From 54f696e0b743f7b7306a41bba3de5bedab19949e Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sat, 25 Oct 2025 11:19:57 +0200 Subject: [PATCH] continued on dmarc page --- .../310-prevent-spoofing-dkim.mdx | 273 ++++++++++++------ ...g-dkim-spoofing-dkim-validation-failed.png | Bin 16614 -> 0 bytes 2 files changed, 180 insertions(+), 93 deletions(-) delete mode 100644 src/content/docs/ispmail-trixie/images/prevent-spoofing-dkim-spoofing-dkim-validation-failed.png diff --git a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx index 03513cd..ed2f4ae 100644 --- a/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx +++ b/src/content/docs/ispmail-trixie/310-prevent-spoofing-dkim.mdx @@ -8,18 +8,15 @@ sidebar: import { Aside } from "@astrojs/starlight/components"; -TODO: - -``` -postconf smtpd_milters=inet:127.0.0.1:11332 -postconf non_smtpd_milters=inet:127.0.0.1:11332 -``` + Email sender spoofing means pretending to be in control of someone else’s email address. This is a common problem with [phishing](https://en.wikipedia.org/wiki/Phishing). Often scammers send emails with a sender address of -something@paypal.com and hope that the recipient falls for it and trusts them. SMTP does not care which sender address +`something@paypal.com` and hope that the recipient falls for it and trusts them. SMTP does not care which sender address you use. Most mail service providers enforce that you send emails only using your own email address. But some do not. -And bad guys obviously could not care less. +And bad guys obviously don't care. So in 2004 people came up with [DKIM](https://en.wikipedia.org/wiki/DomainKeys). It uses _public key cryptography_ to automatically insert a _cryptographic signature_ into the header of each outgoing email. @@ -41,8 +38,8 @@ I don't want to dive too deep into public key cryptography. Take a look at the [Wikipedia article](https://en.wikipedia.org/wiki/Public-key_cryptography) for a good explanation. Obviously your mail server will both _receive_ and _send_ emails. So if you want to use DKIM (which I recommend) then -you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server takes -care of that. +you need to take care of both parts. But luckily that's not too hard. The _rspamd_ software on your mail server can take +care of both adding new signatures and validating incoming signatures. ## Example @@ -65,7 +62,7 @@ I need Google’s DKIM public key to verify that signature. It is stored in thei "s=**20230601**". You can use any number of keys as long as you create the signatures with the matching private key.  The "\_domainkey" part is the standard subdomain for DKIM keys. So let’s get that TXT record: -``` +```sh dig +short 20230601._domainkey.google.com txt ``` @@ -76,23 +73,35 @@ This returns… ``` That is the public key that I can use to verify the signature. An automated check can be done using the -"opendkim-testmsg" tool as described later. I can run it and paste the entire email including headers and body into it. +`opendkim-testmsg` tool as described later. I can run it and paste the entire email including headers and body into it. If it doesn’t complain with an error message then the signature is correct. Sounds good? Then let’s implement that for your email domains, too. +If you have skipped the previous section on detecting and filtering out spam emails, then just run these two commands to +tell Postfix to send all emails through rspamd: + +```sh +postconf smtpd_milters=inet:127.0.0.1:11332 +postconf non_smtpd_milters=inet:127.0.0.1:11332 +``` + ## Creating a keypair As explained above you need a **private key** that your mail server will use for signing and a **public key** that gets -added to your DNS zone. I assume that you have installed `rspamd` in the previous chapter to get rid of spam mails. -`rspamd` also has DKIM signing and validation built-in so let's use that. +added to your DNS zone. If you put your key file into /var/lib/rspamd/dkim/ using a certain naming scheme, `rspamd` will pick it up automatically: -``` +```sh +# Create the directory mkdir /var/lib/rspamd/dkim + +# Fix permissions chown _rspamd:_rspamd /var/lib/rspamd/dkim + +# Create a new keypair (use your own domain here) cd /var/lib/rspamd/dkim rspamadm dkim_keygen -d example.org -s 2025100901 ``` @@ -100,24 +109,38 @@ rspamadm dkim_keygen -d example.org -s 2025100901 The **selector** (-s) I chose is **2025100901** because that’s the day I created it. The first (01) key on 2025-10-09. It doesn’t matter though – you can name it anything you want. If you are lazy and unconcerned you could even use "dkim" as the selector and later save some work by not needing DKIM maps that define which key is supposed to be used for each -domain. "dkim" is the default selector if you do not use maps. But you will probably some day want or need to add new -keys so I recommend you stay flexible and use a custom selector. +domain. "dkim" is the default selector if you do not use maps. But some day you may want to add new keys so I recommend +you stay flexible and use a custom selector. -The output will look like this: +The output will show you both the private key… ``` -----BEGIN PRIVATE KEY----- -MIICdwIBADANBgkqhkiG9w0BAQE… +MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALhyevPohneucRGQ +LXgqtajXhDgOr9kvoX5igRuChC+j7Fxvwh4SuUphMKLynabAvcUUF951BgVB4PXU +Qoxae7cEkjWATNSiv+Eq0w+AKErdC+BFNDSTk74GZDBBhlroxyudk7QMCZ2nhiOA +/rY1LypaDQzBiRSV8zjcHC8E2Z5lAgMBAAECgYEAodSn9isVGBrwz8Udb+qhOoPl +WT3hogA9hGMu/hEUo6wCrNPNkI9DDXSatM2D7xP7LNhFXQR2BNTZaTcUMIsPMXZ9 +157tBVUAcnoRES6BbPyKC7k4dgSXxh687jhSgQWy+OZIU8IbJcoDXXsGjx+6Sb4W +Ilo9NMCF/QqxRFIne70CQQDhNC4YasFOdJyWACxIbFBt+/HhO5+UboUIrZU5nde7 +N5HEfnP3Ow2C6vdNnGWiv4YpobN7zjz+lFj19rlWvmHDAkEA0auDQVfIiLEUrKvW +TdhbscpEoYHP+AlM48C+QltKVk+eAnJJHNbBYMVmCmXafgMzFh8QhgG5WXKSlvtz +G/+UtwJAS4QL0PQ7TeucdlAoiUCI19icC0LLCCLnSTmryF49cPH5V0Jv8H9E0Jmp +w8Sl8CT5AAzQ+rr1iQiFrDTHgWblsQJBAJGEtSMrts1QAaZZ2PHMQM+jL4DcZKek +ZM4JXsMVMwG2XlcaVK4EStBMEKcUy9D7jYBD7SbkmWyAPUc2m0yKVP8CQB1zxjA0 +Z700vkWGKhwY4DznuDGjpU9rvQw7pyCJ3TYDT3ACQePmGmVeCtyETJ5XvFV2jSqf +o9J+GsdbljSnnSw= -----END PRIVATE KEY----- -2019122401._domainkey IN TXT ( "v=DKIM1; k=rsa; " "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZ8e4RtsvuvsgXyo3Jr63twdx3Zm2RtnYPf87wba5ZnFP0sQIagjJ0R3WL+djKhM5EteBeboTeaflLR+AUKWJdQnL5jzGil+yWThH5C+ixhkdFZPdabkxBji+3r6uRxJKBsN0gy2/+Gp4sGs7lmFgioki9OLgQnzzFh2nE/MSACwIDAQAB" ) ; ``` -The first part is the private key. And that includes the "…BEGIN…" and "…END…" lines. This key must be kept secret and -will only be used by your mail server to sign outgoing emails. +…and the DNS record containing the public key: -The second part is the DNS record you need to add to your domain’s DNS zone. Let’s start with that. +``` +2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;" + "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ; +``` -## Adding the DNS record +## Adding the public key to a DNS record Before you start signing your emails you must make sure that the public key is properly present in your DNS zone for the domain you are sending emails from. Otherwise the recipient will be unable to verify the signature and may incorrectly @@ -126,7 +149,7 @@ assume that the email was spoofed. Take a look at the TXT record. It will look something like this: ``` -2019122401._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; " "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxenHupkYLPmFMbJjV9dQICKUl2xH/aexSRUwCuw7TJ9dkddqIN+6tyw4VKhnW8R0/UlbzlSFLmVgMU0uUkwTtVqyDHhtSU7LV/SkVYmUst4dTUF1r+8PvhAm7vobMYKdwvRsOq27ABtZc8P4oU2XXHqqa6LU8s4sNxs12hLW9swIDAQAB" ) ; +2019122401._domainkey IN TXT v=DKIM1; k=rsa; ``` If you are running your own DNS server you should be able to copy this entire file and put it into your DNS zone. @@ -135,100 +158,101 @@ with a host name of "**2019122401**.