From dc883bb1fbea1f176ce2a09784580a2b5fa6a86d Mon Sep 17 00:00:00 2001 From: Scott Lowe Date: Wed, 18 Nov 2015 15:16:58 -0700 Subject: [PATCH] Add SSH bastion host materials Add Vagrantfile and associated documents for creating an environment to test the use of SSH bastion hosts. --- ssh-bastion/README.md | 29 +++++++++ ssh-bastion/Vagrantfile | 95 ++++++++++++++++++++++++++++ ssh-bastion/bastion_rsa | 30 +++++++++ ssh-bastion/bastion_rsa.pub | 1 + ssh-bastion/remote_rsa | 30 +++++++++ ssh-bastion/remote_rsa.pub | 1 + ssh-bastion/servers.yml | 20 ++++++ ssh-bastion/ssh-bastion-diagram.png | Bin 0 -> 23359 bytes 8 files changed, 206 insertions(+) create mode 100644 ssh-bastion/README.md create mode 100644 ssh-bastion/Vagrantfile create mode 100644 ssh-bastion/bastion_rsa create mode 100644 ssh-bastion/bastion_rsa.pub create mode 100644 ssh-bastion/remote_rsa create mode 100644 ssh-bastion/remote_rsa.pub create mode 100644 ssh-bastion/servers.yml create mode 100644 ssh-bastion/ssh-bastion-diagram.png diff --git a/ssh-bastion/README.md b/ssh-bastion/README.md new file mode 100644 index 0000000..d8727e8 --- /dev/null +++ b/ssh-bastion/README.md @@ -0,0 +1,29 @@ +# SSH Bastion Hosts + +These files were created to allow users to use Vagrant ([http://www.vagrantup.com](http://www.vagrantup.com)) to quickly and easily spin up an environment for learning and working with SSH bastion hosts and proxy commands. This environment was created and tested using VMware Fusion 7.1.2, Vagrant 1.7.4, and the Vagrant VMware plugin. + +## Contents + +* **bastion\_rsa** and **bastion\_rsa.pub**: Private/public key pair for accessing the SSH bastion host. The password for this key pair is `password` (all lowercase). These files are automatically installed by Vagrant into the correct VMs. + +* **README.md**: This file you're currently reading. + +* **remote\_rsa** and **remote\_rsa.pub**: Private/public key pair for accessing the remote SSH nodes behind the bastion host. The password for this key pair is `secure` (all lowercase). The `Vagrantfile` will automatically place these files in the correct locations on the appropriate VMs. + +* **servers.yml**: This YAML file contains a list of VM definitions and associated configuration data. It is referenced by `Vagrantfile` when Vagrant instantiates the VMs. Generally, this is the _only_ file that requires any edits; you'll edit this file to specify the correct Vagrant box installed on your system. + +* **ssh-bastion-diagram.png**: This PNG diagram provides a graphical overview of the different VMs in this environment and how they are connected. + +* **Vagrantfile**: This file is used by Vagrant to spin up the virtual machines. This file is fairly extensively commented to help explain what's happening. You should be able to use this file unchanged; all the VM configuration options are stored outside this file. + +## Instructions + +These instructions assume you've already installed VMware Fusion, Vagrant, and the Vagrant VMware plugin. Please refer to the documentation for those products for more information on installation or configuration. + +1. Use `vagrant box add` to add a 64-bit Ubuntu 14.04 ("Trusty Tahr") base box to be used by this `Vagrantfile`. You'll need to specify a box that provides support for the `vmware_desktop` provider (it should work with either VMware Workstation or VMware Fusion). + +2. Edit the `servers.yml` file to ensure the box you downloaded in step 1 is specified on the "box:" line of this file