`z%+Gy;QI~ zCYpQl(jZ<dlq9!QkKYhk+Q!k3R=ie{QIlTcKC`Q8h4wuUd~OGF`qZ<3?~& zyk5=(XM9k?#$@U8p_LmT;>_WF=^+Nt)81&b&0zEjSJEsR=8o&f1dA4mH4f40tVA%@ ztLpd0I8wXz!xJcd*ZTXyUP1Uw+g$K9SS`$nJ@kMxrm;NH$a z5S1f_L|X06hSKM>SF;^m$);8JbJ%n1&T`{a9JE)G z?pEWmUk_|Fpq+eGiI8xJDg+uf#f(+6%26G1xp`G*4XKe?>HNS0PxUcCXEDlk4+i(o zj;@t+s6T6+x!1y>O+RDXhTX~?jXc3ud>9kk{!`&}>Dc;qPpR|cj^=2tG1tNJS4#pW zjM;1P?BmTf+gRu9Obxs{#~TuovcUhu^6P+cg`9^#DeoOg2cUkMhQZPZ?J%A$E40{_MI{55`mLFqjyJxdj4IEj9X?ufy(|;* z8a>98PCgB{M|uOC0WvBCmRUFb=FBJ855OAbn2wEt zpU{WWh?@bGedVKxI7V2`C;wT_Ze%(6g4Nq(flzx&<0ekLpGS`#)&HOn{oWA_ycv^_ z6@+?XslX}TsSt*&TADsQoNx3shoIe)uFci=kL9Q%HN8OXqbPo4)9KnMH~GEiP!2kv;VeQtoRTvk& zaWyMiK;W*0!)oGODTsv~EiqQDU78T?Q2EY}TYPiKoo*EKD?#d}|4(i>FxcOh+Y;JD z(EbOSxZlbKNK03__)}#vl-MVET=Q?&>@)>_^m-Al#Zah2cy3m`aQpk0N~1l|<`*mP zAK%E$q@Y|>@{97BBayh@pgFT%^*SHBXz`RXtCxl?cKHR{ zu3&0O`fWSGmGMhx$C|bprkk_iZ@!8r1uk@DyDcVC>u#jN?YOvo#5MwzpjC4jT!(nk z;gS5w)m)cYWM@4xpy!)0QXO$pETvS*5c$1s$2;fjdVU+Hg;w5`1~`QrUOV0fEZZYn zAM4*VVuO*GO09v6n^|ZAeRp*NPCZu=DHfTPI1l z|2d~6HOM<0j$N8OOo;8d3SMpruLkPBQ8m4Ua8Kg;lO8vP&M=jDldh(-X#sN2-9qxH ze$9*gJ`GqSX*)_SXEoq{#1S4wL+{!MEmx(xkcJ+a`8*$5!7L!6J<@}-8kGTZa80hj zVSLesW;C=CoiuJP{yI}pde~Mfwv@;iKvU5}Cz-R`edJnK27116L}@wWV{MY5cgGkV z9h5)3^=Mc*s?(*xrG#WsZ}GWe0t79ndJaf;|6kt3Kk6MzCQZ~YYELt0btdsH@z~!IzAnP z0Cca{V%AW?-1(1;;4)$m?uzoyB(985HZf6BR|^+nx&b*TA2+ZKw0MYNejkFL!AHh)wywW~} zwA|ceGzAS|hfy<{#{>)0Ht5=t56N4+}7{xe&;LhgQ*mUA#m~YmIzHLYZgQanu7?KZE z$uYG`5AL&Xf#<`V>#z+^aan!Pvh+QQ8}RBxGeZaTSgZ`KtN#>L+4;NS$9BT#*jJ3u z#Ct7CrPHN4y*gTOv}G;tf9|{q;3DWN(Y$gFlPm6N_j`CNd8kv;MB-gzF8XyXFF)*UuR5*NskqXJDdE7=sL z4M1+|vgN7RH6B@4={~7`aAzqr5~lEKc%Y(ISWLIJ&&|hC3LDAnXWWL51!^pE7lJ6P zf8#;+K3tbu;8L4j5SVq_{Lxhoet?MeF_Yy;E}j6=L1S^J;aPyfNO5qkgVR@!vdK!u z6t+G1tOVZeFOsUM&;J&Ze$!A$3SlZEZL@)sq~jrw?l1E=q(oL91F07N{X{vyMD&pR z#3KJkotGCd@i`F7Zf=!8LgXl_UW$PlJvFM7U(azqIFvcs$cHWjv0Ao3vt_Hk_+*#- z664`+4d+3>j#<3&gM^pQ6TqC6x~$uS(un~_kE3s(An8(pP`BlGOi00B#d{N5Y3mUM zha7=6L9~1_v~%;e6raet5q2_saOd}jWn^x~UkyUek_p>_i9eARa~J141D-_+3e`YYn(;U8_}^tuK@vA%du@?-rpwvsCAT~G%!{`|R1D5(4sd-wUFVf28c?b^5Hix!f^-8MC^T@! zkbffSYj%~2{Ln?)0(=)k_&`T1n~&rxc5ZtWl9O`s}NX;jRMWuN?fBY3c2 z6yxb)#?biU{#<4xcbc!6r<3bM37pVQ6{bWM|9hLA_*W(` z16E(gmYP~AP)VL;AugIMQPI#)53|i)5SKwHme<5Y8Umy1Df<&7yQI3F%6cj5qafR? zBqaH?qjx=3V;oyTkOkdQesI7NnqvB9^^b3=?&QtZSe*D8zvru+M{RevqRgU0^C3ht z==C#ovi+r(3^-h(G9>ZYmM&XEq6s=S$TkIh^<4DwY>(@8JxaUmY>fI-Il)0lb}W+( zfC5#pw1?GBodBy${Et;OfC{ovP>^YZl)66*&;f7SE+-&^_B&0M>~ZT)oC%`YboI(< zSp-7)LHyP6q>^H&vf2d1c4rOE8a2~-i^~K>8G4Vg3P5K_w}i8G?mX1I2<)_-A3ZWV zGd1`0dRS)mOy!|mJAHx&`UJ=PS#7u4PwO@$2cc_E-ByNtbnetu*+uX}Jdtqa)ep8q)5@mV1UL4-WA&4xw+ zKf&LYtK&(bBk0AYh>8T0<+ue~VpKeJV(6jLwsrkOy(umfN zO)J0YsNsKP2O6kmH#WPPW7`*Y_ZA9P)p!MdyX8^`Uk&RHc$t@-^@Ka3F}Dro|6N`d zdov$HP`004k%COAbq^Y&{-yj-O@YzVy!Ox|q$HgD)V?sM#7o;$U~O%kHOfu}P-G}C z&wMRgtNmvdr#J%3{={oD9}}U1`uQVRk^emJ+HN#4QWQNxSQ7w`NZzk=q3Kj$JIbnM zQa^2jz@@^0-TLatzDTazdEF;J*6TwWFP|(oh{uPvK$8^G&ur+j)rsh28)j$#65#xc z^G&Cp3Se*+cb>{^J7$08QX*@r3(({6%Br}wReUv-^=ZH_j1JaRw4Qc!yU8OE6B|3D zUau!>AN61^=h^X-K;!(2jZd)@GWs0Z*p;V}WP1{G9sqHx{n#tu3cvhDZd&Y<)kbHPjVu zT<{898#qXW!gHrY5DV00N-0q|w-RoIBt`<5C8f*ykmm?=b4e)NJ4d-hEL1oH^o=x8 zCTaoD3O0{+>Z_`W18jVnQNRS+5?#3~?F!UwK3V?`Y>r;3C=0$VP*~Z@szzy25fw9X z0hFeO$}%~c{(_03Dn1sI%JkbD7!RNN5SIiHc#{4z1j_2aWp+k(k0p3x2< z)(}E+__8t(rT~(61PDmTx@+!uw^MgPvxFA_GR??e9lL$Aq~_6UahJORtgH&yXTK~+ z$}_17?pcv|kr(Dak+@4ER#MOQ)bRj`HZR-%B%NUmY1eWgCyI(#hziE_y*iZ4MB>wN zHrBc)jakLOnSw!y*u`xblnE39Lf!2UT<|GV5VP_Fo3-5Tm@Khuv84GS`wcV*8a(jK z)vARX9%iOa`B>Ljty5|{aU;E-@!yrl@l+)4E=m83t?nDsh@m`o%57mo9*G3y*jqMF z9FP}-(Wrf+^8ExoKX^D^Jm$vi?#Q-O+PWN~v1vJWe{5Xn$;p;jE`t)wCO5t|Vk6lp zuB13mPRNZwGM=56jgNTVqXIqk&E%T)vOfZ`r~@Py-N zFND8Drl9s82*CVB`u2vW&{8$UWt&7LOL&2VuL}wfVdsU1-dr*;|47;; zrFj>(FrVzJ3%ews`vv>4p3}@*H~Xjt`K)sI8jfHt0q8N3yVdE7kTE%{EzHWA5Mhvz zgO28zj3tN^m$?kvEa!*cLTLcSSIN;W;mT0RV2mjVga9RGIuX*iVu7oJ#+u8GC9rRz zdhf+e1#>eKcu-93)qio~YR1B1ug-@fmA8bTA?LIKoNo=I9Si&(`ZI3l(bj~iq}o#_F%b+0Vb@P2E2h6M(Zx| zX#a@#Umbws_wg%~?m#5heQcQQ$(i%`2q^}ldrMTLE6S)*G5X9zOIB&gOhZSY8N_lo z1ChJ->jKP)q}f}gNu?JH)}F2ZXe)8dTQMJOX2T?BEPplRmYPtKX{@y6sa$vJiiCJG zdW;GbO0oY{wj|!$Cu99W`um3OmGiGy^od{?px-2 zbUELIqJ%djpda1#A=xQe#Sv<<2GxrA=5X zj5#zmugEc?6Iu`z0Ps;|e}z!h=sFM~fP*&hjyPMc!`Gwzy$l&h$#O_xw1A;oN`JJ~ z9yt0MYisT{6XF=@co!4}t467nm08#EnpX?#Ydje6ExMEcO4#CNoXk0tlo75aw-IiR zxZ1Q&5ISReB;z@Top@5_FBDSmDp;PS%=w$|p5a3J{Gg&$nVg3p&4MW$TUV3IVl%ss z2p}W3%EwdoBt$|qZBTk>@TXhs2^Z}MueX2p0A zye%#J58%qgy{kxwR(JV#jC7&j!>a?dHviBOrsKT;p#DMJeN6nm(F^qg2US1#O-G)!SJ_nBNUjE6Vz>bYNppbV_LVX=k z2;4AlC*J+|J>k}%iR_WkU75Hdn4)JI!!B^{c{7|J#cO=#s4WN5;MtR7`w(pR#CA@< zT(k@73GdYZl^X>ak$VlRQXmB*cO ztR76~=EbZ^M>jxCs1Ac%;F;uYG8AuC4qvWAcsS6BLDglGaKRu&gXIbb3nSq@?Z)cP zOkl(J%0lUc&dI{gU*?a!$9g8tdk5(c|0>Y#Za;h%ItU04&PfQR7x zt0GsC5q&vs(+&IuT7!vYhT--j;<~DT0@nuFulo@+ugI^!#PC9r8fn^-CjQ!wvr%~C zS^CHiFE1F>g;!_C#oM7?1Q830vEP^LzK43414RVEo;;s`hoeoJ66N4`GXHQJ~Y_a99tgaWA?KLvi>yN<`_jTJGXQ zV!EaKj6h&uS&?R_w27U7)#@bRN-9@)JUP--2{$3VOHEn7Sy>p{Vl7KlRRoKDxbmG2Q=aS&tX z4T6sgw%{0>x0z{QM2U+7)DLp#VjxP8eKODEN8fhBx^3grA@$4+mNTub6@#h1jbhAX zDHM#}R^{K&ywzhp1V#5(XMzqQaTa0Co)SD z_uQC1WGaGs_xT(1dX6r6zhmWf%8^>7lbfh^NB&l;_Qg~~(I6JbWZoL2D&ph3O!Tugb4@qZW;^sB|@#Z5Y z_frF|l@9dJbQBb-%$u#T-`1ix#u`kiI&E&3S=%b>j-K)DRw&_ac~44F>(g2h@4RDc zYilw-zx4Gw9l;pF0^}zJ3P!RGxq$Rq&>9B_r`o#G-^m4O+EA1Gc z&3cZ1*q-l@AL$p!ozE`(^}h-U8Oc3G{Pdtq`%&+(&kJRnlTOPWdAGB)9v(o_EJ;Gbg|5xPZ(Td>BA%F;r-7ZH^M8u{f>UE{p)uTXJ5AR8if<1#BjRB%R8gb{@mmI93BxkwtB8% z+(qHb>*~1qAw7?3{q$6ed$`BaNOZ_J|IZVeh<}mfSBXgZPFlsL1y5L!kbwiejb3D& z6AmrEK2rI&ZD}jq4vSukWh8iX?Y&Bp4AXnx?Td|TAJp2@wD}n?`-u2G?w6?p9<6N* zmcQ?>bevIc?S7g3K!^1Ehl0IN%zH@}8GE#L8^fd42v9DJCiTq#bl1Ftb(!Kqro7Hz=cmcgReT{%> z%&=~KpYXfNog7o`jW2dYKYu|R+(=I!mr(!HulIbbbL`Hml%&Uxs(lFOD!l!A zS?f!HN-VL3^q|~x6;;k%&!h5;dNVhZht)xd%=18pZswL=o)BQt>70#lzclDYa6VSl zHoBhrSoEe%y9XB(aL_U1%X8TQbzU8-7Ii{(LFvfw+*E$DRpEUt%Xw^8Gf*XUv*FFlK8_mIl;Ueqghyzm?Pav^-Q(HC^W#xybaCox zhxC?OHC6Xe@TWe1(A4llDIZanm&iSC7d`aIlyPB>r6+w2{?u03pmN(oUf0lw_N}W!`-VY( zzzgP;5n5Y5m7&RDR))+tOAK~AI+fq1=$|^p#f!2^!bKC7{oKE0I?CMhJcv8Kf2?LH zx)w0P{ku0bt8S>ch(711!FW?T$7mHnuMN5Hmv$|@nd|(;DqhGvY4YY(NUpmVrmD->77dLn(dNb=%FVCN=ZQq}5dS$#nn7sOyg_kAkIozep{L(qE zCD#Yrm#CNUdSmMW+7mwlTYvHCqm{|Utct{!a1T-MR^FzihVnjmVnY&tgb`ztwWAnIBgAAgzl{!U=(i+92#*A0Jb(h+-9;t4Nm{*_35l$I`nL0=! z?PMUUL&rrUW$!&<-3D?q&5}K+Pura45ie+_qoh2(o01YNk@TQ19AMlnrJola;jh0u zD#pxuKmhga$JfO*?sKb)Y50%s5P7$-GALfs_%b0N4K`yK!U?NFHF+)J5Kq8KCiH0nIBQgo7El$hmej= z3cm;Gn55wJPZTO9<-$D2Yn3@#M*irPuLS<~?t2*ek>H(XE_L@%yh+bta|dF7&eWgS zo66D{b$LOUT8V@130Jx;@sX9N@^`OI2QMQV>jH=NnQ&gJWHr!L1V;IJM*(e+mHm#e z!5RE}r!|8}Qu!o<@Ay9}drqDSos}i9<%=ciU5^ja)lIrZ7%#5wQ~GY&r_CS;M)le? z2)AICVy@cM@Xn+cwpQf?(Bq;gU5a3@F60t^2dh(->0I-eJMy}1Rh<-5H+A%L)XL`` zgdS}?czt3^dBzk?9vNw}v~V@g{Zk8&T4u}L3%xyVdsAVpadUym+;oYB0V4mYtNfdC zHKH#Y&_9qqXFD(!^`I!9!REJg5xVzJ~T2On%5}$QYW9$xP30 z(k-T@#p6%f(|YugTf}3EB>v9L%XT85zE!)vS{A1JTf?m|f7fEzg@X#S7ee1W?it%F zW|xS<^EMtTitp^Awv-;WUjAt~5-BozYlq|a*Ezm{7l3ZcOL$5cQ zE6!&8Ku7aQ92>z}t>O_F7G(HZU2z}KbMik$3?GrewcrW)@b}tD;?Of5Pfyy-jKijm zqAjJRlBx<>_~ZvhN;};|p)kT1pw!_o@>L20Pncby!Z$wUaZn#Udqrr?EZO zo^!f*sCO{v$EKet3}5&~uS17uXM8H*a#i-v+H8xj>#!6FCQ)v$gXafB;e-IB?*gqb zqQBSUU9&+EWqxfbzZiZb7nV_(qiBe>DT;fQ6RdxD>$qqSS^A~j9kSORh~^cG+oR$v zXpA#w19d)D;TzoOh+`YMn{4+rpg zX8Lm-m0}ZZI;1U$b>IB>X?TAYvteEMSi)?9ATvt01ndUy+R^0FQe`t7+ zD`F_jFg6Brbnn+xBjRx+mEm4>kAn#tAGZN(*aH~;oU?%Wve&bkcNp7d@FO}c!0^w3 zlK!mBr(&jsy2Ph-3-;xX?65Xc=8J5clf7M-n|#8hP|4F%9u*IG8Cr6B&Y>=r+IAI7wm?azCo}kyM$&Or}LB z^HHSG(OQNM=2zNx|7S;$+7x*WMm2IZRf(7W@Q0ff1h6Ph{LETPvGkld2V1f^q(W=2gAhs_4*z-w>u_-U!oZZ-avRt>)nFWOgQ3?oCXJtPX)77v#wPk zq|)m6V=-#B->_|cA@nn0w=>#rdH+86jNETVaP|vwvs<3RIS(3Vm)O1oFQ4qUUxn7c zoUMihH4w#W<##LX4LES;3;IBci zS{4RioM%n z+ouY;oc)Qb+NGLes3cd46I@+<*xMR}nxX)2dqeW< zx7=b%1YoOFzdco(Oie+=LgZ~genoWu)bMLoG2(DnCtiU6FVDQkbR8ef>P`!wv#)X} z?||6RjaSEedng}(m_;ueN!bX1Ryncir}FyOVU`?w0IkZjm9JVjQ<$hbDi=C(f(17h zk1h54>Vc_QWV8|M1~`ZA38l@`f9A!y#-{?1z&MG7kwIAPNgVGJkzwI4gkF0PnH49V zk;OaHQkcE+MjiR^4*HA<1>U>j&<^zZ4oNC_r?yjXQC&dPam(;`*RCHUbyx8v+}4#Z zr%+kVUoEpfZcpRW@t=Mlf9~D$u}7j_AJRqE>P@Ot%AY(KgMLI5Vu@3B8);|QbpQhM_*39<>8VQWxSAmYzNs|E>EJVNUB3Y*#`}wXL{ru8QQ9tIj>b z$6rV@KtvyvY^80zBJZk_8sDU68V)@W2tw3(sd-dUYfp=QfqYG6QL1* zb3i&Epc(Wti)UItrr^GkkZ&|SKAx0K@g!DA%G(%YxX zcqk_*Q??=gDw~vSxnbswmT3n-y0mXb2Vc+)A0lG$JiN!_qD`GxUnHE6AZI~8x`u+W z(6-(p(_{?Xc2E5>3Pn;|n0;OKRMp74-;_|1(Ssd!eYVZ@IT>bW%p+()0?(P{2vV{z zf<^Wh%l!RL(l;BUEbBRIvGcaOYmMoEdYVF zd_QRo*nJFz3chfLZywK~m-}}p1P(BjWt0$HuK(%~tT%e+ZKYhEp?YVQ8L1G!7c;>bTd@w#{N2^+g0@Etwa%kEL6=(#9nOBTRkINEj zGlSDd-dmMDV0#*beDP0uU$Kq{T%2i+BqKp(g(76Muyc2Ac-j1U2%V9O;Y##@=21Np zdRy=9SHzWJE(h8M)8!RQ-G@K!C^_9v1_28N!)#H;d#!0K+o~D&ob8GXSRE14%!1YP zyN$cfuwZU{Ne#rC{W^sT?x{?c03V6A9_${?s+E4F zu#e53G|z7PR3#QGqy(ILtAvi)))CUGgiEA-iXYO2jwJ7QQygF%PrW7za9j0W+}%|Z z9W!;BtehFlO8r>?KJk&T4r-EtnC9I+V1yV0F*i@)Ew_6U6*^&`Hhf7Sb}kGRo=`AA zhD=+E?aHB|I;iHO23gv&MemQsz?Nd)fB=IqwL&6t`9-L_p+cdk<{PP0!Rnq?$rXSidNsD{vP4vTnLlkFUK`%+(=e-tW8ul~f5-F3N$w=E<2 zVH=qOC9M#{>tDi_ia!4x&^?YYz|?TRtZk*%vNx z2igiTXxX<7&e8pNMjx!2o zda_CX98qsK-rWFO*3|tYg3;{`f#B~l(+@KocvEt*L!~*NA}Rq_*2Hcth#aj3)1NtO z|L7e;BOr<+Pc~Me)0Io(O%{Ij?}Ax3r-?!ewPn0jq6?JTFkAB?QbVwc>a$`VCW=6v zlHW>fwR`q*KlhP&i*rS3uio?yxcG>^5@n?rwPCbV#3YV=d512|PPc?ke_5%j*ih!cjZ|l9AeR75T9{__CvM4NzP<~vrlurExj=#Dv6XuKkfIG8!MO@)*Oa`kK8GZt zkmhl}HfPD;g}W#vr`H&)@h&j4jC2!EwSC@BfeoF}Ad-6Soyz<{X-gH&zI)1HO?AxX z&+jwD{@_-chPK8ytexr`KLpv+ONo9t45Z2K(Jf9dPEl~}?xL1!Dq++$@-JWVt<)@Me`su~Vqvdo$q9oi*!F}_ssu<~&_ZqN8m+S>v*{(k zflv~8r&b+`yw(WWOwMsA1;ORL5>R_y??jma3eR1ASPtr@JA$?}t;x-8$33R^tLe_v z-8L{4B}g@RYv^lP&_Q+0WIrb=)}Cf^wY!gjTXk%XuyfotzU|dT3`(aLe5wBJ52(!X z3=H-A=A;^n7{Z6M!|JQ|$7&L{lDX9i-YWq^zp5khaPnOV6ZERC*|6At zam)*W*baVzE^=M}^_-vQ?tO@=>N(h>tn8Dza-XHBr0SpcL1nMu&2?}_7q$)9ZM}Kt zceY(t`_iTTnG7u?l%Uu&FdU=-Rw5u4PTexBW9MWA6+DU2!;@R87nf*^5NM`=b6^c| z?driW0PiBzHy&ogCE-!MF4{V;F^d$|fluhI)N*WpZGUPiZQ4^LtsJYEg!Arr)2pW& z_U=GYkaHd6oX||IcTTyP%GzvAX+c0R9%~kU;7Z zQJy;{kz_Q7_s%!&y(L<>f;~bnaWd6W94rCW>m8ZFt5?G@@RHPiC^GGi4o|HG583MWRc=c-cioYiZ*qMYcs&!|LJ; zvZZ`26sDb8j`{qrys`FqjE002^t2UT+0w`?F79l|0W2F^8`$qsTHZr(kgA3r zI7aF}{w5rN^ichput>*)7v~Vbcyftf`dTFUGe9uFTG-3*Gb?!yx6nT+soU{GIIAC9 zF>F898pmmz^7t-t{=KOPt0^gXY#Rucv!dDz=|J-=aRI4E?Ddm-u_iksYFgM3b_&f8m zQH%cuM|OnMk})+wusXDaf4(+zCX@d92hOYBGlvC0rWGVjiUFw%(lBQDvumU`o zV#5Nso^qg!aymc=Ao{FHLmmhXaOHti2ff}0*{|_@PXcT##h#pciogNO+}9U z=3Cf)1oI?PrJQMEohi`JUs)v!r+By|Bt4`Pg$sI@75w8;1<#|JSwTpTsOZ1-bjZUs zRR2@h&_Ka-)%ziM(tml|nb=|APZ*W!a@*g)Q9kR}o{Rxt1l+5udk?Qy{mldyor|F3 zCHbLl+q+9#R#g_AW(n$m&H&Qxg6)CCYi-Yg9c0v|(@T&{JMd-~O;`T7%c_(;riK~$ zrMD8aN-h_dt`F689f0T_79C*(oxi`*O0P!SvwQd~{`=zP6Zt3h9zDd_S3IrI+sD?8 zZB%7Xd3oE{Qbn!WyO!vB>X{yVBk z@~Se&x#@t-^Xz?O5Edq#gi9!Sb7V%Q2NUeS)sy2%MC@226LGNq;}1;Q_f?0}gBNa4 zUU!qpNct*?-}qzGr@%}e8opKSG!--vbKz71&;^?tD)JZi8LwFM_Z2ENzKm<9jG-fj z_rZgPU+e-Fv=^YLSJ$~&Q0vax1lF8ty0_)Gesr@Y$ce?dOcmDlILR-5UA3~dxycm{ z=(P9KEKhr*Y-ZGO_H}@Q>EI>!m`lMAZ*LhAY>pz4XEH^XVk0OGgrnpY7wy|OTFigM zjX7zXQENv7OHtYHiR0(}7}&D-!qI{d(`>u<1+Gr_mgrTLCVLVwa_r4X7#zlqgS0q- zTR!tZnkluK@b%{<59RV=-6gCjA?;beefKyx0bFCh?0;+z zNL}CkBlBhs8A+jJ+HToC!r_|;g?Tub9Twxc zc5BWRR2H2e2P0I+Yx`?u&m+qrjbF{awmw*-sE9BsM7+y*rB%{Wu6 zRhW7>x7-E*!RUMFI+k~&##CJYDhoz>VIyNQW98{_i2J@TW}q_pN2k1~Ep7Nm+dbOf zY9!x%Gk7)SG!gZ@VJP52LO)8Ba?F_ihrlprTKLI{_l~+w6|^b+nz!#jl10ds|7&PI z1nb+L2^>U>j}ganpDyzCRl#tI%s3g%91q@8@}Yj7H)kwgDJ@yPrxA!IL z7NF>bQ?D_?gl(MnbIuP`*G#Ox{$`pz|Gd_w|A@d7aWj`H&`*ENrCT_eDj89bsyF>S z^S0!4{p5yWBNT`L1(RoDSIBEaq)h;`W^g$Gx)`H!DiWS+`9)BFFp;ZlCk) zahZCXSmHILRA%RXuM_w!N+ZtLKMVZhShP2Pw=RDwS#VfZz_8q1JAIyH+X)xtai{vh zrk-K<)Ia(7e>#Jrd?d#ubkyyrwCg1B*SF^fj}T5i7_PK!eU|8U4+=8Yg6B-6Q=^;T zFlpi-M|xvR^OA$X7exE%+{CS@-L5X+N%bK*^Ua~$kx`Wu^lx?qN_R$atUZT7RX=Rv zis;;KqH6ORzNIi;Ot$a-+Ff1Xux3k_OZLT!X+i>KY5p7T?|8l#4jWQ`=zV2pRp|IM zGeL&Gc=V5QwIrmXpw^^8s|+HNFHZ3p#z3_=t$PC8K+a(L&nuz!tsa@0&mI4g@|zw= z&;q2Q&yY;WLCW)LC2|kFjH}`og&v$*lW88X9v!c=l9x=fskmY&cJ=cq6z1=NW>%}k zDMI$q#(@<-kJ!hVOV}bFh2<;LCV5cs0oF{a#BgjdJ+8V(qY&(Rdk)>yLFHZ}_e%mR zd5vOS=Nk76u`m@&C~Se;jM!lNsCa4i9Tikyc=8bKc1e$WHZUnV9aQkI7;nO@fAbi2 z*+6`j_2MrJKc>_SjI{2c0SAoU!@ zVALzKZsf8#%p;%BX3*Rk1qt?R5!lTVp&arBTkI4V_>}4yGrgElbCkW<;b_gK!;@W+ zI3_+&%0%*xhK$=2;41T@-!g2$_HJ2-mC>k#{LnW8!ch6>1ICSbNo}Fa>6eGAkwfKtg16^4 zKNura3iFvTUEh^M!Uw~jOM9g#6Wo|rUWp9q8aeU0XNb#g&631FdX(2gFg6z9z699n zR=E|I&QE649Y*h=sqHJ4X1u9$m;S28zYU`lcOOpu;C{=in&j{CNhtZt6$V!X!vj4; zut&)6T&KJa5o!(AZ|ya=fp0SoWPOU1_^5>6m8=W~>BOhp2DO;%F7r%S7~8XK9vI%C z9!fVO1p$KaHmXwKg3>xpWoM1d`t2C7B#=Ar@PR>gU~C8AzP9(h25 zpQ&dVJRZ>gJ3d=9vG%1f%OMiRAqgZcD`A@+`qh)T)mQK6hfWRz8x?wzP~p`&RqG~S zxBRiSjnxziZf2kTSJ!|hxe*uYR4QU&DndP&YJcIM^1P;;lD(-@1z?6SO@IQyzY6|g zTc{y-!KKh`pl#E~G&98B;)CWX`D=b>rG~P@USDuDgqU~&V}B~sKI|%uzApJg88TC; z0>4LcC&fWh3&It0#*~Yt^Ts@w#i!rv1TcNAhO#Yiok@wpv)zg-(eal7w@#1A*6i3G z1(Ht@mfc+`*4TZqV}gkq{{S^2&h9~^k=%bI|9}5>Z{o0tdb?pDxOJ59D)gku))$3) z(ogMpt=Qn|T7lp_etY-J;zpk{gV1j_F!DrfL$FHf(OUOCPP>^>e!L_M^&d#Q+FrH! z7{Z|Q9aFSFOQAAi&+L^rc&+nZD(R(Pcy#75@yYp%t6l|=fz#0MaM{GurF+*|T%Q3% zJIr0xt0V`qkhh_kL@A;uUlfqs78z`C3UM?3|Aekd|Hwerj>SG2?8skjbBp$$z!R?cU|M&|E(Xyn$Ca zzOAw^b51^euksflh@#U4-G@O1>)}W{{I|h)m4Jf461Y|aUn76*^i!=wzH8TZNsb0L zg}i`WiU}!~R6EGN?z}_y1~{#>n<#NoVDk-ziqzs5^@?ueQ|Z%FmVjvS32QU2*)l(r zh~%KI(4J!WA2Y{r$Qq2sAD87KxpJJ&146euH|jIdg4CIBW0Z;FJeMD)oS{536Af{^ zD5b=-a-pb^W7dgD@rnEKrxeIepopfH%%Oy$r&piD2+EXOxVi4G^e+4@jbUQEs!~`5 z(gF=6c!bC9JRdNfBRBqj(O^}OVuChux9vb&wFF$M}3Pkl}%#U zB~o0AR{b9n`SEDZQ^9mOfTnDufa~sd!x?v?6FqA3DJh2`yDB(r=P5*qFa8k%{4bAO ze}>L^5esFjJg%hKN`AvoW9_DSiqZk9o}o})aJYwS_WPcT3iC_iu^Kv^CmoSRf_2M7 zicvV2y$J06r04ntD^Pbn(!jB=q!-D5jRIuON;6fL=^GBJcfe@keu2@)IjZM-@7!Y~ zx?m%@USWoZR_%3qm2KEsgbdlIQ2+$j0GM{$xe~ET|1s&hsOs^ShyO82 z#Iw)7Xqz|iX_l?Fiq1`qh;rB+JT6s3p~CXO#aY?^46swUEdI@|%kQ;DIbo>%&TCC> zj?dcBJ2MXTti8<~f{(D=e$5b;1u@*|tIFY8*gsSaRRQ|w<>2xF-Af7;mmMC%7UMIo z6J>~T4T}`DixeeG2npi_1{+4j^(f!>Tc+Cfde#X^dbm5#`H7-D8ejcJ>J6b<`MK=@ zNDZU{k=Q}8mhsq+bQL-yR;ze9s>^;OROKcZ^l6*G=wI+P$CWDn)1~VJ_ItJ*g>S4V;dueq76zfj2{@LY? z!lO4e*4GsWCE0cz2r3kvGj%}Dar@7UCuo60^f2TgH}zjMT}bLE_~Uek_<4`hJ~vMl zP*TF26k+8LDe*SVm2;9Ju0Ji_ldDY3(vwTmI$^x*x%a{NV3LGFMRh->;Qb&}e#sSBp zktp$|6PX_{mf3%!>Sm&Y<$C{hQQEiGR z8%=p#{2Rmo*e0DvsdC#a@nS>d|2JV20og#M%!j*46*eZUL>pl~C)hnPrFuIA%f7-u z66@R9*Ketz;x`Vs;2l_e@oL_3+i$e9MD{RT8)I@OtNwt7O6-TW z(!)|)j^Mum-|MWj!q&V{EZlO~d+T#N2G89JbRFa-gT~*2_aG5(6GJFdNV=Z zobl}Igp^&>axMO;;pPd>M5eAT75l|(NZ zN}r(^ZsR52O+nj7_J1+>36ZE3F;JgC4cXL)9T#cMGvcF;()Y81mh`AD#UyB;vPKVU z>^XI!gMrQqtTT|J9HYh%&`qK?OIMl&$msl3Xh>!iP z-LN{!Qzm5jBzpg;Yul4>+YYDoo`P)5tGXrV$wCFj3uT;;?nRsc#OBV^S zy^WpqZ5yDkUEHszI}t+Dx+*yKy*vo<%erYZ@Nfup#PxB zygAP!;lnwe{Y+=gzVpDejzMhg*U5PO`|8%)VB1PPP9xRDvh07J+0x@9VsY$tkaqj`9iKCkKaBj+5UXR@O<-W@k$4vIXuqNQcUG8gyJGKr-cYx zVoGW)5d6cfO@vQ2+Lp-xYJ(abR2gulkyOf%dj1kr(R-G{il&R3>>=W?$5|4T!0qd;)0Et-zWjT!6Ea~Jv0e>9k>Jt1aoy9L!y9yj*dvU$jDX%0qx#SR{1v1KkebeJ z-1BW7NF)xVGJEFY*}&45B)B-YmMhXK`pwk9^b#7d!fn$~^f;Ca4vyrgH39to`Y(r9 z5M6ljz40`3`CZEe-8D_0K}eY!=ik*&PCB~wh*wOXc|BV9_};}1 z8od4@1jmyEMucBqE--fV?}$g*7uVW7xLg{r9g2%o6`66@w0oRS_&tJ_@VXM(JnMLD z33yMAFE|kk@+wO;PE!QXOmLX3kHYHrzPZmysOa_)OrAxy7^!hLw}Ir(5^v2@S#L8I zE24wju~V5V<1X$}N$B^-%$7D|?T)7R9q?V4AO@>|zIls@XpsOw2)CUAQuh}q=42ds zQgjX>V{!GTVKaGk(5ZFErEc5)?y`p&chPhhkRDaPCoFlY0dM3l<%RnRw176*tPbj; zE@HWsBL%~APKv{LkRtUT=>(egwt^|#sFFwY0rGMa##>OL;?iUHS)=@LnWXZd=}0IT zLTZ&Kgus{6=WyvgmW4PdDly?JKXD!CD-?#f7>{TVxpqVX@a;$)#Y2{lXv7B0<5)(}&zGMyt{Am)e^+J*4!_k)$u{s4KF>{2}Fqww3Wo4x08J5@UEQl}dr)$~mROURZO4;DGCmHJ}LEn^QyAqV_ z@aEw|Y6AZPQ=wTBSDjmzqDALChq$tHQWOxcM>lgGIKGKL-<{@5NdZ%-+kMAV;h@_t zDX;u(TY^s1BJVdZ?>~q~_qqxh#u|P19qd9cv>Lch&+6xdysX`m-0ldC={A=2piIdONExkI6g=P8loe7 zk6+XPy~3e(+D9JV%d3ML|~EPQUV`;F(*}GK3-Oic_#W-OKjHk)_Auw%aTJ!UVpUBJ1DLV zGWKQMXHGBFv$_~4yf499`<{fMETFq;=EBmRaxMVUZd~QIzC)>C7mKN9ikq;yXJ~)z zGGdbK#&c<2mKCyv?>ADM^THIj(k%9WP^Tf);khV*|fSsZoGQOp#^V?%{F>rL6A@TR6-}L zzm(%>T7w0NP;=JyY83KQYxmy%iJZs5vxMGW;8Z%OZbd?f57w7wB z7u>dCnd97+yH%ru*tkc`a-GbivJ5l$Q6x}@6klVZ8sNWA{hNVezbW`%-i)&>dH|WA zl~(@GH&5Zm4vYce4v}e?{^MtVaqGVwyCaC*A;h_oa+GmY7Osi3^Z29uy%>{#V{q}z zeYn!@oIDg`J(r+7tZ|U?v?6`D3lg&<4TmXYJwD%@V$3x695693@s@3Og4vZfX zWU9Wcz~EsSJ@E-Et`Iv2xzx?_{@c-$Uz}p~(x16MX-0g)MiI$3SYUE|kqWAa(zEwb z1ecs23F6@U_Uv@lWjQXN7jxXP0)sP0=)TOI)W<%U3F$yW&N9`uL3S~R`&H2P(4WH6 zP~ZGA@UWn4y^yS=$GGc*6bX4QjuApZg#wP|X3U(-e$Z9>!BP+U(&CKg5CVGK|M6id z+LlGv8tt9|HJ~v~2A?M(EWV2CTlwixBMpTzQzQ@~StTWTaZbo0!>Pq1f`DhR%s|#P zHbuSPLwy-COYM!yEc-a9T~Y~sxkaxGHF9Z)_WydhfBWsm53`Z%!7!0cBLs>-;2vLD zFq%>)ouUw$N^5 ztQXvKFF3coc%=_ztZ}1zUp38=#(8+MKW1Zn6Iy?o-I~+OyQ5a}Mu>B?%7P31wGe|G zb0kj?Uj)--%IU}>8>=2l0ybj^n*?i4-BBBP;=rXt2oQkm{(tqo z7Tqy+*wA1dZ=2-W9z)>6Cm6=`DcLjlYr?}E%}F8Wr*&JWFU!)(>QBp8^IXw$7ZCNy zR=FV1sU5Uaud*xi$=CPu@W=F1WvgceXt3TbO`Q(Yvd*ekyup+orcs^VV`onD;`vSC z#ms)9c{=`k_A?_lKE-}6U}rp_u-Mr}c`i<@6H2PJ5k%D_uX94G2@|)DG!O6VQMow| zl%y)!G3w}6{7xRXA4QzQjI&PSW!R`GZQPErFDJUp&uX@2IdI2!7tM)N`S|AW@?P=) z`sdire9iccVeW#QIcxqn=eq$MHD=GHSHe1$E7Q2E*E*{Q_A^vy4y$2*<^3%5UfqC8 z;|hyYz&>|zR>t^veXE=vwLX!{!hvb!43;Xf-#*$*&S`Ue#c>Ce16(H@=G?4h;G zTvw<)O=OI(tGyF-cwWVH|5n*Ly;ClQ?CZg5)1&fk(@Fvi^!g^-o-Kv$=3b4J{amFi ztx6e#X~*XBc1KnG(6w#!M3p(3WZ9r>z~N`_mz#Fhe=useX}&q`@u|5|;~v&eKxZ%t zwxuefj^fto#wlLbtm+aSn$k5gBGSqu{HYtYx8dGYp?5SE=@;;9m5glg-+6=jz8KBl zJy2$C&~SQSOz1Xxb-Zsfnm^PLxg+}-maX0orDnYtg4@1qRvg!^XR8Y~8ap#qOOcY5 z-qW&=+!ci{HbypsBIYr|yQ*3@lh{~9*dHPus#nuGRY zu0-h7ZNheIlc81jz-^N`Z(_8;WAqpeXU(ePJuFk7-jrW{4(`!)? zMGLcH&OawfO1zFMg+Xef7T=rfjAAX7p#<$xkCbRQ{=rN!#R(dxoba z9%pnzQ2(gSMsnYF^gI^@X-d(OPkAlrH1yD@8Z~BNXfU9-IHa8XTK?LPPbpp9fy~q{Fc~%H#cEED z9JzLHe=*s=RiiQQ+1y;?@yRvEUxVTizU{zbEPpVh)I3>6Cwj7pu7}-$d$tDqV*Nt5 zqc95TQS)yB`~YGTHo2O^_NL{-*R{xh4~_Js;XT{huejBoLdQwa{QKSU+sH>K)T?GQ zW^eSyIH6i~jiupjwOwr$b>w~H<)6#cTVp@$NPc&Yr_d{lo;geTF2(s8x)JX_JL7f@elbbUEi4HmkGR06;IxuyG$6vmQJmcglT9d=jzZhezJhM8Br(IxaNQ)Hw zyRj6**J0VR(t2?+M0~rNm;Uxlsy%B$PUz8|VUS+{Q%v;UuhM%f%g2x6iEc*3OhR318WnKDo7aJFo_u3*VneA{?)lEtqup7ee3EA zUZs+7+AHw1w6_%#;aVGQs^~l3u`oe&O2trXZDHJWzJX^hux7N!-}B_*$g4W}4a3WL zhw0`8{HA1qvuN#yec?I?_0vh)XZwN(2EQt_a$=EHO+f2&)HxhGI22$A{oFf^+*_Skf&x+55lT57OL?bSRv4`|wlxPz$Lf1VDL?GiG_{>V?3y{RY~ z7|$a`K#+RbUJFHZ#re)Z^514%#PM(bamW8ws7ac99~p;K-L#_}C5e@V8^?QHGDxi~ z1ZH$_4)qw#HRmx~^WFWwr$_it7+k?Sq%=0z%5V*@Z_g>~L_Q3Qj8$6SS;s0&)#cuP zqj^#8YT_vpIP;8Z0n-)aPvTmUF_^($O}IN_%zJDR$YCx=I80TDwq191U<%jVqV>@N0MFWpmY;wbXI=|LS>QbwZ)By>% z-^Mfv3`0dUCw? zKF>cKuREny$XT2q)jJz{d|<)J!}EVvukzl)&GX&YtDJty01rR?=6- zePYG}JFGF)Kf$Duoy)7a4ue_8ezKRQu$=I8K8()ZLf-M=LMKmji~jY61YgT8do?B) z!Fp~fS)mpK69wAoQVnUFYO6tJh-@KE@)QXxH zTrb$qKY7Mrm8$?XDQ# z^T5yMIXge>V>N$(He=Q=mqs+x&7)fgF`buf51-R}X0>RztHHV3j4p8I@Uv&t_QO_* z?@pRYmN#uNu;Rpy=nAe|^jFM(0@zO&vo)t?#<$`?#NsCsCi6AB z0q-nsc`Qplle;BozZcJ&GAUOy%@mv~jVO2L+r8g#;>T1m^_n8fp}h6IwI9t*jYUma zSA+Tsw{K&hW&*(}UeE(8V>iF9AXS7|&!dE!7<$+IkStTmFyHEfT+%FCi&^>dTuyywl|WQJ@1L7cyZd_vF*%!22azwB2j5p@|&H1*8h_NUDA z-$=i&ogp8N` zIe>!ZX143BB*-XZVHW&3rAX_2xZ(b8ZHSV{kpVmz91@8_MPS+Y4>fV^ztY}bGH{?2NAh_f4<`RZnlQ$+A!<1Xq#H)?bSb^UVDtw`8<|u z&5xQ`CygFB3ANN)9PpDYmWCux8R2<3eXj(7g+=pJ6 ziph7b&n&1%Jr^{ZSP^@++BhyNj?9lvp0Q$<)T50j5`ZgH`zgIJ)!EG;y+7h4Sazwt z;-SQdxvwNLXzF8s#Q_5+bNvF3lI0QM&zT5O!Nni(WUFmAeCRpIxe>8NX0Q0!EsLdU z&h}N#F@y0fgAFCu?Rl(o{F}KCO#qd%R*@4Bd;c2eKy274q!mtXhz)aIRiYVUWZx@LZ<%Rw^T-Yr)1D=JDI%uNWWIY=JQl@*vlFKou|2aQ(brC86kc060% zZNxlRTlf?DCa?Tg(B+PNAER#^tyE4WhXlpuJ-5l-8mpP@J@1hR-<*%XbspMn^pIcj zWpaKQV^`bs-08u#*b7Hx3&~f_CkH&5Jab>D#%_3>;!!d~M&=33^*0p@G&$^69R7Tb z7rr7G$*ys){oR}RmS0ryM#k~e-g4Nh{x>8~owiK6bNzagk&tG{k046t*;YX5=Ptqh z@;{J3ZL{9=`PgW8SNX5?K>oco#?xoi2N4~i4&Y6}udiTz)>u`;fwz^lCm<4Ued|rT}b_9P; zjZ^f%n>d%e0Q{_H;}l|&vyGmV&aC##7X8kdqRH8BxS-Fm>J$A3WeEqk!231w>D|-$*~oOiE<05E`01@@f*u~V{fo3WR%xI^pZxCVdu+cw<0y(a;PZ7Bn_ z&IdZO@w9K0QRPa7y^`=kFi4wgdxn>8cr~W*Bd$Y0UMosTpn+?RI5)Rm#6i_!gs>G2h}L(=H#d*)iPH4y1yQd!wPgB}Ul%G_I0;>_#dv@g6BlIQ=N z#Y(gjMNNfBmImNr99r`Fu;W@-AC6qe4oI?c=f%B~?;R*(4ou^Ue{Pym?EJyKNRVU0 z=vJM~K4tBJ#H9UtZYiQbF#OSJr2kJdXCZi`+WY-=kva=m-9T&eP8!AzSsA<&V6T; z9tSD2a3d4#Rsty3WkBmcwQQeT%;~Zk38~B1<9k%{G|m&F=8a4J9?q*#KKRI1GgO;} z#A?B~LrAoG8vp*X|AKwHsAbI+`CeBkhG846IQxl(q_6nFpdTqAA_sI-L4|dm@NTPc z2H%|H1@LfsPwyeAo3PVF-|^X%eX3I>iHjv6Oj?&JA^q_@*uY1WmFfM3ric#Ln;2xj zoRf1Epb}zkYd=FokciqX4$f|(sPuSO362h{*7LLbkqv{dtPrIq`*V-|u&$ug4S}H4 zDNE*&;kupRWH@cET$CwJBb+8`sA`ETWS;rTc-P)EB78KOU)7(g<|;F2L@hxhx}78h z&bgiULsPolD^T%+6yPQ)4coyJ@Mc4*Nk010FWE>IF3=u6AJ$G9D8|2#c=JG0H`^Y{ zmmVrAQ_s_jm_E$#9ba@>$}8ps54rHsi(bG%;WgY}{)MxLYFtzl(t*T<4sE|j>%Qmr zs4O9Zwhnni(wb$UXERl3IwO=qs_9qzD_nOX_j*z$a$^jm<`eRK3|UeUOVCnU-2D6{ z7;iE%-Y1i3Lx4jd^3R8LkSd38+Y}#{I6wjT8-=RxLCdxc&Js_wsy}fFeDueJ>=^#M zzhAEC>v9iJ39i~UTIUNBPNbsf+`QpjgqzqL$znco^f2NkRg}PM1i7pQeZsgJ)Egt< zpmgEUdp05ZJE-oL0P=K}c$b_Rc=3&GjPSD(!I>Oh+L7lLvlKMGifxxg}t)#;6FHEr&B$M-@m z_X*!8%p7V=I?YK(hr}U5qAVJL%Aq**V~_A85{A(EjKMQJZ;}<5bO$PXt}k}03=Kxg zfkC*7!E6wPPVLUNY!b`j3efaU?x=ooxIDOjovVBf=)b|_=H~R{jC8snQ1BN7>OHKq zfV@Kd9`^aR(VZ_JfPg6_Y}btb0oveT-<;aM{mIWfrz!%peE_b~yR4phxVI$?QGmwF z3U{+6*ahT!v&`C?Aw2tmR*G`kD85DHAgu_2<;~1za1f5|&DX&*Amaj%Du*)Tg;*CB zzhU1#2tB3T_gH~R-Tau7!l$&+YA*IOw8^MM zmjEY{@8a4kKMPP9Xp$p<6^2~dW~}#p|DO+5pqma8Y4^gDrm)Qh8`KbHxxoPh9AUYK zxE-@}!h5J)=zYvfUsqfFmbP@Sf@lyH0Vz^YpZ$5D0aS$~!0V689+T)_@VQf+aS-W# zP$36A{RxxH^+l+YYqZ3F;8&nnf5Th3J%&yQp~WQ0!*S5E>BHF_Oz_MqP9~gb7W_ zfbwfvHFsaKK&%~`+FZbFM^M0zfY~0vjXDpfdZTK<;`K1G4ykO-r38y%I&j!>>?w=F zpAQc}A6HS+Gd{^UQqhgL5^LA=?~xsee+#-pERv;0ye*I+Q! zSC>gvX|OtrBuJTw=umlrC7$Z7%YxF}ctR)Mxv81Mg42gSg(@)N89B>@B=0~0b7x;FlOOj z2vjidrbHq_S&0z*pS5cf@Gx)UTv>x#Pwd&3Nml@4N3%_<(+s<)(~X;@tuSQhUw0Uo zj#zO+2RQSeWPs9!sxRnl zqR{1o2!U+a4Nz=4dTynTDI3DCu8V`KnbCYp_LC#Z6cu}={2(I85Ssv(={nQ;!+t6% zd{nABL$trGJ}8Fwgy*|&h*ob!)8)Glv0YTF0ZyYyNMdW&WL{W@bZjYghuaM@fH=nyq30=#&3Fe0P$k-QybS9=b1#+Y4Ri{ToNy-^ zMTR|*HiQtnmYYl?ADNeQulSsD3#;@qXSn`%UPPn#svb<^&j$L6XCEfMYQw%k_L51Z z&Go5wgPy0kCl7Fz|AbSY!rrY-Zv^#i2)ALo_%fQ+x10vACM6#)9l|)MyaRLnWR9U& z#9$~^M=-JZ_d5?(WupGFA!4UH9C|;syNnTVqnes>hD_xm{U{w(AjcdwLViMwcOT7=}NH48Nx!_Z+Bu4Ib~T6>kq3FQFBG_3@c=A?)ztRD}|% zxv!f6{7Y#0z-fVb<-=6(PE)D~f^k|2x+9cy>Ara_a;g)6g+==tCJAD4)RAo@p<)5wN3^GhQ4V@SH9R0x#8n`Kj<_eHt)Lwrt}*HmJ(yg^gw z;Jujx5FV}r_%wMU4G7psc7twWG@azQI}s8j>X0DuXT}8Wr%O)dZCoEekTRb5?eo=jNCVk&Crq^mO_~OCtsdc^6~?87$YF$xihxBUT$03vLpU`K%JAKpKI? z&Q-pw^PWI|oyw5lzb@xZ|J)Pq{7xJO2UoYq5Zl(uz$YFK>!-58UUWbuUz%h{FKnCZSTn7 zqpk4KO+X;HvMOo-iDoJ+P%Usy4Xz20c33cb`ti8kukWGX@bv=EKN6G7HcbA)5uxgX zJX8!HEcW2&i*SSx+A3s!!<8|C_lD*PO z35{l4mPloj#jsw~EnLX8zkP19?gVXysI$rK%C)(HnL`>t+zbdYSU$=;zR!RJU+%6i zdy6#(cMIJ&ucd0@>Qp8SPjhz&jXCpb0rnE&c4(8u!qpM7`b zYjZydEc*SZp$LV~qZ;0~^qoi%oNr||)9zS^0v7Yt=5QAz6OgMm#cUq<)3K;Dhh#Y$ z8;kItQ-}^<%Yb5{<$}Km|GeWI+W#R`{J`l-5<7#Y*-!aS#Sw!BNuP&LmZu`P``XRZ zkW2s_n4%-)joTGN!gYFDqi2$X}MQTizFhL9-o)&*_NQMt-{^TSDy# z@e07fK~%#@K%tprPHN!;nuq%`a=9vzB-FfiR(~W1h0$gQ&fX55Xm`4E)IpPOL)Ey^}0@6Kadnnsjxqb zL2F&LGC4@3cqNtKvBp*3358eFnklq{{uAhIZHk)HK<>= zwYv8dmD2!18ZmN`J;%p63{h_)OE2U*!M+c@tO-87;!v6F#!~6G`MUCNgouicKH#F8 zu8CtaK5HYUzpAqGF=w(I)WNwDy1eQYz`7xeKk*y(vSUBJ9kLIg%=W?}wxp|F@rvcP zy8saFJU7hSohWnL?~FS@ou%O=h^HYR${T!+a|qMWl;&W9c~i3{Q-CalmF=u!WqEVR z%CJghd6x(hC3K}Pu$E`Qh#F=Z6OB!Wuwm79%c7;L_Vk5LNUe2?KL;1XU|zzbxu1`h z>^g745lU3pX=FG7Fq{%R$RXJRSp}V2wo`>1N-iH(%dk-Gb64WoJX)@+q8)ejRbT0) zfkCPXaM}s^WUWOPPHjCHd_oK_?QDIPxArTFf$-mQ2S{2Nh_cGp%d(0ekVl7i$b?si zb(GF`ei(n2o_k_A7u$%$0Ds0oWjdoWr72$CxhB1EdL!izBsx$czfTi+^(76>iL)ry zec;XB_T}6sMW_!Kb8g^_JP7r^{ZB9x%tGt4cj}%zmFX(~@W!`UejW5zH`KBwEjR{ruMFJ3GVpV8d~c^z?syFl&R_!1 zh$8$5Wr96v_X(9nxGQrGa_FBnJSHW)CvvezB{npqE#TKEKL)Bo%E8SJIh&0xbBX)o zhTPha9~up+-is||1*f1>OLgwS))SR@j#|gC*>7REcP43Hl zTy|w)BvglxTYE+Son*8ky!ECqrmboo^7nc$FXX?-<$C-6)qAI&+t}ZXf$9YOB6A_< zKAHO1Oaz*QLu=;)l<2WmpyIr3AWOy$b5 z>j{S|#@s!CYni7D6%i~+xcs0*yz}#k6Y`yHT?%kYn&`As#rDL5)(R%&acH)vsOj~4 zvhQ6|Jh#88-bNDNJ5j93GmHqz~Na<^U z0IkpW5vz&<1UdR&th-J4NH>zqJzz>XI{LE|4jN{sB^)!2{Hc5|SUvIsT$vse!1bgo ztt(X&K+M00S0dE0gp0o7L)?7V3e+kJz~_l|=d0-uJ`evQ`6saQ!-!tZvkM#@1-y59 zv)=6$pjM=`Egb#BShX$gY(Oz@t3{qQChSgKa?8#WD7|;}$DQJ{UUT&wWbT?mR#zbg zJVWG`6A2NyEui?f1ys&X40|~d?aEyEpUhK*lQjF}3yYwQVSqqr6V4=lE3JRKW1w1A z9C}|apy?6J072Os`^(C^>q68ldjr zyOKJ{eaJO`Z&y#s4`&-~hCyB6i~$03@gXN3B7;snj##=@Y=q^-OCROYWn#NV@;~?9 zFEqXloWaeQBEZK(i6;rGs&ZjYjWUwqdG zC@pehIsd;C!7}#(#>wh$sD$i1Q05?_b~>K*FVm|kee$8NY^H~9$N1bG{u#vEMq4mr zD5A1AwIOMLClNuw$4_8;?|tH(Z+vmMkEXS?(%%Pp9dboP{u?W&66oY$`rV2GDj_@* z;l{slz|2nnfTiZO>pLsS^UoBhnRgG&G1Q}R;smI8eXxN*F0KU=MDa8pO0^X(iSJ{? zYvKY4GeF*`L;6n-bCO|Ml8P>~H$ia;3DAT&3AXshuRj>dHK~q7Oz8e4LZ=qt-mw4P z3+Xgf)4jN-e4zYWqkRSis_T{m(=V-uH`HGcRWo%!pTX9?0LbldU6cB!6y0*5$Upl+ z|94#@T8Dh{=`)&~L*C_>OCw$j;oOkx8p(g|ZTZ~1bTek_j6Gp?(7_HjelVxsasGsD zL6Of#5dAY6(~CfBR83Dlj!9N#(w!KJAc)AY4oVBaBgR_7pHDu)7!js{+?(^yR|rR6 z>dSrC-vAl;eq<=ZQXr`oi^uRP4g4Ul9}D_wQ9<1wS>Z9ur>Gm0V9)JRL3RSZcrGutx3& z#YJ??+w*rn@K4WK^&mjrJ$je(%RA$ve!PU?D>__3O4RI4Z}Ko?V3j+rs{F`*?|XuY zddUtP^l`#iNOYm_b4Doc%`awj$t}6Y)%tD<6EYrhdGrk1p<3CZl zT)p}1y`r_b!IXB2#Aj-1OjX7WfBNj}jT{rP5~7aotk>-e_K5!OrKc&IxV8S90NEP06^pNqvmgIWoJEeeuce z_7hKiVb7MW%UyA#i~qt|ZTx8b+yP7Ecfwf$&VTitIabdbL>q7leB7Oo?1}%3k{>sS z9qq-3^SLP?)Gtb@Qd{D&m09!hUwY(!;c{QRv$IJfs+{GE<*#MkieqKb*^S|wt4xHU z=!iK-GM%>@gx@aXckRRxw#nOi0_+6oFtR#oWwtpH=;q_)w&Ev(_`giL(zV-o+=J%! zj}*HadFbDHUP?g*`9q}5D~K5GAWusDR2I-M)LUx#%X(|WQuy89{r|+D@`Js36mGye zEmI)v%C6WY1*99#L4)|Ja3nyqXlduv_`n3(XH=FC(=^xj>7!U3kD*kn}>VxpvyZiQH*o%bUt=_=hG^(|9Qb)nBPTC{^fg3oU0;) zJtK7rhMXeggK?T$!$F}Y|DD6=uBbEk0Siwb9(w+C<&P9$if>u@LC^TtE3~ch97bx~ zGIka1!ar##b`qpTi=WNdp2zB(A2Cn9`AWY%VVua@&i`j%hpF6N^RW)r*Anl1-fFIy zCx5hPbO$PAY8~8#M=C^|W@}na)7pm!zk1t17>*fc<@P`AIPo9N@-%Qop5FgFgRq09 z`w24=a^x39d8l_LKr5WGU&-C&#& z)r-o#Z%TZ9S2z7}c$b}F%dzf^`mHGC+Vx%$p}2kSo+c~b>=A1^<|a=t+PeFtPRdkn zpxAGFf17-cT3(!mO^mnpAV>Ma2IyPEdGlkXa$V?U&zx@B07~xl(Pn`VYg~m8UXfrM z%u>fTBlym9Vk&}Q_r=gB$8K#&+Wr2?9e=@iLx7zRJ4r#|%1iu$k_X*$P za2^Wt@vG*qYBINqZ*c_ z_Q$EM??GQ4eh3nATYg2i=S@M>#OSDt%cEyrAGS@v^WTK5u=dD6q%=(xK0G+QUs#vQ z^>1wN(R0qpTOQ{wRXluHZf0WA2%h2m|32e};B|^$>~I9S`WUedD)Th>>7;|mgx@4( z;8((9dbnWB%*K(`FCDbw<0AcMCI6q*ec`%M+vlLIJtkp;x<-2eDTbj^l@OP2jeAM! zED?mN>l8UA)aZI6l^gjRXrAb(C}x3XTuUnar{;!5nR7nR9@z}o!a~D zdi1+v=rNUh%?(XOX-NgpPI%`L5)z8OZ7wHmSw+~nkplbNer%jPgZqupCow|QcFwvi z;^H;r1j)co@w-9gO=l>cYQ7YmV_XDUNq&rWYlYwP4;R4`ctBRepKUR54%*G6M=$TF zQsjp9%lgfO$E3wKiw=1qA z%A6OFw{aL@3E>h}9p|^QKzGzIeW2sJnJP^9B}(qm&RsfZY?d{^5dO*KcavK-%f&71P< zyIVh@lDI&ly59BwxXI~ktS;dsWwWg1KOU(H?)JyK(sa(ew%^rZr;HQnVtu0~%ny*m zLR62Qd;s&IqEFOA{?qmD;nt!t3y-$mo-Y-&n6!H(D|2b*UG6*LQ@IF3sQ$B9k8v!y z5$g-WXkA1zLS%V*_e0i&C_A&ju#P2Becs$p%coauSY3ry#i)fG#Gl?e^SMhw@yoIu z>>^ud!@@Eb1E)1S7O>ItkJ}u6Y7(*_sfWBPMNy&$Pn6MBbZym8#HzoF0^NtN33Q8%7* zJ#cs8{Mfq~(`u#<2}`uvwy*b~N=NXNuDXAe)Urc_N;M80SFkxJaGJ*SikKU=ndt-h zX%$-|PDKGy`4Trb*tH{|YUTax5%-@N^^=oEi67SFuXV0eDm?OfN%5hQ15;vL#6ycx zk&l%iZK5KjI?-x76TBCRFQAo&wt^Z0QQy#<4VY@NcyyMkG=C-Cf#t_saMTN=Fsml#uJtT-@{Jwtd>ZtpUBQ z+=*)CH;~63$k2|nS8rbZH9HsZSZIY{CH&7SCBz9Q>i!n zc=`;DUr=k-57MK2?ToyEch8XW30_b7QT|zeYZ)XOKYVt`w?8L9PC=233`BR2oC3&2 zY_#<`&*;ba8N+~}*6UR)!F**C+7?abrs$L4s0>Nn&s&= zws?D5;`3fji6j`mu}NC*S;=F6wsr1b_`UpgvbTx|4x|xRmx4u9W^h;h)6ioshAi-_ zet}Wh%MHA*yYe_3uf_yq@zIJmuiEc_#VT)X{UC=EtGa**l$8;{n_u{~yqO`gFQs}$ zGlRi6-?|9odsAI2RhnE-OFLgR%h&cw4qKP)Yj+i94OrCH*7muTO|EH2M#rngiPuo` zV}?DO{@3Rv5zVokNg()pfUP&4Ds68@uCprL+#rtYKY9J>#$0g^U*I`k(Aih70xnSs zM}ndzJn6{4-K7>CO-Glo(Rk7~M+S!H(>@~5+TliD*rZu^=KfvQuS=IiVWHO6%te<% z`iUkrwUwzhGm}{$5GUf38n4e4HItuJ;V^#1(C>_rGg-9F^%-UHO&lRQM)mCe7?0c9 ztUw`?{@HwSeO@Fu`|iJ%e=a%QH~S-6&B7_2IDR`&R59*gRHZvxdLa%T%iJ{O-p7IN zVUjF8>>i=7`&2w%RHk+^}g!T5UCTd1HQwA(f@}=|SNqw&!>v z>;%6tE}gXqBuRNO=PQ^fd$m9{A$+i{>=QsKDS_UL z=yteIwfrsK^nVp_Wldmo#Nt90N&QVu2BQuLA4nWNotZw8^l{(H2ZP6nMay?hTvva` z?D>MqY%}gnU%u+1w;=#QyfK3|0K6R~srn=2U2_2=;2Boh)!r@*D<^{CcyyhA#?YTR z&4Z^opd*kB+Wl=ZJh3$0?i;6&kn{JAossToX4!JwsMKQ6O^FVt@Pzpv-yHIri5jLm zoyr4eQFSdE<)V|NtIwH7_Of(i$VKG?U_o?i(EE6LkPrZ%18r!2i8-ePerk$wtj}te zk7sxxw`a0dnaIej$!iFX^km>#7XInnp9!zo*#jf>_%13J4}MV@(6=i0gIYL}jI2ly zEIScoZr#)+%jYza20>P__+tlWbX;@K2)5QLYRdBkfSiOCc6lTHi`sWg zDidE9Kv0p;=S|W<>5Jc)T8ql=!Q4A{(`u>BQcV5DZ1YEQWSO4c<7O4U0m>I6V9VbW z=XiOv>@tbhb}BZv%U#sT1;6g(>Q)ME(ApX?nOEiGv-wf^$iu>f zk%vL%@pV20KW1oL+a<%jlMDtL?1aR+2jDSIoM?3z`r~10^f?7V5@VBPCqOz?D?@L- z?|I`>aNf7wWu926fk>6%=&2;8f7qw-ll9Qw) zuT2^;4huSHoz8>(nOl}7XSM@3gwG&wLtJo!6~Fj>{F5`?*zgm8dUW7{(AW~Pz7k~$ z(zo|O4BFO9GnzeRC$6!_-y3WP7!9H1>ljWhQl<)iPd^`c6d*eX3(NiabXsvi8b6Gz z>j}WyfTrx^_vMZ(U9iOYVnC{S9|ELlaS9yf)K-sEO4; z+(LuNE9W&;FljM}QUGbf8Ol?)5c-IT^(Ni~^xLU6K6FUsk|3Uu3$wn|lgl+V zGf9n76By%y_9{WMD~-}T&0RsVH3Mj@px+czh2?zWKmZjudVs{twf2{*PAeN~<`=6_ zMVhKxw=a&Q^@yE$?#mOvHQjqIvN}zE^Zs=4p#4%vk>z~*bg+M)RGN#6=JX);?{^Z# z`KDFy9@hnD4V&U|84W*FQp)leZZ>#fjB;* zny_QA(5s`xNb1pw4z_Q+39b+PS3+v~?=83G?tK)qK`Z1Mk^Rj+?!k6oPj^(de&g5qTDyyxu)V6d zz>KS_*#N=_&#>zgP#);)G4NfYf!Tl|=(LsP@K~z+3_;Xm*(rlue;UaW^vYHwsaR8NZxu-mAV|WonGjVkGkOpw9uT>Ub1hTuXK0!k^?XsHC-+l%_n!! z)RJ*=<}oT!tDY;>Mtd*OmqjcWOOw5tdyimbhsi;3p2^G)A4`sUg;EbvvY(?=>sU=! zB+k$bXvll%5jd@Dy9M44$Fbqo%$*a3SVzC&7EUizKig=X>y8s^T&*hAe*NAY>$G9f z8^dJrDYxJf+OUUq(KcFnfiG1NTmiTNA9xsrHtogOd}D3bMRmOy-I{1`?KW&VF|A%Jl_`~oN2Hpsrds+sv+_;F+U@K0O9fR^7w3#LmN`KCXiRaCl1&b* zS#0`4bW&-zt?$j9(_MCGDo+a>yu0a+Dxp)U+qeR2Tva4P8z12d5aa3Cb}pFe?&aq4 z+8QUmlV8mtnJ?RB#>m)ANmRZmK<@<&ZW@sKHAw3oaNeRsO{$ij54R%u{?HQ1;BWAT z<@f2{?i-1oC(c+z@>nDnZ^f#DMGWRv%*6K4{P+mW4zi-ocB2(z{Emi_{h6{Ie99I# zGj9TZKNp|x84w8W7QvtpKVv`2jvMxrjTH(yq!spdBm=OV?fHi12EQ-X7;e4s?uq9} zEx0)(&4h7T$lr>br+Gd+(IbnU>|IM5T_5+Tco@G{qzQ{hRXexiC&FD>gANtC5IU` zhvX=`5;FL`#nF5Z2wtqtC5uBY^$e5f8T4f&=i2p@A9g%tISax907{~Q$a`lYu_S8Z zv!N+^eyrwihhw6xcF13HcM1juJC_yA2G?9(GJtZx4U+M{z@N_?SvtiyHBy^fq2W#G zmV#vFexw)cm(c>JWNQ8_Y8l^T{?bJ6l`#5!oH0J%di2R?&~x9jCk$k1v~9{Kob@K} zkA8ozw#-2>JP)xXVe>gjJ(?C_5}ILl;I4fIiLXf9!Gyev2l4ynxjyO66@V0y)9Y%* zS|&VHUzJwSft9a&>D2T}X=^(fKr0d-&%KHt9#}%Mln|H;&p@P@m}t8BxodQFL{_hE z4vs$gJH48oXzI3;#>qNktblT|n-Vw<$L;ta^vM>@<9_2G=8psy(V4X@3;>V;AKj3b z)@t3qFqqj1&Inwu+&y>wiwt(t0NJNSr(p`(Z8(I>vBulT?_HyugEVa2F4L`#7!7fu zI`$hrnD{h=-osy?(@pSOG4lpea+PNTJqP(}Ulq7mn{`I7~*ip^+=#zJIn`N8h?GNBIE3W)nzer7~f(1y7gg;oKz}pXz z2fQV|4Q!H6xcyBDJ3|#h0T*hu4FW0K99ZVsE7^NuxM-$?$r3+grnequK-4LlP5g!g zsO1ptO2~I06jULxPxfBbMr2n+T%@9jJ6&`t9TVS9F91opVIP-Ud6mXrc-Y>nN|V$A zf;^#I%pdSc-)~C*d2+hgwP5I3(uqKk99Vq>=xT-6SkBhW3lKUQCP^ zR*P*sYloqkw40(TZdaG%ZoA(h!MAjdxz-VO!%z&(!5Bb_2pJ#v8>8=paA z4O%jNcS%4+lWjFbd@sM_r?+oAc^27zi*HEfw&qMy5D_s$!l0ZF-ZwGVL3U;}-^}_O z7MF2KhE0ll3bT|2c$>F$W^V@=(?B=zsjw^5OSR3K*gf`{@2$r?KO4H3%GRRGfV_(% z!Bz&8m`;99m*&f7le+WdQgz#XqTs7u!-u^#9+%wxRhEwshxTZeaeNsV7MFRSR`@#! zP)y`aA(IvN)08K)Kl|U)dr~F^REK4fn{WjEP{gq?KEqs4}MSnF-`|i!G%jM*%TB$sR(2rFr`oNco8OL#gUv4w`>^obVEQ;-N7?S%o?*v&o zAiyb0loBk*BAe+|sHe1)=i-(P5;Hc%2bM7gR4C=CU5VeFIMv#^@B)&WZ3l^&n?7B~OfNlJ5i?qwszwJ;$E!9FS)KNwM1 zn{3!;@JZkLGl7^5+8CPQ8Yu=ZBd@I-&HeW(;8x!5B?)`%?*!L)@X#^yhIWQ4mW{Nz zZl!NGT&<>y(Id^^YUf^#h8nr7Ov=901F%-l86f21dNnTtiEH4mXF1v%)oCTfJeIWs zIHn!PFfcivc2!8pL_5Uyf!SUwn%$4 z&@+D%+Vg;wcA#yU8^UX?4*PEdK9@Xi*)i@$8o-+Ycl zot;FpZ#Vp$4c;Ou5ejlN=r$2i@E$o=-fs2%mFXh!vJ51-$;mR5$JMo!)#c6k+qf1yflYqC>GFCjY>TN zi$pR8?0#0eAfxRev|HWIP||A@bZ$f2Q#-&zAq9fct@Kx zt*HtBBh(J7)WGUG6kx--`0s2NZQ5aiS zyV#=BU9vL>d~@h|e3sVJH$B{)kJ%Hb5HZM1eX1K_msEd1;S6Vw(bK7E^_;9h3qEMU zL)}AMdsFzKwWMB!?}19N#nv^oFFH-{=bJVDVt$MnSdO%*GxjXMf7TngR#yes`cmtn zZHLpTlglAVQ%=DaO@O)$T{kSye<}(}!$D=)KcefXKB)lf3oe6bc~)dbkzxF@>{2-5 zfogKV$@cN(OJH)JsT>PVy`(h1X7R{|b*aRayA{r{ze%0TRu;wm8u7*VU_|@9(q91a zSt<9>4XIwJJag~NO=#f}(jDHXOL8c-iS($%{G`{sRz^c(yvqg`f|MLa^FL_zkO*>t zr@nYNSNaB~*`7N4c7;!MB_y)89O=-z4Q_0(j?KKXTq3^_*`ork%<5h0L24s7w=&7)!}p1wRad7NB~hZCr_@HoR^4W~JCExdN4k4HXO zX?s3s$Zes_oTeZ+!=Gzc0N z>T9JITB~hFaywkU3yb=LJF_I>J)+QbuqcW}aphf7@w)I~fLYZTkdA+!j zviI@YcjPqQ@dh$P&j)S}^oe=3ahADqWBC<8O{J_K$d{>KxX>`aobBg>=Y(9W@bqMu zp37G~>@x~g+5kXk&EXaSG(xLp-z}Z9B~O-yfdDU!jsl8Xm-0YuirlW-e8=miVuvB4 zEoQeb`jF)xZCPGK8E7WM{sGZ2SAXZs|0zhE>_6n=2B)8niHV#4n8+dVR|$j{>=`I8I7fuJ37I5E z^c*qTro`T|^_Jy{!0(PgA^HNbG(XdPPidACxwOp+M1Ap4M~y zZ|gK;2}IG*V!el=m0_nkmUz@2XofQHw+A;5l^)hL>q2zVX_{#q$zhLrre6`P=W{OK zy3;3uSW1V`YwIid5m8KsE@2^my|2>^xEA!LQD_v~eGaDNx3p2%bj36cS|6yCp&B6( z_h%q#|E*^!eO775fB+#&JEjiFj;+hrH|P5cHo&S!HH{AqdX+&f`I>yuAQMLO=jy5} z_V<{fc`eUNNMo{`MwcqBHN{SJ952Y&BgCH0nqAzy%fP4`8VXajxX0~imBOVd5cG}YcL5B6ZEZ7kC!&mA$(nbyvW zvR~G!rD})0_aC7^)hV9eThB{m9kR6?JYQiH3a&g#dUan223w%^rn%^+&}*UdoVRqQLk1NDuVhU7K%BbzB6g{0^sgMyVu~M zn%Tq8){jdU1$%x!b@`ez7_YgUF;FQ3S^TvzTEKxqob~arxFib{)sXYGTTmZdh!NUt zcr1_FC7DrgD_>OH|HN?163AS!qXklA9~8|VTB54#gl-)iR-+{eX}HxT`?B7=OuIM6 zt?c9r&8zuW*xD}|DL3#4NeampYNt*w_Aj{T(WQ=CGS>F04)M6H&#!mHvN2FAgZ26B zt%TG~cdE$?GR;^~y-ULqI|pT=GPQOc2nv-%PaRgZ67PQ$L<8w*AFG*`yBLQ44?J!ylu$x zbG+ECEGeB6n4YhxI1TwAt^Ar4zzbm`9}Hn*`U&ms80Kq7b#f)oqPR|}sL5#EIc|o- z-8kYdMOLRCDRTuEqn$nOz$6-(CAj~trGJPl0qicc+z7l}n~@9bKOIB>k9Y4#8cS%V zuK=Ms_f(U8ZrlLy-Nl=E4RAWv_5j;?cc2^!#dx0DZi7Yqt5ze4qW)?h%jMECe1L(i zVzH%;TTXGF1T$-ShhRK&SxXLs-ogfM_>{?I@6bw@sd=wZxREjVvP_08oGxb821-H$rmeBU)wD+Z0+=uN1z zBP<|v5U|*tIsVTTa_koIP~|@ldFeMn^#zRKmFovN{fUO;LFgx9vBUvP{kqy;V~Mrb zyAG&o@MOVlZ-o8@T{wL7O%kM}9Sh5sA2}1FlrrG8NT&f5&N?Aw2JI{PgoWCR95Mui zH3O4BTagwzo{kMd9qiOGN6`t6Y3G z`K-9T!=PSwoM$e^)DWBX1>o4(>jlFo>NVt$Y9r*{$e4ea7&G5BbcRJlGyt$&>g}{^ z7q&AL)PG9iD4jzuD(2op0Vlz3A8nu3oB@(ULK2ZUCe{X1POw8LLSR!5A4uhqtQdgG z(20=YeC+CXG_Wpp=_8UN%LpTZi!N)q1(p}42|Y4jRbNbYgmOaEg-5zNU(o{83vCqs zYlYoEOnS}&aV#GxL$O{8KR_Nb%kBEJv*_oG-H2}dZKuW!kv;~}X%eqts^I;vWFV;l zj>8~2NLHvGCkRXt%hMA;9M2sf5f=q~B+t#7`M9r4DEd<$^nfW3mol9h4Ob7ALpS6d zhz${)tZ?hjQ+((CXuetWi`>d)S7+wqvQ5Yp5+_Tfpq=5_N~^3ZB~W1AkW)!hM+l8V z8_^dHy;KQ^2BLt;i1PD+iHUqrv)hx+to|L_zn)7X*ler1%K<3>4^r3MoTf6x*?zha#Ky4XpGRrE zT?s75Df2HLYv=i6)a3$V*4U+^d? z94y}xd))?Fny{g`@GGNT>8JUuzm+9`Dpae0vTzMAhdaqLx7sggPbcW zAHzQlMLZwD{6&sEI#u`QMeu{+HzQ07`pV*k&gb2TRSW+nqmRLoy`swO{SrSE|FP~m ztJ$N_mj-Acmd5wr!hk_n&)QxcU(0+FPJECxANqagGOAcgGvwM;hq*?Xj$FbT_Gl~N zG$BWT_>SK6?T6A1B2hQDl=K_2;gOyqx?or`IZHbbQ{_Lc_ms)dUw}DiG%-^`M{P&* zIU~g%u=vT`X{fTv7kTdWjt>KHD9z{TPElb*`nnK$T`FBdhuQI~3V7FLk3To+WbMYx z66}U4DIu+vAzxAq=#K>SJY@PHQYKWhQB|wmE5#*kwU~}vGT4h=R8&FX;AF$-2Ge{KX@ye;??MUW7X}wpsUIrXH=HN;r>Cu|m5G>0MQ2wt1u>OSPa*EG_ z+jSu%zADglE*r_v5>nZrTxdD{oW!U5vDb_^=y@epz+!SxbQ&ooCwMIqn&Rk*Y5sg9 zr+@T$F;_qglkxt7DtH=37a5?icyC>((SLl=JbJCLQH&(rLs#-_PIoK%%X_>!*nOnw zQL(<|=tCn-kft*RdR3jPCysmiN4PZV6yH=45NNJ^o#w1+jH$=!mkY1eM&w7)-jS1m zOkUaa{8OHGt4B9CD=va9j1~NqX%*U>N*-)2%y`m@i)$9*;AHLLky+)1G#(no5XU?i z62P<_#pO!>qi*s)-Osj%eTeNr!so!-k4qJ0%wroF3&$8Hl!1lP!2J)&|f5?kUR*pv#@KVM@2c*tUwRIP-2v;Cv4L=KcdZ){00`1`$F7KMYfVtD= zw&`$a@H=2gF$}g8|LE2fLLfV$r}(Wtjp;dn>jKlQ9a*nG<-4>B;sc(a2b#9@{;ug? z$VwULy;mwo4b;D(%W&=DL+CFft)v@SmoUz{2pxURC->VS1(acFq|@z%b#;4!7Hu5# zLGX5~A@wF;kF?=C6Kf$w4n4)KrDe>xLdJ*OMSoi7hD&L-MUttu!@NVo93? zK!5>!W3rij+y3NYU)2jXAo@ZXepsdzg`dyiqDz<`yU?%yCKj5IPv$x$ra?m^`8hJ= zHpw*?kcIq;GE&5Jvnc(uj0Fijde|koZ*8P{D5*UI>Q`JM4?Qc>Nj+1K`L!yKsM7*1 zbI8Y~?#_3fvc!_A80{R}c7xiHXc8>5l1Bl%F2f z{Lm85udlZ99YXVskyUEAohU7Q^`GlL9|&bjqz?DZxa9g$^f3fE4U|pKl#oH6$CU|d z47MbS+rsGT{#0A-2jAjKxp*rdz5)5QE8;|qTlETQp5v+{mvajir?%z?-Kxk1Y(Teon<+*6LtRc-UXzq`> zNR1g0xgkYCs&3f0odftC9&NnIS@|ayjZ|CBO;3^)@v?TTS(qKoj_dG}1WsLwTm~E( zlD`n8F*dG}1V&2MtW~`X&iJ@!4katH#eU$FvXCPEA7TT99*44T@0qDUpxmX@WJN_a z#%b^5H2WQj->7z_;dwK*=C=FY2spm|Z|crhKTw%*;P-X^s$o5Pj6cT%aarZL4*@e- zAqHVNZl+LErEW)9E+~mg!1QKav7ylX(M+WP?oABv2tsH;E?A30TiaI3?xD{-cmAE($o^bqbW-EKjP4ar(`oei&i z5s;z2fEW*-yh}y#4pCg-+W_{J_FxDfPCPZxz0cc22nyZhct)`StqDU zGLe!zS`DpV%Y^3k_*2JO3&J$V%YqEAs6NnKe0qh4Yt#*JEkILD)cob2$(?h$rY6Zf z)JQ#T3-rHzyDrV{LUZ;LnoU7jK&xVNj7jM7Q_SHssR6w%^nJPVwUX8>ZoJ(W z-os&+*zzh1q!i>!{ z(k=;t`+;VYlb(bQ=OX(OGC&gQ!e9R;t_qE>LVI~a?RFb2?99FUJrz`Wp%Mg6hDvLI z9}olN-Yi1{Dbs+wPIDJicOX#lcnow)i+T3?%erQLz}*7ZV;Nx}Dhhxb>i#D|V6&^E z$TtL_SGt+4uvC_|tm!!XQ#bmz-o>aYz!6LKjOLHiQoF4;`#w@o+xY7f91puE!K&c2gs97Crq~Rd4AbyE zcp;Zpr`SJ2_7_p!e1i+>3oubCh!q)QYZgQH@#B}ZrPeZ^ff?K8w%Vutbx0t$ZqXgd z(>-7c{p%M=hhrxqEu&Bbbfmth{&~?Ld1Sp)?oX~L_V*{ZC)PPL#w=q+O)eM^ zFSMB3)ehE;5~V64be}X(RF0j{q}Gi@AXs2JJ{v9o@dBg)x5Ud^((2 zdoJNSk?x_zDpm!BSWa&dHTB0F??wNwz3cF6I@$K|dGBS{2A16@h#;tdEFhxvrb`nk z0*VTu2vU@$ROzv!2pAC*r70@zBB7c{6{UnCMNoPXLIi<;fC)W$Gry3+efRwX?>V2( zy5To7XU?4SJ!j5LemR2^oZ6X^pfUWM@JHi!ryGg=A(~jxqs%@9@lcnq%n$0>rFmaB z*|gfJ7jG1jio8l2i?my)y@jVr_k>V0)4K@|jBE=8)9o~h@B@t|$9n5dHtiL}9q zn=_9mFcIQ6`2)k-|6FJ&2#~E%G6^ejo0+^`e)AtoO)k$YB*KYlm3jO^!Sln~zlA54 z60ugn;3XecUI1oR`Y!tBlt{(7Q^gDkugdEw7)+b|+nK3^S*>u!+qOkp%AuSfJ}vPQ zMwPYgUA8KGb-1@%H>vc6QHw6lf9QygEAO3|7xJnc4bP?R#(0&6G7gzFnauPqh*XG_ z(v$GLB&!s(kc`LZS4Uc~T*|GPFgnq8aI|-G;XUqr+za3*=$;JW6L%kyOXsr;cnoa1E`t%R8om%;5W|l14 z$CF@CAd;l%qu8+2aouBXdkL=jo0~-&`T7If-gvP-YOxo49{zi{Ke}&PHBrJmwD@(c z1i7Br7(msu4JT(R&($kfn``^{F#JOnUQbjJ?H0zhHKO~%7xZnUt%~eK^M7{~`U5p; zSwsDHvaxC~E~7R^(SEA-GyZpe>BzLM@d=wGS&hVE?}H{`(?%y79p#FDc$1Dg6vdIs z8%lh3MweXhuA}!T^=W2pCzt{ysukM&9Xj~^-E4O+3Ft3)#xp)abDHulB*hO%SVlUf zG~Bl5!_Y8Q@;obV4xEa%k|gK%mRRFU6HEL9V6NkazxJeIW@{=h^*?_=?p8w=&IhQ{ zMT)HbyXxTFqS0bDpjMgwzUE=Ex1aIzGj`0{TkHEyN*wj{YUqoO?Ne|0Jk%vR%jnV? zu{!c9SDEl0Oi)-xT4TlqO?Y;k8g|+-ot_=@;9XDW6|v7i#1ly|;h#Q}=wNiq*^Z%N zt+C9d+{e3f?36=}Rr9Naesyo7*NEF~?Jl;1!VOx?u+cdAc8)#=nSgw&dN-&Cjb&Jy zy9YBHGm$(zaDrG93-%8k!LMF@J?4Xo=gOz~Z=X>!bIrpqq!jJ|#?dvoz_`>wO?}YQ zEvM7zUfT8oPx_|dLLO9VRF_<{@Hl13ql=szKCYyAVtx+5)MNf)vE4rc`X$g>lQU-= zOPTZ-Roh%Ypz6fnp~G#4!(aNB-1D5CD-C&(fZjb50irw``g-qaP`)lwm6t|3;D5#? zj2*I9i|BQk9sCo{^dvYbVHsvI^VFjA&D(RsQEkHj8UBMybtGe8#1d}ZM?jJ8r|D}T^tDRNr3 z`I(IK#WQ*QK`*wCh8?QMmGhDLZ5fS|i(X55cQitMleYClPlwN=F9M+uONagE)7~hC zX8SRS#H>q0ou6n3lIDhzqnJVS$3vC^OkR!VsLZ5?ZyaKbwN&arvyi8Ygk@4aLZ|^I z>Ql3{#cgmRA>_d}atvc(f`t2c)lGAprqmlWINjg*gGOj%(&Be#QUbH%8f!eY(#N&- z^eN93O)mO0dfM9+35U;-Q>t#B#8=I&lDcVAXWRQ%$v|snmvA51tG;hMVYyf5?Lbl#bkw2DjwCog7{VHW0*mhqy#kpPa?QL*J!1Y=)evJpx8k}oyB+IDz9H? zOagUYns5=RcoYzp@4zuV{hB5 zHJL9%zsfO3(xH?cfv;Ha)GHm>SNyu^qkChCPrqHG)?3Au(z-r_!3@a znw%1)I4w9B+lFT$0Hi*Vu?TtE?5=W5@(4RPu@|Dwk?kUl3T6{V*JdsKdBE*fYD5HF zB&rnbGzA?^MWPz1p?}b+!GA<=*97lVwY|_RoSE*q*J!)9h{~7JwQvexL8&WUkG~3C zdO=c?IFs{6C0xz3=TQu>amX<=)u3E;*RgMDlOJ02$q8~Iq2FC%-dJn4M*g$#5+s*M4SCydm@HkV+i7BC?!}C48C=NPDPl(8;AZ#wO?YCwnqjJ zOgCyQR4*--OP_R{>W#6Ly&61Q{AnaHoH!R4LI=LROiTsFmgEit&>KccZ4jqH#R%K-?S_L%6k9K&QA+Y?{6CM^;g)Hk{sod|E`P@EXnXk@(7o@ClcKPa0-2t!^UH8H<_wMHHr8yyONv{_ zu0hgHB;OMjK3~v#3`sc$$q8)a3V;6ayjck)h~9J;nfb6(f;pZNI&{kfE<%WXS8n%B{M3uSk)ndBy8X+jI;9jT*X9_J#zRcb$9@bO9fC>0;bmf5;B z+%P0G^|YH!JWk`lE`(B$q4TqL?-KbE)}MelmX~nzh(jICyJr9=@20}K;a{ov6Pc7Cm@68VvQ!@W63rt3&||JgSP;7A z-}bj)%TYu@ub+*SKDUw22a#gBuFZWa_F;Z)OSpDQ7Z<@Zybrot!fmL0gmU8Bdp=^sUs2*GD7 zIcaTiZM_$-Pyj|)11hl|al$gMFcUBU7`aJA%n6RVqK~tm zcPS<4#r;S&YTC^UYAP)QF9fyYu5 zF*Vg)toAx#>+Me6w`9o~Hu?Swk8vMMi`TKTaaFNUpL~-FYuh)mc={FuS4j8-mK{79 zwNk7yWeJ$Z6LcN6tZaa9e0m||8RbJQMdc71OCkT_Ve33)AS!+|!CZEVG{b@)zBY#H zp_ZqrBF7O{V=C99njRcI_w4iac!lc+@B2U&%AE5T?mf*f+*)tNO*_TgBLe^EVGflENJs2hnw%NecrKB0?|MM zQAP#r-p-Wf#8iYg@J}ZXdqcpJ9e6P+<8u4$5=%Y9FKx(tU>$OfHON@YF?3gOx6N|@ zvJH1J$!-P7GHCIW+gKULgw2!*TKg#ubqSPP+c@fZ#j|t>+tZpchyw)FS!;(rVlTZ9 zjm3CGVZWYh@M9EYb>~^-g(ZO&pn1p2pwli4Ts#A3-ei7p5rhemGA@>~jk>%# zTFoPlV@HS5yBfBbs_#g^v65R}dNyXT697@Cs{r5#AqBZ~zsvRO!hf3`6)U)uMlk|j z@yUY?tQ39vd!t1nK8$1P65{H7K7vaj*uh`BD36*??U&zNAJpl+M~fim9d`zy|NU3s zjLeiZo4sGiKdzXnxRcG6iz3${m2GH!m5##{fAsep{?reQ63O=YoCjAsaOuqPOpjRotHb;AMY*i*?5Io4dZM~V~wZbi|2EIeFp zOC(3IA-P%>I2#*sikDhCXNR7uz?JAaEYN#KEU~j;eUj>S5SrM-xvX}dA(poLJ5#1G zuWTP}=6DW1?z*v6pl*WE=i1s5uK?Ej+hkKjs`lEyky7qJ#QeKxRCTz{0PFhcoZu+YnMwD<}-zSW0`G%=JqUBSJ2$(y~()x&T?i2MdxwH@QLe3gd^K()h z0Qo-T0%%ps%iTC5U`=(vjrUiO5r*6Q!KC%Tvga{$@81~a?RuZXFfb6{`?dmx%QnPi ztRvwk8;MEQz=DCh;-rEd{x2^0R{zbo>h>|wcv&~ND`lWB%Ksq%ykYtVVv^g3Jvr*~ z;``uJP_VMxux(%JBiezHp%woPd?aH@s?#mLQRF5hB2e0$FIjN&ZO zoejT5$LL&KJc8)sM*%=E)Oc4xl|BtZ7>WWG?FU>4i^eyY>ia03QzN=9PUEyn?d)NT z(7!J{-Ck6s)#r}~7MCP~K`u*%HD$kZO-K8{`6HhijWf>?d`B(-Tpfnr-wi7OT&*j) zDRH`0Ku!E9wx#CBC+&Dv$G%ERdHc znu=O2Hgr8Se#$7f`vuv-fC21&9<*~MWgQ{)1#%%#wJ(?a7i^=n85aM%XR;Ksn% zc(5_a@%21!oX2WMFr_y&J*qn+E(Wx(>sTnO47-4W_29|-O|X<0a{RW~dDP)1lk_$Q zc(@C&jrFdR+iU|=#sC_xu)nY!URBV2VJ@5?SUtGLobA^|!KlER#Iy)mRQDHmqux*A zfctV?9Eko7=@d$aFZ$#x#Dxnb9QHS!1`CY?2!Ou8Dp&}Hj;|@X9G`${b=QEm*3QXk z{l2l@AS3cU0=6pvN#lIT@UN*nZF+_!EC z0p}t~6H7h^TuxqtsXwxR1)Hw>wt;(d)7%yUv_L=vCqpX_>}T7#`_-?8C6q$$Y!v@c zQ{7VZmR9K(S0S5}avN+G)Bz>z`sx!m(ttIct*ty*uQYnDd#<-JP2L6#?<$3bSM}N_ z5nq!Tj!wW0Jc>D;Jo~_4PuOmRj-O5QGa^2`UV&~FxWyATcANa-hj}pXXqgGdKa*=lr)thF>Nr4 zeJW*dxtXe;@_x!dVYD@{^<8MMUpV8FxCUx(eOCXb!;G}4uJhR>-94L`n`$bu{s9%g zF40Iz2rveGXhmT(bpF1cs?8%;;H^za3F5AHD1tFu<-UpIgl+nmSDRn%&H=9eR8k^Z z3^d&*00Ky`U~W&CnlE*i0MXde;&HIC;!?WLg$AJq560ZCl|4?jl&!CtsxX2$gA9!s z0Gy2lP1+BpbP&fKVr~SN_U=09^HJ6YA51}I<47y~Y>w38$ywrBDg(FoK*6rNeCj`=p}jCN~gkYFR^?0Wra9+%_rC;Y+%3@2s8G z=`PP5_dRCc~FwEQfV`1G_Fa!X$OCSZS4Bt3_=TO@Id-ip^z z9lPQijPwyY?6P z2$d#*uqzG#C(uFf@~O{PSp~*plq3t{W0z= z?e%NpBjK6BB)DWQ0-RC-mNH_eaVBlQRRKtrZHSjbi!q;T;Dm*5FSeIf$43gkK&4ayF)R?PO?oC6S zhPp3tE1^4S^jEO-NTa=UyaQz)z1Ep!Q(w)!W&yQ&C$MDTp22q5H&c>MZU!ej&atjW zay`;_jDLe^xwK=dfoi1C;sGzWBzVi`ru~UiJ3eByZH#pA#RIVdbs?~Ae;O!3vuBg% z9@k*s!QJ`$$t7^q5MDP?6et1icvpL@lNYa(*ZXG1N3edr$NXWHyLZ5>$=}CdEY>P& zQL8uB(6cas0S=+Mcj3xIBXDBt-T!XFN&hykK&i;7ZS}}Gh#ZK+jI}%Vv4_>e z;F#?}uzuW-4J8AjQ?VHU28b%@a^Qg0z=Ml_Ve$x@q{9QG1uc%|%m)yGkU1|iqlCDD z8LD-sn$_*@;bR~s(e?B-I0JcGhjsSYZOJ^h6DV|fZ1!OYHkxPb$H0cfgI{jx`1k~v zua3X3B>0BL9uP=n9ko@ue%OO!kR6^e^9AbF{(?0~85ZOQ!A)lpdJ6cS=Kx3O4d5p% z1w6k13}$~s04ADaMm~ao*zD*y!)hBxY+XF7iTe|yf=k3d2=~GFZ~`EL&z%XA6B}oQ zNdI_a`1|Lxyw4K5B=RJm{F&U8gZ7k5X!;yG_jwxS~2`2XV&%(qDk zL|n$2ROOJ~tMc(jZlG$mkx?}}$58=T>C}HnUfwje;R2s8_AgZIX@OZ>rfA@=&AE9B z52}9`4Q669H_tA-FPQ1UnXJ-6VK-eqwL+rHfBbyT62wnA{FDQ)ef-43Pdxm@1Fr;r z;(=EhKmEf`Jp9B1uLS;&;Nf22uF>mCRoUz}idIaq%rA;uNvcsbt?}-EesSNf6_v|> zl=<0giZIUoa3rkod#xGgYmyaBzZ6zYF20|Z3RI05tl6Cv!FhXcMJo(xQhgiwy|g$< z)1y`EBah`g1g8VdVaY*Z;6qnGMc+5FyuL33||-A zQ2&oo+%UOlc(Hv~pR-M?)Dh3#(jv7T8yd5I@U`4O*So7F(J1yEd#}&i7aP#EwMO~u zcK#Y=+i$URB}+*yu}*=fFZF~hek+%nt9``VnDg1I(O?HPoJkqo6}T;;-k(@g7L@K*a z&1k#dYl(HK+e*I7$t1C&ahcEor)}c=CZ_R}6s@=K>$?I1NaV?dJ2`pmFNIb%XYO-K z7+P8iC!L8s8}@k#((drm>f2T$KKh@8gIZJ)5A+4BPn-afO^^-#@|9XtMDG7?d{3_a zKXQK|2lr}va`sZ^_8q0N>lWVoe%2>;_0VJLzeY;Usn@uO&z&_Sd|l3}vw}BNuao%c q^ue}WrutKZ?sjfPi$jlr%^v4bmm8bR*sHtsBod z`uv`EjBmVSe7}FbarPKz2y3ss_FQvbbIxndweLL$9#KoCux~M*^q1ARPZ{UdIu}m6 za>^Zshj8-kjq5H$`E9~AK6AExqs*J zt9KsTJUwkA_C$ITow)93!KXCMJ4)HF*J9foDnrIq{1(qG%&_f!UMe~b>xi-hWA-~` zN!H2{`%cE(B>OJ-HXWg$oUAD6rLGKBBIoUiTDz6u zWDGYVFMl*~CejF|b<<4wZj<(S;}oN@31eNa*N9#pK6Muq7B$Y~ymOj1ThVr!u{svc zPkt%Kv$m)#$GdgV|Dj>%tYci)u(#pkGBn3Q|MV-axb$g_KSmPSQmDTx!qc~m**?BU z-H#oyGS!yfF;Dq4z2)(f>7KCb#(5k%b?PuJz8&h#RPgmu-j$jBDwh3v&bW`t(L27D zfB%TiLYjpI+MYu9T)`^sJY0Hae7mERd-6Q0-N+-<+ox%d{iz$Kv&Fo$gH+$_i#{Ff3?v|o>tRk)PyH4-W#}k|gHQgBX zVz=})*dikZ!_Oz|!?`n@rcGBuF~)yn(PNz26SnWHuWZ(}a`NT2rJ0kd8JyG{%ZY^E zSH92m?m1gonaR7hq!m{>@q!Oe%8C>;jObDys=VN^k7Yf&=kIFImm99UFY!dfoNSlq z?nVd~wT})dOJ)3ssSY1bff2ru()a1S7)MHR@>}|aUntV$h${U#juo0)RQJ_sShT;8 z@d-u9QCqx@RB~b7TskT?i(5IvC#48@F+#tR&>yX=7B-Gpd^WL>xTJUA&p@i9ZEfN~1*{0k3nFI`+$F+`7cC&;-g~F$U)SQGPO5HZK$RV2u z7|ALAJkE28l+n<6#XpgGTl{tXu_N+w2?NqC-XnlVvDv3o`dhA7l` z%#Ur;PN<-dObZEC=pdQ@w3oSvJCmi^s)W=Vo1VWgg&IcONyAOM>-1AE3e6%dx5qy< zLCO&!+7`cV_z_om5?kL_Ub?dhOS!PaM?F(rGQA~QSQ#ZwblOx$EJKL3))w%65Cl2L z%O39KDb0pf%s0+!{0+?=+{-q_pw zBH&JjNFK9#gsn-Sw!iANQ$j|vbL7)(W8q%pbFL3uB=B@b33G*_=#LIRz*NmcvT=MR z`~?f+7`2?6zBI$u2lWiuIAGAdQ^k!yQ*j05yIQlIQLw#Cb9wdze+N_tBaM^#?gQmb zOSnX-G=YeDIW&>ojIBp_XKw@figJTc+k~edII_%?l;)wOZd5J3iib3!bKQAgp~Oyz z`flNDfFQ|tDBqWpI8dQ4cnc2m@B9{8GkS)X3W3686HJsp3{iM4H zsCwsi@WJstjxX(|Z+)T9Y4By$UQOHEVzVJ+)7Go5d`pY`6YMXOVyX98Pqf0(d! zh6T0_$30!ed9L7`sNiP9D!u)KnTpm$g*dh+{gh&HuH2mZ+a*h_dqQ%R)T0v+h@i*eV;3tjrARrR+J4y z*+p4cA{T^2zl%l)l}9nCM{$$8pxc&9>nd|(eY13!*7JY8e8=K_N!sq~(1Zk^T?8!Y zMGuLGXrJCz-IaR+P38Fd1HItx$5$7DI3FkLUQx&*ge1zOS|hLJmNN1Bf8D6wAlMIM zgmUOZ0!J_uUt!LLGox?b>oQJ@V6>?8J9u(FB8vLBii1#PZM{OrO@ub)TxBSB9s4;t z5~n~TIij3-^YWa=p_!Kf?u zg<~*;@13X8YO)%LA8LJR=p|hKcOl3uBZhNFsA9IJwAeJ4A0L?w1$u44%bt>CUuUtG zrmVNq;0rptCG7a+(A_bH!qc-Lg!lVrl!KOK1(?zK6c=P=87K+OO7gv`a~E1-#A$7| zPSN2A6ICO<1a5tMQ$LT&B}T(mp6c)a6JJ>hG}qfSiA;Xuvg~VjF9n0U`4q0Xl&Y+-={oU1Gu~p&a@3+C07% zF13s!=oPPGrJ2YhmEP!Ujioc(@5=BuXmD}D}4ibKQl0$OmlV(6acP{})v_}5+c z*p1p8f5cUN49!tbuKQdlMW!Z$RT=t2Jhc)PwVdo$boh&uA(!tcRapnZRs|eP${Rza z$6#`KjFV4$+V~oJj~^$oMTwahy;RtT zqRSXn?U_G{=fp_U1AZj03bBnA4XW0c&-Qr7g;4hLl(mBD$T|^O6h}xgzPDQx-YV76 zOz3+MdS^>{jUtQqDdUTU3|6?WnbR0m8efC=`U!Zw*-sVH@6El#z-5Qlp7@f4CgpcMiwqpvK z@Knz0zN4>thmpCuERnM^o6P#F!CRNj_eR$~7mw}FbeP^=4#;~;Kh!Jb^7WoV3JyHO zeOr@CYWVRqG3p9Y&cmt*RWZCw!@UJJPrvzcJ*3LJF7VHUCf;p{Ik!lmmdCnOT)cdk z{AKC>So04fJD-Q*mLtU9F-tQjQ{Uh#B-WsseXa2r5u1z>+-@PnUwji=!!g7=DsXV` zS|lJk1NCQKJt>J?MfW+{ld8ZW#FG$JdQ#bW#xlHufY@@ZoFPGmD24|p!3?`P5@H2k zUp^l_E=}&Z{+dBsOZTP)C%qY-WIbD-fALuqUT}*6EtK>Y4y9ZE`%mnm_aEb>W+NW5zYpOhr%6()P{Dy#KWgEHn;R}>M$9YrrO36ug159zl+%!= zsp$OjeyNA8HJq!LG1N%WvJ)#YQkv{zk-Ot9F7imXNsUy|Y!c(UoGKbsSHcV0Gz{)S zqlxzyya;$Q@FD4Cm8yA1Yuj`=Db|8pbn4vtRu>XQl1{P?Y6<$<3Fa2+VfqFlMxl^4 z>k#&*X=kVv<`d4Cp?DH)r|*;HqC4(-R3pn+^hT0Rx2a)1A!(mkY9UNk`h;8KBggH6 z=|d&AGHmBuPIb1{j6|#A{*@Six*{srBdeESk_V6EKC*+auUdPUK{i+Hn-F*&3?yOU zjsn_{=I^Fq!3Sg82x&izTTQp?<@Gyxy8~YOyD zgYv%kG_{>zJFI_}QjhgbV{ zO#6i#6?_GSD2Cu^fu}!~UC|^*gQ`JXWZL>YX=aN8!^fYWq+ndD9h%kLrS(B<*UvF4 zqp(4;Uwh%~_9kaRWB0qF-Vu3Cl19@^2eJAZ=MRhoQ>`SFNwjxTp|d6=$z2s2DsD)& z!EF?)8Z2-&X&BPg9M#AdNGPb*_{?Nay=zYP?s{sg_x!k2df^_s$&C+ptW%H}rL{3R zO5!Y%j!qeTt6S_+(c{DiK4hrUY+Ur9H0?XWCHcc~=5A6G9Avt7t<3l4ti#F=6_8X4 zJpoN2V1>@zr6PV#`)#FyIK+^LCgXF``z9O5pS=0#0%_SsxhSKbNvBk-=*@fl z^(@#o9ys`K5e>g?9BaHA7J66y?bBy7RxPH(5gf!!a_{b<`{r8@8T&dJ-2TuZQG%UI z`b@Z)m82&tf#6Zq4+U#BggrD*qb{kDl(?^yX}-v5+9$l^;ECY#qCTiFeicby+5 zB{-A|?%h)zJ5myI5$~+zj#w!~zein3TFZ#;OOU$MQXUn1p?%&sv>jmp;r>|qpwNhg z>M({r*L1QYUg*WMSZet~1>eKy@1!mj^Rm~`xFH$Bc9y63-4A6Jt*rE-qk;+tIdboz zZWfVQsv`+%1`jElLhjeehUmUi@SDqOM!QQ=7ep%X^qb==c^d3N9z2W^gae2%#)A-! zRYuj5l%a}M(gMt zG?9zI9=;*e&C#^BPW!=d>0Q!!xm8hy)|rRG#QhH3_oK$BH14CQKCEu7A9N$X&0pWeyIN zWqrCMqAiCn22p)SlaP`o_8M0c3yof}a4J!3YVuN0mv=+1C~XE`ne>zMYl50u(}|%K z>&}FZ7fHXdO3ykalZ#AB;EsBk~EtVRSRoe&p6B*M>_gKY|v$-+w>!(_YLoC zm-wIFdJ-2qaQI1F*#R{bn~%+4ygU3S>5u|BChcQsDVFER6nV<&Eec&61>H+U4=2lP z4p8nBoIG1+(09snpVWGcHtsHUpE<(X3~Ova>b6Q~pwA}m_x42k~RGtfMp(T%P3sbt~eUV(1gx~UTG+KT0 zu_f&2NWxouKTZ@6n?(= zOguki{!yGnlJGp(zs>GD%Ap6N%d%k9ZMQgUxfj%Eyv<5V9<-BwU1i>cXB;-w`xmZy zvC{7*2~5%X<4q=n;gfQ*PqJE*ReuH(s^WRItRM^spy}zxrbI|(Xe2~^*QG78+71sq zaUwHg{}`1PvBH2uQX0_T`0_FH>hjxSM5v@3Pv~f#-oo}gHc8&ISqaH@1?2E#a}5uv z$&e8RQyeP9p3pRrFP7@utF-yf!!fL%E(X8F+^rLI#tdt*(UTh%%2|Cvi!`Kj%iLmT z_J?SJtcGPvvS|qAXhui4czfLB*5PIZ&xxQ)mVGrv5?c!I{ks+!myae5D)Mt#N~5WC z87b^_s-V1jl({|?%}Sa|D8U+KQp2egBTortcPnb-HJtEg<7K-v+}5%O>8Y8lY3|+E zc{2UI_YJ~bax{YOwkj-aV0^9f*yeo*~WT9>9)TR|%Q;3Geodp4v7g zSa-^NE0X$S;bV$C#4sOOarh^nt?uD%2)Xw)rfh4xZ-p59ToGzDMrKe|@D-!9O*_>P zZKKQ?`00yJM6P&NcLvN)Qripk(d}ReAE5CkSCB0k!B_u~mfj(O`^=+L&KVl&q!H8BF-bkIV z&GsHMEgj?aRQ-E=$1AJKdlU#BB)j;-$RRF%F2=({oI4l+>XJ%<{Xrebb;P@*<3@3F z9M}X{F2>(FvzCKeTJ_8PmQakzg~?MW!l??xPKCydUhiX>R4N%1x$j}W*_)I~*kB1j z>p(}B5b_Vj?apf!dZ!wOiScwY!u2Eo-#bc+skZy&;tPRC)MOnGukJL}vp!IcwpOCL z?a=h?sDldi8)Aav)D>UV*7CjY-nWY@s+uMt#{7~c)s>xS15LyLnTF(sOZS}7xrg*R zcAa5$d0e=_0#-&2dc-bPme%%M zF1#c+>vDmgVZ-z!#5YqMEO<#?$SM#EL+y-+S?E~k7-&UZ%$%4=`0f+)*clpgDT#>v zwFLN$m&DY;!G?>T-r3oi&Y77GYG*>v$jQk`&%i{_#6$~b(Av9NJLtL4THBMtmiV=X zh>^X4otce;8Pu8>wx*sw)X{;Lgaq6t{#!mP8(G2^j22% ze?DRFAnF7b`AeYx@d^9q;6#pI$;ck+XlGy~>SSc?K>Ftrh6evUZ{uiZd9xiu19~G% zBP%e~9=w(DKVB&=DXZ|$6EGE+m|5A}JOz~fA2S`yjDIWZKV*a5x!KO2f`G^WS@%C? z|GoE{$zYbOESCt>z!4^%qzEqw?EPGZPy;hVuA3hjj2IY=I1G$vIoQ}(X<3*V*l9U9 z*$inp4A}J8^z~SnSqvEeSW42`-a*gWzzDV!Se(ubti!0!uE)s1%0jEh%FIm5!f0$v ztEUg_YRtr7$jZTHWW>f~@W&GJc4h#TdX|4m1zXAxEM>sKV#vsBz)7pm%4kH(V#Ej* zHDF<-WjAJLV`nyGGiGFEy;;i8fJ+Q&XQccNl-7PuJ)yWtYHGtzT_+C7ItEqO^`LJ`BB{O7hTa417P z2R#uz2P3d30~0eB0~;43<8ww%E=G1PW(FDtCN73Q=0gq5j9vfVX2aZvnCF+#CCu!> z`(1B_e)*KLk?pVFe*J1`cH>OM#5ZoirDyPK3-)?WMusE= zXae*IbOiuiS=4;D0swUv&Me zuK$$={#TR#Mc4ml>bn2Cm@={k49FRjN?)Xlr$L!@TVGmS1R?}cf>;v@-5v)c_iQB8 z?I92>a@c=xl1gMh!QdSSNmb<26OAxCe(ZY@ ztCTSaH+W_nMANE=wkBvn)S6|#AihH*`}po&0An#b^UJQ}vj!wAYWU}ss8UzE`!aLi z*Cf2+GWRVa+V^$9YyRsJ@c(@GzXrhoaX=c?|1^FJ4HNNy822Ie&G;XNA*dn>;Pb}+ zzI^Wn!~gdvL;zJ#@qZYG+$EuceKGl8m*6c?xc?di!Uz5<{J)xq{0kf48~-{i1oCgR zfk6HZm5_gv6y)Cw3qs<*^Z@cNF#|aGmsS2t4`9{9zx3c=dH`VXFFpAGD?QjNLxcG_ z?6QeF)BkYg@}Uu@(0D%q%V4zY)B56Y!35=kx=s`ur+S^-7)5(wXP=+A8j~1yys8Q6P|Jw9;|VS@AjV z*TFtfgZ|OMfbO41PB_%@;J;6%E9_ssjR4k3pY&3*x>T-A+%VrzLEccQ+-iRbhJ7bC zKwG7`MZe_1r(w+}|1?dSi4NOd47VA{rY5WKUw%5%XMuHPT)s~_DQ`Kcv_$k<)M%?{ zmLLHEz7v+;$gyBh^59}g8}*-d4~I2uPZu9^a!p3*i}4d+jh6u7io^|E9iEaOD;wtL z$?0I|B4X1K-16ZE%lz)nge&NVvTAFMZG;rA=Sm~Mo}D$XIZc1F)0F>Xxo*J5xt>{ z^X7>IV5BOl4z|;Qgb~N|g`t0XWN8T9v1(#10|lMPk0000M-jMfig;?bu0M)&u`p^q ztBlMmI{n#R-nyP3yRfmrhFDTEb#M*V5zqmX1B(-{+WTW-tB;)1K zMW-E%!SWrHYd&HU5>9X9tmU~!UF4%)FTsPoX~i%s6NJ>!m1dg#gO>rpMerOG)7b%`= zCfG|BG#?w0pew#AeT)pIT^}DO-0b=1=i^)Jbr<*U=4Z&gmil(;uA7wRANyY?leva$R!LjYZ_yIjGAqA`RV-e_v!wy7B1&q*T>Ts2h~q2T!Qa+OHVZ>G2|BBjc;?L* zCEp*m$ZS7z3+CpC&(t)qCOl~}!IrjWe^UI`Iy%sWgXua9tpXNGgj!