From 0ed46f62e0f7894e52dc0982c1fb5dc890f551c9 Mon Sep 17 00:00:00 2001
From: James McMurray <jamesmcm03@gmail.com>
Date: Sat, 4 Nov 2023 15:03:37 +0100
Subject: [PATCH 1/2] Add port forwarding for ProtonVPN connections

Works with OpenVPN and Wireguard (downloaded ProtonVPN custom config)

Note for OpenVPN port forwarding you must generate the OpenVPN config
files appending "+pmp" to the OpenVPN username.

Note we do not currently handle if the port changes when renewed (i.e.
we do not rest firewall rules in this case).
---
 Cargo.toml                                    |   4 +-
 src/args.rs                                   |   4 +
 src/cli_client.rs                             |  17 +-
 src/exec.rs                                   | 111 ++--
 vopono_core/Cargo.toml                        |   4 +-
 .../src/config/providers/mozilla/wireguard.rs |   2 +-
 .../src/config/providers/mullvad/wireguard.rs |   2 +-
 .../src/config/providers/protonvpn/openvpn.rs |  15 +-
 .../src/network/application_wrapper.rs        |  12 +-
 vopono_core/src/network/firewall.rs           |  71 +--
 vopono_core/src/network/host_masquerade.rs    |   4 +-
 vopono_core/src/network/mod.rs                |   1 +
 vopono_core/src/network/natpmpc.rs            | 120 +++++
 vopono_core/src/network/netns.rs              |  87 +--
 vopono_core/src/network/openconnect.rs        |  14 +-
 vopono_core/src/network/openfortivpn.rs       |  35 +-
 vopono_core/src/network/openvpn.rs            | 497 ++++++++++--------
 vopono_core/src/network/shadowsocks.rs        |  14 +-
 vopono_core/src/network/warp.rs               |  14 +-
 vopono_core/src/network/wireguard.rs          | 416 ++++++++-------
 vopono_core/src/util/open_hosts.rs            |  50 +-
 vopono_core/src/util/open_ports.rs            | 144 ++---
 22 files changed, 982 insertions(+), 656 deletions(-)
 create mode 100644 vopono_core/src/network/natpmpc.rs

diff --git a/Cargo.toml b/Cargo.toml
index e7a6bf2..0d56d71 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -19,8 +19,8 @@ directories-next = "2"
 log = "0.4"
 pretty_env_logger = "0.5"
 clap = { version = "4", features = ["derive"] }
-which = "4"
-dialoguer = "0.10"
+which = "5"
+dialoguer = "0.11"
 compound_duration = "1"
 signal-hook = "0.3"
 walkdir = "2"
diff --git a/src/args.rs b/src/args.rs
index 1081319..23668ac 100644
--- a/src/args.rs
+++ b/src/args.rs
@@ -212,6 +212,10 @@ pub struct ExecCommand {
     /// Useful for accessing services on the host locally
     #[clap(long = "allow-host-access")]
     pub allow_host_access: bool,
+
+    /// Enable port forwarding for ProtonVPN connections
+    #[clap(long = "protonvpn-port-forwarding")]
+    pub protonvpn_port_forwarding: bool,
 }
 
 #[derive(Parser)]
diff --git a/src/cli_client.rs b/src/cli_client.rs
index 7128d85..f9fd61d 100644
--- a/src/cli_client.rs
+++ b/src/cli_client.rs
@@ -38,26 +38,23 @@ impl UiClient for CliClient {
     }
 
     fn get_input(&self, inp: Input) -> anyhow::Result<String> {
-        let mut d = dialoguer::Input::<String>::new();
-
-        d.with_prompt(&inp.prompt);
+        let mut d = dialoguer::Input::<String>::new().with_prompt(&inp.prompt);
 
         if inp.validator.is_some() {
-            d.validate_with(inp.validator.unwrap());
+            d = d.validate_with(inp.validator.unwrap());
         };
 
         Ok(d.interact()?)
     }
 
     fn get_input_numeric_u16(&self, inp: InputNumericu16) -> anyhow::Result<u16> {
-        let mut d = dialoguer::Input::<u16>::new();
-        d.with_prompt(&inp.prompt);
+        let mut d = dialoguer::Input::<u16>::new().with_prompt(&inp.prompt);
 
         if inp.default.is_some() {
-            d.default(inp.default.unwrap());
+            d = d.default(inp.default.unwrap());
         }
         if inp.validator.is_some() {
-            d.validate_with(inp.validator.unwrap());
+            d = d.validate_with(inp.validator.unwrap());
         }
 
         Ok(d.interact()?)
@@ -66,9 +63,9 @@ impl UiClient for CliClient {
     fn get_password(&self, pw: Password) -> anyhow::Result<String> {
         let mut req = dialoguer::Password::new();
         if pw.confirm {
-            req.with_confirmation("Confirm password", "Passwords did not match");
+            req = req.with_confirmation("Confirm password", "Passwords did not match");
         };
-        req.with_prompt(pw.prompt);
+        req = req.with_prompt(pw.prompt);
         Ok(req.interact()?)
     }
 }
diff --git a/src/exec.rs b/src/exec.rs
index f245720..f7d0871 100644
--- a/src/exec.rs
+++ b/src/exec.rs
@@ -14,6 +14,7 @@ use vopono_core::config::providers::{UiClient, VpnProvider};
 use vopono_core::config::vpn::{verify_auth, Protocol};
 use vopono_core::network::application_wrapper::ApplicationWrapper;
 use vopono_core::network::firewall::Firewall;
+use vopono_core::network::natpmpc::Natpmpc;
 use vopono_core::network::netns::NetworkNamespace;
 use vopono_core::network::network_interface::{get_active_interfaces, NetworkInterface};
 use vopono_core::network::shadowsocks::uses_shadowsocks;
@@ -56,10 +57,9 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
         .map(|x| x.to_variant())
         .ok_or_else(|| anyhow!(""))
         .or_else(|_| {
-            vopono_config_settings.get("firewall").map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            vopono_config_settings
+                .get("firewall")
+                .map_err(|_e| anyhow!("Failed to read config file"))
         })
         .or_else(|_x| vopono_core::util::get_firewall())?;
 
@@ -67,10 +67,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let custom_config = command.custom_config.clone().or_else(|| {
         vopono_config_settings
             .get("custom_config")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
 
@@ -78,10 +75,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let custom_netns_name = command.custom_netns_name.clone().or_else(|| {
         vopono_config_settings
             .get("custom_netns_name")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
 
@@ -89,29 +83,20 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let mut open_hosts = command.open_hosts.clone().or_else(|| {
         vopono_config_settings
             .get("open_hosts")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
     let allow_host_access = command.allow_host_access
         || vopono_config_settings
             .get("allow_host_access")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .unwrap_or(false);
 
     // Assign postup script from args or vopono config file
     let postup = command.postup.clone().or_else(|| {
         vopono_config_settings
             .get("postup")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
 
@@ -119,10 +104,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let predown = command.predown.clone().or_else(|| {
         vopono_config_settings
             .get("predown")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
 
@@ -130,10 +112,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let user = if command.user.is_none() {
         vopono_config_settings
             .get("user")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
             .or_else(|| std::env::var("SUDO_USER").ok())
     } else {
@@ -144,10 +123,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let group = if command.group.is_none() {
         vopono_config_settings
             .get("group")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     } else {
         command.group
@@ -157,23 +133,28 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     let working_directory = if command.working_directory.is_none() {
         vopono_config_settings
             .get("working-directory")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     } else {
         command.working_directory
     };
 
+    // Port forwarding for ProtonVPN
+    let protonvpn_port_forwarding = if !command.protonvpn_port_forwarding {
+        vopono_config_settings
+            .get("protonvpn-port-forwarding")
+            .map_err(|_e| anyhow!("Failed to read config file"))
+            .ok()
+            .unwrap_or(false)
+    } else {
+        command.protonvpn_port_forwarding
+    };
+
     // Assign DNS server from args or vopono config file
     let base_dns = command.dns.clone().or_else(|| {
         vopono_config_settings
             .get("dns")
-            .map_err(|e| {
-                debug!("vopono config.toml: {:?}", e);
-                anyhow!("Failed to read config file")
-            })
+            .map_err(|_e| anyhow!("Failed to read config file"))
             .ok()
     });
 
@@ -199,10 +180,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
                 .or_else(|| {
                     vopono_config_settings
                         .get("server")
-                        .map_err(|e| {
-                            debug!("vopono config.toml: {:?}", e);
-                            anyhow!("Failed to read config file")
-                        })
+                        .map_err(|_e| anyhow!("Failed to read config file"))
                         .ok()
                 })
                 .or_else(|| Some(String::new()))
@@ -216,10 +194,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
             .or_else(|| {
                 vopono_config_settings
                     .get("provider")
-                    .map_err(|e| {
-                        debug!("vopono config.toml: {:?}", e);
-                        anyhow!("Failed to read config file")
-                    })
+                    .map_err(|_e| anyhow!("Failed to read config file"))
                     .ok()
             })
             .expect(
@@ -235,8 +210,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
             .or_else(|| {
                 vopono_config_settings
                     .get("server")
-                    .map_err(|e| {
-                        debug!("vopono config.toml: {:?}", e);
+                    .map_err(|_e| {
                         anyhow!("Failed to read config file")
                     })
                     .ok()
@@ -252,10 +226,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
             .or_else(|| {
                 vopono_config_settings
                     .get("protocol")
-                    .map_err(|e| {
-                        debug!("vopono config.toml: {:?}", e);
-                        anyhow!("Failed to read config file")
-                    })
+                    .map_err(|_e| anyhow!("Failed to read config file"))
                     .ok()
             })
             .unwrap_or_else(|| provider.get_dyn_provider().default_protocol());
@@ -525,7 +496,7 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
         // for the PostUp script and the application:
         std::env::set_var(
             "VOPONO_NS_IP",
-            &ns.veth_pair_ips.as_ref().unwrap().namespace_ip.to_string(),
+            ns.veth_pair_ips.as_ref().unwrap().namespace_ip.to_string(),
         );
 
         // Run PostUp script (if any)
@@ -560,17 +531,33 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
     // Set env var referring to the host IP for the application:
     std::env::set_var(
         "VOPONO_HOST_IP",
-        &ns.veth_pair_ips.as_ref().unwrap().host_ip.to_string(),
+        ns.veth_pair_ips.as_ref().unwrap().host_ip.to_string(),
     );
 
     let ns = ns.write_lockfile(&command.application)?;
 
+    let natpmpc = if protonvpn_port_forwarding {
+        vopono_core::util::open_hosts(
+            &ns,
+            vec![vopono_core::network::natpmpc::PROTONVPN_GATEWAY],
+            firewall,
+        )?;
+        Some(Natpmpc::new(&ns)?)
+    } else {
+        None
+    };
+
+    if let Some(pmpc) = natpmpc.as_ref() {
+        vopono_core::util::open_ports(&ns, &[pmpc.local_port], firewall)?;
+    }
+
     let application = ApplicationWrapper::new(
         &ns,
         &command.application,
         user,
         group,
         working_directory.map(PathBuf::from),
+        natpmpc,
     )?;
 
     // Launch TCP proxy server on other threads if forwarding ports
@@ -598,6 +585,10 @@ pub fn exec(command: ExecCommand, uiclient: &dyn UiClient) -> anyhow::Result<()>
         "Application {} launched in network namespace {} with pid {}",
         &command.application, &ns.name, pid
     );
+
+    if let Some(pmpc) = application.protonvpn_port_forwarding.as_ref() {
+        info!("ProtonVPN Port Forwarding on port {}", pmpc.local_port)
+    }
     let output = application.wait_with_output()?;
     io::stdout().write_all(output.stdout.as_slice())?;
 
diff --git a/vopono_core/Cargo.toml b/vopono_core/Cargo.toml
index 4468747..fb6a1d4 100644
--- a/vopono_core/Cargo.toml
+++ b/vopono_core/Cargo.toml
@@ -14,7 +14,7 @@ keywords = ["vopono", "vpn", "wireguard", "openvpn", "netns"]
 anyhow = "1"
 directories-next = "2"
 log = "0.4"
-which = "4"
+which = "5"
 users = "0.11"
 nix = { version = "0.27", features = ["user", "signal", "fs", "process"] }
 serde = { version = "1", features = ["derive", "std"] }
@@ -23,7 +23,7 @@ regex = "1"
 ron = "0.8"
 walkdir = "2"
 rand = "0.8"
-toml = "0.7"
+toml = "0.8"
 ipnet = { version = "2", features = ["serde"] }
 reqwest = { default-features = false, version = "0.11", features = [
     "blocking",
diff --git a/vopono_core/src/config/providers/mozilla/wireguard.rs b/vopono_core/src/config/providers/mozilla/wireguard.rs
index e9c00db..335d818 100644
--- a/vopono_core/src/config/providers/mozilla/wireguard.rs
+++ b/vopono_core/src/config/providers/mozilla/wireguard.rs
@@ -151,7 +151,7 @@ impl WireguardProvider for MozillaVPN {
 
         // Get user info again in case we uploaded new key
         let user_info: User = client
-            .get(&format!("{}/vpn/account", self.base_url()))
+            .get(format!("{}/vpn/account", self.base_url()))
             .bearer_auth(login.token)
             .send()?
             .json()?;
diff --git a/vopono_core/src/config/providers/mullvad/wireguard.rs b/vopono_core/src/config/providers/mullvad/wireguard.rs
index 1b3b535..e34fbba 100644
--- a/vopono_core/src/config/providers/mullvad/wireguard.rs
+++ b/vopono_core/src/config/providers/mullvad/wireguard.rs
@@ -49,7 +49,7 @@ impl WireguardProvider for Mullvad {
 
         let username = self.request_mullvad_username(uiclient)?;
         let auth: AuthToken = client
-            .get(&format!("https://api.mullvad.net/www/accounts/{username}/"))
+            .get(format!("https://api.mullvad.net/www/accounts/{username}/"))
             .send()?
             .json()?;
 
diff --git a/vopono_core/src/config/providers/protonvpn/openvpn.rs b/vopono_core/src/config/providers/protonvpn/openvpn.rs
index 5410006..f2692bf 100644
--- a/vopono_core/src/config/providers/protonvpn/openvpn.rs
+++ b/vopono_core/src/config/providers/protonvpn/openvpn.rs
@@ -61,7 +61,7 @@ impl OpenVpnProvider for ProtonVPN {
     fn prompt_for_auth(&self, uiclient: &dyn UiClient) -> anyhow::Result<(String, String)> {
         let username = uiclient.get_input(Input {
             prompt:
-                "ProtonVPN OpenVPN username (see: https://account.protonvpn.com/account#openvpn )"
+                "ProtonVPN OpenVPN username (see: https://account.protonvpn.com/account#openvpn ) - add +pmp suffix if using --protonvpn-port-forwarding - note not all servers support this feature"
                     .to_string(),
             validator: None,
         })?;
@@ -94,16 +94,21 @@ impl OpenVpnProvider for ProtonVPN {
         );
 
         let auth_cookie: &'static str = Box::leak(uiclient.get_input(Input {
-            prompt: "Please log-in at https://account.protonvpn.com/dashboard and then visit https://account.protonvpn.com/api/vpn/v2/users and copy the value of the cookie starting with \"AUTH-\" in the request from your browser's network request inspector".to_owned(),
+            prompt: "Please log-in at https://account.protonvpn.com/dashboard and then visit https://account.protonvpn.com/account and copy the value of the cookie of the form \"AUTH-xxx=yyy\" where xxx is equal to the value of the \"x-pm-uid\" request header, in the request from your browser's network request inspector (check the request it makes to https://account.protonvpn.com/api/vpn for example). Note there may be multiple AUTH-xxx=yyy request headers, copy the one where xxx is equal to the value of the x-pm-uid header.".to_owned(),
              validator: Some(Box::new(|s: &String| if s.starts_with("AUTH-") {Ok(())} else {Err("AUTH cookie must start with AUTH-".to_owned())}))
              })?.replace(';', "").trim().to_owned().into_boxed_str());
         debug!("Using AUTH cookie: {}", &auth_cookie);
 
-        let re = Regex::new("AUTH-([^=]+)=").unwrap();
-        let uid = re
+        let uid_re = Regex::new("AUTH-([^=]+)=").unwrap();
+        let uid = uid_re
             .captures(auth_cookie)
             .and_then(|c| c.get(1))
-            .ok_or(anyhow!("Failed to parse auth cookie"))?;
+            .ok_or(anyhow!("Failed to parse uid from auth cookie"))?;
+        info!(
+            "x-pm-uid should be {} according to AUTH cookie: {}",
+            uid.as_str(),
+            auth_cookie
+        );
         let url = self.build_url(&config_choice, &tier, &protocol)?;
 
         let mut headers = HeaderMap::new();
diff --git a/vopono_core/src/network/application_wrapper.rs b/vopono_core/src/network/application_wrapper.rs
index af436af..5ba017a 100644
--- a/vopono_core/src/network/application_wrapper.rs
+++ b/vopono_core/src/network/application_wrapper.rs
@@ -1,11 +1,12 @@
 use std::path::PathBuf;
 
-use super::netns::NetworkNamespace;
+use super::{natpmpc::Natpmpc, netns::NetworkNamespace};
 use crate::util::get_all_running_process_names;
 use log::warn;
 
 pub struct ApplicationWrapper {
     pub handle: std::process::Child,
+    pub protonvpn_port_forwarding: Option<Natpmpc>,
 }
 
 impl ApplicationWrapper {
@@ -15,6 +16,7 @@ impl ApplicationWrapper {
         user: Option<String>,
         group: Option<String>,
         working_directory: Option<PathBuf>,
+        protonvpn_port_forwarding: Option<Natpmpc>,
     ) -> anyhow::Result<Self> {
         let running_processes = get_all_running_process_names();
         let app_vec = application.split_whitespace().collect::<Vec<_>>();
@@ -37,7 +39,8 @@ impl ApplicationWrapper {
             }
         }
 
-        let handle = netns.exec_no_block(
+        let handle = NetworkNamespace::exec_no_block(
+            &netns.name,
             app_vec.as_slice(),
             user,
             group,
@@ -46,7 +49,10 @@ impl ApplicationWrapper {
             false,
             working_directory,
         )?;
-        Ok(Self { handle })
+        Ok(Self {
+            handle,
+            protonvpn_port_forwarding,
+        })
     }
 
     pub fn wait_with_output(self) -> anyhow::Result<std::process::Output> {
diff --git a/vopono_core/src/network/firewall.rs b/vopono_core/src/network/firewall.rs
index 065774f..d97ee79 100644
--- a/vopono_core/src/network/firewall.rs
+++ b/vopono_core/src/network/firewall.rs
@@ -11,42 +11,51 @@ pub enum Firewall {
 pub fn disable_ipv6(netns: &NetworkNamespace, firewall: Firewall) -> anyhow::Result<()> {
     match firewall {
         Firewall::IpTables => {
-            netns.exec(&["ip6tables", "-P", "INPUT", "DROP"])?;
-            netns.exec(&["ip6tables", "-I", "INPUT", "-j", "DROP"])?;
-            netns.exec(&["ip6tables", "-P", "FORWARD", "DROP"])?;
-            netns.exec(&["ip6tables", "-I", "FORWARD", "-j", "DROP"])?;
-            netns.exec(&["ip6tables", "-P", "OUTPUT", "DROP"])?;
-            netns.exec(&["ip6tables", "-I", "OUTPUT", "-j", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-P", "INPUT", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-I", "INPUT", "-j", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-P", "FORWARD", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-I", "FORWARD", "-j", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-P", "OUTPUT", "DROP"])?;
+            NetworkNamespace::exec(&netns.name, &["ip6tables", "-I", "OUTPUT", "-j", "DROP"])?;
         }
         Firewall::NfTables => {
-            netns.exec(&["nft", "add", "table", "ip6", &netns.name])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "ip6",
+            NetworkNamespace::exec(&netns.name, &["nft", "add", "table", "ip6", &netns.name])?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "drop_ipv6_input",
-                "{ type filter hook input priority -1 ; policy drop; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "ip6",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "ip6",
+                    &netns.name,
+                    "drop_ipv6_input",
+                    "{ type filter hook input priority -1 ; policy drop; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "drop_ipv6_output",
-                "{ type filter hook output priority -1 ; policy drop; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "ip6",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "ip6",
+                    &netns.name,
+                    "drop_ipv6_output",
+                    "{ type filter hook output priority -1 ; policy drop; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "drop_ipv6_forward",
-                "{ type filter hook forward priority -1 ; policy drop; }",
-            ])?;
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "ip6",
+                    &netns.name,
+                    "drop_ipv6_forward",
+                    "{ type filter hook forward priority -1 ; policy drop; }",
+                ],
+            )?;
         }
     }
     Ok(())
diff --git a/vopono_core/src/network/host_masquerade.rs b/vopono_core/src/network/host_masquerade.rs
index 4139ee4..b63bf78 100644
--- a/vopono_core/src/network/host_masquerade.rs
+++ b/vopono_core/src/network/host_masquerade.rs
@@ -5,7 +5,7 @@ use anyhow::Context;
 use log::debug;
 use serde::{Deserialize, Serialize};
 
-#[derive(Serialize, Deserialize, Clone, Debug)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct HostMasquerade {
     ip_mask: String,
     interface: NetworkInterface,
@@ -122,7 +122,7 @@ impl Drop for HostMasquerade {
     }
 }
 
-#[derive(Serialize, Deserialize, Clone, Debug)]
+#[derive(Serialize, Deserialize, Debug)]
 pub struct FirewallException {
     host_interface: NetworkInterface,
     ns_interface: NetworkInterface,
diff --git a/vopono_core/src/network/mod.rs b/vopono_core/src/network/mod.rs
index f286795..e7fbb7e 100644
--- a/vopono_core/src/network/mod.rs
+++ b/vopono_core/src/network/mod.rs
@@ -2,6 +2,7 @@ pub mod application_wrapper;
 pub mod dns_config;
 pub mod firewall;
 pub mod host_masquerade;
+pub mod natpmpc;
 pub mod netns;
 pub mod network_interface;
 pub mod openconnect;
diff --git a/vopono_core/src/network/natpmpc.rs b/vopono_core/src/network/natpmpc.rs
new file mode 100644
index 0000000..4910b3e
--- /dev/null
+++ b/vopono_core/src/network/natpmpc.rs
@@ -0,0 +1,120 @@
+use anyhow::Context;
+use regex::Regex;
+use std::sync::mpsc::{self, Receiver};
+use std::{
+    net::{IpAddr, Ipv4Addr},
+    sync::mpsc::Sender,
+    thread::JoinHandle,
+};
+
+use super::netns::NetworkNamespace;
+
+// TODO: Move this to ProtonVPN provider
+pub const PROTONVPN_GATEWAY: IpAddr = IpAddr::V4(Ipv4Addr::new(10, 2, 0, 1));
+
+/// Used to provide port forwarding for ProtonVPN
+pub struct Natpmpc {
+    pub local_port: u16,
+    loop_thread_handle: Option<JoinHandle<()>>,
+    send_channel: Sender<bool>,
+}
+
+impl Natpmpc {
+    pub fn new(ns: &NetworkNamespace) -> anyhow::Result<Self> {
+        let gateway_str = PROTONVPN_GATEWAY.to_string();
+
+        // Check output for readnatpmpresponseorretry returned 0 (OK)
+        // If receive readnatpmpresponseorretry returned -7
+        // Then prompt user to choose different gateway
+        let output =
+            NetworkNamespace::exec_with_output(&ns.name, &["natpmpc", "-g", &gateway_str])?;
+        if !output.status.success() {
+            log::error!("natpmpc failed - likely that this server does not support port forwarding, please choose another server");
+            anyhow::bail!("natpmpc failed - likely that this server does not support port forwarding, please choose another server")
+        }
+
+        let port = Self::refresh_port(&ns.name)?;
+
+        let (send, recv) = mpsc::channel::<bool>();
+
+        let ns_name = ns.name.clone();
+        let handle = std::thread::spawn(move || Self::thread_loop(ns_name, recv));
+
+        log::info!("ProtonVPN forwarded local port: {port}");
+        Ok(Self {
+            local_port: port,
+            loop_thread_handle: Some(handle),
+            send_channel: send,
+        })
+    }
+
+    fn refresh_port(ns_name: &str) -> anyhow::Result<u16> {
+        let gateway_str = PROTONVPN_GATEWAY.to_string();
+        // TODO: Cache regex
+        let re = Regex::new(r"Mapped public port (?P<port>\d{1,5}) protocol").unwrap();
+        // Read Mapped public port 61057 protocol UDP
+        let udp_output = NetworkNamespace::exec_with_output(
+            ns_name,
+            &["natpmpc", "-a", "1", "0", "udp", "60", "-g", &gateway_str],
+        )?;
+        let udp_port: u16 = re
+            .captures(String::from_utf8_lossy(&udp_output.stdout).as_ref())
+            .context("Failed to read port from natpmpc output - no captures")?
+            .get(1)
+            .context("Failed to read port from natpmpc output - no port")?
+            .as_str()
+            .parse()?;
+        // Mapped public port 61057 protocol TCP
+        let tcp_output = NetworkNamespace::exec_with_output(
+            ns_name,
+            &["natpmpc", "-a", "1", "0", "tcp", "60", "-g", &gateway_str],
+        )?;
+        let tcp_port: u16 = re
+            .captures(String::from_utf8_lossy(&tcp_output.stdout).as_ref())
+            .context("Failed to read port from natpmpc output - no captures")?
+            .get(1)
+            .context("Failed to read port from natpmpc output - no port")?
+            .as_str()
+            .parse()?;
+        if udp_port != tcp_port {
+            log::error!("natpmpc assigned UDP port: {udp_port} did not equal TCP port: {tcp_port}");
+            anyhow::bail!(
+                "natpmpc assigned UDP port: {udp_port} did not equal TCP port: {tcp_port}"
+            )
+        }
+
+        Ok(udp_port)
+    }
+
+    // Spawn thread to repeat above every 45 seconds
+    fn thread_loop(netns_name: String, recv: Receiver<bool>) {
+        loop {
+            let resp = recv.recv_timeout(std::time::Duration::from_secs(45));
+            if resp.is_ok() {
+                log::debug!("Thread exiting...");
+                return;
+            } else {
+                let port = Self::refresh_port(&netns_name);
+                match port {
+                    Err(e) => {
+                        log::error!("Thread failed to refresh port: {e:?}");
+                        return;
+                    }
+                    Ok(p) => log::debug!("Thread refreshed port: {p}"),
+                }
+
+                // TODO: Communicate port change via channel?
+            }
+        }
+    }
+}
+
+impl Drop for Natpmpc {
+    fn drop(&mut self) {
+        let handle = self.loop_thread_handle.take();
+        if let Some(h) = handle {
+            self.send_channel.send(true).ok();
+            h.join().ok();
+        }
+    }
+}
diff --git a/vopono_core/src/network/netns.rs b/vopono_core/src/network/netns.rs
index 0f79fd7..db62b02 100644
--- a/vopono_core/src/network/netns.rs
+++ b/vopono_core/src/network/netns.rs
@@ -13,7 +13,7 @@ use crate::config::providers::{UiClient, VpnProvider};
 use crate::config::vpn::Protocol;
 use crate::network::host_masquerade::FirewallException;
 use crate::util::{config_dir, set_config_permissions, sudo_command};
-use anyhow::Context;
+use anyhow::{anyhow, Context};
 use log::{debug, info, warn};
 use nix::unistd;
 use serde::{Deserialize, Serialize};
@@ -21,7 +21,7 @@ use std::fs::File;
 use std::io::Write;
 use std::net::IpAddr;
 use std::path::{Path, PathBuf};
-use std::process::{Command, Stdio};
+use std::process::{Command, Output, Stdio};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 #[derive(Serialize, Deserialize, Debug)]
@@ -46,7 +46,7 @@ pub struct NetworkNamespace {
     pub predown_group: Option<String>,
 }
 
-#[derive(Serialize, Deserialize, Debug)]
+#[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct VethPairIPs {
     pub host_ip: IpAddr,
     pub namespace_ip: IpAddr,
@@ -107,7 +107,7 @@ impl NetworkNamespace {
 
     #[allow(clippy::too_many_arguments)]
     pub fn exec_no_block(
-        &self,
+        netns_name: &str,
         command: &[&str],
         user: Option<String>,
         group: Option<String>,
@@ -117,7 +117,7 @@ impl NetworkNamespace {
         set_dir: Option<PathBuf>,
     ) -> anyhow::Result<std::process::Child> {
         let mut handle = Command::new("ip");
-        handle.args(["netns", "exec", &self.name]);
+        handle.args(["netns", "exec", netns_name]);
         if let Some(cdir) = set_dir {
             handle.current_dir(cdir);
         }
@@ -155,7 +155,7 @@ impl NetworkNamespace {
 
         debug!(
             "ip netns exec {}{} {}",
-            &self.name,
+            netns_name,
             sudo_string.unwrap_or_else(|| String::from("")),
             command.join(" ")
         );
@@ -163,16 +163,24 @@ impl NetworkNamespace {
         Ok(handle)
     }
 
-    pub fn exec(&self, command: &[&str]) -> anyhow::Result<()> {
-        self.exec_no_block(command, None, None, false, false, false, None)?
-            .wait()?;
+    pub fn exec(netns_name: &str, command: &[&str]) -> anyhow::Result<()> {
+        Self::exec_no_block(netns_name, command, None, None, false, false, false, None)?.wait()?;
         Ok(())
     }
 
+    pub fn exec_with_output(netns_name: &str, command: &[&str]) -> anyhow::Result<Output> {
+        Self::exec_no_block(netns_name, command, None, None, false, true, false, None)?
+            .wait_with_output()
+            .map_err(|e| anyhow!("Process Output error: {e:?}"))
+    }
+
     pub fn add_loopback(&self) -> anyhow::Result<()> {
-        self.exec(&["ip", "addr", "add", "127.0.0.1/8", "dev", "lo"])
-            .with_context(|| format!("Failed to add loopback adapter in netns: {}", &self.name))?;
-        self.exec(&["ip", "link", "set", "lo", "up"])
+        Self::exec(
+            &self.name,
+            &["ip", "addr", "add", "127.0.0.1/8", "dev", "lo"],
+        )
+        .with_context(|| format!("Failed to add loopback adapter in netns: {}", &self.name))?;
+        Self::exec(&self.name, &["ip", "link", "set", "lo", "up"])
             .with_context(|| format!("Failed to start networking in netns: {}", &self.name))?;
         Ok(())
     }
@@ -213,32 +221,41 @@ impl NetworkNamespace {
             format!("Failed to assign static IP to veth destination: {veth_dest}")
         })?;
 
-        self.exec(&["ip", "addr", "add", &veth_source_ip, "dev", veth_source])
-            .with_context(|| format!("Failed to assign static IP to veth source: {veth_source}"))?;
-        self.exec(&[
-            "ip",
-            "route",
-            "add",
-            "default",
-            "via",
-            &ip_nosub,
-            "dev",
-            veth_source,
-        ])
+        Self::exec(
+            &self.name,
+            &["ip", "addr", "add", &veth_source_ip, "dev", veth_source],
+        )
+        .with_context(|| format!("Failed to assign static IP to veth source: {veth_source}"))?;
+        Self::exec(
+            &self.name,
+            &[
+                "ip",
+                "route",
+                "add",
+                "default",
+                "via",
+                &ip_nosub,
+                "dev",
+                veth_source,
+            ],
+        )
         .with_context(|| format!("Failed to assign static IP to veth source: {veth_source}"))?;
 
         if let Some(my_hosts) = hosts {
             for host in my_hosts {
-                self.exec(&[
-                    "ip",
-                    "route",
-                    "add",
-                    &host.to_string(),
-                    "via",
-                    &ip_nosub,
-                    "dev",
-                    veth_source,
-                ])
+                Self::exec(
+                    &self.name,
+                    &[
+                        "ip",
+                        "route",
+                        "add",
+                        &host.to_string(),
+                        "via",
+                        &ip_nosub,
+                        "dev",
+                        veth_source,
+                    ],
+                )
                 .with_context(|| {
                     format!("Failed to assign hosts route {host} to veth source: {veth_source}")
                 })?;
@@ -246,7 +263,7 @@ impl NetworkNamespace {
         }
 
         if allow_host_access {
-            self.exec(&[
+            Self::exec(&self.name, &[
                 "ip",
                 "route",
                 "add",
diff --git a/vopono_core/src/network/openconnect.rs b/vopono_core/src/network/openconnect.rs
index 7fe8d51..6c2118b 100644
--- a/vopono_core/src/network/openconnect.rs
+++ b/vopono_core/src/network/openconnect.rs
@@ -49,9 +49,17 @@ impl OpenConnect {
             command_vec.push(server.as_ref());
         }
 
-        let handle = netns
-            .exec_no_block(&command_vec, None, None, false, false, true, None)
-            .context("Failed to launch OpenConnect - is openconnect installed?")?;
+        let handle = NetworkNamespace::exec_no_block(
+            &netns.name,
+            &command_vec,
+            None,
+            None,
+            false,
+            false,
+            true,
+            None,
+        )
+        .context("Failed to launch OpenConnect - is openconnect installed?")?;
 
         handle
             .stdin
diff --git a/vopono_core/src/network/openfortivpn.rs b/vopono_core/src/network/openfortivpn.rs
index e3c4fee..495ead4 100644
--- a/vopono_core/src/network/openfortivpn.rs
+++ b/vopono_core/src/network/openfortivpn.rs
@@ -47,9 +47,17 @@ impl OpenFortiVpn {
         std::fs::remove_file(&pppd_log).ok();
 
         // TODO - better handle forwarding output when blocking on password entry (no newline!)
-        let mut handle = netns
-            .exec_no_block(&command_vec, None, None, false, true, false, None)
-            .context("Failed to launch OpenFortiVPN - is openfortivpn installed?")?;
+        let mut handle = NetworkNamespace::exec_no_block(
+            &netns.name,
+            &command_vec,
+            None,
+            None,
+            false,
+            true,
+            false,
+            None,
+        )
+        .context("Failed to launch OpenFortiVPN - is openfortivpn installed?")?;
         let stdout = handle.stdout.take().unwrap();
         let id = handle.id();
 
@@ -81,15 +89,18 @@ impl OpenFortiVpn {
         let remote_peer = get_remote_peer(&pppd_log)?;
 
         debug!("Found OpenFortiVPN route: {:?}", remote_peer);
-        netns.exec(&["ip", "route", "del", "default"])?;
-        netns.exec(&[
-            "ip",
-            "route",
-            "add",
-            "default",
-            "via",
-            &remote_peer.to_string(),
-        ])?;
+        NetworkNamespace::exec(&netns.name, &["ip", "route", "del", "default"])?;
+        NetworkNamespace::exec(
+            &netns.name,
+            &[
+                "ip",
+                "route",
+                "add",
+                "default",
+                "via",
+                &remote_peer.to_string(),
+            ],
+        )?;
 
         let dns = get_dns(&buffer)?;
         let dns_ip: Vec<IpAddr> = (dns.0).into_iter().map(IpAddr::from).collect();
diff --git a/vopono_core/src/network/openvpn.rs b/vopono_core/src/network/openvpn.rs
index fa4939d..3c5b549 100644
--- a/vopono_core/src/network/openvpn.rs
+++ b/vopono_core/src/network/openvpn.rs
@@ -63,9 +63,9 @@ impl OpenVpn {
         ])
         .to_vec();
 
-        if auth_file.is_some() {
+        if let Some(af_ref) = auth_file.as_ref() {
             command_vec.push("--auth-user-pass");
-            command_vec.push(auth_file.as_ref().unwrap().as_os_str().to_str().unwrap());
+            command_vec.push(af_ref.as_os_str().to_str().unwrap());
         }
 
         let ipv6_disabled = std::fs::read_to_string("/sys/module/ipv6/parameters/disable")
@@ -100,17 +100,17 @@ impl OpenVpn {
         debug!("Found remotes: {:?}", &remotes);
         let working_dir = PathBuf::from(config_file_path.parent().unwrap());
 
-        let handle = netns
-            .exec_no_block(
-                &command_vec,
-                None,
-                None,
-                true,
-                false,
-                false,
-                Some(working_dir),
-            )
-            .context("Failed to launch OpenVPN - is openvpn installed?")?;
+        let handle = NetworkNamespace::exec_no_block(
+            &netns.name,
+            &command_vec,
+            None,
+            None,
+            true,
+            false,
+            false,
+            Some(working_dir),
+        )
+        .context("Failed to launch OpenVPN - is openvpn installed?")?;
         let id = handle.id();
         let mut buffer = String::with_capacity(16384);
 
@@ -239,23 +239,35 @@ pub fn killswitch(
             };
 
             for ipcmd in ipcmds {
-                netns.exec(&[ipcmd, "-P", "INPUT", "DROP"])?;
-                netns.exec(&[ipcmd, "-P", "FORWARD", "DROP"])?;
-                netns.exec(&[ipcmd, "-P", "OUTPUT", "DROP"])?;
-                netns.exec(&[
-                    ipcmd,
-                    "-A",
-                    "INPUT",
-                    "-m",
-                    "conntrack",
-                    "--ctstate",
-                    "RELATED,ESTABLISHED",
-                    "-j",
-                    "ACCEPT",
-                ])?;
-                netns.exec(&[ipcmd, "-A", "INPUT", "-i", "lo", "-j", "ACCEPT"])?;
-                netns.exec(&[ipcmd, "-A", "INPUT", "-i", "tun+", "-j", "ACCEPT"])?;
-                netns.exec(&[ipcmd, "-A", "OUTPUT", "-o", "lo", "-j", "ACCEPT"])?;
+                NetworkNamespace::exec(&netns.name, &[ipcmd, "-P", "INPUT", "DROP"])?;
+                NetworkNamespace::exec(&netns.name, &[ipcmd, "-P", "FORWARD", "DROP"])?;
+                NetworkNamespace::exec(&netns.name, &[ipcmd, "-P", "OUTPUT", "DROP"])?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[
+                        ipcmd,
+                        "-A",
+                        "INPUT",
+                        "-m",
+                        "conntrack",
+                        "--ctstate",
+                        "RELATED,ESTABLISHED",
+                        "-j",
+                        "ACCEPT",
+                    ],
+                )?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[ipcmd, "-A", "INPUT", "-i", "lo", "-j", "ACCEPT"],
+                )?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[ipcmd, "-A", "INPUT", "-i", "tun+", "-j", "ACCEPT"],
+                )?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[ipcmd, "-A", "OUTPUT", "-o", "lo", "-j", "ACCEPT"],
+                )?;
 
                 // TODO: Tidy this up - remote can be IPv4 or IPv6 address or hostname
                 for remote in remotes {
@@ -265,72 +277,87 @@ pub fn killswitch(
                         // resolution working
                         Host::IPv4(ip) => {
                             if ipcmd == "iptables" {
-                                netns.exec(&[
-                                    ipcmd,
-                                    "-A",
-                                    "OUTPUT",
-                                    "-p",
-                                    &remote.protocol.to_string(),
-                                    "-m",
-                                    &remote.protocol.to_string(),
-                                    "-d",
-                                    &ip.to_string(),
-                                    "--dport",
-                                    port_str.as_str(),
-                                    "-j",
-                                    "ACCEPT",
-                                ])?;
+                                NetworkNamespace::exec(
+                                    &netns.name,
+                                    &[
+                                        ipcmd,
+                                        "-A",
+                                        "OUTPUT",
+                                        "-p",
+                                        &remote.protocol.to_string(),
+                                        "-m",
+                                        &remote.protocol.to_string(),
+                                        "-d",
+                                        &ip.to_string(),
+                                        "--dport",
+                                        port_str.as_str(),
+                                        "-j",
+                                        "ACCEPT",
+                                    ],
+                                )?;
                             }
                         }
                         Host::IPv6(ip) => {
                             if ipcmd == "ip6tables" {
-                                netns.exec(&[
+                                NetworkNamespace::exec(
+                                    &netns.name,
+                                    &[
+                                        ipcmd,
+                                        "-A",
+                                        "OUTPUT",
+                                        "-p",
+                                        &remote.protocol.to_string(),
+                                        "-m",
+                                        &remote.protocol.to_string(),
+                                        "-d",
+                                        &ip.to_string(),
+                                        "--dport",
+                                        port_str.as_str(),
+                                        "-j",
+                                        "ACCEPT",
+                                    ],
+                                )?;
+                            }
+                        }
+                        Host::Hostname(_name) => {
+                            NetworkNamespace::exec(
+                                &netns.name,
+                                &[
                                     ipcmd,
                                     "-A",
                                     "OUTPUT",
                                     "-p",
                                     &remote.protocol.to_string(),
+                                    // "-d",
+                                    // &name.to_string(),
                                     "-m",
                                     &remote.protocol.to_string(),
-                                    "-d",
-                                    &ip.to_string(),
                                     "--dport",
                                     port_str.as_str(),
                                     "-j",
                                     "ACCEPT",
-                                ])?;
-                            }
-                        }
-                        Host::Hostname(_name) => {
-                            netns.exec(&[
-                                ipcmd,
-                                "-A",
-                                "OUTPUT",
-                                "-p",
-                                &remote.protocol.to_string(),
-                                // "-d",
-                                // &name.to_string(),
-                                "-m",
-                                &remote.protocol.to_string(),
-                                "--dport",
-                                port_str.as_str(),
-                                "-j",
-                                "ACCEPT",
-                            ])?;
+                                ],
+                            )?;
                         }
                     }
                 }
 
-                netns.exec(&[ipcmd, "-A", "OUTPUT", "-o", "tun+", "-j", "ACCEPT"])?;
-                netns.exec(&[
-                    ipcmd,
-                    "-A",
-                    "OUTPUT",
-                    "-j",
-                    "REJECT",
-                    "--reject-with",
-                    "icmp-net-unreachable",
-                ])?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[ipcmd, "-A", "OUTPUT", "-o", "tun+", "-j", "ACCEPT"],
+                )?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[
+                        ipcmd,
+                        "-A",
+                        "OUTPUT",
+                        "-j",
+                        "REJECT",
+                        "--reject-with",
+                        "icmp-net-unreachable",
+                    ],
+                )?;
             }
         }
         Firewall::NfTables => {
@@ -338,83 +365,104 @@ pub fn killswitch(
                 crate::network::firewall::disable_ipv6(netns, firewall)?;
             }
             // TODO:
-            netns.exec(&["nft", "add", "table", "inet", &netns.name])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "inet",
+            NetworkNamespace::exec(&netns.name, &["nft", "add", "table", "inet", &netns.name])?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "input",
-                "{ type filter hook input priority 100 ; policy drop; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "inet",
+                    &netns.name,
+                    "input",
+                    "{ type filter hook input priority 100 ; policy drop; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "forward",
-                "{ type filter hook forward priority 100 ; policy drop; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "inet",
+                    &netns.name,
+                    "forward",
+                    "{ type filter hook forward priority 100 ; policy drop; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "{ type filter hook output priority 100 ; policy drop; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "{ type filter hook output priority 100 ; policy drop; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "input",
-                "ct",
-                "state",
-                "related,established",
-                "counter",
-                "accept",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "input",
+                    "ct",
+                    "state",
+                    "related,established",
+                    "counter",
+                    "accept",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "input",
-                "iifname",
-                "\"lo\"",
-                "counter",
-                "accept",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "input",
+                    "iifname",
+                    "\"lo\"",
+                    "counter",
+                    "accept",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "input",
-                "iifname",
-                "\"tun*\"",
-                "counter",
-                "accept",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "input",
+                    "iifname",
+                    "\"tun*\"",
+                    "counter",
+                    "accept",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "oifname",
-                "\"lo\"",
-                "counter",
-                "accept",
-            ])?;
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "oifname",
+                    "\"lo\"",
+                    "counter",
+                    "accept",
+                ],
+            )?;
 
             for remote in remotes {
                 let port_str = format!("{}", remote.port);
@@ -422,90 +470,105 @@ pub fn killswitch(
                     // TODO: Fix this to specify destination address - but need hostname
                     // resolution working
                     Host::IPv4(ip) => {
-                        netns.exec(&[
-                            "nft",
-                            "add",
-                            "rule",
-                            "inet",
+                        NetworkNamespace::exec(
                             &netns.name,
-                            "output",
-                            "ip",
-                            "daddr",
-                            &ip.to_string(),
-                            &remote.protocol.to_string(),
-                            "dport",
-                            port_str.as_str(),
-                            "counter",
-                            "accept",
-                        ])?;
+                            &[
+                                "nft",
+                                "add",
+                                "rule",
+                                "inet",
+                                &netns.name,
+                                "output",
+                                "ip",
+                                "daddr",
+                                &ip.to_string(),
+                                &remote.protocol.to_string(),
+                                "dport",
+                                port_str.as_str(),
+                                "counter",
+                                "accept",
+                            ],
+                        )?;
                     }
                     Host::IPv6(ip) => {
-                        netns.exec(&[
-                            "nft",
-                            "add",
-                            "rule",
-                            "inet",
+                        NetworkNamespace::exec(
                             &netns.name,
-                            "output",
-                            "ip6",
-                            "daddr",
-                            &ip.to_string(),
-                            &remote.protocol.to_string(),
-                            "dport",
-                            port_str.as_str(),
-                            "counter",
-                            "accept",
-                        ])?;
+                            &[
+                                "nft",
+                                "add",
+                                "rule",
+                                "inet",
+                                &netns.name,
+                                "output",
+                                "ip6",
+                                "daddr",
+                                &ip.to_string(),
+                                &remote.protocol.to_string(),
+                                "dport",
+                                port_str.as_str(),
+                                "counter",
+                                "accept",
+                            ],
+                        )?;
                     }
                     Host::Hostname(_name) => {
                         // TODO: Does this work with nftables?
-                        netns.exec(&[
-                            "nft",
-                            "add",
-                            "rule",
-                            "inet",
+                        NetworkNamespace::exec(
                             &netns.name,
-                            "output",
-                            // "ip",
-                            // "daddr",
-                            // &name.to_string(),
-                            &remote.protocol.to_string(),
-                            "dport",
-                            port_str.as_str(),
-                            "counter",
-                            "accept",
-                        ])?;
+                            &[
+                                "nft",
+                                "add",
+                                "rule",
+                                "inet",
+                                &netns.name,
+                                "output",
+                                // "ip",
+                                // "daddr",
+                                // &name.to_string(),
+                                &remote.protocol.to_string(),
+                                "dport",
+                                port_str.as_str(),
+                                "counter",
+                                "accept",
+                            ],
+                        )?;
                     }
                 }
             }
 
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "oifname",
-                "\"tun*\"",
-                "counter",
-                "accept",
-            ])?;
-
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "oifname",
+                    "\"tun*\"",
+                    "counter",
+                    "accept",
+                ],
+            )?;
+
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "counter",
-                "reject",
-                "with",
-                "icmp",
-                "type",
-                "net-unreachable",
-            ])?;
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "counter",
+                    "reject",
+                    "with",
+                    "icmp",
+                    "type",
+                    "net-unreachable",
+                ],
+            )?;
         }
     }
     Ok(())
diff --git a/vopono_core/src/network/shadowsocks.rs b/vopono_core/src/network/shadowsocks.rs
index 5460f44..9b2c496 100644
--- a/vopono_core/src/network/shadowsocks.rs
+++ b/vopono_core/src/network/shadowsocks.rs
@@ -66,9 +66,17 @@ impl Shadowsocks {
             encrypt_method,
         ];
 
-        let handle = netns
-            .exec_no_block(&command_vec, None, None, true, false, false, None)
-            .context("Failed to launch Shadowsocks - is shadowsocks-libev installed?")?;
+        let handle = NetworkNamespace::exec_no_block(
+            &netns.name,
+            &command_vec,
+            None,
+            None,
+            true,
+            false,
+            false,
+            None,
+        )
+        .context("Failed to launch Shadowsocks - is shadowsocks-libev installed?")?;
 
         Ok(Self { pid: handle.id() })
     }
diff --git a/vopono_core/src/network/warp.rs b/vopono_core/src/network/warp.rs
index add954d..7e167dc 100644
--- a/vopono_core/src/network/warp.rs
+++ b/vopono_core/src/network/warp.rs
@@ -31,9 +31,17 @@ impl Warp {
 
         info!("Launching Warp...");
 
-        let handle = netns
-            .exec_no_block(&["warp-svc"], None, None, false, false, false, None)
-            .context("Failed to launch warp-svc - is waro-svc installed?")?;
+        let handle = NetworkNamespace::exec_no_block(
+            &netns.name,
+            &["warp-svc"],
+            None,
+            None,
+            false,
+            false,
+            false,
+            None,
+        )
+        .context("Failed to launch warp-svc - is waro-svc installed?")?;
 
         let id = handle.id();
 
diff --git a/vopono_core/src/network/wireguard.rs b/vopono_core/src/network/wireguard.rs
index 1944507..1414c3d 100644
--- a/vopono_core/src/network/wireguard.rs
+++ b/vopono_core/src/network/wireguard.rs
@@ -98,11 +98,16 @@ impl Wireguard {
             .to_string();
         assert!(if_name.len() <= 15, "ifname must be <= 15 chars: {if_name}");
 
-        namespace.exec(&["ip", "link", "add", &if_name, "type", "wireguard"])?;
+        NetworkNamespace::exec(
+            &namespace.name,
+            &["ip", "link", "add", &if_name, "type", "wireguard"],
+        )?;
 
-        namespace
-            .exec(&["wg", "setconf", &if_name, "/tmp/vopono_nft.conf"])
-            .context("Failed to run wg setconf - is wireguard-tools installed?")?;
+        NetworkNamespace::exec(
+            &namespace.name,
+            &["wg", "setconf", &if_name, "/tmp/vopono_nft.conf"],
+        )
+        .context("Failed to run wg setconf - is wireguard-tools installed?")?;
         std::fs::remove_file("/tmp/vopono_nft.conf")
             .context("Deleting file: /tmp/vopono_nft.conf")
             .ok();
@@ -110,32 +115,41 @@ impl Wireguard {
         for address in config.interface.address.iter() {
             match address {
                 IpNet::V6(address) => {
-                    namespace.exec(&[
-                        "ip",
-                        "-6",
-                        "address",
-                        "add",
-                        &address.to_string(),
-                        "dev",
-                        &if_name,
-                    ])?;
+                    NetworkNamespace::exec(
+                        &namespace.name,
+                        &[
+                            "ip",
+                            "-6",
+                            "address",
+                            "add",
+                            &address.to_string(),
+                            "dev",
+                            &if_name,
+                        ],
+                    )?;
                 }
                 IpNet::V4(address) => {
-                    namespace.exec(&[
-                        "ip",
-                        "-4",
-                        "address",
-                        "add",
-                        &address.to_string(),
-                        "dev",
-                        &if_name,
-                    ])?;
+                    NetworkNamespace::exec(
+                        &namespace.name,
+                        &[
+                            "ip",
+                            "-4",
+                            "address",
+                            "add",
+                            &address.to_string(),
+                            "dev",
+                            &if_name,
+                        ],
+                    )?;
                 }
             }
         }
 
         // TODO: Handle custom MTU
-        namespace.exec(&["ip", "link", "set", "mtu", "1420", "up", "dev", &if_name])?;
+        NetworkNamespace::exec(
+            &namespace.name,
+            &["ip", "link", "set", "mtu", "1420", "up", "dev", &if_name],
+        )?;
 
         let dns: Vec<IpAddr> = dns
             .cloned()
@@ -147,54 +161,72 @@ impl Wireguard {
         // TODO: DNS suffixes?
         namespace.dns_config(&dns, &[], hosts_entries)?;
         let fwmark = "51820";
-        namespace.exec(&["wg", "set", &if_name, "fwmark", fwmark])?;
+        NetworkNamespace::exec(&namespace.name, &["wg", "set", &if_name, "fwmark", fwmark])?;
 
         // IPv4 routes
-        namespace.exec(&[
-            "ip",
-            "-4",
-            "route",
-            "add",
-            "0.0.0.0/0",
-            "dev",
-            &if_name,
-            "table",
-            fwmark,
-        ])?;
-        namespace.exec(&[
-            "ip", "-4", "rule", "add", "not", "fwmark", fwmark, "table", fwmark,
-        ])?;
-        namespace.exec(&[
-            "ip",
-            "-4",
-            "rule",
-            "add",
-            "table",
-            "main",
-            "suppress_prefixlength",
-            "0",
-        ])?;
-        sudo_command(&["sysctl", "-q", "net.ipv4.conf.all.src_valid_mark=1"])?;
-        // IPv6
-        if disable_ipv6 {
-            crate::network::firewall::disable_ipv6(namespace, firewall)?;
-        } else {
-            namespace.exec(&[
-                "ip", "-6", "route", "add", "::/0", "dev", &if_name, "table", fwmark,
-            ])?;
-            namespace.exec(&[
-                "ip", "-6", "rule", "add", "not", "fwmark", fwmark, "table", fwmark,
-            ])?;
-            namespace.exec(&[
+        NetworkNamespace::exec(
+            &namespace.name,
+            &[
+                "ip",
+                "-4",
+                "route",
+                "add",
+                "0.0.0.0/0",
+                "dev",
+                &if_name,
+                "table",
+                fwmark,
+            ],
+        )?;
+        NetworkNamespace::exec(
+            &namespace.name,
+            &[
+                "ip", "-4", "rule", "add", "not", "fwmark", fwmark, "table", fwmark,
+            ],
+        )?;
+        NetworkNamespace::exec(
+            &namespace.name,
+            &[
                 "ip",
-                "-6",
+                "-4",
                 "rule",
                 "add",
                 "table",
                 "main",
                 "suppress_prefixlength",
                 "0",
-            ])?;
+            ],
+        )?;
+        sudo_command(&["sysctl", "-q", "net.ipv4.conf.all.src_valid_mark=1"])?;
+        // IPv6
+        if disable_ipv6 {
+            crate::network::firewall::disable_ipv6(namespace, firewall)?;
+        } else {
+            NetworkNamespace::exec(
+                &namespace.name,
+                &[
+                    "ip", "-6", "route", "add", "::/0", "dev", &if_name, "table", fwmark,
+                ],
+            )?;
+            NetworkNamespace::exec(
+                &namespace.name,
+                &[
+                    "ip", "-6", "rule", "add", "not", "fwmark", fwmark, "table", fwmark,
+                ],
+            )?;
+            NetworkNamespace::exec(
+                &namespace.name,
+                &[
+                    "ip",
+                    "-6",
+                    "rule",
+                    "add",
+                    "table",
+                    "main",
+                    "suppress_prefixlength",
+                    "0",
+                ],
+            )?;
         }
 
         match firewall {
@@ -251,7 +283,7 @@ impl Wireguard {
                     write!(f, "{nftcmd}")?;
                 }
 
-                namespace.exec(&["nft", "-f", "/tmp/vopono_nft.sh"])?;
+                NetworkNamespace::exec(&namespace.name, &["nft", "-f", "/tmp/vopono_nft.sh"])?;
                 std::fs::remove_file("/tmp/vopono_nft.sh")
                     .context("Deleting file: /tmp/vopono_nft.sh")
                     .ok();
@@ -260,47 +292,53 @@ impl Wireguard {
                 for address in config.interface.address.iter() {
                     match address {
                         IpNet::V6(address) => {
-                            namespace.exec(&[
-                                "ip6tables",
-                                "-t",
-                                "raw",
-                                "-A",
-                                "PREROUTING",
-                                "!",
-                                "-i",
-                                &if_name,
-                                "-d",
-                                &address.to_string(),
-                                "-m",
-                                "addrtype",
-                                "!",
-                                "--src-type",
-                                "LOCAL",
-                                "-j",
-                                "DROP",
-                            ])?;
+                            NetworkNamespace::exec(
+                                &namespace.name,
+                                &[
+                                    "ip6tables",
+                                    "-t",
+                                    "raw",
+                                    "-A",
+                                    "PREROUTING",
+                                    "!",
+                                    "-i",
+                                    &if_name,
+                                    "-d",
+                                    &address.to_string(),
+                                    "-m",
+                                    "addrtype",
+                                    "!",
+                                    "--src-type",
+                                    "LOCAL",
+                                    "-j",
+                                    "DROP",
+                                ],
+                            )?;
                         }
 
                         IpNet::V4(address) => {
-                            namespace.exec(&[
-                                "iptables",
-                                "-t",
-                                "raw",
-                                "-A",
-                                "PREROUTING",
-                                "!",
-                                "-i",
-                                &if_name,
-                                "-d",
-                                &address.to_string(),
-                                "-m",
-                                "addrtype",
-                                "!",
-                                "--src-type",
-                                "LOCAL",
-                                "-j",
-                                "DROP",
-                            ])?;
+                            NetworkNamespace::exec(
+                                &namespace.name,
+                                &[
+                                    "iptables",
+                                    "-t",
+                                    "raw",
+                                    "-A",
+                                    "PREROUTING",
+                                    "!",
+                                    "-i",
+                                    &if_name,
+                                    "-d",
+                                    &address.to_string(),
+                                    "-m",
+                                    "addrtype",
+                                    "!",
+                                    "--src-type",
+                                    "LOCAL",
+                                    "-j",
+                                    "DROP",
+                                ],
+                            )?;
                         }
                     }
                 }
@@ -312,31 +350,37 @@ impl Wireguard {
                 };
 
                 for ipcmd in ipcmds {
-                    namespace.exec(&[
-                        ipcmd,
-                        "-t",
-                        "mangle",
-                        "-A",
-                        "POSTROUTING",
-                        "-p",
-                        "udp",
-                        "-j",
-                        "MARK",
-                        "--set-mark",
-                        fwmark,
-                    ])?;
-                    namespace.exec(&[
-                        ipcmd,
-                        "-t",
-                        "mangle",
-                        "-A",
-                        "PREROUTING",
-                        "-p",
-                        "udp",
-                        "-j",
-                        "CONNMARK",
-                        "--save-mark",
-                    ])?;
+                    NetworkNamespace::exec(
+                        &namespace.name,
+                        &[
+                            ipcmd,
+                            "-t",
+                            "mangle",
+                            "-A",
+                            "POSTROUTING",
+                            "-p",
+                            "udp",
+                            "-j",
+                            "MARK",
+                            "--set-mark",
+                            fwmark,
+                        ],
+                    )?;
+                    NetworkNamespace::exec(
+                        &namespace.name,
+                        &[
+                            ipcmd,
+                            "-t",
+                            "mangle",
+                            "-A",
+                            "PREROUTING",
+                            "-p",
+                            "udp",
+                            "-j",
+                            "CONNMARK",
+                            "--save-mark",
+                        ],
+                    )?;
                 }
             }
         };
@@ -372,8 +416,9 @@ pub fn killswitch(
     debug!("Setting Wireguard killswitch....");
     match firewall {
         Firewall::IpTables => {
-            netns
-                .exec(&[
+            NetworkNamespace::exec(
+                &netns.name,
+                &[
                     "iptables",
                     "-A",
                     "OUTPUT",
@@ -392,64 +437,73 @@ pub fn killswitch(
                     "LOCAL",
                     "-j",
                     "REJECT",
-                ])
-                .context("Executing ip6tables")?;
-
-            netns.exec(&[
-                "ip6tables",
-                "-A",
-                "OUTPUT",
-                "!",
-                "-o",
-                ifname,
-                "-m",
-                "mark",
-                "!",
-                "--mark",
-                fwmark,
-                "-m",
-                "addrtype",
-                "!",
-                "--dst-type",
-                "LOCAL",
-                "-j",
-                "REJECT",
-            ])?;
+                ],
+            )
+            .context("Executing ip6tables")?;
+
+            NetworkNamespace::exec(
+                &netns.name,
+                &[
+                    "ip6tables",
+                    "-A",
+                    "OUTPUT",
+                    "!",
+                    "-o",
+                    ifname,
+                    "-m",
+                    "mark",
+                    "!",
+                    "--mark",
+                    fwmark,
+                    "-m",
+                    "addrtype",
+                    "!",
+                    "--dst-type",
+                    "LOCAL",
+                    "-j",
+                    "REJECT",
+                ],
+            )?;
         }
         Firewall::NfTables => {
-            netns
-                .exec(&["nft", "add", "table", "inet", &netns.name])
+            NetworkNamespace::exec(&netns.name, &["nft", "add", "table", "inet", &netns.name])
                 .context("Executing nft")?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "chain",
-                "inet",
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "{ type filter hook output priority -500 ; policy accept; }",
-            ])?;
-            netns.exec(&[
-                "nft",
-                "add",
-                "rule",
-                "inet",
+                &[
+                    "nft",
+                    "add",
+                    "chain",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "{ type filter hook output priority -500 ; policy accept; }",
+                ],
+            )?;
+            NetworkNamespace::exec(
                 &netns.name,
-                "output",
-                "oifname",
-                "!=",
-                ifname,
-                "mark",
-                "!=",
-                fwmark,
-                "fib",
-                "daddr",
-                "type",
-                "!=",
-                "local",
-                "counter",
-                "reject",
-            ])?;
+                &[
+                    "nft",
+                    "add",
+                    "rule",
+                    "inet",
+                    &netns.name,
+                    "output",
+                    "oifname",
+                    "!=",
+                    ifname,
+                    "mark",
+                    "!=",
+                    fwmark,
+                    "fib",
+                    "daddr",
+                    "type",
+                    "!=",
+                    "local",
+                    "counter",
+                    "reject",
+                ],
+            )?;
         }
     }
     Ok(())
diff --git a/vopono_core/src/util/open_hosts.rs b/vopono_core/src/util/open_hosts.rs
index 76f33a8..73cffd8 100644
--- a/vopono_core/src/util/open_hosts.rs
+++ b/vopono_core/src/util/open_hosts.rs
@@ -10,31 +10,37 @@ pub fn open_hosts(
     for host in hosts {
         match firewall {
             Firewall::IpTables => {
-                netns.exec(&[
-                    "iptables",
-                    "-I",
-                    "OUTPUT",
-                    "1",
-                    "-d",
-                    &host.to_string(),
-                    "-j",
-                    "ACCEPT",
-                ])?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[
+                        "iptables",
+                        "-I",
+                        "OUTPUT",
+                        "1",
+                        "-d",
+                        &host.to_string(),
+                        "-j",
+                        "ACCEPT",
+                    ],
+                )?;
             }
             Firewall::NfTables => {
-                netns.exec(&[
-                    "nft",
-                    "insert",
-                    "rule",
-                    "inet",
+                NetworkNamespace::exec(
                     &netns.name,
-                    "output",
-                    "ip",
-                    "daddr",
-                    &host.to_string(),
-                    "counter",
-                    "accept",
-                ])?;
+                    &[
+                        "nft",
+                        "insert",
+                        "rule",
+                        "inet",
+                        &netns.name,
+                        "output",
+                        "ip",
+                        "daddr",
+                        &host.to_string(),
+                        "counter",
+                        "accept",
+                    ],
+                )?;
             }
         }
     }
diff --git a/vopono_core/src/util/open_ports.rs b/vopono_core/src/util/open_ports.rs
index 79d8b45..4df63e3 100644
--- a/vopono_core/src/util/open_ports.rs
+++ b/vopono_core/src/util/open_ports.rs
@@ -11,75 +11,93 @@ pub fn open_ports(
     for port in ports {
         match firewall {
             Firewall::IpTables => {
-                netns.exec(&[
-                    "iptables",
-                    "-I",
-                    "INPUT",
-                    "-p",
-                    "tcp",
-                    "--dport",
-                    &port.to_string(),
-                    "-j",
-                    "ACCEPT",
-                ])?;
-                netns.exec(&[
-                    "iptables",
-                    "-I",
-                    "OUTPUT",
-                    "-p",
-                    "tcp",
-                    "--sport",
-                    &port.to_string(),
-                    "-j",
-                    "ACCEPT",
-                ])?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[
+                        "iptables",
+                        "-I",
+                        "INPUT",
+                        "-p",
+                        "tcp",
+                        "--dport",
+                        &port.to_string(),
+                        "-j",
+                        "ACCEPT",
+                    ],
+                )?;
+                NetworkNamespace::exec(
+                    &netns.name,
+                    &[
+                        "iptables",
+                        "-I",
+                        "OUTPUT",
+                        "-p",
+                        "tcp",
+                        "--sport",
+                        &port.to_string(),
+                        "-j",
+                        "ACCEPT",
+                    ],
+                )?;
             }
             Firewall::NfTables => {
-                netns.exec(&["nft", "add", "table", "inet", &netns.name])?;
-                netns.exec(&[
-                    "nft",
-                    "add",
-                    "chain",
-                    "inet",
+                NetworkNamespace::exec(&netns.name, &["nft", "add", "table", "inet", &netns.name])?;
+                NetworkNamespace::exec(
                     &netns.name,
-                    "input",
-                    "{ type filter hook input priority 100 ; }",
-                ])?;
-                netns.exec(&[
-                    "nft",
-                    "insert",
-                    "rule",
-                    "inet",
+                    &[
+                        "nft",
+                        "add",
+                        "chain",
+                        "inet",
+                        &netns.name,
+                        "input",
+                        "{ type filter hook input priority 100 ; }",
+                    ],
+                )?;
+                NetworkNamespace::exec(
                     &netns.name,
-                    "input",
-                    "tcp",
-                    "dport",
-                    &port.to_string(),
-                    "counter",
-                    "accept",
-                ])?;
-                netns.exec(&[
-                    "nft",
-                    "add",
-                    "chain",
-                    "inet",
+                    &[
+                        "nft",
+                        "insert",
+                        "rule",
+                        "inet",
+                        &netns.name,
+                        "input",
+                        "tcp",
+                        "dport",
+                        &port.to_string(),
+                        "counter",
+                        "accept",
+                    ],
+                )?;
+                NetworkNamespace::exec(
                     &netns.name,
-                    "output",
-                    "{ type filter hook output priority 100 ; }",
-                ])?;
-                netns.exec(&[
-                    "nft",
-                    "insert",
-                    "rule",
-                    "inet",
+                    &[
+                        "nft",
+                        "add",
+                        "chain",
+                        "inet",
+                        &netns.name,
+                        "output",
+                        "{ type filter hook output priority 100 ; }",
+                    ],
+                )?;
+                NetworkNamespace::exec(
                     &netns.name,
-                    "output",
-                    "tcp",
-                    "sport",
-                    &port.to_string(),
-                    "counter",
-                    "accept",
-                ])?;
+                    &[
+                        "nft",
+                        "insert",
+                        "rule",
+                        "inet",
+                        &netns.name,
+                        "output",
+                        "tcp",
+                        "sport",
+                        &port.to_string(),
+                        "counter",
+                        "accept",
+                    ],
+                )?;
             }
         }
     }

From c9fc6c860532ca4dfea8625a2cb7becceaa993d0 Mon Sep 17 00:00:00 2001
From: James McMurray <jamesmcm03@gmail.com>
Date: Sat, 4 Nov 2023 16:54:00 +0100
Subject: [PATCH 2/2] Update docs

---
 README.md            |  43 +++++++++++++++++++------------------
 USERGUIDE.md         |  50 +++++++++++++++++++++++++++++++++----------
 protonvpn_header.png | Bin 0 -> 65607 bytes
 3 files changed, 61 insertions(+), 32 deletions(-)
 create mode 100644 protonvpn_header.png

diff --git a/README.md b/README.md
index ebf0795..2e7b0df 100644
--- a/README.md
+++ b/README.md
@@ -24,30 +24,31 @@ lynx all running through different VPN connections:
 
 ## Supported Providers
 
-| Provider              | OpenVPN support | Wireguard support |
-| --------------------- | --------------- | ----------------- |
-| Mullvad               | ✅              | ✅                |
-| AzireVPN              | ✅              | ✅                |
-| iVPN                  | ✅              | ✅                |
-| PrivateInternetAccess | ✅              | ✅\*\*            |
-| ProtonVPN             | ✅              | ❓\*              |
-| MozillaVPN            | ❌              | ✅                |
-| NordVPN               | ✅              | ❌                |
-| HMA (HideMyAss)       | ✅              | ❌                |
-| AirVPN                | ✅              | ❌                |
-| Cloudflare Warp\*\*\* | ❌              | ❌                |
-
-\* For ProtonVPN you can generate and download specific Wireguard config
+| Provider                | OpenVPN support | Wireguard support |
+| ----------------------- | --------------- | ----------------- |
+| Mullvad                 | ✅              | ✅                |
+| AzireVPN                | ✅              | ✅                |
+| iVPN                    | ✅              | ✅                |
+| PrivateInternetAccess   | ✅              | ✅\*              |
+| ProtonVPN               | ✅\*\*          | ✅\*\*\*          |
+| MozillaVPN              | ❌              | ✅                |
+| NordVPN                 | ✅              | ❌                |
+| HMA (HideMyAss)         | ✅              | ❌                |
+| AirVPN                  | ✅              | ❌                |
+| Cloudflare Warp\*\*\*\* | ❌              | ❌                |
+
+\* Port forwarding is not currently supported for PrivateInternetAccess. PRs welcome.
+
+\*\* See the [User Guide](USERGUIDE.md) for authentication instructions for generating the OpenVPN config files via `vopono sync`. You must copy the authentication header of the form `AUTH-xxx=yyy` where `yyy` is the value of the `x-pm-uid` header in the same request when logged in, in your web browser.
+
+\*\*\* For ProtonVPN you can generate and download specific Wireguard config
 files, and use them as a custom provider config. See the [User Guide](USERGUIDE.md)
-for details - note that port forwarding is currently not supported for ProtonVPN.
+for details. [Port Forwarding](https://protonvpn.com/support/port-forwarding-manual-setup/) is supported with the `--protonvpn-port-forwarding` argument for both OpenVPN and Wireguard (with `--provider custom --custom xxx.conf --protocol wireguard` ), note for OpenVPN you must generate the OpenVPN config files appending `+pmp` to your OpenVPN username, and you must choose servers which support this feature (e.g. at the time of writing, the Romania servers do). The assigned port is then printed to the terminal where vopono was launched - this should then be set in any applications that require it.
 
-\*\* Port forwarding is not currently supported for PrivateInternetAccess.
 
-\*\*\* Cloudflare Warp uses its own protocol. Set both the provider and
-protocol to `warp`. Note you must first register with `sudo warp-cli
-register` and then run it once with `sudo warp-svc` and `sudo warp-cli
-connect` outside of vopono. Please verify this works first before trying
-it with vopono.
+\*\*\*\* Cloudflare Warp uses its own protocol. Set both the provider and
+protocol to `warp`. Note you must first register with `sudo warp-cli register` and then run it once with `sudo warp-svc` and `sudo warp-cli connect` outside of vopono. Please verify this works first before trying it with vopono.
+
 
 ## Usage
 
diff --git a/USERGUIDE.md b/USERGUIDE.md
index 4c696ac..3580530 100644
--- a/USERGUIDE.md
+++ b/USERGUIDE.md
@@ -438,21 +438,60 @@ Mullvad wireguard       usa-us52.conf
 
 ## VPN Provider specific details
 
+### Mullvad
+
 Mullvad users can use [mullvad.net/en/check](https://mullvad.net/en/check/) to
 check the security of their browser's connection. This was used with the
 Mullvad configuration to verify that there is no DNS leaking or
 BitTorrent leaking for both the OpenVPN and Wireguard configurations.
 
+
+### AzireVPN
+
 AzireVPN users can use [their security check page](https://www.azirevpn.com/check)
 for the same (note the instructions on disabling WebRTC). I noticed that
 when using IPv6 with OpenVPN it incorrectly states you are not connected
 via AzireVPN though (Wireguard works correctly).
 
+### ProtonVPN
+
+#### OpenVPN Sync and authentication
+
 ProtonVPN users must log-in to the dashboard via a web browser during
 the `vopono sync` process in order to copy the `AUTH-*` cookie to
 access the OpenVPN configuration files, and the OpenVPN specific
 credentials to use them.
 
+Note that there may be multiple `AUTH-xxx=yyy` cookies - the specific one we need is where `xxx` is equal to the value of the `x-pm-uid` header in the same request.
+
+![AUTH cookie example](protonvpn_header.png)
+
+#### Wireguard servers
+
+Due to the way Wireguard configuration generation is handled, this should be
+generated online and then used as a custom configuration, e.g.:
+
+```bash
+$ vopono -v exec --provider custom --custom testwg-UK-17.conf --protocol wireguard --protonvpn-port-forwarding firefox-developer-edition
+```
+
+#### Port Forwarding
+
+Port forwarding can be enabled with the `--protonvpn-port-forwarding` argument, but requires using a server that supports port forwarding. 
+
+Note for OpenVPN you must generate the OpenVPN config files appending `+pmp` to your OpenVPN username (i.e. what will be written to `~/.config/vopono/proton/openvpn/auth.txt`)
+
+Note the usual `-o` / `--open-ports` argument has no effect here as we only know the port number assigned after connecting to ProtonVPN.
+
+The port you are allocated will then be printed to the console like:
+```
+ 2023-11-04T14:47:31.416Z INFO  vopono::exec                            > ProtonVPN Port Forwarding on port 62508
+```
+
+And that is the port you would then set up in applications that require it.
+
+### Cloudflare Warp
+
 Cloudflare Warp users must first register with Warp via the CLI client:
 ```
 $ sudo warp-cli register
@@ -470,17 +509,6 @@ $ vopono -v exec --no-killswitch --provider warp --protocol warp firefox-develop
 
 ### VPN Provider limitations
 
-#### ProtonVPN
-
-Due to the way Wireguard configuration is handled, this should be
-generated online and then used as a custom configuration, e.g.:
-
-```bash
-$ vopono -v exec --provider custom --custom testwg-UK-17.conf --protocol wireguard firefox-developer-edition
-```
-
-Note that port forwarding is currently not supported for ProtonVPN.
-
 #### PrivateInternetAccess
 
 Wireguard support for PrivateInternetAccess (PIA) requires the use of a
diff --git a/protonvpn_header.png b/protonvpn_header.png
new file mode 100644
index 0000000000000000000000000000000000000000..108fb455bb3c2723116953a0b15887c33cfa25d5
GIT binary patch
literal 65607
zcmYg%18^o?w{>jWo;Z^yww*k&G2z6R*qGpnZ5tCO6HRQ}wr%U5_x<ku?q9pQy1GwQ
zpFXvB?_PVYeZrI!q>vE^5Wv8|kY%LBRlvX?NWj3r!Qf#2-g$fU<Ntetx0lv-0s}+D
z_~!thS@(Sd10w^I5f@Q&*FXCPtEDEj=<9}?yb%Ex3hjk^*8aNO%98wxrPwk*#~^Y*
zX#6gfxnHq>uGo^jwrNR1xfT)!O)Zw1xbV^TlgCY4ix-ZT`jH<s=HjB=$$TS??{<R6
zd?JoLqedf8)B(tgQd%thSgY`%F1IJ`jHgax8U_l5`#<Afhr>J4>|~uWGB%Fv@OjM_
z3vsn~wPRevAtVf0Z3=X_-jUclI7o^R|Av`XLTFd}KmnmB1fk%10N`Q~wYcjo>12ti
zg+5Q`qxdkQR$+4_-Bs<E3WH<khmu8$2`@W5KK6Im9U!Bn#cOrD#D;@K#EkWQf7u!5
z+Uzp$Blge9@$0qT7WyUGu7_x7S11yPa7sG&5WJ$sl_Hr6u!>b`FAOPNa@hJVR%r#g
zkC&#}5^B(4(qpUlGylWo(jBw<uqdbdos|xUIW=00W`dHRzVQe@Yqd#ySMq_|_rNji
z@T<ES5lYsb$l*ifRENtgtBb6HOmEJsqTzNOrv26v&y{(Wnwpsp`&pDGOwZ^b?jqzx
zGHr)$2`ApnBBp^)XS*N?LoywO5)GVQWFn;^U1`GaGAa_@nd{vcA#8M%^@OyaXDba-
zWMmOIOjsQ_!%|syqm<Y^g#}?rCvg|pKgwvJejB5^a)Cj@qV&Z<wr)LOJ;aoh(6AFA
zzr8mQBI;stjP0d+TFb3AR&HG^;O)YAZFTv>N)XSk^ds2a`PBFgvuqT#^Vx0w37A_#
zTN{bQt;*rB#z7(G4H_E*Vqsyyx$K`pyfJsHseAiLm@W)j0E(9vy4AkHG-Vdr>ovz}
z|8QTB((PmY^nlY#@DG(*uWwb^={~?-a6U>vp{D2!LB-DYJ(;ugw*Y`|Tc>(MK|`xs
zxR(AN30}Yx^dZARwGUuY8`9jPya^^1d=<cZB<;T!H;!($Hp`o@%DJ-p`SJaWNJME}
z&F~naNn_t^!igjmXV%rM8|AjIF|6bp7P4(p(N$_En86mU<U0YPZKuq%>w(^zjS~*@
zm-_)X6PqK#uB9F%YG@wmahfa;HKJF?lK)m%wV`X*WU3Pt=E{39Qt#(G0uIQozb<43
zv2%98V9r@>Jw~Mz3kC)z=KON5RCQ={H1O~Bhx1H>wI;jm3KlA<VBdPHTUZ<4?!kD5
zy|Z&rU|?X4R-^Tz!k@#F`EqFm1sprm@xYJ}SiNuG;^N~2y1Il5i;EFDT~6lU9UL6&
z9US~yTlu1icmm$uyq%9{pykuqMO0Mcg-QOL&Ge++9Zf?<5pal#ibB|}w}8&hY_@rP
zUhYIBC4-f?sv-ajp`p%4Q{YUxjp7OlC|?aa7#VLE^>CVER{QR^&C4umn`&#(SH?D3
z(%=yhd$ai5M&^oio9x(|GJA&ND2={<r>f86?a{g+MYJ|IHa3QeBvJoEtcN?0aB9EZ
z0}T#~h=_Q1wv1_JX6Ami<v;a<*ESYNjp=Jbgo%j>O;q>$_lTPRrRi)#Oblv8Ma9<M
z9#vw0&%RTRwyrKEJ9|AGWk<+pV?zV>OK{GpRyYO4RXw>9-L)ZGc<1Lmg?va<6i2aQ
zjwtiim%OYuzifUL)!88HC9K{@0C{Px^ccYE+PQ-Braztwm7Gi!GHeY2a-cq_9GxV}
zT}=xf*;s*eP(^zf)H>ku)gch->pO4mH!b#fFE{Z`+v%&Xo97ajUy(1)J}}>1Z#5l(
z-ly2W$4_LZ7<1fsILOE>tyUe5`c{waisPOi78Y8&Ui6+YLZ1%dVPP_9plsaCi7dX|
zr|aFC`g$za!#3#~(VmErrCJkoG&C|s9Uz(6WOkIx=>q&biI8tw%@zxIO<i4YCXdtA
z>W@x%L<)n|a!qDWToVv77;|!gWK=+HZLPh}>%;kRR#vp_YGacB&(qlCWNQ9|;eoYg
zr|VJXPPoD_Tm@=Ma&mHrVMELLvLs=5yR|>$jPbL@@|acTY3!Eq!lK?jKF|Ryc5B=-
zdPHbAbKsCLWC8-ji`53WBaBSm$U=UH6Il?YMveuu^>Y%P!~2fls99G_^os78W2r1+
z7R)9+R6noxKJ@A>;)LsadV8S*<}0+>&Q_ZgX%CjobFi;=yi(ndcYk@I2<5y+jSh{E
zOWYoeL&tlZuW;nqd859LONfiZ?M37ayR!@^D=Ui{IQo!0YE>b=^|OjY;rYvkN&Q_U
zR1Qkk6=Ih{VF(IwaY}cpv?Qq!Zf{@Ueh(<(&JpNAwL|W79IDBmaCN_PD$ZN4IEPiZ
zyXGr&4ogA(ZXVsE3u)UuD{1yiXk&FRCW9SSb}Z}qZL}A#`b~i}5l&z?s>xL{zwk7J
zTqlMosyevP<b35el!O=I)R_RanV6axFBn7&G@?x)+x?pK-YXA<?hs2bWJIk>!DdkY
z<CjulV=DI&L`mbh<W!J3pnn$6oOw^cj7fYx;-rA_jpGYK(zi*15Wjc;P7%nhvQ0@s
zQW8O^mfGK~o!98RtJY)?suBVdV}Uz0JsklNnfb=R`x+z+cd^-t>gDAnGTYtifTMq>
zHQU`2LC^eV;P>88^Yiz@_x+J12#0OrIt6$CJ>IvE*UO%XEH2Epr`sOC*9Y4?;6n1%
zBd<~X&iOf$_jiig@530|pKWBU;4e3$%+R*TLWd2D`jn(Kok5#vS}Y=TiilmEx1tl1
z-;q-1knmXx6~bUKnZN4NR45w}$sso7G@xyI-^#~v238x*45h<U!!WLe{Ajxl{z;cm
zJP<{QXuCKVCqsZKgF}J}q)G#_Ofxc7>Nep>6E<amhNT}b)}eR0cl}Q%`cz7Y=~RC{
zfkL}fe+n1%1^RF~M;ET)e0-*Jkir)Rj?)80@6>(XS}*$K<X6A`Sb<~0*s-sx&`_Zr
zDc)4_7U|oY|2*rz=Vy!5dSmQJOA7U~Rrq;$R-2mUgD`7=EES%{py9)f@<Zx9e4m$;
zy%gSaoFKw217x@l`vEuhMO982+VqIm38|QxbTG0gY>0e3aL|eEdbv*vxDki6=rHT>
zCyKen&lfj|4uGUnKj@y|<<3Bcjh=k%?jy~xWPl{BQh84Ly)2D`@Q@l8_q&Z{XwB3O
z`T;TXWif-!+ovU>P(h&*Z8(saH(_x1B?XsEzssfPiEVfbq(@_eGDSmDA+seRsp-ZU
zW$$;>GZ2B1fRY7B`<ulS?r^E7G2hw_bNo7v+^FFzOs8o`+B~)#oev;7QiX1NMyYc7
zr@4#(VTPEHh#7c)s+c?99H(t7qFA`Na0PFDu;WmuHEdS4Iy^3#525n=%~0%MGnh_9
zwN^1ntM4I=j4+N44m667ZUEa6PhRgGCKO%o{aUr0AbElP?O&86z(RLOTp}VpJ10CL
zYGz)FLEKu6Akgqh=f^!Wqi!Q`in=yUGDmzKTF@Au0wM;|pFT@&v>fWy;|g)eml&J4
zz-MkGrPDkm&&M2B{52Dook*B-BC{o?38y(P%?SLZUbWkr(vsV~Y9hQ_A&2p8W*PnW
zsLf_l!DAc#5xxs}#KJ~@;LHRID<9GW*=n5?t?vVEMME4?@gtK_C{<sMP}uW_Ht2%@
zyI}+@TWm$x;R4J~`MJ!x$>EttG13LDubSN;c~qcGLjg+=i2QlJI`ZPKri87p<_^0W
zTi6oe?SlsOE|E)a*mG}`Bv3x*ViqxT@)3SA7QxA^1Eh9dtf3Zf0yw<h;ZjgDzCE5d
zZQ`J(-2k>6UHXI{`BHS3jSZBEpFMzfoHk2J2g<-IdR^M(&p<yR_bbEc_KI4g9GnHP
zW9bCnZlF6JW>${ew|kZZzJc6&fQHS^4DL5lKps7+lu!IXItsO!YKcOBGL!De9pdhw
zFY^oDQFec!(_+=P01eB(xfPGsnN}g&`$a)!UY#^-pT8YWO_tx80LiBkmMcjnq~kKA
z>bZ!6io?H%j1_%bVdBUJJg6w8y>7;(WsTHjv>gNWVxYIw2hq6}u{$v6H#H`m<M#dN
z*EUkE=#1lD@h1)Js;(tu)fb&y_~NZI`>IwbNwWca((e(Kttzou<v-H`<F<s$FcH~!
znE0W;WQth_q}W&b6KeReU{K0`nfkug{c_nR%MCagDZl73AYBaO`~ACpqywYf>k$V?
z0p#U%J)?cnRQm!1xHnC-IzONqBEw}+KU^|@YB5}nHS0Z;bNhX?De+(ax_5hfBYxEZ
zq*?yOlQl=RP7E2a&W|+%0dCv#=nH=U_=Y`Ohley4Oj;(&*+NpsH>rkKJw(LB-|jFI
z>Y)*F;1C&K`D;4in$kGn^bWUsLl8S~=3Rs<6$qaQIP(BuQ${`Fal<%#UXGi!!=dod
z8O`pIPOndH3u?8@$gfK^_!aUQoDv<(dQ}r?sWJ;&-GL4VV`&)b#_~gL9=A~Ps2R)d
z-T<Rn%iJd(VAs-G&wj*T<iSqy5ArZqUa;#MAo)7o7#=<L+k|fOmNq{ezRT?+tM+8y
z?oa12H3aKifYWhTEfe|mP4Boai+$D{I&sYFmPQADFp^sc)e#;AR_Pxss@`;RyC*>^
z2uriCsneT8zI+Ks^$1)sZL7@LT~?pnPuJ(QfR8g;*Fh{yB*b0zCur;~Hu~4^E5zS3
z2)dSL2quD;;i4(cSqBG>Y%@UR=sZJ1>gYvaW5DmZN{~ats$xY8U5#FZk<xq-*qaHG
zUo??l5E{?Dwnm3-S%MYb#i=AkIa-jD@8r5m#lNUgS7|Nrp>BuVOf^*U%+!SveX%lR
zEFef|?4J@2fcWB*EN5hu8#JaQr@h2HGZR_Qa+jrqZi?06acXYE9!pUz9MvJu{>O12
zLw;n@vZS2M#WNc~M}Ut%MTPvLAd$nto_0NqQhMe05k0zZt#xyo#O@KFEv;Zn<%e6O
zB43Qq@XwGK&lN|$8Y;L(H!2|~aLT@B_UNy7p-X1MFlmgBXNr0#dLl9>=6ZB;W{TlD
zBuk9`!l{s&C)Ve!%fDcYhH;3oLWHgz?8kbG`k#;cMFU(M7X7i0r`;Hgq(jFi-YQbQ
zf}5(0ED;wP@l@fOg8iHQ(OUCKl5KomTV&k62&Tn2&@cmE>rHefJnH2|nuUYMTgJtn
zoaNmgyGU%40%l-#>R1gV&8u+@DMAL}(s4X!)Qm~ka(WQ>Na&}T4(FtMH?GiP{p__M
zZO?}%RK@3a@KVz`l1QftW!#gFGoY$jg))dvDG5g{C^%Ej7uWYbvdN<F^>~3z1WY?R
ze&n%E!!x;nU9h=oIP2^+t?`5B%fE43<BBY${aeyfLSVed9xH@}$kzM&@Njc$9pjNW
z9Zuj>t+q5Q@#*7^{sl3g$t<0He9_e;oQ{N%`MdSiC>BVt_&h3fbq=R*rWNbh;nGF;
zF#LQ7<*-XVp*Y=)j$l6KnCS7MhclpRq}~b~M`_Dz6agO?gX~Dq*Z=~i0Y3a;Ldey<
z?H8Ms`>vA7)a{Muj3K*O@B&8TEzBg;C^eKrvuOJ!mY^UUjW9|7ry=e&dG+qOe&ly1
z6^E1P3vTP<;-RgT4*X123I`7TA0o+k1@emn0Jw;*b7y$QETZX+WvqevAvt#0!af=b
zT29pP{GCF3yHk|KdH{V097HWHel2LgR=0;qfGEWT8>D|$A82zPjiVj+2TN6{r*3^i
z?F$sztV~|UPhm#qo<5Py&V*_@pQ(a7x1vjB)pbXwq&@2{M0iWvBes;h_mp~OwV!Gu
zpH{eEK2oaX<;M%MjFPXk6OEykJQ5p1c}tYg3DLp-ntyO`SN1Bk^HBbZAViWz=ihqN
zO#??5sQEkESq-bbex+|0J=XPiLV>EBD!a8!q-0}ofMi!FJ2Z^A!iVLKg@X8SjZyUp
zkXI}4ukW)UO+EHPWRMcDskybap~dZQEK4deLQyu$=a*s!!s<B{GivYyLE~iJ1OYKQ
zH(%4|pYs1hfv}51oy5DV9qW~`l^+EJIv~Zwlh3}wagGlXv#yU1!xg+P<vKCc1usb%
zXVDA)<e+q<2!7K{($ZE2OQ8>v7m;O^V}Umk?GXoYFbog#d=H$&21+2yFFC}$<1a}C
z%Hv4IkYLM5iJel_3Q|B&K->ol!$(P(E?YJ@@V#IR)22~H`|xu6N=cOHo>20gUu7?(
z^8YC`_h=`-!@_=Jx8Nt?%Cw<Yp{?&=0*X58;8aOH7t>azNz+t#On>TSd6hXuX;tAE
zp@*z&=gz)dFPUwYL)_fYr182GD|Q6mZeBgN#G9y6pt*j?FQR%^Pw15)Diwbcb|M-#
zukhqmIc!B?TDvC1I|e<6zZR1ZR|#W&$DND%k_UAS81?~+s34nDm(->vPCGb{vsNK8
z&utV|$OSVl@LZj1Ozqr%SAlOwb7A}Xk^B@Ig@KOt*W7i`4C7Pf{236J*yVNBD~OVE
z*Y^XV-uyl^$3L74B{k5l6BC|!a;oGNRLKI~U}srRFVMh9Q-3kcbU&p48UP}{<l>bU
ziTP_Xillkz!PP6taX#*v`RDEd=%bkbPVuBm)<pyV9Mj*({l}qU#g&E?_VA6(o~@8u
z)}g`98wpqac=sCbM5$70NgLmA1#sSc&+@*ac1m(h@o((?8-IQj5GF6+wiz3s&vnK(
z4~n#%zsP`hZl&OP4lM?~-R8*MvbT=%mz^FBaU!Qf^4}Ce0ns2PEa@Rb`wQ3%T2opt
zPVHa0+Wt3=)FOr5w9WC9=j?D|I1lU_Q+7jquBD~vP`0k9uD$3(VPWS^X2V3&ImPp+
zw5&#yDZ@j5h6<mf$I{d3%R~1C%1BkT*hsFf2&prQh;LnjeyWrOp+9S#1obMk0fylX
zK1e8^g83~iwfcIehz)EnBAu$wdVK}Hh_)US?+@-zVQu*eLtR*&0dnhz#}Kh8P7=8@
zqd6&l8zZu<yB))G6MhYpa^kQ9eHZQSuAHOaD=z|28}}Mt?1U@Ci)Sh}4b(K^OzAAp
zwwQ||wW%_))MuIU9D5UH;~dDK(qBLSv-W=s84-NJa}3WYhAAWh^Q%tNdGsTWtAwI;
zxQhIC&256{^**k-J%5957BnHwwUVUCIxO7~EwIB<n2)rXo>ZPFA}zyL)5?(*tsD>>
zMFq*S+-Ol?LXvdX)Hj0;*}{hqM8Wj{K4HFMXipf?!%x4*!bs0du&_$8ASo{VuWiMl
z$144@Dh&=`!bmxq?}kW$WOZN;2PU&>GHM@y-zT5rIkQBBh9EtR6B{KNbQT5@s<>d4
zNZDObu32n_7hR$ZkePHW!eMH(MUGQ48QSWT2+fdjus~wKB1l}&O6VEeonur9h`K=g
zgtC63Ut<0EPsIHb*uT7>W(r8V4#A5c^S*2}NAb1rVOQt9w`f_B(z5vnN`M<%p3jlA
zsgv{YqdX#3BEv*8)!t+^b3b%Gb6=n9*<|j>X1ukOTKCSlCt4&x95!Bv*qfp7d%*(>
z3x7GH-A;i`5Jwu4*9JKl^2TSR_b6MFmL~n0#ju}f(jxAs#&3`?GM_K|er@(o_LN0e
z`o10P2ca^`B4*xLc&v=1#)v|O?oW>{EuGNaTttMgY(*s@Nhzl7onK^a&1MV6E<x2u
zauywBjgxO+&u$kyu#>5X)>eQ>>zBra!*~vT-1rR-GZD67jfA<K3w>17x7Q22AqI8k
zXBaHBD0x>r{0=8ikvTasmgTWDYppl~CcJhr<CbxHz!4TU5wX=If8jzDpe8a#D#?dQ
zpNxWxLP-}2X?%LVw{%VA>o1kz=K4ldv`bv{r&r3WsUf0s3)?m^d8VOZ34i?ro*3=A
z0ZF)s;lRsiA;4A;WQ&`<ztkb;(-k5r(dV6;H_<Fs;5w5Ln>j`cmX7`&4uLoy-n6G2
z{+Knq5hOK9KU0MKLP%7nCOJ6^VfdMz-i;5f-jELbNK!aIto4XK11NH)`}CF-nMJT@
z4y|F7xJ1<30_&pCNmi35z0pNvz5jcqsbY9j1l$`j8d=n!OD6(5N#zl3?yu`7zPsN`
z!Jd*`YZFNOOYq^@BM!Aa#`UDPstNYpA)gRi<(}XM_trrC?Ju!7;wJB~A@=oChrhp;
zul)=Q0dI*siLskbvHwYIbSIvW6PC)z=KNq0IRK(j$sOsD|HSIs*UsZHeXCceCg)v;
zNnU_SJjp)Ol4%As{sviAP9=1gnmQd_4q8<^(|3x-6H(}51*@6pyX4pFaLBZ2i|3M)
z3lqfHW#<nRkh_FwrIet8(=cQm7(g)4crESmi;GLvwkX+2Uu6BQ057Z~`818u6i1`_
zmT<nU?Mb&OL>JR(UqzorJ@01O`?~S}wy3r}*n>LEbPxJIM-me($4^y!#9PC}OWYP}
zKzHy~Ic4K)SGs<&M`cPjI)j74JJW420^GJq_}MB0ZL!dYbiRVM<?4>rc3H<O4uMJN
z<?O;i&7s_jGu&%4^fgErBL&6fbwCN(V!eieaY5mKzUf>Mazouc2eQD1cIXP@hGg(8
z3loo_siitn4MB5QhTjxQ*+0ZzyiE2DP`jUxeP3?48F8X|@}gL2Y0rXqnJ@?!zMx(I
zs>~}=t4gMc&fF19o-`>IJ{w(w&OSL^+A8O$%Y2Y$rXVq^l4q#^niknx9HWHvT<(hl
zTU=@@3uVM5GuHvX`>-+axa<PrqV78rg*S$<DG8Gd68pM-Ej(0Vd?Abr4wi<EU}wZH
z^Q}A*LeBasa2-df@t>R|ES`%7t|L+Z$p-L8o<Y+Y(dDB{8cQw{f4d%6cvA+q8tHp|
zx*WXIME%976%|6wfLGnAy0(MH+VuCmdZ#WH?!m-*>Eh)X2xu6jcf!2)l(7bv*e&$>
zZQ77aLi*C@7$D-q6`!2&EI@bHAn%1eGcqzpNGn}0XDb^$Jf$mi9Yuc>(kW_+xO^Nd
z+SGu##LS%xou2$MLzri6I21+L96Ksp&eWylyr={gq-KPq_Xjxjib-88OH_0`DH_Tn
za{4GF*RKy2B7!hGu4Tc$H0vhmtYCp(KqMq1z%@9==gdrR?EIY^8@x~$IsTE;c!3hq
zp6->{_`dm?-ji#`2_|y&x$E!0irIsNNaipWyeTLOq!vvO`|>5A2;d;Fj--vPRE$iy
zAA@}Hjy$UyO7UM@8S_58>!oCe?p9}D&aFI~YVkem%Z2B4mVa>gDEJusFbM|V*(iOW
zT~y97=)B#ln-^5?3-r2ZZNJ8{-oO=D;hI`wY9Q4I{B9fsY@o!_$va%*DBPdJBmXT2
zCH^O{{yK&eF0)l1b|bH$6zs<@YmZON=J&-;3=rE;!Rt!TOogih-(L~tx8uC@uo8l0
zpwrFV(2$0x485}8B~S=4pIRWV;!3$?^NDYz5I&lF3=vBfnLCeov)3<P^cw}NwKDA-
zAa_$X#oCM_Ff9y=+OhPCPe@gA(04a8Ynq!HCz$6sb_1?Au-GoZDjuZ;uE&n_&EP{p
z!r;XGVt?`tm_?sZt(xM5yjj3dz`IW{JPbP!I_ECg(EApKL~xz=7c2&Wbsn~O<Y$wR
z<1qXqK)HXD6La24;Ha|~%a+~g#x`F#aH53t;nmIm2PV652J<lO@D7hDlMBevp&_^y
zqDw=)|M~(=K!HooYpnZo3l5>7O4sGI(E7AE7On_cP`pA(>mUxy+h)$5F`u<(Ch6u7
zaGWqzks+bQcFf9^)IAi7fsAbtn^l4#jh8W?)121TFM=XPD29jLJtLzYRB9KCC5Qgc
zuQAoeen8Pplk#^8F26&D$9j_z<Mm~5SJn{GnSknz^Js!qLE&;xLxT|EZK0LHN%H_m
zCveSMHnbPtA-m?zk?ChMI!~g2r~o6Kz>}uPAylPA)fm|53hK|_7=x`+?tPfe{n8WP
zL2qWm-7<z9;>JkFz~=bS2+>jjb2}gb_P|*80^CERIPEwRS;;Ff(sb+g5C%qt0>E17
z8v3#4`TZb_UDn&8ojf*Ee(>pt+gl71mSS39B?EEZnCV#i(^>g+dWu)3LJ=JT$m_e5
zBAn3^jQ;XiI`5vyRUA||Tojlo*xfz&SJP8>h<r;|mk5VrAY@lm1ck|lb)S4+t7|CN
zMn}Fm5#^T+nP)(!sk|aU$WM+>2uq}2>DIxeq+ob>D6VNJ+BM-E0I;x-iBe($6@Us)
ziZm}~fDeTd>czAH=S}s8X5PineJk{8WE2~fIXbF&wOF-kRVY!#O^46Z!ZD5_-@{W`
zgIn5t>LRSzFbx?U4aigiIp}jKAV!)5L%E#5e3MAWfpHN55=2Q=u~Cj&@09bAut#`U
z2ozKCL=QC^bL29H;<n<6C=$SR-*^n=3EwIDd-8}YgT!i@(^c9Dp!gymj6q#c0fvx^
zi%g(xgn^-jY-(DBjD(Rm9^;d`Z#QoH*Oeq^*8V;nI&l{HTM`Wr_<b+5fT~hf#9#JF
z$XeO?@kU@^00u&Nd-Iuhp%37p9EYhWXldatziqAc#FlZ?=Xi=6Vq$bKRI(+}rfM=C
zkO}lCE_~kcm7An+(jV;RZfoPHpc0pjq&2Q3Pt&M7!sCS&Yw>#`JGfBTdGfCztHhs8
z0N(5x+tOy3B16|1KJPn{*3rei=Q>IUjx46d`e9nDV>=6F;FciQ4dPaFVGfA#Nr{bV
z;RAOIb{uaBTzUr<`Fhn8AajHsjVe3y*BsMq)U^!c*}UuX*uHi&l9o`p;&HBkyFF}*
zbhM*aFxBsJg^XnaAG9cG=Thp!JidR_A9G=J0@<Zxivyw?2!2uuZ?<DczNhS>CCP6W
z{QAZ}fNwyuy1e%~keh~HTlPn<!M;)=Z#n6GH`V*vX?boWqdVVG9tbda{)zLyy#P<m
zEcQZmsGDobi{F|XDypNrtVcpgATL9`_f8g@lJ_-2#d!8twDB=KIIvz~2Z>)lY8CUy
z$5kUu<U#W5i<f2za-zJ(7}m{%T+V}<8GO5I46ikv04H1dQ`MK3l2msKG^ZEt<Pq8)
zb6e$KDX;3%Vc`KhS&=?!%_fIG9rCdH6V2ipQ4@@WH!5Tw%&?0F-~h^7L_)kqtZ}25
z<=Fs_X<S#h1EH*|@7Z##dOql*^ZCjK+%>&!)J$)&1YKil;cY};X0ZBwa^da<h7Q|H
zVfNhEeW_8Ju6w&aHyBEv3Vludn0<!x9rIGc@_riIU>zlmF8(G>?WloI`E+*NIum2e
zkx<xraKu|3V#&?Go`@YTdUGr~VsECbm^>d$6`=dV`L$@&6j>2;&oM_}x6GbaT+`j<
zP^nxagcp+E0MAhf<Cr>3Yn`Mo&~TsBRhmWg+@Z<xblbXB9(A5!ydBS?#WRPP(Ag1E
zC{+ueBK)fi)dTLE8^l4Wc4%1vbVV5r0u!@ZM$#rfyw3emkpGRlw*y}t0pZ9Af301$
zQ4~RfzO0ZWwFUC?sIsIhwdWlk$siCREwjdt7!&wl=^d-23adgfUo0-^gcxf;Kx@jr
z;1e4V$vd_@lN%b+SIC0X#z{2!M^-tPLTmSj;W94QRaY~mpl2m)%aA%P8E2O7Hq^mo
zc*y9KvX<trYo)(Vd`<~5YHZDvOvlJGZ@XTYkme8KIjBktG^%}!H8X{mBa|BooHSWZ
zwx`m(&X*bcc75_2J@vR^pmz^SPrgJ#sLT#l-Lz;QkAPxqh2WyJG<Novby|7=pX)<R
zHN;MWI8-(O;(Un8E$Kih%}a<#>&sv(b5>u!6_s@SO2a^_oL5h8CQ<e<3*Yi5#m3t`
ziLu2^vR2D>gJ~~dS>JzePyET0ufT0C&&rCGr_AxXEq5Y@EU4ZAT|fIIh|M1+wapL@
z#}!btUIvBl_I|yA+7v6X5*!1oTTp7u-slq6jhd4qb`u)rUeXB-L_#(!lpY}6B<*D;
zujgwxiOlJ=2qHCLvMG1awR!1)cI~u>(wBG_5kFk+I5L;jmfp+=TZXP(x_kBzkIYoq
z8^v8m9F{O$Pe~yPlRst7n+zsN-NOnX-KDaaaYGaISs<RMU)3m)GMXKjUAh&9?^WpC
z=8y`1cWA_0i$9n?Q}VuB_o>gAMlHzD?P1@h-gtV$@D5Ybaz2i^uS@TZW)B|-hQ8W#
zBf9hy5bx-N>%~>@KQs_B+;>Tk%1&vpow3U0YApOv9WpYq0Ur!d^8WpS;9b|?^l|ls
z_I+8a_ss}x<Bc4lG8-S%1haxLJj*IpYQXtSIn~Ja!M27XUsO=j?jyM4t*|XLcr#^g
zwru_5z#^wPPaElL>Dctp7=*$ITE+7T!rK(VX2ogbD1+OsVmBva;NY8wR)QN`!o$*z
zpKeP*7X##gD@+abj{WDBLj_L?0?3HayR|<M1+B1qW**D+PIsxJ*ZtMo6CK`Ip7ax+
zw_zY0_to$hrKPFmE|%L1o<4tU=*VKn@)4mcZt!_V_j>T}c@pm6A5OeR^IDqhb;{c_
z)vz@udIV}P<5%6q;GtfA3>_%U4M|+~{WET#0|clARoU*!I}vemf!*6%$nyKK@#zh#
zM;rD6otOom`LqG-TTgf5!|kEuFJmMTY0D*m_j&um)Mn%PklicSxoR!nG`eaQg2VOx
zolE0b+oQ;)4uasc63Uuw5!122QKBe#_(7JBUE1$j4P7)j4S^N0?s%RkgVQPNqr+go
zB=5okQ`;Hx6pGJQQKF!Bx@X9FWT;470?M?8W&^rbF*5-^)({B!KX!zyzra<m4A8O5
zXW@ffa)QV>Vm2Jopo^<g{Y^>GwH)LFJL)8j#QTgQUjaBg#dhvLY(ogz7U_<PxR_~)
z*S8<DDEF|G8_cB;`Ro2r4oG>J49tj!bJK_XR{(W@xa4ve2oLcydLXY%UdY6WUVd$$
z8<p2Z?aN_y4t&(rR1(;=0iXDEK*yDA94zI4wf|+$W##-qb?|DgzB(_Tg%hJo_dc}(
z8lx+lc)El3a&LcR@Xc$UwtaGcYp&pf(A1N}o1dN<$I;GsFobZZ+=w{X4&jQry72Nd
z2FAlvS9_vVqr!Ey?P?Ff-}j!D`^1X)d}+w_xJ?jAJ?g~eo0W}fK{zypZyEQ*ISo#o
zwK34Sad3Xu@b;D?gzFmS#O!Q$0r!7~v3ML~)B3bw9Iz{XjvsNQQ~_)!(0-pO;(Q<6
zMVzE+d&z14lWiW19+A_}Rfln1J>GP+U#eiAkkeOT3*XbCa^2uP5}R$A1**Js-zGuN
z&a0j*aorqv+udGra{}mJSc9_sls`wlv6Q-fMe!B3WEL*v`>qkYxf;`d7+R>)(5;z+
z+#9(iur!b=%|zZR*J(Qrnro){@NVMcXZGAK`_M{R*#+&3ZTWiQ4iL+cM`5SkFbz>j
zI@mB6yaJ~;C<taXJa+TGX}&#-tF`%9pyISUK!hhl);uCBy6bP5_wTeS#uSiUTrZ&#
zBo2t7<40}b_*~sba9(u~gX(;z3k`FJscBIZoFsQK%a!yxh`}#)QDwFZ%^%~Ja~1ip
z+c@Kc0|!kskX&EBZ>LN|$9|)JDIEq~M!BDNh^Ga_La{kFm5{&Z#%lv<>%eF}aHH72
zvN1ulR-58Tkg7dp^;}7mocMg0ArErT+(^qzZU&Dr1%J0w4n0Wr9Q@`j+$$_RJAyx6
znE1xRh0JxS(W!uu_9b}oIOMpJj+7&9G?I8M7l9>YY!j?~6{pLZcpUak-&|_9s{zTG
zfw5)eQRhI*QC~V2nx>FA+Y*yG@yd7-IP@)K$2_J7Vz_DOuHy?6YEjlJ6~OH>ASq#e
zT1~-Miok@sl{y#NlAuhAe`Jv2(}=>GbUJ40PZS|<F!Z+ijD3xG7Ghu0A^%jbjvPOh
z5ji(TY19l6mh1t=DS$|B4@3{^pO@x792X{vQ(0^0Zt1{vS9|y*p~5TqBVbIDeKVPw
zBx!7PvFS%|*Ll)CmnsG_iBe>NVRu<>Uwe7nkY6Qy6fOlxy0_kS6uLC5HR+0*t4RH%
z#~K!pf0^6qL~uiAPjYb}k#%0vl?f9SIUl0O!QiKee+{g*ePM0?d51GK*5$Z$#DP>5
zS%;h#k__Cy9k*-a_DTP4qCw+>_THl#y)pO4{0P`;)wH=f|HS$Tw!%$md_1}(@PJQc
z?KI=8u+a{03lB72lIC3VD>hx`GzCENH=w@01W|^OX2$<qEyW*d#;WfBLP7Ef<m=LQ
z*C6S+uo%4BjfIimSF7c!vDfBqadi}%ta`6;aYfkh*`=D$=Z>s(BgoS{q(0)a!$^*4
z3BtDyl-p6Q`ixR2$U{Ff37CSI7`$BylRelV)ZILSGAHPTUQ{&Maf>Sgl)#HzYE_9U
z1J(AjDea9N<Pzm|6bWKXURj)Itof}ju+&;+osg02HwR!URa6Xz4w4f?;2IZ;dc26l
z#Jz(<yJmxbLNN_S^%*BHq}I|yh0)WsOk~7xi2m;HiS5E>FCBUGM4hDjatIQ8v;nLO
zM87c%ZLhOK!=e~;{hlrARY_TCC2Z;&Sxn#EfNibe&j%x@Ls@$Bak3S}OD|w&7r`DU
zsh|E;9qXfFP2=1s4|1y~z!;IzE{*jxFyB|1hLJAXi!9dJPUY|MCqY0J+6R$a_&h6)
z@yAIPJ6JQmd`~xQp<~#e9JP_WP8A>|3{Fd73q05zYT3NnmaiP>jg4Nw-4_4kqOC%I
zKEwLk_QU3&zWBSYLSboG`-+^L?hj^A!9W3^)`RQ<*+DG!QJd=MYmpM%UWq>Kif~+i
zJ~`}KkD_zColn_=uIBNI6yZF@EY-HWj9+*Piz`xbM!A)J1B1#tA|cjw?CMGvISulM
zCgheM8{`BD<kW^_xG*9EEhgrc4>dS0MdZ}sxTJj&3@&M%TG5V5ERyxFx=z$E;q){_
zvpcSk%?YX<5H^>x%O|T@dru=?*3q|7Q<%}(idLqM81GPsX2@XIhJd^HhZTs<1iZJm
zVc9rNz~R}Su=&d<gsL{%OIkG4<Y?y>2`Z9?U^T`qIuT(Ej0m^~CKsD9O)0#sD^fS5
z6{v5GbQq4}Nt6PD*r*<&T&_K|ik@zhv!Cj8e;g;_7+|@#2jN&7Vzph3QRSrD%U|^g
zlhbfL8=J&rrD4uiEd_?9ChQ>HNd4Am2*bzLP|lgy(D8I<SR{<4Q38g<xwE(p&ns0g
z7p?$GhPdn1!{g#aytzr0P`DV!?6QYuN8+lp(KE>Nw8vP%=!`O@s(+A+ty_1KB$c(i
zSZhP6)aK@?qvfyP%6+EJ%5WcM5z@+|MYjSTQqLS=JNv=pVO_*0#cys6<w0^Tut?9k
zsWb3(sle_vlcN~~%8Xee{q<GQ>D<+3BeqYIx@$u65YOY$&krx-?JT3n4l&*M&kY%)
zwmU|La)hQI{ar39QqKGrfx6FTc&uy0@wp~F4bgk<cCr)QdK6h6Wp^tFN$N65KOqIJ
zY|`1m)^+*~Uz>RPSu&9_SsZGJQAnt4+pS@Nt}%nxq~-P+@wx?4Tuyz@Qk1-3Fw8MM
z4Icoydi**TR<-fuQ3?WrBP*K4_$qwB^mT;e!b%>>ROAy)0<3F*-3q+Hgf%=N-5}W_
z*~^;tTa5lsYSrNF-fo=Oy5{6L&%-8?UYB&GbR46Ct|Hrz+TA3hr8)<^LRM^1MbiGV
zQIEOn6*3_XTzaQh2luuQW*a{)MEK`tX+=7pzQ%Z!uxGwzCF=F370j5{zki5nS5e8c
z77j~(t=qh*{vXvIy?uOtaXkT)ATM5ww@&JQl&+!KqBBuBZHQYKPAR(m8AU*H)WGG1
zrL@WcC5OUcMM)RPmd4(5xzpY`Fg#NZbBi=CT5knL<3|gVpT4wbEcod{a*x8okU}tN
zrw_`Ax7bi3K6m4OHEW+(0(OABl+JGZV~LTsDELjhlY@aeH!(y0Rc~YCljl7UDRfj)
zRu4R1##&W!=xgVuTzHJ2{?FxQ<)@Q%w$Rf#^xmkQn#KT<WG|$_Qc~FInXmr5e9)Sc
zq`hN-py-D%u3FDJWWjF@V7FQcu_R&D3(q?w@`Iw1YbT-9*srdjtqjnlp_3jAG{Tr9
z(8lK(*#Zq+=V$GYiGJM&>RA3iVO*Ua!n;LhnK_=@>>JL6pvg{8aLG9-?Y+C!vl5FI
zoX~ch&<qBtIO-y>IDM(>nY{3-$`kQCn7l&^u{I-sj>l!Uwog$CEBIq2j0%CLE_dqQ
z_Sp}qnur*5b%=_-HvHs|)-NdS^@Mygq&tVzlU*14VceYl(f$eHR4;qVZSH_ty9GfL
z*hr#-fVz<K+2MxHgCE$<^$+%Qw(w%>x7!ax;C-?S`^&4~5XXkg>x}|-eB2ARru{SG
zPy}QUUUmt7!W~FiW{SN|kElEHMr_J*ariw!XSd$@I0I2NXMqkiFXx&S&EMoF=MhLg
zpRLCMCVw90@DCGoZg)-iAqG*Cw2VGJktHtNUTX`=D7_kju7)?O1dM*;NU=OCF4%Ax
zZYMBwHgp@@qU=}@)38>TYY@5+`ZIkCWcf_7@L7y+q3;0lAj|G5|EPQ;#3GUw7n9=W
zPED2O|A5J&=ggCZs#lhi39PlH(NObnx&Io=Ti;Lfc?{$Bdz>&MmaXJbrVU%|wdmAq
zBvT+OAiTD^cP#GVX){`@P^IeEAa%O)+skyv-~;!yh#x7`O?6Hm+ajrfmw1$vfU&KO
z@UqqE5W`sJS@TAzzO!&lK5cx#jNz%#P;zKnElH~);|n}xS0QEV7QB1MeEvG2W{c{A
z4PhP>HHpEGMQTs1f4JaWJaC8ovcc)tl0s=mm-_8tDw8dIUS5vyXnlOkxuc|nAjrKM
zs(%&PUXiWVb_a<*lZ_=wLnb&_KaBr8z`v}`RJ?)!4I%_NGu(<z1Ap<S6}84cV?WXV
zV8;g{I#a~-hvyeh5PTu=!IcUQ6}E&D-?_$$f@jvIBsV4=HB_fy9D1Yp&m^LTv)Mbs
zKxUvL2F7X_#b2$A%!)sIge8_TZadQ771mU`<GuHI?a#lOGcuxoL=!8Ty+H<aWn3jW
zHS%w3Eo>}nN{Xu>bTkeU#Xpc%FHd5>jXR?q@|%l_ufi51;O6)sGW*?UFN{@><Ww_-
zm&Ya0{|cD2;#;KWdh{+f(aprSHIG0&Bj9JS(APF(qBt=JWZ?1Mi?BLI1v^5a+(?+H
z82DK5Bw=8YPuA3cAZlmj2R!L!X>dY@KcV285dk&+o@k0pTh}L+<PW&KDO(O~F=v7`
zd=$4g2i}f_X<Vz9D}<^N+Bg%ltuubUz7jezmRRyn5x|147YPk02nIW%uLAz#eZfAG
zQ*)<#8B?oXF+;7asz3J}jVL1}>`?QSqF7t#tziL^ldgFvVT5cvw3~S|r>pw$#+r08
zzluS>jQ_N8{d%LP>d2BQk2W3aj+PF~z}Eq0a5j=<H|u$YvFPL8-*BAJY{7)RO|$9e
z<YC73<tTOuR*LdO<l*66|6O$Aemdkc-3_|KDRsv($<I|!=Ap3BQn;9LF(-4AdV7|E
zP<>8rSDB2nTKehB&n3=&6LMLT(8k`7t#`WdZF*HPF@GFP$m*S_d+_<t1D$zQxzDfu
z-@Ftn(pRC|&r&%`(MjDQt^IC8et2SE-e896b}u_A%FFl6ad5?HK-8r-wzi$hP2dyo
zs$0Z<qQUy{1%JMnC5_yxxSvD77TSNs#tBb;J(X&ug>dCK*p#IqOW1ilXlc{AjP3hP
zr?1Norn;ilojD*k@=oU6e9Rw>$m0q|8J^#A(6Di2sQ|vuO1iarUs4mJ!ma6IV5|I|
zfr%RaK)3&Nx8F<UV&VTRrs@zMCS@Dv4Sc-a*)^Sl+fAy)LedY6OZ2u#F-maEuIhRp
zO{v-Wg_W>LqD?(o;2(!BpZPpQHz_YJuY9w?KqKHNze*cdu)B3}l;|25Dus-T7hX$N
zaGS`{R=&c)c=gyrt3dpfZ7^ux>H2yMmb+6Bi0jd^=7^-zG<XML5c%u|refVy5Tu7P
zmz=L_wZtj!2}ou>z&eJp;BlaL?OY*F`E&yB_S{PJkZg#f^)ULD1ewN=%y|3LbJP{7
zB~_wN4CeJ9x@Lq1i`IX!H0NQ*(aPuE4w;adrMo6?9E~_NctcF5=V8RQFmbjMW8{0Q
z=Qv)ypc~YrZMY~ubYOhiit*HutA)hgiL1i3JpZA0Cl`1Q)AWF*uc?&@5e;k4N^F@p
z_IAi3XPHuZ`DnWPP94v|l1xVEIZ?njGo;7lgJ0pWYWHn7zA36C<vANR{&JgVT{VQ-
zN_eRzU1u^&PmP&y*I%FnhlRD&+k~*UA8EOdHdWcp(ZU)}`EdN0&Y}|*+d;G|MMYhY
zRKZtoDytzUo1e6oQQ~2-vowJF2yuS3jQq#9<E5t^u_qs*(C=Zy*#;}5$stW9L2fui
zFp6Cli~J5w_v%5Kt_B<f_UhwyN_}F+GkA#lgwf`DMTwbF)Td8`S`YomYs?Zvsq5ML
z7U6Zu7)w(SCpJk@>-C6hI8{HdRv}C>Ls@@j6hU#hlJtnIf<N79yOAr$@n$)q+VDpS
z)S_sK*B)o3)75SlEDU+rL;mpgLk;$UNor62&0#gl(K8Le*Q<=&HqMG5CX6=r`o5f`
zyWvIj6&XRKv&Y|j$%SenGN$(_1|s%+2A#Bh0rJ}(y=*R($O{NFwUYrw_P@IV=pI6#
z@Udnd+ez&xXg7(R7RS2(k3Ea_mNP}aHpG`3v>yFJk`58H8CE<zEHkv+1rHa||8G}^
z<%f{TM4VNye+pjSZEBvoS0N@Nk0=I6^}{uR3#GrzaJoonVbThPuNmpTWL{BMi-8}b
zg(*TgG~1QAhTw$ldd&EO34PZACxHMPEMfX!kEX4^q#51Qd4Ut0%_<`4m}LacfVj9C
zKKI9~gZH@<KHwWeS8W-(!Hb(Z&R1CeAWLSpRHeEb+H(VsbAIDB?9Yr#6h2+tw<~4B
z%=JcGLQ&hYW%KSQ@^-!j_F3yy8gP4W4=S_fVIvD^EY|I>g5UhWac3B;e`0KNk&u}M
zGo_;$oqXsIJJdSr@(y&cBh{^!Hd*fcXRC!38)rtd*VgS95{rTfkvB;C0tdo9yJvjs
z0N`k3wR)?%`|*ADRjw+&q$CE_t3h8z=Y|*(=={JUZj&3-yV!#7$<8U#eU7N*(gTNh
z=qip&gIV~EJ1oT)UhMZ66bcS>sO%Wi7{2KCaPMyH*myxLyZ3e?MU<4f3n7jds-;G9
zO+7i2*p&z4swjDf<&56jv(^yTM|3rhM?@dStxzUP%BElUpj)%N({=UUt27&ne{BOa
zQUJ4Y{{lei1T&F(T_r=Ko{~y_=7bOL#z8Z(7V#f>{=@lb6H}F~+UU)Wf*6!gO-}<|
z@~AiEnjW+{|G(5^-j^b)k;!IwN>zN`SucB+QFixFcZBkZB9Si*{gI2Kmwwu8iWSUr
z?#EK#aa!r!8gZbbxgH*=q>xuP56gty=RNb<<!)FLzfcSuzS3{FZ#Sh3jqk6t`2(|F
z^NcVlY6o}v+FfBY{nh`_uF_&AM{@)W`e%W8(HQAY^Pzk`NX#VCy<6}k0D*Q`1D4~h
zM!GtC-wfP`s*C_ow(nDufzw~+6*5g~#_-q*fe)54=$tRIX%aWMn1*%naal%dX&&aG
z`1xwt7t4C0NJU$P{aE*dh@rtc$}L5M|3Y>Qne<iU<xK0%z<_P9$b9SM8@BQ)RUYBp
zb;POGa2r!Y*VVI0ZCMC9E3I|80WDyK2`NF^I=&*VXDM-GbPWQa`IQc<XHyzMUc;_|
zV_&_YQs)wDTwdZb%D09&0Y~dKiUwk1BdU@pIIFQxz#uhb{`i%}MH4Ane|laJcJT*w
zZf*e&Ei#%))*4HXAjT=P83JM3Qv~=Q?rPj9ko6Lg!L^SII#!bi`u|7y#&sK=(M@BP
z*wQH?5u}mr-F|ywQb4|qPAo8$aeJ!zLsj^LGZ!9Ud`{wxS6#fPvR<<<{~ub@BiDcR
z>iWq^+YPGfPb6s*$Z(*pRO=>M$oSZ!r-3=qk12(rAcf&>_WdbH?dGAkcx$U3XX$gl
zogkI0@QAa8OK<YB@2HbiT7m||BQN_l;+(|;qnZ%&4=qcth!S&Xwo?~Yo7%>fa)52}
zXZkzKUkcMGmv9xSPpVV|Ff`grCY$7TeX6aLp$i9~>-}nSVa_EYUn!0y4)H+7%~q0_
zUUP+$j&<1C3a1KsmWRG1_3b}A>3%A7Lc*!$4wpta`M&6c)!4a&?`vH}Nj`^KUHu>e
z6Qy4&f#`iROa{E$jL5?Ez8bZcwQumF(b$}_L)>d;C{KZkI(MqsuT+K0M^aT;jb7s3
zB=8bi3BaVY!sB)Ad3l62*;}WSro)vYV9V}xxHEObOYuN5MHX~Gt8+^l$)arPhEsIX
zYeD;RM#RL=U{ykz{ILNi*xSo;Ics=Ac~W;+wrbvH_((g=8S622P_n+1R7xcuigb}s
zY_yAo8~F~3$5f}PH*`A^vwHaR3P;0Dn1qKLeDpfwJvJr?I<5|;1jXl6zSt9OM89B<
zR_p8(Ew+$bpK?atjDnOSI-Yh_@xu?QRCW;^O)6fgph`V5iH0FmHOIPGW8f<O3_ywo
zP>&b7zn)jR^G%Xe`v@XtlsruZv_d~3r|-^IznUDB+S|CJg;m0~n(U^7j&O;hGV*G<
z4>85Hm3ZjVvz2Vp%T5-!FTdjW;Rf1>nYZ1~1IGA?{gIQps1g-y9qImrXf8;RiCKY`
ze@u3r2-ZG5O32gAF!@`5qF8wB(zjvc#~yIu$-(OE#<Z6f)!VYx+Ze^n#ma2~53wKP
z=vH*aO;+fC@YkP)t8TUw@YHKpi~V{-sT0`t=tk6>Pvh3^{m|TK1&zn4)@0vw>2(rE
z{A^X`_WTMZ!mcfu*%21o@C`7>k0AA%mhZA=!oJxNW+Rcg5Sk{hZlY(wt<7GMd~j;<
zaQ7a(iRH79MPEx0>Y~KWXsx!V&jg3{m+6AVrdmK3;;_z49;PYATW_J(Mh^k2(2I%{
z{POy{RvQPd%3=1??fS)4o3!oj=`oakUE(H-mj?p-#QN1cY%dF?JJ(07b9V{$Sgjjd
z0X?zXi&LQd=Qa1*R|Mvci4|N1ppO%$8A6?(cB#b%=Lr{-wa(h$ThSs~K0BrSfm3P$
zLvJp=;1WBS!)4up=IVCvdhpKBz(*S(uU4DD_hZjJO}_TxcqNlN5EL_lC&c)|UW2kx
ziXi#Tj>`8jkHhGfK;xx!enT#_*}d#wPPvL~w9&~Tok<4y!wyN1!;S<j1H0^~aHid5
z#h5rSok#E7W44-WNN!zo_^A3p5jotQmZAWCEg!YRcN%7+sla}LnE>0APf0weJ0lcY
zZXruaukH*)vY@k*7YY~R7VyBe%V~FnhZCeJW8ID6@)b=p`!?5_dDoXNmA*B3R9#ZC
zi$+`5PRAMHcd!oJn6hH84)hg45Nv<9<%ET|F?RT96Xljq#Bc1GJ-(%07<qNE>pCeT
zbjiIzhs}6}YP4%I>{aZ|R0`Lu6bDp4I$IX_dQu9$+m<gmCQ{7@$>C)MlB`BdXM&@c
z9LrQf3tSCD7RuHr=3HLhANpSB#40?MS<Cj+w?BR-5$fx#A^TW#(POD_uPFION!~%4
zH&nza8FvvH{Ta1nYQ9`)5Ek;{Tlz4E8R-s+`rlrF>_x%EXf)g|5QNxEQV8X@yemG?
zc7%fZjoSINWHw%#FA)N!wW{>xvthI%ZyaC*ex^O%^(2M9u3R}snI_qS@KSaS7P&9}
z17+)1Jv}BNcga$ZsOY<1*#pMugH}^1v_!=`86PJRY2~9>=n7o>{UB%z#%HB;t3kPZ
zTll{k1^}r+%B@b?=1&>}+W1<iAyJq`%s|UwB7wpGX%FY6qR1w&Y`;Xu$Xf@9%R~|{
ziS;ITGE~u}{~udt8B|BGMeE=W!QF$qI|O(4;O_1o+$FfXySpA7g1fsr1V6w#_tv{V
zUe)_QRWm))wR?82wZ6vddnbJkk*mfNC$k^QETDUb6vOQI7$wGW1b}Vvwf7gf;QPLW
z!o&r<@d+YQ+vhJXw?uUw0iGrJLwt26Fn)DU&2HsR)J1t(-a9_7Ll{9o%qQnOP4!3T
z5Ri7^=q0+UYD`B4|J{9*{n1!K%;*!o|AEbye+5RIoYh%!YD$lqih6LjU@DoOi39jL
z$!k~)-y0tm&vS&m7NLRTPFh5bwNr2QNi9&M<Dft$M`EZVeyH5}61SvDtUoH6;yyf&
z$-T;+>*Asy%vy!7+UAcbs(8MApW60x`b`n%rM<T{fOq-M9>zN499l8+ALYRi6+T2@
zEQtKE0?g_Lnp?u?!HSZQp0>ErAc%3@S>2s<zBRWih3>nwx(X{<Y|dQz#)xVSEi_EG
zYRC`Uh@RMw=XWD9I*7|8b$;TV$r|5H%o!xs=9|lyhzASQA8P!B;XPyx)^ZitWw$1;
z53Pt(yc`lQ!)$=n5}XchH%9Ob69k7sNZ%blZvv?1hNYueO<kc_mLRMw_A5f@{k9TO
zC%;$aY_#prM1a53;G-M^8oH!h)fL}kKJdw@4=NY&=Q3Z;oXL)r*wY1K{07%uZEsJ4
z?<cf?5GvE*yWw8%kAmn4Pv}&S^RDc7+DdWxUI$RGf$0N*kQQ2GL&f#)avep-qHK2y
z^Tepr5KF_oxGhj+>FaZi2sk1dxH&XVHgJRCM`A(zF?*QYp*Xr|;~dmGVKc5!r`m71
zYOY8LLvvLv!9=6o#}Fi7K-PU9B!zGxvqSm+(Mt>{7ZNjNlXm_Sz?(3XI@cl6g7Vfu
ziFAW$=Rbh+eJoG{!q}N=Jw4F@zEX_Rm@f|S)h+q0S;d-H(1s!eT?m>yDAP>m*qJSQ
znIUVKz9KWI=Er<ZW5x62(Et8Ak_lb4teY;QFAx`bsU!n79QI@dMRkYpQ^Sn52ut1J
z1foalB&swvCyX4d`v2Vo*~D&#m}4lRLqq9Odj)U}rea1y3=Zh*skT(-b%)u@-~2Q>
z?VzvTcKZe&8uqX3+EYscHy;eRxpGIOdGf91gX;fbKHbf}|7j*J85O_#y}%@fpnGJZ
z6W}{%@3kpK&)E@#TP2bpb(~WBaBPC~UV#xMqFo)PR<T6=Sxu>lg$L4XCKcrYP{f}I
zzw6GSe3$B21QDn!+$y{64^N8l(VD+wr73=CKD?JzVH#=fA4Z6cVN{`uzA3*~{5a!u
zbcmO>FJ(4p{XPg;ZdzZjk#Kf|W}h~;BZ6Bum}tZ|1Q#1gAei4Nmd78VOcl#~bd|=O
zYV3A8p^5RB1notO1e~EPys>1MvZ0~+C5^pY{3VMFM+P&8;+Xx_4M=!fqK~;Tj3^RJ
z=6F6O?CxkM@3dG;w0goSl|)D?a_mYxFF;3H(gW$mQfgMPQS*j!d@wlr(M-$Uv&#PQ
zSk{mRB&w*~^xa_-4D=yUOk2-Km<D&MRYV>X$IwI{{~YzI7TKj}|KZR&Y%@v}`C>%0
zhi%csjjG&}A*tMKj&e-l{G+<sspzlFmZ-AVk>9Skr>$0i1w2KpdA6n@T*o&9BJ%*v
z#aW@_5E-014SjKGy@+CBq)O+-u0K{+3t1X|^U3u}b)6aK#QN~+$Ur@-^E+04$p-Tt
zQna-Qo5({0>!5eLb{G$;i&58gP7Y4r@>pI<h*@5iwpQhsAftsJIMe5&+_%_2xULsa
z{Zxs6t|p`;>Z(XWw_3)JGxC>A&blf|{*#LVsCQ~48T<xUHCZ>acBs5uhbJuo`_<`R
zdFc9scdaP2K5A^PB@2PRh5Vbl0%t-QW&e8&Q}3!f%-Iy)fcnFCi*XDVYh%fJuUv6+
z`*4M34%!>>rQ)rT?3+5$=zVWkEy&IO)svNinTIUq-J<gZWC&MW4x9%*9Q6j0vtKnL
zza4&DhClU7y#q?-`Vk3#X`$Mr4g%C7Pt)br^-!bTtwR4yA%tUIk+>jOl9g@gD@$V<
zt77eS?=ru1x(yd9l!hWSg5k9}lc0-2anG9|02Pdx_xiPxf$u~M9;pJMg%dF&Z#TdM
zp=uOLJ|)&h_zmq!|H{lq?XzWRxkF}YS#dGWSc}H+=bH@-4NT-lYv9jfAV^jl3~L_<
zgN_~AgkpQk8obd!!=Pcgow5&u)02awGFdRcV(!!y|EmPf#_Ci$TDD)1(6a<r#9uSP
zO{J+#z6^`x7^u4EnToSfi16C<gEEC5D!*2F>tAkVf$Ig$q3&5F;UFsv*FTR1ADxKw
zNBntc;JU0Fo)N7TI56_Iyqsd%PN%R8{ib6KORyQ~{`n)am&rH&Gy25=y%d-ctt`5A
zdWd7V(7~q>?^sM1_#@9|)nW}jPr-%G8rxK&o<t~pVrYjC&I@XNczl={8#%UOI)3)6
zQNkW)VGXY|G@i}bRRrdOU<jU29KlKKo4dK&5Ep{3)78)x>vToQMY%%c&>AGyUm|lI
z%gp3~k*Jew@N5B3LNC$qy&b)&7CsYa#w#Hk>e55K(V5Rs+VKfI2A6@MfmQ%?|5yhE
zWyk1&G3*o!=JY5Bt_LmTR+KpU43^_Qn7rRskxvqUr*-0wwkKE$Do*&Z--gwRE=>+N
z!7AdfV2(7aFa?3kAYGRU%%)@cJ*z*FQbvDjtp#hOH!5|$R960!UM<c!x@HR@&sf`=
zjOK{A3t!;?0czbBj_6DQUI+!=dSy{4!J5vhayJ&j4|Fv}AG`$)#?;+jX`17H@mhmu
zZ5-6G;Z6$*FV6b1tMw+~G42>A)B6D|NBC-(dy&lP%t!$oY~d+Ei^dnePHFaZHG(Qs
z+e7D5oG-3R;D6cj^-y@k{l!<d54=du8Qn`_OMG-l+5Vz11*qP&91&>Md=F56LGs1r
zMz#^k2`fL;9Wph;$dn!v+;+ebB(MeJ$(k8g-32b29Ae7b`n`ks3Oe9$e%8UfLM1L4
zWCWV%e1iAjAIX3rC8Hm5^NQn=)58~Gf+BXOr5-hi5Li>A>mUPlbu6j&2ik~PxZ#pb
znWKhTR4v3t;le=ll3-%So(~?=8p;5l4c0Ew1SUiz_@2JL78+KxUzf=36u_dMhY`Z-
zwV7n--2EF=yXPCx@k~~<37fOy{V3rJYdM+i1gGi;^LM&0o2ciLnV_^tJQ-_C-q)n=
zM<kx$)aZkv9yEAf@!O@8I8Tp6x+jO)@*LZ!Ic!Xz^{U022OT)@wy&V5-b<cMEWw+P
z<K1YAL6zcMlyCb#iX-N|$2vEn3hvb`NO7c9AXhwmd3UHYx!UL9=HSAHJJiK{%m0lv
zcz;WF@Am)dg|)Lr^%A!e|2Lo^86qRTN`rcK6PpqsP^_4Yra^@PS@-6)Q1vY%T;aMi
zEPx?5&JJQeAu%@+aiF1AiJhnYaTYGG_9~K6gLUXNd#H~I6{{KJDVI~@Ld$OiRn>cL
z#5~sjmm6!ietU5H46kv5*N;M8w;{(OZkav>{FH1d-+$N2-OO#ot#$+u<Q&9hQ^Ozl
z77cUp@my&_Imf0nw<nRNe~C}1)$C6_setWwsBZ?wQAA152UBKZLsoGKm8?!?H>kF=
zgh^%c8wG5Uo)2rTwq<W>G``+f7i{%DUSx6d`3KX*!V!XA7)(TRV*aNT{9gu88Z%zd
zWd;<IGUo#!`8rznflS~bgc6t~s(oP_h=9DERlxQSl#^D10mgG;4%$qU@mcL)r!?<9
zL_td)yevWc&{cK{73YQVT@^Ozj@?+4U-84w7kp&VzJwq<`XBRZvA})`JfrKxL_wlq
zfBa%S)zZCx$4M{2ex&6Fw0Vjb=Q)+#eqIBC+?g9-gz+#~ueoEH9)mhXS9|HwSRprW
za8Tt*_WLPI*iN!3F?pXJpz5teJVSEDN?7(`-XkR9^=hZQ=EpJE(Os1{aoOw(7_xa2
z{p)$-ol@QV^qpf9Ei9pFW#)Ay1YW<8@R<HUf2k5Aa1t)pG!KP6*X`;<@XTq|L`7o@
zu!6Iai;mr625HD#Uj`EIxQygYegTvRy!OXsa#rNI^;i*V+&@A*Ago#XDKyf*0!073
zZ~0%Am(cY^7ZF(WT|nYy1gu`N7|t;a2~}UPRX8JhKl0E=ZbWCi%kW?ct})u@E2a$$
zNyX|4wu<}$;T)!ivMR!vOPYB)qSm>RU)7dZ(fj&NeiNq=51wVh=y_NBE#|Wm#kU*<
z1c$%ktdi>)!P2#W_eee7{Os!gG4N#2Vc8gT_r|BLNAdaTA=2NtL1LS`Cx@?&`xmis
z_i@1~+wxm+FpGV?+d{GGZkeAOE21$Pg5$0(d?{iBy02nx-Yje$P-JxLLaO+Q@a~Au
zZ<d4YJDoo$+S_7SGPRzKS;QP@o1|g_ff2IRzo8@ZTCZM|PbHKmGiS2Q_F|hrz}0#)
zx(2Pli!)!Qa-baBa2wxo_yE*NFIZGCycy>+j5b;bklPpzi-P5shi!Ie8@PKU452+a
zteA5k6<_;X87gsXW!<f%i3%nFiI?nBvC76Fxmz#nbe-DZ3Mq&2-$-?2e^0q?c6Z_9
zZ!V5h<7u3lnQ)MX_{IJoEi(D}MI8PqMW$d}+k19AOv2Ruzd@ONBeHrc#XHoglTj`*
zVhAUA`*Z<{<w`-+?~;Cgh3_~M8Y;hI4_rG#LlxIzOE($*8+T=wgRI?|0;K%3i{QqW
zg^(k*-(jYsU6v8cCqn%mDJc;2-X8TiSx*g3F`_*5Q&|iWBxN&#zx|3&qvT70bzOF}
zVOW+E%fJ2(x_Hazbx5XD4rEgTv}fjGxYe^jCH?Qo9Iw53g8(g(DA|OEI6?`H;~=s0
z7DXiA2o+^Q`yRM~u>0^p*Z%LKiu-w|L2I`3{xs8EK;mG%clf2#V`)^1*rE@w!(&wO
zB6k!O-m1H>iJ(SOacIxs<Y4whl)2azy6KmCY!OSY!+KMB%+?j#1X7P)Rd@s!2*d}w
z2nU`GZU)j&lTIg9v;T?ot&EcoiGT*e4vs_@7tV_W!(~63n(Q0pB6W5W9y@xi>9afG
zOq?v0l^>iO)QgC}jyM-+bt+IyVOzHu#>f=6_!F5e11;lKeR!@e{_{_v+fH1)U>otl
z^K6E9g+MC5MXc)AR-yc!o?d}3JnICT(qkYW67nD(I>IE##A2HsTltQ0$NQh}JQ~wK
zCtDE_Gb5==MSjb&LAq75>sC|Rz(wp*GCUdyyNC*o6z!>WJa?G9p9(i#YUz`Y5Mpa+
z3JD6~@`OsK7jxE7XQ(3jYx}{73SLLCxC_7NMKDVhjE~BX?s4{>)~1mv>9Cej=LI88
z89Pdw#YvcBITj{A*z|US3(fogkM@)W@gn<wX-`<@Kzb<e*A<BY+fylD{#87A%%X;=
zU`vP`UMD+aq@{h_Tf~mIBO!@?tA9$}0`qXGn^N!xpI4L)1W`+t7t8!uz19eoI`IDQ
zr}W)bfAIEP8)aaLMudmtXjF@<q#4OdybCHWEc+vd|C8EZBm%<}XZkR5;1~2)$M-l{
zvYJj7=E^DK1I@J0Cs=m+{Q*Z=dS<&<cKS0*Q1-s4;i<?57ONE~kzT)VW)~Mqo`La@
zH?Q)1^E;KR7C=V|Z{;7{;F{0zxtb+|2adEqlQ-o1MNcZ`s{N;boEJf7=MEqcN+4>G
z7rz3t39_udp0fGSo15nW{%H<=<@H>AbEvc)bV$4wIL&R25y>!{+*VB>RfQ5C2+a?Q
zfM*>d7A7bsArr-gAKUgx5zuL6*oscQ7MTCs@mNS^m!B6#rGECw6%0AtWZU++;kkKT
z7EY|76U^cIW*}BQAPL|>sVuDPx%?BHesvsU71_mNj-7KSOj#V?dlh*}%xR39gJZQ_
z$kl6)7W-U!CF)5;=(*g<#VKbQH0c5kIe(}|hY&E$9iy}9b-#ndWkbE~x?qS&2RjO^
zcn@t}aqhGyKKkd$Af$F`YT!lhpW?mr0;5HcAJN|w)t_n-na(<a>%RPU`@kYT32ol)
zDLaUJF?0TH*gqQ9Qh4`_oJjoa#p2EyDEcd?Q{dfjysDR5@P<}|hT&zrMaPj(K-Nhs
zZ4oP&H)~$`es8Q;RcVG0W#kgB_jYYBK1)o^8U4VCMtQ@JNo43zX%jt8W=vAb6#DW?
z?#z$@z1fCj^iRn!UR;c&?LBB~m+~ngCzj+PK5DGmEqN&gUOQ}r!Deu+2dnqBv7k_d
zCI_}656)sA3s=mcur_qJHjxFB(r9WEQ%f~a(lZVI?$qGtkf^~ABFx|N^q^8A_I<1b
z-A41eJ6>_L6aK1c`QWkROYl!`L~Il+Fb$U9Z%CBKo3#s)urJu>0607TgeQUye@DU(
zj}jHI@?am4wkdDOX~y4)PzlTHzeSrT$7JE8S|loErS+O$npi5;M?)F_-*`ctXq1e~
z%dp(V@R_}?MFQic8E-rbA2qz9(%OwLRl)V$?eg15GEYpz-=D5d_PtS>FjoBA>5r`2
z&MWzMV`U4hLhI22!xr|s1&uW3%k>jd5=8(tPYm-v9paN6(?@P9Ks}HXWw(L6-amkU
z+h+~#n3C1i$|w-JMc%QCd;h3`i;<HA<QMtwSqVy^EJDZDG&!=-!Z=3?cAuWQ_f`L}
zl`}~s32lnU)>Q>K1`+^tJgVY1?E;Ec!d{F|WZ}BQ;|7SgHqTBUm2fz%B0UJm>Ti{N
zt>i-)^JyMV)^u3^o}I@X2^&eVxDDJQo40q<fO$QWvApHD&}v@TFjQ^es>NNTfdcKm
zbpLq0zrT-hL3o$mx~&ZMkwy)Pl!UMoRhcu5R>Jd>RKs=dE}-@>USY_%z(1DE^J2EE
zfIbxH;eUJ|8>1as@3||!Qaaq<gH0Qc7R?pY9O4v*{A7d7W!yJ14Ns$T8*+y66V6D$
z#E&w-&JF2HfYK$l3xCvn@g!&(P2lWU<)RX%*e`-DD7ztX7bbV*M34k=LQjowqC-=H
zScxrGZU#m?I!z|$uT8!GkiVP?`g$vD^##){scU#7JFk}%rE68unNNEWszygJO5LM+
zAHr_0i1E{|22{m;G(5O@Xo-h`4G)=Q(<950qQ%3DP-CH^dXm9bZ)3*ax&Ept2*iNk
zT{paYvlLSriUzIC9GHQbUc5C!Xa|BfVV4GNCPm+m?t!qXL|@fK$zt@9IIdg=)37O-
zf<oUS$T3kpp;6QM<_PPsi1FI&4ZzJmCrIx=EApZoWNs~_@lvRhGVQW&%T)(CAtG^>
zj{AjxT)}o;p^n&p>_48Js9Fslf``dX;bz=9J1UbhUuW0#t9+<|l0Wm!(c&e)6;tYV
zN*?R7#$Z2)?<=EUS8#`A#{N9~(7k+8#DccUXBxma^#-lY`K4qeXz_TS77%7w5rx&Y
z^pDj19rgw3`1#P==1x)^h+s?X=XFml=wy1JJC{eoMhq1}Z>z&2j}T$H$O=uIk^aXA
z)xQwizjaGb>O&Ka`zMaY?<(&aIl2cOwH!p6xGN`fRD3t<qRB{CflkN^7h||NU)T<4
z06{xu$iXLD`8R*W5L+^dbw-epDJ^_Y;O6BOGB6_MxI(tZMF}U*tI)yEg@&hUseJ}G
zQAr}s`6$@;asRcz3C!WMC{VBR2EYownsO}H3fv>cgS?XwKeZvnc=bf{;LVfxR2F0;
zxW)k8VR32%sS!V?L=4B##KC{2K5t*32nfur6q#=sIkB^{u|2F|1_~=GqFi6wm#dZ`
zpD)+IC@Lzht}O)x27<A&vMOt7MILO^&F6z6wy096*!vv#bOl5{el!|Xk)!rPtmVc~
zAm|%z;Oy-C=}sSq^-|;SloXoJ4=y~9n{(c;GZqi2YJIW%Ow{s(k->ohFc6k9@XsIA
z>&=d6bSeed0ANPn!A^S&wIVin+gP(Rlcv*pc3L1Q9v-fs9wCMg`F|J;(1B#UeCH>5
z9tb;<5+F7A=QAlHSqSJY;(;HP%2|jgx7icwc47U@jGZ^i00vMJo14#BE>~ADKfOQS
z2-)B)u6{Olm|6US7Hn=p9pRpxC*TqnipTTm8xC9|fONm+j|PEJFSmR^`5KOs)+lls
ziJxU7!BceS#lewMS)6tuLM5reaIom;jFT&B(xz8)$0wqe=LOC^`gF~}YuL=C+Fv<n
zyePwEs-S#3zj&)mk1sqUYlu%4k)^RFsTt<07eBwJeL`r)F@zgOtjsxV-!{V@S!P;Z
zkPoB#o|h;|o<jL{$3wRiZ*Cj@S9Xl%$@$Uwc~E=%J4GfkXVuHg3keI0^2@;tkPsm$
z9tMTzcb(U-kVwf71%KCWT_m(fQhpFWW?z|w(+!0D`<f??hIu_;XY4g_WhE?DA#{_<
zneFyK;MR<NSR&~s_M?Wz&}KLMY2$iP3M%0Lb?%Yf@{{MgXjiCLr5eg8!`rYO-h)HJ
zz#wEIVPj(ldLAB9BmanwilSsyAvQ9KKlx2A(1vQs^Qp(J_1z#*lGOTuUAG4#ROG<?
zHiMbi%_@bSzL>!qn8*G2;MN|03Zwe0>zciW4W(@3Wd4YJc$y_jJM%M8*9W6vXaZ$$
z^f9Qdg6JQ0oZ!c?J+R>jK5=!?`ZNeTELJSu+nkz~T15D-5wQ0S5$zvGz*m1cXJ;%?
zB;&Q%>?y{2y33d0);6D18h61CmBUYm5Ae&F;wTEv)2BVt)$8=&DN?Lc)>l>b$i5gv
z7oGH9>p!u&A*x!pf|`eax;`_9kI&M)v^y}`+ZjapJ*yG;JOY{bHuMwnyuSI_K%}qZ
zkh^}FFRHeC8!qo&ucn;9s!F0CZUSNOgRBpZ=6aN8vZW&U;lMUljCFoOpZBd2BgItj
zJ`IeXCSwPE^w|wEM5Z>3wNG7-3Fdx7r(#RrNZ<V&P}d4zfs6YnJ+Nz<O7Eh<fm-Zs
z@zMONH;Xl120>!Aj)3%t{ykYOLQBTLFxd-J=ac*QE<KGdjBiw%Zm^T4J(MiEjTW}<
z;D|bmBa_ZYue8xxJ(EPwB3@i0xHUP#3K!!*T)<KJ5f@@z_bO!TKPimTosmzsEJsdG
z;>Nck7LNps6Lf-EkZ3rfy;A>Lcj0)&^?gdu&hTaT$1<>0QB+4gi}vr|n0n)3n1A}4
zl3nh^nl*`dj_L;^x#=7>?EXL}KH!Ig04DkUKi8k{Pe@~dY|z+DpH(f2)6=b%^Fv9;
z?P8nlsHH90DJi(G-AiS$+MP<olEom>a5cb0UQVv)A}HiuuZuIVpg=H=2uVy|zjv9J
z*TWvt#6*-p$Uo<Je;>OCzz_umS{HpFUC~ffRhv}&39FZGpM@9_ke|*B(F)I>2l8Gs
zX`>hMkxKKzJR+G=z!2$G9mDC8UkmrThyjK(%$N7^L5l}^u34W*-J%BK5i2^kDYgC6
zif!b1%M=w2JT-S`?JZ7B-Ql4Ji@=mIjAc3mPd`W0?La-p7sKl1<X_?$9t{?2>ZXVD
z;;c5!J~r_B|9T>Yz!CNY9Kql4E{8l^n8>vm1A8mreuTdL>gD?RA$%~$^3FsLyr*Q1
zxiB7+JYeBBXVid74o)1xSnklg-3ap;o2!Z~$cq<yZ)$6}xmO^tx<QB+6*AmnU{J7N
z)foe%8og3R8M8P9DpEfEyz%=K3GM~?2$US*CtHgPq>jVD*r5AQXN~^~=D`ZIZF_!w
zuy~U0Q)REWz_jtTO6(>cwNq2eA?~utOls9G%&6c?iKgwfUEwBh{{t*OcMZNzNI)8N
z|85?)o7?v!keJ4a9T4T~Paw0MU24Pm{mU~@@Ghj|mWi(W%^0?K-7}spBt;xPE}#vS
z1xmt_)twT$nLnDMOhtB!D^i`Wo41uzB$cuM{?-;R2~G|Po}}R_MpJ_O;0?va@ki@-
z_baO1gB2eV;{m}T<ty)L<gv9|wqw=$pFOB-ch@?ltG9z~FSKg}cH5wzN?yHE20afs
z$|S({c9d^+VkA(oufi$a6c-O~7VyrTtP_dP)KAFEE@o-DsVd4Z_+m&R5nG6!O_Nyc
z_g-N*svtjKn}fpR+Z&98A9rvNAF%R9?dij3{CJMybiOE$Nc<@j$bI`oM>`r1qY{7x
zKiv0z&A`q3YjEY6@CStz6%hhfw}NsQ^6kU>Z&+Uy@hr4S0T@`RA832HGE!20m4DsU
zRf_p|dEqmWpDw7Wcl~TRr1u0i^%t?h_J-XW<3|BdB1dRdoQ}=>!C5C#gTh}-F)#R}
zdp83eail@y)1+%Ath~MY_;YR3WR$!7t4#&fgfs{Z_y*!K5{1+JxoBkg^3bv3@9W9$
zK_g`jCXoPUIw=Rd{x(5JyFqm_!p$nOLkn{>9;byjKffDa$XY5Sm>CQ0XU8`cc*@sy
zVLT;wW5!TpW#}M>aN${s@dMQNezfi7;*?$WCjLL+q`TgC;5q&flJk;A$%oVgQHX{q
zxq+9b{6;{u$<A^ICu|r-s-ST4c;46t<(|3xRzU@*N)9rY-^&fmchrc3HGH@tJ>roK
z5nTU*IM&*uh;$`92Q0K&`k-vHFB5VZM(0{KZchq)n4f)c$*-75b)m=BCjRFIun+t+
zjpD9n`)1O)655j-DM^ZUy$$f&Qyv@qSXI+fvaH9b5HUzGRw_g7Ci`fh4U!7~t&YXo
zB+ar^F35k{p{0O_oEm~)aeK3CUvAQ1@VlPm9*<FyPEP61o)dL5?2!6=_wU^7h+ETt
ztqdEfjH?@M4iT~VLgF89=pY2P`Zi%@L*Gos1AKOloeY-ZQlS0zB?<xpI`DBNvdkEG
zd_3ZLR^lGSS>SFLxA`!jP4>J*<K+eQ0(=mXQMa<O35*xSlPf)A_x<{4Rp}F#q|&f>
zFxH#l0Y}2`Jh<I^_1p`MhjRXCj!@YDlaV2eN>|cCwCO}iSlLTFG2p1(d)${=xZ1+a
zc>rn6;R}WwD<tx~N7{ZnjEH383f4%@^n00tkSx@sO>=I=Qm9wY6|=$_*Ba#&oSb5q
zT_Q_ItfUt^)nXl2RxMk=Oo_ALRF@P!h0Ye$kFl^3)8!)HrerqB$;e(39{1IGGr=4n
zY)`TX42r~EE}{Nwl7bd{MduMAUJOQ88|xk`F0NA0=iP`XcWN(OJcyW9OSwDp7_B8}
zg8+cl)NBH?B*cwa%evW%&Il0M|4f7@QiC}nRfaVZ$B}Y<EiOkAV^gE;(w<)y2+>r~
znv@+YPe>}=H$-4~K0nf=p|&wLdcrj(XwD!jEF?0V&PGz4nuS5Om8FD-0RCHGl*{}_
zCJ}$Fdo@HZ)c37QgOHZPoRUWlL}h221U@bPCU-BEAerrYUf^Lm`$2R`Ke3MVbf%Qj
z&ONnZ?@oVYLllltk}axx4(ZwAByxGCCAB3vFnK^L66`|S@)Y9a4vEJ26&rG)%xv{W
zV_RJuF*zwx5E=S?sgSwlbf8(^BfT{DC(zFhp)MpM1*{S6nq2Sp%u%vQ!aYI1c*ga3
zd`d?gXQhKDF4TZB4+Rc!N?tj+;OhOo9ltvMkLiQJcXtHsk!{PJd3aJEDI3vf7nMqy
zOg>yuH0fhF8)A0X)Reke>WMPKOrn_Bmt~q%g-CTfcDKKPoUUg~JTw7^X8VH(1j#Wc
zKm*~rcZkVJs+wzC6V`+Wd)sfd#0bD*fD=~@%=)YL!BeQ|X@`pG9~)}Mki^t{Y80>6
z5q1`IPh0223mgRB=IwjsBHjXJLN?Qr@dg`3O6$;^pJI^{BH$Mzc5{XSu=b|ug+^VJ
zvk0FEcg@#yO#tqM%z7pYRqM?qOr(+zmgRd!_w0z!tUU;$?v8;Kr<)_>({q0$<<vOK
z^OImv9|bZRTG-NsHzTVnZ`c`XF|Ar`Up8<@lGqUyU9Xi~f9A5cnKD{}Vh-t@UIrTF
zT#B_B2vpQRN~N$&tpeWcqxr&ip*vc3c{w%pO$J?9pfd?(6K#@z`D#SF^e8BB23dto
z=J2@aRAuJnjba<v#!AHUL$X;YDY3UY2!$snPyF$H;yPU@gUaN3rc5d?sE1f@2;Q#Z
z9(KB{WHpz=26c?zs1&zJ!tZ_sxm2g6kyil6L%is~eV%lG6u!>3MR4GvQ~pCu)bD6t
z1lZKMF;&>VKQ#qmjg5|C*66H^K3*8Ld#AMgg5MjT8yfn)(VBzlOP2n<*;-w5*Z<-8
zLq01b{D$^j36W?s4h@$VVSV{xWw62LIh6L5GlpnOoH_dA^WDFbm;v^HvpDCaNy4UD
z>+zGdhY2W0DCmpC!cxLP59E)>nS*<K^ImPcL8FLR6n(y)g7nokDY1`o_GlALW0X(G
z&867vizD=t_Bo8$Xd~x%`|EnWi9<y61PcpW&=-Cawv4TG1miwW#M78G3&ZJEAs8@W
z3?x9pUlwk!%P4+h=i(X&gh)FRkeyqFOgpl9(c8DUxIZG<?8Yr<sBXN$X56IMk-UQ2
z3PZV}et99_agI#{<@$bc_=j^-A-vyY^HFi5SYr5(t~Zm~F&GW4KJc{%d>ye;vimE(
zysGcp+SyTVa``ifh!{86uIcaTGwag_!}O6@u4*-JWkqcUpVJm4dDb^kQ^A-N7MxG+
z?d_2^2Y^`qiT?Gi!8yt^IeZ3sesp^AKrDNPcd(j~uUPExbKze&kz-2>j!X@(jUz>~
z{&Gw>GFD{C<A1!&1#3s=88sZZf>hJ;7q~u@zPEyprd@{*_EQ|ac#fg^J2MsP6Gx*6
zpe6iDh>Zz>3GxcZ_}AX%1NHRB<qXCJx*$Si`@RU-c=){OS6^S32__J<&0OXpAtEvz
z-(ay~c-2Dh?PY1S?gKkzkQ0NVBbblP1*aWU*~dRVki(`qXSaHiz9fVM77!3Fa4f)5
ztB8R`zgk7Y2!$HKMjR90=lDBRnbY20FOuQT%QHIL86Ov`5Q{;dAtu(5g$^D@^JXA|
zMfLXR8?I?6isKcNGeEv{T3W>M6EP>@^-j)p;tjjY{{=sAeWZ~5(0%Ot)9$xrq6x8w
zu!<K8RXLVapdIP{pv#;wzye2xDelJ;#-}b}i0}OTZQ;Q}D^wg4(KnZ0ix?`=uu^<~
zC+NibE27h1))gaUd7|BHs#)GrW^Uc_U7Bsx5w4|vMhjn^tvwdnyeN|1v2bd2eemu_
zsq42~a2u`vRbKTx6@-sV8_vOAIGWtS_P1PDyQ}NGoqjxs4^Q?L@Oes4oB@&j6>0Vd
zk{&i3o(HiFVj$l`$|nj$HSb37g_0WvIjvOi13q6_LTl+*XK9a`W+Y}szLI`M(30{0
zsnOw5Pfu4ndYF+kJYP&%Z9Y@0xH*~jOWD4091!fboWo~_ON~Q1821`WsFT4u>+w11
z-`J2YFS6IO@O_xNpm@yTbrYq21|T3Y2YhNdGj1tIdCFz4rpc+*ijgqR2i-^R!T<mW
zlh_8;3>D$h3rv08bo3aNtbT9I-EZe@yx0(KG3k)6uU@KTL--N#WheJ}3ori`(n8_h
z;)RekA?Ga`5t-I)jo;3zRv@pY>x~T3?xnpCV)ezI^oJWv0$nBkD(~@_70x%B>Fwca
zwOw0|x4*WP$nJ<nW4VoS*=F1dFxg+MD58&foJ=ps{#l1c+AN>0_(yM=cyNhW;M?QP
z2r%$M!@^>+ocDA(dLLP5yDsWvE;zA>--*u8*Xn-MaJcVj9BSLKXHZSWe$Dgu)*)Fi
z@bBn7<SmJhJ%{R^ZHh-hzlb9gnp@NJ@56<m9I4U__+h!EW_B==l+I!zKMpPax>48H
zYtR^|%<y%TR&+N2(+9t|Bx7{xm95j7jRoX#zj{+S#YZ>*q0V<WO60OQn-3qNFkxJI
zRnk0|Di5BWQ6d*oe#)(ZQ4(I-;$dLWQ+}_C>$<0QgH>i=aI!jgXfHhWXNyFO^fNb*
zE&q5PGW{Dv*A*O)T)I?ugnhl;lOjg;Bj`Y1Dx$J9MveiZ)P(-CKWJ;N1jyM=<Suq7
z9kn#KP*#V<4&IG#qZrrn^}eGuplP_-eq+hyQc}D|qpDxnI2eMRxgZztdc+&J^-%aR
z&G!Li2YKVW-tsO*ZDL}gupX8t6|D9X72$@IuIeADcXyFi_lvxd<j1m(EW60ybaMCi
z>oqpX)g{+cX8F~R22=B6_%1j5ljA8fk&m}GRwL{gv0y61T(Q27CwU`_e`^*2vto}*
z3^VBC6{-lKZ?AZ{rk*Ss3bnuv*)+w_oMgtmt*bxe1_=I$Lcn?mn`MGRLGvQjGKqg*
za3Li$S5FoP6Di@pV0#_9FU+(%T~S)DP@aSggX$gkE{gr`h8!?n2hlkZ-WePhVbEcE
zHE+5fT%^+y6RD$O8XbD?Bxca|8w>}I6L;F|KeDf-A&iWVV3X?lwtvXQl$KsfVv!}A
zfR7x8<%KH>>4_%U{I0hNcwDk~O;~3R2_IE$zmH*kR>Eg=Iq4O7ZbsSmd&V{@n|{9D
zA0~z@T<v=P%bJEnxZW!=UD6GEvn|jy)S;&O?n^wKtu1#WQGMHOnFN|fDo%`k>G6_1
zz_q4mx+C3*n}aZ<1xWefYV8Z^ed|6Y3Z@}o_N~i=7Htcp+^<)k-nc%CYVGZSFY)>B
zvEQ4`K|_*_<TM3@^qQ*Rlhc0|Niw1Jo>*AjY_9=a9@cH5Lr?O|&KF5bBDy%~UwU?*
zgFS9{0)&J;H7FH;6>?7gpWJw-S8V}U>@HM_j2KcfS)9bFPH)FZ5N$IDU*}b^Vqs~&
zIbaxm$uSlg8CHM3U7*iLKqfsov`#-WFyCVD<(ydfuQdt;l}1Fu+JGFo*Yfv)jU~_a
ze5m08GD~d!zD$`_)ll;2GX^oBiTC;3=LB$>nI4?riOK<4!88!EAmS|dcQSPEbo;Y@
zEt}qL4*f`A3Ah{PDQ-~T<jQ@2`3Oi<sdcGfMW;cJhCx9)qm)Ro6iRn&@9acdXvCBr
zP3n%uwDqB)KvzYJ$EJxsOM8}1DjJUN3sOI)AL%m7t=764ryY!fXPUk&9%FUC^Z=b}
zU?latTvG=1FeLQlOL_ShnW(#RPK?EP2z<}XbZ?7OlI#{?rXc)a<Pn1sa{KI-F-!gV
z<Gl@y5>|b0IPB=APtp3yTS5Z42Ze_s6P^-%JzF;8XMKFIbK!{$&zsTl-<Iad&xp6>
zc8t4pey@c5PrZ6W^b82(<bQ!4a=E!rhJ}y3;^%*J-qRE;*DeR5C*B@MBiQ+~FVmY@
z3XGhGhvaf}@BDV*@-{T#v!p=HHBYGLXS}<AtW56-HP%Q{Xby*Vw37B7l*w4aE1sX2
zd7^oghZnJ5b76=r>-A1RpB@QCHIk7_Lg%rBDzWFubeCtY@AFj`J;vVf*}pR#F<(3t
zjL0qxHy^W6HNv9|0#=@7%5E)n2~XiH)*~)52L#Cdem>JU_P4vyNRSH{t-w0duyBBq
z`Wog7iICS|Rt1zkQ8EfVjt#7Y3zOH}>f*wTm`Z2SgJKv@rU?##x}6b<PfkF-X5+)l
z<9}6hskI}xyMtGSOCrd{Uu7S;39Ib*BVPzazIz`%j@;bzHM%xjfU?<86K(g>SMlq6
z%{Y1nZh5>f81DqudwMDnxAEC(y}ATi@4RY%yx*Xgj15PkuSlCb#MWmRIzPSNz{rXR
z)aZKE|GizQ=Alpj*72pUuVA)~WMF_2NdMqlra+lqeE26aD|Bb3vO6iotCm)^Rpg8*
z!?zxef{IFKY+<g$#bPgB=)nV+l}_8kS}!!x2!#<On-taA8mxm@mPSXSW5nb^;v!4O
z+QzT2w*`Tqh<9nK`Rg!Z{e$D!X4ZYN>V%d)xw@v^vB1_IYFoJ}c4=xVj@=GLo@U|=
zg_yEz*Lc1F7)K?seb#ha`-`Sp!5o*T(WT;=MSAbMOzv+lKsn=FGqZkI=`8#0v<eMB
z%e}}%qyNVp>lE9bu@RrWS7EiqR;LNxxw2(U^HNcyE6WpqMb%SVx1idg2W4<3fvVT@
z7&_ApUdn++&CRaxmWh&sPKV{ys#9ySLqwuy9Ntn1+1AI*1n7V-U6PUY&qeiD%rhLJ
z6}b_wlWx;-v3Y&O?|*54)pvz8jKIxC0~E>6`i=y73|s$n_Olh%8$1VgN=1D}-<eDl
z|Ic)>rV-Vxj`SAGOE%?g;*)-(y)E9XVGuhXA6nf=h;BK`e#2eDQ&9U8sQU0e^#E;?
z`{HFX1sgpd!)`2QVKi8bvCUkc`sZS^<3U$^7jwc<Xo-TGTVmDLF-JaYxmHO}4qjVV
z7emsZ909$Ls%D^k_NN+rO4XfGs+kWa6||4;_yFyOQ-kl)_g##0`DnONl6mj!8E;?O
zwneqj@xZ0qZiv}K#8N8^5YYccOhMiY^M&s-_UfOm#**@%x&<uGk#kurN_rV1Nv2#x
zPoslSwF-%2=~$|~fX}<S))$Xlg5+OdOHNJFVZ&pm1;kKQ(%L3N6-_*f!JX9D_&)FV
z9$k;;G(cW0(L(>-bZ7sTW_C>5m-EQVWb|I^_ZXp@($!7%oWe*`=Z|dsU~CNkFmBYW
zPRCCStfRi8M`>yLRhZv7dMSW)T77me4?c%&1Bz%(uSbFF9iFr7(i4d_#&Fq6!3Cgz
z&F@vU658riO}8l16hS_#M(ICO-+<foUMfkq0(qQvCA%{N>r_~jQPmXlKQ8P4_KN!U
zy~OA7aoSX5u~h|afesRcY$D9kQ<G21WKRY)Wh879Rp3@8s<A5g6&3XHdD37>w;DC)
zaHdj`6zHKfIx}h$cUlWwgO7LoLw4mmY@f068T{BC9ZP80Gixybg(Lb((53i&bt!K1
zHSotve)6G_l5Sk|%g?6YSH;6erkvI2yCLZRLJ6U~ny|LricJG(eKcUId}eJ#e;aV8
z9-3Y$<4;7U$0KQ`#UM_Z%1DQ3QB+~%Dy`HCfNJq-Zl~oO)*e-fYBeL9tl3R|?OplG
zaF;KZzGKT(%qo9=?V563IJONXCOv<k6`8XxN_1{+a>VE$o+s)jlZVR0dl3?XUY8h=
zsQ9g!0Ul>t!>z!|j~MJ5M;<&$J$CueO0$Xgp2iu(w3A^KO?w>qkX%AE9&Z`--cN56
zT$s(JDinmFV6%r~)e^FZ#rKJq#){yaK<(spNIMf_RU-87l(U+3&LNsw8HGtyC_fgq
z@|}&0>_X=ABF51r!yOON`KlYuletK$hj)=8&qe<Jf?r;C%v&=ZIF`tb*Y~cd$qzMS
zEugIiQ<n&)jtqBZG(@*B6Wi!2^0m0S#F);f@8;2Iy%Z?0+qSJw4Q>(k-I=tGCVnDg
zh`q-aD1Gf>HL0=H{^O~J)nL)>i;?5$mGPH>V98jra=w*Pf_n<LjVSn5b`Tw`$<x1p
z_HCb%iq01*S${pVbA*XDx->*~VrQ}LU`T`hyugj0#qaagG0?L<7;B@B=MI@Kv4OL=
zQ)~=HMOc}!&~{_x5Jz*s8j=Bh2WDBJexbNDrf~gyAMUCzd$GACCA<1|$tcCM&)-19
z^%QTCM&4R79y+;vRULu#>}ZRbkE{wUJ{?C~LP>qTvI6Yr<_Hxai6;idXr2^C85@3H
z()}&q{mOHX&R>F39*>&au5qD?axeLr;IYs*_vP30bR~l-lcWms+3vj@8jk96eK~v*
ztURP*&&TiI^(qDp%fT0i)M;x?D+qH^^xeuz0deVa%y+wua{Q~pIVZ60c$!pIw&uo3
z+x>wAzdpkAoeT{yb1i@$lh5MHSH(3o9TH@t=DJu*UY17_<3UXD@BQ@$E!KUjbrLyZ
zv>UHXJ2UY7?wE{ZAkke^-39(yP98l1X7Z<O^r!@XyTAXR49|KOT)r^YEGETdN>umk
zeZu0m$>ALi+fz!lBI%q8_NDT+BE)C4cyJ?_7QHS;SOnyajugKAN=v><o6*TG3Q9PB
z;rn7$Ub1q2NZGIHm3#YoWpWQv-+xZBZbtc+7Fy|mk*N@+B%boZ1EVXHsuQmQ(=TZG
zSJ_pM-#NNG`{C+)6BgpHa<tABW6ha6nVjk`1Y2F2e=r6yue^>Xt?n0;>W)A?B>Xx%
zB}6x@i`dwF$xWi-NH%MiE$7u;T=w|H>6{R(pfa$xz7IxHpaLNaVbvidujdbWA1T!~
zj|ePN7N>fi*>Y65M5(%KF|fDMh3DO^UOVPtlX?7jjLFT2Y}nrj9z85aDOG&oeQF)b
z-Sa5KIU6xvJ{P!odtBToNm|cVUb-n{%WJC4yXmq>n1sCi-6g%on=c#tM7gAMXI%11
zF*IA2xCQm@tqdVhuL4CL=VNLrUvr#3Ck1!Pq3;TNm5(Wx%_45ukIdd_xH{3yhYlT9
z|J!0{-+?biHx49B+E&gTvbdfOfGL+XBaYHSxnw;(NxLC4=U|uaK&n*ES$#XMy>OLf
zZGSu^)FqTZ>T<m#;_K^nZ~zm~S83;z3@2Oj3q@XAy+-zt_i5w=D%#^VySTa%fQnK*
zx2vQpUmSdK6e@XUTIs9*;zJo&?R`SXA1+{xR;%-h&sQrr1whz>A?~K8kGWhK_`}e>
zaSTg}%%YCXxy9^s5<wq_Y!m=Da=V}yjxa}C2`Hs?7d(P;oi8>6_c94Up=8Pq4;`N@
zg73@A;(SGT4sJp3?$`^llzFK2{*a-%7xV*$gt&EPk7&~Y07Jni;Hgp8HtHLGuV&&u
zVk&RDmkP!820|+S$se2&q$Vf-Wi1Yt4<>LnP*={(sd~?;whl;MQBU`D91#QA3f56u
zsUxlTK+5$O<wR5PPkJ7B1A5N7)%oiyDD;ETWv{2<-S1Mlvpg9ywR%lZ;QdLMeIfi{
zjqu4P4=G;co^$HC4g+ykwkAh<U|)BP7tcFX2p>nxYHk+NpSfNb;Tw%Gf>}78!dmr)
z+25^4{V6XO3K+Awf+7+5QW`VNZnmRSoPTt=(W#W*526^L@h^KhtG`*PVd@Hw1~2vU
zn~ww%Zl|x-a|veEu1W^x98aJlk0ZcGq1JDAzp{}EW1Eb334O-7<i!wf6m?rqeB^x4
zr~5i`)82?>T(W$g!}U$nNQr`Jlr^<pHqC^ozTDCQ6mnXGfrw6vFvR5}rQh@l|Cv$W
zRO6KJ{FaBPjNIn-{+-9AfHpc_%)NrxHuHQm#pR<Kakm0M&KM+HyV<qE?4{Zaz*3Ma
z`4K~qIyJr2y>Ze_D`VvQ`nqco;Zj{+|7tpsd<1amwO#9?kZyd*edroF4xx~BPdyAX
zLPE4b(t0S(bi7e!Hg-XnJaPR^i4b0Aoz&yQ1c%&-PW6PIi~nRX$L?|a7z5^@(CKO=
zcN0~YU@3p*sz3L6PcU*!tUx(31KS6|PwceH|8Cb{QaevDibvw!c{JpcofgJnE!W6n
zLT^(5GJ|2->9l0u^Oz=%Kj&O5n*nNN@YOp?MPh_A#9|f-b~;=%8REmE6Smakh%_)?
z@-{j6<`?EB)P%XARa_^>|Biap<0|qFhBM_8pgF)^>fr}}{aaX~_<f5UBl@@+_qXeZ
z`W|*FI;0b?gFI`%r^G#!rMQusLGoLMf#bA#!C8b;XwsRou-{~(lgXJ}?$K67UcffR
zWnB6Xnn579Lcnr$cm~&GmFR~D=>HeV@AY0<M5>ULUZW+u_1|=*nWqXq$2orH<u>->
z6tIjjla)`SwU1xe|9OiO?}6G8OG1Csv+y89_LAv=8h{*}os)cVIAj1UqxJpr9Ici2
zY&^<gv|(fqJ*?Cpg;YE19$V)y3zK`2#1Z<GBpY{tGgZRHE$B{F|L9(&B}^tZ>yCf;
zrO-bLx3DT!m`NVq;+|b(_Wr~Kd(uXuy=oz{ZcoI-G!ME92a=3Y6JgT2(}8!wvT1X|
zYHVJB0_wEY-4aUwK`eNZz98z$%iRU9YPhB;P%b3di#J`3fT!?d%wdV25Ywwq8)CvA
z8<VE0q7FFCqHmk)ebWP066N?~nyHVUUGc8;GD%Sb&P&ZR4)}J_0Pq<ENWZPhHJeXK
zVg?q=;VvsVC1WL}^LeBqj1Pl0<3;^cOf&sd$jll2RK|q%+zH21{YrAv9I18S3DcJk
z?P2eUAFQss@vXNyiLNwyLegC`<S2i9GuELBZ?KB;-qR(yjMWdH&w6;2BjOfQP-P`B
zJ64$<c^M^^jPM1WdON~z)%Y5wemSv~L;0eea(UAy<@m#9%Uh<zuCsgcV2kud*Ava6
zi$}3Pn=a76U!$(FR6ye?&?EM8werei+wCD_tC7NnpWd=8nWDUdht1SXA=?zlO^}#m
z+7OlbK1OTdo_QdyzLXZ$qO@7t$(G+Z<2wSyB$MfHf%NU<r;$9mjWBlrY?8P}c$=+u
zxHDBqS`@$G6qt>nr{*txQ+TTO{rhV5J&WL`!baM>nc>+Kl1R}KTv1Mj+a`_N`lk@K
zhWj{Wjv_jP(Jsy0v5uIMlE{3r6Yp2K??+xZo#!VxRPVTsVnOqWr4{^4`?k5ezTZ3D
zdu*+D*-x_rTe=<98Ap%2!1ld4{x}|e7&eZrUzW-XoC#7||Fsy@qK<q@Wv~c2*#Q8w
zm`5$=(Qf@rY9wuKS*;?P(L?XA<L^DDQ2-U!UV%r?`f2s4jtix@m=l5%nN<N_dZdR)
zd(|VACr~LXT+_M}nbKTs4FJCWbs=|K3w}mD_<0$?TJzs5gx)X?8Q;Zk2j$%s*`Pw;
zGBjj56cM-B=R4q`kVY-#fw1>+@IEETQN8DvSeWE_D>}L!W3%E3(0GBWe;Qm^P<<i5
z!qQ0OmdoJGNs4ruj+cp!L8g8`Q}o1|7q)<6<(<9)yS{lxJVAj@ZX%g5oO_jYC6MZB
zm&-iG_6vjELwuv6l3<|Roh&`MJF5J~JFBPuquzQI4#|aa*H-F|<@&AGa%mjPsF|8l
zjsLU&I3RsF>v!*&Zl@PQ=t`TVJjjy1P6{ilq5CZ_X{2#!0qH8Lg{Ww-$cbJQRp9ne
z3_>vFG$zrrej;5xV_n>ZuNys!#iTs}NtI*Jf}-;l5i4cDZ<ZZ#Tq}||Ua8Xz6e4?z
z9o^J$^}fB2KFU4?QV*sMSS%9!i_(qA11`w47%cswNF}@*aP=U_?jUNLd^W4KX4`jD
z1Otab@u&FSf4wENfKyVuF0LRjy`EvUppnAsBC)`nuGN$W&zJB2vgeS3SCQ!H>D~J&
zWu7R*@fL%*e0DHUHZ?N5#Y9RdAt906JRZK75(yv<IKI(JPp_v5tE*_l2-}@5R9Iyx
zL2?IrB4Uvr7uJgM*i)lnb0=MWe%^1dve`%sONS@N71UWu(y3yxa(nTTlF~;Z^Qodo
z!ufXo3u|){9*3lJv5NJd8n@}l>_~J9-nLBhf|Mk;I!;+H@N?jTOdJ=L=54p&TOi8)
z>OW4UV#K?xu+DRRo3yqJ|6t)hjQfC1j<Zy^d)Mw%FrI_=!<XFMJ)18MR?rDa3a3jX
zBU65Z%(5oR8G^R2^@@o2TivSpbEbwfo0GxX?SEbX<3UvQ9I@Waa0ZR%Q`mZ*6ls_&
zo#ZvimZb@Q<;$kQOs;9$N?EO{k=|eQRT?SsCZDGQ*fz8OeMOCm;VN1XWK=D_j`bo?
zC;R(k-{Z3hLb>?z%qOiDtH`^ogn#68rm^5qx)##z!&_Zl#+KG8hDFzq7B><UXQu~0
z_yie!O`yGaatrg?lUIwZ99&KeGN1EcGjwr;^@d!UT79-RI3oj$qYVXIxp=*1QOCs<
zm|1$m`Jw|v?9<>=Kima#fY!(r*~s0A7lv?Xs+m$q3FH@HZDq^BO+7sG)75|(KC(T5
zLs3LK)8BFnD7Q{Cumo!<zugab2PE8yO@yqYnya$zBy}zR5}F5Y(4;z&I#?iBK|X!-
z!jBf+7u>8u4@$U(x8de&%T%@kFI=Zbmb=E%aQn6DzVmbphe%k*W52bNIX*zw-;b`g
zVXvDJ48)6x{Ok5Us44KTr+n<I`2i!Y(}oI`lus<)=6gL0{-J*zE73w7Tv`o_5?43W
zNIsXa-qxSLXV%BWUKg&<gd$>NVRDK;hU#U@@X3!A=$rPL&Y}<|gnbG5KoqHmBImb*
zr*mR25pjp$>7c<^oEslJ1VEe4O^sOX#0Y>o9MD9{8>IUb{&_4~{eRec$LLJ9s9U&$
zj&0+KZQFJ_?$}nRgN|+6wr#s(+qTo;efpgD-20C4ePjQrAA8iUQMGHWHP>Eqt_Peh
zzdu?vGgkLF?mw$&c!O=$n#GPk-Z_cw6v(5Zt{K^Ua!EnVK6N8KKQWRT;!TQL5Rcd|
z`U3)0z|E#{Ih2np!hT8*#nJo_%q}I&vE64YI8N;klQ(5=tIfJJgX+*tjozGry?&oD
zHkg^eD-b!Qq*!<fTtoh*uB~@)O~8(8WL>?tMQfC@;@<bo3!>bMFCv6l_8ZKZ_&Z~V
zH!No?PZXMFOUt9jc^lA2c}Tz;jR!>7rwAw#V)ozZ+a4e=j3b?|;=mj&!f%@&AsoHU
zY1E!G0s@=vw`VG8A|~IW*0@lxJX{7x3>bO_C8N$mXhIrT#DDYir>1(%E$briLU>2@
zmI~}a_Vp}Z!T<K`2W{_q2BA=<o4&jlz2?4wXBTalcAQdCGTw$jT*J}{HChM&!P7?U
zyC#6wx6uEhxyoj(-G~lCH4lcW2Zy&s2v2vct9+T-vCXIPaHM%{f+9nBkIx0=^~fqv
z_?2Yamxq}|o~S(J+KL(2>5;=PF+sj|kwN%)l1$?#S?8)`R7=2HGgOTcxx~1A37-|C
zM%TMq?7hPG1e2ABr@d%9SaO9&p;=>gr6iL%jNtdW6@NJtYijhu7vyOvURk*b=?46D
zRx7r*cLmr2f5b>5lswj6O79~pg73zRWm~u|sjv1_e!tn3?VdZ{`AO3yjHWWt(kf2-
zf4<n6qs+o$E_s5(+TB*^vVblL!|G34Be%Wi_JlGN5%Fc8THL_9ck$yuf9|QUnlRRS
z`m{UoOE9kpwpdrgBz>jbW_tj1fVFR5_i9|ACP$DfV}c!TwfUf@bC3)-@$hFYLg==C
z3{DuCA*~HS@N~UGHn>2&kG8MD*2QFBkEg<wslW{L+cL6+3|Dqz8pw5kS24)<Cv0|c
z)}In+!JR;MlE5;4LZn+17=M!83WfXqD3*Gz>$UjRbdD$2B+7~t*F<uG<h4&nNSA@{
z-oCp!)D4aT2<MAr+rk%QS6Dv0xE8jeaUCk`^E>}juWK0*F5%VNu~r%*6JcOMFOgeF
zsO!;8G0UFxp<8tn)O8i%H$GaZQ9}*#^^orR(2OD9bNh+&=oAFj^2n<;O?zt)zH!%<
zI4F@}vf)|k&VKKn94~r2ICm>OMPV{(4Rq3?N8&*$E-$Ga!&(iZZ*c?NU3qZxZT-ZF
zGi8S0s&fmiS&eq6twaZl4J#Cz#C`i^iAQ?1)W|9*S?@fmbPhcgHQx`w=)7%RaK=VY
zF#eM>Z3k4H0=h1WU?@mtG(dvl*EROm6w!eAaQ|lNtQ$${b)87CkQ{QY5pmyLq5bsY
z(l=szhekivM~Fx3wn*pM<%dsa-nWcsVt~#9y<m9flwya#GL%Qs<Z$8us3aU+XvkP-
zz|Vp7J+??2OqliW`Wi?f;o6S?-sGt3k8K*bGaO$#^$PJ{vA7VEuK08%m6Db+hASwZ
zo+1v{+T0t9Wpui@XW=>Mu(jOegh@8!yW@)v%NUjIoz`JdyA#0yBet*dY9Zm%B!p1V
z1)_{RX?lHaJgqT{GhS178NAyWSW)<HXdrtW5OzPMhS~^^h&fddZNZ9mH$EO5oZfBF
z_Jemu?2Ore9|SKW@Cl>^$Tv<Isg!`VMG_)NeCl0y!-ghsbn+Dawhm57bci`a)x^FG
z8Here<5GK&iZrNDFn*n(psWp|2<SN&mjNflHEHv52~*>HlWWv2SM#KNPN15K*tK8N
z^IEB_J<8yXWXr;X`Ar(&Im)>dP8kj93nSK8!f|nYOexEL{;EXgjbLL$>^GzTV&N)7
zYhaxeGEF8DBRGckR}p01C8#%KOR3y-F(wUzcutK^&xhaot*vjMk$-i9GD?gBK0s6e
zguLL5GN*ru1vDD)&Ay{VR+BzEa5=IXKt`f;G(cAPz0m5#!kQC@KIRKCh?*(HvWM{0
z0{){zbKqAEBn!G0t|Ovb<JxXWxSdl2|Mu79UBiw(g+nh@-U8c%fgtznB!E~x2+2*}
z1G)}uM`(!ZW|MS`lM$>}ha2HaM5G{VhQp6JcK}X<E8A%x`)Kfu2x}}70CiH%Jy(Ip
zP9rv`K+!TVU_b@*M&IJ+J8PHzZ0{%4n7Ad*%BLRAm*$?v=eGGLAA@+H5~l~;R)&IN
zN&>SHQlcr0lL~f*6xah1plErX)Sr(os1zAe%0!_H-IkuRqXYLtl)L51{T>h9xB#|`
z(d3%yA>+7j2#MZSt;NY2vk!IFVzvcwN*+w#%iya;7#ggcyfZ7x1h1soLro@$5_obU
zHgl+`o8*;J!Efn;8;dCA1C4^1)VBVUUhIl4;eEdyHrAkAdx7v69DFc0Co>JHOQPnL
zFV0k)vQNHOg|&~bls^L7MWCW8TS<_F%8-U2QY9x<>tQ9WZ-hThLzX`h1-S#X<I=-a
z^SE^1+bpotiDlPm9rmu30*<cx&AyQM8|$n(A@uE$vIN8$V4&2u(7{Ag*aY{UY}r$&
zLo|1F>i_(~<`u2vN@g-J1mF@18-au7)tg-;$mGsQ1OtN<!CJI}@7_1!)R~5Dv@j@<
z$bBpw_7=4!MmDN^(g9WB-dH6%C5j_`Jl^bwZEl_-o9*q{CrQfk1ml1`rLxk|%G0aH
zxMqx34D$v9dh~6bD)5(w_T2OV!f*z1>a4W^to5k~aUIskd`7U**2Wnpv_MWhn1RMK
zVoAeYz!*#TmtxMN5Ih$xQ$TNS)oOsZS+S1Gvx%AX<aj<EG}h7lwq*MGxlXTjzx>>}
zh88-P^KqG=K6Sc%1+@)d`O+~dK`Lu+-CRkTnm^=Nfyly>2$$<$u7xJd)y`vH7ZlWz
zzu55L@y8*@b=wn!FsZTDh(Pq&R!2Bg;J2e(Nf|2*QWOAbF@JBa&Chu#KZ1&r^gh2}
zL=}@UW}DHd4#leY%-nPyTEJvN4D9B`+7LvXv<8d^2StGxp1V2A(obL9^3=pKkW>=h
zj5*}m<VHeT<rY_N5+*}J$55#CH!J#&qs=do>5cto*-t*7KezUvQgiE2DR+_-vqHt~
z8l<=auD;p?lW;#e_ANx7#R`!Q%mWXu8lnfw4z`F{<MHIvyFi{EHLvq&xLn6c8j+X*
z(qG5cKT$|pW(Np=Fvp4O!8mKQa{?G%3Jh=dlOiQq^a+B?5r6L-0>o7H;|$?M-+1|G
zkvsrds*lE5PK_e>nUaG5q4ysSPNF)-tncEh1V4VMrq2h$zaL(v_+-kwJ5c)e>60BE
zGg^QfMsG3L1}AA^sxJ?T#V%a#crG_l;Ap#i4=~zNxQ;q8nDs+{lIBVZ0AR8G43rvh
zXnKUsQ-CeBIcF0Z)WgCJe0|KaXMOZj@aECcc!!L0o92E=(;LT}T-mv1fRHyl1jX#s
zSVy8)MNVajq(TtNwM69IIXO2hbF)T~a3;nRCJC?3JsR&+W37r`6c${|c*_k@{Ys85
zWVnFii4&y11pv&dQfwU^$JdfQ4X*d2VlWklaHixXHa$unWX30c^+c6uI6n>2Zf_zk
zWlP=1dz)T4)5BZoBZv3Qd|FR@%QX}^{+KK3pCBe^&QDap`I9nTAB*RS^tCCI(ZL!_
z=g$vp_CZB=Z%2a6dpADOq4+-yxitI8M=@pVG1Kq%@e(_rk;u1-=Wp%=^h<UD<dwlj
z?w@PVKR#Rn!VroJvm4Ehy)z0M^7@Y2DHSs4u5b`0mN2sPHXBd7!_(q!k>^fYM<??t
zHWZUvS~vj&CMuxyMpSxt$8jQ6*!A`Yrl_n%*8t5rfxNxdT%qiu{pMVantS}TI4Z#n
zzJ@P|Re$<R=GGc=FthKe>Vw(D>=N+JO~xG4-5D#Fa32xcqT-U{ru<-cN%F!lExGX`
zU0z3Hl^XJs`xZALN<*a@MyN$CEg;h?NJ-JB8d01$PMgv3GJk`2!-_0jV$G96K*|pa
zZw-MgLVT5kMhy7uC22_&=P}`<HW5AwV|5As@|Dgt(>>PG&HD?p=GsgPhgN*k9;X#g
zi6<_H8Ct-mFnBCNXf1{NqlKTU7Ow)PSq3ZV%gkH`BHA3u=NA>nJ4!)Qabhm)xF)G%
zhnuH{3}e#5-sP1*)z9@RwlugC*x>PDd%om1Wm%^fGVl?kmC`lX?`H!fewb*Ejz65_
zMO2+_nW$>Xy|K9RNVw8+Y5AFP?O4mLBxEod(pGCig<`4RO_3rcb*(kR94Tp45Fjx<
zd=;feF->~He<1(52OxtzxHv}yE^?Y_y<N_|t5kgZB@hY)^Aw*(Os60l#gc}I6A>h|
z<{;Xm`BTqiQdX1%d>6nAMt^A^0vl{!nhSQS@?4F+HJ&GHY`oUHk@*`-c&@01nS#_g
zf^KjCzUrkmgnCHGRADu3Us4pqBY14&ccHlqq3#Bc$kjeEI5ZfsaweH?e0#i4<L{)~
z*!#+G$en$nN>mwup7Uk&d^rX8Hmm$B-z2$QxI{BOBfmG?lLk-`Cu`2`a#9lwFar6#
z5I{A7QDt0&2G!v46V4(v!sr9-(CP|e818m7tk6-E8u$Jph#L`rl&BuSJC>|3y}y}e
z*Wk;-jd&&>RcOE}j$Ltnp|6t?b*ydX;QINEmywa)D++x%{2$V(G17GDjlP)@La|9)
zZrQ^%5hPDiItSrUfBoMQO|Fb4tpZA9<n-kJBN<1<H6Dm&?-%fwJ&e39Ly@!sV@g@F
z;u(`AA^9<C<$yPudi!-#cCAUys6#Q<JE;@n;XM`yW?8;Q7vPRXCAY_F5p9l!Obs!&
zk+?^9Oxu%@G}=Bi^-D1d6=mNKfr27}T$*Ak_h3YLyM>&j*b>t}b?smq$COHD-#$V@
z<lN+muBY1^{LK#$voE?maQe_9n}jqh&#*I*MIWP7mny84&?jHfPp~?Q^YT!9)qgV~
zHw!?TF;8@b+N!0KI1HHV#IrZ)=LQh3V{;i!#;WX`88QCJbS*F~ROI^;5)smm4`9lq
zw9PaTe|0gRX@ifOsv2Z~>~}DFB4@>WB{!W)BvGel_`|<9#%}$D9gKM7?9VHJc(c^B
zlguZi8g%QQAypt79IsE98W16?CCQwJlq#IbND3eQjdqfXjn{qBzCOIS5=-|-`24kI
z@G*iB<EkYMKdiLRZ!uhUQB9m{Kb$g+j<2J`7kuf{$C1rU#d09GxA6`~J=Oa?V`-#P
zE3Y{=v?u`a$-t0SRlGx~B5HL^qXFP%E?`V@*{H%g`iW0-G_xG8y|k%LrDNfs5V5X;
zXDUY;@*7Dr_QOw8{%`@T8ga6(nnReXSsDt#w!_b%zq^OGj7uRaw8z_P=y9!8YnYrE
z5AP~i*hht^s)~`UG65i)9zxNWiS2;0l2mYU-5UJf9@eO=`WXr4G3~NT`r9ftYQBK7
z;HVIlSdq7RwYI=gsy|htC~3NzA%4+!dScAKQ;gXq%QMFn(s{#4gqdeWbPrSj@fN7H
z>ipF%A}h4@Ugxk7a_{-7+#yI(RcVL{Z_@Rvo#%Go>q)9)a_lH8GpN+O?oMGR=c*ws
zf9ewUNhx&5<b;s0B&p*FMY+%w2UAWKG0YvbPliUu=N`iwjU`W+i8}@jGO{Zg_yEwy
z`RO+5$`l28WpC4UK0Lb@&!Q=XLWG##|2amNT=Wk1Y`9Hf#Se~tuQI$zv+Bz$lBuAK
zU3z%Y?MtOgb@sE&=Xr{`Q^jw53t3hL9g<*pX?XfZ_(L}<jK8*f7t>peHR_)}20$GW
zGSCAQ#LM6P2`8cZ^QeVM%o~ZU_)Ugm_q**)zy92Q-hO=3*0%X+9q8H8r?PMO=^OH(
z7ElDFSpq4(DVz?5a=3Av1jxQ-FupLzhy=*N({+fD=_(1t_2-gf{P@;!rHjW&W-xte
zGb_ky7|*_V;+if6MSB+|b;Vta5wT(Uf4jK<9j<Xuswu9#qw--k0$$*p(Zi81oBJI!
zLhR|<$LC43FY15QRQ?^lr=mF-zxEea5;T_PA_Q?VE8KWR9E2-tRl_b#$rYS_4t4?Q
z&HoJEd?3$x54+PLI)9Bvb<!5w*y4sW4e1Q+zf~uJ+9<<LA74rkK8XUU578y+?{j_;
z06U)|{jZM2+{j4kNvEQB*wr+dx6XJIilpL9q<Yc1!puzn=&1bFQV|6&L-d8oUI2(U
zsuCV6ILYx)<rN}ks*W=Q`MGPypZ{pI{QFR<n4sukmToD-BFNn3zYWJ$q!WpogoJv5
zwd!6!9%L$xpox196Vv%O{eY}pdc2LkG^GE%3>ZjiYU&^B@90!gklCWRsHou`9l^mB
zH%GwAzSx8WIK8bPXB2$`d=z!+V7DLlN)>woqD0xF5cr@PQ`3T+jF<Eqb8B2<#@n9;
z5(7p5KD#KmB`GMk9G$gpsdh6$iZf*+o~$S@AKzETzP>(iI>^r<lQcG~uz`UAYI0N-
z-yg{gGnV@5DN?YCqTVab-n}OWxUstMC!_@gDl=E*p^Q=rH2ej0gwW}bd;7H-bQbw?
z`XXk5DR1pCN;hpk-;}qinaroZpMP!<hUK3$hM|#nvKwBPaF582qD;ca?g#CCtf04a
zJy9|T+#S%+pkV!p2x^Z&cx%Jfqob<%Sx}VQ9oV<dJkp1!tvpM;MkVIPjlWb~Omj)t
z6|f7YT&@=Fnh0dG{~dynLV^@G`Yh5q8GafySTpj=!^4m>Gc$dkf1E5WsU0011DG=g
z6RM$MVXIkz-Oz8$dDfA8@3;Y!NiNIGG#aj4vnMHuRnli)#Y#W7_xG{MDEv<=Qlns+
zFP<^1=N1!Wc&XP!+<IuwUkotuyUB9n1=sR-1_)=yZ7?3+>x%Jq^GeC6;6h#J*`P%2
z*^r}25~lp)Lmc>{>Hl7YJ7fXR7v`ZSJemc!9e_0{I6OC?|Lk*LoG>5x-QJU#tMyiG
zX6Hqpk%O;L2nZO;CG9OOP{skFkg%`b&(HJKI5&*V{z^i47NB7ZFSlp~UklNi=>lu7
zUd`DIk!az_Vlc!>4EI>Ub;9$F>MHe@%z*Ea&A*EmQLGgcspT0~wCGz*E!MpM5{=W$
z^e_TSDfpk>a(k}{h<*0#APC(?ea1t(dz=K{l*l~?k`9Cpy>}RR+~sMhU1wXfeVAv4
z4XEB0<K-_uC_cbA?98w*Aa-A-;*kq@qjh-D{di;LSKc2aIBC;DRuNw9X`)bEEwIZ6
zOgL9%Q$n;L+$a-9VmxfQqrTsZ-O+C{Cew*3WIG#Yy@M7b1`1lr7Ec@+3s%8Gcv3WA
zvxD-TX$eXjO+oVo!Fy*H><!T&ZSMy*J@p637IjDB`tRiewPH31MA{a8I}7oCHot{6
zVxlOP90fyfJ^H=<20PZq?U^6Ka*+5K*utDu{2cr+*Ejy!jL0uu%*$=_kb@=?v~PIe
zw-I7U7B`RWS*#H7=g@5#O-E5gkI6v;sDSX#D1!pxyI<tt%4@xtH)h_SbHENk^)T^B
z4_k>xEvguYecSLY=r@qubequu+UhY_=h4@5kTDtZ?jUEm=67L`mvrZmBm1C|R*{0m
zQ>J}<<|u~04s(o-&@wWY;A<^_Dq1)%ZfWY;p$ACL&$;P+^Ksr^LGFr(8lRr7-5KFu
zi?@V9ej9LDqOLx)N4&3L?6@S;*KDw$9D%Mt7(%tHC+ElZ0`Stha5cXcR5I2F6lfq5
z{iqD@`({*2!3%llnOfm2aXjTwI(b`2$%Yg<s$y_ZAW@Voq&39-m5YzO|NPwke3MX)
z9G&kt{a7RmJ*0eCBG<pSn6u%e&Ct5e*8Ke)&iK8W0kp62K@hPKGD4(%zfpsgAq+vB
zBj{-x@kT4!<Jr`Xe3JVQ%z(d`*Dem+R%SqQ^hZG9r*<%CbTZ@ngza@#2eOc`M^j87
zUH`3IsgE0M2fq#4D&%KCeEZ|J%kUzUP8}X*s)F>zb_@?R{wZG1*3Y}#s|}C~dxCLc
zYCq*aoMB}DnXW7^aB4jHa&9yU2??ROUN8Iw7fzjC{Pp)Hus$8FzOF1nJgo`As}E0m
zmqTOGr7IAL^ftzfdk!2Z{Fz`O0|?m)IK^^J9^*^`Urqo%t=P(_>+y%y3j|uBZQv&w
zx=MHjaT@!bU+XV=NrOBjFp=Znwix7np_6cvAKSY!TA7Kjq0UfrLRq=fBlgS*eb=5)
z;fg5*%vWCl-RKtnq@s(|C9b&;f!roq!!QF|op5tITltZLLhId5pfen<E6ItTV=&d*
zhd))6u!{RR#12EmyAWy^@O+;vbi!)S`WgFzhT=o5*qZ{3h~bXCGvOR-KZW4ps)A@_
zg_I0Jm~0`fJYRlmjPxVf^L^XVi}M2WoynhGS0SVTTWC{z{&J)sz88-mH}dn4{TDa8
zNMC7SNVy++@p;am-T!@qU;nbw`8|_FOusea@KXLu^z?Pq>?%5qi(Wsj583ZVm56zI
zaB*d46lbj*6Wb}bk8@co%;b33DHzREHiV9b=9%vB1!3|-T7S2tCBTVL^^lm%loX$D
zQ)+S5o~TzbR5!)q<`Na+|6`2?8<>p&>^}*xipIFZ=$lA+$?gI(JEHX?cP34e)3-to
zJH{&Om08m$y*wUWez!APer@tqsot8YSc_i%+>5HS$Ba!q)hkSuUfbBNH6z;2Cak&9
zWAhU}Eay!H=YV0^p<oLph|MEcQsPuru0RqCbnX;P(kPhDzm?5+u8;W5o>mBTvLwH)
z*1c(dVG>ldDa84qF5SpEp!S}MTK!*e@XUZbo!Xj^DW=(;OYh*|Aj&&}EhM*Gn^0XE
zCV9Tr-@hcHv9Dq5GGSm88}NI8cjO9BsAJ9Q+Qz(G5v~V{d=p+DK-J@KWv0LGg@;Fn
z#^W7YO9y9M3Z=LCb*;F==Yp`)Z_Q7{7a|stn4A&u@?E0Gj}s<*zJb6xgEB9l67s7X
z#54!}hws>sE`y)d6h9++TAbiiUr|AK+L=J)ILj*R`!drV?m%)ar6PVKcizmvXidv4
zZr|>xo#>fHA*1894=WiGQ?c6i>EZVgCp%CUYzy66$C2~A5Md=BeMIf<s2bK8@h>G2
zycisIm_60Qu=d6iUyW>c!GA*L8%FqA!CavWX^Dzk48?RW+=-vDM->DEz9$&*G(12J
zXEFjD#oR{5If9swt5HT_`$ogbkKfhwmLW3wCaf<O!n*$rcYsnjyx`83yvv#mHf!vl
zqlydeuCA_7lItCA_29^hE;THttxiYfL2(5b=McYq53ge5&G`RVj_lccFF``V<xQ{V
zO>n-(<7-83M)?jkxX*DX;ntxXC2fc=CazpJf5On2Ws8>k;h~vki}mcLqC3-1h`b5d
z?TnSU9luS8O2Sa~d?Sdw1~ynxwuaf2KM$Nb_QYaLK`E}pj<Wjfh{Ua)lz1A<&Y|r7
za(k`kV0l8Gc+hGnlFXJKEhNK_*=GS;FO1}Eii4ocS(!5-waC6mbljL4&5oZr(%KYq
z4-*=)$%!7izpv$Nf=VE(833|nO!Phw%<0er{Xm{@w5R0b!INw>9)q01SWZzeFi~(z
zs<ZOK1K2~~Yf(uFbe`QykufRBjv;!J0m_p5(}oCU{L%mQ76?WgQRm=vCY>Rb*DDDm
z-9^9|@n?m~Ykn$|PHjPrB#|7hi;+Iq2I5kPQ164OFsTkI|L3EoKtT^o>A%Sl71=r}
zA;d^Q@}!5Y$Ycj<>$dWL?4Jf0ByeY%Xvy*}l9i|02b3fwwXi;L=#<7pmw*FLCG@qz
z1!=WhFiO!Md`oqj2WS7gtpXM30e3R>Tn<a^Hf^Dj@fkzrzi<I?;wo)-o$nGJA4(NE
zOe8Z`H;~T^KcX}Je!(%bKo26Jrh_IWVN!!S9`;XIK92-Gw%|%ROhtgAE^_Hg7ToK`
zYdimh5f>7x1UYdT1jx-1E{l|IBE`V`FHk2yDq*~FCFnsKF2VM_`i{pmJ0|?>Aa2dO
zNScVrL;|1!D(n0^a<D-%mFNKG0MLk@$@zN}B8b_Qe<c$CC;UbS0mfPAtw+b)-rNqH
zfpznB4Qy;h*K3a7{j*4%2Xg;?#t<k~h`$pdDvugy3Fn(B<YMRiSsW=9syyX)kb>#{
zXSHi6ex|dT|7rpLq7CF8k1YCcY|U`Ym=knUbDfyO)c?#?%!E?aFrx?J1B&x0-S1{~
zbyS+Ecunri4FIQbRD3in8u4ac4-Vz?+J6Gq9#nBbQ&Us^_6~k~l-eS>bRq@@L}KFH
zgnAMvATd=^MkY8i68?0dJa~Pbm%I4DAnfAy6wTYa32FORAwdv?xurF!GjGsjQENu#
zoi)7hdF4O11!_E@O62J5=BBl>l9Q_u5lZh&WvJ3pQDJv=!HeAj313Hh7lJMZ#6jAc
zFp(M~#>+7oFRr*~R{wp85(lVb*2WsQLfZ}Q78kl4Qf(?!WT3_pNJvc$qrIuhr16*u
zXS;==ApoYVz>nkqVTF@l7%$^p@38U=TOs$Bob2CEnb6<6(xBq+8+PZ!Z)0oR8087V
z7aY0Epsl$ha`)EMiK%smZ*Bwp=bx<LaGWt;Kc9kEPg+l>!vDn!Ekz;konTP}bo^*y
zi!gMUcD~WQ?s!?OU~TgC3@RjzeD>RPcp5ogj&=_M<wtdnlx`__F2=SNLTQNVo}Quy
z<(a42gQoZ}h1c{k0A)4GHw#oNZuI1Fa+z>@y|T^>%~<d%N2*yev5=yd=Px{0po2nw
z=&`JA^hGU%569dtL2cy{#Rz9DE%b?d7=9%gmlQ<+KBVz~cNtLr>#s|-VW*cDqSc6q
zh}hoS^FKZ|-}!vwVq-(+;^Gp<=1)!f7k6m=Z`{G293|c87nn@KnU~jAK>0wJk)hKY
z_}vg@Ey}K!-A1l;Am8zwM%ZhBFQvf)*>qS9;6GG+#DgZk(j22?5S>2OsPVn<Kul~|
z?yzymrXqk^uYs|@ZooM4lq_Zz=DTF@@;5cp0$d}}CJ=dCH2su`{tn{P2e?V5o;Oz1
zH_J4CuEW*nCY!`!2^?&ebEdKWbhXqHG1C2IFfo*dun~l|OPjVR6TLhx*^rSIF7h+p
zd0UA%t`w{V2T37vWX%5yRmT81PNjQurhoB^Bf6E~e!>(nCnwh1%HW_F5s56X#xtun
zVfM>65`se)M(Pj|Q<zu;3^$lrzXWXNLdHi=!b)*Czd&L-+rXKSWlngIrCmkRTEFkv
zT-Rrda4)yKXa~B2+q(?ZuH1BuMv92K)xX6=2)WVKsfE0*sWbHIL0Tt@bA8q6up<88
zc0!mCneMr+Lsf%asdo$aL$Fik0R!Jyn(c1q{9R|QeuxsD8^RVhp8gs}q$TgHh@6q#
z+L9eztXB9P7qFd^1_%yA+3oo*G86@TKNGz{KY3Mf)5>nawPcUk+9&6>Uu6QeZy#ir
zVyKfS5-ky0en~dx#0ue}c$u3tgLH!?D6q?qY2is5I3jw&m_;)`XpV?zlNwNzMUGKj
z9B;>`3kBm={_GUSzRwIK)x?a)IzB4U^58+Ij>BRxwQ-y~qWI)P1|I6>_3tGWE*6RG
zwvjxkqR8UQ#W*>^x)eG0STV5sSP*BE>iB4Dd-o)1r`2w|)0!(0rsOl2qpqSFT$9Ej
z6^WcFC1R$A_Q1r?de)G{U85kUg3o4Hb5K{dw&pSv1y;jM?y~)B>ko)?;$2hH(h|*i
zS^$fd&#&1Sl91`&QUXe{G{%8CMP-r(*AVMr&tRDtR}y`dG?H+S63-`KlJdzShJ0u?
zx;H(Yft|>yvamLl$jA39vMrEu!Vyz=&gU6^^>=N=?2%(Q+9Co9ceW~qT;TX#$3+^h
zchyAtn`i}(9|XFHMFyYu+70P!!5bxV=1W)1k9OJtYv0>?T&5&5VE4sFkzA_jB}n|m
zI9WY8>R?D?QZ<E@JHlkXpXJ#vXq-b&`MT+m(`+EW-04p67`svSO&RBk1P8S=HX~Si
zWC%@f(z4Q!6QH!KPrK-NicVcct<5;odM4}5oNYi$ru{*!)A9~&dYIZ?z9)=P-G;bA
zbji!w5Bbt6G?!|A<N-p_mEw2*3p+yVmw#4uv^Z$Gk7a!6i3m%^QsGT3cm5GBL;uZr
z^z*4P-fifY)U+{0N+*%6CCI-jM;#u-(3QB)J-Pr1ROV*aW7I`vp5tJK;W|1CV}O%T
z_sIiNhbe)JI0`3<2o^5yJ?!kgH5@=Lm?<_Iey9~I(<UVLzPU%Xojsp=N*yQF)Kt?r
zv8{p1U|_&sj_0)dTOs@n&VO05TjY{B$E}$erD^9HJ&A=kE>`D?ZG=m&H4p=OIs?5a
zM1)GyoS&ckoIFm<d1p^P`EuW}<X>>%17scy6jMM@X~5<!7ZEgzC5WOVA!U?Ym>cMv
z#7eby1jGjC0ahVJ6CL{W*|5qflmkAjV7c@OlxIRG@?)nxgUJotG*74}NLqfpBDt{!
zuiggF`~hN=vdXDXps`zF4MGVv;c`?ag-EGK%>b(*#g;<F*Cin5$}2d|u&(XG0JrTc
zg+{+noR>SvWi$>V&$wRfX35vtNv}ZTonpy=OwPc=PV|)J=O2NgR-O&%OrlDdso|tA
z(2T?f5~jboGd`5URPj#{LQOnb8#=>9%z$0u(G&}mL4bt{p5g7B_FPJgo)>T49!nsb
zst;XTq~A{noEf#nQ>oYLgo5&NK1>jm=CeyUd+5TzkiMe#b|Rz26#57XDVeS$D5=2~
zHaO3A{*3#4B5NfJAeED*$hva7WtE%c+vB5n>Uh!)&XE2*sw7E4Y)Q@)MGp_D7v+8i
z`$0~x7iV-kAYt$mfPy)dJ=h9<w~EkZjDn1q)fv4W#uOLQ^DGScOL$;UZIP>nL2^s^
zkr$*-s@>2!ZAa9m;yrdwnpbG6J;tS|Qrh>|>^dGtZsZMFcQV4hk+SF(Vc}J(s+;+K
zh*C+6zOcu9=-A6NTkZWjI&PzkwaclJsf3lNzrQgK3z;mbhcfnK*v=0FiM?$vhfi54
zJDhU9M5>}$`TOK|i{F2)o%3q{OfS<bZmC$Gw~r1D27`k53RVL2V_nhE_WKte+$$lU
zqNIXzuY%`|{vK+7H%FD>4RQ6l_=8zUXf3J;NrrMFUJ$As)=7xNqqv%1OZ8JA6%w@A
zMtBJUp#gb_=yXoPVM5<{nFo6zBQO9R)#1J)HooBZQ;>m1!>Wp_MW6_ADkZCPS-I>C
z=Ejj{z@hZ1_a-@B#vK!>Gi$5&o?~Bli<2{Z-eER5-EX$t-t@^xKx36}+G^Qzbc6i9
zdoDWm#ysp}XAnLvz)rM~7vTi6G97#FLa+UCDr47bpuZCDECisKe6JjEXC=_nSJZ31
z)r9ZP_xL3U{~1o^LypN}_e2s`A9FRwg)7N|BTXQ&(6wb6*<bqn2GP@{9Hu%E*;v;-
zV5rScR<Ih!!iaqCh%lZ3*6!SB^eC{xM<Zh|g4{R=NA8o5arrv+*(>=1bhD$CU~?N6
zwe&glmyV%17~yIB&yAod`6lgAyTX*yj&TZgScfkQXCnJW%u?#+F+z6@0WY&DRoKgv
zn3yH-My=UHkD5`iF0*(^ij7aRpA2qjyBxEY*sxDWh_}&F6qWPQlY_1#dZCE{qcq|v
z*FR(z7EN1w(_dDTS1|xcNKmZ2;IyXnCT2>DwpcRK(lE%;3Ap@b!^&Mn)PTFQ@E&>J
znz^l4w65<v7g?cx5y~ZiPch3oiRse(Xm%40B|^^T%P(fPgpvYoU&gvrkhiPCHDahd
zw{u2>)_?lfIG7Sz|2i?qP+&wg%4rKJ2vKgpVj{R4P}10^x7pc9$vR{kq-6Nv)2aOV
zHBpYgQmEdbUuY517TV=<6aAfy%XGmjVCuB|Vz{Uo6R>c-qZscWARy3_+ITmLx&QK!
zs0Sw^KCWcGk+SCEquqUTEyLq8pTTUL#f7j$@4xe#g~G|-yII$M+OJO|px2^j&ipdp
zBQB^9QCDc95eK`aL1K@-*`ks0P&6JjwEpB`x?92L5u*Bm%^|-7p9>QyQ6??HR(G`|
zk|oj|Fr}G1wZ|^O#<h);!e~5czF#eBu<M4m(FlF^SePr7)BVV;!W_%4k;Ep-sj+za
zSvPv1mi#or^@w7#D%)@g$Rm?-TAkh^G1HE!aNEomlreWQSMl=QWEs{G#^si{kh}%|
zK2@;Cu)6QoZ@N<Dy%om(pxF>B)2D!wjcQ?EaF$v?dd3DZ2b*!N5adx<JzPSkJ4EvU
zZU|~oE;~y3epGJ3?_FAOZa(W+`zC+T@+r$fc9-t30R}}ujxSr4q6&=+1qF^n0E)o|
z6r5TuR}V=t#(HrChk&q@aDO~s2}AzppcE0GTZawJIC7iEk-d#yMn21AzdTpEcVU8o
z$S;F}E$s*Ab0CAe{Avhf!g&o;!oXXA$X15L&dn3j;S;}mM>8hh_^3nOF_Ao-`<nF8
zta3q>H_9-@WPeYfLM&lH(5js1y4@6jg$tL;LwLq(mObJZB|h}{(9Zr#v4iQ@FF4J6
z99EM9#X-+-Prd2|u4FYKRrRLrH}s9bpkIRVO(?<1&7#%GE_r+h<J0>W{iSwY66_M;
zcv=3}i`j<TYfpKM#ZZG{H!mZEVM$yc2reGo!36a#`Q<_Q(y+1ZuQunAk-@zBte0<k
zWc&oD#&36b+%0lxK|g~=6y?*>BWezw54T+3-tW{RvUyRjq6%V^esD*<dm;Q3YR>)9
zmJrlka1-BD+7HClEmU0LWmIsDoDjI`S##;ORgl2`^|cKr*AU~lWaCV$iu7})oDo?u
zE5CZ8vLD1aZ-<oaGHl?C4eI-y0jSy*{htXVJw)z)QzU-91AT!tsq#u}crdik5^ujm
zW_V>$fCcg5K8;`PW;}*YO!$~$$GT+(iV$t)6)-qax(c=EMp>L~IA$3uNrY=s0Y6Ds
z1V6JI`*I&Myz2GD4)g%REJ091!ShkMwqgC5ukqMa=|i`ejWU;tT27OhqETANrD051
zsMQ`KaeZ3Ril<Bd4fL1!Y}f5sA=2-7l@zR28Fa7k3(0IGFT_AQu^!?>OOz8jxK?NY
z$|Q1Ypn)Eb;KJVN%A}RPBr;MNEy&?WyRljp=#q0pS!OXp#^+yWaEyoZ%9aY{m0P^N
z1V4YuaLBX6wmN?}8#IJlnaeA$u)Y{DR|nC{n6aqZyo_kbWAk#(!sPcG`EY;sn}Q8z
zWuu`L=LM`NM9Tb|P&)0a({B<~*lzEnkbqjw>1sCCIsEgZ>kxH*QzW&GP)XUMC+kJV
zq^kQ3Q|9s-Q~%K4SNB=(fFQ=v*3p<P6XUVgV0*8G)sMBD3k%jPF4n9<)@r+xqi;BS
zW~|w;aD6!|>H)7m$8-aC-0Klvn<^;gWKuSNlSYO%@)oQ7fIh#x9&bJQ(B{d`%McVK
zQtX6MJ=LK`h9<|zC}ahqZ{gS8fPBq*(}I(0<br(nqr%N47r#D7E;lR+<TFWr0UOFp
zch<s*W-(G0Si2Oj`vlri-C;)n0e7*=<dQ)?pckm+r|Lo)i#pq#+G&b!lVmFn9ykim
zqlN<`@Q!Qg*p<hGkPDxY{dQH1X~kvQ`km01<h!2qx7wtAyVVNsyvS^LR)IMPyD;Z#
zHd$kg*nE0aE^>V9Tlc7{Zq3==AD_|}%s1PVq$0aa;&$AcHb7=Od9pf}I;`gt6Efnc
zB*20ZZoJMkXoB)R#HVION}7@*gOx}=;L5$MocqOYZa=*5ufK03R;0SwP6BcR#g!j-
zwt4ZDM`(HC>J%W;)ywGG3Ri>3smr9mU0>f>C<y0p-7M1GdN$y*i%c{&jEQV0-z|&`
zb|}nLW`ll1y@~#Q{G~nU{vPnamYwINaSEM|7U4E(w+}TcH3%2j$Ww6;8^E!H7>Z|2
zwA&}T3kv|?eOSpar^a*Wxd<M7{L+y+W<pIbhRxiTf7cg?At47SE&n1(<)tOA3wxPJ
zgG<^_#f&Fq53e<{gm_4;Z{CzQ4wqv#lME-8qE7W|iiZx&PkKSs+_7@2uvVrbab?F!
z@pRqqo_*dV%VUlTSq7+QF3Q|~Wg?|ooXVo40{#Q@nBWxvf^|*cH;-+g)|5IM*B28g
z!}OKoazh{36GBu^4;dEiyrUF|l_?#C_ZU{fuog~{%x#q5tFn1I2kY6j$RTE8qjnKA
zHu#KfL)*OPYM56{>A`}rA|{1Y{0N#r=|D~=A-phmB9wV{(EI?YXE#a;g+eNgJSyQQ
z$Jg<~vUwpEeMZ2IjW+BXMOleG-Ic_WN>QsIsvJ6-=Z{Y!)RAVCuD;MWGcelsChLYH
zCpeE88!#ez2$WjMW>s^^VoPXLy-HWTa>Y3+7UcyJLXD`b1bzozFCOrQH+=;K1vx{m
zNpscEE2R9RC$!D_$7Ntf$k!JE!Tjtv#N|GWx;CTUzjjA#_+)0q=GLJav>?Tv=pgb?
zw5<3s^cnvNVDkZ!WZvmyq|LoF7-ydalhndJdDjEX`ME{Cu`b`-BCh%<pb)3X@DmWu
zoMGRNGH!OP4Ew(uJ~O<kbqFrWlTARTYq_Lc-{{{C$>($!)K86E6@2>>mZ1(AFAzvP
zqfZx9Fj`X49kf+V&U^!dikMbR80u<|MTd$PrO1@T7|d)VuEjo8(>?T#PM(S@=bS1k
z${ue-y)>>>jZh%AgMCy|{IX|j4Xd120sM=Ji1q(m(%GXxX$bmo49c}G-8S(`Qq5N)
zPtNq>M0#7~vx;%IAgHZ<is3Tx{9yhQLz)&RUYk!UVS0^PPqkx?g`i}zVwwQ6k@m4*
zialx2hs(k9t4m5NJUirz{XI;y=B+p5Iii&~=M(g+dX3&7Yyz%-BYJqKEY{2DHCsok
zw-jlh_dZ^jN5ZMeXIN3dd$6c=nTYGh2YG}W9vEd@V7~Q7?x)*FL?ATS5v_p${G){d
zXy4wZ6}cX4bZlV0_VXaH27vhQkJ&FSh!h>f=lx^zRbX@-Fbd{up260It{jD+GFku!
z*`Q1)J$i^CwcL73*SU9~&`?@u2O4aC+caR1kx>$c_+w8lnS)DZwDJ^>)f1A__>l$&
z%*w|U$yeVA%x;n;l(Z%&cvJ`$C!O>h^^P?%xe;O(#O*xb4}UE5B9enLgUH*_A$8-?
zW{v+Pai_(BmHQO&c!gBWP;oy_MFB7Vm9htI(l18f)a_;5sG*x2{%SHu3wm70bpPjq
zt@hGt&$08yfZvO><%{=v34h}hOH2?UUQ5g??W#tnL9!641-`(hqLHL1`9z8jLo?CG
zg>4EWnL355j*&x9{xsdV3+D}qeZ|o(RJ(Yv-49ko9jTi>DVRo`w2Ly&JTqmMwZ4<a
z2Lk}-eu5OL71v`NwlIpk!{i~Elu_@%Ks@`&lvH`|z`h%EFIJJpQ3(bD-vN@L{PkcT
z4(MZkXhEb$?j~2fz>%C61W*iB6a%StrzAEVeNlsvcst>OxB3uZ-GWc00GVtOi!z*g
z>OVQ!ASyw7Lb#*qUe7{Sg$Xr}2#!`&WqYMLht7{xB^G{YK34?q=f4J^q=f3~a(1U#
zdAhrUJ*IRvaBGAZ)~=1H&g64%J<f8ex4;iTPeJ&aI5c^P`UoErr<B?sz(KG%?Ml*B
z_DPd?K=B+|fNYTHg>aEMT5u~MrG$pp$dujyNmJtWjqDVYA2N`H`gt_1nvLR@3siP7
zinu{nlFm2$lW|nlDSiNQV&lYQbu)6Vp~PtPNd%6KXoPP@p*zem%i|BpLe_)I;|vUP
z+=@Xad9o?bT_n{-2(If?%6l)#P%wEFd>sxWGfGWWGc?a+X>Tf%EVXibmc9!PVjI-#
ziM|<b9%u@gJ{x{PEx1bxD}7oil*mjHM-8w6s-;MWwp6chE1<>kZ4=6w1vgx$qYA|e
zo^)hap^8nRkCsre8B&hrt*|Ap;cr;&9R=ahhO}sREU7_4{4QUDxPjtXLI$3~av@n<
zU|KNP5{?pIn=}|lODYGOt#rqX49y?A9B0o-m;I-YYE>`yRu~+(P*AjBp%PsZb22kX
zXhcMw|2|4%s*I*6FdXTow8j@QcA&ygLWuVK<1C0xhJkv!CF~>O49pN5mN3uu7G>6o
zk}qeQ#0y;_sDwD|BLsui({hY>0B5O3s1ezp5d&dxjT;$f3%q<5@3-6oeL$ZnM$+=K
z2HlK4XrBqtU*^@8k)b*TE#>^2x$|w`rlv?_?+lyt4t(FL6w+nWaM<^)-tKzJ_H)v$
z;>W9ovp6H@+x$LiI)5~IeaV46iJ1f-Ubscg=$M0az3!#7{<P-`qn5%YzQYMwBlJM6
z)NU0KIdwwQ>pRfP0&3}q*?a4QL2!5bSC%XE=Dw3QD4zEW)|WnzI~BJcOo@DuF1+j;
zG`&TjRSxfFDrr97#(T$@f@oWfugo@4YIA{}EA->QVN5m~NG+QM=G!fE9I+(loxQ0>
zR2w12to)f=4KT(d|7}Y0*Y@;O`ud3N_L?RnpyAi*JLJtTU#vAt7#ik1dV6KZ$NL+O
z9rc(jqxCPTl8vTRoS+`F(SMn_d)YH&E(OYl*xRA!2z;q@?^)ch7~aILk1?F!lRX5@
z{!o}5Egz>QBUpTjl2wUM$`M<24xr}`L1_b_>EP*~i^7K;E$Y7d7BIROiZ!|;IY6>Z
z3_1hv<EkOxwI)5b?`V$lF&IswI#L!eU0O+Nrj00S;RN+2Q-nS_GbG<#k@_6<iwzFn
z7`}RM1m6YeAl`AqVxr!Aa>-P3?5<#Ed!&F|H7h@XQ|IZMfgv)i5|O>kKOgxDB3+r(
z06s+eTNE&BfBgzPfUz8fLPf-Q{M=4B{RSYg?Xss<5E5$IJS-m*zZ|sooO7h);S0{%
zBMfNIhjaV^sH$*7FP1M7B)JQ?y5>4&Z-G7kmOxj#4+X%OXu5UQD%;GZ)8gaB#9x~$
zZE<vDkI)V4A6LsQI4eJ%4$Cm3s2<utJS4H0K;=YTf~YL+h>pVV$fZ&jLH`8n>(b5V
z$y}@j^UKzXKCDddQNs6~)0@oMyNo<vayIUWZ)X`ZL{Tc+kYrOd$qJBH&+(D@jGl>R
zCCGiX6<HFh+$nm7>R&y|-QKo7-$I6`aKcg)Eb>FJ5pm#GHRUkp>S&MXoqy%&5u2cR
zOWIo}l)3gOz<lB7#s*8{oXMCCtvlIye#hiy<4^z-YnMuS&A|(vdvox};YbLisJ(2S
zGk4hnJ6`>b8+GDQd;V(EGGIyYIs}EyLeTHGK}>-c&T!RNw%`$~-xt8(WE<KWPp+>B
zds<%sCl$PCBxX)}yB#XTvMG3UA5ZCM2X69c@aE15^%>7fz|7!G@Xjf|ky{Y&#)6Cr
z>1^W&0n5J??q@1OJ!aCB8Q^A=VgD9}|7%@m`ywm4MlabwFYkadP5U(Yd%wRFS@1VP
z0ED+nTs0k<$-s)l1avYy`2|6-<x$LXc1E~dmfG(nr+HYOck#8-n|4pCE>fT(W6eKi
zMH><%e87Lon29$wX)8GJVkr*T%7PJ^=|h)$cu*~5ex}_1a?BA<qXFOID2jxH8_wbN
zQ&=qvhPiqM%8e5#nZFJ4M)M$s11B29t}7A)Gh0IWmFrl55f}0ZUfhvB@tb?EZgcq-
z5p%TCakFvF<h-&AUh(0C=p<kG4E6grYwveF6CG#&tAWO2Pd&~iyJxH;NO-@gMQBd6
zUfd*-U&X(I*YNm<qL!L-V%E>ls|aFFCIoLydleZx(X{u%c3c?Z6Ny{iOpYJSJj`cf
zYHZk6<q-${e-aEVq(BuAYz4H`t5?w!OTEEUxG0DU1as6FU0B$7o9G%%=wIXQhCyym
z4%RC^?{span~~=UZen#_+JqmQ++CaTE>JoJ%=)s!%3;V?z2iZ`jD<j~5bH0)rno53
z{MPf93eWzI>Wx<Yf^s*i*KqON%=9jWS)p|cy;;m6DV*g6OX6`peDn%~#Og@xZuTA)
zeMFW6F5TdDEXK=xkAh(<$2vB*?c;*T@B1Ovy_5fQ3ZRD_p~S%F>mcP+dryi8?ACQa
zalON#q*b3NeAOVW*VFi_A!|<HJ9Ts^ST}~hQQQ^i%W33Tb+9Q->U~F-=~x!zk$vKN
zm$l|#eByAL9&;+F4=|ByRCDH%c>dOEkL7Ig=R0+^SOO9-KsjXrP2^5aJN+dn=%e<x
zxaiy65u=h7u>B?fN$_$J-}X`y?wiMCA0J83-u4<x%(5*dXovsK^P8pfw5}y0<PZJ~
zKK$tt89TH~!e}&Lc~M#(ZHmX^?Eaf?O)5kYhM0u&<t&VCSu0Uss5~B?fp;sFjnm1}
zPvsd1Ii6Uxqv8uu?gl!c#Ok>bdvfp}>+A!%GaC`G^kO*`6c+xH=$YR5kh3|*`|VJk
zJ07mh-KbqQki^fe7v`@^u5XPu8G}Fa7{fstvz+nF1U$c5%CM9Ee{#`WY7!$M)&aZ$
z$b4x^;-kzZ`0qQJs9y@t<6O!qqXj~*MK@gV36nt^J;3FsO%Y}lbVA4b`1rG8Xx8nu
zDZIxrxCo|@#kuh=c3cP3YnT88Fy0MT--ALD3wHFaVHgZPYpr>=y14c!s!=KefkdR$
zfa(Z5y49wEg}t+wyl*=DyYsbolpW)&)@1{CoY{ris9%lgX)iC})zhL;Zmz8zGD8{u
zf)-yvITE1%y*{bOW40<;*hXMFVZ48j;T|;s9!SYxOQRqHvh+MY#7-b_k>`b^w3Fe|
zS_+q6cVP12M+qY3T6M>GkvMHo+gx%Yl25TjJzprRup{6+DDu<lV`>ZmQCS?y{o}vv
zu!08p$}=1}B-Kk)jY0F;&^>27Hzmxg3O<f(`g*xwW2FnkR5C&$;&B_QWz@R{OM-*?
zjqbSWvGE!gDuwI7|EmR1_AFxBW*DXYA;c_`D$)&gwB+RzDCa-ZWy5ptehvc1bB)a(
zeHLBn8CLr?7Z^fMnmKF}ZTNw-(Tb%-T$#j5AF1_~En4m~k^Lv^LwF-H^Zwra3z>$~
zjyoidSh&Z{Y`o`=+~C+$<shV0T}umetYsmp{zRegw5}PM({`71rJ}%}jHYyj#BUFY
zbX91;y$lSGK=45^t_J@RqBoL~k|N%Xb?iSn*BDz;6*KnoL|&#sa(R)H+F47qzDuPX
z$q`kI{RA}rAvvC(k?1z#>TUf2$r+z5{4xrr_?Q{?<>z;D(bQQ;gfP4TPYx(tv&Y_{
zWP+hT;4GU3W#N)xlw#q?dplKAV{|_)V6TRpW!r<|xD&a1bW1<|#>lf5b5?40>}S}?
z{4?8sih0XLX*Lq>)W2B1)}Gh^@Toame|9Gi6&`u)XYVeQp~obK#GL_tN~SAo!Fe26
z4G*Rd`?T*uX4}5+>{t^UVf;yEy`|WKng#!Vsak>ajEtR>pXe6WOGGRZ!?qXOhG*bq
zaSo5axZ2<^{J*^4P{AAxneSYIKP1{b-(Rex@OiLrYNPuqFMJafTic7$ok#egez=a~
z>EQ|>XU>i5@176oMuPpc<@;eXvN6*NSqY;3N<9Yq&ztoX%mnBw?e$LPb-D+dO9kaF
zk}xtVuAS7IO{qC&HR7K~xF1jNl)+0bLUoat<)78>?`w*8;gq52Y`lR2=#|YYP4N-D
zcEYpb*>^$6c*Ntzcn>M?UV>CFhPOmgwqB2KHg)f58G_pW|C6rWWCyCMWPr<Nv)I&(
z$OOJza{&unaemRzxunSc(FcXS-wA)P>W<mW$0Sjap6DJuJJpVKEDM*}$cKMJJ8c)K
zTHp)Gpb9&fuW-lIfn1{hC{eQiMK^2a6%h-27u$R!b`IU>17a((W|8>p8iP^tKdI4}
zGO2teJpV|Vsa#Grd~J7y-g|8PSS>+*p1}QWs{@THbeiEpf$sjR{2`-No_->VEDCj#
z-Dg4pKvo6Ck_=TIJDu3_{*9~AB={^$BFUd^<~R4c7-#IIN#oX9Se*U9>i)ExVW#&D
ze#*&-p1~GZv=|km)I@2d^k6djzXtkm%x@`?GyA(R2_;0T(_prDvIyW|(Kr=da?K5X
zPAS%nQ&?!d>mU>i&9L|B=+)OZE$X1!ra=WXC_aKYzC?<pPNfN<387-{?ht{$$*~G$
z?Znd%2!*(DMglmFZK-jLw&M}^<Pl*?i&*@|s?K}M;HCVWS&yaAGckede^^1OmfggB
z*+J4e(ZQfHPQsTeywe6|$qu^N!3_UTU2ho`*S3WVCIojUKw*VLa0(~5y9Kx4?(XjH
z?(PJ4mn68mySu|9x#!&bx<_~Ytx;=_S~B-spUm0z_bKlX1oAx+kq+qM9!VD%NQGPt
z;{$b&KXVXo6L%%^rL4#(wEUO-lpzA%Mx2|6B{m!}9^aO$&p>_Rz>NYoUXm1=fxref
z^XZfEGeHZcE^C1~mi!g8vmBKMkGMFNL9fZMJMi);zSfI11NtS0MLRq?(Azth-W>Xe
zV$|clxXJG`2fG5}O!3k5DiM#$gUb7HgsVtK2(bM^RqX&Io2{>lK#Z;2>zy~y29xn;
zI+@5`OnGYP@|=ACR!R&nT(z><(6ZM?ta}2DyxH%H1ixPHPAP6|FmYtFgk73+O~T07
zaF$W;TD9TsEO-TwHQNJF)|qtgVN^tW1qjs(`LHkA_#dgaXa8Uq>TaH84))K-cg2lC
z4Wl32I5|Kn%Y>yEI&uqA#OFFOp9(QKR_(cSeHTS^Vx90UuSSGXGfs&A?;mrgC+v%=
znyG%5_*LDQU9EOhRh7W7VN0G+*^a;!meB8RT2`NH;Wz#0uJ5i1b2rzFv$Pk@F4Hrz
zEHx0YSPMa1DU+2oN+KA(%uSkT+pXb+opiVEQjcm)Yh<BHT~?m>oy(|UeJJ7^3u~of
z5zSFM2V@USm>o4ca`c5$UdPNzRX&F>)!{pWX00e8D@*8ly&viG3CdLaIg@AW%zyb2
zT5`sW(>cFW-%y~UM%M`By_eul8d>PFzQVPGkbN=G%HAvW<iTnSV0wNVoy46}C3p<~
z^(s9Y=YDlk_Vy<8xHi#8#*s9Au92C+M~&vFp`Nl6Dxu7cl5iM8t=x_rbLcZ>r%^Z9
zjVl3Dzzdgi%PPBML#Y*<cS&AcfmAGI^;KZipG}TnjR-I*`yw|j4d32#fHN?p__lZS
z#8cgOjd>3_)4zrLeb-IF<Fk~SuNUL8NxIfz%_%wOlQl<b$Fy()YvZr`$JnZ0N&YBv
zPMHG^DX*S!C%(e|AM<WWOh^#r7K}~9I=61|2}Pt8CZo=uLo2yOcj(XxYpywj&$LP1
z;l(Ds<=viz^!6n^v6mt5gj^$XFR;axQ|AnrtCC7yL=OqZW^}3Ec+gT&GZh^1UxOZ<
z1Af{NG#!V#lXEN;U!FwGA>ZjySC}Z|TQ+!h7|MIh4oSTCtlYZk8|@5-8^hLnp}To6
zJqUPk>YlS!KMv}%L&?j+)w1GJKAs=$tTftpvhn}<-Udal<hNGom6jS@!;qaKR3mH6
zP~Gl<Tu(};*F5x@wz2g6)h^jH2y(&|krcjJ8|%6grDJs#WcrIua3NKoi)w(76lH6C
zVQ7dVj|*R_enCp;vN|;_|55fwR7P%3QC>Xs;NkHymD7<r$6-2aYtaE@{Zb9UZHQPi
zR<$nYIy>!V3|+`(S<A`z7kOpBiWDp9>Uj|JPaz*qf$gGN(rZ<;7CEUqitIGxy1`0<
z{5h4<H-{FnG0?evXPBi{+d<9T^Q3q#a}&~02(Rp_hW}*EnV4<;?A9v_5TI9lN{W7>
z^F?z%HL2un??g#OAcpXZU&+W|@kpfoia@?NOTOu=;@VkCrLokSkV4k0qoPSxaY|d8
zqz8e<_aKJVhq;Beg^eHB5y~ckS1xE|Eoang=*?bj*xV9VvVzI4Qd@1}TgSXF50pz7
zt>)po>yBr+9d|_xHMfRL1_?BUu0fLnH(qr_4cTYCFu1Ghck(N5lVKi=&I%8aEWKr`
zrhvj`ruexMuW<IU14OE^`(=@v3&>*;mA1pmsg@e1eV3kUZWJV1yRPiaGRRUlGB!#5
z`vE7PpCXgL{2qVW718@FB!3sNa0@E#&^8{aPTa+Rd_zdxBV+ceI$C1A(_<4iOV0c5
z9OoW3aGA*GLN*-k0e`dMhIKS5b(_zEZIsz)Q&)4v*6fM@#tYQuYG|m0{X(yjRZg&O
z=1hZFl=LY=7i|O~uC(>Q>y_s6CLHR{4ryjkrIB`Sra6AL$K$IDTh7~iiMC!N8q~%;
z(}C|jW`3PUBLO+*XFfcvtMT`Dz1tbekaskRyFU<aEIxWPObvk4RM-0N>iu{N`g-Me
z<)!mR1^Z?|a%s)+LgH-SI9ISLrZK_LxVd%crYMJ4cD8|Gh+$==+f#<u=|&$}CeVIw
z0*v5+j4={fH-)$taS)MBqO4smkp4baEIi{<Sz@2otc?z=R?8VSit<PWB_nannceNq
zgd7-Z7NqC!bI$G!?<wp1N6p6Mm)eNbP|2{K^Y7^`o}a>51UmRGAuYbRqwV3o?oAVv
zII>I}=aSoyp*?RRNXDv8dy(N$o0wb4W))c7i#_5370VsySIbL7n@f(GEIfM*fUJoF
zCQUWrc^6*79@R>0K%a|_HEJZTu`jFkU#wMHr2YD<V6+|<5d=|ZPw6K%A3$XIbgt;Y
zglZPWZm&bCK_6zP6S4>V3ba$6AjYdOhB!1&rr=;4xUnUm+NW|9mzWOiiZ;hc&>FN9
z3KAJ!l-sTzZVaQC+JvsuJ3m+a5@p=MM8$yACgE``V76sL)tSNKt|ilUz-Y3|ZZv6L
zCO~S2hED`YAr$Sw=>`do7ojDVL5EQbcc4mAq$Kn3+Y#3f>bnx?4tHX8cz%h|6PO%0
ziUNI>#LT*(cXG|EDC>K?EDzaOgLzxTXT_n5%f%414frFTNL8EnM+GcHlFMY4j@#0s
zz`(#vblh{pp&`@u8kFff%B=>iO7t-7nz?#l1q@Tu>U`-eniF6e=wd&|2!Fl-4jk}o
zjfu3sQMpqWNKN{)<q8eSE^nCC8yq~Q)U|$!^5DWFGRLNOUpwDz73cmYyMIg!X_#n`
z!md<0c%EzR>iWHBJUO_R%hh&+T&x4-%HmqJ1?38@DaW0c)oNC;dW&$)`kpd{HB;dl
z{G}x3mMAI&VWt~Yo#=n$$up)}X87v;GqWBj<E@Xg@roTrIoWM6PkAcwX|g-(BCuJy
zvl~0r=>EWq%i?rdd6f&n>Oe9yS%U#Ht{DEVlgytL4Ij^{Ye43Q*})Gce+#8;yGdiQ
ze7~wO68Hx8LlzfLeh>-X^MZK0BZa6#-a{yeZ@}@583=6iR8gCZtE#{B@+UPLeg&fH
zigMh$R#x<ZWAAj}#3IuE!U@gDFW6Gmz5JGPPBx~WG_egDm3fv-eK>eUQ;TW~v`A>5
z?jSl?KT0{TD00z@7$Y_Wn5!xniP|PlzvPiCg@?U=$)S7z^7CO?H$PJOl3?W9Px5Z9
zz#ORlVkYkN8M)`sTzOjQ2eis^3%i1e_|F;G$qm8CfPcWt2Ic3k<m6EO{q}i8m)(V*
zJIGjAMjN!S0yfuw%btKP6RY(4B$WX!4;C6TYY{twT+Hl8HBJLx^5<W13+%W7DD!5}
zU{{Vrz!Al{?dU0_Xc-q)N_)nWM7qk{;QE}|wLSRK(tOXQ@zR?~KaKQ>Wi6vUZUqfr
zG@<^PNvIB(RiRyQ&lbaaTC0I86SS`uo5H`-7}nYvC*sJ=#O@2nw*9j(r3#!j)6TI3
z!R9eL12aQgrs5nwd)#tcgw76G*?-ytmk%?^Ys#p6@u_6;^kuFLs>d!&G|JWDoSY{d
z6XARb#1Jkd>y=U~WeTWdm%gb<%!g_ZXEl3Q-l<}nOg)EX_DI2y8?=lJEE8x%<=l#u
z-j(u;kVsk7#!~hv8>HyeK!(<1nhVE<UXoc>R0~ItD$4klH%EfN3k5^l=+hM>ZZb%6
z`$)DNCQr*Jt3(DuLQIvmll=~GH`ZK#NSmRNNOQ81d8)U~+S}P}sVH180%pUf1I|5s
z0>omPL8fI$;+o+CbuQdsm?2PEEWZlT#Z=OA<P(TFIMm7(j2G)Dlf&sRbT+2U-<#kW
zab7f)s1hxe#{zzYUey=1uTn5NJ9>Q(02^*LyOwNow}Kh9c*gNslIm(>5Kou1<t3Jf
z7z}*%wyVhOQ{l*6nHa@)+!>y~TdJDJRtJv&ekRU33$i<NkLaDN@WNhRLK^IYa_d=(
zX}g<AVXL`NHvbxjpxP=nH`i%FO6%kdp4aL&IoyClg&SnCR^C-}T*_{|imuP1^<3O&
z)Q|Ctv9{_;p}MB@DD=uAQi_&y*e4?7W7$Gy4KKWkLU&<!<BfF5d(q4y8N1rxpS7B4
zM~3gkj|Jt+5vKLt0)xcrpD0cARG7}e+h23XlAGwe=|N`C*T&)`o$|djjG|Ryx@#zQ
zvAj6($d8O&;d+N7I%9K}Xsi;k*b0267(F-(V}Ug+m?rN{6zK0VC}F!jk;`|!UpoAN
zS)6Z9Ae{)bNl8;MnNgK-%O>qPzW((pQ0|~pk$!P#Ff~9=Jg7tV`$vSkSnNnSu8H}G
zlrhD8x`}w1orUG^v9t{~@;FRisocOGL37j>ty1;M3c0DyxYF{8!_&OtF-Pz(?`rqB
z01$TU`BQcEi`r!OS3F7n@Xn-Bo0@j&#HwhQaQ;qGKWY|4rR|{k*BjyZp+AsfVx<2Z
zA?LHq^HL)knA4Z;P`j3_mR!7c_m$|!7c7;ufh;+St(hH_wmjZ4M+fr<WG#Hw5AXIM
zIM(#z%CpknKd{K6Zu@<zRtHPWLFlU<^cK6u_93dF3d@0fFN{&I&bp?UugOmkqZ6MB
ze`n@m;_%|b&)UN~Of5XxDVdrNjg-xn7!1l%y84aa96wl@ZpGqQ7+4D!3<^s0s3H^;
z8CND{Nyk~t+s~WO^|3+`i(OryFElSOL}{Ce;$D`*NJ)esv_@wj$Q&LgeXmFk^=ELZ
z&?k{ixo|2GuV!{@RLOlOTD~mo`Q_=?27j&~vy%kpuDA;Pg##qZGPnI9bbQU1+~7<#
z&sdaj6Ch=X>hiq;p~^##2B%8F(Gi4hgyx-!>mmeQ9s<$}wg23ZS9=-b3z8Y|_+78d
zz0@G=@QI;OIL!RsLXm}M^J!6_%ajhLmlgsX+!%y+JSV3f)N5k<$~!NKR)~3Hlm2pz
zQCz0uM=8S=!E`W}sR>Yr@9Jwk^QPn0jW^TSSh<G<Gqz$9;R2|wMLKFlY&`abeJ;&o
zvi^qEn<gz|z)-Fo=LLavdD>q*I6!oMEF_r8?e|Nyo^?XW;z0NEB-(Sy?1!DK@hrZ9
z8{F~vL%?cx<k+VTa>`K-lb;OHW=08ANxJnQw?i3X#_G7;pYhnfPtOc9{j9FHM4x5m
zY6jovZS_G0i}Z7D->fYN75ao-ZT4xO!mF(y&D7?Ta!P>@A=di->@k_Q-zB3-?UYk4
z#Tb-%%oOL_c0}kR(djYYa3<?i{IHj9*76?oM!G!gJHks|RTZLiu`?Qkaw3FF;2xp}
zdhLEnR|9Bzb<6!s%mcrEIsW{Th>@`sZJ+>5QK4djQ=9N#00L|Vs(uPuk}U~uiA$OW
z-dy4sY=BI~pUsQQYF|Uo%#i-D0Ww(*4((b;-I{uny8BN=4oSZ*LG@Ir=G$6Bm1=Q2
zg7o>+cxPS3BAmd3Fw%Q=AFz@5_VeRs=|r@d=&1rSUGk1Ma{}A&OmXy6#TwlgD#i+T
zMuLrs#T?D0CHmVLl;B6*k1U!EI}c^1z2%2Wh|C?s=p(>kI#t#)MXH(pzIEdF6hL@5
zh|@zT%^9~=;zuVGC!uXqRt~+7O8il7gs@8_5bvI)ubKQSxmQ$cuw?b8yc~M=buOsm
zFLyWzd$^yM<`!ZSh;hs@Dl<-A=q3iba@tqswYzS!qe2alqOG9j7NXoW?!{DKQ4(RR
z={_}fFCq%q$+tkHaq`eOHS{dVnQqnc2Yf|uV+&@6I!4p`0{E_`JQ?CH;T*ZJHkfQ*
zU0B$jVsq)oD$r*TUQZ3k<c??l)*IZ#7*j6g5<CmsLt_{ASif<ekggb6tBs!BvS(yn
zG__86Rtg^+*E}0Um9kS;wzY^@Esk7gN2t-&y!f*YkF9*@vCIuE8hH)@XBFd>LWg62
z3Kr47mv2W0;#0D^k46@_OI3vaM*6z)*xS3{J1V6RDF4VumGOH`)WA`kA||2?8?Ztf
zWHe`KtQ6AgYI1EN$ci1@y3~B&A$_ueF^!%{)&jJ<4(wE?oTSAc>=<7gcIv~UNu@e+
zfb2lA$AsHE(_!aT6{ky7TpLO4Rbnp!+hcz(|JH~#Yk!VLi-!75K%(a?5xIMPoCEPk
zyWk=uVsnPfSHSUgLvSVlfyhd1u6Ea7ibaE*hp7gQK*Ulq+i}5OJ_USgz|gc_)DsL~
zVZ+pe=%H?MwMFiRh{B>_T27mlRyHk6?!Ko{jsQv&1QMmYb<3`dezviMLtLx>mLF%o
z5Y%(8Lo2;(aBQYy(LN(bD<xB{BA`>8x;J5SPlLv!5G&neo5Cq+Zs|2X&@UK?=8GK_
zQMK`<3`E2g2vO(hV$sP<;zx=91Y0A6w#UjKZEYw;!1g@j44+PI2&{mcowON^X+brK
zSe4OZl1?3%V3`#J6Z6nMk$ez_X3b=h9x$W;;Q#J4B0_jSA5qNjF!OMC^8cUul$c_O
zYe1(9%Sqb~@yiPol(q|ANb1tKV=5^D(y2595GlQDoxy4&1Era*{!zi4;jp0aoTTCG
zH1dLuD=PDVl;YRVB50gnEc#Nne9xD8oMhpi7<TE3>u$Py$I|5*iNUyBMDa8X_KVQq
zaRlY5(#|vzkGN(%R~DX=B`DS-iX1cJCGm_2-;&P7V#^&9E&C=h@kP{NMqRqd-j~l#
z`s3><jII8bWCq}?k@N9$l>JrWGcDN!Ld2EsdANrd8OAJ-{vcYh-u;J{PbTwQ&N5M!
z><b{$WO!{$3ixSdza$MrmUM6sPi)KvNE}8j8;Iy-DDy?&9CXZ2qqKT<SKt=)_zu>S
z_7yGb$93HpJ0E;NFDbix5FYv)ut;MT(PlO3bXqyGW8<|}YzSw=T9rkh=E0PjR6=i0
z^)?5ZYy`~=BKdR8Y%wiKVlbW=r)80iMQ(=;BO@yi@{@^qIjP<imKjPoY5c%Bm+l>L
zg%8Ffz2-nn9=Eec``$O`(btyrx^KsI!{CW9G+C>^7K4*aA{2|x-7nR4_tWN#JLrz2
zpin0a2TfmTto_4ic2Q<KY;KjLdj`bD*=hhrG&}X@*cI3&E6RH+<rQHbd82Y!$<Qac
z7dEG;g`;g>T`X)V=#5hAh383{lRfv+t1a+^KG|qxsyuSrI@7(~vgaqmL`DY&c=vOn
zKUux&3>`^8zjt&+*_@jsIhx>;+EufVZgv9Zxwc%9XKb=`e#OiDCTvB6%34*0ImFpc
zR|`N|*!sc$ZKJ~MBd2#@W`3hb2vP$!`h$Qgflrop#Q2-uy_R1a+|osF(2|uo&*9@E
zXkkO;LC)Dv6%Q{RU`?Je(i1Cwq~oS_lQO<L9+8+wprWT+E^Ks3pKK}qEXb;wwPEX;
z6UTz;6DNl43Osis!%D}05wgIXX0%8gPOP)3EfM~iMdUN82K#P$l=*EJtiol$*WaGP
za$jglPBRgmS<yVkNr8T)&{Bi@?tlImgGU%)7bSX9i#RfUm+pM1ReRAX{GyAdP{gR2
z{~;}cZE(1VR%nsjUO@L`kWKs+6vPblfFbuh)YI)u61!&S1Uga_xl;%u=BYk+!jN{C
z`J0ef{FXuXOg~8=&8+qetk$)i4O*mUrQPcPt;f9g`M1OQ-7Wy|&}#n4E+x@gev{Ub
zc8C0F)S#t)sLvGKU}C$^rreViu~tK{sphR0S`8|k+R8a_fuCKE1}z$!`Mr&~fs)K*
zvOf+Pou2$}k4cLZR&j$h31#a_Y_jrnIQ@VaOy8#q#EQYj;w&y{>1YFs=^5M7Fc4eS
z4!e@^SCy%AY>UZszy9gv&zolV?aZug9a1n`(F$U*%)Lj>(uLzHY|6vd9GpQOH7d#5
z+)_tWfxpSkYL6{NHwVqqmKX=TL(t<8q!|Z0MNY}m?Cu+%sW+^RN;9N9)eA)^zg9?r
z>wo+xMFpbMl1RzqBl-a&OgWVnQ`jq#FIhFBS{BfN$$VSI7UF25M)p;_!T?Q;CVV25
z%vt@eFd|$JluV)cs8>@ck7kgJ#+>UoJq?D2WX3{xip#mOqdtFbae$a+(j>i_ZEE`7
zVnKxJ*VsS@v-Ik7xQFiVnL%ep7WWAD%|0@~Ec(2>mC~bj#vDE0hH+MkU=w>w=-`3C
zQJ_cG7a>0-BLef1u%|)6=;228O+5*Z@?rfeDabv|+8utm1}!3;1nI=7Y$JVr<2XN?
zOvJwo!a|YX2sLZjL9uf2^C0Jzcwsg}rllIXGqFaDl80epAS4ZsOWIFvxs|Q;wBqJ;
zl-<S6js;YF4b?1aPVBncBeO#{Pv3@{V*3H6g4l7B*$$Eew6qz;HM15id?SnUvC>Gt
zCnMS^E2TsIO%s}ja`BhV)J487s?Baq-S6GlViu#~YMfih6^g`Q?`_hWkRNm&IIBL0
z8Qid57UBfal%oDayr}VJTY@c`>FVT$loEB_PKmU`zem*G<}XS|Ax+}%tj8aQ#!?6z
z{GtiN=!R@yIu0Pt$##$qpi4^7B?y>+{i6Z=LrePbIuPm9mlU+%px;bef#csWihdT}
zt1SlI43AWM>XEyWBNv;1cjOf(tWioP6G!>KTO6pse4Ux6Q_6fiS#z13Pw%W}W;OWz
z^`smv5$b@Ye+bXg&<{Zg<lkcFt4kfij=;g{1H5PY{Ez~-iZP{84FNMfAp?Sn5*AXb
zBlS!ZzwmAuGj1#tr15JNS(7q;?7C8!V*c|#14F$dT(~AFqeOD$@R9JaH@0;Fj@0>&
z$oor;NXyG?<@LKGc#^D`WaQZ>LUc91udIAOL&cy}KN>1bll+|oQzW1FKD4>T#fMO;
zv-&dBGtQ#Jz3@y);&_|PhcPj7@y*PC0mA60!!%kaCsxsegR-h`Qy>T<!)&>>NP7|m
zGBpQldf)wMwm)Jl?{``2_&GA0^}1|3DL!VN+I-tPI<?zke;_Hy&(B{+=Q-8`?jHj4
z-bJ~Tgm#PmzDRpwv0vxM4_u#*JQX6GSvc?=7wO*JJcAo=_%I9!axLNl3?4B|ZBN`G
zhMu#y#-RHB`2{BSlH8?1999VMgW`c^EG3x#td+OFcRyZ+2Zy|T<+tQ->FMbdb|!8X
zm<pa3Zm*I+f<NVyN|J!e$!sv+5a+b?*74lH4Y&t@yjVhNOh7vy880CIN04Z4>Ac<8
zCa`+IufRWe%S5}AYL<i+?ce?2Z2<nIlziUFPl__Onnj?1O2pp2?%R)vIuiw&3kurV
zg_!v_KZVjcQAY&>thy`~f^Mnf>~C?igg02nPsdo>rpp_4cN*89-8tEXC-<6l*{-Gl
zePm|qAXhj@@W8FoLWcB&B;<!-cM|N(EE21T#Ftb;&k=q7NR_ZzP3~xW3K3R~#;;9!
zk6d-vl)^Rx*!dXO-d;US^Bosp%!n2fha1iN^Q%~l&F}^j5;o2Yu=)w$*(>EV#)-8M
zr1&H2>kDvH2b>>15EO_B@+qQU7DrXTHF8JaxMJX`fqZ+nXPTb6-AO83z>H`=z>=ag
zZn_tnu1548i|=QqYh0{|@p#2kme2hRCP@AxVE(&>%=x;27wh{NEP0|mXT3eQW@1oJ
z_J1Wvq0Ti0XtVK3%eN#P!(LrkR_21(1a&3$e&PHJcr9%as~M3xW5+2&dBk-YEp&a=
z?-lb-dJ_~Yz(&6w1gBnM)>?8^qg-aoLEFRjZ`jogIq(FGz61%lI3t8Ii!<Xt!K4my
z2aQKX=1DF<aqmS0aQV0$dJE@a<|#dv&A&df$M+(1pv~ppd2Gyg5QTB<!tBM;%(vcu
z{(0PzvlMhSo|^7H3V8gVVkw75L4o136K!Td57JqGNmGlMM5S!m#K|FO)23XEdqzd|
zho~U--%U=4Tzm(uI7~!LNXT1upwk(NgYfQNVUi^W@PAu}zxFC8MIFNvoGj@b^5b@I
zU4hs$JQ;VJrNEolpNw88>Q2F5{FU?Wm6zU5CdBh5c7NjeFyccVEqw?%5^^J&a?b<K
zq82ptd-mKaEy&*rSVsaCAcE}1h2NpknTwF>Xad1HqXB=Ko23mUGOukZUI+l<A4=wD
zd@bOtRLAg3SLC^`jrs|~3N;Jk_xP)@IgD?CQ$I<LK{Wa)`xEu(AjH1Fu3ft>*YDp$
zYmHJZ%5{IOsvK%fKW%z0n_~a@(NnZ{uhv~EA-~+4#YLH|+Rnsh^)&mM&{WR*@;eX`
zyYu^8Ik)k24brof7mUC_|N79eQ})Ib?A>3JV}!5t$+}Qh@h^vR0sL#Oz&83AL>^*G
z<O^DU<&tqKk`I+CkwK@EiQdZ#aHk$igr-cKO{qUThU&nHb^8SY+*NZLqMs5W=$E|J
zHc@ammXwHD&x%Thg--)oxF70`zJKqx$1^CB|2OQsuLvLb7gvtj9~5S+;iROb0l^|a
z5wiXiiB%w_gcJGMp9qaJkBzw4g=yrB;0~>2^AxRC?6XV_J(>!hA5b-rqLf7}=7`(I
zJtNA44O#S2Ca*cFy;3!Rpv^aR4LK(_@&$}j>(DQP>1lne;Ei|H0FX-39z`=2xE{6l
zFoWjx<sReKL%3TVGh*7<iTTI_>LEflgO&*Ta8`0Jz4U+f!$)Q;+oXnb%kp3MCf}I<
zV?dlFWDWf1TG(va^X&x=cAQIQZz@*iJ-KT4C}noo1pc$_kfBw=yoDm5IKyraF>*<<
z1J#fy8~YZ17*Q|kT0n8;;d9u}FE&)s6^Zd(Bhhv5Tm&?oF)j9i7~{!<HisI2MT?xB
zq)7?BUmSboq$BZQF<=pY4<2mW#*=pXt*oBq43@9#ml7fPw;?yTt_`ftn|Z>q+KcXn
z?S674ei{cL7nLA8{3g?g@rd|lfwi^2IJeIEq7eR^4=!|26yv!A`}3E0u{ovu98bs=
z+Me!uPZ1&Y9B-lcU)$Z4Fs<RZ{YUv*|J;{+i_Z_pq~Fz95XtFQ0~@9eM+fsnE<qL|
z&b)fXJ2!Njg{EO*8l-<C3^>>ghL1Q?lA1Un8A9lvvN5aj3lb;s)dDCF)#DTyr@VWt
zo&GPSIc%6Fle+oByH5A#ttjZ|io_0_<6T-`ZIKb<F*OA`m?d0q`78CL2GHh)=miV@
z+4?$QK1yZZh*=vwGaHruKSdW=>S6ZdBtP2-c&qjZ{GbAUQN^Pdw4NaVLQA<P-{Ho5
z&dEwsF(?W26qWZkl1ZP?%ip21Z;@pc`o4Q4h=cIu2m6U^>Ujdhe_rTXX}|0hRErE7
zz6nD+j$e!pPBGSW-p>*#)$=GIln6nj-eh^ZEgqu2DFr`LAy%w~{%~<fmMtXerg)@6
zE*^xYKcGj1Es<HNPj#Lyk`C)w27oznP}h_g*jbP!QN}l{^{W({F>pVP+-Pag{4;?F
z*dI5f=A(_OLOrq$w^VI*F2l|FI7)-_nk4@X<08DsNJ|W6<I2pr<v)m5>~lIv^LJF@
zG<h<jaF~a3ul}7b%y(<Vt6rF1Y!T-U*~AXQLULS?dAr|%7d#|`#=pUl_&v8OCSE_v
zRfRx_q+G?vkfIwaUn(zg@bNKL_~(g-e?~gQd{eXVs4inlT{vQF6Gq3_B58lmqW&gd
z?>ZP36y&}<mWj%(27J)8qyA1ZcSK=iD`n~*iOU~}jr!;JF)TNRK>#&4C^z^*_#a=I
zsX#2zUO~wJJuuTOU<rn_6(@)xx8*{-AMc=8bh58F=UX00sD8<@_Wu%a8p0b+JqDo9
zsD0xUR{>o*aETXvpqq~sHM(PAwh;`AemxIg2nl8uR)uV2c^RKMMZXo=HLVv8oz=S-
zE&k&EFw7%bmh-G0>DidGrs*-kKK{v8iCz2$9kKfy58LNBWrjP)jI1v5w<G^p{*{v9
zRA0S&msbwKln*Okv$4pyZ0Qy!KL#B3z(H$v-~?4&K75!9E8s8~tzfXfbiPK~*4MX<
zCj)dXVk}t`y}2UmSK?W(#Y0WB8W6Khs7gF2BkFDaL|{viTPU?KHWRv5exKiJ$oF|E
z=PRN8HH6{4IPE9}wR7Tzp?i5RE*A8OJwY0{Ni=*Zxe`*x|L#QE4ertsKu&H93x-Nc
z>IO9tK(h7e^1Rmoz;@{AytfH}RR!^L=${{Rp+v1g01z~zs%8ykKi9#F1A$Hvu8=aB
zPZ$z+WC9|f{qt?RvWrnxk*-1PR16nA_>{*F=}sQuPDp!Q+}mPpxBEJMo|mkZsq0{c
zNAbO0>um4|Z(&HQ?BM`s!tLQkddqc6_iE6^BZ!h(=(0OO<=z7f?|whDA<t;@07fkM
z;gQhR44jF2R|)-3hJFa|<0`<lJyNJU^vlEMp_d#v!xSk?&TPDD_-_7UCh<r*8Uk-+
z_fKxsz~MJ->%_(e*;R6E1$euq&c~#vTf4bgi(npmJ-@mN<gi6SJig`~gwdNA8iOMZ
zGSVFj&7f%62sDDqLRrfbIU9&CT!y)<rO>#4P!iMv#`&*6!{48p6yNm;Y*hH`5wmWa
zyFrND4T5ES?ebH=A)@4i6cJ%<YAV{8oSd`S2<7x$n+Na26R3Gh9xc~h^I#BOwL|st
zXae*{obv4r8fKS75pRcn*FQ_~>s5E|h30KlRUiLi!TFO*t?TO*65w^|V<XQ4Iu3h0
zKaE26_W03!GXogy3y(05*w)4*0v>)=kR#1-I*^+0wxgM?jtIVAajlN>$2#6?LIaY~
zi|<6OodU^AgG88*<OZ0V5RABlmHXmMg}8{l%ckZv7dsM<e^S@m>D>9~3g!Lnhyh!L
zY2edZvhQU9Tn$Y>3ZLJAo_Qyx?9U<JB&-mNve}J&r4_>p=>4!DZPSR|%*yDZ<K9vO
zFQUbBV;w33EH1>e$l+dPxJIG?R^DcwQ<oifXN%M@htFXyTg%ogFxED*JxerLP@d``
z?H8o7b!q?6$it50q`|eVT%p_^F&<0AH*A@8(zSZ8CO;3+gLA~AnMCIix|4RyJ7QD)
zPq<%n<r4Z=x&IXH_4Mg8>OQ2=;ur0XM)1A63}GE@ulr$wfiR2E7?)$#=h$(iw<$9&
z#wE4=uw}Rm5uQjnCknabxR7MFY_m8fmGcKJ^vAT*q!u|ZNkF{cTIWJ&6D&&(pWLB|
z|7*1G>lE46>8~t3v$mVXPcFn9*W=W%>QP1}F#NX{FTpqtbe4AuK4mP$=FIU>!iIa$
zP@4nZp8&@{qZ2fp{m!Dv&QK$>;&%y=lEwye$}7k<#30CnMKV^NgnGezI0Uj+k&zsF
zWZ2F{WZ*q^vA16i!ZL|a*f^ZZP!6K4<#`V>e21L0`3y^l+e9iv-WWFKYo94FWV<Q?
zz(jT<`ZhKln><d1;hW!xk5%Xa?2djDM}ErVu5<Y5V)V1X;^@{pgZF-Zt=LQTDFLkn
zF5qHz9lk96iMj0CNts=%+VUUoV)ma_-RnZqeT`QMJh)?i=%WG^6synJpn8j>1QwUF
zh%#A9mY$FT^zI>n=$XcgRdlsIyLqy+ICxo}h_w!J)gVS(oFK>j>&Lq$;$2Gs_aMfk
zRI@p51I=QTd<5Pz!OEvOzpZKmH{i<jiO!k1RsN1FP-i&_n${g|NqaTm`yR4=+6#tj
z9}?d@!#dxhAgQW5BYw)ANARrM?WSZdWM!{cZ}2)nwdJrOlVP-cpCGB8<P+gMo{XS%
zHNeJXWW2H&U{t#}=|Y!OO{s)nP{iQe<iXsbUJY+zVB6%78J<LT-CHo$>&$x&SJ(R(
z09W1Cg^f4R9xiek)!hcdqRO0Z_S#_xLa}^<=1+ZzkWyBZWo}2~P8h5Kra}wirh*Y*
zk$5$Nb1Hyj8}NdZi{SeUAk<@eXpo5{Uw75Z#}s?p$L!l&#!lF3ubU>~Isp}sk=|o9
zG7MHmWV&KUq9uf1PR4Dw6|YAhF$l&avd!X+U&h0n_4i4?z`vlq-JbY&;Yn0)0;;gt
zah|SyqI$*OH7r75DY-W{o!V0#?0kK8U&xrFy7ugx2vv6?PZidBc+)3lO<J^J!Eerd
z(($xW4yyguGW3G|!FwtRKQgdajsqT0(ws<igwI&!@xAz#V1!yHoXuVZWaINUpHC6)
zJ+zMzNYr<?K8>}(|J=wuYovn1cELZt0FvqWIww~uM3l9DBV^vkZWHRP;7@^L-t+2>
z6;MsgNW|#acTg75$A9a|cPtn^_0QFPf9Gb;A{Vpv`Nj89K)Zd~z+=_hhht}ZdZi%2
zNS^8~jV8E2s;%EkotW~t*DB6Dgm7X<L&CU}HWzNWU6dFKr{ljZs2JL)H7JV7+zb+4
zy%zNRbP?U#v4id(4uDl2WGtT1vNmx|l`bkMVzd-?K!qWfcVL}a))WnX`#`hE2IR<6
zJh^xS%2^T6g)RCh-WhEiU0~A!-aeIVkxweT3JaPA<{6~r1wRmdVvIsDUaW-y47>#k
zKN9`aWTrTuNE2XY7v;9`7lmRi6t+}k(-@!;4(2TBA-*HL_${>hy^;oX@d0cxfpBBc
zgJRcgsDZ$P0z$y@$Y0uM(^{SE2ll$D3;XM6voB_e=lM;JPmFN(`Fh&C3)O;ev#{SY
z99A@E6J9E1g7Fc4z{%6|ess-%^@w?pFoSNeGUfQ;t@OF&BzROCa_&*ma!h96)w<9~
zyzB`!ITBFZ?1`=`z^_P_g*3Si5-ZyHKD#n>Fh+03nTiBjy|NFuKYBV2c>37KSNBS}
z6H;WOc4YJsT{E<cbk1#jK(mk(|35Z{B{4Yp%G{>L#@mpV?H1Df?wNgwb60CBd`HfJ
z;;=nyGDd71A*SWokh;%@7tWP&_}^>?9NIRe;=3HlHKsg>rUaJ~n_S)T<m=v*IO!aY
z_yPL-L{{)qFR?D!E>rG;R&+kU%{~ku$>}W_5p3iZV&J>(P&Q>`&)Doxi3f|aO{#>^
zTJ}A&{)iS%B{5K#%;vgc9xxc|z6{PaGwYw`9DW$=bE5j;fZ6+FO4h%a|DqfBDF#;i
z`e{v)>+2VM0yI9B60ex%ys6|O`f_`;j>lG_$0wCQId|&!R97X4mm7#bt@}iFZu&ha
z7KlZ`o#En^^HNXO()osxN^LN{{l_d3wojR&co+ZJ%D>+ZA6vrvN$LTF(Hh8TS8CEb
z17jhnPq5dQahbixupJO$of9F4_vg+^Iet>&Go;0aqN@!1VUMBdi0Py<8w(=k-4Z{-
znF3&xA5;!bUrg$VU65mcVGU?SL1Vzp;8!CQVuHml>J$Q|Va3~fEa;|dvEeC)E0_#{
z6^F=2zh!GpQ*bbUQm0);?35-lcE5|-XS`=Je>0!DVKTS98ef;A(_BSNOhD&X7nUx-
zL8z~ytNKY2r&PGppF0}NUuXV>!`?}F%XzUnua-eyUc`RbB=UafbH%K01vNI5vW`vh
zMWMiG!EUK?UGF|?Q8x7hS?N{OMp6{(=HvwNP}&5Xg}})~fy7rtubBLmzR&V08i+K<
zToBVb5ThDA58aC9j$Fc-dMQjTQZ5L2i<4?OQ_4<p?5A1h2FXq(5Q`0FevVGu5l~M-
zn_F42#xMW4LApiJgwqN}zL(Nzgkah!=&Shw6kZ;QVs}GksjJvJ$<8I&A|&cOnVZ6Y
zU|qepUlKbwJGnxW6`nDLWy*FCAfgoK@^3d1*3pn9rT}hMO&OXniY{&7e~<wK@tI9t
z0@0LcQKi^Qk}Iz4F*$BdeA|f4qDx<z3y7YbQ3tL~VUjvghm(4tL1cJ(S^aEh-1m=z
zeoc$#ZQ&MLkegudVXBK6?1nr&(Ngjw8YVHtse?bQ2EyGi+(Zk?3bxV{%GWYFmeFHB
zDJwdXPDK1*z^LXRu<IS9x*{WQY$b}~@YgsRS(Y92^ueRMnV5aro5Z7Nw98Z6q#TkW
zp5$9fw;Mw_2gy=(Rg$aSBF$QQhmz?{lp27?<~ayExvY!UnVtxr9j^oUUw(1~*8w`N
zFo6bZh)vgNA)Jq_!ab|>G~AQ=0YnT1tQ_!Xk`{-KByMk`=hjU9_}kW(Nd8=$U}8_6
zT_Fx>a*LaYO*pqw4ltB4k;W|9Rky=fwA|x`${#Mr1i#k>MLN?nQ%kZXEP_t`cDo~}
zfm)KZXiC7`@9yJotGA-9$bPZE!-8$_{N0v}*7=#2u4jU|@n9NPd&m1F))*kTD_HL)
zjtsWX50-IHoZa(dt(MXT@H}Ez$|;^-U(J7Ka^s$TA*?{Y>bbTCNFVw0<w0)TUiY#Y
zW<M%3pG9i%i5F&^AI{>Q*wGR$#>ROUA`g1G$f&;^J9TvNh~YFnu=r|P0!9I^Sh%bK
zdDW_f?##n%ZXJM?z*|1=%p%Hk+`NEJH2qY@ORpNgNikpxPJBXQkC=&lxqE@rXV4~H
zUr(pHj3%zFll|$$N6D)C7{<a!(q97nvD6hHsA7e<n58x}H3jrgN$lWAi)GQgY3P+e
z2;vR;wDR}X3f`d(x@Rj8M0h7L>CrhEZYf3*_9kaY<f&i|943*qi+NV8bo{Y3$6=1x
zMb>0~8J<Jtb2&`DTrNba#R>|(<>lX*kEZ#`Fi7^umpw(8w#kc3NAdzsVnUG`Bi!(}
zJbKO%Om^&X2>#lXy)b-Sb1$L=7WD94>z909t{ii!o#_zGRYSXF-jJ~2Is|SJJfpUw
zP!zngQ*!p-eP*hguz=@BWbPU4(*YJ~lWxcK7dH~u-;Wr4B@nU(hCmU6>gIS6!od@S
z<@Ril1%LB)`U4lO4I3dP#k9>HVW$;@Fw5OLT*@};e)XyLnnV=u1?qdot01|%-^qm9
z60)W>%3h~4!mR>Nk4G3l>=U0SB)hKtiph5L!LDmeFG&9@e{j>#3{I{Fwy4GxEF(0U
z<~PJdV1Bs=K2}z8kQ>%Wo>VqEyPFYkKNfN{!a;u*IwpG?b|lIkZ)5cY;ktf*tJ~n$
z(AXBE2ET^&23U!4aIoM2#n3Wp1l(iMcJ7qfdBmJbcp3xL+u(I5K%)v@#qVs3ou(D1
z#HL`M{X{DK#x~%K3xVgu!=}S49)<uB)6}rQ#pf3lH^G-SRJGT_q|1A7ia@TYg(zo!
zG5w>etl>T(Hg%pOM&`q>C~^G8y`+Pp5GL%S7WWV}`C9TX4|tvgApEISY~hX4J~+h`
zw%5U^;7&E~p-<%W&cD^2jlfexzIla?6d`S1Dkz-aF7=CYR>Q9is{NQ{9)i;j0`W!Z
zJ+^wtrl<LY*<4UqQ;}K(z<(rr5=u?0j{D4DLy_vy{>khWFYIEhGw=y6*80Jg3k-7E
zuWp69W&;dO=Q8i$g1!*(oS0R{x04GFtJkw96^+A4ruADdy@N9t<`-zv!4;BYl@4sQ
zqPAdm;%#(Cw~y+c3nfnbH^O%e3L9^GWh$u^4JvyNBb}S$y?GZLDMB;(K2(t_emgl>
z^@|w2x09)eJ^MaV8(Q?JbR9hMcW6WNL1&m2M8_4~(tm4PSd#u_CvjAGaYgFQg$dgH
zEjqKRnB(iz$Ru!QE<bE$y29EBlZcMW(ICaHeG)2N{!FPrQ=wdfT8P`a2%eKcY$ecj
zKM#IPLs2fTd9wkG)JSo&0)BlpN2<l04{Z<3!UF)N^ZAGx1XHsR(X<BMcAf<h%MIOu
zby!s6`=gZ3<xcpHR@wU%)Gl>3zjXFi!<pe%MS)(}x(&rh)QZ=9fA9;;Kc}U-p*1(X
z9(wtpyqpk^K_3U2y1cJ@d@)q0xs*8DINV3(Yd9yjel#ar_VG{r^2O{cT?RU;d;---
zx~<ml<IzDEZJkUedOu~;<NWQQoHoM8KP!5C?Mrw^vUoEH$3KAZ9efr1%&yZ6BQCt~
zkDb8U(qco;nEJ%(5G+xJg8rI2yJ&)WUu<aGA-XHdh#utQ$Do}uphRIF7|TZ*xJl|N
zA88jc{>7qj|6ozw4?EZUw~x-MU*T!f_(KE!hh=>wBn%euNDeSP_Va}vM6WVyCV%fi
zgC+s$q5dy(nI`ydMoI&(?$G=?KZ7lG;xJ4hjq(4&#5(?tlM-TjIH+hf7Mhx<Q22kN
z;4;v`){APH5skKX<MHmara+8<usAfx))r$CMd9Hd$N^10o{crRUrb+8%c#LuZ_fqE
z3TCkWRO5SRINwpbod*+P!S%}6R0c0Lkd-_Gj)N^MB!=yy6A_rt8zdMUg>PA`UeGHp
zZ?GIJ_#r#k=0$cQ`B31NzWEV0_W?VziH41o34g4`T-fA4kl{Nt|E~SJsD{*UeHWyi
z$k$D0>^roNo7A4H!V5&*I+StM-dzPqo++wjra(C8_DV%rj>HEu{`2c`dX(a&mD(Jg
zLXPlYh$LAxCd^n<zV4a@5R-&S?zp2OTyZYyzqq3#_#whYG;3NQ5#3$?4pJ7ceJQuQ
za0Oo{*_z&<vU=U1xi;EY63hPwAQX-`_V@=78b?{X*3^Dm5xqJ_;^DC>CdS(6l18#m
zr^k$VZj-fj#=I?`ciHl>ywq9#x(7Gp1qe}aM@=uMT<oletuzZ-SCNE1b=CvMYPkZE
z#A0-?t|?r(Z<yV;Qz#<WqBJ<nG&l~_3$1<HbNvy)S~o;jOtZL3_^~sdh@2+a6G|n-
zWfK#%^ejR`|L(g#OsX{#^fazQ7{>-V;64vMBhv-)RnsWPNfbQtwQVNYUQ|HoFC<V^
zsC(yI!)E({e~mvS;l<SgW=VtI^t>Qy?)ku=Ve<MlaJi~G1){g+pk8(8^c7Z(wf>dx
z2DeMeo}Zkf05c80C#x!|ud)+#4ikTmi>J%;%o?8RS%n}{zxMn3pmJuM$l660N)8=6
zAU0X$F`MkWp=C!_F6964Rou;w9LKGM#|ZvKl6~V?uE33_2T>~eMxXy&_at1vB%<*;
zuu2`<*DLWNU|q;rh%>5`H2DqPQEG`BfI+`7GlX432{hWvzM7{PK|e3wZcI*~!-mXc
zGrQt_uM%BE0Kp=4gk&5cDcWut-_UU(2>psDBg<o^Y<{H10>S<lElz#EdKO}yI3K5V
zm4)DmhiYVB>&r-U{M39e*}3)xJ(9p^e95x0o-U+68_mZDm7@gRp2WBK9D*1x5s2h^
zUxc74#ZF_-Z<J`Pzpf{_%{Qhu1c$c44-ouw0Z7se6sDQ;EJ7=tO8@SEs4TI=e7(9(
zfv!ZB;w>nt4Wf~ei};5WT{eZDCfFph6Y28rhYoea%aP#BehUvU#=AqOEjSaoFYkcv
z9AI3BU{7z26zVG6dawE6|JL=MSGuA#qnEj!#H0RFDEP}aJ#MNInRXKXLZeBQN2p1O
zez+FcGISgQl?umsd@d0}8!u0QtJI?KUbccxWme|pK<TfvAz*fF5BCon2E~#be^dAV
z&h^hhI$z_@&O}CHkLTXaQEtVX=dr?q4ZGXyN-X&NeEk+(v(Bl%wq8`i|DF^38V2UJ
zHnQr6P+OlL3FMD8!K@)j(QdMOhGEK7_EfJb%f`k9PuimuwUmx-9y^tdAJxo!j!pBw
z%(ag%6klLB2CS^|uKfq6nXQ8UubkpN@BZ*nm6taTayMj1jwWpaicWXwY|m^ZY12@7
zOj$MMv%ElxgjIvprmGLHfbcr4wigMt<>p2n5t7!mCgHd@axpnh6r}&Wlw-nJoJw&?
z&2s_kLMxSqG+Al1NEUD2N|vtKF%5Gi6|c<+Duiz!cjS}r!5*oTzoyNXTk~aKg@bym
z?;Z*(R^C`Y)|5jD@er(c1(V*wpqY6i2EA-j`;z~6`pgJrZ<;36^`5_@|2L4m2T9<&
zzGE6VpG*1Q1MobDQVj=d`l3C^8?OBix$%dbP~+z{<}!sbo(TUhSq=^spUFf+qqP1X
w?)+bx;~O$EPL!IDD)XN({LdTX1M&G=C^Zh4_#%tYhxd<|khEYWzmD(!0UvcBfdBvi

literal 0
HcmV?d00001