From c63e6ceedd96c6500f27de08af3b8bbcc0586725 Mon Sep 17 00:00:00 2001 From: Clems1236 <46500363+Clems1236@users.noreply.github.com> Date: Sun, 13 Oct 2024 10:51:18 +0200 Subject: [PATCH 1/7] Add files via upload --- src/content/posts/4wayhandshake.md | 140 +++++++++++++++++++++++++++ src/content/posts/key_derivation.png | Bin 0 -> 10717 bytes src/content/posts/schema.png | Bin 0 -> 91198 bytes 3 files changed, 140 insertions(+) create mode 100644 src/content/posts/4wayhandshake.md create mode 100644 src/content/posts/key_derivation.png create mode 100644 src/content/posts/schema.png diff --git a/src/content/posts/4wayhandshake.md b/src/content/posts/4wayhandshake.md new file mode 100644 index 0000000..20d7750 --- /dev/null +++ b/src/content/posts/4wayhandshake.md @@ -0,0 +1,140 @@ +--- +title: "4 Way Handshake - Wifi Authentication" +summary: "In this article, you will learn how authentitcation works for WPA/WPA2 network" +date: 2024-10-10T20:00:00+0200 +lastUpdate: 2024-10-10T20:00:00+0200 +tags: ["network", "wifi", "authentication"] +author: clementS +draft: false +--- + +# 4 Way Handshake + +## Abstract + +To connect to a WiFi network, the authentication depends on the WiFi protocol. The most common protocols currently in use are +1. **WEP** +2. **WPA Personal** +3. **WPA Entreprise** +4. **WPA2-Personal** +5. **WPA2-Enterprise** +6. **WPA3** + +(There are 2 different versions of WPA and WPA2 which work slightly differently in terms of authentication.) + +While WEP and WPA3 have their own authentication protocols, WPA and WPA2 (which are the most common) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. + + +The 4-Way Handshake requires a PMK (Pair Master Key), a secret shared by both side (client & server). This can be a password (network key) or a username + password as it's the case for Enterprise authentication. + +In this article, you will learn how this method works from a network-oriented approach. + +## Configuration + +We will consider a WPA-Personal/WPA2-Personal WiFi, so the PMK will just be the WiFi password encrypted. We will go into further explains soon. + +But remember that except getting PMK before authentication starts threw a WiFi password(secret shared by both sides), WPA2-Entreprise & WPA-Entreprise works the same way. +Indeed, they use 4 way handshake to secure communication. + +There is a device that knows the key (password) and wants to connect to a WPA/WPA2-PSK WiFi network. + +## 4 Way Handshake Initiation + +**The device sends an authentication request to the network.** +### This request is not included in the 4-Way Handshake. + +## 4 Way Handshake + +![schema](schema.png) + +### *"STA" stands for Station and "AP" stands for Access Point* +### This schema shows the different requests and what they contain. + +## First Request + +Firstly, the AP sends a nonce, which is a large random integer. + +When the station receives the packet, the station creates the PTK (Pairwise Transient Key) using the key derivation function (KDF). This key is created with: + +1. The PSK (Pre-Shared Key). +2. The ANonce received previously. +3. The SNonce. + +The SNonce is similar to the ANonce, a large random number generated on the station side. Each time the station tries to authenticate, the SNonce and ANonce are generated again. These numbers ensure that the PTK is temporary. +**The KDF algorithm returns the PTK. We don’t use the password or the PSK directly because we don’t want the explicit key to go through the network.** +**This is quite obvious; we don’t want others to easily intercept the password.** + +### Pre-Shared Key + +To get the PSK, the device only needs the SSID (network MAC address) and the password. +=> The process is really simple: +**Hash the password with the SSID as salt using the SHA-1 algorithm.** + +Now, we have the PSK (the AP also performs this operation). + +**The PSK is calculated before authentication starts (the station has all infos it needs to)** +**The PMK is exactly the same as PSK for both WPA-Personal and WPA2-Personal** + +**VERY IMPORTANT** + +*For WPA-Entreprise & WPA2-Entreprise, they use here the PMK created by RADIUS authentication* +## Second Request + +Let’s make a short recap. +At the beginning, we only know the **PSK=PMK**, which we derive from the **network password** and **SSID**. +*PMK derived from RADIUS authentication in case of WPA-Entreprise & WPA2-Entreprise* + +We received the AP's nonce from the first request, and the station generated the SNonce to create the **PTK** from the **ANonce**, **SNonce**, and **PSK**. + +Now we need to tell the AP that we know the password without explicitly sending the password. + +The station sends a packet containing the SNonce, allowing the AP to generate the same PTK. At the end of the packet, a MIC is added. +**Here’s the trick:** + +**We add a signature, which is called the MIC (Message Integrity Code).** + +The MIC is just a SHA-1 hash of the packet content with the PTK as salt. +When the AP receives the second request, it will generate its PTK (it has all the necessary information: SNonce, ANonce, PSK). However, at this moment, the AP does not know if the station has the correct password. + +The AP generates the MIC from its newly generated PTK and compares it with the provided MIC. +**If the MICs are identical => the PTKs are identical => the PSKs are identical => the passwords are identical.** + +## Third Request + +To tell the station that it has the correct password, the AP will not do so explicitly. +**The AP will use the same strategy -> MIC.** + +To optimize the request, the AP will send useful information: the GTK. The **GTK** (Group Temporal Key) is directly generated by the AP. +To check if the station has the correct password, the AP generates the MIC corresponding to the GTK (packet content) using the PTK. + +If both match, the station and AP are sure that the other has the correct password. + +## Last Request + +The station sends an acknowledgment packet to tell the AP that everything is OK. +**The encrypted communication can now begin.** + +## Encryption + +WPA2 uses **AES** while WPA uses **TKIP** to encrypt packet content. Even if both are encryption's methods, AES is more secure.This makes it impossible for a hacker to read a captured packet. + +The PTK contains several keys. +Several keys are derived from the PTK: + +1. **KCK** = PTK bits 0-127, the key confirmation key -> used for MIC (verifying message integrity). +2. **KEK** = PTK bits 128-255, the key encryption key -> used for encrypting the key data in the authentication packets. +3. **TEK** = PTK bits 256-383, the temporal encryption key for unicast traffic -> used for AES encryption. + +We simplify things by saying that we use the PTK for something, but in reality, we often use just a part of it. + +## Recap of Key Derivation + +![key_derivation](key_derivation.png) + +In WPA2-PSK & WPA-PSK, the PMK is the same as the PSK. + +## Conclusion + +Remember that even if we use WPA/WPA2, if a hacker catch all packets, he can brutforce PTK and get WiFi; Indeed, he has all infos he needs (2 nonces, bssid, protocols, ...) + +You learned how the 4 way handshake works. Now you can discover the way to get PMK for WPA(2)-Entreprise. diff --git a/src/content/posts/key_derivation.png b/src/content/posts/key_derivation.png new file mode 100644 index 0000000000000000000000000000000000000000..3cd13cdf1cda451464ac531c37cebc7bda46424c GIT binary patch literal 10717 zcmdUVXIN8Pw=T+7!~$CcQE5sS1Ox@7yQO!OCSBeK<5Sv%RUnD?~g+Vff46C2}>51^Tmcbe^}k0B<4gs74T?ovoEL4=2lK*ER@d~3SN~bX1g?cO06h614;kq+-Wb9p5>nraz;`F$m|8=13hP+cg^<=86 zv2IgLG*Ol$!`tta@6c4Y9-5a;^2-~VSEs9A3hM2Bm7_9GG0a`*eWh|Ki0}%kNeRov zs}Fer>g3z32Oa|cf2IuloCO0vS8>2kJKx{NW{>@CjLbCT*BF!)c>MQRG-@C4`0ug3 z<$jI*60tY-H?bDdvJKPwYrO}AFM)CDL931Pu*RTySW8PwvE%(OF@*7IH-1s3Tx<96 z@TnDCGsX{xnsB_^Ax7Ay^qKz_iG$7u1~5$-jrqsT`$?2uw_RBF{1DUyxEJ>0(m}UO}-?~tOt6Q_t9A}0a&ISS&-k`8I5!# z@92E1SV;^ju$YcH1WbLy#a1O}j`QFZYvU0Hm)@K>c1&~#=9iG4zG+#=f98rvcR#8w zSWQ9j6uIbI?KQzu{FfOpd}qrm=8{a@iRLJYEW+l8Dk=W^Gd|uh{ z9Aifr#_l`Q;SouJTpSE0yspIXzcSG9O$!<`}kr1Q8B*Jou$5gwDX4Mra;=P>LY|?w+`+L#}B@U*S6Pvx@#@UEc z-2)i!chp(c%NNBuE?o!jT4isnLv=fm84=YaM9;U7(||klix~`_JD&Vn$DhmHn*PCo z`#z<4Jl8!(eDT3Pi3vXgMn5jBq=(Pci8etXX1jjPQy zjZvuv zjIS&5)Ip}1EEb;JJL5vN*@GKRtIfUaJp|@Ls$zF_N7CvF@A7!0wXKdEWX|170-o%! z9;V&H738zGnVZ9mbKs@ewOWAS#jYn4+8a5i<%)t~V^?9=1w`Zy`D18UyaJgcWxom#n01XADz-B9a3YmM! zq8Q&2-^8@%-jiJczDsf`{7UJN6$OcqZO!u%oE#Dqhkt$WynWX+*Fcmp1*yCkwVV0C z`?L#MHnr)6d16aOvEJ}8=IWxN#3)C&s`X^#09lSm54ybN+z@c?I`b@}6$wWdkAQ3;S6furg!wek(C^o^7{cFc113UA1@;UcAl;yN>(-gg+RibSt*| z&1wGrM{Nrl08S@dP7YJ=d61ewYl>nN*-=?Pjxj^FiZgHF%Ov z1OP!0oqTbv%hxC!GNIcMIH!Z_G5u;uaV1$>;lKyk8=1je`b6w4<7)EcqXo<8&~575vpfAyLB3=oi{QuHwZ8YSC=Zq| z_Xwj@WJj;$>X%4K|Rl* zcDFsppOp;1ORMZIxz}77R&`05b9T>RYlUsCWDKRHY_E$$SDcBzU(RM4{0s8)_x(r* zOE%DF?+@F7h~%L5-|W6LJ^+EX@EnQ7zA?2@C51=&p#g? z@Ej=A^_-~j=x{OhZEELy+ zOwI0`j5razcedBpD?}B4=7NM4URg(jy-@yHu>5N?EKWOzM-Hmfzc;AVkpd|ngoMmG zQ?>iVDSL@Z_sYiLqRt>K1J=t;dM##MNX=179SC^x$gg!W`f+bPC zrP4rqaAbZgupfnLlkSUjh!+7i-ycX#PGhT8uTc>`69zpek>yFKwzjr(bXTUFxw8v8 zGD2H)XNwpX8yCly_MZ1hmNd>_DId13T;$&z^V1WFIPlKTTQ{I zqT0NPv&3GC?%DXwyVc|n5iN&;z(PE#f;Y+U$?S?llZK6P zkpc{oQh~1>kFr!SZ2FlqZCfbDXiE9ljC%a4{JR@NDgewMr{cn+ ze8{p$NtMclb~P&%B-fJ;wPD^SD21TI1=9@w9$;xjG#bIiI;CLzh{`^3vqWe9n~P1D zwd{Fpv5c)%r9lKVjyk_EQ1n)1e+V`tYCH04UEiXS;;1^&W&5!(DJ0o;G!i(;m)5R^ zcQ7rrUFvtIy}4A%%(vU|xr%7|mmDXtZx^6+(;lBx1d@XR&i2@FHk|S=Nz!cvaq}m( z581P>3;K6eeoXo1Bwwn#9nvC4>L=T=N4A(S++b7{{~)-grM<6#8o5{1*^Zus+IMU8 zKDB!7O+#K-=vMllqH9uz9XkSv?g)f1So*Cx86JUEvLE(^!MhsL0uG#Broht-e3cNG zz@qt=DB?VaV#WL-C4?rizBx2YjCxVt_trLf8z}F6A)x*-y2e zr`3=5XH{SD(<*CxBk>f-veAMC-CwScm}8S2#lF==LXh1ipNJ9y6KgHCv&;BP0%x2r zlZHB;G2098#G9j=CW%}#OOMqgjbYCzN4sy&Riuur^cU?gT17-eOli&{0YKJ%#;5!K z&coH$5(zN@B6oKG%;NAM&~e316OCL%#2yso#&rA9Zj*IpiqNB@xgh(fqQ$St`PtzEtITIt)HW?u^JSEtv#HqnGOf5+F=KuiW-~DQIwn*n)G0=lro90%#>SGNy+nttkdLWqgS1ullU&-kzRd*wRc9OE~%(YkV7~HRNZaL zZ>IW1iF;!v*`ju>C$R{#h=a}Mq_NO&I0&oizpH4TXWZ8OhUARtcR_*>7o1U7CX{&? zLaLub^BBh(=^pbwjE^5bdiKB+Uq|u+C0^U7fA#c_K4|k)@wi@3Ti{OXP7^bJs8GIC z-6st;T@HgSeo9W1?O%cLH{Cqs^eW~BB}zNQzN?881o$b7mG}&`s}G`KX$-|AU~S-` zJxTDD8u(oyAtCb}S(g@dXar+xBdHzhf{sWjl;^A88mM*XKw^3minYn3k>iZPP=^0R z@Z_ew=J3|Gn}ZFbZf9YUn%jz7k+auAGjGR3*ykt)2WrR7Vg1ouu)*v!aNPpXh z6`h!jq!Ml3lOc>%ui6{IF>ea{JhRiWeYY~Jd%EqGdrm+}Q;nA_S68Xq!Jmblqaw?* zS~A)l=rF24W2z=lBc3k$Z}54dR9e9WN7bmjTKBZIBEf;;Hgm-Kdy8bv*0>uvxucaR z_)SD__tImyuhz$bBK=a`Z1|k8f3qE#O3!65IQ;uEio*(0#Re_%Ad-{j=@6S1ol;nD zs`Ay8Z@V2FSXN47FpiH(EbpoCLMbBf!#4fYBfIj(-K zBMl+_)PkHL4MyNcQ*JSi@VVd$iqUl&o*ft?42hI1wrJ;b$6-rr)LpRC=a8X__%r}Y z2Vi(SkeBkg0SwKCYxt~&&E98XsN$o$|-mFdO-9g6STT5*fL8+w0Rt$-WZEW*%tV7T9eMJjp}8un_6{(qP;7)tcZF3us`rzk=fn z6gKgRdIS!%ZucC;c%lT?pasQkb-D@5+`x&a37F?8vv9{2F4~;vaV2FD2YZP=zy{YA zjzsy#WQc=Zo<|lF&FB#&k-z1YcBq4E8o{E+8C_a9d zcd8UE|G+`MO_u)$Lvnsl80WCNdIcUUd&x2o*`ZT_L2g%n zVm!SqO|zL3IKgB*qNje+F}4y@`wX`SMz#-OJf+(N^?rcnv*I0%K>#$9!cd8kvtmG& zTezF1|B!=WZmx0tg17^uuC`8JV=^qh7S>bo9BYv48N@^ul?P>2O=jZ+u+~{7xSWSHC4x>h4J-GQ z^pT-*%kAN=QPN+#;R`oCEt{Ojn#Y2Z>aYcuv25l*rP%*I+b$Im!5M*LHrQW(HHeMP zw)9WDF6Bh8AQFX2M-4f5NrRO!>gxs;m?|?k6YUrLVg|;%G|8zcFNL^-aF;z+rCxziJ32pVqb*s$3a?{-Y!l`U~Dq>AayJx}H8S0Tf zu4qb8WuDA_=$9DYGy~{dXGRj#$Ot+2!lAn(U7{5Ddb8|kg>7ns@LgTPUVF?!=+1JJ zZCVhf6bUif)z|yAv%0|J?+Yr34XiJjyc29}`Bn2CpJfF?t?30VzRrXpP;)YbIIZp5 zZaa%ZrD`p5cl37GQlehDS0Gcj7ZxO4xB)E|oTwx`xMiaPtXLw~@_k05I&E*)yp$FLH8wh8OJ(EA=wk{lXbFJ*^YK_8_%iYil4y;mT3w;U6VMkivR=ohfH1 z@#f*e&}%$($^On`5wo4n5RqVJ0p(8_wlvT3t!(@pzGRuF;PU-1-ZK;k3FovKQDsyM zEd$I{@LCB50^nJ;8VOaqw(ILcx2JTNM-DnhY>W^(B=X8_V+L&TQXe@uf;Q(el?gsD z0`vR+X)i5$mR(DDBNV&roT;8vCJorR`cA=*(j*+DQN&~`)=xpE0^{ruASbs_3ZaKE zueIB#61wg^7XG_4@AO5$$C_R)SD|sQ!d4pz8YHN>W%`BT^zrfKolD)! z?Kd5-_s!f~vPIv)ZT3Q7CnU@+6P8cPEoe@WZg#{xZ3gx<|DgKTLJ=WVU(m+{4Q$IL z{P)kwX@6RVrh@#H`V!TyJdN2?o99bSm+U3d{Wi6<0i-4+t1sXx5JLJHUyA;?eJV@< z5EeJ^NPYckN=nrB*Cc4@bQ`WYOyx?u8gEFzsf`Q=Z)djIV-{z3x97F^cF{zCu(4pl zTYVp?wWEWJ8=e%KfHr6JYSZ$Svw%^n%`|69nF~XTMvmhYGJ{DN2C z<=d`AY}HLvyXm`a!7(7?Rc!OxXTF~A->eLX9+(z6riu%l1}a+Lv=$In7)qWs;;nwRJAv4}>xE9#5lVwn6?YCm&@z=kwDkCF@-1tvi}5RlRX;oQdTtWzt{yT(9nLS_vT2wSb9?ct-Rad7yPb{Q8?!^N%P`xj`>%K ze|5T@FH{UD)?1?H8*DC4_9oQTcD4qOam7Gx10dH1#)aBWg48wgOCxiVzK7> zH;r!_mmNzw4{%g(Nc_)~t$47j*0Bx#TzrW1VBH_&eiEz0zI#a9(=%{GzbUg=RKYub z6j1zUIz8uS%i_m}SQgB{=ROG_0s_3Ud}(-V7^+LwD4BKk7?JD$a_uI*zv}eQyFew7 zM79%9mzD)DkGT~Y&X#Mgv6^e#9wm;)en?fmr=N}ScARQUHgj?2sw(`D!LJ_@_AK7T z+46^gM_0}$%80K@sB*qJZh=RiN|j~2iy;&A|CxyrAdwr0a$*aCg_q1PKv1R zbD^pMo5&s&6)sQTuRnGDm&E2AKPh>$C`+N}w1KhYhL6R%DD;^Y37>1WKJ$id&`(5X zlkfDei4(k6nEJ^6^YtG@>YsEC>=Z24y*pCj2--|R?y9MhVbTFa2ZQdWm;DM)_@Ez6 z{#)VtsNs^~Ki^QO{=(9EWGd9_7TWo|F9>rT#8U zO{lt@l66w7bssraDqWpxovwbp{K)ygm(7nFCsXMww9bX) z@Dg42!2XE+wl0c58p{5VVWHQGwH8hJ4O^Egk+2cHH;{xXuuYAwJ!r}0Hv(fUCy>Lap1=D^l=DS=L=F#u-ngQY`KYc z=9%)nvUVP8*t1oNLxOsq~BgCdK*cq$oRV}y@CJzB~X`IT{)aL)hu0m-l=LC z=eu{EApbWKNr_q5{<rD3H zYcOc4LEbKtN+Ea2$+_p8Hf@bl7kh5I$>ZFZFP#wn6}3BDR$fQG_L$LgLkD%Ty} z=P57K6x7xIM$7Fi$4LkCIcDGDSD>DWQ7tk6f$`Sm8mW4@HaOQ|iZWD%cyYmQu+EH8 zMfBF__aMWEbQ3I=L!w?%+f>v2y#>-9@4Cr3;B>!sSq)XE2a5BmQ0YCBxeU-$x&x`c zYj(4FVYf!MnB|@1YWY@=R^Jq*T^1d_NiLy{tD5Z(nIk6JR>iolbYT*ZZ}M57wgx!) zx07<%=FZx#CavFWxmGzZ!p&@-tY(yDBuaD9VLLPt?Pgm_{W1C@>w%V43_@73)UoeOJ>;KqffCJ5+1I;iS+1tQ4%zgia-^i5iVoXzbx80gx=YJl4C--Se3Q4f!y?+45got-9qXl>xJ zFRR(;yvkYE9zrz(j;ZD{LC(};2G&v(vm5ER$G+y?@~QZ}Ww;j3`;Om!v$@!