\_domainkey" in your domain and put the stri the value. In my example: ``` -2019122401._domainkey ➠p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxenHupkYLPmFMbJjV9dQICKUl2xH/aexSRUwCuw7TJ9dkddqIN+6tyw4VKhnW8R0/UlbzlSFLmVgMU0uUkwTtVqyDHhtSU7LV/SkVYmUst4dTUF1r+8PvhAm7vobMYKdwvRsOq27ABtZc8P4oU2XXHqqa6LU8s4sNxs12hLW9swIDAQAB +2025100901._domainkey IN TXT ( "v=DKIM1; k=rsa;" + "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ) ; ``` -Be aware that the string you got contains two strings "…" + "…" that must be merged into one to work. (The syntax with -quotes is meant for a DNS zone file if you run your own name server like _bind_.) There must usually not be any _quotes_ -in the record data. Depending on your ISP it may take a while until the new record is visible on the internet. You can -use *dig* to verify that: +Be aware that the string you got contains two strings "…" + "…" that must be merged into one to work. If you are running +your own name server with `bind` then you can just take that record as is. Other software or your favorite DNS provider +may expect a different syntax. In the end the value of the TXT record needs to be one long string. You can use *dig* to +verify that: -``` -dig +trace 2019122401._domainkey.example.org txt +```sh +dig +short 2025100901._domainkey.example.org txt ``` If you get the TXT entry like as follows then you are ready to enable DKIM signing in rspamd for that domain: ``` -TXT "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCxenHupkYLPmFMbJjV9dQICKUl2xH/aexSRUwCuw7TJ9dkddqIN+6tyw4VKhnW8R0/UlbzlSFLmVgMU0uUkwTtVqyDHhtSU7LV/SkVYmUst4dTUF1r+8PvhAm7vobMYKdwvRsOq27ABtZc8P4oU2XXHqqa6LU8s4sNxs12hLW9swIDAQAB" "" from server foo.bar in 24 ms. +"p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC4cnrz6IZ3rnERkC14KrWo14Q4Dq/ZL6F+YoEbgoQvo+xcb8IeErlKYTCi8p2mwL3FFBfedQYFQeD11EKMWnu3BJI1gEzUor/hKtMPgChK3QvgRTQ0k5O+BmQwQYZa6McrnZO0DAmdp4YjgP62NS8qWg0MwYkUlfM43BwvBNmeZQIDAQAB" ``` -## Enabling DKIM maps in rspamd - -As explained above it is advised to use DKIM *maps*. It’s nothing fancy. Just a simple file defining which selector you -want to use for a certain domain. rspamd will assume that your selector is always "dkim" unless specified otherwise in a -map. If you used "dkim" then you may get into trouble when you later want to replace your key. DNS is a sluggish system -and propagating a new DKIM public key may take a day. Emails signed with a newer key may get rejected while the DNS -record is not yet known everywhere in the world. - -Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. To do that create a -new file in `/etc/rspamd/local.d/dkim_signing.conf` and make it contain just these two lines: - -``` -path = "/var/lib/rspamd/dkim/$domain.$selector.key"; -selector_map = "/etc/rspamd/dkim_selectors.map"; -``` - -The configuration is pretty self-explaining. rspamd will look for the domain-to-key mapping in the *dkim_selectors.map* -file. Create that file and make it contain this line: - -``` -example.org 2019122401 -``` - -That’s all really. rspamd now knows that whenever it sees an outgoing email from anyone@example.org it will get the DKIM -private key from /var/lib/rspamd/dkim/**example.org**.**2018022301**.key and use it to sign the email. - -Reload the configuration: - -``` -systemctl restart rspamd -``` - -This method works well if you just have a few domains that virtually never change. If you are rather serving random -customer domains you should consider putting the keys into a Redis database instead as -[described in the documentation](https://rspamd.com/doc/modules/dkim_signing.html). There is not yet a way to manage -DKIM keys in a database like MySQL. - - - -## Adding the domain key to rspamd +## Adding the private key to rspamd Take the private key that was created earlier (the multi-line string including "`…BEGIN PRIVATE KEY…`" and "`…END PRIVATE KEY…`") and put it into a file at the location where rspamd will look for it: ``` -/var/lib/rspamd/dkim/example.org.2019122401.key +/var/lib/rspamd/dkim/example.org.2025100901.key ``` The name of the file has to be  DOMAIN + dot + SELECTOR + ".key" like above. If you name the file incorrectly you will get an error in your rspamd.log file like "_lua_dkim_sign_handler: cannot load dkim key /var/lib/rspamd/dkim/example.org.dkim.key_". -Make sure that only \_rspamd can read it: +Make sure that only the `_rspamd` user can read it: -``` +```sh chown _rspamd /var/lib/rspamd/dkim/* chmod u=r,go= /var/lib/rspamd/dkim/* ``` -rspamd will automatically pick up the files and does not need to be restarted. +rspamd will automatically pick up the files and does not need to be restarted when you add new keys for further domains. + +## Enabling DKIM maps in rspamd + +As explained above it is advised to use DKIM **maps**. It’s nothing fancy. Just a simple file defining which selector +you want to use for signing for a certain domain. rspamd will assume that your selector is always `dkim` unless +specified otherwise in a map. Always use a specific selector so that you can later add new keys to DNS without getting +into trouble. + +Using maps is simple. First we need to change the *selector_map* setting of the dkim_signing module. Create a new rspamd +configuration file: + +```sh +# Tell rspamd to look up selectors in our mapping file +cat > /etc/rspamd/local.d/dkim_signing.conf << 'EOF' +path = "/var/lib/rspamd/dkim/$domain.