for each VM. (By default, there are three VMs, so make sure to specify the correct box name for all three VMs.) + +3. Run `vagrant up`, and when the VM is up use `vagrant ssh` to access the generic Debian VM. + +Enjoy! diff --git a/ssh-bastion/Vagrantfile b/ssh-bastion/Vagrantfile new file mode 100644 index 0000000..92dd6c3 --- /dev/null +++ b/ssh-bastion/Vagrantfile @@ -0,0 +1,95 @@ +# -*- mode: ruby -*- +# vi: set ft=ruby : + +# Specify Vagrant version, Vagrant API version, and Vagrant clone location +Vagrant.require_version ">= 1.6.0" +VAGRANTFILE_API_VERSION = "2" +ENV['VAGRANT_VMWARE_CLONE_DIRECTORY'] = '~/.vagrant' +#ENV['VAGRANT_DEFAULT_PROVIDER'] = 'virtualbox' +#ENV['VAGRANT_DEFAULT_PROVIDER'] = 'vmware_appcatalyst' + +# Require 'yaml' module +require 'yaml' + +# Read YAML file with VM details (box, CPU, and RAM) +servers = YAML.load_file('servers.yml') + +# Create and configure the VMs +Vagrant.configure(VAGRANTFILE_API_VERSION) do |config| + + # Always use Vagrant's default insecure key + config.ssh.insert_key = false + + # Iterate through entries in YAML file to create VMs + servers.each do |servers| + config.vm.define servers["name"] do |srv| + + # Don't check for box updates + srv.vm.box_check_update = false + srv.vm.hostname = servers["name"] + srv.vm.box = servers["box"] + + # Configure default synced folder (disable by default) + if servers["sync_disabled"] != nil + srv.vm.synced_folder ".", "/vagrant", disabled: servers["sync_disabled"] + else + srv.vm.synced_folder ".", "/vagrant", disabled: true + end #if servers["sync_disabled"] + + # Assign additional private network, if specified in servers.yml + if servers["ip_addr"] != nil + srv.vm.network "private_network", ip: servers["ip_addr"] + end # if servers["ip_addr"] + + # Configure CPU & RAM per settings in servers.yml (Fusion) + srv.vm.provider :vmware_fusion do |vmw| + vmw.vmx["memsize"] = servers["ram"] + vmw.vmx["numvcpus"] = servers["vcpu"] + if servers["nested"] == true + vmw.vmx["vhv.enable"] = "TRUE" + end #if servers["nested"] + end # srv.vm.provider vmware_fusion + + # Configure CPU & RAM per settings in servers.yml (AppCatalyst) + srv.vm.provider :vmware_appcatalyst do |vmw| + vmw.vmx["memsize"] = servers["ram"] + vmw.vmx["numvcpus"] = servers["vcpu"] + #vmw.vmx['guestos'] = "other3xlinux-64" + if servers["nested"] == true + vmw.vmx["vhv.enable"] = "TRUE" + end #if servers["nested"] + end # srv.vm.provider vmware_appcatalyst + + # Configure CPU & RAM per settings in servers.yml (VirtualBox) + srv.vm.provider :virtualbox do |vb| + vb.memory = servers["ram"] + vb.cpus = servers["vcpu"] + end # srv.vm.provider virtualbox + + # Provision key pairs according to VM name + if servers["name"] == "outer" + srv.vm.provision "file", source: "bastion_rsa", + destination: "/home/vagrant/.ssh/bastion_rsa" + srv.vm.provision "file", source: "bastion_rsa.pub", + destination: "/home/vagrant/.ssh/bastion_rsa.pub" + srv.vm.provision "file", source: "remote_rsa", + destination: "/home/vagrant/.ssh/remote_rsa" + srv.vm.provision "file", source: "remote_rsa.pub", + destination: "/home/vagrant/.ssh/remote_rsa.pub" + end # if "outer" + if servers["name"] == "bastion" + srv.vm.provision "file", source: "bastion_rsa.pub", + destination: "/home/vagrant/bastion_rsa.pub" + srv.vm.provision "shell", + inline: "cat /home/vagrant/bastion_rsa.pub >> /home/vagrant/.ssh/authorized_keys" + srv.vm.provision "shell", inline: "rm /home/vagrant/bastion_rsa.pub" + end # if "bastion" + if