*J!8Vv z{qX8)pxopXm#Sw@YqNKv^`y0W?hZ-bH%vc8&{Si`da#sX7U@7wJ73Y8kt-*24PqP9Ta5Ev-qQK@bLLo8!+&ycO-Uq7dd1B{yruQWE+VO}o zbf%eNP9_$6BGJk-yPQ<|u5Bn~x(1#Zyj?aJF=WO#nU26bTyTCyCsXCTU6(@~Otcx_ zB6(rRJUDK_ohC{KQHtwr9e3ELmBo-5ExW8oa=f9HCJdoejdSHF?1{@MC~SI1o>@8~ z%GJF?4UV_LQLg}eieTT(-P)*a?1J<1Q|lWA#1j9ijCM6@Sk^IU<^VQbjFav}$0`^2 zBW3hec`xq{8q1j)d29KJy$kBXLTG;(@6s#e3L-it`^*H)qasJC_Ng?#5Ipy3D2C+R zcHSn_Jtwb#Bt0zbv!DImDs5?%&6L2Ci3qDfYJDy*(_^p<=kcofoSrL|Vpt{5X;7mv^(Ad`K5pO?+*Axth>>b8h53G;;)-u8)g^Javj%DD3YX^(Q_d z#x>vKupY1W41&;CLk6j}Lv2Gj_$BJQ$%ypQ$i#?~(t4PA{~*70^wMxY1osZbXqwVM zxW$83cYL+H6{_M1qC;>~84 zj--UWx%b20am9!J9xNFpuC9?*o`a9I<|j(Kj07t2_|G#n$50WxM6=YL_R^^xU6|0AEIj;5T2) zU;j|x7ezb&BpeJ>!S5B~HM-Q6595Tsbbuap7B`Td62@>>@GB4jV>6SmcW3AM$gzUu zCfn67BiP*)v*~WHMM$psoAt`Q$}XLDc!$yVh*!*o@)g*VuJNP=`yKU&YRM^4STy;~ z%R91yu}SDsrMfFbMf#09v@jKO&MMZhy}}KRtLdya@jhfMmEPN)O&HtC0~fSoqDJBD zM=d*bc>$pnCR6kVH}in5(AL5{|5au5mig_XYv;{yfE|6C1Wq(xlLbdGA7 R1@JA4p{|)u<+WQ6{|ir^VWR*5 literal 0 HcmV?d00001 diff --git a/src/content/posts/schema.png b/src/content/posts/schema.png new file mode 100644 index 0000000000000000000000000000000000000000..1e8b97ca188f549144617e869c9f8d1409dda435 GIT binary patch literal 91198 zcmdSBWmHvd_&0b!;?M^{KpI3qL_z^k8VNyKI;B)fLb@9y6(vLkg@=}w?iLXd5e}Uq zDBTTnZU67P)~q$(Wv@(g)WhEUzVGY$)wQ2#s40>W(-WgmC^DtHa#|=99{d(} z0*wp5NKk~cz%N8jcMYDRP$X2y|2U}Bw{$2JD@sXDM%(l4@`Ozaqt3|9_4__Mk~g}o zS~$>nl+WdHLU8a}chMHo8f?LVGBP3;*0q>fJ0sxxtWmf)R3dD-cY{B&h3dS-u;FqB zV#=kHUaRbF>-r2H&8)qx>gH5PFgQFrdT#e)z{Eu2#)R9{!uW!uaso$iB=VISGCIa3 zEr)!KkyD}A;VXl)6)zC^v)pF_IIPHbY}r*%$TuQW(f^|3o~|I z&QA9jyUgiyc`l4IcL}auvJ4DTTw9?U9?DjGcX+(jM;k3~f_=%+FVwr|r=xRmQkYA1 zfLeY-oIlP|b%3;O-EV5|#OO&)N2PoHl_N!$J{{)$uU>gJU@g4b1|iY@yjU&Ww5mIwsf)@-3Go-}I)rkJ=D2xjuIotGVTVx&Y(r9sPDehSf!u= ztm=t&0!Nayo4dQ@;bP{Xt?)awt5N6WUo6!&_}TvKQ5lHI_$)wrEU2I4)=sH7TzSoV zGgO;ruqUT_P{;)L0bTflS5(G-T6v;zepB%ocQvVR4c$|f*Q5^Jzl$q_rtA`&Jibf4 z!M}hL8F~0lfRwDQdC*KqJ8->r>Md{24AU#OVyCh{{(Qp7PUhMeI=)*N8geBH zv^L1k|1#yr`7&?NRt6(bVyBj$Z()6xFZn7>^rrjQbCG+5Cm*RUvH$fTZHt_%*2=?^ zdC#p(7oMO0d+WfZW*m8N(nEo0Hfs4&UJ^T5f#ZlsDbhPVWvv3+ep5odrs89TIe*Rv zdN(l3zsS!|vS#uacjkKQ6l_jcTlAEt;^Vi z?8ZF~_P;q+^HoJlums<2a^7_cqk4%3WFGIB(KnqL!~)YdqTMVu`npzaP{~g#REvpFqZ`y@ie*R{B zXk_kG%X6ttXU&CMF26n#QE{$cYPj{GzRUToHcys~A+anMncBs z9jT1G(Lh}Pyv02$1DYRV2Fvoj3Ijr4Pt4=!di<<(S-llbGP&uS+fZ_H=jiyhbC0?X z)js(xuWV&Z24x3~*z4{F$rZ2|AC}^N7g9YABc0|g{c|2QwdZEiwI)p3#-UWg@xH1r z+MBTU4w`LNR792PMxg!$4if*8KzmdGF@}=N-bF=m71bQSogHQ&aH~6=gUB1_O4NBg zoW|%nvgM$r?0f&KR$TmlvsNr-iuX~;wmb8NqJvR44;%SI?&2cC>`Ot;OPR075 z*_5*qFziw6zO-F28Qi3I#usagd^1NtBYzK%s``e4 z0+PM1^7~Dhd%Hy6J1>T_g=*;Npg-6cGIr(X&ytL0ZSlSVp-l7zt{jmlW8jl(-Bs#~pv zqhx4gbU{8(w?LD+;?pNrH@A70TT^>vZRlX>-vmktbm2itDAj>DsBp!8D|X@L+(?DX zw%PyB$>b(FIPt2U>C;|ecvPCNDl04PifXboxTh~Ep(*ijB>#i1w%EqrML6G7VYpIQ zHQ9PuGAg5uLaM%^LdV|yZKE+?)Ao;h)o(Jml@cDOh6^@+`}WOOGX6!Kd0Y6rON~qj z0TEmNV7@t>IUP?_u(OiF*$FvSU?T|;YI2Y@RKL!B*D=Xz1eSXg7@>pGynw05DN3yaJ4swTUk6xqDY_+wuoGK~n zKkutsUw>^__;75OQjxLrXtmBRRhK6*s$&*zKQQ?1LYmJiiP?VZn*UxMY#4(iOzT#? zR-RRA_JY@eFY}CK+GinEU%U0`mUr*o#p>MNym9%Rnpj-O2tmxrSmm|Q$c)cIy=EtW z_4etmLzkO?ld<>frTVvd7f~-p0W|JgB1%filVnUX30n!TK%8aY)@s9^sS5rBfB)U( zk@U0Ug_~vpaHM|WN{v;TUuhfBkyvdzp|g^P8HAOgqDt@kDI8g@%KpqqYV~OSM(w zER&u{tmqQu^&PBP`b|e>h1phtuM1lg zlKa!Q7T%UG71cfYEgE@B);8=hZwBOnU=#%tV^z4Feo2QBLO!Gr7vy{jwr9; zr$yMSqfhEqe5bk|vu2+8M-WL*UFO2BPXWyEJ9Ndm-Ou~EzcI(+IgRsikxA0G8p9rE zN%}S2XSK$%Gv*dtnEhCqRKV%-NV&S`44&#hs{m;*s=(Jt#n(O5Jf&w|_oF_W_YlpT z(uRovdG*Qe7%U+(YVYgA^8EaV*I&PJY^;jcVuMSz$RRax^Ojr@bBNjf=7L6C(qPY%QAG#!~3pIC>f>*>)B9Z8-YZ&gkCADMVeB=#*#dCtWmP5fx;tkGdCcK*xQFSmh+ zkfy>$yM{d|)84bsxURpB$+pomaZ7xAu{pOsKR;1f9{r-*YIn@B>Fgl=%-KY5;M3IE z>E1q{vd6l4&_nY|2SS;^^8r=|`jycb7R4l!<_vDx#-KD=O=@%I2ZQ-K_mcUp(L`t4 zq`Cf3I$ADQ7kQ(arN!U4pRwQ-%a2pju6vdT+gzB?xEBFhyQN*scdmWcYurrSnCrsY z3hU^cZRbciG_r8l9uPtI9&$5briz!{HshtC5MOUbR=&7lmnXTW#`wwTC!6cC7zR1s zpL-j$Ly8~hDV|j<)oM~poNNy)_MUaC`@2Lix$9RwVQO_gAb)jdS(Dnt|6o3HE!}rh zsej<7RGj7Z`ipa0xhv6gbZc9kuW=9z873q6P;Yb3*Rh~WgyC#U2;o}O*=bZpsCl*P zpC8anOt)iXzmP@$PaFDxBSpVCTp7E1d(5GVX?H?^G&3s;|I&u1QKxeZ1umN$Pok}Z zL&IW5bhgTCm+s5StlN&pF?H4pmqMj|H2PmM)~TL z_^kMy^>Js+#bHj;-bnF2JH~6knKG`0dosmJgkt){w_-5tZ+gjDBz>zU+{OO<_p);A z37k)!#4pDOTW%(bEaYEzqthn*TLoTiokO2EcPng8dojC{_gY<*1?4U28Q(Cfe;j`8C$TjP$eXx&rzFaMa z14Gg$wpP!I7VwP!9uU3oM}UIWyYpNEhe5sP2Ark*rP>Vc2o`_OLR~u>n}Z+8jjwv< zTLpZ7y-;+zo{^&%#LI_}!n5-PIHi`@udi?TO%>}FOdSqY2|U@)Q}@f);MPytshc_} zGAxWrlkl6TNtZ=`MZK@36UMFn-lIF6%P)J6VnFCxPwTWLwLB9OlPp@?_=%Lt2|iVz zBu^AO?^pFKt=ws;nNX_leodyu0rOYQytexlUvjiO34o6x{j7w#6&4YTnongOe?+1% zJOAGYaS3@%DDabROG8(pHsLD%mZzWahLgpKtyU{%SyJD##_kvv{;n-D zR*$*dk;47F_pa4%r!FRsc4zxBcab+t!nUv0j*6CcN8pJ3gd z){LJXt);8w+{^j_#YatiqdkQD_To3OHQ(KlN2N*vhE5i07)mLTzb~nt>R({3bUlyC z#C7pxjmjWo@fCQ}3q)bFn~Q{vvCG-S1G?O#b+U<&>QlxA+NOQ{)ho$lzI0Lyupkd} zY*NP;7NExM`kCnr0(ohZ$Da8z%q+vyJ^_7jblMm8zh>1G(kz#aHa^$a>+{Aj-f}tI z{$qADiZ%5=u--mvVQ$XT{+lCpVnZ#Tr)>*3i0hr}4*2_2koGJis~ zHaElKFoc`)B;HW0}+vYOq((;;V ze!C;EZ~xRv`tGj-bTe64Ss%^z>0MRZrZ`E?_ns zFf6R>lRP425V41CS!2Aa9&k7SL_qK%f9Sd&%fX!*V}-$HBgcjc*FRbxuWINBliuMy z=n!d3TOeZ=uLh_!Hg&o?sAm?d8k)c%L&45*zTsf*{Tb$7;2}515O;oCV8hx`?gzk5 z>unSO1*HO@k~bc2_B{RlwFc^=y5xaX=#J-|)a--ia}>zK2PjyUpWk7jiGHD+Tdi4Gr}LoNmD*NiS;HHEa_onM)C;LTE;SxgRybXc$HY!yRQ|kYtmJ zF77}7Nw?qvG5&v>SmURvj9vG$Rgf~Dm27%A8_m!D-GgyqxxCN+@J|jQ8GYz7qvCL| ze6urSCJ9|?ocUQXhmt}Joih|2PNmt}Cn9eOwR!Fuewn{ca~`M;t(mX$@&3kRqA#*Y zhdTq>dhOb^fgJTcKdCpptI!M&d?(93!gk?FgpVop-uVl33kn8>5gu?hiM{csU5rmj zYY!jnODUb7+FRPGEm|@=-Av|EP5lXXIW(l3r_I|Vd+mA5#j=r)4rBTvtUG`E0xKC2 zwo&d_X2!2O`>5O?roE@5+Qh^J>X#-p8NJZs<>69jvtJV~-#gt4INO7jSYBQA-x<_H zip+qTm@3w-Z%buhyzD${3=Wztf#XV|^49O(JKfVjxQZGNZM&S;H9^48qOFPceDr8R z7;AjP|Jd^t8(^*e0E*ImpiNhig(soqg9Vh>xVAiKZ9wCGmT29)Hx+OO^_Fc9w{3_1 zLcKX%<)=@}P$jE}U@<{WlK#m-0zWYiyHx3LW19t~kNeZZAStY&PP1(bKI`OUE#R!j z>@--$RePU^ZFF=r6tmb7ZBWm4C;a#j+r%v9ZqNC$+v<9}!BBh|RAr@preok`1^a;+bg2vm4~S}9(|KK-JsaUm1#@oj(X1V zz)3^o%w~BMSVAzNyru?!`(glUniOhGq692rEpyifmAbf~d21+#5&}tb(*0{SxLKX| z#QOwdl(T|s8!SqP;pSk83w4{0=lT26rKCvP_9lIbHMq4A2>}#Q44#ojM9423JJQvr zGyhNI!vSX}0lVetHmMI&9~SDiP2%U`^Uy>)HXi);Xxw7@bq+!6I(jA@^fCzGDlsQ) z5+G#>INq=qF)A2@BdNsoPCHNg7wPeIONib_eSqe(qNb%59ra#YLaIjP4|@T|H3As> zP^*s)+Vx8jY%Y4|f`d{xnG@Be#y>!fo-cdl@!)~L~s#oVlZw zs&ou)bdW}hb}?2ky&5k61lG87y8TkTxXYl9UQJQYN#L`{NXhEXrHZ%2%@++h zokH36`||3F%d1{D6H-=o6wtoK?;q^2MZ&63!Cp_Dta{9es^ttUF6)6vb<<$@(m8@( zM4Kh4*(W(WZ9gBC;^nT%4)`s1ZEVB`_(GYMjf4wResLnE;Y@p=q(@ z*|bGzWCLzE>BTaj>_fJ~W0j@Ys^K3JV!^EI;%mU-4eHz-8cZE+Y!GT!!h|z)dG5*Z zqyG>}yOYK5m#59+=HbzF@cYfZBwq7vbve0D)=v0ckwys|P-Z#!J_2-@4xxZ2$^9G7 z;qWV}SU*gonQOniELvXE)N4KwC}?-TA9CIng@ga#8V_y6gqu&#nA6>k3pw{BpZVD# zEhozF)pB>(;9*-h*_d+|6Iq)Rr+{V2+5}Xe!UJJBSyU7>i99#7+aQSkVa_H8bH1C9#q9=Y~M2(n9n+84S{C$E%$^ zmmLF+jI6HctACBBfFl$@k{Ki$2`F~C`$E^oXoX$6=Pc1!r9_|D{Hyy`BLYRO*Tn*kd2)~H=E(~XB;L9${Ps}xqPn+_)Vj#f#U`W(tk zxaY?rak??ZivIQXeZAD=-=ZZ+09u2#7oL&>%)i9RD8i$Z0M&z|8$ltD0KK2>cS*G$ z^<0EA^!NrT=!2|i+>w<#=nZ(9uCA`0Y02GIoN8|)drHme-sJU5fhBS^G0G-2;GoA0 zwy9iOL-o z&OiQxGUIx_asyO7OO~Tyz<#G~ET<)zneb!#qG2r@(t$tF=o-ddAKjK+Ti*&C=9z zR0rCl(&OUDsgDmDrMxzOJ^gko2WY^+CsuUX2(PUp@W{-k9EWjpzQ1pzw_x+Mi5-1z zt;gTc)TyYe^ML{dht9Atjzy|bD-Q(CFdT-kms21leG{FF(J9a^G_E;shpG-jLt`Qg zjS3VX^_x=9894B51QiU9Y}&$QC6{sMu4ieTXMj*5_7&nS4TgY69Ru5qF!$W*y=msV z(ZRjc#fQ_l_9ok)7+Yia=q0lAK2(~nj@pfhM7g_~Oo4mz@Y~xO`w?jNNxf+jJ}trc zBla{sev*g%@ywur)-9Lyl$f_+TIQ}@^WMEcBm00Q5P)^xLcbiWxA^w=J1z%O;TKEj z?rwj)twn7OS}61mS?1sgB6>aaN3J+aAr6pfK*GD`PC+Tb6!sbg>*R-Vd7YlY%{{;* z?zs-K_e+i|G|`}_&^?jsYwmsZ8;BQh)SFQma3(pFfB`MV!D$==l4*>=JMc9n$JH$u zgu}LC%Hi-7p_uLC;pQK)?`SJ_WFuFQ*0)lHYOdB_K_j)YZUv=@Z zfusti2TM5HE;%)sN#~H!f6;QX%w&G@^Iw9<^75m^x}13*5mi1o!$Fv2IP(;`w-k5S z`K^ijNEWQ|wy{1~AZlVRKOOHxWgvLQg^T|y7n;p}Y!X)R*MyU_!r3`yENWXbvL_5f zXQ!UPLE6S0MJ+GW&s>R1cirmlqeol{vl4xGw%0_}7`u|J+3@zn)kRK|b)>5$5E}Dc z^rLBUPb@Ay;h*`4Xbf-wVz!dO{)68vcH#CsoK#(U5G_j%d( z{Ke2oeqIf24nE6xyLX+c^DW^KtN#SmrPpBaBoGki$cGoX);rT zHFQj{my3n3XW^0fxBs05aB)iSbTY0aNa#wQ+h&l&SJ=2&j*@P*ytoJYuERxR2j|zF zO}Y5zC6ciLW2J<84i~jQTQ@EVAHN{#B)rAB*6FOJ50 zjJ$VZa%~hYq%rveo{V!$~Ovd}0tqT4JjiC@FWuloG%`%I7KaPO`ogH!#LE zCAYczD$Eso68+n{OMKnBw#SmcWI z>EE?{s~Gtg8Qgzd4F^7XH%MwcMagTTeV{Gi)umI_Qr{U)IDSybP$7$)QnCta@IXRWica`Sn z?~l=~OA&&<_odRI|HkK)BmV@Bt9oE4xLB8)9A=Xgsdf56ka ziuc}RM!qd$7aiA1!_)DIx#G;jp{>6H>5)INt?Kr(lfF;+)M_+__e8kf|Mcdk(#;oXNfm zftCB~oD7Cl^Ods{Y}*Wfik!#D_g||Tziv0gTeEKt9q}cn>Zn82#QGHHL0j`?Jckl-SZl4@l1q&- zqMjjQUkD*ZlCzX9zEBduc}mTu>DnTj)GRHV)8hm1?lq}vw#$*{-@4P|HZfBE2mn;C zGvg%`H#IR8mm1^ECycWb+B{(|)`I8>-j6DxHS@GVuw>*)?-Pr&q*KV!LNL1kZe&>N zIZ?vLwHE_nukG%-le$@6`PzJn?+CFVpoWg6$2XPEW8JVH4G_18+2u1Eghj?c^4z2k zpvsv0{NO$2a~bb=sc+IdD~9%uY%S7UtJvn6ibM(}643lW0ztWPLHb z-@d;IgM0Nv5c5xuxFGv$>p(PaUO6x*_2gzN7n2t2&$9=*)K@a>al)(9`=#KKU3#={ zS7C@a<)>3D$dU*MXl$sH;I*4b_5-h zaDpPup0V@)vwYS6<#Hn@k?`10DGnv}CZNn!)6uFEPcx@Z)YHQd?W+TFWQ*rU1Q@5Z z15c;$R!I+^MLxE(B*IYkN8~x9K_APdu)vj;+y3y6DEhJ73yh4c#I&CD(yo+b!yg~g zb3*$+Q()|h$`A@)Q%bNGDl=P?TskSR871_pJ$pzd2D<0ss& zA_^4eZ5(p*m!pE86|YAN?8dT9E4}lsiM@b!lj-=>{uITg@scV(0@bQh0I{7w@C#`% z2^`Pn^vQ=o)R6Cw=5MTanvq4${zWnOWx)3TaIrS^Wzst_LlNeYmvZxK!E8EOYXWD! z!)@ZFy5z0&J`%QIRw!YJ$aSqJL4Cz54Ko{ibJBBvCL)5Ii5{;7tYP?OwoPjGm8i0r zv~$jk5bGGLT)d(cm2p>%{xdfC(fIL_$=Z^FCiRu5V8=p_bkR7$!qU77Om#p4hbHw* z7q>`*7cQWI8_4!M&2pAA(>;>Ye8ur>!HbGhMZf%EY(3a2nmQK*i((#c2%n09VcNr2 zr=l~+iiRxPZI4xB6D(O!`U8-b*Uf=95*_oCAv2(!Mqcyz7^_=LfR0Xw$NY_1v-Ukr>JI0aJKe7y zWD?z(qoDH8pw22ydWIa%VoL@M_Keu)L@3-T#PT-g<5D`07qoWNxYqYhjMm(hF5IO^ zy0cxAdZe*jQ`Pk>mIj&{Lm6>!4DoHz=7R?vtG zfyf_T&|^BYDW`6ixpQEwePqGIkqsd2oBOq4A}$U=9}S5KCf<%t7VNPVOjx z3?F{wL7`pyw+;EPk0x2J&@B{c^I%OpOfYzw)L8>IY;uz6;5|02)fSP0H1tGVyTMeE zG+aW93iLp)K6*I%h3tN!9I1?_8Raz&t z%9G2HyjX}+A{;81W8+nitcjizjhh2qbVZh?d66K6&^ zd3dZZyZ_U=A}$<$Hh)(ZgsoLTPI>OgzrwI^&~~4XeBR5n!cd;EcnR(-v4>z? zI%Yd(;1B3q75!z|W&=WR+q|U&kA;k}^0Al%Mm9MNUeS^ZL11LAhalkR!(=jA97WAv zqTf#Trp$`rtPDR&_j3nE3jR%3r32OtpK(*D>(LuP(Y;r&n9nL4+{ETG||M2!AccL;Vk12RgCbak`jcbni zAEgjAB<$n4D#(&S0L1C_gxa%6Z^}9ps0PuzA71pAuN|c=NNjz*0VLa)FC9V#**5-w zC(l5z0Lcr{;{Rnw*LMt!2xM5JC&DnGA-sM1?X`r@?tOI$ojh$$^)zvZQK6XGOdsHU z**5Ic3V)ga%WX4IM9-YDqEF$OKy|rrSsGllm>b`aU^ZU+_z&Dh@89r!fMPX#Ci|U}zX5C9Z zU4A6>l#vS^{0kU_73sLMB@l4n0>#?5Hdl&4B{wU zJ~+S}vO`k`YZlV3(i70?=)h7w>R$%LADfGPZ|C^UgjELwV*316p8|AmZ^Qb?-<)tA`2OL}eD|DYl65Sd;B1%FsdI&4 z$Anc2g(|dRl7MjY2d|ji)+Z(=q##hBc>y$^h5rU@x}1en#de1+{igVndk_Xv zFv#OQfoAiaO5S+#qg*1%oDTAPpni4nfpG{fg4ZOZhUmj*KtzO!IZm!p-*h3~e&CO2 zoWmG2%QH8u3B)}#*O3hX5xRrM_|h}TDr^>*o!IK>>4B+19_*cF%opKz4gzLK_PSxs zuUIQDhVj;Q(zcnlh`A@(Hb|lwdR?cSmZu1_AxXT`E6hL=!&W;E(ss|XR59p&L*^EzI>2A z^V<47134L=Wjn~}fM&^S*66!2+o8zp#i4ctoAwQqavvYDAsP}kl>xa6FEhB+Azx6{ zxKjwH$P7{|(7ja>tl*!3+13Xp_8;gGslVZ3K3Q}S%WD#l(SLf_OV8GhgrP^QlOY4` zH3`9ovsMy*q=U@6cmdNuVs>DfXK*7o0{_i(%_100P6WtEUMxGjP{m!{%** ze}`NJc#Nrl=l^VjQR@c((yH7*#dZ2hX z8QI9e0==FxD6NpqkbA4Z`SPN$tu{1@LNyPMn`%3N%|NmfNJs*-#H*A5DPfN8&3RC{ zK$O#b1@1lrcYq6HPG;sMr3Bjw@70<^QbK|9aI-u!Z7 zL!4qI9QJRNTeEDW)bR{OhsBE>0=Y4Qdx3XnNs*?Wo6pnr;c3lVj0Hp%^mlKA^Vm~X z@+L8ZyDfr3YPEXqJ8EGjf|2;A`)1>}%PFC@o0BQW~zq!S}^H+0^&RQt^ z1Hbscc8lIiMwv@~(BM{iBSKbs`uWAB;+o&|sspp40BUNC`AFM*B@rDQ?IO&ZMlPHpZw%o6}kjr=VemGO^gnP4Rr--k#Zjr8T`-v+h$(_Z((a=6PBK@d9R z`x}o|eU=KV*lqQwts%LI$OOCKf6Ts2KenQl2Z=Wo;)jQnu-Q!qWOc`w zxs-y_RXAVXnu8`Gv1i;<24@hKT92E$-d zybu+2HE=RnHWJBUA;R_!Aag#`dOC(BVzvzK)?FiKM$5XX|IE#11W3VMcAX9)gsc=C zsB!l(hr1UZpA&F38Sqo8vF5MbAK-0 zCoSUKtQE$Hg6TFW!4w@LR<%Wt;)9$ak|U#sh-Q?uRNNdCwJ8D8F6W}^S>nDe4Vo~e zcVK5#)z1c3+O<8uTJa%^;zw+B$*CLD6s1uN%(TSS4YccN*odBYYhVcSp> zTM0Gk48?FO5w~G7H?wWXAyuKzOCYljn3DBrvy1uE-q_d}mr9BTH?^Ump@4JHA9Bbc zXrfv@d<(Slcn!*|pf$^2tggR?l8p^+zzxL=j}4c7#F_>8f$k1D%GCwQy&CTZQ=UY| zE=_7{xcXtpHIcS`epp@$0d+T(!Ux46|8#^_f%ZE?K7-&JRyec31_+SJQ~4K^&9?dW z_STKKxz*KG2##Dcu7;S<1BoXMrZ-i~O^er{Zk9jl)1|hCV|gT6sUAKh}dSj+{gQD4zz@jOsm0#Upl<10l4oTM*d~H>z0>(l%NdtLhcP zdN<+M`w((^K?^y^1wbAY!62ZK3JmupJY?^Xb ziS{&{4PQu1OnEOALS7z$u=jJ+t|j*jpRYD7%=kq>p{H{p0^}idur|+pZIQ#+RMCdody?{8d56GR6i!GFb`fVa<#i&zmYWzUb}f+q|#?0B2F3!ay#BjZp?=$UuI z+oqM>V^$r|Sc=d84`Oy+lW>fSmTo8Ac`%3*7cWdvV_c-q`>=cj8Qsx@=u!0O-zH0T zcA#iRL_E*tMEPiPhr z267Ftc1G4;uZ4mu@fk@zz$p+=NgqT*r&KQFHnim1b`RXQzF{K37*{&BG{F54< zw_m&HC(Vnh-F~NFc`88KkGm+9u>=u-J09O$YGTa&>)GYb04RagB6U^Vt--YGB{5`f zCqdr>L<%!zLn`-D&e=FPtSm3v+t^%5?g=+%U7KAvN7*mZh8I{#gNL_xk2_SF%+(Sl z_ml90Ui?xm#IuBwvS0=v58C3$;yb@7NVFa;^rfeBbR#+F$Nd=%yQ6kDaBeDWyil_$ zAAxks$_qv2*SDT#&xs}*yAbgN%c(QQM^H!0cR7Qs2-2aQ-F<5O*boSY^pb|pX#Ne+ zsb5?PQDIF~?p6z6F=p(_JtJx>X=q>ylKkQZ;T>QZ$$g+U3_kC+`t_QGOOdv;O zb1c)1-<6T`iO9^d3BUio*G_sG4+s!YqCV+-)>QA?0s&l=D%t&GO1u68$26Ay&iCgf z;^q#v7CbyW{$)fG^-PgLr`SngHf`i$_5gCu%YrY92oAsp^yZ$Qc?T@ymMeD0Vp=Pa zg>nKo0`~wRL(u4b{>7p76{F|z;N-yRs4X%|n)jN7F$yFm{2!s{n6G3y$Frr{tGXW- zS66q%`4g4Nm~LxJPAD9aIHcw0-vRjrxB^J7Nqi=wgM))ZL*bju+qlYES`~(5_gMfw z#bi7N@FGMy2dSLRU)?X=O!%pZQ%>&qvnPu}FTn4Ln*-wk((?FD`{|L7jVx$cM|nz~ z=405=!LlEwYoB27hGp_f$B0VKZth$OH#ZJA*?BzJ1mVGWdSTo9dl2PBV3lRO#Ck3a zw-lHbJMv5`gs^_4c>hz9v@L`}(h~+e^l5z{g8cQ(O?9-n0nK3qF-$A{Acu(z0EeOG zkxq=1mv$Rbq97HtdKj*=a=;&w)>U)6oeX+0RJ?cnw8q@_?l5lfCoe~TRXL5duoG)R= zL)cecVn>@UJZ<5fQ!5b!)!qaWBqNbXWPOo*<~xtc7ttQ_eWWPm1?vrpCoTELShuFF zcWa3K4X_Oyc3Aw!@=;6#wiWaQ{S>g!zethePBZaEsBKGJrC0*`vc85GB&B=GPTwe1 zawu&ch>J*xkOCK9ZH~gVe->yGsybi{rY$my!t)+HZMIOGRJbcR9Dr*fh6DvUrMkJ1 z*qjcAV?^U}fN(&maDd?oq|3YWlWWJOIg(N6X>; zQd>BG?*sH8uMRhlp%?xO$U!mrYwUU1{|5eK#!J#);0J;PN&Z>yOCzyCqK!#)lNRTS zA+wI4c6f9UQ-MYaKDQ$f2_3L>kiZapUnv17MZm%2USmXsQ0%)?$NG&<7$GHL8yy=% z9_`PG4?CwcA90%RRqxM6mydj0@B(Pxg(OqE1a-N<7U!mh0SHKY)%qT|j8!T^;MIAy z9VTxKhA8~kLm*rLbEyCbfn(rZ!DG%{@}`zYLPbJ0TFBt2-^r3$G8J{o5G#9zLm+bV z)kz+%u8()^j+-H!wE@GhsI8pdx`p<4(VB(2 zit)@7KmL97_iw=Hj$u-m)TU}|izP419#qLf>=Gff=QKX8u|}b8zZgmEb*8Qj@nQ(@ zR7%(n3w#>f^E(?da(o9n7YIfe{UKu70qj0o^=OJt6iGk)nL{qQ|KJmm?3I2R4w%H` zjLLx4%M1~~Y#RvWy+v9Yq#c!QwQO0}=UXu_leoO~cfGBvnq>cQI zfO#;cRUqcR+O7E@LT3F&-&uCkx|yZY}t<$H+9- z>A?cT)RE8#Jo5J%+>5oQyfiTJLdGjVC-nF`GGHY1_g`euk{Pvgm?8)Yt~2(UJvxx{ z! zm{w$t5e}$*-1^S_*uKwJc0??0nh@dM(_={siQkS+=-YK55vIp z(6%+Zv6LmYyWo^0M_3uQ;chOslzZ5_|YDMU?7_YCM{h!f~%q6-u#yYk7?