{Tpu7^l*4cW(YRWa+%z)qAKY;1kB-dn4UY}}XXg#v#= z5&tFQAV8GOAC_zfn$=&(kF$#VOH>`ye9r2r8$YUe(ef585|4=ln0bb7gM6hw^x#AO z&6c-PegRZ9Z$s$E!0#=Gbw7#|X?ZU>$Y6KDRuTh)HEiPx%vNkLFjT3-9)CtoE-#wDr2)KcLaV7rL0;PabJHBG%|WmVcYkpi~{DDq*k6S5Uk zN9XVi_n!z-0SAMH$JIqAA%}k9xC9;0Uwy8qon)myY&y3J@K#eCHa5GZ7_bMstFIFM z3AjO%xc7i$leZkT!JITw#qrli^1^?&wtbR6=q;X@;xIpjZJc%P4Kr*~5zO_Czh)K9 z`osbc8~KnQnZU2i1PAd+mbx+RY927{c!l8J}2S zl%b{?GN7!edl1N`!Y}QoD*z$H{}3YWw-B@`7A=p#^8-3YJv5~D>qbD`7Q52`i$K+3 zBS}-_=m7ptMs6az5HRCbz;82hD*&6brEnS*rc5TmBqvZ4GykC#bPFa><(qVsL7R)L zqDi0FB!1?h@*J^@DlrnUE7kNHPXz&J>(w8Nb&m1nb1Ld$1CWZ^ZEr>9l|)Ox)YH<5 z&;RrzX}frFO_u0B%PMe74G^`!t!DB34WX&*^uNz5no-_zu3eboa5lE>D*6l%ZH78FpC1`AC}lRI)Z3|=wTK8Tbd#&;Kz9K4bOmeX%phW z<_>7F#ewa~V75n0*Xs;4L?S_bWCjVNE(*7a~fTB#)9#}4sEtOW6>=lR-A$d2rtVpV(t3dt(m%eWz z7f9`gPH7XOf6I02MlM>I)cx_Z^Kbap>T|`+$5`$GV)!06>h{>GQSIH|aU#^<Q~7X@s{0a4Hin)l`4rj4?!}u25Rtrh`?v*4<#W01ElCdoiS=`?mAT$ZzV)b zHv!;Seg(#tQy@y{;GxhQnGHm+5gRm8mj7B+l0E>uUKK<=##8GcWB3s%`m-_dL6gL}dqP4rEN#Lcd zbrHmr<>ZYj)QJ%Q%le3snOl(5+E_2T9feJI9GQ3`C05p36bJY zA6=ti*%2gn6QCZEzwE>2sQv9;lXG&l?aya#znWBAM0dadE#<&}hFY{-SQ?uka-0l@m@@Gm=*#$OYV#?Y;K=EE}7%~he* z@`{wie)-)pluNUbD%kqOjcjHS=4+*+FfD6wuzwU56JuF%kI(3fEW#%!TaS?_c2fbm zO>6!o>ZZ$jU8%uuRF*!%eWN0}TtPz`%*9T_#|kI{w2>Iy!s3^lc;sW_qI+fWXrjp^ z)#KlDC@-w`)%6|2as(g{1%aEG0C6I8)He0}1Dy&jr3IZyZtCR=FgH6$Ruk1G zQkqQ0)=1Q~LKG%JMxv%O@qu&V38@ty0>lUYS41e?2mZYAJIkY0x1qqUi? zC2TQj9mcX0M{2uV68k}fSpex6b~h0q?|k@o%6p89f{zwITx_Xo2}sb5!gW1W=fPBn z(_3IvveZxXFqLD*u{=&CU}8e=!4|a}Ere~B!2c#f2~2@-FctSZuE=&C76yKeS57#@ zTm&m%YCCI?O_$ynu?41WyC2iWP`)0|`9KN2>s*NsMKL@;u$5oBp1cE)<`o70>6l;F zKn?ICOCA%q#RS{Tp@76ba|<$1P(WT%nsqs|0AeURclj<>5+4GoF!+W2Ef6>@iGEv) zJM;H0nn`ie(mubwnwqw z`GxkI%Q9wSA56x{+E{D8o+Q^~;1~kj88>l%;0lDHG3ozw@M~BM>_jOvXX^VUQ58LK zyr>5&Vosf%f%8$H%4&xi(X{JD_fGk5He~xtR01G_CBbh|ujBx;7-TTkkG6#wzs}rO z)&wTVmViE>SJ-OeRdx;{iYs8bhC9$;?*$UYE82vUSl(!`goYGc-VPcdwjH zSZJzNCx=ODvowal6BbQ-4Vin*2pJa(?(N&W_2O)aA?y}v9Yaer3u`92p|8DNpM2!3 zj)aH2CI>MO7Lz}`m;;PmU1hwnh!L&b9#s zxn#bF0GUj>x6s~B%YWAYp26DkU~{mc>m;S#F~UIHi<-}UnlZA+cww#S6Y9i=l@SC8 zfv(+YMxY1@NSdbzA)p2+AyJCxeFs9ADd{f=-}kGdV~P039|S)4z><4RW@4yxZ!PUm z({;K(9K=d0Vw>D{V}xcww`q5Db+9O_ZQuQ9l`u1ckBRzdf+oe&%l3oUIRW5`T%Q)_ z*8_(dBR6y-+3D0K*)uGvf#*<40<$K|+@!s9k2nGOTCnca68!U5wWD@^r6L$lxFZ zfM74?{zF<6O6{_Z60PZ|X?yT)WC7Vgq^Mm3AZ4(AeA{*hY8@*7e6w78T>D^LZN7%y zi&pi6hj0{}4@!yX+(R=d5In4|?dyRr4)l>n2jQG`AuKFnbhI+25@NY;&N4earMr^& z`UV+qzA|BaA@Wqd{XqAMEk)x*%dlMIE|4b>bIofiz%L?cN-UX*O(&~KYds=i zW)X|)OEzflRi1x~a6GpS{?d(o^|$lXvyQLlD`LXJeue-58ZbADr4QaLExSQL^*CIl zn`I7g|7H{zGs5(B;38-VP-#EdxF)4YWq-=YX{fL{)}ZM?O+Be^xn|8fpN4Q0LZ5n3 zi{m(gR<_*6MV73#yvE4wqc=gG4Eyltb zkq7(j1A2?WX%P}M&+~(D#?0{Gy@;Jh4=;8HzrF90poR?m$lLf5``ddl0pU*;VgZZNqKxy{>bTG8j@J zX)&;}<@L*m8TWSi;`(QDmtVd~P(*7s$mPn3GP)>;B5^M^zrP$vou6?Ymj>W~iM$MR zgZdtfzubU|Y9|$7c`3%#0H{aNVa6;m#SjTH@FtYU&UAWz18=|GkSYHC{?7&5(@JH7 zANC;zEpL#~&=jXDrSV;wy>`P&Qt&BLY%HTYxR&j8gTx8FrGVVNZ)xa)!mxV-wJ;L< zqe8G@5l9-e$SRmXu1?F`7^=1ZTH`7e%C-J;t8P0}{(`eW?$qsrd$kS>)u5c^qy9hO zn4$MV#ZWwD$WUvr0xE8IN^%pLx>jUEKd0t(;xS)V&9&#x)er;EAjQSS<@4|~pup%+ z{X}@odtyU|9>g(U>bGB9uGeyIyW{sznhT4NG^Zvqx{5aCIdkQC-uhksd25Nca|9WHd3YV2$8)8>zfAHG0##GU8^&l5 zZ|8VfVLT6*-afeADaa4y8$I-^Z|*g^$@SEdtHJts6ZTxwddKdI!!Ms~TORVW0QZb_ zfuy~JB`5PfE7^9|(0I(+AttaxA5~bB2Ge)AJr##Cj9|umBZBX&6X*JLfgBgI`gX+e z$Bq|K)?c=SP+`U!Poutr)nTBvL4;H!5Y9-=V>~)Dv z==e3}-+OzV1_MBV3hQGv08-fIg6E61=P%0TLzLUY!ahc9p>>JOx0D^v&EbUTxRKK} z&Y#sl`$)rz%QPdl%cN}=WVy!28t~-#&ppcf*ScQ!i*Bt~XR4X?(}p{*O>@>c(*zmO z=s+F9ezZ_8tnVZf`Q1_RSUi-;c@q2S!u;aLRjqA{Y;^}-Wuf*hh(P^YK-&-K>B7TS zWcu;qcx^-skBdSVLH7a}ZA%2C9jaT=jTf(1r%WO~F|yCNiOT?iTuiKH#C5!vYq1yN zS9C%xtZO*wPW#3U=G7X%t+vqg@KuQ?xqQhx+3jtLasYKNU?Z}>$sVTf4ZtMlcq_Yd zF%cjY&$*JrG30R`_4DyC(_M^>XXvKR5}8rpq7CLNE8>^xx*}aJzH%L(WR+(g3=FJu z+?WrmPME7HKiXp5ops0CYj>D(9RIXH8jfG5&O9i)!~N(y#+#>)|NP)R_kJwLuD>GP zZAjV-Xyk>18ZaTW$77AD3m)uG0_<;fmCKPj7;uB-u-fGg{*VVv-do1KBG>c39=cYLQ?F2bofVr5B(K zoND=c>a(M@8N&;@dWYWY+MM(!J1$_i4qT&~`y0=nW3D;W1sNFcrP`0v$r7$CxL+w> ztaeM!5A8RhC38DF=>fhcWIk3wk%;-L?iaa{Tj0hn=bOC5M>KQwgS)4r@*T$|SGJ!t zb>|LNa^Ji;>3_=JMjF9CYWnrn9i-5P+XvCWGh39#vj={MdIwWjTL`7doQck{BL+ax zQmxC7q>*=Rq~>gBhsC|mnzwF+zZb3}fyJZ4z6D#eJv0^g^k8$nbg+j_}>GBBY zy&!`O`<1@1@bM3B%7o`ME3qUWXb-&}M+ z5!j7{`vWyp2J{A%%5%VCr8C+mMa&sB7I9d;YnAS1v$s<%#*0EaQareJa4Az=Jn%U` zeC#qH@ahz_UC!6-#4A53DG}LPZ^wI&<-CPnzcZF8x>E)ouUVaDzL6MoP`g2Ua4F1; z!_6bQHv-f_v;d`$`;sL??L^;dJ{TK)P}dxvXWalno1V@!e{h#q%3X>Fq|*EirM%y5 zN3IWF-{+(fCxN~WfHT4%9muAa6;`?hd8!>c2eg(7fOiCvX%2Brx{@ zBE%FMR_!ObyGPr`D>u=rgTngJ4S|U&5v$*xIV;j&PV8+5{*HJ3Y*a)W2XrA7#gPgMitiaM^MFIc5MM4+r#X5}+tD6w&NCFqJKdUq5R4w7ZVO ze)J88#U>SpDUSqXg3N^~ypqtz?D9dg4O08XkzI!K*iEONv+w-^kb>!wxvfUs30xNy zu>M}b1iTqA=&x{32l^wGbx#PC+XSud=2hx zaZM)^MSNnZv+gwt5FaP>;aHs$lf+T?M6@*G8MAxlyunfeLjvz|> zsd-lL;KCjoiD%;@iylx9gw@f#{<|VKZC$jdY?B@Lye7RaKAUwW15us86o;#->pkdc zN@GF>%$bmpHF=$39;FHDr6c zRi;?3H;3he0BCyfn9tM27ks5l!euDRXZpAS?$xn%2)%2(t!Has1fh`9+d474(gV-_ z7NnFJMzQp5uXbWSE(M4<%}K$s0?&=mmHJC~wmS&>xCA>>xz5vkTkES0;={6{^-gQ( z`&TxaNY6mRcppIMN}`(A3lBjQ(~k44o6Y{4o~%kR8Bnl3j;?c05P^dft@rmgmdftm zIiL^0kmsoCs=;H&yzik@xhD?Nn&IYC?->&N*I!=xMc!>qdH0i#qeC$hWQik+<^z_2)Ip6>Q@1HA*Qg7^hX zXxBFh&B5DaG04T?bLzrRVH9%~V_5wiH(VUd&wnm7?bz?PdzM&l)4I4%A-bcJ zJ#{d9wX%I3Hd#G>1|NJgx zY7qNuLD=!^6l%N-g^qV7+cK{P0sFLrrpLClNyn9Vc-T|+E0S5A@+$QX35qC?$?sSW zyBBC*I%)0cUT=ZE@nj|Fu1GxVyXIAH=~O0B(;@+(`=>K-83^0yzOGK-gGOh^azd;L zr3p(mx+Y`u=lqx0LAN3IK|X&?ObctO!Y%>vx3ndpphBK~4-Qs=t~ME@FY?m z?0SzgKvN5=-+Q5GbT%3M2`$rKD!^*Wjcz>K0>yVG z9TFr>7)GJNLbLBT2g+bb@rIq)e!n)v#hnKnE`p}Go^gGBc4ql-76gXkiysFZJ5kqB zS`eQm5F%T27yfbH3g?Nv?q3{khF2v6w7B$-ruo}!bvc;5_UqkAqq`Qvw2!SlFV38g zThlY!+k_+NOv`uHUh(r`Wp*T^RnP4PylA>=pjgE|5_YwBL4I zs=P%(CG!p(sNDt3&4<=Y3@9o1DSuFj$NrrD+Q)<n)olsRW9^%@5v@c-Md29^TwKm{!EfGJF51<)xc5%FTpqG7Y~Q)UnX6k3u2~!7 zP8iLyH_^O2;cVxjyj`Bg1J`0q-m3A0H`r}ZuZ-=WLI{QoxQuSdr7DILF>_-?IzuK zfWwzB(`jD0X}Pu>a9nCe!x|xE7?76_MjY2VhyJq8RE~Ic6b?@w$?b;)fuQo%@13l3 zS*{h`{c0Zq`+3VQ6z;NH|Kvx^V1uUQ!Kx}c8XC+C0FD@;UXFzgxp0>~`T|X|vMS>r zibBR?M_UVfEao4xe9Lo_V%IwVV#_{7Bbl0#GJMYZNqeu$h}cdq z#H;(>KaSI7W{ssQnJ75y=URBjv2m~)R($;`{EO`9yF>AYb&6S5(`cP zPuWwzXADlJDp||ZbTGR=gV}w#5Jcu-H++|Ol9 z(^U_d>-V`bVm$9#V_aB%D$9m(NqpsZ>@<4Z2OZ;thg8JANjKOJrvxlVq=;e__R5Oz zo48xthZjx2Bm}q>)vpgnAe%Dlbq?PwG=FuT(v03bEDW7+mV+u{^d{zLjeQVHCTi93 zTpMFu!{^(4``&Zq0E_hz0RSaoDsSe*%5g*=pQi^8pZlAf3`nyatZSv^dezU^b;?W* zThd20MuUSAgaN?Q9~I^T1iXhK0JL*pP!IeY>b>I)?vm3iOCO68+=m_G+VnuANvL!T zYnS1JD#4U8xSQQ$&c_qcj_ZQ5s*B}3%|nhtz*^j8k2}!x3~E1ebJsXxyT1LqAOfDY zNqg^jTV8+aHVGWWDQ}qvj^p&JRuDXB?gNq+!FwLp#(zj3;(3gVif|Sqx-*+SSXja0 z<}k;~_2`kPh=}K)G;m*}`L8|FNx zO;kANN~zkgt2$EREkAU_#^b^z{yO?HeMLBPRT8=KNgTTsw8Yy#osRDIaXT`md8;E4 zK1VZ2wUt6zRjZnq297@e&Q`^?MIJggKZ$S_*9I86we9AfMNT_1f5RnduLO)cmdg_n znIwC48}EWbboS1n{fv7PAVQOn}1EzZJ6Mc<1n)X>fhgo86LQZ zT{$NNQj`xqL;AFkf9ec7-T?Um#RQOigYS**9l3A3nD{tPFv@gKI~Eq)4numz zc0Oq1l@z(~>S(HB$n)-dfW-;+3sb{oas)quQ1AqNpAkgrohpA%MiSR&CubCR=r#hD_k=Cm7RMdpqv9^6@hvDeUANkSqq6 z8+p7~GA=1m*F4tq>u-kv@x6`GsBuYuViU2L=hXpiA18<)wui@kbDM|Wm&Y{wgce_F z3ToEsdNdq91j_a*>U#f(?A2*da3&--mne=lwE&k-#{Enc%7%6N}O*o@*_-StHr`Okn zOND9P^K_Sse3SXgC01H%hRJOE6%MzP0aH`cKsA6*niARw(7JI3^qxQol#Af=1Kw+s zmafzw5vwo|+!YvLe#ciZzRhdU1R6*EsWz7QUaNwG)$%)A8t1*sc4c0dXD*KFvKPCN zl=HKk5v>ODd<2e;J5qcQ0T8@)v$AjW1<_cxm}}%Po=v@8UfR*JGfJ}A3e6IiXKi4H1 zbIy4$_wstZ?)wamgL0)2U*K1|v64_vNS+c;$u%DJ@CGSL7sgC*OR7YQwMMDqAju)J zni3Z!{oK&MPeHR7Am)NE(J1(2`nBYo76kmdDOMG4ST2f6u`K5_r}3bp)ZkpC#oxPS%Bt->=UBFil*Ji zTuHsf6|65g^SXHP8&@q<@}dhmeW+-ByGUS=7;o$$sPZ|cRu$>{2jJhRb8*&tuFVzC z>6(2Z5aO7%a1R|nxG!Y#j#b_zy98p~yw=I9xR-Wuk1Q8OrkInJjva_xpOPG^G5+5?IMaJ7s$%e z5j}#VjJLcF((L;`etp0et(R?w84z9V^Ru7#t5*ggx@Xv97FVPmi(XqfXZ%S;bjhsB zA2Z;tT)sG&SMG=abzy4FQm#WsjQzx_*=2jIaOm~a`!vcoWB9`NGFKgf@TsS_fXCE7 zT^Ow|b)C}J1C{iZyS3?q1shob1#XaaL({Mym|Wf=!0%IWled;#oM`^%vxgvI-wz<< z{sXA!8swHj_N(8CiobgSz?2g-I6zUgCsujMDRH46a5MW!I2v%BWtCe{#SeYFbv>}# zk#;CNyI4Nna8XO)EGi)ZB0?zlW<=Xo~DMKmb<>iomcINBv z{W*1WA({vO+h3H|@aBtQ1|S1-@d+nsdGW=>NiWfDNP=5E#%rEHe?umo)+%;SN#(kW}Ax<7bS}GHMOoNtMjPB7C zrBxc%+t=^0y9M{TAsyk54?fDNzD@{y^Qbpuh69q4f2lBsiq0ldnqdP72g=fcrzEZ; zkWQ^hF-{0!{a)#~W}3|eAVu<8iQtJ7qfLhUTh>i(2zuJWm)8y1g}xICMa}AD}6-TF$PkO)*?@ltS`xmqe7a`&|R_Mb<;yMAUD!_H@|Q zm$1^z`Y4SSL7Z^g>qHDIh8-hcex|u}a9%stAtHbYWiAP|5k=k>k`{EQot!PcnuHp( z+p#DR0A4ELL5UhW3|N$c;W*_YeOEt>0f};MxSE0wqpc+} zDnPdhbc%31-)wpK;fruaG28fqP{y6jF&=aUAhvWZGcO8^3AvRt$KjiCc$DE!h6@uOv+Sghbmyg?DXo;s8l zP+4-VNzw3bsVrxP!4Y-&1wF{W`H*I_YkTdgm_ePny8z3(IMFY#MxtmVg~nsDE6k#n zUkV&aFsAY3NZ{sK19&qz>>V<;@k=)Q&O>GCA`Zq zH|a+(y$fO}QlW%b9{VYp0QJW=&NME3r4&=W9Fn^ieh586B!rb*KK!rx`1QGh*?!fb z;^Yu|QhLGV{t%{;ao36`9Q5!A5v3~m3cRYB{*k3A+ycW6lr#`T>0O(Z%Y?mAK&gP_ z-w!ZGXa<7x+eTto6Lt_3PD6Cb?Wor;{lLq=kF0hZ*y{D8k`nKgB<(Vh06$+6e*cq- zv2pvDdhbvP5LY{BEPGVXTp(`SvjtUH1}M|MF~sY~2h*ej2gGJevm4&U8&g-)U{K+@ zp2CPBd68d`@s*5R!Byos+=ymRsRUIRv_O7Ds{rwMeQt^JjT9XIUa3A;*_(e~SGFwB z8gY*%J1?7yvgDz#VoIE-{CdIFHoY>LifNLmoD#0J@2JACPTYQfcPdkF z$+S<-!*+eXi1g(XbhN?#TXm4gpN1mwWG&jctTztE2&0KzFToGx*K;r<@X^8cOjICk zrO2*UKc6$ud1)!AP7cm6#k9P+feCIoCMG*uO1i*$67@rvo3+``H#GIEbo`9gfqyKv zq7oR8TBCI7XC}E*%`uB3SD<$KvuHA?XQhci@H3>k+$ql)9)V=>d7oU1q!ljMgYyk5 z($4aVkZ%^dnj-QAnGZCk49B_FJ!`4gC&}&)k)^)kl7M#i^r^N3ze_7NhB zlMAV}Z6o3`i=Y)`l54!_WHq5$yGa&)ZNsT2=n# zpBqxgz8!!XY!D3yhZ=V@hhdrfwE?2BFH?Z`B(CVLmC2c?l?5>oMaaar>f`o{&OVC^ zd&>H{{1DWB6agJwtMmHcntkNa@I9_ouL-V9_x!@{`s=*m#9HrF@MF{*t-FleRXV$P zeLCcjalTj+PxrZ)NGpBZg&5y~Up^Og`Sg#A~4vR>8SleuGmK_<`kf`7}>kA!rgPWUoAKD9w#i(-E3Tpd}h z;!>1MO-wuyKpN4T4=d+Z;Hp0D*<3O=+sUf(egTpj6?n&=mY!g*_#MX&;Pa$>j5~QqGO*lJW7Erwae zyovSiUVW}9=b~$+DvME3zNF7@I>vhczQcRVdh}Wk{5y|PDNEux@p@Eb}!cZZ$o|XpXn{s zboK5nvRR9!w2LWdc2MLNZYhi)Ch*FJHg6znjZPU~6eMF>fVni{T{g<-mXK&F3v8BT4Mq{n24ac@;wz~neA2CH@~+lbG_;}UGcys zkB#fH;Ht8kgTru*4eBjlJR-B|f?~L$wOLn5$;Fo#I(^>o#vt1=aB?`R*T4w)i_52UIZPCKaaeZ!I1UyL zI~T9SL8I79a*WI`-puxr9co4}*Vz@fpgzQN(XLMXy#(%*bp<)U{n-rDyQ^8=EBO|e zpRnCBjP&ot3fIfvqzuk%%LhC2ZN>z{TqFCk-dOW;6lLoR9|^o`-V0M%87C!sQq|CTS6I|yUr3F+_XK5&Z* zyZB%Gm0?xD-aVv+8F-enmlNXOEXg$FLbsCNte1@Be9niQvOT)*9z8 zQqha#ldw~rASP?AGi)rW3P@Y;^Vvb-AB9)Ca+9u9b!0tnDP6eGqMiohCE-) zo?w1S^C69v$4`#GD=8!GGGK%_Hf=6g;@-RX3ThqjXbE#+1iRZE-UmCiJuZ!fKbH`m z1RDt@RO+^h!Zh&7y(d{X_=fDBN?S>BJBXfgma0jG#qg`l*7%Nfd7E67U1WV^`s(bX z`grAEsS(pvG;=#A=gPbfR>*Y-IL^B+*VaOo>qvGXf&z;!Vv~d^{Z6shO>d3I*DbbW zYW#ynp4~%9z+cXhC^dV9{ER|%;-=Rx>K!T7c{o?Y-p@D`G|LbQMx5{HeRS`V0&~+f z5pK4*8*JH2CJoid4kOE7lIsy#Cd0YPC>Da9S$8*{CXY5=X4Kjf5?C6As($}y zrQ^2jy5$7!aUt4t@F;Stg2d_Se9U@=^i!SO*umObzl$Mpo@LX80gqz@cDhX~ z^swhU?zaEc))Ae7BS*FMe?1Ypo=y!&S;RuQ=W^hD;;t9vs`%MsU$GQ*PMlA-Pt@SfB)k z02>^nXc!rE{ddZG3GS|lEt2;4buKKpBOk7xix!%cayVgYSf=-|tgus`g~M@h+GtOe z2s}!oEyv{git|}H+WlLk6EeHBqrH{dFKsX_Up|`!kfu4Q4yx8M#mU+l#`8bLhyy7C zq3rA-B_+?12-4Sn#BTAJV3(mcyqV7}Izc&dfqS5>= z65>i&s#elW%4?op5@`t{g6maIyUYs5Nw?P1t-nI2L}kycokNMms3^k(5qo&h3tMy& zhn94y>d|i{V)o2@@2_A@E}G@8^zK%Z?$OabAt_qOPaxg#p(RN}OVJ#>oglbs6GP^`tI_!A|d|#HAH`OxfwMOG2JX4T4o5D)_ z?B+UHHJ~xJj-m3E^_@c*H9~SoX8xTV?z?y$cd1&_Y4vHj533mR^a7?ZAHoezgwoxg zU3tezL*=Gjyr+z?Ug;$7R#e9OzUusyb+OA^QFofWX$mxh%e}N!8kv;`OZ&w|!5mG;d?``lOaV=}8Q-}Ryn>K_X^m4=(^hVTB;ov)#238Q{~1N%1X)Li;JWRYD&vlNWE3r zl3;Ube$ggk6X)8|34^8apZQ*^T`$#cAqndX9m!iW-`f7#4E2}THv1(<2|_C zVMl$kj6Vni1w7KrA6fMzAG)00(X6lMKv1&l_j~NfDnQ-$^}bxMj_xkm7|0i2b+;=l zjF+9XyX>{5tQsHbfGv7GtHAPX?LpA)hJFr1`-ir))`2JYa+t$!<&rzFm5W<FtT~ zch<-T+2`gC7qUS_Fv_s9TpuyFTsMIla@Q3=In{qqPCECXBW!{29(^Pg)i~_$>tB$u%l2aucC>P zC+_z?{Ri2ZYlPfen*F#AE1GPU0eMWf^c`(7Ts^};3+1Dek6y#C&|C^x^$ln3461u{ zVt?efufbLy=IZB6Pg5`yd?=T0sHC9B4b?qa?0^{A~XDJQTK7U z;?qtejrWqC$ESXN&i7KtWDL8TkysIFl!Sfk__TE?GnnW2yObuVi!+pYT?;1L|`L6ySnQGj!hEiXJ;2V_v4g; zzO<*K=%C|ZUu{=WsvO{+%a9xMqMU|P%}yv#?)K4s-PSvLl+sr1+ib^W;7}QH1dt^J zU~nzfVDLpVI2i?5ft%80SUNX#LR*ZcJ3%`CK4)Vxrz z8a&z_cJp3R0637n$?#g3Pm6Eq?X!~NhxZ)yl>YZ&Yjt;xBD34R*b41AH}dkw$h|-G zc9WM2SwGxL&uO|`l1uy=6vVp6#yU-v^G!4)#N9i$N}AE}qh$l}DjJv6wZyY?g+z2Nt%Bbm8Ob03ZSsc=ep`lxdz9TI-ac^|{z`Y zP6P49mV-SmcnwBky^sy zBQ#pqB=dag?gN~FxJ;z%*V&1`8!jhbZZ2V)Rlm-%M*s~8M2!N_sG#bz>KlzjR}oi| z!DVu>{le#zmdm{Qi`^&)w#Z1_z_Y)`-#{LxMvjEe2o9&^+KblY`xg?C7t;O-@Gf$P ztletEDIX&&0~|*Pab)k)`P>?(WA3gMP2W#^BNJor65tPyys6{Q-Kq%B=&U$go0Y9S zZppLcDW6Y$>KL&7-Qiv9AKn?;RX`S!t9tNAB0M;8Ar*;oUxWGs{J7L=DGlkxw9o1O zmX$0I0%R2;Iw!nBXQrlZ9bjrdx{G2PGfXn3kBJ9aP9T@af551twOj_HL`IRHH8QC8 zd51EBE^8^Q-(_eqI{8hVb=M)ZZG+3w<%WG~`ZndC<-yPpX;Rdz@`v_0*MtKvi; zG+XfMTS(;kQNak6SYK4z6Uza1tSqOOF=xHCb^=(f?q%S6)EC~%9=m|(MvYJ9U9i#m zv%{luy6y?ng;l42iXitdu;^u7NReEzyc&vj}B>0z@*Z1;rWFa+_nAcXsUwh`YM1E06m7SQs0|0X}G$DpP0)Z3q39FqS2O3QzhSJ!T_cbDB0V~DHFq%Tr%-I3A9Dc?>O;VK=$EeBxWU+0W_- zwm-DBJ?^WlBp8zfd&-HjllqH2yDe-j_3}O(-g-J9?vli1t3LRr}Pa7M2?V(N&dzBL2 z_~-u1KbPCGo{)u?t*h^(ZVc&NO15gy!9SniVD0H`vWd?vdJVt78W_xgAt~JwRGVk= z-)3}p7pJvVzvkI1jweg(7p~Wg0C2rh9s)G|Al4?6Mdn3t#Y~1nIT-3C0<}5J8y3b- zUI8&<9F08)l`ZA&jKnB`|HUqd{|Mnq_@^>_7_Lw$Ba`i5Z|-{7?+mVsgBjy)VQ<>}YTmC@1ed!B)h?HCUfurbbtw~QJc{COH@)274d%})!TZS; zup@3bCd;D8n}UHwVN=4~0O(H}6&Txj9GjHaco!^$P~|5i^A$AYT3A`c3)ugAg^`y~ zsFyDxGACCNmUu3N!hPJv+KErLJUtL{@sjF?99&ZQ7fN2aZ7c{o!rlK24b#_|| zvi_wzJ|JXZ2)t~ho;+aQs`Gkx*bJyJSeb7-o9MdcrJrcD*V)aL1tjpSCFaN&m7LBKqWZTQ#$(NfDma8YiBEa8`^13-I=qQk3y#@vyVk`G*_GvEaLV3EN;?tM40cLc)9xg6D> z1<{QJsS5O6!}yK9WA*RM?L#wcLV#j`0BQe$ z07l7T<8-X3qd9A*#Z(o2lRNDIqXk%cie(Rcd5SH%OC!=BNU&e< zBY@8VzJ6IRASbPN{$duL?_b!CH4~cvd^%#~W>(gdX)FBfD?KOf$B#9z)CQGlUBzN{ks>y?2`Wb@luDDPPjsAXKBW` zOx)Y})rqKasrlDjuX4UsvD1Cdy%n-jPZm5V{(lZ@6L@16WztGi1|vIeEvoi0ET;}Y zy#4fWFAK+*$|e`Ozd~t^&iFN+DMQRClZj+8kb*6id!dfd8gX*q9+>pw{D?T*+}H8E z$=ns$EN(q#ph5$(t1j2DAAgWP#=7FIWZFzf6gVCKDMg@Bx~Q+;gE({sW3yqF9o&CD zabx2JAt3{8qlVhkEs(zN%&E!mV!7r}o*II_H+~g) zAEKe`UE&n3d>UaupgbddiQ#LxeY*v=452M$Bv%ocZ5yBNXC!Vzo^V>YWb%6vExU1h z21H7zsUEKUbp24g5m%H@_&{s|#IM!1JP*JTrZQYNvO?va5I3XWJ zy`iS&b!>w)XpQKxP2Ozn>^X=4@4m%P_yv$>zJPOkN>lCz4wT*^5)t{%?3S_S)Us1h zSmz@!bS`XeWtQ;h=op^L^lpgClsfe7t9k8(Ah-&!*5 zHcJ${IbQlse(mo(nM%(}SkwC?>a0IuBH7GD3)na(*2vaN9vK?kwi|EeDE7=yp0ZC^ zUIrmiqobp6qf}7CExQRr;e>wdnW{re&dwpTzlPiMa5B||3S?cZt*Mo@O8?o>v`3Y1 z=r*V{O3+2=-hxO)omQtlY?%K=&<}}Ew)DbkK3XMX$x0XA3py%nOeG!keJ zui9_Cq%HafI&Qv)2bO$=IumMcYpJ##1^MJjBk;ZCgpFT+c=IP0ZM@)f0+t)WO7Q+b zkOTc7i+!_IaH2XraD5y3p%FwNQ0x3RI!CJg<&yu~aZt}esPX#e*katRdVJ9AQ$(|Z zILER&p}Zv#(TxmxSYDJeDS~efR)XU4esdhRpa1VTw!%1a?d-^5BXAn%KIKX1y?|X? zbzKj!(1+^tzU#leHfI%)O%jDu_M-$&gCmw1qJ`#}Oz(We?7pORf3WZJb_9k3EU?_v zCg}fzw9C8DoQ@}&dC$L~|0C+K>Isu&*=`gCsI7HnNYZ$4y4L^cWq?FOP2qO+F*vE@ ze>YCP-63{$^D-OXV(Nda{sbb0CwjY1+k_wyv_IQLU|;nvBpUo8Wh(;)bDHty=`pbU zr_^S4wgTLMFDoz*gpnsh8`($0`43y6U(_hvO%z17 z2KqOjpiI3td3*v-bnM2?kNV8Yi}EV{xG#`0~HEvMV9% zncwm;sl-2*Y53pETzPY9^A^_n|1o-MbT~kH1(=}*d@4a_+y=y}UZdms z7)1C6T&9Saok#j*Bl;HQ+yl0b==-9Ql3Wa9!u)jmi5ZYd4UXIkQ}xkFq7wvEP9-w# z>K#~!+#DV~2=X}aH+?6qrJ>Tr=7tQS`t`${TgWP~hyT7ey{5;m0c;%1gLdzl% zOM?ujA_^;fgO3Y(T!JjH1AbfUUhPsA!q=^k=V9DGJKYJkeqC( zE&fE2k5?g>tnkL4tPty8viiJOL5juEakr>s)qZdULlIlJ6GdtnHnPP4)FP;;!CBPZ_y(z?r-=%au^AL5`M&;gs=s{sRdvf<6XU+ z93H(;)RF|Kv+FR7_u0k-a&$mIG^sBDR{q|l+_!YTKH$YHkm>V0g#xhjAF_kxW{9mb zp?TN-g+(}WPUeV6`AQSA_rIMoXL8@tv6msXA%Ze$ixw~%q&}Ihu=Y2o>H?=xDDEGQ zD~b&oRB#{|)5nW{HgtjRlxq{fNT|u#k^Qruez5#D;_7G%plk^55V}IYs8XeeJeXM> zVANe8GngQ_>c9a|@ONbqV4us!zV580J1|6Bp^He|`4G;1FNqFg9ZrCe?4mm}yzB>r z6cnG}>EOlpTp3VFP<*BV3wP!GhN*PCYI+Nf04hu`k~MRdAt)OhDLp7MJA3GNWcv{1 zTiPD|+)sFNgR%(7Z%%Vhm4c2F8dM9Ywd(vfN2A?zU$sJV0Bm~sqxl)P1sO9aw_K>% z*f1aQg|adAY>PMJNz~*Dz;Ht_*z;R2{*mHdzNA+WJFi11f|NGxJ@XKt?LYA02*{E1 z4m={+Slwf22FbkNNLfht$E-pt{`*Gxi^IbpxG*y8#j{{fl4tqckmR-Uzrfu7|JLx@ zRr(r+!WwSEgF}eK0*Cf35ELFLELZ@G1}L7f{jgU*tAuj-!9PnI11sQH7z26>Qiy=ad3X;qx@YK% zKZ9BL^JkosQb!Z8m*G0Oe^|O`k@~Z2Oh&Z=Ugq7mO**}lBPDJJqk576Le6ni4V}>hi^m> zKI6^H&>lVg$6!x=9sX=i^(Z}Co?n6>0zDf-rBr}&yMJfr&VHy0NA~k7$lWS9p9G^G zhCUdW!LSR6O~xyf5su^yl*Lm7q%^W$9YJx^79oX^F0~8LAcJmh7J(RAFDgTdL`vU4 z5dD^Q)1fiM+`~fatapW|i&t{4(F_zX!9nC5TuWXg?=mynLJaFgx|n%xzjEo zSswQ^F@CjU39IZPg5522rX$Bp;!8aNs(fFuGhgfK2jALgxz!Kt*pyxJMVRX?U-&>> z6kR30mluIH4bWUpoH$Xs?CNQ;I^M*DogvWyv$jY;#YZIUd5)GSR($N3-lFwBvtZ&Yd) z59vTUmMSY|au=q8LNE~*$L1GF+dK0{;SuPw^o`mDT?B_YP_CQlB6MRHeVhyO({rtJ z%oLH%l-o+FREPS+=DBT)s+;l1EH+Z z77J*edHekc83Kg;mD(!Wl%Y;14y#*8g*%y>TLywu1uY7PI>lwr=q!~+<{fc!hdL#< z`<-~%vDz^gAl0^g<;=jap9gHM=52!<@V%)?f!Z$vn{!O&ks9@yv29#GKh;AIlxRk16&&Gd-K88LN9SrI75$+DA_ViC~#L|h1j ztjYYaVcEl0R9M(M8S3ze*G5L>2QfQ@ahIGBC`nu|h4D?P&jb;tuy1jT>)(Ve!~v^uV2YVHmAVA|q_6sQSPnGIA!2s+KN(gselE(beS zV$8sopkz=nO?{YaW|GO5v<+osMK9lLN`Nw(GzDewxfF_N@~zIrm|kucQg$|lD^0zY5A5QopW^#Zd;(AvWya*Hi0M`fk?1TqBO z20**eu*i^+M*uBLbg7k5^r7t>QBl6*BbyvvXPnl7O}#TBt<^?DoP-dszyS$CYb2VL z&q*)S46sl=K_`d}%*X0XpR2id3!5BJ)8N$T!U&}&dpiA1Vpn!B0x z8_hP2Uit9FZFwI=Wc;2q=;KOUnZac-2#yZ2Dj?3H?G3DR=@_lLtLt(X`#tmmKx^f!p_O&M-Q zOPIpXMLEE)gpUrRY8?0;W@cVh}l-o+Bonn^TpHFEdm&uQwxA^_U}K z_nP>;PJ_hK;^lyg&nO-^aG=VA>NISyZu(sqANS3)jb-nNV->6SkmLcG$Jo~E7g3Z; zP9$ivhe&PRF(K1g3*h)*8H5?+Xpg=6gl!Xb)l;~xgN7VQPT5Exxr7)IzS)!tXw|Uo zTR#n^%YyL$!sc4(Sf11(+b`A(-UT}aY$ME#E8s#}{q@QUUXr;~1(Dl1?IWqDqdRoP zV{1UmRRqqdUq?^eeRO-l3HXCzuWH#r1p(M^d;BN|+8u>@PggH)Ux3S_J$iR%v7eJk zJ5L`W>ijhoHs5n)Dh!u1IC$A^JX*1Yef+|Jv?z!|&x>te>8-_huY>LVlzSZV}* zf@Y=DD)tlFAGMT}BxhPSomS!d(F{Ov#{35a zk3ee#-UI0zT_b-}-;bOL#B5y3;ZwkF)Ok%hIOIPi;l>Av;WHtGfB(ihY22Ee3g7PE z++KT6*8w`R|GqD}uYkH5_V-7*J=9kG zk{JIK5t98cO0iGg^ox%G2`_1(_k}=dXKi&mEJq|qH5TRq{+>tgG60}jkO#%g)@?qJ z$_3(A2+(SQXYy)O6=3D>p%>Y8`6p9&_EH01Lhk8BE*{nkO+~V^v^WSdK+q!l2@s<@ zzHq++ru4PHf|RD9P&HSqjD!2Et=$ITGz7Xkf`nFdMkAA;M(odbak}egeAy2lC@i=!`CUib;KLHE#f@YuKON+q%JqA1j>d_;^kGNGritKtur zleTU~+xBA6T!w1<>D2@OCl^>X&r}1@yLj1f^B*0}@9GrC@-!EZ zN!_>s6cG?o5HyH!_Y^{hG0Tih1EoY^m6+G;aRc10b)jv!O_*u31TJoD_M~AIio@CC zM?RU^h9IR1kBgtzolGdLP|*5j z3+n$jUVQn(iK|IwJPnS(0VC*(DbU`rdKF6KWu!Z2jgU`Ohr_1>3osASI2(5z)DONd zH=4>Jv%2ixYymhfX$Hw@`xUF!W zLH+Kc^@M85;Sd4r;p|X!XBrq@>tK%MH6tk`CqNUfLrlkC#eMH>`_^)-6U-Hn+S8Y% z>u26%K@ebJnn#LDb07U~Z87TbL`w5E820n~phS=evgU_GZst*r^-clg+Wx%Sv7nv# zoq3$3;ynGRWLg43&HHPCk4%Q$ks_)?41{$=NXYQ2g2m6$ePa%M7vO^`E{4DTIMSsy z+P}?buc~3>-VITr+U{fFAw8thZ))~+6B=mmg_TW)^LP< z3N>5J;Ekg5?p6)0wSeY`ZF)ERpe+jM_CM@wWKZ5WH;l@x>L$mBIMd|1Q9A*K0*@yA z!~VLYOSP9a^I5!Al^hhQL-&gpnlb~FZ5PsHss@TDv2idQ%j4;dL`GxMeZ#1oH<2#( zuOkacC3GzdYFel0jcTt6T!)VCk<>}4p|^*lxNnUlf(F(f>hC~No^E@bffUu? zX#xIvL%Q&F5o-Du`kP2;Hx6270VO4@5N8O$m1B z@hfQSSj%`M4#Cn9X@u(h0Uo|C38#Ed$D0({07HOhpX}4fM#J<{y&L!>_G9Ghvk4Bc zSeEx*FYVl_7XB$aD>X+H+(mj+PzbcApVx@E@Hl@%3jr@@;&+a0f+Ilv7MVogll zOr~q^XF%yl^5!Nf(>bXRKRKh#u*Yk~T6#!5VkauiriJgXu=U{!&Wtzv)%R=YSXA@W zqN5-Ft>>aFJ-?IS3{jUjSa`YV8XYFSaOXsWI>HQTF|)Dy3Tp6%IdBT=ov;_xY#xNR zj;Sk-d47a~uY6IhEwjlxUu+sUQ*(Sny&O;Qs zaY~YMIvra4iNo;Z1T>$~`>%XV_?H>++)s1qTaxy@P-GOJcn0bOdbuhBm{*uA+XQnj zmaW47+#qPa|Ak~!G+G~YdhO0JV5uN5@jUIX-f?{GcP{|a6ag%8N9mSoO99EbX~(J; z(Ca3JJk&Ln2v`K4jN?i_b!uKEAbiPr+Qz$FP|`&Nfy#>z@6y_efBCv^(VVgX_K%1T zeU&aHlP%xIn`97}D(8yo8i%Hc1iG@kPMhvGv~GV9C9-Z-*KA=tb1qGuHDjm2GOtVF z?P6Bm8cjp)b2@FuZjSL14N&Rr&s=j~T|I75;>H^0@{9kUooy$gIK!^84-Wm?H|YD* zS8J=^ty&f0<)GL7T_sXk4dx=9EN%uR9d%+02K#S?efn-!hgT3=SiKU#)*|NZHfr{C zjO-C_Xfx}~lQR*eE>2Hj3C%aXzeZM6v`2Jsql~Wg{)n5#2}q93JEI5O6*x!wwd=eH z=wBMgq}-EiLy9bn?PRN5UG>~ZnQzwTBJJmcK8rIoZ$XV{u1)isKx42E?{To>JD-C} zJZ0C4F4<2`mz2tlc0O*hpG*0*()2uEboG}AK2?F*8kYZ&QCjGbzRgduk}hI32FE6(BN!wdqxMgyI^(7V~TamuoZdjK$&e#a8k3XhNn8$0IcNyKHYZ zMnkr&sr@~^v)0oSoPlzep29%Qk4Z`2{5i#dnoUezPx85{8VQQRjj!+|L5G8}Fqa3Z z>R4obT_lgH2lNoRc@b>y>M*~FZ>T*f<2y7M@EInEc1BNMWB0%h=YBqLAeaSZuIQl8 z_UbvpKa;Pqb5%}Z`2;tLq-j;FyZCT@nAVf1w2N(zBP@MCDB-FOB@+zaYZsZB|G0QV z`^hacWqf;gYnRwrZPLB3wS-m}CQ;ok-jAzd{=F~5d5%M6oPr)6lL~uYF`#~M4}-Ju z%Q(B76%Glik59z}%6Ur`Ti@*o#VQYdZDnQ~s17cdKbSfo#mZ>d$Lir5|ACAr9Ayj4 zWT4m&k6(#(H@p3LOTw0~u+|n(9`;!)l^XNkkOr1suc4oZ+wsSiGoU1)m9R{hYm zqOZI}`mRF-JwY$q`Bjf!J0&U{oeHmS$l|0Eku~ns!oxPV~C-f~j)=a18CnFngJ>Fc``Ix#gYuuYmV6SkNdM#ly z9pvieCFml%WUc=?Ve9$EHJ#O}NC9DefHgZ16YmUTcU&zqwa~5Vz^q(+JTeVS`SN82 znWjEfVmGiW28<&;N`XTFhql(;BVQ;dfle+GuK!lU`r_mXWKW{^qO79yB6pY| zpVrboZgA~Mx*x=?+w!tbNi4t4T%D5MH+)%fQPZum*7)&S*Q*4a10k*-5+%=OeC8HPXn{Kj3+>CM7VxAY*r4Em5)e zW7`i%Iw@%9j*d2!u&m~bm|CRD(+JLSQC%N%C6S4D+Sz3BtIDjjJ&cu?(Gg`>R}d@N zCiktbv^ntZi1_e)*9xmc8}feXA6z&}bK(1t2%7!$Lp`rWdx8k+!v%;0cXc+)NhlxR zhZXA@ckR*HoLkPbP+dRO`oK97P4C0~thls3tX5SPlw`G(Sl~aiSlzKamCdrqGfrCk zJ{hOy^~hS*YXy%@BDK~V*WYTXOV1xWh;wcE`E%`eFQ(>lq$>`kpZ z;i!aNuz$>Z3-;)o(!s`SwH4(`w*IYuQvzJ=G)S{ z=lOE9r2QCCD~_quG4o@d7KYu?nG7+;Q|G;he(}!Ec=JvFnoX=ZM;(pgQNYC~)+jnJ zdD=;$@xNZ9y^FxSe3!aQmt-3L?naExSh(sfmV(4(Mrj!Vs-QMD%5U#fzTe>k3@GoL z)50`D@>R?uD4!>XPHjDpzfxN62wuoz=C2ZYs#8ogLwTS3@KUHYsoL<%Ld%S>E;iEW z?j)p7HNzIo?}uDz{o(e*OU$axTS_AAdG9{Z%{DffDq0iZj6t(=E!P3S;>Mierq_VwmMNWbX3`%Q~# z!o-K|UkVz!ZY7#taxFB$;kYTmSL6d-=DU9Re|{D+eZ-%AC!<`W6m@h$QDL`)lP=s& zbBdovdSq#OGXz#u*g+pUFHM>CmS#JIxQ|#;R2p{nrk` z)XAH*&yx;>jt_aN2(OiZHPPnU9g^hMmN(j=5N9a~xB6#CxNP zk*l}x?O3<;4?}y6e@+a|cSU>&SuKnD7QhX|J1A!-)k5g67$P+KR_XMdXh&iWB-~tE zciu?zzs{T(8g24SB9(C3ejgFqwcW==WAdw_1=_AVx;=GA%kPOFgBavDKU71o&TuZcP5V@(Dy!x^vEg!DsGLGbZchK#y~Hsg?VhX5HL6U@mWNQcC%(3ZDmo)Drng#C zKnB?uXBxiiSM-b5ov`YFK>RFe6HQ`%T&_cg;cxR{+p$66Y_r>w7ltZ9m3qstlaXdRrs95&VG?$fE@NPn7MA|Im z_b(w)!za8L4STdAIhT08H-rm@tGTzfynLCjpm3+?awL0czWuNMqWb{9kncLC=_YNv z1$ax`9vo!i9-sOm-uM+|lo>kJHoln!U`yHR`9{>=2|KgPGWb~PbF!V@sCz2Nn23 zi+m-*sI!4T&6Jt-Z)bJtO+NUv2W){gbwH(3<7~r;b|g@={8TkOvy z3R9u2xXDZ22rlj=e1`odwmt_$d#ALMa-t@8etn?dxukkBK9P_4*c4{1h5=<22-(o= z&)>58ak?!ZW-pW_3B6ARE58J?dEe_oAi?RK(_KpFDs5H+A3jIaX!D&N<<#o|Xq8lI z$yjoj@mtuw+8GGs9ocdXIUPe&X`{|u@J>KbZko7AOET*L;!n)6mrq4_$zEwLkEcd* ziHf`Rm@3bezfDPskyx&?Qb;fVD&C;Mi<-OqJif`qPW@Vt6=aWVDoA$3gZ&0$)Ld?q zKNZ1ph?|9Nn$P@O{6TKGbWw+^q;vyq;R8_=!=ugT7DQM1uW=Sy!LEp zhr2-(olq}z!)2ZdRJip5V!Y;uVk)*RziQ`KD%m%(|D@ZnbKS5|;S z)Uc9x*aWTU2-9IvF{uZ<`_1||owksUjq2!qT_q}4Aqd!ylhoer==WOFtK0n3uXnXu zK0+XK#wKQLWOQ#bO!8YvA9ywb?!l%d5o$r2CP8*USdHdhE>7C_woy>Ty0UCgsRcT;*PAuq%xbmP;j%=@?3m$eR<^AT;tKf ziupnj1UZIc)o(9FXWV_Z1{-)Prf8t4wE6oCnJ4rtt>XW&_uf%WW!>L+W*l|KIw%SX zhy#j^B1%!IqX>#12ud#sN-qjhqy@)8rHcg+q)1Wey;qeYB81){G(l>p2@nYHK1me( zK0d#-zH9y7f8OO?OMxW!+kvr;ooOa*ZwH#@xS(>n^d{@$rTx9gbX0YI3WF-g~jpQQt9jwO{V z92j4iO%iW;4fj8VqcW<&&wW{RVI);>`Ez%lUr?3tPE12L!t;zr6BhyUZdvoPZ@q2c zpMPQoW*xh}EO!1l_vguxAz`L!e>P&SYFLsEd5(y+{Nj>4912&~1H#gju6X-Uc}4GZ zV;{5oLsTe8Vedz?HZx@H9PbJY&g&#-tQ)=2$7ehz0wwB;I=j;W(CzBua&$yiXRdR={cIzCDvxr->&l(zoK}7s} zl%Gy`USKfgcNWWv+H{jD$@N>>hFszcSe(i;y!M{FZ2=O@%c5%*_55u|uv<|@5IdEl zkyeaKI+%82Ll$7qT&LXl#*+p-gtw43_jK|zf+8v%I`&oB22?_Q;`DUlwC8!>XN5_m zvR9U(T8$~GD%DrunfFqO7mgc2QHE(%*6*UZ&-cl|Lz zwg;6j+oF?ng~XnCa>|%WydsTDTyDIT`ci}iavU4{(+-eWMwR)}=tdXGUnQS;02yZC z5DY#JkEoQae~kD^j;PQc8J|!QTD(r?5U84XsIn? z^Qa~9CA3(h2_r7lXBldoHHpLp_I{KV#F% z6Scje-gU2lkJY16zt3i@N>-iKRjVRwEv80JR%{8NR$)$LC)`Avt9h+!+01*mcPOV! zz%s|9Sv9WQFT)uX_P5JxJPeFyKM}zFlfI0w0~PlmnI@dDvAtbt-K?V3wE^Re94q#qku(}_W9IDq{r>EAdBBjJu9=nV& zI(uF`EH+&W)?RjpAimHH?FK!l6)ICPxA>Xjn~&A%$BP!2 zB{}kkv4dbhpYf^XBuErHL{xz9b*5Ho(n|ZCtJu$e!C=n@v-$02p3dz88!*G&A4WK9 z^FB}JZmrXzbjvPIJX7uKkzw}*%hZ0!7TlX@w_It%_6fmg4N3PQn}S3Z_ZnG<)X5J% zFZc6hYq4hMO$%Pc^{adqdsE)sV#U{|l}M;8Z7%GKF$@?B{KZw}(&!MMqoaus)1iCt z98`gmh!$i*OJ*eZ_9RM*tZeQwcHFu?nSnXHcK(@K8&6vDEIK8OCt*`a@TgS@72>!A zqiT|KK6m*?)FFBx;gS#?ko9Y^#)0N&b+r|~{$i%2G&Kvco`oFiFT-;c^@4o6^1&o0 ztZw%cQ{Tay_)l0f(aRb>;}e#*9wpdS_VGgvbOT$J!JEx3d^1ahW?~-!GzTxK@wj1ZS4iQMfv4;Jsv1f19suSCuj4zb2Lr6)xrt=H<$?B;zM;Y1 zVZq9BAaqb_aVzOoSR6KnrO(R*->{1vvm?6B$qLp~)bm%rR(X}%i7+8%sZcf8S9r!( z#-!_f4JMft@@gbuq#(s6T!IoyehVek{JXLG<6&i0IZlgVBRSa)=Eo9sf(2fr{|05G zKGaWN$PSifUtA`LjyJ6>cwwu-vYx|0eIO;j8G3Z88O^{^vUCZrytkGEcZzrH=HuY7 zC~9)Yh9GLEI%=Z>ObtqP-OPc8Wl<(aU8j?^VTQGUjf>;c5;({>#*My{rG!ere*O0g zqfh{MuE8>Fy>08#W1n*}z!!~F$?nBRo>GRJyhi)TEe_V|1|;NI_Pd?aEr?PFmk~oQ z69xlB5~fF|bkrwjX0@QGOK{(0ekq#U97rX~q0<9ea*HF^p~I0i+-mx`xyXp8h$t;u zw(Q_c#2xDe#)9*meBrW2a{Hr^Iypp_U3b%~y<~@NA;r@RX?~RJT50g`#SSGDGMD3O zvUqk9*^X$!b4C_2-GJ1l{|2JKVd|$9VDPxm|_RW7GkI<~gg zE30k_0Y^Cojsi#gSu5=zchtwE9+GEFg0t0#L?t}&pv`rNN9Y#rP#$hqArfa=-XI54 zqMs-DKhBd?&^qks7{j?edcC6{?Yv80+Es2bC@nm>gS8t{mQ~kEf~Afe(ehj7BshTP^cd_U8&@Ow^%r%{^>$ zJ))r=Ml&DP0`&$V^**7gNdqi%e3fOIi9JS;&DowGwAe-Sq2bt;EFNHBse(f(mtY#M zk7#F}`X6Togzoljn1zn!H=E`j9%bdFg6@z)88Y)}s6k*V!=R{7D~bv_-QJP|rUBJB zz0n1&z-D95cg0shS2s-Cx>#z#m9wYuALy!rzN5jaN{jKEswPUrsag)_rJ*B$J^i}l zdubNh4^1vxYKs|N1S4>-!AZO>pjztMV8Me*53%6LImM#wE)aSjP#0^@7wD@zFAS}R z8)qLb4W%5Moe4-dub>T2io-$%6l}=^J^L`$JZU>0Q)V+3s>d1RujV=Cx zEJ()zZYYiu-mOR;6ZN``Q&3PR^HodQNsq0wrqs>(R}K+pWMW<~4$7MA4+6QY2MT`h z49${OQ1i>Ky6VO6uX;t@egLKmC;~n!`76zU{`a&3RPt;7(^MX9Wpyhw zr_Gha?e5!yHa9ApqOgwqbzxpemVGochIjSnrteU{&Jwt0Q4Sz7A%DiKT z?H1K|V=PG!P4_Sjh2Eg)maR3Xc1Zj-Ymd#svrOJQE``7`hVOnPEerDt1pSPcyI<}U4|=*J^L~O+nUhbHU{Q{C8AZZMll@^zszMu1nq+a#GKwq3Yg4 zIlL?ED*fS1gFSdej9%wE(iWK*&d6)%>O7-qOVE}yW)WdBXZJAy7ijRKDL<+|_v(tP zoo>TB3o1>|rwSsAQ^?5%DB{xJ{6O?dNvelS?zhs;E?t@X4S-KSaS5fA#0k9ZS-|zp zNOea12p&c|R8tbi3j9!HLT>V>+uy1`cjCZGBI1c&>U|Eets1X6*VThC8a|5&KMQD= zGV!U$!)7SvNG-AF&3$-M_%T{ex+!d>Jy(~Kh(G`xl5shNu`_-_IOIb&^m_<+HxR>l40M`RV%t5MvoU>!3 zt=d=0MCdi>H~Ci@&~-oy30u9Qi~Sk8qT6F)COvF6DzHBUl-iBHpHvftP>N>BmK>uz zd+GO(_|{fXiNM20Bku}UnKPd3LOdODWGf%IAt-=0z;%c|H3S^FbVr77V5zO8f`@Ap zSF@XA+Ddt(9y9NhUgZ2nPdnxaOW2sm&S)R^B}QO2dokyw{=V$>iaINIB^fU9_GOg_ zw=?F1{2-&d(6dp*(ns9i>^8MZFB%ReqHVmPiE64Ecow(UTa3_`-X)(L9A&*IaJz}p zbuL|As}4y7Bnm0LY2Wwf>ySl~&YGCy>uF!RdUS&b$(VZnJxxHB4efSU;xA~2c_I7< zt2be&(J5)_H*)&Miib#*0IYa4m?eUfZ-0LYxEx##mMO2a6dtLydI?Gy7n%GA`NwV! zYF;ziY^8l}1=w7(Z8$EG+aGLe$f#_+4Z_fd3wN@&p2rV zxWE7_mUYDeGDePtsBUlM9R-!n76ef(yB8T|j;!x)(vD|wZbn5{sexfpZ93wwE4<;*`CO`AYONj zY=Q@I0PWRobh1V0M8*-3N(BC-o!9qdsVvnMUri7gCzO z;|=p&N7uQTmA2YS5`s+zLEC-k*I~P|Ipj);>+c{ZbR*Cp-Viz$R!EEFuKTdq05!Jf z%j19^Vl+=G<7jqUSSkI({{c2-o_R1NtO-;JoN`DXQ&~Gb?Of7OrUE z+#7QL5S|K_Of;pjHb88L%tl>QP7U zALlpXST9~KnwYu!kbJz>mh$fa5`_C60-0oM-Clp5n zep~j%nA8j18fx0x>Lh;2nTkKyBPiVVz;Ke@0E3gQl&sj@r}7BihMS@OlJunEdAw*2 zZ@gE7YHF}-8+^2p-1mCB-O_?8`)ECFU+2!W6N)OsAGrz@$c~)f^mh4Wva>3;sPo=i zAiJIEts1k7RM}|Is&Ze8NyP`LPmz-zhS|zI?+u6WIvzwjU7OzRNUF6^+By+Q2|VFv|~kw4P(#0@Pdm4NT2bnvx*PZ~l%$G%pSXa9t8jEw0bK?Z?wmO@k` z$9i|6akkNF$cBp`67D;ZE-L}LL%vX1`a_A}Ed_jqI=l22$hkxwKtfc#Lb^~j5U~`t z^(+*#@-SK~S&SAhiaWr5Y$)6$z3EZ2*Ih}K*fi0)&=or#fFMRBN!p?JG2CMm*vZS5 zdUl9}L6Ry8yz?}>XcO@mJG?9f?>_) zP!UXXl>XeB-;wrKoK1<_48Nl^%dU(L`MQO?zcf6Q1Q(fKOo$d` z!Wr#@c;%qNhUAgQBd7bQsQFDY=m~r*GX#YXNyRek}07!MUO7ml}dPxHA z?>4;4NyKtNR+Xnz#To6e(l!$P&Zyx!8#LENPLv>OBG`$?pfsAS!ei6TjkGuokvZvQ z02YpurNXEH=t_Y1dowB^qG>zs`L6hhpoBD7KT3kt8b_V$xAdw5q}9pb@^V@ z=mu*H4+n>s(C#63PXx}^$Vo~NjwBGg-(_}!pZF@t7*zN^56#^+W?94<)B0i^BroqJ zktb9IsI39DYJ9I&*&~QW53!$xW|{ULKGg65ohoQ~0q7+%0yDuZK5u_-0KU+WRlxh+ zfFWyLbz7GR1Bww)lu;r+lIn}a8-PiSP^0dfFUCbf@S}+`+ovY_27^>XTV*)K1jmPK zVceQ`K&cKA%{@=!i4SKBY*>UmkKP2XmA-`lqvFUI4Jjb# zOhCY?qRyVbXM{#9K_iMcu$PW^9h^1yRZ`6y$6f0NwrTVkpFIIs^s@eWdh4Vc8MK$ZYsgIe+J! zlQ@uNpP2`d{wS5Xu+!Q~f4~(=@b9U{`%1~KCaC8R-|lhmxgm0G^db-#zXe~ds6?#O z$TDtla}*e|SY!T0IOq1sjM0Ri)I_tVO%klp<6S$*pTfuPS^H6p8U_)x=u({Jsqx0` zauMoF|AhiGgh&lv32;*?@EmFobXV-ajsuzNCFPu3lHu(og>~&d7hH9A@h>d-dRhZP zqR3&EO&3v{@dO~L*%H#cMO)MsHZ>ucKOB&X!RHJPw@s?h2IDxjC}79RS}>OG{SKE&eG5-KpYd);7!kl zRBPtRHj@i4Etg|35QEiBQ?LEgO!4>(az z_M^!bBnbn6YLo$&<>o-D!<;;00I%}U(zI!q7L!^X?oXq8Gad2!Y6kuJZSQhzUm$P)yrjGEx z;B|Dst`z87sWp7-9KdU6M|Ll4sDfv)pnbd+T`xR2lfr7K#1oVzNUbP34$VFref3xf zoNSgdH&misL}^@47C<~14%hqBgk|Cgby=qwc2f1Bg`*%8M{p#sLs`L9B>LMPJvf1H zYe?saDeVK8cq+KvJb?80pGWxJmHxnY?`|%kCztPD1xMJ6VCFv$$u)Er`k!y@euxnD ze;&&cB6gpYns*i7n%kePlQexcC-ThRCx3q0dm?(5iLfxq*8Bt4zuU6@OxwWL$y!x+ zaem9)O}i3$xfj;vUO&DoF{OrGd~3&NR-G**Z1o}(C4c@66!<@n-x+8-#{b7VKR=H7 zshOWn@Y4x?0te=&6Z~|7pH2X*=_iHw$q9Zs!OwK?6A6B%gP-XDD(3%nInjH%@T{Vw_Z?|Y9+spfZ6)*>RV}d+?#JR8y%yhPUQ4GsTWy$HcV8f zsD64&7uz2m_vK$du`DE|OYe}sp0NKVWsQK z+<7iAUm`c*cYWSqcRv=@-qE4$>vAl(o{(g+1fL{yomEm4IJ9mzgZs-5*b9GHSrm3D z-Pu2>VS1l;lZ9zjf9iAlDSTh8?@!C!vh6O(#CLx1 zKEi*y$Lp_eVYzvAV7qD`3aBb+tQ<-yi=L8wx^rh_da~NAXqavx^ZZk_&pOtYGtzpW z(n9SX?{v~SoFp~WT4q;U*YR|YLMa%z`Y!XMU4!4vBx~$E?<@t$P%}R!vtKhPxVOkc zE9Q_}52Hm7no_))y}$kr$+**~-}8w3Wa+zx zdgekG5pY75O!S6ZP$7`)eXF@{<;qQjPFD-NTm|4Q?_ZU{)I1YDNMm~Im z2*2}N^^x4Cx#h$XP7G9;arqB;?ig%|Uuu3v@}J=y6bdnwFN`}bIH4Zsuv?$R6>&5p z*MK-?>H+trE}5-^=`A>obdukDH{i?4*h}79?kOL2nw-yA@MZU26cLdybDXYLw#mufxbh7_=}z=80nDFB5kJYLp`qr*N9gc=fEVqW>O31SeRiYr@f}$4Z}S`# zSdCAkr{KgX?Pt_ke>oY->cGkp_VC?|9C&HM@0$nmwn$rGxnyxWNu#3mdckmaxzd&b z?_VnF(n=4?;YtGR3Oy>wkvpz6J2k(BKvj`qF&y-)EgD*6v&^t~=$a`Yy#Ky@d;6As zW^o+^tnz6;PT|CT7DW)_;tQRP-Yj7W_s_GtOrHS1iPTGo7Q+XDXO;wh25(#FlE|9O z#%h_G!40*+v%vr&4hf%B{>bDyBv+L`VJCRo<*4AEcI(lGvb{sOcYHdsw=I=B9>E>h z3k!L)L%_A!>+A2x!ms)gno7oWyXIquZ$-P6&RO+a^jaGKT~cuM%i`5uVvlLoVZDfv zsw$>P!jg5xpxp2Jlw`$S{-16L-{*M3@sc6#Wo^}^imGyHDZTt-JQF8{DB;Jra;r5k z0z)qv--Uq>C=Wj0`Iq-Ya3ENR$r)LLpYb7+9kv&J?jwY?GjH#_-rW&hawlo+wQmb0 zw#U8;&5%}0PyUIXXb&uaf#x3aL~UQm*!f!@3pkc9-q1=(PiB7KY-xGN?3x3YU|aUd z-skD~0q0n^J;KZWm4%m56zX=L+v;So>ok5GL!R(Wd^9g?MSt7mRq8@e)l#w+ogu#$|xaESQvjYAfkKmT` z;3jB&DZ!MyqqFI~d#qaJ^qyLoE&eS(vY(@Od`_yDh`n%vFyPo$EjoW*X_IYC{x%2> zlT(F9#hx%f7n|?8^d9Z5pdPjYtMx^U_aAumVGMV9@x4ObuYup<5l}Xgh~HRDY0qsj0vraNnBT#jC;iF5KUvim6vlVx-=NzBKGV?4VS^pI zg>fUSkZfYGuvkVvMlUC^e6tt^}xh`Ru{;VgxF4 zSG%RON8R(2nAZdsk=BM1R7t*UOFf{0PGW zUgj+Uf0_YWmH;RuPCwoG_@4;N%cH^p+m_@uJg%-{($C4?23{&Wsu>u1ev>>`>0g>e z!Tnv9GO|W9XAJ|=&COpmoWwu1BRPjK)YP4xqC~u3xhye=;p-o;D5x32c7g%&MX8jo z| zarYtsu{DB%BMK61-c!;>evKM&4x4fU^&E`PE4vtcpwUp>H$5X~=AXaSzgo*Rtlm`m z>mRU3z@om(He9cL)ajDkZI%J0(=US8gf+r*IS|h(C8l2;9GDx_*e5VnD1_IC#~2J# z_{j6aemgfW@X zAlxnDOhs;WNcz%se60<^>eiV+YwNkmen*)jK1n+nwGSs$kPvJH%{rEpBO=J76^5LwnP6-(TD-=Z+7^{J6jT?(!ll(1N| z@t#f9;ee{BGUY6Xag^M~@TU^hO%JAB0{&Q7Gr1ivda*3Kxfp)^YlQ~ZSD)-`%KDdT=N6~RHTNh7%5I720-oUEsLKa5 zN-@N*K7?b;+2!WK^+v-kS(F`WavL3ufQ`PKentj*)z=eQF7EVIbysB^J7K%X*Q3RJ zkIS?KGLXj@#B}6fOUywr&5q=P=$u2GG@dodi{&WL>uA{4~NnyYx0TIKJ-$Hpk;dv0?(1`K z+)wJfnBP?;Vh5FhyN6(7SJQ3(+_5bnXUb&x1QjuT&cFKnL`JX!0$o*LA(EnLo~d``SdbP8=lmgd%6*$*hbCeT|w_ z_%qs2qO5KT->cdx*O+aBClBiN*7n7cl*~iVAFsG^{L*55vpbo@Dw1*Iaypoai{PtL zKmaQJsR~Q-T?+22GJ7>FT4%6}Ve;+J_FJ=4r94T`DhnCNLBW}u+_&iF?EoS{_(HG( z>a$7vg!1h3fMz$*W^6z?UV>?BT>Nt!ANB?FzuL-yF1s&OVmK#b8pN%;mUhI_wvPs;?PiI<7@mt?E-e2 z09p2{v|uw}E3`GO3^Xb+Y2lyjyeKALPz3C<50cv8W-+e2%?$@8`Qyu>N}X+gcQ zBb!0#65QNE{R`@7VkBJSqIlDYz3B+%CN4#}ePN)v=_2|?qy1}KVv2tI4ptL<#S5s> zbZDCzR1if&L!QCF!Qb7!5ts@-(AKU&T9g|c@Ptz3vUY71Btv_$gsP#YZ`92J$RJVU z62X76goG?7CYr)r^t#_GM4(WYt7@3_5-Y!0TKpiuWQzg36#)d8T5X%AgDax9CT81h zB|Pbn2hzQ;v{c?&GPXP= z{h)_Ft(u#}cldjxJ;Odus)p%VY!8udF)-ly76k_eiaeqGU~F{e7ZWp&b^NZa|9|k zWzt=HJEJ+|6{oU;5&nVJy027HlT%EKIDl64l*cb{Gru3HF|P#N zo8M{4c9?Kx5LZ&;_V+zK8F<`@yq0f*Wzi83Nz=Y+RlfYH1=##}>;I~n=guQ%2Wkcd z2L}g~geV#S9|IghP~iidpwL+!mvqG;lNmX%98O?n6Es199STB~RhkC1tbR=XRGMxc zyaGDcgVGAPVt{RD)bw(4@?2WHpUJdV-Z%-TVkkRiMLzC_eSMrLC~R*3z~B!_&L6o7 z+(T^50eBn(sx0?YkYf2{#>-j?+?jGOLX<%-MjC$Dgk`+>0yIZLGiquOMGc$;O}^)+ z${#|10Xi(Ud5JfNfzWt7-~1wPX3-g%O3Gv;O1; zk;)8Gv*Q~P0LQp$tI@7|%;Y|)GtQ2fQL&_5Um|zW`MSNkCKG#?~bbU}yt~yjarO&Vh7zpZJA@)R4B>7KQ*s*!RDEw2U&wwGB zk#loKhf@sKUo3$Z9eR+C!x*$W4vNp8TJR+`*@OTRI+6NEm``C}4bM+&uaAV*BXjOe zuC7lO%Q+x=AMQyX8jGj-EkxP zVv-)O?t##PP#m^>_Zpt! z0VCaRzf=o;#+-XJ`^F~QH0TtXxG)twP{G@Y4YGr^*k6d}Bp7Psb*c1J3cw!>*icry z%8ae>DUq9cnx@=9O+j}e3+-#JT5kWrat$$EE0Yp<1AH8&lQJ+}bWY&7o}gk*$koBP zo0c8soq_f@82;wR%(h}M(v&E+Ty^L>t7-8|MNkGZUXe$r;|pyX$Pq@ODintU6qJ#DbNro>t>HaTWN5Ft7@fTNYQJw zT4{h^x+yu$ldjUfY|4N@4rg}0;J{6Ox!wYsM|*RB(GhswsyH=RqY znywVl-7l>IZlA?gy!fRa*EeyJC>!; z_Q?Gt{6!}_pt0qEBPFE5M$spU!l3YV;*0wx1A&lja+*8;sfwv@`142mf!6v1wo<=Y z+baJ)``WJSd3M23!RdEB9WSRV@Le5F{9uYU=6y@$Mt(Z*{2>w)7W*kKQw7ii{Um7owyGrX3l|7f3QY7!=3w5IS2~0%ET<#_oe0eq zS4yOyPrxS)RQ@sUPLEtC$&Yb+=V+gT_ys2{8>Cla345dm$sPXVH&1KeGSxeC+v+ zk6dy}(-Ov>Fm6d8I_0Trys#PTjB*}fh~w{wQcqlK`ODSUfBrDC?r!BX&rtxnZQ*nI zJ{vtLOa`XUbptHJ@`J=!0BeHi^FL)5_xIz6PIiFZvGBF5Y+2rIC%vnL+ zb8>N7isiz_ioYtH|M&}sI^}~bELcUmgXsh03nwk>PRSk<5{KuYNyN+<@;TI6CLI;q z4qoRmb^tH38*VECKmBNEsRd?_}ZmV^Y~fGYnQE5~~RXQ<{*v zWZ~I|6R`yr|LH%N40Yb5%TjFCt-^Ag7hCooZx3MYSSqak-KZ_^ zB02My?kkQzB1~^&=)J-n_wM`w@$1oqFJy_{y(W+bj`|SoNT;#X~@ z`4j`9ty=%w_nZ^HbWPg};35tD$HOXxgGLtZ;E zHI9|Czt^hEGo%6OxU4Al2KRI{P@;^gW^?N?@F#sle%+Tep#*3wKsM?L$A z4?W8*JJQZM3_NW7a3cYF)Y}KupvES(a$?3Wn53W|kPXSrb$ZX!4&8klHF1?UIOa%hj&k%_2{L{pVV>1c zAuN8RBS}f)Pod>%-1Io2rv09H)x~-p{o)x&2c;7k?e2qBW4O^4o68QFf!P2-`P~an z3#aiqux1IZ^&>cu*#`E1F{8{sVD!bIw*3>>hIBkyy&E(B+o-G% z2}=T#fe=Bxmf-o&yJ=$l9r0bn7;n2I59sSWGkM#PFg`u}+0&iun>ZFa zM5GwsZ9)XMXc`(KFu4)y1Lr(46J4Gh81Wgmpb+c+$`o15f$y z(pf^x0n>cN(M9L5fy~Ta4`FfhjYAh;&9h`)tx?_9BEju>sIMe8VFZ z)E?#z)OA=QXOty|q&$|r&$zZMgDiK-Vl2mTtBvZSiiTQ;RVXsFEzeZY%sBM*CI>4f zO9tCzmE5@UyE10BjFbFT4W(FnA*78KbaFI=OY7TtalOS0Z)j|GPy0l^ScN% z24^)TV9^^i_Np)}%5kl$?nj9w>sL$5UO?rCNhEf|?ODr}ENu5_l{ZH6{UoWI9s?r5 zMa|A9L4uf+;#sJrQZDn#@RFq)AL&Du)WDL*{RcHSGOH*DQVuO*&@O#%#_QAMZGvO9ch?wRjc?DhI zD|Rz>IgKQ=w(;5KFWfA?3|d8{?+=>}Ojoj(1C5DuvHPwgcLHiK)R8;G=*sr_hsAno z^wh`ukFI8X`MjVHL??D=5lG5esmtD6u*BPRyUJH$o?DP>;le?n(?Cy@BGG;V=$AAd z&$W#+k(&unf;Je0kTPByd?39cS;xd?v0<3|$v>$mdJ>+@9`79DhX>LJ1DjrUEQn#~ zgtDQbW>Cd+BvK(s+Ohqv$Dh#3)&|x26k)5`pJGN&{IL2`O>q1B0&XX^Ngrhg1Uj&Q z*q)06yqaMZ*#XOfwjG;bS!psjv@mxd#l@c;o^ZKIx2QnB`NPDlCcjfcA(@3Gtffh` zscYI(N}uK0t6&0Yjy#w-YkoUF!{$>45Yy~CgX6>|VncmykqyTF$`6AUb!34>G(PNW zXksX*b<)U)WRo&b^D)1(o=LxNtBKD6)JU6aOE6j*%WKaah)WfE4+Kt-Jx!<*T61la zBiH8^5+Etn`CqHZ2pohCn~sq@5vBr7ad_%H!9?5wEqC^9-EHtHxEa@OBW)b;@d!WJ z+#Fv54a|h0C36>Fv2q1Z_g|Csm+B=9+m>MBG$kLo!p2U_#$bk64FMjH;54dd-`}Wg$*frJrmLdZqL=WNUgz5iVUsrI_2q@k4PYY(4G#b%@{?EZ5%`)d zF?AUN!i^bN$hRe9*3)O-|Ax`o@PnL=Ip zIS~`3=IKtkVVC+JA6cMK$s_Frh_1yh8lkeJGYiUIM1k`9wgV#ai(ELasKajgMUtd7LY$JKnEttH9tZbSo!&{3kv^_ zxls4AA;INLzv$?q>vE`}%AnDQgRx~=ylF~u*$&MzlEF+z9)(AZo+f-cA0O^rrM)AM zPj7o%)ZQ}@#oCQ6Z>lzmyjUxE?yTYa{Z>gWJsOtW6FV+$H2=6zvyS@=3n5mKDPf@3 zO5bX?+I)P-odrE^P1zYkTY)?goM;%1CCQdzG+&k2gqwDD!GCRLyRu$dwJ(BhCiLTE z#E;R(N{W6jg;k$LzxF@;@fY+zF#PEI_880~&JC+Jj;#!~SBCM&Yf(N2f6%%D*ZDaC zy7GQnfUbz2F7!2=eg-jJ6F*Uit_aDWFiO|N|Ko{lgE2W%)(o#QNxk(h%=su|e>Z*V z@S_x^ch}Q*uB!4-MtpVQsfvrQCq2WK1wygJFU3yg686L|2Xvd`_(C48w{6P5NP#U((yK>y2v_?)gIzI_poYxh*buiO1uH=aVdwWCD$c%g6WDDoTP5z*>_fmH!jHP# ziQdIW8G7E{Rajej*-kUUVRGjA+~;SnnCM*qSIx)w=q*7Qm@xnmn+>1a@s8pyGi{^h zmiRX}V)J+|Eq!Thog*H{Ile`6fg_vq`qi#_wBs1Z@|hq zeSJKa=#2E}xz%p^{y*7Fik-0^VTRZ3<4?YmEeQ$NwG6A;7wV*%%1qfg}4 zjI2`oy469l7msu%8PJrwO6`Ahty233K4ksmb)CE`*5A8zwHD^1&_$ZQSgaEC!}itA zMnUA*bx()ID%0IrZI}-MRJC`B-sx9c?8IxkCrLOQ<>1f}b>^asg}pciZ9?i{b$*q- zAF)?BXLLU2r@y!IqquuvV#-a^g>pP{JL;aV70~-Fc|O&ICzUPZLu|%FtNm?_8YNA# zB~9iGpK;PEY)doMnn(Pe9k~yd#Au(}JzKqAHP|m+YsjhNjZEDe8LN!edHd*H73*ge z2u|hZkr!JJ5uX%^H_w&2)FDQv$t8Zz2O}c>}p|slPo@YX}sfM z0>gd+yfWN;(rqxTG5_OAPrrD9&FI^#F0ZjgzuyzS0c zWn7#`R5u|}tq!XjOQ$Yc?7Ohh4~ERmXFeZkfo{mnc%SNi_vv1^H|&4-AP6fCnlMt3 zJL@=Te_h|v!lBs^&bxYIzqiA_fSsJqgIZDWLtRGzOpCcs8_q+9rv0OH)FMb&>EH&j z4=mXuOmPw&x;9ZErP!O% z<8%PnrER-%ZBU?(nOU7AT+LNPHlSK&p~)-?rX?_pz6@Jj>_-h!)4ynnX>meV!7?T|tujSs-cCri?n^BF; zvK0@wV#@GY_PU5PXWsHg1`%oDMJGuqsZ$ax(eurm1=-ze!F|ICROKDjqW*v+gepyo zD8;9zE0OX+{K9*FW30N%?Ag*{k1u%oaTl?ikK8jfrB^b07ESAFJ#PDTk#f%Vg-NWP zIAiOQ?nAS|Gb~os;kSv`LCIlHrPPl6L6XRfHSdJqsy=OAOWVw?Vxl-%W;*Y%$) zEnhQf;4HYwi}ay0!}}2~cJvc+HPAzF;4rsp!h5|drzA{YLVUXB(XPI@2CjoL$MG<8XY`@M#W-xA&9czpm~&zhf}%+qyz=Lvy$@+BBU&3A3=bpVN} zJikIQrXdk)UK8*>*Iz3k&LmFkN^o9J*6Ds+jidP{FS7uM6h`yO5jw2Zu(xMj=`ylU z{kj*Rmq}uIh{tjy`f|FiTSV63?FHjmE`#i)d`SWY_RytRv*GM6lO>&SS(P9^trJYq z^R4H2`J_{OyU{n`vei}KCfIK)ATT4u_}SER>H-Gk@u8l6>=Lg(fqBBaX+bIdgq8qj z#xKJ2a!vVmjLE$G67o@slbRYr4>I03c%xB6%W=_OcjueO&kXim7>v9{&vF;*7v)K9thpIv+ynu?$-8mQgGe!(gQ-^0B=(2T z45BOxy41sSv#%n)Qk;vxa1496P2Z6tuF1hAH0qLX-QvilQ;r`M0lw}(qF&;|MtWFu z&PLXxHJ`q81Aye{3r3H}j$o_Z}t!(o;V(3#CF1o zFep?V>Q%QG{}Ke>^b2*cN2+wOMe>^UaKKNVxdVrpP&z1U0ZNZ|88b>RI@UOC9R*6C zDT_JB$IFaJT5=3vPecacD)_pXgbV-%r=fy$-5VBoQ*sLp@UGEGTy}=zp*bznmv4>% zQ)IT-aJC}4Y38NTm;@`hM13C*njz+1teDWQIPz9fzTz{1VVL+a+3B?Va94vzoHRSC z(dn#4IW9ksYv9eOjL;(w)XV!CsB!zA`Ea3G*ox zvd3j%ibEYo)`3(2UA1Zle`5k+kNA+tQL8|J+#a1gmFXUOq=zk z+@pq%Ks?FB3}Us^NO4c-&e*#7R=}cTkEJ{Jf)dubQq3$$%W^k6H8w~RR1U_<0pxoC z!(EfmY`5p4O3n!9On70G8_d*nJO}TH^J@AG0caD z>P|;VI3CwC-Jhzx)n>UEh|80$GTRu2O4r_l-B>L&Ht4E*fQDNS=PH7&CySY6^m{A& zvhtnb|H{iH@)!?NPN6|ouF#JR~2Wn9g~s*X41AHvwI|N0ZIsmPq* z9s@VK6#%f7_r2iHq+c1s2}$_=@8EO4&=OE5Ef-_X+AWk!itM~cJpCNJZc|d-xzE!$ z<~8>skS8gGJTz;bYb*4_g}D0#6tN7E3A;F`7l7Z+f)yFgr)DYznUiE3^-k3RUq}={ zlfKGEGiWY-N*?0}EUQb`=(2jd^ZAlK&p$=car44>+*q~O-M?#s#2G=0+U>$OBlmD( zZMo|_H?9LoF^n2238fjYbv@!WH0%4MyH4ziPJ6uxCU}*N21gEG#~-B^futGMkMOmR zt8>q2=4mlQ=4rb7-jqBbX2&J1L$Qb=6dAh0;F3N2Rf8{`BFRcUmJ$+bo$W)Y;jVaj z4J=w2QvKW2k&|W-kI~iQ&)DApz);+@;cV+=z_I2+n`2;4yQM%t8=lubQbR?{Cmx%! zQ}tB587YO2S4t@JK!n!NF#lMJn4h=2^g{KEX}A?RhIEeVS~a?~fC_)(z_WuIlBJM~ z`u;(XEccrlC( zu9u|O3?mn4F~N8xD>?$HJlvkqBef?rq>n1G zxE)rNq_BIo#cKH6Qx{^ueN;{-OQT3&V&Y(F-+n2vW9gUAvgxEfUNhJwU*tD1tMH99 z#e08M{1*%Q=z%c$OAX!U9*vfv595P9Z8P(ZgjBTXM?*Hf)zA zm+`sKNI{%+lCtbh*I4%!n%}c1&?T=OlcfXAA;uf;(}`6j!@{ASEmpdA_!rY@{8LkQ z1#6DNz>@5sPednEJ_~b@>&EjWy8CX#_TS5W47W{oZKo;MY!6k}7)2?GJJ!6J*u-u6 z%M%wSd+=CB3H!;XEhZ*hg4(VOk%&&cl~K~=rL5)yV@i> zbl*%TN;J+c$+*~a19-0k&E2FMvYT#5_~cn2jy72X`wue>z+ag7yvCt3wGRD8%_O^O zpfcUcG)2CpDpD;NSe}^-4-lsaEqB|DohcdHQfxG(=F|MH$Ve1SH_2ZA?C}zyQ5Z7S9@pSeVUT>OCxxECM+%DL4hyiiSb*G^)tIK9h z$!9i>+*1)j(+YyHst)1mdL&24rZv^B0AG+QGEXu8WA0Ch0 zA_xcqN(hn$C9QxUor0u-N($0FgMpNQNGY94NFxnnP=Yi_GYZ1cNDnd0x1PcG{LcG7 z@Aq8SIVwD{_g-t=>t6TT^9%|_&yn?gq`#BT$xHo5Lk0_y72xMm=XP*sUjmW>IA#{w z>c^5`Tq<@Gz4v--OOY#&#Q&jp+&pkMTHx1^+&-a%Ncs?RD=%ly%o})j*4`XPqM6V0 z3m-zgy_E|h?*lFDyBd{p0t~{@pC3j}GCLKKlzOliQv3{GW$f#X&%x;;skk8*?(nO_ zBy}E2sE*`VN;M7z62ibXQ*?HOh+hrSQ5n^wbO#X_d4BMl9sevN=lkb#!tZt%$2?t# zwTa$iz-Cn21zJNrzva(m2%;2p@KbU0V}UzPz7sHfWJ;D>?j#DA0D%3_h2)C5^P2pR zBVX*4Jxn0HE%xX_L#IQb+mH_54D zySi^$C~CnOsHYEknzZ1dy^EhIk@EZq+YU56B75|1%%BD!%)C<3`L_{%z%x)@Q2=+# z*?sa+)COzEq;Di~c;)XzhSQp@@XkHU^1vn?##JX-B+)HxV5FoSrbNq&4EN575B29$ zKDeAO@SlW~ew0`d_OH@zMsz)KxQu97=zz~^Zb81m$y>CsF~To9&U9CcYT%V8j$S$Ac!NQ!V^jp#SW1As*WNEFz-x}{~ z_9ip%qRFoh_++5j(qNV6J4)FdVZ=$j9}5e@I##)y*V{aHqu9Z7h*Z7fFsx1UKmp}I z2C%ETh^%k#^3tBZmW765^cF7exU4gYhIwGU?Ro4KjyUntP~%#SoU5k_u(!qfIS1Fv zVYV!F)`k|@acwt_qK>5TD>E1PIgewqcX|Kp1SV#Mn8hoO1e1OKnC!!MO3CAC1_IdL z?{cwU)3@9`<*5-XNC=8}mZ~D!uMi?pG^c#QFjB|7H26hC7?CtKOBVupISQNQAaVB` z)C*eNhpqxD4P*MWtm0h8XGdsWxQy>bJy&00vJSzK*h#|MzY~aP&vBu-z$nrvCK&5F z%4a$@g=~5{60w7a1jG3#{;B*iAKL>^p?VMQRCH8Nk%9KgBM38u5r&jhE$ISF`1u za_gt0_zBX;@nd!KVuS&qp;bv75x0QH*a@Nu3EPTW*t-4C_o8+xj}N4bieWxO5hi^j z*UukefChgC=!*1Ar-o;*=ajl(Vnxqw^ zT6~Nik1j8N^6ks~aaE^pLuD>^@8W+Fw;gh(tIY@oUn(EW&ky3Pa>a4fzRF@}Rbt)m zZ8c3#2ex36Dnxn9wxS6?yA?-1X=6^DMX6B~Xto9q_TKbgx{TGO66k5607*~H2(y$< z&H-8sPDtb_(oWn+&X~)Q&o-cbGp5M=!A3i^yy6+8KUAecQjWx8g^=9cuF{4OIwqg; zja^r5H@3g0mpKP3Dub^T z7}X=EFQ*#Uk016abzcZtsPfUNh3^jty12``;8uE8NYE7;nY)CBnz9dg<-%!Xh=N_8 zc6r<9%XR9HmZnIap_Jt3eLh=cYAt#%2AyC!a5rV&vOumUb-{oz#9EnFoE$%E(8Jz0plUbTmHd zqs&6ii{7z(Rh~DyioSK~QYpNAp1iD>l(Z1R)WpwEjWI>0HE1D0fZ=KzW4$Wpal@yK zH#;sY1dB)S`xOgcHYi>#u{NUXzBIeASQm7CAF5FUn{(Wv06;{mA9r=?2kPV5o9{Xo zCMn<6#9mPym~n`>F5OPb+Du!qn{%PAxr)cMUf+#+dYu7@n;9(E)D(-*-5bB^RQqNe z(gt*7V8!Keg*7-Pu*t^r7vUnJs!L$k>2l z(j!tPvqCW)S@K)z;HFzf;3{@?yZ>-xU!Am{7K8L&FCcKiXtLKG`?-!O4CXbfXZ7JpkRG__#9doNNVa8vcAEi%T zX*sp9QnoZ2zlpX|M|l@4EPmUoZf?md!rnb}>I44F>5P_RkHKl#WWhx^Xb|tS>wiab z_}HS8iA)HIeBpIP<3eOM>d0(fQPI({co5z<%!}KEwT9XlQ@lxAVyP-uPDCb@*ckMN zsw_W@ayqp(HHyzaI?~ND{h~ZSRhsI?a?0zL;Pg1r=KUflwZ*C80YM38!a2Jx-{S#Z z^_3OI^%9$&ItHsL2{pBca|0x|ErxJROn&sK;2T@xCC6(?p7Xv7g)w?5;NH}S!J7az zbfV{3XCxwF6dxQ^Paq+#K@M@d`GRSa*3gQhz3U2PNfTkJ;_wMlE6KoPs3UX;I3>Ow zBwPrMxyWKS+Gv7NG-pMmj__npO^18z-+F)5C1g;0fmyr}-#xqP3uGrp929M?GUTqA))S&WrrYlOamgst2BD zZC^Ih99sCDDL2xeFhq42?Pw^ruJx{VH%j4Fb;eb}7K4|-5DH@G2T5=VP3F?{M zvO%WDiA?WD!YMjB)6uR%p|YgsH=s;~$n71hOP*XkrS7nPI&^C0#CdBrx&RHWq@+v8 z2udq#nmgP=E#B~5L?yCTIfM+EHd2I{G|HW?iy0O!GOiykS^PwpJ5F7zEm?K0pwA$8 zXT*~cQmRJKr06&E%&7trqzOy++3;*hYhanF*& z4Z7pKh4v5W@mBqg72e1@C?5P!)H+;tKZ<+~>bFoC1RVes)zs9c*ZV)?Zxj-cbDrw+ zhZi^A%&g$L%(G&fBzfCiamJ;0VPW`bNU&@VFHgUcqhh~By-@8t)z>GvY)KYdzmsk2_T$!Usi{#M zSKmag`wPjR0?hOvaNmU>d8&foD9W1^U<}%yITA+kWoHZIzD>DYX$SD>`X(u0iH}c2 z^b?d?WXJ5o{AQhF0nt8%n^j*;;B+`OASkByCDjC;q(jjb0~s`wN%Vr95oCeSf1wmQ zI=Jxl6k*3_mbPe&W`Yl6F|w6-X}P+36)~Q5Jx-0B**f(?mcfv8rM z*eINb!7mqEYKVY~<`4lef{DY3C#2h~za8&&-RM>~pTeyX0YkgE<7kk`e-n}Y1o;qP zqtW;r8!}S&`SKeTiO`9N{70W<<+O0w!uFi zTE9(|AnBlT!~?&7bjb|ObxU%i^fv(B=1^7@&*i2Z`PeA&RcrFn-Pl>WY7KC1@2PNc zlUvrYWoHi^4I+y0I$)-`f@Fk}%8;T%Dr0l=JZBTl+H~o4Y14b}5}3*kcKRI9_k(e8 zh}zv4@tH$_UT^#`K!83MlfkL5x3N^4FC@iyx3-ge^X@)XgHDh1+xuvf&baH+DS_Jv zERlg2m54=_Cea-rY;^3+VP+w;0ybC?NyBcP$>SrM4~>v|NvjAkrUCj!*SC3+(@V%f z3yV>?b8F{$r7ja?H5S#~?>NwPD6Fg1~@mo9d=-!~`KpY*&T1Q?Y zOKl(_YG-7#bqQde227LJy+e@lE|A9|@+&6Vbd(Ipb3Jx%?&}~d=Z3pe%n5`>WQN}E zqZ{xXO9UL6@3Hgw$zoi#?}}&YiMyz7KW|JVIDP(8hX?B;4ezZ_QA2WzN00Xrewnqt zpsA?v*@ep6n>sMS?1i!VwZ_;p9edr->({Y(3V|NWF34fl42Tcc3LF_ax9Zg@k-zl2 zj&_(pO1?XBY+cMZDU1-MdzJW^lYbr+t+`8i%rA>3mWj)z zO7Ix%TDAN;jn8{fnNQ#{lvX5|qEgJ^8aCSht%zvyYNds`1H9jf5~*DX>;j5-S-=D0 zh9TN{FA`6 zTvEn7Zm4sXD|t1R1xe`M@Bmbmd`Ss1p3rLSht~REF*mUG*>987z4J0iYcd~k_l_q- z2(uSD#wQ{t%ZCHre-m&xi61+!LIYopo>z-F{MHx0yP~xbG#JshXV48miQ`o2<&KLB z>!JB2S3L)8{@RD)j7OFx91F1pxR7Xkl+!Zj4JG7sKP{Ii6f)J5smNN5XtH!(#0>$fFSm;LggSCbSFKYcjN!4m15V;sO;9)?9 zNT(IA=mfnAPD{K>;PRBHylN~+uNznn{yX)%^9J7r5oyepiO}EDBmsAdJGCGz! z^zwI7B{Srsv)rh}_wS8M76n4YiQhob6yIMPI5eccRaPAS&^M@{6eV@r&29V%2fqMK zoTf)SlOe3(ZaKi~A51x0!)108&vu{08?F_`jD8oL3-FjDKHU1*UY}fCEV%7NP(iq} z-`D-~H2Z^aLeGz!)>u9xv^}D;kWVQ|GsKro1GKxH>}Q_8b{N#Am}H^n&3idAesu}0N;M5ATCVD zNq9L)U$5Dg+(_fJUVsG7x2{TP+jOh?$^QR1q3^aJWi}w0C2vADIhTJ#DLA>vHVfba zloWB8F9~t(@b(9llZ?xcpC@bQw6)Q$KRf=-ar02c2r|gLuaNmeE&0%17jXO{kl_%Y z6pTR-gR3|rJ7~V;jiF;p>|vUkyY+ErFx!e|BkPQA*2z0+S{2@n>XQVJ zv*D}lq-4ns(a|&iAUUdaPDc|I5pctI;D!wbSKhTQ37qn&ZdWU6ywCnkJ~r(3)QAvr zLd?6j_l-tkw`gfrKxJx1{Q7smLDIsf-Z5j}H4${nVBqL`2fitsOSS=T^%7BbA>+1L zEz}I|u~#bX>IoA``{6~6i6cnVNKHy!Z7B2*OJ?a3mP3z9#tlPyLh*!cd62`4K z4}ImQ$~N(NUWa%R=4nx`AGj-${84$g|13$|1)=TN99`XzyHUOOkZ2%18tG#3V9>WW zwes9dZW3G{j52bA-s=XvJ43=o`*Hoh$6(PoE1omoEF&tK>^#RWa1ZY5oy{>cOubXa z1WPoxs)&o)r_>!h=DsP(_GBsoN>IR)1tGtoA~+dEdscvFDIk~z2%Tgd?_F@9x5&!6 z%8mxx28iQ|^>atfJV!AjwR3aIq~VCx`aZl7RjUN9dz7$QUnyFgn^kz?KjGP-K`U|D zo@w6rN_$to_7g}|sNTkH^uxCy%CZh1j(q+d`s692Ifq`YJ>>&dbnk;XXO>g^wbas} zs-kYnTq85$-7G`Hk*;?oB_9+d!eo@+l5JEXFiU4^N!vf#`-(oQ_DdGi&Lmg5qB69${w6np`-$Lej@%M&9&|5VfQsak&=Qlomk_6{a7>kLf zl%%?%h(CA;#bMQFkh8e0-1pvRFRD@RLEkCa`X!bdH_&Sju7SCT=?Zv(4Pu{rm+XCqsqtxR0Px&;zOEQmWWSe;uGd1J4ygM7BwXr{t z&sk>>JLyAXT#yGCqll|w)fh6A#Urr;dS;s~+5UN*BoBvNQ*0%Ec$Y^!ZfowRQT?#+ z@=@x)Q0a$|GcJ~Hbjn}90^M$ucSmRL+hk&|?!HVP2)%T2=rN_F4(PCMC&G5iu54qH z{TMMu&^nL&M2OmrxmsB~)r}yRbD(id&>(a|hrW0;xGFgN_F9d%c&kI}$~Mt*g5JpX z9Ppb&1pc2|jr!xQc4jxeF`&ioF=CMPiIhokZRM+w0DH^VqHi=*D7DpiuWBx5PlqpA zj2@$H49N~Fi@Pv60I76sOGk%(8jl=*C?q%JJWxHg&|((<0Y=oPm}?ybAm`4&he$2o zQX9DSSs^zisv-z!G`mh?G~r|&)Bn(9v~I>*OjRU~cTo(Td7A+c(3eV;;ZbP?$viWed$i?(p#bG zq@H{lBhRnbQ7CO`gvl3IBhpOFMR7YL&@#X{iODZ47*7?dNSt%_YB~VHb&9>akK)6U zY7n5q$lxFv3OaN^Te>@4z^ykBl_M(plVgf|_M)_&NoIQ_TN`f@yl|bPqto$iuqiA3 z$eW0!fM9&g4Y{NoBV=66h~;|RXBIwG1qbyz`~u6xv$#wMl7eV3VNS} z0A-M0`Ws9ptdf*$?|uAFyRo%u2FVH&qu7<&u+jLKoPbWVc-obf0odM~&XMsU3nBlT z{6ZczAZrYB^JhkbcfI8k?SIQ;ehMs2(YQXI>UCqbZ*(+7Y?U3*OY7P4km5;~{Y@c- zTtMt!Dk16e1EZU#^1Z?`#`^P&zdwODhcLRU<$`33ZA2Chkyud02qam@qR|QC-wm#? zcVrDb+lLDOVCc-qNE5p><~orRDeU-p8)JJ`k5oQ8`l3@M05_D+sV$GnhYHn?&P-jNWq}PfOv+)L77ySWK4DnPezY+SN+M5e)$LluCJ4FUqEdG6K?1>T{BU)o&H@&WVm%T)6YVzVtTHd^?EtuvD91W4+ z?wAZm#AcmBMKb>C8oaub+}*mF`qzKHYRb{|@GvfKDZ2|kZL zW9IeqmpN_um-BJ>IAFb%4y`XlBMm4>m(V!c%lG^q!9*gcV5>mZ6SU>P zGOx&3a(C?Vxm~DJcqp~hZ{@ngJhU8rx!Yqq|94Om+Tt2;=U2e~wLS}65Ym7wLT3KU zIV({v^^Lf-EtaW=#Th|-@r(Y#c2l855i^mvfD3X;FZf!w?&Uf#8h29Y@Kk?-d28P! zo8$$A$**Gx5nFMUg)Bfa6s?z!qtp~SCbg6#x6@0Po^z37iU#b?xe=8*n7Mg69mmA^ZoaSUho5um^)jp5|=m&5$ zKLiCU5p}3b_b*f;RTmVwZ3j2&ZS`_Pmawa7wCmqXmWi9{f&=f|Cbc+`FyyYXM{{pZ z-e0iYoMCfCC32@hO*FpP=f4CrGgRCz=VLl2;H&@ET=Q3^NQ^lpV3!@E9?^Ud)Vl(= zs)QIjgOHHiE#jAj-&1lt9PnFkJGQyM5^z?ri4a3Q+u2A4d^v$H8D#9?Da)9Mwa`2k zV$55`%quaUW%q-yRu8qDEM&DC@LwHL*KIS=(g%)XxNM9oF9u6)w54Z!U3Sl56XFT9 zqQ-H+C^M0i^6_IMsPRzxpTu{A05#cdSp&3k;BB#>#PX-L+FaXm5hylFOn=!_EU))^ z=xj>_6T704?OKo5yw8oN$9S!lNib~=x6cRY=WbpzaQ}HVAKx&9un}j3Tb4ag8L32y zy`TiR$pP_DrUsQBs_nk#e)sq$5yCM zqSED|OXc?=i#giec8?bArOP8Wx50yR5n$8`T$#SLN+2|6yVRwcs&H<{WvKaSVi#9v zKj0h8IqfO+zR)}SnM!W_6kbhX8vfO@j>n2IBy4}~85s+rr^FkY2pbWfp9h7i{4%V=Th+mdiSYR<3I46CwwXj+61M;kqmn2%6o|3_n4!i~@ zvY5OEM^LEyDG&OR$*nf#m0mx;!DpvKjrt%qjwPwDW32oVMOeLlr$zBmoJ6VRqdV*s z#k$v(zG7QiJr_sS_4PNS>l3`@)^#0cTe(@`jLTe6rx;W%PlA4^#g1g=>PgS>KH=rw zu+b2VUPW#ED54GeGI-dFtwgCj-i>;Ol=nx%gMb=Ct%oQW!3_qYa=IXQ514fgkQJ1s z9AnyfVu{O2*_(-k1a}b$(M|gHN)pAT`2r?V)td?2d-U=GVe1VpplVq10f6(>APAj2t?vZ)vhafl}Z~27+ zYv$g*p*wV*1C?kZUj3Fu&!##%)p)dF$l2dQQ=((ES0K)HVD`~GQ`O+jTM``RC~s040?09ZLe3f^H^L|= z1P+_A3%&#f$IXH(S2S?x+uQC=ybs~zmGbs{=eyBzkf+~a9@@-^{(N0Jv0taoIKeAt zVoNf6(;?P=15>~4%fO^#NLp%m;NayRKU+K`_&`Nc5ZztCQB8QGTGPg0WZRDNeia1( z9NlEb-qIu#6bucHzfwjlIP~@&`XWb7x-&ELDCrC;-Su!zDX-DQ9B(t<*rb-{(l_}2 zl>Yvn7f#qBiE+bK)58Zq0IfDiXbhoa2O;~%JOWr7^VJd9kmG0Ul?L7G4R_mDdrB~s z3|5QPF?udjTWB3ZskM-CZ3$@(A!2bQh{e`|2T|dvcSUDu9RSWsOIFHXKl->IVKH7J zbA9;ok&44;s*0IHOsvp+f$qS93^sl(sXL@DKVe&AM$}GWYh<;$=Q;iJxf7%nAJzKZ zSc8*Sf<-f1b7@d_@(^vaa3-L}t?b|x>s9$N66VCUF=)Id{7x#pE)Ue8V*c^|(T%i{ z$X`~XCX3gQwe~nu@c`PyKQbkCrJ%A+)8XY3iB~nJM!c9@87MCeE*UO_j;aKyev4&L zl~`FmpMYv)J7mAD@%O!6iRyv&zhLd63u$Gf{wZ1=(MsLf)X zHQtwRK7VburLG?Kb$PNBUt#njp=j`A%5h<4370yd(K396;Iz{qX~1{nrK!ZJO)o-e z>B{OD(&L4d36jR0a3F0eF8p3hyF@Ha896Gt6)3wGxRY;Yn&8qgO9S^ zdb%IQ!A73Cg}o`eEP5uj#_fZ{yMv&_pBAmGmQYD>GZ|bcvQo7WTGiXUw`h4sH#A4|n_b^FRfmdD)eQoiUcVO*Gm#Zn0w z5~~Oe=a>Q^kz8_Qq^DvBV*hs;WiZWA-P_kKkq_mpQ|d*hGj^)1Uw*gYVIT`m0DL3 z7<=4K?AR!s+MtKGqTBijRoR)(5L-%WD~1CLfXoLuN+gzCT8u? z*5aH8nA9+3FKU7d!S-H$@X3>Sq|XBQ3XbtKry9NaT4E(#*lD8+7??CR_+i<4F=1nG z)Up+2gK{XWM&$R3kz(U)KNfZ-+IL=4gx-|NY%dXKWIu*vtPuMx=z!V{%SP1#*SbG? z6S|Lo0-zyC^6fIqDh~(Ah%Q0?h8Z3UX;-N*U32ZyZW$J1sezs{2bx+g=Fq#_{O$ zHWpP}@Sh@-I=f{Mezw5}()r@PFc8L}XUL7Zqn6g0K_G;Njiy>K1*+RJ^+9Ldra}_- zx5g313?GK_Q5E-F4VT)Pa+j}~c|zECnD5#e3U1^Wu1IInSgV>J%@k7yk?z3x~WY|ZA{bmW^xuLZ~CY@_>#F`XG& zGos@|cGIfp69dQS$CN?9e(|U4168@2BhvYSz5x~JoJs2H9n9(0Al296P*C&jL21Q7 zoYCM)e|S7y-MSJi$%zE3Q9ah}=abUemQ&P+Q0XF*AF@ENdMl)CpTe1LW1%<#FDJ%<|I4VZz|s$?Aq5D^gQ|0do>+oYfrL+#x%JEdWSc5 zy(D2jcwr%`#jLpB0X_Pnwax_}ds;x?4P(8IeH~bG^vOKEK)%P=zcb-?{w-nz&?<^B39u|D# zeTJgP$n!HH>X>`C&+?D&9(d2eRj*8+~I>ogyh4N5N zk)DGGQR(i-KS1} z$LbWI-QMweJ|f9^Gux1j73J+$N^CK%5A9S5^1%_^k$ndHf5m$6&(ax-61yOgV`<{n zx;k5HE_JGQ!e=UeVA6WT&Opo9ok6vH9M()r5Zon^4pcUo7lRL@dc=lHM`K1NzMNm) z^xQq9=BQ~TZM(e{rE(ZJ_8GEg8NzOeMUN0J*qhQv@ungQLXYD@tJsqD;Gp|ESPuoY z2luUh^$#Ssbq!9(?sRs}Om;u~D`f^)&ZosMxLb~5Rdqq2tzsPN7mI}n>6D}IqA)_v zjQJLlEz0jSFS*aV)ZF#;xP zKg{P`&n8*<9faspWJ$w)op%uW668)RY{2@D5Z}f}*86C%IpLsGtPjQb$gX2?vT9|A z4hm_o5jj9ZMJ$FV{O(e%b)nhf_-@GX$vwmbw3b`#Ry` z5WiX@%34E)NNT2nj~XECI6-tY#_qQ|d!6)b$dO(*5`oZ9X#3eY65iQLaTz7Ww_!ij z*bJ6eiv!zuTRLxV`Ph9g;SGR|6gj0BeTjq+2kg>Q;n5fxJ#$ndGcrV}R@~zyQ+Cik zVf)Zzx8ON2KYY3pNvz#QTN@f6EV=WHk&I}r-B+j#<-F?)y$I&HjTPGwul*QqglZvd zL0Lj|O>uhk^Sm*IM~Eo*oSq%_&Mwp|G0m-h?YrrRmtaUiHw?+`}H|HP3YXQv}j+nHazRv5L zPm(Kfc;<8^pV_HE)d>T32wI5=w1wAJPwafn@m!-b3E)V=bLn3%-D`L$!B7Fbu#`}c zHImF^a5^N{iA5CDUTAI}Vd|TH1YF4E!)q{JKayW$20x4l+4ThA!n>^cp=>?88}*W$ z_KjAEC2d^>jwHK>Pp|n_t=325Ncew@<6XrXQJd_;OchwBNYhp;n|JK!uAF zTzT;v8WY5Y22(4r7fH0b$ipSPpXdi&Y=pyc`Xy{Dn2xP|U!S=iJLsi{=N zoSE-4%N4#e=rKy1cXLVY$UrpI()HpBlUlFiHHEF4)qCN?dKz)HF(@{oAJ`*Z=}&Sb zGe3ea)YbmDgexvq@PdSJY|8PNw$ag}wxteXbk30*>wsa}Al^dfSa!N#{Zg0!Rhl(G zSJErA(yL`txE*v?*K^=`qNC#jbDm=%^;(>ZK2Pqz=Od&>g0yZbKZE5CAd7uKR>->? zbYKq&r4<(T;DMHo^h6uEE0~czNkDH*?tz3CjKsdWGq4XOpXYaF>otcAfiKZYMZ+c) zYuO$8^XHDW$Q=_Ee$^@Qip2lj$bp!UN}D%&<=T49W`^||ETAogRz?((&>`_#D2R8e zdtQ&D&w!yZBF+O2PnKfOCX?GUZ;!yHGr=&Zv7iN?R$jsEwKkIMa44lt?%HhRWsphJ z79S(Olqyp&|4Yl9_B;!$>WzP{svqpi8;OM)>l(rX^1$(mssA)kU^wXchZI`rvjI5y zh|&rkI01F!q-YZiLmZh6c(f8Z)@5wI{YoB%p@dFptsx`7(}e77$gIlVQCyR^h6k9D ztN(G_QRDz7n3PdA5xcy|1~mp;71;RR0MZQ7*>zfZlKdW8d`Z9uYS}CAxd1+Zg|#|9 zWX&4*LFTpmv#x#Qb!{Az3xeJ?I#HXPhpp8oE23Z{s4G!W(k390BX{k?flSQ~U-+m6 zOd&GWO2>H>o+vnG3*L_?2gs6WRSfoim94+hM3c3S3@5J^S=BKJs%v>S z9lTNkp5z3&Z~(AdcoOUj``;IVOg!Q0PL_$`if(`b=7>ki3exJ0{?C*D>j^N$bP$55 zqN4*_ZsKs9$d)-&apr&2R&v)TeD6_sEx>;rv}%yEDDkP=Z6Mu{uYm3=qzO(Dc5ILE zHFfHL&tD3bolhj*#yGUMlzg{+dcf^WW;4MFS#BH(C`d%!cJg1x?o0&Z#Hu{~Um`!J zr6M<@*dIpjPP;CR^dbLw>{CM5G=QH_$AuXof)X72WZmyuwJ#w0?g|fw|60L;e_jB8 zr{#d%T!F#wL`0dp`_BEj#yCe6hDu4rrusjgVbet*doP48IHB4f>7ti^zru(YH}bQ8 z9{ZH87y2v{voHTS`TKiL5hHUt9#)0;f13f3p}`Hn4B7f@J44ZSchV;hANF7Fm9@Zz z$o}*0@b`~W4ab>oJHn1jgoTsC@?!dieOzXqeqkbqg#h#abN-#PRIlg)a@=&u!c5sp z3nLSD?eTuDMS$rs&hBdFL#FI&BJoUpXD0XS?Unu7@o$F=wWTuzlawnXw}^54c2nC) z0tk78Q3dCsY~5jLdLJ1Jtna@D>P;(AF!9K;nUnmDI%+31tOAX*I9aXZcRyAB*D?$0 zL!yANmc^%jw*UY~;7#6|qu+Ph@Z#%#dsgA8=ONr8@kWK5(AFlSLn15U^4)#vjw*Lc zARG(+$3<)cR6#9H*ZXvWz&P0 zHU2Ys^kz@xor~Rm$dCSUcsEBdZ5M;P2q2+5HXjFdLTig~jwOj$pWs<81O!zbNkR38 zr6B=1?#%Qb*MA(hk~h!!jSyAuf;H0cRvofOS9^252kFf6XE@ageY)_%HRdJ9Z3~Kj zT!;KM518ap*|6v<$Ui=QkDQv}5Q%qeKD;mNU!G?j2_*MFBoEGJOXKUw=0BCD_3r^a zxCvJ1JI9LLRH5@qZLZ;|=aw7_7XS8>W{uvQYQi&EVDh5!vsph6D|&P62=%|9q*v^q z@+pm0#|9)gy|)S8Ngr_jA)J?b14(y~?=~9o4{DID$D)