servers["name"] == "remote1" + srv.vm.provision "file", source: "remote_rsa.pub", destination: "~/.ssh/authorized_keys" + end # if "remote1" + if servers["name"] == "remote2" + srv.vm.provision "file", source: "remote_rsa.pub", destination: "~/.ssh/authorized_keys" + end # if "remote2" + end # config.vm.define + end # servers.each +end # Vagrant.configure diff --git a/ssh-bastion/bastion_rsa b/ssh-bastion/bastion_rsa new file mode 100644 index 0000000..95a72ab --- /dev/null +++ b/ssh-bastion/bastion_rsa @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-128-CBC,7FE49F27BE773D4FFC45681AAFBE2100 + +D1WCSSy7EhsNjDNw+2bI0P2T3WmriJjHHY7UVwOUShD+yw2JU0Q5Z/6YHiOm9h92 +iU2ZHZzR8HurQ6rDD0KBQI++nmDerkKSdxjTu+3dSHRPG51WniwqmNEriOvSW0RO +cdq1NdIYCDN8YE/r+htJAfhgVU7d+2yOJ9DGKEsm0PQrdEY1tlFfVPJbCNyZkI7M +GPg9RRYdM4qgE5v3wu2KWPbuMkjqltIUOGeJfEl6D4ER8y5sHTxvSXA/gNJUsQuX +9ZUb0fLAwRtfRiRPBIbNbv2HXkGdugo8srqF+7rWxmCk4f14ONekIgtlxxDUIdYK +G7Wx2j9kf2ES8PBdZ3Udl/U404F5LEoIqBLo23zfDmuSK8LF47u5VS5enW68CyIi +mzFw6yCoysdzk76QxrAfqGPtIxTGvemy3NTgk/PgQxRcM1dOca34kJm+36yU+N+w +0Grxw+chNLVYv8VjdBgaJvQiZ/IPx1Zj9gZoQrOErLXGc04NqUFIgFT/M39EaB29 +wyQMYwwumySmFdIxWzAWCYw0KH5okjSR34SdaijYA/YZ16btEg58UNleBcZtyyzz +A6zI9u2DZKdx1Dhgd8ScT8OZ3SFCbbMOTLHLowDQzLgpvK1L9v2+l/h6sa0Mr82U +OeTOnvtuNSZYt3ZK46db5NVia9LcIFuqXbHiNY5pmw0EGZqsndBs4M6h5ijlgJ2D +vG3P3nkYBJ58cnHZjv2yR9JMSqF6NcNGkViH4wEdFBtiye6tQF+Bv4PpAMz3jC/6 +X8JIKsPnbFzsl1HfEeSMcNcPxafqQaxZE18wrHZhn57ppluxvR7X0cGD8kWOMkB5 +v02Gf2NL76VvawbXFAWnOuNioQzzf1nlFU6yvLkuLdFu6W3ZBP86hpHNRZKhl9rt +WGAzpc+cQ2cwRdQ9RPyQBURh3iK2bjWu2Ylje3JxZL5E1KJJk68FFx5NQOram58o +giVulwQGjdmSymcSca4KKTgpoLL2A2uTFyJp0nCJkNhrtAQqd8kKGGGCovh3Z+i3 +hg8SArkvHnqind6/CTdsUCD7DZKtloHCgUoiI2ZXhw1IDn7gUZk0RqCVJX0fz039 +BEoaQCq1mnru6jS+N18qr2oU0BOEZ29id8grzgzyRR2QSYuQcsqygqRcc8b8meos +zP70Z12W4b3qptClyyNcOVngdGiG///tqoVS4kHMB0tignlOjGpP7C8yi3nXxIY/ +lh2cPNfPTFCYEQJA/8nvxQxiVKf6MfmUIcamShG2hQY/WBSfVSsCqWlzSgG1298T +9LCapkujQ+FoXOPE08krDcMWFFgsJuXL8S0c7wnaak0Y+He3LpFTbzuTJJe7jmW8 +e40ezFZyJlbcXjxhS/vifdk4E36VL6oaaE4dwx4nabuI1nVAMt2eGni/QzqbWbgf +lahYnI2GzsF2x/gEEqp+QjORql/5wFZABGhZ7Xiwtj8sKP0Qaw43vXqnEvkpbIL7 +p74yHn4aW2jGMM1Sr68pUZGj8w9dOboARsHACsAnzsf5Sa+3ruegiu+KS1YidZDq +TNMxZ7tyB5x4A39KY7Enz69c9WHQMlEv5q4PJwEqkth1pCAOVFEFoGtlP6ZboqOZ +-----END RSA PRIVATE KEY----- diff --git a/ssh-bastion/bastion_rsa.pub b/ssh-bastion/bastion_rsa.pub new file mode 100644 index 0000000..3bab203 --- /dev/null +++ b/ssh-bastion/bastion_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8ED3jLmtB0o4NCqT4XirE2lGNt4M+WKd5PjIZj1/dgb4Be+IntdrWPAfkbgUoZaAGxp9Apj3asZJKVjFXqHIthu2AUoRGpBI75CQJ/8qXGtkazEhyE9kccIRKsTrngPBw7/uB7o6qXUWVkCjIJ6+QBOF5oTn5LB/FgB4FTxgezyVoRsakuFsuGRpTfndJE/YxK05/w+2Q21znfccORblLPASNnJ6H0vsX5glbF5RqhCLHHlIRLNMGNiUoleVojG60Z5m65fiDJvMSdexGcCZuk9eKxQ0sVwLmEabSZ3muW9SmuyJM1DjKD2/l2Ia+2RKrez1JLJFVmZ6GAsfvAzGX vagrant@outer diff --git a/ssh-bastion/remote_rsa b/ssh-bastion/remote_rsa new file mode 100644 index 0000000..19162f1 --- /dev/null +++ b/ssh-bastion/remote_rsa @@ -0,0 +1,30 @@ +-----BEGIN RSA PRIVATE KEY----- +Proc-Type: 4,ENCRYPTED +DEK-Info: AES-128-CBC,059D08D45581C2138081DD04CAED14E2 + +jTTPJzsuMpgS9AjsQ3ebLT17PfB23pzzYE2rSuCdIbz+Zp/tG8dpUlH1CNzPw32F +7A7PrGGE9neGCHAdQa18G+hW7hB5nwjfxnDOY5V+/IwMj+FTmyU5GH+KHT2ffTvp +Cdb4xnsRDSPPsfJsaON78TrSbmmoVjwuRo/8ERt8HK7GixlE9/Ht65NrQFe3CfUc +mSpLDhnjuRA54sLaCIaUJl0iKbUAGB0qPV8+W2RXGkz/x/CBSRrP7GB5FrZDWUlI +Mu6RhYyt74VHX7hPlUExIxKuKqjKXwx4X8gV7cn5qLZuULg8EyPGTgfCziOfNjZF +OdLAMRfYhwyjmhvEVqQsE8dmZTB7/w9wEcN8NIKLG6ECSKsOJ1a/UvnqUMFAIIx6 +cB655+Y57E93LQXZ6JpqOjf48Rf/FWngnODERkkJ/N7tXPNeoahFvLEH+PosMOvy +hpqSBAZWEStXcInqkzXZr4Amk/voXZwCLKiJlpyvGlSkgG6jxrdGKdGZ5JOJ5Ezj +mXgNnOTZuym5lXx97bdJAoVNXSQ6xMgb9iWJQOJ+wRUPKZgQALChEDtU8ije8KlV +OUxBfL+t3zPnOQ7FfrN0xglswS3Bo/jdnch3fagGL7WimTtpR5OiYNo3/kXmfF1K +RpMG3VbAS6poDHiezEqqObFZCxFMzVRm5tiNOQb5YoLldFmM7XIegd7dAJ5HFF1b +vgpPSmUMRQoeyT2a+K0sdzzhphXZOzyfemRJG/EDV/ohrWqPhMCDfJ9NEWeCaej0 +M0WO02DXvnA6SVeATrMD1YMO0UYK+fP9YLrLafnqFVmH32LIoCLLDTkLc1weD+Fq +dSbSMtoBsW/CwCuAqseim9UMBZS6iNUmTnnaqQBbHitIU6ujQh5ECWUC5TfznqTd +2WVzFFtYYcB5YlMG7ZEfoCvezgjXr15Qfh5lg7D2YlOER59p8Q0jPFUMw06ARStQ +GxozCmHHlFxIIxPWdfZHpfkCcr77l+s1Rqm3WW5h0zSv7Rjdd4ptvp6J3hKoHJnM +jRnGiyj6BpkNQryMui/I7ZncgpA0yD2HVL3g05ZcbF9nM++zr0K9AaSwUGt5cvrV +5OS9CgvGl9Tlxs6KT80rMayRN4pWaEOVCKHp//QRl0W1OsUxlvOAWW57tLh08wQb +TKb4ZjCiJntyT6rFAVC6L1cvIJIsxLiOt1TQINycRsHpY3QSDvNYPjdbRDQI8tls +bkjtBKnQjAUs4JXPIfxdXdCxLBfKUc0DrtSLIAe4opD0QU8pIqW7aPRurE9FY61X +oeKPXiJk735oR/ije7XY8WxNj3a/a5nCR62FqfCuTHRNizDR5MPONS0K7kaHx2i+ +5ZIapO+3DbKDN+Jrer5/IK9KJLxPA70soabHkj2ecnLNncSPZUZqnc7IuxJuw/Th +QUrmnfJnMkMzGhnOO6aaU9+Hd3wKkiiNAzjFFEgaWkh3BrteePxvURYKlNHOPlzt +1i/BC3f1LaPDig2avp4JmWBV6OqWor2cEdTWF+azfOYH1g4u14U0E176G+G1SIRm +pC3NK3V526S6isGnyng3kuzhLF7x/y/NKiaW4Gpk6m1rIrkyHPCNM7xRxGmR5SJp +-----END RSA PRIVATE KEY----- diff --git a/ssh-bastion/remote_rsa.pub b/ssh-bastion/remote_rsa.pub new file mode 100644 index 0000000..cdc308e --- /dev/null +++ b/ssh-bastion/remote_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCp0CZCDAEBX1QPzo3dV2IkSWaAgDuqLBjQc4r8TDFN8epTXauo8IzDJ4L7UuRDdw64X54wSqwK+Z+WzvITHujWtIvznXUTf4M67odDbvWt5T8gT/7bi9+Y2DMFsKQI2CjrQ+lEeiGAZYt/XGGQW9nIhKpSO6m8Vw4JUTfFxrZFkbQ6RyU4kvwOyHlbNYktmfxXTrWp3NHyfWRQC3ywSX19QvVFMeRIu9mmzZWtDaj2k44uwUkBlFjb6ijXzBuQNBtjWlDfwge1XVPfTVVyXSqDZJerHqDfFhqwPB8ZHRvg4YcnOz1ryjpkESJGl3BM3ZFBZHsrjfHhkG2kypn5Xefr vagrant@outer diff --git a/ssh-bastion/servers.yml b/ssh-bastion/servers.yml new file mode 100644 index 0000000..9f72e63 --- /dev/null +++ b/ssh-bastion/servers.yml @@ -0,0 +1,20 @@ +--- +- name: outer + box: slowe/ubuntu-trusty-x64 + ram: 512 + vcpu: 1 +- name: bastion + box: slowe/ubuntu-trusty-x64 + ram: 512 + vcpu: 1 + ip_addr: 10.100.60.1 +- name: remote1 + box: slowe/ubuntu-trusty-x64 + ram: 512 + vcpu: 1 + ip_addr: 10.100.60.2 +- name: remote2 + box: slowe/ubuntu-trusty-x64 + ram: 512 + vcpu: 1 + ip_addr: 10.100.60.3 diff --git a/ssh-bastion/ssh-bastion-diagram.png b/ssh-bastion/ssh-bastion-diagram.png new file mode 100644 index 0000000000000000000000000000000000000000..364ed5998e110999dd843bdad0bbe440f3db3a59 GIT binary patch literal 23359 zcmeFZbyQYc+dc{i3JB65lG5GXNOyO)NH<6$jnbV;iZn=fNrSX>gLHRz=Cfb-cAqoe z@2~S4XN)t(=Xk8ede)kG$8}%V3{#YsKt_Cl2n7X&EF~$b3?m(+5Cf_jPp`3((~n*JQzFlni(>8vRy%VT0^!(e1;XKcpc zZetJbhJxaA=K=q;F>^K|cDJ#%b>ea7C;96R9`J9-WkwR>zix51;wRCRQzRC#b2KAn zXJBJsA`w6&CMM={G&Sc@78U>fb?`ralGo18_B@P?Zf0Jml}^h?+T>I9l2}TiV$YL!N77Z0F+4PeKBD(LcZb(@tkg z^FMF0b^6^c&_PDXPZ*gQm>Bf9_X& zZRczUM#0h2M9S9L%n^Lq*$C1)0hZt2{-5voe?CjW(b5d``mb*@|Ni#Bul>HCj}g-G ze+|TcM)|L+V3-9E`56D1G6BT$HI@Y^C?O~*QDIeg==}_YCN-7Yo}}>aWapGDs$|M6 zsxR0=`{TnE$xdEK$SMwzeKip3Z1Va{V==_!>*>@T$w1}%+rYM7nF6cR1d^Utj~xI3}lB-EMY zjrS2}J6P6=xpk}#EO2E)=4|??Kwnd}Vn}3>$ zb`1SYwXuL4?pB^J16q~lm+n+=}o2Qjkd zO79oLclKZ3B`JSy^_;feIb38<$%2tNKC40?zTs|}zkD=l4a-nJQ zwXm#FBVCV_5g`*H_kU_4)XV+dYzhn?9j4Op!4$QI6woWji{A5#DfX*#frdZrQOFx7 z{%H7)%`k|xC;+)*^qIc&r-uW*szNXhrap*t-Qy#!aT9;`#xemkbtV`c*nh1KK?JZm z{_99>mbD>r9F^{4f|-a5k}y2KJo+jY9{ahq0A6|q5saqA%2lEB3s_9+=*PwOrfTKF zT(j*m)Duh1RveIV7*y~dzyEZf;+C?VcpUdWcNh_x|9xcuJ8ib{o+C9i0xMx*5oS;{~22ztGZ8oiqGjD7>_&t5>IVgf?