*u zgRne^t0~zw|E82dCBhaORRNC$8P*$8vS7$w_>Q!nb}IGv%~zBX;25j{B8Ck7FHmYq z8Bn)le^i#vNK=TFQwlSL?a-+%fh=$Y73j)6N^PBYFr0%!$jB<i!ht!{A} z3y=L|2Rj8BuX&e?RXyS}+XL!N5b_GcI5YNGzZjbqK7XQ!!LhWvR+CPfT_SRZso{by zd6#J2WO>2}0-E7;Z-V*uAt}isY)ei25VCC=e$?`GoLHe=w+YxeNCXFDlXunzn$!T3 z)1WdwdgnI8CAmSw%Pc^8M@Ody>j>OEiTjt!t?j9wZZO2}=*(8I}F3?el zK@542&ZrXJCM6{SY;u6Jm4d;@!bnh|R4C>#gCQRUhiIAko$J=tRM77{4I zi=2GaHq8v#T!A1bHqtxWJYXjnL-27Pu%{E`Ie{SC+SyUbQWN8U(gYB@=omR2=q$Bk z9eEmtNn04Hyw+nW;udhRb=Kn9XNGIXrTF|wU&-l(a*?cM#p~F0K>TY*nF_JQkaG)0 zR5#{Xo1eSyqvP`PK?ONM$Tp%^z{u5VZW!AE%=PP+bh5{8F0hlCS*n$bQ zJ_uX$!f+;c6uT>~JoYRuE)L|G{&Gurb3n}Lv&hPefDWBE>G>B3L4m+7#kN7Lvk@9D z$ftWh^X>!RxF$yc&Q3XuZb;cOtKI(d--}C%E=A7{@eOjrd1;w=Zn`Z1sqEa%?QnE( zkbk5;R!O-GF-;vEhp|cD_1~R9^n}uzX(+9YogZy4Y^q>9T*DmOO6HOEPKjeh8a$tag6Ghe&xR&saCP9L$&bO#&n;Y zp8kt5%61CN?baBF>uAo<(U)h7PtCaWZ%kIx)uGSyp@67auamjK54F{X) zah#m&w;K{W&mus{u)G9ThO?wCcW(x6%{dfXm7?YXcpYwor$LZM&tZpxW-SkiVFX*8TvWg_fZ z(&PwPNW5naNz5#ls|;FAnqx42j*pbywetH z`P@b1RUmCfAO|z4;1FwY_V*OWRz|)>+rFiw&t1=%^z8ZF^+QOt&FB);a2XAVeE%1# zPjk%!bI}s#Bs(tTJL7A2K+efMk*zO8GQZy~QfU5y2crm6-VH@d-XQaGPPv*ut~|0| zzAwqt^P}-bJT~mH=@2fPbn+f}yG2Vdx%dHIII?vho<@7_7($I#pOrqA!MX_%w{6R3 zX|*hM{J`b7mMe2!7N{aJ{x5R~$@8024$mqH0HpWET;lsA`HIOB1u1=tQhjdfq-#d* zP-!Q;7T!VqsKm(X=xh^g_?ao(MT@S3V`f(|8cIZ^5YKGFmn^J0rhN}bO?THiH{yj| zqqQDmXo5MNg^FQ#rHdZ+^j`Qkbj!xt@3r`d2l@>g-vBpI9uOXsPIEo;$=ITJGPO?P z8#{CwtIjhJ(pgvNp==Q{Mfn>C-sa%|+Avi8dcd>X7+DJpUeMc{5B?Js0F;uaJqd{y z2#6PgubBPF1?Smf-dsX-qxaD(n@j6QtqaY-k(@x)vdB!El;r=*0yO35{p0FV=9_PN zVZLh~8P|Xczf{Zj5P4OL-_%yUYSaZv+FTe3l4Kyr+^3Z-iwOKMc{rI30 z#xRWMrAu+`jt0BsvNH5L1}=t<(1Ph6KV?*OKV%;zYx{elPiqd{tw7O^*Mo1-S3=u@O)BHlfy`?-T7YD8MIffbr%NWX`zfT9vE2yKaF_o51%Ugd`Wu8~)72Le{{J zs+56}AlzVeYVARLmGe9|aT`4s&aVEU;@)>|M@? zF#>D6JQordgyh$%4w$s&M88>G-|=Qj#>mCG++qLAPfrpo-#4kB@rXcLcFk+#T+|`S zh`sjisqA{PT2AS;K>Mj@D{Z38;sOseBbHa98RkSg*J#th)izHIC{DZLphhj9J46L% z(O|i#cQIX(71;ve=J4trcs+#w5y;zv#r|#pVdpmEFQPu(i1&`{CI34&`(f$!?L3(1 zv90*hqjVOWI=$2CjduuEogL3dv?6`;=D;bwu*v?!hjErO=#1mRoF8BgZyf9tn8JJ1 z7(hsH%q-Y_$s?(`=*Pav8W5aH2g~K~rKTg^Hi2Jp{yW|c4Gj=rSl*g|x9Xgrs8HT4 zLf0wUU>Nmunoz15GWjrhHkx-o$KB2CpmB;0%`Q3oGYrSN9b%B+DT7{TTAaCXQ!(<0 zHZlwj0+h7jRUL><6|o3(uW6FgUi9 zJ+OZiG*T}>D%e{$Da-m-On@fjiwbGubW*SVZ8Z)-ocDVzNeyMp&6O)G$J2yhCW^*eG(Obu!?F30<`nY$*`5DO>!oeI?7wFtP@D*ju9+r~9;K^XxPf@o}?cbKE zf6eu>0xHu2axooW7iSOO^Tc7#zZB>HMTQN5RDcS>1o&ChQbqF>^p!7VF$6C~ zuf9_&HmTbUqcuf`$qEY#!_WUeT}hA_s!sQr%;{7a@6?{KDp0g;D;Fr5pxo4g4hjjZ z>i>hcH;t#N?c+zyb`oOCPDDsM$rL4-XG&2iip-%9N|AY<$q-U1>TW=$N~X+X65T3_ zG9}6osgUV>m+t3(&bxD7o#)MSe@fe4YhCNQe!uVZvuR=*WmioNkpALzlNv>&S7>Nx zh;KL>w+Z+gAs4Qs$6dKZO>z5d5Ja)L=cu1}7j(X3-kACdb2&qXf=3xz6GAsh-0#s2 zn50R%yBb{y8fYGt<^hjgA2+PtUxw+GEyUGT_+8qjp2=}|aidLkwmRjY5&1L8G{xA+ z$PG8#Z@PhpfRE()Qbg8#RV~X~8#IOX2Nd=Z7Wgu8ZJLiY*l4EtJLVblFX=NJHugBa zcC!JqoI&tmLz!z8Xu!^%J-hATjqWm!vj&|`J->bZkplt$oo&qCxFh41<0qUC{Jlks z53bOwE>gjO|A5M@6o6vS6URH*NS*=haqk$->V4#BW5eagt1I6+B$@=p*${xg?=W^0 z10;m2JiluB^7-~?;y#fERm1sc26eV@MxqLBb-%vb*#)Jm!S&s-oAykCI&hryTEF_4 ze50$s7$t-uHRObqL8qn>pWK-@@EE0gpZfb-nHBILRagp5@Ljt+X67rXQKJlt&;O|Z z{pXGI&1{N^<%ywZ>&uT z-X?t02zvexw1R%(zy$m@MQUDLx-!eRdIdp(e!LFM0ss9sn_x5TfBzXlPjaXEyBtV^ zG(mhctDi#(k`KUo{eS!MtnK_XT^{pi2|U|_@BW&mZRs5CGabo1`isQJpyWFxJ3Ahc zu_h=$`ZPT9Ju%XCQt95>tCzZH=2)a{sm3u^*-m-v49}ZhV)_}|!7AFYp*#doMP&(+ z01|Rd!Le^VN8^;b!Td9~tfU$TDd={#*eCtOkVEO0j{W^4K1Ug5RiH@epkCv^H9PkN z368&+zd9HBJ|lKiK8`SQk-zt#wyoHyIxiQtXHjC$Nk+$*U_+C0X=5 z4aEkWbc!7~I@8lJHGi6lX7)_aw=Z19@CGSleLsbxO-r8d zbPTK_k9O-N+L{(SU;n=5@6#IJYVd^yDSFWj;Oh#kf(hEPuIP>IqlXe|vRiJBynXYA z5=MJ#-Syqj=@l2J_;%4+#?EhR+hZC8YD`xoNc{Ez(L0VO2n$fx*1r!VLO?%hFAdyk zd05wk%dqsGBdkx3=|l1FK6rpzt*x!s|DU(9x=37eYr-D^1~rM)v)MI~zNasJ+1Hh%Cz=#D1a(WJ zi7fB%q1f@|B^E_CEh9~%C*o(D;`kpP%`V-hMO<@zdm?V3;rJMIiVJ0V8utv1k_UN@ z4BoeA7sES`quEE9{pmaFG5_OK#s}}G729VN7d6iFF~9wN)b`NoC$Rt1!bf97=5JD) z>ywHx5l?A5edHl|FU`WPty{Nxd+r}siO6#3xhR@6?JJLg0PxT_w;Gu4U;IcP^nn{6W4Z&zS_v~(@UhMqeOEQ-!`w!~_5xq>q2x%s6L41mN_t8|m zcN@AqxFQ*B4s^;M{UFuo;2lf6I}yIOaVg0nGL0Q~-guasci9x09Em-|!7M`%z#AJW zwkJKz*@FUVS60{YIK9F9Pj6-01W6)#>Yo2f#i(a?gbZ=j(<0_3{a$FD6(L7FVhpLy zO!0qvnD?P1EskKphz9FO&01N5#kVJ%S9enrqh+SaXIJ){TI2hb$)YxeLo(pPxs@M?!z6%`89REAQ zIO=KZ+ba_~CT+DD)#f7YfdH@m{DR6t2ED2;eZ(zJcfmEpca`tx{?13^z(1*US5|*< z&-f(l_WvGI}WDQmCklDkk(dE%d`2>%(eB3=p0{lm444@N4gAqAx zJCj<7*e*LeJB=__giw;`G|#LJRhQ>O<%*o1mUOwZx8q%iY$~|AJUl$Iv%~5J{`|RY z&`J1eKF(A)?cNmMgk%;i@7c+ZrRVJ%DF-i^A5Ro%pRqOF&1wUeJlLa~Lfb{3y zv%eMDpI`Io!w+$UJbz;+8K=OkCWr>yus4nxRU*6K!pCdxd(QTQhdD&bYZ=u7q@@cH zJwvwGk^30FLGdBE%kupJ=J`Q~eELR~?#~H&N+gOv?2C}Nmothtg0wn4GW;91t@3C- zkEZ5lf5+7Idz)zY%BwVbnD>%J#YuEk>wAikl6g`*8YhNe|9a4J?>q`kSc9kD55`?I z*Jz*d>FfI{adD6F-#fY#jyr1kpyo@b>^cFlD7y1A@Xu|QvQ(AjeJlH@xOhWTdEWH{ zq6BhdNWB1Gp$f_^dM4HY;lN7WY0pK1Qy;#1TuR2tLY^Y!3>Sd&CZ=cE*`sD(7e34`t=qKw=+UE6jWX8`C~gjqEl(w%jLI7u zWZcu|R-N}wM7dCWe~O)6Vvu0KT9HUG=X$}iQhT(f(63*=V8FW7t|PQQrX{}q@x>+`DSV z#+!#y?cUG&)(@4gi(TTUp29 z*GpW6x-_1DUy5{!{y&Jk<6sLn9b%)u)FQ>!ySaqwvt0go+41CRc@eR6_#*|bdBx>js`dH`?)2Gm}vZ>)p+vG|=7uLSHsOrHD?87){mXe6~wzw!O`Kqft zf^H!6J5AA6+$;bg2f?fSp6Kc7>Pk&cmTE+ft@a%rh^QcD^hY;Mgu8%^#u9?i>M~ZI zRR|$@RE*Z(2yvBXy;Gc<`*PNo(9Afs-&DFJ6P++p$16NI*D>qc{S&V|VtMRhP_00@ zj+Dm7hE%7%N?(|}K);J0Qnp$+u{Y{5$I)ZP9_{ZnQCM}#x_tTZ76<;kqGwKa_V)#! zU4dN`*E_eE@1v%&Tk)Ty5iE(b^3vq{`a?1Pmd?)s-)WY0FE?&;uL|wjJXd+n^q2@| zplQ_+>+Z?^1t!nv#|8UpmiYV%9McyyPD$4AKF;K5O|{#5z3qqhXDvE;84}&mfd0Js zcg*>&mUsD~TqlZ@z|%<`1KPW?9>qv^d8i=H4r*zkHJ`y^Oo9pmnXab?Z3IMsWR|U* zk%FWHop6kq$y`eod6<{yGXDd*p7Tk2uIfuS3MG(!GZ4sgtE|D@>rF#$pYsGQ5YX6N zPomU47#?t@G=cXcV#ll=A?PRLWBDca@VdAmB5bTI@A|zpTph&|&)HX)W7F=n@OE~T zevN;bl%d`{C&I_ZQ@&BE+^8uxJKHfGZRPzXU6hv_%mgbMSPSg}*IU-sYBUeKmzPTj zEk#5KX9{@9rO_Xra8necUKt6tn!jP?b4QAPf9xS!(>P6`d7qno`)pX*>Lxc_*|u+B zXI08Q$6jF>1FpOXJJU=tbPVcf zEdM>%7q%>fhKWY0p;Lm2V!DO^hsde?PYrW4uCV9?C?b5d#8ylN;_VAFiiP+f>k)eEovLy6e~b++}$`e)O=4#=XC@kyro9AFJ3>X)_-^ zju1mCLl<2W{yZropOcTqsa4Pbe1fG5EKOlGvs{&_8QE-7GCz`CwTz9uyrkbXx$#ww zyCQNdSRjJMz0t(c@u3xEPBT%&NmOt|Cs9P6+hm>7_9;~Q(OTD3R*#GE5!sV0952-< zaS=ZI6Q6j^oHpp>c%rSWO#m5d`a1s9m!d@R{qytv6GtwaTm+X${qnr5Ao((sX>0r5 znv>lRNjEgu$zh`Z)_A!dPqB-rtN8I^M^qL{Jz9Du`MC4Y!YCp=qS*NyXq8VDUjB1+ z0#^ou28W(!b|22oB?8Tcp>12oWtuV!ZJ@{ZPtURQH9UQ^xWVuPQa_auY6u-tzDXh7 z!{3N&I2^xOiAZL1m4C^z;h4KZ#wP>-K-Vr{(5c|@?WmDaCiTUOt2^x5(w{oLmvM?A zBB6)`Q)p%$A2HZjC1K+PX$bV{FTjvR3ynubMG?jUBt4wt5N}$1=G;^4^05qrZ~DEB zY~kiz87lsM91JbCMJTfn=0gf1IB8sp^M@yUk*z`2G6e+=f!933Mw*7E2@j@u*@cJs z`4(jtwzF&^5);0g*KOUO@}{fH`(_tT%Q*gh+Cu9+4LCM?n0HCV;IAMS`VL8TSlBqk z408Yze-lYx^#wMMeHVTMPluV4Nu}9Gc?FrSR=I`6k5z1rgN;acmwdXSXAEFq-tJ%@nhX|v#I2(i~{ko?3}zH z55L!1JYF}Mx84#YvDO95#|^EY&wKQ!A>2o`wP=cW&8CJS$x{_+(xOq;VEd$vmv_d0 zv^E)M7nEz3is9aItlnC>{&iQrg$0$&S_c}Ni$k*tIshr!o?QH4nAjF;mmXjY3yL^9e=yr}9hZR{Oc9%thkcl3D`knL(15n=tp% zE&rbUxM{g%SGyu|BmlbgJU!b)NwV9>doM_Ev`pEuI^ck49amrhZ;2R7l`Dv^vF>CV@RvyBVhM!{fUbP;ZqmVjWgp>2BQD@mMQK(R zonMA{E22C|L6*?<%yDlS8uQ+$bXnH#G*B7g-=R~2gjx;>r{AEs(oUq<#Ecxs8*49H)?s|`=^YRA4KzEeJ)_9wBx@biz*4Jbq3dD7@4cT zQH$FmEX3MU=onhBZp)cU%b`XMxX$4uMPyt_-k4O0MkdD_6)#bC8*$!PA;(R;%B1c( zy>5G>--4to!fbU$oln9yU#4Df`%t_@T(Z{r&bhQFByX)M#)V`bOOn4 zQsTPB=4J83Q8D9V$KDm$?bk9wA|U*k-S{A^elY(|?n{3Hbhejet9Md{y|`#@?umIrSc0Oml2cM-8vg*5ad<5hGO-!~1>;FYMMZ9IjP!2M=rO$=#Q$)8 zEtl4y!ruiaS^LblZ{NgQ|BP9zr0f5KLtPuWtp7YX-0wCG^AWR{9%>8w7=FZh4K>A& za9vmMID<>58<6^DQP>RA!tD6_Bg$SMOAWU_xcCpMKE^vXAejBb#3yNxVyh-Jb7P$-WnRyJHn$n6^;g zN5gP`FF%cK?2ug6qhjY3$fT${cWSY6@4l8drUPXpGN_4ccp$Z>ADh0Z-7PCSwLXgR zBp{4Z`>8s9nzY1-Xl6AcZE(v~6oC@N9g_}K2a0lG?A^McUC%H7stxz){#f(WH#;W> zqV^zT1=NdU-@f(lt+r(kf?r~DfaycW6B-)y%Fo2dpxX-WGCF*?$aSC=L1<%R^SK=l zDp*5qcH&#ZQ(?exgYYr${$)i@x-+ftbZSyr9D zpuWC-K~lgzt)0KH6$g8zq^1seiho7ykn5#F6LAM}_drz=#C1%4;0iT`rs2nN{#eG{ zSuKqVY0w&)o}1h-lXB7}@T3gPV}m*>7e);m)5KdRK0H17^bB`}@Um^Hg!zfXhl7&u z!ehKnS%ZVY!uJ>VEA@ZZvo+4}?sXUOi@l$5k(Znz_%uX609d1rv9W0iv0afRlS$tP z>8zCu$fCr&M;49K)9XbE?yRz@p$&;;=O|UAhEH4QsL^$^V_7D5L z7`AQ`L0q>Mjg^5W`G!ykV`F2PYZv(L7Z)Gv`UThKFYKz25kLuc6EqPl8L^tYJ;e#B z))Z|=$FJ~*fLEcmx`RYqggKgm3gt9!)WH5HO!g*@%-_&@CdQk#s(wW$rn4 z=AI|3>A3)r(e>kYsrf0okKK7ql{q7Gja74rE3zIXoQU3wkr~9qumx4S-M}`U1Jd-K zqxv1DhngJf{CnMPAw)*8R}6n+dOEL!=L@-oeIDN~fXT7PBUW%uM?QK;VYDxOJ(J;C zWcEVwk4-)E)jVoE(BO_I;9ZD)I^wnS#FG-#uSD9Fj)1Q$%Kwi+f(UjQebC_S@Qzwk zzt4Y75Cq!WFh)S9^9cfX4>Fpuv&7r5JN}$wNiUen!x$=A^b7s2>9gSAA>EqKibIQ;T5~#@J zKT?es%t4AldnYCS18v;>yu8Vk3I@&DOJEprw14<;LPYpsHj9CtX46(Z{rjEZ9$_V- zN`>~u4#`7Rs+^LOl@-*~Jiw1Q|HFq5_m=L)iD+K-rbwJ}r&$IC0!7M_rYsY^^(s*o zgZi0n7jF&^TexsSGX@{*JFtwrZMXp5;I-h4WVj)%`>U=#Tz|H0Y*R;wyfCBs>#h~Ef?<&w|@k%Bel zCuWj`{e{=8F8lmMNI{+o_1kqeA{W&$UWjGlGI`*(L`AQ1g3K4&4YY|rnaTa zVF#*&hjxdUSV!m!w;PC{CPX{1RYcs`)o9i=TokWDniFx|<h?9wFi5=d@2mV*E>3)CDH>l` zMvd29dVT~VNE`x>QL3#kwm5U<%&N^ei)t;**dv@P9l4r}MY68Sx)z*Vkffe@#m=;M zGx(uGlb5qg4zf}8mqj9WMEzTS={q4CN5~>kn8*Ejqn;@R0XwQ&wRHZ(^o89UP5xEm z2vN^O9$zNURq5OhsZ{IP*;!nIMiEY@zD&aOSkvi8qRs z=Iw|QdUiSC8<*_G4K^{E9|EP3b@B4D*&ob$xr~GqtjqAjAy^3`xD_29&$F_G$Smvl zG;OfCejnUZ0BSJGFM^g`@#WPud~ z3AZI!y!lhBc?UiDULFcLOS?_e_$}0=GHdRFY6SJ+WgbY(gL-zhYx3T8mp{<=Powe8 z$u2`Hhv7?8ke9Fp-3FF`YCILjKfnZ*f9kjgW}h+>50gMCzhu3?NMp$_L`5_VX#HRD zmBn)$I%q;DhqI{P%HqOIQMlgPdtQ_rh_ol@+&Svs%EsE;Eed-6yI1r#FfyXW zYLB$J3+Cq>90IP!WIMcMp#9>sJBP~Ro^|DVa*Hi^kcC(E4O0aQtPah5X!nMp?-G!< zX80f`ti23SdKp;&81r#J>}qyyE^AQ0f=WYbqrrrMznQJoz+QKD=2z@amn)ZJqzyXV zOZg-#j*)>9QOR30oIsGy@$tXtKO|(gHrfmmG-9>gwwO#bR52)uI=QfJl(9vIBjI$a z4x}HN_B1xWnm2|Q-vnC|O1&_40Y7BFqweW~H&eNrZBXN{*kJs)Y!92N+bbpU$Am!x z$nsCc?^wUjp>^koUKgqk9pUu32SJEWgcP-X1V_F%&SIk32oeP2wGAcOm+3Cw>+#vy z-3hMdm!Rd20RzRvN+Hg-`XRTQj~LAPZ8t*G?TyqFwjZ^q7C+!X!qVj`=>BORtLDNQ z}4RjN@?p=IZ}kO|=gl9`~$ot*5bsomc%hk5RfG1nZ!A6_s@(5j=LY6{>foV{H` zCppp(0(l!c5nTE%gdy{s@~kP!#fei;Tnt`l6~sOSzz4FandBn}YXm!FtiA1Lc_h~# z@R`({evULX!>xP_w8aLVGnPk3t+%eP(An;V6TS261)+q1BqohMH@>6Wr5bAor07=0 z%l&w(>3-y`#j&e|>fQU-H#vBkT9UTyk(DLjvYjW3bMy0g7_3mG(lfIW-Y#^Du11R1 zi`J_|q~Pxz>20(DuN&7{H&PfrWKQRgm0M@Bee83ki;7uy$ zt)!mgX2?V<{$K|NRG>t~8FyMp#>dhPau49AZKr4EeNcj8Z#$&QfmsA=^I6LtGqk)i69%nlU5;^tK)&uV@qxQk=={j5&|mB|`bRrz*Uh1@ zMrf7$OX;SU>2f>x*pN(t6JcXm0%q~#pIY~5v#~KAhEPJa>AH36(EOtnE=eFP69OR) z1uNB*U~Qs~QGiW?h{ph&cg4ysCbL?QkB!idfo9P$H_veHftj*iVx7!aY2NnhVtFic zr$qF`mQ(CCBC{esavoR{m6b&$_5icTqz#H6SXZQ=eymeht^V+R+RTnztQ&C$1tk7;*8odIwsGS-#N@r zZ`j}sk{I|-toDu_JHXL@H1}oqW8oQ68M$%(_RI{*i@GOTdOL1#@a=|IG2|8w3$?yG zI_#gT2?ITPP! zM-py^L|f~Bz3>N+fN?18k4tPJ0R1D zaNkN`7NiD9MtMEH?VqOID3AypV^vz~A6=IU3t z54$M}2!N6ghU5uf5oj)aVVULgrF=hsZ98-mL7FT-|M`RL3rm7|BXWgsE_HNVLbfkd ziD6crH^c3~<6QZMlhu{a9#@Xqalw!|W*&hu;<~1$rlLuO;%5P5W@if>w6L&U8C&Pl(pe?uN}yHEpei0_5^~oX|i1U^9xfj z0`kVv4!K?Iz#i0_b6k?NfV1;1sHL1JRtbYn;)UER+&+W)_$-B~@5z9d=9FqdOC2TH zJE?UT3y}YfW%AXl*Dy-&GPv{I*Ue#Yyhzirbtg8j`p5~R#$=*OA!U_19OM?1D0%fu zVAUXZNQJ*P4qsq_7*^&vZGCqLR?%a}zQ`Z+^<5&uEKoWEsis$YlvnXXzdIGx-HcaA z-mH~!x2h-X##6;7pSb{=Ris;Kjw*ECkrSPKOs<^jUhfLQ}>H-W>J;#D~Sl4 zY~!5UlApcsxx<*uCVT$NfkqSMTmJY89CjnT%DJyIy5Da9z)#9a1r48)VohWxd;&3uCF_{$eeW^hA?qV|uD5m~dtO8m!7nhGtR#K(+ks?26-Fn@1u zC@M(9SjLD`wNSy9j(9bg^7Y;fmW$6a?kPrumZJZ%j~WNYv`K?oz+eig#waaIOD^FY zhTugE6j;QDD~BIx>_#v>2A#Yvc7~P^pf`Fwri2bpMP&^Bk(jHaz`kBbq#U6_DbFkS znJ09t^T<>Qy)lZhOoP)UR+K`MakK%rn>)p_wTwQWxOPQPD@BoSjkq$~ko6+Lv_F~X zdG_qg+cT&-2pgxJsf&ZdDz*Wix`cTd8dU^F;b#!1xK4i&<~Rk2d0sDXXpPXf)-o!) z^!*dQUQaQ!7S$AuKKf*Fo9zXL4Zn(BJ6ynFgHm1R>jbKNq?tZ25eKzYYE{RCqZsx< za0OVF!CmWYl4@p`i0_U_DSzC3=bls8J+Kx&z{-hI;6%z(E7F^25lY~vm8 z9xPc@$o*BG75cB2T`yII9US!;!NG;QiMO7>?C!PQRxa0T%lUk-RaK#(g#hjj*$6I50 z##1`GuX~siLt`}maBXHuAxkt7$q3NfrxD(HK?*N}nt?$ZIMrrSt6MwLZ z`f0ikHf$hI?;l>due>KxxQ22PQ%MN9d>0<-66RR^c9!jw1sac(ia!MWb5p6@kXju8 z!2^C^0*nX%XZC&LQlH*zNdIFtkuaO8rMyRIn!qZww6t&zK+P?f8GOTCFA>NPPaX~= zv{xy1c_SsvaDhpc7*Zjj^-;zsS^T7U>!9}Dv%R#IG1F_ebl+$@jSZYAXMrW3U$X+Z z*Sxf34~%ozcW?ZO9w5-oNE~8_)%tU*F!MWFG*!r__EHl@NLk z1eEpy7D1L^rkrHfLbnmodjkgq{&}>u2-!w5*A@X^0lRLdS<=BxJbrK7IiF z0BR9x0HCu$f&lbX@p=)iR5pGEvdY?{Mv`VFQ^5H%lzsnTj~y5wQgg5ZooNtQ80w~h_QKK6^go0#PEemnmQG{xuoPMta>K~hIGb6E^P8;rb^ zr!mr>pD?He$Xv*zx1f9A4KJJO9)iV(ifU zUegTO;;kKd#!lp{4_CRjN?N@Z(UUQFT%t({be-guYP@}0l2nTuH#jYy_0dG*!5P3G zKbYQVJ;**|x`7Qz8>oP62Dx&#u|ymF2=o!Df9&R1N!INQ+UQJS%4WOro;{ycnpH2c zW1iM;|McVPB!GMat`shfPzn8TL?orw7iI7D#T1!t> zTYhm3?8pp~D=wW2R9RH|E7%2{#zs@)Sj-!s6kztvN7>@U2^MAy=0 zt}(D;7@AJMULiG`u-Hby*F!kT8sQFP1)t)mif^!1;}|Ui$fIS16|NxF zTO1Y`vBtHByiKOD-$rnA{+I&iG*rt?Lr_@p#;S+Bne}aEhWv7j#q*1TC_6jtO!z|J z3mcQ3+}F)vk?iLDjg(mp%L79vM!iEf{;BK(sr_=}WqHyw8=x)FYhy+3TbiXCylbNB zc~;k1Z1Mw#%gVO@X#v(wZP4Dyqo{RG@U(wj3mZTgc$}Q?)8M^uEvssMi^_dW5?Q{ zfRigedxBRhM{5;ZtUQ|dN4#MP2Sm5rV23AfgY~B?)%LOGHq*RT?v$reC#|M7h6Oe& z*q-wIz6hYdW@?=UQNE~;mAkN}P(Z@apNp5AkG zFkT+b*WZBvNf+-WRVsTV7eY zSz9qRN@qLWcbon)iLzifBOfPg!RO5LDit3<+^U+9=y5Ebn^(^~2TMqEWNo-qN5Zd= zs{<{TQ`(kI!q-@KUYp+8r&zOdUmX1-ktaHaWX7KLxrM4h(v5e%Dq2tzbf-!OOzVu) zqR0{<6O6jiABx+a`Feii@!#M8cqjN*dvsXB=CCLdIiy;^GPYKy`(d?9ymJrs)ons2 z9Rc{2u;@SW+IV>tMn@*yUUfB&sgInB2Ah|+jY0QANH(u5y`~M=@(-2e+z>AVZOl%Q zaM$Q-_IIatpHlqJ_u9oIr$A>*JKX|nqr`YCuy?sMS9x(gPF9B}+k$uecwYTPEBv8@ z>RvYM zk1*0);T(MXWKr@M`_|XZGPMq7%ZYvKPtysk;ZZlcm26KC*Vj;kGonmc}Li_e)nll%w#c{$t{e}r$)K@ zP4TXcvyTeZ+D`J(g=X%>mAo<7%M_FM$Y>0Nd|v=mJf}9;6=A-1Twl$BbZdN|2^2I6 zf!8tP@!M6Q&P@ovva`K;WPV$&ZcUW`(<3jrg#};6Sh=}OH|IXEw7lQt9nt@zPD(IL zOu5oTGvd1S_BQu_8~2?&Cr19I)%b1VvdJ{v5AH9Q3eSpM zk1y>sTuhiaft_ns@gvESaW1l9*T6&5MW*>@`##FIlRtbt(a^c$)Jf$Xiu@AnClsX> z^70kIWo;RbLnO2NH#L3L#A9Rf{Un+h|zgOCM<1chdD5k#9L}Zc9 zA2Bv2ykbwqVKfE<)!^>0YD9(usJ(UAebu`aHF)r*>f_tgsC$k+Y-x#tq!