tFIfOYr?tnIpwo;~_D)oWJYL~F3_}fKI7bM}m^Ec|yT2<>#3;Jp*p?fytt&HhO zZrD_F%l@e8X@`*3s%m^}D+NVK7Cxw_u&lDinet?yWR$MhIgibohmQW4+|D1~Pp~J* zK?vsA=vqy9(?MUUn#eIl`8fH{d2}6qJ<{hAb9BF*UpTTHV3w#OBcn0-qGsgaK{-Z6 z?)XIS|GFWnIYvQeHr4+-+G5eSMAV9AC9j14xo}EjV9o8&uA}}^|49x?nm3XdsNIx~B7wKk(k< zQcP;+2nJovMV=MVm&7E)dv z?#@mGiO0$5s(Z-X068=9Y)q4)APC@Fr@ac6>ZWaUN*qNPMkcXm=az;VH=QcnS=VQ{ z4$388F3D5+e`fRdla$Rk{*EC|nn3n@7WWM|c!L5)u^8rUDn-$ST;`nM~fELqR^ z2aFD~+mEg?G~ZDN4{Jr!P^e<~_9FE3-^Y)m^Xdpfc>C2_zj7|j;N1Lv=peEzZSK{& zx1%P)7!Il!Q6#LHe8q8w`UYNhvAsP`&8P<2-2Xaco{>iauOS*Yvk5=4kRgL>ONR(K zgz(Id^bjtD+@V*GSUHnwZ|A${2HMca9`W-#!TG;^6>ig_MusosS+VgDxcKcpE=4XY zwvxjt`&fmYe2{J1|Km8jGb!?KVsor{`FdBrrE9rN{ zxy{D$Mf;acO`onA6_mx!c*TWFVjCNV(HbTTdwj@H<1`T%;p8vT7djiH4Rco=e6B_g zU~`FD^lnC%mraz``}r>f_OZ@B2pf0K&^dib(X1?ZQ?3TT!ttSSL?r23=joeO8@FKj zFMj{qad!sQ#X$C;=O)yJb>^p?I!w)A-`a0p*7A@0tfC12lAzlhx$F3d=`> zPVOu^59_*;NBcEWjq=8-_jv)~Hm;=2!sr3wtgj(e>Fr7N8yOYWS*Q9}<-fj8Oc zJo!Io+j+Q}%K;=<&96bwi|wu&IXw~aLrdy&2%{pQDLvKbJ_n*^qSAN!sI|*w1$In2 z#+E8Sx_s8dn4N9op6`wY`MKdyaVoyO55M>GXE$loa( zKIAoXN<6_?UX`!MueDqfShzTnP^Dx~jtu@(lTVlo#~ZvsDqyx(*Z)f77C!az$FGRY znTq~aocVF9CYwTqiS74*t@D-C!7^iYv!bt>$1ZT}cH8i{zrADuM#W`}zR>wE+juYT z;4Q_vT|v#rdq=eAEt|pWPWuE&@Gxtkq-k63*|*6_63F=PJOfXSy1{SNu|H=4;Z%agy$Lud3GR&^F@ju~{Oe&_V0#h8(B1%t~(G z_b}Docz)wx`))P67?Wp~5*{hyVsV>AVeuu@bJ;V+*syBoMKzv{-!}3WGvL;%mkulh z*Hv8pdd%lf#zIB|hX{G>-a-Zp^weM<07d;Nht?sFv&_dGi9rM1JOGVacr9%rm43Yy%;htQAs)uq)I1c`{gT_YfK(--*!a>5?d+n_18OumA(WY^R`lRGG(3tdG6nb6cZWD^rXNT zk3=|s%4>NVh3t9vm&tsd<#rsTsfGNzZz|TjuaonZ$fc6sQv3Gv#u6&#rh4yde5NAep_ zBzMK6X5pd*)j{qJ_eWEQe2{_gr+<2UxN*RJ!(;NxwJ!m+lqbF$3z zf?~7S%S-)@hr8$gYmV8UlLV9dh6QDw?LA*Y>+N$|6|bFUjcIDaMjkla3^|6l8utqK z-&s$}j?9dT5_hJ?#x73zUC&y--ACo-gI$*mOb?Dv}T$fN&0)ZVTkWXt<|xPsZe z3q`!2GPt4#$_y-|!M5&W7gab@-tai$+NU-qRgEXO_es%oPyYzSsCF=3FZ_0p zGCR(iSC!$vdDre8xF|wM2^Oc^@I%V>>+Fo6DSN6Om~6p4wQ2Ii+B&0!P>jkEpKs%f z1tla6lZu1>wISO{oM<3=P$UbGJ>eqf;i~mYnhP8#DMc$= z9er1OTgjVu|C?)izm-LJu2kS=3BjRRNqpdziUe9ya_*x&T;>tEvR;io9e>51E3E?>aI>S?b z6oIdwIx5G(O%^p1^IbOr`S#(RouWL)m0ck<${jmadLBIgABXq&4RXnlX*np#jTsEq zI&;izP(5#=2#DmVbD^@0W-!D#v>;RrU-O96pRWdqMRiMz{{_MO3d*}5U8gt?!0n<{ z$P42hio3@`h2&bbcN)2uWsT|2l&UQYv`Q`HwfD{~MRT8jS37*yi%`eoO36xma3i-EAXIRj8SF^xBtF#c z|MGcLM;cytH=k+AklVA7t!LJlDAA<_fqU2~ZgNo|)n^pEl6#Wl~`@ zD`+^mUG#Fz23z^;|~ow6L(6FCy&$+WF)q`%oR%x+obRl4(Q^K0i`6aYUPla>{Y zI|ek8MmG9q_k3%V<$-~ua$+$Zl`7gRlvU+`M_@*GnrWb!nL*C{>>?naoFGN1d9)_-(O#|%rHhJwU! zbInbBWXXtstJJijHEq75H>1lROU%nk-gs2WI~eyS@)4`v%0|u_0jWCHFTI~h9i?9j z3Ezs>ncm_*2?R{1{)SPBUFJh+o~ftpPUEw!m*AO@B#qy{Z-SagS|adP92b7cXRbAp zxb~BeX}Y>t(A2|KBQZU`+;m>}kOE(kZ$7~R()s1omZB0J=im=HJ`utG=?@rki_lT} z@3f|ru4+tv%h(&x|L|6shzK`Jf)RHX&-)t{IT|H_Jp10e=b|-YBuetEU8^J~z2qtx z7mgUDPprv6=z_n3aMZc~pWxsf>HM78T;(Ay%4l-qw-+VCA7o^HC7{pTGi*E@cP;Ky zhLkeciTiz$W*{J5kq!eh&S9d z=5He|zJOs`UuO0J{t*2a@rQZZrYnUT!=lSzF8>oEphsii*N86=Y*3-1WP7XSD-|C|+O`}-zUj`G-W*1*GC2YFf)7LOZi z&t4%^GXBAC!-e^SknkmP@%62h9UY@}ZNje3|14}We~Jer-XyZ|X;^;z+N#8i!(U*B z>=--rAmS6{`IPF1wxqO02`?a>>?_I}y#OKkLpAh2U&gf*00(cCy63d&J2%{8 zNsz0$n~bC^tUG6h&Kse|%4t*IoL#FSw`iJpm!J+_uL7HJ`+P^Z`!ISjZq1>h96;h_ z);7hMmk|Sf%$?qo)#W%9q~jW!Kr*FQyg6v^Rbh^QH)1qu{ATUV-!4SiI67&_&J^? zAb_00Q#8aM2=e?n5)bW23wNtehN*-A0*4oq>-s|+Sj_U*VBpMAM?NgLi8p=bReNkHT_8JRmX5}9 zsBj~p$_zjMdnm5#9D;ucEj2&%2mdJThjMJlRf)HVX~}KH;d&bC{TyPQCFClMY6v%e z%jt3hD~tE*wpzx)0LXa&y#X+U$KI@8Y6M@{|k?yD8p$FOhAHFuMR_5`ge9;dy)P&J47*&6_KdkZ3N+HoHF6n?? zS1awzQIu5Hw4(^Cu$!zy1u)SV)voi2QwNJH(VM|Q|IJli9Fj}!5aQ1idkiE+BW%~i z$_NKR^Wo=dBw{ht zh?#p!x|x-hOMl$^5!7nP<+J@4%a@LVvaO7Lr-{yXkr&$!P0KvuyyNO>^r<`lX8=~e zTdeweItNi&4Q%1zbti^FvtoR-+ZBbZBD~m@{3f-%=C0@GS zR-Nh>r|?Hzlwpvpi@zlz7@YjkkN)F$@Tc0*JpqDQ^9rgbuij&Zmyq&g@Az;;@z9`q zCVzXoO(Exg{S9`TsYCusX;&JPk|9)cf{&JbD?6f+q5LZb0&F^=c{;jiW2ZpU;#{(e zyFVw9D}I{ejN5xrrJ_5)WfaeSz%q#W-24iO`#R>U`aUU&e8Lj*+7EFm&<)Hzm!GE8 z&W*~-K#BYRk@eL9QRY$CBPxg>u7Iediqa{dNGl~sNlJ@!H%NmD1_A~l(jZ+@(x4zE zF?5G?4nqw?4SaWS_lx)ApWS7FndkZ4IQN`$pQ$>uM;09U>I!a@u{BY}o{g3NF<^hm z+?rl$z##Bjadp07yiWC5&JH%Bq9DdcbyCV%M*}D2N%%Eg;_)4>R4hMzsp-`n4fb!j zOc)O~l^(cF{=%K~1hY<+71mTtdwctQS2{)0WOffr#?&$2`%z1o3s{Nr;{vC;s4z5n zV5b$)1yYa+9Rdn#y0ZZ2YAV@NL)N$|4M=rD*Lt9F28}m}xPTY{0-1H159BXn*h!Q2{ zhXF3C=i0O}BXyJ0qX91$A*7WZ#n^CWhIgc9zsYF6{y=3c8L@b>4<7jZLvSiQfABsY zHo_d??dJ$n}`kgdLF)yCQnb>0-H-s|k-qjCLHMi0Mxnb>*f51@b!> z_my^LBVSxCz2_Q`0nhfhSvUnXcg|77o@L?mHVgl$%ypT*(M88c1F~=SNiQIf9w)mS zse6-nDag(5>`6QOJHZV$s(I5*wdOBy)rGqzvPW1o$H{xS)2n-fk2Vn#GL*4r7r4?P z?Fz==GXiGVvX~>5T!dU+-J@Fiy>2e|Z<`s_1Wd8pt}X#ZA!S+Tim4-7zR zU^wR6XGQ6enbQ1wvZiZEgW`otHSwp@^BzoeeqNncqZ?2c98c{WUUu@_7aIl?pp-6| zwnpc93g84aV+xF#^xW5&s_4gol5LE*Q61 zPc;K50iMf>>bG`C4M~b*N_fYJy2M=t7klwc_J#a#hZ|YKIW6KQ92Ja~|)#CiFuMy;>jH%}U3EI}LpWM);^(q}H*! z%%&o+b!@WwH_!dquBsHvmEcmhOy1U?&%uvy=WKk(HzJf=*X8CMHnK2@Rs?0Or8nj1Kx8yjZb zqa6qB^17`wwx}GlH7FKBoCYXiYSZeKD$o!>vT2avph7#XCRD?$pLONq&FiI$}uUeK3=o_lgu3m<(I7!nc{0Mp98IG|L z<+s3^!I&d)cdIlagODSb7W2lsL|2x?k?Y}3*K}4?X*`c?gv6Z-9{Nq_j?vB)Nim_I z{)lmsFmmeqUvxX4T#f^+1Z(MaModBfVB@aWBOab$1n1som0N_kj};XbOwy z$wTx>i65IE|2^{zLIUZS@ct*{a14mf!3s*I$C^(enSkfbtip9kY1+yJD#FVP5KZ6N z_jf3rGD$8!ZOk+j`K8(W;Ilf>?j;gIp;g1GOQxLUxeK(BeA>W8^#))cDj)Woy+EKd z1~qp_X^(T4ga|*EP*da2wyEA8fDyfgm3z3UJHMK!PcjC5sx9)|F7PG zNCbX0ototfo}w#ef}}RZXj%A(F)k8QD8jKXZk+ll|5lygy7E*)8LNJ+154mM**2Dq z=-nc*$ubRf-^D%6GsH~lTkYue#HW5`;}ywwOtiV76agzFKjH~^h!9zW+CzC>2aji16t?!vH}`5TVI%#jF7?!$k2&(LV8c{8;QA~7I6xkZmifre znWqVqx+b8h%F}D?u^uJTA6xY~JfX1g`@VBK?fUBf#T}>3S)MatsvDntOo(P-ga;=l zg9-~#+$Rw54fJ!bT3uz=^LpG&RDOBS^xA16rx$Az%iG~D8ky$Z>gx2Vk@fK7rraI? zVq|90hl!m4(fQnW=TH5|{8C))m9xYwlZnmf@@=7q(Y)5h3`>@IM~HT(?NR1i?&y0%KVwSHuJqC{=_vhC z&weX5l*!V&y@wK(A6e8^aT?91dV9O{n_jQhikBqAl0Q24b$~|PNm3U|0l4O>`^;XOm466io5Y_equWvW3*-1` zO*M9}^mIXK*>VgiNhkPNnkp{t$yGl0y#N1)t@?-4~g`pZlE$mC{3 z0G90qQlkNyqOr}KL{~>xiTDWGJ%MK17eKi4MgTPM_})sYH*9f|z`EfL8ZLg3Pe88K zX(6H>z}3#MGA6!!YIMzw1_}Ec62>r?wR7#wWUkge(toL#FKPJ+`rgJwFfQt1wXBU+ zE;<88NgzE>71_GPCw%VZ8%<@n<20qK>YB)l`vT&HnV1)@cj@GP%w~gh>EU4m#f36A z|0xNimzFvhu#3degDx3)e>sT06!cw?%rF&@84cn|xFK1w>IbIDqWr}Gad)e%P|7z^ zW%0GOOANOUYD&7jDi^zDibz~fxo3^>o%1_i=1f4m-nK$TD7${c+ z;Or-WGqck25=JM(iHVntU0JlP(1vF~T-Cr;aUbgEqMPlC`uP!jv>tko$_zMntLSHW zx`0^!oS{TS%W=?mF@9dK1u$`Sz`Nlj6(N_JN*9S{gZqc=a%9>R_ z%$E8}gXpn9xVJCKbHsP9#C-p(2<+iyF*`)=2t7g8=vmY=8?47H>X{JZWV3O*(5f2- zToJcys)8?|me3c)z0!M(7OKCF`6DK|HT(H5nF;=hC&aw`AK43218e&mb#%=-|&=1bo~$`aM@gk-UULwLEH%~Z%1^lW^DnLJzh{R2R%4K{ z0<foEJr$Q@02N$<;+jhFn-ZU>5B2BeNnh@BYkokN!vn1oBedJn z-qv5zAPT0z{n0b!sT|wB#$4XGrJ&vcs+gqy zuI^qcOQMMC450CADx$j_z|L`duYY*m@O1>U>KZp%hsgtJ89`$u!v-IuhMfKDT`0KaaKYR*Hh478EkOp z9NE+%&h9=Tk$jlnZr^Tv1$#CKPeZ{c5==PB@lKOX&)!9sV?xo{`c;9bh3CJJwNnVR zPGY6gU)2hbX;-QIxF)$%&UM+J<0pZ+6r2mv2_N>W=nF;;^OEll{;(VYQoQ1y1W3Dz zShBkV^EU+{WDW|^;f>8bDEYPgis9QwVYqw0{S<9sL#c7;P4-i|d8iU2eeJ() z#eRVd8*in6>UTr%B9F`S=OD8uv@?RmukHiOCwQWV1>zN5D74`Vq(FdNNXk5?MQBZ~R;s+?xd^&Cp>4k|}4rck%DZ43=HRv(u8?vs6L z|MH-qh0cCtWPUf=Xresyd`av6a+K?{Q7c<1He0=CdX;r1k3}iWPW;I5O4l*GbHsV5 z$EQ*pO-0Vd1aprkWjEYMVGxz`>&U_BVi8goU$3h zam#Lsc)@kO2bzA*Gk|){L-fmp_S}<{uH~}+XB2>z7!AVk!Y@P!;@mqJ4Ev$2B;Lrq z2lX#;y`7Vz6(WAl4V2%U_kn7cLZ$FX8tggiK1;m(kJY6Nl*K+*mU1|goM!v~b^OOWUK-)cT zOG`W78VfHUA7C)MtU5{E4+rA*aQ({V+3@u zEi84RINSiB1n}WzZ=tT5|I7{^=7IEjWLc?{4)#3$8_GwgQ&APZKg%A1oGjxGH2+f= zW%&tH;XfO}eHc!!dP%dHKuH%|4=^oF31Z)Xs2)C;w;smfIFb!fG;TgX#VJs0sj|AaVvzz zW1asoK8dWrn0RbgzBV#SE*ZY#&zKebRJ(2KXEJXIAKn6yXj&zEfj^(`=#h~3B9K9} zHTECBqqQ@yApFe$5^_N1eHrJA;mB=VHh-=wj0Xq&SMIc4f2BYrK{$A=!25DB(#K2;{Xn5p5 z^EUm=I~?l4H>~dLhvQOsiaGx^(yQyekDCx3;DzQgzkhwdK%u9tJR10y2}`^S_XV$- zSczAFNu{}78g!$t6PGfc_h!HAb{C{lR(Z^M!{x}i-L~$7g=8;DA1Pu91}%wc#^a8c z5cM6s>9pg!e$Vk0gV0x$cv%6oy=VZbFrC8HM~!wIH#S|YqkdkdhjzR;X)E~u5#v#+B(w#H>OmcL? zw0QS3=My_4ZOcj!z{mDAV) z&rF0-^0^KeJ+>R!aMvVCh8+o(;kLoWr9ytsQDqfL6#f;)ep4S2sskp$UoC<^K_}=9 z6(EQ2b7*4z%5tysN_uA=OW~O;pv1tH$I8N=lN!;znTMA&@rF4p{?|fYz)&y#bHYb= z1H&Nn8J687*k3nL$g@8I8MQ)^1*YBZ7j=HOct*RQ-ex@=epr6?1#u2GSc#R7V|WY=c} zZ{AQ9ea8%d(FR+NCxNP>m}jDV3>;(kzb=R~>Gg&J*x0@D+$g~6YR)CZ(x)YY78GIW zwBDs+Wb0_PDf}FMMv(^vd*b%b76i5?L-@b`tA|&Ef5r!@+&?Ob0hqxCzN@Kfpxu%L z^n=lm^d4IdA1Giy>DX9=7Di^nO_?1P_nL)~`V?n!5+De;pa_SVbz#?0{MA+RYeoeA zfy+?w0*7yVE=rmB0|}$Fp?L4*Sh%_`O`~;%Pyns$F2z<{2NkDc8@E69@;I#0HjSs5 z9I}Jr8>iZZJKbRT)+PhBHXJDWQa$~!28xYVv3wXy@hqi!0&vTgU_iCn6U2W7Az_~rKo|?eWc;HOt0C48EfMf8hEA7ee&`JB7NiF5fZ9|w=qHzO1_7Rt z%a=xclxvCgG~IJ{D^zbWheth!3`A5N+Lcnc#D%(X&z69U$FQ9 zDJ8h+!F(=Yl9~)W%a;-Gw+)Thj|Y4&&__920%mbKwXUiheMld+!6cRWBA#`7^PjP|T1M z;rHg!O(4_Z4DeP~R&{G* z+iwb9Q5oj?i+sC_etS`Zbx|=C^uwJK%;;{Iowo?Db7TiavbVO z<*~%J`rE*u5<_+$&?(ToH%oz=B*(q-X_etu;B7BMH4Bri+mZ(7MC-rr@r}fz#Okma@SO$b++5Q`6=)qywT_q!GlzbY3 z7hhPyKi_}O2 zj)n#0J}RDUt%8+P*II`W$AN3s;`*R{8bMGEup%E(As5>_TAsQ}n;u2hFw)J<3h9hMh~s47Ze>tcwrBMc!8s}LAX)FyGqE}K9&O~4wEmvQmQn}T zCW&Qk6$N_jNn}%Xwc<{Lsfzu zK2UK|ev@$Hy_b*9JVRvtrzd`CDyyrDy^dchX*EEsbuYYB6+ZxscGnUAmJok{1<;+m zQOhQ3A#eR2Rv|37oZo&T2Iqte>JA8n8V9!%R`_w{>a5NeJ^%`; zK$>Sdmw|%~sC=k=OJokdx6_UM>bqXGKn{>Ko<$dZv1*-H{nm~oUwBGeY&K}!}WE&8mub-Y~+&jUO|X&d+{hqrkK4;y`-q$a|>xBv(v zQ|&jzfk2|Cv$d=xMz}OPJ;&i8RL?MaE;ie2>Mz3!024Q?0)MthG$bX%=q|FaKjZp( zL3uKHk8u1|ZEt)Vb?n*8w-Wtk)KGE`nOmj&uqGFKD`H+v$LJp1AA}AG?vDf}gM$fn zKUgx<@EP1i9=tSG<|qdzO=))1w@#NjWw!X}8O=~#qyA4UL{Dbx$*W((*`#)+>w-{guJQoeNixRBxm4CdNUcquy z4u57BOn3lRQ(yT2%UBnd%<0Sp>jV)Urb(lC8-enuYP z4m~yu@73u3)$ye-V(jJIFHIJ_%bN`4<_i3X7MO--7)M$H>}7Fw+@|Q|uT_J}KrZs+Bn&^j z4Ih?u4SaJ~4rc1!AYYQ88UDHnDJDixOI*7m>wm5qI-Tfr3iJ83jNdH)%WiOF!fX7} z&|z%H1856R*I%xnXpZ#cvXv|%fRz6DGr$1cSJ1%be>p$ep#{8tE|;ijqLv!$ko8TP zusu_uTh+aQ^r%t-IT$~;1~ZeQm3b?w#^$}GhJPPvCi{2;cxjn)A|D%063r>5KYDiVsCnC{oV?$BMd8rBJ1$h`(q+>nS z)ek+5zAh{)z$2{^ODO4kEzW%gULMFdP2V-@P^pIb>WnRwzQ1lHFxLqg zU*$>2#S-CXv2Jn8Uw+3NzaTJEU?!V&Tp)A68_n_xN$=BWH|q(WPLoYy{PJe(_u4~j zH}6j6?^pqAG z_CSz4*J7;(-4je%_8R=}{3oS3&D0vMe&`&@o( z_3;BfPw}cN_xp_b%b~SL06bt565Xa%C3IWWiB^&=jyFfS9dSis;?QA_dy2ua8+-&;wBnhn>{p+hJ=Gov*>Pa}aUf99VmC~))3fVVm(!T3G zal>|^NcAqv_D=yEf?xq^L!R7AXsWYAZc>ZaKEj|U#WuXkZP|5>MNn9zcLM5EwTBB&w^wR)qaD3RY)^PSeFTkaA{@sfJj_~c!e=bSL9Nkb$gXPHTn*zrrFAYTbYGsCzr z{w(3|X5a557q)qVknGs2U8=65=E7MFC1-V{P|K|lulml@!F_lk9l|__DA-D$F>Ij4 z)Bb!|9?gmR#&pOha-CQl@1H$hTVPOJ{{T;Lo!K*g>&d5jtfJFS(hGP%LSkTsl9>}! zBzHO7BxsKpfXN?gGKPKR%_bG3laLhf1Wvf3-AK`d2!&t3<-vYY&7l?<{FpvEp?!9? z8~!Cu9dZ&PcxJV&7~oaS;U$kU7O+j@tK0GpcKeeCiU)d|mG6%I@X6D|hvv`Wl_3Pk zAOx0Fe8%(1+g!*Y3E+2CJ2leM(Q~k)bnVk!6&lD;`4O1zO?{NXUI3jnDba81sdy%3 zJV+P@M3zf15@k_+Td8$Zv#hKu@Y?fY_Y?=0Ao4q7e(RrSup1GFHMT6VE*t5q7toUg zni6nT->{>o9}Ju0p}dt9 zTa$V6^Scid++}UZF~}H3{5KqV~}e%WrxwX4`A%lgSS@zWd)S77lINn^-T8(NpCq z%J{y5ZDvx#mG3I6z-!`n9;PJ`2tm_RZ@<4j9;nj0PbwWQZKwcEReZUx#SDTu57#(F zJli5CGdQ9wKhbINFrgJFJ%HOm?jl)LXn>pYpB9va?7@?u{V4*C-{755z4EgZ67-q4 zi$2TlUbMIuNl(}bSU$AI7EoZhm;6h2W_wH4!tb_n6gPZFW9?+vXgZB#~h< zU9}Uba$#Au_K1}Kdcfv_Q+(g38G1P?s1{8U=<%GYC^HMk<2ItaPsZ5+z2w`qeH@d% zL865KmFyM}aByx6Lpd7k_2#v~>RTe}$o=E^9NK1%qN#bs49UveCLg%5uG& zD>t0$68go`K$N(hY?dcI$%*1V`g9cw`|K|Iy(;?p;rc)7e}1jg_U(i+CHQDymSI_s zWfct6t_SVG=^IBlpY=XkvPv%CU^ht>;6ZhPz}Er|&d=}`Kj!LhJlJ`pK2UR>Y~$9^ zu8RgkMT1*Hu>00<=1bLnyd+t>vWZ{90Yi=|1`9;q@6=X`i@9em1B1uCS0xZ9MK$8X z1q<%Q&G!sx957{u@kKcnK; zp?qnd{6w6@ZV1LNc;Z2-FC#!l7$1H^=$KXyz&(6M=;?}6Ot1S@*%5~Pz1{dW4`)y- zYPc!AV`U5d2Gqrf?-C`n!rb1yv8)82PsDROQ!UE-I!6a1(|` zJ)yZzxq9ffG3_>+T}1vk4O72>#%dF~| zQQ?7k+c&;Gu+b)Tw!Ydh&UumH!bJMgr#Sqw3{65i&A|3bR*5iBMZl|0?e{W*vb8Za z@d+^6ri|{yxZTGD_s6r0F&dy`Ejq!}sP>p;1^`3dj_zi-wIcW0x-nYFn8*0lQBfPNipVqnFx*aWD_ zt-oidkN3Y4w{QH9uoYue&ExM@Vc8x6@`@i{rv*9w- zOn4*!YYXaB+-#+*y-wpM*9HrK3$^l*f)#wo#XOxSdaxm0Fm?**M)NwpVc?yEyO~an zocWEtm!})36_Y};qB^K{+Y3aQP(vI6NM|Dp`jJhuUZ5eL|a zVth!5&}x&@!xyT|RWlNOWVUjR6Ic^_A3G$8We z%?~cM%3yf~Y&qFv&l}@{F1>i47xS`#swQ15Cf$l+QfIo-MHW9ejgQaghHZfUjVD); z-;eyZSGm*L55}>$rrVan3zs{m9?aVi1(jbBN$0r79m^zT?s!V~W{c9)=qW8(Vl~S% zw(nJmKayV3=ZR)5zSJ@k#{Zy`kj>RU_~Ymw1%A2jw-+2D?^pauPBhw<=xBJRkmFO3 z@nbx>@6^crbH^`jH+<=7Ms|?Km#8Y5 z2+Aii92Ryyq`e$}CBw`#Ut&PUjlNX{=&+#GtG7jLh)u{e9E@#o|{dw)F(F=RTQ#_IA6M+@ydE41E{$rt#oV zCc$i*f%P-JOU({0q~;wx_u}|L@%+=h`JMCP3re2O7TBc5uM@&Phd+v_nf7(K4}M7| zkRkj@VQ%t&+)q%L)5flYTZ);iQ%o+xfg?54Ov z|JJTIau`Fpsrw&)E(-}wDq4>9XnQ4yCvN9qd;M%5XpN&I_Z^IX(|d_t?jB5F!gQ?( zHUY1p&7?X&iCxw_D&(-P@&n2j@l0UvkA!DiTZgroo7m*J=`1!{*4jrEd5xJ}x>ZcV zUE_V$LJDh9=1P|9Mcm}8#Md{;iI?g+IJr2N#~wzx&c0ZU^;#{6$GsR~l;dO>TjZtM z-$jrYRa-8Vd2)TV4{*_M*FCMFh7^w5+w_Zj@XTPOrLJ+1_OS(t&cKUnB~?AqonFee zA$+O94=zPT4!K;e4Epb2Qrc#iBn$rJs^8lG+!Evy?RfA&?f1!t2@@*K97QzAzLmZt z4_k)^&&Yq2fB0}qX4X&DHYhKIx$uOM4Q{$^rHU#tG9fo0C(9utt2=3!I^B23cX$hf z%94N85qCEt()#Oq-t^wV2?!If?W3s3NE>?=H=Y77Nt%NA)6V^Va2VPoA%Z%PDuuqcf-s_wsxhnZ4mnOkO5Zm79moz_@SW2$rXP~jziO$Ei z^z=t>Ot6l}#%Aq)``#G6<^61SV2rrWb1PDd@BDmi5t*Nt@q?&P20Qia`In2%TXP|X z6lAcl5p;n?=Sfc3{Ke3s_iQ>S)#5>}RwiLycnX$ocbCYmZa-HQ(RpFgCOYxa&s$SJ z=TCBlF<8k9@^sIiw{Ur?nnE#N{PKPt(b0Tfuh`gAS9b=h-u3zrAz#6Drt!A=yX_Di zPo9aOE@k>0`it1cWo5Z6MA@eII&?;;f3kxJn=&_S_VUv)rZ8}$K8d(WA{~r++uKxo zuW`@f<9)p5$|J=<`ygyP&p@acK3mKUw>a;)$=JR8 zbJe%Jb0MA#S#8X)2>LUZm)TXPj>6p!q@hE!9nm&K;>;Q9XVO>!>jNSr|Mwl}y zov)DI#p^|JL78|q1j_U)8bxs|YA;Sv@U@*WW4Ou>la+E*f7-`_<%LBN!gjkGE7jt0 z4v5@nfyIJ}O%2g$%#($ow5F4AGqN46>P(a?`=gAWO%*?BBKl|QWUeQ zy%r0{t6lEehvg172)R~cbLL6}lr%I1<54!n^rV)?j2R(M9vJ2kZbkT24i(cF#lqje zG*Nq9j(g?ScA@d??tJyyZlU+#4|lgXn5Kr9Rn135in$cjz~+xY1i`T`ULcv2)7lwr zco?OjHLae_e5kl{jtIN{^s7Jiuo$AmWwp(+zQFXR8^mHVuAP35^R7dD8siOoGMKq_ ztQ~Mjq2fk@omH=}QInL>)QqPWQkxIQ?{EIJi$2rMr!#Z%$HBq-j?M2`b&pg6q6)Ab zF37-w1hs{L-@#CiCRSP&WKO@-HZJWtUW2)T zKB#zS=o0dF_SUXp6_b|cQ!UF(eT|D`ef?Fbci4_TSy_+obqF$=y||l-+W&_zXnKNS zW|PQez5AjMzexOd>nOO_YGJ}cyqQq+6~tE;UTX0bZKlP$YroMyQbl*i?JrhR3E=z3 zLK)mzm%40WY#L^t#wYE?!c%Jlin~k{`po(oi-RQ+U5`JT3Ed!Pq8|BryQ`wab2N>< z5}$zsjz*T+`+kLES{VXe!s708>UH-r%DJLB{Kv>B1@<@b@iM;1FT&mb;u^+~rgtG% zu4i*6!VsQEj$14qt9{>gT*1;-Mdi%I_?>H&ljqG>yhPA0OLHM&YREC4j1Ta{pz_6% z9Y163{xXIWLvJLy2#kkFTMBRGTVS$}c7l5a3h}y!iImMei%CBuKUGv@=}8&qADfl$ zfJ#2NAofq~T}%Dw={g~N1gPO7;8W;Y`Mmw1nEPC~&bh{@h`~M;bh7e$0-V;XUX@y8 zZ*nm7fJ4lESp)m#CXc77cr-#0$QKB092qbFE7-L$cL(#mqVcdC24@lA;( zDP;&wWd4wG>F&gbkMl=a3D6l^tImC0iT6uXsuKE<4-}2?v zyMDKGjb@jBb{6qiKe_Wa91vG)O{`L4^~fu!?(m4j_qui#o+40zTG5jq5Y5vyzk3ky z@;M2`q}Zs1mEKX`uY7Z8Q6=u%OFvN;rso|qcx?lcaau$aHT0GAq>J!Up7kc}J#??X ze|6*Pg&8TQZU+ZQVQrG$(-=S zwLz-1DPK|5YUK}i^#6O7oaF^h_h0AsKHON&iTYdeL&OB%ixvDxHK8i>9{JJETU~P0 zT=f2K(Vc)8{n!3GPlLJI#z_xb`O+aFSFxlgtmRXuW_7aoRALXN1yIOTP8rR;7RPJI0zrnmaC$BY)wqJXdf!k-pWrB8Q1 zEaPZcrF-BW#jaRU3}pj>(kBnDH(QfP0i(L)|;xU!%Z``s?I3QRtt zZqNdyKheY-8jiAm{06b*>z9Juvi`7wJK@SiV00-m^3!pl&h))6i4!x};xKokN7o8{ zR-b^HlQA2oq-KmPN$9B9{Z?IcXLd6w`o|pRiG?iIHHS!YZ(;89WLY7(@Z<`@Nwrwy zaMW~YCjK9j^y~5}&vL@53TaU)#XEhM#u&w|!ZEyeFnEp$4hr)<)a`QU5R~qW(H!0whmAJk~|KGokksrw-inh=~wN@|t-`~VEA~I{u8|KfiJWFYX z_moQ{$;SSM;ntz&&1)`i;`z?ogwbvw}K($#+5B@{PVmgjemAO(~k6 z?`!nVc~e}b_Pfv)7UTD2yMmN74872}so+2__^}`XW{sUtD)s6%04Vqw!FleWZHD*5 z>gKI+k6{(Gs%?mxy}IC*=d3|Q#9#vFu=b9(HZ;zBJ(foeQye`{e-1|K{>Td~ zGhH6-@culs+c|&UWJ{Ev=I?l8fHtVuSnwjwJx1Qr@IGW_UA%Kp zdw$;az`=Nw7l{>nav&sLCi>K~r}!}Yh49jdX)<%gT6uZrSe872bWy~R$HCOTuz2KN zK3VkHAU6gp1*1d@tGRlJ8q#`aHBpAh$YJ+`!*2x_RK2wFGaV7{t&{VISP7iS1Cmew z-fqr*5F4o8^|bOj(P*J!h#JS=IQXjYHP3P1tWz+j$lxrVkGN{I^)sMNM{k&nkv5f5 zqW^7R$Ibe-r>7DUr0?$D=7uyD29nL8=2pTB<12x0k4Ln%^O5a|$>Apu8$n10m7~6- zcSoZ^dp>E6W94`B-{%Jp{ZrOWN%S`DcU||Tpnzngy;$H5R7UP3o-PHVQz<;<=LMoY z!{nsH;KLnmo#hqvEt3PN_t6zyBtss3zWrrvBuw4I)8kz-AD4f=mtkJ;LNu$%1SH#B zf5Ty#dg}CEU4C0@A+?`ukVB8<@l^nS8-A7n^?Kj6RY#(~iQ_W3ixBSx_x>OdUqidD zleCOp$A2gBpUz`w7QcT0k1R?ul`%R%_^-f}4be+N zGh)3KRyo*1exu~(&wh6;yeC@Xywq6tJq#$qG&B}@=xSnE&BmMLA5xs5#1JWn&b?xA zSssm6qs>69k;@F^ah!U4{UN0051XP-K@_?(ikJRAaS$OP|8jXO=u(eu0;%dTf|W~w z;QG;lhhUBEZRD@~nms-^^#%cO%90o3 zyS!N5nFQrrF#!pqRjNhvYe?YV^6w;hsu`t0>wm|X#U>hHRin$hD)4<+byqZFqS6QzGo`;nC%$ogNuhA*Q(@MSc;>7v-) zk~leI-#(>BPs6!?(`WF*gOZ0`R$8OH{SkNT;}-EF?p1mSGynUlnokFS3(3lISO^(m zwDL$-tLcl=HxwT5mDjk~7|dLSO>;9XxB$QKUh(e`I$^q-{d0c8sjdq#6MAmXsIpF> z_EwZ(0^l?qQ9BsfP1sh>?R3DyWIECIThY{j`(QjC2}R$0uyy%(RA*F7Lz>S_@LFx} zD5T~eoQUWXoDTI!L4>vd{)=}P!u;8Oy@+OIFKG2Cd$d{~f;_Z!wA41-JNfb*0gK2i zA^M`+g|-pV=_ z2@e*AhQ3^ntyB!5i(A{kdHuaxzJrlkk<(%7~2aED8}J6&0Wf|IA)nxv!E^v$L7Lbk{HPpGPY@qh$h4^;>wT zp)yXowN106FE^I$Ul$qLxr%wxxg%Ox=n&c!7SuHBkIK*h-E`E zz`+^rVl>0{hn~^_I~m0_2!WCf2<-fXpO)dlZV&q9r$%^R?=Rt_{4`(%_{W-6(9g3+ zQk`(H-wFyU10u}om ze^lJ!ZvE{&I_CH{7jG_4d;Ir2?4Ij=d1V7}H(G8Bw*S_dLxQdgkZ%B){W>H-6LR*}GmkWwVp}P(>D}_O%2XPl)X2bdF=9a4ELhfyHK%4Lo5c-tlu>-b%Zk4_PYP!eaRWhhV1|ccNOJq*{M)s z24VJP3?C)lcMo4_w$)?if{j8C5%~M=--~Yy%~}lS!WQQ+H7{$@bAH*Cb#}c*GIUl( z<*ohSSw|{%K40{aV8=kpEZN&rSIuoc6I13skW9>IX=-cg%nJ#5zesJmj83rVoPsM9 zPEfL(+%)x>J#S&e>bvGve^0AU)OaQjSStkvWuRZ;zvo4CIzmcZMaW6rQ!f@z*9;S$ zH1-BQc&1uB7wU~qIrVF=JRs?}{%oJ&_NC9x8hv=-mW`R4K|7}{kcAoZ2igL(qfy;R z9>^iwZmm)VunSaCgAxQ1c5gKWr+vrj2=6vOJ@xkfM-%<%C{t6hRj%?6OFm}@1b%<# zQT&O&AE5BD=%H^{E%xk1v1&6Q|3Vp7{0#R#UxxYni#NB*CE8$~fcP{$# zw(1->+(~gDL^Lx6CvegP*=khB?@2r=ia9-J{6s4cd&Bsit=SHK(8gGq-7c_}6Z7-` zR3y<0RMzDFSXx-H0tVy7%G)&azNW+ReECYsk);+Z}R+TPe37e)!%*^KdKvaOk-1|8$ z1S5J6kZZHmcXAt2xj*{S;j@e`lnkNW@WfayIN_U#2{(cCde{piQ-jEeol7*yvt-iL z%8&l-oxe(4b0ifQR2w~la6mm;rCu2SKRk!TFo9rw(ksNr+CFto|RDIp?TY{f|egb z=482i_N)>n4)U6P3*}0Eq9~7PfBYc~jBM<@WbMA#>eg7j*USCQ=X#8SfjZ*rAIZ;l z{NibV(yxB`hKeU)LeIjSZ9=$ROf&7d`{rT^ZQR=Lo_^N(0LG)+E3CvGK3*va z{>oEZ{fCTJ=%onkxXb-uXUNo$LrYaScl`I4YH$CV!Xw2$ck#Ce;eSdrK5T#1;wG5& zoa&)i!9ZQ_2ndFCKiW*Pt4$2T%7=-pCSv8~0bo zaKir`en4cQJf2yqsN>e;hYfhvj~Q_xbzph5-{7=W7T{u_a&mHT7Cpf~koh$pY~W{= zU>0$?%X{Cz>yed#MElJU)ln?}f9Ldu;$>Lp|^A_;ieip#9^`3TpG;R`F~a z5p#7^0ng@-%K6e2LiF`?`WvwMCR@AF#I|||97pxvL13lLAzU4e>4u+}4!!I9Rn8P` zDA!W8^L_s18*F5GRs0Kp96@MF7<}9hc7Oh*rEvQ%h}E14Pt=1pQYLg5bUO0l9G}S@ zNba#W)_gaXx60~dk&Sevm?AOMZmw*kBGWITTTQ}860fOTP_?wX70Y{P! zytk?DTY+$?2si(KFS+%1RqxgkA}QnEgOdo8PX)yJVh2BV_9U|Be}zgG0S4C4xco{L zDp>3C7i3$9oKVb%FX^fpvj+9NG&G}8FQf3_T67-yg_?$BtF^e0;7m7=>*|{1M_BLr zUn2So_)>9F8je>8pz&{2I?A7iEfOy-pq`-pe9q=Q7$=o)O`>15B%3vxnZIHBnyv&v@%o9 zs{oYW9uL&he_;ju|3`mgdFC-g(|LCw3`oVTPfC1$3>9vEJbbcDGi-$CF?&4FhMruX zEA4N_+~@Bxg5C-7llesp#WRRhIAg)4QC+i%6;JsgI1>+eSIoP1r1vqN;{u8^*Ua}t ziYmpVf2Lr%+vep79$xH0>%F@55DqTRm@iGxw^jsQHVhSO+{eqKCIXVpLiMqejo~L#6o$LtF`wF!_Z%GvKdkG_4I*V1Y< zSA6uro;e;_1C%gD4k?uB*tY8mpG7{zI5(~WD!t)CTUzY8I!p_6n*vTum{=<>*D-7U zU`XFfluDeBj3hhTadp9+;}qN^LObeOcc2OsiJsS3DY-D*B5R5D5RAg2;|wSQG9h)` zXn*0toPF{$VLQj^-q*S-*kwr9$^XUPdq+i)ZE>Thql^(z5CjPV0+N#ii7Fr}DoM#f zg5;btj-uo!IVl-Qk~64CkSHQK2}n)?LX(<)yShPV?!E8d_ty8VIcts6bXT1^XXpLf zyQ*y2v`PpWeH5uKFt6tC)@{^|b+>O3u@=j7VA<+%aJ|s@BUXruZ)#w9s?~!_#lbKs z<9HgEm(@~-b}IaGD;V#)A6O?Sm68Ye9zH}*)@{2gnUEn?2vH~09gZbVCY_zkDT9c@ zcGXGqL*NK5XOiEF<&*v+ZGlc`No_mhrKtXV4hRC}ASI`;zFMUX0*qCxyR;tRT33@| zJ6#B6KS(YswxTy4CPb2*|9Z;^MQ>V{SuZn7?Q)&cXgmeatk&^|*Im)csSekA3aVJ0;OP zK2oU#Ig_2emo^fI_S#}M4xhB1Vb%Aob$8dsD5vD3lXyX<{S{7k{WG&Ikzz$rap}nh zUP#iH2geau0dR~G`o7m`5w|0GEK_PoHsYQCIYEg$=t=b$L-^w6ZE?l z!lQUIy-TWpf>${?$YbBK9=jwp9VyV`)?~Ahg&KZ2qr=xTCk!IEV%=mR*O2owkXn}( zx<;sHPf?4CXO6$1Qzc2gd?sIm@RFDi$ViqwKCzj%`=g6H3HLvhb6lF!5otuI0Fh+~ zAONFD^(R#a7@p>59cCnjFFp1u3h;3mCn<8Z|+^;+(3ia%Xq@GTt0}v5UftV|MP{^%E);jt%dr z>axCm62G;bo1FY&QK4-VnIMNyYIj2UT~9?3_Z9$k-5JCxpq>s$Nn26EJp&CF)R(Zo zqK=C~i;!Xa(b{o7yZP$b9hWX4XV~Qosslh%2kV1DXSI9M#yIpniU8Rwr10Kl}-m$vglLRexA%}bENkb`7LOsECH9x4)bmo z%vHQvSp8CoU%5PBS!vpkrr{RNs6nwwZhqf3E}@sPT5dEF-jjfWpYR2v-Uh^ za9qm~tH(*8Dv-PsjFaZtBrgcLi70SVKsAFUa@-XhER+Lcf1p4&kQ8Do5-AKmIe4OI z$G|}?sig8~S06BM565t_aQ@!s4h}5?3Re(WA3eOWu1Uet+s=w-b$>%_=d;~h(*=p^ z_o!uvQjtEcVG5oLBpJhL7M+*(K#HKL;s9I5725F_ep7pVJ>{eW$bG}q+rK1f6&EjL z=r1=Ac=$f7OfkrdyMCbYGGyQo9dn&~3B~Cc1qV%$KL67_x=>aEY>|6GwAQbjjDdmW z3pcy%TB@)`r=N}IB%t+Mj{4>*3C^$M5+GsC#LUXnyA4Bw0O0F#rBep_=GR{*W?a5ITv8`(XdC`1f6naj_tQT~DX zWE1&uA|yc(>&8U@@X;F=(y?{dZM;4XRfk09qk@NmoVf^@%CV>=`D-=9tde%BAe7te zp}(M%-!?w{n$-vsg;M%HdBFj)zM(RG7c*V}42nlOAVkYP5D7wiY_W8vhBw`w zUH#s6JMb#JSb#sG(0=_f&&Mlvi|d-?XYjrsd6I zEV~H~NN&2)5bwyJ1{Gw3$KgMsr{;zL+5s<};ab^VE!DgV5a?_}Yy8V2Z1n+UxF$sI z3!18{;Q)JH5R&q(OPP52!l%Bi8PdDWhY6$sxqy$nfp^jVga!&}RcaliU(RvRg-3`D z5-`J~N$Ld8zXOU4ocnNeYmjpuxSoAry1gC$P_0Sh5$Y10J1^&AXnyQ<{UXC@MxSR& zyf>J(digy?LFGCN_=s31$B>*8I92U+ZeR_<8U>Glg>F6hCql@#ZwK~6RU$T=+HLhg zh2Nbm*Eo^jIJG{=TDilF&w3goKT@x*Do|`?)&D}d8|Le>>j3~opXIv|sD3qR6gX%f zFitufDk#zh<*Mo*u_V%eWMYdrH!S$RINw{ucr#pj9dn4Up|EC?>RQvVb7yLG?v>UC z2Taj5Q0r8iYKV&MgxJ4tS&k37)9Kmzw+2HhOtXYGyw_sB424O2%xT-Bn z?u*lSR`P{8oQpl#1sXojVr9jT1~JYxRU(~Ad~pGy$`AR8MfyyQM&TK~$jH~+FnEz6 zp&*fPqN!Ny5R$TrExy8ruK)x_;>a+guO1n$QVyV~L7sX?)jeg(vtoy+?IBfbF2i_% z@*Ay{f;SCqy4~V=396Jxff{(%q(s`|#6g!Js>M&Qy4MV|7Au;GSjY#X9BYE@fZ)9Q z;UIaV9mv*SF)WWMdi^ZkeBSvc1N{{aq20J19g`24CBkN5;V(bB`jt~%Em(}~?d8~2 z{?vVyJTfD+9V0Fh+HkE{7!~1qpKD5Y-Wd?ps-L6@QE@$EP-1IvxKYKtV0%99hY>XU zJPcF?<0Xx88xaxFr))Ev?5KnU@ZOv5J}bZNo%?bcJ=hX^WUsNnss&O6VHb9@nh@qv zUwu^RR6%fMc4M^unMkI~Hh-nH`E3AcpLrc@G#o9LtUYO#rIva9RG!O-EP2Wasrnvu zTAzpH?xgHnx-!KTH?TGVOxp`niaD8$Y2{kW@Gd>qB|geyN9OZuM3o(8YA{;n6m<|t z?Pa~dg;5+AbOU7BySE|?7dF)yJP!sb0=3^jWZ{481$6knc{9jtDClJh)!vBA1JHqL zY-uQvSu1Fr-3`rVNK^w66ff^zDjO~WW^vAK2@jx3Q5snDwlE9b8ed3Bo;OuNcme@C zq2)8e{K`9D-&k;73Q%#f6}73h+8sD`LcQ(NNG_Bjfcnrh_N|sJn;b zFm!xY7#SDOsXQ2Uup6w*%4rGC5LATL;`HMB&A8}>HsxDzab-=YJSnN9F5<1!cb04u zW!TrOAT77+JK>a^R`^d6rBooDN>ituv>Qj4Di$lVOYE7ZYon?1{XPZUE`EBfuY`LB zbd{4h|D5N=K3zNn*PH+riUa2}xSAP1kK~{K5Ij~dbaKC* z5n&kJ!ueTULPT>sVkNPaJ76jXXC1lPd9R#9&Ee|GfLR7v7GdUjE)ZGHUDpp_+TF=Q3C>(3L3@9o7`L9|GGg&upJk%#DHe$!oSqksve}%Y$6Z5r@HmH16U` z{PS!B9~1_2Z@xiYUP<+Zt|pB)dsV8#9?=kOJu(_>nHOS5&JDtcStT;ZHQn>uoGuet zodPa?m(3c!JNXUd-Is7LAGC|e1QvDoja-EmyCOIQn53~!Yg zk5^Csa>jF@HQqEo^;mPKTFBZ1JKD(dB|E z`?&n9^O}D?;>1}!vGv>E`~5+n5=U(JHtLIY(}?jystV9uhmU}Zo*AV&H2C)zvADDc z$xpRunHyDiLLf~43`uAEE=Cv0UXgSjDdj9W+*X%5I{8};^+NGozIqp2%;DILe%pR*S;TfMsr64YKwa0N;C zNp@M!F*&U|CA?v38Of9f^b7)Cq;E6-%s8Ggwh*p?t-4VYh|iLp+^+9d7QxW+DOWG0 z`^z0kmP7QcCYqz@P;UXbnUpS00(u`DWliiqVc2ditk!uTzjq{orSj*9``eO$F<2bk zHs9HO>5ILNeL%B*l|jRS*G9jv%!6U4}4*gTtIX$wAG35=p3tGsh0_4Zn@Vz2TC2?oy@KtWyk2 zW;4+#q!t3SOCB|6*bj*X_7K7kEZ_OT4jZzDPXO5M;jXqTfG*V(d}(1oJg2 z)I6zYaCH+jZUcNiDuGaZMXYo<8`OL(;PRGEu1R383|`r%+ed>=fobjoz~>5YFu5&q zAPA^R`$0=-jhH;w!DbpJ`&0-I$@d4hFYxihnhzxa9BOl7r_-43Wd2Qes`T;o#x6g%nob_pR0~?UlIesKz0jrPN2gIJlM8!o+#odDl<@|OOE>iyf zOEakDpcDS;t}XpsQ!I<|&Pk6!sEmGT;+?xv6Zxh$Cl_OT9qcXgD18{ztsmAF7bFzw z?BvINMHa(MyYGx5-xCS#GoWuTxD|vZj{1b=~Az7RV4AWlD%#R_|Keqe?&AzkSlsik3} z=37&9*vxT6_w-(d>I?OQ{Qz-Z1Q#GK=I>m2C586hc-lmf4=>^o#M2spJ1(H6`T#+= z4Iy=%7j&uw?5mb)L=IZZ%B|g_v9I%VoSYeOl`ErNj1;b!3z;y#=;Imtc(Xc*_xAaq z%Me|7jx5R-_6~ZUhYlX+oRZ*SB*TCh^#(-k@$pq4G@V}^z*-d}qVg@3l$r#M{`BDv z2957L#|W$x^TBy2#Ao0zxI!g`fcA@&fAb$bA&G?_I%9UqHwMZW-Y*xb91$Cn6dYLIaiu+ zPrD2Yo|qa`r$C92m;{0uy-NeAW#|BfCYGOJqOUwt^fn*%{ej?2jDKjN+>LtgKc*%B ze*Br(a^n3XdQjzGhQnZ-Ic;_|1yZ=qaaQ9eAl=4;bceokVdDud zTqPeU_88}RR^WM?5Xe=4jUbzSY5FJ{8$CcLgUr6|$lKMs?d;Ygkrzag^%Ae*VidU* zB(>8s>}GU@8#pWWN(S!z*eW-ECZT{_Kj`AVSbxF!oS=mNUH5}w#^ zhj=UDnl9Kcpi#g3Kc(pDxQ5_Q6$=4&Q;=?{e16oxZVpm zX672sa%*;nIo47dgCCF@zl;TO;rvo06<1mG60GMHyhU~1v2Mlnrs+#AYI6E-KRODI zy58>qOmB!H5$mk*@J1kMA{Oa?Z6UACC*7Y~uVCW~ZN293bvy=GYisx~@ z0)Wve9D5J1^wkW$&fOOE7X*K(-H9w6MkP3>RQr2^OSy+c>7Ar_z`;2DVw zHY(J~g}aF^(*(WP-PIjU!R$V*vL%A&7f^S)mz=qJ3W>n5y#V{FCiN%QX1%h&oO9?$ zWjva$1>fYdh&=HCUoM9Fl%{O_j8%N1^0VzY( zenvbk45Dz0J0;MzG*1UDdw0T@1dWnj9_TXw0z=7)e#f<2ITr+x%MfdhJt~P=?G5I1 zOK3!I3n|p|UP*<>jgcm3>YuyUBH7=sg8+^N+Q2P^4y&6xHHUTw5FkBO33qu8+k|S6 zVc_p;rN%qZ{g>%EM@DQm!&~_S6L-j&n{ME1BvLP=!5-d74uLedbz(!Iupe!+z)hds zUS_1h4}lMC1KyYsj5b6PT{?bU&x zjC3;8*w-sHn(ZqvPN*G<(rQXyHwKc82jpcPE}SZ%+-1YggU6_aHA>dSt@qwckE0mR zt(*e@@Vx5XG$Mii;2$})X9Njw)E)#7$q;-b*yLw5J^APRPenzMr3HySf$$Y1i*Fwi z^TbuY@n{j#ziag2ZG_Rb`8ZR#Yt&ze$Aj&@%GRO4-jehyUpg+s@tqZRERO{Ft`+PV z(U_SYCw`=RPHJ-Jv8YeR2?j0wfaNhXIZq#*x~)*XU{rB1EOa zJ^j-WI8R9w39vsz^CudJ(Rqpp9{ju#T)dUshKK5?4ubKAY`L9Nz%I|jq^R?-0>msP zfcHVx6)AQA0wCBRYJY>9xIS7BUDu&2+8ZU$_O0IeL@i`{5P4A}2u==Rt@Bbgvvt2U z`o!TI!!U_}@aq?W@efLO#lHkTQjZFSl%ZJpOA_|7?-u)K4l>=!N9(B+4@BrGAD5AN z^$z>izo3{sH}2trvsLfzNiWWd4wDc8UFa)vFBiQ{Sdp=Km6>u2KO;M z;HBf}Av4cFTT*(724O+~Ifp1-+CGY=XvCf+Ru9I<=Yj?Epp8>Q5AU7;`y3O4K4dtc zEMPC?XncSZsO0{KotHgT%TG3dWn%%vd>@|EQEj+NB;wR$eE4!h}y2K>c^D_GEV{W?U4~57QAkm1zol`yDH;P2Ji8728 zN^@?#u}C#pe);hr6W%AB`Pf4!AOygr)?&pFj)->{MU3(vq{HpNY6PNh&%pRA00FCa zquj<{YcWdw;gk4EycsbkF)N23gy>=$McL;*yv)jMX34^;KXoAJi%;c@T=JI;1NBgd zx?W;VoRc}wdlb9xV{_&Td;8W(+uL_ajb^-^f8J0 zL@c88Jp-j96o-L(M9IB>y^&h0E*zXDa(~|Bx0rWyxDQt9kRkx=lv=-tNdI12 zk^p`1oao55|4m2*eV+dX*6^5$3CYBdya0HR+}ekuCFLy5?tkbiqqVo)&7Ui2VPOoh zVl@WF;yak{y&5bJ7G(;@SS6U_&R0Cva^}B0mr$j~fERQIo52$O7%AEFAY$`Z58zCz zqe%MYwW_3jBK&kLuV$X}nqF-Cv}(F4u9CaB7jM6O(nNHfLrzreu$@CW$~2J2WE2b7n3MuA5O0Ej2{xx+nnR8;1orfV<-F8l~`vtQ)JFYRP$Kz z=auaO3E2*-hINcvws;4o>moX|_N&B%f+oRR7U@sCb9z12c$aS?o&ax;T6o{dab)|E zm>q6UYD&izUoA$9=L~#YGiwW2zU)IJ@vKDS(fFL0xg_480LH^wDP|qXwqd z@H9sfx8%v2t2i1epJPFi>YYS;hngaq(Yx;t z`vba`coZzMm&KYAxo*jqst1Wu6Ccg-xXt>=GR|a-=XNynqoWTjt>z{CPnF~q2#C-p zvCVpMgvb-mqu4HV@>9kvd%S1gb)lnMS*=`c6IwFPvZr6QrMnwQ`X?+>CTxCMOZVmr zngRFW7ik_9*TKPgcsgKX@6xlC2)L9*bW5Er2a{Ej`1x5nLf>~yg)buw9w(9#?Bq8) zcX4bBUt~NMhIt$1R?3>%U!w3crU{Pn=wcPTO4=v7esf)}1~YTIbnXuj>-1+RY+qQ) z55&N|m17m)zsQ96^|#s%rub%o(D}Sto5n`cNl+s3rJOUh$1HvN#cBB6!o69Vh*r?$ zBG))AH&y(KYPN^76tY-&n81ms_TPq8<)m%$ ziIC+QU;WX#bn=>P=^@de=wqBi3SKkacY}FIT;3v!c=)76oRcf*X>c6++e?y!C&c2& z6$U1-Qm^ESB}cOQ7lp{9GF}M0gO}xSC%~I>;CvJ_?GgNuo!!$!o)eoFuM8i|k>(RV(-E1w@!~w3_I8KsY+a*YV2g{^EPI_-yRQh(;p7lRN$j6u`Jgqiisb{@ z-6H#X|EW`oc0)YM(cV59=Q$CgdQ@mRnW_$MpvHs0PC(qYU``;>Dwgp6{lPyZ9vzmd z-V%GTqQy2QxEV#Der1x@(8XZ#h%JV6Sqt4dfRLvoJc>oaWwVGt>@HD_O2xS-_B-5E zFSqiEqS}4Asa~zb)IHhuLY9My#xCbu8+JKj6X9ow{k_s%R}H?Z@tb4Oq-KLpxqV*V zAF^xi`{6ALV+!`#74cAKu{49L;i0~m7$klXtMkvsr=@I>Xst*)fyC8X=La3i1ykeu z<(C)g#9wnM)56YX*Dg#4h+<|4mZwC~7d0F=Up+yl*dOnX$#8!rDXI}xSY9v}8lvEf z7bd->-u46eeK9DRjf5{=kcIwOGu>+T&elipg<3NjuA5r(Lq(=-{lPu=>VtdG$Xy8E zhPUSQYxR0+&@!2$`;+6neIs3D=9dBVzHqEnnrQrqjvy_!ERPTz;4u)yGdaE$KOW3O z3>1HyPjsb5nCMC^`Z+%F86tS12orkqzPs1+tuhSl`!3^@jWqXNl3I|F#mm?BQYV;Y zqXH{0aq4mkh3kATXtrm9MiDtuc!coNVbOxlf78b-A&RASCnSQI_BsBYpew+z^fo@7 z#N*k>k-rA&-ei-M(2wSvMrk7Ea@Q}BfpgpK^!@m2gddqa_*Q)Gp z)i_+@mi5Ee7&(81q>Y?r@Zw*I$o2juvCkHclh9NX7^!1c+6xkiK&f+3~y8aG}wJM;iS5gGWcZ%(*^4RT32 zCU6TNv)XT5n?p*F^CyQwWw}4=2f>eGZ|F*pl+KhM@ zyf<{8|6}{xJ^ptGw6`)ArDm<}4D$jv`bRGK%%|Nrf5K=$D@`Bg z^Q<;MWQ*mKDm{)E`&YLQ3WJ`{?Ul6QgwmQz{+p${gQIT_k`WU2b-YjC9J>4n(Ppi> zint(yk1cc5MK!LRTxTU}pH(0}>3^)L>(OjpTclIDAV}?lf#bf2{blZ2crMNznv(8_ z(nTz3q(uaxn_^*qIKi(y%BDe2Q? z$1F;T^Jvr4sjODW2cvBogC2R}{KV0pu!tPRU)%PuO6@7e?W%erVA$Nwh9jS9O~THG z5#;JA=#R$(L`!Vu>LZPYh&mKXbqG8DyeKPm7V#_TA!6W4|E^L>(%=ffKn*UxH4qmE z;~drTy782z*L)b^6GU`N13{?4KC`CA91kuu^GW7(Z$Mq7J2pf6ziAj2dD8b@?$BG7 z_kmuy2b0EWVKW>M>;-R{(1GmKf}DB0yfteDev!tI>7$MO#gGXX;YZ*fNrt`VZ@RiE zA59MW-!jP}0ZW~EF`zv=v#59ciHkaTG~Hb}zm~B3k9S3s&yay!dW5Z9y{3+hWef~- zL_$(;(ipN07WJGk5^)jCr-E0kqyimxsOwIjXNo% z%bWV#&>E`!F(M^~Ft}x^E{fdU6v-czl)&XVaPX~C5lqrJa@cd9isqTr-`&-6r5kCz z>B1mtyG2dUAvyv4Tu&e&^xTd_ z$oh|wg%{pxl zJ%Y$IJ!;xF8Z-}4wpvpV62F-uavH-HawOo-vVu$KzF-%B?4nCgb5)s(NJ$SdpZ^$I zhnuCt6G1z)OGRmD5M|>d)-Jb|r)xco6+)$xxdf0laKmo;Jf_7vWVFK0LJ;+j;X(9C z?Ywt1Gp+2Ztfsg)VhGKcTAoSvn0Xm6iOWTBBb%3+E5iKG06r38@PAAP&V~iCdcbxI z_m356G&Hb3i7yIX-(Oz`?l#zT(h~Y_N|CJ|LGpLz>1Yvd5w5eR(04e;RudfW7|Bef?EiJ_`fM}4&QgvkA7-1OqPUJkQ_Yt)H-YN{h=pgq(q`-4ItSJtWj3U#nE2GRWcJwk|o>3|ckf9dcq9dH!*mk$5Z z;qMgq|63l4_FUjQE9bR|g!<^M!PuhFW?IX!7Doic`P)#U*$)K5hq&*X_=KnK#1@4U z;2-{v80ZZax%u0Pdmp6;_Rs(4Z&HMR`#zTjT?|Mywin=UhyCN2|1ZA}-Van4@mcR~ zPCHbxc7L5pd@Vwvm>V`$)8My$ZuT%}sx72J3OX^V3s~s{46#_lJhi=%LP|fua zKMok-YYWTlxovMFiuy8dT{$qt@V8Averx~d9-@`eC6nM=RZ-Fqkkb}3`q8Ss-gmie ziTz{ly@cGWmTmi9RC=# zYQ0`#-&1Um-p*P&GSprZ+4R=njG zczMAZm)o|{mN}>epRq*Y?TVzSckzyMF$qIu-}z_UT|Se;b|!`6Z&JGEC;n-0X{vGF z(Q54H=Jd8}jXQ$;{2tUP`_Wjk>`iA?mmPQKBz;W0giazMH|M9SisA-*^EiJBRl$hL z+%_sxzxyI?>`v=TWqQ&!lX<3IoecyHjW?HCkBhU_VK!zRU0pH0o-~5}d>(5QUmYJOa55Jdpiqxney^$@A=Ig;DMCt1RYd~Po~Df(A-8N>A39dVZX0J}u9vGM0Has*i_Ozsp zP2hR&m)Jm99Q)ltNtFDHp1ybZ} zY!>lM0Wit?bqblIepr3rjgv{iqmDYt0RUJ_`8jyZ(NPS1tTU0qt4aQPJ?^%XJFF$b zt~(Z$TdPm+h}_gqNWd0GelIT>3K`hHf|y{hzKZT{KZ+NV^xf?xfP_X zmM0VHe(r8LJm{zoXyE%eqw^xuDIj-eOzQ#R*NTjk&DU=N^lrGa0kWJ{BGQImPU2tI zMp*$;;44(`0w?w+ZVRmRf65Qc3z?qDnkp}T>FN@}7RXXQG&BCfoS9OP+(3P1>Nm20 zEQupxe`#c_t(((*BkJqMI^%T?qbW(U4nIFJ3T^4`SXe9058E@==e!JbUB570ttXy0 zCAR4r$B&lW=@iA>A)<7)YD@53?*VN{P&m!OigM9c-?8A(aF{VbP9~ys<>D2s;I>;5 zEYz~d2mKwWxT?6bytB1BP_^_qb_xY*KqBNuu|R&#-_x$JB+S2Fqw1j#ZEjqw_0D6A z8wmKDbz4iVbd#5bAmTn#GHfC$YzkYgtJbe0r|Sstbyf=m&D}&z-0Y_QYR^p((3I7} zg2}&Fpd_%DNqBsn?$Z=G=#*2!PB}D4%+MAa2=;)qLeB3_#LY1^b4_HiZB>1I<}uH= z1``SEK!ptqn^hj(vFMQdFi>U~+d?B?&Bu=XZ4*?%%QvRIq7DQ2yqq zc7asIA||TTY*TAyaf+aBGP`1I?A_@yw zvm=g&w$-#U==G@9Xr>!%3$!nt<+6w8USDoH9c?*>o08Y3Lq@O^&JPD`j5HGorf@Z0>TrOcgR5MN263gC%2= z%5uCpr1AuIJFcMEZHV@`q%kc`{ANde{kkb1<%->^ zNf)&$p|QQ2C-$kKG`g>~3XCLUFA z@v3_v=T*v)(<8=h>~~DoKF+LmSZlS%7PT?(hM)8)&S8Fe61j3Y5JRu$J{6|!%%rS{ z)4&$`LrBeUJQ%sSN5%a;R77c6CA#^AV6F!9P#D_2utcK$$s)LPYYw?ouw!7&1Hn16 z-Vys5GrWoRbiCFPuznH(iWvLq#p&7D5_H*ciTU|z^=U_&LUW6E|A^_d!WzkNU%dN( zR0~~xbSraq5E&V^VV!L}+IjJ|G!KpT#)=f^cyvj1m9)@LP^4DXIp-Qo__k63{nWRA z=<_=!MdQ6Ds0pN?2}=t@_ak0wV^n4bwV`jhrefIEqY_Q!L!oytWKbC7eB)boLC2Su z?AvR3%i3ySwd-?;rd+duz$L^%!advTl?#Fiy`*3$Yc@x+=Z>vX4)i*34sW{FJVnsG z-(wJ4Nru1Qj=3&NWXwC=a5d{&F9W_npb%B!wx)8~ZELK9AN6?TuK_UfM}3BMaw}cl znn?frG7*e897{_rgZHM+)mNW)flBR`Zdn<&ZT59kUnHBg<{K}VXbZHiGFPl>hlO5n zM1MDJH_a>ieSPE;^NT%u_I6Ai90*w2)q{z~;hcYR2d)336$VCVVo z+h8WdXSAkIS;gm?|E#8PuCY92x-{!|R=@40_(uq|qf3UshWjjHzPJap_@?A2hh{oB z|Kp<6=wG4J`;=zd)ou{MwTi({k;5pZ4rL=7d(zrgn*&&M{AsI`!|7`RtdK1~un0&rT7j(GpsTQRyKb zgPL6X_G;@}osZJ7d9OtjCprE2PhbB0C6>LyjZfz-3I21$8N?Rh#L^d{ja4)EoRZwJ zZ8j2Sf3InQw+-+A!N+fy0&CP;OZAxp&ujiX7^1D;$XlRIPjT||E3&2|>L*?urZGGo zNbbuf&TGu|_5j&iy}q!*70EX&%?~e%9r@WQV43afW{|%(2S-I*ijd)E zfkb(-#dqQ>_Kg=M`ZhzR4)n&Bp$4s&gynKg)8}Me%&jWZRx3Pj_VDov z)^Bay_G~yOA$dG^ZRHioI`=FybT?%tY;=h%^oiQ|`3H6-@jB@?D;XD2aN9c*`0!4V z=wxe+bV~+){P<}rr<L)8nJY5kh*Qezjp5;MNXg6oQ= zKcyOWS~oq_+g;bT;yx_j!K_$*4WwEy44BD~w?z9Mw?sD`mPHC7zlW6Mo{f!BP!~kB4Lp}?(W*?P2RqPzuz>Z~t-=bOD=Ilql=YyhWg8n|`Ys`bCa$Y?U#BBhljTG(B_)~PsIcVazAA>i)~I@P{P0>`bI(|qj*ex8?1jy&D&G7w z+d;FIbBkq@J0GeC^+5%n=I%Nvj=V@i&2^F6o9s8`;6zAj(tNj=Ye$n30-pI{cQ=gb z=*9?on?8X_L`P#^ZSPW6)LuKl2pb?w6YZGHh%3k-l}%0nz=pO8C`)?{?*lA z!t>VFS|ibu*X~ad5S*+Z{fl%CROhoib@5dh@18&^^rOI+ci>!c*hO~NQqpEaU4Wxc zcSQ`Uqj}p^cImN$!H?XL7gmPN8tR%OjFp4 z$@y2U{xu3X3c$brT1+6qzeWLw@UO2$l;Yn=0f_LgQ2-+RYZQP8{~84#!vC#C0blqa zo=26S^VU%MsU389UXg$6#`Ml5f`8y)$o}y>NRT_Bz6pHQAouQ{ZVb=sHd5UKZ?M1b z{o_G0`G0nPXZ4vDULm`@)to}=S?!~@-wS{M0k7W!!lG@e!yO*3sBP$Y3Gf-z1XZ zkMZp=g8w-@f$Q=+Z^e-8zBM#}51jT(k9o}0;rFfY z8w@DB8G9;J;s0o2v_oz)`El^8v;x*X zytWDySII<>qgD#}SBO~M#`YG3A zJJI?A z%sUK%svx2bAS>%Qz`Y6t4?y~dEZYz@xGK}fRa{-&*I5oMO+>)eVMR9L=XX)H(&KK0 zyE|2P|9jzY0}%+&O>%@Smnc9H-{)x}pxs`ZRqB}r)m8D_!UDUsDs~*5k^WKjStS3h zIBx^7&?N>13%TmH)s&*%-l<|r^85x+y1t33#>YE!ZF;1(@;{jd0N)UT98;I{PfGy~ z?mrr#=>sOjmB2-#(uH+$acG`2_msleR@iYc8nK#QDekJ?<`Ifx1MZsMn8!o z93jo`M0w>_OuCf!?JwkwbwS^0#I4R!X82_#;hi=6VI7$!WR_WKCv?gGeJ^QkaS5u7 zTE?pcHOy=7w&_Cmbw#tLs9R&CDEv~z#N48M+7R?0|Htqc5PuD#Ahh-|;HD0WThQF` z$ux;Ag)pIDHLA83wK|m+XK30-n$1d{i*_||peq*=+Q`&{JLQS@bQ&=WXArgs=1LI{A_op0ws=qu(2BOFA|fnWXy;wa@zn+@$nlB@li1 zqX3y#?4q|`h7@|iN9yZC$(7ZE9bc=W;NvkwA*VHiZ^(Z0VS(w&?T#c3BE_!H% zx$gDdX4>Fe*mrzPZlQh_g$2LK_EYHePf6O$Qx1LR(?K5S!mUz;{}e(v8Jw8-HxMus zhGJ1NXSem}8022Dw~d#KI%PZ5C^ELB6?U)$JBHk!aPA9gH%cKnI($Ti=c*$wc_=zU zyK>tFS83KgamsrA5JQZ?}+3V zxKK8t?zK}Fi`*%P8?U6X-0%+TdT_X>;(lB;>y+vPbz*iQ)YHpz+XR$8z?j>M7~h@| zzp$>ZJm;Qq`G5f>O+NkGGRV41UC$IL9=pyIqbT{tuuKfT@gS!&{t`U+GN9>hCM^w3 z4>wugxIQiXZ}WYY2mFp3ul_{VzACPBLw$5@t2}?*+_aB>+}f^ClwU8q#Qas(b+G)4 z@-?ib)mC~B#A}?9zNfdRFNLSjpxuYhW~36|7KiJ5oWFI2HLzt$^nT=g4G~;OC(&7{ z4A-rNT!<)$=m6fkozJebHt*L0%uB)s?NK>#9Ua5GNvkJM1`@HHa@B4q&c7pFv*z#4 zSi0L#eSijXGug&3u@98vyQEyh6E31a!W>`09xl8V zmR{;^3tGJQ6dX9&qy2#wOyM@YK<@Q=G+60@x^1nKadW-HXqmpwQuQHF#UGxg3e`)%gm0VG+H7&;crch7wUS^_!wTuUAR5 zyPAmMA-C0+Cz3pgV*1>F$k+gLQxppGUbEe!!r0nSpc%ouTHeT;-pbAKH+Nm7O3bS^ z>(@bgA~@WE(}~)hvr^`7ymirE2HdJYy*H6|<2qNidncHxMRGATuaV#}@iRF1ooNtN zjNitN^Wxw)hna-4x*@???cy|{KDw^-a%*>xZ7H};7Q5DiKqgsr&LS4HIZhuW(`g~X z57`fPywk>7PRhRRttZnPb_0caao`5@U0P-WY`X%M&>W{~(30=Vy2JgsuTI5BX!xVe z5pBi8iwq1Ynql^&h*|Om^R3#(DG=%J4QlqO`VQyjCnf3iz{{uLI1d39QQq^QhRp6W zl-0#M=JZUvW{$~=t>THiu6NqwvTogcta?K_zEv_upNGvpUY6xoyWhJ+-15L0 zd4p}{HGMy2;Z&7vNT z^j(EC;U?;!I};^4y`fM0BBw>D5K}Z}PeLQg&t?HfDdFXu^PhB*)Y;J#g&LjiT|K%v zZbZt6?=qVyzcY`wAwrTbG6&z=xNgYqd~0AAH^+FyAnt`D za4>+TV+W*HMyDfpr8=l;D*%$+V z8kqKR=vB?tp4B6^;N|^VS3=o)0i-|&bdrbntAzQ8*w1y>GYlBC%>{mk>F0@`uP5-) zj8&lmiCBqPrz!~vr(V1mAFsxEiMqM%Mp4>Vm;L94svOX^D#umqQygDt8h?##1Mt!2G@rd6}0?&A{M$Bp3jmtKfEaoeRR z6<%dp$}PLpKn@!HH_>`mIW>X=Ha(fAar5J`Xn?<0T4}u^TecY=BhoG2?umGgvkmP` zgowO9Hib3Om%kWa5j-T@QOU)$sELTjW7kTYf*I9;W#1btjL0gHp%tu>zjiy=fF?A0 zjdO*>n$vB^MB0YnW{$o>I{f^OH58P1d3;KHXQNE2TS3xkE;`*nh0weIXI6k>nV~Is z&xViC>-l?bjs%?kA<}@zHW$TOaQdzGEm9EeM#@bV`hW!go!(@`O?eC$fw-t${Y>R8 z%>}fr56L!u{D37o>z3wa`YLx@cuV=&vkh%We|4RDINkyahaD_uKK0wMIHt2PMQ7@} z`au8@ydZS8EME2rLRot?HxsVCZ%c&01HaL-f7nilVQCJQ(0A+tw@}31+_R0ENz# z(m_Xh`hd8zOnZ}n_k4bRuO&t49he}c^6ZOXw)Kl@Xppb9a+=rt>U){pBW?2#y^S(G z89Y#Uwf@x4n-KXZ{F-G_2p2_wdlgIJ8#xP(jwbk4tAnNlLh5%e)~jhmq*3#d*A;y$%dh@bH#m@bFFoY$L47d?K|g*hqykVr1R-_wCb> zF~8@{`}w*&ebA-d4;91jD1ueCg7ND}%g4D`lc_XL%Xzirk{s`*ZR4h4cID837JG;^ z+PHzMe$>AgD*tOjp@^)z4PSuTMk*pnXnOnt%Na4v?@p4Qf5Mb32BG>5<6oZaMov=( zq!4sTB=V}SR|Cxx6U(l$EzbGxXg!RCeK=>QFLn$xTc$#z#?cLNHuIL|h7 zt~Uqj!d#3$=cdk?638#O;0QZ;_vAMSTo;G5ff%9RhkbxGP?* zJsl5w0p@{CL&SnL$8X)HGiu(JV1Qj)ms3`m)yGnMk!a+`02dbP;(d;4?{ z4Hk^w0YYo6i-6Xb+Pq@75>7gZ@NVNT;9cp(DyYJyAbSR-%+IOW1N$v5DJB(<>mYI5)m?O zG%e}uG`{+Q9QT+JxQHwoqN?yK30b!qR@{wzbkTCyN6cVnvS|240D&xRS6f7ef*X^Y zq7&w+d|_uIK=Tifsp3VZsI^b~-Ih2Tr2xk;L)^fMJOu|g7O@dO@|ol2gW;O1U?LRk zqNX?U3KV_V+5(OvUiusTUD#9yrvGdotvj2sNboI*$qG#$pKV3#&)A7P26C{6>9T!%u`3A!e1lN!V_8N#aH33; zy06;FNd?|!l?qY?q+(qiJyoENvr&GCk4d<~6 zKJ&iTXFrhv+J}Gv?=TO^9!MzuF!XXY40e8}R1Dn((gILL>oywfb_}r~dP@S*QbnKj z2CUM&MGEL^db(qcdR%n$2g(<>*dVIX3CD5r-f_Fh0g4?AcRaVIjV?j14zlvP`rDH+ z?ha>yn+^dVe4UQnQ|uZu2zrQj5QGH>{rRO}@7-vW_mtn1a`qzraHNTM_g+o(F8sG%vA9&PNqLzV1CFVaW1e3 zG2oXBGS>M|+kv>MDm^bg;P(bou*;Y4&~H^Phvf>B+|*)W1h(&4Xs%POljcFLUWco} z?p5Lj2H(VK-d#^D^oT`-nt87!PyB~ZkA>0(-h(DG+0l;;>cT0Qet;hC#5@c0G4$Nr z3CtKl0Eem%A0@qw#_C%FGVGt8MAb}~1motc-sV}H*+X~O2)a^mc>O!~u67%D=@vr6 ztg+_U-D5#~O8URsIv493Pb|&le9b6w({oZpM4HL-QNNfX3f9ucp3B+g#bZbDz;_sK zN!rB$_uIo`AYMQ)3#1QvpY@V7YVm}WeD#_SOgn{09&j~lu8 zill5)Un7LT6H7goVMN$b5M&jMT)mKx^-E6zot-=h>X{XWOetGfC>1JU_Bs7$@Xyk5 z^@SSFzeCjTBN3tS(;-|?4eSrfHD&mFkl*@AI1lj8JIxR^sH?I8PxZIf5~8LI-W;X*QXN!%dVgOy%SVpDOEeCAS+KYq|nX z_Aw{n4}^Tc8<&d8A$EX6 zp6j1icE5HuE+e~FqGp8lE9t~^_W~}xQEgvxxuNY zj=sl;x7&2u(_wLR@Mgid@~nL+b?NyD_tEJ*Cl`g^X1QLNPto3FO8Jsy<@}vNjOXoI z8nEB@H%7*_o?q`u!}YP!jSDq$3mo=&P15e&B`+QjAe(%Cc?F-jO;d${-&y{6outEB z!YDZ(iQwppg=14!@DgANOYtjDRAid)5iD>JDeMMqM&Wl1L`=GbfM40-dc4cD${1#` zp_Tf33cRDkj_#?aF02_Vx0i@R9o8@|`XG$NRM_mvH?-oLf$T;`((IyVI=z2&-LHyA z^h7LK%NaD?nr(bf5bkN)LmA(g9QrKG2B)4?9UE8X+CN9z$RBie41`)!crf;)$~`om z^0a}ORrQhIIhHV4QHwLd9XmDsbROfCxwvs#)r1ui3xjbZ)QN#(0)?phVF_}jKTmg6TkE1muj9A0!CV;y z0%1_LtE3zxH38OZ|CouZ1t3-kuZf_~A4F8y{9ieLHLyrT{^EpdzJhnWa607pApJV> zFhF>jQ9vi;X&|*+G9ZuhL|i#UQJ>ZuF8UIr1t^J9T7Q3`v?9t&oZMbyWjmC& zL)t=#NQ+(l&!gFS@CjB(>)TwF6S+&q#S%E~Lc=lNm@0PBj_9M>h3|6RyD&~e?va^4 zo#>Trfu=pp>%N`FX=nH05Ukjc)0$HNguc3)uwry8*v%Ou8+lV5 z4MWFh*B}z8t0(!9_EM-*=dvuglxAbKAba7Z|5@Y1T?$(JaIn?P>I!7P5mu$Tl5*5o zl;Q8T_76wERyay0PFuW0PFSF_-&SShdux?taUagHX9k3L!`o$cud?3C_`dOKx8uHdgW1?d0Qidh@=%|%-EeUiyJ&CX_A-e7MHz=eUg!A*$uD&MuP zjdSb_n8N+2!T1L5)q_w>!d(E*ue?&bxUokp?b%WOzKUaQbTV^LM``BmJ0uBH<)2kC zzNanTpZRnko1SsT0;}#DaJK+6f2#LyhmyBN#@1c@cEEV)`pWPWj<~xjh)>L)fC|Bj z902SpKq`^i0la)V;GX$k$7tub1}|yu4nqHR&|FVYQqW z^$3@outA|1M7X(6&CgEAOt+HaX9+VrTH;nVPoE!u5(LhfbRTDFUWQ_4saVij1+;}u zFJ>Y?)T$iduclzqH5d{qZzM>v=GcW3h)DV(N1Zn{(3q|dM2LB%lvbdXkXV~=^MV*T zbc*Oeo&!HtArWNGPU#VEZHC%t7N= z%SciUzXy&@L5OtAd&tdHy9RhCp53sM3&Rv-r?;t-Jrgw$*losJ3w-#^dJKppXTG+* z*}LV=Z_ya^=p4kQP}ovr;n+B?+wn zOUAs0CJ&Rqx+fp-Egqv_U98(Nu;oJRWlQe6#1~3E={3qRu0};3^X#VGTVPYAUd2t= zJotEpX^3?dCg0`}0F`Sx;XD0N=qf-0@eH|S#X1D-w@N4@1WkY~ZzM5CU4D08pZAFW zg8rr3%Zn|k4%Y|S`ska3zZ@*}kDdruEW#L7&RnFoW^TCSrxg2kItSn?l6u499ExAy zt7&r72~JDdolO`!?&7bf4Vd7&>Q`A=2f`^2-uf;;M0oK++Z{$7PE-;ozWLZm)Yl@A z(~tJpv9Hu2J6|hv3hlOqu)*wv>7i8*9kzMYO@Dg2)?ir4rT8b52>d!6%SR^g<8nRM zOTDEq1bQ&2%^uRA<*W%t1!~~ih0|#o>uNwKc4Y;dI-JY z-{mRGB#?&BX}3Ta6np%=8iHhYYVoaF+I2By(ah}f>MRzja`|BX?#g9r%Y)cO2(pwmPOQ=^~|geQ2>JbA8orNOMs1oTWtg3ADpGw zsY)Qltfo$o0{19;N&-|Co7Ip3`~sLkRsCGD$ip%ZK9(|gxc}W_j6%yIh0n9#rxmkL zQR-R@Bq0*_4brO@PT}%&c0__jVy@^>D5`+q>-1WNo}B0eTH5te^a)T~5>{y7f8%p) zX$*W9$b#H`oKz-OtQixO(A#TmTj*xWaeM+$aOM3vSbl`gokJ+_@PhB-$NKcVJPQ*e z^G}`Fr89v31oIuDK9mEe1m@$35W?YczS+9tCT?Bx^uezCs_BH-@Nm;WFiqyTaQF#J z`xL2>btQYv&&j6sJM12PD^@&qcc8L$>bnhd0aPGA)4^(xf-Yz2HmGa&w-@c^nRxoL zSx1%iI57~}L;YNELN2=Ntl59?@i|g}LKfCLINDndY~*}pzp2qJ`lt$n3UpOE>xs(vwDP$N zH?Ba8r3+MhwXK%OBYe;CqUC_Zp0IN_OZfd|&Wv7p29IAdtGt4T@^XaKaXuEEK#p@^ z#X&<^U3$~4NSyy-u2}{%P&J-Z_wWA^evA zMqgvt!gbIAp6neKk=29B1gPN*FM%26+|Fyw22JMdJWz{@Xly=(tgsibFwQy-zz$Mt zMY4j0QOd`LqU%5t8fJ?RT;RH5T1Jgp%2othbZd!ofGH!8)BxAH&1<>|;b^-|>1mTS z<@em@l(xd|9O!W`{yC*rOUnuqrz6$4951&Lr3LG1lnBIdtyPJ<;0x3rE;JfXENBnl zf*5hf>^Z3QXDMIeKt36_-oA3{UHui%ow5O2)(ZQV8VcWa%)((|22Dk?svUs`A z6^drIv>FQJtVFZ@MBsTzAU(L>>5>u)LW*&j+mr*q%`F;`n%i}tjjDu4g0)ID%~n=5 zR4;wkYeR6pTyNsYhl$>1$4*6MwAiIs+IXoKU!9n7nNo5H-LzYNZjleW9qEzz5UdOa z-9w+$G_O0*0V0f~gFx7i$-1hJ*vQAqM?4)u}H<`1$)7H8m)` zJyJTsW^yiz{k#(BPeW% z}02tbgAVf%XJEq9Y6Hky_q>zp22%W($q38t$T-xiHD#nri2*#^38i9CqDmB3| zI){)dR0RZBJd}u0&WAvT^&stLI2inW@2?Dpg-^&z|AUazdfBxcbqL}!0!{FdP_l(u z&H*I0FtHRbP)-4Os58W=)2d=GS zk|eGv2vN@vvID&`^gVMq{T~r1A0PiUr~kR)Z-cKz_4ytv<2o4`+d65jfS3gol_B&J zSUG)7vylEKNP^5Db=*B4j|`V%6~48pwY)_d0{$lyG6n30n$l~ixvAKBv_}HzI}aTu zt1t_$jZ}^AP72~o=h4v9aRPM9Z2Hdx&_Q}W*DS8Tv$XK#r5&ng``+P zO)KbQ;cw3E#KkS2G5#UAuYSo$6!gXH2Rf2CL*hw7nnK#B-Smq{QyAzv`=O@rr)Vj8 z1`_^-MyN<`Laf%upa|-uVTyT)!}Snk`}#z@SA%IN0AYU{fds&c)!@F6`>%*1NOMq= z?h_A)=}(UQZ_SR8YA;Y4M%cSfq%O*z{hnfJbM>_cv`KutT4dH zp@P>)K?q*)p8q?%D955FaYtU#s$`bmho7Rxs}2;e0j1`v$HXM$r0`Drk*W$}?LXfF zXFfo1N*LBaYQDfPb6TG>fBeUWJ_l*6D1y&??KYsoUz{g4)h#=!8KED9GwC zUS>OxrbWif0*TM~aXL=J9c*UVuJ3n!O@M-Q*KKfEQ%zdGRfhfpwo zAr-!A6dl(S=RNV`P-uo`1u@2$k#qT|BHf^jSEyD|3Vh`uvfs+`;>)vwN~iUJ2RuJ1 z#Ws_3#pWUY@h7f|S^-GcRC8|WaQ$qy(|yKXNx0jdKEQIKbR9q|eYBx$0rd(Y$E-+7_wJ5$0I2PCj zSIl9ZZpOt6+M)8NT96DCZ2l0oKdZYgdG+)xLORgNkGLP>UAG@M=x-S2^7>U8^B)(e zSaX4O!Yx^%#h66m>92hZ@>|#pwh}SMCn6V;x*Q%Dmo~e%)~vvccv~?BTxLJAw72!1 zxNYO=GKIqBLB>bnhY$0mRU`2{^+9PTsIvG-Xop+&F};Bc>;Z>tnx4PA_?O-PvvvX0 zvs9F!^E{N!5z2;)y21o$5L+=X)Xx&Q6)Xc$VrebL#i`%80zosN5g^2}ojILOiPL#G zH6@N*it!o}TwD918yJWKh)`MM$e5SeB``XEKl6s0WhO^L? z&e)#_ZO1rc;bO(hQJjpKBcHBV_j=W=mBP~xn`S;EVGlBlT z=au5>I1zUL;qjk)IOo5$a`m6FH4G4NwP?2!KYP*Po2lQ=_f8|6evxWvM*h^F;=v(i zqeiM6>{TQI)eKk6T#I%bdCD_(BO4Z(f)C5Vm4(QE{OamU{*zlfyk@_rW_eHj+7_?@ zK5){&eW64-lSZTLQJz9VD&uA5#I_Pvj8yVYUe?#iH1n-NVfF@NX@&{NCxk@QyzKKX z{&{la$*LV|N4Ow|H01N8^QQi4ATPaREKlg08d)#byv2>)354@=RX+Fjm974cTy{e~ocwPGSj%|9| zbY_R#yst2pzV>^6R=MfSjGgz)ef~8gy~@3I*x16I82$?3{IXJycc(M87}2X$sApj! zIIX;VaihfHHA_0_`)6LCY_f#mV)MwwzHrns#=znv6ebU1NO58CW4_ zc22qYtt&b#|KPG0H>Pb2sMbS?Fisuyof5ui)zA1m^5bQ-_pW6D(dhgcObq|Yd%UcS zE|_=?%+$PchF4{sgwX#tsPj(RN&FQ~w&*sj91>p4oN8z4Zs*f~3aGB_<~zwHUBp?r_Yj0b?-oJRiq=T&j&(5h8M zJQ%kNU=nGidL8hCoO!hnTmI|S`g&~-el)pAGWOuFx8c{Q zXN>Qqhx@qh!@Kw<_mlho_XB1-JuWl8beGA@W^_c3d;KRp^E)>UjxfcaKK_GH)krID zo$D`tmzf!$VMjB{l2D=*%wAur(>FE@8i{N}{^$SourDLzubkNDsNm|dy?b?4XWE(f zaXD)^`+6o}*hTZ)aeMy<zav^|iXI11`!F zoBZz5H>>)zhAvHBF|qJ2i9|`N8D`!m@6Qrw#jef11!n)RUsjmOiT{|MVTayU4=c9p zZMgWN=UjO_iyV-MFlnSMo;f6%_CW=oC@;VD^!D7t23PQJ%`m-ZYgb zD6H}Hv#%0ET&vRj@`BW^Z2|wGL&>@eQ&jnF?24ZMG3oQcIk>T2vL15VLI;-M%jE-B zsM+#?7Q?CnjNg1R60*D{tFut1lX(fjjh{&wlW4K`r}fRw)Zw*IdN1a24H7~}moKvXGc;xV!t!rM zpFR&<{qH}N!DOC>o!nBdegXgGu%me+$T*i~yy;o91o|SjuXAK)z&eZ6LpmIhdq=G8 z+d1sehKW>twdb09-Y)p26l|AnvrS(W+*@02fpUs&ty+8%x< zcpo0(6;GdSpO4v?m^|gff7!J$Mrj9ZW6!I!Gkh_Zxm$0%igK;`RwZ==HVD}_GyL&U zP=k?jIo8YGt9L{hms6OV{_TG+VS07ht6Jqa!^4tDzrMm`+^Y!aV3!)0tOl-LnA0Kw zrearOR8A$fZ7<6_Ajq*DBE=*zJF^vpITnXy+yl445?VP>Zrx#mk=c0{54Os9to zcu3FK`Ev{#!;b!GOGB=2p|KkEkH7{Tk@OURefA>fflnBhcpfpN?q!=e+qP4fgOf`BEh}cX{eQ_a9<82V#cX!M#p+joNBxToNdD^{|w#w(q$-aFl9hDcyI+3#F}X z!m$Nz16wR=j9c25s;!e|>NM4|*J%y&!U*=Qu5H*4SX;`3yHl0q2iR4xBu?QA2H?D2 z_DuEKjO9cp-k`*tjaN&<3pwP_FnrbShRk`a>iUa?Ny=GFsRzlAo1B-+4FZ% z7P9(a($CwT>xxPn6M92Vt0vTIbjBD?#*IYcSj(+k$vcE;o@yVVfJ~!pG@t0b|L1lZ zIPpo}wa`b}U4jv$(IiyK*;HLmMV_&iV)8Ssqj1)^^|$3I1sSs*=jKC{$#RZYvg1F) ztP@@62|8If?QcEtqZQx9lFUqdf53L!nV8;eI_H!F(N@)Wcx*FuLKhU?#? zEc$mR6z<1c^99;q>Bpb(SBtmCJ$Y_pj>D8eCBaWgE=f!4Ux*ji&1P@?C|lC)uKWQ- z4J3f?h|7^6{x-AJ-41%_pV!qBD@$}TQ48OOj$?6465Yh%+hBFwQFzqU+ori}sH8DY zX$OolfLf+F_cEHG;F0@U>(3b=zV)u|=8os`SC93n6?POg2__!Wd1GcPl#uw|o%#w~ zV<*acX?kOTu20b%v+Cc6`>?D={=33z?}ovR`?_bXVOxc{c`m#Yvb}U5$=v^pYE+bK zo5SD7G3owFT*>;l(Gp4S9XrZuy3rHIBio%JsP2KI@C0RUBtZmi!Mn_=30lh+j#HjQf}mm6XoC(eb>CGS*JEfu}p=C#} z!ao-I;xgvj>c`G|ljsg_%dZ?(yd%|^&>%fzMVzxtzw;(8Tbed^^`k+{t{rQ`+$X!T zycN`G6YeKqVEu6tvHq{DPVXsCgB^PnwY$H+R|MQ#r?++cY1L~X6UX5$7;>x(mTQS( z(r~dPu_)yTY-oUzAK3a>R}&iqHvB?$CJZs7kPL2CjjfmX{CQxp(4BPY@|mX}%)bz6 z#z&Ps25*u@J~tS-1@J00cmCjp4a9fminx~RQag#|g}Hm0q~dBi7wAv@OQ`189a9hP zzXBftOlIF~!>ec*l-=RhvS6wfTlKjsC16WktyPeoU_{TBtg_;_b0%N&#GUQ(Atw*X zxK;(CSITNHz;zGH{IQnVN_a$e$CM?cUPU)PjHDEgi~~kDwA?V=z2{eZnn=)Go2-=U z{3W%lkLt1V%KoyM63CmABebobjIkDJd24i)@Su`tW zV5;T!biJ*pxR~PjnJVLru+76Gano{0ADS-`4*G%wsx1Y)=wy{A_C?CY8i*#cpSt<^5eJ8idp7f_`zG7R34vCz zJi@yt5B_JFr-e_w=chx)c1mS@v3;7il6hs(UR|0!hEwR{GRLctlVtI57qitUE9m9o zT4Bq|YKr4{ibLyQ)Se2?Z-mgMZ>9Icwb^ixyX5V7t1N^fC`fhKguA=Ba zo8Et%iPdYnT?HV^M2p_IyTnB>^GUZp;dY&^=GchB`?uMU{lT2#s%k#z1+wjy^;&cU z7tQpzh@zWKn-or$Z;Dt2SSf=WMKT^id%;xx~E@+7G0 z%kWbd)-xDsed!)r=2gq6F)gl zJkmP6;JI88kN-V4-vI0(XEiSVQgE7LouuK~&CO;nG}=f3<|w{<$kKb}=6@Jx%ZruQ zv>qG(b4~5cBcB{x|$Rn$P=8~e#;|p7o9Gz zgr(k`=EXQPSlzcGL0i_bXYf6`80SM|N&J}mXt%_loh&<7(hq^|l+$}H zqGsHA_I;5gbk~)Zk_e|aNoC_Bh7vP-Mn>ee$Mwt~g9x1cRuXSzqljFL7wyoG9%9L> z^Xkr1NIFRDX&(A&IOOEilsP*yYaK0*x&8_F_~o~4Yvhhe`qc`aH`4*UcxT~9(XgE3 zQGiVYrApdS&{v%wQAWM_1jQE=v}kvFuf7aKqNzE)BpF9j?T}PMr{Pw^k2u|qDM-n8 z&a8{9)saqr&%OV$NY}jDm)7?=%=E)N+lKK)<- z>_C-O869i8PdjA-YXGKRT{iiBLk5QGi9ipn%U{kwltaM#52a>wu6#FHLI3+5DlaJr zuPGi@ily+5i__-bCzaWme58H2R!7?LOU`*x1OJJJP>B)hV^{(%7gVj^12{(^f7w(yv3dSBgx)V?rlH#OJqU~1t@3MvWt%+#iC#WAj zv*Z!%a*m9jVf7_hJBS$myxuVp=Avwa%=qTxZn)%y{5bHHw>K6`*`1D|%Z1LK=<}F} zgZ&YzEv=`7&ahA#f4uE)9}MJSJ7^k{Doi7q7#oTYlP>5yu(iIGa`pOO;a5mdLU`GZ zpJf%z`C4~*3qj6IqFTEh!{Q^Tin~Wii3!jWLdg{p;z>+eRNHrj@H`~oA0FGjiN#@S zZ~27{68z|RKS4m4t*uP;$dT&yPPTpjbqg&E%QApa6=z-u}`ik(ZRT-849 zfzUHNqOcvqC2sdh)(}iNA&}0EK#J)ig8Y+G$o50LUb`@h;VnP3TjV>Xw4+R&%2+Xt zRZFE!QaN*3PJ03Juyy4Ct;!v5bU?i-L@U3wvIKfQH-eV_fqkWSn}T4hp$r_` zBQ8ac+&u@dh0kY~&^;bfR+2wE7fx$*mZ5%4eeqg)?GfxMxV7C7==!|`5tu9o#9GZb zE6a0ouy#m84dj1;a#Z<@<>H`JO-MZ%*vH*pQ8-p!&F{Qd4uhc(_dYBDu(8uExeuT8 z=JDfqnU_>Arl!WD__f|8D6AVkw6upw4o-|@a`0xDLEpK&k=dxdBdsOL0#?>DIZJbW zkr8(nGfL6dS^!qEZ7j5`@tSIhAvZJ#qP0xAF?WWOq%KpN3Ib>fvD9veZel0AyIR#*ILzE6rJ@1ai=O66s#e6n$I_a#e%h!YEZLeld%`N)k2 z!c*?psyBm$b0bzguSDANA~k=}4DWM7tIqHCDfj}FvroFpbNXU?@=F9LFzvqi<8V9# z%_EL>>FH?e7fueQq%7$ew~F5|8x8u?V|9aB@C%9hUYDW<7AcQ>Ezm?>S}w8Wly6yW~hl(aH2aHB$!y9 zqY(}gqF29He1wIu_NM*{=m&ods)}rjh>d&-I5Cm@@y)Oz%{0*r4;Xcit%Hcr!4Cji zFGtLPH97BzJ%H-% zic?X427l@XH?E?~oQ+sQJJjiu4apTlkD?&c8q0{OsB(QOBdl%AyGqT}@ZMp-;X^ zRnw{Jez^Y@X7PdhOq#949?+rgd^1t%zr@C=KP(|W41BS{;nEIeeYJvQ@!?0Q}7yyuJhkkgII2uQ6=$?>o5g2<7@RC_%N zdXgjJz302oq6X*n_9s~H z(EO-L#iCCTUDVD@N|zjryE8_KxldLGtqI>|Mhqs2ZogaIttjSydVzHd-3WYr@zGYU z#j)69@y<7#(|=OI2Q{3#dbqxQ3fW-TV|+$abY@mP+u^Lj=EuCdE^_u^-Q3hK*C@(h zwSKu{v*=e6ah*UtCu8GME}nz5m3T)`)ib|)FcJD^>gL7IX{2Py~-|`H+s|6Xmgh1kJgrmX>edg^<--4 z0HdjIkO&nmT*uE3Xv;rn5x0%BYuDaDM4)4les0`*7a%H|Z_&)mHqJc(oRbHIN???L zt0jnch268#z@L6m|(-I~`eM{Br1N(7F$Y$KpJ ztKbgZ{55Qd69!z+XExs*MGkeAqcDXpNT<146GImbkRQ#|ACzC=yx#!DX70?b{8xm@qwqZp_ z3v29q{2}CD=q@RbKs|m%E7r-Xlku6rC*7#L3!3inM^5=*S*dAye5fPqGeRDg4jn~c z!!|C*f4v1a|BIty2)R8y#XAF&oi=`x#^Sl}?58ev<93A2O{agT{#gqtM&%wBQe2