|CteWn zXH@>r+*s?$xbZ&R@8wK4nZ%||kAuo-lpb5GCL zJ0VwvdtJ;}#CXqwecI~{GkO`|Tz1uoBFI*JaXx3)nx`|-c&E(A`ookeU9Z8JIRcx$ z->~G1G^{9bG3;aH7p4dGTbZHmYF|{DDYLvPsWnPCc>~#Lre!-QXJL`!*fBX0u`LE&M9eKJ?SA zEIK4DmRPz>-`dkkvjN!x`3%|WHlo`*KWe5bOfL!3*ZK5)OTM|=m#lXTIqhrexQ z`P#lNjdmN9|A2Ryso@ z7T?rZ&lvBzZ)La@Z{$kFQEc{6X1$M}3@< zdUL)zB!;7B3I-abYQc4G#>aQRdU|sJ{Pej>qpMBT{l(ne+PfzxH7M{0IA`}!0yn*~ zX&ghgzTmaNf)^(3_S-8VL>xnDoSay+>TDtSj-mArH@l?wS$y+4!AQ8qnLam`BEKjN zs?3K@kXITT&ZuEX3~m9?@0KwxI9X)+lQ_38y#65l8MM@=jmb z7x2DGUT|Alc;;4h4|=ZHl`ogZk@9eVoA&4#SDR|7?hL-mgi`P)7v&~TfBxi4yPb)` z&7)2fPTu{mah6Lh%^qN0=U-M$>wDtT<;79RRbFQI`r|Kwl|0=hlf+Ps5|Kcwk-A&j zIE?h1sjcZ|r|9C-`C63VY*t%17VRDi-IeEZPiV*00Ap+N{pHdUzW3Sa1(Tp{?T0dr z&S2#IhYFLP*-uw^wsq|fp)-9t&s+@2>-Q=LidSVU6w#s4sJNi@AA3A!-t)fQuT4Y5 zqIpiJI0EK8cg$&ofBGY)zI{8~W{dSp9nA%C>Reyut0z_Ln<11GQxu8zWm8vZGze zMX6q6>a>CH0?o%^&fN&c7AB;$<7He9>*RZ*Vx3xs6U6{LL|VkHyX(^u$ND#uG`El6 zjqUh|-hKYOTRp8G@$nmar-<44&g4bAT8*`qRl-ZAPqqsUF<$jG!r!}VmweK!k`k(> z-{mw$-4hs4+g>p?9lctIi^k#8f86@(!SlAQqoe)Y$mThhyli3&jr6L{|u$8zP#^7fU1#J2NxB=14_6f$A@69VVx z=2}B6qq-9H5^avTcxshFT#IxgqWqSY&@Zix*q3YL1rNhN$w*;yB%(O(Z_cay;`pt$ z=lHC^%-Wa_r&|s%tx5`RF#Z_vcy@{;p+#nx`~&#_jw+4pAi`$$E3?&fDLawxT?I1L z`xYGgtj}6i`2<6TrrqTFrqq`w1B{J&7Z__8mxxH(z1uoBo`o0j&eB?Zr`kzRFsG0T zoX3`v+i-cdG>y;&r+^iigs_IusW9HJlL;q5!! za-O9}KDaJ=Y^7W-`7SklH>|kYF32L0req9(MOc|X%$APgT7@sVIyROTG&eQr3PnT9 zW1TTOdet9_(COM9h;P;(&&=3zWo+v9?lCg>9BxtM9!R-?V<~|6EFl&Zg>UGu_)w4ZikCgL(d*57oQz89?m|%NRY-=z1$imO+1Ecvj=D}-kh z@%net3l5PhzX)irUpqv)5CBh@LLo#%r`Pbcgd@Yk<|{iIdF;xG;mzDz3%8X390ft* zM?Kpkqn6hv8?Mt8J%o7Py*|HgcFRhZEC%0kw^Vh}W^N25)%riG*jzLvvJ*K*$Bq_7 zcuM0d67r0l|Lxfinq9D}p3j7IR>lHrZ4Q6Lf}7!UweqC#sevqA`jy^F+WBUhT`Dlf zBidpW@~}ia-nSR*cPlF2;Nhex6IJ^gL-fx)=G_Wp9f`tx$}2_)+^)}op^fJ8UuIGD>MbVsH8P%l7FhBTQdB4}EAH`x~M+AR0o#%b~0M;`% z2Wn`j`rTLDa0_VofVa90C;ha@?ZUawMlLbi!@38@Z|kdK4N%3q9yPui}Lg%RMH0a7c zm#^|kuj@f|ZtHwMis;pot}LwxlZee3uaITY4u8j;BO%n==^eNo8>-z?5br56lF45( zhMVq4&kL(s1RswNGxK(eh4(SG42=bqk)hJANmHjU3f4{ zqKl?;W3V#wRkrikR=wadwn!T^3Sqn&T?$zMOqe{S zU$n_+*k{dng##kKrsw%(2CXgL4jTd=!KRMJ{i}boeeei~o1a1m-yBjtFG}{D#?7w_ z(7X)bJ!~46@9yGTY$|`)HTYGj(u8KH8LQIZ*1~6SIiDs^ef7xjGxFBj$6u01Tz2%D zg6{BnY2_cY(^+s`q-6PCvuDH#(jShW(Hwt9cW#q>1T7%1g|ylI_V{!}Q0HmB3T*4$ zi45;);B6#%T+4v&$0j~(GUg17&eNtJJWr*Bca96+-!v+em|63Ql=3ZAofn%q!!F6s zyNpTIO}`w^^gKwBXD&N=@NSirDv+gCS>AEdKSt6m;$W2(LdiyYH00<~|IytXH|C3i zkkCCpbUG@bvM-8Jjyst$Pk2G_EdLwLFq%I>vH%81cAR#lT>q7Ug@Oz$>V-@;Bv$zds#7~mlg-!0;kTNi*Hpn#ukT z;VuV>I=0LpbS|g$t8>boz0~s|67UcX6k%d^;J50vps8S^!Z1W365vx&`$CA;iwKQb ztdt`@;|W7a)pr>z{OYC{Y9^#zt0yK zr&K++g-OHu^$)PS2>le;-)>J62dySP#|+J8i#=^rMi|iGKWcjvOkNRAT9GPMgMm$| z{@TbxLES_N-M<{wkn8@qhlq0^iLsW%sN2+xDKUk#VoYIwwt8Q?M^m7juhL%Ri}#ZH z>ak$r`hc@>e9-MW`?RhJW!H%F{TBsT7Gb|FtQ^APIQg;W6{0Wo-$R-!+_TA6(>$iM zEM~BmKfn`3gM8rEIEjZ2ooCP6ou-+%UJ1mT=;Mq@5ls@-+5WbQ4zk1^(`)|3nGS7- zaXHTJbKX3s^Pi)njy$D7D}wV+o|~^d7a(A$m?y%{2HDPR1GZ|h<|rEo(Tsz)Rt77L z$l@()vDv0WCozi3W8njXpr&NSNi~O__{!bYYU0xIRPYhB+HAFEyjhAWE%>;k)d%ke zrB1*LhGoAptqK0gcvl!kN!rLW-aSJNev^rpKb98V*N{7(G7dOZ25w1FW|(@96~1HN zFlwifZo-ekW&Nf;RN2_{yfF|ic@%#>Q1eM9`Ay69CZ5}m(nm{89!^zn&)Wp!+kSf3zDVny=y>ynL*mIm-RKBJ9AbTufqnskPPR(1cx7oC}u+ zh2nS7)6gTBnh&!cm*bF9U=v$UH9yBDM zR|PI+i$#$1)KSn0QDq^8G+!=y=G)BG#8{DrA{K4?2H-}7~#Gp4zJUMF8HYJrP0RTLSwC( z;&tYmB}zLA^j$jAPO!UdM?TnHfeah3F!dG%MM|H`W19d({3~MD;k2dY9`?T6o5?1! zdD01kAa5P)jUlyJ%3q3&RAsakwT^>F%Jq#)WYBv<^r{ZkL2!jo$oCt{ z6!q?KMkvpb2@$Vr@wxBectMm_xuJha$S6s2>(y$+MdL%5&=2?{-SwG+&SwA76p%q` zC-EE01$ckJ*>K&ToiS-5bNtn|+|9ah?W6!wuSLq|30zj)S`-bC+yK1C!IHES_O!+7sX6 zq;R-*A#m;D?Oor!id}yA{<^<3tSPBc^70^Fj$nCv_S&<_^YTF5QWRl>o1`KNH8gR5GR*O+wVoNchA!obsO!gKk@bn>+6>`>4d3jytr!s8XMf$uQ0=%**`zMMlT2iE%BGLN+QfkVtP; zf~!k(z^ci;;_9VgCRX<2J*#{<7px*7vaP zQ>=S~Pvc~anmNgKtj=U^2(jgp%GHgZceVw}Amx<4?*OZJlIC+A-iPPRBnPtirG!hj z<($|GB-1%1acnU8R<^5m%zVxEE3d2&mRE$<9%FPW+#P>k`PB31gSdEMF$m*^8hQvl zHOVF<^8NjIaG*r&v8r;voX2cSGu_HXObQC~mLaMyA| zG&!qSb_=c#2n!(*et+=dbBHHO%k8YSx1=ARx>ZlMHeO2KxB`i=7XbW&N4Qd?gJi+Us1CcAql?yhp> zU_38o3SDs<;{UMXap3Zk<~a60>xk3NqGIja(4(hM)_-ZJ?Ma}mq- z6*ixEq%sMV%kCn|MV}w-*>&jSwb5hVlGsU2Ja(=KN7-VI-Y=dK=b%!V4O{d}`AuSM zL@9l6z7cS`GA9{je8*yBB-(D;fRn8rrrd4pf0!s^8&1`tlKJzjP^Dm22>PzLPsYHI zjC?Ahq9{Zm-cJ8>VThqvQn{vMtG^6SA=M$=&f)gg_b0FXEckQa_*fmhpMtI{MXdCT zWEHf+Nxa(bX>vD4&J)C7`#|_^$*tArevcn!4L5NqmEGzapP16cN-_+lV*zlOO0!(R zTj$V6o{9#umC)bj01C^ue~!d(}YgsQd?hBSftGZL-q zm&b~$PsBgM_L~$Ny<6r!MmDQ^MhicBe8*HEn__&>e5rp+fjOA=dXBmTX`dN|#1VBr ze1kn^TR-#5>T5W#{440zFJ=EU(F~92QmMu&L{RelWHL(vN&*ZPtvsS3Y zDXx&KqJUu@!Nk%}wQq0Ncv=LTLnWH&r0|ltII@-U>b#>ZGOk!HMn!krh8_dw$nOkc4^-lDgvV2&^?;h_WYMuehWLPD7G<>wR&p3~D4I#Cp1Mnk-N=!HN}sP^xo zmAqyN7Cgt)b#M+#E1qCXMW;2tn_SBU!Ik8}_pe;Gm8YMokY&ehKM{DiGTCj4a*4y^ z|Ipj{bmK!HcUo|+Q3cx(fr@~Wkx|~dfBQRP41^-_-KmoOM`54nisSj-2l!YX55K$P zb9NsP5zg&gIc<+(yLpLO_Uz(RXe(s6Gt~o1s*b>r8u2E4_R$R`Ot++;!1J?C^NS~o zS1AMmX$*)2oZ11W$>-1#Udms*1yz#1b-u&Vy1`~FJd-=1=3~1unI$kn;D$;6*uR))58Jf*u&yCq;O z?0Re8>O@*UFA}QPt`}kg0^?dKScY#EO;!)I-wv{8g3cqw?N8Sn)YpYycGGmbk5|OE|dr>Q70II)y$z|XCUhNuB8J7;aL4^YAX5s89vU| zR_hBlLOR&|JBn)@nj)qeX) zG|O1cl>DB4&Oqe!XgiTjB*OB|^Nk!Z>%j27+65_iY$L7fm63?iw# zJq+U4{?vxgPexq(Cm$HPS?5~uO%m9QSUXuUqBvkX`Oh(wJ7u zI49CNv$`(RJkP7;Pd_zZI8zr42CCBCd~LeYC8I8X*-@lCW9%0^rVEjLh$j!W0?4nO zg{bW6;MaHFQR&9BQpzb&XQsqyvIm6;m0q|}XByokNF|n|N=h7`z4^>f=SLp$4>$nO zzZ-xLNJYy56#BIACtTzKj3MKfN2OE!#?0s8+TzyxbaTkH{n3<}-9kgP*4NiD3nP_v zl$q|?mZRB0_jdrXHAXk(=B|Clf~!eU3(70`9;chGtIoqA*{<7pNvRZasXxx6Kwa;= zWG7rLQZ~uJr=EVgSc~-(V4JpT3^UIXN1HZNt*mDN{*fAtj5jMd<>$MZVqxvD<6>3U zc#|x93li)K11;^SNg2)azg+8XsV_+NFMcrh;G0}5`TFWmo)TrcOli5M%tBIjwLAp~ z8bhTHO1u$Rt?~>o(FJ`UKiWaVp*YGS`2^P(y25JQ+xRK9v6c< zgtpV7*s;oDgySg=0~@G=u&;glz}o!w91&Z}GA$uBIxcYac9{3@N9z+JukX6fqhhX> zbEa4s-WN0KpS(5_H1=H1L9h*rH4uhDIm-jGt2fDko{LQ$u3;t)^#f zF3Y^GPaebVfdtQ`5ot=U--O&76hDS0H4JRZ;SWHh65JR0>uL?95%I;qDV$1^BS`qZ zaGy`8$Q3H*6(^vNb$&MskpS)fKM>89f; zBU=NA_3;OM zJarB0ZWlm<$y3`P)zPb`3<)!J4koOYV`NTOD}zWO96 zdP-DgmsbW7gwqv*z&78cC(>1t$Z8EkfzK#GRRd~i_%-=7!5YSf)6LnoD^8*!rd^UE zS49VdPR$^`eH*lG?fts;^S5r>U^3Yh1n<9UHNUOC2ART8oPvNQhwc1pND7`LmIbMc zD_Vo;!p3`>p$Vogwe5N<%Z@%qld*!(c%cgiy;U~2(BSPhxzpu>+m;Gc&aVAZ#nnoY z#|ZyrGU(jY9w=$K-hv`1JEY!}!fX;OoMH{29)J{om@x_=upV{a(4;vA6*ZSh9kWvF znaY?$>$8J}xrxt8ozA;cLwhZ^2iK9GP!Ah+ORq2BT0bVMm+3DYbX+=36>G(GUb)9o zDF`V!zX17o_0P&yvw_5mo8`@TRk|wOB2bI~^=wXPYUbtFYdTf|uaJJL}RRYzQ z_~f#vVji`0h_+p{HK@VS?_S4#V#`sB3-uD+15Btwy=w0&Zc?jT;?t3F3H z2!VJ7^3DKyP*r)?tX@f=-($QNFHiH5xDX^jH3FrheT|a{Uqv8jYNf0Y_6Xf0^>fhD zLJY$zPf(!Re7HU2MA8tv`I%F56o`OPyc$?WvHim&id{qBBd<`Ww$uY4mBk}@{HW)L zpbEo8nQk9YO~yj^0OoT}2#=&gi3Imsk940sw?|>br)|v*MM+2?Sdw$46^YM1_AD>U z^Prw%86kqkClgkH!1wN$<0g}sI$jSwoOtxs_J%ZGg)U7~ZXll8WJD@cbo2zNs59{O z`EFV3;__{{FYO>YdGJqwp%|uh_YHh+{?C}R``e8187=akma#=pHNxLTL1E+4sY?5x zw!PBOy(cKruXo&Fd5j2G^(qMQdZ!b;pZj@mRFZLmh({MAmKpPcs2@hm9o2A<9Mzbn zEm%UgxoR0cH{0qj7fqu0kw%X|DYVgYuEu7}F{m%P=sv?ICgQSUb?-3fI-}5<3;vFO zH8xhh@Y99;*OXjfKjBe(bH}8rN2Mum%N;3{dDaq4+*^pHDbJbtRV#a4PV!=DG)mKB z$D|C=g>^wL1(*c%yV4dkC$v$(qx6wQ14fAuX@muoI0a|L(Xz!idwnBxm*tV_txQh} zZ?07h@s@1q`Zv(jG(KY9gjz!3sqVHJj2gF%beZ+%ypxlr!9wzyd^sA#?X?ltSN5rH zXqmE+^92e-onC(UCc`b7VfAMLMLE$=4Cu23!_vu>6T2`eCPdN7^fq?GtNxe15~HIBrO5Gh;UAg#T8 zB#f)Te~uYa%=luoazY0%J$MIu*l3FbPk?=z;RB&5WQP;O2%v|azgI9zVAiDwP>FHa zujtP^dCwSX8@&^5El?vxk|M%6L1+bsjyVXD>=D@vp2^Y|uf9?}y8@s-D;|e66W0;z zB%<_d=kRKteh9ncTO@(iBLsM3LwzCi(a*4tn?UJr6WG|=qVyk+e1Dnv2-C%-XKgFP z3lUeW!eeMuy@HRaf~CxjyE?8~Cy-fS4%|{_UEz~0bez_6BQLQ%`#CygXVo467fhv* z?K?88v(hD2))D*`;fG+aN>{gq5W`=_ zWHfafRj6e2lV zFF8z$wva9!(hIiUVb-0NT@_$*Is7$8u1t&GD`AYh5f^wztCzAc?>s+99zGEmfcn$oOY@5YX_=8uPLeIlO&&Pf`HA=do^*#o@bkA%T?u^kf zqjUGkJhTmGt`$`0Hhvk)zxMPCUO5RKgL8b(O<2qqvfQ(+N7RpLkOXtA7vJudxGwTx z(r|LKsPofB0hU6<6)y$GsFqyHljy*c2Cr*J-t^Yjqa=+y@ckqY2_R4kQ|-Zjo22U) zcD`ZiZAuq%rx;se{_2dn6o#s3n2}A{a#1`ROD>=&rLA4df;wt4>7`S?O1pBz39f2+ zMSw8@1@qEN6t--4>a}b~rJWosGaaE{qHQWLnnHDgV4adW!d1}W$`-6AHjP5;DyJbP+XB{%ao_%2%XcllHE6G8|0l&kG1ZC3DrC`5x+B8!lmrki9H?jd z@u^AyY3hu1!+0sW5Hc7~NQ}7EC$f@DsPSx9^73H829|sD=*rhvih#+` zkA6TfcvvYvtXu+(;s$>sx|V7<#D!g}qaolIwHXMqEa}sP#n|*c0zRjobLkWA<3KMV zbXA&`GirsaF{EKfo1Xlv118@QhHnj{gazAfvebP8{jU|M$gmi0-B=A}2+VIY8rlez#uP;i>ycKtFo&nbeez1slvIhCU7VHyK)Q z+)E5Mg_X>X-@e7`xtgEvv}?GXI8<&nlxj zT+Pjx-|Ih8Uq-EQ%e%iT-tJ|Srs;UQxMZRihc|>2dD7jF)6A$|ubO$BGKHMIfp~hE zp4`KVZOAalPi#z};6~&EmmuGN`baMStJp|^6!#8w=$Mq&-Qet3%eWX~qC5V$z7cLI z3`%)6K(2dO!nw!s$EWZke{_j)gX?s|@~SNqCWkaEpEg2cSW8IL^#l?DZlya#5^UHD z2fUAb4+>I`8I&c?eo8hua?isyu%S^o!oca7(f!?~aC}X)jPJA&7HG_)mX)H!8uY|k z9cp`%{V*pA7`-qjC=sf)j@2MtPuXDeLPVOs@0|;Lc%%SCJAwH zWV|-H+8{!AO!MPZ+OJ#> z>Mu&uijB?XpDG;brU!Jjs!PfkQ)gJNC~p!&pI;IqGuBKlHNU3#6%@a^?TfdA_$N_r zdkUdlzotL{)R(_$><^Ht{C~YIe;ze9EGeOhKkJZWnG%qt|GS#t4okEB@nUrbgd|^i1Yi6>m{}vKgnoXBDNL=i0u%>y_<{-Y z@B9Lg$NaD&ixD~CC3xMbgKiq#hVlVLJ?@&i98*DXPEHvD;Qao$fvofGv?)5sI{$)@ zz@K+ypi%#w#NG-+3)BHMDu5&}hfU}|xzst1O)Z`MkV!&iMvD&`9<)|4W{Ij;F8rdr zBSx+L@yhEbjCqP+6U;y;>MVkAiT{K8Ko;g-jmiRz`tKuks$mFG2e?8=@_iko2{A zDho7Q)qIB^w4)?9$;TY|{xt;_@c$rboxd?@`H+FH)FBJMt%P58dU%HKwXrgl>UVd4TyBevN8HiUbsCqtGap_f73{`Pev{F z@iUOV(7jnDzw&}?;bWDHnd5_gGW#h6AWiuTtJH@Gl+3E6UjKRSQ54vXzh-68|79YQ zAa-lU8vP$*N=yg)TkDZr!)4cep1A#^BBxNTDA5wYV7TmW;%5N+X7>C_6)2JvN;c|& zc|0nG#?oE?M`sg6)+gW(*i|V2sG%&uXa@R(%}~-vCcuv@!R2<$<$kzY8-g&L-k$Fy zsPng&O~IbDR44bG&;XnGO~pRuk4=mvONR|cA+jw=hh*-y59ff>pA0B#^N@gS4ATtSc>f}BH0UEEj8?~udw?Ai0p zhf-4jDAi5l%Km18>F(1qNc!#a6|w}(0XWF1xij+sqzNQAUjgts-sNZ-Nq*ATc%t^rFn0t@MIV_vbHHt0bU^88s zQ4e$$g8&M)v~9h2g@{d3YHa3GEiyg6LAYJcKfkxro^aL)x-}CG4 z$5@T+)y&y$u0}9M>SBi*fr10Fy4t1Z>4wauX4U0*o`dZ8-p5gFk+quWJgE#Z3|JGin`F-S>IRK9OHZuBR(e#u#Os98|t>bV5y z?9Wbf2%CNhu<08onO(i^&!?vjoj~_C0mp_N(ALVf=W5GbP(l-#&EW_SK`P*|CguFw zv`~e?!k;)4>ef33w|)`{NhRceTelDcNb&Q`l^F+*6FuqDMiG{j(fwsB&_!;^f=5im z3f7*4kM))F^zYJo2rJNQe+^Yr8{QvR^c-d{WRUzFLrFh_ri+J2oIX%2nI-AHza?cM z5W^%I382`y2WT-ev{bvOp%UP+ktB{RGuPm;y*8w;q{@^h6i{Lc>+jL#HSU5JQJiS< zIF)`shJZ(%sR$7X{ReY9N^FDh^zs3;95Rb=WAv8vjwywvP(FhPu7x50O^2~m^w{lT zt6d8avEa?f$KL|7o^>E^f{6n;iw~&wY=UxHMJGfW){v2kAgJWUb8V{G49WzXfT7O@ z$|Pwo`@Mk-2(49h3nhHMJ~h{U^UXl;Q3IwmYKOQKU2H%E`swH>EJ)rk+D1RU$KYBC z#MtW>mi?q!qRlQ6&z-0k-`J6RvN4dx?X;;0cM7U5)o4e*9xhvLzTUL?KO$9QokUmR zLt73EkcM!H_ElvE>BFtsS|83Coj{E)4FY|Ncdn&{d&xe+y2m+_`H)T~!GXyaO^UqT zX|}#|Mk7$p82a8L{M`Wx9CQIoBBWZ1xuc7ezS`iGB2TS_BVySZ;s}Hs3W@9`YgeYL zbM-*km8TZ@(${nr2&%?uwp2D-A5|*9HK(fUEl5l#{wMlIKq!Y%;y@Rc-loau^%t~Y zpv~B>oKo~`=!!S^6CjIz6oSNg@M(zu_K3MMp!f=IY;6PTOhrTIZZ*Yrv2HPeC&NHc z{OH4H8B~8dh&U4N^A{Ele_iL^DDOP(Do%2Vn^8H;;z?>*xT2*v3olohwu3qYfPZ z{dH=rnIV9j9`w(T@1C)Q5V$6{C**(%td5+``O>e4={+E#G|%$B zsBrR_0(GH@GJ~bk=j*SHK3Lpj=>VcVO$I@VmWg(nCCoc=irw5e zMZyuFyDT!T^fCi{<{=2Z@v<54KsQ0TrRJK@`%DR`!