{Veq7vzy zq@XNn+z=@Uh>>q!eAAHpffPHdJBW^A0}d+$9lw8J{NEG1g@C% zdKBm$dI>vIs3!G+c-qPUsh5zHY>JX@)HM3(D=@|v-N0H0!UtMpz^4EZAOmi({Q)a4 z_@lTX*O9>0^C)PJvGWESboLF(G&Z@YFoFKMmzszJXoWmJwp0RuBr#)*QB5A*gGAY= zkd~3udOJtUb zxw#TVCLhh|${Bi-!#BaCSImo1hL95FQuUQ@5ivI?mdRR#iW3ZY4W%x*ppEXC8eyxe z0!)YT8I!G&Rk=Aiow5^PYtLsIB9?EF)l}OJq(11>n|KF+sqK?n4V%6nKepG>@+s^ zKqfY1#lOLxc|wzk!JUW;VW3^SWu73iW;Qx!Dumio%%}$cZL=~4Q{KG`^?0YOK_`lu z=*S@?Tr<$V*9j6ldh8ftKs`Yn#1z`fc(uuO^};lpY1k~q`Z7s6tn>eV3rzH5@E9|Nar_wEHg18{+l zE!?>$?D!q3zEA=b3Fn^wdIwkoO3-%70svmP0V^T8cR*~dJl~5ST2o~O?urFB(;qi{w1O~RMz4Bp88-qNsp?peMHV6$w*K{&O!~9? zI3vM02$C>A;EU=m-rQp6J3cU!G`XS8L_V^>QPBeJVSx%I$f989xQEVzm`AL}u?Ush zWdbE;t}Y8N9G$t&Pa*0*`l7SES%pKrnw3EX%8J$so_6#}8?y6OTwZuX)PXT7=z; z=O4U~I$1)yNkL$Uodd1;U*6j6GA69Gjm(niv(amx;dcOe3W^X?AporwvFQxYMnJ-d zNlIdFDCe!dwXzDv#=|H1FbKCD25?;w%voeOOmLp;eUT$<(v3tnfGCXFiJnUUAd19K zrg%WPec+~I>D{|`%gQi6g)9-B^}vxg)pqMDtR?98P}W|6Cc<0DY-dy!#$}!4)`GUN zn(cHfKmC>(V)W^>C+r{2 zJ-~IU5au1ie?lyI03tQWPf3M3cV1(*c-v-NH2TRB!?-q9`?CP$qe?{wR zeEozoA=kDsEpN<>iM&xT)pn!}}8>pVU}vgD4<6_A5v%$gvM=!X8yq#&fEHpUBp$BBoAq9#HIVe?b( zx$m;W*@`{Y_^k(YWD=HH)GX^7HzfXtqh(H)w$X++MKmd<5b!UkK+&#V(5KDuA8;w4 z%K^ob3U3n$UQq6Z?_Pf)D*boaf9FMeD4b=ODc7iEgM(3dM)4egP}1=}phpi*`C^$^ zzOUO5uYCtB6?V^e9!ms(4aN{yY>=QQ_;JAY6JDo;66OFk=j7xV`NCOB3}lao>z|l5 zYq#^s6dWk{D?(8RnoXWJR+KXm2$v5wH^pnrpPDDX#3!1mafr7D=}jzD=8ZYPltv%2 zC>;y=;{~8M#6Sx#B6=8n{A-8gE`>d7O3DODIF|`c4JK!6WTIpyG7yP)B%h!wa=ooqRRAhJJnY_Q=Pbwt zfMxJ3}@iiUR!X|6&Q)Owu1u zGZN4rkK+=Wgqi^_sO?ZIh8OacA!%Rf)u4 z@p*6(lrU;k<#*w)C|uI!2sXQ)GwmKh2FWx|?Mx4Eoi`R{Rn3fa1dfnvyX>Q~ z(%McFOT<@pmQEQ!nX4bD7<4&@rYORc;Cm*neXCdf}wCg{RY_O z5>rQXYAWw8$o~AHXO<`*ml?eVS&rYO6(xsJZ@_k#(B0*+@4_fJ$vwmt1XK`rtQ-#v zN9@VGi@RnrX$KZqs;kB%Mae8!b%YDZx#!*NlCDT?&#+7*kTDx^&Pa#!V^p%ODZ*C|iY9p%EN`?i z>xQ+ewFo|cysd!T;lO)&_9!Eo0p9?kCbg*Y1F3PzoM(a4;3nN?`GZhqh;Ja?CrrS8 z``G@F5qSkO5?YE-fJ;IXf4;lG3P}ZvN8#JDCQCAI5BVGUvN$+DKO9Kb$)DwG(Z2N& zR17SX!aGL}`TyZMy6@7NEiW~G#Yp!QpD#6oyXNL2tGR8fx^Zaxm)lns+fi%8#hIsZ zzfp0!D@X!v3bB5udX22XXC5`X2M;y(!d7f1uF* zfMuyMO^~!=p9issO$_pz)9!*t?xt|{Ek6H#wqC^SAERW*mccY;n$S(^0R6>i0$Gf2MPHX|x(mA#A(mOk0l4m8 za=WRJ!2c?__V#~iX}n*ppnThMF?j~9OwRFqVt9+2+q+SfDK*wQSgol#U!Ime$X)t0 z4K@Q~*D;I0RiqK~z~UpHEqXSljd(rqQZ4H6uOc-tsNHtNEXxOHEMu>Bf`uVo50~e^ zj`huAsD>BZvyk~p!>H*kNNseeO&0n4He0WJw&$AOxjWU%#FxEEqfUq10C73@qk5hBOc}>j7&)N`3$xK?pudCMTP(C2o`p! zs4!bf%8hSniMO2v-^wsicFOmc@#gEe;ZXB?7~NmM6%ZO&4C^^+%&o76$QCPR8h$3j zAJIHMn*zCqc>qp|EI_sN_0WyAD|grYnln0${;VS@P3}y#dqX>Vo!HGvynB>EwW7p9 zddH3CC5|5q|ES-ebX54T|4t9x^#rHGF~4T$QAOumiBHC;Fx zVQu>f;bgo*21t)r zz5KBj%0uBcj23 zdX~9o7Df(Kv1~#8pb0A`iV?ySp?wEKhon!NVq*_7V?TRzu&D?5Wz3t=XQOaMEk+YN{si_z*6DwVu3a7VqU{#IG1Ib<{|LDFtWO+I)Z0W9af{(3&O zqn6qv8?`_)zP0?sO0H2m^A}GM&YCZnBQfpSTkI?`5byP(D0l2K*6i8dGZ?E8sTm{< zZ5*yD4__OUp;aaq!>wByvq!?+QU^v|L#nKmtqW$za5o+h4$k-5;APc0aD;4e(31m9>T7% zPyahQKBCdbL<8&&y+6HiM7=oglQ*V)$B5GWeB3zg6Ifn!#d%|a zstCI_d9mvn>zS2JVOBlAkpW`?Z6(U>Cs2HNe9X$qn*3M}`ZX7~9}!83BBm(=s#B+* zw$FRpYxbC%rbI_YE!&UuFPUm1VS-}`=A2B++oM1aXiv!B6ju1!qU@JrLEuAznaH&c0N6OoZ%HQvyX^K z_k!6K3;^>-KVrV5RV_m!ML%#?BSeeJmw!4On05 zMBG?bv;?YDZmriyjD{n$PI#@+RcWSud%k^geMKJ_kVS3YNMZ`kJ@HW0c-fG86ygCh zGX#^sb`2!O6J_xqALYC4Sz9FHtYfSWIq(Dtz7evl=@wuKUG&3rx_O^Z9v>~JOY{+6 zYb*^rWzDnsxV+w;bLn`M`W(wd$f2?*SVpiR>x-;n)n!`Y8E9`ZALX%&8Ft@`9n$poLE7P_k(n)`EU#F;kDD;OSzk+X6*o!Y zj?_fi*e_BehX97wVVph;nFlXW{#%?^{!wlXxZE@PY-_8`-SbEP2?<~u;C7QN5=Sn8 zF>O|+g2So$Zo1yWbtX~xE+k_T}Xo<~J+Pz!}w!Ei%jV7Z#)OP9*H@cqSJ zoDhXN>&kUp7CaQH(3~G3KM9h!5nHeI* zvZGkCQ6dB$V3zj(@B2w*ePU47yl?6Kz2p3$#NV2SBOXgV@fO&?(tGOBQmsWH{S(IS zH_sE(L(9E(P3!w-ak);U_HW;|;N7;6bx&O*bVjnb)OGo0&F1of`#hybO_H8Wm9a>^ zKWhMy&%M7#5X1CBSfb+JbCi@ttH$!bI44;_-TxCD$HcJxf856F071sT6nYYUs_&$df`;TzU3VRi^z$O@>k_1(>}&_$2|30l?SbtP zWsK3egq9noi<2|HLFFl}!*qeF%C`XI`ECNntF>Nf-R$UDbpFMNB(vcny1(BysXt}w z`*lH}mc^{0TP88{s-Q)b>0s_gP!&gvb zbi4iLE{*G}*XO!NW)PThT>MFp@8%Mna_hl8OqY3iRWvZvwSmi*jbGCU3Yr>A4&Px0 zHC+)-@D6@e{^%=XdF8BQoO?@*I%Q#^?{RsZ#rVer^Vem^XGHvZinn4`w)&M1(>a19 zU~~9aG13l<9T3_D%tbIpHVrA?!kiW>nNOW3JG%lOZ~^YZ`olU+_k3AdJ+SJ z8hD7fAvlUZcziUI;9+Gl?+X3N?lHXQ1V8pWjYx$fG?tIoFwn(Fo2Edsb^|l;%6M=!6$nipASe;P9M}a%&M#l$NU8TqH{qrYcCD zfwjRT;cI8N)g~9i6W~JYuMPxe!7uAz2=Nc}JR*K|QWc6Zp&b9y0(^RVV+LlgZ)KCS z3rIB}cnl!CDqaU^6wBl#*-F7eKwa1Oop4DQ8~++_swz0Q$B3)g8B$6=fO3JVg4Yg+ zMY+S{dCTLSsoVs6tJ3(-AVDHR_GGb>8(&jVE+%&Xir>dU@{FH_Ukh9OnVyT7y$Lm` zpAYG=(gn2vAV_zk{f*Zs*PzVKhxUp~s}SrFY?g*R z1A24DUExThyb|2C9>q-9G^VY33)lS?=KK|Pl%BY!g&0vk{&cG9`%Lxa3I=tu7KwT) zR~;?7Q%_!w zFZ2^X%dktQl%kTT%P42Y37?@DUl-MyoVSqR@m2 z%^`#kl}aN;Q7TGlo>fv5Ns}~56GEc7kV=Y5(u5{dQX$p1pWM&){ds@A+xPsrw`aSz zn_BC-&ht3-5e=NOk#%)-h)MEQ6)DKc!RkoVqxeeAJE9u~A#@BMR0SsXILi^_`)T-j zVg6N|&vM*-eZw7$uJFfxSiWk>ZiE>+cONuf5Anss#fK6H=k+V6UY_7Gl;q-i?=FAZ z)zx+N6(FjufQsHdICW8U#>6Gq19zA<6)NfLEknBL)NiZ4U!oxc0fvAFtmQ8f>?PeI z+}0k^!^DgrFQ|J}X~m&8o7S(Q``5>WlnnjhJ7Z<=Ho$%igTeP1 zNy(8{^lbiPWeTU=n%ASuaxe#h{ZIG=Emwj0qt~Th@g5l6+-d>sAQ(#j ziLjh`tZ9VT`3);oL=rvNf70SLa5rF3^|{?^1&-8~Y*`W$GY3Zj5=ai`b1hV93jK*J zXTbF6ex^-@$GV#BDMfmIQP`91s$&u|4?TKtF5fY|`#I-k%scPSE;j4osWiiaGvh|`)j!VW)X=Lh`w83wD*`$6BsP^Fm z`v%w8y0wu~Uuwgz1bTJOt*d3@M=C3K)BA`TVZG0ILHM8umiR+F)L`#CK2@`qz%?_i>x>MeuO($>fJ2t6C z-GOV`mHDB=mb+Bf9FX05Ms`tSNL?LemmtG|93^zq1cl=46fS)==OL1Bt^8a zZ_~EoKqrTmX#xr7qa-s7;xe%r9yGd)|9rj)&~=(@NWP2It6iFbuFtOi~ZhTxy)#dtZG zkxYqSYJ*c}pK3EgB;Y?kdiR+`*!zp8GbUKA&_M0N@`OQyh~R;%Ox!C6zYTAf-jg)g zlgnK=s%bb~etqe>3r(krq1?K4B>Dn#?xS4RK!>aC_Wn<$4J<8lhm!BqOh%|nQz;mM zXsq=#m5nWq(7|Y9RPFl}? z;=&tj9}atC{dZIKZa|K=!T=lDwOv`6nM@4WxPu(EIy^c&*xTHUF4m3DrlKJm1OQ3A z#xqcz#GGg^^cw3vQM2Qtr`ckX8s@Fcn>NWbP{2N>-L$t^jUf`gr?8r9yN+TQ0bNJB zop9Y9##s)1KPe{$DU^dqmpYp)$ES>pSjEzZz#p3MZLNC_YjZU4hji31Si9R0g z{8vy$FGt-h?nYAEL*8#o%b1T&;d!xNK*p;G8_L8J<5=(F!dZhjs4Fl;cL585_{0SR z#??5Jp1hYTh7UFLjQE+XAvz|e(7E}Q$u2q|Tkvx!V&1_4yNSke@W25eW>?K%G}orx zwPvUsO*EZhszH-Kg#3V1cPYYYKQJlgk{r67ZP?b;0-H<84i8E%vP<@Lld{SJS zpkHoai<-}nC0(?JRioa=Yppq)x|63c`UnaL07w8I@b$x!WqvwNI0r*MX>itHxV*M2 z)Geh6nQ1@r&Y;o|JJL3H5UR;jgkhpmo|X8#Hdt9V=t`?*zwoxJG+G5+@_?@+J_5toAR?K{VcopT`C>wxnQ(WwYfCp>F$#kW(U=}a1G&wtCy%75w#w99zu>qk8gan3i z2edzfk~@^4HHEk^#?*C={PES?k(A+m!a9#`!-Ta={4aRETY+wLm*SXTfEz{o>WAg@ zbQx;Wb;Qgq%NpSNm7()JiRt?Q}`><23MHs6zrbG;_LQ=?qnjhFGhqZhlwq_ z7NqSm4rYXtAeP9wdqZ{ntMei|4#~umg3&BTY+aBx@abP#EX-qcFy^Xby`)PC;YGvV}6_1N@J2{}djmAs9v1`-+R> zH8#e_^HS|dxu@dyhU4Gq6zVZi9r3J3kWVRwkhsi}k`inL1N421w|lM^jD<7}QZlr) z#ptSoHUq?H7s`-Tk3mYF)TLJ{UqO^=2du(ewmZ8QQyOwj-M_v6g>tv+O7<^s!Lpl1 zD~9^=|17+>XXl2(=0dEAXhT3*s=}8^VhVFiqQq%ONFz5$Y&E4C4`pB#1dUJ`zys)m zVT+U_d_deP4(v?>;mfU}PhwEOQ!nQG)A}bLN#?3ndbR@h`mkZBYBH`9K!npE9rypm z6cIv*X@!I$N>HJT$a2I1+F9y6%!`7>F5CmJz>gUlliV`muu4ck(u9dTNs+;t^a0;d z?tvE`J?Nr8MPhppri}?DQQj0mC<-(mpo7G8hQkL2{)`+F5{vl?3smp;A|w>}wortZ zDCeUkVSK3V9+F$$0Qj>so1m{!YY6xYS|M<**mhf+${~10>>CA*_%HQxtm^gX!Rq@I zT1$l}0K;C~T82S`Ck1ySqYkbrK$L1Rd=Yw}3x+r?clvQOtCh<|6~jHQ|3hMJ0`^^( zFajfua!@X1Ifm+_JE)Kh0?23FN84AWw&=dymYa$@$`Ugkq*POL^CW%}Cfs{Rn}o5K z{uF>^_oZ$_dlBZuK5I`1e4g+cko=z$G>Gbyakt=61Emr9FwJaVEDvKndy?AUt`t;X z_UGdFPUm5g@;NTFt;56NDt3WeI^0t3k^kRUz-uxfnV?u-cIImtVt|l_L9_tiOW0mC zOB}3KF-&clg$@Vpy@a)nU%BT)i9LJX@pA^1u{*ZVYyl`Ie8O01RV=G9kAg}NxXOR)cB z$f8>PZb`{&KteO07HZTE@z+gxDAaT5T(FAL{#pMAUeU9qn1V3UJ0xxJo^g^trIET# zn9lYKig;|JrZJRFnpIg93AQjUjxRLjaI#%twKn3i8h<$H3e z^<-&I4!#K1z`d5FaP&0oYWhowm!C1ChTVC0yFMrtB2Io8TaFvk95q*!kAdoPv)D-E zz){OK(i&9^>DGvLSpt+ z+CsLc_90ugm~e8h)c%tY%bbQwA>ZaAjumn^gTr)2 zI;LY1wGg3%LAWgW_kGuxbb1-SDpkpT2gHIX9Do`Zgm$3sJ-j!8S-s2jv$@)l)3u#TR@qJi~jVIoYE1Y5xV?|>K(q*|FFToq|wg&{)aLiZ1h zuafs*YYH&lwhJ(lbe&-Ru=jZZtLAm)e;5by?>1w3REWYU$#unVZ@^Fux8}!WxYv+1 zBk17tAS~K%yw2{8PQ@%=9{heI?&?$uEtH2Xgw2h0WV|UuVRBvvn9Ov^$dV z$}w>v+NuwNJEv}vJpyNM9?pj^Za&gNx;9vNaM@QwoUMu!R^VFWiwonVa2G=~#>r^; zJ^Zii5T+q(%P~E@<;3iVcr^V@dTyq1WC$MxLpV3jG8wnkfsG-WW?L{;T}-FA^s^tw ziSAM$YF<0w7vR%!xiD6S5fFiSv8L?KI8HT1xK{F_d>h_K=@Y3dH}hg3S=Ekm$ZSV5 zjnpF#PTuGpf8aca2Vx!=O!_jb9VPOqu75fG%IK*;pP5vQr%xU}R293}lC*vd8aSIM zknk80U=Vm%;QeA%HkLz%4W8=^tWx`)>i$@&&-2^P(a{lKA-=(kvER5le$S4l?vmNU z{amB!%2Vip@b3WVqjmZt`QWq;=~3snZA2w!?;aNy9{5y#emjfADEmG#*(*z2Q>+JM zQK^QH0>`2w0M6O!nj`5P64fiIlqkgQT(ylEd2>5453~|411|u5A7HYO{v0Eu{23#m zR>4=SrKxCVEh$lYHXm!+f7xI5BHQo#DmS9_q$n%4si=MEW$CBaO7p^n%EW-j<9d@0 z-^4)DW_vnK0e$TfFz7j3UeLxmiwAMwok%*WDzdfucA~WC#Rek^x=V1FBhP??`NSn@ z3AcQV?3#0nRp%=A>LE_)q}3o83_?E2?+Vdhfx5XE3W)VAq3< zlsI@HJ`u7-G|_H-{g4b<$icZzMq1PEKRmzLWqHxcvM3131i!{YYy5=YCD`_jO88hA zY3}>nbX|z#j6FsMI~tg>rFivj40=77sAz0sp=9_YOW7S1Aw>Xqsb z5FPLR3w@S447b0@Fuy6rU5?ivw|D#qo?R%NslAJuD#9)7B z()qhiM|ow%mYgkYF%qL9k>{l;8O{D_&+~2@qf2Cx|BQWj4|TrvUgP*|&1ee&$kc|+ z`RmM*9-X`NEkudLsi}BQSk*T5qUaFsB~09)Q$@IJm0|`-uK4z;9?Vggu}799^M9sO zjk$}B9zU7^F?c}Yh#0Tqu1nh)n!)UJIBgi4`UMv-*W8xdF{=d+D zaHXT#?X5=-mV=A}p4&5&H%gQt^El~KT$WaE00Kz-(1cY3-F+d6qkZ<9m&W+-8X!>@ zDAjI*D;s}N^jl7rvyMzgn_d-|PS08(^Dd5BbI|+kChb4W|1P!uH;;#3-?~7O_Sb@$ zLNXCPO9ac6MbVu%Y%79QvHaF451dIa4k4kij;gy4_Zh^qlyMb|C1rJC z3&R_Sq&UD@c)17ND36O~B*)Go`U}{@6oMZfoc@HkHt6jyUiL>qHGJQJilKQ)QHpIU z>Gk+=$W1AA33~~a=VN&3CvLT?hW{4K58Y>rU#|ZxC_q9%1T-a z)5Yz=J3Ja(cf-_#><~ra=(huElHo@v17qbc zR}@yLj?n2n`EQ1kw*-*kfH5M=ajc^dXweWNPNS@gss&#ha|u6WY`nvnZe&j$H zwe{tE9lYiQ=0})&qvPw35R7emIgb$@S;`CnbRS9(m4WoGntnW4D8Dl@n#5A>b!(;M zyzRkKXM$lt$WfAyld{F5M@xcE`A@)F1|LfDRLU0bqe?=CZI(Whb$U_(c@ldW(^wJ4 z{S`hf1mR|8)|NW|Tnkdf=-|PlNuMhg=g0M==+je;S>&}}K7kEm7tq|XV7}e5*n||$ zui5{7)M8*q|7|ocy{9XyF|CM=(j{=k}NEi}Jk|i($$@{|m4*H!g ziY+Baw`}n|M<1sa|0^^|7y*zpeM>6WG3T(oiT*e<1Ckt=$@w3KXg^Vd{=7JaazQHm z2&2!Ey#iS z?)Fx!53K6L$lDCt!d_Xx7C6uFc*q&>X8JsHivl<;pg(ET_C&e*me|Dx1RaB8rrBLS zp2VEH+xU%@Lb!S+>9fd?#V}5QTx2SFSZr&OlCFMNdLGU%AHW+`Rt% z-UH9V2Bcii5KxJLCR0nxg1k}8mrCbPIFUV$tbh4 z3D#2TftuT!7=c}CFn*Bm&RqSL|DicWg~@!moqMp(4U`W-L4bx#68nR#RLB;aen3al z(i#kC2SoM#nF6yFH@*ay+rk%kZuFHw%$Au>yt~%(Bq|<1Z})z>&Cy86QjeKJpiT@# zn8&vwo`EdaKZ1gGyUK(wMr3>ZO=lD43Pb&j=In5*EtVA*gW|yIG|Lvw1Cli}VuF0! z`^50F5FJVTity*HDqsJFB?pg{0fI%!Boe4Uf`JCgb1r=08NCUtKH$avK1s;EiGPkb zPDnGWTt$MLmFr)`2AdLxs48B6@dUYY& z$P5YkdkP4w3QO`XFq;jMprUoQV^D62uB z_-d}3vmZaT(Vl~^f`7Nlfxn7G*;Z`?+>(o)Z#(br!xB=TB$ z$Oo4W4%-!c<&}XMWVg8Tp0ugji3U#!8?p886a_% ziSpu}jol^lb;2k-tK=P>`k0%`X5vpw~ad zJ+Omyz~4WWty^|&xl6y!_|E9?27+6bmt%fDl6p3OQ1z#{N!V1?&;41uCO^z|!p~NA zcHctpVsCh_+(!t&GMcrX3pcApT0u@ua=0phv|j{mPQG88V)RZ}TAoaj+02LmF*6gA zIN08%ujA~8ojBY@)ULVeC`mepl`IGM?tPPT)uCb&)E*#i7fiu=Oj3AbU|GRkr*mf2 z%a>SWyl||N(m7NV)*dNOnM{Dm+7C6*MB9uXf)*OkCdvO48X)3y0cw7(>GNr|m(-9= zJVtyM>XIO@#gh5@^}g;>aF0etm;MH%En5l z3p)gc{$Ob`edyAUI}*-o6+=EIqJ4eqs&51e4lXow{RRLH6*<_hzvb0j2p6M?IR6oy z3!j1>j>k!--#vver%Ms+&n@GSI+g(`N*|7GkQ;+&6Zj4(gc@#6Zxl!=RKiORtCi&X zE;+^}8+Rk)vn{I$Z|8Z$v8MS6B~Vx;iMts`2Et;e(5-OJ-WWgq&}OlVwgyIX_x%~Z5@LL?klQ) zGY#z$1!GX+G?q}eefxC%ps_Kym*3cvYg0;{$=%u@;t9w+9yF4?U{0cP(q9vCVkBiT}09w06ooHC*ZYZRb@cSHCVLGSUyRLb?n z_o)qm0B_xfAGZeY?+o&zbd2Cag=`G=Xs5UN*CZ%dEhjRH7~AQs=wEw0DKGy6KWnW0 zBh0*n>;Uc-B7`hUh0>8mn*WICKmzIZdi^q)CP&Vm3`dCf> zYuzx--|r%*Xk_$bd%N94yN>jw;ntg`(-rH-Qh&q^hb{a1@iA% zEK+AY>#f9s?j55s2kWP{9Qv6T6#S%R>fB>{B_a1#9Z|7A0to9D7x-a%-)dAqU^;UM z8gqkv(C^rDl-}41 zU)X2{Q66E;Wkk5HXXWOtK9K98>Z29-WpSKAP`{p*!Qcd?)O2F`H2bNH#C=g&wjZ9< zgnXGlkk&(Mj+tOIZ~Wk0a$J&mONykl^|9@1o=IxkGVNJr_l9ksMrwzOGtgul)>}*1 zSk-F_gJ;vuvH1_V3d8sfaEr}5gXS;OrRAVJwc~}t2Jm4t$Hx@SP`0m z|0dq>*P25jR}NeC>M+PUjpnC4)hOipeDsYm;Y7c0nv@&}JidxA;)i)X{1vO6QkD#E zk={=E7Q0~Gcq~f$Areo6v@iF-=n%WmYRvY1MdU}V0ljvO4^;|kgVSHs)|%XxV{~it z5G_PRrLN@zdG~zv%`WP_vr=96_bgM0mW2NSwyUp=YVk=OI&eTFSZLGrCbNVk z7VHoMFXd$vsE$7cCqWMH>PQrujDL`{tvW3CCvtjr^P2p$A-YUzo605cXx^OIk^cON zUq0c>2{Wy05Jz6aYZ9CLyMSef3zs-Q#u5CJNm(;|Cz;w->Ux{y9BW^MNQ>=3W|rg6 zGg`la@*tm<^wrHxkIiC(?Ni*^#(T=dVZ37UKD9!VNP@BE-}@@y7_gCbgOjnbPXF z+m=q-#oe??$d;;dX;Wj~;qzXfkLkth^7*$n({z8+Gr1RbZq{?wrWSGA?cYUroUU-K z;>R_K5)@>we^<;O+3tPCUP$MTH4Q#HOU|l!mKRZuNqF6b>#A4MO0R-KDdUpYWGDt$wHCrA&Sm<#`gNKCyMLzU|w=8yvQhQWD6pU*VRw__o_FmREk?LsaB%VHw>E}P{D@}EJ2u|4#QbsMW*3*%3GZ#}IeC#< ztIRc$&Uh`|=c$%oMjI9zv|>8wBF;X!W4>td=@qK*Oe~g|AJd>H>1u&Dcyxixaf4 z^u5bVA|?c9R6bNY2j+;L+Z#U5aE86s7K&hCi91$J|EoS%P4-`-Nu`)$hQ-}B52=KZ zZMgLNp@rBHxI zPRv5~_P$-Ouw74EeDeIai(i(1T;GI-1~Aib1BwG`#pqki7?)Ts z{J5h37Bx%}2gzKW*!>wM?W;=mY>^r5v+YDkKTuS4`;4)fS<>!op0*>63)|0ZOJ_Ks zl7h(uND{GsW9H!$RafC>>mnlfOIrHZ*3>R&vC$PD;ZI;`^$`6ug|p{f_+M{oaVlvB zJ&N(uY_dJYkR@IGO2Y(eWZWGD<{=9q6(dnFD_{LFzujI*F8nPwyRR<(r zfAV`Hh*7WBnkmz(_M3OY`g;qVLkqB7GtZ>Wi`&c#=$j&D5xsa1IG1fe5iI@MC51l) zwA&e0(bf7InLMXC@4wmVuvsiS!xn!GQ}JTj?TAC87+Nhlc#a)zTlmnJ=oTYlBTbmQ zh55OQz?LzD2OGy^`q^j#UhP~r;m2~nh9`n@MEakLpmGAHJWDTaO`kcFwktv3Ql0F9lOl3>kBvesP(a*ypkmSWZR{c+&;fV5NUiP za)V$*P%0W;n)JNrM$^&B8MutZ$&LjeNiyZF@>d9AP3-n`c-$+TarXx%Lb^}DMF-a+ z3l;Rhc`iKl^TGUdHWd?d^C|hKXrYct;Qy@1^o!@>d~w5EvBG=tWyGFz|3qTJ*!Cp{ zjjy;_UL9$q>AKO$(k0jvK@fqr5Qm8zQJfEsNubS|HpKMYY*5o~hkK%SA#m%b3|ZzN zZ50I|kF5^(o(}!(Bo7mzj?Ml$u~`g#Qux6)as;^*I3^X0rTi##Op=ZCY^jz^8~Y6b ziZ@mw^2U%BQ+y%F9%2r{hUn+-wtG!w_-2yd&RZ87W0f>uQa?m7Zv*-$pL7&z`pm=VOPdIoX)`Y5X@$p`d-%E*vD@mj7o zL+km%xbacUuy+bj?Cofl|6`1Jx^72wLvC_R+k~LliZC?30-hKX;IP7#LG%DqpM5NKmz2?M7fTV6LF! znq>twM|%+jip8}MBVgwUUa{{Qd3l)4NpwYq`KEzG|8w$$m$5XR2RBpLi@CutWwWWVu|XVq zQ}U6({}T}t&_5^-fr6`^xLD+y$*}x)#nW|xKhNuM3;qjDDGZUI$hIuvsRlKFX8glE z#^CcP;|dEK*wh zbx=6PX<(kDQZPdOV2YJ~etWEC;c+-syIt~sPNa54+!bRB7qYD2lwPxHm3375Gj3Z5 zC7U0~Mkd$`yq%s^4>Yn}hhJ02|9_wF)nEEX!TP-_O+al(p${4^lczw_%d)A^L)Rkr zk_Lq|Hwv?=12Fzba{u#4>Gd%7i^)b-({wk|)nAp3{IFqe{PaSIwWew$7?JP)XKNGz z?Eif^oD{<2kuUiFH{aF&{U07X=FRZ;#}e^1N%%DN3ssdChY~)4{ji9WHi(-zgswmU zQs|RxQ$fv|HEmkGH#CMMQ-eg1N23N*1Y#E-7oeV2+JI!m;-t)wg}EQ(fe}*RoF6~U zexFvg@tJEfjDwbzV$oYII_#r*04RAVY5eCd6H(Aez39dzc^Y^xV7YckW$a8pCjM55^Z~4TG zjw-Mc00c_&@?r*IcbT0t_-AX&(0D#Hm6R0$S@FB(8=FwxX1@yGf=Je?C=)vOH8@~b#R1?qp68hg(N>zqo;l8r-0(QFYbLt>zZrsAaEqzf9_YyHhYQ>9sD+Pw)iXe@!6p5)b{J4$AE2t$uC^ae zi*WH1GmkO{V?