From 0cb3f588faf9ff4a064acc443c4a672ae2b9231b Mon Sep 17 00:00:00 2001 From: Petar Cubela Date: Tue, 29 Apr 2025 16:29:52 +0200 Subject: [PATCH] 20250429 push notes --- .DS_Store | Bin 6148 -> 6148 bytes .obsidian/workspace.json | 111 ++++++++------ .../apsa-pfsense_vs_opnsense/setup-notes.md | 0 .../VZ/Rezept-Installation.md | 0 .../VZ/Win11-autoinstall-iso.md | 0 .../VZ/ninja-install-archive.md | 0 .../boschmann+feth/20250326-Preparation.md | 0 {projects => archive}/bvv/bind-manual.md | 0 .../radiochemie/opnsense-on-sophosHW-END.md | 0 .../radiochemie/opnsense-on-sophosHW-HA.md | 0 .../radiochemie/opnsense-on-sophosHW-intro.md | 0 .../opnsense-on-sophosHW-multi_wan.md | 0 .../opnsense-on-sophosHW-ressources.md | 0 .../radiochemie/ovpn-mixed-otp.md | 0 .../ssr-kwa/Tickets-20240704.md | 0 .../buero-umbau/20240210-Umzug-Planung.md | 0 .../20240918_Meeting_First-Step-Umbau.md | 0 .../buero-umbau/20240918_meeting-oli.md | 0 .../20240925-Einsatz-Kabellegung.md | 0 .../ssr-kwa/buero-umbau/Inital.md | 0 .../ssr-kwa/einsatz-20240715.md | 0 {projects => archive}/ssr-kwa/licenses.md | 0 .../202410_Meeting-MailMigration.md | 0 .../mail-migration/20250206-KWA-Meeting.md | 0 ...ssr-mail-migration-meeting-max-20240808.md | 0 .../manual/Checkliste-apple-geraete.md | 0 .../ssr-kwa/manual/iphone-onboarding.md | 0 .../manual/kerio-vpn-apple-silicon.html | 0 .../ssr-kwa/manual/kerio-vpn-apple-silicon.md | 0 .../ssr-kwa/manual/smb-server-centos.md | 0 ...0240909-meeting-datenschutzbeauftragter.md | 0 .../projekt-datenschutz/backup-scheme.md | 0 .../projekt-datenschutzkonzept.md | 0 .../ssr-kwa/todo-20240725.md | 0 diary/2025-04-21.md | 0 diary/2025-04-22.md | 111 ++++++++++++++ diary/2025-04-23.md | 132 +++++++++++++++++ diary/2025-04-24.md | 0 diary/2025-04-25.md | 131 +++++++++++++++++ diary/2025-04-26.md | 0 diary/2025-04-27.md | 0 diary/2025-04-28.md | 69 +++++++++ diary/2025-04-29.md | 66 +++++++++ files/Pasted image 20250429110706.png | Bin 0 -> 84321 bytes .../Cluster/20250307-cluster-test-on-sg310.md | 0 .../OPNsense/Initial-Notes/OPNsense-about.md | 0 .../OPNsense-approxminated-service-time.md | 0 .../OPNsense/Initial-Notes/OPNsense-config.md | 0 .../Initial-Notes/OPNsense-config_summary.md | 0 .../OPNsense/Initial-Notes/OPNsense-future.md | 0 .../OPNsense/Initial-Notes/OPNsense.md | 0 .../Initial-Notes/OPNsense_IDS-and-IPS.md | 0 .../OPNsense/STANDARDS/Feature-Capability.md | 113 ++++++++++++++ projects/OPNsense/STANDARDS/Monthly-Time.md | 22 +++ .../STANDARDS/possible-impovements.md | 93 ++++++++++++ .../Schulungen/20250305-initial_ideas.md | 0 .../Schulungen/20250319-pre-meeting-prep.md | 0 .../opnsense-ids_ips-suricata.md | 0 .../opnsense-lets_encrypt.md | 0 .../opnsense-utm-checklist.md | 0 .../OPNsense/plugins/net-snmp.md | 0 .../unknown}/opnsense-bussines-edition.md | 0 .../unknown}/opnsense-central-management.md | 0 .../OPNsense/unknown}/opnsense-checklists.md | 0 .../unknown}/opnsense-frankeriger-current.md | 0 .../OPNsense/unknown}/opnsense-planing.md | 0 .../unknown}/opnsense-proposal-draft.md | 0 .../20250318-OPNsense_Migration.md | 18 +-- .../20250414-preparation.md | 139 ++++++++++++++++-- 69 files changed, 944 insertions(+), 61 deletions(-) rename {areas/OPNsense => archive/APSA}/apsa-pfsense_vs_opnsense/setup-notes.md (100%) rename {projects => archive}/VZ/Rezept-Installation.md (100%) rename {projects => archive}/VZ/Win11-autoinstall-iso.md (100%) rename {projects => archive}/VZ/ninja-install-archive.md (100%) rename {projects => archive}/boschmann+feth/20250326-Preparation.md (100%) rename {projects => archive}/bvv/bind-manual.md (100%) rename {projects => archive}/radiochemie/opnsense-on-sophosHW-END.md (100%) rename {projects => archive}/radiochemie/opnsense-on-sophosHW-HA.md (100%) rename {projects => archive}/radiochemie/opnsense-on-sophosHW-intro.md (100%) rename {projects => archive}/radiochemie/opnsense-on-sophosHW-multi_wan.md (100%) rename {projects => archive}/radiochemie/opnsense-on-sophosHW-ressources.md (100%) rename {projects => archive}/radiochemie/ovpn-mixed-otp.md (100%) rename {projects => archive}/ssr-kwa/Tickets-20240704.md (100%) rename {projects => archive}/ssr-kwa/buero-umbau/20240210-Umzug-Planung.md (100%) rename {projects => archive}/ssr-kwa/buero-umbau/20240918_Meeting_First-Step-Umbau.md (100%) rename {projects => archive}/ssr-kwa/buero-umbau/20240918_meeting-oli.md (100%) rename {projects => archive}/ssr-kwa/buero-umbau/20240925-Einsatz-Kabellegung.md (100%) rename {projects => archive}/ssr-kwa/buero-umbau/Inital.md (100%) rename {projects => archive}/ssr-kwa/einsatz-20240715.md (100%) rename {projects => archive}/ssr-kwa/licenses.md (100%) rename {projects => archive}/ssr-kwa/mail-migration/202410_Meeting-MailMigration.md (100%) rename {projects => archive}/ssr-kwa/mail-migration/20250206-KWA-Meeting.md (100%) rename {projects => archive}/ssr-kwa/mail-migration/ssr-mail-migration-meeting-max-20240808.md (100%) rename {projects => archive}/ssr-kwa/manual/Checkliste-apple-geraete.md (100%) rename {projects => archive}/ssr-kwa/manual/iphone-onboarding.md (100%) rename {projects => archive}/ssr-kwa/manual/kerio-vpn-apple-silicon.html (100%) rename {projects => archive}/ssr-kwa/manual/kerio-vpn-apple-silicon.md (100%) rename {projects => archive}/ssr-kwa/manual/smb-server-centos.md (100%) rename {projects => archive}/ssr-kwa/projekt-datenschutz/20240909-meeting-datenschutzbeauftragter.md (100%) rename {projects => archive}/ssr-kwa/projekt-datenschutz/backup-scheme.md (100%) rename {projects => archive}/ssr-kwa/projekt-datenschutz/projekt-datenschutzkonzept.md (100%) rename {projects => archive}/ssr-kwa/todo-20240725.md (100%) create mode 100644 diary/2025-04-21.md create mode 100644 diary/2025-04-22.md create mode 100644 diary/2025-04-23.md create mode 100644 diary/2025-04-24.md create mode 100644 diary/2025-04-25.md create mode 100644 diary/2025-04-26.md create mode 100644 diary/2025-04-27.md create mode 100644 diary/2025-04-28.md create mode 100644 diary/2025-04-29.md create mode 100644 files/Pasted image 20250429110706.png rename {areas => projects}/OPNsense/Cluster/20250307-cluster-test-on-sg310.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense-about.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense-approxminated-service-time.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense-config.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense-config_summary.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense-future.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense.md (100%) rename {areas => projects}/OPNsense/Initial-Notes/OPNsense_IDS-and-IPS.md (100%) create mode 100644 projects/OPNsense/STANDARDS/Feature-Capability.md create mode 100644 projects/OPNsense/STANDARDS/Monthly-Time.md create mode 100644 projects/OPNsense/STANDARDS/possible-impovements.md rename {areas => projects}/OPNsense/Schulungen/20250305-initial_ideas.md (100%) rename {areas => projects}/OPNsense/Schulungen/20250319-pre-meeting-prep.md (100%) rename {areas => projects}/OPNsense/opnsense-utm-features/opnsense-ids_ips-suricata.md (100%) rename {areas => projects}/OPNsense/opnsense-utm-features/opnsense-lets_encrypt.md (100%) rename {areas => projects}/OPNsense/opnsense-utm-features/opnsense-utm-checklist.md (100%) rename {areas => projects}/OPNsense/plugins/net-snmp.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-bussines-edition.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-central-management.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-checklists.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-frankeriger-current.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-planing.md (100%) rename {areas/OPNsense => projects/OPNsense/unknown}/opnsense-proposal-draft.md (100%) diff --git a/.DS_Store b/.DS_Store index 499cc250d859652a1b9fd6f43d9c56f7ef6aea06..0836ba847c7d1f3be5acc36936c7858e9c8e4465 100644 GIT binary patch delta 54 zcmZoMXfc@J&nU1lU^g?Pz-AtngN%#}lh3iH0ZCJ~%*i=y!W=2Z$vH{+`8k_svH3A> JX6N|J4*} = \hat{H} \Large{|}\psi \Large{>}$ + +![important](files/sbx/important.png) + +## Do-It + +- handout: Sophos und OPNsense +- qumulo - zeichne endlich +- phytron - nextcloud abschliessen + +## Timestamps + +- 09:15 - 09:45: Ticketpflege +- 09:45 - 11:30: SSR Wildcard cert abgelaufen. erstelle wildcard certs via letsencrypt +- 11:30 - 12:30: Pause +- 12:30 - 15:00: SSL Zerifikate beantragen, rumschieben, umwandeln, ueberall einfuegen +- 15:00 - 17:00: OPNsense einrichtung. VLANs, WAN config, Updates, Lizenz, IT-docs, Aliase setzen, user erstellen, dhcp config, dns config + +## Thursday + +- 08:45 - 09:00: Ueber MicroShit Support mail aergern +- 09:00 - 09:45: aldi milch einkauf, quatchen +- 09:45 - 10:00: Sammeln, kaffee +- 10:00 - 10:30: DAV: Linux Netwerkeinstellungen - Ticket Nummer fΓΌr die Rechnung bitte [BGS-13360](https://hilfe.dav360.de/browse/BGS-13360 "https://hilfe.dav360.de/browse/bgs-13360") nutzen +- 10:30 - 10:45: TeamViewer auf Mac Instalileren und konfigurieren +- 10:45 - 11:00: Rauchen +- 11:00 - 11:30: Telefonat mit Toril: apple id kann nicht angelegt werden, da Nummer schon vergeben, Notizen App fehlen Funktionen +- 11:30 - 12:00: FIrewall aufbauen fuer opnsense firewall migration bei kwa +- 12:00 - 13:30: Pause +- 13:30 - 15:00: neospehere netzwerkdiagram zeichnen +- 15:00 - 16:30: OPNsense Einrichtung bei KWA. Lizenz in IT-Glue Eintragen, Passwoerter in IT-Glue eintragen + +## Wednesday + + +- 08:30 - 09:00: ipv6 lernen + +- 09:30 - 09:45: FileMaker Update bei Matthias Wittmann +- 09:45 - 10:15: MicroShit Support schreiben +- 10:15 - 11:00: Pause, ipv6 lernen +- 11:00 - 12:30: ipv6 lernen + +- 13:30 - 14:00: Toril schreiben. Recherche: kann man 2 apple id's mit selber nummer haben? +- 14:00 - 14:30: tga firewall - es geht obwohl es das sollte. Nehme an, dass es an der public IP liegt +- 14:30 - 17:30: NeoSphere Netzwerkstruktur um neuen Qumulo + +## Tuesday + +- 09:30 - 09:45: neosphere - ilo-ubt03 lizenz key suchen + +- 10:00 - 10:30: Zugang phytron nextcloud: design schon gemacht, updaten um zwei versionen +- 10.30 - 11:00: cloud.sbx.de design gestalten + +- 11:15 - 11:45: Projekt Freigabe Postafaecher fuer KWA hinzufuegen +- 11:45 - 12:00: SSR Teams nicht mehr anwendbar duer macOS 12 + +- 13:00 - 13:30: Neosphere Netzwerkdiagram erstellen +- 13:30 - 14:00: Lerne was SLURM und Integration in Kubernetes +- 14:00 - 14:30: Matthias kontaktieren, Sein Mac Updaten, erstelle Liste aller Geraete welche Update brauchen. + +- 15:00 - 16:00: tga cloud erreichen + +## Monday + +- 14:00 - 15:00: kwa zertifikate bestellen lassen und einpflegen +- 15:00 - 15:30: Mailstore authentifizerungs problem +- 15:30 - 16:00: Mit Marko OPNsense bei cqse besprechen und standard hardware raussuchen fuer den build +- 16:00 - 16:30: TestCluster aufbauen und anschalten +- 16:30 - 17:00: OPNsense auf XG installieren fuer KWA und entsprechend Notizen machen + +## todo + +### General + +- [ ] handout fuer jeweils sophos und opnsense als vergleich +- [ ] aufgaben fuer wartung rausschreiben +- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline) + +- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung + +- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs +- [ ] kwa/ssr snmp karten fuer usv +- [ ] update filewave admin und central + +### SBX + +- [ ] kube cluster on pve.lab.softbox.net +- [ ] backup on external drive for pve.lab.softbox.net + +- [ ] check if possible to monitor vsphere passwd expiration +- [ ] create obsidian templates (Meetings, People, ) +- [ ] sbx - opsreportcard summary for action plan + +- [ ] fuege bharchitekten zu connectsecure hinzu +- [ ] erstelle connectsecure report fuer grasslfing +- [ ] cybercns bei heilmaier + +- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups + +#### OPNsense + +1. check franke rieger firewall setup +2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...) +3. test management via opncentral +4. write manual for on-boarding + - setup wan manually + - couple to opncentral + - send generic config via opncentral + - use manual for missing specific configs + - check workings of everything + diff --git a/diary/2025-04-23.md b/diary/2025-04-23.md new file mode 100644 index 0000000..8d03038 --- /dev/null +++ b/diary/2025-04-23.md @@ -0,0 +1,132 @@ +$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$ + +![important](files/sbx/important.png) + +## Do-It + +- handout: Sophos und OPNsense +- qumulo - zeichne endlich +- phytron - nextcloud abschliessen + +## Timestamps + +- 08:30 - 09:00: Ankunft, Serverraum Verkabelung ann Switch pruefen und dokumentieren und planen Portbelegung, Neue Firewall anstecken, nachdenken +- 09:00 - 09:30: UTM Installation bei Dominik durchgehen - zu aufwendig (MAC hypervisor), ports an switch durchgehen +- 09:30 - 10:00: Beginn der Migration durchgehen +- 10:00 - 12:30: OPNsense anstecken, umstecken, allen geraeten dhcp einstellen. Klappt bei allen ausser beim cloud key.. panik, Alle unifi gereate zurucksetzen +- 12:30 - 13:00: Pause +- 13:00 - 14:30: unifi einstellungen anpassen, drucker ip anpassen +- 14:30 - 16:30: VPN Einrichtung bei allen Usern, debuggen.. +- 16:30 - 17:15: VPN und debuggen + +## Wednesday + +- 09:00 - 09:15 Mails beantworten +- 09:15 - 09:45: KWA: Firewall: IT-Glue config von opnsense erweitern, Certificate chain erzeugen fuer OpenVPN und sbxadmin user Client Zertifikat erstellen +- 09:45 - 10:45: IPS/IDS konfigurieren, acme an test.gw.softbox.net einrichten und Zertifikate erstellen, IPS/IDS belastet das System hart, muss getestet werden ob deren HW das packt: hat mehr ram +- 10:45 - 11:45: Firewall Regeln und Aliase setzen fuer alles Dienste, backup erstellen +- 11:45 - 12:45: Pause +- 12:45 - 13:45: Firewall Regeln fuer MGMT, CLIENT und SERVER net setzen +- 13:45 - 14:45: Setze DNAT regel fuer LDAP ports von sbxoffice ip. AD config setzen und user syncen +- 14:45 - 17:45: VPN Server config, firewall rules, + +## Tuesday + +- 09:15 - 09:45: Ticketpflege +- 09:45 - 11:30: SSR Wildcard cert abgelaufen. erstelle wildcard certs via letsencrypt +- 11:30 - 12:30: Pause +- 12:30 - 15:00: SSL Zerifikate beantragen, rumschieben, umwandeln, ueberall einfuegen +- 15:00 - 17:00: OPNsense einrichtung. VLANs, WAN config, Updates, Lizenz, IT-docs, Aliase setzen, user erstellen, dhcp config, dns config + +## Thursday + +- 08:45 - 09:00: Ueber MicroShit Support mail aergern +- 09:00 - 09:45: aldi milch einkauf, quatchen +- 09:45 - 10:00: Sammeln, kaffee +- 10:00 - 10:30: DAV: Linux Netwerkeinstellungen - Ticket Nummer fΓΌr die Rechnung bitte [BGS-13360](https://hilfe.dav360.de/browse/BGS-13360 "https://hilfe.dav360.de/browse/bgs-13360") nutzen +- 10:30 - 10:45: TeamViewer auf Mac Instalileren und konfigurieren +- 10:45 - 11:00: Rauchen +- 11:00 - 11:30: Telefonat mit Toril: apple id kann nicht angelegt werden, da Nummer schon vergeben, Notizen App fehlen Funktionen +- 11:30 - 12:00: FIrewall aufbauen fuer opnsense firewall migration bei kwa +- 12:00 - 13:30: Pause +- 13:30 - 15:00: neospehere netzwerkdiagram zeichnen +- 15:00 - 16:30: OPNsense Einrichtung bei KWA. Lizenz in IT-Glue Eintragen, Passwoerter in IT-Glue eintragen + +## Wednesday + +- 08:30 - 09:00: ipv6 lernen + +- 09:30 - 09:45: FileMaker Update bei Matthias Wittmann +- 09:45 - 10:15: MicroShit Support schreiben +- 10:15 - 11:00: Pause, ipv6 lernen +- 11:00 - 12:30: ipv6 lernen + +- 13:30 - 14:00: Toril schreiben. Recherche: kann man 2 apple id's mit selber nummer haben? +- 14:00 - 14:30: tga firewall - es geht obwohl es das sollte. Nehme an, dass es an der public IP liegt +- 14:30 - 17:30: NeoSphere Netzwerkstruktur um neuen Qumulo + +## Tuesday + +- 09:30 - 09:45: neosphere - ilo-ubt03 lizenz key suchen + +- 10:00 - 10:30: Zugang phytron nextcloud: design schon gemacht, updaten um zwei versionen +- 10.30 - 11:00: cloud.sbx.de design gestalten + +- 11:15 - 11:45: Projekt Freigabe Postafaecher fuer KWA hinzufuegen +- 11:45 - 12:00: SSR Teams nicht mehr anwendbar duer macOS 12 + +- 13:00 - 13:30: Neosphere Netzwerkdiagram erstellen +- 13:30 - 14:00: Lerne was SLURM und Integration in Kubernetes +- 14:00 - 14:30: Matthias kontaktieren, Sein Mac Updaten, erstelle Liste aller Geraete welche Update brauchen. + +- 15:00 - 16:00: tga cloud erreichen + +## Monday + +- 14:00 - 15:00: kwa zertifikate bestellen lassen und einpflegen +- 15:00 - 15:30: Mailstore authentifizerungs problem +- 15:30 - 16:00: Mit Marko OPNsense bei cqse besprechen und standard hardware raussuchen fuer den build +- 16:00 - 16:30: TestCluster aufbauen und anschalten +- 16:30 - 17:00: OPNsense auf XG installieren fuer KWA und entsprechend Notizen machen + +## todo + +### General + +- [ ] handout fuer jeweils sophos und opnsense als vergleich +- [ ] aufgaben fuer wartung rausschreiben +- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline) + +- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung + +- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs +- [ ] kwa/ssr snmp karten fuer usv +- [ ] update filewave admin und central + +### SBX + +- [ ] kube cluster on pve.lab.softbox.net +- [ ] backup on external drive for pve.lab.softbox.net + +- [ ] check if possible to monitor vsphere passwd expiration +- [ ] create obsidian templates (Meetings, People, ) +- [ ] sbx - opsreportcard summary for action plan + +- [ ] fuege bharchitekten zu connectsecure hinzu +- [ ] erstelle connectsecure report fuer grasslfing +- [ ] cybercns bei heilmaier + +- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups + +#### OPNsense + +1. check franke rieger firewall setup +2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...) +3. test management via opncentral +4. write manual for on-boarding + - setup wan manually + - couple to opncentral + - send generic config via opncentral + - use manual for missing specific configs + - check workings of everything + diff --git a/diary/2025-04-24.md b/diary/2025-04-24.md new file mode 100644 index 0000000..e69de29 diff --git a/diary/2025-04-25.md b/diary/2025-04-25.md new file mode 100644 index 0000000..2b83af8 --- /dev/null +++ b/diary/2025-04-25.md @@ -0,0 +1,131 @@ +$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$ + +![important](files/sbx/important.png) + +## Do-It + +- handout: Sophos und OPNsense +- qumulo - zeichne endlich +- phytron - nextcloud abschliessen + +## Timestamps + +- 08:15 - 08:30: IT-Glue dokumentation +- 08:30 - 08:45: Firewall Aliase und Regeln fuer Unifi definieren +- 08:45 - 09:15: Firewall Regeln anpassen, Drucker macht Probleme, Regeln anpaasen, Drucker falsche DSN einsetllungen +- 09:15 - 10:30: Alte firewall aufbauen und anschliessen, Passe VPN Config an: dns und regeln, bei Herrn wassmer vpn konfigurieren +- 10:30 - 13:00: installiere opnsense auf alter hardware, debugging, root passwort geht nicht nach backup restore, mehrmals neu installieren, pass reset: komme nicht in web-ui +- 13:00 - 14:00: Anfahrt +- 14:00 - 15:00: Pause +- 15:00 - 16:00: KWA opnsense HW aufbauen und mit pikvm verkabeln + +## Thursday + +- 08:30 - 09:00: Ankunft, Serverraum Verkabelung ann Switch pruefen und dokumentieren und planen Portbelegung, Neue Firewall anstecken, nachdenken +- 09:00 - 09:30: UTM Installation bei Dominik durchgehen - zu aufwendig (MAC hypervisor), ports an switch durchgehen +- 09:30 - 10:00: Beginn der Migration durchgehen +- 10:00 - 12:30: OPNsense anstecken, umstecken, allen geraeten dhcp einstellen. Klappt bei allen ausser beim cloud key.. panik, Alle unifi gereate zurucksetzen +- 12:30 - 13:00: Pause +- 13:00 - 14:30: unifi einstellungen anpassen, drucker ip anpassen +- 14:30 - 16:30: VPN Einrichtung bei allen Usern, debuggen.. +- 16:30 - 17:15: VPN und debuggen + +## Wednesday + +- 09:15 - 09:45: KWA: Firewall: IT-Glue config von opnsense erweitern, Certificate chain erzeugen fuer OpenVPN und sbxadmin user Client Zertifikat erstellen +- 09:45 - 10:45: IPS/IDS konfigurieren, acme an test.gw.softbox.net einrichten und Zertifikate erstellen, IPS/IDS belastet das System hart, muss getestet werden ob deren HW das packt: hat mehr ram +- 10:45 - 11:45: Firewall Regeln und Aliase setzen fuer alles Dienste, backup erstellen + +- 12:45 - 13:45: Firewall Regeln fuer MGMT, CLIENT und SERVER net setzen +- 13:45 - 14:45: Setze DNAT regel fuer LDAP ports von sbxoffice ip. AD config setzen und user syncen +- 14:45 - 17:45: VPN Server config, firewall rules, + +## Thursday + + +- 10:00 - 10:30: DAV: Linux Netwerkeinstellungen - Ticket Nummer fΓΌr die Rechnung bitte [BGS-13360](https://hilfe.dav360.de/browse/BGS-13360 "https://hilfe.dav360.de/browse/bgs-13360") nutzen +- 10:30 - 10:45: TeamViewer auf Mac Instalileren und konfigurieren + +- 11:00 - 11:30: Telefonat mit Toril: apple id kann nicht angelegt werden, da Nummer schon vergeben, Notizen App fehlen Funktionen +- 11:30 - 12:00: FIrewall aufbauen fuer opnsense firewall migration bei kwa + +- 13:30 - 15:00: neospehere netzwerkdiagram zeichnen +- 15:00 - 16:30: OPNsense Einrichtung bei KWA. Lizenz in IT-Glue Eintragen, Passwoerter in IT-Glue eintragen + +## Wednesday + +- 08:30 - 09:00: ipv6 lernen + +- 09:30 - 09:45: FileMaker Update bei Matthias Wittmann +- 09:45 - 10:15: MicroShit Support schreiben +- 10:15 - 11:00: Pause, ipv6 lernen +- 11:00 - 12:30: ipv6 lernen + +- 13:30 - 14:00: Toril schreiben. Recherche: kann man 2 apple id's mit selber nummer haben? +- 14:00 - 14:30: tga firewall - es geht obwohl es das sollte. Nehme an, dass es an der public IP liegt +- 14:30 - 17:30: NeoSphere Netzwerkstruktur um neuen Qumulo + +## Tuesday + +- 09:30 - 09:45: neosphere - ilo-ubt03 lizenz key suchen + +- 10:00 - 10:30: Zugang phytron nextcloud: design schon gemacht, updaten um zwei versionen +- 10.30 - 11:00: cloud.sbx.de design gestalten + +- 11:15 - 11:45: Projekt Freigabe Postafaecher fuer KWA hinzufuegen +- 11:45 - 12:00: SSR Teams nicht mehr anwendbar duer macOS 12 + +- 13:00 - 13:30: Neosphere Netzwerkdiagram erstellen +- 13:30 - 14:00: Lerne was SLURM und Integration in Kubernetes +- 14:00 - 14:30: Matthias kontaktieren, Sein Mac Updaten, erstelle Liste aller Geraete welche Update brauchen. + +- 15:00 - 16:00: tga cloud erreichen + +## Monday + +- 15:00 - 15:30: Mailstore authentifizerungs problem +- 15:30 - 16:00: Mit Marko OPNsense bei cqse besprechen und standard hardware raussuchen fuer den build +- 16:00 - 16:30: TestCluster aufbauen und anschalten +- 16:30 - 17:00: OPNsense auf XG installieren fuer KWA und entsprechend Notizen machen + +## todo + +### General + +- [ ] handout fuer jeweils sophos und opnsense als vergleich +- [ ] aufgaben fuer wartung rausschreiben +- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline) + +- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung + +- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs +- [ ] kwa/ssr snmp karten fuer usv +- [ ] update filewave admin und central + +### SBX + +- [ ] kube cluster on pve.lab.softbox.net +- [ ] backup on external drive for pve.lab.softbox.net + +- [ ] check if possible to monitor vsphere passwd expiration +- [ ] create obsidian