&ke1A7>CZR-0^R}|5 zSbH8drF{D9l5ikDYb7veFlcGA1Y`pOafxdYZgS@0VeK7=WU3(DF??afo?jXd@y*xU z9^Z#kB38$BNga+W#z`aV;M)wMH$YZub2JVS6THhJ^u2QcwR-%&6n>RbuckO`W|KjM zSW|FRCahv2AfIdyt zk_++IK5mfWn|d}Bqkhv5NNA#ME_l1gI$mw1QS@efT>Mg!2C{^G%pG6z8vrd7L7;^rDfHl31k_hj5%NIsTp|4;{DsI228C>SIDY5& z@Ege#P%|IK2P}e%DEOnGr#RY0ls-9B-V6jl{py-Zak=1)jx6Z=;C0D`}Shr3L;{;?I{*67rzq@Atad5mH_6;*Ba0W%X3#iDL(VbG$43qvdH3HAR*W` zp@MluFN(Inaf`G-;NO5wuaJ2Bd|w`_Fg0!#a~QTMirDK ztyWBVNGP%-UebSYez@M6lRAnCaykT|zB!2cIQlb|DT5~~W-Eufjzs4%Vgvy}y~vBl ztQtf|=A+qSu0LCWem3~9g*Nlr03rN~m^0y@1TB=rF9;)u^=AaP&z-v!aubjj7puj2 zuqt&3fHZ@bns1ykCRE=-J3C77;fHvl$wF5^xMRrb+qDmz;u-Xw2HXHKrb;g62=t{n zjeG`zUL<_3@0ri*lWD>e66+|uI1y5fvpp>;%xEaQRPi`%t)q-K%pw)$pLofgtejMD z+{NFP=~iQ3&ESXSJKGgJ{U*Lo-sPP&Nm8pQA(lC9F!=N3vEsW`&x@sx(hhi{Za+jTWs?`NoV&Ho z^2&x&LUYObc4_Yor*7j6?McZjqm6ShYk4RCMczX9}&BpBKi1PnE0}KLd!H zI7{~r#7*`A2xh>sALU;~5u!=$ewM)Mn#t>B>pD1o;f}a42758Fc9;UD1q3zQGBQ#S zBG}(SYC1^RNAMI^|CO*aLNL8CEkmgFF3rb32k+CI2@0E4*qy4 zB}yy{z7t%??x>3m0sYz#8BYEI{a(d}3MB)`6G_EN68q1adyN1p;Z*0~V);)@M}kTL zu60hl_-Bkk100h<$M9|E%k@&hAs$mCQX3#eQ5Nk-jRK2?j|EV-$7UGK=a*>kXXKZ+Ldez{I5R9@KRbDyT>D zc!C^$b0o_SqU{5G>P4^f%^hF}>t`z)7=F)quLFz(zC)lI0}9_!TW>-OIGJH{LPdcc zPt`TZtx0=kxc0w}4+3v`vLB%aV$K#;h(7`+TzvJQ4vEE+h2S(ey7vAa zfL|vI%G*OgUNi)}ZERxB@G}CQA721-#TuX}IK>%l9@?Bk4*}`) zHP8v`zS?Mo)~}=AhMdQJy3lkH8#n?d zi6lc3wC(YNITlShnOCu^TIkx`WYeD^Aff1vF;yLvi+Vq<7*Mk!hPGhi`U7s@^WY&V zDz_^K2qWw6Y+OM{i~HTHZW@gub$XQs=WWS0)N?}T@4}nF#4{am%A=0YR$JMq?KyRB z_Vp7$sD|C)ST(x9Sr>Z=dpNr2i0uD+BB}ggj}E(htH8k>f5qSeNt)z<+op@>;R86K z-*VB*=6{an$N`T%1pKWL*051$a0EUO$Dz;puil<4!m>N#tzLv-)7yPky$pFxb(6^gs)q4O zK_sN5XchSgh(Y#nm;u`fNB49p6#RHP#g3X>$2~|lHsTT0KKE}szk4x}(>`&!QvlJ% zmLcM``{go9C zhPu&Q>R8r4zw$SjD-?GeQ9s^v-2i2l>azb&%Pho`hVK9=j@Y~e!t4Yo zS|QLg52*J5_OM2k`?2vUfKY8*=%yk;Zpvr72tuti5Mx`b?Ln4lme)zxH8>yxz}@7n z5JKLKYO|rW639U}6PqS9NqnUluf_%Y9T}QEHltq- z=T1={8M~#oC*tT1!C3@2^&0iJ!r8a;Aodsnd<^5T1naCDPnK6anP^~!Sp$?3OvBrN zOx^?>@e}AZ`N`R3d#wAb-O?f;!gR7(j&*qf@HU1I!V>^TTd+b-efZ~yogQPG|ErlZ z4~KGZ<2X^uHc=|4Vhod^#a1eeeTXAQoRU-7o03q&gp3$6jckKt$!^G28Y)G$B4)@I zM`cTnkiCW^y!X>}z308I_uu!Q_uu(v=6RlZ?)!It?(g>t*ia=8L@T2uPX{>H{D7Dt zjUW%C$9Yh#^Bih|n4fU>fcj{V(tHyy0)$0Ge`o&QZ;jWnMWQ^e2R-d4bNXF4CDgyG5okFEe&wyzBMApP-V}A-5X{B||rDkAGxlz8pxsfr*v|9NINcyz0s9rYRth}k z>w8&}$}0&Oa@6?Due`#Xh-wnyN4}xmt2e5 zrvVY4@2|Y}RG3^U{>0k5 z2paz#+v=Q5XP^U=O>RC9Uo5bf{8Y1!cmWPtP_@`$`C4+K6D-i~5Jp3~)attou~AOw z+L^~U)>bJBXq=T6HT>$_uUF3jyva)QCmKa&!P{%`%^ReO1 zqIjpOsio-^0H2gjYBVzjRzIzoj(ZvUNwBsOC4U)7@?g-!{2XDo(kSjraM0w$?c@ya z&`nfW$ii))?waFoF#UqyaDUnwGU~V0`Ip*l*rIDKw97mA*>J?(762k7m;hZ$Ju1Sm z-yjP^{UsfBc>7r&Ca=Twn6?(SkS^!@)5aQi);U$k#K*8;0P4fnspvP_{`0Oy#qkWM ziY`m-{c*BfQ$Q%KprpL8_|Zzssa}u_ql)Q#ZYi^mdFZBj0?SqM*xSJz#!#bS%?L{^ zsdHQ-;r2CIvy&*QYOjjF62f*SxtEDDCQ`F!8+hSalyg7*J}!gD!sChU7dbM!3SP48 z7cqapoG?xmznLT`rRhwlM% z+bu-r)_=VsDso%oH%vuvmOxgv*h^gEP# zsMGL=WUFxLvO#`63qI9FHTg!r`-@l%Whgp^6cG(1nhx-LR@IAMo^W(vL~8~+tsobI~P+8uRB;tNJz9*H#S z$9oUyFR#0GHPsytySlp)C|cI6={2PRYP6%tk0UuU6*AW1=R7nbUalY(C}XGvN%ltU zR|>VI+dAHVr^F@I3l0+U4@xA2v3YPv??vY(-BEbQh{3Hg>rxL6`X{Mc(0QY^0;tHh zv>C;hJvw1DH_7f$E+0pBnr}L*LGz_=2jkMG5J`)XesH%>9SC39q;r)qo^`8~a3z|; zuiuedETT!1T`jO9JFnM#rUj8i4ad=Gy79+)TzTz6WvRG^0PK5ad{ zP&Q?<|3nG>Dq~*K_SNPf)rQJ8HCL-zG&SQ@@ov$Tu0iPspBqm8x*Ve^CwH-C$#_1m z={}!lS=nQ1{lZ!ulZYi!5WiReDZ+}%&i4bGV&yb5`B^CiZbV!&w=Y$6M&h89s4{!q$O;*?>)Oh6*KU=e ze43c>M$3jssuNd`Zo6#3CSwbQ7Vp8R_s&0X+^ed%bB$+<0cymwJn4^HIcjU^W;-Zcu$!;T`eY_(MZDZ_d?QK$d1m_=nNH1#FMPg*W&G;;7 zEF~{yXD%D<2}vw{F8pCI=L+jRDVs~UVP)F}lj>Aph37>17`tw!V%c$bRJvTK&iLCc zY1`KksT8&56ocnn9&b!X~I<5h(LTS z*AAD_7weGvii=Dt`vl$u@*pFYRQQ_<02pb32#OnBKfUb~MfqgOI}BQO)`Pj9pH~QS skEZ`Io%KII>fd6?|JzTnX|-zt#QVBJJ*F1xA=H}Bj9_W}z|fKQFB1Zz%>V!Z literal 0 HcmV?d00001