<_#Y$PreX{UD0@P%y|rGu*B6IFY*{|Wi*=gBmpzUcOCb(pe`> z^v75AfT!{Q9&d$MQOPW=+ORcU=A});KA>snRh`vA4S()x~EW@`ySyyf< zd4tC=eHvBb-#Z%Up!I+Mdi@_fldh`PNirK=9jiQ{9Ch@8Y*NhU+z&$`bB_xE?(-c^ zxHYCu(nc(r7bdJPdK``N5)FK^Vm$|AQ=RYJ$XD)A>$H%Bjn)kR{YbUeK^=8(OXRob zIM{qr#i#3_`Q`j@SwX=VQ9Ifu$^1Ty2R(0fAw98}U`I^Kvi_qbvG-!f;frY%%QF3% zAN@^2D$zI~ZO=rf&y3)2r0W*a>@e3r3GcS3!SsBR(l_eK4C`~)~ z^&R%7WEdAJ_pm%1&wsZK!rGxf)B^`b*&jV!`R|Y{u6S0$QS6I8vW7BGYBph>?Bh&AK)(|lGCOn1GK0oSkuz?4nHWb)Me`M zz(K!1L}2?LgB(6~@9xmipO{~i;h!Nu;*MnN5B{JZveyv;nVtRrrt>Qhrj;jY2F59f^iFAB72leXtQ>AXkEvCAEd+l&<02 zqUEIdiV$&>MHse~bjj;vvWc#mR%sIMPri*1=!CH{+`v9hpBN{Ga{TWn*bOce{3s-o ziuLfgNE^I^suOjXdsO?G4z8JB%CNI2LzXfL>67uBr0@Q1Blj|7!Jy5f(BTKd(ZTv0 z2h>$DBOn^6WxjUTq5zXMOg}_3W=(?(tQ<`X60^&-hWGLnDn39h2&r~0k>^Is2J&2{ zx8&;n?|M>o0-y~UEA+9*IrQj3lUCkw3?f(oQJ3vt*tYq^y=+$KQj@ae8zHNqQm$ro z0ULxa@r&CZ6c9pF(Bqm6LpM?ik)N0XQ4|W<#%C9|9`bbXw-083z**1@XeJmKM%yn) zurEUtn~EV$L~5|E;qPNn{awV({^9(rg*G(_3lCBP4B}$hbpGF`Ul%>^z#>7{A=6ED z2<(#bRsF!H+{Q9cOrF2fn79c0`5N^+?J$3FT`Ur?q zTJX;Z#TkIVFA*-Ebz>P9b#j01F&(x3`?xg3s z+;@BC==ASirwdTG{N#IJ&O(sY z`wJZCTKC1)-}#ST(~D~U!@HJEZ*&dlT!~tRn=Z0WUyQ0Xk>6^D*z{{#P53v!M3kDQ z{ixu=LkMX>6FDZuF0jij_L*R{X6-xFUCO?v-!Ql6lTc2=05l-_Io6&&GaaLX5^Ta@O`RvcI_5Zt|!WkYbt)3+YZM4Kds}s{Q zG?#2D~cue4-#mWkJnHoEs}pYeTk#9eP9w}Fz=C^Coh zLI;WZA^TFx&^$1_>zAV7ti)C(8<~4xhY>%C^$e~O+opZ`zVqRZX;8zFQVV6y-5cyC zk#r!u2q%69gu6ZPn2C@GJc#ZV2syd3qpD_kV~KNjhAfPDVKvrvj5qW7 zhThB3LFmyZrC_L>*!XK6j_&y9(xa(1)t2WNOP;eI^Dxns)cSWMMQY6i7GdQqUWDG? z52oY{S@6&xOOVjOg^mFX^q-Pjpgsc94Pq_aFf94OS>L>tq1!7gS6pwxgs*ROZuZ+e z^iA5K1$DM)th%X{U~g;;O)Pn%^o@KWRDfRE1t&pL7Gk=Hf(BXx=k^>Pr`IVF!cyMQ zcNw(dG=g#((%M!JWN6g%lR7|4*bY3G6=nyFm4QYBDu*B&NQ;uE@V4S0LmM<6ybwGD${_^ z{U;l95HS1jOvtB~?)nZ9$wotEv5PE0RY&2mijRrap;RrpYYrEtH=RjDIRtnPu zGETyR?2vTS^etHBLPs-cUQ)7aICjLy2w7Die)WyoJuIjYha(Hbrr2b|^*0`fnRJFI z4D2I*DV(Uk(Q?B}VS>zrpcA?~e}NL0Hoy<%Qt<^p5_r)B`y~wYhHWlOVFZvixVGyv zWFsjW=hc5i;xf8&`7&hoOW^B(w=2ZCua9P3!M?=*O*`wwpFPTGzdCs1Qw@zzpRg>$ znI^samt*$fT4vr6V#+V*&VRAtc5Sz+>Z^Ws=A)JtmB+w&R9VF;B8>9!fz|d&pYi!& zTf5Z^ZRbc?%wE`_f-OXzsflkqDU#uj#9j3V%r5AV5hv;@>A=~+-_v6!yfooeGtVy= zOP&H%gBu3lSNqTutb6se$fLjK7f{P{42&oKrwVhicYJ4Q$O}#=0_6Q9hj`g##Ni4D!lNVcDRkl{NP0Vk^pxtpy`x1MF6?%9pBIcI{!a_gh417kkV7O~ ztwg*pw=Sxq$sf60+Ql*1O?KymZLN)B)T+ksB-QOr_anEJLq1T=LHoV~w!uD|KtV}^ zeG=4%-(Scfe1_RQZqU$<#4YwvV(X0ri zKHb;2S<-F!kGhh4G{I<~qzs?kWqY+t+l!8C!}HX8rrR03mieR8_G=T{Jhlj4K+k%I z2WFS`r$0VJ2QB0dQ1=Gc^h1%RI}fM}f4w@+=x-1!0`Pf`h*$&O>O;~7AP;a$J;iSa zQJTJr0V+5Hekc#>;U< znjWL=KzMnVT$Y%WrXTRXbmHF(7myCz*R699!`1g*_{_?@t z*$4sh1Ms9XA#INz=uvb07dsscbTV5@*j+@Mq-T}q;_arAKut86D% z5vXs7Au?p4I%t4oMFR7dHN?|5TXUf0#M_EL*_h-vA&V2wGHnfw1BlFdVB1L2 zfPM<*e0TT;L>dfa;ve7z#Muy3WrZkj6tCb&-rzBMprZE_Z7aS3*x)c*6WH107tDGT zCL~EBycz4LI0V92sKW_2N1$#5GW<>5Mq~Ckv>qU=%SW=V zzi4c9d-NVZFd4(`mcl9I2=gmTQ#X~S-smRS9Y_^UG5 zUO^9bLVW}W7UDbnJic`D9D+uI6IAYE{xE7c=P6hI_g!~Sk7;-5oIsa%hq79>bW zP(e39`<(2?^pZU5_%75Dv`!v~BK*f?1%TUNaT_~_8FJzmG*$Q%?P;+2YRR|Zw}Axi zLWs^vrc<29nvw*F`F$9-?S|{PuHgcg{DqRpuR=ZZzKj0!jB(GU--=%{N}j@kz@lyp zal;9-7Fd;+DLucuYQM|1X6@wk<*M~E;cIj*o8B+23B z2+x^}DI18CQ?SBmd+A_63r6FyGB}?FlURrV;40($9TgLoG$efAP$hOS{7sV@*vph# zX36WKbS-()*|pNo;4QhDCBznT`cZP0BV1?5g;}w>g(RIX-x^iq+&whq)u1D;m45xe zYHVpoK(V-|uAE=&^lnpF^3!*Mt zwJ!^8PF?D@eoK$>9^)2;q2wWr+1&hm5;od@3aj8Z;v_s-#;S3(_vg6|4oV&ku6!sFc ziuqa=>n-j|;J;HqP!Zap@e{c=@m}IVR7`A4??@o2douAj_S~QtL;}V`);(|+n0G)f zP>oy@)FT5}%es#EDGLisPT!EL*D{1t>$`(W(k_|7$%kWQ&+SUE3=$bVB#I?n`O*fl z-*uS)58@k;HbCqkbpY=FoCzcs52_-Dp!6%>ZdGeQaKpYJ1;US9TCJr&_~uj&<}ny9 zBq+m|G36)NcC6zRrkL$7@nAzfP-laG2OU1ixV&?RNa2Vk1?KasOCUey zFsyWu3oPdS_L`V-F4V!ze#&=hS<4iYc1~`tk+Hy@g^@jeN``zXJ73u#YpHHZJWqym z#lMAKWh-*Ve9Vv(fvTr6j}yoddWws2J7tVVZc~i1Ri*!n7my_r6CQ4fo7Ipy@K3#Z zB5{sAL7=maxg$2C$; zhQBOWS2ASH5~ktdU;5#)M(Q}o0G$FQukUuM{ErIQA0Xo~u*wRFvJiJ1IXAMRyA*TC z7MH$CD+R>CFU|Pr^Awl8O;=p^U<`Eq|Jrh=RK%_gkc3K~leZsg%mdyZ@VglR&CEOKj7mQv7(C*7#@Lua%9 z){hpRn$Wf0-RA15*pk+FqLwz-GwzF9{FRs$jrpa|A74M@5(=-zXdSk|f+`PsKp(F) ze+X!`28%}=SdGK$!KvPu^_MSS9xjVXKMIz-9=LI|47DBr=R@zG2L2;$>3`%ms^|Pm z;SaChF3YdeuO=LQE@c);8OlVbi`M|xF21CChO}MYzdj`{|Gg`_4eIG*9#biv6}f|| zWCed@z80adcYi1Oi#9lR6c7e?7Gw}qW2=OtzmJ&pQi9d99O2_a`PIA99{5xB`lA%J zsmNv-XxuB?4rvIUa7>BlZoLAJB7YrGr9tJ_{9ED0N70vY(vn*@a@>Srwn%Co$Jf5x z%Z^DU@`LsPTBLFo7ZZTtfX@e*N*=B(bv`@xmUET_L4cxA{J0iTj#-WwBMf0LKArA- zTKT)e)mMF`~M<1eYz zAQo$WvoEP-h**-IZO42-ESk`h;?eh1L1{FxU^BNgp)(tCO2qMorzmtHNHNsqy#hz4 zKZLXyE|vQw%L)JiXj3Ij!oox3w4U;0vY?=HyDUxzN4*roT>J zJ?PN`85={Nx@9<&hrD7-B=kP#ULxuAZl_-T7K{k8O(~F|5GOP&3y%<8QKNvf5d-K; z8hnEdSfQc)+pXFkjIl*$fos{`9}624=q?l1Zaqd$r{he-?UVHqvIz|pbRWS7wtq> za!X4Sw)xJ%5eJ_sIyzJOn`%R?wX7Hqy*MRJ;}|H4%wS@mFQCgEpQZ`-d0Aq-QBd~8 zjMVAXr>H*8qLmMJBz_N+ClR92^t4BHwl?4Lm^>mKlU!=UGQ}G7dPEoPmKcu)1;iS} zNhjaV$QXbi+yr7zd~U?K0$ry?2xbQWbOh}LKkJF1&x>p3PV460;#HRw)=!-CY%K~j zVEA)bK~yIr&^!FI?Jk8%E7gOEo3-wTeBs(CD8B9dP~Ad=y(z9T_(xG9y)ZxS*NgU( ze2iGkK~(@j%fZ@`%opf3Na2LDkOu$L=xy#l7_ggFCLTX*5Hmm(EL)jh&EC zz0j*-7@Q5AbZO~9<2R5!-p(__z3o2o8XG!`VX}GKz|=3i&l|2gcQ!mxpgE^~ZaU)s z(-W1LQN<9L@dwVI^18mK4qyemLA()ZPu8O`dt+R)qf#2;yXL*N|pE z`b%}yzRT4qVT@W~bjLfXQ?-MW&`zv1yGN$+*MtT&x`hu=|c;g#uR4h~$D|HCtLe{&~0S3sPwn2j~t{8?;yy zZZiE%qYU3lIUp!IhJXa{>_Go9LF04D#^FQTCO~1L3N0@`WAOk}4#^FYZzQ?GkI$aM zt-g0vm@5kPKxIsAriH#`ahEZni+S(QM4?|RW1U|30AS#uVXywwLIq@gg(cf5b!8bY z`}r6nHhLftTHfzKNi(%5dW=3?6c72VHsJjdM4hj>mQq;$^g`ea>!lM4v|2%?fobAx zz=?#Tac6d0fR+^;QP5m>;hn_AiWD$N^gD{w(~WAxyQ+?zO5^n_TI6Q?^~_o#u{w)H z2qOwBFApP^xq(;2dz2!{9CXJt!0_nR#tF!XyUEjqoqlLwMh_Zah3-iFvcL^ZEe)D?aE|mkClQ+ufKF{+xsUhr!R-D(2A43 zmZb(~^LBrzwe2&J$l#nL1KzcnfOtRzkQcX0hVNnn8b>2IgRul3I&^6H=})%p$b0N= ziCeML%GwJcWMX3C6ub5T9J7=4%pb=|&QoONSxE1ID)!uSMDSBmR+Uk^N|T8^${vuX z0VIV#dMm)*&m#kU2(AyvNo4sHJ~)}cy!um!7yE!O2b&2Rz->A1z68LbCk1aU53>eh z?k1tat>SEGrrWpa%g}pZC>CYz#D0{x=J4Cf^U!o4S|GKBpso0;=aCdtw2aCYQqtvQ zU|{gC_XRWvG7^Ld@AC|tLu|{?675P$&ONHvRSXvx{*jk6S{x`%fdZoh_(J_v=WY-c z>whfU%%JPQ<;77wfPnUN=UE5{1K##dZ9Wj*pBKU0``by&YedwAuO+ktE#{`CxLWab zkhBjJTLWW8)cEBn_CN(Fp|HL43rOzq{cbq3j)O>IN$F^dfb}J6F4l{ zvVHFHIV3Uf^lon~mJY7VFZfhBKC3I$a`ytx6LH`VNHKa{8^LFfo~kQ5gIv@w3O8t8 zS~V$jPgNs-o_$Uh@zW9t$-*yI{E2^XWVu|B_G%xCRs|r*1<&F0oCKValm6<>9dKHv zLR|OZ{CH_lnYrP>05U(ME?w31d+L~kwTDCm%EJG0Gi+J36pgc<7H{tbj1j-qIaJ)D zAN<7>b@+usrz(wO2G!Es8?`b7*g}Lm+Z@dH{*zDW-K<-N3 zxaPRN3E6w>D_lHeJWa%b?%$?$rkNA7Zf3_R@_pQG~@F}Xd!E8ks; zpe!|=6pWYNxkmyFmq$tkdN@7myW(&_ODfnf)O>AX%MikVNOU-a@-TR*(3Nh_ zJ#ZWg)3c|ss(($U$aW&(J4}-}N(kSiZv-d}*s0rNI73h>U2faJg*6jv4YcRR#*?dV z+Fl*!g`U!#b(2SC+X(!A9g9gx!uJHNj&^}uglz^Lx}h(u58r&{ea}Fb^`Fuu8s;UK znG4473SuGp<+Ff~2UyKCy}-GH5-JTpyKy&UoN1FOldy9*$P zf@IZ<&%&&QrG1ptT}=CK7Taj(hGho`;=3a2pe#oSBDEJ zRFA!d_t>L}*l)Z2berw$G*AC;6BpksLhedf=^)?S#I*Or^KL-Va;- zxt1HXf5C;8AqzIA;#U(%f!e=+zcNCvkUwP!lo`4rlBqHSBxSicv?ciUbwx#^`8wV3 zfAE8eE86JcVYD|TSrUjw-+e)X^6apDBh2%m+Y824N5<{AwR_Xod$8Di?YfI}5KO_C z36O_H3EYdh3CLqoQW6*wLYc$AS96qW&kVo*BXp5z&i~lo;0knfi_gyqOkWR9bfB1# zz<;=f5ooeonioX@qfpFlEMFp6fZqUmjE({Ge+lZ;vu5V4Lxh{8W$f1tC-kxCyjT&)32j?DT46&0OH92?g%-1jBPiZc7e#sG9 z^bt@)^?_U;4NY9f260T<4`G3v$n58`@x1=6N8ZxX=5ZdM9$>o42%U85Np`e!N*f#Nrtd}n5+Shg8UI{T z73v4b8c(mu_1+3v=Ys3nNFl3}UuM5M+&#Gw5+Jk?5tVij}r_$*71 z_MgqWl2o2gl_S#AGvzG2eG{pC^(H_=4u*8#hXB#ZqY31JE7AYU+ZmlW zXe@626N%0Q>4x5zylU81Csuz21p&bau)|?|kZ?XifjqUNp7wfW%T(O+k7z|eLKiV2 znkI-g7#VwDt;YD_fe)TkyRoBPgww_1ESSzvYv``xcdJLNqkF)m>xJ5A`kR8)9 zu|31ZJeRuoCrmLbZ`Aog&l%7M2snRkha&->C6Slno5w7ucw@J&t9yUQQf3AerT25= z&BiD>!Rul&F2UU<&R~v!1qY3KUy85UQ_ahCf85jm?jAoE{%En%{pf|H>Nl?~$IZ0S zO~S&571h%;Lbj5$q@`=>!iqCbF%?TlOGPPa(EBSU?9P@9Z25E=+Z>^FIQ$focC_BT z&`%dtjBgx8&xa2~urN63sUjTmf^tq$_Wxn;&%?27*EeAJHiXPcb!S#8Bvbc;kRee> zAt@QkRERQ$h>#%}N`_J>Q!+;=m9Y?&DO1W^D$1OhcfYLX`F;O?+xzFcZEIU=J!|Fe zc3$Uop2x8t``~%1(w>UdtRk4j1t@H0X0k9A5<*zRxU9M56?iahHO6Jb70&2?>%%$J z4D&2+K71+n^|iGX*7SCKFH+lCgwh5{I$1|C?m5We{N*%K_e*WXcqZ@eG<$0nzeC)7G- z@R$w@DK-X#u0I*tp|Tqd7XcQQnJ-=E+_GhFjiax9_xHgz$L>81^8OA&Gpg%J69HH= zoN5!x^Q!J7k8mEd*xoC`eD^T8);IxnO|@Lb%jG_SnZ*hk6N4X5?Y#rtcMY5?TdBH6 z_LJCr+$Is6ww{P9F6O5qpZS$DOQ@Wel)q;FIUs=^j4Qp(krwmPjJ0p8AH&*CG&u=A_YNbg-FWSIg~S@7J~`~k zQ6)?3NNcb>krGleXiT4~nQqJIUvcI}cgUhh=(a!mR(I{5YsMkmB*NR3^dM+nbtB2{ ze`AYesj88tke}t++bTy281y%s=YJ*WXk{r^mUNAM>*MN^o!x^k12f$fRT{<5F#A^Q zkX@=`BkMR;G?4fP#X@F0zjE0dc*1UHBu(~XSjJmc#Ix2|Xz zj&I=nbF^==neOVi`-}0{+$1~dK&+$J92V=7JczA0_ z7_I8k^@sm!zVS0Y2mY z@izTn>BW9y#m4Fr<7oqa4&6&5f|$1-tt7kf1YZrlkCtqIXyDi~gs3I_~mPgN~*a)+# zB`Mz(5@Be)CUy|g^eIouV^@`_a&M*V&>Wy&`h(Y!=Hrgge_hNrCr1fQ zaC?kfbJWuP2hc{dt2a|VKt4)vHo?~&o`M*_TlW5kplb6^AANuPNNRh#kUIjNtnk)( z&8s_HRM{092fLUmzV$tA9Ck6qWzEyCt3B391&QBtZKb4RQK@vvzTL%7_4;NP_ctCt z5hE2#40AmC{n>0;4h{wj{f|vV*(z{XHQ|16bC9`Q#2u|P_K-ni^%zTB7hcyjeA z{qKLVXDgL71Tewy)fHA3>h4#ecP z7Gwj2yGk?4CRxKC!T)Ok^>**r79s)1DE79&!_vqt-h)*fH?9*LE%2^toe&*(np${T z+3-J@F`iji&nxkKcX6_Cf!KxkoeT#Y9QK^dHIDrz$Lbuwe`SB5ptLhbO(%MS*Hb>b zk+NTiRyALY>AWjX?bxhBL?NK;n+WCRJ~JkFl)|N+P=>Y-MXEf!8jhl_G#s`-=oO(O zhwj}e;GtSFW@KpVUNsH_O@eJJxa$(J2S*Wh!Per< z%lPz(;*+0Nm;y%w)2=}3s!Z5ezDgDjtVsw?eKo7dHd09=?1&N1s~fJS@X>WqN&+jE zaEgz-1p7=Fb3mnDb4onU3-uCGWam(2L<6~7hi)`V=$)HscX2@FLqr`U0ODk0X*HT7gX zM*HfdzRM$L zP(>CyjFj@-IGC?k(}`Lcy;LEh4KUb(j}n-^guoKs;P1aVD=&660;~1R%TEV$Oqcz- zl{9+2I`~U;yM29oa|;+Lb;S-!;w09?7_{-Qj+B1T0sx(`ON48pxrs#cvxon+qau*?pbN?H?}I(8POHbuJ(*)TA#1Z4@|yYWjSR7b z(_^LL2ZlgHi!lE5c~66XA$yfYh>O7q^=S!BjvlX!-LTpmo4pVZOSm^=9Jsol&U%JD z1%|rPh)@e`%VT&oj_j-^1LYmo{Rt*cW+ng@SLT#QaN~%qMf|qYd5}j4dYX?F5y}B3 z0tCV_K1VjH@k<_2pB?LMB%?h|YTR4HhY}FPGW;L|?NP;vH$cO%^D&XKjsJU9=^vCh z|A&J#6fjo{i;II_*<~Nw=D?7V$ylvbEs6JKv>{>U_!CZlgr_2Ea&Z|(9G?;VxPdlB zBKCqGJ3leyJd2|!F?bK#k%cbv7v=~4(rh^@hQa0M;v8EpXXeH!la4*RcXK1rMv@#Y zWQ+b5rYCXMM(nhQ?^+oZJ8&;_~Tsgr!)*(Wwvg1E&K2z0Wa{Nm82+*aqKUTt04J z@y5)NH^|iZ;TC#E3&;*bz0_7)oz^mhH-cn){WGRB!yjk}KJ@NT3jy{fxBXn<0KzSA z!W!BER3b1$Y=W)BtflW&A12{(ibd?FR}=|N&dhwZ{uJlivyvXai#keknJQbr*CN6p zzZQu7h!Yr_P?Xqw6WmZ6H{jT#LF0QKtfPMuyDl+!@v%Aix#Q5@&}6xYDPVTJ82JX7 zBU}l+juMz3knGi7nB!aL#H_aezfu3d#2iNSD4~HCi!%5NhXTDg^V98dL z=j5Y{$Amci1%xwkW%HnXvOc`uFtG<_(-7;DCjYmD2QH{mylvKLwSgT2l9~*;9*kmhXqBh(RiT&+F_A-=^@r z;PyV?UcUGh_mRa@jBVL_Uctl#TMKixkJ$HJaBDY;E$qrp7H+DMtbxUvGe8x@3?F?A z2Nm%+%P_dv5k`0bM-Z`^2>uABW9}IvAm5Ui4`>JYSQu^z+*@Pc9drbn2<%ui8=hw3 zaRJ}y4G+|9z2!ANy`9W#Q57c~syJUMk}p`Xm(G|D$JuPxErUG?KPTUYf(P%clrXS`7`I{?PmL>R z0=!N6+lR?P%@{!e=z(n)jou85m0+Y<4A^U=H1X);+DLxF;2pE-X})o)YL>8i|F=F^ zisy%R%?{Qo^VT-IT?Gi>JKu0dcd|t6!jGm$KeTIJGP=n%%~uT3-`<~C`7lBBiPG`ktGlTGqwC0fh~4zv_DLhmSne59 zo@!k;HXbIYoyEM2fw=sIG=V@6=AcA{0!XLU34_$nStlhp2LW4P)`cL5pPoI$8e?X2 z`DY9Kd6_v;wSkrdDDfqTXaHKlPnCweAFKqmcL6-eBt5c{d1*N`8P*|tOiKY3eb-$? z1z0VaPXo+w8LU(L&U~u9^kD50EV@^nb1HY@UF@}@|F^T{Iz8wIwkDGMqKl~0*Yy@0q2G>KG`^x~9uYx-&MUX(`Bx_Dd zl3)EuzDdM!;&QB=dIc=*!t{^kh{17B^Xy7qQe7y)>3|5izQ8_y=l6(5oos0=@8`fd z07QqQ?IRYXyEuFcJ+)u;&8i)m{(CvzDCdr}x3?1nt1G~fn*-sk1)PDU`Z>-7#3KXT zR6e*$z7zJ;!uw``oS`7M?!U-%paLo6r_oo|3aa}w9_ipw!I{b&7c*OdQNnsQP6z|Z z(pO$tV-kSM!V}5%Nb-@r_`o*)E-T$lzBeB*Yk*)O@SqRCyfCS|_LJ*hvUCPG@8Tyg z3Nb_f46aC>RxxpLaDF^-Ve(_pc_H_OMu(fp&dp)ldFXCU$VJdF38=EiiW&L4{y^>W z8`B7+A@72}1y1y%59Floyo1b4LeGbmvYx$GGP-9i*tnUt&$fcfTs9F@Q%j8Az+AB+ zd|GiR!-UL2%4VQh?B=o`&K2B*@!tvi3U#HDW>C?A8{KMx8xWCgY4S*pZ@o(Opr77X z30&>?&4xYUY+v1PAi5*eLXHRf5$31jd-lAB9t-;l>_*fQo{1&>7W{qrW1Cu-pRfOo zgUPxfc51khz~K(+y+UvuVf+m=2j>0+fDJ_JjPyOM!Z|dg0U!OU6(pJs{%y`f(km-B zx#zJO4qtm`DmI@^CAx5{FU9MwR53jBpAD4}&UiMQ_h}GGC&oWq)wd^XoyvDeowKKR zXdZa1di4OW>$1$Ho+SX;{=sac3KMNkJQVIVmuSfgVlZsI?J+j%G*DZFT3v{Qjs9T2 z*JWJ1XSLxy_?X~@tm0p`M(wbzgE6*}-6vs#Wr%1tdv-qF8BZ%jMYwM;B(HaLRC5%( zyD{tskDw3k)=fNA`?L18!PkVM(_M_qNjMbV@xAI@_l;)|eMZz_*OJm3hY{-`;mgzUb(&o@Avgsahb$#Fzvg&0PGlQ^S#qZ^8Ib;-k}uRJ*ew3o%QR@OL=37Nfn_ZAWdD1b-|P$4BgV>C z9Gw`&0^9`zo>Vk672f>jnFx6O`W_}d&iN6x_0i+a>0uvmlSAd0ZOfHd$mKlqRY~V7_E<6ZEA7q~o>63L_3p2! z&I{Qx!^Ym(_d9U!Ri+XqM}Cjqz0Nezzve6F-5t7Xx^JI6n@3~5KZ?q*snikW0^zDb za4UvA2}cQ>5k&S}?V!`Npf0PUy&A{=RJ2^Y2&BCKLApkWNNCdiJJrVVj!2GKjCV^~6}~k&mA+_UAZ42i;5wsSoO&36RI3Yx?19 z(t!aCVMy!A8Ns{WX4dI)&0TAw_;e@FW%DoeN^;D*JKPd#Cp@n0XY^@xyqwK5ALY<} z?+9IQRi{MVbyO^LYQT z1H)xlM%c!O1k67tO)pk0@wvPd2kfs?MK+yK(%s^`&+Lg}xgqob6xik2KW zeKW{Lm?1GzUp+Ny>ENA(Vb2j#Dpi44RwfrSos;}1GtV!bz6p85Twz8&&d-lFCvr)A z-~A?k2mtuShu2F6&Hlj~iDnrG2OL<_ZCUx16yY6p@+AMq$LbW3|0@qG)8vR)^03<5 zhp%sW?9lzaQYzVz_6_^*zJENnh<^LBb>kyPjHU>yIKuYCcWICx%@!QC9lAYOEX9ai z07uM(Kn7J2XaZq|GCHuX^QQ2qn((Ne24XfEFT~gEkYy-in^6*o>!a^*<29yQ($wQb z;HTl?YYpK?T0c>AI^2Yqy`@Q(Vwizr-u|`pD>Mx8=~6Wqzq#Y^0=;STPSHRm?Ke_1 z|9AgCXGiy);?wxcANV%?2{xXQ7k}3E|5MX7d2Q1HNS7;isDxZRaUwy^X`B8{R8;V% z*lM@Uwb$ay7|67^{-H4>h7#difi#l`l+qddG{wKvy7LktULnmJ9HyrD_&VDiO}E57 z$+UYkNzcOZ+{%?(?bDlCd5_FKPd@RDFL|CX5h{+by&qwKd)s=RNU?>W%t_wIHv23C zjg$TVAZ%6k@C_ay=iAxY*>{7yh-ZEU4v;TgkZesP-rd$pldJ)3dAMh*y^v0@-CF@dqyU>l;@-y;jPTe*yYsKr=AZ!Kup;x&qy?6K{*yHA zVNc*kH9&QF*R7L0Jvx0SY0nEbPD$=1|72h6ee&*1M~(R*uq;0AF4A*0DON{W}<+`YBo&jfq`E1 z?d_moWeJD&jtv*O=|w81DpZt6_XT_ct>Ki|W@b7VL2u#Z^==gy+Xq#I(@UH^h#=m1 z#}A_#vC4y+W`E;|C(2~d{{YqSp~= zCdgZ53W_p&TvN`k`$Gv{mJKZbIt4SEV!~pPFx-c!M(rRm*q1zu#z@VaJ3=;?O12Y9 zA6Oa@#`TJg4OY@1<;bC*#uR%9R6MJIm&@#LB59l@M~BAkV`ZQF9<%wEy{&QRQ6BO{ z!3{z^y9`g|TWk+g;&=^pcsq;3|CooEqy0t_7$WZ2S%aBsy`K7SFr{^R|9>ybmbu}I z?#GTnxr1^ZE92Cze|SVglg-H?bAU0j3g-@LW@ z-yZQLMbdw_ORnOij=G>2l;_+3oko@7_TOK0yDD&{*unDimfb(TSckpH_3G@|G(K^? zACcpf#m&Y1oQZJ)5nF%I$FC{-H0b4>Hh6;NdTMakrR$c%(o-er?m_*xEHFXtLC=?@>eJXnL}hQbX1Vp7b*2_pV&30^Q|Y!Q>)o(N4*j zvv07%i1m4Q#30xO4uf;v(t7>pKb-NdxP614WhH=C1apa7-}+v9E4G{SY%N`_qACg0 zo11-bx_ZZoV*M6cssp}q)SE7{>P{b9nmc=TZ$~O`SF`;zjSl<4J78U$l@x}k(592x z;&P;rW`=-tjlf?PMAlz?rYjnw}3O}GxB6qpNLb$G$#ah1Uz!J~7QiWRFJiY6-O zs#xe>WD0UJ_OHY2MC8%)&CK7S3TU>OX6St~M#_a3{)rP?EkVwgyz_)jUC-4t*nAst z&!E7rvMeYyrfqnuA^_QViDTu-FHo6`dGaag9y}}QXTGYi8HvG!^+LY$@KY|O%I#OQ zL)2&jU6u?jgvp!