$selector.key"; +selector_map = "/etc/rspamd/dkim_selectors.map"; +EOF + +# Restart rspamd +systemctl restart rspamd +``` + +The configuration is simple. rspamd will look for the domain-to-key mapping in the `dkim_selectors.map` file. Create +that file for your own domain and selector: + +```sh +# Add the mapping of domain/selector (use your own domain here) +echo example.org 20251000901 > /etc/rspamd/dkim_selectors.map +``` + +That’s all. rspamd now knows that whenever it sees an outgoing email from anyone@example.org it will get the DKIM +private key from /var/lib/rspamd/dkim/**example.org**.**2025100901**.key and use it to sign the email. ## Send a test email -If you have another email account at another location then you could just send a test email there via your mail server. +You could either just send an email from your mail client (or Roundcube) through your mail server to another email +address. Or you could use swaks. Use your own addresses and password of course: + +```sh +swaks --server localhost:587 + --from some.address@example.org + --to some.external.address@example.net + -tls + --auth-user some.address@example.org + --auth-password your_secreet_password +``` + If you take a look at the received email it should have a DKIM header now like: ``` -DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.org; s=2019122401; t=1519400838 h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding; bh=kpYel1IlDvqXEUc0SyIpXbMte3XpQOCXHl+zTyHQvGc=; b=NEUyWUoeKE… +DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=example.org; s=2019122401; t=1519400838 +h=from:subject:date:message-id:to:mime-version:content-type:content-transfer-encoding; +bh=kpYel1IlDvqXEUc0SyIpXbMte3XpQOCXHl+zTyHQvGc=; b=NEUyWUoeKE… ``` -![DKIM signature verification failed](images/prevent-spoofing-dkim-spoofing-dkim-validation-failed.png) - To verify the signature install the _opendkim-tools_ package, copy the entire test email (including headers and body), run *opendkim-testmsg* in your shell and paste the email (finish with CTRL-D). @@ -238,20 +262,70 @@ Unable to verify" then double-check your DNS record. You can also use websites like [dkimvalidator.com](http://dkimvalidator.com/), [isnotspam.com](http://isnotspam.com/) or [mail-tester.com](https://www.mail-tester.com/) service to verify that your signatures are working well. -## SPF and DMARC +
+ Click here if you do not get a DKIM signature… -Adding DKIM signatures is a good first step. But you can take it further by telling receiving mail servers that they -should not accept any email from your domain without a valid signature or from servers that you do no operate. There are -two concepts that aim to help. The older [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) and the -newer [DMARC](https://en.wikipedia.org/wiki/DMARC). Either of them means creating a machine-readable string in a -predefined format and adding a TXT record to your DNS zone. Receiving mail servers can check those records and take your -advice (as the domain owner) what to do if the criteria of the email are not met. It could accept the email anyway or -flag it as spam or reject it altogether. +Enable logging: + +```sh +cat > /etc/rspamd/local.d/logging.inc << 'EOF' +debug_modules = ["dkim", "dkim_signing"]; +EOF + +systemctl restart rspamd + +tail -f /var/log/rspamd/rspamd.log +``` + +Look for any errors. And check that the correct key from `/var/lib/rspamd/dkim` is chosen and used. This is what it +should look like: + +``` +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:185: user is authenticated +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:407: use domain(header) for signature: example.org +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:427: final DKIM domain: example.org +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:48: add selector "2025100901" using selector_map +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:53: set key to "/var/lib/rspamd/dkim/$domain.$selector.key" using default path +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; lua_dkim_tools.lua:53: set domain to "example.org" using dkim_domain +2025-10-19 10:23:40 #1806716(normal) ; dkim_signing; dkim_signing.lua:130: using key "/var/lib/rspamd/dkim/example.org.2025100901.key", use selector "2025100901" for domain "example.org" +``` + +One caveat is the handling of _subdomains_. `example.org` is a second-level domain. But you may want to use +`service.example.org` for your domain. That's totally fine. But rspamd will strip it down to `example.org` and use the +DKIM key for `example.org`. If that's not what you want, then add this line to `/etc/rspamd/local.d/dkim_signing.conf`: + +``` +use_esld = false; +``` + +**esld** is a rarely used acronym that stands for _effective second-level domain_. In layman's terms: the part of a +domain that only consists of the rightmost two parts. + +
+ +## SPF + +An additional way to help prevent spoofing, is adding an [SPF](https://en.wikipedia.org/wiki/Sender_Policy_Framework) +record to your DNS zone. SPF is an acronym for **Sender Policy Framework**. + +But you can take it further by telling other mail servers that they should not accept any email from your domain without +a valid signature or from servers that you do no operate. There are two concepts that aim to help: + +- , the _Sender Policy Framework_ "Which IP addresses are allowed to send emails from my domain?" +- [DMARC](https://en.wikipedia.org/wiki/DMARC), the _Domain-based Message Authentication, Reporting and Conformance_ + "What should the receiving mail server do if the email + +The older and the newer . Either of them means creating a machine-readable string in a predefined format and adding a +TXT record to your DNS zone. Receiving mail servers can check those records and take your advice (as the domain owner) +what to do if the criteria of the email are not met. It could accept the email anyway or flag it as spam or reject it +altogether. Let’s take a look at a typical SPF record: ``` + "v=spf1 ip4:157.97.194.11 mx ~all" + ``` What it means: @@ -279,9 +353,22 @@ allowed to send is a little dangerous and a little inflexible. It is far more in your domain have a valid DKIM signature. Such a record may look like: ``` + "v=DMARC1; p=reject; adkim=s; ruf=postmaster@example.org" + ``` However to create a proper DMARC entry I suggest you use [one of](http://www.kitterman.com/dmarc/assistant.html) [the](https://dmarcian.com/dmarc-inspector/) [web](https://www.unlocktheinbox.com/dmarcwizard/) [sites](https://www.agari.com/resources/tools/dmarc) that aid you there and explain the restrictions and extra features. + +``` + +``` + +--- + +## DMARC + +But what if someone sends an email in your name but does not add a DKIM signature? Would it be rejected? No, it would +not. With DKIM you can prove that you sent the email. And other people cannot fake it without access to your DNS zone. diff --git a/src/content/docs/ispmail-trixie/images/prevent-spoofing-dkim-spoofing-dkim-validation-failed.png b/src/content/docs/ispmail-trixie/images/prevent-spoofing-dkim-spoofing-dkim-validation-failed.png deleted file mode 100644 index cd02062664ac259e0bb222edb464068d6773ac74..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16614 zcmZ|1Wn9!<^eqlZNe)9x4h#*VASoct&YuX{C>$illne zjWFf($MJ9KW9TmEIcBM6HBC4F1&-|db#%@*2kqy2@8z#AUdhyE8*LBgN^OXW7Kv`; z2FU5AvD|;Q`_MWvoSmJR7|#SHPX#-u-j!%|Qjmv0@bBR%VniVLxZp#dHGVX@q2*|8 zngII|0?odQy(3bdj`K+j`rpL{TT}3b*U8?;{mQ8-qbhPH@wY>H5(2ZLP4`9OY53k~ zyb!Dy$QG`3o~kU}{$5+VJ^ilg*}R*?M{;$yfG8Yqzu9^_0`If(qR{kKCi(sQ-hM?P zr+hgd)mVHpvs&}0P_-rvs!6P}rm`oK`p$nYPjF@09&bJW+;O#6b-Qho!}ny$sOqJd zOB-$W5&>?~XYe4?JAPr;2Wkpjc=-H}-#)zKM=8C@zT~%@fHrYj@?TAI?ux#-z2Euo z^hb-iBPFikDvPwwL%*ev<~fhfKf4BkV(T<`53YYlwf()^nOaSGP-7gEppx<#OtD7# z+3wrD_9LBcjUQD3+y~iKp(Yky{ahN0i|rc)AErj7Fp8?4?9S>hE*G*>bl&;foW`kEY56HIW~rr-K@)%P z)0yQ|xh~smdA!~J^?up;8&)yr%>$etYIq?E&5<5ljlViWIB+tbz|zknhmtnu?v& z=DhDro6>3hH~So>*#!<~8yu=8bnXu|aTq~+!=9b5#0rQjqw6VggV(AI-=z-?@9wlE z?&nB-TcBn0?|G=Ihf740^Ko#+=cfk7$Q&6HxR$2I5kTxTNrC5TpTzcHQO8bCbDG_A z)-HQX+r4gA<(13#n(dWXwo_dU_-l%2qS<4q@Dp!e!A^K&%7eeg!)Y61#>>p-uVY#H zZ;uM@ABFwdv62oy{CtB_>jLg%gbBGiHTW7!IpW2zcB&AruX6UouP8i?huGYENbE8* z%J`Ji^M~*Eil<+nUvM4_WC>L5cU%oK#Bip_=$-6**A;V{o199qF|VLmxEWCt_SXcM zsxA?sphepx1IzHM(0_l<47-Apn6e_%*ySN3f3NoU`ChDU7N<<(1`q!5S|3pHT54V7 z4Wb_WaeuExDdhJTqMj793O%lqU(HK_JO}@-I{)c6xqKIQe+x$HywHNIbR2ur^Btk^ zk9Zlgz0le~L2;+)Y$?o&#e48>S$C=V3y$};{ZQZCy53t$vR{HyWKVN26BdI0_#fQn z%cOm`OA7rlH&=V)u74}}qN&v2LPg^RishD}7wf7?@A1O+Kb=K?P8zK@BIbCo*Rq;u zw3dI;xm{Vc`y+gkMiZYk__xBUXixQLdSOdu#)z=fS%*2lBG;uP$g$sIfEr8i?=N*| zsf@hHzMZKmhjtFO`_HN^8@U=X;h|s2B^+5OsDm!I$_?f}xM|00Fn%MJx!P^0)Xo!E zZGwJL$4NDI=ahd!i7Uq~ZZ|;V`-Ol$hladFt0P_ViQLhk=yn&W@VzeDPkA5r+P*QN z8b}<(+^sj?o>RHstuPxXQNv+totM%pC&aIBZ?VF^+EvCmBgQl0eqJQ5!PdfrqGXjZ zJ|O51sh1ilWa=5nRN)qw15RXXLrA|YvC_Ei&EQGrw}@sdRBbVn_5%v#-f~mpOBPII0zLfTUvT$;gxCHDdKzp|xXEAU`Nc(g!CPP=wBqKP}UfS;qZoh{vd{{;BOj~d};)z#E zt9g$Pdp=nDo{an12LmS#QLoB$3Y?E~9*tN?K-CU!bjp4>TMXLy!#1py;q#nUTs+{= zmSs}eq@4&su9YXQogFjkRBZ9_S)k3RN&iT`lz#0Ry`b@vX#IyVS{t|bwjU>KX9^%; z2d~32iCP72coq~^w7<+$vH@=Aoc6ecv#qL&5 z3|jUJt<%&0p6Db&u+;M36FY=4qhPt11HbIDVjtMTSZHE4fL#FxH~OG9Bn+wRsbV_g zv!|+xL0?kap)a(%p6q8_lT@fb5sv5 zG@(6dOh$elCxYpi3KFbdcBm3?FXNHb$HM^uU;kh9R>7}F!YG&}AJ!TNe1#=GupeYl z5y4lEKp20a|1$bo$?v5J2(2Hm0gQry*Rs9E+IO@>omyx^-G@QLX({+9X|4rXJY6C$ z_U?VD9^yW5GrnF)v;u~Xcpb;%n!Zd&8zV-*M4G0{SI&SV-&rzNfj|@Uc`My=s?lG0 zx?J7wCc~3eNw-*wf)CXVs*UeraluZf==a6oBW>B|Q8$5Yu*6a)u7!D3Q9#bO_KyGt-Wq1bJn(HIKf%lc(2yG!6&M%%g+$ahwdra0S zd%ND5YfnZ7Ukgr~p2~n$F%~Q$eVh5|bk5~+go;!3t;C|gQbzEbcjm2n1)g0u+rF|N zOusX8!K^+omw?=3(QET@`on>-3n$}>D$~f~S2w~m#)e*Y(_2*&5w($#u@f?^d`k6* zA))nQvHSL7N;pY5XeEYTkH6&ZYX%zPJf$mBT?#;VlfI?t zAx*Mg_33CBcm3FM(a&F6w?BiiRsi&{BXLK=mZ8cLaq9`Seh03!9kZ93eY%7YzB=0Q zN1Lxfkz9xmOKtmMJh#K-;CPy(hqt09cR;*`9` z^{b()jK%Or-2NSZ$U3;Y?QhaQW8{-2=c(~AyI!`ib}-l6jMe|<>JXPLtd&@6NoP77 z%q=K~Og`CPvSRU_e6$Uq1@Gu}4@<%!yLUmB*b$*kTJ-If1}IP69dpG^*`p-L)#C*` zhtF!mAuC+$7=6TbX9j$%AYIaf-E?sv_>hd@j(lzY7IT*ab%y5k>AXkaln(Jbo9f5_ zDoOSX(|BCP-b3!^4_P|zdjuG6wt+v=qO~dQBaGF10ciM@=02T*+4il+a z5_aeLtKRQalWr9vWC|2t@}XAgH%Pmv8a7xT+EYWD2R#EGS}?2U$I#j^KalL{s(f6b zXG$t_;1jR3-6GGIGU)pBtHkgk&25cDk>FNNrJ(JK^6gr?zi8itG7V|>FG=6Nb*WR} zW`EXJ#N38=1fDqmy5UfolyAE}kkyoc+esVNn-$(k3jO%+@0H)S(!GcgnIo+~ThU=J zbudFWQAf~af{3tp$|&gN(1<<1KyX|ExeB4$o0WZg>I{XL`R5~&(nZa39Xqx+s(&Nj z0wXGe57QG5xY`ywDA8N7=M@H9^l8XY=6uI+_N1YaOd=BWx6R*DvM-xHWv%nq5bMn$ zP31S~@kGiu^3q`9pIROf=%(A9cJStHQg29jE+@P=)kBiT(l3(-V^SreL&w#5Zldn5 z-p#rnvot#x9Sw8q^>3*6vR}PXDuSc)tR^oxX8C-wtGxR_VO(Ox#(^_^={&5aTRU=} z{Ga4T$wjq5J}in>rYcBWn9;F$!7Jgf#`2OjBL7OaG}T@M6U<%DN16*zvSls5KkE0m z_2&U8WP)J!ssT9NxhaCFGmf?qF(1)V1?kSobu%{l8T#fe3?^|0eu=`!4s&Es{q}Pg zsBZbg=Svs$&r9@?qzPgjP{e!>Hy^1qUFK?U3Z-2pI@Cs#mj(>`CaP|J=*g4y!diQ2 z2z-X;fhvMoUFJdR+271EZ;ARRZ2Ku|p#((+=LrEp-ek3!*|+DKdsLk|USeb2ND37P zyioR!tF)hYJbH`u+WP#1Nm@f1Y94m*So759b-{fxY~XtKJ2^-Q1k(N2|9%v0EeuIP zM+$F~Z0P)lD15qyC&dYsTH-+W~)wn1UwuG+J~f}=MI9}0}mEQ5ZPe!ZlQy4C){4f}vk9C-!n zM=@yXjXSt<%$&-ODa$O083N2qKYbEJJBe{H_)KaLsidAxZ_}i<^At!({0uxJ*iEHu^@)|W7Hk>=&5Ax2y(INUtVL0op$$*K6 za%nB1u~PRb`s*P8TW8DF8Rnp=3RWdyJaZIs=TBr=NirnWpfI;%eP+(>ygtw2CQ?*+ zt}6a7$UP;x?Uk>wI}ZbC$f>$G246IDvV3^@l`v$OCW2YSlG<6bZ`Y~3pv-7G-x4NI ze4>aKeoMl=UGp=fISqjscB>=VNRsnfL;Mj@FLOnt;(2}0qH*m>WHi+#4g8Ae|ulJH4uE9T#3mkgKR*a1!lrDsS}hD#cenfo(k|DXu`| z6PQI2k{?ILw(8BK4?P`_Z)vebwWABVkhTj{f{n(zT&7Q<4g@3CX|z(`^(ce!Hi%J7 zTCcm{!~FD4ePS-to9|5*%aSQkBP=u|Qli7#*%ZByNshU(fDFa==d-Yx#~ugDek9S~ zmJy|{aRaa$8QE&NB6i2$A{4qdm<3$bb|Ppc;-i(r4mcE=bH2p;{+ctOyw`Cr8ck04 zoaP`}J`LNNdF^m&y3NuW7Pva`XeJdF zeZYe9_Q}mAzw##jexRr*@{*t=wdKnlK`jg!K7t|L)&@5_-iC}K*r2@vH!mWRN<_DO z;wi%%Ni{z7!Rzz0E~dP=QBJ3C1Gh9wUHd#z#iG)`MBwANGcQQH_DG*8NZr$gtVWjDGv_oUjAi2_fCm5ek=OJKNozV>^pfoXV|8*vlb z>o-gv4W|7nm7|a_-&U)!z~2k=xAg zPPaJzL0zVx9)=$LhJR@PyUr!alLDUXC_DbLB+`bq%d9|KhnvMpTvE8R|g$Et?y@4HwcWzcXM>+$o`~{)VQ*EB8AH$|_L)SAv7a_YNHDIiK@# z=)EA18OFuC>cX33C;+54g zQaDy`Q=Ulsbr(RLo1>R<{>#WZJ>EDzLdcLz{%LXokt!K2HKouYTR(XJ>BV36!K5lJ zYv@F7g1;G>ipCY379Ji0caqQF*kVg&{- zWGm(xh7U8kCI5v5+s#WZeyfw`5Nqf@Oh=;%IS|kFVajq8x9;(lO5d`BW$5x_kjf2PR3aMz%3mMBPNimo|k{Wj3nA{dB3>*fdi z%$3HKwtl=>_uf;plsI04!#q45^Zx1ANkC0BwRbB~%9h+G820>YnL|IyR33ttIC>uh zhkV5bE;3Ot@Mfr5adbpHon++wipeoB5>nF5=!y??$4~xCDizL@Wwujpps4FmlFZ{! z#H07i9OvZyBny0qhs&qoccf}Gr4Y<0azs9{TS?x{P0l&$lZV7|1suE@@5iOPEejh{w(QR1?#*py1m3ZQ`3NDjz&lA zq5LP=h@fiwY=1lq7ahwb6L=lClJN<~1|R&pZXis0pic6&k^#zdT=3v-$rG4ibjAC} z@vkfq3o8VMyKhs2> zm2$Z%kBMGf#mJKqR3yrUTyCcN$D&PgIaSgaRuTmX6pd5;tXpJX?+-5_W6JdKPZTi} z!jKOsIhGiE-ufnV1bZ=6<4shvN0A{5In*x`lHsdr?CgSM1i0q^tQ`+W#1+1F=GH{H z3!m{{oh}-~Hi!%%5-@d(1Of+-;X0TXVDKn-vQ<7k9*X_WX^-)*RZg&IG*GG*uS1;Z zA5qu|xP&os+_#-q$Zi3An{>g%yXM6m0DK?vqhtTtg3&|)1+*$%2qDB zAbj3`QF{k9Vb&7VNBUXzNbhL_ZIP_H)k7{fKzk{)NzH$90jFe+r%;Dw$c>9NbMBT% zLp8}v_06yU9TbL7R3S`AcH{z0{<%B~VkH`61n~uLIW6ro`i4|GoaGQp@)51VJcbwQ zP|*l+2G8a{;cO)h_33rfIP_h^Vc+O#54XzK*1kUI+ki%OE#0-eCrEQJM)VZ8hYiF6 zcTVf84*-ltqurA8&!=gLpb`qP1Pndr>kQThm~OE#X|)LL?Y>hHELfCL(cOrj``=*n zl+WYYzgb00%U$CGXk%;@!2|KCtzZ!>JyU4=crE>ZE~5;-xU}}VdkVL1 zBjZ1+iIxJ=%T*vsJk0gD3bkA8> zXz>0@dW0?@d$;t3^O-i59vZAINflA(Fi7*?Afk8-37h$kV*9$6n>zoWmBIY9l!v-= z(PL^-YpF_&1MKk;i9c-N6agu>#5B~*p$8`AIxHu<4I`CUdIl0085;L?%>;E09}pQM z9)($FWJ%5mD7zf`Er{`QKv$ADI0(OduQt)A4*LIlQ(Dhw35o-b@EC}p2vqI+=8R3s z)K~_C*9UxDsteRS0Y|U>aDGMcy)j#LHOyv|$3n}aD!x!q5ZGRhqWmwN7RGxcGG<)) zs91GV_P^;U?Z5P7x`#b9E2o-|-`U+jaSG4BQ6W76-m0P}iD|#SuHR#mJ&l=T?A%ZB z@@&S2^3RBJ;9m1msB?chmy>#aG!!1J)$w9>8lRB;adYE_6XYY~&iFWC;bFxNA zyx=z&D0!P%mxzOr3x4yG0q+5dNrU@4B6nBm72s__He4vuhBT+GPX2nwaCulG|1@q| zS;7t+TWKj}aBzs}d=+{rljqo(qw<9WkdGk~CQtn|-q4YLPs_(U5Hehwsx+85{P2{i z?RFXT#_|_Ac@cs7uT*zv01@5D=3s^U2@;{vzprGTM`b!!rioHY%ub|OtI^A+h=kO;Ze_xJJV zWWZ4H;ko*-e}4nJ2e(NO<%=xc{gWC8Om=k`#Nz z4REadGX^iW?8pH{vqcMWj{+i{R_KQI2A3?=$Nq&(V}D}E;OEbxV$Ze@$m7?=@vwYz ziJdc|3*$W`vHC4jUl=e`q<_YcF7*K}&cR&o8S@AA(j^`4sJn)b45B5=`>9wA1J7I0 zkxJp-?>9w`TKjvFQOM~RgWP3uk{QyaS~65mQYy_`y#i^Stp_a(Ke_%!nsTzaf@P6b z5UoT7?X@~MrVR2ib!2*;SlLG-SC?hM#6g#|d;`8)% zS38+xw%fcUhos}^tH|j7(4CD1$=Th0{Ks|HDxFjQZ4_szqJG-+JvukGbjlubuWRJ9 zZHyGv>Qk@h)!7VfP~4a+tFvKMJ)E*VlLTxC(5}wmFZz(zvAz>X$5<8*!?l(;V#xcakJ2QCi{B1^ znft80{W}&1_jan)jC}@rwjF))nIu1HBv`cMret^eu(^8h)_7^43Q5j|BRu8F+28OR z6n*Ch#q3CPQ)VUGa!bKZ$nqw0FOhye2L&0K8C+*rQ^$%nxrc1G$Hwq(f|_L)Ja;$_ z-I{}6UafI7HM7jMgD9&>A8cDbpNdD*go z$D>crFI)j}JdJ0;U1QD(CDQ8pID3%%QO;wOrKrEmAqT!#Z6d0@%n=JYj*AQXlW!Z@ zcQf$j*XwkDIS)(jQ&NX(DRq1P*e6<;dmvBnye4AxXHTqy%!^;U2R>K9ShV>NCjN8! zKU#oC#cC`~&i@WTDPY}6lxWva15%Z@_Xw3Z15cUrlC8UH?q zqqZ%^dnoF_#6@!F80$!R5qwZ(s#Kauvmqa7PxbHcu#^t@{N<*3Q_G|Fm%`9;D!DO8 z(aO66KtubxNjMAy%^s7*qp9|vT0>O@sdA-68}Wi59MV*Mm>AvB1UFGGswCW^BRIgI z%1|i86(U44eCS}~<0_YwA}J@}oh{loXpzh*;zt!d;Ir431{PXSx+jH=P0bkZBhSy< zX}g0K9HzM+c~gNW7v(nzSIo z2#^g9X_ll)UA4Q-e@K+)il@4;GpDk?J;!%J2&uH@y}=>vQF-SD38%O$qa*N2e7u15 z^5Eq6E0myy@(56pmS}MbKQe<0$i^q2W`B7T*@fwH2pqs$sLF;N=H{AQ{=B|is+u{r zJ^D^{0}34>)@hYg#J^6Lv?3pBQ z`+0@<8oAH+5_A`ij9-xADSs9~QNOo#IZ8LU&bey?*HwuBOAGa5JWu75A`QFx)tp#H zoL88?)FbR@t%%{~RnL77`K^fAB|@^w>dzXdi=|Re`zVPC3Sy>{Q(F{LX6BCXIaa=k zOKqWVEO8wr_J<*v&N%Y2fAW%`n5?^1H(2}@UQ5V+9TlU4O6)T5(UIUiO_N;t>1ufj z%Io67fE3PDLDv9=nFI z*O)drD=Y>Me;0zgzfOpnIi`U&kKWab5yN*)Z*jFW-J!EcOKnk+adQtOL7D9`RPfv2 zyQYC}>=$T1J_b08QD0oP|CNZ-cuAr&9oRRy))^5zam01H=It@Ya@(VEcfb(McQ?Ee zCzMSq?EHIKRZAC*4*9}OPY^B74e$7F8MM`>IonQF<_%JwF9zQ=rfI}w>4i+!S^-%< zlG;yz%dwn|1~IfmLbzX!i;fJ4aK0>?J`~6+REnjTy0vP_Asd6fvByxcNR4NSHPgng z9&KCPsP^ON#TGwA#h=bX1?lL$9(&MLN&wHYUxG*UX0X^|oC3%F5 zOtt=pW2~y^*{``@jaz(h)~Mt(GhX>ucTf!hQlKnu&>0${z=u^Qaqi)iUnDU}Y-^9) zq~_iXgF;i(d;8oR@uBMNpxhF8Ri6w?}Gr}=f z`<+JDVXa>4G#ApES^TsO_p|5w?eO!7*J9a1jhmb%xU<>Bb_%r-GS4k~$~N*mIx5!P zHiq)bC12(^o^t?xx7^|mhzBp8#50^e{qSQPl>DY52}o&bWY@AJJQk}pvTwhGRAbt) zVkd)(!*#nOk>@O+^xU9xu~l9)nIy6J)_&-vosR<$7QAiSC=7aBAnlttpb1l8r-}fA zqRrxn>oYLQa(su*Kc^GD*7pJTYOEaBO@s?OI6scL1i<@P%FLX{GEqH7dcnk@V0~SL zFK>gm+VYdB@7B0V%6)yCvEKkfR{)+M&yr&uPZg~3lW^@St7i8C=dm|2mq3=IB|O{R zEfRX|?>oR(e%@wzdq5c9u*SS%`2K#og}E;`@3LV4kdRElVwtV=%m?rj!GeCq$$Q*s z(@WtC4!c0QhOPCv&`s7kpr#V7P^}rF!e=m=DAS&Z{wAl{9Z!4m-Sp_^&=i>SUeFgD znJfV#L+_1Y17+uUl?3pt#`B%&a^0euHs2llbsflT+tuF3cavOMw!(P$>36ZRg}QG_ zp7&BY-{sySO#xpDPdKk#l2L);14N!FyFtXX&N?Qk@>o4<{af}EU@EF*wnvCN4pc_EKQy&@Rf?L`)-y~E|^JUr5IZyId z`8{fOw>TNs6gGLM&;N}A|L^sYE+}8BRR9Jc=Gj-kAQWQDZH~XxmF{!0!&wjF*h$ZU zp2Pm+wvOC|Z2_yM;6KPRX|++UiH)!%1k=Y{&%Ga%>MOQ+$;n8#8`6h9%~ zgz+V}(4oW%a!+TU#=uPy#^qS&*ux;~S z#x#WT4?Y2@m5c|C!h){MLG*AJ$BQuH)C*JzyCD9!35FY<-mC0;d2>ijGkANl!WoFm zMjpJkIY%pE?(Wb8=Vfqf>*3@60p(<;{bU;ptO!wJ!83|qzf5beP}!YF5Z^ySlyG5p z+RS4rH-P!-Vxwqk%E;;$pDXL9z&D91Plm{U{SKvvQc}9;3f1wey*XXawwfl1)u|`$ zdr4~m9^XjV>dGGwDaJ!uOx5ADHQqSV!@Wkt7X0dTF=*dnVC8vK&V#?_tC_y<$9wIR zFwi=G?5@=QMFdFLwyANNiVHQAd{u1I_R-Xl-hzLhW?xcc3%Tdksw;P)TqORbyNe@| z;A;dC>stfyZi5XHq%8q(#!;5H=HnxMbB-0e%8NM@B|E92zFTC*pZbxl3IZTirS!q;Ts8b)j7_hE`brZzR)&$g4JgU;~Hw` z>vQmR_Fz+PPHxQhId0n&L2*Z@y23o5`{~l@c6tTfEQl{P$Wn zuEn{&UnsvaX|S&m4oNP?6e=AL)UkzKKLQa|b-%&Z86o?--l5n`P#OgB;;)urB-HPf ztj+Rz)~xk2^>11x4T+>bh94zySCJaU=Y8wmkwsh_6aVfeM15qug4-s0CDQ(vyUAT{ zayDxwg*j9oj5{<~2;Raz4nPg*z+=bm4R?rYym;5yCuRYq;GH)Kw?$s?b@N*E+l}mHDL1;_yo!s#x_C)R`o>6c0%|h1 z`1jS|5Ri;(tFB>1wpC8z?OMNp#AG_X)p~`~6Nr*;snf2idfyLanEWvzeircObOO|&kC&5f zMBJC?Q^ym2Jq<9_q*u9RvH&5O%c8-^7VHu>pY+z+TyXGahQ9vn-}a{qovHreyrKt^ ze!tcy)xw)stDL*GdsEnir5QU$8~muYzDqi#3#iV>l^aXm=6k^i-jutNeYg#fMir@W z`<<$r`Kf_%N+K_b?jgvkRG7(ORj!s~@Sw-y_mLA=B~q5K)gpwP&yWH57n~maRx-wX zq}OZz5G}+FaynGkQGEWNLo8IfndCjiU;}hy#dO=y?1D2(I_O!l$(#U$xotU;wEpGi zG2S9+-%3|`6IQ0ss;^wlo-2x-*)B`oIk*o(Ju-1%I(3t^R!bhV0RaW6E#2-`AQ_Mb z7{1}Mp&8^r+cET(zqtzSs5C0JJBcBdDgS0DZx%b<;PVokEZa1w99~&Z36MI;tiEl1 ztHojV{9Ya*&^k&oW)1js+fE|FV@{XC!o)%@eX3Agcd6sHqk<@IB702py(lv6a9{oL@&^6tT*i{Ja;OJwIcBwb6 zvsPGoHvL@~?p{HPEWPKxF!NTNV}|(C$Z^9&$=$B&AIW8RpR#*W35h7&yA}Z$%9lkT zc?Ukr5Iw2hMBm7zIn~Sk!1R9bBmX8KT@$c%?;Z!J%H1hC7+_q}kF!JUp7pO&S$9Cp z^%W=_+uuD71DZl^eR_le`rTy5vy zN(#^up>nV6oH=S2_sTcyXh@>%pQH-@SnkY1t2Zr=T%@=j9^G)W`Z%??@y1~8YDIwJ z(S<3kx0*a+frYaeYN^hAM(Cc*{tHd5JBfSW`XVX3i28OYWVK58ZmqzTT)WJo|0=oe zROv+L+2corG<4AB$uW?%=0|@DJgJ`yJaqo8iz%o1=7HYhd~Gfu4`HXDz#(L@P~67n8w z-;=%P;%x^v2?NOQq&KYmZ9^ay*xWywuVLT$lm{~%_x!Da!3s~EM_)yhPG=Z-f4A`4^6|8e z{Cu~Uxp-!VVgQk1cqG+L}!uFTF ztU+4XCXk2^uq+26JkWmdohns3Y9GW8nFb=5AYcbk;A#L8;)|avF#J^={#Ab@%uNho(aQA9 zG%VGiWeM(4XS^GP1qof_lqjMLRNmV>>n*C%mx8J|hr1Kyy0*HWpc>)wx+$JkK=m1A z>)iX)meRr#C5%ES=CCzhCq9QA2QQJp%UJd4W`+E6I++y1aSU2$Wjhw#o5)x^;Xv>d z4kb3_x*K=(LOM!;J#o3-)^GUdpAz+q#O}7pfXjs%1H^*fze^a>kO!>LyVCnJtuFx@ zs{pw7PHJ1}_^uN6rmna5oW_-tSneBU@jl|X!uj^*KGs4_LJ`bc!><&RunBg?Q2b3i z_V)ot_Ayq{f-bZ5r5Mc#Dl|#ek6>3d@RHgq*a172A~;Qf1%gIe5Kl-r8g}$52|Wnc zc;R}Y!1<@>5=?FV>4^d* zyoW0Xfqj&`SO&SyJjlMKe6bQrnO6!sFXlVW%-;emq9+Wd_YyE#mE~)7WzCv$N}20u zd|V>jWClXyE)78!NR4&FlZk=L)%<+LbpZ0|K)q1WPd{Qv>9=KGg08P9`G@_j{ja5- ze8$0*=D->%?tV7wx}$Ce8KhvB>iR8 zX-Qnlzp38=Jvzz1Chd7Z6Wo~nTpy64XLL@?uEK<_oA}|kWbx@}_)z5xYc?FNwk=msKc<20C%SuKvD}LuPm#mp=a?q znP&;$s&ecK>3UeU&1wpNDv1k$kWvCv@%ufUp9b1^Bj^YeDg<^xuxV2yo&^Qkfu?+# z_aKdGkrfP?f(sz6-uJ7>LHeT6Kv-IX_$@D^EX}F<6jV3~$}55w%FHoTz;aT;XK#b? zF+Hjfro{sf^sVnwWtkXqZ&@Ln0vNE_`tT#ye}=Qwd<%x`?CbZnr0UB=hh1**uw)HZ z$`l|=PQhkoMMEs__c;W>kVT(o+q4i1bm@92OnABJk|$@|Q<}0s>hG?-)o06**&PXD zi;REb#0P+ikwj~cj>HkcfHbNMIQm)hmTE?IIq!ey%eqv5G=t{RKZVbPDE$$@c9kN8 zHtij=IdNfhf?zkkV0KJ_+R6f!j`srcUIioE{yP%ed$42idcwM%YTGo827%?9&^MG3 zG8l@!;-7A5l1zCZDtOac3m8;p%DEc@OfRD-b*)AVrDQuQFr|T}wA?s+8(;>fu;o-s zehgAWPZi26ophcA0&IfnIdf}D5blnjK~odZ4W9hc6aEA5^UK1hs^Sl+GWMF!qqKsKGl<~3DCqu(j;(YCTb$wN!M z?oy|fi24lks(S*yrX)04HH|?hy-ts0sMm{kELe7msF1(+~duK6-`#4AMpJZvXLJybh*GtLGz3l?U9^+ks>6naLGXTEkL zf?YlTIiqXt zu2BBA`g82&t}6b|=0YBD~{w=ouo9}{#o3xCbb`A&}RSSAM9Ih`wl5FAO0$NEcu?g;a zNjNqou$Lq-)IiAGaV*888e;xkAEit`H0cO#75It8aj^ z;{UsZAV)>q#WPH}o*>+@8K_pOnQcf)C-@LF()fV4wu2e(kqhsX#-QIR@za*ce-=k6 z4g8vG674b@Z)E(kR+XCCB0RHe0f)O&YF6;c;)$yV1A4AfJ%f82U@o7SKfk|H8VPq^ z*UyEV{jm6^fx8bveNgY4>b5IzewHNr{SQ&lT0Y7&h~6~W@YZp zTbedS+a};}4J1Dqal`jmL|ePq@IuvtuTFoN`g#IKQ$wDi<~^J*6~9Jly@I7rDTevX zsQ$;vbi#GGgN9>1GCFi&>F{K^OULFnhaXk2?ly9(oF9gK@U~wp6!KdMqikCkeAw>{ zB$qYX&o)ODegte3V2$zrWf$ODAn6*rTyp1j==uR6+4BP|(R;DVfX&g@&c~Z$PTx30 z?zzs~u^{Z0Y@RfXmK=F0_U&y5U*-d1f3Abtj!O+O*O^h`SD;ia-{k&d?rk+qJ@BC| z7BaHmPeBI~Kh5H}Nv-8466h$DPYrD@eIN8|(<=V?FMfhXLoe+FLs0!~vhF4cnSG;@ zkO;lC>K*`E{0MgAu+%!Sf4NC;GB)w4Qi{Mc2UdB)1^Q0)ft<)F?x4IL+aL{4w(7O* zc<=&b2FTnLAKfVkyNagPd8lk>&0S&z=;jdac97yCgBIFb*+9FY&q*8=Ck;ApF#RU+ zP@$|DR%4wu|NcD-09)GtkI>DIFdVxudpre=QO>(Fb$lLf*XIY@jT1T(o!;Ecdb&Ik z^UWSs-Pv!9eSo2>#s1L|qJ9$$xHOvT_W(@mP8F+B`eI2%P+i#d%Eor7VdYa;+NHCO zqwO4%VDRtnA6hE!|BCRSom|)#l*FB$R(7c>|7`kh`ElaGs-DwQ$0tm+|I^i-RL+?0 z1bX`SoXQ|hDE=mu7#g^x_j4pAc~l1cJU|xqcL6}__bBfZ44^L!^TgfsKtf=|rI8so zHqrMEO^e&}z0qmH=M6wL;+u8P##HDlK#`v7(|Yq_pe8wJV!{?AF8%NVhNU)`eRtk9 zSJvBo>p8i5^s^%xeN>mU&nt=DPqLOGTZ+9F#uvl05ei? ivw!~g={@T6zZ)rmz9BCP$`8N*anx0Glxq~9ME);97pKes