templates (Meetings, People, ) +- [ ] sbx - opsreportcard summary for action plan + +- [ ] fuege bharchitekten zu connectsecure hinzu +- [ ] erstelle connectsecure report fuer grasslfing +- [ ] cybercns bei heilmaier + +- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups + +#### OPNsense + +1. check franke rieger firewall setup +2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...) +3. test management via opncentral +4. write manual for on-boarding + - setup wan manually + - couple to opncentral + - send generic config via opncentral + - use manual for missing specific configs + - check workings of everything + diff --git a/diary/2025-04-26.md b/diary/2025-04-26.md new file mode 100644 index 0000000..e69de29 diff --git a/diary/2025-04-27.md b/diary/2025-04-27.md new file mode 100644 index 0000000..e69de29 diff --git a/diary/2025-04-28.md b/diary/2025-04-28.md new file mode 100644 index 0000000..844eedd --- /dev/null +++ b/diary/2025-04-28.md @@ -0,0 +1,69 @@ +$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$ + +![important](files/sbx/important.png) + +## Do-It + +- handout: Sophos und OPNsense +- qumulo - zeichne endlich +- phytron - nextcloud abschliessen + +## Timestamps + +- 08:45 - 09:00: Ticketpflege, Kaffee +- 09:00 - 09:15: Mailpflege +- 90:15 - 10:45: Ticketpflege +- 10:45 - 11:00: Bvv CNAME Eintrag setzen +- 11:00 - 12:00: Autotask KI Meeting +- 12:00 - 12:15: Kommunikation mit Oli zu MicroShit Support Kack - Schiess Opfer Firma +- 12:30 - 13:30: Pause +- 13:30 - 13:45: Micro$hit Support schreiben. Was fuer Bastarde +- 13:45 - 14:00: Ticketpflege +- 14:00 - 15:30: OPNsense IPS/IDS Test, pakete installieren, IT-Glue doku anpassen, unifi switch in IT-glue replizieren +- 15:30 - 15:45: NinjaOne Bitlocker Recherche, If Bitlocker enabled werden sie in Ninja angezeigt, Erstelle Skript zur Aktivierung des Bitlockers (https://ninjarmm.zendesk.com/hc/en-us/community/posts/35526222579597-Enable-Bitlocker), (https://ninjarmm.zendesk.com/hc/en-us/articles/360051468491-BitLocker-FileVault-Encryption-Key-Management) +- 15:45 - 16:00: Privates +- 16:00 - 16:30: Telefonat mit Sebastian, Packen fuer KWA (15 min) +- 16:30 - 17:30: Anfahrt +- 17:30 - 18:00: Alte HW einbauen, Lizenz einfuegen und Updaten, Switch in IT-glue anlegen + +## todo + +### General + +- [ ] handout fuer jeweils sophos und opnsense als vergleich +- [ ] aufgaben fuer wartung rausschreiben +- [ ] detailiert feature liste fuer opnsense (fuer internen nutzen und grobe baseline) + +- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung + +- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs +- [ ] kwa/ssr snmp karten fuer usv +- [ ] update filewave admin und central + +### SBX + +- [ ] kube cluster on pve.lab.softbox.net +- [ ] backup on external drive for pve.lab.softbox.net + +- [ ] check if possible to monitor vsphere passwd expiration +- [ ] create obsidian templates (Meetings, People, ) +- [ ] sbx - opsreportcard summary for action plan + +- [ ] fuege bharchitekten zu connectsecure hinzu +- [ ] erstelle connectsecure report fuer grasslfing +- [ ] cybercns bei heilmaier + +- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups + +#### OPNsense + +1. check franke rieger firewall setup +2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...) +3. test management via opncentral +4. write manual for on-boarding + - setup wan manually + - couple to opncentral + - send generic config via opncentral + - use manual for missing specific configs + - check workings of everything + diff --git a/diary/2025-04-29.md b/diary/2025-04-29.md new file mode 100644 index 0000000..7dd21a4 --- /dev/null +++ b/diary/2025-04-29.md @@ -0,0 +1,66 @@ +$i\hbar \frac{\partial}{\partial t} \Large{|}\psi \Large{>} = \hat{H} \Large{|}\psi \Large{>}$ + +![important](files/sbx/important.png) + +### KWA OPNsense nacharbeit + +- [x] backup via ftp to nas if possible --> backup via opncentral +- [ ] change ilo ip such that its in the mgmt net +- [ ] unifi cloud key mit cloud koppeln +- [x] Switch und APs in IT-Glue hinterlegen +- [ ] physische Beschriftung anpassen + +## Timestamps + +- 08:45 - 09:00: [x] KWA OPNsense Firewall Regeln nachbessern +- 09:15 - 10:30: TGA WebServer Protection zu Cloud +- 10:30 - 10:45: Rauchen +- 10:45 - 11:00: OPNcentral Lizenz einspielen und dokumentieren +- 11:00 - 11:30: KWA OPNsense IT-Glue Doku weiterverfassen +- 11:30 - 12:00: OPNsense cqse Angebot pruefen und besprechen +- 12:00 - 13:00: Pause +- 13:00 - 14:00: KWA: Unterstuetzung bei VPN Einrichtung auf iOS, Mail verfassen zu VW Ablage von Projekten auf NAS: pruefe Firewall Rules +- 14:00 - 14:30: SSR: VW home.asp ticket von annika. Pruefe VWLizenz Server +- 14:30 - 15:00: pause +- 15:00 - 15:30: OPNsense feature liste + +## todo + +### General + +- [ ] Liste erstellen aller Projekte, die es gibt und neuem Mitarbeiter vorstellen + +- [ ] handout fuer jeweils sophos und opnsense als vergleich + +- [ ] verbraucherzentrale cybercns ueberpruefung - kw ab dem 16.01 wegen baldiger sicherheitspruefung + +- [=] filewave - integrate new admin user - integrated in filewave - need to be tested and then deployed on all macs +- [ ] kwa/ssr snmp karten fuer usv +- [ ] update filewave admin und central + +### SBX + +- [ ] backup on external drive for pve.lab.softbox.net + +- [ ] check if possible to monitor vsphere passwd expiration +- [ ] create obsidian templates (Meetings, People, ) +- [ ] sbx - opsreportcard summary for action plan + +- [ ] fuege bharchitekten zu connectsecure hinzu +- [ ] erstelle connectsecure report fuer grasslfing +- [ ] cybercns bei heilmaier + +- [ ] Fuer Synology Monitoring smtp einrichten wegen HyperBackups + +#### OPNsense + +1. check franke rieger firewall setup +2. replicate config on opncentral (IDS/IPS, OpenVPN, Web Proxy, antivirus, acme ground {needs specific manual how to setup on spot}, ...) +3. test management via opncentral +4. write manual for on-boarding + - setup wan manually + - couple to opncentral + - send generic config via opncentral + - use manual for missing specific configs + - check workings of everything + diff --git a/files/Pasted image 20250429110706.png b/files/Pasted image 20250429110706.png new file mode 100644 index 0000000000000000000000000000000000000000..92b870febe25d0d40099e640c124ab6ef982b22a GIT binary patch literal 84321 zcmbq)Wmr|++BJ=YbR!{+GzdtSbc@2KyQHOCQU&Sm?(PObx^vSF(%t>7?UU!c=ildb zA)CF{oO7)icZ@OaZ%PW1&yk6cp`f6iOG~|d2L%P&2n7Y*{R{#4M#KH;5ef=9-&{;g zNm@*dTDE?>}+#kZ zx^O`#uP8vu5t%E6I2DHNzR&3NmdS&C8=3Je^P5p#bR4#xE%6=knI7IBI=9{YO5)+* zd4dvF)<+2_D1QNE?#rm0Uxp~aOA{MP3~iQmpqRMzs`5!yW>KJ9;^pQMc2nvV6jFtPe z_S!ps=~xmh>y9@Xxl$_Y-4dhsEpR z^$n>cz8)KSN!;t6Qav)6HovA#N}=1_sgWaG3QnV!GiG@bs$2Kg)F^Z@L8Hu$hWBKdUxLt+|Q!Jti-|*gIL4JD^9+KDKk9`ihX3BcOeTwiJE_rQV!e z+$ZjmixL-n{Y_fkf#%bMi$m;ZL$)v0R_0cSKQ>xY1o4i{Rjx2I7n3h?K(H&qqR9$X zf~23khRN;wQ&TPoOJP2LBKXXO7z&COI1p15Wc~d0o`??SLpuEVXEs*J-73W4A0#fY z-WYHlBB&skH{?j!(3l_uRbR(+C>$RqJw!UhyB{J-&qIB%(+QK|<9=}3qB!{I96yu# zf#Cu#(Jsk~CW3*MDg0gvcRUc4oTHb>K)5uV8|PVoD4WuY=x0deY}HsA=(r-(N<0ow zg+5*Z3Sx2T#7f-fP(+_4(w#@u2;igi#X;Cy{#zZW@koe2R*wzdU=Dw_U-fXo)ABu$hJ+kl6LsE0`)H!O!<+@Lh8EjRt!&IJV;w{bc2P$j@sLPgkf(yLx7_d z#qf~@Da^>dd22?!@DdfX``hVT%1jit8}~Cu48<_T2++GrUe>%28CDur31zC&C>1@d)@oab=l`%I zBPb;(-wJ9~eGI%Whf!!(YS;8B3NN!&TCMCL#}%K-a(l-!c`+$ASv2`lyf`z0LY7Uv zLh2;mAa5-{(l@f?UG}@scLC!()JV_8IkGFv3aW>yv8x5=)QshgbJ-PLvp%(a3Ol96 zb;NbXO_j-z@sla*SNqUdSobk#S9Qu{iuR)!r%DY*jqykKsnWt0Rkiods$2Q^g=tFO z`Op^eAN@ZTkG{zt%V5hb$k{2PpIpdsRX?l2lOND#P`79TyOv;D71kDU>AE*v!XLyr zQ1eEm%CKbVW`ymUZC~$vbwt~C*!{jov?HH$UsguTzo0{`!#y zl|9)5I9xRx^6Vw7Ertk5vq>jIm+_7x?Spp7l<_J&dCSR`!>>oU$~ef%)79ZLHq>8h zHYXGbaXTG?8xHKfL38T48l;sTMmc($HZi7CA1{XICKC;{^*u)d4b}~-x^ugJm6Rkf zjX0GZc=8o4dNe(EvT|BJAlVncytt%9yG64@Ya+QN4EnAo!M5H=***5tE@WN3hehF1 zL0y41`O$&PS;4N2XtM~uHh%2@H2yb+Mb2TzwxUk?o{$68oy$S(k(521 z%|~DJ4mlH2w&FXO-9svao zCDBh9gTYL5G)gaP<@*Z9%bD<%@SyOm4Al$WURJf~I5C`)D4 zo%u%C%czci-sWGF+$7#uoFRIjJ`|J+=L)|cZEJV^*_t*cbmo1yU{+-}-Axv-(2*n_ zE1o019K_Sb?Ok!3vmf_O9w~{Jd){WL3BF0ZJjbSJ9=wZn6S)xCZgp12X_aTgvhb+i zGfu)SV~87SGx09y z(sOZS+5749kx#D7&;D`08NXS?G_oN6Nw0Xj`dpck!u;Jk%yvv^N3)9F(_*^Y&U3Jq)M_?g%bpq1GX? z)SSEA{&c?St|nUQp!2-m?ICfbX5e7(5@lMuG_7UTVf|dbd+3+uWnCigJ};5Y{G#=K z^^s-cx@}(0Kt)lFyUx`OX;$h(ERpXl$%nmywm zZ12bBdg6Nm6gN_%1*cpzZj$a7Msh;9OJby8z(UoaK&^F{YYP~Uo_qVy!#sVMRUz?j*^$`;ZDirmoq$`wm{&dkmn%r>7)S=e}Zcvx83S=iZ`fIFD%U9BDT zU6`!xDgWr?uYTSd+Z%o|w{Y6<$MCC`7h z{MVKLZu!C9_>-886)>cO;6E$#=dl02_-8|Y7Ra0bYbO4f=HK4}^DKzW&+_-02_kP6 z)k#7@2}4Q06?yLhy`KVK&sj6p`QzgKE+)w1q-%opCu-D^`%#Oo03Hm`GxSSxIDcVG zX!^#$?zX3gBMKVcKZb;U$tp#De9}XPj&<;!^6w!yVZ<&S0}2)YZ29NNe|BR-K`vew zyj|M3TWDT2#I+Z{9?EwZ?=)vl`()L6^NZwcFIuE7wP?cWT=K^HqANXgwPso;2~XW9 zqSUdS#Caitx$XXx^xh=J5qy5V9+pSqG?UTOVr_bEti5RM&g8X~Y#&-S^5RqP(o=Do z^OEaMJ0e-})OTHD9Rb(J555^+@P5x0@aV!A+uYNetAWJKR&5WLJHRlqaXM~0P(E2z zCf~W{%*+SbdiKA6i}CuEU^(Li7vtvud(cbHTz5ylAy?QBFTD)f-LTk@U_a!fql9W65`p3E4AfS0IsSOu-Dvffo`xkZq;LR)O0;LGf@30 z#G_1;?Ydw0ys*z^>n5P|yjpbL0s2&|cX~MfiEdq>ZjxY(75frvp2D(zHPGvE^$S@p zu}$;XNM4$kTbA>lt6W{Ln=bQf4q$O}2~FbL7fF;+X_IY5Z3cd# z3ngF2$b7G#)9-yyNKr?1d(+^z<*0 z^2==(U`=sV&XEct=IT*V>#p39WzQ>ZwR7c}Z**>5xN2`ghf)RNx%Vd0_s&7J0+TA} zKNaRji8s0D%(AMx@HDUazTH2qlReqGO4e#fyHLOIx?VNk$%#{lZn-;b!uC{=Yjy`L zf?ld)J3RjNU7YC*Ql-a6gd{InE1C16qZ$#g4C9Do9^sG2UxaX^iBsbWP;y9Jo3~Qk zv5t6BiNg3#rRJ=g4w?mD(M^ypHE27{QkT@ueSCblKA%vWh*8to!A5AdFdh$LDBT_) zh)?bi;2Ce+E8UZ&Rsi-iav1>)t;^NNnuN;pop-WKF~1Tmn4eTz&&OrWfhAWQ5xCMS zXZGaZj8?f{+)5gBZv_VawM4HP$_$ zz&EsK2F@D`l;~kUmAhfLvVI?Si1gclL5@$#%h7Rz(vxmtmJEmVe9x0E{BI%)j8%hc zu(4(cLA3K1!dDMh%XtwJMD!JSq3uN9pfP21>ALN-2mL~!pUWJ_>3Z!P)}qe+N^xH5 zR7LLcr;uxk)wJeOYbCs9jZbx1`xb2Ud_=iWsn!(_p^Od$N>qlTR7O0Y*8nLW_ZBH| z482wfMc-P%EFcsVnckm4C7UOkjrlfj(Ev%nZ zDiVAq@05G#)w1{UUCg&Ycs$ULU|`NX4%vs`U1Fs{7&}{-k}t-LgZpq6K<&wt{cj3p ztHe}t6*KlEUQMLt=aB~5d6SbU6G_qG&_zw_dV9{9Bw1-CnCGPQka>H|xvYnH!mNjI zFWKglU6Zy4A3+~6FQf3I%}h7)wj*v5=j=Ep2^&x#<~RZdrIg0XMLUP zjG5-^<*aF1vU9>^dbu)!diRHO5jYkF`@=e|dTpgR-@7*q^X}D)5*jBE1aMzfjAj}6(ngU| z(J-3}A%7gJGL4ewI`J?H?evUxog024Y3=H5Cp1l7y;?_KM!e2=U6q=AMEKC1O8 zgpT_0s%}*jcyiENXC@yzP*~1AiYZaom>ah<^-{ znBDq^SE3_gk2%;YX$VpC0;h44f9O^W-sm8ei!%2SIW?18_|kZjV%uwS40;z*D_@c z+5{u4E0fhbSHQ@9z$uzG`3l%!fjoiz@}Hk_aNsMzZac`ij?A`(%Z6bBSW#ZRTv2Xx zXD+sS;sWQRVvBoU*61=^o>+IJ2^ss)1SGW{I>6$WuasD?%f*&7qKBrYh)|FES-QO~5#6tC1|2`3 za;{%lUbnfsP+F8tvX45W7_+({<*lX^C`&n2n%`Y_?PsGFV+mbCJ(&IaCrn2+jErP9 zC@*-5WYZRi&@TD{e!Sd%19oRVe2G#oMTv5b+mmF|I=i>&#qdppS%w!0Rm>~%XrNc3 z?yg$-ZlIdBpSy$AY?owOQ6>9m9D!ao>H4UsT8CGNDH%*}#XE(~@6V zoq8cZyQ2M3=wyzJOi~z=l-|ZyuO#_I$~NxgCiUZu?8GzrqF;AiAzs}sDd6jRRCuE( z-P-vXcLV`TT7l{-&4(q!bwp7*U*eL|dHQU@N4j1m%65yTb!218g5ydlUK-?AH}{d@ zs#gC7>BxqU{uV2Mcm#9ForY3cQRtysaX-avw_peGdeV0Xb!l5!&m?Z|mY)vuKz`Do zogLFul;&0VK&quDAiA2zT~!)9p(s%Ba8~*xttXFjWbn~nF`^XgO6Y2x_kY&PO5MRQ zTx5!ly1s$kg}yXJT%<&yJ}Ooo)x|(KWKBjO+l}7TXj+&~O){g??!ZDZ}$5=R5Pe@e>!?eiAGw}W7*uAG;2gHr{)42M&v*WcV< z5U;9a7detXEJ>x#o7)Wf{(ioT6c=GRk)JE`%q|sVSVr#T|i(O2FUG>+`do=wX zqPb`EV4X2d4d6G0VwF2PF_w{Nq6@LX+q>`IixwT(Ej~-rIPYp^KV48r3U=Jq`a7N4 zMuQQk$;a|g_9u{IJq}A3M}<;KEeEATvB%SuavOgp3u67?zed2Z(e=?VHuY2={+V+< zg*L+$T&#Wxc<)!^7x=7rf_U37-k`&Nx>mOIkjqNE=cJfa1--Px?OO+R%a>3LAS)@< zkA#ykU0>Mwg<$&(_|dS=@dqqcDHmwAOW!ua2c&SsP^0y!;ZjAG(-G z_FkS&=@wYJyO3RXXGE(6UJ(+m@CoCr85m$emm#l_tkCGB*y>7*QQxxDFC-N05NUI) z{@B2?xVov(@}ujbi|=}CWa%}86{TM9$Z>+tzir zzUFgMa=6C)pwWOwt{WZ!z&xoF_NIH{v+-DikzS3>E zEqfN33=;+Z$1yq(R2! z6e=7xmq`tG8P=C`gPvMjO793k`m6l6+gU9d#o-ku@giJ7hAnT&X%H^>Ibemi4P)CF z1&_O9!hP6$EMa63VvLV7S}dF3F5#@9W#?Y_4VHh@vw}{tE&GlXpky610y=7Nk%%?~ z8ymuRW4$G1F57rIu<;(aYw0aZIRh4GncZ_v<{{-=ydu?