=6p!g2`kkFk<97~PlFAjZHsu!TdTSeHj-LQxS&|xS9}A()k1Ve$ zcZ3=9=9`ZmWD`8J4VGd_jk`nrGdAQs6Vs0U=B*?VYC%Iy1BfPZT2UgdLC|ctdDqx+ zu}`~^Z~y6#k!cq~8qtgyZLZph!jff*xxbdy*Yrs1&<1Y1TuE(PfqWSPY8m(rP1+B{ zP7EE6weFXxs=3{Jg75jwWSjV%Q7mSjZ^Qjpx0iU;c25M~%A?=(qsqizF0`)}pABSG zU5}y@kP)O5pVA;px4^k9d(Pu`K$}A>UuEM>A8zE7PQvKs(+mWy{#9Uwl{*Rt86~U; zZN4c5^{w9>lrJoCf7A7!VA#BBrWXmo6?$C36_5pLRgB;8HT@OTCJ5*#vQPqr)=_oImcf|U3(=9*$_Fg1CN@Z?j2W&O7&3u$VhR1 z(>!qY-5Hu~Dgzk-&Ns}-K=ELqyejL=_GOHX7)3P?fqIzHerVeU+Fl&=bDOucoXt2d z#G!gE!caMEV^vZGWEBnHgfz9%^l>Y(gvcGf%INVXJ|iwA0P+xU3<0cfe`L#LA>hsA zmzQqa*H@M#Qk8?lC}Vhtd90FEQQPW5_8>4=b-Aw-#lpfgTrz2728@XvMW zUs6G#Z?N+Y$}Aw4gtOT7{n;O}jGWPb2}SL1c)=$@@r=O=LG9VY6<#wq0SE&`tS3ay zl!!=WrRS{VjU!y^G0v)ee1k$VHjYmGhmLV|d-9~OCEenKrUI>~H?qo+o$D0`9@j&q zsykOL6gq%J-~8>q&*C)LgXymLUa+$}(u(kA!jRqah#qII#IPRHuO_E4cf*a>IQ0r5 z_W+ffpqD{^_|~$0;ean|v|`8#^pX(OIljjfPnZL?=W`w9E1P!8+-ja`o9t2p{6m&= z6tHC0xQ&xN z0wvXX0m7kvDiy<1o6hB1J!Oqp5Dvxkr}p*(;xpkAH9movnR%}!wd8n$Mnwt3kPXaqFCZk* z(;bDKa=6B$rHNl*Q9QMH)lt@>#B2f6d@GR=2e1~cBE~h(lK{SOs!PQn4eG@5ciD1J zY}>q-eGQ>4|8W8S$Q#89O4YVA{-)tE)g7xHTjxU>S5$v+Xv>$?0C$q&XL_4#lsGvj zM-wN`WNlx=Dk(bz7SFBoceam&%nxlkAwg$Q!YKt(ItWql!Et}}e(Dv9-@H>#Ex`Fl zcN}f)i5bERlZ!}~LxvS!WHpoU?Zeq7FQgNW7RoF0e|oF-s0r%t$4Bl}krmJ%5SF1J zb?xT9sD()+wpk6im68K^@|6o|nJ!!9A@vJw@wk`$LEM<4qMZ?s4DJ<;~F`()VIsvGF<=|42MqXcU$14EBnRge1c$vGsUJRHT4kU@^ef~flO}%~>`Kk1!L@Jdc*d+Z}Qp6QSOEJF4 z?HTHGOzU?V{6qs0JeP_!ZF>5!Gi+>|N1*ks%uH;bAoIgf*L^I+`0@_L9T1HnEE6Ck zcL{r03VJb->##NwL}*FHp;d(eIo69z?KHdi6Q!@ZJMLa{e&Gs7E+^JTkV<7bl5hRA z=~>wTLXK_*4+IF~by~SD4_1zNE?iewV^r|L=pQk&f(!?QIOZ37SCuT@FmS$p&TR{s zC=4l-AXJ0Qlkk1P?*pBO0@^i5;0GtJyWDiQb&!R>q!BE(kR)Nq36tNZiW&|pL!aR_^Q*{Z_$Uz+ z*oiK#p`pPjVUm0`EljFf(%=LDFJiC)Ko9F_7ylgroYVNGguEr61H~NukCh3t5dXgO zjr3jc$~IZsV`L(Yr-n;ajqNsdd?)2F=f~#Td%PvJ$=HKbM&n)mniU+zJ z?PPoSDVbQooitTfS5_aMlwJG@F7#o*QBMKcV?)Kn#d#$Li@<43*8L;^Jkw<8Dy`?dzb5t=~JVY;9Wi%IxA&*h46!nesoDqWu zQ;29#A_@Tm5sb8NAGYeuH-}pSdEoRA^Ig@;(&QX0yNFr+F?BV zoae^-y(#3$t*-Ht#eOh}$wG7=aJS90{di&7AD+1}CLgAU`g85=o&y;b ztJOn=465d8`L^+Mm%<~z3q;5(HyJV$SOaD2^P!-))iwJ@NU#V!HU@J*Yp#G5ibEfv z;O36LjS1a2Q@=2P?lkm`e(%WRKY>c_U)}WMh31<=x9v`6Mhz31Z2ocy-sOs_6;i$N!mcQ6me&y^I@x}2kCvP#BbDhK= z7i>?0btEby4=<7u(-DsuMTtA_vW-iQ>P6$nurKQ-Mii80kM3EjE=DjICMq`xHYrxG zQG$LCPhE)QF4b6T%_v|%rLI5yJ-#7m@e48g7 z3AR=5tYD!t?~PmGIgpT!9Ao&7g^sZ8pJwM&eR_&{+d8*d5Of;10ArKoWj$y}WLA5Zj7cy6wYOc_~# z6$xr)MLvFMtHaoE6W*B0if!IV>(|Su8HG|IGZXhR1X#@=-&XhMi#6a2a7cu%_*#u? zSN;Mjeea%)eTC?jmnlDHt=*2Z&d2WLudl3oHFGLh$rN`0v-fIzW4oJa2}axL={xx% zfkUidYNfU+ESu%GcmK+yxqgfQ17YVG)$omY9NSZJO_F3~!a5~yBp6HcH<{f0K_BVq zo*>rXNYA0}gfF>q=MfJ`R|HCa!(ah?9t7%r-w66k94`Yc1{oQ%!^lg7wYZ;fC`8ZL zFbaP-G+cRGoNf&Xhx$KybrM5kWJlaREQG5?$!E!)RWcmy!;<4Nh|$V!G(yT`_gYj{aJUE3rIZs6&)3yNMGK z4lbAq?b-7!!J%pOp--gjHijSvpdpP!(;|Ea#!4XLS>Izzvv3RaeG@HgFvX>;!I)p_ zWDq8G_%~BYLqMg#fo-GvJQ4}zBoe8dEB)8uCpj5Sf$%eJ7Rz_wR+UMz;$fzflE7uk zU(@*sGs;mon+|JJ>RnJ`i*LQh=BgWOU3rdkT?0sTLqa^PXq;au zaWaDI-xI0Yyc)UQyMA8zsrF^g4mApC%lH1QQ}nCs^D44tICr)Mo_Ks9;?sl(20FbSde8B_r>y@{}GAbw2{h^60Wn7$>bb`a- z)Yr(W@_|=G5}=Nt_? z#>aDR);iQO=V7?$i;F&D5LfMYm;rp(d9T;ex$)!sbgFgDJtDFy+BLzaz>9;AFF0(5AaQDO~`6E2^IZ(pRrC{)E9H)wgZA-g4x`ztecgz}%^7~w+z zEz2@qJWIE2JC^oq^f7VC`Is+?_0*~Prm8G8dYTu~KKne!-8&w$`KVaXLs)Ax5-l8v zmoRj~1jn6u+S={PeT1_ZvR`j$X+dKzA938kAa&$Q^`%ZoX+Ft*ZBKVr1SNtwLocOg_c5j&-)=T-bz&fv_OVQ&FE1Mkpo*G#mCA?Dr`@ z6Z?(uwuh?Y%k6^KE~X_Y1_^x-Va}<_4h6(*xKSZVfXJuD+Zvioh_`@=no+pEwOz=* z*S*TGTP{I6;8USJh)}34fnp)$3Bx3Y?1>}&Vu1num$OVH9ibVJxzL_nT6zW9Iq+K8 zmvv_X-WNthN^lh!tUI6fq6;TG?-pEY^>^_y6t3$}IPGD#@|W(rU|;n&E?2@RV~7^? z?1`LPv>|w2w2>A@s?4DzDFnoDMs;^OrLj|Atsy_yeOppx)zZiiD80u@$E+&nTM+yn z_C&fsTWdQ%`3)5qX4<*Q!tv>-XO6~GZYX334DC5$&z0fpa%r2Pz^IhYaXn6K?N-8J zcb#%z=x@4+NPAl2jgq66kU-Sv^S97Z?v=&cP<#%o;am^G@)%R*^U_;uo#1IoJ;iU@ zVdQuCiClU#REOMk(0*+o;2v(@TK8 zZ<74On{1gZ{1=XpDAkO>Gy?tT1!B`cSt-ZG1nLj3qK700jZrN3ALIQ(!0sVokl}&q z2r$MH@<`Bcm~y^l<&}p%!xtuIFm?sW;|gX}PI~M+pUP`L2&yGbDF}pa8=4D~>byUo z`^t|>UzmCEjkV7fH;G=ezH{jjg9v3m0E6oe6o(wF!C-N4>BCR`bn5B!mrPmhee3=gB~;_JK{Gy6?ql-!(|8UM5ssS2jQ)7(@lJIe?Tv^v zReJzE+Y0KL8AOl3j28S-;ZQ^kMuFX^%8pnjX`76P)c!Z@t{xH>`#rc(WcTiouP;s`2K0Q_{NoGLQ+F?<|=Xm+b5G3-J|jlHT)WF!2$E3`O8-)>06X78SQWg=dJ z2Zr2H*lN1Ue;@}?`O4h?CQ)6XBeGvee*_)`d z1Xm68Cy=#3t%fQPU;)S0!{$w2R3={PQoyB6_8s-8m|-Y#Vcw^~!}b_%3h(K;DC`fX zaxMOB3VFd;zR;EjO^;HNFZh=fovFoT%(Y6yvNAFVo0YpgflHa@Oad1(>Km5OZ4n!% zScmA%9JXHEXwd7#sSXcyZp$Ml+71g*cWv572CI4P7*-Z#cxB&>tOJkq{P{+TPET{) z85Q}TCrDien%Hur?{bbc0zC-K8H>PDch2PCE~Xa_fbuz;rN7?>GOCZ^MRbWHV1oCa)3i% z;Ltk1EhekPJg2gXtw>ESx}&|l#zN}ItdRDlftTYidzb$}N(x96eZN`ZIUSIsq(o%a zLVJms!nQAhYotw}=`mV5u&qxB62nLU9nD`Syz`AhsdKU#FD~Clmgg`|58o-bZ zW#Q%-%$*efl;1o0Sn9Uyy(8O<{3|#7afHiDWb=e+svX9f78o=WUMbp96wk>ausfQ^ zX17a$j)0FR;9e&yLu}2&;r#%RUYH!^d<(i`qFcKW0y@oY`q~N7R@h}y2>;fQM5C`B zJCCfY{(wf&+6b})P^>o73f}(^mBK$^%1&#J93sSFYCUd^7+iukG=;l#TL zEQqx(?@em>wlW^9j8=3~PKhgA#@_hGR%0SQpn8`57fss5=tjLywM!BiPGrklH1HMr zji z-%tRjSpjzVOqg7N``V#!t~6mS`2@n+=D|J}JWKh6GH?~ati8R#ZZ+eNETp(>9)m?A zrFcruy>dq^QrJSVzE>c%R8P@^?x)ai1ZD;P0%uRs2k_c==jP;?0;&ZDWPq5!ClICr z()yvN$OHcR2H?-uyS)z+3>KU5OKY~pzjqyQg+6hGn(u(mElvZKc^A)@ny|( zJ67V1l2zR;XiueU#2V@e(aH86^-j1foFTG7;nw`Q?x zU8gF^tk&UX^Mh$4-I`Onp~|+~L=>y_W%tyypX<1YL;; z9uU-N?Q?)s5)OCC!Vo&Xm|VRuRu(WK+W022{BctEC$a7ZUF!9ccgBD_MP{#X9^7$;?u3SQ-Aukqii92+hBIW4?;Y@o@cAcJ99aJMW)HkwD^~Hnm%l{I2rXgH4}R@cO^^%33YXMcfWl3vb%fZT`9GdGZ3;p zJr&KtWIONz3GJFZQT4%+%q-QIS_D2=U-#82;{KO2W$GATDB_**SzYX1Eb~R#Edf*{ zC0vGU@42vNm#@MHwxC7_=8c2{KVIj&=+pT5Bd1TfT-{4j*+4qG=gvt;xCrYo0*1yG z{`2#v$mW}{dvCVkfm@le{nJ4GOv9{qGJ-!}&0RnChE$MoLMzZ5*^3d1lXdUz>{{(E zU+yLjBzu|tjof6iBzoGf*?FJf-Qx}(B0*K6p`qz^C`rh^A=_-Fr#m)qP*W2D+3^PK!IwQ{HZ7K148YUGl zjdngo5s_seiXZ5jHQ|GFtf!|ZT;{V440|z}Y{mP2{E0zk+b@)#AOK%oe~F?4^+QgZ z9RYTN|Bl~$?~9f8c0*6s`HwWDb`?vzD;EV+##Z*6;S-y?nd}Eur z0s&)XW`3T#d;f`OeMHNnWADEBGABFM%6B^JC3E&oB?))+99Cwl<>AGZ$!`rrL^#31 z1TpU2poyf_`6O7hphfT+5=(BjNwvKK3cU{Ir*Wp2--#blGL_EG z;H6fIT(U5ONe6K#o;LN(i!KFSnn>VCGx(eJ?7Os3Ha!Dr^1>--2mROyXARu`wi`&`vQpf5~PES*jPPtoO zaP@q2B`KT8V!3w+A_D)(7$=g4g`Q6|0>_wwx%O4D+@wCG&=7xu% zh#vODys;gMlo_1b3-}fewzhDkm{R;Hzis)|9ig8iBX^Fuo6ZtebWl4iEG(o(21nb+ zr@#1aI6@)~#kxw~9PFHWW${$_l9uQ4;WJ$ARJ5cy{h_=_*VQJ916YbJ9m*q_N|KTf zqYE62xgOP#1fGy!_EK~jxE|20{mg1xheUqsC^p`Cw(Zv~5^0X|BziBi+G!4KZi}aN zzxdS-lCDXpmy)&y5nSXR+{GtN-A>>)C90zna6YfNGj5t(; zU#}~S)S8S;r3vqJp&^}p7WH(XK&QR8xA*gB(bb4)H}kJ5_}sSzVn0WGt65|XvQ8jJ zssE6YD9cKkBEXHGx;qEe3&kD+H)&AO6*&jyuwm8-(U@$%1qLMr5=mpv4XS8;U|Lgf z(Kw`W-U16NDHL#s`o`&;zc|haw|G2nhoaLlk4(+U^{#?X{+!Ty7kzE?=HYtX;&!%b zU5#)p{aZX+GTLsaEiW%$SoEYO<%{1s*d-V7kB%{Hta)l%Vl6+Yy`ic+wm#@!?27a@ zgN~WR#6;ps1XgiL=Dr?h_}0A|v7<3s>KbnK{$@Fe%(s>k>RT4DPb42U+hBzjS3>s7 zl1T0U6f~sUo(7ZV`?-RJTK0(me+iXVie{gasr&o8Qmf-^tK)D66-}d~qqBN+CdV*F zKOrFjm#98T!1vM6ncG4)DAZ8`s;!jXS>?RWI4%;2q@>eIX{8LxvHGi+X`~2iMO{BA zz`Tx%6r|C}VzB`Q^Hg2YILfyB^ z#Iw1v<_6MkirRfo9lY-7$m|;k*^UTqPZ<4~AlVSBsu>0SIM~lG1REAc$Mg!j-rKED z?Kod_I>#^zDFNEPzN>v{zL)Rg!>=6!*zER|qT|rrV{vnj72DCzBUBJfk(gr;*(e^F zeAwB`ySK!loALq3&oI$D`mbXmL_jEJH1}Uiw@uU6{F6RXYEG6e&NmQcVP>v71;4V( z@X*DbbSj8Gt4-VYyDt?f|D0x2-GdLObHI)p_GE6XBp$~ju2;Jy!WDMMgr?4VB%)81 z0kas?SNMg`=!0=AkqS>JeQ`K1LU1IH((Z-JBi&mE zcBC1!j~{A%cICBrFbTT6<@4WHu`-Q9ix*Vc4=>t3sZ60G5pU!pXH(g3Q&c|j%MEpA z-NoQrM;+|h{+NpJ$j8W6UI78i>4S34$GU#T?ZsivP8%^u$kbt7AHXTe@`qmQk}kGo zg%eMQTa5l>rl>?w#p(?bsamb|*|F5IlcF(*=bk}1oq(|+s2;y&O0A7l**R~jYo0LB zifOPWJ`z{07b>I}{oIkiv$Kn3{OY%vx6qJC6_VRX6^`{5*Cd(0T~5>AhXFpp1pvFk zEi0#3U&}Lb*AA*!>o&W8dS^{LOi_+uHN^E0tr9VKtAT+;8b2X`54n?aO)i2vJV?LZ ziD#?9O5^HMBb>a6>Oi(^BAg(!MZISQCN-g$S5iV`IgkGSjeRvKqV>dH4m*kz#Dup& zCw5(Gw6kf+DKXJB@7}yNJ0u$G3O_3;A-K?l11HRJckH_vWX{aYe0W>a1te8K2UoYa zgY+n-pN$l^GUwGQeT2y>=}%IdVjcSJ7s4{fYs&DJ z<-@Jdy6np^heQc#p!L>CjH;SJnFWu3hLuUoI}pqZe;gTbYxsx1_Nldz{tgqd&E*r} zmmUCu!n%M6-3TLdZJk!1=@foV2|d$}d#rRMlH@3^oS0jDO5k}&N1p!rK<2kio-TT|OpA(cxY? zx0&N^`n~igV~d(mHu2v}|Lpp+9yQ~=?N_OA{(UdK7$v024(pBRUt?pJ92`z){VeV2 z=s2I39<7D=P7c#m3orR3v*m_zCm3U-+QtvcnUmW`+^QvodPt;fdO3WGo~X`ooHiXX zG4K#U;bnOK{Nq76T(bx;__=P2344%vlu*Q=cXQk7@P0USgScUL=@QDXTIH3e>9$C* zg7LNL__uN;(picCwvnDzE9KoBTeT#E|A9y27&y$%%=|1(6w-8epG9qjxH$Vx?aNL1 zhy`X=gLiNw;w;ax)3({2h`{|lLTpg-YjmYiLb2A!Q?_f%#9$sbmuF%}OG|R}6%0mS zmX;2s7$$DZgj! zm#Uw=`g0Z88tk;PJsy@hhAyV=Fuf*5jJQ$KZ3!zB!tL_&=Y`o#KYirsnkYG4_6ucs z(b77{MK*zkluRc zYO!3S{CQvI|7`k6n_ZVzvM|*AT(EK`+Or2&x z4w8PTqIIjIr39Dm5xmxCqgyB+rW7GVYB*i$YJ2QhWa{9t`!YEu;!xi23*FXT>^u9i zcb)24vIYt}R)hf=WnYMgHO>o@T*IuWrq##F%TKbhMu4wWW4%yoXSM-bZ5cT(GShsB zUnH$c66em;D~$2u)9<-)x$!*ivaf%P2+9%MjHvSSKbo`RS2mMg?x1`ih%0B$3h1-~ z*!IEMj%YVfBXLS|kg@?dpb!06GyAJle3(Y-$?2R}Ax&-V1`Ghb!RRRm$fxy$MW*v% zUS3{NksJKnh%)zb?^Sox4hYQXxa}bvqUB4sjo?={6WMW|Njh3Zq{w@I^6TYpTz~h{ zJ+Z=s7HIoq0u^cLE3x;R8;XBZbiA%y0ohq#@y{V%H-ji4Jx-l_(rHCSZBwsM)&kJb z5V4L=PyJSRg!Hb(iRZC_D6iWmJz|&!V+FAW(YOX!D$FY8VTYMKcf_W^MB*ZaiztSW zDK4~RAR2?!5lu7c2p>G9v;dOC7<@S}%R!bml<1Skd?xRR{le?Gd+m8eIlYQc-w$k# z2rRITzi(gg4xS#O_mqi|sTGw-+8>brfMWzy!}U^Yz6`hC=m>FX!|vr+(P>`jQ3=+- zhx_ipLh!pg02y$&a6vn2h%nhhz+(Nkf@eJ8$r-1_+U<%YnG0`9F%JUAB?7RcgwQ9-;2TwU1Sj1hS0h4d*y(>_*>uLdngJXWZBg~>HL>^GQwNbh);W2QjY(71D ze5dBN8)^}Q23c*8D<3@_SX@*@#H163eBic50{+<^sW^#VWVL6uY?nGUp|c|3Bd03x z%9*P_$aITE4Ep)`=|6df0WoYr|4vWi!!S{w+@(CP8J~`lWRN6Hs`#vmFP0KL-M0#W z59^53ID8)|%b@9@+o3(k5lSg6+^f@yk0MO{T5^;lEUP6`>CU44!^0~Augcs63m5#b7vv(0PoGBUQW}Ps=unMu#ba{4 zAGnxZ5mv#8hpl1liyd71VxvC@_S9JUYS~&bK+ofNZKO0l9oAXhf79<@gdyK4oz^3* z-rysr-G4kZ^l4;9Bc&PTMr&)U4TTl7RvK2h3dt~vj&@qqbw)G?MMX0p5E^K;*%iT$ zM@a{ErKz1A#lO!L+IIilcuW!gAz{ez(`|hQ!~Wmkz~XGwf6}x{Pioi0t0-B8vp~xh z{X~$BBnndBty2}aRFlP0=JHqX?C*yx z!lW?CuBww-X#m>%2w|_L=toEaVEY{{qANh{kU_a4;TkxcdWcwn)d~L9r>|e{XYdCQ;BmHZs!sR!fk%C% zx$h^BYq_mqtLJ8K0Dn;IF8-EMaaxVo3<%EdDlQ#cBv{~A-(V{d^>qF2ys+fM9W&UW z0PJd=40BFzqV=Pt!)ez`oVP%-zd1iW6*efxKuvVCJ$RW5-$MVXU%s0^szpbY8u3%`;zgCb!Dk@#qM5t5Gy(iZ?Me7r(MFi!y ze08y$0HXuemha{GTiC#L30;PGBVGDQUfzdV5wze z#8v>=uM@+nlFxQoIx<~W4SPzm4Mgz{6ZZ(K!l-Um8?-{qE-jv-!n ztMoj3c|Z{7e`^a~T7%+j<4?!#*modYLya*|JFNw|SPFRa(AvVeR5`YwkKoJW83L6} z9CmYc4Xbl!CNB&1#B$>i=xZU^49EBW%Roa;du#kOKX{9pmbCqtmKRI4uGYPDkzo>! z#JrA?Aai?k@r3<2PNi(a$6!DSXjbFh*MGu;_6T27M#ly27XU8r4SRz4Bf6=}DLPkG z>q$193LSI9qE0KbKRVgsX=ygU@1juc7EBBV!&Q$okjj zlvk&eQM;I>c;6P%Oug4glv4!59l$wG-lwVSHE%{mL_`n{Br7X89M@(~1RV{}6mRviYV_gT%X5?w>c+%homt zlfR0zi&f6U=wCm7dV(2Y1~++(AUhKFf^;VrrItNXdXQR6>A z9;Y{OsoJ%1d8p&Ki2646c4?wOHjlcMVt9yJI-KC>7G-~u?K~R*&d_OjuUM@eY0+W> zDZ-(HofIA0#X@K+c4_L1#^BI2$m_u0V^{Rq=zPM7Ck9saV~|&!$?LG**V5X$oef`! zu+LvFy7TA*;X73EAJU_Fv)WoiV)P4ol`#{=tX4`h3JA>{&T=qu3&NDl$0;-dB?S*n zOIP?Y#=+R&_n6P@OAM_p0}b}U-4>&-$NBE;B@qV0teZh?zcN&Mc)aO7UG^w%$^L)J zyY_IX(>6SqP*F<~8(WxUN|Cgsld~96CMlJ$ne61WL^_Q_MWqtstX+ymD}$nxQA5c( zrwE}o)uX;uWHzVH3FICg6k_qEKL7HQZ&Svv5Tqfdi{?**UB%1kn!$J`YLej_91c;XS# z@CTt0Tm_=&(9n>foiSS7kgAXTd_+Mqny}R+IN?I7q)OFC=%EvMPmV&HcW;!LcNM#8BW|p zT$=MuRNA)$vwv*d*bn#nGE`y;ZST5JVI5a-|ALXzUYBjt)!%cG`+*DzTluB zGFt`%IqFSi)CZuY)V{~`pJHIDO!0Uki*@2sfBr^BYF64u3~>5<3kvOrWccp-Ia2^M z#F)|8Z1rw~%tdCwS3L*8@4elE5KL9~2289!c-YPDD$dxP94{EDFllW7&gWm9oxs1j zu4mUJ%pX1DuG3~A$XhULhD)nVx-=zJW_lsIs~k$z&MXntPmSeIMP*chlxp(oI08-a z(lO`Hw&UtH5|D3&ggYY(G~lQ}ARyggz@%Gc-bN=cz5NgFGqbJ#BC{3NqFf#285r&m zfd~`u0~M&FQtfbEu<)CDw}NA?6YunPT)E7A&v!4R!+GLy2cp?oUTvy1yA~xrhBgQ@Af4XI{{&KXrX? z(#K-~%1iyCdv}xzq8Ba37HeY*X&vjL3o(Y%8&w;a=YZ6aJFMq1;(Nr?rm#9o_78Ns zMuUdLcP=TtJ?o;~RiHc8BP^Z(^oG&hQjlkx5i1^tWxfMa*i*z$tfJZi{$g2>rjE-< z4FuA^a(&>XO@&R;8h*ZjmGD;|1%22SNo_HaKC#7t)-wozr}7t)h7%R@cU9@jcfXoX zH7(v30@zGoA};$4#gngKf}?eU!QV5vjOP(}@66=&mv3z~k&!EC+elur%G|A6Q%aga zKvvc1E@f^>?i;O^z4quHYt1dPZ!y||k*yO&(i8v=_PiJE?Z+Xke(#hqKH6Ws6yrp4 z89c?vw`Kc1S*+L0uNMe##;ND&H`^Rl+46kuK7Lx-Kg zL6(<-@)8s6y~CcRxmoNQzkwx5`vS1Sb$HkN{C=QvCtX*f^sati@A_<4fVe9ZL&TPmr(jws7Fm zu-&&c-PxayRgPpK?I=~qD*H1jcf1R9ME{kJUk!;GjVi_w7_?@VZx@8v%+^y?;m03G z6PYgGgNHB~dE5hqZ#BRE5ltVKR4RPT-=@4m|m*V^Z9HjLR& zD}T)M=M0^NPQX*e`x0}OB`_3iPfD(N6gD9|nzq#M;QYbyu?Jr^8u; zdaECwT8y$<9GL5oV0hLg`@=$HQ+g!2Ie<*kheaSuJZxM^i-k_de z_jTxR5$XI9nc$B2h>Fhku)5A|@sEGu#rJMF=t{d{wEpO#RV6Ee69+j%=hN>O{&=Tk zH04U{9f=th%J#K>aU|Emj8xp5U^vWcK6ra%=x{60eKO$Z5f~im;e6>ARX5VX^%9O> zTG3I5M{B>KEn~ig5~i_A&fH0(G2X=Y@T{4XvIUBf?$g$aWW;Ke0DiRjGS!{zY~P5% zmTa~&ip7vF6ORU}S!;@ar_MD{HOb)6*ZmZ`G$Lru8j1>6cTm4pT8O3T(~&g~T(Z54St-`%-vU)3aMSyxD4iD$vDpp~ z3R(f&J-d;HjV;+ZM*=rf)^v;m{eUANHKYHAP~cVii=A&Q?wooulM+eGVRBojLa}Xv zVyG8HE3@lw(exK$6tj4_OR({`r_-o5#jNr4@+i%eh5Ep8Bx^$uxdQV(TrfZmsr4T^ zBPGf{YEa5zJfzNFmqyI1^oQH5wMUD?28FTOyCd=Mt6WJDaJkg(@*5s~91p{@S!^N* z-GSYK1W{b;tXjaiSK-aZk>_ytxj|C#c^(c*5$@~muhPLcGq%Z0`{njJST|NCmFuhR zllqcU5NT|~MF83<0Sak~JdG-ivoDKQIE3$copZovqdfmT5jqLWiI1K@Vxb48C*l)j za~!`)#;>o|r^)d2VtpduL80z}u;P@noU`QTs!w4FpyO=+4&~AeOt;d5o|(#Uz=&-^ zTdOV&s1n;eN2I64DsIqJ{OKy7(H-_iECdxTjte&Qk<;anbC%5h2d8rhg4w19bY<)j zi<6p54JTp?I`!pPod>UN|FW@RcoOM+ClST`N+;o=dn#X`@LKC@-K{*RLNUPh2TI%9 z+eMpTqR~2TiF>(l^X+WcoaUOYe&7b(<}##H%Q%2y{L3JVHQ`%nHIB+4TMFgGJ8sz5 z8wA)4K1wphhKX$sP0i}xr5k+!9n}8BO^~xxtHi86bkhn&LEOGp;_?!nEQad9%NKpM zm3pQVMMgU#P9pf$8ik1@m)Jb6(>tjOnMP97keJ0bpd>d#urQD1{bP8gKA?C)4C^BU zG&W$i*4?qLomR(Lxgm34@Buf1OW8?FT5s6gHsU#WdHP7v3=Q^poga@*`sAQK2NrbX z&Lf-A(_R$(f57Pj2w>Lgw=Pnh7&a#sWzS86YYk3F#1PF~vn303#$jP%(aqCCWTPbX zm8jUok9;8eBm@~xMoM5YV`XCS$suQ_hx?OM(8bPKxHmDVOhN`TNmYT`(7%DH+$-=^ zs}zboSD6&4u2ty?IjMo`+~iYCPD#8Owrdh8DN@4LEIcXs1rLcdPiFRB$!%A!OhJcI zq_3eb-OsXiKF(rWImFY>`*c7zl1Sr!=UE)JNSoa)RxXF(;LIutUW$FWkL|M@w-_wz=Vr)o?3`oyy^GkPSK) zw%yV7!Yph|uCD=5bX=JfM^oLXL)kqWfE)T>%0SNx!xgfU^p6}61%%KdOY=T*5rF0d zrn?FwZc)RxsET*8uB-Y9{f7@xjnt?wP_MLUy0a%2CGTkOJ(2#sI~^YI_V3m#b)(7M zwIkusm{dZX;}($`3qm~(Ln-aeY;@Y&8f3Jb(xQEQ9k!&LaixEt%kV}$IdfjTPX|fk z5$9AQVFVyqwGzx?@4;5#Gb{Z0@dk3`MLsUAXga}TIsmyOuX$n5wP+1W$(_l!BX6UW z>)Q6lo=k7`dUoTTUb)VPeltRYsQ-S{D10;3sOhczgmrwOjie4Oc`T;Kh4SR4*3-iDSjw zU2k1wHiKVjEm4zgXoq&>3}lLgf?&``7vOvh6^UH;Pr`MPNvSP}s>ooXos_PeN?Xs9 zJtmZx9boF&hg2ea1d;B^S=mlvJpZu4t%B4CEi$G*SjIA!