  • + + + + High level design + + + + +
    • + +
  • + + + + List of capabilities + + + +
    • @@ -3680,6 +3702,28 @@ + + +
  • + + + + High level design + + + + +
    • + +
  • + + + + List of capabilities + + + +
    • @@ -3796,8 +3840,24 @@

    Users and Role Based Access Control

    Introduction

    -

    In OpenCTI, RBAC features are

    +

    In OpenCTI, the RBAC system not only related to what users can do or cannot do in the platform (aka. Capabilities) but also to the system of data segregation. Also, platform behaviour such as default home dashboards, default triggers and digests as well as default hidden menus or entities can be defined across groups and organizations.

    +

    High level design

    RBAC

    +

    List of capabilities

    + + + + + + + + + + + + + +
    CapabilityDescription
    Nothing
    @@ -3813,7 +3873,7 @@

    Introduction

    - 2023-06-30 + 2023-07-28 diff --git a/5.9.X/search/search_index.json b/5.9.X/search/search_index.json index f6ea06ac..14fad71c 100755 --- a/5.9.X/search/search_index.json +++ b/5.9.X/search/search_index.json @@ -1 +1 @@ -{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"OpenCTI Documentation Space","text":"

    Welcome to the OpenCTI Documentation space. Here you will be able to find all documents, meeting notes and presentations about the platform.

    Release notes

    Please, be sure to also take a look at the OpenCTI releases notes, they may contain important information about releases and deployments.

    "},{"location":"#introduction","title":"Introduction","text":"

    OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.

    "},{"location":"#getting-started","title":"Getting started","text":"

    • Deployment & Setup

      Learn how to deploy and configure the platform as well as launch connectors to get the first data in OpenCTI.

      Deploy now

    • User Guide

      Understand how to use the platform, explore the knowledge, import and export information, create dashboard, etc.

      Explore

    • Administration

      Know how to administrate OpenCTI, create users and groups using RBAC / segregation, put retention policies and custom taxonomies.

      Customize

    Need more help?

    We are doing our best to keep this documentation complete, accurate and up to date.

    If you still have questions or you find something which is not sufficiently explained, join the Filigran Community on Slack.

    "},{"location":"#latest-blog-posts","title":"Latest blog posts","text":"

    All tutorials are published directly on the Medium blog, this section provides a comprehensive list of the most important ones.

    • OpenCTI case management is ready for takeoff: what is available and what\u2019s next Apr 18, 2023

      As part of our 2023 strategic roadmap, we\u2019ve worked since January on the case management system within the OpenCTI platform. This initiative comes from 2 simple statements...

      Read

    • Progressive rollout of the OpenCTI Enterprise Edition: why, what and how? June 10, 2023

      We are thrilled to announce that, from OpenCTI 5.8, Filigran is now providing some customers with an Enterprise Edition of the platform, whether on-premise...

      Read

    • How OpenCTI helps to fight disinformation and foreign interferences May 21, 2023

      In the past year, our product and engineering teams worked closely with multiple companies, public agencies and non profit organizations to extend a bit the...

      Read

    "},{"location":"#additional-resources","title":"Additional resources","text":"

    Below, you will find external resources which may be useful along your OpenCTI journey.

    OpenCTI Ecosystem List of available connectors and integrations to expand platform usage.

    Training Courses Training courses for analysts and administrators in the Filigran training center.

    Performances tests & metrics Regular performance tests based on default configuration and datasets.

    "},{"location":"administration/enterprise/","title":"Enterprise edition","text":"

    Filigran

    Filigran is providing an Enterprise Edition of the platform, whether on-premise or in the SaaS.

    "},{"location":"administration/enterprise/#what-is-opencti-ee","title":"What is OpenCTI EE?","text":"

    OpenCTI Enterprise Edition is based on the open core concept. This means that the source code of OCTI EE remains open source and included in the main GitHub repository of the platform but is published under a specific license. As precised in the GitHub license file:

    The OpenCTI Community Edition is licensed under the Apache License, Version 2.0 (the \u201cApache License\u201d). The OpenCTI Enterprise Edition is licensed under the OpenCTI Non-Commercial License (the \u201cNon-Commercial License\u201d). The source files in this repository have a header indicating which license they are under. If no such header is provided, this means that the file is belonging to the Community Edition under the Apache License, Version 2.0.

    We write a complete article to explain the enterprise edition, feel free to read it to have more information

    "},{"location":"administration/enterprise/#ee-activation","title":"EE Activation","text":"

    Enterprise edition is easy to activate. You need to go the the platform settings and click on the Activate button.

    Then you will need to agree to the Filigran EULA.

    As a reminder:

    • OpenCTI EE is free-to-use for development, testing and research purposes as well as for non-profit organizations.
    • OpenCTI EE is included for all Filigran SaaS customers without additional fee.
    • For all other usages, OpenCTI EE is reserved to organizations that have entered in a Filigran Enterprise agreement.
    "},{"location":"administration/enterprise/#available-features","title":"Available features","text":""},{"location":"administration/enterprise/#activity-monitoring","title":"Activity monitoring","text":"

    Audit logs help you answer \"who did what, where, and when?\" within your data with the maximum level of transparency. Please read Activity monitoring page to get all information.

    "},{"location":"administration/enterprise/#more-to-come","title":"More to come","text":"

    More feature will be available in OpenCTI in the future. Features like: - Automation scenarios and playbooks engine. - Generative AI for correlation and content generation. - Supervised machine learning for natural language processing.

    "},{"location":"administration/entities/","title":"Customize entities","text":""},{"location":"administration/entities/#introduction","title":"Introduction","text":"

    The following chapter aims at giving the reader an understanding of possible options by entity type. Customize entities can be done in \u00ab Settings \u00bb \u2192 \u00ab Customization \u00bb.

    "},{"location":"administration/entities/#hidden-in-interface","title":"Hidden in interface","text":"

    This configuration hides a specific entity type across the entire platform. It is a powerfull way to simplify the interface and focus on your domain expertise. For example, if you are not interested in disinformation campaign, you can hide related entities like Narratives and Channels from the menus.

    You can define which Entities to hide platform-wide from \u00ab Settings \u00bb \u2192 \u00ab Customization \u00bb, and also from \u00ab Settings \u00bb \u2192 \u00ab Parameters \u00bb giving you a list of hidden entities.

    You can also define hidden entities for specific users Roles, from \u00ab Settings \u00bb \u2192 \u00ab Security \u00bb \u2192 \u00ab Roles \u00bb and editing a Role.

    An overview is available in Parameters > Hidden entity types.

    "},{"location":"administration/entities/#automatic-references-at-file-upload","title":"Automatic references at file upload","text":"

    This configuration enables an entity to automatically construct an external reference from the uploaded file.

    "},{"location":"administration/entities/#enforce-references","title":"Enforce references","text":"

    This configuration enables the requirement of a reference message on an entity creation or modification. This option is helpfull if you want to keep a strong consistency and traceability of your Knowledge and is well suited for manual creation and update.

    "},{"location":"administration/entities/#workflow","title":"Workflow","text":"

    For now, OpenCTI have a simple workflow approach.

    The available status for an entity is first defined by a collection of status templates (that can be defined from \u00ab Settings \u00bb \u2192 \u00ab Taxonomies \u00bb \u2192 \u00ab Status Template \u00bb).

    Then, a workflow can be defined by ordering a sequence of status template.

    "},{"location":"administration/entities/#attributes","title":"Attributes","text":"

    In an Entity, each attribute offers some customization options : - Become mandatory if not already defined as such in the stix standard - Have a default value to facilitate the creation of an entity via the creation forms - Define the different thresholds and corresponding label for scalable attribute

    "},{"location":"administration/introduction/","title":"Introduction","text":"

    This guide aims to give you a full overview of the OpenCTI features and workflows. The platform can be used in various contexts to handle threats management use cases from a technical to a more strategic level.

    "},{"location":"administration/introduction/#administrative-settings","title":"Administrative Settings","text":"

    The OpenCTI Administrative settings console allows administrators to configure many options dynamically within the system. As an Administrator, you can access this settings console, by clicking the settings link.

    The Settings Console allows for configuration of various aspects of the system.

    "},{"location":"administration/introduction/#general-configuration","title":"General Configuration","text":"
    • Platform Title (Default: OpenCTI - Cyber Threat Intelligence Platform)
    • Platform Favicon
    • Platform General Sender email (Default: admin@opencti.io)
    • Platform Default Theme (Default: Dark)
    • Language (Default: Automatic Detection)
    • Hidden Entity Types (Default: None)
    "},{"location":"administration/introduction/#authentication-strategies-display","title":"Authentication Strategies Display","text":"
    • This section will show configured and enabled/disabled strategies. The configuration is done in the config/default.json file or via ENV variables detected at launch.
    "},{"location":"administration/introduction/#platform-messages","title":"Platform Messages","text":"
    • Platform Login Message (optional) - if configured this will be displayed on the login page. This is usually used to have a welcome type message for users before login.
    • Platform Consent Message (optional) - if configured this will be displayed on the login page. This is usually used to display some type of consent message for users to agree to before login. If enabled, a user must check the checkbox displayed to allow login.
    • Platform Consent Confirm Text (optional) - This is displayed next to the platform consent checkbox, if Platform Consent Message is configured. Users must agree to the checkbox before the login prompt will be displayed. This message can be configured, but by default reads: I have read and comply with the above statement
    "},{"location":"administration/introduction/#dark-theme-color-scheme","title":"Dark Theme Color Scheme","text":"

    Various aspects of the Dark Theme can be dynamically configured in this section.

    "},{"location":"administration/introduction/#light-theme-color-scheme","title":"Light Theme Color Scheme","text":"

    Various aspects of the Light Theme can be dynamically configured in this section.

    "},{"location":"administration/introduction/#tools-configuration-display","title":"Tools Configuration Display","text":"

    This section will give general status on the various tools and enabled components of the currently configured OpenCTI deployment.

    "},{"location":"administration/merging/","title":"Merging and de-duplication","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/ontologies/","title":"Custom taxonomies","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/parameters/","title":"Parameters","text":""},{"location":"administration/parameters/#description","title":"Description","text":"

    This part of the interface wil let you configure global platform settings, like title, favicon, etc. It will also give you important information about the platform.

    "},{"location":"administration/parameters/#configuration","title":"Configuration","text":"

    Configure global platform settings, like title, favicon, etc.

    "},{"location":"administration/parameters/#opencti-platform","title":"OpenCTI Platform","text":"

    Important information about the platform.

    It's also the place to activate the Enterprise edition

    "},{"location":"administration/parameters/#platform-announcement","title":"Platform Announcement","text":"

    This section gives you the possibility to set and display Announcements in the platform. Those announcements will be visible to every user in the platform, on top of the interface.

    They can be used to inform all your users' community of important information, like a scheduled downtime, an incoming upgrade, or even an important tips regarding the usage of the platform.

    An Announcement can be accompanied by a \u201cDismiss\u201d button. When click by a user, it makes the message disappear for this user.

    This option can be deactivated to have a permanent Announcement.

    \u26a0\ufe0f Only one Announcement is displayed at a time. Dismissible Announcement are displayed first, then the latest not dismissible Announcement.

    "},{"location":"administration/policies/","title":"Policies","text":""},{"location":"administration/policies/#platform-main-organization","title":"Platform main organization","text":"

    Allow to set a main organization for the entire platform.

    All the pieces of knowledge must be shared with the organization of the user wishing to access it or this user need to be inside the main organization.

    "},{"location":"administration/policies/#authentication-strategies","title":"Authentication Strategies","text":"

    There are several authentication strategies to connect to the platform.

    Please see the Authentication section for further details.

    "},{"location":"administration/policies/#local-password-policies","title":"Local Password Policies","text":"

    Allow to define the password policy according to several criteria in order to strengthen the security of your platform, namely: minimum/maximum number of characters, number of digits, etc.

    "},{"location":"administration/policies/#login-messages","title":"Login Messages","text":"

    Allow to define login, consent and consent confirm message to customize and highlight your platform's security policy

    "},{"location":"administration/policies/#platform-banner-configuration","title":"Platform Banner Configuration","text":"

    Allow OpenCTI deployments to have a custom banner message (top and bottom) and colored background for the message (Green, Red, or Yellow). Can be used to add a disclaimer or system purpose that will be displayed at the top and bottom of the OpenCTI instances pages.

    This configuration has two parameters:

    • Platform Banner Level - (Default: OFF) Options available for the banner background are Green, Red, and Yellow.
    • Platform Banner Text - (Default: Blank) If you turn on the banners, you should add a message to this area to be displayed within the banner.

    "},{"location":"administration/reasoning/","title":"Reasoning engine","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/retentions/","title":"Indicators lifecycle","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/segregation/","title":"Data segregation","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/sourcing/","title":"Sourcing knowledge","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/users/","title":"Users and Role Based Access Control","text":""},{"location":"administration/users/#introduction","title":"Introduction","text":"

    In OpenCTI, RBAC features are

    "},{"location":"administration/audit/configuration/","title":"Configuration","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    As explained in overview page, all administration actions are listen by default. However, all knowledge are not listened by default due to performance impact on the platform.

    For this reason you need to explicitly activate extended listening on user / group or organization.

    Listening will start just after the configuration. Every past events will not be taken into account.

    "},{"location":"administration/audit/events/","title":"Events","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    "},{"location":"administration/audit/events/#description","title":"Description","text":"

    OpenCTI activity capability is the way to unified whats really happen in the platform. In events section you will have access to the UI that will answer to \"who did what, where, and when?\" within your data with the maximum level of transparency.

    "},{"location":"administration/audit/events/#include-knowledge","title":"Include knowledge","text":"

    By default, the events screen only show you the administration actions done by the users.

    If you want to see also the information about the knowledge, you can simply activate the filter in the bar to get the complete overview of all user actions.

    Don't hesitate to read again the overview page to have a better understanding of the difference between Audit, Basic/Extended knowledge.

    "},{"location":"administration/audit/overview/","title":"Overview","text":""},{"location":"administration/audit/overview/#overview","title":"Overview","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    OpenCTI activity capability is the way to unified whats really happen in the platform. With this feature you will be able to answer \"who did what, where, and when?\" within your data with the maximum level of transparency. Enabling activity helps your security, auditing, and compliance entities monitor platform for possible vulnerabilities or external data misuse.

    "},{"location":"administration/audit/overview/#categories","title":"Categories","text":"

    The activity group 3 different concepts that need to be explains.

    "},{"location":"administration/audit/overview/#basic-knowledge","title":"Basic knowledge","text":"

    The basic knowledge refers to all stix data knowledge inside OpenCTI. Every create/update/delete actions on that knowledge is accessible through the history. That basic activity is handled by the history manager and can be also found directly on each entity.

    "},{"location":"administration/audit/overview/#extended-knowledge","title":"Extended knowledge","text":"

    The extended knowledge refers to extra information data to track specific user activity. As this kind of tracking is expensive, the tracking will only be done for specific user/group/organization explicitly configured.

    "},{"location":"administration/audit/overview/#audit-knowledge","title":"Audit knowledge","text":"

    Audit is focusing on user administration or security actions. Audit will produces console/logs files along with user interface elements.

    {\n\"auth\": \"<User information>\",\n\"category\": \"AUDIT\",\n\"level\": \"<info | error>\",\n\"message\": \"<human readable explanation>\",\n\"resource\": {\n\"type\": \"<authentication | mutation>\",\n\"event_scope\": \"<depends on type>\",\n\"event_access\": \"<administration>\",\n\"data\": \"<contextual data linked to the event type>\",\n\"version\": \"<version of audit log format>\"\n},\n\"timestamp\": \"<event date>\",\n\"version\": \"<platform version>\"\n}\n
    "},{"location":"administration/audit/overview/#architecture","title":"Architecture","text":"

    OpenCTI use different mechanisms to be able to publish actions (audit) or data modification (history)

    "},{"location":"administration/audit/overview/#audit-knowledge_1","title":"Audit knowledge","text":"

    Administration or security actions

    With Enterprise edition activated, Administration and security actions are always written; you can't configure, exclude, or disable them

    Supported

    Not supported for now

    Not applicable

    "},{"location":"administration/audit/overview/#ingestion","title":"Ingestion","text":"Create Delete Edit Remote OCTI Streams"},{"location":"administration/audit/overview/#data-sharing","title":"Data sharing","text":"Create Delete Edit CSV Feeds TAXII Feeds Stream Feeds"},{"location":"administration/audit/overview/#connectors","title":"Connectors","text":"Create Delete Edit Connectors State reset Works"},{"location":"administration/audit/overview/#parameters","title":"Parameters","text":"Create Delete Edit Platform parameters"},{"location":"administration/audit/overview/#security","title":"Security","text":"Create Delete Edit Roles Groups Users Sessions Policies"},{"location":"administration/audit/overview/#customization","title":"Customization","text":"Create Delete Edit Entity types Rules engine Retention policies"},{"location":"administration/audit/overview/#taxonomies","title":"Taxonomies","text":"Create Delete Edit Status templates Case templates + tasks"},{"location":"administration/audit/overview/#accesses","title":"Accesses","text":"Listen Login (success or fail) Logout Unauthorized access"},{"location":"administration/audit/overview/#extended-knowledge_1","title":"Extended knowledge","text":"

    Extended knowledge

    Extented knowledge activity are written only if you activate the feature for a subset of users / groups or organizations

    "},{"location":"administration/audit/overview/#data-management","title":"Data management","text":"

    Some history actions are already included in the \"basic knowledge\". (basic marker)

    Read Create Delete Edit Platform knowledge basic basic basic Background tasks Knowledge Knowledge files basic basic Global data import files Analyst workbenches files Triggers Workspaces Investigations User profile"},{"location":"administration/audit/overview/#user-actions","title":"User actions","text":"Supported Ask for file import Ask for data enrichment Ask for export generation Execute global search"},{"location":"administration/audit/triggers/","title":"Activity triggers","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    "},{"location":"administration/audit/triggers/#description","title":"Description","text":"

    Having all the history in the user interface (events) its sometimes not enough to have a proactive monitoring. For this reason you can configure some specific triggers to receive notifications on audit events. You can configure like personal triggers, lives one that will be sent directly or digest depending on your needs.

    "},{"location":"administration/audit/triggers/#configuration","title":"Configuration","text":"

    In this kind of trigger you will have to configure different options: - Notification target: User interface or email - Recipients: who will receive the notification - Filters: a set of filters to get only events that really interested you. (who is responsible for this event, kind of events, ...)

    "},{"location":"administration/audit/triggers/#event-structure","title":"Event structure","text":"

    In order to correctly configure the filters, here's a definition of the event structure

    • Event type: authentication

    • Event scopes: login and logout

    • Event type: read

      • Event scopes: read and unauthorized

    • Event type: file

      • Event scopes: read, create and delete

    • Event type: mutation

      • Event scopes: unauthorized, update, create and delete

    • Event type: command

      • Event scopes: search, enrich, import and export
    "},{"location":"deployment/authentication/","title":"Authentication","text":""},{"location":"deployment/authentication/#introduction","title":"Introduction","text":"

    OpenCTI supports several authentication providers. If you configure multiple strategies, they will be tested in the order you declared them.

    Activation

    You need to configure/activate only that you really want to propose to your users in term of authentication

    The product proposes two kind of authentication strategy:

    • Form (asking user for a user/password)
    • Buttons (click with authentication on an external system)
    "},{"location":"deployment/authentication/#supported-strategies","title":"Supported Strategies","text":"

    Under the hood we technically use the strategies provided by PassportJS. We integrate a subset of the strategies available with passport we if you need more we can theatrically integrate all the passport strategies.

    "},{"location":"deployment/authentication/#local-users-form","title":"Local users (form)","text":"

    This strategy used the OpenCTI database as user management.

    OpenCTI use this strategy as the default but its not the one we recommend for security reason.

    \"local\": {\n\"strategy\": \"LocalStrategy\",\n\"config\": {\n\"disabled\": false\n}\n}\n

    Production deployment

    Please use the LDAP/Auth0/OpenID/SAML strategy for production deployment.

    "},{"location":"deployment/authentication/#ldap-form","title":"LDAP (form)","text":"

    This strategy can be used to authenticate your user with your company LDAP and is based on Passport - LDAPAuth.

    \"ldap\": {\n\"strategy\": \"LdapStrategy\",\n\"config\": {\n\"url\": \"ldaps://mydc.domain.com:686\",\n\"bind_dn\": \"cn=Administrator,cn=Users,dc=mydomain,dc=com\",\n\"bind_credentials\": \"MY_STRONG_PASSWORD\",\n\"search_base\": \"cn=Users,dc=mydomain,dc=com\",\n\"search_filter\": \"(cn={{username}})\",\n\"mail_attribute\": \"mail\",\n// \"account_attribute\": \"givenName\",\n// \"firstname_attribute\": \"cn\",\n// \"lastname_attribute\": \"cn\",\n\"account_attrgroup_search_filteribute\": \"givenName\",\n\"allow_self_signed\": true\n}\n}\n

    If you would like to use LDAP groups to automatically associate LDAP groups and OpenCTI groups/organizations:

    \"ldap\": {\n\"config\": {\n...\n\"group_search_base\": \"cn=Groups,dc=mydomain,dc=com\",\n\"group_search_filter\": \"(member={{dn}})\",\n\"groups_management\": { // To map LDAP Groups to OpenCTI Groups\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"LDAP_Group_1:OpenCTI_Group_1\", \"LDAP_Group_2:OpenCTI_Group_2\", ...]\n},\n\"organizations_management\": { // To map LDAP Groups to OpenCTI Organizations\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"LDAP_Group_1:OpenCTI_Organization_1\", \"LDAP_Group_2:OpenCTI_Organization_2\", ...]\n}\n}\n}\n
    "},{"location":"deployment/authentication/#saml-button","title":"SAML (button)","text":"

    This strategy can be used to authenticate your user with your company SAML and is based on Passport - SAML.

    \"saml\": {\n\"identifier\": \"saml\",\n\"strategy\": \"SamlStrategy\",\n\"config\": {\n\"issuer\": \"mytestsaml\",\n// \"account_attribute\": \"nameID\",\n// \"firstname_attribute\": \"nameID\",\n// \"lastname_attribute\": \"nameID\",\n\"entry_point\": \"https://auth.mydomain.com/auth/realms/mydomain/protocol/saml\",\n\"saml_callback_url\": \"http://localhost:4000/auth/saml/callback\",\n// \"private_key\": \"MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwg...\",\n\"cert\": \"MIICmzCCAYMCBgF2Qt3X1zANBgkqhkiG9w0BAQsFADARMQ8w...\"\n}\n}\n

    For the SAML strategy to work:

    • The cert parameter is mandatory (PEM format) because it is used to validate the SAML response.
    • The private_key (PEM format) is optional and is only required if you want to sign the SAML client request.

    Certificates

    Be careful to put the cert / private_key key in PEM format. Indeed, a lot of systems generally export the the keys in X509 / PCKS12 formats and so you will need to convert them. Here is an example to extract PEM from PCKS12: 

    openssl pkcs12 -in keystore.p12 -out newfile.pem -nodes\n

    Here is an example of SAML configuration using environment variables:

    - PROVIDERS__SAML__STRATEGY=SamlStrategy - \"PROVIDERS__SAML__CONFIG__LABEL=Login with SAML\"\n- PROVIDERS__SAML__CONFIG__ISSUER=mydomain\n- PROVIDERS__SAML__CONFIG__ENTRY_POINT=https://auth.mydomain.com/auth/realms/mydomain/protocol/saml\n- PROVIDERS__SAML__CONFIG__SAML_CALLBACK_URL=http://opencti.mydomain.com/auth/saml/callback\n- PROVIDERS__SAML__CONFIG__CERT=MIICmzCCAYMCBgF3Rt3X1zANBgkqhkiG9w0BAQsFADARMQ8w\n

    OpenCTI support mapping SAML Roles/Groups on OpenCTI Groups. Here is an example:

    \"saml\": {\n\"config\": {\n...,\n// Groups mapping\n\"groups_management\": { // To map SAML Groups to OpenCTI Groups\n\"group_attributes\": [\"Group\"],\n\"groups_mapping\": [\"SAML_Group_1:OpenCTI_Group_1\", \"SAML_Group_2:OpenCTI_Group_2\", ...]\n},\n\"groups_management\": { // To map SAML Roles to OpenCTI Groups\n\"group_attributes\": [\"Role\"],\n\"groups_mapping\": [\"SAML_Role_1:OpenCTI_Group_1\", \"SAML_Role_2:OpenCTI_Group_2\", ...]\n},\n// Organizations mapping\n\"organizations_management\": { // To map SAML Groups to OpenCTI Organizations\n\"group_attributes\": [\"Group\"],\n\"groups_mapping\": [\"SAML_Group_1:OpenCTI_Organization_1\", \"SAML_Group_2:OpenCTI_Organization_2\", ...]\n},\n\"organizations_management\": { // To map SAML Roles to OpenCTI Organizations\n\"group_attributes\": [\"Role\"],\n\"groups_mapping\": [\"SAML_Role_1:OpenCTI_Organization_1\", \"SAML_Role_2:OpenCTI_Organization_2\", ...]\n}\n}\n}\n

    Here is an example of SAML Groups mapping configuration using environment variables:

    - \"PROVIDERS__SAML__CONFIG__GROUPS_MANAGEMENT__GROUPS_ATTRIBUTES=[\\\"Group\\\"]\"\n- \"PROVIDERS__SAML__CONFIG__GROUPS_MANAGEMENT__GROUPS_MAPPING=[\\\"SAML_Group_1:OpenCTI_Group_1\\\", \\\"SAML_Group_2:OpenCTI_Group_2\\\", ...]\"\n
    "},{"location":"deployment/authentication/#auth0-button","title":"Auth0 (button)","text":"

    This strategy allows to use Auth0 Service to handle the authentication and is based on Passport - Auth0.

    \"authzero\": {\n\"identifier\": \"auth0\",\n\"strategy\": \"Auth0Strategy\",\n\"config\": {\n\"clientID\": \"XXXXXXXXXXXXXXXXXX\",\n\"baseURL\": \"https://opencti.mydomain.com\",\n\"clientSecret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/auth0/callback\",\n\"domain\": \"mycompany.eu.auth0.com\",\n\"audience\": \"XXXXXXXXXXXXXXX\",\n\"scope\": \"openid email profile XXXXXXXXXXXXXXX\"\n}\n}\n

    Here is an example of Auth0 configuration using environment variables:

    - PROVIDERS__AUTHZERO__STRATEGY=Auth0Strategy\n- PROVIDERS__AUTHZERO__CONFIG__CLIENT_ID=${AUTH0_CLIENT_ID}\n- PROVIDERS__AUTHZERO__CONFIG__BASEURL=${AUTH0_BASE_URL}\n- PROVIDERS__AUTHZERO__CONFIG__CLIENT_SECRET=${AUTH0_CLIENT_SECRET}\n- PROVIDERS__AUTHZERO__CONFIG__CALLBACK_URL=${AUTH0_CALLBACK_URL}\n- PROVIDERS__AUTHZERO__CONFIG__DOMAIN=${AUTH0_DOMAIN}\n- PROVIDERS__AUTHZERO__CONFIG__SCOPE=\"openid email profile\"\n
    "},{"location":"deployment/authentication/#openid-connect-button","title":"OpenID Connect (button)","text":"

    This strategy allows to use the OpenID Connect Protocol to handle the authentication and is based on Node OpenID Client that is more powerful than the passport one.

    \"oic\": {\n\"identifier\": \"oic\",\n\"strategy\": \"OpenIDConnectStrategy\",\n\"config\": {\n\"label\": \"Login with OpenID\",\n\"issuer\": \"https://auth.mydomain.com/auth/realms/mydomain\",\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"redirect_uris\": [\"https://opencti.mydomain.com/auth/oic/callback\"]\n}\n}\n

    Here is an example of OpenID configuration using environment variables:

    - PROVIDERS__OPENID__STRATEGY=OpenIDConnectStrategy - \"PROVIDERS__OPENID__CONFIG__LABEL=Login with OpenID\"\n- PROVIDERS__OPENID__CONFIG__ISSUER=https://auth.mydomain.com/auth/realms/xxxx\n- PROVIDERS__OPENID__CONFIG__CLIENT_ID=XXXXXXXXXXXXXXXXXX\n- PROVIDERS__OPENID__CONFIG__CLIENT_SECRET=XXXXXXXXXXXXXXXXXX\n- \"PROVIDERS__OPENID__CONFIG__REDIRECT_URIS=[\\\"https://opencti.mydomain.com/auth/oic/callback\\\"]\"\n

    OpenCTI support mapping OpenID Roles/Groups on OpenCTI Groups (everything is tied to a group in the platform). Here is an example:

    \"oic\": {\n\"config\": {\n...,\n// Groups mapping\n\"groups_management\": { // To map OpenID Groups to OpenCTI Groups\n\"groups_scope\": \"groups\",\n\"groups_path\": [\"groups\", \"realm_access.groups\", \"resource_access.account.groups\"],\n\"groups_mapping\": [\"OpenID_Group_1:OpenCTI_Group_1\", \"OpenID_Group_2:OpenCTI_Group_2\", ...]\n},\n\"groups_management\": { // To map OpenID Roles to OpenCTI Groups\n\"groups_scope\": \"roles\",\n\"groups_path\": [\"roles\", \"realm_access.roles\", \"resource_access.account.roles\"],\n\"groups_mapping\": [\"OpenID_Role_1:OpenCTI_Group_1\", \"OpenID_Role_2:OpenCTI_Group_2\", ...]\n},\n// Organizations mapping  \n\"organizations_management\": { // To map OpenID Groups to OpenCTI Organizations\n\"organizations_scope\": \"groups\",\n\"organizations_path\": [\"groups\", \"realm_access.groups\", \"resource_access.account.groups\"],\n\"organizations_mapping\": [\"OpenID_Group_1:OpenCTI_Group_1\", \"OpenID_Group_2:OpenCTI_Group_2\", ...]\n},\n\"organizations_management\": { // To map OpenID Roles to OpenCTI Organizations\n\"organizations_scope\": \"roles\",\n\"organizations_path\": [\"roles\", \"realm_access.roles\", \"resource_access.account.roles\"],\n\"organizations_mapping\": [\"OpenID_Role_1:OpenCTI_Group_1\", \"OpenID_Role_2:OpenCTI_Group_2\", ...]\n},\n}\n}\n

    Here is an example of OpenID Groups mapping configuration using environment variables:

    - \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_SCOPE=groups\"\n- \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_PATH=[\\\"groups\\\", \\\"realm_access.groups\\\", \\\"resource_access.account.groups\\\"]\"\n- \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_MAPPING=[\\\"OpenID_Group_1:OpenCTI_Group_1\\\", \\\"OpenID_Group_2:OpenCTI_Group_2\\\", ...]\"\n
    "},{"location":"deployment/authentication/#facebook-button","title":"Facebook (button)","text":"

    This strategy can authenticate your users with Facebook and is based on Passport - Facebook

    \"facebook\": {\n\"identifier\": \"facebook\",\n\"strategy\": \"FacebookStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/facebook/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#google-button","title":"Google (button)","text":"

    This strategy can authenticate your users with Google and is based on Passport - Google

    \"google\": {\n\"identifier\": \"google\",\n\"strategy\": \"GoogleStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/google/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#github-button","title":"GitHub (button)","text":"

    This strategy can authenticate your users with GitHub and is based on Passport - GitHub

    \"github\": {\n\"identifier\": \"github\",\n\"strategy\": \"GithubStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/github/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#client-certificate-button","title":"Client certificate (button)","text":"

    This strategy can authenticate a user based on SSL client certificates. For this you need to configure your OCTI to start in HTTPS, for example:

    \"port\": 443,\n\"https_cert\": {\n\"key\": \"/cert/server_key.pem\",\n\"crt\": \"/cert/server_cert.pem\",\n\"reject_unauthorized\":true\n}\n

    And then add the ClientCertStrategy:

    \"cert\": {\n\"strategy\":\"ClientCertStrategy\",\n\"config\": {\n\"label\":\"CLIENT CERT\"\n}\n}\n

    Then when accessing for the first time OCTI, the browser will ask for the certificate you want to use.

    "},{"location":"deployment/authentication/#automatically-create-group-on-sso","title":"Automatically create group on SSO","text":"

    The variable auto_create_group can be added in the options of some strategies (LDAP, SAML and OpenID). If this variable is true, the groups of a user that logins will automatically be created if they don\u2019t exist.

    More precisely, if the user that tries to authenticate has groups that don\u2019t exist in OpenCTI but exist in the SSO configuration, there are two cases:

    • if auto_create_group= true in the SSO configuration: the groups are created at the platform initialization and the user will be mapped on them.
    • else: an error is raised.
    "},{"location":"deployment/authentication/#example","title":"Example","text":"

    We assum that Group1 exists in the platform, and newGroup doesn\u2019t exist. The user that tries to log in has the group newGroup. If auto_create_group = true in the SSO configuration, the group named newGroup will be created at the platform initialization and the user will be mapped on it. If auto_create_group = false or is undefined, the user can\u2019t login and an error is raised.

    \"groups_management\": {\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"SSO_GROUP_NAME1:group1\", \"SSO_GROUP_NAME_2:newGroup\", ...]\n},\n\"auto_create_group\": true\n
    "},{"location":"deployment/authentication/#examples","title":"Examples","text":""},{"location":"deployment/authentication/#ldap-then-fallback-to-local","title":"LDAP then fallback to local","text":"

    In this example the users have a login form and need to enter login and password. The authentication is done on LDAP first, then locally if user failed to authenticate and finally fail if none of them succeded. Here is an example for the production.json file:

    \"providers\": {\n\"ldap\": {\n\"strategy\": \"LdapStrategy\",\n\"config\": {\n\"url\": \"ldaps://mydc.mydomain.com:636\",\n\"bind_dn\": \"cn=Administrator,cn=Users,dc=mydomain,dc=com\",\n\"bind_credentials\": \"MY_STRONG_PASSWORD\",\n\"search_base\": \"cn=Users,dc=mydomain,dc=com\",\n\"search_filter\": \"(cn={{username}})\",\n\"mail_attribute\": \"mail\",\n\"account_attribute\": \"givenName\"\n}\n},\n\"local\": {\n\"strategy\": \"LocalStrategy\",\n\"config\": {\n\"disabled\": false\n}\n}\n}\n

    If you use a container deployment, here is an example using environment variables:

    - PROVIDERS__LDAP__STRATEGY=LdapStrategy\n- PROVIDERS__LDAP__CONFIG__URL=ldaps://mydc.mydomain.org:636\n- PROVIDERS__LDAP__CONFIG__BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=com\n- PROVIDERS__LDAP__CONFIG__BIND_CREDENTIALS=XXXXXXXXXX\n- PROVIDERS__LDAP__CONFIG__SEARCH_BASE=cn=Users,dc=mydomain,dc=com\n- PROVIDERS__LDAP__CONFIG__SEARCH_FILTER=(cn={{username}})\n- PROVIDERS__LDAP__CONFIG__MAIL_ATTRIBUTE=mail\n- PROVIDERS__LDAP__CONFIG__ACCOUNT_ATTRIBUTE=givenName\n- PROVIDERS__LDAP__CONFIG__ALLOW_SELF_SIGNED=true\n- PROVIDERS__LOCAL__STRATEGY=LocalStrategy\n
    "},{"location":"deployment/clustering/","title":"Clustering","text":""},{"location":"deployment/clustering/#introduction","title":"Introduction","text":"

    The OpenCTI platform technological stack has been designed to be able to scale horizontally. All dependencies such as Elastic or Redis can be deployed in cluster mode and performances can be drastically increased by deploying multiple platform and worker instances.

    "},{"location":"deployment/clustering/#high-level-architecture","title":"High level architecture","text":"

    Here is the high level architecture for customers and Filigran cloud platform to ensure both high availability and throughput.

    "},{"location":"deployment/clustering/#configuration","title":"Configuration","text":""},{"location":"deployment/clustering/#dependencies","title":"Dependencies","text":""},{"location":"deployment/clustering/#elasticsearch","title":"ElasticSearch","text":"

    In the ElasticSearch configuration of OpenCTI, it is possible to declare all nodes.

    - \"ELASTICSEARCH__URL=[\\\"https://user:pass@node1:9200\\\", \\\"https://user:pass@node2:9200\\\", ...]\"\n

    Compatibility

    OpenCTI is also compatible with OpenSearch and AWS / GCP / Azure native search services based on the ElasticSearch query language.

    "},{"location":"deployment/clustering/#redis","title":"Redis","text":"

    Redis should be turned to cluster mode:

    - REDIS__MODE=cluster\n- \"REDIS__HOSTNAMES=[\\\"node1:6379\\\", \\\"node2:6379\\\", ...]\"\n

    Compatibility

    OpenCTI is also compatible with ElastiCache, MemoryStore and AWS / GCP / Azure native services based on the Redis protocol.

    "},{"location":"deployment/clustering/#rabbitmq","title":"RabbitMQ","text":"

    For the RabbitMQ cluster, you will need a TCP load balancer on top of the nodes since the configuration does not support multi-nodes for now:

    - RABBITMQ__HOSTNAME=load-balancer-rabbitmq\n

    Compatibility

    OpenCTI is also compatible with Amazon MQ, CloudAMQP and AWS / GCP / Azure native services based on the AMQP protocol.

    "},{"location":"deployment/clustering/#s3-bucket-minio","title":"S3 bucket / MinIO","text":"

    MinIO is an open source server able to serve S3 buckets. It can be deployed in cluster mode and is compatible with several storage backend. OpenCTI is compatible with any tool following the S3 standard.

    "},{"location":"deployment/clustering/#platform","title":"Platform","text":"

    As showed on the schema, best practices for cluster mode and to avoid any congestion in the technological stack are:

    • Deploy platform(s) dedicated to end users and connectors registration
    • Deploy platform(s) dedicated to workers / ingestion process
      • We recommend 3 to 4 workers maxiumum by OpenCTI instance.
      • The ingestion platforms will never be accessed directly by end users.

    When enabling clustering, the number of nodes is displayed in Settings > Parameters.

    "},{"location":"deployment/clustering/#managers-and-schedulers","title":"Managers and schedulers","text":"

    Also, since some managers like the rule engine, the task manager and the notification manager can take some resources in the OpenCTI NodeJS process, it is highly recommended to disable them in the frontend cluster. OpenCTI automatically handle the distribution and the launching of the engines across all nodes in the cluster except where they are explicitely disabled in the configuration.

    "},{"location":"deployment/configuration/","title":"Configuration","text":"

    The purpose of this section is to learn how to configure OpenCTI to have it tailored for your production and development needs.

    Here are the configuration keys, for both containers (environment variables) and manual deployment.

    Parameters equivalence

    The equivalent of a config variable in environment variables is the usage of a double underscores (__) for a level of config.

    For example: 

    \"providers\": {\n\"ldap\": {\n\"strategy\": \"LdapStrategy\"\n}\n}\n

    will become: 

    PROVIDERS__LDAP__STRATEGY=LdapStrategy\n

    If you need to put a list of elements for the key, it must have a special formatting. Here is an example for redirect URIs for OpenID config: 

    \"PROVIDERS__OPENID__CONFIG__REDIRECT_URIS=[\\\"https://demo.opencti.io/auth/oic/callback\\\"]\"\n

    "},{"location":"deployment/configuration/#platform","title":"Platform","text":""},{"location":"deployment/configuration/#api-frontend","title":"API & Frontend","text":""},{"location":"deployment/configuration/#basic-parameters","title":"Basic parameters","text":"Parameter Environment variable Default value Description app:port APP__PORT 4000 Listen port of the application app:base_path APP__BASE_PATH Specific URI (ie. /opencti) app:base_url APP__BASE_URL http://localhost:4000 Full URL of the platform (should include the base_path if any) app:request_timeout APP__REQUEST_TIMEOUT 1200000 Request timeout, in ms (default 20 minutes) app:session_timeout APP__SESSION_TIMEOUT 1200000 Idle timeout, in ms (default 20 minutes) app:session_idle_timeout APP__SESSION_IDLE_TIMEOUT 0 Session timeout, in ms (default 0 minute - disabled) app:admin:email APP__ADMIN__EMAIL admin@opencti.io Default login email of the admin user app:admin:password APP__ADMIN__PASSWORD ChangeMe Default password of the admin user app:admin:token APP__ADMIN__TOKEN ChangeMe Default token (must be a valid UUIDv4)"},{"location":"deployment/configuration/#ssl-tls","title":"SSL / TLS","text":"Parameter Environment variable Default value Description app:https_cert:ca APP__HTTPS_CERT__CA Empty list [] Certificate authority paths or content, only if the client uses a self-signed certificate. app:https_cert:key APP__HTTPS_CERT__KEY Certificate key path or content app:https_cert:crt APP__HTTPS_CERT__CRT Certificate crt path or content app:https_cert:reject_unauthorized APP__HTTPS_CERT__REJECT_UNAUTHORIZED If not false, the server certificate is verified against the list of supplied CAs"},{"location":"deployment/configuration/#logging","title":"Logging","text":""},{"location":"deployment/configuration/#errors","title":"Errors","text":"Parameter Environment variable Default value Description app:app_logs:logs_level APP__APP_LOGS__LOGS_LEVEL info The application log level app:app_logs:logs_files APP__APP_LOGS__LOGS_FILES true If application logs is logged into files app:app_logs:logs_console APP__APP_LOGS__LOGS_CONSOLE true If application logs is logged to console (useful for containers) app:app_logs:logs_max_files APP__APP_LOGS__LOGS_MAX_FILES 7 Maximum number of daily files in logs app:app_logs:logs_directory APP__APP_LOGS__LOGS_DIRECTORY ./logs File logs directory"},{"location":"deployment/configuration/#audit","title":"Audit","text":"Parameter Environment variable Default value Description app:audit_logs:logs_files APP__AUDIT_LOGS__LOGS_FILES true If audit logs is logged into files app:audit_logs:logs_console APP__AUDIT_LOGS__LOGS_CONSOLE true If audit logs is logged to console (useful for containers) app:audit_logs:logs_max_files APP__AUDIT_LOGS__LOGS_MAX_FILES 7 Maximum number of daily files in logs app:audit_logs:logs_directory APP__AUDIT_LOGS__LOGS_DIRECTORY ./logs Audit logs directory"},{"location":"deployment/configuration/#maps-references","title":"Maps & references","text":"Parameter Environment variable Default value Description app:map_tile_server_dark APP__MAP_TILE_SERVER_DARK https://map.opencti.io/styles/luatix-dark/{z}/{x}/{y}.png The address of the OpenStreetMap provider with dark theme style app:map_tile_server_light APP__MAP_TILE_SERVER_LIGHT https://map.opencti.io/styles/luatix-light/{z}/{x}/{y}.png The address of the OpenStreetMap provider with light theme style app:reference_attachment APP__REFERENCE_ATTACHMENT false External reference mandatory attachment"},{"location":"deployment/configuration/#technical-customization","title":"Technical customization","text":"Parameter Environment variable Default value Description app:graphql:playground:enabled APP__GRAPHQL__PLAYGROUND__ENABLED true Enable the playground on /graphql app:graphql:playground:force_disabled_introspection APP__GRAPHQL_PLAYGROUND__FORCE_DISABLED_INTROSPECTION false Introspection is allowed to auth users but can be disabled in needed app:concurrency:retry_count APP__CONCURRENCY__RETRY_COUNT 200 Number of try to get the lock to work an element (create/update/merge, ...) app:concurrency:retry_delay APP__CONCURRENCY__RETRY_DELAY 100 Delay between 2 lock retry (in milliseconds) app:concurrency:retry_jitter APP__CONCURRENCY__RETRY_JITTER 50 Random jitter to prevent concurrent retry (in milliseconds) app:concurrency:max_ttl APP__CONCURRENCY__MAX_TTL 30000 Global maximum time for lock retry (in milliseconds)"},{"location":"deployment/configuration/#dependencies","title":"Dependencies","text":""},{"location":"deployment/configuration/#elasticsearch","title":"ElasticSearch","text":"Parameter Environment variable Default value Description elasticsearch:url ELASTICSEARCH__URL http://localhost:9200 URL(s) of the ElasticSearch (supports http://user:pass@localhost:9200 and list of URLs) elasticsearch:username ELASTICSEARCH__USERNAME Username can be put in the URL or with this parameter elasticsearch:password ELASTICSEARCH__PASSWORD Password can be put in the URL or with this parameter elasticsearch:index_prefix ELASTICSEARCH__INDEX_PREFIX opencti Prefix for the indices elasticsearch:ssl:reject_unauthorized ELASTICSEARCH__SSL__REJECT_UNAUTHORIZED true Enable TLS certificate check elasticsearch:ssl:ca ELASTICSEARCH__SSL__CA Custom certificate path or content elasticsearch:ssl:ca_plain (depecated) ELASTICSEARCH__SSL__CA_PLAIN @depecated, use ca directly"},{"location":"deployment/configuration/#redis","title":"Redis","text":"Parameter Environment variable Default value Description redis:mode REDIS__MODE single Connect to redis \"single\" or \"cluster\" redis:namespace REDIS__NAMESPACE Namespace (to use as prefix) redis:hostname REDIS__HOSTNAME localhost Hostname of the Redis Server redis:hostnames REDIS__HOSTNAMES Hostnames definition for Redis cluster mode: a list of host/port objects. redis:port REDIS__PORT 6379 Port of the Redis Server redis:use_ssl REDIS__USE_SSL false Is the Redis Server has TLS enabled redis:username REDIS__USERNAME Username of the Redis Server redis:password REDIS__PASSWORD Password of the Redis Server redis:ca REDIS__CA Path of the CA certificate redis:trimming REDIS__TRIMMING 2000000 Number of elements to maintain in the stream. (0 = unlimited)"},{"location":"deployment/configuration/#rabbitmq","title":"RabbitMQ","text":"Parameter Environment variable Default value Description rabbitmq:hostname RABBITMQ__HOSTNAME localhost Hostname of the RabbitMQ server rabbitmq:port RABBITMQ__PORT 5672 Port of the RabbitMQ server rabbitmq:port_management RABBITMQ__PORT_MANAGEMENT 15672 Port of the RabbitMQ Management Plugin rabbitmq:username RABBITMQ__USERNAME guest RabbitMQ user rabbitmq:password RABBITMQ__PASSWORD guest RabbitMQ password rabbitmq:queue_type RABBITMQ__QUEUE_TYPE \"classic\" RabbitMQ Queue Type (\"classic\" or \"quorum\") - - - - rabbitmq:use_ssl RABBITMQ__USE_SSL false Use TLS connection rabbitmq:use_ssl_cert RABBITMQ__USE_SSL_CERT Path or cert content rabbitmq:use_ssl_key RABBITMQ__USE_SSL_KEY Path or key content rabbitmq:use_ssl_pfx RABBITMQ__USE_SSL_PFX Path or pfx content rabbitmq:use_ssl_ca RABBITMQ__USE_SSL_CA Path or cacert content rabbitmq:use_ssl_passphrase RABBITMQ__SSL_PASSPHRASE Passphrase for the key certificate rabbitmq:use_ssl_reject_unauthorized RABBITMQ__SSL_REJECT_UNAUTHORIZED false Reject rabbit self signed certificate - - - - rabbitmq:management_ssl RABBITMQ__MANAGEMENT_SSL false Is the Management Plugin has TLS enabled rabbitmq:management_ssl_reject_unauthorized RABBITMQ__SSL_REJECT_UNAUTHORIZED true Reject management self signed certificate"},{"location":"deployment/configuration/#s3-bucket","title":"S3 Bucket","text":"Parameter Environment variable Default value Description minio:endpoint MINIO__ENDPOINT localhost Hostname of the S3 Service minio:port MINIO__PORT 9000 Port of the S3 Service minio:use_ssl MINIO__USE_SSL false Is the S3 Service has TLS enabled minio:access_key MINIO__ACCESS_KEY ChangeMe The S3 Service access key minio:secret_key MINIO__SECRET_KEY ChangeMe The S3 Service secret key minio:bucket_name MINIO__BUCKET_NAME opencti-bucket The S3 bucket name (useful to change if you use AWS) minio:bucket_region MINIO__BUCKET_REGION us-east-1 The S3 bucket region if you use AWS minio:use_aws_role MINIO__USE_AWS_ROLE false To use AWS role auto credentials"},{"location":"deployment/configuration/#smtp-service","title":"SMTP Service","text":"Parameter Environment variable Default value Description smtp:hostname SMTP__HOSTNAME SMTP Server hostname smtp:port SMTP__PORT 9000 SMTP Port (25 or 465 for TLS) smtp:use_ssl SMTP__USE_SSL false SMTP over TLS smtp:reject_unauthorized SMTP__REJECT_UNAUTHORIZED false Enable TLS certificate check smtp:username SMTP__USERNAME SMTP Username if authentication is needed smtp:password SMTP__PASSWORD SMTP Password if authentication is needed smtp:from_email SMTP__FROM_EMAIL notifications@opencti.io Sender email address"},{"location":"deployment/configuration/#schedules-engines","title":"Schedules & Engines","text":"Parameter Environment variable Default value Description rule_engine:enabled RULE_ENGINE__ENABLED true Enable/disable the rule engine rule_engine:lock_key RULE_ENGINE__LOCK_KEY rule_engine_lock Lock key of the engine in Redis - - - - history_manager:enabled HISTORY_MANAGER__ENABLED true Enable/disable the history manager history_manager:lock_key HISTORY_MANAGER__LOCK_KEY history_manager_lock Lock key for the manager in Redis - - - - task_scheduler:enabled TASK_SCHEDULER__ENABLED true Enable/disable the task scheduler task_scheduler:lock_key TASK_SCHEDULER__LOCK_KEY task_manager_lock Lock key for the scheduler in Redis task_scheduler:interval TASK_SCHEDULER__INTERVAL 10000 Interval to check new task to do (in ms) - - - - sync_manager:enabled SYNC_MANAGER__ENABLED true Enable/disable the sync manager sync_manager:lock_key SYNC_MANAGER__LOCK_KEY sync_manager_lock Lock key for the manager in Redis sync_manager:interval SYNC_MANAGER__INTERVAL 10000 Interval to check new sync feeds to consume (in ms) - - - - expiration_scheduler:enabled EXPIRATION_SCHEDULER__ENABLED true Enable/disable the scheduler expiration_scheduler:lock_key EXPIRATION_SCHEDULER__LOCK_KEY expired_manager_lock Lock key for the scheduler in Redis expiration_scheduler:interval EXPIRATION_SCHEDULER__INTERVAL 300000 Interval to check expired indicators - - - - retention_manager:enabled RETENTION_MANAGER__ENABLED true Enable/disable the manager retention_manager:lock_key RETENTION_MANAGER__LOCK_KEY retention_manager_lock Lock key for the manager in Redis retention_manager:interval RETENTION_MANAGER__INTERVAL 60000 Interval to check items to be deleted - - - - notification_manager:enabled NOTIFICATION_MANAGER__ENABLED true Enable/disable the notification manager notification_manager:lock_key NOTIFICATION_MANAGER__LOCK_KEY notification_manager_lock Lock key for the manager in Redis notification_manager:interval NOTIFICATION_MANAGER__INTERVAL 10000 Sender email address - - - - publisher_manager:enabled PUBLISHER_MANAGER__ENABLED true Enable/disable the publisher manager publisher_manager:lock_key PUBLISHER_MANAGER__LOCK_KEY publisher_manager_lock Sender email address publisher_manager:interval PUBLISHER_MANAGER__INTERVAL 10000 Sender email address

    Default file

    It is possible to check all default parameters implemented in the platform in the default.json file.

    "},{"location":"deployment/configuration/#worker-and-connector","title":"Worker and connector","text":"

    Can be configured manually using the configuration file config.yml or through environment variables.

    Parameter Environment variable Default value Description opencti:url OPENCTI_URL The URL of the OpenCTI platform opencti:token OPENCTI_TOKEN A token of an administrator account with bypass capability - - - - mq:use_ssl / / Depending of the API configuration (fetch from API) mq:use_ssl_ca MQ_USE_SSL_CA Path or cacert content mq:use_ssl_cert MQ_USE_SSL_CERT Path or cert content mq:use_ssl_key MQ_USE_SSL_KEY Path or key content mq:use_ssl_passphrase MQ_USE_SSL_PASSPHRASE Passphrase for the key certificate mq:use_ssl_reject_unauthorized MQ_USE_SSL_REJECT_UNAUTHORIZED false Reject rabbit self signed certificate"},{"location":"deployment/configuration/#worker-specific-configuration","title":"Worker specific configuration","text":"Parameter Environment variable Default value Description worker:log_level WORKER_LOG_LEVEL info The log level (error, warning, info or debug)"},{"location":"deployment/configuration/#connector-specific-configuration","title":"Connector specific configuration","text":"

    For specific connector configuration, you need to check each connector behavior.

    "},{"location":"deployment/configuration/#elasticsearch_1","title":"ElasticSearch","text":"

    If you want to adapt the memory consumption of ElasticSearch, you can use theses options:

    # Add the following environment variable:\n\"ES_JAVA_OPTS=-Xms8g -Xmx8g\"\n

    This can be done in configuration file in the jvm.conf file.

    "},{"location":"deployment/connectors/","title":"Connectors","text":""},{"location":"deployment/connectors/#introduction","title":"Introduction","text":"

    Connectors list

    You are looking for the available connectors? The list is in the OpenCTI Ecosystem.

    Connectors are the cornerstone of the OpenCTI platform and allow organizations to easily ingest, enrich or export data in the platform. According to their functionality and use case, they are categorized in following classes.

    "},{"location":"deployment/connectors/#import","title":"Import","text":"

    These connectors automatically retrieve information from an external organization, application or service, convert it to STIX 2.1 bundles and import it into OpenCTI using the workers.

    "},{"location":"deployment/connectors/#enrichment","title":"Enrichment","text":"

    When a new object is created in the platform or on the user request, it is possible to trigger the internal enrichment connector to lookup and/or search the object in external organizations, applications or services. If the object is found, the connectors will generate a STIX 2.1 bundle which will increase the level of knowledge about the concerned object.

    "},{"location":"deployment/connectors/#stream","title":"Stream","text":"

    These connectors connect to a platform data stream and continously do something with the received events. In most cases, they are used to consume OpenCTI data and insert them in third-party platforms such as SIEMs, XDRs, EDRS, etc. In some cases, stream connectors can also query the external system on a regular basis and act as import connector for instance to gather alerts and sightings related to CTI data and push them to OpenCTI (bi-directional).

    "},{"location":"deployment/connectors/#import-files","title":"Import files","text":"

    Information from an uploaded file can be extracted and ingested into OpenCTI. Examples are files attached to a report or a STIX 2.1 file.

    "},{"location":"deployment/connectors/#export-files","title":"Export files","text":"

    Information stored in OpenCTI can be extracted into different file formats like .csv or .json (STIX 2).

    "},{"location":"deployment/connectors/#connector-configuration","title":"Connector configuration","text":"

    All connectors have to be able to access to the OpenCTI API. To allow this connection, they have 2 mandatory configuration parameters, the OPENCTI_URL and the OPENCTI_TOKEN. In addition of these 2 parameters, connectors have other mandatory parameters that need to be set in order to get them work.

    Connectors tokens

    Be careful, we strongly recommend to use a dedicated token for each connector running in the platform. So you have to create a specific user for each of them.

    Also, if all connectors users can run in with a user belonging to the Connectors group (with the Connector role), the Internal Export Files should be run with a user who is Administrator (with bypass capability) because they imperstonate the user requesting the export to avoid data leak.

    Type Required role Used permissions EXTERNAL_IMPORT Connector Import data with the connector user. INTERNAL_ENRICHMENT Connector Enrich data with the connector user. INTERNAL_IMPORT_FILE Connector Import data with the connector user. INTERNAL_EXPORT_FILE Administrator Export data with the user who requested the export. STREAM Connector Consume the streams the connector user.

    Here is an example of a connector docker-compose.yml file: 

    - CONNECTOR_ID=ChangeMe\n- CONNECTOR_TYPE=EXTERNAL_IMPORT\n- CONNECTOR_NAME=MITRE ATT&CK\n- CONNECTOR_SCOPE=identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report\n- CONNECTOR_CONFIDENCE_LEVEL=3\n- CONNECTOR_UPDATE_EXISTING_DATA=true\n- CONNECTOR_LOG_LEVEL=info\n

    Here is an example in a connector config.yml file:

    -connector:\nid: 'ChangeMe'\ntype: 'EXTERNAL_IMPORT'\nname: 'MITRE ATT&CK'\nscope: 'identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report'\nconfidence_level: 3\nupdate_existing_data: true\nlog_level: 'info'\n
    "},{"location":"deployment/connectors/#networking","title":"Networking","text":"

    Be aware that all connectors are reaching RabbitMQ based the RabbitMQ configuration provided by the OpenCTI platform. The connector must be able to reach RabbitMQ on the specified hostname and port. If you have a specific Docker network configuration, please be sure to adapt your docker-compose.yml file in such way that the connector container gets attached to the OpenCTI Network, e.g.:

    networks:\ndefault:\nexternal: true\nname: opencti-docker_default\n
    "},{"location":"deployment/connectors/#connector-token","title":"Connector token","text":""},{"location":"deployment/connectors/#create-the-user","title":"Create the user","text":"

    As mentionned previously, it is strongly recommended to run each connector with its own user. The Internal Export File connectors should be launched with a user that belongs to a group which has an \u201cAdministrator\u201d role (with bypass all capabilities enabled).

    By default in platform, a group named \"Connectors\" already exists. So just create a new user with the name [C] Name of the connector in Settings > Security > Users.

    "},{"location":"deployment/connectors/#put-the-user-in-the-group","title":"Put the user in the group","text":"

    Just go to the user you have just created and add it to the Connectors group.

    Then just get the token of the user displayed in the interface.

    "},{"location":"deployment/connectors/#docker-activation","title":"Docker activation","text":"

    You can either directly run the Docker image of connectors or add them to your current docker-compose.yml file.

    "},{"location":"deployment/connectors/#add-a-connector-to-your-deployment","title":"Add a connector to your deployment","text":"

    For instance, to enable the MISP connector, you can add a new service to your docker-compose.yml file:

      connector-misp:\n    image: opencti/connector-misp:latest\n    environment:\n      - OPENCTI_URL=http://localhost\n      - OPENCTI_TOKEN=ChangeMe\n      - CONNECTOR_ID=ChangeMe\n      - CONNECTOR_TYPE=EXTERNAL_IMPORT\n      - CONNECTOR_NAME=MISP\n      - CONNECTOR_SCOPE=misp\n      - CONNECTOR_CONFIDENCE_LEVEL=3\n- CONNECTOR_UPDATE_EXISTING_DATA=false\n      - CONNECTOR_LOG_LEVEL=info\n      - MISP_URL=http://localhost # Required\n      - MISP_KEY=ChangeMe # Required\n      - MISP_SSL_VERIFY=False # Required\n      - MISP_CREATE_REPORTS=True # Required, create report for MISP event\n      - MISP_REPORT_CLASS=MISP event # Optional, report_class if creating report for event\n      - MISP_IMPORT_FROM_DATE=2000-01-01 # Optional, import all event from this date\n      - MISP_IMPORT_TAGS=opencti:import,type:osint # Optional, list of tags used for import events\n      - MISP_INTERVAL=1 # Required, in minutes\n    restart: always\n
    "},{"location":"deployment/connectors/#launch-a-standalone-connector","title":"Launch a standalone connector","text":"

    To launch standalone connector, you can use the docker-compose.yml file of the connector itself. Just download the latest release and start the connector:

    $ wget https://github.com/OpenCTI-Platform/connectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd connectors-{RELEASE_VERSION}/misp/\n

    Change the configuration in the docker-compose.yml according to the parameters of the platform and of the targeted service. Then launch the connector:

    $ docker-compose up\n
    "},{"location":"deployment/connectors/#manual-activation","title":"Manual activation","text":"

    If you want to manually launch connector, you just have to install Python 3 and pip3 for dependencies:

    $ apt install python3 python3-pip\n

    Download the release of the connectors:

    $ wget <https://github.com/OpenCTI-Platform/connectors/archive/{RELEASE_VERSION}.zip>\n$ unzip {RELEASE_VERSION}.zip\n$ cd connectors-{RELEASE_VERSION}/misp/src/\n

    Install dependencies and initialize the configuration:

    $ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n

    Change the config.yml content according to the parameters of the platform and of the targeted service and launch the connector:

    $ python3 misp.py\n
    "},{"location":"deployment/connectors/#connectors-status","title":"Connectors status","text":"

    The connector status can be displayed in the dedicated section of the platform available in Data > Connectors. You will be able to see the statistics of the RabbitMQ queue of the connector:

    Problem

    If you encounter problems deploying OpenCTI or connectors, you can consult the troubleshooting page page.

    "},{"location":"deployment/installation/","title":"Installation","text":"

    All components of OpenCTI are shipped both as Docker images and manual installation packages.

    Production deployment

    For production deployment, we recommend to deploy all components in containers, including dependencies, using native cloud services or orchestration systems such as Kubernetes.

    To have more details about deploying OpenCTI and its dependencies in cluster mode, please read the dedicated section.

    • Use Docker

      Deploy OpenCTI using Docker and the default docker-compose.yml provided in the docker.

      Setup

    • Manual installation

      Deploy dependencies and launch the platform manually using the packages released in the GitHub releases.

      Explore

    "},{"location":"deployment/installation/#using-docker","title":"Using Docker","text":""},{"location":"deployment/installation/#introduction","title":"Introduction","text":"

    OpenCTI can be deployed using the docker-compose command.

    "},{"location":"deployment/installation/#pre-requisites","title":"Pre-requisites","text":"

    Linux

    $ sudo apt install docker-compose\n

    Windows and MacOS

    Just download the appropriate Docker for Desktop version for your operating system.

    "},{"location":"deployment/installation/#clone-the-repository","title":"Clone the repository","text":"

    Docker helpers are available in the Docker GitHub repository.

    $ mkdir -p /path/to/your/app && cd /path/to/your/app\n$ git clone https://github.com/OpenCTI-Platform/docker.git\n$ cd docker\n
    "},{"location":"deployment/installation/#configure-the-environment","title":"Configure the environment","text":"

    Before running the docker-compose command, the docker-compose.yml file should be configured. By default, the docker-compose.yml file is using environment variables available in the file .env.sample.

    You can either rename the file .env.sample in .env and put the expected values or just fill directly the docker-compose.yml with the values corresponding to your environment.

    Configuration static parameters

    The complete list of available static parameters is available in the configuration section.

    Here is an example to quickly generate the .env file under Linux, especially all the default UUIDv4:

    $ sudo apt install -y jq\n$ cd ~/docker\n$ (cat << EOF\nOPENCTI_ADMIN_EMAIL=admin@opencti.io\nOPENCTI_ADMIN_PASSWORD=ChangeMePlease\nOPENCTI_ADMIN_TOKEN=$(cat /proc/sys/kernel/random/uuid)\nMINIO_ROOT_USER=$(cat /proc/sys/kernel/random/uuid)\nMINIO_ROOT_PASSWORD=$(cat /proc/sys/kernel/random/uuid)\nRABBITMQ_DEFAULT_USER=guest\nRABBITMQ_DEFAULT_PASS=guest\nELASTIC_MEMORY_SIZE=4G\nCONNECTOR_HISTORY_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_EXPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_EXPORT_FILE_CSV_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_IMPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_IMPORT_REPORT_ID=$(cat /proc/sys/kernel/random/uuid)\nEOF\n) > .env\n

    If your docker-compose deployment does not support .env files, just export all environment variables before launching the platform:

    $ export $(cat .env | grep -v \"#\" | xargs)\n
    "},{"location":"deployment/installation/#memory-management-settings","title":"Memory management settings","text":"

    As OpenCTI has a dependency on ElasticSearch, you have to set the vm.max_map_count before running the containers, as mentioned in the ElasticSearch documentation.

    $ sudo sysctl -w vm.max_map_count=1048575\n

    To make this parameter persistent, add the following to the end of your /etc/sysctl.conf:

    $ vm.max_map_count=1048575\n
    "},{"location":"deployment/installation/#persist-data","title":"Persist data","text":"

    The default for OpenCTI data is to be persistent.

    In the docker-compose.yml, you will find at the end the list of necessary persitent volumes for the dependencies:

    volumes:\nesdata:     # ElasticSearch data\ns3data:     # S3 bucket data\nredisdata:  # Redis data\namqpdata:   # RabbitMQ data\n
    "},{"location":"deployment/installation/#run-opencti","title":"Run OpenCTI","text":""},{"location":"deployment/installation/#using-single-node-docker","title":"Using single node Docker","text":"

    After changing your .env file run docker-compose in detached (-d) mode:

    $ sudo systemctl start docker.service\n# Run docker-compose in detached \n$ docker-compose up -d\n
    "},{"location":"deployment/installation/#using-docker-swarm","title":"Using Docker swarm","text":"

    In order to have the best experience with Docker, we recommend using the Docker stack feature. In this mode you will have the capacity to easily scale your deployment. 

    # If your virtual machine is not a part of a Swarm cluster, please use:\n$ docker swarm init\n

    Put your environment variables in /etc/environment:

    # If you already exported your variables to .env from above:\n$ sudo cat .env >> /etc/environment\n$ sudo bash -c 'cat .env >> /etc/environment\u2019\n$ sudo docker stack deploy --compose-file docker-compose.yml opencti\n

    Installation done

    You can now go to http://localhost:8080 and log in with the credentials configured in your environment variables.

    "},{"location":"deployment/installation/#manual-installation","title":"Manual installation","text":""},{"location":"deployment/installation/#prerequisites","title":"Prerequisites","text":""},{"location":"deployment/installation/#prepare-the-installation","title":"Prepare the installation","text":""},{"location":"deployment/installation/#installation-of-dependencies","title":"Installation of dependencies","text":"

    You have to install all the needed dependencies for the main application and the workers. The example below is for Debian-based systems:

    $ sudo apt-get install build-essential nodejs npm python3 python3-pip python3-dev\n
    "},{"location":"deployment/installation/#download-the-application-files","title":"Download the application files","text":"

    First, you have to download and extract the latest release file. Then select the version to install depending of your operating system:

    For Linux:

    • If your OS supports libc (Ubuntu, Debian, ...) you have to install the opencti-release_{RELEASE_VERSION}.tar.gz version.
    • If your OS uses musl (Alpine, ...) you have to install the opencti-release-{RELEASE_VERSION}_musl.tar.gz version.

    For Windows:

    We don't provide any Windows release for now. However it is still possible to check the code out, manually install the dependencies and build the software.

    $ mkdir /path/to/your/app && cd /path/to/your/app\n$ wget <https://github.com/OpenCTI-Platform/opencti/releases/download/{RELEASE_VERSION}/opencti-release-{RELEASE_VERSION}.tar.gz>\n$ tar xvfz opencti-release-{RELEASE_VERSION}.tar.gz\n
    "},{"location":"deployment/installation/#install-the-main-platform","title":"Install the main platform","text":""},{"location":"deployment/installation/#configure-the-application","title":"Configure the application","text":"

    The main application has just one JSON configuration file to change and a few Python modules to install

    $ cd opencti\n$ cp config/default.json config/production.json\n

    Change the config/production.json file according to your configuration of ElasticSearch, Redis, RabbitMQ and S3 bucket as well as default credentials (the ADMIN_TOKEN must be a valid UUID).

    "},{"location":"deployment/installation/#install-the-python-modules","title":"Install the Python modules","text":"
    $ cd src/python\n$ pip3 install -r requirements.txt\n$ cd ../..\n
    "},{"location":"deployment/installation/#start-the-application","title":"Start the application","text":"

    The application is just a NodeJS process, the creation of the database schema and the migration will be done at starting.

    $ yarn install\n$ yarn build\n$ yarn serv\n

    The default username and password are those you have put in the config/production.json file.

    "},{"location":"deployment/installation/#install-the-worker","title":"Install the worker","text":"

    The OpenCTI worker is used to write the data coming from the RabbitMQ messages broker.

    "},{"location":"deployment/installation/#configure-the-worker","title":"Configure the worker","text":"
    $ cd worker\n$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n

    Change the config.yml file according to your OpenCTI token.

    "},{"location":"deployment/installation/#start-as-many-workers-as-you-need","title":"Start as many workers as you need","text":"
    $ python3 worker.py &\n$ python3 worker.py &\n

    Installation done

    You can now go to http://localhost:4000 and log in with the credentials configured in your production.json file.

    "},{"location":"deployment/installation/#appendix","title":"Appendix","text":""},{"location":"deployment/installation/#community-contributions","title":"Community contributions","text":""},{"location":"deployment/installation/#terraform","title":"Terraform","text":"

    • Multi-clouds Terraform scripts

      This repository is here to provide you with a quick and easy way to deploy an OpenCTI instance in the cloud (AWS, Azure, or GCP).

      GitHub Respository

    • AWS Advanced Terraform scripts

      A Terraform deployment of OpenCTI designed to make use of native AWS Resources (where feasible). This includes AWS ECS Fargate, AWS OpenSearch, etc.

      GitHub Repository

    "},{"location":"deployment/installation/#helm-charts","title":"Helm Charts","text":"

    • Kubernetes Helm Charts

      OpenCTI Helm Charts (may be out of date) for Kubernetes with a global configuration file.

      GitHub Repository

    "},{"location":"deployment/installation/#deploy-behind-a-reverse-proxy","title":"Deploy behind a reverse proxy","text":"

    If you want to use OpenCTI behind a reverse proxy with a context path, like https://domain.com/opencti, please change the base_path static parameter.

    • APP__BASE_PATH=/opencti

    By default OpenCTI use websockets so don't forget to configure your proxy for this usage, an example with Nginx:

    location / {\nproxy_cache                 off;\nproxy_buffering             off;\nproxy_http_version          1.1;\nproxy_set_header Upgrade    $http_upgrade;\nproxy_set_header Connection \"upgrade\";\nproxy_set_header Host       $host;\nchunked_transfer_encoding   off;\nproxy_pass                  http://YOUR_UPSTREAM_BACKEND;\n}\n
    "},{"location":"deployment/installation/#additional-memory-information","title":"Additional memory information","text":""},{"location":"deployment/installation/#platform","title":"Platform","text":"

    OpenCTI platform is based on a NodeJS runtime, with a memory limit of 8GB by default. If you encounter OutOfMemory exceptions, this limit could be changed:

    - NODE_OPTIONS=--max-old-space-size=8096\n
    "},{"location":"deployment/installation/#workers-and-connectors","title":"Workers and connectors","text":"

    OpenCTI workers and connectors are Python processes. If you want to limit the memory of the process, we recommend to directly use Docker to do that. You can find more information in the official Docker documentation.

    "},{"location":"deployment/installation/#elasticsearch","title":"ElasticSearch","text":"

    ElasticSearch is also a JAVA process. In order to setup the JAVA memory allocation, you can use the environment variable ES_JAVA_OPTS. You can find more information in the official ElasticSearch documentation.

    "},{"location":"deployment/installation/#redis","title":"Redis","text":"

    Redis has a very small footprint on keys but will consume memory for the stream. By default the size of the stream is limited to 2 millions which represents a memory footprint around 8 GB. You can find more information in the Redis docker hub.

    "},{"location":"deployment/installation/#minio-s3-bucket","title":"MinIO / S3 Bucket","text":"

    MinIO is a small process and does not require a high amount of memory. More information are available for Linux here on the Kernel tuning guide.

    "},{"location":"deployment/installation/#rabbitmq","title":"RabbitMQ","text":"

    The RabbitMQ memory configuration can be find in the RabbitMQ official documentation. RabbitMQ will consumed memory until a specific threshold, therefore it should be configure along with the Docker memory limitation.

    "},{"location":"deployment/integrations/","title":"Integrations","text":""},{"location":"deployment/integrations/#introduction","title":"Introduction","text":"

    OpenCTI supports multiple ways to integrate with other systems which do not have native connectors or plugins to the platform. Here are the technical features available to ease the connection and the integration of the platform with other applications.

    Connectors list

    If you are looking to the list of OpenCTI connectors or native integration, please check the OpenCTI Ecosystem.

    "},{"location":"deployment/integrations/#native-feeds-and-streams","title":"Native feeds and streams","text":"

    To ease integrations with other products, OpenCTI has built-in capabilities to deliver the data to third-parties.

    "},{"location":"deployment/integrations/#csv-feeds","title":"CSV Feeds","text":"

    It is possible to create as many CSV feeds as needed, based on filters and accessible in HTTP. CSV feeds are available in Data > Data sharing > Feeds (CSV).

    When creating a CSV feed, you need to select one or multiple types of entity to make available. For all columns available in the CSV, you've to select which field will be used for each type of entity:

    Details

    For more information about CSV feeds, filters and configuration, please check the Export in structured format section.

    "},{"location":"deployment/integrations/#taxii-collections","title":"TAXII collections","text":"

    Most of the moden cybersecurity systems such as SIEMs, EDRs, XDRs and even firewalls supports the TAXII protocol which is basically a paginated HTTP STIX feed. OpenCTI implements a TAXII 2.1 server with the ability to create as many TAXII collections as needed in Data > Data sharing > TAXII Collections?

    TAXII collections are a sub-selection of the knowledge available in the platform and relie on filters. For instance, it is possible to create TAXII collections for pieces of malware with a given label, for indicators with a score greater than n, etc.

    "},{"location":"deployment/integrations/#http-streams","title":"HTTP Streams","text":"

    After implementing CSV feeds and TAXII collections, we figured out that those 2 stateless APIs are definitely not enough when it comes to tackle advanced information sharing challenges such as:

    • Real time transmission of the information (ie. avoid hundreds of systems to pull data every 5 minutes).
    • Dependencies resolution (ie. an intrusion created by an organization but the organization is not in the TAXII collection).
    • Partial update for huge entities such as report (ie. just having the update event).
    • Delete events when necessary (ie. to handle indicators expiration in third party systems for instance).

    Live streams are available in Data > Data sharing > Live streams. As TAXII collections, it is possible to create as many streams as needed using filters.

    Streams implement the HTTP SSE (Server-sent events) protocol and give applications to consume a real time pure STIX 2.1 stream. Stream connectors in the OpenCTI Ecosystem are using live streams to consume data and do something such as create / update / delete information in SIEMs, XDRs, etc.

    "},{"location":"deployment/integrations/#authentication","title":"Authentication","text":"

    For all previously explained capabilities, as they are over the HTTP protocol, 3 authentication mechanisms are available to consume them.

    1. Using a bearer header with your OpenCTI API key

      Authorization: Bearer a17bc103-8420-4208-bd53-e1f80845d15f\n

      API Key

      Your API key can be found in your profile available clicking on the top right icon.

    2. Using basic authentication

      Username: Your platform username\nPassword: Your plafrom password\nAuthorization: Basic c2FtdWVsLmhhc3NpbmVBZmlsaWdyYW4uaW86TG91aXNlMTMwNCM=\n

    3. Using client certificate authentication

      To know how to configure the client certificate authentication, please consult the authentication configuration section.

    "},{"location":"deployment/integrations/#api-and-libraries","title":"API and libraries","text":""},{"location":"deployment/integrations/#graphql-api","title":"GraphQL API","text":"

    To allow analysts and developers to implement more custom or complex use cases, a full GraphQL API is available in the application on the /graphql endpoint.

    The API can be queried using various GraphQL client such as Postman but you can leverage any HTTP client to forge GraphQL queries using POST methods.

    "},{"location":"deployment/integrations/#authentication_1","title":"Authentication","text":"

    The API authentication can be performed using the token of a user and a classic Authorization header:

    Content-Type: application/json\nAuthorization: Bearer 6b6554c4-bb2c-4c80-9cd3-30288c8bf424\n
    "},{"location":"deployment/integrations/#playground","title":"Playground","text":"

    The playground is available on the /graphql endpoint. A link button is also available in the profile of your user.

    All the schema documentation is directly available in the playground.

    If you already logged to OpenCTI with the same browser you should be able to directly do some requests. If you are not authenticated or want to authenticate only through the playground you can use a header configuration using your profile token

    Example of configuration (bottom left of the playground):

    "},{"location":"deployment/integrations/#python-library","title":"Python library","text":"

    Since not everyone is familiar with GraphQL APIs, we've developed a Python library to ease the interaction with it. The library is pretty easy to use. To initiate the client:

    # coding: utf-8\nfrom pycti import OpenCTIApiClient\n# Variables\napi_url = \"http://opencti:4000\"\napi_token = \"bfa014e0-e02e-4aa6-a42b-603b19dcf159\"\n# OpenCTI initialization\nopencti_api_client = OpenCTIApiClient(api_url, api_token)\n

    Then just use the available helpers: 

    # Search for malware with the keyword \"windows\"\nmalwares = opencti_api_client.malware.list(search=\"windows\")\n# Print\nprint(malwares)\n

    Details

    For more detailed information about the Python library, please read the dedicated section.

    "},{"location":"deployment/overview/","title":"Overview","text":"

    Before starting the installation, let's discover how OpenCTI is working, which dependencies are needed and what are the minimal requirements to deploy it in production.

    "},{"location":"deployment/overview/#architecture","title":"Architecture","text":"

    The OpenCTI platform relies on several external databases and services in order to work.

    "},{"location":"deployment/overview/#platform","title":"Platform","text":"

    The platform is the central part of the OpenCTI technological stack. It allows users to access to the user interface but also provides the GraphQL API used by connectors and workers to insert data. In the context of a production deployment, you may need to scale horizontally and launch multiple platforms behind a load balancer connected to the same databases (ElasticSearch, Redis, S3, RabbitMQ).

    "},{"location":"deployment/overview/#workers","title":"Workers","text":"

    The workers are standalone Python processes consuming messages from the RabbitMQ broker in order to do asynchronous write queries. You can launch as many workers as you need to increase the write performances. At some point, the write performances will be limited by the throughput of the ElasticSearch database cluster.

    Number of workers

    If you need to increase performances, it is better to launch more platforms to handle worker queries. The recommended setup is to have at least one platform for 3 workers (ie. 9 workers distributed over 3 platforms).

    "},{"location":"deployment/overview/#connectors","title":"Connectors","text":"

    The connectors are third-party pieces of software (Python processes) that can play five different roles on the platform:

    Type Description Examples EXTERNAL_IMPORT Pull data from remote sources, convert it to STIX2 and insert it on the OpenCTI platform. MITRE Datasets, MISP, CVE, AlienVault, Mandiant, etc. INTERNAL_ENRICHMENT Listen for new OpenCTI entities or users requests, pull data from remote sources to enrich. Shodan, DomainTools, IpInfo, etc. INTERNAL_IMPORT_FILE Extract data from files uploaded on OpenCTI trough the UI or the API. STIX 2.1, PDF, Text, HTML, etc. INTERNAL_EXPORT_FILE Generate export from OpenCTI data, based on a single object or a list. STIX 2.1, CSV, PDF, etc. STREAM Consume a platform data stream an do something with events. Splunk, Elastic Security, Q-Radar, etc.

    List of connectors

    You can find all currently available connector in the OpenCTI Ecosystem.

    "},{"location":"deployment/overview/#infrastructure-requirements","title":"Infrastructure requirements","text":""},{"location":"deployment/overview/#dependencies","title":"Dependencies","text":"Component CPU RAM Disk type Disk space ElasticSearch 2 cores \u2265 8GB SSD \u2265 16GB Redis 1 core \u2265 1GB SSD \u2265 16GB RabbitMQ 1 core \u2265 512MB Standard \u2265 2GB S3 / MinIO 1 core \u2265 128MB SSD \u2265 16GB"},{"location":"deployment/overview/#platform_1","title":"Platform","text":"Component CPU RAM Disk type Disk space OpenCTI Core 2 cores \u2265 8GB None (stateless) - Worker(s) 1 core \u2265 128MB None (stateless) - Connector(s) 1 core \u2265 128MB None (stateless) -

    Clustering

    To have more details about deploying OpenCTI and its dependencies in cluster mode, please read the dedicated section.

    "},{"location":"deployment/resources/","title":"Other resources","text":""},{"location":"deployment/resources/#introduction","title":"Introduction","text":"

    OpenCTI is an open and modular platform. A lot of connectors, plugins and clients are created by Filigran and community. You can find here other resources available to complete your OpenCTI journey.

    "},{"location":"deployment/resources/#videos-training","title":"Videos & training","text":"

    • YouTube channel

      Watch demonstration videos, use case explanations, customers and community testimonies and past webinars.

      Watch

    • Training courses

      Empower your journey with OpenCTI training courses for both analyst and administrators and get your certifcate.

      Learn

    "},{"location":"deployment/resources/#articles-news","title":"Articles & news","text":"

    • Blog articles

      Read posts written by both Filigran teams and community members about OpenCTI features and use cases.

      Read

    • Newsletters

      Subscribe to Filigran newsletters to get informed about the latest evolutions of our product ecosystems.

      Subscribe

    "},{"location":"deployment/resources/#analysis","title":"Analysis","text":"

    • Verticalized threat landcapes

      Access to monthly sectorial analysis from our experts team based on knowledge and data collected by our partners.

      Consult

    • Case studies

      Explore the Filigran case studies about stories and usages of the platform among our communities and customers.

      Download

    "},{"location":"deployment/rollover/","title":"Indices and rollover policies","text":""},{"location":"deployment/rollover/#introduction","title":"Introduction","text":"

    ElasticSearch and OpenSearch both support rollover on indices. OpenCTI has been designed to be able to use aliases for indices and so support very well index lifeycle policies.

    Thus, by default OpenCTI initialized indices with a suffix -00001 and use wildcard to query indices. When rollover policies are implemented, indices are splitted to keep a reasonable volume of data in shards.

    "},{"location":"deployment/rollover/#elasticsearch-configuration","title":"ElasticSearch configuration","text":""},{"location":"deployment/rollover/#indices","title":"Indices","text":"

    We advise to put a rollover policy on all indices used by OpenCTI, here is the list:

    • opencti_history
    • opencti_inferred_entities
    • opencti_inferred_relationships
    • opencti_internal_objects
    • opencti_internal_relationships
    • opencti_stix_core_relationships
    • opencti_stix_cyber_observable_relationships
    • opencti_stix_cyber_observables
    • opencti_stix_domain_objects
    • opencti_stix_meta_objects
    • opencti_stix_meta_relationships

    For your information, the indices which can grow rapidly are:

    • Index opencti_stix_meta_relationships: it contains all the nested relationships between objects and labels / marking definitions / external references / authors, etc.
    • Index opencti_history: it contains the history log of all objects in the platform.
    • Index opencti_stix_cyber_observables: it contains all observables stored in the platform.
    • Index opencti_stix_core_relationships: it contains all main STIX relationships stored in the platform.
    "},{"location":"deployment/rollover/#licecycle-policy","title":"Licecycle policy","text":"

    Here is n example of policy:

    • Maximum primary shard size: 50 GB
    • Maximum docs in the primary shard: 25,000,000
    • Maximum age: 365 days
    • Maximum documents: 50,000,000

    Then, apply this policy automatically to all opencti_* indices.

    Rollover documentation

    To have more details about automatic rollover and lifecycle policies, please read the official ElasticSearch documentation.

    "},{"location":"deployment/troubleshooting/","title":"Troubleshooting","text":"

    This page aims to explains the typical errors you can have with your OpenCTI platform.

    "},{"location":"deployment/troubleshooting/#finding-the-relevant-logs","title":"Finding the relevant logs","text":"

    It is highly recommended to monitor the error logs of the platforms, workers and connectors. All the components have log outputs in an understandable JSON format. It necessary, it is always possible to increase the log level. In production, it is recommended to have the log level set to error.

    "},{"location":"deployment/troubleshooting/#platform","title":"Platform","text":"

    Here are some useful parameters for platform logging:

    - APP__APP_LOGS__LOGS_LEVEL=[error|warning|info|debug]\n- APP__APP_LOGS__LOGS_CONSOLE=true # Output in the container console\n
    "},{"location":"deployment/troubleshooting/#connectors","title":"Connectors","text":"

    All connectors support the same set of parameters to manage the log level and outputs:

    - OPENCTI_JSON_LOGGING=true # Enable / disable JSON logging\n- CONNECTOR_LOG_LEVEL=info=[error|warning|info|debug]\n
    "},{"location":"deployment/troubleshooting/#workers","title":"Workers","text":"

    The workers can have more or less verbose outputs:

    - OPENCTI_JSON_LOGGING=true # Enable / disable JSON logging\n- WORKER_LOG_LEVEL=[error|warning|info|debug]\n
    "},{"location":"deployment/troubleshooting/#common-errors","title":"Common errors","text":""},{"location":"deployment/troubleshooting/#ingestion-technical-errors","title":"Ingestion technical errors","text":"

    Missing reference to handle creation

    After 5 retries, if an element required to create another element is missing, the platform raises an exception. It usually comes from a connector that generates inconsistent STIX 2.1 bundles.

    Cant upsert entity. Too many entities resolved

    OpenCTI received an entity which is matching too many other entities in the platform. In this condition we cannot take a decision. We need to dig into the data bundle to identify why he match too much entities and fix the data in the bundle / or the platform according to what you expect.

    Execution timeout, too many concurrent call on the same entities

    The platform supports multi workers and multiple parallel creation but different parameters can lead to some locking timeout in the execution.

    • Throughput capacity of your ElasticSearch
    • Number of workers started at the same time
    • Dependencies between data
    • Merging capacity of OpenCTI

    If you have this kind of error, limit the number of workers deployed. Try to find the right balance of the number of workers, connectors and elasticsearch sizing.

    "},{"location":"deployment/troubleshooting/#ingestion-functional-errors","title":"Ingestion functional errors","text":"

    Indicator of type yara is not correctly formatted

    OpenCTI check the validity of the indicator rule.

    Observable of type IPv4-Addr is not correctly formatted

    OpenCTI check the validity of the oversable value.

    "},{"location":"deployment/troubleshooting/#dependencies-errors","title":"Dependencies errors","text":"

    TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark...

    Disk full, no space left on the device for ElasticSearch.

    "},{"location":"deployment/upgrade/","title":"Upgrade","text":"

    Depending on your installation mode, upgrade path may change.

    Migrations

    The platform is taking care of all necessary underlying migrations in the databases if any, you can upgrade OpenCTI from any version to the latest one, including skipping multiple major releases.

    "},{"location":"deployment/upgrade/#using-docker","title":"Using Docker","text":"

    Before applying this procedure, please update your docker-compose.yml file with the new version number of container images.

    "},{"location":"deployment/upgrade/#for-single-node-docker","title":"For single node Docker","text":"
    $ sudo docker-compose stop\n$ sudo docker-compose pull\n$ sudo docker-compose up -d\n
    "},{"location":"deployment/upgrade/#for-docker-swarm","title":"For Docker swarm","text":"

    For each of services, you have to run the following command:

    $ sudo docker service update --force service_name\n
    "},{"location":"deployment/upgrade/#manual-installation","title":"Manual installation","text":"

    When upgrading the platform, you have to replace all files and restart the platform, the database migrations will be done automatically:

    $ yarn serv\n
    "},{"location":"development/api-usage/","title":"GraphQL API and playground","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"development/connectors/","title":"Connector development","text":""},{"location":"development/connectors/#introduction","title":"Introduction","text":"

    A connector in OpenCTI is a service that runs next to the platform and can be implemented in almost any programming language that has STIX2 support. Connectors are used to extend the functionality of OpenCTI and allow operators to shift some of the processing workload to external services. To use the conveniently provided OpenCTI connector SDK you need to use Python3 at the moment.

    We choose to have a very decentralized approach on connectors, in order to bring a maximum freedom to developers and vendors. So a connector on OpenCTI can be defined by a standalone Python 3 process that pushes an understandable format of data to an ingestion queue of messages.

    Each connector must implement a long-running process that can be launched just by executing the main Python file. The only mandatory dependency is the OpenCTIConnectorHelper class that enables the connector to send data to OpenCTI.

    "},{"location":"development/connectors/#getting-started","title":"Getting started","text":"

    In the beginning first think about your use-case to choose and appropriate connector type - what do want to achieve with your connector? The following table gives you an overview of the current connector types and some typical use-cases:

    Connector types

    Type Typical use cases Example connector EXTERNAL_IMPORT Integrate external TI provider, Integrate external TI platform AlienVault INTERNAL_ENRICHMENT Enhance existing data with additional knowledge AbuseIP INTERNAL_IMPORT_FILE (Bulk) import knowledge from files Import document INTERNAL_EXPORT_FILE (Bulk) export knowledge to files STIX 2.1, CSV. STREAM Integrate external TI provider, Integrate external TI platform Elastic Security

    After you've selected your connector type make yourself familiar with STIX2 and the supported relationships in OpenCTI. Having some knowledge about the internal data models with help you a lot with the implementation of your idea.

    "},{"location":"development/connectors/#preparation","title":"Preparation","text":""},{"location":"development/connectors/#environment-setup","title":"Environment Setup","text":"

    To develop and test your connector, you need a running OpenCTI instance with the frontend and the messaging broker accessible. If you don't plan on developing anything for the OpenCTI platform or the frontend, the easiest setup for the connector development is using the docker setup, For more details see here.

    "},{"location":"development/connectors/#coding-setup","title":"Coding Setup","text":"

    To give you an easy starting point we prepared an example connector in the public repository you can use as template to bootstrap your development.

    Some prerequisites we recommend to follow this tutorial:

    • Code editor with good Python3 support (e.g. Visual Studio Code with the Python extension pack)
    • Python3 + setuptools is installed and configured
    • Command shell (either Linux/Mac terminal or WSL on Windows)

    In the terminal check out the connectors repository and copy the template connector to $myconnector (replace it with your name throughout the following text examples).

    $ pip3 install black flake8 pycti\n# Fork the current repository, then clone your fork\n$ git clone https://github.com/YOUR-USERNAME/connectors.git\n$ cd connectors\n$ git remote add upstream https://github.com/OpenCTI-Platform/connectors.git\n# Create a branch for your feature/fix\n$ git checkout -b [branch-name]\n$ cp -r template $connector_type/$myconnector\n$ cd $connector_type/$myconnector\n$ tree .\n.\n\u251c\u2500\u2500 docker-compose.yml\n\u251c\u2500\u2500 Dockerfile\n\u251c\u2500\u2500 entrypoint.sh\n\u251c\u2500\u2500 README.md\n\u2514\u2500\u2500 src\n    \u251c\u2500\u2500 config.yml.sample\n    \u251c\u2500\u2500 main.py\n    \u2514\u2500\u2500 requirements.txt\n\n1 directory, 7 files\n
    "},{"location":"development/connectors/#changing-the-template","title":"Changing the template","text":"

    There are a few files in the template we need to change for our connector to be unique. You can check for all places you need to change you connector name with the following command (the output will look similar):

    $ grep -Ri template .\n\nREADME.md:# OpenCTI Template Connector\nREADME.md:| `connector_type`                     | `CONNECTOR_TYPE`                    | Yes          | Must be `Template_Type` (this is the connector type).                                                                                                      |\nREADME.md:| `connector_name`                     | `CONNECTOR_NAME`                    | Yes          | Option `Template`                                                                                                                                          |\nREADME.md:| `connector_scope`                    | `CONNECTOR_SCOPE`                   | Yes          | Supported scope: Template Scope (MIME Type or Stix Object)                                                                                                 |\nREADME.md:| `template_attribute`                 | `TEMPLATE_ATTRIBUTE`                | Yes          | Additional setting for the connector itself                                                                                                                |\ndocker-compose.yml:  connector-template:\ndocker-compose.yml:    image: opencti/connector-template:4.5.5\ndocker-compose.yml:      - CONNECTOR_TYPE=Template_Type\ndocker-compose.yml:      - CONNECTOR_NAME=Template\ndocker-compose.yml:      - CONNECTOR_SCOPE=Template_Scope # MIME type or Stix Object\nentrypoint.sh:cd /opt/opencti-connector-template\nDockerfile:COPY src /opt/opencti-template\nDockerfile:    cd /opt/opencti-connector-template && \\\nsrc/main.py:class Template:\nsrc/main.py:            \"TEMPLATE_ATTRIBUTE\", [\"template\", \"attribute\"], config, True\nsrc/main.py:        connectorTemplate = Template()\nsrc/main.py:        connectorTemplate.run()\nsrc/config.yml.sample:  type: 'Template_Type'\nsrc/config.yml.sample:  name: 'Template'\nsrc/config.yml.sample:  scope: 'Template_Scope' # MIME type or SCO\n

    Required changes:

    • Change Template or templatementions to your connector name e.g. ImportCsv or importcsv
    • Change TEMPLATE mentions to your connector name e.g. IMPORTCSV
    • Change Template_Scope mentions to the required scope of your connector. For processing imported files, that can be the Mime type e.g. application/pdf or for enriching existing information in OpenCTI, define the STIX object's name e.g. Report. Multiple scopes can be separated by a simple ,
    • Change Template_Type to the connector type you wish to develop. The OpenCTI types (OpenCTI flags) are defined in this table.
    "},{"location":"development/connectors/#development","title":"Development","text":""},{"location":"development/connectors/#initialize-the-opencti-connector-helper","title":"Initialize the OpenCTI connector helper","text":"

    After getting the configuration parameters of your connector, you have to initialize the OpenCTI connector helper by using the pycti Python library. This is shown in the following example:

    class TemplateConnector:\ndef __init__(self):\n# Instantiate the connector helper from config\nconfig_file_path = os.path.dirname(os.path.abspath(__file__)) + \"/config.yml\"\nconfig = (\nyaml.load(open(config_file_path), Loader=yaml.SafeLoader)\nif os.path.isfile(config_file_path)\nelse {}\n)\nself.helper = OpenCTIConnectorHelper(config)\nself.custom_attribute = get_config_variable(\n\"TEMPLATE_ATTRIBUTE\", [\"template\", \"attribute\"], config\n)\n

    Since there are some basic differences in the tasks of the different connector classes, the structure is also a bit class dependent. While the external-import and the stream connector run independently in a regular interval or constantly, the other 3 connector classes only run when being requested by the OpenCTI platform.

    The self-triggered connectors run independently, but the OpenCTI need to define a callback function, which can be executed for the connector to start its work. This is done via self.helper.listen(self._process_message) . In the appended examples, the difference of the setup can be seen.

    Self-triggered Connectors

    • external-import
    • stream

    OpenCTI triggered

    • internal-enrichment
    • internal-import
    • internal-export
    from pycti import OpenCTIConnectorHelper, get_config_variable\nclass TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\nself.template_interval = get_config_variable(\n\"TEMPLATE_INTERVAL\", [\"template\", \"interval\"], config, True\n)\ndef get_interval(self) -> int:\nreturn int(self.template_interval) * 60 * 60 * 24\ndef run(self) -> None:\n# Main procedure\nif __name__ == \"__main__\":\ntry:\ntemplate_connector = TemplateConnector()\ntemplate_connector.run()\nexcept Exception as e:\nprint(e)\ntime.sleep(10)\nexit(0)\n
    from pycti import OpenCTIConnectorHelper, get_config_variable\nclass TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\ndef _process_message(self, data: dict) -> str:\n# Main procedure                \n# Start the main loop\ndef start(self) -> None:\nself.helper.listen(self._process_message)\nif __name__ == \"__main__\":\ntry:\ntemplate_connector = TemplateConnector()\ntemplate_connector.start()\nexcept Exception as e:\nprint(e)\ntime.sleep(10)\nexit(0)\n
    "},{"location":"development/connectors/#write-and-read-operations","title":"Write and Read Operations","text":"

    When using the OpenCTIConnectorHelper class, there are two way for reading from or writing data to the OpenCTI platform.

    1. via the OpenCTI API interface via self.helper.api
    2. via the OpenCTI worker via self.send_stix2_bundle
    "},{"location":"development/connectors/#sending-data-to-the-opencti-platform","title":"Sending data to the OpenCTI platform","text":"

    The recommended way for creating or updating data in the OpenCTI platform is via the OpenCTI worker. This enables the connector to just send and forget about thousands of entities at once to without having to think about the ingestion order, performance or error handling.

    \u26a0\ufe0f **Please DO NOT use the api interface to create new objects in connectors.**

    The OpenCTI connector helper method send_stix2_bundle must be used to send data to OpenCTI. The send_stix2_bundle function takes 2 arguments.

    1. A serialized STIX2 bundle as a string (mandatory)
    2. A list of entities types that should be ingested (optional)

    Here is an example using the STIX2 Python library:

    from stix2 import Bundle, AttackPattern\n[...]\nattack_pattern = AttackPattern(name='Evil Pattern')\nbundle_objects = []\nbundle_objects.append(attack_pattern)\nbundle = Bundle(objects=bundle_objects).serialize()\nbundles_sent = self.opencti_connector_helper.send_stix2_bundle(bundle)\n
    "},{"location":"development/connectors/#reading-from-the-opencti-platform","title":"Reading from the OpenCTI platform","text":"

    Read queries to the OpenCTI platform can be achieved using the API and the STIX IDs can be attached to reports to create the relationship between those two entities.

    entity = self.helper.api.vulnerability.read(\nfilters={\"key\": \"name\", \"values\": [\"T1234\"]}\n)\n

    If you want to add the found entity via objects_refs to another SDO, simple add a list of stix_ids to the SDO. Here's an example using the entity from the code snippet above:

    from stix2 import Report\n[...]\nreport = Report(\nid=report[\"standard_id\"],\nobject_refs=[entity[\"standard_id\"]],\n)\n
    "},{"location":"development/connectors/#logging","title":"Logging","text":"

    When something crashes at a user's, you as a developer want to know as much as possible about this incident to easily improve your code and remove this issue. To do so, it is very helpful if your connector documents what it does. Use info messages for big changes like the beginning or the finishing of an operation, but to facilitate your bug removal attempts, implement debug messages for minor operation changes to document different steps in your code.

    When encountering a crash, the connector's user can easily restart the troubling connector with the debug logging activated.

    • CONNECTOR_LOG_LEVEL=debug

    Using those additional log messages, the bug report is more enriched with information about the possible cause of the problem. Here's an example of how the logging should be implemented:

            def run(self) -> None:\nself.helper.log_info('Template connector starts')\nresults = self._ask_for_news()\n[...]\ndef _ask_for_news() -> None:\noverall = []\nfor i in range(0, 10):\nself.log_debug(f\"Asking about news with count '{i}'\")\n# Do something\nself.log_debug(f\"Resut: '{result}'\")\noverall.append(result)\nreturn overall\n

    Please make sure that the debug messages rich of useful information, but that they are not redundant and that the user is not drowned by unnecessary information.

    "},{"location":"development/connectors/#additional-implementations","title":"Additional implementations","text":"

    If you are still unsure about how to implement certain things in your connector, we advise you to have a look at the code of other connectors of the same type. Maybe they are already using approach which is suitable for addressing to your problem.

    "},{"location":"development/connectors/#opencti-triggered-connector-special-cases","title":"OpenCTI triggered Connector - Special cases","text":""},{"location":"development/connectors/#data-layout-of-dictionary-from-callback-function","title":"Data Layout of Dictionary from Callback function","text":"

    OpenCTI sends the connector a few instructions via the data dictionary in the callback function. Depending on the connector type, the data dictionary content is a bit different. Here are a few examples for each connector type.

    Internal Import Connector

    Internal Enrichment Connector

    { \"file_id\": \"<fileId>\",\n\"file_mime\": \"application/pdf\", \"file_fetch\": \"storage/get/<file_id>\", // Path to get the file\n\"entity_id\": \"report--82843863-6301-59da-b783-fe98249b464e\", // Context of the upload\n}\n
    { \"entity_id\": \"<stixCoreObjectId>\" // StixID of the object wanting to be enriched\n}\n

    Internal Export Connector

    { \"export_scope\": \"single\", // 'single' or 'list'\n\"export_type\": \"simple\", // 'simple' or 'full'\n\"file_name\": \"<fileName>\", // Export expected file name\n\"max_marking\": \"<maxMarkingId>\", // Max marking id\n\"entity_type\": \"AttackPattern\", // Exported entity type\n// ONLY for single entity export\n\"entity_id\": \"<entity.id>\", // Exported element\n// ONLY for list entity export\n\"list_params\": \"[<parameters>]\" // Parameters for finding entities\n}\n
    "},{"location":"development/connectors/#self-triggered-connector-special-cases","title":"Self triggered Connector - Special cases","text":""},{"location":"development/connectors/#initiating-a-work-before-pushing-data","title":"Initiating a 'Work' before pushing data","text":"

    For self-triggered connectors, OpenCTI has to be told about new jobs to process and to import. This is done by registering a so called work before sending the stix bundle and signalling the end of a work. Here an example:

    By implementing the work registration, they will show up as shown in this screenshot for the MITRE ATT&CK connector:

    def run() -> None:\n# Anounce upcoming work\ntimestamp = int(time.time())\nnow = datetime.utcfromtimestamp(timestamp)\nfriendly_name = \"Template run @ \" + now.strftime(\"%Y-%m-%d %H:%M:%S\")\nwork_id = self.helper.api.work.initiate_work(\nself.helper.connect_id, friendly_name\n)\n[...]\n# Send Stix bundle\nself.helper.send_stix2_bundle(\nbundle,\nentities_types=self.helper.connect_scope,\nupdate=True,\nwork_id=work_id,\n)\n# Finish the work\nself.helper.log_info(\nf\"Connector successfully run, storing last_run as {str(timestamp)}\"\n)              \nmessage = \"Last_run stored, next run in: {str(round(self.get_interval() / 60 / 60 / 24, 2))} days\"\nself.helper.api.work.to_processed(work_id, message)\n
    "},{"location":"development/connectors/#interval-handling","title":"Interval handling","text":"

    The connector is also responsible for making sure that it runs in certain intervals. In most cases, the intervals are definable in the connector config and then only need to be set and updated during the runtime.

    class TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\nself.template_interval = get_config_variable(\n\"TEMPLATE_INTERVAL\", [\"template\", \"interval\"], config, True\n)\ndef get_interval(self) -> int:\nreturn int(self.template_interval) * 60 * 60 * 24\ndef run(self) -> None:\nself.helper.log_info(\"Fetching knowledge...\")\nwhile True:\ntry:\n# Get the current timestamp and check\ntimestamp = int(time.time())\ncurrent_state = self.helper.get_state()\nif current_state is not None and \"last_run\" in current_state:\nlast_run = current_state[\"last_run\"]\nself.helper.log_info(\n\"Connector last run: \"\n+ datetime.utcfromtimestamp(last_run).strftime(\n\"%Y-%m-%d %H:%M:%S\"\n)\n)\nelse:\nlast_run = None\nself.helper.log_info(\"Connector has never run\")\n# If the last_run is more than interval-1 day\nif last_run is None or (\n(timestamp - last_run)\n> ((int(self.template_interval) - 1) * 60 * 60 * 24)\n):\ntimestamp = int(time.time())\nnow = datetime.utcfromtimestamp(timestamp)\nfriendly_name = \"Connector run @ \" + now.strftime(\"%Y-%m-%d %H:%M:%S\")\n###\n# RUN CODE HERE     \n###\n# Store the current timestamp as a last run\nself.helper.log_info(\n\"Connector successfully run, storing last_run as \"\n+ str(timestamp)\n)\nself.helper.set_state({\"last_run\": timestamp})\nmessage = (\n\"Last_run stored, next run in: \"\n+ str(round(self.get_interval() / 60 / 60 / 24, 2))\n+ \" days\"\n)\nself.helper.api.work.to_processed(work_id, message)\nself.helper.log_info(message)\ntime.sleep(60)\nelse:\nnew_interval = self.get_interval() - (timestamp - last_run)\nself.helper.log_info(\n\"Connector will not run, next run in: \"\n+ str(round(new_interval / 60 / 60 / 24, 2))\n+ \" days\"\n)\ntime.sleep(60)\n
    "},{"location":"development/connectors/#running-the-connector","title":"Running the connector","text":"

    For development purposes, it is easier to simply run the python script locally until everything works as it sould.

    $ virtualenv env\n$ source ./env/bin/activate\n$ pip3 install -r requirements\n$ cp config.yml.sample config.yml\n# Define the opencti url and token, as well as the connector's id\n$ vim config.yml\n$ python3 main.py\nINFO:root:Listing Threat-Actors with filters null.\nINFO:root:Connector registered with ID: a2de809c-fbb9-491d-90c0-96c7d1766000\nINFO:root:Starting ping alive thread\n...\n
    "},{"location":"development/connectors/#final-testing","title":"Final Testing","text":"

    Before submitting a Pull Request, please test your code for different use cases and scenarios. We don't have an automatic testing suite for the connectors yet, thus we highly depend on developers thinking about creative scenarios their code could encounter.

    "},{"location":"development/connectors/#prepare-for-release","title":"Prepare for release","text":"

    If you plan to provide your connector to be used by the community (\u2764\ufe0f) your code should pass the following (minimum) criteria.

    # Linting with flake8 contains no errors or warnings\n$ flake8 --ignore=E,W\n# Verify formatting with black\n$ black .\nAll done! \u2728 \ud83c\udf70 \u2728\n1 file left unchanged.\n# Push you feature/fix on Github\n$ git add [file(s)]\n$ git commit -m \"[connector_name] descriptive message\"\n$ git push origin [branch-name]\n# Open a pull request with the title \"[connector_name] message\"\n

    If you have any trouble with this just reach out to the OpenCTI core team. We are happy to assist with this.

    "},{"location":"development/environment_ubuntu/","title":"Prerequisites Ubuntu","text":"

    Development stack require some base software that need to be installed.

    "},{"location":"development/environment_ubuntu/#docker-or-podman","title":"Docker or podman","text":"

    Platform dependencies in development are deployed through container management, so you need to install a container stack.

    We currently support docker and postman.

    $ sudo apt-get install docker docker-compose curl\n

    As OpenCTI has a dependency to ElasticSearch, you have to set the vm.max_map_count before running the containers, as mentioned in the ElasticSearch documentation.

    $ sudo sysctl -w vm.max_map_count=262144\n
    "},{"location":"development/environment_ubuntu/#nodejs-and-yarn","title":"NodeJS and yarn","text":"

    The platform is developed on nodejs technology, so you need to install node and the yarn package manager.

    $ sudo apt-get install nodejs\n$ sudo curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -\n$ sudo echo \"deb https://dl.yarnpkg.com/debian/ stable main\" | sudo tee /etc/apt/sources.list.d/yarn.list\n$ sudo apt-get update && sudo apt-get install yarn\n
    "},{"location":"development/environment_ubuntu/#python-runtime","title":"Python runtime","text":"

    For worker and connectors, a python runtime is needed.

    $ sudo apt-get install python3 python3-pip\n
    "},{"location":"development/environment_ubuntu/#git-and-dev-tool","title":"Git and dev tool","text":"
    • Install Git from apt
    $ sudo apt-get install git-all\n
    • Install your preferred IDE
      • Intellij community edition - https://www.jetbrains.com/idea/download/
      • VSCode - https://code.visualstudio.com/
    "},{"location":"development/environment_windows/","title":"Prerequisites Windows","text":"

    Development stack require some base software that need to be installed.

    "},{"location":"development/environment_windows/#docker-or-podman","title":"Docker or podman","text":"

    Platform dependencies in development are deployed through container management, so you need to install a container stack.

    We currently support docker and postman.

    Docker Desktop from - https://docs.docker.com/desktop/install/windows-install/

    • Install new version of - https://docs.microsoft.com/windows/wsl/wsl2-kernel. This will require a reboot.
    • Shell out to CMD as Administrator and run the following powershell command:

    wsl --set-default-version 2

    • Reboot computer and continue to next step
    • Load Docker Application
    • NOTE DOCKER LICENSE - You are agreeing to the licence for Non-commercial Open Source Project use. OpenCTI is Open Source and the version you would be possibly contributing to enhancing is the unpaid non-commercial/non-enterprise version. If you intention is different - please consult with your organization's legal/licensing department.
    • Leave Docker Desktop running
    "},{"location":"development/environment_windows/#nodejs-and-yarn","title":"NodeJS and yarn","text":"

    The platform is developed on nodejs technology, so you need to install node and the yarn package manager.

    • Install NodeJS from - https://nodejs.org/download/release/v16.20.0/node-v16.20.0-x64.msi
    • Select the option for installing Chocolatey on the Tools for Native Modules screen
      • Will do this install for you automatically - https://chocolatey.org/packages/visualstudio2019-workload-vctools
      • Includes Python 3.11.4

    • Shell out to CMD prompt as Administrator and install/run:

      • pip3 install pywin32

    • Configure Yarn (https://yarnpkg.com/getting-started/install)

    • Open CMD as Administrator and run the following command:
      • corepack enable
    "},{"location":"development/environment_windows/#python-runtime","title":"Python runtime","text":"

    For worker and connectors, a python runtime is needed. Even if you already have a python runtime installed through node installation, on windows some nodejs package will be recompiled with python and C++ runtime.

    For this reason Visual Studio Build Tools is required.

    • Install Visual Studio Build Tools from - https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools
    • Check off Desktop Development with C++
    • Run install
    "},{"location":"development/environment_windows/#git-and-dev-tool","title":"Git and dev tool","text":"
    • Download GIT for Windows (64-bit Setup)- https://git-scm.com/download/win

    • Just use defaults on each screen

    • Install your preferred IDE

    • Intellij community edition - https://www.jetbrains.com/idea/download/
    • VSCode - https://code.visualstudio.com/docs/?dv=win64
    "},{"location":"development/platform/","title":"Platform development","text":""},{"location":"development/platform/#introduction","title":"Introduction","text":"

    This summary should give you a detailed setup description for initiating the OpenCTI setup environment necessary for developing on the OpenCTI platform, a client library or the connectors. This page document how to set up an \"All-in-One\" development environment for OpenCTI. The devenv will contain data of 3 different repositories:

    • Platform: https://github.com/OpenCTI-Platform/opencti
    • Connectors: https://github.com/OpenCTI-Platform/connectors
    • Client python: https://github.com/OpenCTI-Platform/client-python
    "},{"location":"development/platform/#platform","title":"Platform","text":"

    Contains the platform OpenCTI project code base:

    • docker-compose (docker or podman) ~/opencti/opencti-platform/opencti-dev
    • Web frontend (nodejs / react) ~/opencti/opencti-platform/opencti-graphql
    • Backend (nodejs) ~/opencti/opencti-platform/opencti-frontend
    • Worker (nodejs / python) ~/opencti/opencti-worker
    "},{"location":"development/platform/#connectors","title":"Connectors","text":"

    Contains a lot of developed connectors, as a source of inspiration for your new connector.

    "},{"location":"development/platform/#client-python","title":"Client python","text":"

    Contains the source code of the python library used in worker or connectors.

    "},{"location":"development/platform/#prerequisites","title":"Prerequisites","text":"

    Some tools are needed before starting to develop. Please check Ubuntu prerequisites or Windows prerequisites

    "},{"location":"development/platform/#clone-the-projects","title":"Clone the projects","text":"

    Fork and clone the git repositories

    • https://github.com/OpenCTI-Platform/opencti/ - frontend / backend
    • https://github.com/OpenCTI-Platform/connectors - connectors
    • https://github.com/OpenCTI-Platform/docker - docker stack
    • https://github.com/OpenCTI-Platform/client-python/ - python client
    "},{"location":"development/platform/#dependencies-containers","title":"Dependencies containers","text":"

    In development dependencies are deployed trough containers. A development compose file is available in ~/opencti/opencti-platform/opencti-dev

    cd ~/docker\n#Start the stack in background\ndocker-compose -f ./docker-compose-dev.yml up -d\n

    You have now all the dependencies of OpenCTI running and waiting for product to run.

    "},{"location":"development/platform/#backend-api","title":"Backend / API","text":""},{"location":"development/platform/#python-virtual-env","title":"Python virtual env","text":"

    The GraphQL API is developed in JS and with some python code. As it's an \"all-in-one\" installation, the python environment will be installed in a virtual environment.

    cd ~/opencti/opencti-platform/opencti-graphql\npython3 -m venv .venv --prompt \"graphql\"\nsource .venv/bin/activate\npip install --upgrade pip wheel setuptools\nyarn install\nyarn install:python deactivate\n
    "},{"location":"development/platform/#development-configuration","title":"Development configuration","text":"

    The API can be specifically configured with files depending on the starting profile. By default, the default.json file is used and will be correctly configured for local usage except for admin password

    So you need to create a development profile file. You can duplicate the default file and adapt if for you need. 

    cd ~/opencti/opencti-platform/opencti-graphql/config\ncp default.json development.json\n

    At minimum adapt the admin part for the password and token. 

        \"admin\": {\n\"email\": \"admin@opencti.io\",\n\"password\": \"MyNewPassord\",\n\"token\": \"UUID generated with https://www.uuidgenerator.net\"\n}\n

    "},{"location":"development/platform/#install-start","title":"Install / start","text":"

    Before starting the backend you need to install the nodejs modules

    cd ~/opencti/opencti-platform/opencti-graphql\nyarn install\n

    Then you can simply start the backend API with the yarn start command

    cd ~/opencti/opencti-platform/opencti-graphql\nyarn start\n

    The platform will start logging some interesting information

    {\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] Starting platform\",\"timestamp\":\"2023-07-02T16:37:10.984Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] Checking dependencies statuses\",\"timestamp\":\"2023-07-02T16:37:10.987Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[SEARCH] Elasticsearch (8.5.2) client selected / runtime sorting enabled\",\"timestamp\":\"2023-07-02T16:37:11.014Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[CHECK] Search engine is alive\",\"timestamp\":\"2023-07-02T16:37:11.015Z\",\"version\":\"5.8.7\"}\n...\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[INIT] Platform initialization done\",\"timestamp\":\"2023-07-02T16:37:11.622Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] API ready on port 4000\",\"timestamp\":\"2023-07-02T16:37:12.382Z\",\"version\":\"5.8.7\"}\n

    If you want to start on another profile you can use the -e parameter. For example here to use the profile.json configuration file.

    yarn start -e profile\n
    "},{"location":"development/platform/#code-check","title":"Code check","text":"

    Before pushing your code you need to validate the syntax and ensure the testing will be validated.

    "},{"location":"development/platform/#for-validation","title":"For validation","text":"

    yarn lint

    yarn check-ts

    "},{"location":"development/platform/#for-testing","title":"For testing","text":"

    For starting the test you will need to create a test.json file. You can use the same dependencies by only adapting all prefix for all dependencies.

    yarn test:dev

    "},{"location":"development/platform/#frontend","title":"Frontend","text":""},{"location":"development/platform/#install-start_1","title":"Install / start","text":"

    Before starting the backend you need to install the nodejs modules

    cd ~/opencti/opencti-platform/opencti-front\nyarn install\n

    Then you can simply start the frontend with the yarn start command

    cd ~/opencti/opencti-platform/opencti-front\nyarn start\n

    The frontend will start with some interesting information

    [INFO] [default] compiling...\n[INFO] [default] compiled documents: 1592 reader, 1072 normalization, 1596 operation text\n[INFO] Compilation completed.\n[INFO] Done.\n[HPM] Proxy created: /stream  -> http://localhost:4000\n[HPM] Proxy created: /storage  -> http://localhost:4000\n[HPM] Proxy created: /taxii2  -> http://localhost:4000\n[HPM] Proxy created: /feeds  -> http://localhost:4000\n[HPM] Proxy created: /graphql  -> http://localhost:4000\n[HPM] Proxy created: /auth/**  -> http://localhost:4000\n[HPM] Proxy created: /static/flags/**  -> http://localhost:4000\n

    The web UI should be accessible on http://127.0.0.1:3000

    "},{"location":"development/platform/#code-check_1","title":"Code check","text":"

    Before pushing your code you need to validate the syntax and ensure the testing will be validated.

    "},{"location":"development/platform/#for-validation_1","title":"For validation","text":"

    yarn lint

    yarn check-ts

    "},{"location":"development/platform/#for-testing_1","title":"For testing","text":"

    yarn test

    "},{"location":"development/platform/#worker","title":"Worker","text":"

    Running a worker is required when you want to develop on the ingestion or import/export connectors.

    "},{"location":"development/platform/#python-virtual-env_1","title":"Python virtual env","text":"
    cd ~/opencti/opencti-worker/src\npython3 -m venv .venv --prompt \"worker\"\nsource .venv/bin/activate\npip3 install --upgrade pip wheel setuptools\npip3 install -r requirements.txt\ndeactivate\n
    "},{"location":"development/platform/#install-start_2","title":"Install / start","text":"
    cd ~/opencti/opencti-worker/src\nsource .venv/bin/activate\npython worker.py\n
    "},{"location":"development/platform/#connectors_1","title":"Connectors","text":"

    For connectors development, please take a look to Connectors development dedicated page.

    "},{"location":"development/platform/#production-build","title":"Production build","text":"

    Based on development source you can build the package for production. This package will be minified and optimized with esbuild.

    $ cd opencti-frontend\n$ yarn build\n$ cd ../opencti-graphql\n$ yarn build\n

    After the build you can start the production build with yarn serv. This build will use the production.json configuration file

    $ cd ../opencti-graphql\n$ yarn serv\n
    "},{"location":"development/python/","title":"Python library","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/api/","title":"Knowledge graph","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/csv-feeds/","title":"CSV feeds","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/data-intelligence/","title":"Data intelligence","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/data-model/","title":"Data model","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/graph/","title":"Knowledge graph","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/security/","title":"Security","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/streaming/","title":"Data Streaming","text":""},{"location":"reference/streaming/#presentation","title":"Presentation","text":"

    In order to provide a real time way to consume STIX CTI information, OpenCTI provides data events in a stream that can be consume to react on creation, update, deletion and merge. This way of getting information out of OpenCTI is highly efficient and already use by some connectors.

    "},{"location":"reference/streaming/#technology","title":"Technology","text":""},{"location":"reference/streaming/#redis-stream","title":"Redis stream","text":"

    OpenCTI is currently using REDIS Stream (See https://redis.io/topics/streams-intro) as the technical layer. Each time something is modified in the OpenCTI database, a specific event is added in the stream.

    "},{"location":"reference/streaming/#sse-protocol","title":"SSE protocol","text":"

    In order to provides a really easy consuming protocol we decide to provide a SSE (https://fr.wikipedia.org/wiki/Server-sent_events) http URL linked to the standard login system of OpenCTI. Any user with the correct access rights can open and access http://opencti_instance/stream and open an SSE connection to start receiving live events. You can of course consume directly the stream in Redis but you will have to manage access and rights directly.

    "},{"location":"reference/streaming/#events-format","title":"Events format","text":"
    id: {Event stream id} -> Like 1620249512318-0\nevent: {Event type} -> create / update / delete\ndata: { -> The complete event data\n    version -> The version number of the event\n    type -> The inner type of the event\n    scope -> The scope of the event [internal or external]\n    data: {STIX data} -> The STIX representation of the data.\n    message -> A simple string to easy understand the event\n    origin: {Data Origin} -> Complex object with different information about the origin of the event\n    context: {Event context} -> Complex object with meta information depending of the event type\n}\n

    Id can be used to consume the stream from this specific point.

    "},{"location":"reference/streaming/#stix-data","title":"STIX data","text":"

    The current stix data representation is based on the STIX 2.1 format using extension mechanism. Please take a look to https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html for more information.

    "},{"location":"reference/streaming/#create","title":"Create","text":"

    Its simply the data created in STIX format.

    "},{"location":"reference/streaming/#delete","title":"Delete","text":"

    Its simply the data in STIX format just before his deletion. You will also find the automated deletions in context due to automatic dependency management.

    {\n\"context\": {\n\"deletions\": [{STIX data}]\n}\n}\n
    "},{"location":"reference/streaming/#update","title":"Update","text":"

    This event type publish the complete STIX data information along with patches information. Thanks to the patches, its possible to rebuild the previous version and easily understand that happens in the update. patch and reverse_patch follow the official jsonpatch specification. You can find more information at https://jsonpatch.com/

    {\n\"context\": {\n\"patch\": [/* patch operation object */],\n\"reverse_patch\": [/* patch operation object */]\n}\n}\n
    "},{"location":"reference/streaming/#merge","title":"Merge","text":"

    Merge is a mix of an update of the merge targets and deletions of the sources. In this event you will find the same patch and reverse_patch as an update and the list of elements merged into the target in the \"sources\" attribute.

    {\n\"context\": {\n\"patch\": [/* patch operation object */],\n\"reverse_patch\": [/* patch operation object */],\n\"sources\": [{STIX data}]\n}\n}\n
    "},{"location":"reference/streaming/#stream-types","title":"Stream types","text":"

    In OpenCTI we propose 2 types of streams.

    "},{"location":"reference/streaming/#base-stream","title":"Base stream","text":"

    The stream hosted in /stream url contains all the raw events of the platform, always filtered by the user rights (marking based). It's a technical stream a bit complex to used but very useful for internal processing or some specific connectors like backup/restore. This stream is live by default but if you want to catchup you can simply add the from parameter to your query. This parameter accept a timestamp in millisecond and also an event id. Like http://localhost/stream?from=1620249512599

    Stream size?

    The raw stream is really important in the platform and needs te be sized according to the period of retention you want to ensure. More retention you will have, more security about reprocessing the past information you will get. We usually recommand 1 month of retention, that usually match 2 000 000 of events. This limit can be configured with redis:trimming option, please check deployment configuration page.

    "},{"location":"reference/streaming/#live-stream","title":"Live stream","text":"

    This stream aims to simplify your usage of the stream through the connectors, providing a way to create stream with specific filters through the UI. After creating this stream, is simply accessible from /stream/{STREAM_ID}.

    It's very useful for various cases of data externalization, synchronization, like SPLUNK, TANIUM...

    This stream provides different interesting mechanics:

    • Stream the initial list of instances matching your filters when connecting based on main database if you use the recover parameter
    • Auto dependencies resolution to guarantee the consistency of the information distributed
    • Automatic events translation depending on the element segregation

    If you want to dig in about the internal behavior you can check this complete diagram:

    "},{"location":"reference/streaming/#general-options","title":"General options","text":"
    • no-dependencies (query parameter or header, default false). Can be used to prevent the auto dependencies resolution. To be used with caution.
    • listen-delete (query parameter or header, default true). Can be used prevent receive deletion events. To be used with caution.
    • with-inferences (query parameter or header, default false). Can be used to add inferences events (from rule engine) in the stream.
    "},{"location":"reference/streaming/#from-and-recover","title":"From and Recover","text":"

    From and recover are 2 different options that need to be explains.

    • from (query parameter) is always the parameter that describe the initial date/event_id you want to start from. Can also be setup with request header from or last-event-id

    • recover (query parameter) is an option that let you consume the initial event from the database and not from the stream. Can also be setup with request header recover or recover-date

    This difference will be transparent for the consumer but very important to get old information as an initial snapshot. This also let you consume information that is no longer in the stream retention period.

    The next diagram will help you to understand the concept:

    "},{"location":"reference/taxii-feeds/","title":"Taxii feeds","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/taxonomy/","title":"Taxonomy","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/case-management/","title":"Case management","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/containers/","title":"Containers","text":""},{"location":"usage/containers/#stix-standard","title":"STIX standard","text":""},{"location":"usage/containers/#definition","title":"Definition","text":"

    In the STIX 2.1 standard, some STIX Domain Objects (SDO) can be considered as \"container of knowledge\", using the object_refs attribute to refer multiple other objects as nested references. In object_refs, it is possible to refer to entities and relationships.

    "},{"location":"usage/containers/#example","title":"Example","text":"
    {\n\"type\": \"report\",\n\"spec_version\": \"2.1\",\n\"id\": \"report--84e4d88f-44ea-4bcd-bbf3-b2c1c320bcb3\",\n\"created_by_ref\": \"identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283\",\n\"created\": \"2015-12-21T19:59:11.000Z\",\n\"modified\": \"2015-12-21T19:59:11.000Z\",\n\"name\": \"The Black Vine Cyberespionage Group\",\n\"description\": \"A simple report with an indicator and campaign\",\n\"published\": \"2016-01-20T17:00:00.000Z\",\n\"report_types\": [\"campaign\"],\n\"object_refs\": [\n\"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2\",\n\"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c\",\n\"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a\"\n]\n}\n

    In the previous example, we have a nested reference to 3 other objects:

    \"object_refs\": [\n\"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2\",\n\"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c\",\n\"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a\"\n]\n
    "},{"location":"usage/containers/#implementation","title":"Implementation","text":""},{"location":"usage/containers/#types-of-container","title":"Types of container","text":"

    In OpenCTI, containers are displayed differently than other entities, because they contain pieces of knowledge. Here is the list of containers in the platform:

    Type of entity STIX standard Description Report Native Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. Grouping Native A Grouping object explicitly asserts that the referenced STIX Objects have a shared context, unlike a STIX Bundle (which explicitly conveys no context). Observed Data Native Observed Data conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). Note Native A Note is intended to convey informative text to provide further context and/or to provide additional analysis not contained in the STIX Objects. Opinion Native An Opinion is an assessment of the correctness of the information in a STIX Object produced by a different entity. Case Extension A case whether an Incident Response, a Request for Information or a Request for Takedown is use to convey an epic with a set of tasks. Task Extension A task, generally used in the context of case, is intended to convery information about something that must be done in a limited timeframe."},{"location":"usage/containers/#containers-behaviour","title":"Containers behaviour","text":"

    In the platform, it is always possible to visualize the list of entities and/or observables referenced in a container (Container > Entities or Observables) but also to add / remove entities from the container.

    As containers can also contain relationships, which are generally linked to the other entities in the container, it is also possible to visualize the container as a graph (Container > Knowledge)

    "},{"location":"usage/containers/#containers-of-an-entity-or-a-relationship","title":"Containers of an entity or a relationship","text":"

    On the entity or the relationship side, you can always find all containers where the objecti is contained using the top menu Analysis:

    In all containers list, you can also filter containers based on one or multiple contained object(s):

    "},{"location":"usage/dashboards/","title":"Custom dashboards","text":""},{"location":"usage/dashboards/#sharing-and-access-restriction","title":"Sharing and access restriction","text":"

    Organizations, groups, or users who have access to a dashboard can have 3 levels of access: - admin read, write, access management - edit read and write - view read-only

    When a user creates a custom dashboard, it is only visible to themselves. They then have admin access. They can then define who can access it and with what level of rights via the Manage access button at the top right of the dashboard page.

    Manage access button

    They can give access to organizations, groups, users, but also to all users on the platform (everyone).

    Manage access window

    It is important to note that a dashboard must have at least one user with admin access level.

    "},{"location":"usage/data-model/","title":"Data model","text":""},{"location":"usage/data-model/#introduction","title":"Introduction","text":"

    The OpenCTI core design relies on the concept of a knowledge graph, where you have two different kinds of object:

    1. Nodes are used to describe entities, which have some properties or attributes.
    2. Edges are used to describe relationships, which are created between two entity nodes and have some properties or attributes.

    Example

    An example would be that the entity APT28 has a relationship uses to the malware entity Drovorub.

    "},{"location":"usage/data-model/#standard","title":"Standard","text":""},{"location":"usage/data-model/#the-stix-model","title":"The STIX model","text":"

    To enable a unified approach in the description of threat intelligence knowledge as well as importing and exporting data, the OpenCTI data model is based on the STIX 2.1 standard. Thus we highly recommend to take a look to the STIX Introductory Walkthrough and to the different kinds of STIX relationships to get a better understanding of how OpenCTI works.

    Some more important STIX naming shortcuts are:

    • STIX Domain Objects (SDO): Attack Patterns, Malware, Threat Actors, etc.
    • STIX Cyber Observable (SCO): IP Addresses, domain names, hashes, etc.
    • STIX Relationship Object (SRO): Relationships, Sightings

    "},{"location":"usage/data-model/#extensions","title":"Extensions","text":"

    In some cases, the model has been extended to be able to:

    • Support more types of SCOs to modelize information systems such as cryptocurrency wallets, user agents, etc.
    • Support more types of SDOs to modelize disinformation and cybercrime such as channels, events, narrative, etc.
    • Support more types of SROs to extend the new SDOs such asamplifies, publishes, etc.
    "},{"location":"usage/data-model/#implementation-in-the-platform","title":"Implementation in the platform","text":""},{"location":"usage/data-model/#diagram-of-types","title":"Diagram of types","text":"

    You can find below the digram of all types of entities and relationships available in OpenCTI.

    "},{"location":"usage/data-model/#attributes-and-properties","title":"Attributes and properties","text":"

    To get a comprehensive list of available properties for a given type of entity or relationship, you can use the GraphQL playground schema available in your \"Profile > Playground\". Then you can click on schema. You can for instance search for the keyword IntrusionSet:

    "},{"location":"usage/deduplication/","title":"Deduplication","text":"

    One of the core concept of the OpenCTI knowledge graph is all underlying mechanisms implemented to accurately de-duplicate and consolidate (aka. upserting) information about entities and relationships.

    "},{"location":"usage/deduplication/#creation-behavior","title":"Creation behavior","text":"

    When an object is created in the platform, whether manually by a user or automatically by the connectors / workers chain, the platform checks if something already exist based on some properties of the object. If the object already exists, it will return the existing object and, in some cases, update it as well.

    Technically, OpenCTI generates deterministic IDs based on the listed properties below to prevent duplicate (aka \"ID Contributing Properties\"). Also, it is important to note that there is a special link between name and aliases leading to not have entities with overlaping aliases or an alias already used in the name of another entity.

    "},{"location":"usage/deduplication/#entities","title":"Entities","text":"Type Attributes Area (name OR x_opencti_alias) AND x_opencti_location_type Attack Pattern (name OR alias) AND optional x_mitre_id Campaign name OR alias Channel name OR alias City (name OR x_opencti_alias) AND x_opencti_location_type Country (name OR x_opencti_alias) AND x_opencti_location_type Course Of Action (name OR alias) AND optional x_mitre_id Data Component name OR alias Data Source name OR alias Event name OR alias Feedback Case name AND created (date) Grouping name AND context Incident name OR alias Incident Response Case name OR alias Indicator name OR alias Individual (name OR x_opencti_alias) and identity_class Infrastructure name OR alias Intrusion Set name OR alias Language name OR alias Malware name OR alias Malware Analysis name OR alias Narrative name OR alias Note None Observed Data name OR alias Opinion None Organization (name OR x_opencti_alias) and identity_class Position (name OR x_opencti_alias) AND x_opencti_location_type Region name OR alias Report name AND publised (date) RFI Case name AND created (date) RFT Case name AND created (date) Sector (name OR alias) and identity_class Task None Threat Actor name OR alias Tool name OR alias Vulnerability name OR alias"},{"location":"usage/deduplication/#relationships","title":"Relationships","text":"

    The deduplication process of relationships is based on the following criterias:

    • Type
    • Source
    • Target
    • Start time between -30 days / + 30 days
    • Stop time between -30 days / + 30 days
    "},{"location":"usage/deduplication/#observables","title":"Observables","text":"

    For STIX Cyber Observables, OpenCTI also generate deterministic IDs based on the STIX specification using the \"ID Contributing Properties\" defined for each type of observable.

    "},{"location":"usage/deduplication/#update-behavior","title":"Update behavior","text":"

    If an entity already exists in the platform, the attributes may be updated by the incoming creation with the following rule:

    If confidence_level of the created entity is >= (greater or equal) then the confidence_level of the existing entity, attributes will be updated. Obviously, the confidence_level will also be increased with the new one.

    This logic has been implemented so the platform can converge to the highest confidence and quality levels for the entities and the relationships.

    "},{"location":"usage/enrichment/","title":"Enrichment connectors","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-analysis/","title":"Exploring \"Analysis\"","text":"

    When you click on \"Analysis\" in the left-side bar, you access all the \"Analysis\" tabs, visible on the top bar on the left. By default, the user directly access the \"Reports\" tab, but can navigate to the other tabs as well.

    From the Analysis section, users can access the following tabs:

    • Reports: See Reports as a sort of containers to detail and structure what is contained on a specific report, either from a source or write by yourself. Think of it as an Intelligence Production in OpenCTI.
    • Groupings: Groupings are containers, like Reports, but do not represent an Intelligence Production. They regroup Objects sharing an explicit context. For example, a Grouping might represent a set of data that, in time, given sufficient analysis, would mature to convey an incident or threat report as Report container.
    • Malware Analysis: As define by STIX 2.1 standard, Malware Analysis captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.
    • Notes: Through this tab, you can find all the Notes that have been written in the platform, for example to add some analyst's unstructured knowledge about an Object.
    • External references: Intelligence is never created from nothing. External references give user a way to link sources or reference documents to any Object in the platform.

    "},{"location":"usage/exploring-analysis/#reports","title":"Reports","text":""},{"location":"usage/exploring-analysis/#general-presentation","title":"General presentation","text":"

    Reports are one of the central component of the platform. It is from a Report that knowledge is extracted and integrated in the platform for further navigation, analysis and exports. Always tying the information back to a report allows for the user to be able to identify the source of any piece of information in the platform at all time.

    In the MITRE STIX 2.1 documentation, a Report is defined as such :

    Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. They are used to group related threat intelligence together so that it can be published as a comprehensive cyber threat story.

    As a result, a Report object in OpenCTI is a set of attributes and metadata defining and describing a document outside the platform, which can be a threat intelligence report from a security reseearch team, a blog post, a press article a video, a conference extract, a MISP event, or any type of document and source.

    When clicking on the Reports tab at the top left, you access the list of all Reports you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of reports.

    "},{"location":"usage/exploring-analysis/#visualizing-knowledge-within-a-report","title":"Visualizing Knowledge within a Report","text":"

    When clicking on a Report, you land on the Overview tab. For a Report, the following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge contained in the report, accessible through different views (See below for a dive-in).
    • Content: a tab to upload outcomes document displaying the content of the Report (for example in PDF, text, HTML or markdown files). The Content of the document is displayed to ease the access of Knowledge through a readable format.
    • Entities: A table containing all SDO (Stix Domain Objects) contained in the Report, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Observables: A table containing all SCO (Stix Cyber Observable) contained in the Report, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Data: as described here.

    Exploring and modifying the structured Knowledge contained in a Report can be done through different lenses.

    "},{"location":"usage/exploring-analysis/#graph-view","title":"Graph View","text":"

    In Graph view, STIX SDO are displayed as graph nodes and relationships as graph links. Nodes are colored depending of their type. Direct relationship are displayed as plain link and inferred relationships in dotted link. At the top right, you will find a serie of icons. From there you can change the current type of view. Here you can also perform global action on the Knowledge of the Report. Let's highlight 2 of them: - Suggestions: This tool suggests you some logical relationships to add between your contained Object to give more consistency to your Knowledge. - Share with an Organization: if you have designated a main Organization in the platform settings, you can here share your Report and its content with users of an other Organization. At the bottom, you have many option to manipulate the graph: - Multiple option for shaping the graph and applying forces to the nodes and links - Multiple selection options - Multiple filters, including a time range selector allowing you to see the evolution of the Knowledge within the Report. - Multiple creation and edition tools to modify the Knowledge contained in the Report.

    "},{"location":"usage/exploring-analysis/#content-mapping-view","title":"Content mapping view","text":"

    Through this view, you can map exsisting or new Objects directly from a readable content, allowing you to quickly append structured Knowledge in your Report before refining it with relationships and details. This view is a great place to see the continuum between unstructured and structured Knowledge of a specific Intelligence Production.

    "},{"location":"usage/exploring-analysis/#timeline-view","title":"Timeline view","text":"

    This view allows you to see the structured Knowledge chronologically. This view is really useful when the report describes an attack or a campaign that lasted some time, and the analyst payed attention to the dates. The view can be filtered and displayed relationships too.

    "},{"location":"usage/exploring-analysis/#correlation-view","title":"Correlation view","text":"

    The correlation view is a great way to visualize and find other Reports related to your current subject of interest. This graph displays all Report related to the important nodes contained in your current Report, for example Objects like Malware or Intrusion sets.

    "},{"location":"usage/exploring-analysis/#matrix-view","title":"Matrix view","text":"

    If your Report describes let's say an attack, a campaign, or an understanding of an Intrusion set, it should contains multiple attack patterns Objects to structure the Knowledge about the TTPs of the Threat Actor. Those attack patterns can be displayed as highlighted matrices, by default the MITRE ATT&CK Enterprise matrix. As some matrices can be huge, it can be also filtered to only display attack patterns describes in the Report.

    "},{"location":"usage/exploring-analysis/#groupings","title":"Groupings","text":"

    Groupings are an alternative to Report for grouping Objects sharing a context without describing an Intelligence Production.

    In the MITRE STIX 2.1 documentation, a Grouping is defined as such :

    A Grouping object explicitly asserts that the referenced STIX Objects have a shared context, unlike a STIX Bundle (which explicitly conveys no context). A Grouping object should not be confused with an intelligence product, which should be conveyed via a STIX Report. A STIX Grouping object might represent a set of data that, in time, given sufficient analysis, would mature to convey an incident or threat report as a STIX Report object. For example, a Grouping could be used to characterize an ongoing investigation into a security event or incident. A Grouping object could also be used to assert that the referenced STIX Objects are related to an ongoing analysis process, such as when a threat analyst is collaborating with others in their trust community to examine a series of Campaigns and Indicators.

    When clicking on the Groupings tab at the top of the interface, you access the list of all Groupings you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of the groupings.

    Clicking on a Grouping, you land on its Overview tab. For a Groupings, the following tabs are accessible: - Overview: as described here. - Knowledge: a complex tab that regroups all the structured Knowledge contained in the groupings, as for a Report, except for the Timeline view. - Entities: A table containing all SDO (Stix Domain Objects) contained in the Grouping, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine - Observables: A table containing all SCO (Stix Cyber Observable) contained in the Grouping, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine - Data: as described here.

    "},{"location":"usage/exploring-analysis/#malware-analysis","title":"Malware Analysis","text":"

    Malware analyses are an important part of the Cyber Threat Intelligence, allowing an precise understanding of what and how a malware really do on the host but also how and from where it receives its command and communicates its results.

    In OpenCTI, Malware Analyses can be created from enrichment connectors that will take an Observable as input and perform a scan on a online service platform to bring back results. As such, Malware Analysis can be done on File, Domain and URL.

    In the MITRE STIX 2.1 documentation, a Malware Analysis is defined as such :

    Malware Analysis captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

    When clicking on the Malware Analysis tab at the top of the interface, you access the list of all Malware Analysis you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of the Malware Analysis.

    Clicking on a Malware Analysis, you land on its Overview tab. The following tabs are accessible: - Overview: This view contains some additions from the common Overview here. You will find here details about how the analysis have been performed, what is the global result regarding the malicioussness of the analysed artifact and all the Observables that have been found during the analysis. - Knowledge: If you Malware analysis is linked to other Objects that are not part of the analysis result, they will be displayed here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-analysis/#notes","title":"Notes","text":"

    Not every Knowledge can be structured. For allowing any users to share their insights about a specific Knowledge, they can create a Note for every Object and relationship in OpenCTI they can access to. All the Notes are listed within the Analysis menu for allowing global review of this unstructured addition to the global Knowledge.

    In the MITRE STIX 2.1 documentation, a Note is defined as such :

    A Note is intended to convey informative text to provide further context and/or to provide additional analysis not contained in the STIX Objects, Marking Definition objects, or Language Content objects which the Note relates to. Notes can be created by anyone (not just the original object creator).

    Clicking on a Note, you land on its Overview tab. The following tabs are accessible: - Overview: as described here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-analysis/#external-references","title":"External references","text":"

    Intelligence is never created from nothing. External references give user a way to link sources or reference documents to any Object in the platform. All external references are listed within the Analysis menu for accessing directly sources of the structured Knowledge.

    In the MITRE STIX 2.1 documentation, a External references is defined as such :

    External references are used to describe pointers to information represented outside of STIX. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

    Clicking on an External reference, you land on its Overview tab. The following tabs are accessible: - Overview: as described here.

    "},{"location":"usage/exploring-arsenal/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-cases/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-entities/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-events/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-locations/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-observations/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-techniques/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-threats/","title":"Threats","text":"

    When you click on \"Threats\" in the left-side bar, you access all the \"Threats\" tabs, visible on the top bar on the left. By default, the user directly access the \"Threat Actor (Group)\" tab, but can navigate to the other tabs as well.

    From the Threats section, users can access the following tabs:

    • Threat actors (Group): Threat actor (Group) represents a physical group of attackers operating an Intrusion set, using malware and attack infrastructure, etc.
    • Threat actors (Indvidual): Threat actor (Individual) represents a real attacker that can be described by physical and personal attributes and motivations. Threat actor (Individual) operates Intrusion set, uses malware and infrastructure, etc.
    • Intrusion sets: Intrusion set is an important concept in Cyber Threat Intelligence field. It is a consistent set of technical and non technical elements corresponding of what, how and why a Threat actor acts. it is particularly usefull for associating multiple attacks and malicious actions to a defined Threat, even without sufficiant informations regarding who did them. Often, with you understanding of the threat growing, you will link an Intrusion set to a Threat actor (either a Group or an Individual).
    • Campaigns: Campaign represents a serie of attacks taking place in a certain period of time and/or targeting a consistent subset of Organization/Individual.
    "},{"location":"usage/exploring-threats/#threat-actors-group-and-individual","title":"Threat actors (Group and Individual)","text":""},{"location":"usage/exploring-threats/#general-presentation","title":"General presentation","text":"

    Threat actors are the humans who are building, deploying and operating intrusion sets. A threat actor can be an single individual or a group of attackers (who may be composed of individuals). A group of attackers may be a state-nation, a state-sponsored group, a corporation, a group of hacktivists, etc.

    Beware, groups of attackers might be modelized as \"Intrusion sets\" in feeds, as there is sometimes a misunderstanding in the industry between group of people and the technical/operational intrusion set they operate.

    When clicking on the Threat actor (Group or Individual) tabs at the top left, you access the list of all the groups of Threat actors or INdivudual Threat actors you have access too, in respect with your allowed marking definitions. These groups or individual are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares they used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Threat actors.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-a-threat-actor","title":"Visualizing Knowledge associated with a Threat actor","text":"

    When clicking on a Threat actor Card, you land on its Overview tab. For a Threat actor, the following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/exploring-threats/#intrusion-sets","title":"Intrusion Sets","text":"

    An intrusion set is a consistent group of technical elements such as \"tactics, technics and procedures\" (TTP), tools, malware and infrastructure used by a threat actor against one or a number of victims who are usually sharing some characteristics (field of activity, country or region) to reach a similar goal whoever the victim is. The intrusion set may be deployed once or several times and may evolve with time. Several intrusion sets may be linked to one threat actor. All of the entities described below may be linked to one intrusion set. There are many debates in the Threat Intelligence community on how to define an intrusion set and how to distinguish several intrusion sets with regards to:

    • their differences
    • their evolutions
    • the possible reuse
    • \"false flag\" type of attacks

    As OpenCTI is very customizable, each organization or individual may use these categories as they wish. Instead, it is also possible to use the import feed for the choice of categories.

    When clicking on the Intrusion set tab on the top left, you access the list of all the Intrusion sets you have access too, in respect with your allowed marking definitions. These intrusion sets are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares they used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Intrusion set.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-an-intrusion-set","title":"Visualizing Knowledge associated with an Intrusion set","text":"

    When clicking on an Intrusion set Card, you land on its Overview tab. The following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/exploring-threats/#campaigns","title":"Campaigns","text":"

    A campaign can be defined as \"a series of malicious activities or attacks (sometimes called a \"wave of attacks\") taking place within a limited period of time, against a defined group of victims, associated to a similar intrusion set and characterized by the use of one or several identical malware towards the various victims and common TTPs\". However, a campaign is an investigation element and may not be widely recognized. Thus, a provider might define a series of attacks as a campaign and another as an intrusion set. Campaigns can be attributed to an Intrusion set.

    When clicking on the Campaign tab on the top left, you access the list of all the Campaigns you have access too, in respect with your allowed marking definitions. These campaigns are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Campaigns.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-a-campaign","title":"Visualizing Knowledge associated with a Campaign","text":"

    When clicking on an Campaign Card, you land on its Overview tab. The following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/export-documents/","title":"Export in documents","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/export-structured/","title":"Export in structured format","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/feeds/","title":"Native feeds","text":""},{"location":"usage/feeds/#live-streams","title":"Live streams","text":""},{"location":"usage/feeds/#introduction","title":"Introduction","text":"

    The best way to consume OpenCTI data, whether it is through a stream connector or within another OpenCTI instance, is to use the live streams. Live streams are like TAXII collection (ie. serving STIX 2.1 bundles) but under steroids. This means that live streams are supporting:

    • create, update and delete events depending on the filters ;
    • caching already created entities in the last 5 minutes ;
    • resolving relationships and dependencies even out of the filters ;
    • they can be public (without authentication).

    "},{"location":"usage/feeds/#schenario","title":"Schenario","text":"

    To better understand how live streams are working, let's take a few examples, from simple to complex.

    Given a live stream with filters Entity type: Indicator AND Label: detection. Let's see what happen with an indicator with:

    • Marking definition: TLP:GREEN
    • Author Crowdstrike
    • Relation indicates to the malware Emotet
    Action Result in stream (resolve-dependencies=false) Result in stream (resolve-dependencies=true) 1. Create an indicator Nothing Nothing 2. Add the label detection Create TLP:GREEN, create CrowdStrike, create the indicator Create TLP:GREEN, create CrowdStrike, create the malware Emotet, create the indicator, create the relationship indicates 3. Remove the label detection Delete the indicator Delete the indicator 4. Add the label detection Create the indicator Create the indicator, create the relationship indicates 5. Delete the indicator Delete the indicator Delete the indicator"},{"location":"usage/feeds/#taxii-collections","title":"TAXII Collections","text":"

    OpenCTI has an embedded TAXII API endpoint which provides valid STIX 2.1 bundles. If you wish to know more about the TAXII standard, please read the official introduction.

    In OpenCTI you can create as many TAXII 2.1 collections as needed. Each of them can have specific filters to publish only a subset of the platform overall knowledge (specific types of entities, labels, marking definitions, etc.).

    After creating a new collection, every systems with a proper access token can consume the collection using different kinds of authentication (basic, bearer, etc.)

    As when using the GraphQL API, TAXII 2.1 collections have a classic pagination system that should be handled by the consumer. Also, it's important to understand that element dependencies (nested IDs) inside the collection are not always contained/resolved in the bundle, so consistency needs to be handled at the client level.

    "},{"location":"usage/feeds/#csv-feeds","title":"CSV feeds","text":"

    OpenCTI is able to publish data in CSV feeds on a rolling period.

    "},{"location":"usage/getting-started/","title":"Getting started","text":"

    This guide aims to give you a full overview of the OpenCTI features and workflows. The platform can be used in various contexts to handle threats management use cases from a technical to a more strategic level. OpenCTI has been designed as a knowledge graph, taking inputs (threat intelligence feeds, sightings & alerts, vulnerabilities, assets, artifacts, etc.) and generating outputs based on built-in capabilities and / or connectors.

    Here are some examples of use cases:

    • Cyber Threat Intelligence knowledge base
    • Detection as code feeds for XDR, EDR, SIEMs, firewalls, proxies, etc.
    • Incident response artifacts & cases management
    • Vulnerabilities management
    • Reporting, alerting and dashboarding on a subset of data

    "},{"location":"usage/getting-started/#welcome-dashboard","title":"Welcome dashboard","text":"

    The welcome gives any visitor on the OpenCTI platform an outlook on the live of the platform. It can be replaced by a custom dashboard, created by a user (or the default dashboard in a role, a group or an organization).

    "},{"location":"usage/getting-started/#indicators-in-the-dashboard","title":"Indicators in the dashboard","text":""},{"location":"usage/getting-started/#numbers","title":"Numbers","text":"Component Description Total entities Number of entities (threat actor, intrusion set, indicator, etc.). Total relationships Number of relationships (targets, uses, indicates, etc.). Total reports Number of reports. Total observables Number of observables (IPv4-Addr, File, etc.)."},{"location":"usage/getting-started/#charts-lists","title":"Charts & lists","text":"Component Description Top labels Top labels given to entities during the last 3 months. Ingested entities Number of entities ingested by month. Top 10 active entities List of the entities with the greatest number of relations over the last 3 months. Targeted countries Intensity of the targeting tied to the number of relations targets for a given country. Observable distribution Distribution of the number of observables by type. Last ingested reports Last reports ingested in the platform."},{"location":"usage/import-automated/","title":"Automate import","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/import-files/","title":"Import from files","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/inferences/","title":"Inferences and reasoning","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/manual-creation/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/merging/","title":"Merge objects","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/nested/","title":"Nested references and objects","text":""},{"location":"usage/nested/#stix-standard","title":"STIX standard","text":""},{"location":"usage/nested/#definition","title":"Definition","text":"

    In the STIX 2.1 standard, objects can:

    1. Refer to other objects in directly in their attributes, by referencing one or multiple IDs.
    2. Have other objects directly embedded in the entity.
    "},{"location":"usage/nested/#example","title":"Example","text":"
    {\n\"type\": \"intrusion-set\",\n\"spec_version\": \"2.1\",\n\"id\": \"intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29\",\n\"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\", // nested reference to an identity\n\"object_marking_refs\": [\"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\"], // nested reference to multiple marking defintions\n\"external_references\": [\n{\n\"source_name\": \"veris\",\n\"external_id\": \"0001AA7F-C601-424A-B2B8-BE6C9F5164E7\",\n\"url\": \"https://github.com/vz-risk/VCDB/blob/125307638178efddd3ecfe2c267ea434667a4eea/data/json/validated/0001AA7F-C601-424A-B2B8-BE6C9F5164E7.json\",    }\n],\n\"created\": \"2016-04-06T20:03:48.000Z\",\n\"modified\": \"2016-04-06T20:03:48.000Z\",\n\"name\": \"Bobcat Breakin\",\n\"description\": \"Incidents usually feature a shared TTP of a bobcat being released within the building containing network access...\",\n\"aliases\": [\"Zookeeper\"],\n\"goals\": [\"acquisition-theft\", \"harassment\", \"damage\"]\n}\n

    In the previous example, we have 2 nested references to other objects in:

    \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\", // nested reference to an identity\n\"object_marking_refs\": [\"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\"], // nested reference to multiple marking defintions\n

    But we also have a nested object within the entity (an External Reference):

    \"external_references\": [\n{\n\"source_name\": \"veris\",\n\"external_id\": \"0001AA7F-C601-424A-B2B8-BE6C9F5164E7\",\n\"url\": \"https://github.com/vz-risk/VCDB/blob/125307638178efddd3ecfe2c267ea434667a4eea/data/json/validated/0001AA7F-C601-424A-B2B8-BE6C9F5164E7.json\",    }\n]\n
    "},{"location":"usage/nested/#implementation","title":"Implementation","text":""},{"location":"usage/nested/#modelization","title":"Modelization","text":"

    In OpenCTI, all nested references and objects are modelized as relationships, to be able to pivot more easily on labels, external references, kill chain phases, marking definitions, etc.

    "},{"location":"usage/nested/#import-export","title":"Import & export","text":"

    When importing and exporting data to/from OpenCTI, the translation between nested references and objects to full-fledged nodes and edges is automated and therefore transparent for the users. Here is an example with the object in the graph above:

    {\n\"id\": \"file--b6be3f04-e50f-5220-af3a-86c2ca66b719\",\n\"spec_version\": \"2.1\",\n\"x_opencti_description\": \"...\",\n\"x_opencti_score\": 50,\n\"hashes\": {\n\"MD5\": \"b502233b34256285140676109dcadde7\"\n},\n\"labels\": [\n\"cookiecutter\",\n\"clouddata-networks-1\"\n],\n\"external_references\": [\n{\n\"source_name\": \"Sekoia.io\",\n\"url\": \"https://app.sekoia.io/intelligence/objects/indicator--3e6d61b4-d5f0-48e0-b934-fdbe0d87ab0c\"\n}\n],\n\"x_opencti_id\": \"8a3d108f-908c-4833-8ff4-4d6fc996ce39\",\n\"type\": \"file\",\n\"created_by_ref\": \"identity--b5b8f9fc-d8bf-5f85-974e-66a7d6f8d4cb\",\n\"object_marking_refs\": [\n\"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n]\n}\n
    "},{"location":"usage/notifications/","title":"Notifications and alerting","text":"

    It is possible to receive notifications via email or directly on the platform interface triggered by events such as entity creation, modification or deletion.

    "},{"location":"usage/notifications/#triggers","title":"Triggers","text":"

    Each user can create their own triggers. Triggers listen all the events that respect their filters and their event types, and notify the user of those events via the chosen outcome(s) (user interface or email).

    A platform administrator can create and manage triggers for a user, who will remain the trigger administrator, as well as for a group or an organization. Users belonging to this group or organization will then have read-only access rights on this trigger. The user can use filters to ensure that the created triggers are as accurate as possible.

    "},{"location":"usage/notifications/#instance-triggers","title":"Instance triggers","text":"

    Instance triggers are specific live triggers that listen to one or several instance(s). To create an instance trigger, you can

    • either use the general trigger creation form in the \u2018Triggers and digests\u2019 section,
    • either click on the \u2018quick subscription\u2019 icon at the top right of an entity overview.

    An instance trigger on an entity X notifies the following events:

    • update/deletion of X,
    • creation/deletion of a relationship from/to X,
    • creation/deletion of an entity that has X in its refs (examples: contains X, is shared with X, is created by X...),
    • adding/removing X in the ref of an entity (examples: adding X in the author of an entity, adding X in a report\u2026).

    Note: The notification of an entity deletion can either provides from the real deletion of an entity, either from a modification of the entity that leads to the user loss of visibility for the entity.

    "},{"location":"usage/notifications/#digest","title":"Digest","text":"

    A digest allows triggering the sending of notifications based on multiple triggers over a given period.

    "},{"location":"usage/overview/","title":"Overview","text":""},{"location":"usage/overview/#introduction","title":"Introduction","text":"

    The following chapter aims at giving the reader a step-by-step description of what is available on the platform and the meaning of the different tabs and entries.

    When the user connects to the platform, the home page is the Dashboard. This Dashboard contains several visuals summarizing the types and quantity of data recently imported into the platform.

    Dashboard

    To get more information about the components of the default dashboard, you can consult the Getting started.

    The left side panel allows the user to navigate through different windows and access different views and categories of knowledge.

    "},{"location":"usage/overview/#structure","title":"Structure","text":""},{"location":"usage/overview/#the-hot-knowledge","title":"The \"hot knowledge\"","text":"

    The first part of the platform in the left menu is dedicated to what we call the \"hot knowledge\", which means this is the entities and relationships which are added on a daily basis in the platform and which generally require work / analysis from the users.

    • Analysis: all containers which convey relevant knowledge such as reports, groupings and malware analysis.
    • Cases: all types of case like incident responses, requests for information, for takedown, etc.
    • Events: all incidents & alerts coming from operational systems as well as sightings.
    • Observations: all technical data in the platform such as observables, artifacts and indicators.
    "},{"location":"usage/overview/#the-cold-knowledge","title":"The \"cold knowledge\"","text":"

    The second part of the platform in the left menu is dedicated to the \"cold knowledge\", which means this is the entities and relationships used in the hot knowledge. You can see this as the \"encyclopedia\" of all pieces of knowledge you need to get context: threats, countries, sectors, etc.

    • Threats: all threats entities from campaigns to threat actors, including intrusion sets.
    • Arsenal: all tools and pieces of malware used and/or targeted by threats, including vulnerabilities.
    • Techniques: all objects related to tactics and techniques used by threats (TTPs, etc.).
    • Entities: all non-geographical contextual information such as sectors, events, organizations, etc.
    • Locations: all geographical contextual information, from cities to regions, including precise positions.
    "},{"location":"usage/overview/#hide-categories","title":"Hide categories","text":"

    You can customize the experience in the platform by hiding some categories in the left menu, whether globally or for a specific role.

    "},{"location":"usage/overview/#hide-categories-globally","title":"Hide categories globally","text":"

    In the Settings > Parameters, it is possible for the platform administrator to hide categories in the platform for all users.

    "},{"location":"usage/overview/#hide-categories-in-roles","title":"Hide categories in roles","text":"

    In OpencTI, the different roles are highly customizable. It is possible to defined default dashboards, triggers, etc. but also be able to hide categories in the roles:

    "},{"location":"usage/overview/#presentation-of-a-typical-page-in-opencti","title":"Presentation of a typical page in OpenCTI","text":"

    Although there are many different entities in OpenCTI and many different tabs, most of them are quite similar and only have minor differences from the other, mostly due to some of their characteristics, which requires specific fields or do not require some fields which are necessary for the other.

    In this part will only be detailed a general outline of a \"typical\" OpenCTI page. The specifies of the different entities will be detailed in the corresponding pages below (Activities and Knowledge).

    "},{"location":"usage/overview/#overview_1","title":"Overview","text":"

    In the Overview tab on the entity, you will find all properties of the entity as well as the recent activities.

    First, you will find the Details section, where are displayed all properties specific to the type of entity you are looking at, an example below with a piece of malware:

    Thus, in the Basic information section, are displayed all common properties to all objects in OpenCTI, such as the marking definition, the author, the labels (ie. tags), etc.

    Below these two sections, you will find latest modifications in the Knowledge base related to the Entity:

    • Latest created relationships: display the latest relationships that have been created from or to this Entity. For example, latest Indicators of Compromise and associated Threat Actor of a Malware.
    • latest containers about the object: display all the Cases and Analysis that contains this Entity. For example, the latest Reports about a Malware.
    • External references: display all the the external sources associated with the Entity. You will often find here links to external reports or webpages from where Entity's information came from.
    • History: display the latest chronological modifications of the Entity and its relationships that occured in the platform, in order to traceback any alteration.

    Last, all Notes written by users of the platform about this Entity are displayed in order to access unstructured analysis comments.

    "},{"location":"usage/overview/#knowledge","title":"Knowledge","text":"

    In the Knowledge tab, which is the central part of the entity, you will find all the Knowledge related to the current entity. The Knowledge tab is different for Analysis (Report, Groupings) and Cases (Incident response, Request for Information, Request for Takedown) entities than for all the other entity types.

    • The Knowledge tab of those entities (who represents Analyses or Cases that can contains a collection of Objects) is the place to integrate and link together entities. For more information on how to integrate information in OpenCTI using the knowledge tab of a report, please refer to the part Manual creation.
    • Knowledge tabs of any other entity (that does not aim to contain a collection of Objects) gather all the entities which have been at some point linked to the entity the user is looking at (for instance, as shown in the following capture, the Knowledge tab of Intrusion set APT29) gives access to the list of all entities APT29 is attributed to, all victims the intrusion set has targeted, all its campaigns, TTPs, malwares etc. For entities to appear in theses tabs under Knowledge, they need to have been linked to the entity directly or have been computed with the inference engine (to come).

    "},{"location":"usage/overview/#analysis","title":"Analysis","text":"

    The Analysis tab contains the list of all Analysis (Report, Groupings) and Cases (Incident response, Request for Information, Request for Takedown) in which the entity has been identified.

    By default, this tab display the list, but you can also display the content of all the listed Analyses on a graph, allowing you to explore all their Knowledge and have a glance of the context around the Entity.

    "},{"location":"usage/overview/#data","title":"Data","text":"

    The Data tab contains documents that are associated to the object and were either :

    • Uploaded to the platform : for instance the PDF document containing the text of the report
    • Generated from the platform to be downloaded : a JSON or CSV file containing information on the object and generated by the user.
    • associated to an external reference

    Analyst Workbench can also be created from here. They will contain the entity by default.

    "},{"location":"usage/overview/#history","title":"History","text":"

    The History tab display the history of change of the Entity, update of attributes, creation of relations, ...

    Because of the volumes of information the history is written in a specific index by the history connector (https://www.notion.so/luatix/History-17503579a70c467ba02ec11350c593bf) that consume the redis stream to rebuild the history for the UI.

    Less frequent tabs are the following:

    • The Indicators tab (for all the threats and the entities in arsenal - except the courses of action -)
    • The Observables tab (for reports, observed data)
    • the Entities tab (for reports and observed data)
    • the Sightings tab (for Indicators and observables)
    "},{"location":"usage/pivoting/","title":"Pivot and investigate","text":"

    In Opencti, all data can be represented as a large knowledge graph: everything is linked to something. You can pivot on any entity and on any relationship you have in your platform, using investigations.

    Investigations are available on the top right of the top bar:

    Investigations are organized by workspace. When you create a new empty workspace, it will only be visible by you and enables you to work on your investigation before sharing it.

    In your workspace, you can add entities that you want to investigate, visualize the data linked to these entities, add relationships, and export your investigation graph in pdf, image or as new stix report.

    "},{"location":"usage/pivoting/#add-and-expand-an-entity","title":"Add and expand an entity","text":"

    You can add any existing entity of the platform to your investigation.

    Once added, you can select the entity, and see its details in the right. In this bottom right menu, right next to \"Add en entity\", you can expand the selected entity and select the number of linked entities you want to see in your investigation.

    "},{"location":"usage/pivoting/#add-a-relationship","title":"Add a relationship","text":"

    You can add a relationship between entities directly in your investigation.

    "},{"location":"usage/pivoting/#export-your-investigation","title":"Export your investigation","text":"

    You can export your investigation in PDF or image format. You can also download all the content of your investigation graph in a Report stix bundle (investigation is automatically converted).

    "},{"location":"usage/search/","title":"Search for knowledge","text":"

    In OpenCTI, you have access to different capabilities to be able to search for knowledge in the platform. In most cases, a search by keyword can be refined with additional filters for instance on the type of object, the author etc.

    "},{"location":"usage/search/#global-search","title":"Global search","text":"

    The global search is always available in the top bar of the platform.

    This search covers all STIX Domain Objects (SDOs) and STIX Cyber Observables (SCOs) in the platform. The search results are sorted according to the following behaviour:

    • Priority 1 for exact matching of the keyword in one attribute of the objects.
    • Priority 2 for partial matching of the keyword in the name, the aliases and the description attributes (full text search).
    • Priority 3 for partial matching of the keyword in all other attributes (full text search).

    If you get unexpected result, it is always possible to add some filters after the initial search:

    Also, using the Advanced search button, it is possible to directly put filters in a global search:

    "},{"location":"usage/search/#bulk-search","title":"Bulk search","text":"

    The bulk search capabilities in available in the top bar of the platform and allow you to copy paste a list of keyword or objects (ie. list of domains, list of IP addresses, list of vulnerabilities, etc.) to search in the platform:

    When searching in bulk, OpenCTI is only looking for an exact match in some properties:

    • name
    • aliases
    • x_opencti_aliases
    • x_mitre_id
    • value
    • subject
    • abstract
    • hashes_MD5
    • hashes_SHA1
    • hashes_SHA256
    • hashes_SHA512
    • x_opencti_additional_names

    When something is not found, it appears in the list as Unknown and will be excluded if you choose to export your search result in a JSON STIX bundle or in a CSV file.

    "},{"location":"usage/search/#contextual-search","title":"Contextual search","text":"

    In most of the screens of knowledge, you always have a contextual search bar allowing you to filter the list you are on:

    The search keyword used here is taken into account if you decide to export the current view in a file such as a JSON STIX bundle or a CSV file.

    "},{"location":"usage/search/#other-search-bars","title":"Other search bars","text":"

    Some other screens can contain search bars for specific purposes. For instance, in the graph views to filter the nodes displayed on the graph:

    "},{"location":"usage/workbench/","title":"Analyst workbench","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/workflows/","title":"Workflows and assignation","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "}]} \ No newline at end of file +{"config":{"lang":["en"],"separator":"[\\s\\-]+","pipeline":["stopWordFilter"],"fields":{"title":{"boost":1000.0},"text":{"boost":1.0},"tags":{"boost":1000000.0}}},"docs":[{"location":"","title":"OpenCTI Documentation Space","text":"

    Welcome to the OpenCTI Documentation space. Here you will be able to find all documents, meeting notes and presentations about the platform.

    Release notes

    Please, be sure to also take a look at the OpenCTI releases notes, they may contain important information about releases and deployments.

    "},{"location":"#introduction","title":"Introduction","text":"

    OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. It has been created in order to structure, store, organize and visualize technical and non-technical information about cyber threats.

    "},{"location":"#getting-started","title":"Getting started","text":"

    • Deployment & Setup

      Learn how to deploy and configure the platform as well as launch connectors to get the first data in OpenCTI.

      Deploy now

    • User Guide

      Understand how to use the platform, explore the knowledge, import and export information, create dashboard, etc.

      Explore

    • Administration

      Know how to administrate OpenCTI, create users and groups using RBAC / segregation, put retention policies and custom taxonomies.

      Customize

    Need more help?

    We are doing our best to keep this documentation complete, accurate and up to date.

    If you still have questions or you find something which is not sufficiently explained, join the Filigran Community on Slack.

    "},{"location":"#latest-blog-posts","title":"Latest blog posts","text":"

    All tutorials are published directly on the Medium blog, this section provides a comprehensive list of the most important ones.

    • OpenCTI case management is ready for takeoff: what is available and what\u2019s next Apr 18, 2023

      As part of our 2023 strategic roadmap, we\u2019ve worked since January on the case management system within the OpenCTI platform. This initiative comes from 2 simple statements...

      Read

    • Progressive rollout of the OpenCTI Enterprise Edition: why, what and how? June 10, 2023

      We are thrilled to announce that, from OpenCTI 5.8, Filigran is now providing some customers with an Enterprise Edition of the platform, whether on-premise...

      Read

    • How OpenCTI helps to fight disinformation and foreign interferences May 21, 2023

      In the past year, our product and engineering teams worked closely with multiple companies, public agencies and non profit organizations to extend a bit the...

      Read

    "},{"location":"#additional-resources","title":"Additional resources","text":"

    Below, you will find external resources which may be useful along your OpenCTI journey.

    OpenCTI Ecosystem List of available connectors and integrations to expand platform usage.

    Training Courses Training courses for analysts and administrators in the Filigran training center.

    Performances tests & metrics Regular performance tests based on default configuration and datasets.

    "},{"location":"administration/enterprise/","title":"Enterprise edition","text":"

    Filigran

    Filigran is providing an Enterprise Edition of the platform, whether on-premise or in the SaaS.

    "},{"location":"administration/enterprise/#what-is-opencti-ee","title":"What is OpenCTI EE?","text":"

    OpenCTI Enterprise Edition is based on the open core concept. This means that the source code of OCTI EE remains open source and included in the main GitHub repository of the platform but is published under a specific license. As precised in the GitHub license file:

    The OpenCTI Community Edition is licensed under the Apache License, Version 2.0 (the \u201cApache License\u201d). The OpenCTI Enterprise Edition is licensed under the OpenCTI Non-Commercial License (the \u201cNon-Commercial License\u201d). The source files in this repository have a header indicating which license they are under. If no such header is provided, this means that the file is belonging to the Community Edition under the Apache License, Version 2.0.

    We write a complete article to explain the enterprise edition, feel free to read it to have more information

    "},{"location":"administration/enterprise/#ee-activation","title":"EE Activation","text":"

    Enterprise edition is easy to activate. You need to go the the platform settings and click on the Activate button.

    Then you will need to agree to the Filigran EULA.

    As a reminder:

    • OpenCTI EE is free-to-use for development, testing and research purposes as well as for non-profit organizations.
    • OpenCTI EE is included for all Filigran SaaS customers without additional fee.
    • For all other usages, OpenCTI EE is reserved to organizations that have entered in a Filigran Enterprise agreement.
    "},{"location":"administration/enterprise/#available-features","title":"Available features","text":""},{"location":"administration/enterprise/#activity-monitoring","title":"Activity monitoring","text":"

    Audit logs help you answer \"who did what, where, and when?\" within your data with the maximum level of transparency. Please read Activity monitoring page to get all information.

    "},{"location":"administration/enterprise/#more-to-come","title":"More to come","text":"

    More feature will be available in OpenCTI in the future. Features like: - Automation scenarios and playbooks engine. - Generative AI for correlation and content generation. - Supervised machine learning for natural language processing.

    "},{"location":"administration/entities/","title":"Customize entities","text":""},{"location":"administration/entities/#introduction","title":"Introduction","text":"

    The following chapter aims at giving the reader an understanding of possible options by entity type. Customize entities can be done in \u00ab Settings \u00bb \u2192 \u00ab Customization \u00bb.

    "},{"location":"administration/entities/#hidden-in-interface","title":"Hidden in interface","text":"

    This configuration hides a specific entity type across the entire platform. It is a powerfull way to simplify the interface and focus on your domain expertise. For example, if you are not interested in disinformation campaign, you can hide related entities like Narratives and Channels from the menus.

    You can define which Entities to hide platform-wide from \u00ab Settings \u00bb \u2192 \u00ab Customization \u00bb, and also from \u00ab Settings \u00bb \u2192 \u00ab Parameters \u00bb giving you a list of hidden entities.

    You can also define hidden entities for specific users Roles, from \u00ab Settings \u00bb \u2192 \u00ab Security \u00bb \u2192 \u00ab Roles \u00bb and editing a Role.

    An overview is available in Parameters > Hidden entity types.

    "},{"location":"administration/entities/#automatic-references-at-file-upload","title":"Automatic references at file upload","text":"

    This configuration enables an entity to automatically construct an external reference from the uploaded file.

    "},{"location":"administration/entities/#enforce-references","title":"Enforce references","text":"

    This configuration enables the requirement of a reference message on an entity creation or modification. This option is helpfull if you want to keep a strong consistency and traceability of your Knowledge and is well suited for manual creation and update.

    "},{"location":"administration/entities/#workflow","title":"Workflow","text":"

    For now, OpenCTI have a simple workflow approach.

    The available status for an entity is first defined by a collection of status templates (that can be defined from \u00ab Settings \u00bb \u2192 \u00ab Taxonomies \u00bb \u2192 \u00ab Status Template \u00bb).

    Then, a workflow can be defined by ordering a sequence of status template.

    "},{"location":"administration/entities/#attributes","title":"Attributes","text":"

    In an Entity, each attribute offers some customization options : - Become mandatory if not already defined as such in the stix standard - Have a default value to facilitate the creation of an entity via the creation forms - Define the different thresholds and corresponding label for scalable attribute

    "},{"location":"administration/introduction/","title":"Introduction","text":"

    This guide aims to give you a full overview of the OpenCTI features and workflows. The platform can be used in various contexts to handle threats management use cases from a technical to a more strategic level.

    "},{"location":"administration/introduction/#administrative-settings","title":"Administrative Settings","text":"

    The OpenCTI Administrative settings console allows administrators to configure many options dynamically within the system. As an Administrator, you can access this settings console, by clicking the settings link.

    The Settings Console allows for configuration of various aspects of the system.

    "},{"location":"administration/introduction/#general-configuration","title":"General Configuration","text":"
    • Platform Title (Default: OpenCTI - Cyber Threat Intelligence Platform)
    • Platform Favicon
    • Platform General Sender email (Default: admin@opencti.io)
    • Platform Default Theme (Default: Dark)
    • Language (Default: Automatic Detection)
    • Hidden Entity Types (Default: None)
    "},{"location":"administration/introduction/#authentication-strategies-display","title":"Authentication Strategies Display","text":"
    • This section will show configured and enabled/disabled strategies. The configuration is done in the config/default.json file or via ENV variables detected at launch.
    "},{"location":"administration/introduction/#platform-messages","title":"Platform Messages","text":"
    • Platform Login Message (optional) - if configured this will be displayed on the login page. This is usually used to have a welcome type message for users before login.
    • Platform Consent Message (optional) - if configured this will be displayed on the login page. This is usually used to display some type of consent message for users to agree to before login. If enabled, a user must check the checkbox displayed to allow login.
    • Platform Consent Confirm Text (optional) - This is displayed next to the platform consent checkbox, if Platform Consent Message is configured. Users must agree to the checkbox before the login prompt will be displayed. This message can be configured, but by default reads: I have read and comply with the above statement
    "},{"location":"administration/introduction/#dark-theme-color-scheme","title":"Dark Theme Color Scheme","text":"

    Various aspects of the Dark Theme can be dynamically configured in this section.

    "},{"location":"administration/introduction/#light-theme-color-scheme","title":"Light Theme Color Scheme","text":"

    Various aspects of the Light Theme can be dynamically configured in this section.

    "},{"location":"administration/introduction/#tools-configuration-display","title":"Tools Configuration Display","text":"

    This section will give general status on the various tools and enabled components of the currently configured OpenCTI deployment.

    "},{"location":"administration/merging/","title":"Merging and de-duplication","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/ontologies/","title":"Custom taxonomies","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/parameters/","title":"Parameters","text":""},{"location":"administration/parameters/#description","title":"Description","text":"

    This part of the interface wil let you configure global platform settings, like title, favicon, etc. It will also give you important information about the platform.

    "},{"location":"administration/parameters/#configuration","title":"Configuration","text":"

    Configure global platform settings, like title, favicon, etc.

    "},{"location":"administration/parameters/#opencti-platform","title":"OpenCTI Platform","text":"

    Important information about the platform.

    It's also the place to activate the Enterprise edition

    "},{"location":"administration/parameters/#platform-announcement","title":"Platform Announcement","text":"

    This section gives you the possibility to set and display Announcements in the platform. Those announcements will be visible to every user in the platform, on top of the interface.

    They can be used to inform all your users' community of important information, like a scheduled downtime, an incoming upgrade, or even an important tips regarding the usage of the platform.

    An Announcement can be accompanied by a \u201cDismiss\u201d button. When click by a user, it makes the message disappear for this user.

    This option can be deactivated to have a permanent Announcement.

    \u26a0\ufe0f Only one Announcement is displayed at a time. Dismissible Announcement are displayed first, then the latest not dismissible Announcement.

    "},{"location":"administration/policies/","title":"Policies","text":""},{"location":"administration/policies/#platform-main-organization","title":"Platform main organization","text":"

    Allow to set a main organization for the entire platform.

    All the pieces of knowledge must be shared with the organization of the user wishing to access it or this user need to be inside the main organization.

    "},{"location":"administration/policies/#authentication-strategies","title":"Authentication Strategies","text":"

    There are several authentication strategies to connect to the platform.

    Please see the Authentication section for further details.

    "},{"location":"administration/policies/#local-password-policies","title":"Local Password Policies","text":"

    Allow to define the password policy according to several criteria in order to strengthen the security of your platform, namely: minimum/maximum number of characters, number of digits, etc.

    "},{"location":"administration/policies/#login-messages","title":"Login Messages","text":"

    Allow to define login, consent and consent confirm message to customize and highlight your platform's security policy

    "},{"location":"administration/policies/#platform-banner-configuration","title":"Platform Banner Configuration","text":"

    Allow OpenCTI deployments to have a custom banner message (top and bottom) and colored background for the message (Green, Red, or Yellow). Can be used to add a disclaimer or system purpose that will be displayed at the top and bottom of the OpenCTI instances pages.

    This configuration has two parameters:

    • Platform Banner Level - (Default: OFF) Options available for the banner background are Green, Red, and Yellow.
    • Platform Banner Text - (Default: Blank) If you turn on the banners, you should add a message to this area to be displayed within the banner.

    "},{"location":"administration/reasoning/","title":"Reasoning engine","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/retentions/","title":"Indicators lifecycle","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/segregation/","title":"Data segregation","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/sourcing/","title":"Sourcing knowledge","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"administration/users/","title":"Users and Role Based Access Control","text":""},{"location":"administration/users/#introduction","title":"Introduction","text":"

    In OpenCTI, the RBAC system not only related to what users can do or cannot do in the platform (aka. Capabilities) but also to the system of data segregation. Also, platform behaviour such as default home dashboards, default triggers and digests as well as default hidden menus or entities can be defined across groups and organizations.

    "},{"location":"administration/users/#high-level-design","title":"High level design","text":""},{"location":"administration/users/#list-of-capabilities","title":"List of capabilities","text":"Capability Description Nothing"},{"location":"administration/audit/configuration/","title":"Configuration","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    As explained in overview page, all administration actions are listen by default. However, all knowledge are not listened by default due to performance impact on the platform.

    For this reason you need to explicitly activate extended listening on user / group or organization.

    Listening will start just after the configuration. Every past events will not be taken into account.

    "},{"location":"administration/audit/events/","title":"Events","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    "},{"location":"administration/audit/events/#description","title":"Description","text":"

    OpenCTI activity capability is the way to unified whats really happen in the platform. In events section you will have access to the UI that will answer to \"who did what, where, and when?\" within your data with the maximum level of transparency.

    "},{"location":"administration/audit/events/#include-knowledge","title":"Include knowledge","text":"

    By default, the events screen only show you the administration actions done by the users.

    If you want to see also the information about the knowledge, you can simply activate the filter in the bar to get the complete overview of all user actions.

    Don't hesitate to read again the overview page to have a better understanding of the difference between Audit, Basic/Extended knowledge.

    "},{"location":"administration/audit/overview/","title":"Overview","text":""},{"location":"administration/audit/overview/#overview","title":"Overview","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    OpenCTI activity capability is the way to unified whats really happen in the platform. With this feature you will be able to answer \"who did what, where, and when?\" within your data with the maximum level of transparency. Enabling activity helps your security, auditing, and compliance entities monitor platform for possible vulnerabilities or external data misuse.

    "},{"location":"administration/audit/overview/#categories","title":"Categories","text":"

    The activity group 3 different concepts that need to be explains.

    "},{"location":"administration/audit/overview/#basic-knowledge","title":"Basic knowledge","text":"

    The basic knowledge refers to all stix data knowledge inside OpenCTI. Every create/update/delete actions on that knowledge is accessible through the history. That basic activity is handled by the history manager and can be also found directly on each entity.

    "},{"location":"administration/audit/overview/#extended-knowledge","title":"Extended knowledge","text":"

    The extended knowledge refers to extra information data to track specific user activity. As this kind of tracking is expensive, the tracking will only be done for specific user/group/organization explicitly configured.

    "},{"location":"administration/audit/overview/#audit-knowledge","title":"Audit knowledge","text":"

    Audit is focusing on user administration or security actions. Audit will produces console/logs files along with user interface elements.

    {\n\"auth\": \"<User information>\",\n\"category\": \"AUDIT\",\n\"level\": \"<info | error>\",\n\"message\": \"<human readable explanation>\",\n\"resource\": {\n\"type\": \"<authentication | mutation>\",\n\"event_scope\": \"<depends on type>\",\n\"event_access\": \"<administration>\",\n\"data\": \"<contextual data linked to the event type>\",\n\"version\": \"<version of audit log format>\"\n},\n\"timestamp\": \"<event date>\",\n\"version\": \"<platform version>\"\n}\n
    "},{"location":"administration/audit/overview/#architecture","title":"Architecture","text":"

    OpenCTI use different mechanisms to be able to publish actions (audit) or data modification (history)

    "},{"location":"administration/audit/overview/#audit-knowledge_1","title":"Audit knowledge","text":"

    Administration or security actions

    With Enterprise edition activated, Administration and security actions are always written; you can't configure, exclude, or disable them

    Supported

    Not supported for now

    Not applicable

    "},{"location":"administration/audit/overview/#ingestion","title":"Ingestion","text":"Create Delete Edit Remote OCTI Streams"},{"location":"administration/audit/overview/#data-sharing","title":"Data sharing","text":"Create Delete Edit CSV Feeds TAXII Feeds Stream Feeds"},{"location":"administration/audit/overview/#connectors","title":"Connectors","text":"Create Delete Edit Connectors State reset Works"},{"location":"administration/audit/overview/#parameters","title":"Parameters","text":"Create Delete Edit Platform parameters"},{"location":"administration/audit/overview/#security","title":"Security","text":"Create Delete Edit Roles Groups Users Sessions Policies"},{"location":"administration/audit/overview/#customization","title":"Customization","text":"Create Delete Edit Entity types Rules engine Retention policies"},{"location":"administration/audit/overview/#taxonomies","title":"Taxonomies","text":"Create Delete Edit Status templates Case templates + tasks"},{"location":"administration/audit/overview/#accesses","title":"Accesses","text":"Listen Login (success or fail) Logout Unauthorized access"},{"location":"administration/audit/overview/#extended-knowledge_1","title":"Extended knowledge","text":"

    Extended knowledge

    Extented knowledge activity are written only if you activate the feature for a subset of users / groups or organizations

    "},{"location":"administration/audit/overview/#data-management","title":"Data management","text":"

    Some history actions are already included in the \"basic knowledge\". (basic marker)

    Read Create Delete Edit Platform knowledge basic basic basic Background tasks Knowledge Knowledge files basic basic Global data import files Analyst workbenches files Triggers Workspaces Investigations User profile"},{"location":"administration/audit/overview/#user-actions","title":"User actions","text":"Supported Ask for file import Ask for data enrichment Ask for export generation Execute global search"},{"location":"administration/audit/triggers/","title":"Activity triggers","text":"

    Enterprise edition

    Activity unified interface and logging are available under the \"Filigran entreprise edition\" license.

    Please read the dedicated page to have all information

    "},{"location":"administration/audit/triggers/#description","title":"Description","text":"

    Having all the history in the user interface (events) its sometimes not enough to have a proactive monitoring. For this reason you can configure some specific triggers to receive notifications on audit events. You can configure like personal triggers, lives one that will be sent directly or digest depending on your needs.

    "},{"location":"administration/audit/triggers/#configuration","title":"Configuration","text":"

    In this kind of trigger you will have to configure different options: - Notification target: User interface or email - Recipients: who will receive the notification - Filters: a set of filters to get only events that really interested you. (who is responsible for this event, kind of events, ...)

    "},{"location":"administration/audit/triggers/#event-structure","title":"Event structure","text":"

    In order to correctly configure the filters, here's a definition of the event structure

    • Event type: authentication

    • Event scopes: login and logout

    • Event type: read

      • Event scopes: read and unauthorized

    • Event type: file

      • Event scopes: read, create and delete

    • Event type: mutation

      • Event scopes: unauthorized, update, create and delete

    • Event type: command

      • Event scopes: search, enrich, import and export
    "},{"location":"deployment/authentication/","title":"Authentication","text":""},{"location":"deployment/authentication/#introduction","title":"Introduction","text":"

    OpenCTI supports several authentication providers. If you configure multiple strategies, they will be tested in the order you declared them.

    Activation

    You need to configure/activate only that you really want to propose to your users in term of authentication

    The product proposes two kind of authentication strategy:

    • Form (asking user for a user/password)
    • Buttons (click with authentication on an external system)
    "},{"location":"deployment/authentication/#supported-strategies","title":"Supported Strategies","text":"

    Under the hood we technically use the strategies provided by PassportJS. We integrate a subset of the strategies available with passport we if you need more we can theatrically integrate all the passport strategies.

    "},{"location":"deployment/authentication/#local-users-form","title":"Local users (form)","text":"

    This strategy used the OpenCTI database as user management.

    OpenCTI use this strategy as the default but its not the one we recommend for security reason.

    \"local\": {\n\"strategy\": \"LocalStrategy\",\n\"config\": {\n\"disabled\": false\n}\n}\n

    Production deployment

    Please use the LDAP/Auth0/OpenID/SAML strategy for production deployment.

    "},{"location":"deployment/authentication/#ldap-form","title":"LDAP (form)","text":"

    This strategy can be used to authenticate your user with your company LDAP and is based on Passport - LDAPAuth.

    \"ldap\": {\n\"strategy\": \"LdapStrategy\",\n\"config\": {\n\"url\": \"ldaps://mydc.domain.com:686\",\n\"bind_dn\": \"cn=Administrator,cn=Users,dc=mydomain,dc=com\",\n\"bind_credentials\": \"MY_STRONG_PASSWORD\",\n\"search_base\": \"cn=Users,dc=mydomain,dc=com\",\n\"search_filter\": \"(cn={{username}})\",\n\"mail_attribute\": \"mail\",\n// \"account_attribute\": \"givenName\",\n// \"firstname_attribute\": \"cn\",\n// \"lastname_attribute\": \"cn\",\n\"account_attrgroup_search_filteribute\": \"givenName\",\n\"allow_self_signed\": true\n}\n}\n

    If you would like to use LDAP groups to automatically associate LDAP groups and OpenCTI groups/organizations:

    \"ldap\": {\n\"config\": {\n...\n\"group_search_base\": \"cn=Groups,dc=mydomain,dc=com\",\n\"group_search_filter\": \"(member={{dn}})\",\n\"groups_management\": { // To map LDAP Groups to OpenCTI Groups\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"LDAP_Group_1:OpenCTI_Group_1\", \"LDAP_Group_2:OpenCTI_Group_2\", ...]\n},\n\"organizations_management\": { // To map LDAP Groups to OpenCTI Organizations\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"LDAP_Group_1:OpenCTI_Organization_1\", \"LDAP_Group_2:OpenCTI_Organization_2\", ...]\n}\n}\n}\n
    "},{"location":"deployment/authentication/#saml-button","title":"SAML (button)","text":"

    This strategy can be used to authenticate your user with your company SAML and is based on Passport - SAML.

    \"saml\": {\n\"identifier\": \"saml\",\n\"strategy\": \"SamlStrategy\",\n\"config\": {\n\"issuer\": \"mytestsaml\",\n// \"account_attribute\": \"nameID\",\n// \"firstname_attribute\": \"nameID\",\n// \"lastname_attribute\": \"nameID\",\n\"entry_point\": \"https://auth.mydomain.com/auth/realms/mydomain/protocol/saml\",\n\"saml_callback_url\": \"http://localhost:4000/auth/saml/callback\",\n// \"private_key\": \"MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwg...\",\n\"cert\": \"MIICmzCCAYMCBgF2Qt3X1zANBgkqhkiG9w0BAQsFADARMQ8w...\"\n}\n}\n

    For the SAML strategy to work:

    • The cert parameter is mandatory (PEM format) because it is used to validate the SAML response.
    • The private_key (PEM format) is optional and is only required if you want to sign the SAML client request.

    Certificates

    Be careful to put the cert / private_key key in PEM format. Indeed, a lot of systems generally export the the keys in X509 / PCKS12 formats and so you will need to convert them. Here is an example to extract PEM from PCKS12: 

    openssl pkcs12 -in keystore.p12 -out newfile.pem -nodes\n

    Here is an example of SAML configuration using environment variables:

    - PROVIDERS__SAML__STRATEGY=SamlStrategy - \"PROVIDERS__SAML__CONFIG__LABEL=Login with SAML\"\n- PROVIDERS__SAML__CONFIG__ISSUER=mydomain\n- PROVIDERS__SAML__CONFIG__ENTRY_POINT=https://auth.mydomain.com/auth/realms/mydomain/protocol/saml\n- PROVIDERS__SAML__CONFIG__SAML_CALLBACK_URL=http://opencti.mydomain.com/auth/saml/callback\n- PROVIDERS__SAML__CONFIG__CERT=MIICmzCCAYMCBgF3Rt3X1zANBgkqhkiG9w0BAQsFADARMQ8w\n

    OpenCTI support mapping SAML Roles/Groups on OpenCTI Groups. Here is an example:

    \"saml\": {\n\"config\": {\n...,\n// Groups mapping\n\"groups_management\": { // To map SAML Groups to OpenCTI Groups\n\"group_attributes\": [\"Group\"],\n\"groups_mapping\": [\"SAML_Group_1:OpenCTI_Group_1\", \"SAML_Group_2:OpenCTI_Group_2\", ...]\n},\n\"groups_management\": { // To map SAML Roles to OpenCTI Groups\n\"group_attributes\": [\"Role\"],\n\"groups_mapping\": [\"SAML_Role_1:OpenCTI_Group_1\", \"SAML_Role_2:OpenCTI_Group_2\", ...]\n},\n// Organizations mapping\n\"organizations_management\": { // To map SAML Groups to OpenCTI Organizations\n\"group_attributes\": [\"Group\"],\n\"groups_mapping\": [\"SAML_Group_1:OpenCTI_Organization_1\", \"SAML_Group_2:OpenCTI_Organization_2\", ...]\n},\n\"organizations_management\": { // To map SAML Roles to OpenCTI Organizations\n\"group_attributes\": [\"Role\"],\n\"groups_mapping\": [\"SAML_Role_1:OpenCTI_Organization_1\", \"SAML_Role_2:OpenCTI_Organization_2\", ...]\n}\n}\n}\n

    Here is an example of SAML Groups mapping configuration using environment variables:

    - \"PROVIDERS__SAML__CONFIG__GROUPS_MANAGEMENT__GROUPS_ATTRIBUTES=[\\\"Group\\\"]\"\n- \"PROVIDERS__SAML__CONFIG__GROUPS_MANAGEMENT__GROUPS_MAPPING=[\\\"SAML_Group_1:OpenCTI_Group_1\\\", \\\"SAML_Group_2:OpenCTI_Group_2\\\", ...]\"\n
    "},{"location":"deployment/authentication/#auth0-button","title":"Auth0 (button)","text":"

    This strategy allows to use Auth0 Service to handle the authentication and is based on Passport - Auth0.

    \"authzero\": {\n\"identifier\": \"auth0\",\n\"strategy\": \"Auth0Strategy\",\n\"config\": {\n\"clientID\": \"XXXXXXXXXXXXXXXXXX\",\n\"baseURL\": \"https://opencti.mydomain.com\",\n\"clientSecret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/auth0/callback\",\n\"domain\": \"mycompany.eu.auth0.com\",\n\"audience\": \"XXXXXXXXXXXXXXX\",\n\"scope\": \"openid email profile XXXXXXXXXXXXXXX\"\n}\n}\n

    Here is an example of Auth0 configuration using environment variables:

    - PROVIDERS__AUTHZERO__STRATEGY=Auth0Strategy\n- PROVIDERS__AUTHZERO__CONFIG__CLIENT_ID=${AUTH0_CLIENT_ID}\n- PROVIDERS__AUTHZERO__CONFIG__BASEURL=${AUTH0_BASE_URL}\n- PROVIDERS__AUTHZERO__CONFIG__CLIENT_SECRET=${AUTH0_CLIENT_SECRET}\n- PROVIDERS__AUTHZERO__CONFIG__CALLBACK_URL=${AUTH0_CALLBACK_URL}\n- PROVIDERS__AUTHZERO__CONFIG__DOMAIN=${AUTH0_DOMAIN}\n- PROVIDERS__AUTHZERO__CONFIG__SCOPE=\"openid email profile\"\n
    "},{"location":"deployment/authentication/#openid-connect-button","title":"OpenID Connect (button)","text":"

    This strategy allows to use the OpenID Connect Protocol to handle the authentication and is based on Node OpenID Client that is more powerful than the passport one.

    \"oic\": {\n\"identifier\": \"oic\",\n\"strategy\": \"OpenIDConnectStrategy\",\n\"config\": {\n\"label\": \"Login with OpenID\",\n\"issuer\": \"https://auth.mydomain.com/auth/realms/mydomain\",\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"redirect_uris\": [\"https://opencti.mydomain.com/auth/oic/callback\"]\n}\n}\n

    Here is an example of OpenID configuration using environment variables:

    - PROVIDERS__OPENID__STRATEGY=OpenIDConnectStrategy - \"PROVIDERS__OPENID__CONFIG__LABEL=Login with OpenID\"\n- PROVIDERS__OPENID__CONFIG__ISSUER=https://auth.mydomain.com/auth/realms/xxxx\n- PROVIDERS__OPENID__CONFIG__CLIENT_ID=XXXXXXXXXXXXXXXXXX\n- PROVIDERS__OPENID__CONFIG__CLIENT_SECRET=XXXXXXXXXXXXXXXXXX\n- \"PROVIDERS__OPENID__CONFIG__REDIRECT_URIS=[\\\"https://opencti.mydomain.com/auth/oic/callback\\\"]\"\n

    OpenCTI support mapping OpenID Roles/Groups on OpenCTI Groups (everything is tied to a group in the platform). Here is an example:

    \"oic\": {\n\"config\": {\n...,\n// Groups mapping\n\"groups_management\": { // To map OpenID Groups to OpenCTI Groups\n\"groups_scope\": \"groups\",\n\"groups_path\": [\"groups\", \"realm_access.groups\", \"resource_access.account.groups\"],\n\"groups_mapping\": [\"OpenID_Group_1:OpenCTI_Group_1\", \"OpenID_Group_2:OpenCTI_Group_2\", ...]\n},\n\"groups_management\": { // To map OpenID Roles to OpenCTI Groups\n\"groups_scope\": \"roles\",\n\"groups_path\": [\"roles\", \"realm_access.roles\", \"resource_access.account.roles\"],\n\"groups_mapping\": [\"OpenID_Role_1:OpenCTI_Group_1\", \"OpenID_Role_2:OpenCTI_Group_2\", ...]\n},\n// Organizations mapping  \n\"organizations_management\": { // To map OpenID Groups to OpenCTI Organizations\n\"organizations_scope\": \"groups\",\n\"organizations_path\": [\"groups\", \"realm_access.groups\", \"resource_access.account.groups\"],\n\"organizations_mapping\": [\"OpenID_Group_1:OpenCTI_Group_1\", \"OpenID_Group_2:OpenCTI_Group_2\", ...]\n},\n\"organizations_management\": { // To map OpenID Roles to OpenCTI Organizations\n\"organizations_scope\": \"roles\",\n\"organizations_path\": [\"roles\", \"realm_access.roles\", \"resource_access.account.roles\"],\n\"organizations_mapping\": [\"OpenID_Role_1:OpenCTI_Group_1\", \"OpenID_Role_2:OpenCTI_Group_2\", ...]\n},\n}\n}\n

    Here is an example of OpenID Groups mapping configuration using environment variables:

    - \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_SCOPE=groups\"\n- \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_PATH=[\\\"groups\\\", \\\"realm_access.groups\\\", \\\"resource_access.account.groups\\\"]\"\n- \"PROVIDERS__OPENID__CONFIG__GROUPS_MANAGEMENT__GROUPS_MAPPING=[\\\"OpenID_Group_1:OpenCTI_Group_1\\\", \\\"OpenID_Group_2:OpenCTI_Group_2\\\", ...]\"\n
    "},{"location":"deployment/authentication/#facebook-button","title":"Facebook (button)","text":"

    This strategy can authenticate your users with Facebook and is based on Passport - Facebook

    \"facebook\": {\n\"identifier\": \"facebook\",\n\"strategy\": \"FacebookStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/facebook/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#google-button","title":"Google (button)","text":"

    This strategy can authenticate your users with Google and is based on Passport - Google

    \"google\": {\n\"identifier\": \"google\",\n\"strategy\": \"GoogleStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/google/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#github-button","title":"GitHub (button)","text":"

    This strategy can authenticate your users with GitHub and is based on Passport - GitHub

    \"github\": {\n\"identifier\": \"github\",\n\"strategy\": \"GithubStrategy\",\n\"config\": {\n\"client_id\": \"XXXXXXXXXXXXXXXXXX\",\n\"client_secret\": \"XXXXXXXXXXXXXXXXXX\",\n\"callback_url\": \"https://opencti.mydomain.com/auth/github/callback\"\n}\n}\n
    "},{"location":"deployment/authentication/#client-certificate-button","title":"Client certificate (button)","text":"

    This strategy can authenticate a user based on SSL client certificates. For this you need to configure your OCTI to start in HTTPS, for example:

    \"port\": 443,\n\"https_cert\": {\n\"key\": \"/cert/server_key.pem\",\n\"crt\": \"/cert/server_cert.pem\",\n\"reject_unauthorized\":true\n}\n

    And then add the ClientCertStrategy:

    \"cert\": {\n\"strategy\":\"ClientCertStrategy\",\n\"config\": {\n\"label\":\"CLIENT CERT\"\n}\n}\n

    Then when accessing for the first time OCTI, the browser will ask for the certificate you want to use.

    "},{"location":"deployment/authentication/#automatically-create-group-on-sso","title":"Automatically create group on SSO","text":"

    The variable auto_create_group can be added in the options of some strategies (LDAP, SAML and OpenID). If this variable is true, the groups of a user that logins will automatically be created if they don\u2019t exist.

    More precisely, if the user that tries to authenticate has groups that don\u2019t exist in OpenCTI but exist in the SSO configuration, there are two cases:

    • if auto_create_group= true in the SSO configuration: the groups are created at the platform initialization and the user will be mapped on them.
    • else: an error is raised.
    "},{"location":"deployment/authentication/#example","title":"Example","text":"

    We assum that Group1 exists in the platform, and newGroup doesn\u2019t exist. The user that tries to log in has the group newGroup. If auto_create_group = true in the SSO configuration, the group named newGroup will be created at the platform initialization and the user will be mapped on it. If auto_create_group = false or is undefined, the user can\u2019t login and an error is raised.

    \"groups_management\": {\n\"group_attribute\": \"cn\",\n\"groups_mapping\": [\"SSO_GROUP_NAME1:group1\", \"SSO_GROUP_NAME_2:newGroup\", ...]\n},\n\"auto_create_group\": true\n
    "},{"location":"deployment/authentication/#examples","title":"Examples","text":""},{"location":"deployment/authentication/#ldap-then-fallback-to-local","title":"LDAP then fallback to local","text":"

    In this example the users have a login form and need to enter login and password. The authentication is done on LDAP first, then locally if user failed to authenticate and finally fail if none of them succeded. Here is an example for the production.json file:

    \"providers\": {\n\"ldap\": {\n\"strategy\": \"LdapStrategy\",\n\"config\": {\n\"url\": \"ldaps://mydc.mydomain.com:636\",\n\"bind_dn\": \"cn=Administrator,cn=Users,dc=mydomain,dc=com\",\n\"bind_credentials\": \"MY_STRONG_PASSWORD\",\n\"search_base\": \"cn=Users,dc=mydomain,dc=com\",\n\"search_filter\": \"(cn={{username}})\",\n\"mail_attribute\": \"mail\",\n\"account_attribute\": \"givenName\"\n}\n},\n\"local\": {\n\"strategy\": \"LocalStrategy\",\n\"config\": {\n\"disabled\": false\n}\n}\n}\n

    If you use a container deployment, here is an example using environment variables:

    - PROVIDERS__LDAP__STRATEGY=LdapStrategy\n- PROVIDERS__LDAP__CONFIG__URL=ldaps://mydc.mydomain.org:636\n- PROVIDERS__LDAP__CONFIG__BIND_DN=cn=Administrator,cn=Users,dc=mydomain,dc=com\n- PROVIDERS__LDAP__CONFIG__BIND_CREDENTIALS=XXXXXXXXXX\n- PROVIDERS__LDAP__CONFIG__SEARCH_BASE=cn=Users,dc=mydomain,dc=com\n- PROVIDERS__LDAP__CONFIG__SEARCH_FILTER=(cn={{username}})\n- PROVIDERS__LDAP__CONFIG__MAIL_ATTRIBUTE=mail\n- PROVIDERS__LDAP__CONFIG__ACCOUNT_ATTRIBUTE=givenName\n- PROVIDERS__LDAP__CONFIG__ALLOW_SELF_SIGNED=true\n- PROVIDERS__LOCAL__STRATEGY=LocalStrategy\n
    "},{"location":"deployment/clustering/","title":"Clustering","text":""},{"location":"deployment/clustering/#introduction","title":"Introduction","text":"

    The OpenCTI platform technological stack has been designed to be able to scale horizontally. All dependencies such as Elastic or Redis can be deployed in cluster mode and performances can be drastically increased by deploying multiple platform and worker instances.

    "},{"location":"deployment/clustering/#high-level-architecture","title":"High level architecture","text":"

    Here is the high level architecture for customers and Filigran cloud platform to ensure both high availability and throughput.

    "},{"location":"deployment/clustering/#configuration","title":"Configuration","text":""},{"location":"deployment/clustering/#dependencies","title":"Dependencies","text":""},{"location":"deployment/clustering/#elasticsearch","title":"ElasticSearch","text":"

    In the ElasticSearch configuration of OpenCTI, it is possible to declare all nodes.

    - \"ELASTICSEARCH__URL=[\\\"https://user:pass@node1:9200\\\", \\\"https://user:pass@node2:9200\\\", ...]\"\n

    Compatibility

    OpenCTI is also compatible with OpenSearch and AWS / GCP / Azure native search services based on the ElasticSearch query language.

    "},{"location":"deployment/clustering/#redis","title":"Redis","text":"

    Redis should be turned to cluster mode:

    - REDIS__MODE=cluster\n- \"REDIS__HOSTNAMES=[\\\"node1:6379\\\", \\\"node2:6379\\\", ...]\"\n

    Compatibility

    OpenCTI is also compatible with ElastiCache, MemoryStore and AWS / GCP / Azure native services based on the Redis protocol.

    "},{"location":"deployment/clustering/#rabbitmq","title":"RabbitMQ","text":"

    For the RabbitMQ cluster, you will need a TCP load balancer on top of the nodes since the configuration does not support multi-nodes for now:

    - RABBITMQ__HOSTNAME=load-balancer-rabbitmq\n

    Compatibility

    OpenCTI is also compatible with Amazon MQ, CloudAMQP and AWS / GCP / Azure native services based on the AMQP protocol.

    "},{"location":"deployment/clustering/#s3-bucket-minio","title":"S3 bucket / MinIO","text":"

    MinIO is an open source server able to serve S3 buckets. It can be deployed in cluster mode and is compatible with several storage backend. OpenCTI is compatible with any tool following the S3 standard.

    "},{"location":"deployment/clustering/#platform","title":"Platform","text":"

    As showed on the schema, best practices for cluster mode and to avoid any congestion in the technological stack are:

    • Deploy platform(s) dedicated to end users and connectors registration
    • Deploy platform(s) dedicated to workers / ingestion process
      • We recommend 3 to 4 workers maxiumum by OpenCTI instance.
      • The ingestion platforms will never be accessed directly by end users.

    When enabling clustering, the number of nodes is displayed in Settings > Parameters.

    "},{"location":"deployment/clustering/#managers-and-schedulers","title":"Managers and schedulers","text":"

    Also, since some managers like the rule engine, the task manager and the notification manager can take some resources in the OpenCTI NodeJS process, it is highly recommended to disable them in the frontend cluster. OpenCTI automatically handle the distribution and the launching of the engines across all nodes in the cluster except where they are explicitely disabled in the configuration.

    "},{"location":"deployment/configuration/","title":"Configuration","text":"

    The purpose of this section is to learn how to configure OpenCTI to have it tailored for your production and development needs.

    Here are the configuration keys, for both containers (environment variables) and manual deployment.

    Parameters equivalence

    The equivalent of a config variable in environment variables is the usage of a double underscores (__) for a level of config.

    For example: 

    \"providers\": {\n\"ldap\": {\n\"strategy\": \"LdapStrategy\"\n}\n}\n

    will become: 

    PROVIDERS__LDAP__STRATEGY=LdapStrategy\n

    If you need to put a list of elements for the key, it must have a special formatting. Here is an example for redirect URIs for OpenID config: 

    \"PROVIDERS__OPENID__CONFIG__REDIRECT_URIS=[\\\"https://demo.opencti.io/auth/oic/callback\\\"]\"\n

    "},{"location":"deployment/configuration/#platform","title":"Platform","text":""},{"location":"deployment/configuration/#api-frontend","title":"API & Frontend","text":""},{"location":"deployment/configuration/#basic-parameters","title":"Basic parameters","text":"Parameter Environment variable Default value Description app:port APP__PORT 4000 Listen port of the application app:base_path APP__BASE_PATH Specific URI (ie. /opencti) app:base_url APP__BASE_URL http://localhost:4000 Full URL of the platform (should include the base_path if any) app:request_timeout APP__REQUEST_TIMEOUT 1200000 Request timeout, in ms (default 20 minutes) app:session_timeout APP__SESSION_TIMEOUT 1200000 Idle timeout, in ms (default 20 minutes) app:session_idle_timeout APP__SESSION_IDLE_TIMEOUT 0 Session timeout, in ms (default 0 minute - disabled) app:admin:email APP__ADMIN__EMAIL admin@opencti.io Default login email of the admin user app:admin:password APP__ADMIN__PASSWORD ChangeMe Default password of the admin user app:admin:token APP__ADMIN__TOKEN ChangeMe Default token (must be a valid UUIDv4)"},{"location":"deployment/configuration/#ssl-tls","title":"SSL / TLS","text":"Parameter Environment variable Default value Description app:https_cert:ca APP__HTTPS_CERT__CA Empty list [] Certificate authority paths or content, only if the client uses a self-signed certificate. app:https_cert:key APP__HTTPS_CERT__KEY Certificate key path or content app:https_cert:crt APP__HTTPS_CERT__CRT Certificate crt path or content app:https_cert:reject_unauthorized APP__HTTPS_CERT__REJECT_UNAUTHORIZED If not false, the server certificate is verified against the list of supplied CAs"},{"location":"deployment/configuration/#logging","title":"Logging","text":""},{"location":"deployment/configuration/#errors","title":"Errors","text":"Parameter Environment variable Default value Description app:app_logs:logs_level APP__APP_LOGS__LOGS_LEVEL info The application log level app:app_logs:logs_files APP__APP_LOGS__LOGS_FILES true If application logs is logged into files app:app_logs:logs_console APP__APP_LOGS__LOGS_CONSOLE true If application logs is logged to console (useful for containers) app:app_logs:logs_max_files APP__APP_LOGS__LOGS_MAX_FILES 7 Maximum number of daily files in logs app:app_logs:logs_directory APP__APP_LOGS__LOGS_DIRECTORY ./logs File logs directory"},{"location":"deployment/configuration/#audit","title":"Audit","text":"Parameter Environment variable Default value Description app:audit_logs:logs_files APP__AUDIT_LOGS__LOGS_FILES true If audit logs is logged into files app:audit_logs:logs_console APP__AUDIT_LOGS__LOGS_CONSOLE true If audit logs is logged to console (useful for containers) app:audit_logs:logs_max_files APP__AUDIT_LOGS__LOGS_MAX_FILES 7 Maximum number of daily files in logs app:audit_logs:logs_directory APP__AUDIT_LOGS__LOGS_DIRECTORY ./logs Audit logs directory"},{"location":"deployment/configuration/#maps-references","title":"Maps & references","text":"Parameter Environment variable Default value Description app:map_tile_server_dark APP__MAP_TILE_SERVER_DARK https://map.opencti.io/styles/luatix-dark/{z}/{x}/{y}.png The address of the OpenStreetMap provider with dark theme style app:map_tile_server_light APP__MAP_TILE_SERVER_LIGHT https://map.opencti.io/styles/luatix-light/{z}/{x}/{y}.png The address of the OpenStreetMap provider with light theme style app:reference_attachment APP__REFERENCE_ATTACHMENT false External reference mandatory attachment"},{"location":"deployment/configuration/#technical-customization","title":"Technical customization","text":"Parameter Environment variable Default value Description app:graphql:playground:enabled APP__GRAPHQL__PLAYGROUND__ENABLED true Enable the playground on /graphql app:graphql:playground:force_disabled_introspection APP__GRAPHQL_PLAYGROUND__FORCE_DISABLED_INTROSPECTION false Introspection is allowed to auth users but can be disabled in needed app:concurrency:retry_count APP__CONCURRENCY__RETRY_COUNT 200 Number of try to get the lock to work an element (create/update/merge, ...) app:concurrency:retry_delay APP__CONCURRENCY__RETRY_DELAY 100 Delay between 2 lock retry (in milliseconds) app:concurrency:retry_jitter APP__CONCURRENCY__RETRY_JITTER 50 Random jitter to prevent concurrent retry (in milliseconds) app:concurrency:max_ttl APP__CONCURRENCY__MAX_TTL 30000 Global maximum time for lock retry (in milliseconds)"},{"location":"deployment/configuration/#dependencies","title":"Dependencies","text":""},{"location":"deployment/configuration/#elasticsearch","title":"ElasticSearch","text":"Parameter Environment variable Default value Description elasticsearch:url ELASTICSEARCH__URL http://localhost:9200 URL(s) of the ElasticSearch (supports http://user:pass@localhost:9200 and list of URLs) elasticsearch:username ELASTICSEARCH__USERNAME Username can be put in the URL or with this parameter elasticsearch:password ELASTICSEARCH__PASSWORD Password can be put in the URL or with this parameter elasticsearch:index_prefix ELASTICSEARCH__INDEX_PREFIX opencti Prefix for the indices elasticsearch:ssl:reject_unauthorized ELASTICSEARCH__SSL__REJECT_UNAUTHORIZED true Enable TLS certificate check elasticsearch:ssl:ca ELASTICSEARCH__SSL__CA Custom certificate path or content elasticsearch:ssl:ca_plain (depecated) ELASTICSEARCH__SSL__CA_PLAIN @depecated, use ca directly"},{"location":"deployment/configuration/#redis","title":"Redis","text":"Parameter Environment variable Default value Description redis:mode REDIS__MODE single Connect to redis \"single\" or \"cluster\" redis:namespace REDIS__NAMESPACE Namespace (to use as prefix) redis:hostname REDIS__HOSTNAME localhost Hostname of the Redis Server redis:hostnames REDIS__HOSTNAMES Hostnames definition for Redis cluster mode: a list of host/port objects. redis:port REDIS__PORT 6379 Port of the Redis Server redis:use_ssl REDIS__USE_SSL false Is the Redis Server has TLS enabled redis:username REDIS__USERNAME Username of the Redis Server redis:password REDIS__PASSWORD Password of the Redis Server redis:ca REDIS__CA Path of the CA certificate redis:trimming REDIS__TRIMMING 2000000 Number of elements to maintain in the stream. (0 = unlimited)"},{"location":"deployment/configuration/#rabbitmq","title":"RabbitMQ","text":"Parameter Environment variable Default value Description rabbitmq:hostname RABBITMQ__HOSTNAME localhost Hostname of the RabbitMQ server rabbitmq:port RABBITMQ__PORT 5672 Port of the RabbitMQ server rabbitmq:port_management RABBITMQ__PORT_MANAGEMENT 15672 Port of the RabbitMQ Management Plugin rabbitmq:username RABBITMQ__USERNAME guest RabbitMQ user rabbitmq:password RABBITMQ__PASSWORD guest RabbitMQ password rabbitmq:queue_type RABBITMQ__QUEUE_TYPE \"classic\" RabbitMQ Queue Type (\"classic\" or \"quorum\") - - - - rabbitmq:use_ssl RABBITMQ__USE_SSL false Use TLS connection rabbitmq:use_ssl_cert RABBITMQ__USE_SSL_CERT Path or cert content rabbitmq:use_ssl_key RABBITMQ__USE_SSL_KEY Path or key content rabbitmq:use_ssl_pfx RABBITMQ__USE_SSL_PFX Path or pfx content rabbitmq:use_ssl_ca RABBITMQ__USE_SSL_CA Path or cacert content rabbitmq:use_ssl_passphrase RABBITMQ__SSL_PASSPHRASE Passphrase for the key certificate rabbitmq:use_ssl_reject_unauthorized RABBITMQ__SSL_REJECT_UNAUTHORIZED false Reject rabbit self signed certificate - - - - rabbitmq:management_ssl RABBITMQ__MANAGEMENT_SSL false Is the Management Plugin has TLS enabled rabbitmq:management_ssl_reject_unauthorized RABBITMQ__SSL_REJECT_UNAUTHORIZED true Reject management self signed certificate"},{"location":"deployment/configuration/#s3-bucket","title":"S3 Bucket","text":"Parameter Environment variable Default value Description minio:endpoint MINIO__ENDPOINT localhost Hostname of the S3 Service minio:port MINIO__PORT 9000 Port of the S3 Service minio:use_ssl MINIO__USE_SSL false Is the S3 Service has TLS enabled minio:access_key MINIO__ACCESS_KEY ChangeMe The S3 Service access key minio:secret_key MINIO__SECRET_KEY ChangeMe The S3 Service secret key minio:bucket_name MINIO__BUCKET_NAME opencti-bucket The S3 bucket name (useful to change if you use AWS) minio:bucket_region MINIO__BUCKET_REGION us-east-1 The S3 bucket region if you use AWS minio:use_aws_role MINIO__USE_AWS_ROLE false To use AWS role auto credentials"},{"location":"deployment/configuration/#smtp-service","title":"SMTP Service","text":"Parameter Environment variable Default value Description smtp:hostname SMTP__HOSTNAME SMTP Server hostname smtp:port SMTP__PORT 9000 SMTP Port (25 or 465 for TLS) smtp:use_ssl SMTP__USE_SSL false SMTP over TLS smtp:reject_unauthorized SMTP__REJECT_UNAUTHORIZED false Enable TLS certificate check smtp:username SMTP__USERNAME SMTP Username if authentication is needed smtp:password SMTP__PASSWORD SMTP Password if authentication is needed smtp:from_email SMTP__FROM_EMAIL notifications@opencti.io Sender email address"},{"location":"deployment/configuration/#schedules-engines","title":"Schedules & Engines","text":"Parameter Environment variable Default value Description rule_engine:enabled RULE_ENGINE__ENABLED true Enable/disable the rule engine rule_engine:lock_key RULE_ENGINE__LOCK_KEY rule_engine_lock Lock key of the engine in Redis - - - - history_manager:enabled HISTORY_MANAGER__ENABLED true Enable/disable the history manager history_manager:lock_key HISTORY_MANAGER__LOCK_KEY history_manager_lock Lock key for the manager in Redis - - - - task_scheduler:enabled TASK_SCHEDULER__ENABLED true Enable/disable the task scheduler task_scheduler:lock_key TASK_SCHEDULER__LOCK_KEY task_manager_lock Lock key for the scheduler in Redis task_scheduler:interval TASK_SCHEDULER__INTERVAL 10000 Interval to check new task to do (in ms) - - - - sync_manager:enabled SYNC_MANAGER__ENABLED true Enable/disable the sync manager sync_manager:lock_key SYNC_MANAGER__LOCK_KEY sync_manager_lock Lock key for the manager in Redis sync_manager:interval SYNC_MANAGER__INTERVAL 10000 Interval to check new sync feeds to consume (in ms) - - - - expiration_scheduler:enabled EXPIRATION_SCHEDULER__ENABLED true Enable/disable the scheduler expiration_scheduler:lock_key EXPIRATION_SCHEDULER__LOCK_KEY expired_manager_lock Lock key for the scheduler in Redis expiration_scheduler:interval EXPIRATION_SCHEDULER__INTERVAL 300000 Interval to check expired indicators - - - - retention_manager:enabled RETENTION_MANAGER__ENABLED true Enable/disable the manager retention_manager:lock_key RETENTION_MANAGER__LOCK_KEY retention_manager_lock Lock key for the manager in Redis retention_manager:interval RETENTION_MANAGER__INTERVAL 60000 Interval to check items to be deleted - - - - notification_manager:enabled NOTIFICATION_MANAGER__ENABLED true Enable/disable the notification manager notification_manager:lock_key NOTIFICATION_MANAGER__LOCK_KEY notification_manager_lock Lock key for the manager in Redis notification_manager:interval NOTIFICATION_MANAGER__INTERVAL 10000 Sender email address - - - - publisher_manager:enabled PUBLISHER_MANAGER__ENABLED true Enable/disable the publisher manager publisher_manager:lock_key PUBLISHER_MANAGER__LOCK_KEY publisher_manager_lock Sender email address publisher_manager:interval PUBLISHER_MANAGER__INTERVAL 10000 Sender email address

    Default file

    It is possible to check all default parameters implemented in the platform in the default.json file.

    "},{"location":"deployment/configuration/#worker-and-connector","title":"Worker and connector","text":"

    Can be configured manually using the configuration file config.yml or through environment variables.

    Parameter Environment variable Default value Description opencti:url OPENCTI_URL The URL of the OpenCTI platform opencti:token OPENCTI_TOKEN A token of an administrator account with bypass capability - - - - mq:use_ssl / / Depending of the API configuration (fetch from API) mq:use_ssl_ca MQ_USE_SSL_CA Path or cacert content mq:use_ssl_cert MQ_USE_SSL_CERT Path or cert content mq:use_ssl_key MQ_USE_SSL_KEY Path or key content mq:use_ssl_passphrase MQ_USE_SSL_PASSPHRASE Passphrase for the key certificate mq:use_ssl_reject_unauthorized MQ_USE_SSL_REJECT_UNAUTHORIZED false Reject rabbit self signed certificate"},{"location":"deployment/configuration/#worker-specific-configuration","title":"Worker specific configuration","text":"Parameter Environment variable Default value Description worker:log_level WORKER_LOG_LEVEL info The log level (error, warning, info or debug)"},{"location":"deployment/configuration/#connector-specific-configuration","title":"Connector specific configuration","text":"

    For specific connector configuration, you need to check each connector behavior.

    "},{"location":"deployment/configuration/#elasticsearch_1","title":"ElasticSearch","text":"

    If you want to adapt the memory consumption of ElasticSearch, you can use theses options:

    # Add the following environment variable:\n\"ES_JAVA_OPTS=-Xms8g -Xmx8g\"\n

    This can be done in configuration file in the jvm.conf file.

    "},{"location":"deployment/connectors/","title":"Connectors","text":""},{"location":"deployment/connectors/#introduction","title":"Introduction","text":"

    Connectors list

    You are looking for the available connectors? The list is in the OpenCTI Ecosystem.

    Connectors are the cornerstone of the OpenCTI platform and allow organizations to easily ingest, enrich or export data in the platform. According to their functionality and use case, they are categorized in following classes.

    "},{"location":"deployment/connectors/#import","title":"Import","text":"

    These connectors automatically retrieve information from an external organization, application or service, convert it to STIX 2.1 bundles and import it into OpenCTI using the workers.

    "},{"location":"deployment/connectors/#enrichment","title":"Enrichment","text":"

    When a new object is created in the platform or on the user request, it is possible to trigger the internal enrichment connector to lookup and/or search the object in external organizations, applications or services. If the object is found, the connectors will generate a STIX 2.1 bundle which will increase the level of knowledge about the concerned object.

    "},{"location":"deployment/connectors/#stream","title":"Stream","text":"

    These connectors connect to a platform data stream and continously do something with the received events. In most cases, they are used to consume OpenCTI data and insert them in third-party platforms such as SIEMs, XDRs, EDRS, etc. In some cases, stream connectors can also query the external system on a regular basis and act as import connector for instance to gather alerts and sightings related to CTI data and push them to OpenCTI (bi-directional).

    "},{"location":"deployment/connectors/#import-files","title":"Import files","text":"

    Information from an uploaded file can be extracted and ingested into OpenCTI. Examples are files attached to a report or a STIX 2.1 file.

    "},{"location":"deployment/connectors/#export-files","title":"Export files","text":"

    Information stored in OpenCTI can be extracted into different file formats like .csv or .json (STIX 2).

    "},{"location":"deployment/connectors/#connector-configuration","title":"Connector configuration","text":"

    All connectors have to be able to access to the OpenCTI API. To allow this connection, they have 2 mandatory configuration parameters, the OPENCTI_URL and the OPENCTI_TOKEN. In addition of these 2 parameters, connectors have other mandatory parameters that need to be set in order to get them work.

    Connectors tokens

    Be careful, we strongly recommend to use a dedicated token for each connector running in the platform. So you have to create a specific user for each of them.

    Also, if all connectors users can run in with a user belonging to the Connectors group (with the Connector role), the Internal Export Files should be run with a user who is Administrator (with bypass capability) because they imperstonate the user requesting the export to avoid data leak.

    Type Required role Used permissions EXTERNAL_IMPORT Connector Import data with the connector user. INTERNAL_ENRICHMENT Connector Enrich data with the connector user. INTERNAL_IMPORT_FILE Connector Import data with the connector user. INTERNAL_EXPORT_FILE Administrator Export data with the user who requested the export. STREAM Connector Consume the streams the connector user.

    Here is an example of a connector docker-compose.yml file: 

    - CONNECTOR_ID=ChangeMe\n- CONNECTOR_TYPE=EXTERNAL_IMPORT\n- CONNECTOR_NAME=MITRE ATT&CK\n- CONNECTOR_SCOPE=identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report\n- CONNECTOR_CONFIDENCE_LEVEL=3\n- CONNECTOR_UPDATE_EXISTING_DATA=true\n- CONNECTOR_LOG_LEVEL=info\n

    Here is an example in a connector config.yml file:

    -connector:\nid: 'ChangeMe'\ntype: 'EXTERNAL_IMPORT'\nname: 'MITRE ATT&CK'\nscope: 'identity,attack-pattern,course-of-action,intrusion-set,malware,tool,report'\nconfidence_level: 3\nupdate_existing_data: true\nlog_level: 'info'\n
    "},{"location":"deployment/connectors/#networking","title":"Networking","text":"

    Be aware that all connectors are reaching RabbitMQ based the RabbitMQ configuration provided by the OpenCTI platform. The connector must be able to reach RabbitMQ on the specified hostname and port. If you have a specific Docker network configuration, please be sure to adapt your docker-compose.yml file in such way that the connector container gets attached to the OpenCTI Network, e.g.:

    networks:\ndefault:\nexternal: true\nname: opencti-docker_default\n
    "},{"location":"deployment/connectors/#connector-token","title":"Connector token","text":""},{"location":"deployment/connectors/#create-the-user","title":"Create the user","text":"

    As mentionned previously, it is strongly recommended to run each connector with its own user. The Internal Export File connectors should be launched with a user that belongs to a group which has an \u201cAdministrator\u201d role (with bypass all capabilities enabled).

    By default in platform, a group named \"Connectors\" already exists. So just create a new user with the name [C] Name of the connector in Settings > Security > Users.

    "},{"location":"deployment/connectors/#put-the-user-in-the-group","title":"Put the user in the group","text":"

    Just go to the user you have just created and add it to the Connectors group.

    Then just get the token of the user displayed in the interface.

    "},{"location":"deployment/connectors/#docker-activation","title":"Docker activation","text":"

    You can either directly run the Docker image of connectors or add them to your current docker-compose.yml file.

    "},{"location":"deployment/connectors/#add-a-connector-to-your-deployment","title":"Add a connector to your deployment","text":"

    For instance, to enable the MISP connector, you can add a new service to your docker-compose.yml file:

      connector-misp:\n    image: opencti/connector-misp:latest\n    environment:\n      - OPENCTI_URL=http://localhost\n      - OPENCTI_TOKEN=ChangeMe\n      - CONNECTOR_ID=ChangeMe\n      - CONNECTOR_TYPE=EXTERNAL_IMPORT\n      - CONNECTOR_NAME=MISP\n      - CONNECTOR_SCOPE=misp\n      - CONNECTOR_CONFIDENCE_LEVEL=3\n- CONNECTOR_UPDATE_EXISTING_DATA=false\n      - CONNECTOR_LOG_LEVEL=info\n      - MISP_URL=http://localhost # Required\n      - MISP_KEY=ChangeMe # Required\n      - MISP_SSL_VERIFY=False # Required\n      - MISP_CREATE_REPORTS=True # Required, create report for MISP event\n      - MISP_REPORT_CLASS=MISP event # Optional, report_class if creating report for event\n      - MISP_IMPORT_FROM_DATE=2000-01-01 # Optional, import all event from this date\n      - MISP_IMPORT_TAGS=opencti:import,type:osint # Optional, list of tags used for import events\n      - MISP_INTERVAL=1 # Required, in minutes\n    restart: always\n
    "},{"location":"deployment/connectors/#launch-a-standalone-connector","title":"Launch a standalone connector","text":"

    To launch standalone connector, you can use the docker-compose.yml file of the connector itself. Just download the latest release and start the connector:

    $ wget https://github.com/OpenCTI-Platform/connectors/archive/{RELEASE_VERSION}.zip\n$ unzip {RELEASE_VERSION}.zip\n$ cd connectors-{RELEASE_VERSION}/misp/\n

    Change the configuration in the docker-compose.yml according to the parameters of the platform and of the targeted service. Then launch the connector:

    $ docker-compose up\n
    "},{"location":"deployment/connectors/#manual-activation","title":"Manual activation","text":"

    If you want to manually launch connector, you just have to install Python 3 and pip3 for dependencies:

    $ apt install python3 python3-pip\n

    Download the release of the connectors:

    $ wget <https://github.com/OpenCTI-Platform/connectors/archive/{RELEASE_VERSION}.zip>\n$ unzip {RELEASE_VERSION}.zip\n$ cd connectors-{RELEASE_VERSION}/misp/src/\n

    Install dependencies and initialize the configuration:

    $ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n

    Change the config.yml content according to the parameters of the platform and of the targeted service and launch the connector:

    $ python3 misp.py\n
    "},{"location":"deployment/connectors/#connectors-status","title":"Connectors status","text":"

    The connector status can be displayed in the dedicated section of the platform available in Data > Connectors. You will be able to see the statistics of the RabbitMQ queue of the connector:

    Problem

    If you encounter problems deploying OpenCTI or connectors, you can consult the troubleshooting page page.

    "},{"location":"deployment/installation/","title":"Installation","text":"

    All components of OpenCTI are shipped both as Docker images and manual installation packages.

    Production deployment

    For production deployment, we recommend to deploy all components in containers, including dependencies, using native cloud services or orchestration systems such as Kubernetes.

    To have more details about deploying OpenCTI and its dependencies in cluster mode, please read the dedicated section.

    • Use Docker

      Deploy OpenCTI using Docker and the default docker-compose.yml provided in the docker.

      Setup

    • Manual installation

      Deploy dependencies and launch the platform manually using the packages released in the GitHub releases.

      Explore

    "},{"location":"deployment/installation/#using-docker","title":"Using Docker","text":""},{"location":"deployment/installation/#introduction","title":"Introduction","text":"

    OpenCTI can be deployed using the docker-compose command.

    "},{"location":"deployment/installation/#pre-requisites","title":"Pre-requisites","text":"

    Linux

    $ sudo apt install docker-compose\n

    Windows and MacOS

    Just download the appropriate Docker for Desktop version for your operating system.

    "},{"location":"deployment/installation/#clone-the-repository","title":"Clone the repository","text":"

    Docker helpers are available in the Docker GitHub repository.

    $ mkdir -p /path/to/your/app && cd /path/to/your/app\n$ git clone https://github.com/OpenCTI-Platform/docker.git\n$ cd docker\n
    "},{"location":"deployment/installation/#configure-the-environment","title":"Configure the environment","text":"

    Before running the docker-compose command, the docker-compose.yml file should be configured. By default, the docker-compose.yml file is using environment variables available in the file .env.sample.

    You can either rename the file .env.sample in .env and put the expected values or just fill directly the docker-compose.yml with the values corresponding to your environment.

    Configuration static parameters

    The complete list of available static parameters is available in the configuration section.

    Here is an example to quickly generate the .env file under Linux, especially all the default UUIDv4:

    $ sudo apt install -y jq\n$ cd ~/docker\n$ (cat << EOF\nOPENCTI_ADMIN_EMAIL=admin@opencti.io\nOPENCTI_ADMIN_PASSWORD=ChangeMePlease\nOPENCTI_ADMIN_TOKEN=$(cat /proc/sys/kernel/random/uuid)\nMINIO_ROOT_USER=$(cat /proc/sys/kernel/random/uuid)\nMINIO_ROOT_PASSWORD=$(cat /proc/sys/kernel/random/uuid)\nRABBITMQ_DEFAULT_USER=guest\nRABBITMQ_DEFAULT_PASS=guest\nELASTIC_MEMORY_SIZE=4G\nCONNECTOR_HISTORY_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_EXPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_EXPORT_FILE_CSV_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_IMPORT_FILE_STIX_ID=$(cat /proc/sys/kernel/random/uuid)\nCONNECTOR_IMPORT_REPORT_ID=$(cat /proc/sys/kernel/random/uuid)\nEOF\n) > .env\n

    If your docker-compose deployment does not support .env files, just export all environment variables before launching the platform:

    $ export $(cat .env | grep -v \"#\" | xargs)\n
    "},{"location":"deployment/installation/#memory-management-settings","title":"Memory management settings","text":"

    As OpenCTI has a dependency on ElasticSearch, you have to set the vm.max_map_count before running the containers, as mentioned in the ElasticSearch documentation.

    $ sudo sysctl -w vm.max_map_count=1048575\n

    To make this parameter persistent, add the following to the end of your /etc/sysctl.conf:

    $ vm.max_map_count=1048575\n
    "},{"location":"deployment/installation/#persist-data","title":"Persist data","text":"

    The default for OpenCTI data is to be persistent.

    In the docker-compose.yml, you will find at the end the list of necessary persitent volumes for the dependencies:

    volumes:\nesdata:     # ElasticSearch data\ns3data:     # S3 bucket data\nredisdata:  # Redis data\namqpdata:   # RabbitMQ data\n
    "},{"location":"deployment/installation/#run-opencti","title":"Run OpenCTI","text":""},{"location":"deployment/installation/#using-single-node-docker","title":"Using single node Docker","text":"

    After changing your .env file run docker-compose in detached (-d) mode:

    $ sudo systemctl start docker.service\n# Run docker-compose in detached \n$ docker-compose up -d\n
    "},{"location":"deployment/installation/#using-docker-swarm","title":"Using Docker swarm","text":"

    In order to have the best experience with Docker, we recommend using the Docker stack feature. In this mode you will have the capacity to easily scale your deployment. 

    # If your virtual machine is not a part of a Swarm cluster, please use:\n$ docker swarm init\n

    Put your environment variables in /etc/environment:

    # If you already exported your variables to .env from above:\n$ sudo cat .env >> /etc/environment\n$ sudo bash -c 'cat .env >> /etc/environment\u2019\n$ sudo docker stack deploy --compose-file docker-compose.yml opencti\n

    Installation done

    You can now go to http://localhost:8080 and log in with the credentials configured in your environment variables.

    "},{"location":"deployment/installation/#manual-installation","title":"Manual installation","text":""},{"location":"deployment/installation/#prerequisites","title":"Prerequisites","text":""},{"location":"deployment/installation/#prepare-the-installation","title":"Prepare the installation","text":""},{"location":"deployment/installation/#installation-of-dependencies","title":"Installation of dependencies","text":"

    You have to install all the needed dependencies for the main application and the workers. The example below is for Debian-based systems:

    $ sudo apt-get install build-essential nodejs npm python3 python3-pip python3-dev\n
    "},{"location":"deployment/installation/#download-the-application-files","title":"Download the application files","text":"

    First, you have to download and extract the latest release file. Then select the version to install depending of your operating system:

    For Linux:

    • If your OS supports libc (Ubuntu, Debian, ...) you have to install the opencti-release_{RELEASE_VERSION}.tar.gz version.
    • If your OS uses musl (Alpine, ...) you have to install the opencti-release-{RELEASE_VERSION}_musl.tar.gz version.

    For Windows:

    We don't provide any Windows release for now. However it is still possible to check the code out, manually install the dependencies and build the software.

    $ mkdir /path/to/your/app && cd /path/to/your/app\n$ wget <https://github.com/OpenCTI-Platform/opencti/releases/download/{RELEASE_VERSION}/opencti-release-{RELEASE_VERSION}.tar.gz>\n$ tar xvfz opencti-release-{RELEASE_VERSION}.tar.gz\n
    "},{"location":"deployment/installation/#install-the-main-platform","title":"Install the main platform","text":""},{"location":"deployment/installation/#configure-the-application","title":"Configure the application","text":"

    The main application has just one JSON configuration file to change and a few Python modules to install

    $ cd opencti\n$ cp config/default.json config/production.json\n

    Change the config/production.json file according to your configuration of ElasticSearch, Redis, RabbitMQ and S3 bucket as well as default credentials (the ADMIN_TOKEN must be a valid UUID).

    "},{"location":"deployment/installation/#install-the-python-modules","title":"Install the Python modules","text":"
    $ cd src/python\n$ pip3 install -r requirements.txt\n$ cd ../..\n
    "},{"location":"deployment/installation/#start-the-application","title":"Start the application","text":"

    The application is just a NodeJS process, the creation of the database schema and the migration will be done at starting.

    $ yarn install\n$ yarn build\n$ yarn serv\n

    The default username and password are those you have put in the config/production.json file.

    "},{"location":"deployment/installation/#install-the-worker","title":"Install the worker","text":"

    The OpenCTI worker is used to write the data coming from the RabbitMQ messages broker.

    "},{"location":"deployment/installation/#configure-the-worker","title":"Configure the worker","text":"
    $ cd worker\n$ pip3 install -r requirements.txt\n$ cp config.yml.sample config.yml\n

    Change the config.yml file according to your OpenCTI token.

    "},{"location":"deployment/installation/#start-as-many-workers-as-you-need","title":"Start as many workers as you need","text":"
    $ python3 worker.py &\n$ python3 worker.py &\n

    Installation done

    You can now go to http://localhost:4000 and log in with the credentials configured in your production.json file.

    "},{"location":"deployment/installation/#appendix","title":"Appendix","text":""},{"location":"deployment/installation/#community-contributions","title":"Community contributions","text":""},{"location":"deployment/installation/#terraform","title":"Terraform","text":"

    • Multi-clouds Terraform scripts

      This repository is here to provide you with a quick and easy way to deploy an OpenCTI instance in the cloud (AWS, Azure, or GCP).

      GitHub Respository

    • AWS Advanced Terraform scripts

      A Terraform deployment of OpenCTI designed to make use of native AWS Resources (where feasible). This includes AWS ECS Fargate, AWS OpenSearch, etc.

      GitHub Repository

    "},{"location":"deployment/installation/#helm-charts","title":"Helm Charts","text":"

    • Kubernetes Helm Charts

      OpenCTI Helm Charts (may be out of date) for Kubernetes with a global configuration file.

      GitHub Repository

    "},{"location":"deployment/installation/#deploy-behind-a-reverse-proxy","title":"Deploy behind a reverse proxy","text":"

    If you want to use OpenCTI behind a reverse proxy with a context path, like https://domain.com/opencti, please change the base_path static parameter.

    • APP__BASE_PATH=/opencti

    By default OpenCTI use websockets so don't forget to configure your proxy for this usage, an example with Nginx:

    location / {\nproxy_cache                 off;\nproxy_buffering             off;\nproxy_http_version          1.1;\nproxy_set_header Upgrade    $http_upgrade;\nproxy_set_header Connection \"upgrade\";\nproxy_set_header Host       $host;\nchunked_transfer_encoding   off;\nproxy_pass                  http://YOUR_UPSTREAM_BACKEND;\n}\n
    "},{"location":"deployment/installation/#additional-memory-information","title":"Additional memory information","text":""},{"location":"deployment/installation/#platform","title":"Platform","text":"

    OpenCTI platform is based on a NodeJS runtime, with a memory limit of 8GB by default. If you encounter OutOfMemory exceptions, this limit could be changed:

    - NODE_OPTIONS=--max-old-space-size=8096\n
    "},{"location":"deployment/installation/#workers-and-connectors","title":"Workers and connectors","text":"

    OpenCTI workers and connectors are Python processes. If you want to limit the memory of the process, we recommend to directly use Docker to do that. You can find more information in the official Docker documentation.

    "},{"location":"deployment/installation/#elasticsearch","title":"ElasticSearch","text":"

    ElasticSearch is also a JAVA process. In order to setup the JAVA memory allocation, you can use the environment variable ES_JAVA_OPTS. You can find more information in the official ElasticSearch documentation.

    "},{"location":"deployment/installation/#redis","title":"Redis","text":"

    Redis has a very small footprint on keys but will consume memory for the stream. By default the size of the stream is limited to 2 millions which represents a memory footprint around 8 GB. You can find more information in the Redis docker hub.

    "},{"location":"deployment/installation/#minio-s3-bucket","title":"MinIO / S3 Bucket","text":"

    MinIO is a small process and does not require a high amount of memory. More information are available for Linux here on the Kernel tuning guide.

    "},{"location":"deployment/installation/#rabbitmq","title":"RabbitMQ","text":"

    The RabbitMQ memory configuration can be find in the RabbitMQ official documentation. RabbitMQ will consumed memory until a specific threshold, therefore it should be configure along with the Docker memory limitation.

    "},{"location":"deployment/integrations/","title":"Integrations","text":""},{"location":"deployment/integrations/#introduction","title":"Introduction","text":"

    OpenCTI supports multiple ways to integrate with other systems which do not have native connectors or plugins to the platform. Here are the technical features available to ease the connection and the integration of the platform with other applications.

    Connectors list

    If you are looking to the list of OpenCTI connectors or native integration, please check the OpenCTI Ecosystem.

    "},{"location":"deployment/integrations/#native-feeds-and-streams","title":"Native feeds and streams","text":"

    To ease integrations with other products, OpenCTI has built-in capabilities to deliver the data to third-parties.

    "},{"location":"deployment/integrations/#csv-feeds","title":"CSV Feeds","text":"

    It is possible to create as many CSV feeds as needed, based on filters and accessible in HTTP. CSV feeds are available in Data > Data sharing > Feeds (CSV).

    When creating a CSV feed, you need to select one or multiple types of entity to make available. For all columns available in the CSV, you've to select which field will be used for each type of entity:

    Details

    For more information about CSV feeds, filters and configuration, please check the Export in structured format section.

    "},{"location":"deployment/integrations/#taxii-collections","title":"TAXII collections","text":"

    Most of the moden cybersecurity systems such as SIEMs, EDRs, XDRs and even firewalls supports the TAXII protocol which is basically a paginated HTTP STIX feed. OpenCTI implements a TAXII 2.1 server with the ability to create as many TAXII collections as needed in Data > Data sharing > TAXII Collections?

    TAXII collections are a sub-selection of the knowledge available in the platform and relie on filters. For instance, it is possible to create TAXII collections for pieces of malware with a given label, for indicators with a score greater than n, etc.

    "},{"location":"deployment/integrations/#http-streams","title":"HTTP Streams","text":"

    After implementing CSV feeds and TAXII collections, we figured out that those 2 stateless APIs are definitely not enough when it comes to tackle advanced information sharing challenges such as:

    • Real time transmission of the information (ie. avoid hundreds of systems to pull data every 5 minutes).
    • Dependencies resolution (ie. an intrusion created by an organization but the organization is not in the TAXII collection).
    • Partial update for huge entities such as report (ie. just having the update event).
    • Delete events when necessary (ie. to handle indicators expiration in third party systems for instance).

    Live streams are available in Data > Data sharing > Live streams. As TAXII collections, it is possible to create as many streams as needed using filters.

    Streams implement the HTTP SSE (Server-sent events) protocol and give applications to consume a real time pure STIX 2.1 stream. Stream connectors in the OpenCTI Ecosystem are using live streams to consume data and do something such as create / update / delete information in SIEMs, XDRs, etc.

    "},{"location":"deployment/integrations/#authentication","title":"Authentication","text":"

    For all previously explained capabilities, as they are over the HTTP protocol, 3 authentication mechanisms are available to consume them.

    1. Using a bearer header with your OpenCTI API key

      Authorization: Bearer a17bc103-8420-4208-bd53-e1f80845d15f\n

      API Key

      Your API key can be found in your profile available clicking on the top right icon.

    2. Using basic authentication

      Username: Your platform username\nPassword: Your plafrom password\nAuthorization: Basic c2FtdWVsLmhhc3NpbmVBZmlsaWdyYW4uaW86TG91aXNlMTMwNCM=\n

    3. Using client certificate authentication

      To know how to configure the client certificate authentication, please consult the authentication configuration section.

    "},{"location":"deployment/integrations/#api-and-libraries","title":"API and libraries","text":""},{"location":"deployment/integrations/#graphql-api","title":"GraphQL API","text":"

    To allow analysts and developers to implement more custom or complex use cases, a full GraphQL API is available in the application on the /graphql endpoint.

    The API can be queried using various GraphQL client such as Postman but you can leverage any HTTP client to forge GraphQL queries using POST methods.

    "},{"location":"deployment/integrations/#authentication_1","title":"Authentication","text":"

    The API authentication can be performed using the token of a user and a classic Authorization header:

    Content-Type: application/json\nAuthorization: Bearer 6b6554c4-bb2c-4c80-9cd3-30288c8bf424\n
    "},{"location":"deployment/integrations/#playground","title":"Playground","text":"

    The playground is available on the /graphql endpoint. A link button is also available in the profile of your user.

    All the schema documentation is directly available in the playground.

    If you already logged to OpenCTI with the same browser you should be able to directly do some requests. If you are not authenticated or want to authenticate only through the playground you can use a header configuration using your profile token

    Example of configuration (bottom left of the playground):

    "},{"location":"deployment/integrations/#python-library","title":"Python library","text":"

    Since not everyone is familiar with GraphQL APIs, we've developed a Python library to ease the interaction with it. The library is pretty easy to use. To initiate the client:

    # coding: utf-8\nfrom pycti import OpenCTIApiClient\n# Variables\napi_url = \"http://opencti:4000\"\napi_token = \"bfa014e0-e02e-4aa6-a42b-603b19dcf159\"\n# OpenCTI initialization\nopencti_api_client = OpenCTIApiClient(api_url, api_token)\n

    Then just use the available helpers: 

    # Search for malware with the keyword \"windows\"\nmalwares = opencti_api_client.malware.list(search=\"windows\")\n# Print\nprint(malwares)\n

    Details

    For more detailed information about the Python library, please read the dedicated section.

    "},{"location":"deployment/overview/","title":"Overview","text":"

    Before starting the installation, let's discover how OpenCTI is working, which dependencies are needed and what are the minimal requirements to deploy it in production.

    "},{"location":"deployment/overview/#architecture","title":"Architecture","text":"

    The OpenCTI platform relies on several external databases and services in order to work.

    "},{"location":"deployment/overview/#platform","title":"Platform","text":"

    The platform is the central part of the OpenCTI technological stack. It allows users to access to the user interface but also provides the GraphQL API used by connectors and workers to insert data. In the context of a production deployment, you may need to scale horizontally and launch multiple platforms behind a load balancer connected to the same databases (ElasticSearch, Redis, S3, RabbitMQ).

    "},{"location":"deployment/overview/#workers","title":"Workers","text":"

    The workers are standalone Python processes consuming messages from the RabbitMQ broker in order to do asynchronous write queries. You can launch as many workers as you need to increase the write performances. At some point, the write performances will be limited by the throughput of the ElasticSearch database cluster.

    Number of workers

    If you need to increase performances, it is better to launch more platforms to handle worker queries. The recommended setup is to have at least one platform for 3 workers (ie. 9 workers distributed over 3 platforms).

    "},{"location":"deployment/overview/#connectors","title":"Connectors","text":"

    The connectors are third-party pieces of software (Python processes) that can play five different roles on the platform:

    Type Description Examples EXTERNAL_IMPORT Pull data from remote sources, convert it to STIX2 and insert it on the OpenCTI platform. MITRE Datasets, MISP, CVE, AlienVault, Mandiant, etc. INTERNAL_ENRICHMENT Listen for new OpenCTI entities or users requests, pull data from remote sources to enrich. Shodan, DomainTools, IpInfo, etc. INTERNAL_IMPORT_FILE Extract data from files uploaded on OpenCTI trough the UI or the API. STIX 2.1, PDF, Text, HTML, etc. INTERNAL_EXPORT_FILE Generate export from OpenCTI data, based on a single object or a list. STIX 2.1, CSV, PDF, etc. STREAM Consume a platform data stream an do something with events. Splunk, Elastic Security, Q-Radar, etc.

    List of connectors

    You can find all currently available connector in the OpenCTI Ecosystem.

    "},{"location":"deployment/overview/#infrastructure-requirements","title":"Infrastructure requirements","text":""},{"location":"deployment/overview/#dependencies","title":"Dependencies","text":"Component CPU RAM Disk type Disk space ElasticSearch 2 cores \u2265 8GB SSD \u2265 16GB Redis 1 core \u2265 1GB SSD \u2265 16GB RabbitMQ 1 core \u2265 512MB Standard \u2265 2GB S3 / MinIO 1 core \u2265 128MB SSD \u2265 16GB"},{"location":"deployment/overview/#platform_1","title":"Platform","text":"Component CPU RAM Disk type Disk space OpenCTI Core 2 cores \u2265 8GB None (stateless) - Worker(s) 1 core \u2265 128MB None (stateless) - Connector(s) 1 core \u2265 128MB None (stateless) -

    Clustering

    To have more details about deploying OpenCTI and its dependencies in cluster mode, please read the dedicated section.

    "},{"location":"deployment/resources/","title":"Other resources","text":""},{"location":"deployment/resources/#introduction","title":"Introduction","text":"

    OpenCTI is an open and modular platform. A lot of connectors, plugins and clients are created by Filigran and community. You can find here other resources available to complete your OpenCTI journey.

    "},{"location":"deployment/resources/#videos-training","title":"Videos & training","text":"

    • YouTube channel

      Watch demonstration videos, use case explanations, customers and community testimonies and past webinars.

      Watch

    • Training courses

      Empower your journey with OpenCTI training courses for both analyst and administrators and get your certifcate.

      Learn

    "},{"location":"deployment/resources/#articles-news","title":"Articles & news","text":"

    • Blog articles

      Read posts written by both Filigran teams and community members about OpenCTI features and use cases.

      Read

    • Newsletters

      Subscribe to Filigran newsletters to get informed about the latest evolutions of our product ecosystems.

      Subscribe

    "},{"location":"deployment/resources/#analysis","title":"Analysis","text":"

    • Verticalized threat landcapes

      Access to monthly sectorial analysis from our experts team based on knowledge and data collected by our partners.

      Consult

    • Case studies

      Explore the Filigran case studies about stories and usages of the platform among our communities and customers.

      Download

    "},{"location":"deployment/rollover/","title":"Indices and rollover policies","text":""},{"location":"deployment/rollover/#introduction","title":"Introduction","text":"

    ElasticSearch and OpenSearch both support rollover on indices. OpenCTI has been designed to be able to use aliases for indices and so support very well index lifeycle policies.

    Thus, by default OpenCTI initialized indices with a suffix -00001 and use wildcard to query indices. When rollover policies are implemented, indices are splitted to keep a reasonable volume of data in shards.

    "},{"location":"deployment/rollover/#elasticsearch-configuration","title":"ElasticSearch configuration","text":""},{"location":"deployment/rollover/#indices","title":"Indices","text":"

    We advise to put a rollover policy on all indices used by OpenCTI, here is the list:

    • opencti_history
    • opencti_inferred_entities
    • opencti_inferred_relationships
    • opencti_internal_objects
    • opencti_internal_relationships
    • opencti_stix_core_relationships
    • opencti_stix_cyber_observable_relationships
    • opencti_stix_cyber_observables
    • opencti_stix_domain_objects
    • opencti_stix_meta_objects
    • opencti_stix_meta_relationships

    For your information, the indices which can grow rapidly are:

    • Index opencti_stix_meta_relationships: it contains all the nested relationships between objects and labels / marking definitions / external references / authors, etc.
    • Index opencti_history: it contains the history log of all objects in the platform.
    • Index opencti_stix_cyber_observables: it contains all observables stored in the platform.
    • Index opencti_stix_core_relationships: it contains all main STIX relationships stored in the platform.
    "},{"location":"deployment/rollover/#licecycle-policy","title":"Licecycle policy","text":"

    Here is n example of policy:

    • Maximum primary shard size: 50 GB
    • Maximum docs in the primary shard: 25,000,000
    • Maximum age: 365 days
    • Maximum documents: 50,000,000

    Then, apply this policy automatically to all opencti_* indices.

    Rollover documentation

    To have more details about automatic rollover and lifecycle policies, please read the official ElasticSearch documentation.

    "},{"location":"deployment/troubleshooting/","title":"Troubleshooting","text":"

    This page aims to explains the typical errors you can have with your OpenCTI platform.

    "},{"location":"deployment/troubleshooting/#finding-the-relevant-logs","title":"Finding the relevant logs","text":"

    It is highly recommended to monitor the error logs of the platforms, workers and connectors. All the components have log outputs in an understandable JSON format. It necessary, it is always possible to increase the log level. In production, it is recommended to have the log level set to error.

    "},{"location":"deployment/troubleshooting/#platform","title":"Platform","text":"

    Here are some useful parameters for platform logging:

    - APP__APP_LOGS__LOGS_LEVEL=[error|warning|info|debug]\n- APP__APP_LOGS__LOGS_CONSOLE=true # Output in the container console\n
    "},{"location":"deployment/troubleshooting/#connectors","title":"Connectors","text":"

    All connectors support the same set of parameters to manage the log level and outputs:

    - OPENCTI_JSON_LOGGING=true # Enable / disable JSON logging\n- CONNECTOR_LOG_LEVEL=info=[error|warning|info|debug]\n
    "},{"location":"deployment/troubleshooting/#workers","title":"Workers","text":"

    The workers can have more or less verbose outputs:

    - OPENCTI_JSON_LOGGING=true # Enable / disable JSON logging\n- WORKER_LOG_LEVEL=[error|warning|info|debug]\n
    "},{"location":"deployment/troubleshooting/#common-errors","title":"Common errors","text":""},{"location":"deployment/troubleshooting/#ingestion-technical-errors","title":"Ingestion technical errors","text":"

    Missing reference to handle creation

    After 5 retries, if an element required to create another element is missing, the platform raises an exception. It usually comes from a connector that generates inconsistent STIX 2.1 bundles.

    Cant upsert entity. Too many entities resolved

    OpenCTI received an entity which is matching too many other entities in the platform. In this condition we cannot take a decision. We need to dig into the data bundle to identify why he match too much entities and fix the data in the bundle / or the platform according to what you expect.

    Execution timeout, too many concurrent call on the same entities

    The platform supports multi workers and multiple parallel creation but different parameters can lead to some locking timeout in the execution.

    • Throughput capacity of your ElasticSearch
    • Number of workers started at the same time
    • Dependencies between data
    • Merging capacity of OpenCTI

    If you have this kind of error, limit the number of workers deployed. Try to find the right balance of the number of workers, connectors and elasticsearch sizing.

    "},{"location":"deployment/troubleshooting/#ingestion-functional-errors","title":"Ingestion functional errors","text":"

    Indicator of type yara is not correctly formatted

    OpenCTI check the validity of the indicator rule.

    Observable of type IPv4-Addr is not correctly formatted

    OpenCTI check the validity of the oversable value.

    "},{"location":"deployment/troubleshooting/#dependencies-errors","title":"Dependencies errors","text":"

    TOO_MANY_REQUESTS/12/disk usage exceeded flood-stage watermark...

    Disk full, no space left on the device for ElasticSearch.

    "},{"location":"deployment/upgrade/","title":"Upgrade","text":"

    Depending on your installation mode, upgrade path may change.

    Migrations

    The platform is taking care of all necessary underlying migrations in the databases if any, you can upgrade OpenCTI from any version to the latest one, including skipping multiple major releases.

    "},{"location":"deployment/upgrade/#using-docker","title":"Using Docker","text":"

    Before applying this procedure, please update your docker-compose.yml file with the new version number of container images.

    "},{"location":"deployment/upgrade/#for-single-node-docker","title":"For single node Docker","text":"
    $ sudo docker-compose stop\n$ sudo docker-compose pull\n$ sudo docker-compose up -d\n
    "},{"location":"deployment/upgrade/#for-docker-swarm","title":"For Docker swarm","text":"

    For each of services, you have to run the following command:

    $ sudo docker service update --force service_name\n
    "},{"location":"deployment/upgrade/#manual-installation","title":"Manual installation","text":"

    When upgrading the platform, you have to replace all files and restart the platform, the database migrations will be done automatically:

    $ yarn serv\n
    "},{"location":"development/api-usage/","title":"GraphQL API and playground","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"development/connectors/","title":"Connector development","text":""},{"location":"development/connectors/#introduction","title":"Introduction","text":"

    A connector in OpenCTI is a service that runs next to the platform and can be implemented in almost any programming language that has STIX2 support. Connectors are used to extend the functionality of OpenCTI and allow operators to shift some of the processing workload to external services. To use the conveniently provided OpenCTI connector SDK you need to use Python3 at the moment.

    We choose to have a very decentralized approach on connectors, in order to bring a maximum freedom to developers and vendors. So a connector on OpenCTI can be defined by a standalone Python 3 process that pushes an understandable format of data to an ingestion queue of messages.

    Each connector must implement a long-running process that can be launched just by executing the main Python file. The only mandatory dependency is the OpenCTIConnectorHelper class that enables the connector to send data to OpenCTI.

    "},{"location":"development/connectors/#getting-started","title":"Getting started","text":"

    In the beginning first think about your use-case to choose and appropriate connector type - what do want to achieve with your connector? The following table gives you an overview of the current connector types and some typical use-cases:

    Connector types

    Type Typical use cases Example connector EXTERNAL_IMPORT Integrate external TI provider, Integrate external TI platform AlienVault INTERNAL_ENRICHMENT Enhance existing data with additional knowledge AbuseIP INTERNAL_IMPORT_FILE (Bulk) import knowledge from files Import document INTERNAL_EXPORT_FILE (Bulk) export knowledge to files STIX 2.1, CSV. STREAM Integrate external TI provider, Integrate external TI platform Elastic Security

    After you've selected your connector type make yourself familiar with STIX2 and the supported relationships in OpenCTI. Having some knowledge about the internal data models with help you a lot with the implementation of your idea.

    "},{"location":"development/connectors/#preparation","title":"Preparation","text":""},{"location":"development/connectors/#environment-setup","title":"Environment Setup","text":"

    To develop and test your connector, you need a running OpenCTI instance with the frontend and the messaging broker accessible. If you don't plan on developing anything for the OpenCTI platform or the frontend, the easiest setup for the connector development is using the docker setup, For more details see here.

    "},{"location":"development/connectors/#coding-setup","title":"Coding Setup","text":"

    To give you an easy starting point we prepared an example connector in the public repository you can use as template to bootstrap your development.

    Some prerequisites we recommend to follow this tutorial:

    • Code editor with good Python3 support (e.g. Visual Studio Code with the Python extension pack)
    • Python3 + setuptools is installed and configured
    • Command shell (either Linux/Mac terminal or WSL on Windows)

    In the terminal check out the connectors repository and copy the template connector to $myconnector (replace it with your name throughout the following text examples).

    $ pip3 install black flake8 pycti\n# Fork the current repository, then clone your fork\n$ git clone https://github.com/YOUR-USERNAME/connectors.git\n$ cd connectors\n$ git remote add upstream https://github.com/OpenCTI-Platform/connectors.git\n# Create a branch for your feature/fix\n$ git checkout -b [branch-name]\n$ cp -r template $connector_type/$myconnector\n$ cd $connector_type/$myconnector\n$ tree .\n.\n\u251c\u2500\u2500 docker-compose.yml\n\u251c\u2500\u2500 Dockerfile\n\u251c\u2500\u2500 entrypoint.sh\n\u251c\u2500\u2500 README.md\n\u2514\u2500\u2500 src\n    \u251c\u2500\u2500 config.yml.sample\n    \u251c\u2500\u2500 main.py\n    \u2514\u2500\u2500 requirements.txt\n\n1 directory, 7 files\n
    "},{"location":"development/connectors/#changing-the-template","title":"Changing the template","text":"

    There are a few files in the template we need to change for our connector to be unique. You can check for all places you need to change you connector name with the following command (the output will look similar):

    $ grep -Ri template .\n\nREADME.md:# OpenCTI Template Connector\nREADME.md:| `connector_type`                     | `CONNECTOR_TYPE`                    | Yes          | Must be `Template_Type` (this is the connector type).                                                                                                      |\nREADME.md:| `connector_name`                     | `CONNECTOR_NAME`                    | Yes          | Option `Template`                                                                                                                                          |\nREADME.md:| `connector_scope`                    | `CONNECTOR_SCOPE`                   | Yes          | Supported scope: Template Scope (MIME Type or Stix Object)                                                                                                 |\nREADME.md:| `template_attribute`                 | `TEMPLATE_ATTRIBUTE`                | Yes          | Additional setting for the connector itself                                                                                                                |\ndocker-compose.yml:  connector-template:\ndocker-compose.yml:    image: opencti/connector-template:4.5.5\ndocker-compose.yml:      - CONNECTOR_TYPE=Template_Type\ndocker-compose.yml:      - CONNECTOR_NAME=Template\ndocker-compose.yml:      - CONNECTOR_SCOPE=Template_Scope # MIME type or Stix Object\nentrypoint.sh:cd /opt/opencti-connector-template\nDockerfile:COPY src /opt/opencti-template\nDockerfile:    cd /opt/opencti-connector-template && \\\nsrc/main.py:class Template:\nsrc/main.py:            \"TEMPLATE_ATTRIBUTE\", [\"template\", \"attribute\"], config, True\nsrc/main.py:        connectorTemplate = Template()\nsrc/main.py:        connectorTemplate.run()\nsrc/config.yml.sample:  type: 'Template_Type'\nsrc/config.yml.sample:  name: 'Template'\nsrc/config.yml.sample:  scope: 'Template_Scope' # MIME type or SCO\n

    Required changes:

    • Change Template or templatementions to your connector name e.g. ImportCsv or importcsv
    • Change TEMPLATE mentions to your connector name e.g. IMPORTCSV
    • Change Template_Scope mentions to the required scope of your connector. For processing imported files, that can be the Mime type e.g. application/pdf or for enriching existing information in OpenCTI, define the STIX object's name e.g. Report. Multiple scopes can be separated by a simple ,
    • Change Template_Type to the connector type you wish to develop. The OpenCTI types (OpenCTI flags) are defined in this table.
    "},{"location":"development/connectors/#development","title":"Development","text":""},{"location":"development/connectors/#initialize-the-opencti-connector-helper","title":"Initialize the OpenCTI connector helper","text":"

    After getting the configuration parameters of your connector, you have to initialize the OpenCTI connector helper by using the pycti Python library. This is shown in the following example:

    class TemplateConnector:\ndef __init__(self):\n# Instantiate the connector helper from config\nconfig_file_path = os.path.dirname(os.path.abspath(__file__)) + \"/config.yml\"\nconfig = (\nyaml.load(open(config_file_path), Loader=yaml.SafeLoader)\nif os.path.isfile(config_file_path)\nelse {}\n)\nself.helper = OpenCTIConnectorHelper(config)\nself.custom_attribute = get_config_variable(\n\"TEMPLATE_ATTRIBUTE\", [\"template\", \"attribute\"], config\n)\n

    Since there are some basic differences in the tasks of the different connector classes, the structure is also a bit class dependent. While the external-import and the stream connector run independently in a regular interval or constantly, the other 3 connector classes only run when being requested by the OpenCTI platform.

    The self-triggered connectors run independently, but the OpenCTI need to define a callback function, which can be executed for the connector to start its work. This is done via self.helper.listen(self._process_message) . In the appended examples, the difference of the setup can be seen.

    Self-triggered Connectors

    • external-import
    • stream

    OpenCTI triggered

    • internal-enrichment
    • internal-import
    • internal-export
    from pycti import OpenCTIConnectorHelper, get_config_variable\nclass TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\nself.template_interval = get_config_variable(\n\"TEMPLATE_INTERVAL\", [\"template\", \"interval\"], config, True\n)\ndef get_interval(self) -> int:\nreturn int(self.template_interval) * 60 * 60 * 24\ndef run(self) -> None:\n# Main procedure\nif __name__ == \"__main__\":\ntry:\ntemplate_connector = TemplateConnector()\ntemplate_connector.run()\nexcept Exception as e:\nprint(e)\ntime.sleep(10)\nexit(0)\n
    from pycti import OpenCTIConnectorHelper, get_config_variable\nclass TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\ndef _process_message(self, data: dict) -> str:\n# Main procedure                \n# Start the main loop\ndef start(self) -> None:\nself.helper.listen(self._process_message)\nif __name__ == \"__main__\":\ntry:\ntemplate_connector = TemplateConnector()\ntemplate_connector.start()\nexcept Exception as e:\nprint(e)\ntime.sleep(10)\nexit(0)\n
    "},{"location":"development/connectors/#write-and-read-operations","title":"Write and Read Operations","text":"

    When using the OpenCTIConnectorHelper class, there are two way for reading from or writing data to the OpenCTI platform.

    1. via the OpenCTI API interface via self.helper.api
    2. via the OpenCTI worker via self.send_stix2_bundle
    "},{"location":"development/connectors/#sending-data-to-the-opencti-platform","title":"Sending data to the OpenCTI platform","text":"

    The recommended way for creating or updating data in the OpenCTI platform is via the OpenCTI worker. This enables the connector to just send and forget about thousands of entities at once to without having to think about the ingestion order, performance or error handling.

    \u26a0\ufe0f **Please DO NOT use the api interface to create new objects in connectors.**

    The OpenCTI connector helper method send_stix2_bundle must be used to send data to OpenCTI. The send_stix2_bundle function takes 2 arguments.

    1. A serialized STIX2 bundle as a string (mandatory)
    2. A list of entities types that should be ingested (optional)

    Here is an example using the STIX2 Python library:

    from stix2 import Bundle, AttackPattern\n[...]\nattack_pattern = AttackPattern(name='Evil Pattern')\nbundle_objects = []\nbundle_objects.append(attack_pattern)\nbundle = Bundle(objects=bundle_objects).serialize()\nbundles_sent = self.opencti_connector_helper.send_stix2_bundle(bundle)\n
    "},{"location":"development/connectors/#reading-from-the-opencti-platform","title":"Reading from the OpenCTI platform","text":"

    Read queries to the OpenCTI platform can be achieved using the API and the STIX IDs can be attached to reports to create the relationship between those two entities.

    entity = self.helper.api.vulnerability.read(\nfilters={\"key\": \"name\", \"values\": [\"T1234\"]}\n)\n

    If you want to add the found entity via objects_refs to another SDO, simple add a list of stix_ids to the SDO. Here's an example using the entity from the code snippet above:

    from stix2 import Report\n[...]\nreport = Report(\nid=report[\"standard_id\"],\nobject_refs=[entity[\"standard_id\"]],\n)\n
    "},{"location":"development/connectors/#logging","title":"Logging","text":"

    When something crashes at a user's, you as a developer want to know as much as possible about this incident to easily improve your code and remove this issue. To do so, it is very helpful if your connector documents what it does. Use info messages for big changes like the beginning or the finishing of an operation, but to facilitate your bug removal attempts, implement debug messages for minor operation changes to document different steps in your code.

    When encountering a crash, the connector's user can easily restart the troubling connector with the debug logging activated.

    • CONNECTOR_LOG_LEVEL=debug

    Using those additional log messages, the bug report is more enriched with information about the possible cause of the problem. Here's an example of how the logging should be implemented:

            def run(self) -> None:\nself.helper.log_info('Template connector starts')\nresults = self._ask_for_news()\n[...]\ndef _ask_for_news() -> None:\noverall = []\nfor i in range(0, 10):\nself.log_debug(f\"Asking about news with count '{i}'\")\n# Do something\nself.log_debug(f\"Resut: '{result}'\")\noverall.append(result)\nreturn overall\n

    Please make sure that the debug messages rich of useful information, but that they are not redundant and that the user is not drowned by unnecessary information.

    "},{"location":"development/connectors/#additional-implementations","title":"Additional implementations","text":"

    If you are still unsure about how to implement certain things in your connector, we advise you to have a look at the code of other connectors of the same type. Maybe they are already using approach which is suitable for addressing to your problem.

    "},{"location":"development/connectors/#opencti-triggered-connector-special-cases","title":"OpenCTI triggered Connector - Special cases","text":""},{"location":"development/connectors/#data-layout-of-dictionary-from-callback-function","title":"Data Layout of Dictionary from Callback function","text":"

    OpenCTI sends the connector a few instructions via the data dictionary in the callback function. Depending on the connector type, the data dictionary content is a bit different. Here are a few examples for each connector type.

    Internal Import Connector

    Internal Enrichment Connector

    { \"file_id\": \"<fileId>\",\n\"file_mime\": \"application/pdf\", \"file_fetch\": \"storage/get/<file_id>\", // Path to get the file\n\"entity_id\": \"report--82843863-6301-59da-b783-fe98249b464e\", // Context of the upload\n}\n
    { \"entity_id\": \"<stixCoreObjectId>\" // StixID of the object wanting to be enriched\n}\n

    Internal Export Connector

    { \"export_scope\": \"single\", // 'single' or 'list'\n\"export_type\": \"simple\", // 'simple' or 'full'\n\"file_name\": \"<fileName>\", // Export expected file name\n\"max_marking\": \"<maxMarkingId>\", // Max marking id\n\"entity_type\": \"AttackPattern\", // Exported entity type\n// ONLY for single entity export\n\"entity_id\": \"<entity.id>\", // Exported element\n// ONLY for list entity export\n\"list_params\": \"[<parameters>]\" // Parameters for finding entities\n}\n
    "},{"location":"development/connectors/#self-triggered-connector-special-cases","title":"Self triggered Connector - Special cases","text":""},{"location":"development/connectors/#initiating-a-work-before-pushing-data","title":"Initiating a 'Work' before pushing data","text":"

    For self-triggered connectors, OpenCTI has to be told about new jobs to process and to import. This is done by registering a so called work before sending the stix bundle and signalling the end of a work. Here an example:

    By implementing the work registration, they will show up as shown in this screenshot for the MITRE ATT&CK connector:

    def run() -> None:\n# Anounce upcoming work\ntimestamp = int(time.time())\nnow = datetime.utcfromtimestamp(timestamp)\nfriendly_name = \"Template run @ \" + now.strftime(\"%Y-%m-%d %H:%M:%S\")\nwork_id = self.helper.api.work.initiate_work(\nself.helper.connect_id, friendly_name\n)\n[...]\n# Send Stix bundle\nself.helper.send_stix2_bundle(\nbundle,\nentities_types=self.helper.connect_scope,\nupdate=True,\nwork_id=work_id,\n)\n# Finish the work\nself.helper.log_info(\nf\"Connector successfully run, storing last_run as {str(timestamp)}\"\n)              \nmessage = \"Last_run stored, next run in: {str(round(self.get_interval() / 60 / 60 / 24, 2))} days\"\nself.helper.api.work.to_processed(work_id, message)\n
    "},{"location":"development/connectors/#interval-handling","title":"Interval handling","text":"

    The connector is also responsible for making sure that it runs in certain intervals. In most cases, the intervals are definable in the connector config and then only need to be set and updated during the runtime.

    class TemplateConnector:\ndef __init__(self) -> None:\n# Initialization procedures\n[...]\nself.template_interval = get_config_variable(\n\"TEMPLATE_INTERVAL\", [\"template\", \"interval\"], config, True\n)\ndef get_interval(self) -> int:\nreturn int(self.template_interval) * 60 * 60 * 24\ndef run(self) -> None:\nself.helper.log_info(\"Fetching knowledge...\")\nwhile True:\ntry:\n# Get the current timestamp and check\ntimestamp = int(time.time())\ncurrent_state = self.helper.get_state()\nif current_state is not None and \"last_run\" in current_state:\nlast_run = current_state[\"last_run\"]\nself.helper.log_info(\n\"Connector last run: \"\n+ datetime.utcfromtimestamp(last_run).strftime(\n\"%Y-%m-%d %H:%M:%S\"\n)\n)\nelse:\nlast_run = None\nself.helper.log_info(\"Connector has never run\")\n# If the last_run is more than interval-1 day\nif last_run is None or (\n(timestamp - last_run)\n> ((int(self.template_interval) - 1) * 60 * 60 * 24)\n):\ntimestamp = int(time.time())\nnow = datetime.utcfromtimestamp(timestamp)\nfriendly_name = \"Connector run @ \" + now.strftime(\"%Y-%m-%d %H:%M:%S\")\n###\n# RUN CODE HERE     \n###\n# Store the current timestamp as a last run\nself.helper.log_info(\n\"Connector successfully run, storing last_run as \"\n+ str(timestamp)\n)\nself.helper.set_state({\"last_run\": timestamp})\nmessage = (\n\"Last_run stored, next run in: \"\n+ str(round(self.get_interval() / 60 / 60 / 24, 2))\n+ \" days\"\n)\nself.helper.api.work.to_processed(work_id, message)\nself.helper.log_info(message)\ntime.sleep(60)\nelse:\nnew_interval = self.get_interval() - (timestamp - last_run)\nself.helper.log_info(\n\"Connector will not run, next run in: \"\n+ str(round(new_interval / 60 / 60 / 24, 2))\n+ \" days\"\n)\ntime.sleep(60)\n
    "},{"location":"development/connectors/#running-the-connector","title":"Running the connector","text":"

    For development purposes, it is easier to simply run the python script locally until everything works as it sould.

    $ virtualenv env\n$ source ./env/bin/activate\n$ pip3 install -r requirements\n$ cp config.yml.sample config.yml\n# Define the opencti url and token, as well as the connector's id\n$ vim config.yml\n$ python3 main.py\nINFO:root:Listing Threat-Actors with filters null.\nINFO:root:Connector registered with ID: a2de809c-fbb9-491d-90c0-96c7d1766000\nINFO:root:Starting ping alive thread\n...\n
    "},{"location":"development/connectors/#final-testing","title":"Final Testing","text":"

    Before submitting a Pull Request, please test your code for different use cases and scenarios. We don't have an automatic testing suite for the connectors yet, thus we highly depend on developers thinking about creative scenarios their code could encounter.

    "},{"location":"development/connectors/#prepare-for-release","title":"Prepare for release","text":"

    If you plan to provide your connector to be used by the community (\u2764\ufe0f) your code should pass the following (minimum) criteria.

    # Linting with flake8 contains no errors or warnings\n$ flake8 --ignore=E,W\n# Verify formatting with black\n$ black .\nAll done! \u2728 \ud83c\udf70 \u2728\n1 file left unchanged.\n# Push you feature/fix on Github\n$ git add [file(s)]\n$ git commit -m \"[connector_name] descriptive message\"\n$ git push origin [branch-name]\n# Open a pull request with the title \"[connector_name] message\"\n

    If you have any trouble with this just reach out to the OpenCTI core team. We are happy to assist with this.

    "},{"location":"development/environment_ubuntu/","title":"Prerequisites Ubuntu","text":"

    Development stack require some base software that need to be installed.

    "},{"location":"development/environment_ubuntu/#docker-or-podman","title":"Docker or podman","text":"

    Platform dependencies in development are deployed through container management, so you need to install a container stack.

    We currently support docker and postman.

    $ sudo apt-get install docker docker-compose curl\n

    As OpenCTI has a dependency to ElasticSearch, you have to set the vm.max_map_count before running the containers, as mentioned in the ElasticSearch documentation.

    $ sudo sysctl -w vm.max_map_count=262144\n
    "},{"location":"development/environment_ubuntu/#nodejs-and-yarn","title":"NodeJS and yarn","text":"

    The platform is developed on nodejs technology, so you need to install node and the yarn package manager.

    $ sudo apt-get install nodejs\n$ sudo curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -\n$ sudo echo \"deb https://dl.yarnpkg.com/debian/ stable main\" | sudo tee /etc/apt/sources.list.d/yarn.list\n$ sudo apt-get update && sudo apt-get install yarn\n
    "},{"location":"development/environment_ubuntu/#python-runtime","title":"Python runtime","text":"

    For worker and connectors, a python runtime is needed.

    $ sudo apt-get install python3 python3-pip\n
    "},{"location":"development/environment_ubuntu/#git-and-dev-tool","title":"Git and dev tool","text":"
    • Install Git from apt
    $ sudo apt-get install git-all\n
    • Install your preferred IDE
      • Intellij community edition - https://www.jetbrains.com/idea/download/
      • VSCode - https://code.visualstudio.com/
    "},{"location":"development/environment_windows/","title":"Prerequisites Windows","text":"

    Development stack require some base software that need to be installed.

    "},{"location":"development/environment_windows/#docker-or-podman","title":"Docker or podman","text":"

    Platform dependencies in development are deployed through container management, so you need to install a container stack.

    We currently support docker and postman.

    Docker Desktop from - https://docs.docker.com/desktop/install/windows-install/

    • Install new version of - https://docs.microsoft.com/windows/wsl/wsl2-kernel. This will require a reboot.
    • Shell out to CMD as Administrator and run the following powershell command:

    wsl --set-default-version 2

    • Reboot computer and continue to next step
    • Load Docker Application
    • NOTE DOCKER LICENSE - You are agreeing to the licence for Non-commercial Open Source Project use. OpenCTI is Open Source and the version you would be possibly contributing to enhancing is the unpaid non-commercial/non-enterprise version. If you intention is different - please consult with your organization's legal/licensing department.
    • Leave Docker Desktop running
    "},{"location":"development/environment_windows/#nodejs-and-yarn","title":"NodeJS and yarn","text":"

    The platform is developed on nodejs technology, so you need to install node and the yarn package manager.

    • Install NodeJS from - https://nodejs.org/download/release/v16.20.0/node-v16.20.0-x64.msi
    • Select the option for installing Chocolatey on the Tools for Native Modules screen
      • Will do this install for you automatically - https://chocolatey.org/packages/visualstudio2019-workload-vctools
      • Includes Python 3.11.4

    • Shell out to CMD prompt as Administrator and install/run:

      • pip3 install pywin32

    • Configure Yarn (https://yarnpkg.com/getting-started/install)

    • Open CMD as Administrator and run the following command:
      • corepack enable
    "},{"location":"development/environment_windows/#python-runtime","title":"Python runtime","text":"

    For worker and connectors, a python runtime is needed. Even if you already have a python runtime installed through node installation, on windows some nodejs package will be recompiled with python and C++ runtime.

    For this reason Visual Studio Build Tools is required.

    • Install Visual Studio Build Tools from - https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools
    • Check off Desktop Development with C++
    • Run install
    "},{"location":"development/environment_windows/#git-and-dev-tool","title":"Git and dev tool","text":"
    • Download GIT for Windows (64-bit Setup)- https://git-scm.com/download/win

    • Just use defaults on each screen

    • Install your preferred IDE

    • Intellij community edition - https://www.jetbrains.com/idea/download/
    • VSCode - https://code.visualstudio.com/docs/?dv=win64
    "},{"location":"development/platform/","title":"Platform development","text":""},{"location":"development/platform/#introduction","title":"Introduction","text":"

    This summary should give you a detailed setup description for initiating the OpenCTI setup environment necessary for developing on the OpenCTI platform, a client library or the connectors. This page document how to set up an \"All-in-One\" development environment for OpenCTI. The devenv will contain data of 3 different repositories:

    • Platform: https://github.com/OpenCTI-Platform/opencti
    • Connectors: https://github.com/OpenCTI-Platform/connectors
    • Client python: https://github.com/OpenCTI-Platform/client-python
    "},{"location":"development/platform/#platform","title":"Platform","text":"

    Contains the platform OpenCTI project code base:

    • docker-compose (docker or podman) ~/opencti/opencti-platform/opencti-dev
    • Web frontend (nodejs / react) ~/opencti/opencti-platform/opencti-graphql
    • Backend (nodejs) ~/opencti/opencti-platform/opencti-frontend
    • Worker (nodejs / python) ~/opencti/opencti-worker
    "},{"location":"development/platform/#connectors","title":"Connectors","text":"

    Contains a lot of developed connectors, as a source of inspiration for your new connector.

    "},{"location":"development/platform/#client-python","title":"Client python","text":"

    Contains the source code of the python library used in worker or connectors.

    "},{"location":"development/platform/#prerequisites","title":"Prerequisites","text":"

    Some tools are needed before starting to develop. Please check Ubuntu prerequisites or Windows prerequisites

    "},{"location":"development/platform/#clone-the-projects","title":"Clone the projects","text":"

    Fork and clone the git repositories

    • https://github.com/OpenCTI-Platform/opencti/ - frontend / backend
    • https://github.com/OpenCTI-Platform/connectors - connectors
    • https://github.com/OpenCTI-Platform/docker - docker stack
    • https://github.com/OpenCTI-Platform/client-python/ - python client
    "},{"location":"development/platform/#dependencies-containers","title":"Dependencies containers","text":"

    In development dependencies are deployed trough containers. A development compose file is available in ~/opencti/opencti-platform/opencti-dev

    cd ~/docker\n#Start the stack in background\ndocker-compose -f ./docker-compose-dev.yml up -d\n

    You have now all the dependencies of OpenCTI running and waiting for product to run.

    "},{"location":"development/platform/#backend-api","title":"Backend / API","text":""},{"location":"development/platform/#python-virtual-env","title":"Python virtual env","text":"

    The GraphQL API is developed in JS and with some python code. As it's an \"all-in-one\" installation, the python environment will be installed in a virtual environment.

    cd ~/opencti/opencti-platform/opencti-graphql\npython3 -m venv .venv --prompt \"graphql\"\nsource .venv/bin/activate\npip install --upgrade pip wheel setuptools\nyarn install\nyarn install:python deactivate\n
    "},{"location":"development/platform/#development-configuration","title":"Development configuration","text":"

    The API can be specifically configured with files depending on the starting profile. By default, the default.json file is used and will be correctly configured for local usage except for admin password

    So you need to create a development profile file. You can duplicate the default file and adapt if for you need. 

    cd ~/opencti/opencti-platform/opencti-graphql/config\ncp default.json development.json\n

    At minimum adapt the admin part for the password and token. 

        \"admin\": {\n\"email\": \"admin@opencti.io\",\n\"password\": \"MyNewPassord\",\n\"token\": \"UUID generated with https://www.uuidgenerator.net\"\n}\n

    "},{"location":"development/platform/#install-start","title":"Install / start","text":"

    Before starting the backend you need to install the nodejs modules

    cd ~/opencti/opencti-platform/opencti-graphql\nyarn install\n

    Then you can simply start the backend API with the yarn start command

    cd ~/opencti/opencti-platform/opencti-graphql\nyarn start\n

    The platform will start logging some interesting information

    {\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] Starting platform\",\"timestamp\":\"2023-07-02T16:37:10.984Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] Checking dependencies statuses\",\"timestamp\":\"2023-07-02T16:37:10.987Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[SEARCH] Elasticsearch (8.5.2) client selected / runtime sorting enabled\",\"timestamp\":\"2023-07-02T16:37:11.014Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[CHECK] Search engine is alive\",\"timestamp\":\"2023-07-02T16:37:11.015Z\",\"version\":\"5.8.7\"}\n...\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[INIT] Platform initialization done\",\"timestamp\":\"2023-07-02T16:37:11.622Z\",\"version\":\"5.8.7\"}\n{\"category\":\"APP\",\"level\":\"info\",\"message\":\"[OPENCTI] API ready on port 4000\",\"timestamp\":\"2023-07-02T16:37:12.382Z\",\"version\":\"5.8.7\"}\n

    If you want to start on another profile you can use the -e parameter. For example here to use the profile.json configuration file.

    yarn start -e profile\n
    "},{"location":"development/platform/#code-check","title":"Code check","text":"

    Before pushing your code you need to validate the syntax and ensure the testing will be validated.

    "},{"location":"development/platform/#for-validation","title":"For validation","text":"

    yarn lint

    yarn check-ts

    "},{"location":"development/platform/#for-testing","title":"For testing","text":"

    For starting the test you will need to create a test.json file. You can use the same dependencies by only adapting all prefix for all dependencies.

    yarn test:dev

    "},{"location":"development/platform/#frontend","title":"Frontend","text":""},{"location":"development/platform/#install-start_1","title":"Install / start","text":"

    Before starting the backend you need to install the nodejs modules

    cd ~/opencti/opencti-platform/opencti-front\nyarn install\n

    Then you can simply start the frontend with the yarn start command

    cd ~/opencti/opencti-platform/opencti-front\nyarn start\n

    The frontend will start with some interesting information

    [INFO] [default] compiling...\n[INFO] [default] compiled documents: 1592 reader, 1072 normalization, 1596 operation text\n[INFO] Compilation completed.\n[INFO] Done.\n[HPM] Proxy created: /stream  -> http://localhost:4000\n[HPM] Proxy created: /storage  -> http://localhost:4000\n[HPM] Proxy created: /taxii2  -> http://localhost:4000\n[HPM] Proxy created: /feeds  -> http://localhost:4000\n[HPM] Proxy created: /graphql  -> http://localhost:4000\n[HPM] Proxy created: /auth/**  -> http://localhost:4000\n[HPM] Proxy created: /static/flags/**  -> http://localhost:4000\n

    The web UI should be accessible on http://127.0.0.1:3000

    "},{"location":"development/platform/#code-check_1","title":"Code check","text":"

    Before pushing your code you need to validate the syntax and ensure the testing will be validated.

    "},{"location":"development/platform/#for-validation_1","title":"For validation","text":"

    yarn lint

    yarn check-ts

    "},{"location":"development/platform/#for-testing_1","title":"For testing","text":"

    yarn test

    "},{"location":"development/platform/#worker","title":"Worker","text":"

    Running a worker is required when you want to develop on the ingestion or import/export connectors.

    "},{"location":"development/platform/#python-virtual-env_1","title":"Python virtual env","text":"
    cd ~/opencti/opencti-worker/src\npython3 -m venv .venv --prompt \"worker\"\nsource .venv/bin/activate\npip3 install --upgrade pip wheel setuptools\npip3 install -r requirements.txt\ndeactivate\n
    "},{"location":"development/platform/#install-start_2","title":"Install / start","text":"
    cd ~/opencti/opencti-worker/src\nsource .venv/bin/activate\npython worker.py\n
    "},{"location":"development/platform/#connectors_1","title":"Connectors","text":"

    For connectors development, please take a look to Connectors development dedicated page.

    "},{"location":"development/platform/#production-build","title":"Production build","text":"

    Based on development source you can build the package for production. This package will be minified and optimized with esbuild.

    $ cd opencti-frontend\n$ yarn build\n$ cd ../opencti-graphql\n$ yarn build\n

    After the build you can start the production build with yarn serv. This build will use the production.json configuration file

    $ cd ../opencti-graphql\n$ yarn serv\n
    "},{"location":"development/python/","title":"Python library","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/api/","title":"Knowledge graph","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/csv-feeds/","title":"CSV feeds","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/data-intelligence/","title":"Data intelligence","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/data-model/","title":"Data model","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/graph/","title":"Knowledge graph","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/security/","title":"Security","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/streaming/","title":"Data Streaming","text":""},{"location":"reference/streaming/#presentation","title":"Presentation","text":"

    In order to provide a real time way to consume STIX CTI information, OpenCTI provides data events in a stream that can be consume to react on creation, update, deletion and merge. This way of getting information out of OpenCTI is highly efficient and already use by some connectors.

    "},{"location":"reference/streaming/#technology","title":"Technology","text":""},{"location":"reference/streaming/#redis-stream","title":"Redis stream","text":"

    OpenCTI is currently using REDIS Stream (See https://redis.io/topics/streams-intro) as the technical layer. Each time something is modified in the OpenCTI database, a specific event is added in the stream.

    "},{"location":"reference/streaming/#sse-protocol","title":"SSE protocol","text":"

    In order to provides a really easy consuming protocol we decide to provide a SSE (https://fr.wikipedia.org/wiki/Server-sent_events) http URL linked to the standard login system of OpenCTI. Any user with the correct access rights can open and access http://opencti_instance/stream and open an SSE connection to start receiving live events. You can of course consume directly the stream in Redis but you will have to manage access and rights directly.

    "},{"location":"reference/streaming/#events-format","title":"Events format","text":"
    id: {Event stream id} -> Like 1620249512318-0\nevent: {Event type} -> create / update / delete\ndata: { -> The complete event data\n    version -> The version number of the event\n    type -> The inner type of the event\n    scope -> The scope of the event [internal or external]\n    data: {STIX data} -> The STIX representation of the data.\n    message -> A simple string to easy understand the event\n    origin: {Data Origin} -> Complex object with different information about the origin of the event\n    context: {Event context} -> Complex object with meta information depending of the event type\n}\n

    Id can be used to consume the stream from this specific point.

    "},{"location":"reference/streaming/#stix-data","title":"STIX data","text":"

    The current stix data representation is based on the STIX 2.1 format using extension mechanism. Please take a look to https://docs.oasis-open.org/cti/stix/v2.1/stix-v2.1.html for more information.

    "},{"location":"reference/streaming/#create","title":"Create","text":"

    Its simply the data created in STIX format.

    "},{"location":"reference/streaming/#delete","title":"Delete","text":"

    Its simply the data in STIX format just before his deletion. You will also find the automated deletions in context due to automatic dependency management.

    {\n\"context\": {\n\"deletions\": [{STIX data}]\n}\n}\n
    "},{"location":"reference/streaming/#update","title":"Update","text":"

    This event type publish the complete STIX data information along with patches information. Thanks to the patches, its possible to rebuild the previous version and easily understand that happens in the update. patch and reverse_patch follow the official jsonpatch specification. You can find more information at https://jsonpatch.com/

    {\n\"context\": {\n\"patch\": [/* patch operation object */],\n\"reverse_patch\": [/* patch operation object */]\n}\n}\n
    "},{"location":"reference/streaming/#merge","title":"Merge","text":"

    Merge is a mix of an update of the merge targets and deletions of the sources. In this event you will find the same patch and reverse_patch as an update and the list of elements merged into the target in the \"sources\" attribute.

    {\n\"context\": {\n\"patch\": [/* patch operation object */],\n\"reverse_patch\": [/* patch operation object */],\n\"sources\": [{STIX data}]\n}\n}\n
    "},{"location":"reference/streaming/#stream-types","title":"Stream types","text":"

    In OpenCTI we propose 2 types of streams.

    "},{"location":"reference/streaming/#base-stream","title":"Base stream","text":"

    The stream hosted in /stream url contains all the raw events of the platform, always filtered by the user rights (marking based). It's a technical stream a bit complex to used but very useful for internal processing or some specific connectors like backup/restore. This stream is live by default but if you want to catchup you can simply add the from parameter to your query. This parameter accept a timestamp in millisecond and also an event id. Like http://localhost/stream?from=1620249512599

    Stream size?

    The raw stream is really important in the platform and needs te be sized according to the period of retention you want to ensure. More retention you will have, more security about reprocessing the past information you will get. We usually recommand 1 month of retention, that usually match 2 000 000 of events. This limit can be configured with redis:trimming option, please check deployment configuration page.

    "},{"location":"reference/streaming/#live-stream","title":"Live stream","text":"

    This stream aims to simplify your usage of the stream through the connectors, providing a way to create stream with specific filters through the UI. After creating this stream, is simply accessible from /stream/{STREAM_ID}.

    It's very useful for various cases of data externalization, synchronization, like SPLUNK, TANIUM...

    This stream provides different interesting mechanics:

    • Stream the initial list of instances matching your filters when connecting based on main database if you use the recover parameter
    • Auto dependencies resolution to guarantee the consistency of the information distributed
    • Automatic events translation depending on the element segregation

    If you want to dig in about the internal behavior you can check this complete diagram:

    "},{"location":"reference/streaming/#general-options","title":"General options","text":"
    • no-dependencies (query parameter or header, default false). Can be used to prevent the auto dependencies resolution. To be used with caution.
    • listen-delete (query parameter or header, default true). Can be used prevent receive deletion events. To be used with caution.
    • with-inferences (query parameter or header, default false). Can be used to add inferences events (from rule engine) in the stream.
    "},{"location":"reference/streaming/#from-and-recover","title":"From and Recover","text":"

    From and recover are 2 different options that need to be explains.

    • from (query parameter) is always the parameter that describe the initial date/event_id you want to start from. Can also be setup with request header from or last-event-id

    • recover (query parameter) is an option that let you consume the initial event from the database and not from the stream. Can also be setup with request header recover or recover-date

    This difference will be transparent for the consumer but very important to get old information as an initial snapshot. This also let you consume information that is no longer in the stream retention period.

    The next diagram will help you to understand the concept:

    "},{"location":"reference/taxii-feeds/","title":"Taxii feeds","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"reference/taxonomy/","title":"Taxonomy","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/case-management/","title":"Case management","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/containers/","title":"Containers","text":""},{"location":"usage/containers/#stix-standard","title":"STIX standard","text":""},{"location":"usage/containers/#definition","title":"Definition","text":"

    In the STIX 2.1 standard, some STIX Domain Objects (SDO) can be considered as \"container of knowledge\", using the object_refs attribute to refer multiple other objects as nested references. In object_refs, it is possible to refer to entities and relationships.

    "},{"location":"usage/containers/#example","title":"Example","text":"
    {\n\"type\": \"report\",\n\"spec_version\": \"2.1\",\n\"id\": \"report--84e4d88f-44ea-4bcd-bbf3-b2c1c320bcb3\",\n\"created_by_ref\": \"identity--a463ffb3-1bd9-4d94-b02d-74e4f1658283\",\n\"created\": \"2015-12-21T19:59:11.000Z\",\n\"modified\": \"2015-12-21T19:59:11.000Z\",\n\"name\": \"The Black Vine Cyberespionage Group\",\n\"description\": \"A simple report with an indicator and campaign\",\n\"published\": \"2016-01-20T17:00:00.000Z\",\n\"report_types\": [\"campaign\"],\n\"object_refs\": [\n\"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2\",\n\"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c\",\n\"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a\"\n]\n}\n

    In the previous example, we have a nested reference to 3 other objects:

    \"object_refs\": [\n\"indicator--26ffb872-1dd9-446e-b6f5-d58527e5b5d2\",\n\"campaign--83422c77-904c-4dc1-aff5-5c38f3a2c55c\",\n\"relationship--f82356ae-fe6c-437c-9c24-6b64314ae68a\"\n]\n
    "},{"location":"usage/containers/#implementation","title":"Implementation","text":""},{"location":"usage/containers/#types-of-container","title":"Types of container","text":"

    In OpenCTI, containers are displayed differently than other entities, because they contain pieces of knowledge. Here is the list of containers in the platform:

    Type of entity STIX standard Description Report Native Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. Grouping Native A Grouping object explicitly asserts that the referenced STIX Objects have a shared context, unlike a STIX Bundle (which explicitly conveys no context). Observed Data Native Observed Data conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). Note Native A Note is intended to convey informative text to provide further context and/or to provide additional analysis not contained in the STIX Objects. Opinion Native An Opinion is an assessment of the correctness of the information in a STIX Object produced by a different entity. Case Extension A case whether an Incident Response, a Request for Information or a Request for Takedown is use to convey an epic with a set of tasks. Task Extension A task, generally used in the context of case, is intended to convery information about something that must be done in a limited timeframe."},{"location":"usage/containers/#containers-behaviour","title":"Containers behaviour","text":"

    In the platform, it is always possible to visualize the list of entities and/or observables referenced in a container (Container > Entities or Observables) but also to add / remove entities from the container.

    As containers can also contain relationships, which are generally linked to the other entities in the container, it is also possible to visualize the container as a graph (Container > Knowledge)

    "},{"location":"usage/containers/#containers-of-an-entity-or-a-relationship","title":"Containers of an entity or a relationship","text":"

    On the entity or the relationship side, you can always find all containers where the objecti is contained using the top menu Analysis:

    In all containers list, you can also filter containers based on one or multiple contained object(s):

    "},{"location":"usage/dashboards/","title":"Custom dashboards","text":""},{"location":"usage/dashboards/#sharing-and-access-restriction","title":"Sharing and access restriction","text":"

    Organizations, groups, or users who have access to a dashboard can have 3 levels of access: - admin read, write, access management - edit read and write - view read-only

    When a user creates a custom dashboard, it is only visible to themselves. They then have admin access. They can then define who can access it and with what level of rights via the Manage access button at the top right of the dashboard page.

    Manage access button

    They can give access to organizations, groups, users, but also to all users on the platform (everyone).

    Manage access window

    It is important to note that a dashboard must have at least one user with admin access level.

    "},{"location":"usage/data-model/","title":"Data model","text":""},{"location":"usage/data-model/#introduction","title":"Introduction","text":"

    The OpenCTI core design relies on the concept of a knowledge graph, where you have two different kinds of object:

    1. Nodes are used to describe entities, which have some properties or attributes.
    2. Edges are used to describe relationships, which are created between two entity nodes and have some properties or attributes.

    Example

    An example would be that the entity APT28 has a relationship uses to the malware entity Drovorub.

    "},{"location":"usage/data-model/#standard","title":"Standard","text":""},{"location":"usage/data-model/#the-stix-model","title":"The STIX model","text":"

    To enable a unified approach in the description of threat intelligence knowledge as well as importing and exporting data, the OpenCTI data model is based on the STIX 2.1 standard. Thus we highly recommend to take a look to the STIX Introductory Walkthrough and to the different kinds of STIX relationships to get a better understanding of how OpenCTI works.

    Some more important STIX naming shortcuts are:

    • STIX Domain Objects (SDO): Attack Patterns, Malware, Threat Actors, etc.
    • STIX Cyber Observable (SCO): IP Addresses, domain names, hashes, etc.
    • STIX Relationship Object (SRO): Relationships, Sightings

    "},{"location":"usage/data-model/#extensions","title":"Extensions","text":"

    In some cases, the model has been extended to be able to:

    • Support more types of SCOs to modelize information systems such as cryptocurrency wallets, user agents, etc.
    • Support more types of SDOs to modelize disinformation and cybercrime such as channels, events, narrative, etc.
    • Support more types of SROs to extend the new SDOs such asamplifies, publishes, etc.
    "},{"location":"usage/data-model/#implementation-in-the-platform","title":"Implementation in the platform","text":""},{"location":"usage/data-model/#diagram-of-types","title":"Diagram of types","text":"

    You can find below the digram of all types of entities and relationships available in OpenCTI.

    "},{"location":"usage/data-model/#attributes-and-properties","title":"Attributes and properties","text":"

    To get a comprehensive list of available properties for a given type of entity or relationship, you can use the GraphQL playground schema available in your \"Profile > Playground\". Then you can click on schema. You can for instance search for the keyword IntrusionSet:

    "},{"location":"usage/deduplication/","title":"Deduplication","text":"

    One of the core concept of the OpenCTI knowledge graph is all underlying mechanisms implemented to accurately de-duplicate and consolidate (aka. upserting) information about entities and relationships.

    "},{"location":"usage/deduplication/#creation-behavior","title":"Creation behavior","text":"

    When an object is created in the platform, whether manually by a user or automatically by the connectors / workers chain, the platform checks if something already exist based on some properties of the object. If the object already exists, it will return the existing object and, in some cases, update it as well.

    Technically, OpenCTI generates deterministic IDs based on the listed properties below to prevent duplicate (aka \"ID Contributing Properties\"). Also, it is important to note that there is a special link between name and aliases leading to not have entities with overlaping aliases or an alias already used in the name of another entity.

    "},{"location":"usage/deduplication/#entities","title":"Entities","text":"Type Attributes Area (name OR x_opencti_alias) AND x_opencti_location_type Attack Pattern (name OR alias) AND optional x_mitre_id Campaign name OR alias Channel name OR alias City (name OR x_opencti_alias) AND x_opencti_location_type Country (name OR x_opencti_alias) AND x_opencti_location_type Course Of Action (name OR alias) AND optional x_mitre_id Data Component name OR alias Data Source name OR alias Event name OR alias Feedback Case name AND created (date) Grouping name AND context Incident name OR alias Incident Response Case name OR alias Indicator name OR alias Individual (name OR x_opencti_alias) and identity_class Infrastructure name OR alias Intrusion Set name OR alias Language name OR alias Malware name OR alias Malware Analysis name OR alias Narrative name OR alias Note None Observed Data name OR alias Opinion None Organization (name OR x_opencti_alias) and identity_class Position (name OR x_opencti_alias) AND x_opencti_location_type Region name OR alias Report name AND publised (date) RFI Case name AND created (date) RFT Case name AND created (date) Sector (name OR alias) and identity_class Task None Threat Actor name OR alias Tool name OR alias Vulnerability name OR alias"},{"location":"usage/deduplication/#relationships","title":"Relationships","text":"

    The deduplication process of relationships is based on the following criterias:

    • Type
    • Source
    • Target
    • Start time between -30 days / + 30 days
    • Stop time between -30 days / + 30 days
    "},{"location":"usage/deduplication/#observables","title":"Observables","text":"

    For STIX Cyber Observables, OpenCTI also generate deterministic IDs based on the STIX specification using the \"ID Contributing Properties\" defined for each type of observable.

    "},{"location":"usage/deduplication/#update-behavior","title":"Update behavior","text":"

    If an entity already exists in the platform, the attributes may be updated by the incoming creation with the following rule:

    If confidence_level of the created entity is >= (greater or equal) then the confidence_level of the existing entity, attributes will be updated. Obviously, the confidence_level will also be increased with the new one.

    This logic has been implemented so the platform can converge to the highest confidence and quality levels for the entities and the relationships.

    "},{"location":"usage/enrichment/","title":"Enrichment connectors","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-analysis/","title":"Exploring \"Analysis\"","text":"

    When you click on \"Analysis\" in the left-side bar, you access all the \"Analysis\" tabs, visible on the top bar on the left. By default, the user directly access the \"Reports\" tab, but can navigate to the other tabs as well.

    From the Analysis section, users can access the following tabs:

    • Reports: See Reports as a sort of containers to detail and structure what is contained on a specific report, either from a source or write by yourself. Think of it as an Intelligence Production in OpenCTI.
    • Groupings: Groupings are containers, like Reports, but do not represent an Intelligence Production. They regroup Objects sharing an explicit context. For example, a Grouping might represent a set of data that, in time, given sufficient analysis, would mature to convey an incident or threat report as Report container.
    • Malware Analysis: As define by STIX 2.1 standard, Malware Analysis captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.
    • Notes: Through this tab, you can find all the Notes that have been written in the platform, for example to add some analyst's unstructured knowledge about an Object.
    • External references: Intelligence is never created from nothing. External references give user a way to link sources or reference documents to any Object in the platform.

    "},{"location":"usage/exploring-analysis/#reports","title":"Reports","text":""},{"location":"usage/exploring-analysis/#general-presentation","title":"General presentation","text":"

    Reports are one of the central component of the platform. It is from a Report that knowledge is extracted and integrated in the platform for further navigation, analysis and exports. Always tying the information back to a report allows for the user to be able to identify the source of any piece of information in the platform at all time.

    In the MITRE STIX 2.1 documentation, a Report is defined as such :

    Reports are collections of threat intelligence focused on one or more topics, such as a description of a threat actor, malware, or attack technique, including context and related details. They are used to group related threat intelligence together so that it can be published as a comprehensive cyber threat story.

    As a result, a Report object in OpenCTI is a set of attributes and metadata defining and describing a document outside the platform, which can be a threat intelligence report from a security reseearch team, a blog post, a press article a video, a conference extract, a MISP event, or any type of document and source.

    When clicking on the Reports tab at the top left, you access the list of all Reports you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of reports.

    "},{"location":"usage/exploring-analysis/#visualizing-knowledge-within-a-report","title":"Visualizing Knowledge within a Report","text":"

    When clicking on a Report, you land on the Overview tab. For a Report, the following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge contained in the report, accessible through different views (See below for a dive-in).
    • Content: a tab to upload or creates outcomes document displaying the content of the Report (for example in PDF, text, HTML or markdown files). The Content of the document is displayed to ease the access of Knowledge through a readable format.
    • Entities: A table containing all SDO (Stix Domain Objects) contained in the Report, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Observables: A table containing all SCO (Stix Cyber Observable) contained in the Report, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Data: as described here.

    Exploring and modifying the structured Knowledge contained in a Report can be done through different lenses.

    "},{"location":"usage/exploring-analysis/#graph-view","title":"Graph View","text":"

    In Graph view, STIX SDO are displayed as graph nodes and relationships as graph links. Nodes are colored depending of their type. Direct relationship are displayed as plain link and inferred relationships in dotted link. At the top right, you will find a serie of icons. From there you can change the current type of view. Here you can also perform global action on the Knowledge of the Report. Let's highlight 2 of them: - Suggestions: This tool suggests you some logical relationships to add between your contained Object to give more consistency to your Knowledge. - Share with an Organization: if you have designated a main Organization in the platform settings, you can here share your Report and its content with users of an other Organization. At the bottom, you have many option to manipulate the graph: - Multiple option for shaping the graph and applying forces to the nodes and links - Multiple selection options - Multiple filters, including a time range selector allowing you to see the evolution of the Knowledge within the Report. - Multiple creation and edition tools to modify the Knowledge contained in the Report.

    "},{"location":"usage/exploring-analysis/#content-mapping-view","title":"Content mapping view","text":"

    Through this view, you can map exsisting or new Objects directly from a readable content, allowing you to quickly append structured Knowledge in your Report before refining it with relationships and details. This view is a great place to see the continuum between unstructured and structured Knowledge of a specific Intelligence Production.

    "},{"location":"usage/exploring-analysis/#timeline-view","title":"Timeline view","text":"

    This view allows you to see the structured Knowledge chronologically. This view is really useful when the report describes an attack or a campaign that lasted some time, and the analyst payed attention to the dates. The view can be filtered and displayed relationships too.

    "},{"location":"usage/exploring-analysis/#correlation-view","title":"Correlation view","text":"

    The correlation view is a great way to visualize and find other Reports related to your current subject of interest. This graph displays all Report related to the important nodes contained in your current Report, for example Objects like Malware or Intrusion sets.

    "},{"location":"usage/exploring-analysis/#matrix-view","title":"Matrix view","text":"

    If your Report describes let's say an attack, a campaign, or an understanding of an Intrusion set, it should contains multiple attack patterns Objects to structure the Knowledge about the TTPs of the Threat Actor. Those attack patterns can be displayed as highlighted matrices, by default the MITRE ATT&CK Enterprise matrix. As some matrices can be huge, it can be also filtered to only display attack patterns describes in the Report.

    "},{"location":"usage/exploring-analysis/#groupings","title":"Groupings","text":"

    Groupings are an alternative to Report for grouping Objects sharing a context without describing an Intelligence Production.

    In the MITRE STIX 2.1 documentation, a Grouping is defined as such :

    A Grouping object explicitly asserts that the referenced STIX Objects have a shared context, unlike a STIX Bundle (which explicitly conveys no context). A Grouping object should not be confused with an intelligence product, which should be conveyed via a STIX Report. A STIX Grouping object might represent a set of data that, in time, given sufficient analysis, would mature to convey an incident or threat report as a STIX Report object. For example, a Grouping could be used to characterize an ongoing investigation into a security event or incident. A Grouping object could also be used to assert that the referenced STIX Objects are related to an ongoing analysis process, such as when a threat analyst is collaborating with others in their trust community to examine a series of Campaigns and Indicators.

    When clicking on the Groupings tab at the top of the interface, you access the list of all Groupings you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of the groupings.

    Clicking on a Grouping, you land on its Overview tab. For a Groupings, the following tabs are accessible: - Overview: as described here. - Knowledge: a complex tab that regroups all the structured Knowledge contained in the groupings, as for a Report, except for the Timeline view. - Entities: A table containing all SDO (Stix Domain Objects) contained in the Grouping, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine - Observables: A table containing all SCO (Stix Cyber Observable) contained in the Grouping, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine - Data: as described here.

    "},{"location":"usage/exploring-analysis/#malware-analysis","title":"Malware Analysis","text":"

    Malware analyses are an important part of the Cyber Threat Intelligence, allowing an precise understanding of what and how a malware really do on the host but also how and from where it receives its command and communicates its results.

    In OpenCTI, Malware Analyses can be created from enrichment connectors that will take an Observable as input and perform a scan on a online service platform to bring back results. As such, Malware Analysis can be done on File, Domain and URL.

    In the MITRE STIX 2.1 documentation, a Malware Analysis is defined as such :

    Malware Analysis captures the metadata and results of a particular static or dynamic analysis performed on a malware instance or family.

    When clicking on the Malware Analysis tab at the top of the interface, you access the list of all Malware Analysis you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of the Malware Analysis.

    Clicking on a Malware Analysis, you land on its Overview tab. The following tabs are accessible: - Overview: This view contains some additions from the common Overview here. You will find here details about how the analysis have been performed, what is the global result regarding the malicioussness of the analysed artifact and all the Observables that have been found during the analysis. - Knowledge: If you Malware analysis is linked to other Objects that are not part of the analysis result, they will be displayed here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-analysis/#notes","title":"Notes","text":"

    Not every Knowledge can be structured. For allowing any users to share their insights about a specific Knowledge, they can create a Note for every Object and relationship in OpenCTI they can access to. All the Notes are listed within the Analysis menu for allowing global review of this unstructured addition to the global Knowledge.

    In the MITRE STIX 2.1 documentation, a Note is defined as such :

    A Note is intended to convey informative text to provide further context and/or to provide additional analysis not contained in the STIX Objects, Marking Definition objects, or Language Content objects which the Note relates to. Notes can be created by anyone (not just the original object creator).

    Clicking on a Note, you land on its Overview tab. The following tabs are accessible: - Overview: as described here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-analysis/#external-references","title":"External references","text":"

    Intelligence is never created from nothing. External references give user a way to link sources or reference documents to any Object in the platform. All external references are listed within the Analysis menu for accessing directly sources of the structured Knowledge.

    In the MITRE STIX 2.1 documentation, a External references is defined as such :

    External references are used to describe pointers to information represented outside of STIX. For example, a Malware object could use an external reference to indicate an ID for that malware in an external database or a report could use references to represent source material.

    Clicking on an External reference, you land on its Overview tab. The following tabs are accessible: - Overview: as described here.

    "},{"location":"usage/exploring-arsenal/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-cases/","title":"Exploring \"Cases\"","text":"

    When you click on \"Cases\" in the left-side bar, you access all the \"Cases\" tabs, visible on the top bar on the left. By default, the user directly access the \"Incident Responses\" tab, but can navigate to the other tabs as well.

    As Analyses, Cases can contains other objects. This way, by adding context and results of your investigations in the case, you will be able to get an up to date overview of the ongoing situation, and later produce more easily an incident report.

    From the Cases section, users can access the following tabs:

    • Incident Responses: This type of Cases is dedicated to the management of incidents. An Incident Reponse case does not represent an incident, but all the context and actions that will encompass the response to a specific incident.
    • Request for Information: CTI teams are often asked to provide extensive information and analysis on a specific subject, be it related to an ongoing incident or a particular trending threat. Request for Information cases allow you to store context and actions relative to this type of request and its response.
    • Request for Takedown: When an orgnization is targeted by an attack campaign, a typical response action can be to request the Takedown of elements of the attack infrastructure, for example a domain name impersonating the organization to phish its employees, or an email address used to deliver phishing content. As Takedown needs in most case to reach out to external providers and be effective quickly, it often needs specific workflows. Request for Takedown cases give you a dedicated space to manage these specific actions.
    • Tasks: In every case, you need tasks to be performed in order to solve it. The Tasks tab allows you to review all created tasks to quickly see past due date, or quickly see every task assigned to a specific user.
    • Feedbacks: If you use your platform to interact with other teams and provide them CTI Knowledge, some users may want to give you feedback about it. Those feedbacks can easily be considered as an other type of case to solve, as it will often reffer to Knowledge inconsistency or gaps.

    "},{"location":"usage/exploring-cases/#incident-response-request-for-information-request-for-takedown","title":"Incident Response, Request for Information & Request for Takedown","text":""},{"location":"usage/exploring-cases/#general-presentation","title":"General presentation","text":"

    Incident responses, Request for Information & Request for Takedown cases are an important part of the case management system in OpenCTI. Here, you can organize the work of your team to respond to cybersecurity situations. You can also give context to the team and other users on the platform about the situation and actions (to be) taken.

    To manage the situation, you can issue Tasks and assign them to users in the platform, by directly creating a Task or by applying a Case template that will append a list of predifined tasks.

    To bring context, you can use your Case as a container (like Reports or Groupings), allowing you to add any Knowledge from your platform in it. You can also use this possibility to trace your investigation, your Case playing the role of an Incident report. You will find more information about case management here.

    Incident Response, Request for Information & Request for Takedown are not STIX 2.1 Objects.

    When clicking on the Incident Response, Request for Information & Request for Takedown tabs at the top, you access the list of all Cases you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes.

    "},{"location":"usage/exploring-cases/#visualizing-knowledge-within-an-incident-response-request-for-information-request-for-takedown","title":"Visualizing Knowledge within an Incident Response, Request for Information & Request for Takedown","text":"

    When clicking on an Incident Response, Request for Information or Request for Takedown, you land on the Overview tab. The following tabs are accessible:

    • Overview: Overview of Cases are slightly different than the usual (described here). Cases' Overview displays also the list of the tasks associated with the case. It also let you hightlight Incident, Report or Sighting at the origin of the case. If other cases contains some Observables with your Case, they will be displayed as Related Cases in the Overview.
    • Knowledge: a complex tab that regroups all the structured Knowledge contained in the Case, accessible through different views (See below for a dive-in).
    • Content: a tab to upload or creates outcomes document displaying the content of the Case (for example in PDF, text, HTML or markdown files). The Content of the document is displayed to ease the access of Knowledge through a readable format.
    • Entities: A table containing all SDO (Stix Domain Objects) contained in the Case, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Observables: A table containing all SCO (Stix Cyber Observable) contained in the Case, with search and filters available. It also display if the SDO has been added directly or through inferences with the reasonging engine
    • Data: as described here.

    Exploring and modifying the structured Knowledge contained in a Case can be done through different lenses.

    "},{"location":"usage/exploring-cases/#graph-view","title":"Graph View","text":"

    In Graph view, STIX SDO are displayed as graph nodes and relationships as graph links. Nodes are colored depending of their type. Direct relationship are displayed as plain link and inferred relationships in dotted link. At the top right, you will find a serie of icons. From there you can change the current type of view. Here you can also perform global action on the Knowledge of the Case. Let's highlight 2 of them: - Suggestions: This tool suggests you some logical relationships to add between your contained Object to give more consistency to your Knowledge. - Share with an Organization: if you have designated a main Organization in the platform settings, you can here share your Case and its content with users of an other Organization. At the bottom, you have many option to manipulate the graph: - Multiple option for shaping the graph and applying forces to the nodes and links - Multiple selection options - Multiple filters, including a time range selector allowing you to see the evolution of the Knowledge within the Case. - Multiple creation and edition tools to modify the Knowledge contained in the Case.

    "},{"location":"usage/exploring-cases/#content-mapping-view","title":"Content mapping view","text":"

    Through this view, you can map exsisting or new Objects directly from a readable content, allowing you to quickly append structured Knowledge in your Case before refining it with relationships and details. This view is a great place to see the continuum between unstructured and structured Knowledge.

    "},{"location":"usage/exploring-cases/#timeline-view","title":"Timeline view","text":"

    This view allows you to see the structured Knowledge chronologically. This view is particularily useful in the context of a Case, allowing you to see the chain of events, either from the attack perspectives, the defense perspectives or both. The view can be filtered and displayed relationships too.

    "},{"location":"usage/exploring-cases/#matrix-view","title":"Matrix view","text":"

    If your Case contains attack patterns, you will be able to visualize them in a Matrix view.

    "},{"location":"usage/exploring-cases/#tasks","title":"Tasks","text":"

    Tasks are actions to be performed in the context of a Case (Incident Response, Request for Information, Request for Takedown). Usually, a task is assigned to a user, but important tasks may involved more participants.

    When clicking on the Tasks tab at the top of the interface, you access the list of all Tasks you have access too, in respect with your allowed marking definitions. You can then search and filter on some common and specific attributes of the tasks.

    Clicking on a Task, you land on its Overview tab. For a Tasks, the following tabs are accessible: - Overview: as described here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-cases/#feedbacks","title":"Feedbacks","text":"

    When a user fill a feedback form from its Profile/Feedback menu, it will then be accessible here.

    This feature gives the opportunity to engage with other users of your platform and to respond directly to their concern about it or the Knowledge, without the need of third party software.

    Clicking on a Feedback, you land on its Overview tab. For a Feedback, the following tabs are accessible: - Overview: as described here. - Content: as described here. - Data: as described here. - History: as described here.

    "},{"location":"usage/exploring-entities/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-events/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-locations/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-observations/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-techniques/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/exploring-threats/","title":"Threats","text":"

    When you click on \"Threats\" in the left-side bar, you access all the \"Threats\" tabs, visible on the top bar on the left. By default, the user directly access the \"Threat Actor (Group)\" tab, but can navigate to the other tabs as well.

    From the Threats section, users can access the following tabs:

    • Threat actors (Group): Threat actor (Group) represents a physical group of attackers operating an Intrusion set, using malware and attack infrastructure, etc.
    • Threat actors (Indvidual): Threat actor (Individual) represents a real attacker that can be described by physical and personal attributes and motivations. Threat actor (Individual) operates Intrusion set, uses malware and infrastructure, etc.
    • Intrusion sets: Intrusion set is an important concept in Cyber Threat Intelligence field. It is a consistent set of technical and non technical elements corresponding of what, how and why a Threat actor acts. it is particularly usefull for associating multiple attacks and malicious actions to a defined Threat, even without sufficiant informations regarding who did them. Often, with you understanding of the threat growing, you will link an Intrusion set to a Threat actor (either a Group or an Individual).
    • Campaigns: Campaign represents a serie of attacks taking place in a certain period of time and/or targeting a consistent subset of Organization/Individual.
    "},{"location":"usage/exploring-threats/#threat-actors-group-and-individual","title":"Threat actors (Group and Individual)","text":""},{"location":"usage/exploring-threats/#general-presentation","title":"General presentation","text":"

    Threat actors are the humans who are building, deploying and operating intrusion sets. A threat actor can be an single individual or a group of attackers (who may be composed of individuals). A group of attackers may be a state-nation, a state-sponsored group, a corporation, a group of hacktivists, etc.

    Beware, groups of attackers might be modelized as \"Intrusion sets\" in feeds, as there is sometimes a misunderstanding in the industry between group of people and the technical/operational intrusion set they operate.

    When clicking on the Threat actor (Group or Individual) tabs at the top left, you access the list of all the groups of Threat actors or INdivudual Threat actors you have access too, in respect with your allowed marking definitions. These groups or individual are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares they used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Threat actors.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-a-threat-actor","title":"Visualizing Knowledge associated with a Threat actor","text":"

    When clicking on a Threat actor Card, you land on its Overview tab. For a Threat actor, the following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/exploring-threats/#intrusion-sets","title":"Intrusion Sets","text":"

    An intrusion set is a consistent group of technical elements such as \"tactics, technics and procedures\" (TTP), tools, malware and infrastructure used by a threat actor against one or a number of victims who are usually sharing some characteristics (field of activity, country or region) to reach a similar goal whoever the victim is. The intrusion set may be deployed once or several times and may evolve with time. Several intrusion sets may be linked to one threat actor. All of the entities described below may be linked to one intrusion set. There are many debates in the Threat Intelligence community on how to define an intrusion set and how to distinguish several intrusion sets with regards to:

    • their differences
    • their evolutions
    • the possible reuse
    • \"false flag\" type of attacks

    As OpenCTI is very customizable, each organization or individual may use these categories as they wish. Instead, it is also possible to use the import feed for the choice of categories.

    When clicking on the Intrusion set tab on the top left, you access the list of all the Intrusion sets you have access too, in respect with your allowed marking definitions. These intrusion sets are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares they used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Intrusion set.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-an-intrusion-set","title":"Visualizing Knowledge associated with an Intrusion set","text":"

    When clicking on an Intrusion set Card, you land on its Overview tab. The following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/exploring-threats/#campaigns","title":"Campaigns","text":"

    A campaign can be defined as \"a series of malicious activities or attacks (sometimes called a \"wave of attacks\") taking place within a limited period of time, against a defined group of victims, associated to a similar intrusion set and characterized by the use of one or several identical malware towards the various victims and common TTPs\". However, a campaign is an investigation element and may not be widely recognized. Thus, a provider might define a series of attacks as a campaign and another as an intrusion set. Campaigns can be attributed to an Intrusion set.

    When clicking on the Campaign tab on the top left, you access the list of all the Campaigns you have access too, in respect with your allowed marking definitions. These campaigns are displayed as Cards where you can find a summary of the important Knowledge associated with each of them: description, aliases, malwares used, countries and industries they target, labels. You can then search and filter on some common and specific attributes of Campaigns.

    At the top right of each Card, you can click the star icon to put it as favorite. It will pin the card on top of the list. You will also be able to display all your favorite easily in your Custom Dashboards.

    "},{"location":"usage/exploring-threats/#visualizing-knowledge-associated-with-a-campaign","title":"Visualizing Knowledge associated with a Campaign","text":"

    When clicking on an Campaign Card, you land on its Overview tab. The following tabs are accessible:

    • Overview: as described here.
    • Knowledge: a complex tab that regroups all the structured Knowledge linked to the Threat actor. Different thematic views are proposed to easily see the victimology, arsenal and techniques used by the Threat actor, etc.
    • Analyses: as described here.
    • Data: as described here.
    • History: as described here.
    "},{"location":"usage/export-documents/","title":"Export in documents","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/export-structured/","title":"Export in structured format","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/feeds/","title":"Native feeds","text":""},{"location":"usage/feeds/#live-streams","title":"Live streams","text":""},{"location":"usage/feeds/#introduction","title":"Introduction","text":"

    The best way to consume OpenCTI data, whether it is through a stream connector or within another OpenCTI instance, is to use the live streams. Live streams are like TAXII collection (ie. serving STIX 2.1 bundles) but under steroids. This means that live streams are supporting:

    • create, update and delete events depending on the filters ;
    • caching already created entities in the last 5 minutes ;
    • resolving relationships and dependencies even out of the filters ;
    • they can be public (without authentication).

    "},{"location":"usage/feeds/#schenario","title":"Schenario","text":"

    To better understand how live streams are working, let's take a few examples, from simple to complex.

    Given a live stream with filters Entity type: Indicator AND Label: detection. Let's see what happen with an indicator with:

    • Marking definition: TLP:GREEN
    • Author Crowdstrike
    • Relation indicates to the malware Emotet
    Action Result in stream (resolve-dependencies=false) Result in stream (resolve-dependencies=true) 1. Create an indicator Nothing Nothing 2. Add the label detection Create TLP:GREEN, create CrowdStrike, create the indicator Create TLP:GREEN, create CrowdStrike, create the malware Emotet, create the indicator, create the relationship indicates 3. Remove the label detection Delete the indicator Delete the indicator 4. Add the label detection Create the indicator Create the indicator, create the relationship indicates 5. Delete the indicator Delete the indicator Delete the indicator"},{"location":"usage/feeds/#taxii-collections","title":"TAXII Collections","text":"

    OpenCTI has an embedded TAXII API endpoint which provides valid STIX 2.1 bundles. If you wish to know more about the TAXII standard, please read the official introduction.

    In OpenCTI you can create as many TAXII 2.1 collections as needed. Each of them can have specific filters to publish only a subset of the platform overall knowledge (specific types of entities, labels, marking definitions, etc.).

    After creating a new collection, every systems with a proper access token can consume the collection using different kinds of authentication (basic, bearer, etc.)

    As when using the GraphQL API, TAXII 2.1 collections have a classic pagination system that should be handled by the consumer. Also, it's important to understand that element dependencies (nested IDs) inside the collection are not always contained/resolved in the bundle, so consistency needs to be handled at the client level.

    "},{"location":"usage/feeds/#csv-feeds","title":"CSV feeds","text":"

    OpenCTI is able to publish data in CSV feeds on a rolling period.

    "},{"location":"usage/getting-started/","title":"Getting started","text":"

    This guide aims to give you a full overview of the OpenCTI features and workflows. The platform can be used in various contexts to handle threats management use cases from a technical to a more strategic level. OpenCTI has been designed as a knowledge graph, taking inputs (threat intelligence feeds, sightings & alerts, vulnerabilities, assets, artifacts, etc.) and generating outputs based on built-in capabilities and / or connectors.

    Here are some examples of use cases:

    • Cyber Threat Intelligence knowledge base
    • Detection as code feeds for XDR, EDR, SIEMs, firewalls, proxies, etc.
    • Incident response artifacts & cases management
    • Vulnerabilities management
    • Reporting, alerting and dashboarding on a subset of data

    "},{"location":"usage/getting-started/#welcome-dashboard","title":"Welcome dashboard","text":"

    The welcome gives any visitor on the OpenCTI platform an outlook on the live of the platform. It can be replaced by a custom dashboard, created by a user (or the default dashboard in a role, a group or an organization).

    "},{"location":"usage/getting-started/#indicators-in-the-dashboard","title":"Indicators in the dashboard","text":""},{"location":"usage/getting-started/#numbers","title":"Numbers","text":"Component Description Total entities Number of entities (threat actor, intrusion set, indicator, etc.). Total relationships Number of relationships (targets, uses, indicates, etc.). Total reports Number of reports. Total observables Number of observables (IPv4-Addr, File, etc.)."},{"location":"usage/getting-started/#charts-lists","title":"Charts & lists","text":"Component Description Top labels Top labels given to entities during the last 3 months. Ingested entities Number of entities ingested by month. Top 10 active entities List of the entities with the greatest number of relations over the last 3 months. Targeted countries Intensity of the targeting tied to the number of relations targets for a given country. Observable distribution Distribution of the number of observables by type. Last ingested reports Last reports ingested in the platform."},{"location":"usage/import-automated/","title":"Automate import","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/import-files/","title":"Import from files","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/inferences/","title":"Inferences and reasoning","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/manual-creation/","title":"Manual creations","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/merging/","title":"Merge objects","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/nested/","title":"Nested references and objects","text":""},{"location":"usage/nested/#stix-standard","title":"STIX standard","text":""},{"location":"usage/nested/#definition","title":"Definition","text":"

    In the STIX 2.1 standard, objects can:

    1. Refer to other objects in directly in their attributes, by referencing one or multiple IDs.
    2. Have other objects directly embedded in the entity.
    "},{"location":"usage/nested/#example","title":"Example","text":"
    {\n\"type\": \"intrusion-set\",\n\"spec_version\": \"2.1\",\n\"id\": \"intrusion-set--4e78f46f-a023-4e5f-bc24-71b3ca22ec29\",\n\"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\", // nested reference to an identity\n\"object_marking_refs\": [\"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\"], // nested reference to multiple marking defintions\n\"external_references\": [\n{\n\"source_name\": \"veris\",\n\"external_id\": \"0001AA7F-C601-424A-B2B8-BE6C9F5164E7\",\n\"url\": \"https://github.com/vz-risk/VCDB/blob/125307638178efddd3ecfe2c267ea434667a4eea/data/json/validated/0001AA7F-C601-424A-B2B8-BE6C9F5164E7.json\",    }\n],\n\"created\": \"2016-04-06T20:03:48.000Z\",\n\"modified\": \"2016-04-06T20:03:48.000Z\",\n\"name\": \"Bobcat Breakin\",\n\"description\": \"Incidents usually feature a shared TTP of a bobcat being released within the building containing network access...\",\n\"aliases\": [\"Zookeeper\"],\n\"goals\": [\"acquisition-theft\", \"harassment\", \"damage\"]\n}\n

    In the previous example, we have 2 nested references to other objects in:

    \"created_by_ref\": \"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff\", // nested reference to an identity\n\"object_marking_refs\": [\"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da\"], // nested reference to multiple marking defintions\n

    But we also have a nested object within the entity (an External Reference):

    \"external_references\": [\n{\n\"source_name\": \"veris\",\n\"external_id\": \"0001AA7F-C601-424A-B2B8-BE6C9F5164E7\",\n\"url\": \"https://github.com/vz-risk/VCDB/blob/125307638178efddd3ecfe2c267ea434667a4eea/data/json/validated/0001AA7F-C601-424A-B2B8-BE6C9F5164E7.json\",    }\n]\n
    "},{"location":"usage/nested/#implementation","title":"Implementation","text":""},{"location":"usage/nested/#modelization","title":"Modelization","text":"

    In OpenCTI, all nested references and objects are modelized as relationships, to be able to pivot more easily on labels, external references, kill chain phases, marking definitions, etc.

    "},{"location":"usage/nested/#import-export","title":"Import & export","text":"

    When importing and exporting data to/from OpenCTI, the translation between nested references and objects to full-fledged nodes and edges is automated and therefore transparent for the users. Here is an example with the object in the graph above:

    {\n\"id\": \"file--b6be3f04-e50f-5220-af3a-86c2ca66b719\",\n\"spec_version\": \"2.1\",\n\"x_opencti_description\": \"...\",\n\"x_opencti_score\": 50,\n\"hashes\": {\n\"MD5\": \"b502233b34256285140676109dcadde7\"\n},\n\"labels\": [\n\"cookiecutter\",\n\"clouddata-networks-1\"\n],\n\"external_references\": [\n{\n\"source_name\": \"Sekoia.io\",\n\"url\": \"https://app.sekoia.io/intelligence/objects/indicator--3e6d61b4-d5f0-48e0-b934-fdbe0d87ab0c\"\n}\n],\n\"x_opencti_id\": \"8a3d108f-908c-4833-8ff4-4d6fc996ce39\",\n\"type\": \"file\",\n\"created_by_ref\": \"identity--b5b8f9fc-d8bf-5f85-974e-66a7d6f8d4cb\",\n\"object_marking_refs\": [\n\"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9\"\n]\n}\n
    "},{"location":"usage/notifications/","title":"Notifications and alerting","text":"

    It is possible to receive notifications via email or directly on the platform interface triggered by events such as entity creation, modification or deletion.

    "},{"location":"usage/notifications/#triggers","title":"Triggers","text":"

    Each user can create their own triggers. Triggers listen all the events that respect their filters and their event types, and notify the user of those events via the chosen outcome(s) (user interface or email).

    A platform administrator can create and manage triggers for a user, who will remain the trigger administrator, as well as for a group or an organization. Users belonging to this group or organization will then have read-only access rights on this trigger. The user can use filters to ensure that the created triggers are as accurate as possible.

    "},{"location":"usage/notifications/#instance-triggers","title":"Instance triggers","text":"

    Instance triggers are specific live triggers that listen to one or several instance(s). To create an instance trigger, you can

    • either use the general trigger creation form in the \u2018Triggers and digests\u2019 section,
    • either click on the \u2018quick subscription\u2019 icon at the top right of an entity overview.

    An instance trigger on an entity X notifies the following events:

    • update/deletion of X,
    • creation/deletion of a relationship from/to X,
    • creation/deletion of an entity that has X in its refs (examples: contains X, is shared with X, is created by X...),
    • adding/removing X in the ref of an entity (examples: adding X in the author of an entity, adding X in a report\u2026).

    Note: The notification of an entity deletion can either provides from the real deletion of an entity, either from a modification of the entity that leads to the user loss of visibility for the entity.

    "},{"location":"usage/notifications/#digest","title":"Digest","text":"

    A digest allows triggering the sending of notifications based on multiple triggers over a given period.

    "},{"location":"usage/overview/","title":"Overview","text":""},{"location":"usage/overview/#introduction","title":"Introduction","text":"

    The following chapter aims at giving the reader a step-by-step description of what is available on the platform and the meaning of the different tabs and entries.

    When the user connects to the platform, the home page is the Dashboard. This Dashboard contains several visuals summarizing the types and quantity of data recently imported into the platform.

    Dashboard

    To get more information about the components of the default dashboard, you can consult the Getting started.

    The left side panel allows the user to navigate through different windows and access different views and categories of knowledge.

    "},{"location":"usage/overview/#structure","title":"Structure","text":""},{"location":"usage/overview/#the-hot-knowledge","title":"The \"hot knowledge\"","text":"

    The first part of the platform in the left menu is dedicated to what we call the \"hot knowledge\", which means this is the entities and relationships which are added on a daily basis in the platform and which generally require work / analysis from the users.

    • Analysis: all containers which convey relevant knowledge such as reports, groupings and malware analysis.
    • Cases: all types of case like incident responses, requests for information, for takedown, etc.
    • Events: all incidents & alerts coming from operational systems as well as sightings.
    • Observations: all technical data in the platform such as observables, artifacts and indicators.
    "},{"location":"usage/overview/#the-cold-knowledge","title":"The \"cold knowledge\"","text":"

    The second part of the platform in the left menu is dedicated to the \"cold knowledge\", which means this is the entities and relationships used in the hot knowledge. You can see this as the \"encyclopedia\" of all pieces of knowledge you need to get context: threats, countries, sectors, etc.

    • Threats: all threats entities from campaigns to threat actors, including intrusion sets.
    • Arsenal: all tools and pieces of malware used and/or targeted by threats, including vulnerabilities.
    • Techniques: all objects related to tactics and techniques used by threats (TTPs, etc.).
    • Entities: all non-geographical contextual information such as sectors, events, organizations, etc.
    • Locations: all geographical contextual information, from cities to regions, including precise positions.
    "},{"location":"usage/overview/#hide-categories","title":"Hide categories","text":"

    You can customize the experience in the platform by hiding some categories in the left menu, whether globally or for a specific role.

    "},{"location":"usage/overview/#hide-categories-globally","title":"Hide categories globally","text":"

    In the Settings > Parameters, it is possible for the platform administrator to hide categories in the platform for all users.

    "},{"location":"usage/overview/#hide-categories-in-roles","title":"Hide categories in roles","text":"

    In OpencTI, the different roles are highly customizable. It is possible to defined default dashboards, triggers, etc. but also be able to hide categories in the roles:

    "},{"location":"usage/overview/#presentation-of-a-typical-page-in-opencti","title":"Presentation of a typical page in OpenCTI","text":"

    Although there are many different entities in OpenCTI and many different tabs, most of them are quite similar and only have minor differences from the other, mostly due to some of their characteristics, which requires specific fields or do not require some fields which are necessary for the other.

    In this part will only be detailed a general outline of a \"typical\" OpenCTI page. The specifies of the different entities will be detailed in the corresponding pages below (Activities and Knowledge).

    "},{"location":"usage/overview/#overview_1","title":"Overview","text":"

    In the Overview tab on the entity, you will find all properties of the entity as well as the recent activities.

    First, you will find the Details section, where are displayed all properties specific to the type of entity you are looking at, an example below with a piece of malware:

    Thus, in the Basic information section, are displayed all common properties to all objects in OpenCTI, such as the marking definition, the author, the labels (ie. tags), etc.

    Below these two sections, you will find latest modifications in the Knowledge base related to the Entity:

    • Latest created relationships: display the latest relationships that have been created from or to this Entity. For example, latest Indicators of Compromise and associated Threat Actor of a Malware.
    • latest containers about the object: display all the Cases and Analysis that contains this Entity. For example, the latest Reports about a Malware.
    • External references: display all the the external sources associated with the Entity. You will often find here links to external reports or webpages from where Entity's information came from.
    • History: display the latest chronological modifications of the Entity and its relationships that occured in the platform, in order to traceback any alteration.

    Last, all Notes written by users of the platform about this Entity are displayed in order to access unstructured analysis comments.

    "},{"location":"usage/overview/#knowledge","title":"Knowledge","text":"

    In the Knowledge tab, which is the central part of the entity, you will find all the Knowledge related to the current entity. The Knowledge tab is different for Analysis (Report, Groupings) and Cases (Incident response, Request for Information, Request for Takedown) entities than for all the other entity types.

    • The Knowledge tab of those entities (who represents Analyses or Cases that can contains a collection of Objects) is the place to integrate and link together entities. For more information on how to integrate information in OpenCTI using the knowledge tab of a report, please refer to the part Manual creation.
    • Knowledge tabs of any other entity (that does not aim to contain a collection of Objects) gather all the entities which have been at some point linked to the entity the user is looking at (for instance, as shown in the following capture, the Knowledge tab of Intrusion set APT29) gives access to the list of all entities APT29 is attributed to, all victims the intrusion set has targeted, all its campaigns, TTPs, malwares etc. For entities to appear in theses tabs under Knowledge, they need to have been linked to the entity directly or have been computed with the inference engine (to come).

    "},{"location":"usage/overview/#analysis","title":"Analysis","text":"

    The Analysis tab contains the list of all Analysis (Report, Groupings) and Cases (Incident response, Request for Information, Request for Takedown) in which the entity has been identified.

    By default, this tab display the list, but you can also display the content of all the listed Analyses on a graph, allowing you to explore all their Knowledge and have a glance of the context around the Entity.

    "},{"location":"usage/overview/#data","title":"Data","text":"

    The Data tab contains documents that are associated to the object and were either :

    • Uploaded to the platform : for instance the PDF document containing the text of the report
    • Generated from the platform to be downloaded : a JSON or CSV file containing information on the object and generated by the user.
    • associated to an external reference

    Analyst Workbench can also be created from here. They will contain the entity by default.

    "},{"location":"usage/overview/#history","title":"History","text":"

    The History tab display the history of change of the Entity, update of attributes, creation of relations, ...

    Because of the volumes of information the history is written in a specific index by the history connector (https://www.notion.so/luatix/History-17503579a70c467ba02ec11350c593bf) that consume the redis stream to rebuild the history for the UI.

    Less frequent tabs are the following:

    • The Indicators tab (for all the threats and the entities in arsenal - except the courses of action -)
    • The Observables tab (for reports, observed data)
    • the Entities tab (for reports and observed data)
    • the Sightings tab (for Indicators and observables)
    "},{"location":"usage/pivoting/","title":"Pivot and investigate","text":"

    In Opencti, all data can be represented as a large knowledge graph: everything is linked to something. You can pivot on any entity and on any relationship you have in your platform, using investigations.

    Investigations are available on the top right of the top bar:

    Investigations are organized by workspace. When you create a new empty workspace, it will only be visible by you and enables you to work on your investigation before sharing it.

    In your workspace, you can add entities that you want to investigate, visualize the data linked to these entities, add relationships, and export your investigation graph in pdf, image or as new stix report.

    "},{"location":"usage/pivoting/#add-and-expand-an-entity","title":"Add and expand an entity","text":"

    You can add any existing entity of the platform to your investigation.

    Once added, you can select the entity, and see its details in the right. In this bottom right menu, right next to \"Add en entity\", you can expand the selected entity and select the number of linked entities you want to see in your investigation.

    "},{"location":"usage/pivoting/#add-a-relationship","title":"Add a relationship","text":"

    You can add a relationship between entities directly in your investigation.

    "},{"location":"usage/pivoting/#export-your-investigation","title":"Export your investigation","text":"

    You can export your investigation in PDF or image format. You can also download all the content of your investigation graph in a Report stix bundle (investigation is automatically converted).

    "},{"location":"usage/search/","title":"Search for knowledge","text":"

    In OpenCTI, you have access to different capabilities to be able to search for knowledge in the platform. In most cases, a search by keyword can be refined with additional filters for instance on the type of object, the author etc.

    "},{"location":"usage/search/#global-search","title":"Global search","text":"

    The global search is always available in the top bar of the platform.

    This search covers all STIX Domain Objects (SDOs) and STIX Cyber Observables (SCOs) in the platform. The search results are sorted according to the following behaviour:

    • Priority 1 for exact matching of the keyword in one attribute of the objects.
    • Priority 2 for partial matching of the keyword in the name, the aliases and the description attributes (full text search).
    • Priority 3 for partial matching of the keyword in all other attributes (full text search).

    If you get unexpected result, it is always possible to add some filters after the initial search:

    Also, using the Advanced search button, it is possible to directly put filters in a global search:

    "},{"location":"usage/search/#bulk-search","title":"Bulk search","text":"

    The bulk search capabilities in available in the top bar of the platform and allow you to copy paste a list of keyword or objects (ie. list of domains, list of IP addresses, list of vulnerabilities, etc.) to search in the platform:

    When searching in bulk, OpenCTI is only looking for an exact match in some properties:

    • name
    • aliases
    • x_opencti_aliases
    • x_mitre_id
    • value
    • subject
    • abstract
    • hashes_MD5
    • hashes_SHA1
    • hashes_SHA256
    • hashes_SHA512
    • x_opencti_additional_names

    When something is not found, it appears in the list as Unknown and will be excluded if you choose to export your search result in a JSON STIX bundle or in a CSV file.

    "},{"location":"usage/search/#contextual-search","title":"Contextual search","text":"

    In most of the screens of knowledge, you always have a contextual search bar allowing you to filter the list you are on:

    The search keyword used here is taken into account if you decide to export the current view in a file such as a JSON STIX bundle or a CSV file.

    "},{"location":"usage/search/#other-search-bars","title":"Other search bars","text":"

    Some other screens can contain search bars for specific purposes. For instance, in the graph views to filter the nodes displayed on the graph:

    "},{"location":"usage/workbench/","title":"Analyst workbench","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "},{"location":"usage/workflows/","title":"Workflows and assignation","text":"

    Under construction

    We are doing our best to complete this page. If you want to participae, dont hesitate to join the Filigran Community on Slack or submit your pull request on the Github doc repository.

    "}]} \ No newline at end of file diff --git a/5.9.X/sitemap.xml b/5.9.X/sitemap.xml index c7827f2c..130cc863 100755 --- a/5.9.X/sitemap.xml +++ b/5.9.X/sitemap.xml @@ -2,372 +2,372 @@ https://docs.opencti.io/latest/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/enterprise/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/entities/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/introduction/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/merging/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/ontologies/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/parameters/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/policies/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/reasoning/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/retentions/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/segregation/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/sourcing/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/users/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/audit/configuration/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/audit/events/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/audit/overview/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/administration/audit/triggers/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/authentication/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/clustering/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/configuration/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/connectors/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/installation/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/integrations/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/overview/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/resources/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/rollover/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/troubleshooting/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/deployment/upgrade/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/api-usage/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/connectors/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/environment_ubuntu/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/environment_windows/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/platform/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/development/python/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/api/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/csv-feeds/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/data-intelligence/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/data-model/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/graph/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/security/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/streaming/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/taxii-feeds/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/reference/taxonomy/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/case-management/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/containers/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/dashboards/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/data-model/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/deduplication/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/enrichment/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-analysis/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-arsenal/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-cases/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-entities/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-events/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-locations/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-observations/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-techniques/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/exploring-threats/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/export-documents/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/export-structured/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/feeds/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/getting-started/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/import-automated/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/import-files/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/inferences/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/manual-creation/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/merging/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/nested/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/notifications/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/overview/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/pivoting/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/search/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/workbench/ - 2023-07-17 + 2023-07-28 daily https://docs.opencti.io/latest/usage/workflows/ - 2023-07-17 + 2023-07-28 daily \ No newline at end of file diff --git a/5.9.X/sitemap.xml.gz b/5.9.X/sitemap.xml.gz index 357918eea7d1cab84c890df8a0c6f116208d94c1..7589a3310b0002ae9d65ccfef9b29f71293a5bc4 100755 GIT binary patch delta 748 zcmVPblPPU7~Pb2#C@Cn zpf|a_cDDDs&)dV@Mz7@oYwL3DBl*Mfl&p^lVqcQecnF7?ncyc~kVc;0`vH$5v%`9FoVmK42hUk4rytb zF>!{Tp?8)7Tc*O^kSIzv6e3&+D6OZ|VPDvkE>?7y)dP*0n>72K5l*(Kg|Y8zmUe%D zDbjgVJt(mZOJw$SEBc1m$C5R-s5#Ev(wYbue*!1)LN?@!DT|BIjCHkM(!9deoeACW zRv&jwMMkhke2n=w!p(llFgg#G?(^vkVod4GbNycES=N3{d(!HyuF823Ug= z*DT3cjM!g#j4gz_p-i#%J;jw35~Cjs_!ED;YIVD8 zdo~&Y;yGis1I!te*$nRzXzf_H`fo=50OHPbseHrsJuw|K@N5iPzz+#uiXkD( zpc%OZB@;`dW6Eg5@fKXIc8Zt65Gv=byU1A?dyr-4UXAKls<$YP7X`Q?G&(c59meWI z7p7~;TRW&$xy8lCFY&eh8lpV*FG^R+q|NG`DUo1@HWIGt564%`3Fo@cZCA_;j{Q(M e29E|OABzYGAIY_30{?SqbY*Q}a4vXlYyj1ov2xom42JhUh0nXJBpuR` zCoq3|zq{LRAbARy`ls#pZ(o~F+vmfFec_lvHaa-vr|lpzeQDd%>9orzFuE!4i2FAC zL2q(UwsFDWW%IVFs5e84@w89MaM< zW8w@wL+>mFwoHY+AyJfUC`7mtP+Cu^!@jU7U99LZs|Ol0H)-}eBb;ne3uE8cEbV^) zQ>62#dQf5+mdNbuR`d1+dQx+Ga8S84jqDyO9+4pYthU@K^Fc{q~eP(Nt(3&0f=LYZRidx|S7Bt}0N@F#zG)#`TH z_G~l)#B;`M2beP`vl-qc(Au$X_1}#A1zh(@)O%c=Qu&7Mdty3f;Mo|ofFBaR6hlIm zK{Ij-N+y;@$CS~A<1M&a?G!JCAym#=cagI)_8`m7y&BcARBurnFA8u)Xmn<9JB-zb zE=<>ww{}pia*K1HAFq_UzDztNt@L>QzF3*Z6sXPAC9k>6V7#?+pd@y9Q&bi f$P@9;qyA-qvy1=b)bR3?K@PtFQaTu?urdGu=aXew diff --git a/5.9.X/usage/exploring-analysis/index.html b/5.9.X/usage/exploring-analysis/index.html index da3091d7..f783b5f3 100755 --- a/5.9.X/usage/exploring-analysis/index.html +++ b/5.9.X/usage/exploring-analysis/index.html @@ -4085,7 +4085,7 @@

    Visualizing Knowledge within a Re

    z+uh@!XKzW{@V)tUY5-ekZnM~-|K6;Nh47`p?k6khY(b*Dd^7l>)9KD(w_i6j36%&! zJYJ@kaz;W40ND=AqIdkUafQ^NQd*KS{_8779)bnToV+pKOL&-G@B) zDcw8k*ub)OW;j{BY@V4x8B(d~YB~Zee&R&Qi+^7jvr;)?is#?7(>Fs*&Bye+S;lKH zXGhbJl#A#S6~(lu4Hyt%Wq}he&)m|(HH$wB za{M#vTsYMnbt9utLZj``m)N|Ps>K7TMLlP_Tc4R4Y_9wU5t#NTlvT*xU8x%}wT?aX zUq{b4?8e;!&UV9J4n86~Ho|rMq zZ)2ORfl^DFOq>G^X8=f>ulcRH6~+Ws!vu<+id*hvs=Y}pF22<@U)wq^j{sLt&5Gi* z?c|Vn@c1#J_qdWS!O~VQOF~g!EN%dUVz}{q(do}_E!bB-%gRMZTlwni4;iY1Sd`dU zG8T)9NezgZafx!pX|nO6UMR&%KJx3U(9+ zML$9JC%Mm*Lb}2)Xh>3E*b8+4)j=!)%ndl|Xtqpi(uRA9MW&h`qyzVEkDT^WPQ6&u zx4XLpY7{X2Y&T8yv977Nir7tMnQXMezecO&u>wSyT5})zpSC#9_KJN+c46+q0veuH z@H@w@>SP9NM7Of@zOCg``6rLG#vhNU>-^NfA=JLCQ`JeUOdI9JpdJI@K^W(Kv>Bti zK~U|84NLZxKH?5Us>?sBV8XVTsJ9uhw^%*L@>nywOxKpfD&OZh$2uWF9*}GG2pr!ULjO;{eK!{A@Jm%13CGxFv;iF$?RfUBdl9X+N@AZlZq%7ab; z1zYZ)O>sh)(e)eCXYpht`>r^$|EHpaA3ed9XDOf1{f)2JrdZMPdsR|@ZvX+JHdpG@ zruJzECB1h?U4S@$89Ogn4i&Tg_T4m5-UU}_BoEqq&BV6?T~-0w;_JsROpI>?V?nAn zSw}8)mhl0(orF*^2_+~HmQ819HgU$r1g1s=%**|r8ZNmFMJ9WHYRT52W|@#5V<1!j z!fJ!6)~)*v*LgT7QO9!2fX$j-OGL!0sU|`65*NTJNK4Hmqy#pVtQoP1!&Z^j3z8n* z?V2Q%WDftSa%fGi`Ql+@PN69m1zB988h4yL4w8ozHy(URL7!;${q;X4Q96tpYy??3 zqkuL8*bMOhno`;gkWZ3uu$<4@as@DS6Gc8uMl zD6!#k;?krF$n`p&@iS-Z8;l*9o9#chYj|J}?k_1j7cxEvAsz45`$8?}U$xkCM?PJz zyVg_d7dZMC8k<|~3pr^Z?@fCsdHJ20+PcG#p`g-mtJ&tQw^WqWv9#ViIcAAO1O%P3 zfOCFSxwf~V!F$*91L;M*d3tq@V;~uwcQyg3n}ch6_!jO4K=lZ3K&l{UYUwU;Id~QZ zfVFQ`-oUhCIM3`5Xd{D3*4o=i{~!p&dZ&3UJ-mhm2K>;Uvl5ApaL79(G4eHUoB3;P z9qm^0ajgyn5D(qWVGv=WjJ}_&jVe&8b8mpOyR)<>^YcF{11+HPQk^1ELUm@@7yj$H zpT1G{{yzs|AFdB0mcJJv9zT#IBP^~l?T)zxs2VZwSrT@!1kqb3iTOPogvN&n(M7Si zv*`^nGg+K(td0>koo=A%``o>(A$a%Dj<4&@3p|uHelIR}ydbVwVJWcE8sT$MEkelF z3xvyqrsN`p^W3GmZf=1exzx_wfA-NtTqaIFR8j5SXln*8 zU!|4o5fP=iJFKlxfE41O+*wjH$F~+O-WjiIb4-H>QU-EY&K1h9!7h#MHt&M$-RRy0 zsU1vduykT5Lw*O}pjS_jTl@8a_K1yI8zS2~aS}Jbkv!1TLT>Tau1 zQn^pYYWj`@A#%woS)Q%lTB%K9p_^BrG-tjU`s7YKT=z&;xJZqdBqsJ#cklD;r zmDb#sWD%k;vQ%0v+l`O4-B#=_VxTow@$IFG%@kitq4$kjP4HaIu;KKVHw}rFl|kFb{1P{0x!aQVL^n_#^>f>|OP94=uZtrsV{x)SweJ4<6k&5DvqW|cPS$)uB) z9}M#fC=l~9dgnk}L25*JlHw8Bm&0X&95-I2VBT2Iq&wS0_RmdE9(3A=HhGa#3!-ex zF;u3>CC+Z8qpw5@G4|!t`=5hV1oGM!MP7u44ptHScAeX|?cYk9O#hlXXan6Rd6|p9 z0yj*pJuHsNEN8Vlk?Euw1pOmWmE&$W@Hq!e_44EIIf!M&(KhZh=|D8a!jTIIihwCX zUrc?IG8#KoQLyAKpw1@V(wUnUUxD;u{b!<}efy*?8?yWjU8k$HQont?K;3uhi_Pbd zZ$(!&H0TXeMPZ}e6mw41lDf3{S++f{&#ZfmiqagOW^n0kP>pMFLJB(|`2^<2 z3Y#Q2Da0u$0il|Vw1ABQb>&cT{QRXe*-L(14gAb=J zK$p>PuQ+%g(Uv$Ky2+4${(N($9gpchHIg?kRsksc?V*toAk*% z2!sJK8_f$QR5Xc|(F9=8jB*n6Prz{o+2uf25V;;9GO%c*qf2nA2z22y>rAL?@w>KQ zcS9YY6Z)BYSg5s)PoZjn#0Qtn=?V~D@xKgBOvB#o1VwiFxd5n;w#f^LBweEp5%+0p zS%_CxLUAv*glZh!2$6(Qsf0o@Qj5ka7~hpE01LhhybLA`)qgG+%ac*lI$~v#lFBk(Un|<_7V@+JkUX?E1wFTsxjw*UF5)L8 z4Yh4jaVgA@?6$YwAkH>pUi?2Lw=t0!eA#l(S|Tm@N%wi@o{WPfJ=h)>NhRK5wryVW z^BGE7z(|p1!V$R$g3>XN;=8Z;B4vq69Ikp;kZb4D`F24rb7)F9d)6U+)^vsIl@8HB zaON%wQ`j^E$uj${hb(?E2R$@ZZ3O3oPEwopDcBqT`_eKcpptNN7w?9C7xk+lV3nUC zc7Uw(3+?2oh%@|~Z_`$h7}H79*oXGx!Zb{>l_ior6FZ3z2l}BU&mVgT+;R$MOt<}| z&DNcQ z_TMnk|3rK86lGAI&oU8+3`RORf?a_@T zD3eIn!G06FvPfTWtTY4-$JSFfRCe~5L}?DyhF=c3fOMz0<7OZSmlD5#y4_hiW8j>N zHTiWnFi$$iDko#R(C!@wXOQbw;~k3Lg6lf}|1V#K9}g&q+b+e38J_q7C5j}umlyVM z&Y7s4iPD`{z;FpGR|xg|s(CDUFZcM2iz=VG#Pg7h#{z6(Ox41WU)dx+#qGTZI?6C25Iw5CVY?Vj<)*DfX?%|h+7YzLlYiyJn3!&gCw4w=sUrux(|9~K{g)9=ej`;QL zxMJI)mB>Q_K@j4MzN549TEHQgAE7x@p|A2j=>wDq>5IRugSf9cdT4-eHh;)puVl$ysU^(`$mBnLu9QVmJp<|KXad zit8VTd#DV!2S7JN2Cy%=-KqNkU= z?oGyJ67neb5UsSFD7d+x6Z)aWWa89ax<{e>0#dzzVxWVHa;I?b(i)&5KiQQX6Hfz4bt9Zgp_ z`%xefK+%RvvGh*b+}+t*U)OzszzJx_uIQEPUL}KE_t-5ZuS|!$sdoq0dG} zL<_gaqQ>4+Y|oPb-X_izQ8Q!;#@tB{w5Ci)&1O>tu)Wd(9pz|sxXVP*+Ttm`% z@a8k??9&;)-RYSJl!Fl+sn340d%o@Vk1LN3zAS-C8zN=2822!A1J9#SpISI3N%B5a zXay+qxUULjx!%??y$ALd3T2+8DXoYr8=fImdx)%we*f6#yR^Fu47?(`OV5(kE{0z? z+5#R2?XsP(YUalxauRUc*#6~^!Qu?_0YSWeI%K;oMu^A*y!;ZM1BVT2q{W0%tMNdPyOnG;E`P(U7 zY4&3B$B^wE=YlU_1^*_?ZzfkYmy@62){G!K3GA;*+m6BmLc99c|D|tRsCb3bHD`n63qod2%UXJ$~V=`7scut)2pbkg)#@@+Z&s zCp3%t@$iS)Kw_VcqC$h^U{L;`wRhMg4=B=#V$D+HF?fv+3ja z*YN@Z>K{sut9sDWSp5>8Eyi=`)p1CrfOAx%h}$eJlZqZz7U66M+ctPz3CZ92spw)h{Q2_OQT4Gv=$jH#YVu--4PXGFrLCC+?07wp(WY9p|Y z3m~**x&PcGy!-iDV$fsdhL?{E0?vV#@ z5EY>zCVfOIlh`TI?4I^)PQi7)vFY}pXQOb{#K>Ulwgk3xij&xyn+iAO(_h%%O^3Go zXIN#=IkPHddYzuDFg*Y8=R8O2!zI#)o_WVMl*a^#?m9Yk7w#bvX1^K_tig4u5HuDN z*ak;)O6r#%KVf-hy_kgqms`=KMOLd*Mh~zOu(k>|B`e*$C+#~-DOoMZdJAcG zc>RJ~vXsFS{^y>ZmIKS%q4HS+xu?KS=be87D*%$yw9s?$n&5YCR= zwc_(3cie(*uqF{!==NjxtY@6i=gZ#ZTeSvnb<|0u(`az|kpJg4DW>f^g6ZZnC-LLT zo@&pLLxt2k92dq$Cs*(3Vw`U69xf(ipeV(w*P@oEU;86J9Hl=q12>LkoM(I#`SI7s zRTgSS6IeP>e-^@N;b?RXc0TFv(Rh7b|UvOtU#z*o9B9 zjoyP6jBSihw?(_p&<`#|^(^1(#W>=f%4&xEi7TJ$8trB2@Sc6aSP(7Ue6s#x_)pK( zoA($8Xx;lW9Jp7kdA%yCbuxVQ=Dz)U@zz0c?rYY#eSBd&w#2r+J{u($@lex~eAqq9Xj@GdPc8)Ia` ztM~W7+*j@%^k}xpC(o+;B4!*fI>55?;_tui3zZgJb(mjIvgkN$7R@8`8ABx0mnia@ zYandHF5lpXoZg28Q9+jY(9~@_R$kqk7b4vsN&Fvs?;THd`#+AK`|d7xX`4lKQxO?O z5~5)wWG5p;87W)#=q_bTwv3P+vK_mD?2tXP_puKS&hPnpojP^DKmY#z{GLY-mGio; z>v=u*x~|v76LMTHig??VZtD+Ue0$Nc zE~g5K%c&~~uTnqv6ux<4GQzS`o%_yT^LG1$<03~h42;g6coAvaZ=3No!<2ZP?-P-+ zalG|<zZ`@ahSg@PAO*AQFP+_MRfnj4qqEOX!IE^#h<6p2l*DOvjvU4uHtN2L%vapztI4fHB?3>#aIkjyfw6_*Ye@_?(+^@V3uLeH-w& zxjXr6IM0_08=+i5bS>;$Z_#7DgIAINv~A#$ys96eXSqo`zDwRQrI!JlL&MF1@Y==5 zH^`TT2c?}8arVtK;#u~`$t5E3oR4#KWT+uOjysLb(bohic$;*n?rw4yF*2W<-8HK|V{)!<%d!t0EUy!haH7 zy|L}hIe1G>NfzmX4g^FuPV!;(lFOMZLd_M0kGQni18yYMAe7@XRPCAD@9*4rSZXoQCF8k|ri~i-G2dkHxAI+>>lAq#J zOg%*+nrv{Yv}|t#PB<{#?6>pwvgCUPM6+MWZ$yWtN~@SQk*=BGQ?=JO9hAjyC81NG zTc)S_N#!^G+QR-N5HT3&+22HAh)nU+{DCEnaCBGbkg8`tFG`?4-qShh82!zVHRZ>h zBYcY5*D2;=vh#jpB%eb+vBZ1X_K~o|Yza>G{(1yDp&->{?NCK{NfzfXE;>uTRbtmf z-qM8W%yLwC;U(sT2Q26%IyY5QBE%C!TWwEinn+{@@BVRD9oSwU^4|ZsXOdnvp77vs zaL*D6T`H>mVctqyv;Tvx`d>pvd`rJv=y5h|5$+(}PLL9zr9R`R%`Y5qVHM>|boaal zWGcSQUYRW$AJsT2?JP+`n3reIl45Ftv*CWVg5QQb|23q@qzANtv*9T<+8?Wg6{=2? zR{5P*ejDO2D$>B%HMvFG3MDVPbjz?2Wu!oNRu(7pQXbLKreBPVAo(J1Q91 zk7WXLfnu{n!TxUHixx&82$^@?JjgeeuqowcPl#+5;$%}IK7V_yL%MQ@Cn)2LWJ<(x zR870af2e+(g^UYNn_FUD+QK+tW%V*z;7N2frKtr{WKlLd@{rrv^S?kGGPjZW#pNY0e=0XY2?S6mKO7yXY_RX&TZsZ zkVo2`CgWrmunLKO83~Hcg!8C$_;}V_FcU|Zd2)8#!kqXUIwxd)nuo|IalsOXHYS5w zN-@66jW#H9v@C$171g5|1Z~$^55#xW{=5ejgSo6j=1(7MCQ;9lEMarg#Ri6-`!tt0 z3G%8&OVJ2&`h`j0=iPxIL6^xR_vQ_3$t_1jJ+V@@HIp>{hXz4M1&y-y^>_zc<3X+F zna|&+LVoR(-iwUdYo(8wW-0u4H3pj)!wcs$f>J%dA{fc=Xt6%riYsAC=pLk~VJyS< zfRczMD+yj|GOnt?3A1K$5i!pwQSq(0P)@pOl~Zp~p7sSN)txQgA_n0f_ff&Tx<+KE z8DZ8YP)QVxa=jUqBeiiTfReoSW)wg&WBQlE37C65s)zE(C1EqU@(%g*Oj`| zz;IBjD4QNk3%UTkBElg17ruspJGW))%EgNgLw@*?{h`P}AQ0h0e5^s*K+zG9O(W!c z)>A1>RU@x2Jdb!(PMH4BR?Y8`S7jXaEfsXa6eaN~B! z=G(dEEk|bY%sYQW=uY~$QT>7{+30=@we-jiL(=;|w3uM}*;&^`-SAtd1b+^|+;soR zbA`G$P%=t-qc4piJ;5D8{`xPkhNpssM5AQ&1T-q3ODa)0Rs=1dLxUgU*_oJsgF>0? zrgMAFRo!G1p)XUh9xGm9=aJiuz&aQS){ZsUGoN`=+4{oczsSx06)9x+L$BxOU$Ray z0v%s(OSE}wn}NQ-V$esfH`*26RU!90!c1%}X(D6m=Y`EMaipi$-z2~XEo<8ISy}X^ zG%vh}h;dqy3`&(o3<~<{n7y)KD~hrOmrH)zYU8i1KJ$ZH=iw2Rz=?OJ5}8qy2N9sD zgAxP7HkvNPSvtB*{CLA7x|lf=nW!g&(;rEhiTS4#UjS!)S7VZGhSaDp7RZ(cr2Z2L zHw2$RFw|C{*?XS&PG$Lk zp5=W-JLEa3ATYY9GSLwF<^%?uE9C*TrS59|A9Q_ae0 z!C<=~6YT)Z7#=XTU#j}r0gii4lpH73apVj1Gfwu4d_3ZUEBg-|1?}>pEHT@OD{;X7 z68KaYWb4{2AnWzE(^B2B)(pj2#HTv!zsb#2vLAY=#bi9o6{luVxbgjKM-ZYPmnguZ zvR{Tt+?v?s*v_tu`G&cSuduhZ#AZ&5YzlVcU1&-l|09lqgZ$tYm-rF+K|f;}GaM!# zsl^>|mLq8`WOfKgpCPQ|llNAXp{-a(isP`ahoBwK;@*MRC>hbY2CtG${h>B>cu6IL z@Y${Qj<{T2tpy2eNYxCU2x>zU@hXtTb!QM3+6=4=E413W-a*p2znt%*ctitU z-=}U_cjUVxX+fXdS_Z2orV=F?f2T(USqv1oZ6Sx*t1saz(nsqC*(7+K)=*~@>GT;| zxB`=c!*)$a6MTlP_6GJ_w8Mkj1|zn@OG%dydsD-s^Jur&9(Fuf4l;>~^`2bY}w z`0$=1K4ImOk00u6+Zr0|fdPd_1H8i5WFgOC^ z(3BcT6~f4ha6qi0y*~FT(+04-j09%~g1xoNs)h9}vBMnXsacV?%Ay~il*TEk<~u!p zpp#CScKEF@LA*JtX$&4c1nYEwk`V^s=ANdVd*SiO>&8N!wdw0&w-Nt;>@%*zehp?W zi0j~fMh-P9zL1TO{yU@l7W2A%Aj51Nw7wn?p($>??Pb**@S7tDgSX9b4`$UhN|-!R zn|X`1)C#njEO5N%Kn}REPYM2U;8Y?Dqo0ak@;gq}w6Z2fz-_(1-tF0MHq`EffD7pb zu$I;X1D>0q#Q?H9;%zuJCY_9U;8cE-a%bN67{ zmSiVqf!Yg6dP4(R-Yp+Lrx5r5J}(t{UKyJ7Gy9nyit^B=e>05FeHmTr7;0i1WCr1* z$#&pCn|kz?xV>>L9WqKy3lvr#-Zrin zg4yDOf5WdxA95~h@EPce%8keOrh61KxBT0m86&l2&Gd}~VLdcSQVG>njA!kuA zJmlpuJGmqd`068BqZ?(WOgA6FThO!W--Lgao1Iy;b3g$ zXHD0IQpznYv5o0+uVUgTLzC-vm1_}Irq*j;;(UYHQUY1CpmSGvSi16oQoe=6k-AzX z=kUR6RjwsV2_3lY$qPeLL_#L_jFq!R*LI57cDyScY_XD#9E6j=WBsy)T;!vU7U?W3 zWbmO}J^x+BEv*iHL>h^KbRTY-j_VAWZ8tp)jgG;$IDgIFGILoz?ozPCQ}!#}fX+>S zg|y>Wi1=33>TDM1FjR4Wb29!bUQS*Z2&IzJ48|F z&Xlao;_gheIEURQ0D>;*kn4n`9ccYQTIOGLnHCAIzW?2U?q*>*ydh8U5u%XjHOEV> z3m*O#4Q>mg=!*R49^XZEwDe{Fy37?_#~ekq2BIT*R~sEBO}ohH7!n*#wJ4g5QCnv5 zSjM*QG3kq+KL@>g2f&$&3_<{1`)thfe*kq0wLn)vZ~7kOyJ_-&SJ^v+0$RucBzJ3a zobG9&{m!EqHn7!dwp`l(zd+N65MKX*aT{ir>%Tqc33M%c_;qMg@C=aHZOMFoZHul< zbY+U+<8KsqlOgRxF-QUc=UHtpD5t{{x7m_bT|#DmZiV!BMI8yRdk|OeYqjzJ#k|`U zbjy3u1npk)mW1N_!vCFv_Y5jtpHQq_6P)|Mh!^BQpLmKegWEsHZ2m7!7(>xrx=?$4 zB#raGL*V-76X*P1v45PcdSb0sR#j}GVHAHt_mhC%u?qrzt)D%+ zgr?sX)I2U&6D>YpP~0*3Xv)_%cEMn2M@xHFX?oUOGh>s(o4NTFf&x~=ipr4K_uKXV!(9MoS zc%Xz9K^gDOHrhU}{QojPM!9kwk;pVfq-;(#ui-sM`@a&IGPa4x2Q!BUAoJ8%yL|5v zp3-H@UhA#r9v+4GvSV4Jw)wk}?C5WwFv~_n0d1GvyIHp=ONuIZ9V0~@235;N@k2Df zGXV^9Q-5>(PeEe#Sjd+M4HgqqPa~~^##S=opZ@iDPRVj~T&mq^!T$vVt$2IkWyFc# z-6fr6w#(6&d5-$lJly)8PH~a$=b_BN)G0ob+zrl9YD!?Se z|Ls4-+88b6EttnDfPcgtfmr_~jg%yji9+nooSyO)Q%C>gSE3#tK{Fub&-)qx%! zcE;>OpT8a`Zx`EGp-Ku|b8-Fb89Nf3`G@TDtBQhB*;P9O@@>WW3w&sw3*2GsIvMI0 z;_)X8HymGD8zA&X`Q8;hy(*z3a@1lZ{0j|%<>IF738@&*d*+wJFqrWxEn)tfn&VO} zT69=uT8}XvQ;)aUn}|j<&lmM4&Rf|Y7Tey8^0&{t7(*k)0y|l3j=k>vDS+wXvB~Dx zFT3hKBL1-3(!;ygXw$m0?etrX?oKe!NxUnx%SBUug2LMCy`>X4=Pa(FyvE0KmqazV z9p3W{bq!+$?f5;PI>#r(W7+pHsiXV2o;vKNnB}$YA^4jsNc9C5$Bk}9P(l;w1I(Z|DzZ<)uxSLocG%OYopiw zBmI={HOOB8{ui%LsITjmGa@w_o7OGqeNCHqX{W6#l2OGT8t)X~qee zxB{IT_W3{%Q|d1fnk;v+gjy0pCG%$%;eV(Ho};BS<2^FZ7a+WLdt|>DRZW25vp;1S z_DDQAvfz@672Q+EfC_JK+=6YeTm6p(CDzg6B`|cpC7I7pLt-{WiPiE9&Z^;&CKM@S*i#n)2#>Qq9uQM^iKCrr@>&Z=vAj8sIrU7C*mA$!c5Eo9sw%--9$# zxm_o`i0^ggxIv-qw`eObDR7$>jgCs5yYExivQnqz)MzOjJGT>r9#diTVWKSh1e3iG z9l_z1;Mupj)DL{GD$>Wl!=7xRNsBMhledmBBL)inA{1fJa5*dx7E{f zyDbr|N+v(lkw4s1ELkVvNC@`6$_09t=AJKQ92{xC-Xk1@ay(TCqy4Exc@akJ4#!~c zKgS_994slr8`n#1HF5bl5u8q<`*@Zhb+dY2c}r1fE!z^wiD4epetdq$wERKtWff0^ z3cQLGgjZ`f)VP`KHL&dU274sFGXpb<7g;(7sl6jbkh0j`*sTCZOT&@|1Lk~Ljo4{LS0Zc8i6&?v4uBhkKG$e3+=;H-C`h=0(%^IfaN6u0 zY-dNj7PSF`d))lB$!tINOfBXvuk!)txdjWvJf7}2v?axAzkv0K4P`yOTB^kUY8mg_ zFUrp=B*M>&GRd2`cNSN~KTQ~JzQf*M#yxM&yx+ie$d{7Eq)0Hk(#*rCXe~06LR@?# zy7S078A^cb9RqnQyH_!Ts*oa6*i!hDO1xBM<(4a*1k@3Ts>%$QRhFRuw*iszTHEAcJ-RGRGLp=K= zmYL+^@M}h~*Ug9%vpoBJ8_W2EK6|!CBaNQP2H$%bQvwlrQ#616)ITHL)RJ{{NG zL^OL?J0vG}$V`jhAt1o&k)zt-9{jkzj=!E_*gk46rB*~!W@s^wa$XS6Uv9}E?ocBM zE#rC*Flm7BqU>k?J=YMaSSq{ulB<+I`#JM=>2eZ_=H~M+A=}?Bs`GupbsxoEyOXJP z?=M{>*J-#?Dx)vDN9~N)24@6I!SYN@1(2vG7K!`)}|-qRswXo%~w12ZoC+-pVJ36S*ewfgr_mOr*3z?tdt8i zw6KyoTBq5#ow5z)K+v3jNLOd^lPlZ8mJ4ZGuJ+wyl4r^VeZid6X=dNtg0HH5s~Rwn7tJJxeO=CI8j&mq3pzdCRIj6E%7z`dr5{Ch`)Ovqc2f6(fzUO ztD}e>=mpKy5gPB0d*3PqMZDsk_Gl@R3*ed#+h9)A(;3+>LR<6Q5R_rUGUBipWFhJb zQQvwiMl}=a?DP$nvXryfd7)eGNlK7e46{``x2F@KFf=!O3hCZOE1UU9roXpJ4_KR zqc>n1IB_Y11VUQ7#34@Zo51|{vr@T)Id{hQ6jOVDl#K`Y%>}%~13x^u?zj19q^$IU zB?X=X539Nz4LM&R-rau)C@8z`E^8@2jqXyVwsm?5a}~6{1eq z!6P+krmck9gY#!PROr@M*A;JL+4syYC0P%!${+I&VDp#465hT6ZpR3kHA)6dc*dUC zzbY}~Bt+*gl71OcRS(obtX5w5hRScb%jVmj%yM=WU0u2D=r#$Rc{$xGbe^Z4?g(JC zJF^JDj7;za?A`x2ge#b}-Ri^tf>LJD1Vc$%L>}W>KRMI0M=XMr6MA<4B zZt!%Je*JZ5-15i*FpPvi&>qro>1(FBTGn7FZoAw);k$mi%WQJ6&SE3B3=H>G#32}r z44-0Y29+VQX#IIL!--KO0@TAfauTl@}8eQEF5!lNLhHP zxhL~Bbt0#GT>TAoD;b|&r;Z?M(k8l@*Q?7?#gT2(7c6?U1*G3ThM>A;8^QF)jC3!F zCtkq#R1PuCTFh2vMfYxaiRXN<3@URxC%Iad{9|OZUNdE!>HXHA8MBd;;a?0MsR|6< zi{D;^^`hx-0MC9d_2)cFe7zQ6Ax@N4AA8g=aIZqDQqbT`tz3S~q zk`-&AZS*Z1%jOr*j=otVp#Z$P47{oyZ@rRuU2T9K$n8nIym!C&T+It9Z}H;dXNa^$ z(g2QwI{IiQv+Gz*OvC40UV%8q*aAVFdCm7&n2UNe{DVwQ8co}yq3FoQlA zb47=NBv$9@sogkMTO-#I<~~~N95-4f99Oj;-C)rz*=3i;5tZ>OmNIYi-{$ zwHa4TLd9EN#(Z7%LfxZDjsa1gsSfUN^DHAU9EOjXy;}mS(UNP0Nzqm+zd(5!Bjxzb zhmI1cduN>oSZ;`-;-Q_r#FTYkUNj%qw416C`V;Hfe@Oi^%JbBo2%-5Z?|DmDff4-9 zNmM&gDSG$nK1e8SekS}owh`vodNRN)=0fZ&&97(c0CPsw0icM`uxF6whg|=6M*PYN zi|H+Rr*6UiKgXdqZQ%0@4^^exKA*$m8D`71(QYL(g-21o&^6g5zH0>PAOkAy)JSh`m>P z31cgKZfRphYt_sm6tawdan$ixNyuots&eA*-ADvCo&le4Y$4bv@{KOxDGw#mA0F0> zcm`lb!xge7z9?5Cjt%15BSmtBr?dk17VzCJo_N*%ne>SY<5<-++W5#x4Aj zzSPmz!fdzB6qTAR>v5KDap(VO7N`y`*B*)3{L!9qsZUi20sOw1?5qrDs^>f40=rTkNw731py#JL zw5eCpbRbrA(dtRq`eZS7g-#p6W%79xanCJtxsMJ!W_$h$kfzmJ%tOa^v+fYG$4dgX zA;YU_Enr{DW*z*coTk1z%{X1jMQq&9y3OTMZW$)VVsEjWCx8gD@UMgk1eJ zJ?wSZqy%FF%&GxfpPqCeJ?mPoWK$ZN1h{XBW5Bp(aXi(j`3q4F13fXH(-HSvo<$tl#Hn}XXMCI9 z$;amzJ594g_*FP3g9wn{pUUta&(<47?^thK7&t$7*k@B;n5EoA^Tg8~SCP!agPW66 za*EovJ%#zwUXV+OlZrlcy#6Xe{*fM0pZZ!1hSUo{W`)1>?QoQ5OF+S0OF>Bzp6S`v>)OsLPxTM~aI7LL%O8x!{0Gimtm` z=p-l1Pqc#qJaswjKDF1?*<_tk!7(l2vJT=e#QuTOgbRE)U)x-X7Li8EyctniP=aU& zQ^gr`f~qmlf3Yxsa#nt*ov@UZDYbyubcG%bI*FMs6|eThg|;K6U4i~wj+TEuJN-r> z$T-%zFDbrctjgk1pzA{^;6HB=BsUm@5mNy{0;4UE@d$P@10~}JpL$I+<4jkEEFSTd z;N9u_ozG;)s{DAEj5kSAS7ANAhoRPjpgK&r6yeC+R2d>xQ|;Nhh&bMB0S!^3oxK;! zY-khWc+XRNS!&<+rPLeIFK6h=_RC_t} zhFDv1tyI3qjjPO1^*xX{OeV~{fbe|xK?696 z!s|F1F&)3)S0LWPzpCdA`6t1xbwgH$8#@s`P`Hwj!aY`!iI`-@B>`ii`QHAeQZOte zzWYPtb#`Y?3U#`7Rapb1T{4Jz|J;lWK^g}xpG@~=5zUFEp5|ewcGvQgvNq)sH!G*a zR*17xkCud84>$V$q?nc1spd|Bk(I&rPP}O0Us*kh3DdrzX66ODr%EJKh1vi*D0qeC z-pVd7Uz5_mXGUte8&>#1Q~hW)4#b4;^2x#@9ZZeYrT*j3kn#iXesH|9uzbgsN|Y4C zV55;%T`e+Fb>a+kKC{QURwcgI*-AoSVuz{7U3T3J99@Xj*{BTD6l0s~S-8A8dV#3H z4qu^>T7#|c`Ve=`V1-f21SHKU_@KxT<_yuXBuuxc@3_UYzk2c*lB2p|2TNn9UYfY&o#SSRSS^m>VFvNoN@EK-4;^ij6?Lx zL)8~-&n0Cf4y>yCKUn}Xcv01*dWzkw#AN0^Xb;b#M=>66JK01qx*FjFo%A^S@zlcM zc!pu-OgqhySIr0FjU%d*2ZZQ}qvcyyHoGoFdknK_AEw3da)HW>r?WpIm14BbX)C#1 zq5b^>1f|plp&z{{_2%S4eM)7QzbNc=+3xzXAw|OFZfs(aQAzwGt%SIw0`P7>gaXk3 z$G)gO98h4g3ZM88FRg`7xVp>~iqv*0?&WfO0c-GQC^h@{$M}P%{)|E&VqdF7CvXD$ zoI1kBmyq!AsjbvG!Q;p_zKp)ITVe>U;>mC{bXrR^8E!Ds+K9+84ynu<*YP2gEna>| z>~0k7#YbZPa9iRw(KsTP#^4omG=DSVmf>p=&DKITut<7ZsOC(Rn0X*pCSl=-+Ow8>+(JImWzE z;W+$}lGewhXWXy!U@_5JXEUkE%-_&q`(_xX!d~r%3LCQrMYF_C?cQ~_kODQ7iv!d%gHiz-Ga4_g|W%gS23v=fb zchUfhDYB2~e=2qr6~#_I1=%KAQ!lPd&+^E%+D&Ov4D-bh;N1N;oyv-e)Bo(ijLR7} z_$rpowd%W?-D}uo0G(~TOTGoN)<)I%_~nt^9}r(7Qeq{It~%006BSDom?LK4$^RnK z=az#TRtp~HV?gYR62Ngj`dl+)!}s)v9s-LEw@U-_s{~8sp z$mvJOd4D>)3~Kd~gN8W@xB}?aqc|gPQ2w$@*J4}+ZcymZGQw9C7vFDZH(&M2ngB~# z#6vTr8`F!7XiR{7jH5ts9H@r#9`MpKX5pAy9D6b$ZEh$5nZjlkud1DG2R`cQd~;s? z6hNI0m9KGa?oe@pWr%M5 z3peSx>_Pbn0W(srj;B$tDN*T6q^5H|M30T>?h}`|k+*NVE!~CZ*`Biq70^O@kVSBf z0z$@7)L0ehD8tLlWlh|#ir(4|q*>q*+k8@(xHKM@kzuMKlJVq8-~t_iDCA<>qc$|{ zx*#V{jX+zhvRsf+khr52qOvf1%Z8QawdvVfBp$;Uyj%$Jir(<=LwtHfSDDl13fy1# zmPtBC5GGxv$>C6GND0Xn73ytK_c+-U3mSQ(S-SD*SfabdimCHx~8lwvM z01aCTB+13w`DDzp)3~dFTU-lKs@}+ei`@6WFub!PmeRSUlfGFC8!HPkxI1*ATAR;N zITv(V#ugI&x1~0>T?c4fd$vlM2h?7De&tPDZNt!itiZH{yBqP4EwR#l1C%_g)y_T4 z9+{$R*Ox^cJE`_yB2|aEX|~d*S&uLtWR&FtZ)Oa#J^#U8feJ_B*Lk+`gWy6!FQ(IKTW0cg{@`L^pb~Iu{067e>W4 zhu5O@V7fC$0g-cGx52ZKdbX?82k?CnkuJ!Prdp90BC%j0$SVZAtiekIR7U}|71W65 zlGa_N!2g3B8VvF&P&{hRV}cX0%5NcW#GYB4zVSyAP)m?vYIDr;Em&v!a>?{~ zrk6Y2nXqr$E&RUaE*q|uL`R&fcXiC>trCS9=8jc4N*)jV=Eu}EHRjTb{f~_`srLjD zE(@72s?2P+ntevlZRRps~#$qG9%_U_JM$TFxz zA)*1Szz3{gZHM!=82hJO9&s0VkC0rPbRh&nNX8q`!v@Bgnkti+8Yz7vk`#iZ8Nf0R zUjDY#z5-})%SlxDQoVxEzt8fT^=5q!Yv_r=2a?<l<0`V>f0pFGc!;zrNcyA`y006QX_e zQ~5&P*@pJ5#uuy|eJA;$l2v-QW_l>(K*O-eMj9#;R`Gv*W zgq7jw*@E(f^8$bbEk`-SGgzYq;6B?@sUdIId8q}81G8SAoSQDPW86*$LZ&`I-sP@r zPP?lv(n;B>X=;3}p0KidwqbvND-~1-&~rv%R~BcN;uie!&o*cf5d}nFK1ye}&>$aD z#ovR?I|zxWSmf9B$C2E7PKrpP`n1?LA<#Rwq2j?B1Gj@WaH$$n9_T#=IbJwCrCa;0 zqpdQ*%-PCmll4NCV?UNdyQ7ysWh=q>=z#rLvBkhD#nAUYSEg!h_UJ&|uuX&aP-sS} zkjwfGobUZdW?ovRmTIN+g7zG9#Q46f;SW+nniSiHd;NU`Z)4n~Id!n25UQ%$a6{R> z&rpm}I!oTjJQ}RlBxi>fGph0vH>Sku4jl6hD3u_=e%XeTuCn(vcZyKx>VawyByVUK z;D=qgoi%z?i)j5^?o?5N$$|0V{%R`{UY;OXH)mX?Hb=Lk6VSXsCxtx^f@La!O$HtB zhm#4a<9qx~eK#{6!8y0YZ{yp;V{7wrIB%_U>j$j-=hhvZ*0;s{E;$m<0aIFOm&H^) z$7YSC23yqeY0*F}?1pA=cp29!U{-4oc0)MU+esug5@ z&yIJ~K0&xmB@3G)l6bBeq~^@@GU9( zzDKI#kO2Y(t=ny%MYQWJ*fLp&o;LMO6MKKU%x2#8W^whJFI$n`mM`&~i|HqdVM<{p zp-hP+48~Pw`$I7+VT{Z#N;H>gsgr0v@X~QYLKv|YW(g&-CvRokh&-Y zaZz*`NJ?uw`6HkOLv<9Q8?ax3+p{4}RXy8X=NA@qh~>j6<)VV=%s9|;ann8W)tQ^q z13vkFjcW(+y>wt1FUg;Pl_EMM>} zwM8EtxEwmAD$8XIpwzAye1l#k9~nqAe~Czonb%lbjMC=_foj)l#Hk(6FjZys;g4x@LNMtx?OuW8#R#3}^yF-O}AM+#9$yzZaqDc2n zZR&GyMUr%gq0!BsgwBrXtu_-XO*#puS=y*GDBSAy4ZZ=|*s>|D@6G7}({qRE0g+os ztZ7?@57lodUsDiSWOLLX97#DsytFS;ght1CzWH|P_pynRIo5^ofi)RbU(O3B7aIWw|s+GfibAy9j(jBo&f(B%qa$lI&P)8OrC1RKg&gC%5c)70299@Gu3rYSv9ue`!M58rmKA)6ZCwZ**qpYTZx&k-M`ES#S(%cS$r}>)Yo`Sy+Iv}e zF%OiGIy1uNYC`i$dvPw>x(HA?y-3xi*ExGiYpeStw3VO?ootU(kzLfVQ@xEzR!~Q4 z9YbI>C~mqWn(tlvaPEwhiSjAl2mb~uR^3C=pC(!g7N>xyAYbk~G2hTOs}T$2>e0=>BC zn-|r!Lk0ahrB^LfHE9cUg7^5S!znNtq}rrikn$V*DFkj$j*3x*Zhgxx{7%UjBavn>!Vfl((4+39-0fLOnQGY}mSARD8nq7!`l~A=L;clh9qgt*=w<*1-BeVLUTeMv%~oL4 z0L>5DtEMlAL;UMb$BnpzstBHLx^(12KL?E=^m`x`GxwdB<&t%ZPrOR3l{f&U3M2_| z1{QWZdcK6P4hc6JLkPj@OIP=i2-i5)2wDGBkyb=kUb-2KggD8nkU)S@Jn63Bk0Ub7zngfgs?HTr?!~*B}=kPvFHD1hRIq6*# zaga#?ImF#QhN|$eHl*XGh?7<|ilHP)>Nc!`Ie&(Mqx!4gCotSlr2VPB&+8A5LbJ@5 z)J7Yyh=|sB^E`^)t8is|O4Vzcr%q2*^AxWEmwQ}E;$o4Usv%9-eg=UY3Yx|P) zzzC|2kC~Q;BhX!L=aUimT!MT4>U~%qwbx=Ql4E>_ zO&F5>jZENQ48<2{5d+QMTVdBGs;2cm{A>Rw5D+0&DqRc|B;rcu1n&O9%h{lgkZQw= z?>ACmSXlJz@JkSIayE`cOvStGrOQS{FKiO3F!45uqv8GAC-P@3yhPxan0PS6Qf977 z7Kt{BpT`}KV0s)U67fno_DT)Teb&wvDa|6*rx42VSoN&Dyt{N!19`&+9{2ZdzKt5z#!W7Oa2wX-Sy#yRgOb)9Hw`$W(?ST^x`p1od#< z1a3568)e9JZtFQZ*64e{d9d^<0ID>npf*x=$G(ppNzCQFezvpXol^N@X=omzF_es+ zL2Blpzrg#KhZMLM{EwsY#J+Xld6aGy@A444qna^Z?Ci?@Saf#T4xWWZiLz)dX!l4F z%z6LM&;_Bok9zG{dbRRMhhwRwb7eT-0ZF|9zZi20-}>C+>db^3U9YpN1a z*9a4b*&r!yuq=@m&jx{{ku>CdDwMGPxw%(0dL5h+Pz@jTZh=!G&z|0+Vsnbv=?9{X zQcp@io6h~C3GwjN){m6KiPIPU-h)Y&md@g_bS&4f$slQL^;odaseGSwT>k;%jH=-I z)Ryf4sF~`uVV}Pa*+YT^*eI>Bmte>JgR|Y#Ivky>_oYM-`gLe&bD)H)4Ou90kaRCT zSmGyM=*qvx6>da{f&LxCn|VMG2MRb@S|7_US2VK-EigbTpAhhK5HWXY;Dm00xp9f5WkU?u5W?ljGyT=jx)P%jsooY+nVK(q zyZ-2{oAwgmv1SMbx>~2b0lkCII#4FI$K9z7+n&I+&=^yyqzh{2#x4q^q^mk!t2O|% zFvz`#I9wNV2w`tvVoWjz=o_dqrZ$4q{a}`b@RiY2K9cWC?+w-=rd!>a%h<{gRNm2@ zhYlVJfVge>SQ=*|)H}Y2VU=%VD&B?EjSl_0b7^R(gU53$QDUK}(p&GlJ7wG?kY+_j zo6h?+ZI!SZ5waXOvEKExtc4{&vRAIep3XHOq< zx>(!C#yTKMJZ}h?g@5pXGDFQuy%EHSw_Vjotsa0`?(8RB1mTv|1*Ox~mA6@`vw0m+ zxAKs-ENCO~tO#46_Bwp%&}cA2D)SkgGGztW>%#Mna&FPhCnoW;4WXZ>BVG^Nc)!-O zX#IG5v8WQV!$~tP-2*L0XU&Y$1^GnI9Zr%zP@P4m?KAFoiMd+7gi+pkS{Kb%E7j0& zLCHJ)y@`p>8N$`d@Wr+QiMbr+L$nyan_$>g4R7KE&mdtvrfL*w=#b;u^x{L>(>^$s zfqDn;QL@L*Uc+V#%6|VMbwXV&P<@rra>2ryh+?!#{8cBsV`uYx;A>B{fc1ci9|sXE`eqxD`_I~RiaTX*d3 zwN_ha7dp$5f*?hea}^ZQi5DE1oQPAITYBv_rv6<=Au9Qnu|_F`dr)#iuSRl%7ox>@ zS>kKF_#k!yM}-7+)dL7=^`&lE7(nkHgzuOt#VK}3xAAI(*jOm)V(qcpO%dn8P> zAagJoJk80BG)MxwAw0g^V0O$WII5#^+f2+^n^`I%aUnQ!)+bHOTyyW<$i>g#mfrY* z7#;*M@30bp7@v-O1TlJwmElkTWVa>wAa`R_dBwhHZM2|$Oy};NjXzDDZjoT~I<*lxfKIVPKzW4eNO-pM)}Xsy34YAK zIy#eBxo$6ii=(*?FWQtzxGeRR4)-9N0owgU2{Y;DM;wlvx__%>14J?{J&=wf)NE;YJiIqJ=B<)aZXNoLZEg0|Y9t`voXh8tiij#c;J_xouPRZ8V7q{u+ip60PU+~t>-D#b zs=PO2m>$2uU|J=A;Epf2qnBEJ_)qW!N_ASHfcjN5b4d1grjkaP%64=hAO*3#yGGHR zV?A=BA~nBueC|KUyN@7Gs1Q`~72J19PktC^5pEQ{iJ!y!syX_jAxL;{830>`R$F~=y3!ATFG;UwPh{7$kJ;C-j9{z0T4+n0 zEbDx~pf)sN705$pKdq_3*}px5_ZL*axEZtIM;fp1qTpx@%GBZkFcXS`gPRQCY>cAl zTJ{@c{V=5j=(812$q-b&-F1QlB%-kwR>5CoTK8)mKvAwCTx4mXm%LbC<(EwY@(t3Y z%#pAcdySAr3n$Ma<)vaA%Z6stWq6`r5$sn9Qu@_94#;;6mzh=Xu-N?kjoQ0p-8Z+0O4l8lWKsx8hg zt%qNC7KeJiKghN7ka&XDz03TH4{n;gQT7g}G8f9bWOaCk_JYAK-p9heSi#4ZLi7wx zgWpUa1{yz#5HFN_8Hl;LOFl?c;Iq)9^tiv=UrGj~YiT?^v(x7fnehXxRc?8!-7O)x zC!Ix`J~7*E<>Fh4JG4!V(`}vMc+1Q5ZGE<(yd-T|Mk`4h3u@WdacI2JpBmQ8?EQd1 zRn0G^^YUybf-6jRoAb=QWTRL1p?IlD{ye?SL+nDkSMDgiwx|!vG*x8B9M9YulzMSE zG=`X=b31Ps?{i)^2V#8s1j!#&S=Ph}yig7sk`i?)3=43+r(;vWLI;a=XwZhzOs9J|rAg)5;k zj*ZK3PrBSeqYP~}mZ4g_+W3eK_ja3CnCR@x=d)r$)}7D)#Ec|-#N~;9z-t_?UT&+0 z-7VH0QER-ewY^~_=D$s+t&D0G$^bs*U9)5If zXca!7dDH1GzgP?-N4GilvSJnUlej=xVtw{R`C9?|_|Ad13a~53$x;30?Jd`vj7yp; zY6l3;8BPP4)fZcn#vhit4twFN)D5G~&valnYVoJIT{m#V)7qksdl5*}PgBImYW3UJ z%uK{+!(1coAHxl+g1nog8JD`1qYVHijPAYC_U^z!r`pPK$q%`wNq|Oq9obTJRdgK+ zJ4PY0iX2X@`0~Kv)cR4CEeSZIBNs)lqop2oZ{xw(y?%BLJO?#~mwR*T1MU=ern6bw z`vHKeW5hbjyYbS6e!_Ik|(f-e8ovk3*g0a7Q!^WcO zEZezf7ZHdm%uBbwc{jVxh!2JFjcxvmoXx`68)~b%R-G;G`3X*UmlAzn^{eVL1l^dc zXEO@3g=!*`i~q4$58CoK*lUTwe4%TQKXzS9`;LuqB=FtQcE=K22T$F)Lx=mU^-4a?1eqiGNLil#cyu`(@`2~+iMRkc0@b;qyG|#95H*< zh*?w?L)aKLzi@|zi$AbM6coPr>~8gw`YY%;US6%fYL>DUrz=BY8{U6;oh$pBI!b)Q zFhqj*Ze%|7qib&(=(xfK`2l-wZPC@*H+9}km)NGJ4GyfYG>J~XOU}4Kx4k|bvwfz> zKatX)JUiducDZdI4bHb^DDFyV`NotyosbOsVTdlw)BVZY7FmP9mRUo@cWJjig4?{-AO%~_SZ>P9<5WHyagyYJ?)p#P7_5UO5z2m9=-~Vy1mWHU5 zJt}3Dk-b$yg(O6og%Gm0<0z%c(QlgJPl2)Fl(7zeKuO(+;;nRO-8_2#d7n`@_;CB&j?r7*VRh)e3eC{6Ns&IPe}~d!DLo?bE?Gb- z7j0ZfQ5mWC$lli20g)AQ**9R!eT|at(_TXAes4u*`EFAhOv}*ZlxAK<=&@b;s@idj-1dQnVhx>e8Nk?Z!4fR1yS zoe`$dCs!G>RG3x+CsE5QIa-!rK*PHRB%m7tdx%$ROO7?t`!*TKx@f%HZKSX{dy%-@ zCj=heD$;bXU*sLx38))FteZ|6er8@&rW#Kts{1JB!d5b^Jn3S717nr!q9(}6LDzY- zFb8j(+QU;Mr^VMkYyC^;)`{dDe3dNG{Bp%k)LAtk?OKnN@ESy(zu`rN4dkNrB{Cnj>>M2 zU_!)_=8{RLnh7!3f5^rZzsIk0g0Ve zC$}AQcKyRBitl&Ls3f`LjMg(qmoXqW{P?X+LR0`Dgj^q;`>mJQH!b z^&X~0oriqP8I3mgSnH7uWQ{)M@eqxh=e%5>^*erDI;^f+tBlX~XIRAwZhFyHpPVd! z^&lT!f$1p>t$}_jc!qDP@I|mD^y1WR8$dN%)X7I5~kXY-?+4^tYaY@9=Qg zA!b3x*$>(|^OG6+_#b``)b8D5Y9)OYlyRGjt6kb2X05K+PZAq<+}Wi!`-{m(tw0r@%trGTaSES2jgEJ*ra@62Gi%71(FnAWxg**^JlJs!22; zDE!pvT zymp`b=htxc#ExK-fd0rnuV~h|Co29g=uO#!#FqzK&mb<~b;b6)+$Xc&KLryFCnI)^ zEFdCsm5?x6Hh!hK)x8T@9_W<=Pz6e)CV-eCrkcXJ*{a!d>l6CE$>_=pHa#_)&r0#| zu=MO~KH?}JCS2@^g88isZ72I#>~_?UYV`|Q-IKB#k4#&zh54D%o_Ks%t-b8@%^g9K zYeNDjw**JdAxVZPO9~*B50hIO2F-}&Yp6sxI<4f))Tg(Tepu{TfB3ZI%F{JgS7FfNC(q$c@#xqqQju05v@N?dSyU!>C!4x18r2hFyVMw5w`Oh{ zoIYYz#X%BFx)bwWY!YobM4w%;9(f$L?3qRBRr5Lvh@-Q;?~K7lhmixde^hOI(`B7cgd~z#qL|6p){ezn+{52}4g~w@&+(vEOxgF;{Brv~uW=u0NO? zb>pSF;JRcH%b*J4c&#^;E)=GFe=x4D<2Mq6cRYW_tTNKq4PngPnPiD+d+ngg=ipt6 zQ%kx@7T}jkf1O4jy?7B62*5R8wAcr!O%*_jJ$rHljFZK7ZkH(zB8FX0MNY+GkY4hu z%v1h+c5%N%dvltyu5MdjmI7Jj%hf<@nKK4kjo1*?m&cBcg`hnww(q0#hBHZ^z_=In zmlf5t@4gjVyyQ-Fp7$I@6Dt4lI+A!+{gatbgFV?@l@ptd8jG`|!NBazZur7xX#h+#K&#S+$TA@yeVY=7ZQ`=vdtt)lw0MXIuM>_aQR&4==*p6Mx-Y5z^nm+y`kMkn-a} zgR`?LlLXC9-JQKtUtHr!y}tin%TDE;Q_}VPV{^@cRhQ+w@4`rdIj`r@`5q16)y1zR=t3|qt0 z3^(th7KpT^o-b3cq3P0-!>2EzcjwWR-N2Tw{zMC4=r9iadP|n1o0pH49qS$0t~|5+ zg*oc+WI%_SLF?*mrN>o~vOyz7qviB<#7^fpe_>GlRJ3H_Uyn-0sp!VeMAE{3aN0s_ z;<~@9F-fB45{ML7K!P)Z$8iXkeOSB3aT za@V2^mRb$`7-hE%Mw4YF-`iU1Ex3>VZk|&R)>xxOKT`0(t?E4f9=IwHwA0W^6ef1o zk;L?6*ozL3g%=$Sx}f^ITNV-3Y!;0f=Dtk?ftP|v_bbij5FA>8fOprd`JbjWy{|e$ z$+GUU3*Vbx#%ji|wjXPu=Dba`t8qLZ6>(1Yw{|weKV%_4WSyD(Bo~RfE<4q}0Y>Q6 z{aV#w#Fg(U;leA|G!cmOnBfzxA*As&i4`Q{zZBtAdupBgys7WGc1Cy?ATW7O7x}We)Y(?TuC^b^ zfL@s;*&Kq`B*v8tb`-X!NLw=+M%gX~j#9%#!ZJ1!1O-df6U@}gMn5g_{L>Nj(5KtU zti7j7<9g@350J5!y?)ClprAXIaq}PpSK2E!DW#}W&Bmb z$Q}+}x@ltBvbL@kT6;wMR!c(vW{`14czgEEah~T1)Ec$??TDjH=!0-z53H!DaGCzC zw`@v6SpYpqjcpjDhMzGQ-i+ATsPmLd-CZKC%14OTY`|??;E~ z?hp~cBHM%wThf)OXDYQJ(R9s(;~hH+`ckGns`K_KM zQ4rrn&J*8UW|#S@mjK>R(|oq@)W*$_SmK5^`dpw6=3z!wIsX2UK(unm44HR&amKxq zXRm$F8`m-2;X4d_S^>?-;>zC+8oW0b*cG0-oG~BE%EsjPEKJs<#3>YhLU##ZG>szu z=s`Y*)RScVsY9fQ*N-R4@pb83RT8b2cziXRtbO^GdQY!r#ZY%9$HXj~wuqa$3F$hk zNNs*0(K~x?8`<_eF#Y0|9XlL08dOTuu_O-CdO%*|v&J7g)fKN9dA|d48uvyC`+e&^ zMKr`8MJXz8Av|~0b5_>ryshi^HLhJ03n)6)qNGnuq&@c6N4g-6cWn?7J};}H`NB69 z{m|$24}(SUCc}<_5__%f`TAoyu0!Q&kpdc1jd;zvslu$_0@FDER?-6Y@f0mn*_hP%e#g>YV%GouD=>meycvR&>;Tg!D*i?N@RFq(U4x+SQY8sC0i(Q+G7? z*rG11K_bIr2E>QajmnsYRXQMj{C1Q=p+lR&g4D78|4;w$sJ9x*NyGY<;N@e>F;v^fa3sw@9qe; zs_N?hvC9UTQx>1OL$IxSA?qheoKCcDQbhB$NR0(_$?9lp(`gwj4;O9u;VCzF3{bf4 zjV3-%@x>kMIA1nCC&E=SG68TBx%=vx^j~V^+lR&&u0*ddZPU}U9~O7IzL)n1JDPlk z8$me!QEr&(VU+S7t&ge0ET5H~p@_-|a@A%c`=uef8OFBE0kOWK^-ibDA~|#7dPOS< z)+nK{C$S{$-buqZTL_N;q9t$XyYRSH=KZy-;>7Hf z-D%oP9eXuC@nxTUgE|;KcRU1c59a3P{4ssy99boc_)&ZGPGLJ1E1IyBziDsq2CujJ zdt(-hfpgEuk{kKy?~s13b|3bMugJQ8((uH=&Or%8Mj3iE3en&B9U!!b!c|Ee0@8l8~UZHSg2v%IHg)qQr)*z;V~4Fd{=TCU-frCHi(Mze~N!c?m(tVva04RT#c&o_e6c>=RpB&r;O zZ~5}p9LqQ~TfqP|G|$Pyd+#vPiU0f1A#@Ga()6C3X%3vw>$JYC?Rl1ATxbyyPvoZ= z{&t>)WH92V6~wB#vpOVQz8q-1=+8)llA7e%a1oN(dYQ0~%=rCGf49)JH~hNCrbIdS zMJs&&DHuXtW@&cA?EzMuq5v9;~Iay z!2oz!BCO-IFiedmbX!-Ogwo1ae=Y9kY*UUJGzGRj;!jtVtGX!oa#&G zE~Z2N@f+gRtseMdm&sCi^+1#;zukB+ceLs_h8d^T90cPKoV_$eJ2HqqTY=xEIs=PY z>LIa^o0wO`S>moNgMjq^e8%1(kE8QJ6Wim9(4A9{t4xWeH*T!q@Rz_!`FStvl%4H) z)|;?9QvY`yKjj&2Fl`D012l#oZeXbUpuqUi2jKYw|MyGCzXIg`p08+likpYm&%~dW z^Z)l7>Y;nruqT@+(bOhcQ7JmBW13_zBVtzAffnH7?n>E5@A!?}x z%R1~7_ArY~`7z+!vhReFQH?a7>kt|L?9{pRk9>hJu;bhL=&rsmm1K!UvT@Es(V`@h zp^kfALH;F*f1d@q^zfds0hZrbC4PiMOsScbyU4?V{zO-_KdR;M zLaU;Ha$cgk3v;E}#(b@CyUjv$C$B}(vpZcHnp=|8dr$SsfR{EX`lGuzo#7>M=89v9Ipgc4D5PjO{_6V0-3z=L;$6{7mi+~*c}?7nO{3IJVce%&QxnQA zug~|h*sU5~0{udE>&7)8g2j;b4mjl$<4=*q6f8?O_45ReUOHJ^EPjO-n7fimC*-cSz9k}5BSQMW54Rf%N z{A$I=Yjb*fn)I|S-2Ss^jVW0rU9J?BoZ!><{sn{DeDLm!t%$V%7^Anrf6rL0ywF*O zxhP^aK;J~e=TY|!yxGN=P>ZyfVYuG?I&2p-Ncvd{GoptP7qN2JzV~+0^YTi@ewNg{Eju=vn~YZ z8bA9l@WkiO6;_wcWr!=PnD5KiOW|~lFHLrCBO5#%pHSJ$1wH`}5Aa)A9aEnZ zJ(j8TsC}F9UZ91QMKIWNMiO-!cpBpmr_K{PtlA-14AyX}J9&0`{uF0q)sA)KPD4LV zXI@dE?R&v`IJkSjK>1%ML@ESn6H2*}Os)$)Jbnr-&E+$b8R#c-`{R^{`~fMIDPP^* z>r9BMv#RyuyIRmhsg<@`gn%#C4#wa!{9)pbmv~4W2>gc{o9Rzm4Q9?PD2O1#R!M)r z7!cZMQt%M_ffHw2t@;ZDZTI;BektGkYvEV*9|~d4-5;`5O3T^5qYMvwoBiLMc0;}d zZ8MVDpi@ULx`~FMPbp)YbH9=I&=JOM5mfI2V(SgXGtb zO53wDepg}X98n|;O8*!KdjLQ8%0q^lKIlr}cp%xJyr^)r(`LdZ2MGn&a?#j4gj(Sh zd{Pv39Uu(?<%1>0kM76!cWZ_s$Uyk?a_e(@8Ad*bthU|O5w1}j^mNwv$?cygU2c7Z z_Al3Zd4x1qw_9MXds?9xP^Ht@bHwmLU{)shp5DQA&qk!v?+Vj#DLpH_*@_oH;*z>ssy2ddOuCvXqQpYnkNgG=14zShDaAl}=ABM|vR+V~+Ffn{r#VN+$+O+@`JAa!E&$AW zI^fDhjni}sM&s`XmTpTEiQSh@TOCGZ&|eDyxJd<<*DiE3Ny`C0yMnKcN-Ry*`VEgl z%0zq5w7yNv?KU@haCt4Z7Pv~2zxKmjHAA5VGt1k|+z$;z2W)q9hDh@a10c;%17?aS zo$ihNIZ?&BbJT30q4+(OHTQ1!O9O@iw&I2GlHNi2@0dFYiI_(lDf1LB7#EEsL^0ec z^=RJ?A;pS-Z8rqfCZ(jN1po*?VJdyP$pg)-Ni28^H>j8TJun#~_6nZ#e7(FT8C$};zN^i_^X>y#qngTdFTk`1sSL2Rq~lnr@DFh6 zSKbwdJzx6eQo1B_a?5}1=09YgIsSr)%j1a=uknt8{XQJOLN6ZszuQ z$vk-A%!CQBrDR&&Cqw{>Va_dYboQ^;nwBqJh4l2=Qk*$P@O_+WWPe=AkjRpCL&NeV zEy4!yX26uKxlA&!--ep0*7n!jOGtOY_rzsorEr5^A%MPyr#{KST0INrc|K{5!WX*y z+O1DR>A<4z{lOf|HO9R=HuIM=6|qN*=+V39rnT&XC}aPO`-DH#p9V2mt^a zW^B>fIa=El;iS6_%gOrI^aJH(zq_bE)OGlV{uRjb;(I~ZbN9Yx!ku->0L|=MB0CI{ z46MxWh;6?;WZzeWC3|v^X5S@s_PAUwobj0U2NBwOw1qo;QOn17YGcydx2g5v!^E42 zhm7-J3k_ZL#XYu`+WMwUNkee7i$4OtkrAb!L=fdB$zr~8j-S2YnXaH&idl8T-IULF z+Y?l}eX~bOGc@0wi^Kmz(tFhUlG#OLBjPJO;s2#$(~Xa7mj&l2Pefo@dVj&(eU zd{*mgA(u>+>IO<+ShmOfg+YNJ#>V1Bm;PGC#2zD_=5^^vyBw7-n=#L}daZH@LR1M9 z^Zp-s^!Y!dh)`k8b!$uAnW^*1Z*A&!8{Z0#m^t@a2#podmE-{JCdOU&3E-!9t1|Lj zCO$}!B~V3&)w4;CF=Bn9nCRhCIz%ZonD4YRc@p)Dty!kRb>um0{x%x@%m608ZBulK zSQ-9o${M@2G2EMHWvVYdeSjinP6tN0Qrmrkh=s*ws405C16LFB${$25cHaLGR@3Ru zpgvSOKRxdUq$4#?_z>aNduVPBnFSqd{S(Jz?c{p!51oZX0ym_4erFj~H@JT(WgU^s za4bjT{2+{Z)PrlD%>P!LTnbiJgvK>iUm;BnvDUk8JdV_F`0PHM7!RU`IHq!3ZdhM| zQ2Y`BSjW1K42}SqA-ANN?+qrHT2Q3O5N8lP?_fv5ld!2PjdS)Tn14C|ZVLFheCiR4EZ>}J9>h^))2)WHo2%QiKGAu=@dsjvRJ&*+wyg$y(vVN`{ z5}3R6kd@}KI-<~-TGtl;tPlVo$IMeMPj*K;rxp2CPCUcx9pKcN~Ze((GpnX_-xy=t~f`m8-E*_fZY&R*f9&BiTA2PSSgZ&bQZZqZ4c zcq?(guBDK~3ld4(^{}-Vm46I_nZzkaaon}!918nAN#ynWA=tpI`%{Dk0bLWn=|kg4 z97WkhoPa&l_>oe(Ui{Rd#fw?UkCDyR8?-+%*wbx zxF&uiG@yR_MDq>76YP;qsQIgHraRraik9Ug9>Gkcm@>z)NNpjK&&h0e2(c8_=pKTa z1>3S!&SHyZSRViejJ7h6+j&N5d8yd*uJu<;M4iCTzv9Bj2<$R-DScPtKI;`oo6}lR zNSOw=F@gY99JQe7e7U(#x(2c=0cP3iAb*5p@~)(x=<>E&pof)K_M{S^@f_1E_6g}f z$|&c=Ga6A;5UENeglJ7}$*fm8+obHocw2QMbMXG;Vja`8cdJPz(Er%G*CGn?oAvl3 zy97l4HSqfk;N05SP%^Jk!O&bK6Fr%zHN}VPIuP1Ig-{ z7VxF+Zh|sb1>XgXSL7#@S>C9+%-UCBTg_7OPzY_@%7&Om?Q4;sjVqbJJO~Mlejo8h ziO$VEwcm1QVY>cly0ZAUSx==n@&*`u#*ol$5WUp6$LKXf_`n7UPp7fSlcl6Wz|cn{ zuk{f-mY{S;Eonz;rc4J*lnV5ShA8Kg3>$qF10E?+(KN@tq?V6eOhYzQZ&q&^bC&Zx)ReoYN zMI?6@gFwVFT#2d?Dsgu+0%r=I-KqPB4V7I4qhIiB+xTa>?ebgC3gkhjC|%RQIs+FI z%aJIDzK+GxT_neoHmRuap+OiE-NU^Ezi&u!&*u#a4k%4#x$6rc%vt-Ig>GeC`fCe> zLv+shh{yo02pF(38RF0iax=(~Q6V!#iUhkeO7Q?f9Z_%jFdltQrVqBJkTIE_mfFp- zQJl3PALuty^FeSDvN@L>S2rPwPW;_JAC%lopuAzBLx?*56Zs)5>AnAa1o8J$RB_<06mPu8dH3OKplyQeYRa4OzGS5fuvHaijjfn?1@2?Ie5nKw$vp^ zDuIn%24KT!wcgor>+6YX4{H{QeL{E!c>wRK!>&yJu@@ak zUV_Y5?gN=m9YdXrrL68NJcMtvX-bKcD~(-oBQ~sVjDGJ9r#G)Z&jHmn98JNd665T- z+>YpKotEPy)#gix)=ytjsdBVWsL1O1*H>KmqI|cI{Lhnex?9iPtT7zAuzZj9Bj(cF zt;{)CTs$LV06onhj5lU@veV+d+3pOJtcOS5FULMjiY-6ZD2OqQp1GXs7I(1B3 zGvVRrbbIWh1$CeDMY+SV&6)=Dh3m|3k~r2SZbE(h-w@ca7v>E~fr>_1emm0jBB#Kz z;rjE0%D3Aof_mx@kC$9+N7Q+wCX$AQ{H~PQm@P6@B{M$2``6NHyZn9DkP{cE}u*Hv6!kZQB89HnqBeC>2gWxIV1_ei-`j-e;~{6 zG&lMxwN(pJ7VkHp{ILUZQ)^qFA}VjD5*Vs2|O z*W!`z7{H&lVtFT{qD%k*jdVQZIh1i{b^0G-b|evm>K1>D1pe9S&0CM;cF~iJ?s%W_ z=wN%F@O1SLqjSyG&-c%jC$5f5S11-(D?75<{#JZeKkFY1` zl?D3VJv#LVVhBhfGUO$hKczjXX8&NN=vY(8QZA*5K<~0~H}i}eH3E^ux@S!;7}rmx zP!3SafP@l*z#1O1J0?SO;msGu`_?Rsa|5Z0hnvElN*`zte1ZgW^EsjcCh?wCr?g`s=oi3*kO3l>-agqltcG6t{RyFRL=Pg%+sc7G&)w ztXqR2`Uqc^hM-i8i-ChNtCW4U_-Dob2d^N5PnqYm^HJmY4@jm6e#Vor6PHZ@$`Q7b zlju?Q!4!UTtv6CMQomfhla-;526H%hl5OQ{UBag5XBk*6_7hT`Rko10z*W)p-6nW7 z-rdLB*;58OMY)OxNtNd_78rYycB)9vJilg%bUO)j*%u=23~6{S@3y@XGvraxV1VBu zt6h;8y19gEqGGmk>Cb#;ut^z78{!qv-KpL@ox@aj7}>WzjtKj^|A}Can1?c1ker?` z%7*qsm^}V0#<~A$`&POs2c%$2glso&RA3$&Xho%&LJCeaYkOhy0bZho1YtGk|CCmn zR*$~-uO8rfKF1U}aqcj%^_kvVt+l6P%Q2u&!S@7OAO#R{17}nY8ChcTU1SM0 zp6b!(%*~rpULj9(BB8bbDc>5oVcu^$&w4()ytPss`@>!@<|q(;!JIV>@`*_2+Vi01 zlDcT5aDxfO_C|n};-a!cWy7u8ohpXW>qG}gfXudG;@1b0%2}f)E8IYw`8I{PeUs4; zmF(VvWWYtAg8Lshu$Qdf&bfRjz}kYgJiaL@N-`=mDXY_mc|10iO!YkjBQb=3R3j~? zvji!?x+E(}d;KMdL6R6m`LE61rI^ZXtSJzPuILrI)*kYOkA^IKFbS#4!iT>f`ks)O zYjM4`;%9G@kj@IEGPOY~9z7UP^tpEQ%^QIG&rj?1OFdV=Mv6ea#AsoQhhDCTAuC2O zKDZr;n_ynj^yRvN+yL+CqwWd{f7~C^WWz!iX^EtO993RZe=PxdISR23yiDhcZMh}< z407{T5|gq;3%`LTAI*|ab=+KitEgzIB?VtSDsP2+upgv>l$g|k#6kBe@JKnIRTeT} z;q@Sh*V*J3NJouEPk2ZoyZ6Fpr4gZ&qi@ooRG{fRC@_hifb5!2Ib~GAg0k?*u~%G6 z^vUJqaqLBWw;~DOIb;WPAaL_1*YgBdqq(^4aZmL=ZeoT*ecMpaYM#aT-t1?>G5{*I zlR$4Cb?PE;2|{z@c>2RF&AoFjP?rCYpnA^AY%!=-@wM>DO{lUw{=Lm8upaP)&FaJ~ zG@s>uxz-@c012K<=cFH^azLY}ZatiX4p29{a=TVbty$)QE}bjkCF}Xo~&Ha)(~* z$@sl0N9<>YLMN1`)iHC{4EjYmmi=)$fUf~@%Vic*6ogfk(&OV6;bu3s$jL&sHI3An zexCU32`X`K6tBuOu!DhqyLb#Bsxy3;WHIb)*qeQYzt7fD(@t#iAQy*Zth3%^!<8r& zv;YU*+gX-q{IkhsNviWgNCdkd%RJG^+*a*AwY{g=+pF!76pq%Y$-X0m@={00caGV$ z>|Zv6yN9kz0&eN|OJ~{~;(tiFfky-8_(tjwfbqFmc6;?;^qy6rTtY9#83^ zRjQet$;m2jXr}zF11ewmapUp~psi*yLrh6oLej6yy$%dj}^pWGz~mwK4Io&<~==@&Su+h5jr9k+b3s-U1id;qhcUT-(mp<8`B{? z^vTaG+k9|eFVgmB<$;vVac?f~5PRIt&x^Y#sr0vQLPqVwuVz@5%IfXYD%3n~jy>k} zo3W|#hp)%{&%)PIvvtdIEaohSpSo=~L|fIBs=w6o{4?9fMs!C^D(M4NZs1Fy0UMYa z$lnafAqy$t^Y$JPH{=Vy7m=hpl<#WayBD3n60v0Bj9*JC364?#yO~~WkWyQHeX1uN z;B}ekAip`Y6h|rYe8w(YU-H9{&Uzb*ZaB2XDKg*>_5AvCbL zcse95sDSFrG!_;`G&iwCv{P`)Y?gP@9wSqJ_BZ;6W$`b4_l>DV9vaXU^++;jXU#}u z@EV*2gNNcG*A1Gdhg=P(7V1hoj+v{he!6j^`ukGe)R0@UxIy2}#&C4`RC{6sD+^c{MzPxH{x*it2-ctqyTz>=X7* zSJ(et3xHa)o_xTGWd0!YhL*LzW^kFTa{AwjB3XblVzJ!K6f1xN;#P*Lot!fC43nK{ z;hHo!Evy1mqoDxc|9*6olSdps{%vKIe5d&RhwrwP;~&|@-W4tws7qb8{c7bQbNS@S z_Wm9jUTi5;i8WeT!6*|TQr7%6d3T~pPCxD;M!Y9eKjP^;lEH=CCL#bA>*4|+e+IGw z^+P6OuMj~drwRO_BkCzIIb7t@fjzHMsh_oE#0n8LQgN|`H*P+4LdqwH^O5VVTWZzu zg_udnB{Ud^0z{cYOOhx2CrADSO@Lxw3g;9_HMRVOV^0v;*}p$NsCbqY6yy|F!S7Y- zu;hiYraJdI^QW=F15uDY_GHQNKRcb$EaURT>NZMTVlXCX7zXcfv z5LapG-0H%S`}o~Dq<*d?wq)5B50kI{ITxH)_g#^tUu<^nzQB*?37fyZ!;&D}L>N1< z*}cTd3ZzJmWy6m*bS{PqeP*a6z52ZpB&>Y~t&IrX&O>q)db?{iobCuo=Q!WP&c8T~ z|Ar19Blw#yYCS2@ib>`B1gnY)5AgI*bddLK{cJd*M1G7j6H0x|!DYCS_t#m-^{vm} z?!@0!(-)a74~i%V6`EsyhyEVDpE~o&``~i+Em+N=5cgMSlGXA&N~qMnEve&ruT8W6 zNq4&ly_^sdYWGCZR{sbdJbUA`VKgfmEq15sR4~gzL#boQS=Cle_K-8qBebyalU?S+ z$CA^xi*aY^_6G?f=u{5q(!<*SP;JP?OcNL9bkF9Zrcx2h$?UjFRy}wLl`mf%}wS z8ZEVNORgumer0E6z1uJ~_PFN45y=Jc?n{#`!72kzlk>um8Z?3ku{YPk{cqVoW%jGb z9!S+IIuF|$!1RbBlE1-f#!XQPvS3JZsz35e`BdZ_u~7HGSttA&dqv9tM{5SAWIb=J zVpD;C#_-xFVa-tMV(VD*^Yzw|ZC92)&$!pu$-ugxdSr3p2C1(U)0?zdHi9?c_z;n2 zRQC!c#72!}!0jyrsdlj(=oy7*as2Ihl{zzmwQ6q(5hB z+V`MfgfF#28Oyi6;=E&DUV&-dLnyMlc894C8Xj_M{!ZVnymSN4VSUw!6e<#N9gHHaNC=usTY7&K=@-S9-wz?_FSbHK9%N*Cu9b{j(%0 z)n-oFuS+)gYs(^{_o`0`;cs1-`{uK?(7KIowI|84*^`9dDVrQWgDO$In_c&FnoxX| zEA0y{jM1m*y|voA^KkXnIpxz{4}^@(1w0>~k4U)H`*~g@eQ?MA?GX@?pNtQ@IA^=$ zk$(1j!uf9umnGWJZyxX2B3%9H!Up;48uaf*1`^Tl!uzLGj!eZaKCe%PeVYE^ozbM* zV#@lt=zehT>bZp9sWZX`b2C@fGGD*7c=di?=*v|uSPQZIZ(9=pcAxo2wdXJyy*LXI8^>N5|HIB$3U`r0v96ivA)hqkWi zR-KS>Iyc^t`{kmPc;cE&ABz}stcS=|2N5MYvnoc?G(pi&gc=kS*pL3Vmcnc1XS3qCL9iJMKj}IB6eJr;h2s`mml#I!R~l zTD)8Ni_o(S{-m=hj){1qQ2qLQo@ADpN8D9t&bYZF>3uSOn!jZdWE}XVf86*dJn(i% z@td2|>(wPAm!!mb>PDm$+m8#ijid`LZlvZ42)PBqZmGU0$`W6r9KO9|3A2xy>CrI} zcm+;S2)|o7b?Ej5^;0F%Ia@=W6Am}47@sY7mDUUlUWjF0EDJgYeQt@7IcFUwq4e&* zJ{xk^sm5rQDE8T}eI8_{;vV9YL~q@wk+xBtc;2hf`%xk01eiI(|i&|EG{;0 zo@gcaQZQN;p8E|m_AK}I`G^jW!<&{7tr%zME>ryIil=FZ7Pxg}&@q{-Isoo|J^Pq;vFQv(F<6klk^RIi_ zc>mZj>9%PR544TIwK(y4W@5nLvc=c2&4KChArG*dohy{519_#|n8(19N^r62gJC~= zEfVa|q$&2Yxa^LBRSW7xSOZD+CE#CLga3p_-nVCelt3o(;_2CmW*ujTI!@s}5m9rI z^K7COy7)APDcqwY2SCoMznj;4|bLR`u3@eA~1+c*2Vf0rZ9n}NK_K7>KtHN=Oj1Msh&-8 zYwz9v1smC^P3rFtC2PxHtZHph?3u4=q%oeglW*C zWsC6jRGF{(Uka1shgE>t$h@Ba5Au1Ln+qR3$$r!@F+f)$QHb{h#Y|9yrser(1D)4@ zA5Z9bn|10?=}DS1`{XSw%)cGHJFLNx5^nWEEA^1Qf|2c)s}@VV`{b2wLC4&JD%ij_ z)7SMJmY(_jRbdFAh2Bj1JoV-wCKc@bof0}Dygy|vo1T6*M7q zBwoIbiHm$d$RBRY`feHV+V^Sqr0bJ8_nQ~gZ$JO>#N%z+ZT{qB&(fI};+ny)gPd4t z5zXU$;%`|4{!P}2c#wYLKY@Tqj3%EjT3nwlGx%q_65WQIb*OJI4Qxs>a0HIp&05Rm zin#Fc&XSk(!B`0&mQ$v+Jp4hR`v`Xodz8Z`hMzM778NIKLqAzr+lO#*U_YEMZRQ3H z8$t)zxUNOQEYYv*?B#fn=kn+N=?ds5zw$1W5QkVKFs5}nE}Q<$Ha5vcRVt&G@sn`N zgoAN8b~EfUT2zwt!Rl~@sp7iLy_4^XH{DGz*~aP3t6Odo%2*6d%c--3pB0-u&(wQ# zgNL375AC1RBs^~JMV4{hP5a-;OT{rsZz_8=x7E`j#`zNbVSgPZS0Ijx@={i~P0IY`JxZtO9ifD>>;#vDoFbwp{^&JJg$Ekp;gz;`hi|*SxD7L!c4v)lTDF?< zsTUwH8*S?}(Wr}va$S4ahkpH^iIUy8vF)w(VNujSMb@RHOWw%Vmv;`G-NQcA`fwy) z{B!N*X1?4}m4fr+f@ZRi_0!@&H*Q>H3BHtDGqd3ux8-<=j|jYc3MuvMyg4y zmo=;Ss2;TwXBP0>d0O-8L0Z>9$}i(kLrbKgyPr=?Kw_IAquvP%BI(hRsD$&gr(6t3 z`UOoh+W4JcElzPAsEt2e4tKH%uWF@LM}|KN~ARbJA#XGiqQKWI_)gpaz#8BASS8t8m%hL+>~9zC~UyS(^Rz`?y80!^~Jy8kW{ zgqD1|0PUC{<09jKZ>{Q&@PR1LIunW`8OwUi=R=FNQlm z)s5bs`WZB`z*e0f@amZgXW-o2Og+H^88wVdOS7Wish^wQyOn&hoX?4ZhJ60j^hBm@aC6mwx_}xo&QEJ(1*%--e7(8qtnz6X3ni>Ud7b4 zO^0_BJtq!34tZ;#>T}S4Zr{m{u^=;dx##Xt5PKj~=ELnHr;mdYWR^wxSLD|4m9QOA z@z2OG4L!zFcq;a6w_yuz%@4GWI3Bi};MepPSLB^!{W+8B%s4Cx|3C#tRg1Ir?t&n-?7+O$S0f*qM!6UMsxrpkWKQAMc=F<~(#`^0AqN^5#EO3cAPQ zs7^LphTIkpCd&VI!wmoG3#eG6tjcoSZ7TA|Rjz4qw|kq!sp3wKM&k1%U*p?AG$msz zkRMbkGCu3VHbpGeT{4};F^)4(N~CYtwA=mGns*eMl|dV{em8X!lfo^Qxk+eX3DB8n zghKA3BA@anH_g<~J;z00E>*iusLBs&_00M&SmIA2?}l<8`X4bwM&{A_EZ5JvwNZVZ zjTOxqvoISNFUMvyim|zvjW3sSQztW^a$R#L2u)th`9(t;lvP>X)2_9*l0RVJ!5ZG_M!86jP-%<{w6obWGZee9XY*rWK6?fa z@g~c`^R?erYUHZLoNxfsFKe|wf9VmHd&F5bGJ5j!e=6VW+sVM1P}V~;b`sp9&y$G9 zv_8lkvoB7LrO$SY!^(!clk~Fw`Q$c6-Jo$Nn?6uFC1p$zckXM%0&6khkv=|OaEEbf zM0(lVWb>t;Px6xwRZs0_u=Q)lY0|>Zg}ug3ZdGnw$5V9ddbCs&=YRSReEL*Z&qI^# zEwi2p-l>8zMz*O*HoNU1`?-gh#YB$KC|$ifb$FHZaywTC$@BjXGu*^}BSaQN(s1P38)t_-s$0F3nt*~g82?-fW z({JfIQf``9xVKQBZPavm`tU|qm`4`!EnC3OZaB_*-Zk~n!ygT4nJor-T+M?r|7{nkkE1Vv_9#b}PG=T6$oCIY%3K}XMyo(byCPZL=H&r4SBPE7;JE!?X8An|S+sJ`A<&*QXq|IZsg zMT1nhHMQh%8(%@?%&J>H^&kuQciY@X8^nCP*KRqa6NT$xyu^Mnrr0VlFbavMCq`wS%Fo{9}(yz08=%T zv`P)NPFg+dT41ezX}V}>rRDi`ZeS@o^p|^>-9uB-uRnq)_K2O*@Er!ZM57L@{oUfi zwHabw-)8-+EzThj<^Irb<*Jq-uBHMto3T;>lz;c>|HutM#sdIV!;|b)2F}l9&O;PR z;mX{dG*1!Md2T9>f#e|PnAseub<s=KQJu_Z8JVsqv|c7 zqWZq~;V}>e5d%R*Kmn0Pk?s#+07|KJNhqy!g8>o>(%sUHgyevTGzbWTq;xZM4e{?q%v|oh=bU}^ex7IVbFQ1iPITD)6#eD&#>?CDc3_&S8mtGWsP~C$NBc8* zUIP|p8^h#EbCHL^Q?|4XsJizbbcJE)#d4T$z@{JG#A?c{ft zJ?3`Z_N=yl^y4!UF8f;p_YG%#@k<+mzcBw@xq^Q(F;^hTg^O6utd6CXY3^lGtwtQ! zvtPH{ic#e0;}Q6fS;s;j~=-u(obJPR4NMV;yFF@bA(L zcyc^uM(EB*8$gE`m%MqCPOCM2txdfB_|?X+|g=N4+BV$i8vkGOa5go(sUyNJES zGmY3595!x|sv*@)2kh{`aa>;uXU}v(#?xGmF)p{o6OSjq{V$$GxeHwtwJE;VnhYjD zd47P4i?cZA#IT~`2b4hf-Z!wR^*-TyL?zj0tf>N)#<>U`sHfhEJJvn;I+Dj{lI z_}$mgcg;x{`lbKU#(SL1MHB;d(`YFvW>t-J6Djv1Sn`Md*$FC5XupP~$wdSZr@^p{ z{53Q55uCqNRC@@4d7$07Q8i9Szi8I` zX)ms+^u~9JYx*9ok*{eVi!jl=W}oz87|qN*U`h8z7@_fh53yw6Wh<#Qx)aM&a%jyB zZl<2SZ-`GmNFMw&MB0sMn5Yzq{6$I=6N6S>u9v@dDKI8`L8=@r#Kp;wO<0Dx`0Pq- zB-8x{{cD%bA9#$saoK?92cJUJ$?@dF`|ZP6$oD_!7GmMG3;NxT@#Tzi4y1#zjP~-% z_Lge4`!c$<3awdZgZ0lVy3Gb-wF+%PyrTTzGDI z?xg2ae~F|v7r>vpZ)*!&rqpGZRK}cSt~2!LSJ6qZZ%9XfoP^K&$ABN=pR6Q!?mWRINA}82Iy4>7jTkGV& zc|Cb<0rTQuFQD7?<8L`Ssmygp8dTH_ zh8SRp`}USUxE^|pq+d1?{&@qSdLg<+ncuJb27!K+LY!rth9-l;>`xGQE(YCXF+jSbSxwi3|4 z!@AyiER7d}Jf>>p=EeTq#y?#nYUjzu+h>bG9z&^|{hwE>MF76Ej8%jNM$rrfKnHM= zpFX#kQVXMclxE=5YrXe?w3u?e1+7*$>4o_9dL1|eWM`=Fc??m6Z2smLrJY&fIbeK>&#(Mo29R;TYjhrkdXoE)WHM?4u}GtJ=uE4554^@ZAd|?*8n75P3dEU)wxa z_3|;47>_T}W*_l&(DdR?yid+8moVC`&X?%4nvZ#&`<6)9^zQooi(hVD?<${6w`&G5 zmw(eh-%;l%%{!vL5^_MaRl>hpZf9BKso=aDq_5?kbIGsc z1F@SKHiuAik5F|TU;4}hi!gc)5(LY4qJPpTW(9rBBi#-}cO>>7! zVXen36d1*7hiO`Jwy|y%*{?@YS6nR}%TPjENc|h`2HDsl&ud`dNo&zO4 zoYT2k2^$Ka8m^_KX%`SOse0$cdc6Rz~8w~ixo5sr|3-MYyhe5|GCuW z^@F8isV53q*mmkutMvOaJlsCiVADN^IVsm_IxUcKHLQKJ zVR~I?XQS{wV2?7a!Zbe_sE$5IZ-t~U{szTx`(S_gK;3QtfKfnH z$<5xMD0zl|NZC*fU)CV+c*2h=@b$h{>uqp>t{cAEu!n(|DqJ(!r?Nn?TO}Px-o@#G znUdr$E^(9LFnbEAr&Cl;7y}an@r`V}$jL7{xSH^~4{Tk~Fw|zgYg__L%;u%J;H{FR^D(%*20Hg!oH| z{*oFT&%r|^AR7d_M}T&-%)_$Q&~lHF92GyxwjXn)8vnTdN|C-@>QuCwOczjDVS|Pj zVI~Q!n;WIs$z-=OZ1lxtvCFZ#-q8L|-Jne|%E?Qk%Xud6KRAQmZRdNWsNoLBX?OuA zkrZdIm|O0e4Gmd&>rM;WACOoX+V_*p+tTPWmm!_!aup@d)5-nR2ZiblH~I7^?TtaR z;koTdafGNdfN*dsVsAY5xX8)ND~=$o0hzO|_b`{sI&g_TQ@c0?j}OVO8OY&0`qG6G zi^%`=Sm7{@k~gv@eo=!XRqDHV0@6~UkJ>aLv2@r=Jj&|pHAQaMS&pIPkJw*2BYp98 zqCwNjL&Z+m^@!+4{{ZMJB1Zk?I6_?q$8Snq=j}!Hd+8Zaec(|5en+mWPys#lt_wc> zQ7cL11T^;@H1F2{HE`w|0kR6L$2ONuFQ_3z8#)R}DnWWDS%O1;?fS?#%Kh6}fJ&p9# z5gI81BGd8F%Y%A0@o3)MvCE?4mI4Ky-jkdsW>5I78e}0LNEga4yL`DkjSXqDEfRUR^y{=BDJuA~Z<~ek%==-*!zn2L($}9YvRPBT6Tin+ zgT(W43+`P=^fhd)XU;|D#yF5%Z{jCIxt-<;>-XHg4!$`j#5{aGtML1RBpX8hN9H%8`qXK{&?*+4A0 z4*`miio=*tcTQNA5asU7Cfa%CN#0@NBwV`Ko8(x%z+hS}23)>!d90=g+-ud&sMU-;@1+n7+lSF*)NR-dn++NiBQ#^y%`r2_xYq?M=XN;-D&Sh%jVEl z{P^ASMzR&-Cy-H-i&NPOJ2e4G9L|^XpE|!jO10p&=L(R`9`eo9te2Pq zd@s9#a_4+fG(qtHSc1k{z=kEJ`PWJ4mWDd9gX_uE6p)d!kBZt~9vn!cjvyY_MiADJ zg|Z`Q*AX5fypNMFpAoF={x1L}h9!>eQYgID@!_>zWuS^|^^vC#p5u92{7EKwT-85!$hY!}rOO~tbvF@=DTc=^i4 z0--%(C`c)OabTN_y9K-StpvNSWlyeTWFPWP!&iU@C2?c?a`p{&Z@zbd6vBgb;sDz2 zdAHsgn=ag5<#)E@^ueDz@cH?x;L;1GcWsk5kxL;5og}*O1-qTu1AM5vMi_Q4_d);A zpcFRX0cc2N=uG-awPPrqU}deI{RL^Pu0ZwO^u*&64|wI*q%uEi7b-HM8lDO3CPFh4 z^LJ~_K>tplJWVJz2oRauA2XKPwxUme3?dBJCH>qAf*lsIv;&=Dt}!kHqI|4K?E%D- z8xj+CES1Am(EFGbi3KqQnTJK-o|zC4M(1e61LC?W>^RNUwr$-v?Siheh*o*grt(f!8!^@c4MNV-f3bE&ic@8>Vsq_6D(8QRAR=%dyBAOn z3LbLprSTThoQM5(RdwItjU9~-Fs0mK7vMeSj9W$bIUZZj9qw&-%llBH5T0^c*#-rp zb00_NIq1X>t=}T_wW6tqn}J$hP>T|~oSD%T+nOf}1v&U8(^l$uC~G}B9MUjs@9=v> z%J?R85b90NY=2RSXR`j_`3Y?#ty$JZQK)KUdZEbuJ&%w_V_ zw4iESRv=y}rvn$Wto@Z1QnwGD<3t8AhkDqjvwYRpUhCWkbq^>&dXcKb6~)�-0v` zcl;WF-q%K?JLr0(8h&0E!_10Qh06+Gm?nbs&jZX0QH`3Fr6W>DQDnb5-=dpSvZKDR z=k`6NYbJKXzoo_ff&St{_*4CO?Y)tN(w}oA4Pgi0z?Q#WpBi>i@7q}9ajpbk3AIM5 z!Hx7N_m2kY>75!?yIy~5BIJdvUY)}<{|@8j>*S=k>5jml1}TQ=FJA_g^Qa>d0&YWt zzFjpyiAfb;rZs%gpYPtvWrkj%RKBTk9Y48sNI)Kw9)k)dXh6xzyMz#L0j!ssJR5ys zZmI-$b;{$nXc|`?!SRXyI);)~Eo;jz9r$+45?ojDuDqZ|f;62eV$jt; zfX9svZHK~B8};s`A5MyTRuIK*yC(HOn=C@cPqhXbEd#ct8#Whpuh9%sQCC! z(xTdn8O7c52q=m_judQd?KZs?2QO_uI|wa#O2cVfq6#kK0c4I55;{exwH@pWfnE9z=h^`e1|knU_*VWg6thNmCfg?y)+^d~1H;s{XHs~Q|89C5y|a$%KLzVO47 z!MF~MSYY*sI?)||l$RG|cd{N`?Hq+9#k9DyCKgg%`Y*;KPp{E*UIprWUO7f@5R2c2 zFZtSD;*(Ar^VZv;gadgeP-H!wd%4_U%4UPCfR`SKY8}4I$@@ONvN*3n##)cdBJRP} zg#HVru=!jhD|ffzlhnPl(Gwo%!*>~>3rj;h}No@V8ct|fY;+SIyM@}evDC`xA# zlTpB-X2LesvY83wFY#MH2Kw&_XDw8aeo#9Ux8af<%p)% zD??JTs3`yYv=PBeYrjx(*TRAAjtZgN%MdsAywq=su*Imluozic4&BxA{5at}nT! z>CEL8w2!l#J$=fx0Wzt^CLc+qKl~W=qzMDd;rcZfcSqBvKUgc*%)*zIK}l*bm8jHz zxPtq-w|*1Z)OlQVPPF}M4;2`v>2w+NHPWOjvx6yLU5|?Kcae~3e!T~% zQ7Yg1z~uLMzJaFJ6J?S1J;idI$A;W9yZ?ua1~Elz>sNyTwyD;x_GFYcNQWl|;A9MO za|?I2Y2~^4H?WNNs}26_QF;=xfm+i5s9QJJ4ifN*SS9AEI_IJvWjw3{op6hL<#PLa zxT@|snVhNb;?YWvdw!SLZIF6ZQgpWl z^d)|WXs|;aq9`pKpj_$?haJfyz7`-QSwQH+!xt*`*#}SK;jG%dRZ%t*_Nf}aTY|1e zY*vofiDxiTu$8ZumxYBde)@poCNXUHbYvZPw)rPL9xxrKGC>l~?Jex~sjTzBSN z#n4ZG760xFcx=iH<2l28(~kWZj;Bhjvu+6Eb2@% zW|D8~QhYIM(&OaxF`c$K;{$jrL`upks%Y^ecI_C`*-roTYJ~jc5oEEg|UNoUg4YP{;~Vd z&;5_gI}Pwl`h}K{VjV;}+ooz(4t+Ba7nvgm4WAILMY4&-zqo#UxcqVOtwMxjjrMmb z=3zE@c**I-?p&xS8^W}`o4m+EmUF2lnmsk?8n^bTgvy2ogp5`ZtIrZ@{iP&d|rcDOTS39u0HvLD+K3J#l9d?UG$uQI_LLi$q|UW)fz`Y2AP( z|J(+MiX4;-yQLc|o@W1&eL8wY3o2lHl&N=bi5`_=(WT>fLHK9JgBvAQy80`VfQ5rW zDdm6_T$mInI$LsKZDicKLLZ|+SJ2qJxvu_cR@%t3uF~*E! zf`vSfht!mRAGq4HZ>>)zvN^7W0S^*E7QFR^v@kWlr2F5(NB55tE>Cd08BuX(yHBnn zI8nQM{$0cC`Rm*>*=HVD*mzA`zukah4l-9K7DX6AcnVnhB@4m<)XaicRmnc0 z6AUWJ@ga1=%c{ry77`_ka1)ug{(xDep!S;OpQJ&BKpkR@(#4V)p?NVxDQidxHeSC2Pj!C925)6i%;Y z5@bPj*5%T*`idT5A?_fnm)Usez4@x3IS9(#H6GnFpGw*vivD)(Bdi3t4tP)+_kAlT zvuq3`h@9z~606mK=*?wF$gJ7eg^vn+E*m`LY3Y{}OD*Sjg8j51bU+C*QiIYq=c1Bt z3nc;FByp}gR~$hL+D(9(Xq_UJDJ!VIn7|a(RXu>x+$+w zFX-k4H|V#&9XyNCLKxtZx~kTe;9oBatLqU5!v@)!7#rDszrxcllCbMO{_ttX8H2xp zI6HZgOzPA%`9kr>twRCHgTLQeBB>G=UxG7D8l>GXn*o#pzY2bP2U;?}8)l2dQ&8v! zm$yAj(-luy`TiKS1o#3tj`4j0bRUqYnW_!g%CPWKahu$#_NCCJUxgpEF{FZ!%Jzoz z@y}|Bkaanz1c$^b6ryRYI%9-kg~2uQrfsXUjFD)V3k{DK*N41-%Y5RGwG?2Fq~sNn z|5cKDBlVL3)bW>L5@q?O0LvgXT5cq>Gf3u>-$Mci#a#=TrLoOYfO52g(9UjJzlafs z?>%V9X3xlr3jf_1)i;dE5QzdW>rS$)&(0L3zOUIc!SSz3-JN9RTN~)WVT*23hk9YP zXZg0b)Q)S6aCl9Lo~oxvM&e&w%~;m&hG}WH+k0%R=!Zo-YKu8EhObOmbrV;pWV)IgB&S)<2bw0~Yc=Xra*quIlZFUzZQ86S*J0XrKj9wKze&$!Utx%1fx;*)ZY19W#W9_|0C3M}#h*rG zns24GL0yM6t0#|3aB>NxM$g_KU=9P%MzSSa{D6B7Of8}OPjMg^n%`&{Ih-RHLZLuEsBLh0mxl+@kD6b}A`R2=XeE{M66 zB7Hy2%WKfEJA2ddsD{+jZ}Ly}hbF8qX<-rKr^9&QVt`i+q;1yD#uEk$b)RjIO~Pj3 z)Z!^xpt3c%eWDH|sc||FlNZ->;!yI;p_H~J?72IpYQQDoB}_UJpJ_N6fyi>zn>tz{ zd0FHTQ^3db{lUFl`aOH^e}fuk&w74eL(o3qOTh5$!%>yjFcU01CRH1!4hctr1TNFW z;~`0o8-C84jvFsytZU65pzZzKPoNn8gM<_d{8RtA8NT3-J~=R>6M^LCHsv92FmHnYV6skcxs1vuQ=r`M&e+lAON$$S3{FOYzT6X z_NrtYi3OqGCQccw;{$=keQmqw1DDS0Nkp-c#o3;GA1m5NH_qfiEj00JS2 zcdZQ|3E-OZ53Jsm-H_(fU>D-1>+tycb++*B7Su<6d3*GR>ppD~4@UkZ zAp?iR>>=Tsb)3<+?K$7T;B~#4pJh2DATtIqZBU?8niVB{L1Z@eOCK#^MpfU{&YcXT zJ-CjuxC+uldIm0^b?_ka*`Z~||KV{keU_fybM=e$0So>WhOmS0*kpxN8@9P>K#Okl z)#n?#r5^uxy0c(tomP@C!!G~pL`JIl?2F%5Zn1~97aqG5YHJ6ORZNv=uq=sd@nY)R zXO|(7mM!?BJQIxOMoYIn@R6z{ExmH3w z5B`uRGZPHu4r>?5yT2wg`>yl9_!r4$OE}QDXE2mE_7X$Dj+@%nk0$`E245-yIJ1rFbL;v*AOTZnP4s!CI+TP`l^q>NxwC%lPMW-<~G$anye3 zTj?qAcPR2e;feWZ)O!2%<)YrFiI@IsSsPq`oxtB8;R$d?(9+qN%?lHXJv>;dI zhBi|@$mx07*FQ?!9f{$$K6dm-_^M;#`JBs|UKGObI9j-1_3~jYz$#q+JW;|A;NqTl za~hEhPkTQU1px_$;DDq_0l`3`SApmT0c!WBr38>@fYi|LTONQef@t<8Q&q#%jWZ0o zqBxp^ywS*e9*~2qCFMlaVmQ{20-vk^xEPb*pJ5Ph!#`)~^zr_^u>yb^hcAhQnypl` z`hvyqsJJD{i_%a;aPh~=LuuBy*84l_KeF^fDb)aPxO0vH6djHwH*zwu>yQ|1p$(9| z$o8x4P+@R(vh#(-Q?^k>v?d}rBT1v^<_GbN@;(4Vl3xKM_yqi$%x2J%AA9DbpEqa$ zD^rcmw%|5k$=1`{+lNI}U(WLga7(~Kd`1;Vt2js|wWrjre8PI8P*(SW&4K%Wux=vS zC@@Lj|MB12Lb6}Pf+a854;J^816|h+U%Ca$*q}n{l$-fEZ01asp0nV;$`UbM8y;gq zA5YPeLz5K;pqmj}NjGdn091#*IhR|yd+)LjK|F2RiOYSU<`EOlL8f(N(JvbI0{cDs zO#1U9rxwSf_n-#y>Y@N66}n$J|9YZmTFDzVV}fd((&%R3LRY5+XhD0JbRmI7TA=!z zx3KD(MI+i9U|~qK(F@hNsUN9c?Nq0VB&|4iE*-ohSa!NlgpBbCpQq@J3+b*4H&n|G zxa$t%gZoHEvH9PiKdxtZ=Wv8qiCh$K3@L{duy0mHl4CQCpuzv({H{JcsmJ4B{MQ0eM9)?&Tr&g>XZDr<`kL^bUfB?OY7_tE1(ko2 z9i!Llo*STOwtE{&&gkZ5i$T5Nvxv$he#7lnmq6EmmmDZYDNu2cxFp`}11oTwpa1|8 zt7mJ%QS#s5IoGbb+;jAc4W1Ss_=&NF+UVbl>Lj?yDp+W804N?u8QordLcX~a60T4QSy6`4W8`1x^LyMBbCXDo`JWCGK+JikSi*w zo9yQ`fO>^2BI7a6-q{fS8aKu8b3_Ah82CH|ZgLT;)|akxTpvis}rgu(03_hQ>BL6&CV|!`hT}7dCPzaa(MdPdx|f zXPIs>tTqDWlhEUY`!hFQFDUodRoSKROh#6WAUT+@{E-eIfyq6FL6CS){)1v}>$Gs< z4pXQ8kvzM98fo^bfbD^as+v7(w+**yy{Y-O-HQIG1=(S$73I0z0ftuUyggD<0K)L! zC?U(S>k!gX7gjfR|2dUaZ#lgL&AERy=VPY}*^Su!MGEe30W1@L0QrkIPvizaVe!zS zvimythVy?=@$)kt0*0_o;o%-X6wN4Hfi)7}A>pZ4^9gDS*LfM=V#{r#_IVzYghPqO z16ZDAWO_(|@7pt%m>56mPnDdDk!d{=oKlVB^>H)fU8+Dx*4fkE%`;~~f-hY7%|;?P zz)v9k+zQyH7rf*H#oVO$MXpo5s6Cw9x8s|fVU5tG4K;jz(hq>BL=uL%V2J(L97(nF<71_J6gk0CFJD3}ubAl# z4K6E^1BXHBhBR223>k>Y^)kdfU0pY_Rc6A7c%k=UrA8aYgM={nFj}xsQ{?j z1SapHx6_?h-F7MK4qIAXR+(qzJGnCPez*xh_TgJkQH+=M?mXfASw_Dx-@XUtX!=N%pt63yeOUbsXszTOjylFyu6LT96u0ec5#kVnz4d|8&f~fFd@s z2f!h$9o=aPYAU2~wataWp^q;r#zhOs#ZG;BGBpQuqp9Ouy%wpkb*(3eac!}h3KIR1~ zL~ncj?gMlVRkgEBB7)e+%Mbt zy+E}D>vQkbM>0~)r~OoSHs3Rnxfi6Krv<8GNkpiWK=F*37C;-m3wG7$>W<3y zfLbSi1!MHGH|%d&=b{n2g}nq@Fc+*;Ni4}X{+cYk6$QrmO~fX3)So3}&*|xHQ&M;S z^yoW+us(49K-9^OMqOEV>ePYVVo^-*_ZkkND60Bj-THwo=4EZWx}o}oTMplnmJ5%Z zHzJOZ{$y^~XYDQd;0uJL22{--0>s)cu$EdjFgfXSOme3*EWiEq{h% zIN8z0H1jvl!+ZQL+_Zg$8(Q7f4SY@Rj9r&mYM!Ed@^E07e{;*JU3lu{^j>U8w+wsK zVv_K3ZojQ0uEdAs2g`;KL7qG)Rgz`qvwE5v(+T%a1h*c`6KgYjI~Fik$+uo=w&2r{ zQ~4iWsgjks4R2=Gruks~QUm#-`c0P|dm_%7b3%45l1mNq`5Q9Tbkx)^(2msgU;<`*J2pJcy-m zZHyDYpMH0;+szKTZLRw?Z8Im_hHcv|jrrMu$a2pxAFAeP&z{F_2TQ`XlS4{8XOR-hlR+RmROgCEXdi}AEnEH(a!0GajjG?LAFchx&1x@(Bax5qSwUVYHcNamy_Mm*T+isg}iX7a>vXrY{pTF>Pf|Eu{iWb}m5J zkumVdlqQNiR0Esbu&(uCzV9N9tDkx~ZGnk}mj?F6Yow*}g_)ZnDV+N|I-lQ;;fIVo zYq2Y0S|rB5hkNFITVc+FB%6m<22(HmJ-vrpY1q!kYx?hijx>9@dwCUvZBj%x4mzOY z-K7?)YuXZh+Tf`t>uV!Jy7Q+p%Zc08V`kz)#5;a7GL_E-sf&~muhBLui?$ro{+gRs z+7@>;qR6aj`N!<#T)in8vxEC9Rcg_K7wYDR&kdc`)Yd_XqBaG4ZRXs4hc%LPOAhgW8UF7LY2CG6Pc@*n?U3NwyLA;8>zeaNV{TG?)LYa+|88y(G}D)v$>gACUv+!X`03O3 zv}*+pwL4prZm#2WP8NoWqh(h0#l59^>I&Ec8Bw+z`NHsLU(N2Y>g-L%32~Z8*><_? zMTT^-NV(`>Dy7VvHcje-=a&Pf1-rB#r%$`M6}t4ry-of+_9r26vTDu4>3MQ6Zq{Mp zPn_uG>?jNG9Ev!m(#O`*-(D)z#}V2N^0M@+x7=RdQop$%Tb&r(U%}S7lkWdEBChg$ zgqGAQiuI?JCf+cjEg8yfrGmM0$?(2kifQ;U1;$Yp8{lPX*l13}!y!i>boW zFlOkRGbF!oswxwt-uhNaFtyXRc5k!eTe3hMIp-rgr;@#q&}qlz2>&&g2y<@}#0zk2 zcFJinIaazn-|_96oC*Hgla=L{8t0sq=AzHeZJ|OVC!6%R5PG$!{MPtV0oB(_Uw{}vuo?3g5(8~b?hYN_vbv7v#Db>)_{VraB8K;?9zxi2Finv1HMzwssQqA*#Cg zsq?cSJCmqQ!=XdM89uw$B~@lFVFu%RV|^o~RqrIprfIk-&IRcqe++ zd;Hh0IvXPwiSd#Fmj5xPuf+Aa^X%y_^Wo{P?yla{YghJRQJmwmPfL4K9Oi2IIc>ej zyej$g`4Xggt)dR}XZE*)ZiGpmHvX=qFx-Dnh}r4T(Y@cYg336)q6j*4QHG7SNYMYwT?t0Upm^V?Km30Nx3WzqrFy2*OEWWNmyC8 zwHTN3&+Em5dmgHSZDBk7i-KKl3s%n1I~Wl{WnVU4a}^qz^3v-fL%nBd${lP9_g!Vy zVrKl+`)z~62f@9?2?=p*gaDMd5yIxSDo5={SoKmHYH+uM=rDe4G=*}HrYaJsNzk^R@A z+EtE8FLlo7&o+&D9;|Srh=}@4j&{0XKU(X^>VRdSc0FZXq#p0p7X>^vOpPwznm$Oy zui;g(jx?rwS z9uemntPn8QP!-O0na6}Ep13mzvGK9-sadCmfqXWw0ln2xJ_Tu}S?9h*FR%3y*NkZw zR{`9PM#REsQtAF67-GHX0mVVeX9L5ruYBqPuJ(+!E)yMrp-jo2aJ6l5nALEtF9iZa zTQr0+j@cJ1Vm>Tl{Oa1>z*86d8rA*HVo6ss8GT2m<0n|9!T*nqSO|$^AFYnO94aZYJ3V$I zOx>1d!5gtTiZO0(o)&5EX(zLRJP`q{uddi`*%I`gI!>kyH*1+3y59|9BhrX`;bN1H z0J`>`0Y<`!Nf zGL11G%5&{YPNy0Fu6{Gb`>5|D^Rdu328oSgZu;7;(kducX1(_Zx0`sor4+YE4#Z2d zwtoOlzHV6=b{yeL)!YWHyyUDGT1h|DK@>TOhz}}-edPtOv}Ht$nMIuq`)_u>&Vp!_9X>bR~2%CcJ;zcjj7pAYTz z<@4iW`oN!*`7_f$cbyjLyMU{5(|M$w=;whpw>otA6OLr#o zS$W;$T7lL{mrxr%Tbf<&0ki>Jqh39YDBqM+3=9?izYCVlUT(}cqB70)5R>+M`<|$+ zXn&vW%YNU&u%q##q5j;xshfs{exiH(R#pXO%ERr&<)YfZ=1nQc7agZNj41ja?TIY< zZ&-*jt3!@PnM51}g51LGat2)rQ z%8_WD3rM5TJa*7Z0#~xxZv5&wu4JP==lw=ovsrmr`(R%&9nx5EH5Adq8;xvVc6MBz z-%;M{#`#j z`n;isAtiR(+mk7o05-ym_#XEgIqB>lh0V6#ST#wiw#*MYZ?(P3xXCHXqG8UvjHUK1 z%uv&*PVBKu5$ze?NmpgNE4Vz_*t=X$dbeL#JG@&wKeJze@+C1o7JLF2BY2NNTe^i$S1w zWXKmQc2|qnGp4~uY|*y!YS-CXl$B+qo|j+!ij_Txz8Jzz1{V8#ZV&9&zYi7AR&$eA*#m__e5 zcc|()J35jq1L`tmkIR<6t=O{vkZTfAaEl8Wk)A({t-2oC!4j_>_ z8?CMOY7*$C{Y4iD+TC~7v)o{ zfNgF7NpJy7r0#Q2nbKPYGxqh1p}eX;0*gDfY*Kr!5)|xr;cO;X{}MO7I4n3XJ0K8S zojEw4A^$RMLGp!RSL2?|)zzu@sRR3SGZ;}CVuNy-;gVs$D%#;q5A(A6)=dEr5F}wt zkqOe(chIgKE{bc~KEJX2tUa!O|D_Cq%U)q_T5yz}EX5V+b+{Bx9c!1fdL=syqt>y% zkos&&xc^!I%@Q(~w(a$?@7}xz3<7SB^k=TlN3SlN*kb(W24e7T;AzI`>du!Fb^8rD znzs#fU!>&FG8gCgu!zo5T!JC0K3`}$mvMiV8C=Bw#tBPmk;mlOCO=YHPn%_Y+;UWB zrxqDcfQ3ddsvSTtxVj$+ckzZxI)&lxv6?p)cuqb(Eo(5k;Y4TGPDe1+gx=e3Slc*x zT163ox~rf|ROq@mSL9z8v0a_ry!d%N#zC-6`;y<-0Z#v_+nj#1{oMGy;%wjw^*>1F z^v2K{G`u-kekoDPXbVa=*W!c0Z$IZsK4wR$C(hM9Cu(EUu3SFmHUx~^bT=$$o0pqs z_XpN`*DVeJhhrkv^q}H5FM?LKS1I6=8(dx=NW7{%ffd{Wf!Vq?X5B!vm-078kl+NSaiYXOY^}YwdOow)Qi&C3J@Wp^2j@-eaYv3*2<_K7)tIAs z?uqvP!W*k3s^`yO`W!_{3_?G142Jqb03vQHTHx?q?DDRLZ&9J2dbqcz`(jx5O6Imr zAv7KTk(eSMocKX_P4+VgE<+I~c9M3{3tsw?x@S;QTH)<^2ngMJk-ScV%;kU{InB^e zejC;%^eVyY8k^7ZWRvfa$*Yga3AbbrP_@wQuSlm-ozCAG@ ziLJY|w>XS{Zk5h5TRF+O$aFN(upRqok40Gh&$J5sBfd!~<3fG}Hf}YT8uX%Ho8cC@ za7Zax^6u|S0$=g29nbJB(&2LmK&w7~`_(2LL9=8~zz81Z9m%8DT;x;AW8_j&J{O{G zdj9aN{P`{tIIAl_Lt~MT4$s6I``4XSYZ8B^^m)CFi#mIF-tzYijT+95gbsRJ;au6^ zEvp<7+qe`B?6QzE&z;Y5Hyp}YoUQmmj$lK*IIOzZ`mUL!v3euGJrk6Q2j zFq3nYMmbE10s32Ts=JgqXf_Hx6$O6=LeM+!?-SPJFTv{IGDW*@qCApYTaxo&>~;SN ze&kffHwq`7^?Mfn(Qr~`*lBC@#Xkj$(?se0N9$zKQD3J5kN}CFYqTNSnDeEAiyVAm zfLaQ2g>K$Lg%;-1p?x&4bpTsL2G9O3;ysDClz=9%l#A-h7o#cNTyFjFKaKzTkEYv> zF%JkL1XER|!W7viiibm|m~FC>pPIcSVE~-;*>EN^xvIeYLh$F^cIprM@#sGT-_cI2 zojWHE&*lUfK-PI9|BcmOEU5#pwoV$J^R?E=`ZIuFYentr_|CxGXn{UCtObx_P|`k! zSFt7te~dPb*x^y;l8NoEfhuft$9~ae=gx(W$ElC;s}J*yGGxYP+Q*67)=3yThC(i0 zk^!8QwaL)iO?d9(_(^udqu$r?772>g+iLm+ zJ3dZ_rDu9&Xg&;hyc5;~r=xtO6hl5Drc7_+K|^mfac>WScgU6gU`~I$JHMkll3T~y zeYaw%RO8p!`0*cH`#gl0O=j8~O<5*Fh~E$=RL8(qWwP|7dKdl&KWkgj6GU zBmZikt}F#|23(`v??>;58yRA9Vn?(EgFh~IJ*X*-DH+$3Q`gc#&L$oJ7cTTteFP_T zbLbI(x@=mRAmKP87B^c9`eSxzl`JN)de9>)}Y|1RuL z#;p$bmlAeAfeKwKwRtIon1*rjN>vnH`NoL^MEhdB^}C4W+3!?JpGc~`p>{f|s}xt@ zYq5ZxHYqTQSK0w?J9kQf^$_8$?zNF-kiUg_`$cZ2|Bt=*4#)C;|HoCY(k_*eSroE` z5K%I-qwEpc*&_4SkWI+U2$7LZ_9)paDza{}x9oA_{+`!u)cf~-eSXLBJ&y06pX+$N z@7}KaInL)fALsdeUia0a6(Z8d8=hqYbm;SaO^&WD`~3t6SrI&MH0ZEB_-Vv&Hr(mF zBM_w!Z;n1kig)fJ6qM38k_yhu)U&$qU-fNp!x4S+;RIvcytlMSlP2%RsQ?rv`zx~U zJKvqJpFKszFk>>0FUU>Mbm9)~h#-*{_|cPFn1OoXZphH$wDg%wkBWq6Wh+H{Pch;j zZBDrN17|Po+=p?LM@vqULHIGCPD^3oQCl9|3~*k%61(r_k!rsU2KZlgzxv&9UxcE- z^`kiI8?E>JdpI+XK^%1Ab?k#g?Sdsh|t<c%OE}uAcs0 z`#94}eRNyu3+;JVTZ=xgSkOAKGT?q|EbQQ(hJtTT@7-p{NKUF=oOGTW>`>Fy3;)s( zIMNs~FX+ey`ti(qr%A@$nO;OCmkmxGIf19Iz3Av1aMFh`QUUqJQam9EJqY%#E(d%1QLc(eMHXD(fqSl#?-rV* zrWj%s7k%An;|gzWYyDDN5v|tU@UisKoYu9Fdf`)KKwa-ERLe=Q5Q>v9)|oNx_;%i$Q$6mJA26LN*5pG7HS_IfxcPL<}T8zgd87Av2gv<7ZeL|P9r zf@g^RxfW)=XC`*+@wA#UynF@0UA~?iKk>|ZS-9e?o8~83zY}W0nHbD zt;$dYGjZQfoYN}KX6IxOgxjv2ath(qXS)}&azw)E8{HnN+_q*olpfks%^ZN4(goB( zod5jfqS%_909D=1^54(}PyYf^55~m!l_q&fq(2P;CfVlOK1j~ zo?O|rK0>J)2a>{>jRg=8-M3i`MV1$cXxI)QPIf~_;o*HHBCZ&}p@I3Q9PE|@&u~+W z1enIu)~syN6LVGdj==vr}{^GCwm=TXqC*n%|xwPmYLwAcIY(jKk4 zOJDyu^jfNj{K{{^a0i06 z4OiiA^4PE+2W+Qb!U@s{l0gK@(IltR8w*g>A&yOKYr5ex&Xu`GkhP6<-H?Y)>7xyC znB2Qah0JvvqNe|Q!64ZB7#MLEMW8+r-MSurf*gIl7(BK=)Mh%`Be7_pT(b`y?7N)qv)$=;h3VSr$g+Ctg7fnr zaO|TG@e_b+V*1w;;=*GnJhO?ZlnfDdle-D(Hi-RIC*F~FuGHtMyfQz+D6Xixt)6E` z2j~5_1lpdm??b$*)Wzg_(cyG|G23a_7u@zh+7H5Ik`1A{%-<94TlPuV724q`0I(eF zAGK;NN?dhhtrvcv57onf2(v7a&Qr^xiTPrN#x=*xqL zyg({|b`si%`fLgUCOtMO8j(DIc9 zh&=m|-$*+R)A83{%TeBl0y{tVMDDp>PJ1jZ5WOV@g-%Je858&Htl4{~OrLhX zm3wV}*;Jisa79qXVXn%5MQnNa{Xd6c%}l&T_Z|<;{G=%Co@F*FeE3$d-X)V8&SMC@ z5D^FcW)80&md~3U4EP>;--&&PTR6Rvl!4quFGiJcSj~*VsBoh~SzW+_7RvT7ka06T zIJw_}8?b6sRO;%O0W{c(PFO|sQQ6@S&*pA1KbHVN3%Q`9+_6R?x41?=Bj?J8$%cdL zZMGu_jQ%xOOD;$)3>~#4cAUih`AU_m@BKtNbNofGeq|L_eh0eW7L?5BzYSf36EtLx z`&9)KV{`|;9K483Dk-$5dq$@W!pA`QKr>;36dBl6BndEv8%hvxY=ZMr*{u4Pj+4Pv zlI9Gb;9IvRLPG)N7(MP9yF|ITwIZ zSOF%W7K;uE3~eg2x=^qAM93qv_R2Z8gjAhLL2o@ZtbJXBZ@DE)I=KrSm@AG_@4Ja* z)FIAA7r{S=luYd^;b}xcLtJr67{Y2_=oftn(L?SeWdugK5th*ktg`EsM>iaD2#~p$d1=7-G{GgNeMdze7%`e?o^KHBJuTrZV$?wjyAy)*sff*NlPd~Z;Dwz`r0=s* zxD=e=eC47b8xibfdBP!?TL|l!E_Mq9_|ttHj!#a{&G>Z+(ppC@z~AS0`b+DP!k)B0 zzUl%5{9HZEp`f2jm5*#w~&T^$=Av1BC#|zE=G8_?<8(4qdfx z)gfUH+)`0`!jK*=%%zpgM_zc~2^)p#_aI~dE@1#CI^J;+$SoXv1U0v#XP~RH9Qf2P zaAtzKc==^uD1wrQGqx@w6&2)b*VQ)DLa1-Tj+ms@M^Io~$g`o|o)t+Cq1bPzq2M6> z>#O0JX^rroD=F@26-(e44qiq8LyN$*wEeyw9+3A0Y|bfoA?ci}y*aH&96`{^t@>zZ zPGo!P^BE|#Ryq%{1Tr>GPfzY{8Bi%~(B)me{sr0*VK>YE97s(~l8-YMhJ;xY2b* z4o2vwK`8L>m}>D8UaqR4IX^~B&t!R2qV$SxGE?tvwLPJz}Ew| zA|T1G7mdjv{Ujz7OMgt$?AyoMUSxmlS40F^I zH>5L#+PYeO5*v>!4lgVVVRmO=bAfU$#s*BFbBs)}0{N!V7ySFrWlyIbJ4sTmhWF*s zfLfPJBS1BL~^T$u?06Fd7^|)CL&*tTJmY1#yKTw#|;k) zL|fvZ8WR9`ye9-htvA%wyk~N0jfK(^lWL9J}O9W64ao&6nXjSvvkck zqUcq@^EXb^C&3=U!w&Rm2|e5D$;dyERT~J$8)(K1=(7oL00_MkSo{- z!3O|$4L74WjYC?TqQEQs-1Y&ijojb^zT*Pu=&xGy5@%ZhHk!%+Q1tM@4B^ClI`Hrp zktjQBohEGa?V~t1T7dB~cq);&PAWmda5Uw`0|&31JE(8dE3ZV^Fk|MCJwj$Mx^Box zjO58*=8gqmy1fJZhF%~Q%955JXIkf_^PpO8b^neq4Xw9u&B^k!ASfZE1lC_<1Y1WV z%bo?3XLA;~wqhFySW9_TSh_$Ev8}?j(4+#R&P>qT8R%cU^<(O_ho}^h=SMrecuX#a zfK3aaAP%@7X4zfhe81z(uKp;>g7!ayIb1IzXRbCNtLuK^C_K2X!bspNcj>53rR`r;+$DmGJ4eg%75fXjuJI#toS*iGj4HASCA8S zGX*p9dwY2wKUvwaPz1rEJ~Z*Bt<%Y$*%3^&sYA%0_^DdtuMb_dy z9p1rrIJGysvm7dE-evS&y%iw%BqbiC5MPc0|lO;K1yG(TPGMxSsUyY z5@e{h*gqs=jGwZ*-zf3aP+0hSpm!E_t$_r!sg9frMshxFbdf4kR}rmmVo~9m7pkw& zW6+$gb<-}KXU_Hv-8#)nQ9@T}Rw1OI5H4zco3tsF=GxYM0acWN*-_BQSqg|zXOSIf zJDKIouYl?#pm2(uoVK!?iO!*Zwc_009PKltv>6b&`KC_L|2QKl@X~e7D&}p<^|2QSI;Nv!E5UPfSt4JkfB2l#VkD3_ zgrRfqTR@)M>#qdQMiBfX2$lT7FE@K#mDfmM7G= zAV5B;bX7@^J6E8I9PXZ1Gl_>lzEqATYZAH6Mv2J(l%L4;t7|JZoW$c}4?7KAEFM`s z;e79kKyR;Cih48*IYFrOMo}nLOZ5&N5J8ypT}d6Ia#xG8t~jS-+NDCAr5d~LBvsSCus&d}SK&B{$(79&$#okD0jiGQ=FGO~kmuG{A==m<1np@5ZwE zwb=pHDu{!k_LW?=DlcaS1tdHS4cVB(6>6yAIe@ET(F)W@)rkQ_`7d_82PK3MxR%%j zs&y1Mafm0{8vqr_pqNX7Fv4!v%L$OHrOOTt=Hw5>7v91>6v%c1nHUbaI``fYe!#9k ze^lhoj(NPv2dph}0eV)vMsmgx12Jmr0dXWD-!)ooNkt5Q|539wDJbGo?`~#QR!? zPj((7z_Zf`+G4VVx)JQd34k%y!0{C@uI)$7sN(ePg(qi+2GdU%Ax{`2%Sa=nFgH#Fr^4iFQ^82WV&{Ya=WVafRGoYGb;pHl~pLEXo-wOO~<7j1`<* z-0!loF8UTjg6Df8cBgfjwS*1U^vm294x~7bo{6nE1IJ27Zo&z)wd$oHk@!h7PeXMo zqkDPUFpBomJEAXXcz>L&>+go07*8p4*-JE)&-RTl18am{1GI)s%7>(kusQa!F0eJ_ z!%inLD_jt#BJtjNM8k%Yl?2Aa3!?$&L#8wuUw9Fa9pDV%?}{n7B+1Pf0RPN4f^rh6 zILvI|*jBd`6q1hpb^!yqE|Ho-10|C2i6z8ItbwmgGWW4Pv0#X<9dUhZ*qq&(61o&$8RQll zUm0+GS(eBXq48<6pk0 z*bnu|f4Tqvvz-4oOF&-3uKV-jN&c2WY>k+JXJET#Kv`=fjqbDXUz8RV3<(<14GNR( zSLjT;3McBjubC!3E;Q!&4|qZYa=#_*fBh1P6=*r(b3@;WfS4}HzI8^sEu!9 z53w#K?H=!dgpH>}R!mOtD6$h=Z^p(SV$~!T}Jf2ps#pWK8 z53~7O&GOXK4JP>=)!lQ^6})G59S*v<{LAfcC}q_7lhbKpZ89g2$W6Ryw{FJR2LGY8 z#Kcl935L;@Quz4tGZe^}KiIf&zywEQB*Ct0>5q~uQsJ~q7cT1c8!_jm2HKDb8y1UE ze7?E)TS~F5KvSU|d5~C3d=Hzg~hVHfiDu3P2ds8c2FL=_Vmncv3Ybe`bc ze9CF17`oSvH35R;Rg101EdRLFCnxrpkao$$h|}Cm)MPZp16iI0EopaZR+00Kf#xOp zL+;R5gq`Oc@m`#ERobJOJ8=10++!1t2tFlhqxZ9mv*~_bh&sgc*IN?&u$b4Cdq+MD zDw0%P)i4-OonkpIh{&PwRW2EU2`j3`+$LK|P*Q7aTt6U}taVI3z$V+!CR@B6-88z- z$oxiEM%kB#^S@Q3DEYm0Ec$VMx0fCou^Tqn@*gt$jx;sZn%Tx>l{(Czw0Iliov!-n z%<`l>psWhARIF6LfJF4>TU;zOnw!lU$LVqe=?uB!vU>gAMTzPbQ;aVgUy5RCn_e#5 z7A-Z0sp+8#Un{(3h zzL<#A*08-46~DKYIr)zQ&a2S!w^E?(pq{$T=p8UH(d>}uI*bfesmCB|nXhpe*)|KI znQH=!f*V*;6gD=_`kE1?+L=d6i058s&{_X+OKJvt0e+kw4==K-A#*I)uy-P|4kHb8 z1#OjO{xL>LksUh-@p(&cK?8^3Ia#?+?d4%#RyRS$xOYWIp^yW)91A`THCTpqrde>qw z0e#p{xE(>EQvm7{lkOp zEC;@JJtpy&!l;`WnbUMpnTxgYYS71DXQ0LouCNzkZz~SAAyZeh)!L#6I;XMcB=~Op zm;^b~VW+&6a0DSA1z~^5`SWm|!>B{9nHJyDWTKXUKThE}*{Pvj=Ib4eDf+>?WU{d3 z61lkIdw6%4ivJJ`ON=PD_m5(3>glwYiN_EV2Oa$p5hKp1;2ii{ou%d_giV@CGrogk zr%+xX;yq90dhFKU%VYVoynkrQvCc!An@QCP1c)(6(sgf&e3;srSIoE~X73}2rL8a3 zJ+NmFztKmw@joJKw+5PGXXg7e>ViK^>K{w2% zahT~PFng(QMTYQf)X9?rV=-IzaK{ASibB+lhgbNF$B$Z<(@vXy>B5dRQC$2J3Ue;) zraQ;pf*nkM(-Lb77nHNys0t!MEu-Q{Ll5DqXtCtdIvZ;-1MjfCJsCzen$G$(xYMOL z{#5YM?v6sN4)MsOe71?=EVH{kx%2X4shLy0xU+h9?6F434aG{Qbc`q+LN5e7W8@sx z_Juyb8`29ZBB(Sx^JGyJ5`0mUWj$mytp-|%tZ>J}$QTZ}zxVQ@o#t#8*pvnzLV_IN z!(Fa+Lc4f^C8<5F$q+kJS*RNqgdZOo>)rb03DU?s83gq^<`5XBOF9N3C?@C>_?vII zFL9$p7AN9L2H;5sjC#9#K#fPr1jkXt_SocKNQ-7UE|!5IZv(kQIs8 zm&H#Ue^k%HY{#nb`k(QdO4&HgVyhQF#hkz~LuP*Kn}_9jM!WQu$E<&G(*EoYN_0Io z#L3<|k>oK)RpzN|?yVJ~`>TILF_u?5;*U(m#zL&eeTy6}Bh8`O_C`KLGT z3Lp>nR-Xz!#p5Rj$55LlIQB31A`wIf8Fc$IMhYin& z#W>%vQ?ywcBy0Vt$wj`~3(w%rF1yh=pn^LRv&V#n8FEFCzzfRo`fu<`D{>mW&srWg zrykdTiC|sa)!(>_vMU@f;f^q7hRIM7Zsz@EFa{7(w_Brw9!}pAkK^FGbP?CqVlI-F zp=+!WTZP2x?TgKOcMTWyZkg>C$;N^YGv;vjW(4C?F;wix^3^*LYhu4Eh=aASn+2|h9&iN`Y67G_q_ zgGr)ipCdwN3b*3)oGY#2m?e#3>WbN@*WR1CaTj*sHA~oHR3TGoF5v@1uj>DbYb2RM zLS9`*+}B(p=|~pPTc-bqX#L%M&ei%W0RL&Trjj=S%yYb8)Kt!Ob$}W+C2o!qas4)uNQv3YR-TM#fNorx z{;rK%8S=3qzAHoY-H*kD5_GAh;rt{>ii%^)ZzafcrKoOXluC3N0mQD}!z2A-yOjPW zBJE`YsB2=L5>E}e8m>)$p3K%-cT%;;v@|khZ{wde3cuL%Zo!Z2Oh%-)YG&g}rG1cC zUSSd(FEO-&3bXGhD>h}?Ba?bB8lshjKylWd2y2z4DC6X z*ErTqK9BqM>DIaDw{bkTV1N>Z*QZ<4(p}vi;9mB);3_G#yBwJ--Mta^K`SdKa9ktf z4Ij)&2<8=t-;{k@!ym@xu+aYyPw4Ai@k9!J z1hu7|oh3ukKG%G!t2G8vIc2MRLBVzS@-AGmHnzzzTy8fpPkjCyN)_8WkOsy`e+WO1 zyK~wkAa~o)a2!w<+GRA`d#H_UYuyul9KdY;B7rJjwg;C1P(}{d9Qg=+wM$l`k)B=Z zvORC3?z$X~AFesDka*IOJnpnNyW=7~0`_`boQBM>&UjD!{ZdgIbM9TE!&vb{-WdSSf(LP{&VHW98!D9Mmi^}k(C%(Jfgi(`A$*zblmIbarf+(Gy)$8pjx zjNo^W$M7R;k-@3ZHc=A0MBVhY8Le-8qa)ggC@~(oeeqKc&X^~cx&B)FnccO^(G(Y| zV4UW)IXQ-KLz$qV(~R!cnI#3@|`p8}K=xmb+NAqV^S_J+Mv-vwe^)_TN|p-MOwoIXkK#SaKjclSJW zhj^FKyV9kuH!5>D?dCB7q}??N*;=5jF-|R!5nM0R?dp35JA!~8jHRC%^) zsMWh`v?+>FbkD^98lD?iDSlmLTAH1Q4L91X2s;gZ7gERL_``lC_T3nT?zTqUFjS^`6!E zFnq%U${&V0IO(8M!BV*zO~9M|WzHdcu53eCw^##H;&k;Ij+?}v7gH+{@mAtA1DO<0 zaxVjLiQ}coW}_e{MRF(CW3fL|vGZ?4^Yt#_+9CHY@A*AJNF&mmHJd#+kuNKXuTJKq z*i?s(?l#5CEZAd8Fr;X0GA8Db*W*@Yaj|jzgK>0A@m^zPsXc|cgCqDS8EE*n$-2ow z^%enBU25Ea6z0qxs!@VkF<6JZ8IDYr*8_FHazH>k2_VG0BYP16>ewcj9z_f`WNGNvvkRk7S^pk6V%p<(pEDM+wHa{JNlx0wIyb^kHqyQc{i&t zvTe~ON6dBJi~si5Vvs@_GO6q3h4(dmWy_;fn;lpk@}z*=No(q&txHW~HCT)3X zcSZbdR^0$8(RAh~CL#X2U(?S2k{CR3zu5dk@wk_#!L{D`hMw+t%FFgd+J`(Wqq0+{ ztbUBr#L^4YyqDQ*#%`dn3K#njSMs*;FtTKP>oebW&jP^muP#_v8P~;_JJKZZWco;F zuu!GEVubhD!`0qkSB@FX?&ii0)xev!b}l*nomYX~3}16_(65W(E-k!gseS$ps>mrx zC|wTcR+U-%M%Sk%%1h$@*qxr}j;g&5cP|fDogeKcRghQHNVxg?%o|j;(_6!hUuq%< zq1v~*Hd4y3A-Op2k~7)pBaw>favUY{|lx z+~O})cuQZ>n5d+sVvDgW$J*g&e9JkE`c>DX^ z&ueT?w=sm=OG+7;s;Q07f!!xA zRJiu8C&YIpofRu<&bqeHHIXtl-Ia0kKZncQw<*5O__t1a?+vIqu2GJMj8HwAoEA8( zbjZAVYU7#EzTb)px(pw=5_P)Cl9Q5?yS2}GurypVlYaqGwGLq@b)cXMGYfWTa3``3u<}WHs+>Q zyAK9+lv#HLO(s1&>#kJwUNCtov>Md$@ruQHl7dC=v8kWMQv$ckODKB91QkDAEx}68 zbuCjk3$FVuF%`?&I?&z~M0JZC!h7<0RBdnh!NX#Aw*MH;z<&NgQu=rkUoayr-K(6p z{VY}F^;B^@!gn8w7+?@#^Ny`&RG7)}^9K)Ii+suaH~_uIV`FV*b`ca*WI15%xa&Yh z!y8hCRyi$V0{`cM9J+%?6^0^aJ9|?`_lhuhdbf5YuISqM^U1^NYMS1*jpwHBMawl& z#af3y;3b{T`*DxmVbXzV0zON_#Q! zvxc%DksB)uQ;SkIRJ`NX5!C$nCs0=QbaIxO$cj(9ZL$BdDf`1J9_AYdLR|==C>)g*i*pu^v2&N7?i@GQv7OP<)tOHX3ybt> z{8?b4@eY#|_8_iv{QNF?rH^lre*Df{Sc;IOs8oahzL|jt@8A!+4|MB(W#x}h>ndtu zQc^Nk?mu-}Td8E7UW=lbZk5CK#Z5=CxcxDVYp5|YZ$euyU~DMui>#V@Xi>z0o+3Qb% z{~F43Ii&5pL^198avl3|!^s)N|5AYB${Whpg;?$0<}9$*=BTX;qb}gff`5#PopQ!K z&$mr@=BM58bM!mvm+DmKW_#c-s}oC)!QhJIlmt&)#sqsj^j!DHuj44*u_y;#R*SN>#t z^k_@^`B`O-KjuKzsDBwpylXuNUwP&uZS~vE8cyqV!%1oBcbVFI=M+XmPPla*erk8F zCN_N&Sx6y+I}qRVOLC6qra_;hyPM~J!gz3RdL0djgP-$nhPS~Sg!rYkeBN%L!~gac z_$se^7pP95)t7k<3|DQZ3@3M9%!*8{T}iN`frJcvH{gu#>X2kUH$=Tki$3a|vt86Gfj14Fn?9e9{hT-2-iPS*9QxO4XZpzpaR)=9qCF{0DcCukFm49l z@dLW%Y;CC4z7jKTixl}JYx94-{TD+=?dVDz3^T^JycO6@{CvF&%}f8#?{UZGCA@rV zElglHA0H*Q1XC+f#c&HSl3}-gssYzE8k#uZW41us2$#=?_&zjFms(T4&XCUY{DY4jm8-vZY#MEAn?DIiWVOh&%wY zeZ6IRbbrTQA8it6h+^GLSbNbBBI5JYM+s-}tJ=VVk2_zVZ<_{p$Zj$2BV;NUo;6o+ z^$EvaK6Eo*Z9z`_4Ts`o#sSHZIdzCNN7(i=bWLptJ)~+nOmslINsp>Y**oKQ)6!p) zlJ7#UGj3io&THYB0(YLtwbs7^2l3r6KQ!u%rVYHN+R#|)3i{N@?+&XO4sPy@KXnp> zbTW?}RB(aX%H2zp|Kuc}-MTP1mMbKacajYCnxw(A(4w&$_U&L=2)k0%g)0Cq~`%KmH5#KV+w-xQ;%L@e)K3SgUqfC@fXOq6q94* zc-4V zqNYPH0-7K)*UDh6AI=DR0IZPTp8-xgD~&yGO2FFs82kKM>Amv%fhGZkf|?&cX|DOq zMf@{ZJl>R+O4>K9J}IP?e}H1T0iA=OItwd?t1DDrqFRpenR9;c5GhJ1q@PVAu~sj8 z+}j@Jwb(q}(7x2%%X;)GKA{z*dEXDx@u=>2BhNK!TbGMhS84{~JFjbY86TH{$oI3q zmez|dI~p&yNh5gSWPZd-SsP_>#AFFUyE6zmx{#XX&v9e;Iee4!%jgq(F z3AmRp#X?RHrWLj2PR$WJ(4AY;%PYqL(l^$A;+q@Oz>CgR*fzehHvg?imaqUEh>{<_d}IQc ze|29b^edBJbK2XSdYirLaQpSZD`gF4Tpy_K_l?9{``%GiG0effBpXu&koWT0!$QNg zgd6h4pRRmBAPj_ctC{?^)0qh)A6wNrVqRvYEruaFY&{gMk;XD~4ARuNS!G$LrD20s zyT#3WE3XVDOVz)!WnKr?%g%N?jn;rwj{zH?d+&SJv1xSqK#@Q(t=8ny6Ufb6xUQ3r z3SQ5Ob1CGZ?CMCCZNIMsl+@%w8kac`jh*6BPR-gJC}c_30zgs6C$-qQ!sfJ@Jz7LQ zSqb`nP=zY}hq6%;YRe%}En={toJzCRX<>CGzvg|6x*zg#zlYN&f*HU)C}_D5RmP}m z-eVipVb$<%876Asm9VfsGhM8vyBgFG{U`ssAiINSUGlj!l;X%V2srinGUsr!+@!DXtw(9HUt$12cpbVZ` zhK?+JfWED2&m9QPDfeYXBk9YJmFWTJF1smb5nqpm_p%>&URfs>KF%v;ORmDp`BA0` zGaiT3rK#pNCcS+Xv;&mhVxPXZt|PNhZ}bVzsVPI&pX&+Eb|!#%)7{fQty}cZhjXb= z2{y+Q~?(A%fcu4cdG)%jWX_eh^t3u~*(bg`_JW1E7319uVsKRjm9dSDhtI2dPE&kc3a`JW`aXnVpS5eV zD=v0s*6Ap#s}W|uN3d+OU#ZEpXm`Ov_1x$Zl8>s5l(|o)bkx18EH8a$uGet}q_||$ z6N634+?NPCNwPH*NPEP-F{A3}rn*!54Or=|+eO5VpH)9}5*^6CQMs3GSIqBZe0ZKv zIRN3h2duAkLm-Imm`zmsShMzx4)JcQ`R0_>8KUmGtLwvK;9qiQjeTt-tvMehpH;kl z>o6fRwvZlUNIU8xZ9YPER|Q-Wh*=CmZ(O;5VznZOLo=(xa&9x@M+xic6G!7o9>ld! z7T>)c56RfMgcX1dgn5bJ^5W8xy(nI&PR*4lo?>XvL+TWu*&?MxDC-aJ<3`K!G^vP8 z-~m&$39sujfDRZ1$Vu`B1)6Pqj5i+)Nb#dH zK4jGJ@;o zMmO((mBQPy2_S1$lkdm?%ptHjG+$IQ(?>p;T;Oo~(@boKmUpw=3eof`lBHX$5w|YO zD2e>Y11A;nLX}8YhN7Uv@<3MygVf@h1EGPFxk(Rcw@X%D(kKelq^A%g0x5rd+i`V) zv%n25$5LQkYdfQ~xf%1i<2b|v?w4XZwl22@UxY3`&pUe7*+GkP+Hm7^x)~QRQJ@7OhiDJziu@e!k&BimT}c+kj=^De;VArN=vyAoO zz^b8tHA7+#^`Z1I$6O@4+Z+%^m**>%=9h-6E?8tcX|Y05a*FP~j+vRuy}^fh4#g{@ z6tvgb*X}`PE7-9BwirL&q&VQ3Ytyg{)io+8DG)7g0=QxB7UNi{iD}=M+sYVzjK*f! zqSY)nbHK^l%$R6}F8vbhL7k?F=~K(G->AY^C+H@?{D8&jT&jx}I*H|j`d3Y|64PGH zMMXtRjBN1yY88WmyxF@MFf88tj)^s_Zu=$IYYPD7EpuS(u0!b+H_n za-_WW~h!p zreFwwp)7uOlyK_MWLiGP^=9jdvB~j=7wJzd)$JF7f|UJ1?iN=9TQAjp2R`D3-B=IFf-kHrNhN7Ogzpc-~*(Zsy2aoF2A z5j&6Y)>}f-1Q$JFw~g(!8eTIk&Ekm9b}9M;wS_dCE+h+@~GNgPo3va)1zO zzW%PwUb$N~s0U?-q#O6{En2e@dJkHaw!4qY2%f|;>X#Bfhs+QgLdJL?wB=HC#=L#C zL#JxS_m13_K64uTl{E0iynV9lg5?rdw}Srh(mY>M$a2wtZF!^0Abkm@q62ho-y2gn z68vs62T@7z85H=ZMxD{_XVOE{kN0>$-83XBA0UN}juis{LL>JJ zxYC_HIXa6(hDQAyeZA8H{e!oLpVvme$+FNzk1kX2mptlk8-R*NM)lYC`ML-i9YxBF z5S-cBsKMnyA|!Up!Y3Hz}uEc3t`G!Q;AY`I8C3ZXpa_E7d4L-g#kU7WQ5Q{+)E<`JDR4>@mN?yGm zO~KkZj*>Z7uL0i1(KZhjLL+}9@WYjB^XnGCqvcXNo>m8XQ0Zg}bGnljND2!CW)+8HEJ^eBd=ene_EW ztdtg}u?N%t!!_RZyJ|A*Jee#f9Rxh3?HhLfNO^+$dJ-70>* zM(}!kUDxMH8R1T0#&NW`dgUFtnaN71q*b-R7iAq#p74dg&NF82m#8cdgXGB+Q#9`| z(&Xbyr)iKkTR+P?#(K7=!T&&z5|K+JtZSySuAONunr}B5!c*M8lk(nd1)Hr3{`98R z^0&ptcnntLoy(SOZmBgJyj_$`>5!T5$kr2ZxMH>rqW$zH#)eNW`JrrNF4ikcOV4Dc zm+96$)3{G+agDG1G-M2s*5!AOe3hK13_5g=c^L4yaOuNtvMbz&KU8Q@34|-v4j`2@ zOT7y!$`%T`Ykl$VMS%woE^8GO#cgqL@(1!fSILC;Lz<4x(^4MNf6N&MzDPYqd9(}&ktPL!8H3o?dsTH-B9eUOmXoROz%&Z0Aa#Jjgry-qcr( zOXf-3tl{UIlL`h(k5Mk*L>!7wG4Z+ofJ_FGBu_^T>3toi8w3xy=xP3865;l)8~j96 zCjsr9yAsdpflut5{Mi#7MGI@hya(b>mK1Y?wxmCryaD==98<2b*dcL7^qU+uf(&n- zlRIDTmHh>Y(;DC23{#K*+8KA9HFJQ zWTJ7tB!HuqYkPn3J|X$a2cdst1f)pDdNUKuestu&p6=YdA6NL{^kgOMy^X3<%>bhD zh^Hc&+9Vw40;UT+;T!t4VmC5V8IC!1pQ4A7U~aC$7s)D`AJ-ax&e2lz=%2^3^9Saf zBGh62Q$QHr-M+=s6A7bVL&`j(0^wQs2ajkvKzSSdX~Ur`;8?J;c!z2jA?Jb1%o1bf z7oR2HQNg6Ycib43KU#_ z7kuu013@035;f($<@MjVy3BpxE}4}xPbk~r{8zDsnexc)-2=%P*Is{obE2Uov*Z3l zC(rd3-k6&U{Ktt3_VgecSl?Ut{v~KsZ_n^A2)+s4{=?PkqSR}rp`$sDwms+SE9)|j z+G^sF{V;#;M$7$u^d!-n)g`6NcIfe_ItNAlMMl{h}%8u-C zmq2S>thu8<_35P=mHyf0K`uSYlP4r{=?-6sj?$u6u2_UP(yZMAIPr_MePFcac7{QB zROU~zc2sir1cu%%;Om_;OyEr9zRKlZ`X!k_#BxZ^(E5nbu?A-rskY~Lm|ri<*_$^x zqgSY2_t?XxeXwDy>p2+vdo_!#6TMIL}JW_pCX5wnwa+-l7QLQDWH! z696L#&d@)RLhXh1*zQ>Xx4GSnLp%N~ZT+2%m5^!Pl{%Rg;mVND2YEoU!#(d`W#qSV z0q|XH9znLIV2eRsL4zWX3%fM;alJ!x-I43a#PLisYceTw6*`!-j~Kh*}na|>rQv8P+3w+qbwCFTh_`_C@E30 zCTn)dG6r`lvX+vv)@VT?O2}Havfd*5mNnT8GZ@TsT-TV3-}8H3{a^iG-1F%(jhXAb z&h1#f$8sJQA%7%TyE}H_bK-mO5^E3%GBPdkfGQ9%IWWqB#D4r9UU)z_YD&)lK=w|N zl>ruwPr^u@((6Q64kjjk+u89US!^442|m6Wi0;iTzX&l~o?n)syFoCoRw->5B zJSu7<)|LJ!H+DA@DU+X*^D!<9u#R;Ve$nY?(_5CIlg~J7q_V*gbq_*M{4%Ksd=5B8%s?2vDTW_(|n!d1HftO~Aa% z=xziq2?condQbe46BCf2s<};@&k8Zr^mYkG+bDfeI(^m7>o}{LKDZ`koNh>g9Q&(c zmC%Xr*>*R5$?q=baWGB(p55`Xfc7?dFW@SHCNU(o+g!T~4BxVP1;X~#5!JZG$t`pq zf%h)4B~8g>BlShe%36cJ1tc`-yX`Ht23=TSu#tBWR699v>$M+6Moz|(Zo988d>CtV zw?-P!Mj&X3y;RFr&&q58&x4uvWNz|3XTDc6=@`}njuCS6*#v@xl@+|C{cRREy`FdN z*}qi(Xb_HPFBiK{%xL4vJ1uM;nkELR2LGDi(}Z+{}n2GD)mAAs%RH zcv7BSQ=D3GK7q{zARiEJgc}XeDPp(E&R1z)gWLm|JWtCi2sG8U5)_~R9fru}hB1-2 z*_}*HSpak)n1wqg(_&hal1T(V&GFDq*AM$!T=TXe&J}RHqb17G87Gz@L<#Tf`H$SLC_>@RMFdraLp!k|0@!M5QFAogz z{DAa>Vf+a}gbVu@eZzP*JlYNv`VVCktg!}J2iZoFll*pH1laO{djNkkQw3=C*6pCB zFxJfFD}H}0iyC!IV|@d@c@KV_d*mHpoFy3vJ41;n+OKFL$2p)J40daaJ{!hu;&=o8 z3^#3$fmmUlx6kuadaYw|FGha$>edpbPOjcMbkewL)27hkm{qa`DVdNvg4la?785Y@ zCb9|`*%uzzHSaoO{|d2d#(E^gUv;+)vQGfVGh^;erd;FqONnOZ%B$n#K{OBG*1d?1 zF#^Z`OgdF#-a}}>F|tEL(CrV9`_9a@%1Qt;gfzAaTsi&a;9kCuc@J9d55!)JHM-uc z+Sxm*C6l=$8mGs*_%dx3ZbYH(+lgWt{)Ig+BSg=hP7%Xs(>Ra8)X%Pg1cdm@VuT&XK0Ws^=JOpuKGg)aJAoNCp^yY~N8~;j zwb`i^QyLIO(Qz7(mnrC4wQ5b2W>}?QE4RAHxhYsOX^NGH^Yw2r6npkRKOuMgq_MjF z)S+*44p&Ue=eB$`HT>4@D>N8*0Fb+**|_}T_;X2&?M%flbnJ{f(vX%*s(FXd%9-!^%nVExm0^X4kBzrh8AU)c#F`DqZk;&IUD@19FuvH6 z`8?n52kCp@DDGDbIHulswV$ZzgJ1;zaLwBFyEeB&9N8#%b5x+jUqeOT0gN0Tue;%!mym@84)Ym4-|!&N<%MYe*)8Kw?3xc1i~kLIDD32*ku?N)S%A|>qS@aS z7R1c!-W>%r7K$^a>SQ~0gHuW?+g=*?9&hF{zzJf(81=*o)k6yMbL8>6-Nw zAmqI57YEofZNs0h)Pc+bAj%-i!R7+Os^qqc8T(x}WOKD!!y8_h5muQhVMud~L_yBO`e|b0K}a60#1n8d{|Uh!JTuT}8U}b`l)xq3j$I z)XQ@Eu9#UO?Vd3`G}1xS_fI%i8@wlO+GI~@`FXIRLT)}Miaa^hM8fB={F+^J#exw2 zu5Oqgr^KFkv(|WE$tOs5vK# z<)t!(_cC(&n6_Rya|Uo1x91@F?p&h|&%PsK(%Z@uj%6m1hK@NMcFfX6iAbIun7zB_ z^A3O%Mu#1eV0A$k*XF+wN9@vpG>+BUAPx_-I*K|`48e=}HQNZl7Q}p{0PrB~)EhEQ z)D4E4+qp+_I?H7&Enb3B0x15_@@=dFf$yWZT`8Q^dg*26j_2H5TJ>09-ZNw!r5_wd@~kN}{JT zAmJ0+;KU^Z14$%+3_Qg5!?v~}O&;dpxHz@eec`OFiwki9aZ);yNbXhJ7C6H0=u^NY z3{ZA|OD6boZ;ZB5Zx}|q?bA<%i6Fjbh*)dYTuv7Dl_Zkd$x0-X3#PvZ^CTe&C!1s# zI{S`#x<>QU=%u%K;0l1+B3$n%!_;5HUkwoMLsC7!HO1yvkw#WCgW#3HHt!hKEhf@A zhfRu%sBKshEEr$2lQ!Dom0CFI=EN4m}fGI-+puz%Kg$DSSO{c)(*uUtW zo@?aGBTdYWXwv3ICgn3dhr(v`z&xpTedxDZVSZZM^Zxkdqu@(Hvb>^Y2zKnkwizV#bMWLntq zH}keZ@F+@^)7E(k`XC#88;yH0w4ADxfLn^ULVab#MG7X%EnZjfe?pqlrTaa-?4xWG zQeA!XN2nsq{Yp@pP&Zj%>p_`?GnYes!K2eXUglr+SqX%^m`uSq?oVrZ?%zgN90^9b zUczEi6%UmDK2{U!EoceIsrHsGDK8V!4A&4AJXdk)dKdumV-wJOPT1G&$fRdzIzQBF zDoanW#I65&C5iGj0wC!xdC&A;6hkps$*Yh$)}tF=U~t-U@78_-X&@ zPo>9M_r4_}>Ay%^*Pzi4%seh(P28r}Mi*=BHA?<@JxjTFb?RC8)W;LdN5FA`+w5q- zLqqZyGO3D&sgN!_x|U@9yfLoi_bep*<#>b4itK3Pj-j@YJW>P4T)_v{AN!O==UA#| zOqoY6t^0>%XFKJsvd_5qzh(x>tU+5y#B<{v4=YF|or&*r)zNj`5ZNorzad7fX+ zsec3K9%SP_)jfA@4}KB;n4kXnkeSAO*-?C zo|)Po_f<2huYZ!1@a*g8ev-HRb7GAgNAjc|Ab4(wLsbm9f@I)9*fzE^_1D42q;6)YTz9A=`!V_ z^{e8+6Bv7!XcJqa@IjIQ99}-W7u`;B}McDVe5%JGBO5j z4%v{9MSRQeME*==3Gm1h{34Ype?SmeK)0T1aivE`*~{e6V(SK7=w;Kktm@zLo`)e@ z^KyhZN$o@cGIVnFXP0$e1~rXXlCn>*BE!$~&ICybiOX;)2EVg1J{Te!@jZD(*V!%s zn%aW+=zDl$-Xsjoz*Z91I3HxL#z7jNUb7U>4w3R%S6+E8Fd@G<=@?&iN=i7M@ufuI zV@dX#fA+Y;*GPsTk(>sO{Oz*ZA1+P1)k63H@*Xd}cc+vW23xi^@@w2!oi2Z1XUS$0 zI{-_F<>F;BVpus|0b)fcJ*C}GGv)H7iK|8iRnAi$f8y7pMFZ%zZQHW476FS9ag(=@ zUAD=7un~lP41``w{}~@4=D*(QeX-4<{(OV?g!SjuH<0`$5S&QRNb9RM80}$FG=wSL z#vHVKBZWQ#3J%;ZB%~jdAu1+)@gIi@Sbp(!KlL_JgtcotC1h>vHr@hv*7cS}{d)cZ^MqeR(=Gw?w;)$DP(o88*D!l}6ml3LFFq$BZw}_%RNKG``sUVD zB_s(p;{I}($c5BV1_D{mBw*qfL|xBzvYXfrDlw_$r*=Z<#1cPXd~K9tG$U@4YVwrB zqY|c=9}SXlA*_>18Qw3BS$*N;EmMfWqzd8EfuAq>O&?_T3-_{<_pr%*kc`2fx3$KOVvXW@8+cStJayulHk0LXg_TX&&6C|I>M-xrD8`E4GB zV0gc!bz7uG@b>Of5&JSoTy5CHIUV)YF0n$3Hod_b@nyi}h~9zJY9zCLHUq|vI9Yzx zJ>a#Wx{a%VzI56J&Xxv#Z-uxCG&dI9B!JW{ziJIx)Z{?~mA~vHWZzZeg*qK#a6QHc z%dVxB)pv^zwq;5}Fj`kM^&lks<@+PU+)=c58>{)FYllSY^~EH0XYN;Ii?6TN@Hq4) zXM1STK?N`x!GjeFT2O7Pmn>cLA*`vu38{ld%4b|$YEwsmjUe=oj7h4Vu)8)|3PCYc z7D&RX;;p;~ar(z{D$fTVmc084K~iwW)JLfbdF^xy0F02qNqoMT;Xf1V@E*KZ zkU=Gw=ujVwn0b-hyp7}<0A@qesmcHxk+V2$ZJv<7iyX;;wNgK9^9piQ;FK5Ku)fYY z)Qv|%JK*o^@S6pYJAwB|J!BYB;y69ST~%E4O|a1~42gt7aMamU3Xnl%l}NFD+*1y9 z$FmxlM@6LL6u?sl?ucY54ZFO#?@n^GpARV~`^ZsnX60UKK!)PPXd^UEm-BY)s3!&H zkO|E^v(r;SgVWNKj@r(B z3yo-BT;R>WxO_13a1YIc?yvRnpFs|-4U^9>POaITV!$Y9Umm)Ysm$cx_I!Pm*Q6}v%b zbYyDZU-85l5NJ6HLfCOn#ixw)cqZ0~_OS?-i%oQ^-G?n>@Q3c>|C-od1{~qzTO6B& zAsbD{H6SAsI1}aU$yJR|82xA+^5r8gTH{{i0~3={F&wL-m}T0-dZFX>3Hva+pJoL! zpe-E1NuWy!ob zH5-rVZRn|-XD@KGZNI5JaRh9W-%VgEwBKosu+7|{_j&sAl=mM@J(RN`V?xAkZ+4oY z&SfV?BxxUq$yKR&NvDwCA3cI&lr-Hh1=Kvo7J}#6iQ)5Lik%sCt?(1JSsY|cH{HEr z(&!ecJ>L7m3QAeofKstGAV0lNb1PyI`h-oYr6|_&#JMkzU5w$V^x278^qQcqv^Zl)=-se`#o1Z~Qu|Ri=S;IH!tse#OE)>vQnn$wpWl{3?p~dA< zUF~`lNwV`2+?H%OU7=eoKSMMk44i#?lR`F^bltirr6GPXBKnKtvB5hO5h)j;JMoX$ zolXiJ-Ctb!*j2Fkm966b?WgZ=Iy$$?{UYfkb77}Vw>z8q@65!c)Wh1d2p{|W#!g-r zoWHTTOg@$7QH$<#+xo$l`KEz*UBX^$AKJ9AgWb9T)wN9n8Q}-Q!Yk3mYfETR+kX1` z{DAfy2JOJ<=@{&Yx%bOq4y~J{G|9nK4tlkL;3UFP1@de{lxp)1^z=Tuo?Ri!BRVoq zf=&kY>gXd%n6sdi$@AuoqUWCJS8v8jmK0pb<>tMTklINvH6WSPVaP-E9REQ->5pDL zDvF)Gmnj*YX*yxcA9#)b2zm}(lK3%9`8zjlw*Hq3y@mza#PtbdHuEuBlA-BQp?QhW z1-%KMtw;z#{&&BahYS4xKhnfU2CHu(Z~P7~N_MB$RQ1{M-L0ORn){1>A|JhbR|qzI z7S6oip#;M#*Hyl2(AOtJEz;`6NJ*Mx(K@5Y$Y!B0#cAyP`&x~FL%6D=*4Ih&(i3`T z0^p?F)|kD^)dt!eu^s!vtiYe>EJc2mUwarGeq+*N^FmsUUrdnz_0Ds~{h3CkutnnX zZTC&9*)c@nvwB7EqNToZESMnQ~@JSTP%~(u63@jiT2=Y0c=*`hn>FiWpAE4{us7g(13{QF_2Q$Yj8BnDil!^YjsM zbPBpcRYq(frE_xh@&+%tL-kDKSY-UP$js;>psk*;G8R_!voXaO8P!%Rd@X$< z_gd5>CP=S8SMONfiAt;h`4i(T(!O#pG1v(&I;H8~vvGFmK2s}w6rB~)LE%P5Ic}eI zu4*Z(w&4YjVF#@;_t<2@K;c36~E21;!f6kv#n}Nwfv~BQA?$cI%pp~RlogpTs zU2Uh8j%&kIISyA@XuQ5cucCxb{Rt-89GK%fcB3Rf-%_;XQ*_1AIFU^^J%9#EG1$4H zjSAe1-M(K!m%h;18l>j$N8^_3tva}3T+6jBCSKr}pQ-(K^7$7d%BFun{|@`=JX4M~ z4Jv~q#9Zgbcd<6o(RL%6OH+Z%Exvnxl9>2kG>=sbj6PW_9e{B9K3frG!a^)cFi+G> zO{LMTe@B&otwg^>XKudSux_wnu{bKbQ$Fa$Q~DC$gDLIrh+h1;f|4#0`o< z$Es-L2zGmB5&VD9L6;mh(m!V#ydJfC4xdR5SN@o7jSiHL@2Z`%IJ)-rReL+D zTwvbxWz1WA!u(xb;Li%lWm4_p#ny!X*g}z{7CA6Y5_q<`KM7rN^ZK@aYm{dbqRReb z8)kN6lT!l5m=rw0g6!N!4zyC8sOfj|cWomH=T8~Dz=opeAdxqDjCBuP&R;Oy8dG%7 zm87W<0)z#b4)BD$dYyDjd4ni7$zh(-@xC3t2pgcU@%Pvi*GJ2?2BsSYp#f^B>p5+CIL!T(%3WR0~cV4*ijW~P5w!59avgkIUEuREn9PvEeNQpMvQJkYE9C)Xb zzy<_|JP59E=Ys<;(#EMq%HJdBl@Grb$-kE_DT@3;e_gohr4`(Qb`RmL+ZdN$5pFc0jP)p}ZQo zJMw<3=1=D>HfPFyCTKA1S;? zKgFi|5cnC${X)A0jZy}r6pX;-b7EF_!Twm;=-(e{eT~3iDj4SJs>Dcw8>FWcVWLVq zv#LfRxTPhx7U@6;0dFLd=BrO~?Q@4zQZ-kU{LIEEU%VpIJIIsjch41+Xa7K)N_rR< zQrW5N@tfpp^kvrA-w|s^;FxWotmwTB>zz3oN-cUpzHPZEnMq>kLKT}w~IDaayakrpIC#etr&9@ zDWR2Cl9bURtLPOzQCQ8-%)(zkP6Ojb{nkOt*>?5UH$+}2Q`*aSHg>G!*Yv#=_teJj zslL&brMq`_N~^YnRu=;Mf?kz!y2bF=1$c7hyn<;K-dGA7%^?Fl+Up;*>q{Qwteq;U zXNkjoT1Ev56B1VSeAGB$RsdqDq4ZkCcer;{)XvY>o#M_&9HrLKj@*@@)vQ>Ibr?~a zRkLji_D`TuyaR9mp?ij5irGDXucBN>J`Z48#fVpR zqdHnOSpU|wJ;D7ny};6*wHFHZqUCGRmW3{-`gf&J3)cOC{@L|7DYY|j_BF5Sca7Jd zc&8_k%Bu0h{iO)~X8C|w1f+VeMYSq%w4w)HL0&>`*StAt;m zBL$ABqW6&U10+)Q8j265qqhhtm{AWhj9XD=`8tMQx1GB#-l43lo1WPDEtA}H<9a9B zlf`{GuPx4+yUr36e)mH)X(L26V{Vqh3`~#&NNH-{$f8P|HT2wJCMmfa23W}X?F4sK zCxP1v@A%ub7<~{WI{GX@#`d4vL+2=^7Q@K77%h>|hZcCP8zCG2g6qcr0KSgYY~-_w z`5CBx%+GNW;civ5jx~Clt`-KTD6TP!D)7&)@|LcX0Y!@FW~7vK*M1m)bHU|c*a!;` zkUqEhKP9Kr0%RwYk4Fv!l z7v@LtxuVM8kOMLpQFPp|crWk@W+U#G7HA#Sq}rsy^UR@QbGeKnwc(28SU79P)5xfE5S};a8ht zc->)$L1={=EoJpWz_K}|lkS`+f<9xqO^0LCy~kzB(Tfu~oHnk($i&c>q8X+^f)X;g z0S2g;#=DHh0SWMVHwXT#-rc_AW)}qrq!y&RVTq94g4=Daz^hRTgTUDuG>353P!`y+M+4&*xAc_?kc;47_WH zF%)TKf(?n|ftFVe<#u+6ebc4(V&r847<&M7_gcLgSd<2=G+VH+1yO9v z!}^X5>+TP|;I9(8@oBZ6#%qL*sXizeR!+lj>2oyEM{ai_?9S2Op^xL!ycE8ZyYF}# z<}aKC4goeUUB25S<8D6co8Sq-8x4W*b=Qiu5w0WmFt!FJ&IpZs05h|~i-nnc{EU;v zHfc4c>m4i@tIae9gL*<8DFUBP!J{}`avGcvp(($egBBgTS3qvdbl#-8h;?*L(8|F zp)D=*FO`+{-d>h=Pc|`#xUeP(B?Ci`OGo*x)>lAxCCIQ0DQl1i+IDSL*GW&Hc?eqb z)~NP)w}oDN={V@^cYn#ohK}AVF}Ui^_ameWDmciH5-)ow z2oZqW9v*n1MNQz!$e2CV7zu%<@8N%fJ}&R!oAjpcVV1E+q&adS`YNns2oa`NI@iU) zo&aF?JN%9^tp&NQhx^vlIq+DqnH6k7A1Ql<@A9d=R%Q>p>VvMmWF6EaEu^OEO(gO9 z#z=~JHV39FOon0{SXjx>6in6pwjwG$wN4-q8W&w77Wm3XcdO*d!oTt!*8&kLJPz13 ztyW9K+qF&P&r@&*+h>ZyE=_i5Mxofnuc-%|`B+qVo z8+hM>?HNC^XDOYb;G1}H{fsYi#lYcV9>BgqpUI(oM6Aj9A6T1kgxx`8=L3C_!;Zrx zK52Jjia6mxIYkP2!Ra!hh=QZPf-n`VpZ(%8o`b`nfCJswr&@4Td$i~8d zD$TrH7~?R#!dw>mIV~-oFL=e{7n}1=DOj&Z67UN*a=MT>7iUFP@cYH)>skeJR>w0s zWh#_rh%_e2lm=@hK>ryT=HNASeNcO+9x(#WX#wk(#IcyxR{@=ZtPM(6IE*bTlRg^* zeRS!lMP@*=&`7N-vw~7B<$$TV5Qt!R4^&?5&|(hl=2|VX)5JNf_bg_{QYrS~go6_@ z(oaQN;gS!8-I-d5Q!dU?uz$tMy6Od7FZvSXdAd<9Z6P5-bt;f^I?%s|Po@2HPA6rO zb9xe)(=v^1N{m|SA|Wze#{a|zOg|!D`*2-6f?d0G9r~ZPA44v#{1)UTRzdjR@BecJ z=zsmYKL4)6O1k)$9{#0=|5tjT6~xHwMx^tWDVmGSs-1kujrRWEkIdy{T`uLiqQ63a z1~^*rC45x5y{w~G{36P?^n8jH-@!*8*8lr~zd?U3KgDiE3u7fl3~R-g@bTZF|GVn{ s5)7cw|9bt)rvFNqf93lBM=EKZ#pGc7@!(6A2& + + +