&0M8tupC`g6LWr@h7yWSH zoB@x|H!en+&Yn&V(+K%yb6zQ>cG=7QigzW2QiRNc7s;%X3RNUIoEEIN7DQ(8rO1`D z$y!yd>U4o+o>VLNCRgtzbv;%TA{C5gfa55~KDu?A9Nvem9#0(2TPnuPnuS=u+NFrE zogRD7@OtYo_@yrxYcH&HmCN2fdiy#ReJHF9~%aexkA4@wvYf; z3ZEJWg&qk$?jkv2MmB=b1wjQ><0eBZgFo;SZZ+u9*2Xa1zcQdQI1}X|1up|9AW>L` z3PGN(3q%=A?-JNm<5K3b^c9T(xBVT#n=FD;N@Y_jt)23Iy@X#01lwy8n#J6^dg&US zw3kHzY7EzUNFsf-bFc8&a7=Il*sn3p1I=bYUtPGs3u8`<DXL1D!I(j!b{j2OjxesR~PIDBI;Xr-L+J8?D!y;XJa8?0oDJ5V*=pEp56U$ZXbzj4b0l?* zScbv}FTRwO*{W>+b6pEPd|XP+}X^cFb$a0X3AJUW%L zhvG5#Dt7iWF9(XMiQoEQF}FszcQTR*n@jCkcO=wV*K^x+X94P?6Igu*_tt`Yb_GQ>5-WbQouj zz6_IeKd^mga_@H6Dv#$T6yGD+&0R8aYneIN#&mH#_uHAyUZPT=4hRax4rMx4SvF8;(^^!mRsoq2&E--zJi!rMEeR#AfDC_D z*kkoLDL?J?bASJs%Iinxx!jKfpE%nLjDGF9TiU->V&sp5h026j_ju`ilpX8VfyRByA+0)MqOlS}YW< zin~jF?I|fasBlIUCjuQIi8VhTA`mp(Z(;ou_7;rev^`K>YOT(;<`a~ct1P`@`8#yE zZ^R^kncf7c&7vZMgDd0AEtw|2>s2f1+}K0Aj*=y-RwpQva|q|GEMVAFp!%N7GT=XHsJaEE^xn{>Px_$T065+~HN({#UP$qCl_S zFU#EiK0A;H`HdoqrmJCuXU;Q}2NnFUUh#om?@(N)82-HbF9;ZdptSgY##z+y`5^bd zdToRBs@q$n^Y=jiG~LF9%ig|3E;e}eKYD!#0D65C)ww|a=NbQMDqKbmAjWEXxGMjv zR~AUG_@{+x|5~WOrqK-^nDiEyqWJ&StM^Nw*S2uAmcQ=)V`hGjI?4c?=*Kvbjrr2&Gi{f)24bR&vZDMYDdb|q>s`j*LKIxWaD5-u&hV>_B#-$Yw8ySK{wwm$W!QTc_-t%U?+JC0R=x6mC(HT*L;z~6#^@-2`|+$ zpeT5gy#@{wdW=_iv+C~vB*4_e!AS7d zqE=P|z2@SoX^q94^H=rtNl}JuU_%A7w7S4=mj6WCd!uTEmWv-^WT@m}WMo)akXso3 zbIA>DS9I*dEjrA~((Xol`CoAXa5{dJ!9zDN*NslFG#`u30kgI!1Ms3k*#eg{lo__F zc>q$*Skm@*yHi{>T-X|eCV0K#9~lgfCyOex93e?ME2e&^TpsR&>+0zgtFU6ns!CX*Q`8Nr+MunN7maS#SX>Dd_#22>0i(D$!!A!Ni%&pf3 z-njr=!d4|6Wf@3llE0!|MAFp^P-4@2ybvh6A=Uk`0f@mAhXz&1w+y2MhlwqhfEoMF zzG6NApKLN~9CvXEVA7YaguCTPFGjc(1Ngm5YQX)LF!UT(xBK5{Q*9T59hHY^8k-l~ z_DbS}$POT=Y_ej4Ad{eB%Nc~0;(NSauL2G|4Qv~b_f9PL0dOt94U6$Wb%PE`|IzZ3 zUx)6sECLm5By`_rqx1px(a_8Raun(jaJnjLrN+UFD&gDD3yeX-=&7h{!5+I~FYG!o zT@wI;We)Mw#Icx8GcXsVmUZ?~9A5*WdLs!XW10^Ls*Ftz21z}RMMi`G)b7=sp@oV7 zS)zm^XH(rqq%1EP!m3Cxj6b`KJ58clCcn^O91r-N0|fWmx&aO^&xq3QQR|)c2)Ek! zJI9RTF)kd+XbK!&&A9y_m>~6p%MTNiQ6UuC0*L^y^2hMNQqL+8weL)+>0b1~4J-1W zbiN?NX{tvL9NQ8P=wUoi_z4Fev;=_U2h-m7>tyzVA#?o#ttex<;&Tur?F=8J2fg(n zcc>lZh8^GK$bBy4o$AKoK0l83T$evqKjW5MxVZXRrmdWH+k=zZJAiW#%i{sEsuTp* z9MmIgJKuf4m|opOAgUcDy^QrMU|o&nc5S@?MrFfMd5f**MbreFbZ1kT?{naN+iB;P zwq54T^IQew@J^N_=Yt+}euK;{%ujxtgc!LU!tCU~V>2q)2P#<4lI_e%y?~k@>^H)x z(3uUxzreGVuR%V_wT2i$HNbge8C0Sp?Ci)Rlvi&z)KjnCe#eZE{L4#=Exz3i(X%Gg z!g?e%EQWTs#<5|xdO~5ZO^IS%r)Aw?LVnAme92(PCzPvmWg13c^M3CnKSoz}>^U_& z$_p?vYq!QTyh(gyMJBH<{yCh3B0*C3{feAIUdG{b5{^gUy?x(eWkJlVVCRck76e}bd4F+3assLkB5GUOIV|T zmq{Mx>kn9%edp6$3ZeYw#h%3Q>oe0KY|vp220>}-?XH3!w_k~8*$=8>(C@4**x~!x5#W#=ypG+PQPNvaF<@ z?G%GA0^ALc=h+bV4q%E-JnXdvqo{nD+`vlU#vf6dUdY>iJ--i+Qbj0bg#Pg(bio87-0YF?KB-+I185 zY~rqE-akAXc`E`|)LFwc#qs`5ufKS`-`=N=z5oeTy6tAjCQ{wiQ-I$m?HP?Jwu*pn z`H8@Ha$7ws~p?*s{;QhpLR69{c!x%8%-;F9T4rm{22i%rWpeP zuHPF3YdG)@6@*|F)GH-@jqe(pk-@K-B&^92lTn~nt0U;A6R9q`7x8|h2alKT7nNpN z(jYY(=0?!_@9F!5j*rL5npQO**ip18u$cMw{Y=;#U&y@b zZGsI|r${}AoAhFr@6{OMiSO6c--J0M=fqz1Xa!EBJ)YC58EnNHqAjDLG-65+`1sM{ z%$2o0@-hKR2j(8SZYr8ZDY@;p1{8r#c5mCMab4jTOX`-0@;JjnjtkV&!wDaB7KTya z+v4ZU?JJsx{}q|D*1sH$6|cj_U}TkR1jrj~Fo~wcF08I5Up&DzyOi+{P+%Ze`4>i2 zEfm(Ma)ZqMcc}uF73Jx|oLS~q>I5E%cRBcytBg_QZz3SPE?G48NxW&743Xb9yGOcy zWcxyprz}P7K?Ua*(iVajL9lC;_q$^OnZc0;hf&rc;u$|0r6|hekOk>%=r|&JO~Z9$ zU7sbcRY1JFk11e*QTUasl`?gn zV&SidZt{UJ&HJ%ot8)Vj-%?jq?x4B>q_g$!t-6n4W*So3aPR7`3`Qg(w|aU;D*hS- zzVB)r+SPl1VP+|t+Kjq)WSNxck)l&wfGR)A#W&sx${OHpeb#GS+AWaUw!|xE?{{w2 za18S^f1+6Hk@0O~NVAC~asAdFRmP%uUP>||rc2SlT&>{J(e2+5YlbjnXmn+6ATn3n49QmOPdxE?|Ldnwa^qxJmT(I%X^0ge_l z(sz5hBJN;puXbSpafUF_bnlXyI%o)yH4mukycV>@~mJhkInYph1#)! zwo~+G?;X+A8!iiu*SYC8ZZ~wM%%j6+w|iw}E4WvCB!(f@ZzXHdLWlW@PC}M2&VsBMW-*x~Kye(C0 z{B7$?%|tX&-OQ&aAaJ>GEa7KxU)B(QrJEI06MWHClKWc<(eNv=RRVu6ls@bb!3)S@ zF7&z*#SXt1=SvA|%4eJvgTe;pyxO^5=d-~O*5%fwzO}tHwxff0MfTecSgObo}>)k zRgLd_%y{oE`E~RIaFaK7i^>jP!d~1mxKN&1qTs z{fCK3$1v;3w6IuMNVL7($(yb=n1Mxey3xO3Gychx4051^`N&`Pyw)B?d9;Vk?2UDK zJHjjwtw&B6_;A42e5ok`<=!r6wb>V8JI3!B*Piw>Om{AV@xcdWfG~j8MzWeS6x5O* zxBc_&@bf)}1L{u>W2XcM7Vq&R{OR%WBzN0oO#3B!zms)XTT%HX^$?AY4m<36n92QFp2!#?z+;}U%U9~%6DwCD{6yW+kM^JgL`)uimphQ{1lHrPU3SV#5@3*$zU2v!!yQAk6A9nmQcUt zC;E$m+xLIRiSUH^+`>hOSeh&4LbUxdHJZ9D?ENfII`MFN$GksLIgIq?&?F#2E0aA^ z&-pl~{yL3r#_NQViSq+B4JOTO(_rE`lEb<#ciu84hN*g1^Ur&S>;sJJ$ml_qoX=17 zVzna$Z=CkT8;pZ9-8SuvYoR_k9;t+SepSXJW+H?#q%m+& zv=Xot^SYQDAM$7=TmiKhrGt8eE$l0-cv-HzP-y>zAA#h6yXbqY!X^~ z`?K#F1Al-i2O+ET#oz*nWB!ts!};|4#ZGfr@vNn)>eUmau8Y`AtVt;G2{e#h5$NX~ zh5s3_NkP&XpLRI}4V^66&JR`ARGG=I00GZv-LrUV7I{E%M2eJo4Ryy>3z8`V`-CKp0i1I&jAHZOvvOh!h5uXNEKWBfgDi-jgj0C!NvO=nvw08jP zmRANun$u{~vLhq0VkTWfS1VQpf=r~bTcKFaBZ#p8m~A1RyDE|ky!3E0`SK8W}L3zj9?n6+<(GRs77!I=HgerD9ln@ zfLOe;L^krEZfOGn6G;+6PKswRf5fQ`C}q7M8UhEo+0w$g@mEE~k(Oz*Mt39NV&7-YD}j4=K+2i|5rsKG z^mqpl0o|$Z!su3~KA z-LvYPZT4_USF>toQ^G`vurF)nV-my-YnOm0&I9sifsE)Ofvbg(po{vtX&rZJ#*%v4 z^$xz1PVA;k_aD%R=jqx2?lA%2d+RdC00_A*V}wys-hphsFEOam zbG!gKSlN!XX08Ao*nWsJ&XB#E!0=5QfJ=2$Tp`Sm&G)||0rsG|4?Lc24u&y-8~||q zBJT@J=~rYmSXO`cf-;S=e;ZiG!}`_65Z__A0YG54W3*qxdr&=*ThT*0Uzeqir57QN zXNSU5Sr33(d?b~PfTXVpGGCPaXkc+Iuf6 zaMK{8U8*TqeS{AH5gy!pk!X6Cyq`SFmT?S6lI(|hs_1j$J4RM5WHRDhA8)qKnq5*Q z4v-Q7HJTL{O7^r(Q0=shOoHJh0PPtAo>^guMrAyCm@&dtr=(Hd&b|>iCdG)_36~21 zFs1VtZy4G)sLiWs+YbLQ=j*X~FZc4i8BnFtjKEF+Nj7y`XssiKP`lrHVNvO>V`&Xo zLtu9X*!1^Hz)py&YsXo%1Pp@R9AI_kj^^P+O=8W2gtpWD*j1b!78q9uuLFzc617+m zpC3swsWa8eZCyr&RcWWK5ggRgVrF z+aa`DzZt8!0N%~- zou6clwg5DWH=#1x_J~uQT^IYsVG&Ohb8_{B$%3_AMT&WD!V4jl*2dAur*g9#fqH5~ zc`qR69tTc&lH9kUc^~6c|BEvKsgWl+SPuena?H@^LMg<$ehwr~IkXP9yM1&B%!IQXf8!J}-HEaXNyMagu67YOII^ z`2iE=KkWE}FGK?~KYDBt-9I|X5LQHo)W!7fg#Wak)Q+>;F)rFT;jGKp2>{}YlpKN` zo3EDK5Br1P1rxs-OEG-d1>Q6fz>8tGrZp|t25M&+`nzyQxFKa%P5s%`FAS3wDgl4au^2LI^U>5uyfJ^+En8kuA z2E#gekHSCTtVk8dsbc--LyM+AVVGHjSle(+l;$WKSQ)qAAj>cGM9PX{ zGUWEsqFaz4<$xC~wEMb5&6!8P)ne=r<}_%yo{C=PDZBgTj#XGD0U%#wvOGu;I0a|? zEDF0d9EaR|u~v$5bdzg68$SR@_lUqiU!2W!=mLN;RfC%k_+6@4Sla+sGj@X!&Ujk> zD^hg0e2!c8+_3})gm^hxE*};7-v{;K3uKmk5^a@34jevmwxP6Qr$=l7*K&3!kJ7pB94j-Y^u)4gPj*4+-C&$;ygdY>@F8#=$Y zwg^8dL*Gyw0Q*US6ofxuu-TR40{9IE6Xy$l#%nkthFpzL@0)e`B?YB8hTj-kw{&a% z2V)4?JwA_O=}gncnHv!3`sVUgO`>jKt}4%I`MoxPxdVcI)zg|E`zMWnFda;J#TkKT z^lH)e=W~S-H|bg$3T?NYoYvY)i2k(1NwlB=5T~nv)_vLL(K2wVxbVee+>`@tm5ozq zf;J#B*dUfM=RIn$8Q4Oxg}v)ub#BlIHVXRfYZHr?3%0@5KL8nhP8|uiRV`)Zijp9k zEm+;uH3slfo)l}gbk1+FP3Eb_Gro}S0&}nqzk9EbLJ>U&FiG8u-aEQj^QZ4=Z=v>F z9mzgSa5kaITD}NAhlus(03>ozW29E3m_b5cT*AQ0CZZM06GiR3>{%xXXFBlG1;kpU zk^Q&)0-#wSOrmId8HO3{E<2{jw^tTHFptTc-o|FTG1SY&-m?Hi7?t2&^d!e~%1Z_a z-bpV)1aG%zeGo~vBjU{C;7j|>2Z@prGJhF2^n}$Wh$cZL(MOu)vSYZZCgnpM+t{TMEQG z-fpD)F4m!4Uniz6b{j99#p<8o{|#FH5d)Y0j;e$F;FtPlx@l@33#_FG6L;A!N@okZ zwZ3tn7;N;z%6t@r!Cqs>yXRe~8Z1(n8Gh zT+GsHV(1o-<$P4+v}&=abztAKGbx=^SEetOTvof0^B^ZPA+ez&3z_rl7^q4JcA4iV zI++&mJg5GHU-$>q-ZV-#o;I!urB+cLhsW0nw|OwsQ_E(5jSK%#s~D0m3!VYK=+m@D zRX*<&Q1hYd*XW8Tl5@=|D_*y(QC(451#Yq4im|e{Y@a;1ExL)ZQgm!s^Z&tf{{F)=RCoYyvDNY=rXPd{Yc2j1UchkqnZ$^wIPkw?Hh}tn z=2Lq)c92zDK=eNdYz!DCO4f9y#(GB0YU5@1soHeAE8|Ot2Y~a{^isn8D|z_q%s>o^ zE+P!9>X`BKT|jrA0x3%gN}U1Z596;VEfUHs#UEcGZcqI zic8Li`HrYmoEANaxOXAZILpT%$3(yqW8DA@g#>#J2UA5S)>1cl<+lKbNoC0#peTe~ z0I1;Vi`L)b1Ag=M0R(lTDo_wcUiJo3F=q}uh9aQoL?=kh~z%LbV54HZhQ4=GT{I0q4YLP2<#)H92hVO9tGDR z$7WQRmZ^IUFx5Fcf~5Sq!J8&PHBQM>Ac+%b#2Y9tNwyvn$G_MEim{f$CQ=n${}kJ$IO%t`@5Bsl{2 z=K`D~Ps{!309dU?g)niBT7_MF*yeW#@w$si;P?kD&rKk)b$ltXLtg_)W1dax4NbzQ z?W;k@*^-pEX5EbzLApA*6HyQz7FPWLsHHLoIH42Hw&U-$csEI!pE?rdk^t&>-blvM zYkuMTg9k8s3ZOjmGk_3JSmw@oGX$)bb%3$<>E*o5QLJVvJ_9#DQg>HX6v(+5I2L&? z0|`1x=HN~$k)XqrQaEa`ZyAn%P}~DH1>Yu5;kL*(g8BbiwTJJJxJ%|;P3HTD7sh6V z1D%fb4C{}wl^2aW0PSectrz_!x>2egb3Ib7zmjoQL)#g?JBAylDc$Ny$`b-WXjoQs zC3pQ5<_eMN`(wJ5Kkvdd#?PsgvIkcGCRQ3a)w+k5_WohOgnp-3xZFTXM5V2J<_O>v9sl`oHkPs3IgSzI4)DcH3hr z^SvmgODGnpfs(ft7awEF%^a5$jMc(IHgSCQs(0#&NV{qnkgMQCmL5pyBP5N6)Tf@+G}BdP1Ll>hLUmRvdQr3qNZj27uL_dRfr>>M zd+p1!H8Oh@W}RDCx_$v`y1#U7|5!}c_?M%qtc8wXb=uWbS@L{0fDCAYgcOGIAjus1V=HXOY6pK$#z(<73%1nK|9_;tWms0*`aP_Ggc2g%Dc#)& z5(Xh6-QC?S5=w(0-5^MJH%NC&BhuX+|GC_I|IXQG@AuRD$xD5%C)S#4&T)@>jB%q3 zAjKyxqDqw_c0*nv+gqCCil|wt{MnGWg3v`fu)Z_F+M5jOpuNmWF++E!PNE@hGS;CPir@{&{f06T<)x zM!@5G(Dt8DPr(mU_NOw=3xnF{e88kO3ON3lPuTTiZ(rBs?SrPNoCpA`F_*PdkC^LO zG(bZvpsOo0uc(pF0~Eo$j6Ebh6uW)Z`?^>L9tV(dZRz}IP(=KeDM@opQBHA5^7e~9VqAX6 zhP|$ey|bvb^@77l{cBM5c)I+5Y(IaUSlX!+L(%E{H^-w_c31^j<7le>S+!CJ)8u?^ z&$2-$nWmt$htBiSqg|J^q?lbGVQA_|!V6+DQw9@Z+?=p&j}~gIle&fu9Fdf4*3r(yX(Iv!>SsX4lW+8m9vJ z<&~3`jhZoiZ|wCn3U)wDhS?#-!FK+Ai7Au^B=pQJx!>5I?2us{EomO$p0!Q_a=4x@u<+>V1#uBZ~283~h52_CiW%u|#BcZVF zByu{xJQ`P2D+n{Ym34qfR8`BG6?cAG^7sW%;xs;0XyTCgf@+J1%yEHdyp#4Ew8AHj ztD0^YOZ?^_5np-O)l~w^pukZkFx@bOK<;Y1)64$9vH-xzCp)R(q!G6Ad>ef*c^hzk zjSG4yr%;`=QKo=_%sKYv_C`nR1oX2w8*VSRHcES$UIQ$l$(d95*AGB;hx?(~rFxNf zI~6T91&Coy?-t149MRN89^`xr_SDtMWraKQ-n9Ds2TMK4;Ka{%0l=<|>?0vt6T-l_ zf$;gFPv7ZUzjc zPoq5mD8$>@$}F@z*vLdFhzdDNvJ#JiFiHb6HW2O%(o+b}g`;eSonnTKFQl;T&_;(H znF<}$&+#$U@3+q10yd1HvlM-=@ti6VkZZhImE7+0g@DcCD{GiIa??JZwHq{$mlbr7 z(ThZy0?g!`k6{mOcAp6oP!0xOd7nV86DE_v^2hI?oJNHIKCbpZG^{a)OFy?XUq>2Z}9-Ng zKJWt2l{VAbJ}942x*}0tsCj;pSq5A5=}WHeUnh4f%w7jK$rjd0K;`O*IV4(INAO*oRa@s@GXs{>oj{HFm=ighc} z+{jh7@C_|kRE{Qqsh6p5yY`~ZN^+d0of4BvK7qj4+Kgpg!QGyA(uM+mcLSDWvJ^xvOqjH7j(lV4(e4hqEZGb{gV@t7xaA9*6pD$J zzsVjg;>iaU2Xef?*Y4c~=y(&cP^htLMY%YKoq z+{KTGm2F*a&!MOdEDt1&DJ#+a?PH!Env7~cY?l=TVx3`7eYo7H3V+HrXD|g>cUE))3t;Yl4)BoWqyNd94Rf&A9EO$!zSa-!b<$55Fm=V6z4-~)E zD|lPr`!weTXs^c_V{~I`3U^d!jh)+pZSx|YZki7?GL+tM7s(^L=pNOoa7I8tq7xT`1OLdLNX`+1%!%5i3aDIe;2;PH5K`F#)PF{a49) zAtzs}qb)&#$BV4(8U^@SVwdFzeb~lwKxD7F_lz05DpZrUu-;O1omkNoq@`k@fyk~> zq_ksDWl~y$c!rSKCDqJd^%!v}pz=scsOo6Tbxw|B?T$ z4y(P*O>pz{($LVglO&{H~J~WF=Ouhs4Yzm7AH{3jIco)We2puJ~9TQq+j&f4M6Qi*~JZ+y;F3?8k@ zIjvS9hunWxXfD;UtneHF_V{AYW}HWbD9#OuD11p)$0QTsi)DbA4+ZokI`H(@RBI7Xe&9e4jr+OR)cDtTp7|DrRZ2 z1;BgcQ3}va9^RtdE~3o=L3_k#yI^Qmuwhh?z(j!P;1#+HVZuQP5)HG`G4@Z7wj=WM zC=2%Eq%Qas7kB|ykf%czqoU93ywooT9{K}|fK!gk+b9dP!SPSB+H?JS4V<+GjX*RH zcUzy)eqFl86|v+Iuy)UY*z;Ux&uF@ZvxKBMdwr$l4)O4uZ07oIm5>+^D;ala-_88* zSeH95cZ$~~R6?(Xl|dt_q0m`2@a)&D`pS%JV=2$4!W*0LzjQjOCCKmMDNqX7Hh_%w zL`5gPb>cNd>@r5)^)fe65|m$r#jOKuL;;R)*X}5uyExGpN6>$K%Q4o8uOeT1m|HUc zJ=itbgj!krcc&p}>ga_|!&ePTyOxvnnq_t$O=iCbgP3^_KT9}>yzrHt&=*e^Vu+)h zaJc=6=CyA}?hxO)H8Hz%nGbDMv?1*4BPozJ--heKIB)!xEsSt}udL9@-%^*b)qllmvY%is5@rca5!WsVW+Jp}dBz__9gLXfMZV01i3l^-?}UCV4V} zp5LeJ-V%NYF&t`d6Ps`C$&YlpTQ}cHDVx2pVVE~_oDaB$vwCzHRZMy))I5lJP(40Q zvBmK+|Mlve1Xrz67Je3Q>#HFLO-(za0qzhpuyqLju&5YU#CoU_L5is{OMv$-wtd8kTi#wS{zbJK zwtPlyD#)ZonydnRaW8D-W8a4{^}6rT*PH#;)|8kzGiYaUPR=ETb~A@%%MqSpE6LBE z1qL$pxKLJBl3L>gJ_@)`l*7aN6Hmble;liDM!f1-8H0lLC)Y0hW{_-=#*`(aF9aWv zri`$#UIuA4N?og!*0^(JYRQDhyZ~IP29hPV8^OHXEczIlv1*B5OoWyl$ISO_t$P_F zV|^DJ4Ct|+SY8`e93E{p9`<41y{oIJ8d;Um&-fu#Hd_-!*RuA;lbka$WfLjNvP&Xk zPnLei_D_!U!We}sNABT|(arpo+i6VN^+liWOxEYdICh9x!^@qH`xkZ(Yxv{^s7p!@78 zk2^vf9L>nH?7wQPKkC{UCA9WSwOboW-5pKJi6OSs_P`*~9%1(=jr@3IWaW?V{He|z zT=i4Y0~vij;y!DRiL--et$=@sT-Y~0lGo`v^@=UVLd&il?%r0N@*ch!E#o~|NHIDm zS_#Vk+Qa5;K_Akn`_^>NFH7hj36En%uL#-mQ*%u%*_sr~xlYuCk3?O$GG zp1jSd6*WPc-~Z&`*TS5?P~N5Zf?*c?~;^ODe7K00&O=GIb! z#9GL5wlY)Hj;?0aAYM7RWry7#WG*5crs}!HLJTyV90G6YSAB>Ud;uLiF}bHV_wJC!YhQRhkD$Q;s$G?zP8S!Jsz_ImYBffZdLA%K&d34<)YV$pqTpJnNeZ0q#G z>!TBOm0L!twJO1FlMW2i0LbuORQCt0gO zqDqreExn<24M2bash7Q8`A;dmfXwBj5^Ia?tkFGb4mcGOssty7$Mfi?)q`D4VbR0l zk?xdX36vk-|FYg8hO;UpOpeg$5o%x@c)XK1vpBg`DH1nHWEL-N)6eiNYAp_H(4_D4 z+9X$MZ{Oxmm;Be6nlqK(i@22g?Kj%#EjDCRDj5cRja?i~q<7F92M^XoT(?$Hx z#W{NPomT73Cp z_5PAem-4=4$H%LDzXxXWi4BRgKRq?nGt?^k_qW8jXk^uZo|d;1$M&Vr7K_TSP<3k! zMq#mC!v^Z0XY3%-jjC6PiaZmma{UI({jGJ@$L z6u-oI!<o$;B=KpN%ab;KkQ8GUz_F+#x_(9UAy8KBh&b&ukD7)TV>kfH5ZbW60 z=Bzp^+6CMfmD19UOi7%d%O7p23_l5(sRqfP0Z<++PdlECTa{AkSf*KYLnn3)}G)96_e=e8JMN754p(1Cbrq;l>IldP8{db2ZKDG#MH2iEsg#<3-JNtDP8Tr@5Q z;=9o&d|ryEjUZuIbTr7d4AI}J^RWn9q<@|3nelJ=D;p-wr8Qt z?{aovN=5|o4@1q$tVGKr^{71p`}`F+ou3dT-XSbvW7`}~sM|?9$#?$p-Frlg-A;4t zb$7Ke7r6$6W-qyP;_sMS4@u^6^PScRB$F5%$Qthj>=7XGseie+^S)MoFQ!