$(g?yj-yo{ne4hs=~*io z_B)iC#_t;&;2j#~prc)-YIhHoYx%bRlgNapIov~o_Mu*0IZ6@?<*?ql(O>Sq%h@7t z67mPwcX;YRjJm7*<^Sqe!y-^ju|mW${fWo=j)d`n#~{D3u!%UoPc4SjQGs!LJhL)= zId1r2Gp(n!Hx3p$>nLshYF|CoWO(V*BA5_txw5E;!>le-H;kB3VeAZJGERjnJluNn zE^Z0kdD8ZKI`d{}sjCB3j#74zdWqryE;pBo$JwbhpNz4|71Y{tDt29(M^^0O iEs#C%^FJg2kA`k)-go7-_Padt#cV9?E%MCVPW=n%om58v literal 0 HcmV?d00001 From 99de3db38ed60267fc12e4f65982bddc9281f2f2 Mon Sep 17 00:00:00 2001 From: ctmbl Date: Tue, 15 Oct 2024 17:25:12 +0200 Subject: [PATCH 2/7] Move article to leaf bundle --- .../index.md} | 0 .../{ => 4-way-handshake.md}/key_derivation.png | Bin .../posts/{ => 4-way-handshake.md}/schema.png | Bin 3 files changed, 0 insertions(+), 0 deletions(-) rename src/content/posts/{4wayhandshake.md => 4-way-handshake.md/index.md} (100%) rename src/content/posts/{ => 4-way-handshake.md}/key_derivation.png (100%) rename src/content/posts/{ => 4-way-handshake.md}/schema.png (100%) diff --git a/src/content/posts/4wayhandshake.md b/src/content/posts/4-way-handshake.md/index.md similarity index 100% rename from src/content/posts/4wayhandshake.md rename to src/content/posts/4-way-handshake.md/index.md diff --git a/src/content/posts/key_derivation.png b/src/content/posts/4-way-handshake.md/key_derivation.png similarity index 100% rename from src/content/posts/key_derivation.png rename to src/content/posts/4-way-handshake.md/key_derivation.png diff --git a/src/content/posts/schema.png b/src/content/posts/4-way-handshake.md/schema.png similarity index 100% rename from src/content/posts/schema.png rename to src/content/posts/4-way-handshake.md/schema.png From a7208250bd144d7c599cfae33b2fb8168c94094d Mon Sep 17 00:00:00 2001 From: ctmbl Date: Tue, 15 Oct 2024 17:35:22 +0200 Subject: [PATCH 3/7] FOrmat and Improve 4-way handshake article --- src/content/posts/4-way-handshake.md/index.md | 97 +++++++++---------- 1 file changed, 48 insertions(+), 49 deletions(-) diff --git a/src/content/posts/4-way-handshake.md/index.md b/src/content/posts/4-way-handshake.md/index.md index 20d7750..9e093ea 100644 --- a/src/content/posts/4-way-handshake.md/index.md +++ b/src/content/posts/4-way-handshake.md/index.md @@ -1,17 +1,14 @@ --- -title: "4 Way Handshake - Wifi Authentication" +title: "4-Way Handshake - Wifi Authentication" summary: "In this article, you will learn how authentitcation works for WPA/WPA2 network" date: 2024-10-10T20:00:00+0200 lastUpdate: 2024-10-10T20:00:00+0200 -tags: ["network", "wifi", "authentication"] +tags: ["network", "wifi"] author: clementS draft: false --- -# 4 Way Handshake - ## Abstract - To connect to a WiFi network, the authentication depends on the WiFi protocol. The most common protocols currently in use are 1. **WEP** 2. **WPA Personal** @@ -20,107 +17,109 @@ To connect to a WiFi network, the authentication depends on the WiFi protocol. T 5. **WPA2-Enterprise** 6. **WPA3** -(There are 2 different versions of WPA and WPA2 which work slightly differently in terms of authentication.) +> There are 2 different versions of WPA and WPA2 which work slightly differently in terms of authentication. -While WEP and WPA3 have their own authentication protocols, WPA and WPA2 (which are the most common) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. +While WEP and WPA3 have their own authentication protocols, WPA and WPA2 (which are the most common ones) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. - -The 4-Way Handshake requires a PMK (Pair Master Key), a secret shared by both side (client & server). This can be a password (network key) or a username + password as it's the case for Enterprise authentication. +The 4-Way Handshake requires a PMK (Pair Master Key), a secret shared by both sides (client and server). +This can be a password (network key) or a username + password as it's the case for Enterprise authentication. In this article, you will learn how this method works from a network-oriented approach. ## Configuration - We will consider a WPA-Personal/WPA2-Personal WiFi, so the PMK will just be the WiFi password encrypted. We will go into further explains soon. -But remember that except getting PMK before authentication starts threw a WiFi password(secret shared by both sides), WPA2-Entreprise & WPA-Entreprise works the same way. -Indeed, they use 4 way handshake to secure communication. +But remember that except getting PMK before authentication starts threw a WiFi password(secret shared by both sides), WPA2-Entreprise and WPA-Entreprise works the same way. +Indeed, they use 4-way handshake to secure communication. There is a device that knows the key (password) and wants to connect to a WPA/WPA2-PSK WiFi network. -## 4 Way Handshake Initiation +## 4-Way Handshake Initiation -**The device sends an authentication request to the network.** -### This request is not included in the 4-Way Handshake. +The device sends an authentication request to the network. +**This request is not included in the 4-Way Handshake.** -## 4 Way Handshake +## 4-Way Handshake ![schema](schema.png) -### *"STA" stands for Station and "AP" stands for Access Point* -### This schema shows the different requests and what they contain. +This diagram shows the different requests and what they contain. -## First Request +> Note: *"STA" stands for Station, and "AP" for Access Point* -Firstly, the AP sends a nonce, which is a large random integer. -When the station receives the packet, the station creates the PTK (Pairwise Transient Key) using the key derivation function (KDF). This key is created with: +## First Request +Firstly, the AP sends a nonce, which is a large random integer. -1. The PSK (Pre-Shared Key). -2. The ANonce received previously. +When the station receives the packet, the station creates the PTK (Pairwise Transient Key) using the Key Derivation Function (KDF). +This key is created with: +1. The Pre-Shared Key (PSK), +2. The ANonce received previously, 3. The SNonce. -The SNonce is similar to the ANonce, a large random number generated on the station side. Each time the station tries to authenticate, the SNonce and ANonce are generated again. These numbers ensure that the PTK is temporary. -**The KDF algorithm returns the PTK. We don’t use the password or the PSK directly because we don’t want the explicit key to go through the network.** -**This is quite obvious; we don’t want others to easily intercept the password.** +The SNonce is similar to the ANonce, a large random number generated on the station side. +Each time the station tries to authenticate, the SNonce and ANonce are generated again. +These numbers ensure that the PTK is temporary. -### Pre-Shared Key +The KDF algorithm returns the PTK. +We don’t use the password or the PSK directly because we don’t want the explicit key to go through the network. +This is quite obvious; we don’t want others to easily intercept the password. +### Pre-Shared Key (PSK) To get the PSK, the device only needs the SSID (network MAC address) and the password. => The process is really simple: **Hash the password with the SSID as salt using the SHA-1 algorithm.** Now, we have the PSK (the AP also performs this operation). -**The PSK is calculated before authentication starts (the station has all infos it needs to)** +**The PSK is calculated before authentication starts (the station has all infos it needs).** **The PMK is exactly the same as PSK for both WPA-Personal and WPA2-Personal** **VERY IMPORTANT** -*For WPA-Entreprise & WPA2-Entreprise, they use here the PMK created by RADIUS authentication* -## Second Request +*For WPA-Entreprise and WPA2-Entreprise, they use here the PMK created by RADIUS authentication* +## Second Request Let’s make a short recap. At the beginning, we only know the **PSK=PMK**, which we derive from the **network password** and **SSID**. -*PMK derived from RADIUS authentication in case of WPA-Entreprise & WPA2-Entreprise* +*PMK is derived from RADIUS authentication in case of WPA-Entreprise and WPA2-Entreprise* We received the AP's nonce from the first request, and the station generated the SNonce to create the **PTK** from the **ANonce**, **SNonce**, and **PSK**. Now we need to tell the AP that we know the password without explicitly sending the password. -The station sends a packet containing the SNonce, allowing the AP to generate the same PTK. At the end of the packet, a MIC is added. -**Here’s the trick:** - -**We add a signature, which is called the MIC (Message Integrity Code).** +The station sends a packet containing the SNonce, allowing the AP to generate the same PTK. +At the end of the packet, a **signature called the Message Integrity Code (MIC)** is added. The MIC is just a SHA-1 hash of the packet content with the PTK as salt. -When the AP receives the second request, it will generate its PTK (it has all the necessary information: SNonce, ANonce, PSK). However, at this moment, the AP does not know if the station has the correct password. +When the AP receives the second request, it will generate its PTK (it has all the necessary information: SNonce, ANonce, PSK). +However, at this moment, the AP doesn't know if the station has the correct password. The AP generates the MIC from its newly generated PTK and compares it with the provided MIC. -**If the MICs are identical => the PTKs are identical => the PSKs are identical => the passwords are identical.** +**If the MICs are identical => PTKs are identical => PSKs are identical => passwords are identical** ## Third Request +To tell the station that it has the correct password, the AP won't do so explicitly. +**The AP will use the same strategy: a MIC.** -To tell the station that it has the correct password, the AP will not do so explicitly. -**The AP will use the same strategy -> MIC.** +To optimize the request, the AP will send useful information: the Group Temporal Key (GTK), directly generated by the AP. -To optimize the request, the AP will send useful information: the GTK. The **GTK** (Group Temporal Key) is directly generated by the AP. To check if the station has the correct password, the AP generates the MIC corresponding to the GTK (packet content) using the PTK. If both match, the station and AP are sure that the other has the correct password. ## Last Request +The station sends an acknowledgment packet to tell the AP that everything is OK. -The station sends an acknowledgment packet to tell the AP that everything is OK. **The encrypted communication can now begin.** ## Encryption - -WPA2 uses **AES** while WPA uses **TKIP** to encrypt packet content. Even if both are encryption's methods, AES is more secure.This makes it impossible for a hacker to read a captured packet. +WPA2 uses **AES** while WPA uses **TKIP** to encrypt packet content. +Even if both are encryption's methods, AES is more secure. +This makes it impossible for an hacker to read a captured packet. The PTK contains several keys. Several keys are derived from the PTK: - 1. **KCK** = PTK bits 0-127, the key confirmation key -> used for MIC (verifying message integrity). 2. **KEK** = PTK bits 128-255, the key encryption key -> used for encrypting the key data in the authentication packets. 3. **TEK** = PTK bits 256-383, the temporal encryption key for unicast traffic -> used for AES encryption. @@ -128,13 +127,13 @@ Several keys are derived from the PTK: We simplify things by saying that we use the PTK for something, but in reality, we often use just a part of it. ## Recap of Key Derivation - ![key_derivation](key_derivation.png) -In WPA2-PSK & WPA-PSK, the PMK is the same as the PSK. +In WPA2-PSK and WPA-PSK, the PMK is the same as the PSK. ## Conclusion +Remember that even if we use WPA/WPA2, if a hacker catch all packets, he can brutforce PTK and get WiFi. +Indeed, he has all infos he needs (both nonces, BSSID, protocols...). -Remember that even if we use WPA/WPA2, if a hacker catch all packets, he can brutforce PTK and get WiFi; Indeed, he has all infos he needs (2 nonces, bssid, protocols, ...) - -You learned how the 4 way handshake works. Now you can discover the way to get PMK for WPA(2)-Entreprise. +You learned how the 4-way handshake works. +Now you can discover the way to get PMK for WPA(2)-Entreprise. From 2200035e8210f96f937456ceea678d8f81a0a776 Mon Sep 17 00:00:00 2001 From: Clement Salotti Date: Tue, 29 Oct 2024 17:53:27 +0100 Subject: [PATCH 4/7] implement remark part 1 --- src/content/posts/4-way-handshake.md/index.md | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/content/posts/4-way-handshake.md/index.md b/src/content/posts/4-way-handshake.md/index.md index 9e093ea..3d3a410 100644 --- a/src/content/posts/4-way-handshake.md/index.md +++ b/src/content/posts/4-way-handshake.md/index.md @@ -1,6 +1,6 @@ --- title: "4-Way Handshake - Wifi Authentication" -summary: "In this article, you will learn how authentitcation works for WPA/WPA2 network" +summary: "In this article, you will learn how authentication works in WPA/WPA2 based networks" date: 2024-10-10T20:00:00+0200 lastUpdate: 2024-10-10T20:00:00+0200 tags: ["network", "wifi"] @@ -9,7 +9,7 @@ draft: false --- ## Abstract -To connect to a WiFi network, the authentication depends on the WiFi protocol. The most common protocols currently in use are +To connect to a WiFi