From fc924e196b5515396004f0f908f751d31d8e80be Mon Sep 17 00:00:00 2001 From: erjemin Date: Sun, 18 May 2025 14:08:36 +0300 Subject: [PATCH] =?UTF-8?q?add:=20=D0=97=D0=B0=D1=89=D0=B8=D1=82=D0=B0=20?= =?UTF-8?q?=D1=85=D0=BE=D1=81=D1=82=D0=B0=20=D1=81=20=D0=BF=D0=BE=D0=BC?= =?UTF-8?q?=D0=BE=D1=89=D1=8C=D1=8E=20CrowdSec=20....?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- images/crowdsec--security-panel.png | Bin 0 -> 60182 bytes kubernetes/k3s-protection-with-crowdsec.md | 189 ++++++++++++++++++++- 2 files changed, 187 insertions(+), 2 deletions(-) create mode 100644 images/crowdsec--security-panel.png diff --git a/images/crowdsec--security-panel.png b/images/crowdsec--security-panel.png new file mode 100644 index 0000000000000000000000000000000000000000..07be9b6ee828abdf22a095df7ab4c04ff36b000a GIT binary patch literal 60182 zcmbrl1yEc;w=PO>*Fccq?i$=7xCD215AIHI_n^VuWpIMa;O;)S4(^Yfd(U6*RlPd5 z>b) zXz|cVY2ne)(Mi$K@krr68s0E)>*Qnb2tTE?oFO2PF#ml&&8+*qKtPZ{NQ;Z8dSsn; zBI&HQEO2)CL}DF?_mVXHSf6Og_K8`(Fwyw%?DP%a#0sv?2)+R&dJ-R?MYX z<;mnmm$F=3Pc)OQXBfFVYbrF8ei7nlS)x(O7mr~35xK$nM?3|2iZq|jw{62aR5Umr?BF0?_^Q|2`zMZ zXk$Eh`BcL2UlXcDLK6dTkRTQX*OPaqc%qMK0V8jO$(Lu!tucwFzJJ=nk@`1K z#i%L2)M8vF!i4X1JVUi1KaYCkiFy71P0GiKXJ``4wo9%5d&*D*#Bh!&eAmg+s;O|=YW=ybnlH3O%O=PVl@ zV~K5b-yhXj`Az)DR-yEshn=Qj96#Hmcn+~pJZ8XHTi6^Y7Lg=D7vew`i`)?T8P(I= zrd+Es!9NZLEf)b}x_FQ9x83t(D=+!QBbqgRxNx?eD8Ik%H33*%U2M=z{hx%KCqjft z{A_V+xF5!NnI$h1oQe_ywZr1~rfR}> z$wr7|Wvm&+B64n|+Pa+nG94UbAq5J*46_(6Z!Ejlf^--21ojQAge9TN|CqB~uQ3wr z#l`DJ0(z>=!nS$0rIx5!9~JTc#z>|nXdqC%3-x9Q&7xQ*9AGaU(921FCqWN~SQ-Sk zA5#dFZnDKQyo1}RB3R(t17QT>Q$DG=9XE_S1|P=pgQR|aRV5;oEoYNRFMpWrCcJz$ z_0Ob3=Xq<)8V4y=h?AhZ_j*Owyiw4HGX%dxCKuayCcUP@OgTT*BMY$a*V`YAt!4SH z(LU}n4-;2OxKremN4&n9y(Q1dmlEgYy^w6&H~3s}MO^6W!jFhqslWa6^dlMaC-_H1 zJu5e#Ke?c7vj*uD*})V6-sAk>#QH{P`Jc-nTy@Js(-V>nr)S&)y&fIxmnElc_0g!Y z*L_L9VOJaR$Jbx+9t-{jolsZ%n9t*%hb=*1r+{eM1;Vq|&+iX$P?B@E(Q64yG>TL4 zEe9}r1xmPaM1C`eIhr{W+f8m8W-dp%W>fC)fx?vt=lEO81<{r_f4<-FkEWQ`K^Ptp(e#jV>xKFD|!w z*Asg#!_O9qq%U03UT=eOBj`|_eS%-O6e3>r(s}3dT&H6Zin`SFgYOUwBXS<$p?BZ{ z^-shoa`4dj?GlNPvLWsak~Qjoy>qWN=3Zzf35JZhGihavK@&@xucx%hAzMy!DVQtXfuqp`DG3!wjt*I zjm(FQ#CWACWXOvX>fixGGE866m0uQ_7OdXA=$?&mvZxG^Cf&g8yV z4lPt;xBGYKD+A2shp{M5HN)M!@_>)X7d+nJ3b<8jo@*0Nqwva5;Xf85MIw%=2(D4> zn$EZdl8VPh}QUe!$)`V4qgj|*HE~_>v-C;^LYq9&OYsv!YG;f zuoxBSWEL9h*(f<&5APGmqAaQs=v>`!dB-a;w&;{29^yWa3~uN!ecB}=<#K>n&7GXd zTQAJ!eO=Gwt=@y6rU`zfpmm>&NgeJ2zb*abPNeWE^ca$UyNd7`Xc}uZP*g4U7JVuC zzTfv>d0IO-qQykGI|nZ$6O~=Xz=}fVgtrQLvwVG5ALW#^Tu8h0@qvLlIQ(>jLjBc_)UjJRbGa^Vf5F(%obR` zad}r3qXVaP)l0}Us*K?Z9RiyzKjqz%;GrY zi?3h)s|pVd>G*}raT2`-jlYR!DBChfq2p?h##-V1Mn1^dT0T5v^2;L1hZAlhEo~_X zG10qnp0XY`e}1;3Q&9D5$MJo|kNuX7zo$WU8any)UkUPI4rht2wD3BQe=vky@2%5g z2*?vv=0w&DOy7q%^`*K(!mX1^{cuNbk-JC)f7q)Y4-e648`lZgYLevB$qqwdMB(kM z@0FM6rpuf|GmREL6EPqEnGJ*)fJ@ic=!QNAFp#lZ%j~h?f3(U;T;vzwXoo@XBdDdH z@v`K1;I>hZ`7xR>ZH}O2f<*_2=C(lc}hs1k<%NmKXTmPF|*)BalUrDe3 zDvFY{$S=)M`xRN#2bBc+$Ac7$Rcjg|W|9TD_BAWHi2sUSuIj|Mz7j#$$THAeNAO1x z+u`f`T5qfP>nHnzbHMI*?@#~wHZH67iuUn7vxYISn~5b>CD1aEbB|C!25O=~S2NzB zLstiJhB1IFH6VNR{-l!iig2~!?ML(Kaet}I;kQvR7T_%{pb{E{wEM9245y=GyUddR z3FG>SflJ3)6;t>pH6$6HYeAkDLrlIDBiQ)DaA9a`An1L3pPDxAUmZV((r>eITYv6} z4{Drmh2p1Wf!Fg&LUR=!8#J$Cwky0@c79vcvvN%u`=2Kg zf1kK+_?K8@k^{`SKafcXWFqB10r5YGzfP|V|KKB-FXhnUzjR3{GPXbB1OxJ4EdC$F ze^j2dK5Sr`!AJbB8~;yt{O{lXqw*gR`9I;#g6;nWPIoN1|KE`2{|21@TR3d8NOL1c%fgAd{GuS5QlWhgPbYPu`Un<6`H@t^8OyY~yMhuSnljaTgyVjS=XPE=P zgI83FM`w3wlMowbtUYhQb>Zh!w1ap<;c&WL}3?17m8c? zWqoE!H6{7O*fyZnghz1yaweyIHam*H`QrzKsP}Qx_4Jq1yM?(jx!1(ZZ_MGLjf2c1`1{O$ zv37C&1Pg%;3=3Rmh~n4*FM+ktryFSY1X#=x1TGveF`(5=&-Aa6?|(4MfQ77k(^RbQ|CD0^?eJp-Q9fN(l`+i(TA&(y-&vk2LWdE1JxJAXz9N$z$zQ5PIdbglpC9{W6U7`0p$$|TkRH3g6*TudwpK`+1M@lu> zTI^a7n|)BrDRd3nZm$(eO|*r_zZ=R!ul-^#=;dq6FlX1w|HnGQ1GBOum-10-DtFu~fcUHT zUziFgHX)O@p6c~L+$W9DTMgv1nuD@bn>~jk4I{0`7-|2FF|}vO{9Mp0Nc%}^Cb#4o z%caJzo7hN1#m`K<=G0Z(if%0_pR51c1*B&p?cY&yMEm;2uyFAbeyg3Y+vHF2q_tsC zU4-X{#y|Jc@Labgh36&kX!J;4TDx!O*7pfOpH}mwY z=(yt|_=yY0J=@SujsUOmcJw*%PwIGD+CtRt>-h5T=Lf$JN}LHdds3jChTsod#TWBf zqj7hf>)fi3;`oq*Z6DV#-uybN+-X>AwNA)L0!2SF1y+CJ;ce0b2$|3p)Ewhtd(jv; z5P4*B8Rm9EvUK5hw{)x6E;qUQH`x7MG(fmsK1*P4^e_IrDt~-HA@XG<$F3$OKB$*~bhY&l)J#>*z!??>*0R!9z#VxtjZ?u)Rx`kWM||%9hMMIZLgyeBi0P z$5XP+(NapoZ|Z&5S?TiyYY6`yxR%bNL4)B-z~fy9fk4P4=Uihjhrl1`NPEDpf!a?& z3Fy0Le5R2)=3$gOc{nQY&^Lds5j%2&{AyMGWFXcu57EK6K zpkX2WzO2_OH=Zl#>EJy8m6(u4u&bEYvb)E6BP`hD8BCq>(|&VniTTB7*2KR_%9zfo zUdWDVNP*<{#IkJL)t3?RStqYtD**3}ODX}6{*!pDO}UT;{hpnh-%|1KyIVhE27IHJ z+oZK$CUA|+-L*u(o4Q*6A)5c=S3gK9*lNrmH57~m>y(Cv-AW7{)^ zPv*@imzXz8<RQ;FMZ5FKBrhY9ziCD!r;_9pc2_4ho>O^STlgA{;_{ICv3EGKL#Ex1vuGX}Qm7@1=8D0J5SP zlg!l}`>do~X&%&Dx>7{XdT)$Lx6k7WLHo`{!JhrO^z9l?it7%I=_Hp_?NqyO=3l3) z)?b@0ops6aCJZJ&r=7h6j=h-2(QX6li`%@4_GsDA5))Sx)<4jq|J5%PjV1r|4(HVu zwJFASryc~?TZ21l!j`tD!0N(>k_nOB&386G_x=f5)A?SvHg~y1pwr zkAkz`;EuF@`vr}ci>*Ae6Tb`J@AAJ)p3QR+aA4-Hg+vw*I>mmr7*Y$QPl#C^hc}Xs zA9g@y`wg7zKd&OF&6cCH)`lAj$W138eq60uG2nqy-7*k)VgA7dVd|zx^_{#~eq<)V z7BT-xqFUo^l_Z1;;=no%Hf;%}!aT`|B5{PEBmsI+I&PkMgMoM^|4^pw%ja-XCKi1h%ftoRmO7%5ji^+6y#YVB9N zVm8eSW+vSCqrN;_VCo0wDi3H^R7DXNDy|^Z%>vsVm>-r}51m$F&Qy406~N5f_kKJE zpbh$gli5?2vXbc5t5#n3*^X}Fg)M-fd(1);{oHA(bF z(d}0f*9-Tx=go@eMwUyNAdTFmONYCisKzVi7U&apPsFl`dFWoMiwx-zrdKOAPFW=M zixV?Rr9ZVjX`#{rEmtV<^|c0_-Yh*Cmz4<;?Z_x%`g>j>ooWSzy*Z2M5cGi4ZiW#Q zmTR4JH`=>APji3rHf?GJ?gNX*_ZaG*QNFM)mYp{DXYd84ci#J#-M#*$2^+&b27@@u zPFX^Jw{db3PkYIc3k@N#CI&2n^y91Jb`Ps-%0_&Ws=)0aI|i|QAZ(+OTwXJ;ou6_s zGVAQfn|r<63)T*8`+jQNMIW)#$VcjZp=cm6a}dHXaz+S%9K+GMb%hg8I- ziSkv*f;n>-Vs~+0!m?p;lj)ICMzi+`TeoBv(1lIk8%1ai*&wsUd+R(ePl=}ghGoCY zHvP%~fLxHX$W2EjHoKR-V8&D$j2kle6j}Vn)h)g5m*^nn{07H#A9hn%D+`7sD#lm zu@tvkO4h#*+ZVDYi-0M|YMaok^(Xs3{hM`bF=#Z(1&qBGPnw`K5Gc0HQ9G_y0k4AM zs742)M?>T;?Lxh2-b2lKc0oo^XHHC%$B~!zw)m@ z)E9=Nd7t_XvUyR(H&hf{2Ul$;trN|8KhMao#ws6Fhe*^@Ej3Ap#`Axb6#&x~#4{&} zYm8Iv(OTKd1ZzGIJ@HIMKjA{aFQ0P%b>c|N_{L)KmSX+37xz@lAgthI%C_>bV(1_sMd>Q` zB+o-7H+pG<+g*r?C)!8rNeipdgnqTGF<=s8^;bx+`5O}$f5ZRW;2Q6^iRpD$bFtMI zbl6ZWDUsdm|7bba8q+H^ z9CP0~b#g=E2x|LhU>wZFJh|Wl-avFsY2vAwFgYw>F8e-p>wxvu>oS($M;03fYpTmJ zYL4~aFt6D+P0euhg$eX`g+Y(vsS-l)S?fsZFaJ7&;`q}Gg3|;tkzR+tS0iB4FU$Laf8S9Dvn_TT+1Jjqh~%j?0~q=qwPXYdDpb>E z>@YK$={1;-xcJ38>r=UNiw;5>5b&?*Iw{5n&0jV=~c_rBv)0n9s zv{oX&()+Yx$xj7uiJ-UFS4Lvq+#;6xnwCUHq0>Pm$fTJ$$5G7}@vgHcyTV=Zhd+&G?K+U)|20ftiyt7xTKq z{^MTh@0l>*E#L)2cT-LcMM16^Hv+mJp<}r=(@6J}w!$N^E1_dr+?R^Q-kHS(iwF60 z8I8=y6&8~E1QrhKlp)R;>+#G*BWfd;irFFg{chB2t*&?Ap|i^v8A*=QXbRxMHC^wO zBYOfzG>5qmrk~#$nWa?Lv&l+!0;L<}XmmW(8;xPt`!zw7v7@{n%A$cHCH|Fb*w*D? zxs5lhGxgISF4$_;4*lVoE{gGZa&HpbpNli3rC{}TMLow#Q*iW=7;^}d;*PrB+>dy_ zOb4<1i#0uD(h=na6zd4Cui+74{+U9{)Ms|+Eu%4fSOd!Khq*3G@cl=w%>+m)#>EJonk~~#uY%A&7-1hgj zH{GwG{X4D<_j9(8^G0OvB)Y~DwJ)}_d01LYUkMi@0%#_)70x_`YacY>Of3fGZI|w{ zeg|SS)Y8pk68b|ribW*O7(zw+K|jUxOJu|ZG()UN7vG7KQYPgdI+FsuMcXu9MZ2e$ zOOt1+-2mBVvy+gvO6Ox#dYx{b8KBwf6K)9KQWKF1zKyzkXu4E)LyQ$|zW2NfNAV7U z4Gh{&=%%Adj|JxxjvP9h`?8H6Xn(RAN11)-Zi zIRUI|4%lmyRxFr)FkN!+rP|fs*nSqZ>C&pW3rHknOUc7T=xjiBT8j^kfJF-EjYeh` zt2vK1?-)Ro%b3+(1R?a^jk6wBfCB++pc)FrA7fAIoFMDa7*~Zr!mkXA?3woZV9=q3s5};X2u=o%BI{ z2pRyVdN=|9ot&Zvt(E(0oraGG8z&DJPH+9#z`$AZ5X(tW75RC)j9~4{`GQH)q)83A zAaIgRbYkS&nr|$+35VUf?d-uT6*lX!T;^%+KGz>DgRWdNcrAMw&w+DJp`vS`)5JH-mcEO@wO5+LkL6Q4);mu7Jrqo}lhb&Es$9XCgV!6gPGPA~jbxwJEQ1UoD)&9V z^WhdYHx5mG$8-h6Yy-_*$v;~7d+~?B6ZIHpancmy&QDl3WdurD;jy{Z7p`yRGdmoJ|S3TvhGYyUfX>r6uSXEC>bY5B=PfIiREqg-6r4@-7ZqClN^;Kw~UrZ#TexK&YylD$)aJU}9B=>sJ z(BC|JA9KOfC7WPbXww{<9Ivg2zzQ37`?P$jFs}^(Yrd5Hz$f+ zAvKw1b!BknR$GvX=yzlqzq)7cX=P&KtK2t|U2Xmy1q8+gmm)iR%vgEK1 zeV-FL2YF5muY`#^m`7tTo`&K2iOzy6+7+swVKqPs(TzVrTliU2Cu7naflft7&PA+F z*TfV(Z|V$k{Hk@RrL#$?>>Y4i*4i~45!7KxZ!f`qOCxOHX?$~T=g%S<)Wh`}2?h|l z>Yt6+1|F`|zJD6sSnucTNY}F@=J8&j{ckQnAUQu^G`rEs!bMNoO9(9#C$r>=*t9_Y92Y-m$Yak6%MiX-u&=S#bW?h!{=ul;<0%@WoYC@oVI1(C!~ z4=~ba-$(o7JF~%Dx|@pI5NKA8M%kIil$J$XT0u~TeE)J+?hPp1ER|fTlNsKz?Ak| zwY>SIyEmq;=(f^aBA8ReN0$Z9%=>eByT0GNy|A6R3Mja$VxwUC$5NdaeY3js=OCdr zHs(dse3KOMY^SpTf`(o=Xzlaf(xAk61O{r^QEV;TrfpSw8Q6rDG!~PyF zLPbIbGwi#2JFJ#WCes~TJ@6sU+7!ag5mT}h(eD-lFVg$0;Efo{Lha`%d(Ga|Q_0o6 zb;Pr_vvoWM%yJ606-uF_!pu)2>*}}zx8>7}%ws~-z-*$H9>fC+2~>=`c`DVDRj?%! z7k+Y!uQI-1cA-t<^+qzIAAa`a99oC6sFebd)o|aF;>y9)xesm$!>GNABD0vH8#Bn`8SL6YJ2-G|NEWAGZ_{7UyOEMH zOD_YxRDGK=EaTq3l1zS9lY{S7R&r*ZI?%_{-;O<*-=qtZKDFDLP^(5gp&W0sTro(f zrerNoyC5hO&Go2RXe1^FGI1&1O-z75X|BkiXxIOuAU}-)wix{TGk?#p#ZbE0D|FaR z8p_HinfYGIQlgfF712!pXahV|9Vr9IDw*Dip`z733V=Pbg)P@tQ@%O=6chdFF{0Ks z2^=FK9*6tV$(C!%H`j7UW_8Z6Navb!&+dFZAujzJl=z!PYI{wWvyG~ZjaL35H7-qV zc_BR)3dkSDs>Mr_}Ej^E0+BTO$LWc^stpiztU0QjByw1LaazZl19+LTHma z6+=T~y1GnS8wcy(9-^n3x=W?y!ZbV%iHq8&jlspa4+#B0i1Sx$}bIWb4ygn(q}r&vdsV&r%HJarK$;0hwxXCIeDkA@_F@#^^ItC z){`j415&or%rly%S#QGxS2@L__y}n_jowQ95ZK0!=Gxu~9QR0E8ue!u#dRG6j4>2! zTFp8fX`1Bro61$pl5>M?hl9v$C&-Yn+k1Zbxz^JXl;z~~cx72`4fE)`YEH5GkLC~g zrZ&}!XI~(7r^xSq5r8FaP*#-=XShgP$2PT96Nb@ePhrsQ8Vrs~+SEgH@+DN|TS{pg zC1gN(oR4u6sjCA;<^Ud{kMxj zo<)-xS3p)i7?f)9?*M3~A1+Qh{Pf=(b(QsDJ6gA-^DX40Gb|YqR2)&R6`@5*rD5L+ zaR*3uES0Q(S>W+xqsQirBMflwYeOsUWVIdb@%$yoQ6@?|rTL3?fuMXDm~v~MOk}Ba z4Oya7O260U~OG3zJ6F z9Ip(69pBD44Txy!%yd`_xG&|qT=}FN=h`Y6%EWnp%XM>+CJ9c`P4!_A0;VsvcPG2{ zk>YfQ<(i4#_hNZ5%F3nFw6=x*-Ta}`ZrLTcJnCmp*L-HpmR}vcS0D?#Y`CG!c5pB? zXmb!WI%wGQP;8=z8Sn@J>=D^X4 zdyh^g5;4alo6IoF9Ddd2lIPjout{Wscvh%LbMg#MoNxV!{(Afv)@#!P_MsgaFv*$O zqZ3sK45a__ja$(jotM7`M8(NyNpI^DrTSY{B*DfUwqs9ei3r&T{XE(mR0VF;Ot3)f zo^u9{U==MZ!m+6|oiy^uN1RrOKdLxL9(w~FhRTAbB9hWn64wAlQ0M?@ULJ&?FC#z> zM#9qkCo07f$h@~uKFN#ucXe9;zto*%U!t$xt0ZNw!_-fGN^4DG{IX z8Jm02_H8CY`IC0Fu0Kep3CQa_>M-hlTxQ8ci$+|?WlfaudbQP+XNM{5cQcivdqHYg zc$aHW9vjaLBH*W?m-&>73kRBqvlkKs(%E%cZLy*9BH$~Tw_#eny@%<$pkFEhFR5@_ zZk68sA8F*U;H25ASSH%386?P>qBCxe4*OA$-=3(R=alkhT7Id(d1Pu9$0>W~w znd0d4=(gFLGX)iFG?7*X=^`abf@z%)YKe3X9Wn|#Y7=>H4!RB7p-G8)Oe(>{ILPdL zfN|$oQxo#MAa9-RHQS;c9SK*`wCuaB8-Mu?1BvBWkhDwM#Zj)A(^#O0*vuK zbz{2=!uUCv-?1Y}a&L@xAYDASDE#GUN?=5`1f72W{SfLndC`=vjL!i>O?pa{7F~deeEvlArn2 zs!scmlv71X%s1brlrU?)iFOTfoET_Ebq4*=LftAXB;Nq;syr&sRWogyp6vo(lT!uy z>vq+I7Yd zRAPB|Ulil4^r$d{xIm%!FgG(@I$9qjQ ziD*i1M>pi19RInEc~&X!%bgDBmmGJUl1#d@&DcoFH??XnL>chfA5+?|sdRfQMS$(g zRj!OM2ESbc6ay&lB8R^R;!BlTu}}D?Y0^7TON<&XO_Xdauyw;nYGzLs(09yqBu}~{ zp$TmB4dOvd-TAW6;5$3DWCr8?#M+Rt{CnAXx^8Jt>D^_srJ2bk3fiO9hJKvaJUsM; zb>Qx1e z)nBp!)f^r}sDSz+p-YuX@!a&BXHC(VJ22XQOQ}b7Z5I~^vdx1X=xcl66zqfAD5>c+LczTYH>tyY+eSN>S=v%60-*su0BvI$KQ zN;fx$>wK52^FHzHtPZvi`l*;%nS6|3yqLXvNa`n;xYEo371BUSA4~rk2WMTLiqTve zZK2s$#6HpPp2zcO5NT@&F>C{iqQm9dV}xz380|3dUh>b^)&it3d$)W(7WyvSXrAyn zk?5D!HVWF@EqzD-FZ{&c7Yh;wZ+Tq;!m^xffKgPuRqk!R7wz7OGwV`R5vD>q_J2Rg zD*be3ywMd}VdSc3sTWB6?G0~>;X60EfW&*~X>lp@i5#yqX*q-U53sn3 z?=p^1J*UXXPR^ZAze*ZCX8E>yvg^Y7C~kAQGa2AhLQB-f$p4HLioLZQdnIgo?MJs= zPx3jm?d%VM9S2e6!{3uM-@V~Exz3J`R*uxjAs36?gVQ)@@zdYuKN|RAL+aMG+%wT} zna8A9W0tGfu<`w7NL$xp?#7hVq;r}W<77P9NN8>!?jA_N>mpcTuC7IrjHh_H-=c|F z^pj|j@xLkOHBGdNunT=n52UQVeJB+Kg+Kn-Z%suauS{q5mnp#(O_A^tXay^cIDO)` zo!G3M+}{04gy`AC$A;Kgy+l9J!u+cuBHkuRTZOM*d)(A+a!ZWJ^yU*-ytPoJ zk?}}n2xKBZ?3ChxSPktNsQ5!8EWRk~$%g@+wYv`%;S&a=O}Ww&yg)9<1bA?K(R}PA zM2zP}=vb`%#(fg*y?z+C=kTZr#@KJr^~UpBzZ^<=`5X5x2sXOb@`_6VbcYuTs-n@} z$I%dv*RTjzw{@MYFrlTK)Y?C&0Kc*JX*4P~Op&cGxeoO5!p)hh$>UWvKDsmJ}X|An8A4XI>fgXh`Gb##u| z1I)~UN zYZQpC-=vGyX94{X(}Gk^C8zscpREh6nWK;dn`g_uF~p)jmHY2?^ks*dtf?%lg?3%x z)4Y36DlGH@+3@7d4u7)`qL6IcqwedPy59K#&2q9=-pb+#(81 ztO^YwKB>1L5Yh+D%JGAbh66F_j~41d0x8j_wEl5*&jW^9+22n&C5*5ijC_d)j8?WO zGr2gh9O|`M;ed_!PdXBI=9Kq-7qIST=>cfWkh)yIBjI+}@}CtsQ255MXJ z!B$-)qhzEsn-KN7O7A(|6KfhBd<7Hy$1;Al49yzlf3>R8mz9AYoFE0xYI6{@^Nq{~ z#|zv&FntX8xperRVc^(HL5FQPv8KZwhrUZcGeK;op8Z!c_t&76s zi>$HL^}?H=JcmGokjiDNLRVEm9-N26^a7o02tOEuN5J{bt^2yt$-r?PqeK|(`DUw{ zLJmb#{b+|0Dk#OqBloppr&-@u4l_{_B1DtpVn5~Ks(^4|A)xxQ@BTthH?8I%XU$B+ z^yNYsmMq1CTH1+KVHKW1Yr&l6LtV~6$?Omql(b0C%q){^WXjbrbB(kf@bIDDU}|gr zkTIgUbK*e$Jfuz6gah)z97$?x?xNa=4l!udtIm>}JOF-qu3-95y-)R0;SyE`(=$lM zYsp~5!*Ru< zmzRF%5Y06GP>A|QYd%?_d2&)`flGyV3PG$;13D)_uHeIJ$;e;7eNFI<*pIJ}bsID% zFi++G9{Tc6q~;3e6UtE!>K|iun3V@9Bs=M?L50(e#l)}@~Ii@;N&LWc*FvWjo9*UjEwAF(I!xrYlnlrtS*6xW-%k_ zyKQT^G2CC*?)Ju_C)y_%RmPo@wgLO9=)z`erMaufca*2{S=Y_-R(9pih7zNW@y;k{ z)=dxVbx_5bB(8%JtsltW8abhy-~mLwgO{I0w5(LP53hA+c<(f3T&_3!*1|Qk-@f8H zGxJzwI*sm*Wtfdef*pz$pnt=OnAZ-rNHTNX%WFHuN=y)a-~dQ=5;S$OjxxA~y}(lx z%A1~kVmFKyI7@skPbg0o)V>Q~ICDU~na9f|ZjwtHP-Ii{PBk$PBOdw7w9K)$g&KSE zdn#(Z86bIF1zB~kdI2GemxW>DWchq>oW2V;W*MX!RhGIq&BsO=u0Pol{e3*zKB2v; zvI|A9-p%aIZLG749R>1AYHFyB_8PS9hO{?V#A6j$7fOdL9KrjXbEFd6o zDufdLj+`Xg4im6=);g{u&AUNR(!b*aSGt%ut>P|E2Jqw5{QgQQTXpnPH2%F}8D@vK#wwQan?I;ps4wfzLQqP@9*)N~0jDMjM$ z1T~FS_1T)a<*i=oxbjK6;R_K)|IrNxh|o{pjkvJXe6bTegq-1O8_#T|IRm}-M)O@7 z>t@NZj_#IG&BXmVVPLN8=dL20N2jL09pLuw?q52vlBKio%+h*8F4SzE_#^Jj4~cth z6I_EPt`YX1*>L`-(tMe(&WtzZ5mVU?99uUw%ZU2g;R@mJr30&JmkqrPUI!Kv8JNNvH@6Y8gsfC*(Hqv zS1H2*T(*a5J*_y5OHxhv{3jyvwFS(T9*Y#Mi9zAUiW^kStuo9T?7wWI?=x%*3B4dj zk`c|P$Em+R&emXGM)zuAac~Z&j_E5UO2l0ZT-;$5pnSu4OG^R<-vYF|X8q3~H)Jmr z-MeSd6v8k;vogUBSPehMC-Ju^%fE+=u!ww~Y%wOAif<6Edu%0^+sF6mWjtAOCn1`70U8LA?};<6?s z$Llh)z!xOE$Bryp%iMmO!Pzd&IzrDlHaJTRMhVu2FKppdyDtBwLl&LEYF#$u(XLM2 z>^eU_WcY~2(tv;&69MGJvKNcVH>XCBMSOoK*iSTTJ*R>BR9OKF$b@-41({tyx!#5` z7rsdI;z~EaQ@CrMlvkY6{;kW{Od z#f@pA5f??qBqTWGlx^MBj`?htZ_-k6@%aRz7cV$QO~{xfa-qvkL|&vW^3m19SqNOl zI#z7`tUKd9VT?9AiJfIOSK9)(HYq;PXVPiiCWOjibTZz7k)7&vQoxyM!IO&2%+C_p zZcv}$!ag@<*x8_u%tha60;n94*f7=B#)kr|tJlA_3n zkYs-QR%A}531NT6#oH_k#x3#j6u8%`;wV})bQuh%=*HEUFhE>9x3hP%kKy%wLWs-y zTavM^PSCC(@-_xT-dp8w2gOSPd6g|3n191Jw}P(0+vZsK^lCAfs5Zdd0vJ z2H{cd?6GiP9v!EvCW$A})J~w}duCnW9iU7UkDDv3vgBe=_#EpwBkr+4xe<;+jeK9= zh91HMN)AB9Q+YUdx9(&ArGh`0gEV*w>OSQZmD*bShH$&bICW+Jy)21f>M>>T-Dl+m zWy?KvaQ*FL(?&pCmd3}k2OYJ zUwxK4qMSuAdn{;w%C>$l)OtltC^Pa5yPaQc-JWve?z7P14n4uh809?gT1nzn;clIx z1(tR;9Xai23ci48zVh50r2}j)wsE4P6oUpu8;5KS1dcdKH%I{%)PrHpfAg~<$I@Xb$YBcva(f!xwn9}HGODBYU z?E&~QFhF21#GZI#E9HCRmegiI#J3<#KA`VvXdvyFHz@w&UB_W+9_~%IxH82s{SZFT zLIJCG3^r|?@?nJ68|7Q%RRE%9Zp0Mg`cZY4qe~q$aCWAA>durBrAnE*F`amkww2fk zHAsPR`N;IuS({{DlDBtn;=9vU!SXSMia;@25ozAIpl`VmRv)Jr@&vw$0zl-HuY4Pu z0Y=%sBeRN{J)eYOI^4c44;_D)j?@~;JiMZad)utYq}iCUA^vBSpH*U?_M9-G93!2( z3|O42{E%q(d=7tg1b>!|yubPja`)7-r^lwN?<#B)Sa}v zQXV{3JaRDm*Zf1#^`qZzi}eHJs6M;4y#?ftV^)ykc0qiEi7%n}-zzVUuezaJ=NkW# zS+ji!+_amJZ{y-Cpb}1F`YL$>{ZqBN+~3sESgF6j=pms%Up@56aG@#OBi~w?&G#S- zpMQN~Hl)%$oVSD4!S*1~;Rd4qs~hHEeU(C3lxOar za(>~`Ea*;}Whx4lA5c2@zA<)lS%ULyerP~(G=6!DQ zB*K5*^W*ia>8^b}M=@*wqJP%g=&U1=n_l7*6{~^uh|04X;@h~kp_@dj%$^0rJB&w1 z5<#(S+b8b<73G6fN;?VTQnyEr}Q2XVLaI_jZCt8 zv(*D>fR1&>If#Tf(r$4Pn=MmrW(6Gl)bMinDP9JBJdOp-#CKWb-X*r+H>EUyT<7{d zgY9DI0_w!I`LR#rQH3@WbiQu_xk%6{xCaeaNoXZ@({bnf-K;*LZB{Y5BZI2<*Xfym z(zF*bs+IRab;awr^1EGQStQVs{^`HD0BPv)ljhfjBvP-6aPw4pap@r^CCs6@TGhV{ zh(<3I_QRc|ODtun)HVJguGJxv=MCbE^J|kMqn(Gt!!G|R#wJ&o!`9%&QxzhvSMx;@ z{Vg|HRgjByAEN999?ih-cFdLKGM^l(4EX!p#&vn?n%8#{Pb7rN_b z)C=ps5t%8vzGeRHwz!~pJLt}kx7SfBpD!135lm5x)DXfE^f@IGGu}k;zipD@`w=u5 zg$e2dwMeu^I*oDmVd);&2iuF(`ib192(Ra7^o{9tMwTn{t2Bmonu=qYxJ-O*Cgm6@ zk@Y8wi3NOK1J)o-O5{S0CkI)4Yv<|@z@tYk4`pPk#l;$z+yiNvoc=kYvg|Y#jch)* z4pMgs^-LTO;+v78W=iyHu+7-#T1_a#Z_w5PWnXmZ=8~eStjuc^Sswh)CQ8nl2c7 ziQYOwP&gxDM3FA)P_Y6hsmNBNj>z=X=ZORoRv|hBlUc2_g)bF>0DuZ*$QlOrh zWO7+?L4GCcHE(U*MlWb_BxKd~x(L&GmG5v|QI!N?%jgpYqao{3(J!iZi_#(n=R_|Z za*QWrSU<+P89#J_v4n_{Nd~I*4eGSRxO)XDeG{^6MV9LYn7RYpNTj$m20&?Gqj%!( zd`|BVRewjubCXXikj_AKndr0%0&`iDbv8;N_5p|KNa)4KX0Zbd1l&7*A;AyiOSKeAIsu5M(~ zl9%6mm9PH(=)##sxw5KmDtPTs=*2xxMZ5OxHvBx=-d)A==z`UAs_4j=EzpXjpLF!& z9ZT`+Q3P8ixlehf-Rv{elrNEHUQ_#dUj|bVX@r1Y5=mG#*k38DhOL*+C=mV={4qd* zIX=%m5<~}$d`Sx33;Jf_=F(&x-tclgKLU9K>H-hX?ScZ#k5G5SDs*G|DN+$z0nROx zxclsZ-vsbn#{jAKC)a!gR%Qc5l0~zlTVCKdgXU4z>YT(I;_fDhos}YAK)-ksUP(TO zb4nV^3_t!Vm3^P=5t1E+Kn`)rfWc;OAnCMvJZ~#XRVmH9yTWp7qu#^Rn{F}?Jq>@n z?Lk=>7#1S=AHXY@XxLErKL}hb8N>l51O4`YB4hv8U;j_ItlQLbG596$od`_eI_sZ& z&%eutN+Fv!FcQ;5Lk{b^9G|F_98vL=Kpe!^7fT022V)Qvlo$jZkU?;@9B*+6{!zxB z;rJUN9Drcq_u=MSO_;lgfh)*|jTt8Z%aIK?jeiL?p*->1wniAjvSRPge*A+VKF8&+ zB;Z_t>zY%$VLH=`%m7rURPiF`e}t`XC}jVi8^5jx2F}t_kRI@DYMeEtvr zTJVQ}j{*-Ifap~nXA&9M$XmR*^xrl00s&|WpUO{-Kc+vS0N|Ab(Cd|vvGw^ZifzjsnI+}@%TJ$RIzt*|AJQohDXs6cj%xRIHFZLnrQ{IK+pWoQ zOuu^}!@;ZRFT4I{jK(44uo@}j=rV?PyO`ekruMcIKxUgKwfkfqGT zk|j}#*q1rdV!?MNehroyUkTv=4#z2I=91qh2 zTh%vc3rK_JC{gs6ScK|^K8R3U(RR+qR$WsSjD3yAkuhMX;#pyDbo<;Rqb`mw{(+_6kfX-G#5JzqP}@-EWxQ<=Bs`bhDf@%Gt3yVxh@`vW*iB#>NMb zdMf{tsLXsZZD`?Ec|3=tWIKmdzuEusGE5|gdjS@Bwm3prJ`?r9JLLl^6f~|XGQW__ z47sTio$_~8EZLtR=eO2BI{ntIUtzLD4w*i&ok(xZaLJ?B@&B2m5o+eM8g}NOq(Fbo z%24z`sLG7tKNtu2Yb<*@q-)smN3Xv$sIV;IVKb1S;`{Jk>&K{j5s583FK@goxLkEU z!m!7@2dzgY{*SI%Yj}Z@Yl5>b9>v)OUCRZH&Yf>(xb8=2Y<}IOYJiGcSA0*<6FJ9c z{$fZgQ&J4s?zBI5SPhXMd8g(@b)y+kd&RYJw}B zWaE-IYYXb?Ee;16Nkt$JeTDqhCxXn$u@NZsWx^2Uj8)-#oeX5U5)H;0M;my6rW4l! zMHde&7CM@&Fc|H$f%CrA>MKk1<{PI?*~A_=F(vR>UTNX zm*-i`S`h)?<6`b+s^jVt8UvMDXjF|D| zliMZ4rc>s5z9Ss(oa<4&6-^8T`9NKa9*|azzqr)mDCS|e!267CsaBATOyFUDOqFM_ zp{}+?FzWNyVLPpGAM0aMq^a=VE+y8N13gDCi$Ic+-Ds$_FBOOu&5i!WEP2}hJo>5E zGIVB8P<{Eg$Tg$-kaJa1uF)`u zJ%oF58hAzfXw7`!^;EP2rS5Y1yW?<@RkFSPxz^#2hzel*A@Nnc!)41==RD~%q;~V~ z(wKUyEt8hoznlnVzVWW2P7pA>6Z9@JH=SY_{DPn4QY|~Bf#AXU1;=?&#wON;Vz(-1 zIyrj|cLBB25nd_$Z+oxQsaCzGRJ_Er9GLnKR!Ye!?sAk9lZD}(dG?iz63=9|*H^ke zKGE12-O+61?VIn76eP{Nq-a}3@|n6dlYjTn|0?{X>>8=6=cs?zOhg3zm{^PX+d?79 zii0cgYRFCzku&|^htmj24(Vm2a~_(phU&XKSqPg294FTkOm9H2k0>eM<6Kb@h*qHl z2)er7d^p?I=U%~iAiHtDN}ZrUQ_2;W=Wf2+BPB+xL*rxJZ8-eIf6Mu|lK8w#i#&~l z$UDOY^sX9Di-c$y^liy*8vPT+Hhs20%5|f_*FuNo6cW0pzY4QA~nym;Wi(ZUBsK0Ot>NQOL4Jv$0vo56@=e!{|3}@!Q zDj`(TSoQg02;$T==)@WGytcwEZYhqCCT?(U8q=YZ@(5eHL#f}AR!MMZ7a3|*I4#j< z_O+_+&E-?yZ~cy0QuvcWXNV3~^TJrCs3AYT82Z_rI+1vc*$+-0_FVqHtIdA5BCjV1 z*FNK{r63!-%q^58K)1SZ(40E9B_nk{!&a|lK(rT2$lLR{!!R$mQ#du=RYyWYDObOE zeB6hp)v{w2c_@5I@NzKKAs?&nzhoL@KM`6HxY@B_KGb)a4HW$9iOLWbFYvp&0Wqn85{rY z_Ban1rQq&nsB^bGVM|$_&%eK(5^qQ#WBo7F(9`^b3LgWEW5(;KI70z3&(!_o5wVB- zb1Lp3pr3O`j=4)|sQYxZSm&9^;A>SE2~C(a&6(a}wb&_fEJdFDdL+NWw-sgeOqySo znZUuiRc`yrrGPqJ)-S0Yb<8Ci3=(!yWa*sRF_rbnzqZrZXn>PGj9uLjOIC>w@BYRD+)x1z|(&2XoLo8%+tmBFVG;?u0^7N6sHeAQiyLX1KE)F~m zh!fIz@-P`g@HY87&{AeMxN|2F?);(+gYi4Q^P{>f`F>aHhaC6PP!M<)d<BHz4mIi zbTy|2V`soGrHS){<@eNJ{I}qy+E;^1^0wE%=k`K(2lrtwh`inJC*3+C1$El=+6%&? z4dkcVNCD3F459D#zzoku)_Od6$H{fhP^9Z^p;^ClW#%^PF2t;#%Wi$+mnpaEnE0F! zq9hN4+=hD#sB!WT#Uk~5gCm+sVC=Nf_x28^1w+?^DSX4}D~dF`)4C>%)l98lAO~WS@?{2CY&G6`WZ#k>ZSI9Q?Ob*xJ+$@iEMnJ<=@`Bzyb`8b zZgp?eWP;9Z(ZWx4v<9?Zdb_UWGiXh%$@h_ZQ*G@D6C2aD6RwS)3C9)Ddf@es*9zAt zI@soOf3v;brOlAKrS#yq@y zL)2x!v2uduSaKs#LH?F438Kj8g>Nyeiv%(8B3r`v`i_URk*PsOcu@_fBcGQFNtSA7+G;@D`Fe5W)P?D$rs0~j&B9A))*ddmAzL<# zv&n9{3LaWqc=J%E5^+oz^}6+*fZ^}qFj|Et?I70J`_$cWz~T!6eA`ve`u!W{{I1#T z1jKTjvkd*2G8T%#nDdAopz`C5!t*pLlBXVsHQTJiLd>bjb0Scfg6}O3C6)cF>zcWV zdmy`z%v|8y@)zt&+*P;Kg-Whh`ZO-NyDkd#Tfta;1Ci_r1+xq*xX8GfRiDZiE5*l<|Rud(p7R+dBT8aD>e0?na(Yy#FoyWZ{x! zdg0#`i8=@Al(fI3NuF7aZQp*xuEc~;t|B-l2S~?)Q?FS9VmwHCgK{U~FJ1v>dU#X) zEw^V$f#1YG)se`^)@u*6W*$Ji-8x?--PZP+0esU6*4Fhj{?wn4Ha}gi^CKc4M1GR` zI&WX78-IL!++}<+Jv^4yHKNN9UhAWI?3{O*r1Y8btJ>3nWcd zp#&@!e&Yj_683q6nY`qxr~0Sl=6LDnc71yt*TQ3EPGiptXYJ_)iBnBTA-nI;bzi4B zn}inYv>n>Y-s__^6QS^LMzCM%LgOjF;xVE5mD_+%mlCMV<#!z*g)}9#)kL+me2CbU zi-$I4ehFMl_Ghuqgu{5Q^j+&*90TCVvd3J%%^6XHRqJk@7qas8*g4@;JH7RfdC3VP z8RbWhVK;_xQ+ar}9e1T9e`Hyp>kdw=%kOq`c|stNhi zKIXeNj(T^~yxAh)omwR7h@1@N_IGeDtaVt~#>0-qJE(Qx>!$r5&+fOol{sI9=m+w68 z?e=Qa(O|Y@I|p_2y>DRO;F{pZU}b1^fAPrDV51N#^=XObC>5iA|EEa~>Ax7j!JLO< z`UOUSgTw98dJFdp^%DR&NHhmN{9k*z8j{NtZJHW=Q( zb-fFPl~ItT{j&3msqX6-CQ6W~-acfDp{(BJpj*7OSZx_w3x`Awxl2iR5#O39!~W7# zo3{YcB5oLW-lOGXC5t=Kie4~0)VfYNb+DNT_n|j46C=}L_AWG6K0Tq%bxt+slat@~Zg>EG-bjTTXg^(MSjgLr zdNRb|a6skCyE2#F9-)D^!!?;t8cm!y0NKGBkk;`;{WD%A$|5F`S>6(j1k242Hj0da zE`3!HIVa)6#V9a>SZ|3wxpsI`T5?o{DY>4@fLr^se-%Q)#@yH#w$X!m1Y0xuaAo4O zFK=fs7(svIPl_2=Le=v_1V~P`c53xr;;}IQ;J1s^d^w_-y&56*^2J7^A%>$R!0LLz z;z)(hMgQ^Mqy3sP$WL|ynWRr^SG!f~Q7NA$uKbFJH_9Hjq*tGEC={u#eBt8fV%^z= z>clVlsHL;1v2copP^Y6J#8k-M)l2(T#HGlmN>l>6Oy!K7MtUog2LDoTmBNZ9- zg6=uA*}1Y6kxn#^q}=b&T3hPCghEDHWenUgjncR=I!{YvuW#-Rd@NF&B^*IAkH?6# zI{oXu@z=p1W~Sr)hKeOJY5uMC5bQs{F;WOzfrX8}#>@IpEpM0psgtQa^n4_ft9M<* zS&>?pF?*lZ2v!)+4!?TJw*i*#B0nzM*-{yM=iHHGd|+UxJeFgNk~6HL{n^XUP7F7_ zJt|6|ahyJJ)mSgmvizZIMqq60v;f|ap!)FB|C-4Eo~K30usrOs=Ek%5HIIAwO#JSA1skf`O@xOm zc0SE5KfxO>*;Ed848*xv2nuda24NPTY(7VuNYi>~Q}mo;w}@!8ou zUyA|{{DlkH(05dYg<|_pgoS;xjB-gxL$jw+y&h~|p)uAvV$mZyh^c4wd3t8f(B|-$ z4dZUZ#TY5q^25o|>kZ(`RhhUipHHdf38XWKgO4?wBmSr0&bG3q#dZ%E8t21rb7Z@8 z_*K2L8a==AWICjfMjiSbWIHR=Nbaoasn}2Y9CKLJJ|r|pE_$-f4;`FWyaDbq4TUtU zJU6r)sh5Z;&>SBhlJ?P=#jp|Do2xYv9J{cxGiWgeZiZCAxdWu*{m9GF`3r zVFn|;BKy*H+cv|eN~xszIvS-&@~Pa;7Qp80rX!Qxkb3o$51Mivy7ssh+_`G@e$?F# zaZMm<(6^f;r7S|P*$?a<3-)LX!?!ml$toh&oNan2I?qP_NFbJ%CO6%Bx*WGidPy1z zZC1l`^z=_1m-`lZCio+YbiQr4e3q!AeUXitKFQ2nELS19&uX&bEw_7=X0bh#JKJuG zPFb{~=q!FVY&J3d0Y|psdDj&bksuz$GUBefZzv_qQT;K}RWJn+Ql5O+jI$oMFQt&t zn0?WpQz>e#4QO;2y{qkzekwMPzP12ZnYu)j3a_D<-era<^!YxohppZ~`)=dYtS^s? z9i|o1x621Uhq?Z#_hPKIGK)nT~<%%C1d6w4R;}MAt-yfadES4cZnwzF1_E~wSsN4OA2HUl-lS* zRJY_j2|jVx!U~U>J6WmYh)-%_DbJFuca%#AwGwMDAJOnitPm?eKjKfJOeTXe z^{SSk(@r4&wh`eUyWwlV=p%VL`uC*wVY5F-gPVIHyyKGmF+|led}K=66Oo|uid
=9iI4tkWCTOq*dDaTRd~ zWfAv*u@lN$6xE!ibqYZjnc}O4@=GTqudz7eveunT!1Ml3@r_GpwuEo#DLVB_c61x9 zC@3+v)vquSg_1P_lLE32*Y;*7l2^SdJD4Z?qZUFTOs^Z3=?sK8nX%D?y+9B#c#hu( z6ngBfGW%m&FsuiWgfGAHwATLB*Q^C|O}g&(K){wN;>z@$#(~PNFTDbEmBOEB({`%I z&YmWS>fYxCO7m)gJ3O|eQ9PklM#!fYwk!{kn8CJORPgc;VS9~2odW_bBF}bPg|51Z zV8PROeol0e1=Hg`K-5`N~s#zN!?)JG~$2YR&>k z`x=nibXz+~C8M|*VsM0AA_Cp+JbrX^`jlkjR48EDf3Ll)r=dDe^omg7PDk%STr#wM z1GK2eAiZopclv;=%%+wjyh?K;=p3r3^4=#c-Ze(xh;;GgSA8Ecw;7qb^`s-8OXE@D zGvVvUw9M(tH~702&xxh;hl8W_Q?ZCX(wz`{FzKXZfVjg`c_t01MHhQlUj17 z)N()H;v-)+&}g4wDpT^CR#PHFNPHBZgc`Zxv#`w!oxgi>p}2=^;_0E(CvnImiHx3G zeClcj#{eld0^%^6dBH;vLcPr@f#fkHiqxo!Nbru+!kV1n%sHk-a$a{QH-i zAU%1_QBT@@3&r0mA_-MNd$ki&DCW7hAyMfd2664r!&=mx{4`^b`+l2X)6Pj*pK$cW z$7bUgUb>!HI@gez>0XO!3ZVtriT>+NFUQxR*&{M?v5* zYwzbqMyaKzUICXky+y~^R7O5_-50`|#+sfjy+4&UtBIw|p1{;9#QY&I28jpxJrlOn z53c~*Ts`ac<={T>PQ&N;Lm8S%1`RMv z@lLH%{?a`fZuMNG+`ccbJAZJM#iZs%l>P^~$XsQ|)nf1bOS;GQx0a#zx?8bzrBj!; zT+ADSyAw^CCfkDM64dF|fLV%q8`P#(_%rUPh0zl}J$&ol+Im$Klc=G^WqFF5p@jtW zw&X2x6*QbnyOb$ut+g|0yPfImFsh-$I#>;`472L9rTYH(HUhcBnysi6*6)@D8*=B6 z;{;7g>Cyw#707YlGm{_cu|f`vaMM1fLK|BxJ$a;4hI- zbxXBl0raA1(?4BBf;plVv;Y%#JdGGu-yJb{^_mVYBT6;Ur57;xtL~}HG-0|4R=%>M zjm{pkE5RzG7pTBXDEKc@usZFNk0AMsqj9uJHeF}2)m@)KY?GzkFcNTlrFqry@5Mn~ zcW=NmRG{CQ&lWK1)@Z;P^2JwCt)bm)+U)UyE=*9? zJT;vUe$}qC>JHfo@A!BQ`M|PIU@#_i@ptB;um|hq`Nb|H>zfB%iNiKu=8gfa;5XI` zL*Q>CeZ|OmpH^ZK%|rD79voaB+0zjnK=5t^=0gOflbdmWl?BMma%w{Q+X)CmQbz;a z`9^~E(u2Rkjg@^Hxp$zyoudrU7c~QrykSp=_o-vRrGbl<(#D??)7IJ;I&7|y0=|be z{It~yHiX-mOZC05isOn8Nx4ArkYuO$05nIB@@#}~Kx}ReA+@BlPyL}88c$DBZW6TT zBq@uKRFjN?&-4s<8fqRaTaBk>s`&Q10wbC-4W*f<JLC5Vt;>c?{hXG$@vXK<|Xp&VC(vh77wNUC2|8S;A;Wy zPTq*NtM_RM6Lk>>2a$XJU!N zBY>scFc>K%8*FnYAVF8%s4?R&Ob*wNg~AVSgupoBqq5q`B9CnT-G1Vo-6k@c1L$hA zVdd|bW?13*G#op;IhXA29s{9Zy``aj#eVzpWN+NvGHPpTsb%Bv`(roI^%DNOnK2Jd z`5T9?80K6$ySM<$Y?g%!d)J+->WnBN@Mh@C@pR~|*iip-=U5k=`_HzAmv{F+Z-vID zIKY*e^^ELSFMPeF-C}h_P zTIO>mfWp)VpG+fl-))B8b5rcYlOA`DOFKeGQek};a3vImV6y&`>T*ny8F>6~8)-Z; zSlXqM*z}+t!_4AL(6W}E@7?*Je9+e3X3KoxQQiS&Yn9FORRFZn_}n9Pvv|3ZeY>>z z>e!a*En{jMFd=+KC;2F}?k3)<>x1i4uj-8jLCaQ2?YW_c{$yNf+X*2F_uTaXt|$*Z zhvl}rcT4G0VXR)?j?PJX55c(gU_49&g^`1C`g$?^lMv3dU!@R#gn zVyBPA$f$i;tJ=vRaMk?TZg8oQ@)Z7tJ&y>0{AcjyrgK4ITeUqiCy!8>F3E>o&}4IX z2qG)I4Azw*VF9;@M71;w6Y0UY&Q^1I)TQQST4N(cB#!^t9{S-31)@hVCxr(kIw(@i&U}~Dp{^>JDn(>(j?HJ!`KF#U6~Ma89hJN{DNv+e>ITCJ2yaNTItrcoE2upBpY&) ztazAeX`uzHCWDd5F!~r2ihmOPu#W_u;|_|3l`L~%AM;VH(GWATvk#j+`)-op;*)jp zGGgyT%|~rsCR3WvI`S-~Jk5EVZ`4u8`P_&4U5Vao+`S9J0D@KKJ1v;dv91XB881S1 zs!s&2^^xxy|4AC$7+%l;5a46}OlS?+abC{~SZ8KSTE1634D8h!ON*R+zwihcn&VjGn$0@7wjAh;>ff{4xH@>JmXt`E|jA;zpfUDjYd3{cEt>hA6`EPJo!{aOo|<3B$g8hom-)%Mn+eb!UV ztird_J6)Msv!2nam=}Jrn!jq+@NX9M(A>1#x0fy_J>k1)oW=PeT%lZ#y~x{D^BODbyTl^lXOmdZB415>I~zPR!bS z1@;H-yU=DAVi~o1?)!!wzWR!D|0N!tGJ|?O6p1X$+*vK{tdnIE;a`SU7Y_~NSeBWjZKLujA|rz7*aoHS!BmOmwXr;g@5Q(TOGxOwx< zjCNW9j1;apE9~PU{+Db z2LTB0G3CRDi9=a0+J~$-z2|L=&#IzbLo0*CXQ1jF9#hvo4HDkc6Zd$ky2Z*!n?T_1 z0{+uyVGjGx@A*~RnG$&`uZj*h?jl;9okvy*1x41@*?sSx+}AzDWY1a8W71|>EqB?y zP90`fs7)0{6k44BN`zi3Zcel+9)=hoXuaHKS+E~QA|3p>u9+lMa^=UGw4IP+waS~F2w*VeVRU@`&xrTR-9Onp3CS)fcpTu+o2&-AjLX0>JW=ZaJt`N_ zd|Q_E;AeKOuF)?ZuV@0@UWqg1B$|cK+Yvan>niS7bT>tXNr-mli<^J#(;65W=eSR2O?mTi2FQ+;V6oaQvR@1&crh73_0W5O){zA!?m@WZIIo(PJ zWv98-PyN1(Sz#>GFXs+WJ#K9aX_ifc2zO=@t7;`wH;#b+SX1n92i&o+uLwfZUlP^` zT?G}^k{%VgqyBUX(zdSi0Q+0Q3Nxjb6}!eB{h8Wycy6?A?Qi{7KQ8}?6nThwz`Y9u zW}stH_pGE*6!qCltUh;*8lhwQkPk%XzdFYp>{<|>=`6cd1g6@(yj0OLQ@hFSGq?x^ zjaWs77b->Y9jV{!M@6O5N+m~3%gzq(f~bF zd{zg)U}tDzK0eu$M3l@!L)qw|l7Fe^cx#{5d|$U+mLGpAyokXPnas&*?NSa4z*gRI zWuOH94U$jeki3!4aDuo5g;TJ4mjahAga(1z|#NJdbI zvFNZLaVG_~ua{yNXxE^advp}o&iy{NCt;71(W^N@_6aoVP%%y|0{A{Pw-1X^AD>8@ z$UPzolS-;K#xXYw@7m|UjnexFkd)j3Pva}L~eK!2b8A>nK0{~oB2|wnbg42+SE*F9?K~xvsu~PJmA)>43p56$T{Bw zAJF`AAsUIleoFd}aZ=vs@4h z3}Rmab!UF7I5{SD2xe!-Q3y&M^`q4w zKCD>|S(P#QeS`sdns7eKwtGGKQ(Io6+3O)y)l)5Q`_0V>SSW#b41qT^{|R@bb^BGT zQ*tkxy8Hv{w&p%DBL{mmd&=T*YBHF}OIPdDnOOSdYBc>*v!Ba*aPc|dJKnJkR~N*5 zY-J8iq}w@;?0C+fWu?pez)^ts(7(2#Z?Wp~o}7?gqzM+z%e#8P5Va32`?P?|5bB3C z^Eq$3dl{=gXGb6EA0JoFyPIkU;Sao(Tz>Eh4*8nxz*38w4orEn4yQtbxBP_K3e1frj%S2fB$y)MTXZ62o&D$DGO5Vwn@zfV@Gzp z?gI6ze{_v?MZyvyj`vVhlDqe7f<*3!S6|P8z*k2z5(Nr>e6}KIa*<`${n8YGUN zCZ3~kT# z_oDw8^Y-|o1{2?%@xdJeBM9!#q}-gLK#M z?m}7Ru4~Y<7%3nV4Y>sl=E_|#dayIz3=#+y{T$rjER z-v=H&cdEBfi63=|Q9$fpNh!+iOl_OyI%0J{sYI6#VB?LbA)v{Rx(+g=wN`c}9Xrw; zjzhu+3e<7y`SXeYs#U78YrzdKB?A26k4ZiY2-_ogNo#^`hm8CDmjg>Ok8H=n>&uBo zUG@5fn(Kx4KZn5Jt&#S8zX`-)sjor@;@I4{2#$1>34&%w3zMHWJ)3{4mcqangO8~E zRNh@KIsV+7l=fFIp8;T9Y{2n1jz$T_?v}qGBgD54-MPh7s#OJAzCmH0}{UkMT!{q~MvGy`6n#!f}gr=NZA+ zv=>3GtFwCO_J#R@W>n4Y;@*_`XOkgdTo>l$n_DSH9tp3ql!`&4*Kbm=i$Cc=7?2tC z#<`bKg6THqo9qTzo(5P~q6`z!t&VKA{uAn<=;UD{SoB#??2+dxAh8RGh|u=~rCvR1`RTeX_)*84 z@Ar$6jDo4}<<1zY$SrdNb@6u?((}Bd7JhsjHk>LRa)6v81Q9M##jBX<5p;C&dJMAh zunUmyxw7_*K`>p_a zcec7+khfzqV=9d#*Y#?X$64h*bJ@RnD^bnXsPm@=k?fFA#1cx-E-Lx`e`G$C-M86EOzgVf)ztz3O$!L zJEeK@V}v^0i8lop%UD*l^3JRHUWw)FJDGQTaG4QfRAWw0M;F@pQv5N3c4IBo<6^#a zX&tm&@wg{2qhCycFbkEztk1OZe=Ims7^@VA%~*F9yFS3h^aXhKCJE*p#k@)R-19Li zyavJWqg!pPM0Od(EiUi-T>})i~ zT+DJw6Hv4kw45;*o*C&zvU3>`SpTbMCq1lfCl*50X1v#xry)N6{k8>VH{vRapva0k zht%b(M@<_$G-vk{`dX`tox}br^K>54Q zWJ3o1sy&DOn!e|v(Tzb)xuB3-?Ng9SYHD&Cy*Y}P2p(s0wjmzv*~-z;4@vjjbYIvK z9xh9hLznPbTeClVgOX?2@QIb>?0k06H$fkaw#(Dpyu7g5i&OED>&Bd-oIiNJ2_oe0 z&b!3YpRsc@7e5N_VzZ_{8XHZCq1V*WqQ_&PE+I1VZd5B+tmZsEa(l06dF*4EkcxP4 z42FSIDm|aLM%wls2e0aOD*P2B$TgA|aq)`^mA6rQ`gUZ@{hg?@eLrjEP{^;b1a4?!>j-$#CC%ehc=!;R$-C@+|r)U zIlme5D)jU(8yI*{X=X5Em~iRU<&Q@hGO4;#{yt8b&-#?wrT6N7R+(yeBtdWZL3ffe z9{FN*2igHKDQ9ZOjE_Hx5>HP^VI03R(!Q^a?@kr&+{jUam7_iapP@VgA|e*JzBpEw&)Ehv$zuRN7(D*&{iUwV8wKEMdjTV zenDeGy0T!1=`Y{jO|zE|3esb>(7G4%^=?fMj0>^WY=Zk z%;J+}>@-?DvAQsoEu)~W%y*ZNWONVUq}#rIi;{3>>%pGRgOxBf3M7|I&sTvc*D=0q zNY(6?&yN7ox3o;Rx(Lh(WDRIj)uh!LI!P)d!v(I5MK4E*X9>#;llSn-xnW1ztqNGQ zTLiNlNIV1@C#>HOvRf%fAnudMwf_<|FjrN!t*;CVH^r|i*(ZAt8PTAfm^t77pIiV> zphVn|jy{BA!MdP_Z}Ul&8A;WCx}IBOa_cqy{Zm377W&BBvvaz!_{a)I85V%4)C#$+ zZ9O^GF8L39e8e$N>o-Bj+XW3=qbkJCjh$Hxq-?-Zzq|7F3j;;{1HTuDfLj3o>6zr^ z-bV+MN`UmL#v5qPh{SHxe22Egj@GvbHSalEuVXsv^6_Q4*+b5h0^kAM4aj5Ugf%E% zw<~{lt1+L*rJVEZPfw=~z-Xggs_*{AH~sH)(tndf*Z#l=sQNVjV(!f~_y5C2wfF%G z7U1Am$Q)pw8*h1J;ouzpD|PkXU46@-+OFduKs(Z zfAmFf1 zphrs~UJx!uJSfx8(BF>df3Xr_^jeE*ShVzUUzC1}AxDX3CJ4rTg@dC)`2Rc`|D7sJ zvjyYO8jAkcL-=neJ4UqWGxgEJa)umR1I*PH5%1w2i!x%He) zf~4zt<9nXum!9KtLa8tYg#5Z}WBraVtb?`EhIQ$~#%K^)YEgizAlQZ>p6JVD!V|vT)fbk2P zBPG>v)-1kc>f!twa}8dIJ=Ac31NLe`dkH)`-uyD&107YTqwW;sTP8FR`UK3s{!@SX zKX`k~usD`>{TC-d2*HB~f@^ShcXtg01}C^fkl=$e=pey@2L^&eaCdiicZV}s>wW)w z?X%x~o%7*b=Nrv*S9P`2-Br);xl8Zo>us?iD0w`+x72qv&DuO*>`+tv`8rQLD?BxL zar|G{@p>v`Q4Uv6BYc!-Par-AUwAiS-_;s5kQTR>=Y!hS%$dhG8qMV-=GH=U=aPba z-1$h}`cBU*eG1ul3IP9*T?<{R=}Xvms|f4lYWYTgJz4g|(sy2oTaF|wzP`uSekj4I zw$#RV7x)7v)-FQ|^h5Vcsp9h`nU;L=KRccY?la?yG^+Ahirg{GU;Q>a9n=LmMSRD+ zaq*!|tij?heW*wg^n1o@61x$2-CLjj5!sCh;~$7JD7MF9`%eoh=@K&8;7J%Af{n=o+Ci`g6jKv}Cth zTBkT?gStl2H&gMvd}&Rzc{($^MRt_YsoWD*7jk`x5fO>r>f3KrW0jU=(wa5nd<%Xdrm1e8vlP?(tWV8;6b~-m>3kz$5Zm8xQpn+W2sA{eMX61WSUb@qXIS;nhY^ z3j|e`Z+T)8&{O7nG@3ex@EZ;KWQ?@>nrJl+KF_PMFt5`moKTXCPOpUmfsqVek`*m4 zvfCQl*L~9QMl#dW+*v}g@#D-wGVbIqdnFjHuj1`F*`0Z{`fI1(?9EN}Sf1#*$2{ld zRi`pwQm|z4{mo*h7qpc=`pS%z71z-CYQ{IPN;gWA(PoYbLo`m4e#JCZU zX!6jbf93E+^b_9fr+Jo19tD&WtK{a9^EG8Z1HPe)^z6maRXX5e))tcatAe&yFRQAg z;WwXYPv{aptq4Q7x9R2{+!sspYDrXIbzX^x7qJ_Ss8zY%c}rT`pB}~E8L_@Jcq_x7 zltB%y?@+L&E{`5|;`FleEDUy+NcZ|2s+`2dbK{G~pPqbIT5J4m1*mcOjCQIs^H1d~ zFAO|*mOMJOJC1Gne}I++zVr~mzzlxXWy~Y@z+B;4CtX1h3xGiV1IMuf`sx z-cuLR_;WBH@t{LVY~>7deccfv3>y8W>-KK`Z)3>t^>EDEf^>e?&b2ii_%>?x-$x2M;PQ*aVQJ&jw_BC_9$&w~!LS7=MxCU!Y2uSbK9$<7 z`-YSTUD=&vtu=%`AMql|j@!71KHqocIPqdSOj0_@fAgBPxMZl2%rn$J*Rk(~r|M@h zKmUP_8`tJ-k6#7*BJ(6j660v_Pl$XDiX+_MYJt@=%-sfUob%i8MQZW%(Do1V)r`op zwpFX`k-0e1-O64lzZ9?6vkwo?gTO$=jhh4N3s4{OxIiF{y@jaBa6)A5NL>Iz`Ws18 zrHuvnV**y_S1bE7@tU&eNb)6Mn!bO^nJIps`G*0IcP2D?-5!KdEr4?(s9^XazHVH9 zI<2|y7xfobe&21d1wNw#KUU%W-mwm88-9m=($5o~8qmXP444a7?G%SkML)t-YkJ7v z6OT$sb@W<C*Z|9qc^imBLq+r=j(tly6_EMsrXN$N3O(*KN0|InOH zNCNTZE9LwVJrWfqJdfE>^t|6xF&VxuM(x|oYMNv5^6DFSN$A4~{g&)tDgM=MHp^ZQ zCru`&cEoyIJKlvW=;)oN<@+3yU^KO!$3*#pH8ReuBNZY4I^~tgB;V!C$Ajj*4Iw#) zy})Ox(VlsD!_}49*2p%?^qo}Jq8`V2qa|~{#!Ug~3zCca7xMY1FSjMef@i8wxVs4$ z=+!&OJlhIb2ftA(nt4DiGCDG4 z^JeqdVstmmx27c}>}5PF)m4L1*)=auG@3ZdlFPXFvvUt^_x*hS^wg5+QcFKGrUxR~ z+~pAGDfO71TjEqx2>i<<#uc};*PJyA7_JQSMcrO*y=lZW16)9uefwu`l8UEy%B>D1 zK|lPy4;(poTU|MbGixuTwW}o`_`6Zm#Jpft$AlQXfc9*Hg;=sQu82Nej1QNonH7fH zsv7(l9MNqcB0~p)J-;!q>mRS=Z&lx-bzxeQ=}zT!I7;d*jC-1=lTP95a%?wdntvE0 zVY=Xtw$3ALn!&Ug$lNT{KT8@6$Un4C-gRkpDdP66A@v{NTf!n(N#DD~m|kWdEy69R< z(T!@EQ6XUvmon%q+wrI_Mt8#FWwf0(Vb{Y^>BP42;S5qAN%2#S-@*m2|KE5yBl#MC z>Qo-2bv~|ULQ4w&wILBtmQ{U=zaRUwNGZT-R{bla-{0EK5kP0Ds(fxUFRp%9urxSE zNOusUh9GgQ0Ib?-Hw~zWQ~(sCkz{;l+v6M`OD5A!E&#+cKFUWq}!r zr%t__RGpDYpx^<;my?7B`h1R(PoMI*hZYedXelLJa;Vr9m#fP*QMTV80>Rh8;E_@9 ztRAp-?#ShV6Wvlmx@(Kli|av}iHzLHv!~4;6x-&MwY`yaP~(o*u}P2I+W&aQ=K2}W z9R!r%98S+lW~g1-kn6sPy8brx{nx7(91qUD!;{C-U4Ns`EB?DpC&F3XkA)O>FLy&a zzQ!Z*L}#YJcs*tr1{eM-ZmD92Wbw#bKu7VR1Cp=FiO?g3-msdAX`vRkHmAZ1zIn6p z(Sw^nLf_8CAVKY{G(9)sGu47H4uooS26?Gvc(`vf#OG zNDtT4KXB%$#sO;Gp`+MokgS_fhKxKABBd9MP_JhGW|#-Ztu!%>qGTmS&|!Ok&XsAv zYp#e$NVd#xf!n*1iBLjDi$3=l4|Mx+C+UKDy|=>0?{*>3%D^-wT#y<%z>LqVr{AM@ z?z!eo?e?8P?&;LCyh6251C{QZ+slHVl>==$^QOHVwdaNOcP^gPw5Ge*vMh$ZWr~7G z|FVM_AGszP?(QORDwG=LI|0i#IUYb7Ukhk;tl8HA=noy`Ab}N>+RnhE1g3nzOnS71 zBJ7n$%C~uap?Q+pu4@EGz;U|1gshBff_z@>?PKomXHGnqr09A+dC1tdrX8PtlLM%e zp)g!~aQ41Qrg>^o4_u(szQA&IuU0V<@8*v~cb?(RR{w7yjTlm6#FP_lp!&cF{l1ckrLBv+5J4Nn=sVYy>baMrBh~Xs*Snh z_P?82YzzI!StTx$_`(Qalqq3Bi5h5jZHCz#j+Om z4>PPck!vBlSze}N+d7Im{VJ!XLCYorPtGYI|eowKDmPk(Xc=>gqY*jxIS=w<$#cM>ZgPGjQGg9{4 zgrORUb-doSyLnowr*aBslLmD|jeR@c&wX+E<6_xJ|MWBC&%;+bKja38+cbcZS4kKC z_H`yYNbByzQ?zzE!)iaIntNHsUFdxsKe#KX>e0<(3z+7yH2?H>v41rJ4Sq5-`@8V& zN3a)vad@%M^${O?>e)L#G2)vP^?T^1&-zb& z9@f7W5ys^a^4Hm&>N9L4^o)f_JVpP(l|3FEoiz&;aU4_qnxr%bLcW2cPy4G!?7Raj zv5%CqZl`t!?Vs8jsXLyY9Kg38Gk0f;>%t6qH`QjT7%}>5GGZ%W3P0bNkR|Jjg-ofU z3CBzm-^m9;&7(&n6~M$}GazFnHP!#T{K;C%UFi#{AMuOn2TY89BDgF5;VQcrG-UpQ z4)wg{G0Fq)pN-P%&6&lk`YW#Au^F&QxxL#>0LyQHH>s)S&|IcvHVBpS$giI!gHAC2 z!jwnzA-x2maFG!kqs;_=P-J+X0ayWa2xWY3$4pSTsqXZ*ZmTCR4s#4B!F=HYa?52R zhW%o6wYJ_-=D~V`pN^4J#UArDbqH2i4}^vTBTZTM`hdI)!KLm*_PHCcoV%psjJb$ zRZE5?l)Yo^>|$aDr%gJa`GcTio@&MiN2F!((?zSdMttsXd;`|g+uvlE3x7(HMaGN1mbRBdEVnSnfXbnF0b)o}*^3*@}@W^{VS$FJv-I7Ri8t}8y z2#uhSzmlrQld+ojf!?Y~Abiq5pU58w*{=d%g=^7$=dCH!aolldNV@x((3anZ){q|! zN-GCN@C+bZnK7ckd`!G^?KqNdN4YM;_2Y(+?USNhbL9V_o%88pFus8~u?+bkG+05Z z%s+CU-8#VDu7IRg>4;<1UR*b%E0L$8kell-@I;^q5pID)DC#Wot}Vq}SnP&nu^rw* zvT!B`nfo2iCH!CWkkCMXQ)4B??;5LIN2~No5Cw z-fl1k>7{!;Z~#`3o0$f(=Lud>T|`2vz3bYHj)mQzRP#zZc9auS?09vL{*{0BQ55eb zbZCYh9zcsaQ_zU_I}^^OXc!aIL{bj&bU0;(u2Z=EoJNt5~MeTS~a zwS06-nS^6ojlG~PxLSK;9%-k$YTfyR*QF{<=AHF~whiB^h{k~Lj7WEVuh@pG^6U$W zytHObPx$*X=lv!fqlMAE3<%a&;PMge0oKe}0btRcBBO5Te9pK8N`2K-`WnwY^dcR4 z1ye{lRQ_<}j~w8<7*elff2#x~(d?Y-)QW!MgRMg;0aPcbxNkoy?g>YOE0^P}0OQx# zKOxZd@+1s{Lr}o^N^Hsb{~)Qp4yn5B9?&%(wro%LN+^JRdoLb0T?K?l~0D!-M8*%A)c zI1cGZ!6y-{`p6Yl_A6!jg)6o#dzBQMPhOOx^#l)Mf#p$X+HBw$#lydTwY6kJ@7iUA zy^RU$1=KTd^d?Ed8jRdKjN+>3&c8gEqBn5hl`cSlH63S_ug{UsD``qdR9}(N$f071 zMEr_!_!=QZc7w6DmAFDOqPh%hXVF6H@Qa1NuX1l8TKm^VzbVt)l;?J_&uTNx^ANEo zhFCqGT+zwXb#m?%G+4W>BI+Q(k|pz6q&{14-#jD#r>|C?j8<{2P596{LHID^){l)0 zSp~DzCwM62v0%z@_F#oHnRHH+k^52C`v!juUX6KHw{Eg$C**@39L!sL zA0o(Wlh+%ozxkz>#e4n@^}u0=ufbpoK*JM(cf9g#yAKZbJFdzfSXHDxcno2kz742l zpS~xd{SYYH(Uy@xb+AVG^nzG*0R6o+5}x!=^x#c3qc?%A?!6)DsfU;)zz-j}&P>S> z)D&tn^*vh3dW;|gKzP*YH9#}V+48cb_c7lp8k%^Uia!Sc_)xIE-3oM@8sU)-7$ltB zwSI8y8Ik;!d7j#T|3#D*|B`M_SG*no_|r9L`$E%$h+YT1z)A62yaxRX@Ug(7KQ%|V zNsWPQy64Ps7UhaYeZukT53S65i-pP$A=Mh!R)W43fp;~G=#6-sf%@r$Hv=f`P&BKw z)#oQ<^dlKyE_%r!AF-Tk%S;x&cPpDy{x=V_;|?a3mr2#%eQVs=^QH&IR%ck`ZWI%P z9C|rOU05vv0k4q|gP>eL>b7u>au6b!JQh+vO1sqQ(V^en7c^y_6y*#m#AdGln#W)Ao%w%q1@@fs}MFCfM;t9hJoEY>2%d=69_`or!erHVIKJ+i}~q#`fpz- zp2J`HcJh{^)DW)y4_Ty_zbMl_EY=UjRZeM6v$+tL18D>UbOU?jcox0kFla2H&xA*y zCf$lZ90s!L-X{~K1KkjjBSd^3mY(kn(AXEd+Rj*$Uot$Ok#8i#mJwsYeyYGI6M#hM zEYt+eui=vlT_8a0AC8*+dE|~A?w5>Vy=I(|FI4?uQe+0+qhE!;LxlP?q@HJBO&%4s zgX_Ngw36~Q^|x?LH@v`8mMCB-titK62{rCuP|iizdz`@z-Du0|Z{N9GGu;sbm1z%c zJKK-i(yEZfQ$r!IopTlac~D?XFi+WCdP^0b-e7*I1`#$GmaBa1ul*>8P3EB04_ga~ z=6Jj}1?G!D>6VfT`D#Q%aQI}~5%_B&#ytlIo2mCH>0IONzV_~041XdiT8lK+6dXdR zUgw77Q2_5i@Cv{GhI`&CW=5qD!;n+_LCIc=g)&Mhi6Iv0!ikOin67wN*OMOPJ=mrj zZCm}VU1XFI1uf?%Bu=vJi}GKr4+$>A{=|8+^jX z)dWQKE17F3QoQ&&HKw+qmleWp()mPxA9|i%0o+o30H?DBsVeP4L7=~}o;kwG)_S({ zQ5aW8>6=L?yz|=LGF?V4$<^xic}#E-X6Q7E?iJE0{KzHrll6@@eNyN+`iGA}vL8Yj zJ(J)V-oT~xGCX~*&wLkW62*$xg$cCcF&SmMRXAdFjjw0a3sT5N1UtldJA#;Li!(CAh2 zA0upsSt>nMH(YB>J{;K^;8II0m|c5W0!UnK6$zV3nw8})7jzYgIDaDgm|8;_UczKN z*8@>HPH3?Iwm9#^s7EDE(5BO{0;umYMepcPbZ_*4ZS0{*efsV@z5mp43p&2r^bKFy zS@+qy>hWf=tI9?7%!k&9=TZTBtkbBy9>y)CgZF#Ik6+|qsA+OQI#aHKIlq6`WWK~W_a5LeFHnExm>?nyL~J%kl@$at2&;@YzU!QX0W1&> zEIs=|n0)w8C}^Ou=R@;#X}PwMcTz&~402Ojqh@IJKxt9;9W*;yHG#&^prcQw(Y9;m zZbZD%s(@NgPO=Y#le);f3pA%iOk8^pK&x! zpp_Z9mR|8r+C0tWt>J$&KakNPWxxP*m=SQymaoCBK*M0gyz*BYZuI5g*wQU7nkrM8 z51G>Sj})TYaHz=+)aM{^w)E2oFno+2rXc>@0sS8i$vUGL9PBq4zT0&^Oi6$XC4}zo zi5)1{(b_Zmuw6w5+fRk-G&5LBcI`bFpO6|;-CW|EzV>)*GNwjWKl8BV4qkLdo&4Zw z(_S13J6{(fFpfZhaylp2I%my;yG`uZU*j~u@HJZ2k>|LY)wp&8_2W-c7u!cQ$s}4Y zxc&1R9pMeev`ML+MfIiyzwv`ro$pXW;?9SgTcTYPX&UZsTH1^XNx+Q4t8_*+jNkBU z{$hm6{Hd(_N;iHwYJszzT-hk}01g!3V>r}q1jT{2!TEkKzweGJ2O_y2lFX;w2 zm(u4tM8vU&5<$uG^Z9zAfL}EO%aFnGJ(P`^aVx*YqK4+K8Zo(ft(A?o%#886r}5}E zB0J+P!;9v{amgH|vYsp&yJ$5&w}Lp+S+sVZq;s?L4WMdV^aAo?OK_Fv#*Bnx^Z1*j zvVjHjte~-Y#D76akM(PD9^+oE2E5BZG!%kTDakV9iVCZ#X3=QFenEU}{l4qcKWCbE zPo+HGk5f8N4PfSL(+p$q<#e0N&rEJ`HgJ#}YPh*crIP?eQ$pBO>-nl}@1@(SBl`TM zzq@)qHe3A^U^%i122{5XGm)IxV9X% zCRWl>h4euj1x9m9tdFzwRX6?Y7BA8Pa1BoRbW-=1{xzdQgQ`%@>?XI+d6eGdI&1^- zAMmJ_^qws}!n(v&QG;^8Ls1f=4PA7BSdE2hStaeb~t+5^Iq_7I{0pZ${uJ`##^VB0QCMgSO}Co$f;c?mRuZ z7b+hjd~>H~`cB4TP7c=d{DSXhg(gz0Mc-+qGz%T1xFEtloM)&h>Ndl(oY4-SxA3vA zWp)b6KKB@k1{Hk|y+eVmBeneKvi%p1bC2`q4;YwJjsNKg_m5a?8`KI8ipOx2{%2dc z|8kN0$1$*f9pWPLp8%f!0mu9wS_o?Q_2$O|kNnu%Lo=Tk_dv0nQQqP<-)!i=>T_N% zy@7#IPLCEa?fC+rbIX{fg@Iwj0_J1#hw#hOg%nW1n81#ijfV+-u;|zV3GKgvf${kM z4m~1fo}1o;3bZ{A2Hb zHo4*dIQ(%FL#I>zHw^3VlK#sK@c)BK-fc0KY~?3Pl=aVtEhWDDRX?s2epCCa*va4e z%7SxPq7}%9A-kOZll_td3VS(7@eE*dsLos_d%cIall0 z6{Iaels~N*18E9BtkSNLCED5^(gF0*75?F=TG)$;mZ|%3T)r=$nem#*UFN$~$7NTf z@;qo4M0utDx&}|@1KZ1GnBw&xM}1OTA{wnllYiBP;;74?S0Nxlp>IcDl?PdWF?RuCcj?$vWtj6kgvk68tV)fDh5W~MzJ zPJL4Q`#N1&@ydLcP7G)!r9Nrfb+PD^C{D$Lo!I;)<@R~m_`aXZJ$J__TLGuS?gf99 zX4h53c&nvIp9wvXV1=rD*+(RO4qOA7x&(%vbbBf$#wlf3IyJaaC3LtL55 zc1u3qNu~Czw`z5Cj4;1`Ztg1^BEObJu8RT8GB&2L>0j11Lww5lVzL+6v&>twbZRtA z5wtdandiOdb9^>gat!joPg}vzckFIAj8*=_vy^aOv-xm@jLAu=djdt$P8TR`Nb_Jo zi{9B7td+u0`g%M2fBb99~X7Y4N1*SCH0&L zqs~m#gz_mD-WFaZ$ed_IGG;pbdH|aT>z!Mlxo!Qr3T!rOiPuOnig2j~I(Mjdu zoqLouIO*~Ca=Wu9$psD@Z-Wo}9iI*&lWM-x%%DN(L{?KS0ev3wGiD3G!!AR(ZYmeU z0Zw6lOI~9Sz_hA@h%~u10vQNlmn)mqPig(E*j3YFckQ-xxO1VN0hX*v)>>`xEfzqD%5j!E`e_4?J|J_0T)7$i)=lCCc!CY|uvX$$$4%B$^ z6kioDf6QB&Z$L{t3I#%o0Rw}8m8%}p_u(em2}IA-rU?gwhawtrVC^%xj0ss|(yjK* zhlQf1k>Axyx)wmkfQ~DvnMPEo5;S}yEV*!$zkxt!uSSQUMOR~X4u{ERt_@cqLZ^>) zWK4mW&H^9wK<$71+KDOkO@V@zAuaxPS)2`xGY`5vA(ys#T~jv*zGhEct|JG2 z-?NtL2ePKbq!1r>LqEXb?o#hG2|?9lY$XROv+UsYs?GTkhWlxfHrBF^7uQ#zDfg9( zg(l$T`&UjQ3QY3lV*2cFxRJWDi_?`}-uA=u>_(@L>PxYF>D%;t7$C#YZFud#C{MaG zSHRIVb8Sx}_$qLbyW{Hg(?DvVh7=19Qpo66GCQiR;ge@G4;s;8JtpDL3>F?{cO>ft z`pdgV+vw0``_PtKKNZa>)(DKgNG}!{%)W0KT$Gi=M5xDBnm=nBZkzs57(Xg7%v&9> z66jjO&h1kx0^m=$GK+deW$waO=4%mR* z@ifWwBnD{SUIuTds;UCit!m}`UoPri;JvAH~5BC>@s(lK??Uf>(dES^dTkZ zQ0&V#NMkDMYTc}e;$B-|@@B;{!yJX8UoNMF!M0)^Y3u0Ds`eH%J7`IPmL+gUQdabW z4gHSxYCrq&<426@&hH-$Xu3ZpuS(0x#98BlzE58iUW@e}@gD?jOe@LkCC>NP=*x$S zs$m}PjiLAY6z55G9K~*i>*uu$RFVKH(k|9h6^xEJiM}vu!uWU1i20rXyLI>9i$=H) z_>mh@#Ux-=K2rk&L9O4ISwtH4eB+mCKjlii{k*Lz+7b*xdSmcYpTBTt$m)RX{$r!d z+t#jaNm+IHgIUw1D^vGLV+5H=^MXV1Re>V0WEKu`7VRzvXcYkO=5rbGuhoNsl;3Y)p4hF#xa$v3EE1koa{OS@imI5$Ow(= z%aY5=HT##|i$ZH)8B1t$j5pUtQinPKuH0*xG?w9Fb>L}!>4BYD78tLZtc)>sl% z#@%n)#hiMo^QeKUo$ZsbYx;fW46~#A?$6Tut5xM$H+F$&i(w1s>bT=NzYKKpQ!%+8 zVUsF|mc$Sm4Ez({VocMhS|2n9hF7Ri^yZqTVUl0T8V#eoZ(`aE7`X%OY~7JdltovM z(u%~t8KoSqXxXmk_sx--qqQXT4gwrx8|`4}?$gR|lP8Z-leIB%UiyG78r}2bG3E@3tY2kQ` zWEP$*s=)W`gSJD)yl)8Q5kzC(Lj5z|BA~$jhmF;SHR!wc!;H@{gX;aO!1uyiNI~P! zPC+%RU_ILfdaN-55L%kdt5F?_SAoGW|6${c3LiZ^{eH^w`DW{%vXs@KWd*+PWeM!Y z5`9aFV9AJyAS(8;ONa0#9Ti$40U)9>k%s@nt3UzA0$kim!sz#}u;7RR;SmuLd<8ti zSh%>joWbinf6n~>MeP|>f7K4%UqeG<@~u~pBgji$0sbAjhayD@PpXo*>^FWVYF0un zmi&$oW_`4nyUz|}6&4Na-!Dh|MEnBPQMfusXZV~DKP@n#XKuQ8z;Gf)BL!N_#?1O@ zaGa0T4>}5?_x)@*lJ=>pjZt@jJsfAV=#QG%8+vt?(75=6na({kg+@fij2F55!&lje z6gnQ{Gy4gb9m}5?w#kiv)GuxL^L>qqBOh|NrKYn@Cr5RLdCqEKB)RKvAzuJX$G((1 zW7y+5PI1Sc^Ufa(6O>FkslTuj4r9%I8Af*$rS_JabWiam{)#}u!tDtIv635rv$Ob; zCmF!?F(cijqtTYPk8($&bF&^!=`GtGtLmiyCl?d z6cFG-N8kS=kCXX@y@E+=u!3J9sO1MC@A*YLk<`gJJ z+WFZGKH5(0tM#_6*La{+Njw=_xSeotav`{Vah>q1_Tl|qcd<8Nou8j<8|T=-Qm7J( z*aBF?6+6vs&b*Aac>DZ$1i-<*Ipd6u4ct;jv0+RoM&}#kUmAFI3g@iLI5(t0u&Gd3 zigmGf|HeIKT7P58s@55GfUZz#_`7Ka)4Nz;(ji;@%aUg8VcM#M)3J6sjwm@>t<146 zmfG+n2WNOP&e!j{f}A$yDo zyFJzsOlt8L(Ha#w%c>6syw>!B6Ot7+$XQ@;ei#p+y~8o^#v6b6y$=?p7C+3ksf&eS zR)u%y6&8cU=b|N8GHQGN{5B_ZbD@!`H&8X!n1MYBUTkE|oL8+4+9)pE1#UwW2ng$8 zWh!kx2au}u4)&Yq^y$rdSbU8xXx^y%Jfv7`DE(2HR~J|slskq6Ss7c|mzr+Q%@Nm; z83~ad>;Ka8g^(^bsIw7d$^H3eufLOG zr!6;ybc1K#em_s}Ne;RDA$KEy0eZiMP`NnNIb@DRv^0slJN%U_&144>v6?ZZwEYIZ zN=4k-)MowUm*`Ehb+VyRi{<~t{~lm+Rb6rx9?+%C*&roR&4Rqapey5;l#a9F`~jV? zs8!M^pvp&y^gZQ@QIa8d&edZdr|3n*b}DS;p*S^e&a0|Vr&X8&!--o`+KHMb!dWD` zcqV66k_|^bB1;7r|Xa{M-5Uuz;y1>AeX!U{k z?rzqcx%8nH-ifpJqvS&Fpv5QKAR_)q6v)c91y{Ko%Pl+oj;TMv=A;e8^?~{DH{l#b9UA}KRhQ3bMF#m03A)uUO>7w*u#3YS&|VD{zIF> z)$V){)^B+5O_TFa2YAj1AE_Yu^^^1C-!o_LJ4mZSgbt$&(9RRB(<|RCLd9`=5Ni+IM_LK>5C%ssfHO2G05hYrl z`d_VmLl2YnjRf4kca)3B#h&*Up=k0GrPCk+rP$x6u8tT2|8krv>^Cnhm|FU4F&Vge=KgjHFeRI+fc}cEcR3(NmUxU+vJ$ z@B{XZ8_v>sI%Rfy~HD8PHv8z%02#QQkmz%tvPdMW{Y))A{x z2Tq}q<~uXllpj3AJ-mWD%^&Y!cvB{hgjx}jsZlIg4_7d+ozfaO9I!ly9%w{xANSTN z!(6L&#w6>*%<&6or9Kao*owd%mn#Uaf{jk6Uc1eYg81KcUp0!&I`Sr4%O@jzSNI_% zx-Hj={i4vE$WNXn?6(589>jB9U3ynWAyz>YaOW=S<2y(7Eqx}kTGO7Wc*;H*2k4JD1Jud#&qd_>AU+n!TO`@5Kp4 zt68v6mDDkI0a=AyD6?IA%k%<`sPLdfOE8pGha8Su#HJX2h#}SC5V@A=gRNUMnp+?5 z^gj#J5%k;S2`@HU=MKMz%h=P)f??byn-YywdTMDLuT`1J(Z1P9B!AH;8;f0T7u#TO z9aa-YCbr|<5Q5>Al$mZuCVSz8*RzkWS}m`mBDz9LR@b8%a}1atJjqPoR&a_Wj!O@k zZWQ(|p{rOs!g3hCK|20@E%NY4u>hmyVi53>-KFLis-q6Cfr8NX)E>}#JfeI_ogQ%E z8%21P4YuSaAKx<)qn~cw@f^ksrm8xd3a%&iY_T%(fxpHdH>jyJwCkOhpNKRTDQeQV zNuNPF(;_NDb5l5rPg%RW6lHUc)zFns^0akkVgInVx@W;)nfpQXMb3gc-`V1-V1toY z&u`Z$ya5zQT@Sc~uKWQTIP0Xlx85tq@^WP+tWwk8O7_a`k;bB@EZGX#>er|fM3~qS zW32SI{fj%do`%35LS?KvVZM0kiJSF{H;dzngjU+7Lf}6N>`TfZq$g%(sCQ{X{2_7PRs|59HV>o^@GQcmgMjtPBVi%4vwp z(wKKm6{uS4%>y+7Oq#>wg(8Zf%;O4!DdVdkpY%=O)0r>+qvnf;JXtpmxO_nNGYNF zVGBhoB+Gt2jdXYiu1Rsf3s0&k8>8GyEq()SliJkjT>VjcM5XHde!31axI?ZGpn0$m z2d_PCJdKEs+1>sZ<;7q7t}0bOjcC7qZr@K9Ts4%AwZg_G*S~+=gp6vuYrLI?PG6Tt zAvW4dL_G z)t!vTgk;nL0gOVP4Yon3~1H5kr5s}6#Fn`Ay zqNUByHt!HUvt=zfDr zn5Xoc8b$Bg@Dqq`Zg$i((@-@b|Z~>9@4c{Jl&jL{=)c5;ok;(Zm zAFvv}Q)!DeV>!7=o7sKm{;q*a0zw-DU6a5@+F?qQw@DqvOVI1L`TJrS={8!+Gkkh3RS6AAmjY#X*2qv3{2 z2LDgrtd%i>g?r^mD_r5kiqXPtC9KRRRSOWalIdIJKD9|rwa9a@{KC2T2V{0y{X6e>Ny2k_#9Ge@64n# zeUwMhOvEy`?$Xk6vc@`kjakY)O|20=D`fVvJ7%dED`bvL?7nIBs zkIg6eI5~ln?{Q>9h)FGdzMKV3(?<4PbcLlYtUjuum$RShXLI?amWDKLti{x>paqp_ zGCpGqaWGbEzvvXwZdrr$B6?Edx?rto7rP24qKaDc=`uG!mXui822En{$4*Fu;f@$kJhq!0y(T+EzoLMaTxX2FkEDMoO7Mu=5Hk_6@uZ z9lQYRZ3)eK+!c(yuY0i%&yqaveQLHtQYI-X|<#LV)A zH`1B$;~G_Qm=>E&$Epq=huI_xt@yNc`SaJVJIh>6Z50At?jYfSSeovWtcyX^25Rup zDD_PIUU~nO2~`7Zy;u%+{=z|zSZ|C0Y!42-7 zv3$1;lY`k{$opmA#@3LSdorNcHYyf)M$}RK^xebU6++9l4i$if)9= z^v_nz8Sfj(j>(&2f)6f3SZLriL%Go+SdXa|xcBx%<{FUrZXT%Azf}d3y!8jKv>apG;1h z8;|))tQz>L(|B5mI+A1vw&Oo*`{l31#L5v&>ZCmqNb~Q6G;=7;BbLNG4$PvfVIiqE6!_$m_pIcW`5Um)sp>d|>oA$8ejwC}XALmHlDWtFJICq;E|-P5|6^_OTlGc?#6%|Lr<8B=o$9)# zD!>MnhPg+dj?y;3-8KnibNCxSzw2|>Mz8mIYUO>TpfSGXxOKRi=fjj8!c~InZ#pI| zVt(Au;s>26MHBO53icNnE>GAx!n;~cG1VIN+l)CT;u$5Bqa&rWidau@$c@)Sqg2cpF8y9US43|+1u`Hg_ur2iQ5Ea68|F7q6)oehb@>m)i;-BYiR(~9t9v{sDXECxxFe*p+Jz3!^e?xW58Xh@&*XiDF9*B|l)y+1o z-I?zwza&|;gUfGvk~IR_LuRjbBZIyA#W*j=cQ2v5v@dm$XHiA4Tb^8E_vs?3@(*va zK+HQu@Je>C(=P+~%i6B9+lEgo!!k+^0DJCAQ1oj=>>^ zDvXk(_Er0J$zdYdh#xb@T#!2TVOnQw3Ws}1+bXAbRRm52?n5^X4#@b!><5Ak=Imxv zcJ%K)mKj)@FmBE0kS%~oNbi6RJNM0*-ap`kkm3BhUi#2kt%Fk8>X{9@JklNo^-Kwj zX|+T-n6;T;G+6O>ceqX6+{fDcUMW&zw;c-9%6EtXFBQi^Zt|FFUEW5Q0CombxM6St<>R(?FnG?q1WlAr*bP2a5sjY>s_r`gxm<@p)VfBddUZYXG_uBkFU>)iw>(K&qP?~ zBEruox$n_*o*p{`$F`tf?k-s4Ty`;lvT$OgS(bK8uVNy7B1#Kuzz0^w-y-&`$o^1I zlg?5lt|I{Fc)RCSL}lh6atsi28PUt0MqRGNF3|}7VJ9>L!b#BEI|ZtHlZe_lKZx`s zpry~Vq`g93;Jg4Z%1^<}2)X*1o4ZmCQKraPEQmxfxS%oVNW|kTL9U!BT}ouZk>p71 z@s`$q;9c1<>*Muy0A-m=uJpOoo zIdTR)HhEi=uljpg%HvwfmABf+hta6F4&E${iOOp+OLPSE`3&uasnp^BfU|6-47UZ$ zhTksThf7_To-(Bd7=14t>$?|%c4rC>Yp?{6i$yK{R!ho`a1$bJAL9KROSbmpId$>T zjifo1W2r>b5P#22;^C!dGJAGn)QA9VakA}6I+=qMRibuTl5v=t0T<85r9E7B=2feE z1fXE!oO5rbQ#*#y2>w(j!9mY#zCsTYow#IM!{DbP7Zdun+<@Lz)fhz8owmS7^!Ex0 zC1|b)*bt7%gS~ruH+_%ZX8XlN)#XypLJ?uohhjvug*1M}EYrN1h@E`OjkdMIUq9G~ zH?$2JF|e5dcJ)lJZaCwr5tZol_&nt4%^67tt6%3!w*&w4rKk!q6-M0Kq7e0=V3{}i zfX1xr@FD#YtL90yS`692!Ih&eM#JC?Crw8;V>&k-N%nbGQw1`zG5{UrU%- z%tX5Rm|#Y<^%w{>-+wQwosgZPCR=?dcqCPIyTEYc#W%2=DqMmAkPHI8IZ~gY9}PMV zhih-cl#G@?DxWf$zznq3*?G=`a`=>J8YbZ%YJ+%il03R?K?Vm~S2ldU2;fXB0ufKD z&Y(9H`x){CsNwT@=$5(FZ6E$CaZJT|H(GMH;l1u#+_Zk1s6mKan7o6^Bc?=A8p(4M ztASSYOW^A|Vwk)y?&Ftt9r+o*Hl0|n=GLLRgaFK3 zb?%hOrC9X({A((A=uznimD1ns=E%ltbB^*$RW?Z}9jCU`g+%4Rt(#>P=Oa4cAk*Oq zErQ4UMAw3;BJk40;#S6SYnF{KZqGClSE>(vmM7U_+ECHJ-E5lV5p9Ih)^j)-QBckh zSEUphr8wt@c9}5dm#&9MoR;?!H3*~0h{N|!i4%Qw!8b3+!7Mx+-JA_|T$dA<~{uG9a zV~FNQ{?XpjM0C1iLzz4j`pUxL?bYx&WF3r3axjtLJ5>SAjF2RHBRsiE-l*NcYr}*e zd%&hud}4mDC56oqW;gajNhi-vM%Zu$h^-vxy^F?`j4d}!h_=tn#3?+vn3?B+9-zh5 zjM1k9Lw&fiwV8!)6hKvfjLUn*i;~+XW*(W6q^GLJqY`X&>Oz|51(v~65vL>1(K=*l zqvUdffWxRtYE}_f0U^uzBBQ1=DDB?FzDThoGp|-mu9gJMNcX(8ex_a-ryJ#&0y24I z$t(wXQ)TR?;f)~DNULOLd z=o#9L=Hu3}cZpG~YT}ruo35-Y9 z+L+YBx9K&jECNCfepR#?ubExL0o8izN(nmY$$caUn%7*`5!(BLtU&N{R&_v^4GSIf%JGrO)2klLW7CMW z4+0Glnm_P@MM54Gcgq-=W@^l_>Pp7WL?%bXwxkCQh?Kf+NkGHsb5!~ObK%)u-=@W?3p$i1Kpch^wztB zBKZR7q1gG-B36r~Bc%1R1_d(cW>rD*qY4$jrR5133 z+pPU&%pwp7bBnWJ7*`l0TM|Ta`0F-iKx%6)E{tF?K>pblhR_a*(>@6U0ll_kF6Tqv zb4PeL^RNR!EO$ztd`IMJ*=lIJAslp!a+#B%YbYfE=Bs0E(gT_Ac{YpxC2|yREGK%e z)A;<_S3jf|W8~$WN(c0MkHxu=`GsHP~6Z_px#I*C`D{JyZn}F)4_yFh-8dyFY?_l7T_hn zh+h{*Hv$PEgiCHmEJMYj>hloeUKcYItF@jt;jPRk6+|)L9*8+@CLTR=@F0q)D$*=p*8UCWYrF@IKNd#x*O|>pir%rP zjh1yJ@pT);lr=A^h_)d zwF@g*B{JPmQm2nhtlV$@$N3d+STEZHcA;mvF26K0yG-RX7TaT~ql18dKAHbw}k4_cc@rTD`b|3K!a}zTi+|HO!Y|G(&EXGY?*+GEUkW@ z>LsN`Lc(clBO7w1>J}K8X_6}FWyuHGVu+5TCsD3%_ROc){d8hY-fQLoE*#XyVsTnbme5zWAxCejlYQhtH$`Ua+(u0Q=Kd^hU zknj6Vz%CWMsL8gcMuO{(GN)nu75ik_aGFQPZHHyRsG~Qwtg$Xko0EKfc2IAnmDR1C z_NQ4S=GjfkM4riu^f?{Dd#`0MB~aaNlQ;c*7M8*5Q0n1f1r!0V$Wj!{vquCt1J>(# z(Yy#DN<}Ldt35g0-hY|ZIA~j32y6ib&ew*6J5ch3_k7Mhg*Xo2y;+Jfglqx1Fk?P3 zf;9PD;W;D5!E{u4)lqagii$szbOb4;3*meVJDPK8kKl$he^Yuy1IPVHQ7$;0_A?En z9Y4pD_@7kREM&KWLg9*yv9Y%dX`>!$svJQT9i8?Q$@_M%%$PzHXYQ*y6ER4^*{zVB ztDXmgt_5aZYp}8oQt95e{fH|C4F#L%bV2jgZ85f1DAEyd*gLR@?c!j|X}oxm7r+*b z*0N^Dc`h_gl7Dfbn9IjKH=U#9rntRlf>%9sa_v!#jYM%?6f83{_Jrm|!`oXTka7$* zKd93Fwd{5YNh>tscFq}Hd1QChZZ;tCL6E2sP(*vRV1J2Ha7c04ed!Y&5E_G@J|L&5x#0iB!G5QQDq>22n1 zbB!^pS52L4I_$OGM3ZRwE%fXg3Aq9_D$mD5seNF&2Qv3 zeB;?1>?4#GJGjUU$s-c<9pTD5=G~{mkRPM2h=Zw?ba^7Oi1%Jv4Q2|oX>Fp@^Roh)!E-?;0eDRao51Hk)ZfqPW8L;nWnT~0Y zFT}e*$I(K`j<{@*Y5&cuu+fpZmCiDA;gjm|RdZpb7nfo)nJRrIY186kd(4w9cAcJd zR7T*HNYjNK^BCmoVsd-n^Kg1-PwSJr^Iw>)?-6@e$_Z7d67hE^T3&5DZEx>)NEU|8 z)cTo;SNRQqHnB3UBZIM~4n@Bu^83z9&g{cIDi}8GtFZ652OE9$MK}zEYE^6|n;^0J ziBd0HX*Z`!CU z!_l|hJ(SST&8;IgZsX>_A`j|4Q5Uw8F=ulZq8UW>p!6%em}{!b*;9I#!(q#v^7Fic zG6LnO6kn^;s4@>vhIJM8{_b(9UAV)*r>`N>JT+_^Sm%+NxM2m}n`f1_+dZf?Y7dHz zr}iyQb4_H8u-Wp>n5$G*QUop-s91@Fgk`^;=|d zs>##DpFiTtGnUH$Vclyv=1SaB`=Tmb8=Ad5kgQ~?eeR!jvZm5|m>jD4au)h!L)>9Z zUcxcq175I5;k&A9(a=S(UVS63ZTs6%t&#Xg-+2{xd%n5s%83`+Lhz@{ypVp=Y-^fi z8=9Lr{X|!Oz)hxTga7h``li57Lrew5$rxe?Y>kEaXno!(DKq8L1~{c-%g`Ut`96yK z1tt6wyWvLS%6yyWgfFhg+^^LVp_(t}GdVb@-1jpNu5+8E*Sq1AlV|vN`>aWXBg^JZ zSHg=&x}edYLi_}C!&3E(>^#xavSue`mP|iOkWu8@$O!a0sd9W_vRM4JZ&HDASJ!!7 zNUCZGIG!zPVr)ZcuUu}*A1>r(VO5LN&$iuCdtV`0(>INBl42VDY(#Fti#1`B?QgG6 zuIy;?4mCNJ+n_o{GwqvWmp*+bC+TKPsy+0nBhy-AFn(vj&<64N1D*`yHg(c1s8AD!wKU03}SS?xTMIt-Vk2Tn{O% z5@23}*0>0}Zpo0Y-e?8Hx}`IG5IV@0Jaq36k#Urx`HZil%ZYB2EI2~?+7i_$VP(qT z_<+4wo_HucV58eZdrWg0?`39NRM~cQ8t$)0JQVyFsa;Ea6LH+R@Oqc~XmirC6uGK* zUo^yQ^z5?AVVA zhmad1ExRD>@!;cHFp!RIbpxu~=!5Hqt;z%(>*s?+MNz%^-FdJjL1tlbS%Af-io4{n zgYAu_CFxA?b7SgV;+@_J#EMbMCzI7_+sa0?pJkpumMBwI@t`(fgq)uA-n2H3bc#R& z0+VIE$Kbk+h%>Rp0CI(3`bB{0Ed>IBg7mXZajDtJn^#|ETwjHnhL1&TVYh63Nuf$z;%zHJU zDL69H?C@3C$p#Y+pp*5p8mD}HmL&f(ChUOU>6#T;F%3)*`B>tv6%zo~?|9n@Fmn2KZiiPtjKh<{E5B=ZfCL$!5lo4 zNEah#{BdbJJo7sI;ys)uf;_*mA*7aJ!+j|YP8~UAQa&Yy{EhNJd#xk|QqTxt8-2LC z{q~e|3i_E~OqVo-2Y;B>5FQiThd5VfEe?GCGQ}3b0{I~h+dl&k{X1dt9~`v*=B@qP zPD_C^pbG)U5Mo>w3gOQGG4kS>Jh_Lk!3F-SD z`07WhYy+RBwYCC-RlhY$4&(8e_`Q@&0T+=q@P3sB{b`Gs7@cq1<^{b9F4U3lS$yMg zv)bLC&u_=X3YGHd=2u*`owUo=WRT;_A*_Een4_F<1%6P2B;eHDk)@aV z;S)Uz!xh?@`#XnU=#hO& z(%3x&bCgZL+%&zGt-O9SshDi081fGE5o!lWR%DCmdQKMepX07~T);slE+XWw5mvPY zvyNY^>-K13%m2hntg9q)koa(91FqV3B~t7)^D{dBs*Zpm`k<7@^mO`zEthyZ7SavV(>jWXYsacL^jfWsNE!Ct8~mJ;MMbf zdmjeJTIu=BC;68)Ep4JzGMxkBZfQ&VntyD8Sdgy~lg!aNBeg;v6eBZr=mb@PO=RB& zGAp&M8vh@+`Kb(DY^|FRpqC-JQKvhW>Jg<+D7Spdj!JK4(bbQ4$Fd8>1iAj)Sq{D4 zbE@mSjE+vuyPm`=)9$*LD}$V+n&iQnI4<_4Ms))pH{;=P$czkB59{nM{*TV(=(KzF z>Xi%!NqkNPKBCMTmeX~5|X?X_A;Cfi7I2_I^!ldU8bt6r9x zyX4iQ%q;N>sWtH<8U{v|s3!Om^wQnQN?xI8GYVH1xOiNwbunss9a@cR`vg+YUJfb9 zxS`df@-tz>lF0D)WEJ=eCRX8{BYnm@rvq03$^poy_}sJ4KUc9((uR0D79E3iV0k*P z&$mHY94e-$9pXz))|XwjdtpAu{3asokU&}3=ZDtyp5#{8k;*rV@7~|MnT%#Foby!6DgngJp&*x>l(J-nxN*?`1C8ew AH~;_u literal 0 HcmV?d00001 diff --git a/kubernetes/k3s-protection-with-crowdsec.md b/kubernetes/k3s-protection-with-crowdsec.md index 205496a..9913656 100644 --- a/kubernetes/k3s-protection-with-crowdsec.md +++ b/kubernetes/k3s-protection-with-crowdsec.md @@ -33,6 +33,8 @@ Fail2Ban (он написан на Golang), работает с IPv6 и имее ### CrowdSec на первом узле и защита SSH на хосте +#### Подготовка к установке CrowdSec + Делаем обновляем список пактов и систему: ```shell sudo apt update @@ -44,6 +46,8 @@ sudo apt upgrade curl -s https://packagecloud.io/install/repositories/crowdsec/crowdsec/script.deb.sh | sudo bash ``` +#### Установка CrowdSec и проверка + Устанавливаем CrowdSec: ```shell sudo apt install crowdsec @@ -245,7 +249,36 @@ sudo cscli metrics Как видим, CrowdSec читает `/var/log/auth.log` (логи SSH). -#### Подключаем CrowdSec для обмена данными об атаках +#### Установка CrowdSec Firewall Bouncer -- блокировщик IP-адресов + +По мне, блокировки CrowdSec довольно беззубые. К счастью через "вышибалу" Firewall Bouncer можно блокировать +IP-адреса по iptables (или nftables) и сделать CrowdSec злее fail2ban. Для этого нужно установить +`crowdsec-firewall-bouncer-iptables`: +```shell +sudo apt-get install crowdsec-firewall-bouncer-iptables +``` + +А затем подключить его в CrowdSec: +```shell +sudo cscli bouncers add firewall-bounce +``` + +Проверим, что "вышибала" установлен: +```shell +sudo cscli bouncers list +``` + +Увидим что-то вроде: +```text +───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── + Name IP Address Valid Last API pull Type Version Auth Type +───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── + cs-firewall-bouncer-xxxx 127.0.0.1 ✔️ xxxx-xx-xxTxx:xx:xxZ crowdsec-firewall-bouncer v0.0.31-debian-pragmatic-xxxxxx... api-key + firewall-bouncer ✔️ api-key +───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── +``` + +#### Подключаем наш CrowdSec к обмену данными об атаках CrowdSec может обмениваться данными об атаках с другими участниками сети. Чтобы это сделать, нужно пойти [на сайт CrowdSec](https://crowdsec.net/) и зарегистрироваться. После подтверждения регистрации по email, в личном кабинете @@ -300,7 +333,24 @@ sudo cscli metrics ... ``` -Как видим, CrowdSec получает блокировки. +Как видим, CrowdSec получает блокировки. Если очень интересно, можно посмотреть, что именно и почему блокируется +(например, `ssh:bruteforce`): +```shell +sudo cscli decisions list --origin CAPI +``` + +Увидим длиннющий список, примерно такого содержания: +```text +╭───────┬────────┬────────────────────────────────────┬────────────────┬────────┬─────────┬────┬────────┬────────────┬──────────╮ +│ ID │ Source │ Scope:Value │ Reason │ Action │ Country │ AS │ Events │ expiration │ Alert ID │ +├───────┼────────┼────────────────────────────────────┼────────────────┼────────┼─────────┼────┼────────┼────────────┼──────────┤ + ..... .... ...................... .............. ... . ......... . +│ ..... │ CAPI │ Ip:129.211.204.27 │ ssh:bruteforce │ ban │ │ │ 0 │ 79h15m46s │ 1 │ +│ ..... │ CAPI │ Ip:128.199.124.27 │ ssh:bruteforce │ ban │ │ │ 0 │ -1h44m14s │ 1 │ +│ ..... │ CAPI │ Ip:Ip:2602:80d:1006::76 │ ssh:bruteforce │ ban │ │ │ 0 │ 48h15m46s │ 1 │ +│ ..... │ CAPI │ Ip:123.58.213.127 │ ssh:bruteforce │ ban │ │ │ 0 │ 160h15m46s │ 1 │ +╰───────┴────────┴────────────────────────────────────┴────────────────┴────────┴─────────┴────┴────────┴────────────┴──────────╯ +``` #### Настройка Whitelist (белого списка) @@ -343,3 +393,138 @@ sudo cscli allowlist inspect home_whitelist ─────────────────────────────────────────────────────────────── ``` +Еще один способ отредактировать (создать) Whitelist-конфиг парсера, который мы получили командой +`sudo cscli parsers list`. Конфиг `/etc/crowdsec/parsers/s02-enrich/whitelists.yaml` довольно простой, если его +отредактировать (добавить нужные IP-адреса, подсети или даже доменные имена), а затем перезапустить CrowdSec -- получим +тот же результат. Только управлять через списки (allowlist) удобнее. +[См. документацию](https://doc.crowdsec.net/u/getting_started/post_installation/whitelists/). + + +#### Настройка Firewall Bouncer (блокировщик IP-адресов) + +Когда мы проверяли установку CrowdSec, и проверим список сценариев `shell sudo cscli scenarios list`, то нам был +показан список yaml-манифестов c конфигурациями сценариев блокировок. В частности касающихся SSH: +* `/etc/crowdsec/scenarios/ssh-bf.yaml` -- брутфорс SSH +* `/etc/crowdsec/scenarios/ssh-slow-bf.yaml` -- медленный брутфорс SSH +* `/etc/crowdsec/scenarios/ssh-cve-2024-6387.yaml` -- regreSSHion-атака (атаки уязвимости SSH-серверов старых версий) +* `/etc/crowdsec/scenarios/ssh-refused-conn.yaml` -- отказ соединения SSH, защищает от сканеров, которые ищут + открытые SSH-порты (на очень актуально, если у вас SSH открыт по стандартном 22-порту). + +В некоторых манифестах может быть несколько блоков конфигурации блокировок для разных сценариев атак "зловредов". +Например, в `ssh-bf.yaml` есть блоки `crowdsecurity/ssh-bf` (для тупого брутфорса) и `crowdsecurity/ssh-bf_user-enum` +(для перебора пользователей). + +Меняем "беззубые" параметры, на что-то более серьезное. Открываем на редактирование, например, `ssh-bf.yaml`: +```shell +sudo nano /etc/crowdsec/scenarios/ssh-bf.yaml +``` + +Увидим что-то типа: +```yaml +# ssh bruteforce +type: leaky +name: crowdsecurity/ssh-bf +description: "Detect ssh bruteforce" +filter: "evt.Meta.log_type == 'ssh_failed-auth'" +leakspeed: "10s" +references: + - http://wikipedia.com/ssh-bf-is-bad +capacity: 5 +groupby: evt.Meta.source_ip +blackhole: 1m +reprocess: true +labels: + service: ssh + confidence: 3 + spoofable: 0 + classification: + - attack.T1110 + label: "SSH Bruteforce" + behavior: "ssh:bruteforce" + remediation: true +--- +# ssh user-enum +type: leaky +name: crowdsecurity/ssh-bf_user-enum +description: "Detect ssh user enum bruteforce" +filter: evt.Meta.log_type == 'ssh_failed-auth' +groupby: evt.Meta.source_ip +distinct: evt.Meta.target_user +leakspeed: 10s +capacity: 5 +blackhole: 1m +labels: + service: ssh + remediation: true + confidence: 3 + spoofable: 0 + classification: + - attack.T1589 + behavior: "ssh:bruteforce" + label: "SSH User Enumeration" +``` + +Что тут происходит: + +* Сценарий `crowdsecurity/ssh-bf`: + * Тип: `leaky` -- leaky bucket — алгоритм "дырявое ведро", считающий события в окне времени. + * Фильтр: `evt.Meta.log_type == 'ssh_failed-auth'` -- ловит неудачные попытки входа по SSH из `/var/log/auth.log`. + * Логика: + * `groupby: evt.Meta.source_ip` -- группирует события по IP атакующего. + * `leakspeed: 10s` -- "окно времени" — 10 секунд (считает попытки за 10 сек). + * `capacity: 5` -- Бан после 5 неудачных попыток. + * `blackhole: 1m` -- Бан на 1 минуту. +* Сценарий `crowdsecurity/ssh-bf_user-enum`: + * Тип тот же. + * Фильтр тот же. + * Логика: + * `distinct: evt.Meta.target_user` -- считает попытки с разными пользователями (root, admin, pi, orangepi и т.д.). + * `leakspeed: 10s` -- "окно времени" — 10 секунд. + * `capacity: 5` -- Бан после 5 разных пользователей за 10 секунд. + * `blackhole: 1m` -- Бан на 1 минуту. + +Как видим в обоих случаях бан срабатывает после пяти попыток за десять секунд, и блокировка всего на минуту. Конечно, +брутфорсеры -- это быстрые атаки, но "быстрота" понятие относительное. Я выставляю: +* `leakspeed: 10m` +* `capacity: 2` +* `blackhole: 1h` + +И считаю, что это довольно мягко. Но чтоб случайно не заблокировать себя, когда буду подключаться с внешнего IP +не из белого списка (например, по мобильному интернету) -- это разумный компромисс. + +После редактирования файла, нужно перезапустить CrowdSec, чтоб он применил изменения: +```shell +sudo systemctl restart crowdsec +``` + +Другие сценарии можно настроить по аналогии. "Злость" управляется параметрами `leakspeed`, `capacity` и `blackhole`. +Но имейте в виду: не стоит менять много параметров одновременно. Настройки разных сценариев могут конфликтовать +друг другом, и тогда CrowdSec не запустится. И еще, экспериментально я обнаружил, что настройки дней, например `2d` +тоже недопустимы. Надо указывать `48h` (48 часов), и в целом очень длительные `leakspeed` и `blackhole` не нравятся +CrowdSec. + +После перезапуска CrowdSec, можно проверить, что он начал банить на основании настроенных правил (особо ждать не +придется, зловреды попадутся уже через пру минут): +```shell +sudo cscli decisions list +``` + +Увидим что-то типа: +```text +╭───────┬──────────┬────────────────────┬────────────────────────────────┬────────┬─────────┬─────────────────────────────────────────────┬────────┬────────────┬──────────╮ +│ ID │ Source │ Scope:Value │ Reason │ Action │ Country │ AS │ Events │ expiration │ Alert ID │ +├───────┼──────────┼────────────────────┼────────────────────────────────┼────────┼─────────┼─────────────────────────────────────────────┼────────┼────────────┼──────────┤ +│ 30004 │ crowdsec │ Ip:39.98.38.186 │ crowdsecurity/ssh-slow-bf │ ban │ CN │ 37963 Hangzhou Alibaba Advertising Co.,Ltd. │ 11 │ 3h54m49s │ 6 │ +│ 30002 │ crowdsec │ Ip:165.246.104.64 │ crowdsecurity/ssh-bf │ ban │ KR │ 9317 INHA UNIVERSITY │ 3 │ 3h50m0s │ 4 │ +│ 90210 │ crowdsec │ Ip:180.101.143.248 │ crowdsecurity/ssh-bf_user-enum │ ban │ CN │ 4134 Chinanet │ 3 │ 3h6m38s │ 216 │ +╰───────┴──────────┴────────────────────┴────────────────────────────────┴────────┴─────────┴─────────────────────────────────────────────┴────────┴────────────┴──────────╯ +``` + +Время блокировок (`expiration`) могут оказаться даже сильнее чем наши настройки. Это из-за того, что "зловред" +может попасть под несколько блокировок одновременно или успеть сделать несколько атак (_а если честно, я сам не +понимаю, как это работает, даже настройки блокировки на 12 часов будут отображаться как 4-часовые_). + +Плюсом является то, что бгадоря обмену информацией о блокировках, а личного кабинета на сайте CrowdSec можно +посмотреть ваши локальные блокировки в веб-интерфейсе: + +![crowdsec--security-panel.png](../images/crowdsec--security-panel.png) \ No newline at end of file