%4jIS*~ zA%*0`_kThWmKS70q2k>6QCZgK=EZ{6VS0G+swQ~!56cJj%VNkbvWhP` z%g2Sub=cfwJo~;QFdMdZS9zBm1(dFy#!ldpR}G!v5X8)(a3u@5RILwO=U5r&F*&{Pp>Z`rYd0pA zA3SB6;3Smi0!)dbQ8ruS{l7-IiF6LnqBOW?oTb0e@(5MHsi9ZhDmF|=(9;Yn80|Ix zOlifw!|GQAlVaH$W>KwyF%9M(lPZ0mT8OtO&qhvhUX?KjZm5GT+teGATTOUeo^)!mA3(7{ zei^*yysTnfSubqDzV`sV;Fpl30NJN|#0xa_D&|kJbiHilt?84KoDeQ54A6L)dQOHSRKK6UKs0^}D5~{k|KLuKL)h5iHL%ysNX5Sc^_WQYAu&efFa{ zr|Jr>y+7Xx3%2$f#>$ub1e0A#CzQ{I+R>llX&T-XOzlcIJV1l5suuj1ptXz>RvF!o z;4Y=VD5O?Dxnp;p(e-^o!f|U>5SehPlmI%CdXTxh}{BuOqN9)v|KuHBER_ z8V2lqGo53O>})0x8n;YoFP$^Di?E_zt4@TB!VOH>1~WfGPVHZJ^imjy z!Lg;qiwr*TOUyy-j{7as#jV%ZM#R*ZNc|$6kHAj<*=i0w;$>cMG}z)Y%*gJ+zI@`|7dRCx``8Olx{?zzeShA8A+mzqPB2ElvTW;3Pst(986 zs)=xSj?!%1l)IIKP9Y7Edd%aV7V0GLZp}OqrqJRAGp5)R1yiRaryV)hVaE_s=sf!m z+0T#Dlf@w2?9gk(a(vKLm*bwcwVI_kWROdqLO22~!n_}Qr+_~=6O@@c3tKO5kZW?D z*xdsaRPPxcQPe>k&>^tPo6?`gxP$gKdjd zf++Sj8UnyS7dZv`*V|{zwd>^BI>LR6y%B=$w03~!Q(VR|ndV&p1P9&p_r`&peOk4S z4@d@sLRa~d-F2!B9&Z*)fx2{MM|(l}5Hep5LT=il22r2nUqD2+bjE8W`%~2d^281*HXZGNU?kH)u7dbg$<-Bx?2j!W}uct?$lfDm);ji(I%4hIPfBot;c zgIwKAX2`4fD3=%2eoN&*Xl&GUHMe)T0QD71?wC0CU4Zqu6yhakz>;DQV%l+ONoXlh zv3K{{d=omg_gT>I0z?T3W#tvtni?uzY=h3WZnH+V4nsjpt^}2{hUy zSk~tBlKL2zZMvvI6)3cL%qzgnWF#NY@k~5IK`c$n6q@~|X?SZ#J zj$0;>y>k4a^RZq~ojYSgLMv)R-ngd+ZO8K1BH%JLNb7_Q`Vt8;X=)co zd3)!sC%YeZ3z3F+RU+HtrpB9@grV6|h~qrKd%X`@iQzg=YXCD`2ARM~q(*Zfbu8L> z+{wpXX0MANwV_);T`P@MfR>9saBKrflV727n-gT(PTlYi*WQ^1oI2ZS6x4)dzirV) z0yN=kx=qm%m`HHbn5}T``l^Vb+FB?UM zgYv7lP;(X*U*LhWP>*&EqRXSahd#*?KAt^(OTN0QMV9BO4BtKA=a+wmJnq?tEcb)# zRSMa4iyt0c;}81LOcHd0yV}Xf-q6DDybH1yZW+=RkMeE8^pKf&3jrnX$sF~qc-^)r znfy^05U8}Sd_Hr5*z!|wiOqqdyq_VkN)}se%JM|1D#J z7gAV#@w`5e96Sfog_}$8%$vWtKVrC!+GQ9r)pH$l#;xWn+#_$M)a3N$F7 z<=m~VGz#jW z+n%v_B{B^x2%|vrAHLSv4SHuww%u-ek#9{vo`Q_mc^iqltl?#=x~b1tSkkEy%a)>6 zEZffo!fBaWz&57`781i=Nq7twJPas#<4*m9kKt|Io_2u~wX>t^cAiss!}>)sd0BpY z)}AoPn9#>aK&nXu#4Vpk6!D7M&KZzf_1@hD^KE`>q-sQX-V3a+dFtGUsu3xM3)s`6 zbV4D?X=)3;5)SKs_Fp+9L3CCX@5})0n^VMR28!}VmB5>LSy7`<@qKo-O~4terwugR zR(fEO%?&3nf&tNI0y?2DRHC1j!Cc$`7*r@pWXO3^4<6&b-gMu`m|H+Bvo11YB7tlV zW&M`_&<%Q8#>S!FeGh46VuC#z?APsBS^f_;XY<<;+F|-y5U$UY0O9Vy6E#??lFB>~sXdYdXqhm}UMDR8yK=Ys`y&zz`gXB z*6PiqiU~cAhmlm(M_wkpY>)w{&p*G!~J!RPEshKX3g)9ZwD?`LNkOQXcr$N{La%T$%j^VP)5s%3N|% z=1Ff`@s;TvF1J@(S0@1aV`;X^+#bPUZaDtT{ouhNkOCHs=V!T8oNHHf;KO^_>DUpA zQB^vqNndc1e^bCY29naQGK|DFI!t2N799FVw4o7NtBAYeU!xjnsL1nfH)Oqf${4KQ zmfoYi;H0LpQs%Hg$vw-c$yb^U3zA6|bUq$uWq7*EwykhDOH;G_v6aN4<+XmAAGR$r zIddq@T^A_^GqRN4Qu~Asm7V;+!UE`a3x|M6@eOdxWHN%;0^RtVDdzWp&FS`o689yH zfw$8KBb`H(AmUei#F%qZ1;^sto9*nK(b~)T;b!$RFZ$sp6{WyNS{aY{n&dj~E)Hkwxy`ynZaeipt)+{OSsZ_1p`wPt zWuCGPHP6g6j}a%3mEow=uEYnY2f3?o?*R2CU5fQL?aPHnY81QJY6AC*r+*o|XFGyA zw9Co^aX+4sHP_;>g=1WwWkwnmt&Y!3vVQvh>s}ZlrreW@@jxbGLggAD22Ua`tfP_s zNND@%4r=ql%`@;88}|vJV+JxLlTrqCY)_O{7kbJ9L^n1X(pZcO_uCh=;}?z+t;m9; zJ6xHQZkA)N74_x95aky^_uG#z+{0A-MNCgov71~B=99ijdko$in!&Ylq zaC#)R(vN1&=Mhb#Rk`3J6bg_=R*L^P*I`g68;AI%WfFqKN#jrPi?jiWg=oivoHK^G zbE>gl1@3=51TSfwfV_$-a@KVNQViIdb0Zb|FZqr+ zzRVBVuAEvwI;fXe?Lh_w4GX2hAog{dgnYZan7~)Yz$$%FaqjE)`Mye~G6B})4x!n& zLRQmsPM#uO6zvlSZ22yc*)>hh)A7mn!;pcv`e!yJG%ZMH&iOpmR7%v#cGfSuq-iRZ z^BHjC>L!oex7~<*mYp@>v%yZT*_zjqzAoVyMp4+1-_ky+4Rk_h0p4%)RX(EmW4{|H zsKqXs?)^wU>!XqsTzaFB?W{JXoJMhae{i^e?3LELUgr}B?rE$&4&bk&Q>uufSu#=3M{#lkkv8`C%8z^$aBgqNC59bfMfStvCzgM;Tjcr;6 zgCaYFSaoNFbyB{}HM!QiMHPSeH84w%Bjts)wIkMnc=_SU;57TJ_)7r_HZf}&2J;AO#>~5y)f!x?Mc4-M zL?!yAmBEb$hneHP)FRYu6R$jy79j!JrI@!k|Cy8DnIDOWxpT_?=WjBVoKn)Sxwe*{ z!_&6$lk7oMViImJMsc7od7nO}_pcW;;bgtZ!%Ha=H{&K+@4TwWW7QcA@`^6gx%C_I zZ3T=P&zFMY_egK>Jd`vF<+R?7o~}Aj-+&AqN)$H2t!N~gF7C%p4*FHGm$?fWGP55p zgeA2ZqKC%b*7pvQV3TxGVZu%#0$z&mktM4?LPWlc0O}~o3_=U8ezF33{>pg zr0X4e7h`f3&zYedVto-@ky0uAO>)Q}I`N(~$maJ)Bgd7(#E4dffkB^&Ev4c4sj8Hz zXWf2p?zH;2h2uC=)rWOfPENBGUv*i2^%`IxnY{ecSEV}!*Kx`?vsy?oEkNQh0}H1U zQof@zLX}`XLf=oeWK(uar#KrBoc4IiQJS~~$LZDO{AsnrX=Q_~ZmKl7HaZ5$tR(Mq zBpnu2b*FXT(=~{g6tFc_x6`-ajHDPx;#SxHoN5LFV4TXQ-gTnlTl9L-;oka#DqCEr(>3MFYeP488D z6}s6k>JHweIxFoPe@k9o5AsAnbHrKHXis==-0S>Yq4T4$#ArdIaYr`MMb3!@(rmA1 zMtC-3)oiJ#`}x8PFNw`}T&fpBl1Y4jXd<7S+(|E>2Lm#{44jrkSK z9MD8=PEgNeOa%Qr>?19xmX_NOs+0&1?P7NO{&wJf%zZxCMC+nLCN21cO}2`{gaa}< z8d$lBki#~%4ob<+!mOarDTSZNcWd_=T7Av zd(Empv*EP{dt^FO!E=uXq*6xYrr?QBo*p0H=VkiPg-g4R-z|$5|E+2w;_T@}VdqVC zhedTPUkjcK8M;MHEIEq;*zFd(cz5g4*5Og5IQBIULnU>ew484Bv9`VPPba`Yr>W0( zVWiuYlhry^DzBPAUrDUQoN03vg;`g~Zd?yyVvs@RyP|P-dPMEi6M|9%1UGW-V(Pea<;BeD&a;KW~6<%0Iq;iT$mqey?F92thQ z*8x41fNvnJF+sO%MB`=smpwZN6^%ci)BE=mk_<$&H%JINXD(kY{FtA>8D~)P&-%hw zCt~Ka&=(aSzk_m%t-({~EoZnJ)mU>4`toujRuL@h2`2qOtmEG|%S6BXAk323qQThE zCp6eG&UU5RDbg#i-rS;4xJmlq@nsqJR*_{-EXpif8H3>}+xm?qb};ea$L%4U$~%KF zw}K@enqeo5HA{gil@#_yelDb_smtb;EM|rgTf@SmTXuSf{#}mxn0)Fmy_m?-;>aC`3*pG?j0cY#@g+@nUc6fjM+k> zPAnEqVAb9v9@95(zBj4++}AGX{Rw%^Wjam^QFH$I9&EMU7{?!nKJE}=dHy=;diF-D zO+G()d|?gJRb#c5$B6>MY^@gN)0oQfnbou_&cKX+_!hK>#8L~i-}$U&a9N%}8HaMR z1o9^f8tLftf6EQ{gFt*{2RA(}S;ea+_cucEufMF5K`}CFn z_O8OvyOPW*VVpde8s<&uAU*IOu_^lq_G^1E;=(5`5E&bOYPs@_5a7MWU;?{r&c%tVpJHwDPn5^QYK#kcGwo0!7u_gd(}c~ zVL53q`^5xk?`0vk)FrSWk3gM%doao-3#4UMYpK42Z?mj)0cs-|$Rhy_hZ>b6@rZ%~ z$n2ps$(yNO0i{WLtmpsx?cq`2evb#67`cCz@COfE2J+D;?;s6v9PL{dH7ii$UTY5B zfXNI4x5wGSy!{~4Vdj_TkPXKQ@7g%BkD-H{C+INu3tjKG5j!LUyOfJy#kp7l(2((E z|GETtaJvtg_H>=vC@h*pR0EOLG z$V!j|Qpijo3k)>Sj1OcIjsSweVDPG`9OzoB+wHrb#z=wh;y4X#vyrq>CcuIu1?Fqz zViW>XTL6^q7{gS(2s3yEu+wd4=CVpdZ6Q#d*aLnx3y3}WK%rx@0rD-Rvg}=xAd3{* zE-;~3xq^>8yk_WCtyF|kF*mAzg}#R7_e=v_@DqzGh|L0`?`8L1?H>hPceiIvvNPso zA!;RntK2&Vsyf%Yb=bF4jrU?e2`yYu(t-b5Lc8b+d@x@j^ZCVocAwn?*3xG7TOjX^ z`1+5%%7-5Yb~ydFv3X?&(1pE#DB-DU)X8xNi$=f;Xq=Dhi$i4uPsVEec7asfE*|*# zcm~Ua`k-L;L5TmLKdez&Rmx(@|FoJr8?MDDG=9>S9V`x|Zw_v$0+#*y0*E0i%mHWH z-=hnD2P6*HyaP_NxT>7Xnx$GPt!?1_8L$Gv=Ay;P9y>n;C*akxCoWx&jyzeXCi08< z@7xwZ|E1DF^dFlaS=^I|0ii2%x7|PZzwSvVTeQ4IAb?rZ7rs5$a|QL!jr-@9R0nzm z!pag?bPAIvkVgdsJn%!}R1=`fH2x91aJ|ZHdC`Kals9hBn^f%bxDUMr|XJsAUC>x{KI<27zOMf%~*0D7k^Ltl@ zFaOD<{$sCf)&`R`48H>bJEw{@X_&7%S{NJ0Ne`5T2+SxttZ@WoTDPF{)4mNEU*4(f z&2d!C2i99^aO9eS$NKduU!rnRpu(4m@7JrqCsz*QfR#9Yf;A@#63kqZmCT5&Jj<3} z(!@dJE?tlg_YC1ljJc(nzCj9o>@SC6AT#?ap*Sa_&$&4)_df@Yx3|x4PZ)la1Y}w| z#O9r{3IU2}EXtpB>IL^^YSpWP-=e-|nz=YuG<}ETor)Os-3kO_N<;B`kU;jcIF}5B z+UQ}(ZT7y#Xy(pHF|-wAfk2VbAnmD;BST!rvVJ+Eyd6uwMujQTbKK}v$R{=Dv~XAE zM7(c1)4I)vL2A_=vzj+i~#QtaN4gT|@dxG{-XkM;XNWQv0 z8&@fNlx0&hPHuS(b!XSf3+qQUGa3aP_&1qfIN~FYjps5|bMhRJYO^U85qV%j-~Z>2 z;J0w`Pwe><^x!bmn>=q!KeHXlyIC=_Vp&phs8&0w>y5Tzx&Q$=au8FkvG&a-NZrAO zOcKV}%2f#t7i-)6yQ~|W^&sHEXCKho#*dH6_Qi1z8?lmAwt6oYL9>RU9)w#(tIrfE zo|atbzFh{7>}aVn7)v)j5Qbq7M|fYd8QuE-{_x)Y_)Ol+emGPE_!NJFsZI=ia#FGB zU8Qy<#PV&b@_n8*P`t{+V361RB{+f}VMudC zNW=lsS2P2qnq^H8EE5<4^|XqpGWX{U{yR%?dhe|XZ77X4HwC?55m2S}W^6DLip*7G z6A~6vPO7eeAY4Uyj`f%0+W%ZK9vDFq?<|hmo2xUlM3r9EA#xmyEE*;=!J?W~d_jU! zu**!IG=uFp5#DIWLLse$Cdu(C1?-PQ zufG7@s3DXnWu+cI;|T(0P^Oy(UV|M~)xM!;_{~pXjYWnkM^kypP{JIlk^12FVhsT_ zB0i2TRw38Z0>b;4{wM_4AS5oi7?@&w8$GTj_UG2UEBe5}nj&NR7*sKPg3?J(+PUeBWGoU}y2E^4w@W{BSq70shp~l2zs3EMPKS5qk#)ny8 z3;LR%qY{gYJk!n|uPEgMoJLZdqaE)Elm;_rS&H)xda+O%cM|)LfD=4JxO{w7_fY%? zg9q1FHWBV7ljtwf^9v(KdH-4Re?9=m3~(Kf3$%6DMmvh!JvXt2aRW?CiWSC4< zDi$^3p}^3m(!yh)*L~Rb5sevf+@qeALLwue@(Lu9jf8~9ub_&Mi0lDB(?ow|{8xE@ z9ex-8PH;HB8$2)&EFf|jW7rE>`m&NIr|$L7HI%^&^M$k4*pzp54J0IeqhE$mkcw4) zAsLK|p6qpd@nbPVfN-_##P`k+SFeDvNl^pOe`gs_lXvgOfPm$fGl_%V!*QCzCcFQ8 za{hddyoYhTd+;?TxFNMTT~}K?|q;g7JB(W=?z$E_*q04S!DOU zHvavk90ARD1KuW|-%I}EQ~&tzS_~Mbb;s-xYt8?8s{i*r{cmFRD9=P|HlJLa&|%3b6`ueI0umw$Hvr%^`I^IQ>p24(5Q8H5@h_n z;h3Ap-v{2GNzQ8sI92(PW`$PJOI1B+!TawYq-`(p{+A!6m&Ros05y?Nr`W*@e7Cy8 z&t7-ny{T;dEy+9azt*ebUNfQrk~4Ya%aQrG6@=CF*OpLCAY^4i7{p(z8KZ9dvcD;@ zY-Z<30EA3E1rN2Zw95^cYx!dNQ;y6pkDq=x6USoV(v~0uUd$0wc9aifD@B6#Bv(Yn z=g&ZGz<5HUvGt1o@C1BsY9K|}rs>=SC|YJ~7;5hwV#s$+V`ULJ^Mw@dq!3zl&TPG( zyk7*XiBOLkOzfZ?70*NhCgAA+Tp;b0U|t%K97F%*HN?c=17QUJxF~eQ>VR%K3M6`O zkSPLJ)g{;Awcwqb9f+Ao1pBD-T^q@5YB_)hMg=4U7UgpB*c-bbzvw6M9mw8XXI)Vg zPn+iXf$**drVLhxd<~sVw#DTCKACu6lERw5jja!WK);-5aa&cpuu3TKOZFyO)s%L8 z;1jLM2zYEyxI>tf@WyhrG&6enSrue9mPbt{**7wB=E2MW(-F~(;5(orNw~BE35?y~ zgiV5``E`Tk7Ly2Sjczy$sqn^+)adJ+$%uE|;OiuXTX7@+laxHZC6qz5kY*u90CHLE zvi63TKUdy>*vW+Bq!qP3$4G!p`61sc*6(@%fjr+%U#A#`bmqcCo}&!&0-^S?5=TE1qvS+Ii@QZ<9%5)^ITP*kEjl!B zJyRhvew9J*Geznnsc}S$#Ie%>(s)R-x;6$UL?OJM~Z=5tBGsz z6|ocAA_{b}wVFKfWqnIXMLi!MZIQNGLxY<+2@l#cxjqFrJ|=rU`I!l%IHY;q-O?t3 zYswmo%PRV-gp- z(?eslmRrE_B9kjWnDF)a5-XT(FNQm2i~W($ zJ%29?2kWan91B1E0v_&lqVX;a4CPPOAPtb_G~%q1_4xR)B{~x#>#MgZ-Bpz4 z2oTn8e*es~KfqCuTN%=%^yRfV0I{l)@UVaxAH>}XfylB6x_W&I?Zc4AM(1R+6{Dd)(XFnA(Oi4qeN~+(f$F4F;fj_j-FdQF zkwt7KKu_=#xVp3BzXLAdb;^OH*$<*5^JJ{=gc`lXE&Uv+in8ruT9W}s4L`UkvbOG% z32o&@nII3a>XdFMH5iE^&?9etik&dCXT3rNb(osQ+xj*S;O(nDx&RL-Q8T>R1G|F# z;0MiMykq{t^WkL~DI)d|`wUlHjE=))rN3kSLP-c#>h!`DDk{$duj^YfCV$jc(gBV- z?2jQqLolTQkK;%4pMT;9``*b%(wFhZ?nBzZx%HE-TIF2v$N^YnbBldCFhnLfQqF%p zp6_E#9jtTB8YlF5H<(r+%KizyS4uy{{qW`ZE8R=A_OzFGpo`A=aGEz%OH?gL#X)h1 zQv~0Fu+>`7Q>|qv)J^n#2c_Z!;G82-(au5=v7?DA|Xb{NN7X+dr9YB9PCG{`Zoo0j@7y!EK%h>;pXZks<4uI$se}F zo$3H&K9N#^XFN#)`~|MV(%mDt-7lw|LIS^z3Wp=>Gs9;48+l#^0hvCq5ny%!b6`%=$1L{L$% z@z<}>yao44Ma52us1_1YpuIoujfGLYuC4mG!2|21^ox!a&TT5>tzMaPcK63`n-QfO z%tgPpKI%5$^hyeMr+vxc?;@Eb)@9(qY;b=sR+wE!TQm)6-EagIrFBJvzn4R{4*aUB zUsBqVS5~czw}v4Ro3tMoN0L+J1~Q6UYUzp?-b($c9HI6^h*c)8ea{=X{Z`;w_<=*B(vaVSwg-gQina`mz$j4oIB$6`>h zEdKC|cJRozFsL$spRX@kd)%}9E%x0rHW42%1&x2Z_&pL!EBrLKBXdXnu%kJb>$X&| z;sAW-s@6)NcCTeobYmRjbDtJgm$DB zn2g_W^sG995v}e0zU**V@YmI3&;8f2Zk4s@Bs? zfp3s;7AQqq2CBvN!XC#t?Bsq_i5EW`YXdo>@3^l@9Y$@{-)Lj7l@B0VZYPE;23aRN z7@KxKG7wWA;M8raJ6}io|ldmWZldnC}y!(h@(8d$Snhu5L)NLYaR~qCCV#ke_V;C{@##G>Uj#AT zjhJ1!k$ev;@0TSNzEbw$jy3n*Ygxxah4@uwQPIQi7_yYM+b_sFe~o2I;$DXoBBId> z4vXdp*9XG$oKOz{3>^L`Jhr3kywp;$jWdBc!w#THTA~4CPT{(qd%_WV-lon^?(>kL z?lB~8XXSGQ_DK4k`IZ@=P!GS|h|5ppH{;;B8lPV)!j^z56Z4&mx7MaoosSAdG>XSI z+Eo=8NW_xgIi9*!YY*q(i5c&an$V;szc-P%WoA;LiWU;O{XYL91&B)cmOEQNshGp8 zvhk+t@FGmjcZc=_Abz0r2h?Ut@-I64b&gmMBsAT~WIhMScP)WaQ#@7r$h3SPLw=Vd*e|3z#xJC%m0%%; zFz8Db7F3u}`Aee77u?y@6Ego%ll*}kNpn##k=}|&v~ROSIAkEfe2T5h^65<9pKBqx z|3uTE-#p|VH=RqQMhph4fixui6_e6UXq9s$lMz$P<0ut1X1@>(e||pr5Uzj7M2WBj zd+2aUHO$Z{|6?f^KYH15?X@bge$0|@X-vrXcjwP>E1cA46tZ?&5j?wbM6IF+uLWV4 z9po7B_U)ny3J=RoVDAe460qttaQ7C-g17=Wb;1ePhpQ53%*6@Q?}}JwQ!8yMV?IB*RgQ- z^l&g*o-*P4A6mx08Q0i;%D5v5P#gA4Fx%68=={2<`3Wo`xUA`R7~521Q>j67@mo95 z^U})pTz@agCD`HU%9d`x}8bUUG1L zWqZc4E;+u)4_lQ6nUII23$@ObDu<981De(2*oIO2B&Cvl5AN?+7W@M3F^V@1lLkMl z=ctNw)=qUV`tV0Lh%6e>+N3u=wT zBHf&+{M=A|8o#1a^I)L{jJ^)HTODo&%lr5XuKAlg=7&3I0$| zARnZu{RBXDY#(eN8nFP-o)CL^LdjsDD5oDA)`Z*_&p-=*7V037Jfy`Ld%v;UgGu>=?$w3= zsUV=M&LNu0Z)%^NaqYnUxOzamZ{F1{+{oMvS$CM)8^sw!i%Qej ze}7lA-+<|KX$dkc6o^45t!a$;D)|Z|$2@NX0(&7&o!sR|$>#+iiT+gvUWlbsqg2KW zVhYfIi@N+|_~EX3G$@FaBCvOR-Q>Ef%!B>kb?0x2L$C&wqXO>>qK1g?H-Dq|9lq#` zn|u@Rmxc&E!Pe$_2WUBXe)s?i)!bUpNR#BOFgCle`5sgQT<$_rtnHXO2^N(|;4&w> zRNbgP)hcQ@jn8TVF-V;Kl3(08TP1xL@7;pvDEZO)?_%4??y5N-Sq0p1|At?oLTlX< zk>lyQqa)X2J{!bQl`{~MvHlB`D{&{GwO$}#yA23v;%}kQJ&t)$U=f2<@L+4;ws`<2 z)fWN@e~&%tEWxD^T66&oJ>>Kj%RoQ63sYaTfV(ZNyI0gi@w!yxZypQ)lU8ghoDCNyr^9rs0C`oa0LYeNEX>uH#D^LPCFkAoLKSKp1?& z_m&GD{1fcZ<+E3yt0};4#&}UZ-x830g)lPy0fr$F=)b!>tdVR4AEODTasf6+mBct( z)i`}eQR_UwrEFb!a@>tfPrGoAtepK|4j_H@7Bq??Nq5x_dPM=gK=oBNbfAMbKz35` z;`Ynl@OG!aJt7q!iO;-xvehkz>)(qph6r}zT3Q=r< zxD6sU=FnZLNDeIe6MZl%vgZ5%1l-?=l2u93*lX1>a7=_eA;BG=Ti>bu9FE2nB>ejW zAc0my8oUm;rdmLBuNEo@#VHeE;Ic@}$743k)Dr+P7@CHv_roU1_^q_a9sb2uh$(|{ zVX3jmJSh7pPBCZTzMTTW7TCapmLgXs=H{Yl+4>Fg%K)ff`_Kax8YK{P$KYRaQEztL zYrj8#1ONkC^R=uex50s0Z`-bDK35K~t^m+9>h}&$eN7+!56$vVjKFIvTtYRg8)7oR zA>&R8dUqTn406JP0L^A!g2wHlMvvu~D1j`8Sv0;dr;4y5qkpXNYNXWxb(@U1Qc9OrY`0 zsQGSdD@|(Pbd)CG?n*$x`f4D8LCzlvbwXAFIy?XzRU){goU}c_lDHOLb&oAcXlf4I zi*b8A2P@!19Z>E20f{{)p7%A@<#`O>tpXlb$KD3%b0{A$Qy&^EFxNgPy2NS#xYN8P z9P3SxDn$aEE$?vBzC#>^ksYgUlwzvUp6M!YGo~U-)-cHN&Wd{*FXU9u*Du>&)CK&x zvNy#vJk?)!?``}~wF+w20W`uBFr};?UwN=m%;W4njmLos{W?=5KyAL*)S);_ErQA3 zlmX<55%?wmZjJXK&2RHV7S^{Q#EZz>thl_E+Hrf6c7xu20F1_Wa0w_52PrD^wqaXD zG>!}Q`dT_Qm`s-$vBga*E!O7mSYW7z6V2)iYJ^4o3uyiq9N6?Q7ft=99{N*sr9pp^ zTf$uMJTpfCa4Y??ns{7M>9?wpxjKKDzW)b1{5MSf??1hwiPhDi4i@Tn_;&{950NvVgw9+%xX3yMjbNp_%>^gFvlH{*HT}Q-OCl2MV!HqZ z!*=HV+phhyHBvnruhLu>qn%XiGzKT@AtDz+mG=Z0f5A!I51=0p9w|% z@Zy`BhHr%(t%7X4v5PMDLp^RTfg0nr)Bi9VUP(a`+1NEL{&+aRBWF zd}Kk#2mU{6)vKe=jZ6lhh$t5`_tPqhP;RP7m3h;0FjswF76CMtXe=(Km|!s z$Tw}1#XOn;bCxj~1guhgP~hD>DA;fTUg-GrHqTE8YJUWnk$Fh2+YIOt5~!l!1bOF~ z@Gct-5Ocfe1ZJ1yU_%oz@*%+gn)cqj*uLI9Lsjr1<{y!inSS zdP20`>fb_t=>eLAYP_W~ld))mP*^Z<dO<(EmP z8NJ;}uq-OV{?wKZcRh1CAbFX-ZS_2chwWyRNB12n;LlGlU6cN zWplZ@KhqBbzy3*VaO!;ba>S{@h(RcB$T;7@GbsZHk)@We@z0RX#9KC4pUcEl zFBNinZ#@EMYEj!u5CF^9lNQ3B*N;_~Mixpv7bGjcaJl8wI4sE1!|5Xy()KWd&vwn+ zTbHnZhb>MX$*9xEyXkp(_5g?!RL-nUcx&QPETz^V0{g~8X9ZBsJ+%Z=SQS#N?Uz8p zu;Mv16#H@u^fZScdT(*0|Fw(+7%%ZA5)xT);eOXPr^4fDy{md3%ulRo<9Q_Cg02Un zCP>?jH~IMF&d{P52F*g{%F{`#jbEx`znG`L`e3qfXl$uFvp;RWbaPDChplkaeKVmr z3>5zH5?yZ+1Ks0XgW#=875~V(M}N_=z9;zgZ{{aOhYH|NWIU5pj^lKOMU%lT-;P0< zdn?Tgn?WuNm!5!Gh~KCg{kT_P7B_7|Rb0Vx-v(5GxFG)8+8HdXL*lG%Xe2{iO;-vB zP2J8Z*ssG*D71wu5P`U+&MQUt`Lv;lLdP(W0{9NR z5iTu&IHLhfD$gOPI42I`E{zvx2z^I!3QV6TdK8-V9(Gm0o`3bhdeB8<8YU#t$64~Q zcgO0@<)j+{fhEzjpbcQL*7#!ic}%0j=D^;ku8(UJJ4yblz@YvQcX?q=($tDSxZ$k6}iK<9I%#oz~SR# zl|r?A&2>dbQI;E<;3y~3&~s2vd~B%461EWX8c@NB`lrTwH$dg~K0ed*y7i7#|EVQ| z`yPD1Ut-6~IuP4$68N*LD&tBbl6-~F*`s;ap*$w(;W6>C5cW2u;UG!zGfRdgzeo$|JzU7B7 z8f1odf;O<=q zR%gO*CfWk0QY_uHB%ACa1@xrm;o?$Ly{F~iZE6e7y+^wtQkI7F04jk`Sr#^}x`HX2 zy&@HZE-}PX``gYozRLAG+KpfW+EW_E@_sZqHB&vFN9GIX9@`RgAYpw3I}t=+|4Hdd z_sBXmQz%IUh42k=y9!At8h5fNuF>GHs03*uA>cqmNC=TO8qSuC@>sDDEAxtEGba?7 z;M1hsJbYxc2O1MB+vNPp7sH9`Sg{t0Xy zeurC7Y@%U+8RZSLu}*(3FRG}`W1xgGF~~kfn7u|3Q{eTalU4j2*N&MtK$T+y{4R1)kw_FdTFOCIzw2? z}YU#}OkwKH~ZbzJY=1&%U{;hmACk#$&A!N%MqVqkzEt~+ipHYJ4M1klAJRtLVx ziPxX~n0A~}#LQwTsy3Qq6bZx-qJAt;%sq)UfaMK1POGNJgaH`F;8LxmT_rxN1~(7; zVfRdjQm>?=$Cww7<%bC@mUScNwvl_iL5XZ3*!&bSrTU+PdGw*Af=?tDC=C*?L!dyz z0Y&M%S8sbxKNmcM+Fp_St=j2WHE-`m#A%wNy{EIxAbe<@b`8lSm9;DB+=UZ!s2cwJ zs&&qI9w}R2Hs@}D@vAJq;%Z=zJJo1anjzY}ng40X@s=z8jRKi|rIikwUtTmMx3yym zS*)I#dfU{WMI*mQZlCJE-oW|bP{kEh-`}wB_Ft>W5> zZ+A-Y6JCE2-c?f0mHGV6dC=>aKp5ZZ)Ms#wZr7Z3mC8~!@&N4v%&6@Lw>V|^M^V{_ z$;m)QCK?gs=fCJOFU$?v?G=qY$o0tns(k|Wlh-n z-QdvPT>1|^!(V!mz+5y)on<%CdH~c}^5ItzzLQ&HVDej&tB%4)E_^^VIU#T~W1DmM-kQzm9egNbmTb{Vn1v=bJ5drM_b})6Cjk z-L4YMzxU$ok||{=-Adom3ODS(emu0t8r|>>HEww@7HJf`!jA7Hez~gb>PygG@H*+C z$Y9NX3j2Q({)YB)hPVnb$zX)2O{_A%VI0t@+i$YR^%643+CLMkWl^OR`leLih+*rr zIDGo{f3XtK;Ur?IjjdGi>~iZ+zG+br*ou>G>PxU@uWJ9lezQ6Kz=%+dC{O;M9^$`s zrI2dSR-)IH1Ydl z_V=YhH5ftD3>v;M>+)HpqgDo-G2lQD52Bi#@~t1+>lP7AJlGP zyt;q_M@D`F7(}%Z#HuJ<@`FC(SMu+R>@#iWA^?8JH7x7<&hUDYgn%MkW&xD9?wz1B zo$~S@gbXOEI!or?fjeJp6?pda&L%3#j!hpC@%z*4kaL^J>ougp$H|LN^Re=~jsXay z5z_`z*`t;$0YIw!IHwT%7@B=UZ;}lU^-SOE`Z;$zy|KcSpTMiK0BGZHm z)bo{wq|Kn}qaILzhD4ktTuuR4tp(W12%wy3KnpDV&NsMZ20DMTKOHq_k{q>w_n`$m zg52$Q06^rNwjXu~48SBeq?~+Whe>7s+!+Aqn_TywyhyLSJI@YvRB%w{;zKGv2_83K z!0?3zgCJEMRom?NJsCX5z!xb2+-@$(IT-STMQ_hy0I-q7k8@CP^|~l(rxt3wL1UNd z$sij#z+&+nA6Pl`wEzs-0v;kI2=UF^0eX=Yw<{=koD-$qt=3JXrQ%JUNzm9^Kt}jbZ>|JLge-svASxh9=>7 z#C%^#lew$980Y-060(WJxPxc^1V9fT!Dr(F${gvBpwAM5WPEBwR&Nx2gaK-q@doLy z_hdaxWJ`WFUA;}Y$1f5*OUA>`J2Kz7lY;KG^aHRbbrme*vrLO^(8-WH0z{hyw-&f` z5Tt~^ESnX8nsDtm=+qb?>(gPP!o&Me)b81D&>*Uc@0m8H?J+lhyZo(bPKDFn{J(?} zkl8H=4~&?p(JNpOYBhrb{Nc%%6Bm4~{UVuTUGxot;muLO?cbL~k!JN%uks7aW>$fr zOl8uuf6{=Gd;ydpO50D4 z0opit4isgQ#TQXgF*mK`F1d6(9sc)%@tX0IQ1!Oal<=M4TxvvNLzT%Zu^yP*MH&9r zRY;%qjQxuVK`;C$Y6hB>#N0s*np|cR_}khs9m~vlg%1xzwaxRcbQJ~5k4d~L#J~Y^ za179$NtSvk%;6tkaq~mC^BSY22O4asv?z3$HIdtM+`Y@U->S}Wh9}~^@gBoE!Ok01 zB_Y!_Jq>*eiN?RND&U%Uf*w2?frpg@_K+k$eV%r0+-+(i7!BjO)#OXAL3LZlC$b%_ zv*_|T;btyD52CRSD{4T})H7!wY(raDCzR6W=&}WqUa^d_5|-e=`Gn_jeuM{7o$XK{ zZlf90rFNU0kCc6~~0OQ$d)*_%g!nw1Jz0yF}(6j03_d(G(6 zVD)GT@JbQ1#x{yw9Ean58qh5}jl|YGx&muq6!{U%;L;a0S_TdEm}Xh|8>9tyJnOuP zfLZ+{Pgbw?XAoYqlBHPXqN-o*3G4%Eb5LT`sBWxcj)H1J=I}~G=(5!hZcm7ovD#7k z62sT`)Cr<~Qu}4~s_U-($f*mJ$UkgfIT`)it?o(#70HQsMC9s3R?EPNRRV;F{-BVN zi!@zctlROYbpTONt3{1a3ILrOimV*t7_iB=K~Rwe6wU2}UA7SxYUl{eLOB|mVYn}Z zU63|(yT2O@8I2sB%(8!iUCPx#C_W#^5cV)c&sS?R*AH$$^HgX3E%1Yf62S1mG&sIC*r7Ff33r))>R84vd= zosU&4$f;xP0aplR5jct7lYRcL7UZ9|a~|!$2>JBY2>5||h*OUxgtiVS;e4@SC|U>~tPvviESQ(^ zIR}ZY76||p<~Cfz?X8>G1d%GEaJ?c*x4U4n^i5>^Wea*NkLh9uH8DR8m>aaQ-h2*L zHzCC?kNwI3ZTrc}#ODoWWUf%$t_+FxEnksA}9YdjherQk|6O-=?AtL_KUq)S_ zDIxDeq~{iMQVS-^GF5Hs*(exec{WQ#8CJT;Dw#=*CeHzFHId(JiQCV0kz&#MDgLn8 z(5yOQw(bulB=^iR-fmtTh=*6g(~&)NxaGBbkSu~9biSiSvw%&YYb4Z+_N?FIcJ)t> zNA2q$XVO<|TF*MU(f1b7tsNgCA?|*%)AzJ(^>4?=dxqzM5~fJ@I2}j+ z1|Tw6yY(gGE>YHpbR}o5x4$~1^hM~tRDG}#=ufb)T%N4*`+9>O-0E0hNVNOcm&cC( zd**}Fbe}M%V9<1PT}@RnQz|kxW@#c6J2HIXf8@3Q+G!FZ1mL$XVo`?;SO9{KH+Xyd zpUd}u{^4ath*)z@H6z-0{@0)Vi?IzV2h15jwQtU_aqxfC^RLls?s|1)b-!*WD~ED( z=A2QDz-*$|_1gTtBSAfZxXKRVp+&%?1NEc0m!1RZQuD3 z8w!n5^RmkjYI_B7IS?OE4Q4qu11Kp0cK%n-%9trS#H(z?v1~gC;+7j_ThmXlLT!v2mArFR zJBKhX)-->U)$p*Vc)W&uNq7Wv&U7w%tDiyM3=DGgMnX2?7j=27_Ug_;pEdRw(1Miu z`@!_dGz$mynHo1?P`-HXK{1KKThmmSCz0u~cgViIx|};Nn+1GN)K7@U`r~yu3*-C^ zFx@*sLri$XM0=CC;cwaP6dUl8A@ZuX_O$b~H+L2c9?RbS^=NaXIQF2{jgpZ3Bajk~ zw01a$x61L~RnYf5HO)Mnv@Cuwz)zl?@b+n38<=FDb_HzJc56;R&6As);FffzUE>&K z*RAR*>!hap(&F9Yx#5dWLmome&WK2?S9|y6Y92ry=eGb-9X)v|W_)%-2&W#+|E;G7 z{S7(2IN91*sKi4-6(Qg1V3ih`G!IN6s-l~-Kq{Znk1d~KnvWxWYP>j6&`CX(8ib*B z0(dOGLnQ*++OFIM(7_7UdwIOhQQ$u-_5^jl3rYAjM)xF}9 zcvRsgqk~rd4YDEZJ;~_Tu=zyX2z--|`zMsp4hAS#IbIvq1L2TAl7BJ>#)!}x&n|vLoWL#W=)xGbY-9 ze1!{1Y<>Z9?}-f>;(;OgQX_Tf}Q3k>AET9+* zuDChX#D`b9=2AbH|AZ0)AQMobixCW|eF1zwJel!|=_@m4yMwMDILvyW4=}oUFMrpftsbQp8 zT+Kbh=p|>*QYb$N-dem^G+7x)?R>^jpTQG>m>i(}#aF}i=w9Za>SgXW=x_aBy&sqy z>&Bez1q@vVN)gDH$Yn8-h09q)QW*hL<~i+rh&VK9gw$2$X~zHs!$0Li(rGrl+nadF zTciAF*Y{@`$R%)UYV8ssNd}rP2@6rsF1m_>-~-h-ZR8d>JaVsek&gQ5@uOJeH0eLd zr>;Kj%DTzB1@WUEb}EGD`i)F^>Gz%$jAsn5m!ru@SBZ|=Yu19!+W=tlVh5oj57g@fcN znRH>eXFjNRet`7UH!scWF$sB|VoCKG*yPChG4aSVt|lD9(LY?br|U0>x?>kXyA&>o z&Zo!H8aD$fy6*#F9t3a^`GvIgq5*Vy#zRmu9CqyD+qE@uq7InNK2?ltM zpBhnYH_6=nfqm-5_n}liXh57S=0lx6AN#AP48Ny8D^$l55qNPA$U?IQ@r00H+j*_& zcbM7S`tC$yH`Btp^HLYjKmf2QAU{TWAxY$A>M1EPd)8&p{5sUMcoG!60j%T5GLV+7 z^H@5pGByGi02F(hd?>V@&2e@9J%^*@wfj0^)U+u>pZ@Vw{_`<|4)p9I8Z*5{3v*K; z-y*iG%P4FM>uoyuWD6zqFHI_58H(q=FtYCt6|82}{8M+IJF=~F80{&Mo7!XX0942i zNQ0CM?~IFI|IuUy&WwdhVOBZ}d`eW+gmZ8SmDcyrkU|Qsi-%u7HiETk@2qd=brZ5b zlbYi7(3+0ZT_*{oyShq_}RXCJICyRq+HM#T3@AYhP4ZpNS7Foyvrrdc{BDf?2 zKFCjyOomOEp~li$!+!BNWt3C9HwjB>?K3crSdyA0K8e&;Gh0H&l(Cd=ek+e9o*0o% z9%P;@uq5lx@PgeD&RYDYOkQY`76c1k@)P6_c?UM7#Unx``!<^1EUf*tc2?dBHru_g zh{-Y``88gKJ147v16y_0Rv``tohV`?O8%>+kl?_}Z9Owu(^I9W{USQaa$ zvk-CfIgBRllj|W&-_hgp{VJuNEj(+j5LX|TV3BArG1M0j&**fkxOa#ECD}J)60s1P zNx}&PYbM#S!SgIF%|WxB%aVrhhUQ75F@;Es$(QQ}rmK(R*f&)bNKe?-87He;jO7Dlk%{nRP*8E7e(-91 zpYt=*focR5YS4U1Q-NQF!RXdUS)B_Gj;UU##^o4`-+o1QA)yShUE$= zaB?)s+*hnB0U}WxXs+MLP&@l`K)!4XIYCK?tFD^I!F-ik+QKCgMiL(D!24Nn!b<-8 z_n;?s1m)YbON472c;))1wP1lB&W!n`5@Txa`T1W5Y`=7Rv(+YOWQ!-?T%h3HA`>Hw zfwToPhHPllakR*tTx_jnNp$?haPAl-18GtWk~*>^HXG$ev+n5Wp0D1O?*uD$0OK30 zBe8P||sQ!hH(O8b={%3TP z6k?MgAF;FtRc>y!nv)Tj)Xub*owP0b4ikJ?m#f@nZ?UySw2C=sA4ZE-^lI_Xm;503 zs=9p|vdS?q0+NMoCd~|qA9$m5u(e+*)GAMf`ronUvh*>Py03`#8^!tf;d=awG`5*< zNB2x!!ZUrwh!}}NEE>c8gKTpX*`t$DyvA$(gQc#4uw>hK;b!MTy`sd^;Q8Ewy1c#N zt`o+7TOgo#>au7Nmba{xWQr}vX(>G^Y}s#>K>jSiJ&kOswxtVs1e?-OkDwxtvLF*r zs~hIRu;yC8EnqCI{z~s0x+14-Qspj*YsXUc9MBSq~zF# z%TieJG44Suc4?1q9;f$!4L*^H?^C-njMOc|_&QXJZ(O*Hnet)F7a&U=t@AmitT#rY zNi_(e>u6JC#HVlu(Uw0s3ua(>jU}~2fZAt&);%-vek^JKyX?uYmZjvv9~N^xbaUo^ zDF5SM=NoNzMpT8bPqgwG3g2SK9Vs+UspD#STtcwX~Br9fGf9Vs$ znZf=SO7}WTz3P_RAM;s3K7Y`QMpOyRy}9x5&CMHe_n5=^rJPmkMi>)ODsx+t;D^L!|cXb z!2Qu%+K``A?p^7W)hY8j%;B!E$);HF)@6BUUBa)!6 z8K`Fn0-|6o+n2U-YC!Q}PJ@`4O`@1Lh6fjcl)NY)AQ8K5w537>wz?(O!5n6{2$8f= zaO4vDy9P8Etf1#a|Don^*F=GcC$zyWyHE!cfF@`G3h*HoL-<_N)-J zQ22#xa$wbh-Y5TBx2XB+ZZm(rbxy(@ZDkDWv4x@V(ghLkqC-3`c-I+h$TpyypC>Ea z^3$=FFu&t<8pp<>WdN(X^~PDBIl{EHlJ)vW^C?O%B#QsM{ghVi-mw5JaqC&U?UxRv zr@^fyDl_wy1$9QJrS9!v@7AJn2TSrjl#hBUU%3zl*p_!h&8yxm4t}Seq@p!yr@jJt zNNU)V_Dscz@;S6?O3S2GV%v6%y$h_GviJN@c=?$btb8gO8y*E49~K*DJhVNk1WR2w zm~qm1g!M#v?Z05%_w50?E*Tc|L^c}$i?0wQ+>*zHOL6*mS!5?_@YR-8<-i`nlCV4= zupHSaI^I(mD==POAO2-%$C&vH*bRJvx?VQigN_AWXl90!WJNiw9TZ_+l)Nd4Iu7gvj{Qx%u$k)Bgc zxW&8B*>V0K&G+qC{o(6O7bFb)>KT9|yc~oD+X;XN?t^c4Kff zX1kdPqF}E`Wjb&XGY+}-%4(W(rhuCM5m#z>xJWtv)VNUglxc ziF$WPDX+1Y)n#{cMTQ5^X~~K}W&iM$>Y8 zfluLmEMWbEOvI_Y*@22WN6@$4Z zes6dhm&6Gj{*nt;a>84~=0L@iv^SvlSTWF=Y06+`BpdiW-|q6|WEeJlucW+@ zQZX~@N^5E$dnn7qX%>l%Hj6xi&1k-n*>qQUC)ubKeM~Am*FyeCfw;7~`BA)BsF#2- z(Rssw_i(!r|I>-rKOc*J&$0Qory6cE#*t-X(xNKxT#Qp}?lG>yeQRxvs8R!##hZPl zq-HL~P6itKo6QqLHfmWUS%csR8IQ8g>0r>8k7B&P(4OqeHne^c$z;ePb5%;qd>}`@;!-;or7Vr{ z`>CAo5B%+M5ACqWLsWN>(Y#yOT04D+QaAqXkToe>G1+_-?Gm0ulzZlBmOd#7i8zo( z2|VpyIn2n%s>H7SP-dJQbx)+c>#?kkhP&p*Pezy-xqr#G2<(r%3d&t}#QLXKcrhDM zM=dLJ{p{UGJztVYqV?|fzO%1?+Wx8I+M`|`m+ZpQi|BaVH>3V z^$Nln_Ng3Fm1nBrF45OfVnqDEjpYm$a`TJ0HkFC>A3q;)56X3h>yHx~j0I+UV4}3h zxjejZtA!02BlY-d=c5nrB^+X19T0L)L}vAGO`UY#uROye=aqLdttv|kkCfCUr*1HA z*194;R3w36w8(C{Yri9mKjs#0D^?(1C9Cl#)I2kH-yE3$OW;C`Odyk`#T@|6`v6Msh z^2)HF1O1~uc|`b=aNE0AT`L4I4kFUVP!_gut}j~c(EFf75S)kmTI$s|Cs4dzW#_(`&dxI>LFnaE#*&a@d_DNsE zP?MLj<3N;hdF^h(axqVGt~nMScdfpb1|^c#l76^lOeB&fn@WIiJn?mzqiVF<-LcfI zZ?>9ycZRR*ABbm+=5Wld2o6%NDM$0%jW$(DJexl{Mx4YMmT*HuJBg+0pXszb@OD#!OBpGCgDdEo7 zs<`YngeE&KiTZ1#?*#{mGdEX+EISUCij}BOq*7f}ymWk+-@n;)o|7Y&7_mf(Rg<$? zI|Qe0{f8DVI+kb}MrnuL<1ih?K+CgU!$gv$g0eO=8kqjx8MWLc{V!#f33{FFns#PD z(4GQM@5mTcv>VBdzCs|^3GKsD(@CFVr`2Ly*)=!{n&B zfJHop_vOPB)w52QKU%aDC%QQg)qZAM{tb%hW2Y7E2S0xRE=xj$kn{n$9(R)&sg*eg zjJalBa`5PUvu9)FamY011l6e1Bvsz?Swzlj+BAzzD=HtbnSb7B3fknunKREit@z#jQDP+A)FtLp-}4a@R# zM|OMwX~!l>w~~2LK28>GY6zt@4|q$0N@UaGsI#id#1u4!Azkp7Bi@ePwR|bk@)c)! z1Kw~5B3gYxMXcU0)RRR_1fyse^vEaWPutv{41d4zi4sinrq>I%S#GElC(a(nx;}X= zT49d!a{0ZJQ<#L4%zMv}edNUJ54{wCXQ2|^=B~B!D|Z!|O0;_}q#3h6Gm$Yc{f^+8 zfY7vL`#r0MPO=R3ejgjg=uJwrPrK?G?`m8_)!K?1|M)6X3b86&>juELDqe2GR*m{R z6w{_3-Zt;9MTiv%WUFcZ7%xriwk+#;jGlz^$O^UOsZ1XBy^Cx~JVZpx?#8)%2An<& z@|^6MEW5qgx-Yj%T94u+;a}46hvOoXNV5uT?7u%^1EZ>R#06~&Yxe~6PS*0cMS=YN z(A}bsb_uuHY`+$0vqs$4fuq@CxFT-x>w@~Wlj|KbN=CKqjSk>YWGS>PGq%}-Gz=p$ zXNem^Ib1GPZKy;!i-dEW6?vKNp)jgf1y}KUtljJemC9w?WMh#y9 zEpmT;ig)JA+k`%lgrOZYi>g?QB3>;7#%&9oO>(qvAoJkeB%f^XJR?RjsW5Uas*$38 z>M@4_$86r8)HR-G$SJ^U9p+F9J=RIyyj_Sx{!D10r;gbG3gd#v6wI)BuLeq1s*K&+ z0o1MtQynC|0vMk+|3Mlbd*h)8AQLfof4qI~WSHdvG{2)cz}S|lvJFxI4}XT@dv4}X zq~8dDxA^-h3QY6r0s%xi{i#i&nP$`~(8-Ysb}7Izb($A|^%EZuvvpgfvv=siH?Z!~ zO3YRRgW8%uQcL{Jy8%f|zm16Z2OMwp%XDrBNo2Mk4Q@a0&lg-7;(xP2gI~zmPe0;F zTMh&Z*&2jY`m(MaLKS&lFhP>%y;>UI+aIT%Dn3mIW7EYG{o%+Jp2Jh zn4T9&&Ofm|M*FxVaK*U}v-ONKNIkoD<~@joW&8gjthh`6TqeCcwOu*@UlCG4jQVm$ zhG6Ui0z=W9oR`SB0c-gYUrU*l?{P_Kh3lB6&($MKt{BjUw|rl0wn9X;y$G3fOZ#e&q7;zF*LBu96SE6hl^KDy5>@r4LK&Fd^xlF| z;fR+Gz#b2S=q39ZCr~c^0xN4}Co(9eLM%-?vQyIf-PgbhQzKgI^A1hz*gILQ2A>!l z(x{a(+TDhqLcTi-7ge(gLg3{ypRPV!i8avnVDEOb($;b<)SX`hVZ|X?PuJ##e($`TG5kE65-? zbOqnQNxnF+-Sz6QK@yw>OTjzE2c?vBx3xmN3`BKIJr9TI!z@?}t-FVV$QXYue0%hL zfidf9Bwf!oREFX<9u`S0?%Jdl>OlAvvnGQT347^+PJN^LQ z)2xg}aOT(8HeT|-PWX^`Dg4jGx9X2Zh3wmZr5j=t?Z7j`AEI3&*R80ce{Ev0UT=>O zHfBYGd63WvfWFX84xSQuEJ;(Fpe%*RY_Q+l&YEmo zUghg)k3S6Wugbr~pi_a*fV^A1kOye4z2RI;W*Tc8iB+yqaKvs`QHC9m!D5W9az+Nj zBoqRgArpj(@t#r>x3Di6U=N!?!bCRDkAm160wojRy*L+!XzuI(^Y8b;tW+3$f`3s ziRi@Eqi7cx{cLN{dJP9>SgLH5`) zGY5%g*3ttCrI^=TV!W(AV1FtBIuqIDOK`J%cZ{lvGWdOUiMH4>N=g2xOV&4^wpjuN zWDx3TNtNDAEUJj8#gN0birm8=KtGcQ$kP~uS5r`|IR+OJkGnJPoOM9o+@(m4Vf&sc zsBoxXlAKn=yJYpxxkUt(zsHDj$fSRWc=>E%;c?2)70T1cgAt+pHT06M#1~?x;-1vN zDPs`>#|g7D!914t37w-tML$dN(8QFs035hrCRDF!-T=>C(mDkk|glEMXcj!Mc>l^iH`Y5Jz^ChKR9|L|0jhZ7W zJd)XaaHFnngu^|EndOd6af$AXMDK;2W^WS1HMgzn&B&;_KkE$&54K4vqvuwz7AR@~ z`{n5E5aMP-FSvF5XsN8JPTTFxYu0?$*EhMMuhZ*VQnY{Gha_reT7(e|7Mt_QN0XBT z-O3Y{pxtczLyWaO>v3BT=y1D&^okGp4`%D6TacBvFNr2kp!kH#{Gxb2j+R{cbT^RF zao=dBz*LTAFjO{1>}G@YhN1Ne7%7`D)D}HP6DcXXS zjj9Oo$znf+Mg$|L83(?;3+e~f#4@grej)W^3jx)pC%;zj4R!|Xn}64E1rb5d)iBfe zYKBr*Ye={%4ZSUgI#fvZ7<9<2bJbfi_uC=`j`_P(tJ`z zN0i?(xC4a}8zQ~j$uShC!G6!uxywsIADBC)iOz|~KxJ`_!c1n6qxW^4#Q9Uvuk{SIxC;XvL8}fDM6BLVC;eBt z0~^cEaD&F{VxnZwMKUGJE^nK*9=F9kqtp<9%zPh$ls&G1>iEW_8E-w5$uUP3aHwuB zc#^uIAfm&EH#`&UQX?CcN#n}*JMVzpul-I_10fD(mDx=r&&}!=0i_!7<8@FM2n1d$ zo{dA9vYd`{Nr*TH<%&luO^|jrSGuybWUHT1&q8WfuSYiq+i`-bWERX6Z3vjxg%kn^ z<9gs(LskI@UUEG`=AJjdZlEy^X2fb5qS2nfcfLv7iZoFenG5MV11y%Nodo^sU+?i? zWaFk(@phamaZeP^#Z5+O0 zz{01=RZ`Me>5l$dt1Ald7Q_6~_lti%OlR&JqEpgtARirNcJQg-yvHkd*<`}@^7f`) z`5*Q`<$u`&e`Ne?6m$Gs2DReFM3W!|0D?>x#{NSh$T~|(vXl*|E;2)HgqPl13ze!YQx#3L|yaRLkPJpj{c_2wV~fJR*HtGx70|tI8{U zqo!D{r6l8PbmVhJ!ZXeZq=SY*$XfZJ#V046;T%?0g?!CH$L#x$?TUyf-f~Mejl|S( zo?1mx9T2gyeLP%~Wc6+a0)XN-<-9M9tg8v}%Hp2#kj3j^+JRPc));g4igdpcL57f%%C~q=($5{4lx`qErEMGNbhu8oMKIir32vFl<5P zvXm3qCeK!;LR62N9M|*@CxQe8K_H1es4`g;+4KDf?aFIdQ+hL6_}XjoG$?(tWbxV1 zcs>foe<^g5rB1}<8N`i7QMH#Yh4a}Wp01h?3-?S zUHed}60!UEWld7KB&HOC}jRF zk%H(bO;+(}YodgWFDp953j6R)x2`iyHjbZr)+ArJ-GhIs?-qCQNSTXj`t^ZSf$a64 zOa^0~Iv$-ve5nH$3X$FDGGoM17P#WDj;lwi{KeG zOdj>naIfuR{ju!?4hx6w(XT)hmqa%!l5+OvIL=>pQ8$HxOOy z?}@VdAe9|#?1KbZ43d@ia4YtFtXGUYzomTWjhw?HTE32kfpEVHY)L^^6!782Fv9Ac zgZp%%I0v}*P0f+%`{8HmB)qg-bf5`*{ov17Vvk%Y_632F9b{V+FM-0i1?u_@G`|8L7)%LkXhXKEFXrTpKKqrScb1QyDUh0Y@GVMBA%&=Y zS~j+7x#05gR6$&+(k)--aQ5rXsH&Tu>DS83br|}+H5vF?Be$bx6!gG;CrHD;0@SI} znC@E1KDqSd_C4jf(ztbm?h|@<14t4MxF|BMw6@jy`SJkUHaaK$tS>aMPQJ;9el$gYuQ-Wm-y zjxjX`i66jUqjOA1`U_F`2fb(2HhN!P`LQa&i@&pixQ^otBYzLK(3L$JKhmL%B~Ea- zEtT%GWAG7j@eZOwNOcsJ1x?w&x0V;x-w9a^IC25}hniR4Bn|pT!Qri}0xT)id;02e zrQSnUzu?#Y*=1)6D92w^!b{}45FdL$g<@8X(b8}EvY~K|{=~?|IuTtP) z+aDV4;fbFj-%-RMgr)>L4v{z(Os-?x7 zo3?HoJPkEO+5bf0eXl??r!`cgbLsp;I7x^gHdssAMH*C5cfDuvFo$o%Dc45rd20~k z?prJ;L+HCXq2a+fv9+R(e+89#_uUy2(d3_6BR2mJXKxu7)!N1jZx8`R2`Q;TLkJ=0<84B~#kWVcb5)917LlrSiCD0_pS-60WR>RNuq94JT4E zxgod)Ya6aNZ;v}HsMDPZ_!=#{#mURJd;`AHq6sLu(~97tsKP{2T&2j5@>1q}&HV*Q zKu&q1){3IX(aM+8;6LN}`_a@m>h_DwPL9K-q~^Qb;RBcwZ)Nwoom#sG?^mt5HQ$kD zHt1)Q+%LV1EYA2?-+}Q|7R$>~v%=YN>CxqhfQ`Yfx}z4I`z7V8ak+Ej)W;dg;qhK! zCz!47n(g?#71Tx~1QLSj179w`r9VWsMqrvL+hjMUepMXE;lPALw@C!m*q?(e0}?I?C24$)x&WG6PDbryXrD&<{HBjO~Lt^9c}II zu~U+^v3A7yN0Irz99Uj3p%850%|cj6EyoIhP9^!f&72F!JT^`goKs*xISF3JPT2MU zcSDO4Jb~oST{N0rG2E#83S1;`2fk%OJuTbf^T>?8FV-p5iDsE`gBX+zeedEcGD56N zxBi&w7hg^FshjOHEMDm8{*aC;8*jC%UFlWq8y*Pz@mrOwnt5}D549s+rf%y`Viqd7 z$6B_=2i3YRHh%4vI=em7nD@Uq!dY1;>8i^__d6Xi>+4Y)>Sf3fv?AQJp07c6RlhJF%tsFjc7cFjQ zNI{)#qILb|UWRL;vC*T;id_8fH*0jGGP4$-P52)&j#g}m!af$dIh*m&-z=O*nSI9G zhRbR`Oj!F)$l+}~H-%%3cV?*kTMh4u2St&zlt3naLlUeu{S&t}9ilPN!i2IbIm>+h z_rFQQ1mbV$+ncvljCr-4gt5FG6Hi9%-mEA5TOcz<;muyl>(&j~uKxR2!I3|^?H$cs z0~DBEK(fTz40H>+EXFsGxb9cO|FrL6jlkU}Vv~bXF3=90-%g<-jWwh>E)&Wp0jdtN z!Mez)*ZfQ$4+<0KX8r68$6B|6CiMoWmU1_@V-=X_h?8oB(o0gNb8YVS9dV0R}Ot32tRH=)<>w&;FrWx#9D zO}a#B<49x@kBV%0AiTkGrzVvXwKP9SFM=cAR|Tp#i)<>?gmik|hi_ zIp^hoqybekSLZ9_qvkrgH&f4pZq}#;jynW=!&dH$NVhd%o6#J1yG2*cnnahO*R9V|@v{r{E-W>*BsyS4UPp zZja_tuy|pxx!QJMmv%D?NYzqW;@b9I00^V5HS!Z)`V%-O=4A)(3y#^<867XL+Y3r_ zyDb8?wGD_^Y4loaudX>}tr#`TPWH30kD~R0#NwI@yHp+NRvE{=j|E6wLDtFdW;=-# zGmb!b76%wB{cNGfWlrp7<+)zrWR;dc>vzK{Z1FvlDWgsGVsz9lFhede`?+g^5B>Ed2}k}&CwIs|f&NM_)weFI$}@oL^@*6RCShKVBcR*U6m-)aMdqttPH zfl{^};XSFf@Erf4t{%ha^Fs||s(e_Bi6A)oXL^KU|JLMnUFzS<_T1hMgK{9t0R>o| zvabeeUjcE69De4CK65_MfIMx{0V9?h7u6cUD|?`=O7<@<3N6_GSf)Vo3xZjeuajup z%P@L^`>qTwJ=CZv9@275S>F;1_S)+NiID28%EJHE1;oYtxYWpKJVOB^*11xa=kQOluY38{F3WF z;jVHetjTP-64n6X?u)3-NO6(7sYv|2rx~rl$4pU>5dz}fD;}+oQxyOMxXr>uT(C00syn`(GwPn-^!IGW=5Xcrd>Ygm`p^Yaf#+#50+o5O~anzbBtQsSo^2 zrP99E$B)V@<;sWba~~zTa!vMJr+{q2Yf^DvjEBhjPO`y!Q|_VLKn@BHx&_z|noYTn z0RP7y7_g)-w}eshKTi(8qb~5($n87>3N9%ChMt&ube|flOgb-w`rP7jxVA#fJ6%-Za>gKYQDS5FOw#UOd`8hxfw zO-1Z^=d5tx%P&AHqJ01R>Pb#Ii_eEIY~a7jENK0N=7IdkZ5Wn**GdS*I5PTZ-Sut7eRMSr~Q zmEwVC3IGCg(scCpx5;K+%rtlq`v67CV@eneu9#*wZyr&#N`hnr@=B) zP-fU6cg-=akt2y;#SP>z4e-1IL;qpn-@e!0dhR2i;tRPr2y6jUf%=Nvvi$SYqb+I% z>Vlkz0(Tn0pT3KQ9db;ECK%cI52YCws|6Xe!PXU32-|m&MA0(JcYnd7OH{ zrf3UegE6*P^cz6&2s7hM5GJ3j?@H5=?+csORnBWTg%EnH7Xr%$;$N?t=>y+8r0B*1 zp9_k%OxW!7$MSAuRce`G+i$7^OyrepbP&cBMQOyb78DgAFMqvZ?=GoI`>wqPX_u2+ zEsL7P$;cnMZemAIAY|coYQe9UOB$G~0>P#xrK;RD@7}gaGd10Mu%xjRQ~!x>t5ZHE zTyT>wlr^!Y+ps0=R`+v6m(bI8&wm06CeI)G_zmK@!c${ejN9VL?6@BJw*pCB!G7O# z>Ioh78<;hM?tk!vdYV7+gs%T9p71+XA|hHwTCX&71<2qB%Sy*-xzb-IFE&DCq2*r_ zf_SfGf^u$?GRx_`x${A{mF%H`#QfTiHO|UEpZK&s?>~M=)^$Txx0M&JeK~;{m3xrM|I(drCQk0L^%BGaah_d zc~Rl%M#4!Ul3?Qgm)>(TRwC^=ZDpEn$FSL2a!!?o@Zwuyc0Zgblc~BK%m~#a2Dh}_ z=8qd5BeGm4a>I~IoG$SP!Vb(i;~!mnyaHC-E@pte%S+4SizOJjb)Ltu#}f)KkWQ=N zo{KUui?@3;u%ZX}0Au=>yQCC?p0wkAE4%SeYA?pVHa<;j`Qi@CeEo*S;v*hHvB8LZ zaak}}K!#esh(~^af!Y?iCVSz*%G4;*FlL8Ca{E$y<6_y3AUEr@q@zG(Ny9_$7cMzS zx_TpgV7#J*5JI9My^|2vevnTc`sBn{TS_9I(J+G=|pcT^GI*soX+n3 z;h9mEJ?30K4iidDy&jku#1o#D@~J<>-|Sdu&*gr~*C4z?$LS7dO@F;@)^eotfI~2D z1M2*&OSC0>vDcWZ#eK6Ed)GtdydYJGSxU#q*B`qL-kkdO`O`de`S^1BhLxf%^M>F) zDFe-St+z>TxHobrVHdbOwIfz2yoPuwv~1|zFAL{MW@IYgLbjzwIYwo$Twb!NxlbPg zjiX%H5E8`5QP0bv)xrcFEyX56GMzsAk=)cFENWN_6LULGbYL;eb*MVzL1bwUSM9fi z!IHILc9JIX8Mh7Qjj6Sb{eaX;Fe>ryGTkL%S^dA#Al2*ao4RA#8voVI3 z0wKLW(NvNhz3}Tpa%i9UVO8kNeq}W87kc!KyJ;8(OLG3u{D6#*d%QK=!JX4=>Fui~ z?nY7hn)eZ;-=c2|+20PP^B8O)!Gp0qoTp(fSSUYBpEDp3$EAtkQ0adLL$}hYBxjp> zdN&Y(o9n+3DM04Tw)^&jK6TJV;hLK{e^OY$M>TY#LD_BB?*n=Is&?g3)#AFbIIb@} zUp`S!2=FYNGGe;ODNG}1$!Um~K`~LVHY$yqB*^Rm#l0EP*!PR+xh(OSxe-m$day>Lh2ggn z*s)8}`5gz(Z`C3i&#&(&zw zN3hn$Kv7{eM$CE>vT;9s5H)i3fEVVazb;*?_OtqwIv~fX6t1}Qq^yW-!1Gj5Xklvx z&+mRaKTCIb3BQ_rODS=qMVFu+&m(a41I29UKQOO^!Gy<8pAR-~n*ckg_#b!$Si`Cg z54U??5chIyA4bgD@KJ0$Y{w(8Np;bf-{AA+_F8uf&WxniEW_`6F$!B>LrsCXm3-hs zYMT#WJpz^|=WNBpQ6-v%*RCB_JncOo#b7kU|Ip{UyA*jK2j_FH3dwYTF;zT^CzEF< zVWC6ai*Wt|UHnU*8_A&XnFuc6KMm)Ea1Jshy^^Aaa^)}7wEgK70cC&O51Q*kx8&Y= zDW2OIebhaV883X{uj-MNjcj8o7oN5vO*pSvABD@K22Pi=@6N0_e~jrd(S)~UG3zt! z(tSBmfhV=HXV(hP;dYljqDMeow;f6dtoO1bw!YR~cV;XK7z%gx7QI(G>Im zVW~yznH=L=w{OJ4Edb9(QHX;l69#>?q*NwR!x@UW^QsA&=5(IWh<>nf%=UD=v~16<146J`}ZkHf>%XnxtK%_?C894Z9k{Q^jSc1qWYG z*2P`bgV8Q8HhBvNJ=&%V?K%NI8o|m2#wUfCzE^jSmER~(>t}{GgTBFl?n&&89Vft< z=9V4ivhIpykESb-WDk|p#GJlKcx?NW;eoT;1=h^{1yNqqP5_bTiyM5S&VZMr;P%x= z?V^Qe(Ga)wDNT0-oPw^K@70bN3?|!azxScd=k60up>qR{hqo82PdG%oeG6i5d_EC- z9R|CT&-^Q3yGz@uEUYZt@r?ROX1ok93S8*|mv$KicB1z0D2dLeO=Gy^xu?&#d7n=_ zjRRh}4%W^S?m+#p^GtDeu70R@Xh+sq1JFDtE$g)A5}H%YuWe|Tl8My8q6_R7J83qgb488Ks1#z>kv=$AQ`zH zmGP&VvA^xT`LHEPsYihCh;JXOj{#d@7hF6$SxF1$2_@dS)a|Jb;OL&T;YpSmc;BEB z7Lar3j3}Xff*sO3UH$Sq&I_js-w#j8`PjqLOg))yN*ix4*J5>k+Pv9E;n}IBJl?!} zmzi*W6O+e3gw_k&B!qMPY;czKrBFTV5#u3+bQqlfL}B5fQWUY+kaNah)ajX`TkcxU zFU1@$>z(Br%*?5k#wZb!@0Xw2ysjn4Y3efCb#=~G_vi;YExLT`98kuP5W{eNCsraA zL#+cl#}{HdF}@%Yy*EX6Y%nh#$Z97~OaOD?3)MCle9?LB4xUNu(6&#HwyM_`8a$v! zc6`C1z-JDojvoR8OnoSs(oM!Rm@7kwj?#}+1J|1t<;2AC!NfQj^VJaZ~- z$cns1J8Vy*L<|n3R4Q=r*sWs%#ft{OUd0*Ady%H<%3(ItwiqB|R^5tuphZXv!(|hF!G# zzE$(!-mdmi+PP?ZbAxNVZ}o$RNcJ9ZA%iUorYma)%30yf^u$K&p3TpQVvkCqh~+g2 zeAzmGqRj|%^Og`jT9A)NAWi%2Q@0`)KIaH0Wv+j>!OHCDdKf+Ojb*m0i{dM3C+!j5 zSGm5bfSmdlFm^*G#drlY$m#LyS7_)dZa}J zyU*Xnv+SLu-NJLnJ=u_KQSwqj&)ho?+tysjC_RgsbwXaF1Is~Ua8e5aW-%^q-tA<~^H8w$i4L#tej;Y^yf976D;VULa$9gTFv)IHyd@bdyvcaA z8x%f#JJL2T06%lUJ~4t;$kA|jSwAhq-vg1V>0_Vx!CmCWvA zqu8ua(Gr)7O$U6XMCW(=HS^chr}dNwsc)Ir&9zn5X|hvMbhNX+nfMj`W)$_YPI)wM zY=(F%;#;YUz-nqK(Vpw-!8fdBW|41;Rx%0;R^fOsmwK4Gm%PE<5hX4D9r40UmPlf1 z*U~D70GAtwj?!p!z?1{Eu4g_IAGNR%hNoB&P%zR;FzqSYz}-`C_=dIN1Dnzp<&~ZR z=kc8CkK-`b-1SjQ>kq6q%i3b9moM%Y@Zl}^$awY)92Yli7KD%*mp2zRY@VV_7NVN@ zZ?YYpgpMQJZ=Gzy9puflbxchuI~yvWw{@O`Oq52dwjHr=EOE-}B0FdlXnTqyzaG_8@;0nf&{HLCEp&bp zQs{`yEDP}P$eyXkK07}3oGW|J9>hw^LS=TMcY(C=G&*Z_jla-njpITt*@34gOw!y< zNOz3=X8DpPHS6GhqUfPZIJ&L~iF?7eJk@o|S|zQz9cj5(AqCBoR_C@+6a#Dl$G?tp zey3#p#NA7M9<^MTl`UE`vT*A0;iMs*($fvK7pW_aR+)+HB3zOiyt`~HfqIMJny&nE zfE;i>QQf1@D2OzD8(9<7Lpwcvx*QE}u|#-zPv`GF;Aca_3#s$4d6<&_bA!P~S=+^EQkE(|(^&VW)eg5@>v=5Rf^Otne)Tce zo+{zD`F?91HFRBpY_?BI)!empEtO=+`}f-7D+lW|rQ`b&y>}!QLgU!zY~ds0H?kK~ zyxS>19XLsHa)N<{w_1RQh?$)F6LUAjkTN%K?<6h-PnUd?8L!sskqR!R%BeHt>5z8*ni+RX0rFg86nT(e|Q z*Fsta1)41z9y-Pz7I>da#n-jandf-};~sQ!aYo4TytDiF(C_z7V3$2yIjm6JuRQ!# z*}PRgc zGgY5hJN0k6j=^KbJ%XnX##P__?KhzEP8jV*&4GmLS8g{M!&G&X)L|UN7dj&BqD2|n zo?gEP0>o%gweaWHia7cmdpCSXb5-Y3)fGXE@u|Jyt^H>#|M)TQ2FaJr4MRHRYS8ZU zudkdNzxU=ZrPV^8^q*fIA#X9JM0j4B7yR=Wp~K_`hdJbKum10MlSm0C_>eNujwz4) z$01xD@)x>$;+2T-&7i-ZrmOGw*}=y+8-1Hy{jXyHe;mSiu%fotr~B83{?DiP7LgKr zXH8AP#{GXd3XX*4V_`n{P zO@liBdl=^6*mF--{tst~nihQE@Y}J7|2>Rn3gFnesi*$;EUg%U4}4gRregQMhw=Y- zvAo5>yb@&q@jD%IcI=%%cDw-yP$+4HD6{8hGrw@bXnxw+T%kw37D`j1u&$zkgb)Tl zzkd{-c}rpe8G5#WxiV!1umrub3Lm2Y0*`39drmx0|)-`z**wuT_NY!$B_#bkV{7fB~S~6D*o$9lt}5sa7_bR<}nja zq&`=6H(jFr^MON2nnwUP8(|hfuxn3(%sG zIf7&fW4JHKpXyr&j>O%mZ&f2qz#O~>0)K8He?q}97r;BL2Xa-l1Zsotz&BX8wi2j2 zMt*7nF9>E&;Lw)+KC4^GEBJBEmyAZh^2(zItosUG6;_WOA^4m3dyOFFk-t$I0cCF0 zg5TuiN{35;i?_QDWKv~&AY|)NykQXI?mnZ(k?VvoE;$#&$Wk{)C$k!_mIYS@ydZ7W zVLHi>>h(k9Q#|3pZBO?6jt6BU3OP zuR(qWP+w*yrA=~J=yF3t<$SM)8j#AR z22xYSGm!B2X&)$ufxDnw^0?C-C*!)6c5vp+97;rD95<>K!W^lt?`{K`&RF#?Bcv^t zIG!?o`4@)cv;55V!3NH0;C*ZfnKd^9Uoo=z;NT*V`s)V)f`znxJ&;{B2(cj<$ScJ> z0R!MN?g7X;O)u=E3?wqK-{zPV-u+&UW$_Tse^8OREb7g39dLg&2-@RE1@zHBm3K7nenMuh#Qn z5K$g2X)w}_2VzE|PZcR@IP`u>tE}mm;dvEF1naKTl4~~h5FqW{ir1n)xy%_RoDaTc!lR(xdaMt^v#TWI$($O&Y7^&P*q)pZo` zr#K`ym+_HiNG3Kd<+ActvBuOU6J^M^(fQ{`>GcHeW;l(eHn~C&(vHpISy~Y}WTk9K zAnXWJNWMlc-3;E$>|#Daq;mWSRJ{(V{0_r9gsE&~y@9|2df``S;IEx;w-%tBuWvEe zXhsp!18v9h{-%^V;VRd$7ZdrMid*hBUU*M?z>mNXImP|Kdfh3 zSX9h%j=QpA{9?xY^#~}X*iBzFo=t7-R?NK&CdDly7+BQ5SW}-f6+P1ov!l9L)$o9b>8TAL*Favtl>AO4jKUM$w09O^p3h;QiV_#cq0h!n3-yBAgTytB! zbKZdCh@FSsh~1WlXY9d*hGg+Rs92xUqE0ol@`yB(YJVR>uznDvwuL2nEPi~_;|0^8 z4p}+^QY(0*5Mu#DB)u{G!*{=5r`j9)^$j6|7G+7!-@>|^<-b3qhDG&7bDHFZN*=Rd z4j-fvOJYmbjw>>t1dWTW5ixiA?8n2L3#Diw^!B=tMAq(3%;U0;B3I4Z->RT}PjoB( zv}Si+S2`Z=&w0U&W*xhbud~7aN*`L5inTxu2zv9Ya^#uqy^(+KtAf9+m}C=yN}ndt zI|h?nfS*K|5iOif&3a+CCCzZqpSQTj6-`*zj_rUztP-Q#Uu_{|Mw;_AYMdF?++MP$ zYG+}YgyNncOH!7xfiAT1byJ`Eeud=`o3^9X7dw;lAhc4GCs9pW@-rR$?|8eb+2Wz} zqdluIXL0f07YT*6wNG#Jj5dW`7B;ZL3e)~s9yT4*_eM*R_LKvorp)}W%%~@_h>|*N zMUcB@7C5oyyYiu9*uEs@@mxvg?Ty!=1mKmzzN0_7T))}A#6fX?7K-Q<2#zne&9S;cF^6RZ#~(@FgrKm z$B1#Pe?CvDHl!>~74^b6*Q33552%#PS?_*&#PHzB-B+P(D6787npKYJsJ_gFgIF<9 z_K!=(*OJnw1P{Sj)Z|F;1aE5$yF6BjGnr=`PRles@u>qVe9HMlTPgPv3hbx)vl%$= zwt!pS$Pc<)=6{xi-nayCxn5o1HkWt0Vp~;4#%LzX*-ioMsEf=D2^iP}AEuBAt)%#@ zCwO63*|Mrlgu#Km8s`QTIuVLj_};zL>r$f*`IK6E7$hSSpN98{7V1LgcYwVpr+5sD z>GMkBM@vU`zGJ`&w%?b|SKe2Q)V{AE)$j1_%T{VM@sWw|ecYpEGl@MEW;sfhT3va_tDE`s?iafYNAAZaOQJUX=6Z%a?Li~l%p~A~x>eG(ofGWH< zfqJPIC98cCKZdEUi-Hi3jOYyZPFNBfEQ%T&?@6%eGTiBz|M=@hL#kB~%#T z-be79#4mRpMDDsOxO>F)DL*HvXP)5Ui`4WIJvarGPp%bj3lD#`OPf=T;z7Np=saS9 z**v@Siwv^iu)NS%XJpwxJCmVoLVuFpIpOSJwe}5Fz1@VGvZV(RGFA>HyVz3kY`U_b zOwOh8v;ZHcxR>&uua#*2-kg+9ACa?UDb}`(cTZ&zYJ!AFol;Pg7%NX`YT4u(S9}t& zR*8@dO*s%oG@AHe;lWrp;2B8ST-MwF*f;*zL%hBDu;@UbCh%!BoEbn*dI!$I(l+2= zEG`us@T>F>F0XEk@NqX+-+?9X)a7lMxSj=Od;F^hx)vqYX<@(fA(%EJ=fkJWM_x8{ zl|U>ykyH*9^fs1B;}8C)%h?u1XThnt7L~A7EAZ^B&@=dNi_O*GNS~&6Sfs`y!_NF) zZ7cY}rY73nT<#iRi>t2z;(?#;f1wlsHBggh{< z!szkId_xflwI4z7mV|EN&pJ>H4(+pSu4)f>u91TT;X^QZ9ZYuvb$=;ns@xLFRIN}i zbQ8_-w6%%bBlZ~9O>DQ8>hu{MGSai>=Z~I`6YBSe3@laQIRKhl@S;`N8J=l~QL&9X z<~*#|g}iVN8syr8NEI8%RCw$J`#*=n>^>kJ?2q*^Lr<1h<50FQ>LV)dxmQtX8j1Tk|Q@>sdyrs{I)4i7kGWkk-b& zrG9mr70-Ffx`FKKB1^!n>WbDde9vrdS^7njIt!^Jd=S}61+oO_extViM&Nh>F5u6L z-9upCd=0V@Gj${0Vz=ZF*c!8)P##bL2llg6^Kb2M+Wvjc$7eGGPBm`sOQi$F4e(r8T=`KzIvIK#B7M|33Pe|RK?%S z5$3CD3UpM1aLwH_ro5teH}K%1`2N86S*;dIj4lO0K*j6Ff6RXwB5$|*p77KDUcd0*5F1e=fb{I7Go=sMy?>qatT@z zBTtS2#w#!xdTG);BdBSsH3-c83B`f|}Ka4w3a!_Y~Z#`Wg@mL)3}3DU2gb-;H^}wiLu;9cAc$xcA*wnF03@jCGH{&et zv__O15)C-VIZZjJvkR=&3G$Ed-h+30wJbLsKj@84 znIOCk*{(hv%<~7f1CK+D zd_nu&-%oQ3ABve2l#0+0bgk1p-_ln{J&GPmT&{a?@7_CQW%+60oiMLP0JOD7ekBPy|$&a6Y30K6=A7Z&9%PZs>M8Sy|q zTW+riwO7PG|z|^4vV5P;@a8zi?*6lVvjjRrO;1M1idOgYGZe z0>~QKajNScdy}2)H)Tm00j+-7!y?A`*b5aJg7o6(?=KKl&(d$t)ef46> zC8xBr&~X)cXjp$$a zzxUJlYqA#-z~4)Xp__ac>I<-P0Hv`Tmh;@NCzUfN`Eox?O=>c^Z0TzV3x~6Y;C}DZ zjl1Q>+(&|%F-KV{?NWFb$~dMMVlSmXd@e|hU`cpguHsee;7}tBSza8lBFe){b)Q4K zkk*{aP?FT*y(*3w9kD=ibwN{9uAys!{71~Wk?RHpWLQ1a+~$s3f-@(I3VN*c1#-v% zSDlOE2I1B-XQ#Go%`$YjMnjgBleP1uS{OKu5erGr)j_>kwf{|sxgvm+t4`>rTjt%u zy`60%SmQ#g?kz5?|GpX!*R1mUra;hCGwA;B;DX)ldx`DuG6Q_eUPcQ^snroQhHR_f zFygksxMiX^(Ti{CJ^B+!qVE&Wpb{3(SejJsY(;8y$&?#B57t`3`|e zX`vK!GZ@3Lg;zK#n)1rQpP4qUHWqWY`Gyj2hg>Ll8j4!znp694VW+lZHVo@{pY%1j zbrEH(c_!O*LQdnVgWESzl4w*BGR8j#mTvC7XHLJ73a|Np=__}G9A>BXxI6M>STRL{ zedl9&EtJ?rEq=0}gu=cD_sJ|L{+!HfhL&m~)N02c7hYxKbAri25(i%J##b8h?q9LA zH~%V>d*iXo%B4sPzX`$j?&*;{?~h!32%}*)SHFfbvnBW2O9EES{lomjqA#F9+frGU z1`I`@Iif)=0`i_-gTNx+FJtB9!Ie{v@ekj-6=Mp`NNr^CPgg^v+tP6d`nA-1!zTCP zq$4D}c|{LCVGUQ!?EGuxh*D5K()oJ0GZ z0>yIr%`8iW_G>)22}1X7&F8)U04_B-Yi*E{tXnGglb0S&lT0HRZEyh_$+PodZQ3}j z*TWmoMD4KsRIBd3bf{(%C!hC04YqW;bd#iW{?VPlVLDpI&AoB4ov(m-jFHDZ`Ox;zN&XAemuNn_(@;KE~y{J8s3BL zFa=zuOfENfD4~L`>rr=NPA+}BFtoify1SagT($YyShBkE63g3KofBhzRlE-!{c9Q7 z@1=x;(wJoi8pGi=fMJYMOF%sM)oYa8QDhFxpls*v_J6+n2&qoUU_Kp6)4sX%33`MT z%Q>%hP&ginJ#E?IEO_|F?e=#LgMIE}dMmR+At*JJ)a#(7PR+>)u3)WRaI z`a*+ny?AZw@R&Z8gltymEv63(U{_7fkmCnY<4KhzgEEF9(nklEw*>m6qIQOkDm4QA z{v3ac#oMK*ij#&u8o$rQYTT;=9syPN_-ka;FIyFF)mY%po=}FKyr)n40&G|iNbf4Y zD3_dNKUpWFU{vlF*Wa2~Z^z{(4D6b|5cVY{oE-(PKs}unx2^gZ!QSkixKEiP;RSy+ zR(}FzDTEkWj#7Rxqg6|VC7Y34QP)>8|2Yr1+Q`dfQt~(a#`EOH{tbSBcS@N6SmcJ| zx12xU_0Mlo=x>x+)=Wl(s_0$|Zwle;zRNTE(g(lZD&RdGf}svLkI#LQdtA&tCrNIb zOE#g+@A{#SKphbTA29h`ctagP=1I_vC2(65fvq=SgoPDv0S|vqvEMe1H!`Y9kfaVVUXFx zR@k#Sb^`KkzsT^qAHS|`?0A%`aSjq0Ek{~CBrhh9Joiz_7we`jnh>V3s0{}CyHy2; z7eFNR$O^~m<*$K);XXyriaR?Mp`cncazi+FtV+NREe^oOLF8Bp$%1SKz%19=&FR!5 z3}{TstTF~rRw3dgi#QbuEeNR4T2=QkK7)Ip@3Y+dhz(2d73Gya(7H- zE`o!Eaq(LW*6p!8(6sVXFQ*$F{i+BozH9L(5_cJ23*rC)!U}dj}4cY@2_8OyQs5OrTkVAgmmiw}xwj5P}$;P5kRK_}2rrBa+V_0AT3x4=ZttV*n%h0rxY| zyi^!8L~`Bc9G2_{jZ{3c?F`_1Hz1wcD4>0|Kt6Dwf2WsA{FGTR>K}u=`)Reu>(Vap zofU)uGy@ODR~zqH9hyN^ZJ0noGI{R}C}!~>?>4iSkOYgO2TFTq8$mrCGX2m)MScz? zh3Gg8sX{?)hbPVe7t4=T^mKfFoE{=6%isMH_|)b1$%j+&_uH&8{B11MO9f$zyfznFirceut`$xWgl041|Od3la8kt-fiG zUuQEtsnxb5NCSld^6Q@w_NrFdjg_Fy)rxoTiqW>_ua#<9HtP%G@L%8SNZ2`63xfh^ zhksAgW~P0pz+Rs`kO=~p2A1r(oXQU+y@i9{ecE^`&`PADQ5&DJv#TXM%xM{!+(UY6 zLCuI|Cm20`@eJgEY9o5MYmg#7B5k4L>LIzO>qG+?Nh5nQWQ9`3BQa0OM^@Tc#$->p z9?9A2d#DHfz2=1DmT_W@zmX#LYr>}vY5`}E6lF>Iyq~L^tQjPMhI-Vj_HCttLPIpS8SeB zx(y71CYx$r;KA8@fJ0Q1mRwm_9=!yU3n*TkKmA;&Y`n0N3ziC-9dRW1)t3apLY6@I zI0r5?XBfD%6#|FD zK7&hN)`K+;?Y0NeGjtSPyE;QW#k!y{K-0$Sq;P&0?0W%$6y7e7AZvWmIy!T-u%sr) z?7S}NbGuzS3w&Fb&=WM*L^iy_;msDu;Lay30D8krvs@7$fHTL1PC;Rbb@d83>(9^& zdzLjioVjyq8WIf2%LX+Vx5va5^8Zdr>8;0T_>^8#nG`MSBu>IPuD53>8E2+hMNZEw$kntl zat6^Y*F}OM2E-@;8{(tKhA@E2m6Ig2gR#O2YOU+?f`)Nv%&Thmce6AKy8pg0lM{YX zwct_YR9uI8=JEHbO`6FJ4;4IMjfZa<5AtpNKyCXN3>Qc%^axpKzHZrFg7{xwAiqsk z!4Z~q?$mXE?>r|J*>QZdEe>}$p!wX z?z2K!qxZj#3iApK5gh(WnBMWlPqcf+Ex9`Do;@lsJ}OgfC!&ctS4|clW?ndn<8G{T zpYtR3DhuTvn=1|Ca#Tdynl1H1lW$dM_@qN$bvc$;#{MDj_l{N|W_tGks5M6yRI&vY~ zk$l%Gi8O+da$A#-mRq~%3{Gn4Fdf8{qX5+z7(%~}l)SC2hqaov9RbCNIZ|UPZ&w^t zC-i{8G;Xubj>2#yO|SS*nGHGxJDUm<8oA_^Bpo1;4ok2(_83l{6q%_!rfREtEBGYV z6w2|=XK`N&Izl840OGu{nac1A$zB^Ncg1u<$pTJ1^JC60W-3FbSsIF^dmJK+3#!bu zdEhY>T|V>mtOx9PZjaqF0nY;}MiRr%e;Wk$MuFX3Ax4+t{nDrMm_D*kW)2J2;OiFo zQX}^T_QT8lm7BPG8lWKR09mX0yTeR(+>zAd+Pqm0rjLjvBZ4q%F7cGQ8PN*c;K&>B zyP8MA+3aZfgyVCDuLo@BzsoV0|6sX)$yAVhP^A_IwdnajGLzxQY@savAk1fUm~Oy^ ztH&1g8N#o%J{1h>=4GiYi|D~WlW~Hej}*dQf5JdHnE_ch1UqxIU#o9noQjk|(Wve$(Fi#odX1x|@)gNStr)3^K zBk>VzX%-s2KCgz<30~wD2p{im;^Epi3TCN*!{3F*v1*I;*;JSrxWVLYwg7F!eVXf0 zZS6wG66QNXqc$8I{ik7MBCL02+s_qcR4lzTb<<@GR-RPEtS-&eX_!9*8wPhYWrU8r zv+%5ZepJ)As#oz-5e>zx$=bNT2HhbnNau^Sifm&%9U(q^1GROdwm(-m<` z7FRN$RCVv|lt&~5a)$t7k@-`F%&gV5j|c8>rZE*R>m!bCEfLr^g6}T9QokD~K1AH# zo%JKzYCrI>8l=-t?i|-X-9T#>!#1?-jAH}kb$A6S1vd5IR{^QEZ{=GqsgIMY79Mfw zt*@@3%~2`!_<}4i(Qg};mZ6&fZ?O`>?_H}GbDJ)qZJq|kN=B6)x=X-_&w9jmg5C)6 zsjagRK>=~QS_q^m4NzgyA$LEzRkXcp^6La`qC*DT&+BLwCN7%z$a=f*=|20Z+~2Q8 z)o592>o-DT?8`RlFy2pyjh&tv(m?B!Py5506;cU3UOEjgEjBcz*I|9Z#tw@@eo7r0 z>5(lW$UOGty=u_vOq{xmcQ31p|E;-5IfFQ=HF1W@d^t9TP(|Nr!SxcmW)ptXn-s6b z`gGY$cMmnPIorN)K~9q{GTYnkleIw3sYq&%qS|n-KG@MyTQj{)37*QW7yfG768ZV zIBbm4s=vnWqN5vlKvEZ#b3i>~NO;r1m^7tl$tAb&K6g#l;Ct``5yIA<>vUVO^A&eq z%eGOruHM;eUA~p9k0-(!z1M9+apWLT$h*AP>AP3mnmycc#_CLY%{%a-Sdw3 zC|iXU>23O66OC5kLY4Sj`@iN#_t35IV}CP!0l%$s4ILZrM{J#8k_M~ub46Li;3=lL zz~PCp0=-H6x~?`!uls!rqj7lw{amf+hD2vQo?8%!Im3)_X`#z|hfJgPy(R+!l|%Y? zp)@pft?eedzq@sZ{2Q?GKdK$#>#85)jDCCL0CW$7<^* zh|Hs?5BrU-uOX~#gj@0UoxjnHA)1Z100b#x3t5IfCw|`lVsWH?TJj~3Z4~aDPS$E= z4gdX#zk--qyrZvAjjz{`V`IENO#gc!clEu8Uz0k8{$UhJZsOms!+*YiCZ5t`VGj|i z-kPz%oFNWglOsKVA7{|rkgiQWJD>(8OpVBEs$gHga0RjCL+LwU&yTFh*+orPVT_Ik z9!$@ibUU@xXW#uNKLd>b9&pu(Q%!9eqedDp%UvAXYV9VOhSq|$OMcpdWw@r*3SgB> zw`1*FMH`j0!QY&&18qq`wbD4C0+bJiN7fX8*3)+Fa{+|?6rwU>^vq-Z?E$t`kr8}0 z8lCyx4QJW-;G2fM6P2x8`Z~xYUv*A~dTw%mh_m_#1w~u!?E_;Eqn0v8vzqvrj;+fr zYIYK%zYSu5vbRAL%e7vLRAC0BE>b`ZD&LHG3xFl?dxrs&AZ`xuT1x6YWO}A^U}1do zflwLm4>$&NQ0MGu18AeT%J{nvWWaf0_+_DgrUgxIn;{}^LG=>iH7Nc@__oHuq!FT} z#*Mu9=fAn+cmc#MOFIeAU}y2JO+VC$A}^k|-$aKW?Oa|!Dk~}!;Qri$lDUa9`~V-J z*#-gTLzAX9qiRn|YqS_U2MTJ| za)v9x+=go%oR5WdRY5SMiH~*#{lBAx+Z2@nxRN*Jn2RL>pEyBYGtGiqbw*mITyq$s z(*TgaA}Rw1cL%XOp&t(-d_nmzv9Gjo{x+3)*0uk*alYvbhcOD4%R0EmkH?$!Gc=F7&Fs)`yoj;!_8T>VEeof)Q7 zGNve%htBL6N*g8qOy=p95|F`!A~_{}=oy^g3rwDeHX3f^=x2VRS)cu|rNHLkGneFE_<5QaPdwYr8VDv&7lIV&|NN(WvQqP?D6-HUxGUxN3WSe$=Pf-R?gAqEtVM_QM&?GrM|6OX~|Qu(dewBk)qJKq)>G zXk|+b!MEHg`sV-js$g(A{Rh4fYk}%E-R&Wx={>PSN#W&jigv@2gmpm?+?!S_h!}6` z4lQK@X1sH}&!Hh&XS4lKCobWyT8?yX=bfaJ^Da|*4kt~{dpls{ z-$%VJ&`f^$&w0}{ya}gfgx#UA;~v-FdzuCuA@1QCoIh0hNM2U3b#drNQa@>Iw0pNK zZPfhY-_7il3y)j4f%sJK78EGJcy%{Odg}2uk^MIX53y=~+sV;DUf0Up~(Wm?r zs+smmBk$Q)UtQs=u1Spk3V=ER0sj>@!?z-hki}_g&K!scc(MN+%6LA({jn==kX6Kj z&0dV`JZqShR|~;=INteVuhK7~9r`Lfp9{b?JfHl9A*wmRNA)k8p)~pVUA6gT!w%PI1Kc zeE0g*Cfff3_Oo>>`Jl&s=<7lMGrTtKoc9{r{5Tz+w4eW(+82VQnpg{BWtV)WU42G` zchyEi3+ab|oi?>yh5`icizzYcfOZrl8$}e%2uqVx9;}b~$D5~T39t6iDhGMXFP5Z; z^US#6RlKYzE8>g@P?gy9eWI6B$eg!C5Dl76!l9C(aq~9 z+us3U>k(RMCt_O%(p{>wujFRT(IG^igY}Y;aXRG3k1&&dCy#dJbwH`TpSZj%M>aw1 z9`Sz8P|S(2x0^yvrZdP`rv8YXQW!FepOhrU+V=~ayjhFKkYcXP zs3b7dC1oC`-7vv9gajy71Dh$n2egcuDb~C-nJ5yN>H60kK2*RYL^W00}L_ zkOa3X$a83D_Tz}zmRVG4CNYgSqN>>y+Jpa%2z(LJjqVG=r(NU~F45VrdNv5j_30<> zf+hsm5qjuEhtHtDTnF(pAFwyoAz)K|@2EJUybb|(HMLv-MAk5$u^=Y?i=AavT##%G zlcRPRd1g%p#y&B!ZR7Da09(5OAkUZ)uRFwQlLBinHzKifg;-*~e)?g{`Ui&Yn#NJy zUIcFFgCigfgTnJrW=7M55GWC|k4o!YEasp^W{c-Y!p5THIeS`ZOa-X6BQQQPUSuxB z>(qd)66mkr)DC{DW6T!qx;- z1BVdTe1Wd(mti`;JRV}xl8#yfJ9doA_;f8n7b*GkXgPrDjN9VBceOz^A#peAgA&mE z*aqOH-nZt?d_Dpgz+L!WapS~p+tCG|b~iYwWg~pR_s_o_1A*=1M6t@OsPhpUrhi4@ z)>!hyU#h?nWY+7*y$8MDuc8ZAXvLbO5tJDd(7z0=N|Fjnpe85;AYV`L+29B2Yd_v_ zS9cM7lG%s=%YE8@%tBcn69R!WTt#;{2uI$fUK&s^;kx`&`WVRpC&Agv94aH?naa}MU_9nPFW*)l%$4p4R;>!o7TG%%qWxE%7pJ4~NEfPjt^0&42dtVS+5f?y z;~Y*J(U}?02JO?739RZb&PvlTMVqW z_h4s&k9Iue1ExYha<*P36%8p_=exR`7SiYVxm>uaT*reMDEWF}D}O1|rBH_F)s)hK z{Gv(e#-XY0Mo!HM7$kvIiKgTz%L;Bf8D$)BGIYwR0mp)pB`M-Tu?zw+6IU5!sk2e} zrk3NGIp}NCqUE_v&-RvWZ+*srWFkBw9=tvd762<65Ktu4L?XX|ClJ|Bi>p#kvQrlPcV7P6~E{CB6^M;B1m`2349q z_);eptLzz7&_;NQNb699B^}!>b!2WbN85#l&nL@?T$d(*?+>qBTOU#x?Zj}S_Tmi4E@B}`I{O+sV>15FIWSrqS@)(+yq zq&XSo3ZtEas{PW58s09tO&>nyqf+Iqi_EKyb0LM(WNCECzkNuyKVIw7JbYz*V;G;@+qS)m$urdRZsoAtFE!m3fi<%7}E}AGh)rc zwL}#?rroz1nV@JWP)%b$azk0nW@p(I_n-#uC;Fhx z!FC`$Z${^NPkg`*-ECF$Wv97c2X}jfEh`_eNt0k*bWlcoGmnPXs5SCk>L%%Qt_dqA z{KY3P6w`JNb?Pm&2!0h-Wcud%!f0Mu-~MyguaY^{iW8j^t^9#y+j{iF6nr||Zq_Ng^ukyZJ?{`GZz{%e%Vcm3fcxhmLW2}e?fy(${GQA#_t<<% z+vB+pBCX|Nu2cUUqjlkD`jg?u*M9673in7%6yAtxTFo)Q#Rv!A6%yUiUv#^j&L^|T zn5UNg;7#>l$>2jg`Kr=lH^F{^lqaIot=X;9D!PhP9SVfI-P5iq{5E#l3893KpE=QroxYieKSv(kQt1IGSqp14VYgo#?zbC5`hObw= zg5MupbU6%vrFz$5!3_=}&H=82{L<1+k=yq2F?-jb(n>PsSX&gPWEfkPP9;2288rH$ z`!30&$RcZM%z(*gIl93g$~$trv*KgBqz`1jrD&~Z(KJv%^h-y{Fgwg|iJ)&PTOQN9 z+WWao(yll*G4Fz}O3IQi`WlSH>^ogP#DaC{GIPrFZ4z9nYr1}y96^tB&m~cFZku`% z!2So>s^7m`ebW@3&9ftGSUhdR{5XdSOh8#27@e<+A(pa~&J3_dN%I~GQdu0oU?7pF zj;*{z1{@D;p5@fcYGUef?t~&H9=fWat2PG+mu6rk2^=tv-~;EoFsyw-??Th ztUsdP?>UG#hCjzy;sTSF)$_{lw*7e^m \ ) +- [x] ports der unifi untersuchen +- [x] setup acme with dns challenge (issue tomorrow) +- [x] configure dhcp on all unifi devices +- [x] unifi dashboard - define all vlan networks +- [x] add to opncentral +- [x] fotos machen +- [x] ips/ids anschalten +- [x] backup via ftp to nas if possible +- [ ] change ilo ip such that its in the mgmt net +- [ ] unifi cloud key mit cloud koppeln +- [ ] Switch und APs in IT-Glue hinterlegen +- [ ] physische Beschriftung anpassen + + ## Kerio Features ### Network - WAN: 10.0.70.2 (FritzBox PPPoE) - LAN: 192.168.70.1/24 -- VPN: 192.168.170.1/24 +- VPN: 172.16.70.1/24 +### DNS and DHCP + +- [x] domain name: ad.knoppwassmer.de +- [x] query forwarding: `*.zvelo.com` -> `1.1.1.1,1.2.2.1` ## OPNsense ### Network -| Name | Interface | Network | Note | -| ---------- | --------- | ----------------- | -------------- | -| WAN | WAN | 10.0.70.2/32 | FritzBox PPPoE | -| MGMT | LAN | 192.168.50.254/24 | | -| SERVER | LAN | 192.168.70.254/24 | | -| CLIENT | LAN | 192.168.20.254/24 | | -| WLAN | LAN | 192.168.30.254/24 | | -| WLAN_GUEST | LAN | 192.168.40.254/24 | | +| Name | Interface | VLAN tag | Network | Note | +| ---------- | --------- | -------- | --------------- | ----------------------- | +| WAN | WAN | / | 10.0.70.2/32 | FritzBox PPPoE | +| MGMT | LAN | 1 | 192.168.50.1/24 | | +| SERVER | LAN | 70 | 192.168.70.1/24 | | +| CLIENT | LAN | 20 | 192.168.20.1/24 | | +| WLAN | LAN | 30 | 192.168.30.1/24 | USE CLIENT net for WLAN | +| WLAN_GUEST | LAN | 40 | 192.168.40.1/24 | | +| OpenVPN | VPN | | 172.16.70.1/24 | | + +### Firewall + +#### Aliase + +- [x] filewave +- [x] mailstore +- [x] nas +- [x] sbxoffice +- [x] ad +- [x] printer (NEW IP: 192.168.20.10. OLD IP: 192.168.70.200) + +#### Rules + +##### WAN + +- [ ] enable geo filter (iran, north korea, russia) +- [x] Allow VPN entrypoint to WAN via VPN port + +##### MGMT + +- [x] allow 'mgmt addr' to AD server via ldap +- [x] allow 'mgmt net' to AD via dns + +##### USER + +- [x] allow 'user net' to AD via dns +- [x] allow 'user net' to nas via smb +- [x] allow 'user net' to AD via ldap(s) +- [x] allow 'user net' to 'server net' via https +- [x] allow 'user net' to mailstore via its web port (Reverse Proxy in future) +- [x] allow 'user net' to vwlizenz via (any?) +- [x] allow 'user net' to filewaveserver via filewaveservice ports + +##### VPN + +- [x] allow 'vpn net' to AD via dns +- [x] Allow SMB for VPN Client network +- [x] allow vpn net to server net + +##### SERVER + +- [x] Allow filewave out + +#### DNAT + +- [x] Port 8462/tcp from WAN address to Mailstore IP NAT +- [x] Port Group "Filewave" from WAN address to Filewave IP NAT + +### Authentication Server + +- [x] AD coupling somehow - DNAT from sbxoffice to local AD via LDAP(s) + +### VPN +- depends on: Authentication Server + +- [x] Setup OpenVPN. + - [x] Self-Signed Certificate Chain: Root CA, Server Cert and Client Cert + - [x] setup openvpn server + - [x] setup client certs + +### IPS/IDS + +- [x] setup and configure surricata - very heavy on resources.. need to be tested + +### Content Filter + +- [ ] Recreate - if possible - application, web and https filter + +### Reverse Proxy (Web Server Protection) + +- [ ] projektpro +- [ ] Andere? + +### NTP + +- Server: `srvu-master.ad.knoppwassmer.de` + +## Archive + +### Vor Ort Notes + +1. Plane Switch Portbelegung +2. Stelle alle Geraete auf dhcp um: + 1. [x] switches + 2. [x] APs + 3. [x] Cloud-Key + 4. [x] Telefone + 5. [x] Drucker (drucker muss mehr angepasst werden: dns) +3. Dangerous: Setze VLANs auf designierte Ports um +4. Geraete runterfahren +5. Neue Firewall anschalten und hoffen, dass es klappt