network, the authentication depends on security protocols, the most common of which are: 1. **WEP** 2. **WPA Personal** 3. **WPA Entreprise** @@ -19,19 +19,22 @@ To connect to a WiFi network, the authentication depends on the WiFi protocol. T > There are 2 different versions of WPA and WPA2 which work slightly differently in terms of authentication. -While WEP and WPA3 have their own authentication protocols, WPA and WPA2 (which are the most common ones) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. +While WEP and WPA3 have their own authentication protocols, WPA and WPA (the most common ones nowadays) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. The 4-Way Handshake requires a PMK (Pair Master Key), a secret shared by both sides (client and server). -This can be a password (network key) or a username + password as it's the case for Enterprise authentication. +This can be a password (network key) or a username + password in the case of Enterprise authentication. -In this article, you will learn how this method works from a network-oriented approach. +In this article, you will learn how this method works from a network-oriented point of view. ## Configuration -We will consider a WPA-Personal/WPA2-Personal WiFi, so the PMK will just be the WiFi password encrypted. We will go into further explains soon. +We will consider a WPA-Personal/WPA2-Personal WiFi, so the PMK will just be the WiFi password encrypted. We will dive in further explanations shortly. But remember that except getting PMK before authentication starts threw a WiFi password(secret shared by both sides), WPA2-Entreprise and WPA-Entreprise works the same way. +They use an external RADIUS authentication server with personal user informations and not a global shared key. Indeed, they use 4-way handshake to secure communication. +Lets consider the following situation: + There is a device that knows the key (password) and wants to connect to a WPA/WPA2-PSK WiFi network. ## 4-Way Handshake Initiation @@ -46,7 +49,7 @@ The device sends an authentication request to the network. This diagram shows the different requests and what they contain. > Note: *"STA" stands for Station, and "AP" for Access Point* - +> The device is actually the station and the access point is the network node handling authentication ## First Request Firstly, the AP sends a nonce, which is a large random integer. From 25e6c9aa911f6b1fcbf475e44990e8b8df4cfaf8 Mon Sep 17 00:00:00 2001 From: Clement Salotti Date: Tue, 29 Oct 2024 18:47:56 +0100 Subject: [PATCH 5/7] implement remark part 2 --- src/content/posts/4-way-handshake.md/index.md | 45 ++++++++++++++++--- 1 file changed, 38 insertions(+), 7 deletions(-) diff --git a/src/content/posts/4-way-handshake.md/index.md b/src/content/posts/4-way-handshake.md/index.md index 3d3a410..d11ce21 100644 --- a/src/content/posts/4-way-handshake.md/index.md +++ b/src/content/posts/4-way-handshake.md/index.md @@ -69,27 +69,41 @@ We don’t use the password or the PSK directly because we don’t want the expl This is quite obvious; we don’t want others to easily intercept the password. ### Pre-Shared Key (PSK) -To get the PSK, the device only needs the SSID (network MAC address) and the password. +To get the PSK, the device only needs the BSSID (network MAC address) and the password. => The process is really simple: -**Hash the password with the SSID as salt using the SHA-1 algorithm.** +**Hash the password with the BSSID as salt using the SHA-1 algorithm.** Now, we have the PSK (the AP also performs this operation). -**The PSK is calculated before authentication starts (the station has all infos it needs).** +**The PSK is calculated before authentication starts (the station has all infos it needs).** +*Indeed, you selected a network to connect to (BSSID) and enter password* **The PMK is exactly the same as PSK for both WPA-Personal and WPA2-Personal** **VERY IMPORTANT** *For WPA-Entreprise and WPA2-Entreprise, they use here the PMK created by RADIUS authentication* +*How RADIUS pre-authentication works ?* + +1. Client Authentication Request: A client device (supplicant) requests network access. The access point (AP), acting as an authenticator, forwards this request to the RADIUS server. + +2. EAP Exchange: The client and RADIUS server engage in an Extensible Authentication Protocol (EAP) exchange, which provides mutual authentication and allows the server to verify the client’s identity using credentials like usernames, passwords, or certificates. + +3. Session Key Derivation: Upon successful authentication, the RADIUS server generates the Master Session Key (MSK), which it sends securely to the access point. + +4. PMK Generation: The access point extracts a portion of the MSK to create the Pairwise Master Key (PMK). The PMK is then used in the four-way handshake process between the client and AP to securely establish encryption keys. + +This RADIUS-based process ensures that only authenticated users can join the network and that the derived PMK is unique for each session, helping to secure wireless communications. + +[More Info Here](https://en.wikipedia.org/wiki/RADIUS) ## Second Request Let’s make a short recap. -At the beginning, we only know the **PSK=PMK**, which we derive from the **network password** and **SSID**. +At the beginning, we only know the **PSK=PMK**, which we derive from the **network password** and **BSSID**. *PMK is derived from RADIUS authentication in case of WPA-Entreprise and WPA2-Entreprise* We received the AP's nonce from the first request, and the station generated the SNonce to create the **PTK** from the **ANonce**, **SNonce**, and **PSK**. -Now we need to tell the AP that we know the password without explicitly sending the password. +Now we need to tell the AP that we know the password without explicitly sending the password (a hacker could incercept the packet and easily know the password). The station sends a packet containing the SNonce, allowing the AP to generate the same PTK. At the end of the packet, a **signature called the Message Integrity Code (MIC)** is added. @@ -103,8 +117,16 @@ The AP generates the MIC from its newly generated PTK and compares it with the p ## Third Request To tell the station that it has the correct password, the AP won't do so explicitly. + +**IMPORTANT: the AP doesn't send explicitly a message because we want the network to be authenticated. Indeed, a hacker could duplicate the network and fake the real network (emmiting a stronger signal). This make the station sure that also the AP knows the password and it's the same as him** + +**But if there's a network whose you know the password, you can fake it and other people can connect to your network while they think they are connected to the real one** +This is known as [Evil Twin attack](https://www.kaspersky.com/resource-center/preemptive-safety/evil-twin-attacks) + **The AP will use the same strategy: a MIC.** + + To optimize the request, the AP will send useful information: the Group Temporal Key (GTK), directly generated by the AP. To check if the station has the correct password, the AP generates the MIC corresponding to the GTK (packet content) using the PTK. @@ -118,7 +140,7 @@ The station sends an acknowledgment packet to tell the AP that everything is OK. ## Encryption WPA2 uses **AES** while WPA uses **TKIP** to encrypt packet content. -Even if both are encryption's methods, AES is more secure. +Even if both are encryption's methods, AES is more secure (because it uses longer encryption keys). This makes it impossible for an hacker to read a captured packet. The PTK contains several keys. @@ -135,8 +157,17 @@ We simplify things by saying that we use the PTK for something, but in reality, In WPA2-PSK and WPA-PSK, the PMK is the same as the PSK. ## Conclusion -Remember that even if we use WPA/WPA2, if a hacker catch all packets, he can brutforce PTK and get WiFi. +Remember that even if we use WPA/WPA2, if a hacker catch all packets (this can be done easily with Wireshark), he can brutforce PTK and get WiFi. Indeed, he has all infos he needs (both nonces, BSSID, protocols...). You learned how the 4-way handshake works. Now you can discover the way to get PMK for WPA(2)-Entreprise. + + +***Useful Links:*** + +https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access +https://networklessons.com/cisco/ccnp-encor-350-401/wpa-and-wpa2-4-way-handshake +https://www.wifi-professionals.com/2019/01/4-way-handshake +https://en.wikipedia.org/wiki/Pre-shared_key +https://en.wikipedia.org/wiki/Key_derivation_function \ No newline at end of file From fb9a88df582884ac6c1bdf5c4989b1c3e297a8f2 Mon Sep 17 00:00:00 2001 From: Clement Salotti Date: Sun, 10 Nov 2024 19:39:37 +0100 Subject: [PATCH 6/7] changes 2 --- src/content/posts/4-way-handshake.md/index.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/src/content/posts/4-way-handshake.md/index.md b/src/content/posts/4-way-handshake.md/index.md index d11ce21..2011953 100644 --- a/src/content/posts/4-way-handshake.md/index.md +++ b/src/content/posts/4-way-handshake.md/index.md @@ -19,7 +19,7 @@ To connect to a WiFi network, the authentication depends on security protocols, > There are 2 different versions of WPA and WPA2 which work slightly differently in terms of authentication. -While WEP and WPA3 have their own authentication protocols, WPA and WPA (the most common ones nowadays) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. +While WEP and WPA3 have their own authentication protocols, WPA and WPA 2 (the most common ones nowadays) use the **4-Way Handshake** method to allow a device to connect to WiFi and secure connection. The 4-Way Handshake requires a PMK (Pair Master Key), a secret shared by both sides (client and server). This can be a password (network key) or a username + password in the case of Enterprise authentication. @@ -75,8 +75,14 @@ To get the PSK, the device only needs the BSSID (network MAC address) and the pa Now, we have the PSK (the AP also performs this operation). -**The PSK is calculated before authentication starts (the station has all infos it needs).** -*Indeed, you selected a network to connect to (BSSID) and enter password* +**The PSK is calculated before authentication starts (the station has all infos it needs: password & BSSID).** +*Indeed, you selected a network to connect to (BSSID) and enter password. +Even if "How the station list all available network(network name & network MAC address) ?" could definitely an entire article, here is how does it mainly works:* + +*The station send a 'Broadcast' unencrypted network packet "Is there any available network ?". A Broadcast packet is a packet that everyone are allowed to read.* +*Finally every access point reply: "I'm here", and their BSSID is included in their network packet header.* + + **The PMK is exactly the same as PSK for both WPA-Personal and WPA2-Personal** **VERY IMPORTANT** @@ -158,7 +164,10 @@ In WPA2-PSK and WPA-PSK, the PMK is the same as the PSK. ## Conclusion Remember that even if we use WPA/WPA2, if a hacker catch all packets (this can be done easily with Wireshark), he can brutforce PTK and get WiFi. -Indeed, he has all infos he needs (both nonces, BSSID, protocols...). +Indeed, he has all infos he needs (both nonces, BSSID, protocols...). + +*Wireshark is just a tool to capture traffic using pcap (an network capture API).* + You learned how the 4-way handshake works. Now you can discover the way to get PMK for WPA(2)-Entreprise. From 6abeec84aa7d41f6ce92a491241a3f2aa4e63578 Mon Sep 17 00:00:00 2001 From: Clement Salotti Date: Tue, 19 Nov 2024 10:17:44 +0100 Subject: [PATCH 7/7] last small modif --- src/content/posts/4-way-handshake.md/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/content/posts/4-way-handshake.md/index.md b/src/content/posts/4-way-handshake.md/index.md index 2011953..fdcb4d7 100644 --- a/src/content/posts/4-way-handshake.md/index.md +++ b/src/content/posts/4-way-handshake.md/index.md @@ -29,7 +29,7 @@ In this article, you will learn how this method works from a network-oriented po ## Configuration We will consider a WPA-Personal/WPA2-Personal WiFi, so the PMK will just be the WiFi password encrypted. We will dive in further explanations shortly. -But remember that except getting PMK before authentication starts threw a WiFi password(secret shared by both sides), WPA2-Entreprise and WPA-Entreprise works the same way. +But remember that except getting PMK before authentication starts through a WiFi password(secret shared by both sides), WPA2-Entreprise and WPA-Entreprise works the same way. They use an external RADIUS authentication server with personal user informations and not a global shared key. Indeed, they use 4-way handshake to secure communication. @@ -147,7 +147,7 @@ The station sends an acknowledgment packet to tell the AP that everything is OK. ## Encryption WPA2 uses **AES** while WPA uses **TKIP** to encrypt packet content. Even if both are encryption's methods, AES is more secure (because it uses longer encryption keys). -This makes it impossible for an hacker to read a captured packet. +This makes it nearly impossible for an hacker to read a captured packet. The PTK contains several keys. Several keys are derived from the PTK: