From nobody Sun Aug 2 00:51:18 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE5963A0AB6 for ; Sun, 2 Aug 2020 00:51:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.197 X-Spam-Level: X-Spam-Status: No, score=-0.197 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=h5Gg0wHB; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=DClvAUIJ Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fqrL2XxTYW-o for ; Sun, 2 Aug 2020 00:51:14 -0700 (PDT) Received: from out3-smtp.messagingengine.com (out3-smtp.messagingengine.com [66.111.4.27]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A25E3A07CE for ; Sun, 2 Aug 2020 00:51:14 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 4C71B5C0082 for ; Sun, 2 Aug 2020 03:32:44 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Sun, 02 Aug 2020 03:32:44 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:from:to:subject:message-id:date; s= fm3; bh=Zf4d4UWSQdYsjbk8OSixuPMvXjbf0biWSZyiHdkfKxs=; b=h5Gg0wHB ZyeqGXM6G1Fq8Jy4eDbODUJgjtn0d6RJfZqeIljOdUyLrgyVQl1nQOHoV5at8JU3 35tJg9iQqi06XNJuzWnbz+EBTKvc+RxaaHoNm7p+nk0uRSt40wO3mbPS5tptE922 8MYM5uv43bClFZmIwqTNqWcVSvC3HNhivlsEAZN7hVQcvNzETwUC4oNWT9SvKkjV 9Tz25TvQt2TIs7SK/y7VGrlpUcoTuktiRf9p5dlDueGHeYb+1ebB2oAdA5zrzvxh tJS3jbAhkNwbuJ/3oA4j1HW7ZId6fs+i8VgT1p9UFKqGntoLpM/UQLhf/JoJHqnS D7Rgy/l3yhL0IQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=Zf4d4UWSQdYsjbk8OSixuPMvXjbf0 biWSZyiHdkfKxs=; b=DClvAUIJQRSJa3wFpP8JimhK8epmttVsleosUt5BoKaLj 2R6p3OKDbaJ6tHVLwLOvOtunou6Q+kXhIBj84tJdZw439Sb2krhwi9AkGrhyslmf JSHnGE1EBWIBUZl0N/DbI6+NUbvw/fHSN+ok3XztYqKK0q1nL2wyFhF2Hx2FwB7z TViKIDCjWEO9xyzhoffOICa1D8oEkWDSd5X0Ghf44BEW2QX3PHfEXtvIsfPAtowR yTw/cUsLlY/Tzlw5yKsTXtTpkbx7M6khYvSbf+7iUoxwQiQTwreUc8Y0Rpg4bIG5 g79ev3mqkrM/H+7iGTnCzpzOZw+RSJUMxB7Q+5Dwg== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrjedugdduvddtucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpegtggfhvffusegrtddtredttdejne cuhfhrohhmpeftvghpohhsihhtohhrhicutegtthhivhhithihucfuuhhmmhgrrhihuceu ohhtuceoughopghnohhtpghrvghplhihsehmnhhothdrnhgvtheqnecuggftrfgrthhtvg hrnhepkeefvdduteejvdefkeehieevuefgfefhteetveegffekffefteffvdelheduieet necuffhomhgrihhnpehgihhthhhusgdrtghomhenucfkphephedvrddujeehrdduledvrd dutdeinecuvehluhhsthgvrhfuihiivgepgeenucfrrghrrghmpehmrghilhhfrhhomhep ughopghnohhtpghrvghplhihsehmnhhothdrnhgvth X-ME-Proxy: Received: from fv-az115.internal.cloudapp.net (unknown [52.175.192.106]) by mail.messagingengine.com (Postfix) with ESMTPA id DC1AF3280059 for ; Sun, 2 Aug 2020 03:32:43 -0400 (EDT) Content-Type: multipart/alternative; boundary="===============8814658168880235593==" MIME-Version: 1.0 From: Repository Activity Summary Bot To: mls@ietf.org Message-Id: <20200802073243.DC1AF3280059@mailuser.nyi.internal> Date: Sun, 2 Aug 2020 03:32:43 -0400 (EDT) Archived-At: Subject: [MLS] Weekly github digest (MLS Working Group summary) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 02 Aug 2020 07:51:17 -0000 --===============8814658168880235593== MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Issues ------ * mlswg/mls-architecture (+2/-0/=F0=9F=92=AC6) 2 issues created: - Review from Sof=C3=ADa Celi (by beurdouche) https://github.com/mlswg/mls-architecture/issues/74=20 - Open a section for attacks outside the threat model? (by beurdouche) https://github.com/mlswg/mls-architecture/issues/72 [editorial]=20 2 issues received 6 new comments: - #50 Provide details about Deniability (5 by burdges, claucece) https://github.com/mlswg/mls-architecture/issues/50 [editorial]=20 - #48 Description of the formal security guarantees that the protocol MUS= T provide (1 by claucece) https://github.com/mlswg/mls-architecture/issues/48=20 * mlswg/mls-protocol (+2/-6/=F0=9F=92=AC7) 2 issues created: - Derive an "authentication secret" (by bifurcation) https://github.com/mlswg/mls-protocol/issues/374=20 - Follow-up to #21 ? (by tomtau) https://github.com/mlswg/mls-protocol/issues/373=20 5 issues received 7 new comments: - #373 Address DoS by malicious insiders (2 by bifurcation, tomtau) https://github.com/mlswg/mls-protocol/issues/373=20 - #368 Proof of prior membership in the group / Resumption (2 by bifurcat= ion, kkohbrok) https://github.com/mlswg/mls-protocol/issues/368=20 - #367 Negotiate PSKs (1 by kkohbrok) https://github.com/mlswg/mls-protocol/issues/367=20 - #297 Restart (1 by bifurcation) https://github.com/mlswg/mls-protocol/issues/297 [enhancement] [questio= n] [security]=20 - #268 Missing context in the PSK/Importer injection (1 by bifurcation) https://github.com/mlswg/mls-protocol/issues/268 [bug] [security]=20 6 issues closed: - Simplify epoch secret derivation? https://github.com/mlswg/mls-protocol= /issues/325 [analysis] [question]=20 - Authenticate that added members know the PSK https://github.com/mlswg/m= ls-protocol/issues/326 [work in progress]=20 - Detection of tree forks by recipients via a commitment https://github.c= om/mlswg/mls-protocol/issues/291 [functionality] [work in progress]=20 - Missing context in the PSK/Importer injection https://github.com/mlswg/= mls-protocol/issues/268 [bug] [security]=20 - Relax default policy of adding from left to right https://github.com/ml= swg/mls-protocol/issues/266 [performance] [privacy]=20 - Restart https://github.com/mlswg/mls-protocol/issues/297 [enhancement] = [question] [security]=20 Pull requests ------------- * mlswg/mls-architecture (+1/-1/=F0=9F=92=AC0) 1 pull requests submitted: - Fix some grammar (by claucece) https://github.com/mlswg/mls-architecture/pull/73=20 1 pull requests merged: - Fix some grammar https://github.com/mlswg/mls-architecture/pull/73=20 * mlswg/mls-protocol (+9/-7/=F0=9F=92=AC9) 9 pull requests submitted: - Consistency fix for description of key material sent in an update messa= ge (by chelseakomlo) https://github.com/mlswg/mls-protocol/pull/381=20 - Fix inconsistency in deriving welcome_secret (by yihuang) https://github.com/mlswg/mls-protocol/pull/380=20 - Fix typo at minimal number of extensions (by yihuang) https://github.com/mlswg/mls-protocol/pull/379=20 - Readability edits for section 'Synchronizing Views of the Tree' (by che= lseakomlo) https://github.com/mlswg/mls-protocol/pull/378=20 - Fix grammar (by claucece) https://github.com/mlswg/mls-protocol/pull/377=20 - Negotiate PSKs (by bifurcation) https://github.com/mlswg/mls-protocol/pull/376=20 - Fix grammar and add some initials (by claucece) https://github.com/mlswg/mls-protocol/pull/375=20 - Commit Generation Clarifications (by chelseakomlo) https://github.com/mlswg/mls-protocol/pull/372=20 - Define HPKE on first use (by chelseakomlo) https://github.com/mlswg/mls-protocol/pull/371=20 4 pull requests received 9 new comments: - #379 Fix typo at minimal number of extensions (6 by bifurcation, raphae= lrobert, yihuang) https://github.com/mlswg/mls-protocol/pull/379=20 - #378 Readability edits for section 'Synchronizing Views of the Tree' (1= by bifurcation) https://github.com/mlswg/mls-protocol/pull/378=20 - #377 Fix grammar (1 by beurdouche) https://github.com/mlswg/mls-protocol/pull/377=20 - #375 Fix grammar and add some initials (1 by claucece) https://github.com/mlswg/mls-protocol/pull/375=20 7 pull requests merged: - Readability edits for section 'Synchronizing Views of the Tree' https://github.com/mlswg/mls-protocol/pull/378=20 - Fix inconsistency in deriving welcome_secret https://github.com/mlswg/mls-protocol/pull/380=20 - Fix grammar https://github.com/mlswg/mls-protocol/pull/377=20 - Reorder key schedule inputs https://github.com/mlswg/mls-protocol/pull/362=20 - Commit Generation Clarifications https://github.com/mlswg/mls-protocol/pull/372=20 - Define HPKE on first use https://github.com/mlswg/mls-protocol/pull/371=20 - Minor extension fixes https://github.com/mlswg/mls-protocol/pull/370=20 * mlswg/mls-federation (+0/-1/=F0=9F=92=AC1) 1 pull requests received 1 new comments: - #5 Update build (1 by Bren2010) https://github.com/mlswg/mls-federation/pull/5=20 1 pull requests merged: - Update build https://github.com/mlswg/mls-federation/pull/5=20 Repositories tracked by this digest: ----------------------------------- * https://github.com/mlswg/mls-architecture * https://github.com/mlswg/mls-protocol * https://github.com/mlswg/mls-federation --===============8814658168880235593== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Weekly github digest (MLS Working Group summary)

Sunday August 02, 2020

Issues

mlswg/mls-architecture (+2/-0/=F0=9F=92=AC6)

2 issues created:

2 issues received 6 new comments:

mlswg/mls-protocol (+2/-6/=F0=9F=92=AC7)

2 issues created:

5 issues received 7 new comments:

6 issues closed:

Pull requests

mlswg/mls-architecture (+1/-1/=F0=9F=92=AC0)

1 pull requests submitted:

1 pull requests merged:

mlswg/mls-protocol (+9/-7/=F0=9F=92=AC9)

9 pull requests submitted:

4 pull requests received 9 new comments:

7 pull requests merged:

mlswg/mls-federation (+0/-1/=F0=9F=92=AC1)

1 pull requests received 1 new comments:

1 pull requests merged:

Repositories tracked by this digest:

--===============8814658168880235593==-- From nobody Mon Aug 3 15:04:06 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E3F933A1105 for ; Mon, 3 Aug 2020 15:04:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.004 X-Spam-Level: X-Spam-Status: No, score=0.004 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KZSRYP7mnk3m for ; Mon, 3 Aug 2020 15:04:01 -0700 (PDT) Received: from mail-qt1-x836.google.com (mail-qt1-x836.google.com [IPv6:2607:f8b0:4864:20::836]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBBE73A0C6F for ; Mon, 3 Aug 2020 15:03:41 -0700 (PDT) Received: by mail-qt1-x836.google.com with SMTP id v22so23555651qtq.8 for ; Mon, 03 Aug 2020 15:03:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=syPncUsGbTkHc1jt0hnBdol3k6VCvGQ1voSOLaHkhNU=; b=lool8/ujgC85C97Vhi0vfJwVIZuy/k/FJaMkJ/srf6JUiv5HdRBRciwpOO23TkvZiE d1hK4GbgoRsVmQxtnrepdd6Sv+03VRc8hXzMGTPZGxNBhcOorfSTUkNcc/npHsWiIYiy DoxvYQiGQftAaGxxbIWHM7f3y5kCCEpsThQnE96cIWVl+z+5UhJCF6eRn0KmHABlg+Vl V3Zr+bYLFuWuIC1clGrTvmxf8rUFiN7+oz5OGKjXi4hDpfMynfBBmuDdlAJUGBclulh0 7KwJDcR5v8i546HdujKj6ExEyidkrZDAa5Nu537yoC+bCBtSlc9nhTzCRz4j0TOnPP1C HE3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=syPncUsGbTkHc1jt0hnBdol3k6VCvGQ1voSOLaHkhNU=; b=Rsaf+6xU9wInZz9gB3l7/MN8RrUgW101Be0nebtBReGOQya982YQF5XChw0EaBaLMb ESniyn8H1/9nTqAPHpjEcxYzWkEO88W6vrZ0J413mRZP5x052BQi54oseMTkCXZ2rNpF jI8WmgtzV2rCdc27/qc8xSCu7hbABJVvneHGOXdynUaVHO35ETsO0rLAN2WO9fliUKX9 ktTgJCyCTwMt4Yh50sFJbyX8iBREteWDtXU5pRqGnHERr6jfHAG8iLm89zKKRy5rltUk G+RDNRgdYbOCqah0A94WSFSGsjLtA/sRyUGQUdf9S7mOOUjWlxZ7HdKOYX5SVAed/tcZ w33A== X-Gm-Message-State: AOAM530rdOcvrpzjf0Ahe3ud+NWB8Xlxd1Fx6lK8smKdaFi8UJzPBlof +HntDBRfFuLkkyp60dpeUU7ZwJ7mq378eStzHN8ydg== X-Google-Smtp-Source: ABdhPJw71YO/zOOpOoRXuINX2dbaIes5XJmkS2coLExUu7MAG9M29eElZucqSWnxsebc6VJtl2dn52LcmJSvCw8V5ac= X-Received: by 2002:aed:34e2:: with SMTP id x89mr18465475qtd.313.1596492220172; Mon, 03 Aug 2020 15:03:40 -0700 (PDT) MIME-Version: 1.0 References: <682de0fe-41c2-9b96-067b-6cb4b08e1e7c@aalto.fi> <7028_1594089739_5F03E109_7028_154_1_B0D017EB-1A15-4C96-84C8-1E202A5A51EF@nps.edu> <4ceb1790-ef66-0113-0f59-023ab1e713e7@aalto.fi> <5754afd7-f05f-2844-5656-4f4572b49fab@aalto.fi> <0c22bb51-6ef2-a55c-0c3a-14e0b590d7c7@aalto.fi> <064ad211-9f5f-7254-aa48-d7aea0ca2c7f@aalto.fi> <6d0b0e16-88a9-96c6-cb45-96262c61f337@datashrine.de> In-Reply-To: <6d0b0e16-88a9-96c6-cb45-96262c61f337@datashrine.de> From: Richard Barnes Date: Mon, 3 Aug 2020 18:03:27 -0400 Message-ID: To: Konrad Kohbrok Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000abadb505ac004fda" Archived-At: Subject: Re: [MLS] Key Schedule: Replace DPRF with multi-input PRF (NPRF) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Aug 2020 22:04:05 -0000 --000000000000abadb505ac004fda Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable The GroupSecrets are not encrypted under a single key -- they're encrypted to each joiner's init keys using HPKE. Good point about the difference in guarantees; I had missed this about #336. In the terminology that's in the key schedule now, then, we would derive the welcome_secret from the member_secret. Syntically, I might prefer it be an extension as in Commit, but that's outweighed by my desire not to have extensions in GroupSecrets. So yeah, `optional` seems right, where `PreSharedKeys` is whatever we put in the Commit extension. --Richard On Thu, Jul 30, 2020 at 3:49 AM Konrad Kohbrok wrote: > Hi Richard, > > Is there a particular reason why the PSK has to be announced inside of th= e > GroupInfo object? This significantly weakens the authentication guarantee= s > we > get from the PSK. A member that does not know the PSK can now decrypt the > GroupInfo object and learn, for example, about the group composition, > group id, > epoch, etc. > > Our original proposal in #336 was suggesting to put the PSKId into the > GroupSecrets object and I don't see what we gain by having it in the > GroupInfo > object instead. From what I can see it only weakens security and makes th= e > key > schedule design more awkward. > > Regarding efficiency: As Chris remarked, the GroupSecrets object is > encrypted > under a single symmetric key for all members just as the GroupInfo object= , > isn't it? > > Cheers, > Konrad > > > On 25.07.20 23:14, Richard Barnes wrote: > > Think about the order of operations a new joiner goes through: > > > > 1. Decrypt the EncryptedGroupSecrets (including the joiner_secret) usin= g > the > > relevant HPKE private key > > 2. Compute the welcome_secret, welcome_key, and welcome_nonce > > 3.. Decrypt the GroupInfo using the welcome_key and welcome_nonce > > > > My presumption is that the joiner will only know that it needs the PSK > after > > step 3, when it can read the GroupInfo extensions. (See > > https://github.com/mlswg/mls-protocol/issues/367) That means that the > > welcome_secret can't depend on the PSK. > > > > On Sat, Jul 25, 2020 at 4:09 PM Chris Brzuska > > wrote: > > > > Hi Richard, > > > > I have a quick question: An additional change in your key schedule > is that > > the welcome_secret is now derived *before* including the PSK. What > is the > > motivation behind this? > > > > Thanks! > > > > Chris > > > > On 24/07/2020 22:18, Chris Brzuska wrote: > > > >> I see, thanks for clarifying. Obviously, with these requirements, > pull > >> request #336 does not work as is. I think that the conceptual issu= e > of how > >> to best combine two, three keys and more keys, remains, now with a= n > >> additional requirement to combine two keys separately first. > >> > >> Will think about it, thanks for clarifying the requirements! > >> > >> Chris > >> > >> On 24/07/2020 21:47, Richard Barnes wrote: > >>> Your confusion is understandable -- the document is wrong right > now! You > >>> are correct that the current design prohibits new joiners from > >>> participating in the PSK proof, but that's a bug, not a feature. > The > >>> epoch secret should verify that *all members of the current epoch= * > know > >>> the PSK, not just the ones inherited from the last epoch. > >>> > >>> That's why #362 rearranges the key schedule as follows: > >>> > >>> init_secret_[n-1] (or 0) > >>> | > >>> V > >>> commit_secret -> HKDF-Extract =3D joiner_secret > >>> | > >>> +--> Derive-Secret(., "welcome") > >>> | =3D welcome_secret > >>> | > >>> V > >>> PSK (or 0) -> HKDF-Extract =3D member_secret > >>> | > >>> V > >>> GroupContext_[n] -> HKDF-Extract =3D epoch_secret > >>> > >>> (I also promoted the GroupContext to the main key schedule.) > That's the > >>> context for my earlier comments.. With that picture, the only > thing > >>> you're coalescing with nPRF would be the latter two HKDF-Extract > calls. > >>> > >>> Hope that helps, > >>> --Richard > >>> > >>> > >>> > >>> On Fri, Jul 24, 2020 at 2:32 PM Chris Brzuska < > chris.brzuska@aalto.fi > >>> > wrote: > >>> > >>> Hey Richard, > >>> > >>> thank you for looking into this. I think, I need more > explanation to > >>> understand the following point: > >>> > >>> >>> You can't add the commit secret and PSKs in the same > operation, > >>> because you want new joiners to put in the PSK, but you don't > want > >>> them to have to know the commit secret. > >>> > >>> The current draft sais the following about the PSK: > >>> "Groups which already have an out-of-band mechanism to genera= te > >>> *shared* group secrets can inject those in the MLS key > schedule to > >>> seed the MLS group secrets computations by this external > entropy. At > >>> any epoch, including the initial state, an application can > decide to > >>> synchronize the injection of a PSK into the MLS key schedule. > This > >>> mechanism can be used to improve security in the cases where > having a > >>> full run of updates across members is too expensive or in the > case > >>> where the external group key establishment mechanism provides > >>> stronger security against classical or quantum adversaries." > >>> > >>> As I understand this paragraph, the PSK is known by all group > members > >>> and not related to new joiners. Maybe, the requirements and/o= r > design > >>> changed in the meanwhile, and I am not aware of it. I > interpreted the > >>> paragraph this way, since the current construction (posted > below for > >>> convenience) also requires to know the commit_secret to deriv= e > the > >>> epoch_secret (from which the welcome_secret is derived). Wher= e > did I > >>> go wrong? > >>> > >>> Thanks! > >>> > >>> Chris > >>> > >>> init_secret_[n-1] (or 0) > >>> | > >>> V > >>> PSK (or 0) -> HKDF-Extract =3D early_secret > >>> | > >>> Derive-Secret(., "derived", "") > >>> | > >>> V > >>> commit_secret -> HKDF-Extract =3D epoch_secret > >>> > >>> > >>> On 24/07/2020 20:53, Richard Barnes wrote: > >>>> Hey Chris, > >>>> > >>>> I was looking again at the key schedule as I was drafting > #362 [1]. > >>>> A couple of things occurred to me: > >>>> > >>>> 1. You can't add the commit secret and PSKs in the same > operation, > >>>> because you want new joiners to put in the PSK, but you don'= t > want > >>>> them to have to know the commit secret. > >>>> > >>>> 2. The nPRF construction you propose has the same number of > HMAC > >>>> invocations as the chained-HKDF-Extract stuff that's in the > current > >>>> draft / 362. > >>>> > >>>> Given those observations, I wonder how much an nPRF is reall= y > buying > >>>> us. It's not saving us any HMAC calls, and relative to #362= , > it > >>>> would only coalesce two DPRF calls into one nPRF call. > >>>> > >>>> Maybe there's some benefit if there are multiple PSKs? But > even > >>>> then, it seems like you could add a layer, computing a > synthetic PSK > >>>> from the multiple ones, and keeping the main key schedule > simple. > >>>> > >>>> At this point, given the above and the novelty of the nPRF > >>>> construction, I'm inclined to just stick with HKDF and merge > #362 > >>>> instead of #336. > >>>> > >>>> --Richard > >>>> > >>>> > >>>> [1] https://github.com/mlswg/mls-protocol/pull/362 > >>>> > >>>> On Tue, Jul 7, 2020 at 5:30 AM Chris Brzuska < > chris.brzuska@aalto.fi > >>>> > wrote: > >>>> > >>>> Thank you for the pointer to Carter-Wegman MACs. > >>>> > >>>> >>> This style of combing hash outputs does affect > collision > >>>> resistance [4], and some discussion on relation to that > would be > >>>> nice to see. > >>>> > >>>> That's an excellent point. In addition to > pseudorandomness, we > >>>> prove the collision-resistance of our construction. I.e.= , > >>>> assuming that no unique value is used twice and assuming > that > >>>> HMAC is collision-resistance, then the final Expand > operation > >>>> guarantees unique outputs. I.e., by including the unique > value > >>>> into the final Expand operation after the xor, the > construction > >>>> recovers from any collisions incurred by the xor. > >>>> > >>>> Chris > >>>> > >>>> On 07/07/2020 05:41, Hale, Britta (CIV) wrote: > >>>>> > >>>>> This is an interesting proposal. It is closely related > at a > >>>>> high level to Carter-Wegman MACs (i.e. for random seed = r, > >>>>> MAC((k1, k2), m) =3D PRF(k1, r) XOR MAC(k2, m)). Quite= a > few > >>>>> MACs fall into this category in practice. Considering > the use > >>>>> of a MAC-based KDF and the proofs of [3] on DPRFs, ther= e > is an > >>>>> overlap between NPRFs and extrapolation of the above > (based on > >>>>> iteration of the PRF guarantees). > >>>>> > >>>>> > >>>>> > >>>>> This is worth noting from an assurance standpoint: ther= e > was > >>>>> discussion at the virtual interims with respect to the > current > >>>>> formulation of MLS key derivation, which has a =E2=80= =9CTLS > >>>>> precedence=E2=80=9D, yet this proposal is not without p= recedence > >>>>> itself. Ergo, such a change should not necessarily be > >>>>> concerning based on differing from current practice. > >>>>> > >>>>> > >>>>> > >>>>> This style of combing hash outputs does affect collisio= n > >>>>> resistance [4], and some discussion on relation to that > would > >>>>> be nice to see. > >>>>> > >>>>> > >>>>> > >>>>> Britta > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> [1] Carter, Wegman. Universal classes of hash functions= . > >>>>> > >>>>> [2] Carter, Wegman. New hash functions and their use in > >>>>> authentication and set equality. > >>>>> > >>>>> [3] Bellare and Lysyanskaya. Symmetric and Dual PRFs fr= om > >>>>> Standard Assumptions: A Generic Validation of an HMAC > Assumption. > >>>>> > >>>>> [4] Bernstein. What output size resists collisions in a > xor of > >>>>> independent expansions? > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> > >>>>> *From: *MLS > >>>>> on behalf of Chris Brzusk= a > >>>>> > >>>>> *Date: *Tuesday, June 9, 2020 at 10:32 AM > >>>>> *To: *"mls@ietf.org" > > >>>>> > >>>>> *Subject: *[MLS] Key Schedule: Replace DPRF with > multi-input > >>>>> PRF (NPRF) > >>>>> > >>>>> > >>>>> > >>>>> Hi all, > >>>>> > >>>>> I would like to open a discussion on a suggestion for a > change > >>>>> in the key schedule. In the current draft, we use the > Extract > >>>>> function twice as a dual pseudorandom function (DPRF) > when > >>>>> combining 3 keys (*) and interleave them with an Expand > call. > >>>>> > >>>>> The suggestion [1] is to replace these 3 calls by a > multi-input > >>>>> PRF (NPRF) which is especially designed to return a > >>>>> pseudorandom key when at least one of the input keys is > >>>>> pseudorandom. The new suggestion relies on standard PRF > >>>>> security rather than DPRF-security of Extract. > >>>>> > >>>>> You can find the accompanying paper with pictures, > discussion > >>>>> and security reduction for the design principle here > [2]. I > >>>>> include a summary of the main points in the end of this > eMail. > >>>>> > >>>>> Please comment/share your opinion. Thanks! > >>>>> > >>>>> Chris > >>>>> > >>>>> (*) commit_secret, PSK and init_secret > >>>>> > >>>>> [1] Pull Request: > https://github.com/mlswg/mls-protocol/pull/337 > >>>>> > >>>>> [2] Paper: http://chrisbrzuska.de/2020-NPRF.html > >>>>> > >>>>> > *-----------------------------------------------------------------------= ---------------------------------------------* > >>>>> > >>>>> *Summary of main points:* > >>>>> > >>>>> The current key schedule > >>>>> - uses Extract as a dual pseudorandom function and > assumes that > >>>>> HMAC is a dual pseudorandom function > >>>>> - applies Extract after Expand, i.e., after applying a > function > >>>>> which generates a pseudorandom value > >>>>> - iterates Extract-then-Expand sequentially to combine > more > >>>>> than 2 keys > >>>>> > >>>>> The pull request suggests to > >>>>> - replace the ad-hoc assumption that Extract is a dual > >>>>> pseudorandom function > >>>>> - remove Extract steps when applied after Expand > >>>>> - use a provably secure NPRF construction which allows = to > >>>>> combine more than 2 keys and is based on a standard PRF > >>>>> assumption and statistical properties of xor. > >>>>> > >>>>> Efficiency: > >>>>> - The suggested construction has higher parallel > efficiency. It > >>>>> increases the overall number of HMAC evaluations by 1. > >>>>> > >>>>> Assumptions: > >>>>> - HMAC is a standard PRF. > >>>>> - Relies on a unique value, the group_context was > suggested. > >>>>> > >>>>> Construction: > >>>>> (1) Use unique value to expand each key and xor the > result > >>>>> (2) expand resulting key, including unique value into t= he > >>>>> context again > >>>>> > >>>>> Security argument: > >>>>> - Pseudorandomness: unique value ensures that each > outcome of > >>>>> Expand in (1) is used only once in a xor combination, > thus > >>>>> allowing on one-time pad argument of xor. > >>>>> - Uniqueness of resulting keys: (2) ensures that if HMA= C > is > >>>>> collision-resistent, then the result is > collision-resistent. > >>>>> > >>>>> Variants: > >>>>> - It is possible to use an NPRF variant called NameNPRF > [2] > >>>>> which has 3 HMAC evaluations more and relies less on th= e > unique > >>>>> value. I.e., NameNPRF is secure in the same scenarios a= s > DPRF: > >>>>> Keys only repeat if the input keys repeat *and* the gro= up > >>>>> context repeats. > >>>>> > >>>>> Questions/Comments that came up: > >>>>> - Barnes, MacMillion suggested group_context as unique > value > >>>>> - MacMillion wondered about removal of Extract: One can > add an > >>>>> extract operation for the psk. For other input keys, it > does > >>>>> not seem needed, since they were returned from Expand. > >>>>> - Wood: Can we replace HMAC by arbitrary PRF? Yes. For > >>>>> uniqueness of output keys, the PRF needs to be > >>>>> collision-resistant, too. > >>>>> > >>>>> > >>>>> _______________________________________________ > >>>>> MLS mailing list > >>>>> MLS@ietf.org > >>>>> https://www.ietf.org/mailman/listinfo/mls > >>>> _______________________________________________ > >>>> MLS mailing list > >>>> MLS@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/mls > >>>> > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000abadb505ac004fda Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
The GroupSecrets are not encrypted under a single key= -- they're encrypted to each joiner's init keys using HPKE.
<= div>
Good point about the difference in guarantees; I had mis= sed this about #336.=C2=A0 In the terminology that's in the key schedul= e now, then, we would derive the welcome_secret from the member_secret.
=

Syntically, I might prefer it be an extension as = in Commit, but that's outweighed by my desire not to have extensions in= GroupSecrets.=C2=A0 So yeah, `optional<PreSharedKeys>` seems right, = where `PreSharedKeys` is whatever we put in the Commit extension.

--Richard

On Thu, Jul 30, 2020 at 3:49 AM Konrad Kohbro= k <konrad.kohbrok@datash= rine.de> wrote:
Hi Richard,

Is there a particular reason why the PSK has to be announced inside of the<= br> GroupInfo object? This significantly weakens the authentication guarantees = we
get from the PSK. A member that does not know the PSK can now decrypt the GroupInfo object and learn, for example, about the group composition, group= id,
epoch, etc.

Our original proposal in #336 was suggesting to put the PSKId into the
GroupSecrets object and I don't see what we gain by having it in the Gr= oupInfo
object instead. From what I can see it only weakens security and makes the = key
schedule design more awkward.

Regarding efficiency: As Chris remarked, the GroupSecrets object is encrypt= ed
under a single symmetric key for all members just as the GroupInfo object, = isn't it?

Cheers,
Konrad


On 25.07.20 23:14, Richard Barnes wrote:
> Think about the order of operations a new joiner goes through:
>
> 1. Decrypt the EncryptedGroupSecrets (including the joiner_secret) usi= ng the
> relevant HPKE private key
> 2. Compute the welcome_secret, welcome_key, and welcome_nonce
> 3.. Decrypt the GroupInfo using the welcome_key and welcome_nonce
>
> My presumption is that the joiner will only know that it needs the PSK= after
> step 3, when it can read the GroupInfo extensions.=C2=A0 (See
> https://github.com/mlswg/mls-protocol/issues/36= 7)=C2=A0 That means that the
> welcome_secret can't depend on the PSK.
>
> On Sat, Jul 25, 2020 at 4:09 PM Chris Brzuska <chris.brzuska@aalto.fi
> <mailto:chris.brzuska@aalto.fi>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Hi Richard,
>
>=C2=A0 =C2=A0 =C2=A0I have a quick question: An additional change in yo= ur key schedule is that
>=C2=A0 =C2=A0 =C2=A0the welcome_secret is now derived *before* includin= g the PSK. What is the
>=C2=A0 =C2=A0 =C2=A0motivation behind this?
>
>=C2=A0 =C2=A0 =C2=A0Thanks!
>
>=C2=A0 =C2=A0 =C2=A0Chris
>
>=C2=A0 =C2=A0 =C2=A0On 24/07/2020 22:18, Chris Brzuska wrote:
>
>>=C2=A0 =C2=A0 =C2=A0I see, thanks for clarifying. Obviously, with t= hese requirements, pull
>>=C2=A0 =C2=A0 =C2=A0request #336 does not work as is. I think that = the conceptual issue of how
>>=C2=A0 =C2=A0 =C2=A0to best combine two, three keys and more keys, = remains, now with an
>>=C2=A0 =C2=A0 =C2=A0additional requirement to combine two keys sepa= rately first.
>>
>>=C2=A0 =C2=A0 =C2=A0Will think about it, thanks for clarifying the = requirements!
>>
>>=C2=A0 =C2=A0 =C2=A0Chris
>>
>>=C2=A0 =C2=A0 =C2=A0On 24/07/2020 21:47, Richard Barnes wrote:
>>>=C2=A0 =C2=A0 =C2=A0Your confusion is understandable -- the doc= ument is wrong right now!=C2=A0 You
>>>=C2=A0 =C2=A0 =C2=A0are correct that the current design prohibi= ts new joiners from
>>>=C2=A0 =C2=A0 =C2=A0participating in the PSK proof, but that= 9;s a bug, not a feature.=C2=A0 The
>>>=C2=A0 =C2=A0 =C2=A0epoch secret should verify that *all member= s of the current epoch* know
>>>=C2=A0 =C2=A0 =C2=A0the PSK, not just the ones inherited from t= he last epoch.
>>>
>>>=C2=A0 =C2=A0 =C2=A0That's why #362 rearranges the key sche= dule as follows:
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 init_secret_[n-1] (or 0)
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 V
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0commit_secret -> HKDF-Extra= ct =3D joiner_secret
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 +--> Derive-Secret(., "we= lcome")
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 | =C2=A0 =C2=A0=3D welcome_secret=
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 V
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 PSK (or 0) -> HKDF-= Extract =3D member_secret
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 V
>>>=C2=A0 =C2=A0 =C2=A0GroupContext_[n] -> HKDF-Extract =3D epo= ch_secret
>>>
>>>=C2=A0 =C2=A0 =C2=A0(I also promoted the GroupContext to the ma= in key schedule.)=C2=A0 That's the
>>>=C2=A0 =C2=A0 =C2=A0context for my earlier comments..=C2=A0 Wit= h that picture, the only thing
>>>=C2=A0 =C2=A0 =C2=A0you're coalescing with nPRF would be th= e latter two HKDF-Extract calls.
>>>
>>>=C2=A0 =C2=A0 =C2=A0Hope that helps,
>>>=C2=A0 =C2=A0 =C2=A0--Richard
>>>
>>>
>>>
>>>=C2=A0 =C2=A0 =C2=A0On Fri, Jul 24, 2020 at 2:32 PM Chris Brzus= ka <chris.br= zuska@aalto.fi
>>>=C2=A0 =C2=A0 =C2=A0<mailto:chris.brzuska@aalto.fi>> wrote:
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hey Richard,
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0thank you for looking into th= is. I think, I need more explanation to
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0understand the following poin= t:
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>>=C2=A0 You can= 9;t add the commit secret and PSKs in the same operation,
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0because you want new joiners = to put in the PSK, but you don't want
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0them to have to know the comm= it secret.
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The current draft sais the fo= llowing about the PSK:
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0"Groups which already ha= ve an out-of-band mechanism to generate
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*shared* group secrets can in= ject those in the MLS key schedule to
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0seed the MLS group secrets co= mputations by this external entropy. At
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0any epoch, including the init= ial state, an application can decide to
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0synchronize the injection of = a PSK into the MLS key schedule. This
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0mechanism can be used to impr= ove security in the cases where having a
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0full run of updates across me= mbers is too expensive or in the case
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0where the external group key = establishment mechanism provides
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0stronger security against cla= ssical or quantum adversaries."
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0As I understand this paragrap= h, the PSK is known by all group members
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0and not related to new joiner= s. Maybe, the requirements and/or design
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0changed in the meanwhile, and= I am not aware of it. I interpreted the
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0paragraph this way, since the= current construction (posted below for
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0convenience) also requires to= know the commit_secret to derive the
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0epoch_secret (from which the = welcome_secret is derived). Where did I
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0go wrong?
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Thanks!
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Chris
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 init_secret_[n-1] (or 0)
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 V
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0PSK (or 0) ->= ; HKDF-Extract =3D early_secret
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 Derive-Secret(., "derived", "") >>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 |
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 V
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0commit_secret -> HKDF-Extr= act =3D epoch_secret
>>>
>>>
>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On 24/07/2020 20:53, Richard = Barnes wrote:
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hey Chris,
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0I was looking again at th= e key schedule as I was drafting #362 [1].=C2=A0
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0A couple of things occurr= ed to me:
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A01. You can't add the = commit secret and PSKs in the same operation,
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0because you want new join= ers to put in the PSK, but you don't want
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0them to have to know the = commit secret.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A02. The nPRF construction = you propose has the same number of HMAC
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0invocations as the chaine= d-HKDF-Extract stuff that's in the current
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0draft / 362.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Given those observations,= I wonder how much an nPRF is really buying
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0us.=C2=A0 It's not sa= ving us any HMAC calls, and relative to #362, it
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0would only coalesce two D= PRF calls into one nPRF call.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Maybe there's some be= nefit if there are multiple PSKs?=C2=A0 But even
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0then, it seems like you c= ould add a layer, computing a synthetic PSK
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0from the multiple ones, a= nd keeping the main key schedule simple.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0At this point, given the = above and the novelty of the nPRF
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0construction, I'm inc= lined to just stick with HKDF and merge #362
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0instead of #336.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0--Richard
>>>>
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[1] = https://github.com/mlswg/mls-protocol/pull/362
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On Tue, Jul 7, 2020 at 5:= 30 AM Chris Brzuska <chris.brzuska@aalto.fi
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<mailto:chris.brzuska@aalto.fi>= ;> wrote:
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Thank you f= or the pointer to Carter-Wegman MACs.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0>>>= ; This style of combing hash outputs does affect collision
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0resistance = [4], and some discussion on relation to that would be
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0nice to see= .
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0That's = an excellent point. In addition to pseudorandomness, we
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0prove the c= ollision-resistance of our construction. I.e.,
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0assuming th= at no unique value is used twice and assuming that
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0HMAC is col= lision-resistance, then the final Expand operation
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0guarantees = unique outputs. I.e., by including the unique value
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0into the fi= nal Expand operation after the xor, the construction
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0recovers fr= om any collisions incurred by the xor.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Chris
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0On 07/07/20= 20 05:41, Hale, Britta (CIV) wrote:
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0This is= an interesting proposal. It is closely related at a
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0high le= vel to Carter-Wegman MACs (i.e. for random seed r,
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MAC((k1= , k2), m) =3D=C2=A0 PRF(k1, r) XOR MAC(k2, m)). Quite a few
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MACs fa= ll into this category in practice. Considering the use
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0of a MA= C-based KDF and the proofs of [3] on DPRFs, there is an
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0overlap= between NPRFs and extrapolation of the above (based on
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0iterati= on of the PRF guarantees).
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0This is= worth noting from an assurance standpoint: there was
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0discuss= ion at the virtual interims with respect to the current
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0formula= tion of MLS key derivation, which has a =E2=80=9CTLS
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0precede= nce=E2=80=9D, yet this proposal is not without precedence
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0itself.= Ergo, such a change should not necessarily be
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0concern= ing based on differing from current practice.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0This st= yle of combing hash outputs does affect collision
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0resista= nce [4], and some discussion on relation to that would
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0be nice= to see.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Britta<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[1] Car= ter, Wegman. Universal classes of hash functions.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[2] Car= ter, Wegman. New hash functions and their use in
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0authent= ication and set equality.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[3] Bel= lare and Lysyanskaya. Symmetric and Dual PRFs from
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Standar= d Assumptions: A Generic Validation of an HMAC Assumption.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[4] Ber= nstein. What output size resists collisions in a xor of
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0indepen= dent expansions?
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*From: = *MLS <mls-boun= ces@ietf.org>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<mai= lto:mls-bounces@i= etf.org> on behalf of Chris Brzuska
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<chris.brzuska@aalt= o.fi> <mailto:chris.brzuska@aalto.fi>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*Date: = *Tuesday, June 9, 2020 at 10:32 AM
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*To: *&= quot;mls@ietf.org&quo= t; <mailto:mls@ietf.or= g> <mls@ietf.or= g>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0<mai= lto:mls@ietf.org><= br> >>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*Subjec= t: *[MLS] Key Schedule: Replace DPRF with multi-input
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0PRF (NP= RF)
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0=C2=A0<= br> >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Hi all,=
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0I would= like to open a discussion on a suggestion for a change
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0in the = key schedule. In the current draft, we use the Extract
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0functio= n twice as a dual pseudorandom function (DPRF) when
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0combini= ng 3 keys (*) and interleave them with an Expand call.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The sug= gestion [1] is to replace these 3 calls by a multi-input
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0PRF (NP= RF) which is especially designed to return a
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pseudor= andom key when at least one of the input keys is
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pseudor= andom. The new suggestion relies on standard PRF
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0securit= y rather than DPRF-security of Extract.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0You can= find the accompanying paper with pictures, discussion
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0and sec= urity reduction for the design principle here [2]. I
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0include= a summary of the main points in the end of this eMail.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Please = comment/share your opinion. Thanks!
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Chris >>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(*) com= mit_secret, PSK and init_secret
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[1] Pul= l Request:https://github.com/mlswg/mls-protocol/pull/3= 37
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0[2] Pap= er: http://chrisbrzuska.de/2020-NPRF.html
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*------= ---------------------------------------------------------------------------= -----------------------------------*
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0*Summar= y of main points:*
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The cur= rent key schedule
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- uses = Extract as a dual pseudorandom function and assumes that
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0HMAC is= a dual pseudorandom function
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- appli= es Extract after Expand, i.e., after applying a function
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0which g= enerates a pseudorandom value
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- itera= tes Extract-then-Expand sequentially to combine more
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0than 2 = keys
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0The pul= l request suggests to
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- repla= ce the ad-hoc assumption that Extract is a dual
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pseudor= andom function
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- remov= e Extract steps when applied after Expand
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- use a= provably secure NPRF construction which allows to
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0combine= more than 2 keys and is based on a standard PRF
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0assumpt= ion and statistical properties of xor.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Efficie= ncy:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- The s= uggested construction has higher parallel efficiency. It
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0increas= es the overall number of HMAC evaluations by 1.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Assumpt= ions:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- HMAC = is a standard PRF.
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Relie= s on a unique value, the group_context was suggested.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Constru= ction:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(1) Use= unique value to expand each key and xor the result
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0(2) exp= and resulting key, including unique value into the
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0context= again
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Securit= y argument:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Pseud= orandomness: unique value ensures that each outcome of
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Expand = in (1) is used only once in a xor combination, thus
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0allowin= g on one-time pad argument of xor.
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Uniqu= eness of resulting keys: (2) ensures that if HMAC is
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0collisi= on-resistent, then the result is collision-resistent.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Variant= s:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- It is= possible to use an NPRF variant called NameNPRF [2]
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0which h= as 3 HMAC evaluations more and relies less on the unique
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0value. = I.e., NameNPRF is secure in the same scenarios as DPRF:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Keys on= ly repeat if the input keys repeat *and* the group
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0context= repeats.
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0Questio= ns/Comments that came up:
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Barne= s, MacMillion suggested group_context as unique value
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- MacMi= llion wondered about removal of Extract: One can add an
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0extract= operation for the psk. For other input keys, it does
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0not see= m needed, since they were returned from Expand.
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0- Wood:= Can we replace HMAC by arbitrary PRF? Yes. For
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0uniquen= ess of output keys, the PRF needs to be
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0collisi= on-resistant, too.
>>>>>
>>>>>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0_______= ________________________________________
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS mai= ling list
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org>
>>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/listinfo/mls
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0___________= ____________________________________
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS mailing= list
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org>
>>>>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/listinfo/mls
>>>>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000abadb505ac004fda-- From nobody Mon Aug 3 15:59:00 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F35153A1103 for ; Mon, 3 Aug 2020 15:58:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.004 X-Spam-Level: X-Spam-Status: No, score=0.004 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vd6wcEdcYPzP for ; Mon, 3 Aug 2020 15:58:56 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 04ADA3A0D66 for ; Mon, 3 Aug 2020 15:58:55 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id q128so4425072qkd.2 for ; Mon, 03 Aug 2020 15:58:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=8LKE+cmhAm+3Qq7nusP+onKCnsYcr9qCIsVOP94OWeE=; b=0zfOetaCt/xL+Lx7Y3se9zIxgme2OPglUwJVcBMWij9lLdugPfdlQhh0Mkup5n84vD 5CbYgj3ffQROk0hV35iNio6kCX+3XDdSyl1fySdjLg6pXMdhQ7bwnsQKwKlAs+jzcKlB f+DrqFP/jarBpcj3nt8hh3TduRFncQbDZeE+5n+SrNgow96tWj/nXCNoWeHzw8JsEqm4 f6C5U7yogRanIkusohClMXdri55ge3bSmWjY/VvcPfjq4/+sYxkVV8EPd1ArV58MfNLe ckQcyo6UwjiI4MkjZ/iox/gX51P3eE5GaG8thytuHHrJBifg3HbtoL/h0XykLn5qWGoe szvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=8LKE+cmhAm+3Qq7nusP+onKCnsYcr9qCIsVOP94OWeE=; b=Jkwa/HWmJvHlSYLXcvsVOpVR2pvV9JMnjrL59j2upSwgHPYfmKjxscGDe3HDMuQX5V WGJKueALw10yBAQ14EIPJUa7Kyq+uN83az1k1RbchhU83VZq7q3FXVNbpg3tEr/7t1hX 6k4QGZhLkxHhOEbLx3QNk+uzHCtubyEiww4uGSpNun6lRPDhSKLC50QrqWLT0OI+FvxR BnimbAQYlr/LDXghDfa0+ItNQ9WDcoCXrk7LyUkOS6iSg9rzy2B+o53B8jn/NBE0DWdK 3GHIpK5vkxhFrwrk2VwtRwDCPV4M80aeGuaMStku7qAnwIHwY5GBmGQgwsZW06NPLDgZ UwFw== X-Gm-Message-State: AOAM533BRL41KalHRyek2h3Essrw3Vv+GEJ6sxu/mKmZxt/maifijKzo fysSOmvxsAHmwHaEaY6htOGZIuqyAIgwvmpUS+6FxAIekVtF9Q== X-Google-Smtp-Source: ABdhPJwiG/jCrKocBndlwjn52JpgJARHKcbK8B0BB2Jmzsx2A57Fek+vUGf7J71nZmfhAkeHf/k/BkF9xa2DJg8BhiA= X-Received: by 2002:a37:b5c5:: with SMTP id e188mr16094921qkf.159.1596495534671; Mon, 03 Aug 2020 15:58:54 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Mon, 3 Aug 2020 18:58:42 -0400 Message-ID: To: Chris Brzuska Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000003adef405ac011538" Archived-At: Subject: Re: [MLS] welcome_secret X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Aug 2020 22:58:58 -0000 --0000000000003adef405ac011538 Content-Type: text/plain; charset="UTF-8" Hi Chris, I think you might be misunderstanding the encryption of the Welcome message a bit. The GroupSecrets are encrypted with HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets. Still, HPKE does make it possible to supply a PSK. So you could provide the PSK ID on the outside of the Welcome, then use the (combined) PSK as a PSK for the GroupSecrets decryption *and* for the key schedule. A few observations about that, though: 1. It would be marginally more efficient, since you're giving the same PSK IDs to everyone 2. It would leak to the DS the PSK IDs for the PSKs in use 3. If you have multiple PSKs, you would need to combine them *and* combine their IDs, since HPKE only has a single PSK input / PSK ID input 4. Would you want separate derived PSKs for HPKE and for the key schedule? On the other hand, if you don't use the PSKs with HPKE (just with the key schedule / GroupInfo decryption), then you do leak the member_secret and a path_secret to someone who has compromised an init_key, but if they don't know the PSK, they still can't join the group. For me, while including the PSK at the HPKE stage does seem like it would add some conceptual cleanness, the additional complexity seems a bit daunting, and I don't live the privacy leak. --Richard On Fri, Jul 31, 2020 at 3:22 AM Chris Brzuska wrote: > Hi all, > > I think that the current derivation of the welcome_secret (used to > encrypt the Group_Info) performs additional operations which are not > needed, and its use is not optimal from a security perspective (and not > necessary from an efficiency perspective). In the current version, we > encrypt the joiner_secret (without PSK) and then derive the > welcome_secret from the joiner-secret. > > Case 1: If the welcome_secret is not derived from the PSK, then one can > use the same symmetric-key for encrypting the Group_Info than for > encrypting the Group_Secrets. There is no efficiency loss, since for all > new members, the same symmetric key for encrypting the Group_Secrets is > used. In the case that the welcome_secret does not depend on the PSK, it > is not needed at all. > > Disadvantage of this: The PSK does not protect the GroupInfo, as > mentioned by Konrad. > > Additional Disadvantage of current version: Performs additional > unnecessary key derivations which do not add security/efficiency. > > Case 2: If we want to make the welcome_secret depend on the PSK, we do > not need to make it depend on the group_secrets. Making the > welcome_secret depend on the group_secrets does not add any security. > Instead, we only need to derive it from the PSK and the symmetric-key > which was sent to all group members. In this case, it makes sense that > both, the Group_Secrets and the Group_Info will be encrypted with the > same key rather than different keys. In this case, both the > Group_Secrets and the Group_Info will be protected by the combination of > PSK knowledge and knowing the secret-key for the PKE. > > Advantage of this: The PSK protects both the GroupInfo and the > GroupSecrets. > > Chris > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000003adef405ac011538 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Chris,

I think you might = be misunderstanding the encryption of the Welcome message a bit.=C2=A0 The = GroupSecrets are encrypted with HPKE to the public keys of the new joiners;= there's no shared key for the GroupSecrets.

S= till, HPKE does make it possible to supply a PSK.=C2=A0 So you could provid= e the PSK ID on the outside of the Welcome, then use the (combined) PSK as = a PSK for the GroupSecrets decryption *and* for the key schedule.=C2=A0 A f= ew observations about that, though:

1. It would be= marginally more efficient, since you're giving the same PSK IDs to eve= ryone
2. It would leak to the DS the PSK IDs for the PSKs in = use
3. If you have multiple PSKs, you would need to combine them = *and* combine their IDs, since HPKE only has a single PSK input / PSK ID in= put
4. Would you want separate derived PSKs for HPKE and for = the key schedule?

On the other hand, if you don= 9;t use the PSKs with HPKE (just with the key schedule / GroupInfo decrypti= on), then you do leak the member_secret and a path_secret to someone who ha= s compromised an init_key, but if they don't know the PSK, they still c= an't join the group.

For me, while including t= he PSK at the HPKE stage does seem like it would add some conceptual cleann= ess, the additional complexity seems a bit daunting, and I don't live t= he privacy leak.

--Richard


On Fr= i, Jul 31, 2020 at 3:22 AM Chris Brzuska <chris.brzuska@aalto.fi> wrote:
Hi all,

I think that the current derivation of the welcome_secret (used to
encrypt the Group_Info) performs additional operations which are not
needed, and its use is not optimal from a security perspective (and not necessary from an efficiency perspective). In the current version, we
encrypt the joiner_secret (without PSK) and then derive the
welcome_secret from the joiner-secret.

Case 1: If the welcome_secret is not derived from the PSK, then one can use the same symmetric-key for encrypting the Group_Info than for
encrypting the Group_Secrets. There is no efficiency loss, since for all new members, the same symmetric key for encrypting the Group_Secrets is used. In the case that the welcome_secret does not depend on the PSK, it is not needed at all.

Disadvantage of this: The PSK does not protect the GroupInfo, as
mentioned by Konrad.

Additional Disadvantage of current version: Performs additional
unnecessary key derivations which do not add security/efficiency.

Case 2: If we want to make the welcome_secret depend on the PSK, we do
not need to make it depend on the group_secrets. Making the
welcome_secret depend on the group_secrets does not add any security.
Instead, we only need to derive it from the PSK and the symmetric-key
which was sent to all group members. In this case, it makes sense that
both, the Group_Secrets and the Group_Info will be encrypted with the
same key rather than different keys. In this case, both the
Group_Secrets and the Group_Info will be protected by the combination of PSK knowledge and knowing the secret-key for the PKE.

Advantage of this: The PSK protects both the GroupInfo and the GroupSecrets= .

Chris

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000003adef405ac011538-- From nobody Mon Aug 3 16:36:50 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 79F793A116E for ; Mon, 3 Aug 2020 16:36:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.145 X-Spam-Level: X-Spam-Status: No, score=-1.145 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.949, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t611bWYxs9UD for ; Mon, 3 Aug 2020 16:36:47 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A7EA43A116D for ; Mon, 3 Aug 2020 16:36:45 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 0480B2714AD_F289F88B for ; Mon, 3 Aug 2020 23:36:40 +0000 (GMT) Received: from exng1.org.aalto.fi (exng1.org.aalto.fi [130.233.223.20]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng1.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id 83DCB27149B_F289F87F for ; Mon, 3 Aug 2020 23:36:39 +0000 (GMT) Received: from exng6.org.aalto.fi (130.233.223.25) by exng1.org.aalto.fi (130.233.223.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 4 Aug 2020 02:36:39 +0300 Received: from [192.168.1.116] (130.233.0.5) by exng6.org.aalto.fi (130.233.223.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 4 Aug 2020 02:36:38 +0300 To: References: <22342_1596495550_5F2896BD_22342_209_1_CAL02cgSY3tGA+eQOspjr0v88UPCJke5hgmDg63p3Pn7deCCTsg@mail.gmail.com> From: Chris Brzuska Message-ID: Date: Tue, 4 Aug 2020 02:36:01 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <22342_1596495550_5F2896BD_22342_209_1_CAL02cgSY3tGA+eQOspjr0v88UPCJke5hgmDg63p3Pn7deCCTsg@mail.gmail.com> Content-Type: multipart/alternative; boundary="------------4AE95F2C8EC372645BC754AD" Content-Language: en-GB X-Originating-IP: [130.233.0.5] X-ClientProxiedBy: exng5.org.aalto.fi (130.233.223.24) To exng6.org.aalto.fi (130.233.223.25) X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=subject:to:references:from:message-id:date:mime-version:in-reply-to:content-type; s=its18; bh=FhAI8mBq/thd3Bhle7ZehacSe4X/z5MJNRQnLaQu/C8=; b=B96orTRCrqI2BqAs9g2W9PdY6PfF8XgoOMwc853jotDc+OTUFc/6sCUOIRDjWxURRyqCd9e3qarA6oNKjOKekBeXPR4jp0Cd1C10m+qN6MJzLr1RWL9HJzbqlNVjCDG+RxvcG7oZRr9GJ97m3o+oym4s/VSy8XIT7sITDd9lhkmqNcf5JeOldszs/jW25BfV2/tYVmvFF1U6wS9NPAGb0Xc3zfIRR0B3dofsySnB7uBAFa3N20Y82ZIZNR7Fu9A05HsXTAe5DfLgFJqipTB8akG6GMuQk7HUl5m72hjmAGqe3FJtMyPsLA0jruISoLHDMeqJrIICW5TE18lTKQCbTA== Archived-At: Subject: Re: [MLS] welcome_secret X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 03 Aug 2020 23:36:49 -0000 --------------4AE95F2C8EC372645BC754AD Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit Hi Richard, >>> I think you might be misunderstanding the encryption of the Welcome message a bit.  The GroupSecrets are encrypted with HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets. Thanks for helping to address my concerns - my understanding is that we use hybrid public-key encryption to encrypt the same symmetric-key to all new joiners and then use this (same) symmetric-key to encrypt the group_secrets, so we do not need to perform the encryption under the symmetric-key multiple times. I.e., the public-keys are different, but the symmetric-key is the same. Quote from the current document: "In order to allow the same Welcome message to be sent to all new members, information describing the group is encrypted with a symmetric key and nonce randomly chosen by the sender. This key and nonce are then encrypted to each new member using HPKE." This symmetric-key is just shared between the joiners, since it was given to all of them via HPKE key transport. Did I get this right, or are we using a different symmetric-key in each HPKE? ack re the rest for now, trying to resolve the clarification issue first. Chris On 04/08/2020 01:58, Richard Barnes wrote: > Hi Chris, > > I think you might be misunderstanding the encryption of the Welcome > message a bit.  The GroupSecrets are encrypted with HPKE to the public > keys of the new joiners; there's no shared key for the GroupSecrets. > > Still, HPKE does make it possible to supply a PSK.  So you could > provide the PSK ID on the outside of the Welcome, then use the > (combined) PSK as a PSK for the GroupSecrets decryption *and* for the > key schedule.  A few observations about that, though: > > 1. It would be marginally more efficient, since you're giving the same > PSK IDs to everyone > 2. It would leak to the DS the PSK IDs for the PSKs in use > 3. If you have multiple PSKs, you would need to combine them *and* > combine their IDs, since HPKE only has a single PSK input / PSK ID input > 4. Would you want separate derived PSKs for HPKE and for the key schedule? > > On the other hand, if you don't use the PSKs with HPKE (just with the > key schedule / GroupInfo decryption), then you do leak the > member_secret and a path_secret to someone who has compromised an > init_key, but if they don't know the PSK, they still can't join the group. > > For me, while including the PSK at the HPKE stage does seem like it > would add some conceptual cleanness, the additional complexity seems a > bit daunting, and I don't live the privacy leak. > > --Richard > > > On Fri, Jul 31, 2020 at 3:22 AM Chris Brzuska > wrote: > > Hi all, > > I think that the current derivation of the welcome_secret (used to > encrypt the Group_Info) performs additional operations which are not > needed, and its use is not optimal from a security perspective > (and not > necessary from an efficiency perspective). In the current version, we > encrypt the joiner_secret (without PSK) and then derive the > welcome_secret from the joiner-secret. > > Case 1: If the welcome_secret is not derived from the PSK, then > one can > use the same symmetric-key for encrypting the Group_Info than for > encrypting the Group_Secrets. There is no efficiency loss, since > for all > new members, the same symmetric key for encrypting the > Group_Secrets is > used. In the case that the welcome_secret does not depend on the > PSK, it > is not needed at all. > > Disadvantage of this: The PSK does not protect the GroupInfo, as > mentioned by Konrad. > > Additional Disadvantage of current version: Performs additional > unnecessary key derivations which do not add security/efficiency. > > Case 2: If we want to make the welcome_secret depend on the PSK, > we do > not need to make it depend on the group_secrets. Making the > welcome_secret depend on the group_secrets does not add any security. > Instead, we only need to derive it from the PSK and the symmetric-key > which was sent to all group members. In this case, it makes sense > that > both, the Group_Secrets and the Group_Info will be encrypted with the > same key rather than different keys. In this case, both the > Group_Secrets and the Group_Info will be protected by the > combination of > PSK knowledge and knowing the secret-key for the PKE. > > Advantage of this: The PSK protects both the GroupInfo and the > GroupSecrets.. > > Chris > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls --------------4AE95F2C8EC372645BC754AD Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 8bit

Hi Richard,

>>> I think you might be misunderstanding the encryption of the Welcome message a bit.  The GroupSecrets are encrypted with HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets.

Thanks for helping to address my concerns - my understanding is that we use hybrid public-key encryption to encrypt the same symmetric-key to all new joiners and then use this (same) symmetric-key to encrypt the group_secrets, so we do not need to perform the encryption under the symmetric-key multiple times. I.e., the public-keys are different, but the symmetric-key is the same. Quote from the current document:

"In order to allow the same Welcome message to be sent to all new members, information describing the group is encrypted with a symmetric key and nonce randomly chosen by the sender. This key and nonce are then encrypted to each new member using HPKE."

This symmetric-key is just shared between the joiners, since it was given to all of them via HPKE key transport. Did I get this right, or are we using a different symmetric-key in each HPKE?

ack re the rest for now, trying to resolve the clarification issue first.

Chris

On 04/08/2020 01:58, Richard Barnes wrote:
Hi Chris,

I think you might be misunderstanding the encryption of the Welcome message a bit.  The GroupSecrets are encrypted with HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets.

Still, HPKE does make it possible to supply a PSK.  So you could provide the PSK ID on the outside of the Welcome, then use the (combined) PSK as a PSK for the GroupSecrets decryption *and* for the key schedule.  A few observations about that, though:

1. It would be marginally more efficient, since you're giving the same PSK IDs to everyone
2. It would leak to the DS the PSK IDs for the PSKs in use
3. If you have multiple PSKs, you would need to combine them *and* combine their IDs, since HPKE only has a single PSK input / PSK ID input
4. Would you want separate derived PSKs for HPKE and for the key schedule?

On the other hand, if you don't use the PSKs with HPKE (just with the key schedule / GroupInfo decryption), then you do leak the member_secret and a path_secret to someone who has compromised an init_key, but if they don't know the PSK, they still can't join the group.

For me, while including the PSK at the HPKE stage does seem like it would add some conceptual cleanness, the additional complexity seems a bit daunting, and I don't live the privacy leak.

--Richard


On Fri, Jul 31, 2020 at 3:22 AM Chris Brzuska <chris.brzuska@aalto.fi> wrote:
Hi all,

I think that the current derivation of the welcome_secret (used to
encrypt the Group_Info) performs additional operations which are not
needed, and its use is not optimal from a security perspective (and not
necessary from an efficiency perspective). In the current version, we
encrypt the joiner_secret (without PSK) and then derive the
welcome_secret from the joiner-secret.

Case 1: If the welcome_secret is not derived from the PSK, then one can
use the same symmetric-key for encrypting the Group_Info than for
encrypting the Group_Secrets. There is no efficiency loss, since for all
new members, the same symmetric key for encrypting the Group_Secrets is
used. In the case that the welcome_secret does not depend on the PSK, it
is not needed at all.

Disadvantage of this: The PSK does not protect the GroupInfo, as
mentioned by Konrad.

Additional Disadvantage of current version: Performs additional
unnecessary key derivations which do not add security/efficiency.

Case 2: If we want to make the welcome_secret depend on the PSK, we do
not need to make it depend on the group_secrets. Making the
welcome_secret depend on the group_secrets does not add any security.
Instead, we only need to derive it from the PSK and the symmetric-key
which was sent to all group members. In this case, it makes sense that
both, the Group_Secrets and the Group_Info will be encrypted with the
same key rather than different keys. In this case, both the
Group_Secrets and the Group_Info will be protected by the combination of
PSK knowledge and knowing the secret-key for the PKE.

Advantage of this: The PSK protects both the GroupInfo and the GroupSecrets..

Chris

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--------------4AE95F2C8EC372645BC754AD-- From nobody Mon Aug 3 17:50:27 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 551323A11C1 for ; Mon, 3 Aug 2020 17:50:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.199 X-Spam-Level: X-Spam-Status: No, score=-0.199 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id omSrSJp3ALKw for ; Mon, 3 Aug 2020 17:50:24 -0700 (PDT) Received: from mail-qv1-xf33.google.com (mail-qv1-xf33.google.com [IPv6:2607:f8b0:4864:20::f33]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 384E13A11BF for ; Mon, 3 Aug 2020 17:50:24 -0700 (PDT) Received: by mail-qv1-xf33.google.com with SMTP id l13so11915206qvt.10 for ; Mon, 03 Aug 2020 17:50:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=dXcvg3PtiUphGR8EOtqT3oqfWffUq979KCAAbAGLXO8=; b=cEqEf7t1LTbEMYDKYmaMXjUYnN/jRw7+1b1/ACIzybkJZNy7kLUgzQ64kxSzGJYvNN +pFqh031QQnH1XzY2vSxn4WdpzHTHQiJlaujM53zqYO9wj+zTT/bwqdhtyzmsHHjtONT 5rVlbT66UTP97ioDXtFU24Wz8+Wn/HMhhjJXc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=dXcvg3PtiUphGR8EOtqT3oqfWffUq979KCAAbAGLXO8=; b=H1t/D/gpSPsNbe4z+B+1KfTxdhINYi9ZBfkts716gyusGNDZG1BEt14ywJRLNkbI8E zxBWI4aD1THWar5FANmGLRp9tc1LoNiDSoH7NPEdmHB4nBu3iNcQhTn3mE6P5lIAQWfc M0mML+Yfv6yHg9j1D+os/7tE55hUX0nRXsxCNTPbFRiK0g9/WkA8TcWsraukhvwPXyN2 gnJPHm1pI5GSXs3eV0IKopX6m9Yz1dXfY9/jkN5f0DEXy/aMWNxSgN+t6nK0bUkm/KGB YmXIrZcE+ji3WWHqMXKGRFbU4xRcwg1EgCLJjVASejNQDX316Q2dYbXWJ1lAgr7xZumu 91KA== X-Gm-Message-State: AOAM530qb0/4MYty+h43d1gLoQvHZcN7n66dYyu3O6AaffltVenzZUJi gTT0JtMUNFB3P37lSUeeFGphBh35mms= X-Google-Smtp-Source: ABdhPJxPcADdP4dAUTm5zMtSHZR/1D+rrnXxDeDaPOqwgZL89fxruUTwn3HHWMEQbuIoDeuOePGdZQ== X-Received: by 2002:a0c:aac8:: with SMTP id g8mr19768583qvb.70.1596502222621; Mon, 03 Aug 2020 17:50:22 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id z24sm18362550qki.57.2020.08.03.17.50.21 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Aug 2020 17:50:21 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Message-Id: <9555E0C5-E37F-4449-AD3C-CAFC63C37787@sn3rd.com> Date: Mon, 3 Aug 2020 20:50:20 -0400 To: MLS List X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: [MLS] Upcoming Virtual Intrerims X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 00:50:25 -0000 As discussed at the MLS@IETF108 session, I went ahead and requested 4 = additional virtual interims: 11 August 25 August 08 September 22 September @ 1600 UTC, which is the same time as the previous virtual interims. = Webex details to follow later. spt= From nobody Tue Aug 4 07:36:20 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9DF03A0C0F for ; Tue, 4 Aug 2020 07:36:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id S_9zBchFHSTy for ; Tue, 4 Aug 2020 07:36:17 -0700 (PDT) Received: from mail-qt1-x835.google.com (mail-qt1-x835.google.com [IPv6:2607:f8b0:4864:20::835]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C71F23A0C08 for ; Tue, 4 Aug 2020 07:36:15 -0700 (PDT) Received: by mail-qt1-x835.google.com with SMTP id t23so27897747qto.3 for ; Tue, 04 Aug 2020 07:36:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=uzjutMb8ebVc4eN/LNLfUKF0PuvMsKU0A0aNPb+w2i0=; b=wJeabpVvKmtU5Do5JBn06OeFBTQ5olKTWJbjt/i62BIB5JYl7qRCd3DLwlJOG/mya+ lGRYEW0vTBd7H2GH4p6XNT3qF41dMN3ZViEXPm1HmTVggx68hqTLLQ3ixf7xaKX3D6VH b8qUqkmjkHXwBiRyYo7TTSBLZGuVlb4nuafBjFX/EL+TkP8l8D4WaThG2tvPv6K1DXEZ N/vD2qdLV+ZUlcGWBk0FBW3cHQdRioZBJ46ahsqxtvUI48DYgkV45HTjv0PnB/gIlHb0 uyAKFrcV8sCPaytrKr3voM/gGrYmK4ld9MgO57aAhGWoWjNifZcpX0VgJQMSlo5nlKZ2 BOxw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=uzjutMb8ebVc4eN/LNLfUKF0PuvMsKU0A0aNPb+w2i0=; b=GqFX5EqQCU6Bhnnhqs9e/RgBCBCkgMiMMVZt0IQN8W6lGeODbeUTI5Aa4VbdMPGY/h 6cjHgo09tA3Vxj/dCus++Q0iiGX7uYEgbt5Vm1VfCOCajUYKqaoWo9ihsZXTU5L6+vV/ blFAjVpCaEnDqwnMzDh7gt1uSTDK9VYFjkH9hGI1PCwVASAgsq1ZVYGSJ1zDCYHTfYn1 Pyft4DjSk3q31Ccwu0i8UmmirEBLmEluMOIQDQdTIIB+Blo39W/5kCYTQfgHMzyQTbG0 8LTiGE9H9uK2Flh+lY/949xKEqJX9+e3Es5qdUgM7Qay7cKx+OmLd6qz3MKwwrNV7KMa CC5Q== X-Gm-Message-State: AOAM533ESlELlR4wLtSsdYxs4ukucZIaa5ZKcFN6IfW0eKQ7d6yZ/h8P Zqzgtq77tVjAluJ2N+1/WNeuNlcBpMojw00PiaNVQg== X-Google-Smtp-Source: ABdhPJzSt9pw0J88JcDbBajjy7T+fu4Va8P4L9olaDQa4MVwuC+XpuKSylZqpIzgJw2doOgMbhKsWR8gfCXIGkJqoiU= X-Received: by 2002:aed:34e2:: with SMTP id x89mr21624168qtd.313.1596551774494; Tue, 04 Aug 2020 07:36:14 -0700 (PDT) MIME-Version: 1.0 References: <22342_1596495550_5F2896BD_22342_209_1_CAL02cgSY3tGA+eQOspjr0v88UPCJke5hgmDg63p3Pn7deCCTsg@mail.gmail.com> In-Reply-To: From: Richard Barnes Date: Tue, 4 Aug 2020 10:36:01 -0400 Message-ID: To: Chris Brzuska Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000627ff005ac0e2da5" Archived-At: Subject: Re: [MLS] welcome_secret X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 14:36:19 -0000 --000000000000627ff005ac0e2da5 Content-Type: text/plain; charset="UTF-8" In the GroupSecrets struct... struct { opaque joiner_secret<1..255>; optional path_secret; } GroupSecrets; ... the joiner_secret is the same for all joiners, but the path_secret is potentially different for each joiner. On Mon, Aug 3, 2020 at 7:36 PM Chris Brzuska wrote: > Hi Richard, > > >>> I think you might be misunderstanding the encryption of the Welcome > message a bit. The GroupSecrets are encrypted with HPKE to the public keys > of the new joiners; there's no shared key for the GroupSecrets. > > Thanks for helping to address my concerns - my understanding is that we > use hybrid public-key encryption to encrypt the same symmetric-key to all > new joiners and then use this (same) symmetric-key to encrypt the > group_secrets, so we do not need to perform the encryption under the > symmetric-key multiple times. I.e., the public-keys are different, but the > symmetric-key is the same. Quote from the current document: > "In order to allow the same Welcome message to be sent to all new members, > information describing the group is encrypted with a symmetric key and > nonce randomly chosen by the sender. This key and nonce are then encrypted > to each new member using HPKE." > > This symmetric-key is just shared between the joiners, since it was given > to all of them via HPKE key transport. Did I get this right, or are we > using a different symmetric-key in each HPKE? > > ack re the rest for now, trying to resolve the clarification issue first. > > Chris > On 04/08/2020 01:58, Richard Barnes wrote: > > Hi Chris, > > I think you might be misunderstanding the encryption of the Welcome > message a bit. The GroupSecrets are encrypted with HPKE to the public keys > of the new joiners; there's no shared key for the GroupSecrets. > > Still, HPKE does make it possible to supply a PSK. So you could provide > the PSK ID on the outside of the Welcome, then use the (combined) PSK as a > PSK for the GroupSecrets decryption *and* for the key schedule. A few > observations about that, though: > > 1. It would be marginally more efficient, since you're giving the same PSK > IDs to everyone > 2. It would leak to the DS the PSK IDs for the PSKs in use > 3. If you have multiple PSKs, you would need to combine them *and* combine > their IDs, since HPKE only has a single PSK input / PSK ID input > 4. Would you want separate derived PSKs for HPKE and for the key schedule? > > On the other hand, if you don't use the PSKs with HPKE (just with the key > schedule / GroupInfo decryption), then you do leak the member_secret and a > path_secret to someone who has compromised an init_key, but if they don't > know the PSK, they still can't join the group. > > For me, while including the PSK at the HPKE stage does seem like it would > add some conceptual cleanness, the additional complexity seems a bit > daunting, and I don't live the privacy leak. > > --Richard > > > On Fri, Jul 31, 2020 at 3:22 AM Chris Brzuska > wrote: > >> Hi all, >> >> I think that the current derivation of the welcome_secret (used to >> encrypt the Group_Info) performs additional operations which are not >> needed, and its use is not optimal from a security perspective (and not >> necessary from an efficiency perspective). In the current version, we >> encrypt the joiner_secret (without PSK) and then derive the >> welcome_secret from the joiner-secret. >> >> Case 1: If the welcome_secret is not derived from the PSK, then one can >> use the same symmetric-key for encrypting the Group_Info than for >> encrypting the Group_Secrets. There is no efficiency loss, since for all >> new members, the same symmetric key for encrypting the Group_Secrets is >> used. In the case that the welcome_secret does not depend on the PSK, it >> is not needed at all. >> >> Disadvantage of this: The PSK does not protect the GroupInfo, as >> mentioned by Konrad. >> >> Additional Disadvantage of current version: Performs additional >> unnecessary key derivations which do not add security/efficiency. >> >> Case 2: If we want to make the welcome_secret depend on the PSK, we do >> not need to make it depend on the group_secrets. Making the >> welcome_secret depend on the group_secrets does not add any security. >> Instead, we only need to derive it from the PSK and the symmetric-key >> which was sent to all group members. In this case, it makes sense that >> both, the Group_Secrets and the Group_Info will be encrypted with the >> same key rather than different keys. In this case, both the >> Group_Secrets and the Group_Info will be protected by the combination of >> PSK knowledge and knowing the secret-key for the PKE. >> >> Advantage of this: The PSK protects both the GroupInfo and the >> GroupSecrets.. >> >> Chris >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > > _______________________________________________ > MLS mailing listMLS@ietf.orghttps://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000627ff005ac0e2da5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
In the GroupSecrets struct...
st=
ruct {
  opaque joiner_secret<1..255>;
  optional<PathSecret> path_secret;
} GroupSecrets;

... the joiner_secret= is the same for all joiners, but the path_secret is potentially different = for each joiner.


<= div dir=3D"ltr" class=3D"gmail_attr">On Mon, Aug 3, 2020 at 7:36 PM Chris B= rzuska <chris.brzuska@aalto.fi= > wrote:
=20 =20 =20

Hi Richard,

>>> I think you might be misunderstanding the encryption of the Welcome message a bit.=C2=A0 The GroupSecrets are encrypted wi= th HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets.

Thanks for helping to address my concerns - my understanding is that we use hybrid public-key encryption to encrypt the same symmetric-key to all new joiners and then use this (same) symmetric-key to encrypt the group_secrets, so we do not need to perform the encryption under the symmetric-key multiple times. I.e., the public-keys are different, but the symmetric-key is the same. Quote from the current document:

"In order to allow the same Welcome message to be sent to all new members, information describing the group is encrypted with a symmetric key and nonce randomly chosen by the sender. This key and nonce are then encrypted to each new member using HPKE."

This symmetric-key is just shared between the joiners, since it was given to all of them via HPKE key transport. Did I get this right, or are we using a different symmetric-key in each HPKE?

ack re the rest for now, trying to resolve the clarification issue first.

Chris

On 04/08/2020 01:58, Richard Barnes wrote:
=20
Hi Chris,

I think you might be misunderstanding the encryption of the Welcome message a bit.=C2=A0 The GroupSecrets are encrypted with HPKE to the public keys of the new joiners; there's no shared key for the GroupSecrets.

Still, HPKE does make it possible to supply a PSK.=C2=A0 So yo= u could provide the PSK ID on the outside of the Welcome, then use the (combined) PSK as a PSK for the GroupSecrets decryption *and* for the key schedule.=C2=A0 A few observations about that, though:

1. It would be marginally more efficient, since you're giving the same PSK IDs to everyone
2. It would leak to the DS the PSK IDs for the PSKs in use
3. If you have multiple PSKs, you would need to combine them *and* combine their IDs, since HPKE only has a single PSK input / PSK ID input
4. Would you want separate derived PSKs for HPKE and for the key schedule?

On the other hand, if you don't use the PSKs with HPKE (just with the key schedule / GroupInfo decryption), then you do leak the member_secret and a path_secret to someone who has compromised an init_key, but if they don't know the PSK, they still can't join the group.

For me, while including the PSK at the HPKE stage does seem like it would add some conceptual cleanness, the additional complexity seems a bit daunting, and I don't live the privacy leak.

--Richard


On Fri, Jul 31, 2020 at 3:2= 2 AM Chris Brzuska <chris.brzuska@aalto.fi> wrote:
Hi all,

I think that the current derivation of the welcome_secret (used to
encrypt the Group_Info) performs additional operations which are not
needed, and its use is not optimal from a security perspective (and not
necessary from an efficiency perspective). In the current version, we
encrypt the joiner_secret (without PSK) and then derive the
welcome_secret from the joiner-secret.

Case 1: If the welcome_secret is not derived from the PSK, then one can
use the same symmetric-key for encrypting the Group_Info than for
encrypting the Group_Secrets. There is no efficiency loss, since for all
new members, the same symmetric key for encrypting the Group_Secrets is
used. In the case that the welcome_secret does not depend on the PSK, it
is not needed at all.

Disadvantage of this: The PSK does not protect the GroupInfo, as
mentioned by Konrad.

Additional Disadvantage of current version: Performs additional
unnecessary key derivations which do not add security/efficiency.

Case 2: If we want to make the welcome_secret depend on the PSK, we do
not need to make it depend on the group_secrets. Making the
welcome_secret depend on the group_secrets does not add any security.
Instead, we only need to derive it from the PSK and the symmetric-key
which was sent to all group members. In this case, it makes sense that
both, the Group_Secrets and the Group_Info will be encrypted with the
same key rather than different keys. In this case, both the
Group_Secrets and the Group_Info will be protected by the combination of
PSK knowledge and knowing the secret-key for the PKE.

Advantage of this: The PSK protects both the GroupInfo and the GroupSecrets..

Chris

_______________________________________________
MLS mailing list
MLS@ietf.org<= /a>
https://www.ietf.org/mailman/listinfo/mls 

_______________________________________________
MLS mailing list
MLS@ietf.org
htt=
ps://www.ietf.org/mailman/listinfo/mls
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000627ff005ac0e2da5-- From nobody Tue Aug 4 09:18:16 2020 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6F6243A0BA5; Tue, 4 Aug 2020 09:18:14 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.12.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159655789419.5797.3838492726915964282@ietfa.amsl.com> Date: Tue, 04 Aug 2020 09:18:14 -0700 Archived-At: Subject: [MLS] Messaging Layer Security (mls) WG Virtual Meeting: 2020-08-11 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 16:18:14 -0000 The Messaging Layer Security (mls) WG will hold a virtual interim meeting on 2020-08-11 from 12:00 to 13:00 America/New_York (16:00 to 17:00 UTC). Agenda: Github Issues and PRs: https://github.com/mlswg/mls-protocol Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mdaa4ebc77710077eff46ec3d66f2deee From nobody Tue Aug 4 09:18:37 2020 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 7EEBE3A0D3F; Tue, 4 Aug 2020 09:18:30 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.12.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159655791049.13242.3247569164058099902@ietfa.amsl.com> Date: Tue, 04 Aug 2020 09:18:30 -0700 Archived-At: Subject: [MLS] Messaging Layer Security (mls) WG Virtual Meeting: 2020-08-25 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 16:18:36 -0000 The Messaging Layer Security (mls) WG will hold a virtual interim meeting on 2020-08-25 from 12:00 to 13:00 America/New_York (16:00 to 17:00 UTC). Agenda: Github Issues and PRs: https://github.com/mlswg/mls-protocol Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mdaa4ebc77710077eff46ec3d66f2deee From nobody Tue Aug 4 09:18:55 2020 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 29DA43A0E52; Tue, 4 Aug 2020 09:18:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.12.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159655792514.14845.7044546458266979097@ietfa.amsl.com> Date: Tue, 04 Aug 2020 09:18:45 -0700 Archived-At: Subject: [MLS] Messaging Layer Security (mls) WG Virtual Meeting: 2020-09-08 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 16:18:51 -0000 The Messaging Layer Security (mls) WG will hold a virtual interim meeting on 2020-09-08 from 12:00 to 13:00 America/New_York (16:00 to 17:00 UTC). Agenda: Github Issues and PRs: https://github.com/mlswg/mls-protocol Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mdaa4ebc77710077eff46ec3d66f2deee From nobody Tue Aug 4 09:19:02 2020 Return-Path: X-Original-To: mls@ietf.org Delivered-To: mls@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 342073A0EC5; Tue, 4 Aug 2020 09:18:53 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IESG Secretary To: "IETF-Announce" Cc: mls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.12.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <159655793317.2761.14235942465480575514@ietfa.amsl.com> Date: Tue, 04 Aug 2020 09:18:53 -0700 Archived-At: Subject: [MLS] Messaging Layer Security (mls) WG Virtual Meeting: 2020-09-22 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 04 Aug 2020 16:18:58 -0000 The Messaging Layer Security (mls) WG will hold a virtual interim meeting on 2020-09-22 from 12:00 to 13:00 America/New_York (16:00 to 17:00 UTC). Agenda: Github Issues and PRs: https://github.com/mlswg/mls-protocol Information about remote participation: https://ietf.webex.com/ietf/j.php?MTID=mdaa4ebc77710077eff46ec3d66f2deee From nobody Wed Aug 5 06:27:24 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CDA4E3A0143 for ; Wed, 5 Aug 2020 06:27:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JtgwUi8Te8UU for ; Wed, 5 Aug 2020 06:27:19 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B31D63A077E for ; Wed, 5 Aug 2020 06:27:15 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 501B41158B5_F2AB3AFB for ; Wed, 5 Aug 2020 13:27:11 +0000 (GMT) Received: from exng3.org.aalto.fi (exng3.org.aalto.fi [130.233.223.22]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng3.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 899141158B3_F2AB3AEF for ; Wed, 5 Aug 2020 13:27:10 +0000 (GMT) Received: from exng4.org.aalto.fi (130.233.223.23) by exng3.org.aalto.fi (130.233.223.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Wed, 5 Aug 2020 16:27:10 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Wed, 5 Aug 2020 16:27:10 +0300 From: Cornelissen Eric To: "mls@ietf.org" Thread-Topic: Potential issues with "add-only" commits in young groups Thread-Index: AQHWaysOYLkshmHVlE2/Q1XWhkDVcg== Date: Wed, 5 Aug 2020 13:27:10 +0000 Message-ID: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: yes X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/mixed; boundary="_005_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:subject:date:message-id:content-type:mime-version; s=its18; bh=wW2vfpILo8Pm02V/n8oLfFQDZQTzcCdm4oyreZ00uE4=; b=cjl09kb5e+An0MtOFBMrDIhoO1c6ruOS1WlIbiE9Ks5HItvFyxs4EiBwuVlLClKIYDzlvH28NA5zj48sFKzbHTU8ehVrXAQlSMaTv1IqWuwaYpfE8kvCuKIzW16/Klb4fMzoxtYpTiFq8K7yTrIHNMZ33Wn85epeiIPLbSTsBvoSYvmMFP+1HpVMtew7HAN4HKAdyCHXgE+TrIcDkWc/qvWwsCqlE9PuTi8uGQedIGGi09gMXMJykt6jU02yT2FPZMPBNP6KELtEo32wlOXaC7C5OgkZxAgwt+NlxhipCk0A0CmYJbiMKUdsUGHNKhV52V1vVsy2p7lfoT1I2+QuQg== Archived-At: Subject: [MLS] Potential issues with "add-only" commits in young groups X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Aug 2020 13:27:22 -0000 --_005_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_ Content-Type: multipart/alternative; boundary="_000_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_" --_000_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Hi All, Quick introduction: my name is Eric, I have submitted a few issues in the M= LS GitHub and I did an analysis of MLS for my Master's thesis last academic= year, now I'm doing a research project related to MLS with C. Bruzska. During this project I found a potential issues with "add-only" commits if u= sed in the early lifetime of a group. I found two particular issues that I = think are most important to look at and which I will describe both here. Note 1: Neither of the issues I describe hold when a PSK is used, hence I w= ill only consider scenarios where PSKs are not used. Note 2: In both attacks the attacker must record the (encrypted) Welcome me= ssage(s) send out for a group (i.e. I'm assuming a network adversary). Note 3: I use "add-only" commit to denote an commit that does not populate = the path value of a commit and "full" commit to denote a commit that does p= opulate the path vale of a commit. This, I suppose, deviates slightly from = the draft. Note 4: I attached diagrams explaining the attacks, I hope they are underst= andable :) 1. When using an "add-only" commit for the first commit (see attachment = 01.jpg for a diagram) The first issue is w.r.t. using an "add-only" commit as the very first comm= it of a new group. To the best of my knowledge this would result in the inp= ut to the key schedule being to two all-zero vectors. Namely, the init_secr= et for the first commit is always the all-zero vector and the commit_secret= will be an al-zero vector because an "add-only" commit was used. Now, this would allow ANYONE to derive the joiner_secret and welcome_secret= for the first commit. With the welcome_secret we can decrypt the Welcome m= essage for the user(s) being added to the group. From the Welcome message w= e can construct the GroupContext that is used in the key schedule (GroupCon= text_[n] is a subset of the GroupInfo in the Welcome message). With all this information ANYONE can compute all of the keys produced by th= e key schedule for the first epoch and read any communication that happens = in this epoch. Furthermore, if another "add-only" commit is used the input = to the key schedule for the next epoch is also known to the attacker(!) as = commit_secret will again be an al-zero vector, and we know the init_secret. 1. When using a "Full" commit followed by "add-only" commits (see attach= ment 02.jpg for a diagram) The second issue arises from the fact that "add-only" commits allow new gro= up members (ONLY) to learn the value at the root of the TreeKEM tree in som= e earlier epoch E. In general this is not a problem, because they won't kno= w the init_secret for epoch E-1. However, if only the very first commit for= a group is a "full" commit new group members do know the init_secret for e= poch E-1, as it is always the all-zero-vector. >From here the attack proceeds very similarly to the other attack. Imagine a= group is created by Alice. Alice adds Bob to the group with a "full" commi= t (hence init_secret =3D 0 and commit_secret =1B$B!b=1B(B 0). Next, Alice a= dds Charlie to the group with an "add-only" commit (not updating the TreeKE= M tree). Next, Alice adds Eve to the group also with an "add-only" commit (= again not updating the TreeKEM tree). At this point, Eve learn sthe value at the root of the TreeKEM tree. Since = this hasn't changed since the first epoch, Eve can find the commit_secret f= or the first commit of the group. This, together with the fact that init_se= cret is the all-zero vector, allows Eve to compute the joiner_secret and we= lcome_secret for the first commit. Hence, Eve can now carry out the attack = described first to obtain all the keys for the epoch in which Bob was added= . Furthermore, because the commit_secret for the next commit is the all-zero = vector, Eve can compute the joiner_secret and welcome_secret for the second= commit as well. Hence, Even can carry out the attack described first again= . In fact, even is able to do this until she reaches the commit in which sh= e was added herself. I believe the easiest way to mitigate these attacks (and any attacks like i= t) is by requiring that the init_secret of the first commit is a randomly s= ampled value. Alternatively, the first two commits of a group could be requ= ired to be "full" commits. Eric. --_000_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_ Content-Type: text/html; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable

Hi All,


Quick introduction: my name is Eric, I have submitted a few issues in th= e MLS GitHub and I did an analysis of MLS for my Master's thesis last acade= mic year, now I'm doing a research project related to MLS with C. Bruzska.<= /p>


During this project I found a potential issues with "add-only"= commits if used in the early lifetime of a group. I found two particular i= ssues that I think are most important to look at and which I will describe = both here.


Note 1: Neither of the issues I describe hold when a PSK is used, hence = I will only consider scenarios where PSKs are not used.

Note 2: In both attacks the attacker must record the (encrypted) Welcome= message(s) send out for a group (i.e. I'm assuming a network adversary).

Note 3: I use "add-only" commit to denote an commit that does = not populate the path value of a commit and "full" commit to deno= te a commit that does populate the path vale of a commit. This, I suppose, deviates slightly = from the draft.

Note 4: I attached diagrams explaining the attacks, I hope they are unde= rstandable :)


  1. When using an "add-only" commit for the first commit (see att= achment 01.jpg for a diagram)

The first issue is w.r.t. using an "add-only" commit as the ve= ry first commit of a new group. To the best of my knowledge this would resu= lt in the input to the key schedule being to two all-zero vectors. Namely, = the init_secret for the first commit is always the all-zero ve= ctor and the commit_secret will be an al-zero vector because an "a= dd-only" commit was used.


Now, this would allow ANYONE to derive the joiner_secret and welcome_secret for the first commit. With the welcome_secr= et we can decrypt the Welcome message for the user(s) being added = to the group. From the Welcome message we can construct the GroupContext th= at is used in the key schedule (GroupContext_[n] is a subset of the GroupInfo in the Welcome message).


With all this information ANYONE can compute all of the keys produced by= the key schedule for the first epoch and read any communication that happe= ns in this epoch. Furthermore, if another "add-only" commit is us= ed the input to the key schedule for the next epoch is also known to the attacker(!) as commit_secret w= ill again be an al-zero vector, and we know the init_secret.


  1. When using a "Full" commit followed by "add-only" c= ommits (see attachment 02.jpg for a diagram)

The second issue arises from the fact that "add-only" commits = allow new group members (ONLY) to learn the value at the root of the TreeKE= M tree in some earlier epoch E. In general this is not a problem, because t= hey won't know the init_secret for epoch E-1. However, if only the very first= commit for a group is a "full" commit new group members do know = the init_secret for epoch E-1, as it is always the all-zero-ve= ctor.


From here the attack proceeds very similarly to the other attack. Imagin= e a group is created by Alice. Alice adds Bob to the group with a "ful= l" commit (hence init_secret =3D 0 and commit_secr= et =1B$B!b=1B(B 0). Next, Alice adds Charlie to the group with an "ad= d-only" commit (not updating the TreeKEM tree). Next, Alice adds Eve t= o the group also with an "add-only" commit (again not updating th= e TreeKEM tree).


At this point, Eve learn sthe value at the root of the TreeKEM tree. Sin= ce this hasn't changed since the first epoch, Eve can find the commit_secret for the first commit of the group. This, tog= ether with the fact that init_secret is the all-zero vector, allows Eve to compute = the joiner_secret and welcome_secret for the first co= mmit. Hence, Eve can now carry out the attack described first to obtain all= the keys for the epoch in which Bob was added.


Furthermore, because the commit_secret for the next com= mit is the all-zero vector, Eve can compute the joiner_secret and welcome_secret for the = second commit as well. Hence, Even can carry out the attack described first= again. In fact, even is able to do this until she reaches the commit in wh= ich she was added herself.



I believe the easiest way to mitigate these attacks (and any attacks lik= e it) is by requiring that the init_secret of the first commit is a randomly sampled valu= e. Alternatively, the first two commits of a group could be required to be = "full" commits.


Eric.


--_000_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_-- --_005_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_ Content-Type: image/jpeg; name="01.jpg" Content-Description: 01.jpg Content-Disposition: attachment; filename="01.jpg"; size=241012; creation-date="Wed, 05 Aug 2020 13:24:08 GMT"; modification-date="Wed, 05 Aug 2020 13:24:08 GMT" Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkI CQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQ EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCAdMBlYDASIA AhEBAxEB/8QAHgABAAICAwEBAQAAAAAAAAAAAAcIBQYDBAkCAQr/xABwEAABAwMCAwMECgsHDA8G AgsAAQIDBAUGBxEIEiEJEzEUFSJBFhcYMjhRVmGU0SNVV1hxgYWWtdLTM0JSkZWltCQ2N2JydoaS obGysyU0NUNTWXR1d4KDhJOkpxk5Y3OiwSZEZLbC1FSjRcOm8PH/xAAbAQEAAgMBAQAAAAAAAAAA AAAAAwQBAgUGB//EAEARAQABAgIFCAcGBgIDAQEAAAABAgMEERIhMVGRBRMUQVJhcdEVMjOBobHB IkJTctLwIzRikqLhgrJDwvHiJP/aAAwDAQACEQMRAD8A9UwAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHktxB9rVxG6T 6453pnjuFab1Nrxe/wBbaqOattte+ofFDK5jXSOZWNarlRE3VGom/qQj/wD9tXxT/IHSr+Srj/8A vwHtSDxW/wDbV8U/yB0q/kq4/wD78ehtszjWXiT4CFzjDmMtmpGZ4tNNb0sNW+3JDWq9zWdxLJLz Q+998snTr1As4Dzx4BdF+0A0/wBbqy+cT2R5jXYi/H6qnhiu+cNu8CVrpoFjVIEqZdncjZdn8vRF VN+vX0OAAAAAAABT/jd7Q6z8HOU43hkGm/szut8oJbnUxee/N/kUCSd3C79wm5+8c2b+Dt3Xr36B cAHRsdy882W33jue58upYqnu+bm5OdiO5d9k323232Q7wAAAAAAAAAAAAAAAAAAAAAAAAAFNO0Y0 x4wNSKTAWcJ16yW3y2+S5rffMuVJZVe16U3k/eKs8Xe7Kybb33Luvhzdd/4DcJ4hcB0MfYeJm5Xq uzFb3VzpLdr6l2n8kcyJIk79JZPR3R+zebp16JuBYwFP+N3tDrPwc5TjeGQab+zO63ygludTF578 3+RQJJ3cLv3Cbn7xzZv4O3devfpbKx3LzzZbfeO57ny6liqe75ubk52I7l32TfbfbfZAO8AaHrza M4v+ied2PTKoq4Mur8dr6axy0lZ5JOyufA9IVjn5m905Hq3Z/M3lXrugG+A85OBXRLtDMD14hv8A xKZLmlbhjbTWQviuudtu0HlLkb3S9wlVJuvR2zuXp8aHo2AAAAAAAUt7R/jP1Y4P4tPqjTPH8Uuc eVOujK7z7SVM3dOpkpVi7vuZ4tt+/k35ub3rdtuu/UoONbWKr7OOt4v3Y7iKZhBMvdUKUdV5sdEl 4bQuVY/KO937tXu/dffInq6AXdBR/s4+N3V7jAuud02pOO4jbabFae3yUzrHSVMLnyVDp0VJFmqJ UVNoemyJ6/EvAAAAAAAAVP7T7NMxwDhHv2S4Jll5xu7w3S2Rx19or5aOpYx1Q1HNSWJzXIip0VN+ qFdexx1d1Y1PyDVKHUrU/Lctjt9HaXUjL5eqmvbTue+pR6xpM93IruVu+22/Km/gB6dAAADyD7Wz XHWrTfiYs1h071gzbFrZLhtFVPorLkFXQwPmdV1jXSLHDI1qvVrGortt1RqJ6kPQ7gnyG/5Xwo6Y 5HlF8uF4u1fYYpquvr6l9RUVEiudu6SR6q57vnVVUCbgAAAAAAAAAAAPIDtadcta9N+Jq02DTzWD N8XtkmH0NU+isuQVdDA6Z1VVtdIscMjWq5Ua1FdtuqNRPUgHr+CFOCvIL9lXCnpjkWUXuvvF1uFg gmq66vqX1FRUSKrt3ySPVXPd86qqk1gAAAB51cf3aJa5cKWuNJprgOLYPcLTV4/S3ds15oayWo7y SaeNyc0VTG3l+w9PR38eqm8cVPGtrFoVwm6Ra8YzjuI1V/zqK1LeKa4UdU+jgkqra6qekDWVDHtR Hscicz3+j47r1Au6CsXZ8cTWonFdotdtSdSbPj1tr6PJamz08Vkp54YXU8dNTSI5yTSyuV/PNIm6 ORNmp08VWzoAAAAAAAAAAAACLOKm83fHeGfVW/Y/day2XO3YbeKqjraOd0M9NMykkcySORio5j2u RFRyKioqIqASmDxo7LPXnXLULiuo8cz7WfOsltLrDcZnUF4yKsrKdZGtZyuWOWRzeZN12XbdD2XA AAAAAAI/1+1hs+gOjmV6v32k8spsaoHVLKTvu5WrqHOSOCDvOV3J3kr42c3K7bm32XbYjLgk4v8A 3Y2DX/NPa89iPmO7Ja/JvO3nDvt4WSc/P3MXL7/bbZfDff1AWNBH+v2sNn0B0cyvV++0nllNjVA6 pZSd93K1dQ5yRwQd5yu5O8lfGzm5Xbc2+y7bEZcEnF/7sbBr/mnteexHzHdktfk3nbzh328LJOfn 7mLl9/ttsvhvv6gLGgAAAAAAAAHhHx18RvELiPFtqXjeJ68aiWW0UF2bHSUFuyiupqanZ3ES8scU cqNYm6quyInVVA93AdGxSSTWS3yyyOe99JC5znLurlVibqq+tTvAAAAAAAAAACPOIq6XOycPup16 stxqrfcLfht6qqSrpZnRTU8zKGZzJI3tVHMe1yIqORUVFRFQCQweK/Zja/a759xeY5jWda155kdo nt1zfLb7tklZWU0jmUr3NV0UsjmqqKiKiqnRU3PagAAAAAAAAAAAAAAAAAAAAAAAEecRV0udk4fd Tr1ZbjVW+4W/Db1VUlXSzOimp5mUMzmSRvaqOY9rkRUcioqKiKgEhg8V+zG1+13z7i8xzGs61rzz I7RPbrm+W33bJKysppHMpXuaropZHNVUVEVFVOipue1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfzfcaPwttX/78rr/S Hn9Ctq070/da6NzsFx5VWnjVVW2QfwU/tT+erjR+Ftq//fldf6Q8nSDtf+L6mgjp45ML5ImIxu9k dvsibJ/voHtX7XWn3yEx7+S4P1TQeKTK75pFwyagZhpxUwWO645YairtcsNJC9lNK3q1Uie10aom 69FaqfMeS3/theMH/hcK/kR37U9F9csyvOovZmXjUDIlgW65NpfSXiu7iPkj8oqKOKWTkbuvK3me uybrsgFZuzN41OJniD4h67BdXtSvP9jhxisuLKXzNb6XaoZPTNa/np4GP6Nkem3Nt18OiEndqzxP a8cNkWmM+imd+xxuQOvLLmnmyjrO/WBKNYf9swycvL3svvdt+brvsm1Q+xn+Fpc/7y7h/SaQm7ty v9zdGv8A59//ANGgA0S4dqdr5RcOWDY/jl5p7/q7klTcZrpd3Wmne+koo6l7KZsVLDG2FZXo1ybq xURse6tcr0clueDjimzio4Oso184pcgrKqsxa6XBKyaS1wUc/k8UcKxQthijiar3Pk5W7oiq56Iq 7eEV9i1pLjFBpHlGs9RbKeXIrtfZbLBVvYjpKehghherGOXq3nklertvfd3Hv4JtbbjP0eyHXrhi zzSrE5GJervRQy0DHyIxs09NUxVLIlcvRveLAjN16JzbrsgHnBV9pRx28SOaV1i4X8AZbKWmRZY6 S02Zl0q4YN9mvqp6hrom7r03RjG7rt1XqvXvHHl2lvDRdrdXcQeJeWWyuk5I47/jkFJDU7dXMiqK NsbUkROu27tvFWqhAHDTxRaz8AeoWTWt2BQrNdUgpL/Yb9TS007XQOesTmuTZ0b072REVUc1Uf4L 6Kpdah7V3hT14tVLhfE5oLXUls8qjquWZkV7t8U7EVGyuarY5E2RzvexvXZyp13AtBZ+Jm+cSfBv kWsXDRS1lNmyW6opaO2JFDU1NBeI0aqwcsjVjk6Pa5qubs5j2qqIqqieIfErlmvGXau3Wq4k6qtl zyhip6Kujq6WCmkgjbGjoo+6ga2Nqcj0d6KJvzKq9VVT+hTQul0JXAaS/cO9oxKjxK9L5XFJjVDD S09RJsjFc9sTW/ZE5eVyPTnRW8q7Kmx4ZdpR8N7VH/ltD+j6YD0Q7P7LO0HvWpa2/iapbzHp9Hi8 j7Y6rstupYlqkkp0g2kp4myKvdLLsiqqKm6r1RD0AMJg/wDWXYP+a6X/AFTTNgY7I8iseI4/csqy a5wW602illrq6rndyxwQRtVz3uX4kaiqeSWrXa08QWqmoCYLwnYW230lTULTWpy2rznebiqb7PSF UdHGioiryIx6om6q74rXdrjmVyxTg6udut074fZPfbfZqhzHKirDu+oc3dPUvkyNX40VU9ZVTsRc KtF01H1Lz2rpY5bhj9poLfRve1FWJtZLM6RzfiVUpWt3Trsqp4KoGuXHtBe0g4ccgt0uv+MvqaKv VXxUeR4xFQR1TE252wz0rIvTRFT1u5d28zV32X1A4XOJfBuKrSyl1KwuOWjkbKtHdbXO9HTW6sa1 FdE5U2R7VRzXNeiJzNci7NXdqZPiA4edNOJjBWae6pW+qqbZFWxXCF9JN3M8M7EciOY/Zdt2vc1e nVHKa1w4cImkPCdHkLtK336ODIUp318VxuHlLN4O85HMTlTlXaV6Lt49PiQCAuOvtM7Vw136XSjS uyUOSZ3DE19wnrXuWgtPO3mYx7WKjpZlaqO5Ec1Go5qqqqqtKn2ji27WzOrB7ZOIWDJKjGpWLUQy W/BKWSmli8eaJX07pZWJ19JrneC9SqWm0cnETxYY03N3vqfbCzukdduZ6qr46uuaszUX+5e5E/Ef 0i0tLS0NLDRUVNFT09PG2KGGJiMZGxqbNa1qdERERERE8APL/hH7XW8ZPmlu014mrLaqBLpUNoqX JbfG6mjgncqNa2shc5Wtarl2WVitRnTmZtu5t6OLjN8u014a9Q89wO7+a8gsVllraCs8nin7mRit Xfkla5jum6bOaqdTxm7UfBLLgvGXlzLDRxUlNfqeivb4Ymo1rZ54U75yInrfIx8i/O9T0nzrMLln 3ZSVmXXmd89wuGl8LquZ6qrpZ2wMZJIqr4q5zVcv4QKgcLPaoa0W2vzq9cQmbvzGktmLvqMfssdr oaKStu7qymhhia+ngY7q2V6u35tmNe5GqqIhp2o/aSdolhmVwXHMYpsFp7hvVUdjuGGR0tPLBv8A vHVUS1D2dUTmST1+JrvZO6f2LO+MG0VN/o4qqPFrTW3+milajmeUxrHFE9UX1sdOj2/E5jV9Rfft jMXtV44T4MgqqWN1dYMloZqSfl9NiStkikYi+PK5HNVU8FVjV9SAaRB2tE174a7PkOLYLT3TWy93 SXHoMZpI5Z4fKI2Meta2JirK+FzZY0bGi8yyK5qOVGK4qxX9pxx/6YZ55PqVVMpZ4Htmnxm/4lDQ IkbuqNVEijqWoqeC8+/zqSN2JeAWO9aoah6iXCjinuGL2qiore97UVYFrXzd49m/g7lpuTdOvK9y eCqb124WL2pbPpXmjKWNlzbU3K1yTo1OeSBWwyMa5fWjXI9UT1d474wL+8OGuePcR+jWOavY5TOp Ib1A5Kmie9Hvo6qN6xzQquyb8r2u2dsnM1Wu2TfY8tNeO0I4tdO+LfLNOrXq6lNiVmzJ9BFQusVs ckdClQid0srqdZFRGLtzK7m9e+/UtD2MFXPU8KF8hmkVzKXOK+GJFX3rVo6F+yf9Z7l/GeYHHGx0 nGFq0xvi7KqxE/DzgXH4mO0q4qcjut9yDhfxa52XSvHayShTMY8aWvirnsdyulfUTRPp4Y3L7xmy O2VFcu68rc5wYdrLkF5u10xDipuFtfTU9qq7pQ5DS0jKaZ8lNC6Z9NLEzaN7nsY/u1Y1qq9EZs5X py+kGIaU4biGlFt0aorNTOxqgsrbG6jWNO7np+67uTnT98r93K5V6uVzlXqqn862imnlrzLiTwnS 68bzWy65lQWasRV2V9M6sZHInT1qzm/jAtrrJ2lvHjc3N1Lw/Grhp1p3cJ1ZZqh+KsqKapjVV5Ed W1cL2SyKide7VqeOydC4HZw8fd84p/PGm+qVFb6fN7FSJcYKuhj7qK50XO1j3LHuqMlje+Pm5fRc kiKjW8qlguLTDbBkXChqji1XbKZKCDDblLSwNiRI4JKalfLTq1qdE5JIo3IieHKmx5B9knVz03Gl j0MMitZVWi6wyoi++alM5+y/9ZjV/EBebtWOJ/XPhsotM5tFc49jr8glu7bkvmyjq+/SBKTuv9sx Scu3eye9235uu+ybdrhb174nNbuAXNtSqTJJ8g1Vp6y5UlhqYLXRMkWSNkKxMbA2JsDlRXv98xd9 +u/QiPtyv9zdGv8A59//ANGgJm7HP4Icv99lx/1dOB5G8SuWa8Zdq7dariTqq2XPKGKnoq6OrpYK aSCNsaOij7qBrY2pyPR3oom/Mqr1VVPVfs/ss7Qe9alrb+JqlvMen0eLyPtjquy26liWqSSnSDaS nibIq90suyKqoqbqvVEPO/tKPhvao/8ALaH9H0x764P/AFl2D/mul/1TQM2RtxK5fkWAcPepOc4j cPIL3YMWudyt1V3TJe4qIqZ7438kjXMds5qLs5qovrRSSSHuMb4J+sP95F5/okgFBezg43uKDXvi Up8A1Y1O8+2F9krqt1J5lt1LvNGjOR3PBAx/TdenNsvrQuDxz8atj4O8HttZBZGX7LslfNFZbbJK scLWxI3vaidydUjYr2Jyps56uREVERzm+ZXZAfDFpf727n/mjLS9sZw56j6iWrENYsDsdZfKPFaW roL1SUcbpZqaB7myMqUjburmIqPR6onopyKvTmVoQ1jPFn2tGu1vXOdJ8er2Y/PI/uJLTidF5E/l cqObFJWMkdIiKitXZ7tlRUVd0U2HSLtW9ftKdS2abcYmFNdTRVEdNcqnzUtuu1s59tpnwNRI5Y+V UdytY1VavM1zujVjHhZ7VzP+HrTyzaUZJpnastsFhY6ChmirX0FbFC57n8jn8kjJOVXLt6DV22RV XxLX6f8AGn2dvFZn1vqtW9KrNac1qoordTVGa2Slq6aVEcqshbUrzxonM92yytj6rt8SAeg9HWUl xo4LhQVMdRTVMbZoZonI5kkbk3a5qp0VFRUVFOY69BQUNqoae12uigo6OjiZT09PTxpHFDExEa1j GtREa1ERERETZEREOwB53dsbpTqHqZhWmsmneA5FlNVbLpcG1ENltc9dJDHLDFs57YWuVrVWPbde m52LHpBnsXY+S6Wy4Lf2ZUtkq5vMTrZMlwWZbzJUozyfl7zmVqoqJy77bKehIA83Oxr0j1H0ytmq 9ZqLp7kmLTXWeyx0rL3aZ6F07YW1iuWNJmNVyIsybqnhuhKHH72htNwnTUOn2B2Kiv2fXSk8uc2u c7yO2UznK1kkrWKjpHvVruWNHN2ROZyoitR10ygvHbrHwD6SZ3M/V3Ri26j6l11NDJUUcFMx80EK MRsPlU73I2JFYicrURz9uVVaiORyhWO08VXa3ZzhkmseJ226yYekclU2aixK3OgfCzfnfE2SJ08j E5Xek1XeC9ehYDgF7Ty968ZzSaKa4Wi2UeR3OOTzLebcxYYa2VjFe6CaJVVGSK1rla5qo1ypy8qL tzaNifbCvtGO0GPae8Fda3H7RTR0FBBRZM/uYII2oxkbUZb3IiI1ETbdSh3C5c3P4xdLLlQ0i25t TqJaOWma79wjluEaLFvsnRGuVvgn4AP6ANeda8P4etKr7qzm8ki26ywo5lPCqd9VzvcjYoI0XpzP eqJ8SJu5eiKp5Gu7S/j6151CWx6FUUdBLUK+WlsOP47BcpGQNX30slRHI5dkVOaT0G7rvs3fYsZ2 3OTV1FpPpziEMzm0t2v9VXztRVRHupqdGsRfjT+qXL+HY4uxHwq0U+luoeoqUsa3S4X+KyrMrUV7 Kenp45uVF9SK6pVVRPHlbv4IBA/E9xh66Zfw55Nw7cWmmVXiudSS266WW4Otr6OO6QRVTO9a6Nd2 c6Ju5JI15F5XNVGuRObfOw5/rl1e/wCQ2b/WVZP/AGw+C2bIuFJuYVVLGtzxK/Uc9HUcqd42Oocs EsaL48rueNyp61iavqIA7Dn+uXV7/kNm/wBZVgWb7Qbj+i4S6K3YTgtqobzqBfaZayNlarlpbZSc ysbPK1qo57nua5GMRUT0HOcuyI19L9J+NTtUtRmzag4HjtwzfHaOZySwQ4bTuoZHN6uibJDGyZ7k TorWSK5N0+MgvtJcmrso409Sp6yZzmW+tp7ZTsVV2jigpYo9m/EiuRzl+dyr6z3P4fMKtGnWhmBY VY6WOCktOPUEKIxqJzydy10ki7eLnvV73L63OVfWB4VceHEVQ8Tup+MaiMx+osN2pMTp7NfbTOjt 6G5QVtZ3saK5EVW7PY5N0RUR/KvVFPZngI+BxpN/e7D/AKTjyq7XjBbNhnF7UXGzUsdOuWY9Q32r ZG1GtWoWSene/ZPW7yVHKvrc5VXqqno9w66nQaL9m9iOq1TZ5LrFi2F+cn0UcyROnRjnLyI9UVG7 /HsoFtAeYH/txcW+91uv5yR//u5P9g405NcuB7VTiFxTFarFK3H7feaCjgkrkqHsqoqNjo50e1jN tnztXbb9549egQVxjdrbV4DmVy0u4b7NarrV2id1HcMkuLXT0/lDV2fHSQsciScrk2716q1VReVq ps9YXuPFn2t+L46upmQ2DJYMYijSqlkrMDpY6aODx55NqdsrI9v37lRNtupDXZl4DZdROMvCaPI6 SOso7QlXe1glajmyTU8D3wqqL48s3dv/AOoe/wDNDFURPp6iJksUjVY9j2o5rmqmyoqL4oqeoCgv At2n9JxD5RTaRaw2O349mdax3mqvoHObQXR7UVVhVj3OdDNyoqtTmc1+zkTlXla6YO0X1g1L0L4Z rjqJpPk3mK/Ul2oIG1fkdPVfYZZOR7eSeN7Ou6deXdNuinirrTRLoFxZ5fBgi+RNwfOKqeypGvL3 DKesWSnaip/BRrE/Eeu/ayVDKvglvNXFvyTXW0SN38dlnaqAVY4c+1T1ZtGlWoN41evS6h5x5wtN twmzMttNSOmmqG1Xeue2kiY58bFijVU2VyucxjVbz8yRpnnaNdo7p9klPW5/5Xh8VdvPS2e64TFR QSxoqbpGtRCk7mJuibpIq9fE2/sWdNMdyfWXM9RLzQw1Vbh1op4rZ3rUclPPVvka6ZvxPSOF7EX4 pXF0O1ixCzZFwWZVfLjRxSVmL19ruVvlc1FdFLJWw0z9l8U3jqJEX4+gG08B3GPScYGmddeLnaaa 0ZdjU8dJfaGmc5YF7xqrDUQ8yq5scnJInK5VVro3puqbKvnJ2zvwsLN/eRQf0utN17EOsqGaralW 9sipBNj1LM9m/RXsqdmr+JJHfxmlds78LCzf3kUH9LrQLnYzddY8c7K3FMw0IyiSyZbjWJU94ikZ Q01X39NA5zqmJY6iORvWHvHJs3m5mNRF6qRF2Z/HzrbrXrlcNKdeM8jv7LvZ5amxOW2UVG6Orp1R 8kaeTRR83NCsrl5t9u5TbbdS43ApTwVfBnpVS1ULJoZsYhjkje1HNe1eZFaqL0VFTpseNub2W6cC fHWrqKKdtFhGUw3OgRN+aps0rkkbHzetXUsixOVP33MnqA95tVM+tulemmU6k3jlWkxi0Vd1kYq7 d53MTnoxPncqI1PjVUPKfgf4zOODiT4lsY09vOsTpscZJJdr9FHjtqYnm+BOZ8avbTI9qSPWOHmR yOTvUVFRepY/tdNZ6PHOFK3YpYLkyV+plypoYpIndJbdCiVUkjV9aK5KZvzpIppHYsaKeYtO8t14 utJy1WT1aWS1Pe3qlFTLzTPav8F87kavz0wEddr5ofq5qHxBYpkuneleX5RRtw6ChnqbLY6mtiil ZW1b+R7oWORruWVq7Ku+yoTN2h+kOe5XwGaXYXhuC3++3vHq+wLNbbZbJqqqiZFaqiB6uijar0Rr ntRd06LtuehIAp12VGnuX6b8KrLNnGJ3jHLrVZHcKx9DdaGWkqEYqRMa5Y5WtciKkfRdupcUADB5 vmeOadYfes8y64NobLYKGa4V1Q5N+SGJqudsidXO2TZGp1VVRE6qeSOU9qRxfa/akewbhXwmGzx1 UkiWyjprXHcrpNE3dVlmdKjoWJypzLsxGs6ornbcx6pa2y6UU+lWR1OuPmxcFgpO+vSXJFdTuhY9 rmo5qdXqr0YjWIiq5ytaiKqoi+YNl7RnhF0VzuounDHwX95XTQvtzbmlXHa6ipgc5rnNbGyKodyu dG1dlVF6JuidUA1y59oV2iXDHmtBauIzHqe4MqmJUJbr3ZKaj8qp+bZywVFE1jeZPDm9NGrtu1fB fVfQLW3EuIjSew6t4X3sdvvULlfTTKnfUlQxyslgk26czHtVN/BU2cnRUPF3j1407vxaWbDqO9aC 1uAyY1U1ksNVVXN9WtS2dkSOjbzUsPLt3TVXZXb9OiF7OxcqZ5+FO/xSyK5tNnVfFEir71q0NC7Z P+s5y/jArHxZ9oLxcaScU+c6fYpq35FjNivbYaWhWw2yXu6ZWRv5O8kpnSL0cqbq5V+ckjiR7Rri bzbLshsXBfgF2q8PxOpko63LaDG5Lu6plj9/IirG+CGHx5eZquc1Efu1HcqUr7Qz4aOq3/PLf6PE e8OgemmO6QaNYfp3i9DDTUVntFNE7u2oizTqxHTTO28XySK97l9auUDyw4Xu101ktuoVqxviOrbb kWLXWqjpKq7Mt8NFWWzncjUn2gayN8bVXd7VZzbIqou6crvXnKcosOFYxdcyye5RUFnstFNcK6qk X0IaeJive9dvHZqKvTqp/P72jOIWbB+NPU+x2CjipaOSvpLkkUbUa1stXRU9TLsidE3kmev4z0v4 /Mzu1t7NWGpiqZG1OSWvHKKolRy8ytkWCWTr/bJGrV+NHKBUbVHtYuKbVfUT2OcN1rbjlvq6paWy 0NLZorpdq7ddmLIkrJWrI7x5I2ej4bv25l2zKuNPi2xHSHONJONfSu5W+jzrErxa7Fksll8helwf RSpFDIkSJBIjncrdmta9iuRzt2+Gv9inhVovOueaZrX0sc1XjePMhoVe1F7mSqmRrpG/E7kiezf+ DI5PWei/Hpgtmz/hC1St15pY5UtePVd9pXuaiuhqKKNahj2r6l+xq3dPFrnJ4KoHlZ2Qfwx6H+92 5/6LD3RPC7sg/hj0P97tz/0WHuiAPOPjt7Um7aI53cNGNCrLa6+/2faK9Xu5MdNBSTq1FWCCJrmo +RqKnM9yq1rt28qqiqno4eYPFjxE9nRpJqdfbQnDbZ9S87ZcZqi+1MEUcVNHXuer5my1L+ZXzc6r zoyNyIu6KqORWoETX/ip7W/BcPZrDl1vu1HiCtjqHy1eJW5sEcUipyOla2FJ42LzNTmcrfFOu6ly uz97QGLi2huWD5xY6KyZ9Y6VK6RlCrkpLlSczWOmia9VdG5jnsR7Fc737XIuyq1tY9VO1ov2rGke YYO7hHudPbcpsFfaluS5HJPFTsnp3x9/y+QIjkZzc+3OnvffJ4kDdkvUzwcamNRRSK1tTartFKiL 75qUr3bL/wBZrV/EBI/ajZzxiw5VlOI51PdKfROsyGGPH2vt1HFT1EjIe8Y1J440nk2VJXbPeqbt 39SbRDwf5X2gFgw290/CHS3iXHpLmj7otFZrdWNSt7piJu6qie5q93ydEVE/GXo7bL4PWEf35x/0 GqOt2JP9g3Pv77G/0OECvHadZ1xmR37IsT1EmutPozW3ymZY2yW2ihgqJmQJI1qTRxpO/ZySu2e5 U3b8ybRPwf5X2gFgw290/CHS3iXHpLmj7otFZrdWNSt7piJu6qie5q93ydEVE/GXo7bL4PWEf35x /wBBqjrdiT/YNz7++xv9DhAsjxi8YGPcIOlVBlV6ta3rJ745aSy2jve6SonaxHSyyORF5Yo+ZvNs iqqvY1NubdPPLEONDtTeJF1yyXRCz/7EUEyxTtseNUT6SGTZHd0kta2Rzno1UVWo9XbORduqF7OO 7O+DjTiw2XJuKHCKDL7m1s8OPWjyRtTWzIqsWZYmuc1sce6R8z3KidGom67NWomnPaw4Pp1aJcN0 H4I5aOwQ1D6nyW35D3Kd4/beR0cdFIiOXlT98vggHzw2drJq3YNT6bS3izstE6jluHmqtuzaDzfX 2ep5+7VamFNo3Rtf0eiMY5qczvS25F9X7hcKG00FTdLnWQ0lHRwvqKiomejI4omNVznucvRrURFV VXwRD+bDif1Vm1u13yzVSowiXEJshqIKiSzS1Czvpntp4o3Kr1jjVyvViye8b7/1+K+x3Hdnd4xj s57tdKKrkZX32w2W1yTI5UcrKp9O2oRfj5ollav90BVnXrtdNW8yz1+AcJWKwxUMlV5Db7lPbXV9 zusu/K10FMu7GNcvvWOY96psq8qqrU0++ceHab8PNfbr3rjj07rXXycsEGR4nBSU1Qu26xtmpo4l R6N3Xl5+ZPFUVDg7F7C7RfuI3JMtuVLHPUYzjEj6Dnai9zPPPHGsrfid3Xes/BIp60a46I4BxDad V+l+pVBNVWWvlgnctPL3U8MsUiPY+OTZeR3RWqqeLXOTwVQNI4QeLTCuLrTV2Z45RvtN4tkraS+2 WWVJH0NQrd2q16InPE9EVWP2TflcioitVE8VO0M+Gjqt/wA8t/o8R7S8N/BTovwr3q8X3Sh2QxS3 2ljpK2KvuXlET2sfzMdy8qbORVciL8TnfGeLXaGfDR1W/wCeW/0eID201+4k8G4WtC49SMzlSedK OKmtFrZIjZrnWrEishZ8TenM9+yo1qKuyrsi0L4MeIXtC+MbVmqfBq+uN6fWqr8qvlXSYza3R00T nK5lDSvlpnufK5voor3PVjU53q5dkfSHib4nct4pdS6fKs0mqKHH7YxlBZ7TTu7xtuoUVEcrUVUR 8z9uZ7l25nbJ0a1qN96+GHDNIMG0KxG1aFsidh1Tboq6hq27LLXLK1HOqJ3bIrpnL7/dE5VTl2aj UagYvir4ocG4TtLpdQcwjluFZUS+R2e0wyNZNcatWqqMRVTZjGoiufJsqNTwRXK1rvN3F+N3tOuK S6XO5cPOL09HardLySx2eyUclPBv1bG+puHO10nLsqojkVd90aiKh1e2yy25V2vOD4O+d62+0Yml yij3XlSeqq52SLt4dWUsPX5jXOFXtR6Xhe0Us2kFt4fYL0+3TVVTVXT2S+SOrZpp3yc7o0pX7K1i sj98vSNv4ECVdF+1N120r1VbpNxp4kyGFtSykr7h5t8guNrc/blmlhZtFNDsrXeg1q8i87Vf0avp Brvll4xrQDULOcJu8dPdLTh92u1or42RzsjniopZYJUa9HMeiOa12yorVTxRUPCHjV4taDjBzmx5 6zS2HDq+1WxbXUKy6+XLWRpK6SNVd3MXLyq+RPBd+b1bHqXonmNfnfZOz365zumqItMMitave7dy tooKykZuvx8sDQKbcMXal6+UWV5NfdftRUyfHbNitdXUlr802+iWquSPhZSxpJTwMenM9/KvVURH K5UXlJQ4GuNvi5194prHYtTLssGDXykuNSy3U2PQU9HvHTPfEkdQsSzKjXIm28q77ddyl3Z86U47 rJxb4Jh+X0EVdZI56m6VtLK3mjqG0tPJMyN7V6OY6RkaOavRWq5F8T+huKKKCJkMMbY442o1jGps 1rU6IiInggH2RnxPfBq1Z/vGv39AmJMIz4nvg1as/wB41+/oEwHhfwEav4loHr4mr2ayP8243j91 n7iJU72rmfAsUUEe/wC/fJI1qepN1VdkRVJx1Z7RrtE291qJBjVx04wy4SJ5tVcOR9FLG7qxvldb A/vXK398xzUXqqNROhC/Zy6a47qpxg4Hj2WUMVdaqOWqu89LM1HMndS08ksTXNXo5vetjVWruioi ovRT3P4isQs2eaDag4jf6OKporjjdwY5sjUVGPSB7o5E+JzHta9q+pzUX1AVR7OjtDb3xO3W4aT6 tW+3UuaW+jdcKGvoWLDDdKdjmtla6NVVGTM5mu9FeVzVcqNbyLvN/GjxfYvwgabU+UXG1+eshvcz 6Ow2hJe6SolY1FklkfsqtijRzeZURVVXsam3NzJ5Bdl7WVFJxy6bJBIrWzrdoZERejmLa6tdl/Gi L+FEPVbjuzvg404sNlybihwigy+5tbPDj1o8kbU1syKrFmWJrnNbHHukfM9yonRqJuuzVCieIcaH am8SLrlkuiFn/wBiKCZYp22PGqJ9JDJsju6SWtbI5z0aqKrUertnIu3VDb+GztZNW7BqfTaW8Wdl onUctw81Vt2bQeb6+z1PP3arUwptG6Nr+j0RjHNTmd6W3Iv1pz2sOD6dWiXDdB+COWjsENQ+p8lt +Q9yneP23kdHHRSIjl5U/fL4IUN4n9VZtbtd8s1UqMIlxCbIaiCoks0tQs76Z7aeKNyq9Y41cr1Y snvG+/8AX4qH9H2Z5fYMAxG9ZzlVclHZ7BQT3KvnVFXu4IWK96oidVXZq7InVV2RDyUyPtPuMjiF 1AqcQ4UNPUttM1Hy0lNR2dt1ua07XInfVDpEdDGnVu+zEa1XI3nd0VfRfUvTu865cH9y07t1eyK7 5VhMUFNNM5UY6qdTMeznd4o1z0RHL16Kq9TxR0K1y1y7PjWS8rV4HHTXaWmW2Xmx3+mkj72FJEe1 8b2qiou7d2yNVzHIqrs5FRQLE5DxtdqLw3zUOQ66YxJUWaqnSFvn7GKaGklfsq90k9E2PlerUcqI rt+irsqIp6R8InFRiPFtpVHqDj1A+1XGiqFoL1aJZUkfRVSNR2zX7Jzxua5HMfsm6boqIrXIlLbd 2uPDhrPYXYHxK6AXCCzVskTqiON8N5olfG9Htkex7YnoiOai7Na9fV1L28OjeG+44IzLuGWzYdSY 1enIss+OW2GjSaWNFTlqGMY16SsRy+jIiObzeCbgSoUX7U7XXiK4dsSwXPNEM+fj1trrjVWi8s81 UVY2WZ8TZaZUWohkVi8sVSioioi9PiL0FYO0q029svg3z2mgp+9rcdp4skpV235FpHpJM76P36fj A5Ozr19y3iL4ZrZmuoN7bd8poLpX2m7VraeGn72RkneRqscLWxtVIJoU9Fqb7b+KqUk48e0M4lNP OJ/J9NdDNRvM9gxiCnpJIIrLQVneVTYEmqZFfPBI9OVXqxU35U7pV2Tqq57sWdVLfYsW1ew2/Vza ehs7aXKmq5ejYkjkjqpNvmbFT/xkIcDWmtZxhcSur2ZZFAi+dcayWtfLJ1bDXXdJKaNN/UqMqZ1R fV3fQD0c7NriOzDiU4d1yXUa+su2WWS91dpudWlNDTumT0JoXrHCxkbU7uZrEVrU37td913UqT2i HH1xHaTcTtfpVobqH5jtljtlBBVUkdmoKxZq+ZnfufzVEEj91jmhbyou3o+G6rviuxVz+px7VLUf Ri7K+CS622K7RQS9FjqaKZYZWIn8JW1KKqfFF8xB2mtJ7qvtNobi5PK7Zds+qr07f0mutlDI+djH L8SwU7I/+sm3igHrJrhxMW3hB4d7Jm2s1fLkWWrb6S3tpIEigmvN37hFmVEY1I4o+dHve5reVjei NVVa1fPnF+N3tOuKS6XO5cPOL09HardLySx2eyUclPBv1bG+puHO10nLsqojkVd90aiKh1e2yy25 V2vOD4O+d62+0Ymlyij3XlSeqq52SLt4dWUsPX5jXOFXtR6Xhe0Us2kFt4fYL0+3TVVTVXT2S+SO rZpp3yc7o0pX7K1isj98vSNv4ECVdF+1N120r1VbpNxp4kyGFtSykr7h5t8guNrc/blmlhZtFNDs rXeg1q8i87Vf0avojxLVFPWcMWqtXSTxzQT4HfJIpY3I5j2Lb5lRzVToqKi7oqHhhxq8WtBxg5zY 89ZpbDh1farYtrqFZdfLlrI0ldJGqu7mLl5VfIngu/N6tj1L0TzGvzvsnZ79c53TVEWmGRWtXvdu 5W0UFZSM3X4+WBoHnf2TPw1sX/5ru39DkPZDiV4i8D4XtLa7U/O3yzRxPbS2+3wORJ7jWPRVZBHv 0To1znOXo1rXLsu2y+N/ZM/DWxf/AJru39DkJq7bvMrlUal6cafd+9KC32KovPdI5Ua6aoqFi5lT wVUbTbJ8XM741A12DtF+0N4j8qr6Lh4xRKGCkTvXUOPY7HcnUsKrsxZ56lkjd12VObZiOXfZqeBm NN+1a4ndF9Q/YPxY4St0pqeZkd0iltCWq80TXbKkjGNRkUicq8yNcxOdNtntRdy2fZHYVaMb4ObN klDSxtrctu1yuFbMjU53uiqX0rGqvjsjadNk8EVzl9akn8RnAxoHxRZNbcv1Qtl2862ui83x1Ftr vJlkg51e1snorzcrnO2+LmUCZsezfE8pwyg1Dsd9pKjHLlb2XWnuPeIyFaVzO8SVVdtyojeq8222 y77bKeW3EV2v2f3nNJ8D4UcYpPIUqfIqW91tE6srbnKruVrqWm96xrne9R7XucnKvKxV5SxXGbit n4UezlyrTXS+tukdsijistG+tqlmmjp66vatRGr9kVWqyWZqJ6kft4JsUt7GfALJlHElfcuvFHFU zYljktRbkkai9zVTzRxd6nzpEszf+uB3sk4x+1d0ctsWd6n2K80uPq9vM+9YRTQUjFcuzWSvhhjf EqquyI57XKvQu1wJ9oZjvFolThGVWWmxnUG203lT6OCVXUlygRUR8tMr1VzVaqpzROVyoio5HOTm 5bW5hilizvFLvheT0Mdbab5RTW+tp5GoqSQysVjk6/Mq7L6lP54OEbIbrphxh6aVVvqnNmpczo7P UPYqpzwVFQlLOnT1LHK9NvnA9W+1M4idaeHLTvCcj0YzT2O1d1vU9FXP83UlX30aQK9qbVMUiN2V q9Woi9SuOl/afa+VfDtBZ7dQzana45BktwordBBZWPWitkNNTPSd1JRRs71yvlkRiI3qrXq5VRiN dJPbc/2GtO/755v6I8xPYj6f2KLBdQ9U30cUl5qbtDYI6hzUV8NNFCydzGr4oj3zMV3x90z4gK32 PtUuN3TTP30+qVZTXdlBUoy5Y3ecegtssbeiuj3iijmifsvRX82y7KrXJ0W0fEd2lmpGUeZcK4IM IuOUXqusVLfr1caWyyXWa0sqImyNpkgja5qSsRyd496OY1V5UTdFVIP7a/F7VbddcJymjpY4qy94 06GsexuyzLT1D0Y93xu5ZEbv47ManqQt52ROAWPF+EO25hQ0cTblmd1r62vqOVO8ekFQ+liYrvHl akLlRPBFkev75QKX6E9rhxF4bqHR0HEDXUuVYzJVpS3Zj7RBRV9vZzcr5IvJ2RormdVWN7V5kard 2qvMnszVX6y0VimyerutLDaIKR1fLXPlRIWUzWc6yq/wRiMRXb+G3U8HO1Qxe1Yzxp5k60UsdPHd 6a33SaONqNb38lKxJHbfG5zVeq+tzlX1l/eKHOLzYeyXslzpKqRlbf8ABsUt00yOXmVlTHSJOir6 +eNZGr8z1AgnV3tXdd9V9S00y4OcKYyCpqXUlsq5LZ5fdLm5u6rKyB28cMeyOds5rlRqczlb1amD ybjV7T/hcuFrvvENisNbZLhMkbI7tZaOOmmX3yxNqaBGpHLyo5URyqvRV5XIilXeC/ipoeETUi56 ky6Zw5jWVtofaqaOS6eReSI+WN75Gu7mXdVSNG+CdHL16qhPvE52qdJxLaK5Bo7duHiC1JeUgfT3 Jcm8pdRTRTMlbK2PyRm6+grV9JvRzk32VUUPVPhi4j8K4pNJ6DVDDGSUvePdSXO2zPR01urWIiyQ PVOjk2c1zXbJzMe1dkVVaksnkb2IWZV8GdamafOnc6irbTR3lsau9FksEyxOciepXJUNRV9fI34k JCv/AG2GMWK+3Kxv4fLpM63Vc1IsiZFG1HrG9W823k/TfbfYD0wPHPje4+eLrRvinz3TbT7VvzXj 1mqqVtDR+YbZP3LJKOCVU7yWmc93pSOX0nKvUutwX9oHZ+MXLMhxW26Y1mLvsFujuDpp7o2qSZHS ozlREiZt4777qeVfaZfDi1Q/5Tbv0ZSgWy4oO0k4lcivF+ThJxG4wYFiEjqa6ZnTY665xy1DERZX LK+N9PDC1d0bzIquROfmRHI1OrwWdrDnN3zuPA+KS8WmpstfTzyQZM2jjo5KKWKJ0nLOyFGxvjej FaitYjkcrfFF6eiPDZpxjenPDxgeAWe207KCmxyjbUR92itqJpYWvqJHp4OWSR73O+NXKfz63/Tu 1v4mLjpNRKtPbnZ1NjsPKvWODzgsDdvwN2AuNrh2mPGxkrqrUrSHErrgmljap1PbLs/Fm1cVSxH8 rVnrKmKSHvHL+8jVEaq8u7lTmWyPZw9ojlXEfkVbo5rNBb0yyCifcLVdaOFIG3KKNU72KSJPRbK1 Hc6KxEa5qO9Fqt3dcLU3TzE6/QXJ9MI7LSQY87Fqu0w0LI0SKCnbTOZG1ierkRG8q+KK1FTqh4b9 mbVz0fHBpi+B6tWSouMLtl8WuttU1UX+MD2v4nuJTBeFjSys1MzdJape8bR2u2QPRs9xrHIqshYq 9Gps1znPXfla1y7KuzV80cd46e0t4p77dJuHLE6agt1ucnew2ezUs0NM13VjJaqvRzFkVEXoitVd lVGonh2+26y241OqWnOCLO9KC3WCou7Y0VeVZqipdErlTwVUbStRPi3X4yPeEjtOKThS0bo9J7bo FBfZYq2quFZdEyPyN1XNM/dHOiSlfsrY2xx78y7pGi9PBAljSvtSOIrRbVRul3GlhiOpmTshuFX5 rShuduR/vZ+7iRIp4dlRdmNRVb6TXO6Nd6nXXMsYsuHVmoFwvNMzHaG2yXia4MfzwpRsiWV0yK3f mb3aK7dN908DwE42+MOg4xsmxrLU0ohw642Ghmt88rLv5e6thdIj4mqvcRcqRuWXb32/er4bdfT3 hMt974juzBosAfc0iut1xa84nT1MzlVsaxSVFPS823XkbG2FFT+CigVYzHtSOLXXvUSfCeEnT7yC mVZH0MNPaEul2lgauyzz86Ohib1aqojNmK7ZXu6KYzJOM/tUOHVKTKtbcbmmsk07YkW+4tSx0b3r uqRLNRNjVjlRF2RXoq7L0XZSuejmrOu/Z4653OsrcFjor62jktF1s99pnpHU0rpGP5o3sVF2V0TX MlYqtVP4TV2W7dr7Xvh+1ex+bAuJHh+uENkuSxNrIqeaG70Uiska9r5IpGwuRqPY12yI9UVE8QLk cG/FtinF5pi/MrPbXWe92mdKG+2h8ve+Szq3ma9j9kV8T03VrlRF3a9q9Wqq1j46+0/v2iWoVZof oRjtuuWSWzu4rtd7jG+eKmqJGo5KenhYqd5IiObzOcqtRyq3lVUVUt1w0v4Y7zg65pwvWPDaOw3d zY6qfHrXFRPkliRdo6ljWMkSRiSKvLKnMiP3To7dfILtD9D9WtA+Ku+a1QWqsdYb/f25LYr8yBZa aOqV7Ze4kXZWskZKiojHe+ajVTdFXYJWn167ZiitjszqsUyhtqjjWpfTOwm37tjRN13hSDyhERPx lgeAntNqviIzCDRrWSxW205fWQySWm5W5HR0tydGxXvhfE9zlim5Gucio5Wu5XIiMVGo6JNN+28u EUVPR6uaHw1L0REnuGPXJYt19atpp2u/1yFnOEzUjs+9dcmkyHRLTvELRntPI+6SU1xx2mpr1C9y qr5opNnc3Vy7uhkdy79dt03CS+MTixxThF0u9nF7tzrveLnOtDY7QyXu1rKnlVyq9+y8kTGpu52y +LWp1ch5wYnxt9qHxLVlzvOhNlYy226VGVEdixyjkpadypzJGs1akiufy9eXn5uu+3VC/HHRmvCF p9iVlyjinw+gyqaB9RFjtpdSJVVs8jkjWfuGOc1rW7Ni53uc1qegm+6tRaa6b9q3p5pnbqrDuH/g ikorGtU+tfTW+/8AcK6V7WtWV8cdHIiOVsbU98vRqfEB1tA+1j1rwbU6PTXi4sNLNQsrvNtzuHm1 LfcrPNzcrnzQsRI3sYvvmoxrkTdUVdkavrNcLtbLVaqm+3KvgprdR076uoqpHokUcLGq50iu8Eaj UVVX4kP5v+LHWGfXzXvJtWavAZcMqL8lG6Wzy1KzvgdFSRQ8yvWKJVV6Ro/3ie+9fivsDxS5fdcf 7Lm45DBVPSrrsCsFDLIjl5nNrVo6aXdfnZO9F/CBTPXbtc9fc6z6bHOGikp8dsS1fkdqk80x191u bldyserJWvY1XrtyxNjVyb7K5ykjaccfvGfofVUkHGjpfd6fGL8ySmoslq8d83zUVYsbli50jY2F 7d0TmjVjZEbu5N+VWrBvY7YPZ8s4sKm+XekjndieMVt1oUe1HclU6aCna/ZfWkdRLsvqXZT1s4q8 BsmpvDhqNh9+pIp4KnHK6aFXtRe5qYYXSwSp8SslYxyfgA81eAzjz4s9a+K/BtM9SdWPO+N3dbkt dReYrZT96kNuqZmJ3kNOyRu0kTF9Fyb7bL0VUPSXie4lMF4WNLKzUzN0lql7xtHa7ZA9Gz3Gsciq yFir0amzXOc9d+VrXLsq7NXxe7LX4dWm39zef0RWE/dt1ltxqdUtOcEWd6UFusFRd2xoq8qzVFS6 JXKngqo2laifFuvxgdTHeOntLeKe+3SbhyxOmoLdbnJ3sNns1LNDTNd1YyWqr0cxZFRF6IrVXZVR qJ4bDpX2pHEVotqo3S7jSwxHUzJ2Q3Cr81pQ3O3I/wB7P3cSJFPDsqLsxqKrfSa53Rron4SO04pO FLRuj0ntugUF9liraq4Vl0TI/I3Vc0z90c6JKV+ytjbHHvzLukaL08Eirjb4w6DjGybGstTSiHDr jYaGa3zysu/l7q2F0iPiaq9xFypG5Zdvfb96vht1D+g2319DdaCmulsq4aqjrIWVFPPC9HxyxPaj mva5OitVFRUVPFFOwVi7NTMa/NeCvTituk7pqm201VZ1c52691S1UsMKfihZEn4izoAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAH833Gj8LbV/wDvyuv9Ief0bWn/AHKov+Tx/wCih50609jv7b+reX6p e6K80+yu81V38h9iPf8Ak3fSK/u+88tZz7b7c3K3f4kPRukg8lpYabn5u5jbHzbbb7JtvsBzEEcd nwPdW/72Kr/MhO5omu2l/t16PZbpP588zeym2S23y/ybyjybn/f91zs59vi5m/hA8gexn+Fpc/7y 7h/SaQm7tyv9zdGv/n3/AP0aAm7gz7NP3I2rVVqj7dPsr8pstRaPIfY55Dy97LC/vO88ql327nbl 5evN4pt13fjl4HvdoU2GU/tn+w72Ivr37+ZfOHlXlKQJt+7w8nL3H9tvzerbqGgdjn8EOX++y4/6 unLJ8SPEHjHDHpjUarZjjeQ3m00tXBRzx2SnillhWVVaySTvZI2tj5+Viu3VeZ7E2Xc17g54ZPcm aQu0q9m/sq5rtU3Ty/zb5D+6tjb3fd97L4d3483XfwTYl7KsWx3N8cuOIZdZqW7Wa7076SuoqqNH xTxOTZzXJ/8AfxRdlTZUAqXo7xbcHfHNaLpbNQcTxWjr7VU9xBZs3ZQyVE9O5qK2ogWTdPfK9qox Vc1Woq7czVWrPaQcNnA3pxpPPmukl1sePZ4lbTso7LZ735Uy4xvkRJuamWR/dNZGrn87EY3dqNXd XIShqJ2J+kV+us9fptq1kOJ00z1e2hraGO6RQ7/vY3c8T+VPVzuc743KY7DOxC07t1yiqM911v19 o2ORz6a2WeK2ukRPUr3yz7Ivr2Tf4lTxA/OxBqcpk061Ppa10645Debe63I5V7tKx0MvlSN+fkSk 3/C0pH2lsUkPG/qgyVitVaugeiKnijrdTKi/jRUPeDSzSrANFsJt+nemeN01ksVtaqQ08O7lc9er pJHuVXSPcvVXuVVX4/ArTxi9mxpzxYZXDqLT5jXYZliU0dHV1sFE2sp62KPpGssKvjXvGp6KPR6e iiIqLsmwTloXrXpRqZgmJrheoWPXSrrrJTTNoKe5Qvq2csLO8a+FHc7XMVdnIrUVq9F2JRKVcH3Z nY9woalrql7bVxym5tt89vjg80soYEZLy8zlTvZXKqcvT0k8fWXVAqr2mmkt51d4Rcoocco5Ky6Y 3PT5HT00bVc+VtMqpMjUTqqpBJM5ETqqtRPWedfZKcRmDaI6yZFiuo1/pLFZ85t0EENyrJUip4a6 mkc6JssjtmxtcyWZOZyoiO5U9Z7eqiKmylFdfOyK0E1ayKsy7BL9ctOrlcJHTVNNQU0dTbXSOXdz 2UzlYsSqu/oskRnxNQDaeNrtBsI4dtO4Z9KMqw7LM9uVVCyhti1Pl0ENNvvLPUNp5Wua3lTlZu9q q5yKiORrtuLs7OK3X3i1s+W5jqliGJ2fHLRNBQWuos1FVQuq6tUc+dqrNUSorY2LFvsidZU69FQh zAexI00s95hrtRtar5k1BE9HuobfaY7X3qIvvHyLLM7lXwXl5V28FRep6GYLgmIaZ4lbMFwLH6Sy WGzwpBRUNK3ZkTN916rurnKqq5znKrnKqqqqqqoH88+e4rknBtxc+S19rl77T/Laa8W5r92traKG pbPTPaq+LZImt/AquReqKe7OL8W/DXluCU+o1v1qxCns01MlRItbd4Keam3TdY5onvR8cieCsVN9 /DfdN8ZxNcHWifFbaKek1Lss8N2t8bo7ffbbI2GvpWqqryI9WubJHuqryPa5qKqqmyruUrq+w4x9 9wWWh4j7hDQ8yqkMuLsklRvqTvEqmoq/PyfiApLxhapu4t+Le+ZBpnbqu6U16raSw43TxxO76sZG xkEbmsXqneyI56IqIqI9EXZUU9cdfNPPal7NrJdMnTMmkxjTplrmlYu7ZZooGNkenzOejl/Gd7hd 7PPQThbuLcrsFLXZJlyRujZfLyrHyUyOTZyU0TGoyHdN0V2yv2VU59lVCZNdtL/br0ey3Sfz55m9 lNsltvl/k3lHk3P+/wC652c+3xczfwgeQPYz/C0uf95dw/pNIXn7Xb4Gl1/5+tf+tU6nBn2afuRt WqrVH26fZX5TZai0eQ+xzyHl72WF/ed55VLvt3O3Ly9ebxTbrOnF3w4e6p0Zq9I/Zl7F/Kq+lrvO Hm7y3l7lyu5e672Pfffx5unxKBQ3sNP9u6z/APysf/z3A2rtv/7HOl//AD3X/wCojLB8DPAn7i+f M5vbT9mPsvZb27eY/N/kvkq1H/6RNz83lH9rty+vfpluODgw92XjmL4/7ZPsQ9jdbUVnfeZ/OHlH extZy8vfxcm3Lvvuu+/ggEN9ix8FXJP7/a7+gW88y+Nz4ZOq399tV/poe2XBZwqe4/0quWmXs89l vnC/z3zy3zX5Byd5T08Pdd330u+3k/Nzcyb8+23Tday63dkH7cmsuV6t+6G80eye7S3Tzf7EvKPJ +d2/d975azn2+PlT8AHowfzpcM3w4dO/+keh/p7T+i086NM+yE9rrXDHdZvdC+cPMGRwZB5t9ifd d/3dQkvc975a7l3225uRdvHb1AXQ4k/g6ap/3lXz+gzHjD2Tfw18V/5su39DkPcHUrD/AGw9Osqw Dzj5v9k1krrP5X3Pe+T+UQPi7zk5m8/Lz78vMm+226eJTDhN7LX3L2tlq1i9vT2TebKarpvN3sY8 i7zv4XR7975XJty82+3Iu+23TxAiftyv9zdGv/n3/wD0aAmbsc/ghy/32XH/AFdOb/xy8D3u0KbD Kf2z/Yd7EX179/MvnDyrylIE2/d4eTl7j+235vVt13Pg54ZPcmaQu0q9m/sq5rtU3Ty/zb5D+6tj b3fd97L4d3483XfwTYDxl7S2KSHjf1QZKxWqtXQPRFTxR1uplRfxoqHt5oXrXpRqZgmJrheoWPXS rrrJTTNoKe5Qvq2csLO8a+FHc7XMVdnIrUVq9F2IN4xezY054sMrh1Fp8xrsMyxKaOjq62CibWU9 bFH0jWWFXxr3jU9FHo9PRREVF2TbG8H3ZnY9woalrql7bVxym5tt89vjg80soYEZLy8zlTvZXKqc vT0k8fWBdUh7jG+CfrD/AHkXn+iSEwmnax6e+21pPmGl/nfzV7LLJW2by7yfv/JvKIXR953fM3n5 ebfl5m77bbp4geMPZAfDFpf727n/AJoz0i4su0N054ScvpMFy3TvMbvdLhbmXOkno4qdlDNE572b JM+Xm5muYqOTu+m6L60NF4P+zF9yjrFFqz7d3sp7q21Nv83+xryHfvkb6fe+VS+HL4cvXfxQsZxH cLmkPFLiUOKaqWSaV1C90ttudFKkNdb5HIiOdDIqKmzkROZjmuYuzVVqq1qoEa0tt4AuLXD6HUC8 4/phd5LxSsqamSd9LTXSme5qK6GeSNzJ2SNVVRUVydU3ToqKeTHaB6U8OekWtNPj/DdlUF0s9RbW 1Nxo6a5JcIbZVrI9vcsqN3Ku7GtcrHOc5qr1XqiJcq89hxjk9a6THuI25UVIrvRirMZjqpET4ley piRV+flT8BKGh/Y/6AaZX+kyjUHIbtqJWUMjZYaOtgjpLar2rujpKdqudJsqJ6LpFYvg5rkAstwj VOU1nC/pZVZq6d15lxS2uqHVG/euTuG8jn79edWcirv13Vd+pLh+Na1jUYxqNa1NkRE2REP0AAAB /OBxiVN2qOLvVmbLEnklbmtzY5rl9JaVlS5sCNVfV3CRo35tj+j8p9xcdmlpNxTZQ7USDIq/C8wn iZDWXCjpmVNPXNY1GsdPA5zVdI1qNaj2vb6KIi82ybBtuX8aPCdoroZBmGJ6g4lV2qjtLfY9j1mr YXVNQqR/YaZlMxVfF15WuVzUSPrzbbHiJoLf/MXFTpxlmbypa2UueWa6XOaqTuW08fl8Uskj+b3r Ubu7dfV1PUnQ7scNHNOMqpMq1Nzy4ah+b5Wz09sfbWW+gke1d29/H3krpWouy8nO1q+Dkcm6LmOK bsosD4iNUK7VXG9S6vCLjee7fdaVtobX008zGIzvY297EsTnNa3m6uRV3XZFVQNd7ZDDHZ3w64xq XjE0NzpMQyDlrZaWRJWRU1VH3ayK5u6bJK2nb/2iEO9jvxMac6e0uY6Lah5VbcekvFdFe7NU3GpZ T09RL3SRTw949Ua1+0cKtaq7u9Lbqmy3+4f+ErB9EeHybh2utc7M7DXuq1uS3KlbG2qbU/ujO7aq 8rfi9JVReu++xUTNuxF09uuQzV+B64XnHrRLIr226uszLi+JqrvyNmSaFdk8E5muXZOquXqB0+1z 4qNNr9pTQaD6eZZbMju9xucFzvT7XUsqoaCjg35GSvjVWtkfK6NUbvuiMXdE5m76n2HP9curv/Ib N/rKssBTdk1o5YtA8q0mxXK66nyjLfIkq8xuVCyrmhjp6qKfuYqdr42sid3WytR/Mqq1znO5GtTb +B3gHfwZXrLLsmrXsvZlFLS06w+YfN/k6wPkcjubyiXn37xU22TbbxUDzG7U3Tq54HxkZbcqmmey 35dDSX23yqi7SMfAyKXr4bpPFMm3xbfGeqfCZxi6IakcPeK3y8an4xZbxZrNTUN/obpdYKSakqYI mxyPc2VyL3Tlar2v6orXbb7o5E3Pij4SNKOLPEabHNRKWqpa+1vfLabzQOaysoXuROdGq5Fa+N2z eZjkVF5UVNnIjkpjYew9wumvjKnJuIK83G0I9FfSUVgipKhzN/e9++eVqL8/d/iApT2ievdg4iOJ q75jh87qrG7XRU9js9YrFalZBAr1fM1F68jppJuVfW3ZV2XdE9dOELB8W1L4CNPcBza2ecrDfcTZ RXCk7+SHvoXOdzN54nNe38LXIvzkP8Q/ZI4Fq7csS9rnUSLTuy4ljkWPQW1lgW4rMjKmonWd8q1M SrI51S9XKqKqr1367Jbjh80mfoVoximkcmReflxeh8i84+SeS+UJzucju6538nRyJtzr4AQx/wCy 44E/uGf/AOTXj/8Aeze14TdKsS4dc54etIsdZjVly63XKJIn11TVJHWVVN3KTK+eSR/RWRrsi7ej 4dV3m8Afzu8JOpc3CRxdY/kOpduq7ZDj9xq7JkdNJEqy0kcsb6eVytTqvdOckiom6qkeyb7oe42U cW3DXiODTah3PWvD5rPHTrUROo7vBUTVPTdI4YWOV8ki+CMRN9/HbZdo94pOz00G4pbiuV3+mrsb y7u2xuvtmVjJKlrU2alTG9qsm2TZEd6L9kROfZEQqzR9hxj7LgklfxH3Cah5kVYYcXZFKrfWneLV ORF+fk/EBQ3FcbyXjQ4upae12uZs2omWVN0rGM3clBQzVDppnucng2KFXdfXyoniqHrT2tjWs4LL 6xjURrbxakRE9SeUIS7wzcHGiPClaqim00sk813r40iuF9ucjZ6+qYiovJzo1rY490ReSNrWqqIq 7qiKdri34dfdTaL1+kPsx9jHl1bS1fnHzf5bydzIj+Xuu9j33223502+JQKA9hv/ALv6wf8AI7J/ p1hbztQ/gK6m/wBzZ/0vRnV4G+A33GNwzCu9tX2YeyuGii5PMfm/ybyd0y77+US8/N339rty+vfp L3FDob7pLQrJ9FfZR7HfZGlGnnPyLyvuO4rIaj9x7yPm5u55ffptzb9dtlDzM7Eb+zHqJ/ezD/Sm Go9s78LCzf3kUH9LrS+PBF2evuN8yyLLfbd9l/n+2Mt3k/mDzf3HLKknPzeUy83httsn4TEcZ3Zr e671Yo9UPbo9ifklkp7N5D7HPL+bupppO87zyqLbfvtuXl6cu+677IEwcBnwOtJf726f/O4pp21e hvldpw3iGtFHvJQvXGb09jeqwvV0tJIu3gjX9+xVX1yxoehOg2lntI6O4lpN5989exa2x2/zh5L5 N5Tyqvp91zv5N9/Dmd+EivtE75p/ZeDrUePURzHUtxtvkVtg50SSa6OcjqNGIvirZmskXbwZG9fB FA8YNZ9csl4jsZ0N0vo4Kmsr8KxyPGIqfxdPXyVboo+T+FzU0VAm/wDCRyeo99dCdLLbolo7iGlF q5HRY1aYKKSRibJPUI3mnm2+N8rpHr87jxh7KHQ6XVfiioMxuFCstj05g8+1L3N3Ytau7KNm/qd3 m8yf8nU92QAAAAACiHbL1F9h4TbbFanSpST5lb47nyeC06U9U5qP/te+bCv90jSsfY155ophGV6j P1EyLHrFktXSW9LNWXipipualas/lUcMsioiKrlgVzUXdyNRdlRq7esOqGmOFayYFeNNdQrMy52G +QdxVU7nK1eio5j2OTq17Hta5rk6o5qKed127DzDp76+osfEJeaOzLJu2jqsfiqKlGb+9Wds8bVX b191+ICHO1p4msG10ybGcA0oukWRWbBEqam73qgXvqN1XUrGxkTJW+i5GNiX00VWqsmyKqtUsX2L OW4zHw85ViUt+oI7yzNqir8hfUMbOsMtDRsjejFXdUc6GVEVE8WL8RNNm7N3h0sPDzf+Hy20FxSD JVhqbjkMsjH3SWshdzQTc/KjWpGu6NjRqM5XPRUVXucsR8PXZHWHQvWPH9W6rXKvvzsarfLqOgjs DKNHvRqoiSSLPJunXrs1u/zAecvaGfDR1W/55b/R4j+hDHv9wLZ/yOH/AEEPP/iG7I72+daMr1e9 0F5j9k9alX5u9inlXk+0bGcve+WM5/eb78iePgehFupPILfTUPed55NCyLn225uVqJvt6vADwL7U r4dWpP8Ac2b9EUZ6WcXunVz1K7NR1tslM+ouFoxOx32GJiKquZSRwSzbInVVSBJlRPjRDUeKXspv dK665LrV7fPsc9kKUSebPYt5Z3Hk9HDT/u3lcfNzdzze8Tbm267breLDsZjxXCrHhstS2uZZ7XTW x0zouRJ0ihbGrlZuuyO5d+Xddt9t1A8R+yn4h8K0J19uVt1GvdNZbDmlp82+caqRI6emrI5WyQum evRkap3rOZeiOe1VVE3VL99ovxc6TYnw2ZVgmJ53ZMgyrN7fJZ6O32qujq3x0sybVFRL3Tnd3GkP ebK7bmcqIm6I5U0nWjsZ9Is+yysyfTHUW4YBDcJXTzWrzWy40cL3LuqU7e9idEzffZiucib7N2RE am1aPdk3oxpVi+VQVmU3DJcsyTHrlj9Ne66jY2C1NrKaSnfNT0jXfunLI7q6RV23Rqs3VVCiXZB/ DHof73bn/osPdIolwjdl+/hW1notXG65+yZKWhqqJ1u9jPkXeJMzl5u98rk22XZduRd9vUXtA6d5 dcGWeufaWo6ubTSrTIvgsvKvInX+22P5tOHe74dQcSGCXvWRY5cfiyikqL6+4tV8fJ36K986O35m I70noqLuiO3RT+lcoTxGdkVpLrRnNx1BwXO6/ALjep31dxpI7cyvoZJ3ru+SOJZInRK5yq5yI9W7 r0RoG18dHGNoxi3D5k2B4HnNiy3L88tM2O2W0WCtjr5dqyNYHTOSBXcjWskcrN/fu5WtRd1280ey 7yOxYvxo4ZV5FdaW209RTXOkZPVStij759HKjGK5yoiK5ycqIvi5UROqoek3C12WujXDnltJqJfs hrs8yi2PSS3T1tIylo6KVPCaOna56rKnqc97kauytRHIjkjTVPsXtP8ANtQ7pl2Gax3DFLRdaySt fZnWNlalO6RyucyGbv4+WNFVeVHMcqJsm67AdztqJI67huwe40UrKildmcPLNE5HMdzUNWrdnJ0X fZf4jROxr1j0vw7TfUDDMxzuxWC6Le4brFFdLhFSd9Tup2xq+NZHIj+V0S822+3M3fbdC7GUcH+m mb8MFo4W8uqrhXWOyWyjoaK5tVkdZBPTM5Yqli7K1H+O6bKitc5q7opTKj7DnGmXNZbhxGXOa38+ 6QQ4zHFNyfF3q1Lm7/PyfiA3DtqXMrOG7BrjRvbPSvzKBzZo3I5jkfQVStVHJ0VFRFVF9ZonY16x 6X4dpvqBhmY53YrBdFvcN1iiulwipO+p3U7Y1fGsjkR/K6JebbfbmbvtuhffWbht09110UXQ3OUr JLTHT00dLWQPa2qpZ6dqNiqI3KitR6JuioqKio5yKmylE6PsOcaZc1luHEZc5rfz7pBDjMcU3J8X erUubv8APyfiAr12wdwu1w4sqd9XULNbPYnbX2h7Xc0T6ZzpnK9ip0VFlWXqnjsXt4GOIThZ004M MPqKnUvDsadaLe92QUs9dDFW+cEe5ZnPg372R716s2a5XNViN3TZCSeJngS0j4nsJx/HMpqrha71 ilG2htF/ouRalkSNa1Y5mOTlljVWo7l6Ki7q1zd3b1iwjsRdPLTkENfn+uF6yK0xSI91voLMy2vl RF35HzLNMvKvgvK1q7b7Ki9QPN/it1TXXHX/ADDWGC11VDbcrrnVNpSojVjpaGFPJoX/ABKqtp9n bKqI9r279D2Q19xSh4mezxrsa01udJfbiuI2m70EVDO2aR8tK2GoSHlaqqkj0hkjRq9eZdvFF24O KTszdIeIaz4nR4rdnad1uG2xtkt0tBQNqqZ1va5XshkhV7FcrXvkcj0kRVWR6u5lVFTZ+CLgds/B hQ5ZHRah1mWVmXLQeVTS25tHFClL3/IjI0fIu6+Uv3VXr4N2267h5c9lxxBYfoDxHTe2Jd4LRj+W 2iWyTV9S7kgo6nvY5YZJXL0YzeN0auXo3vEVVREVU9OOMTj0024fNJaq/wCn2a4flGb1zoYrFaI6 1tdHJzPb3k07aeRHNibHzqjuZu7uVqL1NU4j+ym0F11yWtznG7pccAyG5SOnrXWyGOahqZnLu6V1 M7l5XqvVVjexFVVVUVVVSI8O7EHAbdd46rO9eL3fLcx6OdSW2yRW6R6IvvVlfNPsi+vZqL8WwEpd nZxkcRHF5esruWouG4da8Rx2ligirLPQVcMs1ykeitiR81TK1zWxNe5yI3dFfEu6Iuy+YHaGfDR1 W/55b/R4j320x0uwLRrC7fp7prjdNY7DbGqkFLBuu7lXdz3vcquke5eqvcquVfFSjPEN2R3t860Z Xq97oLzH7J61Kvzd7FPKvJ9o2M5e98sZz+8335E8fADF8fvAfglXwr2PMNDsGobNdNM7f5XNSUEO z6+2Paj6pZHe+lljVO+53qrtklTqrkNB7Hniw8hrqnhXza5bU9Y6a5YjLM/oybq+pok39Tk5pmJ/ CSbxVzUPVejt8VPa4LVNyzxxU7ad/Mz0ZGo3lXdq79F+I85bx2NtNRaq1GpWlXEXUYVHBefPFkoo 8W8pfaXJL3kcbJvLGc6Ru2RqqxOiIi79VUI57bXSm8My3AdbaWjkltlRbH4xWzNaqtp5opZKiBHL 4JzpPPt/8pfmJq7Kjii0rr+G+1aO5LmtnsmT4XUVkPklyrI6Z9XSTVElRHNFzqiPRqzOjcjd1byI qoiOaq3VzHTXGdUdPKjTrVm027Jrdc6NlPdInUyww1EiIm8sbOdzoV5052Kj1cxdtnbpuefub9iL pzdbtNV6fa4X3HqCR6ubR3K0R3NYkVfetkbLAqongm6KvxqoEva59qxw56J6hrgMNNdc3Snp2SVt xxiamqaanmc5yLBzPla172oiK7lcqJzI1V5kciTLrBl0efcGme5vDYrtZYr7pveLhFQXaJkVZTxy 22ZzWzMY97WP2VN28y7b7Lsu6EBcPvZIaD6O5LRZnm9/uWod2tsrZ6SCvpo6W3RytXdsjqZqvWRU VN0R8jmfG1fEuFqfhftkaaZbp35y83eyixV9l8s7nvvJvKad8Pe93zN5+Xn5uXmbvttuniB4g9kz 8NbF/wDmu7f0OQ95ChvCZ2W3uXda7XrD7efsm820tXTebvYx5F3nfwuj5u98rk225t9uRd9tuniX yAEZ8T3watWf7xr9/QJiTDWdT8L9sjTTLdO/OXm72UWKvsvlnc995N5TTvh73u+ZvPy8/Ny8zd9t t08QPEHsmfhrYv8A813b+hyHt5qn/Yxy/wD5huH9HeU14TOy29y7rXa9Yfbz9k3m2lq6bzd7GPIu 87+F0fN3vlcm23NvtyLvtt08S72VWT2TYxeMb8q8m860FRQ99yc/d97G5nNy7pzbc2+26b7eKAeB vZjfDl0w/wDnXT9F1ZIXbFVF9l4uo4Lq6XyOHFrclsR3ve4V8yvVv/bd7v8AOnzFweGPsn/c4654 xrR7fnsh9jb6p/m32LeSeUd9SzQfuvlknJt33N7xd+XbpvulgOLbgo0p4vbLb4cymrbPf7K17bZf Ldy9/Cx67uikY5OWWJVRF5V2VF3Vrm7u3CKOBjiE4WdNODDD6ip1Lw7GnWi3vdkFLPXQxVvnBHuW Zz4N+9ke9erNmuVzVYjd02Q8i+K3VNdcdf8AMNYYLXVUNtyuudU2lKiNWOloYU8mhf8AEqq2n2ds qoj2vbv0PSDCOxF08tOQQ1+f64XrIrTFIj3W+gszLa+VEXfkfMs0y8q+C8rWrtvsqL1Jp4pOzN0h 4hrPidHit2dp3W4bbG2S3S0FA2qpnW9rleyGSFXsVyte+RyPSRFVZHq7mVUVAkV3Etp1pXwoWbWx yV2VWKy49aJayLHFgqqmJksccTXOY6ViNRr12du5Fbyu6eiu0XaN8bXCHxsLeMQ1AxPH7bJbHMWi tudsoZPL4novM+BJFcznaqdWtcrk3avh4bPwdcAuJcKON5xjtfmUmdxZ/DSUt1irrVHT0roIG1De 77nnk5kelVIjkc5UVETp47wtqj2LWiuU3mpu2mepF/wqGpesnm+elZdKWDdfexcz45Ub8z5Hr84G i9oPwxcBeFaLXvO9PrjjuK5zTLC600FlvaSpcpHSta6JaNZHojeRz3c8bWcuyKqqicq9HsPKnKVr dV6NHTrjbYrXKqO37ptcqzonJ6uZY0Xm29TWb/vTZMV7D3B6O4Ry5rr/AHu7UTXIr4LZYorfI5Pi SSSadE/xVL+6MaI6acP+DU2nmleNw2e0U71mkRHLJNUzuREdNNI70pJF2RN1XoiI1NmoiIG9GPyC x27J7DcsavEPfUF2o5qGqjX9/DKxWPb+NrlQyAA/m+w7OMj4YMx1gwKZZW19zx+96e1qN6bOfUMj kdt6tu5d1+f5z0w7FjTT2PaF5bqdVU/JU5ffko4HKnv6Sij2a5F/+dPUJ/1D74iuyJtuumtOVauW rXL2Lw5PVtrX2v2L+WdzMsTGyu73yuPm55Gvk94m3Pt123W4/DtoxbeHrRbFdHLVc/OUON0joX13 k/ceVTSSvlll7vmdyc0kj15eZ22+26geNmt99ufBd2h2f5RZIpYY1ku1woWRdGvZdbfK+JE/tWT1 LU+ZYvmJU7E7TXzvqxneq1VT80ON2WG00znJ0SorJedXNX42x0zmr80vzls+NPs2rbxealWvUum1 W9htZRWeO01MKWDy9KpI5ZJGSK7yiLlVElVvgu6I3r0JR4LOEi28HmmlzwOmy/2U1l3vEl1qrott 8hVyLFHGyJI+9l6NSNV35uqvd0QCi3ba6U3hmW4DrbS0cktsqLY/GK2ZrVVtPNFLJUQI5fBOdJ59 v/lL8xNXZUcUWldfw32rR3Jc1s9kyfC6ish8kuVZHTPq6SaokqI5oudUR6NWZ0bkbureRFVERzVW 7uomnWFasYdc8A1Dx2lvdhu8Xc1dHUtVWuTfdrmqmzmPaqI5r2qjmqiKioqbnnrm/Yi6c3W7TVen 2uF9x6gkerm0dytEdzWJFX3rZGywKqJ4Juir8aqBL2ufascOeieoa4DDTXXN0p6dklbccYmpqmmp 5nOciwcz5Wte9qIiu5XKicyNVeZHIky6wZdHn3Bpnubw2K7WWK+6b3i4RUF2iZFWU8cttmc1szGP e1j9lTdvMu2+y7LuhAXD72SGg+juS0WZ5vf7lqHdrbK2ekgr6aOlt0crV3bI6mar1kVFTdEfI5nx tXxLhan4X7ZGmmW6d+cvN3sosVfZfLO577ybymnfD3vd8zefl5+bl5m77bbp4geIPZM/DWxf/mu7 f0OQsh22mkt5qJMA1ut9HJPbqWCfHLpK1qqlO5X99TK7bwRyuqE3XpujU8XITFwmdlt7l3Wu16w+ 3n7JvNtLV03m72MeRd538Lo+bvfK5NtubfbkXfbbp4l180wrFNRcWuWE5xYaO9WK7wLT1tDVx88c zF69fWioqIqOTZWqiKioqIoHnz2SvFLpdTaEO0QzXNbPj9/xi41U1DDc6yOmbWUVQ9ZuaJ0ioj3N lfMjmJ1ROVfBen7xrdqvV6Nag27BuHCXBczZTUr5L9X1jJ62miqHORI4IZKeojarmtRyv6uTd7U3 RWuQ4dQexL0tvd3mrtN9ZL9i1FM5XtobhbI7o2Hf96x6Swu5U9XMrnfG5fE3PQbsgtCNK8hpMr1D yS46jV1BI2WmpKylZR21JGrujpKdrnul2VE9F0isXrzNcBn82setXGX2bt1qtQcXtdtzvKbX5/tl qtNNNCxWU9S2opI2slkkd3k8UTdt3bfZm+B50dmRxDYrw5cR8r9SK9tpx/KbXLYa2sqEVsdBUd7H JDLL62tR0axuVeje85l2RqqnvU1rWtRrWoiImyIidEQp1xLdl3oDxC5FWZ1bqi4YNlFwe6Wtq7Qy N9LWSr4yzUztkV6r1VzHMVyqqu5lXcCS9duNHQTRfTG650up2L3mvZRyPs9rt11gq6i41KtXumMZ E5Xciu5eZ/vWou6qeN/Z36RZDrXxc4ZVQ0009Di10iyu81nKvJCylkSaPnXw3knbGxE9fMvqRdrm 2PsOsSp7i2XJeIi719Ajt3QUOOxUkyt+JJXzytRfn5F/AXv0B4btI+GfEHYdpPjTbfDUObLXVs7+ +rK+VEVEfPKvV2267NTZjd15WpuoFLe25/sNad/3zzf0R5kuxN+Dxm39+kn9BpSf+Nzg792RhmO4 j7YvsQ8wXN9y8o80ecO+5onR8nL38XL77ffdfDwOxwTcI/uO9O73gXtg+y7zxenXfyvzT5B3W8EU Xd8nfS837lvzcye+226bqFC+2+/snaZf8w1v9IaXL7LD4DOnn/zbz+las6XG/wBn77srJ8ZyT22/ Yh7HKCah7nzD5w7/ALyRH83N5TFy7bbbbL+EmXhY0H9zPoZjui/sq9knmF9Y7zl5D5H33f1ctR+5 d5Jy8ve8vv135d+m+yB4+9rj8M+9/wDMlq/1B6EanaVXfWXsrLDheO0klVd26aY3dKCCNFc+aWkp aWo7tiJ75z2xPY1PWrkMLxcdl77qfWeu1e9vH2MeWUVLR+b/AGM+W8ncs5ObvfK499/Hbl6fGpcT SrCPay0vw/Tfzn5y9ilgt9j8t7jufKfJadkPe93zO5Obk5uXmdtvtuviB4m9lbxAYVoRxEVlPqLe aezWPMLO+0Lcap6RwUlWkscsLpnr0YxeR7FcvRFe1VVERVT1Y4ieOPQTh3wluWXTLrbk1dUzRRUN ksdxp6isqkc5OaRGo/ZsbW7uV7tm9Eai7uRFiXiL7J7QbW/Jq3OMUvFx0+vtzldPWpbaeOooKiZy 7ulWmcreR6r1Xke1qqqqrd1VVinDuxBwC3XaKpzvXi+Xy3sejnUttskVue9EX3qyvmn2RfXs1F+L YC2/Cdxh4Zxe2e+X3BsGy6y0VgnipZ6q809Oynnne1XLFC+KZ6vcxqNVyK1uySM/hGs3Hsx+B663 Cpulfol3tVWTPqJpPZLd288j3K5y7JVIibqq9ETYnjTHS/A9G8Kt2nmm2OU1ksNrYraelg3XdVXd z3ucque9y9XPcqqq+Km1AQ9ohwi8PPDjeLlftGdPfY9X3embR1kvnauq+9ha7nRvLUTSNb6Sb7oi L854rdpl8OLVD/lNu/RlKf0FHn1xM9k57ovXHKNZvb99j/sklppPNvsV8r8n7qmig273yyPn37rm 94m3Nt123ULv6Y/2NsT/AOY6D+jsP5+Ln8PKr/6XZP0yp/Q1jFm9jmNWnHvKfKPNdDBRd9ycned3 G1nNy7rtvy77brt8Z591XZC+U68za3e6F5e9y52VebPYnvtvW+U9x33lv/V5+T5+X1AX7zr+sjIf +aqv/UuPAvs1/hvaXf8ALa79H1J/QFfbZ56slws3f9z5fSTUvecvNyc7FbzbbpvtvvtuhQXhr7Jn 3POt+Laye395/wDY1PPN5t9ivknlHeU8kO3e+WScm3ec3vF3229e6BGXbbaU3iafT7Wqgo5JrdTw z45cpWtVUp3q/vqbm+JHc1Qm6+tqJ60JA7Jfif0uXh/h0SyrMrRYsjxSvrH01LcauOm8soqiV06S RK9UR6tkkla5qbq1Eaq9HIX3znBcQ1LxK54LnlgpL1YbxAtPW0NUzmjlZuip87XIqI5rkVHNciKi oqIp56Z72JGmV4u81bp1rTfcZoZXq9tFcLVHdEi3X3rZElhdyp4Jzcy/Gq+IEv6+dqbw7aFZ5Fgs cdxziRlOk1dWYxPTVMFHIrlRIFe6RrXSIibqjXejuiL13RJryDiWxzGeG5OJu7YHmcdhS1wXiS0J RQLdoqWV7Wte+Lvu7REa9sjvsnos3VdlRUStmg3ZB6EaVZHR5bqDkty1FrrfI2ampKylZSW3vGru 10lO1z3S7KiLyukVi/vmuL019ut91t1RaLnQ09XQ1kL6aopp40fFNE9qtcxzF6OarVVFReiouwFM 9HOOzhG4z628YHn+J2W1NoGxyUFDnjKF7Lkx/Mj1hSRXRo9mzd2I5XKjkVN0R20Mce/C9wB4ropk ed4bXY1iOaUkKS2emsl7R/nGoV6IkHkXeOarVRV3dG1qt98q8rVRdw1X7GHQ/ML1U3nTTP77grKp 7pFt7qZlyo4VVfCJrnxyNb8zpHfNsnQ1HGuw8wykuEcuY8Qd5ulEjkWSG24/FQSuT4kkkmnRF+fk UDSexAqcp9m+p9HA6dcb81UEtSnXum13fPSH5kcsff8A4Uam/ghYy59qvw9v1efofmeA5PZKZLtN Yb1cMjgpYqSilY50blljbJJvF3jURXO2RGrzL0RS0Wh2gul3Drg8OAaU42y1W1siz1EjnrJUVk6o iOmnlXq96oiJ8SIiI1EaiIkJ8UnZwaEcUF+kzi4SXLFMvmY1lRdrQrOWs5W8rVqYXorZFREROZqs eqIiK5UREQOvqVwy9nDqRZqm+5DZdL7XTzRrKt3st5p7UjN0373np5GRuX17vRyL60U8ldAaGPFe PHDrPoff6u82yg1FhobPcW9H1tqSt7t0j+VE9B9Lzq9dkTlVy7InRLrM7DW1pWc8nEtVOpeb9ybi TUk2+Ln8sVN/n5fxFseFns/NCOFWvXKMYp7hkGWvhdCt9vD2PlgY5Nntp42NayFHJuirsr1RVRXq iqgHnV20FRfX8UVhprg6XzdFh1I63tX9z2dVVXeKnq5lcmy+vZrfmLidnprzww6ccGOMrX6j4djF ba46qTI6esr4YKxa3v5FV741VJJXOZycmyOVW8rW+92SceLDg30r4usaobVnK1lsvFmWR1pvdvVq VFLz7c8bkcitkicrWqrF2XdN2q1d1Wo2IdiFgNuv8Vbm+u96vlojkR7qCgskdvlkai+9dM6abovg uzEXbwVPEDzz4yNXYdfOIzL9YbbbquksuR1EfmZaiF0az0NNG2kilRF/heTqqom+zuZviinrvqFZ 7ZxA9mZNieBXSkvVdLpxaayGmo52yyrUUUMFQkKtaqqkiyUyx8q7LzIqLsqKc/Ez2aGjeveH4hjW J179PKjB6J1rtM9BRJVQ+ROdzrFNE57XSKkiuej+8RyukkVyuVxkODPgexngfpcvyKq1VlyB18pY Fr6yroY7dS0kFN3r1fssknKiJI5XOc/ZEb6gPLPs0df8T4euJqkvmeXKO249klqqMerq+X9yo+9k ililf8TO9gY1XeDUeqr0RT1G41uMnRfAOHjK6TF9SMdyLJ8qtFRZ7FbrPcoa2aSWqjWJJ1bE53LG xr1fzLsiq1Goqq5EK36u8C/AzxFawOg0M4osZxrKskmmqH2Gy1FLeaSWZGulldBDHMxYl2a9ysSR WpsvK1qJsbdY+zX0J4RdM851rzbL6zM75juM3OooKmvpmUlFRz+TSIySOnRz1dMrlRrFdI7Zzmq1 qO2VAo32Wvw6tNv7m8/oisLT9ttpTeJp9PtaqCjkmt1PDPjlyla1VSner++pub4kdzVCbr62onrQ rT2UVjrrtxuYbX0kLnxWWhu9dUuROjInUE0CKvzc88afhVD3NznBcQ1LxK54LnlgpL1YbxAtPW0N UzmjlZuip87XIqI5rkVHNciKioqIoFCOyX4n9Ll4f4dEsqzK0WLI8Ur6x9NS3GrjpvLKKoldOkkS vVEerZJJWuam6tRGqvRyEl6+dqbw7aFZ5FgscdxziRlOk1dWYxPTVMFHIrlRIFe6RrXSIibqjXej uiL13RIgz3sSNMrxd5q3TrWm+4zQyvV7aK4WqO6JFuvvWyJLC7lTwTm5l+NV8Td9BuyD0I0qyOjy 3UHJblqLXW+Rs1NSVlKyktveNXdrpKdrnul2VEXldIrF/fNcBcvTLO6bU/T+wah0WP3iyUuQ0Mdw p6G8QxxVkUUibs71kb3tarm7OREcq7OTfZd0TZz8REaiNaiIidERPUfoAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAaxqhbslvGmeW2nDKiaDIK2xV9PaZYajuJI6x9O9sLmy7p3bkk Vqo7dNl67pseNeQ9n92mOtN4oLbq3JdLjTUruSnr8nziCvpqRHdHOa1s80jd/Xyx7r857dgCC+Dv hVxfhJ0mhwO0Vjbnea+Xy6/Xbu+Ra2rVqJs1OqtiY1OVjd/jcvVzidAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHXuFvobtQVNqudJFVUdZC+nqIJWo5ksT2q1zHIvii oqoqfOdgAeQWtnZFa34Fnr834Vsqp6+3QVfltqpZbmtvu9rejuZjY53KjH8i+9k7xjvDdN/SXEZV wi9rFrzboMG1cvlatgSRjnMvGWUTqNzmru18rKSSR8qovVFcxyovVOp7KACqvAtwJY3wfWG4XS4X mLIc5v8AEyG5XSOJY4KenavMlNTtd6XJzIjnPdsr1a1VRqNREtUAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwWc5S7CMRuuWMxm+5Ct rp3VCWux0qVNfV7f73BErmo9679E5kAzoKjXztG8Yxm8WXHsi4WeIm23TI5pKez0dViFNFNXysRH PZCx1YiyOaioqo3fZFQ3aDjJslPptnGqeYaE6w4ZaMEo4K2qjyTHYKGevZK9zOWkRahWyOYqJzo5 zERHt6ruBYMGOxy+UmUY9a8loI5o6W7UUFdAyZESRscrEe1HIiqiO2cm+yqm/rUwV41ES0akY/px 7CMsrVv9JVVfn2jtveWig7lu/d1VTzJ3Uj/BjeVeZfiA24AAACO8k1xxPF9acP0KuFvu0l/zagr7 jb6mGKJaOKOkZzSJK9ZEe1yp71Gsci+tUAkQGo6daiJqJDf5kwjLMa8wX6rsXJkVt8jdX9xyf1ZS pzO72lk5/scvTm5XdE2NuAAAAAAAAAAAACHco4mscwrTvUfU3K9PM+tNo01uU1uq21tojgluzY3s Z5Vb0klRs9O9ZE5ZFczfZenQ78nEXhMepenuljrXfPO2pVkqb9aZkgh8nhp4IUle2d3e8zXq1yIi Ma9N/FU8QJTAAAA1xuoeHP1Dk0pZemrlUNmZkElvSGTdtvdO6Bsyycvd9ZWOby83N03226gbGAAA MXlOTWLCsZu+Y5RcG0NnsVDPcrhVOY56QU0MaySyK1qK5eVjXLsiKq7dEVTlsF8teT2K3ZLY6rym 23akhrqObkczvYJWI+N3K5Ec3drkXZURU36ogHfAAAA1zPdQsO0wx/2U51em2u1rWUlAk6wySqtR UzsghYjI2ucqukkYm6JsiKqrsiKqBsYI7ybXHE8U1nwzQy42+7SX7OaK4V9uqIYolpIo6OPnlSZy yI9rlT3vKxyKviqEiAAAAAAAGuN1Dw5+ocmlLL01cqhszMgkt6Qybtt7p3QNmWTl7vrKxzeXm5um +23UY3qFh2XZBk2LY7em1t0w6shoL1A2GRqUtRLAydjOdzUa9VjkYqqxXIirsuyoqIGxgAAAR3pL rjiestyzq14xb7tSy6fZPV4nc1r4omNmq6fl53w8kj1dEvMmyuRrvjagEiAAAAAAAAAGt6i5qmnW E3bNVxTIslS1QpN5qx2h8suNVu5G8sEPM3nd6W+26dEVfUBsgIxvnEBieO6maY6UXWxZBDfNVaS4 1dp5qWJsdGlFSpUzMq+aRHxv5HcqIxr/AEkVF2TqScABHekuuOJ6y3LOrXjFvu1LLp9k9XidzWvi iY2arp+XnfDySPV0S8ybK5Gu+NqEiAADUbVqIl11Jvmm/sIyykWx0VNW+faq293Z67vv96pqnmXv ZWfv28qcvxqBtwId0b4oMN12zDIcbwLD80ktWOzVVJJlNXamw2WsqaeVkckFPOsivfJu/mRFjait a5d+nXf891Cw7TDH/ZTnV6ba7WtZSUCTrDJKq1FTOyCFiMja5yq6SRibomyIqquyIqoGxgjvNNcc TwbVzTvRi7W+7TXvUtLqtpqKaKJ1LB5vp0nm8oc6Rr27sciN5GP3Xx5U6kiAAAABomtus+E6Aab3 TVLUCWsbaLWsTHR0UHfVE8ssjY44ombpzOc5yJ1VETqqqiIqmExXX1+T3HB7bLonqpZH5ulyd3t1 x9kUVjSjarv9kntlclN3+20PvudVRF5QJWAAAGuZ7qFh2mGP+ynOr0212taykoEnWGSVVqKmdkEL EZG1zlV0kjE3RNkRVVdkRVTYwAAAAAAAAAAAA1HINREx/UHE9P1wjLLiuVsrnperfbe+tVq8mi7z auqOZO4WX3kXou539OnidvG9QsOy7IMmxbHb02tumHVkNBeoGwyNSlqJYGTsZzuajXqscjFVWK5E Vdl2VFRA2MGBzzLUwTDrvmK43fcgS0Ur6rzXYqPyu4VfL/vcEO7e8evqbuh3sfu/sgsNtvyWyvt3 nKjhrPI7hD3NVTd4xHd1NHuvJI3flc3ddnIqbgZAAAAAAAAAAAAAAAAAHxNL3MMk3dvf3bVdysTd ztk8ET1qavpbn6ao4Ja87bhmU4mlz77/AGHyi3eQXOm7uZ8X2aDmdyc3Jzt9Jd2PYvr2A2sAAAAA AAAFfl41tMEsS5B7GMv7hNUPal7vySm7zzvz8nfbeUbeS83Tn37z/wCGWBAAGDzrL7bp9hGQ57eY Kma341aqu71cdK1rpnw08LpXtjRzmtV6tYqIiuRN9t1TxAzgNX0v1CsurOnWOam45S1tNa8otsF0 o4a1jGVDIpWI5qSNY5zUciL1RHKnzqYPVTXHE9Ib9geO5Lb7tU1OoeQxY3a3UMUT2Q1MjVVHzq+R qtj2TqrUev8AagSIAAAAAAjvVTXHE9Ib9geO5Lb7tU1OoeQxY3a3UMUT2Q1MjVVHzq+Rqtj2TqrU ev8AakiAAR9rRrXjGhdhs2RZVa7vXU98yCgxynZbIYpJGVNW9WRPekkjESNFT0lRVVN02ao091rx jUnO9QNPbJbLvTXHTi4Uttuk1ZDEyCeWeHvWLA5kjnOajdt1e1i7qmyKBIIAAAAAAAAAAA1vUXNU 06wm7ZquKZFkqWqFJvNWO0Pllxqt3I3lgh5m87vS323Toir6jrVOqWHW684ZjN7rai1XzPmTusdr q6WRKiZ0FN5TOx/KitidHFurudyJv6KKqqiKG2gAAAAABHeY644nhOsGnuil1t92lvmpLLrJaqin iidSQpQU/fzd+50iPbuxdm8jH7r48qdQJEAIqybiX0tx/RLIeICgra+/4pjTqqOqdbKVUnkkpqla aZkbJ1iRytla5N1cjVRN2qqKiqEqgx2OXykyjHrXktBHNHS3aigroGTIiSNjlYj2o5EVUR2zk32V U39amRAAAAAa5nuoWHaYY/7Kc6vTbXa1rKSgSdYZJVWoqZ2QQsRkbXOVXSSMTdE2RFVV2RFVA2MG uZJqFh2I5BjOLZFem0l1zGsmoLJTdzI9aueKB88jUVjVRiJHG53M9Wt6Im+6oi7GAAAAEd5jrjie E6wae6KXW33aW+aksuslqqKeKJ1JClBT9/N37nSI9u7F2byMfuvjyp1JEAAAAAAAAAAAAAAAAAAA AAR3bdccTumu134e6e33ZuRWXHoMkqKp8USUTqaWVImsY9JFkWTmXdUWNE2/fL4ASIDoX6+WrGLH cclv1Y2ktlppJq6tqHIqpDBExXyPVERVVEa1V6Iq9DixXJrHmuMWfMsZrvLbPfqCnudvqe6fH31N PG2SJ/I9Ee3mY5q7ORFTfZURegGUAAAGo4TqIma3rKrKmEZZYvYtc1ti1d6tvktPdPR38ooX8y9/ B6ufZvX1G3AAa5kmoWHYjkGM4tkV6bSXXMayagslN3Mj1q54oHzyNRWNVGIkcbncz1a3oib7qiLs YAAAAAAAAAHQv18tWMWO45LfqxtJbLTSTV1bUORVSGCJivkeqIiqqI1qr0RV6HFiuTWPNcYs+ZYz XeW2e/UFPc7fU90+PvqaeNskT+R6I9vMxzV2ciKm+yoi9AMoDXMr1Cw7CLjjlpyi9NoqzLbolls0 XcySLVVixSS92nI1eROSJ68z+VqbIiruqIuvUGuOJ3HXi6cPMFvuzcjtOORZPPVPiiSidSyTJC1j XpJ3iycy7qixo3b996gJEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABULjC+FTwlf31Xn+iwG7doR8 DDVb/mRP9fEcHEjpJqFn2v8Aw8ZtiWP+X2XBb/c62/1XlcEXkcMsETI3ckj2vk3c1ybRo5U26oht PGNp9l+qvDJqDp7gVo86ZBfLWlNQUflEUHfSd6x3LzyuaxvRq9XOROgFX9WtOtXdOeD+m4k7XxI6 i0Oc45jtqvUVso7o2PHY49oE8iS3ozkkjZE7l55Fc97m8zlXdWknXzU3MbzxicOdLTZFdKCy5bg1 4u1ys1PWysoqiZaRsjHSQo7kkViu9FXIqp6jcNf9Kc+zbghvOkGMWHy3LqvEaG2Q27yqGPmqY2wo 9nevekSbcjuqv26dF8DXG6JanJxH8PGerjP+wWC4LX2a/wBX5bT/ANR1klGyNkfJ3nPJu9FTmja5 qeKrsBAdq1CtF+1BzXH+Ljiu1a0c1DbkVdBY7ZS3eWx2GG1tftSS0zkiWmqGK3bd8z1V3T53LfTR 2iyu36Y47R5tn9BnF5jo29/kVDStp4bm1VVY5msY5zd1jVm6tXZyorkREXZICvd94u/NF3051O4S 8S1ipXVNS2jvdNkVuobbW0z3uWHyiirEdJE5rFRruRH77Ltv4rInBvotlXD/AMPWNaX5pdaWtu9v dVVE7KSR76ak7+okmSmhc/0nMjSTl3XxXfbpsBG3EHkGd6n8WOB8KmN6i5FhOPSYtV5rktdjlX5H cqyFs7qenp46lEV0Le8Yqu5eqo5fiRU0Cp0/ybTXtF9EscuGoeQZdYvYvkNRaajIahKq40rnU70m gfUoiOmjRWxvY56K9O8e1XKiN2lPiE0r1ksvERg/FNofiFFmdwstjqsUyDGp7pFbpqy3ySLLFJBP N9iRzJXucqPVN9moniqpq9t054m9QOM7TLiF1C00oMXxeyWO8WmS1098pq6a1JJA5I5KiRrm97LP JIqcsDXsjbEzmduq7BxcOGoud3PRjiVvd51e801tg1Tyy3WrIcnqX1tLYaWJlP3SI2V+yQxczlZE ioxFXbbqqLXfU/Wm06X6QR6x6O8W+u2a53ZJKGqmlvFtuz8TvSuqI2VMfdzUjKWGFUe9Y1a9F6Na jlcqKTBNwfayZbwr8R2kFdb4LDfs91Tu+WY42oroZIa6hWoo54Fe6F7+7SXyd7Ua/ZzV2VzUQy/E Bg/F1xTcO170gXRKy6WxNt9PLJSz5JSV77vUU0kckNFSpT/Y6aFXxtd3kr0X0GM5URznNDYtccqz zWLif074ZcY1CyLBccrcPnzzJKzHavyS51cPfLBT00dSiK6JqSNVXK3q5HL8Sba3DR6uaTcemkuk dTrRmOT4Bc8evtxo6e83N8tQ+RKdyPhq3t5W1jYnsZJFJK1ZG965vMvKinaynEOIW36paR8T+N6S 252bUWLVWG5Pp5VZTRRVk1CkrpI5aWr5lgkVrt5VTfo1Wt8eZW4B9bqzkvaPaOZHqfjtBjE8mJX5 aLGaW4Nr5bbRthe3v6moYiRulmle5OWPdjWxxpzOdzKBkOGywama062a01GX636gUuMad6tVy2W1 W6+SxMqHtlY9aWoc7mc6iYyKNraZitj+zTbou6bdbVPLcFu+tebWfUnjH1SSpt9SyG14tpRS3Njb DAjdlbWvoaeZJahXJuveOTZeZOTbZrZn4T9Kc+00yzXW55tYfNtNmWpVxyCyP8qhm8roJWsSObaN 7lj32X0Xo1yetEI20Vwbil4bbnqNp7iOhtky2iyzM7jktpzSpyino6ZrKxW8vl9OqOqnui5UVyRt Xm6taqe/UI5x3iB1SzDs5dbckq9Qb9PkWn19ueNWvJ297bbrUU1PLSvhnl5UZJFPyVHI7dGv6bO9 LmVe9xD02s+jfDDinFRZdes7qtQKV1hra+3VF3e6wVjat0TH0jrf0j7pveo1Hr9lcjVc56udzHXt XDNxN4zw+cSHDvWYIzJJ82vVwyfH8pivFFA29VFVJSIsLqZ8iOp38sL5Fc9WsRd2oq9FWaeK/RTU 3UvguoNJsJxnzllcMWOtfb/LaeHZaWandP8AZZJGx+ikb199126b7oBp+vFj1H4bsl0W1Nteu2f5 Bcsl1Es+JZVbrrdlltFxp69JO/fFQ7JDTK1Y17tI2pyo5N91TdbrleuMvSrPdV7RpPS4DYfOkuNa q4/kl0b5VDB5Pbqbv+/m3le1H8vO30G7vXfo1epYUDzXzvL8syrhT43KfKMou14ismo13tlsZX1s tQ2ho2VFNyU8KPcvdRN3XZjdmpv0Qkuq+GPwnf8ARveP6Awxt24ZtbqnQLizwqDCea9am59dL3i1 N5ypE84UU00Do5edZeSLdI3ryyqxybdUToSTPorqa/iV4etQG41vYMGwm5Wi/wBX5ZT/ANR1ctGy OOPk7znk3eipzRtc1PFVRAOfgmy/LMrv/ELDlOUXe8R2XWK/Wy2MuFbLUJRUcax93Two9y93E3de Vjdmpv0QiGxalcRc+iPF7ddLr1fsjzTG9Ur1bsZhnmkr5aChZNTo+KjikVyIkUDpnRxNTbmRNmqv RZB03w3iK4ctU9XaXFdFIc+xjUfLqnMbVdqfJaO3pRT1TU76CrjnXvUa1zU2fEyTom+yquyY3QTR ji00o011vfQpjNHqNk+otblVoqK5zZrZdoZkgdLskcjpIGSK2ZrO8RHt9FXNROoGqaLXrTTOsgxq fQvj71Dkzelrqd92xrUG7SVSXKJF/qqkW21LYlZKqIqI6nXZnVU36OTs41pFR3LtOs2fLqDqBElt xO3ZNGyHJ6pjXvdcEkWhkRHenQoqqiUq/Y0RVTY7et+nPEZxYU2PYrkHCnZNMrpQXqguMue1eV2+ 4VNrjp5WyP8AIkpW9+57kbs1H8jfDdE6ObvmR4BrjgvG9NrfhGl8GZ4lmGKUOM3KeO+01BLZpIqt HPnfHN6UzEjTm5Y0Vyqqp026hofDZYNTNadbNaajL9b9QKXGNO9Wq5bLardfJYmVD2ysetLUOdzO dRMZFG1tMxWx/Zpt0XdNutqnluC3fWvNrPqTxj6pJU2+pZDa8W0opbmxthgRuytrX0NPMktQrk3X vHJsvMnJts1sz8J+lOfaaZZrrc82sPm2mzLUq45BZH+VQzeV0ErWJHNtG9yx77L6L0a5PWiEbaK4 NxS8Ntz1G09xHQ2yZbRZZmdxyW05pU5RT0dM1lYreXy+nVHVT3RcqK5I2rzdWtVPfqEQy59l+vfZ uayz5vn2T19bptkF6stHd2Sy2ysvNJSxRrC24RIjHPa6Or5ZIZGpusbOdFciqbRqdqLdOFLhA0jx /D9Vb/aqzVSvstLV5TkdxlursboZqKF1XLSpLzd3HGxje7hanK3nerdnbKd7T/hf4iLFotxHcN+S Y9S1zM8uN6yOwZq6507ILtV1cdO1sElK1yy07lWFXOc5ORFcqJuiIq7Je9E+ITWDh106p7hp5Qad 6o6KXiz3TG6e4XunuFJeH0FOxj+8kpuZIY5uuzV3cisaiqiKqgQxk/E7pNohfMMzXQfjUzTUuR9/ ordlGLZTeJ7pFcLZM7kmng72Fvk80a7OTu1RvzbIrXSJr/qK618U2TY1xLa2an6UaaMt1s9gNbit VUW63XKZ8W9atXWU8bnd6yX0WserWo1N123bzzdZ9QOM/OMmxy1P4f7BpnaIK6KfI7tecmprz39I 390p6OCkVHc7/wB7JKrUbt1avgcuoGT8VuJ55kNDb9DLHq7p9eGQvtMVHe6O1Vtu9DaaCqjrF7uo a5/pNe13ROioqrsgbHww0FyosHrXs4gY9X8bqLjJLjl8fJFUVcNErU/qapqonctTIx2/pq1ruuyp 0REg3tRMQjvumun92dkmR29Y88s9rdTW66y01PKyomRVlfGxUa6aNYmrFIvWNVcrdt1N84NNDM40 qr9Tc2zHFLLg8Wot+hutBhVmq21NLY444ljdvJG1sSyyqvM9I05PQbt/BbkeOXSPULWDRmhtul1p prtkWO5PaskprbUVbKVK5KWVVdCkr9mMcqOVUVyonTxAg7XPTXIrXxgcNumGD6i5JSTrj+UU0mS3 OuW5XeKldH3k72z1HNzTqxXRRvejkZzNXZeRENssNHnPD1xsYFpPQax55mWHamY5dqipoMvvDrpJ RVtEzvUlp5Xojo2uaiN5E6ek7x9Hl2GpwbW3Ubie0I10yTSZ+K0OOWTJaXIqN98o611qmqGOjpWK +N6d8sjWsdvE1yN59nKmyqbFqdpRn+Q8aGi+rNnsHlGKYlZsgpLxcPKoGeTS1NPyQN7pz0kfzO6b sa5E9ewFVaLif0w1n1E1Hu+vXGFl+ltvsWS1eP4njGLXee1KyhplRvl1RJDE5Z5JX7qjXqqNVrk2 VqtRLB8AOv1z1fsWoGF3bUFuepp5kS2+15V3SRy3e0zNV9LLM1Gt3mRGSNc7ZN9k33Xdy47BsF4j uE/MNQbJpho3SapYBmuS1WWWryXJKW01tmqapG9/TTNqtmyRbsbyOY5VRE3VFVyok/aJTa31uLVV 015o8bt18rrhNUUdqsjnzMtlCu3dU81Q5dqiZvXmkY1rV3RERdtwNa4uclq8W0Xr7jTa4W3SaOSr p4KnJKql8pmip3OXvIqWNN1Woe1FRuzXKicyom6IqVATWe16XaxaOT6K69a45hbszzGgxbILbqFS XSS31VJWL3bainlraWJscrHKjkbE5FXp6PKjkWy/Gjo5qJqZbdN8w0xsVDkl400zSiylccrqxlLF doYkcjomyyfY2Spuitc/0U3d69kWLuIbBeL7Xf2u9SqXRu3WBdL82tOTUuDy5NST196WCRXTSyVb VSlg5ERrI2I9yqkkznKioxihjcf0fo7v2muctm1D1CgSgxG35JGlPlFVEjnvr0kWifs70qFFVUSm X7GiLtsffAnpPSWjXfXu+rqBntbJied1Frigr8mqZ6e4MWm5Ulro3OVKqZqL0kfu5OVNvBDeqnC+ IHFOMam19x/RqO/2DOcKtmP3yBMjo6afHKllQ2SZz+df6paxu/7ii8you23Tfpaf6P654brJrrhV Vp8yXAtZbnXXSnzelvlM11p7+gkYjHUSqk8j0lVjEVqIibq7fZAIWvuc4neLHl99ufHNrLkuoFFN Xy01Vp5bbqmLUE7OZ1PTpDTU0lNLE3ZiPV0rt039JPfG9Xbik1ezbhO4fXWDIY7JnuuF9ocWrL/B TMV1DF3skdXWxRqnIkrkiRUTZETvHcvKqN2zGieBcW2JaA0HCfJo1YcTioqGqsdRn7cjpqmjWklf Ir6umoY0799Q5sjuVsqMbzrzuXbdhquIcLXEVXcK2nuAVmG2zFdSdBcpgv8Ai1RV3iGrt+Q91UTS uY5YFc6CN7JGt2eiOVzE35UVVQJ4xfh21j0p1KxjIdPeIbMMqxSR0sGX2XUC9Pubp4Vb9jnoZEi3 hma/dVbu1jk2TonRap6ccSk2lGa676Q6czWuq1Z1J1xvdtxikuE7Y6ai51jYtdUq7/e2Lvys6ule nI1HbO2tJjuQcaWp+pGJuv2m9DozhVinfWZGj77QX2ryD0dmUkCRRuSCLm6ukVWPVq9NlTZY2w7g dXOLTxFWfVnEobBcc81HuGQ4nkdPJTy11PAju8oayKSJ6vj5JHSL3blY7Z8iKicyqBaLRbTa5aVa f0GKX3P8izW8NV1Rcr3fK+Wpnq6p/WRWJI5yQRIvRkLNmtaieKq5y134trtqnV8WHDpppp3qZfsS o8wjyaC8ebqlUZLTQ0sUj3rC7eJ8zI++7p8jHd29yORF22Jv4brjrhU6Y0dr4hsXjteZWSV9sqa6 Csp6invUcXSO4Rdy9yxpK3ZXMkaxyOR3otRURK8cZLc5XjP4XJtNorfPkVNHl9VSU1wmdDBVtioY ny07pGo5Y1libJGknK5GuejlRURUAyOTNzLha4ntHbNZdWM4ynCtVqqvsF4tOV3qS6rS1kcTX01T TSzbviVXv2cxF5dkXp1Tl6GjlqzrjPv+pOpWWa3ai4ji9hzCvxPFbFht7daGR01HyItVUPjar55Z Fei7PVWtVHJsrVajdiXT/X/iE4jtNtR9V9J6fTXDdJ1rrjS0c2QUt0rLzc6iNsbHJ5Mqsiij5Ucn MqOXZU29L0etgmD8RvCflmoVh0z0YptUsDzPJarLbO6lyWktVXaKiqRvf0s7KrZHxI5jeR0auVER VVFV2zQ0S16ycUFDoVxI6UYle6/M9TtG7xFbrBelpGS3GttdQ9rmSPja3llqo6ZtQ5FRqq5yM6Oc npfui1600zrIMan0L4+9Q5M3pa6nfdsa1Bu0lUlyiRf6qpFttS2JWSqiKiOp12Z1VN+jkkTS/Qvi T07071S1LtNyxKl1r1NyFuSS0FRz1FqpII3IkVsWVNnOckSyN75E2Rz08UTmXT9b9OeIziwpsexX IOFOyaZXSgvVBcZc9q8rt9wqbXHTytkf5ElK3v3Pcjdmo/kb4bonRzQxuv8AqK618U2TY1xLa2an 6UaaMt1s9gNbitVUW63XKZ8W9atXWU8bnd6yX0WserWo1N123bz5zVG65pgXAdqvlGH8UFbqJRQs 8pxLK6Gual0oaVZ4G9xLX0z07+Vqq5FkRGO2cqKngiSvqBk/FbieeZDQ2/Qyx6u6fXhkL7TFR3uj tVbbvQ2mgqo6xe7qGuf6TXtd0ToqKq7JAjuEnWh3DfxG0VBp5ZccvmsFZTV1h0+s1zgdS2hInRo5 Fnd3dOksqIrn8uzPQbsvXlaH7xB0Ga5jxEcGluxjL6qzX28WDIWS3prWzVUEUlqp1q5o1kRzVnWF ZuR70ciPVrlR22y7ZeqXPOFHif0gsdt1nz3NMI1Yqq+w3a15heFuclHWxxNfT1FNK9qOj3c5EcxP R2R3xpy9nWfRPiEuGqvDPn+luLW+pn0tst1beluFyhggbLJQQRJRuVHLJvP3csKSxskaxXI9yK1O uTXANf8AiE4jtNtR9V9J6fTXDdJ1rrjS0c2QUt0rLzc6iNsbHJ5Mqsiij5UcnMqOXZU29L0QhXHd b7vw76N8Zuq2Owwy3m26w3amtiTM52MqqiangZI5vg5GLJz8q9F5NvWahmGvWmmCaWO1G067RLMs k1es9JFcpbbcrnPU2S81TdnT0aW90KQxRvTnbHyK1W+j6XrJ0tnBzm2oGlfFBpZntEzHU1P1FuWR YxXPqIahr4e8hmpKhzYXucxiyQojmORr+VXeiblR59x+VOKW/A4OHnF7VlUccFFVZtX5bTVNm3Zs klY2iiRKp3OiKqRKjdld4rtsoWD0xzSDUnTbE9RKWn8nhymx0F6jh337ttTAyZG7+vZH7fiK42Sr ybPuNjXPSa659ltHjaYVY3UlNbb3UUvm6WVE7yal5HbQSu9b2Ijl9alr6VtSylhZWzRzVDY2pLJH GsbHv29JzWqrlairuqJuu3xr4lfcB0pz6ycbOqertzsPc4lkmL2W3Wy4eVQu8oqIE+ys7pr1lZy/ G5qIvqVQIk7LPTeks+ll3zyPLsuqppchvloW2Vd8nmtjWsrGr37aVy92lQvdpvNtzKjn9fSU7/ai YhHfdNdP7s7JMjt6x55Z7W6mt11lpqeVlRMirK+Nio100axNWKResaq5W7bqSZwL6U59o5otXYlq RYfNF2mym8XJlP5VDUb089Qr4n80L3t9JvXbfdPWiH7xy6R6hawaM0Nt0utNNdsix3J7VklNbair ZSpXJSyqroUlfsxjlRyqiuVE6eIEJcSeneRWPid4SdOMD1AyCC4NjzOljyK8Vjrnc4oJKKJ1RL31 Rzd5M2F0qROejka5I92uRvKuyMt2c8N/GdpFp5ataNQMwxHVm3X+G5W3L7y66LS1NvpUqGT073tR YuZVa1Wt2Tbm+NETZckwbW3VHiI4Z9ar5pM/F6bD2Zf7KqF98o6x1oWqo/J6NFfG9O/WXka77C13 JzbO223Ni1p0oz/LeLjh41Px+weVYzgrcpS/13lUMfkfllvZFT/Y3vSSTnkRU+xtdt4u2TqBVWi4 n9MNZ9RNR7vr1xhZfpbb7FktXj+J4xi13ntSsoaZUb5dUSQxOWeSV+6o16qjVa5NlarUSwfADr9c 9X7FqBhd21BbnqaeZEtvteVd0kct3tMzVfSyzNRrd5kRkjXO2TfZN913cuOwbBeI7hPzDUGyaYaN 0mqWAZrktVllq8lySltNbZqmqRvf00zarZskW7G8jmOVURN1RVcqJP2iU2t9bi1VdNeaPG7dfK64 TVFHarI58zLZQrt3VPNUOXaomb15pGNa1d0REXbcCtnas4XT3zh+ocmkyHIaOS1X+2UraOiuksFH UJUVcTVfPA1eWWRnLvG5ybsVVVPEymW02R6ScW/C9pNj+pedXHHrnBmkl0ivOR1Vc+5qyg72Lyt0 jv6o7p7t4+dF5Nk5dtjeuO/SnPtZtA5MK02sPni9Ov8Aaa1KbyqGn+ww1THyu55nsZ0airtvuvqR VGsGlOfZTxg8P2qVhsPlWL4RT5Sy/V3lULPI3VlvSKnTu3PSSTnk6fY2u28XbJ1AiHhssGpmtOtm tNRl+t+oFLjGnerVctltVuvksTKh7ZWPWlqHO5nOomMija2mYrY/s026Lum2jSah2m66u6hY3xd8 UWrOjuUx5PW02J0Ftu01jsK2NqolJUQytiWnnVUVVc+Z3Xpum/MWX4T9Kc+00yzXW55tYfNtNmWp VxyCyP8AKoZvK6CVrEjm2je5Y99l9F6NcnrRDAX/ACHi4pI7/gOoHCri2stomrqh1su1JkNvt9HU 0T3KsMdXRVqOcx7GryucxHovqRfFwQxxq4Fk1Zwx6QVWaa4XTMrnBmtotjr7Ya11BRXelqqlXRVM kML3RyTxsjj5J0Xo7nc3ZXqXwwfEoMExW34nTX2+3mK3scxtdfLlJX103M9zt5aiVVfIqc2yKq9E RE8EKRXTg21ux/ghx/S6x0tovGa49m8GbwY/T3DuqKGNKx83m2nqJtmojWyKvM7ZvNz7KvRVuvp5 fcvyXDrde88wV+G32pSVauyPuUNe6k5ZXtYizw/Y3q5iMf6Phz8viigVlyuvzniQ4ucz0GpNU8uw XCNLLFbaq4txOv8AN9wutzr2JNHz1SNV7IWQrtyM23d1VV9X7nl+124MOH3WTNMm1IbqDZbDHTS4 DXXqR094pnVL2U6xXB/dsZO2OeaNzHIquc1Hcyt3Rrcnn2mWuOkfE3fOJDQ/AaHUK2Z5Y6S05RjT 7zDa6yOqpERtPVwTT/YnN7pEY5jlRfFU336cddovxEcSukurmL8Rdyt2J0mfQQU2KYnRyU9czGvJ +WRk1RVxMa6pkknjie5qOc1EavKqc3K0NQzfQnWfAOHK566UHFVqrU6nY9jb8rqkqr02Wx1NRDB5 RPSpbVZ3DYVRr2NRERUXlVVVN0MRnurup2supPB1UYRn16wuDVjH77W3+ntdU5sKtS2080yJE5Vj fJGizpDJI1/dvVr0RVTZdkyaPjkz3Qyp4cbhoPYrTdbvZfYtdM8ky6llta0r4u4nq46VieVK98XP sxWJyufvuu2xsNy4asrxXXDhPkwe0PuOGaO2TILPebo+pgifCktpjpqaR0Tno97pZGLv3bXcqqqr snUDQ63FdUsN4z7Zw34xxA6iSYHm2GPyO6+db0+4XOifT1EjHMoKyZHPpkkVsTXKm6o10nLyu5HM 3LQq45lp1xXaq8PFVqPleWYrS4rb8ps78kuklwrbdLK5Ypom1Mn2RzHKqORHKvLypt15lXcsg0pz 6u47cU1lpbDz4dbdPKyxVVy8qhTu66SsWRkXdK/vV3Yu/MjFb6t9+hx2HSfUCi42881eqbByYles AoLJQ3DyqBe9rY5+Z8XdI/vW7N68zmo1fUoFZ9A8a1d1Z7P2TXTLOJDVGDJ7TZL9X2Ce35JPC1vk M1UrFrOqurHPlie1yyuciRJGxiN5d1y2RJrRk3AtDxfXTiAzu3aiUuOwZHSw2e5+R2VrI3NRsMlA xO6m7yNOZ6yI5Vke7bZiJGkt8Nuh2qWAdnj7RmW4v5Bm/scyag81+W08v2erqK19Ozvo5HQ+k2aJ d+fZOb0lTZdlTodqlJ2bqaBsxffO0wRlm80+W0/+3EaiLH33edz6vfc/L84GPzDU7NL/AMTnCJHT 5LdrZas8xvJLjerVRV0sNJWSeZo5o+9ia7lk7t71cxXIqtXqmympcCGk1Jatedeb37P8+rpMUzyo tUMFdktTUQXBi03IktbG521VM1F9GR+7k2bt4Ib7UaHapSa38JuXsxfe0aZ4veLdlNR5bT/7H1E9 njp4mcvec0vNK1zd4keibbqqJ1OxoTgGuOj/ABL6rUtdpfBcsA1LyaTJYcugvtMzyBFpXL3ElE77 O9yyIyPdqIicyu3VEAkHjOv99xbhW1PyLGL1X2i62/HamekrqCpfT1FPIiJs+ORio5jk+NFRSuuo mU6v3vUPgxw7EtV8isDs9xW6eyCphrXyLWMZaaSWWeRj1WOWoa1ZnRSStfySPR+yqiotmeLHBsp1 M4btRMBwm1+cr9fbFUUdvpO/jh76ZyJyt55XNY3f43ORPnIjn0L1Tfq/whZQ3Ft7ZpdjV4t+WT+X U3+x1RPZYaaJnL3nNNzTMc3eJHom26qibKBjqqmzDh54z9H9P7FqxnWSYlqxbsgp7pa8pvkt1bTV NvpUqI6infNu6JXKrWq1qo3bfp4bXFcvK1XKqJsm/VdkK8a06UZ/lvFxw8an4/YPKsZwVuUpf67y qGPyPyy3sip/sb3pJJzyIqfY2u28XbJ1JuzbHn5dhl+xOOufROvVsqrc2pYm7oFmidGkidU6t5t/ H1Aed19znE7xY8vvtz45tZcl1Aopq+WmqtPLbdUxagnZzOp6dIaamkppYm7MR6uldum/pJ74uTwg ao5HrRw0af6mZe+KS93q1c1fLHGjGzTxSPhdLyt6NV6x8yoiIiK5UREToQRongXFtiWgNBwnyaNW HE4qKhqrHUZ+3I6apo1pJXyK+rpqGNO/fUObI7lbKjG8687l23YShwJYXqzpZoDaNIdXMAZjtfhr pqGlq4btT1sN2hfPLKk8aRKrokRHtbyybOVeuyeAGs8S+SZ9qBxLaYcLGI6g33CbLfLVcMoye6WC oSmuc1LBuyCngn2VYUdI13M5vXZU+LZdKu1s1c0c46OH/Stmtma5Hp7f6bJ6yKlvV1fNUyzR2yRX wVcjeVKyKNzIJYVma58bpJNnKnLtIPEtp3qda+IDS/iO0asdqym/Y9R3DH7nilXd4bdUXa3ztV/N SyzKjOeJyveqO8U5fUikU5HcdXsp7Q7hwyPU7FaHE0dbsrSgxmC5MuNRQQNtkiOqqmeJEi55pJEa jI+ZrWwt9JyuVEDKcNlg1M1p1s1pqMv1v1ApcY071arlstqt18liZUPbKx60tQ53M51ExkUbW0zF bH9mm3Rd027ujlqzrjPv+pOpWWa3ai4ji9hzCvxPFbFht7daGR01HyItVUPjar55ZFei7PVWtVHJ srVajZR4T9Kc+00yzXW55tYfNtNmWpVxyCyP8qhm8roJWsSObaN7lj32X0Xo1yetENHwTB+I3hPy zUKw6Z6MU2qWB5nktVltndS5LSWqrtFRVI3v6WdlVsj4kcxvI6NXKiIqqiq7ZoRxPrRq/auGvio0 vyTUS73HK9Fp5aK0ZZFMtLcp6CdveUkkkkPKqTtax6Okbsq7p4qiqs0a0Zfllq7O+5ZtbMou1HkU enFFXMu8FbLHWtqXUsLnTJO1ySJIqqqq7fdVVV3NaxLhE1Fvmhmu9NqRcrRQ6ja8zVlfVQ0crpaG 0r3StoaRZeXmkSNV2e9E8HKic227tcznFeMbUrhBrOHBNAqTHLzS4tBZam8T5TQVENzSliY1GUcU b92vqFia3edYmxtkeu71aiKHQ1LyXWHINTODfCMP1ZyXHlzzFbkuQVNNXPe6sjZaqWWaZ7Hq6OWo RizLHLK16skcj9lVOu2ZM3MuFrie0ds1l1YzjKcK1Wqq+wXi05XepLqtLWRxNfTVNNLNu+JVe/Zz EXl2RenVOXQtbbDqdjOvHBRYcTt9vZmlgxm+xrb7hU8kE0tLaKbymkdNHzoxZGRyxJKiPa1z0ds5 E2WUF0/1/wCITiO021H1X0np9NcN0nWuuNLRzZBS3SsvNzqI2xscnkyqyKKPlRycyo5dlTb0vRC1 d2e+O1Vkkb3Ne2nkc1zV2VFRq7KinnZiWqnEDV9mbpZndiy3NrncbjkkkGbZHQOfc7/S48l1rmVN TTul53ulYxkLEd1VjPiRN2+itzhkqLbV08LeaSWCRjU323VWqiIVB0A014sNB+C/TPD8OxSwNznF bjWzZBi13rodrhQS3CrlWCGthdJFDMrJYntequam6o7ZU2A4uHOu07yzUKxX7h345cpzOggbN7I8 RzO8SXWprafkXlfDDUpFU0kjHqiq9rVb0RFRE3RbluXlarlVE2TfquyFL7xpZrfr7rzphqPkPDfa NHUwG+Je7pkUuQ0Nwut2haxW+QMSiRVWKRV2csrk9FV2RF3a62+bY8/LsMv2Jx1z6J16tlVbm1LE 3dAs0To0kTqnVvNv4+oDzuvuc4neLHl99ufHNrLkuoFFNXy01Vp5bbqmLUE7OZ1PTpDTU0lNLE3Z iPV0rt039JPfGyatcQesWXdnnpNrPY8pqbPnF8yCyQVNZQzyUjKuZKqWB6SpC5u8Uro0c+NNmqjl TZE2Nu0TwLi2xLQGg4T5NGrDicVFQ1VjqM/bkdNU0a0kr5FfV01DGnfvqHNkdytlRjededy7bsNJ peHXiYruCnC+Hu7aQspMhwHNLXOyWHIKGWG52+Ktmnkq41WRvdo1sjU5Hqkjl6o31AbnxO49qDwy 2nBda8X171Hvd59mdotWQUN5vKz2m7UtU9WTtSgREgp1VduTumt5EVduuzku4V345dKM/wBYtJbH jGnFg873OjzGzXWaDyqCn5KWCZXSyc0z2NXlTryovMvqRSxAEVrwyaNrQebVxqbyf2d+2TyeXTf7 v9933lG/N73n/wB795t05div/ELluHz6+XXGdSOLbPrJQUltpVtWD6Y01wbcqR7mostRcJqCGaRy uVWqxruREa5vRfF11CneLYLxG8PuvWsGR4PofQajWTVK7098ob0mT0tskt72xq1aWrbMiyLGxznc qxNfs1PBVdytDRtCeKrMcY0U4kq6qyy+5rTaOzSzYpdMpopae6TwT07300Na2RkcjnMlYm7nsa5y OXwTlRPu9aKarycFF/1ruvEfqNeM2vundZkN4oLldGz2KeGpt7pqiiZQKzu4WpC97GPjVrmvRrt+ X0Du4Vwu6+LlHELp5qjZbfcrDrtbmVrs0t1fCymtlxWkkRadKJ7vKHxxzSo2N23WOFquXdyonZ8w 8cd64Ya7hdr9DbHba+mxKbFXZkmWUs1LcKSOlWFvcUqbTNnnjakSLKsbGuesjlRE5ANYp86z5eHr g84etPcyuGI1OrNupoLnfLY5GV1NbKGiilqGU71Re6kekjdnom6cvxKqHPxG6S5HpPrZwy0NNqtm OXYzXalUblp8suXnKro61iIjXw1TmpIscjHP5o3q5EdGxW8u7kXZ75w064W/Q7hpyvCsdt8up2hM FM6oxuuuMUUddDLTRw1tI2qYromyKkbEa/mVm3Mu69EX61Qwjiz191W0Qz6/6LUeF49gGa0twr7O uS0dwrViXrNXSyMc2JI40Y1jIolkkcsr3KiIiIBaOp100So8lXDKvWLB4MgbVpQLapMhpG1iVKuR qQ9ysnP3iuVERm2+67bFbcfTO+LbiG1cs1z1ezfC8C0ruVPjVrteH3Z1rnr67u1dU1FVUxp3jkRy bNYio3ZU9aO57F1XD7oLW5Suc1uiOA1GRurG3FbxLjVE+uWrRyPSfv1j7zvEciOR/Nzboi77kGN0 8164dNedR9Q9ItLqbUzDdVKimu9Xa4b9TWu4We6RRqyV6LU7RSwy83Muzkci7Jt6Pphpdj1G1R09 m4oeG/I9Sb9kq6f4RNkuH5LXVG14hpqi3SvWOWojRrnyQyqzkl6P3RV3T0UbisVwHVXMuBSj19yP iP1Pps5oMDkyC2SW3IZaeij8lpXSQNngTdKt0jYmrNJOr3ufJIqK1OVqbxjPD1rLf7XxD6y6k2G2 0GoGr2Lz2CyYtQXFlQy10kVBJBT08lUvLG+WV7mK9yKjEVN90RVRu+YTpTn1o4DKfRe42HusyZpr UY+62+VQu2r3UD4mw96j1i6vcic3Py9d99uoEFam59etUsQ4HNRMkdG67ZBmdjrq98bEY19S+l3l ejU6NRz+Zdk6JvsSrw4ZplWCcRGtPDjqRl91u7KKpZneI1t5uElTL5iq9mywNklcrkhppkbGib7I qvNMdw6ayLpfwg46mHf7IaXZBaa3LIfOFL/sdDDArZHc3e8s2zum0SvVfUimO7S7Dsqiu+mOdaS3 Wnos9yasrdL2wLv3ldQXemkY5enXaneiyI7ojFk5l8ERQ2jhjxR3FRiuXa16uXK+3jHMq1Bbf8Ht NTc6htLbLfaZ1joZYYedGxK+RkjpEaiJJytV3NuWZxXTHDcKyjLMyx22Pp7rm9ZBX3qZZ3vSomhh bDG5GuVUZsxqJs1ERV6+Jz6c4LZNMcBx3TrG4uS2Y1bKa10u6bK6OGNGI53xudtzKvrVVU2MCuHG rqnneGWTT3TXTG/LYMj1WzKhxRl6bE2SS10ciqtRURNdu1ZUbyo3dOnMqpsqIqcmL8O2selOpWMZ Dp7xDZhlWKSOlgy+y6gXp9zdPCrfsc9DIkW8MzX7qrd2scmydE6LkOL7Q3MdYcUxS/6YVtvps603 yeiy2wMuDlbS1ktOq89LK5N1a2Rq+O3i1qKqIqqmHx3IONLU/UjE3X7Teh0ZwqxTvrMjR99oL7V5 B6OzKSBIo3JBFzdXSKrHq1emypsoR1o5as64z7/qTqVlmt2ouI4vYcwr8TxWxYbe3WhkdNR8iLVV D42q+eWRXouz1VrVRybK1Wo3Rr1rVrDaOGLik0wyHUe812WaLV7KG05bBOtJcp7fO9r6V8ksPKvf o1r0c9uyqipvuu6rKWCYPxG8J+WahWHTPRim1SwPM8lqsts7qXJaS1VdoqKpG9/SzsqtkfEjmN5H Rq5URFVUVXbN1m58KGtFXwx8QE98tttuWrOt9a67S2a21saU1Exr2JTULKiZWMescfPu9VRqquyb 7czg1ziHptZ9G+GHFOKiy69Z3VagUrrDW19uqLu91grG1bomPpHW/pH3Te9RqPX7K5Gq5z1c7mNx 14seo/Ddkui2ptr12z/ILlkuolnxLKrddbsstouNPXpJ374qHZIaZWrGvdpG1OVHJvuqbruHFfop qbqXwXUGk2E4z5yyuGLHWvt/ltPDstLNTun+yySNj9FI3r77rt033Q2LjL0qz3Ve0aT0uA2HzpLj WquP5JdG+VQweT26m7/v5t5XtR/Lzt9Bu7136NXqBGlRS6jan8eupelEmruZWHBqDD7Pc56CzXeW mk79dmtZA/dfJWvV7nyPhRsjljYnMjVci4PQbEtUtQNYdbOHrLeILUafCNLrtRraqqnvj4L5UrcI FlZFPcmp37ooGxO5WoqK50u7lcjUakzYPpTn1n43NTNXrjYe5xLIMStFst1w8qhd39TA7eVndI9Z W7fG5qIvqVRoDpTn2E8SPEPn2T2HyKw51c7FUWCr8qhk8sjp6OSOZeRj1fHyvcibSNaq77punUCu D9WdWbbwP8TFnrdTckrr/pLmt2xSy5O6vfHdnUdPU03dPkqY1a9ZdpJEV++6oqJ4Ic2sOmiZ/wAW XCq27ai6gUcmX4teZqqe3ZPVU0tHJBZonLJSPa7endKqfZnM2WVPfbmw3bhn1uqeHjiwwWDCua+a l6iXe+4tS+cqRPOFDPPTOil51l5It2xvXllcxybdUTdDcNZdJtc7RnvDjrNppptDmddpbarjar5j 3numt8y+WW6Kn5455l7pUY5sirsqquzdt0VVQLc0sCUtNFTNllkSFjY0fK9Xvdsm27nL1VV9a+so tqnluC3fWvNrPqTxj6pJU2+pZDa8W0opbmxthgRuytrX0NPMktQrk3XvHJsvMnJts1t5bbPWVNup am4UPkVVLCx89N3qSdzIrUVzOdOjuVd03Tou25TjRXBuKXhtueo2nuI6G2TLaLLMzuOS2nNKnKKe jpmsrFby+X06o6qe6LlRXJG1ebq1qp79QjnHeIHVLMOzl1tySr1Bv0+RafX2541a8nb3ttutRTU8 tK+GeXlRkkU/JUcjt0a/ps70uZV2TWrENWsM4QvdOQ8RGo0Wo9osVtyJ0cF6c2yK56wq+kW37dzJ EjHuajpEdI5URz3OVVRcDauGbibxnh84kOHeswRmST5terhk+P5TFeKKBt6qKqSkRYXUz5EdTv5Y XyK56tYi7tRV6Ktidf8ASnPs24IbzpBjFh8ty6rxGhtkNu8qhj5qmNsKPZ3r3pEm3I7qr9unRfAC PdYdRNQdZ9Y9EOH7Gc6veCWrNcXmzfKrhjtT5NcX0zYUWGlp59ldCiy8yOcnVUVPi2XUcq05yXTH tBuGewVmo+SZdj0lHl09qfklWlbcaSZbVIlRE6q2R8sSokDmd5zOaqyJzKitRu8al6I63Yxlmh/E BpJiFDkuUae4z7GMjxWpusVE+vo5aZrVSGpfvE18UneL1Xld6OyqiKi9GXTzih1O4w9Etfc50toc VxTEqfIaKqtUV+pa6ptST298cdRUSNc1JHTyytYkcDZEjbAjnu9PoFtstxyHL8auOMT3e72uO5QO p3Vlorn0dZAi/voZ41R0b09TkXdDy20pwaG39k3qDqC7K8praq922508turbzNPbYO7vDk7yClcv JFI7l3e9qbuVVVfE9YDzyxLQDifsPBTqPwhXDRiB9RTUtwTHb/T5LQuivj5rik7GNhc9roPQfI7m lVqegibbrsgdjVrTrV3Tng/puJO18SOotDnOOY7ar1FbKO6Njx2OPaBPIkt6M5JI2RO5eeRXPe5v M5V3VpmeKvinfTZZozpdetW6jSXGc5sK5VluSW5VbWx0yxIsNHSy8j1hdJKj0WREVyJyqi7I5HTL r/pTn2bcEN50gxiw+W5dV4jQ2yG3eVQx81TG2FHs7170iTbkd1V+3TovgalqPoNrDZ7zonr3pNZL bdc200x5MfvmL3C4MpW3aglpmMkhiqtnRxyxyc7mqvoKq777N5XBEulvEnguFcUGnmn2jXFFkere E6hrWWy8WzJbjNcquy1zIuelqIKmaNsnJI7djo1VUTZy9VVvL6GuXlarlVE2TfquyEH6d5fxWZzq NQ1uaaR2PTPBKCknSuo6+9Q3i7XSpciJD3LqR3c08bFRVcrlervDlTfdsr5tjz8uwy/YnHXPonXq 2VVubUsTd0CzROjSROqdW82/j6gPO6+5zid4seX3258c2suS6gUU1fLTVWnltuqYtQTs5nU9OkNN TSU0sTdmI9XSu3Tf0k98dbiFyK/8QvA9w/6xZjk9+o75dsos9tuMdquUlHS1b5Kt0UlS+CNUYsyO pkfG/b7G57+TbclvRPAuLbEtAaDhPk0asOJxUVDVWOoz9uR01TRrSSvkV9XTUMad++oc2R3K2VGN 5153Ltuw0qn4b+Jut4HMZ0Pq9KqKjzHSvKaC7WyB2Q0j4MjggrJplWKRrtqf0ZkTaZWqvKvRN9gO 1xJ6BW6g4oeF3Cmaq6qS094lySjkrZszrX10Hk9G2VssNQrueKV3fOY+RvpPY1jV6NQ3jiOv+K2n Vy0YNn/FtnWNWOix6JKLD8Djr5ciq6lF5Vra2po4pp1jc1FREVGIqojt1Xm37uuOJ8R2d5HoDxE4 9oTG/JtPLne33rB5MoomzsgrYkp2PZWqqU71RkSSKiLuiyI3rsqp1rVhnEjpBxK6h624xoHS51Ra uWmxSzQsyqio6rG6ykpe6lo5JJ+ksKuVV54Ud0Yz0V2AwvCRxCXWgyTX/DblnGY5vhmmFDQ5DYLh l1JNTXtKWWjlmqKao8oijlfyvi2Y6Rm6p6XVHJtxaN6Ua7cSGhFFxD13FDqHjmomX09Td7HQWu6J T43a/sr0pKd9CkbmzRcrWd45/M9UcviqKrsvpbobxB2DiX1LyTVfDbbkGMa42Ckp77eLRdoYoLA+ GmmiSibDKqT1DUjcyJJWs9Lo9Ubu5renpxYeObh90iXhuwfR6wZU6zNqrdjGoK5PS0tLT0ssj3QT VVDK1Zlkh5+rGI5ruVE67K5wYTiW1FXRniR4UNROIK/Wikqccx/Mpsjrraj1pZapLQxjvJ2vRr17 yVURjFTfme1vUknQrJ8/zbH7/wAbup+VXODH62xVNfiWD2y8PW3W6zwxvkSarZG7uqiulRqq5Xo7 ut+XoqcsfXzfh11Sy3XfhgyXP6Wj1Bt+n1vv/s1vtVDRQwrcJqFiU0yUi8qqi1LEVndxrycjXO2V OY7mlugme6K6lZloxZMbfeOHrUCkq66jWOugY/Eq2drm1NE2KR6SPppd1czu2u5HOaiom73qFXNO uIXS/VrT92pOtfaBZng2pN8fUVVPZbBdJ6O04+iSPSmp1o2QrHUIjUY56yOVzkXbdF3cuzZjxSax 6ocEejOqGNZfLas8qNUrXjlxrLdPJTU1ylikqY9pmRK3vIJkbC+SLbkVVVOXZERJd0ct/GPwxacQ aC2fQS1al0ONvqKbHMrgy2ktsEtG+V74UrKaZO+Y+Pn2ckaORURERenO7N8Q2kPELqloto/Zr3Q2 XI85sGoNhyHJn2V7KKihpoHzLNJElTIivSNr2N2ReZ6ormsTflQJ20i0vn0qsFXZ6zUfMs1q7hWL X1Nxye5eVzpK6NjHMhRGtbDDuzmSJiI1qudt4lfuLC76l1HFdw4ab4HqRfcVocwblUF4S31Tmsnp 4aOGRzliXeJ8zI+97p72O7t7keiKqbLborzrLpTn2V8XXDxqfYLD5VjOCsytL/XeVQs8jWstzYab 7G96SSc8iK37G13L4u2TqBDdbiuqWG8Z9s4b8Y4gdRJMDzbDH5HdfOt6fcLnRPp6iRjmUFZMjn0y SK2JrlTdUa6Tl5Xcjmbxw/3HMdOeLnU7h5rdRsoy3FKTGbZlNodk9zfcKy3ySPWOaJKmT7I6Nyru iOVeXlTbrzKu2ZBpTn1dx24prLS2Hnw626eVliqrl5VCnd10lYsjIu6V/eruxd+ZGK31b79DDVuh OoF94s9Vc2qaB9uxLMdMYcVob2yphc5tar3I9EhR/eorGu5uZWo1dui7gVzvuc4neLHl99ufHNrL kuoFFNXy01Vp5bbqmLUE7OZ1PTpDTU0lNLE3ZiPV0rt039JPfGf1T4gNaM24HeHvVnHcvqLHm+UZ zYaGrrKOWSnhrJO8qoXNqI4XMSSCV8TXyQ9GO8NkRE23PRPAuLbEtAaDhPk0asOJxUVDVWOoz9uR 01TRrSSvkV9XTUMad++oc2R3K2VGN5153Ltuw0mzcOvExUcKukWh160hZR3jS/Uyz3GeoiyChmhr 7VDU1UstbH9kRWI1JmJ3bvsjl6o31IG78RVhzvhiu+k+qeJ666kX2pvOoNoxjI7df746rt1zo63v Emc2k5Uhp5E5PR7ljEbzdE6IZ3isy3G6bWGxYzn3FTleE2B1lfPBhuAUtYuQXCsWRU8qmmo4pZm0 3IitRvKxFcxV5l6obnxraUZ/q5iOnVr09sHnWpsWpNiv9wZ5VBB3NBTrL3028r2o7l5m+i1Vcu/R FNPvun+vOkPF3nWu+nmjtNqZZNRrHbKByR5BSWyrsk9HG2NY/wCqVRHQycjXr3e6823o+j1DS+Fv iFuljz7XPBnZ3m2c4RgWPU2V2GqzSlqIL1AzuHvqaaV1TFHNIxXNTkc9ngnRV3VTn0D0/wBd9VdA qLihruI7PI9SMjpKrIbbaGXBvsZgaj5Fp6F1uVqsdC9jGtc5FSROdVa5Fbuvdw/Q3iLo+JvN851O w22XrG9acRjs9+rbPeIY4cXVjHxtpWxzcstU1sKMasrGJzPc52zUXlTq6MUfFppdoC7h7h08xmot lgpK+10GqMOU0z7bHbueVfKvIm71DpomK5qRqjWq5iI57U3UCJ7LxWajYP2d+iFyr9VK+gyfUvJ6 ywXLN71NJcKm1W9LpWJUViulV7pHxwsjY1F32b73ZWt2/Mn4ndJtEL5hma6D8amaalyPv9Fbsoxb KbxPdIrhbJnck08Hewt8nmjXZyd2qN+bZFa7OcPmgmaaudnXoReNOayhoM806yOqzHHkuXM2lq5Y bvWu8mlciKrWSsci77eLWouyKqpZaz6gcZ+cZNjlqfw/2DTO0QV0U+R3a85NTXnv6Rv7pT0cFIqO 53/vZJVajdurV8ANEySfOeI/jLzXRZNVsywrB9KLDbKippsTujrbV3O517EmY+aoYnP3TYl27tFR N2ovrXfAaA4xlOGdo5qLjGT5lcMpbQaaULLbdLlyLXS0S1kTmNqXsa1skjHOkZ3nKiuaxiu3crlX cs205150e4q8i4hdGdNKTUaxai2OhtuQ2VL5T2qso62jRI4amN9RtG+Pumo1W7826u8Nk34dCtKu IWHjKzPX/V3EbdZ7VleE01vpIaC6Q1cVtmjqY+WhV27ZJZEjj718qRtjV8jmtVURNw33jrx5uQ8J mp297vVsW2Y3cLi11ruElIs6xU0n2CZWKneQPRVR8TvRenRSu8t+zPQHgr0QxzSXPMi9lmt1ZiOO 0dzvlxkubbC64UUXeOo45lVsMTEZysib6LOfdE6FxNf8DumqOh2f6cWOaGK5ZNjdxtdE+d3LGk81 O9kfOqb7N5lTddl2Tcq/NoRxB6tcKeB4HftPKHTvUbRKux644nLW3ynuFJdqu1QJEkki03N3EciI voqqqjlbv0TcDg4kMW1B4LtPbfxD4NxAaoZSzG7vb48ms2XX5bpRXa3zzthlRkT2olPLzParXRcq J16eBeRrmvaj2Lu1ybovxoU11hw7ig4v8es2jGfaF0Wl+HT3aiuGW3apyqkuj6ylppEkWlooqbd2 73taqPl5Nkb1QuUiIibInQDz/rdS9R00z44K5uoOStqcSvldFYJku1QkloY2m5mtpHc+9O1F6okf Km5286wrVmg4KYOJefiM1Kp9RbbhtDlUXkd8fHaWKkEcqUz6HZYp292vK58vO9793ucu/KZqq4ct ZZNPuMCxsw7et1SvFZVYnF5xpP8AZGKSn5GO373aHd3TaVWL8ZKuoWlOfXzgPqtGLXYe/wAxk05p rC22+VQt3rmUUcbou9c9Iuj2qnNz8vTffbqBXbXfGXaza98HuXXbNM0s82pFouNZWx2XIamiZb5G WiCfnokY7+pnuWZzZHs6vaiNXdEO1rpxD4u7ijufD5qbxJ5HpTp9p3j9vWWe03Gamu2Q3Sohjlb3 laxj5WxshkarkarVc9VVVXf0d31L0V13s9v4VtQ8C04gyq/aMWx1DfcaW9UtDK9am109NIsdRK7u V7t0L99nLvum26bqmcyLTnX3TTiCquKDSnTKhytmoWNUFtzTDH36CiraOvpmNSKenqpUSCVGMTun Iqt32VU35k5Q0jhP4irXceIfLOH7C9e7pq1g1RifsnsF7u07p7lbKmOZIaiglqXMY+ZNntla5yKr U5U33VTp8CEuoN84a7DxW6wa0agZC/GrbfZaOzSXyR1DV0dM+qa+Sta9HPqqjnSXle96oxscKNRO Rd7K6S3niUy+9ZFfdX8Gx7B8clpI6ax45BcG3K5pMnN3lRU1cSpAjXIqI2NiO29bk2Xn07gq0Pyz T7gwxzQ7WLHnWm7JSXmhu1A2rhnVkNVXVT0RJIXvjXmimavRy7c2y9UVAIq0b0o124kNCKLiHruK HUPHNRMvp6m72Ogtd0Snxu1/ZXpSU76FI3Nmi5Ws7xz+Z6o5fFUVXcHFRxC5hg2W6O6A6r60UumT L9ZpbxqDl2OK9kknctVjIKCR0avgSadj93cnM1FbsuyKjslpxYeObh90iXhuwfR6wZU6zNqrdjGo K5PS0tLT0ssj3QTVVDK1Zlkh5+rGI5ruVE67K5206maC6/WfJdH+IDDLvbdQdTNO7VPZsno6+SK1 x5NS1Mf2buJGsSKneyRz3MRzUbsqbru1UeESaW8SeC4VxQaeafaNcUWR6t4TqGtZbLxbMluM1yq7 LXMi56WogqZo2yckjt2OjVVRNnL1VW8uz6JY3qVrvrvxD45l2uOodtw3E81dTWq32TIJ6OZJZGLu xKhFWSGCNrG8kMSsYrpXq5F2aiTtp3l/FZnOo1DW5ppHY9M8EoKSdK6jr71DeLtdKlyIkPcupHdz TxsVFVyuV6u8OVN921t0AyHW7DOIPicv+mWmlNqFaqnPVpq2zMvUFrraWoZGro54pKj7DIx7Xua9 rnNc1WRq3m3ciBhcou2c3jRXi64cs91Ny29u0YpfOdkvjro+G411urLdPNDR100fKtVGiMVsiPTa RH7L0RES0/BLgdNhPDTp9PTZNk13W/4vZrrI29XeaubRukoIFWClSRV7iBv72JmzW+oirCeGDV7I 9MeJDJ9SaO02PUPX+lqIILPDWpUwWmnio5aegp5ahqcr3J3qo9zEVu2yp13akwcIzNXLRovjmB6v 6U+wq44ZaLdj8Cpe6W4tubKamZEtS3ydVSJHciLyOVV6/NuoQPx0abU+V8THDh32aZna2ZBfqy2S x2m/1FGylSGnV7Z6ZrFRIKhe9c10rfSc1GtVdkMXcdNslybtErzp5j2pGSY5bKbSK2RXa80VXzXq qpYatGtiZVyI5zJJJOR8k2yvVGPRFar+ZJf4wdMtWcky3RzVfSLC4MwuGmmSz3GssTrpDb5Kumnh SNyxzTqkaK3l8FX98myL1Gnum2qs3GfdNeMqwVbFYr5pbbbRJvc6ap8luyVLJpqP7G/nf3acyd6j Ejdy7ovVEA0/RfI8x0Q4p9UNCcg1Qy7N8LtWD0+c26XJ7gtwuNAqSd3PClQ5Ec9jt1VEd4crduvM rq96a8SGlutWG1WpuvPHlmunmcXyqq5qDHMau89Dbsdp2yvZTROp44VZVLyta9zpFVXNciLsu7lt 5RaM5pU8cWY6p3jG0dgl90zgxlletXCqTVflaPkg7pH96n2PdeZWI31Iu/Q0PRewcW/CfgbtBca0 It+qWP2Krq/YtklPltHa08jmmfMyOtgnTvEex0jt1iR6KioieG6hIvAdrtkHEFw90GWZdcqW5360 XKssFxuVLGkcVwkp3pyVLWIiI3vInxOVERE5ldsiJsiWHNR0oh1QhwC0N1mrbDU5i6Nz7m6xwyR0 THueqtjjSRyudytVrVcu3MqKqIiLsbcAAAAAAAAAAAAAAAAAAAAAAAAAANL1m1UsuiOmGQarZHZ7 vdLXjdMlXWU1pijlqnRc7WucxskkbFRqO53bvT0Wu23XZFDdAQ3rvxV6ZcPulFo1jyymvV1sd9np oLfFZaeKepmSaB9Q16MkkjbyNiie9y83RE9ZnNTtecL0tpcGqbnS3O7u1DyGgxuxxWmKOV8k9W1z mTO7yRiNga1que9FVURU6LuBJAIByzjLwOy5nfsFwzTrUjUm4YpIlPkEuGWBK+ntc/isEsr5I2ul REXeOPncioqKm6KiajxIcQdk1D4EM/1m0Nza50axW5WU9fRSzUFwt1UypiZLE/ZWyQSt3VFTp0Xd FVrkVQtYCDMg4kcN0a0305XMUyHI8oy+10kdosdkon3G8XedtNG+Z8ce6cyNReZ73uaib9V3Uyuj 3E7gGsN+veFwWbJ8Py7Hadlbccbyy2ebrhFSP6NqUZzOZJEqqic7HuRFVu+3M3cJeBWWbj70wnor nk2K6ZarZXhdnmmirMyseMd/ZmpCqpNIyR0rZJY49ncz443NRGqu+3U3HUXi60X01wDBNVLnd6u5 YlqFd6O0Wu7W2JskMS1EckjZ50e5j2RNbE/nRrXSNVNuRV3RAmkFdKrjm0wx/LqTDNRMF1HwatvN LNU2B+QY93Tb66Pl+wUbYZJJH1DlexGwvYyRXPY3l5nNRdl054pMRz7U+o0cumD5vg+XMti3mkt+ VWyOlW40SP5HTU74pZWPRrl2Vqq1ydenou2DKa28OWA67SWC6ZFW3+x5Dis8lRY8ix24uobnbnSN RsqRSoipyvRERzXNci7eBjtH+FrA9IcwuepHsjy/NM0u1G22z5Hl128vrmUbXI5KaJUYyOKPmRHK 1rE3VE3MJlnGXgdlzO/YLhmnWpGpNwxSRKfIJcMsCV9Pa5/FYJZXyRtdKiIu8cfO5FRUVN0VEkvS LV/AtcsHpNQdObwtfaqp8kDkkidDPTVEa8skE0TkR0cjF6K1U+JU3RUVQ3MEYa88RGn/AA5WvGb5 qO25Mt2T5DTY5FVUkLJGUk0zJHpNPzPaqQtbE9XKxHu8NmqaHVcc2mGP5dSYZqJguo+DVt5pZqmw PyDHu6bfXR8v2CjbDJJI+ocr2I2F7GSK57G8vM5qKFiwQzpzxSYjn2p9Ro5dMHzfB8uZbFvNJb8q tkdKtxokfyOmp3xSysejXLsrVVrk69PRdth8s4y8DsuZ37BcM061I1JuGKSJT5BLhlgSvp7XP4rB LK+SNrpURF3jj53IqKipuiogT8CJbdxT6IXPQyt4iocvSLCrXG9a+pmp5GT0kzHpG6mkgVOds/eO axGbbqrm7bo5FXTrVxv4K+62KkzbSfVjAbZktZDb7XfcpxnyS2z1Ey7QxulZK90KyL73vWs9e+yI qgWLBCGonFnhmD6h1ulNgwDUDULKbRSwVl3oMOsiVq2uKZOaFamSSSONjnt9JreZXKnXYymDcUek WcacZNqd50r8ft2EyTwZPR36hko6+yzQsR8kVRAqK5HcqpsjebmVdm7rugEtgrFB2gGl0NPaMgyb THVfFsNvk8EFDmV7xfyeyvSZdoZHSpK6SOOTdFa98aNVFRd9upI2t/ElgehNXj1jvlryLIslyyaW GyY3jVu8uudd3bUdK9kaua1GMRUVznOanj47LsErggPDeM/THMtVsd0TjxjNLNmd/hrpprVerSyj mtXk0KTKlU18nMiSRuRYnxJKx+y+kmy7feZ8YeC45nV505xDT/UTUm94yjEv0eF2JK+K1Pem7Yp5 XyRs7xURV7tiud0VNt0VECeQaPo5rNgOu+Fx51p3c5aqh8oloaqCpgdT1VDVxKiS01RC9EdHKxVT dq+pUVFVFRV3gAAAAAAAAAAAAAAAAAAAAAAAAAR3mOh2J5trBp7rXdbhdor5psy6x2qnp5Ym0kyV 9P3E3ftdGr3bMTdvI9my+PMnQkQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAEY638POA69U1kflU96tV5xirdXWK/2G4Oobna5nIiPdBM1F2RyNajmuRWryt6boiphdJeFT A9Ks4rNUKnKczznNKui82NyDMLv5wq6aj5uZYIOVjI4mK7qvKxF8evVd5oAAAAAABHeY6HYnm2sG nutd1uF2ivmmzLrHaqenlibSTJX0/cTd+10avdsxN28j2bL48ydCRAAAAAAAAAAAAAAAAAAAAAAA AAABDli4XMHtus82u2Q5TmOX5HFJWPskWQ3VKqix5lS5Vljt8DWMbC3lXkRXc7kYiJzExgAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD88eilYq3s+9KHQXawY5qPqpi2 G3yolqbhhtjyhaayTLKu80aQrG58cb915mMka1UXbbbZCzwAxGI4ljmB4va8LxC0QWuy2WkjoqCj gReSGFjUa1qb7qvROqqqqq7qqqqqplwAAAAAAAAAAAAAAAAAAAAEd6YaHYnpNlGfZbjlwu1TWai3 vz9dGVssT44ajk5eWBGRtVrNvU5Xr85IgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYLPMQtm oGEZDgd6bzW/I7XVWmqTbf7FPE6N3T8DlM6APNHQWOXiXn0d4d82RVdpNgeV0WWU7vTayrSSTH6S NyL+/bAk8ib9eu/qM1ww5Jctd9VeHvD78ivn0Fwe71eQRuXmRt3jqXWWnZL/APERlLJO3frs7f1l 1cD0F0l0xzbL9RsGw+K15FnlS2ryCtbVTyrWSo97+bkke5kW7pXuVI2tRyruu+ybNO9BdJNKMszD ONP8OitN8z6tS45DVtqp5Vrajnlk5uWR7mxenPK5Wxo1qq7qnRNgo/wN4HxE3jGNR7NgvEtZsIuV n1CvMWQ2OswWG6VbK50jd6iSZ9VG5UkRqI3du32NyIq7KcufaYW/Tzgf4n7lbteLLqfLlF8qLndq m0WqOgp6G79/Ttq4ljjnmaj1VGOVEVu3ToqKilt9SeD/AIcdW8omzXOtMqaqvtVEkNVX0VfV26ar YiIiNnWllj77ZERPsnN0RE8EQ2Gp4ftG6nSKp0HbgNvpMDq6fyaay0LpKSJ7OdHr6cLmycyvRHK5 Hcyruqqu6gVZtdTDZOOnQG4ZNKyC23nRVbVYJJ15Y3XVr+8nYxV6d4sDmJsnVUVE9aEza95NphfZ tStLcRjt9VrbLpbd5qRaW1Okr4aB8UrIY3VbY1SNq1D2K2F0iKqvRyN9JFWQtQtAtHtVsLt2n2oW CUF7sVoSJLfBUPkSWjWNiMY6GdrkljcjUROZr0cqeKqcWkHDzozoLT3CDSfBKOxPuz2yV9T301VV VSt35UkqJ3vleibrsiuVE3XZOqgRhwTZTp/DwL6f3x1wt8WP2fFVZeZHub3UEkCPSt731J6aSq5F +Pf1lL8Fstwi4K+Dqhv9HIlJX6+WqWlp6hF38ilr69WIqL+9ciucnxo5F8FL237gZ4UslyGtya76 PW91Vcqry2tggrqynoqqffdZJaOKVtPI5V6qro13Xx3JCzDRnTLPKPErdk2KQT0mCXmhv+O09PNL SxW+uo0VKaRjIHMRWsRyokbkWPborV2QCvnF3SU1XxU8JramBkiMyi9PbzJvs5tHE9q/ic1q/hRD m1VRG9o5oa5vRXYbkjXL8aI3dELC5bpTgOc5Xieb5TYfLb1g9TPWWCq8qmj8jmmjSOR3Ix7WSbtR E2kRyJ6kRRdtKsCvmo9i1bulh77LMao6m32u4eVTN8np6hNpmd016RP5vjc1VT1KgFDeBvA+Im8Y xqPZsF4lrNhFys+oV5iyGx1mCw3SrZXOkbvUSTPqo3KkiNRG7t2+xuRFXZSx/Bdphb9PKHUq5W7X iy6ny5RmlZc7tU2i1R0FPQ3fla2riWOOeZqPVUY5URW7dOioqKbbqTwf8OOreUTZrnWmVNVX2qiS Gqr6Kvq7dNVsRERGzrSyx99siIn2Tm6IieCISJgmA4Xpji9FhWn2M2+wWO3tVtNQ0MKRxM3Xdy7J 4uVVVVcu6qqqqqqgVn7QmmgrXcOdHVRNlhn12xaKRjk3RzXeUIqL8yop+cXdJTVfFTwmtqYGSIzK L09vMm+zm0cT2r+JzWr+FELF6gaU4Dqk/G353YfObsRv1Jk9mXyqaHyW503N3E/2J7efl53eg/mY u/VqjLdKcBznK8TzfKbD5besHqZ6ywVXlU0fkc00aRyO5GPayTdqIm0iORPUiKBXrVVEb2jmhrm9 FdhuSNcvxojd0QhLgbwPiJvGMaj2bBeJazYRcrPqFeYshsdZgsN0q2VzpG71Ekz6qNypIjURu7dv sbkRV2UvldtKsCvmo9i1bulh77LMao6m32u4eVTN8np6hNpmd016RP5vjc1VT1KhpOpPB/w46t5R NmudaZU1VfaqJIaqvoq+rt01WxEREbOtLLH32yIifZOboiJ4IgFe8T0M0Pt/D/rbj2svE3YcwxTU XM3zZBerXRxWiC035ZYedjUbNPGyXyhlO/Zdm7o1FRWqdvUrLeKLg4x+z5jn+qOMa0abtu9Ba6qG 62ZLfkEMc0qMifTyQudFVSN6KqvTmdsq9OrktNQaKaSWzTR+jdDp3YocJlp3U0ljSjatLIxy8zuZ i++crvS519Lm9LffqR/h/A3wrYLkduyrHtJqbzjZ5Wz25a+511fDRSNXdr4YKmaSKNzVRFarWorV RFTbZANHyrRupyfXnO9SuFfiUgw3UR0duoc7sc9thu1BVyQwbUa1ED1bJTv7rokjFXpvsiKrt44y bjR1OwzQDX2fOcCw6t1E0julvslbU2mOSWx3KSukjjhqXMkXn3jRyq+NzvfI1q8u6o2zGqPCXw9a y5M3M9QdOYKy/pA2mfc6K4VduqpYm9GsklpJYnSIiIiJzquyIieCGXxvh20QxDTa46QY9ppZaTEL w2RtxtfcrIytV6IjnzPeqvleqI303OVycrdlTZNgo9x84Vqbg/B1d6rVHixueU1V7bbaemx2lsFp o7ZcJW1MErmwJFB36RRMY6VHJJ4Rt5l9LZZWraqnpe0f0nrb7OxKS66Nz0ljklcnLJcW1T5JkjVf F/k67rt12UmLG+CnhexSy3jHrTpLQvor7bnWisbXVtXXSeROVFWCKWole+Bm7WryxOYiK1qp1aip GHEXorgGD4XpzgdBwn3HUrTHHauq8oZZbnWVGQ48r/Tjlo/syVMzHSL6aNmRWoxvRURuwYnUy7Yt Xdqbo5brZLTy3y3YVeWXVY1RXRsfDO+njeqeDkRZH8q9UbI1fBybxxwcYNxB3i663WTBeI+z4Ldr bqhepb7Zq3B4btVySyuasdYsz6mN3dytaqMTl2+xuVFXc3PQHSVMp4n8a1O0/wBAsl0r0007sFyp qb2UUL6O53y8V6oyWV0Ur3zva2JG7zSuVy8jU8NkSxWpvCTw8awZMuZ59ptTVd+fClPNcqOuq7dU VEaIiIyZ9LLGsyIiIiI/m6IieCAaFwj6dWnS2q1fzCu4ise1Elv2SvrsjqbfbIbXS2i5wRqlWkrW 1ErGOVHMc/dW7cu6779LJ0FwoLrRQXK11tPWUdVGksFRTyNkjlYqbo5rmqqORU8FQ0y16GaS2PSu u0SseDW+2YTc6CpttXaaLnp2TQVDFZMjnscknO9rlRZObn6782/U2DCsNxvTvEbPgmHW3zfY7DRx W+30vfSS9zTxtRrGc8jnPdsiIm7nKq+tQM2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACHbTrll98t8V0telPf0s/N3cn n2Ju+zlavR0aL4ovqO37bmf/AHIf5/g/UKUcoWKozjPL8tXkrRi7U64meE+SVwRR7bmf/ch/n+D9 Qe25n/3If5/g/UM9Ps9/9tXkdLtb54T5JXBFHtuZ/wDch/n+D9Qe25n/ANyH+f4P1B0+z3/21eR0 u1vnhPklcEUe25n/ANyH+f4P1B7bmf8A3If5/g/UHT7Pf/bV5HS7W+eE+SVwRR7bmf8A3If5/g/U HtuZ/wDch/n+D9QdPs9/9tXkdLtb54T5JXBFHtuZ/wDch/n+D9Qe25n/ANyH+f4P1B0+z3/21eR0 u1vnhPklcEUe25n/ANyH+f4P1B7bmf8A3If5/g/UHT7Pf/bV5HS7W+eE+SVwRR7bmf8A3If5/g/U HtuZ/wDch/n+D9QdPs9/9tXkdLtb54T5JXBFHtuZ/wDch/n+D9Qe25n/ANyH+f4P1B0+z3/21eR0 u1vnhPklcEUe25n/ANyH+f4P1B7bmf8A3If5/g/UHT7Pf/bV5HS7W+eE+SVwRR7bmf8A3If5/g/U HtuZ/wDch/n+D9QdPs9/9tXkdLtb54T5JXBFHtuZ/wDch/n+D9Qe25n/ANyH+f4P1B0+z3/21eR0 u1vnhPklcEUe25n/ANyH+f4P1B7bmf8A3If5/g/UHT7Pf/bV5HS7W+eE+SVwRR7bmf8A3If5/g/U HtuZ/wDch/n+D9QdPs9/9tXkdLtb54T5JXBFHtuZ/wDch/n+D9Qe25n/ANyH+f4P1B0+z3/21eR0 u1vnhPklcGvYBlvs6xGgynzf5F5b3v2Dve95OSV7PfbN335N/BPE2Es0V03KYrp2TrhPTVFcRVGy QAG7YAAAAAAAAAAAAAADB3bOcKsHN59y+yW5W+KVVwiiVP8AGchiZiNraiiq5OVEZz3M4CMLpxM6 FWhysqdRbfK5PVSxy1O/4FiY5DEycV2mMn+5Fvym7/F5FZJnb/g5+UinEWY21RxXqOScfXGcWasv yzHzTKCEn8T0c3+52jOocqL4LPbY4UX+ORThdxF5nL/tDQW/vT/9IuMEP+fc16XZ3/CU0ch4+fuZ eNVMfOU5ggleIDVF37lw91a/3eSUzf8A9g/Pb81cTq7h3eifNldKq/xd2Y6Xa3zwnyZ9BY7s0/30 fqTuCCk4gtTG/uvD7XJ/cZDTO/8A2T7bxH5NF/uhoTlEfx+T1EM/+ZUHS7W/4T5E8h47sx/dRP8A 7JyBCbOKK1w/7p6S6jUiet6WdsjE/CrZP/sdmPix0dZsl3rrzaF9fltnqG7fh5GuNoxVmfvQjnkb lCNlqZ8Iz+WaYwR5aeITRO9cqUWpdkYrvBKqfyZf/wCajTc7XkNgvbeey3y317dt96WpZKm3/VVS Sm5RX6sxKndwt+x7WiafGJj5sgADdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAr/AKUf 1gWv/t/9e8201LSj+sC1/wDb/wCvebacXCfy9HhHyca16keAACdIAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAADI6Af2I7D/AN6/pMpIRHugH9iOw/8Aev6TKSEWcD/K2/yx8oX8P7Gjwj5AALSYAAAA AAaznGpOEacUCXDMsipbc16fYonKrppl+Jkbd3u/Em3xkTXHXLUzNt4NL8GSyUD12S85Iisc5v8A Cipm+kvxorlVF3TdEIbl+i3qmde50MLyXicZGnRTlT2p1Rxnb4RnKfJZYoI3TTSNjjYiuc9y7I1E 8VVV8EI3ybiN0fxiZaJ+XQXSu35W0doY6tlc7+D9j3ai/MrkIqqtMa/LJEqdVM7veVu5kf5G6XyW ha7x6QRKifj39RtdlxrHscg8nsFkorfHtsqU8DWK78Kom6/jK1WKuVerGXj+/q7FrkXC2td6ua53 U6o4znP+MPiq4gdRb5umDaMVkMDveVmQ1rKTZPUqwN3ev4nGJqa3iGyRVW76k2jHIndVp7Fa0lXb 4u9nVXJ+FDawQzVXV61U/L5L9u1hrPsrVMeMaU/5ZxwiGg1GkcN53XMc9zHIub30Vbd3pD+BGM22 T5tzuW7RvS617eTYRbH8vh5RGs/+sVxuQNObp25LHSr2WjFUxG6NUcIdKgstmtactstNFSInqggZ H/ooh3QDbYhmZq1yAAywAAAAAA8QAMVcMTxa7b+dcatdZzeKz0cci/5UNartD9La1/epikFLKi7t ko5ZKdzF+NORyJ/kN6BrNFNW2E1GIu2/UqmPfLRqfTrJLJ1xDV/NLWjfewT13llO38Ecibf5TJ0u V8SGN7I29Ytl8DfHy2kdQ1Lk+ZYl7tF/CbMBETT6szHvaV1U3vbUU1eNMZ8dU/F0KTiXuFoVGaj6 S5FZWJ0dV29zLlTN/tnOZsrU/Eqm/YhrNpdnasixfNrZVVEmyNpXy9zUKvxJFJyvX8SGoGuZJp1h GWtf5/xmhqZX+M6R8k3/AIjdnf5Sam/dp68/H/XkpXOTMDe2UzRPdOccKtf+SwwKy0ONanYQiO02 1Qrlpme9tV/Ty2l2/gtev2SNv9z1NntXErPYJI6DWPCa3HHKqN87USLWW167+Kubu+PffwVHL47q T04uidVer5cfNzL3IV+nXh5i5G6NVX9s7fdmnMHQsl9suSW2G8Y/daW40U6bx1FNK2Rjvxp6/m8U O+WonPXDi1UzTOjVGUgADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAr/pR/WBa/+3/17zbTUtKP6wLX /wBv/r3m2nFwn8vR4R8nGtepHgAAnSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyOgH9iOw/8A ev6TKSER7oB/YjsP/ev6TKSEWcD/ACtv8sfKF/D+xo8I+QAC0mADHZDkFnxWy1mRZBXxUVvoIlmn nkXZGtT/ADqq7IiJ1VVRE6qYmYiM5ZppmuYppjOZc9zulustvqLtd66CjoqSNZZ6id6MjjYnirlX oiEDZBrdmWpE0tn0XpfNlna9Y58quEG6PT1+SQu6vX+2cm3zJ0UwNbJkWvdYzIczSot2GRTJNaMf 94tW1Pe1FWqe+38Ws8ERfi6u3yKKKCJkEEbI442oxjGIiNa1E2RERPBEOfcxFV3VRqj4z5fN6vCc l2sFEVX4iq5u+7T49qfhHe1PG9MrBY7g7ILhLVX6/wAq80t2ukiz1Cu/td+jET1cqb7dN1NuAIoi Kdi/XcquTnXOYADLQAAAAAAAAAAAAAAAAAAAAAAAAAAA+ZI45Y3RSsa9j0VrmuTdHIviip60PoAa LNprUY9cZMj0nyGoxG6vXnlhgTnoKpfHaWnX0fm3anTx23N3wXiCY+50+Gat2pmL5DLtHT1PNvbr i5V2TuZV945enoOX1om+67H2YzI8bsuWWiex3+gjq6OdPSY7xavqc1fFrk9Sp1FFVVqc7fDqL9uz jY0cVGe6qPWj39cd0+6YTsCu2C6h3/SG9UWEahXiS54lXuSms99qf3Whl/e01U71tVOjXr4bfFvy WJOhauxdjONryuOwNzA1xTVrpnZMbJjz3x1AAJVEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADo3292rGbJcMkvtY2kttqpJq6sqHNVUigiYr5HqiIqqiNaq9EVegHeBgMCzvFdTsNtOf4Rc3XG w32mbV2+rdTSwLNCu+zu7la17UXb981PjM+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAABX/Sj+sC1/wDb/wCvebaalpR/WBa/+3/17zbTi4T+Xo8I+TjWvUjwAATp GAzDUDA9PKKC5Z/m1gxmkqZe4hqLxcoaKOWTZXcjXSuajnbIq7J12RTB2LXrQzKLlDZcZ1owS73C ocjIaSgyOjqJpHL4I1jJFcq/gQgvjvt9Bdr7w+Wq60NPW0VZqxZ4KmmqImyRTRPVWuY9jkVHNVFV FRU2VFMlxbaMcMtj4fs2vF/0+wnHqmjs1XNaq+ltlNRVcdwbE5aZIZI2ter1lRiciLs7fZU2JIpj KM+tvFMZRn1rEXvLMWxqottHkeS2q1T3mqbQ22KtrI4H1tS73sMKPVFkkX1Nbuq/EZUoXnVwy266 fcFdyzp9Q++1OX2GSsfU799Iqxt5Xyb9edzeVXb9d1XfqX0NaqdFiqnRazDqdprU4fJqHT6hYzLi sW/eXxl2p3W9mz+7XeoR/dps/wBH33vuniYKh4jOHu6VUdDbNdtPKuplcjY4YMooZHvVfBEa2VVV Si2Hf+58vv4an9NNNtv2tXZxVuiyWCss+FXa+zWGOkZSW/Fljrpa5YEaiRzpA3u5O8/3xXtRF68x JzfzSc3HxXuv+SY7illqMjyi/wBus9ppGtfUV9wqo6emha5yNRXyPVGtRVciJuviqJ6zu01TT1lP FWUdRHPBOxskUsb0cyRjk3RzVToqKioqKhRvUHFcwwnspajGc8rm1V6pMfpFlc2obOjIX3OOSCJJ GqrXd3C+KP0VVPQ6KqbKXG04/seYv/zLRf6hhpNOUZo6qcozd2tyvFrbf7bilxyW1Ut7vDZX262z 1kbKqsbE3mlWGJV55EY1FVytRdk6rsc96vlkxu2zXjIrxQ2ugp03mqq2oZBDGnxue9Uan41Kza1f D14cv+bcp/R7zX7fiFq4ruLrUSn1ShW8YRo35Ba7Ljs7lWinuFRG581VPGi8sjmqx7UR26K1Wbp0 VFzo9bOhG2VnsT1V0vz2pkosG1IxbIqiFFdJFabxT1b2Iniqtie5UT8JtJAupXBho1mMVuueC2Gh 01yqy1kNZbMixSghoqmnVjk5mubGjWStczmbs9F23+LdFniJr2RMZJIsj2tRHPVETmXbquydENZy 6ms5dTF45l2KZjTVNZiOT2m+U9FVSUNTLba2OpZBUs254XujcqNkbzN3avVN03TqMny3FMJtL79m eTWmw2xj2ROrbnWx0sDXuXZrVkkcjUVV6Im/VStWncftGcbOZacOTucc1lt/swsrfBjLvBu2uib/ AGz280zvmRiH7xBR+3bxQ6W8PUP2eyYortQ8rYnVitgcsdDC/wBS80qu5mr4tkRfUZ0dfc20Iz7l j8tznCsBtkd6zrMLJjlvmmbTR1d2uENHC+VyK5saPlc1quVGuVG777NX4jNIqORHNVFReqKhTfX3 DKbi44k5NBqidUxbTbFKy43eVqqrG3y5QOhomuRP30Ubknb86PRSVOC3Ua6Z/oTa7dlPMzKsIqJs QyGF67vjraFUj3cvrc6PunKv8JzviE05RmTRlTmmDHMsxbMKOa44lktqvdJT1ElJNPbqyOpjjnZt zxOdGqoj27pu1eqb9UGS5Zi2F2t18zHJbVYra2RkTqy51kdLAj3rs1qySKjd1Xoib7qpW3s6v7D+ X/8ASFff9OMdpV8F6t/5/tH9JaNH7eiaH29FacwNPn+B1lDfLpSZtYJ6PGJp6e+VEdyhdFa5YEVZ mVLkdtA6NEVXo9UVqJ12M8UL07/sG8cP99ud/wBFkFNOkxTTpLU+6b4bfvhNNPzsoP2ptWHaiaf6 iU1RW6f51j2TU9JIkVRLZ7nBWsheqbo17onORqqnXZSjug2t/Z32TRXB7RqDHp6uTUdhooLt5Zh7 qifytsTUl7yTyV3O7m33dzLuvrUtxoJkWgmX4nVZJw90ePR2GWtdTVMtmtHm+OSpjY1VRzO7jVyo 17eqp4L4maqdHqltXRo9UpLABGjAABkdAP7Edh/71/SZSQiPdAP7Edh/71/SZSQizgf5W3+WPlC/ h/Y0eEfIABaTBXPVK5yarap+1+uy4vhLoay6NRy7V1we3mihd6lYxvVU+NVRfVtYwq1ojJ5zxavy uXd9RkV5r7jLI5d3PVZnNTdfmRngU8XVso3/AEeg5BtRE3MTO2nKI7pqz1+6InLv19SQkRERERNk QAFZ2AAADFSZbisOSxYXNk1qZkNRSrXRWl1bGlZJTI5WrM2DfnWPmRU5kTbdFTcypV7jToanT+v0 74p7NBI6o00vbIL2kTd3TWOtVIalF298rVc3lTwTvHL6jNMaU5I7tc26NPd8utaE1Wj1X0tuNHbL hb9ScVqaW9Vy2y2zw3mnfHW1iLstPC5H7SS79ORu7vmI54utVptP+Hq83jE5/Kb3lTIcfxtKd27q isrvscbolTxcjFfI34+RCEtWtL6DRix8JOmVvSNUsWf2uGokYmyTVTvTnl/68rpHfjNqaM41ort+ aJmKY2ZfGco+q7prDdUdM34e/UNmomMOxWN3K++Jd6dbe13eJFstRz92i94qM9975UTx6GznmTbf /c+XX/lzf/1giFFOlxhm/fmzsjqmeGXm9NI5I5Y2yxPa9j0RzXNXdHIvgqL60MPXZvhdsyahwu5Z fZKTIbpGs1DaZ7hFHW1Uac274oFcj3tTkf1aip6LviU7dg/3Ct3/ACSH/QQpXxV6W3nVfi7s9qxG 6yWzLLJppJf8arWP5UhulLdOeHm9XK5FdGu+6Ij99l22MUUxVOUtr12q3RFVMZzqXWvN6s2OWqqv uQ3aitdtoo1mqqytnZBBBGni58j1RrWp8aqiGJyPUrTnD7PRZDluf43ZLVclalFXXG6wU1PUq5vO 3u5JHI1+7fSTlVd06+BXPUTWSj1x4Dc/zDyRbfeaew1lsv8Aa3orZLddIdm1EDmr1TZ3pN368rm7 9d0NF4rrji1o0g4XrrnCUq47R5RjlRd/KoO/h8jZSI6bvI9nc7eRHbt2XdN02U2i3nOUormJ0Ymq nZlE8ZyWg90vw4/fAabfnXQftTYLxqtpdj2PW/Lb/qTi1ssd35fN9zrLxTw0lZzNVze6me9GSbtR VTlVd0TcrP7oDsyP+C00/Mh3/wC6HxxpMwJtr4dUZS2Wnwx2o1lf3UsEcNvZbnMVVR0bkRjIe7Xq jkRqN33TYaGuIylicRMUTVE0zlulYOg4h9ALrVx0Fs1z0+rKmZyNjhgyaikke5fBEa2RVVfwEgoq Km6LuilZNTP/AGfjcGvLsoZo4tAlJLzpbEt3lq+iv+1+4+y97/B5PS3MvwP1GWWPhIw6t1QnqKWa joaqdJLgqtkhtrZpHU6vV3VGpAjFbv4M5TE0xlnCSi9M16FWU6s9SaVzjC25WmCLl9kTJXQeVJZl uEXlyw+Pedxzd5ydPfcux2cjybG8Os1RkeXZDbbHaaTk8or7lVx01PDzuRjeeSRUa3dzmtTdequR PFTzrko8kmxmTtH2UlUt1Zn6XWOm2XvFw5v+x6wcvqcrN1VfDl9IsV2hNworvwT5rdbZUx1NHWxW aop5o13bJG+5UjmuRfiVFRfxmeb1xCOMVM2668tkZx3x1Jct3EJoFeKyO32nXDT+tqpnI2OCmyWi kke5fBEa2RVVfwG25Hk+N4dZqjI8uyG2WS00nJ5RX3GrjpqeLncjG88kio1u7nNam69VcieKlHNS 9ZOzsvmklzx62WbC7tkFbaH0lvprZjCwVjq50XLHyVHcMSJySKi86vaibLuq+C5PXzGstw/stn41 nNclXe6Gz2NlS9J0nRqLdKV0cfeNVUfyRqxm6KqLy9FVNlM83sY6VOVUxlOUZ6p+ErwxyRyxtlie 17Hojmuau6ORfBUX1oatl2rWlWn9dDbM91NxTG6yoi7+Gnu96pqOWSLdW87Wyvaqt3aqbom26Knq M5YP9wrd/wAkh/0EKXcTWU6OYfxw4ReddG2dcXbgFRG/zrbVroO/dVzd39iRj+vjsvL0NKKdKck1 +7NqiKu+NqzUXEnw6zyMhh1805kkkcjWMblVCquVeiIiJL1UkYqfjWs3Zx5LkdqxzGqHTiou91rY KK3wx4WrHSVMsiMiajnUqI1Ve5qbqqIm/ihbAVRl1M2bnOZznE+AADVMAADH3+xWzJrPV2G8U6T0 dbEsUrV8dl8FRfUqLsqL6lRDv8OmX3aahu2luU1Hf3fC3xQRVLlXmrKCRFWCRd/FUanKu3xN36qf pq1nk8zcSGJ1MG7PZDZrhbp+Vdu8SBEnbzJ69vjM0VaFymqPDj/tpibUYnC3LVXVE1R3TTGc8Yzj huWMAB1HigAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK8doPmq4Hwbao3aOXkmrrN5liRF9J y10rKVUT/qzOX8CKWHKX9prkFeuK6UaeWawVt/rL/nlLdai0UUfeVFfbrZFJU1MUbP37tu7VG+tU 2TqqAYK46scWHCfw4YlqFc9MNPotNcKtNlttwx6SrrFyWKh2hpUmfKm1MydXOa50SNejOZUV7tlU mbUziMze46l2nQnhwxmyX3M62ysyS6XLIJpYrTYbZIqJE+dIfsss0iqnLC1WrsqOVduqQxxP63YT xoYba+Fzh2udwyavzS9W/wBlFZDbKmCDH7RTzsnmmqnzRtSOTmiYiRr6SrunirUdpWpmBcPGC8ZO qd84wbTerbjOX0FhnwW/QV12pKDu6ajSnqqR0tvkaiSo5kao2TfozdOXnTmCymmnEBqvZ9dKrh34 jrHiFJep8cflVlv+MS1DLdWUccvdzRSRVKukhlYqK7fnc1Wovh031PGuIbiz16x666r8OOnmndNp /TVFVDYvZbUVy3TJY6d7mOmgbT8sdMx72OYxJOZd067J1TWNLtEtA9QcJ1Vzbht0cy6yXWfGLriu K5XkF2ubo7ylVRuRX0kVfUOeyJJuRveOjZv+9X36JiNAuM3T/Snhlw7R6wYhkl51kxu1Q2H2vI7N VwV0l0Yqsd3r1i7uKFXbyulVejVXpzIrQLDV+tOtl40DxjUHA+Hy5rneTS09JNjN9qPIWWOR73Ml qKxz0bIsEas5vRZzua9i8rd1VNJs/EHxAaea6afaRa+WvTS7Uepq3CntVxwmasZJb6qkhSV7aiKq c5ZGORzUR7Vbsqqqom2yxhxS3Wy3Hil08tXF26ssmi0+EurGUDaqpfZKjKlmXvKermha3ve7i25O dEauzdkTne1dNw226BWDtENLbngOmFNp9iD8UuEuM1y2aWhTJLnO99LzMY5iPREje/kWRGqqJzp6 EkbnBbnS3XLLNReJfWHSplvtDcS0zhs1NBWxRSpV1FfWQOmla96yKxWM5VbsjEVF23VTU6zi0yC0 akcRcFdjtBXYToTYKCua6jikbX19dNRvqZYVlV6xoxqRqzpGitVd1VUIr4YtasD0Y1G4g8f1bqLn b9Rcg1QulxobFFa6morbrbFaxKDyNjGL36O+yI3ZeiK1V2RdzqcJuqD8T0J1a4ns703vt+i1D1Ou M90t9npWV8tDaudlOrpI0d9mhg2nR3Ij1Vvq25nIEjYxq5xz5TpzYtbMZwbRzKbFfKalukOK2i4V rLq6km5V7tldK9KVZ2Nd6SOY1qK1yIqqiIu56qcQWob9U7dw+aAYfZ7pn01obf73V5HUPZa8doHO 5WeUeTqr5pnu6NijcnTZ3NyruVTvdz0At+oGH3Xs5Mov8WdXbKKLzxjeNsr/AGPzWxz/AOq5LhSz MSCmY1m3VORW+KNRU5m5DVXC+H7EeNHVjJ+Mq23ugx/NqOxVeE5DFXXakoHNp6NIKulfLb5GokvO yNUbJv0bunLzpzBZPSzXjV6h17m4beIXHcTiyCtx5cnsN8xR9QlBX0rJe6lhfDUK6SKZq7u9+5qo i+HTexhU/hF0z4Zrplt61h0V0by6yx2xq2WzZVkFzuksd6pJWtfM+kgrqh8jYke1G87o27/vVX00 S2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV/0o/rAtf/AG/+vebaalpR/WBa /wDt/wDXvNtOLhP5ejwj5ONa9SPAABOkVH7QPHbNl9XoPimR0La203nVK1UFdTOc5qTU8vMyRiq1 UciK1ypuiovXopImPcDnCfi92p73aNE7H5XSvSSJaqSerY1yLui93NI9iqi/GhOgN9Ocsobac5ZQ rlxq4NmV6xrBNScCx2oyC56X5hQZTLZ6VN566jhVe+jhb++k25VRE6qiO23XZFx187QHRSqx6ppt OUyXJs5mgdHQYpT47XNr1rFRUZHKjokYxGv25l5l6IvLzeC2eAiqMspgiqMsphRHPNJL5oh2WF50 9yhrGXqltsVXcI2ORyQzVF0jmWLdOiqxJEYqoqoqtVU6Eg2Djl4P104tON3nUOlvEsdnpqSotLLH WVT6iRsLWuhSPuFa9VVFb16fGu3UtaDOnnGtnTifWedNTiuaYp2ZWqLMtsNfYKO63ia649Za5FbN bLRNcKVYIHMXrH6SSvRq+p6L6ycsJ4/OES1YZYLXcNZKSGqo7XS088a2qvXkkZE1rm7pBsuyoqdC 0gE1xO2GZrirbCpWp17teS8bXDFkdkq0qrddbFklbRzo1zUlgltrnsfs5EVN2uRdlRF69TqZRX37 hI4l8x1duuLXi76VaqU9FLd7haaR9VJYbnTMWNJJombu7l6Oe5XIni9ETdWo11wAY02NPqyVayXj ds+fQQYnwjWar1GzK4TxRMlmtFZT2i1xq5OeatmlZErWo3fZGrvuqdd9kW0FL5SlNClasS1Hdt75 YkVGK/b0uVF67b77bnKDEzHVDWZidkK4ccONXSm0/sWumLUzpch0fvUGTwtj9/Pb0cja6Df1MdD6 TvmiNb4Yb7bmYpq1xr5x3lPTZrXVdyonzN2kgx22tfFSsRq+DnJG9VRPfbMX4i2YM6X2cmdP7Oio /wAM/DLkep2D1Gv+Va0aoYXkmqldPkdbQ4veYaOn8nkletIio+ne520TkVvpbI16IiJsu+Z0oxWX hV4vJ9NarLsgv+O60Wd91ornf6mOerkvtE5yzsfIxjGqroX8yryoqqsaLuqblxwZmuZzzZm5M55v Pzg74seHzRfBctw7U3Uansl4dnF5rEpX0NXMvcvkYjXc0UTm9Va7pvv0Jd19r8Z41eFXLYuHjIoc lqrdXwPpeWCWBJa2kfDUOp0SZrF5nRPTlX3vM5qb+O1pgJrjPSiNZNcZ6URrVkoO0F0JjsUTMmZl FpzRsKNqcOfjlc65tq9vSgYndd25ebojleieG/KvQ0fCdPc0xLgw4g811Dsclkv2pcOXZjNaZf3W 3xVVHJ3cMiep+zVcqeKc6IqIqKiXTBjSiNkGlEbIUw4c+OPhXwnQXT/EMo1apaG72bHaCirqZ1sr nrDPHC1r2K5kKtXZUVN0VULFaQ8QujmvKXZdJc1hyDzH3HnDu6Sog7jvu87rfvo2b83dSeG+3L12 6EigxMxOyGKppnXEAANWoAAMjoB/YjsP/ev6TKSER7oB/YjsP/ev6TKSEWcD/K2/yx8oX8P7Gjwj 5AALSYKvaVwOxyqyrTqrb3dXjd7qEaz46adyywvT5nIqqWhIK14xK54zfqXW7FKGaqdRxJR5JRQ7 qtTQJ4Ttb63xeP8Ac7eCNUqYuiZiK46vk7vId+mm5Vhq5y08svzRs45zHjMMkDp2i726/WymvFoq 46mjq40khlYu6Oav+ZfUqeKKiop3CptdyYmmcpAAZYDB51h1n1Cwy+YLkEXeW6/2+e3VKbdUZKxW q5Picm+6L6lRFM4BsYmImMpeffDk3MtYNVdPdHc9pZnQcNEFct7e9q9zV3WOofS2zbfx5II2ysd6 +V3xk98Z+EZlesbwbUjBMfqL/c9MsvoMoltFMm89dSRKvfRwp++k25VRE6qiO2RV2RbEg3mvOrNW pw0U25tzOefX4bOGSst74+tF6rH6mm07TJMlzeaB0dBitPjta2uWrVNmxyo6JGMRHbcy8y9EXl5v BYg1Y0mvmifZXXHT/J2sZeaaKgq7hG1yOSGaovcEyxbp0VWJIjFVFVFVqqnQvyBFcU5ZQV4eq5E6 dWuYmNm/3q3Wfj94RKa00VPPrJSNkipo2Pb5qr+jkaiKn7gdaa5UV54+cSu9tnSekrtI6ipp5URU 5433Frmu2XZU3RUXqm5ZoGM4jZDfm66sormNUxOqN3vlQnjoxm86GQZzqPidBLNhertmlseV0UKe jRXlGL5HcEb4IkmyxyL0TdVVeZzmoZTieyKzYhpfwq5XkdalHarNluM19dUuY56Q08VK18j1a1Fc uzWquyIq9OiF4gbRc2ZxsR1YXOatGcs/hrzV5/8AaB8H/wB2ek/kqv8A2BHnFnkuB6yW3hxv1imo 8jxTJNUbVEnf0qrBWU6yPikY+KZqKrV2e1Wubsqb9NlLkgxFUUznEN67Vy5TNNdUZeH+5Vf4j+E7 DpcJgzfQXTPFMfz3B6yO/wBoZbLJT07Lk6H0n0czI2NSVsjUVGo798jU3RHONW1y4jqPW3hfxa0a V1HcZHrXcYMQjo1dvLbnvciXBsqdF5Y2bscvT0Zmv8FLkgRXsz6mKsPnnoTlExlP78P3qVkbwJ2J uG+1+nEXramOeQebPNSZBSeSeS8nJ3PdeSbcnL05fiK9ZtlV2k7OfVHRzLajnybSS80OKVvN4y00 V2plpJkT+A6L0Gr60i3PSAGYuT1ta8JTMTFGrOJjj5Kw1HHHwfXHEG2O45zTZJ3lC2CSzRWKrq31 juREWFI3Q8rlcvT0lRvXqqJ1IFyzE85w7sssttuc2qttD6i509ba7TWq7v7dbpbzSuhgejurVT0n cq9UR6IqIu6J6MAxFcU7IK8PVdidOrqmNUb/AHyrdZ+P3hEprTRU8+slI2SKmjY9vmqv6ORqIqfu BHWs2smmum/HBp5qVm2UR2zG6vTabua91PNI1/fVMrovQYxz05k+NvT17F1gIqpjZDaq1crjKao1 TE7N3vV5/wDaB8H/AN2ek/kqv/YFgqeohqqeKqp388UzGyMdttu1U3Rf4jkBrOXUmoiuPXmJ8Iy+ sgAMNwAADWsJgdlHEZFPSt56bCrJItTJ6mVNWuzGfhWNFX8Sn7neZwYdamyxUzq661z/ACa12+JF dJV1LujWI1Ou26puvqT51RFkPRHTao07xR7r5L5Tkl8mW43uo5ubmqHeEbV/gMT0U26eKp4m1qib lyIjZGufoixt6MJhK6521xNNPv8AWnwiNXjPikQAHTeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAHxNNDTwvqKiVkUUTVe973I1rWom6qqr0RET1kF6ScYukOsOqGc6dYxlmMSxYnJTx22uhyG nmffUWnWaqlpoG+ksMHRiytc9rl5l9FG9QncFUuEHikpMt0StuonEBrDjNsuWbX27VOO014raG1y pbGVb4IIY4/sayo1YX+kqOcu/Vy9CaNc664+weG0Y3rjZtK75kFzorbZ7/cKWkq+8qXyI5KWngqn tjmmmYx7Gt9J3VVa1VToEig1PMtWtKtN5qel1D1OxTGJqpvNAy9XqmonTJvtu1JXt5uvxGwWe82f IbZT3uwXWjudurGd5T1dHO2aGZn8Jj2KrXJ86KB3AR3rrWXNmExWXHtb7RpVfb9c6O2Wm/XGkpKt X1L5Ud5JBBVPbHNNMxkjGt9J3VVa1VTpmMy1a0q03mp6XUPU7FMYmqm80DL1eqaidMm+27Ule3m6 /EBtgOnZ7zZ8htlPe7BdaO526sZ3lPV0c7ZoZmfwmPYqtcnzopE3E9xQYJwx4Q3IchrrTV3yungp 7RYam7xUM1er544nyI5yOVsUTZOeSTkVrUb16qgEygrDrZxDXL23uHvENH9RrS7H8/ul1ut6udC+ kraSqsttpu9mb37kexjHLzIsjHNcisVEcmyk84bqZpxqKyqk0+1AxvJ20LkZVOs12grUgcu+yP7p 7uVV2Xou3goGyg1HLtX9JdP7jT2jPNUcRxuvq0R1PS3e901HNMirsisZK9rnJv8AEhtVPUQVcEdV SzxzQzMSSOSNyOa9qpujkVOioqdUVAOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAV/0o/rAtf/AG/+vebaalpR/WBa/wDt/wDXvNtOLhP5ejwj5ONa9SPAABOkAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAABkdAP7Edh/71/SZSQiPdAP7Edh/wC9f0mUkIs4H+Vt/lj5Qv4f2NHhHyAA WkwfjmtcitciKipsqL60P0AV4zbS7JtJ66tzLSuifdMcqZlqrpjDE9OnVffzUf8AnWP+Lfpy9rFM yx3NLf5xx64sqGNVGzRr6MsD/wCBIxerV/D8XTcn0i3UXQOwZdcnZbi1wlxTLG7uS6ULE5ahfiqI veyovxrsvhuqomxRu4aaZ0rXDy8npcHyxRdiLeN29Vf6o6/GNe+JY4Gi3HJ880yk8l1exdyUCLys yOzsdPROTfosrETnhX8KdV8E2NqsuQWTI6NtwsN1pa+nd/vlPKj0RfiXbwX5l6lbPXlO115tzFPO U66Z641xx+m1kAAbIwAAAAAAAAAAAAAAAAAAAAAAAAAAADXsp1AxDDGIuQXuCCZyfY6Zq95PIvqR sbd3Lv4b7bdfExMxEZy2ooquTo0RnLYTUcv1Eosfqo8dstHLfcnrNmUdoo05pXOXwdIqdI2J4qq+ rr4bqnza7HrJqsiOtNC7Accl/wDz9wj57nUMX1xQeEW6L4uXf1opMOnOk2GaX0L4Mbt7nVlSn9WX Kqd3tXVu33VZJF6r168qbN+Y3otV3dmqN/lCDE43DYH1506+zE6v+U/SM58Gq6U6NXCy3f2xdSa+ G65dPD3cMcTf6ltMS77xQJ63ddnP8V6oniqulwA6Fu3Tap0aXlcVi7uMuc7dnX8IjdEdUAAN1YAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAde4S0UFBUz3J0aUkcL31CypuxI0aqu5kX1bb7nnRo RJYsA7OXVbiSXHbdQXzN3ZZfKGqSkjZPTLVzPo6eJjkTdkfOxioxFROvTxPQzJ7DTZTjd2xitmmh p7vQz0E0kLuWRjJY3Mc5q+pyI5VRfjKrQ8CeY1HCxVcKeQ8Qj7njzqyg8iqPYrFA+lt1PVJUupFb HOiyue9rd5XP6cqeivUCOrvw26N6KdmpfbnmGB2a65PJp4tVV3a5Ucc9bFc6imTydkcz0V8TIJ5o 2xtYrUTk325nOVeSsst2uuWcCehl7nlqqqy2luYXrvVVVilttqiWnV3rX7MsjEVeu6IWj4ndBV4j dG67RtmWexqgulXQyVk8dD5T3lNT1DJlgaxJI+XmWJic267beCnyugMc3E9T8RlVk6SQ27Clw+3W FtByNpVdVd++qSfvOrlbvHyJGmyfvl22Ar1mWlWoOiuvepOs174brZrxiWdz01YlXTeTT3+wQww9 26ljpKpqpPF0TlZC5FVEbzeGyTzwkwaB1OkUWW8N9ukt2IZXcqu8rROdK1KSse/kqIWwSOVtMjHx q3uo9o023aio7mXUaPhn4hsUp63G9OuMu+27F6mpnnpqe94xTXu6UTJnue6OO4TSo96Irncqyser enVdiWNDNGMT4f8ATG0aWYZLWz2+1JLI+qrpUkqauolkdJNNK5ERFc573L0RERNkRNkQCCuKT/8A G/FtwxaUM+yQUd6uub17fVF5vpkWleqfPKr2ovxmo5lpVqDorr3qTrNe+G62a8Ylnc9NWJV03k09 /sEMMPdupY6SqaqTxdE5WQuRVRG83hslh5tBfLOKKHiSuGV9+2hwt2I0FjSh5Up3Pq+/kq+/7zq5 yKsfL3adOvMvgaHR8M/ENilPW43p1xl323YvU1M89NT3vGKa93SiZM9z3Rx3CaVHvRFc7lWVj1b0 6rsBt3CTBoHU6RRZbw326S3Yhldyq7ytE50rUpKx7+SohbBI5W0yMfGre6j2jTbdqKjuZYn4x7JZ dRuJbhi0mrbRRVy1WTXDKK7vqdkipS2ymSVsb1VOsb3PcnKvouVvVCwWhmjGJ8P+mNo0swyWtnt9 qSWR9VXSpJU1dRLI6SaaVyIiK5z3uXoiIibIibIho2sfDXkmoWteEa6YLq7Phd9xChqbVLGtkhuU VbRTuRZGNbK9qQvX0k59neLenTqEJZVpXhmuXaJ0+GXmyUsuFaR6dQSVFljiRtFPXVlU58cEsTUR roljcyRY1TlcsLUcitVUOhVsxLSPjr1XzvTbFLXZLTp3oZJX32gtdKymp6y49+tVF3jI0RvMsETE 5tt9mIWZ0u0F9rvWPVfWSuyvzzcNT6u2SdwtD3Hm2moad0MUCP7x/e9Hbq7ZngnQ6OE8Ndrx/UrW fUPKr+zJE1j8ipqugkoVgZR2+mpX0zaXn7xyyo5j13ciM9XT1gU+4ZbFqXctJ4s9zXgH9tvINSWP v13y+8ZNYHSXWKpVXQtjjqpFkp4WwrGxsWzUTl35U8Es9wGacapaT6CMwbVXHqiwVNDfbk+z2me5 Q176C1SS89PCs0L3sdy8z9vS6Jt0TwNcsXBtrFieIe1BifGFktr0ziY+kpbXHjlG68UlA5V3poro ruZqIjla1/dczU2RuyIiFnMasFFiuO2zGbbNVy0lppIaKCSsqX1E7o42I1qySyKr5HbIm7nKqqvV QMkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/6Uf1gWv8A7f8A17zbTUtKP6wL X/2/+vebacXCfy9HhHyca16keAACdIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADI6Af2I7D/3r +kykhEe6Af2I7D/3r+kykhFnA/ytv8sfKF/D+xo8I+QAC0mAAAAAHy9jJGOjkY1zHIrXNcm6Ki+K KhFWV8N2n18rX3zGm1eH3pVV3l1jk7hHr4+nEn2NyL136Iq79VJXBpXbouRlXGaxh8XfwlWlYqmm e7r8Y2T71dq/CuILCN3U7bNqBb4/XGqW+4cqetWrvEvT1Iqqph01lxy3VLbfmtqveI1rl5UivNvk ia5f7V6IrVT512QtCcFbQUNypn0Vxo4KqnkTZ8U8aPY5PnavRStVhOxVl46/9uza5ez1Ym3E99P2 Z4a6fhCF7XerPe6dKqzXWkroV/3ymmbI3+NqqdwyF+4ZdGr3UOroMUSzVqqqtqbPUSUbmfgaxUZ/ 9JrtTw8ZxZ13wjW27tjb4U19pI69FT4u89FyfiQhmzep6s/CfPJft8oYC7suTT+aPrTpfKGSBrVR ifEpY9+ey4dk0TfDyKslo5nJ8/epyIv4Ohj5sw1GtP8AXFoTl0PL75bakdwRPwLGqbkczNPrRMe5 boii57O5TV4VRnwmYn4N1BHsmuWE0C8uQ099sTvBW3G0Txqn+K1x3aTWjSyt27nNrc3f/hnOi/00 Q15yjelnCX4jPQnLwbqDBQZ5g9UiLTZlY5d/4FxhX/M4yEF7stT/ALWu9FL/AHFQx3+ZTaKonZKK bddO2Jd0HG2ppn+8qI3fgein2r2om6uRE+Pcy0yfoOF1ZSM9/VQt/C9EOpPkePUu/lN+t0W38OqY 3/OpjOG0U1TshkQa7U6jaf0iKtRm9hZt6vOESr/EjtzDVeuek9FukuZ0r1T/AIGKWX/QaprNdMbZ S04a9X6tEz7pb2DQIdZbPcumNYjmF/396tuskr0X8buU70N81jvHo4/oVdmI7wku1fBRI1PjVrlV V/AhmKonZr8IzYqsVW/aTFPjMR85huINep9O+I+97LWXjC8ahd6oI5qyob+Hm2jX8SmUpeGae57P z7VvKb0q+/gonst1M/5ljjRVVPxobxbu1bKeOpVrxODtevejwjOZ+WXxdK/ZpiWLsV+QZFQUKom/ JLO1JF/Az3y/iQ1yl1QuGUr3OmWnuRZQ5y7Mqm0y0lDv6t55dkT8aEw4toJpBh0jaiy4HbfKG9Uq Kti1UqO/hI+ZXK1fwbG/I1GojWoiIibIieolpwtc+tOXh/vyUrnLWGt+xtzVO+qco4RnP+Sv9Do9 rTmCJJmmc0OJ0L/GhsEay1St+J1Q/wB4752boSNguiWm2nkiVthx6OW5r1kudc5amse71r3j91bv 8TeVPmN7BYow9u3OeWc97lYnlbFYmmaJq0ad1OqPflrn3zIACdzQAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA/HOa1Fc5URETdVX1IfpX/jwzXOtPOFrOctwO5WOhnpbfLBXS3SCaRfJZ43QK lN3T2ctR3ksXI5/MxOu7XdEA7TeOPhalseTZNS6qRVVoxCanp7rX0tor56dkk8/cRNikjgVtSrpF 2+wq/ZPSXZqbk6ou6b/GUV0yy/Xbhf0w4c9D6yj0+razOMgttopoKW21jX0lk8nWouEsvNUIj6xH SI7vGoke6u3Yu6bb/WcRPEFm/Exqbw/aK4zhL6XBaG0yrfb9FVrT0k9TB30jZu4k3mcvM1kcTEj9 7K5z/QRrgtYCqdHr5xHarauZ3pXolR6XWtdMpaS33msyzy6We41csSPdJT0tM9joadHczUe97lXo qb7qiYbiJ1w4mcJ4Ls8z/K8RxvA80sNVLZqqVKl9dSV9HM5KaOutqxyNkie+SeNY0qE3byOVzHbo BcUEO8JeB6l6Y6GYzgOptRjMlTYrfSUNvbY6SogSOkjpomolT30j+eoV6SK9zEYxd02ahrmrvEDq OmslHw48O+J2C9Zslo8/3y6ZFUTRWmxUKvRkXetgTvZZpHe9jarVRFa5d0VVaFhQVuxfiH1a08pt R28V+n9vstFp/ao75FlmMQ1TrLeaZzV3ggSo9JtS13Kzu1eu7nepERXajJrjxw3LSio4hrPpdpdb cUjtj8ip8TudZXvv09rbH3qK6pZtTxTuiTnRixu23RF2dugFvwVL1R41L9TYBoHmOimG0l8r9aL7 R07LPcebvW0SxK6qjY9j2tjlY9Y2d87njYiPcrHJsfF74juJnTXXbG9EM4wXAcouGodqq6rGlxua spG0FTAqLIlfJUK/mp2MVz1ljY1yoxeWNXKjQLbgrppdrhrDHxL3Xhq1ptuG1Nf7DmZrarti0dVD D5L5Z5K+nniqHvcknOu6ORyNVE8N3bJHmmXExxV654RqFnmm+MaaWyy4nkl6o7Tcb7FXLHdaClVO 5jbHFNuknKju8qVc2Pme1rYvQeoFzjUtUtVsB0Wwur1C1Mv3mewUMkEM1UlLNUuSSaVsUbWxQMfI 9Ve9qbNau3VV2RFVKvWziy4jtR+GWXih050/wewWCyWGpvFwosmlq5qi6uo2PdWJRrA5jYYkWKRk b5edz3NXdjWoj3bpnHFTknmLhvr9P8etja3XO72p9TSXWOSdaK0S0jamsdH3b495o2yRo167s8VV q7psFmUXdN/jP0ozZK7iI1G7RjLXW2+4Etn0jtFHZ3xVFurZGw227Tx1bu75Z0/2RdTwNasi/YvQ RO76bl5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI99oDST5Jf8An6n9oPaA0k+S X/n6n9oSECr0HC/h08I8kPR7PYjhCPfaA0k+SX/n6n9oPaA0k+SX/n6n9oSEB0HC/h08I8jo9nsR whHvtAaSfJL/AM/U/tB7QGknyS/8/U/tCQgOg4X8OnhHkdHs9iOEI99oDST5Jf8An6n9oPaA0k+S X/n6n9oSEB0HC/h08I8jo9nsRwhHvtAaSfJL/wA/U/tB7QGknyS/8/U/tCQgOg4X8OnhHkdHs9iO EI99oDST5Jf+fqf2g9oDST5Jf+fqf2hIQHQcL+HTwjyOj2exHCEe+0BpJ8kv/P1P7Qe0BpJ8kv8A z9T+0JCA6Dhfw6eEeR0ez2I4Qj32gNJPkl/5+p/aD2gNJPkl/wCfqf2hIQHQcL+HTwjyOj2exHCE e+0BpJ8kv/P1P7Qe0BpJ8kv/AD9T+0JCA6Dhfw6eEeR0ez2I4Qj32gNJPkl/5+p/aD2gNJPkl/5+ p/aEhAdBwv4dPCPI6PZ7EcIR77QGknyS/wDP1P7Qe0BpJ8kv/P1P7QkIDoOF/Dp4R5HR7PYjhCPf aA0k+SX/AJ+p/aD2gNJPkl/5+p/aEhAdBwv4dPCPI6PZ7EcIR77QGknyS/8AP1P7Qe0BpJ8kv/P1 P7QkIDoOF/Dp4R5HR7PYjhCPfaA0k+SX/n6n9oPaA0k+SX/n6n9oSEB0HC/h08I8jo9nsRwhHvtA aSfJL/z9T+0HtAaSfJL/AM/U/tCQgOg4X8OnhHkdHs9iOEMdj+P2jFrRBYrFSeS0NLzd1F3jn8vM 5XO9Jyqq+k5V6r6zIgFmmmKYimmMohLEREZQAAyyAAAAAAAAAAAAAAAA/FRFRUVN0UxFww7Ebtv5 0xWz1m/j5RQxSb/4zVMwDExE7W1NdVE50zk0eq0P0crFVZtMMYRV8VjtkUf+i1DFVPDToVVLvLpx bW//AC3yx/6L0JNBHNm3O2mOC1Tyhi6PVu1R/wAp80TP4VNAZPfaeQp/c19Un+aU404TeH5F5k0+ b+O51q//AN4l0GOj2exHCEnpblCP/PX/AHVeaKGcK+gUfvdPKdf7qtql/wA8h36bhx0OpNu602tD tv8AhWuk/wBJykkAzFi1GymOENZ5Tx1W29X/AHT5tOo9G9JaByPpNMsXY5PBy2mBzk/GrdzYqCwW K1bJa7LQUe3h5PTMj2/xUQ74N4opp2Qr14i9d9eqZ8ZmQAGyEAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAqZ2kLnZFpPhGjMLlc/VLUSwY1LEi9VplqO/kcv8AatWGPf4t0LZg CpeetbnXaR6W4uxqPptMMAvGVuaiehHNXypQNRfVzcqNcifFsp+dn6iZVT62a2vbzuz3U67vopU8 ZLbSK2GmTf17fZU+ItqAKB6samcBur9yrMk1mocq0q1as8k1Ciw0tbbcqp3xOcyJ0b6Nr2VXM1Gq xd5WoioieBpmsWTasVXANo27iVZeYm3bUazwZXX3Gif5XT48yrnkjqK6JiK5JFjigVd05lVW77vd 19LwBjMZyOzZhjtsyzHKzyu1Xmkir6Go7t8ffQSsR8b+V6I5N2qi7KiL1KW0uqWHcLPG3rllfEBV Vtgs2pVDjtTil/kt1RUUlRHR0joaila+Fj+WVHq30PFeRF/fN5rygCkfEVfdVOMPgh1WfhWk95ss FRWwPxanrOdtwyK10lXTzvqUpVY18PeJHIscaq50nKmyJzJv2dUuM/TfVfQq7aX8OtLd8k1IzCzP x6gxaltFTHUWiWpi7mR9W58bY6dlO17lVzncu7E2VW7uS6YAohgumMeK8XXDxoI2oZXR6GaUV99q 5mbrE+urHNoZHoi+Cueivai9URUU32w7Z72mGUXJU7yk0t00orQjfFIq+41PlPP8yrBu38BbIAUa t2aNoOI3i94hnSJ5Pphh9FjdrmX1vhoZKypjT50qGMTb1q5Dhxty8PvZGLXuXyerqNPqirbIvR7a q8Oc6Nyr48yPrWePxIhesAUe4j7ZWaM9mFbdMbXDyXq445j+Iwwp6KzVlW+BlS38LkWoUy1ZjNHU 8euiWlNt2ktuiul1deY0RPQjfUcltYip6nckbHInxbKXLAFL+CbN8brOIniWsN+q56TUG6Z9W1C2 uejmbJ5ioUjp6Oo7xW93yu75UanNuqKioioqKXQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADE5bl NlwfFbxmeSVbaW02GgnuVdO7wjghjWSR34mtUwmj2pdv1k0wxvVK02O62ihyegZcaWjubGMqWQv3 5HOSNzm7Obs9qo5d2uavRV2SA+PW63LN7ZgXChi9U+O7ay3+OiuT4XfZKWwUitqLhN03VPRaxqb7 I5Fem/iWjtVrt9jtdHZbRSR0tDb6eOlpYI02ZFFG1GsY1PiRqIifgA7QAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAEMcYOsdVodw+ZVmdmVzsiqIG2fHYY0VZJrrVr3NOjGp75Wud3m3rSNQIu 4edteOLPVbiSn5p7BhW2mWHOdusbu4cktyqWepeaZyNa9E6scqb9C3BF/DHo5T6B6EYdpYzkdV2i 3Mdc5m9e/uEqrLVSb+veZ79lVV9HlTfoSgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqP qmia/ccWBaQNZ5RjGi1Emf5EnRY33iX7HbIHfE+NFWdOnVrndS0WW5RZcIxa8ZnklW2ltNioJ7lX Tu8I4IY1kkd+JrVK58AGL3mt01v/ABC5lTOjyfW6+T5ZUNf1dT25VVlvpkXbqxkHpN8ekviBaIAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVLj1utyze14FwoYvVPju2st/jork+F32SlsFI rai4TdN1T0Wsb12RyK9N/EtFarXbrHa6OyWikjpaG308dLSwRpsyKGNqNYxqfEjURE/AVS4edteO LTVbiRn5p7BhO2mWHOXdY3dw7vblUs9S80zmta9E6scqb9C3AAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAACGOMHWOq0N4e8qzSzK52Q1EDbPjsMaKsk11q17mnRjU98rXP7zb1pGpM5UfVRE1+ 44cC0fazyjGNFqJM/wAiTxjfeJfsdsgd8T2Iqzp06tc7qBM/DHo5T6B6EYdpYzkfWWi3tdc5m9e/ uEqrLVSb+veZ79lVV9HlTfoSiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa9n+W+wXEa/KfN/lvkXdfYO97rn55WM99s7bbn38 F8DSfbcz/wC5D/P8H6hldf8A+xHfv+6/0mIxxzcRXdm/NFNcxERE6suuat8TuUcRcuRc0aasoyjd 374cftuZ/wDch/n+D9Qe25n/ANyH+f4P1DkBH/G/FnhT+lFzl3tz8PJx+25n/wByH+f4P1B7bmf/ AHIf5/g/UOQD+N+LPCn9Jzl3tz8PJx+25n/3If5/g/UHtuZ/9yH+f4P1DkA/jfizwp/Sc5d7c/Dy cftuZ/8Ach/n+D9Qe25n/wByH+f4P1DkA/jfizwp/Sc5d7c/DycftuZ/9yH+f4P1B7bmf/ch/n+D 9Q5AP434s8Kf0nOXe3Pw8nH7bmf/AHIf5/g/UHtuZ/8Ach/n+D9Q5AP434s8Kf0nOXe3Pw8nH7bm f/ch/n+D9Qe25n/3If5/g/UOQD+N+LPCn9Jzl3tz8PJx+25n/wByH+f4P1B7bmf/AHIf5/g/UOQD +N+LPCn9Jzl3tz8PJx+25n/3If5/g/UHtuZ/9yH+f4P1DkA/jfizwp/Sc5d7c/DycftuZ/8Ach/n +D9Q6F/10zjH7Fcb9VaPPfDbaSaskay/wczmxsV6onoeOyGTOtc6CK6W2rtky7R1cEkD1239F7Va vRfHxMxz34s8Kf0nOXe3Pw8mpWji7hv+ly6zWbB6arxFttmuz7jHkEPKyniY50vMis3a5nK5HMVE cjmqioioaH2cVTdsqx/ULV/MLQ6lyjU6+R5VVSPl5lZb52vS30zU5U2jjgbzNXdVVJvVseNGGa7a i6e4DlWjMdxqH4nlMsDbtbFlVjmLFMx0ncP6pC6RsfdvVGqjm7bouyHpRwV8X2umvOot1x3RPQHH 7HjaRUMNyulzuU9RRWOlgidHCxO7jjWWRzUVGRJsruXxa1HPbZpov266ftzVGevPLZlO6I68luKb tNUZznGfdsyn6vTQH4m+ycyoq7dVRNj9LiwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI91//sR37/uv9JiMcZHX/wDsR37/ALr/ AEmIxxzL381V+Wn51OdiPbT4R85AAEYAAAAAAAAAAAAAAAAAAAAAAADxk0b4F834gddMxpJ457Dg ePZNcKK5XhYlasvdVL2rTUiORUfLsnVV3bGi7u3XlY71w4WdNcL0jrMuwHALHDa7NbI7UyKGNN3P d3D+aSR3i+Ry9XOXqqmy0tHR0MToKGlhp43SSTOZExGNWSR6vkeqJ++c9znKviquVV6qfWkf9f8A n35K/wBRIZruTXeteM/9ak0XZru0eP0lK4AOkvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1vUXUTDdJsK uuomoN6baceskST19a6GSZImK9rEXkia57lVzmps1qr1M1a7lR3q2Ul4t0rpKSugjqYHujcxXRva jmqrXIjmqqKnRURU9aIVG7Um9VHuc7TpzQ0NXcKrUTNLLjrKCj2Woqm98tQscaKqJzK6nY1N1RN3 N3VNztZzxB8UOguT4BdtZMF00TT7Nslo8UWlxyrrZbpZJ6pHdwsksqNhqGtRjubkiZvy7J4ooFuQ VvynXzWHP9Xsi0Z4YcbxOomwZsDcqyjLJKh1upKuZvNHRQQ0ytknm5UVXrztazZWr1234NNOK2+W 64asYTxJWWyY9kmj1vhvd1rrDNLNbbla5oXTMqKdsv2VjkRvKsblVeZzURVVVRAsuCnlLr3xyZPp oziCwzRHAZMPqaZt3t2HT1VfNlFwtjtnMeySJvcNmkjVJGx8j12cidXeisu6n6k67eYMKTRHSOnq brl8aVFfWZXUrR0OMRdy2VUroo1798u7lYkcadHNduqdNwmYFadJuIHV+PiHl4bddLTg9Vd6zF1y u03vDZqlKR9O2o7h8E8NQrnsk5kcqOR6tVET1r02Xhh1yyzXWr1TuV2t9op7BieeXHE8floopWy1 dPSIxHTzOfI5Hq5z02VjWJ0VNtwJxBTep45sosOkGuetV3w+1XKzafZ7UYVi0FIslMtckc0MCVFV M972ozvJ2qr2tamzVTbddzebTl3HFZbnjN5yXDNJs2xm81tPBcYMOq6umrbdTTeNWyask7mpjjTq qIjHO6cqdd0Cx4K35Tr5rDn+r2RaM8MON4nUTYM2BuVZRlklQ63UlXM3mjooIaZWyTzcqKr152tZ srV67b5Xh716z3NdQs90M1mxiyWnPdP0oqmeosM8slsulDVsV8NRAkv2SNU25XMeq7KqbKvVECew AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABHuv/8AYjv3/df6TEY4yOv/APYjv3/df6TE Y45l7+aq/LT86nOxHtp8I+choVmyzJarV7JsVr8jwOWw2y20lTSW6jrHuv8ATSPT7JJWxK7kZA7/ AHtyIir6zfSreB/Dy1p/vMsf+ibUxnm1pjPNN1VrhotQ2y23qt1fwmnt95RzrdVy5BSMhrEa9WOW F6ycsmz2uavKq7Kip4odbVXMcgx604vcMNyjAbc27ZDQUVRPlVc+GCropuZXxUTo3J3lY9Eb3TV3 a7Z3RStnZ/6O6cZDwaWm5ZJiVsu9Vk8d1jrpq6lZPJ3LKuohZCxz0VWRtRiuRrdkRz3uRN3KqxJj 9yrrpwJcL89wqXzyRatWyma97t1SKK43BkbfwNY1rU+JGob6EZ5d7fQjPV1SuNHxWaWv4gKnQZ+U Y5HU01sim8vkv0De8ur6t1P5qbCvvqlNkcrEdz7uRvJv1JnKnYrjGNTdolnTpsetkiw4JbrhGrqS NeSqWrRVnTdOkm/Xn99v6y2JpVERlk0riIyyfE00VPE+eeVkcUbVe973IjWtRN1VVXwRENUx7V/S bLru7H8T1RxG9XRvNzUVuvdNU1CcvjvHG9XdPX0Nc4ndLMh1q0Iy7TDFL5HabrfKSOOmqZXObGqs mjkWKRWorkZI1ixuVEXZHr0XwWtlXddN8Umw+x8SvB37V62u70LbRl2MrTy2ymrmORIXOrKRWTU8 b3InoP5v7ffbmTNNMTDNNMVQuTlec4VgdCy55xmFkx2jkfyMqLtcIaSJzviR0rmoq/NudrH8kx3L LXFfMWv1uvNun37qst9Uyogk28eWRiq1fxKUdu1yy3LuN/Vasm4fHauJg1vs9ps9DU3W30sFmhqK dJpJWx1rka98r+ZediKrU3RVRHJvsmlmN6z6W6iauaj0Ogr9McJuuGT3aGztvNurKf2QUrfQfFDS yOSNJIlertmIiqzqu6tQzoatrPNxltWmuWqul9nyOPD7vqRi1DfpXNay11N4p4qxyu96iQuej1Vd 026ddzIXnM8Pxy4UlpyHLLNa66vhqKmlpq2viglqIoGc88kbHuRXtjZ6T1RFRqdV2QqzwucOejeq XCLZJs5w+2Xq7Z3QVVfer9UU0ctzlq55pOaZtS9rntkYu3Ku/RW77Luu+M150sx+q4ieFLSi7Vtd fLJS0uR0kz7pMk81fT01DBIkdS5GokqPSJGvRU2e1XI7fdd2jGeRoU55ZrZwagYHU4omd0+a2GXG nNc9Lyy4wrQq1r1Y5e/5u72R7Vaq83iiofmK6h4BndJPcMIznH8hpaVdp57Vc4KuOJfHZzonORvg vj8RT7ijpKj3TGjukWOaOU+Y4raLRccigwujqKS20VZWI57Ue9sytgckW3eci+Kvd0XmdvkrLgWs dRxKaf6n4rwoppdbaVtZa8vmpsgtEkFyt80ad33sFNKivdFInMio1XL6PijU2aEZZ5mhGWeaadJe KnS/V/UHLcBx3JsdfPYLgyjtT4L7BPLfYvJmzTVFPE3ZVjjcr2KrFeioxXbp4JMxU/g5xnG6TVzi DqqXH7bDNbtQJqejkjpI2upolh2Vkaom7Gqir0TZCSOIK/2GzVtlZeeKhukTpYp1jgWS2N84ois3 f/Vsb19DdE9DZPT6+oxVTGllDFVMaWUJoMRluXYxgeOV2XZlfKSz2a2R97V1tXIjI4m7oibr61VV REROqqqIiKqohCOiOT4zds4ZSWrjXbqfOtLK7zAktmdzIm2821JCyX0Pw7depHvagTSy6Q4JYZnO ba7zqBbKS5bKqNkh7qodyO+ZVRHfhYnxCKM6opIozqilPOknEzoXrrW1ts0q1Eob5W2+PvailSGa nnbHuje8SOdjHOYiqiK5qKiKqbr1Qk4pVq5arZhvaKaDy4fa6W3SXSw3GgroaKFsTJaVkNTyI5rU RFRqbqnxd23+ChdUVREZTDFdMRlMdYcekf8AX/n35K/1EhyHHpH/AF/59+Sv9RIQ/wDmteM/9ai3 7Wjx+kpXAB1nTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR7ja1Bhs3FZw+UNVZrjdbNg7rlnGSRUFK+ql pKLeKlhrViYivc2F7pHu5Uc7lRVROg1L1Exjje1n0h090SqKrI8LwPKYc6zDIY6KeG3076NrvJKN JJGN7yWRz3orG+CKi/vXct4QB5e2LDeFDTnVrWez8atBkFkyq75/dchsNy8432lpLxZapzZKdafz fI2OV7V7xHN2V6K5G7ryq1u85dw9YLl3BXrBlHDXoRmOJZBmdHFT08N9r66quV7ttDWRzMljhqp5 ZI2yxNl5I1Rj3bonKqKxV9CQBUXFOOrTy/43hOAcPuI3fOM4rPN9tqMZSiqreyxQNRjamSuqXwLH AyFqOTpzczkbyoqLuRfqnWaUXPjZz218blTVuw2gtFqdplarkyrfZqxHRItbKyKFFZNUpN6PK5Fc u7kRF5GbehQA87eFOh01xrj41PixXTaHTl8+F0FJhmP1FtfRSXGkla2pnqlj5fsaqsMaua7Z7UVG ORHte1v1wacSWCaGcJtVht6iulZrBZKi/wBxveIrbp217q/ymeRHzbs5Yoe6SJz53uRjGtduu6bH ogAKEcN2X4VonwL6cz634HdcixnUyquNfldxjtKXChoW1s800c9dCnNJ3T2dyzmaxyIqbqqeii4X S2q0vs/Erp7bOAPLcouOIXCqq36gWSnlrqnF6Cg7rdsyLVJywVCyb8jY377ojdmouzvREAeXtiw3 hQ051a1ns/GrQZBZMqu+f3XIbDcvON9paS8WWqc2SnWn83yNjle1e8RzdleiuRu68qtbbbg70x0U s1lu+q+lWi+U4HJk8y0XeZNca2orbnQU718nqUjq6iV8Mb0cqta5GPVNt0VvKq2MAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAR7r/AP2I79/3X+kxGOMjr/8A2I79/wB1/pMRjjmXv5qr 8tPzqc7Ee2nwj5yEW2HRDzJrzmmt3sn772YWahtHmzyLl8l8nTbvO+7xefm/g8jdvjUlIGYnJHEz GxGHDpop7QOidj0d9k3n3zKlYnnHyLyXve/qpp/3LvH8vL33L79d+XfpvskZ2fgs81aDaY6I+2V3 vtcZhBlnnPzNy+X93VVM/k/c9+vdb+U8vPzv25N+XrslmwZ052ttOrag7NNAr4uu8XEPhmry4fJ5 nhtORUVRaIaynr6CCbvl2kke3yddk5VeiO2RN0267yT7aemP3R8X/lin/XNguNut93t9TabtQ09b Q1sL6eppqiJskU8T2q18b2ORUc1zVVFRU2VFVFI89zJw2/e96afmnQfshnntM4na+8/t2B68Yfct O7Rqc2lq6ljKmGsxy8xpXUckUjXMmb3blVWo5Go5FTlVF2Xx3I2vnC1qnqVTUGM648SdVl+H0lbT 11RZ6PFaS1yXB8D0fG2oqI3vVWcyIrkY1m/zLsqTDiOjekOAXN97wTSvD8buMkLqZ9XaLHS0czon KirGr4mNcrVVrVVN9t2p8RuA0sthpaOxCeonDndrzqcutGkmqFXp/mNZb2Wq7TJa4rlRXSmYqLH3 9NI5v2RmyIkjXoqIiIZ3SnR2/wCFV2QZFqFqpe8/vuSNjhq5KyJtJb4II0VGxU9DGqxRIqOXmd6T netfHeTwNKcsmNKcslXIuDXN8exu56Wac8Sl9xrTC6yVCPx3zHTVdVSU9Q5zp6emr3uR8Ubud227 HKnMq7qqqq7u7hfx6353ovk+KXpbTaNGqG6UFHaVpO+dXR1lI2nRXT87eRzeXnVeR/Oqr73xJsBn TqlnTqlFOt2gdHq3X41l1ly24Yfm2GVEtRYcgoIY5n0/etRssUsMnozRPaiIrFVPw7K5F6WCaJ6j W7PaPUPVbXu85nWWqlmpbbbqK3R2W2RJKiJJJLTwvf5Q/ZE2WRyo3xRN0RUmMGNKcsmNKcskJ4Pw 9ZJp3rflGpmLarzQ4tmdwddrzik1lik76sWB0fOysV/PG3nVsnKjOvKjVXYl+4WSzXdzHXW0UVas SKjFqKdkitRfHbmRdvA7oMTMyTMztY6hx3H7ZP5VbbFbqSZEVveQUrI3bL4puiIppWv+huKcQ+ml fprls9TSw1EkdVSVtLt31HVRrvHMzfou27mqi+LXOTdN90kYCJmJzYiZic4V10c4SbphGqTNZ9WN Zrxqdl1vti2ez1ddQMo47fSrvzcrGvfzSKjnpz7pv3j1VFV26WKAEzNW1mapq1yHHpH/AF/59+Sv 9RIchx6R/wBf+ffkr/USEf8A5rXjP/Wpm37Wjx+kpXAB1nTAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACGdVd YMzxXX/RzR3ELdaaimzt96q79UVkMsktHQUFPHIjoVZI1GOfJK1iK9Hp18CZjjdT07p21LoI1mY1 WtkVqczUXxRF8URdkAhHhh14vureidTrRqY/HbFaqm83VttqIVdS07LTT1T6eGWd80rk53LE9Vfu 1qordmp65KwzVPTDUd1SzTzUfF8odR7eUpZbxT1qw7rsnP3L3cvX4yuHFbk2DZ5qHivC5adDqrVP JqBkeayWBL020WWipYpFjjluEitc2VivcqJAsb0XmTdPSbvFOO2jLG9olpFZqzRHBtLrhZcUvl2u 8OIXNtU25WyaJ1PA2q5KaBERlQ3dqKjuq77psgF5Mx1V0v07npaXUDUjFsYmrv8Aasd5vFPROn67 egkr2q7r06bkP4hq5nGacb2Y6bWrJGSafYXgltqKmgip4HtlvFbN30VR3/Isuy0u6IxH8i9Hbb9S LuCHAMI4hbZqBxQ6rYlZ8svWe5XcqW2vvNFFWNt9kpX9zT0kLZUcjGpyvR3LtzIjd99ivGLXt2iP DLxa6saT1U9K/IdQ3YFiVRFMqugt9PM2lpu4kVd2sip6uRsSou7e6ZttsB6XM1o0flv9biVPqniN RfrdHLJVWmC9U0ldC2NqukV1O16yJyo1VXdvTZSM+BfUjUjWLh0s+qup95dcLlk9xuVZSItLBT+T UDauSKnh5YWNRURsW6OVFcqO6qpDnFJw46EaB8BuRU1uwux0N2xKy0q0OQw0kcVyfd+8ijZU+VIi S95JM70vS6terduXob7imqcPChoppRpfLoZq5mdRT4fb1qZsLxN90p6eoSJqTNmej2oyR0nO7l6r su6+KAWau13tNht1ReL5c6S3UFIxZKiqq5mwwwsTxc97lRrU+dVMFhmqemOo7qlmnmo+L5Q6i28p Sy3inrVh3XZOfuXu5evxlSc6uVJxY8XumOkWZY3eKDA7HgL9TrnieQUvk0tZWyVPktNBX026oqw8 zH905VTdz2uReqHPr3hGG6ecZ3DJNpFi1qxzI71X3qkuzLLRx0qVlmipWOlbUMiREe1qK5Wq5Oio u3VqbBau76t6VY/Le6e/am4nbZcZdTMvbKu9U0LrY6oYr4EqUc9O5WRiK5nPtzIiqm6HdoM+wu84 lNneP5Tarzj8FPLVLcbbWR1VO6OJFV6tkjcrXbI1d9l9RUHg40yw3V/VvXriPzGx0d9fctQq6wWF lwhbUQQ0lAxsLamON6K1Hva5Gc+3MjY3NRURzt4pxXJqHT3hF40NQ8ZiitWNXTOMhs2P0dM1I4IU mSKibNCxvosRzqhmyJ0Tu0TwQC0HBFrlftT9EcQvesOoNpqs7zbzneaC0yPpKWsW2R1ksUXdU8SM dJGxkaKsnKq+l6TtyesgzPD8TqbXR5Tldms098rG2+1xXCvip311U73sECPciyyL6mN3cvxFKsvw NdBcm4IcibB5OuPys06ua7bd7Nc7Y2JqP+fvo5Xp/bOU3XSim91JxTXriGr08owDSWSpxLAWO6w1 10X0bldGp4ORF2gjcm7XI3mTZzAMXYOMHWXJcPwS/wBrx3EnVOo2stVhtnatHUqxMXp5J2TVjk8o 3fUt8mkXnRUj/wDhlzTrst9BE2FsdDTsSnVXQo2JqJGq77q3p0Vd18PjOwAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAABHuv8A/Yjv3/df6TEY4yOv/wDYjv3/AHX+kxGOOZe/mqvy0/OpzsR7 afCPnIAAjAAAAAAAAAAAAAAAAAAAAAAAADj0j/r/AM+/JX+okOQ49I/6/wDPvyV/qJDT/wA1rxn/ AK1NrftaPH6SlcAHWdMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEBal8MeSXzXCm4hNItXZMCy2Sx+xy7p PY47tR3KhSXvGIsL5I1jka5G+mjl6Nam3vubFYtwhX3EOIu38RlBrddLjeamwLYcpiu1ohqH3liz pNzQvY9jKFEVkLGsjjVqMiRPFXOWyRqWp2q2A6N4y3MNSL95otL6ynt7JkpZqlz6id6MijbHCx73 K5y7dG9PFdkTcCAsF4K850vW8YVpzxNZBYNLbzcqm4ri9NY6Va2kbO7eaCnubnLJDG7wRWxo9qbq 1yPVXr94zwDYZbODmThGyLL6q5Qyzz178ho6JKOZtatWtRDOyFZJETk2jjVFevM1q9W83S04Ap/q VwNaq64YLQ4RrbxZXTKaa23Cjq6eOPFaehpZGQvRZPKIoZkdPM9iKxJHycjOZ7kjVyoqW/RERNkT ofoAg7Wnhqr9QdR7BrZppqbW6eaiY/b5bM27xW2K401bbZHq9aWppZXNSRqPVzmqj2q1XKvVUarf zTHhorsW1Cr9a9TdTa3ULUipti2ahu9XbYqKitNFurlipKKJytj5nLu9yvc53VN05nc05ACJeGbQ X3OGids0mpsr8/11FNXVdTepaHydaupqaiSZZHQ94/bl52t2513Rm+6b9Iop+AyGPhVx/hhn1RdP BRZLHkF+vLrL6V6alc+qfAsPf/YlcqxM5+d+3dIvKu+yWxAFLOPPI8W13teL8Luk+U0t21Ou2V0V dTOtFW2Z+MMopVWpuFW6NVWBImq9iNVWvV7tmoqoqFqdLdNsX0f07x/TLDKPyazY5Qx0NM1duZ6N T0pHqni97lc9y+tznL6zWq64cP8AoZmNnt7bDjuKZJqfdX0VGtrsPd1F5rdu8f30lPEu69Vcskqo 3dd1dupJ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAabq/j93ynTq7WKxUnlVdVdx3 UXeNZzcs8bnek5URPRaq9V9Rovd6t/cn/n2mJsBUvYSLtznIqmJyiNWXVnvid6vdw8XatLOY4eSE +71b+5P/AD7TDu9W/uT/AM+0xNgI+gz+JV/j+lp0OO1Pw8kJ93q39yf+faYd3q39yf8An2mJsA6D P4lX+P6Tocdqfh5IT7vVv7k/8+0w7vVv7k/8+0xNgHQZ/Eq/x/SdDjtT8PJCfd6t/cn/AJ9ph3er f3J/59pibAOgz+JV/j+k6HHan4eSE+71b+5P/PtMO71b+5P/AD7TE2AdBn8Sr/H9J0OO1Pw8ladL dTsh1pwS2amaaYJ55xu8995FW+dGU/e91M+GT7HMxkjdpInt9Jqb7bpuioq7V3erf3J/59pjQey4 +Anpl+Wv0xWlqh0GfxKv8f0nQ47U/DyQn3erf3J/59ph3erf3J/59pibAOgz+JV/j+k6HHan4eSE +71b+5P/AD7TDu9W/uT/AM+0xNgHQZ/Eq/x/SdDjtT8PJCfd6t/cn/n2mHd6t/cn/n2mJsA6DP4l X+P6Tocdqfh5IT7vVv7k/wDPtMO71b+5P/PtMTYB0GfxKv8AH9J0OO1Pw8kJ93q39yf+faYz+kmP Zdbb/lV9ynHvNHnfyHuIvK4qjfumSNd1YvztXqiePr2JNBtRgoorprmuZy35bpjqiN7ajC00VRVp TOXh5AALqyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQdr1rflenerGimlmG220VdXqXkVTTXBa+GSR0Nr pIEmqpIeSRnLKjXN2c7manXdqk4lRsnnkzPtJrDBDSTV1PpRpfXXlsUXLz+cK+o7jum8yo1Hvg2V FVUT41ROoHasGv3Eprnnmo9k0Ct2ldls+m+SVOK1CZg+vqLjXVdPsj5kipXMSngc7dGOdzq7ld06 KiTvo1k2peV4JS3PV3T2PDcpZNNTVtuhro6unf3b1a2eGRiqvdyJs5Gv2em6oqdEVaSatalcCerF PX6iXt2YaXa4Q08sSQWijuFsyyGvYitjhfHTt7upcrmsRHO505eVFe1EXa33CzXas3Ph6wWv1ygm hzie1Nfdm1ESRT83M7u1mYiJyyrF3avTZFR6uRURegGD1y1yyzT/AFn0T0iw232irqdS71XR3J1d FLI+C2UVOk1Q+HkkYjZNnJs56Ob0X0VP3XPXHLNPtZNE9JcMt9pqqnUu910VyWuhlkfBbKKnSapf DySMRsmzk2c5HNTZfRUh3X/M8d0v4/tMtR9Xa19kwahwO5UdpvU8EjqSO9zVDmyxPka1UY5afl23 235kQx2LahM167RCnyqy2C6vxrTDTSqrbK+oplp5rlU1tQkSzRRzcjmMkjV7GLIjOZIkei8j2uA3 Swa/cSmueeaj2TQK3aV2Wz6b5JU4rUJmD6+ouNdV0+yPmSKlcxKeBzt0Y53OruV3ToqJseT8T+ea XaIWjLNWdHZaDUy/3puLWXD7fc4p23i6SSKyB0E6KvdwPRO8V0iczGoqKiry81eNWtSuBPVinr9R L27MNLtcIaeWJILRR3C2ZZDXsRWxwvjp293UuVzWIjnc6cvKivaiLtjda8W1DyrR/hZ1Q4t8UyC5 2fGamu9siKhZVQ1tGyqiRlHWzto1bPGsaRsdKrNnI5ytVN3cqhN+Z6+8VnD6mNZvxBYppfX4Pe71 R2W5pic1ey4WN9U7ljmc6pVY6mNrtkdytYqqqbJsu5tWqev+qtx1xZw38OGN4xX5RbbQy/ZLe8nk qPNlmppHI2GFY6dUllnk3RyNRzURqovVOZWQbp9pt2fesOpFjxHSDSzMc+o4ldcrhf4sgyB1nsr4 dnwd++rqmslke9ERsbEevirk2Rdu9husGDcNfGnxB1Gv1bXY7NqBLYa3FrjJbaqphulFT0r41igd DG9XPYr2NViJuqtVE6tA+bVkequq3aB6a6fax41ZaG+aN49fcjqp7FNLJa7kyuigp4KmFs32WPZZ EarH7q18aqjnIpfIpZwgZFX6y8XnEHrbc8dr7LBbYbLiNno7hD3VVFTNjfLJ3rF6xvcrIpFjX0md 5yuRHNUumAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVey4+An pl+Wv0xWlqiqvZcfAT0y/LX6YrS1QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAANW1SztNMdOsi1Cdjd1v7Met8twfbrVG19VUMjbu5I2uc1F2TdV677IuyKuyKG0g1rTbU TFdWsCsWpOEXDy2x5DRsraOZU5XcjvFj2/vXtcjmub6nNcnqNlAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpaoAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH4qIqbKnQ/QBTTTxV4L+JeXRarVY NItZq6W5YVKvMsVjyBdvKLXv4Mjm3R8Teib8rURV51LlkZ8RehuP8RGk1400vsz6OapRtXabjE5W y225RbupqqNydUVj9t9lRVarm7pzGmcH2ud/1Sw254FqhFFQ6q6aVfsfzChR26ySsRUhrmfwoqhj edHJ0VyP29Hl3CfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVX suPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrep XaM8P+lfEBFw6ZLSZRJfnV1Bbqi5UtLTPtlJLVpGrO9ldO2REYkrFerY3cvXxVFQsXmeWWbA8Qve b5FUdxa8ft1Rc62T+BBDG6R6/h5WqeI1utOmOtHCvrtrdqHqhhdBqxlWWtyazWesv9LFcGxUjnvk jige9JfsjKuqYxiN3d3MOyL0A90jUtXc99qvSrMdTfNPnT2JWGvvfkPf9x5T5NA+Xuu85XcnNybc 3K7bffZfArtj3F7WVHZ2e6goVhrchteLLFUNm9JvnqJyUjnSN8eVajaTl8VY5OvXcq7i+nXE1nvA pmfFFkvFLmN2ueTYvfaqsxa4yJUWaS0o2eGdiQqu0UyxMklY+JGI1eRvKqb7hfnhQ4gfdP6I2fWP 2JexrztUVcHm7y/yzuu4nfFv3vdx83Nyb+8Tbfbr4nHxZ8Q3uXdFLprD7EPZN5tqqSm83ecPIu87 +ZsfN3vdybbc2+3Iu+23TxPP7A+IXL+HDsjsYynAatKLIr/ktdj1BXcjXrRulq6uWSVrXIqK5Iqe RGqqdHORfUdXi10O15064F6fOcw4kcuzyLJvM1Tk1lyKZaunpJJnsmjfRSvVZI1jl5I1Tfle17nb NVGogeomlGc+2fpbh2pfmvzZ7Lcft198i7/vvJvKqZk3dd5yt5+XvOXm5W77b7J4EGcRnaB6R8M+ ptDpNmGFZ9fL7cLXFdoEx620tTG6KSSViN+yVMb1eiwvVURqptt18dpJ4UPgtaOf3gY9+joDz/43 8vynAu1B0ty/CcAqs2vdtxakko7BS1Pk8te9ZLi1WNk5H8qo1yu96vvQLC492sHDPcckoccy7HtR MDW4PSOGtyexR09MiqqJu50U8rmt3VN3K3lTxVUTqXNY9krGyRva9j0RzXNXdFRfBUU8h+OnWXWj iExnDcS174bbzoXglFkUVbcMtr46i8rTuWKSJGNWKnj5d2yOXkXq9zGdU5etheN/iXy7TvCNE9Gu GDLYaes1ZWloLXkzFbM6K3f1NDA+JyoqI6Vahi94ibtax22zlRUC+pXPP+L/ANg3GJg3Cb7Xnlvs 0tKXTz/527vyTdKz7H5N3Lu8/wBp+Pet/dPD0etUuJqh4kuzzocK1usPFHnGpdmrb3FZr/Y8tqnV MFS98Uk32JHuf3LHtgmT0fSYvKqOd1QxvFe/K817TvRJ+l1/ZZLtf8Io1oLrNTJOtDDOt07yobE5 eV8kcL3vY13oq9rd+m4HqWDzVqcm124NeOjTXS++6/ZfqXguqnc0ssGTVS1EtPPPM6nTu91Vsasl WJ6LGjUVrnMVvTmPRPL7BLleJXvF4b5crLJeLdU0DLlbJu5rKJ0sTmJPBInvJWc3M13qc1FAwWF6 x6bah5dmGCYZk8dzvmBVUFHkNMymmYlFPMj1jZ3j2IyRV7uTfu3O5VaqO2XoboeT3ZnaX11Trzrb m9x1jz2CPTvJWur6eO7O7jJOZ9xa6W6N/wDzL07tZEVevO96+s2rhwfxFdotVZ5q9dOJfONL8YtN 3W047ZMRqlpWwu7tJU79WOasyNZJFvzKqvc52ysREaB6bmEzbNMY06xG753ml2jtlisNHJX3Crex 70hgjbu53KxFc5dk6NaiuVdkRFVUQp72dPENqzm+SaqcO+t2QpkeSaU3d9BDfHMRstZCyomp5GyK iJzK2SFFa9d3KknpKvLuvY7WvEq+7cJt5y+jzbIrTHjc9L31rt9a6Kiu7KmtpoeSsjT91bHvzsRf B3UCWeILi2x3Rzhoi4mcRsHs1slcy3VFug8qktvlVPWPYkcvNJC97PRejuV0aL6l2JS0pzj2ztLs O1J81+bfZZYLffPIu/77ybyqnZN3Xecrefl5+Xm5W77b7J4HmPq3pjWYD2S1Le6nUfLcmZllLil1 io73cFqaeztcsS+TUTV/cYE5ujE/gp8R19UMW4rNNeCnT3ipsXE9klkSyWHHWUmI2pXU9sprVJFB T0nMiP5aiZUdC+TvWORVke1Nkam4etQPNrjH45NRse4f9BExbKWYVeNYbRSXbIchpqZZX2ml7qm7 9YGIjndX1D3btRXo2LZvVyKkd6e8Xtl0o4lNMcf0f4us61rwjNq+KyZRQZlDWOmts80scUVTBLVQ xq1vNLzoyPfZIntdvzNVA9aQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAqRxb41f9EM+svHBppbZqqXGoG2rUW0068vnfHHL1n5f301M7Z6Kv71qbryx7Lbc 4aukpLhSTUFfSxVNNUxuhmhmYj45I3Js5rmr0VFRVRUXoqKB0cWyewZrjdsy/FbrBcrPeaSKuoay B28c8EjUcx6fhRU6L1T1mUKd6AVtZwma71vCHk9XO7A8udU3/Sq4VUickCc3PWWXmX99G5yvjTxV qqq9XtalxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKq9lx8BPTL 8tfpitLVFVey4+Anpl+Wv0xWlqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACtPaE4ZrjqZw 4XTTLQXEJL9ecoraajuCNuNLR+T25rllldz1EsbV5nRxxq1FVVbI71GG017NnhUsGneN2LNdG7Je cgorTSwXa4yyz89VWJE1JpPRkRE3k5lTbwTYteAPPDhs4MNasa0e4gOEvUqyvtuDZNV1E+FZC6vp alkkiqrGSvhjldKxF7ijl5XMb4SJ0VTX8G0W7RGzcLOScH9XpniNHZqe03SjoMoW/QSzV1NJ3sqU MMKP6OmkesKSzd01kcm7k3ah6XgDzntHAhqxnHZs2vh1y61U2N6hY/e6q/26kqq2GeF06VM6sY+a nfIxEkgqJGoqKvK5zebZEU1/WLSDtGNfOFOj0TyzSLGbNLirLczanyCklrsldTubFH/v3k9OxrFd NIrpEc58bEa1EVUT04AEf8PWMX7CNAtNcLyq3+QXrH8Qs9ruNL3rJe4qoKOKKVnPGrmO2exybtVU XbdFVCmnF9oVxWVfHBhPEroLo/S5lQ4nj1NTNSqvdDRxPqkkrEfG5s08cmyMqGO3RNuvj0U9CwB5 w664/wBppxZ4DUaIZXw+4Lp9jt7qaZ9zukmQ09S7khmZKxPsVRK9redjHLyxucvLsioirvunER2f mV5DoXo5ZNG8qpPbA0NihW01Nw+xQ3JU7p8qKvpd27voGPjR27UTdqqm/Ml6gB506v6H8cPHNV4d p7rzpnjGlOB49c2XW8VNHfIbhUXGZrHRq6BkT5OReR8qMa/ZG94quc7ZGmV4muGDiTyXjj031p0I xa1wWLCsXpqSG53GvgbRsqad1c9KSWFJUqe7lbLFCr2Ru5Um5v3q7egIA8/bJw8cVnEXxjYbxAcS OA2LT/GNNo43Wq1UN5huElZPE98sbmuic7xmc17nPRnoxtajd1Vx6BAAUA4XtAeKbhx4m9UKSTS+ x37TDU/IFravInXqBj6SkbLVSRq2n5+9e9W1SsexWbbpujlTxxGk2hHGtwMX3NcN4f8ATLGtVcBy e4LcrS+tvsNvqbZJy8je/bK9nOvIjGvRm6O7trkcxVVp6LACpXAbwm5zoJ7O9UtZrvQV+o2p1yW5 XaOgdzwUTVkllViP2RHPfJO9z9vRTZiIq7K5ZC429GMo4geGLNdKsJdTefbrFST0DKmVI45ZKerh qO7Vy9Gq9InNRV2RFcm6om5OYA84cr0Q4yNS+z5qOHXKdELdbMnxnzFbLFT0uRUMj7nSUsid5NI5 Zu5iVrGM6LJu5eZUROiEs6+aA6t5r2bVm0CxnE/LM8pMWxS2zWny+mj5aijdRrUs798iQryJDJ1R +zuX0VXdN7igDz91m4INX9QOGvh9q8L8gs+reilrt6st1dUxrDNKyKnWSHvmK6NXsmpo1avNyL6a cybopKumd+7QvUPU7H6zUrBMP0nwa0s5r5SQ19PeKu9P335YXRuf3DVVETq5Fa1zl3euyJa0AAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ5xU6Bx8QOl s1gtdwW0ZfYqmO+4leo9kltt2p154Xo7xRrlTkf/AGrt9t2ocXCjr1NrzpilfkltWzZzjFU+wZlZ ZURstBdoPRl9BPCORU52erZVbuqtUmgp5xHW6u4V9bLfxl4fQyuxC++T4/qvbqWFXq6lV3LS3dGp 4yQOVrHqibq1URPfPcBcMHXt9wobtQU10tlXDV0dZCyop54Xo+OWJ7Uc17XJ0VqoqKip4op2AAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/LX6YrS1RVXsuPgJ 6Zflr9MVpaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjnU/iM0J0Yie/VDVfGselYnN5JU1zFq3Jt vu2nZvK//qsUp3qp2z+gmMJNR6V4Vkeb1bN0ZUTo210LviVHSI6ZfwLC38PxB6FA8nU4m+1V4plW HRrSiTBrFVdI66ntbaRrol8V8tuK8r1T44UavxJv42D4JeELij0e1RuOsXEFrpHk9ZeLPLbJ7U6t qrm9OeWORrlqJ1akasWPblY1zdnKiLt1A3nPe0c4fsF1VuWkMFtzbKrvYnvZeqnGrGtfS2tY12l7 5Uej1SNV2esbHo1d098iobLopxuaO6/33UOy6c0eQVUenEazV1wlp6dtLcIuaVGvo3Nmc57Xdy5W q9sfRW+G67VC7KzKsSwTUviHsWpV/tlly9t8jlqnXSpjp5JIoJ6xKhUdIqdGSO3f8XO1VMX2btxx u76qcXN2w1sbcfrXT1FqSNvKxKN9TcXQo1PUndq3ZALJ4H2ovDjqLW4XaMes+bedc4yFmO0dvlt1 N31I98sETaqp5KhzI6dX1DURyOc9eR/odOux6tdoXoTpVqDW6WUlqzTO8otLXLdKDDbMlwdQK3bm SVzpI27t3TmRqu5V6O2XdCDuxQsFpp+HXMsnioYW3OuzSehnqUYnePghoaR8Uar48rXTyqifG9TV eyyv+PYHqxxC4nqjeKC0Z8t+jlqvOc7IZqiOKar79zFeqK5GyPRztv8AhGL1TZQLnaNcXmiuvWnV +1I04vNZWU+LwST3i2T0/c3Ci5I3SI18Tl23c1juVyOViq1U5t2u25uHzil0+4ktJ7lrFg1nyGhs 1rq6qimgu1PBFVOfBEyV6tbFLIxUVsjUTd6Lui7oniUS4VYm5zxdcXmXaXsStwqvsN5pI56JOamq q+edFhdGrfRfzrHVuaqeKO3TopmOzK1c07wzgV1JjyTLLZQ1Viut2q6qkmqWMnWOWhgSFWRqvM7v HtcxiIiq57Vam69ALS4Jx66QahcOWX8TtkxrMosWwqukt9wo6mjpW3CSRjKd7nRMbUOjc3aqj99I 1fRd06Jvo9y7Vnhst+MWrMIcc1FuFrr2RrW1NFYY5YbPJIvowVc3fJE2VU5Xckb5F2c31rsVF4Xf /dE6/f3yVv8ARbUSnpBqLorRdkBfrJW36xxVcWNX221dBLPGlQt5mnnWmRY1XmV7nvp5GLsvo8qp 0b0D0UwTOcV1Mw60Z9hF4iulivtKysoauJFRJI3fGioitci7orVRFaqKioioqFKe1Tz/ACe62fTX hRwaudS3XWLIIaKtlb+9o2TQxsjft1Rj5po3KqfvYHovRV33zsq7fe7fwTYWl4ZLGyoqrpUUTJEV FSmdWyq1URfUrudyfGjkX1kR8ZO1L2mHDJWXHpQyxwwQq7onlHlcyIiL8fM+Hp+D4wN31d0x1S0v 114WNPdBmZ3QaZ2B8lBkMFjkrEtvk8D4HNfce5+xKsm8iq6b36q/x6mU4L7jq9hNfxDZRxF37NqT HbPldVNZ6vL56zyaC007ql7pqRaldkp+RWLzReiqNb47IXJIV4zdU5NFuGPPNSIcWt2RS2yhhijt tyg7+kmfUVMVO1Zo/wB/G1Zke5vTdGqm6b7gRBF2q3DY+anuE+N6l02JVVetuizGfGVbZXzIq7ok veLKqoiKqt7vmREX0ScNeOKHR7h005pNTtQsge+1XR0cdqitrEqai5OeznakDUVGuTk9LnVzWIm2 7uqb+Wev931SvvANjucZpxK4zUWnMq2Got2m1iw610UFO5tQ971bNA1sze65XPkXlROd3I5VV27t j4trhQN0y4DssyOojq8Mt1ltUd4k37yGNzIbU6oZLtunMsccibL19B6epQOz2h/FHp7xGYzpImL2 bKceudtydKqe0ZPaloKxaWZjEiqGN5nMlicrHIjmPdsqddt039AOI/jS0a4YrtZMYzZt/vWS5CiS UFhx2gbWV8kSvVjZFY57Go1z0VrUV3M5Wu5UXlXamHa9Zzpvk920Qt2O3+0Xe9w3Wore8oKmOdYq GV1OjVc5irs2RzUVvXr3blTwUy2otztGHdsvi981KrKegtNbYI22Sqr3oyBj326eGPZzvRTeoSZi f27k9YGAv+seH649qtoVmWGtudPFFji0FdQXWifR11vq2JdnPp6iF/VkiNex23VFa9qoqoqKeqJ5 ganZPhGUdsjphPhdwoa51DamUV3no5GyMdXNpK9yor29HObC+Bq9V25eVeqbJYRunnaWJrkl7drt psulvss8rWz+Rt8v8weWc3k3N5u/dvJvQ373337/APfAblrnx2aI6EZxDpfcabKMuzOSJs0mP4la vOFZAxzedqyIr2Maqt9Ll5ldy7OVERUVc9w6cX2jHE8l1otPLjcqO+WJf9k7DeaPyS4Ujebl5nR7 ua5qO9FVY53KuyO2VU3pvwg3ey4H2lXEZbdVbjSWvI7xVV0tjluUrYlmon1qTMjic9U35qd1M5Go u6sjX1NU5dH6625z2wmd5ZpTUwV2O0FgfHfa+3uR1LLIlFTQvTnb6Ll8pRiL8bonr12VQJqi7U3h uksd/uvmTO/LbBc5bW6zR2mCavq1iRVlniZFO5iQM6c0kj2IiuanipkMu4nNK+Kbgd1pzjS2vrXQ UWHX2jrqG4QJBV0c3m+VyNkYjnN2VqoqOa5zV6pvujkSDeyFs1sXL+IS/Oo4nV/sjp6NJ3NRXth7 2serEXxRFdsqp6+Vu/ghFnCnSU9s0f4/7RQQtgoqK3XCKngYmzI2NhvDURqeCJs1qfiQCV+EDimw bhP7PjTbNdRMaym5We7X+7WtKix0sE6Usy1lQ9vfJLNGqI5rH7K3m94qdOm9xeIbig0z4a9K6bV/ N/OdyslfV01HRR2aOKaerfOxz2LGkkkbFTu2Peqq5PRau2/gVA4WNFIeIPsnF0uSFj7hcG3motLn bJyXCC4TS0y7/vUWRjWuX+C9yesgLTXNbjxr3HhW4XrwyaaDT5tZW5rDI1eVaegl7unZLv1Ry01O 2Lr15qrqBci9V2uuZ8e+kGW49DqdadJ73p4643ege6qjtVLXS09w5Iq1kT3UrapveUvRXKqOazZV 2apFmjGgGsuv/Z66iYDxIR5xV50t/uF1xyTM3Vj7hTTU1JT+S90tX9kbC97ZmdPRVJpduqqekngf jnNY1XvcjWtTdVVdkRAKqdmdrpdddOFayVmR1j6u+YlVS4xX1Ejt3z9wyN0Ejt+quWCWFFcvVzmu X1lrDzr7GFrpNNNU66kaqWyfMESl6dN0p2quy/3Lo/8AIeigAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADHZFj1ky6wXHFsltkFxtN3pZaKuo5280c8EjVa9jk +JWqqGRAFReFHIL1oBqXd+B7US5TVUFrhkvWmd1nav8AslYHOc51G56++mpV3bt4qxHKiI1jd7dE DcX2hF51hwOgyTTqqS3am6e1qZDhlxR3KrauPZX0r19cU7W925q+iq8iu3RFRdn4atd7NxFaSWrU S3UrrfcFV1BfbVIjmy2u6Q7NqaV7Xekitcu6boiqxzFVE32AlIAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAABVXsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUAAAAAAAAAAAAA AAAABAvFzxhab8I+DpfspetzyG5seyx2CnkRJ62VE9+5V/c4Gqqc8iou2+zUc5Uask6OXrKMl0mw 7Js2WDz/AHmx0VyubKePu4oqmeFsskbG7qqMY56sbuqrs1N1Vd1A3EA07UPWLSnSWh846m6i47jE Kt52ec7jFA+VP/hscvM9fmaiqBuIKI6qdsRww4V31HgFBkWfVrFVGPo6XyGiVU9SzVG0nj62xORf 4t4Ldx1do7xO703DboQuOWmp6Q3Omti1KojvBFr63lpPD1oxq+K/gD1ar6+htdHLcLnWwUlLTtV8 s88iRxxt+NznKiInzqVu1U7R3hA0n76muOrNFkNwhVU8hxpi3J7lTxTvY/sDVRemzpG9fxlPaDsw +MPX6sivXFTxIPpoXPSTyFa2e8zQ/wBq2JXR00P/AGbnInjsvgtkdKuye4RtOe5q7/jl1zq4RbL3 2QVyrCjvXtTwJHGqfM9H/j8QIBy3tiNQM9ub8W4X+HC4Xa4S7pBLc2zV9S/foi+RUabov/bOT5vj wqaQdrjxU7uz7Op9OMfq/Gmnr2Whndeti09E11Q/8E/iviu3h6j4lhGGYDamWPBsSs2O25m3LSWq hipIU28PQjaif5DNgecWl/YtaU2qVl01l1RyHLq1zu9lprbG23Uz3qu6o97lklenj6SOYq+PTwLi aV8J/DjookMmmuj2OWqrg25K99L5TXJt/wDpM6vm/wDqJZAAAAebOuuJUUHEhk2Ua29mzcdQ6NZU ksGSYMysrVuaNdtG+4U8ciQq5WcjXd4zdqsVNpGqikgdnXw5akYlVaw6waz4UmJ1Grt1WopsaV6N lo6N0tTK9HozZY0Varka30XIkSqqJuheYAaBoroNpPw74rVYTo7insfstZcJLpPTeXVNXz1T4443 P56iSR6bshjTZF29HfbdVVdW1f4NOGPXi/JlOqmkdrvF55WsfXxT1FFUTNamzUlkppI3S7IiInOq 7IiJ4E0ADU9MtJ9N9GsYjw3S7Dbbjdnjesvk1FFy95IqIiySOXd0j1RETmequ2RE36IRvbuBzhOt OortVrfolYocldUurEqOedYI51XfvWUqyLTsejl5kc2NFReqbL1J0AFSdfOGDB9JOCLVbSfhx02u MLL7Tur2Wa3y1tzqKqte6nY50bZXyyqqxwMTlb09DfbxU0/hd4EdCs/4btMLrxAaCImbWq2ywVbb lHWW2sTlq5ljbUxMfGsmzFbskrXejyp4bF5gB1LRaLVYLVR2Ox26mt9ut8DKakpKaJsUMELGo1kb GNREa1ERERETZEQp12mehOe6gYThetOjtlrLrnmk19iu1BRUVO+eoqad8kTnpHExFdI9ksNPIjU6 8rZNuq7LdAAa5pxl0+e4HYcyq8bu+PVN3oYqqotN2o5KWsoZnN+yQSxSNa5HNdzN3VNlREVN0VFM hkuNY/mWP3DFcqs9JdbPdad9LW0VXEkkM8Tk2cxzV6KimTAEC4jwJcJGC2y/2jGtEbLBTZPRvt9z 8onqaqSWmeqOdGySaR74mq5rV+xq3q1q+LU2ylFwccM9BpJNoVDpPbn4PPXOubrXUVNTOratyI1Z 2TySOmZJypy8zXoqJuidFVCZgBXZOz24OW4zR4jDolQQ22guDbrEkNyro53VLWq1r5Khs6TSo1FX Zr3uam67Im6m961cM2hXETBb4NZNOqDI1tSuWjnfNNT1ECO2VzWzQPZJyKqIqt5uVVRF2JOAEK4/ wZcMuKZlief4xpRQ2q+4PSLQ2Kpo6yqhbSwq6Zyo6JsqRzOV1TMqvla9yq/qq7JtNQAETaz8KPDz xCVVNcNX9LrZf66kj7mGt7yalqkjRVVI1np3skcxFVVRquVEVV2TqpndItCdItBrHNjmkWBWzGqK peklQlK1zpahyJs1ZZpFdJIqIq7c7l23XbxN8AEc6QcPGj2g02Q1GlGIeY5Mqq2113XzhVVPlM7V eqP+zyP5P3R/RnKnXw6IYjGOE3h+wy2ahWbG8A8jo9VWSR5dH51rZPOTZEmR6bvmVYd0qZ/3JWe/ 6eDdpdAEDZQmP8E+hdFadCNBMpyy10FwdBS4zjjqmvqo1qFllkmV0iyy933nvlXfbnTZNuhCXZyc NeeYdkmpHE1rHhTMUyzUu5VElBY1jSN9soJah1RK1zPGPnlViIx2zkbA1VT0tkvMABCnGRnOb4Jw 8ZbVaaYTkeU5Xd6N9mtFFYrXPXTxT1DXMWocyFrlayJivk5nJy8zWt8XITWAK68AnD9XcN/DPjuF X+n7jIro+S/X2L1xVlQjfsS/20cTIYneKK6Nyp0UsUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACm2qrXcGfEdDxC29O40n1Yq4LRqFFzr3NmvCqqUt3Rq dGsf7yVfDdXOXdzmolyTX9QMDxjU/Cb3p7mltZX2TIKKShrYHdFdG9Nt2r+9c1dnNcnVrkRU6oBn mPZKxskb2vY9Ec1zV3RUXwVFPoqpwc57k+CX2/cGWr90dU5dpzE2fG7lO/0sgxlzlSlqG/G+FOWJ 6J4bNTqrXKWrAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/LX 6YrS1RVXsuPgJ6Zflr9MVpaoAAAAAAAAAAAAAAFY+NXjlwHhIxVaZq019z+5Q89ox9JduVqqqJU1 Kt6xwIrV2To56pyt29JzJn1kqtWKTTm8yaIWmyXDM3Qqy2R3mqdBSxvXp3jla13OrfFGLyo5URFc 1Dw71u4HuP2vyu757qZpZkeW3e6TLU1dzt1TBdJKh3REVsdO9z2oiIjWsRjUa1ERGoiIBBGd6oZT rfqjLqBrFlFXX1l5rY1uNZy8y09NzoishjTo1jGbo2NuyIibIemub9sxQ1lTHifDhoFdr3Vu2gop Lw/lVeVNkRlHS873p8Sd61dvV8XlflWBZzgtUtDm+GX3HqlHciw3W3TUj+bx25ZWtXc9aOyh4sNL cnx6DQS8YljWKZ5b6dUpK630FPRNyOBnVVd3bWq6qY1N3Iu6va1Xp1R6IEf+R9sHxVt+zz1Ol2P1 aeDnNx5kaO+NGo64Km3qXmT+PruOnfYuWOrrvZDxAa4XrIq+of3tTT2WJIed/wDb1VR3j5EX1r3b F29aeJ6ZACCtKuB3hV0a7mfDNGLC6vh2VtxukS3GrR38JslQr1jX+45U+YnRrWtajWtRERNkRE6I h+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACuPGRo7luS2Wx666NMWPVTSmd92sjYmpv dqNU/qu2S+tzJYublb/C6JtzqpKWhuseJ6+6WWDVXDZV8gvdMkklO96Olo6hvozU0u3g+N6Oavx7 bp0VFN8Ka1LV4KuKDzgxrqfRfXe5oyp2RrKXG8seiI16r4MhqmtXf1I5FXo2NEULlAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpao AAAAAAAAAAAAAAAADhrKKjuFNJRXCkhqaeZvLJDNGj2PT4lavRUIqyHhK4aMmucF9uGiWJ012pqh tXDc7ZQNt1bHO1d2yJUUvdyo9FRFR3Nuioip1JbAH4iI1Eam/RNuq7n6AAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAA0nWfSPEdddMb/pXnFG2e1X6kdA5/KivppU6xTx7+Ekb0a9q/G3r um6G7ACtXBpq1l1xoL/w56z1O+p+k8jLdXTvarUvVrXpRXOPfq9Hx8qPXx5tldsr9ksqVa4ydOcp xm4WHjA0ctyT51phG/ztQRtVXZDjjlVauicie+cxqvljVUXZUdsiu5drAaa6iYpq1gVi1Jwi4eW2 PIaNlbRyqnK7ld4se3969rkc1zfU5rk9QGygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAPxUVUVEVU3TxT1FI7f2leNaX6xX7QDitx1+IXyxVy00GSW6KSa1XCnds6CofF6U1Okkbo3bJ 3rUVV5nN2Lunmr2yfDd7JcJs/EjjVBzXHFuS05B3beslulk+wTL/APKmerV+afr0YBpXDP2j+j3D JwX6fadU1rueY6hU7bojrFQsWGKnfLdKuSJJ6hzVRvMx7HI2NsjvSTdE33PTbS+rz246f2K56n0d BRZTXUjKq50VAxzYKOWT0/J28znK5Y0VGK5V9JzXORERURPFTsquG726+ISHPL/Qd9i+m/dXao52 7snuKqvkcPz7Pa6ZfmhRF98e6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0jUTUS4YVcLLa7XjH nqqvXlPdx+WtpuTuWscvVzVRd0cvrT3vr3N3Io1c/r/wH8q/6iMq42uu3ZzonKc6Yz8aojrQYmqq i3M0zlOr5we25n/3If5/g/UHtuZ/9yH+f4P1DkBT/jfizwp/Sp85d7c/DycftuZ/9yH+f4P1B7bm f/ch/n+D9Q5AP434s8Kf0nOXe3Pw8nH7bmf/AHIf5/g/UHtuZ/8Ach/n+D9Q5AP434s8Kf0nOXe3 Pw8nH7bmf/ch/n+D9Qe25n/3If5/g/UOQD+N+LPCn9Jzl3tz8PJx+25n/wByH+f4P1B7bmf/AHIf 5/g/UOQD+N+LPCn9Jzl3tz8PJx+25n/3If5/g/UHtuZ/9yH+f4P1DkA/jfizwp/Sc5d7c/Dycftu Z/8Ach/n+D9Qe25n/wByH+f4P1DkA/jfizwp/Sc5d7c/DycftuZ/9yH+f4P1B7bmf/ch/n+D9Q5A P434s8Kf0nOXe3Pw8nH7bmf/AHIf5/g/UHtuZ/8Ach/n+D9Q5AP434s8Kf0nOXe3Pw8nH7bmf/ch /n+D9Qe25n/3If5/g/UOQD+N+LPCn9Jzl3tz8PJx+25n/wByH+f4P1B7bmf/AHIf5/g/UOQD+N+L PCn9Jzl3tz8PJx+25n/3If5/g/UHtuZ/9yH+f4P1DkA/jfizwp/Sc5d7c/DycftuZ8vRdIf5/g/U Kn6a6hZZwc65Vul8mny0+mmrl0kuGH0Ul3Z3VlvTkRaigbLyqxscyqjo2Kjdl2Ru686ls3ORjVeq Ls1N12RVX+JOqlLeKnir4NNQsAyDSTL9RLnBeInd7SrTWC4R1dqucPpQTIr4Wcr2P6KnMi7K5q7b qSW4vTOu5M+6nj6re3XdmfWmfdHktTnXFFc9OKaz1OV6aNpPP96ocftzPP0KuqK2rlSOKNqIz51c q+CNY5fUbN7bmf8A3If5/g/UPDfVPjG1B1rzbS+8ZjUQxQ6evolVYHr3dbWRTtdLXuRzU2fI2OP0 VTZvKuyJzKh7mCu3foiM7s8Kf0s3OetxGdc/DycftuZ/9yH+f4P1B7bmf/ch/n+D9Q5AR/xvxZ4U /pR85d7c/DycftuZ/wDch/n+D9Qe25n/ANyH+f4P1DkA/jfizwp/Sc5d7c/DyblgGW+zrEaDKfN/ kXlve/YO973k5JXs99s3ffk38E8TYSPdAP7Edh/71/SZSQi9ha6rliiurbMRM8F6zVNdumqdsxAA CwlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACLOJvPdItP9Fcnrtbp2Oxe50M1qnoWpz1FydOxzEp adni+Z+68qJ4bcyqiNVUzGtWtWA6BYDXai6i3XyS30m0cEEac9TXVLt+7pqePxkleqbIieHVVVGo qpBWiuiufa2Z9Q8U3FLavJLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5GtiDUuy3rdPMK0n uGhbbHdcW1LstdNdcnsl9g7i4Ttncnk9U1qonPD3HcM3RPRcnVE5kV13SCuJXhq9t7zXqLp1fvYf q1h+82NZLC3x8VWjq0RF72lk3VHNVF5eZVRFRXNe4auJX23vOmnWoth9h+rWH7Q5LjUzvHwRKykV VXvaWTdFa5FXl5kRVVFa54TqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARRq5/X/gP5V/1EZK5FGr n9f+A/lX/URlPH+x99P/AGhWxfsp8Y+cOQAECmAAAAAAAAAAAAAAAAAAAAAAAAAAAAABC3ELwi6M cSVvd7N8fSlvscfJS3+3o2Kuh2T0Uc7baVifwJEcibrtyr1JpBmJmJzhmJmmc4eH3EtwF6zcOz6m ++RrlWHRbubfLbC77Az/APSoeroNvW7d0fVPT3XZPZ/Ti+rlGnmL5K56vW7Wairlcqqqu72Bj9+u 6/vvWbC5rXtVj2o5rk2VFTdFT4jioqKitlFT263UkNLSUsTIIIII0jjijaiI1jGp0a1ERERE6IiG 9dya4jNvXcm5EZuYAEaMAAGR0A/sR2H/AL1/SZSQiPdAP7Edh/71/SZSQizgf5W3+WPlC/h/Y0eE fIABaTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAaJrVrVgOgWA12ouot18kt9JtHBBGnPU11S7fu6an j8ZJXqmyInh1VVRqKqNatasB0CwGu1F1FuvklvpNo4II056muqXb93TU8fjJK9U2RE8OqqqNRVSC tFdFc+1sz6h4puKW1eSXCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbEDRXRXPtbM+oeKbi ltXklwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxWwAAEFcSvDV7b3mvUXTq/ew/VrD95s ayWFvj4qtHVoiL3tLJuqOaqLy8yqiKiua+dQBBXDVxK+2950061FsPsP1aw/aHJcamd4+CJWUiqq 97SyborXIq8vMiKqorXPnUgriV4avbe816i6dX72H6tYfvNjWSwt8fFVo6tERe9pZN1RzVReXmVU RUVzXuGriV9t7zpp1qLYfYfq1h+0OS41M7x8ESspFVV72lk3RWuRV5eZEVVRWueE6gAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAABFGrn9f+A/lX/URkrkUauf1/4D+Vf9RGU8f7H30/8AaFbF+ynxj5w5AAQK YAV47QHLsgwvhKzu741VzUlZPFSW91RE5WuihqKuKGXZU6pvG9zN/wC2M0xpTkzTGlMQl6z6q6X5 FfpcVx/UjFrneoVcktto7xTzVTFb77miY9Xpt6906HdyzOsIwKijuWc5jY8dpJXckc92uMNJG93x I6VzUVfmIpunB3oFcsNxzHrPi1Njc2MTUdbar9YIoKS5xTQKitk8p5HOfzqm7+bm5lXfx2VI60/x nHtXeN/Wy4ak2Wivnte2+wWnHKK5QNqIaOCqpnzTyxxvRWo9z2786JvtIqb7KbRTE620U0zrWhsu W4pklk9kuO5NabpaOVzvOFFWxz03K1N3L3rHK3ZE8evQwM+tmjNNHa5qnVvC4o74xJbW99/pGpXM 5lbzQKsn2VOZFTdu/VFQrTZLNatMuMzVLTzA7fBasZyXSz2UV1roo0ipYblHP5OkjYm7NYro3OVd kTdXbqaZo9pRp/V9mDe8gueLW2vu1bht/u0lfVUzJahKimSqWmVsjkVzUiSGJGoioicvTxXfOhDb QjauxctTdNrLklPht41Bxqhv9WrEp7VU3anirJld71GQuej3b+rZOp3LtmeH2G5w2W+ZXZrdcKmm mrIaSrr4oZpaeFN5ZWsc5HOYxOrnImzU8VQpBqHplhNP2YsGTyY/RT3+bFbRkT7xNC19etfLJTyO mWoXeTm9NWIvN0Zs33qbG16o2C26i8V3DVR5fTsuVJV4tdq+tpp05oqt7KWOVqStXo9vetY9Wrui q1N0UaEfNjQj5/BaK06s6V36y3DJLHqXilxtNp28vr6S8001NSb+HeyNerY/+sqHPbM8xXL8Xrsj 0+zLG73TU8UqMr6W4x1NFHM1m+0skTlRGp0V3XdEKs3DSnAZu0epbS3F7dFa5NMWZHU22OmY2kqr hHcZaaOeWFE5JHMY5OVXIuzmtVOqIpzYbabXiXFHxK43jNvp7ZaqzDrVcpKKkibFB5StJIjpEY1E ajnczlVUTqqqq9VGjBoR1N8yjirtukmiOKZ3qVk2nt9yXIauCljixm+pHbK1r6xsM1TSyy873wwR PR8jtlRHN5VVvMipO+P5Hj2W2emyLFb7brzaqxqupq631TKinmRHK1VZJGqtciORUXZfFFT1HnRc 7Va63s9NAKqsttLPMzMLXA2SWFrnNjkuFRzsRVTdGu5U3TwXZN/A9H7dbbdZ6KK22i301DSQIqRU 9NE2KNiKqqqNa1EROqqvT4xXEQxXERHF2TUsk1d0ow26ssWX6n4lY7lIiKyjuV6pqadyL4Kkcj0c u/4DbSkMel+a6GZVqFV5vwsWzWvGsvyKtv3sit6UlXeYqadUVKSWjqW88vIiKjUjdy9V29901piJ Yppidq6y3G3toPOrq6nSiSHyjylZW913W3Nz8++3Lt133226mv4tqnphnNdPbMJ1HxfIKymRXT09 qvFPVyxIi7KrmxvcrU3+NCjWtuT4FeOHDRPAuH2zXm6YDlmeQWurx6e4upqupayZ75LRLLUP+w80 y7bOdyt5Wq1eXbfYdTNPdZ8lq8MvulnA/Fp5k2HX2juFHeLfkdii/qNi8s9LI2CVqyRPYqorV3Tp ttsqou+hHW3i3HXK6GWZ3hGBUcVxznMrHjtLM/u457tcYaSN7v4LXSuair8yCbOsIp8WdnU+Y2OP G2Rd868PuEKULY9+XnWdXd2jd1RN+bbfoVlwLGcb1h42db6jU2w2+/twC34/aMdobpTsqYaOnqqZ 808jI5EVqOc9qLzom+z1TfZT44kdDsF0Y4V9dHYB5ZRW/J4GXSWzd6zyC3z95G1y0sLWp3LX9Fc3 dU9Fu2yJsY0YziGNCM4hZ+0ZvhmQXessFhy6y3K526OOasoqOvimnpo5E3jdJGxyuYjk6oqom/qM bbtXNKLvkTsQtOp2J1t+a9Y1tdPeqaSrRyeLVha9X7p8WxVXXazW/Qvs+rpkGm9rp7ZkF3x+z091 vdNC1ldVurJoG1M006Ij3vf30vVV6LJ022RDWs30gzjI9EG6ZYVwCJj9xoaKFbFkNNlVhbWUdbFy ujq++ZKkrnK5qK9ebd3Mu6mYoiSKInXmstqhxTaZaU6sYbpXkmR49SzZItc651lbfIKVtiigpe+h fUNf73v3K2ONHuZvuqtV22xMUUsVREyeCVkkcjUex7HIrXNVN0VFTxRUKZZtjtTeOKLhSTU/Fra7 I7ljN9XJaeeCCdJK6O0RrIyRzeZknJLz8qormptu1di57GMjY2ONiNa1ERrUTZERPUhrVEREZMVR ERGT9BDvEJfbHZVsHnnifbpB33lXd7yW1vnTbut/9uxv/ct095t+7elv6O2raMZTjF0z2ko7ZxwN 1KqHQzK3Hklsru/RGKqv2pYWy+h77ou3Tr0MaOrNjRzjNPGTZPj2GWCuynK7zSWq0WyFZ6usqpEj ihjT1uVfn2RE8VVUROqmgaTcUGguuV1q7FpbqPQXu40MazTUncT003doqIr2snYxXtRVRFc1FRN0 3XqhBvanVtXBw22y3RTSR0d2y+20dw5V2Rafu55PS+bvIo1/CiGK19sdmwTjj4a6nB7PR2ueqhuF qqI6KFsSOomRoxrHI1E3a1ksu2/ht8xtTRExn4tqaImM/H4LsgAjRgAAyOgH9iOw/wDev6TKSEU9 xLWbixxTHqSwaacF/s7xul7zyLIPbFttr8s5nufJ/UszFkj5JHPj9JfS7vmTo5DMe6H47P8Ai6v/ AFds/wCzLOB/lbf5Y+UL+H9jR4R8lqgVV90Px2f8XV/6u2f9mPdD8dn/ABdX/q7Z/wBmWky1QKq+ 6H47P+Lq/wDV2z/sx7ofjs/4ur/1ds/7MC1QKq+6H47P+Lq/9XbP+zHuh+Oz/i6v/V2z/swLVAqr 7ofjs/4ur/1ds/7Me6H47P8Ai6v/AFds/wCzAtUCqvuh+Oz/AIur/wBXbP8Asx7ofjs/4ur/ANXb P+zAtUCqvuh+Oz/i6v8A1ds/7Me6H47P+Lq/9XbP+zAtUCqvuh+Oz/i6v/V2z/sx7ofjs/4ur/1d s/7MC1QKq+6H47P+Lq/9XbP+zHuh+Oz/AIur/wBXbP8AswLVAqr7ofjs/wCLq/8AV2z/ALMe6H47 P+Lq/wDV2z/swLVAqr7ofjs/4ur/ANXbP+zHuh+Oz/i6v/V2z/swLMZLXXi2Y9crlj9mbd7nSUks 9Jb3VCQJVytaqth7xUVGK9URvMqKib7qhCXD5xxcP3Ea9tnxXKVs2VNVY6jGL61KO5RyN6OYxjl5 ZtlRd+7c5U29JG+Bqnuh+Oz/AIur/wBXbP8Aszx1400vtJxO5fdL5pczTO/V9VDdLhj1PkNPd/Iq yaNkr5EqKZGtRZHO77l8WrIvq22D+jQ0TWrWrAdAsBrtRdRbr5Jb6TaOCCNOeprql2/d01PH4ySv VNkRPDqqqjUVU8qOArjV457pfqXT7H8KuetGP0zmRTpcZFint0fqVbo/0WJt4JOr99tm7FqOHPbi R4mMszXiZXyDUPTKudT4zpnV9abHqNeVW3Nir6NbLIqt/qhqcrdmuTZFi5Q3rRXRXPtbM+oeKbil tXklwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxTRhuu+IZxrJqBofabdeIr7pvHbJbrUV EMTaSZK6Dv4u4c2RXuVGrs7mYzZfDmTqSQeX+perGtemnF5xZ0nD9pxdcmy+7WnGpY62mp2yQWWl p7Qx01U9HKiSTbPRIYeqvfv0dyqxwXtl4i8Jn1zj4fcctV8yPJKej8vvdRaoIZKHH4V/c/Lpnys7 t8n72NjXvVNlVqIqKaFmvHBi+Kau5XovY9DNYM3vuFpROu0uKWCmrqaJKqnZPCvMtSx6IrX7ekxP Sa5E3RN1yfBHjejFr0Gs+SaM3qbIKfKd7resgr15rldLo9f6okrV3VUma/marFVUZtsir750fcPX /vC+Kz/kmG/otAJJ0s4ydJNTs2ZphWW/K8EzeaJ09Njea2WS011VGiKquhRyrHL0RV2a9XbIqoio iqnFrZxgYpopqdaNIZdLNSs2yW9Wd18p6XELPBXuSmbK+Nyua+eN+6LGqrs1URFTr6iNe1Nttvt/ DOmq9H3dLlunuQ2m743cGJtPT1S1kUbmscnXlVrlcrd9lWNqr1am2ncQup66WdonpzmdTp9meVO9 q+qhfasTtDrncEdJVzbuSFrkVWN29J2/ToBNmK8YtTlOT2jGXcJfERZku1dBQrcbrhsMFFR97IjO +qJEqXKyJnNzPciLs1FXZfAynErw1e295r1F06v3sP1aw/ebGslhb4+KrR1aIi97Sybqjmqi8vMq oiormv6GFcYtPmmWWrE28MXEJY1utUylS43rApaSgpeZdu8nmWRUjjT1u26FhAIK4auJX23vOmnW oth9h+rWH7Q5LjUzvHwRKykVVXvaWTdFa5FXl5kRVVFa586lUePvEtPrFglPxDyZt7AdSMFXfFMh pI+eprah2/La3wp1qopl5m92qLy8zne97xHTjoTluoOd6R4xluqeE+xLKbnQMnuNo7zm7iRfBdl6 s5k2f3bt3M5uVyqrVA30AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8veyJjpJHt Y1qbq5y7IifOpqd61c0ux5XNvOoWP00jfGJ1wiWT/ERVd/kNaqqafWnJJbs3L05W6Zme6M23AiKr 4rNEYZFgoMmqrpM3xjoLZUyr/HyI1f4zoycUlim6WfS/UO4b+EjLKjI1/wCs56f5iKcTZj70L9PI 2Pq/8NUeMZfPJNYINdxHZXN/ufoRksieryirgg/z7nGuv+qr/wDa/DzUOT/4mT0zP/2DXpdrf8J8 kkchY6fux766I+dSdgQP7fesPr4dunzZbS/sz7bxA6nM/wBtcPla1P8A4WRU0n/7CDpdrfPCfI9B Y7s0/wB9H6k6gg5nEnfIOtz0Ny+NE8fJlhqP8ypudmPipw2P/dnB88tG3i6ssbkan42Od0MxirPa azyJj42W8/CYn5TKaARVbeKLQu5P7lM7hpJfB0dbST06tX51exG/5Td7Jn2DZJypj2ZWS5Od4Npa +KV34NmuVdySm7br9WqJ96pewOKw+u7bqp8YmGeABIqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAEUauf1/wCA/lX/AFEZK5FGrn9f+A/lX/URlPH+x99P/aFbF+ynxj5w5AAQKYa3qPp9jOqu DXrTvMqN1TZr9SupKpjHcr0Rdla9jvU9rka5q9dnNRTZAZ2GxWCTg7zjJ7TZtPdVuI+9ZfpxZJ6a VmOvsVNST1sdOqLBDV1rHK+djeVu6crVdtuq8yIqbnqDw63i6anv1n0j1QqcAy6ut7LVd5PNUVzo bpTxrvF31NI5n2RmyIkjXoqNRE8N95sBnTltpyhjTThxbhldmOZZbnldmGd5zSJQ3K/1dHHTMipm MVkcFPTRryxRN3RVbzKrlRFVRhnDn7EeFWo4ZfZj5X3+OXSwee/N/d8vliTp3vk/ervyd/73vOvL 4pv0mcDSk0pQxk3Dn7I+FWHhl9mPk/dY5QWDz35v59/JkiTvfJ+9T33de97zpzeK7de1WaAeV6ta Y6pey3k9rmyVtm8h8g38v8ogbF3ned59i5eXfl5X777bp4kugaUsaUoxk0V7ziVi4h/ZLt3eFew/ zP5H4/1atV5R3/efPycnd/Pzeo6NPoD5Pq/qLqt7LOb2f4/SWLyDyDbyLuYlZ3ved59k35t+Xlbt 8akuAaUmlKuNXwdU9ZwuY3w5rqLUQVuKVMFfbsjgtrUVlXFUvmZItM6RyKid45vL3nz7+olDFMrt uFWClxjU7WnHb7k9CsjbhXzLS2x8znSOcxFpWyKkXKxzG7brvy7r1U340S/aB6F5Vd6nIMn0WwS7 3Stf3lTXV+OUdRUTu2RN3yPjVzl2RE3VfBEGlntZ0s9rKx6n6aTSNii1Dxl73qjWtbdqdVcq+CIn P1UiNvDvrVi9ddqbSnilutgx26Vs9fHbLvjlPe5aF8zldI2nqZpGvRnMq8rXo9G/Ou6rvcHDXw50 s8dTTaA6cQzQvSSOSPFaFrmORd0cipFuiovXckcZ5bDPLYgBeDLTl2hVLom693zvaO6rkdPkiTNS 5RXrvFk8ua5E5Udu5W8u23Iu2+/pHPatAdYbnkNhuOqvE7e8ktOO1sdwp7ZabJDYvK54/eLVzQSO fMzqu8acjHetPUTwBpyacoQ1G4cb3edT36z6Q6rVmnmX19vZarvMlqhudFc6eNfsazU0rmp3jNkR JEcio1ET498AvBvSz6TalYZddSa+65jqsscmQ5dW29ivkfGqd01lLG9jWRRtRyNjR/TnXrtsiWOA 05NOqGk3rSXGct0hdozmUa3OzVFmhs9U5qd06RscbWpK3qvI9HMa9vVeVyJ47ERwcL2ssuO0mnN3 4tckmwijbFTJS0dipqS7yUkapyQOubHq/wAGtRXtja5UTqvVSyQEVTDEVTCFta+Hi7akZRgOfYHq ZU4TlOni1kduuD7ay6slgqoWxTRyxzPbzuVjdkerlX0nKqKuypMVBDVU9BTU9dWeV1MULGTVHdpH 3z0aiOfyp0buu67J0Tc5wYmZnUTMzGTp3GzWe79352tNHW91v3flEDZOTfbfbmRdt9k/iQ4qLG8d ttQlXbrBbqWdqKiSw0sbHoi+PVE3MiAw0HXTRjFNf9M7tphmKzxUVyRj46mnVEmpZ43I6OVm6Km6 KnVF6KiuT1kV6RcH11w3VC26v6s613rU3IcdtrrVjz66gZRxW6BzXNc7la96ySKx7286qm/O5VRV 2VLJAzFUxGTMVTEZQAA1YAABkdAP7Edh/wC9f0mUkIj3QD+xHYf+9f0mUkIs4H+Vt/lj5Qv4f2NH hHyAAWkwAAAAAAAAAAAAAAAAAAAAAAADG5LXXe2Y9crjYLK68XSmpJZKK3tmZCtVOjVWOLvHqjWI 52ycyrsm+6+BQPSbsn7TkGZXHWLi9zJc0ym/V8t1rrNaZJKe3Nnler3Nkm6SytRV2RrO7a1ERvpI ehwAw+JYdieBWGlxbCcbtlhs9E3lp6G3UrKeCNPXsxiIm6+tfFV8SIeJbhp9t7zXqLp1fvYfq1h+ 82NZLC3bfxVaOrREXvaWTdUc1UXl5lVEVFc107ACCeGniW9t/wA6ad6iWH2H6tYftDk2MzO238ES spFVV72lk3RWuRV5eZEVVRWufhtG9JNQsU4yeIHVa/4/5Li2b0+NR2Gv8rgf5Y6koEiqE7tj1kj5 X9PsjW7+Ld06mZ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe9pZN1RzVReXmVURUVzXOGni W9t/zpp3qJYfYfq1h+0OTYzM7bfwRKykVVXvaWTdFa5FXl5kRVVFa54aTS6KapcO3Ec7OuH/ABfz 7pfqTVrJm2KxVtPS+ZLgu3+y1Gk8jGq13++RMXddl2RfsaR6o+w8UWjfGDrZq1gfDLUahY1qHFYI rfVw5ha7XyeRUDIpFVk8iyfuivb1a33m6boqKXXAFObvpNxK8W+b4tPxFYPZtMdMMPukN9XEqa9R 3e432uh37lKmohRIWQNVVVWt6ruqbKqtezd8o0k1CuPHvhmtNHj/AHmGWnT+sslZc/K4E7qtfUyv bF3Sv7127XNXmRit6+JY8ADRNatasB0CwGu1F1FuvklvpNo4II056muqXb93TU8fjJK9U2RE8Oqq qNRVRrVrVgOgWA12ouot18kt9JtHBBGnPU11S7fu6anj8ZJXqmyInh1VVRqKqQVororn2tmfUPFN xS2ryS4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYgaK6K59rZn1DxTcUtq8kuFJvJgeBy Lz02L0ztlbU1DV6SVz0Rqqqp6HTojka2K2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABq Oc6r6facQo/LsnpKOdybx0jVWSpl+LliZu9d+ib7bdeqoRfcNcdUsx3h010/ZZKF/vbtkrlY5zf4 TKZnpeHVFcqou6dCG5iLducpnXudHC8l4rFxp0U5U751Rxnb7s5T497I2Okke1jGIrnOcuyIieKq pG+U8RWkWKzrQTZZDc6/flbRWljq2Zzv4P2PdqL8zlQiqr0zumXPSo1Uz695QqrzLRJL5JQNXx6Q RKifj39RtNjxjHcZg8mx+yUVvZtsvk8LWK7+6VE3d+MrVYq5V6sZeP7+rrWuRcNb13q5qndTqjjO c/4w+KvX3Um/7twPR6opIHe8rckq2023xb07N3r+JxiKn2/Mk63/AFXpLJC731Lj9ta3+KaXeRDb QQzVXV61U/L5OhbtYex7K1THjGlP+WfwiEfy6K4zdHpNl96yTKJN+ZXXa7zSpv8AgarU/EZu2aaa fWdE834ZZ43N8HupGPf/AIzkVf8AKbKDSKKY15LE4m9VGjNU5burg+IYIaeNIqeFkTE8GsajUT8S H2AboAAAAAAAAHXrLbbrizu7hQU9Uzw5ZomvT+JUNXumj+mN438swm1tV3itPF5Oq/jjVqm4A1mm KtsJKL1y36lUx4S0Kn0pksfpYTqJmGPcvvYae6Olp/xxSbov8ZlaXIeI7GdvJsrxvLoGeLLpQLRz q34mugXl3+dxtAERo+rMx4SV3Ive2pirxiJnjt+LoUnErcrNtHqRpNkFnROjqy2qy40qf2znM2cx PxKpIOHaw6ZZ9yMxXM7bWTv22pXSd1Uf+FJyv/yGmmt5Jpvg+W8z79jVHPM7r5Q1ndzIvx94zZ3+ Umpv3aevPx/15KN3kzA3tlM0T3TnHCdf+Sw4KzUOPapYPs7TjU6rmpo/e2nIkWsptv4LZP3SNvzN NmtnEnW4+5tJrBgVfYGoqNdd7fvW29f7ZytTniT5lRy9CenF0T6+r5cfNzL3IV+nXh5i5Hdqq/tn XPuzTmDFY3lWNZhbm3bFr7RXSkd/vtLM2REX4nbdWr8y7KZUsxMTGcONXRVRVNNUZTAADLUAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAIo1c/r/wH8q/6iMlcijVz+v8AwH8q/wCojKeP9j76f+0K2L9lPjHz hyAAgUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGR0A/sR2H/AL1/SZSQiPdAP7Edh/71 /SZSQizgf5W3+WPlC/h/Y0eEfIABaTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQTxLcNPtvea9RdOr 97D9WsP3mxrJYW7b+KrR1aIi97Sybqjmqi8vMqoiormunYAQTw08S3tv+dNO9RLD7D9WsP2hybGZ nbb+CJWUiqq97SyborXIq8vMiKqorXPnYgniW4afbe816i6dX72H6tYfvNjWSwt238VWjq0RF72l k3VHNVF5eZVRFRXNc4aeJb23/Omneolh9h+rWH7Q5NjMztt/BErKRVVe9pZN0VrkVeXmRFVUVrnh OxomtWtWA6BYDXai6i3XyS30m0cEEac9TXVLt+7pqePxkleqbIieHVVVGoqo1q1qwHQLAa7UXUW6 +SW+k2jggjTnqa6pdv3dNTx+Mkr1TZETw6qqo1FVIK0V0Vz7WzPqHim4pbV5JcKTeTA8DkXnpsXp nbK2pqGr0krnojVVVT0OnRHI1sQNFdFc+1sz6h4puKW1eSXCk3kwPA5F56bF6Z2ytqahq9JK56I1 VVU9Dp0RyNbFbAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMXkuUY9h1omv+UXemttvp/fz1 D+Vu6+DU9bnL6mpuq+pCCrxq1qPqsrqPTWmlxPGn9HX6ui3ratm+y+TQr0Y1U8Hu6+tFRU2Ibt+i 1qnbuX8Fybfxv2qNVMbap2R5z3RnKU9QtYsD00Y2HIbqstymT+p7XRM7+tnVfBGxN6pv6ldsnzkU XPMtbdTOZlO9undhk8GxKk92mZ87/ewb/wBrs5PnOTEtO8aw9z6uip5Ku51HWpudbIs1XO5fFXSO 6pv8SbIbMUq7ty7tnKN0eb0eHwWFweuinTq7VUfKnZxznwatjGmeH4pOtfQ21am5SLzS3KtetRVS OXxcsjuqKv8Aa7IbSAaREUxlCzXcruTpVznIADLQAAAAAAAAAAAAAAAAAAAAAAAAPxzWvarHtRzX JsqKm6Kh+gDSLjpRZGXFcgwyvrcRvfilbaJO6a/5pIk9B7fHdNk336qZm163akafqlNqxjaX60s6 eyCxRfZI0/hT03q+dzNkRE6IpngYpztznROXy4NruhiadDE06cd+2PCrb7tcdyScTzTFc6tTL1iN +pLpRv6LJA/dWL/Be1fSY75nIimaKz3fTOnZdVyrArvUYlkTevllAiJFOv8ABnh95I3fx6dfXubN i/EJXY9Ww41rhaobJUSO7qmv1Lu62Vaon75V6wOX4ndPFfRTYtW8VGy5q7+r/Th4rkSqImvBzpxu +9H6vdr7oTkD4hmiqImTwSskikaj2PY5Fa5qpuioqeKKh9lxwQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI y1bx7Lrlf8VvuLY95380eXd/F5XFT7d6yNrer1+Zy9EXw9W5JoIb9mL9GhM5bNndOfXnuR3bcXad GUJ93q39yf8An2mHd6t/cn/n2mJsBW6DP4lX+P6UHQ47U/DyQn3erf3J/wCfaYd3q39yf+faYmwD oM/iVf4/pOhx2p+HkhPu9W/uT/z7TDu9W/uT/wA+0xNgHQZ/Eq/x/SdDjtT8PJCfd6t/cn/n2mHd 6t/cn/n2mJsA6DP4lX+P6Tocdqfh5IT7vVv7k/8APtMO71b+5P8Az7TE2AdBn8Sr/H9J0OO1Pw8k J93q39yf+faYd3q39yf+faYmwDoM/iVf4/pOhx2p+HkhPu9W/uT/AM+0w7vVv7k/8+0xNgHQZ/Eq /wAf0nQ47U/DyQn3erf3J/59ph3erf3J/wCfaYmwDoM/iVf4/pOhx2p+HkhPu9W/uT/z7TDu9W/u T/z7TE2AdBn8Sr/H9J0OO1Pw8kJ93q39yf8An2mHd6t/cn/n2mJsA6DP4lX+P6Tocdqfh5IT7vVv 7k/8+0w7vVv7k/8APtMTYB0GfxKv8f0nQ47U/DyQn3erf3J/59ph3erf3J/59pibAOgz+JV/j+k6 HHan4eSE+71b+5P/AD7TDu9W/uT/AM+0xNgHQZ/Eq/x/SdDjtT8PJCfd6t/cn/n2mHd6t/cn/n2m JsA6DP4lX+P6Tocdqfh5IT7vVv7k/wDPtMO71b+5P/PtMTYB0GfxKv8AH9J0OO1Pw8kJ93q39yf+ faYd3q39yf8An2mJsA6DP4lX+P6Tocdqfh5NN0gx+74tp1abFfaTyWupe/72LvGv5eaeRzfSaqov ouRei+s3IAt2rcWbdNunZERHBZooi3TFMdQACRsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEE8S3 DT7b3mvUXTq/ew/VrD95sayWFu2/iq0dWiIve0sm6o5qovLzKqIqK5rp2AFIuD/FMj4uvY7xr8Ql bQXSZvlEODYtSRvS2WLuJ3081Ysb1XvKp8sD1RzlXkajVRd0Ykd3SqvZcfAT0y/LX6YrS1QAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNtUNbLPgNSzGLNQS5Dl1XHzUlnpF6tT1STv8ACJnr3Xqq eCbbqmr6j60Xi+XSq070ZfFPcoXd1db+5OeltaeCtZ6pJvHZPBFTrv15cVh2C2bDYJX0qy1dyrF7 yvuVU7vKmrkXqrnvXrtv4J4J+HdSlexMz9m1x8nosDyRTTEXsZG3ZT1z3zuj4z3RrYmlwe9ZbeI8 y1fujL5dWbPpbaxFS3W35o41XZ7vje7ff59kU3nwKpcP997QLiK0isOsmI3nQq32nIPKvJ6a5Ud1 bUM7iqlp3c6Rue3q6Fyps5eip4L0JD9rDtJvlZw7/Rbz9RpGGrhPXyzYryjZEbIiMojwhNQIV9rD tJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1Gej1tPSuH7+CagQr7WHaTfKzh3+i3n6h7WHaTfKzh3+i3 n6h0es9K4fv4JqBCvtYdpN8rOHf6LefqHtYdpN8rOHf6LefqHR6z0rh+/gmoEK+1h2k3ys4d/ot5 +oe1h2k3ys4d/ot5+odHrPSuH7+CagQr7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6h0es9K4fv4JqB CvtYdpN8rOHf6LefqHtYdpN8rOHf6LefqHR6z0rh+/gmoEK+1h2k3ys4d/ot5+oe1h2k3ys4d/ot 5+odHrPSuH7+CagQr7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6h0es9K4fv4JqBCvtYdpN8rOHf6Le fqHtYdpN8rOHf6LefqHR6z0rh+/gmoEK+1h2k3ys4d/ot5+oe1h2k3ys4d/ot5+odHrPSuH7+Cag Qr7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6h0es9K4fv4JqBCvtYdpN8rOHf6LefqHtYdpN8rOHf6L efqHR6z0rh+/gmoEK+1h2k3ys4d/ot5+oe1h2k3ys4d/ot5+odHrPSuH7+CagQr7WHaTfKzh3+i3 n6h7WHaTfKzh3+i3n6h0es9K4fv4JqOvcbdQXaimttzo4aqlqG8ksMzEcx6fEqKQ77WHaTfKzh3+ i3n6h7WHaTfKzh3+i3n6h0etmOVsPE5xM8G4Wlme6KTurNPlnyHFXSc9TjVTKrpaZvrdRyO3VPj7 td9/nVd0nXT7UjEtTbL57xS4LMyN3d1NPK3u6ilk9bJY16tXovzLt0VUKZOzHi40s4gdK9Ldca7S u4WjUjz5ySYvS16Tw+b6Lv15nVDka3mfJFts126I/wAOikv5Hg9wgvCZ3pzcksWVw9XStT+p7g1P GKpYnRyLttzbbp+JNtaaq8LOW2N3l5JblvDctUTc9WvZpb/zR/7Rr35rLAjfSrWW3Z++bHL3QusW XW5m9faJ3dVT/hYHf75EvRd06pum/qVZIL9FdNyNKnY81iMNdwtybV6Mpj96t8d4ADZAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAKq9lx8BPTL8tfpitLVFVey4+Anpl+Wv0xWlqgAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAABXzUrU696lXmr0y0tuL6S10jlhyDI4V95/CpaZ3revg56eHq+ft6xagXrML7Po 7p1cXUvdNT2TXmFd/Ionf/lol/4Z6bov8FN08d+X7x3HbPilnprDYqNtNR0reVjE8VX1ucvrcq9V VfEoX701zoUbOufp5vUcmcn04amMTfjOqddMT1f1T9I989T5xrGrLiNngsVgomU1JTp0ani53rc5 fFzl9aqZQAgiMtUOjVVNczVVOco47Lj4CemX5a/TFaWqKq9lx8BPTL8tfpitLVHWeGAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU84t/hk8KP+HX6KgJgIf4t/hk8KP8Ah1+ioCYClifXjwej 5I9hPj9Iatm+DQ5U2lulurpbTkNqd31sutP0lp5E9S/wmL62r8am76O6xT5bPNg2c0sdqzW1s3np 0XaKviTwqadfW1fFW+r/ADdE1bOcIZlUFNcLbXPteQWl/lFqucPSSnlT1L8bF8HNK9NVVqrSp98b /wDbqXrNrG2uZvasvVq66fOmeuPfGvbYwEbaM6qy57QVVhyamjt2X2JUhutCi7I/+DURfHG/ovTf ZV28FRVkk6VFcXKYqp2PH4nD3MJdmzdjKY/ecd09QADdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZc fAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEU656nXHF6WjwX CvsuYZK10dGqdW0MG+0lXJ8SNTfl38XJ6+VUXeM5zKzaf4pcsvv86R0duhWRU32dK/wZG3+2c5Ua nzqQLp/Z7zXVVw1LzRn/AOJMmVJXxq5VbQ0njFTM38ERuyr8/j1TcqYm7NP8OnbPwh3OR8DTdmcV ejOinZHaq3eEbZ90dbL4Xh1swixx2e3ufM9XLNVVUq7y1U7ur5Xr4qqr/EmyGeB0b4l6dZa5Mckp I7r5NJ5C6sY58CT8q933jWqjlZzbcyIqLtvsqKVIiIjKHerrqrma6tcy7wKnaQdolpRl97nwDV2k k00zK31UlvrKa6So6gWpjerHsbVbIkao5q7pKjETwRzi10E8FVBHU00zJoZmJJHJG5HNe1U3RUVO ioqes2qpmnahtXqL0Z0TmjvsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUdR4sAAAAAADWtS71eMc 08yW/wCPXXG7Zc7daqqqo63JZ3QWmnmZG5zJKyRqo5kDVRFe5FRUaiqBsoNRxnM4KfS2xZzqBlWJ Rd9ZaOuul4ttciWR8skLHSTU08rutM5zlWNznbqxWqq7qc+F6o6Z6ksqJNO9RcYyllIqJUOst3p6 5It/DnWF7uX8YGzgi/EtSLqmUanuz7O9MG41h9TC6lW03R3ltopO5dJMt671/d07/R5m7creRHKv gZmt1y0UttfbLXcdYMIpa29QQ1NtppsgpGS1sMzUdFJCxZN5GvaqK1zUVHIqKm4G7g6l2u9qsNtq LxfLnSW6gpGLLUVVXM2GGFieLnvcqNanzqpgsL1T0x1ISoXTvUbF8pSj2So8y3enru538OfuXu5f xgbQDT7prHpFZJa6nvOqeIUMtrrorZXR1N7po3UtZK3mjp5Ec9FZK9vVsa7OcnVEU3AAD8c5rUVz lRERN1VfUhpNl1x0VyTIPYljusGE3W+c6x+bKLIKSer5k8W9yyRX7p8WwG7gwuWZthmBWpb7nWXW XHLaj0jWsu1fFRwI5fBveSua3fovTc/cUzPD88tLb9g+WWbIrY9ysbW2qviq4FcniiSROc3dN06b gZkGo5FrBpLiF+hxbLdUcRsl6qeXubdcb3TU1VLze95YpHo92/q2TqZW95nh+NVltt2R5XZrVV3p 8kdtgrq+KCStexnO9sLXuRZFa30lRu+ydV6AZkGuWvUfTy+YvNnFlzvHq/HKdZEmvFNc4JaGNY15 ZOadrljTlXou7ui9FOLC9U9MdSEqF071GxfKUo9kqPMt3p67ud/Dn7l7uX8YG0AgnTnjE0h1I1xz TRO0Zbi/lOMrbYbVWR5FTyuyCoqIJZaiKliTZXrTd21snI6RUc5UcjFbss7AAAAAAAAAU84t/hk8 KP8Ah1+ioCYCH+Lf4ZPCj/h1+ioCYClifXjwej5I9hPj9IAAV3VaZnON3iOuo9RMGf3GV2FFfAid G18Hi+llT1tcm+3xKvq33SbtNtQbNqbiVJldlR8TZt4qimk/dKWob0khenxtX+NFRfBTRDR47w/R TURmbxOVmJZRMylyKPmXkpKlV2irUT1Juuz/AMKr1VU22tXOZqz6p2+fmixmE9IWdCPaU+r3x10/ Wnv1dazYPlj2SMbJG5HNciK1yLuip8aH0dN4wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHmrwFWXjoq+E7 BqjRzNNH6DD3+c/N1Pf7dXy17NrlVJL3rol5F3l7xW7fvVbv13LAex3tNfujaAfyRdPrHZcfAT0y /LX6YrS1QFVfY72mv3RtAP5Iun1j2O9pr90bQD+SLp9ZaoAVV9jvaa/dG0A/ki6fWPY72mv3RtAP 5Iun1lqgBVX2O9pr90bQD+SLp9Y9jvaa/dG0A/ki6fWWqAFVfY72mv3RtAP5Iun1j2O9pr90bQD+ SLp9ZaoAVV9jvaa/dG0A/ki6fWPY72mv3RtAP5Iun1lqgBVX2O9pr90bQD+SLp9Y9jvaa/dG0A/k i6fWWqAFVfY72mv3RtAP5Iun1j2O9pr90bQD+SLp9ZaoAVV9jvaa/dG0A/ki6fWPY72mv3RtAP5I un1lqgBVX2O9pr90bQD+SLp9Y9jvaa/dG0A/ki6fWWqAFVfY72mv3RtAP5Iun1j2O9pr90bQD+SL p9ZaoAVV9jvaa/dG0A/ki6fWPY72mv3RtAP5Iun1lqjTtXM9i010+u+WK1JKmni7qih23WaqkXli Zt4r6Soq/MimtVUURNU7ISWbVd+5TatxnNU5R4yo7mcfHvqfmc2FXTO9Gqunwmsiqql1PbLgyimr Vbu2N6KqukdGm+6dERVVF36Gf8xdoR8u9Ev5LuP1k06bYrLiWKU1FXyLLdKtzq65zuXd0tXKvNI5 V9ey+jv8TUNoObFyavtVRrl7CrC27URZtVTo09+3fPvnWrd5i7Qj5d6JfyXcfrHmLtCPl3ol/Jdx +ssidG+Jelstc3HFpEuq00iUS1iuSBJ+VeRZOVFdyI7bfZN9jOn3Q05iO1PF4ZcZEeRxcQ2TxZpc 8Wr8kY6Bt4nxqCaKiWqSJvMiJKqr3iN5UeqbJzo718yrOnAhZ+OplTR1Okk0tDgT3o+VcrR62WVi ru5YI1+yuVevpU+26ps5yFxtGuz70c08u0ub6g97qRmlZUvrqu6XuJq0/lL3K98kdL1Zurl5uaRZ HIvVFb4FoGtaxqMY1GtamyIibIifET1340dGIzc6xydXzk3a6su6NvvlHPZcfAT0y/LX6YrS1RVX suPgJ6Zflr9MVpaouPPgAAAAAQ9xjfBP1h/vIvP9EkJhIJ448rxnGOFHVGPI8gt1sfdcUulvoGVd SyJ1VUyUz2shiRyor3qqps1u6gVdgtlBqdlXAvopnFMyvwmfTpmSVdoqE5qW511LZYVp2zMX0ZEj VFdyqioqPcioqKSFxM4XiOjfEtw26haWYza8avN9y5+J3VlopI6VtxtlTG1HtnZGiJIkfvmqqLyq qL6k22vHOG6n1i4aOHu702U3TCM90+xOyVmPZDQwMlmt87rbBHPDLDInLNE9Goj43bb8qJvtui7N iPC3ldXqvYNY9fda6rUm94dDUR4zRw2GCz262STtRstR3Eb5FlmVqIiPc/ZPUm6NVoV0l/2r2iP/ ADfJ+hKk2Fmh+l0PZYz19ThdprLlVaTJk0txqaRktW6v82JUxyrM5FfvG5GNZ19FjGsTZqIhM7uE fmi4iYvbB/s+U7oN/NP+4u9FJS7/ALt/VP7pz7fYvDb17pt0mgvPwqpwy+yvbbA0wjz35D8VB5J5 V5P3n/X7vvPm5vWBSbWTJ8yzjFuB/T2twis1Ft2UY3HkN2xl1ygpG5FWUdppZYmTS1LmxK1ivkkc 2Rdn77bKqohvdy0611vOvmkup2nnBI3Seoxy/RUmS3Siyaxd1WY/PtHVRTQUsyOm5Gr3jE5XKitX lTfYnPJ+D2y5Noxpdp17Ornacr0ho7dHjOY2ymZHUU9VS08cKyrA9XsdFKkaK+FzlRdkTmXbde3h nD7q6moNkz3WbibvmaNxpJX2yz2qzRY/b3TSMVjpapkEj3VSo1ejXORiL15dlVFCF+HfSvBs541u J3JM1xu3X6SwXuzRWqC40zKmGkkno1dNMyN6K1JVSGFqPROZEa5EXZy73iIj0r0Jj0p1V1b1Wly5 twZqbcKC5Oo3UXcJbEpad0StWXvHd6jubm5uVm222y+Jt3tvaTfdQxL+W6b9cDG8QOnV61c0TzXT LHL+llueS2apt1NXKrkbE+RuyI/l9Lkd712268rnbIvgUiuUGn2lmnWPYBxf8DjcKsWPyW6mbqHh bqeqpKepikjSOufU0vJWUSPkanMqq57lfsu6uLqZyul+vGGXrSml1Opee/0boe9x6/RMuEHKqPSW F0blcitVqL4Kioio5FRVRYcybhB1v1Oxj2stZeL66ZPgNQ6BtxtlLh9Fb7hcYIpGvbFNXNkevVzG 8zmxtc7bqvVQIf1WvOVZz2hN4o2aCLrRbcCwmiksVjlvFvpKSidVuZJJcUZWuSKV6q7u0ciKqIjV /etVNx0OwDW3E+Kq8apWzhdk0mwHIcRkpL9aYMgtVVS1V3gkWSnqmU9HKqtkcxViVUZt6TlXq5VJ i1V4W35RqDY9Y9IdSK3TPPbFafY+lxprbFcKSutfNzNpaqklVqSI13Vrke1U6ePKxW5nR/RDN8Iy +76i6oa5ZBqFkl1oo7a1rqZlrtNFSser0bBb4XOjSRXL1le5z9uiKiK7cK78B2h+kuu/Ca3UbVvC LHlmU6oV97rcku9xooqitfKtdUQNSOZ6K+LkZGxzEaqcqrzJsvUxnFJojjOP3XhI0Jber1escpMt qLPJLdatJqqqt/cpz00sjGsRzHRbwbIifY/R+ck5OCzULDPZJjWgvE9edPcDyqtqK+qxxMdpbi6h kqP3dKCqke19K13XZNnci9U69TYZOC7ELTSaF2PBMimslk0Rustzp6WakSqlujpGr3neSo9iRvfI 58jnoxyKr12aibAQlxx2mO1as8Omg+EaOUeQYddbrer5VYNa5aS00d6qaKCOSGJ6yclPyMV75HMf 0ei7bKqoh+3LTrXW86+aS6naecEjdJ6jHL9FSZLdKLJrF3VZj8+0dVFNBSzI6bkaveMTlcqK1eVN 9iz/ABB8PNl16tlgqPZLc8VyvDrk28Yzkdsax9RbapERF3Y9FZLE9ERHxu6O5U69DXsM4fdXU1Bs me6zcTd8zRuNJK+2We1WaLH7e6aRisdLVMgke6qVGr0a5yMRevLsqooRfwuYlisPG1xUzRYzaWSW q4Ym6gc2ijRaR0lunWRYl2+xq5eruXbf1lyiA7bwz5TivEvkuvmCaxzWa0Z0tuflWLy2KGqZcH0U CwxLFVOej6dOVVVeViqqud18EbPgAAAAAAAAFPOLf4ZPCj/h1+ioCYCH+Lf4ZPCj/h1+ioCYClif Xjwej5I9hPj9IAAV3VDp3i0UF+tVXZbpAk1JWwuhlYvra5NunxL60X1Lsp3AY2sxM0znD44c8uuK UNy0myepdLecOc2Onmeq71ltd+4S9fFWpsxdvDZu/XcmYrBntXPgWS2DWO3RuXzJMlFeGMTdZrZM 7lfuieKscqORPjXf1Fm6eogq6eKqppWywzMbJG9q7tc1U3RUX4lQuYWvOnQnbHy6vJweW8NFu7GJ oj7Nfwqj1o+U+/LqcgALTiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKq9lx8BPTL8tfpitLVFVey4+Anpl+W v0xWlqgAAAAAAAAAAAAAAAAAAAAAAAAAAAFf9ZrguaavY1p+x3eW3GIVyK5t/euqV3ZTMX527q/b 1o4n9zmsarnORGom6qq9EQrBphVOyqvyvU6bdzspvErqVy+PkUCrFAm/zI1yFPF1aoo3/KP3Dvcg 2v4leJn7kZR41ao+GlPub6ACs7QAAAAAjjsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUdV4cAAAA ADAZdp9gWoEFJS57hFgySG3zpVUkd3tsNY2nmRFRJI0la5GP2VU5k2XqZ8AfjWtY1GtaiNRNkRE6 Ih+gAAAAAAHHUU9PV08tLVQRzQTMdHJHI1HMexU2VrkXoqKnRUUi73J3Cx97TpV+Ztu/YkqgDQ8R 0D0KwC9R5Jgmi2B43d4WPjjr7RjlHR1LGOTZzUlija5EVOipv1Q3wAAAAAAAAAAAAAAAAAAAAKec W/wyeFH/AA6/RUBMBD/Fv8MnhR/w6/RUBMBSxPrx4PR8kewnx+kAAK7qgAA6t1tlHerZV2i4Rd5T VsL4Jm/GxyKi/wCRTIcMuR1tfgMuG3mdZLrhdZJZJ1XxfCzrA/8AuVjVGp/cHCa1hFZ7D+IdKffk os8s7mKngjq6j9JF/wDBVyfhUzbq0LlNXu4/7RYu10nB3LfXH2o923/HPhCxAAOo8YAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAqr2XHwE9Mvy1+mK0tUVV7Lj4CemX5a/TFaWqAAAAAAAAAAAAAAAAAAAAAAAAAA ADRdc8ldiWkOWX2OTklitskML/4Ms20TF/E6RpHOC2NMbw2y2Pk5XUdDFHIn/wATlRXr+Nyqpl+K qbyjCsfxlF3TIcot1DI344+Z0jlX5kWNpzHOxE53vCP39HreS6ObwET2qpn3RERHxzAARrYAAAAA jjsuPgJ6Zflr9MVpao88dCsD4/uHvSuyaQYNkuhVRZLB5T5LJcqa6y1Du/qZah/O5iMavpzPRNmp 028fFd99lnaV/bzh4+gXj9Y6PO0b3kug4jsSuiCl3ss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1hztG 86DiOxK6IKXeyztK/t5w8fQLx+sPZZ2lf284ePoF4/WHO0bzoOI7Erogpd7LO0r+3nDx9AvH6w9l naV/bzh4+gXj9Yc7RvOg4jsSuiCl3ss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXe yztK/t5w8fQLx+sPZZ2lf284ePoF4/WHO0bzoOI7Erogpd7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj 9Yc7RvOg4jsSuiCl3ss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXeyztK/t5w8fQL x+sPZZ2lf284ePoF4/WHO0bzoOI7Erogpd7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Yc7RvOg4jsS uiCl3ss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXeyztK/t5w8fQLx+sPZZ2lf284 ePoF4/WHO0bzoOI7Erogpd7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Yc7RvOg4jsSuiCl3ss7Sv7e cPH0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXeyztK/t5w8fQLx+sPZZ2lf284ePoF4/WHO0bz oOI7Erogpd7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Yc7RvOg4jsS73Fv8MnhR/w6/RUBMBXCLTji 01F160x1V13v2lj7Zpv567inxeKvinl84UXcO5knRzXbOZEqek3ZOfxXZCx5Uv1RVVnDucmWq7Nm abkZTn9IAAQuiAAAaDq1Urj7MYz1i8q4xkFHVTP/AP0Z7+7lb+BUc1DfjUtWral200ySjVvMqW6W ZqfG6NO8T/KxDSv1ZyT4aY56mKtkzlPhOqfgsgDXNN7wuQ6e4zfXv5n19opKh6/27oWq7/KqmxnX pnSiJh4O5RNquaJ2xOQADLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVV7Lj4CemX5a/TFaWqKq9lx8BPTL8tfp itLVAAAAAAAAAAAAAAAAAAAAAAAAAAABBnEU/wAozfS21L1bLdqyr2+eGBFRf/qMgYvXz+y9pIi+ 93vq/j8li2Mocy57Wvxj5Q9nhIywNjwn/vV5AANUoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAdO9UyVtnr6NU3SemliVP7pip/8Ac7h+ORFRUXw26mGYnKc2W4Zqxa/Q nEJ3LuraN8P/AIcr2f8A7JJxEPCWqrw+4pzeO1b/AE2cl46GHnOzRPdHyeV5VpinH34jt1f9pAAT KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAqr2XHwE9Mvy1+mK0tUVV7Lj4CemX5a/TFaWqAAAAAAAAAAAAAAAAA AAAAAAAAAACC+IdncZ9pXc16NjuVwpd/nmp2oif/AEmRODimh8nxjFclRNkseV2+old8ULudj0/G rmnOcy7GV6r3fL/T2OBq08BandpR/lM/+wADVOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAHVutQlHa6yrcuyQU8kir+Bqr/9jtGr6o3JLTpzklaruVW22eNi/E57FY3/ ACuQ1qnKJlJap07lNO+Yb1ww0i0Wg+IwuTZXUss3+PPI/wD/AGiUTVtLLQtg00xWzPbyvo7NRxSJ /bpC3m/+rc2k6dmnRt0090PHY+5F7FXbkddVU8ZkABIqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/ LX6YrS1RVXsuPgJ6Zflr9MVpaoAAAAAAAAAAAAAAAEQcR/EfjXD3jVHJJbqnIswyKfzfi2LW/wBO tvFa7ZGsY1EVWxoqt55NtmoqeLla1QcR/EfjXD3jVHJJbqnIswyKfzfi2LW/0628VrtkaxjURVbG iq3nk22aip4uVrV0Xh54nc5uWZyaAcUuKUWEasMgW4W6OmkR1tv9E7dyPopeZzXSRpux8aOVd2OV PByM7fDhw4ZLYslrOIjiIuNNkWseRQd250fp0WMUTt+W3UDd1RqIiqj5E6uVXIiqiudJvfENw84Z xFYZHjuRTVNqvNqnSvx3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrmhKYKzcPPENmdFmcnDFxOw0 1q1TtUCyWu6RpyUGYUDd+WspHbIne7NXvIuioqOVETZzWWZAAAAAAI84gsdflOjOWWqJivmZb3Vk SJ4q+BUmaifOqx7fjNIxG9NyLFrTfWuR3l9FDO7b1OcxFcn4l3T8RO80MVRE+CeNr45Gqx7XJujm qmyopWHSSCXHqa/acVTnLPiF4qKGPmXq6me9ZIX/AIHNcu3zIUMVTlcirfGXD9y9PyLc5zC12uum Yq906p+MU8W/AAhdEAAAAAVS4f772gXEVpFYdZMRvOhVvtOQeVeT01yo7q2oZ3FVLTu50jc9vV0L lTZy9FTwXoSH7WHaTfKzh3+i3n6jY+y4+Anpl+Wv0xWlqjo81RueR6biO3KmXtYdpN8rOHf6Lefq HtYdpN8rOHf6LefqLmgc1RuOm4jtypl7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6i5oHNUbjpuI7cq Ze1h2k3ys4d/ot5+oe1h2k3ys4d/ot5+ouaBzVG46biO3KmXtYdpN8rOHf6LefqHtYdpN8rOHf6L efqLmgc1RuOm4jtypl7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6i5oHNUbjpuI7cqZe1h2k3ys4d/o t5+oe1h2k3ys4d/ot5+ouaBzVG46biO3KmXtYdpN8rOHf6LefqHtYdpN8rOHf6LefqLmgc1RuOm4 jtypl7WHaTfKzh3+i3n6h7WHaTfKzh3+i3n6i5oHNUbjpuI7cqZe1h2k3ys4d/ot5+oe1h2k3ys4 d/ot5+ouaBzVG46biO3KmXtYdpN8rOHf6LefqHtYdpN8rOHf6LefqLmgc1RuOm4jtypl7WHaTfKz h3+i3n6h7WHaTfKzh3+i3n6i5oHNUbjpuI7cqZe1h2k3ys4d/ot5+oe1h2k3ys4d/ot5+ouaBzVG 46biO3KmXtYdpN8rOHf6LefqHtYdpN8rOHf6LefqLmgc1RuOm4jtypl7WHaTfKzh3+i3n6h7WHaT fKzh3+i3n6i5oHNUbjpuI7cqZe1h2k3ys4d/ot5+oe1h2k3ys4d/ot5+ouaBzVG46biO3KhTsx4u NLOIHSvS3XGu0ruFo1I8+ckmL0tek8Pm+i79eZ1Q5Gt5nyRbbNduiP8ADopZIh/i3+GTwo/4dfoq AmAqX6Ypqyh3eTLtd6zNVc5zn9IAAQuiAAAaBrHA692myYPEqrJlV9oba5qePdd4j3u/AiMTf8Jv 5q+NUfsv4iLXT7c9Hg9pmuMq/vUq6n7HG1fnRm70/AazGnlRv1fv3JLdzmNK/P3Imr3xs+OULFNa 1jUYxqNa1NkRE2REP0A67wYARBxH8R+NcPeNUckluqcizDIp/N+LYtb/AE628VrtkaxjURVbGiq3 nk22aip4uVrVBxH8R+NcPeNUckluqcizDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZqKni5WtXRe Hnidzm5ZnJoBxS4pRYRqwyBbhbo6aRHW2/0Tt3I+il5nNdJGm7Hxo5V3Y5U8HIzt8OHDhktiyWs4 iOIi402Rax5FB3bnR+nRYxRO35bdQN3VGoiKqPkTq5VciKqK50m98Q3DzhnEVhkeO5FNU2q82qdK /HcioF5K+yV7dlZUQPRUXbdreZm6I5ETwVGuaEpgrNw88Q2Z0WZycMXE7DTWrVO1QLJa7pGnJQZh QN35aykdsid7s1e8i6Kio5URNnNZZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfAT0y/LX6YrS1RVXsuPgJ6Zfl r9MVpaoAAAAAAAAAAAABEHEfxH41w941RySW6pyLMMin834ti1v9OtvFa7ZGsY1EVWxoqt55Ntmo qeLla1QcR/EfjXD3jVHJJbqnIswyKfzfi2LW/wBOtvFa7ZGsY1EVWxoqt55NtmoqeLla1dQ4cOHD JbFktZxEcRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNREVUfInVyq5EVUVzpHDhw4ZLYslrOIjiIuNN kWseRQd250fp0WMUTt+W3UDd1RqIiqj5E6uVXIiqiudJY4AAAIs4huHnDOIrDI8dyKaptV5tU6V+ O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc2OeHniGzOizOThi4nYaa1ap2qBZLXdI05KDMKBu/L WUjtkTvdmr3kXRUVHKiJs5rLMkWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K+yV7dlZUQPRUXbdre Zm6I5ETwVGuaEpgrNw88Q2Z0WZycMXE7DTWrVO1QLJa7pGnJQZhQN35aykdsid7s1e8i6Kio5URN nNZZkAAABXvVOgXCdcrPlTG8ltzij801jv3ra+BN4HL87megn4FLCGh63YFLqLpzcrJQLyXWm5bh apUXZY6yFeaPZfVzdWb/ABPUgxFublvVtjXDp8kYmnDYqNOfs1fZnwnr905T7msA13AMrjzTE6C/ Izup5Gd3Vwqmyw1DF5ZGKi9U2ci7b+pUNiKETExnD09dE26poq2wAAy1AABHHZcfAT0y/LX6YrS1 RVXsuPgJ6Zflr9MVpao6rw4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACnnFv8MnhR/wAO v0VATAQ/xb/DJ4Uf8Ov0VATAUsT68eD0fJHsJ8fpAACu6oAAOGsq6egpJ6+slSKCmjdNK9fBrGpu qr+BEU++GCy1L8Tumo90gdFXZvcH3BGu98yjZuynYv4Go5U+Z6Gi6mtrcqrLJpJZJXMrcsqUjq5G eNPb4/SnkX4uibJv49ULMW630dpt9LardA2Clo4WU8ETfBkbGo1rU+ZEREJcNRp3NLqj5z/r5qPK 97mMLFmNtyc5/LHnV/1dgAiDiP4j8a4e8ao5JLdU5FmGRT+b8Wxa3+nW3itdsjWMaiKrY0VW88m2 zUVPFytavQeVOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNRU8XK1q6hw 4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlVyIqornSOHDhwyWxZLWcRHE RcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6SxwAAARZxDcPOGcRWGR47kU1Tarza p0r8dyKgXkr7JXt2VlRA9FRdt2t5mbojkRPBUa5sc8PPENmdFmcnDFxOw01q1TtUCyWu6RpyUGYU Dd+WspHbIne7NXvIuioqOVETZzWWZIs4huHnDOIrDI8dyKaptV5tU6V+O5FQLyV9kr27Kyogeiou 27W8zN0RyIngqNc0JTBWbh54hszoszk4YuJ2GmtWqdqgWS13SNOSgzCgbvy1lI7ZE73Zq95F0VFR yoibOayzIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAABU/ssqulqeBjTqGnqYpZKWS8wzsY9HLE9btVvRrkT3q8r2O2Xrs5q+ CoWwPMfgJwzjcs2hU9i0YzXSOjx21ZLdqBWX+3101U6pim5JXc0WzeRXN3b0328Sx3sd7TX7o2gH 8kXT6wLVAqr7He01+6NoB/JF0+sex3tNfujaAfyRdPrAtUCqvsd7TX7o2gH8kXT6x7He01+6NoB/ JF0+sC1Rj8hbfnWG4pi0tFHefJZfN7q6Nz6ZKnlXu+9axWuWPm25kaqLtvsqL1Ky+x3tNfujaAfy RdPrHsd7TX7o2gH8kXT6wNa0Q7UHRnN8gqNNtbKOXSfO7ZVyW2upLvMjrctXE9WSMbV7Ikao5rt0 mRiJ0RHPUuXT1FPV08VXSTxzQTMbJFLG5HMexU3RzVToqKi7oqH86vHN7Jm8TeXx5zeMOueUxyQR 32oxOnnht61rYmo9qNmVV71ERqSKmyc6O39LmVbFdnRY+0TZVUNXopPLb9OJJEfMuZJIthlYq7uW niX7M5V6+lS8qKqIj3ogHqLxH8R+NcPeNUckluqcizDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZ qKni5WtXUOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6SIuF9 W2Hizzaj4sWq7X64rIuK3GodvZ6nHtl5Y7Gjk+x7en3jV3l25t1375C9YApjiOunGzrJqbqxjWkd PohQ2PTjLanHIlyOiu3ldQ1iryPc6nnViryom6o1vXwaXOKgcCv9lvin/wClWs/zOA2HCeJ7VPDd W7FoXxW6c2XGbxl/eMxfJ8brpKmx3ioYiK6m2mRJaeXqnK1+/MrkTZN2q7I6v8Qmq3t5UvDTw74b jVzzBtg9k94u+U1k0NrtdCs3csascCd7NI5yp0aqIiOb47uVmkdoxLBcV0AxC0ua7K7lq9ZKq0sZ +7MigSTv5k9aMYskPMvgm7VXwN91x4Y7Fq/qVSanab6w3fTjVfG7c22uu9kkiqFfQve57Ia2jeu0 sfNzOajlbv6+blbyhibbqxxjacai4pjmuGlGI5Xi+W16Wtb9pxBcZH2WZybskraeo53JB0XmlRyN YiKqruiNdZ0pdkesHF5wlXXGa/iDveF6n6c32+Utgqb/AGqgdarzbpqhytjmlp2/YHx9FVWsRV6b bt6b3RAiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zY54eeIb M6LM5OGLidhprVqnaoFktd0jTkoMwoG78tZSO2RO92aveRdFRUcqImzmssyVQ7RGq0jl0rttjyyh udw1Gra5vtbU2PO5b6297t7uSlc1FcyNHcneqqcvLt+/7vYLXgp/idn7VGDGLVFd8q4fXVraOFKh bjTXN9Xz8qbpM6nRIVk398sacm+/LumymW82dp/8p+G36FevrAtUCqvmztP/AJT8Nv0K9fWPNnaf /Kfht+hXr6wMzllo9qXWCSVjUixjUKZZol8GUt3RPTZ8ySpsqfG7onRptxCuf6YdpBqRjNRi2R5H w5rSzPZKySClvUc0ErF3bJG7ryuRfXsvRVTwUjjGbr2g1yrbpi81+0Op7vjkyUVdT11JdO/XZE5Z t2Lyua9OqOTZF+JOhzrlrm69uqdn1eswuO6XYjOJmumMqst2yJ+k+6etbE6N8S9OstcmOSUkd18m k8hdWMc+BJ+Ve77xrVRys5tuZEVF232VFK+eb+0R+UOgX0S7/WPN/aI/KHQL6Jd/rNdHvhLz2f3Z 4Nf0g7RLSjL73PgGrtJJppmVvqpLfWU10lR1AtTG9WPY2q2RI1RzV3SVGIngjnFroJ4KqCOpppmT QzMSSOSNyOa9qpuioqdFRU9Z4T8Y/sn90NlDc4qsRqclY6Bt4kxWOdlAtUkTebZJ15u8ROVH7dOd HevmJ04ELPx1MqaOp0kmlocCe9HyrlaPWyysVd3LBGv2Vyr19Kn23VNnOQnrsxo6UTk5tjlC5zk2 q6dLvjb74ekHZcfAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpaouOAAAAYmfLsUpsmpsKqcntMWQ1tK+u prS+tjbWzUzF5XTMgV3O6NF6K5E2RfWZYq1xdU/sG1k4e9f4E5GWPMXYhdnp0RKC8wrT88i/wI5W MVN/BX7gWKbnGFvy52n7cvsi5Qyj84OsiXCLy9tLzI3v1p+bvEj5lROfl5d123OWmy7FKzJK3DqT J7TPf7bTx1dZao62N1ZTQSe8lkhR3OxjvU5URF9R592+tn91BS8ZLpXeQXLWap0qaqL9jfZlt6W6 Gbfw7vzhDzf3S7+tTTNa8pyebh+4pOIvHKuop6jUrUGjwehroJOR3mC3SsokfG9dkY2Ze/jd4J6S 79fAPRqya06OZLkb8PxzVnDbrfo1c11ror9Sz1jVb75FhY9XoqbLv06Gg55rjlmL8V+l+hVvt9pk sGbWa83G4VM0Uq1kUlJHzRpE9JEY1qr75HMcq+pUKrataLam5dowzTfTPs4/YRfrKyllxnJKLMMd jrbXV072OZP30czZXudyrzqrt3K5XL6WypJuVzZJUcc/DDUZlRtpL/Lgd+fdadr2OSGsWjaszEcx Vau0nMm7VVOnRVQC0GWauaUYFcqazZ1qdieOXCsajqaku16pqOaZFXZFYyV7XOTdF8ENjqrpbKG2 yXmtuNLT2+GFaiSrlmayFkSJur1eq8qN26777bFJ+BnS/TbXbT7UXVnWHA7Dl2U5lnF6gulTeqCK rlp6eJ7Y4qONZEVYo42InK1u226fE3bFcRWkGPad2vho4Rrffb9dNN77nro7nBdq5JpKmlp/s8Vv kkY1nNAr5FRrF8EYxEX0W7BcnDtX9JtRKye3af6oYlk1VStV88FmvdNWyRNRdt3Nie5Wpv06nNed VNMMcqrtQ5DqPi9rqbDBDU3WGtvFPA+ghl6RSTte9Fia/wDeufsjvVuVK47dPMD0es+kusOleGWT FssxzUSzUFHUWWgio31NHUd4yaiekTW95G9qJ6K79EcibI52/ZxvAcVzTtNdT63K7NS3aKy4PZai kpayJJoGVL9mJP3bt2rI1iyMa5U3akr9ttwLRSaz6PQ4izUCbVfDmYvLL3DL26+0qUDpf4CVHP3a u6L05tzYrDkFhyq0U2QYve7feLXWs7ymrqCpZUU87d9uZkjFVrk3RU3RfUUo4V9HNNn8X/E5SVGH 2qe2Y7d7Slntc1Kx9Fb319I6WskhgVFjjfKsUSOc1qLysRu+3Qhe75XfdIuCri/tGnc0topLHrDd rBa2UirG22UFRWUcMkUO37mzu5HsRE22V+6dQPRy2a06OXrJ3YTZtWcMr8ia9Y3Wimv1LLWo9PFq wNer902XdNjczzgz/RPUDKNAWaT4F2cKY3dLfQQLj2TUuYY6yuoa6LldFWd/HMkrnq9qK9efd3M7 depfnTF+YyabYnJqJSeS5W6x0C32DvI5O6uHcM8pZzRqrHbS86btVWrt0VUA2Y0rJNbdGcNvjcYy /VzC7HeHcvLb7lf6SlqV5uqbRSSI/rum3Q3U8+LZpLmnDlXZ7b9UuDi266Ytk+Q3G+y5jZmUdfe5 Kapfz9xUUVS1JpHsTfbu38qLvt1XmUL+1F0ttJbn3iquNNDQRQrUPqpJmthbEib86vVeVG7dd99t jXcN1b0p1Fqqih0+1NxPJ6mjTmqIbNeqatfCm+272xPcrU36dTz71+ynAck0J4Y9NeHbH7xlml2W 5a6J2NT3ZaepuUdG9Xpaaierf6De+fI1WPfyp3TOVdmsU2rUHTfXXJs000zPSngMi0uyHCsnoqyW 9W7J8fjbNZ+rKuiljppmrJG+N3h1VERUb75dwvNmWoeAadUMVz1BznH8Yo5393FUXm5wUUUj/wCC 10rmoq/MiibULAabEH6g1GcY/FizIkndfH3OFtvbFzcvOtQru7RvMqJvzbbrsVP06xTFtbuPfX6q 1Yx225G3Te241ZcYt93pmVUFDTVdLJPUSRxSIrUe+RqLzom+0ipvsp8cUvD/AKe6E8IHEI7Tfy6g tmWU7LvLYu+Z5uttR3kTXrRwNY3uGv2arm7qnot25UREAtrZc/wXJL1XY3juaWK63a2RRT11BRXG GeopY5E3jfLGxyuY1ydWq5ERfVuYq2a06OXrJ3YTZtWcMr8ia9Y3Wimv1LLWo9PFqwNer902XdNi n3ENYrbw99mrdsk0utFLaclvWNWSmvF/pYGsuFa6tmp21c89Q1EkkfJ383VV6LJ022RDVM/0T1Ay jQFmk+BdnCmN3S30EC49k1LmGOsrqGui5XRVnfxzJK56vaivXn3dzO3XqBazVvi90n0d1kwbSDKc oxqknylbg+7VtdkFPRtx+GCk7+GSpY/3vlD1bHGj3R8yqqtV23Ks4QzQ1MMdRTyslilaj2PY5HNe 1U3RUVOioqesorn2M1V74uODpNWcRtbsouuKZCuVU1RT09QklwjssayMkc3mZL3cvPyqiuam27V2 6l62MZExscbGsYxEa1rU2RETwREA+gAAAAFPOLf4ZPCj/h1+ioCYCvfH5HqJLxL8MUelFRYIMqX2 a+QSX5kzqFP9j6Xve9SH01+xd5y7fvuXfpudLzf2iPyh0C+iXf6yniKc6trv8lXNCzMaMzr6vCFk QVu839oj8odAvol3+seb+0R+UOgX0S7/AFkGh3w6XP8A9M8FkTF5TV19vxm619qq6Glraaimmp5q 9rnU0crWKrXSo1Ucse6Jzcqou2+yopAXm/tEflDoF9Eu/wBZqlbYePrVrIK3SaHItEpGUcMVZd56 aC6xwRN5t2U8r91du/ZF5WpvsnimyiaZ2RMZtqb0a6q6aopjXM5bI4/uThC499Dsm1MyCr1yuLcB zyscy0UcNzVPNlPBGvpRMq12SNzpEVXd6jG9E2c5VVD0bp6inq6eKrpJ45oJmNkiljcjmPYqbo5q p0VFRd0VD+dLjfpsloeJPKaDNpcGkySkSlgu64XDURWxtSyBicrWzrzd41iMbJtsnOjv33MWN7Oi x9omyqoavRSeW36cSSI+ZcySRbDKxV3ctPEv2Zyr19Kl5UVURHvRDoW6It06MPKYrE14u5zlyc9k e6NUbNT1F4j+I/GuHvGqOSS3VORZhkU/m/FsWt/p1t4rXbI1jGoiq2NFVvPJts1FTxcrWrqHDhw4 ZLYslrOIjiIuNNkWseRQd250fp0WMUTt+W3UDd1RqIiqj5E6uVXIiqiudJEXC+rbDxZ5tR8WLVdr 9cVkXFbjUO3s9Tj2y8sdjRyfY9vT7xq7y7c26798hes3V0DaX69ZZmfFJrboneqCzU+P6a09hmtl VBFKyql8toknm8oe6RWORrujeVjNk8d/E6GmfENnevusdfT6OWiyro5ir5aG7ZbcKeaWW+3JvRYL VySsZ3Ua+/ne2Rrl6NTbZy1I1I0i1z1z4v8Aix010ezu2YrR3O1Y0t7nnbItRXo20M8noGOYqd1F M9XpNJvujWoiI5HOatv+C3V/DdQ9KIMJs+HU+C5Jp3y49kmGsZ3a2ari3avK1VVXQyK1z2SKq83p buc5HKBH9z104vc74n9VtD9D6fR+ktOm0dml8oyuiuj6moSuomT7c1NOjVVH94nvG+jy+K7qZSm4 ntcNF89xvCeL3TnFrbZ8xr2Wmz5vh1bPLaWXB/7nTVUNSiSwK/bo9VVvRfFqPczG8PX/ALwvis/5 Jhv6LQ+e1UqKKbhLrsZjakt/yLIbNbsdgYv2aWvWrY9Ei9fN3TJU3T4wMvrzrtxI2vigxfh00Dot NWyX3EpskmrMvpq+RrHRVEsbmNdSyt2RWsbsisXrv18ENgxWLtC0ye0Lm9bw7ux1K6Dzslqpb4la tH3id95OssixpLyc3Lzpy822/QhPiFTWiHtE9OWaJewyfLW6X1Td8sfVMt7ovK5u9VVpUWTn8OXp t47k44VJ2ga5Zak1Fo+HtuM+VM86rZam9rXpTb+n3CTMSNZNvDmXb4wNx4huHnDOIrDI8dyKaptV 5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc2OeHniGzOizOThi4nYaa1ap2qBZLXdI05KD MKBu/LWUjtkTvdmr3kXRUVHKiJs5rLMlUO0RqtI5dK7bY8sobncNRq2ub7W1NjzuW+tve7e7kpXN RXMjR3J3qqnLy7fv+72C14Kf4ljXaksxe1MveoehrK9KOLyhtdbq6Wpa/lTdJXw7ROkT98sacm+/ LumyrlvY72mv3RtAP5Iun1gWqBVX2O9pr90bQD+SLp9Y9jvaa/dG0A/ki6fWBaoFVfY72mv3RtAP 5Iun1j2O9pr90bQD+SLp9YFqgVV9jvaa/dG0A/ki6fWPY72mv3RtAP5Iun1gWqBVX2O9pr90bQD+ SLp9Y9jvaa/dG0A/ki6fWBaoFVfY72mv3RtAP5Iun1j2O9pr90bQD+SLp9YFqgVV9jvaa/dG0A/k i6fWPY72mv3RtAP5Iun1gWqBVX2O9pr90bQD+SLp9Y9jvaa/dG0A/ki6fWBaoFVfY72mv3RtAP5I un1j2O9pr90bQD+SLp9YFqgVV9jvaa/dG0A/ki6fWPY72mv3RtAP5Iun1gWqBVX2O9pr90bQD+SL p9Y9jvaa/dG0A/ki6fWBaoFVfY72mv3RtAP5Iun1j2O9pr90bQD+SLp9YFqgVV9jvaa/dG0A/ki6 fWPY72mv3RtAP5Iun1gWqBVX2O9pr90bQD+SLp9Z+ssvacUrknjzXh3rnN/3iott3jjf+FzF5k/E BakFWavXDjQ0qjW4avcMVlzSzsarqiv0yvT6iop0Tx/qGsayWXdOvoO6evxJa0K4jdJeIzHZsh0v yVtY+hf3NytlSxYLhbZd1TkqKd3pRru1yI7q13K7lcuygSYAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAqr2b/wDYJyD/AKQMk/pji1RVXs3/AOwTkH/SBkn9McWqAAAAAABi8pZk kmN3SPDpKCO+vpJW26SvV3k0dSrVSN8nKiuViO2VURN1RNum+5lABT/QTsytCNKrq7OtR0l1Szmq qH11Vdsgha6lSqe5XvkipN3M3Vy83NKsjkd1RW+Bb5jGRsbHG1GtaiI1qJsiJ8SH0AIs4huHnDOI rDI8dyKaptV5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc2OOHniGzOizOThi4nYaa1aqW qBZLXdI05KDMaBu/LWUjtkTvdmr3kXRUVHKiJs9jLNEWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K +yV7dlZUQPRUXbdreZm6I5ETwVGuaEplSLfwea/YRqDqJmej3FxTYjRaiZFUZFWW6XT2muSwyyKu zUmmqt3cqLtujWou2+xneHniGzOizOThi4nYaa1aqWqBZLXdI05KDMaBu/LWUjtkTvdmr3kXRUVH KiJs9jLNAV70j4Ro8R1KTXDWHVO+arajQUz6O33e6U0VHSWqB6Kj20VFDvHArkc5HORV6Ku23M7m ar8JlVlGqkmu+jer970s1ArKKO3XSvoaGC4UV1p40RI0qqOfZkj2ta1qO5k2RqdN0RUsIAKwwcHu eZ1lOPX/AImeJC76nW7FLjFeLXj9Nj1LY7YtdFv3U1RHC57qjlVVVEc5E6qnVquatngRBxH8R+Nc PeNUckluqcizDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZqKni5WtUHEfxH41w941RySW6pyLMMi n834ti1v9OtvFa7ZGsY1EVWxoqt55NtmoqeLla1dQ4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixii dvy26gbuqNREVUfInVyq5EVUVzpHDhw4ZLYslrOIjiIuNNkWseRQd250fp0WMUTt+W3UDd1RqIiq j5E6uVXIiqiudJY4AAAAAAEM67aeXh1TTauYDTI/IrHCrK6jan+6tB4viXbxe3q5i+Pq6ryoTMCO 7bi7ToytYPF14K9F631bY6pjrie6UD4vk1oy+x0uQWSpSalqmcyfwmO/fMcnqci9FQ574l6Wy1zc cWkS6rTSJRLWK5IEn5V5Fk5UV3Ijtt9k32MPqhhlVo7kFVqhiFvlmxa5yd5ktrgbv5JIq/7dhanq /htT8Ph1bnbbcqC70EF0tlXHU0lUxJIZY13a9q+Coc3KaKtCrbD18VW79uL9mfsTxieuJ74+Ma1Z 9Guz70c08u0ub6g97qRmlZUvrqu6XuJq0/lL3K98kdL1Zurl5uaRZHIvVFb4FoGtaxqMY1GtamyI ibIifEfoNqqpq1yit2qLUZURkjjsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUdR4sAAAjniF0cpd fNIL/pZUXt1lku7YJKS6Mpu/dQ1UE8c8M7Y+ZvMrZImrtzN3TdN03JGAFc5eDyj9yJScLtJn01PX USQ1cOVJbUdKy5sr0rlrUp+98Vn5l5e88HKnMpnMc4S9P6LhVpOFDK55r5YG2paGurWR+TzVFS6V Z31jGqr+7k8oVZWoqv2dturuu84ACr0fCfrrc7Lb8AzLjMym44PQOgY6jt1gprZeKqnhc1Y4ZbrF Isv71qOexjHuRF3XdVUkXLNAW5NxEaea9Nyt1K3ArTc7WlpdRrKtalXHyc61CyIrOTx2Vjub40Jc AFYa7hB1BxLK8tvHDrxI3PTOy51cZbxerG7HKW7QR3CVESaoo3SvYtM5+yKqekm+2ybNaje9V8C+ lyaCY7ohYr5fbTVYldWZJZsqima66U97bI6Ra5zlTle5znu5mKm3LsibK1qpZAAVtpeFDPcyzfE8 s4jOIGq1HocGuDLzY7JS41TWWjS5MRUiq6lInyOnezdVam7Gou/TZXNXecZ0G9jvElmXEL7K/KPZ dYaCyeaPIeTyXyZd+97/ALxefm/g923b41JZAETaV6De1nrBq1qv7K/OXtpVtrrPIPIe583eR074 eXve8d33Pz82/KzbbbZfE1jEuD/E7diGtGBZxe1yax6y5bdMnrIG0fkj6BtZyK2Fj+8fzvidG17Z dm+kiLyJsWAAFWKfhH1zmxii0vvXGdlM+AUTYaVKOix6lor1LRRKnJTvurHq/wAGtasjY2vciLuv VSfqjULTTGZPMFy1Bx+iqKBrYHwVt6iSdmzU2R/eP51dtsu7uq77rvubSR3kXDlw95feqvJct0I0 7vd3r3pJVV9xxehqamoeiInNJLJErnrsiJuqr0RAMxHq1pVNI2GHUzFJJJHI1rG3mmVXKvgiJz9V IRpOF/X3DPOFh0k4xL1YcTrKuoqqa23nFqW+Vlv756vfHBWzytfyo5zuVJGv5fn6qsk0/CtwwUlR FV0nDhpdDPC9skUseH29r2PRd0c1Uh3RUVN0VCUQK31PAvpgvD9juhNrv9/t8+JXRuRWXKYpmLdK W9JK+Va3m5eVVV8j92bbcqoibK1rk7mP8OmtNfmOOZHrLxV33LrditY240Nos1igx6GqqmtVrX1r 6eRz6hiI5d4t2xqvi1UVUWwgAgDVDhdv991Zk110T1irtMs2uNtjtF6nbZ4LtQ3amjXeJZqWVzE7 1myI2RHoqNaibeO+trwOUlRozqpgl41UuN4zjWJYpMmzWvtsbnyyRKnctjpI3sYyGNqOayNH9Odf S2RGpaMAaDftGcTzPRR2hecRrdrHU2KGx1jmp3L5Wxxta2ZnVe7ejmNe3qvK5E8diFqfhH1zmxii 0vvXGdlM+AUTYaVKOix6lor1LRRKnJTvurHq/wAGtasjY2vciLuvVS04AgfXrhlvOqWW6caj6d6r VWBZfpmtdFbLlJamXhk1PVwNhmjlinkbzuVjNkerlX0nKqKqoqTfbYKymt1LTXCu8tqooWMnqe6S Pv5EaiOfyJ0bzLuuydE32OyAAAAAACnnFv8ADJ4Uf8Ov0VATAQ/xb/DJ4Uf8Ov0VATAUsT68eD0f JHsJ8fpAAa/muaWvCLR5xrmSVFRO9IKKihTmmq53dGxsanVVVVTrt0/iRa0zERnLr0UVXKoppjOZ dPPsurbJFR49jNO2uym/SeS2mj8d3r4yv+KNibqqr06fFuqSVgumdy0x03rrNitVQ1mW1sM1XNcr hzpFVXN7V2klVqK/ukdsmyJvyp8aqpitFdKq+wS1Go2fMZPmV6YiPai8zLZTeLaWL4tv3yp4r069 VdLRbw1mY/iV7eru/wBuHyvj6a46JYnOmNs9qfKOrfOvdlULQnsz9C9Mb1LqBqZ3uqme11VJcK27 5BC1aXyuR6vklio91Zur1V3NIsjkd1arfAt2xjI2NjjajWtREa1E2RE+JD6BbcFFnENw84ZxFYZH juRTVNqvNqnSvx3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrmxxw88Q2Z0WZycMXE7DTWrVS1QLJ a7pGnJQZjQN35aykdsid7s1e8i6Kio5URNnsZZoiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2Sv bsrKiB6Ki7btbzM3RHIieCo1zQ6envD97A+IbVbXn2W+Xe2dDZovNXkHdeb/ACClSDfvu8d3vPtz e8Zy+HpeJis94Y3XfXzHOI3TLOfYTldDH5vyRrbZ5ZS5LbOm1PUxpLFtI1GpyTbuVuzOi8jdtZ4e eIbM6LM5OGLidhprVqpaoFktd0jTkoMxoG78tZSO2RO92aveRdFRUcqImz2Ms0BVfJOEfWmm1+1B 110c4oKfBZdQ2WyOvt02DU925G0VIyCNElmqW77q17ujG+/2XfbcyuC8HdxXUy06xcRGtd71eynG lV+Psq7bBa7VaZV23nhoYFVnfdE2erl6oi7K5rXNsmAIgvfD9544pMd4lfZb3PmDFajGfMvkHN3/ AHsz5O/8o7xOXbn25O7XfbfmTwJfBEHEfxH41w941RySW6pyLMMin834ti1v9OtvFa7ZGsY1EVWx oqt55NtmoqeLla1QcR/EfjXD3jVHJJbqnIswyKfzfi2LW/0628VrtkaxjURVbGiq3nk22aip4uVr V1Dhw4cMlsWS1nERxEXGmyLWPIoO7c6P06LGKJ2/LbqBu6o1ERVR8idXKrkRVRXOkcOHDhktiyWs 4iOIi402Rax5FB3bnR+nRYxRO35bdQN3VGoiKqPkTq5VciKqK50ljgAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAU+4xdNl0VuMHHJotaqO2ZdhKKuYUNNAkUeV2OaSNtTHU8iJzTR7NkZK7qnJ6 XNyRo24Jr2omOU+Yaf5NiVXTtqIL3Z623SxOTdJGTQPjVqp60VHbAZDHL/a8rx615TY6hKi3Xmig uFHKn++QSsR7Hfja5FMiVx7Oq+y5FwVaV18075XRWqahRznKqo2mq5oGt/AiRIiJ6kTYscAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVezf8A7BOQf9IGSf0xxaoqr2b/APYJyD/p AyT+mOLVAAAAAAAAAAAAAAEWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K+yV7dlZUQPRUXbdreZm6 I5ETwVGubHHDzxDZnRZnJwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uzV7yLoqKjlRE2exlmiL OIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK9uysqIHoqLtu1vMzdEciJ4KjXNCUwVl4eeIbM6LM5 OGLidhprVqpaoFktd0jTkoMxoG78tZSO2RO92aveRdFRUcqImz2M3viP4j8a4e8ao5JLdU5FmGRT +b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytaoOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12 yNYxqIqtjRVbzybbNRU8XK1q6hw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ ROrlVyIqornSOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6Sx wAAAAAAAAAAAfMkcc0boZo2vje1Wua5N0ci+KKnrQrXm2EXXQS5VGV4nRz12n1ZKs1ytkSK+SzPc vWeFPXD/AAm/vfwdUssfL2MkY6ORjXseitc1yboqL4oqEN6zF2O/qlfwGPrwFczEZ0ztjqnymOqe rwzhClsudvvNvgutqrIqqkqmJJFNG7dr2r8X/wDvQ7RrucaUZDpZXVGZ6R0ElfYppFmu2Ls8Wb++ mo/iX44/Xt09SN7WLZbYcytbbtYK5s8W/LIxU5ZIX+tkjV6tcnxL+LdOpz5zoq0a9U/vY9VRNu/b 56xOdPxid0x1T8J6modlx8BPTL8tfpitLVFVey4+Anpl+Wv0xWlqjrPDAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAKecW/wAMnhR/w6/RUBMBD/Fv8MnhR/w6/RUBuuYZ7Bj9RBj9kt8t8ye4 ejQ2il6yPVf38i/73Gnirl9W/wASqlHFTFNWcvTciUVXLM0075+UO3mma2jCLW2vuPeTVFQ9IaKi gTmnq5l6NjjanVVVVT8G/wCAzWkWkV3W7s1V1UjjlyWVipbbai80NlhX9631LMqe+d6uqId7SrRW ax3BmoGpFXFecymZsxWpvTWti/71TtXwXqqK/wAV67eKq6WzNjDzM6dz3R5tOUeVKaaZw2EnPPVV Vv7qe7fO2fDaABdecAAAAAEWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K+yV7dlZUQPRUXbdreZm6 I5ETwVGubHHDzxDZnRZnJwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uzV7yLoqKjlRE2exlmiL OIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK9uysqIHoqLtu1vMzdEciJ4KjXNCUwVl4eeIbM6LM5 OGLidhprVqpaoFktd0jTkoMxoG78tZSO2RO92aveRdFRUcqImz2M3viP4j8a4e8ao5JLdU5FmGRT +b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytaoOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12 yNYxqIqtjRVbzybbNRU8XK1q6hw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ ROrlVyIqornSOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6Sx wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVV7Lj4CemX5a/TFaWqKq9lx8BPTL8tfp itLVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVXs3/wCwTkH/AEgZJ/THFqiq vZv/ANgnIP8ApAyT+mOLVAAAAAAAAAAAAAAAAARZxDcPOGcRWGR47kU1Tarzap0r8dyKgXkr7JXt 2VlRA9FRdt2t5mbojkRPBUa5uicOHCzkGBZLWa1cQGbR6iavXCDyBt6WLlpbTQN3a2noo1a1I1e3 0pHo1qqr3InRXK+xwAAAAAAAAAAAAAAAAAEQ6laFLdbrPn2mVxjx/LXN3nRU/qK57deSoYnrX/hE Tf4912VJeBpct03Y0alnC4u9g7nOWZyn4TG6Y64eZXD7Jx18PuI2vhrst20Ys7sZdUpRU+SUlzdU 1bZ6mWoc+OWJUimbzyvROVEXZE6LsqkyeyztK/t5w8fQLx+sWszzTnD9SbR5ny60R1cbFV8EyLyT 0z/4cUidWr4fMu3VFToQhd8Z1V0dVXSxVWeYjEnSqhbvdaJiePeM/wB/aifvk6+KrsnQrXK71rXO uN/m6+Escn46Ipp+zXumdU/ln6Tr3TLQvZZ2lf284ePoF4/WHss7Sv7ecPH0C8frEq4vmGN5nQJc sbu0NZEmyPa1dnxKv717F6tX8KGZI4xNcxnErNXJFiidGqmYlCPss7Sv7ecPH0C8frD2WdpX9vOH j6BeP1ibgZ6RW19F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/b zh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOk VnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2Wd pX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss 7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+s TcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9 YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4 oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frHzJl/aTxRull v/DsxjEVznOobwiNRPFVXm6ISNlWo+P4xVxWZiVF1vlSqNprRbo1mqpXKnROVPep86+rw3O1YdFM 21LkjuuslWtosnMkkOL26dd5W7dEq527K7+4b0+dq9DEYi7XOjRrn97W1zkvB4ejncROjT1b58I6 /HZvlV63Y9xl8Sev+A5lfb1pjPRaYed42XrHKStjpIluNKkEvWp3Sd7UYxWtZsniq7p4Xq0x0hxn TGmqJqF01yvVw9K43isXnqap3rTf96zfwYnTom+69TbrRZ7VYLbT2eyW6noaGlYkcNPBGjGRtT1I iHcLVFrXp166v3sca/jvsTh8NGjbmc8s85nZtn3bNkfEABM54AAAAAAAAAAIs4huHnDOIrDI8dyK aptV5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc3ROHDhZyDAslrNauIDNo9RNXrhB5A29 LFy0tpoG7tbT0Uatakavb6Uj0a1VV7kTorlfY4AAAAAAAAAAAAAAAAAAAAAOvX3G32undV3Oup6S BvvpZ5WxsT8KuVEGxmImZyh2AR3euIfROwK5tw1Jsz1b4pSSrVqn/go416Tiu0uk/wBx6PJ7wnqW hsszkd+DnRpDOItU6pqjivW+SsddjOmzVlvynLimUEJu4o7U/wD2rpDqXKnqctja1F/BvKE4oaFv WbRvUtqfGyzMf/8A3TXpVntJfQuP/DnjHmmwEMM4q8CjX/ZXFs2tSetayxvRE/DyucZa1cTmhl2e kMWf0lNLvsrK2Cam5V+JVkY1P8ptGJsz96GlfJGPojObNWXdEz8kogxdlyjGcki77Hcitl0j235q KrjnTb8LFUyhLExOuFCqmqidGqMpAAZagAAAAAAAAAAqr2XHwE9Mvy1+mK0tUVV7Lj4CemX5a/TF aWqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZv/ANgnIP8ApAyT+mOLVFVe zf8A7BOQf9IGSf0xxaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMc94f8OzC4OyWzy1 OL5L1VLtal7t8ir499H72VF2677KvxkbXSp1Z0w3bqDjC5FZ4/8A+vWGJXOY3+FPTe+Z87m+inq3 LLgrXMNRXOdOqf31OvheWb9iIt3ft0R1TtjwnbHhrjuQHjWY4xmFJ5bjV7pa+NERXJG/02f3TF2c 1fwohmTNZtw/acZpVuvKW2WxXzdXNu1ml8kqUd/Cdy+i9fDq5FXp4oaBX4Br1gm7rXU23UG1s6oy VUobk1qerdd437J69+ZdvDqVarVy3tjOO7y2/N27ONweK9nXozuq1cKtnHR8Gyg0Sk1ixeGtSz5d TXHErn4LS3uldTb7dFVsi+grfiVVTc3amqqatgZU0dRFPDIm7JIno5rk+ZU6KRxVFWxartV29dUe XulygA2RgAAAAAAAAAAAAAAAAAAAHQvF/sePUy1l9u9Hb4f4dTM2NF+ZN16r8yGJnJmKZqnKHfBo VNqjU5VM6i0swm9ZbNurPKYoVpqFjvDZ1RKiInX5uuy9TYbfojqpmipNqRncdgt7/fWjG0VJHN/g yVT+qLt0VGoqLv6hTnc9SM/lxZu83hdeJrijunXV/bGvjlHe6OT6mYjitQ23Vde+sukq8sVsoI1q KuR3qakbfBV/ttj6teC60am7SXST2u7BJ+8aqTXedn+jBv8A4yfEpL2DaU6f6cQLHiGM0tHM9Npa tUWSpl+Pnldu9d167b7deiIbaWaMJM67k+6PP/45GI5cpo+zhKNfaq1z7qdke/Safp9pNgumVM+L FbM2OqnT+qa+d3e1dSu+6rJK7qvXrsmyfMbgAW6aYojKmMocC7euX65uXapmZ651gANkYAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAw+U5fjGE2mS+ZZe6W2UMXRZZ37cy/wWp4ud8zUVfmIUu2tepGoiup tJ7CmP2Z/T2Q3qHeWRv8Knpv8zn7oqepFIbl+i1qnbu61/B8m4jG/aojKnrqnVHHr8IznuTbkmWY zh1vddcpv1DaqRvTvaqZsaOX4m79XL8ybqRJceJnz291LpLgF2yfrypcqpPILf8AhR8icz9vHblR TVrbpPYUuKX/AC+srMtva7KtdeJFn5V+KONfQYiepNl226Kbs1rWNRjGo1rU2RETZEQqVYi7Xs1R xnyd2zyVg8PrrzuTwp4RrnjHg1Ksl17y/dcj1IpMapX9VoscpNnonqTyiXd6KnzdNzHxaI4LLUpX 5DHc8jrU/wDzN5uEtS9fj3TdGr/Eb8CGaYq11a/HW6NF6q1GVmIoj+mIj4xrn3yxVrxTGLIiJZ8d tlDy+C09JHGv8aIZUAzERGxHVVNU51TmAAywHUr7Rabqzu7pbKSsZtty1ELZE/icinbBjazEzE5w 0e5aKaZ3GVKlmMQ0FS1eaOe3yPpXRr8ad2qJ/kPukxzVTE9nYLrDdnws8KG/sbcInJ/BSRyI9if3 PU3UGsURE506vDUlqxFdcaNz7UbqoiqPjmw9Dr7qLi20epumD6ulb0fdMZkWoYnxuWneqSNT1qu/ 4iTcH1Z081Gj3xDKKOsnam8lI5ViqY/j5on7PTbr1226eJpRq2UaZ4dlkqVtxtSQXBio6O4Ublgq o3J4OSRuyqqerfdCam/do6847/NQvcnYLEfdmid9OuP7Z+kx4LGArhbMt1t0wVGvqPbEx+PxjqFS K7QM/tZPCfbqvpbuXwTYlvTzV7BtTYXpjl0VlfAn9VWyrZ3NZTL60fGvXp8bd0+ct28RRcnR2Tul w8ZyTiMJTzkfao7UbPfG2PfHhm3QAE7mAAAAACqvZcfAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpaoAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARBxH8R+NcPeNUckluqcizDIp/N+LYtb/ AE628VrtkaxjURVbGiq3nk22aip4uVrVCNOzf/sE5B/0gZJ/THFqikXAVmd60brLvwpa/WRMT1Ir brW5XbGOla+ivdLWOSWTyOZqq2R8T+8a5iKqojV235X8t3QAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAADoXmxWTIqJ1tv9norlSP99BVwNljX/quRUIruvC3p8s8lfhNwveG1j15ldaK 5zYXO/toX8zVT5k5UJjBHXaouetGa1h8dicJ7GuY7s9XvjZKvlXplxCYxutnybG8xpWeDK+ndQVS p6kRWbxqvzuUw9TnWbY5u3OdG8ptyN6PqLfG2407fnWSJeifiLNggnB0/dmY+P74upb5eubL1umr vj7M/DV8FZbZrVphc39yzLaWlmReV0dcjqVzV+Je8Rqf5TbaC62u6R97bLlS1bPHmgmbIn8bVUli 94ni2SsWPIsbtd0aqbbVlHHMm3/XRTQbrww6HXWTv1wWCim33bJQVM1MrV+ZI3o3/IRThrsbJifh 5rlHLGCr9emqnhV+ljwdeXhax+n64/qTn1p297FFeEkhT/qPYu/8Z1ZOHvUam/3H1+uUaJ4NrbHT 1O/4VVyGk2r0fd+Mf6WKcdgK9l7Lxpq+kSyQMK7RzXqn6U2q+PVm3rqLIse/+I5TjXTLiRj6R5Vg U3zyUtU3/MY0LnZn4eaSL+EnZep/y+tLPAwHtb8S69Fv2nSfOkVZ9R9JpdxGy/uuZYPB/wDKoqh/ +kY0bnZk57CxtvU8Z8mdBh2aKa5VP+2tZ7TRb+K0uPMl2/x3IdiPhzzCq/3c15yGZF8fIaGCj/i2 5tjPN3Z+5Pw82s4vBU7b8e6Kp/8AXL4sgYy6ZRjVkRVvOQ22h5fFKiqZGv8AE5UO/FwqYHNt7Icp zS/7++bcL29Wr+KNG9DYbJw7aJWBWuoNN7RI5vg6sjdVrv8AH9mVxvGHvT1RHv8A9IKuVMBRsqqq 8KYj4zP0RLUa4aeJUeRWm5VV7q/VT2uilqHu/AqN5V/jO3S3rWDJtkxHRi5U0T/CqyCpZQo1PjWJ VV6/iLF2+12y0QJS2q3UtFCnhHTwtjan4moiHaJIwkz61XCP/qrXy7bp9jZ/umZ+EaP1QFSaJayZ Hs7NNUqKx07ur6PHKNVd+BKiX0mr+BFNsxrhr0kx6qS5VdhlyC5Jsq1t9ndWyOVPBVa/7Hvv60ah KIJacNap15Z+OtQvcs429Gjp6Mbqfs/LXPvzccMENNCynp4WRRRojWMY1GtaiepEToiHIAWHL2gA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABxVVVS0NNLWVtTFT08DFklllejGRsRN1c5y9ERE9agiM9 UOUh/UPXyK23WbB9MLYzJ8pYm06tf/UNu3XbmqJUXxT+A1d+ioqovRdRynU3KdaaqqxzTitqLHhk bnQVuQNaram47dHR0qL7xnqWTx/B4LlcYxWw4daorNj1ujpKaNOvKnpSO9bnu8XOX41KF3EzX9m1 s3+Xm9Pg+R6MPEXMZGdXVRu/N+mNe+Y2Net2nM10u7Mu1PvL8ryBu6xOqG7UdGirvyQQ+9aiL61T fdN9kU3cArxTEOpXcquZZ7I2RsiPCNkAANmgAAAAAAAAAAAAAAAAatlmnVhyqohu289svdIqPpLv QP7mqgeidF5098ifEvz7bG0gxMRVGUt6LlVudKicpYHGtb8r05qIbBrZElZa3ubDS5XRw7Rqq9ES rjT9zd/bJ0/D1cT3R1lJcKWKuoKqGppp2JJFNC9Hskavg5rk6Ki/GhDtTS01bTyUlZTxTwStVkkU rEcx7V8UVF6Kho9t9mGhNRLdsChnvWIySrNX429yukpUXq6WjcvVPWqx+C/P4tlt4iq1qr1x8Y8/ moYvku1jft2Iii5u2U1eHZn4T3LQAwOFZvjWoWP0+TYpco6yiqE2Xbo+J6eMcjfFj09aL+Hqiopn joRMVRnDy1y3VaqmiuMpjbEgAMtFVey4+Anpl+Wv0xWlqiqvZcfAT0y/LX6YrS1QAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVdSe0f0G0+zbIM DtuO5/nFdiPOmQ1GJ2JK2ltKxqqSd/K+SNGoxUVHOTdqKipvuiokrYrxPaJ5hohNxEWrNIGYNR00 tRW108T2PpFiXaSKSLbnSVHbNRiIquVzeXmRzVUJUBTuh7Uvh5ldRXK84bqjYMWuNQlPS5ZdMWWO zyqqqiObMyRz1TovgzfovTopLWvXF5o3w80GPTZbXXO83HLfSsNnx2j8vrrkz0fTiYjkarV52bKr k5ld6O+y7BNQK+aH8b+juuWczaXUVry7Ds0jpnVkeP5fZ1t1ZPC1OZz40Rz2u2b6XLzI7lRXIio1 VTNaB8WGnXEXmGoeFYTZcjoq7TS4x2y7SXWmgiinlfLURosCxzSK5vNSydXoxdlb06qiBNIIK0r4 w9NNX8z1TwbGbDlFPcNIqiemvb62mp2RVL4pZ4neSqydyvRXUz9udI+it8N1RIgb2tPDDJp/DqBF Y8/ljkrZaSW2RWinkraWNnd/1TPy1CwxQudIjWK6Tmc5r0Rq8qgXUBUXOO1G4WcMsGP5JTVeUZLR X6kirXusdqSbzYyR72NbWLJJG2KTnjkTu0Vz/QVdtlaqzJl/FFojg+iVFxCZBmkMeFXSmgqLdVxx PfLWOmaro4YokTnWVdnbs2RW8r+blRrlQJWBWPS/tB9E9Ss8smnVdjWfYLdsoYj8edmFh83wXjf3 vk0iSPR3N+9V3KjlVERVcqItnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARBxH8R+NcPeNUckluqc izDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZqKni5WtUHEfxH41w941RySW6pyLMMin834ti1v8A TrbxWu2RrGNRFVsaKreeTbZqKni5WtXUOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7q jURFVHyJ1cquRFVFc6Rw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlVyI qornSWOAiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zY54eeI bM6LM5OGLidhprVqnaoFktd0jTkoMwoG78tZSO2RO92aveRdFRUcqImzmssyRZxDcPOGcRWGR47k U1Tarzap0r8dyKgXkr7JXt2VlRA9FRdt2t5mbojkRPBUa5oSmCs3DzxDZnRZnJwxcTsNNatU7VAs lrukaclBmFA3flrKR2yJ3uzV7yLoqKjlRE2c1lmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfEsscEb5p pGxxxtVz3uXZGonVVVV8EA4Lnc7fZbfU3a7VsNJRUcTpp55no1kbGpurlVfBEQrXfMhvXEPcO8lS qtmm9JLvT0y7xz317V6SSetsO6dG+K+Pj73kyvJJeITIHUFHJLHpxZajZyoqt8+1TF8f/kMVOnxq m/j7zdIoooImQQRMjjjajGMY1Ea1qJsiIieCIc29e56dGn1fn/r5vXcn4COT6Yu3I/iz/h/+v+vj s+aWlpqGmio6OnjgghajI4o2o1rGp4IiJ0RDlANFraAAAAAAAAA1XN9VtMtNFpG6h5/j+NLXo9aV LrcYqXvuTbm5Odyc23Mm+3xoat7qnho+75gH5wUv65mKZnZDSblFM5TMJTBFnuqeGj7vmAfnBS/r j3VPDR93zAPzgpf1xozuY5632o4pTBFnuqeGj7vmAfnBS/rj3VPDR93zAPzgpf1xozuOet9qOKUw RZ7qnho+75gH5wUv6491Tw0fd8wD84KX9caM7jnrfajilMEWe6p4aPu+YB+cFL+uPdU8NH3fMA/O Cl/XGjO45632o4pTBFnuqeGj7vmAfnBS/rj3VPDR93zAPzgpf1xozuOet9qOKUwRZ7qnho+75gH5 wUv65v2L5VjObWKmyfD7/b73aK3n8nrqCobPBNyPcx/K9iq1dntc1dl6K1U9QmJja2prpqnKmc2t XWxZJgV+k1H0pY1K1/pXeyKvLT3aNOqqiJ7yZOuzk8V/CqOnTTjUbHNT8biyPHJ3cvMsVVSypyz0 k6e+ilb6nJ/EqbKnRTRTRb5Q3zTrJXar6fUrpZ9kS/2hi7MulMni9qJ4TNTdUXbr8/VHLdybE5x6 vX5w0xeEo5So0Z1XI2Tv/pn6T1bJ1bLOgwmGZjj+fY3RZVjFc2qoK5nMx3g5jv3zHp+9c1eip8Zm zpxMVRnDx1dFVuqaK4ymNUwqr2XHwE9Mvy1+mK0tUVV7Lj4CemX5a/TFaWqMtQAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPxeibn6APJrRrWvVTiAxn W7V22a3YPoLitkWRtXYbXhFqqKu4xOjmcxKmWdqSvkdu5iLu5XyPejWt8F5eAyi0hybs3NXMK1vz NMbxirzCojuFcjlWWg5qa2eTzciI5dvKGs2RU2c5Fb6y98HBFwpU+pi6vxaKWNMqdWecPKldMsCV XNzd8lKr/J0fzelzJHvzdfHqd/EuD/hqwa9ZZfsY0jtFLU5xTS0d/jkfNPTVsEr0kkiWnle6FjFc iLysY1OiAefuWVfEzwk6C2vMsZ4i9KtbNFbaygZbrDfbfC+WalfIxIEiiciyLyczV5EnV0aN3Ruz V2l/iLxnS3iLuWgmoGP660+iGslVjVHe8ToaqFXxrTVEPfNgcvoMYrHJIxrt9nbuZyO5mok52ns5 OCiy3+PJKLQS0OrIpElayprq2ppuZF3600szoVT+1Vm3zEl6v8OmiWvdoorJq5p1a8hpbbv5EsvP DNSoqIjmxTQuZJG1dm7ta5EXlTdOiAUy0f104hdOeM3EOHziPqtNtTLpktslW3Zdj9HClzt8TY6h 7WyPjjjVrPscqOjVidJFej1TdHYLs3swxfBuJzisxzMcgt9kr6nJFq44rhUsp+aKlrrkk7kV6omz O/jVV9SORfAulo1wi8OHD9cpr3pHpVbLFc54lhdXumnrKpI198xs1RJI9jV2TdGqiLsm++x0M94K OFjU/P11QzvRqzXXJHvZJNVvlnjZUvaiIjp4I5GxTLsiIqyMduiIi7oBSbs8shtmXa0cYuWWSfvr de6mquNHJsqc8E1XcZI3bL16tci/jMf2e+PWWq7NLiIrqi2wSVFcuSU88jmIrnxw2OB8TVX+0fJI 5vxK5VQ9CcG4atEtNsjzPLcIwdlqumoLnvyOWOvqnsrVc6Ry7RvkVkKbyydImsRObp0RNuPTvhi0 O0o0xv8Ao3gGEea8Pyh1W67W3zlWT+ULU07Kef7LLK6VnNFGxvoPTbbdNlVVA8+uH/HrL/7HHUmd bbAslf53rqlysTeSeGaJInr8atSGPZfVyoQxr1R36fs3uFu8pPNHYqK9XmG4T9z3zIZn1k/k7nMX o7ZkdRsi+PVPWetmP8MWh2LaNV/D9YsI8lwG6MnZV2jzlWP7xszuaVO/dKsybr16PTb1bHetHD1o xZdIIdBKXALfPgFPFJDHZK58lbEjXzOmX053PkVe8e56OV27V25VTZNgohq/ovWah5FpVJrN2m2P 5BWOu0FzwiGl0+oY5aioWSHlWF9FUI7Z7u6ROb0VXbbdUPTMg7Szgk4WNFspZmum+jtqtl8hVywV 01RU1slOrkVFWHymSRIl2VU3ZsuyqngpOIAAAAAAAAAAAAAAAAAAAAAAAAAAAACIOI/iPxrh7xqj kkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNRU8XK1qg4j+I/GuHvGqOSS3VORZhkU/m/F sWt/p1t4rXbI1jGoiq2NFVvPJts1FTxcrWrqHDhw4ZLYslrOIjiIuNNkWseRQd250fp0WMUTt+W3 UDd1RqIiqj5E6uVXIiqiudI4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNREVUfInV yq5EVUVzpLHAAUxxHXTjZ1k1N1YxrSOn0QobHpxltTjkS5HRXbyuoaxV5HudTzqxV5UTdUa3r4NN wwnie1Tw3VuxaF8VunNlxm8Zf3jMXyfG66Spsd4qGIiuptpkSWnl6pytfvzK5E2TdquCzwK5av8A EJqt7eVLw08O+G41c8wbYPZPeLvlNZNDa7XQrN3LGrHAnezSOcqdGqiIjm+O7lZj7bqxxjacai4p jmuGlGI5Xi+W16Wtb9pxBcZH2WZybskraeo53JB0XmlRyNYiKqruiNcElcQ3DzhnEVhkeO5FNU2q 82qdK/HcioF5K+yV7dlZUQPRUXbdreZm6I5ETwVGubHPDzxDZnRZnJwxcTsNNatU7VAslrukaclB mFA3flrKR2yJ3uzV7yLoqKjlRE2c1lmSLOIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK9uysqIHo qLtu1vMzdEciJ4KjXNCUwVm4eeIbM6LM5OGLidhprVqnaoFktd0jTkoMwoG78tZSO2RO92aveRdF RUcqImzmssyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAr/rTl9fqHkcuimJ1LorbToyTK7jC7qyJeqUTFT9+/ 998SdPU5DedcNS6nT3GYaSwRtqMoyCbzfZKZU33mXbmlcn8CNF5lVem/Ki9FNBwPDqbCrBHbGzLU 1sz3VNwrHbq+qqX9XyOVeq7r4b+pEKWKuZzzVPv8vf8AJ6PkbBxbp6bdj8kd8bavCOrv8GZttuob RQU9rtlLHTUlLGkUMUabNY1PBEOyAVnWmZmc5AAZYAAAAAAjHXXXWx6K2Oja221OQZbkE6UGNY1Q Jz1l2rHbI1jGoiqjEVU5n7bIi+tVRFa6662PRWx0bW22pyDLcgnSgxrGqBOesu1Y7ZGsY1EVUYiq nM/bZEX1qqIua4X+F++YdfKnX3X2upsg1gyCDu3Oj9Ojxqjdvtb6FOqJsiqkkqdXKrkRVRXOkmtW tPXOxzsdjow0aFHrfJi9BeDajfJX6ucV1psWe6l5RE1tRR19JFWWvHqTfmZQUcUiOZ6K+/l6qrt9 lVFc6SYvcz8OH3v2m35qUH7IkkF6Iy1Q8zVVNU6VW1G3uZ+HD737Tb81KD9kPcz8OH3v2m35qUH7 IkkGWEbe5n4cPvftNvzUoP2Q9zPw4fe/abfmpQfsiSQBG3uZ+HD737Tb81KD9kPcz8OH3v2m35qU H7IkkARt7mfhw+9+02/NSg/ZD3M/Dh979pt+alB+yJJAEbe5n4cPvftNvzUoP2Q9zPw4fe/abfmp QfsiSQBG3uZ+HD737Tb81KD9kVU7Oj4G2n35W/StWX0KF9nR8DbT78rfpWrK+J9SPF1eSPbz4fWF kQAUno2iUl3n0GzN+V0ULlwjIZ2Mv1LGm6W+pcqNbWMang1eiPRP8voolm4J4amGOpppmSxStR8c jHI5r2qm6Kip0VFT1kL19BR3ShnttxpmVFLVRuimiem7Xscmyov4joaDZTWYZf59DMlqnSxwxurM Xq5N956PdVdTqvrfF12/td/BEQlw9zm6tCdk7O6f9qXKuE6XanE0evTH2u+nf409fdr6paf2XHwE 9Mvy1+mK0tUVV7Lj4CemX5a/TFaWqOg8oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA85eLPUHX2k7SPTLSvSLVO8Y/T5JikcTqN9ZNLa4ZJluUUl a+h50hnlijakrEemyvgi3XZOmOxfIOIThW7QrCdCsq4gcp1MxDUa2+VPZf53yuh7xKljeRrnOSJ7 JqZF3j5Wqx/Kqb+AelYPOJmb648bvGJqVo5jOuGT6XadaVPnoZExafyavrqqKdadznTtVHelIyZy bqrWsjaiN3crzPcLer2tWkvGllfBPq3qXcNRLQy3rcsevl1Tmr417iOpRkkiqrnosT3tdzOds+JF bsjlQC7WpWe2fSzT3JNSsgpqyotmL2qpu9ZFRsa+eSGCN0j2xte5rVcqNXZFc1N/FUKaU/bGcOlV R+coNKtYn0Sb81S2xULomoniquStVOnrLH8Y3wT9Yf7yLz/RJDz14Ge0a4f+HThqtOlmd27La2/0 FXXzvhtltimjlSad72Na98rd1VHIi7onUD0Q0P4qdEuIPT+46k6fZbH5qsiOW8suDPJZ7XysV6rU NcuzW8iOdzoqsVGu2cvK7aB7t2s3DRS1lemOYtqZlVqtr1ZU3qy46x9CxE8XK6aaN7W7dd1YnQhH gM4bs51PwjiRy+943WaeY3rbTVdsx2hmgdH3Mc7qp6StiVGq6GJKiNjVRER6d4ibIh+6L5hxv8Au ArpHlvCS3UTCbTU1VRBdsYqVklfFLIr5HvWJkrnNRVcqd7DG5G9FXZE2C6uJcX+imfaDZHxEYRd6 29Y3ilDV1t1pYKdGXCndTw97JA6GVzUSTk2Vu7ka7dFR23UzWhHEVgPEDpDDrbjENysuOSuq0e6/ NhppIG0z3Nlkk5JXxtYnIq78/h1XYqNheq3CzqlwPcQVdw46dQYLW0+JXP2S2VaRkNQyV1HUdzI5 zFckjF2lRjt025XIrW+BQmzaz6s1PCVh2klXj+TY9ofR5M+lzDJrXTK99xfUVLplpmOdsxUjiRV7 vfZ0nLzrtyooew+gHGPp1xMZbkePaU4nmVbZ8ZlfBU5VU0MENnnkRfRZDIs/fPc5PSRO6RUbsruX du88kf6CYnpNhmkWMWXQ6ChZhS0EVRapqN3O2qjkaju/c/xfI/fmc53pKqrv8RIAAAAAAAAAAAAA AAAAAAAAAAAAAAAfMiSLG5InNa9UXlc5vMiL6lVN03T5t0KL8MCx2Hi1zej4r2udr5cVkXFbjUu3 tFTj2y8sdkRyfY9vT7xq7y7c26798heoiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6 Ki7btbzM3RHIieCo1zQlMFZeHniGzOizOThi4nYaa1aqWqBZLXdI05KDMaBu/LWUjtkTvdmr3kXR UVHKiJs9jLNAVA4Ff7LfFP8A9KtZ/mccXaMSwXFdAMQtLmuyu5avWSqtLGfuzIoEk7+ZPWjGLJDz L4Ju1V8Du2/g81+wjUHUTM9HuLimxGi1EyKoyKst0untNclhlkVdmpNNVbu5UXbdGtRdt9jc9I+E aPEdSk1w1h1Tvmq2o0FM+jt93ulNFR0lqgeio9tFRQ7xwK5HORzkVeirttzO5g+NceGOxav6lUmp 2m+sN3041Xxu3NtrrvZJIqhX0L3ueyGto3rtLHzczmo5W7+vm5W8sa5HrBxecJV1xmv4g73hep+n N9vlLYKm/wBqoHWq826aocrY5padv2B8fRVVrEVem27em8m6r8JlVlGqkmu+jer970s1ArKKO3XS voaGC4UV1p40RI0qqOfZkj2ta1qO5k2RqdN0RUwsHB7nmdZTj1/4meJC76nW7FLjFeLXj9Nj1LY7 YtdFv3U1RHC57qjlVVVEc5E6qnVquaoWeAIg4j+I/GuHvGqOSS3VORZhkU/m/FsWt/p1t4rXbI1j Goiq2NFVvPJts1FTxcrWqEX9ojVaRy6V22x5ZQ3O4ajVtc32tqbHnct9be9293JSuaiuZGjuTvVV OXl2/f8Ad7TloRS6uUWkeMU2u1dbKvOmULEvEtubtF3vqRVReV0iN5edzNmK/m5U5diLuHDhwyWx ZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6SxwAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AA4qmpp6KmlrKuZkMEDHSyyPXZrGNTdXKvqRETc5SE+JLIqu4Uto0dsVS6Kvy+RfL5We+p7ZGu8z vmV+3Inx+khHduRaompbwOFqxt+mzGrPbO6I1zPuhpmMV1Rqjm1x1juccjaJee24zBIip3VE1yo6 blXwfIu6/Gibp1TY3w69voKS10NPbLfA2GmpYmwwxtToxjU2RE/Eh2DmRE7Z2vYXKqZmIojKmNUR uiNn++8ABs0AAAAAAjHXXXWx6K2Oja221OQZbkE6UGNY1QJz1l2rHbI1jGoiqjEVU5n7bIi+tVRF a6662PRWx0bW22pyDLcgnSgxrGqBOesu1Y7ZGsY1EVUYiqnM/bZEX1qqIua4X+F++YdfKnX3X2up sg1gyCDu3Oj9Ojxqjdvtb6FOqJsiqkkqdXKrkRVRXOkmtWtPXOxzsdjow0aFHrfI4X+F++YdfKnX 3X2upsg1gyCDu3Oj9Ojxqjdvtb6FOqJsiqkkqdXKrkRVRXOksuAXojLVDzNVU1TpVbQAGWAAAAAA AAAAAAAAKF9nR8DbT78rfpWrL6FC+zo+Btp9+Vv0rVlfE+pHi6vJHt58PrCyIAKT0YalqRi9ffrR BdMemWnyKwztuNoqGrsrZ2deRfja9E5VTw8N/A20GJjSjJvbrm3VFUdSM+yzqaefgX05ihmY99O+ 8xStau6set2q3cq/EvK5q/gVC15509ltkVXgOkWAWy41LlseoMdz7hXe9p7nBcKliN+ZJI2tT53I ieo9FjpW7kXM+6cnj8VhasLoTtiqmKonxjXwnOPcAAkVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABSzV7h41hyjtJtKtfrFiHlOB43jraG6XbzhSs8n n2uPodw6RJn/AO2IerWKnp+PRdv3X7h51hzbtB9GNcMYxDy3CcTtUVNeLp5wpY/JpEmrHK3uXyJM /pNGu7GOT0vmXa6QAoPf+HHid4auKjM+Ifhgw2xahY/qS2WW9Y1X3aO3VNPVSyJNI9ssrmsVO+53 tduq7SvYrOjXrsXC3wua2VHErlfGTxN09ms+V3uk832jHLXUpUst0Pdxxc0krVVm7YYmsRGudzc8 jl2XZC6wAjbiVxDIs/4e9ScGxG3+X3u/4tc7bbqXvWRd/US0z2Rs55HNY3dzkTdzkRPWqEadnlpB qJoZwv2HTrVPHvMmQ0VfcJp6PyuCp5GS1L3sXvIHvYu7VRejunr2LKADTtYMLyDUTTLIsLxPN7lh 96ulG6K33y3SOZPQ1CKjmPRWqi8vM1EciKiq1XIipvuUswa6drbo3jjNOJNKsJ1Rbblkio8quORM dPK1XKqOmdNVQyzIm/RXMa/bZFVT0EAHnxo1wN6z4FoNxE3rOZ7XdtU9bLNcWMtFrmYymgnljqXt j716sjR8k1Su/Xu2I1uzl3VUk/g64XbtZeCaPh14jsIjppLjLc4rna31cFSrYpql0kUjZYHvYj09 F7XNdu1yNXoqFuABSLge0h4p+FnO8j0Gy7G5Mm0ZWqnqsYyll0o0dQuX0+V1M6ZJ2sk32c1sao2Z Fc3dr3PLugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K+y V7dlZUQPRUXbdreZm6I5ETwVGubHHDzxDZnRZnJwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uz V7yLoqKjlRE2exlmiLOIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK9uysqIHoqLtu1vMzdEciJ4K jXNCUwVl4eeIbM6LM5OGLidhprVqpaoFktd0jTkoMxoG78tZSO2RO92aveRdFRUcqImz2Ms0AAIg 4j+I/GuHvGqOSS3VORZhkU/m/FsWt/p1t4rXbI1jGoiq2NFVvPJts1FTxcrWqDiP4j8a4e8ao5JL dU5FmGRT+b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytauocOHDhktiyWs4iOIi402Rax5FB3bn R+nRYxRO35bdQN3VGoiKqPkTq5VciKqK50jhw4cMlsWS1nERxEXGmyLWPIoO7c6P06LGKJ2/LbqB u6o1ERVR8idXKrkRVRXOkscAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHy97I2Okke1jGIrnOcuyIieKqpWLCK 1+f5jk2r9SjnQ3SdbZZOZPeW6B3Kjk+LneiuVPjRSTOJLKazHtMaq02d+13yieOw0CIuzueoVWvV NuqbRo/r6l2Nfx6yUeN2OgsFA3anoKdlOzpsqo1Nt1+dfFfnUoYqrSrijdr8nqORrPM4aq/O2udG PCMpnjOUe6WQABC6AAAAAAEY66662PRWx0bW22pyDLcgnSgxrGqBOesu1Y7ZGsY1EVUYiqnM/bZE X1qqIrXXXWx6K2Oja221OQZbkE6UGNY1QJz1l2rHbI1jGoiqjEVU5n7bIi+tVRFzXC/wv3zDr5U6 +6+11NkGsGQQd250fp0eNUbt9rfQp1RNkVUklTq5VciKqK50k1q1p652OdjsdGGjQo9b5NOwTh+1 P0kwPOOKbOVs2W8Qs+P1dbboKyJ9Ra7FFHE6Rlqo2Me1eqIrHyteiuc5URyor3STjoXrra9VOG7G dfby+looK/H/ADrd/J0VIKaeBjkrGs5lVeRksUqJuqrs1N13JWc1rmq1zUVFTZUVOioeWyZJd9Ie G3iG4ObK90d9pNRYcLxSnVVTe25HKjqZm3j6UCVb+n8L8ZeiMtUPM1VTVOlVtWr4EeKvMuKDE8pq tR8atdgyKwXGlljorfHKxi2mupI6mgmckkj1V72LIqqio1URFRE6obJo9r1mOqvEdrFp7T22zMwT TJ9vtVNXxwy+W1V0li56hjpFkWPkicyRqtSNF3Vi83qIqrGY5wk8XllnRVosLzHSSa3OREROasxq LvUevq9Gg3bt8xAF2nzrT/ssco1OhmqKHKdbsoff73VQyckrILnXtYqJIu2zZKeNibr02nd8e5lh 6OWTWnRzJcjfh+Oas4bdb9GrmutdFfqWesarffIsLHq9FTZd+nQ0HJ9ccssvF9hnD/S2+0vx7IsS r79VVMkUq1rKiCVWMax6SIxGKidUVir8SoVW1a0W1Ny7Rhmm+mfZx+wi/WVlLLjOSUWYY7HW2urp 3scyfvo5myvc7lXnVXbuVyuX0tlSTambJKjj/wBD6jMqNtJf5dI6591p2vY5IaxXoszEcxVau0nM m7VVOnRVQCz+UavaTYReKfHs01QxKwXWrRHU9DdL3TUtRKi+Csjkejnb/Mhsdwu1qtFtmvN1udJR W+miWaarqJmxwxxom6vc9yo1G7etV2KRcBWkml+vWgF+1X1iwGxZZleo2RXme/1t3oY6mpYiVDoW U7JHor4WRsY3kaxW8u+6bdDpa+aS4/iGQ8J/CA+93u/abXDIrnLcYr1VtqH10dviZPSUdQ9jWNkh R0zmNjVu3KxibeimwXJwzVrSrUeeopdPNTcUyiakTmqI7LeqatdCm+270he5Wpv06n7edWdK8dnv VNkGpmKWybHEp1vMdZeaaF1tSoaroFqUe9Fh7xqKrOfbmRFVNyqHGrgOEaN5HoJq7pXiNnxjKKXV Cz453lmoYqN1dbaxkzZ6SRImt7xrmxoiIu/Kjn7bcynLpvp9iWZdpHr9dcqslJdvMthxhaSnrYWz QRyy0LWrMkb92941jXMa/bmRssiIqI924WjqtZ9HqDFKfPK7VfDqfGauRYqe8y32lZQzP6+iyoV/ duXovRHb9FNks18suR2qmv2PXeiulsrY0lpq2iqGTwTMXwcyRiq1yfOi7FJeDrRrTV/ENxMU9Xh1 pq7dZMwbSWi21NIyWjtrKmFZKryeByLHF3qshR3K1N2wxt8GohBN2ynIdOez61/xjBame20VFrRd 8QoW0snd+QWqWrpueGNd0RjHI+Ri+CbSu+MD0rsmtOjmS5G/D8c1Zw2636NXNda6K/Us9Y1W++RY WPV6Kmy79OhuZ5y6taLam5dowzTfTPs4/YRfrKyllxnJKLMMdjrbXV072OZP30czZXudyrzqrt3K 5XL6Wyp6AYVNklRhthqMyo20l/ltlK+607XsckNYsTVmYisVWrtJzJu1VTp0VUAzQAAFC+zo+Btp 9+Vv0rVl9ChfZ0fA20+/K36VqyvifUjxdXkj28+H1hZEAFJ6MAAFQuDfGKnKeAfBoLY90d1oH3O4 2yVnv46qG7VbmK3516t/6xfbS7OKbUbAbLmNPytfX0zVqI2/71UN9GVn4ntcifNspTXs6Pgbaffl b9K1ZPGgtd7EtRsw0vldyUdercmtLVXojZFRlQxvzI9G7Inq3Umoq0L87p1eTn4iz0nkyntW4iqP CYiKo+U+6U+AAvvLgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAHn1xgcTOuOmnaAaJaN4Rnk1rw7KvY353tbaKmkbVeU3qop595JI3SN5oWNb6L k223TZep6CnlXx9f+9N4cv8ABD/9Y6oD1UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFn ENw84ZxFYZHjuRTVNqvNqnSvx3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrmxxw88Q2Z0WZycMXE 7DTWrVS1QLJa7pGnJQZjQN35aykdsid7s1e8i6Kio5URNnsZZoiziG4ecM4isMjx3Ipqm1Xm1TpX 47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zQ6fEfxH41w941RySW6pyLMMin834ti1v9OtvFa7Z GsY1EVWxoqt55NtmoqeLla1dQ4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNREVUfI nVyq5EVUVzpI57OnBn6n4Ha+M/Vu/wBVmOpmYwVdBT19fGxsdloKWqmpEp6SNqIyNZO5c972oir3 ip03er7qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4kljhjdLNI1jGJu5z l2RE+NVA+waVfNadJcbVzLxqJYYZG++iZWslkT8LGKrv8hqM/FdpO9VbYFyDIHIu21ss0791+bnR hFVftU7ao4r1rkzGXozt2qpjflOXHYmMEHy8Sl5q/wDcDQ7MZ0X3vnDuaLf8PM52x1X6362Vf+0t EKChRfBazI45P40YxCOcXa3/AAnyWaeQsdO2mI8aqY+uaegV/dqdxIT9afE8Dpd/VUVVVJt/ibHG ud8T8ni3TKJP7WKvcv8AlcY6XRungkjkHE9dVMf8vJYQFevZrxOp18p04X5vJ639Y/Uz7iei6upd Mpk+JG17Xf6Ww6ZRungegcR26P7v9LCAgBmqvERT/wC2cFwys28fJrhNFv8A4+5zx68au0n+6egq TtTxkosjgd/ExzN/8pmMXb68+EtZ5Bxn3dGf+dP1mE8AhGLidZS9Mg0ezyi/hPpqFlVG38LmvTp+ IyVDxU6K1Erae45FV2ed3hFcrbUQr+N3IrU/jNoxNmfvR8vmhr5Gx9Gvmpnw1/LNLgNbsOpGn2Uc rcdzax3F7vCOnr4nyfgViLzJ+NDZCaKoq1xLn3LddqdGuJie/UAAy0AAAAAAAAAAAAAAAAAAAAAA AAAAAAAFfNUK32Xa+WbH2rz0WFWt9ynT1eWVK8kbV+dI0RyfhU2A0PTSq9kt6zXUR683shv0zKZ/ jzUlP9ih6/gRyG+HJ0tOZr3z/wDPg93Nvo9FFjs0xHv2z8ZkABloAAARjrrrrY9FbHRtbbanIMty CdKDGsaoE56y7VjtkaxjURVRiKqcz9tkRfWqoiycQh2d+B0Op2HUvGrqPVOv2omcrX01JJNGiU+P 2+CsnpkpKFm68iO7lznP98qP5fW9Xy2bfOTr2KGPxc4WiNHbOxvfC/wv3zDr5U6+6+11NkGsGQQd 250fp0eNUbt9rfQp1RNkVUklTq5VciKqK50llwC/EZaoeXqqmqdKraFZ884J7Pm/FnjnE4/OZaOj tC0NXccZS288dzuNFHUR0lW6o71OR0aTsRE7p3SNU3Tm9GzAMsK/cZHCczixwqy45R5/Lhd1sldP UQ3aK3eWudS1FLLTVNKsfexejKyVN15vBm2y79N7y7QPTrONDH8POQ22STEXWWmsjIonIySGKnax IHxu2VGvjWKN7V2VOZqboqdCRgBV6PhP11udlt+AZlxmZTccHoHQMdR26wU1svFVTwuascMt1ikW X961HPYxj3Ii7ruqqSLe9AW3fiUxTiFblboW4vjNXjiWd1Gsi1CTyK7vlqFk3by+HKrHb+PMhLgA q1Lwcah4ZeMqj4euJm76bYrmVxnu1xsHsdpbo2lq59knkoZ5HtfS8+2+yI5GrsqbbJtl7rwN6Ze0 hhej2G3y9Y1WadV7L1jOTUz2SXGkuiPdI+pk5m8kvePe5XxqiNVFRE5Ua3axwArjaeFTN8l1FxTU LiH15qdR/YJVLccdtFNjlPZaCCv22bVzMjkkdPKzZFZu5qNVN0TqqLuuEaDew7iG1K169lflnth0 NoovNXkPd+Q+QwrFzd93i97z777cjeXw3d4ksgCJtHdBvam1D1Vz32V+dfbNvsN68k8h7jzf3cSx 91z947vd99+blZ+A1DE+DLD6LSbVbRzPb9Jk1j1Uy665VUrFSeRyUK1joXxxxrzycz4XwMe2VdkV yJuzZNlsQAKvR8J+utzstvwDMuMzKbjg9A6BjqO3WCmtl4qqeFzVjhlusUiy/vWo57GMe5EXdd1V Sz8cbYo2xNVytY1GpzOVy7J8ar1X8KmvWTUnTvJsiuOH45n2OXW/WdFdcbXQ3WCero0R3KqzQscr 49nKiekidehsYAAAChfZ0fA20+/K36Vqy+hQvs6Pgbafflb9K1ZXxPqR4uryR7efD6wsiACk9GAA Ct3Z0fA20+/K36VqyWM4rfYfmuEalsXkjtl0S23ByeHkdUnduc740auyp86kT9nR8DbT78rfpWrJ r1LsCZPgN9snJzvnopHRJt4ysTnj/wDqa0Xs85mNsS15O0Zot01+rMRE+ExlPwlYkGoaRZSua6Y4 zk75Oeatt0Kzu333nanJL/8AW1wOnTVFVMVR1vG3rVVm5Vaq2xMxPubeADZGAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHlXx9f8AvTeHL/BD/wDW OqPVQ8q+Pr/3pvDl/gh/+sdUB6qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqvZcfA T0y/LX6YrS1RVXsuPgJ6Zflr9MVpaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdS63 e1WKgmut6uVLQUcDeaWoqZWxxsT41c5URBM5bWYiapyja7YITvHEnBd5pLbpBiVblc7XKx1xl3pL bEvr+yvTeTbr0anX1KpqlfYtUM83fqRqPU09JJ76z46i0dMifwXSr9kkT5nfEVa8XRGqjX8uLs2O Q79f2r8xbjv9b+2NfHJMOZa0aX4C91Pk2ZUEFW1dvI4XLPU83qTuo0c9N16dURDQaziJyy+7s050 iutRE7o2vvszaCHb+EkfV70/Bsp0Ma0/wzEGomO45RUkiJt3yM55l/DI7d6/xmwFeq/dq68vD/fk 6lrk3A2PuzXP9U5Rwp/VLVKqq4gMn3W96k2zHIH++pbBbkc7b4u+m3e1fnQxcmi+NXSRJ8wvORZT Mi83Nd7rLKm/zNarU2+Y38EU06Xra/FfouzZ1WYij8sRHxjX8WAtWn+DWNE81YjaadzfB7aRiv8A 8ZU5l/jM8iI1Ea1ERE6Iieo/QZiIjY0qrqrnOqcwAGWoAAAAAAAAcc9PT1USw1UEc0bvFkjUc1fx KcgBsandtJ9Nr3zecMLtSud4vhgSF6/hdHyr/lMfTaVzWDZ+C6iZbjvL7yCC5Ompk/DFJui/xm+A 00Kc88k/SbuWjNWcbp1xwnU1qkyziLxfba74zmdMzxbWUy0FU5P7V0f2Pf51QzlFxO261qkWpuAZ Diip0fVpF5dRN+P7NCm//wBJ2QqIqbKm6KSU13KPVq46/wDfxVLmGwl/2tqPGn7M/D7P+KRcVzzD M4pvK8Rye23ZiJu9Kaoa58f92z3zPwORDPFbL5pNgt7qUuSWfzbcWLzR19setJUMd/C5o9t1+dUU 5rfd9dsBVPM2S0uc2xn/AOSvf2GtRvxMqW9HO+eRNvEnpxcx68cPL/6517kOivXhrnuq1fGNXHRW NBFGKcR2DXmujsOWRVeG3x/RKK8t7qORf/hT/ub03VETdUVd+iErNc17UexyOa5N0VF3RULVFyi5 GdM5uJiMJfwlWjfpmmfn4Tsn3P0AG6uAAAAAAAAAAAAAAAAAAAaxqdkK4pp1kuRsfySW+11M0S7/ AO+pGvIn43cqGzkP8VtXIzRuvs8D1ZNfK6htkap47vqGOVPxtY5PxkV6rQt1Vdy5yfZjEYu1anZN URPhnrajpTZ0sOnGO23l5XNoI5Xp8T5E7x3/ANT1NrPiKKOCJkMTUayNqNaiepETZEPs5tMaMRD1 9yublc1z1zmAA2aAAAEcdlx8BPTL8tfpitJHI47Lj4CemX5a/TFaWsL1uHyz9z3/AEWYya41Fnxy 63ekbG6ehoZ6mJJEVWK9kbnIjkRUVU3TrsqFLMS4ruLzPeFFOKnH8K0wo7VZ7TWXS5W2vZX+UXWK jfJ5XLS8kytpWokUjWNkWVXLGrl5UciFyc6/rIyH/mqr/wBS4pfoZ/7n25f9GOW/6NeW3DZ7NuLL iQtWglLxdY/p9g0GnHcUdzmxu4zVb7/NbZpWRd+2pjclPG9edHtYsb9o1RVcrt2JJGs3EjltszjA 9F9BsZtF9zrUC3S3yGe+zSQ220WmNu61dSkX2R/Mu7GsYqKrkXdU6IsM6r/+59of+jHHf9GjNV4k tL8KpNYdFddtbMWvt20pl0+hxS+11oqK+J1jqWc09NVTrQvbMkL1mViqiq1Nuqb8qKFhcI151oxH XaxaAcSWO4eytze31lfieQ4k+pZRVklI1H1NJLBUq6SOVsa8/Mj1aqbJ4r01LA+ILiu4g5MvyjQe yaQ23G8Zv9dYILblE9wlu1XJSu5VfKtO5sdL3ni1rmvVPXuiI5dc0AxfgdyrXmxXHh401y7Jq3GK WpuCZr54vU9os8zmd2kCurqnklllY9ycrGP2TZV8FVmk6hZPwDZjk19yfVGizHQbWGnrKmCtW1ec LdepJWvcjKiJaRjqerWVEa9Ho16u36qu+6hO+q/FLqngOmulrptKrZjWpOqF6jx9lsyW6p5sstT6 XPJUVFPusjF5WqxrFRzkeng5qtXbtPsm4ubTqNbcU1nwXA71jV3paiT2S4ZNU07LVPE1HNjqqase 572yb8rXROdsqek1E6pAdj1GfLwfacRcd+kl+yyx5FWVdPeLxX2h0s1npo3yeb66uhiRZ4XyR8re 9jTmTfdy7v2dr2ht3wKzcTeA47wO6j5rlGnNbDcfZ1Zqqorq3H7NTNh3pZIZatu8MzpeiNa9zl5W ouyKqKFgMiznjTyLL8np9OMD00w/GbDXOoLZVZ1UVk1TfuVN1qIW0b0bBC5ejVfzO9atRd0TEY5x yWyXhAyXiazDDlt9yw2oqrPdrHBVI9jrtDOynZDFNt+5ySSwrzbKrUevvuXda0aRVHDZWXrUGPjH wy4ZvrzJltygZYLpaKy5VlTS86JRwW2HlWFIHJ0Y5Fa1EXdzkjRqmo4Zh13zHgP1/wCGay46+g1O xbM6q/z4fTU73PhpYqykk5Ydm8srFZFK2Pk3V/I3ZNlTcLJ6s8SHG1oPoPcNcdRtN9L6ukkooZI6 G0Pr1qLDPO5qQeXMkkRtTHzPbFJ3L41a96KnO1FJB1E4mtQqe8aX6Q6R4pYbxqZqNYm5BNJdppob RZaBsTXS1MzY95Xtc/mYyNrt1Vq7u8N4M4wuMnS/W/g0zKxaU+cr5f7paqaS80KWyojTHomzxPqH VskjGxxq1W901vMqvkczlRzd1TGcQul+FUeqmhuu2tmLX27aVS6c02KX2utFRXxOsdSxqz01TOtC 9syQvWZWKqKrU26pvyooWMwjXnWjEddrFoBxJY7h7K3N7fWV+J5DiT6llFWSUjUfU0ksFSrpI5Wx rz8yPVqpsnivSds1ZmsmLXBmnVVZKfI1jTzfLeoJZqFsnMm/esheyRzeXm965F32Kc6AYvwO5Vrz Yrhw8aa5dk1bjFLU3BM188Xqe0WeZzO7SBXV1TySyyse5OVjH7Jsq+Cqy8IHmhwL5xX8O3B5k3Ez ntnwmpxymbc5Gy222SxZHcbg65dyyGprHvVj4ny8rGojN2pyKu/Ku83ZZrpxuaX6XLxAagab6W1W KUNNDdbvi1rqK9l8oKB6tVy+UyKtPJLE13M9vdtb6LtlXYgnTDSbKda+yHu2CYTRSVt9kuFxuFDS R9XVL6W9OndE1PW5zI3o1PW5WoSlrpxoaX60cN2RaXacU96vOqWdWJ9giwmKzVbbjRVtUzupmztd GjYmw871V7nI3Zm6Ku4G76wcWOo1r1U0fwLQ3GcdyOm1hxyrutpluqTxckiRRywzySRv9CnZC98s jUjc9yM5WqiqilkMFbnTMStrdS5rFLk6RL5yfY45mUCycy7dy2ZVkRvLy++VV33KaRYPV6a8WHB1 p3cpWTVmLacXizzyMXdrpae1xxPc1fiVWrt8yl6QBQvs6Pgbafflb9K1ZfQoX2dHwNtPvyt+lasr 4n1I8XV5I9vPh9YWRABSejAABW7s6Pgbafflb9K1ZZErd2dHwNtPvyt+lassibXPXnxQYX2FHhHy cHCvUeR4lkWFuXb2M5HW0kLPip3uSWNfwKr3gx2iM3mvWvUOyb7MulFbbrE34la10T1T8Kqm/wCA FvCTnaiN2rg4nLlGjjq6u1lV/dETPxzT2ACw5IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeVfH1/703hy/wQ/wD1jqj1UPKvj6/96bw5f4If/rHV AeqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB50Zf2iWovCFr9fNC+JXF5cqxmCZtXYsn tsbIbjJa5lVYHyxLyxVKsRHRPc3ul54nr6SnouUK7XThu9tLRCDWTHaDvMi04556ru27vqLPIqeU Iu3j3TkbMir0axJvW4CrHD/2lF20Y4ZdPOHHRbTSXIdRWzVtF5VcV/qOOprLnUSQRwxRu56h6pPG nV0aI5dvSPXbTW0ZfYsCsds1AyPz9k0VGx14uKRMjZPWO9KXu2Ma1rY0e5zWN26Ma1F3XdTyG7Hz hu9sHVqv16ySg7yx4B9gtfeN3ZPeJWdFT1L3MTleqeKPlhcngez4AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAPmSSOGN000jWRsarnOcuyNRPFVX1Ia7nmoWKabWR19yu5JTQq7u4IWJzzVMvqj iYnV7l/iTxVUTqQVdnZ5rVIlTna1GOYpzbwY3Tyq2erZv0dWSN2Xr/wabInr2VN1gu4im19mNc7v N08DyXcxkc5VOjRvn5RHXPwjrmG35TxDLcK2oxrRqysye5QuWKe6SvVlqo3/ANtKnWZf7Vnj6lXw NN9reryivZftWsiqMtuDHc8VLKnd26lX4o6dPRXou27t9/Wm5uFttlvs9FFbbVRQ0lLA3ljhhYjW NT5kQ7JRrmq7ruT7up6WxbtYOMsNTl/V96ff1eEZd+b4hghpomU9PCyKKNEaxjGo1rU+JETwQ+wA AAAAAAAAAAAAAAAAAAAAAAAAAAAAADoXqw2XIqF9tvtrpq+mf4xTxo9N/jTfwX506mr2yx6h6XvS fSnJFq7Uxd3Y3epHS03L06QTKvPCu3gm6puu6m7g1y15xqlvFydGbdUZ0z1Trj998a2Z0912xbNq /wBjV1pqjGcoYiLJZ7kqNe/54ZOjZm/Fy9duu2xJRAOVYbjuZ0KUV/t7Zu7XngmavJNA/wBT43p1 aqLt83TrudTHtUM00glitWo89TkmIJ6EWQsjV9ZQJvsiVbU6yM/+InX4990Qs28VNOq7x8/3wcjF cjUXft4Lb2Z/9Z6/Cde6ZWJB1bXdLderfT3a0V0FZRVcaSwVED0fHIxfBWqnRUO0XtrzkxNM5TtA AGAAAAAAAAAAAAAAIR4nJPKfa7snqqcupqlyfwmwxyOVPwekhNxBXEI7vdSNKaL1PrbpPt88dO1f /uV8X7Kfd84dbkOM8dR3RVPCmZ+jJAApPRAAAAAARx2XHwE9Mvy1+mK0kcjjsuPgJ6Zflr9MVpaw vW4fLP3Pf9FqgAW3DAAAAPiaaKnifPPKyOKNqve97kRrWom6qqr4IiAfYKZ8MHHFmutWuNRhmY4n ZrRhOZUd0uemd0popmVF1pqCtkp5Wzq+RzXSrGxZdmNYjUY7x3TaW9etccs0t1Y0UwTH7faaig1I yKptF1krIpXzQwxwJI10Cska1rt16q5r029QE4mBzywXrKcMvOO45llZjF1uFHJBRXikjZJLQzKn oTNY9OV3Kuyq1fFN03TxTWdOcwy3Ic91CsV/ybTy422wXCmp7TR47WyTXSgifErnsu0bnK2KZzkR WI1ERWoqmVo9YdJLjlb8Et+qWIVWSxvWJ9mhvdM+ua9N92rAj+8RU2XdOX1AVozjh+40tcMAp9Cd ZtStMKfCal9LFf77YaauW+3elgkY/l7qVqU8D5Fjar3Ncqb77Jy7tW31BQ0lsoae20ELYaakiZBD G3wZG1Ea1qfgREQxuWZthmBWpb7nWXWXHLaj0jWsu1fFRwI5fBveSua3fovTc/cUzPD88tLb9g+W WbIrY9ysbW2qviq4FcniiSROc3dN06bgZkAAAAAAAAoX2dHwNtPvyt+lasvoUL7Oj4G2n35W/StW V8T6keLq8ke3nw+sLIgApPRgAArd2dHwNtPvyt+lassiVu7Oj4G2n35W/StWWRNrnrz4oML7Cjwj 5NGhv7cN17ZfHKiMrcRkplRfBXNrGORfw7KDQuIm5PseRY7co3crpqKsgVfmSSBf/uCvGKmxM0Q6 9XIdHKVFF+qOrLhMwuyADtvm4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAQVjupWsOS2anvdGuKRw1PPytlgnRycr1au+zlTxavrJ1K/6Uf1gWv8A7f8A17znYyapu0UR VMRlVOrumnzUsVVVFVMROW36M77Lda/+Gw//AMGo+sey3Wv/AIbD/wDwaj6zIAh0Ku3VxV9KvtTx Y/2W61/8Nh//AINR9Y9lutf/AA2H/wDg1H1mQA0Ku3VxNKvtTxY/2W61/wDDYf8A+DUfWPZbrX/w 2H/+DUfWZADQq7dXE0q+1PFj/ZbrX/w2H/8Ag1H1j2W61/8ADYf/AODUfWZADQq7dXE0q+1PFj/Z brX/AMNh/wD4NR9Y9lutf/DYf/4NR9ZkANCrt1cTSr7U8WP9lutf/DYf/wCDUfWebnGtd82q+0d0 Gr70+zrd4fYv5ItMyRKfpfqlWc6OXmX0999vVsb9xD8WOtfBhrw+1ZHQNzfTPLGrdbRHVv7qtod3 bVNNDUoi8yRyLzIyRrtmSRNRzUK2cQ3FLpRq9xg6Na5Y/W3Ckx3HY7A68pW0bmz0Lqa7z1E7XMZz d4rYntdvGr0XfZOu6JZs2a6Z0pqmYy3rFqm5E5zMzGT149lutf8Aw2H/APg1H1j2W61/8Nh//g1H 1nnllnaP6ia66i2fRThTxjzLPkVcygiyG8QtnqmMXrJPHTJvHGyNjXyKr1kXkavotVD0PsVrWyWW gs7rjWV7qGmjp3VdZKsk86taiLJI9ffPdtuq/GqkFVmunbXVxRVRco21TxbtpblFxzPBLZkt2jgZ V1nfd42BqtYnJM9ibIqqvg1PX4m1ke6Af2I7D/3r+kykhF3CVTXh7dVU5zNMfJdsTNVqmZ25R8gA FhKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEMcUGv+F6JYU23XixPyzJMvV9nx7DqVne1V+qJU5O 5Rmy7RekiSPVFREXbqqtavY4j+I/GuHvGqOSS3VORZhkU/m/FsWt/p1t4rXbI1jGoiq2NFVvPJts 1FTxcrWrqHDhw4ZLYslrOIjiIuNNkWseRQd250fp0WMUTt+W3UDd1RqIiqj5E6uVXIiqiudIEbcB GXQaF26m4MdWsEp9Pc/t6VF4tsbahJqTJKeeR0rpqeo3VJZY0Xuns5nKiQpt71zWXXIs4huHnDOI rDI8dyKaptV5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc2OeHniGzOizOThi4nYaa1ap2 qBZLXdI05KDMKBu/LWUjtkTvdmr3kXRUVHKiJs5rAsyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ABpeqGqFm0xssdZVwSV90r3+T2u10/Wetn9TWp6mpunM7wRPjVURcpnebWTTzFa/Lcgm5KWij3Rj ffzSL0ZExPW5y7In8a9EUgnErTkGQXqfVDUNjVyC4s5KOj8Y7TRr1bBGi+DlRd3u8VVV+Nd62IvT R9inbPwdjkvk6MTnfv8As4/yndH1nqjvmFa9DqHjz4o8WsfFBb8i0UkZfW1Udrpb5TXNHW1kFVLT vbHFFzRs3fC5UdzOcqKiqu6qS77WHaTfKzh3+i3n6jY+y4+Anpl+Wv0xWlqiXmaNuSlOPxMxFOnO Uao7oUy9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNzHTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJv lZw7/Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m +VnDv9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rDtJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1F zQOao3HTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/U Paw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25U y9rDtJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1FzQOao3HTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJvlZw7 /Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnD v9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rDtJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1FzQOa o3HTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UfMml naRTRuhmyjh1fG9qtc11JeFRyL4oqbdULngc1RuOm4jty86bHnHFfwc63YBhGqEmA33D9Spb1Uy2 fEYa1zqJKClbNNLD5Tt3a/ZWO5U5muax6KjfRVPQTHMisuW2SjyLHrhFW2+ujSWCaNejk+JfWiou 6Ki9UVFRSp3Fv8MnhR/w6/RUBtNsvVVoNla3ulaq4DfqlqXekai8tpqXqiJVRonhG5dke1Pm2/eo kFVyMPXFP3fl/p07OFq5VsVXZnO9n/dGUavHdv2blmgfEM0VREyeCVkkUjUex7HIrXNVN0VFTxRU PstuEAAAAAAAAAAAAABBGvf9l/STfw3v38fksRO5BXEI3utRtKa5fBldc4N/nkp2p/8AYrYv2U+M fOHX5C/nqfy1/wDSpkgAU3oQAAAAAI47Lj4CemX5a/TFaSORx2XHwE9Mvy1+mK0tYXrcPln7nv8A otUAC24YAABV/tF9WLvpvw23TG8Pp6ysy/Ueojw+xUdBC+aqmkqkVJlijYivc5IElRvKm/O+Pbqq FoCHc44e11A4isB1wv8AmHe2nTq31sdqxvzfu1blUorH1r6jvNl2jRiNj7ro5iO5/UBRvXHU22YZ pPo/d9K+HHXWxXXh9r6KupLlfcBqaCjltbIkjuMdROqqkSTsaj3uXpui7qm+5YDieyK0ZfrTwf5Z j9Y2rtd6yqouFFO3wlgmoWPjen4WuRfxltcjsFpyvH7ni1+pG1VsvFHNb62B/vZYJWKyRi/MrXKn 4ys2F8EV3xixaG2K66yuvLNEL3W3KimksPdyXCkmRUipXL5Q5I1iReVJE5kVqNTkTbdQgXJczyPT +g4/crxKrmpbtS11qip6iBytkg76lWF0rHJ1a5rZHORydUVEX1E+4lwT8OOZ8NOFYa/C6G0ypZ7T c4cmssMNNeo61rIplq463kc9JHv3VXLv0cqJtsm26Ytwq49bMk1wuOWXtuRWbW6ohfX2p1EtP5HA 2mfA+JJUkcsiuR6qj0axWqibdepGknAnqBdcKotDsr4rslu+jtCsEDcZWwUkNwnoIXtdDRy3Rru8 dE3kanSNq8qIiKiIiIEX6pV2YZV2g12ss2g8+tdHp1g9CllstXd7fSQUktSrHzXJzKxzYpZXKvd7 taqps1dk5W7b3w/6c6049xcXDUii4Y36Qae5PizqHILbDkFqqqSe7Qy89PWNp6OVeWRWKsaqjNur lXq5VJZ1T4WPZJn1h1f0d1Fq9Mc6sFo9jrK+ktkNfRVtqR3M2lqaSRWtkaxybtVHNVOnjys5c1o/ ohm+EZfd9RdUNcsg1CyS60Udta11My12mipWPV6Ngt8LnRpIrl6yvc5+3RFRFduEwAhfh1t2qNDf tXX6hZHfbvbJs/rnYs+7Ub6V0NrWKF6RQMeqqtPHM+aGORF2kSHvEREciE0AAAAAAAoX2dHwNtPv yt+lasvoUL7Oj4G2n35W/StWV8T6keLq8ke3nw+sLIgApPRgAArd2dHwNtPvyt+lassiVu7Oj4G2 n35W/StWWRNrnrz4oML7Cjwj5K68XXOrsT7v321fv+D+pwZbiGtrr7kmPWyNvMsNDWTqnzLJC3/7 A5d+3NdyZh7fk3FW7OEooq26/nK64APTvi4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAV/wBKP6wLX/2/+veWAK/6Uf1gWv8A7f8A17znYv8AmKPCr50qOL9enwn6NtAB qgAAAAAAAAAABXPjz4f/AG/dArrQ2ii7/J8Z5r1ZORu8kskbV72nT1r3sfM1G+CvSNV8Dw2P6VTx y4uODm/2njCtuB6f23u7VqrXeX2VzY17qkc9+9axUT95AvPKqJ72JzE9RZsV5fZlaw9eWdMpr7Jb h/8AJ6K88RWQ0Xp1XeWXHe8b4RtVPKqhu/xuRIkcnVOSZPBT0iNe09wWwaZYPY9P8Wpu4tVgoYqC mau3M5rG7K9yp4vcu7nL63OVfWbCQ11adWavcr06s2R0A/sR2H/vX9JlJCI90A/sR2H/AL1/SZSQ ibA/ytv8sfKF3D+xo8I+QAC0mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiDiP4j8a4e8ao5JLdU5Fm GRT+b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytariP4j8a4e8ao5JLdU5FmGRT+b8Wxa3+nW3i tdsjWMaiKrY0VW88m2zUVPFytauocOHDhktiyWs4iOIi402Rax5FB3bnR+nRYxRO35bdQN3VGoiK qPkTq5VciKqK50gOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc 6SxwAAiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zZTAFZuHn iGzOizOThi4nYaa1ap2qBZLXdI05KDMKBu/LWUjtkTvdmr3kXRUVHKiJs5rLMkWcQ3DzhnEVhkeO 5FNU2q82qdK/HcioF5K+yV7dlZUQPRUXbdreZm6I5ETwVGubHPDzxDZnRZnJwxcTsNNatU7VAslr ukaclBmFA3flrKR2yJ3uzV7yLoqKjlRE2c1gWZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADTdYM1XT zTW/5ZEqeU0lKrKRPHepkVI4unr9NzVVPiRTWqqKKZqnZCSzaqv3KbVG2qYiPGUQZddvbd1Zlpt0 lxTAKjuo2dFjrLvt6b1+NIUXZE/hbr4ONuNa05xf2H4bbbLKquqmxd9WSOXd0lRJ6UjlVeq+kqpu vqRDZTlRM1faq2y9vXTRaiLNr1adUd++ffOtHHZcfAT0y/LX6YrS1RVXsuPgJ6Zflr9MVpao67wg AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACnnFv8MnhR/w6/RUBLFwt9FdaGotlxpmVFLVR uimiem7XscmyopE/Fv8ADJ4Uf8Ov0VATAUcT63uek5HmYszMb/pDpcPGS1tjrLnolkFU6Wox5iVd knkVOaptb12anzrE70F+ZUROiE4FYNSKp+G3jGdWqRHNfjVwZFX8u/2S3zqkczV28duZFTfwVVUs 6x7JGNkjejmuRFa5F3RUX1ob4SvOmaJ6vl1eSvy5h4pu04mmNVe380beOcT730AC24YAAAAAAAAA ABCPE7GtMzT297dKXL6Wnev8FkzJGqv4PRQm4iHiso5JdGbjdYGc01krKK5RonjuyoYir+JrnL+I gxMZ2av3sdPkarRx9rPrnLjq+riB8QTR1EMdRC7mjlaj2r8aKm6KfZRelAAAAAAjjsuPgJ6Zflr9 MVpI5HHZcfAT0y/LX6YrS1hetw+Wfue/6LVAAtuGAhnic4gKzQvHsdo8WxduTZtnV8gxvGLRJUdx DNVy+Ms8myqyGNOrlRN+rU6IqubH10144k9C8xwmn4lMd05uGH51e6fGY7zhrq6GSz3KoRe4Sojq nO72F7mq3vGqzbZVVE6NcFpwVbvnEPrvduK7MOGjTXFcQlZaMft97pLzd21LYqGORE791Qkcm9Qq vfE2OKNIvF7nSbM2XIaR8Smcxah6qaR8Q9uxmgvOmNqpsjfeccSoZb661SwukdJ3M7nyRvjRqI5O dyKqrt0bu4LKApxYOIfjU1B0zXiK060e0+qsGqIpbla8Tqaqufk9yt0b1RHskiRads0jWq9kSMfv uiIrlVEXM6v8VOsGP6q6QabaYac22Su1Yx6trobdk0FRS1Vsro445ESqcx/2KOFjpXTMSNz17pWs VFVFAtcCteJa6a04rxK45oBr1R4X3eZYlNd7HdMdpauGOe600i+VUe9RK5XNSFO9T0WqiKiKrt9z vZPxCZy7iWv2jmDWuxz4/g+CS5Pk9fVwTSTxXCXn8io43Mla1nM1EldzNcrmboitXqBYYFMdFeIL jU4gtA7brdgeF6V25JKWoc23XSO4Olvc9PI9kvkyRzbUjFcx0TO8dKrnMVy8jVQjXiV4gdQNfeHn h+1X0wdjtnsuaah2Kiq7dc4Z6iop73DWSrGx0kb2NdSMmpXq5OVJHp3atVnVAPRgFatStfdaMPyX T3h8xSwYdkesuY0FRc7hVvWqpMftNFAqo+rfHzPqHNcqKxkaP3VzXbuToi8mEa860YjrtYtAOJLH cPZW5vb6yvxPIcSfUsoqySkaj6mklgqVdJHK2NefmR6tVNk8V6BZExGO5fieXsuEmJ5Rab22018t quDrdWxVKUlbFt3tNL3bl7uVnM3mjds5vMm6JuVmwfiB4nNfMgzHItBcU02g0+xK/VWPUkmTz1yV 9/qKXZJpIZIPsdNEqqiNc+ORevVOiomI7Mi8VGQ4JrTf6u01FrnuetGSVktDUK1ZaV8kNG9Ynq3o rmqvKu3TdF2AuOAABQvs6Pgbafflb9K1ZfQoX2dHwNtPvyt+lasr4n1I8XV5I9vPh9YWRABSejAA BW7s6Pgbafflb9K1ZZErd2dHwNtPvyt+lassibXPXnxQYX2FHhHyaRSWFuY6+pZX7LHRYg+ocq+C PfWMRE/DsgNg0Ph856z6i33beO20tttUTvjVWOkkT8TkT+ME2GtU10aU75UeWMbdsYiLVucoimn4 xE/VPQALrzgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV/wBKP6wL X/2/+veWAK/6Uf1gWv8A7f8A17znYv8AmKPCr50qOL9enwn6NtKpw6zcV2omumqemWkMOk1HatOa u3U/fZJR3J1RO2rgdI1eanm5VVFjfv6Leit8epaworp/mesWJcXPEimk+itPn6VVysHl6y5PBaPI uWjl7vbvY397z80nhty8nXfmTbaiM80dEZ5pXxfXvW3BtZsZ0Z4k8TxCJ+dRVPscyHEp6nyOWop2 I+Snmhqd5GO5Vbs7fbdzUTfdVbz3/XPWvPdX8s0h4dsWw9EwFKRmQX/Laip8n8oqY1kZBBT020j1 RrV3crkTdFTp6KuxVm0y151r1zwvVzXLE7Hgtg04bWT2XHqG7pc6qrrqhiMWWedjGxoxqNaqIib7 t222VVMvn3DS/J9SrzrDoHrjctPM0rkior86giguVvrpIWIkaVVJIvKkrWcqbqvRF35d1VVz9nPW 2+znr/0yOAancR9o1VoNL9c9MLNU0d7o5qq35ZhcdZLa4ZIk3dBVtnRXU7lT3rnO2VytanNuqt72 kmt+R5zrbrXp1kNLZ6Szaa1Npit1TAySOaSOpp5ZZXVD3yOYvKsabK1rERN99/E0aw6xcROjmrWG aVcRUeJ5NZ89qJrfZMox+OSlnjrI2I5I6qnf6PpboiLGiInNvuuyolf8n0n1q1p144qME0ry22WS 21E9kmvEU6SJPdnsopVp6BHtVvdQyr3qSv336MTq1zzMUxO3962Yoic8/wB61rtLNcs3101LuNbp vaLTFpBYVkoZMirqeZ9Tf69qqjkt/LI1jaeNejpXtejlTZqdVVs7EN8K2rOH6m6YU1tx7G4sTumI ctjvmKJH3T7JVwpyrDyePdryqrHetEVF9JrkSUcn8y+xq7eyR/JaPIZ/L3cz27U3du71d2eknoc3 VvX4upHVtyR1bcsmTB59c/ZK/KlP5fyX9qWh4Wl4dHYJcl4ZrglXjfneTyx/lldU7V3cxcyc1Y50 ifY+56IvL1+NVMzTlGevgzVRlGevg6HFzxNU3DLp/RXyisHn/JL/AFzbZY7Xzqxs0ypu571RFdyN Tbo3qrnsb03VyQ7iHE7rLj2v+C6b8XeiuK4/ccobK3FL1Z5e9WknmRI1hcrpZer15IncrmqivZ0V q7pge0tR8GqPDbc6rpbKbKqhKpzveNVai3OTm/6rJP4lHaMI+s174YLba/Sua5RM6NGe/bzVltRi /g5mu2/ApJTTGURvzSUUxlEb818wAQIGR0A/sR2H/vX9JlJCKe4lQ8eE2PUkmjN90Rp8OXvPNsWR 0t0fcW+m7ve9WD7Gv2bvVby/vFbv13Mx5s7T/wCU/Db9CvX1lnA/ytv8sfKF/D+xo8I+S1QKq+bO 0/8AlPw2/Qr19Y82dp/8p+G36FevrLSZaoFVfNnaf/Kfht+hXr6x5s7T/wCU/Db9CvX1gWqBVXzZ 2n/yn4bfoV6+sebO0/8AlPw2/Qr19YFqgVV82dp/8p+G36FevrHmztP/AJT8Nv0K9fWBaoFVfNna f/Kfht+hXr6x5s7T/wCU/Db9CvX1gWqBVXzZ2n/yn4bfoV6+sebO0/8AlPw2/Qr19YFqgVV82dp/ 8p+G36FevrHmztP/AJT8Nv0K9fWBaoFVfNnaf/Kfht+hXr6x5s7T/wCU/Db9CvX1gWqBVXzZ2n/y n4bfoV6+sebO0/8AlPw2/Qr19YFqgVV82dp/8p+G36FevrHmztP/AJT8Nv0K9fWBZrIW351huKYt LRR3nyWXze6ujc+mSp5V7vvWsVrlj5tuZGqi7b7Ki9SoGiHag6M5vkFRptrZRy6T53bKuS211Jd5 kdblq4nqyRjavZEjVHNdukyMROiI56my+bO0/wDlPw2/Qr19Z4+8dPsuTidy9moVZhNVlbH07L5L h0VTHbnVaQs5kRKhebvUbyJJt050d++5gP6KKeop6uniq6SeOaCZjZIpY3I5j2Km6OaqdFRUXdFQ iTiP4j8a4e8ao5JLdU5FmGRT+b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytavl12dFj7RNlVQ1 eik8tv04kkR8y5kki2GViru5aeJfszlXr6VLyoqoiPeiFueF9W2Hizzaj4sWq7X64rIuK3GodvZ6 nHtl5Y7Gjk+x7en3jV3l25t1375AJd4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNR EVUfInVyq5EVUVzpMrpfr1lmZ8Umtuid6oLNT4/prT2Ga2VUEUrKqXy2iSebyh7pFY5Gu6N5WM2T x38SeTzA1I0i1z1z4v8Aix010ezu2YrR3O1Y0t7nnbItRXo20M8noGOYqd1FM9XpNJvujWoiI5HO aoW30z4hs7191jr6fRy0WVdHMVfLQ3bLbhTzSy325N6LBauSVjO6jX3872yNcvRqbbOXR7nrpxe5 3xP6raH6H0+j9JadNo7NL5RldFdH1NQldRMn25qadGqqP7xPeN9Hl8V3UkDgt1fw3UPSiDCbPh1P guSad8uPZJhrGd2tmq4t2rytVVV0Mitc9kiqvN6W7nORymg8PX/vC+Kz/kmG/otAMlTcT2uGi+e4 3hPF7pzi1ts+Y17LTZ83w6tnltLLg/8Ac6aqhqUSWBX7dHqqt6L4tR7mfevOu3Eja+KDF+HTQOi0 1bJfcSmySasy+mr5GsdFUSxuY11LK3ZFaxuyKxeu/XwQxHaqVFFNwl12MxtSW/5FkNmt2OwMX7NL XrVseiRevm7pkqbp8ZpXEKmtEPaJ6cs0S9hk+Wt0vqm75Y+qZb3ReVzd6qrSosnP4cvTbx3AmzFY u0LTJ7Qub1vDu7HUroPOyWqlviVq0feJ33k6yyLGkvJzcvOnLzbb9DduIbh5wziKwyPHcimqbVeb VOlfjuRUC8lfZK9uysqIHoqLtu1vMzdEciJ4KjXN07CpO0DXLLUmotHw9txnypnnVbLU3ta9Kbf0 +4SZiRrJt4cy7fGWEArNw88Q2Z0WZycMXE7DTWrVO1QLJa7pGnJQZhQN35aykdsid7s1e8i6Kio5 URNnNZZkqh2iNVpHLpXbbHllDc7hqNW1zfa2psedy31t73b3clK5qK5kaO5O9VU5eXb9/wB3tjsT s/aowYxaorvlXD66tbRwpULcaa5vq+flTdJnU6JCsm/vljTk335d02UC4AKq+bO0/wDlPw2/Qr19 Y82dp/8AKfht+hXr6wLVAqr5s7T/AOU/Db9CvX1jzZ2n/wAp+G36FevrAtUCqvmztP8A5T8Nv0K9 fWPNnaf/ACn4bfoV6+sC1QKq+bO0/wDlPw2/Qr19Y82dp/8AKfht+hXr6wLVAqr5s7T/AOU/Db9C vX1jzZ2n/wAp+G36FevrAtUCqvmztP8A5T8Nv0K9fWPNnaf/ACn4bfoV6+sC1QKq+bO0/wDlPw2/ Qr19Y82dp/8AKfht+hXr6wLVAqr5s7T/AOU/Db9CvX1jzZ2n/wAp+G36FevrAtUCqvmztP8A5T8N v0K9fWPNnaf/ACn4bfoV6+sC1QKq+bO0/wDlPw2/Qr19Y82dp/8AKfht+hXr6wLVEB8W016uNpw/ DMdkpGXG7XvyqDyxjn073U0LntbK1qo5Y1e5nMiKi7J0VFNR82dp/wDKfht+hXr6yJtXrf2hDNQd PEynINB33BZLp5rdRUl2SBru4Z3vfo9eZd27cnL699yDExnamPD5unyPOjjKaspnKKp1bdVMzHDa x2kHaJaUZfe58A1dpJNNMyt9VJb6ymukqOoFqY3qx7G1WyJGqOau6SoxE8Ec4tdBPBVQR1NNMyaG ZiSRyRuRzXtVN0VFToqKnrPCfjH9k/uhsobnFViNTkrHQNvEmKxzsoFqkibzbJOvN3iJyo/bpzo7 18xOnAhZ+OplTR1Okk0tDgT3o+VcrR62WViru5YI1+yuVevpU+26ps5yEVdmNHSiclyxyhc5ybVd Ol3xt98PSDsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tUXHAAAAAAGiVuvehdtttLebjrRglLb66o lpKWrnyOjZDPPE7lliY9ZOVz2O9FzUVVRei7HdyLV/SXEK23W7LNUcRstXd42S2+C43umppKxjve uhbI9FkRfUrd9ymHAxo3ptlfDNqbeMtxC13ysveSZLRTTXClZUPipY3vRkESvRVjYj3SSIjdvTkc 7xXcwGgekmn177KC+5TkWLW673y54TkdxludfTtnqmy0aVUdFySvRXMbBHTQNjaiojeToibqB6HX m+WXHLXUXzIbxRWu20jO8qKytqGQQQt/hPkeqNanXxVTD4XqdptqRFUVGneoWNZTFSKjah9lu1PX NiVfBHrC93KvRfE84c4yTMs7g4KNPK3Tyq1OtVZhCZJWYo+509JHfq6mtsfdLPJVOSJ6QojpVa9V 50c9FReYlOHTvXO4cSuleq+CcF6aSRWWumt2W11HktjdBcbNUNRjmzU9LMiyrEqd430XO3RNt1Ru wXBvGsmkOPR3WW/6q4fbGWGqjorq6svlLClBUSNV7IZ1e9O6kc1FcjXbKqJuibH5dtZtH7Djtvy+ +arYdbrDd1VLfdKu+0sNJWKnRe6mc9GSf9VVKscN+nGGZdxm8UmQZZj1BeprZebPSUMdfTtnipkm olWdzGPRWo96RxNV22/KzbfZVQxvARopphXXDiFhu+F2i6UVo1XyHFLZRV9Iypp7fa4ZUelNBHIi tiY5Zl5mtREdys335U2CceLbiCvmiOhMerWmrbBepam62qkppKxH1NHNT1U7GLI1YZGK70Xbtcjt vBeqEm0mrmlNfl0mn9DqdidRlELnMkskV6pn17HN98i06P7xFTZd05eh5fXpah/ZNOsbblLTwWnU N1toZVkVVpYG3lys2cvVOVXKqfEWH4/tA9IdKeDy6ZppzhFmxrJNOqqz3GwXuhpI4a+KpS4U8Svf UNRJJXPSRyuVzlVz9nLuqIoFzMszbDMCtS33OsusuOW1HpGtZdq+KjgRy+De8lc1u/Rem5+4pmeH 55aW37B8ss2RWx7lY2ttVfFVwK5PFEkic5u6bp03KAZ9kObaicelWldw8v1egwjALbU2nHJ7tQUd LbZ61I5Z67u65yRySczli3RFVOVv8FqpIvD/AKc6049xcXDUii4Y36Qae5PizqHILbDkFqqqSe7Q y89PWNp6OVeWRWKsaqjNurlXq5VAtHQax6RXaptdFatU8Qrai+VE1Ja4aa900r66eFVSaOBrXqsr 2Kio5rd1bsu+2xuBR3szNK8Gn07yTUy643brlkvs5vdNRXKspmTVFvpop15Yad7kVYW88k715FTd 0rlXfpteIDrXG42+0UM90u1fT0VFSxrLPU1ErY4omIm6uc9yojUT1qq7Gs4drDpJqJWzW3T/AFSx DJqunar5qez3umrZI2ouyq5sT3Kib/GRrxqaI5lr5ot7DsFqLY+5UF6t97W13WR7KG8xU0nO6hqH N6pHJ0Xw25mN32T0khHH8o0hodYNNrZr1wc12h2bw3htLid+tHkz7RVV72OY2iWuoORHpKjlRsEr Favgu3XcLgZpqhpppuynl1E1ExnFmVaqlO69XenoUmVPFGLM9vN4+ozdnvNnyG2U96sF1o7nb6tn eU9XRztmhmZ/CY9iq1yfOinnHppdM4zbiW4g87ruElNa6625jUYnR1lde7TTxWa3UauZFTQwV70V qSN2kc5jdnKvjvzH2618QXDtoPxU5LBpHW6U4jeKOlumG2eO+0Nd5oqqhvk9xWnWjlekKbubK1ER iM2by+AF9qPWHSS45W/BLfqliFVksb1ifZob3TPrmvTfdqwI/vEVNl3Tl9R2b9qfppitfW2rKNQ8 Zs9bbbe27VtNX3anp5aahdIkSVMjHvRWQrIqMSRURvMvLvv0K/YlwT8OOZ8NOFYa/C6G0ypZ7Tc4 cmssMNNeo61rIplq463kc9JHv3VXLv0cqJtsm2jZdppiuofag2myZtb4b9bLRovFc3UlxiZNBWTR 3aSKN08at5JOVZu8RFbsj2MciIrU2C3l41K06x3F6XN8hz3HbXjtdFFNS3etukEFHPHI3mjcyZ7k Y5HNVHIqL1Tqh9WjUfTzIMXqc4sOeY7cscoopZ6m8Ud0gmooI4280j3zscsbWtaiucqrsidV6FEd Tpciv3aBXPGqHhzj1Ys2meDUEWO4x5yt1voLV5QrHPrWw1jmwvcm/cpyoqtRrPDlaqbxoTpdq/bO K67Z17lpulGmuX4nJa8ms/n201lDWXOORXQ1Xk1JKqI50bnRO2ZsqOcq9XKqhNfDrxYaacRtTlFu xe+2Blyx++3K301vp75BV1VfbaWVkbLo2FqNe2CVZG8q7OanM1OddybSnfZoY7j9Hppnt4pLFboK 9uo+R0TaqOlY2ZKdJo1SFHonNyIqIqN326J0LiAAAAAAFPOLf4ZPCj/h1+ioCYCH+Lf4ZPCj/h1+ ioCYClifXjwej5I9hPj9IYPObQy/Ybe7O9vN5XQTxt+Z/IvKv4nbL+IkXQu+yZJo/iN3mfzyvtUM Mjl8XPiTu3KvzqrFU1STkSNyye95V5t/iOzwnJInD9ineePLWbfg8sn2/wAmxHh5yve6fnHmscrR pYDOequPjTVn8oS4ADovKAAAAAAAAAAAGt6k48uWafZHjbWc0lxtdTTxJ/8AEdGvIv4nbKbIDFUR VExLe3cm1XFynbE58Fb9Jryl+02x248/M5aGOB6/G+L7G5f42KbaaJpzSrjGRZxp29OXzFfZZ6Vn hy0dSnewpt+BV/jN7ORRno5Tte7xGjN2aqNk648J1x8JAAboQAACOOy4+Anpl+Wv0xWkjkcdlx8B PTL8tfpitLWF63D5Z+57/otUAC24anHaO6WTZfa9LdSa3ELxlOM6f5SlVlNqs8k7K1bRUNayeoi8 nc2VVi7tqryOR2zlXdGo5UjjGsa7OPP89w/F9HdOsz1Ju9VdoKiR1vvmRPprAyPd6VtY6rqWRRtY 5E9Bd3qq7I1V2avocAKl6a/+8o1k/vCsP+khqF2w2q1F40OJnT6inZBUZPo/SWaGV67NY+pgdE1y /MivRS8YAoVodxrYJoZw22DSLNsbyKLWPB7T7H48A80VaV1zrafeOBsMjInxrFKiMd3qK5ERyqiO 6I7ZsyumQX7jl4W73l2NMx+9V2HZJVV1pSqSq8gqH0SK+DvUa1HqxVVquRqIqou3QueAKv8AH9il 2i0usmvmI0rpcm0TvtNmFK2Po+egjcja+nVfUx0G73fGkOxg+FOzV9+0J1R4j8io5IL3rZVXXJGM mT7LT2hkUkNsp1X1o2BnO1filN74ldJdftdXu0qsGXYnjGlN9p4Yclro0qZMiqIedVqKWnby+Tsj lYjGK9XK5Ec/0VTosv1uIUVNp7PgWL0lPQUkVmdaLdB1bFTxpAsUTOiKqNanKngq7IBRLgu4ydJd EuDHDcf1PnuVmv8Aa6CufarctsqHrf43VU74HUT2MdHKrnO7pyc27JGP5kamyro1403y3RPs/NAL lqDZK+gkxrVe0ZrksPksjpLVQSVVXJzyxtRXN5WSw8zVTdHP5VTcvXwl6RZJoPw74XpJl9dbay8Y 5SzQVU9tlkkpnufUSyorHSMY5U5ZETq1Ou/4SXQPO3igtOj+oOvOlvFhmdtvWVaG3vFanGbherM+ 503mmeOpmlp6uZKRY6lIXvkfHvty9N1RfQ33HQDF+B3KtebFcOHjTXLsmrcYpam4Jmvni9T2izzO Z3aQK6uqeSWWVj3JysY/ZNlXwVWXhAFAuE7XbT7hLsubcOuuVRdrDlllzG61dopG2arqn3+hqJEf TzUfcxu75XruiNTr1b8+269mPW3W5YJrTcL7Z5bRc6rWjI5q23zKiyUc7oaNZIXbKqczHKrV2Xbd C5AAAAAUL7Oj4G2n35W/StWX0KF9nR8DbT78rfpWrK+J9SPF1eSPbz4fWFkQAUnowA4K+sit9DUV 867RU0T5nr/atRVX/IgFdezo+Btp9+Vv0rVlkfDqpXTs86SWj4O9PIZk2c6K4yp/cvuVU9P8jkJj 1Qv6Yzp/fbwj+WSKjfHCu/8AvsnoM/8Aqchm7OjVVPijwNE3LduiNsxENi4VqfyvDL7mjk39lGRV 1dC/44GuSJiJ8yLG8G/aUYsuE6bY3i74+Sagt0LJ27bfZ1bzS/8A1ucC/Yo0LdNM7nmeUr8YnGXL tOyZnLwjVHwbWACVRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACv+ lH9YFr/7f/XvLAFf9KP6wLX/ANv/AK95zsX/ADFHhV86VHF+vT4T9G2kWaZaG+1zq5qnqn7KPOHt l1NsqPIPIu683+SQyR7d53ju95+8335Wbbbdd9yUwYzyQRMwFesh4VchtWoV+1K0C1tu2mlxyydK u/UHmmnu1sranrvP5NMre7lcqqrnNd1VV8N13sKBEzGxmJmNiBcN4Yr57Y1n1Y1w1lu2pWQYy2ZL DFJbKe1262vlbyvlZSw7o6VWoiI9zl9S7KqNVuz6ZaG+1zq5qnqn7KPOHtl1NsqPIPIu683+SQyR 7d53ju95+8335Wbbbdd9yUwZmqZJqmUNZHw7OfrxadftOsy9id4WDyDKKNLf5VS5FRptyMlaksfd zMRPRm9JU2Zuio3ZZlAMTMztJmZ2gAMMIt4jeHjC+JbTx+BZhNU0boahldbrjSbd/RVTUVEe3fo5 qtc5rmr4oviiojkirSLgakw/VK16v6v63ZHqpkGOweT2JbrCsUVCmyojuV0sqvc3mcqLzIiOVXKi u2VLTg2iuYjKG0V1RGUAANWrI6Af2I7D/wB6/pMpIRHugH9iOw/96/pMpIRZwP8AK2/yx8oX8P7G jwj5AALSYAAAAAAAAAAAAAAAAAAAAAAABj8hS/OsNxbiy0SXlaWVLetcrkp0qOVe7WXkRXciO2Vd k3232KpaE9mfoXpjepdQNTO91Uz2uqpLhW3fIIWrS+VyPV8ksVHurN1equ5pFkcjurVb4FvQB8sY yNjY42o1rURGtRNkRPiQi7iG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHI ieCo1zZTAFZeHniGzOizOThi4nYaa1aqWqBZLXdI05KDMaBu/LWUjtkTvdmr3kXRUVHKiJs9jN70 94fvYHxDara8+y3y72zobNF5q8g7rzf5BSpBv33eO73n25veM5fD0vE7nENw84ZxFYZHjuRTVNqv NqnSvx3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrmxxw88Q2Z0WZycMXE7DTWrVS1QLJa7pGnJQZ jQN35aykdsid7s1e8i6Kio5URNnsYGzZ7wxuu+vmOcRumWc+wnK6GPzfkjW2zyylyW2dNqepjSWL aRqNTkm3crdmdF5G7aXknCPrTTa/ag666OcUFPgsuobLZHX26bBqe7cjaKkZBGiSzVLd91a93Rjf f7LvtuWoAFbMF4O7iuplp1i4iNa73q9lONKr8fZV22C12q0yrtvPDQwKrO+6Js9XL1RF2VzWubul 74fvPHFJjvEr7Le58wYrUYz5l8g5u/72Z8nf+Ud4nLtz7cndrvtvzJ4EvgARBxH8R+NcPeNUcklu qcizDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZqKni5WtVxH8R+NcPeNUckluqcizDIp/N+LYtb/ AE628VrtkaxjURVbGiq3nk22aip4uVrV1Dhw4cMlsWS1nERxEXGmyLWPIoO7c6P06LGKJ2/LbqBu 6o1ERVR8idXKrkRVRXOkBw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlV yIqornSWOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQHxcU96obHieZY6tI242e9pTwyVfN3EXlMTo0f Lyoq8iPRm+3XZehPhqOrWEpqJpzfsQby9/X0jvJXO6I2oYqPiXf1em1u/wA25Ffomu3NMbV7ky/T hsXbuV7M8p8J1T8JUp0a7PvRzTy7S5vqD3upGaVlS+uq7pe4mrT+Uvcr3yR0vVm6uXm5pFkci9UV vgWga1rGoxjUa1qbIiJsiJ8RrOm2Tuy3DbfdKlHNrWM8mro3ps6Opj9GRHJ6l5k32+JUNnOfpzcj Sl6mMPThZm3EZZI47Lj4CemX5a/TFaWqKq9lx8BPTL8tfpitLVHVeIAAAAAEN8PvDv7ROlN60x9m HnzzvdrrdPLvN/k3deWvV3J3fev5uTfbfmTm+JDG6c8L/tf8IM3Cn7OPL++x28WDz95s7rby5ahe 98m713vPKPe976XJ4t36TsAK4X3gztd30l0ow2h1EudkzXRujpoMZzO20cbZopY4GQyq+mkc9j4Z Wxt54Vcu+yJzKm6LmsD0A1XpdRbVqPrJxKXzN5sfhnitdpttpisFsa+ZvK+WpggketU7l96kjuVq 9UbuTqAIm0n0G9q/VfVjU/2V+c/bQuVBcPIfIe583eTQOi5O87x3fc3Nvvys2222XxGgGg3tGVGp U/sq89+2Hnt1zfbyHybyHy1WL5L+6P73k5P3T0ebf3qEsgCpFbwB01x4WKnhirdUO8pqzKXZHPdf MipzRurPKHU3cpUbpunod53nz8vqMllvBpnepbLPhGqvEreso0ustfT1qYxLYKWCsuDKdyOghrbi x3NOxuyc32Jrn7bqvNs5LSgCDNYeGWszfUu0646W6nV2nGolrtr7JJdae2w3CluFuc/n8nqqSVWt kRr+rXI5qovx8rFbk9H9EM3wjL7vqLqhrlkGoWSXWijtrWupmWu00VKx6vRsFvhc6NJFcvWV7nP2 6IqIrt5gAEOcPGjFt4XNMbpjF3zumudHLfbjfprlU0zbfFAlVLz925HSvTZqrtzK5N/iTwN19t7S b7qGJfy3TfrmdyLG8dy+y1eN5ZYbderRXs7uqoLjSsqaaoZui8skUiK16boi7Ki9UQjv3J3Cx97T pV+Ztu/YgdfVTFcU4jcWix7BtaZrHfLDcKa9W+8YvdIZ5qKpiV3drNE1ysmhdu5HRSJyu6etEVNF Zwo6nZvl2IX7iG4kKnP7Tg16gyO02ShxSlskD7nAipBUVD45JHy8nM5Uaisbuq9NlVFmjB9HtJNM aiqq9NtLcQxOeuY2OqlsdkpqB87Gqqta9YWNVyIqqqIu+26m3gV3yrhWyy36q5Dq/wAP+t9Xprds 0ZB7JqGWwwXi3XGaFqtjqEglfGsM3Kqormv2dvuqbq7fZME4cKW04DmWG6q6g5DqZU6h997I628S d1FKySLulipaWNe7pI0Z4JH1Rdl5vRbyzIAKgycCeoF1wqi0OyviuyW76O0KwQNxlbBSQ3Ceghe1 0NHLdGu7x0TeRqdI2ryoiIqIiIku27h3o7TxOxcRFvyKOnpafT5mAwY9Hb+VsUbK5Kls6T950REa kaR938/N6iYQBBmsPDNWZxqZadcdLdTq/TnUS1219kkusFuiuNLcbc5/P5PVUkqtbIjX+k1yOaqL 8fKxW5PR/RDN8Iy+76i6oa5ZBqFkl1oo7a1rqZlrtNFSser0bBb4XOjSRXL1le5z9uiKiK7eYABA egXDPlOgObZZU2TWOe5YBkt3uF+hxOosULZKKuq3sc56VyPWR7GoxURnI1Ou67ruqz4AAAAAAAU8 4t/hk8KP+HX6KgJgIf4t/hk8KP8Ah1+ioCYClifXjwej5I9hPj9IYHPbuywYVfLw93KtLQTvZ87+ RUan43KifjJJ0QsEmM6RYlZpmcksVqgklavi2SRvePT8TnqhDOoVE/NsgxjSWl3d5/rmVVz2/eW6 nXvJVX4uZWoifGqbFnWtaxqMY1GtamyIibIiGuFpzrmrdq+vk35buRRh7dnrqmavdGqP/Z+gAvvM gAAAAAAAAAAAACvuqtF7EteLDkrW8lFmVsktFQv71KuBeeJy/O5i8ifgUz5k+I7E6zJ9L62ts7f9 l8cljvtucibqktOvM5E9aqsfOiJ61VDWsavtJk9gt+QUK/YbhTsnam+/LzJ1avzou6L86HMu06F2 Y36/P9972WCu9IwVFfXT9mfdrj4Tl7mSABqmAAAI47Lj4CemX5a/TFaSORx2XHwE9Mvy1+mK0tYX rcPln7nv+i1QALbhgAAGIs+X4nkNzu1ksGUWi53GwzMp7rSUdbFNNQSuTmbHOxjldE5URVRHoiqn Uy5UrhB+E1xXf34Wv+iPAs7acwxG/XK72axZTaLjcLBK2C7UlJXRTTW+VzeZrKhjXK6JytRVRHoi qibmAsuuOiuSZB7Esd1gwm63znWPzZRZBST1fMni3uWSK/dPi2KgYDp7eNYMu449NMZyJtmuWSXe jttNXbu5IpH0MjeV6t9JGL1Y7bdeVzui+BrFyg0+0s06x7AOL/gcbhVix+S3UzdQ8LdT1VJT1MUk aR1z6ml5KyiR8jU5lVXPcr9l3VwF2Ycwy1/EBPgb8m08XGmYml1bZ2Vsi5U2t8rSPyh0HN3aW/kV W95y83e7Jvt0OzX69aGWq0U+QXTWfBKO11lRLSU9dPkVHHTzTxO5ZYmSOkRrnsd0c1F3Rei7EB2q WKftTa+eCVskcmhEb2Pa7dHNW+RqiovrRUNQ7ODSDTnINHcyyXKsPtN+r7vml9oJJLpRx1Xd0Uc6 7UzEkRUZFzvlerU2RXSOVdwLsRXyyz2duRQXeiktT6fyttcyoYtOsHLzd6kiLy8nL15t9tupqVHr 1oZcLNW5FQaz4JU2m2zRU1bXw5HRvp6aWR3JHHJIknKxznei1qqiqvROp5o0FZXy8AeHaS+cauHH Mg15ZgtYxszkWOzPrppnQ82+6N52J6/WTb2lOg2keHaCWHK8HwyyYpcrPklotsbrPRx0fllHJO3e klSNESViOZHKiO35XRbptuu4X8AAAFc+I7j44c+GhlTbMqyxL3lEKKjccsatqaxr/imXdI6f1b94 5rtl3a13geWPER2ofEZr9Uy4vh1xi02xesf3DaO1Vnd1UzHLt/VFe7lcidVReTumbL6SL4ge5ltv tkvM1dTWi70VdLa6laOuZTTtkWlqEa1yxScqryPRrmOVq7KiOau2yod4qLw0a0cGPDvonjGlNs4k NPJprVSo+5Vbb3DvWXCReepnVVXdUdI53Lv1RqNT1En+7X4R/vjdP/5cg/WAmsoX2dHwNtPvyt+l assT7tfhH++N0/8A5cg/WKZcCfEToTgnCrhGK5lq3i1lvFD5y8poa25RxTRc9yqZGczXLum7Htcn zORSDERM06nT5JqpovTNU5avrC6oIk91vwxfd5wj+WIfrPifi94X6eJZZNd8MVrfFGXSN7v4mqqq UtGrc9Dz1vtRxS8Q7xdaoU2k3D7l2Qd+1tzr6KSzWeHbmfPX1TVjiaxqdXOTdz9vijcale+PrQBl Uyy6eVWQaj36ZF7m1YrZp6qVy+Cbue1jERV9aOVU8dvDfHYHo7qdrjqTZNfOJS301mo8dV82H4HE 7vW22R3KqVdbIvR9R0T0ETZqtYvoqitNop0ddSGu9FyJosznM8I70w6A6eyaU6K4Xp5UOV1TZLPT wVS/HUq3mm2+bvHP2+bY58zovZjnuDabMbzxVtzS73FqeHklKnOrXfM92yfhQ3gw+gFvXK89zDVW ZOelge3G7O5U/wB5hVHzvb8aOkVuyp8SoaZc5XFO+f8A6s85GDsV3o+7GUeM6o4bfcnsAHVeIAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK/6Uf1gWv/t/9e8sAV/0 o/rAtf8A2/8Ar3nOxf8AMUeFXzpUcX69PhP0baADVAAAAAAAAAAAAAAAAAyOgH9iOw/96/pMpIRH ugH9iOw/96/pMpIRZwP8rb/LHyhfw/saPCPkAAtJgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIs4huH nDOIrDI8dyKaptV5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc2UwBWXh54hszoszk4YuJ 2GmtWqlqgWS13SNOSgzGgbvy1lI7ZE73Zq95F0VFRyoibPYyzRFnENw84ZxFYZHjuRTVNqvNqnSv x3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrmxxw88Q2Z0WZycMXE7DTWrVS1QLJa7pGnJQZjQN35 aykdsid7s1e8i6Kio5URNnsYFmiIOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRV bzybbNRU8XK1quI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNRU8XK1q6h w4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlVyIqornSA4cOHDJbFktZxE cRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNREVUfInVyq5EVUVzpLHAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAVxzm0rpJqs+9MjWPFM+nRZn9Ejobvt1VV9STIm+/wDC38EQ2skfNcOsWf4xX4nkdIk9 DXxKx6fvmO8Wvavqc1dlRfjQgHF7pf8AEcgfpRqG/wD2Xo2K613FU2ju9GnRsjV/4RqJs5vj0Vev VTm3rfNV59U/Pc9hyfiox1iIn2lEa++mNk+MbJ9072P7Lj4CemX5a/TFaWqKq9lx8BPTL8tfpitL VHSePAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU84t/hk8KP+HX6KgJWulzobLbqm7XOp ZBSUkTpppHL0a1E3Uiji4VG8ZHCk5yoiImdKqr6v9ioDarBZJtfspSlSJfa7sFUjq2dejb1VsXdI GL64Wr1cvgq/iVKOJzmuKadsvS8jaFOGru3ZyopnXPujVHfPVH0bfw8YtX3GS56z5LRvp7hk7Gw2 qnlT0qS1NXeNPwyLs9fwNX1qTWfMcbImNiiY1jGIjWtamyIieCIh9Fq1bi1RFMOJjcXVjb9V6rVn sjdEbI90AAJFUAAAAAAAAAAAAAfjmte1WPajmuTZUVN0VCsWH0C6d51kukM3oUtJMt4sW/g63zuV VY3/AOXIqtX59yzxC3EpjNbBbbXq3j9M6W6YZK6WqjZ41Ntf0qGL8fKnppv4IjlKuLozp042x8ut 2+Q8RFF6cPXOq5q8Kvuz9PCXMDrWy5UV4t1NdbdO2alrImzQyN8HMcm6L/lOyU9rvTExOUgAMsBH HZcfAT0y/LX6YrSRyOOy4+Anpl+Wv0xWlrC9bh8s/c9/0WqABbcMAAArvdOF7OrFrNl+r+iWuTsJ XUBtG7JLVWY1DdoJ6imjWOOop3PljWB/Iq77o9qucqqipsiWIAFZMD4HrPiFo1ksFw1TyW5U2r9R S1lTXxOWkulDVRxr3lR5Ux6pJJJM5ZfRjjYm6s5FZ0Mdk3CDrfqdjHtZay8X10yfAah0DbjbKXD6 K33C4wRSNe2KaubI9ermN5nNja523VeqlrABD9s4eqa08Tz+IujyVsdP7AI8FisDaDZImMrW1Lah KjvPDZqM7vu/n5vUc3DNoL7nTT+uwX2V+yDy2/XG+eVeQ+ScnlUvP3XJ3km/L4c3N1+JCWgBSrUf hi0t0U4McxwbV/Pr5VWKHJJstZkVksz21lnqpqpr4ZWQsfKrkjc7lc/dEVjnL6HikH8U1I7UbAMC w648Xtu1yy+/5TaKbErRYKKiooo+aVFmuFTBSySOke2FHM7yRzY2JLJsxFVVT1BnggqoJKWqhjmh mYsckcjUc17VTZWqi9FRU6KhqWKaNaQYJdpb9g+lWH47c6hqtlrbVY6WknkRfFHSRMa5UX51A3EA AQNxE8EfDzxNU8tRqBhkdJf3s5YsitHLS3Jiomyc0iIrZkROiNla9E9SIvU8teITsquIfQysfmGl XLqRYKGVKmJ9upUS50yNXmTvKJ3N3uy7J9iWTfZVVjU6HuGAK18MNp4deIXRPG9TYdCNPqW4VcC0 t6ofYxRtdQ3OFe7qoFasfM3aRqq1HdVY5i+slT3PegX3D9P/AM2aL9mbrSWm1W+qrK2gtlJTVFwk bNVzQwtY+oejUajpHIm71RqI1FXddkRDtgR/7nvQL7h+n/5s0X7MpFwBaVaX5JwkYJesi03xa6XC p86d9V1tnp55pOW51TW8z3sVy7Na1E3XoiInqPR0oX2dHwNtPvyt+lasr4mcqHU5JiKr857vrCW/ aO0U+4/hP5v0n7M+4dFNG6eRJqfSXDIpG+DmWGlaqfjSM3MFPOXoebo3Ola7HZbHE6Cy2iit8btu ZlLTsiau3hujUT41O6AYb7Go6pZLV45iczbQ10l4u0jLXa4mL6b6qZeVnL86bq78RNemmE0enWCW bDKLlcltpmslkamySzL6Ur/+s9XL+MhrTa1rqdrHUZTK3vMewDmo6JfFlRdXp9kenqXu27J8zlaq FiyxhKM87k+Efv8AexyeXL+hTRhKer7VXjOyPdHxmQAF150AAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAg+waVat45aILLQXbFHQU/NyLKlQrvScrl3VGp63L6icAV7 2GovzFVUzExnsnLbl5Ibtmm7MTV1If8AYNrN9s8P/wAWp+oewbWb7Z4f/i1P1EwAi6BR2quKPolG +eKH/YNrN9s8P/xan6h7BtZvtnh/+LU/UTAB0CjtVcTolG+eKH/YNrN9s8P/AMWp+oewbWb7Z4f/ AItT9RMAHQKO1VxOiUb54of9g2s32zw//FqfqHsG1m+2eH/4tT9RMAHQKO1VxOiUb54of9g2s32z w/8Axan6h7BtZvtnh/8Ai1P1EwAdAo7VXE6JRvnih/2DazfbPD/8Wp+oewbWb7Z4f/i1P1EwAdAo 7VXE6JRvnih/2DazfbPD/wDFqfqHsG1m+2eH/wCLU/UTAB0CjtVcTolG+eLV9MsVrsJwe24xcp4J qmi77nfAqqxeeZ7023RF8HJ6vE2gAtW7dNqiLdOyIy4LFFMUUxTGyAAG7YAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAIs4huHnDOIrDI8dyKaptV5tU6V+O5FQLyV9kr27Kyogeiou27W8zN0RyIngqNc 2UwBSvs6cGfqfgdr4z9W7/VZjqZmMFXQU9fXxsbHZaClqpqRKekjaiMjWTuXPe9qIq94qdN3q+6h VXsuPgJ6Zflr9MVpaoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABqOpemlh1OsKWi7rJTVVM/y i3XGn6VFDUJ72SN34k3b4Knz7Km3A1qpiuNGrYktXa7FcXLc5VRsl5q6PUHHrwt2GycMlru+ilFQ 2dtS+zVl5pbnKlybPUy1D+7njVrXOR8zk5VY1yJypsq+Ms+yztK/t5w8fQLx+sWzzXB8Y1BsU2O5 Xa462kl6tVekkL/VJG9OrHJ6lT8HVFVCBrzbc+0Q9DIkq8rwuJPsd6hj5623s9TaqNPftT/hG/j9 TSrdru2pz20/Lx83awOHwOOpiiPs3N2eqr8s7+6fdnsjRfZZ2lf284ePoF4/WHss7Sv7ecPH0C8f rExWi82q/wBBFdLLcIK2kmTdksL0c1fm+ZfjReqHcNIxFcrU8k4emcpieKEfZZ2lf284ePoF4/WH ss7Sv7ecPH0C8frE3AdIrY9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4o R9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6B eP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0 C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4 fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5 w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOkVnovD7p4oR9lnaV/b zh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1ibgOk VnovD7p4oR9lnaV/bzh4+gXj9YeyztK/t5w8fQLx+sTcB0is9F4fdPFCPss7Sv7ecPH0C8frHxPm XaSU0L6ipyLh0iiiar3yPoru1rWp1VVVXbIifGSlluc47hdNHLeatVnqHIymo4G95U1L1XZGxxp1 cqr038PjU+cc0iy/VSogverUMlkx2ORJabF4ZF72qROrXVj09Xgvdp+PZU6ov3a50aNc/vazXyZg 7FHPX50afjPdEdfyjrmFcMW0u4qOL7WfBNQNZr1gdLhOm8t3gbccVhrqSS5NrqZIZo4PKObvE3ij ar/QRGuk98uzT0FslktOOWmlsVioIaKgoYkhp6eJuzWMT1f/AHVV6qqqq9TsUdFR26khoLfSw01N TsSOKGFiMZG1OiNa1OiInxIcxbooy+1Vrne4OIxEV/w7UTTbzziM89eURnPfq8gAEiqAAAAAAAAA AAAAAAAHxNDDUwyU9REyWKVqsex7Uc1zVTZUVF6Kip6j7AFYbBb59Kc8uGkNe53mup7y54xO9yrz 0zlVZKbf+FG7fp4qm6+Cob2bDrZppJqPijUs8yUuSWWXzhZKvm5e7qW/vHL/AAHonKvq8F67EdYF mMeZWPyuanWjudHI6kudC7o+lqmLs9iovXbdN0+b50U5ddvma9Dq6vL3fJ7XDYmMfYi/96NVXj1V f8vnn3NkABhuEcdlx8BPTL8tfpitJHI47Lj4CemX5a/TFaWsL1uHyz9z3/RaoAFtwwAAAAAAAAAA AAAAAAAAAAAKF9nR8DbT78rfpWrL6FC+zo+Btp9+Vv0rVlfE+pHi6vJHt58PrCyIAKT0YafqTktz tFtpbBjEff5Lkc6W60wovVJHdHSr8TWIvMq+CLtv0NnudyobPb6i63OpZT0lJG6WaV67I1qJuqnV 0CxKvyi8VGueVUb4ZbhEtLjdJIv+1LevjMqep8vjv/BVdujumIpm5VFFPX8IZqu0YW1OJua4p2Rv q6o+s93uSfprglt02wq2YhbV50o4t551T0qidy80krvjVzlXx8E2T1GzgHVppimIpjY8Tdu13q5u XJzmZznxkABloAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB50Zf2iWovCFr9fNC+JXF 5cqxmCZtXYsntsbIbjJa5lVYHyxLyxVKsRHRPc3ul54nr6SgTb2XHwE9Mvy1+mK0tUeMfD/2lF20 Y4ZdPOHHRbTSXIdRWzVtF5VcV/qOOprLnUSQRwxRu56h6pPGnV0aI5dvSPXbTW0ZfYsCsds1AyPz 9k0VGx14uKRMjZPWO9KXu2Ma1rY0e5zWN26Ma1F3XdQNmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAD8VEcitciKipsqL6z9AEOZfw8US3GbKdKLwuIXuVVfPTxs57bWu33XvYPBqr4czNtt1XZV 6mj1GfXvCqplp1gxebHZnu5IrpBvPbKlf7WVN+RV/gv6p61Qs2cFbRUVypZaG40kNVTTt5JYZo0e x7fic1eip+Eq3MLTOujVPw4O3heW7tuIoxMadPCqPCevwnPuyQ9SVdJX00dZQ1UVRBKnNHLE9Hse nxo5Oiocpx33hoslNVS3fSvJK/Cq6RVe6np/s9umd/b0z12Tw29FURN16Gp3Cr1iwPducaeuvlDH 43XGVWf0U/fPpnbSN6dVVOiddirVRXb9ePfGt27N/DYr2FcZ7qvsz5T7pz7m4A1jG9TMGyt6QWbI qV1VvyrSTKsNQ13gqd2/Zyqi9OiKbOaxMVa4S1267c6NcZT3gAMtAAAAAAAAAAAAAAAAAAAAD5kk ZEx0kr2sY1N3OcuyInxqoH0DSrpq9hdFWpaLTVVGQ3V26MoLJA6smevxJyeii7/Gp3rfiuvOeqix 2+36f2qT/f61UrLi5vxtib6DF8ej13ToaxOlOVGvwSV0czTpX5iiO/VwjbPuiWUyDJsfxWhW45Fd 6agp032dM/ZXL8TU8XL8yIqmv2up1R1S2Zp3YHY/ZZfHIb3CrVe3+FT0y+k/5nO9H49iR8M4edP8 Wrm326RVWUX1Oq3O9yeUyNX/AOGxfQjRN+mybp8ZJ5ZowtVWu5OXdHn5cXJxHLVmzqw1OlO+rZ7q ev38EeadaIYhp9UOvblqL5kcyL396uTu9qHb+LWeqJvqRG9duiqpIYBcooptxo0xlDz9/EXcVXzl 6qZnv/ezuAAbIQAAAAAAAAAAAAAAAAAAAR7qtxB6J6HMpl1Z1MsWMyVsbpaaCtqUSedjV2c5kTd5 HIirtujV69DL41qdiGb6cwaqYPWzZBj9ZQS3Giloqd/e1cbEdukcciNdzqrFajXInUDayBNbMKue E39+tuE29Z4ljbFlVthb6VVTN8Kpif8ACRp4/G3r09Lfl0c4l8v1hzJtmThj1PwvHXUss/n3LaGO 3pzt25I0p+Zz15t12VF26fOZbW1vFfVXSit/D5HpXBapqVfONbmC18k8cyuVOWGGmTlcnLsu71Tr v0Uiu2ou06MrmBxleBvRcp1xsmN8dceW6dbo2m62++W2mu9qqmVNJVxpLDKxd0c1f8y+pU8UXods iG96cahaH4ii3q/RusuQW9aW+VthhcxmP3SWNWOrKSN26tgV68yNX3q7J8SO4tHNAZNO7+7OavXr UvPJ62gdTNiv98bU25I5HMf3kUDWIjXegmzkcvRVT1nPiJiZpr1TD1dVVNcU3bGuirr3d098f72S kTKdQcCweNJc1zewY+xzedHXS5Q0iK3dU33kcnTovX5iDuzn4leHvAODXT3Ec51twiwXug87eVW6 5Xymp6iDnutXIznje9HN5mPY5N06o5F9ZKea6DaNakZNTZhqBptYcju1HSNoYZ7nStqUZA173tZy P3YqI6R69W/vlPhnD3oExqMZofp+1rU2RExqiRET/wAMmtXYtudjcHcxcxriIhIXuxuE/wC+R02/ Oak/aD3Y3Cf98jpt+c1J+0I/9z7oL9xHAfzaov2Y9z7oL9xHAfzaov2ZL0mNyl6Gr7UJA92Nwn/f I6bfnNSftB7sbhP++R02/Oak/aEf+590F+4jgP5tUX7Me590F+4jgP5tUX7MdJjcehq+1CQPdjcJ /wB8jpt+c1J+0HuxuE/75HTb85qT9oR/7n3QX7iOA/m1Rfsx7n3QX7iOA/m1Rfsx0mNx6Gr7UJA9 2Nwn/fI6bfnNSftB7sbhP++R02/Oak/aEf8AufdBfuI4D+bVF+zHufdBfuI4D+bVF+zHSY3Hoavt QkD3Y3Cf98jpt+c1J+0HuxuE/wC+R02/Oak/aEf+590F+4jgP5tUX7Me590F+4jgP5tUX7MdJjce hq+1CQPdjcJ/3yOm35zUn7Qe7G4T/vkdNvzmpP2hH/ufdBfuI4D+bVF+zHufdBfuI4D+bVF+zHSY 3HoavtQkD3Y3Cf8AfI6bfnNSftB7sbhP++R02/Oak/aEf+590F+4jgP5tUX7Me590F+4jgP5tUX7 MdJjcehq+1CQPdjcJ/3yOm35zUn7Qe7G4T/vkdNvzmpP2hH/ALn3QX7iOA/m1Rfsx7n3QX7iOA/m 1Rfsx0mNx6Gr7UJA92Nwn/fI6bfnNSftB7sbhP8AvkdNvzmpP2hH/ufdBfuI4D+bVF+zHufdBfuI 4D+bVF+zHSY3HoavtQkD3Y3Cf98jpt+c1J+0K2dnR8DbT78rfpWrJT9z7oL9xHAfzaov2Zt1hx+w YraYLDjFjt9ntlLzdxRUFMyngi5nK53LGxEa3dznOXZOqqq+Kkd29FyMslzBYCrC3JrmrPVkyABo l1kv+quSy6XYFWOpaaDb2R3uPq2ihXxgjXwWZ3VNvV1+JVbXmeqNrrUUxOdVU5UxrmeqI/fGdT6t Nkn17zNbOxqLgGNVTXXWdF9G7VjOraZip4xtXZXKnj+NqlmYoo4Y2QwxtjjjajWMamyNROiIiJ4I YrEsTsOD47RYtjVC2kt9BGkcUadVX1q5y/vnKu6qq+KqpmC/Ys81Tr2zteW5Tx/TbkRRqop1Ux85 nvnr90dQACdzQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoV2unDd7aWiEGsmO0He ZFpxzz1Xdt3fUWeRU8oRdvHunI2ZFXo1iTetxfUhjig1/wAL0SwptuvFiflmSZer7Pj2HUrO9qr9 USpydyjNl2i9JEkeqKiIu3VVa1Q8x+x84bvbB1ar9eskoO8seAfYLX3jd2T3iVnRU9S9zE5Xqnij 5YXJ4Hs+Uo4CMug0Lt1NwY6tYJT6e5/b0qLxbY21CTUmSU88jpXTU9RuqSyxovdPZzOVEhTb3rms uuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADTs31l0g0yrKa3akarYdilXWRLNTwXy+0tD JNGi7K9jZntVzd+m6dNwNxBFXuseFj75bSr88rd+2M7b9bNLLvn9s0xs+Y0txyK9Y63LbfBRRyTw 1NndJ3bKtlSxqwLG52yN9Pd26KiKi7gbwAalprqtgOr9nr7/AKdX7zvb7bdKmzVNQlLNA1tXTuRs rG96xqvRqqic7d2L6lXZQP3MdKdOdQGOTL8OttxkcnL5Q6LknRPiSVmz0/E4jqs4a6+zbyaa6q3+ ytTq2iuKNuNIn9q1r9nMT591UnEEVdi3cnOqNa/h+U8XhY0bdc6O6dccJzhXWqsXEVjG/luH4/lt Oz/fbTXrSTK341ZOmyr8zTE1OrlJYt25xhWWYxy+/lrrVI6D8LZI+ZHJ86IWgBBOE7NU+/W6Nvl7 P21qJ8JmmfrHwVztWqenN62835paXOd4MkqWxPX/AKr9l/yGzQzwVMaTU80csbvBzHI5F/Gh837L eF3JK/UagyCix+tqtKqWOtzCWaxyKtsifTvqEd33dbSr3Ub3KkLnuTbZURyohpy2bgtpqLAMmhp5 KSHVWenp8Skpn3eB1yfNH3ke0cao6FqsVHc0rWNRFTdUI5w12NmU8Y81qOV8DVGuK6fdFXxzp+Td gbXQ6M4Dbtkpaa9I1PBr8iuL2p+J06oZqDB8Zpm8kdBKqf8AxKuZ6/xueqm0Ya515fv3IquV8NHq xVwj9Uo6BntUsm0f0Vwus1D1MrvM9goJIIZ6ru6qpcj5pWxRtbFCj5Hqr3tTZrV233XZEVU/JMo0 ei1Sg0VfW/8A4zqLGuSMtiRVSr5tSbuVndKid01O8Tl5XPRyr4JsZ6NX3NfS9jdPw82CBJXsQx37 Xf8A86T9YexDHftd/wDzpP1h0avuPS9jdPw80agkr2IY79rv/wCdJ+sdaq0/xWsRUmoqpu//AAVf URf6D0MdGr7mY5Xw/XE8I80fHWrrnbbZH3tyuFNSM8eaeVsafxqqG2V2hOm1z3Svob1O1f3r8kuX L/i+UbGPoeGTQugqFqo9PqWeVy7qtZVVFUi/ilkchrOHu9WXGfJNTytgcvtaf9sfq+iN7prPpfaX d3PmNDPJvyoyjV1S5y/EndI7qfFNqFk2QbNwfSLLrwjveT1FMlDTP/BLKu3+QsJZMPxLGmo3HMXt NrRE2/qOijh/0UQy5tGErn1quEefkir5csU+ytTP5qvpER81e6XAOInJtlrK3F8LpnfwEdcatn4u kS/xmct/C7idW9lTqHk+Q5jM1UcsVbWOgpEVPBWwxbbdfUrlQmgEtOFtxt1+P7yUbvLmMr1W5iiP 6Yynj63xYnHcTxjEaNLfi+P2+1U/rjo6dkSO+d3KnpL869TLAFiIiIyhyq66rlWlVOcgAMtQAAAA AANT1S1TwLRbB7hqRqZf0s2O2pYW1VYtNNUKxZZWRRokcLHyOVXyMT0WrtvuuyIqoG2A+WPSRjZG oqI5EVN2qi/jReqH0AAMXf8AHbfklIlFcai5wxoqrvQXSpoZOv8Ab08jHf5QMoa9LqHgEORU2ITZ zj8d+rXujprW65wJVzua1XOayHm53KjWucqInRGqvqO5jONW7ErSyy2qpus9Ox75Efc7tVXKfdzl Vd56qSSVU3Xoiu2ROiIidCM9POEDhm0qyOPMME0ax+3X2GZ9RDcnxvqamGR6KjnRyTOe5iqjnJ6K p0VUA7+unEzo5w4UloqNWMkqbbJkD5orVT0tsqq2WskiRiyNakEbkaqJIz36tRd+m5smlWplj1gw O36hY1bbxQ2+5rOkEF4oX0VUiRyvj3fE/q1HKzmavra5q+vY2xY43PbK6NqvYio1yp1RF8dl/En8 R9AV+0r1l4ps/wA9t1Hl/Cb7AMJk79ay73PLqSqrW7QvWLkpIW8yK6RI2ruq7I5V9Rs+u2EcQ+aS WWDQvXC2acwRNqEu1RU43Dd5plXu+5WJsyoxvLtLvv47t+I23TXVbAdX7PX3/Tq/ed7fbbpU2apq EpZoGtq6dyNlY3vWNV6NVUTnbuxfUq7KbaBqWn2J5bj+ndDiWoefz5nfIoJoa+/+QR26SsV73qjk hiVWxK1jmtTlX97v6yMNI+CfRPRvN6XUmwyZbd8oo4poYbnfckq617WysVkm7HPSN27VXxau3imy oik+ADA37AcEym50d6yfCrDd7hbmOjo6uvtsNRNTNcqK5I3varmIqoiqiKm+yGbiiigibDBEyONi I1rGNRGtRPBERPA+wAAAHDWUdJcaSagr6aKopqiN0U0MrUcyRjk2VrkXoqKi7bFbcoxW88PlZJcb dFVXTTepl5nsbvJPYXuX+N9Oqr+Fv4ff2YPieCGphkpqmFksUrVZJG9qOa9qpsqKi9FRU9RDesxd jdPVLocn8oV4GudWdE7Y3+Ux1T9NSGKCvorpRQ3G3VUVTS1DEkimicjmvavgqKhzms5dpPk+kVTU 5TpPRy3bGppFnuOLoqrJTb9XS0a+PzrH/Fv05e5imYY/mltS6Y/XNnY1eSWNU5ZYH+tkjF6tcn// ADdDnznTOjXGU/vY9VTNu9b56xOlR8Y7pjqn4T1M0ADLUAAAAAAAAAAAAAAAAAAAAAAcFfX0Vro5 rjcquKlpadivlmlejWManrVV8DS7PRZjr1USUWMS1WPYM1Vjqr46NWVNyT99HStcnotXwWRfrauM 5z0Y1y3imIpm5cnRojbM/vXO6I1v2e7ZJqjfqjT/AEuqO5ipnd3e8iRN4bexfGOJf38y9UREXp82 yq2e8CwPHNOMbp8Yxmk7mmh9OSR680tRKvvpZHfvnr61/AibIiIdjEMPxzA7BS4zitsiobfSN2ZG zxc71ve7xc5fW5eqmaL1ixzf2qtdX72PNcpcpzi/4VqMrcdXXM75790bI4zIAFhyQAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiDiP4j8a4e8ao5JLdU5FmGRT+b8Wxa3+nW3itdsjWM aiKrY0VW88m2zUVPFytaoOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNR U8XK1q6hw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlVyIqornSOHDhwy WxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6SxwEWcQ3DzhnEVhkeO5F NU2q82qdK/HcioF5K+yV7dlZUQPRUXbdreZm6I5ETwVGubHPDzxDZnRZnJwxcTsNNatU7VAslruk aclBmFA3flrKR2yJ3uzV7yLoqKjlRE2c1lmSLOIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK9uys qIHoqLtu1vMzdEciJ4KjXNCUwVm4eeIbM6LM5OGLidhprVqnaoFktd0jTkoMwoG78tZSO2RO92av eRdFRUcqImzmssyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0zPtNdIMra/JtS9OcTv7rXSP/ AKsvNmpqySCnZzPc1HSscrWp6S7J03VVNzIS42c39rzhM1Uyds3dStxuqoIJN9lZNVolLEqfOj52 qnzgQD2cOgmkmacNrNTs30ewy6Vuc5JeL5B5xsFJUOpaZal0EcEfPGvJE3uFVrG7NTmVUTqYrFrl qffuPbWh2gOHYy+bDMasWFUNwvjpILNZ6NI0nlh7qmTvHvWZnKyFnI1Gxvcrm8rWutdwt4SmnHDf pphb4u6mtmL29tU3bbapdA186/8AiPepDnZyNTJNOdRda5URztT9R79f6eZfXRtmSGFiL/BasUu3 4VAyujfFRnV4w7W5ms2OY9b8q0Olq23WexSTOtldFHSvqGSRJMqyM3SN27XOVdlb4KqomqQ8YWsc umHD7R0+KYVDqVrzDVVNNUXGSoorBbYYmJO1zm88kz3vilgRkaSbve5dlTdGkAOymrd2fXEDrDQI 6W6a5aiXKK07eM9NVV8NGyFq+tGxsqdv4iyetOTcLOEWTHOGTijwOoiw21Y5Qts2RXS2SPtM00Ef cLDBVU+8lNUMYxFVV7teV3RdlTmCTNNMj4r6LURMR1rwfCLnjtZb5KqnyrD55qeGkqGORPJqmlq5 HSqr0VVa+NXImybp1VW5bim1PyvRbh9zbVTCaG2Vl6xq3pXU0Fyikkpn7SsR/O2N7HqnIr1TZydU T8BAPBNcKxdZs7smjmWZnk3D7SWekdZa7JFqZYqe8rJ9kprdPVNbLJTNi5ld4ojuXr1Rzp54t7P5 +4WtXLWjeZ8mFXl8afHIyjkez/6moBFPFxxf5lolo/imRaY2CyXnNMntkl+8kuUUz6OltVNSJUVl S9sUjH7Ir4Y2Ir03dKnVdtl3zV7XfKrFmekemGltvtNfk+pFwSrq/OMUssFusFPEktbVq2ORio/Z zGRczuVz1VOu2xUrBbXcda+ELWbiSyGklbC7SebCcRjmaqLHbLXb1fWTt/5RXslX49qdieo3Xh9y m4XLSXU3jyyeGSB1Jg78fwtk7dnQWi1UrlklZv1RaqvZI/ZeuzGfGBi9aOJjNdW+AvWfMa622mm8 +ZjV4LiEdtikY6ttr62CmY+VXyP55nMdU8yt5Wryps1OpvGT4tSv41OGrRKg5ZLdpFgdzyKWJqei rFgZbqZ6p6uWSJFT51IesuErQ6E8DPD26Je8yzKqfOa+FU9KanpmSXKdr/WqbVjd9/DlT4iftDv/ AMdcfPEDn6+nTYbZ7BhFBKvr541qqpifFyzNTdPnQC19RK6CCSdsMkyxsc9I49uZ6om/Km6om6+C bqhUHMdd+NzFtPcg1tu+muk+M49j9PV3WTELzc6uS/vt9PzOdzVMLvJmTOjYrmtRj06tTffobx2g V01Ws/CnmNdo8+7RXtqUzame0NctdT29Z2JVSQcvpcyRc26t6tar3IqbbpSnigsHBfPwn5JX8LWl dNmF6paWifcMtS21U81ohfUwtkqKqrnbutQ/mVqxtVXt5nvVrWsUCxHFdnFFr1g/C9jtqopqak1f zXH8hnoplRZG2qKn8rnjdt0VWpLFuvhu35xi+oWM2Hi84oOIjM6t0WOaVYxZcYZUNbzPczulq6qK NN+r+/Y1qN36ue34zr2KfENQuNTQTGsBukN1xPSvSetyO3VUTVSFzKrktsSojkTZeSNjkRU322Ui K2adZrrx2e/EBm2B26oul71W1BueWUdNA1XS1lBTXOBUgjROrlRtLNyNTdXL6KdVQCfpNceOG5aU VHENZ9LtLrbikdsfkVPidzrK99+ntbY+9RXVLNqeKd0Sc6MWN226Iuzt0Nkxbi2uee6r6F2jFrRb 4sM1hxK535zquKRbhS1dLG16wNe2RI9m8ytdux26t3RUQ0fVLjP031X0Ku2l/DrS3fJNSMwsz8eo MWpbRUx1FolqYu5kfVufG2OnZTte5Vc53LuxNlVu7kjfiOtd14OqPhPfjNG6837C7PkeJ0LKeNXJ XXmutMcNPs1eqsfW8i7L+9VQJ3xjizy3LuMufQ60WKzLp5FBdrZDeFjlWtqr3bY6aStYx3ed2kMf lbIlTu1Xnjf6WybG9aM605ZrBq3qjQW232lmnOC3GLGrdcGwyLWXG8RMR1f9k7zu+5hc5saIjN3O VV5umxUniCtV64OG8NFBhlLLe8wpbTl1hp5I294+55LdaelRs7t+rkdXSd4vN+96bl3OHzSC3aE6 O4zpfQz+VS2ijRbhWKqq6tr5FWSqqHKvVVfM+R3XqiKieoD61vzDVHDcPhqdHtNmZnktwuEFvgp6 itbS0dEyRVR1ZVPVebuY9vSSNFeu6bIibqkMWfiD4gNPNdNPtItfLXppdqPU1bhT2q44TNWMkt9V SQpK9tRFVOcsjHI5qI9qt2VVVUTbZY74vK7E6ji6wmw8UVxuNFoMuJT1FDE99Syz1+SJUORY61Yf fK2Dlc1r15d+VE9+9F0LDrboFj/aH6W3TAtMaXT3D34pcJsZr3WaWhbklzne+l5mMcxHo1I3v5Fk Rqqic6ehJG5wT/bOIriA1I4jdW9EdJMUwzzPp+61QQZHemVXc0801MslRHMyKTmqJO89GONiRIjW SOfJujGvx+OcVWtlw0p4gm3bFcQ9srQx1Qjn0MdVLZroxlO6oY5sTpEmaqxxyIrO83RVb18UOfs5 dsl061F1qlTmdqdqRfr9TzL66NsyQwsRf4LVikRPwqdDs/bNRajaSar6mXiLv6XWDP8AIrijl/f2 5z/Jo40/tW8kyJ+ECSMp4p7Ph/CHbeJq5UsM9Td8ZoLjb7ZAjv6rulZCzuaONu6uXeaRGqibuRrX L15VNJTiO4i7jfMS0BxrCcLr9aKrHI8mzSpqXVNNj+MU8jvscL2NfJPNOvM1nI2RN1Tn3RrvRgLg ZxTMdc6rBMEz63TMwvhfq7hSTsmT7FeMqbW1DaVdvWyjpVjcnrSSROio4k+l1Cxfha429a8w16qK iw49qlQY9U4vks1FNLRPSipXQT0bpY2uSOXmVF5V23RiL++buEn6Ya+6v2ziBXhr4h8dxKK/XSwO yTHr5ij6ltBXU8cixywSQ1Cukimbs53vlaqJ6t0307RLiJ4q+JKzZretMsX03s9qsWW3W02e836G udBcKKF7W08bYIZud8iJustRzsZu9rWRKrXqmozZhcNQtYNSeOahtVyt2nml2mdwsuG1txpJKR98 rEbJUz1sMUqI/uU6wtc5ER6q3bqjkTe+Gzbh57NuyZRJ9hqLRgVdlrnO986aoimrmovxuVZWtTfr 4IBy4Vx10NVwkQcROc4c6K/uukuNRY9apVk853ptQ6CKCle7deWRU5t15lY1H+/5fSx+ouv/ABhc P+GQ6263YHpfU4JS1VI2/WjHaquW82imqZmRNkSaVVgqXRvkYjmtY1FXwXbdyV8yHRB9p4CeGKty HFbxfsOx3IKDL82obV3/AJY23V/fzvqk7hWzfYkqURVYqPai7oqIiqm6Y/p32c+s+W2TTnSfTHNN S4rxKq3eqosiyNLdZaZjVck1ZLVVTI9+drWpGm79/VujUcHoXDNHURMnhej45Go9jk8FRU3RSjFt u/EBnXaIZlWwZHp/FYdHLJS2yoSroKx0dNa7pMyse5qpOiJcFpoGtdKq9zsxE7vpuXojjZFG2KJi NYxEa1qJsiIngiFAdCrjS6gZXxn6YQ3CWg1XzG9ZBSUFuqaWaNzbXBSeR2+pWVW92jFfUdPS32VF TdFRQJPwrXriq4jLTcNSOHTD9N7Np+2rqKSw1eavr5K3IGwPdG+oYymVraaJz2ua3n53eiqqhKfC zr6nEZpWzN6vHHY/erdcquxX21LMkzaO40zkbKxkmyczVRWORduiO267brXPh04xdI9GuGnF9Kb/ AG3IKfVHDbOlmnwGOxVi3aquUXM1I442xK1Ulfs5JN+VEf1VFRUJq4GtHMr0X0AoLVqDE2HL8kuV blF/gaqKkFZWSc6xboqpzMjSNrtlVOZHbKqbKB3+JLiAyHSy6YVpjpfi1FkupWpFdNR2Ggr6h0NF TQwMSSprapzEV/cxMVFVrfSd12X0VKycVmQ8RGR3rSLhm12x/C6j2xc+tFXDd8QdVMo5bfRSo+vp p4KpXSNkZ3lPI1yOVr283vVbsbrxG5lZtFOPHTTWrVhKu3aeJg9fYaa+JSSz0tBd31EjnJL3bXLG r4nMai7dd19TXKmLj1Qt3Ev2h2lLMZtdy9iWnOGXnK7fXV9FJSpc3VbkoXVEUUrWydy16RtY9zW8 zmPc1FbyucEr3vXvWnU7VXKdLOF7HMOfTYBNHRZNlWXPqX0Lbg9vMtDSwUytklkYn7o9Xta1d029 6rsbiPE5qtdsb1swnMLBiGO6q6L0kVbWztdU1VhrKWamdUw1TG8zJ0asUb941fzIvJu7qqNq1g2G 8I2muY6pYxxoW/I7FnU+c3e70NX5xv8ATQXy2VEiSQT0qUEjY5nLu5FRGrJvsi7qio2S8zwTTvBO BHWrVXQzQrMMJuOdWR1BVU19ra2suddbWzLTx1To6ieZ8LPJ6iaTlXlcjffIrUa4Bwv6vajcPXCJ JrtrK6y36mz64SXuwWi00k7L3d75dauRzYppZJHRO7z0FbyRorY2qq86t2WQdRdf+MLh/wAMh1t1 uwPS+pwSlqqRt+tGO1Vct5tFNUzMibIk0qrBUujfIxHNaxqKvgu27kivX21YDqZwn8POUYbRXbNd J9O7/ZmZPFZ6eshqUttNSrSzVDGsRk/2Jd+Z0ezk5lVFREVU5cf077OfWfLbJpzpPpjmmpcV4lVb vVUWRZGlustMxquSaslqqpke/O1rUjTd+/q3RqOCdNZeJHVSw8SuFcPWjeLY7favJ8Wq7/UzXTv2 Mo294sdPPJLG/wCxwNWOVzk7t7pFRkbVYr+ZMVl/EJxHYxrvp3w4WjG8EyLLcgxWuv8AkNVFDWUt BRKkz4qedjllfJHA3kdzNc2R8jkaxqx8/M3g0Oiizbj717zpkbVpMGsVgwa3SInREkjWqqY2/Fyy sRFT50PvRHbOuPvX7Pl+yU+F2Sw4RQSr137yNauqYnxcszURU+dAOPEuIviauWtGZcMdzw3AbhnF ioqO70uR0C1lPY6e3zs3c6qge986zI5Y2siY9O8V6rzMaxXLnNLuKDOKi0a7WnWCz45FkehjX1Fd W2Hv222vp3UUlVE9jJnOkjcjYnI9qvdsqpspiODz/wDGmv8AxPayO+yMrs3p8OppfFEjs9KkLkYv xKsrVXboqoilaLjk9U/ge4l9YaDmluetOpNfa7Lyr1nopa2GjhiRfXtH5Un4gJ4yPjJ1jxfhv0D1 HTB8fuueav5DbaKayUVLMyF9DVd7Iq0rX1HM2XuvJ0R0kjmI6RXKnL0Ta8k164jdI9X9Mca1ex/T qrxnVC8vsMMeOvrVr7RVqzmj55Z15KmPddnObFF4KuydEXVcrxakfxocM+h9CjZLdpJg1zyKaJqe irO4ZbqV6p6uWSJFT51M1rQns97QjQbBP3SmwXHb7m9bEngvftSjp3r/AHMrN0/CoGxXvXvWnU7V XKdLOF7HMOfTYBNHRZNlWXPqX0Lbg9vMtDSwUytklkYn7o9Xta1d0296rs7w5a9ZpqJl2oWjmrmL 2my6gaZVVFHdHWWoklttfTVkKzU1TTrKneMRzEXdjt1bu3dd1VraV4NhvCNprmOqWMcaFvyOxZ1P nN3u9DV+cb/TQXy2VEiSQT0qUEjY5nLu5FRGrJvsi7qio25HB7pjo9jWLXTU3S7RjJ9Ppc0lY2oj yW41dTcK6kpXyNpJ3Mqp5nwtcyRzkYvK7ZyboqIxQLBgAAAAAAAET6j6DUOR3R+a4HdFxfLvfPq4 W701d/aVMSdHb/wkTf1rzbISwDS5bpuxo1QsYbF3sHXzlmrKfhPdMbJjulWKl1CuONXWPE9XLIuM 3d/owVSrzW+u67c0M3gnx8rl3TfZV36G8tc1zUc1yKipuiovRUJSyHG7BllqmseS2iluVBOnpwVM aPaq+pU38FT1KnVPUQlddBs3wJzqzRnJErLa1eZcbvcrnxtT+DTz++Z69mu6b9VVSjXYuW9muPj/ ALelw3KeGxeq5/Dr/wAZ9+2n35x3wzgNFpNWLbQXBtg1Cs1fhl4XokF0ZywSr03WKdPQe3r49Dd4 ZoaiJs8ErJI3pzNexyK1yfGip4kMVRVsX67VdvKao1TsnqnwnZPufYANkYAAAAAAAAAAABqGR6qY fjtUlqSslut2kXkitlrjWqqpH/weRvgv90qGs1RTrlvRbruzlRGbbzUsp1Is2PVsdgt9PU33IalU bT2i3M72d6r63bdI2/GrvV12U5LZp/rRqds++Tpp5j8njDC9JrtOz53e9g3/AMZPWikv6f6WYPpl RPpMSsrIJZutTWSr3lVUrvuqySr6TuvXboiepEJKLNy7s1Rvny81XEY7C4PVVOnVuidXvq+kZ+MI xxbQjIc2rIMl1yqYnwRqktJi1HIq0kC79FqHov2Z/wA3vfHqqLsTvBBDTQx01NCyKGJqMjjY1GtY 1E2REROiIieo5AXrVmm1GVLzWMx97HVZ3Z1RsiNUR4R9ds9cgAJVMAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAIg4j+I/GuHvGqOSS3VORZhkU/m/FsWt/p1t4rXbI1jGoiq2NFVvPJt s1FTxcrWqDiP4j8a4e8ao5JLdU5FmGRT+b8Wxa3+nW3itdsjWMaiKrY0VW88m2zUVPFytauocOHD hktiyWs4iOIi402Rax5FB3bnR+nRYxRO35bdQN3VGoiKqPkTq5VciKqK50jhw4cMlsWS1nERxEXG myLWPIoO7c6P06LGKJ2/LbqBu6o1ERVR8idXKrkRVRXOkscABTHEddONnWTU3VjGtI6fRChsenGW 1OORLkdFdvK6hrFXke51POrFXlRN1Rrevg03DCeJ7VPDdW7FoXxW6c2XGbxl/eMxfJ8brpKmx3io YiK6m2mRJaeXqnK1+/MrkTZN2q4LPArlq/xCare3lS8NPDvhuNXPMG2D2T3i75TWTQ2u10Kzdyxq xwJ3s0jnKnRqoiI5vju5WY+26scY2nGouKY5rhpRiOV4vltelrW/acQXGR9lmcm7JK2nqOdyQdF5 pUcjWIiqq7ojXBJXENw84ZxFYZHjuRTVNqvNqnSvx3IqBeSvsle3ZWVED0VF23a3mZuiORE8FRrm xzw88Q2Z0WZycMXE7DTWrVO1QLJa7pGnJQZhQN35aykdsid7s1e8i6Kio5URNnNZZkiziG4ecM4i sMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zQlMFZuHniGzOizOThi4nYaa1 ap2qBZLXdI05KDMKBu/LWUjtkTvdmr3kXRUVHKiJs5rLMgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAABDXE9xQYJwx4Q3IchrrTV3yungp7RYam7xUM1er544nyI5yOVsUTZOeSTkVrUb16qho2tnE Ncvbe4e8Q0f1GtLsfz+6XW63q50L6StpKqy22m72ZvfuR7GMcvMiyMc1yKxURybKBZ4GtYbqZpxq Kyqk0+1AxvJ20LkZVOs12grUgcu+yP7p7uVV2Xou3gp1su1f0l0/uNPaM81RxHG6+rRHU9Ld73TU c0yKuyKxkr2ucm/xIBtwOOnqIKuCOqpZ45oZmJJHJG5HNe1U3RyKnRUVOqKhw3O6Wyy2+ou15uNN QUNIxZZ6mpmbFFExPFz3uVEaifGqgdoGtYbqbpvqMypk091BxrKG0TkbUus12p61IVXfZH9093Kv RfH4lOrl2sOkmAXCG0Z5qliGN11SiOhpbve6ajlkRfBWsle1V3+ZANvBh73mOI4zjcuZZJlNotWP wRMnlutdXRQUccb1RGPdM9yMRrlc1EVV2VXJt4mKTV3SdcriwRNT8SXJZ+XurN56pvLpN03Tlg5+ 8XdOqbN8ANtBBmuHF5pVofnuFac3/JccS75TdUpbgyuv8FC2x0CQPldXVKv35GqrWMja/kSRXrs7 0VRZLyvVLTHA7bR3nONRsXx233BEWjq7td6ekhqEVEVFjfK9rX9FReir4oBtAMdaskx2/WSLJbHf rdcbRPEs0VwpKpk1M+NN93tlaqtVqbL1RduimqVOvmhVHR2m41etOBwUt+YslqnkyOjbHXtR6sV0 Dlk2lTma5u7N+qKnigG+Ahnic4osC4ZsGZkt+uForL1cJqeCz2KovEVFNcO8njjfIjnI5WwxNk7y STkVrUb16qhutfrNo/asWoc5ueq2HUeN3TdaG8T32ljoarZVRe6nc9I37Kip6Ll8ANxBhsVzPD87 tTb7hGV2fIba56xtrLVXRVcCuTxRJInObum6dNzMKqIiqq7InioH6DTLNrTo5kWRrh2P6s4Zc7+1 zmraqO/Us1Yit35k7lj1fumy79OmxAnGnxUJpZXYZpHp9q1h2JZjl+QU1DdLtdamlmXGbUrFfLWy wTPRjVVORGd9sx3pInXZUC1xFOu9r4k79RUdi0Av2DY/FXxTwXa9X5lVPW0CO5UZLRQRN7qSRqd4 u0rkbvyerc27T1tdbtPrPLkOokWZzNoW1E2S9xT00dxjcivbUI2n2haxWK3ZWeiqIi79dyMNJOMX SHWHVDOdOsYyzGJYsTkp47bXQ5DTzPvqLTrNVS00DfSWGDoxZWue1y8y+ijeob1obo1i+gmmdp00 xN89RBb2vlqq6qXmqbhWSOV89VM799JI9VcvxJs1OiIb6VS4QeKSky3RK26icQGsOM2y5ZtfbtU4 7TXitobXKlsZVvgghjj+xrKjVhf6So5y79XL0LSV1zttst812uVwpqShp41mmqZ5WxxRxom6vc9y oiNROu6rsB2Qarhmq2l2o8lTDp5qTiuUSUSb1LLLeKetWFN9vTSF7uXr06m1AAVeyjim1O1C1Kv2 kHCRptaMrrsSn8jyPLcjrpKWwWyrTxpU7pqy1MrV3RyR7cqp606p0p9aeNTSDJ8ej1y0Yw7M8VyC 4xWya6aYJcZ6q0vk35ZZ6Ooa6SSNNlVVZsiInjurWOC1wMDfc+wXFrlT2fJs0sNor6umqK2npa+4 w0801PA3mnlYx7kc5kber3ImzU6qqHXdqfpqzD4dQn6hY03FahN4b467QJb5E5lbu2o5+7VOZqp0 d4ooGzAwGHagYHqJb33fT/NrBk1DE/u31VmuUNbE1/8ABV8TnIi/NudjHsvxPLm3F2KZPab0lor5 bVcFt1bFUpR1sW3e003duXu5WczeaN2zk3TdE3Ay4NX9tLTLzJfMl9sXGPNGM1ktvvdw870/k1rq olakkFTLz8sEjFexHMeqOTmTdE3Q63ty6Qeyamwr21cP9kNajFprR58pfLZ0eiKzkg5+d3MioqbJ 1RU2A3EEO8RPEjZ9CKaxWS3YvcMyzvMqp1Di+KWx7WVFxmaiK975HbpDAxFRXyqio1F32VEVUjW6 Zd2lVntkmYO0u0OutJBGtS/FqC63JLw9iJusLKl6JTOl23Tw5d/DfwAtYCPdHNZbRq1pFaNXKiy3 LE6WvpXz1dFfYlpZaB0blbIj1ejUViK1VbJ0RzdndN9kyuH6uaUah1lRbsA1OxPJqujbzVEFnvVN WyQt323e2J7lam6onUDbQaxeNUNNMerbpbr/AKiYzbaux00VZdIKy708MlDTyLtHLO170WJjl6Nc 7ZFXwU+KPVbS644fU6hW/UnFarFaJHLU3yG8U77fAjdt+eoR/dt23Tfd3rQDagQxw1cUeA8TNjvN 4xO4WeKa2XatpI7dDeIqqtdQRTuigrZoGo19O2dGK5rXIqbbbOdubrZdZ9HskyR+G47qvh10v8Tn NfaqK+0s9Y1W++RYWPV6Kmy79OgG5AxC5hiTcrTBFym0JkrqHzmlmWui8uWj5+TyjuObvO65/R5+ Xl5um+5jMi1W0uxC51NlyzUnFrLcKO3rdqmkuN4p6aaGhR3ItS9kj0c2Hm9HvFTl36b7gbUCGOGn ijwHiZsl5vGJXC0RTWy7VtJHbobxFVVrqCKd0UFbNA1Gvp2zoxXNY5FTbbZztyZwAAAAAAAAAAAA ADoXuwWPJbfJachtFHcqOX38FVC2Vi/Ps5F6/P4kRXThhs9ulkrdLMxvOGzucr/JY5PK6BzvHdYJ V+P4nbJv0QmwEdyzRd9aFzDY/E4P2NcxG7bE+MTqngrlWWfiFxDdLnh1nzGjZ/8AmbNV+TVHL8bo ZffO+ZhiX61YzbJW0uZWjIMVqFXl7u72uWJFX5nNRyKnz9C0ZxzQQ1MToKiFksT02cx7Uc1yfEqL 4larCdirjr8nVt8vRPt7UT30zNM/WOEQgK159hF6RPNeW2ipcv7xlZHz/wCLvun8RnWua9qPY5HN Xqiou6KbbetEdIshVz7rpzYJJH++kjomQyL+F0aNcv8AGatNwn6K8yvttiuNrcvXeiu1Szr+Bz1Q jnD3o3T+/Bbp5WwFW3Tp90T8dKPk+AcTuFbDG/7WzfPaZPUkV+ciJ/G1T8ThXxJf3bUHUKZPiffl 2/yMMcze3fFv6RwH4k/2/wC3MYy5ZRjNnRVu2Q2yi5fHyirjj/0lQyTOE/SR/wDupHf7onrSsvNQ qL+Hlc0z9o4dtEbGrXUOm1merfBauJar/XK4zGHvTu4/6a1cq4CnZNc/8Yj46X0RJVa36eMqPIbV c6m91i+9prVRy1L3fgVqcq/xncpLhrXlmyYhpHNaoH+Fbk1SlKjfi3p27yL+IsTbbRarNB5LaLZS UMKf73TQtib/ABNREO2SRhJn1quH7lVucu26fY2vfVMz8I0fqgih4dcqyTaXVPVCuqoHe/tVhZ5F TKn8F0nV8jfwoi/OSlhem2CaeUnkeGYxQ2xqt5XyRs5ppE/t5Xbvf+NVNlBPbsW7eumNfxcvE8p4 rFxo3K/s7o1RwjKAAEygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPmRJFjc kTmteqLyuc3mRF9Sqm6bp826FF+GBY7Dxa5vR8V7XO18uKyLitxqXb2ipx7ZeWOyI5Pse3p941d5 dubdd++QvURZxDcPOGcRWGR47kU1Tarzap0r8dyKgXkr7JXt2VlRA9FRdt2t5mbojkRPBUa5oSmC svDzxDZnRZnJwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uzV7yLoqKjlRE2exlmgKgcCv9lvin /wClWs/zOOLtGJYLiugGIWlzXZXctXrJVWljP3ZkUCSd/MnrRjFkh5l8E3aq+B3bfwea/YRqDqJm ej3FxTYjRaiZFUZFWW6XT2muSwyyKuzUmmqt3cqLtujWou2+xuekfCNHiOpSa4aw6p3zVbUaCmfR 2+73Smio6S1QPRUe2iood44FcjnI5yKvRV225ncwfGuPDHYtX9SqTU7TfWG76car43bm2113skkV Qr6F73PZDW0b12lj5uZzUcrd/XzcreWNcj1g4vOEq64zX8Qd7wvU/Tm+3ylsFTf7VQOtV5t01Q5W xzS07fsD4+iqrWIq9Nt29N5N1X4TKrKNVJNd9G9X73pZqBWUUduulfQ0MFworrTxoiRpVUc+zJHt a1rUdzJsjU6boiphYOD3PM6ynHr/AMTPEhd9TrdilxivFrx+mx6lsdsWui37qaojhc91RyqqqiOc idVTq1XNULPAEQcR/EfjXD3jVHJJbqnIswyKfzfi2LW/0628VrtkaxjURVbGiq3nk22aip4uVrVC L+0RqtI5dK7bY8sobncNRq2ub7W1NjzuW+tve7e7kpXNRXMjR3J3qqnLy7fv+72nLQil1cotI8Yp tdq62VedMoWJeJbc3aLvfUiqi8rpEby87mbMV/Nypy7EXcOHDhktiyWs4iOIi402Rax5FB3bnR+n RYxRO35bdQN3VGoiKqPkTq5VciKqK50ljgAAAAAAAAAAAAAAAAAAAAAAAAABr9XqHgFBf6XFK7Oc fp73WyrDTW2W5wMqp5NlXkZErudztkVdkTfooGwAjLXLiQ0h4c7XbLrqzklRa471O+mtsdPbamsk qpmIjnMa2CN+y7Knvtk+czWkequPaz4RS59i9tvdDbqyWaKKK8W99FUr3b1arlif1Rrtt2r60VAN zBX7T7Vni3y3UShtmX8KVvwnC1nmjrLvVZrS19V3TWP7uSOnhaipzPRiK13VEVVNs11wziAzKKy0 uhes9r077l1R52qqvHYrtJO1yR9z3TJVRrVbtJvv48yfEBKoNR0txfNsRwK3Y1qPqLJneQU3f+WX 99sitzqznle9u9PEqsj5GObGnKvVGIviqm3AU/4x7JZdRuJbhi0mrbRRVy1WTXDKK7vqdkipS2ym SVsb1VOsb3PcnKvouVvVDW8q0rwzXLtE6fDLzZKWXCtI9OoJKiyxxI2inrqyqc+OCWJqI10SxuZI sapyuWFqORWqqE26x8NeSaha14Rrpgurs+F33EKGptUsa2SG5RVtFO5FkY1sr2pC9fSTn2d4t6dO ud0u0F9rvWPVfWSuyvzzcNT6u2SdwtD3Hm2moad0MUCP7x/e9Hbq7ZngnQCs1WzEtI+OvVfO9NsU tdktOnehklffaC10rKanrLj361UXeMjRG8ywRMTm232YhpPDLYtS7lpPFnua8A/tt5BqSx9+u+X3 jJrA6S6xVKq6FscdVIslPC2FY2Ni2aicu/KnglwcJ4a7Xj+pWs+oeVX9mSJrH5FTVdBJQrAyjt9N Svpm0vP3jllRzHru5EZ6unrI5sXBtrFieIe1BifGFktr0ziY+kpbXHjlG68UlA5V3pororuZqIjl a1/dczU2RuyIiAbHwGacapaT6CMwbVXHqiwVNDfbk+z2me5Q176C1SS89PCs0L3sdy8z9vS6Jt0T wNJ4jLfTa6cZWlnDPlbPKsHtGPVmoV+tL3L3F3kZM6mo4p2+D445Wq9WL6LkcqKi9NrX41YKLFcd tmM22arlpLTSQ0UElZUvqJ3RxsRrVklkVXyO2RN3OVVVeqkP65cNNw1L1AxnWXTfVCu071Dxejnt dPeIbbFcqeqt8qq59NUUsrmtkajlc5qo5Nlcq9V5VaGK1B0N0Z0bu914psHxmDGsg09w28SSW6wx QUNDdKZtM+RrKyCONFk5XRbsVFbsrU35uVqJpPBXw96bZNw8WjVHVnELFm2Z6o0z8jyS9X2ghrZ6 lapVcyJHStXu42RLG1GN2aioqoibklaV8LlDilyzDMdVs5r9Tcyzy3pZb1d7lSR0cKWtGuRKGmpY V5IIV5lVyIqq5y7qu5oVl4L9VsXwqXRbFuLfI7bpa5ktHBaG47Rvu9LQSucr6WK6OdzNbs5zUf3K uai7IqIiIBUKhqbplHZ72nRW03OqdZtS9bGYTiTnvWRzLKtek0asV26qxksEnXwTwLDcdekOm+E6 TaU4Fp7h9stmRXnUzHrTZbnDTs84MqXyvfJVPqNu8kkdyKskjnKrnP5nKq9SarvwiYk+86HQ4jdm WDEdE6uqraWwNoln84zPhRkD3TrIixvjk55XOVj1kc92/KvVdi1e0E9trVDSjPq3K/Irdpjdqu9P tHkPe+c6mSFrIHd93je57pyK73j+bm29HxAhLI8VxfVXtMKK33THLXcLfp9pk+vrfKKOOVslxrKr uo2yI5F5lSnVHN5t9tuhDWht61G1azrUTiDu3Bu/WRLvkdbZccuFbkNnhpbNZ6N6xRUVNS1sm8bt 0c6SRrW86u39bt7bU3DXkll4pbzxGYpq7PbKDKqKho8jxqWyQ1La5KSJY4e6qnPR1O3wcqNYqqvN 16ptrFJwjanafXvJm8PvEzcMAxXK7pUXqqsFRi1Jd20VZOu876KaV7Vga5U3Rite1q+CAQnjVl1T 4c9DuLLPMq0pdpbil9ofOWG40l4oq2Kgraijlp6h0fkkjmRtdUPplRqI1NtkRNkMrddBdKtC+zLv 82S4XarhfqjTtai4XG4UrJqvzpU0yJAiSvRXtbDNNG2JrVRGoxNkRVVVm3UfhAp854ZF4aKXVHIG UdXW01Xdb5elfda64IysbVTNerpI+VZJGptyqjWJ4NU23id0FXiN0ar9Go8s9jNBdaqhkrKiOh8p V9NT1DJlgaxJI+XmWJic267beCgVPy3CmZJVcCWhWV0FPc7lHSwZDeHVUDZHtitVril7mRXIqrG5 73M5V6OVnVNyRtetBs7x3iCsuv8AhGiGMatYtbMV9ja4VVTU9JPZ3JUOmWst7J2LTq5WqrVbs169 URfS6SZq9wzX/O9Z8F1u0/1Zmwe84Zb6izvhSxw3GGroZnIr42tke1IX7cyc+zunL06deLIuH7Wy jznIss0f4pbvi1vyiqSurbLfLBFkNNTVPI1iuo3TSxvp2KjU+xIrmIvgiIiIgdHhHrOHjLqzONRN GtPLhgeSVdfFac0xysp30EtBXUzV5WyUTXLAxyo9y97G3d+7t15uZEwHaCZBfqzEtOdDrBeam0N1 gzq3Yrdq2mkWOWO1PVXVTWOTqjnojG/O1XNXo5SVdANALboXbchnmyu55XlGZXV97yPILiyOKWvq 3NRqcsUSIyGJqJs2Nu6N3Xr4InJxDaA2DiEw+32C43244/eMfu1Pf8evtt5fKrVcoFVYpmI70Xp6 SorF6Ki+KKiKgVr7QfRXRTSjg+uFz0705sOM5HjVwsyYjW2egjp7hBXeXQNTu5mJ3j3rH3qru5Vd srl3ciKZPLcVs2qHaK6eY/k2N2ivlwXTKsyS995RxSRz1tXIlE1ku6Kj1a1Ec1Hb7J1TwJFoeFPN cxy7Gcn4kdeqvUykwyubdrLZKfHaey25LgxFSOrqY4nyOqJGbqrUVzWtVV9HZXIu6YVoL7FeIfUb X+vyvznUZxb7Va6K3eQ90lppqSJWvZ3veO77vZNpPeM5dtvS8UCT6htrt1qlbURU8FupadySMViJ FHA1vVOXwRqNTw8Njzr0IksWAdnLqtxJLjtuoL5m7ssvlDVJSRsnplq5n0dPExyJuyPnYxUYionX p4noZk9hpspxu7YxWzTQ093oZ6CaSF3LIxksbmOc1fU5EcqovxlVoeBPMajhYquFPIeIR9zx51ZQ eRVHsVigfS26nqkqXUitjnRZXPe1u8rn9OVPRXqBHV34bdG9FOzUvtzzDA7Ndcnk08Wqq7tcqOOe tiudRTJ5OyOZ6K+JkE80bY2sVqJyb7cznKun6gP1KyCv4ZOF2TTe5alWzH9NbfmuWYrFeKa3peXx RMpqeOolqnsY+GCdnMsaqvPum6Ltul1+J3QVeI3Ruu0bZlnsaoLpV0MlZPHQ+U95TU9QyZYGsSSP l5liYnNuu23gpitbOGqp1FzTGNWNNtSK3TnP8SpJrZRXilt0VfT1FvlXd9LU0kqtbLGi7q3ZzeVX Kvjyq0K+S6X60ZNxB6P6h4dwXQaOx4leJI8gvFFkNjcyqs0sXJLTyQ0cqOlRP3qcruXddkTdVLr5 vX3O1YXf7pZI1kuNHa6qekYjeZXTMic5ibev0kToRzpJodmuHZlcNSdUtcL/AKg5LXULbXCi0rLV aaKlR/Pyw0ELnM7xXIm8r3PfsmyKib7zCBVHsu7fZqXgtwq522Vk9Zeam6XC7VHNzST1rq6ZjnSL 4q9GRxt3Xrs1pr2smuXHTotkuIpkVl0Iq7HnGcUOI2mC3OvE9xRKuR/dvkR6xR+jGxVe5F2R22yb KbOnBXmWnWSXq8cLPEhe9KbTkVY+41+OS2GlvlqZVP8AfyU0M7m+T82ybo1V8ERNmo1qZ7BeECSH P7TqzrzrLk+reWY9Is1kW4ww2+1WuZeiz09BT7Rtl26c7ld4Iu26IqBGuY4RYtfe0jjsmU0cdzxr SrTyCoq7dO1JKepuNZVq+KOZi+i9nd93Jyr0V0LN0VOh84xhGJ6+8c2oeO5pjtsr8I0Cs1ntuO4z NTMW2x3C5QuqJa1abbu3PajHxpuioiI1UTdEVJ80u0F9rvWTVfWWuyvzzX6n1Vsk7jyHuPNtNQ07 oYoEf3j+93R26u2Z4J0NXz7heyep1huWumhus1TpvlGR0FPbskjkscN4oLtHTpywSPgkfGrJmNRG o9r/AHqIm3V3MERXCiw/R/tGWS6cWahx+0e1JW33NqO1QMp6WSOGpf3E8kTERiSorWpzbc3Kqepy 77T2eT2YfwZQaq5fI2nmyasvucXmVy7IiSVEqrIqr8cMLHbqSPpjwr45hsGc3fOcrumd5jqXTLQ5 Rkdxjjglnpe6WJtLTwxJyU0DWOXZjd+uyqq8rUbGdHwO6lQ6H3DhyquKW5y4GtrqrXaqWLGIIKuG KRH90yqqWTc9TFG5yOVjEh7zlRrnciuYoVlmpbm/swLHaKydKO/8RWosLJ5F8Umr7u6RH/PvDRMX 8Dibe0F0b0h0q4IrpaMMwi2UN6t9fZoMcroKZiXJ1ydXQbzeUInevnfGk6veqq527lVd13Mbr3oj Z73nXCnwUx3uu804/ablcrjcqBfJamNbdbWw0tbGm7u7kWo53purkRy9eZN95lg4S87zPNsWyXiI 4ha7Ui0YRcGXeyWGPHKa0Uq3CNFSKqq1ie7yl7N1VqbMai79Nlc1waRg0FVee00yFc2mbUXLFNJr fDZWyepJp41qqiNPDfvHyMVyep6oW9v1/seLWasyLJrzRWm1W+JZ6utrahkEEEaeL3yPVGtRPjVS H9euF22aw5PYNT8Vzu9ae6kYtC+lteUWdkcr1pnqqupqmCT0KiHdzl5HbdXO67OVF0Wr4Lc41Pr6 FnFJxN5FqhjttqI6qPGaSyUtgtdXIxd2+Vx0yudUNRdl5VcnVPi6AYTie8l114oNFOGm6VqVOAXG grs5yKjhm+w3uKmbtRQPVq7SQ961XuburXI5F8WtUw/Fvp9genGsnDJdNIsNsuMZfV6kUltR9koI qN89jVm1fFIkTW88SRubui78qOdttzLvN+t/DPBqbf8ADtQsAzmr07zvAWzQWO9UFBFVQtpJmIyW knpH8rJoVanRu7eXddl6nV084ZLrbtUaTW7WvVat1KzWz0UtusUz7VDa7dZoZU2mdTUkTn7SyJu1 0rnucrenREQCG+HvTjEtbuL/AIiNcMys9NfKTHsko8NslLWxpNSQVNvpWxVM3dO3YsrVVEa5U3Yk su3v1NCxG445hFk49NQbLZ7fS4pQ3CS0261spmJRMu1FQyxzObFtyIr6maFV2TxRF+It9w1aC+58 wy9Y3UZX7JLjkOS3LKLjcvIfJO+qat6Ocnd95Jtytaxu/Mu+2/TwI5oOB+gbwy6icPN61Hqauq1H vldkNyyGntiQPbWVFRFO1e4WV/M1qwRNcneJzNRerd+gV31KsF/0b4GtCdFdMcYfHlers1lsl7W1 SQUFwraeeF1XV0yVT+VGve5/dI6R3KjXPReinZ1u0X1bzbR2LAdIOzng08yWyVNDWY1kdDlmPMqb XPTzxvWTvY5kle5zGvaqucqq5yOXdURSzeUcKl41F0VxrTvUjWG43HMcNulPerBmtrtEFuqKCtp9 0p3spmq6NWtYvK5rnLz+O6LsqdjEOHnVyTN7DmetfE3fM3jxeV1Ta7RarLDj1C+pcxzO+q208j3V Ko1ztmOcjN1X0dlVFCI+0Hytmjdw0o19xV8NbqrilfVR0lkgjkfJfbM6le65xObGiuSGJjUl7xyc sfVffOQ+7djOL6a8F+pfEnkt+oM5zXUbD58jvGRSwI6GqmlpVWio4GPT7HSwvfExkaoiord1RF2a 2cNOeHSLHtS8u1l1LyqPOsxyZrrdS1UttSlpbNZU95bqWndJLysVVVZHq7eReqonXfR6Pgmhg4X8 34U6nVCslxe/XCqnx2dlu5Z7BRSVTamKjVVmclSyOVq7u+xq5r3Js3oqBtXBXpXZdLeGjTi20tio qK7VOM0FVdJ4qZjJpZ5o+/e2R6JzP5XzPRN1XYnM03SLEMywTAbZiueagpml2oGd067NtMVtSSNO kbUgic5reVqIm/Mqqu6/Mm5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFnENw84ZxFYZHjuRTVNqvNqnSvx3IqBeSvsle3ZWV ED0VF23a3mZuiORE8FRrmxxw88Q2Z0WZycMXE7DTWrVS1QLJa7pGnJQZjQN35aykdsid7s1e8i6K io5URNnsZZoiziG4ecM4isMjx3Ipqm1Xm1TpX47kVAvJX2SvbsrKiB6Ki7btbzM3RHIieCo1zQlM FZeHniGzOizOThi4nYaa1aqWqBZLXdI05KDMaBu/LWUjtkTvdmr3kXRUVHKiJs9jLNAACIOI/iPx rh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNRU8XK1qg4j+I/GuHvGqOSS3VORZh kU/m/FsWt/p1t4rXbI1jGoiq2NFVvPJts1FTxcrWrqHDhw4ZLYslrOIjiIuNNkWseRQd250fp0WM UTt+W3UDd1RqIiqj5E6uVXIiqiudI4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixiidvy26gbuqNRE VUfInVyq5EVUVzpLHAAAAAAAAAAD8VUaiucqIiJuqr6gP0GNtOSY7f5aqCxX+23GWhejKplJVRzO gcu+yPRqryquy7Iu3gQxnPHHw06f6hP0nvWeVFRmMVZHQy2e32esqpYpX8u3O9kSxtREe1V3f4Lu BPINI1hzfM9PsMkyHAtLrjqBd21EUEdloK2Klke16qiyLJL6KNb03/CYzQ/OdZM8s1xuWsmiCaZV cVS1lvoFyKmu76mBWIqyukgRGxrzbpyKm/gBJQK/XrT/AIzrzqhLdbfxB4fjuCQ3ZlRT2qlxNtZW T29siOWnmlmciNe5iKxXs8N906kia0aP2rW/EI8MveXZbj1G2tjrJJ8auzrdUzoxr29zJI1FV0Tu fdWetWtXfoBvpF134ouHayZrSacV+s+JLlFbc47LHaKe5R1FW2ufKkTaeSOJXOik7xUaqP5dl8dj uaIaCad8PmNVuLac01zjpbnXOudbLcbnPWzVFU6NkayOfK5dlVkTE2bsno+BlLZo1pFZchq8vtGl 2JUd+uFW+vq7pDZqdlZPUver3SvmRnO56uVV5lXfcDG63a02rQzF6PJ7rhWZZSlfXsttPb8Us63K tfM6OSRPsSObs3aJ3pKu2+yetDk0V1Suur2JT5XdtLMvwFzK6SlhtmU0aUtdLE1jHJOsSKvK1yvV qIq77scb+AK/Wyt47blqkxtysujNo05p7y5szvKLjPeqq2NlVGuj2+wMldHsuzuiKuxvetml+Yaq WW3WfEdZsk06Wmq1nrKuwxwrUVcPIre555EXu+qo7mRN+hIwA0zSXTebSrEWYrUah5hmkiVElS+6 5VcW1tc5X7bs7xrGIkabei3bpupqOFcIHDNp5lq55iWjeP0mReWSV7LnNE+pqIqh7lc6SN8znrGu 7l25dtt+mxMIA+XRxue2R0bVezflcqdW7+Oy+o+gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAMRLiOJz5PBm8+MWmTIqWkdb4Lu+iiWtipXO5nQNnVveNjV3VWIvKq9djLgAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAEWcQ3DzhnEVhkeO5FNU2q82qdK/HcioF5K+yV7dlZUQPRUXbdre Zm6I5ETwVGubHHDzxDZnRZnJwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uzV7yLoqKjlRE2exl lampp6OB9VV1EcEMacz5JHo1rU+NVXohDnFFpJpRrNpLUXLPshZj0eNROv8AZsyo5kZUY/NG1Htr YZmqnoIjWq5u+z2onVFRrmh2eI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzyb bNRU8XK1q6hw4cOGS2LJaziI4iLjTZFrHkUHdudH6dFjFE7flt1A3dUaiIqo+ROrlVyIqornSV+7 M/N9NNcchrNW9QtQqzOeIGotUrq9tdb5I4sbtMVQtPFDSr3aQNWVqsle6NeZe+Vqon2RX2c1m171 e0/zBuIabcK+Xai81HHVJdKW401Bb0c9XJ3SzS77Pby7qm3RHJ8YE5g1LIKnUy66ZT1uFW6y2TOa u1slpKO/SPqKKirnMRVinfTrzPaxyuaro/FU3TdOhpWhuOcU1putzuPEJqRhV9pKinYyht2N2eSm ZSzI7dz1lkXneit6bKnzgTEdK83qzY7bKi95BdqK2W6kbz1FXWTsghhbuibve9Ua1N1RN1X1kJaw cIOM635rNlWZauaq01tlgig9jVoyiSis6cjdlf3DG787v3yo5NyWb/gOIZZhkmnuV2OnvWPz00VJ UUNenfRzxxq1WpJze/6savXxVAMZgetWkWqVyudo011KxvKqqzNifXss1yirEp0kVyM5nRqreqsc nj6iM9WOMnE9Ls6r9NKDSTVfOcjt7IXTU2J4rJWxN72JsjN5lcxm3K9u6oq7dfWmxK+DaV6ZaY08 tJpvp3jWLQzo1szLNaoKNJUTfbn7prebxXqu/iptIGpam3jUS1af3G76TYnQZFlTGwLbrXc63yKC ZXSsSTvJVReTljWR+23VWo3puatoVcuJu6NvVTxF41gFkYq0/mSmxisqqmVE+yd/5U6ZOT/geTu/ 7ff1ErACBs+4e9YM81DuGRt4ts4xrFZ5YX0WOY/bqKkdSNZGxr2rVuY98vPI1793N6I/l6om6yRq zpJgOuGEVmnOptkddseuEkMtTSNqpqZZFikbIz7JC5r0Tmam+zk3TdPWbiANA0h0D0e0FtlZZ9Ic Dt+NUtxfHJVtpVe51Q5iKjFe+RznOVEc7bdfWpu9PbrfSTz1VLQ08M1U5HzyRxNa6VyJsiuVE3cu ybbqdgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAHSut6s1iplrb3dqK306eMtVOyJn+M5UQja9cT2jVpnWio8n ffKzry01npZKtz/wOanIv+MaV3aLfrTELNjB4jFexomrwiZSsCC6jiMy657ph+huQzo73sl5qorc iJ8atXmVfwbmNqM44kr5ukS4XjMLvBWRzVlQ38PMvdr/ABEE4u31Zz7nQo5Cxc+vo0+NUfKM5+Cw wK1TY9q7dv64Neb65HeLbXRQUG3zIrEVfxnRm0Wx65b+ybJMryHf33nO9TSc34eVWmk4ufu08Z/+ rNPINEe0vR/xpmfnorHXDLMWtO/nXJbVR8vj5RWRx7f4yoa1cNddGrZulVqbjiq3xSGvjmVPxRqp D9HoppVQ7dzhNA7b/hueX/TVTOUeDYVb9vIcQstOqeuKgiav8aNNJxV2dkR++CenkbB07a6p90R9 amyVPFZoHTO5Fz5kr/BGw2+rk3/ArYlQ6r+K/SR3+0X3+u+LyezVC7/4zUPiGmp6dvLTwRxN+JjU an+Q5DHSL09ccP8AaSOS+T4+7XP/ACj9DhXioxB3+18A1BqG+p0VhVUX+N6HyvFLZF/ctJNT5P7m wN2/yynYBjnr3a+Df0fgI/8AHP8AdPk63uoaNerdG9Stvns7EX+LvT9TiktCfuukGp7Pn8wtVP8A WnYA5692vgdAwH4U/wB0uFOKfF0/ddN9Rovj57B4fxSHIziu0xb/ALeoMpofj8oskybf4u59Ac/e 3xw/2xPJ3J8/+Of7vOJcsXFjoM9yMnzWSmev72e11bV/j7rb/KZq38Q2iVy28n1LsjN//wCIn7j/ AFiNNfexkjeWRjXIvqVN0MZWYpi9w38vxu11O/j31HG/f+NDPSL0buE+bSeScBOzTj/lE/8ArCWL fn+CXbbzXm1hrN/Dye5Qyb/4rlM7HJHKxJIntex3VHNXdF/GVurNINMK7fvsHtLd/wDgYEi/0NjG t0LwKjesthbd7HIq789uuk8S7/H1cqG0Yq5G2mOP+kVXImFq9W7VHjTE/KqPktKCs0OF6gWn+t3X PMoNvepcZWV7U+baRE6HfgyDiTsey0+Y4pkzW+KXS2OpHuT5vJ12Rf8AIbxjI+9TPwV6uQav/Hdp nxzifll8VigQPT696qWnZuU6JSVUae+qbLdY5t/wQuRHf5TLUHFTpcsrKXKIr/ilQ9eVI71apIkV f7pnO3b51VCSMVanry8dXzVa+RMdRri3pflmKvlMymIGDx3OMNy6NJMXyq03VFTfakq45XJ+FrV3 T8aGcJ4mKozhzK6Krc6NcZT3gAMtQAAAAAAAAAAAAAAAAAAAAAAPl0kbHMa97WrIvKxFXZXLsq7J 8a7Iq/iUD6BouqeuekGiNHR12rOotjxaO4975E24VKMkqu75e87qPq+Tl7xm/Ki7c7d/FDI6ban4 Pq/hFDqNprfWX3Hrms6UdZDE+JJlhlfDIiNla1ybSRvb1REXbdOiooG0gr/pTxN6hap53QY7Jwn6 n4fj9W2Z09/yinhoW03JE57EdT8znrzua1ibL0VyKvQ2XXVvFXNUWal4bZdMaenlZP54qsxbXOkh VFZ3Xk7abo7dFk35+ibJ8YEtg1LBbXqK3TmitOqOQWyqy59LLFcbjY4XwU3euc/lfC1/pN5WKzx9 aKpGOkPCazTDNqfUS+6/6u59eoIJYGxZNkflFvakjeV3JStYjW/GnVdl6gS3lmoOA4DTtrM6zewY 5A5qubLdrnDRsVE8VRZXNTY+6XOMSuOGrqDaL7S3THfIZLjHcLc7yuKamY1XLJEsXMsibNXbk3Vf Vua1qNw96JavXy25HqjplYcpuFohfT0Ul0pkqGxRucjnN7t27FRVTfqim52KwWLFrPSY9jNloLRa qCNIaWhoKZlPTwMTwbHGxEa1PmREQCINI+LXA9bczXEsHwjUXyZKSWrS/XHFqiitSoxWp3ffzcq8 7ubdqK3rsvX4+fW/OOKHHcgoLNoNoZj+W2+po++qrzd8mjoIqWo53J3K0/L3j05Ua7nau3pbbdOs zgDUqKHUm+aWNp7vV23Gc8r7G6OWooGeWUltuj4VTvYmyfusccqo5Gv98jdl8TRdGNHtbcGyOoyX VnifvWpKz0T6Rtufj1FaqGJ7nsckzY4EV3OiMVqbu22e7oTOAIW1l4PNAeIHMaLNtXsSq8gq7dQx 2+npn3erp6RrGSSSI5YYZGNc/eVyK52+6I1F6IhKNtxDGLTiNJgVFY6RMdordHaIbbJH3sCUbI0i bArX78zO7RG7O33Tx3MwAKp9ltGxnArpq5jGtV63lzlRNuZfPFYm6/H0RE/Ehawqr2XHwE9Mvy1+ mK0tUAAAAAAAAAAAAAAAAAAAAAAAAAAAAHxJLFCxZJpGsani5y7IYupy/E6LdKzKLRBt497WxN/z uMTMRtbU0VV+rGbLg1abVTTCn6VGo+Lxbfw7xTt/zvOq/WnR9nvtUsTX8F4p1/zPNecojrhNGExE 7LdXCW5g0n27tHV6e2ji38qwfrHLHrLpDKuzNUsS3+JbzTp/neOdo7UcWehYmP8Ax1cJbiDWoNTN N6nZKbUHGpd/4F2gd/meZSlyPHq7byK/W6o38O6qmP8A8ymYrpnZKOqxdo9amY9zIg/EVFTdF3RT 9NkQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+JpYqe J888rI442q973uRGtaibqqqvgiIRBkvExikFXNZNOrTXZzd4lVrmWxOWjid/8SpcnIifO3mQjuXa LUZ1zks4bB38ZVo2KZn5R4zsj3piNSzTVnTnT1jly/LrfQTIm6U3ed5UO/BEzd6/h22IXuMes+oa q/NM39jFtf8A/wBJxtyxyK1fVJUru5V26KjfRXdfA7WM6Y4NiUiVNnx+nSr3Vzqyfeaoc5V3V3eP 3ciqvXpsVasXVPqRx8v/AI7dnkO1RrxNzOd1P6p1cIllaziMym/7s0z0mudXC7oy43uVtBBt/Dax d3vb+BUUwdZHrrl+65TqhFYKZ/vqLGaXulTf4qiTeRFQ28EFVVdfrVT8vk6dq1hsP7G1Ed8/an45 xwiGh0miWn0VT5fdrdU32tX31TdquSqe78KOXlX+I3K3Wq12iDya022loof+Dp4Wxt/iaiIdoGsU 007ITV3rl3VXVMgANkQAAAAAAAAAAAAAAAAAAAAAAAAfE0ENTE6CohZLG9NnMe1HNVPnRT7AGmXj RzTW9Sd/UYnR086LzJNRb0z0d/C3iVvX8J8UeKak4ls7ANX71DCz3tBemtuNPt/BRX+lGn4OpuwN NCInONXhqTTfuVU6Nc6UbqoiY4TmwtHrdrFjWzM20upb7Ts6Orcbq159vj8nl9Jyr8yohuuIcQml OY1CW6nyRlrue/K63Xdi0dQ138HZ+zXL8zVUwhiMgxLGcrg8myOxUdwYibNWaJFcz+5d75v4lQmp vXaNk5+Pn/8AVK7gMFiPWo0J30z9JzjhMJ5RUVN0XdFP0rDQYLmGCq2bSfUO5WuGP3toub1rbe5P 4KNdu6P+6buvQ2m1cSNyxx7aLWbB6qxt3Rvnm2I6rtzv7Z228kXr6LzL0J6MXTOquMvlx88nKv8A IV6NeGqi5G6NVX9s7fdMp1BhaLNMQuONyZhRZPa5LHDC+omuPlTEp4Y2N5nukeq7MRqdXcypy+vY 81OL3tYaiur5NIuEFrq641kyW+XLHQc3NK53IkdvicnpuVyoiTPTbx5Gru2RLUTExnDi1UzRM01R lMPUUGp6UYZU6eaa41hVfdam6V1otsFPXXCpmdLNW1fKiz1D3u6udJKr3qq+tymtZFxR8OuKZbBg V81nxKHJJ6+O1JaY7lHPVsq3yJG2GSKNXOjdzORNnom2/XYy1SiDQdadXItF8RiyyTTvN81dPWx0 MdrxC0eca9XPY9yPWLnb9jTk2V2/RXN6dTh0R1Wver2MVmR3zSXL9PnwV7qWC3ZPStp6uohSNjkn RjVXlaqvc3ZV33YoEiAr95bx23DVXuYbLozatN6a/cr5qipuM15q7O2o99GjPsMc74U32d6KOX4k N91v0xyzVbGKPHcR1gyPTqaKvbU1VxsLY1qainSORq06Oen2NFc5judOqd3t6wJENer9Q8AtV7pc Zumc4/R3iumSnpbfUXOCOpnlXwYyJzkc5y+pERVMFotpL7TWIy4q7UfNs3lqK2SvluuXXXzhXK97 GNWNsnI3liTk3azZduZ3VdzXMZ4P+GbEM2m1HsWjePx5NNcpLut0qI31M8dY+RZHTRrM53dO53Kq cnLy+rbZAM7rRr7pdw/2Wgv2qF8qrfT3SpWjoWUtsqq2WonRiv7trKeN6ovKiru7ZOnid7SDVvHd a8ObnGLWq/UFvkqZaZkd6tklDUPVm270ik9LkXdNnes3YAV/xLVni3yTUqlst84UrfiuEtr5YKq+ 1ebUtZUPpmq5GzxUsTUc3mVGryu67Kbnrdh+ueY0VpotEtYrdp5LHNKtzrqnHorvJLEqN5Eijlc1 qKio5V3XruSaANS0txfNMOw2ksOoOpFTnd7iklfUXuotsFA+dHvVzW9xB9jYjUVGpt6kTcizTjga 0A001Co9WLfbcivGY22WaWjvF7yKsq5YFlY5kiNYsiRqise5vVi9FLAADBZHgmEZhU0NZl2G2O91 FrWR1DLcbdDUvpVfy86xOkaqs5uRm/Ltvypv4IZmnpqekgZTUkEcMMacrI42o1rU+JETohyAAAAA AAAAAAAAAAHnRl/aJai8IWv180L4lcXlyrGYJm1diye2xshuMlrmVVgfLEvLFUqxEdE9ze6Xniev pKei5QrtdOG720tEINZMdoO8yLTjnnqu7bu+os8ip5Qi7ePdORsyKvRrEm9bgKscP/aUXbRjhl08 4cdFtNJch1FbNW0XlVxX+o46msudRJBHDFG7nqHqk8adXRojl29I9dtNbRl9iwKx2zUDI/P2TRUb HXi4pEyNk9Y70pe7YxrWtjR7nNY3boxrUXdd1PIbsfOG72wdWq/XrJKDvLHgH2C1943dk94lZ0VP UvcxOV6p4o+WFyeB7PgAAAAAAAAAAAAPxzmtRXOVERE3VV9SAfoI9yvX/SLDpHUt0zWhqKxF5UpK BVq51d/BVsSO5V/utjS6viJzK+7s090cu0kTve1t/nZQRon8JI/Se9PwKikFeJtUapnX3a/k6Njk nG340qbcxG+fsxxnL4J2OOaeGmidPUTMiiYm7nvcjWtT41VfArpVVfEHlG/nvUi143A/31NYLdzu 2+Lvpt3NX50MY/RbGbnK2pzG75DlU6Lzc94uksqIvzNarU2+YhnF5+rTx1eboW+QYj212I/LE1fP Rj4ymTIdetG8XVzbvqLZUez30dNP5VI35lZDzORfm2NTqOKfFKr0cRwjM8iVfey0tqWOBfwvkVqo n4jGWfCsQx9G+ZMZtlE5vg+GlY1/43bbr+NTNEc4i9V1xH7/AH1LlHJeAt7Yqq8ZiI4RGfxYifW/ Wi6dLDo1Q2xi+9mu16a/f51jiajk/jOhNknEtdv3fKsNsSL9r7dLUuan/brsqmzAjmq5Vtqn5fJa ptYa36lmmPGJq/7TLTZcc1auW63zXrIH83iluo4KH+LkRdjqSaSQ1vW96i55dd/FKu/SORfxIidD fQazRE7dfvlPTfqo9SIjwpiPlEI8TQLS17+9rLBPWyfw6m4VD1/09jvQaLaWU/7nhNuXb+G1z/8A SVTdQY5uiOqG04vETtuTxlq8Wlum0XvcDsK/3VBE7/Oh2G6eYAzozBsfb+C2QJ/+ybADOhTuaTfu ztqnjLA+wDBF6LhVh/k2H9U436c6eye/wTHnfhtkH6psQGjTuOeudqeLVJdKNNJvf4JZE/uKJjf8 yIdGo0P0oqd+8wqiTf8A4N8jP9FyG8gxzdE9TaMVfp2VzxlHjNBtOqZea1Udyti+KLSXSoZt/G9T sx6YXKg62TVvUG37eDG3tz4vxscnU3oCLdMbIZnFXqvXqz8dfzahFbdb7X1s+utZK1P96uNnp6jm /C9dnJ+I7kOb8S1p98/Bb9Enj3kVRSzO/ByryIbGDaNKNlU8UNXNXPXtUT/xiPjERLFwcQGpVs6Z PoZWvYnjPaLtFU834IlRHJ+NTJ0vFbpgxzY8opMkxd6rsqXezysRF+LePnT8Z+n45jXtVj2o5rk2 VFTdFQ3i9ep2VZ+MeWStXgMBc22svy1TH/bSbzj2q2mmV8rcezux1sj/AAhZWxpL/wCGqo5P4jay ul50v08v/Mt0w61yPd4yMgSKRf8Ars2d/lMVS6UzY/s7AtQ8sxvl95TwXF01Kn4YpN0X+MljFVx6 1Ofh+/qqXORMNX7K7MfmjP4xP/qtACu1JlvEdjGyedcYzOmZ4pV0zqCqcnzLH9jRfwmapOJ6ntW0 epOmuS40qe/qoYkr6Nvx7yxdf4mqSU4u3PravHz2KVzkLF067WVf5Z18Jyq+CbwariWqenWdtb7E sytdxkcm/cRzo2dE+eJ2z0/G02os01RVGdM5uVctXLNWhcpmJ3TGQADKMAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAOGsrKS30stdX1UNNTQMWSWaZ6MZG1E3VznL0RE+NQzETM5Q5iL tRterBiFxXE8YoJcpyx+7W2uhenLTr/CqJfexNTfwXr4dERdzQ8n1RyvWWsqcf0zrqmxYhC5YazI mtVlTXqnR0dIi9WN+OTx/B4L38UwzHcLoFt+P29sDXrzTSuXmlnf63SPXq5f8nXpsUbmJmrVa4+X m9JhORqLMRcxu3sfqnq8I175hgLhi2c6lypWawZOslDzI+PHbS50NCzruiSu355lT516L4LsQFw2 VPHfrjotjuqenVVoFY8fvaVSUlDV2+6RTRdxUy07uZsSuZ1dC5U2cu6Km/XdC25HHZcfAT0y/LX6 YrRhrdNUzNWuTlbF3bVNFFqdGnXqjVHV1fXa1z2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1FzQWuao 3OJ03EduVMvaw7Sb5WcO/wBFvP1D2sO0m+VnDv8ARbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UP aw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy 9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/wBFvP1D2sO0m+VnDv8A Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv 9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNx0 3EduVMvaw7Sb5WcO/wBFvP1D2sO0m+VnDv8ARbz9Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UPaw7S b5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rDt JvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Rc0DmqNx03EduVMvaw7Sb5WcO/wBFvP1D2sO0m+VnDv8ARbz9 Rc0DmqNx03EduVMvaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv9FvP 1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rDtJvlZw7/Rbz9R8v0u7SORqsflXDs5rkVFRaW8Kip8 XgXPA5qjcdNxHbl4mX3Rniy4vtFLPq7hdzxOls2TMqFrMQsss1qZUS01ZNEkj2yvdDKvNFzJzSMa 30dm77uWoeXaXataJX+jnz3BMhxuppalktPNUQS07JHscjkWGob6Kqip0dG5VReqLuh699nR8DbT 78rfpWrLCXmy2jIrZUWW/WyluNvq2LHPTVMTZIpGr6nNcmylaLvNTNMRqdirAxjaab1yudKYjOZ1 9X762u8BFDoPVaF0ud6D+dfI8rlSrvTLreJrhWQXONjY5YZnSuXlezZE9FGo5qseibOapMNHo3pF b8kq8yotLsThyCvqFq6q7Ms1OlZPOq7rI+fk53O39aqVswXTqPhWvl2yzRrGknxi9yMlvuOQOc1W cm6JPSt35edqKqKm27k2RVXZFbabCc5xjUKwQZJid0jraOdNl26Pif645G+LHJ60X8KboqKTWr9N 2dHZLnY3ky7g6YuetRPXG/dO6fn1TLPAAnc4AAAAAAAAAAAAAAAAAAAAAAAAAAAAACGOKDX/AAvR LCm268WJ+WZJl6vs+PYdSs72qv1RKnJ3KM2XaL0kSR6oqIi7dVVrV7HEfxH41w941RySW6pyLMMi n834ti1v9OtvFa7ZGsY1EVWxoqt55NtmoqeLla1dQ4cOHDJbFktZxEcRFxpsi1jyKDu3Oj9Oixii dvy26gbuqNREVUfInVyq5EVUVzpAjbgIy6DQu3U3Bjq1glPp7n9vSovFtjbUJNSZJTzyOldNT1G6 pLLGi909nM5USFNveuay65FnENw84ZxFYZHjuRTVNqvNqnSvx3IqBeSvsle3ZWVED0VF23a3mZui ORE8FRrmxzw88Q2Z0WZycMXE7DTWrVO1QLJa7pGnJQZhQN35aykdsid7s1e8i6Kio5URNnNYFmQA AAAAGOv2RWDFrdJd8kvNHbKKL309VM2Nm/xIrl6r8SJ1Uh268Ss9/kkodHMIrsjVFVvnatRaO3MX fxRzkR8m23giNXw2UiuXqLXrSuYXk/E4zXZpzjfsiPGZ1JzI5zHiB0rwuoW3VmSMuV035W220sWs qVd/BVrN0avzOVCKbhieoWfbv1U1Fq56V/jZrHvR0W38F7k+ySp4++6/ObDjuHYviVP5Njdio6Bq ps50Uac7/wC6evpO/GqlWrFV1epGXj5f7duzyLh7WvEVzVO6nVH90x8o97irtY9aMu3jwrAqLFaJ /RK7IZVkqFT4208fvHfM5VQwFZppd8td3uqGol/yZHLu6ibN5FQ/g7mLb+PdDfAQVaVfrzn8uDp2 ubw38vRFHfGuf7pznhMMPYMOxXFo0jx7H6Cg6bK+GFqPd+F/vl/GpmABERGqCqqquc6pzkABlqAA AAAAAAAAAAAAAAAACqXD/fe0C4itIrDrJiN50Kt9pyDyryemuVHdW1DO4qpad3Okbnt6uhcqbOXo qeC9CQ/aw7Sb5WcO/wBFvP1Gx9lx8BPTL8tfpitLVHR5qjc8j03EduVMvaw7Sb5WcO/0W8/UPaw7 Sb5WcO/0W8/UXNA5qjcdNxHblTL2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1FzQOao3HTcR25Uy9rD tJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1FzQOao3HTcR25Uy9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz 9Rc0DmqNx03EduVCMh4X+OfKHLNd5OGt1Qq7+UQ0d5gmRfUvPHs5VT51MniOjHagYW5I7TrZo9PS NXpR1/nSria3+C1ZYle1P7lyF5AYizbpnSiMpb18o4q5RzdyuZp3Trj4qq+bO0/+U/Db9CvX1jzZ 2n/yn4bfoV6+stUCVSVV82dp/wDKfht+hXr6x5s7T/5T8Nv0K9fWWqAFVfNnaf8Ayn4bfoV6+seb O0/+U/Db9CvX1lqgBVXzZ2n/AMp+G36FevrHmztP/lPw2/Qr19ZaoAVV82dp/wDKfht+hXr6x5s7 T/5T8Nv0K9fWWqAFVfNnaf8Ayn4bfoV6+sebO0/+U/Db9CvX1lqgBVXzZ2n/AMp+G36FevrHmztP /lPw2/Qr19ZaoAVV82dp/wDKfht+hXr6x5s7T/5T8Nv0K9fWWqAFVfNnaf8Ayn4bfoV6+sebO0/+ U/Db9CvX1lqgBVXzZ2n/AMp+G36FevrHmztP/lPw2/Qr19ZaoAU8sWr3GZgHEvpHpBrzVaSV9k1N 8/7SYrR3BtRB5ut61HV1Q9Gt5nviTo126I/w6KXDKq8Q/wAOzhG/w+/Q8RaoAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AA+JZYoInzzyMjjjar3veqI1rUTdVVV8EQrRlWS1HELfVoaJ80Om9oqOrk3Yt+qWL4/H3DVTp8ap 8fvNp4h8ouN6rbdohjdQ+CqyGFau9VTFTeltbXcr0T+2kcnJ+DdF9905bZbaKz2+mtVtp2QUtJE2 GGNidGsamyIc/E3Ocq5uNkbfLzep5JwkYW1GLr9er1e6O14z1btu5y01NT0dPHSUkEcEELUZHHG1 GtY1PBEROiIcgBEv7QjjsuPgJ6Zflr9MVpI5HHZcfAT0y/LX6YrS1hetw+Wfue/6LVAAtuGAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAChfZ0fA20+/K36VqyyJW7s6Pgbafflb9K1ZZE5l z158XscL7Cjwj5Bot3tt702yN2qWnFF3kqptfrLH6Mdzp0XdXtROiTN6qionXr47qjt6BpMZ642r VFejnExnE6pjqmN372bYSPheZ4/qBjdHleMVqVNBWs5mqqbPjcnRzHt/euavRU/zpspnCtmH3aTR 7VWKjTduJagVaRKxNkZQ3dU9FyfE2VE2VPjT4moi2TL9i7ztOvbG15XlPAxgr2VGuirXTPdunvid U8esABO5wAAAAAAAAAAAAAAAAAAAAAAAARBxH8R+NcPeNUckluqcizDIp/N+LYtb/TrbxWu2RrGN RFVsaKreeTbZqKni5WtVxH8R+NcPeNUckluqcizDIp/N+LYtb/TrbxWu2RrGNRFVsaKreeTbZqKn i5WtXUOHDhwyWxZLWcRHERcabItY8ig7tzo/TosYonb8tuoG7qjURFVHyJ1cquRFVFc6QHDhw4ZL YslrOIjiIuNNkWseRQd250fp0WMUTt+W3UDd1RqIiqj5E6uVXIiqiudJY4AARZxDcPOGcRWGR47k U1Tarzap0r8dyKgXkr7JXt2VlRA9FRdt2t5mbojkRPBUa5spgCs3DzxDZnRZnJwxcTsNNatU7VAs lrukaclBmFA3flrKR2yJ3uzV7yLoqKjlRE2c1lmSLOIbh5wziKwyPHcimqbVebVOlfjuRUC8lfZK 9uysqIHoqLtu1vMzdEciJ4KjXNrrivE7xFWPLIOFXVW02GyanUlO+Smyypeq0OR0DOjKyii5UR0y tRVfH6nNdu1uzms0rri3TpSnw9irE3YtUzETO+co/fx3Lg5bm+JYHa3XjL7/AEdqpE35Xzv2dIqe pjE3c9fmaiqQ5dNctQ883ptJcUSz2x/Tz/f41ark/hQUydXevZzt0X1ohiLPpfaYLp7JcsuFXleQ O2V1xuru85PmijX0Y2p6kTfb1KbmUK79y5s1R8eP78Xp8PybhMLrqjnKt86qfdHX7/7WjUek9srL k3Ic+u9dmV5b1Sour+aGLw6RQJ6DG9E6dTd2MZExscbGsYxEa1rU2RETwREPoEUUxGxeru13MtKd mzdHhGyPcAA2RgAAAAAAAAAAAAAAAAAAAAAAAAAAjjsuPgJ6Zflr9MVpaoqr2XHwE9Mvy1+mK0tU dV4cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVXiH+HZwjf4ffoeItUVV4h/h2cI3+H36 HiLVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAFZMKqpMtzrOtRKxUc+qu8lnok337ujpPQbt8XMvpL86G8EeaDc6aeR NqP9ttuFclX/APO8ofv/AJNiQzj0TnTnPXre/wATTFF2bcbKdUeEao+QADdAEcdlx8BPTL8tfpit JHI47Lj4CemX5a/TFaWsL1uHyz9z3/RaoAFtwwAAAAAIF4iuJm5aV5TjGj2luBvzrVLNWST2qy+V JTU1JSR7o+tq5lRe7harXbIibuVj0RU26z0U5tr4LN2q939kjkZLf9JYo8cfL4SJHWsdPFHv+++x zPVE68qOXwXqGSyTUDtG9NrPPnGSaV6MZxZ7fGtTW2LEa66Q3fuWpu/uXVKLHK9rUVeVrVc5U2a1 yqhYG06sYjPp3ZdSsrqnYTbb1DTPSHKuW1z0s0+yMp5mzq3ll515Ubv6S+93RUVdQ1mdxgNyOjTh 6g0dfYfIm+WLmct0bWeWd4/m7tKRqs7rk7vbf0ubm9WxTzX/AFszDiP7L+g1Zyiltlnv95yajhc2 0skZBA+C9OgjfGkj3vRdo2uXdy9d/DwA9CLJnmD5LUXekxzMbHdZ8fm8nu0dFcIp3W+XZVWOdGOX unbNd6Ltl6KYnGdadHM1vT8aw3VnDL9d4ubnt9sv1LVVLeX328Ub1cm3r6dCq3HLgGIaU8O+HaS6 bWKkxewZ7n2O4jkU1shbTz1NukWVZXTzMRHSOcsTUc9yqrud26rzLv8AvaEaMaVaYcJ9y1H01wbH 8PybTets9xxq6We3xUlTRzJX08PKkkbUc5qskdu1VVFcjVXdUAuIzL8Tkyp+Csyi0OyWKhS5vsyV sS1zaNX92lQsHN3iRc6o3n5eXmXbfcNy/E35U/BWZRaXZLHQpdH2ZK2Ja5tGr+7SoWDm7xIudUbz 8vLzdN9yqmH1s9y7TeruNVB3M1VoLSzyRfwHOu8Sq38Srsd21PY7tUL01rkVWaHxNciL4L56jXZf xKn8YE8VuvuhNttdLfLjrVgdLba2eWlpqyfI6NkE80TuWSNkiycrnsd6Lmoqqi9F2ObVHWTAtI9K rvrJld4Y7GrRRJXLUUjmzeUteqJEyHZeV7pHvY1nVEVXp1ROpUns19HdMci0XzHJsow+y5DcbxmV 6oKiS6UcdWsVJHNs2lakiKjI+Z8kitTZFdK5V33K55KlXRcCGf4o5amrwnS7iDmtDY1V0rY7BDUx KkXXfdiTVKL+F6AXCxzUztD9UrBBqFg+lGjuG2G5RJV22y5hcLlNeJqdyczHSOpkbFC57VRUa5N2 quzkQlHhu14yXWKiyOw6h6Y3LBc3wqvbbb7bJlWake9zeaOakqURGzRvanN03Vu6b7o5rnS/Q1lH caKnuFuqYqikqomTQTRORzJI3Iitc1U6KioqKip6iAOM/V6LFuGrWJ+n2XUS5djNjbFV09FWMWtt flfIxsr2NXnhd3UqvY5UTw3TwAlFNbtF3ZR7B26u4UuR995P5nS/0nlve77cncd53nNv0223M9eM uxPHbha7RkGT2m2V17lfBbKWsrYoZa6RjeZ7IGPciyua30lRqKqJ1UqldeFjh/puA6qssOneNo+D Tx92ZekoIvLfL20HfpXeUcved53qc+/Ntt6PvfRIRyuWt1x004FW6jz1Nc/IbulNd3SyO56+BtM2 ORsrt93JNGzaTr6SSO38QPQXFNXNKM7utVYsH1OxPIblQtV1VR2q9U1XPAiLsqvjie5zURVROqJ1 I2054xNIdSNcc00TtGW4v5TjK22G1VkeRU8rsgqKiCWWoipYk2V603dtbJyOkVHOVHIxW7LE/E7h uJYBxO8LWSYPjFqx+4T5VXWWaa2UcdKs1FJSo1YX92iczERXIiLuiczttt1PjhrxrGbfxmcWVwpM Ttb57JV4tNbWsoo0dTvfbKhz0hVG7xq9fHl23Veu4Focq1k0hwW7w4/m2quH49dKhGrDQ3W+UtJU SIvgrY5Xtcu/q2Qyt9zjCsWjtc2T5hZLRHfKuKgtbq+4RU6V1TL1jhgV7k72R371jd1X1Ip5qcHS ZnnGiNXn984FYNZLjqJdLncL3ltxyGxtfcXrUyRLE2Osk76GONGciM2am6K5vRyKTlobw55LeODL MNCeKPHajDrRb7vc5ccdW3ilrqix2diMqKKpSqhlexrqeR0qJu5PRi2VEYuyhbvI8zw/D1tyZdld msi3itjttuS410VN5ZVyb8lPD3jk7yV2y7Mbu5duiERac8YmkOpGuOaaJ2jLcX8pxlbbDaqyPIqe V2QVFRBLLURUsSbK9abu2tk5HSKjnKjkYrdlrPwP5jd+K3V6lz7XO/09wvmkWP09JiNsdTywtuTK jmZLk3JM1qvdO2NjGq1Nmb7qjVVirInC5iWKw8bXFTNFjNpZJarhibqBzaKNFpHSW6dZFiXb7Grl 6u5dt/WBcoAAAAAAAAAAUL7Oj4G2n35W/StWWRKA8FtHxmy8NGHSaUXnSGDFV84eQR36nuLq5P8A ZCo73vVh9Bfsvecu373l367k2+b+0R+UOgX0S7/Wc+un7U63q8Neys0Rozsjq7lkQVu839oj8odA vol3+seb+0R+UOgX0S7/AFmmh3wm5/8ApngmPViwrkGA3aCF6x1dHD5fSSt6Ojnh+yMVF9S+jt+N SbtOMnfmmA4/lcrGtlutugqZmt8GyuYnOifMjt0KTXKg7QhLdVLWZDoF3CQv73+pLt7zlXf1/FuZ bQq29o87SXHHYnkWgMdoWnetG250l3dUpH3r9udY/R+Pbb1bEuHjRuTr2x+/mp8q187g6c6Ziaat Uz3xOcfCF5gVV82dp/8AKfht+hXr6x5s7T/5T8Nv0K9fWXnmlqgVV82dp/8AKfht+hXr6x5s7T/5 T8Nv0K9fWBaoFVfNnaf/ACn4bfoV6+sebO0/+U/Db9CvX1gWqBVXzZ2n/wAp+G36FevrHmztP/lP w2/Qr19YFqgVV82dp/8AKfht+hXr6x5s7T/5T8Nv0K9fWBaoFVfNnaf/ACn4bfoV6+sebO0/+U/D b9CvX1gWqBVXzZ2n/wAp+G36FevrHmztP/lPw2/Qr19YFqgVV82dp/8AKfht+hXr6x5s7T/5T8Nv 0K9fWBZrIW351huKYtLRR3nyWXze6ujc+mSp5V7vvWsVrlj5tuZGqi7b7Ki9SoGiHag6M5vkFRpt rZRy6T53bKuS211Jd5kdblq4nqyRjavZEjVHNdukyMROiI56my+bO0/+U/Db9CvX1nj7x0+y5OJ3 L2ahVmE1WVsfTsvkuHRVMdudVpCzmREqF5u9RvIkm3TnR377mA/oop6inq6eKrpJ45oJmNkiljcj mPYqbo5qp0VFRd0VCJOI/iPxrh7xqjkkt1TkWYZFP5vxbFrf6dbeK12yNYxqIqtjRVbzybbNRU8X K1q+XXZ0WPtE2VVDV6KTy2/TiSRHzLmSSLYZWKu7lp4l+zOVevpUvKiqiI96IW54X1bYeLPNqPix artfrisi4rcah29nqce2XljsaOT7Ht6feNXeXbm3XfvkAl3hw4cMlsWS1nERxEXGmyLWPIoO7c6P 06LGKJ2/LbqBu6o1ERVR8idXKrkRVRXOkyul+vWWZnxSa26J3qgs1Pj+mtPYZrZVQRSsqpfLaJJ5 vKHukVjka7o3lYzZPHfxJ5PMDUjSLXPXPi/4sdNdHs7tmK0dztWNLe552yLUV6NtDPJ6BjmKndRT PV6TSb7o1qIiORzmqFt9M+IbO9fdY6+n0ctFlXRzFXy0N2y24U80st9uTeiwWrklYzuo19/O9sjX L0am2zl0e566cXud8T+q2h+h9Po/SWnTaOzS+UZXRXR9TUJXUTJ9uamnRqqj+8T3jfR5fFd1JA4L dX8N1D0ogwmz4dT4LkmnfLj2SYaxndrZquLdq8rVVVdDIrXPZIqrzelu5zkcpoPD1/7wvis/5Jhv 6LQDJU3E9rhovnuN4Txe6c4tbbPmNey02fN8OrZ5bSy4P/c6aqhqUSWBX7dHqqt6L4tR7mfevOu3 Eja+KDF+HTQOi01bJfcSmySasy+mr5GsdFUSxuY11LK3ZFaxuyKxeu/XwQxHaqVFFNwl12MxtSW/ 5FkNmt2OwMX7NLXrVseiRevm7pkqbp8ZpXEKmtEPaJ6cs0S9hk+Wt0vqm75Y+qZb3ReVzd6qrSos nP4cvTbx3AmzFYu0LTJ7Qub1vDu7HUroPOyWqlviVq0feJ33k6yyLGkvJzcvOnLzbb9DdeInh2wn iOwluM5M+e23a2TeXY9kND6NdZa5uysnheiou26N5mbojkRPBUa5un4VJ2ga5Zak1Fo+HtuM+VM8 6rZam9rXpTb+n3CTMSNZNvDmXb4ywgFJNINX82x7NpeG/iQp4LbqRbYVktlzjTlocsoW7o2spXKi J3myL3kXRUVHdE2c1k8EX9ozWaOP0jobJmtFca/UCsrE9rmmsLuW+NvO6d3JTORFcyNHcneqqcqt 2T3/AHe0WYza+0fhx62xXTI9EHVbaWJJ1r6e4vqeflTfvXQ7RLJ/CWNOXffbdNlKV61FM5xL0WAx td2jRrpmcuuFowVu839oj8odAvol3+seb+0R+UOgX0S7/WQ6HfC/z/8ATPBZEFbvN/aI/KHQL6Jd /rHm/tEflDoF9Eu/1jQ74Of/AKZ4LIgrd5v7RH5Q6BfRLv8AWPN/aI/KHQL6Jd/rGh3wc/8A0zwW RBW7zf2iPyh0C+iXf6x5v7RH5Q6BfRLv9Y0O+Dn/AOmeCyIK3eb+0R+UOgX0S7/WPN/aI/KHQL6J d/rGh3wc/wD0zwWRBW7zf2iPyh0C+iXf6x5v7RH5Q6BfRLv9Y0O+Dn/6Z4LIgrd5v7RH5Q6BfRLv 9Y839oj8odAvol3+saHfBz/9M8FkQVu839oj8odAvol3+seb+0R+UOgX0S7/AFjQ74Of/pngsiCt 3m/tEflDoF9Eu/1jzf2iPyh0C+iXf6xod8HP/wBM8FkQVu839oj8odAvol3+seb+0R+UOgX0S7/W NDvg5/8ApngsidG+JenWWuTHJKSO6+TSeQurGOfAk/Kvd941qo5Wc23MiKi7b7KilfPN/aI/KHQL 6Jd/rHm/tEflDoF9Eu/1jR74Oez+7PBr+kHaJaUZfe58A1dpJNNMyt9VJb6ymukqOoFqY3qx7G1W yJGqOau6SoxE8Ec4tdBPBVQR1NNMyaGZiSRyRuRzXtVN0VFToqKnrPCfjH9k/uhsobnFViNTkrHQ NvEmKxzsoFqkibzbJOvN3iJyo/bpzo718xOnAhZ+OplTR1Okk0tDgT3o+VcrR62WViru5YI1+yuV evpU+26ps5yE9dmNHSicnNscoXOcm1XTpd8bffD0g7Lj4CemX5a/TFaWqKq9lx8BPTL8tfpitLVF xwAAAAAAMbkWTY5iFpnv+WZBbbLa6ZEWatuNXHTQRIvROaSRUa38amSKD8XlyyjKeObTDTpuj0uq tjx/DarK6bEn3OkoqaquD6ianWol8rc2GXuWRsVrHbqiv3RNuYC6+G6h4BqNQy3PT3Ocfyejgekc tRZrnBWxMcvg1zonORF+ZVMRctdNErNb57td9YsHoaGluM1onqanIaSKKKuh272lc90iI2ZnM3mj VeZvMm6JuVSwfTrXBnF1gmrmLcIi6QY46guNnzp1Nkdmlp7nTPh5qSR1PSS7rJHO1FVyMc5UVqdE afPANpTp5k2Q8ROZZPjFqvdzdrBkdoYlxpY6lKalY9kitjbIioxJHTLz8qJz92xF35E2C7lpu9pv 1tprzY7nSXG31kaS09XSTNmhmYvg5j2qrXIvxouxqts1u0YvWS+wuz6u4VX5B3ixeaaa/wBJLWc6 eLe5bIr9/m2PNvJsuyDRzhV4xsA05q6i3WPFtRfNNkSneqNtdFcKuGOppoVT3jEa5zERPBZVXxVd 7McUPC7oLh/BXl1vxfT/AB+1z4Xi8l0st4pKGKKuirKSJJYp0qWokiyPexOZ3Nu7nXffcC1uSZTj OG2ibIMvyK12O10+3fV1yrI6anj38OaSRUan41MNTalYjk+E3XM9OstsGTUlDSzyx1Vsr4q2mWWO NXI1XwuVPi3TdF2UpNYq9/EbxJcNuMa0UMN8s0WidNqC+2XCJJaStvtS1sUkssLvQkcxqc7Uci8q qqptupZSThs0s01yXONW9PbfLjVbkGJzWu52W191TWmqWNHvZVOpWMT+qE6s7xHInKrum7nKoYjh 34tsSznQHAdTNb88wLDcjzGlqJ0oZrpFbopVZVzQt7iOpmdI5No0/fO67/gLDRSxTxMngkbJHI1H sexd2uavVFRU8UKDcFXDxo7k3Z+W+95dgFkv12yWxXaWsuNyoo6ipY1k1THCyKV6K6FsbWN5EYqI 13M9NnOVSbezputwvHBVpXWXKqkqJmWuela+R26pFDVzxRt/A1jGNT5kQCx5q2aaqaYabrTpqJqP i2LLV7+T+erxT0PfbLt6HfPbzfiNpKVar6N6n4JxN5nr/S8PGP68YzmVstlGygqaumjuuNJSQ93I yljq2rHLFKv2RWsVHK5fVsqvC41jv1jye1U99xq9UF2ttW3np6yhqWTwTN8N2SMVWuT50U1u2a06 OXrJ3YTZtWcMr8ia9Y3Wimv1LLWo9PFqwNer902XdNih2quqmlWMcDOvF34ZsUyPTe+eeqWiyrGr hFJRVNhq6yop4J+SmR7o6dkkKua1Ydmrv4Irdk5c/wBE9QMo0BZpPgXZwpjd0t9BAuPZNS5hjrK6 hrouV0VZ38cySuer2or1593czt16geheSZTjOG2ibIMvyK12O10+3fV1yrI6anj38OaSRUan41On jWoOBZnY5cnw/N7BfbPBzd7cbbcoaqmj5U5nc0sblYmydV3XohTO82u96ucYmhWlfERYqaujsGkn swuVhru6qaOXJZH+TVHeMaroZ1i5HK1fSanVW9F3WepeGvSvTbJM51a0+t8uN1mQYnParnZLX3VN aKru2veyqdSsYn9UJurO8RyJyq7pu5yqEjWXVrSrJLha7TjmpmK3WuvlI+vtlNQ3mnnlrqZquR00 LGPVZI0VrkV7UVqK1evQ4LvrTo5j+Stwy/as4bbcge5rG2qsv1LDWOc7wRIXvR6qu6bJsU24MMSx /TPs65Necexu3VGoEWIZFeIb1NSRy1qSUyVTKeFkrkV7Y2sgjakaLy78y7buXfQ+HXCb9kPC7Z7N W9nqmoUWZW6S4XLLqrK7C2uu9RUq57qvvKiTyiN6K70OZUczlTwXcC6XEjxRYDw22/G5cnuNnkuG SX2gtUNBV3iKikjpZ52xz168yOXuYGKr3u2RvRGq5vNuSrj+RY/ltmpMjxW+2+82mvj72kr7fVMq KeoZvtzRyMVWvTdF6oqp0POHU3AdSMd4TOF3GOIbFoI82sur9gsVV5ZNTV0rrd39YkMTponSNcxY GworeZd+ROZNz0mt1tt1noYbZaaCmoqOnbyQ09NE2OKNvxNa1ERE/AgHZAAAAAAABVXiH+HZwjf4 ffoeItUVV4h/h2cI3+H36HiLVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFZcQpX4hqFnWnVUnKsV0ffKBV/wB8pKr0 un9w70V+dTdzrcQ2JXOgmt2tGLU0lRccZidBdKSNE3rLU53NIn91Gu70/C5fUiHzabrQXy2Ut4td Q2ekrImzQyNXxa5N0/Avxp6lOVVTzdc0T7vB7i3fjGWKMRHXGU91URr47ff3O2AABHHZcfAT0y/L X6YrSRyOOy4+Anpl+Wv0xWlrC9bh8s/c9/0WqABbcMAAAAACIuILhpwviCo7NWXO63fGsrxWodWY 5lFjqO4uFrmXbm5HbKjo3creZjk2VE6Ki9SXQBVmr4V+JrKqJ2NaiceGVV+NzN7qpprFiNustwnh 8FYtdGr3tVU3RVa1N9+qGwamcGWEZRw0UHDHp1c0wqwWytoqyln8ldXuRYapKh/O10rFe+R/MrnK /orlXb1FhgBoGuuimH8QWmlz0wzbyuKhuCxzQ1dFIkdVRVMTkfFUQvVF5XsciL4Kipui7oqoQ3dO D/UvUtLJjvEPxM3DP8JsddT3BcfgxeltS3SWBd4UrqiOR7p2IvVzWtYjl6r1RFS0YAgnVjhsyHLN ZrNxAaU6rvwPNLdY5MZrZZ7JHdaO42x03fJDJA6SJUc2ReZHtfv0b06HR0w4UrlgXEZcuJC/6tV+ U3u+4h7G7rDVWxkCS1HlccyVEKxyckETYoYoW07Y196r3SOe5yrYQAedXAxo9qzftEsgyHR3iCrd PZLzmF8iulLPj9PeaaSWOoVjamBkr2Ogm5OVjlRzmOSNiqzdN1tnpXws6ZaaaE1GgNXSzZNY7uyq df57qvNNd6iqVVnnlVu2zlXblVq7tRjNl3TmJLxjEMTwm2us+GYvabDQPnkqnUtsooqWF00i7ySK yNqNVzl6q7bdV8TLgVLsXBvrzptbPYVopxtZTjOEQ7x0VnuuLUN6qaCBf95grJnNexjU6NTl9FNt uvUkXTHhC0o0505y7T+tS55XNqGyb2Y3u+VKz3G9vlY5jnSyptyo1Hv5Gt25N1VFVyq5ZvAFS14K 9WJtPm6E1XF1kMmlKUyWpbOmNUbbs61InKlCtz5t+Tk9Dfud+T0fe+iSLnPC7YskvOilRi97jxuz 6LXFtXQWtlCtQ2qp2U7YI4EkWRqxcrWp6ao9V9aesm8ARJrLoJ7bmoGlWdeyvzT7WV/kvnkvkPf+ cOeNGd1z943uttt+blf+A1628M+U4rxL5Lr5gmsc1mtGdLbn5Vi8tihqmXB9FAsMSxVTno+nTlVV XlYqqrndfBGz4AKv23hC1J0zr7/RcOXErXae4lkNwnusmPVWLUl5jt9VMu8rqKWV7FgYq9UY5HtR fUZnLeEquyTQqz8P0OtGTrYX3JlVltxujn190yGkWVZZ6RKhZWJSMlcuy8jXIjERqNVFdzWHAEKa icNFBf8AO9N9TdM8igwTItOdrbFJT2xKmmuFhVvLJapoWyRfYuiLG7mXu13Vrd1RUx1t4Z8pxXiX yXXzBNY5rNaM6W3PyrF5bFDVMuD6KBYYliqnPR9OnKqqvKxVVXO6+CNnwAAAAAAAAAAABQvs6Pgb afflb9K1ZZErd2dHwNtPvyt+lassicy568+L2OF9hR4R8gAGqdp+rV9fYsCubqaNZa24MS20ULff STz/AGNqJ86cyr/1SctPcY9heDWHE1ej32q3wUsj08HSNYiPcn4Xbr+MhDBbPLq/qmy+vRy4lgNV vA9ERWV93RPFF9bYUVF3T99t4o4sgWMJTnM3PdDlcu34opowkbY+1V4zsj3Rr9/cAAuvOAAAAAAA AAAAAAAAAAAAx+QpfnWG4txZaJLytLKlvWuVyU6VHKvdrLyIruRHbKuyb7b7FUtCezP0L0xvUuoG pne6qZ7XVUlwrbvkELVpfK5Hq+SWKj3Vm6vVXc0iyOR3Vqt8C3oA+WMZGxscbUa1qIjWomyInxIR dxDcPOGcRWGR47kU1Tarzap0r8dyKgXkr7JXt2VlRA9FRdt2t5mbojkRPBUa5spgCsvDzxDZnRZn JwxcTsNNatVLVAslrukaclBmNA3flrKR2yJ3uzV7yLoqKjlRE2exm96e8P3sD4htVtefZb5d7Z0N mi81eQd15v8AIKVIN++7x3e8+3N7xnL4el4nZ4jdAMG4gcG8zZXVy2W52WRbnYcmo3pFW2GtYiOb UwyboqIitTnaqojkb4oqNc2IOEvi6rMuv0vD7rhcqFmo1o72O2XqmasdvzGjicrfLKRXI1O82aqv jRE8Fc1ERHNZjOInJvFuuaZriNUdfVrSDnvDG676+Y5xG6ZZz7CcroY/N+SNbbPLKXJbZ02p6mNJ YtpGo1OSbdyt2Z0XkbtpeScI+tNNr9qDrro5xQU+Cy6hstkdfbpsGp7tyNoqRkEaJLNUt33Vr3dG N9/su+25agGWitmC8HdxXUy06xcRGtd71eynGlV+Psq7bBa7VaZV23nhoYFVnfdE2erl6oi7K5rX N3S98P3njikx3iV9lvc+YMVqMZ8y+Qc3f97M+Tv/ACjvE5dufbk7td9t+ZPAl8ACHuJTiUxXh1xW mqqqhnv+W3+XyHF8XofSrLvWLsjWNaiKrY0VW88m2zUVE6uVrVcSnEpivDritNVVVDPf8tv8vkOL 4vQ+lWXesXZGsa1EVWxoqt55NtmoqJ1crWrBuiuiuVQ5VWa/6/3KC/6r3+Lu1WP0qPHKNd+W30Ld 1RqIiqj5E6uVXdV3c6SO5ci3C3hMJXiq8o2dcmiuiuVQ5VWa/wCv9ygv+q9/i7tVj9KjxyjXflt9 C3dUaiIqo+ROrlV3Vd3OknAA59VU1TnL1Nq1RZoiiiNQADCQAAAAAAAAAAAAAAAAAAAAAAAAOjfE vS2Wubji0iXVaaRKJaxXJAk/KvIsnKiu5Edtvsm+x3gBV7Rrs+9HNPLtLm+oPe6kZpWVL66rul7i atP5S9yvfJHS9Wbq5ebmkWRyL1RW+BaBrWsajGNRrWpsiImyInxH6DNVU1a5R27VFqMqIyRx2XHw E9Mvy1+mK0tUVV7Lj4CemX5a/TFaWqOo8WAAAAABDOvHDfBq7kWK6kYpnVywPULCXz+ZMjoKaKq5 YZm8s1PUU8voTwuTf0VVFRVXZeqoszACEtM9B9SrHqHHqdrBxDX3PbpQ0MtvttvpLdHZLRSxyqiy PdRwvek8q8qbPke7b1JujVbWLhE0o1Oyar1+y7SPXGq0/us+s2T2uvZPYoLzRVMMToZIZEglcxY5 mOnlTna/ZyORHNdyt29CjEY7iGJ4gy4R4ni9psjbtXy3W4Nt1FFTJV1su3e1MvdtTvJX8reaR27n cqbquwEM4HwbacYxoTleh+VXG45bHqBV1lzyy9VqtjrLncalWufVJy7pG5rmMcxE3RqsRV5lVVXT LhwX6rZbhlJo5qRxZ36/6Y07YKaezRY3S0dzrqKFzVipqi5Ne5z2+gxHObG1z0TqvUtgAIN1m4W7 bqHccKzHTrM63TfNtO4n0mO3u20cVTHDRPjSN9JPSybMngVqJs1VTl67L1VFxunPCndrHmWS6s6s au12oeoV/sD8Xp7vLaIbdSWu2uVXLDTUcTlRu715nOV6qu3q5nK6wgAiXQnQX2lOHWz6Beyvzz5p t1Zb/O3kPk/e9/LNJz9x3j+Xl77bbnXfl8U36Y/QbE8G4UtHMU0KyTVixVVVjtLMjauulhtslSyW pllR6QPlerU3erd+ZUXkX8CTUaRmmh2iupF2jv2omj+E5Tc4oG0rK29Y/SV07IWuc5saSTRucjEc 9yo3fZFcq+tQOz7b2k33UMS/lum/XIrynQLVCuz276o6D8T9xw+mzCKmqLhbK6ywZDbJXsjRsc9I 2WVi0/MzZVRjla5V328ETbfcncLH3tOlX5m279iSXbLZbbJbaSzWa301Bb6CCOlpKSlhbFDTwsaj WRxsaiNYxrUREaiIiIiIgECYbwaYbQ4LqTjGqWUXPP7xq9I2XL71VwxUb6l0bOSnSCGJOSnbD76N E5lR3XdURETXafhH1zmxii0vvXGdlM+AUTYaVKOix6lor1LRRKnJTvurHq/wa1qyNja9yIu69VLT gCEdb+GWDVC84fn2E6gXXAs/wNssNkyOmgZXr5NKzklp6qGddqmNyddnORd1Vd+q74nTnhTu1jzL JdWdWNXa7UPUK/2B+L093ltENupLXbXKrlhpqOJyo3d68znK9VXb1czldYQARZw9aFUehugePaE3 G9x5RS2WjqaKerkoUpmVkc00sjkdCr5OVNpVaqc677fPsRPj/B1q7ptj9Tproxxa3zE9O3yzrRWa fGaS4V9rhme58kNLcJHtexu73cquY5zN90XfqtqwBAGrXCTb9RNDMS0dsepF/s1fgl0t17sOSXBf O1Yyvo+fkmqElc3v9+8fu3maiKqIiI1qNJgwS0ZXYcSt1ozjMG5VfaeNza28Nt0dA2rer3Kjkp43 ObGiNVG7Iq+9333Uz4AAAAAAAAAqrxD/AA7OEb/D79DxFqiqvEP8OzhG/wAPv0PEWqAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAPl7GSsdHIxr2PRWua5N0VF8UVCtOY4hW8P8AepchscE1RpzdJ+aspWIr3WKd6/ujETr3 Dl8U/er+Lmswcc8EFVBJTVMLJoZmLHJHI1HNe1U2VFReioqeohvWYvR3xslf5Px9eBrmcs6Z2xv8 pjqn6ZwhmhrqK50cNwt1VFU01QxJIponI5j2r4Kip4nOa3lekWU6U1k2SaQUUt2x6olWW4Ytzbvg VffSUar/AJY/4t+nLy4jnOOZtSPqLHWqs0DlZU0kze7qKZ6LsrZI16tXfpv4fEpz5zonRrjKf3se rom3ft89h50qfjHdVHV8p6pZ8jjsuPgJ6Zflr9MVpI5HHZcfAT0y/LX6YrS3hetweWfue/6LVAAt uGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAChfZ0fA20+/K36VqyyJW7s6Pgbafflb9 K1ZYW73i1WGglul6uEFFSQpu+aZ6NanzdfFfiROqnMuaqpeywkTVZoiN0fJ3DQq2qvmrmQy6badV 6wUUC7ZFfourKOLfZYIneDpndU6eHX4lVvJZrbm+vEqQWFldjGCyN/qi8yx93V3NnrZTNXq1i/8A CL6vxtWwWIYdjmB2CmxnFbXFQ2+lT0Y2J1c71ve5ernL63L1UWrU39eyn5+HmxjMdb5NiaY13d22 Ke+e/dT1de6f3EMRsGCY7RYtjNC2kt9CzkjYnVXL4ue5f3znLuqr61UzIB0oiIjKHkK66rlU11zn M7ZAAZagAAAAAAAAAAAAAAAAAAAAAdC+X2z4zaaq+3+4wUFvoo1lnqJncrWNT/OvqRE6qqoibqp1 cvy/HsEx+ryfKLjHRW+jbzPkd4uX1Mani5yr0RE6qV4kTI9b7vDl2f0ctBjNNJ3tkxx6+/8A4NRV p++eqdUZ4Ii/FvzV71+LX2Y1z+9rqcncmVYzO5XOjbjbO/ujfPwjbPf93q/5NxB1SvqkrLHp0x28 FFusVVe9l6STKnVkPTdGp4+PxKmN1h0BwrV7CqTFqhklirrHI2rxu82xO6q7JWM2WOaBzdlREVre Zm6I5ETwVGubJbWtaiNaiIiJsiJ6kP0oxMxVpzOt6SuLc2+Yopyojq+s7570e8MvE1lNTlLuGziT ZTWvVK1wK+23JiclDl1C3farpV2RO92RVkiTZUVHKiJs5rLSlV9cND8W1yxaKzXmeptd4tc6V1gv 9C7krrPXN2Vk8L0VF8UbzN3RHIieCo1zfvhl4mspqcpdw2cSbKa16pWuBX225MTkocuoW77VdKuy J3uyKskSbKio5URNnNZ0LV2LkZTteWxuCqwtWlTrplaUh7iU4lMV4dcVpqqqoZ7/AJbf5fIcXxeh 9Ksu9YuyNY1qIqtjRVbzybbNRUTq5WtVxKcSmK8OuK01VVUM9/y2/wAvkOL4vQ+lWXesXZGsa1EV Wxoqt55NtmoqJ1crWrBuiuiuVQ5VWa/6/wBygv8Aqvf4u7VY/So8co135bfQt3VGoiKqPkTq5Vd1 XdzpNrlyLcI8JhK8VXlGzrk0V0VyqHKqzX/X+5QX/Ve/xd2qx+lR45Rrvy2+hbuqNREVUfInVyq7 qu7nSTgAc+qqapzl6m1aos0RRRGoABhIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjjsuPgJ6Zflr 9MVpaoqr2XHwE9Mvy1+mK0tUdV4cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVXiH+HZw jf4ffoeItUVV4h/h2cI3+H36HiLVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACNtSNC8Yzysbkdtqp8cymBNoL1b 05ZF/tZmbokzfVs7rt0326Ekg0ropuRo1RnCfD4m7hK+cs1ZT+9u+O6VYrrfNSNK3rDqtjfl9oYu zckssbpYEb16zwonNEvhuu2267JuQBw42Hjl0d0dsOmWlWc6A3bGrJ5T5JU1cV0nnVZ6mWoekjo+ RN0fM9ETlRUREReqbno25rXtVj2o5rk2VFTdFT4iJsq4a8Fu1dLfsQnrcMvcnpLV2Z/dxSLvv9kg 945Oq7oiN39albmblnObU5xunbx/fi7HT8HyhlGNp0ao66dnvjbHuz8EEeyztK/t5w8fQLx+sPZZ 2lf284ePoF4/WN/uFBrnp4rvZFi8Wb2pnhcbC3krEb8b6VffL49GdPDqMf1XwXIqhbfBem0VwYvI +huDFpahjv4PK/bdf7lVI5xNdM5Vap71ynkbD3KdO19unfTOfHrj3xDQPZZ2lf284ePoF4/WHss7 Sv7ecPH0C8frE3Az0itH6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7 LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8f rE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4 /WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6 eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4 +gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nD x9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrP ReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv 7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4wOS53h+HxLJkmQ0dE qJukT5OaVyfNG3d6/iQxOJrjXMtqOSLNydGimZlF/ss7Sv7ecPH0C8frHxNmXaS08T56jIeHWKKN Fc976K7ta1PjVVd0N5ocn1Jz3aLTDTisSnk97eb+i0dGifw2s/dJU6/vevj0NrtHDRDeZY7jrFl9 dlc7XI9LdCq0ltiVOqJ3bFRz9unVVTf1opmi9euepHv2R+/Bpf5P5Pwn8xVlO6Jzq4Rqj3zCvHCv a8t0y0VxvQrCbXTZzkWPurWVtztr3ts8CzVs07VdUSNZzbMmbuiJ1VF2VSxmI8PDqu5U+VayXqPK LrA5JKa3RsVlronf2sS/uq/2z0/Ci7IpL1os1ox+3w2mx2ylt9FTt5YqemibHGxPma1NjuktGGjP SuTnPwVL/LNcUczhI0Kcss9tUx49Xuy75l8sY2NqMY1GtamyIibIifEfQBacQAAAAAAAAAAAAAAA AAAAAAAAAMNl+XY/guPVmUZPcGUdvomc8kjvFy+pjU8XOVeiInVVO3e71acctNXfb5XxUVBQxOmq J5V2axieK/P8yJ1VdkTqVtWe565ZJT57lNNLTYtbpFfjlmmTbvfirJ2+CuX9631J83V1e/e5qMo2 z+83U5N5O6ZVNdzVbp2zv7o75+Ea57/yGHINZMhp9QdQKN9HZqN3eY9j0nVsLfVU1CeDpVTqiL4G /AFGI652vT1VRMRTTGVMaoiNkR+9s9cgAMtAjrXDQ/FtcsWis15nqbXeLXOldYL/AELuSus9c3ZW TwvRUXxRvM3dEciJ4KjXNkUCJmJzhrXRTXTNNUZxKqXA9jtbqriVu4udWshqsu1FyqCpoYK6ujY1 looaaolpkgpY2ojI+funPe5qIq94qet6vtaVu7Oj4G2n35W/StWWRN7kzNc5oMHRTRYo0Y6oAAaL IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKqaFYHx/cPeldk0gwbJdCqiyWDynyWS5U11lqHd/U y1D+dzEY1fTmeibNTpt4+K777LO0r+3nDx9AvH6xNwJukVud6Lw+6eKEfZZ2lf284ePoF4/WHss7 Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ 2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Y m4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6 w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3Tx Qj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0 C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6Lw+6eKEfZZ2lf284eP oF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxQj7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Ym4DpFZ6L w+6eKEfZZ2lf284ePoF4/WHss7Sv7ecPH0C8frE3AdIrPReH3TxVwybWLtF8PrbdHkF00BprbcJk p3XRLdd3U1I9fe98qP5mIv8AC5VT49iRo6DtO5o2zQ5Xw1vje1HNc2jvSo5F8FRd+qEgXK20F4oJ 7XdKSOppKpixzRSJu17V8UU1/TTM63Ri+0um+YXCSfELlJ3WPXWodutBIvhRzuXwb/AcvRPDw35M 0YmYqyubJ+DTE8j267Olhs9OnbG3ON8d8buuNnfgfNnaf/Kfht+hXr6x5s7T/wCU/Db9CvX1lqgX nm1Qse0J4w8x4j9KtZNfsn0kltOmfnzuabFY7jFUTecaBad26VDVa7ZzYV983ZOfxXZC3oAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAANcy/TnBc9p/JswxW3XRETlbJNCnesT+1kTZ7fxKhsYMTTFUZTDe3crt VRXbmYmOuNUoNrOGissm8ml+qF8sLG9WUFejbhRt/tWtfs5ifPuqmCrLfxBYhv56wS15XSM8aqwV ndzI341gl6uX5mljwVqsJbn1dXh5Ova5dxVOq9EVx3xr4xlPGZVeZrZh1JUNocpp7xjFY7p3F5t0 tO7f1pvsrf41NttORWC/x97Y73QXBm2+9NUMk2/DyquxNtZQ0Vxp3Ulwo4KqB/vopo0ex34UXopH WQcN2i2RSLUzYNR0FTvzNqLY59E9jvjRIla1V/CikU4W5HqzE/DzX7fLODue0oqp8JiqOE6PzliA dKo4Z6637rhus2X23b3kdwfHcYmfMjHo3p825jajTTiMsm62/JcOyWJvilZTy0U7k+bu92Iv4VIp t3adtP1W6MVg7vqXo98TH0y+LPg1Cau10tP+7Oh01TG3xmtd5p5+b8Ea7OOlNqwts6ZNpvnNl299 JVWV6xfhR7VXdDSastsTHjErNNmbns5irwqpn5S3wGgU2vOlFS7u/ZbHDInRWT000StX4l5mIhmq PUzTyv2Slzixucvg1a6Nrl/EqopiLlE7JbVYW/R61Ex7pbKDpU97stUiLS3eimRfDu6hjt/4lO4i o5OZqoqL60Ns0MxMbX6ADLAAAAAAA609yt1Lv5TX00W38OVrf86mKrM/wW37+W5lZIFT96+viRf4 ubcxMxG1vTbrq9WJlngaNWa4aUUO/fZpRO2/4Fkkv+g1Tgh1ox+5dMZxrLMgVfe+bLLNJzfg5kaa 85RszS9Ev5ZzRMR3xl80gA02HIdXbt/W/oNfXI7wddK2Cg2+dUeqr+I70GGcSd88aTDMahXxWeom rJ2/gRici/jNo0qvVpnhKGrm7ftLlMf8on4RMz8GyHBWV9DboFqbhWQUsLfGSaRGNT8a9DqU/Dtm 9z2XL9c729rvfRWWiioOX5kenMq/hVDNWrhb0foZ21t3s9dkVY3wqL1Xy1Lvxt3Ri/jaSRZvVfdy 8Z8s1WvlDAWttyavy0z/AO2ij6461acUNR5FTX9LpVuXZlPbIX1T3r8SLGit/wApzUd41hy7ZMK0 hraKB/va7JJkomInqXuesjkXx6FhLJjWOY1T+S47YLda4dtu7o6VkLf4mIhkiWMJVPrVcP3Klc5d t0+wte+qc/hGXzlA1HoFqTkWz9QdXJqOB3v6DGqZKZqfGiVD0V6p6urTfML0L0twORtXY8TpZK9F 5lr63epqXO9bu8k3Vq/3OxvoJqMNaonOI19+tzcRytjMRGhVXlTuj7McIyz9+YACdzgAAAAAAAAA AAAAAAAAAAAAAAAAAD4lligifPPI2OONqve967Na1Oqqqr4IfZX7WfMK/UbI5tFsTqHxWul5H5Xc oXe9jXqlFG5P37tvT+JOnqchFeuxap0pXcBgq8dd5unVEa5ndG/yjrnUwmS32TiEyde6lemnNhqd oY9lal8q2L1kd8cDF6InrX8Ozd4a1rGoxjUa1qbIiJsiIcFut1DaKCC2WyljpqWljSKGKNNmsaid EQ7BztczNVW2XrZ0KaYtWoyop2R9Z756/LIABlqAAAAAK3dnR8DbT78rfpWrLIlbuzo+Btp9+Vv0 rVlkTa568+KDC+wo8I+QADVOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAGNyLHrRlVmqbDfKRtRR1bOR7F8U+JzV9TkXZUX1KhkgYmM9Us01TTOlT tY3RfUG6YvemaL6h3J1RVMYrscus3TzjTN/3l6/8NGnT50T8CunUr3nOG0Wa2VbfNK6mrKd6VNvr Y12lpKlvVkjVTqmy7b/Gn4lN10Q1Rrs1t9Xi+Xwso8wxxWwXOBFRG1LNvQqo09bHp47eCr6kVpZw 13Keaq93k5PK+BiumcZZj80bp7Ud09e6e6YSeAC684AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAADq1trtlybyXG3U1U3w2mha9P8qGuXDSPSu67rcNN8Zmcv791qg5/8ZG7/wCU20Gs001bYS0X 7tr1KpjwnJGVVw0aFViqs2nFtbv/AME+WL/QehjJOE3QndXUmJVNG5f31Pdqtv8AnlVCYARzh7M7 aY4QtU8q4+j1b1f90+aGl4UtMk/2vcsqp09TYr3KiJ/HufK8KuDJ+5ZdnMX9xfX/AP3aTODHRbPZ hJ6Z5Q/Gq4oW9yvin73UPUNqfEl+Xb/QP1OFbCl/dc1zyX+7vrv/ALNJoA6LZ7J6ax/4soZThT05 X91veXy/3d8k6/xHI3hN0Td/t6w3Ku+Pyi8VS7/4siExAdGs9mODE8s8oT/5quMx8kWU3C9oLSbd 1p1Ru2/4WpqJP9KRTO2/RLR+2bLSaZY0jm+DpLbFK5PxvRVN2BtFm3Tspjghr5Rxlz17tU+NU+bH W/G8dtO3muw26j5fDyelZHt/iohkQCSIiNirVVVVOdU5gAMtQAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAADFZTk1nw3HbhlN/qe4t9sgdPO/bddk8ERPW5V2RE9aqiGJmIjOW1FFVyqKKYzmWi65am 12FWilxrEmMqcvyVzqW1wqv7g3b06p/xNYnXr4rt4oiml4Ph1BhFhitFJI+ed7lnrKuRd5Kqod1f K9V6qqr8fgmyGGwWku+U3iv1ezKBGXi/tRtDTOT/AHOtyL9ihT4lVNnOX1qvqVVN5OXVXN6rTnZ1 fvve1s4enAWej07dtU753eFOyO/OQABkAAAAAAABW7s6Pgbafflb9K1ZZErd2dHwNtPvyt+lassi bXPXnxQYX2FHhHyAAapwAAAAAAAAAAAAABGOuuutj0VsdG1ttqcgy3IJ0oMaxqgTnrLtWO2RrGNR FVGIqpzP22RF9aqiLqmjuumeR5m/QriaxWlw3U5sHl9AynkR1vvlG7dyPpJeZzXPj6sexHKu7HKn g5G7RRVNOl1IKsTapuRamdcp5ABqnAAAAAAAAAAAAAAAAAVS4f772gXEVpFYdZMRvOhVvtOQeVeT 01yo7q2oZ3FVLTu50jc9vV0LlTZy9FTwXoSH7WHaTfKzh3+i3n6ibo9bm+lcP38E1AhX2sO0m+Vn Dv8ARbz9Q9rDtJvlZw7/AEW8/UOj1npXD9/BNQIV9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Q6PWe lcP38E1AhX2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1Do9Z6Vw/fwTUCFfaw7Sb5WcO/0W8/UPaw7S b5WcO/0W8/UOj1npXD9/BNQIV9rDtJvlZw7/AEW8/UPaw7Sb5WcO/wBFvP1Do9Z6Vw/fwTUCFfaw 7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UOj1npXD9/BNQIV9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Q6 PWelcP38E1AhX2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1Do9Z6Vw/fwTUCFfaw7Sb5WcO/wBFvP1D 2sO0m+VnDv8ARbz9Q6PWelcP38E1AhX2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1Do9Z6Vw/fwTUCF faw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UOj1npXD9/BNQIV9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz 9Q6PWelcP38E1AhX2sO0m+VnDv8ARbz9Q9rDtJvlZw7/AEW8/UOj1npXD9/BNQIV9rDtJvlZw7/R bz9Q9rDtJvlZw7/Rbz9Q6PWelcP38E1GlZ1ZL1b7lQam4NEnsmx/0kh3VG3Gk/3ymft47purfiXw 6qippXtYdpN8rOHf6LefqHtYdpN8rOHf6LefqMThq5b2+WMPROeuY64y1THXE+K1mA5vZdRcTt+X WGXmpq6PmdG5U54JE6Pienqc1d0X+NOiobCefOJZrxKcKHEngGG66XzTJ2I6y1t1dVx4xTVu1HUU dK1UmRahWpFzyzwcypzIrUfuibNU9Bi7bmqYyr2vP4qi3Tcmuxnzczqz905eMZ/XrAAbqwAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAV01VvPttakx6eUj1fi+Hysq725N+Ssr+vdU2/g5rPfOT490XqiKSbrZqLLpvg89xtk aVF9uMjbdZabZHLLWS9Geivijerl/Bt6yN9P8RZheM09pfMtRWyOdU19Sqqrqiqf1keqr1Xr0T5k Qo4qvSnmo9/k9JyJhuapnG17dlPj11e7ZHfPc2MAEDqAAAAAAAAAAArd2dHwNtPvyt+lassiVu7O j4G2n35W/StWWRNrnrz4oML7Cjwj5AANU4AAAAAAAAAABGOuuutj0VsdG1ttqcgy3IJ0oMaxqgTn rLtWO2RrGNRFVGIqpzP22RF9aqiK1111seitjo2tttTkGW5BOlBjWNUCc9Zdqx2yNYxqIqoxFVOZ +2yIvrVURc1wv8L98w6+VOvuvtdTZBrBkEHdudH6dHjVG7fa30KdUTZFVJJU6uVXIiqiudJNatae udjnY7HRho0KPW+Rwv8AC/fMOvlTr7r7XU2QawZBB3bnR+nR41Ru32t9CnVE2RVSSVOrlVyIqorn SSHxE8O2E8R2EtxnJnz227Wyby7HshofRrrLXN2Vk8L0VF23RvMzdEciJ4KjXNlQF6IiIyh5mapq nSmdakmkGr+bY9m0vDfxIU8Ft1ItsKyWy5xpy0OWULd0bWUrlRE7zZF7yLoqKjuibOayeDv8RPDt hPEdhLcZyZ89tu1sm8ux7IaH0a6y1zdlZPC9FRdt0bzM3RHIieCo1za8aQav5tj2bS8N/EhTwW3U i2wrJbLnGnLQ5ZQt3RtZSuVETvNkXvIuioqO6Js5rKd6zo/ap2PQcn8oc5lauzr6p3/7TwACu64A AAAAAAAAAAAAjjsuPgJ6Zflr9MVpks+44bZh2ruW6N47w+6t55dsK8g87VOK2WKup4fLKVtRBuvf I5u7XOT0mpusb9t0TcxvZcfAT0y/LX6YrRw8fDs4uf8AAH9DynVeHPd1ZD95FxJfmez9sPd1ZD95 FxJfmez9sTzqFrHpPpL5B7aGpONYn5173yHzzc4aTynuuTvO77xyc3L3ke+3hzt38UNP92Nwn/fI 6bfnNSftAI293VkP3kXEl+Z7P2w93VkP3kXEl+Z7P2xJPuxuE/75HTb85qT9oPdjcJ/3yOm35zUn 7QCNvd1ZD95FxJfmez9sPd1ZD95FxJfmez9sST7sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0Ajb3d WQ/eRcSX5ns/bD3dWQ/eRcSX5ns/bEk+7G4T/vkdNvzmpP2g92Nwn/fI6bfnNSftAI293VkP3kXE l+Z7P2w93VkP3kXEl+Z7P2xJPuxuE/75HTb85qT9oPdjcJ/3yOm35zUn7QCNvd1ZD95FxJfmez9s Pd1ZD95FxJfmez9sST7sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0Ajb3dWQ/eRcSX5ns/bD3dWQ/e RcSX5ns/bEk+7G4T/vkdNvzmpP2g92Nwn/fI6bfnNSftAI293VkP3kXEl+Z7P2w93VkP3kXEl+Z7 P2xJPuxuE/75HTb85qT9oPdjcJ/3yOm35zUn7QCNvd1ZD95FxJfmez9sPd1ZD95FxJfmez9sST7s bhP++R02/Oak/aD3Y3Cf98jpt+c1J+0Ajb3dWQ/eRcSX5ns/bD3dWQ/eRcSX5ns/bEk+7G4T/vkd NvzmpP2g92Nwn/fI6bfnNSftAI293VkP3kXEl+Z7P2w93VkP3kXEl+Z7P2xJPuxuE/75HTb85qT9 oPdjcJ/3yOm35zUn7QCNvd1ZD95FxJfmez9sPd1ZD95FxJfmez9sST7sbhP++R02/Oak/aD3Y3Cf 98jpt+c1J+0Ajb3dWQ/eRcSX5ns/bD3dWQ/eRcSX5ns/bEk+7G4T/vkdNvzmpP2g92Nwn/fI6bfn NSftAI293VkP3kXEl+Z7P2w93VkP3kXEl+Z7P2xJPuxuE/75HTb85qT9oPdjcJ/3yOm35zUn7QCN vd1ZD95FxJfmez9sPd1ZD95FxJfmez9sST7sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0ApfxIaoZz rrq/pFmzODLX2Kw4HFkkV3pqnElbUT+caKKCFYOWRzd2Pj5lVyt26Km69CQca4/sm0X0pbVa38LW ulFQ47yU0l9qcbZBT+TK9sdO6eSaZqNkVXsj8V3Xl6qqlj/djcJ/3yOm35zUn7Qrb2jHErw95/wa 6hYjg2tuEX+91/mnyW3W2+U1RUT8l1pJH8kbHq53Kxj3LsnRGqvqNNCNPT69ieMTXzHR/u55+/LL /wCr5ghmk4zuE2rpYatnEZp3G2eNsiMlyKlY9qKm+zmq/dqpv1ReqKSbiGZYnn+O0mXYNkltv9kr +88luNtqWVFPPyPdG/kkYqtdyvY9q7L0Vqp6jdBMZapZkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI516zyrwTT6pfZXKt +vUrLRZ2NX0lqpvRR6f3DeZ2/wAaJ8ZrXXFumap6k2HsV4q7TZt7apyRjcLt7ausNdkiO73HsIdJ abSniyeuX/bM6epdujEVOiojVQ3EwmFYtSYZi9vxuj2c2jhRskiJ+6yr1e9fwuVVM2cqM5+1Vtl7 WuKKcrdr1aYyjw3++dc98gANmgAAAAAAAAAAK3dnR8DbT78rfpWrLIlbuzo+Btp9+Vv0rVlkTa56 8+KDC+wo8I+QADVOAAAAdG+JenWWuTHJKSO6+TSeQurGOfAk/Kvd941qo5Wc23MiKi7b7Kigd4FT tIO0S0oy+9z4Bq7SSaaZlb6qS31lNdJUdQLUxvVj2NqtkSNUc1d0lRiJ4I5xa6CeCqgjqaaZk0Mz EkjkjcjmvaqboqKnRUVPWZqpmnajtXqL0Z0Tm+yMddddbHorY6NrbbU5BluQTpQY1jVAnPWXasds jWMaiKqMRVTmftsiL61VEVrrrrY9FbHRtbbanIMtyCdKDGsaoE56y7VjtkaxjURVRiKqcz9tkRfW qoi5rhf4X75h18qdfdfa6myDWDIIO7c6P06PGqN2+1voU6omyKqSSp1cquRFVFc6SW1a09c7FLHY 6MNGhR63yOF/hfvmHXyp1919rqbINYMgg7tzo/To8ao3b7W+hTqibIqpJKnVyq5EVUVzpLLgpjiO unGzrJqbqxjWkdPohQ2PTjLanHIlyOiu3ldQ1iryPc6nnViryom6o1vXwaXojLVDzNVU1TpVbVzg Vhwnie1Tw3VuxaF8VunNlxm8Zf3jMXyfG66Spsd4qGIiuptpkSWnl6pytfvzK5E2TdquyOr/ABCa re3lS8NPDvhuNXPMG2D2T3i75TWTQ2u10KzdyxqxwJ3s0jnKnRqoiI5vju5WZYWNIr4ieHbCeI7C W4zkz57bdrZN5dj2Q0Po11lrm7KyeF6Ki7bo3mZuiORE8FRrmxtbdWOMbTjUXFMc1w0oxHK8Xy2v S1rftOILjI+yzOTdklbT1HO5IOi80qORrERVVd0RrrOgUk0g1fzbHs2l4b+JCngtupFthWS2XONO WhyyhbujaylcqInebIveRdFRUd0TZzWTwd/iJ4dsJ4jsJbjOTPntt2tk3l2PZDQ+jXWWubsrJ4Xo qLtujeZm6I5ETwVGubXjSDV/NsezaXhv4kKeC26kW2FZLZc405aHLKFu6NrKVyoid5si95F0VFR3 RNnNZSvWdH7VOx6Hk/lDnMrV2dfVO/8A2ngAFd1wAAAAAAOjfEvTrLXJjklJHdfJpPIXVjHPgSfl Xu+8a1UcrObbmRFRdt9lRQO8Cp2kHaJaUZfe58A1dpJNNMyt9VJb6ymukqOoFqY3qx7G1WyJGqOa u6SoxE8Ec4tdBPBVQR1NNMyaGZiSRyRuRzXtVN0VFToqKnrM1UzTtR2r1F6M6JzR32XHwE9Mvy1+ mK0cPHw7OLn/AAB/Q8o7Lj4CemX5a/TFaOHj4dnFz/gD+h5TqPFsZxVYzjeY8aXCfjmXY/bb5aav 2d+UUFypI6mnm5LTA9vPHIitds5rXJunRWovihOnuZ+HD737Tb81KD9kQ9xD/Ds4Rv8AD79DxFqg I29zPw4fe/abfmpQfsh7mfhw+9+02/NSg/ZEkgCNvcz8OH3v2m35qUH7Ie5n4cPvftNvzUoP2RJI Ajb3M/Dh979pt+alB+yHuZ+HD737Tb81KD9kSSAI29zPw4fe/abfmpQfsh7mfhw+9+02/NSg/ZEk gCNvcz8OH3v2m35qUH7Ie5n4cPvftNvzUoP2RJIAjb3M/Dh979pt+alB+yHuZ+HD737Tb81KD9kS SAI29zPw4fe/abfmpQfsh7mfhw+9+02/NSg/ZEkgCNvcz8OH3v2m35qUH7Ie5n4cPvftNvzUoP2R JIAjb3M/Dh979pt+alB+yHuZ+HD737Tb81KD9kSSAI29zPw4fe/abfmpQfsh7mfhw+9+02/NSg/Z EkgCNvcz8OH3v2m35qUH7Ie5n4cPvftNvzUoP2RJIAjb3M/Dh979pt+alB+yHuZ+HD737Tb81KD9 kSSAI29zPw4fe/abfmpQfsh7mfhw+9+02/NSg/ZEkgCNvcz8OH3v2m35qUH7Ie5n4cPvftNvzUoP 2RJIAjb3M/Dh979pt+alB+yHuZ+HD737Tb81KD9kSSAI29zPw4fe/abfmpQfsiHuy4+Anpl+Wv0x WlqiqvZcfAT0y/LX6YrQLVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABXLLbiuomu86td3lm08p/JYk8WyXOdN5XfPyMRG+H Ryb+smzUHL6TAcJvWY1iNdHaqN87WKvSSTbaNn/WerW/jIN0nsFXYcLpZLq5z7rdnvutykd759TO vO7m+dEVrV/uSli6s5i375+nx+T0fIVnQprxU/ljxnbPujV/ybgACu6oAAAAAAAAAAAAAoBwXWnj GqeGjDp9Kst0tosWd5w8ggvVBWyVrP8AZCoSTvHRryLvL3ipt+9Vu/Xcm3zF2hHy70S/ku4/WfvZ 0fA20+/K36VqyyJLXV9qdSlhrMTZonSnZHX3K2+Yu0I+XeiX8l3H6x5i7Qj5d6JfyXcfrLJA00+6 E3MR2p4q2+Yu0I+XeiX8l3H6x5i7Qj5d6JfyXcfrLJAafdBzEdqeKtvmLtCPl3ol/Jdx+seYu0I+ XeiX8l3H6yyRjsjbf32C4x4q+ijvL6aRtA+tV3cMnVqox0nKiqrUdsqoiddtum+40+6CbER96eLw z4xPZCnEJlDMxumK3HI43wsvE+NQTRUK1bY2o5ESVVXvERGo9U2TnR3r3VZ24EbPx1sqKOp0kmko cDe9HyrlaPWyyMVd1WCNfsrlXr6VPtuqbOchcPRbs9tGdNrk7Mc8SXUbMamd1ZU3O9xItOlQ9yuf JHS7qzdXLzc0iyOReqKhaNrWsajGNRrWpsiImyInxE9d+NHRiM3OscnV85ztyrLujb75Vk4O5LRZ OJ/MqLibYq69XBXrjFwqXItqqLDsu0dlRyfY1T0+8au8qpv1375C/wCVX1w0PxbXLForNeZ6m13i 1zpXWC/0LuSus9c3ZWTwvRUXxRvM3dEciJ4KjXN++GXiaympyl3DZxJsprXqla4FfbbkxOShy6hb vtV0q7Ine7IqyRJsqKjlRE2c1k1m5FcZdbn4/B12K5r20z1+a0pUDgV/st8U/wD0q1n+Zxb8qRb+ DzX7CNQdRMz0e4uKbEaLUTIqjIqy3S6e01yWGWRV2ak01Vu7lRdt0a1F232JnPdLtGJYLiugGIWl zXZXctXrJVWljP3ZkUCSd/MnrRjFkh5l8E3aq+BvuuPDHYtX9SqTU7TfWG76car43bm2113skkVQ r6F73PZDW0b12lj5uZzUcrd/XzcreX70j4Ro8R1KTXDWHVO+arajQUz6O33e6U0VHSWqB6Kj20VF DvHArkc5HORV6Ku23M7mar8JlVlGqkmu+jer970s1ArKKO3XSvoaGC4UV1p40RI0qqOfZkj2ta1q O5k2RqdN0RUCMsj1g4vOEq64zX8Qd7wvU/Tm+3ylsFTf7VQOtV5t01Q5WxzS07fsD4+iqrWIq9Nt 29N7olYYOD3PM6ynHr/xM8SF31Ot2KXGK8WvH6bHqWx2xa6LfupqiOFz3VHKqqqI5yJ1VOrVc1bP ACpnaM1mjj9I6GyZrRXGv1ArKxPa5prC7lvjbzundyUzkRXMjR3J3qqnKrdk9/3e0pcSnEpivDri tNVVVDPf8tv8vkOL4vQ+lWXesXZGsa1EVWxoqt55NtmoqJ1crWrBuiuiuVQ5VWa/6/3KC/6r3+Lu 1WP0qPHKNd+W30Ld1RqIiqj5E6uVXdV3c6SO5ci3GtbwmErxVeUaojbLTMZtfaPw49bYrpkeiDqt tLEk619PcX1PPypv3rodolk/hLGnLvvtumymS839oj8odAvol3+ssiChp90PTRh8vvTxVu839oj8 odAvol3+seb+0R+UOgX0S7/WWRA0+6DmP6p4q3eb+0R+UOgX0S7/AFjzf2iPyh0C+iXf6yyIGn3Q cx/VPFW7zf2iPyh0C+iXf6x5v7RH5Q6BfRLv9ZZE6N8S9LZa5uOLSJdVppEolrFckCT8q8iycqK7 kR22+yb7DT7oOY/qni8MuMf2T+6GyhucVWI1OSsdA28SYrHOygWqSJvNsk683eInKj9unOjvXzE6 cCFn46mVNHU6STS0OBPej5VytHrZZWKu7lgjX7K5V6+lT7bqmznIXG0a7PvRzTy7S5vqD3upGaVl S+uq7pe4mrT+Uvcr3yR0vVm6uXm5pFkci9UVvgWga1rGoxjUa1qbIiJsiJ8RPXfjR0YjNzrHJ1fO Tdrqy7o2++Uc9lx8BPTL8tfpitHDx8Ozi5/wB/Q8o7Lj4CemX5a/TFaOHj4dnFz/AIA/oeUuPPnE P8OzhG/w+/Q8RaoqrxD/AA7OEb/D79DxFqgAAAAAAAYi0ZfieQXW7WKw5RablcrBKyC7UdJWxTT2 +R7eZjJ42uV0TnNRVRHoiqiboBlwAAAAAAAAYnJ8sxXCbRLkGZZLarDa4FRstdc62Olp2KvgjpJF Rqb/ADqfuMZZi2bWiLIcNyW1X61zqqRV1srI6qnkVPFGyRqrV2+ZQMqAAAAAAAAAAAAAAAAAAAAA FG+yOzuS5cMNp0/uC8s9nfW1tAipt3lHNX1HNt8fLMkm6/26J6i8h5pcCdw9gPDzofqmxeSmhqbt Y7yvq8iqLtVo17vmjk2d+FUIL9ybcU1dWevw/et0uTMNGMquWcvtTTOj4xMTHHLL3vS0AE7mgAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAgriSrvZDd8N0ohXmju9et1ujU/wD4Ol9JGO+Z71RE+dhkjTqOt9mWteb5kq95S2ZY8Yt7 vFESH06hEX/5q79PjNxOVVVp11V/vU9vatdGw9ux1xGc+NWv4RlHuAAGQAAAAAAAAAAAABW7s6Pg bafflb9K1ZZErd2dHwNtPvyt+lassibXPXnxQYX2FHhHyAAapwAAAAAAAAjrXDQ/FtcsWis15nqb XeLXOldYL/Qu5K6z1zdlZPC9FRfFG8zd0RyIngqNc2RQImYnOGtdFNdM01RnEo94ZeJrKanKXcNn EmymteqVrgV9tuTE5KHLqFu+1XSrsid7sirJEmyoqOVETZzWWlKr64aH4trli0VmvM9Ta7xa50rr Bf6F3JXWeubsrJ4XoqL4o3mbuiORE8FRrm/fDLxNZTU5S7hs4k2U1r1StcCvttyYnJQ5dQt32q6V dkTvdkVZIk2VFRyoibOay/auxcjKdrzGNwVWFq0qddMrSgAmUAh7iU4lMV4dcVpqqqoZ7/lt/l8h xfF6H0qy71i7I1jWoiq2NFVvPJts1FROrla1XEpxKYrw64rTVVVQz3/Lb/L5Di+L0PpVl3rF2RrG tRFVsaKreeTbZqKidXK1qwbororlUOVVmv8Ar/coL/qvf4u7VY/So8co135bfQt3VGoiKqPkTq5V d1XdzpI7lyLcLeEwleKryjZ1yaK6K5VDlVZr/r/coL/qvf4u7VY/So8co135bfQt3VGoiKqPkTq5 Vd1XdzpJwAOfVVNU5y9TatUWaIoojUAAwkAAAAAAAAAABHHZcfAT0y/LX6YrRw8fDs4uf8Af0PKO y4+Anpl+Wv0xWjh4+HZxc/4A/oeU6rw5xD/Ds4Rv8Pv0PEWqKq8Q/wAOzhG/w+/Q8RaoAAAAAAFF dLNYMK0L1m4wdRc7rnw0FFlFjjgp4G89TXVT6KRIqWnj8ZJpHdGtT51VUaiql6jzJZwvVGv/ABI8 TuUYxmN1sWeYLlFnuWGTMqeWhp7q2mSVks8Wyo9XdykXMu/K2Ry8rvACzF+4ltWtG+HGfWjXnAbT DlN9uUNHi+FWbvY6hklU/lo6KqqJXva+o5d3yvYxjWo1yIxVTYw2c6+8WPDxZrXqjxC4jphX6fy1 1JR3/wBic1ey4WBlTI2Jk73VCujqWMe9rXcqMVVVNui7kUa+5XfONPg9pbnRYLXT57pNmlBX51gt K+SOvbUUaSw1cEKMXvNnxzSSRqxebZqo1VexUMPPaOzNzqO1Ypp9ppnmpF/v1XTUr8WoL3kq1NK1 z295JVpU1TIYGw++csj0TdvTp6SBa/Btd8uqeKzPOHTP7fZqaCkslFlGFVlFDLHJcbY9VjqUmV8j mukjmVGorEaio1y8ppmV8YOT43nuvNbR4vbrpp7odjlM6okhZK2uuN/mZ3q07Z+dY2Qxs9CT7Erm u9LdU9FcVx1Ucui8mmPF5i9qnqH6RXVLfe6aB32Spx6ualPMxVd79WPWPk5uiLI5yqm253eHywXr R3gxumouXadV2cZVnLK3PMpsNHAySouc1yckkkCRSdHKymdG10a7qvduaiKqo0D7xrVXjmrsPx3V qPAtIs0xu+Mo61+P4vX1kV2jo6hW+lFVVEnks0kbX7uRUY1eVyI7wUtcnVNzyw1CvvCrY7GuTcAW a5zjWsVTWUsltwzG47p3FbUOmYksFdbp2LAyNrFfzJuxiKxNuZOi+o9ufXSW+lfc4o4qx0LFqGRL uxsvKnMjV9aIu+wFKOPHVDS/T/X/AIf7tqQlNk9ps1Ze31+I07Iq2tlnqqRsdvq0onORH8szHsY5 +yI6Tdq7opIfCphN1wXMtQtQ81xy0aaJq9d6SrxzAkrIEmpY6OlVkkzo417vymdF72WOLm5OVvMq rvtX6O86A4NkvEdpbxsUtXYb3qTlddVW/IKy01M6XPHnNjW2toqmOKREdTKxFbH+9ejU9JWqjdf0 C19ln1xwjIuLy/3i0W/AbDV2fTG73bGq+l9lktXUOp3XR/NGvJM6kjgj7t3VyyOfv1XcPT1V2RVX fp16JuU10u4iuMDiHwKr1r0UxbR+LFlq62K3Y5eauvfe52U0rmd3NNE5IKeaTk3axzFREexVXlXc uNUySw00ssFO6eVjHOZE1yNWRyJ0air0Tdem69DzUznKOArJWXvOXuznQbWx/lK1NssMdyt17S4t c7latPA1aaoWR+zuZqelzrzPRd1QLSat8Tmd4Rjel+N2DStjNW9WZ/I7ZjN3uDUprXJFE2Ssmqp4 ebnhgRyKvd+k5F3TZd0MbS68cQOkmrGEaf8AEtj+BVVk1HrH2iy5FhzqyFlHdEZzR0tVBVOe5Ul6 tY9jvFOrU67Vu1hwPUXM9NuF3X7iiwbIr3S4rDcKLUejt6VVPcaWkrWNZTV8jKNWTxqxscckyM2X mXlVuyq03TTTGOz6zfWTCbboVpzl+fXa23Fl8S9Ud7v81txualVJYKiqfW1LYt1kajUjRHuVd0Vq 77KEtV+vfEHqxqxnGnvDHjun8Np02q47Ver9mctY+Otubmcz6WlipFRzUi96+R6r1Xo1U23wOp/G DrHprws3TWLK9H48TzLGcpp8du1rutNUT0NXF5SyKSroXo6J00MjHq6N+6pzIqemiI52p6Zar4bw Xa2654nxA1VdjNnzvMZ84xi/yW2pqKK5RViby07JIWP2liciNVi7KvXb1b4Ti91hyDXXgeyHOrrp pcMQs02cWumx5tyld5VdbYyvhSKvfA6Ni06S7rtGvMuyb8yoqKoTbmvEVrHoVo3edWNcsMxmW5Xa voqDDMTx6eo8rfU1SqkVHWVEycizIuyvfE1GokcnKjum+BznX3ix4eLNa9UeIXEdMK/T+WupKO/+ xOavZcLAypkbEyd7qhXR1LGPe1ruVGKqqm3RdzvdpFpPkWqnD9Qy41jNbkk2GZTbcpqrLQvkZVXG jgSWOohhWNUfz93O5ycio70PR9LZCAp7R2ZudR2rFNPtNM81Iv8AfqumpX4tQXvJVqaVrnt7ySrS pqmQwNh985ZHom7enT0kCQM5uPEPV9pXZrFjF9wBkNLpzUV9sbX2+tkjZaJrlGyobJ3c7VdVufAn LI3aNGI1FYq7qbxRa/cSesmquo+FcP8AbdLLRbNNLv5hrHZlJXT11wqWt3dKyGlczuYFXdrXu5+b bdPWialq7muH6E9ofhGc6hVc9jxS6aUS4tbri+lnnhfcG3N0iU3NG1y8/dq1ev8ACbv4mD1vyPgV y3VDJfdGY1f9JNSLFXPoqPIIUrrfXXWlY1EhrqaqokWOoa5uyNR/M9qNRFam2yBb3RnKdSstwiO4 auaeMw3KKeqno6yhgrWVVNN3b+VtTTyNXdYZE2c1Hojk6oqL0Vd6K2cA9+1RyDRq61Go90yO726m ym5U2G3fJIHQ3W546xWeSVNSj0R6vcqyek9EVURPVsq2TAAAAAAB54cDmOQ5dwFYljc221fTXmNi r4Nk86Vasd+JyNX8R6HlC+zo+Btp9+Vv0rVlbFRnRlLr8i1TRidKnbEfWFstA8xmzfSmxXSucvnG lhW3XBrvfNqYF7tyu+d3Kj/+sSEQJoTW+xnVPONP3ryU11SLJ7ezwTd/2KpVE/u0Z4fET2bYavTt xntjVwRcr2Iw+Mrin1Z+1HhVry92eXuAATuaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABiMuyCnxPFbxlFVssVpoZ6xyL++7tiu2/Ht t+My5D3FTcZo9LPYzSSKypyq60VliVvj9klR7tv+rG5F/CR3q+btzVuhbwGHjFYq3ZnZVMRPh1/B o+jVqqLZp3a5q5XOrbo190qnu98+Sdyybr8/K5qfiN2OOngipaeKlp2IyKFjY2NTwRqJsifxHIcy mNGIh7G7c525VXPXIADZGAAAAAAAAAAAAAK3dnR8DbT78rfpWrLIlbuzo+Btp9+Vv0rVlkTa568+ KDC+wo8I+QADVOAAAAAAAAAAAR1rhofi2uWLRWa8z1NrvFrnSusF/oXcldZ65uysnheiovijeZu6 I5ETwVGubIoETMTnDWuimumaaoziUe8MvE1lNTlLuGziTZTWvVK1wK+23JiclDl1C3farpV2RO92 RVkiTZUVHKiJs5rJE4lOJTFeHXFaaqqqGe/5bf5fIcXxeh9Ksu9YuyNY1qIqtjRVbzybbNRUTq5W tWONcND8W1yxaKzXmeptd4tc6V1gv9C7krrPXN2Vk8L0VF8UbzN3RHIieCo1zdT0S0AybHMnqtY9 es1bn+qldB5Cl3WPlprZQt3a2Cjj5WpHzJ6Ujka1VV7k9blfcjERo5ztcGvkmvntGmfs79z90V0V yqHKqzX/AF/uUF/1Xv8AF3arH6VHjlGu/Lb6Fu6o1ERVR8idXKruq7udJOABUqqmqc5dy1aos0RR RGoABhIAAAAAAAAAAAAAI47Lj4CemX5a/TFaOHj4dnFz/gD+h5SG9CsD4/uHvSuyaQYNkuhVRZLB 5T5LJcqa6y1Du/qZah/O5iMavpzPRNmp028fFdw4E6vUuu4o+KGq1gnx2bLn+wnzi/Ho5mW9drdU pF3TZlWRPsSR83N++5tumx0qa6apyiXjruGu2Y0rlOUN04h/h2cI3+H36HiLVFVeIf4dnCN/h9+h 4i1RugAAAAAAAAAABXHXfQ3WviFzKDAstyPELXoZDcKK5V9DQpVSXy+tgSOTyKp52pBFAtQ1VVY1 VytazwXcsa1rWNRjGo1rU2RETZET4j9AAAAAAAAAAAAAAAAAAAAAAAAAAAAChfZ0fA20+/K36Vqy +hQvs6Pgbafflb9K1ZXxPqR4uryR7efD6wl3Iav2Kar6e5ui8kMtwfj9avqdHVNVI+b4ka9ObfwL LlZdabZNctNrxJSKraq3xtuNO9vix8Dkk3T5+Vrv4ywuK3yHJ8YtGSU+3d3WhgrWongiSRo/b/KQ 4SrKqqn3/T6L/LtvStWr27Omfdrj5zwZUAF55sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACBteKjzvqvpziyLvFReXXupb/AHDEZCv+ OrieSu2RzeeOJW/VCrzNx/HKO2onqa6aRZ/41Rf4iri5/hxG+Y8/o7XINGeKm52aap4xo/8As2YA FR3gAAAAAAAAAAAAAAAFbuzo+Btp9+Vv0rVlkSt3Z0fA20+/K36VqyyJtc9efFBhfYUeEfIABqnA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKsYtqzlXDlxW69ZPceHzVPMrRnfsW8112L2LyqBfIr a5k3M972IvpzI1OVV6sei7bdbTg3t1zbnOFbFYaMVRFFU5a81XKriDk1347OGTvNG9RMD8x+zTb2 XWplF5b31n/3jlkfz8nden4bd4zx3PQYoXrnmWJ6f8ZXDDl2c5JbbBZKD2a+VXG5VLKeng57VFGz nkeqNbzPexqbr1VyJ6yyfuxuE/75HTb85qT9oX7dWnTFTzGKsxh7024nPLyTCCHvdjcJ/wB8jpt+ c1J+0HuxuE/75HTb85qT9obq6YQQ97sbhP8AvkdNvzmpP2g92Nwn/fI6bfnNSftAJhBD3uxuE/75 HTb85qT9oPdjcJ/3yOm35zUn7QCYQQ97sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0AmEEPe7G4T/v kdNvzmpP2g92Nwn/AHyOm35zUn7QCYQQ97sbhP8AvkdNvzmpP2g92Nwn/fI6bfnNSftAJhBD3uxu E/75HTb85qT9oPdjcJ/3yOm35zUn7QCYQQ97sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0AmEEPe7G 4T/vkdNvzmpP2g92Nwn/AHyOm35zUn7QCYQQ97sbhP8AvkdNvzmpP2g92Nwn/fI6bfnNSftAJhBD 3uxuE/75HTb85qT9oPdjcJ/3yOm35zUn7QCYQQ97sbhP++R02/Oak/aD3Y3Cf98jpt+c1J+0AmEE Pe7G4T/vkdNvzmpP2g92Nwn/AHyOm35zUn7QCYQQ97sbhP8AvkdNvzmpP2g92Nwn/fI6bfnNSftA JhBD3uxuE/75HTb85qT9oPdjcJ/3yOm35zUn7QCYShfZ0fA20+/K36VqyyfuxuE/75HTb85qT9oV s7Oj4G2n35W/StWV8T6keLq8ke3nw+sLFV9HDcaGot9Qm8VTE+F6fG1yKi/5FMjwt3Sav0Xs9BVu 3qrLLU2qf5lhmcjU/wARWHVOjw1TeQ3fUnFd9ko8j85Nb/BbVxI5Nvm+xqVbM5Xo784+v0drlGjn MBcjszTV86f/AGhOIAOk8gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAABWnFpfOWqOqN8Vd1kvsdv5v8Ak0KM2/FuWWKv6RP8rp8tuy9V ueW3SrVfj3kRP/2Sli510x4/v4vRcg05UXq+6I4zn9G+gArusAAAAAAAAAAAAABRHKOOrO+F3Wy8 aOa/45LkmPwytqrNkNvY2KvfbpVVYXyxLyxzq3ZY3Ob3a80T19IvcUu7T7QP2xtIIdVrFRd5fcC5 5qnkb6U1reqd+i/H3TkbKm/RGpL8ZJa0Zqyq61TGc5Tb07U641+MdauGiPH7ctJ+HvBtBdJdP5b5 naS1dJ5RXr/UrJ6q4TyQsiiY7nncqTRp1ViI5dvSPUDALZlFnwuz27N7956yGOlY66VyRtjZNVO9 KXka1ERsaOVWsTbo1Gou69Ty97LTQP2cam1utF/ouez4T9ht3O3ds10kb0VPUvdRqr19aOkiVPA9 Yja/oxVlCDk3nKrWncnVsiO6AAELpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAZVp9gWd+ S+zfCLBkPkPP5L51tsNX3HPy8/J3rXcvNyN32235U38EMB7n3QX7iOA/m1RfszfgZzmGs0UzOcw0 H3Pugv3EcB/Nqi/Zj3Pugv3EcB/Nqi/Zm/AaU72Obo3Q0H3Pugv3EcB/Nqi/Zj3Pugv3EcB/Nqi/ Zm/AaU7zm6N0NB9z7oL9xHAfzaov2Y9z7oL9xHAfzaov2ZvwGlO85ujdDQfc+6C/cRwH82qL9mPc +6C/cRwH82qL9mb8BpTvObo3Q0H3Pugv3EcB/Nqi/Zj3Pugv3EcB/Nqi/Zm/AaU7zm6N0NB9z7oL 9xHAfzaov2Y9z7oL9xHAfzaov2ZvwGlO85ujdDQfc+6C/cRwH82qL9mPc+6C/cRwH82qL9mb8BpT vObo3Q0H3Pugv3EcB/Nqi/Zj3Pugv3EcB/Nqi/Zm/AaU7zm6N0NB9z7oL9xHAfzaov2Y9z7oL9xH Afzaov2ZvwGlO85ujdDQfc+6C/cRwH82qL9mPc+6C/cRwH82qL9mb8BpTvObo3Q0H3Pugv3EcB/N qi/Zj3Pugv3EcB/Nqi/Zm/AaU7zm6N0NB9z7oL9xHAfzaov2Y9z7oL9xHAfzaov2ZvwGlO85ujdD Qfc+6C/cRwH82qL9mPc+6C/cRwH82qL9mb8BpTvObo3Q0H3Pugv3EcB/Nqi/Zj3Pugv3EcB/Nqi/ Zm/AaU7zm6N0NB9z7oL9xHAfzaov2Y9z7oL9xHAfzaov2ZvwGlO85ujdDQfc+6C/cRwH82qL9mbd YcfsGK2mCw4xY7fZ7ZS83cUVBTMp4IuZyudyxsRGt3c5zl2TqqqvipkAYmZlmKKadcQGE0hl838Q GZ25F2S72KguCp8fcvWHf/6jNmt4o/yLiZtkqdPOOJVNIvz8lQ2QUzlXTPf/AKZu06eGvU76Z+Ex P0WHAB1XiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAKs6DO77TqCsXqtXXV0yr8e9Q9P/sWmKrcPS76QWFy+Llq1X6VKUcX69PhP0el 5D/lr099HyrSMACB0wAAAAAAAAAAAAAIq4hNaMX0oxaO119jkynIsrc602HE6Vne1N7qJE5O6Rmy /Y/STncqKiIu3VVRF59dddbHorY6NrbbU5BluQTpQY1jVAnPWXasdsjWMaiKqMRVTmftsiL61VEX NcL/AAv3zDr5U6+6+11NkGsGQQd250fp0eNUbt9rfQp1RNkVUklTq5VciKqK50k1m1Nc5zsc3H46 MPGhRrqn4IF4PLrNoRBT8I+rWDw4JnNC2a7W9jahJqTIKed7pFlp6jdUlkj37tzeZVRIunvXI21x 3+Inh2wniOwluM5M+e23a2TeXY9kND6NdZa5uysnheiou26N5mbojkRPBUa5teNINX82x7NpeG/i Qp4LbqRbYVktlzjTlocsoW7o2spXKiJ3myL3kXRUVHdE2c1m9+1MfahDydjoqiLNzVPUngAFZ2AA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAADVad3ccRWnr06eU0N3hX5+WBHG1GpTrtxB6VbfvkvqL9CMddPjHzhtGu3cj+iv/AKSsgADr PCgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAVX4fk5NKrVTr4wTVka/iqZfrLUFXNE2+T4tcbavRaC+3GmVPi2nVdv8AKUcX69Pv+j0v IU//AM96O+if+/mkAAEDpgAAAAAAAAAAEY66662PRWx0bW22pyDLcgnSgxrGqBOesu1Y7ZGsY1EV UYiqnM/bZEX1qqIrXXXWx6K2Oja221OQZbkE6UGNY1QJz1l2rHbI1jGoiqjEVU5n7bIi+tVRFzXC /wAL98w6+VOvuvtdTZBrBkEHdudH6dHjVG7fa30KdUTZFVJJU6uVXIiqiudJNataeudjnY7HRho0 KPW+Rwv8L98w6+VOvuvtdTZBrBkEHdudH6dHjVG7fa30KdUTZFVJJU6uVXIiqiudJZcAvRGWqHma qpqnSq2hFfETw7YTxHYS3GcmfPbbtbJvLseyGh9Gustc3ZWTwvRUXbdG8zN0RyIngqNc2VAZYUk0 g1fzbHs2l4b+JCngtupFthWS2XONOWhyyhbujaylcqInebIveRdFRUd0TZzWTwd/iJ4dsJ4jsJbj OTPntt2tk3l2PZDQ+jXWWubsrJ4XoqLtujeZm6I5ETwVGubXjSDV/NsezaXhv4kKeC26kW2FZLZc 405aHLKFu6NrKVyoid5si95F0VFR3RNnNZSvWdH7VOx6Hk/lDnMrV2dfVO//AGngAFd1wAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1Ny d5xDaYtT/eYb3Iv46RGm2GsWdvlXEjicSdfIbFcalfm59o9zH3qfGPm2zyt3Z/or+NMwsUADrPCg AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAVk06j8gyXUayr08mzCvnYnxRy8r2p/nLNlb2Q+adftRrYvRlwitlzhT8MHJIv8AjoU8ZHqz 3/R6DkGrPnqP6YnhVEfVtoAKzsAAAAAAAABGOuuutj0VsdG1ttqcgy3IJ0oMaxqgTnrLtWO2RrGN RFVGIqpzP22RF9aqiLJkiPVjkic1r1ReVXJuiL6t03Tf+NCs3B7JZ7JxQ5lRcTLHLrxcFkXF7hVO RbVUWDZdo7Mip9jVPT7xq7yKm/XfvkJbNEXKspUcfiasNbzpjXPwTPwv8L98w6+VOvuvtdTZBrBk EHdudH6dHjVG7fa30KdUTZFVJJU6uVXIiqiudJZcAvxGWqHlqqpqnSq2qY4jrpxs6yam6sY1pHT6 IUNj04y2pxyJcjort5XUNYq8j3Op51Yq8qJuqNb18Gm4YTxPap4bq3YtC+K3Tmy4zeMv7xmL5Pjd dJU2O8VDERXU20yJLTy9U5Wv35lcibJu1Xa9wK/2W+Kf/pVrP8zji7RiWC4roBiFpc12V3LV6yVV pYz92ZFAknfzJ60YxZIeZfBN2qvgZYbvq/xCare3lS8NPDvhuNXPMG2D2T3i75TWTQ2u10Kzdyxq xwJ3s0jnKnRqoiI5vju5WY+26scY2nGouKY5rhpRiOV4vltelrW/acQXGR9lmcm7JK2nqOdyQdF5 pUcjWIiqq7ojXZbXHhjsWr+pVJqdpvrDd9ONV8btzba672SSKoV9C97nshraN67Sx83M5qOVu/r5 uVvLGuR6wcXnCVdcZr+IO94Xqfpzfb5S2Cpv9qoHWq826aocrY5padv2B8fRVVrEVem27em4XRIr 4ieHbCeI7CW4zkz57bdrZN5dj2Q0Po11lrm7KyeF6Ki7bo3mZuiORE8FRrmyoAKSaQav5tj2bS8N /EhTwW3Ui2wrJbLnGnLQ5ZQt3RtZSuVETvNkXvIuioqO6Js5rJ4Iv7Rms0cfpHQ2TNaK41+oFZWJ 7XNNYXct8bed07uSmciK5kaO5O9VU5Vbsnv+72zmjVPqfSaYY9T6y1luqsxZRsS6yULdo+89SKqL yuejdudW7NV3Nypy7FG/biic4el5NxVd+maK42df7626AAgdMAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADX9Oo/L+JW4VPiy14e2D8EktWj t/8AFQ2AxegcPnDVPU6/r1jilttshX4u7hcsif4ytM0Rncpjv+ktMRVoYS9V/TlxqiPqncAHUeKA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAr9qjB5m4iceue3LHkeN1Nv+Z0tPL3u/4eVyJ+AsCQjxO03m+LBs4am3mPI4oJ3fwKapasci /wAaM/jK2LjO1M7spdjkKvRxsUdqKqeMTl8cnbABTegAAAAAAAACOtcND8W1yxaKzXmeptd4tc6V 1gv9C7krrPXN2Vk8L0VF8UbzN3RHIieCo1zZFAiZic4a10U10zTVGcSj3hl4mspqcpdw2cSbKa16 pWuBX225MTkocuoW77VdKuyJ3uyKskSbKio5URNnNZaUqvrhofi2uWLRWa8z1NrvFrnSusF/oXcl dZ65uysnheiovijeZu6I5ETwVGub98MvE1lNTlLuGziTZTWvVK1wK+23JiclDl1C3farpV2RO92R VkiTZUVHKiJs5rL9q7FyMp2vMY3BVYWrSp10yxtv4PNfsI1B1EzPR7i4psRotRMiqMirLdLp7TXJ YZZFXZqTTVW7uVF23RrUXbfY3PSPhGjxHUpNcNYdU75qtqNBTPo7fd7pTRUdJaoHoqPbRUUO8cCu Rzkc5FXoq7bczuawgJlBXvVfhMqso1Uk130b1fvelmoFZRR266V9DQwXCiutPGiJGlVRz7Mke1rW tR3MmyNTpuiKmFg4Pc8zrKcev/EzxIXfU63YpcYrxa8fpsepbHbFrot+6mqI4XPdUcqqqojnInVU 6tVzVs8ABD3EpxKYrw64rTVVVQz3/Lb/AC+Q4vi9D6VZd6xdkaxrURVbGiq3nk22aionVytariU4 lMV4dcVpqqqoZ7/lt/l8hxfF6H0qy71i7I1jWoiq2NFVvPJts1FROrla1YN0V0VyqHKqzX/X+5QX /Ve/xd2qx+lR45Rrvy2+hbuqNREVUfInVyq7qu7nSR3LkW4W8JhK8VXlGzrk0V0VyqHKqzX/AF/u UF/1Xv8AF3arH6VHjlGu/Lb6Fu6o1ERVR8idXKruq7udJOABz6qpqnOXqbVqizRFFEagAGEgAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHFw qweU4Le8sVN/ZLklwuEb/jiR6RtRPmTu3GFz+8pj2E3y88/K+loJnxr/APE5VRif4yoSXoljq4pp JidjezkkhtcMszf4Msid5In+M9xJh4zveEfv6qnKtfN4CY7VUR7oiZn45N3AB0XkgAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAANB15xh 2X6QZTZYmc860D6qBE8VlgVJmInzq6NE/Gb8fjmte1WPajmuTZUVN0VDWumK6ZpnrTYe9Vh7tN6n bTMTwnNAeE31uTYjZ7+juZ1dRxSyfNIrU50/E7dPxGaNC0rpX4zPlOm026OxS9Tw07V8fI5lWWB3 40c5TfTlUTM069r29+mmm5OhsnXHhOuPgAA2RAAAAAAAABHWuGh+La5YtFZrzPU2u8WudK6wX+hd yV1nrm7KyeF6Ki+KN5m7ojkRPBUa5sigRMxOcNa6Ka6ZpqjOJR7wy8TWU1OUu4bOJNlNa9UrXAr7 bcmJyUOXULd9qulXZE73ZFWSJNlRUcqImzmstKVX1w0PxbXLForNeZ6m13i1zpXWC/0LuSus9c3Z WTwvRUXxRvM3dEciJ4KjXN++GXiaympyl3DZxJsprXqla4FfbbkxOShy6hbvtV0q7Ine7IqyRJsq KjlRE2c1l+1di5GU7XmMbgqsLVpU66ZWlIe4lOJTFeHXFaaqqqGe/wCW3+XyHF8XofSrLvWLsjWN aiKrY0VW88m2zUVE6uVrVcSnEpivDritNVVVDPf8tv8AL5Di+L0PpVl3rF2RrGtRFVsaKreeTbZq KidXK1qwbororlUOVVmv+v8AcoL/AKr3+Lu1WP0qPHKNd+W30Ld1RqIiqj5E6uVXdV3c6Ta5ci3C PCYSvFV5Rs65NFdFcqhyqs1/1/uUF/1Xv8XdqsfpUeOUa78tvoW7qjURFVHyJ1cqu6ru50k4AHPq qmqc5eptWqLNEUURqAAYSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAANB1dp3X+lx7T+FVV+V32koZUTxSna9JJXfgRGpuWga1rGoxjUa1 qbIiJsiIV3w2jXLeIuB6t56PBrK+dy+KNrav0Gpt/wDKRV/EWJLOEp9avfq4f7zcfl65lNqxHVGc +NX/AOYpAAXHnwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAFe9UKH2H69WbImpyUObWx9tqF9XltN6Ubl+dY1RifgU2EyPEjitXkel 9ZcrQze74zNHfre5E3VJKdeZyJ613j5029a7Gu47e6TJLFQX+hXeC4U7Khib7q3mTflX50Xovzoc y7ToXZjfr8/j83ssFd6Rg7dfXT9mfdrj4Tl7mRABqmAAAAAAAAAAAI61w0PxbXLForNeZ6m13i1z pXWC/wBC7krrPXN2Vk8L0VF8UbzN3RHIieCo1zZFAiZic4a10U10zTVGcSqlwPY7W6q4lbuLnVrI arLtRcqgqaGCuro2NZaKGmqJaZIKWNqIyPn7pz3uaiKveKnrer7Wlbuzo+Btp9+Vv0rVlkTe5MzX OaDB0U0WKNGOqAAGiyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAHxPPDSwSVNRIkcUTFe97vBrUTdVX8R9mi6v1ldLjUGIWV3+yuW1kNl pET1JK7aRy/2qM5t19W6GtU6MZpLVHOVxTs/eufc3bhdtc0+I3fUSuicyqzS6zV7Ecmzm0karHAz 8SNcqfM5CZzH49ZKHGrDbsdtkfJSWylipIW7fvGNRqb/AD7IZA6dmjm6IpeOx2J6Xia73VM6vDZE e6MgAEioAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAA+XsZIx0cjGuY5Fa5rk3RUXxRUKx4HQyYLlWU6R1KqkVlq1r7Rzfv7dUKr2In x8jlVqr8alniCuJG0S47X47rRb4nL5hmS3XlGJur7bO7bmX4+7kXmRPjevxFTF0Z0xXHV8uvz9zu chX8r04arZc2fmj1eOun3skD5jkjmjbLE9r2PRHNc1d0ci+CovrQ+iq7gAAAAAAAAAAABRHKOOrO +F3Wy8aOa/45LkmPwytqrNkNvY2KvfbpVVYXyxLyxzq3ZY3Ob3a80T19I2pomvYhvX6LGU17J60u 9nR8DbT78rfpWrLInk/ojx+3LSfh7wbQXSXT+W+Z2ktXSeUV6/1KyequE8kLIomO553Kk0adVYiO Xb0j1AwC2ZRZ8Ls9uze/eeshjpWOulckbY2TVTvSl5GtREbGjlVrE26NRqLuvU2u0TTVMz1oMFfo uW6aKdeURnwbAACNdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAADW9Nrcue66V2QyJ3lpwClWhplVN2uuVQn2Ryf3EaK1fiXZTkz3KosMx K45A9qPlgi5aaLxWWd3oxsRPFd3Knh6t1JF0OwKbTzTi3We4qrrtVq643WR3vn1k3pSb/GrfRZv8 TENrVHOXIjqjX5fvuQY6/wBFwdVcetX9mP8A2nhq/wCTfgAdN44AAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6F+sluySy12P3e nSeiuNPJS1Ea/vmPaqL+BevRfUp3wYmM9Us01TTMVU7YVj0ymuNiW66W5FKr7th9R5I2R3Ramid1 p5k39Ss2T5tk+M3kiztBbrlmi2m1VxO6axW/z5jMdPbbhDWxOfBU0dRVRRMWRrXNc5WSSJts5PfI vg3YxHtYdpN8rOHf6LefqOfThq4zpjZD1V3lbD1xTcn1qozmI6p2TxyzjumE1AhX2sO0m+VnDv8A Rbz9Q9rDtJvlZw7/AEW8/UbdHrRelcP38E1AhX2sO0m+VnDv9FvP1D2sO0m+VnDv9FvP1Do9Z6Vw /fwTUCFfaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UOj1npXD9/BNQIV9rDtJvlZw7/AEW8/UPaw7Sb 5WcO/wBFvP1Do9Z6Vw/fwTUUu7T7QP2xtIIdVrFRd5fcC55qnkb6U1reqd+i/H3TkbKm/RGpL8ZM /tYdpN8rOHf6LefqOCu0i7Rq50VRbbjkXDnU0lXE+CeGWjvDmSxuRWua5FTZUVFVFT5zaizcoqiY RX+UMNftzbqz19yh3ZaaB+zjU2t1ov8ARc9nwn7Dbudu7ZrpI3oqepe6jVXr60dJEqeB6xFYNHuF Hjv0MwWk070/v3D7TWmjlmnRZ4bxJNLJK9XudI/lTmXqjUVfBrWp6jdfaw7Sb5WcO/0W8/UbXLVd dWaLB43D4a1FGvPr1JqBCvtYdpN8rOHf6LefqHtYdpN8rOHf6LefqI+j1rXpXD9/BNQIV9rDtJvl Zw7/AEW8/UPaw7Sb5WcO/wBFvP1Do9Z6Vw/fwTUCFfaw7Sb5WcO/0W8/UPaw7Sb5WcO/0W8/UOj1 npXD9/BNQIV9rDtJvlZw7/Rbz9Q9rDtJvlZw7/Rbz9Q6PWelcP38E1AhX2sO0m+VnDv9FvP1HR0C 1F1vu2rurOjeuT8Nnu2nPmHu6nGIKmOnl84UstQu6zuVztmpEnvW7Lz+KbKYqs1URnKWzyhZv1xb ozzlPAAIl0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAN dz/LYsKxervawrPU9IKKnRFV1RUv6RxoidV3Xx29SKYmYiM5bUUVXKoop2y6VotXtpazUNkVve4/ gfJdLiviya4uT+p4V9S8ibvX8DkUskaBojp5Np1gtPQ3V6TX25yOuV5qFVFdLWS9Xpv60b0an9zv 6zfy9hrc26M52zrea5XxdOJxGjbnOijVHfvn3zr8MgAFhygAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVXtR/gJ6m/kX9MUR aoqr2o/wE9TfyL+mKItUAAAAAAAAAAAAAAAAAAAAAAAAAAAApHp38Ozip/wH/Q7y7hSPTv4dnFT/ AID/AKHeRX/Zyvcm/wA1T7/lKeQAc96oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAANV05s7tWdVH5ZUM7zFsEndBb909Csuv7+VF8HNiTbb+2VFTxU6mod3vN ZPbtN8Mf/wDiPKHrBFIibpRUv+/VL9vBGt32+fw6psT3g+G2bT/FLbiFggSOjt0KRou2zpH+L5Hf 2znKrl+dTezb52vXsj5/vWr8oYroWH+z69eqO6nZM+/ZHvZ0AHSePAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVV7Uf4C epv5F/TFEWqKq9qP8BPU38i/piiLVAAAAAI7hzDLX8QE+BvybTxcaZiaXVtnZWyLlTa3ytI/KHQc 3dpb+RVb3nLzd7sm+3QCRAaFWa/aEW+zW/I6/WvAqa03Z8kdvr5sko2U9W6N6skbFIsnLIrXorXI 1V2ciovU6WtmeZDjGm0OWad5jpta6iprKJsFyzW4vgs8lPLI1HI2aJyKsj2L9i2XZzlTxQCSgQTk nGHpDi3ERQcP13y7F6SeezT3CuudVkVPA2hrWzxRw258bv8A8xK2Rz0Yr2vRrE2Y5HbpOwAH45zW ornKiIibqq+pDSbLrjorkmQexLHdYMJut851j82UWQUk9XzJ4t7lkiv3T4tgN3BhcszbDMCtS33O susuOW1HpGtZdq+KjgRy+De8lc1u/Rem5+4pmeH55aW37B8ss2RWx7lY2ttVfFVwK5PFEkic5u6b p03AzINRyLWDSXEL9Di2W6o4jZL1U8vc2643umpqqXm97yxSPR7t/VsnUyt7zPD8arLbbsjyuzWq rvT5I7bBXV8UEla9jOd7YWvciyK1vpKjd9k6r0AzINcteo+nl8xebOLLnePV+OU6yJNeKa5wS0Ma xryyc07XLGnKvRd3dF6KcWF6p6Y6kJULp3qNi+UpR7JUeZbvT13c7+HP3L3cv4wNoBBOnPGJpDqR rjmmidoy3F/KcZW2w2qsjyKnldkFRUQSy1EVLEmyvWm7trZOR0io5yo5GK3ZZ2AAAAUj07+HZxU/ 4D/od5dwpHp38Ozip/wH/Q7yK/7OV7k3+ap9/wApTyADnvVAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYnKsmtWH2GsyK8zpHTUkauVN/Skd+9Y343OXZE/CZSS SOKN0sr2sYxFc5zl2RETxVV9RqenGOya25nHnFziR+DYzUuSzwPb6N0rmdFqXIvjHGu6N38V/wCs hjKapimnbLbO3aom9e9Snb37ojvn/fU3HQPTy6W2Gs1PzemRmU5O1ru5VVXzdQ9Fipm7+C7bOd8+ yL1Rd5gAOnbtxapimHjsXiq8Zem9c2zwiOqI7ogABurAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKq9qP8BPU38i/piiL VFVe1H+Anqb+Rf0xRFqgAAAFS6D/AN6lc/8AoKZ+nGFtCJafQXuOKmp4mfZXzeUYK3CvMnkO3LtX NqvKfKO86+95O77v1783qArf2Z+i+mWRcLMl7yvC7RfqvIrxeKWrkudIypclIyqljbTMWRF5It+8 fyN2Tnlkdtu5VIGirKyo7JfGaOqqpZ2WzPYaGmWRyucyFl8fyM3X1JvsnxJsngh6E8LmgvubNIaL Sr2V+yPyOurq3y/yHyPn8oqHzcvd95Jty8/Lvzddt9k8CJIuAruuFCk4YfbW38lyRMh8+eYvfbVy 1Xc+T+UdPHk5u8+fb1AYrIMSxWv7Uu0R12M2mpZNo3JXyNloo3o+qS8OakyoqdZEaiIj167Iibly iAdYeGvJcv1ux7iF051nlwDIrHYpMduDpLHBc4K22LOs6x8sr2JE5HucvP6X73omy7yh7b2k33UM S/lum/XAxvEDp1etXNE810yxy/pZbnktmqbdTVyq5GxPkbsiP5fS5He9dtuvK52yL4FIrlBp9pZp 1j2AcX/A43CrFj8lupm6h4W6nqqSnqYpI0jrn1NLyVlEj5GpzKque5X7Luri6mcrpfrxhl60ppdT qXnv9G6Hvcev0TLhByqj0lhdG5XIrVai+CoqIqORUVUWHMm4Qdb9TsY9rLWXi+umT4DUOgbcbZS4 fRW+4XGCKRr2xTVzZHr1cxvM5sbXO26r1UCH9VrzlWc9oTeKNmgi60W3AsJopLFY5bxb6SkonVbm SSXFGVrkilequ7tHIiqiI1f3rVTcdDsA1txPiqvGqVs4XZNJsByHEZKS/WmDILVVUtVd4JFkp6pl PRyqrZHMVYlVGbek5V6uVSYtVeFt+Uag2PWPSHUit0zz2xWn2Ppcaa2xXCkrrXzczaWqpJVakiNd 1a5HtVOnjysVuZ0f0QzfCMvu+ouqGuWQahZJdaKO2ta6mZa7TRUrHq9GwW+Fzo0kVy9ZXuc/boio iu3Cu/AdofpLrvwmt1G1bwix5ZlOqFfe63JLvcaKKorXyrXVEDUjmeivi5GRscxGqnKq8ybL1MZx SaI4zj914SNCW3q9XrHKTLaizyS3WrSaqqrf3Kc9NLIxrEcx0W8GyIn2P0fnJOTgs1Cwz2SY1oLx PXnT3A8qraivqscTHaW4uoZKj93SgqpHtfStd12TZ3IvVOvU2GTguxC00mhdjwTIprJZNEbrLc6e lmpEqpbo6Rq953kqPYkb3yOfI56Mciq9dmomwEJccdpjtWrPDpoPhGjlHkGHXW63q+VWDWuWktNH eqmigjkhiesnJT8jFe+RzH9Hou2yqqIfty0611vOvmkup2nnBI3Seoxy/RUmS3Siyaxd1WY/PtHV RTQUsyOm5Gr3jE5XKitXlTfYs/xB8PNl16tlgqPZLc8VyvDrk28Yzkdsax9RbapERF3Y9FZLE9ER Hxu6O5U69DXsM4fdXU1Bsme6zcTd8zRuNJK+2We1WaLH7e6aRisdLVMgke6qVGr0a5yMRevLsqoo RfwuYlisPG1xUzRYzaWSWq4Ym6gc2ijRaR0lunWRYl2+xq5eruXbf1lyiA7bwz5TivEvkuvmCaxz Wa0Z0tuflWLy2KGqZcH0UCwxLFVOej6dOVVVeViqqud18EbPgAAACkenfw7OKn/Af9DvLuFI9O/h 2cVP+A/6HeRX/Zyvcm/zVPv+Up5ABz3qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAADSMnveR5PkMelemzk8+VTEfcbhtvFZ6VfGV6p/viovot8eqfGhrM5N6KNOdc 5RGuZnZEb5cNdS3PWfLJdMMclkhx+3vauU3WNdtm/wD8HE71vdts74k338FRbKWi0WywWulstmoo qOhoomwU8ESbNjY1NkRDEafYHYdNsWpMUx6JyQU6K+WZ/WSpmd7+WRfW5y/xJsidERDYy/Ys83Gd W2f3k8zypyh0yuLdrVbp2d++qe+fhGoABYcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVe1H+Anqb+Rf0xRFqiqva j/AT1N/Iv6Yoi1QAAAAAAAAHHUU9PV08tLVQRzQTMdHJHI1HMexU2VrkXoqKnRUUi73J3Cx97TpV +Ztu/YkqgDQ8R0D0KwC9R5Jgmi2B43d4WPjjr7RjlHR1LGOTZzUlija5EVOipv1Q3wAAAAAAAAAA AAAAAFI9O/h2cVP+A/6HeXcKR6d/Ds4qf8B/0O8iv+zle5N/mqff8pTyADnvVAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABp2T5ZeKu8xae6dUbLlldY3d2/WC2wr4z1 DvBETfo3xXp06ojsTOTeiia51e+eqI3z3GW5XeJrxT6eafUzK/LLk3dN+sNug9dTOvqREXdEXxXb ou6I6YtLdMrPpfjy2uilfWXCsf5TdLlMm81dUL4vcvjsm68rd+ifOqqvX0o0os+l9oljiqH3K93J yT3a7TpvNWTf/ssTdeVvq+dVVV3ouWLE0fbr2/J5/lTlKL8dHw/s42z11Tv8I6o9869gAFpxAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAABVXtR/gJ6m/kX9MURaohfjG0TyTiK4cMu0bxG52233bIPN/k9TcnyNp2dxX 09Q7nWNj3dWwuRNmr1VPBOpHvmztP/lPw2/Qr19YFqgVV82dp/8AKfht+hXr6x5s7T/5T8Nv0K9f WBaoFVfNnaf/ACn4bfoV6+sebO0/+U/Db9CvX1gWqBVXzZ2n/wAp+G36FevrHmztP/lPw2/Qr19Y FqgVUW2dqBt0yfht3/5FevrI4qNX+0ftWZvwPJarQSy3R6c1EtXb7skFezf30EjZFR34F2d6tt90 TSuumj1pyT2MNdxMzFmnOY1+5fIFLvZZ2lf284ePoF4/WHss7Sv7ecPH0C8frGOdo3pOg4jsSuiC l3ss7Sv7ecPH0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXeyztK/t5w8fQLx+sPZZ2lf284ePo F4/WHO0bzoOI7Erogpd7LO0r+3nDx9AvH6w9lnaV/bzh4+gXj9Yc7RvOg4jsSuiCl3ss7Sv7ecPH 0C8frD2WdpX9vOHj6BeP1hztG86DiOxK6IKXeyztK/t5w8fQLx+sPZZ2lf284ePoF4/WHO0bzoOI 7ErolI9O/h2cVP8AgP8Aod52/ZZ2lf284ePoF4/WOHQTS7WnHNVNVNX9cLvh1Ze9RvMf2PGG1Lae HzfTS0/VtQ3mbux0S++duqP8OiEd25TVRMRK3gcJetYimuunKNfylOgAKT0QAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+JZYoInzzysjjjar3ve5Ea1qJuqqq+CIaLQyZb rjWSWPTuea04tFKsNzyZWqjpkT30NGi++d6lf4J83TmxM68o1y3ppjRmuudGmNszsj/e6I1y5Lxk uR5hkD9ONKGR1F2TZLndnJzUtojXoquXwdL47M+P8Cok2aZ6X45pfZFtlnbJU1lU7vrjcqheaprp vW+R3jtuq7N8E3+NVVcjhGC4xp3YIMbxS2MpKSHq5fGSZ/rkkd4vevrVfwJsiIhny7Yw/N/br1z8 vB5zlHlScTHMWNVv41d8/SNkd86wAFlxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADW8809xPU mxusOW2tlVBvzwyovLNTSbdJInp1Y5Pj9fgqKnQ2QGKqYqjKdje3crs1xctzlMbJhWG6Lm2h1RHb 8+kmv2JPk7qjySKNXS0qL71lYxN1T4u8Tx+dV2TdaOtpLjSxV1BVRVNPO1HxSxPRzHtXwVFToqEy VNNTVlPLSVlPHPBMxY5IpGI5j2qmytci9FRU9SkC5Tohk2nlTNkmiL0qLc5XTVmJ1Uy9y9VXdXUj 1/cnf2q9P8jShcw9VrXRrj4x5/N6nCcqWsZ9i/lRc37KZ8ezPfs8GcBrWIZ/Y8v76jgSehu1EvJW 2utjWKqpnp4o5i9VT506fgXobKQxMVRnC9XRVbnRqjKQAGWoAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYfKctx/DbY67ZDcGU0Keixq9Xyv9TGNTq5y/En+Y wd51Bqaq9LhenNmfk2SqqJJDCu1NRIq7c9RL71iJ8W+/q6KqG96c6CwWa6Q5xqRc25Pljd1ike3+ o7eirvyU0S9EVP4apv60RF33UU1XZyo49TF+7ZwVOniZ27KY9afKO+fdEtNxnTHMNZ5oL5qNT1OP YaipLTY+j1ZV3BPFr6pydWMXx7tOv4OjlsJbLZbrLb6e02ihgo6KkjSKCngYjI42J4I1qdEQ7QL9 qzTajVt3vL47lC7jqo0tVMbKY2R5zvmdYACZQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAABoOpWi+IakrFcqtk1rv8ASdaO9W9e7qoXInRFcnv2/wBq71b7Km+5D9xvOe6STst+rNu8vs27 Y4MptsKrCu/h5TEnWJ3zomyr4b9VLPHHPBDUwyU1TCyWKVqskje1HNe1U2VFReioqeorXcNTcnSp 1T+9rrYLle7hqYtXY06N07Y/LPV4a47kMW+40F2o4rjbKyGqpZ288U0L0ex6fGip0OwdLKOHWay1 c2RaI3pmOVsjlkns9QiyWurXbw5E6wr87enqRE8TVKXUp9mukeMaoWKfEb09eWNapeaiqtl25oah PRVFX1KvTw3VSnVFVucrkZd/U9FYrtYynSwtWl3bKo93X4xnG/JvAPxrmvaj2ORzXJuiou6Kh+gA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAda5XO3WeikuN1roKOlhT mkmnkRjGp86qadb8mzrU+ZaHR/H/AOoOdWS5JdY3RUTNl2XuWKnNM78CbIvim3U1mdeUbW9NuZpm uZypjbM6oj3/AE2thynMccwy3+ccjukVLG7dI2L1kmd/BYxOrl/B+MxNlwzVDWRWz3FKzBMOkXfl XZLtcYlT4uqU7V+fr8zkUkLT3QLF8PuDMpyGrnyrKtkV12uKI7unJ/wEXVsKJ6tt1T49uhKBZt4W a9d3Zu85crFctW7P2MHGc9qY/wCsfWeENfwrA8T08ssdhxCywW+lbsr+RN5Jnbe/kevpPd86r/kN gALsRFMZQ85cuV3aprrnOZ2zIADLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AMZkONY/ltrlsmTWekudDN7+CpiR7d/Uqb+Cp6lTqnqMmDExExlLamqqiYqpnKYQBdtAcxwVzq3R bJ+9oGrzLjd7kdLBt09GCf38fTfZHbpuvVTBUOqtDR3NmOahWatw69r0SnuabQTL06xTp6D27rtv unzblnDGZDjOPZbbZLPk1lo7pRSe+hqoWyN3+NN/BU9Sp1QqV4SNtucu7q/07uH5dqn7OMp0/wCq NVXlPv196Lmua9qPY5HNcm6Ki7oqfGfpi7tw6XzFnPrdFs1ltcaKrvMV4V1Vb3f2rHrvJEnh1TmX 5zV6zUS+YTM2i1ewm4Y4quRjblA1au3SqvgqSs35FXdPRVN09exVqiq37SMvlx83asVWsX/LV6U7 tlXDr92bfAdO1Xi032jbX2a5U1dTP8JaeVsjfwbp6/mO4NpMTTOUgAMsAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAweT5xiWG0/lGS36loum7Y3v3len9rGm7nfiQw1uuWrWo2yadYO60 W2Tb/ZvI0WBit/hRU6bvf69l8PDfY10tejGuUnNzFHOVzFNO+dUf78Izltlyudts9HJcLtX09HTR Ju+aeRGMb+FV6Gl0edZVqBO+3aNYjNeGI5Y33uvR1NbIV6oqo5dnSqip1a3r+E3zG+GnGkq4r5qb eKzOLsxeZqV6clDC7/4dM30NvHo7mRfiQmCnp6ekgjpaSCOGGJqMjjjajWsangiInREJ6MNXXrrn KPj++LmX+WMNY1WI06t86qeG2ffl4ShrGOGy3VFbDkOrt9lzK6xrzx0sre7ttMvXoynTo/x23fvv 627kzQww00LKeniZFFE1GMYxqNa1qJsiIidERE9R9guW7VFqMqYcDFY2/jatK9VnlsjZEeERqj3A AJFUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA454IamF9PUwsl ikarXse1HNci+KKi9FQ5ADYiTJeGfT651kl6xJ9dht3f18qsc3cxvX4nwfuat6ruiI3f4zTq/FeI DBN1koLXn9sj/wB+olSiuCN+N0Tt2O/A1VVepYwFavC26tcap7v3k69jlvFWoim5OnTuq18J9aOO Sslu1iw6at8z399ZjN0TZHUV7pnUkjV8PF3o+Pzm6wzQ1ETZ4JWSRvTdr2ORWuT40VPElO/4zjuV US27JbFQXWlXf7FWU7JWoq+tEci7L86dSKrnwuYlTSvrNOskv2GVLl5u7oap01I5fjdBKqov4Eci EFWHu07Nfwl1LXK2Dvaq4mif7o+kxwlyg1msw3iKxJVVlNjudUbPBYJPN1a5PXu132L8SKph5tX7 fYpEptQMUyPEpVXl57jb3rTuX+0lYio5Pn2RCCqdD14y8fPY6NuiL/sKor8J18PW+DfgYmyZbi+S MR9gyG31+6b8sFQ17k/C1F3T8aGWMxMTrhrVTVROVUZSAAy1AAAAAAAAAAAAAAAAAAAAAAAAAAAB rN+1NwDGeZL1ltugez30TZkllT/qM3d/kMXSahZPlOzNOdKskvbX9GVlVElBRu+dJZfH8GyGmnTn lG1NFi5o6cxlG+dUcZyhvR1Lnd7TZKV1beLnS0NO3xlqJmxt/jcqGLotJ9eMq2dk2aWXEaN/jTWe mWrqeX4nSybNa752bm1Y9wy6WWmqZdL7QVuV3JuyrV3+pdVqq+v7Gu0e2/xtUlptXa9lOXip3cbg sP69zSndTGfxnKOGaN49Waa/1L7fptit6zGqYvK51BTrHSsX+3neiNanz9UM7QaS63ZptJmOW0OF 293jQ2RvlFarfidUO9Fi/Ozf8BPtJSUlBTR0dDSxU9PEnLHFExGMYnxI1OiIcxPThI/8k5/CPP4u Ze5eqjVhqIp75+1Px1fD3o+wjQfTHAqhLla8fbW3VV5n3O5vWqq3O/hc7+jV6fvEaSCAWqaKaIyp jJxr+Iu4mrTvVTVPfOYADZCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAHxLFFPG6GeNskb05XMciKjk+JUXxPsAR3kvD5o3lb3TXPArbDUOXm8ooW rRyc38LmhVu6/h3NSqeGeutm7sD1gym0bdWQXBY7lTs+ZrHo1UT8ak4ghqw9qrXNP0+To2eVsbYj RpuTMbp+1HCc4V6qMD4kLButPNh2UwN8PSloql34lTu0/jMZUZdqVY90yvQzKIUb759pWO5NT5/s ap0LMAinB0/dqmPiu0cvXP8Ay26Z4xPwnL4KuM1007imSlvFdXWapX/eblb5oXJ+FeVUT+Mz9u1D wO7beb8xs0zl/eNrY0f/AIqrv/kJ+qqSlrYVp62miqIneLJWI9q/iXoajdtF9JL4rnXPTfHZHu8Z G2+ON6/9ZiI7/KRzhbkbKon3Zea1Ty1hKvXt1U+ExPziPm02KWKdiSQyskYvg5rkVF/Gh9nLVcKW iMsizUGNVdrld4yUN0qY1/iV6on8Rg7/AMOFksNA+us2pWoVJyeELb2jo/4nRr/nIa6a7XrRHH/T oYa7hsZ7Gqr30xHyqllwVyzXIc4wp0jbVqBfJu7328rWCb+PeI0GHiO1bhXZ+QwTbf8ACUMCf6LU Ks4qiJymJdinkS/XTp01Rl7/ACXLBUGPie1Rj99La5P7qj+pUOw3in1Kb40ljd+Glk/+0htGIplF VyVep2zHx8ltgVL91VqT/wDwFh+iy/tDjfxTamO97T2Vn4KV/wD93mekUsRyXenrj4+S3AKfS8Te qcnvKu3Rf3FG3/7qpwQ8QWrVwqmU7spSFj12XuqGnRf41YppOKojqlPRyJiK9lVPx8lyAQlg9Bku cOY276kZTD3m2/kdRDD/ABbREyUnC1h1VEya85vnl252o5WVl9VW9fVsxjehLRcm56sKWIwtOE9r VwjP5zD6q6+hoGd5XVsFOz+FLIjE/jVTXLjqrpvat0rM2s6K3xbFVNlcn4mbqbvb+FvQq3v75cFj q5fFZKysqJ1d+FHvVP8AIbhaNMdOLByrZcCx+ic3wfDbYWv/ABu5d1/jLUYa7O3KOM+TjV8rYGjV EV1cKfrUgGLW3Fbm5WYraMkyR++yNtNnml3X4k5kaZGnumtV+2THNEq6mjd4T3q4w0nL+GLq9fxF kmtaxqNa1EaibIiJ0RD9N4wk/eq4R/8AVavl6iPZWY/5TM/LRV/ptKeIO+7Lec6xfGYnfvbXQPrZ Wp8SrNs3f50MrTcLOM12z87zfLMoVffwVFwWnpV/BFFsqf4xNYJIwlqNsZ+P7yVK+XMbV6lUU/li I+O34tRxfSTTPC+V+M4PZ6GVnvZ20zXzf+K/d/8AlNuAJ6aYpjKmMnMu3rl6rSuVTM75nMABsjAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAf/2Q== --_005_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_ Content-Type: image/jpeg; name="02.jpg" Content-Description: 02.jpg Content-Disposition: attachment; filename="02.jpg"; size=535658; creation-date="Wed, 05 Aug 2020 13:24:09 GMT"; modification-date="Wed, 05 Aug 2020 13:24:09 GMT" Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkI CQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQ EBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCBI2BlIDASIA AhEBAxEB/8QAHgABAAMAAwEBAQEAAAAAAAAAAAYHCAQFCQMCAQr/xAB3EAABAwMCAwMEDAcICgoO AxEAAQIDBAUGBxEIEiETFDEJFSJBFhcYGSM4UVemp9PUMlhZYYW10jNCUlVxgaW0JDdWYoSGkaOk syU0NkNzdXaDlLEmNTlTY3J0d5KWoaKy0URFZ4KVtsHjR1STl8LVZMPExeHw/8QAGwEBAAIDAQEA AAAAAAAAAAAAAAMEAQIFBgf/xABFEQEAAQICBAoIAwcCBwEBAQAAAQIDBBESITFRBRMUQVJhcZGh 0RUyM4GSscHSIlPhNEJicqKy8COTNUNUgrPC8SQG4v/aAAwDAQACEQMRAD8A9UwAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAHktxB+Vq4jdJ9cc70zx3CtN6m14vf621Uc1bba99Q+KGVzGukcysa1XKiJuqNRN/UhX/AL9X xT/3A6Vf/eq4/fgPakHit79XxT/3A6Vf/eq4/fj0Ntmcay8SfAQucYcxls1IzPFpprelhq325Ia1 XuazsJZJeaH8H8JZOnXqBpwHnjwC6L+UA0/1urL5xPZHmNdiL8fqqeGK75w27wJWumgWNUgSpl2d yNl2fy9EVU369fQ4AAAAAAAGP+N3yh1n4OcpxvDINN/Zndb5QS3Opi89+b+5QJJ2cLv3Cbn7RzZv 4O3ZevfoGwAcGx3LzzZbfeOx7Hv1LFU9nzc3JzsR3Lvsm+2+2+yHOAAAAAAAAAAAAAAAAAAAAAAA AAAxp5RjTHjA1IpMBZwnXrJbfLb5Lmt98y5UllV7XpTd37RVni7XZWTbfhcu6+HN1n/AbhPELgOh j7DxM3K9V2Yre6udJbtfUu0/dHMiSJO3SWT0d0fs3m6deibgaMBj/jd8odZ+DnKcbwyDTf2Z3W+U EtzqYvPfm/uUCSdnC79wm5+0c2b+Dt2Xr36aysdy882W33jsex79SxVPZ83Nyc7Edy77Jvtvtvsg HOAIHrzaM4v+ied2PTKoq4Mur8dr6axy0lZ3Sdlc+B6QrHPzN7JyPVuz+ZvKvXdAJ4Dzk4FdEvKG YHrxDf8AiUyXNK3DG2mshfFdc7bdoO8uRvZL2CVUm69HbO5enyoejYAAAAAABi3yj/GfqxwfxafV GmeP4pc48qddGV3n2kqZuydTJSrF2fYzxbb9vJvzc34Ldtuu/EoONbWKr8nHW8X7sdxFMwgmXsqF KOq82OiS8NoXKsfeO137NXu/dfwkT1dANugw/wCTj43dXuMC653Tak47iNtpsVp7fJTOsdJUwufJ UOnRUkWaolRU2h6bInr8Tk+VG4s8+4ZtNMas+l1ZHbckzerqoWXR0TZX0dJTMjWZYmvRW9o508SI 5UXZObZN9lQNrg8TuFSyeUm4ipqbVXC9ac1qsYt97ipayS45nNFDULG6N88cdO6RUciMem/oo3rs iqqKie2IAAAADwV4TOJLiJyTi003xvIde9Rrpaa7LKWmqqCtymunpp4Vl2WN8b5Va5qp0VqoqAe9 QMm+VAzXMtP+Em9ZJgeW3nG7vFdrbHHX2ivlo6ljHTojmpLE5rkRU6Km/VDPPkcNXdV9T73qpFqV qfluWst1JaHUbb5eqmvSnV76rnWNJnu5Fdyt32235U38APTgHnVx/eUS1y4UtcaTTXAcWwe4Wmrx +lu7ZrzQ1ktR2kk08bk5oqmNvL8D09Hfx6qTjip41tYtCuE3SLXjGcdxGqv+dRWpbxTXCjqn0cEl VbXVT0gayoY9qI9jkTme/wBHx3XqBt0GYvJ8cTWonFdotdtSdSbPj1tr6PJamz08Vkp54YXU8dNT SI5yTSyuV/PNIm6ORNmp08VXToAAAAAAAAAAAAAAAPCPjr4jeIXEeLbUvG8T141EstooLs2OkoLd lFdTU1OzsIl5Y4o5UaxN1VdkROqqB7uA4Nikkmslvllkc976SFznOXdXKrE3VV9anOAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAMZYV5SCz55xmScJth0w7WjZdrjaUyjz7ujpKOmmllclKlP1RZIHxp8N 1TZ396bNAAAAAAAAAAAAAAAAAAAAAAAAAAHllxScP/lPMq4gM0yHRfK89psJrq9slmhoNRW0FOyH smIqMp1q2dmnMjunKny+sD1NBxbXHUxWykirVctQyCNsqudzKr0anNuvr679THmFeUgs+ecZknCb YdMO1o2Xa42lMo8+7o6SjpppZXJSpT9UWSB8afDdU2d/egbNAAAAAAAAAAAAAAAAAAAAAAY68o1x hap8Idgwi86aWHF7n7I6ytpa1L5S1EyR9kyJ0fZ9jPFsq8799+bwTbbrv0+Fca2sWS+T3yTixrMd xFmXWqafutFFR1SW18UVZFCqvjWoWVV5XSL0lTqiepFRQ26DCXk6OOrWPi8y/MbJqPjeHW2hxy20 9VA+x0dVDI6WWVW7PWaolRW8rXdERF39Zu0AAAAAAAzF5SjL8swTg3zjKMIyi7Y9eaSa1JT3G1Vs tJVQo+407HoyWJzXt5muc1dl6oqovRTJ/kedY9XdTdRdQ6HUnVTMMspqKy0ktNDfL5VV7IHrO5Fc xsz3I1VToqpsuwHqaAAAPJXyvWtmsummv2J2bTjVvNMVt9Th8NVNSWS/VVDDJMtbVtWRzIZGtV/K 1qcypvs1E9SG6uAbJskzHhC02ybL8guV8vFdb6h9VcLlVyVNTO5KudqK+WRVc5UaiJuqr0REA0AA AAAAAAAAAAB5J+V51s1m004gsVsunOrmaYrb6jDYKqaksl/q6GGSZa6sasjmQyNar1axqcypvs1E 9SAetgKB4CslyPMeETTbJcuyC5Xu719umfVXC5VclTUzuSqmaivlkVXOXZETdVXoiIX8AAAAHnx5 QvygutvCVrFY8B07xfCbjabrjUF4fNeqKrmnSodVVMT2o6GpibyI2GNUTl33c7r4Ikq4ieNbWLSH gn0s4ksex3EanJc1ktCXOkraOqfQwx1lBPUuWFjKhsjdnRxonNI7o5d912VA26DKvk8OKfUni10s yLPdSbLjltqbVkDrRTMslNPDE5jaaGVVek00qq7eb1KibbdDVQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAH+b7jR+Ntq/wD8srr/AFh5/oVtWnen7rXRudguPKq08aqq2yD+Cn96 f56uNH422r//ACyuv9YeXpB5X/i+poI6eOTC+SJiMbvZHb7Imyf76B7V+11p9/cJj3/3rg/ZIDxS ZXfNIuGTUDMNOKmCx3XHLDUVdrlhpIXsppW9WqkT2ujVE3XorVT8x5Le/C8YP/fcK/8AvI77U9F9 csyvOovkzLxqBkSwLdcm0vpLxXdhHyR94qKOKWTkbuvK3meuybrsgGZvJm8anEzxB8Q9dgur2pXn +xw4xWXFlL5mt9LtUMnpmtfz08DH9GyPTbm26+HRCzvKs8T2vHDZFpjPopnfscbkDryy5p5so6zt 1gSjWH/bMMnLy9rL+Dtvzdd9k2yH5Gf42lz/AORdw/rNIXd5cr/tbo1/w9//APhoAIJcPKna+UXD lg2P45eae/6u5JU3Ga6Xd1pp3vpKKOpeymbFSwxthWV6Ncm6sVEbHurXK9HJrng44ps4qODrKNfO KXIKyqrMWulwSsmktcFHP3eKOFYoWwxRxNV7nycrd0RVc9EVdvCq/ItaS4xQaR5RrPUWynlyK7X2 WywVb2I6SnoYIYXqxjl6t55JXq7b8Ls49/BNtbcZ+j2Q69cMWeaVYnIxL1d6KGWgY+RGNmnpqmKp ZErl6N7RYEZuvRObddkA84KvylHHbxI5pXWLhfwBlspaZFljpLTZmXSrhg32a+qnqGuibuvTdGMb uu3Veq8e8ceXlLeGi7W6u4g8S75bK6Tkjjv+OQUkNTt1cyKoo2xtSRE67bu28VaqFAcNPFFrPwB6 hZNa3YFCs11SCkv9hv1NLTTtdA56xOa5NnRvTtZERVRzVR/gvoqm1qHyrvCnrxaqXC+JzQWupLZ3 qOq5ZmRXu3xTsRUbK5qtjkTZHO/BjeuzlTruBqCz8TN84k+DfItYuGilrKbNkt1RS0dsSKGpqaC8 Ro1Vg5ZGrHJ0e1zVc3ZzHtVURVVE8Q+JXLNeMu1dutVxJ1VbLnlDFT0VdHV0sFNJBG2NHRR9lA1s bU5Ho70UTfmVV6qqn+hTQul0JXAaS/cO9oxKjxK9L3uKTGqGGlp6iTZGK57Ymt+ETl5XI9OdFbyr sqbHhl5Sj472qP8A5bQ/q+mA9EPJ/ZZ5Qe9alrb+JqlvMen0eLyPtjquy26liWqSSnSDaSnibIq9 ksuyKqoqbqvVEPQA6TB/9xdg/wCK6X/VNO7A67I8iseI4/csqya5wW602illrq6rndyxwQRtVz3u X5EaiqeSWrXlaeILVTUBMF4TsLbb6SpqFprU5bV5zvNxVN9npCqOjjRURV5EY9UTdVd8mrvK45lc sU4OrnbrdO+H2T3232aocxyoqw7vqHN3T1L3ZGr8qKqesyp5EXCrRdNR9S89q6WOW4Y/aaC30b3t RVibWSzOkc35FVKVrd067KqeCqBHLj5QXykHDjkFul1/xl9TRV6q+KjyPGIqCOqYm3O2GelZF6aI qet3Lu3mau+y+oHC5xL4NxVaWUupWFxy0cjZVo7ra53o6a3VjWoronKmyPaqOa5r0ROZrkXZq7tT s+IDh5004mMFZp7qlb6qptkVbFcIX0k3YzwzsRyI5j9l23a9zV6dUcpGuHDhE0h4To8hdpW+/RwZ ClO+viuNw7yzeDtORzE5U5V2lei7ePT5EAoLjr8pnauGu/S6UaV2ShyTO4YmvuE9a9y0Fp528zGP axUdLMrVR3Ijmo1HNVVVVVpk+0cW3lbM6sHtk4hYMkqMalYtRDJb8EpZKaWLx5olfTullYnX0mud 4L1MpabRycRPFhjTc3e+p9sLO6R125nqqvjq65qzNRf/ABXuRP5j/SLS0tLQ0sNFRU0VPT08bYoY YmIxkbGps1rWp0RERERETwA8v+Efyut4yfNLdprxNWW1UCXSobRUuS2+N1NHBO5Ua1tZC5yta1XL ssrFajOnMzbdzd0cXGb5dprw16h57gd3815BYrLLW0FZ3eKfsZGK1d+SVrmO6bps5qp1PGbyo+CW XBeMvLmWGjipKa/U9Fe3wxNRrWzzwp2zkRPW+Rj5F/O9T0nzrMLln3kpKzLrzO+e4XDS+F1XM9VV 0s7YGMkkVV8Vc5quX+UDIHCz5VDWi21+dXriEzd+Y0lsxd9Rj9ljtdDRSVt3dWU0MMTX08DHdWyv V2/Nsxr3I1VREIdqP5STyiWGZXBccximwWnuG9VR2O4YZHS08sG/7x1VEtQ9nVE5kk9fiR3yTun9 izvjBtFTf6OKqjxa01t/popWo5neY1jiieqL62OnR7fkcxq+o3v5YzF7VeOE+DIKqljdXWDJaGak n5fTYkrZIpGIvjyuRzVVPBVY1fUgEIg8rRNe+Guz5Di2C0901svd0lx6DGaSOWeHvEbGPWtbExVl fC5ssaNjReZZFc1HKjFcZYr/ACnHH/phnnd9SqplLPA9s0+M3/EoaBEjd1RqokUdS1FTwXn3/OpY 3kS8Asd61Q1D1EuFHFPcMXtVFRW972oqwLWvm7R7N/B3LTcm6deV7k8FUnXlwsXtS2fSvNGUsbLm 2puVrknRqc8kCthkY1y+tGuR6onq7R3ygb94cNc8e4j9Gsc1exymdSQ3qByVNE96PfR1Ub1jmhVd k35Xtds7ZOZqtdsm+x5aa8eUI4tdO+LfLNOrXq6lNiVmzJ9BFQusVsckdClQidksrqdZFRGLtzK7 m9e+/U1D5GCrnqeFC+QzSK5lLnFfDEir+C1aOhfsn/3T3L/OeYHHGx0nGFq0xvi7KqxE/l5wNj8T HlKuKnI7rfcg4X8Wudl0rx2skoUzGPGlr4q57HcrpX1E0T6eGNy/gM2R2yorl3Xlb3nBh5WXILzd rpiHFTcLa+mp7VV3ShyGlpGU0z5KaF0z6aWJm0b3PYx/ZqxrVV6IzZyvTl9IMQ0pw3ENKLbo1RWa mdjVBZW2N1GsadnPT9l2cnOn75X7uVyr1crnKvVVP862imnlrzLiTwnS68bzWy65lQWasRV2V9M6 sZHInT1qzm/yga11k8pbx43NzdS8Pxq4adad3CdWWaofirKimqY1VeRHVtXC9ksionXs1anjsnQ2 B5OHj7vnFP54031SorfT5vYqRLjBV0MfZRXOi52se5Y91Rksb3x83L6LkkRUa3lU0FxaYbYMi4UN UcWq7ZTJQQYbcpaWBsSJHBJTUr5adWtTonJJFG5ETw5U2PIPySdXPTcaWPQwyK1lVaLrDKiL+E1K Zz9l/wDumNX+YDc3lWOJ/XPhsotM5tFc49jr8glu7bkvmyjq+3SBKTsv9sxScu3ayfg7b83XfZNu Vwt698Tmt3ALm2pVJkk+Qaq09ZcqSw1MFromSLJGyFYmNgbE2Byor3/hMXffrv0Kj8uV/wBrdGv+ Hv8A/wDDQFzeRz+KHL/ysuP+rpwPI3iVyzXjLtXbrVcSdVWy55QxU9FXR1dLBTSQRtjR0UfZQNbG 1OR6O9FE35lVeqqp6r+T+yzyg961LW38TVLeY9Po8XkfbHVdlt1LEtUklOkG0lPE2RV7JZdkVVRU 3VeqIed/lKPjvao/+W0P6vpj31wf/cXYP+K6X/VNA7srbiVy/IsA4e9Sc5xG4dwvdgxa53K3VXZM l7CoipnvjfySNcx2zmouzmqi+tFLJKe4xvin6w/8iLz/AFSQDAvk4ON7ig174lKfANWNTvPthfZK 6rdSeZbdS7zRozkdzwQMf03XpzbL60Ng8c/GrY+DvB7bWQWRl+y7JXzRWW2ySrHC1sSN7WoncnVI 2K9icqbOerkRFREc5vmV5ID44tL/AMm7n/1RmpfLGcOeo+olqxDWLA7HWXyjxWlq6C9UlHG6Wamg e5sjKlI27q5iKj0eqJ6Kcir05laFNYzxZ+Vo12t65zpPj1ezH55H9hJacTou5P5XKjmxSVjJHSIi orV2e7ZUVFXdFJDpF5VvX7SnUtmm3GJhTXU0VRHTXKp81LbrtbOfbaZ8DUSOWPlVHcrWNVWrzNc7 o1ax4WfKuZ/w9aeWbSjJNM7VltgsLHQUM0Va+grYoXPc/kc/kkZJyq5dvQau2yKq+Jq/T/jT8nbx WZ9b6rVvSqzWnNaqKK3U1RmtkpaumlRHKrIW1K88aJzPdssrY+q7fIgHoPR1lJcaOC4UFTHUU1TG 2aGaJyOZJG5N2uaqdFRUVFRT7HHoKChtVDT2u10UFHR0cTKenp6eNI4oYmIjWsY1qIjWoiIiIibI iIhyAPO7yxulOoepmFaayad4DkWU1VsulwbUQ2W1z10kMcsMWzntha5WtVY9t16bnIsekGexeR8l 0tlwW/sypbJVzeYnWyZLgsy3mSpRnd+XtOZWqionLvtsp6EgDzc8jXpHqPplbNV6zUXT3JMWmus9 ljpWXu0z0Lp2wtrFcsaTMarkRZk3VPDdDEHHXkXGXfb5Y4+K2nucVupay6piS1lroqRFiV8Pb8i0 0bFk9FtNur91Tpt4rv8A6Ajyt8ub+5aK/wDjZH//AI4ChuCzLfKI2nEbLbOHmkvT9M35BvVuprJb amLndJH3neWeJ0qejtvs7p6ti6/KM8cPFHoPxMV+n2lGp/mOwQ2igqmUnmW3VO0sjFV7ueeB7+qp 4c2yeo0H5Hz4nkP/ACmuf/8ASMD+V3+OVdP+ILX/AKtQPZHhzyu/55w/6a5vldf369ZBiVpudxqu yZF29TNSRySv5I0axu7nKuzURE36IiHn75TjjR4luHriDtWD6P6k+YLJU4pSXKWl8z2+q5ql9VVM c/nqIJHpu2KNNkXb0fDdV33Xwi/FU0c/5B2H+oQnlP5aD411j/5DUH9drgPVXhFzzK9T+GrTzUDO br5zv99s0dXX1fYRw9tKrnIruSJrWN8E6NaiHhbwZfHO0t/5Z0f+uPbPgI+JxpN/ydh/+Jx4mcGX xztLf+WdH/rgPWTyt3xLr9/xzav6whmfyG//AG/1g/8AI7J/8dYaY8rd8S6/f8c2r+sIZn8hv/2/ 1g/8jsn/AMdYBxPK+aH6uah8QWKZLp3pXl+UUbcOgoZ6my2OprYopWVtW/ke6Fjka7llauyrvsqF zeUP0hz3K+AzS7C8NwW/32949X2BZrbbLZNVVUTIrVUQPV0UbVeiNc9qLunRdtz0JAGOvJUae5fp vwqss2cYneMcutVkdwrH0N1oZaSoRipExrljla1yIqR9F26mxQAAAAAADzb43vKjZTpVqXX6GcPW N2+4X21TNobnea+F9SjKx229NSwNVOd7VVGq5/MnNzNRi7cy09Xa/eWUsNqlze7YvkzbRTxLVTQS YXb/AIOJE3VXxNg7dqInVd9lRE67FOcc2jmsHDJxcXrWaG1VSWy65c/Mcbv3d1lpFqH1Xe2wvcqc qSRSbtWN3VUai7K1yKaQ058t7M1lPSat6Gte5ERJ6/Hbny7r61bTTtX/ANs4Fx8AnlKpOJfJU0h1 YsNus2bSU8lRbKy3czKS6tiarpI+ze5zopmsRz9kcrXNa9U5OVEXieVa4pNduGt2l6aKZ17HPZEl 785/7GUdZ2/d+5dl/tmKTl5e2l/B235uu+ybWNwh515P/Wa8PyLh+09w6zZnbkfWy01VjtPSXukR +6PlY/Zyub6fK50MjmpzIiqm6IuY/Lnfh6KfyZH/AP40DWXk39adTNe+GyDP9Wcl8+3597rqN1X3 Onpd4Y1ZyN5IGMZ03Xry7r61K88qhxKa1cN+H4DddF809jtVernW09dJ5upKvto44mOYm1TFIjdl cvVqIvXqc3yQHxOqX/lJc/8ArjKm8uD/AGvtLf8Ajm4/6iIC9fJg686scRGgN9zbWLK/ZBeqPL6u 1wVPcaak5KVlHRyNZyU8cbF2fNIu6pv6W2+yIieTvlDPjo6rf8ct/q8R6R+RX+Ktk3/L6u/V9vPN zyhnx0dVv+OW/wBXiA2jqfx2cZ+q9RX03BTpTepcExpfN6ZRSY265zXKWJqNe+PtGOiRnTdsbWOk 2VFcqc3K2AcOPldNa8Z1Bo8Y4mVo79jtTVpR3CvbbI6G4Wp3NyrKrIWsY9rF352KxH7Iuy7pyr6u aNYBZdLNJ8S08x6kipqGwWelomNjaiI5zY055F+Vz3q57l8Vc5VXxPE7ysWFWjD+Mi+1VnpY6duS WugvVRHG1Gt7w9jopH7J63Oh51+VznL6wPb7O9RMU050/vOp2TXJseP2O2yXWpqYtpOaBjOb4PZf TV3RGon4SuRE8Tydu/lM+NviMzqrxnhY0+bbKaFHTQUtus7brXsp0ciJLUyzNdCxN1RN0Y1qK5G7 uXZV19ieF5PxOeS7smC22tb5+v2B0tFRyTycqTVFGrUia96+CPWma1zl/hKqnljw8cRWtnk/tVMg pp8Diirq2FlBfLDf6aWCRWxvV0b2ORUcxybu5XJzMc16rs70VQNC33jm8pzw1V1vvGvmKuqrTWTd kxt/xqnp6ad226xsqKJsaNk5UVURXKvTflVEU9L+FLiaw/iu0mpdTMWpJLdUMndQXa1zSJJJQVrG tc6PmRE52q17XNfsm7XJuiKitTElB5Wfhi1wsseD8TGgVfTWmeeKaRi9jeqBsrF3bI9rmxSIiLv+ Cx69dupvPQCHh8qcCgyfhus+H0mLXpe2SbG7fDSRTyNTlXtWxsa7tW+CpIiPb4KiAZU48vKZ0/Df kcukWkdlt9+zeCJklzrK9XOorTztRzIlYxzXSzK1UcqczWtRzd+ZVVqZxXiN8sGzD/bkfjt09iSU /nBWLitt5e67c/adj2feuy5evP4cvpb7dTDuUajretf7lqvl1rS/NqctkvtfQTTcja2Pvayvp1er XcjXN3Zvyryovgu2x6F+/lVKt5V4YYeXbbb2Yrtt/wBBA0DwBeUUpOKqpqdN9Q7NQ2HUCgplq4e5 OclHdqdmyPdE16q6OVm6K6Pmdu3dzV2RyNuLjH4r8Y4R9KXZxdaBLte7lOtBYbSkvZ97qeVXK57u qtiY1OZ7kRfFrU6uQ8R+GnUltj41MF1Dxa1pYaK4Z3B2dvim520dDW1XZSUyP5W8yNgndHvypuie CeBqHy2uT19XrpgWGSTOWiteJrc4o912SWqrJo3rt8qtpI/8iARvDvKBeUr11yurdo9DLc20m09R arDiNNU0tNGqrypJJLHJIxF2VE5pUVdl2Ul2t3lSeJW3abWzD3W6o0s1gsN5WDIoH2SJzKyhdAqx SNgrY5FhXn25k9foOa5WuVrdheSgwez4pwZYvfaGkjZXZZW3G63CVGpzSSNq5aaPdfFUSKnj2T1K q/Kpm/y32B2WOPTHUympYorrO+vslXM1qI6eBqRywo5fXyOWbb/hFA0l5L/XjVviI0FyDONZMt9k F4o8uqrVT1HcKak5KZlHRyNZy08cbV9OaRd1RV67b7Im2HOIbyhvGFg3FBnOneLavdyx6z5dVWyi o/Y/a5OypmVCsaztH0znu2b03c5V/Oan8iv8VbJv+X1d+r7eeZnFn8dXUz/l7Xf1tQP9GB408Zvl BOLvSjie1A07wDVvzXj9kuLIKCj8w2yfsY1gjcqdpLTOe70nKu7nKvU9lj/PF5RH46eqv/G8f9Wh A/0ALk1tseEezHKrrBRUFBavOVxrZ1RkcMTIu0llcvgjURHKv8h5V6l+VV4jNaNS0034O8FbTQVM 74LZK+2JX3avRvVZljfvDCzlRXKitdytRVc9OqJp/wAppltxxbgLuVNbZnwvv62e0SvYqo5IXvZJ I3dPU5sSsX5Ucqes8s+Cni3oeD3N77nbtLocxr7vbEtdOr7r3FaONZWySKjuxl5udWRp4J+D69wN MZDxxeUy4WL1a7hxH4jBcbRcZOWOG7WekhhqETq6OKqoEa1kvL1RHK5U8VaqHpxw5cQGE8TOlFr1 WwZ0kVNWq6nrKGZyLNb6xm3a08m3TdN0VF/fMcx2yI48luKvyotHxR6K3fSG6cPsFlkr56WqpLr7 Je9OoZoZmv52xrSM5lcxJI19JOkjv5C2vIfZjXpcNU9PpZ3PonQ26808Su9GOVHSxSuRPlciwoq/ +DaBCOLPygvFxpJxT5zp9imrfcsZsV7bDS0K2G2S9nTKyN/J2klM6RejlTdXKv5yyOJHyjXE3m2X ZDYuC/ALtV4fidTJR1uW0GNyXd1TLH+HIirG+CGHx5eZquc1Efu1HcqYr8oZ8dHVb/jlv9XiPeHQ PTTHdINGsP07xehhpqKz2imid2bURZp1YjppnbeL5JFe9y+tXKB5YcL3ldNZLbqFasb4jq225Fi1 1qo6SquzLfDRVls53I1J9oGsjfG1V3e1Wc2yKqLunK7a/lC8w4vMNxDF7xwmrcEljmrpsilo7ZRV iR0rImOjc5KqN6NRF7Rd27Kvr9R5P+UZxCzYPxp6n2OwUcVLRyV9JckijajWtlq6KnqZdkTom8kz 1/nPcSkrKi48LsNwq5FknqsBbNK9V3Vz3W7dVX+dQP8APvw/XvXOm1vsV90DfW1WpTpauW1vhpoa qeSR9NN3h3JUNdG9VhdMq8yL61TqiKe6XAteuJ6/aO19bxZQ18WZNv8AUx0yVtBS0cnm9IIFj2ZT MYxU7RZuqpzeO67Ih5CeTC+PPpj/AMJdv1TWH+gQAVBxR8TWCcKml1TqPmrZKyV8iUdptUD0bPca tyKrY2qvRrURFc96oqNai9HKrWut88b/AC2eZXKu1ywXAXTvW3WfFvOscfMvKlRVVc0ci7fLyUkX UDg0PlDPKNcR2R3FnD9jHdaai9OSjxzGorg2ljcq8nbT1TJU5l2Xr6HMqLs1PBJBpR5WLiK0k1D9 gfFrhnnCkp6htPdFdafNl5t2+y9p2LUZHIiNVHcisarkVFR6evYXkqMLtGKcF2I3agpY463KKq43 a4Stam8sqVcsDFVfXtFBE3+ZSZ8Q/AZw+8TuY0meamWy7peKOgZbUmttd3ZJYWPe9vaJyrzORZHI i+O2yeCIBedqyzGr3itJnFrvdHPYK6gZdILikqJA+kfGkjZuddkRnIvNuu2yeJ5YcRXlfs/vOaT4 Hwo4xSdxSp7lS3utonVlbc5VdytdS034LGud+Cj2vc5OVeVirymkeNiw23he8nPkunGm1bc2W+mp qfH6OWsqlmnZS1dc3to3P2TdvZSSxonqaqJ6jE3kZ8AsmUcSV9y68UcVTNiWOS1FuSRqL2NVPNHF 2qfnSJZm/wD3YHOyTjH8q7o5bYs71PsV5pcfV7eZ96wimgpGK5dmslfDDG+JVVdkRz2uVehtrgT8 oZjvFolThGVWWmxnUG203en0cEqupLlAioj5aZXqrmq1VTmicrlRFRyOcnNy6tzDFLFneKXfC8no Y6203yimt9bTyNRUkhlYrHJ1/Mq7L6lP88HCNkN10w4w9NKq31TmzUuZ0dnqHsVU54KioSlnTp6l jlem35wPUvyqfEnrhw341p7ddFs49jst6rrhT3FfNtHV9u1kcLo/9sxScuyuf+Dtvzdd9k2oXBPK dcQFfw82TG8XtdRqbrnkN0uKJ3axtlWgtkXJyTLSUUbEkequejE5dvQc5++yNdMPLhf7g9K/+N7l /qYTtPImYBYqTR7OdUe5xOvV0yRbEtQrUV7KSmpoJkY1fFqOfUuVyJ48jN/wU2DLuJeVa4z9N8/7 DVerpcgpaKq7K6Y9dbDT22eJqL6cbXQxRyRSIm+yvRyIu27V8DTnEz5SXVXKLlR4NwNYZccnqG2a kvd6vlHYpLrLQNqYWzRwthY17GOYx7e0dIjkR/MzZFY5TP3locXtVn4l8dyG30scNRfsSp5a5WN2 WaaKpnibI75Xdm2Nn8kbTc3kosBseIcG2MZBb6OJlxy+rr7rcp0anPK9lVLTxIrvHZsUDNk8EVXf Ku4Yk4dPK4a945qPbrRxEXOhybFa2rbSXKoW1wUVbbWudyrMzu7GNcjF6uY5iqqIqIrV6nq/r3k1 8xPQXUXM8PuaUd4s2I3e6WusbHHMkNTDRyyQyI16OY9Ee1q7ORWr60VDw38pni9qxTjY1Ho7NSx0 1NWzUNzdGxuydtUUMEszv5XSvkev53KewuXVc9w4Ab1X1UivmqdHqmaRyrurnOsrlVf8qgedHCz5 U3W+hze/XriO1KdkeLWrGq2sp7XHaLdRy1dwR8SU8Ub4IGP5nOcrfFWojlcqbN6dBqt5STyh2P36 lyS9W6p06st3VZ7VbKvD2R01RAmypyTVkLpZk2Vu7mvRF33RE3RCq/Jsaf2LUbjJwG05LRxVlvt0 lXeH08rUc2SWlppJYd0XoqJM2N2y+PLt6z1N8q9i9qv3BPl92r6WOSpxyutVxoZHN3WKZ1dDTOVF 9W8VRIn84FL4X5XFl04Z6nKLlh9HX6xw3SHH6DHqFJFguU8zFdFWJGirIkSI16OjaquWRrWorUkR W5gyfylnlDdNs2Ymok62GV3LVJjl8w6KhjdCqrt0fEyp5F2VEd2m/TxO58jPgFjyjiSvuXXijiqZ sSxyWptySNRexqppo4u1T86RLM1P/HNH+W2xe1VOimA5pJSxrc7dlLrXFPy+mkFRSTSSN3+TmpY1 2/MBrrhK4jrLxT6J2nVW10CW6skkkoLvb0k50o6+LbtI0d62qjmSNVevJI3frueZfGT5QXi80p4n NQNPMB1c814/ZLm2noKPzBa5+xjWGN23PLTOe7q5V3c5V6l8eRHq536Mah0DpFWGHJ4pmN36I59I xHL/ADoxv+Q8/wDyhnx0dVv+OW/1eID1e48834wsW05wrIeFZ9xWrVtTU5NNSWuiq+SnbBG9r3pU xvRib9ovoIn/AFHjNw/XvXOm1vsV90DfW1WpTpauW1vhpoaqeSR9NN3h3JUNdG9VhdMq8yL61Tqi Kf6JMv8A7Sl7/wCS1T/VHHhl5ML48+mP/CXb9U1gHrFwk6k6/wCO8N+U6i8blRXW69Y9cbhXTTV1 upaWSO0Q0sMiOSOlY1jvSSfborlXp16IYdyPyn3GRxC6gVOIcKGnqW2maj5aSmo7O263NadrkTtq h0iOhjTq3fZiNarkbzu6Kvp1xKaZXLWXQTPNL7LVx01yyKyVNHRSSO5Y+8K3miR6+piva1HL12RV 6KeF2hWuWuXk+NZLytXgcdNdpaZbZebHf6aSPtYUkR7XxvaqKi7t3bI1XMciquzkVFA0TkPG15UX hvmoch10xiSos1VOkLfP2MU0NJK/ZV7JJ6JsfK9Wo5URXb9FXZURT0j4ROKjEeLbSqPUHHqB9quN FULQXq0SypI+iqkajtmv2Tnjc1yOY/ZN03RURWuRMW27yuPDhrPYXYHxK6AXCCzVskTqiON8N5ol fG9Htkex7YnoiOai7Na9fV1N28OjeG+44IzLuGWzYdSY1enIss+OW2GjSaWNFTlqGMY16SsRy+jI iObzeCbgWodVlWT2LCsZu2YZPcI6C0WSimuFfVSb8sNPExXyPXbquzWquydTtSI6tu01ZppkcusK 25MLjoJJL35x37stM3q5HonVyLsicqbq5dkRFVdgPKjOPKpcVWuepTcC4UsKhtUNZO+K008VrZcr vVsaiqskvac0MacrVeqIzZib7vcibnVX3j+8pBwxZZbaTiHscFZDXtWeKhvtipaVlXC1UR/Y1FE2 NOZvMm/V3Kqt5mrvsskofKIcG+iufyXfhl4NG1VwayShhu6VMdqmnjcqcyRsbFO/ldyptvyu28UT qhTvHhxv3nixxDF7HeuH+uwN9guUtXDX1V1fV9ukkXK6JqOpYeXfZrlXmX8FOnrA9i+HHXvEuJbS Oy6tYdHLTU9ya+KqoZnI6Whq415ZYHqnjyr1R2yczXNdsnNseYHG9x9cXWjfFNnum2n+rfmvHrNV UraGj8w2yfsWSUcEqp2ktM57vSkcvpOVepf/AJE+pnfw65pSPkVYos0lexqr0arqGk32/wDRQwF5 TL48WqH/AJTbv1ZSgaM4pfKfcRl71VvmLcL1V5rxfF5Fo5bjR2SG5T1srOksznTRysZFzo5rOVqb tbzK5ebZu/NceLPFeGfh4smrOona3S8Xa30kdvtcKsimudwkga9zU6bRsTq57+XZqeCKqtasg4RN JMY0X4dsGw/G7ZBSvfZaSuuU0bER9XXzQtknmevi5Ve5UTffZqNanRqHmd5bLLblXa84Pg753rb7 RiaXKKPdeVJ6qrnZIu3h1ZSw9fzAcrF+N3ynXFJdLncuHnF6ejtVul5JY7PZKOSng36tjfU3Dna6 Tl2VURyKu+6NRFQlGi/lTddtK9VW6TcaeJMhhbUspK+4ebe4XG1uftyzSws2imh2VrvQa1eRedqv 6NWquFXyo9LwvaKWbSC28PsF6fbpqqpqrp7Je6OrZpp3yc7o0pX7K1isj/CXpG3+RKW41eLWg4wc 5sees0thw6vtVsW11CsuvflrI0ldJGqu7GLl5VfIngu/N6tgP9DdPUU9ZTxVdJPHNBOxskUsbkcx 7FTdHNVOioqLuiofQzv5PXMa/O+DLS2+3Od01RFaZLWr3u3craKplpGbr8vLA00QBgDywul2fal6 S4I3T3Bsgyiut2RSrNT2a2TVssUT6Z/puZC1ytbzMam6ptuqJ6zi6TaQ57R+SLvOnVxwW/0uV1lk v0yWKa2TMuCzecJ3xM7ure0VzmsY5qcu6o5qp4oehIA8yvI16Pamab3HVi5akac5PirquCywUPnu 0VFCtSiOrHS9n2zG8/L8Hzbb7c7d/FC8OPvygNBwjU9uw3ELFSX/AD6+Uq1sNPWPclJbqXmVjZ50 YqOkV72vRsbXN35HKrk2RHbFMJceWrnAfpNl7KrWzSC3aiajV1HEqUEFMySohpk3SJaiZ7kbCxev Kicz18eXZeYDK+P8VflbdT8Tl1ZwG13SfE0SWVktuxK3vglZGqo/sWyxOmma1WuTdiu6tVN90UvD gO8qPkWs2oFv0V15tVrgvN6V0NlvtujWCOoqEarkgqIlVWte9EVGvZyoruVvJu7mIjhnlf4cfx2i xnTLgprI8dtELaShp6DJXJFBG3wYjWUDkbt8m6mCdHb++5cXOE5PRW1bO6s1GttdFRo7daTnucb0 i32bvy78vgnh4J4Af6E9aNXcQ0I0wv8AqvnNQ+K0Y/S9vIyLZZZ5FVGxQxoqoivkkc1jd1RN3Juq Jup5C3HynXHZrtqIlh0Gt8dpfVvctBYbFYIbpUdi3rvLJPFIrlRPwnojGp47NQ0/5a3Jq63aA4Zi 1NM6OC85Sk9SjVVO0bT00vKxflTmla7b5WN+QiHkQsKtDMX1M1FfSxvuk1fR2WKZzUV8UDI3TPa1 fUj3SRqvy9m35AKl4jOMbiBvvDZm/DnxfaYVmNZhdoLdXY9dXWx9G25tguNM+aN7OsbnIxHuSSLZ voK1Wo7ZV77yIP8AbO1N/wCIaL+sONU+VywWzZPweXjKq6ljdX4ddbdcKGdWpzsWapjpZGovjyub UbqngqsavqQyt5EH+2dqb/xDRf1hwGvvKA8eNJwi2O241iVqo71n+RQvqaOmq1d3agpEVW95na1U c/mejmsYipzKx6q5OXZ2HdKuNjyp2qUtTm+nVlrsysVBMrZ6emw6mfQK5OqwpJHG2VzkRU3a2VX7 KnyopUvlRsmrsj42c9hqpnOgszLdbKRiqq9nEyihe5E/Mskkrv8A7pT2k4UsKtGnvDXpnitlpY4I KbGLfNLyNREkqJoGyzyL+d8sj3L+dwHiVx58SUXE9m+G5nXYxU43kdmxrzDkdnnY9q0dxhralz2t 50R3KrZGO2cnM1VVq7q3dfXjycXxJ9LP+Lan+uznmr5Y3BbNinFTQ5DZ6WOnflmMUlyr0Y1E7SrZ NPTrIqJ61jhh3X1qiqeg/BXmUWnXk4sV1BmoHV0eMYnd7y+lbJ2bp2001VKsaOVF5Vdybb7Ltv4K BrYHmB7+Li34ut1/9ZI/u5pHQnjlp+Irh31P1osOCz4zLgdJcFZTVFc2r7aSChWpa/dGM2TfZNtl 8AKV42/Krs0ZzC46RaDWS2XzIrRI6mu96uPNJRUVQnR8EUTHNWWRi7o5yuRrXIrdnqi7Z691j5XH 2Ne2f5hyf2L9j3ztfYHS937vtzdr/tftey5evPvty9d9upnXgYwy3avcY+nOP5kzznTV96lulc2q XtEqnU0EtWqSc2/Oj3Q7ORfFFXfxP9E2ybbbdAPObgj8qsus2Z23SHXmyWyy5DeJG0tnvdu5o6Os qV6Mp5onucsUj12RrmuVrnKjeVqqm+jfKCaraiaJ8LOUak6WZF5kyG1VVubBWd0gqeVktZFE9Ozn Y9i7tkVOrd09Wx4vcamJ0WkXGFqNY8MTzZBbMg8429tL8GlI6ZkdU1I9vwUY6XZqJ4I1PkPVjyie RTZf5N+75ZUMayW9UGN3F7WpsiOmrKSRUT+dwGWeGjyqmrFk0/1Jv2uWRuz/ACSOSz0OE2WO3UlG +esnWrSbfusLHOjRGRK5VRy7o1rdlk615qH5RfykGDX+mu2cxVmEUtxVZqO1XLCI6OmmjRUVUjdV QrM9qbom6SqvXxO28jRppjuX8QmQ5tfqGGrnwyxJPbGytRyQ1c8qRpOm/wC+bGkrU+TtN/FEN9+V DxCzZVwWZ1V3OjilqbAtDdbfM5qK6nnbVxMc5q+pXRSSsX8z1A+3AHxpw8X+AXOS/wBppLRmmLSw w3ilpFd3eeOVHLFUwo5Vc1rlZI1WKrlarfHZyGB/LX/GVw//AJDU39frTleRMrKhnEBnNvbIqQTY c6Z7N+ivZW0yNX+ZJHf5Ti+Wv+Mrh/8AyGpv6/WgbD4ffbUj8lnj1fonkElmza3YxV3C0VEdHBVO kkgrJpXQJHOx7HLKxj403b0V6KipsZ48nf5Q3XzVPiQt+l+vGocd/tGTW+qpra11poaPsLhG1Jo3 c9PDGq8zIpWcrlVFc9vrNqeTn+JTpX/xXP8A1yc8i+K/BLvwa8b1dcsTpu60trvtLmWNonoxrSyT duyJP7xkjZYF+VI18QPfHJ8itWIY1dstvtQkFtslDPcayVf97ghjdJI7+ZrVU8eeGbjo44uI7iax bTe36trRWS+Xp1TW0sOPWpyUlqjV008aSOpVf0hY5jXOXdXK3qqqbB8pNxA2m18C8l/xO4czNV4r fbrVK1fSdR1cfeZXbJ6nU0b2L8iyIUH5FDRT/dvxBXWk/g4vZ3ub/wCJPVvTf/Bmo5P/AAifKBx/ LCaKar6i6vYLf9O9MMsymCLG5KOpmstlqa5kL21Uj0a90LHI1VSRVRFLT409IM9yHya+mWA4xgt/ u+QY/R4s2W00FsmqKyJ0NvWGVHQsar0VquVHbp09Z6EgDE/kktOM00z4ZLvac8w+9Y1dK/MK2u7n d7fLR1CxLS0kbX9nK1ruVVidsu2y7KbYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA/zfcaPxttX/wDlldf6w8/0bWn/ALVUX/k8f/woedOtPkd/bf1by/VL3RXmn2V3mqu/cfYj 2/du2kV/Z9p31nPtvtzcrd/kQ9G6SDutLDTc/N2MbY+bbbfZNt9gPsURx2fE91b/AOTFV/1IXuQT XbS/269Hst0n8+eZvZTbJbb3/u3eO7c/7/sudnPt8nM3+UDyB8jP8bS5/wDIu4f1mkLu8uV/2t0a /wCHv/8A8NAXdwZ+TT9yNq1Vao+3T7K+82WotHcfY53Hl7WWF/adp3qXfbsduXl683im3Wb8cvA9 7tCmwyn9s/2HexF9e/fzL5w713lIE2/d4eTl7D++35vVt1CAeRz+KHL/AMrLj/q6c0nxI8QeMcMe mNRqtmON5DebTS1cFHPHZKeKWWFZVVrJJO1kja2Pn5WK7dV5nsTZdyPcHPDJ7kzSF2lXs39lXNdq m6d/829x/dWxt7Ps+1l8Oz8ebrv4JsW9lWLY7m+OXHEMus1LdrNd6d9JXUVVGj4p4nJs5rk//H4o uypsqAZL0d4tuDvjmtF0tmoOJ4rR19qqewgs2bsoZKienc1FbUQLJun4SvaqMVXNVqKu3M1Vyz5S Dhs4G9ONJ5810kutjx7PEradlHZbPe+9MuMb5ESbmplkf2TWRq5/OxGN3ajV3VyFoaieRP0iv11n r9NtWshxOmmer20NbQx3SKHf97G7nifyp6udznfK5TrsM8iFp3brlFUZ7rrfr7Rscjn01ss8VtdI iepXvln2RfXsm/yKniB/PIg1OUyadan0ta6dcchvNvdbkcq9mlY6GXvSN/PyJSb/AMrTEflLYpIe N/VBkrFaq1dA9EVPFHW6mVF/nRUPeDSzSrANFsJt+nemeN01ksVtaqQ08O7lc9erpJHuVXSPcvVX uVVX5fAzTxi+TY054sMrh1Fp8xrsMyxKaOjq62CibWU9bFH0jWWFXxr2jU9FHo9PRREVF2TYLy0L 1r0o1MwTE1wvULHrpV11kppm0FPcoX1bOWFnaNfCjudrmKuzkVqK1ei7FomKuD7yZ2PcKGpa6pe2 1ccpubbfPb44PNLKGBGS8vM5U7WVyqnL09JPH1m1QMq+U00lvOrvCLlFDjlHJWXTG56fI6emjarn ytplVJkaidVVIJJnIidVVqJ6zzr8kpxGYNojrJkWK6jX+ksVnzm3QQQ3KslSKnhrqaRzomyyO2bG 1zJZk5nKiI7lT1nt6qIqbKYV188kVoJq1kVZl2CX65adXK4SOmqaagpo6m2ukcu7nspnKxYlVd/R ZIjPkagEp42vKDYRw7adwz6UZVh2WZ7cqqFlDbFqe/QQ02+8s9Q2nla5reVOVm72qrnIqI5Gu2+X k7OK3X3i1s+W5jqliGJ2fHLRNBQWuos1FVQuq6tUc+dqrNUSorY2LFvsidZU69FQpzAfIkaaWe8w 12o2tV8yagiej3UNvtMdr7VEX8B8iyzO5V8F5eVdvBUXqehmC4JiGmeJWzBcCx+kslhs8KQUVDSt 2ZEzfdeq7q5yqquc5yq5yqqqqqqqB/nnz3Fck4NuLnutfa5e20/y2mvFua/dra2ihqWz0z2qvi2S Jrf5FVyL1RT3Zxfi34a8twSn1Gt+tWIU9mmpkqJFrbvBTzU26brHNE96PjkTwVipvv4b7pv1nE1w daJ8Vtop6TUuyzw3a3xujt99tsjYa+laqqvIj1a5ske6qvI9rmoqqqbKu5iur8hxj77gstDxH3CG h5lVIZcXZJKjfUnaJVNRV/PyfzAYl4wtU3cW/FvfMg0zt1XdKa9VtJYcbp44ndtWMjYyCNzWL1Tt ZEc9EVEVEeiLsqKeuOvmnntS+TayXTJ0zJpMY06Za5pWLu2WaKBjZHp+Zz0cv85zuF3yeegnC3cW 5XYKWuyTLkjdGy+XlWPkpkcmzkpomNRkO6bortlfsqpz7KqFya7aX+3Xo9luk/nzzN7KbZLbe/8A du8d25/3/Zc7Ofb5OZv8oHkD5Gf42lz/AORdw/rNIbn8rt8TS6/8fWv/AFqnE4M/Jp+5G1aqtUfb p9lfebLUWjuPsc7jy9rLC/tO071Lvt2O3Ly9ebxTbrenF3w4e6p0Zq9I/Zl7F+9V9LXecPN3feXs XK7l7LtY999/Hm6fIoGDfIaf7d1n/wCCx/8A67gSry3/APa50v8A+O6//URmg+BngT9xfPmc3tp+ zH2Xst7dvMfm/uvdVqP/AOYm5+bvH97ty+vfp23HBwYe7LxzF8f9sn2IexutqKztvM/nDvHaxtZy 8vbxcm3Lvvuu+/ggFN+RY+Krkn/L2u/qFvPMvjc+OTqt/wArar/40PbLgs4VPcf6VXLTL2eey3zh f57533zX3Dk7Snp4ey7Ptpd9u783NzJvz7bdN1zLrd5IP25NZcr1b90N5o9k92lunm/2Jd47vzu3 7Pte+s59vl5U/kA9GD/OlwzfHh07/wDOPQ/19p/otPOjTPyQntda4Y7rN7oXzh5gyODIPNvsT7Lt +zqEl7Hte+u5d9tubkXbx29QG0OJP4umqf8AyKvn9RmPGHyTfx18V/4su39TkPcHUrD/AGw9Osqw Dzj5v9k1krrP3vse17v3iB8XacnM3n5effl5k3223TxMYcJvktfcva2WrWL29PZN5spqum83exju XadvC6Pfte9ybcvNvtyLvtt08QKn8uV/2t0a/wCHv/8A8NAXN5HP4ocv/Ky4/wCrpyf8cvA97tCm wyn9s/2HexF9e/fzL5w713lIE2/d4eTl7D++35vVt1mfBzwye5M0hdpV7N/ZVzXapunf/Nvcf3Vs bez7PtZfDs/Hm67+CbAeMvlLYpIeN/VBkrFaq1dA9EVPFHW6mVF/nRUPbzQvWvSjUzBMTXC9Qseu lXXWSmmbQU9yhfVs5YWdo18KO52uYq7ORWorV6LsUbxi+TY054sMrh1Fp8xrsMyxKaOjq62CibWU 9bFH0jWWFXxr2jU9FHo9PRREVF2TbreD7yZ2PcKGpa6pe21ccpubbfPb44PNLKGBGS8vM5U7WVyq nL09JPH1gbVKe4xvin6w/wDIi8/1SQuEh2senvttaT5hpf5381eyyyVtm793ft+7d4hdH2nZ8zef l5t+XmbvttuniB4w+SA+OLS/8m7n/wBUZ6RcWXlDdOeEnL6TBct07zG73S4W5lzpJ6OKnZQzROe9 myTPl5uZrmKjk7Ppui+tCC8H/kxfco6xRas+3d7KeyttTb/N/sa7jv2yN9Pte9S+HL4cvXfxQ0Zx HcLmkPFLiUOKaqWSaV1C90ttudFKkNdb5HIiOdDIqKmzkROZjmuYuzVVqq1qoFa0tt4AuLXD6HUC 84/phd5LxSsqamSd9LTXSme5qK6GeSNzJ2SNVVRUVydU3ToqKeTHlA9KeHPSLWmnx/huyqC6Weot ram40dNckuENsq1ke3sWVG7lXdjWuVjnOc1V6r1RE2VefIcY5PWukx7iNuVFSK70YqzGY6qRE+RX sqYkVfz8qfyFoaH+R/0A0yv9JlGoOQ3bUSsoZGyw0dbBHSW1XtXdHSU7Vc6TZUT0XSKxfBzXIBpb hGqcprOF/SyqzV07rzLiltdUOqN+1cnYN5HP3686s5FXfruq79S3D+Na1jUYxqNa1NkRE2REP6AA AA8rfLm/uWiv/jZH/wD449UjK3HPwM+7RbhTfbR9h3sPW4r/ANpPOHeu992//mIeTl7t/fb8/q26 hC/I+fE8h/5TXP8A/pGHfLHY3cbRxZU18qIHpSX3F6Geml29Fyxvlie3f5UViKqfI5vynqhwfcNP uUNHmaT+zX2U8lzqbj3/AM29x37bl9Dsu1l8OXx5uu/gh9OKbhJ0r4tMOpsZ1Dhq6Sutcj5rTeKB zW1dDI9ER6JzIrXxu5W8zHJsvKipsqI5AozgZ43uHeo4XMNsWc6sYzit9wuzw2S4W+83GKkmc2lb 2cUkLZFRZmviax3wfMqKqtVN0PMjygeutFxF8RFfqTjtJVMxXuUVqx2qqIXRLXUdM+RrqhqORF5X TrOqboiomyKiORUTcGM+RAwWiyCOry3Xu9XazMkRz6GisUdFO9u/4KzumlRPkVUj/k2LL4nfJXYb rtXYYzA9QoNObLhePMx6jtcGPrcGuibPLMkiyLUxLzK6Z6uVyOc5yq5XKqqBdnAP14ONJv8Ak7D/ APE48TeDL452lv8Ayzo/9ce9vD7pM/QrRjFNI5Mi8+ri9D3Lzj3TuveER7nI7sud/J0cibc6+G5i rRnyQftRaz4tq77obzt7GrzDd/N/sS7DvHZv5uz7XvruTfw5uVf5ALM8rd8S6/f8c2r+sIZn8hv/ ANv9YP8AyOyf/HWG/uLfh191NovX6Q+zH2Md+raWr84+b++8nYyI/l7LtY999tt+dNvkUrPgb4Df cY3DMK721fZh7K4aKLk8x+b+7d3dMu+/eJefm7b+925fXv0DWQAAAACMan59bNK9OMn1LvVHVVdB i1pqrvUwUqNWaWKCJ0jms5lRvMqNVE3VE39Zmbht8pjpFxN6qUWk2IYLmFruVdS1FUyouUdKkDWw xq9yKscznbqidOho/WPT322tJ8w0v87+avZZZK2zd+7v2/du8Quj7Ts+ZvPy82/LzN3223TxPKHg A0Wh0n8pVkOmtjylMppMAtl0hqrsyj7qkjkjihk3i7STk5Zplj2516t36b7IHseAAMLweVY4c8l1 WZonmeB5Hj1BUXCezXe4ZXBSQ0lFPHzNVtRG2STZnasRiucqI3fmdsiLtLNUuF3yb2f2OrvuSWnT SxQSxOlW8WS9U9qSLdN+1RYJGxOX1+m1yL60U+vFB5NHQbiXyOoz2WoueH5bVone7laOR0Va5E2R 9RA9OVz9kROZiscu3pK7oZsh8hram1iPqOJarfS83WJmJNbJt8nOtYqb/n5QMacI0E+PceuC2zSC 9Vd1t1NnK0VFXtarJKyzJM9k0r2oibI+jSRzk26Iq+Btby4uN3GqxbSTL4oHrQWy4Xe2zyonotlq Y6aSJqr8qtpJf/RU1hwtcBWhfCjNLfcOo6+9ZTUwrTzX68SMkqGRr+FHCxjWshYvr2TmVOjnOQtn WXRvANe9PLnpjqVZ/OFlujWq5GP5JoJWrvHNC/xZI1eqL4eKKitVUUPOzyS3Fpo1g2kF60b1Qz6y Ylc7feprrb571Wx0dNVUs8caOa2aRUZ2jJI3qrVciqj27Iuztqe8q7xP4fxBZNjeMaUV6XzFMEfM yvvtK1XUdRcqtEVsUcng9GR0zlRydHK5+26NRVu6q8h3iD76tRRcQ14is3abpSS49FJVcn8HvCTt Zv8An7Lb8xcmq3kuNLcs0BxvQXTHK5cKp7HfPPtVeKq2pc6u6TrTvhes+0sKcyo5myoqNajEajUR egRryK3xV8m/5fV36vt55ueUM+Ohqt/xy3+rxHs9wUcKD+D3TC76bLqB7LmXS/S3xKvzV3Dslkp4 IVj5O2l5v9rovNzJ+Ftt03XN+vvki1111oyrV2fiEWzpk9wWtW3JifeFp28rWozte+N5ujfwuRP5 ANBcM/GZojqnojYMpvOp2M2O9W+2QwZFb7rdIaOehq4o0bMrmSuavZq5rnNf4K1U67oqJ478futt j4jOKjIsuwSV9wscDaWx2eaNjt6uOBiNWRjdt1R8rpFb03Vqt6brselvEn5JbR3XDMa3P8Ky6u0+ vN2lWe4xU1AytoJ5l6umSBXxuje5d1dyycqr15UVVVeXwyeSj0b0DzKh1EyrKK/P8gtMrai2d7om UlDSzN6tmSnR0ivkavVquerWrsqN5kRUCyrVmdq4F+CrDLrqFjN/ucGH2K10V4p7LBFNNBVStakj lSSSNqRpO9Wq7m3TmToQjRvjI4P+OCku+Pag4njVBVWuZGUlpzllDJJVwPbv20Habt3R3MjmsVXN 2av75DXuQY/Y8ssdfjOS2qludpulPJSVtHVRpJFUQvarXse1eioqKqHntqV5FTRzI7vUXLTTVHIM Op6h6vSgqqNl0gg3X8GNVfFJyp6ud71/OBXXlFuGfgTwHRu551phc7BjWeQz0yWy02a99u2588zG ysdSLI/ka2J0j+diMRFaiKq7oi9x5Dupyl1j1ZpJ3TrjcdXaZKVH79k2tcyoSbk9XMsbYOb8yRnZ Yj5EDAaG4xzZzr3fbzRNcivp7ZZIrc96fJ2kks6J/wCiegOkWj2nWhWD0Wnel2NQWWyUSuekUaq9 80rtueaWRyq6SR2ybucqrsiImyIiIHgDq3jN94UuMa4RXC2SdphWZxXy3scnL3qjZVNqaZ7VX1Pj 5P5F3T1Ke7Fk4r+HG/aeRao0usuKQ4/JSpVvmqbpDFLAnLusckSu7RsqeHZ7c2/REVdiPcUXBZop xZW6l9sK21VDfbdEsNBf7W9sVbBGqqvZOVzXNli5lVeR7V2VXK1Wq5VXGi+Q3sPnHtU4kK9KDm37 BcWZ23Lv4dp3rl329fJ/MBeuhPlSNJdftVrZpHh+l+fLdLxUyRU9UlPSvpo4WI5zqiZe3R0caMar l9FVTwRFVURcu+W506ucGc6d6txUz32+utM2OTzIi8sU0Ez6iNrl8EV7aiVU+XsnfIb44XOCzRXh NttUmntuq66+3GNIq+/3R7Za2eNFReyarWtbFFzIi8jGpvs3mVytRUsPWXRrT7XvT+46Z6mWRtys txRrlRHck1PM3qyaF6dWSNXwcnqVUVFaqooYm8lHxU6VO4d6PRfMM4s1gyLDqysbBT3Stjpe+UU8 76hssTpFRH8r5ZGOaiqrUa1VTZyGcvK8cS+C6x5hiemuml/pL9bMLbVVF0udBKk1I+uqeRrYWSt3 a9Y2QuVVaqpvIqb7tciXBXeQ6xKS9uqLbxD3eCzrJu2knx2KapRnyLO2djVX8/ZfzFYeUo4XtLOF Th901wnTKgqVWvyGsqbpc657ZKy4zNpmo10rmoiI1qOcjWNRGt5l2TdzlUNH+RX+Ktk3/L6u/V9v PNfjzsN2wzjN1ShrInwTy5HJdoFcnjHUo2oicnypyyNPSjyK/wAVbJv+X1d+r7eXBxe8AWkvFzLR 5De6+uxrLrdT91gvdvjZIssCKqtiqInbJK1qucrVRzXJuqc23QDk4r5QzhRvektHqjd9YsbtUjqB lTW2OatZ51p6jk3kgbSb9tI5HbtRWtVrtt0VUXc8MeIrUC66r63Zjqbd7RUWt+VXJ13pqSobtJFR ztbJSovy/wBjuiXmTo5F3Top6jaVeRX0qxPKKa+am6q3XNrfSSpM21QWttshn2XdGTOSaV7mL60Y rFX5TtuJXyStv1/1ov2rFq1shxGlvMdDFFZYcUSpjpG01HDTI1j0q405VSBHIiMTbfbrtuBbvHjp Vd9X+B7IrDjlHJV3a12yhvtHBG1XOlWlVkkrGtTq5ywpMjWp1VytQ84PJN8QuDaIa5XqxajX2lsl nza1MoorlVyJHTwVsMqPhSV7vRjY5rpW8yqiI7kRdkXdPbuyW99ostBaZKjvD6Klip3TcnJ2isYj Vdy7rtvtvtuu3ymJeIHySGgusOSVmZYRfbjp3dbjK6argt9NHU26SRy7ue2mcrFjVV33RkjWfI1O u4W7xH8dugnDjidPkFyyigym41tRHDS2Sw3CnqKyVjurpVRH7Mja3deZ2yKuyJ1U7fhS4tcQ4ucZ vGWYRhOWWS3WarZQyVF6p6dkVTO5nO5kDopXq9WNViu3Ru3aM233XbImEeRE06td3iq9QNcb7kNB G9HOo7bZ47Y6REX8F0jpZ12XwXZEX5FTxPQvTzTrCtKMOtuAaeY9S2SwWiLsqSjp0Xlam+7nKqqr nvcqq5z3KrnKqqqqqgeAXlDPjo6rf8ct/q8R/oQx7/tBbP8AyOH/AOBDz/4hvJHe3zrRler3ugvM fsnrUq/N3sU713faNjOXte+M5/wN9+RPHwPQi3UncLfTUPadp3aFkXPttzcrUTfb1eAHgX5Ur49W pP8A4tm/VFGe0tgikqOFW3QQsV8kmn0LGNRN1cq21EREMscUvkpvdK665LrV7fPsc9kKUSebPYt3 zsO70cNP+7d7j5ubseb8BNubbrtuu5MLxtMRwyxYitWlYlltlLbVnWPk7bsYmx8/JuvLvy77brtv tuoH+fbyfmdYtptxh6b5fml5prTZqasq6eoraqRI4YFqKGop2Oe9ejW88rN3LsiJuqqiJuf6C8az HEczppq3D8ptF9p6aXsJprbXRVTI5OVHcjnRuVEdyuauy9dnIvrPPfVTyLGm2X5rX5Jp5q7cMNtV wqH1K2eWysuEdMrl3VkMnbxK2NFX0WuRyomybqao4POE+xcIOnNx0/seX1+R+dbq+71NXV07INpX QxRcrGNVeVu0SL1cq7qvUC+DyW8tppLeW5VgeuNHRyTWua2uxeumY1VbTzRTSVECO+TtEnn2/wCC X8x60kfz7AMN1RxC5YHqBj1Je7Dd4ewrKKqbuyRu+6KipsrXNVEc1zVRzXIioqKiKBhLyUvFTpXL w60OjOYZxZrBkeG1dYyGnulbHTLWUU876hksTpFRH8rppGOaiqrUY1VTZyHQ8ZnlYbnpHqbT4Nw3 +wTMqGio+a83OtjqKyBKxz12hgkp6iNjkaxEVypzJzO23RWuQZ35EfTS73aas071rvuN0Mrle2ju NpjufZbr+C2RssC8qeCc26/Kq+JYXD75I/QbR/I6PMc6v1x1FutukbNSQV9Mylt0crV3bI6ma56y Kip0R8jmfK1eioEi1MxXWXi68nJcG6gYzbbdqFk1lZkNLabVTzQxo+GpSqpYWslkkekksEbGqjnd HyqnTbp5t+TI4hsV4cuI+V+pFe204/lNrlsNbWVCK2OgqO1jkhll9bWo6NY3KvRvacy7I1VT3rMc 8S3ku9AeIXIqzOrdUXDBsouD3S1tXaGRvpayVfGWamdsivVequY5iuVVV3Mq7gWXrtxo6CaL6Y3X Ol1Oxe817KOR9ntduusFXUXGpVq9kxjInK7kV3LzP/Bai7qp43+Tv0iyHWvi5wyqhppp6HFrpFld 5rOVeSFlLIk0fOvhvJO2NiJ6+ZfUi7bNsfkOsSp7i2XJeIi719Ajt3QUOOxUkyt+RJXzytRfz8i/ yG79AeG7SPhnxB2HaT4023w1Dmy11bO/tqyvlRFRHzyr1dtuuzU2Y3deVqbqBhjy4X+4PSv/AI3u X+phJ55Fr4qmRf8ALyv/AKhQFv8AHDwW+7MsOK2T2yvYf7Gaupqu18zecO8dsxjeXbt4uTbk333X ff1HfcFnCr7kDSq46Zezz2W+cL9Pe+/ea+4cnaQU8XZdn20u+3d9+bmTfm226bqHnV5bX+3xgf8A yR//ALyc3t5NH4j+l3/klw/WNURLja8nd7sbPLDm/twexHzJaPNXdfY/3/tvhpJe05+8xcv7pty7 L4b79di++GjRX3O2h+L6M+yX2QexuKoi85dz7p3jtamWbfsu0k5Nu15fw135d+m+yB4u+VY+PBnP /kln/V1OetGQ/wDc9Ln/AOZmb9RqUfxWeSu905rhfNZvb29jfnqKji82+xfvnZdhTRw79r3uPm5u z5vwE23267bmtLjpH3/h6qdBvZB2fecMfiPnXum/LzUK0veOx5+vjz8nP+bm9YHi/wCSZ+Oti/8A xXdv6nIennlQ/iK6m/8Ai2f9b0ZWvCZ5Lb3Lutdr1h9vP2TebaWrpvN3sY7l2nbwuj5u173Jttzb 7ci77bdPE09xQ6G+6S0KyfRX2Uex32RpRp5z7l3vsOwrIaj9x7SPm5ux5fw025t+u2yh5m+RF/tw 6i/8moP6000B5a74suIf8u6X9X1xYfBF5Pb3G+YZHlntu+y/z/bI7d3fzB5v7DllSTn5u8y83htt sn8pYHGvwm+7D0ytGnPs+9iPmq+xXvvnmrv/AGnJTzw9l2fbRbb9vzc3Mv4O23XdAy55ET+1JqR/ yjpv6shgXyhnx0dVv+OW/wBXiPY3gh4N/cbYlkmLe2N7L/ZDcY7h2/mjzf2HJFycnL28vNv477p/ IUFxDeSO9vnWjK9XvdBeY/ZPWpV+bvYp3ru+0bGcva98Zz/gb78iePgBtzKYpKjRm7wQsV8kmMVD GNRN1cq0jkREPBDyfmdYtptxh6b5fml5prTZqasq6eoraqRI4YFqKGop2Oe9ejW88rN3LsiJuqqi Juf6GrfRpQ26mt6vSRKeFkKuVu3NytRN9vz7HnRqp5FjTbL81r8k081duGG2q4VD6lbPLZWXCOmV y7qyGTt4lbGir6LXI5UTZN1A2RqrxM6Z6XaSX7WiCrlzSw41JFFcW4nNTXCaF0jmNTmTtWsRE7WN zt3bo1yO22KG0b42uEPjYW8YhqBieP22S2OYtFbc7ZQyd/iei8z4EkVzOdqp1a1yuTdq+HhZ3Cpw b4bww6R33SJb7NmVuyaumrbotzoo2RTpLTxwPh7FFcnZqyNN0crt+Zepm/VHyLWiuU3mpu2mepF/ wqGpesnm+elZdKWDdfwYuZ8cqN/M+R6/nAgvlB+GLgLwrRa953p9ccdxXOaZYXWmgst7SVLlI6Vr XRLRrI9EbyOe7njazl2RVVUTlXg+Q8qcpWt1Xo0dOuNtitcqo7fsm1yrOicnq5ljRebb1NZv+9JJ ivkPcHo7hHLmuv8Ae7tRNcivgtliit8jk+RJJJp0T/0VN+6MaI6acP8Ag1Np5pXjcNntFO9ZpERy yTVM7kRHTTSO9KSRdkTdV6IiNTZqIiBOjEvlf6i+wcHVVHaHSpSz5JbI7pyeC0u8jm835u3bB/Ps baI5qJp9iGq2E3jTvPbNFdbBfaZ1LW0siqiPYqoqKjk6tc1yNc1yKitc1FRUVEA8hPI5ZxoxhOpu dz6k36wWS/1VrpGWCtu9RFTokSPl73HFLIqNR7t6deVF3VrHeKIp2nlbuJ/Ataa3G9K9JrxBk1vw 2We7X67253b0cc8vJDDEyZu7HI3mdzORVbzSsai8yORLRv3kPcKqr9JU4zxA3m3WZ0iuZR1tgiq6 hrN/we3bPE1V/P2X8xo/EPJucOmHaB5PoRR0FxqY8xii875BUSMW5yzwvSSCRjkbyRtikRHNjRvL 483NzOVQoDyKWW4zT6PZzilTfqCG7+yplW2ikqGNmfFLSwsY5rFXdyK+J7eieKbGHvKZfHi1Q/8A Kbd+rKU33ob5IDH9HNX8c1UqddrhemYxdIbrR29lgZSq98T0cxskqzybpuib7MRV9WxyuJnyTnui 9cco1m9v32P+ySWmk82+xXvfd+ypooNu175Hz79lzfgJtzbddt1Db+mP9rbE/wDiOg/q7Dy68trp TeGZbgOttLRyS2yotj8YrZmtVW080UslRAjl8E50nn2/4JfzHqxjFm9jmNWnHu894810MFF23Jyd p2cbWc3Luu2/Lvtuu3ynXaiadYVqxh1zwDUPHaW92G7xdjV0dS1Va5N92uaqbOY9qojmvaqOaqIq KipuBiLyVHFFpXX8N9q0dyXNbPZMnwuorIe6XKsjpn1dJNUSVEc0XOqI9GrM6NyN3VvIiqiI5qrM dc/KscOeieoa4DDTXXN0p6dklbccYmpqmmp5nOciwcz5Wte9qIiu5XKicyNVeZHIlQ5v5EXTm63a ar0+1wvuPUEj1c2juVojuaxIq/gtkbLAqongm6KvyqpY3D75JDQfR3JaLM83v9y1Du1tlbPSQV9N HS26OVq7tkdTNV6yKipuiPkcz5Wr4gbJwHLo8+wmx5vDYrtZYr7QQ3CKgu0TIqynjlajmtmYx72s fsqbt5l232XZd0O/AAAAAf50ePOovtTxi6syZE6VapuSVEcfaePdWo1tNt+bsEi2/Nsf6LjJPF55 OHSbiuv7M8kvtfh+ZJAymnulFAyohrY2JszvEDlbzvaiI1Hte1eVEavMjW8od6nGJwiaN8Pdqy3G 9QsWSw26yQpZ8ftVdC6ulVsSclKymYvO2Tm2a7maiMXdXqmyqeH2n+UzRcSuK59myJa+2zS3X+4u nasbYYpK2OodJ6XgzkdzIq/vVRfA9S9GfIy6P4JlFLkeqGoly1AhoZWzRWtLa220czkXdEnaksr5 Gf3qPai+C7puiyriu8lZgHEhqPLqhjmodTgt1uEMENygitDK6lqFijbGyRkaSxLE7s2MauzlavKi 7Iu6qHUeV9xBuo/CxbM9xGpgusGG5HT1lZLRytmYyknifC527N06SSU/8yqpnXyPXErp5pjdcz0j 1Hyi34+zJJaW52asuFQ2CmfURtdHNA6R6o1r3NWJWbqm/I5PFWovobw0cIuHcPGhNfoNW3Z+Z2e8 1NXUXN1yo2Rx1KVEbI5IuyRXIjFbGnRXKvVepk7P/Ik6b3vIp7lp3rTeMXtM8iyNttbaG3NYEVd+ Rk3bRO5U8E50c7bxc5eoH78rRxV6Z1+iXtE4Dl9ryO95DX0tVdm2uqZVR2+hp5ElRZnxqrWvfM2F GsVd9kcq7ejvVPkQf7Z+pv8AxDRf1hxpey+Sb0bxjQvM9LrBlde7Kc1pqWlqcvuNEypkpYoKyGp7 OCma+NGRudA3mTn5l6buVERpJOCLyfL+DbL8jylNX/ZezIbbHb1pvY/5v7FWSo9H8/eZeb1ptsnj vv6gPOXytOnVzwzjCveTT0z22/NbdQXail2XkcscDKaVqL4cyPp1cqeKJI1fWh6WcFHF/orn/Dbh 3nvUvG7JfcXslLaL5Q3W6Q0k0EtLE2JZlbK5N45EYkiPTdvpKm+7VRLO4m+FbSriuwqLENSaKojn oJHT2q7ULmsrLfK5ERyxuciorHIjUcxyK13K1eita5MTWjyHeHQXttRfeIW8VlnR+7qSkx+KmqVZ v4JO6eRqLt6+y/mAx75SriBxriI4lKnIcHrO/Yzjtshx6217EVI63spJJZpmb+LVlne1F9bWNXwV D1Y4CcbsuZcAWBYhklH3y0XzH7jba+n7R8fbU01TUxys5mKjm7tc5N2qipv0VFKs1/8AJJ6e6qw4 ZatNNQGaeWjDrM60spfMS3J9Y5075nVEkq1MSrI50juZVRd9+myIiJqvhp0Xfw86IYvo3Jk/siXG oZ4fOXcu6duklRLMnwXaScmySI38Nd+XfpvsgVF71xwJ/MZ9Jrx97LLwPhS0S0m0zyzSrSrElxyx 5jBUxXKJtfVVavfNTrA56OqJZHJ6GybIqJ08C3wB/nM0fv194NeL2xXTUG01FPV6f5E6kvVOxiq/ uzkdBO+JF250dDK57F8HIrVRdl3Pduo4sOGmlwn2xJdc8L8w937ylQ27wukc3bfkSFHdqsnq7Ll5 9+nLv0IZxR8CGhXFa6K8Zpb6yz5RTRJDDkFneyKqdGn4McyOa5kzE9XMnMibo1zd1Mis8hvYUuHa ScSFe6h5t+xTFmJLy7+Had6VN9vXyfzAYPz+uyPjR4vLxVYLap3VuouTLFa4XsVXQUiuRkT5dt+V I4GNfIvg1GOXwQ9b/KZ2Sjxnyf2U45bubulqZYaGDmXr2cVfSsbv+fZqFicL/A7oXwoxTV2B2qqu WR1kXYVWQXZ7Zqx0aruscfK1rIY1XxRjUV2ycyu2TaT8VWgfumtDr9oz7K/Y357lo5POXcO+dj2F THPt2XaR83N2fL+Gm2+/XbYDzg8iB/bJ1P8A+I6H+sPNz+Ud+JPqn/xbTf12AivBB5P/ANxrkuT5 D7bXsv8AZJQwUXY+YfN/d+zkV/Nzd5l5999ttk2+UvTiP0c90DonlWjvsj8w+yamip/OPc+9d35J o5d+y52c+/Z7bc6eO/q2A8rPIn/GNzT/AJEzf1+jPn5a/wCMrh//ACGpv6/Wm0uCfyc/uO9R71qB 7cXsu872R9n7p7Hu4dlzTwy9pz95l5v3Hbl5U/C336bL+eNfycnuw9S7PqJ7cfsR802KOy9z9j3f +15Kiebte07zFy79vy8vKv4O+/XZAsDyc/xKdK/+K5/65OZ08s7ob7KNKcc12tFHzV2GVnmy6Pa3 qtuqnIjHuX5I6hGNRP8A+YcbT4c9HfaA0UxXR72RefvYzSyU3nHunde8c0z5Obsud/Jtz7bc6+G/ 5joeMq+af2Dhd1Lq9TXMWxTY9V0r4lejXz1Esasp44lX/fVmWPkX1O2XwQDwr1W4hbxqpoPo1om/ vE0mncNzgkVEVe8vqKlO7NRPWscLWsbt8qnu9wm6MxaA8PGEaXLA2OutlsZNdFbt6VwmVZqld/Wi SyPai/wWtT1Hix5NjQ6TW7isxeOtoVnsWHv9k11c5u7OWmciwRrv0XnqFhRWr4t5/HZT/QGAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcO8U1fW2mto7VcvN1bPTyRU 9Z2LZe7yuaqNk5HdH8qqi8q9F22Uz5wm8EmFcKl1yzKLflt3yzJMwlY6tu11YxszY0c57mJy/wAO Ryve5V3cqN+Q0eAAAAAAAAAAAAAAAAAAAAAAAAAAAAGG/Kn8NutPEfhOCWjRjDPZFV2a61dTXR+c aSk7KN8LWtdvUyxo7dUVNmqqm5ABkHyYOg2rHDvoDfcJ1ixT2P3qsy+rukFN36mq+elfR0cbX89P JIxN3wyJsq7+jvtsqKuvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4N8hramy3Cntr3Mq5aWVkDmv5FSRWKj VR3qXfbr6jxTyrgO8p/q9U0Vg1Tlvt6t1LLzQT5DnlPXUlO7w7RGd5kei7Ku6pGrtj26AGcOB/g6 sPCBppPYnXCC8Zbf5GVWQXaJitjkexFSOnhRfS7GNHP2V3VznvcqJujW6PAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAdFnOUuwjEbrljMZvuQra6d1QlrsdKlTX1e3+9wRK5qPeu/ROZAO9Bka+eUbxjGbxZceyLhZ4 ibbdMjmkp7PR1WIU0U1fKxEc9kLHViLI5qKiqjd9kVCbQcZNkp9Ns41TzDQnWHDLRglHBW1UeSY7 BQz17JXuZy0iLUK2RzFROdHOYiI9vVdwNBg67HL5SZRj1ryWgjmjpbtRQV0DJkRJGxysR7UciKqI 7Zyb7Kqb+tTorxqIlo1Ix/Tj2EZZWrf6Sqq/PtHbe0tFB2Ld+zqqnmTspH+DG8q8y/IBLgAAAK7y TXHE8X1pw/Qq4W+7SX/NqCvuNvqYYolo4o6RnNIkr1kR7XKn4KNY5F9aoBYgIjp1qImokN/mTCMs xrzBfquxcmRW3ubq/sOT+zKVOZ3a0snP8HL05uV3RNiXAAAAAAAAAAAABTuUcTWOYVp3qPqblenm fWm0aa3Ka3Vba20RwS3Zsb2M71b0klRs9O9ZE5ZFczfZenQ58nEXhMepenuljrXfPO2pVkqb9aZk gh7vDTwQpK9s7u15mvVrkREY16b+Kp4gWmAAABHG6h4c/UOTSll6auVQ2ZmQSW9IZN22907oGzLJ y9n1lY5vLzc3TfbbqBIwAAB1eU5NYsKxm75jlFwbQ2exUM9yuFU5jnpBTQxrJLIrWorl5WNcuyIq rt0RVPrYL5a8nsVuyWx1XebbdqSGuo5uRzO1glYj43crkRzd2uRdlRFTfqiAc8AAACOZ7qFh2mGP +ynOr0212taykoEnWGSVVqKmdkELEZG1zlV0kjE3RNkRVVdkRVQJGCu8m1xxPFNZ8M0MuNvu0l+z miuFfbqiGKJaSKOjj55UmcsiPa5U/B5WORV8VQsQAAAAAAAjjdQ8OfqHJpSy9NXKobMzIJLekMm7 be6d0DZlk5ez6ysc3l5ubpvtt1GN6hYdl2QZNi2O3ptbdMOrIaC9QNhkalLUSwMnYznc1GvVY5GK qsVyIq7LsqKiBIwAAAK70l1xxPWW5Z1a8Yt92pZdPsnq8Tua18UTGzVdPy874eSR6uiXmTZXI13y tQCxAAAAAAAAACN6i5qmnWE3bNVxTIslS1QpN5qx2h75cardyN5YIeZvO70t9t06Iq+oCSArG+cQ GJ47qZpjpRdbFkEN81VpLjV2nmpYmx0aUVKlTMyr5pEfG/kdyojGv9JFRdk6lnAAV3pLrjiestyz q14xb7tSy6fZPV4nc1r4omNmq6fl53w8kj1dEvMmyuRrvlahYgAAiNq1ES66k3zTf2EZZSLY6Kmr fPtVbezs9d23+9U1TzL2srP37eVOX5VAlwKd0b4oMN12zDIcbwLD80ktWOzVVJJlNXamw2WsqaeV kckFPOsivfJu/mRFjaita5d+nWf57qFh2mGP+ynOr0212taykoEnWGSVVqKmdkELEZG1zlV0kjE3 RNkRVVdkRVQJGCu801xxPBtXNO9GLtb7tNe9S0uq2mopoonUsHm+nSebvDnSNe3djkRvIx+6+PKn UsQAAAAIJrbrPhOgGm901S1AlrG2i1rEx0dFB21RPLLI2OOKJm6cznOcidVRE6qqoiKp0mK6+vye 44PbZdE9VLI/N0uTu1uuPsiisaUbVd/sk9srkpu322h/C51VEXlAtYAAARzPdQsO0wx/2U51em2u 1rWUlAk6wySqtRUzsghYjI2ucqukkYm6JsiKqrsiKqSMAAAAAAAAAAAAIjkGoiY/qDien64RllxX K2Vz0vVvtvbWq1d2i7TauqOZOwWX8CL0Xc7+nTxOXjeoWHZdkGTYtjt6bW3TDqyGgvUDYZGpS1Es DJ2M53NRr1WORiqrFciKuy7KiogSMHQ55lqYJh13zFcbvuQJaKV9V5rsVH3u4VfL/vcEO7e0evqb uhzsfu/sgsNtvyWyvt3nKjhrO53CHsaqm7RiO7KaPdeSRu/K5u67ORU3A7AAAAAAAAAAAAAAAAAH 4ml7GGSbs3v7Nqu5WJu52yeCJ61Ivpbn6ao4Ja87bhmU4mlz7b/YfKLd3C503ZzPi+Gg5ncnNyc7 fSXdj2L69gJWAAAAAArTKNfcSxPVyk0Zr7PfJ71WYvWZZHUU8ELqRKSmfySRq50qP7VV22Tk5eqb uQhdw41dKbZoFiHEJPY8tktWd18Nqx+y09ujmvFdWyySsjgZCyVY1e7sXqnwm22yb8yo0C/wdLhu SPzDFrZk8mOXmwOuUDZ1tl5p2wV1Kq/73NG1zka9PWiOVPzndAAZ4quOLSej4dr7xMy49lq4vj14 fZKqkbSU3f3ztq2UquYzt+zVnaSNXdZEXlRV236EkzPilwLB8u1Bwy62HJJqzTbDVzi6y01NA6Ge gRHr2cCuma5020bvRejG9PwgLjB0OA5jbdRMFxzUCzU1XT2/J7TR3mkhq2NbPHDUwtlY2RrXOaj0 a9EciOcm6Lsq+J3wAAAAAAAAAAiN41ES0akY/px7CMsrVv8ASVVX59o7b2looOxbv2dVU8ydlI/w Y3lXmX5AJcCOY3qFh2XZBk2LY7em1t0w6shoL1A2GRqUtRLAydjOdzUa9VjkYqqxXIirsuyoqJIw AAAAAACu9JdccT1luWdWvGLfdqWXT7J6vE7mtfFExs1XT8vO+Hkkerol5k2VyNd8rULEAAFXxcQu FzarZvo+22XpLzgVhp8huU6wxd1lppmK5rYXdpzukRE6o5jU/OoFoAg+ieruN68aW2DVvEKG5Udn yOGSelguUUcdSxrJXxKj2xve1F5o1Xo5em38hOAAAAArvWnXHE9CrbjF0y633ariyvJ6DE6JLdFF I6Orq+fs3ydpIxEiTs15larnJ02apYgAAAAAAAAAAAAAABHMb1Cw7LsgybFsdvTa26YdWQ0F6gbD I1KWolgZOxnO5qNeqxyMVVYrkRV2XZUVEkYAAAAAAAAAA/E0vYwyTdm9/ZtV3KxN3O2TwRPWoH7B WVq4gcNdpHa9ZM4suT4Ba7pVx0CW7KbRJTXSnqJa3ukLJaWPtHNWSRWObtunI9r15U3VLNAAAAAA AAAA6nLMjosOxW85dcYKieksdvqLlPFTta6V8cMbpHNYjlRFcqNVERVRN9t1TxKpwviz09zq/aXY 9acfyeGo1asFXkdlkqaanbHT0tOxHvbUq2ZyskVHN2RiPTqm6oBdgAAArvXfXHE+HrAXai5pb7tW 21tfSW5YrXFFJP2lRKkbF5ZJI28qOciqvNvt4IvgWIABXdVrjidHr3RcOstvuy5JX4w/LI6psUXc UpG1C06sc/tO07XnRV2SNW7fvt+hYgAAAACu6rXHE6PXui4dZbfdlySvxh+WR1TYou4pSNqFp1Y5 /adp2vOirskat2/fb9ALEAK+yvWvGMP1fwTRa5Wu7y3rUGnudRbKmnhidSQtoIWyzJO50iPaqtc1 G8rHbqvXl8QLBBX2hGteMcQmmtBqlh1su9vtVxqKumigusMUVSjqed8D1c2KSRu3PG7bZy9Nt9vA sEAAAABC9ZtV8d0O0wyDVjLKK41doxumSqqobdHHJUvYr2s2jbI9jVXd6eLk6bgTQHX4/eqXJLDb cioY5Y6a6UcNbC2VER7WSsR7UciKqIuzk32VU39anWN1Dw5+ocmlLL01cqhszMgkt6Qybtt7p3QN mWTl7PrKxzeXm5um+23UCRgrvSfXHE9Yrtndmxm33alm0+yWpxa5ur4omNmq4URXvgVkj1dGvMmy uRrv71CxAAAAAAAAAAAAAAAAAAAAAAAAAAAAyFxhfGp4Sv8AlVef6rATbyhHxMNVv+JE/wBfEfDi R0k1Cz7X/h4zbEsf7/ZcFv8Ac62/1Xe4Iu5wywRMjdySPa+TdzXJtGjlTbqiEp4xtPsv1V4ZNQdP cCtHnTIL5a0pqCj7xFB20nasdy88rmsb0avVzkToBl/VrTrV3Tng/puJO18SOotDnOOY7ar1FbKO 6Njx2OPaBO5Jb0ZySRsidy88iue9zeZyrurSzr5qbmN54xOHOlpsiulBZctwa8Xa5WanrZWUVRMt I2RjpIUdySKxXeirkVU9RMNf9Kc+zbghvOkGMWHvuXVeI0Nsht3eoY+apjbCj2dq96RJtyO6q/bp 0XwI43RLU5OI/h4z1cZ/2CwXBa+zX+r77T/2HWSUbI2R8nac8m70VOaNrmp4quwFB2rUK0X7UHNc f4uOK7VrRzUNuRV0FjtlLd5bHYYbW1+1JLTOSJaaoYrdt3zPVXdPzuXemjtFldv0xx2jzbP6DOLz HRt7fIqGlbTw3NqqqxzNYxzm7rGrN1auzlRXIiIuyUFe77xd+aLvpzqdwl4lrFSuqaltHe6bIrdQ 22tpnvcsPeKKsR0kTmsVGu5Efvsu2/iticG+i2VcP/D1jWl+aXWlrbvb3VVROykke+mpO3qJJkpo XP8AScyNJOXdfFd9umwFbcQeQZ3qfxY4HwqY3qLkWE49Ji1XmuS12OVfc7lWQtndT09PHUoiuhb2 jFV3L1VHL8iKkAqdP8m018ovoljlw1DyDLrF7F8hqLTUZDUJVXGlc6nek0D6lER00aK2N7HPRXp2 j2q5URu1p8Qmlesll4iMH4ptD8QoszuFlsdVimQY1PdIrdNWW+SRZYpIJ5vgkcyV7nKj1TfZqJ4q qRe26c8TeoHGdplxC6haaUGL4vZLHeLTJa6e+U1dNakkgckclRI1ze1lnkkVOWBr2RtiZzO3Vdg+ XDhqLndz0Y4lb3edXvNNbYNU8st1qyHJ6l9bS2GliZT9kiNlfskMXM5WRIqMRV226qi531P1ptOl +kEesejvFvrtmud2SShqppbxbbs/E70rqiNlTH2c1IylhhVHvWNWvRejWo5XKilwTcH2smW8K/Ed pBXW+Cw37PdU7vlmONqK6GSGuoVqKOeBXuhe/s0l7u9qNfs5q7K5qIdvxAYPxdcU3Dte9IF0Ssul sTbfTyyUs+SUle+71FNJHJDRUqU/wdNCr42u7SV6L6DGcqI5zmhItccqzzWLif074ZcY1CyLBccr cPnzzJKzHavulzq4e2WCnpo6lEV0TUkaquVvVyOX5E2jcNHq5pNx6aS6R1OtGY5PgFzx6+3Gjp7z c3y1D5Ep3I+Gre3lbWNiexkkUkrVkb2rm8y8qKcrKcQ4hbfqlpHxP43pLbnZtRYtVYbk+nlVlNFF WTUKSukjlpavmWCRWu3lVN+jVa3x5lb0D63VnJfKPaOZHqfjtBjE8mJX5aLGaW4Nr5bbRthe3t6m oYiRulmle5OWPdjWxxpzOdzKB2HDZYNTNadbNaajL9b9QKXGNO9Wq5bLardfJYmVD2ysetLUOdzO dRMZFG1tMxWx/DTbou6bcbVPLcFu+tebWfUnjH1SSpt9SyG14tpRS3NjbDAjdlbWvoaeZJahXJuv aOTZeZOTbZrbn4T9Kc+00yzXW55tYfNtNmWpVxyCyP71DN3uglaxI5to3uWPfZfRejXJ60QrbRXB uKXhtueo2nuI6G2TLaLLMzuOS2nNKnKKejpmsrFby9/p1R1U90XKiuSNq83VrVT8NQrnHeIHVLMP Jy625JV6g36fItPr7c8ateTt7W23WopqeWlfDPLyoySKfkqOR26Nf02d6XMq87iHptZ9G+GHFOKi y69Z3VagUrrDW19uqLu91grG1bomPpHW/pH2Te1RqPX4VyNVznq53Mce1cM3E3jPD5xIcO9ZgjMk nza9XDJ8fymK8UUDb1UVUlIiwupnyI6nfywvkVz1axF3air0Vbp4r9FNTdS+C6g0mwnGfOWVwxY6 19v77Tw7LSzU7p/hZJGx+ikb1/C67dN90Ah+vFj1H4bsl0W1Nteu2f5Bcsl1Es+JZVbrrdlltFxp 69JO3fFQ7JDTK1Y17NI2pyo5N91TddrmeuMvSrPdV7RpPS4DYfOkuNaq4/kl0b3qGDu9upu37ebe V7Ufy87fQbu9d+jV6mhQPNfO8vyzKuFPjcp8oyi7XiKyajXe2WxlfWy1DaGjZUU3JTwo9y9lE3dd mN2am/RCy6r44/Cd/wCbe8f1Bh1t24ZtbqnQLizwqDCea9am59dL3i1N5ypE84UU00Do5edZeSLd I3ryyqxybdUToWTPorqa/iV4etQG41vYMGwm5Wi/1ffKf+w6uWjZHHHydpzybvRU5o2uaniqogH3 4JsvyzK7/wAQsOU5Rd7xHZdYr9bLYy4VstQlFRxrH2dPCj3L2cTd15WN2am/RCobFqVxFz6I8Xt1 0uvV+yPNMb1SvVuxmGeaSvloKFk1Oj4qOKRXIiRQOmdHE1NuZE2aq9FsHTfDeIrhy1T1dpcV0Uhz 7GNR8uqcxtV2p8lo7elFPVNTtoKuOde1RrXNTZ8TJOib7Kq7J1ugmjHFppRprre+hTGaPUbJ9Ra3 KrRUVzmzWy7QzJA6XZI5HSQMkVszWdoiPb6KuaidQIpotetNM6yDGp9C+PvUOTN6Wup33bGtQbtJ VJcokX+yqRbbUtiVkqoiojqddmdVTfo5OTjWkVHcvKdZs+XUHUCJLbiduyaNkOT1TGve64JItDIi O9OhRVVEpV+DRFVNjl636c8RnFhTY9iuQcKdk0yulBeqC4y57V5Xb7hU2uOnlbI/uSUre3c9yN2a j+RvhuidHNnmR4BrjgvG9NrfhGl8GZ4lmGKUOM3KeO+01BLZpIqtHPnfHN6UzEjTm5Y0Vyqqp026 hA+Gywama062a01GX636gUuMad6tVy2W1W6+SxMqHtlY9aWoc7mc6iYyKNraZitj+Gm3Rd0242qe W4Ld9a82s+pPGPqklTb6lkNrxbSilubG2GBG7K2tfQ08yS1CuTde0cmy8ycm2zW3Pwn6U59pplmu tzzaw+babMtSrjkFkf3qGbvdBK1iRzbRvcse+y+i9GuT1ohW2iuDcUvDbc9RtPcR0NsmW0WWZncc ltOaVOUU9HTNZWK3l7/Tqjqp7ouVFckbV5urWqn4ahUMufZfr35NzWWfN8+yevrdNsgvVlo7uyWW 2Vl5pKWKNYW3CJEY57XR1fLJDI1N1jZzorkVSUanai3ThS4QNI8fw/VW/wBqrNVK+y0tXlOR3GW6 uxuhmooXVctKkvN2ccbGN7OFqcred6t2dspztP8Ahf4iLFotxHcN+SY9S1zM8uN6yOwZq6507ILt V1cdO1sElK1yy07lWFXOc5ORFcqJuiIqyS96J8QmsHDrp1T3DTyg071R0UvFnumN09wvdPcKS8Po KdjH9pJTcyQxzddmru5FY1FVEVVApjJ+J3SbRC+YZmug/Gpmmpcj7/RW7KMWym8T3SK4WyZ3JNPB 2sLe7zRrs5OzVG/m2RWusTX/AFFda+KbJsa4ltbNT9KNNGW62ewGtxWqqLdbrlM+LetWrrKeNzu1 ZL6LWPVrUam67bt57us+oHGfnGTY5an8P9g0ztEFdFPkd2vOTU157ekb+6U9HBSKjud/72SVWo3b q1fA+uoGT8VuJ55kNDb9DLHq7p9eGQvtMVHe6O1Vtu9DaaCqjrF7Ooa5/pNe13ROioqrsgSPhhoL lRYPWvZxAx6v43UXGSXHL4+SKoq4aJWp/Y1TVRO5amRjt/TVrXddlToiJRvlRMQjvumun92dkmR2 9Y88s9rdTW66y01PKyomRVlfGxUa6aNYmrFIvWNVcrdt1J5waaGZxpVX6m5tmOKWXB4tRb9DdaDC rNVtqaWxxxxLG7eSNrYlllVeZ6Rpyeg3b+C3seOXSPULWDRmhtul1pprtkWO5PaskprbUVbKVK5K WVVdCkr9mMcqOVUVyonTxAo7XPTXIrXxgcNumGD6i5JSTrj+UU0mS3OuW5XeKldH2k72z1HNzTqx XRRvejkZzNXZeREJZYaPOeHrjYwLSeg1jzzMsO1Mxy7VFTQZfeHXSSiraJnapLTyvRHRtc1EbyJ0 9J3j6PLIanBtbdRuJ7QjXTJNJn4rQ45ZMlpcio33yjrXWqaoY6OlYr43p2yyNax28TXI3n2cqbKp ItTtKM/yHjQ0X1Zs9g7ximJWbIKS8XDvUDO7S1NPyQN7Jz0kfzO6bsa5E9ewGVaLif0w1n1E1Hu+ vXGFl+ltvsWS1eP4njGLXee1KyhplRvfqiSGJyzySv3VGvVUarXJsrVaiaD4Adfrnq/YtQMLu2oL c9TTzIlt9ryrskjlu9pmar6WWZqNbvMiMka52yb7Jvuu7l67BsF4juE/MNQbJpho3SapYBmuS1WW WruuSUtprbNU1SN7emmbVbNki3Y3kcxyqiJuqKrlRL+0Sm1vrcWqrprzR43br5XXCaoo7VZHPmZb KFduyp5qhy7VEzevNIxrWruiIi7bgRri5yWrxbRevuNNrhbdJo5KungqckqqXvM0VO5y9pFSxpuq 1D2oqN2a5UTmVE3RFTICaz2vS7WLRyfRXXrXHMLdmeY0GLZBbdQqS6SW+qpKxezbUU8tbSxNjlY5 UcjYnIq9PR5Uci6X40dHNRNTLbpvmGmNiockvGmmaUWUrjldWMpYrtDEjkdE2WT4NkqborXP9FN3 evZFq7iGwXi+139rvUql0bt1gXS/NrTk1Lg8uTUk9felgkV00slW1UpYOREayNiPcqpJM5yoqMYo dbj+j9Hd/Ka5y2bUPUKBKDEbfkkaU+UVUSOe+vSRaJ+zvSoUVVRKZfg0Rdtj98Cek9JaNd9e76uo Ge1smJ53UWuKCvyapnp7gxablSWujc5UqpmovSR+7k5U28EJ1U4XxA4pxjU2vuP6NR3+wZzhVsx+ +QJkdHTT45UsqGyTOfzr/ZLWN3/cUXmVF226b8LT/R/XPDdZNdcKqtPmS4FrLc666U+b0t8pmutP b0EjEY6iVUnkekqsYitRETdXb7IBS19znE7xY8vvtz45tZcl1Aopq+WmqtPLbdUxagnZzOp6dIaa mkppYm7MR6uldum/pJ+ETq7cUmr2bcJ3D66wZDHZM91wvtDi1Zf4KZiuoYu1kjq62KNU5ElckSKi bIido7l5VRu3caJ4FxbYloDQcJ8mjVhxOKioaqx1GftyOmqaNaSV8ivq6ahjTt31DmyO5WyoxvOv O5dt2EVxDha4iq7hW09wCsw22YrqToLlMF/xaoq7xDV2/IeyqJpXMcsCudBG9kjW7PRHK5ib8qKq oF8Yvw7ax6U6lYxkOnvENmGVYpI6WDL7LqBen3N08Kt+DnoZEi3hma/dVbu1jk2TonRcp6ccSk2l Ga676Q6czWuq1Z1J1xvdtxikuE7Y6ai51jYtdUq7/e2Lvys6ulenI1HbO21JjuQcaWp+pGJuv2m9 DozhVinfWZGj77QX2ryD0dmUkCRRuSCLm6ukVWPVq9NlTZa2w7gdXOLTxFWfVnEobBcc81HuGQ4n kdPJTy11PAju0oayKSJ6vj5JHSL2blY7Z8iKicyqBqLRbTa5aVaf0GKX3P8AIs1vDVdUXK93yvlq Z6uqf1kViSOckESL0ZCzZrWoniqucud+La7ap1fFhw6aaad6mX7EqPMI8mgvHm6pVGS00NLFI96w u3ifMyPtuyfIx3ZvcjkRdti7+G6464VOmNHa+IbF47XmVklfbKmugrKeop71HF0juEXYvcsaSt2V zJGscjkd6LUVETPHGS3OV4z+FybTaK3z5FTR5fVUlNcJnQwVbYqGJ8tO6RqOWNZYmyRpJyuRrno5 UVEVAOxyZuZcLXE9o7ZrLqxnGU4VqtVV9gvFpyu9SXVaWsjia+mqaaWbd8Sq9+zmIvLsi9OqcvA0 ctWdcZ9/1J1KyzW7UXEcXsOYV+J4rYsNvbrQyOmo+RFqqh8bVfPLIr0XZ6q1qo5NlarUbIl0/wBf +ITiO021H1X0np9NcN0nWuuNLRzZBS3SsvNzqI2xscndlVkUUfKjk5lRy7Km3pejxsEwfiN4T8s1 CsOmejFNqlgeZ5LVZbZ3UuS0lqq7RUVSN7elnZVbI+JHMbyOjVyoiKqoqu2aEEtesnFBQ6FcSOlG JXuvzPU7Ru8RW6wXpaRktxrbXUPa5kj42t5ZaqOmbUORUaqucjOjnJ6X90WvWmmdZBjU+hfH3qHJ m9LXU77tjWoN2kqkuUSL/ZVIttqWxKyVURUR1OuzOqpv0cliaX6F8SeneneqWpdpuWJUutepuQty SWgqOeotVJBG5Eitiyps5zkiWRvbImyOeniicyw/W/TniM4sKbHsVyDhTsmmV0oL1QXGXPavK7fc Km1x08rZH9ySlb27nuRuzUfyN8N0To5odbr/AKiutfFNk2NcS2tmp+lGmjLdbPYDW4rVVFut1ymf FvWrV1lPG53asl9FrHq1qNTddt28/eao3XNMC4DtV8ow/igrdRKKFnecSyuhrmpdKGlWeBvYS19M 9O3laquRZERjtnKip4Ilr6gZPxW4nnmQ0Nv0Mserun14ZC+0xUd7o7VW270NpoKqOsXs6hrn+k17 XdE6KiquyUI7hJ1odw38RtFQaeWXHL5rBWU1dYdPrNc4HUtoSJ0aORZ3dnTpLKiK5/Lsz0G7L15W h/eIOgzXMeIjg0t2MZfVWa+3iwZCyW9Na2aqgiktVOtXNGsiOas6wrNyPejkR6tcqO22WWXqlzzh R4n9ILHbdZ89zTCNWKqvsN2teYXhbnJR1scTX09RTSvajo93ORHMT0dkd8qcvJ1n0T4hLhqrwz5/ pbi1vqZ9LbLdW3pbhcoYIGyyUEESUblRyybz9nLCksbJGsVyPcitTr2a4Br/AMQnEdptqPqvpPT6 a4bpOtdcaWjmyClulZebnURtjY5O7KrIoo+VHJzKjl2VNvS9EKVx3W+78O+jfGbqtjsMMt5tusN2 prYkzOdjKqomp4GSOb4ORiyc/KvReTb1kQzDXrTTBNLHajadeUSzLJNXrPSRXKW23K5z1NkvNU3Z 09GlvdCkMUb052x8itVvo+l6y9LZwc5tqBpXxQaWZ7RMx1NT9RblkWMVz6iGoa+HtIZqSoc2F7nM YskKI5jka/lV3okyo8+4/KnFLfgcHDzi9qyqOOCiqs2r8tpqmzbs2SSsbRRIlU7nRFVIlRuyu8V2 2UNB6Y5pBqTptieolLT93hymx0F6jh337NtTAyZG7+vZH7fzGcbJV5Nn3GxrnpNdc+y2jxtMKsbq Smtt7qKXzdLKidpNS8jtoJXet7ERy+tTV9K2pZSwsrZo5qhsbUlkjjWNj37ek5rVVytRV3VE3Xb5 V8TPuA6U59ZONnVPV252HscSyTF7LbrZcO9Qu7xUQJ8KzsmvWVnL8rmoi+pVAqTyWem9JZ9LLvnk eXZdVTS5DfLQtsq75PNbGtZWNXt20rl7NKhezTebbmVHP6+kpz/KiYhHfdNdP7s7JMjt6x55Z7W6 mt11lpqeVlRMirK+Nio100axNWKResaq5W7bqWZwL6U59o5otXYlqRYfNF2mym8XJlP3qGo3p56h XxP5oXvb6Teu2+6etEP7xy6R6hawaM0Nt0utNNdsix3J7VklNbairZSpXJSyqroUlfsxjlRyqiuV E6eIFJcSeneRWPid4SdOMD1AyCC4NjzOljyK8Vjrnc4oJKKJ1RL21RzdpM2F0qROejka5I92uRvK skZbs54b+M7SLTy1a0agZhiOrNuv8NytuX3l10WlqbfSpUMnp3vaixcyq1qtbsm3N8qIklyTBtbd UeIjhn1qvmkz8XpsPZl/sqoX3yjrHWhaqj7vRor43p26y8jXfAtdyc2ztttyRa06UZ/lvFxw8an4 /YO9YzgrcpS/13eoY+598t7Iqf4N70kk55EVPg2u28XbJ1AyrRcT+mGs+omo93164wsv0tt9iyWr x/E8Yxa7z2pWUNMqN79USQxOWeSV+6o16qjVa5NlarUTQfADr9c9X7FqBhd21BbnqaeZEtvteVdk kct3tMzVfSyzNRrd5kRkjXO2TfZN913cvXYNgvEdwn5hqDZNMNG6TVLAM1yWqyy1d1ySltNbZqmq Rvb00zarZskW7G8jmOVURN1RVcqJf2iU2t9bi1VdNeaPG7dfK64TVFHarI58zLZQrt2VPNUOXaom b15pGNa1d0REXbcDNnlWcLp75w/UOTSZDkNHJar/AGylbR0V0lgo6hKiriar54GryyyM5d43OTdi qqp4naZbTZHpJxb8L2k2P6l51cceucGaSXSK85HVVz7mrKDtYu9ukd/ZHZPdvHzovJsnLtsTrjv0 pz7WbQOTCtNrD54vTr/aa1KbvUNP8DDVMfK7nmexnRqKu2+6+pFUawaU59lPGDw/apWGw96xfCKf KWX6u71Czubqy3pFTp2bnpJJzydPg2u28XbJ1AqHhssGpmtOtmtNRl+t+oFLjGnerVctltVuvksT Kh7ZWPWlqHO5nOomMija2mYrY/hpt0XdNoNJqHabrq7qFjfF3xRas6O5THk9bTYnQW27TWOwrY2q iUlRDK2JaedVRVVz5ndem6b8xpfhP0pz7TTLNdbnm1h8202ZalXHILI/vUM3e6CVrEjm2je5Y99l 9F6NcnrRDoL/AJDxcUkd/wAB1A4VcW1ltE1dUOtl2pMht9vo6mie5Vhjq6KtRzmPY1eVzmI9F9SL 4uCmONXAsmrOGPSCqzTXC6Zlc4M1tFsdfbDWuoKK70tVUq6Kpkhhe6OSeNkcfJOi9Hc7m7K9TeGD 4lBgmK2/E6a+328xW9jmNrr5cpK+um5nudvLUSqr5FTm2RVXoiInghiK6cG2t2P8EOP6XWOltF4z XHs3gzeDH6e4dlRQxpWPm8209RNs1Ea2RV5nbN5ufZV6Ku19PL7l+S4dbr3nmCvw2+1KSrV2R9yh r3UnLK9rEWeH4N6uYjH+j4c/L4ooGZcrr854kOLnM9BqTVPLsFwjSyxW2quLcTr/ADfcLrc69iTR 89UjVeyFkK7cjNt3dVVfV/c8v2u3Bhw+6yZpk2pDdQbLYY6aXAa69SOnvFM6peynWK4P7NjJ2xzz RuY5FVzmo7mVu6Nb2efaZa46R8Td84kND8BodQrZnljpLTlGNPvMNrrI6qkRG09XBNP8E5vZIjHM cqL4qm+/T512i/ERxK6S6uYvxF3K3YnSZ9BBTYpidHJT1zMa7vyyMmqKuJjXVMkk8cT3NRzmojV5 VTm5WhEM30J1nwDhyueulBxVaq1Op2PY2/K6pKq9NlsdTUQwd4npUtqs7BsKo17GoiIqLyqqqm6H UZ7q7qdrLqTwdVGEZ9esLg1Yx++1t/p7XVObCrUttPNMiROVY3yRos6QySNf2b1a9EVU2WSZNHxy Z7oZU8ONw0HsVput3svsWumeSZdSy2taV8XYT1cdKxO9K98XPsxWJyufvuu2xIblw1ZXiuuHCfJg 9ofccM0dsmQWe83R9TBE+FJbTHTU0jonPR73SyMXfs2u5VVVXZOoEDrcV1Sw3jPtnDfjHEDqJJge bYY/I7r51vT7hc6J9PUSMcygrJkc+mSRWxNcqbqjXScvK7kcyZaFXHMtOuK7VXh4qtR8ryzFaXFb flNnfkl0kuFbbpZXLFNE2pk+EcxyqjkRyry8qbdeZVmWQaU59XcduKay0th58OtunlZYqq5d6hTs 66SsWRkXZK/tV3Yu/MjFb6t9+h87DpPqBRcbeeavVNg5MSvWAUFkobh3qBe1rY5+Z8XZI/tW7N68 zmo1fUoGZ9A8a1d1Z8n7JrplnEhqjBk9psl+r7BPb8knha3uM1UrFrOqurHPlie1yyuciRJGxiN5 d17bIk1oybgWh4vrpxAZ3btRKXHYMjpYbPc+52VrI3NRsMlAxOym7SNOZ6yI5Vke7bZiJGlt8Nuh 2qWAeTx9ozLcX7hm/scyag8199p5fh6uorX07O2jkdD6TZol359k5vSVNl2VOh2qUnk3U0DZi++d pgjLN5p77T/7cRqIsfbdp2Pq/C5+X84HX5hqdml/4nOESOnyW7Wy1Z5jeSXG9WqirpYaSsk8zRzR 9rE13LJ2b3q5iuRVavVNlIlwIaTUlq1515vfs/z6ukxTPKi1QwV2S1NRBcGLTciS1sbnbVUzUX0Z H7uTZu3ghPajQ7VKTW/hNy9mL72jTPF7xbspqO+0/wDsfUT2eOniZy9pzS80rXN3iR6JtuqonU5G hOAa46P8S+q1LXaXwXLANS8mkyWHLoL7TM7gi0rl7CSid8O9yyIyPdqIicyu3VEAsHjOv99xbhW1 PyLGL1X2i62/HamekrqCpfT1FPIiJs+ORio5jk+VFRTOuomU6v3vUPgxw7EtV8isDs9xW6eyCphr XyLWMZaaSWWeRj1WOWoa1ZnRSStfySPR+yqioumeLHBsp1M4btRMBwm1+cr9fbFUUdvpO3jh7aZy Jyt55XNY3f5XORPzlRz6F6pv1f4Qsobi29s0uxq8W/LJ+/U3+x1RPZYaaJnL2nNNzTMc3eJHom26 qibKB11VTZhw88Z+j+n9i1YzrJMS1Yt2QU90teU3yW6tpqm30qVEdRTvm3dErlVrVa1Ubtv08Nti uXlarlVE2TfquyGeNadKM/y3i44eNT8fsHesZwVuUpf67vUMfc++W9kVP8G96SSc8iKnwbXbeLtk 6l3Ztjz8uwy/YnHXPonXq2VVubUsTd0CzROjSROqdW82/j6gPO6+5zid4seX3258c2suS6gUU1fL TVWnltuqYtQTs5nU9OkNNTSU0sTdmI9XSu3Tf0k/CNk8IGqOR60cNGn+pmXvikvd6tXNXyxxoxs0 8Uj4XS8rejVesfMqIiIiuVERE6FEaJ4FxbYloDQcJ8mjVhxOKioaqx1GftyOmqaNaSV8ivq6ahjT t31DmyO5WyoxvOvO5dt2FocCWF6s6WaA2jSHVzAGY7X4a6ahpauG7U9bDdoXzyypPGkSq6JER7W8 smzlXrsngBGeJfJM+1A4ltMOFjEdQb7hNlvlquGUZPdLBUJTXOalg3ZBTwT7KsKOka7mc3rsqfJs sKu1s1c0c46OH/Stmtma5Hp7f6bJ6yKlvV1fNUyzR2yRXwVcjeVKyKNzIJYVma58bpJNnKnLtYPE tp3qda+IDS/iO0asdqym/Y9R3DH7nilXd4bdUXa3ztV/NSyzKjOeJyveqO8U5fUilU5HcdXsp8od w4ZHqditDiaOt2VpQYzBcmXGooIG2yRHVVTPEiRc80kiNRkfM1rYW+k5XKiB2nDZYNTNadbNaajL 9b9QKXGNO9Wq5bLardfJYmVD2ysetLUOdzOdRMZFG1tMxWx/DTbou6bc3Ry1Z1xn3/UnUrLNbtRc Rxew5hX4nitiw29utDI6aj5EWqqHxtV88sivRdnqrWqjk2VqtRto8J+lOfaaZZrrc82sPm2mzLUq 45BZH96hm73QStYkc20b3LHvsvovRrk9aIQfBMH4jeE/LNQrDpnoxTapYHmeS1WW2d1LktJaqu0V FUje3pZ2VWyPiRzG8jo1cqIiqqKrtmhXE+tGr9q4a+KjS/JNRLvccr0WnlorRlkUy0tynoJ29pSS SSQ8qpO1rHo6RuyruniqKq3RrRl+WWryd9yza2ZRdqPIo9OKKuZd4K2WOtbUupYXOmSdrkkSRVVV V2+6qqruRrEuETUW+aGa702pFytFDqNrzNWV9VDRyulobSvZK2hpFl5eaRI1XZ70TwcqJzbbujmc 4rxjalcINZw4JoFSY5eaXFoLLU3ifKaCohuaUsTGoyjijfu19QsTW7zrE2Nsj13erURQ4GpeS6w5 BqZwb4Rh+rOS48ueYrclyCppq573VkbLVSyzTPY9XRy1CMWZY5ZWvVkjkfsqp1lmTNzLha4ntHbN ZdWM4ynCtVqqvsF4tOV3qS6rS1kcTX01TTSzbviVXv2cxF5dkXp1TlgWtth1OxnXjgosOJ2+3szS wYzfY1t9wqeSCaWltFN3mkdNHzoxZGRyxJKiPa1z0ds5E2W0F0/1/wCITiO021H1X0np9NcN0nWu uNLRzZBS3SsvNzqI2xscndlVkUUfKjk5lRy7Km3peiGq7s98dqrJI3ua9tPI5rmrsqKjV2VFPOzE tVOIGr8mbpZndiy3NrncbjkkkGbZHQOfc7/S48l1rmVNTTul53ulYxkLEd1VjPkRN2+itzhkqLbV 08LeaSWCRjU323VWqiIZB0A014sNB+C/TPD8OxSwNznFbjWzZBi13rodrhQS3CrlWCGthdJFDMrJ Yntequam6o7ZU2A+XDnXad5ZqFYr9w78cuU5nQQNm9keI5neJLrU1tPyLyvhhqUiqaSRj1RVe1qt 6Iioibouy3LytVyqibJv1XZDF940s1v19150w1HyHhvtGjqYDfEvd0yKXIaG4XW7QtYre4MSiRVW KRV2csrk9FV2RF3a7W+bY8/LsMv2Jx1z6J16tlVbm1LE3dAs0To0kTqnVvNv4+oDzuvuc4neLHl9 9ufHNrLkuoFFNXy01Vp5bbqmLUE7OZ1PTpDTU0lNLE3ZiPV0rt039JPwjZPCBqjketHDRp/qZl74 pL3erVzV8scaMbNPFI+F0vK3o1XrHzKiIiIrlREROhRGieBcW2JaA0HCfJo1YcTioqGqsdRn7cjp qmjWklfIr6umoY07d9Q5sjuVsqMbzrzuXbdhaHAlherOlmgNo0h1cwBmO1+GumoaWrhu1PWw3aF8 8sqTxpEquiREe1vLJs5V67J4AW1dtKMHveoNLqhcrS+XIqOyVOOxVPeJEalDUSNklj5EXlVVcxvp bbp1RF6mKONfh0wjCaXhlxPDL9mNislNqbjmJUdvociqo4KOnkmqJFqoU5l5K1qvVG1KfCNRERF2 RD0GM8cX2lOfao3DQ+fBbD5zZh+rNhya9L3qGHuttplk7af4V7efl5k9BnM9d+jVAiFiqsmwvygG L6O0mf5dc8WotF31i0d2vlRWJU1aXeRiVU6PcqS1HJs3tXIr+VETfY7i55flkflJLPgseUXZuNy6 PS3N9mStlShdWJdnxpULBzdmsvIiN5+Xm5em+x+dadONY8Z4rMS4ndK9P488pIMQqcMvdjiu1Pb6 uKJ1StTFUQvqXNif6blRzVci7J0336dVgmmnEHfeOKn4itRcFo7DjVRp3PjtNTU92p6uS2SJXNlj p51a5Fklf8LKro2LE1HNZzuVqqoZMvn/AHJLU/8A84FR+vqc9J8j0H0yyu+5dkd7sUs9fnOMriF7 kSrlYlRa1SVFiREciMXaaT027O6p16IYyuvClr7U+TtzvQqHAubOLzmE10obV50ok7WlddoahJO2 WbsW/BMc7Zz0d02236HocB1mMY5aMOxq04jYKZae12OhgttFCr1esdPDG2ONqucqquzWom6ruplG 5VOc8UPFbqZpFHqzmWDYJpBQWiGSHEbj5trbrc7hC6ftJalGrIkUbWOZ2bdkVWovrXfYJlHK9Ntd 9EeJbMdfdENOqLUaw6n223wZHj3nuC1VtJX0MaxQVMMlR8E+NY1VHNVUdzPcvqTcOm1Sy7X7gu4Y 9WMqybUaDPGWippodP7ndN57tDHVysg5bgvZsjmdC+Tna70uflVHbJs1Os1d0M1k0S0CvOt9h4pt UrjqPh1o9kFwbdL0lVY6+SFqSVUC25zOyZErUkRiN2Vvo9VJLkOg3EPxNaE6r4hxD3y145U55JTy YnjVI6GrhxZtK5ssKTVcUbXVD5ZmMWVd3ojU9DbmVidPqFFxwa06N1fD3e9CrJjFwyGgZY79nM2W UtVbu7LsypqIKSNO8udKxH8sb2t5Vf1cu24HSZ3qXqRrFr1wv0uFahX/AAyyaqYLcL1eqe2Vrmo2 F9HFUqjI3bxrOiKsTJXMc6PnVzdnIin5psV1Sx3jTqeFuy8QGosun+Q4JFm9e+43t9bdqRY6yWlW no66bmlp2SSJG5ytXm5eZGq1dnJY1dw85XjnEpw73nDrG+pwXS7DrrjlbcX1UDHU+9EyClRYlekj 1dyJurGuRPXsd9PpTnz+P+n1tbYd8Lj0kXGHXPvUPS5+d3VHYdjz9r+5Kjufk5PVzb9AK+0bvmc4 DrfxB6AVmpGVZRj+M49bsgx6ryC5vrbjb3VNLIs0XenfCPbz8qt3XdqNTbqqqtTaa47q/nfk8ZOI 3IuJDU+nzKxYteL5aHUGRTRU7WW91Q5jKpm6rWOl7ByvfMrlRJEa3lRiIaGtGjmo9LxVa5akT45y 45mOGWu02Wt75AveqqGBzZI+zR/aM2cqJzPa1q+pVOo0p0O1SxrybtdoHe8X7tnc2CZFZmWnvtO/ esqm1iQR9s2RYfS7WP0uflTm6qmy7BU+pb9Z/cR0PGZNr7nNFqLHZLXlMVJbrktNYUimlh2pXW1q djIzsZPSV/M50m6qvL6CWvmGoWXXTjO4frPSZLd7fYsqwq+XG42ilr5Y6Sol7qj43SRI7ke5iu9F zkVW+rY/uoOh2qV88m7S6B2vF+3zuPBLLZnWnvtO3asgbTJLH2zpEh9Hs3+lz8q7dFXdDsLhoxqV PxQaBaixY3zY9hWF3O032s75Tp3SrlpWsjj7Pn55N3IqczGuanrVEArLgQ0mpLVrzrze/Z/n1dJi meVFqhgrslqaiC4MWm5ElrY3O2qpmovoyP3cmzdvBDX2sF2r7FpdlF3tmb2jDqultk8kN/u0aSUl sdyrtUSMcqI5GeKIq7KqIiovgtDaE4Brjo/xL6rUtdpfBcsA1LyaTJYcugvtMzuCLSuXsJKJ3w73 LIjI92oiJzK7dUQnXGlork3ELw1ZjpTh1dBS3q6xU09F3iRWQzSU9TFOkL3J4I/slair0RVRV6IB hnU/Wm06X6QR6x6O8W+u2a53ZJKGqmlvFtuz8TvSuqI2VMfZzUjKWGFUe9Y1a9F6NajlcqKaN4hc h1OyPi70F09wbUq/4jZ81x6+S3ltvq127COFkqubE7eJZ+VFjZK9jljWRXNTdEOp4gMH4uuKbh2v ekC6JWXS2Jtvp5ZKWfJKSvfd6imkjkhoqVKf4OmhV8bXdpK9F9BjOVEc5zZRQada45rxEcPWseU6 VPxikxLG7/bslp3Xqiq1ttRNAsUDeaOTeZJOVHIsaORqORHKiooHCtseYaB8bWn+ldo1UzfJ8O1L xu7z1dtyq9y3VaOtom9q2enlm3fGjmojVYi8vVy7fg8vT6F2bPuL7ItTNXMm131HxS02TNLhi2J2 XFL15vpKWkouREqJ4+RzamV7n7qkqOb0cmytVEbaep2lGf5DxoaL6s2ewd4xTErNkFJeLh3qBndp amn5IG9k56SP5ndN2NcievYr3TLCeKDhYy3UTC9O9ErbqPhGYZVWZXYbomVU1rdan1fL2lNVRzNW RzGKxuzomuXZFXZVdytD8+TfgyOkm4haTL7jDcL5T6u3iG41kMKQx1VQxkTZJmxp0Yj3IruVOic2 xcvFzktXi2i9fcabXC26TRyVdPBU5JVUveZoqdzl7SKljTdVqHtRUbs1yonMqJuiKkH4G9GtX9H4 dXF1ko6Vt1y3UCuyKCtpJ4nwXCOeONXTxsa9zomLIj+VknK9ERN0Q7DjR0c1E1Mtum+YaY2KhyS8 aaZpRZSuOV1Yyliu0MSOR0TZZPg2Spuitc/0U3d69kUM0JrPa9LtYtHJ9Fdetccwt2Z5jQYtkFt1 CpLpJb6qkrF7NtRTy1tLE2OVjlRyNicir09HlRyLaVD8eTiS/wDNha/9Q44fENgvF9rv7XepVLo3 brAul+bWnJqXB5cmpJ6+9LBIrppZKtqpSwciI1kbEe5VSSZzlRUYxZpjWkmrNVxJ6v6r3rBnWq1Z vp3a7Xb0dcqWZfOTafaalXkkVd2PXl7RWox226KqAdx5OD4kuln/ABdVf12oINxr57kuKau4Lb8/ 1A1A0/0OqrVVyXjI8MbNHOl4STaGCqqYI3zU8HZ7KnKicyud4o1VZb3BPpxmekfC5gOnOoVm805F ZKKoirqPvEU/YvdVTPanaQucx3ovavouXx+U+2sN/wCJzEM5t190s06smo2E1FtfS3LHlucNqulP W9pu2pjqKj4GWJWegsTuVUXdd136BXui7qeDDtRMn0s4tbhqtgj8fmkt0FyuTbjd7HcWxSOc5a5F bK1jmoipHKznarUVF8ebm8JeX5ZknANjeY5FlF2ul/nxa51Et1ra2WesklbJUo17pnuV6uRGt2VV 3TZPkI5ozw+ah33XzOtcsx0ps2j1myjCnYguMWu5U9bPX1D5+0fcqp1MiQJIjfg28qucqeKp15um 0bwji5034cncKa6NWyOrt1BcbJR517JaR1tfSzyTObUtpUXvSytZLs2JzGtc5reZ7EVdgpXUjJdQ Mx8nhwyZLNklVeMwr9SrI+C5XqokrJJaxJ69sLp3vcr5ERUYi7u35U23Ld4kcd1L4QrPivEJjfER qVla0eTW6gyyz5Ldm1VtudDUyckyw0rWNjpXo5U5OzREai/m69HkHCxxDXHgc0E0asWMxW7OsNzW 2XS6smrqSSO0wxTVrlqnOSZGTNZ20TlZE9z3IuyJvvtOdaMJ4oeKr2J6QZxonbMCw+gyKhvOU5B7 Kaa4x18FI5Xd3ooY0SZO0dsqOmYzl2TdPECJa/6iutfFNk2NcS2tmp+lGmjLdbPYDW4rVVFut1ym fFvWrV1lPG53asl9FrHq1qNTddt288qzDV/KOGrgz1A1ZxrXul1kpKapZHhN6qVhq6imZUzRQRxV VTE7kq3wvkdIrla1V5eVyeCJZOoGT8VuJ55kNDb9DLHq7p9eGQvtMVHe6O1Vtu9DaaCqjrF7Ooa5 /pNe13ROioqrslM4twOZhnGi2vWJ5tZbFpuusV0pbtZMVtNSlXRY5NS8r4nvfE1savllYxZUiTl5 Wpy+PK0KazDXrTTBNLHajadeUSzLJNXrPSRXKW23K5z1NkvNU3Z09GlvdCkMUb052x8itVvo+l6y +tSdW814h9TdA9G8Izi/YFj+o2Hu1CyOusFV3e5uo1p2vp6SCo25okWRXI9zeqoqfJssso8+4/Kn FLfgcHDzi9qyqOOCiqs2r8tpqmzbs2SSsbRRIlU7nRFVIlRuyu8V22XkcROkus9JrNplxNaN49bc yyLDKCssV+x6WuZbPOtBUt/Cp5ZVVkTmSK96Ne5fFvVdl3Cv71aNUtHOOTh80xptbs5yHAchpsoq u4Xu8SVE8s8Vse50dVKnL3uJjmwSRJMj3RvdLs7ZURthcE2X5Zld/wCIWHKcou94jsusV+tlsZcK 2WoSio41j7OnhR7l7OJu68rG7NTfohUeSXXWTJfKD8NGU6sYTRYVFVUmXUtqx2O6R3Kop2xWqRZa ioqIkSLnkWVjUjZzI1sKKrlVyo2f6b4bxFcOWqertLiuikOfYxqPl1TmNqu1PktHb0op6pqdtBVx zr2qNa5qbPiZJ0TfZVXZArKm4ndQ9IdC+LjU+bIbjfbrierN3seNR3Wrkq4re2WenggjiZI5UZDE sqvSJNmeiqbdSucw1600wTSx2o2nXlEsyyTV6z0kVylttyuc9TZLzVN2dPRpb3QpDFG9OdsfIrVb 6PpesuLA+C/VPMeH/iJ0e1nfRWu9al53XZJa7tTyslpZ5XLTzxVLWMe58cK1EKt5H8siM33am5Yl Hn3H5U4pb8Dg4ecXtWVRxwUVVm1fltNU2bdmySVjaKJEqnc6IqpEqN2V3iu2yhBtZdTtSdTtY+EV umeoN7wy3as2K9XK5xUNUqsWlktlLUqqxO3ikmjifL2L5GPSORUejV22Xuq6jy/h+4y9IdO7Hq1n mRYlq3bMhprpbcnvst07rU0FIlRHUU0k274XKrmtVGqjdt+nhtPNXdJtR8p4r+HLUy2WeO4WHA4c obktyjmhgZTSVluZDArYXydq5HyoqIjEfy/vlROp9NadKM/y3i44eNT8fsHesZwVuUpf67vUMfc+ +W9kVP8ABvekknPIip8G123i7ZOoFM8CGk1Jatedeb37P8+rpMUzyotUMFdktTUQXBi03IktbG52 1VM1F9GR+7k2bt4IaR4ttY7joBw5Zzq3ZqeKa5WK3sSgbM3mjSqnmjp4XOb++a2SZjlT1oip6ys9 CcA1x0f4l9VqWu0vguWAal5NJksOXQX2mZ3BFpXL2ElE74d7lkRke7URE5lduqIXDxHaOUnEBofl +j9XXpQ+yS39jBVObzNgqY3tlgkc1OqtbLHGqonVURQKLt/DLxF27Csd1EwTitziv1PclDcblSZV dlmxiu51a6qploY4VSCPlc9GLEnMmydUVeZv4ya5Z/xHcXmYaDwan5Tg2D6WWG21d0jxO4LQV91u lfGk0aOq2t7RkLIl25Wcu7k3VevT50918oZecEsWjdv0wx/BL5Rto7fcdTUyKiuVIlNArElqKa3O jdK6WVjFRGSsRqK9erd0c3u8y0u1s0g4lrxxFaM4VTai23ObDR2fKcfku8Fsr21dGiMp62CWZEge nZt5HMVW9VVU8U2DrNLMi1A0Z4tL7wtZBqRkebYpe8GTNMbrsiqkq7nbpWVLqealdU7I+Vi8r3or 91ajWInVXKtMaB41q7qz5P2TXTLOJDVGDJ7TZL9X2Ce35JPC1vcZqpWLWdVdWOfLE9rllc5EiSNj Eby7roPSPSTV/MOIfIuKfW3FqDEa5+Ksw3GMWp7nHcJqOj7ZZ5Z6mojRIllfIq8qMVURr3Iq9EVe t4bdDtUsA8nj7RmW4v3DN/Y5k1B5r77Ty/D1dRWvp2dtHI6H0mzRLvz7JzekqbLsFSZEmtGTcC0P F9dOIDO7dqJS47BkdLDZ7n3OytZG5qNhkoGJ2U3aRpzPWRHKsj3bbMRI0mOtedaqZxrdwlWTDtQ7 1iEOpdkvtVfY7XVOZFJF5spqh69k5VjdKxjpuxfI1/Zvcj0RVTZZVU6HapSeTdTQNmL752mCMs3m nvtP/txGoix9t2nY+r8Ln5fzn9rtD9UZtZ+EfLI8X3tWmGOXqgyuo77T/wCx089mhpomcvac03NM xzd4keibbqqJ1AgtbiuqWG8Z9s4b8Y4gdRJMDzbDH5HdfOt6fcLnRPp6iRjmUFZMjn0ySK2JrlTd Ua6Tl5XcjmS7RO55ppvxTas8PdRqRleV4vR4lQZVZn5JdJLhXW6WRVjlibUyfCOYrlRyI5V5eVNu vMqzbINKc+ruO3FNZaWw8+HW3TyssVVcu9Qp2ddJWLIyLslf2q7sXfmRit9W+/Q49p0k1CpuNTUH VqfH+XFL5p7RWOguHe4F7aujm5nxdkj+1bsnXmc1G/IoGJ8qjyXVXydHD3n2b6k5xcL3U52y2VdT JkVU51Yya91TElnVzlWWaJsEaQyOVXRoi8u25oXiprcl0Xu+lWEZFqrqzj2h8VNcfZPmVorqmuvP fubmpo62vaySojh9JURzU3VN2/vEVsdouFPXyn8nVpvpFDhtM3UbBMmZkklgqLpTNSpSK7VU7YUq WPdAjnRTsci8+yeCqi9C/MizrjGp0xbPce0Is1dbqygqqXI9P58kpI7pQ1SVDuwqYbj/ALWma6Fr VdF0259t1Xq0OFwpxWesvt5v2lnFrXataeVNBE1tqvdybdbpabjzqvOtWqpMyJ0aKnYzM5ub0kcm yot36l3Oss2nmSXW35XasYqqS1VMsN6urEfR216Ru5aiZqq1HMYvpKiqiKibbmbtDdFtTa/imuXE nk+jtk0etb8Vdjr8foLpTVtXeal9Q2VayqdSIkCcrWo1Ornryt3XZNktbi70fv8Ar3w4ZxpNi1xh orvfqGNKKSZ6sjdNDPHO2N7k6ta9YuRV2XZHquy+AGDNRtX7RgejM2rOlnGNrtmWotkZTVrq6qtl 1fiV0n7ZiVEfYS0jaSOnVFkRnppts1OZ3rvziTy/VPMNeeF3FNP9RL9htPqVbMgW8Ntla9jOw7hT TPeka7xvmijdMsL3td2citeidD46q4NxdcRHDXc9CH6JWTS2KKxRQTyTZJSVy3Salax0NFRsp920 8UkkTN5JXJysTk5V5le3uLbpfrxmGr3ClqLlGk7sbh02tuSW/KoXXuiqu4OmtkdNTPRY5N5UlexV RI0erEVOflAh/E/qtDoVl+k/CvW8Q2V4XiVyo6+95VnVxuLqy/z0jZZFgpY6tWOcx75ednaI3max saJ0aqO6bS3iTwXCuKDTzT7RriiyPVvCdQ1rLZeLZktxmuVXZa5kXPS1EFTNG2Tkkdux0aqqJs5e qq3lv3iQ0c1Rn1e084mdD7Zbb5lGDQVlquWOV9alG29WupbsscVQ5FbFLG5XOar/AEVV26r6PK6Q ad5fxWZzqNQ1uaaR2PTPBKCknSuo6+9Q3i7XSpciJD2LqR3Y08bFRVcrlervDlTfdoXJerPQZDZq +wXWFZqK50stHUxo5W88UjFY9u6dU3aqpuhBcc4fNK8TuOCXWx2CWCp03ss+P469ayV/daKZkbJG ORXKkiqkTPSfuqdevVSxz5VMPeaaWn7V8fascznYuzm7ptui+pUA8+ciy3Bsly/Nm5rxvaxXPJqa 71MNHTaWW66+ZrBE3pDTvjo6aWKeVi7o9XyOV2yIqIu6r84eLbWrIvJ7acZjR5FHSakaiZXT6ex3 9tO1HQyyVlRF3tI9kakiw0679E2e5XIidESa8NWA8XGgWk0XDLZ9HLBD5urq+Kl1IfkNMtE+CoqZ JUrXUDUWpknY2TlbE5GtdyMRz2puQTFOD/iGdwky8PVXitBZcn0rzOPLcGvtRd4KijyCaOrnmbzM iVZKf4OVzfhEbu57fBEdsHy48tCMo0j4eaGttOuOoWX2yoyWy017osxu/nRJV7y10dTTvc1H08iS Na1WNXs1ZI70d2tVLe1Tueda6cZkPDZa9TcqwjC8RwtuVXqXF7gtBcLnWzVKRRQLUtTnZE1jmu2b tuvMi+LVbC+J/FuNPil0kosRdw80GEeabzbbrWUb8uoa+pu74pmoscCtcyKKFjXPmc6R/O5Y42tZ 1VSx9XdMtbtPuKah4otEMCo8+prvivsSybG33iC2VPKydJoauCafaJVTZrVa5UXZq7fhbtCu8Kw/ JNOvKZW3G8iz67ZVbqXSCpmtNxvcrJa+GjdcvShqJ0RvbKyVJVSRyc3I9iOVyt5l1lYdedEMrrnW rEtYcJv1wSGSoSitd/pKuodHG1XPckcUjnKiNRVXZOiIZ40/0t4jMk42qbiI1Y0/ttjxus09qMdi oKW709d5qXvbXx0s7kVrppX7yyufHGsTUe1nM5W7roPF+H3QXB7s2/4VolgOP3RkckLa61Y3R0lQ 2N7Va9qSRRtciOaqoqb9UXZQMucN+G6jcZWmEnEbn/EFqhismW3G4rjllxG/La6GzUMFTJTxNdEx qpUSc0T1c6XmRybdPFVr3OuI3Wa6+Tn1XvF4zi4UuoelmbNwqqyK0zvoKisdS3Sib2+8KtVivin5 Ho1UR2zt/wAJS19GsV4quEXDq/QvCNCqLU/FbZcq2oxG+QZXSWzsKSpmfM2CthqNpOZkkj1V8SPR ebZE6brF884NNXqDgA1A0gtNPR5VqnqFkceXXmGiqYqamkuE1ypZp2RSVDmN5GQwJ1cqcytXZOqI BzuLjHdVuHrQd/E3atfNQKzOsZrbVW3WilvDvMNf29VFDPTJbUTsI4UWbZmyc6Nam73O3cd9qDZv ZT5SG34+y6V9s87aD19G2toKh0FVS9rc5GpLFIxUcyRvNzNc1UVFRFRSwuPfSnPtaeE7MNNNM7D5 5yS6uti0lF3qGn7Tsq+nlk+EmeyNNmRvXq5N9tk3VUQ/FfpPqBNx42HWeKwb4dRaXS45Pcu9Qehc XXB0yQ9lz9qvwao7mRnJ6ubfoBX2gHEzfsH4P8/u2sN2muOdaETXbHr9JXTukmuFXTKvc3ue9Vc/ t0fDGkiqvO5HLv1J9wv6FVsWmmkmo2td2v2S6n4/bK+4pc7tdKieakku7WPqKdWveqbMjbFEjduV vZuVu3Mu+f8AiI0Vr8q49LJphjNwp1xPV6jtWWai2pqbq6GxTP7N8jU6NjnXsIUXbdXo5T0NAium GmOG6PYXR6f4DbH0FkoJqmeCB875la+oqJJ5V53qrl3klevVeiKiJ0RCjuMvK7bY63BrTk/EvcdL ccuFXUrcbfjdLNLkd/VrE7KKjfAyWaJjHqnaKyNd0eiczehpsyvrtplrHYuKvCuJ7S/Tem1FpbZi tVilfYVvFPbqqjV875W1lPJUqkSqqSOjcm6O5U2679ArThv1hqbPxfU2jOF6p6nZngOS4jUXbsdQ 6SubcLdcoJtuaCathimfC6Poqek3mcvXdNjlcMeJ6jcQV11ziz7XbUikx3GdV8hstkpLLkdRRVEP JIxVa6paqy9jGx0LYoGubEzeVVa7mTl7av064r6niwwDigvWmNqr6N9prMYr8Zt2QU6SY3QSPR0d RJUS8jauVXPlfIkTV2RGsbzcvO6zODjSnPtKodZmZ7YfNa5Xq1kGT2f+yoZ+82ypSDsJ/gnu5Obk d6D+V6bdWp0AzzZ+KXVnS3gh10yK6ZZVZHlulOfXTT+x3u5NbLUzsbU00MFROqptJLGlS927kXm7 NqO367/Ti+4dtQtL+DLM8kdxDai5XeEtNM3JqLJLv3+23Bsk8KT9hC9u9IrHuSSNYnJ0ZyO50cqk jtvBvqNnHDtxL6P5fb4MeuOouqF7yrF6ieqimjmp3TUs9HM9YXPWNkj6dWOa5Eka1VVWeCL8tdrT x08RHDXfdFrnw/WrF7vPboGXK6uy6iqkvUkEkb+yoomqiQ9tJG1znTyNRjOdvpuVFA2DpT/auw7/ AIgt/wDV2GOca0io7l5TrNny6g6gRJbcTt2TRshyeqY173XBJFoZER3p0KKqolKvwaIqpsbQ0+tl fZMBxqzXSn7CtoLPR0tTFzNd2crIWNe3dqqi7KipuiqnyGdsjwDXHBeN6bW/CNL4MzxLMMUocZuU 8d9pqCWzSRVaOfO+Ob0pmJGnNyxorlVVTpt1Co+GvSHJdW9UuJagn1azLDsZotVrs5sOIXHzbW1d a9U5nzVSNdIkcbGx8kbFaiuker+bZqJ8LBxSaqaH8KfENWX7LKvMch0fzqtw7HLzedpamoifPBDT SVK7fCvjWV8iq78LZG+BoXhP0pz7TTLNdbnm1h8202ZalXHILI/vUM3e6CVrEjm2je5Y99l9F6Nc nrRCqqDg4zfULTXij0xzyhZjrNUM/rcgxivfUQ1DXxJJFNS1DmxPc5jFkiajmuRr+VXeiBRmYa9a aYJpY7UbTryiWZZJq9Z6SK5S225XOepsl5qm7Ono0t7oUhijenO2PkVqt9H0vWelOmOaQak6bYnq JS0/d4cpsdBeo4d9+zbUwMmRu/r2R+38xnyjz7j8qcUt+BwcPOL2rKo44KKqzavy2mqbNuzZJKxt FEiVTudEVUiVG7K7xXbZdSUrallLCytmjmqGxtSWSONY2Pft6TmtVXK1FXdUTddvlXxA+oAAAAAA AAAAAAAAAAAAAAAAfl72RMdJI9rGMRXOc5dkRE8VVQP0DL9R5QbSt1qr8xx/THVjIsFtks0dTmtp xZZbK1kTlbLO2V0jZXxMVHcz2xqicq/IdZxdcXF501wrS3I9H7Tf73Q6gZJZEp73aaClqaWqt80q SPo4+3cipU1MKObGnImycy88bkQDWYMZas8aOoWM696M4bY9EtUqW15HTXi4XqxOstudcLsxlDzQ wU6OqFRHwSr2k20keyNaiLIiq0uLUviuwfTjMaHTakwzOczzSrtjbxLjuK2ZK6toqNy8qS1KukZF Eiu9HrJvvt6lRVC6wVfonxFYBrtSX9Mcpr3ZLxidU2jv9hyGgWhuVqlc1XM7eJVVEa5rXK1zXK1e V3XopWNZ5QfR2CnrMloMH1NuuB26qfS1We2/F5JsfjVj+zkkSdH9o+Jr90WRkTm7p0Vem4aeBlfP dRbzXccGgVrxXN7hJiGUYnf7lLSUVwk833JqU6Pp53xtd2cuyKjmOVF233QtnE+IPC861YybSjD7 bebq/DImpfsgghh8z0NWv/0F07pEe+pRE3cxkbms8HOaqKgFngzNVcfmljqW55HjWnOqWU4VZ55Y K3M7HjC1Fkj7JVSaRsqyNkkjjVF5pI43NREVd1TqTjUzir0h0v04w7Vy63SpueI5vd7fabddLY2N 8MffGvfHUzLI9isha2NyvVN3t8ORVRUQOfrbw5YDrtJYLpkVbf7HkOKzyVFjyLHbi6hududI1Gyp FKiKnK9ERHNc1yLt4HXaP8LWB6Q5hc9SPZHl+aZpdqNttnyPLrt3+uZRtcjkpolRjI4o+ZEcrWsT dUTclWkWq0Gr1gq8ko8DzLF6SCsWlpmZPavN89dF2bHtqYYlcruxckmyK9Gu3a5FamxGNXOKLTzR fUHGdNMrtmRVV4y+iq6u0ttdA2qSokgVje7NY16Sumkc9qMRrFb4q5zGoqoFwAznbeOTTaqyW6af XbT7Uex55QthfSYfcLEzztdo5EcqSUjYZpIpI0ax7nPdI1rEaquVERdprovxIYVrVccqx2gsWSYt kmEzQxX2w5NQso66jbMxXwyqjJJI3Rva1ytc169E3XZFaqha4Mv1HlBtK3WqvzHH9MdWMiwW2SzR 1Oa2nFllsrWROVss7ZXSNlfExUdzPbGqJyr8hYWqfFPpLpLpxiGrd9uVVX4lmt1ttst90t7I3Qxt rY3SRVUyyvZyQNYxXPVN3on7xeuwW8CgouMrBabM8YxLLNOdSMRpM1r2WzHr9f7C2lttwq5P3GFF 7VZonyfvWzRRqvrRNl27fVXiowbTDOqfS6jxPNM5zOeg86yWHELP3+qpaPm5UnnVz444mK7onM/f dU6dU3C5gVbotxG6e640OQvsEN6sV1xGpSkyGx5HQrQXG0yOarmdvG5VRGua1yo5HK1Ua7r0Urm0 8fuj96p6rJaHDdR3YJTVMlImeOxxyY/I9r1ZulRz87Y1kTk7V8bY0cvpOb1UDTAKWtvF1o9U8Ott 4nrzWXKw4fdY1dSxXGmatfJJ2z4WQthhfJzyvexeVrHO6dV2RF26nF+M3BLvmVgwjNNN9S9OKzLJ kpbBU5ljyUNLc6lU3bTxyskkRsrk8GScjlVUTbdURQv8FK6o8VuD6a6h02ktuw7Ns7zKWgS6VNmx C0trpqCjV3K2eoc+SNkbXL0RFcrurenpN3qfh21urdWuNbVeC1ZLkrsYocTs7oMfurqinS01yPVl Sx9FKqJTzo9qo/ZqKvju5FRVDYQKY4v9ZL/oTw+5bqDi1gvFxu9Nb6iChnt9NDO22VDoJOyrahsr kb2EcjWc2yPVVVqcioq7dBg3Fhj9p4Z7brhrdacmxCOmpaGkqHXq3Qx1N6rJKaFyTUUFM9/aMmfI 7kREYvovVWMa3cDQwM+49xpYJXZdj2H51ppqbpvPltS2isNZmWPJQ0lwqndWU7JWSyIyV371knIq r08VRDQQAGW8L4hNNNOcN4gdT5L3qpkltwHOrlT32lvlTT1b6SoY6Jr6a0MWVrWUTVe1Y2Pc1U9L dDsr9x36X47YaXPK/T/Ul2n9TJDG/NorA11mg7R6MR7n9r2zoke5GdqyJ0bl/Ac9FRVDSQMmcTHF hmmlevej+nuHYHmV5tGSVNdWXFbNbqKpTIKZlE5zaaidNK1VfHI+OWRd4tmo3Zz0VWlkai8V2Dae 5FaMDiw7N8rze72xt49imNWhtbcqKjXZO1qkWRsUCI5eX0pOrvDdFRVC6wVbo5xG4BrZBkFPj1Hf bPfsTlbDfsbv9vWhutte9quj7WFyqnK9qKrXNc5q7eJEdDONDT/iIqbA3TXAtQKi33qGokq7tUWe Ntvs0sXaqlPW1DZXMZM9ImuayNZOk0KuVvNsBoAGZbp5QHSGj863q0YNqbkWF2Kpkpblm9lxh9TY aZ0TuWZ/bo9HyRxrvzPjjc3ZN0VUVFWwdS+J7SbTLEsYy2rudbkCZysTcVtuO0jq+vvqyMa9vdYW bc6cj2uVyq1qczUVUVyIoWyCl9L+KvBtSM8fpZc8RzXAsyWjdcaWyZhaEoKivpWrs+Wmcx8kUqNX xRr+ZNlXbZrto5RccGAX3JMxwvCtNNScsyPBr9W2G7Wuy2aCeVi0zkatVzuqGxNgkdzNj7R7JHrH JtH6K7BosGV9UuNexT8KGa626OWXJ627WdK+xzUrrZEytxm7MhftJcaed6IxkMnZq9E7TfnaiNci rta3DTqjftXdILDluTYhk1hubqKkiqXX2jp6Z9ylWlhkfWwMgke3sJHSO5V9BfRcnI1EQC0gVnrZ xB4FoPT2OPKae9XW85RVuobFYbDb3V1yukzGo57YYWqm6NRWq5zla1OZN16odFpTxV4PqhntTpXX Yfm2CZlBQedYbHmFnSgqKyiR/I6eBWSSRyNR3Rdn79F6ei7YLpB50XvVPU6Lhx40r5FqNlDLliuo 92obFWNu9Qk9qpmT06MhpZOfmgjajnIjWK1E3XZOpvPTSrqq/TjFK6uqZaipqLJQyzTSvV75HugY rnOcvVVVVVVVeqqoEkK7zHQ7E821g091rutwu0V802ZdY7VT08sTaSZK+n7Cbt2ujV7tmJu3kezZ fHmTofnTDXbDdVH53Ba6S52mbTvIqzG71Fdo4onNmp2tetQzkkeiwPa7dj1VqqjV3ah0WgHFTplx F6aXjVXD4LzarNYauelrmXunjp6iJIoI6hZVZHJInZuilY9rt+qb9E2AuMGf142NJI9HsK1fqrPl sSaiyyQYvjLLY2ovt0kbI5u0VNBI9qoqNR/N2nKjXs3VFcjTuNL+KvBtSM8fpZc8RzXAsyWjdcaW yZhaEoKivpWrs+Wmcx8kUqNXxRr+ZNlXbZrtgugGUeE7U+4trOJi/wCpmd181kw7VK+xRVF3uEk0 NqtsDGO7OPtHKkULE5lRjdmp12Q7S2+UA0hqXWm7XrBtTccw2/1UVJa82veMPpbDVOlXaF6Tq9Xx xyLtyvkja3Zd1VERVQNNAp/VzifwPSXL7Zpx7H8rzLNbtSOuNPjeJ2vv9e2ja7lWplRz2RxRcyK1 HPe3dUXbfY++j/EvgGstfkOOWy15HjmVYo1kl4xnJLatDdKWN6bxyrGrnMfG5PBzHuTq3dU5m7hb IMsWjyh+leSaXx6xYtpfqpe8WghlnvNbQWGCVtjbG9yPSrd3jl3axqSuSF0qsjexz+XfY7bI+PPS CxY3DqHQ4rn1/wBPlWBKnNrRYe1s1J2itbvI98jJXIxz0Y9Y4no1/MxV52q1A0iCsNX+IvTbReyW K65DUXG7VmVztpcds9ho3V1xvMqtR3LTQs/DRGuaquVUanM3dd3Ii9NpfxV4NqRnj9LLniOa4FmS 0brjS2TMLQlBUV9K1dny0zmPkilRq+KNfzJsq7bNdsF0A/E0qQQyTuarkjarlRPFdk36GW7R5Q/S vJNL49YsW0v1UveLQQyz3mtoLDBK2xtje5HpVu7xy7tY1JXJC6VWRvY5/LvsBqcGbsj489ILFjcO odDiufX/AE+VYEqc2tFh7WzUnaK1u8j3yMlcjHPRj1jiejX8zFXnarUsLV/iL020XsliuuQ1Fxu1 Zlc7aXHbPYaN1dcbzKrUdy00LPw0RrmqrlVGpzN3XdyIoWeCl9L+KvBtSM8fpZc8RzXAsyWjdcaW yZhaEoKivpWrs+Wmcx8kUqNXxRr+ZNlXbZrtugvPGxhEGSZDj+D6UarahQYnXS2u83bEsaSsoKSs i/dqftHyxrLIzdOZsbX7bp47oBocFKXfjB0Qtmjlg1vpL1cbxY8rrI7XYqO2W6We5XG4ve9iUUVN sj+3R8cjVauyIrF69U3+GBcXGG5fqBa9MMm071E07yK/wzzWSmzKxJRMunYt55WU8scksbntZ6Ss VyORPV6gLyBQWX8ZWD2HN79p9h2m2pepF1xR7Ib8uGY+ldBbJnJzJDLK+SNqybb+gxXL0VPFFRJh g3EfpFqBo/Va6WfJu7YnbYaqW5z10L4Jrc6mRe3iniVOZkjNurdl33Tl5kc1VCzQZam8ofpLb8Lq NR8h021UsOKPo5ay03q6Y0lPR3vljdIyOllWXlR8rGqsSTLEkng1VVUQsTOuKfTDT7AMMzq9Q32p n1BgppcZx63W9au8XN80LJUiip43Kiua2RvOvNyNVUTm6t3C4QUvpfxV4NqRnj9LLniOa4FmS0br jS2TMLQlBUV9K1dny0zmPkilRq+KNfzJsq7bNdtdAAAAAAAAAAAAAAAAAAAAAABWOt/DzgOvVNZH 5VPerVecYq3V1iv9huDqG52uZyIj3QTNRdkcjWo5rkVq8rem6IqdLpLwqYHpVnFZqhU5Tmec5pV0 XmxuQZhd/OFXTUfNzLBBysZHExXdV5WIvj16rvdAAAAAAAK7zHQ7E821g091rutwu0V802ZdY7VT 08sTaSZK+n7Cbt2ujV7tmJu3kezZfHmToWIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAABXeY6HYnm2sGnutd1uF2ivmmzLrHaqenlibSTJX0/YTdu10avdsxN28j2bL4 8ydCxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHHuNGtwt9VQJV1FKtTC+Ht6d/J LFzNVOdjlRdnJvui7LsqIcgAVJorw0YPoneb7l1Dfspy3LckbHFcslyu5JX3KaCP9zp0kRjGsib4 o1jU32TfflbtbYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIxqhly6f6Z5bnjbYtxXG7FX 3dKNF2Wp7vTvl7Lf++5OX+ck5+JoYamGSnqImSxStVkkb2o5r2qmyoqL0VFT1Aefjl1gy/gquWvu onFPLj1pyXFayvhxXGsatMFsjSpjkSK2sdLBJPLJI96RL6fPzvVEXdOZYnfpmO4EODed0qKyPUzE Od6u6NRrqtF3X1bbbGx8L4MOGHT3IW5Piekltpa2KSWanZNVVNTS0r5EVHugpppHwQKqOcm8bG9F VE6KKbgx4Z6XTK5aORaXU64ddbg26T2uS41r2sqm+EkL3TLJTqnXZInMT0ndPSXcK11+c1nlA+Fd z1RqOos0air03XzYnT+U40mVax658WmqOlGD6nwaXWTS+hs8NVU26xUVZeL3LXQLOjllq2SNjgj2 22a31sXf0ultZRwf8OmaYTjGnmTacsrrJhj5ZLEx10rWVFC6V3NJy1LZknVHrsrkdIqLs3ffZNmd 8H/DjqVfKHJsw01gqrrb7fFaoqunuNZSSSUkaIjIZlglZ27ERETaXn6IiAY60hgvV51Y43bJi+o1 xz69z4VR2+ivs0FPFUXCtjtlVAnK2mZHEvZzJ2KOY1N+zTqqruug+EvONIrf5PvDslymvtHsMs2H up8jSqibPTt7JrmVsU0OzudXP7RFj5VV/OiIjuZEW2Lbwz6F2TUSzarWLTuhtWTWC2ttFvqrfNNS xRUbY3RsidTxPbDIjWOVredjlRNtlTZNoreeBXhMv+Wz5rddFbPNcaqr7/UxtqKmOiqKjfdZJKJk qU0jlXdVV0a77rvvuBmLiTo8j1P4i+Hai4WMlteIeyXAb4lgustulpYrfbJaZq9pBT8jXxP7Bdo0 VreVVavTbdJtw73mnruDHU7h5xrD2Ynqtp9jt5sV/scDnOnnu0tHMkVxY9VV8zap20jZN167oiq1 GKur7npHp5d9Qcc1Tr8cY/J8So6m32atZUzRtpKeobyysSFr0icit6ekxVT1bHyfo3pu7VdmuDMc 7DNm2xbM+6U9ZUQ9vR779lNCx6RToi7KiyMcreVuypyt2DF/B/hWvGScJWG3zCOL/E7Bh1PZZIqi 21OnNLVMtnZq9KmGonfWM5la7tFc97W7ovMqbKRrVjSrGNO+CTh902smpVDqRjftuWXul7p6RIae spamqrJFYjO1lTlasj2fhr4KmyeCayyPgX4UcryKuyi86PUDqy51He66KmrqylpKubfdXy0sMzIJ HKvVVdGu6qqrvuWBmOiWlmeY5juI5Nh9LLZcSuVFd7JQ0sstHDRVVIipTOY2BzPRYjlRGLuzbxau yATgyRrXTQVHlFeHJ88TXrBj+VSR8yb8ru67bp+fZV/ymtyJXnSnAcg1Fx3Vi72HvGVYpTVdJaK/ vUzO7Q1LeWdvZNekb+ZvTd7XKnqVAM6V1JTS+VYt80kDHPh0JdLG5U6tf58kZzJ+flcqfyKR+ly5 dPeM3imzuO2LcFx3TW0XlaJq7LVLTUckiR/yu5OX+c1W7SnAX6qs1tdYd80jsPsYbc+9TdLZ3haj sOx5+y/dVV3Pyc/q5tuh+LfpHp5bNQMh1So8cY3Jsroae23isfUTSNq6aBvLFGsLnrE1ERVTdrEV fWqgYpcusGX8FVy191E4p5cetOS4rWV8OK41jVpgtkaVMciRW1jpYJJ5ZJHvSJfT5+d6oi7pzLDs uhprn5PPhPpKpjKinnz7FIJWO9JrmrJVNc1fzbbpsbMwvgw4YdPchbk+J6SW2lrYpJZqdk1VU1NL SvkRUe6CmmkfBAqo5ybxsb0VUTop+7Rwb8N9hxSjwa0ac92sVuyOnyykoW3evWOC6Qb9lMzedVa1 vM74JF7Nd13YoFY+UeRPYJpC/b0max4w5q+tq7z9U/ynHkyrWPXPi01R0owfU+DS6yaX0Nnhqqm3 WKirLxe5a6BZ0cstWyRscEe22zW+ti7+l00hqRpRgGrlBaLXqFYPOtNYrxS3+3s71PB2NfT83Yzb xParuXmd6LlVq79UUiWpnCfw+6wZbHneoOnUFwv8dMlE6vgr6uikngTwim7tLGk7PVtIjk26eHQD FelyXO46mcclrsOo1wz26vwWloqa/TwU8U9fVxWqqh9FtMyOJezlRYUcxqb9mnVVXdb00PybTml8 mRZrtdaug9jdPpxUUlyRXN5HTJTyRVEKp65HTc7OXxV7kRN1Uuqj4Z9EbJn1q1WxrTq3WvK7Ba0t FsqaKeekgjpWxOjjhfBE9IXtaxytRXxuVqbbfgptipcYxPG6LIXJ5OLOrdrFPNXNt8NlpqivxJLg /nbT10U7pkooWtRzHq/sWOYqLy7bIqBXl2pb57hPg7vFJkkGPWq26gUslZeKqiSspbXM6sq0p6ue BzmtkjjdzqqOciLvsq9TR+vHD7q9l9mxaxa6cdOJ0tumyi21NkSTT2moZai7RvV1OyCVK/ftHeki IniiqXVoDw72zDeFHEuHvVWy2u/w0tlbS3qhqI21FLJPJI6aRib9HIyR6o1ybLuxHJsux9tP+DLh m0vyiizPDdLKWC82tFS31VbcKy4LQ7pt/Y7aqWRsC7dEWNG7eoCqeHqogt/lBeKG13+RjLzc6LE6 20tkXZ8tvjoXMldHv4sa98DXbdObbfqcDQi8Y5evKT8QtRjk9PO2nxyx0lbLAqK11XFHGyRN06K5 qojHfI5iovVFL71b4XdB9c7zb8j1P0+p7rd7XEsFLcYaypoapkSqq9ms1NJG9zN3OXkcqtTmd06r vz9O+HjRjSXIajKdN8Do8fuNXa6ezTPo5pmxOpIXK6NnYq9Y0Xmc5yvRvO5XKrnKqqBC+O9FXg81 aREVf+xqpX/qM/cRM1PQ6Q8GOV3yViYjacuxCou88iotPBzUTexnlXwSNq8+7l6Jv+c3RkeO2PL8 fuWK5Na6e5Wi70stFXUdQ3mjqIJGq17HJ8itVUK7w/hY0BwTTm76R49pxRew+/SdrcLTX1NRcIZn bNRF/smSRzduRitRqojVaipsvUClfKdSwV2h2KYvbZGSZRfc+sUGNwMXeeStSZV5o0Tr0YrkVyeH OietDYBTWnXB5w3aU5RS5phOmNNT3ugjWKhrK24VdwfRMVNlSn71LIkHRVT4NG9FVPBS5QPMW7fF c48P/Ohff9dTGgOKGipKTyZt7oaanZHT0+AWqOKNqbNY1rKblRE/Nsn+Quubho0SnxbPMLlwrms2 pt0nvWVU3nKrTzhWTOa6SXn7Xni3VjfRiVjU26InUkWVaU4Dm2mtRpBk9h77iNXQRWya3d6mj5qa NGoxnasekqbcjeqP36dV8QMk6iSba7cCMsr9kW33xFc5fFzrJS7Jv8qqR2yYrrFdfKHa/WnCNbrZ p5erla8euFAlwxWK8vutsZSNjcsHaTxdmyKXZr+Xm5nO67cnXXGpXDXojq9itgwvUTBYbtasWWNb MzvtTBNRcjEY3s54ZGSp6LWovp+lyoq7qiKcfUHha0D1Stlgtec6dUlwbi1Kyhs9VHV1NNW0dOxq NbEyqhkZPy7J4K9d16ruq7gVJovo7d8a4ns41Ezbifx/UDNfYdDY71YLdjUNpmpYllZLS1M7Y6qX qjWPYm7EVWyJ1TZEWJ8AFkuE/kzKCmxOBWXq72jKFp1hTZ8lYtXWxRL08XehGif+KhqDSrQvSXRG zVth0twihsNLcpe3rnROklnq5NlRHTTyudLKqbrtzOXbddtt1Ox0t0swPRXBbbpppnYvM2N2hZlo qLvU1R2XazPmk+Eme+R28kj3dXLtvsmyIiAZ34G8w0wt/k/cUu+QVtrixnH7DXwZKyqY18VOscsy 1cc8Wy7q7dzlYqKrkkTovMm9O6xyty/iu4acn0Kz616e4rkWHXSmwm8VGKdtRRTuRznRRUUywJG6 WGSJrN+VV5m7Iu6Gn8m4GuFDMMuqs3yDRi1VF0r6pK2sRlTUw0lXPvzdpNSRytp5XKu6qr413VVV d91LC1G0Y0s1bxCPA9RcGtV6sNOsbqajmi5EpXMTlY6BzFa6FzW7tR0atVEVU8F2AzfX6F5/U8SO kOQ6z8Y+M3rJ8XqLlcMdsEOFQWqtuVO+BGVjGPZWOcrOzRFX0HIiNXp0XbjcA90x52sHFTZYZ4Ev keq1xqqiLdO1WkdJI2J23irUe2ZPkRV/OX1pTwvaD6J3mqyTTfT2mt15rIe7zXOprKmvrFh6L2aT 1UkkjWLsm7WuRF2TdOiGc9BeFHDdRsm16n110muTe86tX2vsNdVNrbVUT0E6RfCU9RE6KSSnk5U/ BcsblanjsBU12kju2nHlA8isTmzY9VXfutLND1hkrIIHJWK1U6KvM5iqqfKim/NAnsk0J04kjejm uxKzua5F3RUWji6ofvGtDtJMO0yn0bxrAbVQ4XVU09JU2dkSuhqIpmq2XtVcqukc9FVFc5Vcvy9E Pno9oXpZoHj1Riuk2MOsdqqqnvctOtfU1e8nKjd0dUSPc1OVrURqKjU26IBSvEXqFqZd+JbTLhw0 zya2YTUZBabjkFXlc9oguNbFFCjm92oo6hFjbI5Gu53KiqjVRU/BVHVFDQXTGfKX6T4pkOuN41Fu 1Fi17SqluVHQU7qBZKaR7adO5wxNVytRJFY/dzWuYvRHJvsHV7h90e14htcWquFw3p9jmfPbaltV PSVVI923P2U9O+OViO5W7ojtl5W7ouyEcquDnhqq7bjNqdpVQQRYfXTXOzyUtXVU9RBVSqxZZXzx ytlmc/s2c/aufzcjebfZAMT3/wCK7x3/APnRvP8AWKU9FNKf7V2Hf8QW/wDq7CM1HDNojVYtnmFz 4TzWbU26TXrKabzlVp5wrJXNdJLzpLzxbqxq8sSsam3RE6li2m10NjtdHZbXB2NHb6eOlp4uZXck TGo1jd3KqrsiIm6qqgefPFBlFx0C1d1/x+worKjXfT+1VFiY1eVHXpaltlkZF/4Ts6uKddvU3f1H R65sl4XJ9XdAsKRVk1U04xW34vCz0EkrmvZj9Qxn9+sD6eVduvo7+O5u7UXQXSXVjKsPzbUHD4rv esBrluOPVTqqeJaKo54pOflje1sqc8ETuWRHN3b4dV3Z9oLpJqhmuIaiZ3h0V1yHAqpazHq11VPE tHMr4383JG9rJdnxRuRJGuRFTdETddwxlrnpplGA8WvDNg2Bai0WCUlsweuxjGr5cLIy507K6CHk kiSF8kbe1lhWJqLz7qrkRN1Usiv0Lz+p4kdIch1n4x8ZvWT4vUXK4Y7YIcKgtVbcqd8CMrGMeysc 5WdmiKvoOREavTou2ldUNItNdacaXENUsOt+RWntWzshqmrzQypuiSRSNVHxPRFVOZjkXZVTfZVI 3pTwvaD6J3mqyTTfT2mt15rIe7zXOprKmvrFh6L2aT1UkkjWLsm7WuRF2TdOiAYNyu33258K/HbT Y6yV9W3Va6VEiRIqu7tFV0klSvT1JAyVV/NubWvmpvDtY+F+w51qdV2Go0yqrRaUjZWUHnGmna5I kp420zWSLK5r0YqNaxytVirsnIqpPsM0g050+kyuTE8ZjpPZxd6m+5A2SomqGV1bUIiTSObM9zWo 5ERFYxGs+RqFdY7wM8J+KZfS5xYtF7TT3SgqlraNrqmplo6Wo33SSGjfKtPE5F2VFbGmyoiptsgF ZaQz0ls8pHrZS33anrMgw3HK3GGTsWN8ltihZHUpE12y7JOnpNROitXdOin4lkhvPlRLjU4u9ssd i0a7lkkkK7tjqJLiskEMqp/visdE9EXryonqQ0Dq1w9aNa5rbpdUcGpbxVWhXLQVrKiakrKXm/CS Opp3smY1fW1H7L60OTpXoXpLolZ62xaXYTRWKmucvbVz43yS1FZJsqI6aeVzpZVTd2yveu267bbq Bkrg4pKaPyTNQ5kDEWqxPMpJun7o7vFwZuvy+i1qfyIgmpKan8jwkMMDGMXTVsqtROnO7Z7nfyq5 VX+VTW2HaHaW4BpL7RmJYv3DCO51tB5r77US/AVb5H1DO2kkdN6TppV35905vRVNk2P0O0tk0e9o N+L74IlrSzeae+1H+00TZI+27TtvV+Fz835wML6hWnPKviG4SanHdSKPBZbnpo+3WO+XGysulPHc u5sWaFIZJI29pLE+NiLzou6oiIqqiFv1+hef1PEjpDkOs/GPjN6yfF6i5XDHbBDhUFqrblTvgRlY xj2VjnKzs0RV9ByIjV6dF20Pmeg+kOoen1Bpbm+CW+84xaooIaCiqle51KkLEjidFNzdqx7WJy87 Xo7ZV3Xqp1OlPC9oPonearJNN9Paa3Xmsh7vNc6msqa+sWHovZpPVSSSNYuybta5EXZN06IBZld/ tKo/4J//AFKYV4OKSmj8kzUOZAxFqsTzKSbp+6O7xcGbr8votan8iIbvkY2Rjo3pu16K1U+VFINh 2h2luAaS+0ZiWL9wwjudbQea++1EvwFW+R9QztpJHTek6aVd+fdOb0VTZNgyTNSU1P5HhIYYGMYu mrZVaidOd2z3O/lVyqv8qkN1CtOeVfENwk1OO6kUeCy3PTR9usd8uNlZdKeO5dzYs0KQySRt7SWJ 8bEXnRd1RERVVEN0P0O0tk0e9oN+L74IlrSzeae+1H+00TZI+27TtvV+Fz835z85noPpDqHp9QaW 5vglvvOMWqKCGgoqpXudSpCxI4nRTc3ase1icvO16O2Vd16qBniv0Lz+p4kdIch1n4x8ZvWT4vUX K4Y7YIcKgtVbcqd8CMrGMeysc5WdmiKvoOREavTou3yxXRnOrbX5bqNwMcTlibj9+yKvuV0xS/2t lytDbyr9qpramNW1FKnM1N2Ii9FRfDlL20p4XtB9E7zVZJpvp7TW681kPd5rnU1lTX1iw9F7NJ6q SSRrF2TdrXIi7JunRCPZnwP8LWfZNcswyTSinW63mRZrlJQXSut8dbIv4TpoqaaOOVyqqqquaquV VVd91ApS25fp1xo6CafVWoeT0+k2fU+aTw4vWWSqYrG5Fb3PaslFzpyzxPa7fkcvVV5UcqojlkNL qXxIaB62aa6X685Rhup1h1Dr6m02i/0Fp813uiqo4uftJaZrnQuiVFajlj223VVVNka6+L/w6aG5 PplR6N3rTCwz4XbuVaK0Mp+yipXtVVSSJWKjo5N3PVXtcjlV7t1XmXfptMeEfh30eyduaYFpvBS3 +OJ0ENzrrhV3Kpgjcio5sUlXLK6JFRVReRW7oqp4KqAUNo7kms/EjWaoakRa+M0jxPGcvudgitFi sNsdM1lEjeerr6qsikXtHNduqbNaiIq77eGbcWlr775M/iqmx681l5kk1PuVV36WFsU9VS94tUks 8kbGtaxXxJI9zWta1N3IiIibHoDfeDPhkyXOq7Ue96TW+pvl0qW1lwVaqpbSV07V3SSoo2ypTTO3 6qr43Kqqqruqqci48PWnGFzaiaj6YaVWiszTNLXVx3GhrK+eO33uV7d1hnhc50EaSuaiPekW68yq 7fddwqXjPybTlfJ1X+ufV0ElkvGK26GxNa5qtnmf2LqRIk/fK1Wtf08GxuXwapSGZ2fO6nXjhAnx vUeiwSS5aXebrHe7hZWXSnjuXcmLLCkMkkbe0lifGxF5kXdUREVVRDpr/pjjt/0puWmej3AFqJiO q2VUTrLNVXimqX49YHVDkbWz01dUzyQRxKztEasDWuc12ypsuy72uXD3pnmWkGO6Oan4tb8qs9gt 1FRRJVxq1zZKeFsTZontVHxP2RfSY5HbOVN9lUCiK/QvP6niR0hyHWfjHxm9ZPi9RcrhjtghwqC1 Vtyp3wIysYx7KxzlZ2aIq+g5ERq9Oi7a2or7Y7lX11qt15oaqttjmNrqaCoY+WlV6KrElYi7sVyI qpzIm+y7FdaU8L2g+id5qsk0309prdeayHu81zqaypr6xYei9mk9VJJI1i7Ju1rkRdk3TohIsR0h 07wXNcw1ExXHu45DnstJPkNZ3ueXvr6Zj2QL2b3uZHytkenwbWou/XfZAJiAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAp2065ZffLfFdLXpT29LPzdnJ59ibvs5Wr0dGi+KL6jl+25n/wA0P9PwfsFK OELFUZxnl/LV5K0Yu1OuJnunyWuCqPbcz/5of6fg/YHtuZ/80P8AT8H7Bnl9nr+GryOV2t890+S1 wVR7bmf/ADQ/0/B+wPbcz/5of6fg/YHL7PX8NXkcrtb57p8lrgqj23M/+aH+n4P2B7bmf/ND/T8H 7A5fZ6/hq8jldrfPdPktcFUe25n/AM0P9PwfsD23M/8Amh/p+D9gcvs9fw1eRyu1vnunyWuCqPbc z/5of6fg/YHtuZ/80P8AT8H7A5fZ6/hq8jldrfPdPktcFUe25n/zQ/0/B+wPbcz/AOaH+n4P2By+ z1/DV5HK7W+e6fJa4Ko9tzP/AJof6fg/YHtuZ/8AND/T8H7A5fZ6/hq8jldrfPdPktcFUe25n/zQ /wBPwfsD23M/+aH+n4P2By+z1/DV5HK7W+e6fJa4Ko9tzP8A5of6fg/YHtuZ/wDND/T8H7A5fZ6/ hq8jldrfPdPktcFUe25n/wA0P9PwfsD23M/+aH+n4P2By+z1/DV5HK7W+e6fJa4Ko9tzP/mh/p+D 9ge25n/zQ/0/B+wOX2ev4avI5Xa3z3T5LXBVHtuZ/wDND/T8H7A9tzP/AJof6fg/YHL7PX8NXkcr tb57p8lrgqj23M/+aH+n4P2B7bmf/ND/AE/B+wOX2ev4avI5Xa3z3T5LXBVHtuZ/80P9PwfsD23M /wDmh/p+D9gcvs9fw1eRyu1vnunyWuCPYBlvs6xGgynzf3Lvva/Adr2vJySvZ+Fs3ffk38E8SQlm ium5TFdOydcJ6aoriKo2SArLV/V+8aa3jGbBYMG9ktfkvfeyi85souz7uyN7vSexzV3a9V6qn4Pr 3Ip7fesP4uv0upfsyOvE26KppmdcdU+Tq2OB8XiLVN6imNGrZnVTGyZjZNUTtiV8Aof2+9Yfxdfp dS/Zj2+9YfxdfpdS/ZmvK7W+e6fJL6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t8 90+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/F 1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t 890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/ F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2 t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h /F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV 2t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71 h/F1+l1L9mPb71h/F1+l1L9mOV2t890+R6Cx26n46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mO V2t890+R6Cx26n46PuXwClMU1+zG7ahY/gmWaSex32Rd77vVef4qvbsIHSu9CONPkanVyfhb9dti 6yW3dpuxnR/neo4vBXsDVFF+MpmM4ymJ1ZzG2JmNsSAAkVQAAAAAAAAAAADo7tnOFWDm8+5fZLcr fFKq4RRKn/pOQxMxG1tRRVcnKiM56neArC6cTOhVocrKnUW3yuT1UsctTv8AyLExyHUycV2mMn/a i35Td/k7lZJnb/yc/KRTiLMbao716jgnH1xnFmrL+WY+a5QUk/iejm/7XaM6hyovgs9tjhRf8sin xdxF5nL/ALQ0Fv70/wD5i4wQ/wDXua8rs7/CU0cB4+f3Mu2qmPnK8wUSvEBqi79y4e6tf/HySmb/ APuH89vzVxOruHd6J+bK6VV/ydmY5Xa3z3T5M+gsd0afjo+5e4KKTiC1Mb+68Ptcn/iZDTO//dP2 3iPyaH/thoTlEfy93qIZ/wDqVByu1v8ACfIngPHdGPion/2XkCk2cUVri/7Z6S6jUiet6WdsjE/l Vsn/AOI5MfFjo6zZLvXXm0L6++2eobt/LyNcbRirM/vQjngbHxstTPZGfyzXGCvLTxCaJ3rlSi1L sjFd4JVT92X/ADqNJna8gsF7bz2W+W+4N233palkqbf/AHKqSU3KK/VmJU7uFv2Pa0TT2xMfN2AA N0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADP+lH+4C1/8/8A695LSJaUf7gLX/z/APr3ktOLhP2ejsj5ONa9SOwABOkAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAB2OgH9qOw/4V/WZSwivdAP7Udh/wr+sylhFnA/stv8Alj5Qv4f2NHZHyUPr 3/bh0j/T/wDVYjtTqte/7cOkf6f/AKrEdqVbnta+36Q91hf2Gx/LP99YADCQAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAESqPjB6Ufp3+omkDN9R8YPSj9O/wBRNIFnB7Ku36Q43D/r2f5P/esABccA AAAEZzjUnCNOKBLhmWRUtua9PgonKrppl+Rkbd3u/mTb5SprjrlqZm28Gl+DJZKB67JeckRWOc3+ FFTN9JflRXKqLum6IQ3L9FvVM69zoYXgvE4yNOinKnpTqjvnb2RnK/JZYoI3TTSNjjYiuc9y7I1E 8VVV8EK3ybiN0fxiZaJ+XQXSu35W0doY6tlc7+D8Hu1F/MrkKqqtMa/LJEqdVM7veVu5kf3N0vda FrvHpBEqJ/Pv6iV2XGsexyHu9gslFb49tlSngaxXfyqibr/OVqsVcq9WMu3/AD6uxa4FwtrXermu d1OqO+c5/ph+KriB1Fvm6YNoxWQwO/ArMhrWUmyepVgbu9f5nHU1NbxDZIqrd9SbRjkTuq09itaS rt8nazqrk/lQlYIZqrq9aqfl8l+3aw1n2VqmO2NKf6s47ohAajSOG87rmOe5jkXN+FFW3eRIf5EY zbZPzbnMt2jel1r27thFsfy+HeI1n/1iuJkDTi6duSxyq9loxVMRujVHdDhUFls1rTltlpoqRE9U EDI//hRDmgG2xDMzVOcgAMsAAAAAAPEADqrhieLXbfzrjVrrObxWejjkX/2oRqt0P0urX9qmKQUs qLu2Sjlkp3MX5U5HIn/sJ0DWaKatsJqMRdt+pVMe+UGp9Osksmy4hrBmlrRv4ME9d3ynb/JHIm3/ ALTs6XK+JDG9kbecVy+Bvj32kdQ1Lk/MsS9mi/ykmAiJp9WZj3tK6qb3tqKau2mM+/VPi4FJxL3C 0KjNRtJcisrE6Oq7e5lypm/3znM2VqfzKpPsQ1m0uztWRYvm1sqqiTZG0r5exqFX5Eik5Xr/ADIR AjmSadYRlrX+f8ZoamV/jOkfJN/+sbs7/wBpNTfu08+fb+nkpXODMDe2UzRPVOcd1Wv+poYGZaHG tTsIRHabaoVy0zPwbVf077S7fwWvX4SNv/i9ST2riVnsEkdBrHhNbjjlVG+dqJFrLa9d/FXN3fHv v4Kjl8d1J6cXROqvV8u/zcy9wFfp14eYuRujVV8M7fdmvMHAsl9suSW2G8Y/daW40U6bx1FNK2Rj v509f5vFDnlqJz1w4tVM0zo1RlIAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAM/wClH+4C1/8AP/695LSJaUf7gLX/AM//AK95LTi4T9no7I+TjWvUjsAA TpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdjoB/ajsP8AhX9ZlLCK90A/tR2H/Cv6zKWEWcD+ y2/5Y+UL+H9jR2R8lD69/wBuHSP9P/1WI7U6rXv+3DpH+n/6rEdqVbnta+36Q91hf2Gx/LP99YAD CQAAAGSuL696o6kahWDh10QzK847e6axXLMrxXWitkpZ2sihfFQUzpI3IvJLUuRrmqvgrHbLshPd PblBxccN2J3+bN8sxWtroopLnV4vdHW2tjr6fmiqIVkaiqkayI9eVU6pyKbaGURKCL8VVzREa48d /dnC+AYRqdGMhh4wKXQdvEtrr7HJ8AXJ3SrnNR3rvffnwcqP25ez5Gp05d9/X6i+KjhOp6ix0Nj9 0XrtGlDUVFR3uPOJW1M3atiTklk5N3sZ2W7G/vVkk/hGZpiOdrRerrzyp2atq9gYR0P0YyHUbVHW HDL9xK66x0GBX6ntlrdTZzUMkfE+N7lWVVRUc7dqdURv8hb3E5f8j0n0KsOkmnmW36rzTNLhRYbY btXV75rnzyuTtquSdNnq9kSO3lTZWuc1d0E0a8synETNE3Kqcoj/AONIAzxwe5hlKW/N9D9RciuF 7yvS/IJrfJcLlO6aqr7bUK6aiqpHvVXOVzFcib+DWtOgzXLdVOIDiByHQbTPPKzBcQwCkpZcsvtr YxblWVdS3nipKeRyKkKI1F3eiborHou6bIuNDXk24+NCKojXOrLr/RqYGYb9w/a+aVyUeXaC695r mFbTVUXf8az+8tr6O40znokiMnVjXU7moqu3buvRUT+CvK1EzTJLTxr6V48/J7hbrBWYneK2525t weyhkkjZIqSSx7pG9WbdHuTptv0Gjnskm9NPrU5a4jvaUBmC05Pm3FrqBDX4Rkd7xbRbE65ea7Wy rloazMK6NVa6OGWNWyMoWLujnNVO0XdE69Y+p4h7fkuccXGmOk9NqjneJ2G843c6usbjF+mt0kss PO5jl5d2uX0UTdWqu3Qzoa8pYnEfh0qYzjOIjrz+jWoM8+43pvxnuIb/ANf5vsyI8Q1DkmccXWmO lFPqfnWK2G843c6usZjF+mtz5ZYedzHLyLyqvoom6tVduhiKYmdUs1Xa6Kc6qeeI272tAZA1x0Tz LQnS+/6w6c8UGrPnfE6VbkylyfIvO1urGsVOaGSGVm2709Fq7+Kp0XfppnS/LKrPdNMSzmuoUoqn IrHQXWamTfaF89OyVzE369FeqdfkE05RnDNF2aqpoqjKdqTAzjq1lWUW3jR0Hxa3ZJdKWy3i35G+ 422GskZS1joqJzo1miReSRWOTdquRdl6psU5qfq5q3pjxe5/qHQ5Le7pp5gcWPxZJjXepZaeG219 Nyy1sEHNyNkhljY9Va1FXnduqNVxmLcy0rxNNGecbJy8M828QZ24zs5uls4f7fl2n+WVtD3+/WN1 PcbTWvhdNSzVMf4Mkaoqsex3VN9lRTRJrMZRmmiuKqpp3ZeOfkAAw3AABEqj4welH6d/qJpAzfUf GD0o/Tv9RNIFnB7Ku36Q43D/AK9n+T/3rADrshyCz4rZazIsgr4qK30ESzTzyLsjWp/1qq7IiJ1V VRE6qW5mIjOXBppmuYppjOZfe53S3WW31F2u9dBR0VJGss9RO9GRxsTxVyr0RChsg1uzLUiaWz6L 0vmyztesc+VXCDdHp6+6Qu6vX++cm35k6KdDWyZFr3WMyHM0qLdhkUyTWjH/AMBatqfg1FWqfhb+ LWeCIvydXTyKKKCJkEEbI442oxjGIiNa1E2RERPBEOfcxFV3VRqp8Z8vm9XhOC7WCiKr8RVc3fu0 9vSnwjrRPG9MrBY7g7ILjLVX6/yrzS3a6SLPUK7+836MT5OVN9um6kuAIoiKdi/XcquTnXOYADLQ AAAAAAAAAAAAAAAAAAAAAAAAAAA/MkccsbopWNex6K1zXJujkXxRU9aH6AEFm01qceuMmR6T5DUY jdHrzywwJz0FUvjtLTr6P5t2p08dtyb4LxBMfc6fDNW7UzF8hl2jp6nm3t1xcq7J2Mq/gOXp6Dl9 aJvuux+zrMjxuy5ZaJ7Hf6COro509JjvFq+pzV8WuT1KnUUVVWpzt93MX7dnGxo4qM91UetHv546 p90wvYGdsF1Dv+kN6osI1CvElzxKvclNZ77U/utDL+9pqp3raqdGvXw2+Tfk0SdC1di7GcbXlcdg bmBrimrXTOyY2THnvjmAASqIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAM/6Uf7gLX/AM//AK95LSJaUf7gLX/z/wDr3ktOLhP2ejsj5ONa9SOwABOkdBmGoGB6 eUUFyz/NrBjNJUy9hDUXi5Q0Ucsmyu5Gulc1HO2RV2TrsinR2LXrQzKLlDZcZ1owS73CocjIaSgy OjqJpHL4I1jJFcq/yIUXx32+gu194fLVdaGnraKs1Ys8FTTVETZIponqrXMexyKjmqiqioqbKinZ cW2jHDLY+H7Nrxf9PsJx6po7NVzWqvpbZTUVXHcGxOWmSGSNrXq9ZUYnIi7O32VNiSKYyjPnbxTG UZ87RF7yzFsaqLbR5HktqtU95qm0NtirayOB9bUu/BhhR6oski+prd1X5DtTBedXDLbrp9wV3LOn 1D77U5fYZKx9Tv20irG3lfJv153N5Vdv13Vd+pvQ1qp0WKqdFGYdTtNanD5NQ6fULGZcVi37S+Mu 1O63s2f2a71CP7NNn+j+F+F08ToqHiM4e7pVR0Ns1208q6mVyNjhgyihke9V8ERrZVVVMLYd/wBx 8vv8tT+umktv2tXk4q3RZLBWWfCrtfZrDHSMpLfiyx10tcsCNRI50gb2cnaf74r2oi9eYk4v5pOL jxbuv+SY7illqMjyi/26z2mka19RX3Cqjp6aFrnI1FfI9Ua1FVyIm6+KonrObTVNPWU8VZR1Ec8E 7GyRSxvRzJGOTdHNVOioqKioqGG9QcVzDCfJS1GM55XNqr1SY/SLK5tQ2dGQvucckESSNVWu7OF8 Ufoqqeh0VU2U2Npx/a8xf/iWi/1DDSacozR1U5Rm5tbleLW2/wBtxS45LaqW93hsr7dbZ6yNlVWN ibzSrDEq88iMaiq5WouydV2Pver5ZMbts14yK8UNroKdN5qqtqGQQxp8rnvVGp/OpmbWr4+vDl/x blP6veR+34hauK7i61Ep9UoVvGEaN9wtdlx2dyrRT3Cojc+aqnjReWRzVY9qI7dFarN06Ki50edn QjbLT2J6q6X57UyUWDakYtkVRCiukitN4p6t7ETxVWxPcqJ/KSkoXUrgw0azGK3XPBbDQ6a5VZay GstmRYpQQ0VTTqxyczXNjRrJWuZzN2ei7b/Jui3xE17ImMkkWR7WojnqiJzLt1XZOiGs5czWcuZ1 eOZdimY01TWYjk9pvlPRVUlDUy22tjqWQVLNueF7o3KjZG8zd2r1TdN06jJ8txTCbS+/Znk1psNs Y9kTq251sdLA17l2a1ZJHI1FVeiJv1UzVp3H7RnGzmWnDk7HHNZbf7MLK3wYy7wbtrom/wB89vNM 78yMQ/vEFH7dvFDpbw9Q/D2TFFdqHlbE6sVsDljoYX+peaVXczV8WyIvqM6OvqbaEZ9TR+W5zhWA 2yO9Z1mFkxy3zTNpo6u7XCGjhfK5Fc2NHyua1XKjXKjd99mr8h3SKjkRzVRUXqioY319wym4uOJO TQaonVMW02xSsuN3laqqxt8uUDoaJrkT99FG5J2/nR6KWpwW6jXTP9CbXbsp5mZVhFRNiGQwvXd8 dbQqke7l9bnR9k5V/hOd8gmnKMyaMqc1wY5lmLZhRzXHEsltV7pKeokpJp7dWR1Mcc7NueJzo1VE e3dN2r1TfqgyXLMWwu1uvmY5LarFbWyMidWXOsjpYEe9dmtWSRUbuq9ETfdVM2+Tq/tP5f8A+cK+ /wDxxjylXxXq3/j+0f1lo0fx6Jofj0WpzoafP8DrKG+XSkzawT0eMTT098qI7lC6K1ywIqzMqXI7 aB0aIqvR6orUTrsd8YL07/tG8cP/ACtzv+qyCmnSYpp0mqfdN8Nv4wmmn/rZQfakqw7UTT/USmqK 3T/OseyanpJEiqJbPc4K1kL1TdGvdE5yNVU67KYd0G1v8nfZNFcHtGoMenq5NR2Gigu3fMPdUT97 bE1Je0k7q7ndzb7u5l3X1qa40EyLQTL8Tqsk4e6PHo7DLWupqmWzWjzfHJUxsaqo5nZxq5Ua9vVU 8F8TNVOjzS2ro0eaVlgAjRgAA7HQD+1HYf8ACv6zKWEV7oB/ajsP+Ff1mUsIs4H9lt/yx8oX8P7G jsj5KH17/tw6R/p/+qxHanVa9/24dI/0/wD1WI7Uq3Pa19v0h7rC/sNj+Wf76wAGEgfKrqqahpZq 2snZBT08bpZZZHcrWMam7nKq+CIiKu59TrMnxuzZljlzxPIqaSptd5pJaGthZPJCssEjVa9nPG5r 27tVU3a5F6+IYnPLUxNoA3ih1CyvO+KPS60aaSW3Ui4up7W7Laq4R1cVroZHwQNjZTxOa1jkbu7r u5zN9k6byzhQlzzR3XjUDQXVSnsFFV5ejtQrJFYpppLcizSrHWRQLO1r/wAJrFRm3oox6punU1Ti OJ49gmMWvDcStjLdZrNSx0VDSsc5yRQsTZqczlVzl+VzlVVXdVVVVVOtv2l+DZNm+Oaj3mx9tkmJ NqWWivZUzRPp2zs5JWq2N7Wytc3pyyI5E3XZE3UkmuJzjLUqU4aqjRqidcbd2vaoeu/7pVb/APzP O/W0hqEi79MsHk1Kj1ffZN8uis/mBlx7zN0oO1Wbsuy5+y/dFV3Nyc3q326EoNapzyT2qJo0s+ec 2XuFD+39xL/8rqL/AFEhC82n1i1t4xau+aLUmG11DoZRpa2LlNTVR0brtXRu7w+Lu7HOdIxjWxqi 7I1Wb+KoatxPTHB8Hv8Ak2UYvZO5XPMKxlfep+8zSd6nY1WtfyverWbI5ejEan5j86f6XYLpdTXe lwax+bmX66T3q5OdVTVElVWzbdpM98z3uVV5U6b7J6kTdTbTjOZQ8nqmmmiZ1ZzM98zDJtRPrnoz xYYZrDrVRYJQ2jUmNmBXKTFKqskh711kopZ0qY27SK9rY0ciqnIx++23WSaZ5DatE+NLVjCc8q4r XDqmltyDGK6qckcNa+KN8c9Oj3dO0R8jka3fdeRf4TUXR+pGmGDauY2uI6hWPzra+8w1jYkqZqd7 J4nc0cjJYXskY5F9bXJ0VU8FVD56j6T6b6u2JuN6lYdbsht8bu0ijrI93wv225o5EVHxu26czXIu w04naxyeumc6Z2TnGfZlMOp1q12wDQfGmZBmlZNLPVTx01vtNA1stwuMz3o1I6eFXIr167r1RE28 d1TfN3Elp5ZNZOMrSHDMolu1HaLrid0kr6alqFppp4W8z3U0j2LujH7ckiNXdWq5EVN9y9tOeEjh z0nv0eUYLpbbqO7w/uFbUz1FdNAu228TqmSRY126bs2XboTW56Y4PeNQbPqncbJ22UWCknobdX95 mb2EEyKkjOzR6Ru33Xq5qqnqVDEVRTOcNq7Vy9TlXllnGrsnXr/RnbSrILtwk6lUfDfqBcJqnTvJ Z3u05yCqdv3WRzt3WipevTmRXfBuXx3RE/CRsfU8SGm+G6scbWkuFZ7apLjZqrFrvLLTx1k9MrnR 87mL2kD2PTZyIvR3X17mn9StLsC1gxaXCtR8chvVnmljnWCSSSJzJWLux7JI3NkjcnVOZrkXZVTw VUWI6kcLOhmrs9lqtRcPqrzUY/RJbrfPJfLhHLHB8jnxztdI5dur3q5y+tVMxXGefO1rw9c0cXGU xnExn27Nk6tyPWfga4X7Bd6G+2rTushrbdUxVdNIuS3Z6MljcjmO5XVKtds5EXZUVF9aKVfxH4VJ qDxt6S4xHmWS4s6oxa7v85Y7Wtpa6Pk53crJHMeiI7bZU5eqKvgWF73/AMJnzY1f/rPd/vRartId PHZjjufux9Vv+J26S02isWsn/sake3ldHyc/I/dvTme1zvzjTynPOZJsTVTo6MU64nV1T2Qx3r/o rT6TZxgV91i1N1G1G0XuNwZbshpMmyGSaK2V7nb0lXM2FsbJKfmTlcjm+jsvVeZrTeFNHTQ00UNH HEynYxrYmxIiMaxE9FGonRE2222OpzXC8X1FxW54RmtnhutkvEC01bSSuc1sjFVF/CaqOaqKiKjm qjmqiKioqIpyMYxqz4djttxTH4JobZaaaOjo4pqmWodHCxOVjVklc57tkRERXOVdkQ1qq0ojNLas 8VXM07J7/wD4zhrP8e/h2/4tyj+oPPtpzardfOMjiIst4ooayguFgxmlqqeZvNHNC+jka9jkXxRW qqKn5y871pjg+Q55jupl4sneMlxOOqhs9b3mZndmVMaxzJ2bXpG/mYqp6bXbeKbKfW0ac4bYs3v+ o1qs3YZFlENLT3Ws7xK7vEdMxWQp2bnLGzlaqpuxqKvr3M6UZZdX1acRVp6X8Wfu0cnnvrVcLrot gV44Rctq5p6O1ZHZr9gFwqHbrWWR9wZz0quX8KWne5W7eKt3VERrUPSwgeqWhelOtLrM/UzEIbzJ j1UtZbJFqZ6eSnlXl3VHwvY5WrytVWqqtVWtVU6ITwVVRVEM2bNVqqrOdWrLsjPzAAaLIAAIlUfG D0o/Tv8AUTSBm+o+MHpR+nf6iaQLOD2Vdv0hxuH/AF7P8n/vWGc9UrnJqtqn7X/RcXwl0NZdGo5d q64PbzRQu9SsY3qqfKqovq20YZa0Rk854tX5XLu+oyK819xlkcu7nqszmpuv5kZ4DF1bKN/0Z4Bt RE3MTO2nKI6pqz1+6InLr18ywkRERERNkQAFZ2AAADqpMtxWHJYsLmya1MyGopVrorS6tjSskpkc rVmbBvzrHzIqcyJtuipudqZe406Gp0/r9O+KezQSOqNNL2yC9pE3d01jrVSGpRdvwlarm8qeCdo5 fUZpjSnJHdrm3Rp7vlztQkVo9V9LbjR2y4W/UnFamlvVctsts8N5p3x1tYi7LTwuR+0ku/Tkbu78 xXPF1qtNp/w9Xm8YnP3m95UyHH8bSndu6orK74ON0Sp4uRivkb8vIhSWrWl9BoxY+EnTK3pGqWLP 7XDUSMTZJqp3pzy//dyukd/ObU0ZxrRXb80TMUxsy8Zyj6tukYbqjpm/D36hs1Exh2Kxu5X3xLvT rb2u7RItlqOfs0XtFRn4X4Sonj0JOeZNt/7j5df/AC5v/wCEEQop0u+Gb9+bOyOaZ7svN6aRyRyx tlie17Hojmuau6ORfBUX1odPXZvhdsyahwu5ZfZKTIbpGs1DaZ7hFHW1Uac274oFcj3tTkf1aip6 LvkU5dg/7RW7/wAkh/8AgQxXxV6W3nVfi7s9qxG6yWzLLJppJf8AGq1j+VIbpS3Tnh5vVyuRXRrv uiI/fZdtjFFMVTlLa9dqt0RVTGc6m1rzerNjlqqr7kN2orXbaKNZqqsrZ2QQQRp4ufI9Ua1qfKqo h1OR6lac4fZ6LIctz/G7JarkrUoq643WCmp6lXN529nJI5Gv3b6ScqrunXwM56iayUeuPAbn+Yd0 W33mnsNZbL/a3orZLddIdm1EDmr1TZ3pN368rm79d0ILxXXHFrRpBwvXXOEpVx2jyjHKi796g7eH ubKRHTdpHs7nbyI7duy7pumym0W85ylFcxOjE1U7MonvnJqD3S/Dj+MBpt/610H2pILxqtpdj2PW /Lb/AKk4tbLHd+Xzfc6y8U8NJWczVc3spnvRkm7UVU5VXdE3Mz+6A8mR/wB600/9SHfdD8caTMCb a+HVGUtlp8MdqNZX9lLBHDb2W5zFVUdG5EYyHs16o5Eajd902GhriMpYnETFE1RNM5bpaDoOIfQC 61cdBbNc9PqypmcjY4YMmopJHuXwRGtkVVX+QsFFRU3Rd0UzJqZ7343Bry7KGaOLQJSS86WxLd31 fRX/AGv2Hwva/wAHk9Lc7fgfqMssfCRh1bqhPUUs1HQ1U6SXBVbJDbWzSOp1eruqNSBGK3fwZymJ pjLOElF6Zr0Ksp1Z6l0rnGFtytMEXL7ImSug70lmW4Rd+WHx7TsObtOTp+Fy7HJyPJsbw6zVGR5d kNtsdppOTvFfcquOmp4edyMbzySKjW7uc1qbr1VyJ4qedclHkk2MyeUfZSVS3VmfpdY6bZe0XDm/ 7HrBy+pys3VV8OX0jRXlCbhRXfgnzW62ypjqaOtis1RTzRru2SN9ypHNci/IqKi/zmeL1xCOMVM2 668tkZx1xzLct3EJoFeKyO32nXDT+tqpnI2OCmyWikke5fBEa2RVVf5CW5Hk+N4dZqjI8uyG2WS0 0nJ3ivuNXHTU8XO5GN55JFRrd3Oa1N16q5E8VMOal6yeTsvmklzx62WbC7tkFbaH0lvprZjCwVjq 50XLHyVHYMSJySKi86vaibLuq+C9nr5jWW4f5LZ+NZzXJV3uhs9jZUvSdJ0ai3SldHH2jVVH8kas Zuiqi8vRVTZTPF7GOVTlVMZTlGeqfCW4Y5I5Y2yxPa9j0RzXNXdHIvgqL60Itl2rWlWn9dDbM91N xTG6yoi7eGnu96pqOWSLdW87Wyvaqt3aqbom26KnqO8sH/aK3f8AkkP/AMCGLuJrKdHMP44cIvOu jbOuLtwCojf51tq10Hbuq5uz+CRj+vjsvL0NKKdKck1+7NqiKuuNrTUXEnw6zyMhh1805kkkcjWM blVCquVeiIiJL1UsYyfjWs3k48lyO1Y5jVDpxUXe61sFFb4Y8LVjpKmWRGRNRzqVEaqvc1N1VETf xQ1gKoy5mbNzjM5ziewABqmAAB19/sVsyaz1dhvFOk9HWxLFK1fHZfBUX1Ki7Ki+pUQ5/Dpl92mo btpblNR293wt8UEVS5V5qygkRVgkXfxVGpyrt8jd+qn9ItZ5PM3EhidTBuz2Q2a4W6flXbtEgRJ2 8yevb5TNFWhcpqjs7/1aYm1GJwty1VzRNUdU0xnPfGcd25owAHUeKAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABn/Sj/cBa/wDn/wDXvJaRLSj/AHAWv/n/APXv JacXCfs9HZHyca16kdgACdIyP5QPHbNl9XoPimR0La203nVK1UFdTOc5qTU8vMyRiq1UciK1ypui ovXopYmPcDnCfi92p73aNE7H3ulekkS1Uk9WxrkXdF7OaR7FVF+VC9Ab6c5ZQ205yyhnLjVwbMr1 jWCak4FjtRkFz0vzCgymWz0qbz11HCq9tHC399JtyqiJ1VEdtuuyL1188oDopVY9U02nKZLk2czQ OjoMUp8drm161ioqMjlR0SMYjX7cy8y9EXl5vBdPARVGWUwRVGWUwwjnmkl80Q8lhedPcoaxl6pb bFV3CNjkckM1RdI5li3ToqsSRGKqKqKrVVOhYNg45eD9dOLTjd51DpbxLHZ6akqLSyx1lU+okbC1 roUj7BWvVVRW9enyrt1NWgzp5xrZ04n1nnTU4rmmKeTK1RZlthr7BR3W8TXXHrLXIrZrZaJrhSrB A5i9Y/SSV6NX1PRfWXlhPH5wiWrDLBa7hrJSQ1VHa6WnnjW1V68kjImtc3dINl2VFToakAmuJ2wz NcVbYZK1OvdryXja4YsjslWlVbrrYskraOdGuaksEttc9j9nIipu1yLsqIvXqcTKK+/cJHEvmOrt 1xa8XfSrVSnopbvcLTSPqpLDc6ZixpJNEzd3YvRz3K5E8Xoibq1Gu2ADGmxp82TLWS8btnz6CDE+ EazVeo2ZXCeKJks1orKe0WuNXJzzVs0rIla1G77I1d91Trvsi6gpe8pTQpWrEtR2be2WJFRiv29L lReu2++259QYmY5oazMTshnDjhxq6U2n9i10xamdLkOj96gyeFsf4c9vRyNroN/Ux0PpO/NERvhh vtuZimrXGvnHaU9NmtdV3KifM3aSDHba18VKxGr4Ockb1VE/C2YvyGswZ0vw5M6f4dFh/hn4Zcj1 Oweo1/yrWjVDC8k1Urp8jraHF7zDR0/d5JXrSIqPp3udtE5Fb6WyNeiIibLv3OlGKy8KvF5PprVZ dkF/x3WizvutFc7/AFMc9XJfaJzlnY+RjGNVXQv5lXlRVVY0XdU3NjgzNcznmzNyZzzefnB3xY8P mi+C5bh2puo1PZLw7OLzWJSvoauZexfIxGu5oonN6q13TffoW7r7X4zxq8KuWxcPGRQ5LVW6vgfS 8sEsCS1tI+GodTokzWLzOienKv4PM5qb+O2pgJrjPSiNZNcZ6URrZkoPKC6Ex2KJmTMyi05o2FG1 OHPxyudc21e3pQMTsuzcvN0RyvRPDflXoQfCdPc0xLgw4g811Dsclkv2pcOXZjNaZf3W3xVVHJ2c Miep+zVcqeKc6IqIqKibTBjSiNkGlEbIYw4c+OPhXwnQXT/EMo1apaG72bHaCirqZ1srnrDPHC1r 2K5kKtXZUVN0VUNFaQ8QujmvKXZdJc1hyDzH2HnDs6Sog7Dtu07Lfto2b83ZSeG+3L126FigxMxO yGKppnXEAANWoAAOx0A/tR2H/Cv6zKWEV7oB/ajsP+Ff1mUsIs4H9lt/yx8oX8P7Gjsj5KH17/tw 6R/p/wDqsR2p1Wvf9uHSP9P/ANViO1Ktz2tfb9Ie6wv7DY/ln++sABhIAAAAAAAArDV/iN000Wrb dYskqblc8jvLVdbcesdC+vudW1N05mQs8G7o5Ec5WoqtVEVVRdoXbONjTVl/t2Pah4PqLpo+7zpT UFXmeOut9JUSr4MSZHva1V+VytRPWqEW4X6Onyfic4iNQL/Gyov1tv8ATY5RPkTd9Jboo3I1sf8A BbJyMVdvFWb/ACkg1/4g9OsdW/4Tqnw4am5bjVnSKqr7jHhja6xyMYxk3apNJIkatjVfScqIjXMc i+BJoxno5KU3a5p4zSiIznLVu3p9rpr/AIzoHbsfrshxnJb9Nk93jsltorBSRVFTLVSNVWNRkkse /Ny8qIiqqqqJsQK4cadrsVJJdcq4cddbFaqdqvqrlXYizu1LGnjJK6OdytanrXYr3jGzy0VmL8Nm ptksd2qrXUZ7Yb7R22io0krpad0PbMhjgYqo6VWqjUY1V3dsiKSfNeOS122mpsco+HvVlmRZM91t sNBkOOJa6a4Vjm7NiWWeRE26puiI5dl8OpmKNUamK7+VdUaWURllqz2tCWDUPCcnwem1KsmTUM+L 1VEtxZdHSdnA2naiq971ftycvK7mR2ytVqouyopS0fHFp/d1nrMD0r1bzeyQPcx19x3EZai3uVqq jlbI9zHORNl32apQ+qWl2XaGcAeD6KZPdEhqr9lVBbchdTTbspqerq5ah8TXp02aqRtcqdFXm8UU 3tZbLacctFFYLFb4KG3W6BlLSU0DEbHDExqNaxqJ4IiIiGJimnXtb0XLt2dH1coiZ7Z5kV0m1n05 1ux6TJNOsgbcIKaZaasp5I3Q1NFOnjFPC9EfG7ovimy7boqp1Pjo9rNi+ttnvd7xWgulJBYb9WY9 UtuEUcb31NNyc7mJG96LGvOmyqqL47ohSNPSU+D+UZfRYzG2nps808W5X2miTZklXBVvZHUuanTm 5Y0Zv/fPXxcpyfJ+f2vtSP8Azn3/AP8A6AmmIjOCi9XNcUT1xPuyXLm+s2L4FqNgWmF4oLpNdNRJ a+K1zU0UbqeFaSJkknbuc9rmoqSN5eVr91Rd9vEgOW8X+O41qfkuk1n0d1SzC84mlI65yY1Zaesg jSpgZNEu61DXJu1+3pNTq1226JuRjiR68XnC7t/+m5T/AFKmIDZdddLtEeN7iBqNTMhntUd3gxll GsVrq63tFjtrFfulNFIrdudv4W2+/TfZTMURMZ5c31aXL9VNUxM5RpZZ9Wjn818accVuAZ/nEWmd zxjM8FyyqgfU0Noy+zLb566JiKr3QKjnsk2RFXZHb7I5URdl2ugxpk2bW3iw4hdIKzRqy3ursGnV 0qb5e8pq7VUUNLGxWMRtJEs7GPe+RWbK3l8FReqI5W7LNK4iMk9i5NzPOc4idU7wAGqcAAAAAAAB Eqj4welH6d/qJpAzfUfGD0o/Tv8AUTSBZweyrt+kONw/69n+T/3rDL2lcDscqsq06q29nV43e6hG s+WmncssL0/M5FVTUJRWvGJXPGb9S63YpQzVTqOJKPJKKHdVqaBPCdrfW+Lx/wDF28EapnF0TMRX HN8mvAd+mm5Vhq5y08sv5o2d+cx2zDsgcO0Xe3X62U14tFXHU0dXGkkMrF3RzV/6l9Sp4oqKinMK m13JiaZykABlgOjzrDrPqFhl8wXIIu0t1/t89uqU26oyVitVyfI5N90X1KiKd4BsYmImMpeffDk3 MtYNVdPdHc9pZnQcNEFct7e9q9jV3WOofS2zbfx5II2ysd6+V3yl98Z+EZlesbwbUjBMfqL/AHPT LL6DKJbRTJvPXUkSr20cKfvpNuVUROqojtkVdkXRIN5rzqzVqcNFNubcznnz9mzuyZlvfH1ovVY/ U02naZJkubzQOjoMVp8drW1y1aps2OVHRIxiI7bmXmXoi8vN4LUGrGk180T8ldcdP8naxl5poqCr uEbXI5IZqi9wTLFunRVYkiMVUVUVWqqdDfIEVxTllBXh6rkTp1a5iY2b/ezdZ+P3hEprTRU8+slI 2SKmjY9vmqv6ORqIqfuBxprlRXnj5xK722dJ6Su0jqKmnlRFTnjfcWua7ZdlTdFReqbmmgYziNkN +LrqyiuY1TE6o3e+WCeOjGbzoZBnOo+J0Es2F6u2aWx5XRQp6NFeUYvc7gjfBEk2WOReibqqrzOc 1DtOJ7IrNiGl/CrleR1qUdqs2W4zX11S5jnpDTxUrXyPVrUVy7Naq7Iir06IbiBtFzZnGxHVhc5q 0Zyz8NebPPvgfB/889J/96q/7ArzizyXA9ZLbw436xTUeR4pkmqNqiTt6VVgrKdZHxSMfFM1FVq7 ParXN2VN+mymyQYiqKZziG9dq5cpmmuqMuz9ZZf4j+E7DpcJgzfQXTPFMfz3B6yO/wBoZbLJT07L k6H0n0czI2NSVsjUVGo798jU3RHOItrlxHUetvC/i1o0rqOwyPWu4wYhHRq7eW3Pe5EuDZU6Lyxs 3Y5enozNf4KbJAivZnzMVYfPPQnKJjKf87P81MyN4E7E3Dfa/TiL1tTHO4ebPNSZBSd07rycnY9l 3Tbk5enL8hnrNsqu0nk59UdHMtqOfJtJLzQ4pW83jLTRXamWkmRP4DovQavrSLc9IAZi5PO1rwlM xMUas4mO/wAmYajjj4PrjiDbHcc5psk7ShbBJZorFV1b6x3IiLCkboeVyuXp6So3r1VE6lC5Ziec 4d5LLLbbnNqrbQ+oudPW2u01qu7e3W6W80roYHo7q1U9J3KvVEeiKiLuiejAMRXFOyCvD1XYnTq5 pjVG/wB8s3Wfj94RKa00VPPrJSNkipo2Pb5qr+jkaiKn7gV1rNrJprpvxwaealZtlEdsxur02m7G vdTzSNf21TK6L0GMc9OZPlb09extYCKqY2Q2qtXK4ymqNUxOzd72effA+D/556T/AO9Vf9gaCp6i Gqp4qqnfzxTMbIx2227VTdF/yH0BrOXMmoiuPXmJ7Iy+sgAMNwAACNYTA7KOIyKelbz02FWSRamT 1MqatdmM/lWNFX+ZT+53mcGHWpssVM6uutc/u1rt8SK6SrqXdGsRqddt1TdfUn51RFsPRHTao07x R7r5N3nJL5MtxvdRzc3NUO8I2r/AYnopt08VTxNrVE3LkRGyNc/RFjb0YTCV1ztriaaff609kRq7 Z7ViAA6bxgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM/6U f7gLX/z/APr3ktIlpR/uAtf/AD/+veS04uE/Z6OyPk41r1I7AAE6QAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAHY6Af2o7D/hX9ZlLCK90A/tR2H/Cv6zKWEWcD+y2/5Y+UL+H9jR2R8lD69/24dI/0 /wD1WI7U6rXv+3DpH+n/AOqxHalW57Wvt+kPdYX9hsfyz/fWAAwkAAAAAAAAZuz7R/V/TjWe66/8 O1PaL0/KqaCmy3ELpVLRsuD4G8sVTTVGytjmRvoqj05er19JXbJ1GfycYGv2I3PS2bRPHNLrPkNK +33a8XfJ4bxM2lkRWypTwUrUTnVqqiK923X96vVNUA2ivqQTh4nOImYieb/Iz7pZp1p0HzCrtHDx i2BW6S9UOmeYWGoudTJUQQPjt1FG2N9Q5r3t5l2aiqxnM7r0RSzOIbRi3a7aXXLCJ6nuNzara+x3 JqqkluuUO7oJ2uTqmzvRdt15XORNlXcsoDSnV1NuIo/FHNP/AMUK7TPNeIzhgfppxE49JjGV1lK2 mrJ4KinqeSsgcjoa+JYJHN2c5rXrHu1er2dEVFXoLBnHG/gdohxDIdALFqLW0EaU0WT27Maa3RVj Wps2WeCoZ2iPVERXcqbKu+yIaZA0+bJrNjZMVTE5ZZ6tfbqyUPoRornlqz/I9ftcLnbKvPsnpI7Z DQ2vmdRWO2Mcjm0kT3dZHOcjXPd4cydN91VYjasB4gOGvOs0q9HtPbXqRgucXqbI0tDr5Farhabh MidujXzosUkTuVuyboqIiJ02VXamA055zk9OUREzExz8+vazdgul+supmulm1/14sdpxODDqCqos WxWguCV8sE1S3knqamoaiRucrF5Uazp0avRW+l3GlWmOcY3xV63ak3qyd2xzL4MfZZq3vML+9LTU SRzp2bXrIzlf09Nrd/FN06l8gTXMsxYpjKc9cTn2zll8gAGqYAAAAAAAAAAESqPjB6Ufp3+omkDN 9R8YPSj9O/1E0gWcHsq7fpDjcP8Ar2f5P/esP45rXIrXIioqbKi+tD+guOAzxm2l2T6T11bmWldE +6Y5UzLVXTGGJ8JTqv4c1H/1rH/k36cvKxTMsdzS3+cceuLKhjVRs0a+jLA/+BIxerV/l+TpuX6V bqLoHYMuuTstxa4S4pljd3JdKFictQvyVEX4MqL8q7L4bqqJsUbuGmmdK13eXk9Lg+GKLsRbxu3m r+6OftjXviXXAgtxyfPNMpEpdXsXVKBF5WZHZ2OnonJ6llYic8K/yp1XwTYlVlyCyZHRtuFhutLX 07v98p5UeiL8i7eC/mXqVs9eU7XXm3MUxcp10zzxrjv+m12AANkYAAAAAAAAAAAAAAAAAAAAAAAA AAABHsp1AxDDGIuQXuCCZyfB0zV7SeRfUjY27uXfw3226+JiZiIzltRRVcnRojOUhIjl+olFj9VH jtlo5b7k9ZsyjtFGnNK5y+DpFTpGxPFVX1dfDdU/NrsesmqyI600LsBxyX/6fcI+e51DF9cUHhFu i+Ll39aKXDpzpNhml9C+DG7e51ZUp/ZlyqndrV1bt91WSReq9evKmzfzG9Fqu7s1Rv8AKEGJxuGw Przp19GJ1f8AdP0jOexFdKdGrhZbv7YupNfDdcunh7OGOJv9i2mJd94oE9buuzn+K9UTxVXW4AdC 3bptU6NLyuKxd3GXONuzr8IjdEc0AAN1YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAGf9KP9wFr/wCf/wBe8lpEtKP9wFr/AOf/ANe8lpxcJ+z0dkfJxrXqR2AA J0gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOx0A/tR2H/Cv6zKWEV7oB/ajsP+Ff1mUsIs4H9l t/yx8oX8P7Gjsj5KH17/ALcOkf6f/qsR2p1Wvf8Abh0j/T/9ViO1Ktz2tfb9Ie6wv7DY/ln++sAB hIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACJVHxg9KP07/AFE0gZvqPjB6Ufp3+omkCzg9lXb9 Icbh/wBez/J/71gALjgAAA/L2MkY6ORjXMcitc1yboqL4oqFVZXw3afXytffMabV4felVXd+scnY I9fH04k+Dci9d+iKu/VS1waV26LkZVxmsYfF38JVpWKppnq5+2Nk+9navwriCwjd1O2zagW+P1xq lvuHKnrVq7xL09SKqqdOmsuOW6pbb81tV7xGtcvKkV5t8kTXL/evRFaqfnXZDUJ8K2goblTPorjR wVVPImz4p40exyfnavRStVhOhVl26/1dm1w9nqxNuJ66fwz3a6fCFL2u9We906VVmutJXQr/AL5T TNkb/laqnMOwv3DLo1e6h1dBiiWatVVVtTZ6iSjcz+RrFRn/ALpHanh4zizrvhGtt3bG3wpr7SR1 6Knydp6Lk/mQhmzep5s+yfPJft8IYC7suTT/ADR9adL5Q7IEaqMT4lLHvz2XDsmib4dyrJaOZyfn 7VORF/k6HXzZhqNaf90WhOXQ8v4S21I7gifyLGqbkczNPrRMe5boii57O5TV2VRn3TMT4JqCvZNc sJoF5chp77YneCtuNonjVP8A0WuObSa0aWVu3Y5tbm7/APfnOi/+NENeMo3pZwl+Iz0Jy7E1B0UG eYPVIi02ZWOXf+BcYV/6nHYQ3uy1PWnu9FL/AOJUMd/1KbRVE7JRTbrp2xLmg+bammf+BURu/kei n7V7UTdXIifLuZaZP6D4urKRn4dVC3+V6IcSfI8epd+8363Rbfw6pjf+tTGcNopqnZDsQR2p1G0/ pEVajN7Czb1ecIlX/IjtzpqvXPSei3SXM6V6p/3mKWX/AOBqms10xtlLThr1fq0TPulOwQCHWWzX LpjWJZhf9/wVt1klei/zu5Tmw3zWO8bNx/Qq7MR3hJdq+CiRqfKrXbqv8idTMVROzX2a2KrFVv2k xT2zEfOYTIEep9O+I+97LWXfC8ahd6oI5qyob/LzbRr/ADKdpS8M09z2fn2reU3pV/Dgonst1M/8 yxxoqqn86G8W7tWynv1KteJwdr170dkZzPyy8XCv2aYli7FfkGRUFCqJvySztSRf5GfhL/MhHKXV C4ZSvY6Zae5FlDnLsyqbTLSUO/q3nl2RP50LhxbQTSDDpG1FlwO294b1Soq2LVSo7+Ej5lcrV/k2 J8jUaiNaiIiJsiJ6iWnC1z605dn6+Slc4aw1v2Nuap31TlHdGc/1M/0Oj2tOYIkmaZzQ4nQv8aGw RrLVK35HVD/wHfnZuhY2C6JabaeSJW2HHo5bmvWS51zlqax7vWvaP3Vu/rRvKn5idgsUYe3bnPLO etysTwtisTTNE1aNO6nVHvy1z75kABO5oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAACvfaA0k/uS/0+p+0HtAaSf3Jf6fU/aFhAq8hwv5dPdHkh5PZ6Ed0 K99oDST+5L/T6n7Qe0BpJ/cl/p9T9oWEByHC/l090eRyez0I7oV77QGkn9yX+n1P2g9oDST+5L/T 6n7QsIDkOF/Lp7o8jk9noR3Qr32gNJP7kv8AT6n7Qe0BpJ/cl/p9T9oWEByHC/l090eRyez0I7oV 77QGkn9yX+n1P2g9oDST+5L/AE+p+0LCA5Dhfy6e6PI5PZ6Ed0K99oDST+5L/T6n7Qe0BpJ/cl/p 9T9oWEByHC/l090eRyez0I7oV77QGkn9yX+n1P2g9oDST+5L/T6n7QsIDkOF/Lp7o8jk9noR3Qr3 2gNJP7kv9PqftB7QGkn9yX+n1P2hYQHIcL+XT3R5HJ7PQjuhXvtAaSf3Jf6fU/aD2gNJP7kv9Pqf tCwgOQ4X8unujyOT2ehHdCvfaA0k/uS/0+p+0HtAaSf3Jf6fU/aFhAchwv5dPdHkcns9CO6Fe+0B pJ/cl/p9T9oPaA0k/uS/0+p+0LCA5Dhfy6e6PI5PZ6Ed0K99oDST+5L/AE+p+0HtAaSf3Jf6fU/a FhAchwv5dPdHkcns9CO6Fe+0BpJ/cl/p9T9oPaA0k/uS/wBPqftCwgOQ4X8unujyOT2ehHdCvfaA 0k/uS/0+p+0HtAaSf3Jf6fU/aFhAchwv5dPdHkcns9CO6Fe+0BpJ/cl/p9T9oPaA0k/uS/0+p+0L CA5Dhfy6e6PI5PZ6Ed0Oux/H7Ri1ogsVipO60NLzdlF2jn8vM5XO9Jyqq+k5V6r6zsQCzTTFMRTT GUQliIiMoQ/UDSTT3VLuHs7x/wA5+bO17r/Zc8PZ9pyc/wC5Pbvv2bPHfbbp4qRD3JPD583/APSt d9sW+COqxarnSqpiZ7F61wjjLFEW7V6qmmOaKpiO6JVB7knh8+b/APpWu+2HuSeHz5v/AOla77Yt 8GOTWehHdCT0vwh+fX8VXmqD3JPD583/APStd9sPck8Pnzf/ANK132xb4HJrPQjug9L8Ifn1/FV5 qg9yTw+fN/8A0rXfbD3JPD583/8AStd9sW+Byaz0I7oPS/CH59fxVeaoPck8Pnzf/wBK132w9yTw +fN//Std9sW+Byaz0I7oPS/CH59fxVeaoPck8Pnzf/0rXfbD3JPD583/APStd9sW+Byaz0I7oPS/ CH59fxVeaoPck8Pnzf8A9K132w9yTw+fN/8A0rXfbFvgcms9CO6D0vwh+fX8VXmqD3JPD583/wDS td9sPck8Pnzf/wBK132xb4HJrPQjug9L8Ifn1/FV5qg9yTw+fN//AErXfbD3JPD583/9K132xb4H JrPQjug9L8Ifn1/FV5qg9yTw+fN//Std9sPck8Pnzf8A9K132xb4HJrPQjug9L8Ifn1/FV5qg9yT w+fN/wD0rXfbD3JPD583/wDStd9sW+Byaz0I7oPS/CH59fxVeaoPck8Pnzf/ANK132w9yTw+fN// AErXfbFvgcms9CO6D0vwh+fX8VXmqD3JPD583/8AStd9sPck8Pnzf/0rXfbFvgcms9CO6D0vwh+f X8VXmqD3JPD583/9K132w9yTw+fN/wD0rXfbFvgcms9CO6D0vwh+fX8VXmqD3JPD583/APStd9sP ck8Pnzf/ANK132xb4HJrPQjug9L8Ifn1/FV5q4xHh20dwXIaTKsVw/uN0oe07CfzhVS8nOxzHei+ VzV3a9ydUXx+UscAkooptxlRGXYqX8TexVWnfrmqdmczMzl7wAGyEAAAAAAAAAAAAAfxURUVFTdF OouGHYjdt/OmK2es38e8UMUm/wD6TVO4BiYidramuqic6ZyQeq0O0crFVZtMMZRV8VjtkUf/AMLU OqqOGnQqqXeXTi2t/wCDfLH/APC9CzQRzZtztpjuWqeEMXR6t2qP+6fNUz+FTQGT8LTyFP8Axa+q T/qlPmnCbw/IvMmnzf57nWr/AP1i3QY5PZ6Ed0JPS3CEf8+v4qvNVDOFfQKP8HTynX/xq2qX/rkO fTcOOh1Jt2Wm1odt/wB9a6T/AOJylkAzFi1GymO6Gs8J46rber+KfNDqPRvSWgcj6TTLF2OTwctp gc5P51buSKgsFitWyWuy0FHt4d3pmR7f+iiHPBvFFNOyFevEXrvr1TPbMyAA2QgAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAODfb3asZslwyS+1jaS22qkmrqyoc1VSKCJivkeqIiqqI1qr0RV6HXYFne K6nYbac/wi5uuNhvtM2rt9W6mlgWaFd9ndnK1r2ou375qfKB34AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAADPHlB81XA+DbVG7Ry8k1dZvMsSIvpOWulZSqif/czOX+RFKZuOrHFhwn8OGJah XPTDT6LTXCrTZbbcMekq6xcliodoaVJnyptTMnVzmudEjXozmVFe7ZVO98prkFeuK6UaeWawVt/r L/nlLdai0UUfaVFfbrZFJU1MUbP37tuzVG+tU2TqqHQ8T+t2E8aGG2vhc4drncMmr80vVv8AZRWQ 2ypggx+0U87J5pqp80bUjk5omIka+kq7p4q1HBc+pnEZm9x1LtOhPDhjNkvuZ1tlZkl0uWQTSxWm w2yRUSJ86Q/CyzSKqcsLVauyo5V26px9NOIDVez66VXDvxHWPEKS9T44/KrLf8YlqGW6so45ezmi kiqVdJDKxUV2/O5qtRfDpvmvUzAuHjBeMnVO+cYNpvVtxnL6Cwz4LfoK67UlB2dNRpT1VI6W3yNR JUcyNUbJv0ZunLzpzWDpdoloHqDhOqubcNujmXWS6z4xdcVxXK8gu1zdHeUqqNyK+kir6hz2RJNy N7R0bN/3q/hogSfGuIbiz16x666r8OOnmndNp/TVFVDYvZbUVy3TJY6d7mOmgbT8sdMx72OYxJOZ d067J1SyK/WnWy8aB4xqDgfD5c1zvJpaekmxm+1HcWWOR73MlqKxz0bIsEas5vRZzua9i8rd1VM8 6BcZun+lPDLh2j1gxDJLzrJjdqhsPteR2argrpLoxVY7tXrF2cUKu3ldKq9GqvTmRWn94pbrZbjx S6eWri7dWWTRafCXVjKBtVUvslRlSzL2lPVzQtb2vZxbcnOiNXZuyJzvaoWfZ+IPiA08100+0i18 teml2o9TVuFParjhM1YyS31VJCkr21EVU5yyMcjmoj2q3ZVVVRNtlnGluuWWai8S+sOlTLfaG4lp nDZqaCtiilSrqK+sgdNK171kVisZyq3ZGIqLtuqmRsNtugVg8ohpbc8B0wptPsQfilwlxmuWzS0K ZJc53vpeZjHMR6Ikb38iyI1VROdPQkjc6c8MWtWB6MajcQeP6t1Fzt+ouQaoXS40NiitdTUVt1ti tYlB3NjGL26O+ERuy9EVqrsi7gWpWcWmQWjUjiLgrsdoK7CdCbBQVzXUcUja+vrpqN9TLCsqvWNG NSNWdI0Vqruqqh02Maucc+U6c2LWzGcG0cymxXympbpDitouFay6upJuVezZXSvSlWdjXekjmNai tciKqoiLXPCbqg/E9CdWuJ7O9N77fotQ9TrjPdLfZ6VlfLQ2rnZTq6SNHfDQwbTo7kR6q31bczkh l7uegFv1Aw+6+Tkyi/xZ1dsoovPGN42yv9j81sc/+y5LhSzMSCmY1m3VORW+KNRU5mhqzVTiC1Df qnbuHzQDD7PdM+mtDb/e6vI6h7LXjtA53KzvHd1V80z3dGxRuTps7m5V3ONpZrxq9Q69zcNvELju JxZBW48uT2G+Yo+oSgr6VkvZSwvhqFdJFM1d3fhuaqIvh03zZqrhfD9iPGjqxk/GVbb3QY/m1HYq vCchirrtSUDm09GkFXSvlt8jUSXnZGqNk36N3Tl505rv4RdM+Ga6ZbetYdFdG8ussdsatls2VZBc 7pLHeqSVrXzPpIK6ofI2JHtRvO6Nu/71V9NEDWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfiaaGnhfUVE rIoomq973uRrWtRN1VVXoiInrA/YKI0k4xdIdYdUM506xjLMYlixOSnjttdDkNPM++otOs1VLTQN 9JYYOjFla57XLzL6KN6wnhB4pKTLdErbqJxAaw4zbLlm19u1TjtNeK2htcqWxlW+CCGOP4NZUasL /SVHOXfq5egGrQV1rnXXH2Dw2jG9cbNpXfMgudFbbPf7hS0lX2lS+RHJS08FU9sc00zGPY1vpO6q rWqqdO5zLVrSrTeanpdQ9TsUxiaqbzQMvV6pqJ0yb7btSV7ebr8gEsBw7PebPkNsp73YLrR3O3Vj O0p6ujnbNDMz+Ex7FVrk/OikH11rLmzCYrLj2t9o0qvt+udHbLTfrjSUlWr6l8qO7pBBVPbHNNMx kjGt9J3VVa1VToFiAieZataVabzU9LqHqdimMTVTeaBl6vVNROmTfbdqSvbzdfkJBZ7zZ8htlPe7 BdaO526sZ2lPV0c7ZoZmfwmPYqtcn50UDmAprie4oME4Y8IbkOQ11pq75XTwU9osNTd4qGavV88c T5Ec5HK2KJsnPJJyK1qN69VQg2tnENcvbe4e8Q0f1GtLsfz+6XW63q50L6StpKqy22m7WZvbuR7G McvMiyMc1yKxURybKBp4Eaw3UzTjUVlVJp9qBjeTtoXIyqdZrtBWpA5d9kf2T3cqrsvRdvBTjZdq /pLp/cae0Z5qjiON19WiOp6W73umo5pkVdkVjJXtc5N/kQCXA+dPUQVcEdVSzxzQzMSSOSNyOa9q pujkVOioqdUVD6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOPcJaKCgqZ7k6NKSOF76hZU3YkaNVXcyL6tt9z kHWZPYabKcbu2MVs00NPd6GegmkhdyyMZLG5jnNX1ORHKqL8oHnnoRJYsA8nLqtxJLjtuoL5m7ss vlDVJSRsnplq5n0dPExyJuyPnYxUYionXp4nfXfht0b0U8mpfbnmGB2a65PJp4tVV3a5Ucc9bFc6 imTu7I5nor4mQTzRtjaxWonJvtzOcq2LDwJ5jUcLFVwp5DxCPuePOrKDuVR7FYoH0tup6pKl1IrY 50WVz3tbvK5/TlT0V6lxcTugq8Rujddo2zLPY1QXSroZKyeOh7z2lNT1DJlgaxJI+XmWJic267be CgZcrLLdrrlnAnoZe55aqqstpbmF67VVVYpbbaolp1d61+GWRiKvXdEO8zLSrUHRXXvUnWa98N1s 14xLO56asSrpu7T3+wQww9m6ljpKpqpPF0TlZC5FVEbzeGyaFXQGObiep+IyqydJIbdhS4fbrC2g 5G0ququ3fVJP2nVyt3j5EjTZP3y7bEFo+GfiGxSnrcb064y77bsXqameemp73jFNe7pRMme57o47 hNKj3oiudyrKx6t6dV2Al3CTBoHU6RRZbw326S3Yhldyq7ytE50rUpKx7+SohbBI5W0yMfGreyj2 jTbdqKjuZa04pP8As34tuGLShnwkFHerrm9e31Reb6ZFpXqn55Ve1F+UvXQzRjE+H/TG0aWYZLWz 2+1JLI+qrpUkqauolkdJNNK5ERFc573L0RERNkRNkQ6ObQXvnFFDxJXDK+3bQ4W7EaCxpQ8qU7n1 fbyVfb9p1c5FWPl7NOnXmXwAzxmWlWoOiuvepOs174brZrxiWdz01YlXTd2nv9ghhh7N1LHSVTVS eLonKyFyKqI3m8NkvnhJg0DqdIost4b7dJbsQyu5Vd5Wic6VqUlY9/JUQtgkcraZGPjVvZR7Rptu 1FR3MsRo+GfiGxSnrcb064y77bsXqameemp73jFNe7pRMme57o47hNKj3oiudyrKx6t6dV2LY0M0 YxPh/wBMbRpZhktbPb7Uksj6qulSSpq6iWR0k00rkREVznvcvRERE2RE2RAM+8Y9ksuo3EtwxaTV tooq5arJrhlFd21OyRUpbZTJK2N6qnWN7nuTlX0XK3qhG8q0rwzXLyidPhl5slLLhWkenUElRZY4 kbRT11ZVOfHBLE1Ea6JY3MkWNU5XLC1HIrVVC7dY+GvJNQta8I10wXV2fC77iFDU2qWNbJDcoq2i nciyMa2V7UhevpJz7O8W9OnXvdLtBfa71j1X1krsr883DU+rtknYLQ9h5tpqGndDFAj+0f2vR26u 2Z4J0AzNVsxLSPjr1XzvTbFLXZLTp3oZJX32gtdKymp6y49utVF2jI0RvMsETE5tt9mIQnhlsWpd y0niz3NeAf228g1JY+/XfL7xk1gdJdYqlVdC2OOqkWSnhbCsbGxbNROXflTwTYOE8Ndrx/UrWfUP Kr+zJE1j7lTVdBJQrAyjt9NSvpm0vP2jllRzHru5EZ6unrK5sXBtrFieIe1BifGFktr0ziY+kpbX HjlG68UlA5V3pororuZqIjla1/ZczU2RuyIiASPgM041S0n0EZg2quPVFgqaG+3J9ntM9yhr30Fq kl56eFZoXvY7l5n7el0TbongaLOtxqwUWK47bMZts1XLSWmkhooJKypfUTujjYjWrJLIqvkdsibu cqqq9VOyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFJcRvFLimgsNuxq32qqzHUbJXdhjeG2peeur5V32fJtv2M CbKrpXJts12yO5V2C7HOa1Fc5URETdVX1IUU3jj4WpbHk2TUuqkVVaMQmp6e619LaK+enZJPP2ET YpI4FbUq6RdvgVfsnpLs1NyM8W+oOtOG8E9+zuSnxXG8sZYEZklNM+esgpkqIVglio5I3R/DpNLF yPfzMTruj+irWGmWX67cL+mHDnofWUen1bWZxkFttFNBS22sa+ksnd1qLhLLzVCI+sR0iO7RqJHu rt2LumwbqRd03+U/plOs4ieILN+JjU3h+0VxnCX0uC0NplW+36KrWnpJ6mDtpGzdhJvM5eZrI4mJ H+DK5z/QRrlHr5xHarauZ3pXolR6XWtdMpaS33msyzv0s9xq5Yke6SnpaZ7HQ06O5mo973KvRU33 VEDVgMdcROuHEzhPBdnmf5XiON4HmlhqpbNVSpUvrqSvo5nJTR11tWORskT3yTxrGlQm7eRyuY7d C4+EvA9S9MdDMZwHU2oxmSpsVvpKG3tsdJUQJHSR00TUSp7aR/PUK9JFe5iMYu6bNQC4gZ61d4gd R01ko+HHh3xOwXrNktHn++XTIqiaK02KhV6Mi7VsCdrLNI78GNqtVEVrl3RVVvDxfiH1a08ptR28 V+n9vstFp/ao75FlmMQ1TrLeaZzV3ggSo9JtS13Kzs1eu7nepERXBpEGQJNceOG5aUVHENZ9LtLr bikdsfkVPidzrK99+ntbY+1RXVLNqeKd0Sc6MWN226Iuzt0OXqjxqX6mwDQPMdFMNpL5X60X2jp2 We483atoliV1VGx7HtbHKx6xs7Z3PGxEe5WOTYDWgMkXviO4mdNddsb0QzjBcByi4ah2qrqsaXG5 qykbQVMCosiV8lQr+anYxXPWWNjXKjF5Y1cqNJZpdrhrDHxL3Xhq1ptuG1Nf7DmZrarti0dVDD3X vndX088VQ97kk513RyORqonhu7ZA0WDGOmXExxV654RqFnmm+MaaWyy4nkl6o7Tcb7FXLHdaClVO xjbHFNuknKju0qVc2Pme1rYvQeotnFlxHaj8MsvFDpzp/g9gsFksNTeLhRZNLVzVF1dRse6sSjWB zGwxIsUjI3y87nuau7GtRHuDUOqWq2A6LYXV6hamX7zPYKGSCGaqSlmqXJJNK2KNrYoGPkeqve1N mtXbqq7IiqksRd03+UzNnHFTknmLhvr9P8etja3XO72p9TSXWOSdaK0S0jamsdH2b495o2yRo167 s8VVq7ptWdkruIjUbyjGWutt9wJbPpHaKOzviqLdWyNhtt2njq3dnyzp/si6nga1ZF+C9BE7PpuB uYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAB8ayso7dRz3C4VUNLS0sbpp55pEZHFG1N3Pc5ejWoiKqqvREQxzkmseq3 GjdqzTbhYuVXimmdJUvosm1SdGrJKxGrtJSWZq7K9y9UWo6Im+6K30VkCX60cU2T3LO6nhz4U7FS 5fqakapdrnO7ezYlGvRZq2VN0dKnXlgTdeZNlRV9B0s4c+FfGdDUrswv94qc21NyL4XIsyuqc1XV vXbeKFFVe706bIjY2r4I3dV5Wok00Y0P000BwyHB9McdjttC1e1qZ3L2lVXz7bOnqJV9KWR3rVei eDUREREnoGTPKQudkWk+EaMwuVz9UtRLBjUsSL1WmWo7eRy/3rVhj3+TdD+Z61udeUj0txdjUfTa YYBeMrc1E9COavlSgai+rm5Ua5E+TZTWgAyV5P1Eyqn1s1te3ndnup13fRSp4yW2kVsNMm/r2+FT 5CuNWNTOA3V+5VmSazUOVaVatWeSahRYaWttuVU74nOZE6N9G17KrmajVYu8rURURPA34APNDWLJ tWKrgG0bdxKsvMTbtqNZ4Mrr7jRP73T48yrnkjqK6JiK5JFjigVd05lVW77vd19HMZyOzZhjtsyz HKzvdqvNJFX0NR2b4+2glYj438r0RybtVF2VEXqdmAMNUuqWHcLPG3rllfEBVVtgs2pVDjtTil/k t1RUUlRHR0joaila+Fj+WVHq30PFeRF/fN5uTxFX3VTjD4IdVn4VpPebLBUVsD8Wp6znbcMitdJV 0876lKVWNfD2iRyLHGqudJypsicyb7cAGLNUuM/TfVfQq7aX8OtLd8k1IzCzPx6gxaltFTHUWiWp i7GR9W58bY6dlO17lVzncu7E2VW7uTo8F0xjxXi64eNBG1DK6PQzSivvtXMzdYn11Y5tDI9EXwVz 0V7UXqiKim7wBk2w7Z75TDKLkqdpSaW6aUVoRvikVfcanvPP+ZVg3b/IQy3Zo2g4jeL3iGdInd9M MPosbtcy+t8NDJWVMafnSoYxNvWrkNygDCmNuXh98kYte5e71dRp9UVbZF6PbVXhznRuVfHmR9az x+REOVxH2ys0Z8mFbdMbXDyXq445j+Iwwp6KzVlW+BlS3+VyLUKbhAGNKzGaOp49dEtKbbtJbdFd Lq68xoiehG+o5LaxFT1O5I2ORPk2U+XBNm+N1nETxLWG/Vc9JqDdM+rahbXPRzNk8xUKR09HUdor ez5XdsqNTm3VFRURUVFNoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFdTdUMC0cwy4ag6k5LSWOxW1nNNU1DvwnL+DGx qbukkcvRrGorlXwQh3EFxL6fcPFmpH5CtVeMnvblgx3FrUzt7neanfZrIYk3VG8yojpFTlbv63Kj VqbTLhp1A1oyy26+caD6euu9DKtXi+nsD+0s2MtXq18zd1bVVe23M927UVOm+zUYHQUeJat8e90i v+p9FetPOH6NzZrZiiyLTXfL2oqOZPXuavNBSrsjmxIu7kXfdfRkNg45jdgw+w0GL4rZqO02i1wN pqOho4WxQwRNTZGMY3oiHZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAACvdf/wC1Hfv8F/rMRAfaowD+IP8ASp/2yjexVy3d4uimJyiJ 1zltmeqdyrexFVuvQiM9We3t6p3NAAz/AO1RgH8Qf6VP+2PaowD+IP8ASp/2zTleI6EfFP2o+V19 GO/9GgAZ/wDaowD+IP8ASp/2x7VGAfxB/pU/7Y5XiOhHxT9pyuvox3/o0ADP/tUYB/EH+lT/ALY9 qjAP4g/0qf8AbHK8R0I+KftOV19GO/8ARoAGf/aowD+IP9Kn/bHtUYB/EH+lT/tjleI6EfFP2nK6 +jHf+jQAM/8AtUYB/EH+lT/tj2qMA/iD/Sp/2xyvEdCPin7TldfRjv8A0aABn/2qMA/iD/Sp/wBs e1RgH8Qf6VP+2OV4joR8U/acrr6Md/6NAAz/AO1RgH8Qf6VP+2PaowD+IP8ASp/2xyvEdCPin7Tl dfRjv/RoAGf/AGqMA/iD/Sp/2x7VGAfxB/pU/wC2OV4joR8U/acrr6Md/wCjQAM/+1RgH8Qf6VP+ 2PaowD+IP9Kn/bHK8R0I+KftOV19GO/9GgAZ/wDaowD+IP8ASp/2x7VGAfxB/pU/7Y5XiOhHxT9p yuvox3/o0ADOV7wHS3HLNX5DerZHSW610stbV1ElXOjYoY2K9719PwRrVX+Yh3k7dXbZrJhWXZ/R 26K000lekXdUe5Upoo5qrskc5yqqu7HsnOXfbmV22ybG9vFXqq6aa6IiJnLOJmeaZ6Mbm9vEV11R E06p6+qZ3dTXxnDX7itq8YyePQrh7x2LP9Ybk3Zttjcq0FgiXberuczekTGoqKke6Od0T0eZvNEc 24hdS+JXMLlolwb1sFJaLc9aTLNU5Y1lobWv76ntqeFVVbb+mi8rd0VFRFSRt3aA8O+nHDliDsXw Shmlq62TvV4vVc/trjeKtd1dPUzL1e5VVyonRreZdkTdd7y2h/D7wqUmmWQ1usOqeTy6g6v36JG3 PJq2NEZRsVOtJb4vCngburU5URXJ48qLyJf4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV7r/AP2o79/gv9ZiOuOx1/8A7Ud+/wAF /rMR1xzL37VV/LT86nOxHtp7I+cgACMAAAAAAAAAAAAAAAAAAAAAAABiTyqOuXsB0Zo9KLNWcl4z 6ZWVKMX0o7ZArXSqu3VvaPWJib9HN7VPUYO4WtaMfslPNoZq7qVkOH6S5Pc2XDJX2GjWWpr+RiMb Syytd2kVM5N+fs2Pc7w5VRd27s198ntmvE1rddNStQtXaGzWVrI6Gz222259VNDQxJ6LXPkdG1j3 PdJI7ZHojnqibpttItBfJdcLNLluSW7MrVfsxbY+4OgS5XR8Eaulje5yq2l7LdN0TZFVU6bLv1LF Fy3RNNE7ZnxymflC3aropyo558mztB7xobctN7VS8PVyxqpw6ghbBSRWKVjoYE235XtavM2Requ7 T01duruu5YZBtNNDdHNG4JYNLNMscxdZ40inmttvjinnYnVEklRO0kTdN/ScpOS2tAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACv df8A+1Hfv8F/rMR1x2Ov/wDajv3+C/1mI645l79qq/lp+dTnYj209kfOQ6umynGK3IKzE6PI7XPf LdDHUVlsirI3VdNE/wDAfJCi87Gu9SqiIvqO0KExHPXVnFvqfg7MOxeldZcZtVal6p7erLpWLI3f sqifm+EjZ+9bypt8pmIzaRGea+zq7/lOMYrFRz5Rkdrs8dwrIrfRvr6yOnbUVUm/ZwRq9U55HbLy sTdy7LshlvRTXviw1+0OpNV8OxjTa0zxx1bJIrpDXPZdZ4ZZEVKZkc29PHsjY+aR8irI2ReVrUbv 8cv4mYNQOHrRHWKLTrGLg7NM+tFqmoL9RrXR22ftqmCWopl3arJmSQO7KRd9kd1RdzbQnPJtxcxO UtfAxtaK3Xev8oVklFTXjCe623FKKORk1BVqvmB1xWRI49pkRK3Z67yLvGq7ehsmxskxVTotaqdE BXHETrBHoJozk2rMlkku62GCJ0VEyTk7WWWaOGNHO2Xlaj5Wq5dl2ai7dSA2bMuMa3SY9kV/w/TD MMcu9TTsrKbEayqiraKmm2/slktS9YKhjEXdduVXdOXx3RFMzGZFMzGbQoKAzPW7VTJdartoToBY cXkuOKW+nuGS3zJn1DqKidUJzQU0cNOrXySuYqP3VzWom/rQ5Wk2veV1eaZjpHrpZLLYsuwy3R32 Sss88sltuVqfv/ZUKSp2kfI5OV7Xb7KvRV67NGcs2dCcs16gyjj2vXFjqbgVRrppZplgsuEu7zU2 mwXKorVv92o4Huar2Pi+Bikk5Hckatd1VE3Xoq9nqvxN6oY3l2i+M4LpzTJWar0FydJashhmp6y3 VsUELomyua5OzjjfK5ZvQeqsjdybKqKZ0J2M8XOeTTYM8Z3rdrJhE+AaOUthxDINYs475K91PJU0 9it1JA5znVUiOV06tSPlajEXdzmv2X8Frv1YNadZsJ1fx3R7X2x4er86pqx2M3/GFqWUr6qmYkkl LUQVDnPY5WKitcj9l6IiKqry40JY0JaFBjfg+rtc7trlrRW5ZeMLnoYMtWkyJKShq2Ty1MNG2KFa Nz5lbHCiMjRWyI92yLsqGjtSdaMK0onoKfLIshe+4skfB5rx6uuSIjFRF51popEYvpJsjtt+u3go mnKcoJpmJyhOgVpgPELp3qTkDcZxqDKWVroXzotxxW5UEPK3bf4WogYzfr0Tm3X1ER40Neci0A0g iv2FUdNU5PkF3pcfsyVLeeKKomR7u0c3dOblZE/ZF6cyt33TdFRTMzkxFMzOS+QZB0+1V4idI+Jv GNAOIDPbNnNFn1mnr7XdqO0x0D6KrhbI98Ctja1Hs2icm6puqvjXdvpNNfCqnRKqdEPnpH/u/wA+ /RX+okPofPSP/d/n36K/1EhF/wA612z/AG1M2/a0dv0la4AOs6YAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAr3X/APtR37/Bf6zE dcdjr/8A2o79/gv9ZiOuOZe/aqv5afnU52I9tPZHzkMt4F8fLWn/AJGWP/4TUgNonJpTVlmzD5On 4k2Df+JeP1nVmZsQ+IZwx/8Anhof1pcT03BtFzKZnrb8ZrmcufNkS55vjelXlCLrXZ9WTWmkzXB7 darFUPpZZIq2sSsRvYNcxrkR26L47IieKpum+uzh3p14bZ652PR0cl1SmlWhZWveyndUci9mkrmI rmsV23MrUVUTfZFXoUx37jh/uW0M/wDv/d/uZifxNZ/EnGuOSUOKaX3y9XfTquzm1xwtjuVko6Zl RJPSPcjZXdi/pI1rVVzm9VVrVMOX67aD49cbFX8AubZZDntXe6NPYhanXKS11VO+VO8d+pqlqsgY 1m6qqq3l9SJ+E3aunNTxITX6Vurdl02pLL3Z6xyY5dK+oqlqOZvKjm1FPGzk5efdUdvujenVdrJM xVos01aGpgTVLTnR3BOLXP8AL+JuyXmLCs+orbW4/kVNXXOmo6Wrp4EhqKSofQyN2e7bnb2m6I1q bKnMu9gaH6c8N+dVOotZoBp5k9vjrcbnxePNbnXXKWiuMdU3eSGmbWzOe9I3sjVXpGibp0ds70td gac5MzcnJiLQriqwvQLQG2aQak2e90OqGFU1RaWYilrqXVN1nZI/u/dnsjcx7JUVnwiKqJuq9U2V 0hz68ZDknFNwj37LsXTHLxcKDLKqstC1PeVoZXWtjuxdJyt5nN3RF9FOqL8m5rwDTjPPJjTjPPJj HjP04xtuuum2sup+M3m8ab0lurLBkc1qmrI5bS5yukp6qTubmzdkr3qjlauyI3qiqrUX+6PY5wXZ TrPjjtDdP8oymtsjZrmuUx3a8TWuyTNbsxsjqyo5Hvk3VqMY16/KmyKrdmgac5ZHGTlkyJw0Zvje F8TOuGlGU1k1uynKszku9moZqWVO+0fdXS9qx6N5OVGMcu6uT1Im6rsaB1JtutlfPQLpLleIWeFj JErm32zVFc6RyqnIsaxVEXKiJzb7ou+6eGxOgazVnObE1ZzmrTAbRxFUWQNm1MzfA7pZexejqezY /VUdT2vTkXtJKqRvKnXdOXdflQp/yjmB5VlmiVmyfELLU3aswXKKLI6iipmK+WWljZKyRWtTdV5V kY5dvBrXL6jVYEVZTmRVlVpMH49nlq4vuNjTfUnSy13mXDtNrHVzXa6VtA+mY2smZK1tMnN0V6Of FuiL1RJFTdG7rvAAVVZlVWlsD56R/wC7/Pv0V/qJD6Hz0j/3f59+iv8AUSEX/Otds/21Fv2tHb9J WuADrOmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAK91//tR37/Bf6zEdcdjr/wD2o79/gv8AWYjrjmXv2qr+Wn51OdiPbT2R85AA EYAAAAAAAAAAAAAAAAAAAAAAAAfPSP8A3f59+iv9RIfQ+ekf+7/Pv0V/qJDT/nWu2f7am1v2tHb9 JWuADrOmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAK91/wD7Ud+/wX+sxHXFhZBj9oym0T2K+0neqGq5e1i7RzOblcjm+k1UVPSa i9F9RDvaA0k/uS/0+p+0OffsXpvTctxExMRGuZjZM9U71O/YuV3NKnLZ59U73XA7H2gNJP7kv9Pq ftB7QGkn9yX+n1P2hpxOK6NPxT9qLk97dHfPk64HY+0BpJ/cl/p9T9oPaA0k/uS/0+p+0HE4ro0/ FP2nJ726O+fJ1wOx9oDST+5L/T6n7Qe0BpJ/cl/p9T9oOJxXRp+KftOT3t0d8+Trgdj7QGkn9yX+ n1P2g9oDST+5L/T6n7QcTiujT8U/acnvbo758nXA7H2gNJP7kv8AT6n7Qe0BpJ/cl/p9T9oOJxXR p+KftOT3t0d8+TrgUhwFYlj2tPCdg2pmpdv885JefOffa3tX0/a9lcqqGP4OFzI27RxMb6LU323X dVVV0B7QGkn9yX+n1P2g4nFdGn4p+05Pe3R3z5OuB2PtAaSf3Jf6fU/aD2gNJP7kv9PqftBxOK6N PxT9pye9ujvnydcDsfaA0k/uS/0+p+0HtAaSf3Jf6fU/aDicV0afin7Tk97dHfPk64HY+0BpJ/cl /p9T9oPaA0k/uS/0+p+0HE4ro0/FP2nJ726O+fJ1wOx9oDST+5L/AE+p+0HtAaSf3Jf6fU/aDicV 0afin7Tk97dHfPk64+ekf+7/AD79Ff6iQ7X2gNJP7kv9PqftCQ4lgGI4N3v2LWnuXfez7f4eWXn5 Obl/Dc7bbnd4beJmjD35u0VVxERE56pmeaY6Mb29vD3IuU1VZZR19UxuSEAHSXgAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAGW9SvKM8P+lfEBFw6ZLSZRJfnV1Bbqi5UtLTPtlJLVpGrO1ld O2REYkrFerY3cvXxVFQ1IABEtXc99qvSrMdTfNPnT2JWGvvfce37DvPdoHy9l2nK7k5uTbm5Xbb7 7L4EN4UOIH3T+iNn1j9iXsa87VFXB5u7/wB87LsJ3xb9r2cfNzcm/wCAm2+3XxAt8FOcWfEN7l3R S6aw+xD2TebaqkpvN3nDuXadvM2Pm7Xs5NtubfbkXfbbp4k50ozn2z9LcO1L81+bPZbj9uvvcu37 bu3eqZk3Zdpyt5+XtOXm5W77b7J4ASoGYuIzygekfDPqbQ6TZhhWfXy+3C1xXaBMettLUxuikklY jfhKmN6vRYXqqI1U226+O0Nx7ysHDPcckoccy7HtRMDW4PSOGtyexR09MiqqJu50U8rmt3VN3K3l TxVUTqBs8H5Y9krGyRva9j0RzXNXdFRfBUU/QAGc8/4v/YNxiYNwm+15332aWlLp5/8AO3Z903Ss +D7t2Lu0/wBp+Pat/dPD0eujAABC8L1j021Dy7MMEwzJ47nfMCqoKPIaZlNMxKKeZHrGztHsRkir 2cm/Zudyq1UdsvQCaAAADpM2zTGNOsRu+d5pdo7ZYrDRyV9wq3se9IYI27udysRXOXZOjWorlXZE RVVEKe4guLbHdHOGiLiZxGwezWyVzLdUW6DvUlt71T1j2JHLzSQvez0Xo7ldGi+pdgL8BFdKc49s 7S7DtSfNfm32WWC33zuXb9t3bvVOybsu05W8/Lz8vNyt3232TwJUAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAADpszyyzYHiF7zfIqjsLXj9uqLnWyfwIIY3SPX+Xlap3JmnyhOG a46mcOF00y0FxCS/XnKK2mo7gjbjS0fd7c1yyyu56iWNq8zo441aiqqtkd6gPMO3WnTHWjhX121u 1D1Qwug1YyrLW5NZrPWX+liuDYqRz3yRxQPekvwjKuqYxiN3d2MOyL0PRzHuL2sqPJ2e6goVhrch teLLFUNm9JvnqJyUjnSN8eVajaTl8VY5OvXc++mvk2eFSwad43Ys10bsl5yCitNLBdrjLLPz1VYk TUmk9GRETeTmVNvBNin+Gzgw1qxrR7iA4S9SrK+24Nk1XUT4VkLq+lqWSSKqsZK+GOV0rEXsKOXl cxvhInRVArbF9OuJrPeBTM+KLJeKXMbtc8mxe+1VZi1xkSos0lpRs8M7EhVdopliZJKx8SMRq8je VU334eB8QuX8OHkjsYynAatKLIr/AJLXY9QV3I160bpaurlkla1yKiuSKnkRqqnRzkX1E1wbRbyi Nm4Wck4P6vTPEaOzU9pulHQZQt+glmrqaTtZUoYYUf0dNI9YUlm7JrI5N3Ju1Dt7RwIasZx5Nm18 OuXWqmxvULH73VX+3UlVWwzwunSpnVjHzU75GIkkFRI1FRV5XObzbIigVTxa6Ha86dcC9PnOYcSO XZ5Fk3mapyay5FMtXT0kkz2TRvopXqskaxy8kapvyva9ztmqjUT0a4UPitaOf8gMe/V0BhvWLSDy jGvnCnR6J5ZpFjNmlxVluZtT5BSS12Sup3Nij/37u9OxrFdNIrpEc58bEa1EVUTfHD1jF+wjQLTX C8qt/cL1j+IWe13Gl7VkvYVUFHFFKznjVzHbPY5N2qqLtuiqgHnXxv5flOBeVB0ty/CcAqs2vdtx akko7BS1Pd5a96yXFqsbJyP5VRrld+Cv4JGeOnWXWjiExnDcS174bbzoXglFkUVbcMtr46i8rTuW KSJGNWKnj5d2yOXkXq9zGdU5et38X2hXFZV8cGE8Suguj9LmVDiePU1M1Kq90NHE+qSSsR8bmzTx ybIyoY7dE26+PRTrNdcf8ppxZ4DUaIZXw+4Lp9jt7qaZ9zukmQ09S7khmZKxPgqiV7W87GOXljc5 eXZFRFXcJTxv8S+Xad4Rono1wwZbDT1mrK0tBa8mYrZnRW7+xoYHxOVFRHSrUMXtETdrWO22cqKl d8TVDxJeTzocK1usPFHnGpdmrb3FZr/Y8tqnVMFS98Uk3wSPc/sWPbBMno+kxeVUc7qhZ/ER5PzK 8h0L0csmjeVUntgaGxQraam4fBQ3JU7J8qKvpdm7toGPjR27UTdqqm/MkT1f0P44eOarw7T3XnTP GNKcDx65sut4qaO+Q3CouMzWOjV0DInyci8j5UY1+yN7RVc52yNAhXFe/K818p3ok/S6/ssl2v8A hFGtBdZqZJ1oYZ1unaVDYnLyvkjhe97Gu9FXtbv03JDU5Nrtwa8dGmul991+y/UvBdVOxpZYMmql qJaeeeZ1OnZ7qrY1ZKsT0WNGorXOYrenMSnia4YOJPJeOPTfWnQjFrXBYsKxempIbnca+BtGypp3 Vz0pJYUlSp7OVssUKvZG7lSbm/ert/LJw8cVnEXxjYbxAcSOA2LT/GNNo43Wq1UN5huElZPE98sb muic7xmc17nPRnoxtajd1VwG68vsEuV4le8Xhvlyssl4t1TQMuVsm7GsonSxOYk8EifgSs5uZrvU 5qKeWvkztL66p151tze46x57BHp3krXV9PHdndhknM+4tdLdG/8A0l6dmsiKvXne9fWesJgDhe0B 4puHHib1QpJNL7HftMNT8gWtq8ideoGPpKRstVJGrafn7V71bVKx7FZtum6OVPEIPw4P4ivKLVWe avXTiXzjS/GLTd1tOO2TEapaVsLuzSVO3VjmrMjWSRb8yqr3OdsrERGlteTp4htWc3yTVTh31uyF MjyTSm7voIb45iNlrIWVE1PI2RUROZWyQorXru5Uk9JV5d1g2k2hHGtwMX3NcN4f9Msa1VwHJ7gt ytL62+w2+ptknLyN7dsr2c68iMa9Gbo7s2uRzFVWlw8BvCbnOgns71S1mu9BX6janXJbldo6B3PB RNWSWVWI/ZEc98k73P29FNmIirsrlCP+VrxKvu3Cbecvo82yK0x43PS9ta7fWuioruypraaHkrI0 /dWx787EXwd1M5at6Y1mA+SWpb3U6j5bkzMspcUusVHe7gtTT2drliXu1E1f3GBOboxP4KfIbv42 9GMo4geGLNdKsJdTefbrFST0DKmVI45ZKerhqOzVy9Gq9InNRV2RFcm6om5lTK9EOMjUvyfNRw65 TohbrZk+M+YrZYqelyKhkfc6SlkTtJpHLN2MStYxnRZN3LzKiJ0QCs9UMW4rNNeCnT3ipsXE9klk SyWHHWUmI2pXU9sprVJFBT0nMiP5aiZUdC+TtWORVke1Nkam9i8Y/HJqNj3D/oImLZSzCrxrDaKS 7ZDkNNTLK+00vZU3brAxEc7q+oe7dqK9GxbN6uRUuDXzQHVvNfJtWbQLGcT75nlJi2KW2a09/po+ Woo3Ua1LO3fIkK8iQydUfs7l9FV3TeBazcEGr+oHDXw+1eF9ws+reilrt6st1dUxrDNKyKnWSHtm K6NXsmpo1avNyL6acybooFMae8Xtl0o4lNMcf0f4us61rwjNq+KyZRQZlDWOmts80scUVTBLVQxq 1vNLzoyPfZIntdvzNVPWkylpnfvKF6h6nY/WalYJh+k+DWlnNfKSGvp7xV3p++/LC6Nz+waqoidX IrWucu712RNWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV 8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyznvlHOH7BdV blpDBbc2yq72J72XqpxqxrX0trWNdpe2VHo9UjVdnrGx6NXdPwkVANTAz9opxuaO6/33UOy6c0eQ VUenEazV1wlp6dtLcIuaVGvo3Nmc57Xdi5Wq9sfRW+G67QHA/Ki8OOotbhdox6z5t51zjIWY7R2+ W3U3bUj3ywRNqqnkqHMjp1fUNRHI5z15H+h06hr8GY9WvKF6E6Vag1ullJas0zvKLS1y3Sgw2zJc HUCt25klc6SNu7d05karuVejtl3QmejXF5orr1p1ftSNOLzWVlPi8Ek94tk9P2NwouSN0iNfE5dt 3NY7lcjlYqtVObdrtgukFOcPnFLp9xJaT3LWLBrPkNDZrXV1VFNBdqeCKqc+CJkr1a2KWRiorZGo m70XdF3RPEh+CceukGoXDll/E7ZMazKLFsKrpLfcKOpo6VtwkkYyne50TG1Do3N2qo/wpGr6LunR Nw0mDGly8qzw2W/GLVmEOOai3C117I1ramisMcsNnkkX0YKubtkibKqcruSN8i7Ob612NW4JnOK6 mYdaM+wi8RXSxX2lZWUNXEiokkbvlRURWuRd0VqoitVFRURUVAO+Bgvyqef5PdbPprwo4NXOpbrr FkENFWyt/e0bJoY2Rv26ox800blVP3sD0Xoq79vq7pjqlpfrrwsae6DMzug0zsD5KDIYLHJWJbe7 wPgc19x7H4JVk3kVXTfhqr/HqBt0Hn5ozqXr3oRhvErqDrFZdX8jhoMumo8Spaqlq66RlL2lQ2Ko o46p7W90bzxOc+NeXkYi9dkQoHya+p2m+D2vPuIDUnC9VMgza00F3utxyxka1FrltsTKd76RJZJ2 tfWOern7PTwVPTRAPYEFOYTxS6f55wz1XFTaLPkMOJ0lput4fR1NPA24rDQPnZM1I2yui51Wnfyp 2myord1b12ypxya74hxJ+TYuermDW68UNnul7ooYYLtDFFUtdDcEidzNikkaiK5iqmzl6beHgB6H A8k+OL4ovBl/xbZP1ZRmsNRrbrxP5SDTiSxV+fx6VPwuqdeW0ctalgS4dncmNSdGL3ftt3Urk5/S 3SNU8Gga8B5t6MaAay6/+T11EwHiQjzirzpb/cLrjkmZurH3CmmpqSn7r2S1fwjYXvbMzp6KpNLt 1VS+PJna6XXXThWslZkdY+rvmJVUuMV9RI7d8/YMjdBI7fqrlglhRXL1c5rl9YGrAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAABT+rHF3w16IpNFqPrDj1vrYN+e2wVHfK5FT1LTQI+Vu69N1ai fn6KY21M8tHhjKtbDoLo7fMpr5n9jT1V3kSkje/1Kyni7SWVF+RVjX/8YelJDtRdY9KdI7f5z1O1 Ex7GIFbzs853COB8qf8Ag2OXnkX8zUVTzMW6+V94s/8AaNFVaW45WJvzNYmPRsa7wVHPV1wcip62 8ybfypvMdOvIwWqvuHsk4iNcLzkdxqHdrVU9lZ2faP8A7+rqeeSRF9a9mxdvWnqCeaseWP4bcLWa i02seQ5/Wx7oyWGHzdQuVPUs06dr/OkKp+f5aSXi68p7xVfAaB6PSYbYav0YrlS21GNVi+O9fX7Q uVE9cTWu+RN1Q3tpNwVcLuinYz4Ho5YY6+DZW3K4RLX1qO/hNmqFe5ir/eK1PkRC7gMQcEvCPxUa R6oXHWPiF1yZktXebPLbZ7RJXVVzkTnljkY5Z5la2JWLHsjWNc3Zyoip6tvgAAAAPMHyVmVYlgmp fEPYtSr/AGyy5e2+Ry1TrpUx08kkUE9YlQqOkVOjJHbv+Tnaqnp8ebOuuJUUHEhk2Ua2+TZuOodG sqSWDJMGZWVq3NGu2jfcKeORIVcrORru0Zu1WKm0jVRQIn5N2443d9VOLm7Ya2NuP1rp6i1JG3lY lG+puLoUanqTs1bshYvkULBaafh1zLJ4qGFtzrs0noZ6lGJ2j4IaGkfFGq+PK108qonyvUk/k6+H LUjEqrWHWDWfCkxOo1duq1FNjSvRstHRulqZXo9GbLGirVcjW+i5EiVVRN0NT6K6DaT8O+K1WE6O 4p7H7LWXCS6T03fqmr56p8ccbn89RJI9N2Qxpsi7ejvtuqqoYH8llf8AHsD1Y4hcT1RvFBaM+W/R y1XnOdkM1RHFNV9u5ivVFcjZHo523/fGL1TZTpuFWJuc8XXF5l2l7ErcKr7DeaSOeiTmpqqvnnRY XRq30X86x1bmqnijt06Kbo1f4NOGPXi/JlOqmkdrvF55WsfXxT1FFUTNamzUlkppI3S7IiInOq7I iJ4E80y0n030axiPDdLsNtuN2eN6y92oouXtJFREWSRy7ukeqIicz1V2yIm/RAPPPyZWrmneGcCu pMeSZZbKGqsV1u1XVUk1Sxk6xy0MCQqyNV5ndo9rmMREVXParU3XoVlwu/8Acidfv+Ulb/VbUeiN u4HOE606iu1Wt+iVihyV1S6sSo551gjnVd+1ZSrItOx6OXmRzY0VF6psvUr3XzhgwfSTgi1W0n4c dNrjCy+07q9lmt8tbc6iqrXup2OdG2V8sqqscDE5W9PQ328VAoPSDUXRWi8kBfrJW36xxVcWNX22 1dBLPGlQt5mnnWmRY1XmV7nvp5GLsvo8qp0b0vryVdvvdv4JsLS8MljZUVV0qKJkiKipTOrZVaqI vqV3O5PlRyL6yI8LvAjoVn/DdphdeIDQREza1W2WCrbco6y21ictXMsbamJj41k2Yrdkla70eVPD Y23aLRarBaqOx2O3U1vt1vgZTUlJTRNihghY1GsjYxqIjWoiIiIibIiAee3GTtS+Uw4ZKy49KGWO GCFXdE7x3uZERF+XmfD0/k+U9FDF/lM9Cc91AwnC9adHbLWXXPNJr7FdqCioqd89RU075InPSOJi K6R7JYaeRGp15WybdV2XVunGXT57gdhzKrxu749U3ehiqqi03ajkpayhmc34SCWKRrXI5ruZu6ps qIipuiooHw1W/tXZj/xBcP6u881eDekqa7yTGt9PSQulkV2SPRjU3VUbbqdzun5kRVPUm7Wuhvlr rLLdIO2o7hTyUtRFzK3nie1Wvbu1UVN0VU3RUUhWkOgukuhGFVOneleIR2fHayqmrJ6CSrqKxsks rGskVXVMkjlRzWNRW78vTw6qBgfQXVzTqy+R9yKyV+W2yO50uP5PYJKFalneErayoq1p4kj35lVz amJ3RPwVVfBFVKzqf+4n0n/KRf1y89BLFwC8H+NXa73uyaG2alrL3R1dBVPSpqnNZBUxOimbAx0q tpldG97eaFGKiOVGqh3y8IfDw7RRvDqunqrp62q74ln87V3Sbtu25u37bt/3RebbtNvVtt0A89eO L4ovBl/xbZP1ZRnrYVJnPChoDqRiOGYJmmBecbFp7HBDjdL50rYe4shiZFGnPHM18uzI2J8I52+2 67qqqW2B/HOaxqve5Gtam6qq7IiHnZ5GFrpNNNU66kaqWyfMESl6dN0p2quy/wDiuj/9hqnjIznN 8E4eMtqtNMJyPKcru9G+zWiisVrnrp4p6hrmLUOZC1ytZExXyczk5eZrW+LkOg4BOH6u4b+GfHcK v9P2GRXR8l+vsXrirKhG/BL/AH0cTIYneKK6Nyp0UDRQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAAAAAAB0mW 5vhmA2l9+zrLbNj1tj35qu6V0VLCm39/I5E/9oHdgxdqz5WjhM067ajxi83fPblFu1IrHRq2mR/y OqJ+Rit/vo+0M4VPlGuOviSqZLZwrcPy2mhkc5jblFQPukkK77JzVUzWUcf8j416+voB6tVlZSW+ llrq+qhpqaBqvlmmejGManirnL0RPzqZt1Y8o5whaRdtTXLVajyK5Qqqeb8ZZ5ykVyeLe1jXsGqi 9FR8jV3/AJzHNJ5Nvje4jaqK78VXEM620b3o9bdJXSXaWFd91RtPG5lJF+ZWPXr12+XSWk3kneEr TfsazIrBdM8uUezlmv8AWL2CP/vaeFGRq3+9kR/8oGf8p8r3qzqZdpMT4VeHGsuVdJ6MU9wimuVU qKuyO7pSbIxU+VZXpv4psnXp14bfKq8V202sep0uB49V9X0NTcW0THRL+97lQJ6ap/BnVq+tV+X1 LxXDcQwW0x2HCcVtGP22Lbko7XQxUsDfV0ZG1Gp/kO5A8+tJvIy8P2J9jW6qZZkOd1jNlkp43+a6 F3ypyRKs386TJ/IbK0z0I0Z0bpEpNLtMsdxpOXlfNQ0DGVEqf+Em2WST+VzlJ2AAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4qo1Fcu/ RN+ibnXY9kmP5baIL/i18oLvbapFWGroahk8Mmy7Ls9iqi7KiovyKmx2R46cdUetPAdxQTasaCZd ccdxnUx8l5dRxbSW+S4tVErIJqd6LE/dzmyoqt3RJ1Ripy7gbf8AJdvZHwI6aSSORrWpelc5V2RE 88VvVTTdgyKw5Va475jN5orrbpnyMiq6Ods0MiserH8r2qrXbPa5q7L4tVPUf589DMp4h+I2bT3g txzPbpQ4XJVzU626h2hhZSyzy1VXUVPJs6oRiPlejZFVvotRERV6/wCgXDsSsOBYnZ8JxagZRWew 0MFuoadvhHBExGMTf1rsibr4qu6gdwAAAAAAAAAAABmPja44MH4SMNdDE+kvWf3WF3mWw9pvyb7o lVVcq8zIGr4J0dIqcrdtnOYGg5swxmDL6XAX3mm9kNZbprtFbkdvN3KKSOJ87mp+CztJY2Iq7bqq om/K7buTzH8kbkOea16p6z8Qmp18qbxfayC2WpKyZERNpHzSvijanSNjEhgRGNRGoip0Ni6s8bvC zot20Gb6x2JbhBujrbbJVuFYjv4LoqdHrGv/AI/Kn5wLzB5k6g+Wdp7tcPY1w56E3jIbjUOWOlqL 05UdI5P4NHS875EXxT4Vq7eKfJEUxvyvfFn1vN1q9LccrERFjkl9j7GMd4tWOJHV7k28Uk3RfD5Q PSXU7X7RTRimdUapaoY7jbkbztp62uYlTIm2/oQIqyv/APuWqY01Y8s7oNi/a0Ok+GZDnNY3dI6m dqWuhcvqVHSI6df5Fhb/AC/J0mmPkW8Bpqlt8101dv2V18ru2qKW1RpRQvevij5pO0llRfHmTs1/ /HsrSfhN4cdEEhk000hx611kG3JcZKfvVcip6+8zK+VPl6ORAPPb3QflXOK9ey0m04m0/wAdq12b W09ubb2OiX993yvVXv2/hU+y/Inih3WJ+R+1M1FuzMs4p+I6vulfL6U8NtkmuFU7fqqLW1n4Kp8i ROTfwXp19SgBmzSbydnCLpB2NTaNJqC+3KHZUuGSL5zlVyeDkZL8CxyeKKyNvU0dTU1NRU8dJR08 UEELUZHFExGsY1PBEROiInyIfUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxVxtaW4JrTxYcLWmmpdi88Y3ePZv32i71NT9r2Vtpp o/hIXskbtJEx3ouTfbZd0VUUNqgykvkuuBT5jfpNePvZ/F8l3wKp4aG/Sa8fewzk1cDJzvJe8Cyf /mO+k14+9n4XyX3Ax8x30mvH3sxmzoy1oDJS+S/4GE//ADH/AElvH3s/C+TB4Gk8ND/pLePvYzZ4 uWuAZFXyYXA18yH0lvH3s/K+TE4HE8NEPpLePvZjShtFqqWvAZAXyYvA78yP0lu/3o/K+TH4HvmR +kt3+9DThniKmwQY8d5MjgfTw0S+kl3+9H5XyZXBB8yX0ku/3oxpwzyepsUGOHeTL4IU8NE/pJd/ vR+F8mbwRfMn9JLv96HGQ25LXvhsoGNF8mbwRp/+ZT6SXf70fhfJn8Eif/mU+kl3+9GOMhnkle+G zgYuXyaPBKn/AOZX6R3f70flfJpcE3zK/SO7fehxsNuRXN8NpgxU7yanBOnhot9I7t96Pyvk1eCj 5lvpHdvvRjjqWeQ3N8f57m1wYmd5NbgpTw0X+kd2+9H4XybHBV8y/wBI7t96HHUs+j7u+P8APc24 DEK+TZ4K/mY+kV2+9H5XybfBYn/5mPpFdvvRjj6WfR13fHj5NwAw4vk3OC35mfpFdvvR/F8m7wXJ /wDmZ+kV2+9Dj6W3oy7vjx8m5AYYXyb/AAXp4aNfSK6/ej8r5ODgw+Zr6RXX70Y5RSz6Lvb48fJu kGFHeTi4MU8NG/pDdfvR+HeTk4M08NHPpDdfvI5RSz6Jvb48fJu4GD18nLwZ/M59Ibr95Pyvk5uD VP8A8zv0huv3kxymjrbeiL++PHybyBlXyXHxE9Mv01+uK01UWHKAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAM+cdXDnFxMcO2QYVQ0jJMktjfPOOvVE5kr4WuVIkX1JKxXxL6k7RF/eoaDMn61a1Z9 rZn1dws8LV17pcKTaPPM8jTnpsXpnbo6mp3J0krnojkREX0OvVHI50QUP5HHhpkxPDb3xF5XbHQ3 TJXSWaxMmj5Xw0EMm1RKiL1RZJ2cnyokC+px6UGH7XSZd5OC6UtFWXS95fw5XaZkc1bVKtTccKrp FRHSycqJ2lFLIqudsnoOcuycy7S7VtV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqK nRUUDlgAAAAAAAAADJvHTx7YhwmY+mO2OOmv2o92p3Pt9qV+8VDGqKjaqr26ozf8GNFR0my7K1EV yeE+d53l2pmXXTO87v1Veb9eZ1qa2tqXbvkevRERE6NaiIjWtaiNa1ERERERD/Q3qjwTcLGst5rc j1E0as9xu9xeklXcIJJ6OpneiIiOfJTyMc5dkRN1VfBDPeZ+Rq4Wb+j5cWvmbYvMqL2bKe4xVUDV Xw3bPE56on5pEA8v+FLAsu15zKPh6tuuseAWnIXuqXU1ZV1DaW51KI1qRJBGqMmmVm/K2Rzd0RUa u67L6haT+R14Z8J7Gt1FumQ6gV0aor46mfzfQqqetIYFSTx9TpnIvht470dlHkRsqttS24aa8QtF LNFI2SnZdLNJSPhc3qipNDLIqqioioqMTb+br6B8Mdv4icd09hw3iSlsl2yKyNbTw5FaK91RHdoO vK+VskUb2TNRERyq3Z+6O35lciBMdPdI9LtJrd5q0z0+x/GKZWo17bXb4qd0qfLI5qI56/ncqqS4 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAGVOIj49fCP/j9+p4jVZlTiI+PXwj/AOP36niA1QvrPw4/a+s/DjEtofhx81Po 4+amreH5cfhx+3H4cJSQ/Cn4cftT8ONUkPwp+F9Z+1PwvrNZbw/Dj8Kftx+FMJIfhx+FP24/CmJS Q/Lj5uPo4+bjVvD5uPyp+nH5USkh83es/Kn6d6z8qat4fh3rPwp+3es/ChvD8Kfhx+1Pw40SQ+a+ s/Lj9L6z8uMS3h+HH5U/Tj8qapIfN3rPm4+jvWfNwlvD8r6z8OP2vrPw41SQrXyXHxE9Mv01+uK0 1UZV8lx8RPTL9NfritNVHVeIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJ+tWtWfa2Z9XcLPC1d e6XCk2jzzPI056bF6Z26OpqdydJK56I5ERF9Dr1RyOdEDWrWrPtbM+ruFnhauvdLhSbR55nkac9N i9M7dHU1O5Oklc9EciIi+h16o5HOivXRXRXAdAsBodOtOrV3S30m8k88i89TXVLtu0qaiTxkleqb qq+HRERGoiI0V0VwHQLAaHTrTq1d0t9JvJPPIvPU11S7btKmok8ZJXqm6qvh0RERqIiTsDiXW1Wy +2yrst6t9PX2+vhfTVVLUxJJFPE9Fa5j2u3RzVRVRUXoqKY0/wCybyd+Tf8A1jfeGq+1v9/UVWA1 Uz/53SW973fnVir/AAv3baxxLrarZfbZV2W9W+nr7fXwvpqqlqYkkinieitcx7Xbo5qoqoqL0VFA Wq62y+2ykvVluFPX2+vhZU0tVTSpJFPE9Ec17HN3RzVRUVFToqKcsxT/ANk3k78m/wDrG+8NV9rf 7+oqsBqpn/zukt73u/OrFX+F+7bLtV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqKn RUUDlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfxFRVVEVF2XZfzH9MReUrt+sWl2NWnit0Ay252K+Yg6O 3ZJBTL2lPcLVJJ8E+ogcixzJDM9UTmaqo2oe7dOQDbplTiI+PXwj/wCP36niKA4bvLJ4Rk3dca4k cb9i1xdyx+yC0xvnt0i/wpYPSlg/lb2iev0ULn1bzHE894zeD3KcJyS2X6z1rc+dT11uqmVEEieZ ofB7FVN09aeKesDYC+s/Dj9r6z8OMS2h+HHzU+jj5qat4flx+HGfMs43NN7DkWRWLG8A1KzqmxCo fSZFeMUxxa63WuojTeWKWZZGcz406vSNH8vXfwUk+T8VOieM6QWbW+TKnXLGsmfDT2JLbSyVFXda qVXNZTQU6JzumVzXtVioitVrkdy7KJbxMLZU/DijsQ4vcIyDO7Ppxl+Aahac3zJEk8xR5lY20UV0 exN3RQyxyyM7REVF5HK13VE23VEVkXFzgll1UyvRWgwzNsgzLFIaGofbLNbYqh9dFUw9t2kCrM1E ZE1WNkfN2TUdJG1Fcr2ouuTeKoXcp+F9ZnrHuN/TjM7dWswvT/Ue/ZPaaupo7xiNHYm+eLU+BUR6 1THythiRVciN+FVXqj0YjlY9G82t4ztIabh3reJeGmyGpxm2VkdvuFCyiZHc6OqdVMpnQywyyMa1 7HytVyc/4PVObpviYlJFUL1cfhTPt943tKMVutnXMcbzbHsVyKp7rac0udnSGxVj1a58atl7RZWt ka1XMc+JqOb6SLy+kdnY+LPC7lqPj+ml/wADz/EavLmzLjlfkVlSko7s6NnO5kTu0dIx/JsvJMyN 3VEVEVURcZS3iqF2OPwpnK36w4ziepPERc7Kmq+YXfCUsE12x6Wop6i303bUr1j8zQulb2TVZzSV HOrd1Zu3m22X68D2uuba66J2i/6gY7kUV5ipmyVF9r6CmpqG8OknnRHUfYP9JsbY2tdzRx7Krfwt 1UxMas29NcTOTQzj5uPo4qTVriQw3SjKrXgC43lmXZdd6N9yp7Bi1r77WNo2v5FqZEc9kccXOitR znpuqKiGu1LnFOuVpuPypWGlPETg2rFZf7LT23IMWv8Ai7I5bxY8ot62+upIZEVY5nNVzmOicjVV Hte5Pl23Tevp+O3TB1uq8rtGn2p15wehmkjqM0t2MulszWRuVskySK9JXxMVF5pGxK1NlGUtouUx GebRjvWflSu9QOIHS3TvTq26oXe/OrrNfnU0djba4XVdRd5qhvNBFSxM9KV706onTpuqqiIpH9Oe KXCs/wA4i0zuuIZtgmVVlI+ut9qy+z9wluNOzftH07mveyTlRFVW83MiIq7ei7bXKW+nTE5Zrhd6 z8KUXg3GFgepeUJiOFYLnlzrIL1UWW5yw2mN9NaHRTOi7ermbKrIonuZJydVeqMcqsanU/OQ8X+D 2/Jr7jGHaf6iagPxaodSXytxKw99pLfUt6vgfK6RiPkan4TI0eqeHiioNGW8XaMs815qfhxm/Xbi wttu4UbrrroolzvjbhSTUtvuNFRxvSz1So5iT1kU6pyJFIiNVqsf6asTlVrty1NFNQLpqVp3bMmv OI5Fj9Y+GOOaG+UsME1S7smOWoY2GR7eyerl5V3Rei+ihpNMxGaSm5TVVox2pwvrPy4+Mtyt0Ujo 5a+mY9vRWulaip/NufqKpp6lqvpqiOVqLsqsejkRfk6Gspof1x+VOlTOcJkyx+BR5hZHZNHB3t9l S4QrXtg6fCLT83aIzqnpcu3VD82XOcJyW73XH8czGyXW6WKTsbpRUVwhnqKCRVciNnjY5XRO3a5N nIi7tX5DGTeKo3u4d6z5uPo71nzcYlJD8r6z8OP2vrPw41SQrXyXHxE9Mv01+uK01UZV8lx8RPTL 9NfritNVHVeIAAAAAAAAAAAAAAAAAAAAAAAAAAB/FVGpu5UTrt1P6dbkmPWjLcfuWLX+kSqtt3pJ aGrhVVTtIZGKx7d06puir1Tqh5DRcdfFBwHa03/QTVmpk1MxnHa3sqN15mVlxkt70R9PPDWIiq7m icxVbIkiIu7EVuygexYM+8OfHVw7cTEUFDhWYMtmSSN3fjt55aWvR23VI0VVZOn54nO2TxRPAiOt WtWfa2Z9XcLPC1de6XCk2jzzPI056bF6Z26OpqdydJK56I5ERF9Dr1RyOdEDWrWrPtbM+ruFnhau vdLhSbR55nkac9Ni9M7dHU1O5Oklc9EciIi+h16o5HOivXRXRXAdAsBodOtOrV3S30m8k88i89TX VLtu0qaiTxkleqbqq+HRERGoiI0V0VwHQLAaHTrTq1d0t9JvJPPIvPU11S7btKmok8ZJXqm6qvh0 RERqIiZzwrXD2C8XPFZcNUtRq+kwTB7bitXTU9wuEslFbUltyOl7vAqq1j5ZFT0Y280j3ImyuVAN jgzBoJTaza+Z5HxK6j3XJcLwlsLosGwOCvlpO8Uj/C5XaONyJNLImyxwv5mMaqLsq+k6r6HA8o1+ 44uIHCb5r9rBi9iwyDGZbTbsUzGpttNEtVbY3TfBJzMRFczm9FE9JzlXdVA3eDEep1VrNwHVtg1N frVlOpuj1Zd6a0ZTbcxmjrLpZ46h/Kyup61rGue1rlRFjcm3VqdVdzx/viGs+VaoceODaNQ6zak4 ZjNfp7VXeohw/Jp7WstTFVzI17kZuxyqmyKqtVdkRN+gGzrrarZfbZV2W9W+nr7fXwvpqqlqYkki nieitcx7Xbo5qoqoqL0VFMaf9k3k78m/+sb7w1X2t/v6iqwGqmf/ADukt73u/OrFX+F+7WbivBnT Yrk9oydvFDxEXZbRXQVyUF11AmqaKr7KRH9jURLGiSRO5eV7FX0mqqesv662q2X22VdlvVvp6+31 8L6aqpamJJIp4norXMe126OaqKqKi9FRQFqutsvtspL1ZbhT19vr4WVNLVU0qSRTxPRHNexzd0c1 UVFRU6KinLMU/wDZN5O/Jv8A6xvvDVfa3+/qKrAaqZ/87pLe97vzqxV/hfu2y7VdbZfbZSXqy3Cn r7fXwsqaWqppUkinieiOa9jm7o5qoqKip0VFA5YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPnUVEFLBJVVU0cMMLFkkkkcjWsaibq 5VXoiInVVKz0H1/xriGtd/yfCLHeYsbtd3ltdsvVZAkVNfGRtRJKml68zokk52cyom/L8vM1sozu q06uFFHp1qFcrOkGbRVFpgtdwqmROurXRr20ETVcjpHdmqqrWbrtuvqOyxTFcdwbGbXh2JWmC12W y0kdFQUcCKjIIY2o1rU36r0TxVVVV6qqqu4FQ4lwb6SYxqPTat190zfJ8soK2euobhkGVVtZ3R0q ParGRc6RcjWSOY1rmLsm3iqbkp1v4cNGOI+1Wyy6z4b7IaKz1D6qii841dJ2Urm8rnb00sau3Tps 5VQssAQrSHRnTbQfDItPtKMb8x2CGolqmUnfKip2lkXd7ued739VTw5tk9RWmK8BXCdhWo9Lq3jG lPcsso7g+6QXDz7cpOSqerldJ2T6hYl3Vzuit5evgaAAFaa38OGjHEfarZZdZ8N9kNFZ6h9VRRec auk7KVzeVzt6aWNXbp02cqodtpDozptoPhkWn2lGN+Y7BDUS1TKTvlRU7SyLu93PO97+qp4c2yeo moAz/ivAVwnYVqPS6t4xpT3LLKO4PukFw8+3KTkqnq5XSdk+oWJd1c7oreXr4E11v4cNGOI+1Wyy 6z4b7IaKz1D6qii841dJ2Urm8rnb00sau3Tps5VQssAQrSHRnTbQfDItPtKMb8x2CGolqmUnfKip 2lkXd7ued739VTw5tk9RWmK8BXCdhWo9Lq3jGlPcsso7g+6QXDz7cpOSqerldJ2T6hYl3Vzuit5e vgaAAFaa38OGjHEfarZZdZ8N9kNFZ6h9VRRecauk7KVzeVzt6aWNXbp02cqoZI48r3pjwVcIE3D7 ojjjLTUalVFVabfa0qp617KaZE7/ADos75Hu3Y5sSJzdHTtVqeip6BEWq9L9P7jntPqfc8UoK7Ka KkbQUVzqo+2lo4Ec53LBzbpCque5XOYiOd0RyqiIiB4qcN3kquITWvut/wA8pva3xeblf3i7QK64 zsX/AL1R7o5v8sqxp13TmNHam8B2AaN698NelGiGbZTiF8yR2YVVRl8dYstf3yjtsE0EnJ6MSR8y OY+NjWc8b3tcq77nqMZU4iPj18I/+P36niAuzTSTUTENLqafiEy/Gqy/2mGoku96t8a0VA6CN71b UP7RUbGvZI10i7NYjubZEaiE1hqaesp46uknjngnYkkUsbkcx7FTdHNVOioqLuiocTJcbsGYWG4Y tlVnpLtaLpA+lraKriSSGeJybOY5q9FRSr9AOHK38Oi3+x4hn+TXDDbhLHNZcautQlTBYNuZZY6a VyLL2blcioxztm8u/pOcrlxLaFuOPmpC9N9bdK9X5r5S6dZpQXmpxu4z2u600SuZPSVEUjo3I+N6 I7lVzHcr9uVyJu1VJopq3hj3yZ10ttq4ZLnZcgrqemv+L5TfYctSokax9PWJUve98/Mvo/B8vpO6 bNX5FIJqtl+jmQag8IepOlkFuo9Im5he6OGSmtLrZQMuMrGx0rkhfHGjP7IjnVHcqIqo5UVfE0lq JwZcMmqmV1Ob5xpRQVt6ruXvtTBWVVGlarfBahlPKxk69E6yNd4ITbJNINLss0+TSnIcDstZiEdP HTRWZ1I1tLDHH+5pGxu3Zq3ZOVW7K31KgbRE7Gc/KCyQ3Ct4f8Xs8jX5XV6u2SttkUa/Dtp4ElWo mT1pGzniV6+CbtVfA+ujNNA7yhnEXVuias0VhxWNj1Tq1rqRFcifmVWN/wAiFt6acKegGkGR+zDA tPIKS+thWmiuVZXVVwqYIlRUVkUlVLI6JqoqoqMVu6KqeCkrs2lmB47qDkmqdnsXd8oy2CkprzX9 6mf3qOlZyQN7Nz1jZyt6bsa1V9e5jNvETnmztwgUtPHxEcU9VHCxssma0THvROrmpTPVEX+d7l/n Uy1nnTgA4q2J0azW64tanqRPOtt6IeleI6W4JgeQZTlOJ2LuN0zSuZcr5P3qaXvdS1nI1/LI9zY9 m9NmI1PzESuHC5oVc8AyzS6uwbtMYze+SZJfqHznWJ3y4ySxyvm7RJe0j3kgiXkjc1no7I3ZVRcZ 5NtCZjLtU75RC2W9dJtM7UtJEtG3U/GqdIVb6CR80reXb5OXp/IcnjL2TVvhmen4SakxNRfXssDt 0NAai6W4JqtbbZaM+sfnSks91pr3RR96mg7Ktp1VYZd4ntV3Krl9Fyq1fWin5zTS/BdQbtjN8y+x 9/rsOuaXiyy95mi7rWI1WpJtG9qP6L+C9HN/MYzSaMzmy3poiu4kONhERVVaDG0RE/4mqif+T2ex /Brpi5j0ciW2oTdF36pWToqf5S4LBpVgOK5jl2fWLH2099ztaN2Q1TqmaVK3usTooN43vWNnKx7k 2Y1u+/pbr1KihxjQvg2rZKjTbQ3O5H5csj6puI2a5XuGLsXIqI+NrnspUVZnK1rUajtnbJ6PTEzn GTemmaJiZ6/GWhHGbdY9K7PqBrvR5JpPry7T7Wew413WWOKlhuDKuyPqFe1lRRy7I+Ptt9ntcioq 9UVUbt3DuL6w/MNr1/8As1uX7B2eQaR6I8U1gsWdah6U3RlVFHK2hW701XZbzRsSRzVY/s3xzxtV UVyNVdlRyORPSNY1bUkzFeqFDZDqbrjebNrxwz6k0GNXXOrXprW3i23/ABaKSJLhTSwyRpBNE9Vd FUKr05Wouyo7dE22c7rOHvCtaMk4T8UvNi4ucUs+DrizYaqjn0+pp4rfCyFWVME07qxvOsapI173 NbzKiuVE3NX6WaFaTaJUtdS6YYVSWRbm9sldUJJLUVNU5u/L2s8znyyIm67I5yom67eKkIvHBJwt Xu91V/r9Irf29dUd7qqeCsq4KKebffnfSRytp3Kqpuu8a7+szpQRaq2z85ZluOGWXRt/Bhb36j0m Z4PZL/eKZuTMhSCkqZ6xOe3Lt2kjW8vM9jV51/c1Xp4JsbMMy0dteqeEYjlqWyfO7s2ukxeN9sWq q4WMiRal8crWO7s1WN2VznMR/Kqbryqid1l+mOnud4W/TrLcOtVyxl0McCWuWnakEbI02jSNrduz 5Nk5Vbsrdk2VCK6WcMuheit2qr/ptp/S2y61cPd5a+aqqK2p7Hp8G2WpkkexnRN2tVEXZOnRDSZi dqWmiqjVTllqVD5PajpoMH1Tq4oWtmqtVshWV+3V3KsKIir8iIn/ALV+Up7gawbiBuuk95tmG8R1 oxGss2U3Skv1lqsIhuNVTXBJfhHyzPqY3OV6cqpu1NtuXdeVTcWAaYYNpXb7na8DsfmulvF1qb3W x95mn7WtqFRZZd5XuVvMrU9Fqo1NuiIQfPuErh41MyWqzDMNNqae8V7UZW1dHXVVC6sRE2Tt0ppY 0m6bJu9HdERPUZ0o1sxZmIp6uuYZezbTm2afcCevrrNrLatR4sivtXeauutVuZR01LXPqaZtTA2N k0rURHs5tkVERHJsm3VdracPbJp3iz2ORzXWWiVFRd0VOwZ1PjFpRptTady6S0uF2qDD5aOSgfZ4 oEZTrA/fnbs3Zd1VVVXb83MvNvv1ONpZpBp3onjUmIaZWB1ntEtU6sdTuraiq+FVjGKqPnke5E5Y 2IjUXZOXoniRzVnCa3bmirVsyUDqfhelFwz++Vt64CMgzGumqnOnv0FvtT47g7ZPhWulq2PVF/vm ovTwLW4erNitkxW402JaDXDSmmfcHPktdbT0sL6qTs2J3hEppZWqioiM3VUX0PDbZS1l9Z+XGKqs 4yS0Wopq0vpDEXlEUismSaYZbpRPXR66sujqTGIbXC2WesoVY/vDJ2r0WFvN0V26enIm2yvc2deT totOWcONuu+E1k1bebpVzT5dVVn+3XXrf4dk26quzd28m/ixWuX0nuLqdoxpquq3t3S42s+atoPN kVznraiXsKbbZWRQvkWGLfrurGNVed+6+m7f8YRotppptk2TZfg+NrabnmFT3y9Ohrah0NVPu53a dg6RYmO3e5VVjGqvMvyiao0dFrTZqi9xur/Oft3pm71nzcfR3rPm4jldh+V9Z+HH7X1n4capIY14 CuArhO1p4TsG1M1L0p885JefOffa3z7cqfteyuVVDH8HDUMjbtHExvotTfbdd1VVXQHvXHAn8xn0 mvH3seS4+Inpl+mv1xWmqjqvEMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3s e9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/M Z9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s 1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71 xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKb/ACXfAjGx 0kmh6Na1FVzlye8IiJ8q/wBlnkdlGhk3EbxD5TjnBbo7XyYXQ1/cbctPUzz0rIY0Rnep6uqkckaS ua6RqPenoua1E3Tr/oMyKwWvK7DccZvkD5rddaWSjq4mTPiWSGRqteznYqObu1VTdqovXoqHwxLD sTwKw0uLYTjdssNnom8tPQ26lZTwRp69mMRE3X1r4qviB538NPkccNxOSiyviLyl+S3WFzZmWKzT SU9BC9OqJJUJyzTKi7fgdkiKn75CyKS2XTycGX1tXRUFRduHLMLp3qtmjiWauwq4zK1vayuRFfPR PVGpzO3czZE35v3XcBxLrarZfbZV2W9W+nr7fXwvpqqlqYkkinieitcx7Xbo5qoqoqL0VFAWq62y +2ykvVluFPX2+vhZU0tVTSpJFPE9Ec17HN3RzVRUVFToqKedVZwvYHxRcd3E9jWol1vsVtttBjMl NS2+udBF32WzsZDVyNT90fBs5Y0d6O8juZHIuxZP/ZN5O7Jtl8433hqvtb/f1FVgNVM/+d0lve93 51Yq/wAL9207hOnOlVDmGQa4YNb6eW9ajU1BLdLzTV8s8Vygp4UZSvY1Xuia1Ittlja3mTqu69QK W4V9cM1tmVXHhM4jKxqan4jT9rars/dsWXWZN0iroVX8KVGptK3dXbtc7qrZEZ0nD1/3Qvis/wDJ MN/VaGg9QdD9LtUshxfLc2xjvl7wysWusVxp62oo6milXbfllp5GOcxeVN43KrHbdWqQLUXgZ4Xd V87u2pmeab1Ffkt87DzhXQ5FdKTt+xhZDHvHBUsjTaONjejU8N13VVVQqfykuV2zP8AtHCJhtdBc 9QNUL7baSK2U7klmoKKGoZUS1k7U6xxt7JvV226c6pujXKka4htL/bN8onp1hVPqFmeFtbphVStu mKXRtDcGpHVzfBpM5j05Hfvk5euydTUejvC9oFoDNVVmkmmVrsNbWs7OorueWqrJGKu6sWone+Xl VURVbzbKqIu3QkVbpJp7cdUrdrTWY/2mZ2m1SWSjufe507Kie9z3Rdkj+ydu5zl5lYruviBVeFcI FRhmWWrK3cVvEJf0tVUyqW2XrMYqmgq+Vd+zniSmar419beZN/lNCAyfrVrVn2tmfV3CzwtXXulw pNo88zyNOemxemdujqancnSSueiORERfQ69UcjnRBx9e9WMu4hMvu/CJw4TU73rEtJqJmckKT0OO 0UiK2SkiRfRmrZG8zeT9518FRzotDaPaT4jodptYtLMGhqI7NYKfsIFqZlllkVXK58j3L++c9znK iIjUVdkRE2RONororgOgWA0OnWnVq7pb6TeSeeReeprql23aVNRJ4ySvVN1VfDoiIjUREnYAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAFHax6MZbqDxFaEak22W3+xvTmqyCrvUU8zmzPkqqFkNIsLEaqPVJEcrt3N2Rd038C8SmtUNbb /gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAZU4 iPj18I/+P36niNVmVOIj49fCP/j9+p4gNUL6z8OP2vrPw4xLaFbXDh80mrdYbXrzHi7KHN7XDPTL c6CV1M6tiljWNWVTY1RtQiJtyrIiqnK3rsiIRzO+KvTTS7V+36S6mQ3fF23qmiktGSXKl7Oy19S5 yo6lbVb8rJWpyKvPyp6W26ejzXS46PLcOxPPLLLjebY1bL9apnMkko7jSsqIXPYvMx3K9FTmaqIq L4oqboYbx1O25kciOa5FReqKnrPw4q7iE1N1O0mx225jp/pHU6gW2lrFXI6K31XJcoKDkXeWkgVP 7IejtlVm++ybInVXslGmOpOMavYFaNR8NkrH2e9wLNTd8pJKaZNnOY5ro5ERUVHNcm/VF23aqoqK uJSRtSZT8OP2p+HGqSH4U/C+s/an4X1mst4fhx+FP24/CmEkPw4/Cn7cfhTEpIflx83H0cfNxq3h 83H5U/Tj8qJSQ+bvWflT9O9Z+VNW8Pw71n4U/bvWfhQ3h+FPw4/an4caJIfNfWflx+l9Z+XGJbw/ Dj8qfpx+VNUkPm71nzcfR3rPm4S3h+V9Z+HH7X1n4capIVr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv 1xWmqjqvEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOJdbVbL7bKuy3q309fb6+F9NVUtTEkkU8T0 VrmPa7dHNVFVFReiopjP/sm8ndk2y+cb7w1X2t/v6iqwGqmf/O6S3ve786sVf4X7ttc4l1tVsvts q7LerfT19vr4X01VS1MSSRTxPRWuY9rt0c1UVUVF6KigLVdbZfbZSXqy3Cnr7fXwsqaWqppUkini eiOa9jm7o5qoqKip0VFOWYo/7JvJ3ZNsvnG+8NV9rf7+oqsBqpn/AM7pLe97vzqxV/hfu2zLVdbZ fbZSXqy3Cnr7fXwsqaWqppUkinieiOa9jm7o5qoqKip0VFA5YBk/WrWrPtbM+ruFnhauvdLhSbR5 5nkac9Ni9M7dHU1O5Oklc9EciIi+h16o5HOiBrVrVn2tmfV3CzwtXXulwpNo88zyNOemxemdujqa ncnSSueiORERfQ69UcjnRXrororgOgWA0OnWnVq7pb6TeSeeReeprql23aVNRJ4ySvVN1VfDoiIj UREaK6K4DoFgNDp1p1au6W+k3knnkXnqa6pdt2lTUSeMkr1TdVXw6IiI1ERJ2AAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEUyK 16ZVed4jc8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7 bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAMqcRHx6+Ef8Ax+/U 8RqsqrXThc0J4lPMnt14N7I/Y53nzZ/snWUfYd47Ltv9rSx83N2EX4W+3L023XcLSX1n4cZb9644 E/mM+k14+9j3rjgT+Yz6TXj72GYnJqFx81Mxe9ccCfzGfSa8fex71xwJ/MZ9Jrx97MZNtJptxGNR 7ZnF2wa9WzTPJKHHsoqKV7bXcq2iSqgpp1XdHPi3RHetOu6Iq7q123KtF+9ccCfzGfSa8fex71xw J/MZ9Jrx97MZM8Z1J5w+Z9rTl9ou9k130pXEcmxupjo5a6kqWT2q9o5quSponbq9GbbczXJ6KuRN 1cj2stZxm33rjgT+Yz6TXj72UlhHkkNN8N1lqabJMXtWoGlt2p5p457neLhQXqyTs27OBvdJY4aq N/N1c5rXIjV8NkSTGi2i7lzN+KfhfWZwb5L7gOdI+FuiLFkYiK5iZReN2ou+yqne+m+y/wCRT9+9 ccCfzGfSa8fexoNuP6miXH4Uzz71xwJ/MZ9Jrx97HvXHAn8xn0mvH3sxoNoxOXM0G4/Cmf8A3rjg T+Yz6TXj72PeuOBP5jPpNePvZji+ttyvqX84+bihfeuOBP5jPpNePvY9644E/mM+k14+9jiuttGM y/d8V7OPypRfvXHAn8xn0mvH3se9ccCfzGfSa8fezHFdbaMdl+74/ovB3rPypSPvXHAn8xn0mvH3 se9ccCfzGfSa8fezHE9bPL/4fH9F1u9Z+FKX9644E/mM+k14+9j3rjgT+Yz6TXj72OJ623pH+Hx/ Rcqn4cU771xwJ/MZ9Jrx97HvXHAn8xn0mvH3sxxHW2jhPL93x/Rby+s/Lio/euOBP5jPpNePvY96 44E/mM+k14+9mJw/WzHCmX7nj+i2XH5Uqj3rjgT+Yz6TXj72PeuOBP5jPpNePvY5P1tvS38Hj+i0 3es+bisPeuOBP5jPpNePvY9644E/mM+k14+9mOTdbb0v/B4/os1fWfhxWvvXHAn8xn0mvH3se9cc CfzGfSa8fezHJettHDOX7nj+h5Lj4iemX6a/XFaaqIppbpbgmi2CWzTPTSxeZsbs3bdyou9TVHZd rM+aT4SZ75HbySvd6Tl232TZERElZbcMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHEutqtl9tl XZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUUxn/2TeTuybZfON94ar7W/39RVYDVTP/nd Jb3vd+dWKv8AC/dtrnEutqtl9tlXZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUUDKWrGv eX8QmXScOHCJkUCvfDHJmeolI5JqLHaGVN0ipZGryy1sjd+XlX0OvVFRzor90V0VwHQLAaHTrTq1 d0t9JvJPPIvPU11S7btKmok8ZJXqm6qvh0RERqIiUL5K21Wy38DuAVtDb6enqLnNeKmtliiRr6mV t0qomvkVOrnJHHGxFXrysangiGtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t 6bzbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXt ORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA1R4VH5HqvR68aSanXzTrPHSUlPeqql/suh vlvic1Fp6qkld2blSNFRjk25V2VUVURW21kupWAYbkFgxXK8xtNou+VSywWWjrKpsUlfLGjVeyJH L6Tk52Jt4qrmom6qiElIJrJohphr7h02DaqYrTXm2yKskLn7snpJttkmglbs+KRPlavVN0XdFVFC dgrG53jGOFrQmOvvldmOSWTCbfDDPVyMlu12qIkc1izSq1N38vNzOdsjWMaq9Gt2JRpzqXgermJU Wdab5TQZBY69u8NXRyo9qOTbmY9PFj277OY5Ec1eiogEmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4FN aoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAh+DaT6baVOv9VpxgtssMmR1q3S5x22BsSVdTyI3m5d0a3o38FOVvM5ztt3 OVZgAKH0N4rrVqhmNx0hz7BLzptqfaIn1NRjN4VJEqaVruXvNHUsRI6mLw3c3b17czU5i+D4OoaJ 9bHcn0cDquGJ8EdQsaLIyN6tc9iO8Ua5WMVU8FVjd/BChsy1f4gdMNboLVkej3sr0pyeso7faL3i qPnuNjqJOSNfOUDtt4XSqru1Zs2Nqoiq5egGgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB FMitemVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnk t7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAFMcRWL8RtYyyZvw451bqW742sz6rFbzTtW25FE/l3ikmTaSGVvJ8G5HI3dyoqtRVcWdh tyyO8YnZ7tl+OssF8rKKGe4WplW2qShqHMRXw9s1EbJyuVW8yJsu3TdOp3JCtYtKbHrVp9ctO8hu 97tdLcFhlbW2avfR1dNNDI2WKWORvrbIxrkRyK3dqbp0QCagrPQXEtYcAwmoxrWvUu35xWW6tkjt l7jolpame2oxvZrWIrlas6Lz8zm9FRGqrnOVVJ5YMhsOV2akyPF73QXe1V8aS0tdQ1DJ6ednhzMk YqtcnReqL6gOwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJc fET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeavAVw FcJ2tPCdg2pmpelPnnJLz5z77W+fblT9r2VyqoY/g4ahkbdo4mN9Fqb7bruqqq6A9644E/mM+k14 +9jyXHxE9Mv01+uK01UBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k14+9j3rjgT +Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5jPpNeP vZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mqgBlX 3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuOBP5j PpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k14+9j 3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5j PpNePvZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9m qgBgC6cLmhPDXx2cMPtKYN7HPZH7NfOf+ydZWdv3ezp2P+2ZZOXl7eX8Hbfm677Jtv8AMq8Q/wAe zhG/x+/U8RqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAKa1Q1tv8AgvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzI vTw2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+VVS01bTTUVbTxVFPURuililYj2SMcmzmuavRUVFVFRfEp vSDhVwbQbUK+5ZpVe75Y8cyGnd3rDI6lH2WGtV7Xd7p4nIroH8qK1WsVG7KibIjWol0gCAYxrzpL mGpGR6Q2HNKKXMcUkay5WeXmhqERY2v54mvRO2YiPRHOj5kavRdt03n5XueaBaR6l5jjGoWX4ZR1 eTYfWxV1ou0auhqoXxu5msdIxUWSLfr2b+ZnVenVSPa38TuHcPeSY3R6l4/f6LFcg54ZcvipFmtd squZqRQVTmbvj7Tdyo5W8qbJ4pzKwLjBxbZc7be7dS3izXCmr6CuhZUUtVSytlhnieiOZIx7VVrm qioqKiqiou6HKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inp l+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX 6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAdRS5fiddkldhtDlFpqMgtkEdTXWqKtifWUsMn7nJLC judjXfvXOREX1AduAdRf8vxPE32yPKcotNmfeq+K121twrYqda2tk37OmhR7k7SV2y8sbd3LsuyK B24AAAAAAAAAAAAAAAAAAAAAAAAAAAADKvEP8ezhG/x+/U8RqoyrxD/Hs4Rv8fv1PEaqAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC j9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/gvEZoj o1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAABwr1ZbPkdpq7DkFqpLnba+F1PVUdXC2aGeJybOY9jkVrmqniipsc0AV1rDdd TsA0079oLpxaMou1okpmx2Cet7i2S3sVEljp3InKkqRpysa5WtTx9LlRjv3oVrPZtd8Bhzi0Y7f7 BIyqmt1wtV8t8lJVUNbCqJNC5HoiPRrl252Krd0VF2c1zW2EcK9U1zrLNX0dkubLbcZ6WWOkrX06 TtppnMVGSrEqtSRGuVHcu6b7bbpvuBzQUZw8ZJxO093u+mXEbhduqprFSxz27PLLNG2gvsbnq1Gv plVHwVKInM5qN5Oi9GorFfeYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ V8lx8RPTL9NfritNVHmrwFcE+k+rnCdg2oeTZJqBS3K7ec+3hteU1NHSt7K5VULeSFi8rd2xtVdv FyqvrNAe9v6E/wB2Oqv/AK71n/zA1UDKvvb+hP8Adjqr/wCu9Z/8x72/oT/djqr/AOu9Z/8AMDVQ Mq+9v6E/3Y6q/wDrvWf/ADHvb+hP92Oqv/rvWf8AzA1UDKvvb+hP92Oqv/rvWf8AzHvb+hP92Oqv /rvWf/MDVQMq+9v6E/3Y6q/+u9Z/8x72/oT/AHY6q/8ArvWf/MDVQMq+9v6E/wB2Oqv/AK71n/zH vb+hP92Oqv8A671n/wAwNVAyr72/oT/djqr/AOu9Z/8AMe9v6E/3Y6q/+u9Z/wDMDVQMq+9v6E/3 Y6q/+u9Z/wDMe9v6E/3Y6q/+u9Z/8wNVAyr72/oT/djqr/671n/zHvb+hP8Adjqr/wCu9Z/8wNVA yr72/oT/AHY6q/8ArvWf/Me9v6E/3Y6q/wDrvWf/ADA1UDKvvb+hP92Oqv8A671n/wAx72/oT/dj qr/671n/AMwNVAyr72/oT/djqr/671n/AMx72/oT/djqr/671n/zA1UDKvvb+hP92Oqv/rvWf/M4 9b5O/h6tkK1Nxz7U2lhTxknzurjan86u2GxmImZyhrI6/IbJS5LYbjj1bUVcEFypZaSSakndBPEj 2q3nilbs6ORu+7XtVFa5EVOqGKbzwr8EthVyXHXrN+Zv4TKfUKrqHJ/K2JXKRebQ7g0kVUx/LNeM gX1ebL7c3838nachDViLVO2qO9dt8F429GdFqqY35Tl37FVWPyk2vfCLq5ftAeKGzLqBQYzXrRNv UDWUt2dSrs6CoTwiqGvhdG9EfyPXn9KRVPQvQjim0L4kbV5x0nzyiuVVHGklVapl7C40ievtKd+z 0RF6c7UVir4OU8GtWLFDrfr7d7Fw54pmV/tcb20dshr6qW53CSKNEa+aaVVcjGLIr1TqjGtVu677 qukdBvJq602C/wBtzbOqnzLW2+VtTTUlsvvd6iKRPDnqqdXOZ60XslRdl6PRTau7TbjOWmHwN7FV 6FuNnPMxEd8vQLyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVEioAAAAABmexav2q08XWs9hvmIYl a7dhmF2y+VmSU1sVl3qYOzWSRlTUcy9rFG1qqxvKm23ippgw7WYbU6i8ZHFLp9RVDYKjJ9KLfZop Xrs2N9TSPia5fzIr0UCR4Zrpxr6w6cO130v050voMSrop66xY5fJ6+S+XKijc5GuWeFyQQySoxVY 1WOT0m7u26nBzfissGpml3DRq3jmneMXal1E1PslmfTZJQd+lsVQ6WaKaakejmdnVQyRPSOfbwXm 5fS2TpuH3jK0v0P4c8d0p1VhvVj1PwO0+Yp8Mks9U64V1VTIscKUyMjVsrZkaxWva5W+nuqoiblU Q6UZZo1w28G+IZ3QPt9/m11sl1rqKRNnUjqqqqZmROT965sb2czfU7mT1AaZvnEPrvduK7MOGjTX FcQlZaMft97pLzd21LYqGORE7d1Qkcm9QqvfE2OKNIvF7nSbM2XsdIuJTOY9RNVNI+Ie34xQXnTG 1U2RvvWOJUMt9bapYXSOk7Gdz5I3xo1EcnO5FVV26N3dHtNf+6Uayf8AIKw//EhELphtTqLxo8TG n1HUNgnyfR+js0Url2bG+pgdEjl/MivRQJLiGu/Gpq/p07XjSvTTTOkw+tZPW2PG75U1zr7dKGNz ka/t4lSnhklRiqxiscnpN3dt1X+6o8dVXbOGTSziT0sxanuNJnOVWyzV9prY3zTxQyOqGVcECsfG neGy07o2PduxV6qxUXpmXRu08CeDaT2zEOJDEM2x3VrHKd9uvGNrdslZV11VE5zWPpIaadIZGzIj Fb2ezE5vU3ZS0uIPDcLwrhW4fbPgemN30/s1Rq3jVfHjd3qZJ6ugdPLUyPZK6SWVyOVzldyq/dOb ZUaqK1A2ZpFJrXPYKup10p8NprxNWLJRUuMOqXwU1GsbOWKaSfrJM1/aIr2o1ipy7NTqTkADL+Ta +68ZvxFZpw/6BW3Tq2TaeUFtq7vcM0krJZK59bCkzG0lNSuY5Y2NVqPkc5URzkTbqm/eVPEXqFpF oTnWqXE5ptSWC4YJM6FFsdek9Df0crGU8tIr/hYmySyNj5ZU3b4rv1RKp4mMi4Lci1YueOcV2C3P CMgsMVOuPZo+OspFutO5nNzUtdRePZOVzezlXo5V2b4lTNwPWHiG4QNf9NsPvuZZvh1Hd6Cp0uu2 UxyJc7xS00kdRUwtdM1kk0aLFyQvc1OZztum3K0LzyfXfjW0x01Zr/qJplplU4dSU8N0vOMWiqrm 3622+RWq53eJVWnmlia7me1GNT0XbO9ZM9WOJvKH5bp5pPw52OxZDmGo9nfktLXX6aaK12yytYjk q52xJ2snaKvKxjFTqi7qnTfKjJfJs3rC6SkptL9Q8gzq4QQ0tRp3S3nKH3ZKx+zZaZ8clSkbUaqu 3e9yMVGrsq7ohbGqdrtXCxxM6R67VWK3a26UW7TpdNq6aCGa4LjLIZFmpFqVYskisVFbEsm7+rFV XKqpzBb2Bar8R9syLLsB1y0xs0NdZ8efkFny3GYat+PXBE3atLJ2/pw1DXJzLGr1VzOZU2TlV0N4 WuJXXrWzTW1a/wCoFkwPGdNKe011Rd5oWVnnGqmpUk7WopmK90cVMx7HM2e573LE9yK1FahIcX4q rXr9ec1x/SbEa28aeWfFamoqM7l7alpZ7m5rkShpoZYWrNsz03So9Ebttt1aroZwbYZPqJ5Mmx6e 0U7KefKMQv8AZ4pXdGxvqZ62JHLt8iv3A5GIa78amr+nTteNK9NNM6TD61k9bY8bvlTXOvt0oY3O Rr+3iVKeGSVGKrGKxyek3d23Va14vNd8u1x4TdJ9VdJKmx27GM3yqzQXKiusE01XFcI69qwxI+N7 WLDFU0siSbt5no1itVnUrDRu08CeDaT2zEOJDEM2x3VrHKd9uvGNrdslZV11VE5zWPpIaadIZGzI jFb2ezE5vU3ZS1OJXCsVwHgV08rsA0myHBcYsOaWTKa/H6981ZW2ildVPknfNzSSvReaVHK1Xbt5 0RUau7UDc2Dx5zFitvj1KqrFU5KjHd/lsdPNBQudzu5eyZM98jU5OXfmcvXf1bId6ZX4iteM9uug tLrpw16g2Slw5klNLLd32x09ZXuddIqJaeCKpYkcUfpTK+V7XOXlajETftE1QAAAAAAAABlXiH+P Zwjf4/fqeI1UZV4h/j2cI3+P36niNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1 nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNur dk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADP0Ok/ERgevS5pgGrbc j06y65OqclxjKnPlks27VVZbVMxN2t6IxIHbMbvuvNvuzQIA+PfaPviW/vcPeli7ZIO0TtOz325+ Xx5d+m/hufYo7iC4WLJrRd7XqJi+Y3jANTsch7CyZdaHK6SGLmc5aeogVyMqadXOcqxu2Vd1Tm2V zVn+X6l4Lo7j1krNWNQbbaY7hVU9liudzeymjq657HKm+2zI1d2b3L4NaiL1REAmQPzHJHNG2WKR r2Pajmuau6ORfBUX1ofoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX 6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAA/E00VPE6eeVkcbEVznvciNanyqq+B W+TcRmj2LzLRTZhBc67flbSWljq2Vzv4PwSK1F/MqoaV3KbcZ1TknsYa9iqtGzRNU9UTKywUPV8Q Gol/3ZgOjtXTwu/Brcjqm0iJ8irA3d6p/I46Wqi13ynf2Tarw2WB34VJjlCkW38k8m8iEFWLo/di Z/zrdS3wDiJ13qqaO2c57qc/HJoi43S22imdW3a401FTt/ClqJmxsT+VzlRCub7xL6LWKVaVM0gu lVvsyC1RPrHPX5EdGis/94q+HRLBpKlLhkEdyyOtT/6Tea+Wpevy7oqo1f8AITC12Oy2SLsLNaKK gj225KaBkSf5GohDOJuzsiI8fJet8DYO37Suqrsypj/2nwh+KniRyG6bpg+imSVqL0bNd5YrbGv9 8nNzKqf5Nzq6jNuJK/b9nNhuLwO8Oyhlralv8vOvZr/kJICOa7lW2qfkuUYfCWvZ2affnV85y8EJ qMN1Dvm65brjldUjvw47YsdtY783LEi9PzHGh0L037bvdztNTdqn1z3Gumncv8qK7b/2E/BHNFM7 dfbr+a1TiLlEZW50Y/hiKflk6W24Th1n281YraKRW+DoqONrv8qJupycisVNkuP3DHKupqqemudL JRzSUkvZTNje1Wu5Hp1YvKqojk6p4oqKiKdiDaIiNiKuqq5605otp3pbp5pLYWYzpviFtx+3N2V0 VHDyulcibI+WRd3yv2/fPVzvzkpAMzObSIimMoVx5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqjq vEAAAAAAZ00A0K1dxvW/UfX/AFtvWIyX3NKS32qjtuL95dSUlHSNVEc99Q1r3SP9FVTbZFR2yqio iaLAAAAAAAAAFYap1XE3Be6Vuidi0wrbOtIi1T8putwpalKnndujG01PK1Y+Tk6q5F3V3TZEVYX5 w4//AO5Dh9/9Y719xNBgDrMZdkj8dtj8xgtsN9dSRLco7ZLJJSMqeVO0SF8jWvdGjt+VXNRVTbdE U7MAAAAAAAAADOvGlb9Wc30wuelemWi96yyW9Jb6lbnTXa10lNTPgr4Z3RPbVVMUiuVkK7K1it9N vXx2unBchyLKMfju2UYDdMOr3SvY613GrpKmZjUXo9X0kssSo7xREfunrRCQgAAAAAAAADKvEP8A Hs4Rv8fv1PEaqMq8Q/x7OEb/AB+/U8RqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3p vNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05 EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0Ob4JhupWMVuGZ9 jVvv1kuLOSpoa6FJYnp6l2Xwci9UcmyoqIqKipud8AKywXAcQ4XdG6uwYlBll5sOMQVtxpaB08t1 r+y3dK2jpWL6Tkam0cUabeCbqqq568jRDiB0p4hsW9lel2TxXGOFUjr6GVOyrrdMu+8NTA70onoq OTr6LuVVark6likZsmmen2N5he9QMfw2027I8kjhiu1ypqZsc9a2JXKztHInpLu9d3eLtm7qvK3Y JMCg8W4q4k1vqtAdXNOL3geR19ZUpiVXP/ZduyWjZzObJDURJyxzJEnM+F34HhzKvol+AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAA AAAAAAAAB/FVERVVdkTxUrTL+InS/Eql1qivEl/u6bo22WSJaydzvk9D0Gr+ZzkX8xpXcptxnVOS exhr2Kq0LNM1T1Qsw49fcbfaqWSvuldT0dNEm8k1RK2NjE+VXOVEQoKv1O13zXdmN2G14Jb3/g1V xVK2vVPlbEnwbF/vXov8p0iaQ2u8VbbpqFf7zmNc1eZrrpVOWCNf/BwtVGtT83VOpWqxcf8ALjPt 1fr4OzZ4BmNeJuRT1R+Kft8fcsK+8T+m1HUvteJpc8xuTend7HSunYi/K6Vdmcv50VSL1uo3EHl6 q20Wiw4JRP8ACSqd5xrkT1KjU2iT5dnJud3QW632qmbRWugp6OnZ+DFTxNjY3+RrUREOQQVXLte2 rLs1fq6drB4PD+zt6U76tfhqp74lAZ9JYMilbVaj5hkGXSoqO7KtrHRUrV/vYY1RG9fVvsSyy4zj 2Nw93sFkobezbZUp4GsV38qom6/znZAjimInNaqv3K6dGZ1btkd0agAGyIAAAAAAAAAAAAAVx5Lj 4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqjqvDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM q8Q/x7OEb/H79TxGqjGvGLer/jvGBwqXnF7PBdbnTezlYaOafsWTItrp2vTnXo1eRXKir03RC57F xPYTJUstWf2u6YRcnryoy6wqtNIv95UNRWKn987lToRV3qKKtGqclyxwficTam7Zp0oictWue7bl 15ZLjBx6C4UF1pI6+2V1PWUsyc0c0ErZI3p8qOaqopyCVUmJicpAAGAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3t sem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/AGS+caqZ H9vTebaBlRF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAfOSnp5pIppoI3yQOV8TnNRVjcrVaqtX1Lsqp09SqhQ2u+pXEZo/m1Bm+K6aQaiaWL SRU15tFjieuSW+o7R/NWQMVeSpj5VYixJs5OXfdqczi/QB84JHTQRzOhfEr2I5Y37czFVPBdlVN0 /Mqn0Kw4gMB1bzvFKJdFNWZcFyiy1zblSyS0rKiguKtY5vdaxitV6wu5l6t/BXZ3K5Wt277SK6an 3jT201+suL2rHswc2SO50Nrre9UqPZI5jZI3+psjWtkRiq5WI9GqqqigTEAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAARLO9VsB02p0 ly7I6akmkTeGkYqyVM3yckTd3LuvTfbbr1VCqLpq5q/qBzQYBjkeGWmTol2vcaS1r2/wo6ZN2sXw /D3RflILmIotzlM5zuh0cJwVicXGnTGVPSnVHu3+6Jld2SZXjWH2512ym+0VqpG/77VTNjRy/I3f q5fzJupUF04kblkb3UmjeCVl8Yqq1Lzc0dR29v8AfN5tpJU8Oicq9SNW7Saw+cUv+X1lblt68Vrb zKs/KvyMjX0GInTZNl226KTZrWsajGNRrWpsiImyIhVrxFyvZqjxdyxwXg8PrrzuVdeqnujXPvmO xBrhhWb57zP1Z1CrbjTSdVs1pVaKgRP4LuX05U8erlRepJrBi2OYtS9zx2y0lvi22VIIka5353O8 XL+dVU7QEOjGefOvzdqmnQjVTujVHdGoABsjAAAAAAAAAAAAAAAAAAAAAGbve6ODb5nfpDdfvI97 o4Nvmd+kN1+8mkQbcZXvlByWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZ u97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7y aRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+ 8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7 oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X 7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN 1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0 I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q 3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+ kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oUlpzwW8NGkuZW/UHT7TXzVf7V2vdKvzzcJ+z7WJ8T /Qlncxd45Hp1au2+6bKiKXNW0FDc6Z9FcqKCrp5E2fFPGkjHJ+dq9FPuDWZmralt0U2tVuMuzUgS aURY/VyXXTDKLrhtdIvO5tFKslJK7/wlO/djk6J06J+YkFu1s1WwpWwakYPHkVuZ+Fd8c6zNb/Ck pXdVXbqqtVETb1negxTnb9Scvl3JLvF4qMsTRFfXO34o19+cdSa4Nqxp7qPFzYjk9JWTtTeSkcqx VMXy80T9npt1Tfbbp0VSXGc8n0zw7LJkrrha0guLFR0dxo3rBVRuTwckjdlVU/vt0PxbMj1003VE pblDqFZY/wD6NcXpBc42/I2f8GRfHq/dV8EQsUYuY1XI98eX/wBcm/wHRc14Sv8A7atXdVsn36LR 4K1wfiA08zSsbY5qyfH79ujX2i8x92qOb5GK70ZPXtyqq7JvshZRborpuRnTObhYjDXsLXoXqZpn rAAboAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AEUyK16ZVed4jc8pgx9+YUHf/Yq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOjeXZrxN6Dau2 eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAADoc8wmwak4ZesByqKpls9/o5aCtZT1UlPI6GRNnIkkao5u 6fIvVOi7oqod8AKc4dtH9T9FaW9YdlmslZn2JQPgTFFu1Mnna3U6I/tIKmpRdqhE+DRjuVFRGr4J s1LLxrMMUzOlqa7Ecltl6p6Krmt9TLQVTJ2w1MTlZLC9WKvK9rkVFavVDuClrHwoaa4brh7eendV d8Rrq+OVl/stnqUhtF8e5qoyapptlb2jFVXI5nLu7dV3VXKoXSCuqriD0kt+sbdBbrlsVvzSahhr 6ShrIpIGVsciuRG08r0SOaROXdWNcq9em6o5G2KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGQ PJP33zvwS4hb+69l5kuF3oefn5u25q6ao59tk5f9scu3X8HffrsmvzFXkhvibW3/AJQXT/WNNqgA RfO9TMI02t6XDL77BR9onwFOnp1FQvqSOJu7ndem+2yetUKbu2o2sOqO8OMUj9P8ck/+mVTEkutS zp1Yz8GDdN/FVcnRUVSC5iKLerbO6HSwfBWIxkacRo0dKdUe7nn3RK2dQNX8B00ia3Jr2xK2VE7C 3Uze2rJ1XwRsTevX5V2T85U91z3WrUveKzwN08sMn++yok92mZ+Zv4MG/wD6SfKp/cU04xbEJH11 BSSVVzn3WoudbIs9XM5fFXSO6pv60bsi/IScp13blzbOUbo83fw+BwmD10U6dW+rZ7qdnfn7kUxb TLE8VqHXOnpJa+7SrzTXS4SLUVcrvW5Xu8FX+92JWAaREUxlC1XcquTpVznIADLQAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdNk+G4xmVH3 HJbLTV0aIqNdI3Z8f52PTZzV/kVDpLVFq7pfsuB5N7J7NH/9R36XeRjf4MFT4t/MjvRRE9ZNAa5Z TpRqlJxmdHF1xFVO6dcfp2xlLscI4hsJymvbjt+ZU4nkXRFtl4Tslev/AIKVfQkRfVtsq/IWkUPk eK47l1AttyS0U9fTrvypK30mKvra5PSav50VFI9ak1b0o2dgl7XKrDH1Ww3qb4aJvX0aep8U+RGu 6InyqWKMVVTquRnG+PLy7nKxHAtm9+LC1aM9GqdXuq5v+74mmQVzp7rvhGfVXmN8k9iyKP0ZbNdW 9jUI7/we/oyp8nKu+3VUQsYu0V03IzpnN57EYa7ha+LvUzTPX/niAA2QgAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp/sl84 1UyP7em820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXn XeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAILqzodpTrnZ6Sx6qYXQ36moKllZRvl5o5qWZjkcjopo1bIzfZEVGuRHJ0XdOh0nEDr7ScPNj tOYX/AcnvuNT1qwXu6WWmbUJYqfkVUqp4kXndHzcqKrUXZOZVXfla+1T8vYyRjo5Go5rkVHNVN0V PkUDpcJzbE9R8UtmcYLf6S9WG8QpUUVdSP5o5mbqi7etFRyK1WqiK1yKioioqHeENzG35Th2mFyo NCcTxrz5bqNyWG0Vf9hW1ZN9+RyQonI3ZXKiJyortkVzUVXJF+HjXW561WS7Q5VpfkuA5ZjFSy33 6z3emd2UdQ5vMi01SiIypiVvVHN2XZWqqbOa5wW0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFOZvxD 0FNcZsS0rtSZfkMa8szoX7UFCu+yrPMnRVT+C1d12VN0XoaXLlNqM6pWcLg72Nr0LNOe/dHXM7I9 7PvkpcisWLcEVHe8ju1LbaGnv90WSeplRjE9NvTdfFV9SJ1X1FxXrXDOdR+e36N2lbTaH7sdk92g VOdP4VLTu6u/M56bepURTIPk1NPLHkfDvbMhyV9RdG0l4r20VBUSK6kplR6Kr0i8HPcq9VXf1dOh t1rWsajGNRrWpsiImyIhTvXblVU0xqjx/R6Dg/A4W1bpvVRp1TGev1Y93PPbq6pRLGtNLHYrg/Ib lPVX7IJl5prvc39tOq/3m/SNE9SN67dN1JcAQREU7HSruVXJzqnMABloAAAAAAAAAAAfxj2SNR8b 2uavgqLuhnrUDUDP9d8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj6e64fl vk9rlTKtzvWXcP10lZHPW1arU3HD616ojpZVaidpRyvVXKqInI5y9N9u1lizVNOkoV8I2aL3FT37 mngca23K33m3012tNdBW0VZEyenqIJEkjmjcm7XtcnRzVRUVFQ5JEvgAAAAAAAAAAAAAAAAMccBX AVwna08J2Damal6U+eckvPnPvtb59uVP2vZXKqhj+DhqGRt2jiY30Wpvtuu6qqroD3rjgT+Yz6TX j72WuS9bh+mf4PH9Fjgrj3rjgT+Yz6TXj72PeuOBP5jPpNePvY5L1npn+Dx/RY4K49644E/mM+k1 4+9j3rjgT+Yz6TXj72OS9Z6Z/g8f0WOCuPeuOBP5jPpNePvY9644E/mM+k14+9jkvWemf4PH9Fjg rj3rjgT+Yz6TXj72PeuOBP5jPpNePvY5L1npn+Dx/RY4K49644E/mM+k14+9j3rjgT+Yz6TXj72O S9Z6Z/g8f0WOCuPeuOBP5jPpNePvY9644E/mM+k14+9jkvWemf4PH9Fjgrj3rjgT+Yz6TXj72Peu OBP5jPpNePvY5L1npn+Dx/RY4K49644E/mM+k14+9j3rjgT+Yz6TXj72OS9Z6Z/g8f0WOCuPeuOB P5jPpNePvY9644E/mM+k14+9jkvWemf4PH9Fjgrj3rjgT+Yz6TXj72PeuOBP5jPpNePvY5L1npn+ Dx/RY4K49644E/mM+k14+9j3rjgT+Yz6TXj72OS9Z6Z/g8f0WOCuPeuOBP5jPpNePvY9644E/mM+ k14+9jkvWemf4PH9Fjgrj3rjgT+Yz6TXj72PeuOBP5jPpNePvY5L1npn+Dx/RY4K49644E/mM+k1 4+9j3rjgT+Yz6TXj72OS9Z6Z/g8f0WOCuPeuOBP5jPpNePvY9644E/mM+k14+9jkvWemf4PH9Fjg yVqHwuaE8NfGTw2e0pg3sc9kfsx85/7J1lZ2/d7Uzsf9syycvL28v4O2/N132TbWpDct8XOTpYPF cromvLLXkAAjWgAAAAAAAHRZXg+MZrStpshtcc7o+sM7fQmhd6lZInpN69fHb5UU62zZbq9pGiRT PqNQcWiT9zkciXekYifvXeE6J8i+kvq5UJeDGUxOlTOUt5qi5RxV6mKqd0/SdsT2Jvp/qjhOptvd XYleY55IelTRyJ2dVTO32VJIl9JvXpv4L6lUlUckcrEkie17V8HNXdFPPnU2a9cQWsaaNcNMslpy KzSN9mmodBI+KPHqZd0dTMfGqJPVvRFRGb7t2VN02escooIcw8nBdKamr7pfcy4c7tMyOeuqlWqu WF1siojppOVN5aOV6q53KnoOcuycy7S9GzVXVTnXDyXCFrD2r2jhpmY6+ad2fP25Q3ADgWG/2PKb LRZHjV3pLpa7jC2opKykmbLDPG5N0cx7VVHIv5jnkqjMZapAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dP B2LEaqP9Nq826t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6Tnqju ZF6eGylygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAFAaRVnFjhuqVbpvrDQ2rOsNrWVNxtGe25I6CalRHIqUVZRbru700ax8ar6Ld1Vy83Jf4KA1J0X 1xo9YqTWjQrV+SlW5TUVFkuIZK6SpslVQxq1j5qVrPTpqhrOZ3o9JHeKt6o4L/Bxp7lbqWspbfU1 9NDVVvOlNBJK1sk/InM/kaq7u5U6rt4J1U5IAAAAAAAAAAAAAAAAAAAAD+KqIiqq7InioH9IrqBq bhumVrS6ZZdWwLKvJTUsSdpU1T/U2KNOrl39fgm/VUK8zbX+quNynwzRaggvt2icsVZd5VXzbbl+ VXp+6vT+C3p/LsqEZxrTunt10flmU3SfJMpqGp210rtnKz+9hZ4RNTwRE/6uhTu4r921rnfzfq7+ D4FmYi7jM6Y5qf3p+2Oude6Od8b1ctTtat25FJU4ZiEn4NoppNq+uZv/APSJNvg2qnixP5F9Skms WP2TGLdHabBbIKGki/Biibsir61VfFy/nXdVOwBVyznSq1y7mlFNEWrcRTTHNH155nrnWyT5L34q dB/x3cf/AI2mtjJPkvfip0H/AB3cf/jaa2JLvryp4P8AZ6OyAAGiyAAAAAAAAAAAZ51A1Az/AF3z +s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc6NqBqBn+u+f1nDXw13LulVSbMzf N2N56fG6d26OggcnSSteiORGovodeqKjnR6u0V0VwDQHAKDTrTm090t1JvJNNIvPUV1Q7btKiok8 ZJXqm6qvh0RERqIiWrNnP8VTi8IcIaOdq1Ovnk0V0VwDQHAKDTrTm090t1JvJNNIvPUV1Q7btKio k8ZJXqm6qvh0RERqIiTC62q2X22VdlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FRTlgtuC wPk+MZHwB5GtbRNuF74db3WdU9OoqsFqpX+C+Ln0LnO8eqsVf4X7roy23K33m3012tNdBW0VZEye nqIJEkjmjcm7XtcnRzVRUVFQuG62q2X22VdlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FR TCWT4xkfAHka1tE24Xvh1vdZ1T06iqwWqlf4L4ufQuc7x6qxV/hfuta9Z0vxU7XX4P4Q4vK1dnVz Tu/RpUHGttyt95t9NdrTXQVtFWRMnp6iCRJI5o3Ju17XJ0c1UVFRUOSU3oQAAAAAAAAAAAABXHku PiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqOq8OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA x5xb/HJ4Uf8AHr9VQFwFP8W/xyeFH/Hr9VQFwFLE+vHY9HwR7Ce36QAAruqAAAAAAAAGedQNQM/1 2z+s4a+Gu490qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc6NqBqBn+u+f1nDXw13LulVSbM zfN2N56fG6d26OggcnSSteiORGovodeqKjnR6u0V0VwDQHAKDTrTq090t1JvJNNIvPUV1Q7btKio k8ZJXqm6qvh0RERqIiWrNnP8VTi8IcIaOdq1Ovnk0V0VwDQHAKDTrTq090t1JvJNNIvPUV1Q7btK iok8ZJXqm6qvh0RERqIiTC62q2X22VdlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FRTlgt uC86M7xDVXycmYPzTSq41dz0Gvlajqy2VXPUsxieR34MidXd1cq7Nlb6TF2a5VXZZNiaR8Q2F6qR U9CkiWi+ywMqEt1RK1zaiNybtkppU9GeNU6o5vVU67bdSyLrarZfbZV2W9W+nr7fXwvpqqlqYkki nieitcx7Xbo5qoqoqL0VFPPPVXR9eDm8NkrqG43vh7ulaj6eqgc+S5aeVkj90VkibvdQueqbePKq puiu27WCumuidO33f5sl08New+Ipixi4y3VxtjqnpR4xzTlqei4M2YdrblOntFROz2u9mGFVkbZq HLbenbTRQvRFjWoazftGKip8I3dV8fSVdk0NZ7zachtlPebHcaeuoatiSQ1EEiPY9v5lT/8A5Da1 epu7Nu5FjeDr2CmJr10zsqjZPlPVOtzQASqIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mjl513i5e05EX0dubo Sso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACqOIDhr084irNb6 fK3XK1X2wTOqseyOz1TqW5WepXb4SCVvqXlbu1yK1dkXo5GuTtJMms/D9o5Q3jWzVFa+nxyjpaS7 ZRcqZIXVUznsiSV8cKLy80j2psm+yLu5y7K4sM4l2tNqv1sqrLfLZSXG31sToKmkq4WzQzxuTZzH scitc1U6KioqKB+bNerPkdppL9j91pLnba+Js9LWUkzZoZ4nJu17HtVWuaqeCouxzSuNG9BtNeHq 0XuzaX2uvt1pu9xkuzra6umqKelkc1EdHSxPcqRMVUV3K3xVy9dkajep0L4otLdfJLlZsbqLhZcq scjorvit/pu5XigVq7c0lO5VVWdU9NqqnpIi7KuwFugAAAAAAAAAAAAABW2qWtlnwCZmN2ehlyDL qxnNR2elXdyb+Ek7vCKP17r1VPDpuqaV10240qp1J8PhruLuRasxnM/5nO6OtLMyzbF9P7FPkeW3 eGgooE/CevpSO9TGNTq9y+pETcoO+37P9dVfFXJW4hgkmysoWryXG6M+WZyfuUap+8TxTx36Kn8t mE3nIb7HnmrFzjvd/a3+xqVrdqG2J48sMa9Fd4bvXrum/j6Szc59y7Ve1bKd2/t8nqsJgbPB/wCK Mq7m/mj+WOef4p90RtcGy2O0Y7borTY7dBRUcKbMihbsifKq/Kq+tV6qc4A0iMtixMzVOc7QAGWG SfJe/FToP+O7j/8AG01sZJ8l78VOg/47uP8A8bTWxvd9eVbB/s9HZAADRZAAAP4qonVVRPV1P6cC /WO2ZNY7hjl6pkqLfdKaWjqolVU54pGq1ybp1Toq9U6oBzweV0fGTxEcGOrV60W1MqH6g49Yqvsq V11lVtc+hciOgmiqtlVeaNzVVsiSIi7tRW7Kbi0I4yNCuIKKGjxLKW2+/SN9OxXXlp61HetI0VVb Mn543O2TxRCSq1VTGfMqWcbauzoZ5VbpXeZ51A1Az/XfP6zhr4a7l3SqpNmZvm7G89PjdO7dHQQO TpJWvRHIjUX0OvVFRzo2oGoGf675/WcNfDXcu6VVJszN83Y3np8bp3bo6CBydJK16I5Eai+h16oq OdHq7RXRXANAcAoNOtObT3S3Um8k00i89RXVDtu0qKiTxkleqbqq+HRERGoiJLZs5/iqUOEOENHO 1anXzyaK6K4BoDgFBp1pzae6W6k3kmmkXnqK6odt2lRUSeMkr1TdVXw6IiI1ERJ2DAOi2l2UcRms nEFLlfEhrfYqfEtQqy02mhxzOKmipKem3c5GNiVHtRG+CI1ERE6bFxwW/gYxuOQazcF+rWA2TMdW b3qZpBqReosWjq8m7OS84/dZkXuyuqmNb3iKTlXfnROVGOVERU9P+69Z1lWecYtm4Y7vrbedJcLf h6ZDFV2SrioLjkVwdUrElNDWSNXs0axrl5GekvI/x9FWBs04l1tVsvtsq7LerfT19vr4X01VS1MS SRTxPRWuY9rt0c1UVUVF6Kimbbbw368aUai4pkmkHEZl2U4y6vSHLsf1HvklzZLQOT0paKfsXSRz t8WtVUa5dt3I1HNXToGB8nxjI+API1raJtwvfDre6zqnp1FVgtVK/wAF8XPoXOd49VYq/wAL910Z bblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKioXDdbVbL7bKuy3q309fb6+F9NVUtTEkk U8T0VrmPa7dHNVFVFReiophLJ8YyPgDyNa2ibcL3w63us6p6dRVYLVSv8F8XPoXOd49VYq/wv3Wt es6X4qdrr8H8IcXlauzq5p3fo0qDjW25W+82+mu1proK2irImT09RBIkkc0bk3a9rk6OaqKioqHJ Kb0IAAAAAH8VUTqqonq6n9OBfrHbMmsdwxy9UyVFvulNLR1USqqc8UjVa5N06p0VeqdUA54PK6Pj J4iODHVq9aLamVD9QcesVX2VK66yq2ufQuRHQTRVWyqvNG5qq2RJERd2ordlNxaEcZGhXEFFDR4l lLbffpG+nYrry09ajvWkaKqtmT88bnbJ4ohJVaqpjPmVLONtXZ0M8qt0pR5Lj4iemX6a/XFaaqMq +S4+Inpl+mv1xWmqjovJAAAAp3jBs+Z3rhm1DZp3kt5sOS0FmluttrrRWy0tW2WkVKjs2SRKjk7R sTo1TfZUeqL4maOKnWjU3V3RzR+m0NzW8Y5f8sxW5alV1TZKySnnSnttoWZKR6xqiqyWrniiVi9F VnXwA3yDJGdat37WTU/hcxjT3JrpaLfmET9R7/5rrpadX2umo2SQ006xuRZIJZ50jdG7dqqz0kXY zjgfFHpPr03JdRdeeNnNNNK6svFXT41i+LXie2QWm2Ru5YJJkihclTM/q5yyK5NvUiLsgehOumsm McP2lV+1fzKgulbZseZA+qgtkUclS9JZ44W8jZHsYvpStVd3p0RfFeizS31sVxoKa4QNe2OqhZMx HoiORrmoqb7evqeZmba933XTyYet0eT5VT5TcsIyGPGW5FDCkKXukiudC+mrVYiIjVkjkRFTZF9H dU3VS+NQcjzvV7iNwnhRxjUXIMHxu36etzjJbjjlQlLc61FmZSwUkVSrVdC1HK17lYm7kcqb9EVA 2GDMUNm1h4Tcd1Uzi86qV+omm1ixWovtipsorX1d9pLlTxOe+nfUpG1JaaTZNlc5XtXlRE/Cc6Ba c6F6y6q8PNq10vnFNqnRak5Xj7MooG229JTWOiknh7xS0/m5rOxfEjXRtejkVV9LZU6AbaB505Rx Gaw6zaD8Juf4nm1bimS59nUVgvNTb5HRwSva+ekmkkgRUjlZzRLM2J6OZvyoqKnQlmq+LaraP8T+ j2mWnHEJqJJZ9ZYb1br62/3hbq+jbQxQ1ElTQ9u1W00743va1Wt5GrsqM9QG6gZDwj2X6K8cdBot R6n5plOG5ngdRflospvMl0loLhT1XJzwTS7vYx0aKix77buVfU1EztgfFHpPr03JdRdeeNnNNNK6 svFXT41i+LXie2QWm2Ru5YJJkihclTM/q5yyK5NvUiLsgeooMx8AOvd9100mv0eT5VT5TcsIyiux luRQwpCl7pIkY+mrVYiIjVkjkTdNkX0d1TdVNOAAYp4ys/vuL68YladU9SdQ9OtC6jHJZp8hwzto HyZB3lWtp6yqp43ywQ9hyuaibIrl8VRHK2R6b5vRaVaS6payYTxMza1af2GxTXi0Ud0r2XG5W6sg p5JJKeauaqPcyRUYiMlYj2Jt18VUNZg8rsZ1402y/SOPUbNvKK5pYtZLnQPuzLfQ3KaCyWytc1Xw 0Lrc2BYHxs9CN/NuqrzLzFvXPiw1N1i4eeHWjw2++xTLddr35iu18ooWrJb4KOR8VxmpWORWske6 Pdm+/Kjl267OQN5gzzhnD7rFpNqlj17wfX/LMtwaoiqIMrsufXmS51Cry/2PUUE3ZbxvR+/OxVax W9E9XLUPCTYNTNZ9QtVskzfW/UBMf071jvdHY7RR3yVkVQsNRHItPVq7mdLSMYkDGUyK2NqOm6ek mwbkOmzPMcb09xK8Z1mNzbbrHYKKa43CrdG+RIaeJque7kYivcqIi7NaiuVeiIqqiHm7jXFDpXrj kWcZdr3xm5lpg2nyCrteK4tit4ntbKK2wKjY6modDE7vE0i7qvaKrU2XpsqNbwMx1bu/EH5P3Wui yDVG65JWaT5BJQUGR2uqfQsyW2rJG2llrYmcqStdHM/mjcmyujjcu7kVVD1AtlyorzbaS722btqS ugjqaeTlVvPG9qOa7ZURU3RUXZURTlFO6O0GH6CaAW275RqJeHWSC2092rbrlt+kq1pEfTxbxtmn duyJFREZGnRFdsibqTfS/VHBNZ8Ht+pGmt988Y7dXTtpK3u01P2iwzPhk+DmYyRNpI3t6tTfbdN0 VFAlYAAAADHnFv8AHJ4Uf8ev1VAXAU/xb/HJ4Uf8ev1VAXAUsT68dj0fBHsJ7fpAACu6ofxVROqq ierqf04F+sdsyax3DHL1TJUW+6U0tHVRKqpzxSNVrk3TqnRV6p1QDng8ro+MniI4MdWr1otqZUP1 Bx6xVfZUrrrKra59C5EdBNFVbKq80bmqrZEkRF3ait2U3FoRxkaFcQUUNHiWUtt9+kb6diuvLT1q O9aRoqq2ZPzxudsniiElVqqmM+ZUs421dnQzyq3Su8zzqBqBn+u+f1nDXw13LulVSbMzfN2N56fG 6d26OggcnSSteiORGovodeqKjnRtQNQM/wBd8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9Ec iNRfQ69UVHOj1dororgGgOAUGnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjUREms2c/x VKHCHCGjnatTr55NFdFcA0BwCg0605tPdLdSbyTTSLz1FdUO27SoqJPGSV6puqr4dEREaiIk7McY Vrh7BeLnisuGqWo1fSYJg9txWrpqe4XCWSitqS25HS93gVVax8sip6MbeaR7kTZXKhKNBKbWbXzP I+JXUe65LheEthdFg2BwV8tJ3ikf4XK7RxuRJpZE2WOF/MxjVRdlX0nW3BafBhChwPKNfuOLiBwm +a/awYvYsMgxmW027FMxqbbTRLVW2N03wSczERXM5vRRPSc5V3VTs9TqrWbgOrbBqa/WrKdTdHqy 701oym25jNHWXSzx1D+VldT1rWNc9rXKiLG5NurU6q7njDbhxLrarZfbZV2W9W+nr7fXwvpqqlqY kkinieitcx7Xbo5qoqoqL0VFMY8Q1nyrVDjxwbRqHWbUnDMZr9Paq71EOH5NPa1lqYquZGvcjN2O VU2RVVqrsiJv0LQxXgzpsVye0ZO3ih4iLstoroK5KC66gTVNFV9lIj+xqIljRJIncvK9ir6TVVPW BR+V4pkHARkD6inirr9w5X6qVr2OR1TUYPUTO8F8XSUD3O/OrFXZfS/dbStNqveFObnugl4o57bc 2R1c1jdKj7bcYnIjkkgci7RPVu2zmryr09XRdOXW1Wy+2yrst6t9PX2+vhfTVVLUxJJFPE9Fa5j2 u3RzVRVRUXoqKYSyfGMj4A8jWtom3C98Ot7rOqenUVWC1Ur/AAXxc+hc53j1Vir/AAv3WrfsaX46 drtcG8JzZjiL2uid+uPf9J2xzNeaY6x4vqbFPSUiTWu+0Ho19mrvQqqd3rVE/fs+RyfKm+yrsTwz VfsRx3UKltuW4/ee53JjGVdpyC1yor0a5N2OR7V2kjVF8N9lRV2VNyS4Frtc7Rc4MG1rhgtt0mf2 VvvkTeWgufybr4Qy+G7V2RV8OXdEXW1icvw3e/8AzYnxvA8TE3sFrjnp547OlHjHPntXgAC488AA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprVDW2/wCC8RmiOjVutNvq LZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzw o2s7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAABH3afYM7N2alLiNo9lcdC62NvSUjErO6uc1ywrLtzKzdqKiKvTrtt uu8gAFA5TxR3LTDXKHTHVvS272PFMkrKW34fmlG5a6huFXK1qd1qWRt5qWVZeZrEXdHIm68qIri/ j8yRxytRssbXojkciOTdN0XdF/lRURf5imOIjIOJfC5LJnGhWL2HM7NaUmXJMTqFdT3K4xO5eWSi qN1Y2SNGu2Y5q83MvR68qIF0g6fDsgqMrxOz5PVY7dLDNdqGCtfa7pE2OsolkYjuxnY1zkbI3fZz d+ioqL1O4AAAAAAAOLdLpbbJbqi7Xeugo6KkjWWeonejGRsTxVVXoiGdMozvKNeJ3WnFZ62waftV WVNxRFiq70idFZEi9Y4V6oq+K+v1tSG9eptRr1zudDAcHXcdVMxqojbVOyPOd0fTW7/Pdbrzk9yr MC0TWKeqgd2NyyR6I6jt/wArYvVNL8m27U/P1VvXYdglnw2KaandNW3OuXtK+51b1kqauReque9e u2/gnh/KvU7Wx2K0Y1bIbNYrfFR0dOmzIo02T86r61VfWq9VOec+qaq50q9vyept0WsNb4nDxlTz zz1dv0jZHbrAAZYAAAAAGAeEbgt4aNT9M7rkGc6a+c7hTZTd7dFN55uEPLTwVCsiZyxTtavK3puq br61Uu33ujg2+Z36Q3X7yOAj+01fP+W9/wD60ppElrrqiqdalh8NZqtUzNEbN0M3e90cG3zO/SG6 /eR73RwbfM79Ibr95NIg04yvfKbktjoR3Qzd73RwbfM79Ibr95HvdHBt8zv0huv3k0iBxle+Tktj oR3Qzd73RwbfM79Ibr95P47ydXBmxqvfo+jWtTdVXIbqiIny/wC2TSRwb7ZLdkllrsevEL5aC5U8 lJVRsldGskT2q17eZio5u7VVN0VF69FQcZXvk5LY6Ed0PD/I9HZdedc8jsPCZpXWvxOjre50CwTz TUzIo/Q7zNVVL3IxJVR0iI56ei5ERN067R4f/JV4rjMlJkuu+Ruv9yiVsrbNapZIKKJ6dU7SdOWW VUX+D2aIqfvkN04ziuM4XZafHMQsFvstrpG8sFHQ07IIY0/M1qIm6+tfFfWdoSVX6pjKFSzwbaoq 07mufDuZgw253HyeeV1bUoZ7nw+Zbc+9Vk8cSy1uH3CXlassjkRXz0b9moqu3c3ZPX0l3varrbL7 bKS9WW4U9fb6+FlTS1VNKkkU8T0RzXsc3dHNVFRUVOiopT1yttvvNvqbTdqGCtoq2J8FRTzxpJHN G5NnMc1ejmqiqiopnPGMnyPgCyNKKtdcL3w63us6L6dRVYLVSv8AH1ufQuc7w6qxV/hfus1m9pfh q2qHCHB/F53bUaueN36N8GQOBX+23xT/APnVrP8Aqca0tV1tl9tlJerLcKevt9fCyppaqmlSSKeJ 6I5r2ObujmqioqKnRUUoPKvJ+8JOa5Ves2yPS6pqLzkVbLcbnURZNd6dKiokcrnvWOKqaxu6qvRr URPUhZchWXGrkto1o1c0Y4WcDrYbtkdPnVBmGRtpHpL5mtdA1/aOqFb0ie9JV5WqqKqtROnO3e0N TZ+FDiI1RuPDFq/jFtvWVY/RQ3OnpLtSuppHwztRVdQVKK2R2ycvP2Tk2VNl3Vq8tgaP8PWi2gVv qbbpDp3asbZWq3vU0DXyVFRy/gpJPK50siJuuyOcqJuu3ip8tYOHDQ/XyKkZq5pxashloEVtJVS8 8NVA1V3VrKiFzJWt368qORN+u24GP9bdMqfgUveneU8OOrGXUjsgy+32GTTe53p9yoLrSTvVsnd4 JVWSN7eidpuu3M3ZWrtzehJTGl/Bvwz6N5GzMNPtJ7dRX2JFbDcqypqbjVQbpsvZS1ckjo1VFVN2 qi7KqeCqXOAMbcSuuWSa1ZLd+Erh2nppZ3xOo9QMukhSeisFHIitkpIkX0ZayRvM3l/edU6ORzo+ RxCcQma6pZrX8MHDBdu7XSm+CzfN4k56fGqd26OpqdydH1zkRUREX4Pr1RyOdHLNJdJcK0VwqjwX Bbb3aipt5JppF56isqHfhzzv8XyOXqqr+ZERERESC7d0NUbXRwOBnEzp1+r81L23yb3B9RW+mo6v S6e4TwRMjkq579cWyTuRNlkckc7WI5V6qjWtTr0RE6HJ97o4Nvmd+kN1+8mkQU+Mr3vQclsdCO6G bve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8 mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvJ/HeTq4M2NV79H0a1qbqq5DdURE+X/bJpI4N9sluySy12 PXiF8tBcqeSkqo2SujWSJ7Va9vMxUc3dqqm6Ki9eioOMr3yclsdCO6Hh/kejsuvOueR2HhM0rrX4 nR1vc6BYJ5pqZkUfod5mqql7kYkqo6REc9PRciIm6ddpcP3kq8VxiWkybXbI3X+5RObMyz2qV8FF E9OqdpOnLLKqL/B7NEVP3yG6MZxXGcLstPjmIWC32W10jeWCjoadkEMafma1ETdfWvivrO0JKr9U xlCpZ4NtUVadzXPh3K48lx8RPTL9NfritNVGVfJcfET0y/TX64rTVRfeZAAB+JoYqiJ8E8bZI5Gq x7HJu1zVTZUVPWioYt4K+GHVbSvUzK5tWLBFBjWI2WowfApnVsFT5xs092q62SZ7GPc6JeV1Kzlk RruVrU29FTaoAxbwO8NOr2lGo+S33V+yspaLEbImBYHU9+gqHVtkS51dWs6tje5Yt0fStRr0a/Zn VE22ORpJhnE5wgUWQ6Taf6G0eqeDS3qsu+LXCkyqktM9vp6l/OtHVx1KJvyPVypJHzb7qu3Xlbso AZP4g9MuJjWXgczXT/LLPjt11NyN0EtNaLDM2npaeFtxgmbTdvUyNZI+OJjuaRVYjlTZEVdld9dU 9HdZsN1swnig0UxW35XeLbiPsKyjFam6R2+Wuoe0SaOSnqXosSSMm6rzqiKjGoi+KpqsAZpx3DOJ HXpdRafiDoKXT/AsrxefF7VhFJWUlzqoJJ2ubNcp6yJn7pyu5WRskVmy9URWo50HwyPjj0y0RpeH S2aEWO+XOx2lcas+dR5dSwWtKVrFipqqWkenekdHHybxtYvMrPFN9jZwAxZc+EHNcB0/4WdM8CoW 5BTaVZxSXrJK5tRDTtjiV0stVUNbK9rnt7aZ/KxvM/ZU6KWbrhpTn2YcVnDnqTjlh73jmBy5U7IK 3vUMfckrKCKKm+De9JJOd7HJ8G12227tk6mhgBnrJ9Ks9uPHNhesVHYe0xC04FcLLWXHvUKdlWS1 KvZF2Sv7V27evMjFanrVCutJMM4nOECiyHSbT/Q2j1TwaW9Vl3xa4UmVUlpnt9PUv51o6uOpRN+R 6uVJI+bfdV268rdlACD6NprC7B4KnXR+OtyqqqJ6iWlsLJO60UDnqsVP2j1VZXsbsjpERqKvgi7c zpwQDVjSi4aoxWyOh1ez/BfNzpnOdiddTUzqvn5Nkm7enm5kbyejy8u3O7ffdNq79yXkH44nEF/9 /rZ//DwO11byHigw7P4LtpvplZNS8DrrZ3aqsbLrBarpRVyPXeZJqlexnhcxUbyKrVRd18PGndMO FnMc41A1gz7UXTKz6R47qfhq4c7ErPcIK2WV70cklzqHU7Up0mRHKjORVX0nbrv1dq3T7D6nA8To 8Xq80yPK5aR0qrdshqIp6+fnkc9EkfFHGxUbzcrdmJ6LU33XqsjAx3pnWccWimlNr0KoOHywZdX4 tQNsdkzKPL6WltctLGnZ001RSSIlSixxoxHMa1ebkXZyb7kq4hNCdaNR8C0vzay3fG63WDSu70mR MajJKS1XWZGI2rpGq5XPiZIiIjXKv73ryc27dNADOOJX3jK1N1TxmvyjT6i0bwKwNnnvtC+90F8r cilczaKCN0Ubkp4WO9JX7te5OnT1ffg40pz7SqHWZme2HzWuV6tZBk9n/sqGfvNsqUg7Cf4J7uTm 5Heg/lem3VqdDQ4Ax1prhHErwjXLM8F040UpNVMCv2Q1mR49UUuT0lpq7V3pUdJR1LKrZHsa5PRf Grl23VU9LlbK9TdL+IvXHg9z/T7UpmKU2fZVDUSW222mR6UtFCkzJaejkqHrtLKiR8rpkRjN3J02 RXLpoAUvpBjeQaj6WYzbuInQyixy74fWUrqC11t0prvG6elpWxx17XQqsbV5pJkax27mqxHePKqR DycvxRcU/wCNci/XdcXFqnjeqWTWakpNKNTrfhFxiqkkqKytx1t4ZNByOTskidPDyLzK13PzL+Dt t13SruF7hx1c4drXQ4ZddfLbleG29K6SG1Mw1tvn7xU1L6h0i1Xe5VVEklk9Hk8FRN02A0MAAAAA wxx+6c4bq1xL8MWn2oNm862C6+zXvdJ3iWDtOyt9LKz04nNem0kbF6OTfbZd0VUOF73RwbfM79Ib r95Jjxb/AByeFH/Hr9VQFwFPEVVU1apd/gqzbuWZmumJnPnjqhm73ujg2+Z36Q3X7yPe6ODb5nfp DdfvJpEEHGV75dLktjoR3Qzd73RwbfM79Ibr95P47ydXBmxqvfo+jWtTdVXIbqiIny/7ZNJHBvtk t2SWWux68QvloLlTyUlVGyV0ayRParXt5mKjm7tVU3RUXr0VBxle+TktjoR3Q8P8j0dl151zyOw8 Jmlda/E6Ot7nQLBPNNTMij9DvM1VUvcjElVHSIjnp6LkRE3TrtHh/wDJV4rjMlJkuu+Ruv8Acolb K2zWqWSCiienVO0nTlllVF/g9miKn75DdOM4rjOF2WnxzELBb7La6RvLBR0NOyCGNPzNaiJuvrXx X1naElV+qYyhUs8G2qKtO5rnw7mYMNudx8nnldW1KGe58PmW3PvVZPHEstbh9wl5WrLI5EV89G/Z qKrt3N2T19Jd72q62y+2ykvVluFPX2+vhZU0tVTSpJFPE9Ec17HN3RzVRUVFToqKU9crbb7zb6m0 3ahgraKtifBUU88aSRzRuTZzHNXo5qoqoqKZzxjJ8j4AsjSirXXC98Ot7rOi+nUVWC1Ur/H1ufQu c7w6qxV/hfus1m9pfhq2qHCHB/F53bUaueN36IvWcL2B8UXHdxPY1qJdb7FbbbQYzJTUtvrnQRd9 ls7GQ1cjU/dHwbOWNHejvI7mRyLsX7wr64ZrbMquPCZxGVjU1PxGn7W1XZ+7YsusybpFXQqv4UqN TaVu6u3a53VWyIy6cJ050qocwyDXDBrfTy3rUamoJbpeaavlniuUFPCjKV7Gq90TWpFtssbW8ydV 3XqfzUHQ/S7VLIcXy3NsY75e8MrFrrFcaetqKOpopV235ZaeRjnMXlTeNyqx23VqllyGfOHr/uhf FZ/5Jhv6rQ63ykuV2zP8AtHCJhtdBc9QNUL7baSK2U7klmoKKGoZUS1k7U6xxt7JvV226c6pujXK lsai8DPC7qvnd21MzzTeor8lvnYecK6HIrpSdv2MLIY944KlkabRxsb0anhuu6qqrJtHeF7QLQGa qrNJNMrXYa2tZ2dRXc8tVWSMVd1YtRO98vKqoiq3m2VURdugGXOIbS/2zfKJ6dYVT6hZnhbW6YVU rbpil0bQ3BqR1c3waTOY9OR375OXrsnUvHCuECowzLLVlbuK3iEv6WqqZVLbL1mMVTQVfKu/ZzxJ TNV8a+tvMm/ylqVukmntx1St2tNZj/aZnabVJZKO597nTsqJ73PdF2SP7J27nOXmViu6+JMABjbi V1yyTWrJbvwlcO09NLO+J1HqBl0kKT0Vgo5EVslJEi+jLWSN5m8v7zqnRyOdHyOITiEzXVLNa/hg 4YLt3a6U3wWb5vEnPT41Tu3R1NTuTo+uciKiIi/B9eqORzo5ZpLpLhWiuFUeC4Lbe7UVNvJNNIvP UVlQ78Oed/i+Ry9VVfzIiIiIiQXb2hqja6OBwM4mdOv1fmpe2+Te4PqK301HV6XT3CeCJkclXPfr i2SdyJssjkjnaxHKvVUa1revRETochfJz8Gypt7T235/ZDdfvJpIFPjK970HJbHQjuhjRvAlwraY Xqeuz7ROXKcNqnovnCC+XSOstO//AHyOKoa2WL5XInMn+RFvez+TR8n9kNrpr1Y9HIK6grI0lgqI MpvDmSNX1oqVf835l6FpvYyRjo5GNcxyK1zXJuioviioQSmt+WaN3aTJtLqd9fYp39pdcWV+zH/L LSf97k/vU6L4bL0RNrd+q1P4tceMeaPF8GWcbTnZiKLndTV9Inr2Tz5bXE9644E/mM+k14+9j3rj gT+Yz6TXj72aEwDUTFdS7E2/4rcO3iR3ZzwSJyT0svrjlZ4tcn+RfFFVOpJjoU1RVGdOx5W5ars1 zbuRlMbYllX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoGWjKvvXHAn8xn0mvH3se9ccCfzGfSa8fez VQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvX HAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfS a8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvX HAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3s/i+S74HmJz UWjdRRTJ+DNBlF3R7f5N6pU/9hqsAZJqPJ9UGGSLd+HfiF1R02uzGK1sfnl11tsqp1b21LU79oiL 4bv2TdehzNDOJDVnGdUKbhk4u8fpLZm1fDPUYtltuRrbRlkMLk52xp07KqRqo5Y9k3TfdsarGkmq jPXHfpH7a3Dhks9op1bleGwrlWM1sPo1NJX0XwyLC9OqOexj2fJu5PkRUDQoIDoFqZFrLorhOqMb eV+SWSlrqhiN2SOocxEmYifI2RHp/MT4AAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029 lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvN tAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAIRrLgmUakafXDFcL1KvGB3uV8NRRXy1sY+WCWKRsjWvY9PT icrUR7EVvM1Vaq7KqL1ugkuvfsLlt/ETRY0mTW2tko4rhYJ3Op7rSta3kq1ic1Owe9Vduzw3buiM RUalknFudLRVttq6K5LtSVEEkVQvaLH8G5qo700VFb0VeqKip47oBXPExq1VaI6BZnq5aoKaqqse ti1dJHOqrFLK57WRtdt12Vz2p0+Ukekup2MazabY7qjhtT29oyOhZWQKq+lGq9JIn/I+N6PY5PU5 inj7xf6taZaP4PmvCzoRr3cs8wPImUjYMfkYlbTYvUQVsFS6OC6OdvLCqRcqQsR6NVV5no5Hc828 jpxQrjmVXHhky64o225E+S6Yy+V+yQ17W7z0yKvqljaj2puiI6JyIiukA9eTpcwzHHMDx+qyfKbn HQ2+kbu57+qud6mMb4ucvqROqnX6jakYzpfjz8gySpciOd2VLSxJzT1ky/gxRN/fOX/IniuyFG09 lybUu+0+farRtZ3Z3aWfHmu5qe3NXwfIn++TL03VfD+ZEbWvX4t/hp11fLtdfg7gucV/rXvw245+ eeqn6zsjt1T87lJlOvNZBe82pZ7Ph0EiTW3HVdtJWbfgz1ap4/Kkfgn+VXTuKKKCJkMMbY442o1j Gps1rU6IiIngh+gUspzznXL0k1RoxbojRpjZEc3nO+dsgAMtAAAAAAAAGbuAj+01fP8Alvf/AOtK aRM3cBH9pq+f8t7/AP1pTSJtc9aUGG9jT2AANU4AAAAAAAAca5W233m31Npu1DBW0VbE+Cop540k jmjcmzmOavRzVRVRUU5IAzVjGT5HwBZGlFWuuF74db3WdF9OoqsFqpX+Prc+hc53h1Vir/C/dd22 q62y+2ykvVluFPX2+vhZU0tVTSpJFPE9Ec17HN3RzVRUVFToqKU9crbb7zb6m03ahgraKtifBUU8 8aSRzRuTZzHNXo5qoqoqKZzxjJ8j4AsjSirXXC98Ot7rOi+nUVWC1Ur/AB9bn0LnO8OqsVf4X7rc s3tL8NW157hDg/i87tqNXPG79G+AcS1XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY5u6OaqKio qdFRTlllyAx9xCcQma6pZrX8MHDBdu7XSm+CzfN4k56fGqd26OpqdydH1zkRUREX4Pr1RyOdG4hO ITNdUs1r+GDhgu3drpTfBZvm8Sc9PjVO7dHU1O5Oj65yIqIiL8H16o5HOjlmkukuFaK4VR4Lgtt7 tRU28k00i89RWVDvw553+L5HL1VV/MiIiIiJBdu6GqNro4HAziZ06/V+ZpLpLhWiuFUeC4Lbe7UV NvJNNIvPUVlQ78Oed/i+Ry9VVfzIiIiIiTIAozOeuXpqaYpjRp2AADIAAAAAAAAAAK48lx8RPTL9 NfritNVGVfJcfET0y/TX64rTVR1XhwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGPOLf45 PCj/AI9fqqAuAp/i3+OTwo/49fqqAuApYn147Ho+CPYT2/SAAFd1QAAAAAONcrbb7zb6m03ahgra KtifBUU88aSRzRuTZzHNXo5qoqoqKckAZqxjJ8j4AsjSirXXC98Ot7rOi+nUVWC1Ur/H1ufQuc7w 6qxV/hfuu7bVdbZfbZSXqy3Cnr7fXwsqaWqppUkinieiOa9jm7o5qoqKip0VFKeuVtt95t9TabtQ wVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFM54xk+R8AWRpRVrrhe+HW91nRfTqKrBaqV/j63PoXOd4 dVYq/wAL91uWb2l+Gra89whwfxed21Grnjd+jfAOJarrbL7bKS9WW4U9fb6+FlTS1VNKkkU8T0Rz Xsc3dHNVFRUVOiopyyy5AY+4hOITNdUs1r+GDhgu3drpTfBZvm8Sc9PjVO7dHU1O5Oj65yIqIiL8 H16o5HOjcQnEJmuqWa1/DBwwXbu10pvgs3zeJOenxqndujqancnR9c5EVERF+D69UcjnRyzSXSXC tFcKo8FwW292oqbeSaaReeorKh34c87/ABfI5eqqv5kRERERILt3Q1RtdHA4GcTOnX6vzNJdJcK0 VwqjwXBbb3aipt5JppF56isqHfhzzv8AF8jl6qq/mREREREmQBRmc9cvTU0xTGjTsAAGQAAQq9Yj fbFkS6i6XVsdtyJG7VdLJ/tS7Rp17OZvgjvkf0VF9aeKW3pTq7ZNT6CeFlPJar/bF7O6WepXaelf 4bp/DjVfB6fKm+y9CMkSy3B5rpcabL8UubrHlltT+w7jEnSRv/epm/75GvgqKi7b+tN0XNuuqzOd OznjyaYnDWuEKNC9qqjZV9J3x4xzatTSAKw0k1mhziafEcqoG2TM7Y3estznehUMT/f6dy/hxr47 dVb+dNlWzzo0XKblOlS8jicNdwlybV6Mpj/M43xO8ABugAAAAAAAAAAAAAAAAAAAAAAAADh3i2xX i0V1on/cq6mlpn/+K9qtX/2KcwAZf8mVXy3Lgc0wqJvwmU9yp0/8WK51caf+xiGoDKvkuPiJ6Zfp r9cVpqoAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mjl513i5e0 5EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AARXUvS/CNYMTqsG1EtEt0sVaqd5o21tRTNmRP3r3QPY5zf71V28OnQlQAxZlHkiODTIOfzTYcpx rm328136WTl6L4d7Sb5UXrv4J+fehdUfJY6XaFvt2f6f8Q+X2TIaGuiqMep57XT3Crnro3o+JI0i dB4Kjd3bbJ+fdGr6M6papWTS+yMrq6OSuudc/sLXa4Os9bOvg1qepqKqczttkT5VVEWnsaxe+XK+ yajakVMddk9W3lhib1p7VAvhBAngipv1d4qu/Vd1V1W/f0PwUbfk7XBnBkYiOUYjVb5t9U7o6t8+ 6NbiYpi+WZHdoNSdYaqnrsnWFraajp2q2jtTdurYWKrtnKvVXKqr+dfFZ6AU4jJ6Guuaso2RGqIj ZEboAAZaAAAAAAAAAAAzdwEf2mr5/wAt7/8A1pTSJm7gI/tNXz/lvf8A+tKaRNrnrSgw3saewABq nAAAAAAAAAAAONcrbb7zb6m03ahgraKtifBUU88aSRzRuTZzHNXo5qoqoqKckAZqxjJ8j4AsjSir XXC98Ot7rOi+nUVWC1Ur/H1ufQuc7w6qxV/hfusv1y4lcl1qySXh24SsjgfPLBHJl2oFG9JqOwUU qbpFSyNXllrJGqvLyr6Hyo5HOjt25W233m31Npu1DBW0VbE+Cop540kjmjcmzmOavRzVRVRUUjum mlmA6PYxHh2nGNU1ltLJZJ1hh3cr5Hru573uVXPd4Ju5V2REROiIhYjETFOXO5NfBVFV7TicqeeH w0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/xfI5eqqv5kRERERJkAV5nPXLq00xTGjTsAAGQA AAAAAAAAAAABXHkuPiJ6Zfpr9cVpqowX73RwbfM79Ibr95HvdHBt8zv0huv3ku8po63nPRF/fHj5 N6AwX73RwbfM79Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+90cG3zO/SG6/eR73RwbfM79I br95HKaOs9EX98ePk3oDBfvdHBt8zv0huv3ke90cG3zO/SG6/eRymjrPRF/fHj5N6AwX73RwbfM7 9Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+90cG3zO/SG6/eR73RwbfM79Ibr95HKaOs9EX9 8ePk3oDBfvdHBt8zv0huv3ke90cG3zO/SG6/eRymjrPRF/fHj5N6AwX73RwbfM79Ibr95HvdHBt8 zv0huv3kcpo6z0Rf3x4+TegMF+90cG3zO/SG6/eR73RwbfM79Ibr95HKaOs9EX98ePk3oDBfvdHB t8zv0huv3ke90cG3zO/SG6/eRymjrPRF/fHj5N6AwX73RwbfM79Ibr95HvdHBt8zv0huv3kcpo6z 0Rf3x4+TegMF+90cG3zO/SG6/eR73RwbfM79Ibr95HKaOs9EX98ePk3oDBfvdHBt8zv0huv3ke90 cG3zO/SG6/eRymjrPRF/fHj5N6AwX73RwbfM79Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+ 90cG3zO/SG6/eR73RwbfM79Ibr95HKaOs9EX98ePk3oDBfvdHBt8zv0huv3ke90cG3zO/SG6/eRy mjrPRF/fHj5Jjxb/AByeFH/Hr9VQFwFJac8FvDRpLmVv1B0+0181X+1dr3Sr883Cfs+1ifE/0JZ3 MXeOR6dWrtvumyoil2le9XFyrOHWwGGrwtuaK9ueer3AAIl0AAAAAAAAONcrbb7zb6m03ahgraKt ifBUU88aSRzRuTZzHNXo5qoqoqKckAZqxjJ8j4AsjSirXXC98Ot7rOi+nUVWC1Ur/H1ufQuc7w6q xV/hfusv1y4lcl1qySXh24SsjgfPLBHJl2oFG9JqOwUUqbpFSyNXllrJGqvLyr6Hyo5HOjt25W23 3m31Npu1DBW0VbE+Cop540kjmjcmzmOavRzVRVRUUjummlmA6PYxHh2nGNU1ltLJZJ1hh3cr5Hru 573uVXPd4Ju5V2REROiIhYjETFOXO5NfBVFV7TicqeeHw0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyo d+HPO/xfI5eqqv5kRERERJkAV5nPXLq00xTGjTsAAGQAAAAAAAEXzfBqfLI6avoq2W1X+1v7a2XW n6S00ieCdPwmL62qTPSHWOpyWrfgGoNNFas0oI+Z0bV2gucSf/SKdfX4buZ4p1XwRUbxCO5phVBm NHDzVEtBc6CRJ7dcqdeWejmTqjmqnXbdE3T1/wAuyopqqtVaVHvjf+rF6zaxtvib/Nsnnp843x74 1tCgqPSLV+vu9wdpvqQyKhzCij5opW+jBd4E/wB/h9XNsnpM9XVUToqNtw6Vu5Tdp0qXkcVhbuDu zauxr8JjfG+JAAbqwAAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaa qAAAAAAAAAAAAAAAAAAACmtUNbb/AILxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHc yL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABD9T9 TbFpdj3ne6NfVVtS/u9tt0HWeuqF/BjYnybqm7ttkT5VVEX7ak6j49pfjMuR5BK53pJDSUkXWasn X8GKNvrcv/sTdV8Cj8ZsORZLkL9UdTOV9+qWKygoEXeGz0y+ETE/hqi+k7x3VflXerfv6H4KPW+T s8F8GRif9e/qtx31Tuj6zzdr64vjV8uV7m1I1GmZV5PXM5Yom9YLXTr4U8Kepdl9J3iqqvVd1V0y AKcRk9FXXNc7ojVEc0RugABloAAAAAAAAAAAAcG0XyzX+nkq7HdqS4QwzyUsr6aZsiRzRuVskTuV V5Xtcitc1erVRUVEUDPnAR/aavn/AC3v/wDWlNImbuAj+01fP+W9/wD60poCx5HYMmppqzHbzRXO np6h9LJNSTNljbMzo9nM1VRXNXoqIvRUVF6oqG1z1pQYaf8ARp7HYgA1TgAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAI7muF0OZW+KJ88tFcaKRKi3XGBeWejnTq17VTrtuibp6/5URUlmjmrldf6u XTvUJkVFmdtj5t2+jFdYE8KiD1Kuyek1PDqqJtujeKRjOcJhy6kp56Stktl7tknebXc4OktLMnVF 3Txauybt9f8ALsKaqrVWnT743sXrNvGWuIvat09GfKeePfGtooFWaM6vz5ktRhea08dtzWzMTvlM nSOsi8EqYPlYvTdE/BVfkVC0zpW7lN2nSpeQxWFuYO7Nm7GUx49cb4nmAAbq4AAAAAAAAAAAAAAA AAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9Bt XbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl 841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0mZZjj+BY5WZVk9c2loKJnM9y9XPd+9YxP3znL 0RPlOwut0t1jttTeLvWxUlFRxOnqJ5XcrI2NTdXKv8hmp9wrNd8phzm+Us0GH2iVVxy2TJt3qROi 1szfXv8AvGr4J/OroL97ioyjbP8AmbqcGcH8trmu5qt07Z+kdc+Ea30stNfdScmbqvn1G6nc1Fbj 1nkXdttp18JHJ65npsqr6vzdEbOQChEZbdr09dUVZRTGURqiOaI/zvnWAAy0AAAAAAAAAAAAAA80 OPuz6n8MGtNDxFaJ5Ncceos3VIbs2kdvTOucLfCaFyLFI2WNOdGuau745XeKnpeVpxHaM23XzRzI tNK7smVFfTLLbah6dKauj9KCTfxROdER23VWOenrN7dWjVr2K2LszetTFO2NcdrxvxDVbiC1Y82c PWH5XV0dvyu+TPdbbevd46iprJuaV872em6JN1VWuVWNazfbdFU9stLdO7DpLp5j+m+Mx8tux+hj o4nK1EdK5OskrkTpzvernu/vnKYH8ltw3XG1ZFkutecWaSlrLJUVGN2inqGbPiqmry1sv5lanwKK m6elMnqPSEkv1RM6MKvBlmqmjja9s/IABA6YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIp nOGz37ul/wAdrfNmUWV/b2u4M6K13rik/hRu6oqLv4/yotmaP6s0mpdqnpbhSea8ns7kp7za3r6U Mn/fGb/hRO8Wr1+TdfFY8QzMsbvNJdqTUnAHNp8qs7ejN9o7lTfv6aVPWip+CvqXbw6KmaK5s1aU bOeP852uIw1GPtcTcnKqPVnd1T/DPhOvfnpYET0y1JsOqOMRZFZFfDI1ywVtFL0moqhv4cUifKi+ C7dU2X8xLDp01RXGlTseNu2q7Fc27kZVRqmAAGUYAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmq jKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2 s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1 bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAABROt2eXLKb0uieBXJ1PUzRpJktzh69wpHJ+4tX/AL7Ii7bepq/nVWx3bsWqdKVvBYOv HXYtUaueZ5ojnmf81zqR/Ocom16yiTGLU9yafY/VJ3+oaqol6rGLukTVTxhYvVVTxXr/AAVSYxRR wRshhjbHHG1GsY1NkaidERETwQ4djslsxy0Utjs9M2no6ONIoo09SJ61X1qq7qq+tVVTnHN1zM1V bZevyot0RZsxlRTs+sz1zz92yAAGWoAAAAAAAAAAAAAAAAZ51A1Az/XfP6zhr4a7l3SqpNmZvm7G 89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo2oGoGf675/WcNfDXcu6VVJszN83Y3np8bp3bo6CBydJK1 6I5Eai+h16oqOdHq7RXRXANAcAoNOtObT3S3Um8k00i89RXVDtu0qKiTxkleqbqq+HRERGoiJas2 c/xVOLwhwho52rU6+eWObnhuV+T0uNMiXG85bw+3SZjJ6yq/si4YfWyKiOllVqJ2lJLIquVUROVz l6br8LpW23K33m3012tNdBW0VZEyenqIJEkjmjcm7XtcnRzVRUVFQuG62q2X22VdlvVvp6+318L6 aqpamJJIp4norXMe126OaqKqKi9FRTCWT4xkfAHka1tE24Xvh1vdZ1T06iqwWqlf4L4ufQuc7x6q xV/hfuu16zpfipQcH8IcXlauzq5p3fo0qDjW25W+82+mu1proK2irImT09RBIkkc0bk3a9rk6Oaq KioqHJKb0IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgl889aW5S7VrCqF1TBI1I8ltM XTvtMn+/sTw7ZnVd/Wm/99vovGsks2X2GhybH61lVb7jCk0ErfW1fUqepUXdFReqKiovgVeQfHb8 /QDL+1mmemnmSVO1THsqtsta/wAJU/gwvXo5PV/MiO3s3eJqyn1Z8P8AOdXx+C9I286I/wBWmNX8 URzdsc2+NW5psH5jkZKxssT2vY9Ec1zV3RUXwVFP0dJ48AAAAAAAAAAAAAAAAAAGVfJcfET0y/TX 64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR /b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1nc0cvOu8 XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+Lvt08QMa53x Ccd95zDOY9GOHLG7PiGEMlkjuGdJWQ1F/ZHz7vomxPjb6SRuVqO3RGqxXOarkadjpv5QKx5lwW5H xYXHCZoarEZJbddLJTVG7H3BroWxtjlVu6RP71A5XK1VYjndHcu7sC6Q0WCZxlmq+PcYOmec6hcQ NdXvpsYscqXBWrO5JGojVie2OGFsqtVXyL2bYWtVnRFRbX8n5nls0/4WdbNC8q0evOdZZj97rrve sHSic2Srtz4aKklajnsViyNfFI7s0+EVGbsRV2AujCeKzj8ynA7HrjZ9BdMs0wm9vhkbZMXutS++ wwSLt6bnSPiR7enMnIqt/fNbsu0+4sOM/MdHcr030o0vwe0TZrqVE2op5curFo6C1scqNayo5HIq ycyuRUR6cqt2TmVyIeeWfN4TYLFTZNwVXHWjDNbZpqTuuHW1lbKkErpG9tC+RWdovIiv5VbK7mVE RWbOXl2Lxa3zTx+A6P2Pjj4fcgv0NXj9NJfM5sjnIuPXh1O3vUSpTpzbOla1Vbv2bkXdrXrHsBdO iWrnF/JqommXEXoZYYbdWUC1tJmWGVE0lojeiOVIZknc56OdyORF3RUVWeirXo5Ol4MOLDUXiL1Q 1wwrNrLjlFQ6aXyG2WmS1U08Us8T6iujVZ1kmkRzuWlj6sRibq7p1REyfwbNhtHGJj1m4LM11LyT RB9vnkyz2RQSstlLIsc3KxiuZG3nR6Qci8iSbq5N3M5z78N2sNu4KeLviBwnWjE8pikz6+LcMfdb LRLWPuKR1dXJAkLGJu/tmVjVaqdEc1WuVqgaX4ceMHU3WHVbiKwTI7Hi9LQ6R11ZS2OWipahktQ2 KprImrVK+dyPXlpo1XkSPqrvDdESjMA8oxxj6o8PeR6uYJoZhFymwapqajJrg/vENBDQsiZIjKen dU9rLM1naySOSTlazs9mqrjrPJ51d7rtaOMGuyizPs95rZairrrdI9rn0k8lTcHyRKreiqxzuXdO nQ/vk72t97H19XlTrPle/Tx/2ApQJXePKOcS2W6Aw8Q+jPD/AI+7FscjjgzGtvdXJIja3tEbLHRR RyxyPhY18LllXm27bl5fg3qWzqb5RHG8G4S8H4iLXh0lxvuoiNpLNjy1GzW1yc7ahHyo3dYonxuT dG8z1VibN5lVue+H9rfebM/XlTrS31V6eK94QrDUXRHNtTvJjcP+cYZjNXkTcFrbzPdLZSMe+Z9F UXCdHyo1npq1roWI7l6tbIrvBqqga4Xi/wCJ/Q3UbT+wcXmmmAUGMakVjbZRXTEq2ofJaKtysRsd W2Z72v2WRvMrFRu3M5rncqtXbx5O6c2LycuqeoOF4noJwdZtlN4uVRHJd5nXq80cOM8rmqslTJJU uY7kXmVeVdl5ERquc5Gr6xAAAAAAAA6PNsysWAYxX5bkdUkFFb4le7+FI7wbG1PW5y7IifKpiZim M5bUUVXaooojOZ1RCJa2apT4BZ6az41HFWZdkD1pbPRu68rv31Q9PVHGnVd+irsnhuqQHBMOhw2z LTS1Lq251sjqu518nWSrqXru96qvXbddkT5Pzqp1mE2y+ZFea3VjO4Gtv17Y1tJS+KWyhTrHA3fw cqLu5fHdevVXbzc5ddc3qtOdnN/nW9pYw1OAs8np11TrqnfO6OqPGc53AADYAAAAAAAAAAAAAAAA M86gagZ/rvn9Zw18Ndy7pVUmzM3zdjeenxundujoIHJ0krXojkRqL6HXqio50bUDUDP9d8/rOGvh ruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj1dororgGgOAUGnWnNp7pbqTeSaaReeo rqh23aVFRJ4ySvVN1VfDoiIjUREtWbOf4qnF4Q4Q0c7VqdfPJororgGgOAUGnWnNp7pbqTeSaaRe eorqh23aVFRJ4ySvVN1VfDoiIjUREnYBbcEOJdbVbL7bKuy3q309fb6+F9NVUtTEkkU8T0VrmPa7 dHNVFVFReiopywBgfJ8YyPgDyNa2ibcL3w63us6p6dRVYLVSv8F8XPoXOd49VYq/wv3XRltuVvvN vprtaa6CtoqyJk9PUQSJJHNG5N2va5OjmqioqKhcN1tVsvtsq7LerfT19vr4X01VS1MSSRTxPRWu Y9rt0c1UVUVF6KimEsnxjI+API1raJtwvfDre6zqnp1FVgtVK/wXxc+hc53j1Vir/C/da16zpfip 2uvwfwhxeVq7Ormnd+jSoONbblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKiockpvQgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnnUDUDP8AXbP6zhr4a7j3SqpNmZvm7G89PjdO7dHQ QOTpJWvRHIjUX0OvVFRzo9qKJrnKEN+/Rh6NOt2GU8RuaXXUS46YcN+iVXq5eMci58kmp79T2mht Ujl2ZAtTO1Y5Jl9LeNFRU2XxVHI3hXTMeNy9W6otN08nwyppKuNYpon6qWdUc1fH97/7fUar0V0V wDQHAKDTrTq090t1JvJNNIvPUV1Q7btKiok8ZJXqm6qvh0RERqIiTsuRh6Msph56rhTEzXpUVZdz Eul2qPlBNPMXjxS5cCrr9S0Ujm2+WXVKzwywU37yF7tndpy+CO2b02TbZEJh7ofjs/J1fW7Z/szV QJaaYoiKY2KV67XfuTdubZ1zqiPlqZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoGyNlX3Q/HZ+Tq +t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6vrds/wBmPdD8dn5Or63bP9maqAGVfdD8dn5Or63b P9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mWrwua6e6U0JxnWv2Lexz2R99/2M793zsO71k9N +7dnHzc3Yc34Cbc23XbdbVMq+S4+Inpl+mv1xWgaqAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/T X64rTVQAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8A TavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspc oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARyu1J07tmY0mndyz7HKTK6+ ndV0linusEdwqIGte5ZY6ZXJI9iNilVXI1U2jev71dvliWqemGfV1bbME1HxfI6y3f7cp7ReKesl puu3wjYnuVnXp1RAJQCOZnqRp5pxSQ1+oee47i9NUOVsU15ukFFHIqeKNdM5qKvVPA5uMZbiubWm O/Ybk1pv1slVWsrbZWx1UD1TxRJI1Vqr1T1gdsCBa+Z7eNLNEc81Kx+mo6i54vjtwu9HFWMc+CSa CB8jGyNY5rlaqtTdEc1dvBUMNaP8WnlQNddPKbVLTPQvR672Gqknihcsk9NNK+F6se1GS3FqovM1 UTfooHpEDHfDR5Qm16raZam5DqthU2I5Ro/SzVeTWumc6RskUbZVVYWv2c16PgkjWNyryu5PSXm6 V9gHFx5Q7iBxGXVvQnh004ZhU01Qy2w3q5yyV9Y2F6sejHJUQtVUc1zd3ManMi7b7AegoMj6b8aG fZ/wo6l6yXjSKrwzNtPLTX1T7beKOp831c0NM+WKSNXdm98auYrXsR3M1U25urXLydAONyhyDg5i 4peISpsePtjqa6CaK0wyMjnfFO+OGGnillke+Z/KiI3n8d19FqKqBq8GXuDbXTiT4kIrnqpnuC4x humVc+T2K0fdal15r4ub0J5JnT9kkSNTbmSFO0VVVqNaiK7UIAAAAAAMzZDfV101A7zFIsmC4fVK 2kYrfQulxbujpl9To4/BvqXx/fKiS7iAzi5VUtJo1hdWsd7yGJX3Kqjd1ttt32kevyPf1a3+fw3a p8LDY7bjVmo7DaIOxo6GJIomb7rsnrVfWqruqr61VShibmnVxcbI2+T1PBGE5Lb5XX69Xq9Uc9Xb OyOrOdzngAhXwAAAAAAAAAAAAAAAAzzqBqBn+u+f1nDXw13LulVSbMzfN2N56fG6d26OggcnSSte iORGovodeqKjnR6FexsjHRvTdrkVFT8ymYsPuty8ntltaq0U904fcvui1dZPHEstbh9xmVrVlkci K+ejfs1FVd3M2T1ptLLZimavxKHCNd6izna9/VDY2iuiuAaA4BQadac2nulupN5JppF56iuqHbdp UVEnjJK9U3VV8OiIiNRESdnEtV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqKnRUU5 Z0HlmAdFtLso4jNZOIKXK+JDW+xU+JahVlptNDjmcVNFSU9Nu5yMbEqPaiN8ERqIiJ02Jhccg1m4 L9WsBsmY6s3vUzSDUi9RYtHV5N2cl5x+6zIvdldVMa3vEUnKu/OicqMcqIip6fP4Ff7bfFP/AOdW s/6nHVcauS2jWjVzRjhZwOthu2R0+dUGYZG2kekvma10DX9o6oVvSJ70lXlaqoqq1E6c7dw++vWd ZVnnGLZuGO7623nSXC34emQxVdkq4qC45FcHVKxJTQ1kjV7NGsa5eRnpLyP8fRVkwtvDfrxpRqLi mSaQcRmXZTjLq9Icux/Ue+SXNktA5PSlop+xdJHO3xa1VRrl23cjUc1e51Nn4UOIjVG48MWr+MW2 9ZVj9FDc6eku1K6mkfDO1FV1BUorZHbJy8/ZOTZU2XdWry561t0yp+BS96d5Tw46sZdSOyDL7fYZ NN7nen3KgutJO9Wyd3glVZI3t6J2m67czdlau3MHoScS62q2X22VdlvVvp6+318L6aqpamJJIp4n orXMe126OaqKqKi9FRTlgDA+T4xkfAHka1tE24Xvh1vdZ1T06iqwWqlf4L4ufQuc7x6qxV/hfuuj LbcrfebfTXa010FbRVkTJ6eogkSSOaNybte1ydHNVFRUVCouJXXLJNaslu/CVw7T00s74nUeoGXS QpPRWCjkRWyUkSL6MtZI3mby/vOqdHI50c70s00xjR7AbNpxh0U7LTZYOxhWeVZJHqqq573OX985 znOXbZE32RETZCliIpidW16Lgqu9VRMV+rGyf85krABXdYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAzzqBqBn+u+f1nDZw13HulVSbMzfN2N56fG6d26OggcnSSteiORGovodeqKjnR7UUTXOUIb9+jD 0adZqBqBn+u2f1nDXw13HulVSbMzfN2N56fG6d26OggcnSSteiORGovodeqKjnR6u0V0VwDQHAKD TrTq090t1JvJNNIvPUV1Q7btKiok8ZJXqm6qvh0RERqIiNFdFcA0BwCg0606tPdLdSbyTTSLz1Fd UO27SoqJPGSV6puqr4dEREaiIk7OhRRFuMoeVxOJrxNelV7o3AAN1cAAAAAAAAAAAAADKvkuPiJ6 Zfpr9cVpqoyr5Lj4iemX6a/XFaBqoAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAA AAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6 s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5g8YmDW/UvyqmkGCXiqq4LZesQhprilLO6F9RRq+ 6rPTq9io5rZYkfE7ZUXlkdsqeJxMv0lwfhm8qpo1adFbQmNWjKbM2Wvt1NK9YHOl77BKiI5V2Y5s MTuXwR7eZOpr3P8AhA9nPGJg3Fl7YfcvYXaUtfmDzT2ne9krPhO89s3s/wDbnh2Tv3Px9Lo1U4Qf bM4r9OuJ/wBsPzb7AaFlF5j809t33lkqH83eO2b2f+2Ntuzd+B49egZI0KwXFeLPyiGvVbxBWiLK KfAp6u02Gy3Jzn0sFPDWupo3pFvsqJHHzbdWq+dz1RXKinY8PNmoeHryqecaE6TpLQ4JfrIlZV2W OZz6ejm7lDVNciOVdlbI57W/Iyfl8NjQer3AcmUaz1PEJoZrVfdIs7ulOtNd6u3UMddS3BuzUVz6 d72JzO5GK7dytVzGu5UeiuWRcMfBbjPD3lWRapX/ADm86g6j5W1Y7pk13Ykb1iVzXOjiiRXdmjlY zfd7l2YxE5UTYCWcY3xT9Yf+RF5/qkh568DGpflAMd4bLRY+Hvh0xHKcTbWV60V7ud5p4ZFmdO5Z eaF9ZE7Zj1VPwU3RPFT061j099trSfMNL/O/mr2WWSts3fu79v3bvELo+07Pmbz8vNvy8zd9tt08 SG8JnDz7l3RS16Pey/2TebaqrqfOPm/uXadvM6Tl7LtJNtubbfnXfbfp4AZ64UODuo0a0/1ezvi8 yWwpdtX2zR5Oi1zIaOhpJ3S9qj6heVjZJZKl26tXlaqRo1yruQjDOCzik0csXnrgX4yrZd8JrnyV 1ttV3ZFU0UrVVd0jla2enkc5U2WRjIkVfHbbc37qHgGKap4RetO84tTLjYr/AEj6OtpnKredjvW1 ydWuaqI5rk6o5qKnVDFtm8mdqlp7Sz4xovx16jYdiEkj3xWZtI6ZYUeu7uSSOphaxy77q5kbVVeo EVwvi81E4heFXie001nxm32rO9NcWu1FcZrcnLBU7wVUT0VvM5GyMkgcjla7kdzIrUTZTFWJ6IcQ 2QcJmL8Qr/NmV6Z6a32aqpsLmWR7ZadtS59bVzxM25o1kRI3+kr0i5l9FrVVfU7TXgB080n0E1G0 exPKbnPe9T7XU0F8yq5xJUVEkksMkbH9k1zE5I1mkcjObdVe7d67oqT7hU4cafho0MoNE6vKI8sg pJ62WWsktqUjJ2VErnqx0KySpsiO5V3cu/yJ4Ad1w5a4YBxC6R2PUjTl0cNtqYUp5renKj7ZUxtR JKR7W7I1WdNtkRFarXJ6LkLNMr8PfA9U8MmtmUZ3pbq1JS6fZW90lVglRZlkjgdsqxrDV94TlWN6 uRqrEvwblY7mVEemqAAAAEZ1Gzy06bYfcMuvG746Rm0MDV9Oond0jiZ8qudsn5k3XwRSTGacivPt z6ouqmOSXDsGqHQ0aKm7K+6J0fNv4ObH0Rv5+qdHKQYi7xVOrbOz/Op0+C8FGMvZ3PUp11eXbOzv nmf3TrHrvTR12Z5g7tcoyaVKy4vVP3Bu3wdO35Gsbsm3y/LshMgDnxGjGT1FyublWlP/AMjmiOqA AGzQAAAAAAAAAAAAAAAAONcrbb7zb6m03ahgraKtifBUU88aSRzRuTZzHNXo5qoqoqKckAZqxjJ8 j4AsjSirXXC98Ot7rOi+nUVWC1Ur/H1ufQuc7w6qxV/hfuu7bVdbZfbZSXqy3Cnr7fXwsqaWqppU kinieiOa9jm7o5qoqKip0VFKeuVtt95t9TabtQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFM54xk+ R8AWRpRVrrhe+HW91nRfTqKrBaqV/j63PoXOd4dVYq/wv3W5ZvaX4atrz3CHB/F53bUaueN36Lxy ryfvCTmuVXrNsj0uqai85FWy3G51EWTXenSoqJHK571jiqmsbuqr0a1ET1IWHo/w9aLaBW+ptukO ndqxtlare9TQNfJUVHL+Ckk8rnSyIm67I5yom67eKk5tV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6 I5r2ObujmqioqKnRUU5ZZchW2sHDhofr5FSM1c04tWQy0CK2kqpeeGqgaq7q1lRC5krW79eVHIm/ Xbc6HS/g34Z9G8jZmGn2k9uor7EithuVZU1NxqoN02XspauSR0aqiqm7VRdlVPBVLnAAx9xCcQma 6pZrX8MHDBdu7XSm+CzfN4k56fGqd26OpqdydH1zkRUREX4Pr1RyOdG4hOITNdUs1r+GDhgu3drp TfBZvm8Sc9PjVO7dHU1O5Oj65yIqIiL8H16o5HOjlmkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw5 53+L5HL1VV/MiIiIiJBdu6GqNro4HAziZ06/V+ZpLpLhWiuFUeC4Lbe7UVNvJNNIvPUVlQ78Oed/ i+Ry9VVfzIiIiIiTIAozOeuXpqaYpjRp2AADIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ51A1Az/Xf P6zhr4a7l3SqpNmZvm7G89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo9qKJrnKEN+/Rh6NOs1A1Az/Xf P6zhr4a7l3SqpNmZvm7G89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo9XaK6K4BoDgFBp1pzae6W6k3k mmkXnqK6odt2lRUSeMkr1TdVXw6IiI1ERIbHw3WHTThmyHRDQye4Y1Wz2WsZQXajrHwXCS6viXkr JamNWvWV0qMVzkVOicqbNRESHcM3Ef554E7VrpmVfNWXDEsYrUvr6uVzqiartjZI5Flc70lll7Fr 136qsqetToUURbjKHlcTia8TXpVe6NzTwMTeTY1C1YrqLM9MtcMuu+QZJBBY82oKq61cs83m+8UE cyQMWRyq1kMjHMVqbI1z1RETc7XQzWKpvGsfEvr/AKgai3Gi0vwi6xYnaqepuEzrXRrQRIlfPHBu rFkfJ2So5jVe7tVam/MiG6u2IDNFFx76Xo20XjKdONUsQxG/Tw09uzDIMZWlssyzLtC50ySOfEyT dFa+SNjVRd90TqfDNsvyyl8oVpvhdJlF2hx2v0/utbVWmOtlbRT1DJ1Rkr4EdyOeidEcqKqJ4KBp 4Gdsr44dNrBkeRWLGtPtS87psPqH0eRXnE8bWuttqqI03lilmWRnM+NOr0jR/L6/BSV5PxXaIYxo 9ZdcpMrfcsZyZ8NPYUttLJUVd1qpVVrKWnp0TndOrmvarFRFarHI7l2XYLeBQ+G8YeDZDntm01zD T3UTTe+5MknmGPM7G2hiur2JzOigljlkZ2iIqLyPVruqJtuqIv6yHjAwKyar5Zojb8KzjIczxKGg qZLZZbZDUPr4aqDtu0gVZmojImqxsj5liaj5I2tVyvaihewM443x0aa5rbq1mE6ealX/ACi0VdTR XnD6Kws882l8CtR61THythiRVciN+FVXqj0YjlY9GzfBeJ7SDO9F63Xqnv01nxW0pUpdn3endT1F slp3cs0E8XVUlauycjeZXK5vLzcybha4M0UXHvpejbReMp041SxDEb9PDT27MMgxlaWyzLMu0LnT JI58TJN0Vr5I2NVF33ROppbx6oB/QAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVoGqgAAAAGVf JcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs 1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeF G1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAACKX/AFY0sxTKrbguU6l4pZskvPY+brPcLzTU9dWdrIsUXYwPekknPI1zG8rV5nIrU3VNiVnl Xx9f91N4cv8AFD/8I6oD1UAAAAAAAAAOLdLpb7Jbaq8XWrjpaKhhfUVE0i7NjjYiq5y/mREUbGYi apyjaq/iEzy52Kx0eCYjNtk+XvdRUrm9VpKbb4epX1ojWKqIvyrun4J0OLY3bcRx+ix20xIymook jRdur3eLnr+dyqqr+dSMYNJXZ7kd01nv0L45b1/Ytlp5NlWktjFXkRPkc9d3L/LuniTw5VVfG1af d2fq9taw8YGzGGjbtq/m3f8Abs7c55wABkAAAAAAAAAAAAAAAAAAAAADjXK22+82+ptN2oYK2irY nwVFPPGkkc0bk2cxzV6OaqKqKinJAGasYyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn0LnO8Oqs Vf4X7ru21XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY5u6OaqKioqdFRSnrlbbfebfU2m7UMFb RVsT4KinnjSSOaNybOY5q9HNVFVFRTOeMZPkfAFkaUVa64Xvh1vdZ0X06iqwWqlf4+tz6FzneHVW Kv8AC/dblm9pfhq2vPcIcH8XndtRq543fo3wY+4hOITNdUs1r+GDhgu3drpTfBZvm8Sc9PjVO7dH U1O5Oj65yIqIiL8H16o5HOj4+uXErkutWSS8O3CVkcD55YI5Mu1Ao3pNR2CilTdIqWRq8stZI1V5 eVfQ+VHI50c00l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/wAXyOXqqr+ZERERETa7d0NUbUOB wM4mdOv1fmaS6S4VorhVHguC23u1FTbyTTSLz1FZUO/Dnnf4vkcvVVX8yIiIiIkyAKMznrl6ammK Y0adgAAyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGedQNQM/wBd8/rOGvhruXdKqk2Zm+bsbz0+N07t 0dBA5Okla9EciNRfQ69UVHOj2oomucoQ379GHo06zUDUDP8AXfP6zhr4a7l3SqpNmZvm7G89PjdO 7dHQQOTpJWvRHIjUX0OvVFRzo9XaK6K4BoDgFBp1pzae6W6k3kmmkXnqK6odt2lRUSeMkr1TdVXw 6IiI1ERGiuiuAaA4BQadac2nulupN5JppF56iuqHbdpUVEnjJK9U3VV8OiIiNRESdnQt0RbjKHlc Tia8TXpVe6NweVWobbhhV71t4FLbK+lTVLVfHqixNjXZY7Xend5rnRp6ooW0aRu9Sc6+tT1VK6vv D1o7kusVj19veFQ1We45SLQ227rV1DVhh2lTZYWyJC9USol2c9jnJzJsqcrdt1dmziky238KvEhh evlNTxU1jvOnmQ4hXRonLC2a3QLcbfGqet0j2Phb6/V4FNanaU5JhHkhKGne2ofcb1NbcxyeTs1f LKytr46hz5GJtzKxslPzJ06RLvtsqm/dadBdJeIfF6bDNYsRZkNno65lygp1rKilWOpax7GvSSnk Y/8ABlem3Nsu/VOibTKosVlq7JJjVZaaSotMtKtFJQzQtfA+nVvIsTmKitcxW+irVTZU6AYv1m0d 1ZzrQO5Raq8euDwaZZDQUyTV8mm9JTUrqeR8bqdzJu/ojd3dmrVT17bHPmss+N8fmhuO1V587zWv SKuopLh2fJ3x0TkYs3LzO5edW823Mu2/iviWtYuBThOxu/0eSWrRu3pU2+p75RwVFdWVNFTTb7o+ KklmdTsVF6pyxpsvgWZcNKcBumplq1irrD2uX2W2zWihuPepm9jSSu5pI+yR6RO3Vd+ZzFcnqVAM z+THulttPDDdLLkNdT01/wAWyq+w5clTI1j6asSpe975+b8H4Pl9J3TZq/IpBtV8w0ayHUPg91L0 qgttFpA3Mr3RQS01oda6BlxlY2OlckL440ZvURzqjuVEVUcqKviaS1E4LeGHVbLKnOM50moK29V/ L36pp6yqo0rVbtstQynlYydeidZGu8EJ3kejulmXaeN0myLAbJW4cynjpYrK6ka2lhjj27NI2N27 NWbJyq3ZW+pUAzj5QySG413D1i1me1+W1msFjrbXFGvw7aeBJVqJk9aRs54levgm7VXwORopTQP8 orxH1jomrNFYMTiY/bq1rqNFcifmVWN/yIW3pjwncPmj2SezLAdOYKS+tgWmiuVbX1dxqYIlRUVk MlXLI6JqoqoqMVu6KqeBL7JpTgOOah5LqtZrD3fKcvgo6a81/epn96jpWckDezc9Y2crem7GtVfX uoGdODekpouI7itqo4GNmlzehY96J1c1tM9URf53uX/7pTKGe2681/AbxNMtLZVpaLX26z3BkUav 2omVtErlVibczWuVjlTw2aq9Ntz06w7SnAcAyHKsrxKw9wuubVzLnfajvU0ve6ljORr+WR7mx7N6 bMRqfmOPhui+mGA2XJscxjEqeG15ldq6932jqZZauKurKxGpUve2dz05Xo1EWNNmbeDU3UDK2s2j urOdaB3KLVXj1weDTLIaCmSavk03pKaldTyPjdTuZN39Ebu7s1aqevbY2Hg9lnxvCsfx2qvPnea1 2ukopLh2fJ3x0UTWLNy8zuXnVvNtzLtv4r4lQ2LgU4Tsbv8AR5JatG7elTb6nvlHBUV1ZU0VNNvu j4qSWZ1OxUXqnLGmy+BfIAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaBqoAAAABlXyXHxE9M v01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88t mmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wAF4jNEdGrdabfUWzU/2S+caqZH9vTebaBl RF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AADyr4+v+6m8OX+KH/4R1R6qHlXx9f8AdTeHL/FD/wDCOqA9VAAAAAAAAChuIS+y5hfbVodaJ3ti rUbc8jlicqLFQMd6EO6eDpHp/MiN9Slw5hlNrwnF7nll6l5KO1076iTbxdt4NT++cuzU/OqGfdML VdJqW4Z/lDP+yDL6jzjVIvjBCqfAQJ69mM26eKb7eop4uvVFuOfb2fr5u/wHhvxTjK9lHq/zf/5j X25JpBBDTQR01PE2OKJiMYxqbI1qJsiInyIh+wCs7IAAAAAAAAAAAAAAAAAAAAAAAAAABxrlbbfe bfU2m7UMFbRVsT4KinnjSSOaNybOY5q9HNVFVFRTkgDMvk3rbb6Lg+wmro6GCCe4S3SerkjjRrp5 EuNTGj3qnVzkZGxu6+pjU8EQ00Zu8nR8TbT79LfrWrNIm1z15QYX2FHZHyAAapwAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAACr/ACWNuoKXggwK5U1FBFV3aovFXXzsYiSVUyXSqjSSR3i93Zxxs3XdeVjU 8EQtArjyXHxE9Mv01+uK0tYXncPhn9z3/RqoHTZpNPTYdfqimnkhmitlU+OSN6texyROVHNVOqKi 9UVDz401x3V/O/J4ycRuRcSGp9PmVixa8Xy0OoMimip2st7qhzGVTN1WsdL2Dle+ZXKiSI1vKjEQ tuG9IAee2pb9Z/cR0PGZNr7nNFqLHZLXlMVJbrktNYUimlh2pXW1qdjIzsZPSV/M50m6qvL6Cd3x W8UUMGrGl2jeSayVmkWIZHi6ZjlF+tb1jr5o5FeymoaadGPdBzSRSK57U5uVE2VNlRQ3cDz60V4k cMxjitwjSjSLiav+ruCaiUdxp6ylyKvluFbYLlTQrNDLHVTRtkdFM1rmdmquRFRyr+92j1q1CtF+ 1BzXH+Ljiu1a0c1DbkVdBY7ZS3eWx2GG1tftSS0zkiWmqGK3bd8z1V3T87lD0mBi7iRyHXfAOH7S xlZqtfb5ZpbxTw6h59gtsa24LZla9WVUDI+17Jrk7PnmjRerUVERH8i9xwyT4RkeoNDkegXGvf8A UTFm0NQmQ4nlV3dd65VVESnqIFn5Kmk5Xr6XM1zXIvLsi9UDXIMEahZbgd81czu26jcZ2rM1xoLm +C249pPSXRlNj1K1NmRVbqGmmbNUo5Hc/aO8UVORPwW9Zi3GNqpZfJyZxq/XX595zPEr1VYjbLzW USRT1Llq4YIKqaFzURJWR1HMrXt6uiTnRVV24ehQMCcTuj+t/DxwpZNqXh/FHqhdsqobZAmRJdr8 +enqEmkjjmlokRGvoZI3vR8axPT0GOY5H8258uIjiWWz5roxoXl+udz0wxa84TT5XluUUUzkula1 zFigpYajke+Jz5YpHPkROZU9abKjg9AAefWivEjhmMcVuEaUaRcTV/1dwTUSjuNPWUuRV8twrbBc qaFZoZY6qaNsjopmtczs1VyIqOVf3u26s1xWDN8WuGK1N7vdojuMaRurbLcJKGuh2cjt4p41R8bu m26L4KqesCuNDeKDDeIS73qm0/w/NEsdoknhiyevtTae0XKSKVI3spZe0V8jkVd/SY3oi+tNi4jy z4csrr+GPyb+Q8SeLZLktbkT3V9ot1ruF2mqbRSVEt37vHUxUTl7JkjebtHORPTVHIu/MpeWruhm smiWgV51vsPFNqlcdR8OtHsguDbpekqrHXyQtSSqgW3OZ2TIlakiMRuyt9HqoG2gYN1M1H1N1p1v 4Y7ZgeouRYRaNXMFr7reGWmvexIIH0kVU90bF3jWoaznijlcxyxq/mTqhtTBcSjwTErbiUOQX2+M tsSxJcL5XOra+o3cruaad3WR3XbdfUiAd8ZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rQNVAAAAA Mq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78w oO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOF vjp4OxYjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAB5V8fX/dTeHL/FD/8ACOqPVQ8q+Pr/ALqbw5f4of8A4R1QHqoAAAAAAHS5pldswbFLpl14 ftSWqmfUPTfZXqieixPzucqNT86oYmYpjOW1FFVyqKKIzmdUKY1yuvtgag2fSGldz2uz9nfMi2/B eqf7WpnfyqvOqetFavqO+IXpZaLnFZ6rLckTe/ZXUuu1wVU25OfrHEnyIxioiJ6t1QmhytKbkzXP P8uZ7jiqcNbpw1Gynxnnnv2dUQAAy1AAAAAAAAAAAAAAAAAAAAAAAAAAB/FVERVXfp16JucGx36x 5NbIb1jl4orpb6hFWKqo52zRP2XZdnNVUXZei/Ipzzyu4yI9WuDHiIl1M0WyivsWPagvfdXUsWz6 F9c1U71DLA5FjfurmyIqpuiTKjVTlN6KNOclfE3+TUxXMZxztf8Ak6nNZwZ6fve5Gtal2VVVdkRP OtX1NCWS+2XJLdHeMeutJcqCVz2R1VJM2WKRWOVjuV7VVHbOa5q7L4oqeo8P9Hcj1014lwfhMsOa XGjxN9TLAtBR/BRMppJpKmqnqOTZZkaj5HI16q30WoiIvj7dYrjNlwvGbViGOUTaS12WjhoaOBvh HDGxGtT867Im6+tepteo0ZznnQYC/wAdbimI1UxEZ9eTtAARL4AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAABXHkuPiJ6Zfpr9cVpY5XHkuPiJ6Zfpr9cVpawvO4fDP7nv8Ao0rllFVXPFrzbaKLtKirt9RB CzmROZ7o3I1N16Juqp49DMelOh2qWNeTdrtA73i/ds7mwTIrMy099p371lU2sSCPtmyLD6Xax+lz 8qc3VU2XbWILbhsnag6HapXzybtLoHa8X7fO48Estmdae+07dqyBtMksfbOkSH0ezf6XPyrt0Vd0 P1qZofrFjmoWlXEfo9j9tv8AlOG4smJZHi1dcWUa3O3PYjuWCqVHRslimV7vS9F3Tr02dq8AUlpn lfFPm+ocdyz7Sqxaa4JRUMsctuq7xDd7vcqxyp2b2yUruxp4mIi7oqvc75OqKyvb3feLvzRd9OdT uEvEtYqV1TUto73TZFbqG21tM97lh7xRViOkic1io13Ij99l238V1eAMhaU6S8VnDHw66c4lp3TY vmd0x+urqnJsYmrXUzKmkqpZJI6agrZUVIlgc9OsjeV/XqiIiO4ln0k1j1b4odPdc8j4frPozS4K 24y3OsbfKKvuuRLUwdkynd3JFZ2TFVzlWV6rs53KiKvXZAAxXoFgnFbw3WvLdHMW0SsV/p7rlNxv Fqzyqyango3RVb0Vs1bSIi1b5I0ROZrG+lsjUciJzrBsd4RNZV4YtcOFjUW30VDSXS/1eS45ntVd qZKa5zLUwTQ9tTsVZaZXOp/hHObs1JFRqO26+hp02Y4hjeoGK3XCcxtMN0sl7pJKKvo5t+WaF6bO buioqL8ioqKi7KioqIoGCOMPOOKbM+C3LbbqdpLZ8AoKG10cl+vq5NTXJLw5tRCkcdDDT7rGk8yx uV0rk5WczUR6uRUtXM9GdXLVlWjnE5orYLfkGSYrhsWL3/F6+ubQOulskia9rYah6KyKWOVznbP2 avTqm2zu+ofJ+6UoyzWbJ9R9VMtxDH6iKot2HX/J1qbJCsS7wsWFI2vkZH0RrHvc1ETbZU3RdO+A FJaZ5XxT5vqHHcs+0qsWmuCUVDLHLbqu8Q3e73Kscqdm9slK7saeJiIu6Kr3O+Tqisu0ADEelnBz nGSeTwuXC9qfRMxbJrjPcaiHtKiGqZTT+cnVdI9z4HvarHK2PmRqqqNc5Nt+hz9QouODWnRur4e7 3oVZMYuGQ0DLHfs5myylqrd3ZdmVNRBSRp3lzpWI/lje1vKr+rl23NmgDLVfw8ZXjnErw63nDbG+ qwTS3D7rjlbcX1UDHU6LRMp6VFiV6SPV3Im6sa5E9exqUAAZV8lx8RPTL9NfritNVGVfJcfET0y/ TX64rQNVAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAKa1Q1tv +C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MK Dv8A7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAGXdPtPsQvmIUF0ulo7eqn7XtJO8St32le1OjXIngieoqYnE12a6aKKYmZiZ1zlsy6p3q9+/ NqYiIzzz58tmXVO9qIGf/aowD+IP9Kn/AGx7VGAfxB/pU/7ZDyvEdCPin7UPK6+jHf8Ao0ADP/tU YB/EH+lT/tj2qMA/iD/Sp/2xyvEdCPin7TldfRjv/RoAGf8A2qMA/iD/AEqf9se1RgH8Qf6VP+2O V4joR8U/acrr6Md/6NAAz/7VGAfxB/pU/wC2PaowD+IP9Kn/AGxyvEdCPin7TldfRjv/AEaABn/2 qMA/iD/Sp/2x7VGAfxB/pU/7Y5XiOhHxT9pyuvox3/o0AeVfH1/3U3hy/wAUP/wjqjXGNWDRHMZb jT4xJQ3Gos9XJQ3Gnhr5lmo6hjla6OaNX88bt0Xo5E3Tqm6KimB+MvE7BavKHaGWOgoOyoaz2M9v F2r3c/PfKhruqqqpu1ETopLav3q6sqqIj/umf/WElvEV1zlNOXv/AEeygM4XzBtJMYtNTfskhorV baNiyVFZW3KSCGFvyve+RGtT+VT+2TAtLcjs9FkFltSVNvuMDKqlnSoqGpLE9qOY9Ec5F2VFRU6e CoRcqxHQj4p+1Hyq50Y7/wBGjgV7oB/ajsP+Ff1mUsIuWLvHWqbmWWcRPfC3br4yiK98ZhQOvd09 m+d49o9Su56Cj5b/AJBt+CsTF2ggd/4z+qp47cql43u8W/HrPXX66zpDRW6nkqqiRf3sbGq5y/5E M3aVw115gu2pt9i5LpmdWtwVq9VhpE9GniRfkSPZU/MqEGLr1Rbjn+T0XAVj8dWLq/c1R/NOzujO e3JOwAVnZAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApDjI0Ij4gtCr3iVHTNkv1vb51sT9vSStiaqpG i+pJGK+P5E50X1F3medQNQM/13z+s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc 6Pe3FU1Roq2LuW7dqeN2SojyVfD/ACYzil313yW3uiuV/c+1WZsrNnxUUT9p5Nl8FkmZy/KiQ/I4 36ZhueG5X5PS40zUuN5y3h8ucrI5qyq/si4YfWyKiOllVqJ2lHK9VcqoicjnL0327XSttuVvvNvp rtaa6CtoqyJk9PUQSJJHNG5N2va5OjmqioqKhvfiqK85Q8G3LdViKbe2Nva5IAIV8AAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAGOOArgK4TtaeE7BtTNS9KfPOSXnzn32t8+3Kn7XsrlVQx/Bw1DI2 7RxMb6LU323XdVVV0B71xwJ/MZ9Jrx97LXJetw/TP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mv H3scl6z0z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0mvH3 se9ccCfzGfSa8fexyXrPTP8AB4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBX HvXHAn8xn0mvH3se9ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3scl 6z0z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/wAHj+ixwVx71xwJ/MZ9Jrx97HvX HAn8xn0mvH3scl6z0z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHA n8xn0mvH3se9ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3scl6z0z/ AAeP6LHBXHvXHAn8xn0mvH3se9ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8x n0mvH3scl6z0z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0 mvH3se9ccCfzGfSa8fexyXrPTP8AB4/oscGStQ+FzQnhr4yeGz2lMG9jnsj9mPnP/ZOsrO37vamd j/tmWTl5e3l/B235uu+yba1Iblvi5ydLB4rldE15Za8gAEa0AAAAAAAAAAAAAAAAAAAAAAAAFceS 4+Inpl+mv1xWljlceS4+Inpl+mv1xWlrC87h8M/ue/6NVAAtuGAAAAAMA6LaXZPxG6x8QUuWcR+t 9ipsS1CrLRaqHHM4qaGlp6bdzkY2JeZrUTwRG7IidNidcNN91JwXi41D4aqrVzINTcHsGMUl8hue QTsrLjZrhLMxiUM9U1qLI58bpJNnIiojG7InpKtX8O/C7ohr5rdxL3jVXEqy71ds1NrqWlfBfbhQ IyJyucqK2lnja7r63Iq/nJhp7Y8f4V+NrEuHHQa4TuwnOrDcbxkuNzVHfVslTBG99PWNmfzTs7VW pGrZHuRebf1t2C5sn4zMFtea37BMI031K1JuGKTd2v8ANhlgSuprZU7brTySySxtdKmy7sj53IqK m26KiQ3iL4ibFqRwI6h6x6GZpdaGWloVgjrKSSa33G2VkdRE2WF+ytkgmbzbKm6dHIqKrXIq8DyZ 8sFFpTqBi9zkZHlVm1IvzMjgeu07at0rVSSRF67Oa1ERy9F5FRF6KZ1ukkV04YOOfKcfe2TFbvnt Y61zxLvBUSsnh7xLEqdHNc5zF5k6KBpez8eum+J4Jjd6yrDtT6nFkpKGirtQEx2SWxJUq1kckjql z+1kZ2u7e2bG5jnfgudum+raWqpq2mhraOojnp6iNssUsbkcyRjk3a5qp0VFRUVFQyXrFkeAO8mJ dLrSVlD7H6jS+npLcqOb2aTOo44qeNPkek3I3l8Uc3bxQuHh2r48X4fdHsdzO7UtBfajDrLSJS1l Q2OeepZQwpJG1rlRz3tXxRN1AtgAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWgaqAAAA AZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt 7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/wBkvnGq mR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz/p R/uAtf8Az/8Ar3mgDP8ApR/uAtf/AD/+vec7F/tFHZV86VHF+vT2T9EtABqgAAAAAAAAAAB5l+Uv 05zLRnU6x8U+kl6uWPz3vltd4q7bM6F0ddGz4J71b4tliZyq1d2qsPXfmMgZvxVapajasYPrRmTr VcMnwSO3spJu6dlHWLR1klVG6djHIiqr5FR3Z8iK1E2RF3VfbnXLSeya4aUZJpffeVsN7o3RQzq3 daapb6UEyfnZI1jtvWiKnrP8/OV4xe8Kya64fklE6kutlrJqCsgd4xzRPVrk/Om6LsvrTqXLMxVG U7YXbFUVxlO2Go9FazWbygHEdY7Jq3llwvGOWuVbzdqNq9lQ0tFE5N444WbMasjlZDzbK/Z+6quy ns3FFFBEyGGNsccbUaxjU2a1qdERETwQyN5NPh/9qHQuLNb3Rdlkef8AZ3Sbnbs+GgRF7pF+bdrn Sr/wqIv4Jrsgu1RNWUbIV71UTVlGyHY6Af2o7D/hX9ZlLCK90A/tR2H/AAr+sylhEmB/Zbf8sfKF rD+xo7I+SkOJi8S3iCwaPW2ZzZ8sq0luLmLssVtgVHyqqp4czkaifLs5PWcmCCGmhjpqeNscUTUY xjU2RrUTZET+YhWM3H2wtSMr1SkXno2zeYLI5eqdzgd6cjfzSSbu/wApOCpVVxlc193Z/mt721Y5 JYow/PEZz/NO3ujKPcAAMgAAAAAAAAAAAAAAAAAAAAAAAAAAAGedQNQM/wBd8/rOGvhruXdKqk2Z m+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj2oomucoQ379GHo06zUDUDP8AXfP6zhr4a7l3SqpN mZvm7G89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo9XaK6K4BoDgFBp1pzae6W6k3kmmkXnqK6odt2lR USeMkr1TdVXw6IiI1ERGiuiuAaA4BQadac2nulupN5JppF56iuqHbdpUVEnjJK9U3VV8OiIiNRES dnQooi3GUPK4nE14mvSq90bnEutqtl9tlXZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUU wlk+MZHwB5GtbRNuF74db3WdU9OoqsFqpX+C+Ln0LnO8eqsVf4X7rvg4l1tVsvtsq7LerfT19vr4 X01VS1MSSRTxPRWuY9rt0c1UVUVF6KimaqYrjKWlm9XYriuidanrbcrfebfTXa010FbRVkTJ6eog kSSOaNybte1ydHNVFRUVDkmasnxjI+API1raJtwvfDre6zqnp1FVgtVK/wAF8XPoXOd49VYq/wAL 910Zbblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKioc+5bm3OUvU4XFUYqjSp288OSADR aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVx5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqjqvDgAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMecW/xyeFH/AB6/VUBcBT/Fv8cnhR/x6/VUBcBS xPrx2PR8Eewnt+kAAK7qgAAAAAAAAAAAAAAAAAAAAAAABXHkuPiJ6Zfpr9cVpY5XHkuPiJ6Zfpr9 cVpawvO4fDP7nv8Ao1UAC24YAAAAAzxlPk/uErNMrvWb5FpfVT3rIa2W43Kphya706VFRI5XPerI qprG7qq9GtRE9SITrR3hq0L0B76/SPTi22CouKI2rrGvlqaudu+/K+one+Vzd+vKrtt+u25ZoApv Ufg/4cdWMoqM0zjTOnqb3WxNhra2iuFXb5K1iIiIlR3WWNJ+iInwiO6IieCIhJrjoNpDc9JJ9CZc FoKfA6imSjkstC6SjiWJHpJsjoXMeiq9OZXI5HOXdVVd13nwAo2r4IeFevyOmyms0ets1XS1DKxk D6uqWhdUNRNpX0fa92kkXbdz3xq5yqquVVVVO41i0SbqhqLpJmaQUEa6d5DUXmWrmqZm1DYXUr2d hDE1Ozesk3d1c6RUVjYl5d1cpbRHM51Cw7Ta20N2zW9NttLcrpR2WlesMkqy1tVKkUESNja5d3Pc ibqnKibq5URFUCRgAAAV3ozrjieuVPmFTidvu1I3CstuGG3BLjFFGstbRpGsskXZyP5ol7VvKruV y7Lu1PWFiAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rQNVAAAAAMq+S4+Inpl+mv1xWmqjKvk uPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mj l513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnV N/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ/0o/3AWv/AJ//AF7zQBn/AEo/3AWv /n/9e852L/aKOyr50qOL9ensn6JaAYpxPBMj124otfLDf9c9WcfteG19ljtVDjeW1FBTxNqaWR0i dmnM1E3iaqcqJ1V3juKYzRU055trAyC5NQ+F/iO0wwSDV/L88wrVF9wt09BllclfW2+qp4mPZPDU q1r1YqyNRWr0REdvuqtVvxrr3kevHFRqHo7lmuWTadWjCY7cyxWHG7ky11167eHtJap1QrVkka1V anIzoiPZ4Lurs6DOh3NiAobANGda9KdVaCaxa03nM9NK6jmZd7dmlxdW3SjqUTeGSkqEi3e1XbI5 j3NRG8y+kvLywTTrW2LBtb+KS+6p59Xx4jhlVj76OGurZJYKFslLOro6aFyqjXSPRqckaIr3cvRV 2GjnsY0M9jWgM86GW3V/VfL38QeqNyv2LWOohWLEcEirpYIoKN3hWXKNjkbNUyIu6RvRWxoqdObb lv26XOhstsq7xc6hIKOhgkqaiVUVUjiY1XOcqJ1XZEVehrMZTkxMZTk5IM+e7/4P/nstv/QKz7Et HSzWLTXWuw1OTaXZVBfrZR1bqCeohhljRk7WMerNpGtXflkYu+23pGZpmNsE01RrmEyMOcTPAdHr BxX4TqRb6FqYve3I7NUb0RHUjUVi/LvUMRkK7eCs5vWTTygmu2oGlmKYbgGlNz815XqRefNdNcUR FfTQMWNsix7ovK9z54W82yqjVdtsuypVVXdtdOC7iL0sxfMtesh1Kw7U6pW11rL6r3upantYonSR LJJIsaMdUQv9FyIredqovRxJRFUa4lLbpqj8UTtegUUUUETIYY2xxxtRrGNTZrWp0RERPBD9AEKF 2OgH9qOw/wCFf1mU+XEFmdThel10ntjnedrurLPbGt/CWpqPQRW/na3ncn/in10A/tR2H/Cv6zKV 7qpX+zXXOzYrG7nt+D0S3asb+9dXTptC1fztZ6afyqbWq9DA28ts00x4PR//AM/h4xF23NcfhpiK p7IjZ75yj3uTh+OU2I4vbMbpVRWW+nbErk/fv8Xu/ncrl/nO4AIojKMoesqqmuqaqtsgAMtQAAAA AAAAAAAAAAAAAAAAB/FVE6qqJ6up/TgX6x2zJrHcMcvVMlRb7pTS0dVEqqnPFI1WuTdOqdFXqnVD y9j4yeIjgx1avWi2plQ/UHHrFV9lSuusqtrn0LkR0E0VVsqrzRuaqtkSREXdqK3ZTeiia9m1Xv4m nDZTXGqed6ogpDQjjI0K4gooaPEspbb79I307FdeWnrUd60jRVVsyfnjc7ZPFEOo1A1Az/XfP6zh r4a7l3SqpNmZvm7G89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo0W6pq0cmLmLtW7fG55wagagZ/rvn9 Zw18Ndy7pVUmzM3zdjeenxundujoIHJ0krXojkRqL6HXqio50ertFdFcA0BwCg0605tPdLdSbyTT SLz1FdUO27SoqJPGSV6puqr4dEREaiIjRXRXANAcAoNOtObT3S3Um8k00i89RXVDtu0qKiTxkleq bqq+HRERGoiJnPCtcPYLxc8Vlw1S1Gr6TBMHtuK1dNT3C4SyUVtSW3I6Xu8CqrWPlkVPRjbzSPci bK5UL9FEW4yh5jE4mvE16VXujc2ODMGglNrNr5nkfErqPdclwvCWwuiwbA4K+Wk7xSP8Lldo43Ik 0sibLHC/mYxqouyr6TqvocDyjX7ji4gcJvmv2sGL2LDIMZltNuxTMam200S1VtjdN8EnMxEVzOb0 UT0nOVd1U3V27wYj1OqtZuA6tsGpr9asp1N0erLvTWjKbbmM0dZdLPHUP5WV1PWtY1z2tcqIsbk2 6tTqrueP98Q1nyrVDjxwbRqHWbUnDMZr9Paq71EOH5NPa1lqYquZGvcjN2OVU2RVVqrsiJv0A2dd bVbL7bKuy3q309fb6+F9NVUtTEkkU8T0VrmPa7dHNVFVFReiophLJ8YyPgDyNa2ibcL3w63us6p6 dRVYLVSv8F8XPoXOd49VYq/wv3W78V4M6bFcntGTt4oeIi7LaK6CuSguuoE1TRVfZSI/saiJY0SS J3LyvYq+k1VT1l/XW1Wy+2yrst6t9PX2+vhfTVVLUxJJFPE9Fa5j2u3RzVRVRUXoqKa1UxXGUpbN 6uxXFdE61PW25W+82+mu1proK2irImT09RBIkkc0bk3a9rk6OaqKioqHJM1ZPjGR8AeRrW0Tbhe+ HW91nVPTqKrBaqV/gvi59C5zvHqrFX+F+66Mttyt95t9NdrTXQVtFWRMnp6iCRJI5o3Ju17XJ0c1 UVFRUOfctzbnKXqcLiqMVRpU7eeHJABotAAAAAAAAAAAAAAAAAAAAAAAAB/FVE6qqJ6up/TgX6x2 zJrHcMcvVMlRb7pTS0dVEqqnPFI1WuTdOqdFXqnVAOeDyuj4yeIjgx1avWi2plQ/UHHrFV9lSuus qtrn0LkR0E0VVsqrzRuaqtkSREXdqK3ZTcWhHGRoVxBRQ0eJZS2336Rvp2K68tPWo71pGiqrZk/P G52yeKISVWqqYz5lSzjbV2dDPKrdKUeS4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqo6LyQAAABjPJ Y9R9RfKB5JpDBqzl2PYTHpxRXiuorRdZIHulSrWNG067qlM56vRXyxo2RWxI1HIjlA2YDCmjeJ6p ZVxE61cMl/4gtRqjANOJbVcaGpbfHsvsslyo2TRwSXNPh1giRJdmoqKruVVdsitd1+KcSWo2hXDt xL1N9ym45nX6MZdVWHGrnfpe81ckM74YqNtVJ0WdY5Jkc5y9XJum6JtsG+weV181303x7R52pGMe UXzW6az2+1peX2+quUstkuFwaxJJKBLasCQMjcvNEzbbZVaqrt0Ln1g1e1J1UyXg7vGnWdXjC49V oLjUXiG3VLki7KW3U8krVicqxyyQo+ZYXSte1kiNfyr1RQ3UDCuS4tqnp9xi4joHhnEDqI7DNSsY rLhefPN6dc66gdSPc9zqConRzqZ0qNZEqpvytkkc1EckasmuilXmGl3GrmPDvJqRluWYjWYHS5nb 2ZPdZLlVW6p76lNJHHUS7yLG7mV3KqqiKibfnC8dBNccT4itNKHVPCbfdqK019TVUscN1iijqEdB M+F6ubHJI3ZXMVU2cvTbfbwLEPN3gE0BzDV7hao7hc9etRcNt9PdbtTY/RYddvNkcO1XI59TUq1q uqZFmc9OVzkYjI2ojd1c5flX8bOrOP8ABVap7/mtJbs/k1Gk0suOYT0rXsoo4XOfLc3Rbcrnsp0a i9F3cqv23A9JweXee8T2kehFPYNStCuN/NtR7pbrtRxZFi+T3ie5095tsj0ZUOhZLC1tNM1F52uj VqIiKmy+C3XnNFqdqnx+ZFopb9ZM1xTC/a8ob3cIrFd5KeZHsqljRtKq8zaZ8j5I1fKxqPVkSs3T m3A2yDh2e2ts1oobQysq6ttDTRUyVFXKss8yMajeeR69XPXbdXetVVT61zqtlFUPoIo5KpsT1gZI uzXSbLyoq+pFXbcD7g8xtMc7tOb2mptWv/GrqzpLxAPqKtKm03a6vtFloKlJnpTJDSPjSjmp1akf o86ufu7ZU3Qtji84gMk01uui2hWYa6R4XT5bST1ucZ9aqVKaZ1NSwt6UbUSTu7qmbmRHNRys3btu 3dFDcIPOjBeJXT7T7iQ0zxTRPirybVjEs/r5bDkFkya5zXOottS9qd0q6apnjbIxqyLyvZurdt+n VFbYenFszvjNz3VrK71rjqJhOJ4NmVbg+N2jDLwlqRXUTGdtWVD2sc6d0jpWOa13otTdNl6bBtQG EuJ+48UOifCTY4Ml1Ujumc27UK2UVuv1oqZ6N90tzp3dhHXdmke7nJ6ErG7scjU3VyqqnZ8UWV5f wZ6D0kNp1xyi6ZRqTltBZarLcrqUrWWNs0bnVVXTU6MSOGJjInK2FrVRqv3TdUA20Ryq1Cw6jz+g 0uqb01uUXO11F6pbf2Miq+ihkjjklV6N5Goj5WJs5yOXddkVEXbzez3ie0j0Ip7BqVoVxv5tqPdL ddqOLIsXye8T3OnvNtkejKh0LJYWtppmovO10atRERU2XwW1M10jo8i8qDb6GbUHUCiiq9MXZHvQ ZPVU7oZW3Ts+6xK13oUjkja51OnoOcquVN1A3gCvst1+0ewbUHHdKcnzugpcvyqZsFqs7GST1Ern IqtV7Ymu7Frtl2fLyNXZdlXZSwQAAAAADHnFv8cnhR/x6/VUBcBT/Fv8cnhR/wAev1VAXAUsT68d j0fBHsJ7fpAACu6oAAAAAAAAAAAAAAAAAAAAAAAAVx5Lj4iemX6a/XFaWOVx5Lj4iemX6a/XFaWs LzuHwz+57/o1UAC24bKHlAuIK8aM43gWIWPOo8GfqHkTbXcsqdCkr7Nao0R1XPE1UVO12exGrsu2 7ttl2cmfbhxN6V6NZ9p5fdBuMnMdT6W75LRWLK8Xyq8T3VJrfUqrHVtO+aJqwSxP5V5WKjXcyJsj UVHaz4uNDs21Ut2EZ1pRVW6PPNMMjhySzU9yerKW4MRNp6OR6IqxpI1G7O28W7LtvzN+OP57xj51 mOOUNXoNYtMMcpKxtRkdfeckpr1NWUyNVHU1FFRqnI9yqm0sqoiIm/Iv4KhWVTBqXqbx8ak6Tpq9 mGP4LQ4hZ7pU0NouskEvbLs1sdO9VVKVHq9z5Hwo2R3ZsbzIiu3+enepeXcP2s3ELppfc6ybN8Q0 +wunzyz+yO4urq+lRKZ8lRTd6f8ACSMcrfR5lXlRqbdVcrrOwfSnPrPxval6v3Gw9jiOQYjaLZbr j3qF3b1MLkWVnZI9ZW7fK5iIvqVTpG8PuWZJxW60ZPldgfDgOoOntHi0NxZVwK6d6sWOoYkSPWRq o1zvScxGr6lUCv8ASvRjX7XLQW06/pxU6g2bVDLbd7ILTSU1zSHGKJ0iq+mpX25InMfDycjXucj3 9VX0ttl+2vNZrveOJrh90hj1SuWKVeYYtd4cumxmumjpFkhgZJUTU0cicvaLySMhkkYro+1RydWn 6wO2cemjWjcHDbiGkGOXeuslLLZcf1I9k9LDQ01IrnJBUzW+Vjp1liYrfQRr2qrE35k3R05vGius E3E/w/ag3eZ2UUOD4tebblWSudS0vaV89KjGyJTNc120knMqJGxWtRU3VPECPTrlfDBxaaY4/X6l ZrkenOp9iqMUT2S3ye4d0yCnd20E6ukXlbJOxWwpytRXLzKu+25yazL821N4r9U6mw5hfKDCNGcI dZ30dDcZoaSuyKshfO6V7GORkroIfQ9JFWN/KqKikq8oNitFfOF3Jsq87U9pvGn8lNmdhuEy7d3u NDIkkSN/v5EV8LU9bpUOBwxaf3zC+Ee7ZJmcXLmGo1Lds5yRytVrlrbhG6VGKi9WqyHsY1avgrFA qnhM0l1X4heEzGNRc64mdVaLKbnQ1bLLPbMkmp4qNsVRLFDJUtTd1a9z2K97p3O3a5GN5UahUOpm Y5DxNcKHDRqnnOWZJR5HW6pWrEbw213SSjp5ntqqmNa1IolRjaraCN7JWoixue9GbIpYfBfmPFfh 3Bjhti0y0Stud09xt9bLj17bktNb0tqy1U+7K2nqNnSJFLzuRYVdzxqxuzFRVJHlPBpqjgnBvpJp dp1RUGWZnplmttziuou/MpI7pURz1E08EU82zWojqnla5/Lu2PfbddgOPxRay0GkuqumfCreeILJ tPcJ9j82QZLl81ylqb7Xw9rLFTUjK17XyMe6SKRXSbc3KiIiptsvXaK8SOGYxxW4RpRpFxNX/V3B NRKO409ZS5FXy3CtsFypoVmhljqpo2yOima1zOzVXIio5V/e7WlqPpzr/ddSNN+L7AtMqCnzmyWa rx3J8BuF/gR9VbJZXvjZDXsRYEmY93adfRXmRN/RVHWNpnlfFPm+ocdyz7Sqxaa4JRUMsctuq7xD d7vcqxyp2b2yUruxp4mIi7oqvc75OqKwKN4drFqHxeQ5prxk2v2pOLQLldxtGJWbGLwlFQW6gpHo yKSanVjo6qVzt1d2qOau3hsuydv5Mdl+iwPWiPKqqCpvTNaMjbcpqePs4pKpIaPtXMZuvK1X8yom 67IqIfHR/CuKnhVrMz0qwHRG06gYdeMlrr9jF+dlVPbWW2Krcju71kMjVmckbk3V0THKvpbJ1Taa cBmjWq2ieFalWTV+khbeL7qXeb9T1kM0T47lSzxUzW1jWxvesTZHxSOSORUe1PwkQDTQAAGVfJcf ET0y/TX64rTVRlXyXHxE9Mv01+uK0DVQAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAA AAAAAAAAAAAAAAAACmtUNbb/AILxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08 NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAABn/Sj/cBa/wDn/wDXvNAGf9KP9wFr/wCf/wBe852L/aKOyr50 qOL9ensn6JaYV0/wbVnM+LniRXTDXKo07SjuVg78kWO0d079zUcvZ795Rez5OV/4P4XadfBDdRFc Y0vwXDcuynO8bsfc75mstNNfarvM0ne307HMhXke9WR8rXuT0Gt33679DNNWjmipq0YlWenfC/VW TUuk1j1b1ZvmpeX2mllo7PUV9JBQ0lsZKipI6ClgTkbI5qq1Xb+C+G+yp12Q2DhO4uMuyXBMwxWi u2V4JVutlayrjkoLlCidUfDIxzJXwbqqtciqxV67bORV0OVfqhwxaDazXWK/ajab2+53WFiRtuMU s1JVq1OjWump3skciJ4Irl29QirXnLMVa85Z7dYLjwscSmlmnOlWquTX7H88qauju2GXq5ecfN1P HFztq6dXenAxvVV3/C5HdXJuiQ+1cNOHcSHFHxMWzMr1e6SO01dkW3Moax0UUNdLRSpFWvYm3aSQ 8juRHLy7Sybou6KmutLeG/Q/RasqLnppp3brRcKpixzV7ny1VW5i9VZ287nyI1VRN0R2y7Jv4ISD GNL8Fw3LspzvG7H3O+ZrLTTX2q7zNJ3t9OxzIV5HvVkfK17k9Brd9+u/Q24zLY24zLZtVFw0a15X VXm58Ouur46bVHDokVKnwiyO2p0iuECr+Eqpt2jU6o7rsi8zWX9dKispLbV1dut619XDBJJBStlb GtRIjVVsaPd6LeZdk3Xom+6kVzHRzTjPcrxvOsnx3t8gxGZ09nuUFZPSz0yu25mq+F7FkYu3WN/M xUVyKmzl3mZpMxOuEdUxM5wz77d/FR+JHdP/ANoFm/bLQ0tyvUHL7FU3HUfSqowG4xVboYbdNeaW 5LNCjGKk3aUyqxqK5z28q9fQ38FQmQEzE8xMxPMwh5T6knsd+0J1ZqopPM2J5VI24Starkj7SSlm bvt8raOX/IdLxm5XimufEzw24Hpjk1syOpo70+51klqq2VTIKaSopJOdzo1VE2ipZpFTfflRF8FQ 3fmWF4pqFjdbiGb4/RXqzXBiMqaKsiR8ciIqKi7L4Kioio5NlRURUVFQguk/C1oDoddai+6Xaa2+ zXKqjWJ9Ys09VOkarurGSTve5jV2TdGqiLsm/gb01xERvhJTciIjPbC1AARIlE2HgY4RNVcQbq9q zpclzvldFNPc7it9uVOj2U7nRNVY4ahkbeWKJiei1N+Xdd1VVWpNLeAPhTyjGX5TfNIVRt3rKiqo aZb7cm91o1eqRRbtqN3bIm/M5VVd03U0LkF+qaDhZseLWuXluWY1r7FTbdVRstXL2rlT+D2bXIq+ rmQmdst1LaLbSWqhZyU9FAynib8jGNRrU/yIhFZuVcTappnZTHjEf573tOA8Jb9HU3blMTNWURnG eUUxry7ZnwZ397o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRBLxle+XS5LY6Ed0M3e90cG3zO/SG6/eR7 3RwbfM79Ibr95NIgcZXvk5LY6Ed0M3e90cG3zO/SG6/eR73RwbfM79Ibr95NIgcZXvk5LY6Ed0M3 e90cG3zO/SG6/eR73RwbfM79Ibr95NIgcZXvk5LY6Ed0M3e90cG3zO/SG6/eR73RwbfM79Ibr95N IgcZXvk5LY6Ed0M3e90cG3zO/SG6/eR73RwbfM79Ibr95NIgcZXvk5LY6Ed0M3e90cG3zO/SG6/e R73RwbfM79Ibr95NIgcZXvk5LY6Ed0M3e90cG3zO/SG6/eR73RwbfM79Ibr95NIgcZXvk5LY6Ed0 M3e90cG3zO/SG6/eR73RwbfM79Ibr95NIgcZXvk5LY6Ed0M3e90cG3zO/SG6/eR73RwbfM79Ibr9 5NIgcZXvk5LY6Ed0M2u8nVwZsar36Po1rU3VVyG6oiJ8v+2TzDyPR2XXnXPI7DwmaV1r8To63udA sE801MyKP0O8zVVS9yMSVUdIiOenouRETdOvuBfbJbskstdj14hfLQXKnkpKqNkro1kie1WvbzMV HN3aqpuiovXoqHxxnFcZwuy0+OYhYLfZbXSN5YKOhp2QQxp+ZrURN19a+K+skovTTrnWr38BbvZR TEUxz5RGbC3D/wCSqxTGpKTJdd8jdf7lErZW2a1SyQUUT06p2k6cssqov8Hs0RU/fIW9htzuPk88 rq2pQz3Ph8y2596rJ44llrcPuEvK1ZZHIivno37NRVdu5uyevpLp841yttvvNvqbTdqGCtoq2J8F RTzxpJHNG5NnMc1ejmqiqiooi/VFWclzg2xVb4umMp3rhtV1tl9tlJerLcKevt9fCyppaqmlSSKe J6I5r2ObujmqioqKnRUU86qzhewPii47uJ7GtRLrfYrbbaDGZKalt9c6CLvstnYyGrkan7o+DZyx o70d5HcyORdiUYxk+R8AWRpRVrrhe+HW91nRfTqKrBaqV/j63PoXOd4dVYq/wv3XX2E6c6VUOYZB rhg1vp5b1qNTUEt0vNNXyzxXKCnhRlK9jVe6JrUi22WNreZOq7r1LtNUVxnDzd6zXYrmiuNaluFf XDNbZlVx4TOIysamp+I0/a2q7P3bFl1mTdIq6FV/ClRqbSt3V27XO6q2RGdJw9f90L4rP/JMN/Va Gg9QdD9LtUshxfLc2xjvl7wysWusVxp62oo6milXbfllp5GOcxeVN43KrHbdWqQLUXgZ4XdV87u2 pmeab1Ffkt87DzhXQ5FdKTt+xhZDHvHBUsjTaONjejU8N13VVVdkSp/KS5XbM/wC0cImG10Fz1A1 QvttpIrZTuSWagooahlRLWTtTrHG3sm9Xbbpzqm6NcqRriG0v9s3yienWFU+oWZ4W1umFVK26Ypd G0NwakdXN8GkzmPTkd++Tl67J1NR6O8L2gWgM1VWaSaZWuw1tazs6iu55aqskYq7qxaid75eVVRF VvNsqoi7dCRVukmntx1St2tNZj/aZnabVJZKO597nTsqJ73PdF2SP7J27nOXmViu6+IFV4VwgVGG ZZasrdxW8Ql/S1VTKpbZesxiqaCr5V37OeJKZqvjX1t5k3+U0IDH3EJxCZrqlmtfwwcMF27tdKb4 LN83iTnp8ap3bo6mp3J0fXORFRERfg+vVHI50eJmKYzltRRVcqimmM5lx+JXXLJNaslu/CVw7T00 s74nUeoGXSQpPRWCjkRWyUkSL6MtZI3mby/vOqdHI50cLtvk3uD6it9NR1el09wngiZHJVz364tk ncibLI5I52sRyr1VGtanXoiJ0Lo0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/xfI5eqqv5kRE RERJkUbl6qqdWqHpcLwfbs0f6kRMs3e90cG3zO/SG6/eR73RwbfM79Ibr95NIgj4yvfK1yWx0I7o Zu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7 yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1 +8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I 7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3 X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+k N1+8j3ujg2+Z36Q3X7yaRA4yvfJyWx0I7oZu97o4Nvmd+kN1+8n8d5OrgzY1Xv0fRrWpuqrkN1RE T5f9smkjg32yW7JLLXY9eIXy0Fyp5KSqjZK6NZIntVr28zFRzd2qqboqL16Kg4yvfJyWx0I7oeH+ R6Oy68655HYeEzSutfidHW9zoFgnmmpmRR+h3maqqXuRiSqjpERz09FyIibp12lw/eSrxXGJaTJt dsjdf7lE5szLPapXwUUT06p2k6cssqov8Hs0RU/fIboxnFcZwuy0+OYhYLfZbXSN5YKOhp2QQxp+ ZrURN19a+K+s7Qkqv1TGUKlng21RVp3Nc+HcrjyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVF95k AAAzzYNKc+ouO7KdZqqw8mHXHTqjsVNcu9Qr2lcytSR0XZI/tU2Ym/MrEb6t9+hoYAZ50c0pz7Fe LziG1Rv9h7rjGcxYo2wV3eoX98Wjtzoan4Nj1kj5JFRvwjW83i3dOpXNo4SMxzrFeKjTzUCg8w0G rGWzXPHa9Z4ahHxtbG+nqXMjermtbNExVY/lcqIvRPE2YAMm2PMuPm14DbdMKbh4xiPKaCjhtPs4 qsvppbK5Y2ozvy0bWpVuVUbzdlyp6S+O3okj1s0m1PzHXzhtzi32qC60OB115nym408sVNFTrPQx xMkZDLKsjmvka7ZrO0Vqbcy+tdHgDPOdaU59eeNvTHV222HtsSx7FLxbLlcO9Qt7CpnX4JnZK9JX c3ytaqJ61Q/tBpVnsHHxdNapbDy4ZUaWRY5Fc+9QrzXFLmk6w9jz9qnwaK7nVnJ6ubfoaFAGEOFX GuNPhb0HgwCXh1ocxqqmtuFfRU0WXUFFLaHyzv2hqeZ7o5Y3bNmR8MjnIkrmOYitRV5VJwK6j0nC dYMSpsms8esFhzhuqUNY/mW3uvySuf3dzkTm7Ps1RnNt+G1HeBuUAZxt+oXGxmt4sFji4e8e03pW V0Mt/vt5yemvELqRi/DRUlNSq2Rz3p0a6RWI31p13T72HSnPqLjwyjWepsPJh1x05pLDTXLvUK9p XMrWyOi7JH9qmzEVeZWI31b79DQ4AHGucVfPbqqG11cdLWyQPbTTyRdoyKVWqjHuZunMiLsqpum+ 226FIXbhZv10utZc4+LTXihbV1Ek7aWkvdtbBAj3K7s40dQKqMbvsiKqrsibqviczEuGq94tktuy Kfii1sv0dvqGzutt2vFvlo6tE/3uZsdExzmL60RzV/OBT2du4vNQ9MblpBqpwc4dnF3qaOotrcoT KbfHZ3yPa5jK5tLM3vUKt3a/lY3m3b6Lm7py/O58J+sunGJ8P2dabXG1ZZqJodbZrTX26urHUtPf aCpg7OemiqHtXs1jTdsLntRNurtlRGrtEAUVgeZcWWdai2qbKdG7Hpjg1BDO67RXK+QXm53SZzdo WU3dHdnTtY70nOe5yuTojUKzx7BeJLhY1H1MfpDo5Qap4NqPkU+YUcMWTU1nq7PcqlqJUxypUpyy ROc1nKsaqrWtToqrsmwQBivV/RHiv1N4arNYs/q6DLdQKnUS3ZNU2+3yUlLS2S1sn5u5xSu7JJ2w sTdXOV0jnPciK9ERVuDi/wBCcl1005s8eAXWht2a4RklBmGMzVyL3Z1fRucrYpVaiqjHNe5N0Rdn I1V6IXoAM42/ULjYzW8WCxxcPePab0rK6GW/3285PTXiF1IxfhoqSmpVbI5706NdIrEb6067p0ms WAa441xjYrxGaYaXwZ5Z3YRLhlzom32mts1C5a11QlTvP0kbs5E5Wbu6O6J031SAMm8UGEYji+rO hF9x/HaGhuWSav0lbd6yKJEnrZm22qY10r/wncrWo1qKuzU6IiGsjMesvDFr9qznNkymHics1nt+ JZH7I8bty6fsqHUUqRyRxslm76zt0ayVyKqtbuvXZC/cDtWYWTE6C159l1NlF+gSRKy7U1rS3R1K rI5WK2nSSRI+Vitb+Gu6tVem+yB34AAAADHnFv8AHJ4Uf8ev1VAXAU/xb/HJ4Uf8ev1VAXAUsT68 dj0fBHsJ7fpAACu6oAAAAAAAAAAAAAAAAAAAAAAAAVx5Lj4iemX6a/XFaWOVx5Lj4iemX6a/XFaW sLzuHwz+57/o1UAC24YAAABXenGuWJ6oZ1qDp/YLdd6e46bXKntd1lrIYmQzSzRrI1YFZI5zmojV 3V7WLv6lAsQFRWzii0urK7VinuctystJozMyLJLhcIWJTqjoXTc8HZve+REa1U2VjXK5URGruQSm 49tOIqW2ZFlWlOrWJYfd5oIqXLr7i/YWdWzuRsMr5Wyukijerm8r3xtavMi77KBNdWeF3CNbs0tW TajZVmNyslqdTy+w1LqjMeq54XufHNUUqM5pXo5ybor+VUa1Faqb72teLVT3uz11kqnSMgr6aWlk dGqI5rHsVqq3dFRF2XpuilN0uX4o/jUq8FZlOobsjZpq26Osz62NcVbR+cmx95bBzdp5w51RnPy8 vZbpvv0I5jXHbgGdWKuvWnOk+qeYSWmqqqS60NlscE89vdDK+PeVy1CRbv5HOZGyR0qs5XKxEc3c Lc0T0ixvQfS2waSYhXXKss+OQyQUs9yljkqXtfK+VVe6NjGqvNIqdGp02/lJwU5T8Wuh0/D57pt2 UvhwfsVe6aWmclS2ZJexWmWH8Ltu19DlTdFXqi8vpFf5B5QnS7C8djyDUHS3VfEH1r6dtqob7jkd HUXVssrI1dTK6fsnKztWPfG6RsiMVXIxURQNRgAAAV5rJxA6O8P9h9kWree2ywQParqeCWTnqqpU 9UMDN5JV/wDFaqJ61RALDBWPDzrdBxD6fN1Ts+JXKxY9cqyaKxrcnNSqrqWJ3ItU+Nu6RNdI2RGt 5nKrWI7f0kRLOAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK0DVQAAHTZnfI8Yw++5JNK2OO022q rnvcuyNSKJz1VV9SJyncmSePfVO4XPHaLhD0tjW56lawxOtrKaF6Klrs7l2q62p2XdkaxpKxN/wk SVU/AVFCQeTctK2bgk0to1bt2lBWVf8A+vr6ib/+oaWOjwbELRp9hVhwSwRJFbcdttNa6RqJttFB E2Nv8+zU3O8AAAAAAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYj VR/ptXm3VuydU38C8CmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw 2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ/0o/3AWv8A5/8A17zQBn/Sj/cBa/8A n/8AXvOdi/2ijsq+dKji/Xp7J+iWgA1QAAAAAAAAAAAAAAAAKLwmt9l+TYfZmrz0WDWmsrJU36JW 1dVKjUVPzRI1yKvh1LkK40Tx5tss1yvjmp2t5q0ejv8AwUTGxtT/ANJJP8pY5TwefEUTO6PlEfJ9 FwU08isU0bIop75jOfGZAAWlgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAca5W233m31Npu1DBW0VbE+ Cop540kjmjcmzmOavRzVRVRUUznjGT5HwBZGlFWuuF74db3WdF9OoqsFqpX+Prc+hc53h1Vir/C/ ddKnGuVtt95t9TabtQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFN7dybc5wq4rC0YqjRq280rhtV1 tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqKnRUU5ZgfGMnyPgCyNKKtdcL3w63us6L6 dRVYLVSv8fW59C5zvDqrFX+F+67ttV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqKn RUU6FNUVxnDy16zXYrmiuNblgGPuITiEzXVLNa/hg4YLt3a6U3wWb5vEnPT41Tu3R1NTuTo+uciK iIi/B9eqORzo8zMUxnLSiiq5VFNMZzJxCcQma6pZrX8MHDBdu7XSm+CzfN4k56fGqd26OpqdydH1 zkRUREX4Pr1RyOdHLNJdJcK0VwqjwXBbb3aipt5JppF56isqHfhzzv8AF8jl6qq/mREREREaS6S4 VorhVHguC23u1FTbyTTSLz1FZUO/Dnnf4vkcvVVX8yIiIiIkyKF27Nyep6jBYKnC05zrqkABEvAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK48lx8RPTL9NfritNVGVfJcfET0y/TX64rTVR1XhwAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGPOLf45PCj/j1+qoC4Cn+Lf45PCj/j1+qoC4ClifXj sej4I9hPb9IAAV3VAAAAAAAAAAAAAAAAAAAAAAAACuPJcfET0y/TX64rSxyuPJcfET0y/TX64rS1 hedw+Gf3Pf8ARqoAFtwwAADJHCK9kPFNxYW6VyMqW5TZ6hYlXZ3ZSUcisft8ionRTW5U2f8ACroJ qbmjtQ8wwJJsjlp2UlRcaK51tvlqoWoiNjqO6zRpO1ERE2kR3RETwREAynpVW6M51kXG23VDJKal 0+uWR0VtutzSpSNkLEhkp1kZIiKiKkyJyrsqcyN6KnQ73USs4mOC7SVuobdYcU1k0nxuOhjktOR2 tlHdUtzpY4oW01bA5Y6mROZio+Vq7om6IqoiGosX4dtEsMgyuixrTm1UdDm8VPBfqDZ8lHWRQQdh FH3d7lijY2L0OSNrWqniir1INYeArhJxy80V8tujtI+a3TpVUdPWXOurKOCVF3RzKSed8DVRfDZn QCBY9WxXLyoVTcYY5I46rQSGdjJG8r2tdeo1RHJ6l69UP35Melp6fQLI5oYWsfU6gZDLM5E6vek7 WIq/KvK1qfyIhoyPSnAYtVZdbI7Dtmk1iTGn3PvU3W2pOk/Ydjz9l+6ojufk5/VzbdBplpTgOjuP z4tpxYfNFrqa+oucsHepqjmqZ3c0r+aZ73JzO67IuyepEA8u4XRUfBNiVyuOzcetPEmypviv/co7 c2rmR6v9SM53R+PTdUNOeVavOJxcPWOWy6VFNJdLhmdols0fMjpFex7lllYnjypE5zVd4J2jU/fJ vbWpGimO6bcOOYYHovoZZ8yprjNNc58PutzmWG6SzTNfUKks7nubJ0V7ERURHsby8q7KZGv+iuJ6 r2rHdH+H7g71J08nut7tc+U5JmtBUww2m00syTyU9PU1c8rpd3sZyxQKjHK1FX1bB6aAADz98olx XcY+iUVXbdLdIn2HEVbyrnjEbc3Kip6o0RWUa7rtvO1yr4t2PHi+ZZk+omXeyLPchueQ3S41DO9V lxuO88yK7bZZ5uZGJsuyK70W/Jsmx/qGmhiqInwTxMkikarHse1Fa5qpsqKi+KKhi3iR8lTw9619 6v8AgdP7W+UTcz+3tMCOt071/wC+0e6Nb/LEsa9d1RwHa4nrJxm4di9oxPFfJuxUdms1DBQW+ni1 ds/JFTxMRkbUXs+qI1qdTtvdD8dn5Or63bP9mWTwpYxq9gGjdp011rWiq77iH+w9PdqKp7aC60Ea J3adOZEe1yRqkTkkajldEruqORVuEDKvuh+Oz8nV9btn+zM/8BWs3FjinCdg1g004L/Z3jdL5z7l kHti221985rlVPk/sWZiyR8kjnx+kvpdnzJ0ch6VGU/JbSRv4FdNWse1yxreWvRF/BXzvWLsvydF Rf5wP17ofjs/J1fW7Z/sz+LxA8eNQnZQ+T2p6V7vCWfVi0yMb/K1ke6/zGqwBkarn8pZqhJ5rp7X pdoxbXN+GuC1L79ck36fAsROw3ROvpInXbZfUWdw8cKuD6BOuWUOuNbl+oeRcy5Bmt6+EuVwVzmu WNHKq9jBuxm0TV2+DZzK5WtVLrAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/ANir 610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdi xGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADP8ApR/uAtf/AD/+ veaAK99oDST+5L/T6n7Qo4qzduXKa7eU5RMa5mNuXVO5VxFmu5VE0Zas9vu6p3OuB2PtAaSf3Jf6 fU/aD2gNJP7kv9PqftCLicV0afin7UHJ726O+fJ1wOx9oDST+5L/AE+p+0HtAaSf3Jf6fU/aDicV 0afin7Tk97dHfPk64HY+0BpJ/cl/p9T9oPaA0k/uS/0+p+0HE4ro0/FP2nJ726O+fJ1wOx9oDST+ 5L/T6n7Qe0BpJ/cl/p9T9oOJxXRp+KftOT3t0d8+Trgdj7QGkn9yX+n1P2g9oDST+5L/AE+p+0HE 4ro0/FP2nJ726O+fJ1wOx9oDST+5L/T6n7Qe0BpJ/cl/p9T9oOJxXRp+KftOT3t0d8+Trgdj7QGk n9yX+n1P2hUmrun+E2XP8JwvFbL3R1ydVV90VKmWRVpIWJys9Ny8qPeqpumy9PEjuU4m1TpTTT8U /as4Tg3E4y7xVvRzymdczlqjOf3ep2Ol/wDuGtn/AD3+ueSk4trtdDZaGK222DsaaHm5Gcyu23VX L1cqr4qpyjSzRNu1TRO2IiHuMJaqw+Ht2qttNMR3RkAAlWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAHGuVtt95t9TabtQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFM54xk+R8AWRpRVrrhe+HW91nRfT qKrBaqV/j63PoXOd4dVYq/wv3XSpxrlbbfebfU2m7UMFbRVsT4KinnjSSOaNybOY5q9HNVFVFRTe 3cm3OcKuKwtGKo0atvNKotcuJXJdaskl4duErI4HzywRyZdqBRvSajsFFKm6RUsjV5ZayRqry8q+ h8qORzo5ppLpLhWiuFUeC4Lbe7UVNvJNNIvPUVlQ78Oed/i+Ry9VVfzIiIiIiUv5N622+i4PsJq6 OhggnuEt0nq5I40a6eRLjUxo96p1c5GRsbuvqY1PBENNG965NVWXNCDg/C0WbcXOeYAAQuiAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAACuPJcfET0y/TX64rTVRgv3ujg2+Z36Q3X7yPe6ODb5nfpDd fvJd5TR1vOeiL++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvm d+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL ++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2 +Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3uj g2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0d Z6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3ujg2+Z36Q3X7yPe 6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQGC /e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfvI 5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDdf vI97o4Nvmd+kN1+8jlNHWeiL++PHyTHi3+OTwo/49fqqAuApLTngt4aNJcyt+oOn2mvmq/2rte6V fnm4T9n2sT4n+hLO5i7xyPTq1dt902VEUu0r3q4uVZw62Aw1eFtzRXtzz1e4ABEugAAAAAAAAAAA AAAAAAAAAAAABXHkuPiJ6Zfpr9cVpY5XHkuPiJ6Zfpr9cVpawvO4fDP7nv8Ao1UAC24YAAAAAAAA AAAAAAAAAAAAAGDvI/5PLNw3sw2rcqLSVNRc6RHfvopaqeN/L+ZHw/5Xm8Tzf8m3V+xXTjRG978l Pk1BkFgqV9XO261c0O/51cnKi+JBeq0NGev56nS4OsxiIvW+fQmY7aZir5RMPSAAE7mgAAAAAAAA AAAAAAAAAAAAAAAKa1Q1tv8AgvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2 UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZwrKr2T8QeYXrfngxu30lgpnermdvNN t+dHrspoueeKmhkqZ5EZFE1Xvcvg1qJuqr/MZh0WfLc8auGY1LXJPlV5rrw/m8UR8qtan8mzE2T8 5Sxc66aff3f/AF6HgG3lF69uiKffVOfypnvT8AFd1wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AfxVREVV36deibnBsd+seTWyG9Y5eKK6W+oRViqqOds0T9l2XZzVVF2XovyKBn3ydHxNtPv0t+ta s0iZt8nU5rODPT973I1rUuyqqrsiJ51q+poSyX2y5Jbo7xj11pLlQSueyOqpJmyxSKxysdyvaqo7 ZzXNXZfFFT1G1z157UGF9hR2R8nOABqnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/EssUETpp5WRxsTmc 97kRrU+VVXwA/YOBW36y2+x1GTVl0porTSUr62atWRFhZTsar3SK5OnKjUVd/kQrnTfij0I1ezGf A9Ns+gv14paOSvmjp6SoSJsLHsYq9s+NI3LvI3o1yrtuvghnKZ1tZrppmImdcrVK48lx8RPTL9Nf ritOq1e1tzbT3IqXFsK4fs0z2qqqJtYlZbUigt0SukezsX1Mi7NkTk5lby9GvYu/XpUvC1qLxk8N ug+MaLpwRrkSY8lYvnJdSLXRLP3ismqf3FWycnL2/L+Gu/Lv032Szh5inOapcbhWmq9NMW4mcs88 onqejIMee634yfyff1r2r7Ee634yfyff1r2r7EscZRvhyeS3+hPdLYYMee634yfyff1r2r7Ee634 yfyff1r2r7EcZRvg5Lf6E90thgx57rfjJ/J9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GDHnu t+Mn8n39a9q+xHut+Mn8n39a9q+xHGUb4OS3+hPdLYYMee634yfyff1r2r7Ee634yfyff1r2r7Ec ZRvg5Lf6E90thgx57rfjJ/J9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GDHnut+Mn8n39a9q+ xHut+Mn8n39a9q+xHGUb4OS3+hPdLYYMee634yfyff1r2r7Ee634yfyff1r2r7EcZRvg5Lf6E90t hgx57rfjJ/J9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GeZnCilRQ8BOmmW0LFdV4tdKq8won ivZXmqRyfycrlVf5C8Pdb8ZP5Pv617V9idBwpaRZfgvCPYdItRbMlqvsVJdqaspFqIp+y7xW1Mka 9pE5zF3ZKx3Ry7b9dlRUK2KmK7eVM63Y4Dorw+Liu5TMRlzx1xnHc25R1dPX0cFfSSJJBUxtmjcn 75jk3Rf8in2K14ccgkyPRbF6mocq1FHSLbZ2u/Ca+ncsOy/n2Y1f5yyizbr06Iq3uPirE4a/XZn9 2ZjunIABugAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdix Gqj/AE2rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kX p4bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEA19yJcW0ay 27Mk5JPNslLE71pJPtC1U/OiyIpAsNsyY9iVmsfLyuoaGGB6fK9GIjl/nXdTsOKSo77YsSw1i7rk GTUkc7flpouaSRf5lRhyTnX50r09Uf59HreDKOLwFM9KqZ90ZRHjmAAjWwAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAADyu4yI9WuDHiIl1M0WyivsWPagvfdXUsWz6F9c1U71DLA5FjfurmyIqpuiTK jVTlPVEpDjI0Ij4gtCr3iVHTNkv1vb51sT9vSStiaqpGi+pJGK+P5E50X1ElqqKatexUxlmbtr8H rRrh5QaO5HrprxLg/CZYc0uNHib6mWBaCj+CiZTSTSVNVPUcmyzI1HyORr1VvotRERfH26xXGbLh eM2rEMcom0lrstHDQ0cDfCOGNiNan512RN19a9TC3kq+H+TGcUu+u+S290Vyv7n2qzNlZs+Kiift PJsvgskzOX5USH5HG/Ta/VE1ZQg4Ns1UWuMr2z8uYABC6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAA7Ojxu9V9MyrpKLtIpN+V3aMTfZdl6Ku/ih9vYhkX8Xf56P8AaNtCqeZDOJs0zlNcZ9sO mB3PsQyL+Lv89H+0PYhkX8Xf56P9ocXXuljlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6 TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/n o/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9 iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4 u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6Y Hc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6Tl Vjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/ 2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iG Rfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/ z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc+xDIv4u/z0f7Q9iGRfxd/no/2hxde6TlVjpx3w6YHc +xDIv4u/z0f7RXVuu2tlxzGisb+GzJrbY5pXsqr5cL9ZEZTtRjla9IIKyWV6OcjW7IiKnNuqJsqG Yt1zzNasZh6dtcd6WAiGsmH8VL4bVBoDb8BjlkdMl1nyyWoVsTNmdksCU7urv3Tfm6fg/nJDptgm s1FhlDS6rS2a5ZO1ZVramzp2NI9FkcsaMa93Mm0asau/irVX1jiq8s8mIxliatHSjtzjL5ucdPke Y4jh1Mlbl2VWex07t1SW5V0VMxdvH0pHInQgWnHBxm2EZnQ51f8AXfVfL6ug7bkt92yCFbXJ2kTo 1V9K1qIqoj909JNnI1fUTnUHhmwvVettVw1J0ytORzWRJm0PnBI5WQpLyLInIruV2/Zs/CRdtum2 6754uYnZPcxGLomnPSpieuqPo+1my3GMjx2PLscvtFdrLNHJNFX0EyVMMrGK5HKx0e6P2Vrk9Hfq mxVemHFnpxrFl9PiuA49m1dBUxSype5cenp7YxGNV2z5pOVWq7bZvo9VVE9Zc1Dg1Dp/aKLH7Njd vsVrga5tJQ0EEUNPE3fmcjI4tmtTdyr0ROqqp9DWYyziYTUzNyIqoqjLq159kqz1czDXPHaq30Gj 2jtuy9tXE91VX1+RRW+GheiojWrErFfLzIqru1U22/kJNjjs/uuAQey2K22PLqmikbUJb3LU01JU qjka5ivT4RG+iuy+PVCTAxnqbRTOlM5z2Kb0r0m10xXK0ybVDiXrs5p+7SQ+aWY3SWylR7ttn/Au VVVu3RfXuu52GrfDFo3rpfbfftUsdq70+2U/dqem851NPT8vOr93RwvYjnbqvVfV0LUA0pzzY4mj R0JjOOvX83T2LEMZxrFaTCLLZqensNDRpQQUCoskTaZG8qRKj9+ZvL02XfdDm2y0WmyUraGzWyko KZn4MNLC2JifyNaiIcsGG8REbAABkAAAAAAAAAAAAAAAAAAAAAAAAAAHB4aKnzbcNQsGcu3mrIPO MLF/eQVkaPY1Pzbsd/lLxM96fVHmLiQq6VV5YMnxlJP/ABqmmm22/mjVTQhcwk528t0zDz/DtGjj Jr6UUz4ZT4xIACy44AAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9nPCja zuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3V uydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoHWKo88a 9YTYt+Ztis9feHt/4ZyQNVf5Fb0O7IpUz+euIjObjvzMstvttpid6vTYsz0T+Ry9SVnKmdKuqrr+ Wr6PcW6OKw9m3upj+r8X/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnnUDUDP9d8/rOGvh ruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOjagagZ/rvn9Zw18Ndy7pVUmzM3zdjeen xundujoIHJ0krXojkRqL6HXqio50ertFdFcA0BwCg0605tPdLdSbyTTSLz1FdUO27SoqJPGSV6pu qr4dEREaiIlqzZz/ABVOLwhwho52rU6+eWObnhuV+T0uNM1Lject4fLnKyOasqv7IuGH1siojpZV aidpRyvVXKqInI5y9N9u10rbblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKioXDdbVbL7 bKuy3q309fb6+F9NVUtTEkkU8T0VrmPa7dHNVFVFReiophLJ8YyPgDyNa2ibcL3w63us6p6dRVYL VSv8F8XPoXOd49VYq/wv3Xa9Z0vxUoOD+EOLytXZ1c07v0aVBxrbcrfebfTXa010FbRVkTJ6eogk SSOaNybte1ydHNVFRUVDklN6EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWViH+52k/5z/WO Ot1PTVNcLrW6LuxVuWq6LuTsobUutzW9o3te0SmVJVXs+dG8qp6StVeiKi9liH+52k/5z/WOO5Ol b9SOx47Fe3r7Z+bC9Trp5QyDiGo+G2KHh2qMiqcXflktXFQ3xaOmo0qFgRsjln50er0TZEaqbOb1 6nfcQGqvGDpPoRCmY5Lp5a9RMxzay4ri9ZhdunlhhbUyosnaR3HtWvkc2OVqejsiLunpbKnM4ef+ z3j14jtSV9OlxWjsmEW+RevhF2tWxF/NNCiqn98hwONfGqfWjiP4ceH6qqqqO21V2uuW3nu0zopG U9DTtWJEe1UcztFWaNHNVFTm3RUXqm6BqPH9VtLsqv8AVYli+pWLXq+W9Hd7ttBeKaoq4OVdnLJD G9Xs2Xou6Jsp0tPV3O6a71cVs1wtE1osmPRwXPT6npKSStgrppe0iuM8/OtREx0PoNi5Gsd+Huvg Zo1i0v05xXjY4X8Z0nwaw4rcKZchuNxmstvio182wUTUZFL2TU52ucsjE5t9uZ38JTi6K4Rddfbn xmZLZMgfZ67OsjqdP7Zdm7r2DbZQrTMkbt15Ph03VqoqonRd0A1bR66aJXDJEw236xYPU390vYJa ochpH1iyb7cnYpJz82/q23JwedlrsOmWm+C4lw6cZPB5asWtdRLQ4/Q59jiQ1Fsra9qtSKokq4Ej q6GWZ7N1c/0lVXq5UartvQ+ngZS08VNEr1ZCxsbVkkc9yoibJu5yqrl/Oqqq+sDrMdy7E8vp6yrx PJ7Te4LdWS26skt1bFUsp6uLbtYJFjcqMkZunMxdnJum6IfLFM7wjO7K7JMHzKx5DaGSPhdX2q4w 1dMj2fhtWWJzm7t9ab7p6zAOL5XfsTwXX3Q7BatafNNTNf77i1gVn4VHBcIqeWprNk6oynpUnk5k 8HIz5Tr8WqqrTvQfUvhR0hkWjyDNNar3pzjbUXmfQ218NNLV1bkTZeSGjdIquTqjntUDaV+zW15/ ftOZNLeJPFLXR3K4T3FaCiWgucmXUFMipPTUr3SKrWMc13aSwo5zeVU3bspn2u4o9TaLEeMDU92V N8xabXCTGMKh7jTcluudPTdlK/m7PmnV1VNA5Wyq9E22RERdj8YfjeJYtx0QY5ZoUpcP4fNGIaGJ vRVp6mom5le5f4TqVFVy+Kruq+JQVPbrhf8AyeuC4zXNcy78S2sED6+JF9Nzau6PkV6r8nJRQqq/ I5APSbRWqy+u0ewiv1Bubrhk9Xj1vqbzUugjhWWtkp2OmXkja1jU53OTZrUTp4HYZnqVpzpzBDVa hZ/jeLw1Kq2GS83WCibIqeKNWZzUX+YkTGMiY2KNjWMYiNa1qbIiJ4IiGFLRfbZxH6sZTrlo1wjW bUakp5PYxFled5Qymopu6Ls9LdRPp6ns41V26yojOZVXf0legG2rTk+N3+xR5RYcgt1zs8sTpo7h RVTJ6d8bd93NkYqtVE2Xqi+owTDxS8Qd24Jce1Uoc3dT5vqxqVHjuJVi2qiV1BRTXF8UcLYVh7OT aKlmTmkY5yo/fdVRqpFtCsxrsF4SeL3VCCzW7F7XJkd9oLPZbTU9rbrfW91ZTq6ldyMRYnTTxIit YxF5ERGt22SV0+Eeb8l4FuHfsdksVvmza8xbdIamjt7JY3qn56mSZE/OoG48y1K0503poKrUPUDH MYgqFVsMt6usFE2VU8Uasrmoq/yH6n1H08pcOdqJU55jsOKMjSV19kukDbe1iuRiOWpV3ZoiuVG7 8226oniZK4NMHxLiKuupXFBq3jlsyq937LrhY7FHd6VlXFZ7JRuSOCngjkRWxqqq9XuaiK7xXq52 9N3HFaCDBuP3AsFoo6LT+yLSVdqt1M3lpKS5RUkk9xbCxPRZtJDHu1qIiI1iIiIgHo7lGe4NhGPp lmaZpYrBY1WNqXO6XGGlpFWT8BO2kcjPS9XXr6j75Fl+J4hR01xy3KLRZKSsqoqKmnuNbFTRzVEq 7RwsdI5Ec969GtTqvqRTzq4o62fiM0kq8XpJXTYxo1pLDmd6Vq7snyGttv8AYEDvlWGlWoqOngss e5dduqfdN8S2B2ZV7zhuh9ht+V3X1xVWUV9Mi0ES+pVp6dXToqLu10iIqdQNgmJtHddOO/iOsN31 G0lpdBbdh6ZBcbZZvP8ASXlayelp5lYyVywTLG7dOiqnLu5rvRRNjTHEJm/tbaE6g562bs5bFjVx radd9lWdlO9YkT86v5UT86mSeEnhs4sse4bdPocG4vaHD7JcbLDeaWyO02oq99ElbvVOY6okqEfI 7mmVVVyJ47bIiIgGgtP7/wAUOH1tzybiryrQu0YPQW98j63H1uNJJBU9pGjHTTV0vYsh5VkRV8eZ Wbesupl2tctrbfIrlSvtr6dKttY2ZqwLAreZJUk35eTl9Lm3226lD5vpHqlXcKeqWnerOq0epF+v ViuyUVyjx6CzthRaP4CFIIXvRytmYr+dV3Xn22TlQz3U6oZDrJwl8P8Awx6dXSSLK9X8aorbe6+F d32vH6GJsNzq3epFk7J0LUdsj1fI1FRUQDb7dU9MX4ZHqOzUbF3YnMirHfku9OtueiOVi7VPP2S7 Oa5v4Xiip4ocrD8+wXUO2uvOAZpYcmt7H9m6qs9xhrYWv8eVXxOc1F/Nueft9td8yHi3vOmuI8NE uq2nfD1j9msNjxfz3b6K30FbV0rZkrpoq17W1EvI18SLs7bk5l2cqKtnaHaYaw0nGEursPDK3RnD Llh81pv9JBfbVUwXOvZOj6eZYKKRdpEaqt5+TwaqKvpdQ2FkGRY/idmq8jyq+2+zWmgj7Wrr7hVM p6enZvtzSSPVGsTdU6qqJ1Ko4auKTAOJix3m84pcbPFLbLrW0sdvivEVTWuoIp3RQVs0DUa+nbOj Fe1rkVNttnO3Ow4rsmt+G8NOpuT3Kmp6iOgxe4SQxVEbXxvqFhc2BFa7dF+FWP8AnMcZhhcmnPB3 w5cPeLRx45dNabnj+PZTdKGJsFY6hqWLU1saytTmc7ml5Oq9Wq9vg5QN12bWnRzIsjXDsf1Zwy53 9rnNW1Ud+pZqxFbvzJ2LHq/dNl36dNiZmGfKD6K6KaUcH1wuenenNhxnI8auFmTEa2z0EdPcIK7v 0DU7OZido96x9qq7uVXbK5d3Iim27T5w81UXnbl793ePvPLtt2vKnPtt6ubcDpc01N0304ipp9Q9 QcaxeOscrKZ96u1PRNmcm26MWZ7eZeqeHylLt1kzDKeOCzaTYdlcEuB27Td+WXeOmhp5oq2pnq+x ptp+VXoiMVJE5Ho1yL13K34VMKxLiN1V1u4iNU8atmUVEOaVmEY1Dd6WOrittpt7WonYxyIrY1lW XmeqJurkd19J2+f6O80/D3j/ABq6zaPtShist6ocExNKZfg7VK+pVlUymT8GNsU1Yj2MTZrVYiIm 3QD0juGs+j1pyluDXXVfDaPI3vSNtnqL7Sx1znr4NSBz0kVV36JykM4nuKDBOGPCG5DkNdaau+V0 8FPaLDU3eKhmr1fPHE+RHORytiibJzyScitajevVUMlRaHZ3Bw/V+jC+TY77dLjZpaapyWuzDHZr hUXR8S73F87pllWTtl7RPT6fgpsnQ7HNcHye/wB74JNA9YrRTVuXUs8t8yRKpYauRjLRRNekU0rV c2Rr1VWu9JzXuau6r4gbjdqdpszDotRH6hY03FJ2dpFfVu1Olve3mVvM2p5+zVN0VN0d4oqHIw/P sF1DtrrzgGaWHJrex/ZuqrPcYa2Fr/HlV8TnNRfzbmDc+qcr1J41srxqz8NXtr4RofarZbrXjEV2 ttttlBcq+BKha6Snq3tjmk5e0iaiNcjUj36KrVWd6K6b6t2vi8l1ldw0x6K4PW4ZPbMip4r9aqim uNbHOkkE7oKKRdpEaqpzqz8Frt19LqGpajWPSKkqXUVVqniEVQy7+x90L73TNel09FO4q1X7949N vwP4fpJ06oce5656JWWmqK28axYRQU9Hc5rJUS1OQ0kTIbjDy9tSPc6REbOznbzRL6beZN0TdDKf k99P8JvGlGT8WGeWOjr7pnOW37L6WruNO2Z1spm1bt3QI9F7F6vp1e57dldyRbrtG3aMcKmnWn9D wO5/xK6nYfbL1ec4pMoy6uddaZlQsNNzVCtgi50Xka/su0Xl2VzpE335W7BuHItWNLMP82ey3UrF bJ56a19s843mmpu+tXbZYe0enaIu6bcu/ih0mudbckweGz45rhZ9K75f7nR220X+4UtJV9pUvkRy UsEFU9sc00zGPY1vpO6qrWqqdMV2PSnBNMvJS3XNM6xyhvWQXzT11V5yukDaiogWsj5bbFE96K6K ODt4OzYxURr+ZyIjnOVZNkFlu10zvga0Jvk8tVV2G1tyy9rKqq5k9rtUKQPdv1VVn7Ru69dwNmXf VDTTHqy522/6i4zbaux00VZdIKy708MlDTyLtHLO1z0WJjl6Nc5ERV8Dm4nmuG57aG3/AAXLbNkd rc9Y21tpr4qynV6bbtSSJzm7punTf1mPuHvTjEtbuL/iI1wzKz018pMeySjw2yUtbGk1JBU2+lbF Uzdk7diytVURrlTdiSy7fhqVDU6h12h2JccmrWktPFZaSHLLbi1ip6GNsUNFdGbUlXURNanK2RH1 SSeH4TGgeg9w1n0etOUtwa66r4bR5G96Rts9RfaWOuc9fBqQOekiqu/ROUmR5yxaHZ3Bw/V+jC+T Y77dLjZpaapyWuzDHZrhUXR8S73F87pllWTtl7RPT6fgpsnQ2jw3WPUHGNA8BxzVVJEy212Cko7s ktQyokbPHGjVR8rHObI5EREVyOciqiruu+4Hb6h//V//ADv/AO4Q4mOof/1f/wA7/wDuEOOff9pL 1XBv7LT7/nIACJeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABDMlqPMeq2mOUb8rUvEtnevqXvk SxtRf503Q0sZb1yWSjwVMhgarprBcqK6RonjvHO1N0/mcpqGGWOeJk8L0fHI1HscngqKm6KWMJOu qnsn6fRyuHaM7dm7/NT3Tn/7P2AC684AAAAAAAAAAAAAAAAAAAAAKa1Q1tv+C8RmiOjVutNvqLZq f7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s 7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAfCuq4rfRVFfOvwdNE+Z//AIrUVV/6gzETM5QzTprN51vmf5Kq7+cssrmRO+WCJUZH/wCzcnRX +g8MrdMLVWVH7vXvqayVfldJO9d/8mxYBx7c50xO97/FRFN6qiObV3avoAA3VwAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAzzqBqBn+u+f1nDXw13LulVSbMzfN2N56fG6d26OggcnSSteiORGovodeqK jnRtQNQM/wBd8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj1dororgGgOAU GnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjUREtWbOf4qnF4Q4Q0c7VqdfPJororgGgO AUGnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjUREnYBbcEOJdbVbL7bKuy3q309fb6+F 9NVUtTEkkU8T0VrmPa7dHNVFVFReiopywBgfJ8YyPgDyNa2ibcL3w63us6p6dRVYLVSv8F8XPoXO d49VYq/wv3XRltuVvvNvprtaa6CtoqyJk9PUQSJJHNG5N2va5OjmqioqKhcN1tVsvtsq7LerfT19 vr4X01VS1MSSRTxPRWuY9rt0c1UVUVF6KimEsnxjI+API1raJtwvfDre6zqnp1FVgtVK/wAF8XPo XOd49VYq/wAL91rXrOl+Kna6/B/CHF5Wrs6uad36NKg41tuVvvNvprtaa6CtoqyJk9PUQSJJHNG5 N2va5OjmqioqKhySm9CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACysQ/3O0n/Of6xx3J02If7n aT/nP9Y46vN9V8B05u2LWLMr93CvzS6tstjgSlmmdV1jk3SP4JjkYm3VXv5WJ63IdK36kdjx2K9v X2z80N4dOH72hos+qKzLfZJdM/zO4ZfW1q0HdOyWp5OWmRvaSczWcrtnbpvzr6KH1m0F75xR0/En cMq7dtvwx2JUFj7jslO99X28lX2/aLzOcirHydmnTrzL4FtA3QKkn0EWt4o6fiTr8s7dtvwx+J2+ x9w2bTvfVdvJV9v2npOc1Vj5OzTou/Mu2xB8I4N58O4dV0Up9Zcio7+6/wA+UOy+xxrbqh9yfVLO x7qftJGyRonIx0T3Oa9Gb+iu3LpMAZlufCdqlqZcLBTcQ/ErU5xi+P3SmvTLDbcTpbLHXVdO7mhW qlZJI+RiO6qxnI1fzbJtpoADO2n/AAe2zC+KDLeJKvzaW7+fX1NRaLC63pFFZqqqip4qqobL2ru1 kkjpWM35GbNc5Ou+40v4Pbbp9xJZpxD3LN5b5JkVTWVdmsz7ekMVknrEgbWStk7V3aySMpYGc3Kz ZrXJsu/TRIAz5JwpVr7nxB5BHqTyXjXahhtjKvzRv5ipoqGSkia1O3+HVrZVdvvHuqJ06Hxh4QKK BOHq3x5vtaNB4XOdRea+t8q0o2QRVCv7XanVsjXy8vLJur1bum3MuiQAMwaa8HWaaSUtywDA+Iq8 WrS6vudRcI8cgscCXGkjndzS00N0V6vjjcqqnM2JJGoqq17XemafAGN6Pye1woeHrLOGWn1tX2GZ DkdPeaSNcaYk9FSsq0qZaR8jahFnWRzIUSReXl7Poxd9ku1dAmTcUFPxH1eUNljt+FLiFusLaDlb Sq6r7d9Uk/adXKm8fJ2abJ++XwLbAGYqLhG1I08v+UP4e+JKuwDFsuuk97rbBPi9Ldm0dbPt20lF NK9qwI7ZFRjmvaip0QmmM8LGEYVw+ZXoHjFyrkjzK33WC8X24r3qtrq6vhfFPXVC7t7WReZF2RWp s1E3TxLpAGcNMeDW36dcLuY8PEudy3e65xbrnR3XKZbajHyTVVMtLDKlN2q+jBC2BjY+12Xsuit5 uky4XuHqg4bNMW4M3JZclu9ZXz3S832al7vJcaqRURHrHzv5GsiZFG1vMqIkafKW6RHVHVnTrRXE ps51RyqksFkhlZAtTO171fK/fljjjjRz5Hrsqo1jVXZFXbZFAjnE1ovW8Q2iGS6OUOY+xd2SMp4Z Lp3DvixRx1Ecr2pF2kfNzpGrPw02Ryr1Kns3Dhxo4/aKGw2jjxoaehttNFSUsKaTW5UjhjajWNRV qd+jURDRmD5rjeo2KW3N8QrZquzXeLt6OeakmpXyM5lbusUzGSM6ovRzUX1negQnSfE9SMUxF9l1 a1Sj1DvT6mWR11SwwWlvYORqNh7vC5zdm7OXmVVVeb5EQp/hE4KrRws1N4utVnc+ZXSrp22i1VVR b0pPNFnbNJOlDE3tZFVFnlfI9+6cy8nopy9bp021XwHV603C+6dX7zvQWq61Nlqp0pZoGtrKdUSa Nvasar0aqonO3di+py7KS0DPufcL+WVGr911w0L1sq9NskyeipaHJYpLFBeKC7Npm8tPK6CV7FZM xnoI9r/wU22Td3NNtE9HbrpXT3y45VqhkeeZNk9Wytu11ur0ih52M5GR0tHH8DSxo396xN1/fOXZ qJZgArriH0aoOIPRjKNHblfKmzQZLSsg7/TxpI+nfHKyVjuRVRHt5428zd03aqpum+5AMq4UrpqR oljum2purtwumXYhc6e9WHNLZaYLbUW+uplVKaRlM1XMVGtXlc1XLzeO6KjVbeGR5TjOHWuS+Zdk drsduiVEkrLlWR00DFXwRXyKjU/ynT4Zq3pTqNLLT6e6m4nlEsDeaVlmvVNWujbvtu5Inu2Tf5QK doeFPNcxy7Gcn4kdeqvUykwyubdrLZKfHaey25LgxFSOrqY4nyOqJGbqrUVzWtVV9HZXIujgAMu2 Hg5z7T3Lsul0f4l73hmD5ve57/c8dgx+kqqinq6jbvDqOtmVVp+ZERE+CcrURu26puffTjgRwDEe G/NeGzKsgqsis2cXitvFbXMgWmqI5ZnROhc1XySq6SFaeFUe9V5nM3cnVUNNgDMtFwsa33imtOLa o8YWT5Fh1pnp5lt1ssVPZrhXNgc10UdVcYZHTPbu1vMrEjc/xVd+pI9Y+GvI9Qda8I10wTV2owu+ 4hQ1NqljdZIbnFW0U7kWRjWyvakT19JOfZ/i3p063uAM+59wv5ZUav3XXDQvWyr02yTJ6Kloclik sUF4oLs2mby08roJXsVkzGegj2v/AAU22Td3N3GJ8PWRY7p5n9hvGtOR5LmOodHUxV2S3WNFhpJ3 0zoIn0tvjcyGCONHI7s2Kiu22c/o3lulVRqK5yoiJ1VVIHDr9oTUX5MVp9a8DlvbpOxS2sySjdVK /fbl7JJOfff1bbgRfHuHf2J8KLeGTHsw7rI3Ep8Zbf8AzfurZZ4Hxy1aU/ap1V8j3oztOiqicy+J 12T8L/nbhAj4UcfzjzM1mNUWOLfvNnbK5sXZJPKtN2resyMk3b2norL4u22W9gBSeu3DRR6zaBUH D7R5UuP2SnfaYamRKDvK1FFQyRvSn5O0Zy86wx+luvLt+Cp2T9BG1PFDBxI1uUpMygwt2I2+xJQc raZzqvt5Kvt+0Xdzk3j5OzTp++XwLaAFS8NWgvufMMvWN1GV+yS45Dktyyi43LuPdO2qat6OcnZ9 pJtytaxu/Mu+2/TwIVh/BTiNv4fs70D1ByWfKKbUS+3HILzc4KNKGXvdTMyVkkbFfKiPidDCrVVX Iqxpumy8po8AZlouFjW+8U1pxbVHjCyfIsOtM9PMtutlip7NcK5sDmuijqrjDI6Z7d2t5lYkbn+K rv1NNAAQ3UP/AOr/APnf/wBwhxMdQ/8A6v8A+d//AHCHHPv+0l6rg39lp9/zkABEvAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAjWpdu87ae5HQI3mdJbKhWJ8r2sVzf/aiFtaRXfz9pbiV3c7mfUWa kWRf/CJE1H/+8ikGqYI6qnlppU3ZMx0bk/MqbKcvhUrZKnQ+xUc67z22WroZfzLHUybJ/wCirSXD Tley3x8p/VS4Xp0sBFXRrjxifthbgAOg8oAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9t j029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+ 3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAABENX7l5o0qzC4o7Z0NjrVYv9+sLkb/7VQl5VfFHXLb9Bsslaq80sEFOiJ4r2lRGzb/I 5SO9Vo26p6pXOD7fG4u1b31Ux3zCGaa0Xm7T3G6NU2cy10yuT++WNqu/9qqSQ49upUobfTUTfCnh ZEn/ANy1E/8AxHIOZTGURD19yrTrmrfIADZoAAAAAAAAAAAAAAAAAAAAAAAAAAAAABnnUDUDP9d8 /rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj0K9jZGOjem7XIqKn5lMxYfdbl 5PbLa1Vop7pw+5fdFq6yeOJZa3D7jMrWrLI5EV89G/ZqKq7uZsnrTaWWzFM1fiUOEa71FnO17+qG xtFdFcA0BwCg0605tPdLdSbyTTSLz1FdUO27SoqJPGSV6puqr4dEREaiIk7OJarrbL7bKS9WW4U9 fb6+FlTS1VNKkkU8T0RzXsc3dHNVFRUVOiopyzoPLMA6LaXZRxGaycQUuV8SGt9ip8S1CrLTaaHH M4qaKkp6bdzkY2JUe1Eb4IjURETpsTC45BrNwX6tYDZMx1ZvepmkGpF6ixaOrybs5Lzj91mRe7K6 qY1veIpOVd+dE5UY5URFT0+fwK/22+Kf/wA6tZ/1OOq41cltGtGrmjHCzgdbDdsjp86oMwyNtI9J fM1roGv7R1QrekT3pKvK1VRVVqJ0527h99es6yrPOMWzcMd31tvOkuFvw9Mhiq7JVxUFxyK4OqVi SmhrJGr2aNY1y8jPSXkf4+irJhbeG/XjSjUXFMk0g4jMuynGXV6Q5dj+o98kubJaByelLRT9i6SO dvi1qqjXLtu5Go5q9zqbPwocRGqNx4YtX8Ytt6yrH6KG509JdqV1NI+GdqKrqCpRWyO2Tl5+ycmy psu6tXlz1rbplT8Cl707ynhx1Yy6kdkGX2+wyab3O9PuVBdaSd6tk7vBKqyRvb0TtN125m7K1duY PQk4l1tVsvtsq7LerfT19vr4X01VS1MSSRTxPRWuY9rt0c1UVUVF6KinLAGB8nxjI+API1raJtwv fDre6zqnp1FVgtVK/wAF8XPoXOd49VYq/wAL910Zbblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2u To5qoqKioVFxK65ZJrVkt34SuHaemlnfE6j1Ay6SFJ6KwUciK2SkiRfRlrJG8zeX951To5HOjnel mmmMaPYDZtOMOinZabLB2MKzyrJI9VVXPe5y/vnOc5y7bIm+yIibIUsRFMTq2vRcFV3qqJiv1Y2T /nMlYAK7rAAAAAAAAAAAAAAAAAAAAAAAAAAAAHU5FluKYhStrssya02SmdvyzXGtjpmLt47Okcid N0/ygmYjXLtgdVjeVYzmVjgybEb/AG+92iqWRIK63VDKmCbs3uY/kkYqtfs9jm9FXq1UKm034u9M 9XMzocP0/sGbXOKuSZUva45UQWuFI4nSbyzyo1Wc3Jyt3b1c5qeszFMy0m5RTlEzt2Or477lqreM J0p0TwK5Y5Bb9U8tpbFXw19NPJUP7OpSo5+aORqJSt7JO2aiK9yOREVqb79Vr5f9YLpxg8OuBS2L H8rz7FcfveT1VNb1moLKlTUtdSw1MzpFllip4exV6/hvc5OVqbvTbsdes3xvE+LzhpuGpNXPa8Vs tDkdXSVi0c00NRdqlvd4oPgmuXnbsxydOiuT5SaaIsTO+P7X7UFU7SnwqyWHCKCVeu/aRrVVTE+T lmYiL/Kh0bfqR2PI4r29fbPzd1pbxAa22/iRunDhxDWbBWVnsP8AZra71ij6qOlSjbU93fHUMqnO c1yOR68yKjdmeHpdOtxPXfim4hrfX6icN+I6cWrT6OqqKSx1uavrn1mRJA90b6iJlKrW00Lntc1q v53Ly7q1PBIRSY9e9bOKLi0uWNSJ36x6f0mm1hnc7lRKmqo5Z5Wo797y1KN3/lRSi9IqHgGxrRqx 41qXguf+2/Zrc2gu+FUtxyaG61d2jRWuZDTQzNhakr05mq3lYiP68uyoboG/uF/XhvETpTT55U44 /H7vS19XZr1anTJMlHcKaTklY2RETnavouRdvB2y9UOq4i+IG+aW3fDdMdM8Spsq1K1Eq56axW2r qlp6OnggZz1FbVyNRXNhiaqKrWpzO6o3wUlHD/pfgmk2mNtsGnun9ZhdBcP9l6my1tdJWVNLV1DW ulbLLJLKrnouzV2eqbt6GeOIbJrdofxx6f8AEBqhDW0unMmCVuMJfI6KWpp7VdXVT5d5+ya50aSR OaxrtuvX1NcqBZGCam8UeM6q0WAcQWnmJ1eP3m11Vwp8wwqOuS3WuWnbzPp6/vW/Zq5u/I/mRHKi IiLu7kimFa9cVXEZabhqRw6YfpvZtP21dRSWGrzV9fJW5A2B7o31DGUytbTROe1zW8/O70VVUO5p NaLzxY4hq3iOkOG18eHy4nWWmwZpX9rRR3a71FPLGrKanmja50EfMzedVROZFRGqi8yVbw6cYuke jXDTi+lN/tuQU+qOG2dLNPgMdirFu1VcouZqRxxtiVqpK/ZySb8qI/qqKioB3uT8et7j4Jr9xFY9 hlDb86sd5Zi1Rj1xWSqpo7w2sihmiRYnRvkb2b3SN2ci+Cddl37TWDiK4odD8exzV7OMI0/iwu6X q32y449DJWOv1FFVP5Gv7xz93dK3dFdE2NyNXdqSPROcoRmjeV4PgvDBoBqBCxmW6k6tT6jZVRsV HIndWuqZ6d226LyxSQtfsqpzNXZVTZS/uOdPZjqFw4aKN9NuTakQX2riT/fqK1RLNOxU/gqkqKv8 iARXilr9fc24zdJtH9PbzhENFZaWpz+hgu1DWTMZNBE+mbLXJFM1ZGo+SRIkj5OVyqrld4JYS69a +6uZ9k2BcNdgwRaHT6qbZsly3Ku9uoKm8tYiz0VDTUz0kd2SqiPe+TZFXbZeiuhtlzfG7Z5UTMaT Oque33WpwS1Y3hsUtHM9txhkf3yqWJ7Wq1EZIjkVVVE3Ryb9FM96V4bweaYy5vhfGRbcmsepNJll 1qubzjkFOy+Ucs3PT1NGyhlSKZHtXb0U51VOoGwdLuKjJLriestBqzi1qsecaHRTS5BHbKiSa21c HdJKmnqoFftI1kjInryO9JERN13XZK7xviT4y8u4WGcTVHhOl1mo7bj1TkNZQXSOv7e609O2SWSS maybalYsbFSPtHyrJtzr2bXoiQbV7G9MdKOATUnN9ItGsl08u2rKUNldbchuNVU3KubLV92gdIlR PM6PmppZnoxVaqI7ZyeClt8b+2jfABe8Cx/0qjzHacJtsUfTtu1fBSqxv8sPaLt+YCueL/VPU7XH RbQWxadLj9otmvtyssVdbrlBPNUx8/ZVaoskb2ItLHyIkqI3nkaqcqtRV3tDI9e+ItNYbHww4lS6 XpqE3FPZTfr5eG10NpkY6odE2Ggo2SLUSuRGo5yul2REd8mxXWtFXiWi3FDwoYtnlXNbMNwLGrnS W6sSjmmgqLmtHFRQQJ2bHLztRjHN6dOZPlJPxEalcFue5hdtPeLHE6/Er3iVVyWG8XajqaWasgc1 r21Vtr6PdVjV6r8HzovM1OZm+7UC89Fsl4hq67ZFjGveA47QPtLoH2vIsarHOtt3jkaqua2nnctR DJGqIjubdq7rsvTdfvxGa8WLh10xqtQbvaqq8VclVBa7NZ6Rdp7pcp3csFMxVRdlcqKqrsuzWOVE cqI1ap4BrrqHc8PzVl8veW3zAqXJZoNPbtlscjbrW2hGJ6b1la2SSLm/c3vajlTmToiI1vF4/rLf obfpBqpSY/cL5j2mmotsyTI6O30zqieOhj5kdVNibur+yVd1ROqc2/REVUDrtStfuMbh+wiLW/Wj AtLazB6OppEv9nx2prlvNqp6iZkSPbPKqwVDo3SMRzWsair4O5d3JC+LpdZ9TuLbQrTXBLvgctqi mqc8sbbnQVkzYZqKmRWT1yRzN7RjpFckSRoxWqvpOXfY5vEtrFiPG3g1v4Z+Gu51mVrmV2oFye9U tuqIqGwWinnZUSyzTSxtakquiY1sX4TvSRURVajpdp/S0+X+Ugz+5U0aLQaT6cWjE4GJ1ZDNXS98 RU/vuzRzf5OnqA1RRNyFuPQMuM1ukvqUTUnkgieykdV8iczmsVzntiV+6oiuVyN6bqvUwbwn53rs 9+v/ABV53fMFqcdbcrrBdO62+sZPUNsVErKd9E586siper/RkR71XnXm3Xc3XmNzuVlxG+XizUUl ZX0Ftqamlpo2cz5pmROcxjW+tVciIifnPMjF9TcUtPkjL3h2E3iW4ZZLtj94p3U0sUrbndbo7tIX Oe1Ee/sZJE9FV6NTfxAlHDHlvFdpLwLW3UjTjCsBjx2wWu6ZXc3ZZPWLdL6ztpqqongZArY4G9n6 EayOcsnZo7ZrXN30hk/F/XTaeaRzaZYG296ja2W6Cux3HqurWKnoo1pmT1NTVzI3dIIGv6q1vNJt s1E6qnRcbnLozwA3vAMeTmqFsdqwe2Qx9O27V8FIrG/yw9ou35ioOJLR/S/TjXbR+98QFjvNRo3Y dN24Uy622a4Qw2i600m8UlRJQubLHHJFsxN15VXfdNmqqBeMGvHETpJq3gOn/Ehj+n1dZdS6yW0W q9Ya6thWguTWc7IaiGqc5Xtk/Ba9ip13VUTbZdM3K4Udot1VdbhMkNLRQvqJ5F8GRsarnO/mRFUx dw+6acFeomr1NfdEtJMvvNJhbGXaizisvV6ks8Vy5+VtPA2uqfh5UaquVzY3MRETdUVUNkZNY6fJ 8cuuNVcjo4LtQz0Mr2fhNZLG5iqn59nAYo4XNKLNxoR1XF/xI2lmU019uNZBg+K3P4a1WO0wTOhR 3dl+Dkme+N/O56Ki8qO26ptJM/0k8n9kOaY3ecW1P030xzXEb1HPT12GX602qvdLG5WupJom7sej nbNc18au6K3oiuRYVwxcSOL8GmmlLw0cWFFd8Gu2FVVZS2u9vs9VU2q+0UlRJNFPTzwRvTf4RWq1 UT8FN15uZreiyTG9FOLDVHTih4XuHKio8esOa0OVZdqCzDIrHTVVHTOc91HFPJFHPUPle5Fc1G+L WKu6bq0NAa18RerOM8TeG8OekOJ49eq/I8YrL7WSXXt2MotpXRQTySxv+DgascqvTs3ukVGRtViv 5k4+Sa/67xZ5Y+G3AMewjI9Wm2Zb9ll4mWrpcbsdI6VWxfBo59RJJIitRsfOi9Ucq8qry9Vokjc7 4/tfc/VEkp8JsdhwigmXr+6MWrqmJ8nLMxEVPzoRSl1Cxfha429a8w16qKiw49qlQY9U4vks1FNL RPSipXQT0bpY2uSOXmVF5V23RiL++buFn6Ya+6v2ziBXhr4h8dxKK/XSwOyTHr5ij6ltBXU8cixy wSQ1Cukimbs534StVE9W6b9/wia5ZXxDae3/AFFyO3Wmkt65bdrbjvm6KViTWmnkSOGSZXyP55Vc knM5vK1dk2anUpPH4sw4ieIHOOKbBbBdafFsR08rMR0+qK6kko5L9c5e0lkrIY5Ua9IUc7skc5ER 27VTqjkSC6A8UenGinAHFhWHyXGt1Hw/GbtJW45Hbp2VVtr0fUTTTVauYjYImOe56ve5OZERreZ7 msULBqOODUODg51M4nlsWMOqbRllZZ8MpkpqhYK2hbXQ0tO+oTtuaWVVfMrljdG1eRNmpsu/cav8 QvFtolpXDxDZpgGnceIW91BLfcXikrFvlNTVEscKubUq/u6TI+VnNF2bmt3VO0fy8y511Ettfp3w Q8JukNnxusvVdkF9t2XVtnoo+0qa2jhjlulXCyPxe/eoZs3xVWoidVQtjif1rwrjTxKz8LfDvcrh k1XmN7t7sqrYbZVQU9gs9PO2eaWqfNG1I5OeONGxr6Sqip0VWo4JNrrdbnxScSWPcJVqyG42vTyg xhua53Jb53U9RdoJZEZS21ZG7OZG7mY+RE/Ca9fBWopbV64IuEy+YbLg02gGFUtBJTrTtqKO0QwV 0W6bc7KprUmSRPHn51Vduu5TuqlTX8KXGDLxHXnErxc9Ls3xGnxu93K0UMlZJj1ZSyNWKWaKNFf3 d0bGt5kRfSVfWjUd3eU8fFj1BpWYjwa4vddU82uL2wQTvs1bSWS08y7LPX1EzIuVjU3Xlau6qnLu 1QOyv+aXng30y004fMPq7tqxqLk1VLZMUhvVS2B0kUXwks9VK1qqymponNTojn8qNTfZFc35XLX3 iS0Q1G0+sHEfj2nFwxjUi+RYxR3XDXV0Mtsukyf2OyeOqc5JY3qit5m8ips5VRNka6N8Rdxr9IeK /RfiN1SoJXYTbMbuWPXq722jmqaWx3Kdiqk72ta6RkMnMsaPVF2RF5tvX8Myyy1cbOvekVt0hZW3 fTjTC/Jm2RZStFNBQS19O3+waOmfK1vbyc6uV/Lu1rXb77oqAS53EXrzm3FDqXw+6RYliE1uwagt Uj7/AHhtSkNFUVMCSvbMkUm87l5kbHCxsf4ErnSpyI13HwXiZ1mvNk19w7Lrbgtuz/RJkNQ+6U0V W+xVlPNTSVMcjoXSdu1Wxwv5mJL4ub1TqfLyfm2V0+tetcicy57qfd5KKXx57bSq2GmTf17fCp/M UDb7lfbtwbcYmuthoamurNQ8vvVLR93Yr3vszJIqNrunVWsilqVVfBGsVflAmXC/q9qNw9cIkmu2 srrLfqbPrhJe7BaLTSTsvd3vl1q5HNimlkkdE7tPQVvJGitjaqrzq3ZbB1F1/wCMLh/wyHW3W7A9 L6nBKWqpG360Y7VVy3m0U1TMyJsiTSqsFS6N8jEc1rGoq+C7buSq9fbVgOpnCfw85RhtFds10n07 v9mZk8Vnp6yGpS201KtLNUMaxGT/AAS78zo9nJzKqKiIqp9cf078nPrPltk050n0xzTUuK8Sqt3q qLIsjS3WWmY1XJNWS1VUyPfna1qRpu/f1bo1HBpjVTXvJdJdc9NrJkUFjbpZqHFUWht6eySOpt99 Rqy0zZZlk7LsJ40VjG9mjudrlV+ybEStPEdq/qbYdStW9L7fiNp0sxW1VXsZvOQ0NXLNkFXS8zqm takU0aNoGtY9jPR55HJvzNTdqQXW6zXHyg9yv2hWndyitek+ESSR3jKmQNkS65DFE5KeholVFTsK d7mvnlb1d0Y1UReZ3SXrWW/5l5MDUCipceWjzXB7HPp/k9loadGuoqmnfHR1KpExNmsWnes2zU5W tVyJ0aoHY8D9s1kTQ205rqTc8bqqDPKivy2m7pSVDLk+qral0s0lVI+RYntc1Y1YjGN2bsiquxoQ jmj2Saf5Jw/6bP0wvKXTHrVZILPTVKU8sKOWlhihcnLI1ruisVFXbbdF6qSM59/2kvVcG/stPv8A nIACJeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOPwuS9hZc2sTunm3MK9safJE9I3N/63HIOt 4fJO66j6qWbfZGVttrWp8vbU7lVf8rTa1OV6n3/L9EONp0sDejdoz/VEfVeoAOm8aAAAAAAAAAAA AAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRv Ls14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1xXP59L6e2fxnfrbSbfLvMjtv/cLlKT4on9rb MBt6f/SM2tznJ8rGNlVf/wARBivY1OnwLGePtdU592tyQAUXpQAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAA41yttvvNvqbTdqGCtoq2J8FRTzxpJHNG5NnMc1ejmqiqiopyQBmrGMnyPgCyNKKtdcL3w6 3us6L6dRVYLVSv8AH1ufQuc7w6qxV/hfuu7bVdbZfbZSXqy3Cnr7fXwsqaWqppUkinieiOa9jm7o 5qoqKip0VFKeuVtt95t9TabtQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFM54xk+R8AWRpRVrrhe+ HW91nRfTqKrBaqV/j63PoXOd4dVYq/wv3W5ZvaX4atrz3CHB/F53bUaueN36LxyryfvCTmuVXrNs j0uqai85FWy3G51EWTXenSoqJHK571jiqmsbuqr0a1ET1IWHo/w9aLaBW+ptukOndqxtlare9TQN fJUVHL+Ckk8rnSyIm67I5yom67eKk5tV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2Obujmqioq KnRUU5ZZchW2sHDhofr5FSM1c04tWQy0CK2kqpeeGqgaq7q1lRC5krW79eVHIm/Xbc6HS/g34Z9G 8jZmGn2k9uor7EithuVZU1NxqoN02XspauSR0aqiqm7VRdlVPBVLnAAx9xCcQma6pZrX8MHDBdu7 XSm+CzfN4k56fGqd26OpqdydH1zkRUREX4Pr1RyOdG4hOITNdUs1r+GDhgu3drpTfBZvm8Sc9PjV O7dHU1O5Oj65yIqIiL8H16o5HOjlmkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1VV/Mi IiIiJBdu6GqNro4HAziZ06/V+ZpLpLhWiuFUeC4Lbe7UVNvJNNIvPUVlQ78Oed/i+Ry9VVfzIiIi IiTIAozOeuXpqaYpjRp2AADIAAAAAAAAAAAOjvGc4Tj1bT22/wCY2O21lXKyCnp6y4QwySyvVEYx jXuRXOcqoiInVVVNjqdV9X9PdEsWbmWpd9darS+qZRMmbST1LnzvRysjRkLHO3VGO67bdOqoMplr NdNMTMzsTIEF0g1kxTW2wVeTYfRXuCgpax1Gj7pbZKN06oxj+0jbJ1dGqP2R3Tq1ybdCFv1M4nKz Un2O2/hsoaTD6e9dzlyOsy2mc+e3pNyuqoqRrUka5Y93tY5fHZNzOjOxrN2nKJjXnujP5LuBCNWs e1VyXH6S36R6h0OG3RK1r6q4VdoZcUWl5Ho5jInqjefnWNUVV22aqes+2lmKZ5h+NyWzUXU+fPLv JVPnW6TWqC3csatYiRNhg9BGorXLv4+mvyIMtWbOlOlo5e/V/wDfBL3yMjRFke1vMqNTddt1XwQj OoGqOnelVqiveo+Z2nHaKeRYYZa+pbF20iIqq1iL1euyKuzUVSurZwd6JUOo7dWK+33285LBdH3e jqrlfauVlHUOkV6dlEj2sRjVXZrXNciIiJ1LXyDEcUy2OmiyrGLTeWUUveKZtwoo6hIZdlTnYkjV 5XbKqbp12VRqzYibkxOqInm5/J1WmuqeA6wY4uW6b5HDe7Q2pko1qoopI29tHtzN2ka1enMnXbZd +ileY3xDZzlOoEGI0fDPqLbbQtdJSVN+vEMNHTwsark7ZrFc50jFVE25V6oqKXRSUdJQU7KShpYa aCNNmRRMRjGp8iInRD7DONxNNcxGvt/zWrzWL2/3UNth0DTBG1kksiXGXLO9rFFFypyLElN1V+++ 6O6eB3GmNJqZQ4hTU+rl3sdyyVJJXVFRZYJIaRWK9VY1rZPS6N2RVXx23JWBnqyZ0PxaWfkpDB+F /wBi2d0eol/111Tyy40E0s1PRXa/c1tj52OYqJTNYibI16+Kr4IvqJ5qHo1pbqzNa59SsGteRrZX SuoG3CLtWQrLydpsxV5V37Nm+6L+ChMwJqmZzYi1RTGjlqdbjmM43h9np8exLH7bZLVS83YUNupW U1PFzOVzuWONEa3dVVV2Tqqqp2QBhJEZaoTjG8kstBZaekq63s5Y+fmb2b123eqp1RNvBTsvZfjv 8Y/5mT9krUE8YiqmMnNucFWblc1zM5zr5vJZXsvx3+Mf8zJ+yPZfjv8AGP8AmZP2StQZ5TX1NPRF jfPh5LK9l+O/xj/mZP2R7L8d/jH/ADMn7JWoHKa+o9EWN8+Hksr2X47/ABj/AJmT9key/Hf4x/zM n7JWoHKa+o9EWN8+Hksr2X47/GP+Zk/ZHsvx3+Mf8zJ+yVqBymvqPRFjfPh5LK9l+O/xj/mZP2R7 L8d/jH/Myfslagcpr6j0RY3z4eSyvZfjv8Y/5mT9key/Hf4x/wAzJ+yVqBymvqPRFjfPh5LK9l+O /wAY/wCZk/ZHsvx3+Mf8zJ+yVqBymvqPRFjfPh5LK9l+O/xj/mZP2R7L8d/jH/Myfslagcpr6j0R Y3z4eSyvZfjv8Y/5mT9key/Hf4x/zMn7JWoHKa+o9EWN8+Hksr2X47/GP+Zk/ZHsvx3+Mf8AMyfs lagcpr6j0RY3z4eSyvZfjv8AGP8AmZP2R7L8d/jH/Myfslagcpr6j0RY3z4eSyvZfjv8Y/5mT9ke y/Hf4x/zMn7JWoHKa+o9EWN8+Hksr2X47/GP+Zk/ZHsvx3+Mf8zJ+yVqBymvqPRFjfPh5LK9l+O/ xj/mZP2R7L8d/jH/ADMn7JWoHKa+o9EWN8+Hksr2X47/ABj/AJmT9key/Hf4x/zMn7JWoHKa+o9E WN8+HkjWd6f1Wa8VmmOtFRkNpTFNOrLeIoaR/eO+uudcxIXPbH2XZ9mkLU9JZEdun4PrLv8AZfjv 8Y/5mT9krUDlNfUeiLG+fDyWV7L8d/jH/Myfsj2X47/GP+Zk/ZK1A5TX1Hoixvnw8lley/Hf4x/z Mn7I9l+O/wAY/wCZk/ZK1A5TX1Hoixvnw8lley/Hf4x/zMn7I9l+O/xj/mZP2StQOU19R6Isb58P JZXsvx3+Mf8AMyfsj2X47/GP+Zk/ZK1A5TX1Hoixvnw8lley/Hf4x/zMn7I9l+O/xj/mZP2StQOU 19R6Isb58PJJcyvFuuvc/N9R2vZdpz+g5u2/Lt4onyKRoAhrqmudKXQsWacPbi3TsgABqlAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAOl0hf3TiAzOk8O/2Ggq9vl7N6x7/wDtO6I9gj+7cTjk8G1u Evb/ACvZWtX/AKhTquUz1tb0aWFvU/wz4TE/RoQAHVeJAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeI zRHRq3Wm31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/ 9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAACjuJF3a5BplRfw8hfNt/wcKr/wDjLxKK4hF59RdKqf8AhV1zk2/8Wnb/APMr Yv2U+75w63Acf/uo7Kv7anZAApvRAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHGuVtt95t9Tab tQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFOSAM1Yxk+R8AWRpRVrrhe+HW91nRfTqKrBaqV/j63P oXOd4dVYq/wv3XdtqutsvtspL1ZbhT19vr4WVNLVU0qSRTxPRHNexzd0c1UVFRU6KilPXK22+82+ ptN2oYK2irYnwVFPPGkkc0bk2cxzV6OaqKqKimc8YyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn 0LnO8OqsVf4X7rcs3tL8NW157hDg/i87tqNXPG79G+DH3EJxCZrqlmtfwwcMF27tdKb4LN83iTnp 8ap3bo6mp3J0fXORFRERfg+vVHI50fH1y4lcl1qySXh24SsjgfPLBHJl2oFG9JqOwUUqbpFSyNXl lrJGqvLyr6Hyo5HOjmmkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1VV/MiIiIiJtdu6G qNqHA4GcTOnX6vzNJdJcK0VwqjwXBbb3aipt5JppF56isqHfhzzv8XyOXqqr+ZERERESZA6+jyCw XG4T2m33y31NdStR89NDUsfLE1V2RXMRd2pv03VCjOc63pYiKIimNUOwBT2qnFtoJo1kTsOzrM5Y MhSNkrbVSWyqqqh7Xpu3bso3NTdOvVyE7y/LbrZcDqswxLEa3Ka1lNHU0doppGwT1fOrdmo5/Rqo 1yuXf5FM6MsRconOInPLakwKx0c1A1mzmouj9UdCH6d0cDIXW10uRU1ylrFVXdojmQoixcqIzbm8 d1+Q6fUPB+KHJsyrH4HrnjuFYo5sXdGNxdlyr2qkbe051mekfV/MqbeCKm6dBo68pY4zOnSpiZ8P nkuYEZ1DwWDUjCa/CbhkV9s0dxbCktfYq1aKsj5JGSKkcqIqsR3JyuTruxzk9e5G9GuH3TzQtLvJ hKXmarvywLcay63WetmqFh7Ts1VZHK1u3ayfgom+/XfZNmrJmZq0sojU+ubcRehOnF0ksWa6sYza 7pC5rJbfJXsfVxq5EVqPhYqyN3RyKm7U3RUU7zU3P4tMsPq8wmxLJclbSPij8247Qd9r5lkejE7O HmbzbK5FXr0TdfUJ9KdMKrJarM6rTrGZ7/WuY6oustpgfVyqxjWM5plar12axqJ16IhKRqYiK5zz mOpXejurN41XpLnX3PSTMsFiopI2U8eTUbaaara5HKrmxo5VTl2RF3X1oRXKavjKq8+qaPB7RpRQ 4bDVxpFWXeevkuE9N6KvVrIfQY/8JE5unTcu4DPKc8iaJmmImqUQ1TwrIc/xOTHMZ1Du2FVkk8ci 3S1xsdUJG1fSjbz9E5k9fimx12j2kkuktpr7fU6mZtmtRcqhKmasyi5pWSxuRqN5Itmt7OPpvy9e pYAGc5ZM6FOlp86rE4XOH1c3rNSKjSmx1eSV1ctzmr6yN1S9arm5u1a2RzmsdzIipyomyloujY9W q9jXKxeZu6b7L8qf5T9AxMzO1mmimj1YyAAGwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB GLE7sOJPGX+Heser4f5eV7XknIrTr2XEVp67/v1Dd4/8kCOMfvU9sfNmYztXY/gr/tmWjQAdZ4YA AAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2 Tqm/gXgU1qhrbf8ABeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAojX1d9WtJY/lffHf5KWMvcoj Xv8AtwaRr/x9/VYiti/ZT2x84djgL9uj+Wv+yp2gAKb0AAAAAAAAAAAAAAAAAAAAAAAAAAfx72Rs dJI5Gtaiq5yrsiJ8qgf0HFS6W19vfdo6+B9ExjpXVDJEdGjG78y8ydNk2Xf+Qq/BeK3QDU3N4tO8 A1Epr7fZYpZ2w0lJUOi5I27uXtljSLwTw5t1MxEzsazXTTMRM7VtAqzWHVvPtO7jbrVg2g+S6gS1 8L5XTW6php6amc123JLLJ+C5d906eBLbDd83yHT6G8V2LQYvlVZb3yJaq6rbWRUVWrV5GSyw7JIx HcqqrNl2VfBRlOWbEVxNU0xtjq/yEmBUeleOcTtLkS3jWbUnDK62LTPZ5lx+ySxsSZVbyyd5mfz7 N2cm3L13PprBw72vWe90Vyvup2odloKOl7s+z4/fnUNDVLzud2kzGtVXv2dy7oqdEQZRnlMsadU0 5xTr61p1dXSW+kmr6+qipqamjdNNNM9GRxxtTdznOXoiIiKqqvREQiWL6zaS5xkk2IYXqTjd/vFN TPrJqO13KKqfHC17GOe7s3KiIjpGJ16+kh2NpwLGrTgVPpp3SStsEFrSzrT10rp3TUnZ9mrJHuXd +7N0VV8dziYXpJpbpw5X4BpzjWOyOjWJ8tstcNPK9iqiqjnsajnJuieKr4INTM6ecZZZc6Hau8SF p0kySmxJ+lupOX3OromV0bMVx51fGjHPexEc/na1rt43bt8URUX1oS69XC65VpPVXW2YMlbcbvYV qYcbvyJT9rLLBzJRVSO3SNVV3ZvRd0Rd9yXgZwaNWc5zqYx8mNS6n0uhtmkuFhw6jwSrir56Cso3 Teea2uSvkY59Um3ZKxGsexFRebljiTw32uzVfRPUvUrKW19o4j8swvHUpY4XWew0kEMqyorueVKt d5PSRWpy7Lty9PHZIh5Oj4m2n36W/WtWaRN66piuZhXw1uKsPRTO6Pl1IzfNPbBlens2meXPrb1a ay3MtldJVVLm1FXGjUar5JY+V3O7bdXN26qqpsdDpTw86MaIPqZdLMCobDNWRNgqJ4pJZZZY0XdG uklc5ypv18SxAaZzlkscXTMxVMa4fBlDRR1clfHRwNqpWoySdI0SR7U8EV3iqJ8h9wDDcAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACJyLy8Qmlq/wANl8b/AJKNFJYR Ko+MHpR+nf6kYnbT2x84b0+pc/kr/sqaQAB1nhAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYM ffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNn d5wt8dPB2LEaqP8ATavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAACidfk5dVtJpfklvTP8tLH/wDIvYoviHbyZ7pXU/wblXxf+nTp/wDIrYv2U9sfOHX4 C/bqeyv+yp2IAKb0IAdfkGQWLFLLWZHk13pLXa7fEs9VWVczYoYY08XOc7oiAmctcuwB0uF5fZc+ xa25njcs0tpvECVVDNLC6JZoHKvJKjXbORr27ObuiLyuTdE8DugxExMZwAAMgPy+RkaIsj2tRVRq Kq7bqq7In+Ujme6lYBpbZmZBqLl9qx23yypTxz3CobE2SVWq5GM36udytcvKm67IvyDaxMxTGcpK CI6Zatad6yWCoyjTPJoL7a6asfb5amGKRjW1DGsc5nwjWquzZGLuibdfEr+2cQ2c3vUVmFW7hm1F p7Wy6Ot1VkFzhho6SONsisWpYiuVZYunMit/CaqKhnRlpN2iIic9vvXcCB6ue3m610EWhS4Qy5SV Ktr5cqSqWCOn5V9KJKdUcsnNt0d02Ox0zodS7fi7INWb9ZLvkCzSPkns1G+mpmxrtyMa17nOVU6+ kq9fkGWrNtpfi0ckrOryDKcZxOkS4ZTkdrs1KqqiT3Csjp4128fSeqIVLjHDB5mz+n1FyDXXVPJK yirZKylttffv9i4ubm2YlM1iIrUR23V3qQn2oej+mOrLbazUnCrZkUdolfNRR18ayMie9ERy8u+y 7o1PFF8BlETtaxVXNMzllPa7rF8txbN7PHkOGZHbL7apnvjirrdVMqaeRzHK1yNkYqtds5FRdl8U KnwTi0wbUfOaLB8UwXUWfvkssTrvNjM0NtpljY9yrNM9UViKrOVF5V3c5qdN90tnGcUxfC7PDj2H Y5bLHa4FcsVFbaSOmgYqru5UjjRGoqr1VduqnajUTFc5a8t6ttZMr1wxtloh0W0ntmYy1qzpXzXC +x2+O38vJ2S8rkV0vPzSfgqnL2fXfmTaR6dVeoNxwqgqdUbTarRk8qS99pbTUOnpofhXpHyPem6r 2fIq79OZXeokwGerJmKZirSz93MpLTXRbW/Hsyosx1O4ob3mTKVsvPZoLHS2u3yq+NzER7IlVXci uRyL06tRVJBrDw46Ta9VVon1SsdXdobM2VtPSsuVRTQv7RWKqyNhe1XqisTbdem6/KWaBpTnmxFm jR0JjOOvX83R4bhGK6fYrQ4Rh1mhtljtsboaWijc57I2OcrlTd6qq7q5y9VXxO0obdb7XTpSWygp 6SBvhFBE2NifzNREOQDDeIiNUAADIAAAAA/iqiIqrv069E3ODY79Y8mtkN6xy8UV0t9QirFVUc7Z on7LsuzmqqLsvRfkU555XcZEerXBjxES6maLZRX2LHtQXvurqWLZ9C+uaqd6hlgcixv3VzZEVU3R JlRqpym9FGnOSvib/JqYrmM452v/ACdTms4M9P3vcjWtS7KqquyInnWr6mhLJfbLklujvGPXWkuV BK57I6qkmbLFIrHKx3K9qqjtnNc1dl8UVPUeH+juR66a8S4PwmWHNLjR4m+plgWgo/gomU0k0lTV T1HJssyNR8jka9Vb6LUREXx9usVxmy4XjNqxDHKJtJa7LRw0NHA3wjhjYjWp+ddkTdfWvU2vUaM5 zzoMBf463FMRqpiIz68naAAiXwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAibk5+IXTBP+9xXt/8AlpEQlhFaNvbcRmBt/wC8W26y/wCWJGmOentj5w2jVbuT/BX/ AGy0aADrPCgAAAAAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux 2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9nPCjazuaOXnXeLl7TkRfR25uh KwAAAAAAAAAAAAAAAeavAVwFcJ2tPCdg2pmpelPnnJLz5z77W+fblT9r2VyqoY/g4ahkbdo4mN9F qb7bruqqqh6VAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3sDVQMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx 97A1UDKvvXHAn8xn0mvH3se9ccCfzGfSa8fewNVAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3sDVQMq +9ccCfzGfSa8fex71xwJ/MZ9Jrx97A1UDKvvXHAn8xn0mvH3se9ccCfzGfSa8fewNVAyr71xwJ/M Z9Jrx97HvXHAn8xn0mvH3sDVQMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97A1UDKvvXHAn8xn0mvH3s e9ccCfzGfSa8fewNVAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3sDVQMq+9ccCfzGfSa8fex71xwJ/M Z9Jrx97A1UDKvvXHAn8xn0mvH3se9ccCfzGfSa8fewNVAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s DVQMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97A1UDKvvXHAn8xn0mvH3se9ccCfzGfSa8fewNVFH8Sr eyuumtd/AydsG/8AwkTk/wDxEF9644E/mM+k14+9j3rjgT+Yz6TXj72R3bfG0TQt4HFciv038s8s 9WzbEx9Vjgrj3rjgT+Yz6TXj72PeuOBP5jPpNePvZByXrdH0z/B4/o6LiK4rNKOGqxpV5ndO93qp jV9vsVG5HVlV8jlTwij38ZH7J0VE5l9E8ltceKjUfinza3U+oV9dY8U7/EyC029sj6ahic9GrMrE 3dUStaqrzKiqq7o1GovKa/4XOCHQLiA4S8IyjLrFXUGS1jLkyW9WusdDUPRlyqmM5mO5onbNa1u6 sVdkRNyCaneSW1GsT33PR/UO23+ONe0jo7mxaCrbt4IyRvNG92/rXs0/ydVvi6JynaYqMXiaIqpj 8MxE5R9djf2guqWCamYhyadWK/Wyy48kNqpWXW1yUKPiZE1GLC1/VzEaiN36dUI5c9TOJ2TUWTHL Bw10KYpTXRtM/JK3LqZFqKPtER88dK1vaNXk3VGuXx6H74VMz1evun0eLa9YbdrHm+NI2jrKmrjR 0N1iRNo6qKZirFI5UTaRGOXZyI5dkkaXWV5ypmdTq0Z3LdM5zHuy92vNCtWsf1QyXGIrZpLqBR4b eVrGPludVamXBG0yNej2NheqNVyuVioq/wAFflPlpBhGfYJj1XbdRdWKzUC6VVa6q85VNshoeyYr GN7FkUSq1rEViuTr4vUnQMZ6skmhGlpfWflsUmzg80Sm1LXVq92++3vI47yt9o5rhfat8VDVdt2z Vhia9rGsY78FiorURETYt284/YcjghpchslvukNPMlRFHWUzJ2xyoitR7UeiojkRzk3Trs5flOeB NUztKbdFGejG18qWkpaKBtNRU0VPCzo2OJiMa3+RE6IfUAw3AAAAAAAAAAAAAAAAAAAAAAAACkOM jQiPiC0KveJUdM2S/W9vnWxP29JK2JqqkaL6kkYr4/kTnRfUXeZ51A1Az/XfP6zhr4a7l3SqpNmZ vm7G89PjdO7dHQQOTpJWvRHIjUX0OvVFRzo97cVTVGirYu5bt2p43ZKiPJV8P8mM4pd9d8lt7orl f3PtVmbKzZ8VFE/aeTZfBZJmcvyokPyON+mYbnhuV+T0uNM1Lject4fLnKyOasqv7IuGH1siojpZ VaidpRyvVXKqInI5y9N9u10rbblb7zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKiob34qivO UPBty3VYim3tjb2uSACFfAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjjgK4CuE7WnhOwbUzUv Snzzkl58599rfPtyp+17K5VUMfwcNQyNu0cTG+i1N9t13VVVdAe9ccCfzGfSa8fey1yXrcP0z/B4 /oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0mvH3se9ccCfzGfSa 8fexyXrPTP8AB4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0mv H3se9ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3scl6z0z/B4/oscF ce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/wAHj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s cl6z0z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0mvH3se9 ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3scl6z0z/AAeP6LHBXHvX HAn8xn0mvH3se9ccCfzGfSa8fexyXrPTP8Hj+ixwVx71xwJ/MZ9Jrx97HvXHAn8xn0mvH3scl6z0 z/B4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBXHvXHAn8xn0mvH3se9ccCfz GfSa8fexyXrPTP8AB4/oscFce9ccCfzGfSa8fex71xwJ/MZ9Jrx97HJes9M/weP6LHBkrUPhc0J4 a+Mnhs9pTBvY57I/Zj5z/wBk6ys7fu9qZ2P+2ZZOXl7eX8Hbfm677JtrUhuW+LnJ0sHiuV0TXllr yAARrQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEaxtveOJaxR+PdMYr J/5OaVrCSkf08Z3riZrp/FtFhSRfyOfWtd/1II110x1wVzo4e9P8E+Or6tBgA6rw4AAAAAAAAAAA AAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprV DW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAABlX yXHxE9Mv01+uK01UZV8lx8RPTL9NfritA1UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAwX5Oj4m2n36W/WtWaRM3eTo+Jtp9+lv1rVmkTmXPXntexwvsKOyPkAA1TgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAZ51A1Az/AF3z+s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RU c6Paiia5yhDfv0YejTrNQNQM/wBd8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69U VHOj1dororgGgOAUGnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjUREaK6K4BoDgFBp1p zae6W6k3kmmkXnqK6odt2lRUSeMkr1TdVXw6IiI1ERJ2dCiiLcZQ8ricTXia9Kr3RucS62q2X22V dlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FRTCWT4xkfAHka1tE24Xvh1vdZ1T06iqwWql f4L4ufQuc7x6qxV/hfuu+DiXW1Wy+2yrst6t9PX2+vhfTVVLUxJJFPE9Fa5j2u3RzVRVRUXoqKZq piuMpaWb1diuK6J1qettyt95t9NdrTXQVtFWRMnp6iCRJI5o3Ju17XJ0c1UVFRUOSZqyfGMj4A8j Wtom3C98Ot7rOqenUVWC1Ur/AAXxc+hc53j1Vir/AAv3XRltuVvvNvprtaa6CtoqyJk9PUQSJJHN G5N2va5OjmqioqKhz7lubc5S9ThcVRiqNKnbzw5IANFoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB XHkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqOq8OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAx5xb/HJ4Uf8AHr9VQFwFP8W/xyeFH/Hr9VQFwFLE+vHY9HwR7Ce36QAAruqAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB02jDO967agVnj5vtdro9/k7RHybf+6dydfw 5x95zDVG9+PbXmlod/8AyeDbb+bnM24zu0R1/SUeKnRwV+eqI76qfpmvMAHUeLAAAAAAAAAAAAAA AAAAAAAEUyK16ZVed4jc8pgx9+YUHf8A2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a 8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAADKvkuPiJ 6Zfpr9cVpqoyr5Lj4iemX6a/XFaBqoAAAAAAAHBvl8s2M2atyHIbpS22122nfVVlZVStihp4WNVz 3ve7ZGtREVVVTM7PKFadXmKW66e6Ja455jsT3NTIsbweWe2yI1VRzmSSPje5E2XfZnQ6byndRVVe iOF4M6rlp7PnOpFgx2+vY9Wb0EjpZXoqp4JzwxL/ADGhNQcytWhmnUd2tGm2UZBbrQlPQUtiwyzd +rGRdGMSKmarfg2Iib7Ls1qAcfRHX3S7iGxWTLdLsh84U9LOtJXUs0L6eroKhPGGeF6I6N382y7L sqoWGZt4ctetGNSNWs1xjDtCMv05zipoqe/5E7JcVhs9ZcY+bsopJNpHSyLu53Krk26vVF3Vd6f4 BqfUPNdHbfxD6ua36hXeLD62+xW+0efJH0dZSxPqOeWva/mfVyo6R7Wc7+WNsEPKiKi7hvIGH+HX TnU/iz0gp+IbUTiN1Qxm95nNW1VmteJ31bfa7JSx1EkVPGlM1vLUKnZ8znS7q5FRF67uWvL7xJax ZjweYbfLzmdxt+bY9rJQYNf7rZ6l9C65NgqHNerkhVvoyRuj52fguVFXZEXZA9IwZh8oFl+WYZpX hdxw/KLtYqqq1Fx+hnnttbLSyS00kr0khc6NyK6NyIiOavRfWhCcnh1P1I8oRkukFHq/mGNYPDp5 RXi40dnukkD3SJU8jWU6rulM57ntV8sbUkVsXKjk5lUDahQep/GjpPpznU+ltoseZ6h5pRRpNXWD B7G+61VCxURUWdUc2ONdlReVX8yIqKqIipvXenOR55oZxfZBw41Wf5Pm+J3zAVzfH/ZJcHXCvt9X FUuglpUqX/CSRv5HORHqvLsxE/fKv88ljZ7dPws0up9Q5lVlGoV9u95yO4PRFnqapK2aJvO7x2Rk aORvgiyOVPwl3Cz9HeMPSnWDMp9M0tuV4TnEMC1SYxmdnfarjNAiKqyRMcrmyIiIqqjXKuyK7bZF UvIi+R6X6f5dleO5zkuJ0Fwv+JPmkslwmZvNQulREkViovrRE8dzKmmNBnXGTqJq1leR606gYhhu DZlWYRjllw29OtHO6iazt6upljb2kznrIxzWuXlbu5NlTZEDaYMH2TVjVew6T8XWiOU6h3i837RW y1VRj+VPm7C6Poqu2T1FIsk0XKqzxdlv2qbOVXJ8iHGqMF1XuXArScR914jtTafPrbp7DllFJQX+ SC3tbDRNniimpU3ZUq+Jje1km53vke926IqNQNrZXqFh2EXHHLTlF6bRVmW3RLLZouxkkWqrFikl 7NORq8ickT15n8rU2RFXdURZGeceudqqtc8r4MNQsgzPL7VXajUtNLcYrLfZ6KGkmdbWVDp6Rkao kEyune1ZW7OViNavRDu+IDX7HbXxKUnDZqBxH5Jpbp3g2KUlVX3OguMsd6yC5yIzson1zWPla1IV R73Js57ufdVVWq0PQEGC+GXX3HbrxJXfhywniGv2rOneTYnNdrZdLncJpLvZq+OTknpe+8scz2ui XtGv35mKjUaqKjnL1t01d4hNMZbpwEQX68XzVLIrg2DBM4uE75ZHYxVdtJNcaqZV5lqaNkM8aruj nOSNWo7l9INx5XqFh2EXHHLTlF6bRVmW3RLLZouxkkWqrFikl7NORq8ickT15n8rU2RFXdURZGef 3FXoXTUOsvCvh8+qmplSlVc6ix1Fe/LKzvTnQUyvWtZIr1WOqkdK9HytXdW8rE2a1ETWupOtGjnD Hg9rrNW9R22i3QRRUFLUXOWatr65Y2NaruRjXz1D9tnPejV8Vc5U33AswH8a5HtR7V3Rybof0AAA AAAAADBfk6Pibaffpb9a1ZpEzd5Oj4m2n36W/WtWaROZc9ee17HC+wo7I+QADVOAAAAAAAAAAAAA AAAAAAAAAAA/iqidVVE9XU/pwL9Y7Zk1juGOXqmSot90ppaOqiVVTnikarXJunVOir1Tqh5ex8ZP ERwY6tXrRbUyofqDj1iq+ypXXWVW1z6FyI6CaKq2VV5o3NVWyJIiLu1FbspvRRNezar38TThsprj VPO9UQUhoRxkaFcQUUNHiWUtt9+kb6diuvLT1qO9aRoqq2ZPzxudsniiHUagagZ/rvn9Zw18Ndy7 pVUmzM3zdjeenxundujoIHJ0krXojkRqL6HXqio50aLdU1aOTFzF2rdvjc84NQNQM/13z+s4a+Gu 5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc6PV2iuiuAaA4BQadac2nulupN5JppF56iu qHbdpUVEnjJK9U3VV8OiIiNRERororgGgOAUGnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDo iIjUREznhWuHsF4ueKy4apajV9JgmD23Faump7hcJZKK2pLbkdL3eBVVrHyyKnoxt5pHuRNlcqF+ iiLcZQ8xicTXia9Kr3RubHBmDQSm1m18zyPiV1HuuS4XhLYXRYNgcFfLSd4pH+Fyu0cbkSaWRNlj hfzMY1UXZV9J1X0OB5Rr9xxcQOE3zX7WDF7FhkGMy2m3YpmNTbaaJaq2xum+CTmYiK5nN6KJ6TnK u6qbq7d4MR6nVWs3AdW2DU1+tWU6m6PVl3prRlNtzGaOsulnjqH8rK6nrWsa57WuVEWNybdWp1V3 PH++Iaz5Vqhx44No1DrNqThmM1+ntVd6iHD8mntay1MVXMjXuRm7HKqbIqq1V2RE36AbOutqtl9t lXZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUUwlk+MZHwB5GtbRNuF74db3WdU9OoqsFq pX+C+Ln0LnO8eqsVf4X7rd+K8GdNiuT2jJ28UPERdltFdBXJQXXUCapoqvspEf2NREsaJJE7l5Xs VfSaqp6y/rrarZfbZV2W9W+nr7fXwvpqqlqYkkinieitcx7Xbo5qoqoqL0VFNaqYrjKUtm9XYriu idanrbcrfebfTXa010FbRVkTJ6eogkSSOaNybte1ydHNVFRUVDkmasnxjI+API1raJtwvfDre6zq np1FVgtVK/wXxc+hc53j1Vir/C/ddGW25W+82+mu1proK2irImT09RBIkkc0bk3a9rk6OaqKioqH PuW5tzlL1OFxVGKo0qdvPDkgA0WgAAAAAAAAAAAAAAAAAAAAAAAA/iqidVVE9XU/pwL9Y7Zk1juG OXqmSot90ppaOqiVVTnikarXJunVOir1TqgHPB5XR8ZPERwY6tXrRbUyofqDj1iq+ypXXWVW1z6F yI6CaKq2VV5o3NVWyJIiLu1FbspuLQjjI0K4gooaPEspbb79I307FdeWnrUd60jRVVsyfnjc7ZPF EJKrVVMZ8ypZxtq7OhnlVulKPJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UdF5IAAAAAAUJxx67X 7h14bcm1HxNIEv6OprbapahiPigqKiVsfbOau6L2bVe9EVFRVaiKioqmLtQOIHTDS7TpNSNH/KEZ lmeqFjSnrJ7Re7pPVWa/u5295p0oXwpHA1zVfycitc1ERObf0kD1MBhzUvMtSNWeLrRXF8C1PyfD 8Tz7Tee93aC2VzmqlO5VmR0THbxNqFTs4knVivYx7lbs5GqkhoKjM+HDjL070kpdUMxy3BtXbNd0 Siyq7yXSe2XK3w9v2sFRLvI1j2bMWNVVN3KvqbyhsIGHeHbHM941cQvXEBm2vmpuLUF6vlwpMVsm HX5bTSWy3U8qxRukaxq94mVzXK50nMi7J02XZI1FxgayYDwi6tJe7zBfNTdM87qNNbffJ6ZjUrZF qI4oK6WNE5OdrHyLsqKjliYrkXmduHoOV3i2uOJ5brNm+h1tt92jv2BUlurLlUTxRJSSsrYu0iSF ySK9yon4XMxuy+Cr4lPx8L2vGBVOM5fppxS5vkGS0lfTvyShze8Pq7JdqNf9tMipmRO7q9f97WP8 FOiqq+kVhatPcn1M8oXr/jdu1FyDD7F5jxie7VOO1DaW51LkompBBHUq1ywxqrpHvViI9VYxEc1F duG8wZN4Ub1nmHcRWt3Ddkmo+R5tYMLZY7rYLhkdZ3u4wR1tMsksMtQqI6VqOVqN38Eaq/vlNZAA ZX48sx1ExC04BLab/mGN6dVd9kj1AyDEKd0t1t1AkW8Kscxj3xROk5ueRjeZOVqJuruV3w4XpMPv udMyPQrjPvWpeGrbpW3rF8nuy3e4QTqrewqYpJuSppWou6ObI1Wu36bLtyhq8Hl1gfFHpPr03JdR deeNnNNNK6svFXT41i+LXie2QWm2Ru5YJJkihclTM/q5yyK5NvUiLskzxvjl1Cg4HM/zW35RQ5Tm +H5dJgNlyXuzWRXVJZom0tzdEqcqO7GZzuVW7K6NvMi8ygeiQMtx8L2vGBVOM5fppxS5vkGS0lfT vyShze8Pq7JdqNf9tMipmRO7q9f97WP8FOiqq+kQB1j1M1p449b9I59bs+xjBLPascuS02P3uSlq Ip3UTUbFTPXmSmikWSWSXska6R0ce67c24bjP4qoiKqrsieKnnhqlxK4VmHFDn+mOsXE9kekmCac RUVttVDj1xmt1dfbhJFz1NRPVQxuk5Il2YkaK1F3Y7+Ei/TRbWSm1Wdrpw3WfiCybP8AE7NjUeSY rmNPcpaW9wQIiLPRzVbGsfIrZkjbzqm7o3vaqqjka0N1ae6hYfqrhts1AwG8tu1gvDHy0NY2GSJJ mte5iqjJGtenpMcnVE323TpspIjInkz8OteGcJOLZ1UZfkM8d+ta1NVT3e9Sz262MgqKlFWlhkXs 6Vio5XScuyOVqKvgaA0o1z0o1ypbzX6T5lTZHSWC4OtdfU0sMrYWVCNR/Kx72NbK3lc1UfGrmKi9 HKBOwAAAAAAAY84t/jk8KP8Aj1+qoC4Cn+Lf45PCj/j1+qoC4ClifXjsej4I9hPb9IAAV3VAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+PCtF2uGZJfPHzzldyrGu+VvMxi fzegp87pWtttsq7i/blpYJJl3+RrVX/8R3XDBbXWzQrFY5EXtKmCase5fFyzTySIv+RyEliM70dU T9FXhOrQ4Pq66qY8Kp+kLTAB0XkQAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/ZL 5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3N HLzrvFy9pyIvo7c3QlYAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVoGqgAAAAA AAVjxI6EWDiQ0hvWlV+r5rctekdRb7lA3mlt9bE5HwVDU3Tflcmypum7Vcm6b7pTuPakeUEwG0Q4 dlXDFjmpdxoI0p2ZXaM6pLXT16NTZs01NUx9qx6oiK7lTZVVdmtQ1gAM3cPOiOsVDrDl/Epr1csd pcpy21U1jpsex5JJaS2UMD+diPqJPSmmVdt1REai82yqiojf1wOaM5npbwxUul2rWNpa7pJX3hau hWrhqN6epqpXN9OB72elG9F2R26b9dlNHgDGWjdh4u+FTTt+gWK6E23Uu0WGprG4rlEeV0lui7pP M+WNtdTzbSo+N0jubskcips1vhzL0964H9SrRwZUemVgvFpvOp1Hl8OolY98iw0VwuyVHaywNe5E VrezXka5yIjnMRV5Ed6O5QBiXiVxTix4mMSwy2U+grMMpcbzG0X640FZk9vrKyu7GXZ3ZOikSFsM THyPVXP7R7kjRsaekp1mT12qdj8pbluR6VYzQ5RVUGmFA24WGpuDaF9dSPq0RVgneixsmZIkbkST Zrm9o3maqopu0ru26HYna9drvxCU9wuzsivWPQY3UUr5Ylom00UqStexiRpIknMmyqsipt+9TxAq DRjS/WXNOJ++8VGtuEUmDrT4tHhuM4027Q3Kpipu8d4mqaiaDeJHOerka1qr0eqL+CiuiuNaTcTn B7lmTUXD3gVm1T0qye6TXqlxiovkVnuVgq5l3ljgnnRYn067Js1evROjV5nSbNAGYMOx3i81i1Zx zUHV+Cm0gwjEpJKqDDbJkCXGuvVU5isTv9TCjYXU7UXdI2ou67oqeDk6PFsE4huFrUnUt+lmj9Nq hgmo2Rz5hSQ0uRUtqrbPcqlrUqopW1WzJInOazlcxyq1rU3RVXZNdgDGth4adYJNG+JTL80tttk1 S14tdcyOxW6tY+ChjZQTU9voe8ycjHyJ2qo6RVazqnXZFUsOXSnPneT/AE0SbYd809qVuMebO9Q/ 9s0tKU/Ydtz9l+6+jz8/J6+bbqaHAGJc30I14tGlnClkOG6eQZFlWilPb233GHXmlpJJF82xU87Y 6l7lgVWPjVN0cqLuipuhJ8r051+wvXi3cWOl2mdDf63LsQpLHm+CT36ClqqapZyyMlpq16dhK6JU 7J26ta5Gbt3592azAFJ6cZZxR328ZJl+pOlVnxbHKS1clixClu0FwvVbXsVXLJJWNeykia9No2xq qpuqK57UReah/cZ6n6g6e5HrfndZFZeJO73eLKbDVw1TJYsbfR8yUNnjkaqsdTrErmSqiq17peZ3 PyIq7kAGQNdMN4j9RrboBrhatGYpc308vUlyyLC33+igeqyw9lL2FWsjoFais5m7vV3K9u6bo5Ec fmK2i7cHGfarZJgNFac6qMQt1BVOkkjqqi3RrWwyyUTKhvoq1ssj0c5myP5UVd0Ru2vzPvFNw66s 8RmP3fT+z68W7EcKvtBDSV9qfhzbjUPkZN2iyNqu9RK1FVsacvL05V6rv0C/qf8A2vF/4jf+o+hB tKMX1Vxa01lHqtqlbs4rJJ2upKqixttnbTwo1EWNY2zzc677rzbp47besnIAAAAAAAAHk9wW8FvD Rq1w0YdqDqDpr51v9184d7q/PNwg7TsrhURM9CKdrE2jjYnRqb7bruqqpdvvdHBt8zv0huv3keTo +Jtp9+lv1rVmkTn111RVOt6vDYazVZomaIzyjmjczd73RwbfM79Ibr95HvdHBt8zv0huv3k0iDTj K98puS2OhHdDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdDN3vdHBt8zv0huv3ke9 0cG3zO/SG6/eTSIHGV75OS2OhHdDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdDN3 vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTS IHGV75OS2OhHdDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdDN3vdHBt8zv0huv3k e90cG3zO/SG6/eTSIHGV75OS2OhHdDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdD N3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75OS2OhHdDNrvJ1cGbGq9+j6Na1N1VchuqIifL/t k8w8j0dl151zyOw8Jmlda/E6Ot7nQLBPNNTMij9DvM1VUvcjElVHSIjnp6LkRE3Tr7gX2yW7JLLX Y9eIXy0Fyp5KSqjZK6NZIntVr28zFRzd2qqboqL16Kh8cZxXGcLstPjmIWC32W10jeWCjoadkEMa fma1ETdfWvivrJKL00651q9/AW72UUxFMc+URmwtw/8AkqsUxqSkyXXfI3X+5RK2VtmtUskFFE9O qdpOnLLKqL/B7NEVP3yFvYbc7j5PPK6tqUM9z4fMtufeqyeOJZa3D7hLytWWRyIr56N+zUVXbubs nr6S6fONcrbb7zb6m03ahgraKtifBUU88aSRzRuTZzHNXo5qoqoqKIv1RVnJc4NsVW+LpjKd64bV dbZfbZSXqy3Cnr7fXwsqaWqppUkinieiOa9jm7o5qoqKip0VFPOqs4XsD4ouO7iexrUS632K222g xmSmpbfXOgi77LZ2Mhq5Gp+6Pg2csaO9HeR3MjkXYlGMZPkfAFkaUVa64Xvh1vdZ0X06iqwWqlf4 +tz6FzneHVWKv8L9119hOnOlVDmGQa4YNb6eW9ajU1BLdLzTV8s8Vygp4UZSvY1Xuia1Ittlja3m Tqu69S7TVFcZw83es12K5orjWpbhX1wzW2ZVceEziMrGpqfiNP2tquz92xZdZk3SKuhVfwpUam0r d1du1zuqtkRnScPX/dC+Kz/yTDf1WhoPUHQ/S7VLIcXy3NsY75e8MrFrrFcaetqKOpopV235ZaeR jnMXlTeNyqx23VqkC1F4GeF3VfO7tqZnmm9RX5LfOw84V0ORXSk7fsYWQx7xwVLI02jjY3o1PDdd 1VVXZEqfykuV2zP8AtHCJhtdBc9QNUL7baSK2U7klmoKKGoZUS1k7U6xxt7JvV226c6pujXKka4h tL/bN8onp1hVPqFmeFtbphVStumKXRtDcGpHVzfBpM5j05Hfvk5euydTUejvC9oFoDNVVmkmmVrs NbWs7OorueWqrJGKu6sWone+XlVURVbzbKqIu3QkVbpJp7cdUrdrTWY/2mZ2m1SWSjufe507Kie9 z3Rdkj+ydu5zl5lYruviBVeFcIFRhmWWrK3cVvEJf0tVUyqW2XrMYqmgq+Vd+zniSmar419beZN/ lNCAx9xCcQma6pZrX8MHDBdu7XSm+CzfN4k56fGqd26OpqdydH1zkRUREX4Pr1RyOdHiZimM5bUU VXKoppjOZcfiV1yyTWrJbvwlcO09NLO+J1HqBl0kKT0Vgo5EVslJEi+jLWSN5m8v7zqnRyOdHC7b 5N7g+orfTUdXpdPcJ4ImRyVc9+uLZJ3ImyyOSOdrEcq9VRrWp16IidC6NJdJcK0VwqjwXBbb3aip t5JppF56isqHfhzzv8XyOXqqr+ZERERESZFG5eqqnVqh6XC8H27NH+pETLN3vdHBt8zv0huv3ke9 0cG3zO/SG6/eTSII+Mr3ytclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6G bve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8 mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdf vI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO 6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1 +8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpD dfvJ/HeTq4M2NV79H0a1qbqq5DdURE+X/bJpI4N9sluySy12PXiF8tBcqeSkqo2SujWSJ7Va9vMx Uc3dqqm6Ki9eioOMr3yclsdCO6Hh/kejsuvOueR2HhM0rrX4nR1vc6BYJ5pqZkUfod5mqql7kYkq o6REc9PRciIm6ddpcP3kq8VxiWkybXbI3X+5RObMyz2qV8FFE9OqdpOnLLKqL/B7NEVP3yG6MZxX GcLstPjmIWC32W10jeWCjoadkEMafma1ETdfWvivrO0JKr9UxlCpZ4NtUVadzXPh3K48lx8RPTL9 NfritNVGVfJcfET0y/TX64rTVRfeZAAAAAFQ8WGhDuJDQnItK6O7R2q51qQVdqrpEVWU9bTytlhV +268iqzkcqIqo16qiKqIhXkeonHvfbLb8PpeHfFsXyJXQQXDMbjlNNXWdjWub21RFQwbVL+dqO5Y 3cnKrk3cu25qEAYb4iH6kUXlC9JrtprQW273614BdKl9rrahaOG6QpM9k0CTbP7F6ter2Ocjm87G I70VVUmuKac66azcVOK6/wCsOmlPp1j+mdmuFDj1nkvdNdK2urq1ixTVD3UyrHHGkSqiNV3Nu1q+ teW67vodid61ysHEBVXC7MyHHbJU2Glpo5Ykon0871e9z2LGr1eir0VHonyopYgGNtJMN4nOEK2Z DpHp/oZR6oYW+9Vt1xS5UuVUlqloaepf2ndKyKp2cvI9XL2kXPuir09ScKl4FcvyThP1E05zbJ7Z T6mamZPU57W19JzuoqC8vnjmigY7bmWJvZIxzuVVTtHq1F2bvtYAZRdknH9qKzGsHfpfZdKJKeup n5Nm7MgoLtHU0sS/DsoaLs3ua6bb0e1RORF23/fJJ9LtKc+xzjL1t1XvNh7viuX2nHaazV/eoX96 kpabknb2TXrIzld03e1qL6t0NDgDO+l2lGf45xm626sXmwd3xXLrTjtLZq/vUD+9S0tNyTt7Jr1k Zyu6bva1F9W5ogimpWCVeouNLjtHqBleGyLPHP5zxqqhgrERu/wfPNFK3kdv1Tl36J1Qqf3JeQfj icQX/wB/rZ//AA8CW643LiIx6pxvJdC8asOWUVFUTtyLGa6sbQVVwgexEifS1b944nxu3VWvTZyK ibpt1pHENINXdSeK7CuITJNBbNozQ4ZQXSC5JFeqOvuWTyVcPZRxz9zRY0ihXd6LI5zt16J4K3Ru lemddpja62212qeb5w6sqEnbVZVWU9TPTojUb2cawQQojOm+yoq7qvX1E3AxrpJhnE5wgUWQ6Taf 6G0eqeDS3qsu+LXCkyqktM9vp6l/OtHVx1KJvyPVypJHzb7qu3XlbMtT9CNZ+JHhPvem2sl5xm0a gXafzpbpLMyXuVrnhqGzUkD5HKrpdkb2b5WtTo9Va1yt3dpgAZRdknH9qKzGsHfpfZdKJKeupn5N m7MgoLtHU0sS/DsoaLs3ua6bb0e1RORF23/fJJ9LtKc+xzjL1t1XvNh7viuX2nHaazV/eoX96kpa bknb2TXrIzld03e1qL6t0NDgDKF002120D4i881l0Y04o9R8W1UhoJr1YW3uC119tuVJGsbZ4X1O 0UkT2ucrm8yO5nfI1OaydO2cROoVjzh2tmOY3hlDfad1DjtgoavzhWW+N0LmSSVlWxUikc5zkcjI 27NRFTmUuYAZT4PdKtSbVw+Q8NHEhohQ0Vlxqm7iysffKa4UmQxrVyzfuES88bETs92y/h77K3bd p2HCBS0tDqbxH0VFTRU9PT6jpFDDExGMjY220qNa1qdERERERE8C/M+tOZXzEq+16f5hS4tf5+y7 ndqm1JcoqbaRrn81MskaSczEexPTTZXI7rtstCaN8MevmlOf3zMKrias96ocvv7b/kluTAGUzq2T smROZFN31/YIrI2pujXbLuuwGmwAAAAAAAY84t/jk8KP+PX6qgLgKf4t/jk8KP8Aj1+qoC4ClifX jsej4I9hPb9IAAV3VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEQ1euX mrTHJavm5Vdb5IEX5FlTs0/9ry8tPbP7H8CxyxKzlW32mkpnJ/fMha1f/aimfNZoPOtksmJInN7J Mht1sVvytdKjl3/N6BqMnwsZ11T1R9XN4bq0cNao3zVPdERH1AAXnmQAAAAAAAAAAAAAAAAAAAAB R+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wXiM0R 0at1pt9RbNT/AGS+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAyr5Lj4iemX6 a/XFaaqMq+S4+Inpl+mv1xWgaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYL8nR 8TbT79LfrWrNImbvJ0fE20+/S361qzSJzLnrz2vY4X2FHZHyAAapwAAAAAAAAAAAAAAAAAAAAAAA AAAAABxrlbbfebfU2m7UMFbRVsT4KinnjSSOaNybOY5q9HNVFVFRTOeMZPkfAFkaUVa64Xvh1vdZ 0X06iqwWqlf4+tz6FzneHVWKv8L910qca5W233m31Npu1DBW0VbE+Cop540kjmjcmzmOavRzVRVR UU3t3JtznCrisLRiqNGrbzSuG1XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY5u6OaqKioqdFRT lmB8YyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn0LnO8OqsVf4X7ru21XW2X22Ul6stwp6+318L KmlqqaVJIp4nojmvY5u6OaqKioqdFRToU1RXGcPLXrNdiuaK41uWAY+4hOITNdUs1r+GDhgu3drp TfBZvm8Sc9PjVO7dHU1O5Oj65yIqIiL8H16o5HOjzMxTGctKKKrlUU0xnMnEJxCZrqlmtfwwcMF2 7tdKb4LN83iTnp8ap3bo6mp3J0fXORFRERfg+vVHI50cs0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyo d+HPO/xfI5eqqv5kRERERGkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1VV/MiIiIiJMi hduzcnqeowWCpwtOc66pAARLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACuPJcfET0y/TX64rTVRl XyXHxE9Mv01+uK01UdV4cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjzi3+OTwo/49fqq AuAp/i3+OTwo/wCPX6qgLgKWJ9eOx6Pgj2E9v0gABXdUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAARCsp/PuuenNh25oqF9deahP4PZRbRL/AOmppIz/AKTU/nziByu9KnNH jdipLS1fUj6h6zrt+fZuymgC1g4/BNW+flqcPh6v/XotdGmPHOr5TAAC24YAAAAAAAAAAAAAAAAA AAAAimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQb V2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAABlXyXHxE9Mv01 +uK01UZV9644E/mM+k14+9gaqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+k14+9 j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+k14+9gaqBlX3rjgT+Yz6TXj72PeuOBP5 jPpNePvYGqgZV9644E/mM+k14+9j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+k14+9 gaqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+k14+9j3rjgT+Yz6TXj72BqoGVfe uOBP5jPpNePvY9644E/mM+k14+9gaqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+ k14+9j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+k14+9gaqBlX3rjgT+Yz6TXj72Pe uOBP5jPpNePvYGqgZV9644E/mM+k14+9j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+ k14+9gaqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+k14+9lE4V5P/hOqLzmGNZB pR3isx+/VFLE9b7c2KtI7Z0CqjahE6tVf8nipFcu02ss+ddwmBuY2KptzH4cs8+vVuSzydHxNtPv 0t+tas0iRvTnTnDdJcNt+n2n1m81WC1dr3Sk7xLP2fayvlf6crnPXeSR69XLtvsmyIiEkKFU6VUy 9PZom3bponbERAADCQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABxrlbbfebfU2m7UMFbRVsT4Kinn jSSOaNybOY5q9HNVFVFRTOeMZPkfAFkaUVa64Xvh1vdZ0X06iqwWqlf4+tz6FzneHVWKv8L910qc a5W233m31Npu1DBW0VbE+Cop540kjmjcmzmOavRzVRVRUU3t3JtznCrisLRiqNGrbzSqLXLiVyXW rJJeHbhKyOB88sEcmXagUb0mo7BRSpukVLI1eWWskaq8vKvofKjkc6OaaS6S4VorhVHguC23u1FT byTTSLz1FZUO/Dnnf4vkcvVVX8yIiIiIlL+TettvouD7CaujoYIJ7hLdJ6uSONGunkS41MaPeqdX ORkbG7r6mNTwRDTRveuTVVlzQg4PwtFm3FznmAAELogAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ArjyXHxE9Mv01+uK01UYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yXeU0dbznoi/vjx8m9AYL97o4Nv md+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWei L++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg 2+Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3u jg2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0 dZ6Iv748fJvQGC/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3ujg2+Z36Q3X7yP e6ODb5nfpDdfvI5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQG C/e6ODb5nfpDdfvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfv I5TR1noi/vjx8m9AYL97o4Nvmd+kN1+8j3ujg2+Z36Q3X7yOU0dZ6Iv748fJvQGC/e6ODb5nfpDd fvI97o4Nvmd+kN1+8jlNHWeiL++PHyb0Bgv3ujg2+Z36Q3X7yPe6ODb5nfpDdfvI5TR1noi/vjx8 kx4t/jk8KP8Aj1+qoC4CktOeC3ho0lzK36g6faa+ar/au17pV+ebhP2faxPif6Es7mLvHI9OrV23 3TZURS7Sveri5VnDrYDDV4W3NFe3PPV7gAES6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAR/UC9+xvCL5e0fyvpaGV0S77fCK1UZ/7ytMTOUZy2oom5VFMbZdvwtU3fseynOH puuS5HVzQP8AlpYtook/PsrXl2EJ0TxpcQ0mxSwPj5JYLZFJM3b8GaVO0kT/ANN7ibHQw9Ohapid zynCl6L+MuV07M5iOyNUeEAAJlAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8F4jNEdGrdabfUWzU/wBk vnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzR y867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAztltL7GOI6uRE5KbMrDDVovqdVUrljVP5ez2X+c0SUfxOUnmpuFajxpt7Hr4ymqn+HLR1bezlX f+VGdPzlbF0529Ldr8/B2eArmji+Ln9+Jp9+2P6ohzQAU3fAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAGbvJ0fE20+/S361qzSJm7ydHxNtPv0t+tas0ibXPXntQYX2FHZHyAAapwAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDqzTLkLcZ0+j3cuU36kpJ2p/+isf2 krv5ka1SfEZw6k9lPEbTOVOelwmxyVKr4o2sq15ET/8AVbrv+Y1mnTmKN8//AHwSUXOIiq/0Imff zeOTRCIjURrUREToiJ6j+gHXeDAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7K fPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m 2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAACH6vYl7OtMckxVkfaTV1vk7u3bfednpxf5xjCYA1qpiumaZ50lm7VYuU3aNtMxMe7Wzv prkXsqwOyX1X88lRSMbMu/8AvrPQk/8Aea4kpB8JovYhnOdacOTkit11W6UDV8O6Vado1rflRq7p /KpODlUZ5ZTth7m/o6c1UerOuOydceEgANkQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM3eTo+ Jtp9+lv1rVmkTN3k6Pibaffpb9a1ZpE2uevPagwvsKOyPkAA1TgAAAAAAAAAAAAAAfxj2SNR8b2u avgqLugH9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFVETdV2RDi8LtGtztGU6kyN3XL L3K6mf8AwqOm3ih6+vZe0QjerN+lx3T68VlLutXPD3Ola3q500y9m3lT1qiu3/mLu05xSLB8EsOJ Rom9roIoJFTwdKjd5HfzvVy/zkmHp0rue6Pn/kqnCt3icDNPPXOXup1z46KRgA6LyQAAAAAAAAAA AAAAAAAAAAAAACKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/Vn RvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoHW+i9i2r2GZ4xEZS36GXGa93gnaKva 02/yqruZN/HZp3Z3nEJiM+YaTXult6O8422Nt1oHN/CbPTr2icv51ajm/wD3RDMRyCDKsYteRU+y NuFLHMrU/ePVPSb/ADO3T+Y5t6nQuzG/X5/51vYYC7yjBUVc9GdM/OPCZj3O3ABosAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAzd5Oj4m2n36W/WtWaRM3eTo+Jtp9+lv1rVmkTa5689qDC+wo7I+Q ADVOAAAAAAAAAAAAZ51A1Az/AF3z+s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RU c6Paiia5yhDfv0YejTrNQNQM/wBd8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69U VHOj6i64flvk9rlTb3O9Zdw+3SVkc9bVqtTccPrZFRHSyq1E7SjlequVURORzl6b7drsXRXRXANA cAoNOtObT3S3Um8k00i89RXVDtu0qKiTxkleqbqq+HRERGoiJMLrarZfbZV2W9W+nr7fXwvpqqlq Ykkinieitcx7Xbo5qoqoqL0VFL0WaYp0Xmq8feqvcbE5ZcynrbcrfebfTXa010FbRVkTJ6eogkSS OaNybte1ydHNVFRUVDkmasnxjI+API1raJtwvfDre6zqnp1FVgtVK/wXxc+hc53j1Vir/C/ddGW2 5W+82+mu1proK2irImT09RBIkkc0bk3a9rk6OaqKioqFK5bm3OUvQ4XFUYqjSp288OSADRaAAAAA AAAAAAAAGOOArgK4TtaeE7BtTNS9KfPOSXnzn32t8+3Kn7XsrlVQx/Bw1DI27RxMb6LU323XdVVV 0B71xwJ/MZ9Jrx97HkuPiJ6Zfpr9cVpFK6u4sdaeLHW/TPTTin9rXG9NfY13Ki9g9tvPa+cLak0n wk3JI3aSJ7vSc/ftNk5UaiL1Xh0r9644E/mM+k14+9j3rjgT+Yz6TXj72Pc8cdn5RX6orP8AaD3P HHZ+UV+qKz/aAPeuOBP5jPpNePvY9644E/mM+k14+9j3PHHZ+UV+qKz/AGg9zxx2flFfqis/2gD3 rjgT+Yz6TXj72PeuOBP5jPpNePvY9zxx2flFfqis/wBoPc8cdn5RX6orP9oA9644E/mM+k14+9j3 rjgT+Yz6TXj72Pc8cdn5RX6orP8AaD3PHHZ+UV+qKz/aAPeuOBP5jPpNePvY9644E/mM+k14+9j3 PHHZ+UV+qKz/AGg9zxx2flFfqis/2gD3rjgT+Yz6TXj72PeuOBP5jPpNePvY9zxx2flFfqis/wBo Pc8cdn5RX6orP9oA9644E/mM+k14+9j3rjgT+Yz6TXj72Pc8cdn5RX6orP8AaD3PHHZ+UV+qKz/a APeuOBP5jPpNePvY9644E/mM+k14+9j3PHHZ+UV+qKz/AGg9zxx2flFfqis/2gD3rjgT+Yz6TXj7 2PeuOBP5jPpNePvY9zxx2flFfqis/wBoPc8cdn5RX6orP9oA9644E/mM+k14+9j3rjgT+Yz6TXj7 2Pc8cdn5RX6orP8AaD3PHHZ+UV+qKz/aAPeuOBP5jPpNePvY9644E/mM+k14+9j3PHHZ+UV+qKz/ AGg9zxx2flFfqis/2gD3rjgT+Yz6TXj72PeuOBP5jPpNePvY9zxx2flFfqis/wBoPc8cdn5RX6or P9oA9644E/mM+k14+9j3rjgT+Yz6TXj72Pc8cdn5RX6orP8AaD3PHHZ+UV+qKz/aAPeuOBP5jPpN ePvY9644E/mM+k14+9j3PHHZ+UV+qKz/AGg9zxx2flFfqis/2gD3rjgT+Yz6TXj72PeuOBP5jPpN ePvY9zxx2flFfqis/wBoPc8cdn5RX6orP9oBSOofC5oTw18ZPDZ7SmDexz2R+zHzn/snWVnb93tT Ox/2zLJy8vby/g7b83XfZNtalD5dwNcVGd5limoOVcenfr/g/f8AzDV+1bbou598ibFU+hHUNZJz xsanwjXcu27dl6kC4o9POMnhr0JybWv3bnsj9jncv9jPa2tVH2/eKyCm/duaTl5e35vwF35dum+6 V71mq5VnDrYDH28LbmiuJzzz1e7ra1ABSeiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAABDLtRezPWLBsFREkprdM/Jri3xRI6fpBunrR0q7Ki9DSxRPDlQ+yLJc31TmbzRVta2x 2xy+HdaZPTe3+9e9UX+Vql7FvCU5UTXvcLh67niIsRsoiI9865+eXuAAWnEAAAAAAAAAAAAAAAAA AAAAAAAU1qhrbf8ABeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMite mVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfxURUVFRFReiopmLAKBcJyrL9KpE5IrJcVrbY 31dwqfhI0b8vKqqi/nU08UJr9b1xPUDDtUoU5KWqeuNXdyJ/vcqq+ne78zZEduq/mQqYun8MV7vl Lu8A3srtWGnZXGr+aNcd8Zx73cAAqu2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADN3k6Pibaff pb9a1ZpEzd5Oj4m2n36W/WtWaRNrnrz2oML7Cjsj5AANU4AAAB/FVE6qqJ6uoH9AAAAzzqBqBn+u +f1nDXw13LulVSbMzfN2N56fG6d26OggcnSSteiORGovodeqKjnR7UUTXOUIb9+jD0adZqBqBn+u +f1nDXw13LulVSbMzfN2N56fG6d26OggcnSSteiORGovodeqKjnR6u0V0VwDQHAKDTrTm090t1Jv JNNIvPUV1Q7btKiok8ZJXqm6qvh0RERqIiNFdFcA0BwCg0605tPdLdSbyTTSLz1FdUO27SoqJPGS V6puqr4dEREaiIk7OhRRFuMoeVxOJrxNelV7o3AAN1dxLrarZfbZV2W9W+nr7fXwvpqqlqYkkini eitcx7Xbo5qoqoqL0VFMJZPjGR8AeRrW0Tbhe+HW91nVPTqKrBaqV/gvi59C5zvHqrFX+F+674OJ dbVbL7bKuy3q309fb6+F9NVUtTEkkU8T0VrmPa7dHNVFVFReioprVTFcZSls3q7FcV0TrU9bblb7 zb6a7WmugraKsiZPT1EEiSRzRuTdr2uTo5qoqKiockzVk+MZHwB5GtbRNuF74db3WdU9OoqsFqpX +C+Ln0LnO8eqsVf4X7roy23K33m3012tNdBW0VZEyenqIJEkjmjcm7XtcnRzVRUVFQ59y3Nucpep wuKoxVGlTt54ckAGi0AAAAAAB/FVE6qqJ6uoH9AAFceS4+Inpl+mv1xWjh4+PZxc/wCIP6nlHkuP iJ6Zfpr9cVo4ePj2cXP+IP6nlOq8OlXErxK53otnem2memmiPtlZJqV547lReyWGzdl5vhhmk+Em ifG7eOV7vSczbs9k5lciJFfdD8dn5Or63bP9mOIf49nCN/j9+p4jVQGVfdD8dn5Or63bP9mPdD8d n5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63 bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2 ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/wBmaqAG VfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZmqgBlX3Q/ HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6 vrds/wBmPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP 9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mVVxR3Tjs4lNCcm0U9wn7HPZH3L/AGT9s+z1nYd3 rIKn9x2j5ubsOX8NNubfrtsu/wAAYj9sTjs/EC+tWz/skw4c9Y/b/wBGse1b9jnmHz93v/Y/vneu x7Cqmp/3XkZzb9jzfgptzbddt11YYL8nR8TbT79LfrWrKl+3TRTnTDvcG4u9iLs03JzjLq3w0iAC q7QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEV1QySXFcGulypOZa2SPutE1qbud USryM5U9aort/wCYlRDlt659rdi+HonaW7GGOyW5ptu1ZGryUzF9W/OvNt60U1qzn8MbZ1JbU00T Ny56tMTM+7m9+z3rq0swuLT3Tyw4dG1qPt1Gxk6t8HTu9KVyfyyOcv8AOSoA61NMURFMbIeGu3ar 1yq5XtmZme2QAGUYAAAAAAAAAAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vO Fvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfS c9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAE T1VwiLUXT2+Ye9GpLX0rkpnu/wB7qG+nE7+Z7W7/AJtyWAxVTFcTTOyUlq7VYuU3aJymJiY7YZy0 xyabK8Lt9xrkc24QtWkr2OTZzKmJeSRHJ6lVU5tv75CVERuduTTvXS8WBrOztWcwrfKD1NbWs6VU afnd0kX82xLjkxE0/hnbGp7i5VTcyu2/VqjOPfze6c49wADZGAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAzd5Oj4m2n36W/WtWaRMA8FvBbw0atcNGHag6g6a+db/AHXzh3ur883CDtOyuFREz0Ip2sTa ONidGpvtuu6qql2+90cG3zO/SG6/eSWuKdKdfh+qlhqr3E0ZUxllHPO7+VpEGbve6ODb5nfpDdfv I97o4Nvmd+kN1+8mmVG+e79U2lf6MfFP2tIgzd73RwbfM79Ibr95HvdHBt8zv0huv3kZUb57v1NK /wBGPin7WkTgX6x2zJrHcMcvVMlRb7pTS0dVEqqnPFI1WuTdOqdFXqnVDPvvdHBt8zv0huv3k/jv J1cGbGq9+j6Na1N1VchuqIifL/tkZUb57v1M78/ux3z9rIEfGTxEcGOrV60W1MqH6g49YqvsqV11 lVtc+hciOgmiqtlVeaNzVVsiSIi7tRW7Kbi0I4yNCuIKKGjxLKW2+/SN9OxXXlp61HetI0VVbMn5 43O2TxRDygyPR2XXnXPI7DwmaV1r8To63udAsE801MyKP0O8zVVS9yMSVUdIiOenouRETdOu0eH/ AMlXiuMyUmS675G6/wByiVsrbNapZIKKJ6dU7SdOWWVUX+D2aIqfvkLFym3lnOqXKwl3FTXNNEZ0 Z8+z3T/nYvfUDUDP9d8/rOGvhruXdKqk2Zm+bsbz0+N07t0dBA5Okla9EciNRfQ69UVHOj1doror gGgOAUGnWnNp7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjURExxhtzuPk88rq2pQz3Ph8y259 6rJ44llrcPuEvK1ZZHIivno37NRVdu5uyevpLve1XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY 5u6OaqKioqdFRSazFMU/hUMfXeqvTF7Vls3OWYB0W0uyjiM1k4gpcr4kNb7FT4lqFWWm00OOZxU0 VJT027nIxsSo9qI3wRGoiInTY38ZA4Ff7bfFP/51az/qcSqTgXHINZuC/VrAbJmOrN71M0g1IvUW LR1eTdnJecfusyL3ZXVTGt7xFJyrvzonKjHKiIqen/des6yrPOMWzcMd31tvOkuFvw9Mhiq7JVxU FxyK4OqViSmhrJGr2aNY1y8jPSXkf4+irPhxq5LaNaNXNGOFnA62G7ZHT51QZhkbaR6S+ZrXQNf2 jqhW9InvSVeVqqiqrUTpzt3tDU2fhQ4iNUbjwxav4xbb1lWP0UNzp6S7UrqaR8M7UVXUFSitkdsn Lz9k5NlTZd1avKHTW3hv140o1FxTJNIOIzLspxl1ekOXY/qPfJLmyWgcnpS0U/Yukjnb4taqo1y7 buRqOaunTz21t0yp+BS96d5Tw46sZdSOyDL7fYZNN7nen3KgutJO9Wyd3glVZI3t6J2m67czdlau 3N6EgcS62q2X22VdlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FRTCWT4xkfAHka1tE24Xv h1vdZ1T06iqwWqlf4L4ufQuc7x6qxV/hfuu+DG3ErrlkmtWS3fhK4dp6aWd8TqPUDLpIUnorBRyI rZKSJF9GWskbzN5f3nVOjkc6PSuKZp/FsT4au7RdibW1bttuVvvNvprtaa6CtoqyJk9PUQSJJHNG 5N2va5OjmqioqKhyTMtt8m9wfUVvpqOr0unuE8ETI5Kue/XFsk7kTZZHJHO1iOVeqo1rU69EROhy fe6ODb5nfpDdfvJz8qN8936vVRVf6MfFP2tIgzd73RwbfM79Ibr95HvdHBt8zv0huv3kZUb57v1N K/0Y+KftaRBm73ujg2+Z36Q3X7yPe6ODb5nfpDdfvIyo3z3fqaV/ox8U/a0icC/WO2ZNY7hjl6pk qLfdKaWjqolVU54pGq1ybp1Toq9U6oZ997o4Nvmd+kN1+8n8d5OrgzY1Xv0fRrWpuqrkN1RET5f9 sjKjfPd+pnfn92O+ftZAj4yeIjgx1avWi2plQ/UHHrFV9lSuusqtrn0LkR0E0VVsqrzRuaqtkSRE XdqK3ZTcWhHGRoVxBRQ0eJZS2336Rvp2K68tPWo71pGiqrZk/PG52yeKIeUGR6Oy68655HYeEzSu tfidHW9zoFgnmmpmRR+h3maqqXuRiSqjpERz09FyIibp12lw/eSrxXGJaTJtdsjdf7lE5szLPapX wUUT06p2k6cssqov8Hs0RU/fIWLlNvLOdUuVhLuKmuaaIzoz59nun/OxrXyXHxE9Mv01+uK0cPHx 7OLn/EH9TyjyXHxE9Mv01+uK0cPHx7OLn/EH9TyltwziH+PZwjf4/fqeI1UZV4h/j2cI3+P36niN VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBfk6Pibaffpb9a1ZvQwX5Oj4m2n36W/Wt WV8T6kdrq8Ee3ns+sNIgApPRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD51NTBR 08tXVStjhgY6SR7vBrUTdVX+REPxwxWaorLFe9U7pCrazNa91RAj09KOgh3jp2f5Ecv50VpC9WJa 670Vq04ssituWaVzLa1yeMVNujqiXb5Gs8fzONJWe00NhtFFY7XAkNHb6eOlp408GRsajWp/kRCX DU6dzS3fOf0+alwte4jCRajbcn+mnzq/tcwAHQeUAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXn eI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7Kf PLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAABUvEpitdd8DZl1ih573hlS29UeydXxs/d4v5HR7qqetWIh1FivFF kNmor5bn89NXwMqI19ezk32X86eC/nQu+SOOWN0UrGvY9Fa5rk3RUXxRU9ZmPDKF+n2a5Jo/Uq5t PbplutjVy/h26d2/Kny9m9Vaq/KqlDE0aFcV806ve9RwNf47DVYedtGuP5Z2905T75TsAELoAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAM3eTo+Jtp9+lv1rVmkTN3k6Pibaffpb9a1ZpE2uevPagwvsK OyPkAA1TgAAHBvtkt2SWWux68QvloLlTyUlVGyV0ayRParXt5mKjm7tVU3RUXr0VDnAG11eM4rjO F2WnxzELBb7La6RvLBR0NOyCGNPzNaiJuvrXxX1naAAiIjVDjXK22+82+ptN2oYK2irYnwVFPPGk kc0bk2cxzV6OaqKqKimc8YyfI+ALI0oq11wvfDre6zovp1FVgtVK/wAfW59C5zvDqrFX+F+66VON crbb7zb6m03ahgraKtifBUU88aSRzRuTZzHNXo5qoqoqKb27k25zhVxWFoxVGjVt5pXDarrbL7bK S9WW4U9fb6+FlTS1VNKkkU8T0RzXsc3dHNVFRUVOiopQeVeT94Sc1yq9Ztkel1TUXnIq2W43Ooiy a706VFRI5XPescVU1jd1VejWoiepCjsYyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn0LnO8OqsV f4X7ru21XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY5u6OaqKioqdFRToU1RXGcPLXrNdiuaK4 1oNo/wAPWi2gVvqbbpDp3asbZWq3vU0DXyVFRy/gpJPK50siJuuyOcqJuu3ip8tYOHDQ/XyKkZq5 pxashloEVtJVS88NVA1V3VrKiFzJWt368qORN+u25ZINkSmNL+Dfhn0byNmYafaT26ivsSK2G5Vl TU3Gqg3TZeylq5JHRqqKqbtVF2VU8FUucGPuITiEzXVLNa/hg4YLt3a6U3wWb5vEnPT41Tu3R1NT uTo+uciKiIi/B9eqORzo8TMUxnLaiiq5VFNMZzJxCcQma6pZrX8MHDBdu7XSm+CzfN4k56fGqd26 OpqdydH1zkRUREX4Pr1RyOdHLNJdJcK0VwqjwXBbb3aipt5JppF56isqHfhzzv8AF8jl6qq/mRER EREaS6S4VorhVHguC23u1FTbyTTSLz1FZUO/Dnnf4vkcvVVX8yIiIiIkyKF27Nyep6jBYKnC05zr qkABEvAAAAAAcG+2S3ZJZa7HrxC+WguVPJSVUbJXRrJE9qte3mYqObu1VTdFRevRUOcAbXV4ziuM 4XZafHMQsFvstrpG8sFHQ07IIY0/M1qIm6+tfFfWdoACIiNUK48lx8RPTL9NfritHDx8ezi5/wAQ f1PKPJcfET0y/TX64rRw8fHs4uf8Qf1PKdV4c4h/j2cI3+P36niNVGVeIf49nCN/j9+p4jVQAAAA AAK7071xxPUzPtQtOrDb7tBctNa+lt12lq4omwTSTxLIxYHNkc5zUa1UVXtYu/gi+JYh5rUnEzbu H/iG4l7FZI6C5aiZ3m1isuIWisqGwQS1clIsfb1EjlRGU8bpGK5d0Vyq1qbbq5oelIMTcQWXal8F XCZDWVusFzyDUXN8kpbVW5bfKiWrpbZV1naSTzU1M9VZBTwxQypHExqNTZrlavVpR+o/EtpRofjd u1Q0H46c31GyuyV1G+7Yxkl3nr6LIaN8rWVLI4ZYWspXo1yva6NW8rWqibrsoHqSDKuL5zlGnXHP c8CyHLbxc8K1oxmLIsPiuFdLPBb7jRN2q6OmbI5Uia+Jyzua3ZE9BEQhked686i5TxP6x6P3q818 GFUL8DwKxx1L5aKe6UjEkuFYykVexlqElVGxv5XK5PQ6p0UNug86NHciwjUGkx6LT7j81KsWs0cl G+5WHPrnI+lmrd2rVUTrTUtiY9F+EaxtO/dvoqjl23PRZN9uviBXGsWvGIaMOsFtvFrv1+v+V1Ut JYsfx+h73cbi+JnPMsbFc1iMjYqOe972taipup/dHdd8Q1o8/wBBZrXfrFfsUq46K+2C/wBD3S42 6SRnaRLIxHOYrJGekx7Hua5EXZTIfGdr3dqLWLHdS9CcTqskuHD1PcafMbxVUznWG2RXSCOnkhld G5JppYVSKWRkDXLG1q8yps5EufRuLGNFtQbYzN89qM81Q4jJX3eW82uhZHbnUtuokdEyFjXr2NJF BIjY3qrnSOfuq7qiIGnAfxd9l5URV9W55k6d5/bcxZdLRxPcY2q+j2ur7hWtfZ6m7yWaw0CpM9KR aaF0aUlRTqxI1Xmern7u2XZUeoem4MPcW+vmYaSWfRDRrKtdqbG5c7WZ2Yai2yjbA9tBRwxukfSs RJGwyVLpGo17UcjV8ERF2SA47xL6b6Za96W2nQzi1yrVXHc6v0WL5HjuT3We6S0r6lUZTV1NPPG1 8XLKqI9iKrVRydE8UD0fBjDD6POuMLWPV+a7a1agYRhummTSYZY7Vhl381yTVVM3+yqqqmaxz5lV 6pyMX0UTpsvXfouKGr4mNBuCy8rlWrMl5ymyZjQRWHIbTVz0ddW2l1bGkEdc6Nsfwzmq5knIqtc1 U3Vy7uUN2AxVxM5RnXBhw7VuS0ms+R33NtQcgttjkyDJapKuislTOyV89RR0vIjIIGRxzK2JEVE2 ZvzbLvReo/EtpRofjdu1Q0H46c31GyuyV1G+7Yxkl3nr6LIaN8rWVLI4ZYWspXo1yva6NW8rWqib rsoHpNVahYdR5/QaXVN6a3KLna6i9Utv7GRVfRQyRxySq9G8jUR8rE2c5HLuuyKiLtIzBOVaW23M fKbWhGaiagUlLc9LfZRG6gyaqpnRP858iU0Std8HSOaxrnU6eg5yq5U3U6fN9RaCTiI1Dxji14i9 V9IKeK7NgwCGw3KezWSrtPZpyVHeoYnRzTK7dX9s7Zq7t67K1oehwK24eqDI7dphQQZDrHR6oxum nktmT08cSLWW9Xr2CSvic6OaRrfRdK3ZHbdU33VbJAAAAAABgvydHxNtPv0t+tas3oYL8nR8TbT7 9LfrWrK+J9SO11eCPbz2fWGkQAUnowAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACJa oZPVYxicz7Sx0l3uUjLba4mfhyVUy8rOX86dXf8A3JrVOjGct7dE3a4op53P0Tty5zqnkWpc7Oe2 461cesyr+C6b8Kqlb/lRiKm+6OX5DQJFtMMHpNOMDs+HUqtc6gp0SolT/fqh3pSv/nerlTf1bJ6i UnRw9vi7cRO3neU4UxUYvE1V0erGqnsjZ37Z65AATOeAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb /gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzC g7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAFJcStgqbbSWXWGzU7pK3EJ9q9jPwp7ZKvLM38/Lujk+Tdyl2n wr6GkulDUWy4U7J6WrifBPE9PRkjcitc1fzKiqhHdt8bRNK3gcVOCxFN6NeW2N8TqmPfCnqSrpq+ khrqOZstPURtlikb4PY5N2qn5lRUPqQTT2Gswu9XzR67zPfPjc3a2yV/jUWyVeaJ351bvyr8i7J6 idnMpnONe17G5TFFX4ZzidcTvidcT3AANkYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzd5Oj4m2n36W /WtWaRM3eTo+Jtp9+lv1rVmkTa5689qDC+wo7I+QADVOAAAAAAAAAADjXK22+82+ptN2oYK2irYn wVFPPGkkc0bk2cxzV6OaqKqKimc8YyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn0LnO8OqsVf4X 7rpU41yttvvNvqbTdqGCtoq2J8FRTzxpJHNG5NnMc1ejmqiqiopvbuTbnOFXFYWjFUaNW3mlcNqu tsvtspL1ZbhT19vr4WVNLVU0qSRTxPRHNexzd0c1UVFRU6KinLMD4xk+R8AWRpRVrrhe+HW91nRf TqKrBaqV/j63PoXOd4dVYq/wv3WX65cSuS61ZJLw7cJWRwPnlgjky7UCjek1HYKKVN0ipZGryy1k jVXl5V9D5UcjnR34rpmnS5nmK8Ndou8VMa3I4hOITNdUs1r+GDhgu3drpTfBZvm8Sc9PjVO7dHU1 O5Oj65yIqIiL8H16o5HOjlmkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1VV/MiIiIiI0 l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/xfI5eqqv5kRERERJkUrt2bk9T0eCwVOFpznXVIAC JeAAAAAAAAAAAAAFceS4+Inpl+mv1xWjh4+PZxc/4g/qeUeS4+Inpl+mv1xWjh4+PZxc/wCIP6nl Oq8OcQ/x7OEb/H79TxGqjKvEP8ezhG/x+/U8RqoAAAAAAGNbFwYU2oOo/E27WfAqaGy6mV9uTHL0 2SmlrGwxU6800DmOdJA5k7Yn8r0bzKxN0chsoAYtvOgnErrVwxO0i1VWktupOmeRUlyw7Lp6uGei yF9C93dKuVkb3zQufEr2SJIxHczmv2du5qT6n1E44swns2OUvDvjens3e6db1kl3yimu1E2mY5Fm SlpKZUme6REVG9orOXfZV/fJpQAZJ8pPRVeP6MWLXXFa+nos00rya33jHnSs53Vck0zaeWiRqdXp K2RFVidVSLbom6k10p0Y1J0a4QrXpnpjdrVQ6j01n766uu8S1FNJep394qlm2Xmc10j5I0f1Vqcq 7Ly8q99lPC5g+d6w2/V/OcpzHIPMtXBcbPi9fdUdj9trYomxsqoaRrEXtU5Vfu97kR73KiJvslxg YX1/wfib4rtPk0ryrhAxrEb5Vy0rfZ1XZbQVsNnWOZj5KikZC1avdyNc1Gej0eqOVeu+37dSyUNv paKarkqpKeFkT55fw5Va1EV7vzrtuv8AKckAY2sWCcR/DtlGqmMYloJadY8A1Myi5ZZC9MlpLZU0 slwa1KmjrI6tOWaL0Uajm8y8u+6Lzcra74dtAOKzht1Khze7aL23PrdX2p1ksFvos4ja/ArbJXSV D6JrqxjUqGenHu+NXO2j5U3TovoaAPlUsnkppY6WdsMzmOSORzOdGOVOjlbum+y9dt03Mg5ZW8X2 VYDctKNWODzDtSq2WOpoo8jjye309mqefmbHUrSVCd5hVqK1Va1Fdu3drmqqbbDAGJZuD/WXT7Sr h8v2B3m0ZJqdoL3pHUlbVOgpLvRVrVbV0Mc7mqsfLGrYonvaiI1qqqN32LgwzNuLjO9QbIl/0Use mGF0CSy3x91v1PebhclVipHDSto3IyFEdsqySOXdP3vTZb6AGQ6HAeIvhl1i1MybR7SOh1SwrVG7 Jk3cY8jprRXWe6vbtU861KcksUjtnIrV5m7Im3T0ui1r0U4t9W+Eu+Y3nslvyTUDIMwor5S2G3TU dPS2K2Mq4pG0LKh/ZJOsTGuVZHuc5yrsiu2RXbZAFI8X2g974gdI243iF5pbVlmP3iiybG6urRVp 2XGkcqxpLsiqjHNfI3dEXbmRdl22WM0+onHFmE9mxyl4d8b09m73Tresku+UU12om0zHIsyUtJTK kz3SIio3tFZy77Kv75NKADK2sWAa441xjYrxGaYaXwZ5Z3YRLhlzom32mts1C5a11QlTvP0kbs5E 5Wbu6O6J037LKsm4tLFfcpxPIOGvHdY8SuFwlmsdZQ3+gtiR0D0Tkpa2lrd0e9nVFkYrkdvvyp4G lwBnzgm0NzDQnTK/2nNKS12mryfLLlk9Pj1pnWaix6mqez7O3wyKiI5saR7+iiN3cu2/VV0GAAAA AAADBfk6Pibaffpb9a1ZvQwX5Oj4m2n36W/WtWV8T6kdrq8Ee3ns+sNIgApPRgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAEXwO1+2TrbJd5W9pYtO2LHF/AmusqdV/P2bE/mdt8p+9RMrX DcUq7tTxrNXSctLb4ETd01VIvLG1E9fXrt8iKWlo3p+mmun9ux2dySXF6LWXSffdZqyX0pXKvr2X ZqL8jUNrVHGXIjmjXP0/zqQ47EcjwlVcetX+GOz96e7V7+pNgAdN40AAAAAAAAAAAAAAAAAAAAAA AAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgU1qhrb f8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABSPEjj1VaWWjWex0zpK3FX9jc42J6 VRa5F2kT86sVedPk3cvqPrRVlLcaOC4UUzZqepjbNDI3wexybtcn5lRULjrKOluFJPQVsDJqepjd DNE9N2vY5NnNVPkVFVDM2E0tXp5ld50Zu0r3MtarX2GaRetRbZHKrU3XxWN27V/kXbohz8TRoV6c bJ+f6vV8E4jlOGmxV61vXHXTM/SfCepPAARLoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAzd5Oj4m2n3 6W/WtWaRM3eTo+Jtp9+lv1rVmkTa5689qDC+wo7I+QADVOAAAAAAAAAAAAAONcrbb7zb6m03ahgr aKtifBUU88aSRzRuTZzHNXo5qoqoqKR3TTSzAdHsYjw7TjGqay2lksk6ww7uV8j13c973Krnu8E3 cq7IiInREQlYGfMxoxnpZawABkAAAAAAAAAAAAAAABm73ujg2+Z36Q3X7yc3gC05w3SXiX4ndPtP rN5qsFq9hXdKTvEs/Z9rb6qV/pyuc9d5JHr1cu2+ybIiIaEM9Xjh612tOsueat6KcUPtf+2B5r85 2/2E0d137jSpTw/C1Mi/LK70Wt/dNl5uVFJ7N3Kr8cuXj8FFduIsURnnzZRq1p9xD/Hs4Rv8fv1P EaqPOehx3XawcdnDT7dev/tm9v7MvNn/AGK0dl838tnXtv8Aayr2vabxfhfg9l0/CU9GC7TVFUZw 8/dtVWaporjKYAAZRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYL8nR8TbT79LfrWrN6GC/ J0fE20+/S361qyvifUjtdXgj289n1hpEAFJ6MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAIrqTldTiuNudaIVqL1c5WW600zURXTVcq8rERPXt4/zbesxMxTGct7dE3Koop2yYRavbQ1nW4y t7THtO3ej/AqLu9On8vZN6/mcifKaNIdpLp/T6ZYJbcWjkSaqjas9fUbqq1FXJ6UsiqvVevRN/Ui ExL+Htzbo17Z1y8vwrjIxeI/0/Up1U9kc/vnOffkAAncwAAAAAAAAAAAAAAAAAAAAAAAAAAAAART IrXplV53iNzymDH35hQd/wDYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOjeXZrxN6Dau2eS 3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACoOIvDLjcLDRajYtT8+RYY91bExvjV0ap/ZFOuyb ru1FVE/MqJ1cW+DS5bi7TNMrOExVeDv03qNseMc8dkxqUZj19t+TWSiv9ql7SlroWzRr6038UX5F Rd0VPlRTsCELZ3aP6o1WDKzs8Yyp8lzx922zKeo8Z6RFX+ZzU+RU8VVSbnMjPZVth7KvQnK5bnOm qM47PONk9cAAMtAAAAAAAAAAAAAAAAAAAAAAAAH8VURFVd+nXom5wbHfrHk1shvWOXiiulvqEVYq qjnbNE/Zdl2c1VRdl6L8inPPK7jIj1a4MeIiXUzRbKK+xY9qC991dSxbPoX1zVTvUMsDkWN+6ubI iqm6JMqNVOU3oo05yV8Tf5NTFcxnHO1/5OpzWcGen73uRrWpdlVVXZETzrV9TQlkvtlyS3R3jHrr SXKglc9kdVSTNlikVjlY7le1VR2zmuauy+KKnqPD/R3I9dNeJcH4TLDmlxo8TfUywLQUfwUTKaSa Spqp6jk2WZGo+RyNeqt9FqIiL4+3WK4zZcLxm1YhjlE2ktdlo4aGjgb4RwxsRrU/OuyJuvrXqbXq NGc550GAv8dbimI1UxEZ9eTtAARL4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz1xC2fWW06 7aJ616SaS+2B7X/sk84Wzz9S2rfv1HFTRfDVCr8sjvRY79z2Xl5kUkvut+Mn8n39a9q+xLgBNRfq ojRhz7/BtrEXJuVTOc9nkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwA25TX1IvRFjfPh5Kf91vxk /k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcp r6j0RY3z4eSn/db8ZP5Pv617V9iPdb8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91 vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn /db8ZP5Pv617V9iPdb8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2 JcAHKa+o9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617 V9iPdb8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN 8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9iPdb8ZP5Pv 617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/3W/GT+ T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9icLgt05zLSXhow7T7UGzea r/avOHe6TvEU/Z9rcKiVnpxOcxd45GL0cu2+y7KioXaDSu9VcjKVjDYC3ha9OiZz2a//AIAAiXQA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjWkNpXVDU2s1Kq2c+PYk6S2WJHJuyorFT4epR F6KjUVGtVOngqdUU67Um53isS3adYi//ALIcslWjhcib91ptvh6h23VEazfr/OnVC/8ADcTtODYt bMSscPZ0Vrp2wR/K5fFz1/vnOVXL+dVN7FHG3M52R8/819ytwjieR4bKPXuao6qeeff6sdWbugAd J5AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/AGS+caqZH9vTebaB lRF2Ozkb6TnqjuZF6eGylykUyK16ZVed4jc8pgx9+YUHf/Yq+tdEleznhRtZ3NHLzrvFy9pyIvo7 c3QlYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABB tZNN4tTcKqLPBKlNdqN7a+0VifhU9ZH1jVF9SL+Cv5nKviiFXaeZdJl1g7a4Uy0l4t8r6G60b+jq erjXleip6kVU3T8y7epTRRnvWqwSaZ5rDrJaYH+ZLusVBlMEbfRidvyw1u35lVGu/m9blUpYq3l/ qx7/AD93yej4ExXGROCr59dPbzx/3c3XHWkIPzHJHNG2WJ7XseiOa5q7o5F8FRfWh+iu6oAAAAAA AAAAAAAAAAAAAAAAAAUhxkaER8QWhV7xKjpmyX63t862J+3pJWxNVUjRfUkjFfH8ic6L6i7zPOoG oGf675/WcNfDXcu6VVJszN83Y3np8bp3bo6CBydJK16I5Eai+h16oqOdHvbiqao0VbF3Ldu1PG7J UR5Kvh/kxnFLvrvktvdFcr+59qszZWbPioon7TybL4LJMzl+VEh+Rxv0zDc8NyvyelxpmpcbzlvD 5c5WRzVlV/ZFww+tkVEdLKrUTtKOV6q5VRE5HOXpvt2ulbbcrfebfTXa010FbRVkTJ6eogkSSOaN ybte1ydHNVFRUVDe/FUV5yh4NuW6rEU29sbe1yQAQr4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAABxbpc6GzW6pu1yqGwUtJE6aaRy9Gtam6qcog1ZaZdY9Q4NNKVZPY5YnR3DJ52L6 Mq780NHv8rlTd35kX1tNZz2RtlvRFOuu5OVNMZzPV5zsjrS3h4xKtu01frblFI+K45GxIbRTyonN RWtF3jRPkdJ+Gv5tl9al3n4iiigiZDDG2OONqNYxqbNa1OiIiJ4Ifs6dq3FqiKYePxuLqxt+q9Vq z2RuiNke6PMABIqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029lPnl s0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyo i7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAcO8Wi25BaquyXikjqqGuhfT1EMibtexybKi/zHMAmM9Us01TTOcbWYMQiuWnO UVmjGSTyTdxYtVj1ZIm3fLcq9Gb+t8fVqp8idOibrPDvdb9MZtQ8bhq7DI2mymwS9+slUq8u0qbc 0Tl/gSInKqL035VXomxX+BZjBmthZcVhWlr6d7qW40bt0fS1TOj43IvVOvh+ZU/Ocuu3xNWhzc3l 7ntbGJjH2eUR60aqo69/ZV8843JGADDYAAAAAAAAAAAAAAAAAAAAzzqBqBn+u+f1nDXw13LulVSb MzfN2N56fG6d26OggcnSSteiORGovodeqKjnR7UUTXOUIb9+jD0adZqBqBn+u+f1nDXw13LulVSb MzfN2N56fG6d26OggcnSSteiORGovodeqKjnR6u0V0VwDQHAKDTrTm090t1JvJNNIvPUV1Q7btKi ok8ZJXqm6qvh0RERqIiNFdFcA0BwCg0605tPdLdSbyTTSLz1FdUO27SoqJPGSV6puqr4dEREaiIk 7OhRRFuMoeVxOJrxNelV7o3OJdbVbL7bKuy3q309fb6+F9NVUtTEkkU8T0VrmPa7dHNVFVFReiop hLJ8YyPgDyNa2ibcL3w63us6p6dRVYLVSv8ABfFz6FznePVWKv8AC/dd8HEutqtl9tlXZb1b6evt 9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUUzVTFcZS0s3q7FcV0TrU9bblb7zb6a7WmugraKsiZPT 1EEiSRzRuTdr2uTo5qoqKiockzVk+MZHwB5GtbRNuF74db3WdU9OoqsFqpX+C+Ln0LnO8eqsVf4X 7roy23K33m3012tNdBW0VZEyenqIJEkjmjcm7XtcnRzVRUVFQ59y3NucpepwuKoxVGlTt54ckAGi 0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABx7hcKK1UNRc7jUsp6WljdLNK9dmsY1N1 VTDMRMzlCO6h5bU4xaIqey0rq2/3iZKC0UbU5nS1L+iKqfwW77qvh4J03LW0g02ptMMOhsqzJVXS qe6tu1cqelVVknV71XxVE/BT8yJ61UrzQfE6zM77LrnlNGsbZ43UuL0knjTUXVHVCp6ny9dl/gqv iioX0WcLbz/1avd2fr8nH4axcU//AIrc7NdU76t3ZT8890AALrzwAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRv Ls14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ81qxiq01yldacdp5H2evW OmyuhhZv6Pgyta1P3zd9nfKnX1uU0GfGrpKavpZqGtgZPT1EbopYpG8zXscmzmqnrRUVU2Ir1qLt OXPzLuAxtWBvRciM4nVMb43fWN05Sp2kqqaupYa2jnZNBURtlikYu7Xscm6Ki/IqKfUgcFrqtEs3 bpxcZJ5cXvcjpsYrZV3SB6ru+he75UVd2qviip612SeHOjPZO2Hrqopyiu3OdNWuJ3x5xsmOaQAG WgAAAAAAAAAAAAAAGedQNQM/13z+s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc 6Paiia5yhDfv0YejTrNQNQM/13z+s4a+Gu5d0qqTZmb5uxvPT43Tu3R0EDk6SVr0RyI1F9Dr1RUc 6PV2iuiuAaA4BQadac2nulupN5JppF56iuqHbdpUVEnjJK9U3VV8OiIiNRERororgGgOAUGnWnNp 7pbqTeSaaReeorqh23aVFRJ4ySvVN1VfDoiIjUREnZ0KKItxlDyuJxNeJr0qvdG4BgHRbS7KOIzW TiClyviQ1vsVPiWoVZabTQ45nFTRUlPTbucjGxKj2ojfBEaiIidNiYXHINZuC/VrAbJmOrN71M0g 1IvUWLR1eTdnJecfusyL3ZXVTGt7xFJyrvzonKjHKiIqenurtnAxlr1nWVZ5xi2bhju+tt50lwt+ HpkMVXZKuKguORXB1SsSU0NZI1ezRrGuXkZ6S8j/AB9FWTC28N+vGlGouKZJpBxGZdlOMur0hy7H 9R75Jc2S0Dk9KWin7F0kc7fFrVVGuXbdyNRzVDSV1tVsvtsq7LerfT19vr4X01VS1MSSRTxPRWuY 9rt0c1UVUVF6KimEsnxjI+API1raJtwvfDre6zqnp1FVgtVK/wAF8XPoXOd49VYq/wAL913wcS62 q2X22VdlvVvp6+318L6aqpamJJIp4norXMe126OaqKqKi9FRTWqmK4ylLZvV2K4ronWp623K33m3 012tNdBW0VZEyenqIJEkjmjcm7XtcnRzVRUVFQ5JmrJ8YyPgDyNa2ibcL3w63us6p6dRVYLVSv8A BfFz6FznePVWKv8AC/ddGW25W+82+mu1proK2irImT09RBIkkc0bk3a9rk6OaqKioqHPuW5tzlL1 OFxVGKo0qdvPDkgA0WgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACCpaZ9b88XAqSSRuJY7 KyfJKhnRtXOi7x0TXevqm7/k2XwVE3++e5DenVVBp9hDFlynIlWOmVPwaKDwkqpF9TWpvt8qp032 2W79OMAsumeJUeJ2TnkZBvJPUSfulVO7rJM/++cv+RERPBDa1b46rLmjb5eaLGYv0dZ049pV6vVH PV9KevXzJJDDDTQx09PEyKKJqMjjY1GtY1E2REROiIieo/YB03jAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKR TIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlYAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARjUfT+y6m4nV4pfOdj JtpKeoj/AHSlnb1jmYv8Jq/5UVU8FKPwbIbzT3Cu04zr4LKrBs2V6ps2vpv97qo19aOTbf5F+TfZ NLlZa2aWVmcUFJkuIzx0OY48rprXUrsjZ2/v6aVfWx6bp16Iq/Irt6uJszV/qUbY8Y/zY7nBGPpt f/mvz+CrZPRnf2Tsnv5nUgjmC5lTZnZ1q+wdR3GkkdS3Kgk6SUlS1dnsci9fFF2X1p+fdEkZTiYq jOHeroqt1TTVtgABlqAAAAAAAAAAD+PY2Rjo3pu1yKip+ZTMWH3W5eT2y2tVaKe6cPuX3Rausnji WWtw+4zK1qyyORFfPRv2aiqu7mbJ602l08ca5W233m31Npu1DBW0VbE+Cop540kjmjcmzmOavRzV RVRUU3t3JtznCtisLTiqNGrbzSuG1XW2X22Ul6stwp6+318LKmlqqaVJIp4nojmvY5u6OaqKioqd FRTlmB8YyfI+ALI0oq11wvfDre6zovp1FVgtVK/x9bn0LnO8OqsVf4X7ru21XW2X22Ul6stwp6+3 18LKmlqqaVJIp4nojmvY5u6OaqKioqdFRToU1RXGcPK3rNdiuaK41sl8Cv8Abb4p/wDzq1n/AFOO q41cltGtGrmjHCzgdbDdsjp86oMwyNtI9JfM1roGv7R1QrekT3pKvK1VRVVqJ05272blXk/eEnNc qvWbZHpdU1F5yKtluNzqIsmu9OlRUSOVz3rHFVNY3dVXo1qInqQsPR/h60W0Ct9TbdIdO7VjbK1W 96mga+SoqOX8FJJ5XOlkRN12RzlRN128VNkSv9TZ+FDiI1RuPDFq/jFtvWVY/RQ3OnpLtSuppHwz tRVdQVKK2R2ycvP2Tk2VNl3Vq8uetbdMqfgUveneU8OOrGXUjsgy+32GTTe53p9yoLrSTvVsnd4J VWSN7eidpuu3M3ZWrtzbA1g4cND9fIqRmrmnFqyGWgRW0lVLzw1UDVXdWsqIXMla3fryo5E367bn Q6X8G/DPo3kbMw0+0nt1FfYkVsNyrKmpuNVBumy9lLVySOjVUVU3aqLsqp4KoFzgGPuITiEzXVLN a/hg4YLt3a6U3wWb5vEnPT41Tu3R1NTuTo+uciKiIi/B9eqORzo8TMUxnLaiiq5VFNMZzLj8SuuW Sa1ZLd+Erh2nppZ3xOo9QMukhSeisFHIitkpIkX0ZayRvM3l/edU6ORzo53pZppjGj2A2bTjDop2 WmywdjCs8qySPVVVz3ucv75znOcu2yJvsiImyHw0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/ xfI5eqqv5kRERERJkULt2bk9T1GCwVOFpznXVO3yAARLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAdBm2Y27CLFJeK5j5pXOSGkpYk3lqp3dGRMROqqq/wCRN1O1udzoLLb6i63SqjpqSljWWaV6 7NY1PFf/APXrOt0Zwu5ag5BBrTmdK6G3wI5MUtcqfuUS9FrJG/8AfHono/Imy/wVMRFVdWhTt+XW zVXbw9ucRe9WObfPNEfXdGtKtDNL7hidJV5tmjknzHJGtkrnL1bRQ+LKSP5Gt6c23iqevlRS1QDp 27dNumKaXjsVibmMuzeubZ8N0R1RsgABurgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACj9Wd G8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/gvEZojo1br Tb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAozWvTu5Y/d3a06eUD5rjTsRuQWuHo lzpG+MjU/wC/MRN0XxVE/Ns7845kVoyuy0t/sdU2oo6tnMxyeKL62uT1OReip8qF6mcdTMRq9Fci qdRsVt75sNu0qPyC3QN3W3zL075E1P3i/v2p4fybctDEWuLnjKdnP5+fe9RwVjuVUxhLs/jj1Z3/ AMM/+vduSsHwoa6judFBcbfUx1FNUxtliljdu17FTdFRT7kDozExOUgAMsAAAAAAAAAAA41yttvv NvqbTdqGCtoq2J8FRTzxpJHNG5NnMc1ejmqiqiopnPGMnyPgCyNKKtdcL3w63us6L6dRVYLVSv8A H1ufQuc7w6qxV/hfuulTjXK22+82+ptN2oYK2irYnwVFPPGkkc0bk2cxzV6OaqKqKim9u5Nuc4Vc VhaMVRo1beaVw2q62y+2ykvVluFPX2+vhZU0tVTSpJFPE9Ec17HN3RzVRUVFToqKcswPjGT5HwBZ GlFWuuF74db3WdF9OoqsFqpX+Prc+hc53h1Vir/C/dd22q62y+2ykvVluFPX2+vhZU0tVTSpJFPE 9Ec17HN3RzVRUVFToqKdCmqK4zh5a9ZrsVzRXGtywDH3EJxCZrqlmtfwwcMF27tdKb4LN83iTnp8 ap3bo6mp3J0fXORFRERfg+vVHI50eZmKYzlpRRVcqimmM5k4hOITNdUs1r+GDhgu3drpTfBZvm8S c9PjVO7dHU1O5Oj65yIqIiL8H16o5HOjlmkukuFaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1 VV/MiIiIiI0l0lwrRXCqPBcFtvdqKm3kmmkXnqKyod+HPO/xfI5eqqv5kRERERJkULt2bk9T1GCw VOFpznXVIACJeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+Pe2Nqve5GtaiqqquyInyn9IDN DdNbMon04xaokgxu3vRuTXiJdt0//Q4XeCvd4OX1Jvv8jsTM7I2y3ppiYmuucqY1zO6PPdHPL7Yr jy8QmUJVVUciadY/Udd90bfKxi/gp8sDF8fU5f5fR0zHGyJjYomNYxiI1rWpsiIngiIcSy2W1Y7a aSxWOhioqChibDTwRJs2NieCJ/8ANeqr1Xqc06FizFqNe2dryvCOPnHXI0Yyop9WPrPXPP3bIgAB M5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZz wo2s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV 5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAHznggqoJKaphZLDKxWSRvajmvaqbKiovRUVPUfQA2Mx5PYKjh6v/awsll04vNR 8G7q9bFUvX8B3r7Byr0X1L08fw5vHJHNG2WKRr2Pajmuau6ORfBUX1oW1drTbb7bKmzXiihrKGsi dDPBK3mZIxU2VFQzVcLTdOH2+w2C71E1ZgFzm7O0XOVVc61yu6pSzu/gfwXL/wDPl5t61xM5x6vy /T5PX8H46OEaeLuT/qx/XH3R47duec9B/EVHIjmqiovVFT1n9NFkAAAAAAAAAAAAAca5W233m31N pu1DBW0VbE+Cop540kjmjcmzmOavRzVRVRUUznjGT5HwBZGlFWuuF74db3WdF9OoqsFqpX+Prc+h c53h1Vir/C/ddKnGuVtt95t9TabtQwVtFWxPgqKeeNJI5o3Js5jmr0c1UVUVFN7dybc5wq4rC0Yq jRq280qi1y4lcl1qySXh24SsjgfPLBHJl2oFG9JqOwUUqbpFSyNXllrJGqvLyr6Hyo5HOjmmkuku FaK4VR4Lgtt7tRU28k00i89RWVDvw553+L5HL1VV/MiIiIiJS/k3rbb6Lg+wmro6GCCe4S3Serkj jRrp5EuNTGj3qnVzkZGxu6+pjU8EQ00b3rk1VZc0IOD8LRZtxc55gABC6IAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAQrJ7/AJDkF/j0w00ayXIqtnPWVrk3htFMvjNIv8PZfRb47qnyoi4mcm9F GnO3KI1zM7IjfL5366X7PMmXSjTqdY61zUde7s1N47TTL4oip4zOTo1u+6fm6q2/sIwrHtPcao8V xiiSnoqNu3Xq+V6/hSPd++e5eqr/ADJsiIhwdNNNce0uxqPH7Ex8sj3dtW1s3WetqF/Clkd61X1J 6k6EsLuHscX+Kr1p8Op5vhThGMVPE2dVuP6p3z9I5o65kABZcgAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAFNaoa23/AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4 bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgX6w2jJ7 NV4/f6CKtt9dEsNRBKm7XtX/AKlRdlRU6oqIqdUOeDExExlLNNU0TFVM5TDMNTSXjQi+QYllNXNW 4dXydlYr3L1WkcvhSVLvVt+9f4KifJujJ2ioqboWjkWO2XLLLV49kVuirrfXRrHPBKm6OT5U9aKi 9UVOqKiKhnOupb5oNdoMbyurmuGF1kiQ2a+S9XUTl/BpapfVsn4L/DZPkRUbzrtqbE5x6vy/R6/A 46OEo0atV2P6uuP4t8c+2Nydg/jXNe1HscjmuTdFRd0VD+miwAAAAAAAAAAAD+KqIiqu/Tr0Tc4N jv1jya2Q3rHLxRXS31CKsVVRztmifsuy7Oaqouy9F+RQM++To+Jtp9+lv1rVmkTNvk6nNZwZ6fve 5Gtal2VVVdkRPOtX1NCWS+2XJLdHeMeutJcqCVz2R1VJM2WKRWOVjuV7VVHbOa5q7L4oqeo2uevP agwvsKOyPk5wANU4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEMyLKL7d78zTjTWnjrsmqW81RO /rT2qBfGaZfDfr6LfFVVOi7oi4mcm9FE1zuiNczOyI3y/uUZPe7he4dOdOqdlblFczmkkd1gtcC+ NRMvq2RfRb4qu3Rd0R1x6XaY2TS6wLa7c99XX1b+8XO5T9Z66oXxe9fk6ryt32RF9aqqr+dLtLbH pfZH0NBJJW3Ktf29zulR1nrZ18XOX1NRVXlbvsifKqqqzQuWLGh+Ovb8nnuE+E4vxyfD+zjbPPVO +erdHvnWAAtOKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zy W9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONV Mj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBvdktGSWmqsV+t8Ndb62NYqinmbu17V/6l9a KnVFRFTqhzgJjPVLNNU0zFVM5TDL14tV84ebnHbrxPU3TTyrlSO33N+75rQ5y+jBUKnjH6mv/m/M TuKWKoiZPBKySORqPY9jkVrmqm6Kip4oqFu3K22+82+otV2ooaujq43RTwTMR7JGKmytci9FQzfl OI3/AIfJnXO0Mq7zpzJIrpoOslVYt16q31vg3X+Vv8vV3Nu2Zs/ip9X5fp8nrcDwhTwjlbu6rvhV 5VeE9u2bA41tuVBeKCC52uriqqSpYkkU0TuZr2r60U5JGtzExOUgAMsAAAAAAeV3GRHq1wY8REup mi2UV9ix7UF77q6li2fQvrmqneoZYHIsb91c2RFVN0SZUaqcp6olIcZGhEfEFoVe8So6Zsl+t7fO tift6SVsTVVI0X1JIxXx/InOi+oktVRTVr2KmMszdtfg9aNcPKDR3I9dNeJcH4TLDmlxo8TfUywL QUfwUTKaSaSpqp6jk2WZGo+RyNeqt9FqIiL4+3WK4zZcLxm1YhjlE2ktdlo4aGjgb4RwxsRrU/Ou yJuvrXqYX8lXw/SYzit312ya3OiuV/c+1WZkzNnxUUT9p5Nl6oskzOX5dofkcb8Nr9UTVlCDg2zV Ra4yvbPy5gAELpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEE865PqtkE+DaW1HdqKkd2d6yXl5oq NPXFB/3yZU+Renyp+EmJnmja3ppziaqpypjbM7I/zmjbPM/d8yPI8syJ2meljWTXrZPOVzcnNTWe Jeiuevgsnjys+X+TYuzTLTHHdLbB5nsjZJ6mod29wuE681RXTr4ySO8fWuyeCb/KqqvJ0+08xjTP H48exei7KJF7SeeReaaqlX8KWV/i5y/5E8E2ToSYu2MPxf46/W+TzvCXCnKY4ixqtx31Tvn6Rzdu sABZcYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3 /wBir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLf HTwdixGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfKj/ABE9Tf0L+uKIe9ccCfzGfSa8fex5Uf4iepv6 F/XFEaqAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVA DKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccC fzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx 97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccC fzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8feyo+GnS3BNFuLH iW0z0zsXmbG7N7De5UXepqjsu1ts00nwkz3yO3kle70nLtvsmyIiJ6DGI9O/j2cVP+I/6neRX/Zy vcG/tVPv+Ur5ABz3qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD51NTT0cElVVzxwQwtV8kkjka1jU8VVV6Ih1+SZNZMRt E18yCvjpKSBOrneLneprU8XOX1Ih0+K6Z5RrVU0uR6i0dRZMLjck9FYFcrKm47Lu2SqVOrGetGeK /m6KuIzqnRpjOW1What8dfnRojn55ndEc8+Ec+Tr7LQ5Rr9Xy0GOVFVZMCgesVbeWtVlRdFTo6Gl 38Gepz/5fztXROK4pj+FWKlxvF7XDQW+kbyxwxJ6/W5y+LnKvVXLuqr4nYUdHSW+lioaClipqanY kcUMLEYyNiJsjWtToiInqQ+xfs2Ita51zveY4Q4Srxs6FMaNuNkfWd8/LmyAATuYAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bz bQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/AOxV9a6JK9nPCjazuaOXnXeLl7Tk RfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAADKvlR/iJ6m/oX9cURqoyr5Uf4iepv6F/XFEaqAAAAAAAAAAAAAAAAAAAAA AAAAAAAYj07+PZxU/wCI/wCp3m3DEenfx7OKn/Ef9TvIr/s5XuDf2qn3/KV8gA571QAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA BVREVVXZE8VAEWzHP6DFpaa0UVHPeMguLkjoLRR+lPO5fBV2/AZ8rl9SL47KddJlmTagXebENG6S OsngkSK436du9Bbk9ezvCWTbwam6fypvtb+l+jeNaZRT1sMst2v9wXmuF6rUR1TUO+RPHs2fI1Pk TdV23M26Kr0/g2b/AC3tMViLPB9Od/XVzU8//dujxnq2olp3oXX1N3i1A1jmp7rfWKj6C1RrzUNp TxTlb4SSp63ruiL4b7I4usA6Fu1TajKl5TF4y9ja9O7PZHNEbojm/wAzAASKoAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb 46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nP VHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAADO/GDw3e3Xhs99x7WTINMclstM99PeaK91FHb3sTdeStjZI1is/8AC9Ht +VyJyL4ZZHrXxC4pkdwsL+IXL66a2VT6fvlrzKqqqWZWO2SSGaOVWvYu26OT1KngvQD2r8qP8RPU 39C/riiNVHg7SYZxPam8FOpvEPq/rhqRX4ZQebaOx2i65HW1NNeah11pIpZ5IppHNfDFzORq7LvM m6KnZKi+8QAAACjqXLsUfxq1mCtyjUN2SM02bdHWZ9bH7FW0fnJsfeWwc3aJcOdUZz8vL2W6b79C 8TJdB/3VK5/+Ypn68YB3OKcfGnmoGErnOnOkuq2W0lKtQl0p7PYYJ5rWsUj2K2dVqEiWRzWdokUT 5JOzfG5zW87d/wAa4cQOkGacK9n1st+d6iW7D77dLalLcsHqWUN3SVavsuwesrmo1iStdHM3fqiO RN+h0nktKWnp+Ee2TQQtY+pyG9yzORNle9K2RiKvyrysan8iIZPo0Rvkn7NG1Nms1HY1qJ4Innx3 RANYZrxa55jvGzbdEaDTDPrhjkGKz1VVRW+1UMj66okrIo4rlG98zX9ziakrHLzNVXOdvG7la41y ZKu7ms8qdYedyJz6JTNbv++Xzy9dk+VduprUDpc0zLGtPMTu+c5jdYrZZLFRy11fVyIqtihjbu5d moquXp0aiKqrsiIqqiFA03HtpxFS2zIsq0p1axLD7vNBFS5dfcX7Czq2dyNhlfK2V0kUb1c3le+N rV5kXfZS1eIO36XXfRbLrPrVeIrVhNwtzqS71sk/YpTxSORjXo/ZeVyPcxWrsqc226L4GWtRKziY 4LtJW6ht1hxTWTSfG46GOS05Ha2Ud1S3OljihbTVsDljqZE5mKj5WruiboiqiIBo7WLiXwLRzIbN g9XaMlyvMcghfVW7GcWtvf7lLTMVUfUOYrmMjiRUVOd72ouztt+V2370Z4k8D1pvF7xK3WnJMXy3 HGxy3TGcotq0FypoZP3Obs+ZzXxu9T2PcnVN9uZu+Ub3aNUMj8pBkjsF1do9OLnkmm9srLDUXbGI 7s6ut7Xs7emijkmiSN7ZWve5Gqq+g7psiqWXgeimXW7ixfn2dcWGOZjqJa8Gntb8eosVhtNT5smn 5oZpUjqpFVjahUVFVi+KdU3QCV5Jx2aX2a75DS49gGpmaWbEaqWiv+SYxjTq20W2aJN52PnV7Vf2 SdXrG16NTrvsd5n/ABmaJae4/p/l9bcrjdsf1KSdbLdLVTNni2ig7b4RiubLzOT0GxsY+RZPQVqK Vd5M+94xaeCe3UGQVdLR1eKV1+p8vZWOajqSobXVEsneebwVIHxqvN6iH60XrSHUPKeDe/aP26gZ gtZntVUWeGltDrdTokW68zKZ8casTto3OReRN19JN0VFUNE3viwwPENLaDVDUDE82xNbzcvNFpxq 62VW3641iuVscUFHG56udJtu3qnTbm5V6Hx0+4t8HzTUGh0syTBs+07ym8U8tTZqDM7KlCt1jiTm l7tJHJJG9zG9XMVyORPV4lG8eVuy2Xia4YbjZc5pMNplul9t9Nfq61NuNJQXOemhSmSSne+Nj3yK 1WM3enKu7k/B2Xt870F1Mu+q+kFTrjxqYvV19hyyG+Y7aG4LT2yrustPs6opopG1qu2fFu12zXIm 7V2XZEUOz0N4tM91F4q9U9Lbtphn0WO2eey0NsjmtVCxmPvdSTyVE1wkZN2iNqHtYsWyzei1Oke6 oa5MlcMLmpxs8XMaqiP77hzuVfHbzbP12+Q1qAAAAxHp38ezip/xH/U7zbhiPTv49nFT/iP+p3kV /wBnK9wb+1U+/wCUr5ABz3qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEXPUGtu15fhul1mXJ8gbt2yxu2oqFFXbnqJvBNv4KLuu yp0XoazMQ3ot1V55bI2zsiO2eZIMnyzH8Ntb7vkVyipKdvRvMu75HfwWNTq535kOnsOnue628tbl ra3EMIk5Xx25q8lxujP/AAq/7zGqfvfFU/mck2080CorLdIs11GuiZVlbd1imlbtR0G678tNCvRN v4apv60Rq7luFi3hpr13dm7z8nLxfDFGH/Bg9dXS3fyxPznXuiNrrcdxuw4naILDjVqprdb6ZvLF BAzlanyqvrVV9aruqr1VTsgC9EREZQ81VVVXM1VTnMgAMtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf/Yq+tdEleznhRtZ3NHLzrvFy9py Ivo7c3QlZR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/wBNq826t2Tqm/gXgAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA dLmGa4fp9YKjKs6yi1Y/Z6RE7auuVWymgYq+CK96om6r0RPFV6IRTRPX3TfiEsd0yfS6uuFws9su L7alfUW6alhq3ta1yyU6ytb2ke7lbzJ++a7ptsqhYpSGvmr2uGJX22ae6C6C12Z5BeaR1Ul8uVS2 kx+1NR6t3qZubnfIm3N2LeVzmqitc5UVqdfp9wtXi16rLrXq1rjmOfZJRVVU+x0j6jzfaLTTyo+N rI6KBUY+RIpFY57ujvHlRepf4ELvmnlr1U0xp8G1xxuyXxLhR0br7QQ9o+gkrI1jkd2Su5XrGkzN 2K7Z2yJunih5va08DVLxBeUEfgeM49TYzplh+PWeW9vtdKymgpoFY9WUkDWIjWyyqjttk9FvO/rs iO9VTjUttt9FUVlXR0MEE9wmbUVckcaNdPKkbI0e9U6ucjI427r15WNTwRAMm+Ulx6x4l5PXPMXx m1U1stNpprDRUNHTMRkVPBHdqFrGNangiIiIa7Mq+VH+Inqb+hf1xRGqgAAAESj0pwGLVWXWyOw7 ZpNYkxp9z71N1tqTpP2HY8/ZfuqI7n5Of1c23QloAiWl2lOA6L4hBgemlh8z2KnnnqYqTvU1RyyT SLJI7nme967vcq7K7ZN9k2QiTOFLQJmlEOh7cC2wmC5Jd47X50rfRq0nWftO27btl+FVXcvPy+rb boW0AKr1i4ctD9YLnbM11P0/8+XbF4ZHW+qpqmqgqmM/DWJO7SMdKiqi7Ru5k3cuyeku8Q92Xj/4 vvEF/wDswuf7BoMAUri2uWH64V8+md30P1Ro7feKOeKrXLsCrKG2Sw8i88Uss7Oz9JN0Rq+KrsdV YeArhJxy80V8tujtI+a3TpVUdPWXOurKOCVF3RzKSed8DVRfDZnQv8AV/q3oFo/rrSUNJqrg1FfV tciy0FSsktPVUjl25uyqIXMlj32TdGvRF2TfwQ/OkvD9o5oXDXx6V4LR2SW6va+vqu1lqauqVu/L 2tRO98r0Tddkc9UTddvEsIAUfnnBNwt6l5bV5zmWkVuq7zcZGzV80FZVUkdbIi7o+ohglZFO7fqq yNcq+vcnF80T0tyKswmuueH0yP05qUqsXjpZZaWG2SJGkackULmsc1GIjUY5rmoidEJwAIzqLppg OreK1OE6lYpb8hslWrXyUdbFztR7fwXtX8Jj03XZ7VRybrspCdMOE3h70cyT2Y6f6cU9HfUgWmju VZXVVxqYIlRUVkUlVLI6JqoqoqMVu6KqeHQtwAVjdOGnRC86vU2vNdgkK53SpEjbvDW1MLpOybyR rLFHIkUqtaiNRZGOVEa1PUm1nAAAAAMR6d/Hs4qf8R/1O824Yj07+PZxU/4j/qd5Ff8AZyvcG/tV Pv8AlK+QAc96oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAD4VtdRW2klr7jVw0tNA3nlmmejGMb8qqvRDBEZ6ofc6PK81xvCqJK3ILi2HtF 5YYGpzzTu9TY2J1cu/T5PlVDoKDJ821QqH23RyyI6ha9Y58luUbo6GLZdnJC1U3mcn5k2RfFNl3L R060GxbCK5MmvFTPk2UvRO0vFyRHPYvyQM6thanq267dN9uhtRRXe9TZv/za1xN+xgI//RP4ujG3 39H36+pXlk091M1i5KvKHVeD4hKiObQRu2utez5JHf7w1U/e7c3qVF3RS9cQwvF8DssOP4lZqe20 MKdGRN6vd/Ce5fSe5f4TlVTuwXrVim1rjXO95rG8J3sb+Cfw0RspjZ7989cgAJnOAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P8A ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc 0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAQ7VXV/TTRDEpc41VzCgxyzRPSFKiqcvNNKrVckUUbUV8sio1yoxiK5Uaq7b IpwNFtZLFrxhcuc4vj+UWa1vrJaSkffbU6gmrI2NaraqBj9+eB/P6D/WrXIqIqKiBPXTRNkZC6Vi SPRVaxXJu5E23VE9e26f5UKJ10zfipdllPprw7aVWbaro2VNVnWSV7UtduR7ntWNlNH8NNMnLvtt ypuzdFR3T86NcImOaaZ1LrBmmoOW6j6jTRS03shv9c5G01PJ+FBTUsapDDGqbejs7ZU9HlToX2BG 8hwTHNQsUp8Y1RxqyZJTKtNUVdJV0bZqSSqic16PSOTfokjd0Rd+nRd0Vd+/paWmoqeKjo6eKCCF iMjiiYjWManREaidERPkQ+oAAAAAAMq+VH+Inqb+hf1xRGqjKvlR/iJ6m/oX9cURqoAAAAAAAAAA AAAAAAAAAAAAAAAAABiPTv49nFT/AIj/AKnebcMR6d/Hs4qf8R/1O8iv+zle4N/aqff8pXyADnvV AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH 8c5rGq97ka1qbqqrsiIQq66pWxbmuNYTbKvLr94dytac7Il+WWb8CNvyr129aId1aNBMzz1za7Wj JO7W5y8yY1ZJVjhVP4NROnpSerdGrtum6KhinSuTlRGfy7212beFp08TVoxu/ensjb75yjrdHVal PvN0kxjS+w1GXXli8si0q8tHS7rtzTVC+iiIvqRevhuikpxnh1qr7VQ5BrffW5DVMVJIbLS80Vrp V28Fb+FMqfK7ZPUqOLfx7GsfxK1xWTGbPSWyhh/AgpokY3f1qu3iq+tV6r6zsy3bwkbbmv5fr73D xPDlcxNGEjQjf+9Pv5vd3y+VLS0tDTx0dFTRU8ELUZHFExGMY1PBEROiJ+ZD6gFtwZnPXIAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2 zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv8AgvEZojo1brTb6i2an+yX zjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAK61w1/wBL+HjFocs1PvktFBW1CUVvpaalkqaqvqlRVbBBFGiq 567evZqetUTqcrS/Oq7WTTWLKa/B8twKS7sqImW+9QtpbnTx7ubHNyoruzc5vK9EXq1V2VF23UJg t2tTbq2xLc6RLk+ndVto1mb26wI5GrKke/NyI5zWq7bbdUT1lF6wVnGVlGfPwPRK1YfhWJwsp5aj O71N5xqZeZN5IqW3tRER7FTlVZV5HIu6Oavh2WhPCPpZoReK3N6Ca95Vnl3hWG6ZfktwfXXSra5W q5nO7ZsbN2p0Y1FVERHK7ZC7QOsvONWDJaalpcosVsu7KOojrIGVlIyZkVSzfkmY16O5Ht3XZydU 36KdmAAAAAAAAAAAAEU1S0twTWnBLnpnqXYvPON3nse+0XepqfteymZNH8JC9kjdpImO9Fyb7bLu iqi0B71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvX HAn8xn0mvH3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfS a8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH3s1UAPNXgK4CuE7WnhOwbUzUvSnzzkl58599rfP typ+17K5VUMfwcNQyNu0cTG+i1N9t13VVVdAe9ccCfzGfSa8fex5Lj4iemX6a/XFaaqAyr71xwJ/ MZ9Jrx97HvXHAn8xn0mvH3s1UAMq+9ccCfzGfSa8feyGZ/5JPhXu8TavT/E5LBVxIipS1F2uFTST bepyun7Vu/yo5f5DboNaqYqjKUtm7NmuK6Yie2ImO6c4eZ1ZwQ8MWn8zaHWPhrntMfMjG3u3X+71 NtlXoiKrkqVdFuq9Gu6/yEytfk/uCK90TLjZ9LaetpZPwJoMluj2L/OlV4/mN+TQw1EL6eoiZLFI 1WPY9qOa5q+KKi9FQqHKOGnE6uslvunl0rMHvMm7lktey0krv/CUy+g5PzN5UKldq9R6lWceP+dz u2Mdwff1X7UUTviM6e7bHuz7GbPe6ODb5nfpDdfvI97o4Nvmd+kN1+8lvXOp1g033TPMM9kVrj8b zjjVkc1v8KWmXZzfzqnopsu252uL53iWZwdtjl9pqtyJu+FHcs0f/jRu2cn86EHG1ROjMzEunyGz VRxlFNNVO+IiY/TsnKVGe90cG3zO/SG6/eSyNHOHPRrQDzv7UmHeYfP3d/OH+yFVVdt2Hadl/tiV /Lt20n4O2/N132TayQZmuqdUy1psWqJ0qaYieyAAGqUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4V3vVnsFG64Xu50tDTM8ZaiVrG/yIq+K/mTqY2MxE 1TlDmn5e9kTHSSPaxjEVznOXZERPFVUgtFn+TZ1K6j0hwatvrN+VbvWotJbY19a879nSbbdWtRF+ TclVp4brjkcjK/WjNai+oio9LNbVdSW1i/I7bZ8v5lXlXqZoiq57OM+vm/zsYv12cH+016M7ttXd ze+YRes1Vo7hcX49p1ZK7Mry3osNtbvTwr12WWoX0GN6ePU761aC51nO1VrFlvcre/r7HrC9Y43N /gz1H4T/AFbtTpv4Khd1ix6xYvbY7Rjlno7ZRRfgQUsLY2Ivy7InVflVeqnYlmjCRtuTn1c36uNf 4drj8OEp0OuddXlHujPrdNi2HYthNsbZsTsVHa6Nv+908aN5l+VzvFy/ncqqdyAW4iKYyhwq66rl U1VznM88gAMtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAABFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE 3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADP2e2HjHzzVaW0YlmOI6b6aWippJo7pBSrd L1e2ojJJYuzk5YqeJXc8a/v+m6K9F6aBAHHqaChrZKaWsooJ30c3eKZ0saOWGXlcznYqp6LuV727 p12c5PBVOQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9Nfr itNVAAAAAAAAACAZ1oXppqDOtxvFhSkuqLzMuluetLVtd/C52fhr1/fo4n4NaqKa4yqjNNYxF3DV 6dmqaZ3xOTPVx0s1wwXmlxPIqLO7azq2huqpS17W/wAFs6eg9fzv28fA6aDV6x0Nc2zZ3a7nh1zX p2N4gWOJ/wCdk34Dm/3yqhp44V4slnyCgktd+tVJcaOX8OnqoWyxu/la5FQq1YT8ucu3X+rtWeHZ nViqIq64/DP2z3RPWqWnqaesgZU0k8c8MiczJI3I5rk+VFTop9D5XjhfxeCaS46aZJeMJrXrzKyi lWeie75X08i7L/IjkT8xGK606/YOq+eMTt2a29n/ANLscvY1aN+V1O/8J35mf5SvVRct+tT3a/18 HVs4jC4n2NyM91X4Z8fw+PuSwEJtOsODXGrW119wmsVyauz6G8wOo5mL8i8/o7/mRyk0Y9krGyRP a9jk3a5q7oqfKimkVRVsT3LVdqcq4yfoAGyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAABGMk1MwXE3LDeskpI6hF5UpYnLNOrvUnZs3cm69OqIcGhverWb7N090vqaOl k/BumSv7nCiepyQpvI9vr3T/ACGulEzlGuepLxNVNOnX+GnfM5R47fcmpDr9qzhNiq0tbbk+63R6 8rLdao1q6h7v4PKzoi/mcqHf0HDbd8i2n1a1JuV3jd1darSncaJP71yt9ORPzryqWpiOn+E4FSrR 4fjFvtUbk2e6CFEkkT+/kXdz/D98qk1Ni7Xt1eM/573PvcJ4LD6qZm5PVqjvmM/6fepG32DXvUD/ ALX2WiwG1yeFXddqmvc35W07fRYv5n7eHiTXF+GnALVWx3zLX1uZXlnXvd7l7aNi/wB5B+5tTomy KjtvUpbQLFGFt066tc9flscnEcN4q7E0250Kd1OrvnbPfl1PxFFFBEyGGNsccbUaxjU2a1qdERET wQ/YBZcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylykUyK1 6ZVed4jc8pgx9+YUHf8A2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAADzq4stWtdcj1nzrNND8zvlFi/DHbbVcb3a7fXSw0mQXCaqjnq6eoaxUbNFFRMk5muR 3IrHp05wPRUFQ6r69UuLcNtx17wex3fJaOXHVvdtS1wRSvZFJTLLHUyNke1qRRoqPkXdVRqO2a5e hljNuObWCx8BVu1TpsAz+hzertdqp/ZbW2S2tt0lTMsHaV7WJI5vYyo97Y/gE3e5qKxqdUD0FBS2 UcVeF4HpraNQ9QsLzfGqvILl5ntGK1lqZLfq+sVzkZDFTU8sjXK9G8zV59tlbuqKqIcfTji3wjPN RqXSW+4Jn+n2WXOklrrTbsxsiULrpDEm8q0z2SSMerGornN5kciIq7dF2C8QUbqNxdYLgue12mFg wbUDUTJrNTxVV5oMKsXnFbTHKnNF3l7nsYxz2+k1iOV6p+96oU5xZ8Stt1A4OE1a0Hzu92py5Xar ZUT0c09tuFDMlZGyoo52tVskb0R2zmKuytci9WuRVDaoKy1D4gMO0+1DxPSdLXesjzDMJHOpbPY4 YppqSjbv2ldVLLJGyGmaqbK9XbuXdGNcqKiR3UPi1wXCM/rNLMewrO9RMrtNNHWXe2YZZkr32qKR N41qZHyRxxuenVrOZXqmy7dU3C7wU1j3FfpVlOjWYa02Vt7kocCp66XIrLPQ92u9umpIllmppaaZ zUbLyt6Irkaq/vui7fXRPiaxTX2tjXBcJzZljltEV0iyO4WlsFqlkckXPRxz9ovaVEayq16MRWI6 KVEe7lAuAFea8a5Yfw76fyalZ3S3Ka0Q11JQS9wZE6SN1RK2Jr3drIxqMarkVy826JuqIvgV7cON rTmyXWwJkmA6jWXFspuENstGY3GwpDZaqaZfgF51l7eNknix8kLWqnpb8vUDQoKk1i4mcD0cySzY HVWXJ8szK/wPq6DGcWtnf7jJSsVUdUOYrmMjiRUVOd72oqo7bfldt0mLcYenGUWzOebFc1suT6e2 ea+3jD7zaW0l7WiZGr0lgidJ2UzXImzVbLtu5qKqczVUL2BTWV8VmmeI8ONv4n6ulvdZi90obdW0 lFRU8UlymWtfGyKBsSyIxZWulRHNSTZOR+yrt1++a8UGnWEaE2PiCqaK9XOw5JFapLVQ26CF9wq3 3B0aQRNjfKyPtE7TdyLImyMfsqqiIoW8D+J1TfbYx1wfa90+KcJeT6v656g3KrorFlN9ZPcbtWy1 c/Yx1Sthp41kcrnKqqjI40XxVERANjAoTKeMnTvAMa06yfUXDs1xaHUqWeK3Utxt8C1dGscXat71 DFO9zXSN5UZHGkkiue1qsRy7HJxri2w+76n2TSXK9O9QcDveUxVEmPyZTZ46Wmuyws55GQyRzSbS NZ6SskRjk3RFTdyIoXkCjtQOLfBsM1CrtKsbwjPNRMrs9PFVXi3YbZm1y2qOVN4u8ySSRxxue3qj OZXKnq6odVPxzaLQ6U3DVxKTJ1t9hv8ATY3kdtltrae54/VzStiTvtPNIzs2Ne9qK5qu8dmo5Uci BoYFQ6/cUGm/DfUYfTagU94mdml1S10a26njlSm9KNr6io55GckDFlj5nN5nJzps1Tvc91sxXT7U XT/S65267V191Iqq2mtLKGKN7IW0kKTVE06vkarY2sVOrUcu6+AFggzNJx76cVVLcshxPSnVvLMP tM08NTl9ixbvFn2hcrZpGSOlbJLGxWu5nsjc1Eaq79DQGG5hjWoOKWnN8OusVzsl8pI66gq4kVGz Qvbu12yoiouy9UVEVF3RURU2A7kGRs14tc8x3jZtuiNBphn1wxyDFZ6qqorfaqGR9dUSVkUcVyje +Zr+5xNSVjl5mqrnO3jdytcRnT3iYuOC8THEVi2RM1Cz6op77am45ithgmuk9JStoldUyQwve2Km hR8kXM5XMa572onM7oBt8FVaK8Sem+uWLX7J7B51sL8TrJqDIrZkdJ3Cus88TeZ7amNXK1iI3deZ HK30XJvu1yJWz/KCaULapc1pNN9VqzT6GZ0cmdU+KPdY0ja/kdPz86TrCjkVFekKpuip4gaeBw7N eLXkNoob/Y7hBXW25U0dZR1UD0fFPBI1HMkY5Oitc1UVF9aKcwAAAAAAAAAAAAAAAAAAAAAAAAAA AMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAADp8kw/FcwpO4ZTjtuusG2y Nq6dsnL+dqqm7V/OmylWXDhcx2gkdVaaZhf8NmVVckFPULVUW69d3QSqu/X++RC6wRV2bdz1oXMN whisJGVmuYjdtjunV4M6VuMcRGH7rNZLDnFGz/fLfP3Gs29aujk9BV9ezTqfblx221Lbfm1pvmJV jl5UjvFvkiY5f72REVqp+ddkNQnwrKGiuNM+juFJBVU8ibPimjR7HJ+dq9FK9WEy9Srv1/q6trh7 PViLUT10/hn6x3RClrVfLNfYO9WW7UdfD/Dpp2yN/wArVU5p2OQcM+jt9qFr6bGFsdd1VtXZZ30T 2b/I1i9n/wC6Riq0D1OsO7sH1jmrYm/g0eR0bajm+TeoZs//ACNIqrN2nmz7P1yX7fCGBvbLk0z/ ABR9ac/GIdsCI1TtesZ39kWlFNe4G/hVWPXBr/8AJBJtIp1ya2YbRztosopr1jFU5duwvNslp3b/ ACb7K1P51Ipqin1tXbqXaLNV2M7MxX/LMT4RrT8HV2jKcayBqOseQW6v3TfanqWSKn8qIu6HaGYm J2I6qZpnKqMgAGWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcavulstUPeLpcaWji/h1EzY2/ 5XKiEOr9bdN6SdKOkv3nWrd0ZT2yB9U9/wDIrEVv/tNZqpp2ylt2bl31KZn3J0CF0uR6rZLsmG6K XpsT/Cqvs0duY1P4XI5Vc5P5DuKXSDXbItnZNqJY8Zgd+FT2OgdUy8vyLJNtyr+du5mIqr9WmZ/z rR3KrNj21ymn35z3U5y7ipqaajhdUVdRHBExN3SSPRrWp+dV6IQu5az6f0VV5ut91kvde7oyktED quR6/mVicv8A7xObXwsaaMmZW5bPfMvq2LzJLerjJI1HfmjZyt2/MqKWfYsYxvF6XuWN2C3WqDZE 7OjpmQtX+VGom/8AOTU4a7Vtyjx8lG5wvgrXqRVXPupj6z4QoCjdrrmComL6Yw49Sv8Awa3Jqns3 Ii/LTR7yIqfn6He0XDdfb9tLqdqteLkx3V1us7W2+l/8Ryt3fI3868ql6gmpwlEetnLn3eHsTVqs xFEdUZz3znPdkiGG6Sabaftb7EsOt1DK1Nu89l2lQv8ALK/d6/5SXgFimmmiMqYyci7euX6tO7VN U75nOQAGyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv 4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAA AAAAAAAAAAAAAAAAAAABDtY9TLNo1pZlOqWQKi0WM2ue4OjV3Ksz2NXs4UX+FI9WMT87kMS8L+lP HRYtFq2rocd0KuFNq1PU5dfFymuu7bjVPucbXPZUsggVjfg1RvIirtuvXdVNuaq6S6f624bUaf6n WJ15x+rmhqKih75UUzZnxPR8fO6B7HOaj2tdyqvKqom6LsS2OOOGNsUUbWMY1Gta1NkaieCInqQD zz0HvOV4jwZcRfClqTLTLl+jOO3+3q2nlfJHNa6u3T1FJLE57WvexeaVGqrUVGJFuib7HC1/ex/k c8UkY9HNZjWIczkXdE2qqRF3/kXobil0R0tn1DvWqk+JQyZLkdk9jl3qX1EyxV1u3Rexlp1f2D/B E51Zz8vo83L0IljPB3w3YhgGS6W2HTGnixXL+z88Wue4VlTFP2blfHy9rK50PK5Vc3s1bs7ZU2VE UCDcV2pmoVLq3otoNpnerRjFx1KrrpM/LK+2Q3B9shoKdszm0sU28azyc3KiuRUReVNl5t0pLUi0 X3D+PfhpxjK9f75qLd6WovtRPDc6C30vmpk9Byx7dzgi6zrG/wBF6u6RIqbb9dR1fBrw11+nFs0n rdM4p8astc65W6CS51rqijqXbbyRVazd4Yq7InSRE2RPkQ+dw4LeGK54lb8Jq9KKLzZbLmt5pnxV 1XFWJWq1GrO+rZKlRI9Wo1FV8jt0a1F/BTYKt4IamG3a2cUeLX2VkeUJqXUXV8Mq7TOtU7N6F6Iv VY+TfZfBOZPlQr/jkzjR/N+EnOqzQZlmldb9SbfRXmehtbqSnqb4ysiWd75OzYlS5VczmmYr0dun pKaj1X4TeHrW680+R6l6a0lzu9NTpSNuEFZU0NS+BPCKSWmkjfIxOuzXq5E3Xp1Ofc+GnQy7aWUe idRp3QQYTb6iGrp7RRSzUkbJopO1ZJzwvY9zu0TmVVcquXfm33UDN3C9Lkmh/E5memnEs623LUzV COO/2LN4GvSC90scTUmtMHafuKUrmuVkTUTmZs5UTZm8K4e8M12vHEZxM2PA+IK06f3mLPprhWWy vw2K71NVb5+Z1DUNkkqInNiSJyNRqIqJui7+kiG3tTNG9N9YIrIzULHPOUmN3OK82ioirKijqaGs j/Alinp3skavyojtl2TdF2TaPaq8LWgmtV8pso1H08prheqWHu0dzpaypt9YsPqjdPSyRyPYm67N c5UTddk6qBl25aTSYRpnxi5pc+IuxalZLkeHVFLk1FarFFbG2utpbXUsYskcdRKiPfG/qmzVVWOV d1320zwe0NLb+FDR6no4GRRvweyTq1qbIr5KOKR7v5Vc5yr+dVO7sHD1oxi2l120XxrALfa8NvtL U0dzt1I6SJauOojWOZZJmuSZz3MXlWRX8+yJs5Nk2l2JYrYcFxWzYTitB3Gy4/QU9rt1L2r5ewpY I2xxM53q57uVjWpu5VVdt1VV6gZd8qTBFVcI90pp2I+KbILJG9q+DmrXRoqf5D++VBjji4S61I2N YkORWLs+VNuTatjRNvk6GitUNKcB1nxOTBtSrD54sktTBVvpe9TU+8sMiSRu54Xsf0c1F25tl267 ofzVHSjANaMSkwXUuweeLHNUQVb6XvU9PvLDIkkbueF7H9HNRdubZduu6AZuw2SGz+U/1BgyV7Ya y/6b21+NOmXZZqSKZqVMcSr4r2rHOVqddmOXwRVPlk0dFkvlQcdorIyKrWz6T1kGUIxEc1lPNVv7 CCbbpurpGPRi9eVyLtsaD1a0B0f1zp7fBqnhFJe32mR0tBVdtLTVdI523N2VRA9k0aLsm6NeiLsm /gh+9JtB9I9DKGuodK8Io7Gl0lSavqGyS1FVVvTflWaomc+WTbd23M9duZdtt1AwfozHJdr9pTwR 3LepZpVqvktfcmS+k59qtDVqrc+RF8Y5ZblTo3f/AL1/en90pSfMMv0T4OKp76iPRrUnJ7lekcu7 korI9ZLS9yL4xv8AOFO1N+ioz5UN3WXQXSXHtX75r1ZsPips8yShZbrnd0qp3LPTtSFEZ2TnrExd qeHdzWI5eTqq7rux3QXSTFNWMi1yx/DoqPN8rpWUd3uraqdy1ELUiRGpE56xR79hEqqxjVcrEVVV d1UJ+eOmjts1ExPB8a4iM+t1BluiGnepd4kuGL08Ur6iiklqHMW+Ss/BndTyPZysVHI1qKqI1XOe nsWQjBdFdMNNsKr9OcPxOClxu6z1lRW26eeWriqH1SqtRz9u96q1+67t35dl2REQDOHFxX2HL9Ze Ee9WurpbpabjnDrhRVMLkkinjWmZLDKxydFT8FyL/IdhxlIicQfCrIibOTPKpqO9ey0zd0/nLesX CvoTjVswizWjC546PTe4zXTFopb1XzJbamXfnViyTuVzV3XaN/MxN12ahKsz0owDUHIMVynL7B3+ 6YTXuulin71PF3Sqc3lV/LG9rZOibbPRyfmAzdwQyw23W3ikxq+PZHlPtl1FzkikXaZ1qnZzUL9l 6rHyc2y+CcyfKVnFptT6+azcc2LYvGyqst+s9js8EsWywS3+mt7lRE26K+KpjTn26o5evia11T4W dBNaL9BlWomn0Fde6eDurbnSV1Vb6t0PqifNSyxvkYnXZrlVE3XZCW6baX6faP4tBhWmeJW/HbLT vdK2lo4+VHSO25pHuXd0j12Td7lVy7JuvQDz5xx0vHlZ7pK7mrpMN0ChtCI7qsWW3LeR70/Oi26L p4+l19RY3DFqLT8TfENbdcLjUNlt2mmkdooqpz+rIb7dW94rXovythhWN35lTfxQ1VpNoLpLoY2/ M0qw+Gwpk9wddbqkdVPN3ipXf0vhnv5GpuuzGcrE3XZEGkGgukmgtvu9q0lw6HH6W/XB10uDGVU8 /bVLmo1XbzPerW7ImzGqjE67Im67hl3DNJtU9IdMKjNeCfiTxbItKImV13tmKZZbmVVuhi7SSWoi guULmzMZz9onK9Nmrurnbq5y6U4aNW6bXXQnDtWKXHvMTchoFmfbkXdtPIyR8UjWLsm7OeNytXZN 2q1SGXjgI4R75eKy91ujlHHLcKhaqrpqS511LRTyqu6ufSQztp13X1LHsXnZbLaMctFHYMftdLbb ZboGU1JR0kLYoaeFiI1jGMaiI1qIiIiImyAZXu7ms8qdYedyJz6JTNbv++Xzy9dk+Vdup8uE2jpU 4veLO4dgzvK37H4e129LkSilXl3+Tdd/8nyF2aq8NOiGtt/suU6m4JDd7xjyOZbq1lbU0k0LFdzK xXU8jFkZvuvI/mb1Xp1XeQ4npTgODZZluc4tYe5XvOamnq7/AFXeppO+SwRrHE7ke9zI+VrlTaNr UX17qBhG8Wy+3N/lC7Xi8Urq2anoXMihReaRq2yZ0zWonVVcxHpsnVd9iSaRafa15XwgY3dabjSw +06bVWDw01VTz6b0skNvoUpOyqKeada1vM6JEkje9URVc1yqiKpsnFNJ9P8AB8sy3OMXsCUV7zqo p6rIKpaqaXvssEaxxO5JHuZHs1yptG1qLv1RVKwruAzhHuF7nvtTotbO0qarvk1HHWVcVukm335n ULJUpV6p4LFsBKuFzBrfprw+YLhFoz+nze3Wu1MZQ3+ngSGKvpXOc+F7GJJIiNSN7Gps926NRfXs lpnypaWloaWGioqaKnp6eNsUMMTEYyNjU2a1rU6IiIiIiJ0RD6gAAAAAAAAAAAAAAAAAAAAAAAAA ABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAAAD41dHSV8DqWup YamF/R0crEe138qL0U+wDMTMa4VzkHDtorkrnSXDT21wSqu/a0LXUb0d/C3hVu6/ykXqOGCloN34 XqnmVk2/Bglq21lMz+SOREX/AN4u4ENWHtVa5ph0LXC2OsxlTdnLdM5x3TnDP9RpTxC2XdbTnmKZ Gxvqudvko3uT/meZN/8A2HXT1GvFk/7daMJcIm+M9nu8Mm/8kTtnmkQRTg6P3ZmPH55rdHD1/wD5 lFNXuy/tmPky9Nq7T2rplOA5rYeX8J9bZZOz/lRzd90/Ofe362aV3LZIM0oY1X1VPPBt/L2iNNNH VXXFMXv26XzG7Vcebx73Rxzb/wDpIppOErjZV4fqs08OYer17Ux2VfSafqp6gyfG7rt5syG2Vm/h 2FXHJv8A+iqnZne3Th00Qu+/e9NbNHzePdY3U3+qVux0MvChpRH/ANpH5FZPk7hep28v8nOrjScP ejdPv/RYp4VwFW2ao/7Yn5VfR/QcSThlmpv+0utOeQbeCVdZHVIn8ysTocaTQTVml62zX18jU8I6 zHKd+/8AK9H7/wDsNZtXY/d8Y80sYzA1bL0R2xV9Il2gOjfpPxDUv+1dQMQrtvDvVtli3/8AQVT4 uwfidpvFum9Y31dnNWxuX/0m7GujcjbTKWLuGq9W9T3zHziEiBGHWLiTg/DwfE6nb/vN2ezf/wBJ D8LTcRUX4Wj9rm/4PIoW/wDxIY/F0Z7pbRNqdl2j46frKVAiav4hW+Og8L//ABcppE/60P53jiD/ ABffpZRDOejPdPk20aPzKPjo+5LQRNJeIR3hoHG3/wAbKqNf+o/qRcRMn4Oi9vi/4TJKd3/Ug19G e6fJjK3H/Mo+Oj7krBF22jiRm/A07xqn/wCFvPNt/wCih9W4dxOVH7nbtPKTf/v9XVv2/wDQaMqu jPc1mqzG27R8UT8kjB0TNL+I+p/21l2C0W/j3akqZdv/AE9j7s0M1oqv9va6UlIi+LaTG4X/AORz 37obaFydlE+Hm0nEYSn1r9P9U/KmXbA4MfDZfan/ALda5ZfNv49ybDSf5NkdscqLhT0/k/7dZLml 6+Xv98e7m/l5EabRZvT+74//AFHVj8BTtuzPZTP1yfCtu1qtqc1xudJSp47zzNZ/1qRy4auaZ2zf vWb2hVb4pDUJMqfzR7lgW3hi0Jtao+DT2jmd4q6qnmqN1+VUke5CX2nTrT+w8vmTB7BQK3wdT26G Nf8AKjdzaMNdnbMR3z5IKuGMDT6tNdXdT9amfYtbsUuK8uMWjJciXwRLXZ5peb+TmRpz4L/q/eum OaFXpGu8JLvWw0HKnyq16qv8yGlERERERERE6IiH9N4wk/vVd0f/AFXr4eoj2dmP+6qZ+Wiz3BgH Eje+tTW4VjcLv4HbVlQ3/wBiRr/lOxp+G7IrnsuZ635NWIv4UdpiitrF/vfR5lVPV+cvMEkYS3G3 OferV8O4ufUyp7KY+c5z4qps/DBotapkq6nE1vFX++qLrVS1Tnfyte7k/wDdLGs+PWDHoO62Cx2+ 2Q+HZ0dMyFv+RiIh2AJqLVFv1YiHPv4zE4n21yau2ZkABurAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKZFa9MqvO8R ueUwY+/MKDv/ALFX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW9tj029lPn ls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAqnJtU9VbNrxjmmVm 0Gr7xhV3oUqbjnDLsyOC1zfD/AupliV0i/BRdUkT93Tp6PW1jBOt2pOotp8qvo3p3a8+yOjxS6Yw 2orrFT3WeO31Uu109OWma5I3u+Dj6uaq+g3+Cm1e2y/cR2q3lE9aNBMM17yfGMdW3Onmm77NVpZ6 NiUSuW308j+yhmfJKyPtERFaySRU67AenBU+guq+qOplpv1x1Y0KrtLZbVWdhSQVt3ZXd+g5d1nR zYo0YiL02Xf+UyTwSaha5af8Z+qPCFqnqzetQ7VYbW+62653md89Ux6OpXRqj5HOe1r4atOZnM5q OYnLtuu9WcMV81T124M+I6TMtc9RVrsaq6q40VwbkNTJUtipqGWbuiSSOcraeRW8r2N2RyKoHpfp Pq/p1rjh8WfaWZG2+WCeompY6xtLNTo6SJ3K9EbMxj+i+vbZfUqoTI8+fI+6Y1lu0Pi1XfqPltVT XWS4WtuLz3BXWakcypaveYafwZM7k2V/rR7vlPQYADDnlQdZNX9J7LpvT4ZkuQYjg9+vMlNmeT2C m7SuoKdHQJGyN/Ts3OY+oc3ZzVe6JG8yJujo/wAIuUU981ltL9FOP646n4jPRyLesSz6WeW9vejX fCUnbsY9EYvK5VYnKiNVF5kVFQPQMHk1q3xiUupXFlqBgGrPFLmmimm2B1VVZrVFh0VUytuVfTzd jI+Wamikdsr2SO9NOXlRjWoiq5yyrhn4/wDLLHoxr9Hfs3fqWuk9P37D8kuFNJBNd6SeZ1PT96a9 GybJKsDl5vT2le1Xei1QPTsHmfo9ozxpa98Ptr4msd4xMyo9RMhmkuNrsEtZ2OPtgZVOjSKSBqLE iq1jnp8ErU3axWr1cdh5RrVjiM0t0n0GvNTlFbjucTXZ8WRUuLXqopqK5VEbIlWNVYrFfE9ybox6 KjedU6+Kh6QA889f8q4ieBHhqyrUbKterhn2fakXu326gkrKZ3ccaqZIamao7lDJI9nZoyN7WIjG N5mxuVip6JmW7cYDNG7BhOqWlHHJn+p+cpVUr8ww7JKevW0TwvjV1QynSohbHE1j07PdrlcqPR7V by7KHrlmGsem2BZpiOnmWZPHQ5Fnc09Pj9D3aaV1Y+FrXSelGxzY0RHt9KRWou+yKqk0PJTim02q 858oppFb7drLqDR0eo9shvtvrae7uZU48yfvCdlbnf8A0dipA1VRPW9/ynqvi9lkxrGbRjst4r7s +1UFPROuFwl7Wqq1ijaxZpn/AL+R/LzOd63KqgVjdeKDDaLXhvDzZsPzTI8jp46Sa71dntTZrfZI 6nrE+smdI1Y2q1Ud6LX9F/MqJcR58aQaVWXFuOviCvNXqJqPLTYHb8cvu7sqqnvuKOonTvhrVV39 lQt2VrI5N2tb6KdCT8OunOp/FnpBT8Q2onEbqhjN7zOatqrNa8Tvq2+12SljqJIqeNKZreWoVOz5 nOl3VyKiL13cobgB5s5zxMa05F5PC55tVZVW0mo2EZ5BidxutpqX0LrhNTV8TVcqwq1UbLHIxr2p s1y83REXZNxaOaVXjTO33CbJdUMtzW9Xx8VVcam91/bU8NQjV520UCNa2lgVzl2ib0REb1VU3UJD mOoeHYBLYIcuvTbe/KLzBj9pasMki1Vwma90cKcjXcu7YnrzO2anL1VOhHm644m7iAdw4Jb7t7JW 4l7Mlquyi7j3LvaUvZ8/adp2vaLvy9ny8vXm36GZPKBaeQZTrHw6TTZhl9sbec4prNJDar7PSRU7 UbI9KqBjFRIqpO0c3t2+nyojd9kOnyzTbJLt5RezabYrqRkljpKfQmmo7rfI6ztr3PQQ3ZyLyVcq OVKiSVsHPOqOerVlVNnORzQ3uDHmjtfmmifGhlPDzc9V8wzTCqzTlmd0TsruTrlW26oZXJTSRsqH Ij3RuRXu5V8Nmp6lVc8accTelWu1huup2vnHFm2m2R3e41fmXF8YvE9upLBQskcynbJFFC5tVIqN 53OkVyORzU2TqB6lAzbwC683/X3Qyou+V36mv94xXIa/F6q900KQx3ZKfs3xVaMRERvaQzRKqIid d12TfZI5xvZHqfbNTeHvGdMs/umLT5Tl9Taq6akmd2b4HwNRz5IN+znWNrnPjbK1zOdrVVFTdFDW oMZZ/bcx4auJLQ5uK6w6g5DYtR7zW49kNnyi/SXSnlXsEfFUQpJ/td7Xqqr2fK1dmoiInMi1Zk3E 5p7qbxA6p2DXLiuyjSfGMCvT8ZxywYxdJ7XPWzU6uZVVtTUQRufIiyt2YxVRqInguyq4PSAGFuFv Uyu4jrNrfw10ev8AkOTW/GHUbsS1Ft1XLR3daOsic+NXzRdk98tPNFyucqN7TdzV3aux1GP6w696 +3CwcFlXdrziWoGG17vbWyu1VT6aXzRROiWCahqGKjklr0khXmbsrE7TdvK7YDbtVqFh1Hn9BpdU 3prcoudrqL1S2/sZFV9FDJHHJKr0byNRHysTZzkcu67IqIu0jMF5bo3QXjynNqs7tQ9RKOCbS5cg a6kyusjkikZc+y7sx/PzJSuSNrnw78rnqrl3VVU3fVVMNHTTVlQ7ligjdI9dvBrU3Vf8iAfUHlrp xxN6Va7WG66na+ccWbabZHd7jV+ZcXxi8T26ksFCyRzKdskUULm1Uio3nc6RXI5HNTZOp2mV8Vmr Gf8Ak7rpnll1CqZM1w/UCmxN2SWeaSg88JDVQujnVIlYrWTQzxc7U2R3pdE32QPTYGIuKjENU+GX RuXiXxbiB1CvmWYhWW6svlBdbwstkvUM1VFBUQpb+VIadm827OzajmNTbdXbOTvtQsuzjiE4rbbw 64vqRkmDYRY8IizO+1eOVSUd0uU9RM2OnpW1KIroY2se16qzZV3ei/vVaGvwY9xW+5vw3cXdi0Ju uqOVZrgOoGLV94ty5TXecLhabhRcz5mtqnIkkkLoWL6L1VUcqbL0Xmi+gmGatcZGklRxJXviO1Jw 275XW3N+KWjHLulHabPTU9TLT07JqZrFSqXnhcr3SKquauybL1A1NqXrjieleYYBhOQ2+7VFdqPd 32a1SUUUT4oZ2R86unV8jVazZfFqPXf1FiGBeKaz64Lc+EnHsvyqxR6lOyyooa2+2ynWWkZOsCMW siikYxHPSNe15HMRnaJttydCR5nY884YeJTRFuPa6aj5bYNSrxW4/kFoy69ecoHL2COingRWNSnc j1VVSNEReVEREbzIobXAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9Nfri tNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp 4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAA AAAAAAAAAAAAYs1e4eNYco8pNpVr9YsQ7zgeN462hul284UrO7z7XH0OwdIkz/8AbEPVrFT0/Hou zQ7h41hw/wAozrBrxkeId0wXKbBLRWm6+cKWTvMyy25yN7FkizM6U83V7Gp6Hj1TfaYAxbppw86w 4/5THUviCu+IdhgGQY62gt1384Uru3nSC3MVnYNkWZvpU8ybuYieh49U3i3A5wla06daB65aX6q4 zHi9w1BfW01rfJX01W10c9FJAkqrTSScqI56bouy/mN9gDFfk4NNuKTQbFazRDWbSq02fFbU6sr7 bf6e909TNV1Ms0SpD2MT3KjOVZn87kavRreXc2odDmOBYLqJbIrJqBhdiye3Qztqo6S826GthZM1 rmpI1krXNR6Ne9Ecib7OcnrUh3uW+GX8XTTD/wBUbf8AZARXihpuKyFuPXzhupsWyGhpJnsyTE74 yKNbtTrtskVRJ6LOnMioqt8WqirsrVy9iXChrpqtxT6fa5ZVw6YPoDaMGqkr6+KxXWlqqu+Stcjm tclH8Gu+3IrnI1eR791f6LU39iGC4Tp9anWLAcOseNW18zqh1HZ7fDRwOlciI6RY4mtarlRrUVdt 1RqfId4BgO68O/FJwzcVuc6/cNOB2LUfGtTO1nu1hrbxFbamkqpZUmkekkzmtVO2V7mqiu9GVzVa io15bGPaPcSOvOg2o+CcW9+x+21WdxSQWe02OnZI3H491fEskzV/shzZOyXl5l9GLq9VevLqQAeb uA6d+U50o0Th4VsIwPEKamt88lLbNRYsjhb3OjfULM7aBy9sq7ueiO7LdGLtyKqI4kvGtwocQ+pe lGh2H4s+r1KyLDLotVkt5qq6kpJJnObGr5tp5I0VvMjka1vM5Gtai7+K79AGf+OLhlqOK3QWu02t N0prffKOuhvNlnqubsErImvYjJVaiqjXxyys5kRVarkXZdtlpvBaryn9xs2F6WVOn+D6f0uPd2o7 vmlRcqa6LcKOGNI946Nj3ObI5qI5d0bzPROsbVVDcgAwvxocPfEXeOKDSjib0Dwy25nUYVRNoay0 1d0goXKrJpn8yulexvK9tQ9N2qqtVqLyqhtPE6vIa/FbNXZdaYLVfam30810oIJ0njpKt0bVmhZI nR7WPVzUd60Tf1nagDOGnWjOZ0HFvr9qDlWNpHhmfWjHqC11i1cLu+93olhqWdm16yR8rl23e1u/ i3dOpAdG7Dxd8Kmnb9AsV0JtupdosNTWNxXKI8rpLdF3SeZ8sba6nm2lR8bpHc3ZI5FTZrfDmXZo AwdmvBjqpYeBV+iuOw02W6hXnK6XKr86lqYqaCarkro5qhY31Do28jI2Nam6oruTdGpvypvEADNn Gdpfqpmc2lGoGkeJU+V3bTbNabIKixyXKGgfXUyMc17Y55lSNrkXl/CXwVV67bLxsR061bu3G3Qc QOUafLj9hrNG48erEW60tUtHeFuqVDqNezfzycse69q1nZrtsjt+hpwAZ1dpJncvH5LrRNjqPweX SRcWdcVqoFR1xW7JOsCw8/a/uXpc/Jyerm36Fe6M4nxUcIOK1+h+FaFUWqeH265VtVid5psspLVJ T0lRM6ZKasiqU5uZsj3qr4+dF5uidDZgAhmkLNWW4Fb5NbqjH5MvmWSatjsMUjKOna56rHC10jld IrGK1rn9EVUXZPWtV8S2lOfagaw6AZTiNh7/AGvCcunud9n71DF3SmdAjUfyyPa6T0umzEcv5jQ4 AzvxMaUZ/qDrBoBlOIWDv9rwnLprpfZ+9QRd0pXQI1H8sj2uk6ptsxHL+YiFt0+4guGfWbUrKdJN KqTU/B9UbqmSPt8N/prVcLPdXNVKlVWp2jmilcqORWu5m7Im3T0tbgChLdlPF9S6T5vmd/0xxyqz arkVcNwy13KJy0DFajGJXV00kcMyo5Vlf2fL6LVRqqrkRtNy8G2o+jeIYbrPpBM3JterBcpbtl00 9WynbmbK97VuVFLLIrWNY3ZqwOdsjOy32Rzt02+AMn6pYTrxZuLbDOJfTrSD2W26pwJ2IXi0S3+j t9VapH1i1PavdI50cqN50aqRK/q12yqnKq6tlijmifDMxHskarXNVN0VF6Kin7AGM9GcT4qOEHFa /Q/CtCqLVPD7dcq2qxO802WUlqkp6SomdMlNWRVKc3M2R71V8fOi83ROhHeO+j1equA1INZ7jYI8 zrcktC1TrBDIlJR9pXt7KNiyOVZHRtVqK/0UcqLsnrXdxXeu+h2J8QuAu06zS4Xaitrq+kuKy2uW KOftKeVJGJzSRyN5Vc1EVOXfbwVPEDOmvuH8XXEzgUPDdkujtmxWz3euoWZVnEOTU9TRz0dNOyZ7 qKkREqWvkfExzWyNRG/gKqovOkt1S0g1Y064i7RxM6C4dQZgybFUw3JMUlukdunmpY5klp6mlnm+ C7Rita1zXq3drUROrlVuogBlrAdKdYtV+Jek4kdcsGocGt2KY7UY/jOLtu0Vzq3yVLl7xWVM0PwL UWNysSNiu8U3VOX0oXpVh/GDwmYNdNAdMtE7PqLjtFX10uG5M7Kaa3soKaqlfK1ldTTJ2j3RySPc 7st0dvsm3ibZAGRs00L4hb3dOGG4Zfdos7v2BZJPdc2v0XdKKONJIl9KOJOy52MVUjb2cfOrWI5z UVVJjxMaUZ/qDrBoBlOIWDv9rwnLprpfZ+9QRd0pXQI1H8sj2uk6ptsxHL+Y0QAKmxvVTOrlxLZl o3eMToKTHLHjttvtpusVRzz1aVL3xuSRiOXs0SWGdrUcjVXs1VN06lsnApbDY6G7V9+orNQ09zuj YWV1bFTsZPVNiRyRJLIicz0YjnI1HKvKjl223U54AAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+u K01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfH TwdixGqj/TavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o 7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFNU9UcI0YwK7al6i3plqsFlibJVVCsc927nI xjGMaiuc9z3Na1qJ1VyFQWTjewKqyfHMczXS7VPT6HL6yO3WO7ZbjfcrfW1cibxQJK2V6xyP/etk azf8x+uObV3J9I9IrQ/DaKzPvOY5XbMTpa280yVFFbHVSvVauWN3ouRiRrtv0RzmqqKibLmXjrxX OtPcY00otSOKS/5zc7hntlqI7LVWW1UMHLFL8JWNbTQNljZGr2M3WRW7zNRd1VANb6hcWenWnGsD dDLpYcruWW1OPR5DbqS025lUtyY+ofClPA1snOsydnJI7ma2NsbHOdIiIpztIuJjDdW80v8App7F stw/Msbpoq6tsOUW+OlqnUkiojKiJYpJY5IuZUTma9dlVN06lRrS09R5Vls08LXvpdCu1hcqbqx6 3vkVU+ReV7k/kVT5VkdUvlRrgy3OSOpm0Cd2bvD4Tz2iNVf50T/IBNPdyaYVmQX6gxvBdSMkx3Fq 6W3XrL7LjjquyUM0X7ujpWv7WRI/F7o4noielurVRV6fyc+b5JqDw+VeR5Rl1zySpky29xQV9wr5 KyRaZtQqRNbJI5y8iN25URdkTwI/5Ma+41aOB6wrda6lopsbrL7Hkzql6MWknZX1Er+8Kv4KpA+J V5v3ux+fJTzUFRwppUWqHsqKXK70+mj5eXkiWfdiberZu3QDvOMbidzjRDOtJsOwvCstr0yXKaPz lU2u3UlTHcqHadstrp1nkRUqnOSJ/gxEZttIiqqENyXiRuWGcc9ufka57DYb1onS3GhwOGKWprJb zPdekbbfE90S1rYWyNe9FVGsikVZORqqSXjdc1mrXC697ka320qZu69E3WJURP5VU+T6OlqvKtMn qIGSSUmhfbQOcm6xvW9qxXJ8i8r3p/I5QLW0X4pMH1py6/6d0+L5hh2YY3TxVldj+WWpKGt7rIqI 2oY1r5GPjVVam6O/fN6dUI1feN7T2kv2QWfCdNtTtQ6TFKqShvl4xDHO/W+hqY03lhWV0jFlexOr kia/YhdTHUL5UivZb3tiqZ9A3cj/AFdp57RGqvy7Kif5CmvJ8YDxF3rhxpaXT/ihsuGJZbzdaG9Y /V4BBcqu3XBtVIsiVFQ+rjc97mqx/pMTZHI3ry7gb60y1MwnWHBrVqNp3fIrtYLzEstLUsa5qrs5 WvY5rkRzHtc1zXNciKioqKdDrvxA6W8N2Dvz/VfIPN1uWZKamiiiWaprKhUVUihjTq52zVX1NREV XKidSv8Agf00smmWlV8o8d1ptGp1Dfctud7S7Wm3so6Wnml7Ns1LHGyaZqI2WOR3RyInabbdN1zB 5WVFterHDdlmWRufgttySXzs57VdBH/ZNFJIkieHpQRybIvijH/nA0RpD5QvQrVvUG36XyWjNcIy O8xpLaKXL7MlAlzRUVW9g5skjV5kReXmVvNts3ddkO01z47NEdCM4h0vuNNlGXZnJE2aTH8StXnC sgY5vO1ZEV7GNVW+ly8yu5dnKiIqKvB1q1k4O36taX47n9us2aZxda2J2ISW6hjuc9DI+aHspkkY q9g10nI9r99vgnO8GqpmPhBu9lwPylXEZbdVbjSWvI7xVV0tjluUrYlmon1qTMjic9U35qd1M5Go u6sjX1NUDZHDpxfaMcTyXWi08uNyo75Yl/2TsN5o+6XCkbzcvM6PdzXNR3oqrHO5V2R2yqm9RP8A Kq8NceP5Be5LHniVOO3OW2zWllqp5a2dIk+FqWNjqHMbTs9FHSSPZ1e1ERdymdH6625z5YTO8s0p qYK7HaCwPjvtfb3I6llkSipoXpzt9Fy95RiL8ronr12VT5eSlx6y3Gt4l6qvt0FRLV3llumdIxHc 1M5a1XR9f3rlXqnr2TfwQC9795Ujhbs2ndl1EoajKb7FeGyySWu1WpstfbWRyJG51Y18jY4W86oi Ksi8++7OZN1J/lPGzovjXDZScVNJ58v2F1kkMLWWuliWtZK+bsVY+KaSNrXMkRWuTn9W6cyKiriX yZ+PWWs4DOIWtqrbBLNcfPFDVPcxFWWCOztcxi/KjVmkVPkVylZ2V73eRnv7XOVUZnbGtRV8E71T rt/lVf8AKBuO4+VO4WbTkeP2KvmyuKkyCGmkS9eamrbaKSVjHuhmmSTdXxdo1svZNkaxyKiu6Kdr L5Szhlh1io9HZa3I2S3C4ea6TInW1Ess9T2nZbMnV/O9na+h2qRrHv15uX0jKfHJj1ltvkreH/uN tghWBMYqGOYxEVJKizVEkzt/797lc75V6qc3yodhtFi4buHKO0W+GlS01VJR0XZMRqwQ9xiXkbt4 JvGxf/uUA0Xqrd+GaDyhemVpy7FsyqNX5rCjrBc6SSJLPBSbXDZs7VmR6v6VPhG5PSj6+O1SWTyk uX3bjVuWELp1qWuAUdmZbGYtT4vTPu0V0WaHe41LebtYqflkVN0lVvIsTuTdy7f3X3/uxGhv/JJv /Vdzj6Z3qz2Dyymrz77daS3Nq8UiggdVTNiSWRaK0vRjVcqbqrWOdt8jVX1AekJ1uS5HYsPx655Z k9zgttos9JLXV1ZO7aOCCNqve9y/IjUVTsiveIOg06u2iWa2jVu9OtGH3Czz0d3uDVVHUsEreTtW qjXbK1XIqeiqbom6Km4GemeVP4eFibfJcL1UgxB9R3ZuYSYo7zMq8/Jzdqkiybc3Tbs+bfptv0Lx 1c4oNFdFNLqDWDNcviXHLyyF9nkoWLUS3RZo+0iSnY38PmZ6W/RqJ1VUQ88Kq1cQ3C/w8rm2jXFN phq1ohbYW1VPjuR26LeenfOjkibDIjnq5Hu3WLtmORyLs1HIjTqePXObtqlhXCLrRFTMwLHbqkkz 5GUTamksVU6Wjd2vYuRGSsayJ0kbHbI9kSp0RVA3bpBx36Patah0mlNRjmc4JlVzplq7Vbczsfm2 S5xIiu5qdUe9rvRa5U3VFcjV232U/WuPHfolobnjNLa2gyzMcySFKiosWI2nzhVUsat50WVFexrV Vi83KjlcjVRyoiKirmrMNEqrKOIHRm6ax+UdseXZbZLvT3bErbSYHRwTVjO8QyPjSShqNkZL2LUR 0nM3bnVqKnOddwc3qz4P5SPiTt2p9zpLXkF1q6+Wzy3KVsKy0Tq7tmMjc9U33p3Uz0ai7qxm/g1V A1/pjxl6J6v6R5ZrBgtwudZRYPQ1NdfbRJSpDdKNIYXzLG6F7kbzPbG/kVH8jlRU5kVrtoHpp5Sr h81YyXBMPxO1Zi+8Z7NLFT0stvp97ajJZImvrHMnc2NHuierUYr3bbKrW7pvHX6k8KmoOD8TzeHz F6OPILfi18TK77b7UkNNcJ309Xs7vLfRqFc9sz0cm+6czkXZevR+SQxymouDKrudgpYaa83y93R8 tVyoj5JWNbFDzO8VRqNTZPBN3fKoFh555SDQXDcuyDELLjuoGcvxJzm5DccSsHfqC0q1VR/bzOkY iNarXIrmo5u7VTdVRTp+Kbjxx3CuFeLWXQ9l5v7syo6imsF+oLYyajs1WjmR9pXpN+4ua+RUax7H o6RiNVNl3XE3k8sc1RqcH1Jstg4xbXovU2W7PkyOx3bELdc5ZmJDyvqZJayRr0a1WSxuYiK1qtVV 6vJ1lelmE6WeSm1Wtemmt8WqWOV+T26vhukFlkt0dNKtdbo5IUY+SRVRFY1yruibuVNt9wNvcEnE PduIfRe0XvJcay2hv1sttBDdrne7RFQU95qnwI6SqouyXkkgc5FVHI1iekmzUNBlH8El8st54UNK I7RdqOtfRYfaqepbTztkWGVlO1jmPRF9FyOY5FReu7V+QvAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq +S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/AOxV 9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4Ox YjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAFd6d644nqZn2oWnVht92guWmtfS2 67S1cUTYJpJ4lkYsDmyOc5qNaqKr2sXfwRfEDv8AUXTbBdW8Qr8C1Ixmjv1guSNSpoqpF5XK1yOa 5HNVHMcjkRUc1Ucip0VCtaXgo4XqXDb1gSaTUVRaMhZBHce919XU1czIXo+FqVcsrqhjWOTdqNkR EXfbxUu8AV7imgOk2E5lb9QcaxeSmyC14yzDqWukuVXO5loZOk7adWyyua9e1Tm7RyLIvgrtuh2q aUYAmqy63JYP+zVbD7GVufepv+1vb947Dsefsv3X0ufk5/VzbdCWgCkrzwV8LuQZ3V6kXfSC1z3y 4VTa2tclRUspKyoR3N2k9G2RKaZyu9JVfG7dVVV3VVLB000rwLR/H58W06sKWi11NfU3OSnSpmnR amd/PK/mle5yczuvKi8qepEJYAINq9olpbrzjUOIas4lBf7XTVbK+njfPNBJBUMRUbJHLC9kjHIj nJu1yboqopxsT0A0kwfMLbn2L4otHfrTi8eGUdYtwqpVjs7JkmbTKySRzHbSIju0ciyL4K5U6FhA CJJpRgCarLrclg/7NVsPsZW596m/7W9v3jsOx5+y/dfS5+Tn9XNt0IBnvBdwyamZRXZnl+ldJNeL r/2xqKO4VlAlevy1DKaWNk6r61ka5V9ZdgA6jE8SxjBMcoMRwyw0NlstriSCjoKKFsUMLN99mtb0 6qqqq+Kqqqu6qqnB1D02wPVjFqrCdSMUt2RWOsVHS0VdCj2cyfgvavix6epzVRyepUJKRGfURIdV KfSz2EZZItRZHXv2RMtu9kj2mWLuj6rm6VS7c6R8v4Cou/qAgukPBpwyaD5A7K9K9I7XZ7yrXMZX yT1FZPC1ybOSJ9TJIsW6KqLycu6KqeHQ5+s/Cjw88QlVTXDV/S62X+upI+xhre0mpapI0VVSNZ6d 7JHMRVVUarlRFVdk6qTbC9Q8O1DivM2G3ptyZj95q8fuLmwyRpBcKVyNnh9NreblcqJzN3avqVSR gQPSLQnSLQaxzY5pFgVsxqiqXpJUJStc6WocibNWWaRXSSKiKu3O5dt128ThaS8Omjehi5I7SzDv Mi5dUpWXn/ZCqqe9TJz7O+Hlfyfuj+jOVOvh0QskAVbpjwxaHaN4BftLtN8I8z4xkz533Wh85VlR 3h00DYJF7SaV8jN42tb6Lk223TZep1EHBrw202jNRw+waccuAVdelzmtHnivXmqUc1yP7dZ+2T0m NXZH7dPDxLpAFW55wxaHam6VWDRPOMI85YXjDaNtqtnnKsh7ulLA6CD4aKVsr+WJzm+m9d9913Xq fvVbho0S1vxywYlqhhXnq04vKya00/nKrpu7vbH2bV5oJWOfs1NvTVf8pZ5EtWtS7Ho3ptkWqWS0 Vwq7VjNC+4VcNvjY+ofEzxSNr3saq9fW5E/OB01/4eNHso1isev19xDvOeY3SJQ2u7ecKpnd4Phv Q7BsiQv/ANsTdXMVfT8eibR7VHg84cNYc2g1N1A0ot15yqjZEkNc6tqqVZFi/cu1SCRrZOXZERXt cqIiJ1REQ7PE+IvDMw1Vt2kFust/gvFywWm1BinqYIW0rbfPO2BkTnNlV6To93VqMVmyLs9fAtQC sPZDxNfNFph/+0W4f/wQ59nk1ayWeew6oaX4BTY5XU0sFZ3LK6q6vla5qp2Tqaa2QMexyKqO3k8F 8F8CwCu9X9ccT0VqMHpspt92qnZ/ltBhttW3xRPSKtq1ckck3PIzliTkXmVvM5OmzVAq+Lyb/BLD fUyJmgdpWqSTtezfX1zqXm3327ss6w8v97ybfmLozfSfTXUjCXab5xhFou+MdnHEy1z0zUghbGm0 fZI3bslYnRqs2VqeCoSwruw644nkWtuU6C0VvuzMgxK1Ud3ramWKJKOSGp/c2xPSRXq5PWjmNT5F UCOaQcG3DLoNf3ZVpVpJbLNeXMdG2vknqKyoia5NnJG+pkkdFuiqi8ipui7L0OVrNwk8OfEFcae8 au6WWy/XKljSGOuSaekqezRd0Y6anfG97UVV2a5VRN12TqpboAr7E+H/AEbwTTW5aQ4bgFts2JXi mqKS4W+j54lq4541ilWSZHdq97mLy9or+dERNlTZNuZpFo1ptoPhkWn2lOOeY7BBUS1UdJ3yoqdp ZF3e7nne9/VfVzbJ6iagCidSuBnhP1dy2bO8/wBGLTcL7Uv7SprIampo1qX/AMOZtPKxsrl9bnoq r61LEqNHNLKnTKTRmTA7O3CJaNaB1jipkjpex35tka3bZeb0uZNnc3pb83Uk15ulPY7PXXqrZI+C 300tVK2NEV6sjarlRqKqJvsnTdUInonq7jevGltg1bxChuVHZ8jhknpYLlFHHUsayV8So9sb3tRe aNV6OXpt/IB1uifDhotw6W652rRnCIscprzNHPXNbW1NSs72IqMVXTyPcmyOdsiKidSygZ+oONbT C42LHMghxjL2U+T6ke1dSNfSUyPjuvO9nbSIlQqJTbxu9JFc/ZP3MDQIAAAAAAAAAAAAAAAAAAAA AAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/AILxGaI6NW60 2+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9 nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAHn9pFpblGrHFzxQWZmqOV4 ZjNFkFpmq0xWuSgr7hVvpHJEjqpGufHFGxsiqxnKr3SN3XZuy+gJi/DMF4pdFuIrXTVnGdH6XL8X z28UL6O1pkNHQ1s7YKdWsq4HyOWNGorpGPjmWJy7xubuiKgHS4Jr5qHw7t4ntMs3y+6Z+midtpMg xa532Xtq6qpq2jWaKmqpkRFl5JFiar19JeZ/giNRKXt+u2m910aZqRd/KMZrRa11NpW9JQQ3KVlj prksfasty21IO7rE120Ll67ru5F29E0lptws57qNRa/5vxB26jxjINeqaG0ss9DWMr1sNupqV1PT c0zNo5Zk3a93L6KrE1d05lan9wO88dmmGlVq0TouHnHL7e8ctsdhtmbLmFNFaJIYWJFBVTUjmpVb tY1iujRu7laq7pvsgRG7cTGo/EDifDHp7hmT1OE3XXSGvrMlvVoRraqjprZTq+sjo3PRyROlkZIj H7KrEanjuu94ab6F6w6Rar0dZYNc8izHTSvt00d5tWcXWS5XOlrk6wT0VR2e/Iv4L43vRERVVOZe VGx/iB0R1ryOo0d1wwibHr5qrpJNNLV0Cudb6C+Q1lO2Gvghe9XrArkavZq9VREc7dfUdpglfxea m6q0N+z/ABGm0h08s9tqoarH23ehvFwv1bMzljkdPCxUpood+dvI9rlcicyOa5UaGfciy3Bsly/N m5rxvaxXPJqa71MNHTaWW66+ZrBE3pDTvjo6aWKeVi7o9XyOV2yIqIu6r1WQcR2rud+TTwnVqszS 6W3MZ8qoLTX3e01L6GeqZFdH06ucsKtVO0jY3namyOVXdERdixuGrAeLjQLSaLhls+jlgh83V1fF S6kPyGmWifBUVMkqVrqBqLUyTsbJyticjWu5GI57U3IPjfCNxDT8FGS8LFxw+htV8w7IW3nEr1Pe aeakyJG3B9VsrI1WSnXk9H4VG7ue3fZEdsF6eUTy/LMI4eI73hmUXawXFcpslOtXa62Wlm7KSra1 7OeNyO5XJ0VN9lTopX/F1qDdsb4irJZNZtUdRtNNEJsZ7WkvuGunpWVF+WoVroa2sp43yxNSLlVr OjVXZd/wj88UmMcXXE/pHbsUo+H6LDX2y+Wu7V9HV5Tb6youLop280dO6ORImRMRz5XPke169mxr Y15lVLt1UyPikw7UKWuwXSiyao6fXO2xwraIbtT2m526saq9o90lUvY1EMjVT0d2qi7+pPSCusS1 C9pbQXVfWbD+JBdbcKstrfcsZZc6yOvrrfVshdzU1TXRuR0rHyui2a9jXxt36qq7mZbfrtpvddGm akXfyjGa0WtdTaVvSUENylZY6a5LH2rLcttSDu6xNdtC5eu67uRdvRL8024Scvzi7655JqJp/ZtJ bJq9jsOOwYnZq2GtdTysjei3Kd0CNp1m53czWs333fzLv6Tu3wO88dmmGlVq0TouHnHL7e8ctsdh tmbLmFNFaJIYWJFBVTUjmpVbtY1iujRu7laq7pvsgXfwxatVWumgGDasXCmip67IbTHNWxwoqRtq mKsU/Ii9Ub2kb1RFVdkVE3UqPNbxlF78oLR6ULm2S2/GLxovWzzUFuu09NHHVPuUkPe42scjWVLW Ls2ZE527JsvQ0xi0OSU+NWuDMa6grb7HRwtuVRQQOhppalGJ2joo3Oc5rFdvsiuVdtijLnpTn1Rx 8WbWqGw82GUml82OzXPvUKctwdcnTJD2PP2q/BqjuZGcnq5t+gFSeTE05p7XjOeZyuZ5jXVLc3yG yuoa6/VFRQSNbUQu706ncqsdVOVmzp1TnVHORV6qWdxu5Nlmmdh051mx/JrtbLTh2d2pcpp6Wtlh pqyy1cndp21EbXI2VGvkhVvOio1VVU6nVcHOAa46I3/PNK810vgbidfld5ya1ZjT32mkjqo6mWNY oFo0+HY/ZHKrnIjU2269FW5eIfTJms2hmdaX9kx8+RWOqpKTnVEa2r5FdTvVV6ejM2N38wGV+JXV /UaycWNryXF80vNvwLR6oxajzS3U9bJHRVS32rmhe6oiaqMl7KF1O9vOi8qu3TbdFLHdmOZZfxn6 iwWjO57PimkmnlPS1NPVVsjLS2+16vqY6uqiR7Y5GxUzE35urU68zdyE6Y8MmsGV8Jms1g1wx+Oh 1P1VdVVDqd1fT1CxyU1FDBbGumie6NUSSmY/fn6c/XbbpztKuGfWTKOFfWSw6twwY7qlrNVXSrrU fWRVLaTeBtPRwSS07ntdHyRIq8qqqNmd039ECg8z1OsVp0gv2o+J8bmueX6mWWlqbjHdbRa7p7Ea ishcruwSn7mtE2nVG8iuV6tRfSV227S5uInWjUq7aT8PWoVyyDMMN00zW2w3jUq/4TTvdcLWk9uh npWtexj5IYHTSSI97EVyI1E33VEdyFwXi51F4X14XJ9FbHpoymxD2O1WQzZHS10NakFL2TI6Smp0 c6NKh7GI98yt7ON8myPcjSR6dz8aunejGlVDZdE7JNJhVqixjI8Pq8hpGVlzhpqSGGnuFHXMc6CL dzHq6GTrtsm/XdA7LhZXF7vmVRkWivGNdtUMGktisuOOZHdfO9xoqxXp2VRHPJy1FOxWorVjkYqO VVVF325dD57g+N6l4XetP8wonVlkyCiloK+BsronSQyJs5EexUc1dvWioqGXtONHdV824sLFxGZL obZtGbdjtkr7bW0dPeKSuuGSzVKbMWpWjTskji/DRXOc/ma3xTbk2ABBaDSHAMazOPVC02tKbIbf ikWIQVctTIsUdqhlWeOJzFdy9JFVVftzbdN9jAWRagYzVYJleWpxza05ZqRbWXGrp7jhNsuqYlDV xc7oKdsENK+kdAiNja9XSOTZXLzIh6IaoYhPqDpnluBUtxW3zZLYq+zx1aIqrTuqKd8SSdOvoq/f p8hk3TPAuLePhxouEyo0ZsODRUtimxqszZ2R01XSy0rmPY+elo4UWZZ5WuXrLyI1z1evNtyKHVZt xE6tamaB8NGOY9lc2K5VrxX0dDfL/bGNZUUtJFGi1slKiptFK9dlaqfg7qibdFTpOKrR3I9Jc44b IKPVzNstxmt1nxtJ6XLrp50qaeuZMvZSwVL2pI1jo1mR8blc3dsatRvpc31s3DjxMy8OujkUGm1u smpfD3kMVXa7dWX2mmpcloW7pM1k0KuSnWRvIidoqKnK7fbdFJJrNhnF1xEZjonlF20Oo8KseA6k 2S+XO0PyiiuFbLBHLzz1zpGObE2KBjOVI2OfLIs6qjURmyh3NQuccT3F7qfpnNq3m2GYLo7QWamZ RYjdnWuoudyr4XTrNPOxOdzGIx7Ej35fRavTd3N0/DHjuU4lx/624zlWW1mTy27EbHFR3auaxKyp o12dF3hY0a18rEcsavRrefs0cqbuUlV/091/0N4pM51v0c0tpNSMY1Wt1sZe7VHfqa1VltuFDEsM czXVO0ckTmK5VRF5uZ7uicqc364ddJ+IC1cWWp+uWsWMW610WcY9bIqNluuUVVBRSQqjUokXdJXv jjYxXyrGxjnufydNgNZmbeNnVPP8MsWn2mult98w5LqtmVDikd6SFsr7XSSbrUVETXdFkRvKibp0 RzlTZyIqaSKG4vNDcv1hxXFL/plW2+nznTfJ6LLbAy4Oc2lrJadV56WVzUVWtkavjt4tai7IqqgU vxBY/nnBbZMV1xwrXrUzKrbSZJbrXlVkzG/Ldqa4W+pf2ckkSPand5mu5VasfK3r4bJsvYVMGpep vHxqTpOmr2YY/gtDiFnulTQ2i6yQS9suzWx071VUpUer3PkfCjZHdmxvMiK7fl6pYXxL8XXsT011 D0PpNLcItt/or7k1bVZRSXWouUdK5XNo6SOl35Ue9U3kl5dkRF5enK6f4PpTn1n43tS9X7jYexxH IMRtFst1x71C7t6mFyLKzskesrdvlcxEX1KoFa6ZXjNcE1u4gOHG6ahZLl+LWbD6XIrHNklwdX19 CtRTvbNCtS/4SRiuVFajlXlRqetXKtN6fZRmujvBNwx8RmO5Le6bHcHuslLmdppqyVtHW2Wur5qe SaaBq8kr4XqxY1c1VR0m6KmyGlYdGdSm8WOs2pbsb2xvLNP6KyWet75T/wBk1sbFR8XZ8/aM2X98 9rW/IpyOHvh7ulLwJ2jh01rszbRW1GPXC03imdUQ1HdO2mnc2RJInujVzUex6K1y7KidUVAPhr3l 2U53xMaK6Cae5ddbXRsfPqFl1RZ6+SndLZ6X4OmgkfE5FfBUTucxzVXlXZq9diy6fhk0bpLXaLNB jUzaSxZo7UGhZ36ZezvjnyvWdV5t3N3mk+DX0OqdOiGb/JeYjl17wy+a96jXCG6XW7w0WF2Gsj3W N1js0fdmSxOXqqTTtlc5V/CdGjum+xuQAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWm qjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwh5R3U3VO8 agaQ8Keg+c3fF8vzq6rca64Wm4TUc9NQt5omK98LmvWJf7JkciL17qhMPJia45Tq1oFWYvqRebjc c30+vVTY7xNc6l89bK1XrJDJM96q5ypzSQ7qu/8AY6/ymScYyjia4gOOvUviU4Y8KxLK48GlXF7X Jk1Q5lHT0qsfAyWDlmic58jYqh/4So1Kl26ek3aR8K1/1j4efKI3nE+IHGbHi9drxb5bnLR2SZX2 1a5ZJZYZY1WSRUV0kVWzlVyrz1HqRUA17rJx/aH6Naot0aqLVmWX5bHG2Stt+KWdK99CjmI9O1RZ GKq8io9WsR6oipuiGXuDHN8Z1J8qXrTnWHXHv1mvWFyVVJP2bo3K1ZrQitcxyI5j2uRWua5EVrmq ioiofzg3vmP4X5SfiSoNRrpRWu/XOsuT7RJcZWwrJSOr0mSONz1TfeB1O9Gp1VjN/BqnC4QL1jmV +VD4hbzprWUktBXYzd1oqqmciwzVHfrc2SZjk6Oa6ZHvRybo7m3RV33A0vfPKV8OVo1Ku+nFDR5r f245M6G936yWF1ZarZyOVsj5pGP7Ts2ORyK9sbm+iuyqhR3kfaqmrbpxA1tHURz09RlNLLFLG5HM kY51YrXNVOioqKiop0Pkfs305wXSvViz5/kFpsV/t9975eGXWojglShZTozd/aKiuayRtQjvHlV3 X8JN+w8jBNa6mn1wqLJAsFulv1vfSRK3l5IFSrVjdvVs3ZNgNbcavEe7ha0BvOp1BQwVt7fNDa7J T1G/Yvrpt+V0myoqtYxkkitRUV3Z8u6b7pljTHhU44ddtPLXrJnvHRmmH37J6OO7UFktTJmUlNDK 1JIUmZBPDG1XNc1VY2P0N9lVyoqFn+Vq00yLUbhHq6vG6Karlw6+0mSVUELVc91LHFPBK5ETxRja ntHfI1jl9RLeGjjU4ccu0AxS+3bV3Eser7TY6SkvFtut2gpKijqYYWskTs5HNc5iuaqsc1FRyKm3 XdECsrVV8X1FwbcQ2F8WNlp6mox/E77TWLKIqmnc6806UdQ1yvjjVHoicrHMkexjntk9JOZqqtTc GPHdolwxcH2E43mtHlF5uLZ7lU10WP21tU22xS3GdsTqmSSSOONX8qq1nMr1REXl2Vqrdd64xcQ4 ruGfiXhwPDsgpbNiOKXyjhvtVGxKK5tdRT8jolVUka9Wt51jczdrXM5lRXIhAeDvGLCvklM3c610 6reMfzCsrVWNN5po2VEbJF+VzWwxIi+KcibeAGwpeKXRCDQSLiWnzOKPAp6VKmOuWF/aOcsnZdgk SJzrN2qLGrETdHIvqRVKlwTyl2gGZ5fjmJXTG9QsNbmD2x49dcnsCUduujnua1iwzNlfu1znMRHq iN3cm6puYmw3Xu66FeSuxS4WjEbDf66+ZxX2mmW/W6Ovo6DrPMsyQyIrHSfBqjEcm3pOVd9tl6Tj vg1Bxm0aI0mpHFHZtR53Tw3OmtNqxq3WymsVOrIOV7JaREc6JyJyx86NRyQuciJyqiB6Pa1cdOie gGr9Ho3qRBkNHX1mPzZIl0ipYX2+Omjjqn8jndskqyuWkkY1rYnbvfGm/VVTFflE9b8W4iNHNA9V MNtV6t1quWZ10EVPeKeOCqasL2ROVzGPe1EVWKqel4Km+3gTDiUs9iy7yuehVDc6emuNA/GaSrax yJJG98Et0mid8i7SRsX+Y7Pyx3/afRP/AJWzf/DCBbWqt34ZoPKF6ZWnLsWzKo1fmsKOsFzpJIks 8FJtcNmztWZHq/pU+Ebk9KPr47TfWXjn0d0c1B9qZtlzPOc0igSqq7FhllW5VVHErUcjpkV7Gt9F UdyoquRqtVURHJvm7X3/ALsRob/ySb/1XcpzSXHdVZfKF8QON2HiSptGsorrrcaqnq7hjlHdXXSg dW9rDDGlW9qM2hfBIiNVVcxN9tmboHpdoDxGaXcSuITZjphdqiaKiqVorhQ1sC09bb6hE37OaJVX lXbqioqtXrsqqiolbcfPE/eOGLRKvvmLY/fqnIb1Tz0Vpu1Hbo6mhs9TvG1s9Y6ReViby/BorHo9 7UaqbKpXvALpTiOG6pawZnjPFTbtXbrkFZEmUst2NttkNPcknnd2yujlfC9XudPt2aI1eqoqoSjy p7XO4GdQ1a1V5ZbOq7J4J51pQObwycY9kzPhmZq1rLDkmMJiVnoFyLIMjtEdDS3WofC1X1NC2FVS aN8nRqMY1XK9jWs3VEIxQeVa4aqiqoJ7tjmpNixy51K0tJlFyxvktMzkVUVWyMldIqJsu+0e6bLu ibKZ04sqiryryTGkMuF3KK4U1hjxp2Qto5kk7vA2hmgVsyNVeXapdC1UX98ifIWfxe6oaFXPyYdN QWLJMfqIbnYLBR49b4KiJ0zamKSmVY2RovMx8TI5edNkVqNei+Oyhv8At1xoLvb6a7WqtgrKKthZ UU1RBIj45ontRzHscnRzVRUVFToqKYB4nvKEZnplxZ4TpNiuGZ5Fj9mq6n2U0FNjtPU1eTxuYnY+ bkkVXPiYrX+mx0SqvOi7o00lwNWjJLFwi6VWzLYp4rlFjsDljnRUfHC9XPgYqL1RUhdGmy+G23qM q8XVyt9l8qdw73S8V0FDRsssDHVFRIkcbXOqa9qIrndE3c5qfyuT5QItxF6o4rY/Ka6GawZY+rxy wx6cw3urbdIFjqaOF8N2k7KWJvMqTJzIxY28yq/0U3XbfVuhnlCdBNetUJdHrBS5Xj2UckklJSZH a20a1yRsWRyRcsj1RyRor+WRGKrUVURdjOHEXb7LlHldtB46yKnuFDJi9JXQr0kje6J90mhkReqL s9jHIv5kU5fE/R01F5Wnh/rqSFkM9ZY6fvD2JssqpNcWIrtvFeXZu6+pETwQDS2svHPo7o5qD7Uz bLmec5pFAlVV2LDLKtyqqOJWo5HTIr2Nb6Ko7lRVcjVaqoiOTedaA8Rml3EriE2Y6YXaomioqlaK 4UNbAtPW2+oRN+zmiVV5V26oqKrV67KqoqJ5o6S47qrL5QviBxuw8SVNo1lFddbjVU9XcMco7q66 UDq3tYYY0q3tRm0L4JERqqrmJvtszdNR8AulOI4bqlrBmeM8VNu1duuQVkSZSy3Y222Q09ySed3b K6OV8L1e50+3ZojV6qiqgG2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdi xGqj/TavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRe nhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIxqNhVVq Bi8+NUedZNiMk0kciXTHKmGCtjRjt+Vr5opWI13gu7F6eGxJwBnz3JeQfjicQX/3+tn/APDyyNKd La/TCjuFJXas53nK18rJGzZXW01TJSo1FTliWCCFEau+67ovVE6oTsAAAAKz1z0JtevdkpMav+oG cY7aYllbX0eNXZtCy7QSI1HQVS9m5z4lRqps1Wrs5yb9SzAB1GI4njmB4xa8MxC0QWuy2WljoqCj gRUZDCxuzWpv1XonVVVVVd1VVVVU7cAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmq jKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8K6jguNFUW+q7 TsamJ8MnZyujdyuRUXZ7VRzV2XorVRU8UVFPuAK80T4ftIOHXHKzE9G8Ojx613CtW4VMKVlRVOln VjGcyyVEkj9uWNqI3m5U6qiIqqq/HUnh00b1dzHFNQNQMO85ZFhFQlVYbhFcKqkko5UlZKi/ASsS TZ8bHIj0ciddk9J29kgCmtW+Drhp11yinzXVTSe2Xu+U0bIkre8VFNJKxv4LZewkYkyInREkR2yd PDodlgfC9oNphqTcNW9P9PKSxZRdLWyy1NTSVVQ2FaJiQNbCym7Tu8bUSlg25I2r6Hj1Xe0wBRuS cD/Cjl2o0mq+R6J2OuyaepSsnqHvnSCon33WSWma9KeVyr1cr41Vy7qu6qSzSTh60e0LrckuGlWH pY58vrG195clfVVCVM7VkVHI2aR6R9ZZOjEanXw6JtYwA/L2NkarHtRzXIqKipuip8hnXJvJ3cF2 XX6TJLxoLZW1ssiyvShq6uhgc5V3Vewp5mRdV9XLsaMAELg0Y0sotMK7Ri2YRbbbhVyt9Ra6qz29 i0kUlPOxWTN3iVr0c9rnbvRyPVV3336nBw7QHSTANJKnQrEsT7hg9XS1tFNau/1MvNDV8/eG9tJI 6ZOftH9Ufum/oqmybWEZnwLjQi1N4hNRdIcK03luOLaX0ksl9y5l1REWqjRUWlhpex2e5ZWSsRyz NRUhkd4IiOCc0PCRw62/R1+gMOmNFLgT6l9YloqqupqUZUOdzLKyaWR0zH7quzmvRU3VE2RVQ6Ol 4D+Eei07rtK6bRKzsxy5VcNfVQ94qVqJaiJHJFItWsveEVqSSIm0nRJHonRzt4EzymWhkmkWPa0M wzUFbJkuTyYnRweb6LvTaxkbZFe9ve+RI1R2yKj1dui+inia4Apyy8IHDpjuaYbqFZdOWUl/0/tb bNjlUy6VqpQ0be22j7NZljk/2zP6UjXOXn8eibd7rJw8aPcQENkp9XMQ8/R45VrXWxPOFVS9hOqI iv8A7HkZzfgp0dunTwLGAFc3/h40eyjWKx6/X3EO855jdIlDa7t5wqmd3g+G9DsGyJC//bE3VzFX 0/Hom3T6y8I/DlxA3OnvermldsvtzpY0hjrkmnpKlY0XdrHS08kb3tTddmuVUTddk6qRDhD4v/dV V2odF7XnsX9gV2jtfN527733nWZO027GLs9ux8PS/C8enW4NXc99qvSrMdTfNPnT2JWGvvfce37D vPdoHy9l2nK7k5uTbm5Xbb77L4AfnS/SPTXRbGGYbpZhttxuzskWZaejjVO0kVERZJHuVXyPVERO Z6quyIm/RDtM1wrFNRcVueEZxYqW82K8QLTV1DUt3jmjVUXZduqKioioqKioqIqKioild8KHED7p /RGz6x+xL2Nedqirg83d/wC+dl2E74t+17OPm5uTf8BNt9uviW+BVOlfCvw/6LYzfsN0400t9usm UbJeaGpnnr4q5qNc1GyJVPk5m8r3Jy+HVehDbB5PbgzxnKY8xtOg1kS5QzJPGlRU1VTTMei7oqU0 sroE2XwTk2T1GiAB/ERETZE6FW62cLugvEU62S6y6dUeRTWdHpRTuqaimmia5UVzO0p5GOc1VRF5 VVW79di0zOef8X/sG4xMG4Tfa8777NLSl08/+duz7pulZ8H3bsXdp/tPx7Vv7p4ej1CaRcK2gkGo GHapQYCyPJsAs8FgxysZcaxraCghjkjihSFJeyejWTSJu9jnel1Xom3ZZVw86PZtqxjuuGT4h33N sTgbTWe6ecKqPu0aOkcjexZIkL+s0i7vY5fS/Mm1jEc1Izq1aYafZLqRfaStqrbi1pqrxWQ0TGPq HwU8TpZEja9zWq7lauyK5qb+KoBBNZeEfhy4gbnT3vVzSu2X250saQx1yTT0lSsaLu1jpaeSN72p uuzXKqJuuydVJfpfpHprotjDMN0sw2243Z2SLMtPRxqnaSKiIskj3Kr5HqiInM9VXZETfohR1v8A KFaN3K26L3SDEs5bFrrc6m1Y4j6GkR1NLBXsonuq9qnZjO0ka5FjWReTddkX0Ts8R4wO/wDFpkHC Zn+nnsVu9LSOuGOXRLv3uG/UyN7RFazsY1if2SOfy8z0RYpm827EVwaNAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53i NzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy 2aZzZ3ecLfHTwdixGqj/AE2rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAHyqp0paaapWKWXsY3SckTeZ7tk32anrVfUhRPBJQasR6FQZBrZJk MWWZPe7te6q3XuSZ09rjmq3pDStbL1jjbGxrmsREanP0TqTHiB1ysfD7gDM6vVmrrw6putBZqK20 LmJUVdTVTtjaxnOqN3RqvfsqpujFTpvuWUAAAAAAAAAAAAiOreD12pWmeTYHbMnueOVt8ts1JS3W 21L4Kijmc30JGvYqOREdtzIipzN5k9ZLgBVnDFetWr3ojjcmuWN1Nmzehikt12ZO9jlq5IJHRNq0 Vqr0ma1snXbq5dk22VbTKU4i9f7pw/XrTq73XH6SXAciv/mLJ73LM5r7K6dm1JMrUTlSJZd0kkcu zURE23cm11gAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUlxEcY+gfDFb3yalZlEt5WPtKbH7dtU3Oo6bptCiokbV 9T5VYxfU7foefV+4sOOvj+u9XhPDFhVZg+FLItPV3OmnWJzWLv8A7ZuSoiRqrevZQIj/ABT4RANz cSnHtw88MkVRbcpydL3lMbV7PHLKraisR+y7dsu6Mp03237RyO2XdrXeBRnHlxqZHQcM2muTcO1/ lttdrFUtZSXOJUSoo6ZrG9tExyp8HMksjInO8W8sm2y7KnK4bfJJ6PaaSwZZrjXJqVlHN2z6aoY5 tohlVVVfgXelUr16rMvKvj2aKSrylfDYuseiWPPwu/47jN8wW5JV2aK5VsNupJolj5X00cj1bHE/ Zkbmb7N+CVF2Rd0DNnHViHFHwhaDYxV2fi81FySlvl9gpbrV1V0nhrqavbSzvalNVMk7ZKaREl5o XucnNFEqLvuT3j51T1ywzW7hqsmkOoF8tlwyVkVKtCl1qIqG41clRTRwrWRMdyzt5pfSR6O3RVT1 lM+UfyTiyzHh8we48RmG4rhMNNkMNPTWm13NlfU3irdRzq+uVYnvjhiY1vK1jXOVVqV3XZG76k4q OHHWfU3iH4YM/wAIwxbjYdPrlb6rI6pa+lgWhijraSV6rHLI2STZkUi7Rtcvo7bbqiKEF4nM81/4 E+Hy16d23XW9ah6i6oZZULSZReYV7W10vd6dksFOyWWVrE7XlVng1qTyKjUciOOm4l8H4peBrTyw cQWN8XWcZ1WUd0paPIrLktQ+qtlT2yO3WGJ73dnHzt5OVPT2ejmvareuluP3hKvHFZpfaqPCrzTW vM8RuC3SyS1TlbDMrm8ssDnoiqzm5Y3Nfsuzo2ouyKqpQ+selPlBuM3GMc0T1c0xxDTXGaS4U9dk GRQXuCtfcHRNc3mhp4ZHuYi87npG7ZFcjN3tRF3D+8ROvWdXviq4RbjhWbZLYcZ1EpbTdq6zUV2n hpauKqqInoyoiY5GTehJyrzNXdOngSHju1J1FxDjA4W8ZxLPsjslnyDJqSC72+3XWemprhEtzo2K yoijcjZmqx72qj0VNnKngqnJ40eD/Vq6XbRHUzhetdBdLxoulLRUlkr6yODt6amfC+mVHyOZGqJ2 LmvRXtVUenL4KQvVvQHjW1z4jdAtd840xslsosUyOhmuditV8pZksVDT19NO+ommlkZ3iWX4ZeSB Ho1kEadXOXcPjrJlfEDkvlPW6Hab615JitlvePRJOxlZLPSUEPcXSzzwUb39glQqRq1j1avK96P8 UORp5meuPCr5QWwcNOaa3ZRqVhOodqSupJMkqnVNVSOeyo7JzXOVVa5JqWRio1WsVj91buibRLWm LU1fK501do/5plyq34zHWUdHdXuZSV7G26TtaaR7esayRK9Gv2VGv5FXoilqaT8OXE5q/wAadDxZ 8TeGWbB6HELctDYbDRXWG4SSqkcrI93wucnI11RNKrnK1yuViIzbfYNp6m5LNhem+V5jTI1ZbFY6 +5xo7w5oIHyJv/O0xd5H7DaNOFrIMpr+ae4Zpk9c+uqnrvLLFHFHE1quXquzu2duvrkcbZzvGmZn g+Q4dJKkbb7aqu2Oevg1JoXR7/zcxiTyPOTPh0PzPR+9xLSZHgeXVMVdQvX4SCOZjUTmT1L20NS3 /wC4As+k8nJodR6PYroozI80fZMRyz2YUdQ+spFq5qzlVqxyuSm5FhVF8Gsa7onpFfcdmoVVaNWc VxbK+M2HR3BHUaT3C14y2tkyitkcsiJK1aWCR0caqjGM3VG9JHbPVEam6jAOr3DtxN4Lx7S8Wuju mlk1Ktd4tsdGtvrr3Bb32uRKKOlcqOmXdE+CR6OjR6qkkjVRN9wI95PTiZyq+cQeqGh9XrFf9TdP 7FZpsix/IMhimS5JDDNTxua9Z2tmXdtTsqPTxi3ajUcqL0PCNPxNcdF2zzX6p4n8ywGmtF5Wgxux WeRHWyGRGJK1lRSuXspomMfC1Uc1XP3cquT1zDSPht4uNKuN24665PhuOZlaNT7UtBlddQXaKkp7 G2pmp5Jo4opXdtOkCUzGM2avaNVFVWrvt13Dvw/8c/Bvk2b6V6RYDiGWYLk9yWstGSXa9Mp47Y5W 8jJ5oEd28ipGkfaRtjVFdGnK/ZV3Cp+BDVvIdENA+LPVqeipHZDYa6mnbCjVWnbcZHVUbOirusaT SNXbfdWptv6zvsX064ms94FMz4osl4pcxu1zybF77VVmLXGRKizSWlGzwzsSFV2imWJkkrHxIxGr yN5VTfedcKHAlrBZdGuIrRnWq2+Z/bFlhist4fV0tSlW+PvCsq3RwSvcxEkWF6sfyuVHKidUXbrs G0W8ojZuFnJOD+r0zxGjs1PabpR0GULfoJZq6mk7WVKGGFH9HTSPWFJZuyayOTdybtQCacAuu2lH D75P/BMv1gy6PHrRXX26W2nqX0k9Qj6l1XUyNZywMe5N2RSLuqbej47qhJeKnyg+HWHhQuesvDVl lLf6yuyKPDaG5PoJmR0Ne+nWpkesVRG1XqyBu7d2qzmezfmRFaSbgt4YX41wkYto7xMaSY/X3Cz3 S4V7rRe6ehu8EMklRM6KZuyyxc/Zyqm6LzIjnJ03VDtuKLgj0/1k4dbrovpdjeMYHUNukeRWpLZa 4qKi86RxrFzzx07E354XOiV6IrkRWrs7lRqhmDVfSniz0G4aKXiut/GTqDdsvttJbr1ebFcapZ7Q +Opkia+GKneqxp2azJuqt2cjHbNZuiJxuNTir1Rv/Djw3a3ac5LfMXumW1zp7lQ2a61FFDVzsbG2 Snk7N6LJF2rHoiP39F351JDnGnHlI9btDbbwo5bpRhmN2fsqG23fNn5FDMlbSUr2OY5KeN7pWOcs UbnLyelsqbMRy7d3xh8FGpN10X0F0h0FxiTJqbTWvRLhNJXUlG/s0ZHz1DknlYiq96SOVrFcqb/y AVzxc13FnwZZVp3rxcOKHIcwbkV47vfsdka6CzxyIjZHwQUvO6PsXM7ViLytkbytdzcy7tmevv8A 3YjQ3/kk3/qu5Y/lQOHnWHiJ04wiw6OYh7IK+0ZEtfWxecKWk7KDsHs5+aokja70lRNkVV/MfzV7 h41hyjyk2lWv1ixDvOB43jraG6XbzhSs7vPtcfQ7B0iTP/2xD1axU9Px6LsEd4b9QNRdIePjVjhs 1T1EyO/WHIKJckw6W/3eetSnp2qsyQwOne5WtSGWZrttkVaP8x1PBa/OOMa+cRmpGf6gZhPprmMt xwrHbP52mWkpaOoa7tpIKeRXQxysp3UyNeka+lJLunVUXp/LA2Z+FM011+w28xW3NaWor8SjZH1q auiq6WbdWInVUi5pW/mWqTx3RDX/AAf6Ls0A4ccI0zmpkhuVHbm1d36dVuFQqzVCKvr5XvViL/BY 35AIlbuAzR22WzRW1QX3LHRaE3CquWOufV0yuqpZ6mOoelXtAiPb2kTduzSNdt+q+JnnylbE094n uGDWy0J2VxiyBbXWSJ0WWliq6V7YlVOvKraiqaqfI9T0XPOnygzvbb4zeGfQGyf2RWUF1W/3Rkfp OipH1ELnOVPUrYaGpfsvqVF8FQD0WAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTeb aBlRF2Ozkb6TnqjuZF6eGylykUyK16ZVed4jc8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaci L6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABCdT dH8K1cfir80pqqoTDcio8ptjIqhY2JX03N2TpGp0kanO70V+Umxn/BNPdSKnjM1N1fy62VNDjNPi 9nxbEnuq43x10CudU1cvZseqsVlR6Kc6I5UdunRTQAAAAAAAAAAAAAAB1eTYtjOa2SoxrMMft18t FWsa1FBcaVlRTzcj2yM543orXbPY1ybp4tRTpsV1Q0/y7Lso09xi/wAFTfcHkpqe929sb430Szx9 pDujkRHNcxN0c3dvRU33RUJaVZNoFZo+I6n4jrNf622XOXHZMcvNtgjYtPd4kka+CWVV6o+JUVEc ibqiNbujUVHBaYAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAgmr2uek2g2NuyvVnOLbj1Ds7sUqJN56pyJurIIW7yTO2/es aq+teh5zaneU1194i8lm0n4HNLrtG+o3jW9TUjai4LGu6do1i7wUbP8AwkrnKnRd2KB6Ba68TWif DfY0vWrWc0VqklYr6S3MXtq+s67fA07N3uTfor9kYi/hOQ87Mz4/OLzjKyKp004MNNrrjloc5I6i 7sRrq9kblROeaqX4ChTx6Ncr/wCC9fAm2hXkk6/I78uqPGfqBX5bfq6RKmostLcJZUlfvvtV1zl7 SXp0VsXKiKnSRyHonheDYbpzjtLiWBYvbMfs1E3lgordTMgib0RFdytRN3Lt1cu6qvVVVQMDcO/k iMPstfHn3FJlU2f5JUSd6mtUNRKlAky7KqzzO2mqnb/KrGr1RzXoeg1isFixaz0mPYzZaG02ugjS KloqGnZBBAxP3rI2IjWp+ZEOeABAdbtDNNOIfA6jTnVSw+dLPNMyqj5JXRTU1QxFRk0UjerHojnJ v4KjnIqKiqiz4AZNwvyaGgGL5XYcryHI9Qs8XFnMfZLdlt/StoberFRWJFCyJnotVrV5HKrF5U3R djWQAAAAAABSsvCfp1NxPw8WLr1kaZdBbltjaJKmDzasXYOg3WPse15uVyrv2u2/q26F1AAClsT4 UNO8F4h8j4kcRvOR2u+ZbTLT3u0QVECWitcqN3mdCsKyJKr2JJzNkT0lcvg9yLdIAAAAAAAAAAAA AAAAAzU/gB0OuOvL+ITLLll+UXxl0feKK2Xm6smtdvqXSdoiwQNja5GtfsrWOe5qKibouxpUAAUt hXCfp1hvEDlPEvJecjv+aZRCtKst4qYJKe20/op2VIyOFixtRkbI0Vznu5W7b7uerrpAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wXiM 0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg329W7G7JcMiu86Q0NrpJq2qkX95DExXvd/M1q qc46PM7fid9xytxPNnUjrRkkEtmqKapqOxbWMnjcx8CKjkVVexXps1d9t9gIhw26uXPXnRHFdXbv iKYzPk1NJVJbUrO9dlEkz2Rv7TkZukjGNkROXoj0Tddt1ss6rFMXsGEYxacNxW2st9msVFBbrfSM c5zYKeFiMjYiuVXLs1qJuqqq+KqqnagAAAAAAAAAAAAAA4N8tUV+stwsc9XWUsdxpZaR89HUOgqI myMVqvilbs6N6Iu7XIu6KiKngc4AUZwgWbWjDdMavTTWyCoqq3CrxVWSy36edsj79aI1RaWrcnM5 zXcjuzVHbLtG3xXdS8ymuKzWfMOH/TGDVXG8Wpb7arPeaH2URSc6zU9lkl5Kiop2sVOaVnMzbm9F EVzlRUapbNnu9sv9por9Za6Gtt1yp46ukqYXc0c8MjUcyRq+trmqiovyKBzAAAAAAAAAAAAAAAAZ V8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0+WZhiuB2 CrynNcjttis9CxX1FdcKlkEMafne9UTf5E8V9R55a++V0oqi7LptwhYNWZtkVZItLTXepopnwvk6 p/YlGxEmqHetFdyJun4L0A39qJqdp9pLjU+Yal5ha8cs9P0dVV9QkbXO9TGJ+E96+prUVy+pFPOj WXyr+cak5D7VXBFprc71d61yww3urtzqiof1ROemokRUa1N9+0n6In4UaeJ0enXk3eJTikyaDVjj h1Qu1BFKvaR2Zk7Jrj2SqirG1rUWmoI1TryMa5UVFRWNXqei+jPD9o/w/Y8mNaS4NbrFTua1KieN nPVVbkT8Kad28ki/+MuyepEToB596QeSv1T1kyNurXHJqbdq641nLI+x01w7zWub4pFPVrvHCxq9 OygRyIi+i9ngejWmWkumujWNRYhpdhdrxu0xbKsFDCjVld/Dleu75X/3z3Od+cloAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/AOxV9a6JK9nP CjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptX m3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUR xF6N5lrDqRoktE2idhuGZc7K8hSafll7elgctB2ce20iLK96O6psiouypvte5S2juuOQ6pa26yYK 2026PFdN7hbbPbrjEj+8VdbJTLJWxybuVu0T+VqcqIuy9dwLpAAAAAAAAAAAAAAAAAAHFudstt7t tXZrzb6avt9fBJS1dJVQtlhqIXtVr45GORWvY5qqitVFRUVUUiNm1M0yptSJ9AbLX09FkljsdPd2 2eOkdBHHbnPWJjofRSNzWq1GqjFXl3ai7E4Kwz/QTHs71d0+1qZerjZsiwCSrjjloUYiXGiqI1ZJ R1HMi80XNs5PW3d3KrVdzIFngAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmq gAAAAAAAAAAAAAAAAAAAAAAAAAPnUVFPSU8tXVzxwwQsdJLLI5GsYxE3VzlXoiIibqqmHOJnysOi OkD6nFtJI2alZUxVi5qKbltVNJvt6dSiL2yp0VGwo5q+CvaoG27veLTYLZU3q+3Skttvo41lqaur nbDDCxPFz3uVGtRPlVdjAfEd5XXTnDqmTCeG+xO1EyeZ/dobg+ORtrjmVURqRtbtLVu5unKzkavR Wvd4FJWfht4+PKGXOlyziHyupwHAZJG1FNb6indTs7NdlRaa2o5HOXbwlqHb7LujnJ0N98OPBLw/ cMNLFPgOIsq8hSPknyO68tRcZN02dyvVEbC1durYmtRfXuvUDB+KcDnGfxu36l1F4wtQ7nieOq/t qW0TsRKtka7+jBQN2ipOnoq6VO08Fc1/ieh2gfCnoXw1WnzfpVhFLRVkkaR1V3qfh7jVp/4Sdyc2 2/XkbysT1NQtwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa 23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMff mFB3/wBir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAHFudzt9lttXebtWRUlDQQSVNTUTORrIYmNVz3uVfBEaiqq/Ih 0WAUmm8lomy3TGkx/wA25dULfZrhZY4Uhuk8rWo6rc+JNpXvRrd3qqqu3VToeInAMr1W0OzXTTCb 1RWm8ZRaJ7VDWViP7GNkyckvNyIrtljV7d0RdlVOhI9OsNoNOtP8a0/te3c8atFHaYFRNt2QQtjR f50buBIgAAAAAAAAAAAAAAAAAAAAFAcLen+rekF51G0vzF9Xd8Gor867YPfq24JUVM1JW8009HKj nrKqwSqqdo/8NZHr8iJf5W3EbmOpWnmi2U53pLYrZesjx+j84xW64MkdHUwROR1Q1qRua7tOxSRW bb7uRqbLud9pVqTjesGnGOan4jUdrackt8VfT7qiuj5k9KJ+3g9jkcxyepzVQCVgAAAAAAAAAAAA Mq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAADiVF2tlLcKS01FdBHW1zZH 01O56JJM2NEWRzW+Ko3mbuvgnMnyocsAAZh4mPKH8PHDV3qyXK/eynL4N2ex6ySNlmikT97Uy79n T+Kbo5Vft1RigaeMecTflPuH3QHvePY1XN1By+HmZ5ts1Q1aSmk2XpUVfVjdlTZWxpI9F6K1viZF myzyhnlLJ30OLULtOdKqp6xyyMklo7fLDum6ST7dvXu2/esTs906tZ4mvuGTyY/D5w+pSZBf7e3U DMIUa/zpeadq01PJt401J1Yzr1Rz1keipujk8AMgwYV5QvylVRHcMyuLtOdLKp6SRQyRSUdBLFuu yx02/bVztvB8i9nv4Ob4G4+Gfye3DzwzpTXqz2Bcmy6HZy5Fe2NmnienXenj27On267KxOfbor3G mgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE 3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4FNaoa23/AAXiM0R0at1pt9Rb NT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAzVx9asam6B6LUOt+mNRGs+I5BRS3ehqWq+luFtnV1O+GVE6pvLLA rXtVHNcibL1VF0qVVxV4B7aPDdqTgrIe1qLnjdb3Rm2+9VHGssH+djjAy/j/AJTTBNV870dgwzML PhtiuiXer1FjySSKHzSynpmLBAk8itavazP2ZIxfSTbojuZjdIaccXmgesWeP050lzKTL7rTQPqq 6W10E76Ohgb0SSWqexsOznKjWoxznKq+GyKqf56dJ9Ks31r1As+menlnfcb3eqhIYWIi8kTfF80r kReSJjd3Odt0ai/yH+hDhL4W8J4UNK6XA8YaysutVy1V+vLmcstyrNurl/gxs3VsbP3req7uc5zg usAAAAAAAAAAAAAAAAAAAAB/FRHIrXIioqbKi+sr9+pOlmnmoOJ6AQNgsl2yG21dZYbdTUCwUb4a bZZYo3NakaPRHOd2bevK1VVE3TewStNatBcV1ufh9berlcrRdcGyGmyOz3S2OjZVQTRL6USOe1yd lImyPaqKi8rd06IBZYAAAAAAAAAA/ioqoqIqpuninqMR2/yleNaX6xX7QDitx1+IXyxVy00GSW6K Sa1XCnds6CofF6U1Okkbo3bJ2rUVV5nN2Nunmr5ZPhu9kuE2fiRxqg5rji3Jacg7NvWS3SyfATL/ AMFM9Wr+afr0YBCuGfyj+j3DJwX6fadU1rueY6hU7bojrFQsWGKnfLdKuSJJ6hzVRvMx7HI2Nsjv STdE33PTbS+rz246f2K56n0dBRZTXUjKq50VAxzYKOWT0+7t5nOVyxoqMVyr6TmuciIioieKnkqu G726+ISHPL/Qdti+m/ZXao527snuKqvc4fz7Pa6ZfzQoi/hHuoAAAAAAAAAAAAAADqcryrH8Hxm6 Zjld1gttmstJLXV1XMuzIYY2q5zl/mTwTqvgnU7Y8e/KzcZ65xkMvDHpvdkdj9hqUflNXBJu2uuD F3bSIqeMcDk3enrl6bJ2SKoTPhG4tMg4pPKR1mX1sdRT46zF7rasatr37JRUTZIZEke1N07WXs+a RUXxcjUVWsabU4j+N/h94YqWWmzvLWV2RJHzw45aeWouD1VFVvOxFRsDV/hSuai+rfwP8/mnOouc aZX9980/zCrxi5VlLJbZLnSvdHLDTzbJJyvYivZ0T8Jnp7b7HrBwd+TD0EuNhtms2p2fUOsVZd07 7ElDUOdZe1cqq5Xqu0tU9HfhdryJvujo9wKpu3EVx9+UQuVTivD/AItUaf6fSSOp6m4U9Q+mi7Nd 0VKm5K1HvXbo6KnbvsuzmOTqaT4ZvJQ6GaOLS5PqmrdScrjVJf7Ph5bVTSdF+DpVVe1VF3TmmVyL 0VGMU2xarTarFbqez2S20tvoKONIqelpYWxQwsTwaxjURrUT5ETY5YHzgggpYI6WlhjhhhYkcccb Ua1jUTZGoidERE6bH0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uz Xib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAAAABCNRN RLhhVwstrteMeeqq9d57OPvrabk7FrHL1c1UXdHL60/B9e5NyqNXP93+A/pX/URlXG1127OdE5Tn TGfbVEc6DE1VUW5mmcp1fOD23M/+aH+n4P2B7bmf/ND/AE/B+wfQFP8A1vzZ7qftU+Mu9OfDyfP2 3M/+aH+n4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJ8/bcz/AOaH+n4P2B7bmf8AzQ/0/B+w fQD/AFvzZ7qftOMu9OfDyfP23M/+aH+n4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJ8/bcz/ AOaH+n4P2B7bmf8AzQ/0/B+wfQD/AFvzZ7qftOMu9OfDyfP23M/+aH+n4P2B7bmf/ND/AE/B+wfQ D/W/Nnup+04y7058PJ8/bcz/AOaH+n4P2B7bmf8AzQ/0/B+wfQD/AFvzZ7qftOMu9OfDyfP23M/+ aH+n4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJ8/bcz/AOaH+n4P2B7bmf8AzQ/0/B+wfQD/ AFvzZ7qftOMu9OfDyfP23M/+aH+n4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJ8/bcz/AOaH +n4P2B7bmf8AzQ/0/B+wfQD/AFvzZ7qftOMu9OfDyfP23M/+aH+n4P2B7bmf/ND/AE/B+wfQD/W/ Nnup+04y7058PJ8/bcz/AOaH+n4P2B7bmf8AzQ/0/B+wfQD/AFvzZ7qftOMu9OfDyfP23M/+aH+n 4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJ8/bcz/AOaH+n4P2B7bmf8AzQ/0/B+wfQD/AFvz Z7qftOMu9OfDyfP23M/+aH+n4P2B7bmf/ND/AE/B+wfQD/W/Nnup+04y7058PJUnAPwpac6E4hdc /slBHPkWZV9Y+Sse1FdRW9tVIkFFCuycrGta1XqiJzv2VejWI3VxXugH9qOw/wCFf1mUsIv4Wuq7 Yorq2zET4L9mqa7dNU7ZiAAE6QAAAAAAAAAAAAAAAAAAAAAUBpHpdqdpTxIanyUyrcdK8/bDlVLP UV3NNa767aKqpmRuVXOjkYxsm/RrEZGxvgpf5HdRJc4gwS/z6aRWyXK4rdO+zR3NjnUslYjFWJkq Nc1eVzkRFVHJtvuQrhe1xpuIXRaw6jrR9wusrX0F9tyorXUF0gd2dTCrV6t2enM1F68j27+IFrgA AAAAAAFWcTee6Raf6K5PXa3Tsdi9zoZrVPQtTnqLk6djmJS07PF8z915UTw25lVEaqp3GtWtWA6B YDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVSitFdFc+1sz6h4puKW1d0uFJvJge ByLz02L0ztlbU1DV6SVz0Rqqqp6HTojka2IIl5Let08wrSe4aFssd1xbUqy1011yey32Du9wnbO5 O71TWqic8PYdgzdE9FydUTmRXbdKK4leGr23vNeounV+9h+rWH7zY1ksLfHxVaOrREXtaWTdUc1U Xl5lVEVFc17hq4lfbe86adai2H2H6tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrnheoAAAAA AAAAAAACvNfbVrLf9Kr5YNBLpYLVmVzh7pSXO9VM0MNAx+6STsWGKVyytbvyIrURHKjlVeXld5UU /kVOJKr7SpvGqWnTKmSRXOWOrr5+ffqrlc6mau6qq79P5+p7NADxwpfIk65vna2t1dwSKFd+Z8TK yRydOmzViai9dvWn/wCIvjhn8n1xb8K2T+etOOIzFZLVVSo+52GtoKt9vuCIm2740VOSTZERJGbO TbbdW7tX0XAHypVqXU0Lq2OKOoWNqysier2Nft6SNcqIqpvvsqom/wAiH1AAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp /sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2 s7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAAAVRq5/u/wH9K/6iMtcqjVz/d/gP6V/1EZTx/sf fT/dCti/ZT2x84fQAECmAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA7HQD+1HYf8K/rMpY RXugH9qOw/4V/WZSwizgf2W3/LHyhfw/saOyPkAAtJgAAAAAAAAAAAAAAAAAAAAAK8zbVfTTRe+4 ZiN/idaXahXyW12uSmoeWkW4yI6VUmkaiNY+V6qib7ue9yr12c5LDK9120Qw3iF06q9Ns3dWwUc9 RT1lPXW+RsVbQVUMiPjnp5HNd2cibK3m2X0XOTwVQLCB8aWNKeCOjdVPnkhiY1z5VRZH9NuZ2yIm 67L4Iib7n2AAAAQTWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieHVVVGoqo1q1q wHQLAa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqUVororn2tmfUPFNxS2rulwpN 5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxA0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2V tTUNXpJXPRGqqqnodOiORrYtYAACiuJXhq9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNV F5eZVRFRXNfeoAorhq4lfbe86adai2H2H6tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrn3qU VxK8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5r3DVxK+2950061FsPsP 1aw/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXPC9QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem 3sp88tmmc2d3nC3x08HYsRqo/wBNq826t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9v TebaBlRF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAAACqNXP93+A/pX/URlrlUauf7v8B/Sv+oj KeP9j76f7oVsX7Ke2PnD6AAgUwAzx5QHLsgwvhKzu741VzUlZPFSW91RE5WuihqKuKGXZU6pvG9z N/74zTGlOTNMaUxC3rPqrpfkV+lxXH9SMWud6hVyS22jvFPNVMVv4XNEx6vTb17p0OblmdYRgVFH cs5zGx47SSu5I57tcYaSN7vkR0rmoq/mKpunB3oFcsNxzHrPi1Njc2MTUdbar9YIoKS5xTQKitk7 zyOc/nVN383NzKu/jsqV1p/jOPau8b+tlw1JstFfPa9t9gtOOUVygbUQ0cFVTPmnljjeitR7nt35 0TfaRU32U2imJ1toppnW1DZctxTJLJ7Jcdya03S0crnecKKtjnpuVqbuXtWOVuyJ49eh0M+tmjNN Ha5qnVvC4o74xJbW99/pGpXM5lbzQKsnwqcyKm7d+qKhmmyWa1aZcZmqWnmB2+C1YzkulnsorrXR RpFSw3KOfu6SNibs1iujc5V2RN1dupDNHtKNP6vyYN7yC54tba+7VuG3+7SV9VTMlqEqKZKpaZWy ORXNSJIYkaiKiJy9PFd86ENtCNrbFy1N02suSU+G3jUHGqG/1asSntVTdqeKsmV34KMhc9Hu39Wy dTmXbM8PsNzhst8yuzW64VNNNWQ0lXXxQzS08KbyytY5yOcxidXORNmp4qhiDUPTLCafyYsGTyY/ RT3+bFbRkT7xNC19etfLJTyOmWoXeTm9NWIvN0Zs38FNiV6o2C26i8V3DVR5fTsuVJV4tdq+tpp0 5oqt7KWOVqStXo9vatY9Wruiq1N0UaEfNjQj5+DUVp1Z0rv1luGSWPUvFLjabTt3+vpLzTTU1Jv4 drI16tj/APulQ+9szzFcvxeuyPT7MsbvdNTxSoyvpbjHU0UczWb7SyROVEanRXdd0QyzcNKcBm8o 9S2luL26K1yaYsyOptsdMxtJVXCO4y00c8sKJySOYxycquRdnNaqdURT7YbabXiXFHxK43jNvp7Z aqzDrVcpKKkibFB3laSRHSIxqI1HO5nKqonVVVV6qNGDQjmTzKOKu26SaI4pnepWTae33Jchq4KW OLGb6kdsrWvrGwzVNLLLzvfDBE9HyO2VEc3lVW8yKl74/kePZbZ6bIsVvtuvNqrGq6mrrfVMqKeZ EcrVVkkaq1yI5FRdl8UVPUedFztVrrfJ6aAVVZbaWeZmYWuBsksLXObHJcKjnYiqm6Ndypunguyb +B6P26226z0UVttFvpqGkgRUip6aJsUbEVVVUa1qIidVVenyiuIhiuIiO9ySJZJq7pRht1ZYsv1P xKx3KREVlHcr1TU07kXwVI5Ho5d/5CWmIY9L810MyrUKrzfhYtmteNZfkVbfvZFb0pKu8xU06oqU ktHUt55eREVGpG7l6rt+F01piJYppidray3G3toPOrq6nSiSHvHeVlb2XZbc3Pz77cu3XffbbqR/ FtU9MM5rp7ZhOo+L5BWUyK6entV4p6uWJEXZVc2N7lam/wAqGGtbcnwK8cOGieBcPtmvN0wHLM8g tdXj09xdTVdS1kz3yWiWWof8DzTLts53K3larV5dt5DqZp7rPktXhl90s4H4tPMmw6+0dwo7xb8j sUX9hsXlnpZGwStWSJ7FVFau6dNttlVF30I528W455bQyzO8IwKjiuOc5lY8dpZn9nHPdrjDSRvd /Ba6VzUVfzIJs6winxZ2dT5jY48bZF2zrw+4QpQtj35edZ1d2aN3VE35tt+hmXAsZxvWHjZ1vqNT bDb7+3ALfj9ox2hulOypho6eqpnzTyMjkRWo5z2ovOib7PVN9lPxxI6HYLoxwr66OwDvlFb8ngZd JbN2rO4W+ftI2uWlha1Oxa/orm7qnot22RNjGjGcQxoRnENP2jN8MyC71lgsOXWW5XO3RxzVlFR1 8U09NHIm8bpI2OVzEcnVFVE39R1tu1c0ou+ROxC06nYnW35r1jW1096ppKtHJ4tWFr1funybGVdd rNb9C/J9XTINN7XT2zILvj9np7re6aFrK6rdWTQNqZpp0RHve/tpeqr0WTptsiEazfSDOMj0Qbpl hXAImP3GhooVsWQ02VWFtZR1sXK6Or7ZkqSucrmor15t3cy7qZiiJIoidebS2qHFNplpTqxhuleS ZHj1LNki1zrnWVt8gpW2KKCl7aF9Q1/4PbuVscaPczfdVartti4opYqiJk8ErJI5Go9j2ORWuaqb oqKniioYyzbHam8cUXCkmp+LW12R3LGb6uS088EE6SV0dojWRkjm8zJOSXn5VRXNTbdq7Gz2MZGx scbEa1qIjWomyIiepDWqIiIyYqiIiMn9BTvEJfbHZVsHnnifbpB23euz3ktrfOm3Zb/7djf+5bp+ Bt+7elv6O0W0YynGLpntJR2zjgbqVUOhmVuPJLZXduiMVVftSwtl9D8Lou3Tr0MaOrNjRzjNfGTZ Pj2GWCuynK7zSWq0WyFZ6usqpEjihjT1uVfz7IieKqqInVSAaTcUGguuV1q7FpbqPQXu40MazTUn YT003ZoqIr2snYxXtRVRFc1FRN03XqhRvlTq2rg4bbZboppI6O7ZfbaO4cq7ItP2c8npfm7SKNf5 UQ6rX2x2bBOOPhrqcHs9Ha56qG4WqojooWxI6iZGjGscjUTdrWSy7b+G35jamiJjPtbU0RMZ9vg2 yACNGAADsdAP7Udh/wAK/rMpYRj3EtZuLHFMepLBppwX+zvG6XtO5ZB7YtttffOZ7nyf2LMxZI+S Rz4/SX0uz5k6OQ7j3Q/HZ+Tq+t2z/ZlnA/stv+WPlC/h/Y0dkfJqoGVfdD8dn5Or63bP9mPdD8dn 5Or63bP9mWkzVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1 u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MD VQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6 H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVQMq+6H47Pyd X1u2f7Me6H47PydX1u2f7MDu79pdq5p1xRXrXLSi2Ut+xnNcUkgyix1V07qq3egZvQSwbtciOlav YLsnK3mke7dVRDsOHzji4fuI17bPiuUrZsqaqx1GMX1qUdyjkb0cxjHLyzbKi79m5ypt6SN8CHVv ELx7vo52W/yeMMFU6JyQSzar2iWNkmy8rnMRrVc1F2VWo5qqnTdPE8UuIe65dV64ZTc83w+LEczb cnrkFBRyIkUd2a7+yJouVVRiSSIsnove3meqtcrVaiB/pdIJrVrVgOgWA12ouot17pb6TaOCCNOe prql2/Z01PH4ySvVNkRPDqqqjUVU8qOArjV457pfqXT7H8KuetGP0zmRTpcZFint0fqVbo/0WJt4 JOr99tm7GqOHPbiR4mMszXiYXuGoemVc6nxnTOr602PUa8qtubFX0a2WRVb/AGQ1Fa3Zrk2RYuUJ 1ororn2tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxXRhuu+IZxrJqBof abdeIr7pvHbJbrUVEMTaSZK6Dt4uwc2RXuVGrs7mYzZfDmTqWQeX+perGtemnF5xZ0nD9pxdcmy+ 7WnGpY62mp2yQWWlp7Qx01U9HKiSTbPRIYeqvfv0dyqxwbtl4i8Jn1zj4fcctV8yPJKej7/e6i1Q QyUOPwr+59+mfKzs3yfvY2Ne9U2VWoiopAs144MXxTV3K9F7HoZrBm99wtKJ12lxSwU1dTRJVU7J 4V5lqWPRFa/b0mJ6TXIm6JuvZ8EeN6MWvQaz5Jozepsgp8p3ut6yCvXmuV0uj1/siStXdVSZr+Zq sVVRm2yKv4Tq+4ev+6F8Vn/kmG/qtALJ0s4ydJNTs2ZphWW/K8EzeaJ09Njea2WS011VGiKquhRy rHL0RV2a9XbIqoioiqny1s4wMU0U1OtGkMulmpWbZLerO6+U9LiFngr3JTNlfG5XNfPG/dFjVV2a qIip19RWvlTbbb7fwzpqvR9nS5bp7kNpu+N3BibT09UtZFG5rHJ15Va5XK3fZVjaq9WptDuIXU9d LPKJ6c5nU6fZnlTvavqoX2rE7Q653BHSVc27kha5FVjdvSdv06AXZivGLU5Tk9oxl3CXxEWZLtXQ UK3G64bDBRUfayIztqiRKlysiZzcz3Ii7NRV2XwO04leGr23vNeounV+9h+rWH7zY1ksLfHxVaOr REXtaWTdUc1UXl5lVEVFc1/AwrjFp80yy1Ym3hi4hLGt1qmUqXG9YFLSUFLzLt2k8yyKkcaet23Q 0IBRXDVxK+2950061FsPsP1aw/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXPvUyjx94lp9YsEp +IeTNvYDqRgq74pkNJHz1NbUO35bW+FOtVFMvM3s1ReXmc78HtEdeOhOW6g53pHjGW6p4T7Espud Aye42jtObsJF8F2XqzmTZ/Zu3czm5XKqtUCegAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2 c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m 1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAFUauf7v8B/Sv8AqIy1yqNXP93+A/pX/URlPH+x99P90K2L 9lPbHzh9AAQKYRvUfT7GdVcGvWneZUbqmzX6ldSVTGO5Xoi7K17Hep7XI1zV67OaikkBnYbGYJOD vOMntNm091W4j71l+nFknppWY6+xU1JPWx06osENXWscr52N5W7pytV226rzIipM9QeHW8XTU9+s +keqFTgGXV1vZarvJ5qiudDdKeNd4u2ppHM+EZsiJI16KjURPDfe7AZ05bacqY004cW4ZXZjmWW5 5XZhnec0iUNyv9XRx0zIqZjFZHBT00a8sUTd0VW8yq5URVUYZw5+xHhVqOGX2Y977fHLpYPPfm/s +XviTp2vd+1Xfk7f8HtOvL4pv0ucDSk0pUxk3Dn7I+FWHhl9mPd+yxygsHnvzfz792SJO17v2qfh dl+D2nTm8V268qs0A73q1pjql7LeT2ubJW2buPcN+/8AeIGxdp2nafBcvLvy8r999t08S3QNKWNK VYyaK9pxKxcQ/sl27PCvYf5n7n4/2atV3jt+0/PycnZ/n5vUcGn0B7vq/qLqt7LOb2f4/SWLuHcN u5djErO17TtPhN+bfl5W7fKpbgGlJpSzjV8HVPWcLmN8Oa6i1EFbilTBX27I4La1FZVxVL5mSLTO kcionaOby9p+ff1FoYpldtwqwUuMana047fcnoVkbcK+ZaW2Pmc6RzmItK2RUi5WOY3bdd+Xdeqk +IJftA9C8qu9TkGT6LYJd7pWv7Sprq/HKOoqJ3bIm75Hxq5y7IibqvgiDSz2s6We12sep+mk0jYo tQ8Ze96o1rW3anVXKvgiJz9VKjbw761YvXXam0p4pbrYMdulbPXx2y745T3uWhfM5XSNp6maRr0Z zKvK16PRv513VZ3Bw18OdLPHU02gOnEM0L0kjkjxWha5jkXdHIqRboqL13LHGeWwzy2KAXgy05do VS6Juvd87Wjuq5HT5IkzUuUV67RZO/NcicqO3creXbbkXbff0j72rQHWG55DYbjqrxO3vJLTjtbH cKe2WmyQ2Lvc8f4C1c0EjnzM6rvGnIx3rT1F8AacmnKkNRuHG93nU9+s+kOq1Zp5l9fb2Wq7zJao bnRXOnjX4NZqaVzU7RmyIkiORUaiJ8u/QLwb0s+k2pWGXXUmvuuY6rLHJkOXVtvYr5HxqnZNZSxv Y1kUbUcjY0f05167bImjgNOTTqhCb1pLjOW6Qu0ZzKNbnZqizQ2eqc1OydI2ONrUlb1XkejmNe3q vK5E8dio4OF7WWXHaTTm78WuSTYRRtipkpaOxU1Jd5KSNU5IHXNj1f4NaivbG1yonVeqmkgIqmGI qmFLa18PF21IyjAc+wPUypwnKdPFrI7dcH21l1ZLBVQtimjljme3ncrG7I9XKvpOVUVdlS4qCGqp 6Cmp66s73UxQsZNUdmkfbPRqI5/KnRu67rsnRNz7gxMzOomZmMnDuNms937PztaaOt7Lfs+8QNk5 N9t9uZF232T/ACIfKixvHbbUJV26wW6lnaioksNLGx6Ivj1RNzsQGEB100YxTX/TO7aYZis8VFck Y+Opp1RJqWeNyOjlZuipuip1Reiork9ZVekXB9dcN1Qtur+rOtd61NyHHba61Y8+uoGUcVugc1zX O5Wveskise9vOqpvzuVUVdlTSQMxVMRkzFUxGUAANWAAAdjoB/ajsP8AhX9ZlLCK90A/tR2H/Cv6 zKWEWcD+y2/5Y+UL+H9jR2R8gAFpMAAAAAAAAAAAAAAAAAAAAAAAA63Ja672zHrlcbBZXXi6U1JL JRW9szIVqp0aqxxdo9UaxHO2TmVdk33XwPMS48BemmkU8vExx+5jccwuGUZNA250GPxvZa6Gprp1 +Gq51VkrqdjndVb2aNTZqJJuiL6mkZ1L07xbVrAb9prmtD3uyZHQy0FZGmyPRr06PYqoqNkY7Z7H bei5rV9QHNxHD8SwTH6TGMHxy2WKzUbeWmorbTMggjT5UYxETdfFV8V8VKi4luGn23vNeounV+9h +rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXWvhGNWzA8UseAW+7VtdFYrbBQ08txqUmrJY IWJG18r9kV7tkTd23VTvwKJ4aeJb23/Omneolh9h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRF VUVrn9No3pJqFinGTxA6rX/H+64tm9PjUdhr+9wP746koEiqE7Nj1kj5X9PhGt38W7p1O54luGn2 3vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXOGniW9t/zpp3qJYfYfq1h+0O TYzM7bfwRKykVVXtaWTdFa5FXl5kRVVFa54Qml0U1S4duI52dcP+L+fdL9SatZM2xWKtp6XzJcF2 /wBlqNJ5GNVrv98iYu67Lsi/BpHFH2Hii0b4wdbNWsD4ZajULGtQ4rBFb6uHMLXa+TuVAyKRVZPI sn7or29Wt/A3TdFRTa4Axzd9JuJXi3zfFp+IrB7Npjphh90hvq4lTXqO73G+10O/YpU1EKJCyBqq qq1vVd1TZVVr2TfKNJNQrjx74ZrTR4/2mGWnT+sslZc+9wJ2Va+ple2Lslf2rt2uavMjFb18TR4A EE1q1qwHQLAa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqNatasB0CwGu1F1Fuvd LfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqlFaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnb K2pqGr0krnojVVVT0OnRHI1sQNFdFc+1sz6h4puKW1d0uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqq p6HTojka2LWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO 5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAA AAAAAAAACqNXP93+A/pX/URlrlUauf7v8B/Sv+ojKeP9j76f7oVsX7Ke2PnD6AAgUwAAAAAAAAAA AAAAAAAAAAAAAAAAAAAKb1r4u9AtAopoc8zqmfdo2qrbLbdqq4PXZdkWJq/B77Lssqsb+cti8Wmh vtrqrNcmSvpK2J0E7YpnwucxybKiPYqObunTdFRTzn4xeC/hhwyC22jTaz5NHqbmlX3TGsdtt3We OrmV3wlRUd5SV7IGJzOc5Ht6+tE5lbvRFNU5S3t001TlUgmr3lTtX9Rri3ENB8ZhxGnuE7aOmrJ+ Sruc7nu5W8u6dlCruZE2Rr1ReqPPU7HLbVWbHrXZ664z19TQ0UFNNVzvV8lQ9jEa6R7l6uc5UVVV eqqp4tcNHD9kFp47Mc0ezGja6rw/IH1terEVYnsoWuqY5E3RFWOVWRK3dE3bK3dOux7bEl6Kacop SX4ppyikABAgAAB2OgH9qOw/4V/WZSwivdAP7Udh/wAK/rMpYRZwP7Lb/lj5Qv4f2NHZHyAAWkwA AAAAAAAAAAAAAAAAAAAAAAAAAKD1N0Uzp3ExpzxCaVVVFFLTwzYxnFFWVT4o6+xyIskcjUa1eaWG VFc1u3pK5iKrWtcpfgKC4ctZM/yXPtTtEtZIaVuY4HeO80lXRUiwUtysVZvJQzxoqrs5rUdG9u67 KjUVzncygX6UTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormuvYAUT w08S3tv+dNO9RLD7D9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPvYoniW4afbe816i6dX 72H6tYfvNjWSwt238VWjq0RF7Wlk3VHNVF5eZVRFRXNc4aeJb23/ADpp3qJYfYfq1h+0OTYzM7bf wRKykVVXtaWTdFa5FXl5kRVVFa54XsQTWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleq bIieHVVVGoqo1q1qwHQLAa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqUVororn2 tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxA0V0Vz7WzPqHim4pbV3S4U m8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYtYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tse m3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29 N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAKy1bx7Lrlf8AFb7i2Ped/NHfu3i73FT7 dqyNrer1/M5eiL4ercs0EN+zF+jQmctmzqnPnz3I7tuLtOjKk+z1b+af+naYdnq380/9O0xdgK3I Z/Mq/p+1ByOOlPh5KT7PVv5p/wCnaYdnq380/wDTtMXYByGfzKv6ftORx0p8PJSfZ6t/NP8A07TD s9W/mn/p2mLsA5DP5lX9P2nI46U+HkpPs9W/mn/p2mHZ6t/NP/TtMXYByGfzKv6ftORx0p8PJSfZ 6t/NP/TtMOz1b+af+naYuwDkM/mVf0/acjjpT4eSk+z1b+af+naYdnq380/9O0xdgHIZ/Mq/p+05 HHSnw8lJ9nq380/9O0w7PVv5p/6dpi7AOQz+ZV/T9pyOOlPh5KT7PVv5p/6dph2erfzT/wBO0xdg HIZ/Mq/p+05HHSnw8lJ9nq380/8ATtMOz1b+af8Ap2mLsA5DP5lX9P2nI46U+HkpPs9W/mn/AKdp h2erfzT/ANO0xdgHIZ/Mq/p+05HHSnw8lJ9nq380/wDTtMOz1b+af+naYuwDkM/mVf0/acjjpT4e Sk+z1b+af+naYdnq380/9O0xdh0Wc5vi2m+IXbPM1vEFqsdjpX1ldVzO2bHG1P8AKrlXZrWp1c5U REVVRByGfzKv6ftORx0p8PJm/XHW7IOH/Bpc5zzTd0UL546K30cN6glqbjWydIqeGNiOc97l+RF2 RFVeiKQbh90O10t2SXfiC1g0uS56kZcxGsR94pmR2C2eMVvp2OVVZsn7ou+6u6L15ldJ9AMIzTia 1LouMLW+zTW2xW9j00sxCrbv5upH/wD1tUs8FqpkRrmfwW8qoq7RqmvzeMHMU6PGVdv4ftbRhYiM tKfDyZCi0Azan4jpOIum0oYy6VWMOx+pg89Uuz5EmY9tTv8Aw+zZ2S/3qN/OWj2erfzT/wBO0xdg NZwUz/zKv6ftazhInbVPh5KT7PVv5p/6dph2erfzT/07TF2AxyGfzKv6ftORx0p8PJSfZ6t/NP8A 07TDs9W/mn/p2mLsA5DP5lX9P2nI46U+HkhukGP3fFtOrTYr7Sd1rqXt+1i7Rr+Xmnkc30mqqL6L kXovrJkAW7VuLNum3TsiIjuWaKIt0xTHMAAkbAAAAAAAAAAAAAAAAAAAAAAAAAAAEK1j1PsWiOmu Q6s5BZLrcrdj1KlXWwWmnZNVuhRyNVyNc5iKjEcrnKrk5Wo5fUTU4t1tduvlrrLLeKKGsoLhTyUt VTTMR0c0MjVa9jmr0VqtVUVPkUD4Y7kFmy3H7ZlOO18VdarxSQ19DUxLuyaCViPjen5la5F/nOxI NpHpthWhOCWHSHEblWebbZHMy2Q3O4LUVTo+dZHta53VzWdpsiImzW8qdE2JyAKJ4luGn23vNeou nV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXXsAMRcH+KZHxdex3jX4hK2gukze8Q4 Ni1JG9LZYuwnfTzVixvVe0qnywPVHOVeRqNVF3RiR7dMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC KZFa9MqvO8RueUwY+/MKDv8A7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2z yW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAA+VTU01FTS1lZURwU8DHSyyyvRrI2NTdznOXoiIiKqqpiygpp/KF6ptv8A WPnThy09ue1upXNcxmcXmF2zp3ov4VDC5FRqL0eu+6Lu5I+drNll84yNUK/hR0ruFVSadY5O1NU8 ro38qTbLv5jpJE6LI/ZUlcm6NRFavg5r9a4ti2O4RjltxDErPTWqzWemZR0NFTM5Y4IWJs1rU/k9 a9VXdV3VQOzYxkTGxxsaxjERrWtTZERPBEQ/QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAULxLaG5lnuTacau6QVtuoNQNO77HLDJXzvhpq6z1CpHX0czmNcvK6PZyLyqqcrkam7ty+gU Bp7qtqZbeKbPtB9UI++WyuoYcswO501CkcSWz0Yaiime1Nu1jmTdFcqucjnLuiKxoF/gADKvkuPi J6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVM j+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i 5e05EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGYOKHWfP73ltDwn8N 9WxupGT0veL1e09KLD7M7ZH1kqp4TuR20TN0du5rk2VWbyrio4i5tF7FbMPwK2MyHVXOZltmHY+z 0llnXo6qnTf0aeFPTe5dkXbbdE5nN5fC9w40mgOK19Vfr2/JtQcuqPOuY5NUdZblXO3VWtVU3bBH urY2bIiJuuyK5UAl2iGjGF6A6bWnTLBaR0dBbmK6epl2Worqp3WWpnd+/ke7qq+pNmps1qIk8AAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB0+YZC3EMVvOWLZrhdvM9BPXOobdG19X UtiY56xxNc5qOeuyo1quTdV29Z3AAh2j2quKa3aZ49qrhVQ+Wz5FRtqoUk27SF26tkhkRFVEfG9r 2ORFVOZq7KpMSvdM9MNLuH+11OK4Y5lloslv1XdIaKquCqx1bUenJDSse7ZjdmKqRRpsiI5dvFSw gMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AxVpbxs8WOtOCWzUzTTgH8843ee27lW+2nbafteymfDJ8HNAyRu0kT2+k1N9t03RUVZX7ofjs/J1 fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/s wNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr 7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/ J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z /sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7of js/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1f W7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/sw NVAyrh/Fvrt7e2n2imtfCZ7XXti+dvNlz9nlHd/9oUbqmb4Gmh/4JvpPZ+6bpzcqoaqAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACj 9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/gvEZojo 1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAABW3EDrzhnDppxWahZgs1QrXtpLXa6VOarutfJukNLA3qrnvX17LytRzl6IS3O M2xbTfELtnea3iC1WOx0r6yuq53bNjjan+VXKuzWtTq5yoiIqqiGXNAcJzPib1LouMLW+zzW2w29 r00sxCrbv5upH/8A1tUsXotVMiNcz+C3lVFXaNUCU8LGhOW0t7uvE3xB00U+rubxIndd+eHF7V4w 2ymRd+VUTZZHIu6u3TdfSc/SwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AUlxaaC3XXbTemgwi601l1AxK502Q4deJ3OYyiuMD0VEe5rXL2b2czHJsqbq1yovKiFx2xbkttpF vLaZLh2Efe0pVcsKTcqc/Zq7Zys5t9t+u225yigLnqLqvgvGHbsGyVlVdtNNRrAvselpbejksl4o t3VEU8kbebs5onI9HyLtzcjW7I1ygRTyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAABlXiH+PZwjf4/fqeI1UZV4h/j2cI3+P36niNVAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMi temVXneI3PKYMffmFB3/ANir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le 2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAD5VNTTUVNLWVlRHBBAx0sssr0ayNjU3c5zl6IiIiqqqfUxrrNll84yNUK/hR0ruFVSad Y5OxNVMro38va7Lv5jpJE6LI/ZUlcm6NRFavg5rw4NDTTeUL1Tbfqx86cOWntz2t9K5qsZnF5hds s70X8KhhcioiL0eu+6Lu5I9rMYyJjY42NYxiI1rWpsiIngiIdZiuLY7hGN23EMSs9NarNZ6ZlHQ0 VMzljghYmzWtT/8AGvVV3Vd1U7UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAHznkfFBJLHA+ZzGK5sTFajnqifgpzKibr4dVRPlVD6ADInkpcgs154IsJtlsr4qiqsVXd6C 4xNX0qed1xqKhrHfnWKohf8AyPQ12Yd8ldi2m2mHB3jupVTcYLPX59X1KXWquFzWOCoqorjU0dLH GyRyRse5rWMRGIjnuVN+b0UTcQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6/IbnVWWw3G80Vnq 7tPQUstTHQUnL29UrGq7souZUasjtuVqOVEVypuqJ1QOwBVGhfFHobxG2xa3SvOqO4VkLOertM/9 j3Gj9S9rTP2eiIvTnRFYqp0cpa4GVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAADpsyy RMNxK85YthvF7Sz0M1d5ts9L3murOzYruxp4t07SV22zW7puqom4Hcg6rE7+mV4tZspSzXS0JeLf T3Dzddafu9bR9rG1/Y1EW69nMzm5Xs3Xlcipuux2oAERxDURMuynLMWTCMssy4nVw0i3G723u9Fd e0Yr+0oZeZe3jbtyuds3ZyohLgAAAAAAAAAAAAAAAAAI5ZtQ8OyHM8k0+s96bU5BiMdDLeqNIZGr SNrGPfTbvVqMcr2xPXZrlVERObbdN5GAAAAAAAABlXiH+PZwjf4/fqeI1UZV4h/j2cI3+P36niNV AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXp lV53iNzymDH35hQd/wDYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlYAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAKK4qOIubRexWzEMCtjMh1VzmZbZh2Ps9JZZ16Oqp039CnhT03uXZF223ROZ zQivFDrPn96y2g4T+G+rY3UnJ6bvF6vaelFiFmXZH1kqp4TuRdombo7dzXJsqs3uPQ/RjC9AdNrT plgtI5lDbmK+epl2Worqp/WWpnd+/ke7qq+pNmps1qIkR4XuHGk0BxWvqr9en5NqFl1R51zHJqjr Lca526q1iqm7YI+ZWxs2RNt12RXKhdQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAeR2iWSZ3qR5O+zcP1Nwn6g5TbpoLk+05XaJ6ZIYq5LpUzw1MKOcj94Zl5HJunN yPbuiONTaecVvFJZcFsFnz7gp1MvmR0Nvgprnc6eSkhjrahjEa+ZGK9eVXqnMqeG6rsiJ0SQ+S4+ Inpl+mv1xWkr1nzXV/TPiF0svtqbcr3phlbpsSv9pobd3h9tuMq9pSXLeNiyqxeVY3qq9nGxrnbb u3AinuwNdvxC9Vf+l0f7Q92Brt+IXqr/ANLo/wBo1UAMq+7A12/EL1V/6XR/tD3YGu34heqv/S6P 9o1UAMq+7A12/EL1V/6XR/tD3YGu34heqv8A0uj/AGjVQAyr7sDXb8QvVX/pdH+0Pdga7fiF6q/9 Lo/2jVQAyr7sDXb8QvVX/pdH+0Pdga7fiF6q/wDS6P8AaNVADKvuwNdvxC9Vf+l0f7Q92Brt+IXq r/0uj/aNVADKvuwNdvxC9Vf+l0f7Q92Brt+IXqr/ANLo/wBo1UAMq+7A12/EL1V/6XR/tD3YGu34 heqv/S6P9o1UAMq+7A12/EL1V/6XR/tD3YGu34heqv8A0uj/AGjVQAyr7sDXb8QvVX/pdH+0Pdga 7fiF6q/9Lo/2jVQAyr7sDXb8QvVX/pdH+0Pdga7fiF6q/wDS6P8AaNVADKvuwNdvxC9Vf+l0f7Q9 2Brt+IXqr/0uj/aNVADKvuwNdvxC9Vf+l0f7Q92Brt+IXqr/ANLo/wBo1UdXlN4qsexu6XyhslZe aqgpJaiC3UaIs9ZK1qqyFm/RHPds1FXZqb7qqIiqB/nl4s6+54lxSZLluL4bkmld2q6yO+NtM9Yy OutVXOxJHuZJTu+DR7nOlYicqtbIiImyIq604LfKc8TV2yS3aW5jpxddYo5OVjamz0yNvVNEioiy SOREhmY1Nt3S9mvVVfKWBpx5KbM9YdQLtrfxmZr2d0yS4SXWrxuwTo96PkdzJFNVru1jGpsxI4Ud sxGo2Vux6FaX6P6YaLY2zEtK8HtWNWtmyuioYOV8zkTZHyyLu+Z+3Tnkc535wKF8lx8RPTL9Nfri tNVGVfJcfET0y/TX64rTVQAAAAAAKq4rbzeMd4ZdVb/j91rLZc7dh92qqOto53Qz00zKWRzJI5GK jmOaqIqORUVFTdC1SneMZUThO1h3/uIvP9UkAzpX6naq5/YeE/h2xrUi+Y9WanYRS5Bl+U0s/Pd3 UlNa4ZXtinlRytmnk5+aZd3ovKu6orkXv8shzrhG160epLNrDneZYPqfe5MUvNpzC7uustLVyMRa WppaiRO0j9NV52bq1UTw6py9dbdG9SrvpPwpcReitvt13y7TXB7ZTz2CvrEpI71bKy0wRzQsnVFb FK3qrFcnLu5VX8FEWWVWnuvnEjrhptnGrellNplhelldNfYLbPf6a6XC8XRzEbA7el3ihiiVObq5 XL1Tbru0IJLqNqF3bjvX2eZGi4fQvfjqpdJ0WzuS0VEiLSel/Y687Wu+D5fSRF8TiVGC6r3LgVpO I+68R2ptPn1t09hyyikoL/JBb2thomzxRTUqbsqVfExvayTc73yPe7dEVGpLX8PurywcZrExH0tW KN8WIJ3+l/2SctrngRP3T4H4V7W/Dcnjv4bqWLLpTnzvJ/pok2w75p7UrcY82d6h/wC2aWlKfsO2 5+y/dfR5+fk9fNt1Ao3iD4ur/Bplw22a6amJprHrPZ6e+ZdllJEnbWyiZQ0888dN6Luzkmkn5GPR qqzZOnUjOO8S+m+mWveltp0M4tcq1Vx3Or9Fi+R47k91nuktK+pVGU1dTTzxtfFyyqiPYiq1UcnR PFLUv3DVrHR6VcNOfYHbLY3VPQmyUdJU2C41rI4LhDLboaa4UXeY+djZPg1ayTdzOrl36opaOGZt xcZ3qDZEv+ilj0wwugSWW+Put+p7zcLkqsVI4aVtG5GQojtlWSRy7p+96bKFKab2DUzXDiv1+w++ a36gWTC8GyC01NHb7LfJaeSSeal5mwJI7m7KlakUjnwx8qSOlart+XZdymeOHrSnPsG4heIbOcps PcrJnN6s9XYKrvUMnfIoKR8cruRj3Pj5XORNpGtVfVuhocCvuIK56l2XRLNrro5QLWZrS2WplskL Ykle6pRnRWRruj3om6tYqKjnI1Nl32MU6O5FhGoNJj0Wn3H5qVYtZo5KN9ysOfXOR9LNW7tWqonW mpbEx6L8I1jad+7fRVHLtubt1RpdRa3T6+U+kl1tVuzB1Kq2eousDpqRs6Kio2VrevK5EVu6b8vN zbO22XIOv+D8TfFdp8mleVcIGNYjfKuWlb7Oq7LaCths6xzMfJUUjIWrV7uRrmoz0ej1Ryr13Dhc TXElYZ+K1+g2ovEFd9IdPsWx2C6XGrsdTJSXG93SoVHR07aqNjpIYWRORy8myqvMir1arfpwvcSm O0vEzc9D8K4g7tq5p3dMVlyG2XK91D6u5Wevp5Np6R9Q9jHzRui+ERXbqmzUT98rrHz3SHWvSriJ g4ktFMZpNQmXvF4MXyzHau6xW2tqX07mrBX088qdkr9mo1zHq3oi7b827LI0kvfEnmuVXq86wae4 9gmHOoGUlsx1Liy6XWWp51WSonqYVSBkasXlSJqPXfrzJt6QZ30EwzVrjI0kqOJK98R2pOG3fK62 5vxS0Y5d0o7TZ6anqZaenZNTNYqVS88Lle6RVVzV2TZep9eI+7cTOPO4YMGuWqTbRnWSZDU2HJLn jk8zKGrR8CRrVLA5rGTOYx3bNZJH2aSp0bynM0qw/jB4TMGumgOmWidn1Fx2ir66XDcmdlNNb2UF NVSvlayuppk7R7o5JHud2W6O32TbxJBmmhfELe7pww3DL7tFnd+wLJJ7rm1+i7pRRxpJEvpRxJ2X Oxiqkbezj51axHOaiqoEM4qtRajhjotJ+Hml4gMtx+1Z3drjV5Jn9/uC3G8UVtp0Y+SKKd0a8j5X SpHG5GL2eyIibEMx3iX030y170ttOhnFrlWquO51fosXyPHcnus90lpX1KoymrqaeeNr4uWVUR7E VWqjk6J4ppfio0V1Ey/K9M9dNGI7ZWZxpRcqupprTcaju0F3oKyJIqul7bZUikVjURjnJypzO3Od hmbcXGd6g2RL/opY9MMLoEllvj7rfqe83C5KrFSOGlbRuRkKI7ZVkkcu6fvemyhRPCvpFR0/HHxF 1ztQdQKh2IXLG3wsqMnqpI7ilRbp1Vte1XbVbY/CJsm6RoiI3ZDeBlbBcA1w0p4zNU8xt+l8OQ4D q5LYah2QRX2mp32VaKkfDI2Wlk+FmVXPVU7NNtkb16qjdUgAAAAAAAAZV4h/j2cI3+P36niNVGVe If49nCN/j9+p4jVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq82 6t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylygAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFbcQOvOGcOunFZqFmCzVCte2ktdrpU5qq618m6Q0sD eque9fXsvK1HOXohWXCxoTltLe7rxN8QdNFPq5m8SJ3Xfnhxe1eMNspkXflVEVFkci7q7dN19Jz7 5yLBcNy25WO8ZPi9suldjVYtxs9RV0zZJKGp5FZ2sSqm7XbL4p60avi1FTvQAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a /XFaaqAq3RfX2xaxXzPcTjsVfj+RaeX6Sy3W03BzFnSNU5qerTkVWrFM1HOYqKv4K+rZVtIr+5Yd pBpxmGS8Q97S249da6009vvt9rK5aenWjgcqxrLzuSJFRXNbzqnNsjG77IiE9hmiqImTwSskikaj 2PY5Fa5qpuioqeKKgH7AAAAAAAAAAAAAAAAAAAAAAAAAAAA49bcKC2QrU3Gup6WFPGSeVsbU/nVd hsZiJmcocgEDvOvGjVhVyXHUmw8zfwmU9W2ocn8rYuZSLzcV+lUiqmPxZHkC+rzZZpn838naIwhq xFqnbVHeu2+C8bejOi1VMb8py79i5AUbLxI5FWf7ndC8rqN/wfOMsNB/l5ldscSXWLXyv/7X6V47 at/Dv96Wo2/l7JE3NJxdrmme6VqngLGz60RHbVT8s8/BEvJcfET0y/TX64rTVRlXyXHxE9Mv01+u K01UWXHAAAAAArPX3Qax8Q2HMwTJ80zCw2eSVXV8OO3FlJ5yhVqo6mqVdG/nhXfdWpsq7eJZgA67 G8etGJY7a8Ux+jbSWuy0UFvoadqqqQ08LEjjYir1VEa1E6/IdiAAAAAAAfGsp3VdJPSNqZqdZo3R pNCqJJGqptzNVUVEcm+6bovUoL3JeQfjicQX/wB/rZ//AA80GAKj050Au+n+UQ5LWcRWrmXxwxSR ra8jutDPRSK5u3M5kNJE9XN8U2enXxRS3AAAAAAAAAAAAAAAAAAAAAyrxD/Hs4Rv8fv1PEaqMq8Q /wAezhG/x+/U8RqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/8AsVfWuiSvZzwo2s7mjl513i5e05EX 0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAA AAAAAAAAAAAAAAAAAAARLMNV8BwLJcUw/K7/ANyvGb1slvsNKlLNM6snjYj3t3jY5saNaqKrnq1v XxJaYb4kr/nmQ+UI0ixHTLGKLIL7g+G3fIKeK41ToLdQy16uo1qat7GuekbGxNXlY1Xuc6NqcvNz NDcgMwaa8RmsGP8AEFduHniXtGEUta3E3Znab/iz6qOhfQxzLFNHPHUuc9j2q17ubmRNmL09JDr8 S1y4ttfrDU6pcPuEab2jApZZ2Y+3M5K5bnf4onuZ3hradWspI5HNcjOfnXpuqbKigavBlGHjytdb wzYvrPbNPqyrzLML0mI2nDWVbUkmv/bPhdT9vy7JEixuf2it/BVqKiOXY7i0ak8aGF57h1u1g0sw fIcXy6vS2VVVgTbjLU45K5u7Jqzt0Vj6dFTldIiMRvVf4KPDSwKF1GzbivrtRrniekOCYJYMas9N TyLlOcVU8kN1nlaqrFSU9I9r2pHtyudK5Ovg1U2VYpp/xgZBetAdZc+zfGbNbcu0XqrzaLpFb6mS otdfW0UHPG+BzuWTs5Hq1vI5eZPlTfoGpQUfbdcMstXBvHxFZ3b7TT5CzA3ZbUUdNFLHSJUOo1qI oEY+Rz0RVWNior991XqnqrK48WOsrsa0BxC0YzhUGpet1lfeXVV5lqaSx21jKaOodGkbXvnllc2V jWxpJvzJ1Xqmwa9BSOneZcTVizG5WLiCw/CH4xBaH3WHMsVqpaejp3xu9OmqaWrkdM13IjnpIxXM RGpv1VeWvsS1y4ttfrDU6pcPuEab2jApZZ2Y+3M5K5bnf4onuZ3hradWspI5HNcjOfnXpuqbKiga vBVfDLrrR8Rujln1RgsUtkqquSoo7jbJJe0WjraeV0U0aPRE528zd2rsm7XJuiLuhagAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET 0y/TX64rTVQEf1BwXG9TsHvunmX0XerNkVBNbq2JFRHLFI1WqrVVF5XpvzNd6nIi+oiXDdp3nmku jOOaa6iZdSZNc8chdb4blTxPj7SijeqUzX8y7q9sPIxV6b8vrXdy2aUBxW5HrNpzUafasaYNvN7s WP5DHSZhitsoe9TXO11nLAs8bGMWV8sD1a5rGLsvOqu6NAv8H5Y5Hsa9qKiORFTdFRf50Xqh+gAA AAAAAAAAAAAAD8TTRU8Tp55WRxsRXOe9yI1qfKqr4Fb5NxGaPYvMtFNmEFzrt+VtJaWOrZXO/g/B IrUX8yqhpXcptxnVOSexhr2Kq0bNE1T1RMrLBQ9XxAaiX/dmA6O1dPC78GtyOqbSInyKsDd3qn8j jpaqLXfKd/ZNqvDZYHfhUmOUKRbfyTybyIQVYuj92Jn/ADrdS3wDiJ13qqaO2c57qc/HJoi43S22 imdW3a401FTt/ClqJmxsT+VzlRCub7xL6LWKVaVM0gulVvsyC1RPrHPX5EdGis/94q+HRLBpKlLh kEdyyOtT/wCk3mvlqXr8u6KqNX/ITC12Oy2SLsLNaKKgj225KaBkSf5GohDOJuzsiI8fJet8DYO3 7Suqrsypj/2nwh+KniRyG6bpg+imSVqL0bNd5YrbGv8AfJzcyqn+Tc6uozbiSv2/ZzYbi8DvDsoZ a2pb/Lzr2a/5CSAjmu5Vtqn5LlGHwlr2dmn351fOcvBCajDdQ75uuW645XVI78OO2LHbWO/NyxIv T8xxodC9N+273c7TU3ap9c9xrpp3L/Kiu2/9hPwRzRTO3X26/mtU4i5RGVudGP4Yin5ZOltuE4dZ 9vNWK2ikVvg6Kjja7/Kibqd0iIibImyIAbRERsRVV1VznVOYADLVXHkuPiJ6Zfpr9cVpqo85+FzU PjJ4a9CcZ0U9xH7I/Y533/ZP2ybVR9v3isnqf3Hlk5eXt+X8Nd+Xfpvslq+634yfyff1r2r7E6XG Ub4eO5Lf6E90thgx57rfjJ/J9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GDHnut+Mn8n39a9q +xHut+Mn8n39a9q+xHGUb4OS3+hPdLYYMee634yfyff1r2r7Ee634yfyff1r2r7EcZRvg5Lf6E90 thgx57rfjJ/J9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GDHnut+Mn8n39a9q+xHut+Mn8n39 a9q+xHGUb4OS3+hPdLYYMee634yfyff1r2r7Ee634yfyff1r2r7EcZRvg5Lf6E90thgx57rfjJ/J 9/WvavsR7rfjJ/J9/WvavsRxlG+Dkt/oT3S2GDHnut+Mn8n39a9q+xHut+Mn8n39a9q+xHGUb4OS 3+hPdLYYMee634yfyff1r2r7Ee634yfyff1r2r7EcZRvg5Lf6E90thgx57rfjJ/J9/WvavsR7rfj J/J9/WvavsRxlG+Dkt/oT3S2GDHnut+Mn8n39a9q+xHut+Mn8n39a9q+xHGUb4OS3+hPdLYYMee6 34yfyff1r2r7Ee634yfyff1r2r7EcZRvg5Lf6E90thgxxU8X/GNSwunl8nzI5rE3VI9UrZI7+ZrY FVf5kIlL5RTiHprk20XHgZfbap/g246lUVGn87pqVrU/nUxN63TtqjvSUYDFXPUtVT2Uz5N6AyTa uKHjUvtI2vsfk/6O40r/AMGek1ksk0a/yObGqHM90Px2fk6vrds/2ZJE564VZpmmcp2tVAyr7ofj s/J1fW7Z/sx7ofjs/J1fW7Z/swwcQ/x7OEb/AB+/U8RqoxVQ0PFjrTxY6Iamal8LHta43pr7Je+1 vs4tt57XzhbVhj+Dh5JG7SRMb6LX79puvKjVVdqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/AGS+ caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylykUyK16ZVed4jc8pgx9+YUHf/Yq+tdEleznhRtZ3NHL zrvFy9pyIvo7c3QlYAAAAAAAAAAAAAAAAAAAAAAAAA8/MP4g8HwHjp141R1RlqrTh6NoMHtuSOo5 Z6KlrKCGJ9TRyyRNcsTnvkc9vMiNXs3Jvumx6BgDAHsXy3i7z3XjX/A7TcIMeqtLK3TPT2qr6d9G 69SzMklnqomSo1zYu2csbZHIm6SepWuRtW6ZQeT9tOjuO2HKdP8AUKt1dttoprfdMGo7lk8N2qbz HEjJY46eOdsMbXytc5FTlja13gipynqiAMDa5aZ4hw41PDNqLjGmd4x3S3AMhuVyyi2sdPdZ7LNc aeNWVFQqPme9IpUk53tc9EXZGqu7UW+9OOLG1a56lpi+hmK1mT4bQ2qequ+azsnoaCnrend6OBJY kWpkd1V/KrUY1UXdV3aX8APMLhupuHXNMcucnFPhVy1G4ka29V8N2xq92+qq7gyZJ3JT09NE9Owp 6ZI+Re19GJiK7mejGJtD9P6Kor/JW6y47p3ZXpl1TlE1wybH6CjkSe0xvuNO18KRq1F2bS0u+yfg s5t9lRT1tAHnnxk8Sum2pPCnT6P8OdxqMhiy2ssuKur6ajmjpbTBJPGjIpZJGtb270j7NIE3fy9o 5URG7lucQ+b8JVvq6bh74pcAqbfi1qtdJPj1/u9ulW21DkYsbo6Sspt5KeaNrWo7dY3Lv03TlV2s AB566P2bOc/w/iN0z0JynM8n0fuOGzW3BK/KXzqq3eeklZLTUNRUtbK+mRXI3md6LV5VRV3Vzq40 yg8n7adHcdsOU6f6hVurtttFNb7pg1Hcsnhu1TeY4kZLHHTxzthja+VrnIqcsbWu8EVOU9UQBAtD tMMG0i00tOIaeYTUYlaVYtetnqa2Srnpaide0lZJK+WVXvR7lRVSRzd09FdtiegAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9 NfritNVAAABVGEa/2zKtdM70Bu+OVVhyDD6ekudCtTM17b3bJ2pvWU6IibMZIqRuTddnKib78yNt ch2QYHpnBmdLrhktst1LfsYtFVRMvtTOsKUduf8ACTJI5XIxGJyq7mf+CivVFRFdv2tLnGHV2GM1 Eo8mt02MSW/zq27MqGrSrR8nadt2m+3Jydd/kA7wHQ4Fm2P6lYTYtQcUqX1FmyO3wXOhkkjVj3Qz MR7OZq9Wu2XqnqXdDvgAAAA/iqiIqquyJ4qVpl/ETpfiVS61RXiS/wB3TdG2yyRLWTud8noeg1fz Oci/mNK7lNuM6pyT2MNexVWhZpmqeqFmHHr7jb7VSyV90rqejpok3kmqJWxsYnyq5yoiFBV+p2u+ a7sxuw2vBLe/8GquKpW16p8rYk+DYv8AevRf5TpE0htd4q23TUK/3nMa5q8zXXSqcsEa/wDg4Wqj Wp+bqnUrVYuP+XGfbq/XwdmzwDMa8Tcinqj8U/b4+5YV94n9NqOpfa8TS55jcm9O72OldOxF+V0q 7M5fzoqkXrdRuIPL1VtotFhwSif4SVTvONciepUam0SfLs5Nzu6C3W+1UzaK10FPR07PwYqeJsbG /wAjWoiIcggquXa9tWXZq/V07WDweH9nb0p31a/DVT3xKAz6SwZFK2q1HzDIMulRUd2VbWOipWr/ AHsMaojevq32JZZcZx7G4e72CyUNvZtsqU8DWK7+VUTdf5zsgRxTETmtVX7ldOjM6t2yO6NQADZE AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwraChuVO6kuNFBVQP8Awop40exf 5UVNj7gwzEzGuEDqdGMOjrFumMPuWLXFfCqslY+lcnyeiiqzb8yIh2VFfOIXDdkt2U2fNKFn/wBH vFN3aqRvyNmi6Od+d5KgYinR106uxJXd46NG/EVx/FGfjtj3S4tu4obNbnMptUMKv2HSqqNWpkh7 5Q83yJPEnX/0f5y1cbzDFcxo0uGK5Db7rBt1fSVDZOX8zkRd2r+ZdlKzexkjHRyNRzXIqOaqboqL 6lIVdtHsJuFZ52tlHUWC6N3VlfZZ3UczF+VOT0d/zqm5NTiLtO3X4T/nuc67wVgr2ujO3PV+KO6d fjLTIM40F+1/wbZLfkFtzq3M8KW7MSlrUb8jZ2ei5f75+/iSuxcT2EyVLLVn9rumEXJ68qMusKrT SL/eVDUVip/fO5U6FinFW6tVWrt89jl3+A8VbjStRFcfw657tVXhkuMHHoLhQXWkjr7ZXU9ZSzJz RzQStkjenyo5qqinILLkTExOUgADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1 Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08N lLlAAAAAAAAAAAAAAAAAAAAAAAAAyLqzxeaj4HV8SVdZ7Fjk9l0Zt1igsklRS1D5K68XCJj1jmVs yI+NjpYm8rEY7d6ekaJqtRLDgWGWa9a05li2K1tTRwJXTV1wioKRazs2rM2JZ5PwUertkVzlRNt1 XxJS+30EjZWSUNO5s7kfKjomqkjk22V3TqqbJ1X5EMTXbILNxFa+ZHnmk3CrbtUZdP3zYVPkmZZM yjs0NVE9HzRUNG+CoRz2q5OadGMVUd4qjk3DZmNZVi+aWiLIMOyS1321zqqRVtsrI6qnkVPFGyRq rV2/Mp1HtuaULl/tepqdifsp5+z8x+eqbzhzePL3fn7Tf83KedGnGpOU6P6f8bWsVixiz4OlsuVB Y7dZMfqu3ttqvkcTqOomp3dnG1XdtUQyOVI2+kmyoqIhdOS8OGimjfABeq+8YfZ0yW14RJfp8lfT M86OyJabto6tlWqdqkve3M5F5unot8OgFm8GmsuYaraW5nq5qVlcE1lqc1vi4/NNDT0sFBYYJUjh jV7GsRyNVku8kiucvrcuxweKzipsOL8MGcaiaAaoY3fcktrqK226osldR3Tu9bU1cULUcxFkj5ka 6RyNeiovKvQzVZMF864BwX8G1zSRmNZdb6nN8voUcrG1kMMC3FlJLt1dG+aaRHt+VrV8URUnfGXo fpQ3XDhqw7B8MsmPXPIMya2vp7NRR0ba6zUKw1U0czIkakjWLGxW8yLyqrttt1A3Nj9PdaSw22lv tf365Q0kMdZVcjWdvOjESSTlaiNTmduuyIiJv0RDr8w1AwPTygZdc/zawYzRSuVjKm8XKGiic5E3 2R8rmoq7ercqi9cV8Vn1Lk00Zw467XB0d0jtaX2iwp77M9XPazt0qlkROwRXbrJtsjUVfAqLhqw/ GeJTXPW7XjVix0GUOxfNKvT7FKG6wNqqe0UVvaztJIYZEVrHzOla9ztubfmRFRHLuGvsayvF8zs8 WQ4fklqvtqn37KuttZHVU8m3jyyRqrV2/MpF59f9B6W1Wu+1WtmBQ22+c/muskySjbBXckjo39hI snLLyva5i8qrs5qovVFQxZS320aEa0cZ9RpnSU9mxDGcJoLnJbqFiRUVPkEtA9Y+yY30I3PVV5ka iel4/goid3hmgulWi/k0Lrfctwu03S9V+m9TeLhWXKlZNU96qaR8sFO2R6K6NsUkzGMaxURrkVye k5XKF78cOsWV6NcM+Q5xppdWU2VVM1vt2P1DYYqhFqamqijRWska6N/wbpFTdqp0Lcw7KLDeoKiw 0WbWnIb1jnZUF97lVQyS09YjE5knjiX4F7lRXcitb49ERDB18st2uGkXApoDep5aisvt5s+SV0Ui qrnUdsoUqpIHf3rWTsav/iJ8hPrbnuNcNXGTxH3fMKvuWPXzBrNqMrem6to0dRTJGi+L5JnIiJ++ e5qfIBePEjxEY7otphn17smR43WZrieOyXqCwVVYx86I5zYoJZqZkjZuwdNJG1XJyou+yORVQ6LT 7WvVfIuIe36NZBZsehorXphbsoymopqWds0N+qp1j7rCrpnNZByskejXo9/o7c6nU8GWld+ZjGQ6 /avWxi6gazVbL7c6adnP5stqJ/sfbmo5N0bFDyqqKiLzO2durEU0m2np2TPqWQRtmkRGvkRqI5yJ 4Iq+K7bqB9AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABiryQ3xN rb/ygun+sabVMVeSG+Jtbf8AlBdP9Y02qAAAGXeIvj50Q4esmn061hwfPGd+p3oyVtijloLhA5OV 3ZSOlRsrdl2cieHNs5EXdE8qtXuL6Kl0CqOFjRHKb3U6f1N/rbhFLc6FKWtpbQ+VJYLSrklf2jGy q+R7/RVfRb+DzIe4urOj+m+uOG1eBapYpRX6z1fXsp27SQSbKiSwyJs+KRN12exUXqqb7KqL4xcZ 3kyNSeHZa7PdNe+Znp5GrpZJmRo64WmPx2qY2p6caJ/vzE5eiq9sfTcPWTgo+KPpD/yPtn+oaXWZ U4QtWsE074L9JZ8zyaCnqH47EkNKjllqpkR7mtRkTd3qngiLtsnTqhJ7pq5q/qBzQYBjkeGWmTol 2vcaS1r2/wAKOmTdrF8Pw90X5SC5iKLc5TOc7odHCcFYnFxp0xlT0p1R7t/uiZXdkmV41h9uddsp vtFaqRv++1UzY0cvyN36uX8ybqVBdOJG5ZG91Jo3glZfGKqtS83NHUdvb/fN5tpJU8Oicq9SNW7S aw+cUv8Al9ZW5bevFa28yrPyr8jI19BiJ02TZdtuik2a1rGoxjUa1qbIiJsiIVa8Rcr2ao8XcscF 4PD6687lXXqp7o1z75jsQa4YVm+e8z9WdQq2400nVbNaVWioET+C7l9OVPHq5UXqSawYtjmLUvc8 dstJb4ttlSCJGud+dzvFy/nVVO0BDoxnnzr83app0I1U7o1R3RqAAbIwAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+FbQUNzpn0VyooKunkTZ8U8aSMcn52r0 U+4MMxMxrhAk0oix+rkuumGUXXDa6RedzaKVZKSV3/hKd+7HJ0Tp0T8xILdrZqthStg1IwePIrcz 8K7451ma3+FJSu6qu3VVaqIm3rO9Apzt+pOXy7mbvF4qMsTRFfXO34o19+cdSa4Nqxp7qPFzYjk9 JWTtTeSkcqxVMXy80T9npt1Tfbbp0VSXGc8n0zw7LJkrrha0guLFR0dxo3rBVRuTwckjdlVU/vt0 PxbMj1003VEpblDqFZY//o1xekFzjb8jZ/wZF8er91XwRCxRi5jVcj3x5f8A1yb/AAHRc14Sv/tq 1d1WyffotHgrXB+IDTzNKxtjmrJ8fv26NfaLzH3ao5vkYrvRk9e3Kqrsm+yFlFuium5GdM5uFiMN ewtehepmmesABugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAARTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOj eXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAA AAAAAAAzPiXCLnOmeRZbT6UcRN0xfBczvtRkFdYY8fpqitpKmo27x3OvkcvYtcjUROaF6sREVF5t 3LpgAZTw7gHsGN6c6t6KXTUOsumnmp9zqbxT2zzc2Ots9VK6NySd8dI91SrFggVvOxOse7ubdTos 84E9X9VdF6nRXUjjAvF4tUNPSU9p7PFKeljiSnljcx1Y2OZJK1yRxqxvNKxqOckjmvc1u2nLtqtg Nj1IsWkdzv3ZZbktHU3C2W5tLM9ZqenTeWR0jWLHGiernc3mXo3dSWgUHrdwq+2NeNPc4011GrNO 800yZNS2K7wW2K4Q9zliSKWnmppHNbI1WN2T0k25neO/TpMZ4Pchg4hMP4jtRtcrlm2R4tbK6gWK qs8VJA51RG6Nq00cMiR00bGSSejySPe57nOkX0UTS4AGbKzhQz/EtQcuzXh64g6rTuiz2vdeL/Za nGqa80rrk5NpKum7V7Fge/xci87Vd4psjWt0mAMwZHwMWGv4cMz0Jx7US50l41EuMV2yjMrnSNr7 hc6pKmOaV72NfE1EckXZtaio1jXL0cquV1i8Rugvt7aB3nQiz5X7EqS7w0VJ35lD3tYaaCeKRY2x 9pHvzNiRm/N0Ry9F8C2gBSuT6D2RmuWE8QF1zOmtlh0vxi4WqitM9K1kNOs7OWWrdVOlRI2tgajF arPBN1cngZ1z/CdP+NzjTxyvw2vbfME0us6QZrdqKZJbZeKjvTKqjtDZG7snRksbZpURXMRE5V2d sbnvNls+RWqrsOQWmjudsr4XU9XRVkDJ4KiJybOZJG9Fa9qp0VFRUUhOC5TovYMyufD/AKdU9qs9 4xighutZYbVaHUlNR09Qvwb92RtgRXr15Wu5vWqbdQLDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAYq8kN8Ta2/8oLp/rGm1TFXkhvibW3/lBdP9Y02qABF871Mw jTa3pcMvvsFH2ifAU6enUVC+pI4m7ud16b7bJ61Qpu7ajaw6o7w4xSP0/wAck/8AplUxJLrUs6dW M/Bg3TfxVXJ0VFUguYii3q2zuh0sHwViMZGnEaNHSnVHu5590StnUDV/AdNImtya9sStlROwt1M3 tqydV8EbE3r1+Vdk/OVNds81p1NR0Fpp26e2CXosszUnus7P/F/Bh36/3yfKp+sU04xbEJH11BSS VVzn3WoudbIs9XM5fFXSO6pv60bsi/IScp13blzbOUbo83fw+BwmD10U6dW+rZ7qdnfn7kKwPR7A dOoY0x+yRLUsT/bc6JJNuviqLtszf5GoiE1ANIiKdULVddVyc6pzAAZaAAAAEN1a1awrRXCqzOs6 uXdqGm2jhhjTnqKyod+BTwM8XyOVNkRPzqqoiKqIjPVDFVUUxpVbDVrVrCtFcKrM6zq5d2oabaOG GNOeorKh34FPAzxfI5U2RE/OqqiIqpEdBuIq36wS3LFskxS5YNnti5ZLpit3RWVcNO/Z0U7OZrVk jc1zN1RE5VXZU2Vqu/fD3w95rqlmtBxP8T9p7tdKb4XCMIlXnp8ap3bK2pqGr0fXOREVVVPg+nRH I1sVi8UHC/T6109uzvBL0mJarYkiy43kkTfHxVaOqRE+FppN1RWqi8vMqoiormutxhvw69rh18LT F78Mfg+fW7gFQaFa61GodRdNO9RLCuJao4kqQ5Dj0y/yIlXSqq/C00m6K1yKu3MiKqorXOt8q1Uz TOUu1buU3aYronOJAAYbgAAAAAAAAAAAADLmlvEtxY604JbNTNNOB7zzjd57buVb7Zdtp+17KZ8M nwc0TJG7SRPb6TU323TdFRVlXticdn4gX1q2f9kmXkuPiJ6Zfpr9cVpqo6HEW9zyvpLFdLwjyYj9 sTjs/EC+tWz/ALI9sTjs/EC+tWz/ALJtwDiLe49JYrpeEeTEfticdn4gX1q2f9ke2Jx2fiBfWrZ/ 2TbgHEW9x6SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2Jx2fiBfW rZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61bP+ybcA4i3uPSW K6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvceksV0vCPJiP2xOOz8QL61bP+yPbE47Px AvrVs/7JtwDiLe49JYrpeEeTEfticdn4gX1q2f8AZHticdn4gX1q2f8AZNuAcRb3HpLFdLwjyYj9 sTjs/EC+tWz/ALI9sTjs/EC+tWz/ALJtwDiLe49JYrpeEeTEfticdn4gX1q2f9ke2Jx2fiBfWrZ/ 2TbgHEW9x6SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2Jx2fiBfW rZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61bP+ybcA4i3uPSW K6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvceksV0vCPJiP2xOOz8QL61bP+yPbE47Px AvrVs/7JtwDiLe49JYrpeEeTC9n4hddrTrLgekmtfC97X/tgedPNlw9m1Hdd+40q1E3wVNGvyxN9 Jzf3TdOblVDQpT/Fv8cnhR/x6/VUBcBVv0RRVlS7XBt+5iLU1XJznP6QAAhdAAAHTZPhuMZlR9xy Wy01dGiKjXSN2fH+dj02c1f5FQ6S1Rau6X7LgeTeyezR/wD1Hfpd5GN/gwVPi38yO9FET1k0Brll OlGqUnGZ0cXXEVU7p1x+nbGUuxwjiGwnKa9uO35lTieRdEW2XhOyV6/+ClX0JEX1bbKvyFpFD5Hi uO5dQLbcktFPX0678qSt9Jir62uT0mr+dFRSPWpNW9KNnYJe1yqwx9VsN6m+Gib19GnqfFPkRrui J8qlijFVU6rkZxvjy8u5ysRwLZvfiwtWjPRqnV7qub/u+JpkFc6e674Rn1V5jfJPYsij9GWzXVvY 1CO/8Hv6MqfJyrvt1VEOXrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUV Uu0V03IzpnN57EYa7ha+LvUzTPX/AJ4mtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U 2RE8OqqqNRVSC8NXFVZde/OmLZDidywLUTH9pLtiF43bVw0z9nQ1MfM1qyROY5m6o1OVy7KmytV0 E0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYp3xK8NXtvea9RdO r97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5r9kK9QUVw1cSvtvedNOtRbD7D9WsP2hyX GpnePgiVlIqqva0sm6K1yKvLzIiqqK1z71AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVH cyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAA AAAAAAAAAAAAAAAAAAAzZdOKO/2bXPWvFp7BQVmF6L4JT5FcH0sEi3Oe4SwOqkgR6ydnyLTxu2b2 e/N1V23Qi2Haz8cWf6XWfXfCcI0av9hvdJDdaTE6K4VyXaSlk2XsO/PclMlS1q7Oa6NGtc1yL1TY iPD3qPBits4l+KK4YTfssoL7qdPZ1pbLSNqqmSz29GUzKjslcivjYyWRXNbzLs13TbdUrPOLxw7U uR2LIfJzZNfqXVO65BROmxvFoa9llq6V0qd5dc6OViU9PC2PdV6Rq1URduiuaHpdbqmorLfS1dXQ S0M88LJJaWVzHPgerUVY3KxVaqtVdlVqqm6dFVOpS2B65ZZm/FdqdotT2+0JimnNltEk1WyKXvr7 nXM7ZGOk7Ts+zSJHeikaO5k/C9ReJhHQDWXAtFde+I+3ax11faM1yXPH1dotqWupqKq8WiOPkoFp GRRuWdVa5yI1m6pzIBbdbxS5Ba9bNdMZqLDQVeFaJYXS36tfSQyLcqivlpn1fYo9ZOz5VgjciN7N F5uqu26EWw7Wfjiz/S6z674ThGjV/sN7pIbrSYnRXCuS7SUsmy9h357kpkqWtXZzXRo1rmuReqbE C4VdUK2w6fcQHFblmmeRXh+VakVFLV2a008dbWU1rpEjgar2I7aVsDZZUfyc26RuVE5d1SBZxeOH alyOxZD5ObJr9S6p3XIKJ02N4tDXsstXSulTvLrnRysSnp4Wx7qvSNWqiLt0VzQ1pqtxDZ/T6hY7 oJohg9tuWpV7s3shuaZBVOZbcatvMjO1rHU6udK9ZV7NscS9V9LmRuyrwdOteNZrDr9RcOnETj2H +dcjsc99xy/Yk+pZRVTYHbT00sFSrpI5Wpu/mR6tVNvWvTPOuGF6FYvxsZ7mfGBa73SYdmNis64f kEFbdaWhhmpoUiqqSWW3yNVJHOakiNk6Iib9Fcm9m8OGlvDbk97yjVDh50gy611dioZ7VjOZ327X V1NdH1EDklWjirqhz+zY7lasixIiqvoquygd1jHEDxL8QN6yi/cNWLacU2n+MXaosdLdMvmrnVGQ 1NOqJNJTJTKjYIOZeVsj0fv47b8zWx/gDyC5awancQHEVesfms1ZkWRWzGloJ5GyuoX2uhayaBHt 6ORHzJ6Sbc3Ki7J4EC4NOKXTXQnhVtujV3s9/XVfCo7uy4YWyzVSV0lV3qon5nydn2UcSse1zpnv RjGo7dfR2W5vJo2OuoOEnHMovCJ52za43TJ7g5E255amskRrv5444l/nA1MAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABTmb8Q9BTXGbEtK7UmX5DGvLM6F+1BQrvs qzzJ0VU/gtXddlTdF6Gly5TajOqVnC4O9ja9CzTnv3R1zOyPez75KXIrFi3BFR3vI7tS22hp7/dF knqZUYxPTb03XxVfUidV9RcV61wznUfnt+jdpW02h+7HZPdoFTnT+FS07urvzOem3qVEUyD5NTTy x5Hw72zIclfUXRtJeK9tFQVEiupKZUeiq9IvBz3KvVV39XTobda1rGoxjUa1qbIiJsiIU7125VVN Mao8f0eg4PwOFtW6b1UadUxnr9WPdzz26uqUSxrTSx2K4PyG5T1V+yCZeaa73N/bTqv95v0jRPUj eu3TdSXAEERFOx0q7lVyc6pzAAZaAAAAAAAQ3VrVrCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxf I5U2RE/OqqiIqoiM9UMVVRTGlVsNWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86q qIiqkU4e+HvNdUs1oOJ/iftPdrpTfC4RhEq89PjVO7ZW1NQ1ej65yIiqqp8H06I5GticPfD3muqW a0HE/wAT9p7tdKb4XCMIlXnp8ap3bK2pqGr0fXOREVVVPg+nRHI1sWwC9ataGudrzOOx04mdCj1f mAAnc5QnFBwv0+tdPbs7wS9JiWq2JIsuN5JE3x8VWjqkRPhaaTdUVqovLzKqIqK5rq40K11qNQ6i 6ad6iWFcS1RxJUhyHHpl/kRKulVV+FppN0VrkVduZEVVRWudsIoTig4X6fWunt2d4JekxLVbEkWX G8kib4+KrR1SInwtNJuqK1UXl5lVEVFc10V21FyOtcweMqwtW+mdsO4BUGhWutRqHUXTTvUSwriW qOJKkOQ49Mv8iJV0qqvwtNJuitcirtzIiqqK1zrfKExNM5S9TbuU3aYronOJAAYbgAAAAAAAAAAr jyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVHVeHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAY84t/jk8KP+PX6qgLgKf4t/jk8KP+PX6qgLgKWJ9eOx6Pgj2E9v0gABXdUAAAAAACG6tatYVo rhVZnWdXLu1FTbRwwxpz1FZUO/AggZ4vkcvRET86qqIiqiIz1QxVVFMaVWx0XEJkWkeFYBVZhq2y NKSi2ZRrCn9nTVK79nDS8qo50rl8Gou3Td3ooqp0vDDw4ah57erJxCcVdTcq+52liuwTELrP27cb pnLuyoqeiJLXOTl6uTePZPByNbFzOHvh7zXVLNaDif4n7T3a6U3wuEYRKvPT41Tu2VtTUNXo+ucm yqqp8H06I5Gtj2AXrNmLf4p2vOcIcI14qItUz+CNnn1f5mAAnctRXErw1e295r1F06v3sP1aw/eb Gslhb4+KrR1aIi9rSybqjmqi8vMqoiormvcNXEr7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJ uitciry8yIqqitc+9SiuJXhq9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXN eF6gorhq4lfbe86adai2H2H6tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrn3qAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7 KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTeb aBlRF2Ozkb6TnqjuZF6eGylygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/iqiIqquyJ4qB/SK6gam4bpla0umWXVs CyryU1LEnaVNU/1NijTq5d/X4Jv1VCvM21/qrjcp8M0WoIL7donLFWXeVV8225flV6fur0/gt6fy 7KhGca07p7ddH5ZlN0nyTKahqdtdK7Zys/vYWeETU8ERP+roU7uK/dta53836u/g+BZmIu4zOmOa n96ftjrnXujnfG9XLU7WrduRSVOGYhJ+DaKaTavrmb//AEiTb4Nqp4sT+RfUpJrFj9kxi3R2mwWy ChpIvwYom7Iq+tVXxcv513VTsAVcs50qtcu5pRTRFq3EU0xzR9eeZ651sk+S9+KnQf8AHdx/+Npr Y87uCDPuJfTzRBMRwbhW9mtvt97uEUtz9nFvtv8AZDZEbLF2MrXO9BybcyKqL6jQHt6cZP4iX1n2 r7MmuUTNUz9Yc7C36abNMTE7OjPk0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavszTQnq74T8oo3T8N Xk0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NInAv9ZdLfY7hX2O1NudwpqaSa loXTpD3qVrVVsXaKiozmVOXmVFRN9zPvt6cZP4iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5J Lofxg6I68ObasbyNbVkjVVk+PXlqUteyRPwmtaq8suyou/ZucqetE8C7Dwe4tEvNNxDZRcbxp03T 69VlTFca2xwXyC590qpY2yPkSeBEaiyK7teXxasn8horgu4tuMW43mmwiyYlcNWbHArY5krpFjmo GepVuLvRYm3gk3Pvts3YmqsatKlz7PCWdfFXY17M4j6bXpLq1q1hWiuFVmdZ1cu7UNNtHDDGnPUV lQ78CngZ4vkcqbIifnVVREVUinD3w95rqlmtBxP8T9p7tdKb4XCMIlXnp8ap3bK2pqGr0fXOREVV VPg+nRHI1sVf8KFvtnEJxD5TnHETK2l1C03rXQ43pzVJ/Y9hpF5Vbc2b+jWSvVU2nanK1Uaqbc0X L6AE1m1FEZztUMfjar9XF06qY8QzBWceuLuzbLsGxTh61vzGowi8TWO7VuOY1TVtIypicqKjXJVI 7Zdt05moqp6jT5kDgV/tt8U//nVrP+pxO5q2dGuLTSTWvI63BLS++41mlui7xVYrlNqktd1ji/hp DJ0e1PXyOdt0VdkVFXka0cUOnGid+tOFXS35Lk+YXyB1Xb8YxW0vuVznp2qrXT9k1UayNFRU5nua i8rtt+V21K+UMoKTGb3oFrHYYmU+ZWbVK0WSjqo05Zaihq0m7xSOVOrmPSNEVF6Ijnom3Mp3mt+j +v2H8R9NxWcO9nx7L62pxdMUv2KXmt7lJUU7Z+2ZJSVK+hG9XIxFR6oicu+zub0QlOFca2nGSagW jS/MsD1F0zyLIlcyyU2b4/5vjukjfGOCZkkkbn9UTZXJuqo1N3KiLoMyHTcV+EZLnGH4FxacMV90 5v8APeYX4xW5LQU91s7bsnSLu1wanKyfd3ouRqbbovM3oa8AoTig4X6fWunt2d4JekxLVbEkWXG8 kib4+KrR1SInwtNJuqK1UXl5lVEVFc11c6Fa6z6iT3TTvUSwriWqOJKkORY7Mv8AIiVdKqr8LTSb orXIq7cyIqqitc7YJkvyg2EabW7TyLX+uzNuCah4R/uWyCmj56itndurbW+FOtTHMvMnJsvLu534 PaI6K7ai5HWuYPGVYWrfTO2Fogy5jev/ABpXDH7bXVfA33ieopIpZJvbAt9D2jnNRVd3eViyQ7r1 7N6q5vgq7odl7enGT+Il9Z9q+zKOhPV3w9LGJonmn4avJpEGbvb04yfxEvrPtX2Y9vTjJ/ES+s+1 fZjQnq74OUUbp+GryaRBm729OMn8RL6z7V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq8mkTgX+sulvs dwr7Ham3O4U1NJNS0Lp0h71K1qq2LtFRUZzKnLzKiom+5n329OMn8RL6z7V9mPb04yfxEvrPtX2Y 0J6u+DlFG6fhq8kl0P4wdEdeHNtWN5GtqyRqqyfHry1KWvZIn4TWtVeWXZUXfs3OVPWieBdh4PcW iXmm4hsouN406bp9eqypiuNbY4L5Bc+6VUsbZHyJPAiNRZFd2vL4tWT+Q0VwW8W3GLcr1TYPZcSu GrFjgcyOfvz1jmoI/lW4u9FibeCTK/fbZuxNVY1aVLn2eEs6+Kuxr2ZxH02vRDyXHxE9Mv01+uK0 1UZV8lx8RPTL9NfritNVF154AAAAzXxA5Nlmm3E3oHmEGTXaDDsouVwwi+WxK2VKGWsqqdZLdKsH N2ay9rHI3nVObl6IoGlAYTodX9RpOOt2ZuzS8+1XU5fU6QMtDq2Tze26RWllV26Qb9n2y1bZIufb m23TfoqEe1S4nNSdP7bxScQePZNXz0NjyK2abYVb6uqkkttvr4Gsjr6tKdyrEr0klV/Ny9VjRq7p ugHoaV3kmuOJ4vrTh+hVwt92kv8Am1BX3G31MMUS0cUdIzmkSV6yI9rlT8FGsci+tUPPfUDiB0w0 u06TUjR/yhGZZnqhY0p6ye0Xu6T1Vmv7udveadKF8KRwNc1X8nIrXNRETm39JL/yvJ6XNuOfhhzO hidFTX7A79c4WOXdWsno2yNRV/MjkA2aDD+iuP6hcalDmms+Q8QOpWFW1uT3GyYhZ8PvCW6loaKl cjI5qhiMXvUr3bq7tF26KibIqI3n6w5txOYDp1ovw/ZFqNaodTNTMn9jtzzKyQbrHa4lV8tTFHJG 1rKpYnRIq8vKjkerdlVFaG0QYk1vsudcGFZp7qth+uepGWWC45db8ayqx5lfXXeGpoqtXNWogdI1 HQTMc3dORUaqqnRERWu5dRS6jan8eupelEmruZWHBqDD7Pc56CzXeWmk7ddmtZA/de6ter3PkfCj ZHLGxOZGq5FDaAMJ6DYlqlqBrDrZw9ZbxBajT4RpddqNbVVU98fBfKlbhAsrIp7k1O3dFA2J3K1F RXOl3crkajU6WwcUep2inCJxA3m8ZRW5dkOkWoN0wfHLteXJPUzxd4p4aaWpdsnbPjWd71V34SMR oHoMDywzDXrTTBNLHajadeUSzLJNXrPSRXKW23K5z1NkvNU3Z09GlvdCkMUb052x8itVvo+l6z0p 0xzSDUnTbE9RKWn7vDlNjoL1HDvv2bamBkyN39eyP2/mAkwB5s2rUK0X7UHNcf4uOK7VrRzUNuRV 0FjtlLd5bHYYbW1+1JLTOSJaaoYrdt3zPVXdPzuUPSYGHuKDXbUPQnQ3SHBL1rzbEvmf3aO13nUy jt7GMhtEfpzVsETVkZ2yxSQoj03RV53NRqq3lq+4cTelejWfaeX3QbjJzHU+lu+S0ViyvF8qvE91 Sa31Kqx1bTvmiasEsT+VeVio13MibI1FRwemIMfXKpznih4rdTNIo9WcywbBNIKC0QyQ4jcfNtbd bncIXT9pLUo1ZEijaxzOzbsiq1F9a78DWqxcQ2hHCHrhBkOtNxv8FqhZVYPkbK6WLIqWkdJHzxVl RGyPmka7o2Riq5yOdzKibNQNoAxLl+XahcMXB/kXFLe9S8oyzPMixy1SR0F2r1ms9qrKt8TI0pKX ZEY2Lt05nOVXS9lu9VVylFZhr1ppgmljtRtOvKJZlkmr1npIrlLbblc56myXmqbs6ejS3uhSGKN6 c7Y+RWq30fS9YHpZftQ8OxnLcYwW+XptNfcykq4rHR9jI9at1LAs8+zmtVrEZGiu3erUXoibqqIS M87tXMetuvPFdwpZq3NM8sdLqfil5vXZWnJamkda08zRTtSicxU7sr0cjZVZt2iJs49DKWBKWmip myyyJCxsaPler3u2Tbdzl6qq+tfWB9QAAAAGPOLf45PCj/j1+qoC4DPfH7fcyxriX4Yr3p9gnszv 9N7Ne6WTzpFbu981vpWv/siVFZHyRue/qnXk5U6qhwvb04yfxEvrPtX2ZTxFMzU7/BV2mizMTnt5 omeaN0NIgzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7Mg0J6u+HS5RRun4avJpE4F/rLpb7HcK+x2ptz uFNTSTUtC6dIe9Staqti7RUVGcypy8yoqJvuZ99vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RR un4avJJdD+MHRHXhzbVjeRraskaqsnx68tSlr2SJ+E1rVXll2VF37NzlT1ongXYeD3Fol5puIbKL jeNOm6fXqsqYrjW2OC+QXPulVLG2R8iTwIjUWRXdry+LVk/kNFcF3Ftxi3G802EWTErhqzY4FbHM ldIsc1Az1Ktxd6LE28Em599tm7E1VjVpUufZ4Szr4q7GvZnEfTa9JdWtWsK0VwqszrOrl3aipto4 YY056isqHfgQQM8XyOXoiJ+dVVERVSJ8PfD3muqWa0HE/wAT9p7tdKb4XCMIlXnp8ap3bK2pqGr0 fXOREVVVPg+nRHI1scA4ULdbOITiHynOOImVtLqFpvWuhxvTmqT+x7DSLyq25s39GskeqptO1OVq o1U25ouX0AJrNqKIznaoY/G1X6uLp1Ux4q3w3XfEM41k1A0PtNuvEV903jtkt1qKiGJtJMldB28X YObIr3KjV2dzMZsvhzJ1OJLxF4TPrnHw+45ar5keSU9H3+91FqghkocfhX9z79M+VnZvk/exsa96 psqtRFRTCWperGtemnF5xZ0nD9pxdcmy+7WnGpY62mp2yQWWlp7Qx01U9HKiSTbPRIYeqvfv0dyq x2w+CPG9GLXoNZ8k0ZvU2QU+U73W9ZBXrzXK6XR6/wBkSVq7qqTNfzNViqqM22RV/CdO5rrM144M XxTV3K9F7HoZrBm99wtKJ12lxSwU1dTRJVU7J4V5lqWPRFa/b0mJ6TXIm6Juvd6WcZOkmp2bM0wr LfleCZvNE6emxvNbLJaa6qjRFVXQo5Vjl6Iq7NertkVURURVStuHr/uhfFZ/5Jhv6rQ+PlTbbb7f wzpqvR9nS5bp7kNpu+N3BibT09UtZFG5rHJ15Va5XK3fZVjaq9WpsFla2cYGKaKanWjSGXSzUrNs lvVndfKelxCzwV7kpmyvjcrmvnjfuixqq7NVERU6+o4GK8YtTlOT2jGXcJfERZku1dBQrcbrhsMF FR9rIjO2qJEqXKyJnNzPciLs1FXZfApPiF1PXSzyienOZ1On2Z5U72r6qF9qxO0OudwR0lXNu5IW uRVY3b0nb9OheOFcYtPmmWWrE28MXEJY1utUylS43rApaSgpeZdu0nmWRUjjT1u26Ac/iV4avbe8 16i6dX72H6tYfvNjWSwt8fFVo6tERe1pZN1RzVReXmVURUVzXuGriV9t7zpp1qLYfYfq1h+0OS41 M7x8ESspFVV7Wlk3RWuRV5eZEVVRWufeplHj7xLT6xYJT8Q8mbewHUjBV3xTIaSPnqa2odvy2t8K daqKZeZvZqi8vM534PaI4NXAyBivErx63LGbVca3yeveqipooZZZ/bLtlv7V7mIqu7rMxZYN1Xfs 3qrm+Cruh2vuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9b tn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHu h+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8n V9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+ zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDK vuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz 8nV9btn+zP4vEbxwwJ2tb5O2obC38JYNVbRM/wDmYke6garBkqXj3uWCzo7iE4W9UtObYrd1vTaF t3t0O3j201N1Z+bZrlXr06GjtONTMB1dxOkznTTK6DIbHW7pFWUcnM3mT8Jjmrs5j06bsciOT1og EnAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIv o7c3QlZR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAACttUtbLPgEzMbs9DLkGXVjOajs9Ku7k38JJ3eEUfr3XqqeHTdU0rrptxpVTqT4fDXc Xci1ZjOZ/wAzndHWlmZZti+n9inyPLbvDQUUCfhPX0pHepjGp1e5fUiJuUHfb9n+uqvirkrcQwST ZWULV5LjdGfLM5P3KNU/eJ4p479FT+WzCbzkN9jzzVi5x3u/tb/Y1K1u1DbE8eWGNeiu8N3r13Tf x9JZuc+5dqvatlO7f2+T1WEwNng/8UZV3N/NH8sc8/xT7oja4Nlsdox23RWmx26Cio4U2ZFC3ZE+ VV+VV9ar1U5wBpEZbFiZmqc52gAMsM3cBH9pq+f8t7//AFpTSJm7gI/tNXz/AJb3/wDrSmkTa560 oMN7GnsAAapwAADgX+sudusdwrrJaXXS4wU0klJQtlbF3mZGryR87lRrOZ2ycyrsm+5zwBhjTPya VtvmV12qnFFla5bkd6rZLlWWm2vfDQJNI9XuR8vSWRqKuyNb2bURNvSQ2njOK4zhdlp8cxCwW+y2 ukbywUdDTsghjT8zWoibr618V9Z2gNqq6q9qG1h7dj1I81Qa7aE1GodRa9RNO78uJao4kqzY9kMK fyqtJVIifC00m6o5qou3Mqoiormusfhf4oKfWunuOCZ3ZUxLVbEkSLJMbld4+CJWUqqvwtNJuio5 FXl5kRVVFa53cFQa7aE1GodRa9RNO78uJao4kqzY9kMKfyqtJVIifC00m6o5qou3Mqoiormuls3t DVOxRx+Ai/HGW/W+bYRhnTS2cW3D5qxrbcsc4TKnObNn2b1eQWy4RZvaLci07lcjN45ZHPTmRUX0 kaqeCoXXwv8AFBT6109xwTO7KmJarYkiRZJjcrvHwRKylVV+FppN0VHIq8vMiKqorXOvsvbXnJiY nKWSMe0a4geITWnE9Y+J3H7LhGM6dVLrji+C225pcpn3NUTlrK2qYiRuWPZqsRnrTwanN2ko1Qou L7T3WSs1K0hpLdqfg16oIKaqwa43eO1VFrqYk27eiqHsWNWv6ueki78zlTwRqt0eAwxjqTgvFNxf 1eJ4VqTotZ9IsFsORUWRXWqqcop7zdK5aZXKyCmbSt7OHmVyor3O3ROqeCsds4EE1q1qwDQHAK/U XUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqA1q1qwDQHAK/UXUa7d0t1JtHDDGnPUV1 Q7fs6enj8ZJXqmyInh1VVRqKqZR0/wBP8/13z+j4lOJS290qqTd+EYQ93PT43Tu2Vs87V6SVr0Rq q5U9Dp0RUa2Np/p/n+u+f0fEpxKW3ulVSbvwjCHu56fG6d2ytnnavSSteiNVXKnodOiKjWx6GKd6 9n+Gl3uD+D9HK7djXzQAArO0AAAAABwL/WXO3WO4V1ktLrpcYKaSSkoWyti7zMjV5I+dyo1nM7ZO ZV2Tfc54Awxpn5NK23zK67VTiiytctyO9VslyrLTbXvhoEmker3I+XpLI1FXZGt7NqIm3pIbTxnF cZwuy0+OYhYLfZbXSN5YKOhp2QQxp+ZrURN19a+K+s7QG1VdVe1Daw9ux6keauPJcfET0y/TX64r TVRlXyXHxE9Mv01+uK01UdN40AAApLjF0tyvVbQ+utunlubW5nYLnbclxqJ08cPNcKKqjla1JJFa xiuYkjEc5yInP1Uu0AYrdw26w0nBParPTY3FUa027KodSVolr6dqSX7zv3ySNZ1f2W/YvfFzc/L0 Tqvr5tt4M8ny/gJXQTLq2Gy6hXt0mTV9a+RsrafIJa1a34R8Sua5EcqQucxXeiiq3m2TfY4Ay9Hq Jx732y2/D6Xh3xbF8iV0EFwzG45TTV1nY1rm9tURUMG1S/najuWN3Jyq5N3LtudxqJpRqFfeM7Rz Vm3WNtTi+K4/faG83FtRDGlPUVEPLE1IXP7V3M7+C1yJ61Q0SAMZae4VxS8JNVmun2lWiNs1Rwq/ ZBW5DjVc3Kaa0zWjvSor6SrjqE3kYxybo6LdVTdfF3KznZ9w6cS2YaSaZZlkGdWPJdcdNMlTLIu1 iZSWyrY5y9ramuijbys7LkYkrm7q5i7qiO5m6/AGPtQsI4j+LS/4HimpOi1LpZgmK5LR5TfJarJq S61d2kpeZYqOnZS7oyNznLzPkVq7bKiIreV07wfSnPrPxuamavXGw9jiWQYlaLZbrh3qF3b1MDt5 Wdkj1lbt8rmoi+pVNDADPOgOlOfYTxI8Q+fZPYe5WHOrnYqiwVfeoZO+R09HJHMvIx6vj5XuRNpG tVd903TqVZaeDrNc/wBH+J3SfPqJmOrqdqXd8lxmtfUQ1DXwLLBNR1Lkhe5WMdJAiOY7lkRvN6Kb obZAGVqPPuPypxS34HBw84vasqjjgoqrNq/Laaps27NkkrG0USJVO50RVSJUbsrvFdtl1JStqWUs LK2aOaobG1JZI41jY9+3pOa1VcrUVd1RN12+VfE+pS+acOF6zDKLhktNxOa0Y5HXyJI212W70EVF SojUTliZJRPejem/V7uqqBdBlC933i780XfTnU7hLxLWKldU1LaO902RW6httbTPe5Ye8UVYjpIn NYqNdyI/fZdt/FZlRcKd/o6yCrdxd6+VCQStkWGa+WxY5ERUXlciUCKrV22XZU6L4l+gYWt3BNrB iXDRpFaccv8AZKnVLSDJZMsttJPPJ5slZNPJJNamyuTnaxWPa1Hqn4TF/BR3M25cfz3jHzrMccoa vQaxaYY5SVjajI6+85JTXqaspkaqOpqKKjVOR7lVNpZVRERN+RfwV0IAMo5XptrvojxLZjr7ohp1 RajWHU+22+DI8e89wWqtpK+hjWKCphkqPgnxrGqo5qqjuZ7l9Sb9RqHprxd6w8M+tdv1Ho7f7Is6 hiixHA6Cro3x2Kmjc3eJ9erY2zTSbK57nvVicicit5lamxQBROrfDzUa38IkugN7qWWi6VmN26lZ M/aRtJcKVsMkfMrFXmYk0KNcrVXdqu23IZR59x+VOKW/A4OHnF7VlUccFFVZtX5bTVNm3ZsklY2i iRKp3OiKqRKjdld4rtsuqQBlriZ031uXW7Q7X3S7A6XP6rTtl7o7zZ47rBaXztr6RkCTRPqHKxrW rzuVquc78FE33Vyacts9ZU26lqbhQ9yqpYWPnpu1STsZFaiuZzp0dyrum6dF23OSAAAAAADHnFv8 cnhR/wAev1VAXAU/xb/HJ4Uf8ev1VAXAUsT68dj0fBHsJ7fpAACu6ocC/wBZc7dY7hXWS0uulxgp pJKShbK2LvMyNXkj53KjWcztk5lXZN9zngDDGmfk0rbfMrrtVOKLK1y3I71WyXKstNte+GgSaR6v cj5eksjUVdka3s2oibekhtPGcVxnC7LT45iFgt9ltdI3lgo6GnZBDGn5mtRE3X1r4r6ztAbVV1V7 UNrD27HqR5qg120JqNQ6i16iad35cS1RxJVmx7IYU/lVaSqRE+FppN1RzVRduZVRFRXNdY/C/wAU FPrXT3HBM7sqYlqtiSJFkmNyu8fBErKVVX4Wmk3RUciry8yIqqitc7uCoNdtCajUOoteomnd+XEt UcSVZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXS2b2hqnYo4/ARfjjLfrfNM9G9JNQsU4yeIHVa/ 4/3XFs3p8ajsNf3uB/fHUlAkVQnZseskfK/p8I1u/i3dOp0VLopqlw7cRzs64f8AF/Pul+pNWsmb YrFW09L5kuC7f7LUaTyMarXf75Exd12XZF+DSOY8L/FBT6109xwTO7KmJarYkiRZJjcrvHwRKylV V+FppN0VHIq8vMiKqorXOvsvbXnJiYnKWKH2Hii0b4wdbNWsD4ZajULGtQ4rBFb6uHMLXa+TuVAy KRVZPIsn7or29Wt/A3TdFRTsbvpNxK8W+b4tPxFYPZtMdMMPukN9XEqa9R3e432uh37FKmohRIWQ NVVVWt6ruqbKqtezYwDDOGUaSahXHj3wzWmjx/tMMtOn9ZZKy597gTsq19TK9sXZK/tXbtc1eZGK 3r4mjwQTWrWrANAcAr9RdRrt3S3Um0cMMac9RXVDt+zp6ePxkleqbIieHVVVGoqoDWrWrANAcAr9 RdRrt3S3Um0cMMac9RXVDt+zp6ePxkleqbIieHVVVGoqpjay4Zr3rBn1n4rtV7VbUudlmWow/Ti4 NV9LZ6N3hJI5VRO/uTZ3Oqeg5G/gq1rGd3p/p/n+u+f0fEpxKW3ulVSbvwjCHu56fG6d2ytnnavS SteiNVXKnodOiKjWx6GKd+9n+Gife7/B2AiiYvX6YnqnZ7/81dqT6Y6x4vqbFPSUiTWu+0Ho19mr vQqqd3rVE/fs+RyfKm+yrsTwznmGn9tymamu9LVz2e/29yPobvRLyVEDk8EVU/Db8rV9Srttud5g Wu1ztFzgwbWuGC23SZ/ZW++RN5aC5/JuvhDL4btXZFXw5d0RVrE/u3e//NjbG8DRMTeweuOennjs 6UeMc+e1eAALjzwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8vYyRjo5GNcxyK1zXJuioviioYg1x 02j4G81Xi60Jtk1JhNZUspdT8MpJnNoailmla1lzpYPwIp4Xv8GoicrlRvI10vPuEhmtGGW/UTSL NMFulMlRTX2w11A9nr3kge1qp8jkcqKi+pURQJXbrhRXa30t1ttSyopK2FlRTzMXdskb2o5rk/Mq Ki/znIM+8AOTVuXcG+lV4uFW+pmZY0oFkeu6q2lmkpmoq+vZsKJ/MaCAAAAAAAAAAAAAAAAAAACm tUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlM GPvzCg7/AOxV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOLdLpbbJbqi7Xeugo6 KkjWWeonejGRsTxVVXoiGdMozvKNeJ3WnFZ62waftVWVNxRFiq70idFZEi9Y4V6oq+K+v1tSG9ep tRr1zudDAcHXcdVMxqojbVOyPOd0fTW7/Pdbrzk9yrMC0TWKeqgd2NyyR6I6jt/yti9U0vybbtT8 /VW9dh2CWfDYppqd01bc65e0r7nVvWSpq5F6q57167b+CeH8q9TtbHYrRjVshs1it8VHR06bMijT ZPzqvrVV9ar1U55z6pqrnSr2/J6m3Raw1vicPGVPPPPV2/SNkdusABlgAAAAAZu4CP7TV8/5b3/+ tKaRM3cBH9pq+f8ALe//ANaU0ibXPWlBhvY09gADVOAAAAAAAAAACoNdtCajUOoteomnd+XEtUcS VZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXWPwv8UFPrXT3HBM7sqYlqtiSJFkmNyu8fBErKVVX4 Wmk3RUciry8yIqqitc7uCoNdtCajUOoteomnd+XEtUcSVZseyGFP5VWkqkRPhaaTdUc1UXbmVURU VzXT2b2hqnY5ePwEX44y363zbCBQnC/xQU+tdPccEzuypiWq2JIkWSY3K7x8ESspVVfhaaTdFRyK vLzIiqqK1zrA1q1qwDQHAK/UXUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqXtrzkxMT lJrVrVgGgOAV+ouo127pbqTaOGGNOeorqh2/Z09PH4ySvVNkRPDqqqjUVUyjp/p/n+u+f0fEpxKW 3ulVSbvwjCHu56fG6d2ytnnavSSteiNVXKnodOiKjWxtP9P8/wBd8/o+JTiUtvdKqk3fhGEPdz0+ N07tlbPO1ekla9EaquVPQ6dEVGtj0MU717P8NLu8H8H6OV27GvmgABWdoAAAAAAAAAAAAAVx5Lj4 iemX6a/XFaaqMq+S4+Inpl+mv1xWmqjqvDgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMe cW/xyeFH/Hr9VQFwFP8AFv8AHJ4Uf8ev1VAXAUsT68dj0fBHsJ7fpAACu6oAAAAAAACoNdtCajUO oteomnd+XEtUcSVZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXWPwv8UFPrXT3HBM7sqYlqtiSJFk mNyu8fBErKVVX4Wmk3RUciry8yIqqitc7uCoNdtCajUOoteomnd+XEtUcSVZseyGFP5VWkqkRPha aTdUc1UXbmVURUVzXT2b2hqnY5ePwEX44y363zbCBQnC/wAUFPrXT3HBM7sqYlqtiSJFkmNyu8fB ErKVVX4Wmk3RUciry8yIqqitc6wNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4 dVVUaiql7a85MTE5Sa1a1YBoDgFfqLqNdu6W6k2jhhjTnqK6odv2dPTx+Mkr1TZETw6qqo1FVMo6 f6f5/rvn9HxKcSlt7pVUm78Iwh7uenxundsrZ52r0krXojVVyp6HToio1sbT/T/P9d8/o+JTiUtv dKqk3fhGEPdz0+N07tlbPO1ekla9EaquVPQ6dEVGtj0MU717P8NLu8H8H6OV27GvmgABWdoOvv2P 2bJ7XNZr9b4qyjnTZ8Uiev1Ki+KKnqVOqHYAxMZ6pZpqmmc42oZjmdZdoO9KDJZK3JcARUbDW/ul dZm+CJInjLCny+Kf5Gromz3m1ZDa6a9WO4QV1BWRpLBUQPRzJGr60VP8n5l6FUPYyRjo5GNcxyK1 zXJuioviioQSmt+WaN3aTJtLqd9fYp39pdcWV+zH/LLSf97k/vU6L4bL0RJLV6qzqnXT4x+irjeD 7fCH46MqbvdFXbunr2Tz5bWnwRnANRMV1LsTb/itw7eJHdnPBInJPSy+uOVni1yf5F8UVU6kmOjT VFUZ07Hk7lquzXNu5GUxtiQAGWgAAAAAAAAAAAAAAAAAAAAAAAAAAB/FRFRUVN0XxQ/oAyr5LlVX gU0yVV3/AO3P64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2 x6beynzy2aZzZ3ecLfHTwdixGqj/AE2rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpk f29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADpcwzHHMDx+qyfKbnHQ2+kbu57+qud6mMb4u cvqROqnX6jakYzpfjz8gySpciOd2VLSxJzT1ky/gxRN/fOX/ACJ4rshRtPZcm1LvtPn2q0bWd2d2 lnx5ruantzV8HyJ/vky9N1Xw/mRG1r1+Lf4addXy7XX4O4LnFf6178NuOfnnqp+s7I7dU/O5SZTr zWQXvNqWez4dBIk1tx1XbSVm34M9WqePypH4J/lV07iiigiZDDG2OONqNYxqbNa1OiIiJ4IfoFLK c851y9JNUaMW6I0aY2RHN5zvnbIADLQAAAAAAABm7gI/tNXz/lvf/wCtKaRM3cBH9pq+f8t7/wD1 pTSJtc9aUGG9jT2AANU4AAAAAAAAAAAAAqDXbQmo1DqLXqJp3flxLVHElWbHshhT+VVpKpET4Wmk 3VHNVF25lVEVFc10X080s1Y1dzyi174t47euQWVFhxbEKF/aWyw7bI+r25nJJUyObzI5VdyJy9d0 akehwbxcqinRVqsJaruxemNYADRZAAAAAAAAAAAAAAAAZK4XNQ+Mnhr0JxnRT3Efsj9jnff9k/bJ tVH2/eKyep/ceWTl5e35fw135d+m+yWr7rfjJ/J9/WvavsS4AWOU19TleiLG+fDyU/7rfjJ/J9/W vavsR7rfjJ/J9/WvavsS4AOU19R6Isb58PJT/ut+Mn8n39a9q+xHut+Mn8n39a9q+xLgA5TX1Hoi xvnw8lP+634yfyff1r2r7Ee634yfyff1r2r7EuADlNfUeiLG+fDyU/7rfjJ/J9/WvavsR7rfjJ/J 9/WvavsS4AOU19R6Isb58PJT/ut+Mn8n39a9q+xHut+Mn8n39a9q+xLgA5TX1Hoixvnw8lP+634y fyff1r2r7Ee634yfyff1r2r7EuADlNfUeiLG+fDyU/7rfjJ/J9/WvavsR7rfjJ/J9/WvavsS4AOU 19R6Isb58PJT/ut+Mn8n39a9q+xHut+Mn8n39a9q+xLgA5TX1Hoixvnw8lP+634yfyff1r2r7Ee6 34yfyff1r2r7EuADlNfUeiLG+fDyU/7rfjJ/J9/WvavsR7rfjJ/J9/WvavsS4AOU19R6Isb58PJT /ut+Mn8n39a9q+xHut+Mn8n39a9q+xLgA5TX1Hoixvnw8lP+634yfyff1r2r7Ee634yfyff1r2r7 EuADlNfUeiLG+fDyU/7rfjJ/J9/WvavsR7rfjJ/J9/WvavsS4AOU19R6Isb58PJT/ut+Mn8n39a9 q+xHut+Mn8n39a9q+xLgA5TX1Hoixvnw8lP+634yfyff1r2r7Ee634yfyff1r2r7EuADlNfUeiLG +fDyZiu124l9eOJfRjUHUHhk9rmwac+yLvdX7NLfd+284W9ImehEjHt2kiYnRr9+03XlRqqunQCK uubk5yu4bDUYWjQo2bdYADRYAAAAAAAAAABUGu2hNRqHUWvUTTu/LiWqOJKs2PZDCn8qrSVSInwt NJuqOaqLtzKqIqK5rovp5pZqxq7nlFr3xbx29cgsqLDi2IUL+0tlh22R9XtzOSSpkc3mRyq7kTl6 7o1I9Dg3i5VFOirVYS1Xdi9MawAGiyAAAAAAAAhV6xG+2LIl1F0urY7bkSN2q6WT/al2jTr2czfB HfI/oqL608UtvSnV2yan0E8LKeS1X+2L2d0s9Su09K/w3T+HGq+D0+VN9l6EZIlluDzXS402X4pc 3WPLLan9h3GJOkjf+9TN/wB8jXwVFRdt/Wm6Lm3XVZnOnZzx5NMThrXCFGhe1VRsq+k748Y5tWpp AFYaSazQ5xNPiOVUDbJmdsbvWW5zvQqGJ/v9O5fw418duqt/OmyrZ50aLlNynSpeRxOGu4S5Nq9G Ux/mcb4neAA3QAAAAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmq gAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6 ErKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ/U 3U/HtLrEl1vCyVNZVO7C3W2n61FdOvhGxvybqm7vBEX1qqIvz1S1Ssml9kZXV0cldc65/YWu1wdZ 62dfBrU9TUVU5nbbInyqqItPY1i98uV9k1G1IqY67J6tvLDE3rT2qBfCCBPBFTfq7xVd+q7qrqt+ /ofgo2/J2uDODIxEcoxGq3zb6p3R1b590a3ysONZFk2Re2ZqlJHU356Klvt7F3prPCvhHGngsn8J /jv6/WTcApRGT0Ndc15c0RqiI2RG6AAGzQAAAAAAAAAMn5Nx2WjRPWq7aNcQ2OTWaCORtTZsmtsT 5qWqoJVVYZJoOsjHNRHRvdHzosjH7NahmmmatiO5dotZTXOUS7/gI/tNXz/lvf8A+tKaRPN/RTjt 0c4etFrtbKh1XkuSVuVXuvpLVb05WrDLUuWKSWocnJGxyJunKj37bLybKim5tEciz3MdM7LmOpNq orTeb9D5x82UjXI2gp5PSghcr1VzpEj5Feq7em5yIiIiIb3KZiZmVfCXqK6KbdM5zEJ0ACNcAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAEXzfBqfLI6avoq2W1X+1v7a2XWn6S00ieCdPwmL62qTPSHW OpyWrfgGoNNFas0oI+Z0bV2gucSf/SKdfX4buZ4p1XwRUbxCO5phVBmNHDzVEtBc6CRJ7dcqdeWe jmTqjmqnXbdE3T1/y7Kimqq1VpUe+N/6sXrNrG2+Jv8ANsnnp843x741tCgqPSLV+vu9wdpvqQyK hzCij5opW+jBd4E/3+H1c2yekz1dVROio23DpW7lN2nSpeRxWFu4O7Nq7GvwmN8b4kABurAAAAAA AAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAKa 1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUw Y+/MKDv/ALFX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEP1P1NsWl2Ped7o19VW1L+7223Q dZ66oX8GNifJuqbu22RPlVURftqTqPj2l+My5HkErnekkNJSRdZqydfwYo2+ty/+xN1XwKPxmw5F kuQv1R1M5X36pYrKCgRd4bPTL4RMT+GqL6TvHdV+Vd6t+/ofgo9b5OzwXwZGJ/17+q3HfVO6PrPN 2vri+NXy5XubUjUaZlXk9czliib1gtdOvhTwp6l2X0neKqq9V3VXTIApxGT0Vdc1zuiNURzRG6AA GWgAAAAAAAAAABi7yn2gftjaQQ6rWKi7S+4FzzVHI30p7W9U7dF+XsnI2VN+iNSX5TaJB9aNTNPt KNPbplGpdRH5ndE6kWjWNJZbjJI1WpSxRL+6Pf1Tl8Nt1XZqKqbUTNNUTCHEW6btqqmvY8euBPQP 2+terXQ3ai7fGca5b1e+du8ckcbk7KnX1L2snK1U8VYkip4Ht6Y48nXatP8AAbHmOncdgu2K6hOu z7nebBfoliuFPb3f7RRqqiLNEyJ6bv2Re0kfuiI5u+xyS/VNVeSrwbZpt2Iqic5kABC6AAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAACO5rhdDmVviifPLRXGikSot1xgXlno506te1U67bom6ev+VE VJZo5q5XX+rl071CZFRZnbY+bdvoxXWBPCog9SrsnpNTw6qibbo3ikYznCYcupKeekrZLZe7ZJ3m 13ODpLSzJ1Rd08Wrsm7fX/LsKaqrVWnT743sXrNvGWuIvat09GfKeePfGtooFWaM6vz5ktRhea08 dtzWzMTvlMnSOsi8EqYPlYvTdE/BVfkVC0zpW7lN2nSpeQxWFuYO7Nm7GUx49cb4nmAAbq4AAAAA AAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAo/Vn RvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW6 02+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAACH5frJpDp9cIrRn2quH41XVDUdFS3i+UtHLIi+CtZK9qqi/mQlNJX0N wooblQVsFTSVEaTRVEMiPjkjVN0e1ydFaqdUVOgH3BB7TrpojfsgTErHrHg9xvjpOyS2UmQ0k1Wr /wCD2LZFfv8Am23JFk+XYphFpffszye02C2RORr626VsdLA1V8EWSRyNRei+sDtgRzDNSNO9RqWa u09z3HMopqdUbLNZrpBWsjVfBHOic5EVfzjFtSdOs5uF2tOE59jmQV1gmSnu1NarrBVy2+VXPajJ 2RucsTldHImz0Rd2OT1KBIwReyapaZZNcL5acb1Fxi612MOey+U1Dd6eeW1ua5zXJUsY9VgVHRyI qPRNlY5PUp1Sa/6DuxuLMW62YEtgnq3UEV1TJKPub6lqIroWzdpyLIiOaqsRd0RydOoE9BFMk1Z0 rw2mttZl+peKWOnvTUdbZbleaamZWoqIqLC6R6JIio5v4O/inykjqLhQUdDJdKuup4KKKJZ5KiSV rYmRom6vV6rsjduu++2wHIBEsP1d0n1Drai24BqfiWTVdG3mqKez3qmrZIU323e2J7lam67dSWgA AAAAAAAAAAOkzLMcfwLHKzKsnrm0tBRM5nuXq57v3rGJ++c5eiJ8p2F1ulusdtqbxd62KkoqOJ09 RPK7lZGxqbq5V/kM1PuFZrvlMOc3ylmgw+0SquOWyZNu9SJ0Wtmb69/3jV8E/nV0F+9xUZRtn/M3 U4M4P5bXNdzVbp2z9I658I1vpZaa+6k5M3VfPqN1O5qK3HrPIu7bbTr4SOT1zPTZVX1fm6I2cgFC Iy27Xp66oqyimMojVEc0R/nfOsABloAAAAAAAAAAAAQ3VrVrCtFcKrM6zq5d2oabaOGGNOeorKh3 4FPAzxfI5U2RE/OqqiIqoiM9UMVVRTGlVsNWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jl TZET86qqIiqkU4e+HvNdUs1oOJ/iftPdrpTfC4RhEq89PjVO7ZW1NQ1ej65yIiqqp8H06I5GticP fD3muqWa0HE/xP2nu10pvhcIwiVeenxqndsramoavR9c5ERVVU+D6dEcjWxbAL1q1oa52vM47HTi Z0KPV+ahOKDhfp9a6e3Z3gl6TEtVsSRZcbySJvj4qtHVIifC00m6orVReXmVURUVzXVxoVrrUah1 F0071EsK4lqjiSpDkOPTL/IiVdKqr8LTSborXIq7cyIqqitc7YRQnFBwv0+tdPbs7wS9JiWq2JIs uN5JE3x8VWjqkRPhaaTdUVqovLzKqIqK5rtrtqLkdaLB4yrC1b6Z2w7gFQaFa61GodRdNO9RLCuJ ao4kqQ5Dj0y/yIlXSqq/C00m6K1yKu3MiKqorXOt8oVUzTOUvU27lN2mK6JziQAGG4AAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAACKZzhs9+7pf8drfNmUWV/b2u4M6K13rik/hRu6oqLv4/wAqLZmj +rNJqXap6W4UnmvJ7O5Ke82t6+lDJ/3xm/4UTvFq9fk3XxWPEMzLG7zSXak1JwBzafKrO3ozfaO5 U37+mlT1oqfgr6l28OipmiubNWlGznj/ADna4jDUY+1xNycqo9Wd3VP8M+E69+elgRPTLUmw6o4x FkVkV8MjXLBW0UvSaiqG/hxSJ8qL4Lt1TZfzEsOnTVFcaVOx427arsVzbuRlVGqYAAZRgAAAAAAA AAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAimRWvTKrz vEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW9tj029lP nls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAH88eigeR1nZpTrpmGt2e6McHt51noqySpZd8xzPNqOiZRyOSV3bUEUkCujTl9JvK7n bHHEnwe+yy3gVxXUvXryYupuk+I5Q+kvT7/cLNZJJ6hzGRQdhQ1L6XmTdWMlWWoYvqTtnb9Ny6ME 8mb7W98yeyYdxG5ZatK8xqu2vOFUlBFG+qg6p3Z1fzq9sascsbuSNj3R+irl8Ts9KvJx0OmmHaj6 TO1xyOs06zp8lTRWSkomUNTZ6xXxKyqZWNe50kjWQRxqnK1j2oqOau+wGKKrH8E0a00senvGD5Pz IsXprJNTQ1OpGJVLVqZZmv2SSSdEWNzn+tveFRd15GtVG7aX43dD9StbF0R1y0YxaDWPBcZtkVZL i9yr1Yt0p5mRyR1Tke5qzLLFyo/xfu1u7HIrkSVXTyd+r2Y4jT6S6k8b2Y5BprD3eJ9gbj1NBUTU 8D2uijfWLK9z+VWMVFexybtau3RCytYOCqizNcBu2kGrWTaVX/Ta2RWWx1lsXvdMlDHGsbI5aaR7 WyKjFc3m5kVzXuR3Mm2wZs4T804c4OLe2UFz4bcz4etV7haZqOksPbOisl0i7ORz94ljiVXOaxXN XkSNzoGqi86Jzc/yWrmt4g+LONXIj1yymVG+vZK67b/9af5S8NLOB672TWu1cQWvGvl91YzLHaR9 HY5Km1w2ykoWva9quSCJ70c5Elk26om7lVUVUaqR66eTuudo14yjWjRbiSyrTWDOJpZ8htVst0U7 p3TSdpN2M73o2Ld6ue1VierHOXlVE6AUlwJzQ1PENxsTwSNkilutxexzV3RzVrrmqKn5tim+Dnhr 0y1c4A9Z9Rs9tct0vONOvjcdkkqZGstMtNa4KvtYWNcjUdJI6NJFVF5mxMb4G8uG3gOtPDZlGq93 x7UOW42vUmNYKS3zWxzZLTEj51Y107p3rUqiT7K5WsVeXdfHp9+Hfgh9oThjz7hx9s7z77OJLq/z z5l7r3PvtvipNuw7d/acnZc/7o3m5tum26hg3TPh50+1E8mBlmtWcUtVeMxx+Csjx+5VNXK51ooq OoRzKSBnNyJErn1DlRUXftl/gt5eDxB6nZ7XeTc4aMOS5Vk1DlNZX0lzRtT2S1UNvqnw0lM+ReiM RqtVEd6KLCxV/BQ9ANP+CL2C8Gt/4SPbO7958ir4vZB5l7Lse8yc+/de3dzcvh+6pv8AmOLP5PjT /IeETGuFPPcpq7r7FJZ6u25JR0baOogqn1E8qSNhc+ROXlqHRuYrlRydd2ryq0MrZLw68TjtRNMM /wBDuAG3aN3TArnFJVVtp1AtFV5zot2I+GoYj4lkVWI9rnuVzntkejt9029VjIOC8B+cQZriWUa3 8V+a6lW/BXtlsdnfSJbYEe1W8veXsme+pT0Gb8yoruVEcqtVWrr4AAAAAAAAAAUTrdnlyym9Long VydT1M0aSZLc4evcKRyfuLV/77Ii7bepq/nVWx3bsWqdKVvBYOvHXYtUaueZ5ojnmf8ANc6kfznK Jtesokxi1Pcmn2P1Sd/qGqqJeqxi7pE1U8YWL1VU8V6/wVSYxRRwRshhjbHHG1GsY1NkaidERETw Q4djslsxy0Utjs9M2no6ONIoo09SJ61X1qq7qq+tVVTnHN1zM1VbZevyot0RZsxlRTs+sz1zz92y AAGWoAAAAAAAAAAABDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIiqiIz1Q xVVFMaVWw1a1awrRXCqzOs6uXdqGm2jhhjTnqKyod+BTwM8XyOVNkRPzqqoiKqRTh74e811SzWg4 n+J+092ulN8LhGESrz0+NU7tlbU1DV6PrnIiKqqnwfTojka2Jw98Pea6pZrQcT/E/ae7XSm+FwjC JV56fGqd2ytqahq9H1zkRFVVT4Pp0RyNbFsAvWrWhrna8zjsdOJnQo9X5gMwVnHri7s2y7BsU4et b8xqMIvE1ju1bjmNU1bSMqYnKio1yVSO2XbdOZqKqeonOjXFppJrXkdbglpffcazS3Rd4qsVym1S Wu6xxfw0hk6Panr5HO26KuyKirO5y5gVDrRxQ6caJ3604VdLfkuT5hfIHVdvxjFbS+5XOenaqtdP 2TVRrI0VFTme5qLyu235XbRrCuNbTjJNQLRpfmWB6i6Z5FkSuZZKbN8f83x3SRvjHBMySSNz+qJs rk3VUam7lRFDkcUHC/T6109uzvBL0mJarYkiy43kkTfHxVaOqRE+FppN1RWqi8vMqoiormurjQrX Wo1DqLpp3qJYVxLVHElSHIcemX+REq6VVX4Wmk3RWuRV25kRVVFa52wihOKDhfp9a6e3Z3gl6TEt VsSRZcbySJvj4qtHVIifC00m6orVReXmVURUVzXRXbUXI61zB4yrC1b6Z2w7gFQ6Fa6z6iT3TTvU SwriWqOJKkORY7Mv8iJV0qqvwtNJuitcirtzIiqqK1zreKFVM0zlL1Nu5Tdpiuic4kABhuAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAABDdWdWcK0VwqszrOrl3ahpto4YY056isqHfgQQM8XyOVNkRPz qqoiKqNWdWcK0VwqszrOrl3ahpto4YY056isqHfgQQM8XyOVNkRPzqqoiKqRTh84fM11SzWg4n+J +092ulN8LhGESrz0+NU7tlbU1DV6PrnIiKqqnwfTojka2OW1am5PUo43G04WnKNdUodpfwP0fElc rjrpxi4ZJEuQo19gwSCvqaOOzUuycs1W+nfG+Sse1E5kVURu6o5N9mx2P71xwJ/MZ9Jrx97NVAv0 0xTGUPMXLld6qa65zmWVfeuOBP5jPpNePvY9644E/mM+k14+9mqgZaMq+9ccCfzGfSa8fex71xwJ /MZ9Jrx97NVADKvvXHAn8xn0mvH3se9ccCfzGfSa8fezVQAyr71xwJ/MZ9Jrx97HvXHAn8xn0mvH 3s1UAMq+9ccCfzGfSa8fex71xwJ/MZ9Jrx97NVADKvvXHAn8xn0mvH3seS4+Inpl+mv1xWmqjKvk uPiJ6Zfpr9cVoGqgAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAA FNaoa23/AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iN zymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAABiviS429VtFOMHDuH/ABTTy0ZVaMox5lbDSRxyx3SouUy1sVPCyoWZ IYolmgp+d74ncjFlcq9E267S3jZ4h7PxZWvhe4ptJsXxyrymldVWStsFRLI1rVZK+NXufLIkrXLB LFu1GKj29W7AblBizUHjQ1uzfiJvvDXwgaa4xkF2w6F8mQ37KKmVlvp5GK1skTWRPY70XvbHvzKq v59mcrFeve8LvGXnGoes2UcMfEJp5b8O1OxiBaxEtdQ6WguECIxyrGj3Oc1eSWORvpu5mOVfRVqo oaqvN5s+O2msv+QXWjtlst0D6qsraydsMFNCxFc+SSR6o1jWoiqrlVERE3UrdvFfwtvcjGcSmlbn KuyImY25VVf/ANccLjG+KfrD/wAiLz/VJDAXAtofwFZtwtWvJOIGHBWZPLVXFtdUXTJloKpkLJ3p GqtSoYrNmImy7JunygeqVnvNnyG2U96sF1o7nb6tnaU9XRztmhlb/CY9iq1yfnRSHZDr9oTiV4fj 2V614HZbrE/s30NwySjpqhrv4KxySI5F/Nseafk+majVmCcWOCcP97utXjFNS1keCVL5XMd356Vb KZ8Ll2Rk0kLIFcqbbOSJV26Fd8KN88nlj2BVemPGJptdLLqQ2tqorvc73Q16qvO9ezRiwKslM5rF ai7sb6SK5XLv0D2YnyzFqXGpczqcltUOPwUrq6W7SVkbaOOma1XOmdMq8iRo1FVXKuyIm+588SzP D8+skWS4JldmyO0TveyK4WmvirKZ7mLyuRssTnNVUVFRUReioYixXRzS7R/yfWt9JoxrfV6j4jeM ZvdbSyvqYJoKCXuUiSRxpEm8blTkV7HdeZN9mqq75D0d44Lnpnwh4Twx6L3alt+ouV3atpK2+1sy U1Lj9PVVrmsf2rujZXI7m5/CJnpfhcuwew9o1Z0rv+XVmn9i1LxS5ZRbu075ZKS8001fTdmqI/tK dr1kZyqqIu7U2VU3JWULwicI+EcKWCOtFrkS8ZZeeWoyPIpm/D3Co8Va1V3VsLVVeVm/rVzt3Kql 9AAAAAAAA6PNsysWAYxX5bkdUkFFb4le7+FI7wbG1PW5y7IifKpiZimM5bUUVXaooojOZ1RCJa2a pT4BZ6az41HFWZdkD1pbPRu68rv31Q9PVHGnVd+irsnhuqQHBMOhw2zLTS1Lq251sjqu518nWSrq Xru96qvXbddkT5Pzqp1mE2y+ZFea3VjO4Gtv17Y1tJS+KWyhTrHA3fwcqLu5fHdevVXbzc5ddc3q tOdnN/nW9pYw1OAs8np11TrqnfO6OqPGc53AADYAAAAAAAAAAAAAfx6uaxzmN5nIiqjd9t1+QzJw pW618QfETlWb8Q87afUHTetdBjWnVUn9j2GkXl5bmzf0aySRVTaZqcrV5VTbeLl04VBrtoTUah1F r1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cyqiKiua6WzXFFWtRx+HrxFrKidnNvbCBQnC/ xQU+tdPccEzuypiWq2JIkWSY3K7x8ESspVVfhaaTdFRyKvLzIiqqK1zr7OhteWmJicpZA4Ff7bfF P/51az/qccbyhlBSYze9AtY7DEynzKzapWiyUdVGnLLUUNWk3eKRyp1cx6RoiovREc9E25lOh00t nFtw+asa23LHOEypzmzZ9m9XkFsuEWb2i3ItO5XIzeOWRz05kVF9JGqngqEvx7RriB4hNacT1j4n cfsuEYzp1UuuOL4Lbbmlymfc1ROWsrapiJG5Y9mqxGetPBqc3aGHL1v0f1+w/iPpuKzh3s+PZfW1 OLpil+xS81vcpKinbP2zJKSpX0I3q5GIqPVETl32dzej19NxX4RkucYfgXFpwxX3Tm/z3mF+MVuS 0FPdbO27J0i7tcGpysn3d6Lkam26LzN6Et1QouL7T3WSs1K0hpLdqfg16oIKaqwa43eO1VFrqYk2 7eiqHsWNWv6ueki78zlTwRqtgGpOC8U3F/V4nhWpOi1n0iwWw5FRZFdaqpyinvN0rlplcrIKZtK3 s4eZXKivc7dE6p4KxwbOAIJrVrVgGgOAV+ouo127pbqTaOGGNOeorqh2/Z09PH4ySvVNkRPDqqqj UVUChvKDYRptbtPItf67M24JqHhH+5bIKaPnqK2d26ttb4U61Mcy8ycmy8u7nfg9oju+0ayfN8y0 wx3J9R8Q9jGR3CiZNX2ztObsXr4Lt4s5k2dyO9JnNyruqKVZp/p/n+u+f0fEpxKW3ulVSbvwjCHu 56fG6d2ytnnavSSteiNVXKnodOiKjWx6GKN+umqcoek4Mw1yzTNVc7eb6gAIHUAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAIbqzqzhWiuFVmdZ1cu7UNNtHDDGnPUVlQ78CCBni+RypsiJ+dVVERVRqzqz hWiuFVmdZ1cu7UNNtHDDGnPUVlQ78CCBni+RypsiJ+dVVERVSKcPnD5muqWa0HE/xP2nu10pvhcI wiVeenxqndsramoavR9c5ERVVU+D6dEcjWxy2rU3J6lHG42nC05Rrqk4fOHzNdUs1oOJ/iftPdrp TfC4RhEq89PjVO7ZW1NQ1ej65yIiqqp8H06I5Gtj2AAX4iKYyh5euuq5VNVU5zIADLUAAAAAAAAA AAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaBqoAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9 NfritNVAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/0 2rzbq3ZOqb+BeBTWqGtt/wAF4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGyl ygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5y6/ta7yxGhqOaip7E2L1T1 ol32P1xUInvr/Dsu3XzHB/WLiejAA8vsaylfJ/ccesGZa245fY9P9VZ6q62rJqG3yVVOyWaqdVJE 5WJuitWWWNzer0VrF5Va5HEi4WbXk3Ev5QHLuMuz4jebHpxQ2vzZZay6Urqd90l7rFStVjV/CRWt lkVU3RvwbV6qej4Ap7jG+KfrD/yIvP8AVJDEfk8OBnhZ1w4YbBqPqjpal7yKruFwhmrFvVxp0eyK pexidnDOyPo1ET8Hr69z09AFT3nBqjQXQq9WThU0zxuC7WilfV2exPY6KmrahFar2yOa5r3yvY1U Rzn7q7k5nbGKHeUY4fsyw9uKcbHDPdGZ9Rtkpq60yYjHUQyP5l5e7JVydtC7bbo5UVrvBy+J6XgD yP4XNLs7xThV4utRKrCrxhuA5hjlykxWy3TnSVIY4KxyORJPSVrIpYY+12+EVF6rykx4OODzSziT 8nSlguNit1tyi9XS4VdLkbKZq1UFdTzSR073v/CfEjd2Oj325Xv22cvMnp+AMH+T34nsuprzceC3 iOWSg1LwNX0dqmq37uutFE3dI+df3SSOPlex6fukKtf15XOXeAAAAAAAAMzZDfV101A7zFIsmC4f VK2kYrfQulxbujpl9To4/BvqXx/fKiS7iAzi5VUtJo1hdWsd7yGJX3Kqjd1ttt32kevyPf1a3+fw 3ap8LDY7bjVmo7DaIOxo6GJIomb7rsnrVfWqruqr61VShibmnVxcbI2+T1PBGE5Lb5XX69Xq9Uc9 XbOyOrOdzngAhXwAAAAAAAAAAAAAAAAAAVBrtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTS bqjmqi7cyqiKiua6x+F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZSqq/C00m6KjkVeXmRFVUVrnd wVBrtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cyqiKiua6eze0NU7HLx+Ai/HG W/W+bYQKE4X+KCn1rp7jgmd2VMS1WxJEiyTG5XePgiVlKqr8LTSboqORV5eZEVVRWudfZe2vOTEx OUgBBNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4dVVUaiqhg1q1qwDQHAK/UX Ua7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqZR0/0/wA/13z+j4lOJS290qqTd+EYQ93P T43Tu2Vs87V6SVr0Rqq5U9Dp0RUa2Np/p/n+u+f0fEpxKW3ulVSbvwjCHu56fG6d2ytnnavSStei NVXKnodOiKjWx6GKd69n+Gl3uD+D9HK7djXzQAArO0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ3V nVnCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqo1a1awrRXCqzOs6uXdqGm2jhh jTnqKyod+BTwM8XyOVNkRPzqqoiKqRTh74e811SzWg4n+J+092ulN8LhGESrz0+NU7tlbU1DV6Pr nIiKqqnwfTojka2KW1am5PUo43G04WnKNdUoxhWnWSJQ3Tjo4t8UudTJiFtnvWJ6fUUbJnY7QRt7 R1TJHK5jJa9WN515lTk5fU5Gtj2Fp3qDjup2nuP6m41NIlmyS1092pVqEaySOGWNHo2REVUa9u+z kRVRFRU3XY7m8Wm33601tiu1M2oobjTS0lTC7wkikarXtX8ytVUPObTXVe86LeT41n0prKqWTK9K L5d9O7e1P3eZ9bU9nRzMT1+lVvVn97D8iF+IimMoeXrrquVTVVOcy2Rw18T+mvFTid2zHTOO7Q0d mu8tnqIrpBHDM6RkbJEla2OR6LE9siK1yqirs7dE2OzxPXzD801szbQqxWy8yXnAKShqrzcHQxeb 2Oq2JJDAyRJFkWXkVVVFjRE5Xdd02M38OWHUXClxQ1+i9RPFTWXMNLLHemTuVGwrcrNElDV7ermf FtM9fXtupU2Daz5No7wZazcalngijyzWLOKqpsU1XGjm01I6r7pSK5rt90hRKp7UciouzUVFRV3y 1emZXd31xxOy65WDh/qrfdn5DkVkqb9S1McUS0TKeB6se171kR6PVU6IjFT5VQ899QOIHTDS7TpN SNH/AChGZZnqhY0p6ye0Xu6T1Vmv7udveadKF8KRwNc1X8nIrXNRETm39JL/AKnJ6XNuP/Q/M6GJ 0VNftI665wscu6tZO9JGoq/mRyAbNBhjQbGdSeNXB75xB33iJ1Kwtt5vNxpcQtGKXZKC32uhp5XR QunhRi97kV7HK9ZF6p0Tl6bdvrDmvEtjmP6B8NOQ6iW62aj6oXart2RZfjsfVtuoWJJPLSpLG1I6 iSKSLd3IiNej+VERU2DaAMUat2zOuDTM9Kc6xbW3UTLsUy3M6HDMnsmY3t13a6Ota/s6unfI1Hwv jWNyqjVRHLypsicyL+7Xb9RdWeObXLTCu1hzay4LZbPjlalus16mpZY6iSjTlbTyIqrSxuV0skvY ox0j2xbu2RzXBtQGE+HbEtU9Us61l0SzriE1HmxHS3Jlt9kq6G9vpb1VJUsV7Uq7gxEmlbCxiciI qI50siv5kbG1sbtnFjqrpJwOaq5NcspmyPL9PtQLnp3ZL3d0bLNKjKiFkVTULttI+OOZ7t3IvMsb UdvuoHogDyz1A4gdMNLtOk1I0f8AKEZlmeqFjSnrJ7Re7pPVWa/u5295p0oXwpHA1zVfycitc1ER Obf0k9MsKyelzbDbDmdDE6Kmv1spbnCxy7q1k8TZGoq/mRyAd0AABlXyXHxE9Mv01+uK01UZV8lx 8RPTL9NfritA1UAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAi mRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW 9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAGKuJzjW1T0W40NJ+HTFrBilVjed+YfONVcKWpfXRd9u01HL2L2T sjbtHE1W80btnKqrunRNqnlXx9f91N4cv8UP/wAI6oD1UAAAAAAAAAAAjOo2eWnTbD7hl143fHSM 2hgavp1E7ukcTPlVztk/Mm6+CKSYzTkV59ufVF1UxyS4dg1Q6GjRU3ZX3ROj5t/BzY+iN/P1To5S DEXeKp1bZ2f51OnwXgoxl7O56lOury7Z2d88z+6dY9d6aOuzPMHdrlGTSpWXF6p+4N2+Dp2/I1jd k2+X5dkJkAc+I0YyeouVzcq0p/8Akc0R1QAA2aAAAAAAAAAAAAAAAAAAAAACoNdtCajUOoteomnd +XEtUcSVZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXWPwv8AFBT6109xwTO7KmJarYkiRZJjcrvH wRKylVV+FppN0VHIq8vMiKqorXO7gqDXbQmo1DqLXqJp3flxLVHElWbHshhT+VVpKpET4Wmk3VHN VF25lVEVFc109m9oap2OXj8BF+OMt+t82h9atasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GS V6psiJ4dVVUaiqmUdP8AT/P9d8/o+JTiUtvdKqk3fhGEPdz0+N07tlbPO1ekla9EaquVPQ6dEVGt ji/DlSZVxcz2Di+17raG4PjSaHDMYo2OS22TsZnQTVaseq89S+WF6o5yryojVRd0akerje9e/dpQ cHYCIiL1z3R9QAFV2wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACG6tatYVorhVZnWdXLu1DTbRwwxp z1FZUO/Ap4GeL5HKmyIn51VURFVJkZ/4O9PZeKWrtHGrrHJBXU7qirj0/wAVaqvo7BDBUyQPqpUV ESWrdJC5Ufts1Ea5OvIkctq3xk9SljcXGFo1bZ2JHw98Pea6pZrQcT/E/ae7XSm+FwjCJV56fGqd 2ytqahq9H1zkRFVVT4Pp0RyNbFsAAvxEUxlDy1ddVyqaqpzmQwjqpwlauZDxs0mS47j0MmkWW33H Mzyyt79TsSG5WaGrZHTrTukSV7ZXLC5ysY5FV6Kq+i7bdwMtWRfKD6I60akWbD834ecfbd81x7z1 ZH0/fqekXzXdrbLS1EnaTyMYqsckTmt5t+Zd0TopKNR+EOmzPgtoeF2zXWC13CzWS2wW24uaqxsu VH2ciSv2TflklY7nVEVUSRyoiqiIaSAGXo9ROPe+2W34fS8O+LYvkSugguGY3HKaaus7Gtc3tqiK hg2qX87Udyxu5OVXJu5dtzuMq0o1CufHDp/rBTWNs+J2TB7jZ7hc21ELEjrJZVcxiQuf2q7p13Rr mp61NEgDFml+F8WHCLZ8k0d0s0PtGpmIzXitueI3j2U01sW2Q1T+fu1bBOiPekb1VeaJV5kVfDf0 e11A4duJK96faO6jV2a2bM9b9JrvNe51qWR0FBdoarpVW+N8UTWxfBJHGyVzE37NVcic3o6+AGQ8 xwTiI4qs803pNUNHabS7A9P8lpswuDKrI6W61t4rqVrkpoIm0u7I4kV7+dz3Iqo7oiK1EWbaW6U5 9jnGTrdqtebD3fFsvtWOU1mr+9Qv71JS0qsnb2bXrIzld03e1qL6t0NDADPPDZpTn2Aaya/5Xlth 7has2yumudiqO9Qy97pmU6sc/lje50ezumz0av5iorJwZ6gZzw368aQZnTx4tecy1SvOX4tWSVMV Qzs1mppaOof2Dn8jHrC5jmqnaNa5V5d9kXcYAy9HqJx732y2/D6Xh3xbF8iV0EFwzG45TTV1nY1r m9tURUMG1S/najuWN3Jyq5N3LtuafjSRI2pK9rno1OZzW8qKvrVE3Xb+TdT9AAAABlXyXHxE9Mv0 1+uK01UZV8lx8RPTL9NfritA1UAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAA AAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlIpk Vr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5V8fX/dTeHL/FD/APCOqPVQ8q+Pr/upvDl/ih/+ EdUB6qAAAAAAAAAHFul0t9kttVeLrVx0tFQwvqKiaRdmxxsRVc5fzIiKNjMRNU5RtVfxCZ5c7FY6 PBMRm2yfL3uoqVzeq0lNt8PUr60RrFVEX5V3T8E6HFsbtuI4/RY7aYkZTUUSRou3V7vFz1/O5VVV /OpGMGkrs9yO6az36F8ct6/sWy08myrSWxiryInyOeu7l/l3TxJ4cqqvjatPu7P1e2tYeMDZjDRt 21fzbv8At2duc84AAyAAAAAAAAAAAAAAAAAAAAAAAAAADN3k6Pibaffpb9a1ZpEzd5Oj4m2n36W/ WtWaRNrnrz2oML7Cjsj5AANU4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABXHkuPiJ6Zfpr9cVpY5XH kuPiJ6Zfpr9cVpawvO4fDP7nv+jT93uUFmtNbeKmOR8NDTyVMjY0RXuaxquVGoqom+ydN1QzLSeU N0pummtPrBYtM9Urth7YUmut2obDDLBZvS2c2pd3jZXMRWuf2HaoxHJzKi7omic6/wBxGQ/8VVf+ pcYq0GpKaDyPV0jhgY1r9NcvlciJ4vVLg5XL+ffqW3DXHk3HfpDjVpp829jGeXTT2aoippM8t9j7 SwwOkekfM6V0jZnMbI5I1eyJzedFaiq5Nif6zcROnmiEFihyFt3vN6yqd1Nj9gx+hdX3O6va1HP7 CFqoita1UVz3Oa1EVN16oZd1RpKan8jxRQwwMYxdNcflVqJ053d0e538quVV/lUj2qNm1CruNLQO TFtTqLAp7xpOtBYbxcbEy7QyXBjnvqaeOKSWNqSvgki9Lm322bsvMgGrtKeKXBtUc2q9MavF8xwb NKSi85Nx/L7SlBV1NHzcqzwK18kczEd0Xleqp16dF2i1x44cEW736jwjSbVnPbXjNdNbbpfsWxjv dthqYV2mjbI+VjpVYv4XZMengqboqKsNp9Ds4Xin0sy/WHjAxvIctxOlu1VZscpsNgtNZcaKeDsa lOZlY9zmN6ORVY5EVr9v3yp12E6OahY7b77qFwKcTmOVWF3m8V90dimSWxtwtDLgsi95ZHWRK2op 2c7VTk2XZFRd18VC5si4vtFLHpRi2r9BdbnkNqzmojosZobJbpKq43arcrk7vDT9Hdo1zHtcjuVG ubyqqKqIvz064scNznUCi0sv+A6gae5TdqWastNvzGyJQrdIoU5pu7SRySRyOY30nN5kcidduilI W3J9OeNXQ/SDJsiy9ukGo8t+rZsNntU8b+S70LpIqjuzJE5KiB7Wo5WKqKu6N5lXfmklj1P4idFO IDTnRfX6/wCG6j2zUNbjTWPJLVa1tl3o56aBJXuqKVHOi7JzeVN4ttl3VV2aiKE3yfjSwW1ZhkWF 4VplqfqPVYjUrQ36pw3HO/UtuqkTd1O+V8kaOlb++ZHzqioqeKKhNMY4kdHcs0Tl4hLblscWE0tJ PV1lbUxPjkpOxVWyxSxKnOkrXIreREVXLty83M1Vzdofk+svEZj2da01XEO3SHEbbkt0oYrLYbDa t6SGkVEfU19XWQyOWZW7K78FqIiL4KiNzPb33C8eSg1sms9bWXGNuo9RPUyyRJFPNT+caB7nvjai IxVRUe5qNRE69EQDaFw8olpNYcIm1Fy3TLVbG8dlpFq7PcLvjbaaC+Jy8zY6SRZuTnezd7GzOi52 tVW7+BZWpPFBptpfjuJXi80t+uV1zxkbscxuz29a28XJXRNkc2OBjtvQa9qvcr0Y3f8AC6pvUHlG sl07k4Cspqe+UEtsvtDa2442NzVSokdUQSwLBt47RsdJ08GMcvhuVFqDZNQazjE4e3YrqbQ4DNd9 Im2+w3e42Jl1gfcGcz6mnjhkliakr4Hxelzb7bN2XmQDWulPFLg2qObVemNXi+Y4NmlJRecm4/l9 pSgq6mj5uVZ4Fa+SOZiO6LyvVU69Oi7WTmuSz4di1wyWmxa95HJQRpI212WGOWuqt3InLEyR7GK7 rv1e3oimW6fQ7OF4p9LMu1h4wMayHLcUpbtVWbHKbDYLTWXGing7GpTmZWPc5jfRciqxyIrX7fvl TX4GA+ADWm9ZBhOXa/65ZVqt2bqe519xu+Q10a4hS00NWqJFQQNkVzJmNbsqJGn79rd/RRbfj4/9 L4LZQ5fkOmOrGPYLcpYmU+a3XFliszmSuRsUzntkdMyJ6ubyvfEiLzJ8pkKht18ufkXMhhsUc0j4 rpVVNUyJF5lpY8gR8q9PU1rVc7+9a42RxfZXp3LwI57f6Wvt7sau2Fujsr2ub2Urp4Wtomx+pV53 RcqJ8n5gJTrDxZaZ6KZhjmEZNbcjuVwyy21Nxs/mWhZWpWLE5jW08bWyJJJNK6VjY2sY5FV26uai KpZeC5VJm+JW3KpsXvuOPuMSyra75TNp6+l2cqcs0bXORrum+yOXoqdTDmP2C40nEfwP2rMKR63e 06YXBKqOob6cdXHZ42u5kX9813N+fdNz0BAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK0DVQAAA ADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8l vbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/AILxGaI6NW602+otmp/sl841 UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAHlXx9f91N4cv8UP/wAI6o9VDyr4+v8AupvDl/ih/wDhHVAeqgAAAAAAABQ3EJfZ cwvtq0OtE72xVqNueRyxOVFioGO9CHdPB0j0/mRG+pS4cwym14Ti9zyy9S8lHa6d9RJt4u28Gp/f OXZqfnVDPumFquk1LcM/yhn/AGQZfUecapF8YIVT4CBPXsxm3TxTfb1FPF16otxz7ez9fN3+A8N+ KcZXso9X+b//ADGvtyTSCCGmgjpqeJscUTEYxjU2RrUTZERPkRD9gFZ2QAAAAAAAAAAAAAAAAAAA AAAAAAAfxUVUVEVU39aeoyJQ8f8Aj+nWql60S4lLE7F7xZ6xaeG/0MT5bbWwO2dDO6P0pYEexzF2 TtGpuu7m7GvDAHlWdA/ZBiNq18x+i5q7HOW2Xvkb1koZH/Ayr/wcrlb/ACTfI0ktxTVOjUqYyq5b t8Za2xzb4RLh949dLOHrhNwfBKe3XDKs4gbcd7NRtWKOB0txqXxJNO5qonM17VRI2yO6puib7noT p3VZpXYRZ7hqJS0VJkdZStqbhSUTXNhpJH+l2DeZVV3ZoqMVyr6TmqqbIqInkl5NvQP23NcYszvd F2uO4D2dzm527smrlVe6xfn2c10q/wDBIi/hHsgbX4ppqyhBwbVcuW9KvZGqI7OcABC6QAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAABXHkuPiJ6Zfpr9cVpY5XHkuPiJ6Zfpr9cVpawvO4fDP7nv+jUdfRU tzoai21sXaU9XE+CZnMqczHIqOTdOqboq+HUhdi0O0txrR6XQOyYv3bBJrXV2Z9p77UP3o6pJEnj 7Z0izel2snpc/MnN0VNk2nYLbhoJdtDtLb5o8zQO6Yv2+CR2umszbT32obtRwIxIo+2bIk3o9mz0 ufmXbqq7qfzULQnSPVbDqHAdRMGoL5ZLYkXcYKlX9pSOjbysfDM1ySxvRqbczXo5U8V6k8AFYaT8 M2hmiFyrb5pnp/S2u63GNIKq5T1VRXVskSKi9n3ipkklRm6NXlRyIqonTohFsr4F+FPNMiuOVX3S SmS4XiZ1Rce43SuoYKyRy7ufNBTzMikVyqqqrmLuqqq77qf3VfjK0n0tzhdLqO1ZdnubxQpUVON4 VZX3WupIlRFR0yNVrI90VF2c9HbKiqiIqKrSTjK0p1WzhdLaqz5fgWbugWpp8bzayvtVdVRIiq58 LVc5kmyIq7NcruVHORFRqqgTHK+HTQ7NtOrfpNkumNjqcStHItutkcHYR0Lm78roHRK18TvSd6TH I5eZ26rup1WlvCfw+6MZE/L9PdOoKK+vgWmS51lfVXGrjiXxZHLVyyvjavgqMVN06Kdvp7rjiepW oWoemtit92guemlbR0F2lq4omwTyVMTpWLA5sjnOajWqi87WLv4IviWIBStdwY8Mdzzqs1HrtJbd NerlWpcq3eqqe51VWjubtpaJJO7SP5vSVzolVXbqu69RfeHnT3A7Rqbmek2kFmuuWZzRVUtztFfc J2W++zybufFLFI50ESyrujnNjbuq+ku26l1ADy6ynSbHM00pq9I9DuBLUXCdSMtghtNbc8jpKpbH jkT5431slNW1U8kaRqjHtRKdrXPa7qn7xfQDMNANKtStPLPprqbiNDk1qssFPFS96a5ksMkUaMbL FKxUkhfsn4THIuyqm+x/dSdccT0tzXT/AATILfdqiv1IustotUlHFE+GGaONJHOnV8jXNbsvRWte u/qO2xDURMuynLMWTCMssy4nVw0i3G723u9Fde0Yr+0oZeZe3jbtyuds3ZyogEe0n4ZtDNELlW3z TPT+ltd1uMaQVVynqqiurZIkVF7PvFTJJKjN0avKjkRVROnRCzwAIXp3o3pppTgCaW4LisFDiqLU 72yeaWsjelQ9z5mvWoc9z2vc9+7XKqbLttt0K7snAtwoY9kFJklr0ct6VFvqu+0dNPXVdRQ00++6 SRUUsrqaNUXqnLGmy+GxfAAiV60pwHIdRcd1YvFh7xlWJ01XSWe4d6mZ3aKpbyTt7Jr0jfzN6bva 5U9WxLQABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritA1UAAAAAyr5Lj4iemX6a/XFaaqMq+S4+I npl+mv1xWmqgAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4 uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLw AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFO2nXLL75b4rpa9Ke3pZ+bs5PPsTd9nK1ej o0XxRfUXEZ/0o/3AWv8A5/8A17zn4uu5F2iiiqaYmJnVlzaO+J3qeJuV01UxTOW3d1b0p9tzP/mh /p+D9ge25n/zQ/0/B+wfQEP+t+bPdT9qDjLvTnw8nz9tzP8A5of6fg/YHtuZ/wDND/T8H7B9AP8A W/Nnup+04y7058PJ8/bcz/5of6fg/YHtuZ/80P8AT8H7B9AP9b82e6n7TjLvTnw8nz9tzP8A5of6 fg/YHtuZ/wDND/T8H7B9AP8AW/Nnup+04y7058PJ8/bcz/5of6fg/YHtuZ/80P8AT8H7B9AP9b82 e6n7TjLvTnw8nz9tzP8A5of6fg/YPNbjay6/3fykegl+r8Q7hXUXsW7Cg84Ml7xyX6pe34VGojOZ yq3qnTbcuDUrjpvnDLrrcdK9esSkuGMVvLcbBklpjRtQlDKq8rZ4FVGyLG9HxucxWrtGi8jlcZu4 pdZtLdRuOrQnUzDc5tVwxiljxqSruPbdlHRpHe6iSRJ+fZYVYxUc5JEaqNVFXoqKWLVF6JzqrmYy /h+kQnt8bnnVVMxl1eT1a9tzP/mh/p+D9ge25n/zQ/0/B+wYl1V8plikmTUemHDRjTs9yu71kdto 66pR8FsbUSPRjeVOks6cy9duRu3VHqhs7H6W8UVit9JkFzZcbpFTRsratkSRMnnRqc72sTo1qu3V E9SbJuviQzTiKY13Z7qftRVVXqY11T4eSwsAy32dYjQZT5v7l33tfgO17Xk5JXs/C2bvvyb+CeJI SvdAP7Udh/wr+sylhFzC11XLFFdW2YiZ7lyzVNdumqdsxAAdLmmV2zBsUumXXh+1JaqZ9Q9N9leq J6LE/O5yo1PzqhPMxTGcp6KKrlUUURnM6oUxrldfbA1Bs+kNK7ntdn7O+ZFt+C9U/wBrUzv5VXnV PWitX1HfEL0stFzis9VluSJvfsrqXXa4KqbcnP1jiT5EYxURE9W6oTQ5WlNyZrnn+XM9xxVOGt04 ajZT4zzz37OqIAAZagAAAAAAAAAAAAAAAAAAAAAAAAAAFc8QeZ6YYVpLkNXq7K12O3Gjltk1E1Oe e4OmYrEpoGeL5X7ryonhtzKqIiqnaatatYVorhVZnWdXLu1DTbRwwxpz1FZUO/Ap4GeL5HKmyIn5 1VURFVIpw98Pea6pZrQcT/E/ae7XSm+FwjCJV56fGqd2ytqahq9H1zkRFVVT4Pp0RyNbFLatTXOf MoY7GU4anR21Tzeao/J2yYZhGnNfotNYrpjGodnrJblkVmvcHYV0rZlRYKlrVROaLsexZ0T0VTqi cyK7XJ0/FBwv0+tdPbs7wS9JiWq2JIsuN5JE3x8VWjqkRPhaaTdUVqovLzKqIqK5rq40K11qNQ6i 6ad6iWFcS1RxJUhyHHpl/kRKulVV+FppN0VrkVduZEVVRWudvftTE6UIeDsZTcpizVqmNnX+q3wA V3VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlzS3iW4sdacEtmpmmnA955xu89t3Kt9su20/a9 lM+GT4OaJkjdpInt9Jqb7bpuioqyr2xOOz8QL61bP+yTLyXHxE9Mv01+uK01UdDiLe55X0liul4R 5MR+2Jx2fiBfWrZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61b P+ybcA4i3uPSWK6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvceksV0vCPJiP2xOOz8QL 61bP+yPbE47PxAvrVs/7JtwDiLe49JYrpeEeTEfticdn4gX1q2f9ke2Jx2fiBfWrZ/2TbgHEW9x6 SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2Jx2fiBfWrZ/wBke2Jx 2fiBfWrZ/wBk24BxFvceksV0vCPJiP2xOOz8QL61bP8Asj2xOOz8QL61bP8Asm3AOIt7j0liul4R 5MR+2Jx2fiBfWrZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61b P+ybcA4i3uPSWK6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvceksV0vCPJiP2xOOz8QL 61bP+yPbE47PxAvrVs/7JtwDiLe49JYrpeEeTEfticdn4gX1q2f9ke2Jx2fiBfWrZ/2TbgHEW9x6 SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2Jx2fiBfWrZ/wBke2Jx 2fiBfWrZ/wBk24BxFvceksV0vCPJhez8Quu1p1lwPSTWvhe9r/2wPOnmy4ezajuu/caVaib4KmjX 5Ym+k5v7punNyqhoUp/i3+OTwo/49fqqAuAq36Ioqypdrg2/cxFqark5zn9IAAQugAAAAAAAAAAA AAAAAAAAAAAAAFceS4+Inpl+mv1xWljlceS4+Inpl+mv1xWlrC87h8M/ue/6NVAAtuGAADGnktKC lvGg181fucbJsv1By27XPIa16bzvmbO5jInO8eVqbuRvgiyuVPE1FlWl+n2cZBjmVZZidBc7viNU 6tslZOzeWhnciIr41RfXs3ou6btRdt0QzBbdIuJXhM1By26cOOFWXUzTPNrrLfpMQq71HaK+y3GX btlpqiZFhdC7ZPRd1RGtbsnKr3yTHLDxh626o4vl+qlBT6L4JiFZ5y9i9myJLlc79VI1WtjrKmBG w91TdVWNN+bdUVFXlewKn0m0wyXVXi74orJFqdlGG43S32yy1vsXrUobjX1LqJyRNWqRrnxRRtSR VazlV7pG7u2YrVnHDJm2o2P1HEdo5k2rlRdmaUXFqY/leXzJUy0dNU0ck0bq2VVZ2zIVjRznOVFV Obq1NkbPeHrSnPsG4heIbOcpsPcrJnN6s9XYKrvUMnfIoKR8cruRj3Pj5XORNpGtVfVuhVt64VNV 81m4wLJUUcVjp9W5LU7FLhLWRPjrFp6Z3Mj2xOdJExZEbG7nai8r1VEciAUTnmq1mxfRq46oaf8A GlrrmGpdkgSvS5QWu6OxGuqmSIssXd3UaUTadU52ovPsi7KrlT0S8+J3UnVfJX8KtVp3m9yw+v1L uTIri631MjYWx1lBE573w78k6wpK+SNsqObzsbuniMrwbi51n4Y6rhwl0UsmmDKfF2Wqouc+SUtc y4PpoESGmo4KffsY55I40dJM5Ozjc9Ea92yp910l1/zOi4U6vINJHWCr0rvTIslp1vlDUpT0sFFH A2qa5kmz2yOYqpGzne1PFAOLrtp9HplrBwnYnHmOVZR2OeXOZblk10dcK+RX0zXKjplRN2pvs1uy IidE6HEpuIjNdK7nxo55cL5cr5Fp/cLd7Hbdca2WekopZaVzY2RxudtHGsz43Pazl32X19S4+JLS nPs/1p4f8txKw9/tOEZTV3K/VHeoYu5076dGNfyyPa6TdyKm0aOX8xBbTwqZdml64scaz62rZrBq /WUXsfuSVEE/aJHSOak/ZMer29nN2a8siMV23T5QM2za7abw6M+2RT+UZzaTWyO0ee1oHXKVbHJc +y7Vbd5t7Du6Rc3wKL8vpeHonolw+6nSaz6I4RqpPSR0tRk1kpa+qgj35IqhzESZrd+vKkiPRN+u yIUPieTcemHaZ2vSCk4eMarMlstuislLnEuYU3mZ7YmJHHWyUnKlWq8rUc6NGJu7fqiLypaWuGp+ qejuCYDdbXj9myi63TKrDjeSSo5aWGKKtkSnkqqaJZFe5e8PhRsSK9UbIqru1rnIFzgAAAABlXyX HxE9Mv01+uK01UZV8lx8RPTL9NfritA1UAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgA AAAAAAAAAAAAAAAAAAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9 PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSsAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ/0o/3AWv8A5/8A17zQBn/Sj/cBa/8An/8AXvOdi/2ijsq+ dKji/Xp7J+iWgA1QAAAAAAAAAAAyJ5Szh/8Abe0LlzWyUXa5HgHaXSHkbu+agVE73F+fZrWyp/wS on4R4yn+lOWKKeJ8M0bZI5Gq17HJu1zV6Kiovih4Z8UXC7f9L+J+fSHD7TLUUuVV0M+KRtRdpIKq Tlji3/8AByc0Sqvqj5l6KWrFerRlbw9erRlf3kneH/2Q5hdeIDIKLmoMb5rXY+dvSSvkZ8NKn/Bx PRv8s3ytPVAguhuk9k0P0oxvS+xcrobJRtimnRuy1NS7d08y/nfI57tvUionqJ0QXKtOrNXuV6dW bsdAP7Udh/wr+sylhFe6Af2o7D/hX9ZlLCJsD+y2/wCWPlC5h/Y0dkfIKB17uns3zvHtHqV3PQUf Lf8AINvwViYu0EDv/Gf1VPHblUvG93i349Z66/XWdIaK3U8lVUSL+9jY1XOX/Ihm7SuGuvMF21Nv sXJdMzq1uCtXqsNIno08SL8iR7Kn5lQ1xdeqLcc/yel4CsfjqxdX7mqP5p2d0Zz25J2ACs7IAAAA AAAAAAAAAAAAAAAAAAAAAABDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIi qjVrVrCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqpFOHvh7zXVLNaDif4n7T3a 6U3wuEYRKvPT41Tu2VtTUNXo+uciIqqqfB9OiORrYpbVqbk9SjjcbThaco11ScPfD3muqWa0HE/x P2nu10pvhcIwiVeenxqndsramoavR9c5ERVVU+D6dEcjWxbAAL8RFMZQ8vXXVcqmqqc5kKE4oOF+ n1rp7dneCXpMS1WxJFlxvJIm+Piq0dUiJ8LTSbqitVF5eZVRFRXNdfYM7WImYnOGPdCtdajUOoum neolhXEtUcSVIchx6Zf5ESrpVVfhaaTdFa5FXbmRFVUVrnW+dPxQcL9PrXT27O8EvSYlqtiSLLje SRN8fFVo6pET4Wmk3VFaqLy8yqiKiua6uNCtdajUOoumneolhXEtUcSVIchx6Zf5ESrpVVfhaaTd Fa5FXbmRFVUVrnUb1nQ1xsejwGPi/HF3PW+a3wAQOoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArj yXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVHVeHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAY84t/jk8KP+PX6qgLgKf4t/jk8KP8Aj1+qoC4ClifXjsej4I9hPb9IAAV3VAAAAAAAAAAAAAAA AAAAAAAAACuPJcfET0y/TX64rSxyuPJcfET0y/TX64rS1hedw+Gf3Pf9GqgAW3DAQjWHWTANCcKm z3Ua7vorayeOkgjhhdPUVlVIqpFTwRMRXSSvVF2anqRVXZEVUrzD+MbBsgzqy6d5hp3qPpvd8nVz LD7M7ClBBdZWpzLDDKySRqS7dezerHdUTbdURQvoFG5ZxeaeYpq1fNDm4rmV6zKz0VHXQ22z2yOp fcmVDXP/ALH2lTZI2tVZHzdlG3dqc6q5qL3WjPElhGtF1ynF6KyZJiuT4XJC2+WDJqFlHXUjJmK+ KVUY98bo3tRVRzXqm2yrsjmqoWwDMNZ5QfR2CnrMloMH1NuuB26qfS1We2/F5JsfjVj+zkkSdH9o +Jr90WRkTm7p0Vem8t1R4wdJtKchxPHbpT3+9S5zZ5rzYJ7DRsro7gxvZpFDC1siSSSzLNGkaMY5 q826uam6gXiCmtOOKHFdQdTk0frcFzXDsqfjceVQUOTUEFK6ehdN2K8qMmkd2jHps5qongqorkTc 7PK+IjC8T1fg0TmtN8uOQPxerzCpfQwQvpqG3QOczmmc+Vrmuke3kYjWuRXKm6tRdwLSBl6xeUC0 2y7AI9T8J0l1ZyTG4qZ1Rda6149DLHaOXdZI53LUI172M2e9IFl5GuTm2XdE6Lik4zavENO9Kc10 PtuQX616iZNZo4L3a7fTTwT0T595qBG1DkVtXMxkkbWKxOVUfu+NzUA18cC6WGx3x1E+92ahuDrb Vsr6JaqnZKtNUsRyMmj5kXkkRHORHt2VEcuy9VKozniowbTjFcTvOX4pmVJkWbPdDZMKhtTanIaq VnWSNKaGRzEVjdnOcsnIiOTd26oh+tKeKXBtUc2q9MavF8xwbNKSi85Nx/L7SlBV1NHzcqzwK18k czEd0Xleqp16dF2C5AZ+uvGnp7BnOQ4Tiun2pObMw+qWhyK84vji19utdS3rJDJIj0fJIzrzNiZI qbKmyr0It5PfUi8apYnrDktwzW5ZPQN1eyGnsdXWV0tU2K1pHSvp4oFkVeSBGyKrGN2anMuyJuBq oAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaBqoAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9N fritNVAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02 rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAM/6Uf7gLX/z/APr3mgDP+lH+4C1/8/8A695z sX+0UdlXzpUcX69PZP0S0z5kPGXjlo1GynTGwaK6s5hdMOmggus2N2KnrKeJ00faR+ktS1yI5Obb mam6td8hoMwrp/xAaTaGcXPEi3U/Jai0rerlYFoeytNZW9r2NHL2m/dopOTbtWfhbb79N9l2zRGe aOinPPVm0HpfxWafal5s7TSrx3MMIy91M6sp7Hl9nW3VVXA3dXSQ+k9kiIiKuyO32Ryoio1VT6aj 8UmB6f5pJptbcbzHOMtpoGVVZZsRszrhUUUL0RWPncrmRxcyKiojn77K1dtnJvStfmFFxXcUekeV aQWK9y4tpk+53G85TWWqehp5VqImMjpIe3ax8jlcz0k26I9V8EXeRZFp5xDaG65ZzrJophlk1Fx/ UXuNReLDU3NtuuVLUUsSxosE8iLG6NUc9dl3XdyIjU23dtoxm20ac9aydMeKXT/UrNZNNKmw5bhe YNpVrYrFlloW31VTTp+FJD6TmSImyr6Lt9kcqIqNVUkeC604tqDqLn2mVmoLrDdNOp6Gnuk1VFG2 nmdVxvkjWBzXuc5ESN3NzNZsqptuVbgXERpvqHq3YMT1Y0UvGAaoU8FS7HvZPaonrI1WfDtt9aiL vu1qo7bk5kRUTfwM1ZbqlrBp5rlxV0OiWDXa7364y2WpqLtS07ZYrHQ09FL21RyuVEknVJU7KLxc rXu2VGKiooz1EW85mG3aXXrELtrJUaI41bbzfbza6VKu911vhidb7Lzb9nFVTOkaqSv29GNjXu9a oiI5Uskp/hRxrSOw6LWSv0buLrvaL4xblVXmodz1tzrX/u81W5evb86Oa5q/gK3l8ELXukFdVWyr prZXpQ1k0EkdPVLCkqQSq1UbIrFVEfyrsvKqpvtsaVZZ5QjqyzyhyQZ89p7jA/HNtv8A+zGj+8lo 6WY1qVi1hqaDVHU+DOrnJVumgr4bDFaUhgVjESHso5Ho5Uc17uffdefbboJiI5yYiOd89YdZNP8A QnCKnUDUi8+b7VTyMgYjI1kmqJ378kMTE6veuzl28ERrlVURFVKC0z4n+Fjic1qxNyWK/WnPMZir J8ZbkNvZTOqGTw7SrCrJHtevZtVzUcqL0VWp0Ur7ymq+dNQeHbDbg3tLPeMpnWtgf1jl5Z6CNOZP BfQnlT+Ryn88oajcd4iOGPLbPG2G6+yKSmWRibOkhjrKBWRrt4t+GlTb/wAIvyklNEZRvnNLRRGU b5zb1ABChdjoB/ajsP8AhX9ZlLCMe4lrNxY4pj1JYNNOC/2d43S9p3LIPbFttr75zPc+T+xZmLJH ySOfH6S+l2fMnRyHce6H47PydX1u2f7Ms4H9lt/yx8oX8P7Gjsj5J3xMXiW8QWDR62zObPllWktx cxdlitsCo+VVVPDmcjUT5dnJ6zkwQQ00MdNTxtjiiajGMamyNaibIifzGSLXrxxa5vnl41XpOCxL iyohZZ6KNuo9tYyjihVe0Yx7o/hOaTd3MiIm++25Kfb04yfxEvrPtX2ZXqiblc16urXGz/Nb2tmu jC4ejD5TnGufw1etO3m5oyj3NIgzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7MxoT1d8NuUUbp+GryaR Bm729OMn8RL6z7V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq8mkQZu9vTjJ/ES+s+1fZj29OMn8RL6z 7V9mNCervg5RRun4avJpEGbvb04yfxEvrPtX2Y9vTjJ/ES+s+1fZjQnq74OUUbp+GryaRBm729OM n8RL6z7V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq8mkQZu9vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCe rvg5RRun4avJpEGbvb04yfxEvrPtX2Y9vTjJ/ES+s+1fZjQnq74OUUbp+GryaRBm729OMn8RL6z7 V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq8mkQZu9vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RRu n4avJoK/1l0t9juFfY7U253CmppJqWhdOkPepWtVWxdoqKjOZU5eZUVE33Ki0P4wdEdeHNtWN5Gt qyRqqyfHry1KWvZIn4TWtVeWXZUXfs3OVPWieBGvb04yfxEvrPtX2Z5X8WiXmm4hsouN406bp9eq ypiuNbY4L5Bc+6VUsbZHyJPAiNRZFd2vL4tWT+Qlt2tLVKpisbNjKuiJy54mJjxmHvCQ3VrVrCtF cKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqp5tcF3Ftxi3G802EWTErhqzY6dWxzJX SLHNQM9SrcXeixNvBJuffbZuxrrhQt9s4hOIfKc44iZW0uoWm9a6HG9OapP7HsNIvKrbmzf0ayV6 qm07U5WqjVTbmi5c02J0splrc4TpizxlETnO/Z3rA4e+HvNdUs1oOJ/iftPdrpTfC4RhEq89PjVO 7ZW1NQ1ej65yIiqqp8H06I5GtivjDdd8QzjWTUDQ+0268RX3TeO2S3WoqIYm0kyV0Hbxdg5sivcq NXZ3Mxmy+HMnUsg8v9S9WNa9NOLzizpOH7Ti65Nl92tONSx1tNTtkgstLT2hjpqp6OVEkm2eiQw9 Ve/fo7lVjrkRFMZQ87XXVcqmqqc5lu2XiLwmfXOPh9xy1XzI8kp6Pv8Ae6i1QQyUOPwr+59+mfKz s3yfvY2Ne9U2VWoiopAs144MXxTV3K9F7HoZrBm99wtKJ12lxSwU1dTRJVU7J4V5lqWPRFa/b0mJ 6TXIm6JuvZ8EeN6MWvQaz5Jozepsgp8p3ut6yCvXmuV0uj1/siStXdVSZr+ZqsVVRm2yKv4Tq+4e v+6F8Vn/AJJhv6rQy1WTpZxk6SanZszTCst+V4Jm80Tp6bG81sslprqqNEVVdCjlWOXoirs16u2R VRFRFVPlrZxgYpopqdaNIZdLNSs2yW9Wd18p6XELPBXuSmbK+Nyua+eN+6LGqrs1URFTr6itfKm2 232/hnTVej7Oly3T3IbTd8buDE2np6payKNzWOTryq1yuVu+yrG1V6tTaHcQup66WeUT05zOp0+z PKne1fVQvtWJ2h1zuCOkq5t3JC1yKrG7ek7fp0AuzFeMWpynJ7RjLuEviIsyXaugoVuN1w2GCio+ 1kRnbVEiVLlZEzm5nuRF2airsvgc7ig4X6fWunt2d4JekxLVbEkWXG8kib4+KrR1SInwtNJuqK1U Xl5lVEVFc13GwrjFp80yy1Ym3hi4hLGt1qmUqXG9YFLSUFLzLt2k8yyKkcaet23Q0INrMTMTnDH2 hWus+ok90071EsK4lqjiSpDkWOzL/IiVdKqr8LTSborXIq7cyIqqitc63irvKDYRptbtPItf67M2 4JqHhH+5bIKaPnqK2d26ttb4U61Mcy8ycmy8u7nfg9ojqtxvX/jSuGP22uq+BvvE9RSRSyTe2Bb6 HtHOaiq7u8rFkh3Xr2b1VzfBV3Qo3bOjOcPR4LH8bRlcic43RM/JqMGbvb04yfxEvrPtX2Y9vTjJ /ES+s+1fZkWhPV3wu8oo3T8NXk0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NI gzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7MaE9XfByijdPw1eTSIM3e3pxk/iJfWfavsx7enGT+Il9Z 9q+zGhPV3wcoo3T8NXk0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NIgzd7enG T+Il9Z9q+zHt6cZP4iX1n2r7MaE9XfByijdPw1eTSIM3e3pxk/iJfWfavsx7enGT+Il9Z9q+zGhP V3wcoo3T8NXk0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NIgzd7enGT+Il9Z9 q+zHt6cZP4iX1n2r7MaE9XfByijdPw1eTSIM3e3pxk/iJfWfavsx7enGT+Il9Z9q+zGhPV3wcoo3 T8NXk0icC/1l0t9juFfY7U253CmppJqWhdOkPepWtVWxdoqKjOZU5eZUVE33M++3pxk/iJfWfavs x7enGT+Il9Z9q+zGhPV3wcoo3T8NXkkuh/GDojrw5tqxvI1tWSNVWT49eWpS17JE/Ca1qryy7Ki7 9m5yp60TwLsPB7i0S803ENlFxvGnTdPr1WVMVxrbHBfILn3SqljbI+RJ4ERqLIru15fFqyfyGiuC 3i24xbleqbB7LiVw1YscDmRz9+esc1BH8q3F3osTbwSZX77bN2JqrGrSpc+zwlnXxV2NezOI+m16 IeS4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqouvPAAAAAADz54ZsM1S1+4f8ANsszXiK1PoKuzZBk FDjrrRkk9M+nSCRzmy1Em6yVOz3ciRvcsbY4mo1qKrnLxsHh1m1p4C6rihy/iCz+2Zra8Xut2tDL BdVt1DGlrSZrO808SI2qfO6lc+V0nN+67NRiNRAPQ8HnrrRxf3yrwnhsxXJtWZNMqPVbG4sjzfLq GNGVVNTso43rDSKjH9i6edz2o9rd2eht05kXhYLxK6fafcSGmeKaJ8VeTasYln9fLYcgsmTXOa51 FtqXtTulXTVM8bZGNWReV7N1btv06orQ9FwYj0zsWoet/E9xG4RketOfWnDMUvVqS30Fkv09HMya ejVeWOdFV8ELORzuyiVjXvk3fzcqIdZwu4fqtrzadUMG1M4idSPNWluc3jB7HXWW9Ot1zqVppVVa qtq407SpejXxNY1y8ibP5mu3TlDVeu+uOJ8PWAu1FzS33attra+ktyxWuKKSftKiVI2LyySRt5Uc 5FVebfbwRfAsQ8udUtTtQdS/Ja0t9zS7Lf8AKLPmtNZnV9Qmz691LdlZC+XbbdytRjXL4rtuq7qq lvcUeE6x8MmkkvFBjvEjqJkGVYnW2+sv9pulza+wXaGeqihqII7e1iR07N5k5OT0msRequ2egboB gHiI4ocZvvE3Bo1nfEFeNIdN7Fi9LfK2rslS+juV7uNUjXw06VMbHvhiZC9rlRmyqvMiqu7Vb2XC pxF2J3FFXaCYFxA3bV7AL3jL77abje6h9VcrRcYZeWajfUvYx80bol7RFdurfRRP3yuDdgMNcBNg 1M1dslRqrqRrhqBWU+J5lebbZrMy+SrSVkTJnK59fz8z6nZZezZGrkZG2BitTdVNygAZ945Ml1dx TQeou2j63uGr870MV8rbFSJU3OhsrpF73UUkaovNK1vL12VWtVzunLzJVfD5cNNswz/Hbxw7cdmY ZStNM9cixHN7xJc57jRoxefsqaqbFPTSsdsvaMRWJtsrduihtYHm/k3E5p7qbxA6p2DXLiuyjSfG MCvT8ZxywYxdJ7XPWzU6uZVVtTUQRufIiyt2YxVRqInguyq7stJuNq44ppTxFwW7Ur21KTSCmpa/ Dsor2fDXKmro1bBFVKjWLK6CoRGPeqNc/d3gm2wehwMb4/w38Rdx0txvVbEOLDOpNWLhSUF6qae/ 3TtMWnkmRkk9I63xxK2OFGPe1qxojt0Rem/o9dqdFqvqLx+Uuidv1cyzEcXuGksF5vlPj93lhWN7 LnIxz6RXIrYZnv7CNZ0Ykixc7UVObdA2yDz61515x2ycRtBwzag8SeTaY6d4FiNFUV92o7jJHe8i ub2sSKOSuZG6RqJCqSPc3lV71fuvVqt5XDlrpj+RcQ1/4ZsH4j8k1R09y3Dqi42u9Vlxlde7DcGu WOenZXKxkrt4ndqyRd3McjNuqOVwbYwvUPDtQ4rzNht6bcmY/eavH7i5sMkaQXClcjZ4fTa3m5XK iczd2r6lUkZh3yYmnNPa8ZzzOVzPMa6pbm+Q2V1DXX6oqKCRraiF3enU7lVjqpys2dOqc6o5yKvV TcQAAAAABjzi3+OTwo/49fqqAuAp/i3+OTwo/wCPX6qgLgKWJ9eOx6Pgj2E9v0gABXdUAAAAAAAA AAAAAAAAAAAAAAAAK48lx8RPTL9NfritLHK48lx8RPTL9NfritLWF53D4Z/c9/0aqABbcNiXykVH kPsn4d7xb8spsXt1HqFHFLfKy3traS210kbe51E0Lnsa5GqyX8JzUTqu6H11m4f9WMnrtPbbrrxx YrHFTZnbbnjlM7T+nt9RWXaBznQxQSJXc3O5Fe3ZEX8JOirsi64zfBsP1JxiuwvPcboL9Y7kxI6q hroUlikRFRUXZfByKiKjk2VFRFRUVNyttOeDrht0oyemzTCNMKamvdCxY6Ktra+ruElG1U2VKfvU siQdFVPg+Xoqp4AVZpvS07/KY6v1roWrPDp/ZImSKnpNY97FciL8iqxv+RCDZlb75c+LPistWKxy uvFforDDQNhRed9W6le2LbbxdzK1ENi2zSnAbPqVedX7dYexy7IKCntlxuPepndvTQrvEzslesTd vlaxFX1qp/LZpRgFn1LvOsFusHY5dkFBBa7jce9Tu7elhXeJnZK9Ym7beLWIq+tVAofhLzjSK3+T 7w7Jcpr7R7DLNh7qfI0qomz07eya5lbFNDs7nVz+0RY+VVfzoiI7mRFhGWVOCZZxs8J1+wehp24v Ph+Q3CxRx0DqSJlM6gRYFZA9jViajHIrWq1u3Tohct54FeEy/wCWz5rddFbPNcaqr7/UxtqKmOiq KjfdZJKJkqU0jlXdVV0a77rvvuWRdNI9PL1qBjWqVxxxkmTYfSVVDZK1lTNG2kgqGckzEiY9InI5 vT0mKqerYDPfHHRTaY5HpVxe2mNzXaZ5BHbclcxP3THbk5KepV234XZvexWovRFkc71HU8PVO3VF 3EJxY1O01Pm01djmKy+LfMFrhfTsliX1NnmbI9yfLGiku4y8rzzL8UvPDLpnovlGR33P7YluW/z2 tW45aqaoc6OaeetcvKksTGue2NEV3NyKm67ItqWHS+16WcPkOkuI08k9Lj+LyWmlRke8lS9tO5qv 5U8XyP3cqJ4ueoFGeTZybB6bgKxCvfcKGG32GmuyX1ZHN5aZ7ayolmWb5Pg3tf1/eOavgqGVMMpL jb+AHhaluUckFNLrva6qkbN07OkdX3BWqu/girzORfWjkX1mh+FPgk0dzThh06frrovVU2VwW2SC 6U1a+utVTLyVcyxNrII5Iu22YreVJmu9HlROmxqPPNCtItTNOIdI80wS212IUzYGU1qjR1NFSpCm 0XYrCrHQ8idEVit2RVTwVUAyXxL2TUGs8orpW7FdTaHAZrvgNdb7Dd7jYmXWB9wZUzPqaeOGSWJq SvgfF6XNvts3ZeZCY0+h2cLxT6WZdrDxgY1kOW4pS3aqs2OU2GwWmsuNFPB2NSnMyse5zG+i5FVj kRWv2/fKl23nhg0HyPTK1aPZBp1RXLFLG5ZLbSVdRPLNRyK5zlkiqXPWoY9Ve700k5uqpvt0P3pP wzaGaIXKtvmmen9La7rcY0gqrlPVVFdWyRIqL2feKmSSVGbo1eVHIiqidOiAUX5M6uoaDRXO7Rda qGC+2TUTIG5GyV6Nkiqe0aqvl36puxETmXp6C/wVON5L642O8ad6x3fGFjWzV2suRVNuWJNmLTPg o3Rcv5uRW7FxZnwZcMeoOcVWo2W6TW6sv1wVrq+dlVUwRVyt22WpgilbDUeCb9ox2/r3J3pvpJp3 pFTX6j05xuOy0+TXyqyS5xRzyyMmuNQjEmla2RzkjRUjYiRs5WN5fRagEvAAAyr5Lj4iemX6a/XF aaqMq+S4+Inpl+mv1xWgaqAAAA+dTURUlPLVTv5YoWOke75Gom6r/kAyz5Lj4iemX6a/XFaaqMse S/glp+BbTGOVvK5WXd6J/euu9Y5F/wAioanAAAAAAAAAAAAAAAAAAACKZFa9MqvO8RueUwY+/MKD v/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb4 6eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ/0o/3AWv8A 5/8A17zQBn/Sj/cBa/8An/8AXvOdi/2ijsq+dKji/Xp7J+iWlBaF6X51hvEVr5neSWPudjzWusc1 iqu8wyd7ZT00zJl5GPV8fK57U9Nrd9+m/Uv0GInLOEMTlEwGcbq7i90o1Eya5YzjVFrFhOQ1nfrb QTXyC03KxKqelTtdM3spIU6I1N+bpuqou/No4CJyInJluPT7XzXzWXANRNW9PrRptjWm1XUXOitk d6jutyuNZIxGt55YWpFFE3lRVRFVV22677tk+hel+dYdxE6+Z3klj7pY81rrHNYqrvMMne2U9NMy ZeRj1fHyue1PTa3ffpv1L9BtNc7GZrmYyZox7SHUnh915lumjWOeedJ8/qHVGRWGKsgp1xy4rsi1 1KyZ7EdE/pzxM3dsi7J6MbTR10ttHebbV2i4xLJSV0ElNOxr3MV0b2q1yI5qo5u6KvVFRU9SnJBi ZzYmqZ2s++4J4V/m9un/AK23n72WhpbpBp9ovYqnGtOLNUWy3VdW6umimuNVWq6ZzGMV3PUySPRO WNicqKidN9t1VVmQE1TO2Saqp1TLOPG7w25JxB4JZKzT240tFmuF3NLtZX1LuSKZdk7SFXbKjFVW Rua5U25o0RdkVXJVVg0O4qOIfX3AtU+KDEscw6xaZu73QW22VrKl9fWI9sjXojJZUa1ZI4nO5nJ6 MaNRqqquTcYMxXMRk2i5MRkAA0aOx0A/tR2H/Cv6zKfLiCzOpwvS66T2xzvO13VlntjW/hLU1HoI rfztbzuT/wAU+ugH9qOw/wCFf1mUr3VSv9muudmxWN3Pb8Holu1Y3966unTaFq/naz00/lU2tV6G Bt5bZppjwej/AP5/DxiLtua4/DTEVT2RGz3zlHvcnD8cpsRxe2Y3Sqist9O2JXJ+/f4vd/O5XL/O dwARRGUZQ9ZVVNdU1VbZAAZagAAAAAAAAAAAAAAAAAAAADgX+sudusdwrrJaXXS4wU0klJQtlbF3 mZGryR87lRrOZ2ycyrsm+5ifTPyaVtvmV12qnFFla5bkd6rZLlWWm2vfDQJNI9XuR8vSWRqKuyNb 2bURNvSQ3ODamuadiG7YovTE3Izy7nV4ziuM4XZafHMQsFvstrpG8sFHQ07IIY0/M1qIm6+tfFfW VprtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cyqiKiua63wYiqaZzhtXaouUaF UanT8L/FBT6109xwTO7KmJarYkiRZJjcrvHwRKylVV+FppN0VHIq8vMiKqorXO6vRvSTULFOMniB 1Wv+P91xbN6fGo7DX97gf3x1JQJFUJ2bHrJHyv6fCNbv4t3TqQzXbQmo1DqLXqJp3flxLVHElWbH shhT+VVpKpET4Wmk3VHNVF25lVEVFc11j8L/ABQU+tdPccEzuypiWq2JIkWSY3K7x8ESspVVfhaa TdFRyKvLzIiqqK1zr9q7FyOt5fGYOrC1b6Z2Sh1Lopqlw7cRzs64f8X8+6X6k1ayZtisVbT0vmS4 Lt/stRpPIxqtd/vkTF3XZdkX4NI4o+w8UWjfGDrZq1gfDLUahY1qHFYIrfVw5ha7XydyoGRSKrJ5 Fk/dFe3q1v4G6boqKbXBKpsc3fSbiV4t83xafiKwezaY6YYfdIb6uJU16ju9xvtdDv2KVNRCiQsg aqqqtb1XdU2VVa9k3yjSTUK48e+Ga00eP9phlp0/rLJWXPvcCdlWvqZXti7JX9q7drmrzIxW9fE0 eABBNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4dVVUaiqjWrWrANAcAr9RdRr t3S3Um0cMMac9RXVDt+zp6ePxkleqbIieHVVVGoqplHT/T/P9d8/o+JTiUtvdKqk3fhGEPdz0+N0 7tlbPO1ekla9EaquVPQ6dEVGtj0rri3GcrGGw1eJr0affO40/wBP8/13z+j4lOJS290qqTd+EYQ9 3PT43Tu2Vs87V6SVr0Rqq5U9Dp0RUa2PQwBz665rnOXqrFijD0aFAADVMAAAAAAAAAAAAAAAAAAA AAAAAHAv9Zc7dY7hXWS0uulxgppJKShbK2LvMyNXkj53KjWcztk5lXZN9zngDDGmfk0rbfMrrtVO KLK1y3I71WyXKstNte+GgSaR6vcj5eksjUVdka3s2oibekhtPGcVxnC7LT45iFgt9ltdI3lgo6Gn ZBDGn5mtRE3X1r4r6ztAbVV1V7UNrD27HqR5q48lx8RPTL9NfritNVGVfJcfET0y/TX64rTVR03j QAAAABmng80f1F0s4fsnwjPMd813q45Df66mpe9wT88FTI5YXc8T3MTmRU6KqKnrRDpNFtDtUsS8 nHU6C5Bi/dM6kwvJLS21d9p5N6uqdWLBH2zJFh9Lto/S5+VObqqbLtrEAYpm4adbcZwDhs1RwGx2 yXU3RXHYrRdsYuNwjhiulLPRMgqqVtUzniZKxUdyP3Vm7lXddkRbhwPMuLLOtRbVNlOjdj0xwagh nddorlfILzc7pM5u0LKbujuzp2sd6TnPc5XJ0RqF6gDPPD3pTn2DcQfELnGU2HuVkzm92irsFV3q GTvkMFI+OV3Ix7nx7OVE2kRqr6kVBwg6U59pdWa3y53YfNjcv1byDJ7KveoZu9WypWLsJ/gnu5Ob ld6D+V6bdWoaGAHnbc+EviAr+AWu0Mgw1aXNKvPpLuylS5UTuyonXLtkqO07bsl2j9Pk5+b1bb9C w9fcQ4uuJnAouG7JNHbNitmu9fQsynOIcnp6mjno6adkz3UVIiJUtfK6JrmtkaiN/AVVRedNngDL GomkOr+lXEfHxJaB4Vb81ob3jMOL5Lict1ittS5Kd6LTVdLPMnZKrWtaxWPVOidN+bdlj6P5BxL5 dl93v+reAY/gOJNoo6e1Y+24sul2fVo9VfUz1UCpAyNW+ikTUeu/XmTb0rgAGeOBnSnPtHdHrri2 o9h80XSpy683OKDvUNRzU08/NE/mhe9qczeuyrunrRDQ50mZ43Pl+L3DGqbJ71jslfF2bbpZZo4q 2lXmReaJ8jHsR3Tbqx3RV6FL+5LyD8cTiC/+/wBbP/4eBP8AXKTXClxKluugcFgrr/brlT1NXaby 5YorrQNVe2pY5/Cnldu1WyORWpsqKnXdM25fpfrrxG6u6X5bkHDPZ9IZMEyqkyS5ZXPkdBcbnW00 G/NboUo0Vzo5VVEcsrkbs1PR8UXR2lOjly0wrLhV12teo+cpXxMjbDldwpKmOlVqqvNEkFNCqOXf Zd1XoidELIAyRbdPuILhn1m1KynSTSqk1PwfVG6pkj7fDf6a1XCz3VzVSpVVqdo5opXKjkVruZuy Jt09KY1Gm+tvERoZqPgfERQ47ibs2hlpbFabRK6tlskHInZLVVO6MqZEma2RUja1uyKiO9LZmhgB jS11flC4NMLJoTZtK8cxi/Wuno7NJqf7JKOtoG0sHIxauK3PjWZ8r4mbcj2I3mcq9OiNnts0h1Fo +PGPWOrt0lZiMej7MVffJKima+e6pdWzrG6BrkkRVjRXq5I0j67IqL0NHADLup2les2nHEy/if0O w6gziDI8djxzKsWmusVtqpFhkR0FZTTzJ2Sua1EY5j1b0TpvzbssLR/IOJfLsvu9/wBW8Ax/AcSb RR09qx9txZdLs+rR6q+pnqoFSBkat9FImo9d+vMm3pXAAMrcHOAa46I3/PNK810vgbidfld5ya1Z jT32mkjqo6mWNYoFo0+HY/ZHKrnIjU2269FXVIAAAAAABjzi3+OTwo/49fqqAuAp/i3+OTwo/wCP X6qgLgKWJ9eOx6Pgj2E9v0gABXdUAAAAAAAAAAAAAAAAAAAAAAAAK48lx8RPTL9NfritLHK48lx8 RPTL9NfritLWF53D4Z/c9/0aqABbcMAAAAzBwsZflmQ8Q3ExZL/lF3udusOVW2ntVJWVss0NBE6l e50cDHuVsTVVEVUYiIq9QNPgxDjuoWu8964zodO7zeL/AJJi9fSx4fbaqofVsoZHUT3KylgkVWNX dFckbU2e9rUVF32INo7kWEag0mPRafcfmpVi1mjko33Kw59c5H0s1bu1aqidaalsTHovwjWNp37t 9FUcu24G6Y9REk1Wl0q9hGWNWKwpffZE627WN286Q9zbVc3Wq69p2XL+Aiu39RLjMNDl+Wv8pRcM EflF2djbNGWXRtmWtl7i2t88sj7ykHN2aS8iqztOXm5em+xVXB3gmo/EbpNkd71N4hNUaaC35Zer TZW2PJp6OoijjnVe2mqEVZZnI5/IyN7liYyJuzN3OVQ3mDzkt/FDrn7hjH44M0fJqLkOpCaVUmUT QtdM1X1UjUq3N25VlSGNWcy9d9nbq7qdpxl6d6v8M+iVDkumnEvqpdKeuv1qtt+S/wCRSVNTyvqG q2opahqMlp1V7ezfE13ZvjmX0UVqKoeg4AAArzWTiB0d4f7D7ItW89tlgge1XU8EsnPVVSp6oYGb ySr/AOK1UT1qiHmPxE+WLz7MaibD+GPFJMdpah/d4r3coGVNznVy7J2FOnNFCqquyc3auXdNuVQP XrdN1bum6JuqH9Ke4UNJ8k0i0Xs9oz++V97ze7p55yq519U6pnqLlO1qvYsjlVXNiajIW7dOWJFR E3LhAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK0DVQB86ipp6SJ09VPHDE38J8jka1P5VUD6FU8 VWpdDpDw6ahagVsjGut1hqmUrXu5Ukq5WLFTs3/vpZGJ067Kp/NTOKzhz0fonVmoGseMW5yNVzaW OubU1ciJ/Bp4eaV3ybo3bcztQY9n/lBNRMazzNsUr8R4ecQqlulmstzc6K45lcGOTsaqogTpFSNT dWo5VVyb7c6SqsQX/wAH+nlx0p4YtNsDvLUZcLdYKd9ZGibdlPNvNJH/ACtdK5qr69ty4QAAAAAA AAAAAAAAAAAAAAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS 5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAZ/0o/3AWv8A5/8A17zQBn/Sj/cBa/8An/8AXvOdi/2ijsq+dKji /Xp7J+iWgA1QAAAAAAAAAAAAAAAAOTofXUts0VtVyrpkipqSKtnmkXwYxtRM5yr/ACIilU6RrVXu 33fUW5xuZW5lc5rlyu/Cjp0crYI/5GsTp+Zx/cgv1TQcLNjxa1y8tyzGtfYqbbqqNlq5e1cqfwez a5FX1cyEztlupbRbaS1ULOSnooGU8TfkYxqNan+REILVWlZtU7qY75iP8973P/8AP2uJ4Oi7O2vK PdTEfOZ/pckAErqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVBrtoTUah1Fr1E07vy4lqjiSrNj2Qwp /Kq0lUiJ8LTSbqjmqi7cyqiKiua63wZpqmmc4aXLdN2maK4ziXT8L/FBT6109xwTO7KmJarYkiRZ JjcrvHwRKylVV+FppN0VHIq8vMiKqorXOvsx7rtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8L TSbqjmqi7cyqiKiua6x+F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZSqq/C00m6KjkVeXmRFVUVr nX7V2Lkdby2MwdWFq30zslfZBNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4dV VUaiqjWrWrANAcAr9RdRrt3S3Um0cMMac9RXVDt+zp6ePxkleqbIieHVVVGoqplHT/T/AD/XfP6P iU4lLb3SqpN34RhD3c9PjdO7ZWzztXpJWvRGqrlT0OnRFRrY9q64txnKPDYavE16NPvncaf6f5/r vn9HxKcSlt7pVUm78Iwh7uenxundsrZ52r0krXojVVyp6HToio1sehgDn11zXOcvVWLFGHo0KAAG qYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABXHkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqOq8OAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAx5xb/HJ4Uf8ev1VAXAU/xb/HJ4Uf8AHr9VQFwF LE+vHY9HwR7Ce36QAAruqAAAAAAAAAAAAAAAAAAAAAAAAFceS4+Inpl+mv1xWljlceS4+Inpl+mv 1xWlrC87h8M/ue/6NVAAtuGAAAZKseE6/aB8RurWZ4Vo43UTEtVKq3XamqKPIaO3z2urggdFLFUM qXNVzHOcrkdHzKjUToqqqJrUAY10S0Y4rcIruJDKJm43ZM1z+60N4xi4TSNrLW+VIXOkh5Gu7ZI4 1d2CSSMY5dkkRip6J0Ov+D8TfFdp8mleVcIGNYjfKuWlb7Oq7LaCths6xzMfJUUjIWrV7uRrmoz0 ej1Ryr133QAM4WLR/UO2cd0mr9VbJKnD26Qw4ql6lqoFfNc23NkyxuhR/a7rG1Xq/k5PVzb9DkcD OlOfaO6PXXFtR7D5oulTl15ucUHeoajmpp5+aJ/NC97U5m9dlXdPWiGhwB57U3CVq7FwdVuJXaG1 YtnmM6oT6gY4y63GnWknkjqldAkk0T3MZ2kckiIiqio7lR3Km6p1vHllfEbqFoNZ26i6Q0WmNsps qsqTUcmRU93rL1XPqEbHBAlMnJHC1FklVz3c7lZGiMROZTeGqel2D6z4HdtNdRbKy62C8xNjqadX uY5Fa5Hsex7VRzHte1rmuReiohUGOcD+nltynHcnzPUvVDUNuIVLK6wWzMMk79QW6qYm0c7Imxs5 5GfvXSK9UA0UAAMe8Wfk0NIOJq6V2d2+8XPEc5q2or7nFI6rpapyJs1JqaR3RETpvE6PbxVHeB5P 8QfA1xDcMFa66Z1g6XrGaeVHJfbUslTbZWIvhM5nLJBv4fCIxeq8qr4n+iI/E0MVRE+CeJkkUjVY 9j2orXNVNlRUXxRUAw5oVwLeTy150jxfVrGNDkSiyOgZUuh9lN4ctNUJuyeBy976ujla9ir61bv4 E89644E/mM+k14+9mhMF00wTTGkuFu0/xmisFDc619yqKKhZ2VMlS9rWvfHEnoRcyMaqoxGtVUV2 26qqyYDKvvXHAn8xn0mvH3sz/wABXAVwna08J2Damal6U+eckvPnPvtb59uVP2vZXKqhj+DhqGRt 2jiY30Wpvtuu6qqr6VGVfJcfET0y/TX64rQHvXHAn8xn0mvH3s/cHkv+BanlbLHoXGrm+CPyO7vb /OjqpUU1OAKd0+4POF/S24tvGDaH4rQXBm3Z1ctH3qeLb1sknV7mL+dqoqlxAAAAAAAAAAAAAAAA AAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/AE2rzbq3ZOqb+BeBTWqG tt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAM+4njureL2ClsXtZd57tz/C+eqZnNzPc7w3Xb8Lbx9RoIFa/hov1R VpTExnsy58t8TuQXbEXpiZmYy3KT7PVv5p/6dph2erfzT/07TF2Ah5DP5lX9P2o+Rx0p8PJSfZ6t /NP/AE7TDs9W/mn/AKdpi7AOQz+ZV/T9pyOOlPh5KT7PVv5p/wCnaYdnq380/wDTtMXYByGfzKv6 ftORx0p8PJSfZ6t/NP8A07TDs9W/mn/p2mLsA5DP5lX9P2nI46U+HkpPs9W/mn/p2mHZ6t/NP/Tt MXYByGfzKv6ftORx0p8PJSfZ6t/NP/TtMOz1b+af+naYuwDkM/mVf0/acjjpT4eSk+z1b+af+naY dnq380/9O0xdh+ZJI4Y3SyvaxjEVznOXZERPFVUchn8yr+n7TkcdKfDyZKtNsu82e4vhN7pewXTy 01VZVQ9o16Mra2d6xoqsVWr8ArHou/TdS1CA6T1MmSNyPUioa7tMtvNRVwq5NlSkjcscDevXojXf 5SfFSzTFFERTs5uyNUeD6JFiMHbt4WP+XTFPv5/GZAASsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ABUGu2hNRqHUWvUTTu/LiWqOJKs2PZDCn8qrSVSInwtNJuqOaqLtzKqIqK5rrfBmmqaZzhpct03a ZorjOJZR4cqTKuLmewcX2vdbQ3B8aTQ4ZjFGxyW2ydjM6CarVj1XnqXywvVHOVeVEaqLujUj1cZu 8nR8TbT79LfrWrNIm92qaq5zQYK3TbsU6MbYiQAEa0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA DJXC5qHxk8NehOM6Ke4j9kfsc77/ALJ+2TaqPt+8Vk9T+48snLy9vy/hrvy79N9ktX3W/GT+T7+t e1fYlwAscpr6nK9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP 5Pv617V9iPdb8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa +o9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9iPdb 8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/ 3W/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9iPdb8ZP5Pv617V9i XABymvqPRFjfPh5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/3W/GT+T7+te1 fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9iPdb8ZP5Pv617V9iXABymvqPRFjf Ph5Kf91vxk/k+/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+Hkp/3W/GT+T7+te1fYj3W/GT+T7+ te1fYlwAcpr6j0RY3z4eSn/db8ZP5Pv617V9iPdb8ZP5Pv617V9iXABymvqPRFjfPh5Kf91vxk/k +/rXtX2I91vxk/k+/rXtX2JcAHKa+o9EWN8+HkzFdrtxL68cS+jGoOoPDJ7XNg059kXe6v2aW+79 t5wt6RM9CJGPbtJExOjX79puvKjVVdOgEVdc3Jzldw2GowtGhRs26wAGiwAAAAAAAAAAAAAAAAAA AAAAAAFceS4+Inpl+mv1xWljlceS4+Inpl+mv1xWlrC87h8M/ue/6NVAAtuGAAAAAAAAAAAAAAAA AAAAABlXyXHxE9Mv01+uK01UZT8ltJG/gV01ax7XLGt5a9EX8FfO9Yuy/J0VF/nA1YAAAAAAAAAA AAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj 9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFccQ+Ty4po9kdZSOXvlbTJbKRrfwnS1 DkiTl/OiPc7/AO5LHKJ4h6vz5m2nmn7F5o3V8t/rG+pGUrPgub5Uc9zk28OhBiatC1Mx2d+p0uCL MX8bbirZE6U9lOuflk/OK2OLGsatdghROW30kVOqp++c1qI53867r/OdqAUIjKMoenqqmuZqnbIA DLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+Kiqioiqm/rT1GRKHj/x/TrVS9aJcSlidi94s9Yt PDf6GJ8ttrYHbOhndH6UsCPY5i7J2jU3XdzdjNNM1bEdy9Ray05yzSvydHxNtPv0t+tas0ieafD7 x66WcPXCbg+CU9uuGVZxA2472ajasUcDpbjUviSadzVROZr2qiRtkd1TdE33PQnTuqzSuwiz3DUS loqTI6ylbU3CkomubDSSP9LsG8yqruzRUYrlX0nNVU2RURN7lMxVMzvQYO9RXbpopnOYiM+5IwAR rYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAPhW19DbKZ9Zcq2Ckp403fLPIkbG/wArlXZDiuyOxJYZcoiutPUW mGmfVurKd/bRrCxFVz2qzfmRERfwd/AMZw7EFOaXcW2h2tOW+w7TLI7heqpKeSpWoSz1cFMjWbcy drNGxObr0T17KczWDUrWnD7xQ2TSbh/qM+Wsplmlr35BTWylpH8ypyPWVFVy7Ijtk8UX5TOjOeUt OOomnTpnOOrX8lrgjNvqM/u2nLKiuoLbYMzqrS5Vp3SrVUlFcHRryorm9ZI2ybb7dVRCC6SYFxGW PJ5si1i13tuT0ElHJTx2C241DRU8EznsckyVCO7V6ojXN5XJts9V8RkzNc5xEROtcBXHkuPiJ6Zf pr9cVp1Wr3DNhOtuRUt9zXKM0ZS0tE2iWzW2/S0dumRJHv7R8UeyrIvacqu5k3a1ieohLfJzcGzW o1dH1cqJtuuQ3Tdfz9KkmtXKbeebnY7CXcXMaOURGe2ezqb1Bgv3ujg2+Z36Q3X7yPe6ODb5nfpD dfvJNymjrUPRF/fHj5N6AwX73RwbfM79Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+90cG3z O/SG6/eR73RwbfM79Ibr95HKaOs9EX98ePk3oDBfvdHBt8zv0huv3ke90cG3zO/SG6/eRymjrPRF /fHj5N6AwX73RwbfM79Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+90cG3zO/SG6/eR73Rwb fM79Ibr95HKaOs9EX98ePk3oDBfvdHBt8zv0huv3ke90cG3zO/SG6/eRymjrPRF/fHj5N6AwX73R wbfM79Ibr95HvdHBt8zv0huv3kcpo6z0Rf3x4+TegMF+90cG3zO/SG6/eR73RwbfM79Ibr95HKaO s9EX98ePk3oYO8j/AJPLNw3sw2rcqLSVNRc6RHfvopaqeN/L+ZHw/wCV5+Pe6ODb5nfpDdfvJYOl uCYbw96oYFjWn1o8z4xcaCvsDaXvEs6RPdK6rZu+VznuV0z37KrlVN9k2REQjrxETNOW/wCer6rW H4Krpt3YrymZonLLfExVu3RMe9rMAFxwAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/AAXiM0R0at1p t9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7 OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAM4VlV7J+IPML1vzwY3b6SwUzvVzO3mm2/Oj12U0XPPFTQyVM8iMiiar3uXwa1E3VV/ mMw6LPlueNXDMalrknyq8114fzeKI+VWtT+TZibJ+cpYuddNPv7v/r0PANvKL17dEU++qc/lTPen 4AK7rgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAPKs6B+yDEbVr5j9FzV2OctsvfI3rJQyP8A gZV/4OVyt/km+Rpv8rniDzPTDCtJchq9XZWux240ctsmompzz3B0zFYlNAzxfK/deVE8NuZVREVU 3t1TTVEwr4q1Tds1U1anlr5NvQP23NcYszvdF2uO4D2dzm527smrlVe6xfn2c10q/wDBIi/hHsgZ G8nbJhmEac1+i01iumMah2esluWRWa9wdhXStmVFgqWtVE5oux7FnRPRVOqJzIrtcm1+qaq9aDg6 1TbsRNM5565/zqAARL4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnGN43Za+y09XV0XaSyc /M7tHpvs9UToi7eCHzypNMcFsVRlGb3a049ZqNWJUXG63NKSlhV70Yznlle1jeZzmtTdequRE6qT xh6qozc25wrZt1zRMTnGrm80LBxPdA8G34wulX/rxQ/bn0veufCtYtP7tqnJqfjNzxaxVFPSXG42 O5Ou7aeeeRscUbmUayv5nOe3ZqNVdlVfBFVM8mr6mnpexunw833BZKYjjioipbl6/LLIn/4yJy5P o/FqnDoo+u/7NJ7I7I2WxsVU5UtqTdgs7pUTsmp2qcvKr0cq+CbdRyavqPS9jdPh5uiBZXsQx3+L v89J+0PYhjv8Xf56T9ocmr6j0vY3T4eatQWV7EMd/i7/AD0n7Q9iGO/xd/npP2hyavqPS9jdPh5q 1B3ubZPo/p1eMWsGY13cLhml0bZrFTpFVTOq6tW83J8EjkYiJ1V7+VietUOrXU3QJtfqJbXX1qT6 T0kdbmHwFZyWyF9O+oa7n5eWZeyje5WxK9U22VEcqIOTV9R6Xsbp8PNxgTHDF071BxKz5ziLXV1k v9FDcbdVObUQrPTytR8b+SXle1HNVF2c1F6+B3PsQx3+Lv8APSftDk1fUel7G6fDzVqCyvYhjv8A F3+ek/aKmqdfOGGk0zvesM+WbYhjt4fYLhcUobg7kr2zMhWJkSR9rN8JIxvNGxzV3VUXZFVHJq+o 9L2N0+Hm54LKTEMcVEXzd4/+Fk/+Y9iGO/xd/npP2hyavqPS9jdPh5q1BZXsQx3+Lv8APSftD2IY 7/F3+ek/aHJq+o9L2N0+HmrUFlexDHf4u/z0n7RWdz1v4SLLcquz3jXbTOgr6CeSmqqWpzKjimgm Y5WvjkY6dHNc1yKitVEVFRUUcmr6j0vY3T4eb9A7PC9QuHLUi7PsGneqGEZTc44HVT6Ky5NT107Y Wq1rpFjhlc5GIr2orttkVyJ60Jv7EMd/i7/PSftDk1fUel7G6fDzVqCyvYhjv8Xf56T9oexDHf4u /wA9J+0OTV9R6Xsbp8PNWoLK9iGO/wAXf56T9oexDHf4u/z0n7Q5NX1Hpexunw81agsr2IY7/F3+ ek/aHsQx3+Lv89J+0OTV9R6Xsbp8PNWoLK9iGO/xd/npP2iJXLJ9H7TqVaNH6+t7PLr9b57rQW1s VU9ZKSFdpJVkaixxoi9Nnuaqr0RFHJq+o9L2N0+Hm6IFlexDHf4u/wA9J+0PYhjv8Xf56T9ocmr6 j0vY3T4eatQWV7EMd/i7/PSftD2IY7/F3+ek/aHJq+o9L2N0+HmrUFlexDHf4u/z0n7Q9iGO/wAX f56T9ocmr6j0vY3T4eatQWV7EMd/i7/PSftFG6haTcKugjG6/wCpFTk1CywVLOzuNfleQ3ZsM1Q7 sGtZSrUTI/mWXlRqRqiIu+yIm6Iw1XPLWrhi1zUz4PpmupWnem9NBV6g51YMaiq+dKd12uMNL26s 25kj7Ryc6pzN3Ru+26fKcrD80xXUDHabLcJv1HerPWLI2nraORHxSrHI6N/K717PY5P5iwMv0H0a 1CdQSZ5prYMj82Oe+iS7UbatKdz+XmViS7o1V5W7qnX0U+Q7ez6a4HjtuitGP4xRWygg37Klo2rD DHuu68rGKjU3VVXonrM8mqyYjhe3pa4nLs1/NlTTjintmqGZ0OJ2DRjVeipKztue/XbGXUdrg5In PRHyueqorlbyonL+E5qEh1lvHELbpLTSaEYfiN2dVtn84VmRXCWCGiVvJ2W0cXpyc3M/wXpyfnQ0 v7EMd/i7/PSftD2IY7/F3+ek/aHJ6s84yYjhW1NOjVpZ74iI+qj8Hh1GfgtHBqXWWKPLnwytrp7A yVaGORXu5HQpOnOqIxWdHp1VF9RXemGg2o+IZfT5nn3Evm2bT08Usa22WKChtkqvareZ9NGioqt3 3b6SbKifyGj8ys9utXc/N9P2Xa9pz+m52+3Lt4qvyqRohqiaJml0LNVGJopuxn7/AKq71P4etG9Z 7nbLxqfg1LkFVZ43w0a1E8zWRseqK5FYx7Wu3VE/CRf/AGkvxrFsdw7H6PFMXs1LbLPb4uwpaKnZ yxRR7qvKifJuq/5TtQaZzMZJ4opiZqiNcv4xjY2oxjUa1qbIiJsiJ8h/QA2AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAgOtSVFDidNltCxXVeLXSjvMKJ4r2UqI5P5OVyqv8hPjrcltEeQY9c7HKictwpJq Zd/VzsVu/wDNua1xnTMQlsVxbu01VbM9fZzrvo6unr6OCvpJEkgqY2zRuT98xybov+RT7Fa8OOQS ZHoti9TUOVaijpFts7XfhNfTuWHZfz7Mav8AOWUdS3Xp0RVveJxVicNfrsz+7Mx3TkAA3QAAAAAA AAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38 C8CmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBr7kS4to1lt2ZJySebZKWJ3rSSf aFqp+dFkRSBYbZkx7ErNY+XldQ0MMD0+V6MRHL/Ou6nYcUlR32xYlhrF3XIMmpI52/LTRc0ki/zK jDknOvzpXp6o/wA+j1vBlHF4CmelVM+6MojxzAARrYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQ 3VrVrCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqoiM9UMVVRTGlVsNWtWsK0Vw qszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIiqkU4e+HvNdUs1oOJ/iftPdrpTfC4RhEq8 9PjVO7ZW1NQ1ej65yIiqqp8H06I5GticPfD3muqWa0HE/wAT9p7tdKb4XCMIlXnp8ap3bK2pqGr0 fXOREVVVPg+nRHI1sWwC9ataGudrzOOx04mdCj1fmoTig4X6fWunt2d4JekxLVbEkWXG8kib4+Kr R1SInwtNJuqK1UXl5lVEVFc11caFa61GodRdNO9RLCuJao4kqQ5Dj0y/yIlXSqq/C00m6K1yKu3M iKqorXO2EUJxQcL9PrXT27O8EvSYlqtiSLLjeSRN8fFVo6pET4Wmk3VFaqLy8yqiKiua7a7ai5HW iweMqwtW+mdsO4BUGhWutRqHUXTTvUSwriWqOJKkOQ49Mv8AIiVdKqr8LTSborXIq7cyIqqitc63 yhVTNM5S9TbuU3aYronOJAAYbgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsrEP9ztJ/wA5/rHH 0yXFcXzS0S4/mON2u+2udzXS0Nzo46qne5qo5qujkRWqqKiKm6dFTc+eIf7naT/nP9Y47k6Vv1I7 HjsV7evtn5sG2DRPRnNfKQ5Rj1NpHhbMX0605pKeqtUVgpW0b7rWVCTMmkhSPkc/u8ioiqm6I1ux 9+P7H8OwXFtIdINMdL7ZTLm+p1sq6qxY9b6eiW6Q0iK6SPZjWs5nOdAnaP6NRN1XZCW8C3/Zpqrx Ma2r8IzIdRX45STL/vlLaYuyic3+9Vszf8n5jk6hNTP/ACkmlmMKnbU+mWBXjLZGr1YyaulShai/ 32zWOT1+Cm6ByptfuJfTLXnTbTvXHFNOJcd1Tqa2gt0mK1Fc+stVVBEkqNndUIjJ2LzNbzMYz987 ZNkR3NbxZX6gzfiTqrljlBWYVoVbaKWjdRRSNr7jVuon1FVE+Rz3Ro1j2cibRpyo7dVXY6jURUz3 ykWlWL79pT6ZYHeculT94yaukShai/3yI1jk/mUgfCpqXb8K4ddS+JjIMGv2WWnUzU+8XasitFC2 slhtElSlL2z4VXmkghSOVXNajnbKvTbdUCd4xq5xz5TpzYtbMZwbRzKbFfKalukOK2i4VrLq6km5 V7NldK9KVZ2Nd6SOY1qK1yIqqiIusqeV81PFNLTvgfIxrnRSK1XRqqdWqrVVN08OiqnyKp5qXu56 AW/UDD7r5OTKL/FnV2yii88Y3jbK/wBj81sc/wDsuS4UszEgpmNZt1TkVvijUVOZvpeBmfTfiyr5 tJtcNT9WKG1UcWkWbZDjTYrZHJF3qCgSLu7V7R7955XStZuio1XObs1DqNJeL/L3cLWoeuWv2P2S z3/Tu73Wz19stTJYoXVVMkbYaZO1kkd2j5ZWRb8227k6IUbp5YbjqLxb6j8NCUcvsXterFVqplrl aqRTwMpqN1vpF/evSWsckjmL4tpv5RprY7jrBxSZ9w5zUcq4limsN11Qytzmr2VS3sKNtrolXwcj 6pJpXsXorYAL9wDiD1zuWtekuiee47idLesgwGrzfN46OiqWPtvNIsVLBT887uzVsitZIr+05nNd y8u6bZYvGUVUvBdxRawUHNLctYtTKyyWXlXrUUL6uCjhjRfXtEtSn8xcceapQ8S3Fzr+svwOlWCU ON2yZV8ZGUclbPG386VEbU29auQrazYStDoTwM8Pbol7TK8qp85r4VT0pqemZJcp2P8AzbVjd9/D lT5APRXBcWpcGwjHsKoeXu2P2qktcPKmyckELY27fzMQqbU7NeKeo1FqcO0awPCbPj1tooaifLc3 qp30tdPJv/Y9LTUj2yKrP3z5HNTffZPwVdep5i6BM4fcvdlcvGHiVyzviEqMlr6eoxi7W+rrqtkf abU1PQU6p2EdMrdlSX0Y2oqq57WNRUDUOkXFbkeTab6x3LUvHrNbMo0UnuFLeZbNUvntdb3emdO2 endIiPa1yMcisduqbJuu67NypZcQnZwj8IWiNUjpK3VDUKiya783V1VQJNNXTuVPX8HNT9f71CH4 Nk9jw7yd/EHYLDb6a0ZvkmdzWuuxunidE61rcKuGlhokRWonIkENRyonqRU6GpZMWpZOO/Q/Sag2 lt2ieldbd2Iiegx9RyWxibfwuSNjkT5NlAmUvEDrprHqXmWC8LuNYTHY9Pa9bLe8rzB9XJTVN1am 8tHSU9KrXuWLdEfI56JuvRNuVXRGv4z9V7To1rut8wnGbfq3oUtL5xpY3T1Vlr4ahUfDUxJzxzIx 8TZV5FfzN2Yqr1VqRDhV11034ScfzrRbiHudbimY0ma3e7RtqLVVS+f6ape10NXSOijck/OiI3lT 0vRTdD+WLS/Msm4d+LTX3PMYrsfumstqudfabPcI+zq6a00Fvnbbu3YvWOVyKqqz1IjV9eyBZfFx xf5lolo/imRaY2CyXnNMntkl+7pcopn0dLaqakSorKl7YpGP2RXwxsRXpu6VOq7bLPNXtd8qsWZ6 R6YaW2+01+T6kXBKur84xSywW6wU8SS1tWrY5GKj9nMZFzO5XPVU67bGSsFtdx1r4QtZuJLIaSVs LtJ5sJxGOZqosdstdvV9ZO3/AMor2Sr8u1OxPUXTwJUVx1bqbrxZZNSSs88WmiwzD4527OgslA1G zzN36p3mtSaRUXrtGz5QNX5FfKLGMfueSXN/JR2mjmrqh3yRxMV7l/yNU8uuDHXLgAsOiMFZxF1+ B1uoWQXm6Xq8peMTkuFRC+aqfyM7ZaZ6K1Y2seiI5UTnX17m1ePzN/YBwdap3xs3ZyVVifZ41Rdl V1c9lJ0/PtOq/m239RVOhPHtwRaY6KYHp3PrlQxVGOY5brbUNSz3Ffh4qdjZV3Sn2VVejl3Tp1Al sWpegdu4d9RuI/guw7T2puOJ2qub32lxZaGKV1NFHVTU8vIyCZ7Oz5HbNcic3L1VW7EyzDiiteEc I1u4lrtSQT1d3xi3XO322BHbVlzrYI1gpI27q9UWWREVEVXNajl68qkrxbULSvin0kv1Vprk8d+x u909dYJaxKWeBivfDySN5ZmMcqIkqdUTb1b9FMO8DVJf+J6HSew5TQTx4Pw4UCpWwTsVI7jliTSs pWKi9HNpKVI5EVOqPlRFRUcBoSTiJ4h625YjoPjOF4ZcNbK3HY8lzGapWppsexemkdsyORrZJJ5p lVWsSNsnVUV+6NXZO/0s141eode5uG3iFx3E4sgrceXJ7DfMUfUJQV9KyXspYXw1Cukimau7vw3N VEXw6b5s1Vwvh+xHjR1YyfjKtt7oMfzajsVXhOQxV12pKBzaejSCrpXy2+RqJLzsjVGyb9G7py86 c138IumfDNdMtvWsOiujeXWWO2NWy2bKsgud0ljvVJK1r5n0kFdUPkbEj2o3ndG3f96q+miBoHV/ IcixHS3KssxOps9PdbJaqi4wS3iGWWjYkLFkesrInMe5vI13Rrm9dupinhp1k1I4dOEF2u2sDbJk UWoNxfeMds1qpaiO9Xe+3WrlekU8z5HRKj05XN5I0VsbV/DVER2iOPa53208Heq9RjtDU1dZNj8l G6KnYr39hO9kM7tk67Nhkkcq+prVUzzq3U47f+HDhn1X0mgr8x090fyqwVl6ZbrdO6ZtFQwpBJUt gcxHydi5q77Iv4SrvsjlQLD1K1+4xuH7CItb9aMC0trMHo6mkS/2fHamuW82qnqJmRI9s8qrBUOj dIxHNaxqKvg7l3cmuqSqp6+lhrqSVJYKiNssT08HMcm6Kn8qKhh7iW1ixHjbwa38M/DXc6zK1zK7 UC5PeqW3VEVDYLRTzsqJZZppY2tSVXRMa2L8J3pIqIqtR24aSlp6GkhoaSNI4KeNsUbE8GsamyJ/ kQDNF31+121S1ky/Srhhx7B227TmSGjyPJcwdVyU0txkarloqWGlc1znRomz3udsi7pt+Dz0zpbr DXXTi01i1812stPjTtC9OqfFb3DRzrU0rah9ZNUumpHORrnpM2HeNHIj9pGsXr1X6cKWvOA8Ol61 k0r1o892zUW66m3q/wBNa4rJWVlVfYKrsu7yUnZRu7VHqxeXqiekjlVEVVSsLXhWo/ELwY8U+o9i xeqXKtQ9QH1cdmgVJah9vtlVSvSlarN+0kY1tQxEbvzqzZu/NsBpGo1y43K/S+r4hrNpbpjbsOht r8hpsUulZXLkFRa2RrLzOqI9qeKd8Sc6RrG7bdGqu/QgnGNqxnmu+j+htj0irLFRY/r1ebVS1NHd aaeSsYivjqVR7opGtSnjWPlmaiK56dGuam+8PpaTybWW2612LTLTHULOcqvEkFGuHW2/ZMytpEer WzJVLNVMggZE1Xc6vejfR6KqdUneuHtaaF8V/C7id0pZsZ04wez3ttkXsKmrgdXzQtpoKbnRJJHy NRGORXKq7uRVXqBamU69a50+Z2Lhy0+sOE5Lq6tm8+5TdpUqqTG7HSLIrI3rGj31Ekki8qNiR/N+ +VUavTm6Wa8avUOvc3DbxC47icWQVuPLk9hvmKPqEoK+lZL2UsL4ahXSRTNXd34bmqiL4dN82aq4 Xw/Yjxo6sZPxlW290GP5tR2KrwnIYq67UlA5tPRpBV0r5bfI1El52RqjZN+jd05edOaztC7BwvYp atQeJzSDRvLLLSYTZK5lryrIrndJIr1RMp1nnfSQV1Q+RsSOiRvO6Nu/71fw0QO+0L4iOI7iGynM 0wzHcDtmHYfqHW2B16uMFY6SvtNPLG3kp42S7Pqlj7R7pXKyJqvhRGO3fydJplxMcVeueEahZ5pv jGmlssuJ5JeqO03G+xVyx3WgpVTsY2xxTbpJyo7tKlXNj5nta2L0HqcnhRnl0I8m1R6gV7+W4xYn eM1qJ39HzzT9vVxOX5XKx0LU+XZCM425eH3yRi17l7vV1Gn1RVtkXo9tVeHOdG5V8eZH1rPH5EQD vbZxZcR2o/DLLxQ6c6f4PYLBZLDU3i4UWTS1c1RdXUbHurEo1gcxsMSLFIyN8vO57mruxrUR7ppn HFTknmLhvr9P8etja3XO72p9TSXWOSdaK0S0jamsdH2b495o2yRo167s8VVq7ptXHEfbKzRnyYVt 0xtcPJerjjmP4jDCnorNWVb4GVLf5XItQp21ZjNHU8euiWlNt2ktuiul1deY0RPQjfUcltYip6nc kbHInybKBJHcRevObcUOpfD7pFiWITW7BqC1SPv94bUpDRVFTAkr2zJFJvO5eZGxwsbH+BK50qci Nd9tKeLW/wBK3XCz8RdDj1ruGhclNNdrpjiTdxrqSpp5JoVhinc6Rsu0atVivXdz2oh1nk/Nsrp9 a9a5E5lz3U+7yUUvjz22lVsNMm/r2+FT+Yzm/AMz144PeK3PsGtlTdbxqHqRU1tvpaZFdNW2i2Vt M6OKPbq53ZxzojURVcrUaibu2A0HUa5cblfpfV8Q1m0t0xt2HQ21+Q02KXSsrlyCotbI1l5nVEe1 PFO+JOdI1jdtujVXfoaR0m1Hs2r+meMaoY/DNDb8otdPc4YZtu0hSRiOWN23Tmau7V26bouxgOlp PJtZbbrXYtMtMdQs5yq8SQUa4dbb9kzK2kR6tbMlUs1UyCBkTVdzq96N9Hoqp1T0LwbCcX02w+0Y FhVqS2WKxUkdFb6RJXy9jCxNmt55HOe7+VzlVfWqgdVqH/8AV/8Azv8A+4Q4mOof/wBX/wDO/wD7 hDjn3/aS9Vwb+y0+/wCcgAIl4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB4aKnzbcNQsGcu3m rIPOMLF/eQVkaPY1Pzbsd/lLxM96fVHmLiQq6VV5YMnxlJP/ABqmmm22/mjVTQhcwk528t0zDz/D tGjjJr6UUz4ZT4xIACy44AAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9n PCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/pt Xm3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoHWK o88a9YTYt+Ztis9feHt/4ZyQNVf5Fb0O7IpUz+euIjObjvzMstvttpid6vTYsz0T+Ry9SVnKmdKu qrr+Wr6PcW6OKw9m3upj+r8X/sAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEN1a1awrRXCqzOs6u XdqGm2jhhjTnqKyod+BTwM8XyOVNkRPzqqoiKqIjPVDFVUUxpVbDVrVrCtFcKrM6zq5d2oabaOGG NOeorKh34FPAzxfI5U2RE/OqqiIqpFOHvh7zXVLNaDif4n7T3a6U3wuEYRKvPT41Tu2VtTUNXo+u ciIqqqfB9OiORrYnD3w95rqlmtBxP8T9p7tdKb4XCMIlXnp8ap3bK2pqGr0fXOREVVVPg+nRHI1s WwC9ataGudrzOOx04mdCj1fmAzBWceuLuzbLsGxTh61vzGowi8TWO7VuOY1TVtIypicqKjXJVI7Z dt05moqp6ic6NcWmkmteR1uCWl99xrNLdF3iqxXKbVJa7rHF/DSGTo9qevkc7boq7IqKs7nLmBUO tHFDpxonfrThV0t+S5PmF8gdV2/GMVtL7lc56dqq10/ZNVGsjRUVOZ7movK7bfldtGsK41tOMk1A tGl+ZYHqLpnkWRK5lkps3x/zfHdJG+McEzJJI3P6omyuTdVRqbuVEUORxQcL9PrXT27O8EvSYlqt iSLLjeSRN8fFVo6pET4Wmk3VFaqLy8yqiKiua6uNCtdajUOoumneolhXEtUcSVIchx6Zf5ESrpVV fhaaTdFa5FXbmRFVUVrnbCKE4oOF+n1rp7dneCXpMS1WxJFlxvJIm+Piq0dUiJ8LTSbqitVF5eZV RFRXNdFdtRcjrXMHjKsLVvpnbDuAVDoVrrPqJPdNO9RLCuJao4kqQ5Fjsy/yIlXSqq/C00m6K1yK u3MiKqorXOt4oVUzTOUvU27lN2mK6JziQAGG4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACysQ/wBz tJ/zn+scdyUDrfxQYJwx6TUWQ5FXWmqvldPHT2iw1N3ioZq9X1bYnyI5yOVsUTZOeSTkVrUb16qh H9bOIa5e29w94ho/qNaXY/n90ut1vVzoX0lbSVVlttN2sze3cj2MY5eZFkY5rkViojk2U6Vv1I7H jsV7evtn5tPAjWG6macaisqpNPtQMbydtC5GVTrNdoK1IHLvsj+ye7lVdl6Lt4KcbLtX9JdP7jT2 jPNUcRxuvq0R1PS3e901HNMirsisZK9rnJv8iG6BLgfOnqIKuCOqpZ45oZmJJHJG5HNe1U3RyKnR UVOqKh8bndLZZbfUXa83GmoKGkYss9TUzNiiiYni573KiNRPlVQOUCNYbqbpvqMypk091BxrKG0T kbUus12p61IVXfZH9k93KvRfH5FOLl2sOkmAXCG0Z5qliGN11SiOhpbve6ajlkRfBWsle1V3/MgE vB097zHEcZxuXMskym0WrH4ImTy3WurooKOON6ojHume5GI1yuaiKq7Krk28Tqk1d0nXK4sETU/E lyWfl7Kzeeqbv0m6bpywc/aLunVNm+AEtBRmuHF5pVofnuFac3/JccS75TdUpbgyuv8ABQtsdAkD 5XV1Sr9+Rqq1jI2v5EkV67O9FUWy8r1S0xwO20d5zjUbF8dt9wRFo6u7XenpIahFRFRY3yva1/RU Xoq+KASgHXWrJMdv1kiyWx363XG0TxLNFcKSqZNTPjTfd7ZWqrVamy9UXbopFKnXzQqjo7TcavWn A4KW/MWS1TyZHRtjr2o9WK6ByybSpzNc3dm/VFTxQCeApnic4osC4ZsGZkt+uForL1cJqeCz2Kov EVFNcO0njjfIjnI5WwxNk7SSTkVrUb16qhNa/WbR+1YtQ5zc9VsOo8bum60N4nvtLHQ1Wyqi9lO5 6Rv2VFT0XL4ATEHTYrmeH53am33CMrs+Q21z1jbWWquiq4FcniiSROc3dN06bncKqIiqq7InioH9 BDLNrTo5kWRrh2P6s4Zc7+1zmraqO/Us1Yit35k7Fj1fumy79OmxQnGnxUJpZXYZpHp9q1h2JZjl +QU1DdLtdamlmXGbUrFfLWywTPRjVVORGdtsx3pInXZUDVwIvp62ut2n1nlyHUSLM5m0LaibJewp 6aO4xuRXtqEbT7QtYrFbsrPRVERd+u5WGknGLpDrDqhnOnWMZZjEsWJyU8dtrochp5n31Fp1mqpa aBvpLDB0YsrXPa5eZfRRvUL3BlLhB4pKTLdErbqJxAaw4zbLlm19u1TjtNeK2htcqWxlW+CCGOP4 NZUasL/SVHOXfq5ehqSuudttlvmu1yuFNSUNPGs01TPK2OKONE3V7nuVERqJ13VdgOSCK4Zqtpdq PJUw6eak4rlElEm9Syy3inrVhTfb00he7l69OpKgAMvZRxTanahalX7SDhI02tGV12JT9zyPLcjr pKWwWyrTxpU7Jqy1MrV3RyR7cqp606pwp9aeNTSDJ8ej1y0Yw7M8VyC4xWya6aYJcZ6q0vk35ZZ6 Ooa6SSNNlVVZsiInjurWODVwOhvufYLi1yp7Pk2aWG0V9XTVFbT0tfcYaeaangbzTysY9yOcyNvV 7kTZqdVVDju1P01Zh8OoT9QsabitQm8N8ddoEt8icyt3bUc/ZqnM1U6O8UUCTA6DDtQMD1Et77vp /m1gyahif2b6qzXKGtia/wDgq+JzkRfzbnIx7L8Ty5txdimT2m9JaK+W1XBbdWxVKUdbFt2tNN2b l7OVnM3mjds5N03RNwO3BF/bS0y8yXzJfbFxjzRjNZLb73cPO9P3a11UStSSCpl5+WCRivYjmPVH JzJuibocb25dIPZNTYV7auH+yGtRi01o8+UvfZ0eiKzkg5+d3MioqbJ1RU2AmIKd4ieJGz6EU1is luxe4ZlneZVTqHF8Utj2sqLjM1EV73yO3SGBiKivlVFRqLvsqIqpWt0y7ylVntkmYO0u0OutJBGt S/FqC63JLw9iJusLKl6JTOl23Tw5d/DfwA1YCvdHNZbRq1pFaNXKiy3LE6WvpXz1dFfYlpZaB0bl bIj1ejUViK1VbJ0RzdndN9k7XD9XNKNQ6yot2AanYnk1XRt5qiCz3qmrZIW77bvbE9ytTdUTqBLQ Ri8aoaaY9W3S3X/UTGbbV2OmirLpBWXenhkoaeRdo5Z2veixMcvRrnbIq+Cn4o9VtLrjh9TqFb9S cVqsVokctTfIbxTvt8CN2356hH9m3bdN93etAJUCmOGrijwHiZsd5vGJ3CzxTWy7VtJHbobxFVVr qCKd0UFbNA1Gvp2zoxXNa5FTbbZztya2XWfR7JMkfhuO6r4ddL/E5zX2qivtLPWNVv4SLCx6vRU2 Xfp0AmQOoXMMSblaYIuU2hMldQ+c0sy10Xflo+fk7x2HN2nZc/o8/Ly83Tfc6zItVtLsQudTZcs1 Jxay3Cjt63appLjeKemmhoUdyLUvZI9HNh5vR7RU5d+m+4HH1D/+r/8Anf8A9whxC9LOKHAuJqxV N5xKvtEUtsu1ypI7fDd4qqtdQxT9lT1s0LUa+nSdGK9rHIvTbZziaHPv+0l6rg39lp9/zkABEvAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhmS1HmPVbTHKN+VqXiWzvX1L3yJY2ov86boaWMt65LJ R4KmQwNV01guVFdI0Tx3jnam6fzOU1DDLHPEyeF6Pjkaj2OTwVFTdFLGEnXVT2T9Po5XDtGduzd/ mp7pz/8AZ+wAXXnAAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5to GVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIv o7c3QlYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+FdVxW+iqK+ dfg6aJ8z/wDxWoqr/wBQZiJmcoZp01m863zP8lVd/OWWVzInfLBEqMj/APZuTor/AEHhlbphaqyo /d699TWSr8rpJ3rv/k2LAOPbnOmJ3vf4qIpvVURzau7V9AAG6uAAAAAAAAAAAAAAAAAAAAAAAAAA AAAP49XNY5zG8zkRVRu+26/IZk4Urda+IPiJyrN+IedtPqDpvWugxrTqqT+x7DSLy8tzZv6NZJIq ptM1OVq8qptvFy6cKg120JqNQ6i16iad35cS1RxJVmx7IYU/lVaSqRE+FppN1RzVRduZVRFRXNdL ZriirWo4/D14i1lROzm3thAoThf4oKfWunuOCZ3ZUxLVbEkSLJMbld4+CJWUqqvwtNJuio5FXl5k RVVFa519nQ2vLTExOUsgcCv9tvin/wDOrWf9TjjeUMoKTGb3oFrHYYmU+ZWbVK0WSjqo05Zaihq0 m7xSOVOrmPSNEVF6Ijnom3Mp0Omls4tuHzVjW25Y5wmVOc2bPs3q8gtlwize0W5Fp3K5GbxyyOen MiovpI1U8FQl+PaNcQPEJrTiesfE7j9lwjGdOql1xxfBbbc0uUz7mqJy1lbVMRI3LHs1WIz1p4NT m7Qw5et+j+v2H8R9NxWcO9nx7L62pxdMUv2KXmt7lJUU7Z+2ZJSVK+hG9XIxFR6oicu+zub0evpu K/CMlzjD8C4tOGK+6c3+e8wvxityWgp7rZ23ZOkXdrg1OVk+7vRcjU23ReZvQluqFFxfae6yVmpW kNJbtT8GvVBBTVWDXG7x2qotdTEm3b0VQ9ixq1/Vz0kXfmcqeCNVsA1JwXim4v6vE8K1J0Ws+kWC 2HIqLIrrVVOUU95ulctMrlZBTNpW9nDzK5UV7nbonVPBWODZwBBNatasA0BwCv1F1Gu3dLdSbRww xpz1FdUO37Onp4/GSV6psiJ4dVVUaiqgUN5QbCNNrdp5Fr/XZm3BNQ8I/wBy2QU0fPUVs7t1ba3w p1qY5l5k5Nl5d3O/B7RHd9o1k+b5lphjuT6j4h7GMjuFEyavtnac3YvXwXbxZzJs7kd6TOblXdUU qzT/AE/z/XfP6PiU4lLb3SqpN34RhD3c9PjdO7ZWzztXpJWvRGqrlT0OnRFRrY9DFG/XTVOUPScG Ya5ZpmqudvN9QAEDqAAAAAAAAAAAAAAAAAAAAAAAAAI9mWouAadUcNwz/N7DjdNUOc2GW7XGGkbK 5qIqtYsjk5lTdOibr1Q+uF5ziGothiynBsiob5aJ5JIo6yilSSJ7mOVr0RyeOzkVBlO1jSjPRz1u 8BSGD8UHthZ3R4hYNCtU6a3TTSw1GRXawdztsHIxyo5JHPVXormo3oifhIpJ9Zbxr7bY7TT6E4fi t4qKp06XCpyGvkp4aNE5OyVGR+nJzbyb7eHKnymdGc8paRdpmmaqdayARjThmpKYXQt1bkx5csXt lr3Y6k3cE3lesaRJOnadI1Yi82+7kVfBSuNN9AtTMXzOhzbUDiezbM5aFJt7WsFPb7XULJE5nwtN Eio7l5+duzk2c1q+rZWUb2ZrnVlG3wcfiXsll1G104V9Jq20UVctVk10yiu7anZIqUtsiWVsb1VO sb3PcnKvouVvVDiZVpXhmuXlE6fDLzZKWXCtI9OoJKiyxxI2inrqyqc+OCWJqI10SxuZIsapyuWF qORWqqFqZpw15JqFqTp7rpgurs+F33EKGttUsa2SG5RVtFPMqyMa2V7UhevpJz7O8W9OnWbaXaC+ 13rHqvrJXZX55uGp9XbJOwWh7DzbTUNO6GKBH9o/tejt1dszwTodG36kdjyOK9vX2z82ZqtmJaR8 deq+d6bYpa7JadO9DJK++0FrpWU1PWXHt1qou0ZGiN5lgiYnNtvsxCE8Mti1LuWk8We5rwD+23kG pLH3675feMmsDpLrFUqroWxx1UiyU8LYVjY2LZqJy78qeCbBwnhrteP6laz6h5Vf2ZImsfcqaroJ KFYGUdvpqV9M2l5+0csqOY9d3IjPV09ZXNi4NtYsTxD2oMT4wsltemcTH0lLa48co3XikoHKu9NF dFdzNREcrWv7LmamyN2REQ3QJHwGacapaT6CMwbVXHqiwVNDfbk+z2me5Q176C1SS89PCs0L3sdy 8z9vS6Jt0TwITxGW+m104ytLOGfK2d6we0Y9WahX60vcvYXeRkzqajinb4Pjjlar1YvouRyoqL02 1fjVgosVx22YzbZquWktNJDRQSVlS+ondHGxGtWSWRVfI7ZE3c5VVV6qU/rlw03DUvUDGdZdN9UK 7TvUPF6Oe1094htsVyp6q3yqrn01RSyua2RqOVzmqjk2Vyr1XlVodVqDobozo3d7rxTYPjMGNZBp 7ht4kkt1higoaG6UzaZ8jWVkEcaLJyui3YqK3ZWpvzcrUSE8FfD3ptk3DxaNUdWcQsWbZnqjTPyP JL1faCGtnqVqlVzIkdK1ezjZEsbUY3ZqKiqiJuWVpXwuUOKXLMMx1Wzmv1NzLPLellvV3uVJHRwp a0a5EoaalhXkghXmVXIiqrnLuq7kCsvBfqti+FS6LYtxb5HbdLXMlo4LQ3HaN93paCVzlfSxXRzu ZrdnOaj+xVzUXZFRERAMhUNTdMo8nvadFbTc6p1m1L1sZhOJOe9ZHMsq16TRqxXbqrGSwSdfBPA0 Nx16Q6b4TpNpTgWnuH2y2ZFedTMetNlucNOzzgypfK98lU+o27SSR3IqySOcquc/mcqr1Lqu/CJi T7zodDiN2ZYMR0Tq6qtpbA2iWfzjM+FGQPdOsiLG+OTnlc5WPWRz3b8q9VkWr2gnttaoaUZ9W5X3 K3aY3arvT7R3HtfOdTJC1kDu27RvY9k5Fd+A/m5tvR8QKSyPFcX1V8phRW+6Y5a7hb9PtMn19b3i jjlbJcayq7KNsiOReZUp1RzebfbboU1obetRtWs61E4g7twbv1kS75HW2XHLhW5DZ4aWzWejesUV FTUtbJvG7dHOkka1vOrt/W7fW1Nw15JZeKW88RmKauz2ygyqioaPI8alskNS2uSkiWOHsqpz0dTt 8HKjWKqrzdeqbRik4RtTtPr3kzeH3iZuGAYrld0qL1VWCoxaku7aKsnXed9FNK9qwNcqboxWva1f BAKTxqy6p8Oeh3FlnmVaUu0txS+0PnLDcaS8UVbFQVtRRy09Q6PukjmRtdUPplRqI1NtkRNkO1uu gulWhfky7/NkuF2q4X6o07WouFxuFKyar86VNMiQIkr0V7WwzTRtia1URqMTZEVVVbt1H4QKfOeG ReGil1RyBlHV1tNV3W+XpX3WuuCMrG1UzXq6SPlWSRqbcqo1ieDVJbxO6CrxG6NV+jUeWexmgutV QyVlRHQ95V9NT1DJlgaxJI+XmWJic267beCgZPy3CmZJVcCWhWV0FPc7lHSwZDeHVUDZHtitVril 7GRXIqrG573M5V6OVnVNyxtetBs7x3iCsuv+EaIYxq1i1sxX2NrhVVNT0k9nclQ6Zay3snYtOrla qtVuzXr1RF9LpZmr3DNf871nwXW7T/VmbB7zhlvqLO+FLHDcYauhmcivja2R7UhftzJz7O6cvTp1 +WRcP2tlHnORZZo/xS3fFrflFUldW2W+WCLIaamqeRrFdRumljfTsVGp8EiuYi+CIiIiBweEes4e MurM41E0a08uGB5JV18VpzTHKynfQS0FdTNXlbJRNcsDHKj3L2sbd37u3Xm5kToPKCZBfqzEtOdD rBeam0N1gzq3Yrdq2mkWOWO1PVXVTWOTqjnojG/narmr0cpaugGgFt0LtuQzzZXc8ryjMrq+95Hk FxZHFLX1bmo1OWKJEZDE1E2bG3dG7r18ET6cQ2gNg4hMPt9guN9uOP3jH7tT3/Hr7beXvVquUCqs UzEd6L09JUVi9FRfFFRFQM1+UH0V0U0o4Prhc9O9ObDjOR41cLMmI1tnoI6e4QV3foGp2czE7R71 j7VV3cqu2Vy7uRFOzy3FbNqh5RXTzH8mxu0V8uC6ZVmSXvtKOKSOetq5Eomsl3RUerWojmo7fZOq eBYtDwp5rmOXYzk/Ejr1V6mUmGVzbtZbJT47T2W3JcGIqR1dTHE+R1RIzdVaiua1qqvo7K5FmmFa C+xXiH1G1/r8r851GcW+1Wuit3ceyS001JErXs7XtHdt2sm0n4DOXbb0vFAs+oba7dapW1EVPBbq WnckjFYiRRwNb1Tl8EajU8PDY869CJLFgHk5dVuJJcdt1BfM3dll8oapKSNk9MtXM+jp4mORN2R8 7GKjEVE69PE9DMnsNNlON3bGK2aaGnu9DPQTSQu5ZGMljcxzmr6nIjlVF+UytDwJ5jUcLFVwp5Dx CPuePOrKDuVR7FYoH0tup6pKl1IrY50WVz3tbvK5/TlT0V6gV1d+G3RvRTyal9ueYYHZrrk8mni1 VXdrlRxz1sVzqKZO7sjmeiviZBPNG2NrFaicm+3M5yrD9QH6lZBX8MnC7JpvctSrZj+mtvzXLMVi vFNb0vL4omU1PHUS1T2MfDBOzmWNVXn3TdF23Ta/E7oKvEbo3XaNsyz2NUF0q6GSsnjoe89pTU9Q yZYGsSSPl5liYnNuu23gp1WtnDVU6i5pjGrGm2pFbpzn+JUk1sorxS26Kvp6i3yru+lqaSVWtljR d1bs5vKrlXx5VaGfJdL9aMm4g9H9Q8O4LoNHY8SvEkeQXiiyGxuZVWaWLklp5IaOVHSon71OV3Lu uyJuqm183r7nasLv90skayXGjtdVPSMRvMrpmROcxNvX6SJ0K50k0OzXDsyuGpOqWuF/1ByWuoW2 uFFpWWq00VKj+flhoIXOZ2iuRN5Xue/ZNkVE33uEDKPku7fZqXgtwq522Vk9Zeam6XC7VHNzST1r q6ZjnSL4q9GRxt3Xrs1pHtZNcuOnRbJcRTIrLoRV2POM4ocRtMFudeJ7iiVcj+zfIj1ij9GNiq9y Lsjttk2Uk6cFeZadZJerxws8SF70ptORVj7jX45LYaW+WplU/wDDkpoZ3N7vzbJujVXwRE2ajWp3 2C8IEkOf2nVnXnWXJ9W8sx6RZrItxhht9qtcy9Fnp6Cn2jbLt053K7wRdt0RUCtcxwixa++Ujjsm U0cdzxrSrTyCoq7dO1JKepuNZVq+KOZi+i9nZ9nJyr0V0LN0VOh+cYwjE9feObUPHc0x22V+EaBW az23HcZmpmLbY7hcoXVEtatNt2bntRj403RUREaqJuiKl+aXaC+13rJqvrLXZX55r9T6q2Sdh3Hs PNtNQ07oYoEf2j+13R26u2Z4J0Ivn3C9k9TrDctdNDdZqnTfKMjoKe3ZJHJY4bxQXaOnTlgkfBI+ NWTMaiNR7X/goibdXcwVFcKLD9H/ACjLJdOLNQ4/aPakrb7m1HaoGU9LJHDUv7CeSJiIxJUVrU5t ublVPU5d5T5PJ7MP4MoNVcvkbTzZNWX3OLzK5dkRJKiVVkVV+WGFjt1LH0x4V8cw2DObvnOV3TO8 x1LplocoyO4xxwSz0vZLE2lp4Yk5KaBrHLsxu/XZVVeVqNrOj4HdSodD7hw5VXFLc5cDW11VrtVL FjEEFXDFIj+yZVVLJuepijc5HKxiQ9pyo1zuRXMUMyzUtzf5MCx2isnSjv8AxFaiwsnkXxSavu7p Ef8An3homL/I4u3ygujekOlXBFdLRhmEWyhvVvr7NBjldBTMS5OuTq6DebvCJ2r53xpOr3qqudu5 VXddzrde9EbPe864U+CmO913mnH7TcrlcblQL3WpjW3W1sNLWxpu7s5FqOd6bq5EcvXmTfe5YOEv O8zzbFsl4iOIWu1ItGEXBl3slhjxymtFKtwjRUiqqtYnu7y9m6q1NmNRd+myua4IRg0FVefKaZCu bTNqLlimk1vhsrZPUk08a1VRGnhv2j5GK5PU9UNe36/2PFrNWZFk15orTarfEs9XW1tQyCCCNPF7 5HqjWonyqpT+vXC7bNYcnsGp+K53etPdSMWhfS2vKLOyOV60z1VXU1TBJ6FRDu5y8jturnddnKiw Wr4Lc41Pr6FnFJxN5FqhjttqI6qPGaSyUtgtdXIxd297jplc6oai7Lyq5OqfJ0A6Tie7rrrxQaKc NN0rUqcAuNBXZzkVHDN8De4qZu1FA9WrtJD2rVe5u6tcjkXxa1Tp+LfT7A9ONZOGS6aRYbZcYy+r 1IpLaj7JQRUb57GrNq+KRImt54kjc3dF35Uc7bbmXe79b+GeDU2/4dqFgGc1ened4C2aCx3qgoIq qFtJMxGS0k9I/lZNCrU6N3by7rsvU4unnDJdbdqjSa3a16rVupWa2eilt1imfaobXbrNDKm0zqak ic/aWRN2ulc9zlb06IiAU3w96cYlrdxf8RGuGZWemvlJj2SUeG2SlrY0mpIKm30rYqmbsnbsWVqq iNcqbsSWXb8NSBYjcccwiycemoNls9vpcUobhJabda2UzEomXaioZY5nNi25EV9TNCq7J4oi/Ia+ 4atBfc+YZesbqMr9klxyHJbllFxuXce6dtU1b0c5Oz7STbla1jd+Zd9t+ngVzQcD9A3hl1E4eb1q PU1dVqPfK7IblkNPbEge2sqKiKdq9gsr+ZrVgia5O0Tmai9W79AzvqVYL/o3wNaE6K6Y4w+PK9XZ rLZL2tqkgoLhW088Lqurpkqn8qNe9z+yR0juVGuei9FOTrdovq3m2jsWA6QeTng08yWyVNDWY1kd DlmPMqbXPTzxvWTtY5kle5zGvaqucqq5yOXdURTTeUcKl41F0VxrTvUjWG43HMcNulPerBmtrtEF uqKCtp90p3spmq6NWtYvK5rnLz+O6LsqcjEOHnVyTN7DmetfE3fM3jxeV1Ta7RarLDj1C+pcxzO2 q208j3VKo1ztmOcjN1X0dlVFCo/KD5WzRu4aUa+4q+Gt1VxSvqo6SyQRyPkvtmdSvdc4nNjRXJDE xqS9o5OWPqv4TkP3bsZxfTXgv1L4k8lv1BnOa6jYfPkd4yKWBHQ1U0tKq0VHAx6fB0sL3xMZGqIq K3dURdmtvDTnh0ix7UvLtZdS8qjzrMcma63UtVLbUpaWzWVPwLdS07pJeViqqrI9XbyL1VE67wej 4JoYOF/N+FOp1QrJcXv1wqp8dnZbuWewUUlU2pio1VZnJUsjlau7vg1c17k2b0VA+HDdpZZdLeGf Sm2UtioqK61WM0tVdJ4qZjJpp5o2TvbI9E5n8r5nom6rsWCLLiGZYJgOO4rnmoKZpdqBk0Trs20x W1JI05EjakETnNbytRE35lVV3X8yDn3/AGkvVcG/stPv+cgAIl4AAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAEa1Lt3nbT3I6BG8zpLZUKxPle1iub/7UQtrSK7+ftLcSu7ncz6izUiyL/4RImo//wB5 FINUwR1VPLTSpuyZjo3J+ZU2U5fCpWyVOh9io513ntstXQy/mWOpk2T/ANFWkuGnK9lvj5T+qlwv TpYCKujXHjE/bC3AAdB5QAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNn d5wt8dPB2LEaqP8ATavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs 5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiG r9y80aVZhcUds6Gx1qsX+/WFyN/9qoS8qvijrlt+g2WStVeaWCCnRE8V7SojZt/kcpHeq0bdU9Ur nB9vjcXat76qY75hDNNaLzdp7jdGqbOZa6ZXJ/fLG1Xf+1VJIce3UqUNvpqJvhTwsiT/AO5aif8A 4jkHMpjKIh6+5Vp1zVvkABs0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVBrtoTUah1Fr1E07vy4l qjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cyqiKiua6x+F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZS qq/C00m6KjkVeXmRFVUVrndwVBrtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cy qiKiua6eze0NU7HLx+Ai/HGW/W+bYQKE4X+KCn1rp7jgmd2VMS1WxJEiyTG5XePgiVlKqr8LTSbo qORV5eZEVVRWudfZe2vOTExOUgBBNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ 4dVVUaiqhg1q1qwDQHAK/UXUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqZR0/0/z/Xf P6PiU4lLb3SqpN34RhD3c9PjdO7ZWzztXpJWvRGqrlT0OnRFRrY2n+n+f675/R8SnEpbe6VVJu/C MIe7np8bp3bK2edq9JK16I1Vcqeh06IqNbHoYp3r2f4aXe4P4P0crt2NfNAACs7QAAAAAAAAAQ+/ ax6R4tdEsWSaoYna7m6VsDaGrvNPFUrI5URrEic9Hq5VVOm2/URGexiaop1zKYAiGqeqGPaQ4nJm OTUd2qqNk8dMkNroX1dQ+SRdmo2NnXxTx8DrtHtX4tYrTX3qm08zbFKejqEghblFpWglrGq1HdrE xXO5o/Vvv4p4Gcpyza6dOloZ61gApG7ZZxc1uoslnxnSXCLbh9Lc2RLeLxfnzT1lCj055Y4YE3jk VnNytfvsu2+6E61ZxbUXMMXZZ9MdTlwO6rVxyS3VLRDcnLTo1yPibFMqNRXKrV59905eniMmIuZx MxE6vd800ONV3O20EsMNdcKankqXpHCyWVrHSPVdka1FXqqr0REIdpBp9lenVgq7XmGql7z2vrKx 1WtwukUcTokVjG9lGyPoyPdnMjevVzvlIpT8H3DrBqLNqy7TqOfLJ7ut9W4z3CrkVlb23bJKyNZe zZtJ6SIjURBlHOTVXMRMR3z5Zprqhq9pxovYIco1OymCw2uoqW0cVRNFJIj51Y56MRsbXOVVax6+ H71T+aWat4HrRjcmX6dXWe42iOqfRpUTUM9JzyNaxy8rJ2Merdnt9LbZevyKSqqoKGu7JK6jgqOw kSaLtY0fyPRFRHN38F2VU3Tr1U+41ZM5VaWeer/OfP6KQt2tWuF71GZits4XL5TY1DdXUNbktzvt LSsZTMkVjqmKmXd8zVROZqNXdUVFJjrBQa33GzUNLodfsTtFwdVL3+qv9LNOjKfkXZYWx9FfzcvR /Tbf+efAZ69UMRROUxVVM5+75IfpVYtSsdxRtBqtnlJl1+dUSSur6S1soImRO25YkjYqovLsvpLs q79fAg9i4WMRtGfU2o9y1D1IyG60Va+upIrzk81RS07nK70GQojW8iI5URqoqbbeJdAGlPMTapmI ideSO5fp1gGoLKOPPcJsWRx2+R0tJHdrfFVshe5Nlc1sjVRF2ROu3qO0slhseNW+O0Y5ZaC1UMSq sdLRUzIImKvjsxiIib/yHOBjNvoxnnlrAAGQAAdnR5JeqCmZSUlb2cUe/K3s2Ltuu69VTfxU+3sv yL+Mf8zH+ydMDbTqjnQzhrNU5zRGfZDufZfkX8Y/5mP9key/Iv4x/wAzH+ydMBxle+WOS2OhHdDu fZfkX8Y/5mP9key/Iv4x/wAzH+ydMBxle+TktjoR3Q7n2X5F/GP+Zj/ZHsvyL+Mf8zH+ydMBxle+ TktjoR3Q7n2X5F/GP+Zj/ZHsvyL+Mf8AMx/snTAcZXvk5LY6Ed0O59l+Rfxj/mY/2R7L8i/jH/Mx /snTAcZXvk5LY6Ed0O59l+Rfxj/mY/2R7L8i/jH/ADMf7J0wHGV75OS2OhHdDufZfkX8Y/5mP9ke y/Iv4x/zMf7J0wHGV75OS2OhHdDufZfkX8Y/5mP9key/Iv4x/wAzH+ydMBxle+TktjoR3Q7n2X5F /GP+Zj/ZHsvyL+Mf8zH+ydMBxle+TktjoR3Q7n2X5F/GP+Zj/ZHsvyL+Mf8AMx/snTAcZXvk5LY6 Ed0O59l+Rfxj/mY/2R7L8i/jH/Mx/snTAcZXvk5LY6Ed0O59l+Rfxj/mY/2R7L8i/jH/ADMf7J0w HGV75OS2OhHdDufZfkX8Y/5mP9key/Iv4x/zMf7J0wHGV75OS2OhHdDufZfkX8Y/5mP9key/Iv4x /wAzH+ydMBxle+TktjoR3Q7n2X5F/GP+Zj/ZHsvyL+Mf8zH+ydMBxle+TktjoR3Q/Uq00+TwZvPa LTJkVLSOt8F3fbKda2Klc7mdA2dWdo2NXdVYi8qr12O39l+Rfxj/AJmP9k6YDjK98nJbHQjuh3Ps vyL+Mf8AMx/sj2X5F/GP+Zj/AGTpgOMr3yclsdCO6Hc+y/Iv4x/zMf7I9l+Rfxj/AJmP9k6YDjK9 8nJbHQjuh3PsvyL+Mf8AMx/sj2X5F/GP+Zj/AGTpgOMr3yclsdCO6Hc+y/Iv4x/zMf7I9l+Rfxj/ AJmP9k6YDjK98nJbHQjuh3PsvyL+Mf8AMx/sj2X5F/GP+Zj/AGTpgOMr3yclsdCO6HMuN4uN17Pz hUdr2W/J6DW7b7b+CJ8iHDANZmZ1ylpppojRpjKAABsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAcfhcl7Cy5tYndPNuYV7Y0+SJ6Rub/1uOQdbw+Sd11H1Us2+yMrbbWtT5e2p3Kq/wCVptanK9T7 /l+iHG06WBvRu0Z/qiPqvUAHTeNAAAAAAAAAAAAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf/AGKv rXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2L EaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Ka4rn8+l9PbP4zv1tpNvl3mR23/uFylJ8UT+1tmA29P/AKRm1uc5PlYxsqr/APiIMV7Gp0+BYzx9 rqnPu1uSACi9KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKg120JqNQ6i16iad35cS1RxJVm x7IYU/lVaSqRE+FppN1RzVRduZVRFRXNdY/C/wAUFPrXT3HBM7sqYlqtiSJFkmNyu8fBErKVVX4W mk3RUciry8yIqqitc7uCnNftEvZwtv1OwXJWYZqXhqOqbDkrVRjWtTdXUtX6pKZ6KqOa5F25lXZU VzXT2b2h+Gdjl4/ARfjjLfrfNovWrWrANAcAr9RdRrt3S3Um0cMMac9RXVDt+zp6ePxkleqbIieH VVVGoqplHT/T/P8AXfP6PiU4lLb3SqpN34RhD3c9PjdO7ZWzztXpJWvRGqrlT0OnRFRrY4Fw05A7 jFyi18SGuGZY5d8gtkMi4tgtvqWrBjsUcqwyV0lM5yvWeSRnM170VGtWNUX8BGXDqvxU6aaRZS3B rvbMsveRPpY6xtssNhnrZVierkYqOREj6qxybc3q6kl65MzoUq2AwlFumMRensXECM3zKb/Fp7Nm OI4TW3m7PtzK6hsFVM2gqJ5HNRyQSOkRWwv67Lzb7KiopEdHcr4hcouVwn1i0osOE2xIGrQQUl8b catZeb0myujRI+Xl9aesq5as3amuImKd/V9VqApfVHTDiIzfLZpsJ4j24JiroY2toKPGaasrHSIn pr3iVyKxFXqnL4eBYWX4Das+wOq0/wAtq62porhTR01ZPTTupp5eVWuVyPYqKxVc1FXZfWqDKN5F VU5xo7PH5pIkkbpHRNkar2Iiuai9URd9lVPz7L/kKq1G4qeH3Sa+z4xqBqdbbXeKVI1moEimqKhn O1Hs3jhY53VrmqnTqiocvR3hv0d0FkudTpfi0trqby2JtwqJbjVVUlT2auVnN20jkTbnd+CieKk9 Zj9hiu0t+jslAy5zo1Ja1tMxJ5EROVEdJtzLsiIibr4IPwxLH+pNPNE9/k6jUPNJ8EwmvzG34hfc rko2wrFarFTpUVlV2kjGJ2bFVEVG8/O5d+jGuXrtsRvRrUzUPUlLvU5tojedPqSkWDzc663CCaav R/adpvFH6UPJyx/hb83adPwVLKAzjLJmaapqzz1blI57aeMW9ZzW0+n+W6Z45hcckXcqmpoKuru0 jezYsvaMVewT0+dG7LvsiKpYupuCS6kYfV4lDmmS4o6rfE7zpjtd3OvhRj0cqRy7Ly8yIrV6L0VS UgZsRbjXnMzmrvR3ROz6MUlzprZmeZZJLdpI5aiqya8OuE3MxHInK5Wojd+Zd9k67Ifar0B0QuOV VWcXTSbE6+/1szaia41lphqJ3StRER6OkaqtciNTqm3gT4DSnPNmLdERFOWqAAGG4AAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdLpC/unEBmdJ4d/sNBV7fL2b1j3/wDad0R7BH924nHJ 4NrcJe3+V7K1q/8AUKdVymetrejSwt6n+GfCYn6NCAA6rxIAAAAAAAAAAAAAAAAAAAAAprVDW2/4 LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO /wDsVfWuiSvZzwo2s7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAUdxIu7XINMqL+HkL5tv8Ag4VX/wDGXiUVxCLz6i6VU/8ACrrnJt/4tO3/ AOZWxfsp93zh1uA4/wD3UdlX9tTsgAU3ogAAAAAAAAAAAAAAAAAAAAABxbhdLZaKdau63GlooE8Z aiZsbE/ncqIfm2Xm0Xu3Mu9kudLcaGXm7Opo5mzxv5XK13K5iqjtnNVF29aKniDPmcwFJ6ccYWie r2a0eEaa3C+X2asSba4Q2OqioIuzjc9ySTSsYjd0YqJ06qqJ6zvtZNRdXMIntVDpToTVah1FyZMs 0jb5T2yChVisRO0fMi783MqoiePIpnRnPKUcXqJp06Zzjq1/JZwIzhdfnl6wWjr81sNFjmU1NPIt TQwVKVkFJLzORido3ZJE25FXbbxVCB6b6e8R9ry+HJNUuIK23+0silY/HbbikNHAr3N2a/vKvdKv KvXZeijJma51ZROvw7c1xHxra2jtlFUXG41cNLSUsT5555noyOKNqKrnucvRrURFVVXoiIVlrDw4 4DrlcbdXZzcclSK3QvgbRW68zUdNM1zt95WRqnM5PBF3TopM8TwPFcKwuh08sFqRlgt1J3GGjqJX 1KLAqKise6VXOeioqovMq9F28BqyImvSmMtX+cyNYZxFaH6i5UuFYHqdY7/ekp5Kru1vqO2+CYqI 53O1FYu3Mnr3Os1g14uml97osasWiGoedV9fS96ZNj9sbLQwpzubyTVDnokb9277K1eiou5YOPYf iWJU/dcUxe0WWDbbs7fRRUzNvk2jaiHbjOM9jGjXNOUzlPV+qMUl8y+86btyKhxVLVlFXZ3VVPZb nOitp65YlcynmkZ+9STZrnN9W6oQjSKLisnyWoueudVptTWJ9E9lNbMZZWPqGVKvYrHySz9FRGJI io3oquRfUW8BmzNGcxOc6lRau6BXbVnJKa7M131Jw22Q0TKWS14rdW0Mcz0e9yzOfyOdzKj2tVPD ZifnJ37A7DVafN00v/er9Z3Whtlq1ucyyz11OkKROWaRNlc97d1c5NlVVVU2JEBnJFumJmctrJ/k 2cAwi18MmIagW7E7VT5LeYrnT193jpWJV1MTLnUNax8u3MrUSKNOXfb0G/IhrAzd5Oj4m2n36W/W tWaRNrnryiwkRFijLdHyAAaLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAARixO7DiTxl/h3rHq+H+Xle15JyK069lxFaeu/79Q3eP/JAjjH71PbHzZmM7V2P4K/7Z lo0AHWeGAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGq j/TavNurdk6pv4F4FNaoa23/AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4 bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKI19XfVrSWP5X3x 3+SljL3KI17/ALcGka/8ff1WIrYv2U9sfOHY4C/bo/lr/sqdoACm9AAGOOKvyieE6PPqsE0obSZf m3WB8kb+0oLbL4bSOZ+7SIvTsmKmy9HORU5VzTTNc5Qiu3qLFOlXOUNjgjGmNvyu2ae49R55dX3L JEt8L7xVPRqdpWvbzTcqNREa1HucjURERGoiJ4HfVlzttvdE2vuFNTOnekcSTStYsj1XZGt3Xqqq qJshhJE5xm5IIjqfqzp5ozjSZhqZksNjtDqhtI2pkhll5pnNc5rEbE1zlVUY5eieo4ekGtOA6549 V5Vp1XVlZa6StdQ9vU0M1L2r0Yx/MxsrWucxUkTZ23iip6jOU5ZsadOloZ69ydApH26tcLjqUuIW Dhcvbscpr15vrcmuV9paOFtG2fkfWQQO3fO1WIr2tRUVU2J1qtQau3KwU9Lo1kON2a7Oq296qr5R S1UbaXkfzdkyNzfhOfs9ubdu3N69ho5bWsXImJmInV1eaaAhmlGP6nY5jUtFqzqFR5jepax87K2k tDLdHDArWI2BI2OXm5XI9edeq8+3qIJbOEvBqLUVmptxzrUW93SnujrtSwXPJppqSmkWRXpGyFER Oybvyox2/ooiLuMo55JqqyiYp/T5rPzDUDBNPKCO6Z7mljxykmescU92uEVIyR6JvytWRyI523qT dRhGfYXqTZPZJgWTW+/Wvtn06VlDMksSyM25mo5Oiqm6f5T+5ZgWD57DSU2cYdZchhoJu8UsV0oI qpkMuyt52tkaqI7ZVTfbfqdlarPaLDRMttjtVHbqSP8AAp6SBsMbf5GtREQasm34tLqU7jHE/wCz PP6fCcf0K1TSjdWyUdVkNfYe62uDk5kV6Sueqvbu3boieKKSrWO766WuitkWhuIYzeq2plkbWy36 vfTwUjERORyNj9KTdVduieG35yxAM4z1Q1iirRmKqkU0xTVFMPpfbjfjLspWSVar2OJP3BGK9VjR nb/Cbo3ZF39aKV5gnDznONZzRZxlfEzqLlHcZZZG2iaaGmtsyPY9iNmgY1UejUfunVNnNavqLuA0 pJt0zlnzIBqpoJpFrbLaJtU8KpsgdYVnW3pPPMxsPbcnaejG9qO5uyj/AAkX8Hp6yS4bheK6e45S YhhNhpLNZqDn7tRUrOSKLne57tk/O9znL8qqqndAxnOWTaKKYq0ojW/LGMiY2ONjWMYiNa1qbIiJ 4IiH6ADYAAAAAAAAAAH8VFVFRFVN/WnqMiUPH/j+nWql60S4lLE7F7xZ6xaeG/0MT5bbWwO2dDO6 P0pYEexzF2TtGpuu7m7GvDAHlWdA/ZBiNq18x+i5q7HOW2Xvkb1koZH/AAMq/wDByuVv8k3yNJLc U1To1KmMquW7fGWtsc2+ES4fePXSzh64TcHwSnt1wyrOIG3HezUbVijgdLcal8STTuaqJzNe1USN sjuqbom+56E6d1WaV2EWe4aiUtFSZHWUram4UlE1zYaSR/pdg3mVVd2aKjFcq+k5qqmyKiJ5JeTb 0D9tzXGLM73RdrjuA9nc5udu7Jq5VXusX59nNdKv/BIi/hHsgbX4ppqyhBwbVcuW9KvZGqI7OcAB C6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAROReXiE0tX+Gy +N/yUaKSwiVR8YPSj9O/1IxO2ntj5w3p9S5/JX/ZU0gADrPCAAAAAAAAAAAAAAAAAAAAACKZFa9M qvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb 2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAGKtLeNnix1pwS2amaacA/nn G7z23cq3207bT9r2Uz4ZPg5oGSN2kie30mpvtum6KirtUyr5Lj4iemX6a/XFaA90Px2fk6vrds/2 Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q /HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq +t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6vrds/wBmPdD8dn5Or63b P9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqA GVfdD8dn5Or63bP9mPdD8dn5Or63bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV9 0Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk 6vrds/2Y90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t 2z/ZkDz7N+OvOMtxLKvcDdyXFnVy9h7adnk7z3mJsf4XK3k5eXfwdvv6jcwNa6KbkaNWxNYxFzDV 8ZanKdcd8TE7eqWI/bE47PxAvrVs/wCyPbE47PxAvrVs/wCybcBpxFvcseksV0vCPJ456567cafE foraMz0e0mrsfwC/wVKVbseuKXK51HZVEkEkb+RkczI94ndI4uqL6T1ReU8+aGS8YZlFHVVMFXbb lZ6yGo5JadEmgkjej0VY5E23RURdnJsvrTY9nvJ0fE20+/S361qy4dQtH9LdV6LuGo+A2TIY2t5W PraRj5Yk/wDBy7c8a9V6tci9SCL0W5mnLU6NeArxdFN7T/FMROv9NiH8LtM6p00psxh1qv2pdFlP JcaW43Zkcb6dvKjXQtjj6R8rmqjmKq7PRyHyn4PuHSs1DqdVrhp1HWZTVXFLs6vnuFW/lqkej2vb F2vZt2ciKmzTvNFtAsJ0BornYtOKq701guVQlW20VdYtTT0U22znQOeiyN505eZHPci8jVTZeZXW SQTVrmaZdOi1E0RFyIzj3/N8Kuhoa9sbK6jgqGxPSViSxo9GPTfZyb+CpuvX859wDVMAAAAAAAAA AAAAAAAAAAAAAAAAAAAABXPEHmemGFaS5DV6uytdjtxo5bZNRNTnnuDpmKxKaBni+V+68qJ4bcyq iIqp2mrWrWFaK4VWZ1nVy7tQ020cMMac9RWVDvwKeBni+RypsiJ+dVVERVSKcPfD3muqWa0HE/xP 2nu10pvhcIwiVeenxqndsramoavR9c5ERVVU+D6dEcjWxS2rU1znzKGOxlOGp0dtU83mqPydsmGY RpzX6LTWK6YxqHZ6yW5ZFZr3B2FdK2ZUWCpa1UTmi7HsWdE9FU6onMiu1ydPxQcL9PrXT27O8EvS YlqtiSLLjeSRN8fFVo6pET4Wmk3VFaqLy8yqiKiua6uNCtdajUOoumneolhXEtUcSVIchx6Zf5ES rpVVfhaaTdFa5FXbmRFVUVrnb37UxOlCHg7GU3KYs1apjZ1/qt8AFd1QAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAZc0t4luLHWnBLZqZppwPeecbvPbdyrfbLttP2vZTPhk+DmiZI3aSJ7fSam+26b oqKsq9sTjs/EC+tWz/sky8lx8RPTL9NfritNVHQ4i3ueV9JYrpeEeTEfticdn4gX1q2f9ke2Jx2f iBfWrZ/2TbgHEW9x6SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2J x2fiBfWrZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61bP+ybcA 4i3uPSWK6XhHkxH7YnHZ+IF9atn/AGR7YnHZ+IF9atn/AGTbgHEW9x6SxXS8I8mI/bE47PxAvrVs /wCyPbE47PxAvrVs/wCybcA4i3uPSWK6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvcek sV0vCPJiP2xOOz8QL61bP+yPbE47PxAvrVs/7JtwDiLe49JYrpeEeTEfticdn4gX1q2f9ke2Jx2f iBfWrZ/2TbgHEW9x6SxXS8I8mI/bE47PxAvrVs/7I9sTjs/EC+tWz/sm3AOIt7j0liul4R5MR+2J x2fiBfWrZ/2R7YnHZ+IF9atn/ZNuAcRb3HpLFdLwjyYj9sTjs/EC+tWz/sj2xOOz8QL61bP+ybcA 4i3uPSWK6XhHkxH7YnHZ+IF9atn/AGR7YnHZ+IF9atn/AGTbgHEW9x6SxXS8I8mI/bE47PxAvrVs /wCyPbE47PxAvrVs/wCybcA4i3uPSWK6XhHkxH7YnHZ+IF9atn/ZHticdn4gX1q2f9k24BxFvcek sV0vCPJhez8Quu1p1lwPSTWvhe9r/wBsDzp5suHs2o7rv3GlWom+Cpo1+WJvpOb+6bpzcqoaFKf4 t/jk8KP+PX6qgLgKt+iKKsqXa4Nv3MRamq5Oc5/SAAELoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAARNyc/ELpgn/e4r2//AC0iISwitG3tuIzA2/8AeLbdZf8ALEjTHPT2 x84bRqt3J/gr/tlo0AHWeFAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR /b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1nc0cvOu8 XL2nIi+jtzdCVgAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWgaqAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYL8nR8TbT79LfrWrNImbvJ0fE20+/S361qzSJzLnrz 2vY4X2FHZHyAAapwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIbq1q1hWiuFVmdZ1cu7UNNtHDDGnPUV lQ78CngZ4vkcqbIifnVVREVUatatYVorhVZnWdXLu1DTbRwwxpz1FZUO/Ap4GeL5HKmyIn51VURF VIpw98Pea6pZrQcT/E/ae7XSm+FwjCJV56fGqd2ytqahq9H1zkRFVVT4Pp0RyNbFLatTcnqUcbja cLTlGuqTh74e811SzWg4n+J+092ulN8LhGESrz0+NU7tlbU1DV6PrnIiKqqnwfTojka2LYABfiIp jKHl666rlU1VTnMhQnFBwv0+tdPbs7wS9JiWq2JIsuN5JE3x8VWjqkRPhaaTdUVqovLzKqIqK5rr 7BnaxEzE5wx7oVrrUah1F0071EsK4lqjiSpDkOPTL/IiVdKqr8LTSborXIq7cyIqqitc63zp+KDh fp9a6e3Z3gl6TEtVsSRZcbySJvj4qtHVIifC00m6orVReXmVURUVzXVxoVrrUah1F0071EsK4lqj iSpDkOPTL/IiVdKqr8LTSborXIq7cyIqqitc6jes6GuNj0eAx8X44u563zW+ACB1AAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAFceS4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqo6rw4AAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAADHnFv8cnhR/x6/VUBcBT/Fv8cnhR/wAev1VAXAUsT68dj0fBHsJ7 fpAACu6oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEaxtveOJaxR+PdM YrJ/5OaVrCSkf08Z3riZrp/FtFhSRfyOfWtd/wBSCNddMdcFc6OHvT/BPjq+rQYAOq8OAAAAAAAA AAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLw Ka1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAA AZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rQNVAAAAAAAAFd616+6W8PmNwZNqfkaUEddOlJbqOC F9RWXCoXwip4I0V8juqb7Jsm6cypuWIY27jTZ75U2anyyJlVBp5pgy4Y5TSpuyGqqKtjJapjV6c/ LK6NXePRn8FAJFVeUM04x9IbhqPonrhgOPzSMj9kOS4RLT22PnXZqvkje97UXdNt2b/mNN2e8WnI bTRX6xXKmuFtuNPHVUlXTSpJFPC9qOZIxydHNc1UVFTxRSnOIDXix6e1btPcj4d9WdR7bfrU59Y7 FcOW8250MrpIn007udE51RqqrFRfRe1fWZ74hNf7Ld/J52zV/hdprzglpjvlvo7NRUiJaZoY4bn3 eSBWUsitZG9zHorUds5ruqdVQDeYMa8QNXqhwr6Hxri+ruT5NqNqvldnxaG85BVNqqW1V9X2naS0 VLypHTxI1kvJEiKiLyKvNyrv0vEjgepfCBpG/iK0+4idUcoueHVtvmvlpyy/Lcbde6Sapigmj7u9 vLTuVZUc10XLyojkTrsqBuQGWMbz7Jbx5RatxiDKbw/FJ9F6e909nfWy9ybVPusbUqEp+bs0l7N3 Lz7c2y7b7HJt2X5Y/wApLdcFflF2djUejkd0ZZlrZVoW1i3dka1CQc3ZpLyKrefl5uXpvsBp44t0 ultsltq7zebhT0NBQQPqaqqqZWxxQQsarnyPe5URrWtRVVVXZEQwfwaYBqVxG6SZBkWp/ETqrTQ0 OVXi1WNlkyeejmiijmVVmmn3WWdyOerGRvcsTGRNRGbucq1fqprNqZqBwHZDp7qDlU1dd7Jq8zSv Ib6iJFLW0MFQyTt5OXoiqnZscv75Grzb8yqoakTyhumN37zcNOtHtadQcepJHxyZHi+FS1NsVWKq PVssj43ORuy7qjV6dfAujRfXPTHiAxBM20tyNl0oGTOpaqJ8boamiqG/hQzwvRHxvTfwVNlRUVFV FRVlmOY7Y8RsFuxbGrZT2602mljo6Kkp2cscEMbUaxjU+RERCmtcqnCeFbSTV3iEwHCbXR5LXUXn OvmZGqJcLgidjTPmRF6okkqK5E235nr+E5VAvcGI63QnWeh4bptdU4q9VnapQYuuWuRb03zGtW2m 7ytJ5t5Ow7Dxj/B3/feHoEe1P111Y1XxbhCy7AM1r8Numpt1WmvK2+Z6U/M+mayocsCr2c6Ru7WS JkqPajkZui9dw36Ryzah4dkOZ5Jp9Z702pyDEY6GW9UaQyNWkbWMe+m3erUY5XtieuzXKqIic226 b5Vz+25jw1cSWhzcV1h1ByGxaj3mtx7IbPlF+kulPKvYI+KohST/AGu9r1VV7PlauzURETmRYvww 6V2618bPEjeqrUPUCZmE1+O1DGz5NVSx3Bk9tnc5tc1XbVbYk6RNk3SNERG7Ab1B5a6ccTelWu1h uup2vnHFm2m2R3e41fmXF8YvE9upLBQskcynbJFFC5tVIqN53OkVyORzU2TqXJozmmsHGFwfXKvx DVmtpNTtPMoqrfa8ktVTJQ0l/qqDklgWqhYrWSU9TBNG17HorOZedW9OUDcxHLNqHh2Q5nkmn1nv TanIMRjoZb1RpDI1aRtYx76bd6tRjle2J67NcqoiJzbbpvkvR7WjPuN3U/GbhYqjI8DwjS2KKrzW kpK2WimuuUuRW+aldG5HSUcHK570VeWTma1zeqKnTcK+kVHT8cfEXXO1B1AqHYhcsbfCyoyeqkju KVFunVW17VdtVtj8ImybpGiIjdkA3gAAAAAAAAAAMF+To+Jtp9+lv1rVmkTAPBbqvxL41w0YdZNP uE32Z2Cm84d0vfs7t9u73zXCoc/+x5WK+Pkkc9nVevJzJ0VC7fb04yfxEvrPtX2Zz66JmqfOHq8N foizRExOyP3at3Y0iDN3t6cZP4iX1n2r7Me3pxk/iJfWfavszTQnq74Tcoo3T8NXk0iDN3t6cZP4 iX1n2r7Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NIgzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7MaE9Xf ByijdPw1eTSIM3e3pxk/iJfWfavsx7enGT+Il9Z9q+zGhPV3wcoo3T8NXk0iDN3t6cZP4iX1n2r7 Me3pxk/iJfWfavsxoT1d8HKKN0/DV5NIgzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7MaE9XfByijdPw 1eTSIM3e3pxk/iJfWfavsx7enGT+Il9Z9q+zGhPV3wcoo3T8NXk0iDN3t6cZP4iX1n2r7Me3pxk/ iJfWfavsxoT1d8HKKN0/DV5NIgzd7enGT+Il9Z9q+zHt6cZP4iX1n2r7MaE9XfByijdPw1eTSIM3 e3pxk/iJfWfavsx7enGT+Il9Z9q+zGhPV3wcoo3T8NXk0Ff6y6W+x3Cvsdqbc7hTU0k1LQunSHvU rWqrYu0VFRnMqcvMqKib7lRaH8YOiOvDm2rG8jW1ZI1VZPj15alLXskT8JrWqvLLsqLv2bnKnrRP AjXt6cZP4iX1n2r7M8r+LRLzTcQ2UXG8adN0+vVZUxXGtscF8gufdKqWNsj5EngRGosiu7Xl8WrJ /IS27WlqlUxWNmxlXRE5c8TEx4zD3hIbq1q1hWiuFVmdZ1cu7UNNtHDDGnPUVlQ78CngZ4vkcqbI ifnVVREVU82uC7i24xbjeabCLJiVw1ZsdOrY5krpFjmoGepVuLvRYm3gk3Pvts3Y11woW+2cQnEP lOccRMraXULTetdDjenNUn9j2GkXlVtzZv6NZK9VTadqcrVRqptzRcuabE6WUy1ucJ0xZ4yiJznf s71gcPfD3muqWa0HE/xP2nu10pvhcIwiVeenxqndsramoavR9c5ERVVU+D6dEcjWxXxhuu+IZxrJ qBofabdeIr7pvHbJbrUVEMTaSZK6Dt4uwc2RXuVGrs7mYzZfDmTqWQeX+perGtemnF5xZ0nD9pxd cmy+7WnGpY62mp2yQWWlp7Qx01U9HKiSTbPRIYeqvfv0dyqx1yIimMoedrrquVTVVOcy3bLxF4TP rnHw+45ar5keSU9H3+91FqghkocfhX9z79M+VnZvk/exsa96psqtRFRSBZrxwYvimruV6L2PQzWD N77haUTrtLilgpq6miSqp2TwrzLUseiK1+3pMT0muRN0Tdez4I8b0Yteg1nyTRm9TZBT5Tvdb1kF evNcrpdHr/ZElau6qkzX8zVYqqjNtkVfwnV9w9f90L4rP/JMN/VaGWqydLOMnSTU7NmaYVlvyvBM 3midPTY3mtlktNdVRoiqroUcqxy9EVdmvV2yKqIqIqp8tbOMDFNFNTrRpDLpZqVm2S3qzuvlPS4h Z4K9yUzZXxuVzXzxv3RY1VdmqiIqdfUVr5U222+38M6ar0fZ0uW6e5DabvjdwYm09PVLWRRuaxyd eVWuVyt32VY2qvVqbQ7iF1PXSzyienOZ1On2Z5U72r6qF9qxO0OudwR0lXNu5IWuRVY3b0nb9OgF 2Yrxi1OU5PaMZdwl8RFmS7V0FCtxuuGwwUVH2siM7aokSpcrImc3M9yIuzUVdl8DncUHC/T6109u zvBL0mJarYkiy43kkTfHxVaOqRE+FppN1RWqi8vMqoiormu42FcYtPmmWWrE28MXEJY1utUylS43 rApaSgpeZdu0nmWRUjjT1u26GhBtZiZic4Y+0K11n1EnumneolhXEtUcSVIcix2Zf5ESrpVVfhaa TdFa5FXbmRFVUVrnW8Vd5QbCNNrdp5Fr/XZm3BNQ8I/3LZBTR89RWzu3VtrfCnWpjmXmTk2Xl3c7 8HtEdVuN6/8AGlcMfttdV8DfeJ6ikilkm9sC30PaOc1FV3d5WLJDuvXs3qrm+CruhRu2dGc4ejwW P42jK5E5xuiZ+TUYM3e3pxk/iJfWfavsx7enGT+Il9Z9q+zItCervhd5RRun4avJpEGbvb04yfxE vrPtX2Y9vTjJ/ES+s+1fZjQnq74OUUbp+GryaRBm729OMn8RL6z7V9mPb04yfxEvrPtX2Y0J6u+D lFG6fhq8mkQZu9vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RRun4avJpEGbvb04yfxEvrPtX2Y 9vTjJ/ES+s+1fZjQnq74OUUbp+GryaRBm729OMn8RL6z7V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq 8mkQZu9vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RRun4avJpEGbvb04yfxEvrPtX2Y9vTjJ/E S+s+1fZjQnq74OUUbp+GryaRBm729OMn8RL6z7V9mPb04yfxEvrPtX2Y0J6u+DlFG6fhq8mkQZu9 vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RRun4avJpE4F/rLpb7HcK+x2ptzuFNTSTUtC6dIe9 Staqti7RUVGcypy8yoqJvuZ99vTjJ/ES+s+1fZj29OMn8RL6z7V9mNCervg5RRun4avJJdD+MHRH XhzbVjeRraskaqsnx68tSlr2SJ+E1rVXll2VF37NzlT1ongXYeD3Fol5puIbKLjeNOm6fXqsqYrj W2OC+QXPulVLG2R8iTwIjUWRXdry+LVk/kNFcFvFtxi3K9U2D2XErhqxY4HMjn789Y5qCP5VuLvR Ym3gkyv322bsTVWNWlS59nhLOvirsa9mcR9Nr0Q8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVRde eAAAAAAAxJxqcRlNjGvmB8PuQ601uk+G3GyzZNk+RWx6xXCoi7SSGmoqeZGPdArpIXq57U5tvBU2 VFDbYPPrRXiRwzGOK3CNKNIuJq/6u4JqJR3GnrKXIq+W4VtguVNCs0MsdVNG2R0UzWuZ2aq5EVHK v73bteF3DtSeIS563Oz/AF81MpMdxrVTILLY6Sy5JPRTwqx7HOR1SirKsMbHQtigRzYmbyqrXcyb BvAHnvR8WWq2i3DFxCUuRZJLleX6L5ZJilivlyja+esp6meOKjnqUREbJLGj3vcqps7kai79VWXa u6GayaJaBXnW+w8U2qVx1Hw60eyC4Nul6SqsdfJC1JKqBbc5nZMiVqSIxG7K30eqgbaOJdrlBZ7V WXeqZI6Ghp5KmRsaIrlaxquVERVRN9k+VDGmUax5zxLaoaL6LYfm170+smbadRam5PXY/OkNzfTT NRsFHT1DmuWFEl5udzU5lTZEVNutlYro/rFpFX5zQ1Wsd1znS+vxeeSggyuvfW363XRGuR6NqOzR JaZ0fX03q5HbIiJs5zwtPRHV/Gte9LLBq5h9Dc6Oz5FFLNSwXKKOOpY2OZ8S87Y3vai80blTZy9F T+QnJ5w8JmhOeag8C2N5pJxBaiYjU0FmucmNW/Fbv5uoqNsNRUKx1SxjearfJK17387tuRzWNRvK rl1nwXan5PrJwu6e6j5nVNqr5dbY5tdUIxGdvLDPJAsqo1ERHP7LmXZETdy7IidALrAMEa/6iutf FNk2NcS2tmp+lGmjLdbPYDW4rVVFut1ymfFvWrV1lPG53asl9FrHq1qNTddt284b3BjLMNX8o4au DPUDVnGte6XWSkpqlkeE3qpWGrqKZlTNFBHFVVMTuSrfC+R0iuVrVXl5XJ4Imfcw1600wTSx2o2n XlEsyyTV6z0kVylttyuc9TZLzVN2dPRpb3QpDFG9OdsfIrVb6PpesD1PBi7M9Xs14kdWdHNEsIzi +YBj+aaex6m5HX2GdsN0ko5kRtNRwVCtVYU7RV53tTmVNkTb12RiGkmtOjV0zaFda7zmWmtVjM09 tbk1ykq8htV3a13N2dUkadpTqxN05n87X8uyJsrnhokGEODquz2HhWt3GHq3rBnuS1mP4veq2nsM 97kdbpaOjSobz1LHIrqmpesMj+2kcqtRzGoiIzrUGDa+aZ6j6Ys1F1U8ofmWJasXqKavjttpuc9L ZbJMrnLT0q0DIXRTRtRGI/nVznel6W/VQ9K851Cw7Ta20N2zW9NttLcrpR2WlesMkqy1tVKkUESN ja5d3PcibqnKibq5URFUkZ5c6wZxc+KbhX4ZNZMnyXIbZfLzqZZ8Xu8FnustHSvmSpqYpKxsUaox tRvTtkjlRN4+0cjdj0tw7GIcMxi3YtT3m83aO3Q9i2tvNfJW1s6bqvNNPIqvkd18VXfwA7kAAAAA AAGPOLf45PCj/j1+qoC4Cn+Lf45PCj/j1+qoC4ClifXjsej4I9hPb9IAAV3VAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6bRhne9dtQKzx832u10e/ydoj5Nv8A3TuTr+HO PvOYao3vx7a80tDv/wCTwbbfzc5m3Gd2iOv6SjxU6OCvz1RHfVT9M15gA6jxYAAAAAAAAAAAAAAA AAAAAAimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXi b0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAAZV8lx8RPT L9NfritNVGVfJcfET0y/TX64rQNVAAAAAAAAGb+I7h+1IvWpeLcSvDzebTQ6lYlRS2mot9450t+Q Wl7le6jmez0o3Nc57mO8OZybqmzXJpAAZZq9WOP7J6J2P49wk4rhV0nb2XsgvufU1wt9M5eiypTU sfbPT1oi7eGyopBtSuDTPsV4BbNwzacOXNMitd4orhNJ2kFC2ZVuXe6hzO2ka1rGc70aiu5lRqdN 12NvgCkeL/Qm+6/6SR49ht2pLZlmOXmhyjG6msRe7tuNI5VjbLyoqo1zXyN3RF2VyLsu2y1BrLjP FhxbYJTaDZloXQaYY7eK6ikyzIZsrpLkklJTzsmfFQwU+8ive+NitdLyIiJsvjumzQBlfUrTLWDT rixs/EfpJppHndlq8DXBrtY6e8U1vq6NGViVMVTE6qcyN7fRYxW8yKmzl9aHF0p0w1/qeOG9cQmp eF0Vlxy96apY6OKlukFWttqG3GJ7KKVUcj5JVZG+d0jI+yasvZo9yt5nayAHnPwLZfxGYHopkc2n Oi1JqZZbnmN8moWQ5HTWmpttS2fkfFMlSnJJA7lZI17HK9FdIisVOVS2dOOB+ou/CTmeiutd0pm5 RqdfK7L73WW1O1jtt3qJY5InQqu3OkSwQ8ybojvhGovKvMt96F6HYnw+4VPgmGXC7VtBUXWsu7pL nLFJMk1TJ2kjUWONjeVF8E5d9vFVLEAyJiudeUL0xsFPgGRcOON6p1tsiSjpswt+cU1sirI2pysm qaaoZ2vabIivViJuu+yJ4naWThk1i1L0h1XsfEnqelbkWrNN2cdrtcssllxZsce1MykieqczmuSN 0junOrETdV3e7U4AxfUM45q/QZ3DbJoNYYrzNYfYlLny5fTLau7LD3d1clKje99osW68nZ9Hrv4e gdrl3C3luM1HCpimnlrderHpDeEdfbg6oggWOFKVrHVCxyPRzueTmdyRo5U38NuprsAZ34mNKM/1 B1g0AynELB3+14Tl010vs/eoIu6UroEaj+WR7XSdU22Yjl/MRzCtO9bNMOMjVbK6XSynyTT7WB9i llv0d8pqd1m7lRvglbLSyfCzcznu2RibbcvXqqN1WAMZ6M4nxUcIOK1+h+FaFUWqeH265VtVid5p sspLVJT0lRM6ZKasiqU5uZsj3qr4+dF5uidCe5/Dxk3Lh6ocRt9Fjz9Ucvq/N11vVlmbTW/FbfPI vaVKdvKktRLFCvK1Ym8yvXmRvopzaPAGRLPwu5Dwtal4FmPC/i8l0xqsoafFdQ7D32CCWup40VYb 2jpnsY+qjer+0RF5ntfytam7lTssFwDXDSnjM1TzG36Xw5DgOrkthqHZBFfaanfZVoqR8MjZaWT4 WZVc9VTs022RvXqqN1SAAAAAAAAAAAAwX5Oj4m2n36W/WtWaRM3eTo+Jtp9+lv1rVmkTmXPXntex wvsKOyPkAA1TgAAAAAAAAAAAAAAAAAAAAAAAOBf6y526x3CuslpddLjBTSSUlC2VsXeZkavJHzuV Gs5nbJzKuyb7mJ9M/JpW2+ZXXaqcUWVrluR3qtkuVZaba98NAk0j1e5Hy9JZGoq7I1vZtRE29JDc 4Nqa5p2Ibtii9MTcjPLudXjOK4zhdlp8cxCwW+y2ukbywUdDTsghjT8zWoibr618V9ZWmu2hNRqH UWvUTTu/LiWqOJKs2PZDCn8qrSVSInwtNJuqOaqLtzKqIqK5rrfBiKppnOG1dqi5RoVRqdPwv8UF PrXT3HBM7sqYlqtiSJFkmNyu8fBErKVVX4Wmk3RUciry8yIqqitc7q9G9JNQsU4yeIHVa/4/3XFs 3p8ajsNf3uB/fHUlAkVQnZseskfK/p8I1u/i3dOpDNdtCajUOoteomnd+XEtUcSVZseyGFP5VWkq kRPhaaTdUc1UXbmVURUVzXWPwv8AFBT6109xwTO7KmJarYkiRZJjcrvHwRKylVV+FppN0VHIq8vM iKqorXOv2rsXI63l8Zg6sLVvpnZKHUuimqXDtxHOzrh/xfz7pfqTVrJm2KxVtPS+ZLgu3+y1Gk8j Gq13++RMXddl2Rfg0jij7DxRaN8YOtmrWB8MtRqFjWocVgit9XDmFrtfJ3KgZFIqsnkWT90V7erW /gbpuioptcEqmxzd9JuJXi3zfFp+IrB7Npjphh90hvq4lTXqO73G+10O/YpU1EKJCyBqqqq1vVd1 TZVVr2TfKNJNQrjx74ZrTR4/2mGWnT+sslZc+9wJ2Va+ple2Lslf2rt2uavMjFb18TR4AEE1q1qw DQHAK/UXUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqNatasA0BwCv1F1Gu3dLdSbRww xpz1FdUO37Onp4/GSV6psiJ4dVVUaiqmUdP9P8/13z+j4lOJS290qqTd+EYQ93PT43Tu2Vs87V6S Vr0Rqq5U9Dp0RUa2PSuuLcZysYbDV4mvRp987jT/AE/z/XfP6PiU4lLb3SqpN34RhD3c9PjdO7ZW zztXpJWvRGqrlT0OnRFRrY9DAHPrrmuc5eqsWKMPRoUAANUwAAAAAAAAAAAAAAAAAAAAAAAAcC/1 lzt1juFdZLS66XGCmkkpKFsrYu8zI1eSPncqNZzO2TmVdk33OeAMMaZ+TStt8yuu1U4osrXLcjvV bJcqy02174aBJpHq9yPl6SyNRV2RrezaiJt6SG08ZxXGcLstPjmIWC32W10jeWCjoadkEMafma1E TdfWvivrO0BtVXVXtQ2sPbsepHmrjyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVHTeNAAAAAAzVx BaQarUeuuE8Uuh1ktuSX/GrVU43fMarq9tCt2tUzlkYkFQ9FZHLHK5z/AE9mrunVNtnaVAFJaZ5X xT5vqHHcs+0qsWmuCUVDLHLbqu8Q3e73Kscqdm9slK7saeJiIu6Kr3O+TqiszBwh5Tr3hFfxAXfT XSSm1HsVbrLk0C26G/09qrKGujdErpVdUp2UsMrJIm9HI9iwqvK9H+j6GFd6M6HYnobT5hTYncLt VtzXLbhmVwW4yxSLFW1iRpLHF2cbOWJOybyo7mcm67uX1BmrHuCTNs84atZcT1dr7Zac/wBbMgqM qqWUcq1FLZqhssc1FS9oibyNY6JEe5u/ovcic2268zUKLjg1p0bq+Hu96FWTGLhkNAyx37OZsspa q3d2XZlTUQUkad5c6ViP5Y3tbyq/q5dtzZoAyVqLw5aj6WZ7pNrPw5WKhymt03xJuA3LGrhcGUEl 2srGIkKw1D0WOOaN6K9ef0Xbp16bLKcIZxaajZNlmVapY/Raf4hJjU1osmCRXCiudVVXB/Mq11TW xM2Z6K9m2NknL13ciK3d+jABnjhO0pz7TPgwxrSfN7D5tyq32W5UlRb+9Qzckss9Q+NvaxPdGu7Z GLujlRN+u2ynacEGmua6QcLOBacai2XzTkVlpaqOuo+8xT9k59ZPI1O0hc+N27HtX0XL47eO6F5l V6oaGXXUrIYb/Ra+6p4VHFSMpVt2L3Ojp6R6tc93aubNSyuWReflVeZE2Y3omyqoWoZ71AyfitxP PMhobfoZY9XdPrwyF9pio73R2qtt3obTQVUdYvZ1DXP9Jr2u6J0VFVdk/vuS8g/HE4gv/v8AWz/+ Hl6WG1yWSx26yy3Wuuj7fSQ0rq6ve19TVKxiNWWZzWta6R23M5Ua1FVV2RPADEmLcDmYZxotr1ie bWWxabrrFdKW7WTFbTUpV0WOTUvK+J73xNbGr5ZWMWVIk5eVqcvjytsGjz7j8qcUt+BwcPOL2rKo 44KKqzavy2mqbNuzZJKxtFEiVTudEVUiVG7K7xXbZdUgDMevOkGsds1twPij0Zs1qy3JcbstRjGR Y7UVrbYl4t0rlkR1NNJzMhkZM570bIqoqKic3RebsMIZxaajZNlmVapY/Raf4hJjU1osmCRXCiud VVXB/Mq11TWxM2Z6K9m2NknL13ciK3d+jABnThW0MyLG+CjH9AdXrK+1XGexXOy3miZUwzuijqpq lFRJInPjcqxzIu6OVOvXruhA9Jm8avDzpfQ6D27h/smfuxiGS22DL4cupaChmpOZ3d31VLKneGuj arUc2NHcyM2R2/pLscAZT4n9H+IPUnQPTZYKOwZZqVgeYWTMLlQ2+ZLbR3OWk7XtIKd87lRn7qmz nqiKjVXZu6MNG4JecpyHErdec1w12J3qqjc6rszrhFXOo3I9yI1Z4vg3qrUa7dvRObbrsd+AAAAA AAAAMecW/wAcnhR/x6/VUBcBT/Fv8cnhR/x6/VUBcBSxPrx2PR8Eewnt+kAAK7qgAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfHhWi7XDMkvnj55yu5VjXfK3mYxP5vQU+d0 rW222Vdxfty0sEky7/I1qr/+I7rhgtrrZoVisciL2lTBNWPcvi5Zp5JEX/I5CSxGd6OqJ+irwnVo cH1ddVMeFU/SFpgA6LyIAAAAAAAAAAAAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp/sl841UyP7e m820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/8AsVfWuiSvZzwo2s7mjl513i5e 05EX0duboSsAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK0DVQAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBfk6Pibaffpb9a1ZpEzd5Oj4m2n36W/WtWaROZc9ee17 HC+wo7I+QADVOAAAAAAAAAAAAAAAAAAAAAAAAAAAAABUGu2hNRqHUWvUTTu/LiWqOJKs2PZDCn8q rSVSInwtNJuqOaqLtzKqIqK5rrfBmmqaZzhpct03aZorjOJdPwv8UFPrXT3HBM7sqYlqtiSJFkmN yu8fBErKVVX4Wmk3RUciry8yIqqitc6+zHuu2hNRqHUWvUTTu/LiWqOJKs2PZDCn8qrSVSInwtNJ uqOaqLtzKqIqK5rrH4X+KCn1rp7jgmd2VMS1WxJEiyTG5XePgiVlKqr8LTSboqORV5eZEVVRWudf tXYuR1vLYzB1YWrfTOyV9kE1q1qwDQHAK/UXUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVR qKqNatasA0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4dVVUaiqmUdP9P8/13z+j4lOJ S290qqTd+EYQ93PT43Tu2Vs87V6SVr0Rqq5U9Dp0RUa2PauuLcZyjw2GrxNejT753Gn+n+f675/R 8SnEpbe6VVJu/CMIe7np8bp3bK2edq9JK16I1Vcqeh06IqNbHoYA59dc1znL1VixRh6NCgABqmAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVx5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqjqvDgAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMecW/xyeFH/Hr9VQFwFP8AFv8AHJ4Uf8ev1VAXAUsT 68dj0fBHsJ7fpAACu6oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiGr1 y81aY5LV83KrrfJAi/Isqdmn/teXlp7Z/Y/gWOWJWcq2+00lM5P75kLWr/7UUz5rNB51slkxJE5v ZJkNutit+VrpUcu/5vQNRk+FjOuqeqPq5vDdWjhrVG+ap7oiI+oAC88yAAAAAAAAAAAAAAAAAAAA AKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8Rm iOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAYA4XLpx2cNe hOM6Ke4T9kfsc77/ALJ+2fZ6Pt+8Vk9T+47ScvL2/L+Gu/Lv032Tf4Ayr7ofjs/J1fW7Z/sx7ofj s/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW 7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szV QAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7o fjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1 fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/s x7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs /J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7 Z/szVQAxxknF9xiYjU2ujyLyfvdJbzULS0Se2ta3pLKjebl3ZCqNXb+Eqbn091vxk/k+/rXtX2Jb vFZSuh05oMtjaqvxW/W+6qqJ15Ek7NyfyfCpv/IfprmuajmqioqboqeCoVLl+ui5NDvYTgyxiMLT fmZzmZidm2MurdMKT4LdOcy0l4aMO0+1Bs3mq/2rzh3uk7xFP2fa3ColZ6cTnMXeORi9HLtvsuyo qF2gFaZ0pzde3RFuiKI2RqAAYbgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABUGu2hNRqHUWvUTTu/ LiWqOJKs2PZDCn8qrSVSInwtNJuqOaqLtzKqIqK5rrfBmmqaZzhpct03aZorjOJZR4cqTKuLmewc X2vdbQ3B8aTQ4ZjFGxyW2ydjM6CarVj1XnqXywvVHOVeVEaqLujUj1cZu8nR8TbT79LfrWrNIm92 qaq5zQYK3TbsU6MbYiQAEa0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJXC5qHxk8NehOM6Ke4 j9kfsc77/sn7ZNqo+37xWT1P7jyycvL2/L+Gu/Lv032S1fdb8ZP5Pv617V9iXACxymvqcr0RY3z4 eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7 +te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/ GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlw Acpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te 1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0R Y3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/G T+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/ AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1 fYlwAcpr6j0RY3z4eSn/AHW/GT+T7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eSn/AHW/GT+T 7+te1fYj3W/GT+T7+te1fYlwAcpr6j0RY3z4eTMV2u3EvrxxL6Mag6g8Mntc2DTn2Rd7q/Zpb7v2 3nC3pEz0IkY9u0kTE6Nfv2m68qNVV06ARV1zcnOV3DYajC0aFGzbrAAaLAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFZT+fdc9ObDtzRUL6681Cfweyi2iX/01NJGf9Jqf z5xA5XelTmjxuxUlpavqR9Q9Z12/Ps3ZTQBawcfgmrfPy1OHw9X/AK9Fro0x451fKYAAW3DAAAAA AAAAAAAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaciL6O3N0JW Ufqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAET1Yx32W6Z5PjrWc8lba6hkKbb/Cox XR/++jSodML17INPcfuqv5ny0ETJHfLIxOR//vNU0UZf0qpfY9PluBOTl9jeQ1cFOz5KWR3aQr+b dHOUoYqMq6at+r/PF6bgS5p4a7a6MxV36p/9U9ABC6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAzd5Oj4m2n36W/WtWaRM3eTo+Jtp9+lv1rVmkTa5689qDC+wo7I+QADVOAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABH9QL37G8Ivl7R/K+loZXRLvt8IrVRn/vK 0xM5RnLaiiblUUxtl2/C1Td+x7Kc4em65LkdXNA/5aWLaKJPz7K15dhCdE8aXENJsUsD4+SWC2RS TN2/BmlTtJE/9N7ibHQw9OhapidzynCl6L+MuV07M5iOyNUeEAAJlAAAAAAAAAAAAAAAAAAAAAAU 1qhrbf8ABeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3P KYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAztltL7GOI6uRE5KbMrDDVovqdVUrljVP5ez2X+c0SUfxOUn mpuFajxpt7Hr4ymqn+HLR1bezlXf+VGdPzlbF0529Ldr8/B2eArmji+Ln9+Jp9+2P6ohzQAU3fAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGbvJ0fE20+/S361qzSJm7ydHxNtPv0t+tas0ibXPX ntQYX2FHZHyAAapwAAAAAAAAAAAAABDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZE T86qqIiqkR0G4irfrBLcsWyTFLlg2e2LlkumK3dFZVw079nRTs5mtWSNzXM3VETlVdlTZWq7OjMx pcyOb1EVxbmdc8y4AAYSAAAAAAAAAAAAAAAAAMuaW8S3FjrTgls1M004HvPON3ntu5Vvtl22n7Xs pnwyfBzRMkbtJE9vpNTfbdN0VFWVe2Jx2fiBfWrZ/wBkl4i5uUfSWF6XhPkvkFDe2Jx2fiBfWrZ/ 2R7YnHZ+IF9atn/ZHEXNx6SwvS8J8l8gob2xOOz8QL61bP8Asj2xOOz8QL61bP8AsjiLm49JYXpe E+S+QUN7YnHZ+IF9atn/AGR7YnHZ+IF9atn/AGRxFzceksL0vCfJfIKG9sTjs/EC+tWz/sj2xOOz 8QL61bP+yOIubj0lhel4T5L5BQ3ticdn4gX1q2f9ke2Jx2fiBfWrZ/2RxFzceksL0vCfJfIKG9sT js/EC+tWz/sj2xOOz8QL61bP+yOIubj0lhel4T5L5BQ3ticdn4gX1q2f9ke2Jx2fiBfWrZ/2RxFz ceksL0vCfJfIKG9sTjs/EC+tWz/sj2xOOz8QL61bP+yOIubj0lhel4T5L5BQ3ticdn4gX1q2f9ke 2Jx2fiBfWrZ/2RxFzceksL0vCfJfIKG9sTjs/EC+tWz/ALI9sTjs/EC+tWz/ALI4i5uPSWF6XhPk vkFDe2Jx2fiBfWrZ/wBke2Jx2fiBfWrZ/wBkcRc3HpLC9LwnyXyChvbE47PxAvrVs/7I9sTjs/EC +tWz/sjiLm49JYXpeE+S+QUN7YnHZ+IF9atn/ZHticdn4gX1q2f9kcRc3HpLC9LwnyXyChvbE47P xAvrVs/7I9sTjs/EC+tWz/sjiLm49JYXpeE+S+QUN7YnHZ+IF9atn/ZHticdn4gX1q2f9kcRc3Hp LC9LwnyXyDPVn4hddrTrLgekmtfC97X/ALYHnTzZcPZtR3XfuNKtRN8FTRr8sTfSc3903Tm5VQ0K aVUTROVSzZv28RTpW5zgABqlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAI DqzTLkLcZ0+j3cuU36kpJ2p/+isf2krv5ka1SfEZw6k9lPEbTOVOelwmxyVKr4o2sq15ET/9Vuu/ 5jWadOYo3z/98ElFziIqv9CJn383jk0QiI1Ea1ERE6Iieo/oB13gwAAAAAAAAAAAAAAAAAAAAAAA FH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4FNaoa23/BeIzR HRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH6vYl7OtMckxVkfaTV1vk7u3bfednpxf5xjCYA1qpi umaZ50lm7VYuU3aNtMxMe7WzvprkXsqwOyX1X88lRSMbMu/++s9CT/3muJKQfCaL2IZznWnDk5Ir ddVulA1fDulWnaNa35Uau6fyqTg5VGeWU7Ye5v6OnNVHqzrjsnXHhIADZEAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAADN3k6Pibaffpb9a1ZpEzd5Oj4m2n36W/WtWaRNrnrz2oML7Cjsj5AANU4AAA AAAAAAABDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIiqjVrVrCtFcKrM6z q5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqpFOHvh7zXVLNaDif4n7T3a6U3wuEYRKvPT41T u2VtTUNXo+uciIqqqfB9OiORrYpbVqbk9SjjcbThaco11ScPfD3muqWa0HE/xP2nu10pvhcIwiVe enxqndsramoavR9c5ERVVU+D6dEcjWxWLxQcL9PrXT27O8EvSYlqtiSLLjeSRN8fFVo6pET4Wmk3 VFaqLy8yqiKiua6+wX4piIyh5iq5XXXpzOtj3QrXWo1DqLpp3qJYVxLVHElSHIcemX+REq6VVX4W mk3RWuRV25kRVVFa51vnT8UHC/T6109uzvBL0mJarYkiy43kkTfHxVaOqRE+FppN1RWqi8vMqoio rmurjQrXWo1DqLpp3qJYVxLVHElSHIcemX+REq6VVX4Wmk3RWuRV25kRVVFa51K9Z0NcbHocBj4v xxdz1vmt8AEDqAAAAAAAAAAAAACuPJcfET0y/TX64rSVapcevCdotndz0z1L1W8zZJZux77ReYrl Udl2sLJo/hIad8bt45WO9Fy7b7LsqKiRXyXHxE9Mv01+uK0cPHx7OLn/ABB/U8p1Xhz30fgT+fP6 M3j7oPfR+BP58/ozePuhqoAZV99H4E/nz+jN4+6D30fgT+fP6M3j7oaqAGVffR+BP58/ozePug99 H4E/nz+jN4+6GqgBlX30fgT+fP6M3j7oPfR+BP58/ozePuhqoAZV99H4E/nz+jN4+6D30fgT+fP6 M3j7oaqAGVffR+BP58/ozePug99H4E/nz+jN4+6GqgBlX30fgT+fP6M3j7oPfR+BP58/ozePuhqo AZV99H4E/nz+jN4+6D30fgT+fP6M3j7oaqAGVffR+BP58/ozePug99H4E/nz+jN4+6GqgBlX30fg T+fP6M3j7oPfR+BP58/ozePuhqoAZV99H4E/nz+jN4+6D30fgT+fP6M3j7oaqAGVffR+BP58/oze Pug99H4E/nz+jN4+6GqgBlX30fgT+fP6M3j7oPfR+BP58/ozePuhqoAZV99H4E/nz+jN4+6D30fg T+fP6M3j7oaqAGVffR+BP58/ozePug99H4E/nz+jN4+6GqgB5h8RPHTwr53xL8PuoOK6pd+sGD+y zz9V+ZLjF3PvlviipvQkp2vk55GOT4NruXbd2ydSyPfF+Db54vo9dfuxvQyr5Uf4iepv6F/XFERV 2abk5yu4bH3MLRoURGW3X/8AVjgA571YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAACqiJuq7IhxeF2jW52jKdSZG7rll7ldTP8A4VHTbxQ9fXsvaIRvVm/S47p9eKyl3Wrnh7nS tb1c6aZezbyp61RXb/zF3ac4pFg+CWHEo0Te10EUEip4OlRu8jv53q5f5yTD06V3PdHz/wAlU4Vu 8TgZp565y91OufHRSMAHReSAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/8AYq+t dEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsR qo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAABQOt9F7FtXsMzxiIylv0MuM17vBO0Ve1pt/lVXcyb+OzTuzvOITEZ8w0mvdLb0d5xtsbbrQOb +E2enXtE5fzq1HN/+6IZiOQQZVjFryKn2RtwpY5lan7x6p6Tf5nbp/Mc29ToXZjfr8/863sMBd5R gqKuejOmfnHhMx7nbgA0WAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZu8nR8TbT79LfrWrNImb vJ0fE20+/S361qzSJtc9ee1BhfYUdkfIABqnAAAAOBf6y6W+x3Cvsdqbc7hTU0k1LQunSHvUrWqr Yu0VFRnMqcvMqKib7g2OeCk9D+MHRHXhzbVjeRraskaqsnx68tSlr2SJ+E1rVXll2VF37NzlT1on gXYZmJpnKWlFym5GlROcBDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIiqj VrVrCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqpFOHvh7zXVLNaDif4n7T3a6U 3wuEYRKvPT41Tu2VtTUNXo+uciIqqqfB9OiORrYpLVqbk9SpjcbThaco11ScPfD3muqWa0HE/wAT 9p7tdKb4XCMIlXnp8ap3bK2pqGr0fXOREVVVPg+nRHI1sWwAZgrOPXF3Ztl2DYpw9a35jUYReJrH dq3HMapq2kZUxOVFRrkqkdsu26czUVU9RfiIpjKHl666rlU1VTnMtPgpnRri00k1ryOtwS0vvuNZ pbou8VWK5TapLXdY4v4aQydHtT18jnbdFXZFRV5GtHFDpxonfrThV0t+S5PmF8gdV2/GMVtL7lc5 6dqq10/ZNVGsjRUVOZ7movK7bfldtlqt4oTig4X6fWunt2d4JekxLVbEkWXG8kib4+KrR1SInwtN JuqK1UXl5lVEVFc13HwrjW04yTUC0aX5lgeoumeRZErmWSmzfH/N8d0kb4xwTMkkjc/qibK5N1VG pu5URdBjazEzE5wx7oVrrUah1F0071EsK4lqjiSpDkOPTL/IiVdKqr8LTSborXIq7cyIqqitc63z p+KDhfp9a6e3Z3gl6TEtVsSRZcbySJvj4qtHVIifC00m6orVReXmVURUVzXVzoVrrPqJPdNO9RLC uJao4kqQ5Fjsy/yIlXSqq/C00m6K1yKu3MiKqorXOo3rOhrjY9HgMfF+OLuet81vAAgdQAAAAAAD gX+sulvsdwr7Ham3O4U1NJNS0Lp0h71K1qq2LtFRUZzKnLzKiom+4NjngpPQ/jB0R14c21Y3ka2r JGqrJ8evLUpa9kifhNa1V5ZdlRd+zc5U9aJ4F2GZiaZylpRcpuRpUTnCuPJcfET0y/TX64rRw8fH s4uf8Qf1PKPJcfET0y/TX64rRw8fHs4uf8Qf1PKdR4pFONnS3BNaeLHhZ0z1LsXnnG7z7N++0Xep qfteyttNNH8JC9kjdpImO9Fyb7bLuiqiyv3rjgT+Yz6TXj72OIf49nCN/j9+p4jVQGVfeuOBP5jP pNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k14+9j3 rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5jP pNePvZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mq gBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuO BP5jPpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvZqoAZV9644E/mM+k1 4+9j3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvY9644E/mM+k14+9mqgBlX3rjgT+Yz6TXj72PeuO BP5jPpNePvZqoAZV9644E/mM+k14+9j3rjgT+Yz6TXj72aqAGVfeuOBP5jPpNePvZWvk6Pibaffp b9a1ZvQwX5Oj4m2n36W/WtWV8T6kdrq8Ee3ns+sNIgApPRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAIZdqL2Z6xYNgqIklNbpn5NcW+KJHT9IN09aOlXZUXoaWKJ4cqH2RZLm+qc zeaKtrW2O2OXw7rTJ6b2/wB696ov8rVL2LeEpyomve4XD13PERYjZRER751z88vcAAtOIAAAAAAA AAAAAAAAAAAAAAAAAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08N lLlIpkVr0yq87xG55TBj78woO/8AsVfWuiSvZzwo2s7mjl513i5e05EX0duboSsAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/ioioqKiKi9FRTMWAUC4TlWX6VS JyRWS4rW2xvq7hU/CRo35eVVVF/Opp4oTX63rieoGHapQpyUtU9cau7kT/e5VV9O935myI7dV/Mh UxdP4Yr3fKXd4BvZXasNOyuNX80a474zj3u4ABVdsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAG AeC3VfiXxrhow6yafcJvszsFN5w7pe/Z3b7d3vmuFQ5/9jysV8fJI57Oq9eTmToqF2+3pxk/iJfW favsx5Oj4m2n36W/WtWaRJa6o0p1fPzUsNarmzRMVzsjo7uxm729OMn8RL6z7V9mPb04yfxEvrPt X2ZpEGmlG6PHzTcTX+ZP9P2s3e3pxk/iJfWfavsx7enGT+Il9Z9q+zNIgaUbo8fM4mv8yf6ftZu9 vTjJ/ES+s+1fZj29OMn8RL6z7V9maROBf6y526x3CuslpddLjBTSSUlC2VsXeZkavJHzuVGs5nbJ zKuyb7jSjdHj5nFVx/zJ/p+14W8WiXmm4hsouN406bp9eqypiuNbY4L5Bc+6VUsbZHyJPAiNRZFd 2vL4tWT+Q0VwXcW3GLcbzTYRZMSuGrNjgVscyV0ixzUDPUq3F3osTbwSbn322bsXhpn5NK23zK67 VTiiytctyO9VslyrLTbXvhoEmker3I+XpLI1FXZGt7NqIm3pIbTxnFcZwuy0+OYhYLfZbXSN5YKO hp2QQxp+ZrURN19a+K+ssV3adHRyzczDYG9Fybs1aMTPv9/N/mxnbhQt9s4hOIfKc44iZW0uoWm9 a6HG9OapP7HsNIvKrbmzf0ayV6qm07U5WqjVTbmi5fQAx7rtoTUah1Fr1E07vy4lqjiSrNj2Qwp/ Kq0lUiJ8LTSbqjmqi7cyqiKiua6x+F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZSqq/C00m6KjkV eXmRFVUVrnS2a6aqcoUMfhrlm5NVU5xPOvsyBwK/22+Kf/zq1n/U41+YZ00tnFtw+asa23LHOEyp zmzZ9m9XkFsuEWb2i3ItO5XIzeOWRz05kVF9JGqngqEyg77yhlBSYze9AtY7DEynzKzapWiyUdVG nLLUUNWk3eKRyp1cx6RoiovREc9E25lO81v0f1+w/iPpuKzh3s+PZfW1OLpil+xS81vcpKinbP2z JKSpX0I3q5GIqPVETl32dzejxMe0a4geITWnE9Y+J3H7LhGM6dVLrji+C225pcpn3NUTlrK2qYiR uWPZqsRnrTwanN2ko1QouL7T3WSs1K0hpLdqfg16oIKaqwa43eO1VFrqYk27eiqHsWNWv6ueki78 zlTwRqtCJU3FfhGS5xh+BcWnDFfdOb/PeYX4xW5LQU91s7bsnSLu1wanKyfd3ouRqbbovM3oa8MY 6k4LxTcX9XieFak6LWfSLBbDkVFkV1qqnKKe83SuWmVysgpm0rezh5lcqK9zt0TqngrHbOAGS/KD YRptbtPItf67M24JqHhH+5bIKaPnqK2d26ttb4U61Mcy8ycmy8u7nfg9ojr51q1qwDQHAK/UXUa7 d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqZR0/0/z/AF3z+j4lOJS290qqTd+EYQ93PT43 Tu2Vs87V6SVr0Rqq5U9Dp0RUa2PS5XFEZys4XD3MRciKO/c6LG9f+NK4Y/ba6r4G+8T1FJFLJN7Y Fvoe0c5qKru7ysWSHdevZvVXN8FXdDsvb04yfxEvrPtX2ZpEHP0o3R4+b1EWa/zJ/p8mbvb04yfx EvrPtX2Y9vTjJ/ES+s+1fZmkQNKN0ePmcTX+ZP8AT9rN3t6cZP4iX1n2r7Me3pxk/iJfWfavszSI GlG6PHzOJr/Mn+n7Wbvb04yfxEvrPtX2Y9vTjJ/ES+s+1fZmkTgX+sudusdwrrJaXXS4wU0klJQt lbF3mZGryR87lRrOZ2ycyrsm+40o3R4+ZxVcf8yf6fteFvFol5puIbKLjeNOm6fXqsqYrjW2OC+Q XPulVLG2R8iTwIjUWRXdry+LVk/kNFcFvFtxi3K9U2D2XErhqxY4HMjn789Y5qCP5VuLvRYm3gky v322bsXhpn5NK23zK67VTiiytctyO9VslyrLTbXvhoEmker3I+XpLI1FXZGt7NqIm3pIbTxnFcZw uy0+OYhYLfZbXSN5YKOhp2QQxp+ZrURN19a+K+ssV3adHRyzczDYG9Fybs1aMTPv9/N/mxDPJcfE T0y/TX64rRw8fHs4uf8AEH9TyjyXHxE9Mv01+uK0cPHx7OLn/EH9TyltwTiH+PZwjf4/fqeI1UZV 4h/j2cI3+P36niNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADBfk6Pibaffpb9a1ZvQ wX5Oj4m2n36W/WtWV8T6kdrq8Ee3ns+sNIgApPRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAARXVDJJcVwa6XKk5lrZI+60TWpu51RKvIzlT1qiu3/mJUQ5beufa3Yvh6J2luxhjslua bbtWRq8lMxfVvzrzbetFNas5/DG2dSW1NNEzcuerTEzPu5vfs966tLMLi0908sOHRtaj7dRsZOrf B07vSlcn8sjnL/OSoA61NMURFMbIeGu3ar1yq5XtmZme2QAGUYAAAAAAAAAAAAAAAAAAAAAAACj9 WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/AILxGaI6 NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABE9VcIi1F09vmHvRqS19K5KZ7v97qG+nE7+Z7W7/m3 JYDFVMVxNM7JSWrtVi5TdonKYmJjthnLTHJpsrwu33GuRzbhC1aSvY5NnMqYl5JEcnqVVTm2/vkJ URG525NO9dLxYGs7O1ZzCt8oPU1tazpVRp+d3SRfzbEuOTETT+GdsanuLlVNzK7b9WqM49/N7pzj 3AANkYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADN3k6Pibaffpb9a1ZpEzd5Oj4m2n36W/WtWaRNr nrz2oML7Cjsj5AANU4AAAAAAAAVBrtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7 cyqiKiua63wZpqmmc4aXLdN2maK4ziXT8L/FBT6109xwTO7KmJarYkiRZJjcrvHwRKylVV+FppN0 VHIq8vMiKqorXOvsx7rtoTUah1Fr1E07vy4lqjiSrNj2Qwp/Kq0lUiJ8LTSbqjmqi7cyqiKiua6x +F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZSqq/C00m6KjkVeXmRFVUVrnX7V2Lkdby2MwdWFq30 zslfYAJVMIJrVrVgGgOAV+ouo127pbqTaOGGNOeorqh2/Z09PH4ySvVNkRPDqqqjUVUa1a1YBoDg FfqLqNdu6W6k2jhhjTnqK6odv2dPTx+Mkr1TZETw6qqo1FVMo6f6f5/rvn9HxKcSlt7pVUm78Iwh 7uenxundsrZ52r0krXojVVyp6HToio1seldcW4zlYw2GrxNejT753Gn+n+f675/R8SnEpbe6VVJu /CMIe7np8bp3bK2edq9JK16I1Vcqeh06IqNbHoYA59dc1znL1VixRh6NCgABqmAAAAAAAAAABXHk uPiJ6Zfpr9cVo4ePj2cXP+IP6nlHkuPiJ6Zfpr9cVo4ePj2cXP8AiD+p5TqvDnEP8ezhG/x+/U8R qoyrxD/Hs4Rv8fv1PEaqAAAAAABlfh21FvC6+8UyZznFc/HMQvtrfSNulye6jtFL3KSSbs0kdyQR +jzO5dk6bqaoPJ7UvTvWzPtZuKKqwKC33vDcXy6xX7KsOV00dVlcVPCj+4tfH1SNImzPVqLu96Ro iOVEQDfONcWelt80avPEFd4L7i2AWqWVKe8X2jZA26QNfyMqaSJj3yvjkeqNjR7GPeqpszqRyy8c OnlTe8ftmaaa6oYBb8rqoqGy3zLMb7lbayol/cYu2bI9YnSfvUlazdOvRCi+OjP8X1j4K9NdUNJr vT0OFezTH62tqEomyw2qhZ20LmT0zVRqpBO6Frot0buxGouyop33EVoHq7nukU2Pa58emHUWG36r oGR1kmnlLSJJULOySm7GdK9FRzntbsrV6t5vVuBpnCdd8RznVnO9FqS23i25Lp+lFJXR3CGJkVZT 1UaviqKVzJHLJHtsjlcjVarkRU3OovfFLpdjeo+b6dXt9zpPa5xqLKMlvToGLbaCCXrHTucj1ldU OZ8I1jYlRW+Dld6JTXEvJHw78R+kHFPX3BsNjuUT9N87rVbyMWmqEWWjqpETflayoY5znLvsiMbv 4HRaG4lp7mPC5qzrrxG1iWSy6+XKsvV2q6mbsZLfZHSd2tcXabLtyM5Xxrsv7q3dF8ALJpuPbTiK ltmRZVpTq1iWH3eaCKly6+4v2FnVs7kbDK+VsrpIo3q5vK98bWrzIu+ymmPEwvqJWcTHBdpK3UNu sOKayaT43HQxyWnI7WyjuqW50scULaatgcsdTInMxUfK1d0TdEVURDb9trYrlbqW4wxyRx1ULJ2M kbyva1zUVEcnqXr1QDM/F3mV3odUNGdNLlqfc9PcDzGqvsmS3223Fttn5qKjZPS03fXf7WZI5ZVc 5qo5yM5UVD9cFeW5Jk911Rp7XnOR5tpVa7zSU2C5JkErqiqrfgF84MZUvaj6qnjn5Wxyu339JEc7 bcpGr0cl49LnrtV5znVXBl2neZ1uN4JYJqj/AGOsDaJWOpq2ej6tnWrcj2ySSNeis50ZvyojZjw8 8RObcTOuGIYrZaWpwqg0fslcmo1npJ2No6u9vc6ip6KJGKqSU8awy1DHN3aiKxqrunUNuGZpOPfT iqpblkOJ6U6t5Zh9pmnhqcvsWLd4s+0LlbNIyR0rZJY2K13M9kbmojVXfoaUqqinpKWaqq5Gsghj dJK53g1iJuqr+bYxHhmk2qekOmFRmvBPxJ4tkWlETK672zFMstzKq3QxdpJLURQXKFzZmM5+0Tle mzV3Vzt1c5Q0Rm3FHo1g2l1g1crMinully51NFjkFppJKqtvM86bxQU1O1Od8jv4KonKqbO2U6fT 7i3wfNNQaHSzJMGz7TvKbxTy1NmoMzsqUK3WOJOaXu0kckkb3Mb1cxXI5E9XiZA1b1JyXXrJOC/W nHLxSaYUeRS36lgra21suVFaLw+JkMTFge6JkiSvhe2FVc1URefxTZbkzvQXUy76r6QVOuPGpi9X X2HLIb5jtobgtPbKu6y0+zqimikbWq7Z8W7XbNcibtXZdkRQtrUbi6wXBc9rtMLBg2oGomTWaniq rzQYVYvOK2mOVOaLvL3PYxjnt9JrEcr1T971Q49y41tE6LQyPiDoqi8XLGUu8FirIKekZHXW+ukm bC6GphnfH2To3Par0VfwVRzeZFRVrrghqYbdrZxR4tfZWR5QmpdRdXwyrtM61Ts3oXoi9Vj5N9l8 E5k+VCAccuXaH6icIOoXtOMtUtHTaiUFtyOe22t1JFU3dK6HvL1k7Njal68zeaZqvR26ekoGl7Xx X6b1GnuUat5NaMpw/CsZSORl7yK0uo4LvBJ+5z0LN3SzRvXkRm7GucsjNmruhG7Lxw6eVN7x+2Zp prqhgFvyuqiobLfMsxvuVtrKiX9xi7Zsj1idJ+9SVrN069EK+8qZbrg3h3xWptlZHarTZ9QLFU3e rWkSop6KgTto0lkh3RJI2SvgXkVURdkTdNzquIrQPV3PdIpse1z49MOosNv1XQMjrJNPKWkSSoWd klN2M6V6KjnPa3ZWr1bzercCUZrxa55jvGzbdEaDTDPrhjkGKz1VVRW+1UMj66okrIo4rlG98zX9 ziakrHLzNVXOdvG7la4nmV8ZGGWbN79gOG6X6najXDFJm019mw7Hkraa3VCt5uwklkljR0qJ4sj5 1TqniiokBrGS0vlQ8bgrKpJpk0NkidKreTtpEu7+ZUTfoq7Ku3XY/FNoxktRqHqFqXwW8Tdss9Td Mhm9mGLXW1x3W1OvsaI2dHORWz0ki9Ffy8yqqr6kRGhonSDWDBtcsKgzzAK+ont8k81HPDVU76ep o6qJ3LLTzxPRHRyMd0Vq/KipuioqzUong/1xvuuOBZHVZfjNns2S4dltyxS+eZJHSW2sraVWLJU0 rneksb+1T8JVXdFVV6oXsAAAAAADBfk6Pibaffpb9a1ZvQwX5Oj4m2n36W/WtWV8T6kdrq8Ee3ns +sNIgApPRgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD51NTBR08tXVStjhgY6SR7 vBrUTdVX+REPxwxWaorLFe9U7pCrazNa91RAj09KOgh3jp2f5Ecv50VpC9WJa670Vq04ssituWaV zLa1yeMVNujqiXb5Gs8fzONJWe00NhtFFY7XAkNHb6eOlp408GRsajWp/kRCXDU6dzS3fOf0+alw te4jCRajbcn+mnzq/tcwAHQeUAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/2 KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB 2LEaqP8ATavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAVLxKYrXXfA2ZdYoee94ZUtvVHsnV8bP3eL+R0e6qnrViIdRYrxRZDZqK+W5/PTV8D KiNfXs5N9l/Ongv50LvkjjljdFKxr2PRWua5N0VF8UVPWZjwyhfp9muSaP1KubT26ZbrY1cv4dun dvyp8vZvVWqvyqpQxNGhXFfNOr3vUcDX+Ow1WHnbRrj+WdvdOU++U7ABC6AAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAADN3k6Pibaffpb9a1ZpEzd5Oj4m2n36W/WtWaRNrnrz2oML7Cjsj5AANU4AAAAA AAAAABUGu2hNRqHUWvUTTu/LiWqOJKs2PZDCn8qrSVSInwtNJuqOaqLtzKqIqK5rrfBmmqaZzhpc t03aZorjOJdPwv8AFBT6109xwTO7KmJarYkiRZJjcrvHwRKylVV+FppN0VHIq8vMiKqorXOsDWrW rANAcAr9RdRrt3S3Um0cMMac9RXVDt+zp6ePxkleqbIieHVVVGoqpnjXbQmo1DqLXqJp3flxLVHE lWbHshhT+VVpKpET4Wmk3VHNVF25lVEVFc10X080s1Y1dzyi174t47euQWVFhxbEKF/aWyw7bI+r 25nJJUyObzI5VdyJy9d0akdyMRTo5zteer4Luxe0KfVnnf3T/T/P9d8/o+JTiUtvdKqk3fhGEPdz 0+N07tlbPO1ekla9EaquVPQ6dEVGtj0MAVK65rnOXesWKMPRoUAANUwAAAAAAAAAAAAArjyXHxE9 Mv01+uK0cPHx7OLn/EH9TylI8LmofGTw16E4zop7iP2R+xzvv+yftk2qj7fvFZPU/uPLJy8vb8v4 a78u/TfZJ7wNZdmWd8VHFHlWoOn3sHv9d7Ce92HztFc+58luqY2f2TE1rJOeNjJOiJy8/KvVFOnF VNWyXi67Ny3GddMxHXCY8Q/x7OEb/H79TxGqjKvEP8ezhG/x+/U8Rqo2RgAAAAARLEdKcBwXKssz XFbD3G9ZxVQVt+qe9TS98mhYrI3cj3uZHs1VTaNGovrRVJaAK7xfh60aw205dj2P4JRw2bOq2a4X +0zzTVNBVzyptK5KWZ7oYkem3M2NrGrs3dPRTaIYdwQ8LOBZLb8uxrSSijuVol7e3Oq6+srYaGTf dHwQVEz4oXIqIqKxiKioipsXmAMj8Y65txDQ1XB9hekWV93vtxtq3/NrjauxsdttrHw1UktJUvXa oqE5UjRjU6O50VU2NNR4JiDcIi02lx6hqMYitjLOlrqIWy07qJkaRJC5jt0c3kRG7L6jvgBQFh4C uEnHLzRXy26O0j5rdOlVR09Zc66so4JUXdHMpJ53wNVF8NmdC/wAKZ1O4O+GzWHKZM2z/S6krb9P EkNRcKSuq7fNVMREaiTOpZY+29FEb8JzdERPBEQ4NXwOcJ9VPY6qHRWzW2fHWNioJrTNUW6RGI/n 2ldTSMWdObdV7VX7qq777qXoABn+8cBHCPfLxWXut0co45bhULVVdNSXOupaKeVV3Vz6SGdtOu6+ pY9jQAAhmV6NaVZxp+zSrKsAslwxGGGKCCzvpWtp6dkabR9i1u3ZKxOjVZyq31KhFtMOE3h70cyT 2Y6f6cU9HfUgWmjuVZXVVxqYIlRUVkUlVLI6JqoqoqMVu6KqeHQtwAVJq1wn8PeuV8hybU3Takul 4gg7qlwgq6mhqXw+qKSWmkjfIxN12a9VRN16dTnXThp0Mu+lNLofU6d0EGD0c0NTDZ6KWakjbLFK krH88L2SK7tE5lVXKrl35t91LNAHX5Bj9iyuyVuNZPZ6O62m5QOpqyirIWzQVETk2cx7HIqORfkU pzDuCHhZwLJbfl2NaSUUdytEvb251XX1lbDQyb7o+CComfFC5FRFRWMRUVEVNi8wBWOqvDTohrbf 7LlOpuCQ3e8Y8jmW6tZW1NJNCxXcysV1PIxZGb7ryP5m9V6dV36LUDgx4aNT8rrM4zDTCGW+3JES uraC51tufWbJsizpSTRpKu3Td6Kql1gCO4Bp5g+leK0eEadYvb8fsVAi93oqKJGRtVy7ucvrc5V6 q5yqqr1VVJEAAAAAAADBfk6Pibaffpb9a1ZvQwX5Oj4m2n36W/WtWV8T6kdrq8Ee3ns+sNIgApPR gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAES1QyeqxjE5n2ljpLvcpGW21xM/Dkqpl 5Wcv506u/wDuTWqdGM5b26Ju1xRTzufonblznVPItS52c9tx1q49ZlX8F034VVK3/KjEVN90cvyG gSLaYYPSacYHZ8OpVa51BTolRKn+/VDvSlf/ADvVypv6tk9RKTo4e3xduInbzvKcKYqMXiaq6PVj VT2Rs79s9cgAJnPAAAAAAAAAAAAAAAAAAAAAAAAAABTWqGtt/wAF4jNEdGrdabfUWzU/2S+caqZH 9vTebaBlRF2Ozkb6TnqjuZF6eGylykUyK16ZVed4jc8pgx9+YUHf/Yq+tdEleznhRtZ3NHLzrvFy 9pyIvo7c3QlYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ApLiVsFTbaSy6w2andJW4hPtXsZ+FPbJV5Zm/n5d0cnybuUu0+FfQ0l0oai2XCnZPS1cT4J4np6M kbkVrmr+ZUVUI7tvjaJpW8DipwWIpvRry2xvidUx74U9SVdNX0kNdRzNlp6iNssUjfB7HJu1U/Mq Kh9SCaew1mF3q+aPXeZ758bm7W2Sv8ai2SrzRO/Ord+VfkXZPUTs5lM5xr2vY3KYoq/DOcTrid8T rie4ABsjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGbvJ0fE20+/S361qzSJm7ydHxNtPv0t+tas0ibX PXntQYX2FHZHyAAapwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADJWnnFHoTw18ZPEn7dec+xz2 R+w7zZ/sZWVnb93tT+2/2tFJy8vbxfhbb83TfZdtagkt3OLnNVxmF5XRFGeWvNmO6cUehPEpx2cM PtKZz7I/Y57NfOf+xlZR9h3izp2P+2Yo+bm7CX8Hfbl67bpvv8xHqJ8ezhW/x4/U7Dbheoq06dJ5 jE2eT3Zt555eQADdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgvydHxNtPv0t+tas3oYL8 nR8TbT79LfrWrK+J9SO11eCPbz2fWGkQAUnowAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAACL4Ha/bJ1tku8re0sWnbFji/gTXWVOq/n7NifzO2+U/eomVrhuKVd2p41mrpOWlt8CJu6aqkX ljaievr12+RFLS0b0/TTXT+3Y7O5JLi9FrLpPvus1ZL6UrlX17Ls1F+RqG1qjjLkRzRrn6f51Icd iOR4SquPWr/DHZ+9Pdq9/UmwAOm8aAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zy W9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONV Mj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAApHiRx6qtLLRrPY6Z0lbir+xucbE9Kotci7SJ+dWKvOnybuX1H1oqy luNHBcKKZs1PUxtmhkb4PY5N2uT8yoqFx1lHS3CknoK2Bk1PUxuhmiem7XscmzmqnyKiqhmbCaWr 08yu86M3aV7mWtVr7DNIvWotsjlVqbr4rG7dq/yLt0Q5+Jo0K9ONk/P9Xq+CcRynDTYq9a3rjrpm fpPhPUngAIl0AAAAAAAAAAAAAAAAAAAAAAAAAAH8VFVFRFVN/WnqMiUPH/j+nWql60S4lLE7F7xZ 6xaeG/0MT5bbWwO2dDO6P0pYEexzF2TtGpuu7m7GvDAHlWdA/ZBiNq18x+i5q7HOW2Xvkb1koZH/ AAMq/wDByuVv8k3yNJLcU1To1KmMquW7fGWtsc2+ES4fePXSzh64TcHwSnt1wyrOIG3HezUbVijg dLcal8STTuaqJzNe1USNsjuqbom+56E6d1WaV2EWe4aiUtFSZHWUram4UlE1zYaSR/pdg3mVVd2a KjFcq+k5qqmyKiJ5JeTb0D9tzXGLM73RdrjuA9nc5udu7Jq5VXusX59nNdKv/BIi/hHsgbX4ppqy hBwbVcuW9KvZGqI7OcABC6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAArbWPhz0a1/8ANHtt 4d5+8w9483/7IVVL2Pb9n2v+15Wc2/Yx/hb7cvTbdd6397o4Nvmd+kN1+8mkQbRXVGqJRVWLVc6V VMTPZDN3vdHBt8zv0huv3ke90cG3zO/SG6/eTSIHGV75a8lsdCO6Gbve6ODb5nfpDdfvI97o4Nvm d+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb 5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3 yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4N vmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6O Db5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOM r3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o 4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve 6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQOMr3yclsdCO6Gbve6ODb5nfpDdfvI97o4Nvmd+kN1+8mkQ OMr3yclsdCO6Gbve6ODb5nfpDdfvJdunOnOG6S4bb9PtPrN5qsFq7XulJ3iWfs+1lfK/05XOeu8k j16uXbfZNkREJIDE1VVbZb0Wbduc6KYieqAAGEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAARXUnK6nFcbc60QrUXq5yst1ppmoiumq5V5WIievbx/m29ZiZimM5b26JuVRRTtkwi1e2hrOt xlb2mPadu9H+BUXd6dP5eyb1/M5E+U0aQ7SXT+n0ywS24tHIk1VG1Z6+o3VVqKuT0pZFVeq9eib+ pEJiX8Pbm3Rr2zrl5fhXGRi8R/p+pTqp7I5/fOc+/IABO5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAA imRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zy W9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVBxF4ZcbhYaLUbFqfnyLDHurYmN8aujVP7Ip12T dd2oqon5lROri3waXLcXaZplZwmKrwd+m9RtjxjnjsmNSjMevtvyayUV/tUvaUtdC2aNfWm/ii/I qLuip8qKdgQhbO7R/VGqwZWdnjGVPkuePu22ZT1HjPSIq/zOanyKniqqTc5kZ7KtsPZV6E5XLc50 1RnHZ5xsnrgABloAAAAAAAAAAAAAAAAAAAAAAAAFc8QeZ6YYVpLkNXq7K12O3Gjltk1E1Oee4OmY rEpoGeL5X7ryonhtzKqIiqnaatatYVorhVZnWdXLu1DTbRwwxpz1FZUO/Ap4GeL5HKmyIn51VURF VIpw98Pea6pZrQcT/E/ae7XSm+FwjCJV56fGqd2ytqahq9H1zkRFVVT4Pp0RyNbFLatTXOfMoY7G U4anR21Tzeao/J2yYZhGnNfotNYrpjGodnrJblkVmvcHYV0rZlRYKlrVROaLsexZ0T0VTqicyK7X J0/FBwv0+tdPbs7wS9JiWq2JIsuN5JE3x8VWjqkRPhaaTdUVqovLzKqIqK5rq40K11qNQ6i6ad6i WFcS1RxJUhyHHpl/kRKulVV+FppN0VrkVduZEVVRWudvftTE6UIeDsZTcpizVqmNnX+q3wAV3VAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjWkNpXVDU2s1Kq2c+PYk6S2WJHJu yorFT4epRF6KjUVGtVOngqdUU67Um53isS3adYi//shyyVaOFyJv3Wm2+HqHbdURrN+v86dUL/w3 E7Tg2LWzErHD2dFa6dsEfyuXxc9f75zlVy/nVTexRxtzOdkfP/NfcrcI4nkeGyj17mqOqnnn3+rH Vm7oAHSeQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9v TebaBlRF2Ozkb6TnqjuZF6eGylykUyK16ZVed4jc8pgx9+YUHf8A2KvrXRJXs54UbWdzRy867xcv aciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAQbWTTeLU3CqizwSpTXaje2vtFYn4VPWR9Y1RfUi/gr+Zyr4ohV2nmXSZdYO2uFMtJeLfK+h utG/o6nq415XoqepFVN0/Mu3qU0UZ71qsEmmeaw6yWmB/mS7rFQZTBG30Ynb8sNbt+ZVRrv5vW5V KWKt5f6se/z93yej4ExXGROCr59dPbzx/wB3N1x1pCD8xyRzRtlie17Hojmuau6ORfBUX1oforuq AAAAAAAAAAAAAAAAAAAAABDdWtWsK0VwqszrOrl3ahpto4YY056isqHfgU8DPF8jlTZET86qqIiq jVrVrCtFcKrM6zq5d2oabaOGGNOeorKh34FPAzxfI5U2RE/OqqiIqpFOHvh7zXVLNaDif4n7T3a6 U3wuEYRKvPT41Tu2VtTUNXo+uciIqqqfB9OiORrYpbVqbk9SjjcbThaco11ScPfD3muqWa0HE/xP 2nu10pvhcIwiVeenxqndsramoavR9c5ERVVU+D6dEcjWxbAAL8RFMZQ8vXXVcqmqqc5kKE4oOF+n 1rp7dneCXpMS1WxJFlxvJIm+Piq0dUiJ8LTSbqitVF5eZVRFRXNdfYM7WImYnOGPdCtdajUOoumn eolhXEtUcSVIchx6Zf5ESrpVVfhaaTdFa5FXbmRFVUVrnW+dPxQcL9PrXT27O8EvSYlqtiSLLjeS RN8fFVo6pET4Wmk3VFaqLy8yqiKiua6uNCtdajUOoumneolhXEtUcSVIchx6Zf5ESrpVVfhaaTdF a5FXbmRFVUVrnUb1nQ1xsejwGPi/HF3PW+a3wAQOoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAHFulzobNbqm7XKobBS0kTpppHL0a1qbqpyiDVlpl1j1Dg00pVk9jlidHcMnnYvoyrvz Q0e/yuVN3fmRfW01nPZG2W9EU667k5U0xnM9XnOyOtLeHjEq27TV+tuUUj4rjkbEhtFPKic1Fa0X eNE+R0n4a/m2X1qXefiKKKCJkMMbY442o1jGps1rU6IiIngh+zp2rcWqIph4/G4urG36r1WrPZG6 I2R7o8wAEioAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTOb O7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7H ZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAcO8Wi25BaquyXikjqqGuhfT1EMibtexybKi/zHMAmM9Us01TTOcbWYMQiuWnOUVm jGSTyTdxYtVj1ZIm3fLcq9Gb+t8fVqp8idOibrPDvdb9MZtQ8bhq7DI2mymwS9+slUq8u0qbc0Tl /gSInKqL035VXomxX+BZjBmthZcVhWlr6d7qW40bt0fS1TOj43IvVOvh+ZU/Ocuu3xNWhzc3l7nt bGJjH2eUR60aqo69/ZV8843JGADDYAAAAAAAAAAAAAAAAIbq1q1hWiuFVmdZ1cu7UNNtHDDGnPUV lQ78CngZ4vkcqbIifnVVREVUmL1c1jnMbzORFVG77br8hmThSt1r4g+InKs34h520+oOm9a6DGtO qpP7HsNIvLy3Nm/o1kkiqm0zU5Wryqm28XLJat8ZKnjcVyW3nEZzOxP+Hvh7zXVLNaDif4n7T3a6 U3wuEYRKvPT41Tu2VtTUNXo+uciIqqqfB9OiORrYtgAHQiIpjKHla66rlU1VTnMswVnHri7s2y7B sU4etb8xqMIvE1ju1bjmNU1bSMqYnKio1yVSO2XbdOZqKqeonOjXFppJrXkdbglpffcazS3Rd4qs Vym1SWu6xxfw0hk6Panr5HO26KuyKirU3Ar/AG2+Kf8A86tZ/wBTjjeUMoKTGb3oFrHYYmU+ZWbV K0WSjqo05Zaihq0m7xSOVOrmPSNEVF6Ijnom3MplqurWjih040Tv1pwq6W/JcnzC+QOq7fjGK2l9 yuc9O1Va6fsmqjWRoqKnM9zUXldtvyu2jWFca2nGSagWjS/MsD1F0zyLIlcyyU2b4/5vjukjfGOC Zkkkbn9UTZXJuqo1N3KiLFtb9H9fsP4j6bis4d7Pj2X1tTi6YpfsUvNb3KSop2z9sySkqV9CN6uR iKj1RE5d9nc3o9fTcV+EZLnGH4FxacMV905v895hfjFbktBT3WztuydIu7XBqcrJ93ei5Gptui8z egGvChOKDhfp9a6e3Z3gl6TEtVsSRZcbySJvj4qtHVIifC00m6orVReXmVURUVzXX2BtZiZic4Y+ 0K11n1EnumneolhXEtUcSVIcix2Zf5ESrpVVfhaaTdFa5FXbmRFVUVrnW8Vd5QbCNNrdp5Fr/XZm 3BNQ8I/3LZBTR89RWzu3VtrfCnWpjmXmTk2Xl3c78HtEd32jWT5vmWmGO5PqPiHsYyO4UTJq+2dp zdi9fBdvFnMmzuR3pM5uVd1RShetaE5xsel4Pxk4mnRr2wmYAIXSAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAOPcLhRWqhqLncallPS0sbpZpXrs1jGpuqqYZiJmcoR3UPLanGLRFT2WldW3+ 8TJQWijanM6Wpf0RVT+C3fdV8PBOm5a2kGm1Nphh0NlWZKq6VT3Vt2rlT0qqsk6veq+Kon4KfmRP WqleaD4nWZnfZdc8po1jbPG6lxekk8aai6o6oVPU+Xrsv8FV8UVC+izhbef+rV7uz9fk4/DWLin/ APFbnZrqnfVu7KfnnugABdeeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMf fmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd 5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAM+a1YxVaa5SutOO08j7PXrHTZXQws39HwZWtan75u+zvlTr63Ka DPjV0lNX0s1DWwMnp6iN0UsUjeZr2OTZzVT1oqKqbEV61F2nLn5l3AY2rA3ouRGcTqmN8bvrG6cp U7SVVNXUsNbRzsmgqI2yxSMXdr2OTdFRfkVFPqQOC11WiWbt04uMk8uL3uR02MVsq7pA9V3fQvd8 qKu7VXxRU9a7JPDnRnsnbD11UU5RXbnOmrXE74842THNIADLQAAAAAAAAAAAAACoNdtCajUOoteo mnd+XEtUcSVZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXW+DNNU0znDS5bpu0zRXGcS6fhf4oKfW unuOCZ3ZUxLVbEkSLJMbld4+CJWUqqvwtNJuio5FXl5kRVVFa519mPddtCajUOoteomnd+XEtUcS VZseyGFP5VWkqkRPhaaTdUc1UXbmVURUVzXWPwv8UFPrXT3HBM7sqYlqtiSJFkmNyu8fBErKVVX4 Wmk3RUciry8yIqqitc6/auxcjreWxmDqwtW+mdkqU00tnFtw+asa23LHOEypzmzZ9m9XkFsuEWb2 i3ItO5XIzeOWRz05kVF9JGqngqEvx7RriB4hNacT1j4ncfsuEYzp1UuuOL4Lbbmlymfc1ROWsrap iJG5Y9mqxGetPBqc3aa3BKps4aoUXF9p7rJWalaQ0lu1Pwa9UEFNVYNcbvHaqi11MSbdvRVD2LGr X9XPSRd+Zyp4I1WwDUnBeKbi/q8TwrUnRaz6RYLYciosiutVU5RT3m6Vy0yuVkFM2lb2cPMrlRXu duidU8FY7ZwAEE1q1qwDQHAK/UXUa7d0t1JtHDDGnPUV1Q7fs6enj8ZJXqmyInh1VVRqKqNatasA 0BwCv1F1Gu3dLdSbRwwxpz1FdUO37Onp4/GSV6psiJ4dVVUaiqmUdP8AT/P9d8/o+JTiUtvdKqk3 fhGEPdz0+N07tlbPO1ekla9EaquVPQ6dEVGtj0rri3GcrGGw1eJr0affO40/0/z/AF3z+j4lOJS2 90qqTd+EYQ93PT43Tu2Vs87V6SVr0Rqq5U9Dp0RUa2PQwBz665rnOXqrFijD0aFAADVMAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQVLTPrfni4FSSSNxLHZWT5JUM6Nq50XeOia719U3f8my+ Com/3z3Ib06qoNPsIYsuU5Eqx0yp+DRQeElVIvqa1N9vlVOm+2y3fpxgFl0zxKjxOyc8jIN5J6iT 90qp3dZJn/3zl/yIiJ4IbWrfHVZc0bfLzRYzF+jrOnHtKvV6o56vpT16+ZJIYYaaGOnp4mRRRNRk cbGo1rGomyIiJ0RET1H7AOm8YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKa1Q1tv+C8RmiO jVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/ALFX 1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACMaj6f2XU3E6vFL5zsZNtJT1Ef7pSzt6xzMX+E1f8qKqe ClH4NkN5p7hXacZ18FlVg2bK9U2bX03+91Ua+tHJtv8AIvyb7JpcrLWzSyszigpMlxGeOhzHHldN a6ldkbO39/TSr62PTdOvRFX5FdvVxNmav9SjbHjH+bHc4Ix9Nr/81+fwVbJ6M7+ydk9/M6kEcwXM qbM7OtX2DqO40kjqW5UEnSSkqWrs9jkXr4ouy+tPz7okjKcTFUZw71dFVuqaatsAAMtQAAAAAAAA AAAAAKg120JqNQ6i16iad35cS1RxJVmx7IYU/lVaSqRE+FppN1RzVRduZVRFRXNdb4M01TTOcNLl um7TNFcZxLp+F/igp9a6e44JndlTEtVsSRIskxuV3j4IlZSqq/C00m6KjkVeXmRFVUVrnX2Y9120 JqNQ6i16iad35cS1RxJVmx7IYU/lVaSqRE+FppN1RzVRduZVRFRXNdY/C/xQU+tdPccEzuypiWq2 JIkWSY3K7x8ESspVVfhaaTdFRyKvLzIiqqK1zr9q7FyOt5bGYOrC1b6Z2SvsgmtWtWAaA4BX6i6j XbulupNo4YY056iuqHb9nT08fjJK9U2RE8OqqqNRVRrVrVgGgOAV+ouo127pbqTaOGGNOeorqh2/ Z09PH4ySvVNkRPDqqqjUVUyjp/p/n+u+f0fEpxKW3ulVSbvwjCHu56fG6d2ytnnavSSteiNVXKno dOiKjWx7V1xbjOUeGw1eJr0affO40/0/z/XfP6PiU4lLb3SqpN34RhD3c9PjdO7ZWzztXpJWvRGq rlT0OnRFRrY9DAHPrrmuc5eqsWKMPRoUAANUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB 0GbZjbsIsUl4rmPmlc5IaSliTeWqnd0ZExE6qqr/AJE3U7W53OgstvqLrdKqOmpKWNZZpXrs1jU8 V/8A9es63RnC7lqDkEGtOZ0robfAjkxS1yp+5RL0Wskb/wB8eiej8ibL/BUxEVV1aFO35dbNVdvD 25xF71Y5t880R9d0a0q0M0vuGJ0lXm2aOSfMcka2SucvVtFD4spI/ka3pzbeKp6+VFLVAOnbt026 YppeOxWJuYy7N65tnw3RHVGyAAG6uAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7Ne JvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZ qf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACjNa9O7lj93drTp5QPmuNOxG5Ba4eiXOkb4 yNT/AL8xE3RfFUT82zvzjmRWjK7LS3+x1Taijq2czHJ4ovra5PU5F6KnyoXqZx1MxGr0VyKp1GxW 3vmw27So/ILdA3dbfMvTvkTU/eL+/anh/Jty0MRa4ueMp2c/n5971HBWO5VTGEuz+OPVnf8Awz/6 925KwfChrqO50UFxt9THUU1TG2WKWN27XsVN0VFPuQOjMTE5SAAywAAAAAAAAAAAAABUGu2hNRqH UWvUTTu/LiWqOJKs2PZDCn8qrSVSInwtNJuqOaqLtzKqIqK5rrfBmmqaZzhpct03aZorjOJZR4cq TKuLmewcX2vdbQ3B8aTQ4ZjFGxyW2ydjM6CarVj1XnqXywvVHOVeVEaqLujUj1cZu8nR8TbT79Lf rWrNIm92qaq5zQYK3TbsU6MbYiQAEa0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfx72xt V73I1rUVVVV2RE+U/pAZobprZlE+nGLVEkGN296Nya8RLtun/wChwu8Fe7wcvqTff5HYmZ2RtlvT TExNdc5Uxrmd0ee6OeX2xXHl4hMoSqqo5E06x+o677o2+VjF/BT5YGL4+py/y+jpmONkTGxRMaxj ERrWtTZERPBEQ4llstqx200lisdDFRUFDE2GngiTZsbE8ET/AOa9VXqvU5p0LFmLUa9s7XleEcfO OuRoxlRT6sfWeuefu2RAACZzgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEUyK16ZVed4j c8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfP LZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD5zwQVUElNUwslhlYrJI3tRzXtVNlRUXoqKnqPo AbGY8nsFRw9X/tYWSy6cXmo+Dd1etiqXr+A719g5V6L6l6eP4c3jkjmjbLFI17HtRzXNXdHIvgqL 60Lau1ptt9tlTZrxRQ1lDWROhnglbzMkYqbKioZquFpunD7fYbBd6iaswC5zdnaLnKquda5XdUpZ 3fwP4Ll/+fLzb1riZzj1fl+nyev4Px0cI08Xcn/Vj+uPujx27c856D+IqORHNVFReqKnrP6aLIAA AAAAAAAAAAAA/ioqoqIqpv609RkSh4/8f061UvWiXEpYnYveLPWLTw3+hifLba2B2zoZ3R+lLAj2 OYuydo1N13c3YzTTNWxHcvUWstOcs0r8nR8TbT79LfrWrNInmnw+8eulnD1wm4PglPbrhlWcQNuO 9mo2rFHA6W41L4kmnc1UTma9qokbZHdU3RN9z0J07qs0rsIs9w1EpaKkyOspW1NwpKJrmw0kj/S7 BvMqq7s0VGK5V9JzVVNkVETe5TMVTM70GDvUV26aKZzmIjPuSMAEa2AAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAEKye/5DkF/j0w00ayXIqtnPWVrk3htFMvjNIv8PZfRb47qnyoi4mcm9FGnO3K I1zM7IjfL5366X7PMmXSjTqdY61zUde7s1N47TTL4oip4zOTo1u+6fm6q2/sIwrHtPcao8VxiiSn oqNu3Xq+V6/hSPd++e5eqr/MmyIiHB0001x7S7Go8fsTHyyPd21bWzdZ62oX8KWR3rVfUnqToSwu 4exxf4qvWnw6nm+FOEYxU8TZ1W4/qnfP0jmjrmQAFlyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGylykUyK 16ZVed4jc8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBfrDaMns1Xj9/o Iq2310Sw1EEqbte1f+pUXZUVOqKiKnVDngxMRMZSzTVNExVTOUwzDU0l40IvkGJZTVzVuHV8nZWK 9y9VpHL4UlS71bfvX+ConyboydoqKm6Fo5Fjtlyyy1ePZFboq6310axzwSpujk+VPWiovVFTqioi oZzrqW+aDXaDG8rq5rhhdZIkNmvkvV1E5fwaWqX1bJ+C/wANk+RFRvOu2psTnHq/L9Hr8Djo4SjR q1XY/q64/i3xz7Y3J2CteIrWVugejGQavMx5L+2xpSKlAlZ3ZJ0nqoYP3Xkfy7dtzfgrvy7dN90i Hticdn4gX1q2f9kU26q4zphi9i7OHq0bk5T2SvkFDe2Jx2fiBfWrZ/2R7YnHZ+IF9atn/ZNuIubk XpLC9LwnyXyChvbE47PxAvrVs/7I9sTjs/EC+tWz/sjiLm49JYXpeE+S+QUN7YnHZ+IF9atn/ZHt icdn4gX1q2f9kcRc3HpLC9LwnyXyChvbE47PxAvrVs/7I9sTjs/EC+tWz/sjiLm49JYXpeE+S+TA HlWdA/ZBiNq18x+i5q7HOW2Xvkb1koZH/Ayr/wAHK5W/yTfI00N7YnHZ+IF9atn/AGTq8qv3Glmm M3XEMj8nq2rtd6o5qGsgdqrZ9pIZGK1yfg9F2Vdl9S9Tei1coqzyQYjGYTEWptzVt6p8nn55NvQP 23NcYszvdF2uO4D2dzm527smrlVe6xfn2c10q/8ABIi/hHsgYu4ZtPOMnhn00j0+sXAk66TS1k1d X3OTU2zQyVcz12aqsRHcqNjbGxE3X8FV6bqWx7YnHZ+IF9atn/ZM3bdyurPLUiwOJwuGtRTNWudu qfJfIKG9sTjs/EC+tWz/ALI9sTjs/EC+tWz/ALJHxFzcueksL0vCfJfIKG9sTjs/EC+tWz/sj2xO Oz8QL61bP+yOIubj0lhel4T5L5BQ3ticdn4gX1q2f9ke2Jx2fiBfWrZ/2RxFzceksL0vCfJfIKG9 sTjs/EC+tWz/ALI9sTjs/EC+tWz/ALI4i5uPSWF6XhPkvkFDe2Jx2fiBfWrZ/wBk7LQvXTO9Ss71 B0z1M0d9r3JNPfNPfaL2Qw3btO/wyzR/CQxtjTaNjHei537psvKrVQxVarpjOYSW8bYvVRRRVnM9 U+S5wARrQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQzIsovt3vzNONNaeOuyapbzVE7+tPaoF8Zpl8N+vot8VVU 6LuiLiZyb0UTXO6I1zM7IjfL+5Rk97uF7h0506p2VuUVzOaSR3WC1wL41Ey+rZF9Fviq7dF3RHXH pdpjZNLrAtrtz31dfVv7xc7lP1nrqhfF71+TqvK3fZEX1qqqv50u0tsel9kfQ0Eklbcq1/b3O6VH WetnXxc5fU1FVeVu+yJ8qqqrNC5YsaH469vyee4T4Ti/HJ8P7ONs89U756t0e+dYAC04oAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb 46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nP VHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAcG92S0ZJaaqxX63w11vrY1iqKeZu7XtX/AKl9aKnVFRFTqhzgJjPVLNNU 0zFVM5TDze8odhWY6R8L2c4kxKm94TcnW1LXXPXmmtbm3Kmf3edfWxUaqMd8uyfmT0hMq+VH+Inq b+hf1xRGqiO1ai1E007FvGYyvHV03LkfiiMpnfrnXPXv7wAEimAAAAAAAAAAAAAAAAAAAAAAAAGI 9O/j2cVP+I/6nebcMR6d/Hs4qf8AEf8AU7yK/wCzle4N/aqff8pXyADnvVAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AQTzrk+q2QT4NpbUd2oqR3Z3rJeXmio09cUH/fJlT5F6fKn4SYmeaNremnOJqqnKmNszsj/OaNs8 z93zI8jyzInaZ6WNZNetk85XNyc1NZ4l6K56+CyePKz5f5Ni7NMtMcd0tsHmeyNknqah3b3C4Trz VFdOvjJI7x9a7J4Jv8qqq8nT7TzGNM8fjx7F6LsokXtJ55F5pqqVfwpZX+LnL/kTwTZOhJi7Yw/F /jr9b5PO8JcKcpjiLGq3HfVO+fpHN26wAFlxgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAEUyK16ZVed4jc8pgx9+YUHf/AGKvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2 a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZV8qP8AET1N /Qv64ojVRlXyo/xE9Tf0L+uKI1UAAAAAiMeoiSarS6VewjLGrFYUvvsidbdrG7edIe5tqubrVde0 7Ll/ARXb+oCXAER1Q1ETTDFlyl2EZZlaJV09J5uxi29+rfhXoztOy5m/Bs35nu36NRV6gS4EcqtQ sOo8/oNLqm9NblFztdReqW39jIqvooZI45JVejeRqI+VibOcjl3XZFRF2kYAAAAAAAAAAAARyzah 4dkOZ5Jp9Z702pyDEY6GW9UaQyNWkbWMe+m3erUY5XtieuzXKqIic226byMAAABiPTv49nFT/iP+ p3m3DEenfx7OKn/Ef9TvIr/s5XuDf2qn3/KV8gA571QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB86mpp6OCSqq544IYWq +SSRyNaxqeKqq9EQ6/JMmsmI2ia+ZBXx0lJAnVzvFzvU1qeLnL6kQ6fFdM8o1qqaXI9RaOosmFxu SeisCuVlTcdl3bJVKnVjPWjPFfzdFXEZ1To0xnLarQtW+Ovzo0Rz88zuiOefCOfJ19loco1+r5aD HKiqsmBQPWKtvLWqyouip0dDS7+DPU5/8v52ronFcUx/CrFS43i9rhoLfSN5Y4Yk9frc5fFzlXqr l3VV8TsKOjpLfSxUNBSxU1NTsSOKGFiMZGxE2RrWp0RET1IfYv2bEWtc653vMcIcJV42dCmNG3Gy PrO+flzZAAJ3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0 R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/wDY q+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyo/wARPU39C/riiNVGVfKj/ET1N/Qv 64ojVQAAADMNFl+WP8pRcMEflF2djTNGWXRtmWtlWhbW+eWR95SDm7NJeRVZ2nLzcvTfY08Z4pNK c+i4/q7WySw7YXNpO3GmXPvUPW5JdWz9h2PP2v7kiu5+Tk9XNv0Aozgs091L4kOG+LKdTeIzVSnq G3O62+yy2bJqiknhjjqpPh6ibdZaqRJFc1GyuWNsccbUYnpK6KXniC1hynyZ2M6kXDPLxSZlBllH ZKy922rfR1NVHDdnQbufErV9OJrWv/hLuq+KmnuAvSnPtF+HK14HqXYfM99p7tdamWk71DUcsc1Z JJG7nhe9i7sci7I7dN9l2UzvT8KWvrPJ827Q92BbZtBmzbvJa/OlF6NIl1dP2nbdt2K/BKjuXn5v Vtv0A7/NtIqPIvKg2+gm1B1Aoo6vTF2R70GT1VO6GVt07NaWJWu9CkckbXOp09BzlVypupvAytrF gGuONcY2K8RmmGl8GeWd2ES4Zc6Jt9prbNQuWtdUJU7z9JG7OROVm7ujuidN9UgV9xBXPUuy6JZt ddHKBazNaWy1MtkhbEkr3VKM6KyNd0e9E3VrFRUc5Gpsu+xinR3IsI1BpMei0+4/NSrFrNHJRvuV hz65yPpZq3dq1VE601LYmPRfhGsbTv3b6Ko5dtzduqNLqLW6fXyn0kutqt2YOpVWz1F1gdNSNnRU VGytb15XIit3Tfl5ubZ22y5B1/wfib4rtPk0ryrhAxrEb5Vy0rfZ1XZbQVsNnWOZj5KikZC1avdy Nc1Gej0eqOVeu4cLia4krDPxWv0G1F4grvpDp9i2OwXS41djqZKS43u6VCo6OnbVRsdJDCyJyOXk 2VV5kVerVb9OF7iUx2l4mbnofhXEHdtXNO7pisuQ2y5XuofV3Kz19PJtPSPqHsY+aN0XwiK7dU2a ifvldY+e6Q616VcRMHElopjNJqEy94vBi+WY7V3WK21tS+nc1YK+nnlTslfs1GuY9W9EXbfm3ZZG kl74k81yq9XnWDT3HsEw51AyktmOpcWXS6y1POqyVE9TCqQMjVi8qRNR679eZNvSDO+gmGatcZGk lRxJXviO1Jw275XW3N+KWjHLulHabPTU9TLT07JqZrFSqXnhcr3SKquauybL1PrxH3biZx53DBg1 y1SbaM6yTIamw5Jc8cnmZQ1aPgSNapYHNYyZzGO7ZrJI+zSVOjeU5mlWH8YPCZg100B0y0Ts+ouO 0VfXS4bkzsppreygpqqV8rWV1NMnaPdHJI9zuy3R2+ybeJIM00L4hb3dOGG4Zfdos7v2BZJPdc2v 0XdKKONJIl9KOJOy52MVUjb2cfOrWI5zUVVAhnFVqLUcMdFpPw80vEBluP2rO7tcavJM/v8AcFuN 4orbTox8kUU7o15HyulSONyMXs9kRE2IZjvEvpvplr3pbadDOLXKtVcdzq/RYvkeO5PdZ7pLSvqV RlNXU088bXxcsqoj2IqtVHJ0TxTS/FRorqJl+V6Z66aMR2yszjSi5VdTTWm41HdoLvQVkSRVdL22 ypFIrGojHOTlTmduc7DM24uM71BsiX/RSx6YYXQJLLfH3W/U95uFyVWKkcNK2jcjIUR2yrJI5d0/ e9NlCieFfSKjp+OPiLrnag6gVDsQuWNvhZUZPVSR3FKi3Tqra9qu2q2x+ETZN0jRERuyG8DK2C4B rhpTxmap5jb9L4chwHVyWw1DsgivtNTvsq0VI+GRstLJ8LMqueqp2abbI3r1VG6pAAAAYj07+PZx U/4j/qd5twxHp38ezip/xH/U7yK/7OV7g39qp9/ylfIAOe9UAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVURFVV2RPFQBFsxz+ gxaWmtFFRz3jILi5I6C0UfpTzuXwVdvwGfK5fUi+OynXSZZk2oF3mxDRukjrJ4JEiuN+nbvQW5PX s7wlk28Gpun8qb7W/pfo3jWmUU9bDLLdr/cF5rheq1EdU1DvkTx7NnyNT5E3VdtzNuiq9P4Nm/y3 tMViLPB9Od/XVzU8/wD3bo8Z6tqJad6F19Td4tQNY5qe631io+gtUa81DaU8U5W+Ekqet67oi+G+ yOLrAOhbtU2oypeUxeMvY2vTuz2RzRG6I5v8zAASKoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsn VN/AvAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAADKvlR/iJ6m/oX9cURqoyr5Uf4iepv6F/XFEaqAAAAAAAAA+NZTuq6SekbUzU6zRujSaFUSSNV TbmaqoqI5N903RepQXuS8g/HE4gv/v8AWz/+HmgwBUenOgF30/yiHJaziK1cy+OGKSNbXkd1oZ6K RXN25nMhpInq5vimz06+KKW4AAAAAAAAAAAAAAADEenfx7OKn/Ef9TvNuGI9O/j2cVP+I/6neRX/ AGcr3Bv7VT7/AJSvkAHPeqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIRc9Qa27Xl+G6XWZcnyBu3bLG7aioUVdueom8E2/gou67K nRehrMxDei3VXnlsjbOyI7Z5kgyfLMfw21vu+RXKKkp29G8y7vkd/BY1OrnfmQ6ew6e57rby1uWt rcQwiTlfHbmryXG6M/8ACr/vMap+98VT+ZyTbTzQKist0izXUa6JlWVt3WKaVu1HQbrvy00K9E2/ hqm/rRGruW4WLeGmvXd2bvPycvF8MUYf8GD11dLd/LE/Ode6I2utx3G7DidogsONWqmt1vpm8sUE DOVqfKq+tVX1qu6qvVVOyAL0RERlDzVVVVczVVOcyAAy1AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi +jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/AE2rzbq3ZOqb+BeAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAABlXyo/xE9Tf0L+uKI1UZ/49dLc71p4Ts50z00sXnnJLz5s7lRd6hp+17K5Us0nwkz2Rt2ji e70nJvtsm6qiLFfdD8dn5Or63bP9mBqoGVfdD8dn5Or63bP9mPdD8dn5Or63bP8AZgaqBlX3Q/HZ +Tq+t2z/AGY90Px2fk6vrds/2YGqgZV90Px2fk6vrds/2Y90Px2fk6vrds/2YGqgZV90Px2fk6vr ds/2Y90Px2fk6vrds/2YGqgZV90Px2fk6vrds/2Y90Px2fk6vrds/wBmBqoGGsM49+KDUPTCi1lw ngHqrxiFxSd1NX02o9Gr3thmkhlXsFpe2ajZIpEVVYiejv4KirzMa44+KbMKDznjXAlT19Pvs5Y9 WLWjmL8jmrCjmr+ZURTWa6aZymdaejDXrtHGUUTNO+InLvbZBjz3W/GT+T7+te1fYj3W/GT+T7+t e1fYmOMo3wclv9Ce6WwwY891vxk/k+/rXtX2I91vxk/k+/rXtX2I4yjfByW/0J7pbDBjz3W/GT+T 7+te1fYj3W/GT+T7+te1fYjjKN8HJb/QnulsMGPPdb8ZP5Pv617V9iPdb8ZP5Pv617V9iOMo3wcl v9Ce6WwzEenfx7OKn/Ef9TvO591vxk/k+/rXtX2JGuHqz6y3bXbWzWvVvSX2v/bA9jfm+2efqW67 dxo5aaX4anVPkjd6TG/umyc3Kqkd6umaJiJXOD7F2jEU1VUzEa+ad0tCgAovSgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfCtrqK20ktfc auGlpoG88s0z0YxjflVV6IYIjPVD7nR5XmuN4VRJW5BcWw9ovLDA1Oead3qbGxOrl36fJ8qodBQZ Pm2qFQ+26OWRHULXrHPktyjdHQxbLs5IWqm8zk/MmyL4psu5aOnWg2LYRXJk14qZ8myl6J2l4uSI 57F+SBnVsLU9W3Xbpvt0NqKK73qbN/8Am1rib9jAR/8Aon8XRjb7+j79fUryyae6maxclXlDqvB8 QlRHNoI3bXWvZ8kjv94aqfvdub1Ki7opeuIYXi+B2WHH8Ss1PbaGFOjIm9Xu/hPcvpPcv8Jyqp3Y L1qxTa1xrne81jeE72N/BP4aI2Uxs9++euQAEznAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/AILxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30n PVHcyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpa2fcPuL5TXyZRi1ZPiWUdXJc7a1EbM75J4ejZU+ XwVfWq+BVPkuPiJ6Zfpr9cVpqo0rt03IyqjNYw2KvYSvjLNWU/PtjZMdUsw3DJ860wlbQ6w47tQc 6MiyS1MdLRP3XZO2Yic0Ll/Omyr4Jt1JlbbnbrxRR3G010FZSzJzRzQyI9jk/MqF0zQw1ML6eoiZ LFK1WPY9qOa5qpsqKi9FRU9RTGT8NtBTVs2RaQ32TDrpIvPLSMb2lsql6dHwL0Z4bbs8PU3cpV4a ujXRrjx/V6LDcL4fE/hxEaFW+PVntjbHuzjqh9wQOoz3IsFqmWnWTFZbC97uziu9Kjp7ZUL+aRN1 jVf4Luvy7E2o62juFNHW0FXDU08yc0csL0ex6fKjk6KhBFUTOXO6VVuqmIq2xOyY1xPZMan2ABsj AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAP45zWNV73I1rU3VVXZEQhV11Sti3Ncawm2VeXX7w7la052RL8ss34EbflXrt60Q7q0aCZ nnrm12tGSd2tzl5kxqySrHCqfwaidPSk9W6NXbdN0VDFOlcnKiM/l3trs28LTp4mrRjd+9PZG33z lHW6Oq1KfebpJjGl9hqMuvLF5ZFpV5aOl3XbmmqF9FERfUi9fDdFJTjPDrVX2qhyDW++tyGqYqSQ 2Wl5orXSrt4K38KZU+V2yepUcW/j2NY/iVrismM2ektlDD+BBTRIxu/rVdvFV9ar1X1nZlu3hI23 Nfy/X3uHieHK5iaMJGhG/wDen383u75fKlpaWhp46OipoqeCFqMjiiYjGMangiInRE/Mh9QC24Mz nrkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5 dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4FNaoa23/AAXiM0R0at1p t9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZV8lx8 RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAfCsoqO40stDcKSGqpp2qyWGaNHse35HNXoqfylM5Bw 10luqpb3o9klRiFdIvPJQKiz2yod/fQu/A38N2+HqQu0Edy1Rd9aFvC47EYKc7NWWe2NsT2xOqWY KzOct0/mbQ6x4bPaY+ZGNvduR1TbZV6Iiq5N3RbqvRruv8hMbXdrXe6Jlxs9wp62lk/AmgkR7F/n T1/mLrmhhqIX09REyWKRqsex7Uc1zV8UVF6KhUOUcNOJ1dZLfdPLpWYPeZN3LJa9lpJXf+Epl9By fmbyoU68NXR6k5x4/wCdzvWOGMNf1X6dCd8a6e7bHuz7H5BDLnU6wab7pnmGeyK1x+N5xxqyOa3+ FLTLs5v51T0U2Xbc7XF87xLM4O2xy+01W5E3fCjuWaP/AMaN2zk/nQg0sp0Z1S6fFzVRxlExVTvj XH6dk5S74AGyMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAADhXe9WewUbrhe7nS0NMzxlqJWsb/Iir4r+ZOpjYzETVOUOafl72RMdJI9rGMRXOc5dkRE 8VVSC0Wf5NnUrqPSHBq2+s35Vu9ai0ltjX1rzv2dJtt1a1EX5NyVWnhuuORyMr9aM1qL6iKj0s1t V1JbWL8jttny/mVeVepmiKrns4z6+b/Oxi/XZwf7TXozu21d3N75hF6zVWjuFxfj2nVkrsyvLeiw 21u9PCvXZZahfQY3p49TvrVoLnWc7VWsWW9yt7+vsesL1jjc3+DPUfhP9W7U6b+CoXdYsesWL22O 0Y5Z6O2UUX4EFLC2NiL8uyJ1X5VXqp2JZowkbbk59XN+rjX+Ha4/DhKdDrnXV5R7oz63TYth2LYT bG2bE7FR2ujb/vdPGjeZflc7xcv53KqncgFuIimMocKuuq5VNVc5zPPIADLUAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/ 9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHT wdixGqj/AE2rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RP TL9NfritNVAAAAAAAAACAZ1oXppqDOtxvFhSkuqLzMuluetLVtd/C52fhr1/fo4n4NaqKa4yqjNN YxF3DV6dmqaZ3xOTPVx0s1wwXmlxPIqLO7azq2huqpS17W/wWzp6D1/O/bx8DpoNXrHQ1zbNndru eHXNenY3iBY4n/nZN+A5v98qoaeOFeLJZ8goJLXfrVSXGjl/Dp6qFssbv5WuRUKtWE/LnLt1/q7V nh2Z1YqiKuuPwz9s90T1qlp6mnrIGVNJPHPDInMySNyOa5PlRU6KfQ+V44X8XgmkuOmmSXjCa168 ysopVnonu+V9PIuy/wAiORPzEYrrTr9g6r54xO3Zrb2f/S7HL2NWjfldTv8AwnfmZ/lK9VFy361P dr/XwdWziMLifY3Iz3Vfhnx/D4+5LAQm06w4NcatbXX3CaxXJq7PobzA6jmYvyLz+jv+ZHKTRj2S sbJE9r2OTdrmruip8qKaRVFWxPctV2pyrjJ+gAbIwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAEYyTUzBcTcsN6ySkjqEXlSlics06u9Sdmzdybr06ohwaG96tZvs3T3S +po6WT8G6ZK/ucKJ6nJCm8j2+vdP8hrpRM5RrnqS8TVTTp1/hp3zOUeO33JqQ6/as4TYqtLW25Pu t0evKy3WqNauoe7+Dys6Iv5nKh39Bw23fItp9WtSbld43dXWq0p3GiT+9crfTkT868qlqYjp/hOB Uq0eH4xb7VG5NnughRJJE/v5F3c/w/fKpNTYu17dXjP+e9z73CeCw+qmZuT1ao75jP8Ap96kbfYN e9QP+19losBtcnhV3Xapr3N+VtO30WL+Z+3h4k1xfhpwC1Vsd8y19bmV5Z173e5e2jYv95B+5tTo myKjtvUpbQLFGFt066tc9flscnEcN4q7E0250Kd1OrvnbPfl1PxFFFBEyGGNsccbUaxjU2a1qdER ETwQ/YBZcgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAU1qhrbf8ABeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpF MitemVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAA AAAAAAAAFB8c+r+XaIcNGT5tp7cO5Za+agttjl7CKZUqqirij6Mla5jlSN0iojmqnQsXE9UtO7jc 4NOmatYpfM0oKdsVwt9LdqR1c6aNiJK91NG7mZ1RyqnIiJ8iGcPKD2qDU3JdAOHme4T0kOb5+241 r6aZYplordTufOjHp1a7adqo5OqORq+ojfGlpDpdp1XcOtLpDgFhxfLHasWOitdRZqCKlqO5Iki1 KPexEdJHukKv5lXfxXxXcNl5jn+Cad25l41Azaw4zQSP7NlVeLlDRQuf/BR8rmtVfzbnLxvKMZzG 0Q5BiORWy+Wuo37GtttXHU08m3jyyRqrV/mU89MNvmousXEbq9rDX8KE2tVuxjKKvBMYdV5Baqai sUNAqNmSGlrpEXtZlfHK6VG/vuVHfhIfKuk1w4X8O4nteafRV2j2NX6x2uTHrFFebfWxUt7kelHJ Vwx0cjmRLzTMkVOVqOXl8dtkDetdrDpJbMpZg1y1SxGkySV7YmWee900dc567bNSBXpIqrumycvr O9yHJscxG1TX7LMgttltlPt21bcauOmgj38OaSRUan86mbMM4EuHqq4bbdphmGEWuouN6tNPJecm 7vCt4muczWvkq2VkjHSJKszlVm6qiIqN2VN0WHawV2Jaiav41w94hoXcNbMj0Ut9NWXCbJclbQWa ifPTMZA+u5o5GVtU6NGyInYrsrnK3b4REDWuG6i6fajUc1x09zrHsnpKd6RzT2a6QVscbl8GudE5 yIv5lOVZcvxPJK662vHcotN0rLFU9zulPRVsU8tBUbb9lO1jlWJ+3XlciL+Yw1w/UORe+K5Kldpb iOmi47pkyK/23FbilTRVc01ZHJTyTubBA1Jeydv1Yqo2NvpKi7JYvk35G3rRnNdbq9yM9s7UDIMq 7eVeVEpln7Fqbr4NasEm3ybqBp225thl5qLzS2fLrLXT45MtPeY6avilfbZUbzKyoRrlWF3Kirs/ Zdup0uM62aM5renY3hurmF367t5uagtl/pKqpTl/C3ijkV3T19OhhvRzRjLOKHgh1cumI3yC2XvW jUK75VRz1iyMp6qnir42spJlZ6bYX91kZ0RdubwVN0JpjVVo1dtQ9PtIuIrg/h0ezanuUdbht0s3 YJa6yupE50jpbjQrG9qqiI7u8nRfRR27uVFDYuY5/gmnduZeNQM2sOM0Ej+zZVXi5Q0ULn/wUfK5 rVX825y8byjGcxtEOQYjkVsvlrqN+xrbbVx1NPJt48skaq1f5lPPTDb5qLrFxG6vaw1/ChNrVbsY yirwTGHVeQWqmorFDQKjZkhpa6RF7WZXxyulRv77lR34SFycH+l+q+E646tZhetDvalwTMILXV27 G2Xm31sDblExzKiaJlHI5kPOmznei1FVW+PL0DXYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAO nyTD8VzCk7hlOO266wbbI2rp2ycv52qqbtX86bKVZcOFzHaCR1VppmF/w2ZVVyQU9QtVRbr13dBK q79f75ELrBFXZt3PWhcw3CGKwkZWa5iN22O6dXgzpW4xxEYfus1ksOcUbP8AfLfP3Gs29aujk9BV 9ezTqfblx221Lbfm1pvmJVjl5UjvFvkiY5f72REVqp+ddkNQnwrKGiuNM+juFJBVU8ibPimjR7HJ +dq9FK9WEy9Srv1/q6trh7PViLUT10/hn6x3RClrVfLNfYO9WW7UdfD/AA6adsjf8rVU5p2OQcM+ jt9qFr6bGFsdd1VtXZZ30T2b/I1i9n/7pGKrQPU6w7uwfWOatib+DR5HRtqOb5N6hmz/API0iqs3 aebPs/XJft8IYG9suTTP8UfWnPxiHbAiNU7XrGd/ZFpRTXuBv4VVj1wa/wDyQSbSKdcmtmG0c7aL KKa9YxVOXbsLzbJad2/yb7K1P51Ipqin1tXbqXaLNV2M7MxX/LMT4RrT8HV2jKcayBqOseQW6v3T fanqWSKn8qIu6HaGYmJ2I6qZpnKqMgAGWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcavulst UPeLpcaWji/h1EzY2/5XKiEOr9bdN6SdKOkv3nWrd0ZT2yB9U9/8isRW/wDtNZqpp2ylt2bl31KZ n3J0CF0uR6rZLsmG6KXpsT/Cqvs0duY1P4XI5Vc5P5DuKXSDXbItnZNqJY8Zgd+FT2OgdUy8vyLJ Ntyr+du5mIqr9WmZ/wA60dyqzY9tcpp9+c91Ocu4qammo4XVFXURwRMTd0kj0a1qfnVeiELuWs+n 9FVebrfdZL3Xu6MpLRA6rkev5lYnL/7xObXwsaaMmZW5bPfMvq2LzJLerjJI1HfmjZyt2/MqKWfY sYxvF6XuWN2C3WqDZE7OjpmQtX+VGom/85NThrtW3KPHyUbnC+CtepFVc+6mPrPhCgKN2uuYKiYv pjDj1K/8Gtyap7NyIvy00e8iKn5+h3tFw3X2/bS6narXi5Md1dbrO1tvpf8AxHK3d8jfzryqXqCa nCUR62cufd4exNWqzEUR1RnPfOc92SIYbpJptp+1vsSw63UMrU27z2XaVC/yyv3ev+Ul4BYpppoj KmMnIu3rl+rTu1TVO+ZzkABsjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYs Rqo/02rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/AGS+caqZH9vTebaBlRF2Ozkb6TnqjuZF 6eGylygAAAAAAAAAAAAAAAAAAAAAAAAADqLxl+J47crVZsgyi02y4X6d1NaqSsrYoZq+Zqczo4GP cjpXInVWtRVRAKQ174S6nXLVzFNWE1WueMVWDWqeHH47dQMfNR3WSdkiVyyPerJGcsbY3U7olR7V du5N+n7wnhcyhdWrRrTr1rTVamZBitNPTYxTtscFot1pWdvLNO2njfJ2k7moje0c7onq6M5bsxvL 8TzKmq6zEMotN8p6Cslt9VLba2KpZBVR7dpBI6Nyo2Ru6czF2cm6boh24Ga63hQ1FxLPcuy/h64i qzTq355cn3u+2SpxmlvVMtzkRElq6ZZXsWB79kVyLzoq+KbI1rZZT8LWJVugeQaCZzlmUZfR5Z3m e9Xi7V6y1s9XM9JFni3RY4EZI1j442N5Gq1N0cquV10ES9tbAV1U9pNt+5s0SxeyV1sbSzLy23t+ w7Z0yM7Jvwvo8iv5/BeXbqBQdv4MM/yCHGsU1y4m73qDgWKVNNVUWNJj9LbUrX0yotM2vqY3ukq2 MVrVVqo3nVqK7dSQ5Dwt5lQa4ZPrhorrfLglbndJR0+UW+ox2G7QVklKzs4J4e0kZ2EjWbp1R7VV zlVq77GiCJaZ6rYDrFYKjKdOL954tVLcKi1yVKUs0De8wO5ZWtSZjVciO6czUVq+pVAqHS3hFqtK Ndsq1etOrFxu9uzq3UtLklqvFtjqKqvqoIVjSo76j29kjnOc9YmRIxN+VvKxrGti+I8EWfYTpfc9 A7FxM3Wn0xqIrhDQWiPHYGV9NDUukkWnkr0l55Ie0lcr0YyKRzVc1JGIvTWYAzlbOES6YtodpvpZ p9rbkOJ37TPeW33+2UzUp62Z6P7Zau3ve6KeN6yPXke5Vaqrs7q7f62Lhczm+amYtqbr/rxU6hVG DTTVeO2ujx2nstBTVcjORaiVkb5HzPRv4O70RqpuidVRdEADNdbwoai4lnuXZfw9cRVZp1b88uT7 3fbJU4zS3qmW5yIiS1dMsr2LA9+yK5F50VfFNka1ttaN6WM0hw1MYfmWRZXXVNZPcrjd77WLPU1d XM7mkeifgQs3/BijRGtT1KqucvN0x1WwHWXGXZjptfvPFmbWVFB3tKWaBrp4HqyVrUmYxzkRyKnM iK1duiqS0ACJO1d0nbSyVztT8SSmivfsakmW9U3Iy7/xerufZKr/AMD+6f3pLQAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cV pqoAAAAAAAAAAAAAAAAAAAAAAAAAfGro6SvgdS11LDUwv6OjlYj2u/lRein2AZiZjXCucg4dtFcl c6S4ae2uCVV37Wha6jejv4W8Kt3X+Ui9RwwUtBu/C9U8ysm34MEtW2spmfyRyIi/+8XcCGrD2qtc 0w6FrhbHWYypuzlumc47pzhn+o0p4hbLutpzzFMjY31XO3yUb3J/zPMm/wD7Drp6jXiyf9utGEuE TfGez3eGTf8Akids80iCKcHR+7Mx4/PNbo4ev/8AMopq92X9sx8mXptXae1dMpwHNbDy/hPrbLJ2 f8qObvun5z72/WzSu5bJBmlDGq+qp54Nv5e0Rppo6q64pi9+3S+Y3arjzePe6OObf/0kU0nCVxsq 8P1WaeHMPV69qY7KvpNP1U9QZPjd1282ZDbKzfw7Crjk3/8ARVTszvbpw6aIXffvemtmj5vHusbq b/VK3Y6GXhQ0oj/7SPyKyfJ3C9Tt5f5OdXGk4e9G6ff+ixTwrgKts1R/2xPyq+j+g4knDLNTf9pd ac8g28Eq6yOqRP5lYnQ40mgmrNL1tmvr5Gp4R1mOU79/5Xo/f/2Gs2rsfu+MeaWMZgatl6I7Yq+k S7QHRv0n4hqX/auoGIV23h3q2yxb/wDoKp8XYPxO03i3Tesb6uzmrY3L/wCk3Y10bkbaZSxdw1Xq 3qe+Y+cQkQIw6xcScH4eD4nU7f8Aebs9m/8A6SH4Wm4iovwtH7XN/wAHkULf/iQx+Loz3S2ibU7L tHx0/WUqBE1fxCt8dB4X/wDi5TSJ/wBaH87xxB/i+/SyiGc9Ge6fJto0fmUfHR9yWgiaS8QjvDQO Nv8A42VUa/8AUf1IuImT8HRe3xf8JklO7/qQa+jPdPkxlbj/AJlHx0fclYIu20cSM34GneNU/wDw t55tv/RQ+rcO4nKj9zt2nlJv/wB/q6t+3/oNGVXRnuazVZjbdo+KJ+SRg6Jml/EfU/7ay7BaLfx7 tSVMu3/p7H3ZoZrRVf7e10pKRF8W0mNwv/yOe/dDbQuTsonw82k4jCU+tfp/qn5Uy7YHBj4bL7U/ 9utcsvm38e5NhpP8myO2OVFwp6fyf9uslzS9fL3++Pdzfy8iNNos3p/d8f8A6jqx+Ap23Znspn65 PhW3a1W1Oa43OkpU8d55ms/61I5cNXNM7Zv3rN7Qqt8UhqEmVP5o9ywLbwxaE2tUfBp7RzO8VdVT zVG6/KqSPchL7Tp1p/YeXzJg9goFb4Op7dDGv+VG7m0Ya7O2YjvnyQVcMYGn1aa6u6n61M+xa3Yp cV5cYtGS5EvgiWuzzS838nMjTnwX/V+9dMc0KvSNd4SXethoOVPlVr1Vf5kNKIiIiIiIiJ0REP6b xhJ/eq7o/wDqvXw9RHs7Mf8AdVM/LRZ7gwDiRvfWprcKxuF38Dtqyob/AOxI1/ynY0/DdkVz2XM9 b8mrEX8KO0xRW1i/3vo8yqnq/OXmCSMJbjbnPvVq+HcXPqZU9lMfOc58VU2fhg0WtUyVdTia3ir/ AH1RdaqWqc7+Vr3cn/uljWfHrBj0HdbBY7fbIfDs6OmZC3/IxEQ7AE1Fqi36sRDn38ZicT7a5NXb MyAA3VgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867xcvaciL6 O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4AAAAAA AAAAAAAAAAAAAAAAAAACq8+0SXPdc9L9Xa2+Rx0emkN5fDbFp1ctTVV0EcLZVfzbNSNjH7Jyr1fv umxagAzJjOBat8KGgNl090hxKj1JzW7ZDVTXC51cqW63U8lbUyzSV9WnM6Tso2uYzlj5nqjUXocb FuIPXfDeIPB9C9erXpzdG6kUlzmst1wmWrZ3Oehg7eWOqhqXPVWuZsjXtcnX1eO1X8UddhFXxm2S xcWtwr6TRNmGrUY7TTuqWWW4X/vCJIlUsPR8rYublY/pskf8LZ8Q0rtuhtg8o7iVZhWmUGnOLT4B VSYi59nkoXZFXzVLoXTsjc1HsRYFmRqSI1ysjR+yJI0C/qbX7iH1t1FzWwcMeOafU+J6fXV+PXDI cxfWyJdLrEiLPBSR0qt5GRKqNdI9Xb8zVRFRdin9DNcGJrHxOcWesGPSY8zTmz2rEKm3xTJULHVU jJO/U0EnRHo+rjYkSrtzJKxV23U/HBFxB4NoJpfetDNTKPIIdXrflN3mq8Yp7NVT193qJp1dFLAr Wdm5j28rUle9rERvM5yM2ctU0mLZ3qd5MbU7VG2Y7VXK6an6iVecXahoUdLLLRMucTZmRo1N3Njd Svf4dGtcvqA0peeIfjKxbRqp4kcx0005pMKW2Jd345R1dauQ2+hlanZTPmk/saWSNHskfFyM9FHJ ujvRLD8nzhkmD8HOmFtqGOSouNoW+TPd+FI6ulfVI5y+teWZqfyIhnvjR4ytN9WuFe8YTw9TXDJK nLZbfYamqjtdRTUlojqJ407KaSVjWds/ZYmwsVz+r3bcrFU01n3CxBnFuxa1WrXjVzAqLFbPBZqe jwrIY7ZTzxxNRrZJWrC9XP2ajUXfZERE28VUPzxB8QmQ6d5Zh+jek+JUmU6mZ66d9so6+pdT0Fvo 4G7zV1ZIxFekTfBGtTmeqORF3REWI0OvvEBpXrZgmlXEjj+A1ds1MkqqKxX3DlrIm0lfAxH93qYa pz1cj0ciNexydV6p47Vxm0dBwpcY+E6s6q3nJbnp2/SxcFizK7pLcZqS6R13eOevmjYqtfKzf4Tl RHLI5ERGtdt3FRkVDxe8U+m+e4FDWzaT6LwXG9VmT1NHLS0l1u9RE2OKnpVla1ZUhRiSOe1OVPSR V6sVwSHGOIriI1Z1z1i0o0nxXCIbLp9c6K20eRXuOrWGKXsFWpiljil5qqZZkXlazsWxxsVXue5z EX9YDxXZpetFteLzqXZrLa8u0UnvNtrp7I+VbfWy01M6SKWBJVV7Fc5OXkcqqi8vVOblT4eTd2r9 AMh1lufwMmp2b5DmM0svRUjfUrCm6r4IiU6qn8qr6zLrLnc63ya+f5lRo5l+4jdTqqSiV6em91bd WQqzbx2WOkm2T++VQLo4Us6y/QHGeE/Qqa1WlMX1Vxe7XOprJYZe+w3NY1uTWpIkiMRr21LW8rmK 7dOiptsXtnuu2ZO4mcM4ddKLbZq6d1FJkWdV9whllbaLOio2GOPs5GIlTM/drefmRqK1ysc1elX8 fNLb9GdL9HtX7XQTS0ejGcWSomjgRO0daVYtNPE31IrkWFqercsXg50sybGMRvOsOqVLyalatVyZ HkLXIvNQQq3aitrd+qMp4Fa3lXqjnPTrsgEbxzgkdasY06x27ZzT1y4nqZV6nXqVtvVnne4PkqHw NRFkXs+z7aNFVVdv2fgm/TU4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8F4jNEdGrdabf UWzU/wBkvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB3/2KvrXRJXs 54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAArvW2rufsftNgx3XC0aX3y 93mko7fca6kpKqSufz8zqGngqXtY+aVqK1Nkc5Oqo1V8AsQEPy/WTSHT24RWnPtVcPxqunaj4qa8 Xylo5ZGr4K1kr2qqfyISi33Cgu1FBc7XXU9ZR1UaSwVFPK2SOVipujmuaqo5FTwVAOQDqL5l+J4x U2uiyXKLTaai+Vbbfa4q6tigfXVTurYIGvciyyL6mN3cvyC+5fieL1Nro8lyi02movdY232yKurY qd9dVO/Bgga9yLLIvqY3dy/IB24Ifl+smkOntwitOfaq4fjVdO1HxU14vlLRyyNXwVrJXtVU/kQk 1Hc7bcbdFd7fcKaqoZ4kniqoZWvhkjVN0e16Lsrduu6LsBygQ/GdZNIc1vc2NYbqrh9+u9Ojlmt9 svlLVVMaN/C5oo3q5NvXunQ7TLs5wnT+1efM8zCyY3bedI++Xe4Q0cHOvg3tJXNbv0XpuBRGR6Da 1636o2uv1/yHDYtM8PvTr1ZMWxxtVJJd6iN7u5y3SWdrUVImqjuxjRWOfvvuiIhpMzRqprxfrnxA cPmnWjOeW6qsOd1V5ut9q7b3Wugq7ZQ0yPRjZla9GtfIrm88ao7du26GlwAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWm qgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHjNrnxMcSeR6x6k8TulepOUwaYaU5t Z7KlkpLxUxWyuga98avdC1/ZPjlkp286Oau6VjEXp0A9mQR2g1BxGv09ptU0vVPBjFTZ2X9LhM9G RMoXQpN2zl8Eaka8ymItYvKNaAax6Eat4li9qzimoq7Fb5aKDI7hYXRWerrX0MqRU7ahr3LHJIqt RjZWMVVc1OiqiAb/AAYV8nrqng+i3k57JqXqNemWuw2Wqu0lTOrVe5VdcJWsjYxvV73Oc1rWp4qq FPccfHHpFxHcImRWDFrDmlgqq6tt9TaX5HZu6QXeKKsj7VaSZj5I5VYi7q3mR2267bNdsHqWCq+F D4rWjn/IDHv1dAYi407nrBmnlDtPNAsK18zzT+y5TjVKsy2C9VVPFHL2le5ZewjlYxz1SFjVVeuy J16IB6Ygw9TeTy1xgqYp3+UU1tlbG9r1jdc6zZ6Iu+y/2Z4KXpjnFtpzkXEvfuFR1jyW15jYaJ1e s9fTU7KGtiRkUid3kZM571WOZHpzRt6MfvsqbKF2gpK7cWunNs4m7ZwoU9jyW55hcKFLhLVUVNA6 30MXZSS7VEjpmyNd2caO9GNyfCxoiqrtkgWeeUg0Fw3LsgxCy47qBnL8Sc5uQ3HErB36gtKtVUf2 8zpGIjWq1yK5qObu1U3VUUDVQInpZqngutGCWvUjTe+xXew3eNX09QxqscitcrXsexyI5j2uRWua qIqKhkjyl3GjnXDbYrPhWlltyC15Re5aStbky2inqLXFSc86S0rHzc7XVSrC34NY+kcnMjkXYDcY KFruNDSPGtDINfdSbdlWA2eqq5aGmtOS2ru13nqGOc1I2UrHvVyuRiuRebbl9JytRFVIPgXlL+Hr M8zs2D32y55gdXkbmNs9Tl1jSipK9XqiM7OVksiI1yqiI53K3dU6puBrIA85bJ5SXL7txq3LCF06 1LXAKOzMtjMWp8Xpn3aK6LNDvcalvN2sVPyyKm6Sq3kWJ3Ju5dg9GgeV2Hay4RoR5T7iGz7Pamrb Qtx51FTU1DTOqauuq5JrUsdPTwt6ySORj126IiNcqqiIqptXhl42NFuKysvVn08W+W292BqS1tov tGymq2wq7k7VqMkkY5qP2auzt2qreZE5k3C/AZVzzykGguG5dkGIWXHdQM5fiTnNyG44lYO/UFpV qqj+3mdIxEa1WuRXNRzd2qm6qil/aWap4LrRglr1I03vsV3sN3jV9PUMarHIrXK17HsciOY9rkVr mqiKioBLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/Ta vNurdk6pv4F4FNaoa23/AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXK AAAAAAAAAAAAAAAAAAAAAAAAAAAAyZxCf9nPHHw5abt9OlxqG+5vco/Hbs4Eho37eraZHJv+c1mV AnD5HUcS154iLrl01QtfhTMKorVFTOgfQQd57eWZtS2XmV7n77crGK3fo5QM13PTfLuG3UjVXP8A UbhhtuuGFZxkNXksmS2+Klrr7aKKRqf2BLRVSc00MLWqjEidyo1FVfFGt07wwWvRag0WsNdw9xvi wS9dtdrZE6eeRsSzSOdKxrZnKsSNk50WJNmtcjkRPHetqfhb4iLRjk+nePcad+iw97JaWFlxxSkr r1DSP33iS5PkRXORHKiSOiV6dNlTZNrw0j0txTRTTbH9K8IhnjsuOUiUlL28nPLJ6SufJI5ERFe9 7nPdsiJu5dkRNkAzxrwvs649uHrTtPTpcQtd9ze4R+O+8SU1K9fk5ZmLt/Kp/deJGZ5x6cPem7Hp JBiFtvucXKFF32RYkp6N6p6tpmO2X86k+1e4a8izPWbH9ftMNV34LmVlssuOVEs9kjutJX218qzJ E+F0kStc2RznI5H/ACdOh1+mvCPNhevGSa+ZVqvdstvmT4szG6p1RSJSTRbytkklhkhkRsLNo42M jjYzkRiKr3vVz3BSdz03y7ht1I1Vz/UbhhtuuGFZxkNXksmS2+Klrr7aKKRqf2BLRVSc00MLWqjE idyo1FVfFGtimu91wx2iuhehnCNjd1vGCa05BXXaayW+9Oo5rja6baorrbHPVyI2ka9z3Nezma1v ZvaiLzKjr/p+FviItGOT6d49xp36LD3slpYWXHFKSuvUNI/feJLk+RFc5EcqJI6JXp02VNk27XKO CnB6jSrTvT3TjKrzhV20mqErMQyOnbHVVVJUO37Z00b0Rk7JlcrpGbNRy7bbN3aoZ41Y0j1nzm14 XRaUeT+pNLb/AIhkVtudsyOgybH2PoYIZE7Vjkp5WySMcxV5mdd1RFVFUsPEMasHElx36r3bUiz0 eQY9otbrTjuN2q5QtqKSKtrYnT1VX2LkViyo6NWI5UVeXk9bW7W3p/oDqfQ6gWzUfWbiMvmd1thg mhtNtoLVFYbXE6ZvJJLNTwPetTJy9E7R6tbvujd9lToMh4Tc5tutWU6y6F8QNdp3NnsdL7KLY/HK a7QVc1OxWRzw9s5qQScqu8WvRVc5VRUXZAqzRzTDCLd5TTUiqwO0UltsuGYXSJNbqFiRUlHeLisD nvjibsyNz4Id3I1E5nKqr13NylEcNvCvR8PGV6k5ame3HK67Ua50twqKq5QbVUaQseiJLLzuSZzn yyvVzWxtTm2axrUREvcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAKS40dZvaF4Z851DpqrsLpFbnW+0Kjtnd/qV7GFzflVjn9oqfJG486dDNBOPN/B/W6QYTot plWYHqfSLepK27Vr2XaVKqOJ0M6L3lrGPY2OF0aOjVEVrVVF67+oWtWgek/ERjNLh2sOLyX+zUVa 24w0iXKro2pUNY9jXqtNLG52zZHoiOVU9LfbcnFut1DaLfS2m2U0dNR0ULKenhjTZscTGo1rUT5E RET+YDyx0Z1NyXUryUGrOmCd49lOmFJUWesp137dttSZs6K5PFEbClTDt8lOpJdL9R9F6TyPd3sl bfrI2pjxq9Wue3Pnj7x55lqZ1p0WPfmV6yPhlb035dndETdNy4Bw2aJ6XZbmGb4Lg8dsu2fSvmyN /fqqaCve+R8jldTyyOhZ6UsnRjGoiPcidF2ITafJ/wDB3Y7nd7xatC7LBVXyjq6CrVKmqcxsFTE6 KZsDFlVlMro3vajoUY5qOXlVAPNnNaK9VfkbcBntTJXUtFqBNPclZvs2mWe4RtV35u2kgT+VUL34 99R9F755N/A7TjV/slZLWxY+mP0dNPG+andBAiSr2bVV0fZx9pE/dE5XPRq7Kuy7rxLh10WwjSWb QrH8Do24HUNnZLZayaathekz1kk3dUPe9d3qrk9L0V2VNtkK6oPJ4cGlsxy9YrQ6HW6O35AkTbgv nGudUPZHK2ZrGVCzrNEztI2OVsb2tdyoioqJsBOOFD4rWjn/ACAx79XQHnhx94Vh2ovlLNNsLz/L avGMfuuKUkVddqSviopqViS3FyObPK1zGKrmtTdyL47es9TcSxWw4LitmwnFaHuVlx+gp7XbqbtX y9hSwRtjij55Fc93KxrU3cqqu3VVUqfWfgt4aOITLIc51f018/3unoY7bHVeebhS8tOx73tZyU88 bF2dK9d1bv18eibBmbC+C7gmwfMbFmtu4yMpq6vH7nS3SCnrdQ7RJTzSQStkayVqQNVzFViI5EVF VFXqnicbj7pGaG8VGgfGZansitfnKPGMjqo1RI+6v59nqqdHK6lmrE3X1Qs/mub3rjgT+Yz6TXj7 2XdqfoZpVrNp+zS3UvE471jETqd8dE6qnhVjoP3JzZYntlRUTpujuqKqLuiqBijye9numuWsOv8A xmytck+S3KpxvFJpk6xUzUa/1/wYmUDEcn8GRPlQzv5PLHNUanB9SbLYOMW16L1Nluz5Mjsd2xC3 XOWZiQ8r6mSWska9GtVksbmIitarVVerz1t0p0m090Rwih050uxyOx49bnyyU9G2eWdWulkdI9zp JnPkequcvVzl2TZE2RERK31K4GeE/V3LZs7z/Ri03C+1L+0qayGpqaNal/8ADmbTysbK5fW56Kq+ tQIL5NvS7B9KtDLpatNdcYdUccuORVFdT3OGzSW6OnlWCCOSBrHySK7ZY2uVUVE3cqbb7lNeWqXs 9HNOJ37pHHl/pO26J/Ysq/8A4l/yG/sSxHF8DxyhxHC7BQWSy2yLsaSgoYGwwws332a1vTqqqqr4 qqqq7qp0OrejGmGu+JOwXVrEKTIrI6dlU2mnfJGsczEVGyRyRubJG5Ec5OZrkXZzk8FVAMB+VTud prtQOG7UG411NdtNKLI5UutTTSNqKRN6iikej1bu13PTxy8qdd0Y/b1nI8sNmWn2caQ6bYnhl8tW QZdc8qhq7RDa6mOqqH0bqWaNys7NVXlklkpUbt+ErU235TbFl4YdA7BpM/Qu36ZWp+CSSPmdZqtZ KuJZXO5lk55nPk5+bqjubmReqKhHNL+B3hS0ayiLNdO9GrVbr5TuV9PW1FTU10lM5f30PeZZEid4 pzMRF2VeoFw4zBdKXG7TS3yXtbjDQwR1j99+adI2o9d/Xu7c88dM71Z7B5ZTV599utJbm1eKRQQO qpmxJLItFaXoxquVN1VrHO2+Rqr6j0hKa1N4POGvWLO6XUzUbSugu+TUiQoy4d7qadz+y/c+0bDI xkvLsiIr0d0RE8ERAMf8O1ntty8sFrfXV1HFNPaseqKqje9qKsEzltkKvb8i9nLI3f5HqnrPxpFb 5KDyvWutBjjY6Oapw6aSPkRGt7xLBa5Fev8ALK5Xqvyqqm4sZ4eNHsP1eyDXjHMQ7pnWU0rqK7XX zhVSd5hV0Llb2L5FhZ1p4erGNX0PHqu6zcPOj2P6zXniCtGIdhn+QUiUFxu/nCqd28CNhYjOwdIs LfRp4U3axF9Dx6ruHlV5PLHNUanB9SbLYOMW16L1Nluz5Mjsd2xC3XOWZiQ8r6mSWska9GtVksbm IitarVVerzdfk29LsH0q0Mulq011xh1Rxy45FUV1Pc4bNJbo6eVYII5IGsfJIrtlja5VRUTdyptv uTrUrgZ4T9XctmzvP9GLTcL7Uv7SprIampo1qX/w5m08rGyuX1ueiqvrUt/EsRxfA8cocRwuwUFk stsi7GkoKGBsMMLN99mtb06qqqq+Kqqqu6qB24AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKZFa9MqvO8RueUwY+/MKD v/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb4 6eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEW1SwZ2pmnWRY CzJLrj779b5qJl0tdQ+Cqo3ub6MrHtVF6Ltu3dEcm7V6KoEpBnXg41pyrNcevWjmsTux1X0rqW2X I2SPRXXKHl3prnH63Mnj2VXbfhbrsiOahooAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAArDXDiX0R4dLN541az232d8kavpbeju2rqvxT4GnZvI5N025tkYi/hOQo2k 8obhWo3CfqpxBaX2qqpLhgjZqSG23ZGLMyeTlbRzysYqt7N7pEVWo5f3N7d+m4GwQeWeneLcWl24 L8l4xZeLXOZ8luVgvN18wVFSr7ZHb40mikWNqOTu9QjGPmikhRnI5I028VOLU6xavp5Ial1NTVfM ky92QrEt/S/VXnJY/Or4+RantO15eT0dubbboB6rA8+tNL3r7ozw7XPjr1a1tvGWd902p1tGDVDp lttLLN3RKCqkes20s7ka10r+zR695l9P+FC9NtKuLPW/hiq+LG4cZOoNpzC4UNwv1psVvqlgs7Yq Z8vJBJTsVsfwnYrsqN2aj27tfsu4enIPK3ULjF1a1a8mH7bNPl91x3ObNl9NjlzvFiq5LdNUvZyv 7RFgVqs54poudrdmq5HbIibIl18YGouoOM+TRx3PMbzrIbTk09lxWWW80NzngrnvmbT9q51QxySK r+Z3Mqu3duu++4G5weXPGhrJrNh/CjwoZZhOpOVUGQX61Wqa5VFNe6qGS7TOttJIve3skR0/NIqq 7nVd1e5fFVPvxix8VPBW3COJCDijyvM33K+x27IcfuDuys8k74nzrHT0jV7OOBzYZmfg87fRcjt/ APT8zlrxxf8AtVa5aecO2DaeezfNM7f2stN527hFaqPmVEqZXpDKrk5Y53q1ERUZC5fW1F0DZ7nT 3u0UN5o+bsK+miqoubx5HtRyb/zKh57cMbU1L8qhr5n96/siTDqB9ltzXdUp1a+ClRzN/wAFeSCZ On/fX/KBom88dOlFjzTVnBavFsyfX6N2d97v0kdHSrDUU7eyXalVahHPeqTNVEe2NNkd18N7V0V1 bx3XbS6watYnb7nRWjI4H1FLBc4o46ljGyvj9Nsb3sRVViqmzl6Kn8hXF34LNKr1mer2cVV4yZtf rRY0sF9jjqadIqWn7FkXPSosKqyTZjXbyLInN6tuhXnElYK3hf4Rse0x0k4gLNpdbrPJHa0yTJ3u mrpabaR7oqdtNAqvqHuXdXRxbtY16oiL6SBsEHkZgXE7V6ZcVGkOMaM8XGoGsuI51caOyZLS5jDW 8sM1TUMg7Sn73ExWt+FSRvZ77dnyuc5HbFtat53rZxNeUDr+FXCdZ8m02wvBrU2uuNTjVU6lrKx6 QQyyOWRqoqqslTFEjXKrEaxXcqqq7hoyp4v+78alLwf+15zd5tK3T2RedtuXalfP2fdex6/gcu/a +vfb1GjTyw0xxjO8L8rtaMU1AzafL62143PDSXyqgbFVVtGtskdCtQjPRWViOWNz0ROfs0cqbuU7 fh7vHEFx5626qZzHxK5rpxiuEXNlDj1pxydI4V53zdj28S/BzI1kKOk7Rrle6TZFa1NgNWcN/F/7 oPWLV3Sb2vPMHtV3Z9r84edu9ecuWqqIO07LsWdj/tfm25n/AIe2/TddGHl35NzJZ8C1v4t8v1dv FLBPj1dLcMmr6enf2DHwVlwfVysjajnciK2RyNRFXbZE3U13Z+PjhlzawZnc9MNQo8puGFYtcctr LfDb6ymc6jo2I6RUfPCxv4To27Iqr6fguygaJB5mcN+CcU/HFprfOITIeLrOMFr7hc6ulxuy43UP pbXTJDsiLNFG5vaM51Vmy7v2ZzOe5XdPhptxeawat+Ty1rrssyivotQtNkZQJkFsnWjq5I3yRrFK skKt5ZUVszHOZtzNRFXqrlUPToz5xr8WXuPNMrRqN7AfZd51vsVk7n517h2fPTzzdr2nYy77dhy8 vKn4W+/TZcPtsvF5nHAfbuKd3FhmVmq8XtMlXQWSirJm9+pKapdFLPW1XadpPO9WySJzo5qNRjNu qqnA42tWck1w8mJojqdmErJr3dssiir5mMRiTzU8FzpnSq1uyIr1h51REREVy7IidAPWi2VvnK20 lx7Ps+9QRzcnNvy8zUXbf17bnKPPniizvUnhy4m9ANZotQMlj0wyltLjuR2R12qFtME6x9ms7qZX 9kirDOkqbN35qRzvFTts9zrUnWPynGM6M4Pn+S2bDNMLLFesso7Vdailp62fpO2OdkT2sma501DE rH7+isqetUAsyu8ojozb8f1iySfEc67rojeaWx5C1tDR89RUVFbLRsWlTvOz2JLC5XLIsao1zVRF XdE+GrXHlbdJJdG8svWmNYmmmr1JR1LcnqLo2GeyPqI2StjqaRsb2ryxyxvVWz+DZtt+zTm7W58A mjV1xzWbGJ7/AJcyl1yvUF9yF7KumSSmqIqx1W1tIq06oxnavXdJEkXb179SC+Uc0kx63+T5uuKU DZZ4NOqWyOtEtRyvlalNNDS8zlRETmWCSVFVERPSXoidANnoqORHNVFReqKh/Sn+D7Lq7OuFvSzJ 7nK6WsqsWoI6mVy7ulliiSJ71X5XOjVV/OpcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P8A ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc 0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZR4wcJyXTPKLDxq6 S2ueryDAoFo8wtNK1Edf8Yc5HVDHfLJBssrFXwRFVd+RqGksHzTG9RsPs+d4fc4rhZb9RRV9DUxr uj4pGoqb/I5N9lavVFRUXqinczQw1EL6eoiZLFK1WPY9qOa5qpsqKi9FRU9RjrRySbg74iKnhouz nRaW6mVFRe9NqhzdorXcVVX1lmV6r0RVVHxJ/fInpOeuwbIAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAABWGuHEvojw6Wbzxq1ntvs75I1fS29HdtXVfj+407N5HJum3NsjEVf ScnieeWdeUf4o+KnIqjTHgj0outsp5F7OW8PgZUXFsblVEkke7+xaBq9U5nOcqLsrZGr0A9DdcOJ fRHh0s3njVrPbfZ3yRq+lt6O7auq/H9xp2byOTdNubZGIq+k5PE88s68o/xR8VORVGmPBFpRdbZT yL2ct4fAyouLY3KqJJI939i0DV8OZznKi7K2Rq9CX6H+SKferz7ZHGLqNcMwv1bIlTVWiir5ntle vqqq569tMu3RUj5NlTpI5D0NwXT7B9Mcdp8R09xO1Y7ZqX9yordSsgjRdkRXKjU9Jy7dXLu5V6qq qB556H+SKderz7ZHGLqNcMwv1bIlTVWiir5ntlevqqq569tMu3RUj5NlTpI5DY2qXDlppd+GrLtB cUtVkwjHrpZ5qeF1LTsp6akmREfHUSom3NyyMY57nLzORF3XfqXMcK92W05JZq/Hr9b4K+2XSmlo 6ylnYjo54JGqySN7V8WuaqoqfIoHlfZbXxo4DwNZ1onerDp/Bp1jtgvaNzqlyOCvWqoU7WWSip4o JHK6SWVXQI+RI+Rsmyt5mpvztNNGNS9bPJBWXT7TLGXXi/3O+T1dLSLVQUvaxRXiVXuSSd7GIiIx 3i7rt03NCS+Sn4ceWos9Fl2qNDidVVpWTYlT5QqWeR6KipzROjWRfwU9JZObonpdDWWHYfjOn+LW vCsMs1PabHZaZlHQ0VOioyGJibIib7qq+tVVVVVVVVVVVUCobfoDNnXBTYeHHUSN9orp9P7Xj1x5 HMndQV0NFCzmRWOVknZTxovouVruTouy7mVMM058pLpDoPX8JeM6TYZfbStPXWm2Zw3I4Ym0lFVO er1Wnke2Vzm9rJyLyej6KK1/L19IgBhC6+TqvFr8n7W8MON5DQVeaTVzMlmrHq6OjqbokjFdE1VT mbH2LEha9UTdWtcqNRVRKy1L0P8AKFa08HtBoHk+kuN2R2FU9spqWKnv9JNXZKlK6OGJu/bd3pmM h5pnudJzPfExGtTmVD08AHk95RrDsjxXhc4UtP8AI4X2i/WenoLNXxtkZMtJVw26lhkRHRuVj+V7 V6tcqLt0XbqWLxGaB8d3GFdMN0a1UwjD8XwfG7qyuu2V2u8xzsuj2sWJaiGmV3bRu7N8vJE6NE5p PSeiJumsuJXhP064p6bFqXUG9ZHb2YlcXXOiWzVMESySuRqKkvawybt9BOjeVfHqXUB8KGiprbRU 9uookjp6WJkETE8GsaiI1P5kRDzx0LVdGvKxat4Nff7Hg1Nsz7xZpH9O9Su7KqVGfKicta3+WFT0 VKW1s4UNO9cdQMH1UvF5yPHss0/qe8Wq62Coghme1HtekM3bQytkiRyKvLsn7pIng5UULpMW+Um4 XdXOIK36b5Xo/bbdfbnp/damrmx+vqY4IrjHMtO5F5pXNjXlWm5Va5zd2yu2X1LtIAebPELoHxza 0Z7pbxLTaV4vTXzTy+Uc9Dp9SZDA50NPBPHUrPNXSKyFzpJI0YrI19BjY1TmVXbSDUrh64sNPOLi g4x9BtOrHklZltjp6XLMUqb3BTdzqVpYop4mzyOY18aLDE9sjFVVex27OVU39BgB576YcOXFlJ5Q y1cTeruIWiOz3CzTpXVFoudO+ltL3UMkENE1j5EqJlaiRI+RI+VXveqeim5wdKuHzjO4PNcNR4dB 9N8VzrANQq5K2kqrnfI6JtrckkroVmYrklXs0nex6Rsdzo1qorV6HosAMF8CXChrNpVqpr7U8QuJ 2+6WTUCo7OOvmlo6mkv8bqmrWd7qVsj3MjlbMjljlanR6tVF2VDUqcMmgFFY8iseMaPYZjCZTZKz HrjVWKw0lBUy0NSzlli7SKNrlavoryrum7Wrt0Qs8Aec2jml3lDeDvD8g0M0p0vw/UTHqivqKvH8 mlvkFGtvWZERXS000jHPRFaj1jRF2er053tVDucL4C9QdJOAzU/SS3upso1O1Ej75WRUtSyKBZkf GkdMyadWNVGta9yverd3Pdt0RN/QAAY6xbQHVu3eTNm4fK3E+zz9+J3C2JaO/wBMu9TLUSvYzt0k 7Dq17V359k36qhQuq3BnxJ5L5N/SHQSy6b95zvF8pqLjdrT54oGd3p3SXNWv7Z06Qv3Spg6Meq+n 4dHben4Ay3x+aX2LPOCPL7ZlVVS2+oxazxX6iqahybQ1tGxFRiL1TmkTtIE233Wbp4oVl5J7Bcju Wn2Y8TeoUklVk+qd3Xs6qVvpOoKRXRtc3fqiOmWZNvWkUa9S8OI7go0u4o8ltF/1LyfNoaW00zKV bNarsymt9Y1srpEdPGsTnK/d6pzNc1dttttty7cWxjH8Kxu2Yhilqgtlms1JFQ0NHAm0cEEbUaxi evoiJ1XqvivUDtDHPlYs9oMQ4OMhsE0zErsxuNvs1FHv6TnNqGVMioniqdnTvRV8PST5UNjFLayc J+nWvGpmD6k6iXnI6xun83erXj8dTA20y1HOj1lniWFZJHKrIkVO0RqpG1NtldzB3PC7glfplw56 b4HdoXw3Cz4zQQ10Tk2WOqWFrpmfzSOen8xaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6bey nzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P8AZL5xqpkf29N5 toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKn4nNBLVxF aUV+DT1aWy900jLpjd4buklpu0O7qepY5vpJsu7XbdVY5yJ12UtgAUZwja83PWvT2qtud0XmvUjB qx2PZra3R9msNwi3RJ2N/wC9TNb2jVT0d+dqbo3cvMyDxTWW7cOWq9p43sEoJ6i1xxw2HVG10zXO dXWZzmtiuDWJ+FNTLy9fFWI1N2tR6rrGyXq05JZqDIrDXw11sulNFWUdVC7mjngkaj2SNX1o5qoq L8igc0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64 rTVRlXyXHxE9Mv01+uK01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAFYa4cS+iXDpZvPGrWe2+zvkjV9 Lb0d21dV+P7jTs3kcm6bc2yMRV9JyeJ55515R/ii4qciqNMeCLSi62ynk+DlvD4GVFxbG5VRJJHu /sWgavhzPc5UVEVsjV6AehmuHEvolw6Wbzxq1ntvs75I1fS29HdtXVfj+407N5HJum3NsjEVfScn ieeWdeUf4o+KnIqjTHgi0outsp5F7OW8PgZUXFsblVEkke7+xaFq9U5nucqLsrZGr0Jfof5Ip96v Ptk8Yuo1wzC/VsiVNVaKKvme2V6+qqrnr20y7dFSPk2VOkjkPQ3BdPsH0xx2nxLT3E7VjtmpU+Co rdSsgjRdk3cqNT0nLt1cu7lXqqqoHnlof5Ip96vPtk8Yuo1wzC/VsiVNVaKKvme2V6+qqrnr20y7 dFSPk2VOkjkPQ3BdPsH0xx2nxLT3E7VjtmpU+CordSsgjRdk3cqNT0nLt1cu7lXqqqpIAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf/AGKv rXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2L EaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHFutrt18tdZZLx RQ1lBcKeSlqqaZqOjmhkarXsci+LVaqoqfIpknhnu1w4YtYrlwU5rXyPxyubPf8ASm51cyvfU25X K6otTnr4y068zmp4qzmXoisQ2AUjxa6C12uemrPYdcPNOoWIVbcgwu7sekb6S6Q9WMV+3SOXbkei 7p1a5UXlRALuBUXC7r5RcQ2lVJlk1ElryW2TyWbKbK7dJbVd4F5Z4XNXqiKqc7d/3rk36oqJboAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8 RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAFYa4cS2iXDpZfPGrWe2+zvkjV9Lb0d21dV7b/ALjT s3kem6bc2yMRV9JyeJ55515SDii4qMiqNMeCLSi62ynk+DkvD4GVFxbG5VRJHvd/YtA1eqcz3OVF 2VsjV6AehmuHEvolw6Wbzxq1ntvs75I1fS29HdtXVfj+407N5HJum3NsjEVfScnieeWdeUf4ouKj IqjTHgi0outsp5Pg5bw+BlRcWxuVUSSR7v7FoGr1Tme5yoqIrZGr0Jfof5Ip97vPtk8Yuo1wzC/V siVNVaKKvme2V6+qqrnr20y7dFSPk2VOkjkPQ3BdPsH0xx2nxHTzE7VjtmpU+CordSsgjRdurlRq ek5durl3cq9VVVA88tD/ACRT73efbJ4xdRrhmF+rZEqaq0UVfM9sr19VVXPXtpl26KkfJsqdJHIe huC6fYPpjjtPiOnmJ2rHbNS/uVFbqVkEaLt1cqNT0nLt1cu7lXqqqpIAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29 N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9 pyIvo7c3QlYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABjrXSCq4RNfqTissEMya cZ5LTWHVChgaiRUU6uSOivXKnra53JKvrR3rdJumwaapp6yniq6SeOeCdjZIpY3I5j2OTdHNVOio qKioqHV5hiWO57i12wrLbXDcbNe6SWhrqWZN2ywyNVrk/Muy9FTqi7KnVDMvCFleR6QZje+CPVK5 VFXcsOp/OOCXirVrVvmMudtE1P4UtOu8bkT963ZE2jVVDWQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAB n7jV4r8e4TdIarLJ1gq8ouvPRY3a3u/2zVbdZXonXsYkVHPX1+i3dFegHPybijxe38UuG8Ldg7G4 X670tbc77Ij90tlPFSSSwRrt/vsjmtdsv4LE3VPTaqXkf5+eCziJsmB8YFPxAa7ZXVuifBd6263F 8L6ieoqZ6aVrWtYxFVXOke1qIiI1N035Wpumq868pBxRcVGRVGmPBFpRdbZTyfByXh8DKi4tjcqo kj3u/sWgavhzPc5UVEVsjV6AehmuHEtolw6WXzxq1ntvs75I1fS29HdtXVe2/wC407N5Hpum3Nsj EVfScnieeedeUg4ouKjIqjTHgi0outsp5Pg5Lw+BlRcWxuVUSR73f2LQNXqnM9zlRURWyNXoS7Q/ yRUl7vXtk8Yuo1wzC/VsiVNVaKKvme2V6+qqrnr20q7dFSPk2VOkjkPQ3BdPsH0xx2nxLTzE7Vjt mpf3Ojt1KyCPfbq5UanpOXbq5d3KvVVVQPPLQ/yRUl7vXtk8Yuo1wzC/VsiVNVaKKvme2V6+qqrn r20y7dFSPk2VOkjkPQ3BdPsH0xx2nxLTzE7Vjtmpf3Ojt1KyCPfbq5UanpOXbq5d3KvVVVSQAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9B tXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/wCC8RmiOjVutNvqLZqf 7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAZ64xdEMk1FxO06n6S9nSasaYVTr9ilV2fM6qVrfh7e/qnNHUMTl5VXZXI1FVEV2+hQBX PD5rbjfEJpRZNT8bY+nSvjWGvoJek1uro15aimkTxRzHoqdUTdqtd4OQsYxrl6JwVcTTNTKZEpdH NbbhHRZPEyNeysOTO3SG4L6o4qndWyL0RHcznL0YhsoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAjeo+oeI 6T4PedRc6u0dtsVhpXVdZUP8Uang1qfvnucqNa1OrnORE6qf53uK7iXy7io1duOpGRrJTUDd6SyW vn5mW6ha5VZGnqV67q57v3znL4IiIn+inMcFwjUSz+x7UDDrHk1q7Vs/cbxb4a2n7Ru/K/s5Wubz Juuy7bpupBvcncLH4tOlX/qbbvsQP81rXcrkdyouy77L4Ke0Pk7ePjQvNMbtGht2xTHNL8qgRsNJ S2+FlLarzKqInPCv7yocqJvHIqueuyte9VVrdY+5O4WPxadKv/U23fYhOFDhaaqObw1aVoqLuiph tu6f5kC1QfiGGKniZBBEyOKNqMYxjURrWomyIiJ4IiH7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/AOxV9a6JK9nPCjaz uaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3Vu ydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIrqlppiesWnt+0yzig73 ZMho30dVGi7ObvsrZGL+9ex6Ne1fU5qL6iiODLUvLLVLf+EzWSvWfUHSlscNLXSc3+z9gXZKO4MV 3Vyo1WxydVVHcvMquV22oTMvGXpXlqw2Die0Zou11K0nV9ZHSNerW3yyrutbbZEb1fzM5nMTqqO5 kanM9FQNNAh2kGquI63abWDVLBq9tVZ7/SNqYuqc8L/wZIZE9Ukb0cxyepzVJiAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfxVRqK5d+ib9E3Oux7JMfy20QX/ABa+UF3ttUirDV0N QyeGTZdl2exVRdlRUX5FTYDM/kuPiJ6Zfpr9cVpqoyn5Lt7I+BHTSSRyNa1L0rnKuyInnit6qabs GRWHKrXHfMZvNFdbdM+RkVXRztmhkVj1Y/le1Va7Z7XNXZfFqp6gOxAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8A BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB 3/2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAGNLK73FXE+7FJ3pS6Ma6XJ09oe9/LBj2VORVkpkTwjhqkRFYngjkREREY5V2WV/r xoxi3EBpXfdLMtR0dLd4P7HrI2os1BVMXmhqYt/B8b0R3im6btXo5SteDjWnKs0x69aNaxOWHVfS upbZsjbI9FdcoeXemucfrcyePZVd/C3XZEc1ANFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAB46cdUetPAdxQTasaCZdccdxnUx8l5dRxbSW+S4tVErIJqd6LE/dzmyoqt3RJ1Ripy7n sWZ846uHOLiY4dsgwqhpGSZJbG+ecdeqJzJXwtcqRIvqSViviX1J2iL+9QDxl0MyniH4jZtPeC3H M9ulDhclXNTrbqHaGFlLLPLVVdRU8mzqhGI+V6NkVW+i1ERFXr/oFw7ErDgWJ2fCcWoGUVnsNDBb qGnb4RwRMRjE39a7Im6+Krup53+Rx4aZMTw298ReV2x0N0yV0lmsTJo+V8NBDJtUSoi9UWSdnJ8q JAvqcelAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq 3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAA AAAAAAAAAAAAKd1ytNvvmX4Na7pT9vSz+c+0j53N32iicnVqoviiesuIqjVz/d/gP6V/1EZS4QiK rGU7M6f7oVsXGdqYnfHzhFvaowD+IP8ASp/2x7VGAfxB/pU/7ZLQUuSYfoR3Q5/FUboRL2qMA/iD /Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HF UboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2 S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7V GAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qM A/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6E d0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU/wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2x7VGAfxB/pU /wC2S0DkmH6Ed0HFUboRL2qMA/iD/Sp/2zOnFRolSaeVln4ntMMYmq6/C92ZTZoJpFderAqos6bq 7dJIURZGrv4IqrvytQ1u5Fc1Wo5WqqbI5Nt0/P16GA+LnHvKI4JDX37TnVuszLClY9Zae22Ohhud HErVR3axxwc0zdvF8ar61VjEQktYWzE6qaY90JLVqjS1RBxLcR2kVgvujuKaUuiqvZteLNfLpWQ1 cruysjqpnwCojlVr5tnNcn4TWseipu5DaHtUYB/EH+lT/tn+eGGuq6K5R3Bm0dTTTpM1ORGox7Xc 34KbIib+pNj/AEhW2vp7rbqW6UiqsFZAyoiVVTqx7Ucngqp4KngptdwOHoiIiiO6El7D27cRERHc jftUYB/EH+lT/tj2qMA/iD/Sp/2yWgh5Jh+hHdCvxVG6ES9qjAP4g/0qf9se1RgH8Qf6VP8AtktA 5Jh+hHdBxVG6HY6Af2o7D/hX9ZlLCK90A/tR2H/Cv6zKWEdDA/stv+WPlDp4f2NHZHyAAWkwAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAZP1q1qz7WzPq7hZ4Wrr3S4Um0eeZ5GnPTYvTO3R1NTuTpJXP RHIiIvodeqORzomtWtWfa2Z9XcLPC1de6XCk2jzzPI056bF6Z26OpqdydJK56I5ERF9Dr1RyOdFe uiuiuA6BYDQ6dadWrulvpN5J55F56muqXbdpU1EnjJK9U3VV8OiIiNREQMtWuky7ycF0paKsul7z Dhyu0zI5q2qVam44VXSKiOlk5UTtKKWRVc7ZPQc5dk5l2l2rarrbL7bKS9WW4U9fb6+FlTS1VNKk kU8T0RzXsc3dHNVFRUVOiooutqtl9tlXZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUUxp /wBk3k78m/8ArG+8NV9rf7+oqsBqpn/zukt73u/OrFX+F+7BtYHEtV1tl9tlJerLcKevt9fCyppa qmlSSKeJ6I5r2ObujmqioqKnRUU5YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/9ir610SV7OeFG 1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNu rdk6pv4F4AAAAAAAAAAAAAAAAACqNXP93+A/pX/URlrlUauf7v8AAf0r/qIynj/Y++n+6FbF+ynt j5w+gAIFMAAAAAAAAAAAA+dRUQUkElVVTRwwwsWSSSRyNaxqJurlVeiIidVVQPoDr7BkNgyuz02Q 4tfLfebVWtV9NXW+pZUU8zUVWqrJGKrXIioqdF8UU7AAAAAAAAAAAAAAAAADM/EtwD6M8Q7am/Q0 jcSzGVFcl7tsDdqh+3RaqDdGzfndu2Toic+ybF8ae2K54vgONYze6qGpuNos9HQ1c8Kqscs0ULGP e1VRF5Vc1VTdEXZfAkANpqmYylmapmMpAAasAAA7HQD+1HYf8K/rMpYRXugH9qOw/wCFf1mUsIs4 H9lt/wAsfKF/D+xo7I+QAC0mAAAAAAAAAAAAAAAAAAAAAAAAAfxVRqbuVE67dT+gAAAMn61a1Z9r Zn1dws8LV17pcKTaPPM8jTnpsXpnbo6mp3J0krnojkREX0OvVHI50TWrWrPtbM+ruFnhauvdLhSb R55nkac9Ni9M7dHU1O5Oklc9EciIi+h16o5HOivXRXRXAdAsBodOtOrV3S30m8k88i89TXVLtu0q aiTxkleqbqq+HRERGoiIDRXRXAdAsBodOtOrV3S30m8k88i89TXVLtu0qaiTxkleqbqq+HRERGoi JOwABxLrarZfbZV2W9W+nr7fXwvpqqlqYkkinieitcx7Xbo5qoqoqL0VFOWAMU/9k3k78m/+sb7w 1X2t/v6iqwGqmf8Azukt73u/OrFX+F+7bLtV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2Obujm qioqKnRUUXW1Wy+2yrst6t9PX2+vhfTVVLUxJJFPE9Fa5j2u3RzVRVRUXoqKY0/7JvJ35N/9Y33h qvtb/f1FVgNVM/8AndJb3vd+dWKv8L92DawOJarrbL7bKS9WW4U9fb6+FlTS1VNKkkU8T0RzXsc3 dHNVFRUVOiopywAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3 Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/ALFX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAA AAAAAAAAAFUauf7v8B/Sv+ojLXKo1c/3f4D+lf8AURlPH+x99P8AdCti/ZT2x84fQAECmEI1r1Xs Wh+lmRaqZHBLPRWClSbu8Tka+ole9scUSKvRFfI9jd+u3Nv6iblF8bmmOSau8MmZ4Zh9I+svT4ae uo6VnV1Q6mqI5nRNT1ucyNyNT1uVqG1MRMxmzTETVESjbdU+MjFqCxZ5m2keH3rG7rUUza+w4otf PfrTBOqbSO50WKoWJFTtGsa3rvsu27k7fMdbtWMn1tu+hOgFhxZ1diVvpq/Jb7k7qh9HSPqW80FN HDTq18kjmKj91ejUTdPFOsfdx4YZf7JZLPpXiV3y7Uu7zU1LLhrqWqoJrdK5USodVzvgcyGOL0t3 bORdk/e7uToo8us/C9xa6qZXqy6ptGHarUVmr7TkLqSWWjiqqKB8MtJLJG13ZvVXue3m2TlROu6o b5b41pNHfGtPdONf9QKjMs60Z1axuxW7PMPsiZDSVNnlmktl2oHN2SaNku0sfJIrWOarl6quy9Ny t8X4meKXNeGZOJWx4jpzS221WyruVfb61lb29yipHSd5kpuSXanaiRvRiSLKrlYrl5UciH0warXW niO1J4jMVoK5MFt2nTsNtV0qaSSmZd6hZe8yywNkRrnRsVqs5ttlVU23OLo1/wBysuH/AJuso/8A hrjOURzbmcojm3O6y/id1+tuidNxSWPBsNhwHsaW4y4/Xy1L73Lb5ZWR9s2oY5IGOXn52sVj9mKi qvNuwlurXELqHjms2mOmOmeNWS8Raj2ivrIX3FZYnQSRRtkZK+RjtmxNjV73tRjnO5Ua1Wqu6Vxq Z/3Kyj/83Vh/+GlO0vPxteGT/kTef6iwZRu3mUbt7taXXriStut9Xw237E8DuGVXCzRZDZr7Qd7p 7XT2/tJI5ZKuB73zOej4+RrY3pzOc3dWoqqnfad64aiXbI9WdIdXbBi78lwG2Q3KKqs8c/m26UdT TvkYjoZnOe1W8qNeivVF5lRPDderqP8AulVL/wCZRf1286K3fG+4i/8AkBav6s8ZRu5mMonm5lT6 q5/qLl/BPo7kuI2bA8WtOSZFb6evtFutU1PTRVLbkr6VKeNkvLHAkkCulau7nKqK1W9Te+GszKPG qFmoNTZajIEa7vslmglho3O515eyZK970Tl5d+Zy9d/V0PPy4R1EPk09HcgSkqJqLHsktl2uL4IX SLBSRXGo55Va1FXZOZv+U39gmd4nqZilBnGDXhl0sdzSRaSrZFJGkqMkdG5UbI1rk2exydU67bp0 2UxXs98lez3y78y9i+uHEjrZfc3m0Ttel9ssmGZDV453XJ5a6W41c9MqI6V6U7mtp2PVfR5muXov yddQmFNRsg4J8rzC/XfVy25Lo5qfQVs9NNV0PfqC6VKNdtHVQyUjXQ1SSIjXNds9y9PVsq4ojNrR GfMuzO+JHM9OtGMZyjKtJ5qLUfLrtBjVrxJ1wjeyS6TSOYxVnZuiQK1nab7b7Oa1dlXdOnv2tfET ojd8Xuev9g0+r8OyW709iqLhij62OezVVQqpE+ZtSrkmh5k5Vc3kVPHbwa6gc0w7WDVHhT0w1A1U xrJ8r9hGarcrjRyRy016ueMdo5neHNiVsqT9nyru1Udyemq+LlkFvx/yfmdZFjmK6aYDl+oV0ulx gbJSUF5v7mWqNF5lq6tamoZHEyNUTdHLzfI1TfRiEkU0xzL1zTWzVvJ9Z7zodw+WHE5LhiFvpa/J b1lElQtHSvqW81PSxw06o98jmenzK5Gom6eKdemyPiI1vwzQfVDLc30voLFm2nPI2GZ8VRNYr0x7 m8tRSvVY5Hs2VyOZzbsXl3XdVakXXNLLwscWmqmW6tLWWnDNVaKzV9pyHuU09JHVUUD4ZaSV8TXc j1V7nNRUROVG/KhxtdNbqzXLhM1xv1rwautWG0FJFSY7e610kb7+ztGLNOymkjY6KJruVGuVXc+6 /gq1WmIp1xq1amIp1xq1ak/ouIXUfEdG79xG6yWHHLbhjbLTXSw2m2OnW6yLMrWwtqnSL2THSrJF sxiL2fPs5XK1Tosj1p4vNOtPm64Z5p3p3UYpTQRXG7Y7a6msbe7fQvVFc7t5F7CWSNrt3tRjU9F2 y+s5vENpdkWr/As/CMPpHVV5fjdnraKlZ+FUOpuwmWJqetzmRua1PW5WlEMk8n7d8SpaWn04zq+Z nXQxU0+CU12yN10Srfs2SnfHJUJG1Gqrt3OcjFRq7Ku6IKYideRTETryT7XbKdXco4q+H+p0wv8A hnmy9W693fFn3Ohq5I1R9rasz6xI5WrIixPXsuz5OVXLzcxtCnSoSniSrWNZ+RvarGioxX7deVF6 om/huY417q8P0H124YsvvNFVY3gGJWy+WN08jJatlsR9tjgpYJXs7Ryu8Goqq5V5XLuqIqmxKCup bpQU1zoZe0pquFk8L+VW8zHNRzV2VEVN0VOipua17Ia17I/znQ/UrWLDdJ/NyZbFf3+dO27v5qsF bctuy5Obn7rFJ2f7o3bm2367b7Lt1GC8RenGouRw4tjkGVtrqhkkjFuGKXOhh2Y1XLvNPAyNF2To iu3VeidTt9SrdrNX+bvajynE7N2fbecPP1onru135Oy7Lsp4uTbaTm35t927bbLv1GC2fiQo8jhn 1HzrALnY0ZIk1NaMeq6Spc/lXkVsklVI1ER2yqitXdPkNcoyaxEZI5xl69Xfh20Prs3xqip6q/1t bT2e0MqGq6JtTNzLzuaipzcrGSORPWqIi9Nyq8O1U4lNFuIvBdHOITPrLm9r1Lt9Q+jrqO0xUMls r4Wq5YU7JrUlj35WbuTde0avo8qosh8o9pxlWonDi+bDbVUXO44rfKPIu5U8avlmiibLHJytTq7l bMr1ROuzFKsp9R7TxmcXuj+VaWWe9OxrTWjrLnf7jWUL6eOlqZWpy0qq5NnSI+ONuyePM5U3RqqS UxGj3pKIiae/9G9wAQoQAAdjoB/ajsP+Ff1mUsIx7iXAVwna049Samal6U+eckvPad9rfPtyp+17 J7oY/g4ahkbdo4mN9Fqb7bruqqq9x71xwJ/MZ9Jrx97LOB/Zbf8ALHyhfw/saOyPk1UDKvvXHAn8 xn0mvH3se9ccCfzGfSa8fey0maqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+k14 +9j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+k14+9gaqBlX3rjgT+Yz6TXj72PeuOB P5jPpNePvYGqgZV9644E/mM+k14+9j3rjgT+Yz6TXj72BqoGVfeuOBP5jPpNePvY9644E/mM+k14 +9gaqBlX3rjgT+Yz6TXj72PeuOBP5jPpNePvYGqgZV9644E/mM+k14+9j3rjgT+Yz6TXj72BqoGV feuOBP5jPpNePvY9644E/mM+k14+9gaYyTHrRluP3LFr/SJVW270ktDVwqqp2kMjFY9u6dU3RV6p 1Q8houOvig4Dtab/AKCas1MmpmM47W9lRuvMysuMlveiPp54axEVXc0TmKrZEkRF3Yit2U2+/wAl 3wIxsdJJoejWtRVc5cnvCIifKv8AZZ5HZRoZNxG8Q+U45wW6O18mF0Nf3G3LT1M89KyGNEZ3qerq pHJGkrmukaj3p6LmtRN06h7N8OfHVw7cTEUFDhWYMtmSSN3fjt55aWvR23VI0VVZOn54nO2TxRPA iOtWtWfa2Z9XcLPC1de6XCk2jzzPI056bF6Z26OpqdydJK56I5ERF9Dr1RyOdFQ/DT5HHDcTkosr 4i8pfkt1hc2Zlis00lPQQvTqiSVCcs0you34HZIip++Qsiktl08nBl9bV0VBUXbhyzC6d6rZo4lm rsKuMytb2srkRXz0T1Rqczt3M2RN+b91DUuiuiuA6BYDQ6dadWrulvpN5J55F56muqXbdpU1EnjJ K9U3VV8OiIiNRETOeFa4ewXi54rLhqlqNX0mCYPbcVq6anuFwlkoraktuR0vd4FVWsfLIqejG3mk e5E2Vyoa8tV1tl9tlJerLcKevt9fCyppaqmlSSKeJ6I5r2ObujmqioqKnRUU86qzhewPii47uJ7G tRLrfYrbbaDGZKalt9c6CLvstnYyGrkan7o+DZyxo70d5HcyORdgNA6CU2s2vmeR8Suo91yXC8Jb C6LBsDgr5aTvFI/wuV2jjciTSyJsscL+ZjGqi7KvpOq+hwPKNfuOLiBwm+a/awYvYsMgxmW027FM xqbbTRLVW2N03wSczERXM5vRRPSc5V3VSzOFfXDNbZlVx4TOIysamp+I0/a2q7P3bFl1mTdIq6FV /ClRqbSt3V27XO6q2RGdJw9f90L4rP8AyTDf1WgHQ6nVWs3AdW2DU1+tWU6m6PVl3prRlNtzGaOs ulnjqH8rK6nrWsa57WuVEWNybdWp1V3PH++Iaz5Vqhx44No1DrNqThmM1+ntVd6iHD8mntay1MVX MjXuRm7HKqbIqq1V2RE36HJ8pLldsz/ALRwiYbXQXPUDVC+22kitlO5JZqCihqGVEtZO1Oscbeyb 1dtunOqbo1ypGuIbS/2zfKJ6dYVT6hZnhbW6YVUrbpil0bQ3BqR1c3waTOY9OR375OXrsnUC7MV4 M6bFcntGTt4oeIi7LaK6CuSguuoE1TRVfZSI/saiJY0SSJ3LyvYq+k1VT1l/XW1Wy+2yrst6t9PX 2+vhfTVVLUxJJFPE9Fa5j2u3RzVRVRUXoqKUNhXCBUYZllqyt3FbxCX9LVVMqltl6zGKpoKvlXfs 54kpmq+NfW3mTf5TQgGKf+ybyd+Tf/WN94ar7W/39RVYDVTP/ndJb3vd+dWKv8L922XarrbL7bKS 9WW4U9fb6+FlTS1VNKkkU8T0RzXsc3dHNVFRUVOioplLXvVjLuITL7vwicOE1O96xLSaiZnJCk9D jtFIitkpIkX0Zq2RvM3k/edfBUc6LQ2j2k+I6HabWLSzBoaiOzWCn7CBamZZZZFVyufI9y/vnPc5 yoiI1FXZERNkQJkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3 VuydU38C8CmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAA AAAAAAAAAAAAAVRq5/u/wH9K/wCojLXKo1c/3f4D+lf9RGU8f7H30/3QrYv2U9sfOH0ABApgAAAA AAAAAAAAAVJl1XxZx5JXMwPHtJJ7Akidxku94uUVY5nKm/asipXsavNv+C5U22LbBmJyInJSVJXc ay1cKV+MaJNplkb2yw327LIke/pcqLSIirtvtuu25doAmc2ZnMABhgAAAAAAAAAAAAAAAAAAHY6A f2o7D/hX9ZlLCK90A/tR2H/Cv6zKWEWcD+y2/wCWPlC/h/Y0dkfIABaTAAAAAAAAAAAAAAAAAAAA AAAAOuyKwWvK7DccZvkD5rddaWSjq4mTPiWSGRqteznYqObu1VTdqovXoqHwxLDsTwKw0uLYTjds sNnom8tPQ26lZTwRp69mMRE3X1r4qvidwABxLrarZfbZV2W9W+nr7fXwvpqqlqYkkinieitcx7Xb o5qoqoqL0VFOWAMUf9k3k7sm2XzjfeGq+1v9/UVWA1Uz/wCd0lve9351Yq/wv3bTuE6c6VUOYZBr hg1vp5b1qNTUEt0vNNXyzxXKCnhRlK9jVe6JrUi22WNreZOq7r1JfdbVbL7bKuy3q309fb6+F9NV UtTEkkU8T0VrmPa7dHNVFVFReiopjP8A7JvJ3ZNsvnG+8NV9rf7+oqsBqpn/AM7pLe97vzqxV/hf uwac1B0P0u1SyHF8tzbGO+XvDKxa6xXGnraijqaKVdt+WWnkY5zF5U3jcqsdt1apAtReBnhd1Xzu 7amZ5pvUV+S3zsPOFdDkV0pO37GFkMe8cFSyNNo42N6NTw3XdVVVu21XW2X22Ul6stwp6+318LKm lqqaVJIp4nojmvY5u6OaqKioqdFRTlgVbo7wvaBaAzVVZpJpla7DW1rOzqK7nlqqyRirurFqJ3vl 5VVEVW82yqiLt0JFW6Sae3HVK3a01mP9pmdptUlko7n3udOyonvc90XZI/snbuc5eZWK7r4kwAAy frVrVn2tmfV3CzwtXXulwpNo88zyNOemxemdujqancnSSueiORERfQ69UcjnRNatas+1sz6u4WeF q690uFJtHnmeRpz02L0zt0dTU7k6SVz0RyIiL6HXqjkc6K9dFdFcB0CwGh0606tXdLfSbyTzyLz1 NdUu27SpqJPGSV6puqr4dEREaiIgNFdFcB0CwGh0606tXdLfSbyTzyLz1NdUu27SpqJPGSV6puqr 4dEREaiIk7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6 ErKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAA AAAAAAFUauf7v8B/Sv8AqIy1yqNXP93+A/pX/URlPH+x99P90K2L9lPbHzh9AAQKYAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAADsdAP7Udh/wr+sylhFe6Af2o7D/hX9ZlLCLOB/Zbf8sfKF/D +xo7I+QAC0mAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4l1tVsvtsq7LerfT19vr4X01VS1MSSRTxPR WuY9rt0c1UVUVF6KinLAGKP+ybyd2TbL5xvvDVfa3+/qKrAaqZ/87pLe97vzqxV/hfu2zLVdbZfb ZSXqy3Cnr7fXwsqaWqppUkinieiOa9jm7o5qoqKip0VFF1tVsvtsq7LerfT19vr4X01VS1MSSRTx PRWuY9rt0c1UVUVF6KimM/8Asm8ndk2y+cb7w1X2t/v6iqwGqmf/ADukt73u/OrFX+F+7BtcyfrV rVn2tmfV3CzwtXXulwpNo88zyNOemxemdujqancnSSueiORERfQ69UcjnRcfVjXvL+ITLpOHDhEy KBXvhjkzPUSkck1FjtDKm6RUsjV5Za2Ru/Lyr6HXqio50V+6K6K4DoFgNDp1p1au6W+k3knnkXnq a6pdt2lTUSeMkr1TdVXw6IiI1ERAaK6K4DoFgNDp1p1au6W+k3knnkXnqa6pdt2lTUSeMkr1TdVX w6IiI1ERJ2AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7 mRenhspcpFMitemVXneI3PKYMffmFB3/ANir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAA AAAAAAAAACPZbgGI5z3T2U2nvvcu07D4eWLk5+Xm/Ac3ffkb47+BIQaV0U3KdGuM43S1qpiuMqoz hXvtAaSf3Jf6fU/aD2gNJP7kv9PqftCwgQchwv5dPdHkj5PZ6Ed0K99oDST+5L/T6n7Qe0BpJ/cl /p9T9oWEByHC/l090eRyez0I7oV77QGkn9yX+n1P2g9oDST+5L/T6n7QsIDkOF/Lp7o8jk9noR3Q r32gNJP7kv8AT6n7Qe0BpJ/cl/p9T9oWEByHC/l090eRyez0I7oV77QGkn9yX+n1P2g9oDST+5L/ AE+p+0LCA5Dhfy6e6PI5PZ6Ed0K99oDST+5L/T6n7Qe0BpJ/cl/p9T9oWEByHC/l090eRyez0I7o V77QGkn9yX+n1P2g9oDST+5L/T6n7QsIDkOF/Lp7o8jk9noR3Qr32gNJP7kv9PqftB7QGkn9yX+n 1P2hYQHIcL+XT3R5HJ7PQjuhXvtAaSf3Jf6fU/aD2gNJP7kv9PqftCwgOQ4X8unujyOT2ehHdCvf aA0k/uS/0+p+0HtAaSf3Jf6fU/aFhAchwv5dPdHkcns9CO6Fe+0BpJ/cl/p9T9oPaA0k/uS/0+p+ 0LCA5Dhfy6e6PI5PZ6Ed0K99oDST+5L/AE+p+0HtAaSf3Jf6fU/aFhAchwv5dPdHkcns9CO6Fe+0 BpJ/cl/p9T9oPaA0k/uS/wBPqftCwgOQ4X8unujyOT2ehHdCvfaA0k/uS/0+p+0HtAaSf3Jf6fU/ aFhAchwv5dPdHkcns9CO6Fe+0BpJ/cl/p9T9oPaA0k/uS/0+p+0LCA5Dhfy6e6PI5PZ6Ed0K99oD ST+5L/T6n7Qe0BpJ/cl/p9T9oWEByHC/l090eRyez0I7oddj+P2jFrRBYrFSd1oaXm7KLtHP5eZy ud6TlVV9Jyr1X1nYgFmmmKYimmMohLEREZQAAyyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHEutq tl9tlXZb1b6evt9fC+mqqWpiSSKeJ6K1zHtdujmqiqiovRUU5YAyV5K21Wy38DuAVtDb6enqLnNe KmtliiRr6mVt0qomvkVOrnJHHGxFXrysangiGtTKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnR vLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/wCC8RmiOjVu tNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKvku PiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMVaW8b PFjrTgls1M004B/PON3ntu5Vvtp22n7XspnwyfBzQMkbtJE9vpNTfbdN0VFWV+6H47PydX1u2f7M eS4+Inpl+mv1xWmqgMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47Py dX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f 7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAM q+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47 PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u 2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6 H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47Pyd X1u2f7M1UAMq4fxb67e3tp9oprXwme117YvnbzZc/Z5R3f8A2hRuqZvgaaH/AIJvpPZ+6bpzcqoa qMq8Q/x7OEb/AB+/U8RqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7 TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8AAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAADKvEP8ezhG/x+/U8RqoyrxD/Hs4Rv8fv1PEaqAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/g vEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7 /wCxV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr 9cVpqo81eAriQ1YwHhOwbE8Z4SNQM0ttD5z7C+Wuopm0tXz3KqkdyI9yO9Bz3Rrv++YpoD3YGu34 heqv/S6P9oDVQMq+7A12/EL1V/6XR/tD3YGu34heqv8A0uj/AGgNVAyr7sDXb8QvVX/pdH+0Pdga 7fiF6q/9Lo/2gNVAyr7sDXb8QvVX/pdH+0Pdga7fiF6q/wDS6P8AaA1UDKvuwNdvxC9Vf+l0f7Q9 2Brt+IXqr/0uj/aA1UDKvuwNdvxC9Vf+l0f7Q92Brt+IXqr/ANLo/wBoDVQMq+7A12/EL1V/6XR/ tD3YGu34heqv/S6P9oDVQMq+7A12/EL1V/6XR/tD3YGu34heqv8A0uj/AGgNVAyr7sDXb8QvVX/p dH+0Pdga7fiF6q/9Lo/2gNVAyr7sDXb8QvVX/pdH+0Pdga7fiF6q/wDS6P8AaA1UDKvuwNdvxC9V f+l0f7Q92Brt+IXqr/0uj/aA1UDKvuwNdvxC9Vf+l0f7Q92Brt+IXqr/ANLo/wBoDVQMq+7A12/E L1V/6XR/tD3YGu34heqv/S6P9oDVR1+Q3OqsthuN5orPV3aegpZamOgpOXt6pWNV3ZRcyo1ZHbcr UcqIrlTdUTqmZfdga7fiF6q/9Lo/2h7sDXb8QvVX/pdH+0BaehfFHobxG2xa3SvOqO4VkLOertM/ 9j3Gj9S9rTP2eiIvTnRFYqp0cpa5/nR4s6+54lxSZLluL4bkmld2q6yO+NtM9YyOutVXOxJHuZJT u+DR7nOlYicqtbIiImyIq604LfKc8TV2yS3aW5jpxddYo5OVjamz0yNvVNEioiySOREhmY1Nt3S9 mvVVfKBtDyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAA6bMskTDcSvOWLYbxe0s9DNXebb PS95rqzs2K7saeLdO0ldts1u6bqqJudyVVxW3m8Y7wy6q3/H7rWWy527D7tVUdbRzuhnppmUsjmS RyMVHMc1URUcioqKm6AWBid/TK8Ws2UpZrpaEvFvp7h5uutP3eto+1ja/saiLdezmZzcr2bryuRU 3XY7UwlX6naq5/YeE/h2xrUi+Y9WanYRS5Bl+U0s/Pd3UlNa4ZXtinlRytmnk5+aZd3ovKu6orkX v8shzrhG160epLNrDneZYPqfe5MUvNpzC7uustLVyMRaWppaiRO0j9NV52bq1UTw6pyhqDENREy7 KcsxZMIyyzLidXDSLcbvbe70V17Riv7Shl5l7eNu3K52zdnKiEuMIy6jahd24719nmRouH0L346q XSdFs7ktFRIi0npf2OvO1rvg+X0kRfE4lRguq9y4FaTiPuvEdqbT59bdPYcsopKC/wAkFva2GibP FFNSpuypV8TG9rJNzvfI97t0RUagb5BgbiD4ur/Bplw22a6amJprHrPZ6e+ZdllJEnbWyiZQ0888 dN6Luzkmkn5GPRqqzZOnUjOO8S+m+mWveltp0M4tcq1Vx3Or9Fi+R47k91nuktK+pVGU1dTTzxtf FyyqiPYiq1UcnRPFA9HwYa03sGpmuHFfr9h981v1AsmF4NkFpqaO32W+S08kk81LzNgSR3N2VK1I pHPhj5UkdK1Xb8uy7lAAr7iCuepdl0Sza66OUC1ma0tlqZbJC2JJXuqUZ0Vka7o96JurWKio5yNT Zd9jFOjuRYRqDSY9Fp9x+alWLWaOSjfcrDn1zkfSzVu7VqqJ1pqWxMei/CNY2nfu30VRy7bgei4M FcTXElYZ+K1+g2ovEFd9IdPsWx2C6XGrsdTJSXG93SoVHR07aqNjpIYWRORy8myqvMir1arfpwvc SmO0vEzc9D8K4g7tq5p3dMVlyG2XK91D6u5Wevp5Np6R9Q9jHzRui+ERXbqmzUT98rg3iDCugmGa tcZGklRxJXviO1Jw275XW3N+KWjHLulHabPTU9TLT07JqZrFSqXnhcr3SKquauybL1PrxH3biZx5 3DBg1y1SbaM6yTIamw5Jc8cnmZQ1aPgSNapYHNYyZzGO7ZrJI+zSVOjeUDcoMJ8VWotRwx0Wk/Dz S8QGW4/as7u1xq8kz+/3BbjeKK206MfJFFO6NeR8rpUjjcjF7PZERNiGY7xL6b6Za96W2nQzi1yr VXHc6v0WL5HjuT3We6S0r6lUZTV1NPPG18XLKqI9iKrVRydE8UDflm1Dw7IczyTT6z3ptTkGIx0M t6o0hkatI2sY99Nu9WoxyvbE9dmuVURE5tt03kZg/hX0io6fjj4i652oOoFQ7ELljb4WVGT1Ukdx Sot06q2vartqtsfhE2TdI0REbshvAAAAAAAAADKvEP8AHs4Rv8fv1PEaqMq8Q/x7OEb/AB+/U8Rq oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1 tv8AgvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAB1eU3iqx7G7pfKGyVl5qqCklqILdRoiz1krWqrIWb9Ec92zUVdmpvuqoiKp2gA8xdOPJTZnrDq Bdtb+MzNezumSXCS61eN2CdHvR8juZIpqtd2sY1NmJHCjtmI1Gyt2PQrS/R/TDRbG2YlpXg9qxq1 s2V0VDByvmcibI+WRd3zP26c8jnO/OTAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAA Kd4xlROE7WHf+4i8/wBUkLiKz190GsfENhzMEyfNMwsNnklV1fDjtxZSecoVaqOpqlXRv54V33Vq bKu3iBmy26N6lXfSfhS4i9Fbfbrvl2muD2ynnsFfWJSR3q2VlpgjmhZOqK2KVvVWK5OXdyqv4KIs sqtPdfOJHXDTbONW9LKbTLC9LK6a+wW2e/010uF4ujmI2B29LvFDFEqc3VyuXqm3Xduosbx60Ylj trxTH6NtJa7LRQW+hp2qqpDTwsSONiKvVURrUTr8h2IGM38PurywcZrExH0tWKN8WIJ3+l/2Sctr ngRP3T4H4V7W/Dcnjv4bqWLLpTnzvJ/pok2w75p7UrcY82d6h/7ZpaUp+w7bn7L919Hn5+T1823U 0OAMaX7hq1jo9KuGnPsDtlsbqnoTZKOkqbBca1kcFwhlt0NNcKLvMfOxsnwatZJu5nVy79UUtHDM 24uM71BsiX/RSx6YYXQJLLfH3W/U95uFyVWKkcNK2jcjIUR2yrJI5d0/e9NlvoAZ44etKc+wbiF4 hs5ymw9ysmc3qz1dgqu9Qyd8igpHxyu5GPc+Plc5E2ka1V9W6Ghz41lO6rpJ6RtTNTrNG6NJoVRJ I1VNuZqqiojk33TdF6lBe5LyD8cTiC/+/wBbP/4eBbOqNLqLW6fXyn0kutqt2YOpVWz1F1gdNSNn RUVGytb15XIit3Tfl5ubZ22y5B1/wfib4rtPk0ryrhAxrEb5Vy0rfZ1XZbQVsNnWOZj5KikZC1av dyNc1Gej0eqOVeu+jNOdALvp/lEOS1nEVq5l8cMUka2vI7rQz0UiubtzOZDSRPVzfFNnp18UUtwD Kue6Q616VcRMHElopjNJqEy94vBi+WY7V3WK21tS+nc1YK+nnlTslfs1GuY9W9EXbfm3ZZGkl74k 81yq9XnWDT3HsEw51AyktmOpcWXS6y1POqyVE9TCqQMjVi8qRNR679eZNvSuIAYm0qw/jB4TMGum gOmWidn1Fx2ir66XDcmdlNNb2UFNVSvlayuppk7R7o5JHud2W6O32TbxJBmmhfELe7pww3DL7tFn d+wLJJ7rm1+i7pRRxpJEvpRxJ2XOxiqkbezj51axHOaiqprkAZ34qNFdRMvyvTPXTRiO2VmcaUXK rqaa03Go7tBd6CsiSKrpe22VIpFY1EY5ycqcztznYZm3FxneoNkS/wCilj0wwugSWW+Put+p7zcL kqsVI4aVtG5GQojtlWSRy7p+96bLfQAytguAa4aU8ZmqeY2/S+HIcB1clsNQ7IIr7TU77KtFSPhk bLSyfCzKrnqqdmm2yN69VRuqQAAAAAAAAAMq8Q/x7OEb/H79TxGqjKvEP8ezhG/x+/U8RqoAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAIpkVr0yq87xG55TBj78woO/wDsVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9Bt XbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAy r5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKv kuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAy rxD/AB7OEb/H79TxGqjKvEP8ezhG/wAfv1PEaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjV TI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd 4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjKvkuPiJ6Zfpr9cVpq oAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwBwuXTjs4a9CcZ0U9wn7I/Y533/ZP2z7PR9v3 isnqf3HaTl5e35fw135d+m+yWr7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/sz VQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7 ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J 1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/ sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofj s/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW 7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szV QAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/szVQAxVQ0PFjrTxY6Iamal8LHta43pr7Je+1vs4tt57X zhbVhj+Dh5JG7SRMb6LX79puvKjVVdqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3n C3x08HYsRqo/02rzbq3ZOqb+BeBTWqGtt/wXiM0R0at1pt9RbNT/AGS+caqZH9vTebaBlRF2Ozkb 6TnqjuZF6eGylygAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01 UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAARTIrXplV53iNzymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR +rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAABjXySd0r7hwW49SVk/aRWy8XWlpW8rU7OJal0qt3RN19OWRd13X0tvBERNlGKvJDf E2tv/KC6f6xptUAAAAAAAAAAAAAAAAACCa1a1YDoFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr 1TZETw6qqo1FVILw1cVVl1786YtkOJ3LAtRMf2ku2IXjdtXDTP2dDUx8zWrJE5jmbqjU5XLsqbK1 XBeoAAAAAAAAAAAAAAAAAAAxVpbxs8WOtOCWzUzTTgH8843ee27lW+2nbafteymfDJ8HNAyRu0kT 2+k1N9t03RUVZX7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J 1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/ sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofj s/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW 7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swN VAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7o fjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1 fW7Z/sx7ofjs/J1fW7Z/swNVAyrh/Fvrt7e2n2imtfCZ7XXti+dvNlz9nlHd/wDaFG6pm+Bpof8A gm+k9n7punNyqhqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAKa1Q1tv8AgvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9 UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAMVeSG+Jtbf+UF0/1jTapiryQ3xNrb/wAoLp/rGm1QAAAAAAAAAAAAAAQT WrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieHVVVGoqo1q1qwHQLAa7UXUW690t9 JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqUVororn2tmfUPFNxS2rulwpN5MDwOReemxemdsra moavSSueiNVVVPQ6dEcjWxA0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqno dOiORrYp3xK8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5r71AFFcNXEr 7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9SiuJXhq9t7zXqLp1fvYfq1 h+82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXNe4auJX23vOmnWoth9h+rWH7Q5LjUzvHwRKykVVX taWTdFa5FXl5kRVVFa54XqAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyrxD/AB7OEb/H79TxGqjKvEP8ezhG/wAfv1PE aqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtU Nbb/AILxGaI6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAMVeSG+Jtbf+UF0/wBY02qYq8kN8Ta2/wDKC6f6xptUAAAAAAAHW5LXXi2Y9crlj9mb d7nSUks9Jb3VCQJVytaqth7RUVGK9URvMqKib7qgHZAoDh844uH7iNe2z4rlK2bKmqsdRjF9alHc o5G9HMYxy8s2you/ZucqbekjfAv8AQTWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqb IieHVVVGoqo1q1qwHQLAa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqUVororn2t mfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxA0V0Vz7WzPqHim4pbV3S4Um 8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYtYAzBWceuLuzbLsGxTh61vzGowi8TWO7VuOY1T VtIypicqKjXJVI7Zdt05moqp6gNPgpnRri00k1ryOtwS0vvuNZpbou8VWK5TapLXdY4v4aQydHtT 18jnbdFXZFRV5GtHFDpxonfrThV0t+S5PmF8gdV2/GMVtL7lc56dqq10/ZNVGsjRUVOZ7movK7bf ldsFvFFcSvDV7b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy8yqiKiua/g4VxracZJqB aNL8ywPUXTPIsiVzLJTZvj/m+O6SN8Y4JmSSRuf1RNlcm6qjU3cqIugwKK4auJX23vOmnWoth9h+ rWH7Q5LjUzvHwRKykVVXtaWTdFa5FXl5kRVVFa596lFcSvDV7b3mvUXTq/ew/VrD95sayWFvj4qt HVoiL2tLJuqOaqLy8yqiKiua9w1cSvtvedNOtRbD7D9WsP2hyXGpnePgiVlIqqva0sm6K1yKvLzI iqqK1zwvUAAAAAAAAA63Ja68WzHrlcsfszbvc6SklnpLe6oSBKuVrVVsPaKioxXqiN5lRUTfdUA7 IFAcPnHFw/cRr22fFcpWzZU1VjqMYvrUo7lHI3o5jGOXlm2VF37NzlTb0kb4F/gZV8lx8RPTL9Nf ritNVGVfJcfET0y/TX64rTVQAAAAAAAAAArvJNccTxfWnD9Crhb7tJf82oK+42+phiiWjijpGc0i SvWRHtcqfgo1jkX1qgFiAAAAAAAAAAAAAAAAAAAAAAI5ftQ8OxnLcYwW+XptNfcykq4rHR9jI9at 1LAs8+zmtVrEZGiu3erUXoibqqISMAAAAAAyrxD/AB7OEb/H79TxGqjKvEP8ezhG/wAfv1PEaqAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAACKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9 BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA A8wPJ96k8WOmPD6mE6ecHPs+tttyC5wzXf2wrbav7KbKjZoewma53oObtzoqtd4oaV90Px2fk6vr ds/2Y8m//aJyD/zgZJ/XHGqgMq+6H47PydX1u2f7Me6H47PydX1u2f7M1UAMq+6H47PydX1u2f7M e6H47PydX1u2f7M1UAMq+6H47PydX1u2f7Me6H47PydX1u2f7M1Udbktdd7Zj1yuNgsrrxdKaklk ore2ZkK1U6NVY4u0eqNYjnbJzKuyb7r4Af53eNNL7ScTuX3S+aXM0zv1fVQ3S4Y9T5DT3fuVZNGy V8iVFMjWosjndty+LVkX1bbai4CuNXjnul+pdPsfwq560Y/TOZFOlxkWKe3R+pVuj/RYm3gk6v32 2bsaE0m8k/acgzK46xcXuZLmmU36vlutdZrTJJT25s8r1e5sk3SWVqKuyNZ2bWoiN9JDe2JYdieB WGlxbCcbtlhs9E3lp6G3UrKeCNPXsxiIm6+tfFV8QMW8Oe3EjxMZZmvEwvcNQ9Mq51PjOmdX1pse o15Vbc2Kvo1ssiq3+yGorW7NcmyLFy7qKJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZ N1RzVReXmVURUVzXOGniW9t/zpp3qJYfYfq1h+0OTYzM7bfwRKykVVXtaWTdFa5FXl5kRVVFa54X sZA4Ff7bfFP/AOdWs/6nGvzDOmls4tuHzVjW25Y5wmVOc2bPs3q8gtlwize0W5Fp3K5GbxyyOenM iovpI1U8FQDvvKGUFJjN70C1jsMTKfMrNqlaLJR1UacstRQ1aTd4pHKnVzHpGiKi9ERz0TbmU7zW /R/X7D+I+m4rOHez49l9bU4umKX7FLzW9ykqKds/bMkpKlfQjerkYio9UROXfZ3N6PEx7RriB4hN acT1j4ncfsuEYzp1UuuOL4Lbbmlymfc1ROWsrapiJG5Y9mqxGetPBqc3aSjVCi4vtPdZKzUrSGkt 2p+DXqggpqrBrjd47VUWupiTbt6KoexY1a/q56SLvzOVPBGq0IlTcV+EZLnGH4FxacMV905v895h fjFbktBT3WztuydIu7XBqcrJ93ei5Gptui8zehrwxjqTgvFNxf1eJ4VqTotZ9IsFsORUWRXWqqco p7zdK5aZXKyCmbSt7OHmVyor3O3ROqeCsds4AZR4+8S0+sWCU/EPJm3sB1IwVd8UyGkj56mtqHb8 trfCnWqimXmb2aovLzOd+D2iOvPWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieH VVVGoqpRWiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbEHAxXiV4 9bljNquNb5PXvVRU0UMss/tl2y39q9zEVXd1mYssG6rv2b1VzfBV3Q7X3Q/HZ+Tq+t2z/ZmqgBlX 3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6vrds/wBmPdD8dn5Or63bP9maqAGVfdD8 dn5Or63bP9mPdD8dn5Or63bP9maqOtyWuu9sx65XGwWV14ulNSSyUVvbMyFaqdGqscXaPVGsRztk 5lXZN918AP8AO7xppfaTidy+6XzS5mmd+r6qG6XDHqfIae79yrJo2SvkSopka1Fkc7tuXxasi+rb bUXATxq8c11v1Jp9YMLues+PU7mRVHnGRYp7bGvgq3N/osTbwSdX77bN2NCaTeSftOQZlcdYuL3M lzTKb9Xy3Wus1pkkp7c2eV6vc2SbpLK1FXZGs7NrURG+khvbEsOxPArDS4thON2yw2eiby09DbqV lPBGnr2YxETdfWviq+IGbfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAzXxA5Nlmm3E3oHmE GTXaDDsouVwwi+WxK2VKGWsqqdZLdKsHN2ay9rHI3nVObl6IppQpLjF0tyvVbQ+utunlubW5nYLn bclxqJ08cPNcKKqjla1JJFaxiuYkjEc5yInP1UCgKHV/UaTjrdmbs0vPtV1OX1OkDLQ6tk83tukV pZVdukG/Z9stW2SLn25tt036KhHtUuJzUnT+28UnEHj2TV89DY8itmm2FW+rqpJLbb6+BrI6+rSn cqxK9JJVfzcvVY0au6boTl3DbrDScE9qs9NjcVRrTbsqh1JWiWvp2pJfvO/fJI1nV/Zb9i98XNz8 vROq+vm23gzyfL+AldBMurYbLqFe3SZNX1r5Gytp8glrVrfhHxK5rkRypC5zFd6KKrebZNwz1qBx A6YaXadJqRo/5QjMsz1QsaU9ZPaL3dJ6qzX93O3vNOlC+FI4Guar+TkVrmoiJzb+kl/5Xk9Lm3HP ww5nQxOipr9gd+ucLHLurWT0bZGoq/mRyEsj1E4977Zbfh9Lw74ti+RK6CC4Zjccppq6zsa1ze2q IqGDapfztR3LG7k5Vcm7l23O41E0o1CvvGdo5qzbrG2pxfFcfvtDebi2ohjSnqKiHliakLn9q7md /Ba5E9aoBVGiuP6hcalDmms+Q8QOpWFW1uT3GyYhZ8PvCW6loaKlcjI5qhiMXvUr3bq7tF26KibI qI3n6w5txOYDp1ovw/ZFqNaodTNTMn9jtzzKyQbrHa4lV8tTFHJG1rKpYnRIq8vKjkerdlVFb9NP cK4peEmqzXT7SrRG2ao4VfsgrchxqublNNaZrR3pUV9JVx1CbyMY5N0dFuqpuvi7lZzs+4dOJbMN JNMsyyDOrHkuuOmmSplkXaxMpLZVsc5e1tTXRRt5WdlyMSVzd1cxd1RHczQ6PW+y51wYVmnuq2H6 56kZZYLjl1vxrKrHmV9dd4amiq1c1aiB0jUdBMxzd05FRqqqdERFa7l1FLqNqfx66l6USau5lYcG oMPs9znoLNd5aaTt12a1kD917q16vc+R8KNkcsbE5karkXn6hYRxH8Wl/wADxTUnRal0swTFclo8 pvktVk1Jdau7SUvMsVHTspd0ZG5zl5nyK1dtlREVvK6d4PpTn1n43NTNXrjYexxLIMStFst1w71C 7t6mB28rOyR6yt2+VzURfUqgUzoNiWqWoGsOtnD1lvEFqNPhGl12o1tVVT3x8F8qVuECysinuTU7 d0UDYncrUVFc6XdyuRqNTpbBxR6naKcInEDebxlFbl2Q6Rag3TB8cu15ck9TPF3inhppal2yds+N Z3vVXfhIxGmgNAdKc+wniR4h8+yew9ysOdXOxVFgq+9Qyd8jp6OSOZeRj1fHyvcibSNaq77punUq y08HWa5/o/xO6T59RMx1dTtS7vkuM1r6iGoa+BZYJqOpckL3KxjpIERzHcsiN5vRTdAKJzDXrTTB NLHajadeUSzLJNXrPSRXKW23K5z1NkvNU3Z09GlvdCkMUb052x8itVvo+l6z0p0xzSDUnTbE9RKW n7vDlNjoL1HDvv2bamBkyN39eyP2/mM+UefcflTilvwODh5xe1ZVHHBRVWbV+W01TZt2bJJWNook SqdzoiqkSo3ZXeK7bLqSlbUspYWVs0c1Q2NqSyRxrGx79vSc1qq5Woq7qibrt8q+IH1PNm1ahWi/ ag5rj/FxxXataOahtyKugsdspbvLY7DDa2v2pJaZyRLTVDFbtu+Z6q7p+dy+kxlC933i780XfTnU 7hLxLWKldU1LaO902RW6httbTPe5Ye8UVYjpInNYqNdyI/fZdt/FQhvFBrtqHoTobpDgl615tiXz P7tHa7zqZR29jGQ2iP05q2CJqyM7ZYpIUR6boq87mo1Vby1fcOJvSvRrPtPL7oNxk5jqfS3fJaKx ZXi+VXie6pNb6lVY6tp3zRNWCWJ/KvKxUa7mRNkaio6yLdwTawYlw0aRWnHL/ZKnVLSDJZMsttJP PJ5slZNPJJNamyuTnaxWPa1Hqn4TF/BR3M25cfz3jHzrMccoavQaxaYY5SVjajI6+85JTXqaspka qOpqKKjVOR7lVNpZVRERN+RfwVCBXKpznih4rdTNIo9WcywbBNIKC0QyQ4jcfNtbdbncIXT9pLUo 1ZEijaxzOzbsiq1F9a78DWqxcQ2hHCHrhBkOtNxv8FqhZVYPkbK6WLIqWkdJHzxVlRGyPmka7o2R iq5yOdzKibNSRZXptrvojxLZjr7ohp1RajWHU+22+DI8e89wWqtpK+hjWKCphkqPgnxrGqo5qqju Z7l9Sb9RqHprxd6w8M+tdv1Ho7f7Is6hiixHA6Cro3x2Kmjc3eJ9erY2zTSbK57nvVicicit5lag dVl+XahcMXB/kXFLe9S8oyzPMixy1SR0F2r1ms9qrKt8TI0pKXZEY2Lt05nOVXS9lu9VVylFZhr1 ppgmljtRtOvKJZlkmr1npIrlLbblc56myXmqbs6ejS3uhSGKN6c7Y+RWq30fS9ZtnVvh5qNb+ESX QG91LLRdKzG7dSsmftI2kuFK2GSPmVirzMSaFGuVqru1XbbkMo8+4/KnFLfgcHDzi9qyqOOCiqs2 r8tpqmzbs2SSsbRRIlU7nRFVIlRuyu8V22UKX1cx62688V3Clmrc0zyx0up+KXm9dlaclqaR1rTz NFO1KJzFTuyvRyNlVm3aImzj0MpYEpaaKmbLLIkLGxo+V6ve7ZNt3OXqqr619Zl/iZ031uXW7Q7X 3S7A6XP6rTtl7o7zZ47rBaXztr6RkCTRPqHKxrWrzuVquc78FE33Vyacts9ZU26lqbhQ9yqpYWPn pu1STsZFaiuZzp0dyrum6dF23A5IAAAADKvEP8ezhG/x+/U8RqoyrxD/AB7OEb/H79TxGqgAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8 RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0duboSsAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyr 5N/+0TkH/nAyT+uONVGVfJv/ANonIP8AzgZJ/XHGqgAAAAAAAAAAAFE8S3DT7b3mvUXTq/ew/VrD 95sayWFu2/iq0dWiIva0sm6o5qovLzKqIqK5rr2AFE8NPEt7b/nTTvUSw+w/VrD9ocmxmZ22/giV lIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVR eXmVURUVzXOGniW9t/zpp3qJYfYfq1h+0OTYzM7bfwRKykVVXtaWTdFa5FXl5kRVVFa54XsAABBN atasB0CwGu1F1FuvdLfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqjWrWrAdAsBrtRdRbr3S30 m0cEEac9TXVLt+zpqePxkleqbIieHVVVGoqpRWiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytq ahq9JK56I1VVU9Dp0RyNbEDRXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh 06I5Gti1gAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQAAAAAAAAAAAAAAA AAAACl804cL1mGUXDJabic1oxyOvkSRtrst3oIqKlRGonLEySie9G9N+r3dVUugAUFRcKd/o6yCr dxd6+VCQStkWGa+WxY5ERUXlciUCKrV22XZU6L4l+gAAAAAAAAAAAAAAAAAZV4h/j2cI3+P36niN VGVeIf49nCN/j9+p4jVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9 Nq826t2Tqm/gXgU1qhrbf8F4jNEdGrdabfUWzU/2S+caqZH9vTebaBlRF2Ozkb6TnqjuZF6eGyly gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAGVfJv/ANonIP8AzgZJ/XHGqjKvk3/7ROQf+cDJP6441UAAAAAA AAAAAAAACieJbhp9t7zXqLp1fvYfq1h+82NZLC3bfxVaOrREXtaWTdUc1UXl5lVEVFc117ACieGn iW9t/wA6ad6iWH2H6tYftDk2MzO238ESspFVV7Wlk3RWuRV5eZEVVRWufO9atasB0CwGu1F1Fuvd LfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqkE4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6t ERe1pZN1RzVReXmVURUVzXQXRXQDVjU/PqHiK4yYLa7J7JvDieG0L0ltePcuyPrFTmc2Wqkc3nRy q7kTl67o1IwaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT0OnRHI1sWsAAA AAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWmqjAHC5dOOzhr0JxnRT3Cfsj9jnff9k/bPs9H2/eKyep/ cdpOXl7fl/DXfl36b7Javuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKv uh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8 nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn +zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+ Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9 btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA 1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvuh+Oz8nV9btn+zHuh+Oz8nV9btn+zA1UDKvu h+Oz8nV9btn+zHuh+Oz8nV9btn+zAcQ/x7OEb/H79TxGqjFVDQ8WOtPFjohqZqXwse1rjemvsl77 W+zi23ntfOFtWGP4OHkkbtJExvotfv2m68qNVV2qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf8A2Kvr XRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LE aqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZV8m/wD2icg/84GSf1xxqoyr5N/+0TkH /nAyT+uONVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpO eqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAMY5Z5RSyaA6+XrQnidxaexU8crauxZZaonz0dZbZlVYJJ6frKxzUR0b3x9 oiyRv2Yxps4wV5XThu9tLRCDWTHaDtMi03556rs27vqLPIqd4RdvHsnI2ZFXo1iTetwFR6BeUV0L 4ZNBL1aal1blmVV+Y3+40VmtjeRiwS1bnQyzVL05I2PRN05Ue/bZeTZUU9DeH/KNSM50msOdaq2a gst+yODzp5oo2PRluppfSp4HOequdKkXI6RVRvpueiNaiIh4deTr4bvdH8R1nt96oO8YninLfr/z t3jliienY0zvUvay8rVb4rGkqp+Cf6CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACj9WdG8uzXib0G1ds8lvbY9NvZT55bN M5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/AILxGaI6NW602+otmp/sl841UyP7em820DKi LsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAV5r1qzplozpjeMv1YqovMToXUbqFY0ll uckrValJDEv7q+RN28vhturlRqKqcjWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbI ieHVVVGoqpRWiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbEEC8l nb9LMCxnONNqGwXfE9SX3qS7XzHcgi7K409tcv8Ase1iqiLPCyF6bybIvaSyKqNRzN92lFcSvDV7 b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy8yqiKiua9w1cSvtvedNOtRbD7D9WsP2hy XGpnePgiVlIqqva0sm6K1yKvLzIiqqK1zwvUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/ANir 610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdi xGqj/TavNurdk6pv4F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABD8v1k 0h0+uEVoz7VXD8arqhqOipbxfKWjlkRfBWsle1VRfzISmkr6G4UUNyoK2CppKiNJoqiGRHxyRqm6 Pa5OitVOqKnQ8lLOzSnXTMNbs90Y4PbzrPRVklSy75jmebUdEyjkckru2oIpIFdGnL6TeV3O2OOJ Pg99llvAriupevXkxdTdJ8Ryh9Jen3+4WayST1DmMig7ChqX0vMm6sZKstQxfUnbO36bgehtp100 Rv2QJiVj1jwe43x0nZJbKTIaSarV/wDB7Fsiv3/NtuSLJ8uxTCLS+/Znk9psFsicjX1t0rY6WBqr 4Iskjkai9F9Z46VWP4Jo1ppY9PeMHyfmRYvTWSamhqdSMSqWrUyzNfskkk6IsbnP9be8Ki7ryNaq N20vxu6H6la2Lojrloxi0GseC4zbIqyXF7lXqxbpTzMjkjqnI9zVmWWLlR/i/drd2ORXIgbnwzUj TvUalmrtPc9xzKKanVGyzWa6QVrI1XwRzonORFX84xbUnTrObhdrThOfY5kFdYJkp7tTWq6wVctv lVz2oydkbnLE5XRyJs9EXdjk9Snnzwn5pw5wcW9soLnw25nw9ar3C0zUdJYe2dFZLpF2cjn7xLHE quc1iuavIkbnQNVF50Tm5/ktXNbxB8WcauRHrllMqN9eyV123/60/wAoG8rJqlplk1wvlpxvUXGL rXYw57L5TUN3p55bW5rnNclSxj1WBUdHIio9E2Vjk9SnVJr/AKDuxuLMW62YEtgnq3UEV1TJKPub 6lqIroWzdpyLIiOaqsRd0RydOpgTgTmhqeIbjYngkbJFLdbi9jmrujmrXXNUVPzbFN8HPDXplq5w B6z6jZ7a5bpecadfG47JJUyNZaZaa1wVfawsa5Go6SR0aSKqLzNiY3wA9cck1Z0rw2mttZl+peKW OnvTUdbZbleaamZWoqIqLC6R6JIio5v4O/inykjqLhQUdDJdKuup4KKKJZ5KiSVrYmRom6vV6rsj duu++2x45aZ8POn2onkwMs1qzilqrxmOPwVkeP3Kpq5XOtFFR1COZSQM5uRIlc+ocqKi79sv8FvL weIPU7Pa7ybnDRhyXKsmocprK+kuaNqeyWqht9U+GkpnyL0RiNVqojvRRYWKv4KAeu2H6u6T6h1t RbcA1PxLJqujbzVFPZ71TVskKb7bvbE9ytTddupLTypyXh14nHaiaYZ/odwA27Ru6YFc4pKqttOo FoqvOdFuxHw1DEfEsiqxHtc9yuc9sj0dvum3qsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACCa1a1YD oFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FVGtWtWA6BYDXai6i3XulvpNo4II 056muqXb9nTU8fjJK9U2RE8OqqqNRVSitFdFc+1sz6h4puKW1d0uFJvJgeByLz02L0ztlbU1DV6S Vz0Rqqqp6HTojka2IGiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyN bFrAAAUVxK8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5r71AFFcNXEr7 b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9SiuJXhq9t7zXqLp1fvYfq1h +82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXNe4auJX23vOmnWoth9h+rWH7Q5LjUzvHwRKykVVXt aWTdFa5FXl5kRVVFa54XqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKa1Q1tv8AgvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIu x2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6E rAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH88ein9AGIsE8mb7W98yeyYdxG 5ZatK8xqu2vOFUlBFG+qg6p3Z1fzq9sascsbuSNj3R+irl8Ts9KvJx0OmmHaj6TO1xyOs06zp8lT RWSkomUNTZ6xXxKyqZWNe50kjWQRxqnK1j2oqOau+xsoAYfunk79XsxxGn0l1J43sxyDTWHu8T7A 3HqaComp4HtdFG+sWV7n8qsYqK9jk3a1duiFlawcFVFma4DdtINWsm0qv+m1sistjrLYve6ZKGON Y2Ry00j2tkVGK5vNzIrmvcjuZNttLADKulnA9d7JrXauILXjXy+6sZljtI+jsclTa4bZSULXte1X JBE96OciSybdUTdyqqKqNVI9dPJ3XO0a8ZRrRotxJZVprBnE0s+Q2q2W6Kd07ppO0m7Gd70bFu9X PaqxPVjnLyqidDX95vNnx201l/yC60dstlugfVVlbWTthgpoWIrnySSPVGsa1EVVcqoiIm6lbt4r +Ft7kYziU0rc5V2REzG3Kqr/APrgKp4beA608NmUar3fHtQ5bja9SY1gpLfNbHNktMSPnVjXTune tSqJPsrlaxV5d18en34d+CH2hOGPPuHH2zvPvs4kur/PPmXuvc++2+Kk27Dt39pydlz/ALo3m5tu m266Xs95s+Q2ynvVgutHc7fVs7Snq6Ods0Mrf4THsVWuT86KQ7IdftCcSvD8eyvWvA7LdYn9m+hu GSUdNUNd/BWOSRHIv5tgKZ0/4IvYLwa3/hI9s7v3nyKvi9kHmXsux7zJz7917d3Ny+H7qm/5jiz+ T40/yHhExrhTz3Kau6+xSWertuSUdG2jqIKp9RPKkjYXPkTl5ah0bmK5UcnXdq8qt0xPlmLUuNS5 nU5LaocfgpXV0t2krI20cdM1qudM6ZV5EjRqKquVdkRN9z54lmeH59ZIslwTK7Nkdone9kVwtNfF WUz3MXlcjZYnOaqoqKioi9FQDLWC8B+cQZriWUa38V+a6lW/BXtlsdnfSJbYEe1W8veXsme+pT0G b8yoruVEcqtVWrr4ilo1Z0rv+XVmn9i1LxS5ZRbu075ZKS8001fTdmqI/tKdr1kZyqqIu7U2VU3J WAAAAAAAAAAAAAAAAAAAAAAAAAAAAgmtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2 RE8OqqqNRVScyK9sbnRs53Iiq1u+26/JuYY4dkZxIcTWW5pxLP7jqDpjXvp8Y00q0/sbH6NeXkub N/RrZZFVvw7UVrfRVNkWLlCc6K6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT 0OnRHI1sWsAAMwVnHri7s2y7BsU4etb8xqMIvE1ju1bjmNU1bSMqYnKio1yVSO2XbdOZqKqeonOj XFppJrXkdbglpffcazS3Rd4qsVym1SWu6xxfw0hk6Panr5HO26KuyKirU3Ar/bb4p/8Azq1n/U44 3lDKCkxm96Bax2GJlPmVm1StFko6qNOWWooatJu8UjlTq5j0jRFReiI56JtzKBdWtHFDpxonfrTh V0t+S5PmF8gdV2/GMVtL7lc56dqq10/ZNVGsjRUVOZ7movK7bfldtGsK41tOMk1AtGl+ZYHqLpnk WRK5lkps3x/zfHdJG+McEzJJI3P6omyuTdVRqbuVEWLa36P6/YfxH03FZw72fHsvranF0xS/Ypea 3uUlRTtn7ZklJUr6Eb1cjEVHqiJy77O5vR6+m4r8IyXOMPwLi04Yr7pzf57zC/GK3JaCnutnbdk6 Rd2uDU5WT7u9FyNTbdF5m9ANeFFcSvDV7b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy 8yqiKiua+9QBRXDVxK+2950061FsPsP1aw/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXPvUyjx 94lp9YsEp+IeTNvYDqRgq74pkNJHz1NbUO35bW+FOtVFMvM3s1ReXmc78HtEdeOhOW6g53pHjGW6 p4T7EspudAye42jtObsJF8F2XqzmTZ/Zu3czm5XKqtUCegAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PT b2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em 820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA ADFfElxt6raKcYOHcP8Aimnloyq0ZRjzK2GkjjljulRcplrYqeFlQsyQxRLNBT873xO5GLK5V6Jt 12lvGzxD2fiytfC9xTaTYvjlXlNK6qslbYKiWRrWqyV8avc+WRJWuWCWLdqMVHt6t2IVr+1rvLEa Go5qKnsTYvVPWiXfY/XFQie+v8Oy7dfMcH9YuIFi6g8aGt2b8RN94a+EDTXGMgu2HQvkyG/ZRUys t9PIxWtkiayJ7Hei97Y9+ZVV/PszlYr173hd4y841D1myjhj4hNPLfh2p2MQLWIlrqHS0FwgRGOV Y0e5zmrySxyN9N3Mxyr6KtVFzpjWUr5P7jj1gzLW3HL7Hp/qrPVXW1ZNQ2+Sqp2SzVTqpInKxN0V qyyxub1eitYvKrXI4kXCza8m4l/KA5dxl2fEbzY9OKG1+bLLWXSldTvukvdYqVqsav4SK1ssiqm6 N+DavVQNfcY3xT9Yf+RF5/qkhgLgW0P4Cs24WrXknEDDgrMnlqri2uqLpky0FUyFk70jVWpUMVmz ETZdk3T5TfvGN8U/WH/kRef6pIYj8nhwM8LOuHDDYNR9UdLUveRVdwuEM1Yt6uNOj2RVL2MTs4Z2 R9Goifg9fXuBE/J9M1GrME4scE4f73davGKalrI8EqXyuY7vz0q2Uz4XLsjJpIWQK5U22ckSrt0K 74Ub55PLHsCq9MeMTTa6WXUhtbVRXe53uhr1Ved69mjFgVZKZzWK1F3Y30kVyuXfp6q3nBqjQXQq 9WThU0zxuC7WilfV2exPY6KmrahFar2yOa5r3yvY1URzn7q7k5nbGKHeUY4fsyw9uKcbHDPdGZ9R tkpq60yYjHUQyP5l5e7JVydtC7bbo5UVrvBy+IE5xXRzS7R/yfWt9JoxrfV6j4jeMZvdbSyvqYJo KCXuUiSRxpEm8blTkV7HdeZN9mqq75D0d44Lnpnwh4Twx6L3alt+ouV3atpK2+1syU1Lj9PVVrms f2rujZXI7m5/CJnpfhcu1hcLml2d4pwq8XWolVhV4w3Acwxy5SYrZbpzpKkMcFY5HIknpK1kUsMf a7fCKi9V5SY8HHB5pZxJ+TpSwXGxW625RerpcKulyNlM1aqCup5pI6d73/hPiRu7HR77cr37bOXm QNi8InCPhHClgjrRa5EvGWXnlqMjyKZvw9wqPFWtVd1bC1VXlZv61c7dyqpfRg/ye/E9l1NebjwW 8RyyUGpeBq+jtU1W/d11oom7pHzr+6SRx8r2PT90hVr+vK5y7wAAAAAAAAAAAAAAAAAAAAAAAAAA AAUTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormuvYAUTw08S3tv8A nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23vNeounV+9h+rWH7 zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXOGniW9t/zpp3qJYfYfq1h+0OTYzM7bfwRKykVVXt aWTdFa5FXl5kRVVFa54UfppbOLbh81Y1tuWOcJlTnNmz7N6vILZcIs3tFuRadyuRm8csjnpzIqL6 SNVPBUJfj2jXEDxCa04nrHxO4/ZcIxnTqpdccXwW23NLlM+5qictZW1TESNyx7NViM9aeDU5u01u AM4aoUXF9p7rJWalaQ0lu1Pwa9UEFNVYNcbvHaqi11MSbdvRVD2LGrX9XPSRd+Zyp4I1WwDUnBeK bi/q8TwrUnRaz6RYLYciosiutVU5RT3m6Vy0yuVkFM2lb2cPMrlRXuduidU8FY7ZwAEE1q1qwHQL Aa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqNatasB0CwGu1F1FuvdLfSbRwQRpz 1NdUu37Omp4/GSV6psiJ4dVVUaiqlFaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krn ojVVVT0OnRHI1sQNFdFc+1sz6h4puKW1d0uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqqp6HTojka2L WAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAEUyK16ZVed4jc8pgx9+YUHf8A2KvrXRJXs54UbWdzRy867xcvaciL6O3N0JWUfqzo 3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMVcTnGtqnotxoaT8OmLWDFKrG878w+caq4Ut S+ui77dpqOXsXsnZG3aOJqt5o3bOVVXdOiBtUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKJ 4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXXsAKJ4aeJb23/Omneo lh9h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRFVUVrn3sUTxLcNPtvea9RdOr97D9WsP3mxrJY W7b+KrR1aIi9rSybqjmqi8vMqoiormucNPEt7b/nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K 1yKvLzIiqqK1zwvYgmtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVRrV rVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLh SbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5GtiBororn2tmfUPFNxS2rulwpN5MDwOReemxemd sramoavSSueiNVVVPQ6dEcjWxawAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6b zbQMqIux2cjfSc9UdzIvTw2UuUimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9nPCjazuaOXnXeLl7T kRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5V8fX/dTe HL/FD/8ACOqPVQ8q+Pr/ALqbw5f4of8A4R1QHqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAUTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormuvYAYi4P8AFMj4 uvY7xr8QlbQXSZveIcGxakjelssXYTvp5qxY3qvaVT5YHqjnKvI1Gqi7oxI9umVfJcfET0y/TX64 rTVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAABR+rOjeXZrxN6Dau2eS3tsem3sp88tmmc2d3nC3x08HYsRqo/02rzbq3ZOq b+BeBTWqGtt/wXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPKvj6/7qbw5f4of/AIR1R6qHlXx9 f91N4cv8UP8A8I6oD1UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB/FRVRURVTdPFPUYj t/lK8a0v1iv2gHFbjr8QvlirlpoMkt0Uk1quFO7Z0FQ+L0pqdJI3Ru2TtWoqrzObsBM/JcfET0y/ TX64rTVR5QcM/lH9HuGTgv0+06prXc8x1Cp23RHWKhYsMVO+W6VckST1DmqjeZj2ORsbZHekm6Jv uem2l9Xntx0/sVz1Po6CiymupGVVzoqBjmwUcsnp93bzOcrljRUYrlX0nNc5ERFRECUgAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G 1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAABTtp1yy++W+K6WvSnt6Wfm7OTz7E3fZytXo6NF8UX1EF7E27ExFeec7omdnZE 70Vy9Rayirn6pn5LiBVHtuZ/80P9PwfsD23M/wDmh/p+D9gi5fZ6/hq8kfK7W+e6fJa4Ko9tzP8A 5of6fg/YHtuZ/wDND/T8H7A5fZ6/hq8jldrfPdPktcFUe25n/wA0P9PwfsD23M/+aH+n4P2By+z1 /DV5HK7W+e6fJa4Ko9tzP/mh/p+D9ge25n/zQ/0/B+wOX2ev4avI5Xa3z3T5LXBVHtuZ/wDND/T8 H7A9tzP/AJof6fg/YHL7PX8NXkcrtb57p8lrnlXx9f8AdTeHL/FD/wDCOqN++25n/wA0P9PwfsHm txtZdf7v5SPQS/V+IdwrqL2LdhQecGS945L9Uvb8KjURnM5Vb1Tptub28XauTlTn8NUfOG1OIt1z lHynyewAKo9tzP8A5of6fg/YHtuZ/wDND/T8H7Bpy+z1/DV5NeV2t890+S1wR7AMt9nWI0GU+b+5 d97X4Dte15OSV7Pwtm778m/gniSEs0V03KYrp2TrhPTVFcRVGyQAG7YAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAPNXyyfDd7JcJs/EjjVBzXHFuS05B2beslulk+AmX/AIKZ6tX80/Xow9KirOJvPdIt P9Fcnrtbp2Oxe50M1qnoWpz1FydOxzEpadni+Z+68qJ4bcyqiNVUDx+8lVw3e3XxCQ55f6DtsX03 7K7VHO3dk9xVV7nD+fZ7XTL+aFEX8I91DEXkt63TzCtJ7hoWyx3XFtSrLXTXXJ7LfYO73Cds7k7v VNaqJzw9h2DN0T0XJ1ROZFdt0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAxVpbxs8WOtOC WzUzTTgH8843ee27lW+2nbafteymfDJ8HNAyRu0kT2+k1N9t03RUVZX7ofjs/J1fW7Z/swNVAyr7 ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J 1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/ sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofj s/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW 7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swN VAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7o fjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyr7ofjs/J1fW7Z/sx7ofjs/J1fW7Z/swNVAyrh/Fvrt7e 2n2imtfCZ7XXti+dvNlz9nlHd/8AaFG6pm+Bpof+Cb6T2fum6c3KqGqgAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprVDW2/4LxGaI 6NW602+otmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9 a6JK9nPCjazuaOXnXeLl7TkRfR25uhKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABn/S j/cBa/8An/8AXvNAGf8ASj/cBa/+f/17znYv9oo7KvnSo4v16eyfoloANUAAAAAAAAAAAMZalcdN 84ZddbjpXr1iUlwxit5bjYMktMaNqEoZVXlbPAqo2RY3o+NzmK1do0XkcrjN3FLrNpbqNx1aE6mY bnNquGMUseNSVdx7bso6NI73USSJPz7LCrGKjnJIjVRqoq9FRTUflLOH/wBt7QuXNbJRdrkeAdpd IeRu75qBUTvcX59mtbKn/BKifhHjKW7VNNUaUbVyzTTVGlG1676q+UyxSTJqPTDhoxp2e5Xd6yO2 0ddUo+C2NqJHoxvKnSWdOZeu3I3bqj1Q2dj9LeKKxW+kyC5suN0ipo2VtWyJImTzo1Od7WJ0a1Xb qiepNk3XxPL/AMk7w/8AshzC68QGQUXNQY3zWux87eklfIz4aVP+Diejf5ZvlaeqBDdimmdGlBdi mmdGl2OgH9qOw/4V/WZSwivdAP7Udh/wr+sylhEmB/Zbf8sfKFrD+xo7I+QAC0mAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAgmtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVQ GtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVSitFdFc+1sz6h4puKW1d 0uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqqp6HTojka2Jororn2tmfUPFNxS2rulwpN5MDwOReemxe mdsramoavSSueiNVVVPQ6dEcjWxawAoriV4avbe816i6dX72H6tYfvNjWSwt8fFVo6tERe1pZN1R zVReXmVURUVzXuGriV9t7zpp1qLYfYfq1h+0OS41M7x8ESspFVV7Wlk3RWuRV5eZEVVRWufepRXE rw1e295r1F06v3sP1aw/ebGslhb4+KrR1aIi9rSybqjmqi8vMqoiormvC9QUVw1cSvtvedNOtRbD 7D9WsP2hyXGpnePgiVlIqqva0sm6K1yKvLzIiqqK1z71AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAyrxD/Hs4Rv8fv1PEaqMq8Q/x7OEb/H79TxGqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs14m9BtXbPJb22PTb2U+ eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+otmp/sl841UyP7em820D KiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGf9KP9wFr/wCf /wBe80AZ/wBKP9wFr/5//XvOdi/2ijsq+dKji/Xp7J+iWgGfMh4y8ctGo2U6Y2DRXVnMLph00EF1 mxuxU9ZTxOmj7SP0lqWuRHJzbczU3VrvkMREzsQxTNWxoMFMaX8Vmn2pebO00q8dzDCMvdTOrKex 5fZ1t1VVwN3V0kPpPZIiIirsjt9kcqIqNVU+mo/FJgen+aSabW3G8xzjLaaBlVWWbEbM64VFFC9E Vj53K5kcXMioqI5++ytXbZyb50ZzyNGc8lxgp3THil0/1KzWTTSpsOW4XmDaVa2KxZZaFt9VU06f hSQ+k5kiJsq+i7fZHKiKjVVJHgutOLag6i59plZqC6w3TTqehp7pNVRRtp5nVcb5I1gc17nOREjd zczWbKqbbiaZgmmYT8FbUuvWIXbWSo0Rxq23m+3m10qVd7rrfDE632Xm37OKqmdI1Ulft6MbGvd6 1RERypZJiYy2sTExtAAYH5liinifDNG2SORqtexybtc1eioqL4oeGfFFwu3/AEv4n59IcPtMtRS5 VXQz4pG1F2kgqpOWOLf/AMHJzRKq+qPmXop7Maw6yaf6E4RU6gakXnzfaqeRkDEZGsk1RO/fkhiY nV712cu3giNcqqiIqpQWmfE/wscTmtWJuSxX6055jMVZPjLcht7KZ1QyeHaVYVZI9r17NquajlRe iq1Oik1qqqjOctSa1VVRnVEal86G6T2TQ/SjG9L7FyuhslG2KadG7LU1Lt3TzL+d8jnu29SKieon QBFM560Mznrl2OgH9qOw/wCFf1mUsIr3QD+1HYf8K/rMpYRYwP7Lb/lj5Qv4f2NHZHyAAWkwAAAA AAAAAAAAAAAAAAAAAAAADrclrrxbMeuVyx+zNu9zpKSWekt7qhIEq5WtVWw9oqKjFeqI3mVFRN91 QpLh844uH7iNe2z4rlK2bKmqsdRjF9alHco5G9HMYxy8s2you/ZucqbekjfAC/wCCa1a1YDoFgNd qLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FVAa1a1YDoFgNdqLqLde6W+k2jggjTnqa 6pdv2dNTx+Mkr1TZETw6qqo1FVKK0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRG qqqnodOiORrYmiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbFdGG 674hnGsmoGh9pt14ivum8dslutRUQxNpJkroO3i7BzZFe5UauzuZjNl8OZOoFkAqyXiLwmfXOPh9 xy1XzI8kp6Pv97qLVBDJQ4/Cv7n36Z8rOzfJ+9jY171TZVaiKikCzXjgxfFNXcr0XsehmsGb33C0 onXaXFLBTV1NElVTsnhXmWpY9EVr9vSYnpNcibom6hpAFFaWcZOkmp2bM0wrLfleCZvNE6emxvNb LJaa6qjRFVXQo5Vjl6Iq7NertkVURURVT5a2cYGKaKanWjSGXSzUrNslvVndfKelxCzwV7kpmyvj crmvnjfuixqq7NVERU6+oD68SvDV7b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy8yqi Kiua9w1cSvtvedNOtRbD7D9WsP2hyXGpnePgiVlIqqva0sm6K1yKvLzIiqqK1z+rxXjFqcpye0Yy 7hL4iLMl2roKFbjdcNhgoqPtZEZ21RIlS5WRM5uZ7kRdmoq7L4HacSvDV7b3mvUXTq/ew/VrD95s ayWFvj4qtHVoiL2tLJuqOaqLy8yqiKiua8L1BRXDVxK+2950061FsPsP1aw/aHJcamd4+CJWUiqq 9rSyborXIq8vMiKqorXPvUAAAAAAAAAAAAAAAAAAAAAAAAAAAAB1uS114tmPXK5Y/Zm3e50lJLPS W91QkCVcrWqrYe0VFRivVEbzKiom+6oB2QKA4fOOLh+4jXts+K5StmypqrHUYxfWpR3KORvRzGMc vLNsqLv2bnKm3pI3wL/Ayr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAACu9d9 ccT4esBdqLmlvu1bbW19JblitcUUk/aVEqRsXlkkjbyo5yKq82+3gi+BYgAAAAAAAAAAAAAAAAAE cwvUPDtQ4rzNht6bcmY/eavH7i5sMkaQXClcjZ4fTa3m5XKiczd2r6lUkYAAAAABlXiH+PZwjf4/ fqeI1UZV4h/j2cI3+P36niNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/2KvrXRJXs54UbWdzRy867 xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4 F4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADP+lH+4C1/wDP/wCveaAM/wClH+4C1/8A P/695zsX+0UdlXzpUcX69PZP0S0wrp/xAaTaGcXPEi3U/Jai0rerlYFoeytNZW9r2NHL2m/dopOT btWfhbb79N9l23UUFoXpfnWG8RWvmd5JY+52PNa6xzWKq7zDJ3tlPTTMmXkY9Xx8rntT02t336b9 TNMxETmjomIic/8ANar6/MKLiu4o9I8q0gsV7lxbTJ9zuN5ymstU9DTyrURMZHSQ9u1j5HK5npJt 0R6r4Iu8iyLTziG0N1yznWTRTDLJqLj+ovcai8WGpubbdcqWopYljRYJ5EWN0ao567Luu7kRGptu 7VZnG6u4vdKNRMmuWM41RaxYTkNZ3620E18gtNysSqnpU7XTN7KSFOiNTfm6bqqLvzZirPVDMVZ6 ofjAuIjTfUPVuwYnqxopeMA1Qp4Kl2Peye1RPWRqs+Hbb61EXfdrVR23JzIiom/gZqy3VLWDTzXL irodEsGu13v1xlstTUXalp2yxWOhp6KXtqjlcqJJOqSp2UXi5WvdsqMVF0FHp9r5r5rLgGomren1 o02xrTarqLnRWyO9R3W5XGskYjW88sLUiiibyoqoiqq7bdd92yfQvS/OsO4idfM7ySx90sea11jm sVV3mGTvbKemmZMvIx6vj5XPanptbvv036m2cU/51tommnu+rveFHGtI7DotZK/Ru4uu9ovjFuVV eah3PW3Otf8Au81W5evb86Oa5q/gK3l8ELXukFdVWyrprZXpQ1k0EkdPVLCkqQSq1UbIrFVEfyrs vKqpvtsZxx7SHUnh915lumjWOeedJ8/qHVGRWGKsgp1xy4rsi11KyZ7EdE/pzxM3dsi7J6MbTR10 ttHebbV2i4xLJSV0ElNOxr3MV0b2q1yI5qo5u6KvVFRU9SkdW3NHVtzzUL7T3GB+Obbf/wBmNH95 LR0sxrUrFrDU0GqOp8GdXOSrdNBXw2GK0pDArGIkPZRyPRyo5r3c++68+23Qq/3BPCv83t0/9bbz 97LQ0t0g0+0XsVTjWnFmqLZbqurdXTRTXGqrVdM5jGK7nqZJHonLGxOVFROm+26qq5mYmP0ZqmJj 9IY98pqvnTUHh2w24N7Sz3jKZ1rYH9Y5eWegjTmTwX0J5U/kcp/PKGo3HeIjhjy2zxthuvsikplk YmzpIY6ygVka7eLfhpU2/wDCL8pc/G7w25JxB4JZKzT240tFmuF3NLtZX1LuSKZdk7SFXbKjFVWR ua5U25o0RdkVXJVVg0O4qOIfX3AtU+KDEscw6xaZu73QW22VrKl9fWI9sjXojJZUa1ZI4nO5nJ6M aNRqqquSSmYyid2aSiqMonPZm3GACBApDEtZuLHFMepLBppwX+zvG6XtO5ZB7YtttffOZ7nyf2LM xZI+SRz4/SX0uz5k6OQ7j3Q/HZ+Tq+t2z/Zl0aAf2o7D/hX9ZlLCLOB/Zbf8sfKF/D+xo7I+TKvu h+Oz8nV9btn+zHuh+Oz8nV9btn+zNVAtJmVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn 5Or63bP9mPdD8dn5Or63bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV90Px2fk6v rds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y 90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/ HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/ZnjrxppfaTi dy+6XzS5mmd+r6qG6XDHqfIae79yrJo2SvkSopka1Fkc7tuXxasi+rbb/RFktdd7Zj1yuNgsrrxd Kaklkore2ZkK1U6NVY4u0eqNYjnbJzKuyb7r4GA9JvJP2nIMyuOsXF7mS5plN+r5brXWa0ySU9ub PK9XubJN0llairsjWdm1qIjfSQDPfAVxq8c90v1Lp9j+FXPWjH6ZzIp0uMixT26P1Kt0f6LE28En V++2zdjVHDntxI8TGWZrxML3DUPTKudT4zpnV9abHqNeVW3Nir6NbLIqt/shqK1uzXJsixcu0sSw 7E8CsNLi2E43bLDZ6JvLT0NupWU8EaevZjERN19a+Kr4lQ8S3DT7b3mvUXTq/ew/VrD95sayWFu2 /iq0dWiIva0sm6o5qovLzKqIqK5rgvY8v9S9WNa9NOLzizpOH7Ti65Nl92tONSx1tNTtkgstLT2h jpqp6OVEkm2eiQw9Ve/fo7lVjtlcNPEt7b/nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K1yKv LzIiqqK1z+m0b0k1CxTjJ4gdVr/j/dcWzenxqOw1/e4H98dSUCRVCdmx6yR8r+nwjW7+Ld06gdlw R43oxa9BrPkmjN6myCnyne63rIK9ea5XS6PX+yJK1d1VJmv5mqxVVGbbIq/hOr7h6/7oXxWf+SYb +q0OypdFNUuHbiOdnXD/AIv590v1Jq1kzbFYq2npfMlwXb/ZajSeRjVa7/fImLuuy7IvwaRxR9h4 otG+MHWzVrA+GWo1CxrUOKwRW+rhzC12vk7lQMikVWTyLJ+6K9vVrfwN03RUUDs/Km2232/hnTVe j7Oly3T3IbTd8buDE2np6payKNzWOTryq1yuVu+yrG1V6tTaHcQup66WeUT05zOp0+zPKne1fVQv tWJ2h1zuCOkq5t3JC1yKrG7ek7fp0Jfd9JuJXi3zfFp+IrB7Npjphh90hvq4lTXqO73G+10O/YpU 1EKJCyBqqqq1vVd1TZVVr2TfKNJNQrjx74ZrTR4/2mGWnT+sslZc+9wJ2Va+ple2Lslf2rt2uavM jFb18QOXhXGLT5pllqxNvDFxCWNbrVMpUuN6wKWkoKXmXbtJ5lkVI409btuhoQEE1q1qwHQLAa7U XUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqBRnH3iWn1iwSn4h5M29gOpGCrvimQ0kf PU1tQ7fltb4U61UUy8zezVF5eZzvwe0R3XYrxK8etyxm1XGt8nr3qoqaKGWWf2y7Zb+1e5iKru6z MWWDdV37N6q5vgq7oc/RXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5 Gti1gBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6vrds/wBmPdD8dn5Or63bP9ma qAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfd D8dn5Or63bP9mPdD8dn5Or63bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV90Px2 fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrd s/2Y90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Z j3Q/HZ+Tq+t2z/ZmqjrclrrvbMeuVxsFldeLpTUkslFb2zMhWqnRqrHF2j1RrEc7ZOZV2TfdfAD/ ADu8aaX2k4ncvul80uZpnfq+qhulwx6nyGnu/cqyaNkr5EqKZGtRZHO7bl8WrIvq221FwE8avHNd b9SafWDC7nrPj1O5kVR5xkWKe2xr4Ktzf6LE28EnV++2zdjQmk3kn7TkGZXHWLi9zJc0ym/V8t1r rNaZJKe3Nnler3Nkm6SytRV2RrOza1ERvpIb2xLDsTwKw0uLYTjdssNnom8tPQ26lZTwRp69mMRE 3X1r4qviBm3yXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAHnzwzYZqlr9w/5tlma8RWp9BV 2bIMgocddaMknpn06QSOc2Wok3WSp2e7kSN7ljbHE1GtRVc5eNg8Os2tPAXVcUOX8QWf2zNbXi91 u1oZYLqtuoY0taTNZ3mniRG1T53Urnyuk5v3XZqMRqIXzweaP6i6WcP2T4RnmO+a71cchv8AXU1L 3uCfngqZHLC7nie5icyKnRVRU9aIdJotodqliXk46nQXIMX7pnUmF5JaW2rvtPJvV1TqxYI+2ZIs PpdtH6XPypzdVTZdgqbWji/vlXhPDZiuTasyaZUeq2NxZHm+XUMaMqqanZRxvWGkVGP7F087ntR7 W7s9DbpzIvCwXiV0+0+4kNM8U0T4q8m1YxLP6+Ww5BZMmuc1zqLbUvandKumqZ42yMasi8r2bq3b fp1RW2DNw0624zgHDZqjgNjtkupuiuOxWi7YxcbhHDFdKWeiZBVUrapnPEyVio7kfurN3Ku67Ii3 DgeZcWWdai2qbKdG7Hpjg1BDO67RXK+QXm53SZzdoWU3dHdnTtY70nOe5yuTojUApjTOxah638T3 EbhGR6059acMxS9WpLfQWS/T0czJp6NV5Y50VXwQs5HO7KJWNe+Td/Nyoh1nC7h+q2vNp1QwbUzi J1I81aW5zeMHsddZb063XOpWmlVVqq2rjTtKl6NfE1jXLyJs/ma7dOW6eHvSnPsG4g+IXOMpsPcr JnN7tFXYKrvUMnfIYKR8cruRj3Pj2cqJtIjVX1IqDhB0pz7S6s1vlzuw+bG5fq3kGT2Ve9Qzd6tl SsXYT/BPdyc3K70H8r026tQDH+qWp2oOpfktaW+5pdlv+UWfNaazOr6hNn17qW7KyF8u227lajGu XxXbdV3VVLe4o8J1j4ZNJJeKDHeJHUTIMqxOtt9Zf7TdLm19gu0M9VFDUQR29rEjp2bzJycnpNYi 9Vds9Irc+EviAr+AWu0Mgw1aXNKvPpLuylS5UTuyonXLtkqO07bsl2j9Pk5+b1bb9Cw9fcQ4uuJn AouG7JNHbNitmu9fQsynOIcnp6mjno6adkz3UVIiJUtfK6JrmtkaiN/AVVRedAiHERxQ4zfeJuDR rO+IK8aQ6b2LF6W+VtXZKl9Hcr3capGvhp0qY2PfDEyF7XKjNlVeZFVd2q3suFTiLsTuKKu0EwLi Bu2r2AXvGX3203G91D6q5Wi4wy8s1G+pexj5o3RL2iK7dW+iifvldYuomkOr+lXEfHxJaB4Vb81o b3jMOL5Lict1ittS5Kd6LTVdLPMnZKrWtaxWPVOidN+bdlj6P5BxL5dl93v+reAY/gOJNoo6e1Y+ 24sul2fVo9VfUz1UCpAyNW+ikTUeu/XmTb0gz1wE2DUzV2yVGqupGuGoFZT4nmV5ttmszL5KtJWR Mmcrn1/PzPqdll7NkauRkbYGK1N1U3KZ44GdKc+0d0euuLaj2HzRdKnLrzc4oO9Q1HNTTz80T+aF 72pzN67Ku6etENDgZ945Ml1dxTQeou2j63uGr870MV8rbFSJU3OhsrpF73UUkaovNK1vL12VWtVz unLzJVfD5cNNswz/AB28cO3HZmGUrTTPXIsRze8SXOe40aMXn7KmqmxT00rHbL2jEVibbK3boukt cpNcKXEqW66BwWCuv9uuVPU1dpvLliiutA1V7aljn8KeV27VbI5Famyoqdd0zbl+l+uvEbq7pflu QcM9n0hkwTKqTJLllc+R0FxudbTQb81uhSjRXOjlVURyyuRuzU9HxRQrXJuJzT3U3iB1TsGuXFdl Gk+MYFen4zjlgxi6T2uetmp1cyqramogjc+RFlbsxiqjURPBdlV3ZaTcbVxxTSniLgt2pXtqUmkF NS1+HZRXs+GuVNXRq2CKqVGsWV0FQiMe9Ua5+7vBNtrXtun3EFwz6zalZTpJpVSan4PqjdUyR9vh v9NarhZ7q5qpUqq1O0c0UrlRyK13M3ZE26elMajTfW3iI0M1HwPiIocdxN2bQy0titNoldWy2SDk TslqqndGVMiTNbIqRta3ZFRHelswK9x/hv4i7jpbjeq2IcWGdSasXCkoL1U09/unaYtPJMjJJ6R1 vjiVscKMe9rVjRHboi9N/R67U6LVfUXj8pdE7fq5lmI4vcNJYLzfKfH7vLCsb2XORjn0iuRWwzPf 2EazoxJFi52oqc26c611flC4NMLJoTZtK8cxi/Wuno7NJqf7JKOtoG0sHIxauK3PjWZ8r4mbcj2I 3mcq9OiNnts0h1Fo+PGPWOrt0lZiMej7MVffJKima+e6pdWzrG6BrkkRVjRXq5I0j67IqL0AojXn XnHbJxG0HDNqDxJ5Npjp3gWI0VRX3ajuMkd7yK5vaxIo5K5kbpGokKpI9zeVXvV+69Wq3lcOWumP 5FxDX/hmwfiPyTVHT3LcOqLja71WXGV17sNwa5Y56dlcrGSu3id2rJF3cxyM26o5XWzqdpXrNpxx Mv4n9DsOoM4gyPHY8cyrFprrFbaqRYZEdBWU08ydkrmtRGOY9W9E6b827LC0fyDiXy7L7vf9W8Ax /AcSbRR09qx9txZdLs+rR6q+pnqoFSBkat9FImo9d+vMm3pBn3yYmnNPa8ZzzOVzPMa6pbm+Q2V1 DXX6oqKCRraiF3enU7lVjqpys2dOqc6o5yKvVTcRlbg5wDXHRG/55pXmul8DcTr8rvOTWrMae+00 kdVHUyxrFAtGnw7H7I5Vc5Eam23Xoq6pAAAAAAMq8Q/x7OEb/H79TxGqjKvEP8ezhG/x+/U8RqoA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1R3Mi9PDZS5SKZFa9Mq vO8RueUwY+/MKDv/ALFX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAGf9KP8AcBa/+f8A9e80AZ/0o/3AWv8A5/8A17znYv8AaKOyr50qOL9ensn6 JaADVAAAAAAAAAAAAAAAAA7HQD+1HYf8K/rMpYRXugH9qOw/4V/WZSwizgf2W3/LHyhfw/saOyPk AAtJgAAAAAAAAAAAAAAAAAAAAAAAAAAAABRPEtw0+295r1F06v3sP1aw/ebGslhbtv4qtHVoiL2t LJuqOaqLy8yqiKiua5w08S3tv+dNO9RLD7D9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXP vYoniW4afbe816i6dX72H6tYfvNjWSwt238VWjq0RF7Wlk3VHNVF5eZVRFRXNcF7Aonhp4lvbf8A Omneolh9h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRFVUVrn3sAAIJrVrVgOgWA12ouot17pb6 TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUBrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH 4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5 GtiaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT0OnRHI1sWsAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAA AAAAA6TM8bny/F7hjVNk96x2Svi7Nt0ss0cVbSrzIvNE+Rj2I7pt1Y7oq9Cl/cl5B+OJxBf/AH+t n/8ADzQYArfSnRy5aYVlwq67WvUfOUr4mRthyu4UlTHSq1VXmiSCmhVHLvsu6r0ROiFkAAAAAAAA AAAAAAAAAAZV4h/j2cI3+P36niNVGVeIf49nCN/j9+p4jVQAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bH pt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/ b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAz/AKUf 7gLX/wA//r3mgDPuJ47q3i9gpbF7WXee7c/wvnqmZzcz3O8N12/C28fUc3GZ03qKspmMqtkTPPTu idyji4nSpmImduyM9yXg6bs9W/mn/p2mHZ6t/NP/AE7TEPHR0avhq8lfX0Z7p8ncg6bs9W/mn/p2 mHZ6t/NP/TtMOOjo1fDV5Gvoz3T5O5B03Z6t/NP/AE7TDs9W/mn/AKdphx0dGr4avI19Ge6fJ3IO m7PVv5p/6dph2erfzT/07TDjo6NXw1eRr6M90+TuQdN2erfzT/07TDs9W/mn/p2mHHR0avhq8jX0 Z7p8ncg6bs9W/mn/AKdph2erfzT/ANO0w46OjV8NXka+jPdPk7kHTdnq380/9O0w7PVv5p/6dphx 0dGr4avI19Ge6fJKtAP7Udh/wr+sylhEN0gx+74tp1abFfaTutdS9v2sXaNfy808jm+k1VRfRci9 F9ZMi/g6Zpw1umqMpimPk6NiJi1TE7o+QACylAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUTxLcNP tvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormucNPEt7b/nTTvUSw+w/VrD9o cmxmZ22/giVlIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tE Re1pZN1RzVReXmVURUVzXBO9atasB0CwGu1F1FuvdLfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVU aiqlFaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT0OnRHI1sUS4P8UyPi69 jvGvxCVtBdJm94hwbFqSN6WyxdhO+nmrFjeq9pVPlgeqOcq8jUaqLujEj26AAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGAOFy6cdnDXoTjOinuE/ZH7HO+/7J+2fZ6Pt+ 8Vk9T+47ScvL2/L+Gu/Lv032S1fdD8dn5Or63bP9mBqoGVfdD8dn5Or63bP9mPdD8dn5Or63bP8A ZgaqBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2YGqgZV90Px2fk6vrds/2Y90Px2fk6vrds/2YGqg ZV90Px2fk6vrds/2Y90Px2fk6vrds/2YGqgZV90Px2fk6vrds/2Y90Px2fk6vrds/wBmBqoGVfdD 8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZgaqBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZgaqBlX3Q/HZ+T q+t2z/Zj3Q/HZ+Tq+t2z/ZgaqBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGYGqgZV90Px2fk6vrds /wBmPdD8dn5Or63bP9mBqoGVfdD8dn5Or63bP9mPdD8dn5Or63bP9mBqoGVfdD8dn5Or63bP9mPd D8dn5Or63bP9mBqoGVfdD8dn5Or63bP9mPdD8dn5Or63bP8AZgaqBlX3Q/HZ+Tq+t2z/AGY90Px2 fk6vrds/2YGqgZV90Px2fk6vrds/2Y90Px2fk6vrds/2YDiH+PZwjf4/fqeI1UYqoaHix1p4sdEN TNS+Fj2tcb019kvfa32cW289r5wtqwx/Bw8kjdpImN9Fr9+03XlRqqu1QAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEb nlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErKP1Z0by7NeJvQbV2zyW9tj029lPnls 0zmzu84W+Ong7FiNVH+m1ebdW7J1TfwLwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMq+S4+Inpl+mv1xWm qjKvkuPiJ6Zfpr9cVpqoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAprVDW2/wCC8RmiOjVutNvqLZqf7JfONVMj+3pvNtAy oi7HZyN9Jz1R3Mi9PDZS5SKZFa9MqvO8RueUwY+/MKDv/sVfWuiSvZzwo2s7mjl513i5e05EX0du boSsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAP4qKqKiKqbp4p6jEdv8pXjWl+sV+0A4rcdfiF8sVctNBkluik mtVwp3bOgqHxelNTpJG6N2ydq1FVeZzdjbp5q+WT4bvZLhNn4kcaoOa44tyWnIOzb1kt0snwEy/8 FM9Wr+afr0YBCuGfyj+j3DJwX6fadU1rueY6hU7bojrFQsWGKnfLdKuSJJ6hzVRvMx7HI2NsjvST dE33PTbS+rz246f2K56n0dBRZTXUjKq50VAxzYKOWT0+7t5nOVyxoqMVyr6TmuciIioieKnkquG7 26+ISHPL/Qdti+m/ZXao527snuKqvc4fz7Pa6ZfzQoi/hHuoAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2 rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP8ATavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9 kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACrOJvPdItP8ARXJ6 7W6djsXudDNap6Fqc9RcnTscxKWnZ4vmfuvKieG3MqojVVO41q1qwHQLAa7UXUW690t9JtHBBGnP U11S7fs6anj8ZJXqmyInh1VVRqKqUVororn2tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSue iNVVVPQ6dEcjWxBEvJb1unmFaT3DQtljuuLalWWumuuT2W+wd3uE7Z3J3eqa1UTnh7DsGbonouTq icyK7bpRXErw1e295r1F06v3sP1aw/ebGslhb4+KrR1aIi9rSybqjmqi8vMqoiormvcNXEr7b3nT TrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc8L1AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53iNz ymDH35hQd/8AYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOjeXZrxN6Dau2eS3tsem3sp88t mmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgmtWtWA6BYDXai6i3Xulv pNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVRrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH 4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5 GtiBororn2tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxawAAFFcSvDV7 b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy8yqiKiua+9QBRXDVxK+2950061FsPsP1a w/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXPvUoriV4avbe816i6dX72H6tYfvNjWSwt8fFVo6 tERe1pZN1RzVReXmVURUVzXuGriV9t7zpp1qLYfYfq1h+0OS41M7x8ESspFVV7Wlk3RWuRV5eZEV VRWueF6gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAACmtUNbb/gvEZojo1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw 2UuUimRWvTKrzvEbnlMGPvzCg7/7FX1rokr2c8KNrO5o5edd4uXtORF9Hbm6ErAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAABBNatasB0CwGu1F1FuvdLfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqk5kV7Y3OjZzuRF Vrd9t1+Tcwxw7IziQ4mstzTiWf3HUHTGvfT4xppVp/Y2P0a8vJc2b+jWyyKrfh2orW+iqbIsXKE5 0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYtYAAZgrOPXF3Ztl2 DYpw9a35jUYReJrHdq3HMapq2kZUxOVFRrkqkdsu26czUVU9ROdGuLTSTWvI63BLS++41mlui7xV YrlNqktd1ji/hpDJ0e1PXyOdt0VdkVFWpuBX+23xT/8AnVrP+pxxvKGUFJjN70C1jsMTKfMrNqla LJR1UacstRQ1aTd4pHKnVzHpGiKi9ERz0TbmUC6taOKHTjRO/WnCrpb8lyfML5A6rt+MYraX3K5z 07VVrp+yaqNZGioqcz3NReV22/K7aNYVxracZJqBaNL8ywPUXTPIsiVzLJTZvj/m+O6SN8Y4JmSS Ruf1RNlcm6qjU3cqIsW1v0f1+w/iPpuKzh3s+PZfW1OLpil+xS81vcpKinbP2zJKSpX0I3q5GIqP VETl32dzej19NxX4RkucYfgXFpwxX3Tm/wA95hfjFbktBT3WztuydIu7XBqcrJ93ei5Gptui8zeg GvCiuJXhq9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXNfeoAorhq4lfbe86 adai2H2H6tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrn3qZR4+8S0+sWCU/EPJm3sB1IwVd8 UyGkj56mtqHb8trfCnWqimXmb2aovLzOd+D2iOvHQnLdQc70jxjLdU8J9iWU3OgZPcbR2nN2Ei+C 7L1ZzJs/s3buZzcrlVWqBPQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEa qP8ATavNurdk6pv4F4FNaoa23/BeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRen hspcoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAKJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXm VURUVzXXsAKJ4aeJb23/ADpp3qJYfYfq1h+0OTYzM7bfwRKykVVXtaWTdFa5FXl5kRVVFa597FE8 S3DT7b3mvUXTq/ew/VrD95sayWFu2/iq0dWiIva0sm6o5qovLzKqIqK5rnDTxLe2/wCdNO9RLD7D 9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPCj9NLZxbcPmrGttyxzhMqc5s2fZvV5BbLhF m9otyLTuVyM3jlkc9OZFRfSRqp4KhL8e0a4geITWnE9Y+J3H7LhGM6dVLrji+C225pcpn3NUTlrK 2qYiRuWPZqsRnrTwanN2mtwBnDVCi4vtPdZKzUrSGkt2p+DXqggpqrBrjd47VUWupiTbt6KoexY1 a/q56SLvzOVPBGq2Aak4LxTcX9XieFak6LWfSLBbDkVFkV1qqnKKe83SuWmVysgpm0rezh5lcqK9 zt0TqngrHbOAAgmtWtWA6BYDXai6i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVRrVrVg OgWA12ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLhSby YHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5GtiBororn2tmfUPFNxS2rulwpN5MDwOReemxemdsra moavSSueiNVVVPQ6dEcjWxawAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9nPCjazuaO XnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU 38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAABRPEtw0+295r1F06v3sP1aw/ebGslhbtv4qtHVoiL2tLJuqOaqL y8yqiKiua69gBRPDTxLe2/50071EsPsP1aw/aHJsZmdtv4IlZSKqr2tLJuitciry8yIqqitc+9ii eJbhp9t7zXqLp1fvYfq1h+82NZLC3bfxVaOrREXtaWTdUc1UXl5lVEVFc1zhp4lvbf8AOmneolh9 h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRFVUVrnhexBNatasB0CwGu1F1FuvdLfSbRwQRpz1N dUu37Omp4/GSV6psiJ4dVVUaiqjWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieH VVVGoqpRWiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbEDRXRXPt bM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5Gti1gAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/ AAXiM0R0at1pt9RbNT/ZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35h Qd/9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKJ4luGn23vNeou nV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXXsAMRcH+KZHxdex3jX4hK2gukze8Q4 Ni1JG9LZYuwnfTzVixvVe0qnywPVHOVeRqNVF3RiR7dMq+S4+Inpl+mv1xWmqgAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC j9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/ptXm3VuydU38C8CmtUNbb/gvEZoj o1brTb6i2an+yXzjVTI/t6bzbQMqIux2cjfSc9UdzIvTw2UuUAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP4q KqKiKqbp4p6jEdv8pXjWl+sV+0A4rcdfiF8sVctNBkluikmtVwp3bOgqHxelNTpJG6N2ydq1FVeZ zdgJn5Lj4iemX6a/XFaaqPKDhn8o/o9wycF+n2nVNa7nmOoVO26I6xULFhip3y3SrkiSeoc1UbzM exyNjbI70k3RN9z020vq89uOn9iuep9HQUWU11IyqudFQMc2Cjlk9Pu7eZzlcsaKjFcq+k5rnIiI qIgSkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/wBir610SV7OeFG1nc0cvOu8XL2nIi+jtzdC VlH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F4AAAAAAAAAAAA AAAAztjvE5qTldnp7/YNAe9UFVz9lL7KqdnNyvVjvRfEjk2c1U6p6iK5eotZRVz9Uz8l3CcH4jHR VVYiJinLPOaY255bZjdLRIKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2ZHyu1vnunyW/QWO3U/HR9y+AU P7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0u pfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+A UP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0 upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+ AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv 0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y +AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4u v0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9 y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4 uv0upfsxyu1vnunyPQWO3U/HR9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR 9y+AUP7fesP4uv0upfsx7fesP4uv0upfsxyu1vnunyPQWO3U/HR9y+AQ/STUD20tPbVnfmjzZ5z7 f+xe8dt2fZzyRfh8rd9+z3/BTbfb1bkwJ6aorpiqnZLl3rVdi5VauRlVTMxPbGqQAGyMAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAPNXyyfDd7JcJs/EjjVBzXHFuS05B2beslulk+AmX/gpnq1fzT9ej D0qKs4m890i0/wBFcnrtbp2Oxe50M1qnoWpz1FydOxzEpadni+Z+68qJ4bcyqiNVUDx+8lVw3e3X xCQ55f6DtsX037K7VHO3dk9xVV7nD+fZ7XTL+aFEX8I91DEXkt63TzCtJ7hoWyx3XFtSrLXTXXJ7 LfYO73Cds7k7vVNaqJzw9h2DN0T0XJ1ROZFdt0AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AztjvE5qTldnp7/YNAe9UFVz9lL7KqdnNyvVjvRfEjk2c1U6p6jsfb71h/F1+l1L9mVoxlmdcTPd Pk7NXAGPpmaaqaYmP46PuXwCh/b71h/F1+l1L9mPb71h/F1+l1L9mOV2t890+THoLHbqfjo+5fAK H9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6X Uv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fA KH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6 XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5f AKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX 6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5 fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8X X6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+ 5fAKH9vvWH8XX6XUv2Y9vvWH8XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKH9vvWH8XX6XUv2Y9vvWH8 XX6XUv2Y5Xa3z3T5HoLHbqfjo+5fAKUxTX7MbtqFj+CZZpJ7HfZF3vu9V5/iq9uwgdK70I40+Rqd XJ+Fv122LrJbd2m7GdH+d6ji8FewNUUX4ymYzjKYnVnMbYmY2xIACRVAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAU1qhrbf8ABeIzRHRq 3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcpFMitemVXneI3PKYMffmFB3/2KvrXR JXs54UbWdzRy867xcvaciL6O3N0JWAAAAAAAAAAAAAADK3Dx/aex/wDwv+tSmqTK3Dx/aex//C/6 1KUcX7Snsn6PTcB/st7+aj5VrGABA6QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPpw k/F8xT/Dv69OW+VBwk/F8xT/AA7+vTlvl/Dexo7I+TzHC/8AxC//AD1f3SAAmc4AAAAAAAAAAAAA AAAAAAAAAAAAAAAAACCa1a1YDoFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FVA a1a1YDoFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FVKK0V0Vz7WzPqHim4pbV3 S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYmiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6 Z2ytqahq9JK56I1VVU9Dp0RyNbFrACiuJXhq9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VH NVF5eZVRFRXNe4auJX23vOmnWoth9h+rWH7Q5LjUzvHwRKykVVXtaWTdFa5FXl5kRVVFa596lFcS vDV7b3mvUXTq/ew/VrD95sayWFvj4qtHVoiL2tLJuqOaqLy8yqiKiua8L1BRXDVxK+2950061FsP sP1aw/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXPvUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAMrcPH9p7H/wDC/wCtSljFc8PH9p7H/wDC/wCtSljHGtezp7IfQsb+1XP5p+cgAJFUAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAARKo+MHpR+nf6iaQM31Hxg9KP07/AFE0gWcHsq7fpDjcP+vZ /k/96wAFxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAFH6s6N5dmvE3oNq7Z5Le2x6beynzy2aZzZ3ecLfHTwdixGqj/TavNurdk6pv4F 4FNaoa23/BeIzRHRq3Wm31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKAAAAAAAAAAA AAADK3Dx/aex/wDwv+tSmqTK3Dx/aex//C/61KUcX7Snsn6PTcB/st7+aj5VrGABA6QAAAAAAEG1 c1r050PsEOQaiX5KKOsm7tQ0sMTp6uunXwighYiue7qngmybpuqbiIz1QxVVFMZ1TlCcgzjUccuB WNIq7PNI9YMKscr2s8+3/EJIKBnMuzVc9j3uai7p4t3/ADGhLVdbbfLZSXqzV9PXUFfCyppamnkS SKaJ7Ucx7HJ0c1UVFRU9SmZpmNrSi7Rc1Uy5QAMJAAAADj3G40Fot9TdbrWwUdFRQvqKmonkSOKG JiK5z3uXo1qIiqqr0REA5AM4pxzae3PvFdgmlmrWb2OmkdG+/Y7iMlRb1Vq7OVsj3sc5E2XdUavy ls6Tax6e63YsmXac35lxomyup6iNzHRVFJO38KKaJyI6N6b+Cp1TZUVUVFMzTMa5hFRet1zlTKag AwlADorTnOK3zLL/AIPars2oveMR0cl2pUikRaZtUx74N3q1GOVzY3rs1VVNk323TcxMxG13oADI AdFac5xW+ZZf8HtV2bUXvGI6OS7UqRSItM2qY98G71ajHK5sb12aqqmyb7bpuYmYja70ABkAAAAA AAB9OEn4vmKf4d/Xpy3yoOEn4vmKf4d/Xpy3y/hvY0dkfJ5jhf8A4hf/AJ6v7pAATOcAAAAAAAAA AAAAAAAAAAAAAAAA63Ja68WzHrlcsfszbvc6SklnpLe6oSBKuVrVVsPaKioxXqiN5lRUTfdUKS4f OOLh+4jXts+K5StmypqrHUYxfWpR3KORvRzGMcvLNsqLv2bnKm3pI3wAv8AgmtWtWA6BYDXai6i3 XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVQGtWtWA6BYDXai6i3XulvpNo4II056muqXb9 nTU8fjJK9U2RE8OqqqNRVSitFdFc+1sz6h4puKW1d0uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqqp6 HTojka2Jororn2tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVVVPQ6dEcjWxXRhuu+IZ xrJqBofabdeIr7pvHbJbrUVEMTaSZK6Dt4uwc2RXuVGrs7mYzZfDmTqBZAKsl4i8Jn1zj4fcctV8 yPJKej7/AHuotUEMlDj8K/uffpnys7N8n72NjXvVNlVqIqKQLNeODF8U1dyvRex6GawZvfcLSidd pcUsFNXU0SVVOyeFeZalj0RWv29Jiek1yJuibqGkAUVpZxk6SanZszTCst+V4Jm80Tp6bG81sslp rqqNEVVdCjlWOXoirs16u2RVRFRFVPlrZxgYpopqdaNIZdLNSs2yW9Wd18p6XELPBXuSmbK+Nyua +eN+6LGqrs1URFTr6gPrxK8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5 r3DVxK+2950061FsPsP1aw/aHJcamd4+CJWUiqq9rSyborXIq8vMiKqorXP6vFeMWpynJ7RjLuEv iIsyXaugoVuN1w2GCio+1kRnbVEiVLlZEzm5nuRF2airsvgdpxK8NXtvea9RdOr97D9WsP3mxrJY W+Piq0dWiIva0sm6o5qovLzKqIqK5rwvUFFcNXEr7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tL Juitciry8yIqqitc+9QAAAAAAAAAAAAAAAAAAAAAAAAAAAAHW5LXXi2Y9crlj9mbd7nSUks9Jb3V CQJVytaqth7RUVGK9URvMqKib7qgHZAoDh844uH7iNe2z4rlK2bKmqsdRjF9alHco5G9HMYxy8s2 you/ZucqbekjfAv8DK3Dx/aex/8Awv8ArUpYxXPDx/aex/8Awv8ArUpYxxrXs6eyH0LG/tVz+afn IACRVAAAAAAAAAAAAONc6+G1W2rulQ17oqOCSoejERXK1jVcqJuqJvsnygckEO0h1Rx/WnTiy6n4 tR3CltV9jklpobhGxlQxGSvjXnax72ovMxfBy9Nv5CYiYy1MU1RVEVRskAAZAAAAAAAAAdFmGc4r gNBR3PLrs2301fcaW00z1ikkWSrqZEjhjRGNVd3Pcib7bJ1VVREVTvQxnGeQAAyAAAAAIlUfGD0o /Tv9RNIGb6j4welH6d/qJpAs4PZV2/SHG4f9ez/J/wC9YAC44AAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACKZFa9MqvO8RueUwY+/MKDv /sVfWuiSvZzwo2s7mjl513i5e05EX0duboSso/VnRvLs14m9BtXbPJb22PTb2U+eWzTObO7zhb46 eDsWI1Uf6bV5t1bsnVN/AvAAAAAAAAAAAAAAAGVuHj+09j/+F/1qU1SZW4eP7T2P/wCF/wBalKOL 9pT2T9HpuA/2W9/NR8q1jAAgdIAAAAADKfc6fNPKOSwZNG2ohwbTtldYaeVN2xVE9UxktS1F/f8A LK5m/wCZvyIasKE160Rz67ag45xAaG3W2Uef4xSSWyehunMlFfLY9yudSyub1Y5HOc5jvDmcm6ps iptROUoMRTMxExGeUxP+fN3mt2s9nwepXBr7oVqZntBeba51U7G8VW60DopHPjdTzO50TnVGqqsV PwXtX1lHa4622m6cDVv1R4dILrhttZeKGltNJTIlslhZFcOxkhVtM9UbG9zHIrUdsrXdfFULCqtT ONnIqR1ksfDJjeJXGZvZ+e7zmtPXUUC+HaJT0zO1enrRF2/OikOz/hSzXG+Cq1cPmBOXLL7brrSV 0snPDRtlVbh3mdW9q9rUa3nciIrt1RqetdjemIjLPer3arlcVTRnllPNlOerLLnnndnrdVaicN+j 7PY7qfkOQZ5qVktrxyK7XypSpp7bW1XP2klJT8qMgiRGycsaIqJ6Crvsu/U694ZqBwt6YO12wjXX UXIrhitXQy3i2ZNelr6C70stRHDKzsHN5YHbyoqOj25URduuypcnFHo1edbNMWWPFbnTW/JrFdqP IrDUVSL2Da+lcqsbJsiqjXNc9u6IuyuRdl22WrtVse4l+JzDYNF8r0cotO7Fdaykkya+S5LS16Pp oJmSujo4YN3q5742qiycqIibL47opnPLP3l6iaZqiInZ+Hbt1/XekFgzXILrx21ePQ5HdHY1NpNB d4bU6rk7o2ofcmNSdIN+RJeReXn25tum+xyaDKMmfx93LDX5Fc3WCPSuO4stS1ci0bapbo1nbpDv yJJyLy8+3Nt032ONn+nuqWCcS9q160x0/jzK0VOGLh1ys8F0p6GqpUZVJPHPG6oc2N7ejWK3mRei r8hxtNtPNbKjjBu2uOoGJUlpsN3wBLPSx09xhqVoJ218T20kio5HSSKyN8zntZ2SdpyI5yt5nNWW fUz+PPRyn1vBAeFHCdQNedMb3fdQ9ddSaeKjyO6W2zstGRTUssUbJd1llm6yTORzlY1j1WNrI2oj eriu9SNWNQc24Mb5g2cZJLWXS0aot03vl5REjkq6OGdr+2ft0RVTkY5f3yNXffdVWV8HGU674ZpH fZcD0mpdQbTcMqvEtIyK/QWyooKhJuR8cqVCcr4XcrXo9jlciueitVOVSzMD4QJ7pwx5XpLq5cad uRah3esyi71VvTtI6C6TyMfG6JV250jWGLdN0R3ptRdl3XeZimrXvQUUVXbURRnnNM57de7/ADma UsNis+MWWhxzH7dDQWy2U8dJSU0LeVkMTGo1rWp8iIiFU6w1GI8N2mOqGuOFYjbqTIKyk84VsrI1 RK6uROygfKiL1RHyIqom2+718XKpBcbzHjk09skGE37Qawaj1dujSlp8pocwp7dFVManKyWognZ2 nPsiK7l23XfZE8TsbRw96p6gaX6lWfX7UNKu+6mQdmy3W6SR9pxxrGbQMpo3qnM5HIx0junOrE6q u73RRGU65W6rk3KcqKZzynbGWWr/ADYiNXo1qxR6By6yJxJaku1Ghx1cndvdm+Z1qUp+8LS9w5Ox 7Hxj8N/33h6J0eomsmpepeOcLuT4Tl1bilx1CuS092WilckG76drJ3LCq8kyRu7R8bZUc1HI3dF6 7yednGLWaMO0CfovZY7rLZfYxJmq5RTrbu7rF2C1iUyJ3nnWPdeTk/C6+HonY5Pw55Pj0/DZjWDW 512s+l10R15rnTwwqyJKdGOnVj3o53PJzLysRypub5xzq801TGVETllGe3bnH0zzlwM2t+VaAa+6 PtxvVPOL5Zs9utXY75a8jvUlxgk+BR0U0SSfuD0cqqvZ7IuyIiIm6LHeHjTegt3F1r5dqnOc3lbi NbYpmNmyGokZXNmoJnK2saq/2S2NOkaP3RiIiN2Ld4gtNc2zfVLRLI8XsvfbdiOTzXG8zd5hj7rT uhRqP5XuRz+vTZiOX8x0OI4Lq7p3xV6k5LTacQX/AAfVJ9mlkvTLxTwLau6Ur4ZGyUz/AISXmc9d uRNtuXr1VGoqzp931b1W8rkatUVdfR82d8C4hdNtZbLctQ9auMLLsBv10r6nzTjuPXWagprLRser YGyRxxObUSKic7nSK7dFRNk6lraUZbqlxTcLVfW4vqZV02oeC5FU0Nuv9tqH0dNe6ii5JIVqYmK1 r4KiGVjXseit3Xm5enKdtpRjPEhwu43W6P4lo3Saj4tQXCrqcZutPk1LbXwUs8rpUgq46hObma97 1V8fMi83ROhNM2i4rK/Q2jxihpLG/UXKKruFxu1plbBQ43RTPXnqE7aRJJ5Iol5U7NN1f6SJ6Kc2 apjPUjt0V5fjzzy16p1z257d0x4IDpZqzmvF7qHj1dZp79heIacxx1OXUtLVy0ktyyNUVPNquY5H PpYeVz3oq7P5mtc3qip1XDfphSwcYWu9Y7N83ndi1wsD4mTZDUPZXpPQzLy1jVdtUtj8I0fukaIi N2JdauHW+cOWoGF5Vw7Y7JcbBVUcGN5zZe9wwyVkDEVYruizPYx1RG5X86Iu72v2aibqqc/DcJ1g 024r9R8qodO4b5hWp8lmndfI7zTwOtK0lK6KRJKd/wAJKqueu3Im2yN69VRuM416O5tFFWdM3Yzm KtfdOWXVs97SAAIXRAAAAAAAAUJo3rNxY4ppvaLBppwX+zvG6XvHcsg9sW22vvnNUSPk/sWZiyR8 kjnx+kvpdnzJ0chNPdD8dn5Or63bP9mWXwk/F8xT/Dv69OW+X8N7Gjsj5PMcL/8AEL/89X90sq+6 H47PydX1u2f7Me6H47PydX1u2f7M1UCZzmVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn 5Or63bP9mPdD8dn5Or63bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV90Px2fk6v rds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y 90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/ HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/ZnjrxppfaTi dy+6XzS5mmd+r6qG6XDHqfIae79yrJo2SvkSopka1Fkc7tuXxasi+rbb/RFktdd7Zj1yuNgsrrxd Kaklkore2ZkK1U6NVY4u0eqNYjnbJzKuyb7r4GA9JvJP2nIMyuOsXF7mS5plN+r5brXWa0ySU9ub PK9XubJN0llairsjWdm1qIjfSQDPfAVxq8c90v1Lp9j+FXPWjH6ZzIp0uMixT26P1Kt0f6LE28En V++2zdjVHDntxI8TGWZrxML3DUPTKudT4zpnV9abHqNeVW3Nir6NbLIqt/shqK1uzXJsixcu0sSw 7E8CsNLi2E43bLDZ6JvLT0NupWU8EaevZjERN19a+Kr4lQ8S3DT7b3mvUXTq/ew/VrD95sayWFu2 /iq0dWiIva0sm6o5qovLzKqIqK5rgvY8v9S9WNa9NOLzizpOH7Ti65Nl92tONSx1tNTtkgstLT2h jpqp6OVEkm2eiQw9Ve/fo7lVjtlcNPEt7b/nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K1yKv LzIiqqK1z+m0b0k1CxTjJ4gdVr/j/dcWzenxqOw1/e4H98dSUCRVCdmx6yR8r+nwjW7+Ld06gdlw R43oxa9BrPkmjN6myCnyne63rIK9ea5XS6PX+yJK1d1VJmv5mqxVVGbbIq/hOr7h6/7oXxWf+SYb +q0OypdFNUuHbiOdnXD/AIv590v1Jq1kzbFYq2npfMlwXb/ZajSeRjVa7/fImLuuy7IvwaRxR9h4 otG+MHWzVrA+GWo1CxrUOKwRW+rhzC12vk7lQMikVWTyLJ+6K9vVrfwN03RUUDs/Km2232/hnTVe j7Oly3T3IbTd8buDE2np6payKNzWOTryq1yuVu+yrG1V6tTaHcQup66WeUT05zOp0+zPKne1fVQv tWJ2h1zuCOkq5t3JC1yKrG7ek7fp0Jfd9JuJXi3zfFp+IrB7Npjphh90hvq4lTXqO73G+10O/YpU 1EKJCyBqqqq1vVd1TZVVr2TfKNJNQrjx74ZrTR4/2mGWnT+sslZc+9wJ2Va+ple2Lslf2rt2uavM jFb18QOXhXGLT5pllqxNvDFxCWNbrVMpUuN6wKWkoKXmXbtJ5lkVI409btuhoQEE1q1qwHQLAa7U XUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqBRnH3iWn1iwSn4h5M29gOpGCrvimQ0kf PU1tQ7fltb4U61UUy8zezVF5eZzvwe0R3XYrxK8etyxm1XGt8nr3qoqaKGWWf2y7Zb+1e5iKru6z MWWDdV37N6q5vgq7oc/RXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5 Gti1gBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/AGZqoAZV90Px2fk6vrds/wBmPdD8dn5Or63bP9ma qAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfdD8dn5Or63bP9mPdD8dn5Or63bP9maqAGVfd D8dn5Or63bP9mPdD8dn5Or63bP8AZmqgBlX3Q/HZ+Tq+t2z/AGY90Px2fk6vrds/2ZqoAZV90Px2 fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrds/2Y90Px2fk6vrds/2ZqoAZV90Px2fk6vrd s/2Y90Px2fk6vrds/wBmaqAGVfdD8dn5Or63bP8AZj3Q/HZ+Tq+t2z/ZmqgBlX3Q/HZ+Tq+t2z/Z j3Q/HZ+Tq+t2z/ZmqjrclrrvbMeuVxsFldeLpTUkslFb2zMhWqnRqrHF2j1RrEc7ZOZV2TfdfAD/ ADu8aaX2k4ncvul80uZpnfq+qhulwx6nyGnu/cqyaNkr5EqKZGtRZHO7bl8WrIvq221FwE8avHNd b9SafWDC7nrPj1O5kVR5xkWKe2xr4Ktzf6LE28EnV++2zdjQmk3kn7TkGZXHWLi9zJc0ym/V8t1r rNaZJKe3Nnler3Nkm6SytRV2RrOza1ERvpIb2xLDsTwKw0uLYTjdssNnom8tPQ26lZTwRp69mMRE 3X1r4qviBm7h4/tPY/8A4X/WpSxiueHj+09j/wDhf9alLGONa9nT2Q+hY39qufzT85AASKoAABkT i114p8e1qwzRC+atVmmmK19omyDIb7b3LHXTx9o+KnpIJUY5YVc+J6uc1N9vBU22XXZQGt+l2pVL rJiHEbo9aKC/3rH7bUWC8Y/WVraNbnbZXK9qQzuRWRyMkc53p9F6demy7UZZ60GJiqaPw747lP6S a+Ynj3EniGmmmHEHe9T8NzqkroKumvtbJXVdlr6eJZYpGVErGyLHK1HM5FVyIqOX5DsuHXFc+1xu Gr7s21q1BprFj+pF7tFnpbRf5qSaJWParkdOirIsTGOiSOFHJG3eReVeZNrw0+yXiOy/OWV+a6bW bAMNpKORklBU3SK6XSvqnKnI9r6d3ZQRsRF3RVeq/J13bnfheyPWnEK3W26YBplT57ZqvVfIIVoI b1BbaujrGOjV0iuqPg5IpGPiTo5HMWJejkd0k2xOSpEaNVMVZzGc80xzRza5yzful4mNSdJeHnXG nvt/kyTKNJslfjdmvFexrpqqComZFSzVCIm0kjEe9yqv4XK1F36qso1Q0d1W0i0Uuur9l4jdR6/P MVtnnytbcbv3iz1r4mpJUwrQq3smRK1JEajdlT0eqn9sfCJl+acP+q2M6n1tvtma6u3ubJKhlLIs 9Nap2yslpKfnT8NrHRojnN36PVE5tt15ecx8X+rWlNTofd9G7RjtdfKJlnvWYy5NTVFB3ddm1E8N NGneFdIxHbMc1vKr+qrtuZzjPUaNej+OJ2atu3OfHLLa4+RaqZjxAaiaTaS4tl13wi0ZdgkeoWQ1 lkmSK4Pp5URsNJBOqKsKJLvzOROZU26p65/jmluqml9bmNHU6q3LMNOq3HZpKOHJa19XeaC5I1yO Rs/Zp2lO5nX03K5HbbImyq6OZ3oPnmnGaaZ6saD2ajyOrwHGW4VX2Curm0UlztLWIkSxTuRWMlY9 Fd6fRd069NlkeIM4ms8yHJsk1GsdJhGLyY/La7RhsVdSXCpqK526rWVFXG3ZnReRsbX8vXdURW7u 1zjLVsSUxOlOnE6Wfuyy7vdvUFwzaNZnnHBxYcsk1vzrGKijtVwkx+hxu59xpKRsU86tdUMY3mqX Pla5zud23K5GtRu266Z4TdQ8h1W4dcGz3LKhKi8XK3ubWTo1G9tLFNJCsiomyIruz5l2RE3VdkQ6 fho01zXT7hOsGmeX2XuGSUVpr6Wei7zDLySyTTuY3tI3OjXdHtXdHbJv19Z2PCDgGW6XcOOF4Fnd p82X2009THWUnbxTdk51VNI1OeJzmO3a9q9HL4/KK5ic+1nD25tzRqn1dfbq/VcRizWzO3W7iOyD H+IDVzUPTXT9lDb/AGFVeN1E9BQXCZ0W9WtTVwRud2rZejWPVGo1N18W820yj83yHiUxnM77R0Oj ln1Pwe6MidbI6S70ttq6D0NpYallUvJO1XdUc1eieKL4JrROUpcRGdMdu6Z74jWgGU6o5Fw/8KOb 6mY/rTTaq01PO1mI3eoWKpmp2VEscLI6meNeSpdE6RXq5WtVduVU8ESkMp1o0/w3Th2eYJx1ZXf9 ULVTR3CSguFwmns91qE2dNSpQuhSKON3ptZyq1W+j6XrLWxzg9ynMNJdaMay60WbAl1UuNPcrRjd sqEqaSwy03K6NznxtaxXSSMasiRptyp0/gpOKTNeNeoxqiwyLQzHbbkkbIaSoy6tyanqLTu3ZH1T aSNEqXcyIqpGqN2V3iu2xJExCpVTcqyzziMtWqZ15z1xlzbUdyvVHLdfNTNKtIsQy+8YTZMtwZmo V+rbLMkVxkpZURsFLDOrVWJO035nNTmVNvD1z3F9MtWtKbjl0S6t3bK9P6nHpZre3Ia+SpvltubU dvyVKMTngVnX0ncyO22RNlV3X6z6XaqW/V3DOIvSi1W3J8gsFonx6+2KerS3pdKCRVei08r+ZsT2 Suc5GvVUVFRN+nXnYgziazzIcmyTUax0mEYvJj8trtGGxV1JcKmornbqtZUVcbdmdF5Gxtfy9d1R Fbu7XPVq2JqYmK504mZz1TzZZd3u3qq4VqzNIuG6g4p9TtUs0yCqsmO3argss13etDJS0qTpz1DH Irp6h6xPf2r3KrUcxqIiN61dh2tWn2e6etzvUjjnyvGdS7tHLWx2+2XCantFolVXLBTLRNiWOVjU 5EfzK5zuvpb9V1Nw36O32wcJFk0T1RtDrbXzWa42m7UjaiKZ0cdTNOioj43OYqrHKi9FXx/mIZpk nFtobp3R6MUGiNozVcdifb7LlMWT01FRy03MvYOqaaRO3arGq1HNYjuZG7I798u2cTMoeLrimjPP LLXqmderdOak9UswuHEdw4cPWquRZBfLfeLrqDasdukNruUlLTPlSoqI31TYmKjWz7wNeyROsfO5 G7HoDiuPRYnj1DjkF1utzjoIuybV3WtfV1cybqvNLM9Vc93XxUoHiI0t1wz/AEVwBYaWyZLqBhmU 2jKa+jopUoKW4SU3adpDC+Zyoz90T0nqm/Kq7JujS+cNuuR3zGaC65bijsau9Qxzqm1OrY6xaV3M qI1ZovQeqtRF3b0Tfb1Glc5xqWLFE0XJ0tuUa97ugARrYAAAAAiVR8YPSj9O/wBRNIGb6j4welH6 d/qJpAs4PZV2/SHG4f8AXs/yf+9YAC44AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACmtUNbb/AILxGaI6NW602+otmp/sl841UyP7em82 0DKiLsdnI30nPVHcyL08NlLlIpkVr0yq87xG55TBj78woO/+xV9a6JK9nPCjazuaOXnXeLl7TkRf R25uhKwAAAAAAAAAAAAAAZW4eP7T2P8A+F/1qU1SZW4eP7T2P/4X/WpSji/aU9k/R6bgP9lvfzUf KtYwAIHSAAAAAAAAAAAAAAAAQXRzR7GdEMSmw3FK651dFNcqq6OkuMsckqS1D+d6IsbGJyovgm2+ 3iqk6AEznrlimmKY0Y2AADIAAAAAAAAAAAAAAAAAAAAA+nCT8XzFP8O/r05b5UHCT8XzFP8ADv69 OW+X8N7Gjsj5PMcL/wDEL/8APV/dIACZzgAAAAAAAAAAAAAAAAAAAAAAAAAAAABRPEtw0+295r1F 06v3sP1aw/ebGslhbtv4qtHVoiL2tLJuqOaqLy8yqiKiua5w08S3tv8AnTTvUSw+w/VrD9ocmxmZ 22/giVlIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZ N1RzVReXmVURUVzXBewKJ4aeJb23/Omneolh9h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRFVU Vrn3sAAIJrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUBrVrVgOgWA1 2ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLhSbyYHgci 89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5GtiaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0k rnojVVVT0OnRHI1sWsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAytw8f2nsf/AML/AK1KWMVz w8f2nsf/AML/AK1KWMca17Onsh9Cxv7Vc/mn5yAAkVQAAAAAILpRo9jOj0GU0+M11zqW5dk1dlda tfLG9Y6uqRiSMi5GM2iTs28qO5nJuu7lJ0BmxNMTMTPMAAMgAAFcaiaO3LP77FeqTWvUfEmR0zaZ aHHbhSQUr1a5zu1c2WmkdzrzbKvNts1vTxVbHAicmtVMVxlKkPcy3z8afW//AO/Nu+4lx2W3Ps9n obTJcqy4voqaKndWVr2vqKlWNRqyyua1rVe7bmcqNRFVV2RPA5gMzMztYpt00bAAGG4AAAAAAAAA AAAAAACJVHxg9KP07/UTSBm+o+MHpR+nf6iaQLOD2Vdv0hxuH/Xs/wAn/vWAAuOAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAo/VnRvLs 14m9BtXbPJb22PTb2U+eWzTObO7zhb46eDsWI1Uf6bV5t1bsnVN/AvAprVDW2/4LxGaI6NW602+o tmp/sl841UyP7em820DKiLsdnI30nPVHcyL08NlLlAAAAAAAAAAAAAABlbh4/tPY/wD4X/WpTVJk zTzGOIPAsOt+J+0b37uPa/2R7JqGLn55Xyfg7u2259vFfAo4uJ06ZiJnVOyJnduel4Cqo4i9RVVT EzNE66op2RXntmN8LQBEu8cQf4vn0soR3jiD/F8+llCV856M90+TraNH5lH+5R9yWgiXeOIP8Xz6 WUI7xxB/i+fSyhGc9Ge6fI0aPzKP9yj7ktBEu8cQf4vn0soR3jiD/F8+llCM56M90+Ro0fmUf7lH 3JaCJd44g/xfPpZQjvHEH+L59LKEZz0Z7p8jRo/Mo/3KPuS0ES7xxB/i+fSyhHeOIP8AF8+llCM5 6M90+Ro0fmUf7lH3JaCJd44g/wAXz6WUI7xxB/i+fSyhGc9Ge6fI0aPzKP8Aco+5LQRLvHEH+L59 LKEd44g/xfPpZQjOejPdPkaNH5lH+5R9yWgiXeOIP8Xz6WUI7xxB/i+fSyhGc9Ge6fI0aPzKP9yj 7ktBEu8cQf4vn0soR3jiD/F8+llCM56M90+Ro0fmUf7lH3JaCJd44g/xfPpZQjvHEH+L59LKEZz0 Z7p8jRo/Mo/3KPuS0ES7xxB/i+fSyhHeOIP8Xz6WUIznoz3T5GjR+ZR/uUfcloIl3jiD/F8+llCO 8cQf4vn0soRnPRnunyNGj8yj/co+5LQRLvHEH+L59LKEd44g/wAXz6WUIznoz3T5GjR+ZR/uUfcl oIl3jiD/ABfPpZQjvHEH+L59LKEZz0Z7p8jRo/Mo/wByj7ktBEu8cQf4vn0soR3jiD/F8+llCM56 M90+Ro0fmUf7lH3JaCJd44g/xfPpZQjvHEH+L59LKEZz0Z7p8jRo/Mo/3KPuS0ES7xxB/i+fSyhH eOIP8Xz6WUIznoz3T5GjR+ZR/uUfcmPCT8XzFP8ADv69OW+Vxw7YjkOC6O4/iuVW/uN0oe99vB2r JeTnqpXt9JjnNXdr2r0VfH5SxzoYeJptUxO6Pk8nwpXTcx16uic4muqYmNkxnIACZQAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAUTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMq oiormucNPEt7b/nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23v NeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXBO9atasB0CwGu1F1FuvdLfSbRw QRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqlFaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr 0krnojVVVT0OnRHI1sUS4P8AFMj4uvY7xr8QlbQXSZveIcGxakjelssXYTvp5qxY3qvaVT5YHqjn KvI1Gqi7oxI9ugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVuHj+09j/wDhf9alLGKv08xj iDwLDrfiftG9+7j2v9keyahi5+eV8n4O7ttufbxXwJH3jiD/ABfPpZQnGtxVTRETTOzdPk+hYqbV y/XXTdoymZn16N/8yWgiXeOIP8Xz6WUI7xxB/i+fSyhN856M90+SDRo/Mo/3KPuS0ES7xxB/i+fS yhHeOIP8Xz6WUIznoz3T5GjR+ZR/uUfcloIl3jiD/F8+llCO8cQf4vn0soRnPRnunyNGj8yj/co+ 5LQRLvHEH+L59LKEd44g/wAXz6WUIznoz3T5GjR+ZR/uUfcloIl3jiD/ABfPpZQjvHEH+L59LKEZ z0Z7p8jRo/Mo/wByj7ktBEu8cQf4vn0soR3jiD/F8+llCM56M90+Ro0fmUf7lH3JaCJd44g/xfPp ZQjvHEH+L59LKEZz0Z7p8jRo/Mo/3KPuS0ES7xxB/i+fSyhHeOIP8Xz6WUIznoz3T5GjR+ZR/uUf cloIl3jiD/F8+llCO8cQf4vn0soRnPRnunyNGj8yj/co+5LQRLvHEH+L59LKEd44g/xfPpZQjOej PdPkaNH5lH+5R9yWgiXeOIP8Xz6WUI7xxB/i+fSyhGc9Ge6fI0aPzKP9yj7ktBEu8cQf4vn0soR3 jiD/ABfPpZQjOejPdPkaNH5lH+5R9yWgiXeOIP8AF8+llCO8cQf4vn0soRnPRnunyNGj8yj/AHKP uS0ES7xxB/i+fSyhHeOIP8Xz6WUIznoz3T5GjR+ZR/uUfcloIl3jiD/F8+llCO8cQf4vn0soRnPR nunyNGj8yj/co+4qPjB6Ufp3+omkDOGLYtrFfNYsJyrKtLvY7a8d85dvP57pavfvFK5jfRYqO/CR qdEX8L1Iho8t4OJimqZjLXz6uaHB4eqoquWooqicqMpymJjPTrnbEzGyYAAW3CAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARTIrXplV53 iNzymDH35hQd/wDYq+tdEleznhRtZ3NHLzrvFy9pyIvo7c3QlZR+rOjeXZrxN6Dau2eS3tsem3sp 88tmmc2d3nC3x08HYsRqo/02rzbq3ZOqb+BeAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABlXyXHxE9Mv01+ uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm31Fs1P8AZL5xqpkf29N5 toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV7OeFG1nc0cvOu8XL2nIi +jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv01+uK01UAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq826t2Tqm/gXgU1qhr bf8ABeIzRHRq3Wm31Fs1P9kvnGqmR/b03m2gZURdjs5G+k56o7mRenhspcoAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAABlXyXHxE9Mv01+uK01UZV8lx8RPTL9NfritNVAAAAAAAAAAAAAAAAgmtWtWA6BYDXai6 i3XulvpNo4II056muqXb9nTU8fjJK9U2RE8OqqqNRVQGtWtWA6BYDXai6i3XulvpNo4II056muqX b9nTU8fjJK9U2RE8OqqqNRVSC8NXFVZde/OmLZDidywLUTH9pLtiF43bVw0z9nQ1MfM1qyROY5m6 o1OVy7KmytV0E0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYp3x K8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5rwvUFFcNXEr7b3nTTrUWw +w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9QAAAAAAAAAAAAAAAAM7Y7xOak5XZ6e/2 DQHvVBVc/ZS+yqnZzcr1Y70XxI5NnNVOqeo7H2+9YfxdfpdS/ZkO4eP7T2P/AOF/1qU7LItZdNsU vFRYL/kfda+l5O1i7nUP5eZiPb6TGK1d2uRei+s5FN+5oRVVXln2eT3tzgzCcfXZs4aKtGZ57kzl E5c1Tv8A2+9YfxdfpdS/Zj2+9YfxdfpdS/ZkO90Po9/df/R9V9mPdD6Pf3X/ANH1X2Y5TV+Z/b5H oe3/ANH/AOT7kx9vvWH8XX6XUv2Y9vvWH8XX6XUv2ZDvdD6Pf3X/ANH1X2Y90Po9/df/AEfVfZjl NX5n9vkeh7f/AEf/AJPuTH2+9YfxdfpdS/Zj2+9YfxdfpdS/ZkO90Po9/df/AEfVfZj3Q+j391/9 H1X2Y5TV+Z/b5Hoe3/0f/k+5Mfb71h/F1+l1L9mPb71h/F1+l1L9mQ73Q+j391/9H1X2Y90Po9/d f/R9V9mOU1fmf2+R6Ht/9H/5PuTH2+9YfxdfpdS/Zj2+9YfxdfpdS/ZkO90Po9/df/R9V9mPdD6P f3X/ANH1X2Y5TV+Z/b5Hoe3/ANH/AOT7kx9vvWH8XX6XUv2Y9vvWH8XX6XUv2ZDvdD6Pf3X/ANH1 X2Y90Po9/df/AEfVfZjlNX5n9vkeh7f/AEf/AJPuTH2+9YfxdfpdS/Zj2+9YfxdfpdS/ZkO90Po9 /df/AEfVfZj3Q+j391/9H1X2Y5TV+Z/b5Hoe3/0f/k+5Mfb71h/F1+l1L9mPb71h/F1+l1L9mQ73 Q+j391/9H1X2Y90Po9/df/R9V9mOU1fmf2+R6Ht/9H/5PuTH2+9YfxdfpdS/Zj2+9YfxdfpdS/Zk O90Po9/df/R9V9mPdD6Pf3X/ANH1X2Y5TV+Z/b5Hoe3/ANH/AOT7kx9vvWH8XX6XUv2Y9vvWH8XX 6XUv2ZDvdD6Pf3X/ANH1X2Y90Po9/df/AEfVfZjlNX5n9vkeh7f/AEf/AJPuTH2+9YfxdfpdS/Zj 2+9YfxdfpdS/ZkO90Po9/df/AEfVfZj3Q+j391/9H1X2Y5TV+Z/b5Hoe3/0f/k+5Mfb71h/F1+l1 L9mPb71h/F1+l1L9mQ73Q+j391/9H1X2Y90Po9/df/R9V9mOU1fmf2+R6Ht/9H/5PuTH2+9Yfxdf pdS/Zj2+9YfxdfpdS/ZkO90Po9/df/R9V9mPdD6Pf3X/ANH1X2Y5TV+Z/b5Hoe3/ANH/AOT7kx9v vWH8XX6XUv2Y9vvWH8XX6XUv2ZDvdD6Pf3X/ANH1X2Y90Po9/df/AEfVfZjlNX5n9vkeh7f/AEf/ AJPuTH2+9YfxdfpdS/Zj2+9YfxdfpdS/ZkO90Po9/df/AEfVfZj3Q+j391/9H1X2Y5TV+Z/b5Hoe 3/0f/k+5PsU1+zG7ahY/gmWaSex32Rd77vVef4qvbsIHSu9CONPkanVyfhb9dti6zGk2uOlz9YtP sqblG9rsfnbv8/cqj4HtqXkj9Hs+Z27unoou3r2Quz3W3D584H9FV32JYw2KpmJ4yuNvPMbocjhf gW9TctzhcPVETTriIqmM9KqOfOdkRqzW+AC+8yAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAimRWvTKrzvEbnlMGPvzCg7/wCxV9a6JK9n PCjazuaOXnXeLl7TkRfR25uhKyj9WdG8uzXib0G1ds8lvbY9NvZT55bNM5s7vOFvjp4OxYjVR/pt Xm3VuydU38C8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqA AAAAAAAAAAAAQTWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieHVVVGoqoDWrWrA dAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieHVVVGoqpRWiuiufa2Z9Q8U3FLau6XCk3k wPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbE0V0Vz7WzPqHim4pbV3S4Um8mB4HIvPTYvTO2VtT UNXpJXPRGqqqnodOiORrYtYAAABRXErw1e295r1F06v3sP1aw/ebGslhb4+KrR1aIi9rSybqjmqi 8vMqoiormvcNXEr7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9SiuJXhq 9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXNeF6gorhq4lfbe86adai2H2H6 tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrn3qAAAAAAAAAAAAAAZW4eP7T2P/wCF/wBalGD/ ANuHUz9Df1Vw4eP7T2P/AOF/1qUYP/bh1M/Q39VccKn1bf8AnNL6Xe9tiff/AH0rGBVGrOO2fK9S dO7Bf6PvVBVed+1i7R7Oblp43t9Jio5NnNRei+o7H3PGj39yH9IVX2hJpVTMxTGzr/RX4mzTRTVc qmJqjPVTE88x0o3bljArn3PGj39yH9IVX2g9zxo9/ch/SFV9oM7m6O/9GNDDdOr4Y+9YwK59zxo9 /ch/SFV9oPc8aPf3If0hVfaDO5ujv/Q0MN06vhj71jArn3PGj39yH9IVX2g9zxo9/ch/SFV9oM7m 6O/9DQw3Tq+GPvWMCufc8aPf3If0hVfaD3PGj39yH9IVX2gzubo7/wBDQw3Tq+GPvWMCufc8aPf3 If0hVfaD3PGj39yH9IVX2gzubo7/ANDQw3Tq+GPvWMCufc8aPf3If0hVfaD3PGj39yH9IVX2gzub o7/0NDDdOr4Y+9YwK59zxo9/ch/SFV9oPc8aPf3If0hVfaDO5ujv/Q0MN06vhj71jArn3PGj39yH 9IVX2g9zxo9/ch/SFV9oM7m6O/8AQ0MN06vhj71jArn3PGj39yH9IVX2g9zxo9/ch/SFV9oM7m6O /wDQ0MN06vhj71jArn3PGj39yH9IVX2g9zxo9/ch/SFV9oM7m6O/9DQw3Tq+GPvWMCufc8aPf3If 0hVfaD3PGj39yH9IVX2gzubo7/0NDDdOr4Y+9YwK59zxo9/ch/SFV9oPc8aPf3If0hVfaDO5ujv/ AENDDdOr4Y+9YwK59zxo9/ch/SFV9oPc8aPf3If0hVfaDO5ujv8A0NDDdOr4Y+9YwK59zxo9/ch/ SFV9oPc8aPf3If0hVfaDO5ujv/Q0MN06vhj71jFc8Q/9p7IP8E/rUQ9zxo9/ch/SFV9oPc8aPf3I f0hVfaGtcXKqZpyjX1/olsVYazdpuaVU5TE+rHN/3NUgyt7njR7+5D+kKr7QsrhJ+L5in+Hf16c6 NnEVXK9CqnLVntz3dUb3k8fwTawmH4+3cmr8URlNOW2Kpz9ady3wAWnEAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeIzRHRq3Wm 31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/9ir610SV 7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVR5q8B Ws3FjinCdg1g004L/Z3jdL5z7lkHti221985rlVPk/sWZiyR8kjnx+kvpdnzJ0choD3Q/HZ+Tq+t 2z/ZgaqBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/ZgaqBlX3Q/HZ+Tq+t2z/Zj3Q/HZ+Tq+t2z/Zga qOtyWuvFsx65XLH7M273OkpJZ6S3uqEgSrla1VbD2ioqMV6ojeZUVE33VDM/uh+Oz8nV9btn+zHu h+Oz8nV9btn+zAlfD5xxcP3Ea9tnxXKVs2VNVY6jGL61KO5RyN6OYxjl5ZtlRd+zc5U29JG+Bf5/ nL400vtJxO5fdL5pczTO/V9VDdLhj1PkNPd+5Vk0bJXyJUUyNaiyOd23L4tWRfVttqLgK41eOe6X 6l0+x/CrnrRj9M5kU6XGRYp7dH6lW6P9FibeCTq/fbZuwHqvrVrVgOgWA12ouot17pb6TaOCCNOe prql2/Z01PH4ySvVNkRPDqqqjUVUorRXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9 Eaqqqeh06I5GtigvDntxI8TGWZrxML3DUPTKudT4zpnV9abHqNeVW3Nir6NbLIqt/shqK1uzXJsi xcu6gBmCs49cXdm2XYNinD1rfmNRhF4msd2rccxqmraRlTE5UVGuSqR2y7bpzNRVT1GnzIHAr/bb 4p//ADq1n/U4C2dGuLTSTWvI63BLS++41mlui7xVYrlNqktd1ji/hpDJ0e1PXyOdt0VdkVFXka0c UOnGid+tOFXS35Lk+YXyB1Xb8YxW0vuVznp2qrXT9k1UayNFRU5nuai8rtt+V21K+UMoKTGb3oFr HYYmU+ZWbVK0WSjqo05Zaihq0m7xSOVOrmPSNEVF6Ijnom3Mp3mt+j+v2H8R9NxWcO9nx7L62pxd MUv2KXmt7lJUU7Z+2ZJSVK+hG9XIxFR6oicu+zub0QlOFca2nGSagWjS/MsD1F0zyLIlcyyU2b4/ 5vjukjfGOCZkkkbn9UTZXJuqo1N3KiLoMyHTcV+EZLnGH4FxacMV905v895hfjFbktBT3WztuydI u7XBqcrJ93ei5Gptui8zehrwCiuJXhq9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNVF5e ZVRFRXNe4auJX23vOmnWoth9h+rWH7Q5LjUzvHwRKykVVXtaWTdFa5FXl5kRVVFa596mUePvEtPr FglPxDyZt7AdSMFXfFMhpI+eprah2/La3wp1qopl5m9mqLy8znfg9ojg1cDIGK8SvHrcsZtVxrfJ 696qKmihlln9su2W/tXuYiq7uszFlg3Vd+zequb4Ku6Ha+6H47PydX1u2f7MDVQMq+6H47PydX1u 2f7Me6H47PydX1u2f7MDVQMq+6H47PydX1u2f7Me6H47PydX1u2f7MDVR1uS114tmPXK5Y/Zm3e5 0lJLPSW91QkCVcrWqrYe0VFRivVEbzKiom+6oZn90Px2fk6vrds/2Y90Px2fk6vrds/2YEr4fOOL h+4jXts+K5StmypqrHUYxfWpR3KORvRzGMcvLNsqLv2bnKm3pI3wL/P85fGml9pOJ3L7pfNLmaZ3 6vqobpcMep8hp7v3KsmjZK+RKimRrUWRzu25fFqyL6tttRcBPGrxzXW/Umn1gwu56z49TuZFUecZ Fintsa+Crc3+ixNvBJ1fvts3YDdPDx/aex//AAv+tSjB/wC3DqZ+hv6q4cPH9p7H/wDC/wCtSjB/ 7cOpn6G/qrjhU+rb/wA5pfS73tsT7/76TOP7cOmf6Z/qrSxiuc4/tw6Z/pn+qtLGJKPWq7fpCtiP Z2v5Z/uqAASKoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH04Sfi+Yp/h39enPmfThJ+L5in +Hf16ckw/to7J+cKnCv/AA+r+ej+2tb4AOi8kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W +Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz 1R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKvkuPiJ6Zfpr9cVpqoyr5Lj4iemX6a/XFaaqAA AAAAB1uS113tmPXK42CyuvF0pqSWSit7ZmQrVTo1Vji7R6o1iOdsnMq7JvuvgdkAPPHSbyT9pyDM rjrFxe5kuaZTfq+W611mtMklPbmzyvV7myTdJZWoq7I1nZtaiI30kN7Ylh2J4FYaXFsJxu2WGz0T eWnobdSsp4I09ezGIibr618VXxO4AFE8S3DT7b3mvUXTq/ew/VrD95sayWFu2/iq0dWiIva0sm6o 5qovLzKqIqK5rnDTxLe2/wCdNO9RLD7D9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPvYo niW4afbe816i6dX72H6tYfvNjWSwt238VWjq0RF7Wlk3VHNVF5eZVRFRXNcF7GGdNLZxbcPmrGtt yxzhMqc5s2fZvV5BbLhFm9otyLTuVyM3jlkc9OZFRfSRqp4KheHDTxLe2/50071EsPsP1aw/aHJs Zmdtv4IlZSKqr2tLJuitciry8yIqqitc+9gMkY9o1xA8QmtOJ6x8TuP2XCMZ06qXXHF8FttzS5TP uaonLWVtUxEjcsezVYjPWng1ObtJRqhRcX2nuslZqVpDSW7U/Br1QQU1Vg1xu8dqqLXUxJt29FUP Ysatf1c9JF35nKngjVbo8AYx1JwXim4v6vE8K1J0Ws+kWC2HIqLIrrVVOUU95ulctMrlZBTNpW9n DzK5UV7nbonVPBWO2cCCa1a1YDoFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FV Aa1a1YDoFgNdqLqLde6W+k2jggjTnqa6pdv2dNTx+Mkr1TZETw6qqo1FVKK0V0Vz7WzPqHim4pbV 3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYmiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF 6Z2ytqahq9JK56I1VVU9Dp0RyNbFrAAAAAAAAAAdbktdd7Zj1yuNgsrrxdKaklkore2ZkK1U6NVY 4u0eqNYjnbJzKuyb7r4HZADzx0m8k/acgzK46xcXuZLmmU36vlutdZrTJJT25s8r1e5sk3SWVqKu yNZ2bWoiN9JDe2JYdieBWGlxbCcbtlhs9E3lp6G3UrKeCNPXsxiIm6+tfFV8TuABlbh4/tPY/wD4 X/WpRg/9uHUz9Df1Vw4eP7T2P/4X/WpRg/8Abh1M/Q39VccKn1bf+c0vpd722J9/99JnH9uHTP8A TP8AVWljFc5x/bh0z/TP9VaWMSUetV2/SFbEeztfyz/dUAAkVQAAADN+hWd3Vda+I5MxzCsdYcXv FudTNuNe91LbKbuj3y9mj3ckLOnM7l2TpupmIziWldyKJiJ5/LNpAFTY/wATOnN40pu2t90hvGOY TbZJEgut5pWwpcYWv5G1FNEx75XRyOVGs5mse5VTZvU6K08YGDT3eyW/LNP9RMJockqY6O03jJbB 3S31c8n7lH2rZHrG5/71JGs38ehnQq3NePtxlr2r2BAsQ1mxjMNTMz0mpqC6UF/whKSSsZXRRsjq oKhivjnpnMe5Xx7bIquRqorkRUOru/Ebp1Yc9y/BLu+4U3sDx+PIsguzoWLQUUMnWOFzkesqzuZ6 aMSNUVvgqr0MaMtuMoyzz6logz7Bxp4FFTW++5JprqbjOLXOWGOmyi8452NqVJlRIZHyNkc+ON6u byvexqLzIvgaCE0zG0ouU3PVkBnbigyu50eoulGn9fqJcMGwzKqm8Pv95oK5tBNzUlK2anp+9r/t dr1WRVVFRVRmyKh/eErJr/kNy1Fgt2YX7L9NrddqWDDb/e5XT1NZ8CvfmMqHoj6iCObZrJF339JE c7bczofhzR8fHGcXl/mWfd172iADPr+NPAqmnr75jOmup2TYtbJZoqjKLPjnb2vaJytlkY9ZGySR sVHcz2RqicqmIiZ2JK7lNv1paCBWeXcRelOHadWTU+qvs1xtOTrBHYYbbSvqKu7TTJvFDTwInO6R f4Komy9HbKdXhHE7h+WZvR6cX7Ds1wXI7rBJUWqiyu0pR+cmRpvJ3eRkkkb3NTqrOZHInqGjO1ib 1ETo5rgBT2d8T+G4bmlZp5ZcOzfOshtUEdTdqLErN39bYyRN4+8OV7Gtc5vVGIquVPV4HwuHFvpF SaOM1wpJ7pcMfS5w2aqhgpmx1lDWPlbE6Koimezs3Mc5quRV/BVHJzIqKrRq3McdbzmM9i6AVPbu JXAZ8GyLU7ILXkeLYjj6RyMvF9tjqWG5wv8A3OajbuskrHryo3drXOV7dm9UOhtPGBg093slvyzT /UTCaHJKmOjtN4yWwd0t9XPJ+5R9q2R6xuf+9SRrN/HoZ0KtxN+3GWcr2BmLLeJrNLFxc0GkNFp5 mtdYYcbmqaikorbRyPrJ31UbI7hG98qP7rG1JGKvM1eZzvg3bIpMsk4q8TtOX3rCsU071DzyuxuV tPeZcVsaVdPQTq3m7F8j5I0dIieLWcyp4eKKiNCWIxFuc9eycl1giWl2qWH6w4jDmeE1s01DJNLS zRVMDoKilqIncskE0TvSZI1eiov5lTdFRSWmsxlqlLExVGcbAABkAAA+nCT8XzFP8O/r058z6cJP xfMU/wAO/r05Jh/bR2T84VOFf+H1fz0f21rfAB0XkgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABFMitemVXneI3PKYMffmFB3/2KvrXRJXs5 4UbWdzRy867xcvaciL6O3N0JWUfqzo3l2a8Teg2rtnkt7bHpt7KfPLZpnNnd5wt8dPB2LEaqP9Nq 826t2Tqm/gXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZV8lx8RPTL9NfritNVGVfJcfET0y/TX64rTVQA AAAAAAAAAAAABRPEtw0+295r1F06v3sP1aw/ebGslhbtv4qtHVoiL2tLJuqOaqLy8yqiKiua5w08 S3tv+dNO9RLD7D9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPvYoniW4afbe816i6dX72H 6tYfvNjWSwt238VWjq0RF7Wlk3VHNVF5eZVRFRXNcF7Aonhp4lvbf86ad6iWH2H6tYftDk2MzO23 8ESspFVV7Wlk3RWuRV5eZEVVRWufO9atasB0CwGu1F1FuvdLfSbRwQRpz1NdUu37Omp4/GSV6psi J4dVVUaiqgNatasB0CwGu1F1FuvdLfSbRwQRpz1NdUu37Omp4/GSV6psiJ4dVVUaiqlFaK6K59rZ n1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT0OnRHI1sTRXRXPtbM+oeKbiltXdLhSby YHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5Gti1gAAAAAAAAAAAAAAAABlbh4/tPY/wD4X/WpRg/9 uHUz9Df1Vw4eP7T2P/4X/WpRg/8Abh1M/Q39VccKn1bf+c0vpd722J9/99JnH9uHTP8ATP8AVWlj Fc5x/bh0z/TP9VaWMSUetV2/SFbEeztfyz/dUAAkVQAADzR1AwXVzNdV+IqowuGiu+KY7k9mvWSY qrpWVOSxQQo/uaPZ4R9m2Vyt8XORiIirselxGcY01wrDckybLsbsvc7tmFTDV3qo7zNJ3qWJisY7 le5Ws2aqpsxGovr3N6K9DNXxFjj8oz1fpLJfGNmuO6qcJOAai6Z3SCjxH2W2Srq50pGyxW2jb2sS tmp0VGqkMzomuj3RN27b7bKd1rtorqhmumEti1i40cVpMUvNTRNjqn4NTUqPn7Zj6fspkrUVHK5r dlavVu/q3NDY7obpRilsyex2TDKWK05lVy116ts0stRRVM0qbSOSnlc6KNHJtu2NrUXZvTom0XxX hC4ccLyChyfH9MaRlfbJO2oHVVbVVcVHJvujoYZ5XxxKi7KisamypumxtFcRsQ1YeuuZmrKc4iJ1 zHy2q64gXx6F69aXcR9bWtis9fG7Aczq1byMWnnRZKSoeib8rWTscrnLvsiNTfwOm0exnBsq4dNT NZNeatLRadaq+qu1zqaiXsn0Voc/sLdHz7LtyM5XsXZf3Ru6L4Ej4q1y7XKKo4WsS0vyXsLxXUC3 vLq+29lZ6CgY+Kpklpqhy7TzpskaManR3OiqmxoRmG4u3EI8BlsdHPj0VvZakt08SSQOpGxpGkTm u3RW8iImyjSypjf9GYt6d2rLZ9Z1T/nXLKWdVXEHwmaZNzluqeNaq6aWBlGx9sv1tZS3JKF0kccS U9XC5WTvTmYqOkau6JuiKuxr+gq47hQ09fCyRjKmJkzWyN5XNRyIqIqepevVCmrNwXcMlhutJeKD SulfLQTJUUsFXcKyqpIZEXdHMpppnQt2Xw2Z0LsNKpidiWzbromdLZuzmfGWGanSuTjRuOstTmOY 1MOT4LllXYMNsks39gWVtIrFgq5qXq2ZalyPa98jXorOZG+CIkq0M11y7iD1gxfHLTTVGJUeltor Ezy1UszG0tTd3uWkgpI0YqpJAxYZJ2ubu1EVrd9063NqFwr6Bap5G/Ls206pau9TRpFPXU1ZU0Ut QxERESZ1NJH2vRET0+boiJ4Ihwqrg94aaiaz1EWklpoJrExI6KW2Sz0L0ajubaR1O9izJzdV7RXb qq777qb6dMxlKGMPdpq0oy69c69ecc2r/IW/UzQU1PLUVL2shiY58jneCNRN1Vf5jIeJ6Z6j6X6e T5bwj6+45fdNYmVl0t+NZNQtqKCKPnfJNHDXxObKxnP2icrk2Rd1cu6uVdgFJXTgr4Yrxdaq71el VKySunWpqaemuFZTUk0iruqupYpmwLuvq5NjSmqI2p71uqvKadvbMfL5M06nZ/f9ab9wnas2G6Uu nlLfZLzTQ1dXbm3Cktl0fGyKNqwudG2RJHxObEquaqIvN6tltXMtFtQbpqVpdUawcWuO1VbZcmiv FitbcNgt9TcpINnT08cjatXbPj3a7ZrkTdq7LsiGg8l0p02zDCGabZJhNorcYiijhhtbqZrYIGxp tH2TW7dmrU6NVmyp6lQjenfDPodpVf8A2VYRgUFJeUhWnjuFVWVNdUQxqmysjkqZJHRoqKqKjFTo qp4G+nGWpDGGq0vxa88s9cxsiOaNXMqvhCqIqHV3iMxy8ytZkaagT3J8Ui7TOtszN6N+y9VZyb7L 4JzJ8pCeMTJ9H864Xc59qpltlpafOqKgv01vtzqaKouiVkXeHLJyNbUPXmbvK1Xo7dPSU0Zqbw06 Haw3eLIdQsApbjdYYe7pXQ1VRR1D4v8Avb5KeRjpGdV9FyqnVTl3Hh/0dummtPpBUYLRQ4fSSxTw 2ukklpY2yxyJI1/NE5r1dzpzKquVXLvzb7qYiuM4qKrFybc2tWWvX2/LxUn5Ryhrk0Kxuot9Uy22 y1ZtZqi51K0vbw0lEnasSSSLdEfG2V8K8iqiLsibpudbrtorqhmumEti1i40cVpMUvNTRNjqn4NT UqPn7Zj6fspkrUVHK5rdlavVu/q3NZXux2bJbRWWDIbXS3K2XCF1PVUlVE2WGeNybK17HIqORfkU qvFeELhxwvIKHJ8f0xpGV9sk7agdVVtVVxUcm+6OhhnlfHEqLsqKxqbKm6bCmvKG13DzXXM7YmMt sx8tqBVTJKfyilghqqhJZU0ekjWVU5e1el0duqJ+fZV2PxT6T5BPnOcagcJfEJb7XUXG+SrlOOXK 3R3K2uvEaIkyOcitmpnr05+XdVX8yIiXBqTw/wCkGrt6tOR6g4bFc7pY0VtBWMq6imliYq7qxXQS MV7N+vK7dvVenVd+mzfhP4ftRMlqswynTyKS816IlZV0Vwq6B1VsmyLMlNLGkq7dN3oqjThibFev VG3ONcxPhH/1xuFzWC86w4XfqnKMftVqyDFcmr8avHmh6voKqrp1Yr6inc7qsbu0TxVV3RevVC5D osJwXD9OMbpcQwTHaKyWeiRexo6SNGMaqru5y+tzlXqrlVVVeqqp3ppVlM6lm3FVNERVOcgAMNwA AD6cJPxfMU/w7+vTnzPpwk/F8xT/AA7+vTkmH9tHZPzhU4V/4fV/PR/bWt8AHReSAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFNaoa23/BeI zRHRq3Wm31Fs1P8AZL5xqpkf29N5toGVEXY7ORvpOeqO5kXp4bKXKRTIrXplV53iNzymDH35hQd/ 9ir610SV7OeFG1nc0cvOu8XL2nIi+jtzdCVgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADps0utb YsOvt7tsSSVlvtlVVU7FTdHSRxOc1NvXuqIBTOovGvpRg2c1umGOY9nGpOXWpEW6WfBbC+6zW7fw Sd6ObEx3iit592qmzkQ5GkfGXpPqxnC6Wz2nL8Fzh0DqqDG80sj7VX1MLUVXPia5XMk2RFXZHc2z XKiKjVVIN5MDHbTb+ELGMwg5am95pWXK9364u9KatrVrZ41dI/xcrWxtb19aKvrU66/cYOi131Dw SfU3hO1ftF2fkMFhxjIMswCOmgorhWPSNvY1M0u8au5eZeTd3LGqoi7AbBBgLiG4lMZunFpfdDtU OIu9aQ6f4LZaOomWwVklFcL7daqNkzWrVRMdJHDHDI3dreXd3iq7py/vhu1msmoGt+a8LGK8R+U6 kYBe8R8/2PJluksd9s1Q2dsNRRJXoyOVztntlbIqbtTZEXdXbhqHLeJ3SzGNDsg4g6GquORYnjcs 8FU61Un9kSSwVfdJmxsqFiR3LKjk5lcjVRqq1XJtvZ9ruEV2tlJdII5I46yCOoYyRER7WvajkRyI qpv167KpgrydegGG6lcGDoc8veWXq15wt0t1zs1VkFStvjZHc5V56eBHIkErlYivezZzlVVVeqne 8WOc3HEOILH8a1f1P1G0y0MTFmuoL3hr56Zk997wrFgraynjfNE1IeXlb0aq7Lv+EBuIFC8KlI1l BkNyxTick1iwOtngdYpK+rjuFxtMiMXt4Z61i80qOVWq1kjGvYibKq7qpM+Iu+XPG9FMrvFn1Os2 nlZBRIkWT3eBJqa28z2tWRY1VOd6oqtYnX03M9F34KhY4PLnPdb7JpDZcS1Q0Q4nNeM1vEV9tsFz gy6husmPXuimkRlQje9UkcEKu3RWLG9FROjd12cmktVr7neuHF3FwwWLUnJcFxDF8OTK7/WYzVpR 3O41UtQ2KCmbU8quhia1yPVWbK7dyL+9Voa0Blmth1n4QdPdXc3v+p1TqLgthsL7viTMlqn1V8pa 9ka81PU1CRtSandIrdnK5XtRNvlVYnhnD3xE5lovjWs+P8WOfQ6s3+20ORNguVzRcWbJUNZM6jfb WRKxIUjerN2pzcyc3h6KBtIGCuJviRhh4kbDoBqjrxV6QYdaMSiyDJLnjtTJT1l1usr0ZHQ09Ukb pYYWt3k5kRrnJzIuy8qp/eGjiNxuk4rKXQzTbiJvOr2n+W49UXGimv1XJWXGyXWmVXvh71Ixr5YZ IWuciO3VFRNlTZVcG9AeaGJag2rJ8gyWx8V3F3qzo5q556roqO1Jd5LLYaSlbKqUj6Zqx91qIeXl 3dI9Vem/Xrzrb3FDk2tuA6S6QQX/AFSyKpxSeuSLUvPcDtvJXdySHenqImxJKsEUjl3kljReqJy7 cyMUNonzqKiCkgkqqmVsUMLHSSPcuyNaibqqr8iIZU4XpMPvudMyPQrjPvWpeGrbpW3rF8nuy3e4 QTqrewqYpJuSppWou6ObI1Wu36bLty2/xPY83J+H3UC3Ovd6tKxY/W1jam0XCSiqUdBE6Vre1jVH cjlYjXt8HMc5q9FUCY4FneK6nYdac/we6+crDfaZtXb6vsJIe2hd4O5JWte3w8HNRfzHfnm/guV5 Pw0eThxHOtM8qv8AV5fqLHZbJafPd0krqGz1VTK9nPSU8u7IGIztF5Gpyq5GK5FRNlsDiH0v1T4W NFa7iAwDiW1RyPJ8LdSV10ocnva11ovUDp446iJ1I5vJToqSOc1Y1RWomyLvs9A3ARy26hYdd85v Wm1tvTZ8kx2jpK+50SQyItPBVLIkDlereRVd2MnotcrkREVURFTfsMZvtNlGN2nJqNjmU93oYK+J rvFrJY2vai/n2chiLQXSKj98M18ldqDqA9MVTGLhAx+T1TmVq1NG+V0FW1XbVEDHOVI4n7tjb0b0 A1ZonrjievFlv99xC33ajp8cyOvxiqbcooo3vqqRWpI9iRyPRY1505VVUcvXdqFiHnfwa6J5NrBi +q/nDWfPMMx+i1RyOG30eG3XzXPLVLIx0tTUVDWufJ0WNjI90YnI9VRyuTbh0fF9q9ptwH5Zkd3y 9t1znHM/rNN7bktyia93oTN5a2duyo98cKybKqLurGK7n9LmD0cB5aaj8RelujuEwam6HcfOaZ9n 9inpaisx/IrtPWWvIollY2qhSlkhRlLuxz3MWNUVqN2RVVUcnp5YbxS5FYrdkFDzd2udJDWQ83jy SMR7d/5lQDngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyr5Lj4iemX6a/XFaaqMq+S4+Inpl+mv1x WmqgAAAAAAAAAAAAAAAAKJ4luGn23vNeounV+9h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVUR UVzXQXRXQDVjU/PqHiK4yYLa7J7JvDieG0L0ltePcuyPrFTmc2Wqkc3nRyq7kTl67o1I9YAAAAAA AAAAAAAAAAAAAAMmaeYxxB4Fh1vxP2je/dx7X+yPZNQxc/PK+T8Hd223Pt4r4H80xdkL9UdR3ZVj 3mO6L5n7eg72yp7H+x38vwjPRdu3ld08ObbxQ1oZMyfUPDsC4g9TPZZeO49+8zd3/seWXn5KFvN+ 5tdttzt8dvE5V+xTh4pnSnLPLXlunqe34N4TvcLV3qJtUxVNOf4dLOZ06eaapjr1Q5Wcf24dM/0z /VWljFLVGoeHZ7rDp97E7x37uPnbvH9jyxcnPS+j+6NbvvyO8N/AukitzFU1TG/6Qu4uiq3Taprj KdHn/mqAASqYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH04Sfi+Yp/h39enPmfThJ+L5in+ Hf16ckw/to7J+cKnCv8Aw+r+ej+2tb4AOi8kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKP1Z0by7NeJvQbV2zyW9tj029lPnls0zmzu84W+ Ong7FiNVH+m1ebdW7J1TfwLwKa1Q1tv+C8RmiOjVutNvqLZqf7JfONVMj+3pvNtAyoi7HZyN9Jz1 R3Mi9PDZS5QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB/HNa9qse1HNcmyoqboqH9AGNMM0t4oOD e5XrFdB9PrNq1pPdbjPdLRYJ7/FZrrj0kzuaSnjmnRYZafdd2oq82+6ryqqq7k5BptxUcVGZYHVa xYLjWkmDYFlNDl7bZDeW3y83KupFcsLFlia2CKJUe9HeLvS/fbdNhADLOeaX62aTcTd54ktEcHoc +tudWSktGU4y+7w2ytZU0uzaesp5p07JyJG1GOY5Wr4qirv6NlaNXziRyrI75kOsWEY9guNOghgs mOwXBtzubZmqqy1FTVxKkCNciojY2I7b1uTb07cAGVuAzANcdDcEm0E1N0vgt1nxqquNRbMqp77T VMV2SesdKxraVnwsXoyOXeTb8FE23XpNtVMj4pMO1ClrsF0osmqOn1ztscK2iG7U9pudurGqvaPd JVL2NRDI1U9Hdqou/qT0rzAGWOFjRDUHGNadSddcs03seltvzWjoKGlwu018NWiSU/Mr62pfTtbA krlcuyR7/hv5l39J0n44NEsy140MkxXAY6GqvtqvVvv1Lbq+Xs6a592l5nUsrl6Ij2qu3N6PM1qK qIvMmgABh3ifwTi/4qtG58fptGbXp8+w1lDeqex1mTUlfV3+shmaqU6TQ7QU0DGLK/me/me9sSbM ajlWUZdgPENZNbMc4v8ATbSWkrr5eMTXFsz0+rMhpoKmONJ+2hmp63rTvkaqNR26oitaiJ1cqt10 AMxWzTriN4hLDqjbOIdlHgmJZpYH4/YMMo6iluc9re9io+4VFXExO0l5+VWxterETdFTdEVYVjq+ UGxjSGzcPWPaTY3bL5ZaKmx+l1O9k1JPboqOBGxsq0t743VD5exYicjmKiu9Jf4JtIAZV1G0c1v0 617x7iZ0gtdHqLc3YizDMxsdbXQWqpusccjZY6+nlc3sGS87U5mLyt2RGt/CVW2JpPkfE9mea3K9 an6d2DTrDYrclPQWV1zju13nrlfutTJPTu7CKJGej2ac7lXruhcwAyPfrvxe3HFrlplqvwg4dq25 z6iCG+w5Jb6O0V0TnO7KSWiqkWeFWsVqORiPXdq7L6z+6a6YcV3DFw+6T4Vp5T45qHV4o2tjyyw1 Fd3OWtiqJZJYWUNbMnKzu6ycm0jUR7WptyImxrcAY7xDSDV3UniuwriEyTQWzaM0OGUF0guSRXqj r7lk8lXD2Ucc/c0WNIoV3eiyOc7deieCt1HqJjVRmen+T4fSTxwT32zVttilk35WPmgfGjl267Ir t1JCAMIYzw269am8FrOGnUHAKXT3KNPm22fEr9JfKa4UtzrqWeWRsqx0/M+CPlRjF593fDKqNXkV FkWsNm4wuKTTRdAcn0Jtem1BkEtJDlGVyZXSXCBtLFMyWVKGmh3mc6RY0RqSo1ERVaq9edNmgDh2 e1UVitFDY7bF2dJbqaKkp2b78scbUa1P5kRDMVlwDXHTTjdz7UuxaXwZPguq1LYKeqvEV9pqV9jW hg7CR0lPJ8JPunM9EjRd/RTfffbVIAzxwUaU59pHhefWnUKw+aau96jX2/UMfeoZ+2oah0awy7xP cjeZGr6LlRybdUQpiwcGGp2XcMGqWleSQw4nllz1Rueb4nVT1MNRCjkmikpJpFgc/lZIjZGKi+m1 Hbqxdtl3cAMyM1F47cppbXitHw7Yvg91dPTtuuV3TKKa52yOJj2rO+noqdUqJFe1HcrHqzl5kRXd OY00m+3XxP6AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+Kiqioiqm6eKeoxHb/KV41pfrFftAOK3H X4hfLFXLTQZJbopJrVcKd2zoKh8XpTU6SRujdsnatRVXmc3YCZ+S4+Inpl+mv1xWmqjyg4Z/KP6P cMnBfp9p1TWu55jqFTtuiOsVCxYYqd8t0q5IknqHNVG8zHscjY2yO9JN0Tfc9NtL6vPbjp/Yrnqf R0FFlNdSMqrnRUDHNgo5ZPT7u3mc5XLGioxXKvpOa5yIiKiIEpAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAABQ+vf8Abh0j/T/9ViO1JnqBpJp7ql3D2d4/5z82dr3X+y54ez7Tk5/3J7d9+zZ4 77bdPFSIe5J4fPm//pWu+2KFzD3ZuVVU5ZT19URuemwnCmDowtu1dmqKqYmNVMTGuqqeeqN+58wf T3JPD583/wDStd9sPck8Pnzf/wBK132xrye9ujvnyT+leD+lX8FP3vmD6e5J4fPm/wD6Vrvth7kn h8+b/wDpWu+2HJ726O+fI9K8H9Kv4KfvfMH09yTw+fN//Std9sPck8Pnzf8A9K132w5Pe3R3z5Hp Xg/pV/BT975g+nuSeHz5v/6Vrvth7knh8+b/APpWu+2HJ726O+fI9K8H9Kv4KfvfMH09yTw+fN// AErXfbD3JPD583/9K132w5Pe3R3z5HpXg/pV/BT975g+nuSeHz5v/wCla77Ye5J4fPm//pWu+2HJ 726O+fI9K8H9Kv4KfvfMH09yTw+fN/8A0rXfbD3JPD583/8AStd9sOT3t0d8+R6V4P6VfwU/e+YP p7knh8+b/wDpWu+2HuSeHz5v/wCla77Ycnvbo758j0rwf0q/gp+98wfT3JPD583/APStd9sPck8P nzf/ANK132w5Pe3R3z5HpXg/pV/BT975g+nuSeHz5v8A+la77Ye5J4fPm/8A6Vrvthye9ujvnyPS vB/Sr+Cn73zB9Pck8Pnzf/0rXfbD3JPD583/APStd9sOT3t0d8+R6V4P6VfwU/e+YPp7knh8+b/+ la77Ye5J4fPm/wD6Vrvthye9ujvnyPSvB/Sr+Cn73zB9Pck8Pnzf/wBK132w9yTw+fN//Std9sOT 3t0d8+R6V4P6VfwU/e+YPp7knh8+b/8ApWu+2HuSeHz5v/6Vrvthye9ujvnyPSvB/Sr+Cn73zB9P ck8Pnzf/ANK132w9yTw+fN//AErXfbDk97dHfPkeleD+lX8FP3vmfThJ+L5in+Hf16ce5J4fPm// AKVrvtix8RxHHsFx6kxXFbf3G10PadhB2r5eTne57vSe5zl3c9y9VXx+QlsWLlFzTry2TGqezqjc p8I8I4W/heIsaUzNUTriIjKIqjmqne7gAFx54AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARy/Y1gNwyvGspyS1WeXIrG+qjx6tq2s7zSvqIk ZUNp3O9JFfG1EcjfFqdSRlG8UGi2Y6qT6Y5Tp1V22myTTzN6DIY1uEro4ZqFOZlXArmNc5Odjk8E Xfl29e6XkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACi884usMxHUK66W4xp3qLqJkWPRQTXynw6xNr WWrtm88TaiWSWNjXvZ6SMarnKm/TdFQvQyZedGrlftatQtTeEfiXpMVzGoqqSjzrHay2Q3a2z1sE PLD20blbLSvWPxexV32dt++AtvC+KHR7NNLL9q+2+1NjseJzVFLkcV7o5KOss1TAiLLT1MDkVzZU 5m7NbzcyuRG7quxAKLj30vRtovGU6capYhiN+nhp7dmGQYytLZZlmXaFzpkkc+Jkm6K18kbGqi77 onUzBxMavak6zcFutWI5rjlkocp0wzS3WrK6rGUkmttygZUxOWpia9efo7lV8blVW8iKqt3VG2xr No7qznWgdyi1V49cHg0yyGgpkmr5NN6SmpXU8j43U7mTd/RG7u7NWqnr22A0frVxD4FoY2yUWRUt 8vd/yeeSmsWO49b3V90ub42o6TsYUVE5WNVFc9zmtTdOvU6bTLit091Mq8msDcfy3FsrxG3rdbni +TWruF0bR8u7Z441e6OSNV2bzNeqIrm77czVWjam3LgHlBdErdmF+bcKOXSCfHrJdJ2JEyuvEEyr UPYiucjZJIOVeVHKuz0Tdd03vjOM30Un1FyTAoUtU+qlPgtVXTPitbpKyns+7kRklYkatjYsrkck LpEVVcjkbsqKodRohxi4FxBVVpTTzBs9ktdxon1VVfKq0MjtlslaxX90qalsrmJUK3kdyR86Ikje ZyKuyR+q4/NLHUtzyPGtOdUspwqzzywVuZ2PGFqLJH2Sqk0jZVkbJJHGqLzSRxuaiIq7qnUr3hJs NzqfJWQWjDKZ6Xm54Vk6USQN+EkrZZK5I1TbqrlerUT19EQivB/hWvGScJWG3zCOL/E7Bh1PZZIq i21OnNLVMtnZq9KmGonfWM5la7tFc97W7ovMqbKBZ/Frxe3TTzB9Lcn0Ztt9v1v1AyaysgvlnoaW ppamglmR8lEzt3IqVVRE1zGNVibenu+NzUNO4dkc2W4xbskqMZvOPSV8Pautd5hjiraVd1TkmZG9 7Gu6b7I9ydU6nnpqJp1YdJOEXhjw3GdUqPUGw0OtlgqaDIaWmSngnp5qmul2a1JZURGOkc38Nfwf V4J6SAUpqdxXYPpzny6VWvDc4z7MYaFtzrLNh1mSvmoKV67MlqHPfHHGjl22RX83VvTZzd/3hXFX g2ounmVZxh2KZlX3LCqh1HfMRfa209/o6lNvgXU00jWc3KquRe05VRrtl3aqFS2vJtZuIDid1cwX DdVotLcf0xfbLZKtpsNDV3e8y1ELpO2mmq45EjibyqjEa3qip16LvCuB6rjq9f8Ai4jh1Aq83Vk2 PRefaqGnikuDo6StjdJy07GRK3mbytcxqI5rWu677qFucAvEVnXENorbch1CxbJI7t/Zc8mQVdBS 09subXV9SyOOkWF+7uxjYyJ/NEzqzfdyqrl+XHDxJZtoFbcBpMHxbJaqqyfMLTb57hb6ClqYX07p 95qBvbvT+yp42PbGnKibcy9oxURT4eS/ex/AxplyOR3Ky7Iuy+C+dqzocHyizmsxfRCV7kaxmtuL Oc5eiNT+yeqr6kAjusvEXc8T4oNA8kvkuc4pjN7xvIai44jO2Raurq+zSOlgloKaSRk9SsrmJG1O dUV6bKnVUufS7i2wfUrUubR+44PnmCZelvddqS2ZhZm0L7hRtdyulp3Mkka9EXxRVRejunou2rXW +jpavyivDgtVAyXu9hyqaPmTflelIqI5Pzpuux9NZkRvlF+HZ7U2c/HMqa5U8VRKVVRF/nUCcZZx l4HZczv2C4Zp1qRqTcMUkSnyCXDLAlfT2ufxWCWV8kbXSoiLvHHzuRUVFTdFRLL0i1fwLXLB6TUH Tm8LX2qqfJA5JInQz01RGvLJBNE5EdHIxeitVPkVN0VFXCfA3gfETeMY1Hs2C8S1mwi5WfUK8xZD Y6zBYbpVsrnSN3qJJn1UblSRGojd27fBuRFXZTR/Bdphb9PKHUq5W7Xiy6ny5RmlZc7tU2i1R0FP Q3fla2riWOOeZqPVUY5URW7dOioqKBYOvPERp/w5WvGb5qO25R23J8gp8diqqSKN8dHNLHJIk0/M 9qtha2J6uViPd4bNU6Gr4tNP8f0mq9YtQsWzXB7VHdG2iht+Q2V1PdLrO9rXQpS0jHPfJ2vMqNRe V3wb1cjUaqpWPlEaGlucPDxba+Bk1NV654xBNG9N2vY5Khrmqi+KKiqh8+OqSG1aq8MeU5E9sWK2 3UiNlxnmXaCCrkiTuckir0aiObIvMvRNlUCwsW4ysGu+b2HAM2041J02ueVyLT2B+Z2BKGnuc6Jv 2EUscsjWyqipsyTkcqqibbqiL3Oq3FLgml2b0emFLjOX5xmtZRLc1x7EbUlfWU9HzcqVE6ufHHCx XdEV70VenTqm9SeUlkhr8N0kxW1va/KrrqpYXWGBi7z9rG6TnlYidUaxHojneCc7d16oNA5IbT5Q riXtmSvYy9Xq2YtcLF2q7PntkVG6OZYt/FjZXQtdt05m/mAtDEOLbBM6xrMbljuG5u/JsDSNb5hN TaW02QQdp1jVKeWRsb2ubu5HJKrVRF6+CLE+AXiKzriG0VtuQ6hYtkkd2/sueTIKugpae2XNrq+p ZHHSLC/d3YxsZE/miZ1Zvu5VVyw21PivXlK9TK/GHNmorNo9Ba8gfB6TGXOSsZLBHJt/vnd29N+u zVQk3kv3sfwMaZcjkdysuyLsvgvnas6AXdrHrPgGg+FS53qNdZKS3pURUVNDTwOnqa2rkVUip4Im IrpJXbLs1PUiqqoiKqV3i3GVg13zew4Bm2nGpOm1zyuRaewPzOwJQ09znRN+wiljlka2VUVNmScj lVUTbdURa946pIbVqrwx5TkT2xYrbdSI2XGeZdoIKuSJO5ySKvRqI5si8y9E2VR5SWSGvw3STFbW 9r8quuqlhdYYGLvP2sbpOeViJ1RrEeiOd4Jzt3XqgFe6sax6h57x6W/SZ1p15s2J4tjqVzbTiE1P QyXKsbdOx851CpUJ21rcxWt9Jeddk+DTmdvuPOsqfg+I3TLGYzeshW2Qdv5ss0MctbUpuiK2Jsj2 MVURd+r06Iv8hmmi/wC6qXD/AMxDf16w1NfUV1juLWoqqtJMiIn/AIigefls4rdW9WPJwZ1qLd6P NbDltBZ6qrhy+GKC3UtWrrrLHG2gmpZGyc0MTWRPVY413avVyqrlt21cemnWE6fYxesuw7U+uxll FQUVxz+PHnz2NtUrGRySPqnPSSVvbbtWVkb2udvyucqpvQ2DvY/yJNVyOR3LYrsi7L4L59n6F48U FBRUXky71bqSljipqbALSyGJrdmsaxtNyoifm2T/ACAXZrHxGadaKUtgbfvO17vGWTLBj1hx6iWv uV2e1qOcsETVRFa1qoqvc5rURU69UOr0p4pcG1Rzar0xq8XzHBs0pKLzk3H8vtKUFXU0fNyrPArX yRzMR3ReV6qnXp0XbIucWbUOu4u+HWTF9TqLAqi8aPR0FivFxsTLtDJcGI59TAyKSWNqSvgki9Lm 322bsvMhb9PodnC8U+lmXaw8YGNZDluKUt2qrNjlNhsFprLjRTwdjUpzMrHucxvouRVY5EVr9v3y oGvwAAAAAAAAAAAAAAAAAAAAAAAAAAPNXyyfDd7JcJs/EjjVBzXHFuS05B2beslulk+AmX/gpnq1 fzT9ejD0qKs4m890i0/0Vyeu1unY7F7nQzWqehanPUXJ07HMSlp2eL5n7ryonhtzKqI1VQPH7yVX Dd7dfEJDnl/oO2xfTfsrtUc7d2T3FVXucP59ntdMv5oURfwj3UMReS3rdPMK0nuGhbLHdcW1Kstd Ndcnst9g7vcJ2zuTu9U1qonPD2HYM3RPRcnVE5kV23QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAZ9ym18WmDa6syzBrlad QtMspq6KmuWOXOaO31uMp6EUlVRzI3lmhRu8r437vXbZqKq8xoIAVxrdxC6ScOdht+Uaw5PJYrVc qzuEFS231NWnbcjn7ObTxvcibNXqqbb7J6z76Ka96T8ROK1Wa6OZX7ILLRXB9rnqe41NJyVTI45H R8lRHG9dmTRruicvpbb7oqJYAAz/AO714TvbT9pT21v+zP2QexbzZ5iuX/bTvPduw7bu/Zfu3o8/ Pyevm26lga1696T8O2K0ua6x5X7H7LW3Blrgqe41NXz1T45JGx8lPHI9N2QyLuqcvo7b7qiLYAAr /RTXvSfiJxWqzXRzK/ZBZaK4Ptc9T3GppOSqZHHI6PkqI43rsyaNd0Tl9LbfdFRK/wDd68J3tp+0 p7a3/Zn7IPYt5s8xXL/tp3nu3Ydt3fsv3b0efn5PXzbdTQAAr/WvXvSfh2xWlzXWPK/Y/Za24Mtc FT3Gpq+eqfHJI2Pkp45HpuyGRd1Tl9HbfdURWimvek/ETitVmujmV+yCy0Vwfa56nuNTSclUyOOR 0fJURxvXZk0a7onL6W2+6KiWAAM/+714TvbT9pT21v8Asz9kHsW82eYrl/207z3bsO27v2X7t6PP z8nr5tupYGtevek/DtitLmuseV+x+y1twZa4KnuNTV89U+OSRsfJTxyPTdkMi7qnL6O2+6oi2AAK /wBFNe9J+InFarNdHMr9kFlorg+1z1Pcamk5Kpkccjo+SojjeuzJo13ROX0tt90VEr/3evCd7aft Ke2t/wBmfsg9i3mzzFcv+2nee7dh23d+y/dvR5+fk9fNt1NAACv9a9e9J+HbFaXNdY8r9j9lrbgy 1wVPcamr56p8ckjY+Snjkem7IZF3VOX0dt91RFaKa96T8ROK1Wa6OZX7ILLRXB9rnqe41NJyVTI4 5HR8lRHG9dmTRruicvpbb7oqJYAAz/7vXhO9tP2lPbW/7M/ZB7FvNnmK5f8AbTvPduw7bu/Zfu3o 8/Pyevm26lga1696T8O2K0ua6x5X7H7LW3Blrgqe41NXz1T45JGx8lPHI9N2QyLuqcvo7b7qiLYA Ar/RTXvSfiJxWqzXRzK/ZBZaK4Ptc9T3GppOSqZHHI6PkqI43rsyaNd0Tl9LbfdFRK/93rwne2n7 Sntrf9mfsg9i3mzzFcv+2nee7dh23d+y/dvR5+fk9fNt1NAACv8AWvXvSfh2xWlzXWPK/Y/Za24M tcFT3Gpq+eqfHJI2Pkp45HpuyGRd1Tl9HbfdURWimvek/ETitVmujmV+yCy0Vwfa56nuNTSclUyO OR0fJURxvXZk0a7onL6W2+6KiWAAM/8Au9eE720/aU9tb/sz9kHsW82eYrl/207z3bsO27v2X7t6 PPz8nr5tupYGtevek/DtitLmuseV+x+y1twZa4KnuNTV89U+OSRsfJTxyPTdkMi7qnL6O2+6oi2A AK/0U170n4icVqs10cyv2QWWiuD7XPU9xqaTkqmRxyOj5KiON67MmjXdE5fS233RUSO6mcIfDpq9 lL84zvTaGpyCaJsE9yobjWW2oqGNREa2V9JLEsuyIiJz79ERPBEQuIAQvBtGNKdNcGl00wjAbPa8 XqWytqbYynSSGq7VvLIs/PzLMrm7NcsiuVUREXohXVi4FOE7G7/R5JatG7elTb6nvlHBUV1ZU0VN Nvuj4qSWZ1OxUXqnLGmy+BfIAhOq+i2lmuOPxYxqthdBkNvp5kqadtRzslppUTbtIZo1bJE7bpzM ci7dDqdL+GzRDRi03izaa6f0dnhyBqsuk3eJ6iqrGqipyyVMz3zOREc7ZFfsnMqpsqkzzPMcb09x K8Z1mNzbbrHYKKa43CrdG+RIaeJque7kYivcqIi7NaiuVeiIqqiHPtlyorzbaS722btqSugjqaeT lVvPG9qOa7ZURU3RUXZURQOj0102wrSHCLXpxp3ZfNOO2Vj46Gj7zLP2LXyOkcnaTOfI7d73L6Tl 8dvDYq3I+BfhRyvIq7KLzo9QOrLnUd7roqaurKWkq5t91fLSwzMgkcq9VV0a7qqqu+5fAAgmf6Ga Saoadx6TZvgltr8SgSBKe1xo6mipuxTaLsVhVjoeVOicit2RVTwVUO8wTBcW00xK3YNhVtdQWW0x uipKd1TLUOY1z3PXeSVzpHKrnOXdzlXqd+AKg1G4SOHfVnMnagZ5ptT1+QS07KWorYa+rpHVcLUR GsqG08rG1DURETaVHdERPBEQ7W08N2iOP6l0mr2P6f0Vqyqit0dphq6CaamiSkjh7GOJ1NG9IHIy LZjVdGqtajURU2Tbna6ayYxw/aVX7V/MqC6Vtmx5kD6qC2RRyVL0lnjhbyNkexi+lK1V3enRF8V6 LNLfWxXGgprhA17Y6qFkzEeiI5Guaipvt6+oFc6UcNOiGht6vN/0pwWHHqu/qq1yQVtS+F27+faO GSR0UKc3XaNrU8E8EO+1V0j051uw+fAtU8Wp7/YqiWOd1LLJJErZWLuyRkkTmyRuTdfSa5F2VU8F VCYACtMe4b9GMVvGF5BYsPdT3DT2jrbfjk7rnWSuooKvfvDVR8qpMr+Z3pSo9yb9FQ729aUYBkOo uOas3iwd4yvEqerpLPcO9Ts7tFUs5J29k16Rv5m9N3tcqerYlwApzUng/wCHHVvKJs1zrTKmqr7V RJDVV9FX1dumq2IiIjZ1pZY+22RET4Tm6IieCIWJgmA4Xpji9FhWn2M2+wWO3tVtNQ0MKRxM3Xdy 7J4uVVVVcu6qqqqqqnfgCJag6U4Dqm7G355YfOa4jfqTJ7N/ZU0PdbnTc3YT/BPbz8vO70H8zF36 tU5+c4HhupmL12FZ/jVBfrHcmIyqoa6FJIpERUVq7L4ORURUcmyoqIqKipud8AKe014ReHXSPJ4s zwTTWnpb7TQrT0twra+ruM1JGqKitgdVSydiioqp8Hy9FVPBVQ7jVnhx0V1xqbfcNT8EprtcLS1z KG4RVM9FW07Hb7sZU0z45UYqqq8vNy7qvTqWSAITpVotpbojY58d0swuhx+iq5lqarseeSaqmX/f JppHOkldt03e5VOn0o4adENDb1eb/pTgsOPVd/VVrkgral8Lt38+0cMkjooU5uu0bWp4J4IWcVVk XEvpbZdBbrxIWytr8hwy1Q1EzpbZSqk86QVLqaVI46hYt1SVj03crUVG7oqoqKoTfOcDw3UzF67C s/xqgv1juTEZVUNdCkkUiIqK1dl8HIqIqOTZUVEVFRU3K8014ReHXSPJ4szwTTWnpb7TQrT0twra +ruM1JGqKitgdVSydiioqp8Hy9FVPBVQtDHL5SZRj1ryWgjmjpbtRQV0DJkRJGxysR7UciKqI7Zy b7Kqb+tTsQIkzSnAY9VZNbWWHbNJbCmMvufeputt7dJ+w7Hn7L91RHc/Jz+rm26EtAApC1cFPDFY rLl+OWbS6GhtWdwrT32igutcyGojWRJOSNiTbU6c6Iu0PJ4Inh0LCyrSnAc201qNIMnsPfcRq6CK 2TW7vU0fNTRo1GM7Vj0lTbkb1R+/TqviS0AQDPNBNH9TsIt2nOfYJQXqwWdkLLdT1LpO0o+yYjGO hnRySxvRqInO16OVPFV3Ov0n4ZtDNELlW3zTPT+ltd1uMaQVVynqqiurZIkVF7PvFTJJKjN0avKj kRVROnRCzwAAAAAAAAAAAAAAAAAAAAAAAAAAIJrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01P H4ySvVNkRPDqqqjUVUBrVrVgOgWA12ouot17pb6TaOCCNOeprql2/Z01PH4ySvVNkRPDqqqjUVUo rRXRXPtbM+oeKbiltXdLhSbyYHgci89Ni9M7ZW1NQ1eklc9Eaqqqeh06I5GtiaK6K59rZn1DxTcU tq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVVVT0OnRHI1sWsAKK4leGr23vNeounV+9h+rWH7zY1k sLfHxVaOrREXtaWTdUc1UXl5lVEVFc17hq4lfbe86adai2H2H6tYftDkuNTO8fBErKRVVe1pZN0V rkVeXmRFVUVrn3qUVxK8NXtvea9RdOr97D9WsP3mxrJYW+Piq0dWiIva0sm6o5qovLzKqIqK5rwv UFFcNXEr7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9QAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMteUwx5t64Oc7uHnu9W99lp4q1kdvuElNHV7ytiWG paxUSaFWyqqxu3bzNYvi1CqNfKDUHRPQPh6s2j+q2aw3jKNSscpe+Xe/1Va56VdHI3usvM/eSjR7 I17uu7Oi9Opp/i30tyLWrhvz3TDEVp/PV9tax0LZ5OzjkmZIyVrFcvRvMsfLuvRN916FFZ1p5xGa xaaaAUt+0QXF71p1qtjVzvFB7I6CsRLPQQbTXBJGPRqpzvciQtV0uzd9l36B13FTm154RdNsJ0vs 2vOW09RqZlyw3fPMrrvOddZrc2OPvklPuzlYu3JyMa3lYr5OXZVRW1jcOJvSvRrPtPL7oNxk5jqf S3fJaKxZXi+VXie6pNb6lVY6tp3zRNWCWJ/KvKxUa7mRNkaio7WfFxodm2qluwjOtKKq3R55phkc OSWanuT1ZS3BiJtPRyPRFWNJGo3Z23i3Zdt+Zvxx/PeMfOsxxyhq9BrFphjlJWNqMjr7zklNepqy mRqo6mooqNU5HuVU2llVERE35F/BUM66rcTGFZpxS6g6a6x8TmQ6RYLp2yjt1qoMcuE1urb5cJY+ epqJqqGN0iRxLsxI0VqLuxf4SLPOCLiFgy3WPUXQiy6z1mq2J2KgpL9i2SXFyvuDaaRUjqKSplVj FmdHK9nK9U3VFXdeqI2R3TTbXbQPiLzzWXRjTij1HxbVSGgmvVhbe4LXX225UkaxtnhfU7RSRPa5 yubzI7md8jU5rc0TuvEPkNTkOQ634tjuJW+rmhbj+OUFZ3+toomtVJX1dWxUikc92ytbG3ZqIu7l ArLymvxHNT//ACe2/rOkKx1r0x1s0s4cJuJWy8Smoftg4xaqS/1Vqdcm+xqRidms1E22oxGJC2NX Naqqr15UVzlVVUvXjo0zzjWLhUzvTbTex+eMjvUVCyhou8w0/arHX08r/hJnsjbsyN7vScm+2ybq qIVLq7i/GZqjoq7hcdpDZKTztSUtjuuofsmp3UC0MbmdrUtodkqUlkYzZYtla1znbPciI4CL8SPF vRXbPtHtNr3rFW6QYVmeGw55kt9tkix3CWGoaqUtBTzox7oVWRj1c9reZUToqbKi8XRXiRwzGOK3 CNKNIuJq/wCruCaiUdxp6ylyKvluFbYLlTQrNDLHVTRtkdFM1rmdmquRFRyr+92tnVPh71HwDUnS 7XXh5stBktx09xlcIueNXCvbQvu1lRvwSQ1LkVkc0b93+ns1d06pts6f6Z5XxT5vqHHcs+0qsWmu CUVDLHLbqu8Q3e73Kscqdm9slK7saeJiIu6Kr3O+TqisCjNFcf1C41KHNNZ8h4gdSsKtrcnuNkxC z4feEt1LQ0VK5GRzVDEYvepXu3V3aLt0VE2RURs11UuGsWnHCrZ7frjxN41geSw3OCgvma22ifLN X0XaPXs6OFY0c2ukiRu6sjfsrJHNam+7Y7p7hXFLwk1Wa6faVaI2zVHCr9kFbkONVzcpprTNaO9K ivpKuOoTeRjHJujot1VN18XcrPhqdoHxU3vBNFdQcmr7PqjqVpplj8lvFkSWntlJWxS+FPSyqxkS Pp0bGjJJE3Ved2/g1QrazazUOmvEBo/RaOa5a2ZhY84v/seyK16i0lzfSyxTMRIqilmrqaLs5Gv9 JWxu6oidEbzIt/aY5fllfx960YbX5Rd6mwWrFcfqKC1TVsr6OllkYiySRQq7kjc798rURV9ZX+vO C8Xusl/0x1kp9HLda/axy6ku1PgfslpJa+5Q9VqKmWs3Slic3ljZHE1zuj5XOcq8rEll3wnXvTPi ovPELhGj3s2s2oWJ262Xi001/oqKus1wpttvSqXsimi5em7Hb7qq7bInMHztOb6oycZHELjGNXy4 3NbJgNqrcbsVXXSOt8VyfTuVishc7s41kk5Uc5ERV36qUHpNmWOZ9jdJQZjx3ar6c8QipzV9pyu5 PoLbSXTnX4BLZPEyllgVejWMdzKip4L6Jemk+kXExS8R2tGsuVWiy43V55idBTY7UMq47hR26thY 5kVPK1rmyzdmjY3SP5GMc5z0Yqpsp0Ordq4s9dNIrjoxqPwa4hccguNtktSZjPltvfa6Spczk85Q Qq1auJWu+FaxrOZFRE3XwA43F9xD1OJaz6b8PGda6T6Y47XY67JMyymzMdS1laqOfDDS0j0bI6lR 80MrlVN3I3ZObovN0GivEjhmMcVuEaUaRcTV/wBXcE1Eo7jT1lLkVfLcK2wXKmhWaGWOqmjbI6KZ rXM7NVciKjlX97tY2WcOOs2mWS6Na06SJQZ5lmm+GxYLklpuNelA/Ibe2JqdpBUSIrY5Wzc8nwnR d03XdFR1paZ5XxT5vqHHcs+0qsWmuCUVDLHLbqu8Q3e73Kscqdm9slK7saeJiIu6Kr3O+TqisCyN SsdZlmB3zH33u9WhKujenfbNcJKKthVvpIsU8ao+Nd27bovgqp6zzT0wwSmsvkf8pzhmTZNWTZFj 1ayS3Vt3mnttF2N6nYi0lK5ezp1dtu9WInM7dV6nqVXUqVtDUUSv5EqInxc22+3Mipv/AO0wBhmh PFBbeArNOEG+aLQQ3W0WuspLDeKfJaGWG/yTXN9SiMjV7Vp0Rki9ZnN35U6Iq7IH91a061d054P6 biTtfEjqLQ5zjmO2q9RWyjujY8djj2gTuSW9GckkbIncvPIrnvc3mcq7q07Die4qo36k6S6SZRrH V6Q4llGIx5rlV+tT3R18rJUcynoaadGPdBzSRyK57U5uVE6psqOu7X/SnPs24IbzpBjFh77l1XiN DbIbd3qGPmqY2wo9navekSbcjuqv26dF8CHZzoVrPimYaP8AERpJjttvuW4Th8eIZLildco6Nblb 3RNXkgqlR0TJYple70l5XdOvTZwVfo1xG4Vj3FPhmkWkvE3kWrmBakUNypa6lyC4zV1dYLjTwrND LFVyMZL2czUcxGbrsqOduno7Wjwoas3rTuwazaRa35jdbvddDbvWV0l3vFW+prKzHJ431dJUySyq r5HdmkidVXlb2bd/AsrTPK+KfN9Q47ln2lVi01wSioZY5bdV3iG73e5VjlTs3tkpXdjTxMRF3RVe 53ydUVmaOPbSe/ZHxHadWHTm9x0Fbrra5cDy6mi/d32akqqetlrGtTpuyFs0bnL+8VGp+F0C/eBR dRr7oVDqlqnkF4uF71JulZlkVLX10tRHa6Cpk3pKSma9VSKFIUY9rGIiJ2q9Ohoc4tsttBZbbSWe 1UkdLRUMEdNTQRpsyKJjUaxjU9SIiIifyHKAAAAAAAAAAAAAAAAAAAAAAAAAAEE1q1qwHQLAa7UX UW690t9JtHBBGnPU11S7fs6anj8ZJXqmyInh1VVRqKqA1q1qwHQLAa7UXUW690t9JtHBBGnPU11S 7fs6anj8ZJXqmyInh1VVRqKqUVororn2tmfUPFNxS2rulwpN5MDwOReemxemdsramoavSSueiNVV VPQ6dEcjWxNFdFc+1sz6h4puKW1d0uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqqp6HTojka2LWAAGY Kzj1xd2bZdg2KcPWt+Y1GEXiax3atxzGqatpGVMTlRUa5KpHbLtunM1FVPUTnRri00k1ryOtwS0v vuNZpbou8VWK5TapLXdY4v4aQydHtT18jnbdFXZFRVC5gVDrRxQ6caJ3604VdLfkuT5hfIHVdvxj FbS+5XOenaqtdP2TVRrI0VFTme5qLyu235XbRrCuNbTjJNQLRpfmWB6i6Z5FkSuZZKbN8f8AN8d0 kb4xwTMkkjc/qibK5N1VGpu5URQ53Erw1e295r1F06v3sP1aw/ebGslhb4+KrR1aIi9rSybqjmqi 8vMqoiormvcNXEr7b3nTTrUWw+w/VrD9oclxqZ3j4IlZSKqr2tLJuitciry8yIqqitc+9SiuJXhq 9t7zXqLp1fvYfq1h+82NZLC3x8VWjq0RF7Wlk3VHNVF5eZVRFRXNeF6gorhq4lfbe86adai2H2H6 tYftDkuNTO8fBErKRVVe1pZN0VrkVeXmRFVUVrn3qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAADqssqaejxa81dXUVkEEFvqJJZaJyNqI2NjcquiVeiPRE3aq+vYDtQZq0v4jdHdOO ELD9Ybzm2d3HGK1i0tsq8telwyS61L6mVscD0hV3bzucxyNRqrsxqKqojVVO4xbjKwa75vYcAzbT jUnTa55XItPYH5nYEoae5zom/YRSxyyNbKqKmzJORyqqJtuqIoX6Cg8M1Bw6LiR1wtNNkuo9fdsV tVkrbvabjWRSWGijdRrJGtqhR3NHJIxFWbnRqOfsqLt1I7Z+P/TfKdOo9VMK0o1WybHIqV1Xdau1 WGCVloRiK57Khy1CNc9jER72wOl5GuTm2XdEDTwKpyPif0YxfRa2a+3HKlfiN8ip32qWnp5JKmvl n/cqeGBE53TOVHJ2e27Va7m2RrlSN4fxjYNkGdWXTvMNO9R9N7vk6uZYfZnYUoILrK1OZYYZWSSN SXbr2b1Y7qibbqiKF9ApXVHitwfTXUOm0lt2HZtneZS0CXSps2IWltdNQUau5Wz1DnyRsja5eiIr ld1b09Ju9T8O2t1bq1xrarwWrJcldjFDidndBj91dUU6WmuR6sqWPopVRKedHtVH7NRV8d3IqKob CBTHF/rJf9CeH3LdQcWsF4uN3prfUQUM9vpoZ22yodBJ2VbUNlcjewjkazm2R6qqtTkVFXbNWs3E xmtdodw5am3mfN9Okn1TxWjyerub2WxLvb1o3T1dQraSVzZKGXdy8rkai9mu8aIiAb8Bnyyca2nt fqHjuneS6d6mYZJmNQtJjl2yfG3UFvus+27Yonq9ZGvcipytkjYvpNRURVRCQ6r8UeCaWZnRaZ0+ N5dm+a11EtyTHcRtSV9bBRo7l7xNzPZHDGruiK96Kq7bJ1QC4gVhopxD4Frp58oMcpb5ZcgxeoZT X3Hcgt7qG6W18jVdH2sKqqcr2oqte1zmrsvUmeb5rjGnOI3fO80u8NrsdjpJK2vq5d1bFExN1XZE VXKvgjURVVVRERVVEA7wGWLh5RLSaw4RNqLlumWq2N47LSLV2e4XfG200F8Tl5mx0kizcnO9m72N mdFztaqt38CY6jcY2l+l93w2xZDY8rqa3PLHJe7LDbrcyqkn2SPkpEjbJ2jqmR00bGMY1zVVV3c1 EVQL2BSWY8WWCYDiWI3zKsPzekyLOXyRWPCWWbtsiqZI1XtG91Y9Wt5W7Oc50iNRHN9LqfbS3ipw XUvO5tK7hiuZ4JmkdCtzgsOX2lKGprKRF5XTU7mPkilai9F5XqqbO6ei7YLnBXekWuWJ60Vuc0GL W670smn+VVuIXNbhDExJqyl5e0fDySP5ol5k5Vdyu+VqELq+MjTGj091Z1JksOUOtmjmQ1eNX2Ft LT9vU1NPJGx76Vqz8r41WVqor3Ru2Rd2p03C+CnNL+FzB9NNQrlqxV5TmObZhcKVbfDeMsuqV01v olfzrTUqNYxkUau6rs1Xf33Vd4fdOPHS+z2Okzqu0/1LZp/VSQxrm6Y8i2WFJHIxJHP7Xtli515e 1ZE6Ny7crnIqKujqWqpq6mhraKojnp6iNssUsbkcyRjk3a5qp0VFRUVFQD6gAAAAAAAAAAAAAAAA AAAAAAAAAD8yK9sbnRs53Iiq1u+26/JuYY4dkZxIcTWW5pxLP7jqDpjXvp8Y00q0/sbH6NeXkubN /RrZZFVvw7UVrfRVNkWLl3SUTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vM qoiormuC9gUTw08S3tv+dNO9RLD7D9WsP2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPvYDIHA r/bb4p//ADq1n/U443lDKCkxm96Bax2GJlPmVm1StFko6qNOWWooatJu8UjlTq5j0jRFReiI56Jt zKdDppbOLbh81Y1tuWOcJlTnNmz7N6vILZcIs3tFuRadyuRm8csjnpzIqL6SNVPBUJfj2jXEDxCa 04nrHxO4/ZcIxnTqpdccXwW23NLlM+5qictZW1TESNyx7NViM9aeDU5u0Dl636P6/YfxH03FZw72 fHsvranF0xS/Ypea3uUlRTtn7ZklJUr6Eb1cjEVHqiJy77O5vR6+m4r8IyXOMPwLi04Yr7pzf57z C/GK3JaCnutnbdk6Rd2uDU5WT7u9FyNTbdF5m9CW6oUXF9p7rJWalaQ0lu1Pwa9UEFNVYNcbvHaq i11MSbdvRVD2LGrX9XPSRd+Zyp4I1WwDUnBeKbi/q8TwrUnRaz6RYLYciosiutVU5RT3m6Vy0yuV kFM2lb2cPMrlRXuduidU8FY4NnAEE1q1qwHQLAa7UXUW690t9JtHBBGnPU11S7fs6anj8ZJXqmyI nh1VVRqKqBRnH3iWn1iwSn4h5M29gOpGCrvimQ0kfPU1tQ7fltb4U61UUy8zezVF5eZzvwe0R146 E5bqDnekeMZbqnhPsSym50DJ7jaO05uwkXwXZerOZNn9m7dzOblcqq1SjNFdFc+1sz6h4puKW1d0 uFJvJgeByLz02L0ztlbU1DV6SVz0Rqqqp6HTojka2LWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAI7qL/a+yf/AImrf9Q8kRW/EPmtVgukmQXOgwXK8uq6ykmt1NbMatb6+rfNNE9r HLGzqkaO25n+DUXcDz2wySG1cPnAhlORPbFittzeVlxnmXaCCrkqJu5ySKvRqI5si8y9E2VTSXlJ ZIa/DdJMVtb2vyq66qWF1hgYu8/axuk55WInVGsR6I53gnO3deqEy4XtA6aDgtwfRDXTB6OtTzOq Xay3GJsrY3STyTtY9P3sjOdvVF5mub0VFQlmmvCLw66R5PFmeCaa09LfaaFaeluFbX1dxmpI1RUV sDqqWTsUVFVPg+Xoqp4KqAUhgnx0uL7/AJK4x+qXnbcBtFSweTnxOKGnY1k2P3uSRET8NzqurVyr 8u+5oag0b03tma5hqHQ452eQZ7S0tFkNZ3yde+w08Swwt7NXqyPljVW7xtaq+Kqq9T74JpTgOmen VHpPhFh824rb6aakp7f3qabkilc98je1le6Rd3SPXdXKqb9NtkA8uoaXIncJPBNeaHLafGLdR5rV Qy3ytoG11Jba6SsnSjnmhc9jXNarJfwnNROq7oad1m4f9WMnrtPbbrrxxYrHFTZnbbnjlM7T+nt9 RWXaBznQxQSJXc3O5Fe3ZEX8JOirsi6StfD5o1adIIdBKfAaCfAaeF9PHZK58lZEjHSulX053PkV ySOVyOV3M1dlRU2TaOac8HXDbpRk9NmmEaYU1Ne6Fix0VbW19XcJKNqpsqU/epZEg6KqfB8vRVTw AqXh6qILf5QXihtd/kYy83OixOttLZF2fLb46FzJXR7+LGvfA123Tm236nA0IvGOXryk/ELUY5PT ztp8csdJWywKitdVxRxskTdOiuaqIx3yOYqL1RS+9W+F3QfXO82/I9T9Pqe63e1xLBS3GGsqaGqZ EqqvZrNTSRvczdzl5HKrU5ndOq78/Tvh40Y0lyGoynTfA6PH7jV2uns0z6OaZsTqSFyujZ2KvWNF 5nOcr0bzuVyq5yqqgQvjvRV4PNWkRFX/ALGqlf8AqKC4kqaiuugvBhR1UUdTSVmo+ARSMciOZLG+ ieiovqVFRf8A2m5Mjx2x5fj9yxXJrXT3K0Xelloq6jqG80dRBI1WvY5PkVqqhU+PcGvDditgseL2 LTp1NbMbyelzG1wLebhJ3a70zeWCoRz51cqNauyROVY/lYoFZ+UEREquG+ZE2e3XfFka71oirPv/ ANSf5CsLJiusV18odr9acI1utmnl6uVrx64UCXDFYry+62xlI2NywdpPF2bIpdmv5ebmc7rtydds ag6UYBqouOOzywedFxK/UuTWb+ypoO63Km5uxn+Ce3n5ed3oP5mLv1ap0erfDlorrpNb6zVHA6S8 VtpRzaGvjqJ6Otp2r4sZU0745WtVVVeVHbbrvsBT2hOjt3xrirzDUTNuJ/H9QM19idNY71YLdjUN pmpYlnjlpamdsdVL1RrHsTdiKrZE6psiL+fKiU10quCHUFtsZK9I32qWqbH+EtO25Uyv/mTZFX8y L6i8tJ9DtJ9DbTV2bSrCaGwU9wm7xWviV8s9XIm+zpp5XOllVN1253Ltuu3ipz9V6O8XDTTJ6GwY dassuFRa6iKCxXWVI6S5qrFRaaVyoqI16bt6pt167JuoGbvKNZLp3JwFZTU98oJbZfaG1txxsbmq lRI6oglgWDbx2jY6Tp4MY5fDci96oaWt4xOD51VAyXu2B3meNHJujXpbGIjv5U3Xb85T2U6TY5mm lNXpHodwJai4TqRlsENprbnkdJVLY8cifPG+tkpq2qnkjSNUY9qJTta57XdU/eL6DUmh+njMjwjN rhZnVmTaf2mSz2S5uqZmLBBLC2KZFia9In87W+L2uVPUqAZ/1Clhs/lPNMblkz2Q2676aXK2Y/JO uzHXVlXJJOyNV6dotO5qbJ1VHInrHEZJDd+PjhetGOPbJfbRDlFyuyQr6dPbJKNjGul28GPcyVjd +nNuidVNF6qaM6X622GLGtU8NocgoKadKmmSfnZLTTJ4SQzRq2SJ+3TmY5q7dDqdJuG/RPQ6suF0 0ywOmtVxurEjrbjNU1FbWzxoqKjHVNTJJKrN0ReXm5d0RduiAUlwGSRw5fxOW+V6MqYtab7Uvicu zmxS8ixvVPkcjXbL69lM0x3y15NwcccGQ2Ssjq7dctUL3VUlRG5HMmhfUUjmSNVPFrmqiovyKhu3 MOEfh4zvNa7UPJdOo5b9dWMjuVRS3Kso2XBrE5WpVQwSsiqE5U2+FY7dOi7oVrxT8PmNYnwj604z obpzVpc813u1Ra7PHUVclZXPlgRyw06K/k9CNu0cTWsRG9GoBwdYsowJ/kxrreaSuolsFVpfBR29 Ue3k7Z9GyGniT5HpMrG8vijm7eKF3cM9Dd7Xw46V22/skZc6TCrJDVslRedszaGFHtdv++RUVF/O ild4jwT8Nt4tuLZjlmjdE+/w0dFX1VPUTVUdKtekLOeWWg7RKZ0qu3VyviVyu3V26qpo4AAAAAAA AAAAAAAAAAAAAAAAAAAAAAAoniW4afbe816i6dX72H6tYfvNjWSwt238VWjq0RF7Wlk3VHNVF5eZ VRFRXNc4aeJb23/Omneolh9h+rWH7Q5NjMztt/BErKRVVe1pZN0VrkVeXmRFVUVrn3sUTxLcNPtv ea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormuC9gUTw08S3tv+dNO9RLD7D9Ws P2hybGZnbb+CJWUiqq9rSyborXIq8vMiKqorXPvYAAQTWrWrAdAsBrtRdRbr3S30m0cEEac9TXVL t+zpqePxkleqbIieHVVVGoqoDWrWrAdAsBrtRdRbr3S30m0cEEac9TXVLt+zpqePxkleqbIieHVV VGoqpRWiuiufa2Z9Q8U3FLau6XCk3kwPA5F56bF6Z2ytqahq9JK56I1VVU9Dp0RyNbE0V0Vz7WzP qHim4pbV3S4Um8mB4HIvPTYvTO2VtTUNXpJXPRGqqqnodOiORrYtYAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAUTxLcNPtvea9RdOr97D9WsP3mxrJYW7b+KrR1aIi9rSybqjmqi8vMqoiormucN PEt7b/nTTvUSw+w/VrD9ocmxmZ22/giVlIqqva0sm6K1yKvLzIiqqK1z72KJ4luGn23vNeounV+9 h+rWH7zY1ksLdt/FVo6tERe1pZN1RzVReXmVURUVzXBO9atasB0CwGu1F1FuvdLfSbRwQRpz1NdU u37Omp4/GSV6psiJ4dVVUaiqlFaK6K59rZn1DxTcUtq7pcKTeTA8DkXnpsXpnbK2pqGr0krnojVV VT0OnRHI1sUS4P8AFMj4uvY7xr8QlbQXSZveIcGxakjelssXYTvp5qxY3qvaVT5YHqjnKvI1Gqi7 oxI9ugAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGVfJcfET0y/TX64rTVRlXyXHxE9Mv 01+uK01UAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAH8VFVFRFVN08U9RiO3+UrxrS/WK/a AcVuOvxC+WKuWmgyS3RSTWq4U7tnQVD4vSmp0kjdG7ZO1aiqvM5uxt081fLJ8N3slwmz8SONUHNc cW5LTkHZt6yW6WT4CZf+CmerV/NP16MAhXDP5R/R7hk4L9PtOqa13PMdQqdt0R1ioWLDFTvlulXJ Ek9Q5qo3mY9jkbG2R3pJuib7nptpfV57cdP7Fc9T6OgosprqRlVc6KgY5sFHLJ6fd28znK5Y0VGK 5V9JzXORERURPFTyVXDd7dfEJDnl/oO2xfTfsrtUc7d2T3FVXucP59ntdMv5oURfwj3UAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAIfq3qB7Vunt1zvzR5z82dh/YveOx7TtJ44vw+V223ab/grvtt69yt/b71h /F1+l1L9mdzxbfF8yv8AwH+vQHzKGIuXIu6NNWUZRu698PTcF4TC14OLt23FVU1VRrmqNURTPNVG +XVe33rD+Lr9LqX7Me33rD+Lr9LqX7M7UEXGXenPh5L3JcD+RT31/e6r2+9YfxdfpdS/Zj2+9Yfx dfpdS/ZnagcZd6c+HkclwP5FPfX97qvb71h/F1+l1L9mPb71h/F1+l1L9mdqBxl3pz4eRyXA/kU9 9f3uq9vvWH8XX6XUv2Y9vvWH8XX6XUv2Z2oHGXenPh5HJcD+RT31/e6r2+9YfxdfpdS/ZnT5jqdq HnuJ3jCcp4Z2Vtnv1DPbq6ndl1LtJBKxWPTfs+i7Kuy+KLspLQOMu9OfDyOS4H8invr+9QfCXjec cJuk8emeO6Evu88tdPcbjdpclpIJK2eR2zVViNdyoyJscaJzKnoKvRXKXP7fesP4uv0upfsztQOM u9OfDyOS4H8invr+91Xt96w/i6/S6l+zHt96w/i6/S6l+zO1A4y7058PI5LgfyKe+v73Ve33rD+L r9LqX7Me33rD+Lr9LqX7M7UDjLvTnw8jkuB/Ip76/vdV7fesP4uv0upfsx7fesP4uv0upfsztQOM u9OfDyOS4H8invr+91Xt96w/i6/S6l+zHt96w/i6/S6l+zO1A4y7058PI5LgfyKe+v73Ve33rD+L r9LqX7MlekGr941KvGTWC/4N7Gq/Gu5drF5zZW9p3hkj2+kxjWps1iL0VfwvVsdSdVoJ/bh1c/QH 9VlN7d25xlMTVnE9m6epBjMHhOSXa6LUU1UxExMTV0qY56pjZM8y+AAdF5IAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVBxbfF8y v/Af69AfM+nFt8XzK/8AAf69AfM52I9tPZHzl63gr/h9P89f9tAACNbAAAAAAAAAAAAAAAAAAAAA AAADqtBP7cOrn6A/qsp2p1Wgn9uHVz9Af1WUzb9rR2/SUeK/Yb/8sf30L4AB1HiwAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABUHF t8XzK/8AAf69AfM+nFt8XzK/8B/r0B8znYj209kfOXreCv8Ah9P89f8AbQAAjWwjDM6R+pMmm/sQ yZqx2ZLz59db9rO74ZIu6pU83Wp68/Z8v4CKu/qJOZ5pMoyZ3H7XYa7IrmtgZpO24ttS1cnc0q/O rWdukO/J2vIvLz7c3L032M0xnmjuV6GXXOTQxGNRc5TTvHFyNcQybJdqmCm7jj1v75V/CPRvadnz N9Bu+7nb9ERVMo8JWDaga96CR5FqFrxqRBM243KitMlpyGammijZUP8Ahp5d1kqZOdXNRsjljbHH G1Gp6SujV11v1TyPyfePZ9XZndKXK4cmpbRVXegqn0tRUxxXNYd3PiVq+lGjUd/C6qvib8Xry61e cVnRpZZZxMx7v/rbtRnOK0mbUWnU92a3Irhbp7tTUXZSKr6SGRkcknOjeRqI+RibK5FXddkXZdu9 MZZdphS33yidDRS5vm9JHU6euv29FkNRA6KRtx7Pu8atd6FM5GIroU9BXbqqbqbNNaqYjLJNauVX JqzjZOQCEa33DUC06RZdctK6JavLaa01EloibGkj3VCN6Kxi9HvRN1a1UVHORE2XfYyRpXfcQzem sceEcbGf2bVhj6R1fZc1uD3U8tXu1aikdbKhsbHIvpta2F26dNnLtuKaM4zYuX4t1RTl9O7rbuBi 7iE19ss3Eo/RjO9b7npfg+OWKG419TZ6h9LX3e4zqixwJUMY58UTYnI5eXZVXmRV6tVv74ddf7FT 8Qdx0fxHXC56n4LcsbkvlvuF3nfU19qrYJNpqV072NfLG6P00V26p0RP3yrni5yzacro09Dry2xt 7NrZwMb6LYnqbxV6Yza+3fXnPsUueSVdwfjdrsNzSltlqp4KiSCBktOjFSpXniVXq9d3NXbovU+m vVz4g7G7h3w6v1Gba8yv98qLLf7jYZpWUdSjoUYtQsKoxsrmsXtWsezkSVOico0NeWZyn8Gnozlq y97YgMbcSOdz8PVJpnoZT625PZLbmVyr6m/Zte65a+6UlvgRj3xxzOYvK+R0iMY5GLybIiJsROxc QOBae606c2zR3iayPUmxZleosdv1iyK5TXGWmdUKjKesp5po2vj5ZVRHNRVRUVOierMW5mM4Yqxd NFWjVzZZ645/m2xac5xW+ZZf8HtV2bUXvGI6OS7UqRSItM2qY98G71ajHK5sb12aqqmyb7bpv3pj Lhv0wpYOMLXesdm+bzuxa4WB8TJshqHsr0noZl5axqu2qWx+EaP3SNERG7GzTWqIpnKEti5Vcp0q oy1z4TkAA1TB1Wgn9uHVz9Af1WU7U6rQT+3Dq5+gP6rKZt+1o7fpKPFfsN/+WP76F8AA6jxYAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAqDi2+L5lf8AgP8AXoD5n04tvi+ZX/gP9egPmc7Ee2nsj5y9bwV/w+n+ev8AtoAARrYUZTaa 5rHxs1mrr7LtiUumjcfZcO8w9a9Lk2bsey5u1/c0V3Ny8vq336F5gzE5NK6Iryz5pzUZwX6a5rpN oNbsL1Asvmq8wXK5VElN3mGfljlqpHxrzxOcxd2uRdt90367KUXBw161s4H6HR92F7ZdDl7bo+3e caTpS+clm5+17Xsv3Nebbn39W2/Q3ODbTnPNFOGommKM51Rl35eTN+qmE6wWDipxvXjTvTuHM7W7 EJMTuNI2809vlo1WsWdJ95uj2+kibN3XovTw30gfKqgWqpZqZs8sCyxuYksSoj49025mqqKiKnim 6L1KV9zLfPxp9b//AL8277iYz0trbRm1MzTGeevmWZqLTZ3V4ReINMblbaDKXUyra57lCstKkyKi okjU68rkRW7pvtzb7LtsuXNbcP4heJXCE03yThcx/GLxUyUzfZjWZNRVcVrWOVr3z0rYkWp3VGuR G+j0eqKq9d74wPRO54RkUWQVWu2p2URxRvjW3X65Uc1I/mTbmc2KljduninpJ1+Us4RVo7Gtdqb8 ZV5x1av1ZuzTS/VzTbXWHXzSPH6bOWXfHYcdyaxVNyjoKuodC5FhrYZpU7NXbNRrmuVOiLtvzbtn umN319y3JLtddUsHseGYq6iZTW+xJXNuNykqOZVfPNURL2LY1avKkbUcu/XmTb0rUAmrOG9NmKas 4mctuXN5+LI2m2LcUvDPh1x0T090jtWdWKkrayXFMhdkdPRNoqeoldK1lZTyp2j3Rve5y9nvzb7J t4nd5Zo5rld7lw8V2UXOPMrzhd/nuWXXmLutJHGkka+kyJOz52NVUjbyM5lRiOciKqmngZ052tIw 1MRo5zlzdWU5/TnUXxH6SZ3lGS6fax6Tx2+qzDTW4VNRBba+fsIbpRVUSRVNP2uypG9WNRGucnKm 7tzmYpl3E9mWb2hL1pJZ9O8To0kkvDrleoLtW16q3ZkVM2lcjIkR3VXvcu6fvemy3QDGlqyb8VGl NUTMZ7Wb8NwnWDTbiv1Hyqh07hvmFanyWad18jvNPA60rSUropEkp3/CSqrnrtyJtsjevVUbpAAx M6Ta3bi3ExE88z36wAGG4dVoJ/bh1c/QH9VlO1Oq0E/tw6ufoD+qymbftaO36SjxX7Df/lj++hfA AOo8WAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAKg4tvi+ZX/AID/AF6A+Z9OLb4vmV/4D/XoD5nOxHtp7I+cvW8Ff8Pp/nr/ALaA AEa2AAAAAAAAAAAAAAAAAAAAAAAAHVaCf24dXP0B/VZTtTqtBP7cOrn6A/qspm37Wjt+ko8V+w3/ AOWP76F8AA6jxYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAqDi2+L5lf+A/16Azf7r7/AOzz+lv/AMiAcPhK7XbvRozzR85fSv8A +QwdjF8H1cdTnlXOWuejTuPdff8A2ef0t/8AkR7r7/7PP6W//IgFDlN3f8nqPQ2C6HjPme6+/wDs 8/pb/wDIj3X3/wBnn9Lf/kQBym7v+R6GwXQ8Z8z3X3/2ef0t/wDkR7r7/wCzz+lv/wAiAOU3d/yP Q2C6HjPme6+/+zz+lv8A8iPdff8A2ef0t/8AkQBym7v+R6GwXQ8Z8z3X3/2ef0t/+RHuvv8A7PP6 W/8AyIA5Td3/ACPQ2C6HjPme6+/+zz+lv/yI919/9nn9Lf8A5EAcpu7/AJHobBdDxnzPdff/AGef 0t/+RHuvv/s8/pb/APIgDlN3f8j0Nguh4z5nuvv/ALPP6W//ACI919/9nn9Lf/kQBym7v+R6GwXQ 8Z8z3X3/ANnn9Lf/AJEe6+/+zz+lv/yIA5Td3/I9DYLoeM+Z7r7/AOzz+lv/AMiPdff/AGef0t/+ RAHKbu/5HobBdDxnzPdff/Z5/S3/AORLU4Qcw9nuY6mZZ5u7j37zN/Y/bdryckVRH+Fyt335N/BP EAtYK9XcxFMVTv8AlLi//wBHwfh8LwVers05T+GNs9OnfLTYAPQvk4AAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//9k= --_005_e0d6ff151c464d9d9cf49af054df6cdfaaltofi_-- From nobody Wed Aug 5 08:59:18 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6806E3A0B3D for ; Wed, 5 Aug 2020 08:59:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HJCn77tah7Sv for ; Wed, 5 Aug 2020 08:59:09 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 083E73A0CA4 for ; Wed, 5 Aug 2020 08:59:03 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id d14so42096602qke.13 for ; Wed, 05 Aug 2020 08:59:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lr0ux52+MyK1znCeM/FD3rimV2ctYTuyMcr2Pq6Jsyw=; b=f3OtCViTSRUhnxx4Zv1DruR1UdTmi9eQ3zC91sknT4PNXvMZVV4WuriN7oCJSeWK/s IqSYW12bNijxsCZHEBnkcHf31C3mP0QXxQBQTJQD7qMTdsCoAMrjxWuqY8gMQs1ZiyFO gt4fz5tloD8T7EWRMax21k72+YWN0odcEYw0Mc3vlC/ym32v/M3bG2NweTa6VCcXSPKk YlMqinUNUVHIl0k+L0C2TPTF5Y1fA+5XlUoNWAMGsIZiKGSTf7vH+/hqyj0Of16ayiSK cjrGnt9eksOuxvlD/aq83AiFGTrdVzbCpJhAibEQv3deNjlwGl8cGEis9QiRb6j0UkqO D1hQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lr0ux52+MyK1znCeM/FD3rimV2ctYTuyMcr2Pq6Jsyw=; b=H6NxE1yOw9GVOrDdm5MDy++9oIKhusaeMzTe9XjdY5njPC8++LH0R1v8n3BYadnGxn CeYwGrBIvGJQVu4mMbFmBFGZTOBRTK93ycUb3hnJlufk/KM63XGAyoYN7y8Fk1es2mVp al5+253i+rzZNtlGQrZpcAAVKCEE330ioNev4sErCtNylXDmgdSzIL9FE7McUJrRkByD G44TkJel7KypAWHqr5q8cNBCUEi+5NfwnLFPHqBavvswhE315Dw3JaSuluA2jrWV+f3E 6AeSWSIJ4keRhmtHyMMCUQ6e5ACs1Re1Y0mgYrIjgPA0J3DOL2Mxa3v8tEYPNToUSxqY jeFA== X-Gm-Message-State: AOAM530w23LTk0PdaqNv75rh8C0gpOxt93k7b70WAPbAJXGIds6iQRKI qoj4P/8C7LhgHlU2LIzwwG1DTtZZaKpv49Ds0n+BPw== X-Google-Smtp-Source: ABdhPJwGn2Lc6UORGmPQZUtj7Xuhav3KH1ZzZJfY8QbLE2XQ6RbRzP1XesMYcP+ZYb4JgOWRBr1ApOGUMsUf3AjGTTs= X-Received: by 2002:a05:620a:63a:: with SMTP id 26mr4159836qkv.490.1596643142777; Wed, 05 Aug 2020 08:59:02 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Wed, 5 Aug 2020 11:58:49 -0400 Message-ID: To: Cornelissen Eric Cc: "mls@ietf.org" Content-Type: multipart/alternative; boundary="0000000000005c104105ac237337" Archived-At: Subject: Re: [MLS] Potential issues with "add-only" commits in young groups X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Aug 2020 15:59:16 -0000 --0000000000005c104105ac237337 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Eric, Thanks for the analysis, and the detailed, clear writeup. I agree that there are some real issues here, and with the solution approach. Just to align on a couple of details: #1 is clearly a problem. Good catch. #2 is less clear to me. You lose me when you say ""add-only" commits allow new group members (ONLY) to learn the value at the root of the TreeKEM tree". How do you think this happens? As I understand the spec, this is not the case. New members are added to the "unmerged_leaves" array at the root, but they are not told the root secret or root private key. In any case, I agree that we should change the initial init_secret from being zero to being random. I think I had set it to zero out of a general caution against requiring fresh entropy, and likely under the theory that the first commit would change it (before `path` was optional). But it is clearly necessary now. If you would like to send a PR, I would be happy to review. Thanks, --Richard On Wed, Aug 5, 2020 at 9:27 AM Cornelissen Eric wrote: > Hi All, > > > Quick introduction: my name is Eric, I have submitted a few issues in the > MLS GitHub and I did an analysis of MLS for my Master's thesis last > academic year, now I'm doing a research project related to MLS with C. > Bruzska. > > > During this project I found a potential issues with "add-only" commits if > used in the early lifetime of a group. I found two particular issues that= I > think are most important to look at and which I will describe both here. > > > Note 1: Neither of the issues I describe hold when a PSK is used, hence I > will only consider scenarios where PSKs are not used. > > Note 2: In both attacks the attacker must record the (encrypted) Welcome > message(s) send out for a group (i.e. I'm assuming a network adversary). > > Note 3: I use "add-only" commit to denote an commit that does not populat= e > the *path* value of a commit and "full" commit to denote a commit that > does populate the *path* vale of a commit. This, I suppose, deviates > slightly from the draft. > > Note 4: I attached diagrams explaining the attacks, I hope they are > understandable :) > > > > 1. When using an "add-only" commit for the first commit (see > attachment 01.jpg for a diagram) > > The first issue is w.r.t. using an "add-only" commit as the very first > commit of a new group. To the best of my knowledge this would result in t= he > input to the key schedule being to two all-zero vectors. Namely, the > *init_secret* for the first commit is always the all-zero vector and the > *commit_secret* will be an al-zero vector because an "add-only" commit > was used. > > > Now, this would allow ANYONE to derive the *joiner_secret* and * > welcome_secret* for the first commit. With the *welcome_secret* we can > decrypt the Welcome message for the user(s) being added to the group. Fro= m > the Welcome message we can construct the GroupContext that is used in the > key schedule (GroupContext_[n] is a subset of the GroupInfo in the Welcom= e > message). > > > With all this information ANYONE can compute all of the keys produced by > the key schedule for the first epoch and read any communication that > happens in this epoch. Furthermore, if another "add-only" commit is used > the input to the key schedule for the next epoch is also known to the > attacker(!) as *commit_secret* will again be an al-zero vector, and we > know the *init_secret*. > > > > 1. When using a "Full" commit followed by "add-only" commits (see > attachment 02.jpg for a diagram) > > The second issue arises from the fact that "add-only" commits allow new > group members (ONLY) to learn the value at the root of the TreeKEM tree i= n > some earlier epoch E. In general this is not a problem, because they won'= t > know the *init_secret* for epoch E-1. However, if only the very first > commit for a group is a "full" commit new group members do know the > *init_secret* for epoch E-1, as it is always the all-zero-vector. > > > From here the attack proceeds very similarly to the other attack. Imagine > a group is created by Alice. Alice adds Bob to the group with a "full" > commit (hence *init_secret* =3D *0* and *commit_secret* =E2=89=A0 *0*). N= ext, Alice > adds Charlie to the group with an "add-only" commit (not updating the > TreeKEM tree). Next, Alice adds Eve to the group also with an "add-only" > commit (again not updating the TreeKEM tree). > > > At this point, Eve learn sthe value at the root of the TreeKEM tree. Sinc= e > this hasn't changed since the first epoch, Eve can find the > *commit_secret* for the first commit of the group. This, together with > the fact that *init_secret* is the all-zero vector, allows Eve to compute > the * joiner_secret* and *welcome_secret* for the first commit. Hence, > Eve can now carry out the attack described first to obtain all the keys f= or > the epoch in which Bob was added. > > > Furthermore, because the *commit_secret* for the next commit is the > all-zero vector, Eve can compute the *joiner_secret* and *welcome_secret* > for the second commit as well. Hence, Even can carry out the attack > described first again. In fact, even is able to do this until she reaches > the commit in which she was added herself. > > > > I believe the easiest way to mitigate these attacks (and any attacks like > it) is by requiring that the *init_secret* of the first commit is a > randomly sampled value. Alternatively, the first two commits of a group > could be required to be "full" commits. > > > Eric. > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000005c104105ac237337 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Eric,

Thanks for the anal= ysis, and the detailed, clear writeup.=C2=A0 I agree that there are some re= al issues here, and with the solution approach.=C2=A0 Just to align on a co= uple of details:

#1 is clearly a problem.=C2= =A0 Good catch.

#2 is less clear to me.=C2=A0 You = lose me when you say ""add-only" commits allow new group mem= bers (ONLY) to learn the value at the root of the TreeKEM tree".=C2=A0= How do you think this happens?=C2=A0 As I understand the spec, this is not= the case.=C2=A0 New members are added to the "unmerged_leaves" a= rray at the root, but they are not told the root secret or root private key= .

In any case, I agree that we should change the i= nitial init_secret from being zero to being random.=C2=A0 I think I had set= it to zero out of a general caution against requiring fresh entropy, and l= ikely under the theory that the first commit would change it (before `path`= was optional).=C2=A0 But it is clearly necessary now.=C2=A0 If you would l= ike to send a PR, I would be happy to review.

Than= ks,
--Richard



On Wed, Aug 5, 2= 020 at 9:27 AM Cornelissen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


Quick introduction: my name is Eric, I have submitted a few issues in th= e MLS GitHub and I did an analysis of MLS for my Master's thesis last a= cademic year, now I'm doing a research project related to MLS with C. B= ruzska.


During this project I found a potential issues with "add-only"= commits if used in the early lifetime of a group. I found two particular i= ssues that I think are most important to look at and which I will describe = both here.


Note 1: Neither of the issues I describe hold when a PSK is used, hence = I will only consider scenarios where PSKs are not used.

Note 2: In both attacks the attacker must record the (encrypted) Welcome= message(s) send out for a group (i.e. I'm assuming a network adversary= ).

Note 3: I use "add-only" commit to denote an commit that does = not populate the path value of a commit and "full" commit to deno= te a commit that does populate the path vale of a commit. This, I suppose, deviates slightly = from the draft.

Note 4: I attached diagrams explaining the attacks, I hope they are unde= rstandable :)


  1. When using an "add-only" commit for the first commit (see att= achment 01.jpg for a diagram)

The first issue is w.r.t. using an "add-only" commit as the ve= ry first commit of a new group. To the best of my knowledge this would resu= lt in the input to the key schedule being to two all-zero vectors. Namely, = the init_secret for the first commit is always the all-zero ve= ctor and the commit_secret will be an al-zero vector because an "a= dd-only" commit was used.


Now, this would allow ANYONE to derive the joiner_secret and welcome_secret for the first commit. With the welcome_secr= et we can decrypt the Welcome message for the user(s) being added = to the group. From the Welcome message we can construct the GroupContext th= at is used in the key schedule (GroupContext_[n] is a subset of the GroupInfo in the Welcome message).


With all this information ANYONE can compute all of the keys produced by= the key schedule for the first epoch and read any communication that happe= ns in this epoch. Furthermore, if another "add-only" commit is us= ed the input to the key schedule for the next epoch is also known to the attacker(!) as commit_secret w= ill again be an al-zero vector, and we know the init_secret.


  1. When using a "Full" commit followed by "add-only" c= ommits (see attachment 02.jpg for a diagram)

The second issue arises from the fact that "add-only" commits = allow new group members (ONLY) to learn the value at the root of the TreeKE= M tree in some earlier epoch E. In general this is not a problem, because t= hey won't know the init_secret for epoch E-1. However, if only the very first= commit for a group is a "full" commit new group members do know = the init_secret for epoch E-1, as it is always the all-zero-ve= ctor.


From here the attack proceeds very similarly to the other attack. Imagin= e a group is created by Alice. Alice adds Bob to the group with a "ful= l" commit (hence init_secret =3D 0 and commit_secr= et =E2=89=A0 0). Next, Alice adds Charlie to the group with an "ad= d-only" commit (not updating the TreeKEM tree). Next, Alice adds Eve t= o the group also with an "add-only" commit (again not updating th= e TreeKEM tree).


At this point, Eve learn sthe value at the root of the TreeKEM tree. Sin= ce this hasn't changed since the first epoch, Eve can find the commit_secret for the first commit of the group. This, tog= ether with the fact that init_secret is the all-zero vector, allows Eve to compute = the joiner_secret and welcome_secret for the first co= mmit. Hence, Eve can now carry out the attack described first to obtain all= the keys for the epoch in which Bob was added.


Furthermore, because the commit_secret for the next com= mit is the all-zero vector, Eve can compute the joiner_secret and welcome_secret for the = second commit as well. Hence, Even can carry out the attack described first= again. In fact, even is able to do this until she reaches the commit in wh= ich she was added herself.



I believe the easiest way to mitigate these attacks (and any attacks lik= e it) is by requiring that the init_secret of the first commit is a randomly sampled valu= e. Alternatively, the first two commits of a group could be required to be = "full" commits.


Eric.


_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000005c104105ac237337-- From nobody Wed Aug 5 23:44:50 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6370A3A0AAE for ; Wed, 5 Aug 2020 23:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1aoBPzZqpEJL for ; Wed, 5 Aug 2020 23:44:46 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5EA223A0786 for ; Wed, 5 Aug 2020 23:44:45 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 80D17115931_F2BA6D7B; Thu, 6 Aug 2020 06:44:39 +0000 (GMT) Received: from exng4.org.aalto.fi (exng4.org.aalto.fi [130.233.223.23]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng4.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 55FBE11596E_F2BA6C3F; Thu, 6 Aug 2020 06:44:19 +0000 (GMT) Received: from exng7.org.aalto.fi (130.233.223.26) by exng4.org.aalto.fi (130.233.223.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 6 Aug 2020 09:44:19 +0300 Received: from exng4.org.aalto.fi (130.233.223.23) by exng7.org.aalto.fi (130.233.223.26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 6 Aug 2020 09:44:18 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Thu, 6 Aug 2020 09:44:18 +0300 From: Cornelissen Eric To: Richard Barnes CC: "mls@ietf.org" Thread-Topic: [MLS] Potential issues with "add-only" commits in young groups Thread-Index: AQHWaysOYLkshmHVlE2/Q1XWhkDVcqkpefyAgAEn/L8= Date: Thu, 6 Aug 2020 06:44:18 +0000 Message-ID: <37a1560c423a4a36aaeb93d558b1552c@aalto.fi> References: , In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_37a1560c423a4a36aaeb93d558b1552caaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=gkqx4iBEwQ+cxEipzVnJNL9Mt94AO191XYGynHOSq5Q=; b=y+VqRakiWmby7IdafrJs6CZz55Jin7x1X+8piUHB1CGFyvue1SXiLe0FYc6bNPTfUmEdFiOMNMRkbCMNSZ8C1kqWIgkvJDExH4/LbmdYIeam2Ipa2evSU2waG/dMucVwIToN0IxsiY5tCep6lEi5gcwoivbX+bnPzPiaPPF3xLwXtsA++Y431ZwA9K4eEl8L0IwolhcdIUqRbNnGVDi8rhKEH6rKgq10VX+ZW9rma9Tug/DUKyO2My9L1yGSfHXrKSoQoVT13JIElytlIUdH5+HomOMDFUHYHoQ5Me4Jp+h1fAj32SDzRYjtf/HgOS35gSs9kE2uIwekUK7GPkrLvQ== Archived-At: Subject: Re: [MLS] Potential issues with "add-only" commits in young groups X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Aug 2020 06:44:49 -0000 --_000_37a1560c423a4a36aaeb93d558b1552caaltofi_ Content-Type: text/plain; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable Hi Richard, I will try to get in a PR to change the initial init_secret from being zero= to being random. Regarding #2, thanks for the clarification. If, as you say, a joiner does n= ot learn the value at the root of the TreeKEM tree in the case of an "add-o= nly" commit, then the attack I describe doesn't work. To me, it was not 100= % obvious from the spec whether or not this was true or not (though it make= s sense seeing that the joiner doesn't need to know that value). Regards, Eric ________________________________ From: Richard Barnes Sent: Wednesday, August 5, 2020 6:58:49 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Potential issues with "add-only" commits in young groups Hi Eric, Thanks for the analysis, and the detailed, clear writeup. I agree that the= re are some real issues here, and with the solution approach. Just to alig= n on a couple of details: #1 is clearly a problem. Good catch. #2 is less clear to me. You lose me when you say ""add-only" commits allow= new group members (ONLY) to learn the value at the root of the TreeKEM tre= e". How do you think this happens? As I understand the spec, this is not = the case. New members are added to the "unmerged_leaves" array at the root= , but they are not told the root secret or root private key. In any case, I agree that we should change the initial init_secret from bei= ng zero to being random. I think I had set it to zero out of a general cau= tion against requiring fresh entropy, and likely under the theory that the = first commit would change it (before `path` was optional). But it is clear= ly necessary now. If you would like to send a PR, I would be happy to revi= ew. Thanks, --Richard On Wed, Aug 5, 2020 at 9:27 AM Cornelissen Eric > wrote: Hi All, Quick introduction: my name is Eric, I have submitted a few issues in the M= LS GitHub and I did an analysis of MLS for my Master's thesis last academic= year, now I'm doing a research project related to MLS with C. Bruzska. During this project I found a potential issues with "add-only" commits if u= sed in the early lifetime of a group. I found two particular issues that I = think are most important to look at and which I will describe both here. Note 1: Neither of the issues I describe hold when a PSK is used, hence I w= ill only consider scenarios where PSKs are not used. Note 2: In both attacks the attacker must record the (encrypted) Welcome me= ssage(s) send out for a group (i.e. I'm assuming a network adversary). Note 3: I use "add-only" commit to denote an commit that does not populate = the path value of a commit and "full" commit to denote a commit that does p= opulate the path vale of a commit. This, I suppose, deviates slightly from = the draft. Note 4: I attached diagrams explaining the attacks, I hope they are underst= andable :) 1. When using an "add-only" commit for the first commit (see attachment = 01.jpg for a diagram) The first issue is w.r.t. using an "add-only" commit as the very first comm= it of a new group. To the best of my knowledge this would result in the inp= ut to the key schedule being to two all-zero vectors. Namely, the init_secr= et for the first commit is always the all-zero vector and the commit_secret= will be an al-zero vector because an "add-only" commit was used. Now, this would allow ANYONE to derive the joiner_secret and welcome_secret= for the first commit. With the welcome_secret we can decrypt the Welcome m= essage for the user(s) being added to the group. From the Welcome message w= e can construct the GroupContext that is used in the key schedule (GroupCon= text_[n] is a subset of the GroupInfo in the Welcome message). With all this information ANYONE can compute all of the keys produced by th= e key schedule for the first epoch and read any communication that happens = in this epoch. Furthermore, if another "add-only" commit is used the input = to the key schedule for the next epoch is also known to the attacker(!) as = commit_secret will again be an al-zero vector, and we know the init_secret. 1. When using a "Full" commit followed by "add-only" commits (see attach= ment 02.jpg for a diagram) The second issue arises from the fact that "add-only" commits allow new gro= up members (ONLY) to learn the value at the root of the TreeKEM tree in som= e earlier epoch E. In general this is not a problem, because they won't kno= w the init_secret for epoch E-1. However, if only the very first commit for= a group is a "full" commit new group members do know the init_secret for e= poch E-1, as it is always the all-zero-vector. >From here the attack proceeds very similarly to the other attack. Imagine a= group is created by Alice. Alice adds Bob to the group with a "full" commi= t (hence init_secret =3D 0 and commit_secret =1B$B!b=1B(B 0). Next, Alice a= dds Charlie to the group with an "add-only" commit (not updating the TreeKE= M tree). Next, Alice adds Eve to the group also with an "add-only" commit (= again not updating the TreeKEM tree). At this point, Eve learn sthe value at the root of the TreeKEM tree. Since = this hasn't changed since the first epoch, Eve can find the commit_secret f= or the first commit of the group. This, together with the fact that init_se= cret is the all-zero vector, allows Eve to compute the joiner_secret and we= lcome_secret for the first commit. Hence, Eve can now carry out the attack = described first to obtain all the keys for the epoch in which Bob was added= . Furthermore, because the commit_secret for the next commit is the all-zero = vector, Eve can compute the joiner_secret and welcome_secret for the second= commit as well. Hence, Even can carry out the attack described first again= . In fact, even is able to do this until she reaches the commit in which sh= e was added herself. I believe the easiest way to mitigate these attacks (and any attacks like i= t) is by requiring that the init_secret of the first commit is a randomly s= ampled value. Alternatively, the first two commits of a group could be requ= ired to be "full" commits. Eric. _______________________________________________ MLS mailing list MLS@ietf.org https://www.ietf.org/mailman/listinfo/mls --_000_37a1560c423a4a36aaeb93d558b1552caaltofi_ Content-Type: text/html; charset="iso-2022-jp" Content-Transfer-Encoding: quoted-printable

Hi Richard,


I will try to get in a PR to change the initial init_secret from = being zero to being random.


Regarding #2, thanks for the clarification. If, as you say, a joiner doe= s not learn the value at the root of the TreeKEM tree in the case of an &qu= ot;add-only" commit, then the attack I describe doesn't work. To me, i= t was not 100% obvious from the spec whether or not this was true or not (though it makes sense seeing that the joiner = doesn't need to know that value).


Regards,

Eric

From: Richard Barnes <rl= b@ipv.sx>
Sent: Wednesday, August 5, 2020 6:58:49 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Potential issues with "add-only" commit= s in young groups
 
Hi Eric,

Thanks for the analysis, and the detailed, clear writeup.  I agre= e that there are some real issues here, and with the solution approach.&nbs= p; Just to align on a couple of details:

#1 is clearly a problem.  Good catch.

#2 is less clear to me.  You lose me when you say ""add= -only" commits allow new group members (ONLY) to learn the value at th= e root of the TreeKEM tree".  How do you think this happens? = ; As I understand the spec, this is not the case.  New members are added to the "unmerged_leaves" array at the root, but they are n= ot told the root secret or root private key.

In any case, I agree that we should change the initial init_secret fro= m being zero to being random.  I think I had set it to zero out of a g= eneral caution against requiring fresh entropy, and likely under the theory= that the first commit would change it (before `path` was optional).  But it is clearly necessary now. = If you would like to send a PR, I would be happy to review.

Thanks,
--Richard



On Wed, Aug 5, 2020 at 9:27 AM Cornel= issen Eric <eric.cornelisse= n@aalto.fi> wrote:

Hi All,


Quick introduction: my name is Eric, I have submitted a few issues in th= e MLS GitHub and I did an analysis of MLS for my Master's thesis last acade= mic year, now I'm doing a research project related to MLS with C. Bruzska.<= /p>


During this project I found a potential issues with "add-only"= commits if used in the early lifetime of a group. I found two particular i= ssues that I think are most important to look at and which I will describe = both here.


Note 1: Neither of the issues I describe hold when a PSK is used, hence = I will only consider scenarios where PSKs are not used.

Note 2: In both attacks the attacker must record the (encrypted) Welcome= message(s) send out for a group (i.e. I'm assuming a network adversary).

Note 3: I use "add-only" commit to denote an commit that does = not populate the path value of a commit and "full" commit to deno= te a commit that does populate the path vale of a commit. This, I suppose, deviates slightly = from the draft.

Note 4: I attached diagrams explaining the attacks, I hope they are unde= rstandable :)


  1. When using an "add-only" commit for the first commit (see att= achment 01.jpg for a diagram)

The first issue is w.r.t. using an "add-only" commit as the ve= ry first commit of a new group. To the best of my knowledge this would resu= lt in the input to the key schedule being to two all-zero vectors. Namely, = the init_secret for the first commit is always the all-zero ve= ctor and the commit_secret will be an al-zero vector because an "a= dd-only" commit was used.


Now, this would allow ANYONE to derive the joiner_secret and welcome_secret for the first commit. With the welcome_secr= et we can decrypt the Welcome message for the user(s) being added = to the group. From the Welcome message we can construct the GroupContext th= at is used in the key schedule (GroupContext_[n] is a subset of the GroupInfo in the Welcome message).


With all this information ANYONE can compute all of the keys produced by= the key schedule for the first epoch and read any communication that happe= ns in this epoch. Furthermore, if another "add-only" commit is us= ed the input to the key schedule for the next epoch is also known to the attacker(!) as commit_secret w= ill again be an al-zero vector, and we know the init_secret.


  1. When using a "Full" commit followed by "add-only" c= ommits (see attachment 02.jpg for a diagram)

The second issue arises from the fact that "add-only" commits = allow new group members (ONLY) to learn the value at the root of the TreeKE= M tree in some earlier epoch E. In general this is not a problem, because t= hey won't know the init_secret for epoch E-1. However, if only the very first= commit for a group is a "full" commit new group members do know = the init_secret for epoch E-1, as it is always the all-zero-ve= ctor.


From here the attack proceeds very similarly to the other attack. Imagin= e a group is created by Alice. Alice adds Bob to the group with a "ful= l" commit (hence init_secret =3D 0 and commit_secr= et =1B$B!b=1B(B 0). Next, Alice adds Charlie to the group with an "ad= d-only" commit (not updating the TreeKEM tree). Next, Alice adds Eve t= o the group also with an "add-only" commit (again not updating th= e TreeKEM tree).


At this point, Eve learn sthe value at the root of the TreeKEM tree. Sin= ce this hasn't changed since the first epoch, Eve can find the commit_secret for the first commit of the group. This, tog= ether with the fact that init_secret is the all-zero vector, allows Eve to compute = the joiner_secret and welcome_secret for the first co= mmit. Hence, Eve can now carry out the attack described first to obtain all= the keys for the epoch in which Bob was added.


Furthermore, because the commit_secret for the next com= mit is the all-zero vector, Eve can compute the joiner_secret and welcome_secret for the = second commit as well. Hence, Even can carry out the attack described first= again. In fact, even is able to do this until she reaches the commit in wh= ich she was added herself.



I believe the easiest way to mitigate these attacks (and any attacks lik= e it) is by requiring that the init_secret of the first commit is a randomly sampled valu= e. Alternatively, the first two commits of a group could be required to be = "full" commits.


Eric.


_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--_000_37a1560c423a4a36aaeb93d558b1552caaltofi_-- From nobody Thu Aug 6 03:02:18 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 149F83A10BE for ; Thu, 6 Aug 2020 03:02:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WpAzW2Oe9oWI for ; Thu, 6 Aug 2020 03:02:15 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D8AD33A10BA for ; Thu, 6 Aug 2020 03:02:14 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 472812713F5_F2BD521B for ; Thu, 6 Aug 2020 10:02:09 +0000 (GMT) Received: from exng3.org.aalto.fi (exng3.org.aalto.fi [130.233.223.22]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng3.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id E54B82713F2_F2BD520F for ; Thu, 6 Aug 2020 10:02:08 +0000 (GMT) Received: from exng5.org.aalto.fi (130.233.223.24) by exng3.org.aalto.fi (130.233.223.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 6 Aug 2020 13:02:08 +0300 Received: from exng4.org.aalto.fi (130.233.223.23) by exng5.org.aalto.fi (130.233.223.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 6 Aug 2020 13:02:08 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Thu, 6 Aug 2020 13:02:08 +0300 From: Cornelissen Eric To: "mls@ietf.org" Thread-Topic: Two poorly defined aspects of the spec Thread-Index: AQHWa9hzVoJJMfPk+kK5poDHTeMmXg== Date: Thu, 6 Aug 2020 10:02:08 +0000 Message-ID: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_af4a72d6f3ae4c809367222386340e6caaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:subject:date:message-id:content-type:mime-version; s=its18; bh=hZNatypOw/nG9//a67ATPvA+RjtHIE0FKDbqyVsjoY4=; b=febIH42Wufcg+V6mimSalw4z0+h+ZJzZgF/SA2W4+Pm7yCYCIhPh7Vpj7x7kXNbD5WGxnWwPAk7/Pv8li9lGkVJw97BHrD235bK9o5T/2gWAms5/68wRzp5VFUNHECrc24Lke8SKXkQPWenntuUtATEvH9SxDt8/voOyanRkFRkev+pQ1Qxcl+pET9z05A3MuAmwQIjQwxhe0q1EIOe2Tj6RaTGUE+Fce35C1LJunGXPCGXSz4g3sWnQwYcqSpwdT/347LypgfbnxG9zrCHrpnps7N2jMxZW3lSr3Z/gvKPpg7fkchzprKKJXkftD5pDVuL5Xs1YQqrE+nsBgH8ifQ== Archived-At: Subject: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Aug 2020 10:02:17 -0000 --_000_af4a72d6f3ae4c809367222386340e6caaltofi_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi All, I have two questions about things that are unclear to me in the current sta= te of the spec as they are undefined/poorly defined. 1. What is the intended value of interim_transcript_hash_[0]? >From the current draft I cannot definitively (i.e. with 100% certainty) say= whether the value of the first interim_transcript_hash should be: a. "the zero-length octet string" following the last line of Group state se= ction, or b. a value derived based on the MLSPlaintextCommitAutData for the first com= mit concatenated with 0: interim_transcript_hash_[0] =3D Hash(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthDat= a_[0]) =3D Hash(0 || MLSPlaintextCommitAuthData_[0]) The draft strongly suggests to me that it is the former, but the latter see= ms to more accurately reflect the statement "The confirmed_transcript_hash = field contains a running hash over the messages that led to this state." In the case that a is correct I would suggest updating the definition of in= terim_transcript_hash_[n] to: interim_transcript_hash_[0] =3D 0 interim_transcript_hash_[n] =3D Hash(confirmed_transcript_hash_[n] || MLSPlaintextCommitAuthData_[n]); In the case that b is correct I would suggest adding a "warning" that says = something along the lines of "as a placeholder value" to the place(s) where= the draft says that the interim_transcript_hash of a group is initialized = to 0. 2. What is the `members` array mentioned in the Group creation section? In that section it is stated that "A new member receiving a Welcome message= can recognize group creation if the number of entries in the `members` arr= ay is equal to the number of leaves in the tree minus one." First of all, i= t is not clear what this `members` array is. It seems this refers to a fiel= d of the now-removed Init struct. Interestingly this struct was removed in = the very same PR that added the above sentence (see #239). But I wasn't able to really figure out what= the draft-09 equivalent of it should be. In addition, I'm pretty sure this technique would no longer work to detect = group creation (but that would depend on how the sentence should be updated= ). Regards, Eric --_000_af4a72d6f3ae4c809367222386340e6caaltofi_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1. What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
    interim_transcript_hash_[0]
        =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
        = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
    interim_transcript_hash_[0] =3D 0
    interim_transcript_hash_[n] =3D=0A=
        Hash(confirmed_transcript_hash_[n] ||=
=0A=
            MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the dra= ft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer work= to detect group creation (but that would depend on how the sentence should= be updated).


Regards,
Eric
--_000_af4a72d6f3ae4c809367222386340e6caaltofi_-- From nobody Thu Aug 6 09:44:34 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EDADF3A0C80 for ; Thu, 6 Aug 2020 09:44:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id a-50xfPCohCJ for ; Thu, 6 Aug 2020 09:44:31 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 94F333A0BE0 for ; Thu, 6 Aug 2020 09:44:31 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id k18so36803441qtm.10 for ; Thu, 06 Aug 2020 09:44:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=nCxKKd4CIkYDWvVsjNUBT1HxfQ8BhZloUaaDTsjNkDw=; b=F+/5n8kHqHoxBmcQIyZ/QFI/O34tOFsN4PL7o8N8C9DDdJIxR1tjLB8cVP4S1UAFwc gsgn/h0MSQ+JbrKANcfEWDay/SAomZnWIKl7wbAfBLRVSQkVy7449UPKPGY8LEEOrYYa s5W3b8txLtCEG66zqt1gc2C2R3ysXBaYWksFs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=nCxKKd4CIkYDWvVsjNUBT1HxfQ8BhZloUaaDTsjNkDw=; b=iGoyzw4o9Yia8XzY1phuML7tu1eKnf2C/RN1zjTLtNLK/9m2RDmYeGcrotgV/igbRF K8bY2DwK7bCfhNHFmL4IKUrK+la6qUW6u4TPgie7s7sRW2B8f67EbscXdGUbL0m6YkHq nfPwLHRVz8i9jUj9vA5pyor12aZbVRNx2BcedTDcs5Lk2WWrX+gOn6aRbQ9clvX6sqmK 5TfwJi0rbzwEDj6K9dXWLWt1Hbr0JPVDWoQbKW3mqiUFGQMXEbjuK+EyJIexk/New/bV YnKw0kEy9gA7uXhALWSNlOKBvWmLcoaKoXpkftn8Oz6kiBjxlUgXNBVEGSlCo03vzB/z Itww== X-Gm-Message-State: AOAM5331ac0r5X0Dt3MD3bRl5lRksSFAH+/iU+MBRn+0uNo0MB/CtTsW yU2oadnyyy2+uNoyYnc1W3Qznht8xKY= X-Google-Smtp-Source: ABdhPJxDLKr3WhhHOqzeVGwFSPp0N9TPh6WxcGu6sYR0RyjRBl+6p3QwKvnGtUVrf8681UT0pJV0aw== X-Received: by 2002:ac8:7205:: with SMTP id a5mr9830513qtp.235.1596732270079; Thu, 06 Aug 2020 09:44:30 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id o39sm5363944qtj.0.2020.08.06.09.44.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 06 Aug 2020 09:44:29 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Message-Id: Date: Thu, 6 Aug 2020 12:44:28 -0400 To: MLS List X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: [MLS] 20200811 MLS WG Virtual Interim X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 06 Aug 2020 16:44:33 -0000 Hi! We are having a virtual interim Tuesday 11 August 2020 at 1600 UTC. = Webex details can be found here: https://datatracker.ietf.org/meeting/interim-2020-mls-18/session/mls Our agenda is to address protocol related issues and PRs. Outstanding = Issues and PRs can be found here: https://github.com/mlswg/mls-protocol Nick and Sean= From nobody Fri Aug 7 09:06:12 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EB2B3A0B3B for ; Fri, 7 Aug 2020 09:06:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N-M6hFB8h9dR for ; Fri, 7 Aug 2020 09:06:06 -0700 (PDT) Received: from mail-qk1-x72b.google.com (mail-qk1-x72b.google.com [IPv6:2607:f8b0:4864:20::72b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 585CC3A0B46 for ; Fri, 7 Aug 2020 09:06:06 -0700 (PDT) Received: by mail-qk1-x72b.google.com with SMTP id x69so2192807qkb.1 for ; Fri, 07 Aug 2020 09:06:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=yF0uzHy4WP4xT0NZASx8DOHztGyIi2AcyOFnOto4WpA=; b=MvH3dviiq37Gqs6UcVkZH2UNLHbnt9FTv0Zj4pjKRDVEAq5ccAoDnfEezbW+xKd7oy EiOT2mljCIKaFP/DSNr/KU1d8bN6WYJn6uON/uZg5PGXDJPfLadmEAy6lezer2gYPuSO zptKlxJnBmK6kl7YwWDhPL9xGjBK8QUeNNyXP9JLykdFR3A9vgAVMiAV0eD310bJbG5q aBi0JfYMM2wEiNBFVUE9gvZ7KtqbOwePFsek9TTMX4kEzIraLKH1qlDadopYSp6XEFPi IygVPklKOIrwRdMmM6UZzLYfdCuzjRI5o3pSMag98GNYhgabDWYlqSs7wJkoExdxVBhO SOmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=yF0uzHy4WP4xT0NZASx8DOHztGyIi2AcyOFnOto4WpA=; b=A86v2FK1gJZ/pNHgk119aqgTBi3AzDawLcrAMF0ypy3ScDkTGVPRxdpZOou6q0NvFr fpZ9UM9KWe8IuezqCyRoM6h2OaWkiqAAFopA9IYJgOl/kN+9OaF1rn0Q+rXc1DUeL7aX kfZbotGBujhqXnsh8v3jl18msuC+alyxQvwUhmTTdj2HJDb0d0P7G+XgnNVXmaOBek7z GGPVsmWOAVwhO0VmH2uemTUC+jlGjKdz5NB0UA7bc4WQcF/an32UHkWGTy4WZ3tQk2Ac j3ETq2kb6HgZXgIcSDTjML3OLPJyQw4H8ixm4ct6XDM4MaRNhTw29pQgr4lR5Uupb9kf jsXw== X-Gm-Message-State: AOAM533DSfnR+LJ+kiTji5v//VRZBkYnluHYWaQQHNdzMD7Aw2o9TMdJ 1zFpu3KtT76hUmnpK9pxl4HqV1IeURsOFRTrvQcz2cnKJCCpLQ== X-Google-Smtp-Source: ABdhPJwUqNV+6eltyhfP+ljdjduCMzlLnqPF/+cSvwIGil3ccPttq4Cd79NkEIJaOotzTvUv3sHsjeDU8jGjbzErMUA= X-Received: by 2002:a37:99c7:: with SMTP id b190mr14710924qke.347.1596816365177; Fri, 07 Aug 2020 09:06:05 -0700 (PDT) MIME-Version: 1.0 References: <710ba832-c77c-58d2-a7b4-b8dc8eaf09e3@datashrine.de> In-Reply-To: From: Richard Barnes Date: Fri, 7 Aug 2020 12:05:50 -0400 Message-ID: To: Konrad Kohbrok Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="00000000000037e61805ac4bc8fd" Archived-At: Subject: Re: [MLS] PSK Injection, Group recovery, Re-Init, Sub-group Branching (#336) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 07 Aug 2020 16:06:11 -0000 --00000000000037e61805ac4bc8fd Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Konrad, Britta and I just sync'ed up and drafted a plan of action on these issues: - For Commit Extensions (#366), PR#369 is fine, we'll focus on landing that - Konrad/Britta are going to draft a new PR for how PSK are signaled and included in the key schedule, using a Commit extension (#367) - For simplicity given that PSKs are optional, injection will be in two phases: (1) combine the PSKs into a derived_psk and (2) inject the derived_psk into the key schedule - So some of the nPRF stuff might get pulled in for that first stage - PR#336 will get refocused on defining how resumption is done using the PSK mechanism (#368) - Konrad/Britta will either make a new PR for Authentication Codes (or whatever we call them) or keep them in #336 One significant design question for the group: Should we have a Proposal that allows group members to request that a PSK be injected? On the one hand: - Having a Proposal would bring the full PSK lifecycle within the scope of MLS. In particular, the request would be authenticated within the group and included in the transcript. - If the DS wants to instruct the group to inject a PSK, they could re-use the proposal-from-outside machinery that already exists On the other hand: - It's not clear that including the request for a PSK in the transcript is all that useful (as opposed to just the instruction to use it) - We would probably want to solve the general problem of new proposals (#383) if we do this, which is a nontrivial amount of complexity Overall, my inclination is to not have a Proposal, since the benefits of extra authentication don't seem to merit the complexity. But feedback from others would be useful here. --Richard On Tue, Jul 28, 2020 at 1:37 PM Richard Barnes wrote: > Actually, noticed one thing that isn't accounted for in that list: > > Derive an "authentication secret" > https://github.com/mlswg/mls-protocol/issues/374 > > A fun question for the list is what we should call these things, since > there are a bunch of terms in the prior art, for example: > > - Authentication secret [PR#336] > - Short authentication string [ZRTP, TLS] > - Safety numbers [Signal] > - Security codes [Zoom security whitepaper] > > Personally, I'm inclined against things that include "authentication", > since the thing we're defining here is a backstop to the primary > Authentication Service. Among the above list, "Security Codes" might be = my > favorite. Otherwise, maybe something like "group state verifier"? > > > On Fri, Jul 24, 2020 at 6:39 PM Richard Barnes wrote: > >> Picking this thread back up: >> >> I tried to encapsulate my approach to the issues here in a few GitHub >> issues and one PR: >> >> Reorder key schedule inputs >> https://github.com/mlswg/mls-protocol/issues/362 >> >> Add extensions to the Commit message >> https://github.com/mlswg/mls-protocol/issues/366 >> >> Negotiate PSKs >> https://github.com/mlswg/mls-protocol/issues/367 >> >> Proof of prior membership in the group / Resumption >> https://github.com/mlswg/mls-protocol/issues/368 >> >> Konrad / Britta - I think those combine to cover the cases you were >> trying to address in #366, but tease the issues apart a bit more clearly= . >> Does that make sense to you? What have I missed here? If this general >> plan looks good, I think we can get the details arranged and agreed fair= ly >> quickly, as these are each pretty self-contained pieces of work. >> >> Thanks, >> --Richard >> >> On Tue, Jul 14, 2020 at 12:37 PM Konrad Kohbrok < >> konrad.kohbrok@datashrine.de> wrote: >> >>> We just briefly touched upon this PR in the virtual interim on July 14t= h >>> and I >>> think we agreed that the discussion should be continued on the >>> mailinglist and >>> then tied up at the IETF 108 meeting. >>> >>> I think continuing the discussion on the mailinglist is a good idea, >>> however, >>> neither Britta nor myself are going to be present at the IETF 108 >>> meeting. Maybe >>> we can push the discussion to the next virtual interim meeting instead? >>> >>> Cheers, >>> Konrad >>> >>> >>> On 18.06.20 16:29, Konrad Kohbrok wrote: >>> > Hi, >>> > >>> > Just a small addition to Britta's response: >>> > >>> > For #3: We already mandate that the parent group must not be used >>> anymore if a >>> > Re-Init proposal is included in a commit in lines 2341-2342 of the PR >>> (although >>> > "to send messages" might as well be removed). We could also get rid o= f >>> the >>> > proposal and simply have the intent to re-initialize be implicit in >>> sending a >>> > Welcome message with a corresponding PSK Id. The idea behind the >>> Proposal was to >>> > make that intent explicit such that the intent, as well as the target >>> > ciphersuite and MLS version are all entered into the transcript and >>> thus agreed >>> > upon. Even though the group is terminated after the proposal is >>> received, this >>> > agreement can be verified by using the authentication key technique >>> that Britta >>> > proposed, i.e. each party can check that their authentication key >>> corresponds to >>> > the one the committer uploaded. >>> > >>> > I'm also ok with splitting it into multiple individual PRs if that >>> makes it >>> > easier to review and discuss. >>> > >>> > Cheers, >>> > Konrad >>> > >>> > >>> > On 18.06.20 04:07, Hale, Britta (CIV) wrote: >>> >> Hi Richard, >>> >> >>> >> >>> >> >>> >> Thank you for the comments and careful read of the PR. >>> >> >>> >> >>> >> >>> >> For #1/#2: I am amicable to the idea of adding an extension field to >>> the commit >>> >> message. As a general comment, we may want to consider if there are >>> other types >>> >> of commit extensions worth adding or, alternatively, how the field >>> may be abused >>> >> (e.g. treated as AD by an application). >>> >> >>> >> It terms of objection to the current form though, your argument is >>> not clear. >>> >> PSKIds should uniquely identify PSKs, and a joiner (or anyone) shoul= d >>> be able to >>> >> identify the correct PSK given the PSKId, if they are in possession >>> of it. PSKs >>> >> must only be used in an Add if the joiner is a past group member >>> (line 2055) and >>> >> therefore has the correct PSKId/group_id/psk_epoch, although this is >>> nullified >>> >> if we make the change discussed in #4. In that case, the issue for >>> Adds goes away. >>> >> >>> >> The PR already allows for a PSK in the Welcome message. >>> >> >>> >> >>> >> >>> >> For #3: Currently, in the PR, there is a recovery_secret derived >>> per-epoch. When >>> >> a member wants to re-initialize, they issue a Re-Init proposal. They >>> may then >>> >> re-initialize the group by sending a Welcome message (see lines 1923= , >>> 1948, and >>> >> 2349) with the PSKId for the parent group/epoch and a psktype that >>> indicates >>> >> that they are re-initializing the group with the stated PSKId. So >>> this seems to >>> >> already be what you describe below as =E2=80=9Chave the initiator of= the >>> child send a >>> >> Welcome that has a pointer back to the parent=E2=80=9D. However, you= are >>> right that more >>> >> detail can be added; in particular a requirement should be added to >>> terminate >>> >> the parent group and that the terminating member/re-init proposer >>> must also >>> >> create the new group. >>> >> >>> >> >>> >> >>> >> For #4: There was a discussion at the first virtual interim in late >>> April >>> >> (Interim #11-2020) wherein some expressed a desire for this feature. >>> Namely, >>> >> instead of re-syncing the entire group, there were use cases for >>> re-syncing the >>> >> odd member when necessary. Its inclusion in the PR arises from that >>> later >>> >> request. I am favorable to removing it since, from security >>> standpoint, it is >>> >> not ideal. However, the motivation for this was pushed from the >>> implementation >>> >> standpoint. Consequently, now is a good time for anyone to speak up >>> who wants to >>> >> push for this. >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> One item: you made point of specifically requesting =E2=80=93 a few = times =E2=80=93 >>> at the >>> >> virtual interims #11 and #12 in April/May that this PSK PR and as >>> many other key >>> >> schedule-related PRs be combined into a single one. Raphael made a >>> similar >>> >> request under git issue #325. In fact, the authors of this PR had >>> pushed back on >>> >> that insistence to limit the current PR down to the items it >>> currently covers, >>> >> instead of merging in other key schedule changes as well. Are you >>> saying that >>> >> you have changed your mind? >>> >> >>> >> We can, of course, accommodate a revised preference if needed. >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> Britta >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> >>> >> *From: *MLS on behalf of Richard Barnes >>> >>> >> *Date: *Wednesday, June 17, 2020 at 3:54 PM >>> >> *To: *Messaging Layer Security WG >>> >> *Subject: *[MLS] PSK Injection, Group recovery, Re-Init, Sub-group >>> Branching (#336) >>> >> >>> >> >>> >> >>> >> Hey all, >>> >> >>> >> Sorry for the late review on this PR, I have finally gotten a chance >>> to really >>> >> dig into it, and ... I have some concerns. My current thinking is >>> consistent >>> >> with my earlier comments that the general thrust of this PR is OK. >>> But I think >>> >> the actual approach needs to change a fair bit. >>> >> >>> >> As its title implies, this PR is trying to do several things at once= , >>> which seem >>> >> to me to be fairly separable: >>> >> >>> >> 0. Update the key schedule so that PSKs are injected at the right >>> point and >>> >> multiple PSKs are supported >>> >> 1. Signal that a PSK should get injected into a given epoch >>> >> 2. Request injection of PSK at join / in Welcome >>> >> 3. Re-initialize the group with different parameters >>> >> 4. Re-sync group members that have lost state >>> >> >>> >> For the most part, I think these are worthwhile goals, but they >>> should be >>> >> accomplished in different ways than the PR proposes. Detailed >>> thoughts by >>> >> objective: >>> >> >>> >> >>> >> # 0. Update the key schedule so that PSKs are injected at the right >>> point and >>> >> multiple PSKs are supported >>> >> >>> >> This part of the PR is fine, but I think is ultimately done a bit >>> more elegantly >>> >> with the n-PRF stuff in #337. >>> >> >>> >> >>> >> # 1. Signal that a PSK should get injected into a given epoch >>> >> # 2. Request injection of PSK at join / in Welcome >>> >> >>> >> (These go together) >>> >> >>> >> The PR proposes (heh) an EPSK proposal or an Add proposal, but then >>> requires >>> >> that only one EPSK be used. I actually don't the proposal for >>> including PSKs in >>> >> Adds actually works. The joiner would have to know all of them plus >>> the EPSK, >>> >> and there's not even any syntax in the PR to tell the joiner which >>> ones to include. >>> >> >>> >> I would propose that instead we add an extensions field to the Commi= t >>> message, >>> >> then add a Commit extension that specifies the PSK ID for the PSK to >>> be added. >>> >> That extension can then also go in the Welcome message corresponding >>> to the >>> >> commit, so that joiners know to add the PSK. >>> >> >>> >> This change actually doesn't make a difference in terms of what ends >>> up in the >>> >> transcript -- either way, only the PSK ID selected by the committer >>> goes in the >>> >> transcript. It seems better not to deliberately have proposals >>> floating around >>> >> that never get included in the transcript. >>> >> >>> >> >>> >> # 3. Re-initialize the group with different parameters >>> >> >>> >> The PR proposes another proposal type for reinitialization, but it's >>> really >>> >> under-specified what you do to re-init. For example, what goes in >>> the ratchet >>> >> tree? Clearly you need a brand new tree, since the one you have >>> might be tied >>> >> to the wrong ciphersuite. What you really need is something like a >>> Welcome message. >>> >> >>> >> And that's how I think we should actually arrange things. Instead o= f >>> having the >>> >> parent group do something to spawn, have the initiator of the child >>> send a >>> >> Welcome that has a pointer back to the parent. So we have another >>> Welcome >>> >> extension (`parent_group`, say) that has a pointer to the parent >>> group by group >>> >> ID and epoch, and instructs the joiner to take a secret from that >>> group/epoch's >>> >> key schedule and add it into the new group's key schedule. >>> >> >>> >> >>> >> >>> >> # 4. Re-sync group members that have lost state >>> >> >>> >> We should not do these. At the January interim, we decided not to >>> drop the >>> >> resync issue (#93) given that there were some subtleties depending o= n >>> exactly >>> >> what state had been lost, and that it could be cleanly done in a >>> separate spec. >>> >> >>> >> >>> >> # Conclusions >>> >> >>> >> Given the above, I would propose we break this into separate issues >>> to be closed >>> >> with individual, smaller PRs. Assuming that (0) will get addressed >>> by the n-PRF >>> >> PR, that leaves us with: >>> >> >>> >> #XXX Add Extensions to the Commit message >>> >> #XXX Signal use of external PSKs in Commit/Welcome (=3D> extension t= o >>> >> Commit/Welcome messages) >>> >> #XXX Allow Welcome to signal the inclusion of information from a >>> prior group (=3D> >>> >> Welcome extension) >>> >> >>> >> Happy to write those up, and contribute to PRs. Sorry again for the >>> slow >>> >> progress here. >>> >> >>> >> --Richard >>> >> >>> >> >>> >> _______________________________________________ >>> >> MLS mailing list >>> >> MLS@ietf.org >>> >> https://www.ietf.org/mailman/listinfo/mls >>> >> >>> > >>> > _______________________________________________ >>> > MLS mailing list >>> > MLS@ietf.org >>> > https://www.ietf.org/mailman/listinfo/mls >>> > >>> >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls >>> >> --00000000000037e61805ac4bc8fd Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Konrad, Britta and I just sync'ed up and drafted = a plan of action on these issues:

- For Commit Ext= ensions (#366), PR#369 is fine, we'll focus on landing that
- Konrad/Britta are going to draft a new PR for how PSK are signaled and= included in the key schedule, using a Commit extension (#367)
=C2=A0 - For simplicity given that PSKs are optional, injection will be i= n two phases: (1) combine the PSKs into a derived_psk and (2) inject the de= rived_psk into the key schedule
=C2=A0 - So some of the nPRF stuf= f might get pulled in for that first stage
- PR#336 will get refo= cused on defining how resumption is done using the PSK mechanism (#368)
=
- Konrad/Britta will either make a new PR for Authentication Cod= es (or whatever we call them) or keep them in #336

One significant design question for the group: Should we have a Proposal t= hat allows group members to request that a PSK be injected?
=
On the one hand:
- Having a Proposal would br= ing the full PSK lifecycle within the scope of MLS.=C2=A0 In particular, th= e request would be authenticated within the group and included in the trans= cript.
- If the DS wants to instruct the group to inject a PS= K, they could re-use the proposal-from-outside machinery that already exist= s

On the other hand:
- It's = not clear that including the request for a PSK in the transcript is all tha= t useful (as opposed to just the instruction to use it)
- We= would probably want to solve the general problem of new proposals (#383) i= f we do this, which is a nontrivial amount of complexity

Overall, my inclination is to not have a Proposal, since the benefit= s of extra authentication don't seem to merit the complexity.=C2=A0 But= feedback from others would be useful here.

--Rich= ard

On Tue, Jul 28, 2020 at 1:37 PM Richard Barnes <rlb@ipv.sx&= gt; wrote:
Actually, noticed one thing that isn't accounted for i= n that list:

Derive an "authentication secret= "
https://github.com/mlswg/mls-protocol/issues/374

A fun question for the list is what we should call = these things, since there are a bunch of terms in the prior art, for exampl= e:

- Authentication secret [PR#336]
- Sh= ort authentication string [ZRTP, TLS]
- Safety numbers [Signal]
- Security codes [Zoom security whitepaper]

Personally, I'm inclined against things that include "authentic= ation", since the thing we're defining here is a backstop to the p= rimary Authentication Service.=C2=A0 Among the above list, "Security C= odes" might be my favorite.=C2=A0 Otherwise, maybe something like &quo= t;group state verifier"?


On Fri, Jul 24, 2020= at 6:39 PM Richard Barnes <rlb@ipv.sx> wrote:
Picking this thr= ead back up:

I tried to encapsulate my approach to= the issues here in a few GitHub issues and one PR:

Reorder key schedule inputs

Add extensions to the Commit= message

Negotiate PSKs

Proof of prio= r membership in the group / Resumption

Konrad / Britta - I= think those combine to cover the cases you were trying to address in #366,= but tease the issues apart a bit more clearly.=C2=A0 Does that make sense = to you?=C2=A0 What have I missed here?=C2=A0 If this general plan looks goo= d, I think we can get the details arranged and agreed fairly quickly, as th= ese are each pretty self-contained pieces of work.

Thanks,
--Richard

=
On Tue, Jul 14, 2020 at 12:37 PM Konr= ad Kohbrok <konrad.kohbrok@datashrine.de> wrote:
We just briefly touched upon this PR in t= he virtual interim on July 14th and I
think we agreed that the discussion should be continued on the mailinglist = and
then tied up at the IETF 108 meeting.

I think continuing the discussion on the mailinglist is a good idea, howeve= r,
neither Britta nor myself are going to be present at the IETF 108 meeting. = Maybe
we can push the discussion to the next virtual interim meeting instead?

Cheers,
Konrad


On 18.06.20 16:29, Konrad Kohbrok wrote:
> Hi,
>
> Just a small addition to Britta's response:
>
> For #3: We already mandate that the parent group must not be used anym= ore if a
> Re-Init proposal is included in a commit in lines 2341-2342 of the PR = (although
> "to send messages" might as well be removed). We could also = get rid of the
> proposal and simply have the intent to re-initialize be implicit in se= nding a
> Welcome message with a corresponding PSK Id. The idea behind the Propo= sal was to
> make that intent explicit such that the intent, as well as the target<= br> > ciphersuite and MLS version are all entered into the transcript and th= us agreed
> upon. Even though the group is terminated after the proposal is receiv= ed, this
> agreement can be verified by using the authentication key technique th= at Britta
> proposed, i.e. each party can check that their authentication key corr= esponds to
> the one the committer uploaded.
>
> I'm also ok with splitting it into multiple individual PRs if that= makes it
> easier to review and discuss.
>
> Cheers,
> Konrad
>
>
> On 18.06.20 04:07, Hale, Britta (CIV) wrote:
>> Hi Richard,
>>
>> =C2=A0
>>
>> Thank you for the comments and careful read of the PR.
>>
>> =C2=A0
>>
>> For #1/#2: I am amicable to the idea of adding an extension field = to the commit
>> message. As a general comment, we may want to consider if there ar= e other types
>> of commit extensions worth adding or, alternatively, how the field= may be abused
>> (e.g. treated as AD by an application).
>>
>> It terms of objection to the current form though, your argument is= not clear.
>> PSKIds should uniquely identify PSKs, and a joiner (or anyone) sho= uld be able to
>> identify the correct PSK given the PSKId, if they are in possessio= n of it. PSKs
>> must only be used in an Add if the joiner is a past group member (= line 2055) and
>> therefore has the correct PSKId/group_id/psk_epoch, although this = is nullified
>> if we make the change discussed in #4. In that case, the issue for= Adds goes away.
>>
>> The PR already allows for a PSK in the Welcome message.
>>
>> =C2=A0
>>
>> For #3: Currently, in the PR, there is a recovery_secret derived p= er-epoch. When
>> a member wants to re-initialize, they issue a Re-Init proposal. Th= ey may then
>> re-initialize the group by sending a Welcome message (see lines 19= 23, 1948, and
>> 2349) with the PSKId for the parent group/epoch and a psktype that= indicates
>> that they are re-initializing the group with the stated PSKId. So = this seems to
>> already be what you describe below as =E2=80=9Chave the initiator = of the child send a
>> Welcome that has a pointer back to the parent=E2=80=9D. However, y= ou are right that more
>> detail can be added; in particular a requirement should be added t= o terminate
>> the parent group and that the terminating member/re-init proposer = must also
>> create the new group.
>>
>> =C2=A0
>>
>> For #4: There was a discussion at the first virtual interim in lat= e April
>> (Interim #11-2020) wherein some expressed a desire for this featur= e. Namely,
>> instead of re-syncing the entire group, there were use cases for r= e-syncing the
>> odd member when necessary. Its inclusion in the PR arises from tha= t later
>> request. I am favorable to removing it since, from security standp= oint, it is
>> not ideal. However, the motivation for this was pushed from the im= plementation
>> standpoint. Consequently, now is a good time for anyone to speak u= p who wants to
>> push for this.
>>
>> =C2=A0
>>
>> =C2=A0
>>
>> One item: you made point of specifically requesting =E2=80=93 a fe= w times =E2=80=93 at the
>> virtual interims #11 and #12 in April/May that this PSK PR and as = many other key
>> schedule-related PRs be combined into a single one. Raphael made a= similar
>> request under git issue #325. In fact, the authors of this PR had = pushed back on
>> that insistence to limit the current PR down to the items it curre= ntly covers,
>> instead of merging in other key schedule changes as well. Are you = saying that
>> you have changed your mind?
>>
>> We can, of course, accommodate a revised preference if needed.
>>
>> =C2=A0
>>
>> =C2=A0
>>
>> Britta
>>
>> =C2=A0
>>
>> =C2=A0
>>
>> =C2=A0
>>
>> *From: *MLS <mls-bounces@ietf.org> on behalf of Richard Barnes <rlb@ip= v.sx>
>> *Date: *Wednesday, June 17, 2020 at 3:54 PM
>> *To: *Messaging Layer Security WG <mls@ietf.org>
>> *Subject: *[MLS] PSK Injection, Group recovery, Re-Init, Sub-group= Branching (#336)
>>
>> =C2=A0
>>
>> Hey all,
>>
>> Sorry for the late review on this PR, I have finally gotten a chan= ce to really
>> dig into it, and ... I have some concerns.=C2=A0 My current thinki= ng is consistent
>> with my earlier comments that the general thrust of this PR is OK.= =C2=A0 But I think
>> the actual approach needs to change a fair bit.
>>
>> As its title implies, this PR is trying to do several things at on= ce, which seem
>> to me to be fairly separable:
>>
>> 0. Update the key schedule so that PSKs are injected at the right = point and
>> multiple PSKs are supported
>> 1. Signal that a PSK should get injected into a given epoch
>> 2. Request injection of PSK at join / in Welcome
>> 3. Re-initialize the group with different parameters
>> 4. Re-sync group members that have lost state
>>
>> For the most part, I think these are worthwhile goals, but they sh= ould be
>> accomplished in different ways than the PR proposes.=C2=A0 Detaile= d thoughts by
>> objective:
>>
>>
>> # 0. Update the key schedule so that PSKs are injected at the righ= t point and
>> multiple PSKs are supported
>>
>> This part of the PR is fine, but I think is ultimately done a bit = more elegantly
>> with the n-PRF stuff in #337.
>>
>>
>> # 1. Signal that a PSK should get injected into a given epoch
>> # 2. Request injection of PSK at join / in Welcome
>>
>> (These go together)
>>
>> The PR proposes (heh) an EPSK proposal or an Add proposal, but the= n requires
>> that only one EPSK be used.=C2=A0 I actually don't the proposa= l for including PSKs in
>> Adds actually works.=C2=A0 The joiner would have to know all of th= em plus the EPSK,
>> and there's not even any syntax in the PR to tell the joiner w= hich ones to include.
>>
>> I would propose that instead we add an extensions field to the Com= mit message,
>> then add a Commit extension that specifies the PSK ID for the PSK = to be added.=C2=A0
>> That extension can then also go in the Welcome message correspondi= ng to the
>> commit, so that joiners know to add the PSK.
>>
>> This change actually doesn't make a difference in terms of wha= t ends up in the
>> transcript -- either way, only the PSK ID selected by the committe= r goes in the
>> transcript.=C2=A0 It seems better not to deliberately have proposa= ls floating around
>> that never get included in the transcript.
>>
>>
>> # 3. Re-initialize the group with different parameters
>>
>> The PR proposes another proposal type for reinitialization, but it= 's really
>> under-specified what you do to re-init.=C2=A0 For example, what go= es in the ratchet
>> tree?=C2=A0 Clearly you need a brand new tree, since the one you h= ave might be tied
>> to the wrong ciphersuite.=C2=A0 What you really need is something = like a Welcome message.
>>
>> And that's how I think we should actually arrange things.=C2= =A0 Instead of having the
>> parent group do something to spawn, have the initiator of the chil= d send a
>> Welcome that has a pointer back to the parent.=C2=A0 So we have an= other Welcome
>> extension (`parent_group`, say) that has a pointer to the parent g= roup by group
>> ID and epoch, and instructs the joiner to take a secret from that = group/epoch's
>> key schedule and add it into the new group's key schedule.
>>
>>
>>
>> # 4. Re-sync group members that have lost state
>>
>> We should not do these.=C2=A0 At the January interim, we decided n= ot to drop the
>> resync issue (#93) given that there were some subtleties depending= on exactly
>> what state had been lost, and that it could be cleanly done in a s= eparate spec.
>>
>>
>> # Conclusions
>>
>> Given the above, I would propose we break this into separate issue= s to be closed
>> with individual, smaller PRs.=C2=A0 Assuming that (0) will get add= ressed by the n-PRF
>> PR, that leaves us with:
>>
>> #XXX Add Extensions to the Commit message
>> #XXX Signal use of external PSKs in Commit/Welcome (=3D> extens= ion to
>> Commit/Welcome messages)
>> #XXX Allow Welcome to signal the inclusion of information from a p= rior group (=3D>
>> Welcome extension)
>>
>> Happy to write those up, and contribute to PRs.=C2=A0 Sorry again = for the slow
>> progress here.
>>
>> --Richard
>>
>>
>> _______________________________________________
>> MLS mailing list
>> MLS@ietf.org=
>> https://www.ietf.org/mailman/listinfo/mls
>>
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls
>

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--00000000000037e61805ac4bc8fd-- From nobody Sun Aug 9 00:41:36 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A62E3A0B6D for ; Sun, 9 Aug 2020 00:41:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=QZrKrd54; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=nXrVRmMr Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aMxPtlT_G4pq for ; Sun, 9 Aug 2020 00:41:29 -0700 (PDT) Received: from out1-smtp.messagingengine.com (out1-smtp.messagingengine.com [66.111.4.25]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 203EA3A0B6E for ; Sun, 9 Aug 2020 00:41:29 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id E8FC55C008C for ; Sun, 9 Aug 2020 03:32:28 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Sun, 09 Aug 2020 03:32:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:from:to:subject:message-id:date; s= fm3; bh=OIBz6u4Tghsm+q2nsM9BCu3l7zzB4eHy+Xexn/obI2U=; b=QZrKrd54 7QlaS5GfnC53Xz3pg0S2aoDXlX1zcJfROv/fLVFUWgBX3o299MpThsaca+NtDstB uR9GsU4l1+R53TtcabtwGGvEP8hAN64DrPbKqk/Rpfmiol7hPtvzIhdhFc7qoBJe lSi3Yur3ZORjEswcLXGRM+u4aPNaMq2czYufH+sUxX8+59LO/huO3RPRnjlit+Ng yRmOdJfL23DRFYFqRHjkg8nVE66F9ZVqH+mmpzY7pmY3gGaaP5KIiaTJDBuyxUiG 5xXefwXHxwKYd7gOhSMUzNOlJsQjYz/IWasrhdZbs5hfAtyplHSadJYQta2hdeOE 0tVwoo3UYEH1oQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=OIBz6u4Tghsm+q2nsM9BCu3l7zzB4 eHy+Xexn/obI2U=; b=nXrVRmMrbvle3C8rqdrZzSgRJJRoW9X5bG2XUnXJwbvxQ jBlPkExX55ANveRntKMunbhFvXyuxpTwCPL9IdgdsikLbDzTpiAVCrYcvHdB+qKg evr/Y4sR9gQSmO2CO1fyt+FLmRdQroJpdJ7AgaiNLCrpDZRypANR7b24McySUOPm zyPex1Mad5NfC+DkWUuie5idXg8hl93kkBEcUo74uzdavMwl2AgO8pcTkguV6mtj NWDpa07jZ0bb0rF6KyYoKV9gJbKmMUH1wfz/YFZDN9a7t1U4CJRl+I4Lt+8yEkcU av2oOr+d3DuQNsefywHMcMLsQj0ecY1DXC38xmcyw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrkeehgdduvddtucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucenucfjughrpegtggfhvffusegrtddtredttdejne cuhfhrohhmpeftvghpohhsihhtohhrhicutegtthhivhhithihucfuuhhmmhgrrhihuceu ohhtuceoughopghnohhtpghrvghplhihsehmnhhothdrnhgvtheqnecuggftrfgrthhtvg hrnhepkeefvdduteejvdefkeehieevuefgfefhteetveegffekffefteffvdelheduieet necuffhomhgrihhnpehgihhthhhusgdrtghomhenucfkphephedvrdduheegrdejvddrke elnecuvehluhhsthgvrhfuihiivgepfeenucfrrghrrghmpehmrghilhhfrhhomhepugho pghnohhtpghrvghplhihsehmnhhothdrnhgvth X-ME-Proxy: Received: from fv-az54.internal.cloudapp.net (unknown [52.154.72.89]) by mail.messagingengine.com (Postfix) with ESMTPA id B17BE328005A for ; Sun, 9 Aug 2020 03:32:28 -0400 (EDT) Content-Type: multipart/alternative; boundary="===============2243184429856553341==" MIME-Version: 1.0 From: Repository Activity Summary Bot To: mls@ietf.org Message-Id: <20200809073228.B17BE328005A@mailuser.nyi.internal> Date: Sun, 9 Aug 2020 03:32:28 -0400 (EDT) Archived-At: Subject: [MLS] Weekly github digest (MLS Working Group summary) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 09 Aug 2020 07:41:32 -0000 --===============2243184429856553341== MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Issues ------ * mlswg/mls-protocol (+1/-0/=F0=9F=92=AC8) 1 issues created: - Enable Commit to cover new proposal types (by bifurcation) https://github.com/mlswg/mls-protocol/issues/383=20 3 issues received 8 new comments: - #383 Enable Commit to cover new proposal types (1 by bifurcation) https://github.com/mlswg/mls-protocol/issues/383=20 - #366 Add extensions to the Commit message (6 by bifurcation, kkohbrok) https://github.com/mlswg/mls-protocol/issues/366=20 - #365 Update security considerations (1 by ericcornelissen) https://github.com/mlswg/mls-protocol/issues/365=20 Pull requests ------------- * mlswg/mls-protocol (+3/-5/=F0=9F=92=AC1) 3 pull requests submitted: - Require the initial init_secret to be a random value (by ericcornelisse= n) https://github.com/mlswg/mls-protocol/pull/385=20 - Fix formatting issue in Commit section (by ericcornelissen) https://github.com/mlswg/mls-protocol/pull/384=20 - Add Konrad and Britta to contribtors (by bifurcation) https://github.com/mlswg/mls-protocol/pull/382=20 1 pull requests received 1 new comments: - #376 Negotiate PSKs (1 by bifurcation) https://github.com/mlswg/mls-protocol/pull/376=20 5 pull requests merged: - 4 editorial edits to the draft https://github.com/mlswg/mls-protocol/pull/384=20 - Require the initial init_secret to be a random value https://github.com/mlswg/mls-protocol/pull/385=20 - Consistency fix for description of key material sent in an update messa= ge https://github.com/mlswg/mls-protocol/pull/381=20 - Fix typo at minimal number of extensions https://github.com/mlswg/mls-protocol/pull/379=20 - Add Konrad and Britta to contribtors https://github.com/mlswg/mls-protocol/pull/382=20 Repositories tracked by this digest: ----------------------------------- * https://github.com/mlswg/mls-architecture * https://github.com/mlswg/mls-protocol * https://github.com/mlswg/mls-federation --===============2243184429856553341== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Weekly github digest (MLS Working Group summary)

Sunday August 09, 2020

Issues

mlswg/mls-protocol (+1/-0/=F0=9F=92=AC8)

1 issues created:

3 issues received 8 new comments:

Pull requests

mlswg/mls-protocol (+3/-5/=F0=9F=92=AC1)

3 pull requests submitted:

1 pull requests received 1 new comments:

5 pull requests merged:

Repositories tracked by this digest:

--===============2243184429856553341==-- From nobody Sun Aug 9 19:23:36 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 417EE3A1335 for ; Sun, 9 Aug 2020 19:23:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ij_u18_2H4gF for ; Sun, 9 Aug 2020 19:23:32 -0700 (PDT) Received: from mail-qv1-xf2f.google.com (mail-qv1-xf2f.google.com [IPv6:2607:f8b0:4864:20::f2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8BD913A0B7B for ; Sun, 9 Aug 2020 19:23:32 -0700 (PDT) Received: by mail-qv1-xf2f.google.com with SMTP id a19so3581630qvy.3 for ; Sun, 09 Aug 2020 19:23:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=tVPlY/yUJ0BgmC093x3XYU3IgqWYhiYkvj8liDXnYWo=; b=B8tnXNce8RDHnqyZhkjk6qpFTzRg7m/W+8x2n1OJx56MGtAaEHjifD2cylf//uwuxp n3ZhoA2ugA7ffU4VQAMOArZ9YFYjGVtJRBoXWo+/DAjzRPZC9KIufm5ronlsLjUqLjGF peowR2mnQhwVAqi6G0qb7AvH/JaQYvOARirbk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=tVPlY/yUJ0BgmC093x3XYU3IgqWYhiYkvj8liDXnYWo=; b=IXQUMVrjVo+9zpVDX1dwuoDkZBDR0zopLUnGEmr9K8hb9LqLxB9O6rjkOKAmZvm7aE 9ue7Hr3f0GsM/Rr0Dv6kGHCNVRM7obLi+PqTcY9IqaE4vRZY+BGj5H+WCEIlTT4y+Wr3 D78lUmBL1pBJ3CewYkrbEboQ1N25K3Ct+LFApD/TJnDGut/ldmJAQnU7C4hz5Hq6N2og 9ZdYGfLrmvM2mPHB1Z9qzdBGAz1uKEKMvBazE39j3JvnZ2Sj046gRAyQqgPZ4qhH+v+z 2HsolY6iP4TobUvcHdN7Hv6ZoUURBaUrafMpk0G7HzaIZdTocsmYeGuLpez6iw/DYnd5 PC3A== X-Gm-Message-State: AOAM530IZv8rBOgAsNmIe+FtdT/6rHRrwBPSAd0RwLjr+ZVD3DscJZM5 ALgBtS/NrPmoh/kBkODZu9uk3Ml6B9c= X-Google-Smtp-Source: ABdhPJz/WdK298eDxeS34tOaCaIVdDc/x0nehhpggpNUWy2k9ttuqJbfc2UR7KM8krrywggLMn0fvg== X-Received: by 2002:ad4:46e1:: with SMTP id h1mr26026238qvw.129.1597026211106; Sun, 09 Aug 2020 19:23:31 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id x3sm13051319qkx.3.2020.08.09.19.23.30 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sun, 09 Aug 2020 19:23:30 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Sun, 9 Aug 2020 22:23:29 -0400 References: To: MLS List In-Reply-To: Message-Id: X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [MLS] 20200811 MLS WG Virtual Interim X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 02:23:34 -0000 Just a reminder that we have a meeting scheduled for Tuesday. spt > On Aug 6, 2020, at 12:44, Sean Turner wrote: >=20 > Hi! We are having a virtual interim Tuesday 11 August 2020 at 1600 = UTC. Webex details can be found here: > https://datatracker.ietf.org/meeting/interim-2020-mls-18/session/mls > Our agenda is to address protocol related issues and PRs. Outstanding = Issues and PRs can be found here: > https://github.com/mlswg/mls-protocol >=20 > Nick and Sean From nobody Sun Aug 9 22:58:00 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BCA053A13F5 for ; Sun, 9 Aug 2020 22:57:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pITpLx-M2ROl for ; Sun, 9 Aug 2020 22:57:53 -0700 (PDT) Received: from mout-p-101.mailbox.org (mout-p-101.mailbox.org [IPv6:2001:67c:2050::465:101]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D97FF3A13F7 for ; Sun, 9 Aug 2020 22:57:52 -0700 (PDT) Received: from smtp2.mailbox.org (smtp2.mailbox.org [80.241.60.241]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by mout-p-101.mailbox.org (Postfix) with ESMTPS id 4BQ4xn4zbCzKmtQ for ; Mon, 10 Aug 2020 07:57:49 +0200 (CEST) X-Virus-Scanned: amavisd-new at heinlein-support.de Received: from smtp2.mailbox.org ([80.241.60.241]) by gerste.heinlein-support.de (gerste.heinlein-support.de [91.198.250.173]) (amavisd-new, port 10030) with ESMTP id XK3LHyR37CDQ for ; Mon, 10 Aug 2020 07:57:45 +0200 (CEST) To: mls@ietf.org References: <710ba832-c77c-58d2-a7b4-b8dc8eaf09e3@datashrine.de> From: Konrad Kohbrok Message-ID: <3e2aeaba-4413-9545-f49d-2266d9b08f3b@datashrine.de> Date: Mon, 10 Aug 2020 07:57:44 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: de-DE Content-Transfer-Encoding: 8bit X-MBO-SPAM-Probability: X-Rspamd-Score: -6.66 / 15.00 / 15.00 X-Rspamd-Queue-Id: 345B217B0 X-Rspamd-UID: 6200aa Archived-At: Subject: Re: [MLS] PSK Injection, Group recovery, Re-Init, Sub-group Branching (#336) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 05:57:58 -0000 I think the question Extension vs. Proposal will come up again at some point in the future, for example when we introduce the next generation of TreeKEM-like primitive. So maybe it would be worth taking a more methodical approach and tackle the problem now rather than later, when we already have a bunch of extensions that would better fit as proposals. But I don't have too strong an opinion on this and if the rest of the group would prefer getting on with finalizing the spec, then that is ok by me. I just think that that complexity will come sooner or later. Konrad On 07.08.20 18:05, Richard Barnes wrote: > Konrad, Britta and I just sync'ed up and drafted a plan of action on these issues: > > - For Commit Extensions (#366), PR#369 is fine, we'll focus on landing that > - Konrad/Britta are going to draft a new PR for how PSK are signaled and > included in the key schedule, using a Commit extension (#367) >   - For simplicity given that PSKs are optional, injection will be in two > phases: (1) combine the PSKs into a derived_psk and (2) inject the derived_psk > into the key schedule >   - So some of the nPRF stuff might get pulled in for that first stage > - PR#336 will get refocused on defining how resumption is done using the PSK > mechanism (#368) > - Konrad/Britta will either make a new PR for Authentication Codes (or whatever > we call them) or keep them in #336 > > One significant design question for the group: Should we have a Proposal that > allows group members to request that a PSK be injected? > > On the one hand: > - Having a Proposal would bring the full PSK lifecycle within the scope of MLS.  > In particular, the request would be authenticated within the group and included > in the transcript. > - If the DS wants to instruct the group to inject a PSK, they could re-use the > proposal-from-outside machinery that already exists > > On the other hand: > - It's not clear that including the request for a PSK in the transcript is all > that useful (as opposed to just the instruction to use it) > - We would probably want to solve the general problem of new proposals (#383) if > we do this, which is a nontrivial amount of complexity > > Overall, my inclination is to not have a Proposal, since the benefits of extra > authentication don't seem to merit the complexity.  But feedback from others > would be useful here. > > --Richard > > On Tue, Jul 28, 2020 at 1:37 PM Richard Barnes wrote: > > Actually, noticed one thing that isn't accounted for in that list: > > Derive an "authentication secret" > https://github.com/mlswg/mls-protocol/issues/374 > > A fun question for the list is what we should call these things, since there > are a bunch of terms in the prior art, for example: > > - Authentication secret [PR#336] > - Short authentication string [ZRTP, TLS] > - Safety numbers [Signal] > - Security codes [Zoom security whitepaper] > > Personally, I'm inclined against things that include "authentication", since > the thing we're defining here is a backstop to the primary Authentication > Service.  Among the above list, "Security Codes" might be my favorite.  > Otherwise, maybe something like "group state verifier"? > > > On Fri, Jul 24, 2020 at 6:39 PM Richard Barnes wrote: > > Picking this thread back up: > > I tried to encapsulate my approach to the issues here in a few GitHub > issues and one PR: > > Reorder key schedule inputs > https://github.com/mlswg/mls-protocol/issues/362 > > Add extensions to the Commit message > https://github.com/mlswg/mls-protocol/issues/366 > > Negotiate PSKs > https://github.com/mlswg/mls-protocol/issues/367 > > Proof of prior membership in the group / Resumption > https://github.com/mlswg/mls-protocol/issues/368 > > Konrad / Britta - I think those combine to cover the cases you were > trying to address in #366, but tease the issues apart a bit more > clearly.  Does that make sense to you?  What have I missed here?  If > this general plan looks good, I think we can get the details arranged > and agreed fairly quickly, as these are each pretty self-contained > pieces of work. > > Thanks, > --Richard > > On Tue, Jul 14, 2020 at 12:37 PM Konrad Kohbrok > > wrote: > > We just briefly touched upon this PR in the virtual interim on July > 14th and I > think we agreed that the discussion should be continued on the > mailinglist and > then tied up at the IETF 108 meeting. > > I think continuing the discussion on the mailinglist is a good idea, > however, > neither Britta nor myself are going to be present at the IETF 108 > meeting. Maybe > we can push the discussion to the next virtual interim meeting instead? > > Cheers, > Konrad > > > On 18.06.20 16:29, Konrad Kohbrok wrote: > > Hi, > > > > Just a small addition to Britta's response: > > > > For #3: We already mandate that the parent group must not be used > anymore if a > > Re-Init proposal is included in a commit in lines 2341-2342 of the > PR (although > > "to send messages" might as well be removed). We could also get > rid of the > > proposal and simply have the intent to re-initialize be implicit > in sending a > > Welcome message with a corresponding PSK Id. The idea behind the > Proposal was to > > make that intent explicit such that the intent, as well as the target > > ciphersuite and MLS version are all entered into the transcript > and thus agreed > > upon. Even though the group is terminated after the proposal is > received, this > > agreement can be verified by using the authentication key > technique that Britta > > proposed, i.e. each party can check that their authentication key > corresponds to > > the one the committer uploaded. > > > > I'm also ok with splitting it into multiple individual PRs if that > makes it > > easier to review and discuss. > > > > Cheers, > > Konrad > > > > > > On 18.06.20 04:07, Hale, Britta (CIV) wrote: > >> Hi Richard, > >> > >>   > >> > >> Thank you for the comments and careful read of the PR. > >> > >>   > >> > >> For #1/#2: I am amicable to the idea of adding an extension field > to the commit > >> message. As a general comment, we may want to consider if there > are other types > >> of commit extensions worth adding or, alternatively, how the > field may be abused > >> (e.g. treated as AD by an application). > >> > >> It terms of objection to the current form though, your argument > is not clear. > >> PSKIds should uniquely identify PSKs, and a joiner (or anyone) > should be able to > >> identify the correct PSK given the PSKId, if they are in > possession of it. PSKs > >> must only be used in an Add if the joiner is a past group member > (line 2055) and > >> therefore has the correct PSKId/group_id/psk_epoch, although this > is nullified > >> if we make the change discussed in #4. In that case, the issue > for Adds goes away. > >> > >> The PR already allows for a PSK in the Welcome message. > >> > >>   > >> > >> For #3: Currently, in the PR, there is a recovery_secret derived > per-epoch. When > >> a member wants to re-initialize, they issue a Re-Init proposal. > They may then > >> re-initialize the group by sending a Welcome message (see lines > 1923, 1948, and > >> 2349) with the PSKId for the parent group/epoch and a psktype > that indicates > >> that they are re-initializing the group with the stated PSKId. So > this seems to > >> already be what you describe below as “have the initiator of the > child send a > >> Welcome that has a pointer back to the parentâ€. However, you are > right that more > >> detail can be added; in particular a requirement should be added > to terminate > >> the parent group and that the terminating member/re-init proposer > must also > >> create the new group. > >> > >>   > >> > >> For #4: There was a discussion at the first virtual interim in > late April > >> (Interim #11-2020) wherein some expressed a desire for this > feature. Namely, > >> instead of re-syncing the entire group, there were use cases for > re-syncing the > >> odd member when necessary. Its inclusion in the PR arises from > that later > >> request. I am favorable to removing it since, from security > standpoint, it is > >> not ideal. However, the motivation for this was pushed from the > implementation > >> standpoint. Consequently, now is a good time for anyone to speak > up who wants to > >> push for this. > >> > >>   > >> > >>   > >> > >> One item: you made point of specifically requesting – a few times > – at the > >> virtual interims #11 and #12 in April/May that this PSK PR and as > many other key > >> schedule-related PRs be combined into a single one. Raphael made > a similar > >> request under git issue #325. In fact, the authors of this PR had > pushed back on > >> that insistence to limit the current PR down to the items it > currently covers, > >> instead of merging in other key schedule changes as well. Are you > saying that > >> you have changed your mind? > >> > >> We can, of course, accommodate a revised preference if needed. > >> > >>   > >> > >>   > >> > >> Britta > >> > >>   > >> > >>   > >> > >>   > >> > >> *From: *MLS > > on behalf of Richard Barnes > >> *Date: *Wednesday, June 17, 2020 at 3:54 PM > >> *To: *Messaging Layer Security WG > > >> *Subject: *[MLS] PSK Injection, Group recovery, Re-Init, > Sub-group Branching (#336) > >> > >>   > >> > >> Hey all, > >> > >> Sorry for the late review on this PR, I have finally gotten a > chance to really > >> dig into it, and ... I have some concerns.  My current thinking > is consistent > >> with my earlier comments that the general thrust of this PR is > OK.  But I think > >> the actual approach needs to change a fair bit. > >> > >> As its title implies, this PR is trying to do several things at > once, which seem > >> to me to be fairly separable: > >> > >> 0. Update the key schedule so that PSKs are injected at the right > point and > >> multiple PSKs are supported > >> 1. Signal that a PSK should get injected into a given epoch > >> 2. Request injection of PSK at join / in Welcome > >> 3. Re-initialize the group with different parameters > >> 4. Re-sync group members that have lost state > >> > >> For the most part, I think these are worthwhile goals, but they > should be > >> accomplished in different ways than the PR proposes.  Detailed > thoughts by > >> objective: > >> > >> > >> # 0. Update the key schedule so that PSKs are injected at the > right point and > >> multiple PSKs are supported > >> > >> This part of the PR is fine, but I think is ultimately done a bit > more elegantly > >> with the n-PRF stuff in #337. > >> > >> > >> # 1. Signal that a PSK should get injected into a given epoch > >> # 2. Request injection of PSK at join / in Welcome > >> > >> (These go together) > >> > >> The PR proposes (heh) an EPSK proposal or an Add proposal, but > then requires > >> that only one EPSK be used.  I actually don't the proposal for > including PSKs in > >> Adds actually works.  The joiner would have to know all of them > plus the EPSK, > >> and there's not even any syntax in the PR to tell the joiner > which ones to include. > >> > >> I would propose that instead we add an extensions field to the > Commit message, > >> then add a Commit extension that specifies the PSK ID for the PSK > to be added.  > >> That extension can then also go in the Welcome message > corresponding to the > >> commit, so that joiners know to add the PSK. > >> > >> This change actually doesn't make a difference in terms of what > ends up in the > >> transcript -- either way, only the PSK ID selected by the > committer goes in the > >> transcript.  It seems better not to deliberately have proposals > floating around > >> that never get included in the transcript. > >> > >> > >> # 3. Re-initialize the group with different parameters > >> > >> The PR proposes another proposal type for reinitialization, but > it's really > >> under-specified what you do to re-init.  For example, what goes > in the ratchet > >> tree?  Clearly you need a brand new tree, since the one you have > might be tied > >> to the wrong ciphersuite.  What you really need is something like > a Welcome message. > >> > >> And that's how I think we should actually arrange things.  > Instead of having the > >> parent group do something to spawn, have the initiator of the > child send a > >> Welcome that has a pointer back to the parent.  So we have > another Welcome > >> extension (`parent_group`, say) that has a pointer to the parent > group by group > >> ID and epoch, and instructs the joiner to take a secret from that > group/epoch's > >> key schedule and add it into the new group's key schedule. > >> > >> > >> > >> # 4. Re-sync group members that have lost state > >> > >> We should not do these.  At the January interim, we decided not > to drop the > >> resync issue (#93) given that there were some subtleties > depending on exactly > >> what state had been lost, and that it could be cleanly done in a > separate spec. > >> > >> > >> # Conclusions > >> > >> Given the above, I would propose we break this into separate > issues to be closed > >> with individual, smaller PRs.  Assuming that (0) will get > addressed by the n-PRF > >> PR, that leaves us with: > >> > >> #XXX Add Extensions to the Commit message > >> #XXX Signal use of external PSKs in Commit/Welcome (=> extension to > >> Commit/Welcome messages) > >> #XXX Allow Welcome to signal the inclusion of information from a > prior group (=> > >> Welcome extension) > >> > >> Happy to write those up, and contribute to PRs.  Sorry again for > the slow > >> progress here. > >> > >> --Richard > >> > >> > >> _______________________________________________ > >> MLS mailing list > >> MLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/mls > >> > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > From nobody Mon Aug 10 07:23:07 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D8A843A15E5 for ; Mon, 10 Aug 2020 07:23:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ET09tTVANY-x for ; Mon, 10 Aug 2020 07:23:04 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CA41E3A15E4 for ; Mon, 10 Aug 2020 07:23:03 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id 2so8429494qkf.10 for ; Mon, 10 Aug 2020 07:23:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=oG3VBdDkJoc+BHKz2GN466Jlat6tlpuV0/yZcBLoW08=; b=TwpqbQSpHPXhhBLqmL28kY9Fruk6MlJk1vugsTa6G9OvFlR6V+fNycgf5dtCWkHCka xVOAu4YvszNz5sjOZt0C1DAy0Dl9ZyurKhnfruDejIlBbdymhGgRtAMFbbajVhFmg5te 02KYpZZdtGuWXtEIPR3UEc3kbPk47fd+FrNomxLYxjynp81BunguVR2R0vQm6Ey+Xd6f 8Iiu/pSfmlJxtpoq5LE2h3OjnnHzfxkWKuHdikDlPKD6C7daFCsy5OkEo3WzcsaUn9YM w+NXK1bsy68uC63CVnpwRcvrVN8xdWlCEPFK5HZEog0z3qJ77HVBpfge06wlrBCnDSvq mHVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=oG3VBdDkJoc+BHKz2GN466Jlat6tlpuV0/yZcBLoW08=; b=eEhUjreoz6uba7WDeRpzuErkCiEuBNkq7CnXlkUw2l2qUAqsWsq0MQ5AYNIPGmb5RP qOugGxwWofMDaJdQE48JhK/hnq+Rivgs78VR02KLjpisOqhaJS0hVI46e/BJBy8EPwOf FuKhcc9nzBC5ATA/N+RvAYWg1PF6fnpqPiCecONe7q+eda1aSMBkJhi3/V9ERL277xL5 PU/XF0TIxovMRRDy64IXqD1Odg0dmF2Dfi+i2GHywCiFHrT/IQ0Gd9MJ8maY2VX9jW+i rYJ2yMqRiNgZ0dUjNkzt+VjkjWKDl+xle5AFRAEky+VBxRgB/WHvBUATAt33NvhdY8bj T9lg== X-Gm-Message-State: AOAM530VUv/G1UA8DycIGVQu627pfZtVxYNRmMpqfw3KVR2PM72k8YYg Syi65K7xwB6GCF3Xo3jJuw2wn2bukiWGC5IELuZHqA== X-Google-Smtp-Source: ABdhPJxJnty9qjwdsKZAyKxrMRQBK/JwmWlyxkpb9TWWZdqRLqUNO368zIIF+aOvZyvyGufZERldT1FsP2LsT2C6FNo= X-Received: by 2002:ae9:ee06:: with SMTP id i6mr25331427qkg.132.1597069382281; Mon, 10 Aug 2020 07:23:02 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Mon, 10 Aug 2020 10:22:47 -0400 Message-ID: To: Cornelissen Eric Cc: "mls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000369ba405ac86b14b" Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 14:23:06 -0000 --000000000000369ba405ac86b14b Content-Type: text/plain; charset="UTF-8" Hi Eric, Thanks for the analysis here. More good finds. 1. I think the right answer is a little of both. If you initialize a one-member group, before any Commit messages have been sent, then it should be the zero-length octet string. But then as soon as the group is used for something, it is updated. Maybe the way to clarify this is to fix the indices. If we have the interim hash belong to the new epoch, then we could have something like the following: interim_[0] = 0 confirmed_[n] = Hash(interim_[n] || MLSPlaintextCommitContent_[n]); interim_[n+1] = Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); 1.a. BTW, this raises another issue: I had thought we had removed direct dependencies on hash functions when we move from invoking HKDF to invoking the KDF from HPKE. But this points out that we still have raw hash invocations. I filed an issue for this: https://github.com/mlswg/mls-protocol/issues/386 FWIW, I think the latter course there is the right answer, i.e., to keep the raw hash invocations and clarify that the ciphersuite specifies a hash function. 2. It seems like the right reference here is probably to the "secrets" array in the Welcome message. There's one entry there for each member being added, so if len(secrets) = len(group_info.tree.leaves) - 1, then there was only one member in the group to start with. It's not strictly true to say that this is a new creation, since one commit could remove all but one of the members of the group and re-add a new set of members. But this distinction doesn't really seem salient. On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric wrote: > Hi All, > > > I have two questions about things that are unclear to me in the current > state of the spec as they are undefined/poorly defined. > > > > 1. What is the intended value of *interim_transcript_hash_**[0]*? > > From the current draft I cannot definitively (i.e. with 100% certainty) > say whether the value of the first *interim_transcript_hash *should be: > > a. "the zero-length octet string" following the last line of Group state > section > > , > or > b. a value derived based on the MLSPlaintextCommitAutData for the first > commit concatenated with 0: > interim_transcript_hash_[0] > = Hash(confirmed_transcript_hash_[0] || > MLSPlaintextCommitAuthData_[0]) > = Hash(0 || MLSPlaintextCommitAuthData_[0]) > > The draft strongly suggests to me that it is the former, but the latter > seems to more accurately reflect the statement "The > *confirmed_transcript_hash* field contains a running hash over the > messages that led to this state." > > In the case that *a* is correct I would suggest updating the definition > of *interim_transcript_hash_**[n]* to: > > interim_transcript_hash_[0] = 0 > interim_transcript_hash_[n] = > Hash(confirmed_transcript_hash_[n] || > MLSPlaintextCommitAuthData_[n]); > > In the case that *b* is correct I would suggest adding a "warning" that > says something along the lines of "*as a placeholder value" *to the > place(s) where the draft says that the *interim_transcript_hash* of a > group is initialized to 0. > > > 2. What is the `members` array mentioned in the Group creation section > > ? > > In that section it is stated that "A new member receiving a Welcome > message can recognize group creation if the number of entries in the > `members` array is equal to the number of leaves in the tree minus one." > First of all, it is not clear what this `members` array is. It seems this > refers to a field of the now-removed Init struct. Interestingly this struct > was removed in the very same PR that added the above sentence (see #239 > ). But I wasn't able to > really figure out what the draft-09 equivalent of it should be. > > In addition, I'm pretty sure this technique would no longer work to detect > group creation (but that would depend on how the sentence should be > updated). > > > Regards, > Eric > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000369ba405ac86b14b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Eric,

Thanks for the anal= ysis here.=C2=A0 More good finds.

1. I think t= he right answer is a little of both.=C2=A0 If you initialize a one-member g= roup, before any Commit messages have been sent, then it should be the zero= -length octet string.=C2=A0 But then as soon as the group is used for somet= hing, it is updated.=C2=A0 Maybe the way to clarify this is to fix the indi= ces.=C2=A0 If we have the interim hash belong to the new epoch, then we cou= ld have something like the following:

interim_[0] = =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitCon= tent_[n]);
interim_[n+1] =3D Hash(confirmed_[n] || MLSP= laintextCommitAuthData_[n]);


1.a. BTW, this raises another issue: I had thought we had removed dir= ect dependencies on hash functions when we move from invoking HKDF to invok= ing the KDF from HPKE.=C2=A0 But this points out that we still have raw has= h invocations.=C2=A0 I filed an issue for this:

https://gith= ub.com/mlswg/mls-protocol/issues/386

FWIW, I t= hink the latter course there is the right answer, i.e., to keep the raw has= h invocations and clarify that the ciphersuite specifies a hash function.


2. It seems like the right reference= here is probably to the "secrets" array in the Welcome message.= =C2=A0 There's one entry there for each member being added, so if len(s= ecrets) =3D len(group_info.tree.leaves) - 1, then there was only one member= in the group to start with.=C2=A0 It's not strictly true to say that t= his is a new creation, since one commit could remove all but one of the mem= bers of the group and re-add a new set of members.=C2=A0 But this distincti= on doesn't really seem salient.


=

= On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1.=C2=A0What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0]
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0] =3D 0
=
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[n] =3D
    =C2=A0=C2=A0=C2=A0 Hash(confirmed_transcript_hash_[n] ||
        =C2=A0=C2=A0=C2=A0 MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the= draft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer = work to detect group creation (but that would depend on how the sentence sh= ould be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000369ba405ac86b14b-- From nobody Mon Aug 10 11:02:50 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DE9733A08B9 for ; Mon, 10 Aug 2020 11:02:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NBBlUwKUjJCo for ; Mon, 10 Aug 2020 11:02:47 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B9B583A08AE for ; Mon, 10 Aug 2020 11:02:47 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id j187so9169469qke.11 for ; Mon, 10 Aug 2020 11:02:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:from:date:message-id:subject:to; bh=Pe3rQh9gQgE97DnZ4bpW+C7gqL2YQmVvT94yYU3uEj8=; b=tdYz6ryAOi9L3n7wjP/vwghb+RzCfvxhqwjcnaOPinUntVYjE6kFa37m6GA/5sYEvY 9B5wfxET2Hw5mPWWq/o/Ede06LcZirX6+nLfzd2DIbu/q0RZgRHGC4FvbGgRcJqMtUvo fqkkDDOOCFPVzZPAOBUHAkXXWss0ZwGZ5QTfE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=Pe3rQh9gQgE97DnZ4bpW+C7gqL2YQmVvT94yYU3uEj8=; b=BC03kPzePQ/66kBwxkhsVy0Cl48BRKKkpCLDV73AJZkpKGzs+tSEVRfR27yrELBldq 7sZRfg/Gtq71+nwH016PCRdBgu3u6e7/Cw67q9GgH56nvNKQh0VTuapVY5bDIZWuk2gx C+zJ9KxPOhwDUIR9D9Xlh6voKaevwFXPqyXe81uTPaB8cPKCfFA4wGPQz5D8Io3Czc0F 2yBD4qKlur2A2BjLlrZld3xDNbMZiFh3eZ+DEZxdacU8zN32oHw96MLTQ/zoeaRNcvJ0 PqEd3dSzQ6+/sqKuhhfkIihhghILdscntD9RyKaAgiWJQYnGBAZgYepo6PLU6+Bh1yOK MIpA== X-Gm-Message-State: AOAM531uKi0IgvdgES1Q1TbuYSIiUd8TkbJdsiyiNRwyf8PuTQ8Hzbux Tv2ehkYWCwACuu7d26ADYsBkuV8kgL/wHSRsnyfZgRzWpxI= X-Google-Smtp-Source: ABdhPJzxUaNfiifQTihDeeYvbAFfnyz4Gg2H8Dt828VG75MCIUhFTf3pfwTFoVvN1az6A9j7zyAAscc3nQoslidJsUM= X-Received: by 2002:a05:620a:cd6:: with SMTP id b22mr26594879qkj.443.1597082565933; Mon, 10 Aug 2020 11:02:45 -0700 (PDT) MIME-Version: 1.0 From: Brendan McMillion Date: Mon, 10 Aug 2020 11:02:34 -0700 Message-ID: To: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000000521b205ac89c3a5" Archived-At: Subject: [MLS] ChaChaX X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 18:02:49 -0000 --0000000000000521b205ac89c3a5 Content-Type: text/plain; charset="UTF-8" Hello mls@ I wanted to quickly poll the list on a somewhat annoying issue. Currently, every time we encrypt with our AEAD we use an unstructured nonce: sender data encryption is properly random, while HPKE and message encryption use the output of a KDF which is as good as random. Accordingly, we should be using ChaChaX instead of ChaCha. Does everyone else agree? Should I open these PRs? --0000000000000521b205ac89c3a5 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hello mls@

I wanted to quick= ly poll the list on a somewhat annoying issue. Currently, every time we enc= rypt with our AEAD we use an unstructured nonce: sender data encryption is = properly random, while HPKE and message encryption use the output of a KDF = which is as good as random. Accordingly, we should be using ChaChaX instead= of ChaCha.

Does everyone else agree? Should I ope= n these PRs?
--0000000000000521b205ac89c3a5-- From nobody Mon Aug 10 12:31:10 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E1AD3A0C46 for ; Mon, 10 Aug 2020 12:31:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GSndoYFY7bzn for ; Mon, 10 Aug 2020 12:31:05 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F0D053A0C3E for ; Mon, 10 Aug 2020 12:31:04 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id p4so9514932qkf.0 for ; Mon, 10 Aug 2020 12:31:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=LVG5meez/0fK09DXb9Kb3QlhAJ5rznbrAyfBiIppS2E=; b=EcK26XLwrsQTTZ/oAagxt669A4br22lZYr890RP7T0MlD03oBtDMykAy/cr/fY+L/G 5U/QywEp0sZ0uOvjXGl7VzfAK1OUfkoDs6bW6WSRyBu2BBJuqyKHyo7UmLWIg3YuwcaB PUZjtbaDSG9zB/OjKZ/q9AbkqgMV/B+SsrZTMtOCJzyeqxP2o2URYVFVaWw0AyQEUmXh MQOIv2EwZH3Z3yfFXn5w6zozejZm8noM0ddeRZIp3x0NZKPw5nbhOePy8Q1rHuaBHWty DwjyBsLyz/B5VhCokh3oXOfPrsP6g4iarD1J6Cis0ies3FgSEEhb0TPoam1WV+Hd0NUg fkIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=LVG5meez/0fK09DXb9Kb3QlhAJ5rznbrAyfBiIppS2E=; b=G8NmZ/dICqmTVDrlcVbOZkepDupJpExG9N9eR/HfFwAugzcQz9VM0V1C+8n6XPX2UD pxH/cZvgT2GCMJLApZwa7cDh8A3UrajrihhxVCxhl42aVzZypdEcW2G/Cu0Cbqe2eQUW ER4dlFC5XovXQsPxz/Onl+DawXurdovbbCBUW4XEtw4VADgcod3fjKDhnk3na9uHsyQ9 byk8o4UGfiXlhw3nXNTq97g4BuaRIvRkLsZbqyozKGkvkVgxXSyLn5S5mbW+oFpihUIr bHeXeQgB0uccm7KEellhVEyYWPQ6HleE09+hf9MZsg8QJqXY43lpWebGEG0HLqG5qIun xz0w== X-Gm-Message-State: AOAM531nukl0AtAnl0+kFUwoJMV/BIwNFvOF5sDOpeDcogXED8CvCxxw LoPWpwvQ01k11WcT2NGzamjy0DqRmwOGJTH1yhVj4Q== X-Google-Smtp-Source: ABdhPJw/8UyOsWRhm5OKz8PkVYdZDeTlw6l419Ga0o1DqO5OA7mjnUKrvSFxQB/4SUDjVXoT4Y7MrnAbuXkZOs98Z9Q= X-Received: by 2002:ae9:ee06:: with SMTP id i6mr26656383qkg.132.1597087863794; Mon, 10 Aug 2020 12:31:03 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Mon, 10 Aug 2020 15:30:49 -0400 Message-ID: To: Brendan McMillion Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000cc060f05ac8afed9" Archived-At: Subject: Re: [MLS] ChaChaX X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 19:31:08 -0000 --000000000000cc060f05ac8afed9 Content-Type: text/plain; charset="UTF-8" Hey Brendan, I'm not sure I follow. Could you clarify what you mean by ChaChaX, and how it's different from base ChaCha? Where by "base ChaCha", I mean RFC 8439. https://tools.ietf.org/html/rfc8439 Thanks, --Richard On Mon, Aug 10, 2020 at 2:03 PM Brendan McMillion wrote: > Hello mls@ > > I wanted to quickly poll the list on a somewhat annoying issue. Currently, > every time we encrypt with our AEAD we use an unstructured nonce: sender > data encryption is properly random, while HPKE and message encryption use > the output of a KDF which is as good as random. Accordingly, we should be > using ChaChaX instead of ChaCha. > > Does everyone else agree? Should I open these PRs? > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000cc060f05ac8afed9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey Brendan,

I'm not sur= e I follow.=C2=A0 Could you clarify what you mean by ChaChaX, and how it= 9;s different from base ChaCha?=C2=A0 Where by "base ChaCha", I m= ean RFC 8439.


Thanks,
--Richard

On Mon, Aug 10, 2020 at 2:03 PM Bren= dan McMillion <brendan=3D40cloudflare.com@dmarc.ietf.org> wrote:
Hello mls@

I wanted to quickly poll the list on a somewhat annoying = issue. Currently, every time we encrypt with our AEAD we use an unstructure= d nonce: sender data encryption is properly random, while HPKE and message = encryption use the output of a KDF which is as good as random. Accordingly,= we should be using ChaChaX instead of ChaCha.

Doe= s everyone else agree? Should I open these PRs?
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000cc060f05ac8afed9-- From nobody Mon Aug 10 12:36:37 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 27FDA3A0C54 for ; Mon, 10 Aug 2020 12:36:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7kJoMrBolq_R for ; Mon, 10 Aug 2020 12:36:34 -0700 (PDT) Received: from mail-qt1-x82b.google.com (mail-qt1-x82b.google.com [IPv6:2607:f8b0:4864:20::82b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B192A3A0C53 for ; Mon, 10 Aug 2020 12:36:34 -0700 (PDT) Received: by mail-qt1-x82b.google.com with SMTP id w9so7691347qts.6 for ; Mon, 10 Aug 2020 12:36:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=v91ytwLjaYUEKB4Ikm2Tzt+bs2LpJfEt0OMyaplfTGk=; b=YTAVzWO1TDknsKfG3tO9CkFVLbHIt17uzxbAalbsWoM5MEI+K6jeVXWW+x79u/zJIQ yjVerIKsrV9HEvOI2pNuTUsETSVExRE9mo9DJUCuzRcTB+uv3sGFtN5b7WWhE1qC/XlU mkZzpnir86qsN0yZIvox8jUFVmfPz2f9K63Wo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=v91ytwLjaYUEKB4Ikm2Tzt+bs2LpJfEt0OMyaplfTGk=; b=Oapg9nbXpO5DC+/Xig9CbXDWxCnJ0DSHcrFWstXUvO0RYRuMLSgn6NdsI1U10WLve/ PsPR3JtfhifHceTZ1PKa+yGcBwEdVBK/jhFcopyzuS/uYuCDgCZGobUkvzqEWAkFg7dF DfPTkd2Mik/4ZsNprQS/4lMIVUyNx07y5w4sCQHr43OF6vRPKSPdeuTJ5toXdUV/D+ix Y2+1vkEkrMvGkye2xY/tWH3C7Vizh1XWaZYUXx0XjZUs3xXyCqVVojDa57uopWzsV868 rOinly1i1zgVNHi3l1SUh5YS2wv4WZeaE+lef8OZucbOPdTteQWwH1Gj587ewMD57sX7 hNKw== X-Gm-Message-State: AOAM532HehFVgniCwQrxoLcWjjnIcAWKnHQTPutZe9gtEpWyngUVDdqb xEZ3yzh94VCYHBXeZviXHrJH23H6HdH9USZjDZtmErGAjbggnA== X-Google-Smtp-Source: ABdhPJxUS2cmHKbT6aNtdHoEeJQyq09ZhyxW8bM4E0uxHaf0B7oj8PTrm4rzXuj6Dmsyt2dBdx45Ml4S4c9A9WdcI/E= X-Received: by 2002:ac8:6d2f:: with SMTP id r15mr29299247qtu.281.1597088193140; Mon, 10 Aug 2020 12:36:33 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Brendan McMillion Date: Mon, 10 Aug 2020 12:36:22 -0700 Message-ID: To: Richard Barnes Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000006d85e105ac8b12a0" Archived-At: Subject: Re: [MLS] ChaChaX X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 19:36:36 -0000 --0000000000006d85e105ac8b12a0 Content-Type: text/plain; charset="UTF-8" Sorry, I suppose the real name is XChaCha and it's defined here: https://tools.ietf.org/html/draft-irtf-cfrg-xchacha-01 XChaCha has a 24 byte nonce and is meant to be more suitable for randomly generated nonces On Mon, Aug 10, 2020 at 12:31 PM Richard Barnes wrote: > Hey Brendan, > > I'm not sure I follow. Could you clarify what you mean by ChaChaX, and > how it's different from base ChaCha? Where by "base ChaCha", I mean RFC > 8439. > > https://tools.ietf.org/html/rfc8439 > > Thanks, > --Richard > > On Mon, Aug 10, 2020 at 2:03 PM Brendan McMillion 40cloudflare.com@dmarc.ietf.org> wrote: > >> Hello mls@ >> >> I wanted to quickly poll the list on a somewhat annoying issue. >> Currently, every time we encrypt with our AEAD we use an unstructured >> nonce: sender data encryption is properly random, while HPKE and message >> encryption use the output of a KDF which is as good as random. Accordingly, >> we should be using ChaChaX instead of ChaCha. >> >> Does everyone else agree? Should I open these PRs? >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > --0000000000006d85e105ac8b12a0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sorry, I suppose the real name is XChaCha and it'= s defined here: https://tools.ietf.org/html/draft-irtf-cfrg-xchacha-01

XChaCha has a 24 byte nonce and is meant to be more suitab= le for randomly generated nonces

On Mon, Aug 10, 2020 at 12:31 PM = Richard Barnes <rlb@ipv.sx> wrote:
Hey Brendan,

<= /div>
I'm not sure I follow.=C2=A0 Could you clarify what you mean = by ChaChaX, and how it's different from base ChaCha?=C2=A0 Where by &qu= ot;base ChaCha", I mean RFC 8439.


Thanks,
--Richard

On Mon, Aug 10, 2020 at 2:03 PM Brendan McMillion <brendan=3D40cloudfla= re.com@dmarc.ietf.org> wrote:
Hello mls@

<= div>I wanted to quickly poll the list on a somewhat annoying issue. Current= ly, every time we encrypt with our AEAD we use an unstructured nonce: sende= r data encryption is properly random, while HPKE and message encryption use= the output of a KDF which is as good as random. Accordingly, we should be = using ChaChaX instead of ChaCha.

Does everyone els= e agree? Should I open these PRs?
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000006d85e105ac8b12a0-- From nobody Mon Aug 10 13:26:15 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF0E63A0DFB for ; Mon, 10 Aug 2020 13:26:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=matrix.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fYetQdJAkz-F for ; Mon, 10 Aug 2020 13:26:07 -0700 (PDT) Received: from polemos.matrix.org (polemos.matrix.org [94.237.46.156]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DEE013A0D61 for ; Mon, 10 Aug 2020 13:25:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=matrix.org; s=polemos; h=Content-Transfer-Encoding:From:Message-ID:Subject:Date: MIME-Version:To:Content-Type:Sender:Reply-To:Cc:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=/oFoBbhHEsJq2ifgpDke+0kf1USdNNPBSM/iAbVK8Zc=; b=ndybk/X4j2BuesD+DjDqxWFzzF t2MDoyAXZwCadzNeu/E6m+qZ54TDMuHPC3Sddo1pJJIPQtB1FXbFksWaMUwNcJQbKOqIRA0mu+yxp P0+tC8uffsgH7QzxFzOQbBlorhO5Pkztm8Qi4UaE924UASZN+hyUZJk9L+me1nMOfSaBWreY3ygiL dMhMz3VrW+aS3bBxBz5Bi5dqW0LovE5Qd12RuFob3/CJYaDaQaRXIbM7jY5M7ozLh4V+PDZIc2tum /+OOocirAc2pjWZ5xfcIhVoyI2yivSZZs2fz88OcQnTFwuZbUWSwEqdnUFJuK2bJI1hzPJSyw9Loq EysbL0RLj9wzga/g0HjFuHX9F6CiJ8PxXOC4yh46LGkAP2UeCQ9MuieUQRZkjyGFoPfl/5w8bILts r36Pdxg65n2B3puwx9JIjWhFIYzRksqNNTEMEVnOw/5p9jpnFIZzYmNUyPoSdYH2KFGpwefoTXTdQ 67qOOewzAgCKJFjLXQ4hWLuLkM2i8AKi66EtTa6MZ7xce833i3o98yMcJHrnZv9JBhfw3MTyDab/s ZDtE50Nd87qUlQaFqYJeIjhj4gZ8KNYjIJ6n/7ClPzRL3FYfDviG23btnIub6tqkKrclFSsWoLs73 fXGwveJTa3lo3WUYtMV9OLfB/QHD1T9L7c0y97ej0=; Received: from [127.0.0.1] (helo=localhost) by polemos.matrix.org with esmtp (Exim 4.89) (envelope-from ) id 1k5EMl-0004G6-8x for mls@ietf.org; Mon, 10 Aug 2020 20:25:55 +0000 Content-Type: text/plain; charset="utf-8" To: mls@ietf.org User-Agent: SOGoMail 3.2.6 MIME-Version: 1.0 Date: Mon, 10 Aug 2020 21:25:55 +0100 Message-ID: X-Forward: 45.58.213.43 From: "Hubert Chathi" Content-Transfer-Encoding: quoted-printable Archived-At: Subject: [MLS] Tree of application secrets X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 20:26:13 -0000 The tree of application secrets (#astree) is used to derive an applicat= ion secret for each sender. However, only the leaf nodes are ever used= ; I don't see the internal nodes being used anywhere, and I don't see t= hat deriving through a tree provides any extra security. Would it be s= impler to just derived the application secret for a sender using their = leaf number (e.g. astree=5Fnode=5F[N]=5Fsecret =3D DeriveAppSecret(appl= ication=5Fsecret, "label", N, 0, Hash.length) using the same DeriveAppS= ecret as defined in that section)? This would mean that if you need to= derive the application secret for one of two senders, you'd only need = to do O(1) work, rather than O(log(n)) work. From nobody Mon Aug 10 15:30:04 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A1C973A0DBF for ; Mon, 10 Aug 2020 15:30:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NDKpi9qkcHTD for ; Mon, 10 Aug 2020 15:30:00 -0700 (PDT) Received: from mail-qv1-xf2f.google.com (mail-qv1-xf2f.google.com [IPv6:2607:f8b0:4864:20::f2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1A2AB3A0DBC for ; Mon, 10 Aug 2020 15:30:00 -0700 (PDT) Received: by mail-qv1-xf2f.google.com with SMTP id o2so5071911qvk.6 for ; Mon, 10 Aug 2020 15:30:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=USxQDVsXXgtzLGskT9Kf6NXNp/DTBb/YNVWNcONkLNk=; b=gch3bz6COPQz9KRMlNNfNGSmDxF6GH4AHGa/bX4/nZ1KYAPY1DDXaMiikfaoHkkS4v VmS5rX7mT+kxJVmBT5nkeTs3wjxwwFP0ggUJNiKspcvyLQOIn8zFPF/uUAhcs3AiZJqz m+eCVlSHJCsBmeGXTC9Vl3ZIsV4b8G885A7AE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=USxQDVsXXgtzLGskT9Kf6NXNp/DTBb/YNVWNcONkLNk=; b=MoJG/V8m2tjKBIxdpTXRy8zR1vOvx5KI2xyUXwVVNB6ugy5wkjq8xu8IeAS2wMExXz TDZctWk2rJoTggPiN6lwssyGSMveGepQTwIv08Aqc+JEuJMHHHaF1wzuczGPHUF1KGm2 dpM5IOhJpdVS6B5ospmeLkU4DR2H+UL1F5JX7PUR1zrpxBleaWUgP0tXNZ98WT8t3geR 1GRbtfLi2jEUEB9sP42Sg7LeGCMvpzoFFuHjUyj5M/F1OAQuq4OtvDEQeajju2LktFeE kmoizOpjbLj6tGHRSIC2pUk0FbJAv3GZby7GddnbgdU8YHV8jE73+CpR8ebYGVAMDbTS ZAWQ== X-Gm-Message-State: AOAM530Yc9PSlN1OexXG828xLb4xwvLCVFOKwRESbKXgH1Xt6FvbXdFT MR1s7F3x5ojaRPtYzZIss49e8U+N++fcqrUczGCDp8qYmHs= X-Google-Smtp-Source: ABdhPJyzqkP5yZJ2MLNdE+iuy3VL3DBq8th8gcdenLwln3g7ZMQAwyv2lUy7O+6Y4T3HWQHgSd/XFM+vPFBGLUJJIXc= X-Received: by 2002:a05:6214:11f3:: with SMTP id e19mr30472339qvu.220.1597098599019; Mon, 10 Aug 2020 15:29:59 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Brendan McMillion Date: Mon, 10 Aug 2020 15:29:48 -0700 Message-ID: To: Hubert Chathi Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000aaa27c05ac8d7e8f" Archived-At: Subject: Re: [MLS] Tree of application secrets X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 10 Aug 2020 22:30:02 -0000 --000000000000aaa27c05ac8d7e8f Content-Type: text/plain; charset="UTF-8" Hey Hubert The following section describes the application secrets tree's deletion schedule . Values are deleted from the tree as they're consumed to provide forward secrecy. In the flat approach you described, it wouldn't be O(1) to generate a leaf, it would be O(n) because when you consume the root node you'd have to generate every leaf. On Mon, Aug 10, 2020 at 1:27 PM Hubert Chathi wrote: > The tree of application secrets (#astree) is used to derive an application > secret for each sender. However, only the leaf nodes are ever used; I > don't see the internal nodes being used anywhere, and I don't see that > deriving through a tree provides any extra security. Would it be simpler > to just derived the application secret for a sender using their leaf number > (e.g. astree_node_[N]_secret = DeriveAppSecret(application_secret, "label", > N, 0, Hash.length) using the same DeriveAppSecret as defined in that > section)? This would mean that if you need to derive the application > secret for one of two senders, you'd only need to do O(1) work, rather than > O(log(n)) work. > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000aaa27c05ac8d7e8f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hey Hubert

The following sec= tion describes the application secrets tree's deletion schedule. Values are deleted from the tree as th= ey're consumed to provide forward secrecy. In the flat approach you des= cribed, it wouldn't be O(1) to generate a leaf, it would be O(n) becaus= e when you consume the root node you'd have to generate every leaf.
=

On Mon, Aug 10, 2020 at 1:27 PM Hubert Chathi <hubertc@matrix.org> wrote:
The tree of application secrets (#astr= ee) is used to derive an application secret for each sender.=C2=A0 However,= only the leaf nodes are ever used; I don't see the internal nodes bein= g used anywhere, and I don't see that deriving through a tree provides = any extra security.=C2=A0 Would it be simpler to just derived the applicati= on secret for a sender using their leaf number (e.g. astree_node_[N]_secret= =3D DeriveAppSecret(application_secret, "label", N, 0, Hash.leng= th) using the same DeriveAppSecret as defined in that section)?=C2=A0 This = would mean that if you need to derive the application secret for one of two= senders, you'd only need to do O(1) work, rather than O(log(n)) work.<= br>
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000aaa27c05ac8d7e8f-- From nobody Mon Aug 10 18:34:06 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0B0A93A0EA0 for ; Mon, 10 Aug 2020 18:34:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (4096-bit key) header.d=matrix.org Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FHXneGHcvXam for ; Mon, 10 Aug 2020 18:34:02 -0700 (PDT) Received: from polemos.matrix.org (polemos.matrix.org [94.237.46.156]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A49CA3A0EBA for ; Mon, 10 Aug 2020 18:33:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=matrix.org; s=polemos; h=Content-Transfer-Encoding:Subject:Message-ID:MIME-Version:To:Cc :Date:From:In-Reply-To:Content-Type:Sender:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=JKxXTfy/dqDOwayT4gyv5jlojaaOdnn3QAHUwBnkj3s=; b=THdKZYlV0vMXVqOyeHKUYFZ9bf 9pKSEMIgIED+dxkUZHRLV+SFYfnt/2Lxl6xeR6odgjkTvtYf/Ac4r9PGDGt02pnny2cBHlfWvvAWG K09+xD4qq9odg0NrlAzqEnx2x8wl5dttNngy+F/se50qQn29gwgE0h6IHuj74e5eVMeaZpFIY8069 lYMkabLmKkU2lBhAATuUbpmm+CvU+dohzx4OPrsOogF4bJFnVwSoy7U3PvYe1OUZFBtu1EGPJ8lM1 +4c/HquXeGj9C1j62QU23oinLbWfbM02gzorsduKjVouFVqpgHtNnu5IUM1NTBGlYFuvCH/9GeQAs lrrndF4TyCe7jIGHmlGjM/AHHGukbU6Z+6YG10T3A06S0vwQIaYawnRgyLj6b2qiolleDZIiqRf2+ CihNP0tD3ZgIKTybM2iOIbMigbMrUzbYDziyHPA5pQZZEFvZxkF6qfDXrKqbu0TKhV7HT/d7V9F6l V93tWpmU+76gRKo6BQ4jK0xYyiIryachQwNfPEyVsQdFAIqBBU4dpaVMOz7kbl4LE/Nx00FTOFiXV MTHcP47Q0M63dzfkfbaj2dBwVfHdU0qGosK8zbHd9uLOk7Z0K7ABHPIlPOZEJ5Ib3Cn25vUL4xL2C BlYLWu05954q/oVZoMMl08BNg9uP73zoYK74wMGps=; Received: from [127.0.0.1] (helo=localhost) by polemos.matrix.org with esmtp (Exim 4.89) (envelope-from ) id 1k5JAX-0001y2-So; Tue, 11 Aug 2020 01:33:37 +0000 Content-Type: text/plain; charset="utf-8" In-Reply-To: From: "Hubert Chathi" X-Forward: 45.58.213.43 Date: Tue, 11 Aug 2020 02:33:37 +0100 Cc: "Messaging Layer Security WG" To: "Brendan McMillion" MIME-Version: 1.0 Message-ID: User-Agent: SOGoMail 3.2.6 Content-Transfer-Encoding: quoted-printable Archived-At: Subject: Re: [MLS] =?utf-8?q?=3F=3D=3D=3Futf-8=3Fq=3F__Tree_of_application_se?= =?utf-8?q?crets?= X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 01:34:05 -0000 Ah, right. That makes sense. Thanks for the clarification. On Monday, August 10, 2020 18:29 EDT, Brendan McMillion wrote: > Hey Hubert > > The following section describes the application secrets tree's deleti= on > schedule > . > Values are deleted from the tree as they're consumed to provide forwa= rd > secrecy. In the flat approach you described, it wouldn't be O(1) to > generate a leaf, it would be O(n) because when you consume the root n= ode > you'd have to generate every leaf. > > On Mon, Aug 10, 2020 at 1:27 PM Hubert Chathi wr= ote: > > > The tree of application secrets (#astree) is used to derive an appl= ication > > secret for each sender. However, only the leaf nodes are ever used= ; I > > don't see the internal nodes being used anywhere, and I don't see t= hat > > deriving through a tree provides any extra security. Would it be s= impler > > to just derived the application secret for a sender using their lea= f number > > (e.g. astree=5Fnode=5F[N]=5Fsecret =3D DeriveAppSecret(application=5F= secret, "label", > > N, 0, Hash.length) using the same DeriveAppSecret as defined in tha= t > > section)? This would mean that if you need to derive the applicati= on > > secret for one of two senders, you'd only need to do O(1) work, rat= her than > > O(log(n)) work. > > > > =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= =5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F=5F= > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > From nobody Tue Aug 11 06:47:42 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5BD7A3A1089 for ; Tue, 11 Aug 2020 06:47:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p9Vweu-5yDjK for ; Tue, 11 Aug 2020 06:47:37 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 226783A1087 for ; Tue, 11 Aug 2020 06:47:35 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 2CFFB2715E8_F32A173B; Tue, 11 Aug 2020 13:47:31 +0000 (GMT) Received: from exng1.org.aalto.fi (exng1.org.aalto.fi [130.233.223.20]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng1.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id B5522271566_F32A172F; Tue, 11 Aug 2020 13:47:30 +0000 (GMT) Received: from exng4.org.aalto.fi (130.233.223.23) by exng1.org.aalto.fi (130.233.223.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 11 Aug 2020 16:47:30 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Tue, 11 Aug 2020 16:47:30 +0300 From: Cornelissen Eric To: Richard Barnes CC: "mls@ietf.org" Thread-Topic: [MLS] Two poorly defined aspects of the spec Thread-Index: AQHWa9hzVoJJMfPk+kK5poDHTeMmXqkxOXWAgAG6Coo= Date: Tue, 11 Aug 2020 13:47:30 +0000 Message-ID: References: , In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_cc19f450a410431cb3be124c96417c60aaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=/9+3SDPkKLC90v1OJ26CnJEqVrqmmLFv3jyzZxbunGI=; b=S0v+6GY0CoGuuWXHKGSSoKAsh1dGjy5dZLRe+3L14UgvG3JJntk7FRnrGAb3rqvtk+ZJnfQhTYq3OwDKnIp0TRLJGS+CzMHYkv+HWgkmwCelN8tZBC5vygQlYqt4iELiuu1L+kYv19rh4G66x1v+CBw+lcVOR+HutBORDbBoyBf3hEwwZqMi8pVHpjKwszZep2/xAZkEZh3ipKrn1CMjN1FVv0WVYlMl/SEsPQ+vfA0HO2wiXKIPfLjyVA0xdafMJ56CRzQkfETS4J4BazVvdvAp9QBiqv+MFfG2rugy3PFuN3Cwwx3Zrq3+bZR6g1VyJy37/tgm1Ps0i2lHsFalxA== Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 13:47:40 -0000 --_000_cc19f450a410431cb3be124c96417c60aaltofi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Richard, 1. In that case I would agree that clarifying the indices is the way to go.= I personally think just adding interim_[0] =3D 0 to the current definition= would suffice and be clearer than your suggestion here, but that's just pe= rsonal taste. 2. The "secrets" array makes a ton of sense. If the welcome is ignored when the verification fails, then the fact that t= his is not strictly true seems to make it impossible to continue with a gro= up after all but one person left (unfortunately, the paragraph doesn't spec= ify what should happen if the verification fails). This is not a cryptograp= hic problem, but I'd imagine this being confusing for end users if the appl= ication layer doesn't deal with it properly. However, as I just pointed out in #385, it seems that we (I) made it impossible for joiners to verify = group creation at all. Regards, Eric ________________________________ From: Richard Barnes Sent: Monday, August 10, 2020 5:22:47 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec Hi Eric, Thanks for the analysis here. More good finds. 1. I think the right answer is a little of both. If you initialize a one-m= ember group, before any Commit messages have been sent, then it should be t= he zero-length octet string. But then as soon as the group is used for som= ething, it is updated. Maybe the way to clarify this is to fix the indices= . If we have the interim hash belong to the new epoch, then we could have = something like the following: interim_[0] =3D 0 confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]); interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); 1.a. BTW, this raises another issue: I had thought we had removed direct de= pendencies on hash functions when we move from invoking HKDF to invoking th= e KDF from HPKE. But this points out that we still have raw hash invocatio= ns. I filed an issue for this: https://github.com/mlswg/mls-protocol/issues/386 FWIW, I think the latter course there is the right answer, i.e., to keep th= e raw hash invocations and clarify that the ciphersuite specifies a hash fu= nction. 2. It seems like the right reference here is probably to the "secrets" arra= y in the Welcome message. There's one entry there for each member being ad= ded, so if len(secrets) =3D len(group_info.tree.leaves) - 1, then there was= only one member in the group to start with. It's not strictly true to say= that this is a new creation, since one commit could remove all but one of = the members of the group and re-add a new set of members. But this distinc= tion doesn't really seem salient. On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric > wrote: Hi All, I have two questions about things that are unclear to me in the current sta= te of the spec as they are undefined/poorly defined. 1. What is the intended value of interim_transcript_hash_[0]? >From the current draft I cannot definitively (i.e. with 100% certainty) say= whether the value of the first interim_transcript_hash should be: a. "the zero-length octet string" following the last line of Group state se= ction, or b. a value derived based on the MLSPlaintextCommitAutData for the first com= mit concatenated with 0: interim_transcript_hash_[0] =3D Hash(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthDat= a_[0]) =3D Hash(0 || MLSPlaintextCommitAuthData_[0]) The draft strongly suggests to me that it is the former, but the latter see= ms to more accurately reflect the statement "The confirmed_transcript_hash = field contains a running hash over the messages that led to this state." In the case that a is correct I would suggest updating the definition of in= terim_transcript_hash_[n] to: interim_transcript_hash_[0] =3D 0 interim_transcript_hash_[n] =3D Hash(confirmed_transcript_hash_[n] || MLSPlaintextCommitAuthData_[n]); In the case that b is correct I would suggest adding a "warning" that says = something along the lines of "as a placeholder value" to the place(s) where= the draft says that the interim_transcript_hash of a group is initialized = to 0. 2. What is the `members` array mentioned in the Group creation section? In that section it is stated that "A new member receiving a Welcome message= can recognize group creation if the number of entries in the `members` arr= ay is equal to the number of leaves in the tree minus one." First of all, i= t is not clear what this `members` array is. It seems this refers to a fiel= d of the now-removed Init struct. Interestingly this struct was removed in = the very same PR that added the above sentence (see #239). But I wasn't able to really figure out what= the draft-09 equivalent of it should be. In addition, I'm pretty sure this technique would no longer work to detect = group creation (but that would depend on how the sentence should be updated= ). Regards, Eric _______________________________________________ MLS mailing list MLS@ietf.org https://www.ietf.org/mailman/listinfo/mls --_000_cc19f450a410431cb3be124c96417c60aaltofi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Richard,


1. In that case I would agree that clarifying the indices is the way to = go. I personally think just adding interim_[0] =3D 0 to the current definition would suffi= ce and be clearer than your suggestion here, but that's just personal taste= .


2. The "secrets" array makes a ton of sense.


If the welcome is ignored when the verification fails, then the fact tha= t this is not strictly true seems to make it impossible to continue with a = group after all but one person left (unfortunately, the paragraph doe= sn't specify what should happen if the verification fails). This is not a cryptographic problem, bu= t I'd imagine this being confusing for end users if the application layer doesn't deal with it properly.


However, as I just pointed out in #385, it seems that we (I) made it impossible for joiner= s to verify group creation at all.



Regards,

Eric


From: Richard Barnes <rl= b@ipv.sx>
Sent: Monday, August 10, 2020 5:22:47 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
Hi Eric,

Thanks for the analysis here.  More good finds.

1. I think the right answer is a little of both.  If you initiali= ze a one-member group, before any Commit messages have been sent, then it s= hould be the zero-length octet string.  But then as soon as the group = is used for something, it is updated.  Maybe the way to clarify this is to fix the indices.  If we have the interi= m hash belong to the new epoch, then we could have something like the follo= wing:

interim_[0] =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]);<= /div>
interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData= _[n]);


1.a. BTW, this raises another issue: I had thought we had removed dire= ct dependencies on hash functions when we move from invoking HKDF to invoki= ng the KDF from HPKE.  But this points out that we still have raw hash= invocations.  I filed an issue for this:


FWIW, I think the latter course there is the right answer, i.e., to ke= ep the raw hash invocations and clarify that the ciphersuite specifies a ha= sh function.


2. It seems like the right reference here is probably to the "sec= rets" array in the Welcome message.  There's one entry there for = each member being added, so if len(secrets) =3D len(group_info.tree.leaves)= - 1, then there was only one member in the group to start with.  It's not strictly true to say that this is a new crea= tion, since one commit could remove all but one of the members of the group= and re-add a new set of members.  But this distinction doesn't really= seem salient.



On Thu, Aug 6, 2020 at 6:02 AM Cornel= issen Eric <eric.cornelisse= n@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1. What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
    interim_transcript_hash_[0]
        =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
        = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
    interim_transcript_hash_[0] =3D 0
=
    interim_transcript_hash_[n] =3D
        Hash(confirmed_transcript_hash_[n] ||
            MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the dra= ft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer work= to detect group creation (but that would depend on how the sentence should= be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--_000_cc19f450a410431cb3be124c96417c60aaltofi_-- From nobody Tue Aug 11 07:49:03 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F00883A0C67 for ; Tue, 11 Aug 2020 07:49:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, T_FILL_THIS_FORM_SHORT=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=riseup.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ajvpIPa8i7Jk for ; Tue, 11 Aug 2020 07:49:00 -0700 (PDT) Received: from mx1.riseup.net (mx1.riseup.net [198.252.153.129]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 71FAB3A11E6 for ; Tue, 11 Aug 2020 07:48:34 -0700 (PDT) Received: from capuchin.riseup.net (capuchin-pn.riseup.net [10.0.1.176]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.riseup.net", Issuer "Sectigo RSA Domain Validation Secure Server CA" (not verified)) by mx1.riseup.net (Postfix) with ESMTPS id 4BQwgj6lhxzDsdk for ; Tue, 11 Aug 2020 07:48:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=riseup.net; s=squak; t=1597157313; bh=dn8PMrJ9XGz2y5xOaGjjPdmtyYXERm89e4AEhwf+ULo=; h=To:From:Subject:Date:From; b=q/+xXl6ayhwHAg42BP0KyCIXKejgK0eoWpJyklnICGHB7WI44hI1c3uxHFFZ9sCa7 Zgv7YguOExLtkEtFQSZaTtPKERsQOQs1Um7AGJ32Ub5APlFfDJ9udYjzLTGx8DlCwz O0QET8FQPnhZ2bDJUZw0iS6b+xamCY31X7Z+7z/I= X-Riseup-User-ID: F1974F78B9EC68DC3D69D7EDAE890A8EE87005F879B484AFAAD7A3DDEA454E59 Received: from [127.0.0.1] (localhost [127.0.0.1]) by capuchin.riseup.net (Postfix) with ESMTPSA id 4BQwgj2RdZz8v0Q for ; Tue, 11 Aug 2020 07:48:33 -0700 (PDT) To: mls@ietf.org From: =?UTF-8?Q?Sof=c3=ada_Celi?= Autocrypt: addr=cherenkov@riseup.net; keydata= mQINBF2PpxoBEADAIhbOpA23OBsXzg/aQakv88vaLv8Dxt2oR92Rz9cfxca736HKDeO19IFC F1Anu6ylQsJfoT4UUgbGIjJpHtQB3OVIcgvsMagfZ0lEHd1eG8H8K9wqSjwSphUJl9ra+tMW MEbSDVmeV6qvHeO63vrazXrgUKBf0jDae0HcK++AYiSeSpbTmN+zTsY3ZXy9H1sdNhMUlkGt jcpROrna2NaSL3YG8YNJHsN+zGPoaBbPo9gQALUvuxtg0yS/ecly2xomWIeH6qJ4yJonO/Ys WqAAC96n423BeC1cAyYjij8ydygnR3csTibUI/iPkoH8xstnTyrv3djyiunVuw1BQUNqmtLV v7meRZfIFbfnNatuuPYp7S5NnL58vUwY/BwlMb5OhyzdCckRcITAXiz8sp4LANx1lxIdbaQA 9NsYv32vem9Pd0wtdN5JTW3dajgJtPAC1yfR86rw9u/+BSW9KhRqNF0/a+hX/+Njdni9fkl9 EheZiFHNO+nXeGLy0kikhUXr5iLg8626fG9I8QYuNj05WIEntegvAW65YjGTYSCdVgLx2bvv oGwC/4/jWxNm8MTzv38f/9YAZ5u5DSG3dFKYAjwOhf1IgEMTEWj+bKDFvgpv5fdTFumLxNey M/v3viwuNjS1hscRbi6IO36v4sFce4K1C5GU93YIgao2j01M8QARAQABtB1yaXNldXAgPGNo ZXJlbmtvdkByaXNldXAubmV0PokCVAQTAQgAPhYhBPq5Ptx83RGY3P1FWJG7a0VvRC0CBQJd j6caAhsDBQkHhh+ABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEJG7a0VvRC0CEV0P/2UN rjx8LYmz/ydk2XO/uNWyobCtj/y9XBhZG9dpB8R43VC8OS5gv4Nw2ZLDrrpLQmaQ2dXjAeLL +9eCM++QT//VP2j2QS3YKbIcRreXSnl7DI6bMpD+Pu3JwiYHSyBs1zZT+VGm4nTS6QH588XJ VrslKyDYJFfzaHgkIGtxAWgqaHWAZHtjqh6PNEWMe2t571YYcVlk29cWsJ5ITsSPb+0Y0xJn u5HKQOc4TOdraedpLSFb5CZRlusNgWvhqmL4VyIcfjSEY0B8JVOgVpUeNTy0sZcDflYJ6uSN 9B1m79kb8STnVOtFS9gjnWbVwjAunqkkb/joRZhYfjeANVyYC4skh0uqJLFtqJw4r8s9+MrE p4lBy30lQ7mYYyqvRcwyEgoRRLHUvzV6cIHau/HV1pw0lwcbiXk3jP+TMf6OKOzg6lGJ/zX0 ZD+s0OAvHh8GM+5TDlgEM4Dwp6Q+9Jr1m9sp1QDQVbU7xrXXndXDd8RLEkiMDLovyyDtN6Jn HsW9PVMtu6sXvmbn0AHeHzHU/+bwB1LF4sx8O82tWKCgZlm270p+Bk6mjYmrlO4eQ11/AOF6 3ZlVoeXSaM4X0yoKa3ltdWaRoy9L0a4p7JuQYhBYIzjARbVjp9CmxctuQqW2qNSCJfagsUl8 mpcrs7xdhzfhzZHf8kQYWQcPYPPWLWqIuQINBF2PpxoBEACow9T4wPaQvKNG2LBnXeuLkDxf VGrZ/fDk0yfhG0174SjWXvDMIAgdNmfn2F4CM4F2FfPI32NZT34Td89fyWEWvP5/2I9HywyI QI/ubQvbqvm0l+DyzsdZNj4MBmNLy34Rg3K8uScgG7YbakzUplalbQKuzHrSW5OL5aBeKOG2 NGKJK7VZ4MzbdxhCLnXYvQwgnSkJ6B3AoBGv0LsLYzGUixzlMbNmYEhlQcK2scqprmFoX9rQ ymStV8b4Z37gkVmYeWGG2D9zl8gLj0u5Xw/KlF45JNxtMFBSL+Px7E1c+GJTWJxIENBhxRAu fxvbvduyJdXTObI51bqgV57510RjoLdzvVVqUpevmIdaMnavyUnDZOb8sBg3JG6NozZVzlXf S3FAvvK82zRShpd06ZNUbxPtNkruH/dT+6QV8gW3jX15gKGp2CtvhxLbi8ysV6zwtqxPkba2 03J0RAq2lVzxE/CSAP2qGPttElzHOPqhdmL6XjdmTw/WpF+qT8acB6Te8HZF+DriR/xG6EA1 MSdIK0vX4r5+U5bd0r7sh1ysSaYk/RI8hqxZZ4VGdPbVhFCOdT8AVcEXRoLsv+oN4x5WYJ9g 8G8Xw9+DvCNjFLxaGcL0ATHc8u8TyeegGRF3ZQNsRCqfVOLEYclYX+DqIly4ebCawAoIeWg2 GvN9cJAnFwARAQABiQI8BBgBCAAmFiEE+rk+3HzdEZjc/UVYkbtrRW9ELQIFAl2PpxoCGwwF CQeGH4AACgkQkbtrRW9ELQJX3g/8DAxtZTUJAlbKkluY30zITfcUwH4h9Rppxx/RvibZ1R4k 960OlvwyoRZ5rv2XiQA5VxOaVlh1tJErZnAyqgYwHr5CGQBjPEgkmRWBzme4W62uvCXOahxJ 4lNpr0TrVGRNOu223zYQcaN5S4Q5H2U9XNUFx8UF5leZIL6/Z6/bSGEW27vSuCxY6v8MkhQC 6l8T5RJqDsJmhwcVg9KDm8eGLkiu+kXS8iKl/Bw4o9257BI8hswBVRhN8kpHsecP2MGzKwn9 ccXWnOfM75qiq566UI26MY5priaGz5i+eCo26Rc0edm0IXxNs6rUZKVQUoxfMb/A/buJknYZ lUYXAgG2eDHEjlXvqNxQWHgfhIGqKFXDWuMt0sKP7Ta/lvGVPx9IHCTvkRZn9mtIN2/F9Lt5 sK3kezAlFw3BK6AIbD2v+g8TZnvKWSBidJHyhh7OEmKg3gXA3DxBpb7TU6iVUfG5e10RJUvQ qQNTSxv6mxJOgE3mEXizzj+tC6aEG/BzBwDsQpKquzUIKGCF2EGX9C7CZBhlsng/zmL3TFH6 EnY1tqV/lEg2/+gCLy/OE2dlE+EDZEtAiV183lzZNBs5Bg9NIz0Gq6a4ZkA8zDOFuxL2BFH2 EqrT33ladX2AIyKPMF50IwY4TMxGRlKhAjb4++pb55vBwVBLaTC09mvA+CuupPU= Message-ID: Date: Tue, 11 Aug 2020 09:48:31 -0500 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: [MLS] Invitation to participate of the Secure Messaging Summit X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 14:49:02 -0000 Dear, list, We are organizing a Secure Messaging Summit, a place where people from different places (academia, industry, open source implementations, and legal/political perspectives) talk about the latest problems and advancements on the secure messaging sphere. This is an online event but you need to register. More details over here: https://claucece.github.io/Secure-Messaging-Summit/ It will run for two days: the 3rd and 4th of September, 2020, centered around times convenient to the morning in the Americas, the afternoon in Europe and Africa, and the evening in Western Asia. On the first day, we have a set of speakers: - Rosario Gennaro speaking around deniability and the simulation paradigm, - Nik Unger speaking around usability and secure messaging, - Paul Rösler speaking around concurrent group ratcheting, - Daniel Kales speaking around mobile private contact discovery, - Thomas Ristenpart speaking around message franking, - Raphael Robert speaking around group messaging On the second day, we have a set of people speaking in a panel. The topics of the panel will be sent next week; but manly the idea is to talk about the threats/challenges that secure messaging faces from a legal/political and even sociological perspective in different regions. We will have perspectives from Hong Kong, Latin America, US, Tibet and more. The participants are: * Danny O'Brien from EFF * Erica Portnoy from EFF * Glacier Kwong from Keyboard Freedom * Lobsang Gyatso from the Tibetan Action Institute * Carolina Botero from Fundacion Karisma * Paulina Gutiérrez from Article 19 One can register here: https://docs.google.com/forms/d/e/1FAIpQLSf1Knazuv88jaoZW1HAvK9XpHHMHh4YS2UlYsWSZoqAjKdHQw/viewform or you can send an email, as outlined here: https://claucece.github.io/Secure-Messaging-Summit/#how-to-register Registration closes on the 30 of August. As stated, further information can be found here: https://claucece.github.io/Secure-Messaging-Summit Register if you are interested! Thank you! Secure Messaging Summit September 3 and 4, 2020 https://claucece.github.io/Secure-Messaging-Summit -- Sofía Celi @claucece http://claucece.github.io/ Cryptographic research and implementation at many places, but mainly at Cloudflare FAB9 3EDC 7CDD 1198 DCFD  4558 91BB 6B45 6F44 2D02 From nobody Tue Aug 11 08:23:11 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D4B413A120A for ; Tue, 11 Aug 2020 08:23:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Ubx1QebyweN7 for ; Tue, 11 Aug 2020 08:23:00 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D7E733A120E for ; Tue, 11 Aug 2020 08:22:48 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id w9so9670901qts.6 for ; Tue, 11 Aug 2020 08:22:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q88QUhsyQkkq3E079URs2YYJRYWI1k+SGPVuvf1ZSuI=; b=TlG8HzxFp5+r17WVp5bE4PyNihptNdccErmC7PVuLOAd0xHUjzJb2G9TNmTqLSnqgd One3IBCGMsD2ODGZQAdVg4Zrm6rIYrJT4cp5b/85kb1ie8wq3IxxIy7wlpDUtHVnHdWm tvXMoLZ3coRZSkyyh/ao17C56Dwjpxh9K/8zoLq7ch+khqB38SupuuNbvFbRAiHRIEqI PlAtIj1anhfaXnVkbrZlT1m5LaJTHJ+EOpc4fio6aASRDH528RzYH48WlW5RKOAPZzX3 a8HtpRJmnAyNTfPLBdBj3SbtObhddesyEDetA5vpW8MacPJC4GtQ5HPf6kxxN7nzLotx 3hDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q88QUhsyQkkq3E079URs2YYJRYWI1k+SGPVuvf1ZSuI=; b=Ed9/aKYij22VmBvfak9BkgbqYBua6nkW+m5iaCIlKKnSb3fTuLH7aYVjlKIJrnH5C2 qMlr3+bI/SdyNS0OCHlnCe/A3n7gAgX3jcHkBONyLXsX+b7Rr4eCz5FeZu3Zx3NlQcsc E+G74+8hF9cCf5JOOgCFI7aab1vy4BY/TSCF5D76I06G0EUX6l11817USYAv/6edmNDM NNLT180kFyqRNk70XB5El9bgvSIun622nbDwH4ZrvhLFXCxg6T1SA6wpd4KEa8Tk61O3 wyi2bGPzPPiX40Q+4UEz68bnKwv2MJHTirSMgU7dmzmOUvtE0WcPDeGOelPqLcwhpuva 4d6w== X-Gm-Message-State: AOAM530gY0Cr7cZpl2XNDrFcH/SJlVbuOEHo/KPy0B9XLxgBmW/V4K5o FMe4YR+SUVJ21uDjGhm2guzh4pfMSYCEpMhX5QtYiQ== X-Google-Smtp-Source: ABdhPJzvPEho4bO0picGh1EqcW4D45rhsIH2UN3h6cDR2hXLDo8/HmLb3JbfnpgblE/Zo+k4PTQsWTunhUWhYf8g5JU= X-Received: by 2002:ac8:32dd:: with SMTP id a29mr1609028qtb.191.1597159367144; Tue, 11 Aug 2020 08:22:47 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Tue, 11 Aug 2020 11:22:32 -0400 Message-ID: To: Cornelissen Eric Cc: "mls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000ba97eb05ac9ba41c" Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 15:23:10 -0000 --000000000000ba97eb05ac9ba41c Content-Type: text/plain; charset="UTF-8" I filed #388 to fix (1) and (1a). https://github.com/mlswg/mls-protocol/pull/388 Not sure what to do with your observations about Welcome. If you have thoughts about how to clarify, please send a PR! --Richard On Tue, Aug 11, 2020 at 9:47 AM Cornelissen Eric wrote: > Hi Richard, > > > 1. In that case I would agree that clarifying the indices is the way to > go. I personally think just adding *interim_[0] = 0* to the current > definition would suffice and be clearer than your suggestion here, but > that's just personal taste. > > > 2. The "secrets" array makes a ton of sense. > > > If the welcome is ignored when the verification fails, then the fact that > this is not strictly true seems to make it impossible to continue with a > group after all but one person left (unfortunately, the paragraph doesn't > specify what should happen if the verification fails). This is not a > cryptographic problem, but I'd imagine this being confusing for end users > *if* the application layer doesn't deal with it properly. > > > However, as I just pointed out in #385 > , it seems that we (I) > made it impossible for joiners to verify group creation at all. > > > > Regards, > > Eric > > ------------------------------ > *From:* Richard Barnes > *Sent:* Monday, August 10, 2020 5:22:47 PM > *To:* Cornelissen Eric > *Cc:* mls@ietf.org > *Subject:* Re: [MLS] Two poorly defined aspects of the spec > > Hi Eric, > > Thanks for the analysis here. More good finds. > > 1. I think the right answer is a little of both. If you initialize a > one-member group, before any Commit messages have been sent, then it should > be the zero-length octet string. But then as soon as the group is used for > something, it is updated. Maybe the way to clarify this is to fix the > indices. If we have the interim hash belong to the new epoch, then we > could have something like the following: > > interim_[0] = 0 > confirmed_[n] = Hash(interim_[n] || MLSPlaintextCommitContent_[n]); > interim_[n+1] = Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); > > > 1.a. BTW, this raises another issue: I had thought we had removed direct > dependencies on hash functions when we move from invoking HKDF to invoking > the KDF from HPKE. But this points out that we still have raw hash > invocations. I filed an issue for this: > > https://github.com/mlswg/mls-protocol/issues/386 > > FWIW, I think the latter course there is the right answer, i.e., to keep > the raw hash invocations and clarify that the ciphersuite specifies a hash > function. > > > 2. It seems like the right reference here is probably to the "secrets" > array in the Welcome message. There's one entry there for each member > being added, so if len(secrets) = len(group_info.tree.leaves) - 1, then > there was only one member in the group to start with. It's not strictly > true to say that this is a new creation, since one commit could remove all > but one of the members of the group and re-add a new set of members. But > this distinction doesn't really seem salient. > > > > On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric > wrote: > >> Hi All, >> >> >> I have two questions about things that are unclear to me in the current >> state of the spec as they are undefined/poorly defined. >> >> >> >> 1. What is the intended value of *interim_transcript_hash_**[0]*? >> >> From the current draft I cannot definitively (i.e. with 100% certainty) >> say whether the value of the first *interim_transcript_hash *should be: >> >> a. "the zero-length octet string" following the last line of Group state >> section >> >> , >> or >> b. a value derived based on the MLSPlaintextCommitAutData for the first >> commit concatenated with 0: >> interim_transcript_hash_[0] >> = Hash(confirmed_transcript_hash_[0] || >> MLSPlaintextCommitAuthData_[0]) >> = Hash(0 || MLSPlaintextCommitAuthData_[0]) >> >> The draft strongly suggests to me that it is the former, but the latter >> seems to more accurately reflect the statement "The >> *confirmed_transcript_hash* field contains a running hash over the >> messages that led to this state." >> >> In the case that *a* is correct I would suggest updating the definition >> of *interim_transcript_hash_**[n]* to: >> >> interim_transcript_hash_[0] = 0 >> interim_transcript_hash_[n] = >> Hash(confirmed_transcript_hash_[n] || >> MLSPlaintextCommitAuthData_[n]); >> >> In the case that *b* is correct I would suggest adding a "warning" that >> says something along the lines of "*as a placeholder value" *to the >> place(s) where the draft says that the *interim_transcript_hash* of a >> group is initialized to 0. >> >> >> 2. What is the `members` array mentioned in the Group creation section >> >> ? >> >> In that section it is stated that "A new member receiving a Welcome >> message can recognize group creation if the number of entries in the >> `members` array is equal to the number of leaves in the tree minus one." >> First of all, it is not clear what this `members` array is. It seems this >> refers to a field of the now-removed Init struct. Interestingly this struct >> was removed in the very same PR that added the above sentence (see #239 >> ). But I wasn't able to >> really figure out what the draft-09 equivalent of it should be. >> >> In addition, I'm pretty sure this technique would no longer work to >> detect group creation (but that would depend on how the sentence should be >> updated). >> >> >> Regards, >> Eric >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > --000000000000ba97eb05ac9ba41c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I filed #388 to fix (1) and (1a).

<= /div>

Not s= ure what to do with your observations about Welcome.=C2=A0 If you have thou= ghts about how to clarify, please send a PR!

--Ric= hard


On Tue, Aug 11, 2020 at 9:47 AM Corneliss= en Eric <eric.cornelissen@a= alto.fi> wrote:

Hi Richard,


1. In that case I would agree that clarifying the indices is the way to = go. I personally think just adding interim_[0] =3D 0 to the current definition would suffi= ce and be clearer than your suggestion here, but that's just personal t= aste.


2. The "secrets" array makes a ton of sense.


If the welcome is ignored when the verification fails, then the fact tha= t this is not strictly true seems to make it impossible to continue with a = group after all but one person left (unfortunately, the paragraph doe= sn't specify what should happen if the verification fails). This is not a cryptographic problem, bu= t I'd imagine this being confusing for end users if the application layer doesn't deal with it properly.


However, as I just pointed out in #385, it seems that we (I) made it impossible for joiner= s to verify group creation at all.



Regards,

Eric


From= : Richard Barnes <rlb@ipv.sx>
Sent: Monday, August 10, 2020 5:22:47 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
=C2=A0
Hi Eric,

Thanks for the analysis here.=C2=A0 More good finds.

1. I think the right answer is a little of both.=C2=A0 If you initiali= ze a one-member group, before any Commit messages have been sent, then it s= hould be the zero-length octet string.=C2=A0 But then as soon as the group = is used for something, it is updated.=C2=A0 Maybe the way to clarify this is to fix the indices.=C2=A0 If we have the interi= m hash belong to the new epoch, then we could have something like the follo= wing:

interim_[0] =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]);<= /div>
interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]= );


1.a. BTW, this raises another issue: I had thought we had removed dire= ct dependencies on hash functions when we move from invoking HKDF to invoki= ng the KDF from HPKE.=C2=A0 But this points out that we still have raw hash= invocations.=C2=A0 I filed an issue for this:

FWIW, I think the latter course there is the right answer, i.e., to ke= ep the raw hash invocations and clarify that the ciphersuite specifies a ha= sh function.


2. It seems like the right reference here is probably to the "sec= rets" array in the Welcome message.=C2=A0 There's one entry there = for each member being added, so if len(secrets) =3D len(group_info.tree.lea= ves) - 1, then there was only one member in the group to start with.=C2=A0 It's not strictly true to say that this is a new = creation, since one commit could remove all but one of the members of the g= roup and re-add a new set of members.=C2=A0 But this distinction doesn'= t really seem salient.



On Thu, Aug 6, 2020 at 6:02 AM Cornel= issen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1.=C2=A0What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0]
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0] =3D 0
=
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[n] =3D
    =C2=A0=C2=A0=C2=A0 Hash(confirmed_transcript_hash_[n] ||
        =C2=A0=C2=A0=C2=A0 MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the= draft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer = work to detect group creation (but that would depend on how the sentence sh= ould be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000ba97eb05ac9ba41c-- From nobody Tue Aug 11 08:33:44 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A564D3A111B for ; Tue, 11 Aug 2020 08:33:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id PVy2KQn0MS7e for ; Tue, 11 Aug 2020 08:33:41 -0700 (PDT) Received: from mail-qk1-x729.google.com (mail-qk1-x729.google.com [IPv6:2607:f8b0:4864:20::729]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C1C9C3A1109 for ; Tue, 11 Aug 2020 08:33:25 -0700 (PDT) Received: by mail-qk1-x729.google.com with SMTP id 62so346469qkj.7 for ; Tue, 11 Aug 2020 08:33:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:date:references :to:in-reply-to:message-id; bh=WTrM09xp+Ic48yX935n9+obViHqfjJx69rafrVMdKGo=; b=PCSFeg3/vUBOmQM7YpnODwEqUVFwGefbq8cqvJu7z1tO6LCIBiExonuAGVO22HzLAK l2PI3ugKPNgRe3UYubQk7PgnIv85OTSMxr1eat2AnlCHIN2y7CFpaK2UA38VSXSckaP3 Y0FO+oOunBrCZWNRogia/M2nbfEwDA0rpdkmw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:date:references:to:in-reply-to:message-id; bh=WTrM09xp+Ic48yX935n9+obViHqfjJx69rafrVMdKGo=; b=M1A5TbG1MWlsADkjx9vgAK7pS2/hEP8EWU0Mx5YUjrGGUi66fQNaNRkq1l2A7dnbRC GTlZ9rZTo1uu6zIgO/Z79nuJfG1/lJjYkFDPopSHmfGd1Ap4THly0vvyg0LZ8sK7WweS dduMdxijYsb/hDF5r5MZO/ZakbOVing6LXYAD/+TIR06fB3iVcBTi0u5JaJch/MnOtOT YDd4HTz232FKgFf2D3KxgBG1xLAur+AhFr1kqGPjeKlHOW2Yc12Gybn0JJ6B3Xi84v0v lU1zMdx4+Kdoqy93rY4CwK5y8nWaJEg8bpU7XIOc3YJbA6qie0oBq3Xv1QfQO2LCgxN8 q6VA== X-Gm-Message-State: AOAM5310yJG2ZXuTpchVMtLpKk/oFrhMXifDsM4rhGBPNVpo5j8qV8PW mOx5K6P4kt3Ub71r2yUMDeAplelGbNU= X-Google-Smtp-Source: ABdhPJz/yRpnYlMj+GEs/pPX1OmhuysAi6/Qkv3zxSDF2TIvtTc2LqAgl7mHkVLs5dO8v4DR2920Cg== X-Received: by 2002:a37:a28d:: with SMTP id l135mr1723676qke.247.1597160004075; Tue, 11 Aug 2020 08:33:24 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id d124sm18238284qkg.65.2020.08.11.08.33.22 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Aug 2020 08:33:23 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Date: Tue, 11 Aug 2020 11:33:21 -0400 References: To: MLS List In-Reply-To: Message-Id: <7AE1D70F-0636-4DE5-9EDB-61D62D04B61A@sn3rd.com> X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: Re: [MLS] 20200811 MLS WG Virtual Interim X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 15:33:43 -0000 Another reminder of the call in about 30min. spt > On Aug 9, 2020, at 22:23, Sean Turner wrote: >=20 > Just a reminder that we have a meeting scheduled for Tuesday. >=20 > spt >=20 >> On Aug 6, 2020, at 12:44, Sean Turner wrote: >>=20 >> Hi! We are having a virtual interim Tuesday 11 August 2020 at 1600 = UTC. Webex details can be found here: >> https://datatracker.ietf.org/meeting/interim-2020-mls-18/session/mls >> Our agenda is to address protocol related issues and PRs. Outstanding = Issues and PRs can be found here: >> https://github.com/mlswg/mls-protocol >>=20 >> Nick and Sean >=20 From nobody Tue Aug 11 12:53:47 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 90F103A0C0F for ; Tue, 11 Aug 2020 12:53:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2AMC8fOZ_35k for ; Tue, 11 Aug 2020 12:53:44 -0700 (PDT) Received: from mail-qt1-x832.google.com (mail-qt1-x832.google.com [IPv6:2607:f8b0:4864:20::832]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCA2C3A0B23 for ; Tue, 11 Aug 2020 12:53:43 -0700 (PDT) Received: by mail-qt1-x832.google.com with SMTP id 6so10415641qtt.0 for ; Tue, 11 Aug 2020 12:53:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=QYaS5aawPrXncI0HvWvt4CxSG8QpG4Nbzn/JpQVP7ok=; b=Cy8z2nqHk+JY9KuJKqRYcSbpqCt7WnDZXPowKbvSfL1CSuUG8MjjMiPK4VE2kcE5UE tkTyxNV2nFATRNm0DE7mP79oyRM1UH51dA9QzYnRQhdXMgt+ruy7bopMALddeopahzXB /yQyoWVuTCULXhp6iMXiSHPsCHaUjR+cAiryXb3U7Jx3GmUVuZ+t8NEMUZ59rJHALmN8 DhPNadDbvYyrQH1ipAqdIXB672PgiqmW9zhUWfe4c1wDUOv5xahGedEhBLzChmuwHCWG D6yP98+5z70TfO2FAcDDvbgXXQon++zQVmIaH+9d8bwlfyMSMpU9HpNUtOEsulwIeGG1 SdtA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=QYaS5aawPrXncI0HvWvt4CxSG8QpG4Nbzn/JpQVP7ok=; b=a1RLoD1MBRxCzco7v98QqsD15XFQfMwo9Ak0n/RTI9I5eeac4soUmtkmYRNFVveiIU hux928UvLgN6klNerrXrr6Ptvy7qhlfuvxmgBM878TvB77breOgNm6MNKBqHroe8tDpK IOj2KA/BCFiCmr6lf1Wmmm0RbAB/ZDXnZnmWwTtFVj24H/mKKLmgT6ZOUUc0stAY9avb 5Wq+I2qCaRI8rwPW6/Rp4oEZGNhfzXMfJm9QYWQv+iRZyIapgqTySuV3gL7yL6if3mHh 8KB5CM2pVH9PbgGSVgGxE9dHzfN6yxUcgbpQjj3zDs9tXgE7VMaCgiFnweyCaNpWwUNE 71DQ== X-Gm-Message-State: AOAM533EA3dcH/jLn8U9ul9HFIVXb15wHZYf5fM4M7usxkyetTfT+cgN AnPfPccw1TddLjinSTXTJZw8EMPiIwrA8n4ThMCG8g3Z4CvwfA== X-Google-Smtp-Source: ABdhPJy9Bbrmp29ViBEcq1s9vkmMitmoCqxNc1x22tmpRfCLd5vgsNbatNk1rUtdaTglaN6HheT0hZYNH16KzipsNFo= X-Received: by 2002:aed:2a11:: with SMTP id c17mr2785705qtd.84.1597175622581; Tue, 11 Aug 2020 12:53:42 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Richard Barnes Date: Tue, 11 Aug 2020 15:53:27 -0400 Message-ID: To: Brendan McMillion Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000a0d82105ac9f6d32" Archived-At: Subject: Re: [MLS] ChaChaX X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 11 Aug 2020 19:53:46 -0000 --000000000000a0d82105ac9f6d32 Content-Type: text/plain; charset="UTF-8" Ah, thanks. It seems like this is mainly a question of limits / how many ciphertext you can send within an epoch -- you get more reuse with longer nonces. Cf. https://tools.ietf.org/html/draft-wood-cfrg-aead-limits-00 Note also that this primarily mattes for sender data encryption. For content encryption, you're effectively using a fresh key *and* nonce each time, so you more space. --Richard On Mon, Aug 10, 2020 at 3:36 PM Brendan McMillion wrote: > Sorry, I suppose the real name is XChaCha and it's defined here: > https://tools.ietf.org/html/draft-irtf-cfrg-xchacha-01 > > XChaCha has a 24 byte nonce and is meant to be more suitable for randomly > generated nonces > > On Mon, Aug 10, 2020 at 12:31 PM Richard Barnes wrote: > >> Hey Brendan, >> >> I'm not sure I follow. Could you clarify what you mean by ChaChaX, and >> how it's different from base ChaCha? Where by "base ChaCha", I mean RFC >> 8439. >> >> https://tools.ietf.org/html/rfc8439 >> >> Thanks, >> --Richard >> >> On Mon, Aug 10, 2020 at 2:03 PM Brendan McMillion > 40cloudflare.com@dmarc.ietf.org> wrote: >> >>> Hello mls@ >>> >>> I wanted to quickly poll the list on a somewhat annoying issue. >>> Currently, every time we encrypt with our AEAD we use an unstructured >>> nonce: sender data encryption is properly random, while HPKE and message >>> encryption use the output of a KDF which is as good as random. Accordingly, >>> we should be using ChaChaX instead of ChaCha. >>> >>> Does everyone else agree? Should I open these PRs? >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls >>> >> --000000000000a0d82105ac9f6d32 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Ah, thanks.=C2=A0 It seems like this is mainly a ques= tion of limits / how many ciphertext you can send within an epoch -- you ge= t more reuse with longer nonces.=C2=A0 Cf. https://tools.ietf.org/html/draft-wo= od-cfrg-aead-limits-00

Note also that this pri= marily mattes for sender data encryption.=C2=A0 For content encryption, you= 're effectively using a fresh key *and* nonce each time, so you more sp= ace.

--Richard


<= div class=3D"gmail_quote">
On Mon, Aug= 10, 2020 at 3:36 PM Brendan McMillion <brendan@cloudflare.com> wrote:
Sorry, I suppose the= real name is XChaCha and it's defined here: https://tools.ie= tf.org/html/draft-irtf-cfrg-xchacha-01

XChaCha= has a 24 byte nonce and is meant to be more suitable for randomly generate= d nonces

On Mon, Aug 10, 2020 at 12:31 PM Richard Barnes <rlb@i= pv.sx> wrote:
Hey Brendan,

I'm not su= re I follow.=C2=A0 Could you clarify what you mean by ChaChaX, and how it&#= 39;s different from base ChaCha?=C2=A0 Where by "base ChaCha", I = mean RFC 8439.


_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000a0d82105ac9f6d32-- From nobody Sun Aug 16 00:41:32 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 38D103A083C for ; Sun, 16 Aug 2020 00:41:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=auz+g7Qv; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=oEfQ97RY Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id INFIc5Cv5Qz9 for ; Sun, 16 Aug 2020 00:41:25 -0700 (PDT) Received: from wout5-smtp.messagingengine.com (wout5-smtp.messagingengine.com [64.147.123.21]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 065113A083D for ; Sun, 16 Aug 2020 00:41:24 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id 615A8F57 for ; Sun, 16 Aug 2020 03:32:55 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Sun, 16 Aug 2020 03:32:55 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:from:to:subject:message-id:date; s= fm3; bh=NqykE3mf6+BtQ30yQEtSRWoopkdM59FqPI8y3w26Vck=; b=auz+g7Qv x2j47WafELxKve/gceR/kEkp8dwF4aQ+V/CJR+v52VmlhpKut+VEisThstf87aOa bZjkPWi7VaLDvebBT6nMeL4J6rs5sBvQcTRup9ql1rP9/IvKhbKqqrSADAfORBG3 SgdVl2A+p7a3C0YWpj18re9K8PUjId8tgn9mH9xRLWJs60cy2aQ4dPXcTGJvxsjN 1uN6/lMoalm4/WVBbWRX6N0Y4erY1m97BUvN8kOUwCweudbjLEFykFtqypRB9M8w xfUXD2wmb2tRPda7DdfieP4TYzG/JAEP8zhM0SroDUskySQ/grh40xrl0sna6vk3 dJJPwq58RvCjGg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=NqykE3mf6+BtQ30yQEtSRWoopkdM5 9FqPI8y3w26Vck=; b=oEfQ97RYxPgHkHKNy8koGqk46ldO/OtEX2nOXaIhrqq7O q2TYMOdB4bMrsyJmkQtGsXdQOrfQeKv6vJ0hZBH4P7znU5is+4NPXrATjunPGK6O ia0je/4CVSyCsoUewNth4mGWwZbGzaaeko4WOhC0VNZuwMXQL/HQPWZwoNHyGBWj eF6/LsL62ylCC8KAULaJT0rv7XUIc1odWrnK0mZCNRidP/G13Hnpyq5FINBQl9ME Mva4L/V7S8y6q9HxF7MkDZFrAx+pwIyoX4MfGtnCLAhhORH8EGJu4gEGtYa/msq5 uPDAa8khMdFOTOFqDAkjv3gDDWooM5OPbvF01MtLQ== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedruddttddguddukecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurheptggghffvufesrgdttdertddtje enucfhrhhomheptfgvphhoshhithhorhihucettghtihhvihhthicuufhumhhmrghrhicu uehothcuoeguohgpnhhothgprhgvphhlhiesmhhnohhtrdhnvghtqeenucggtffrrghtth gvrhhnpeekfedvudetjedvfeekheeiveeugfefhfetteevgeffkefffeetffdvleehudei teenucffohhmrghinhepghhithhhuhgsrdgtohhmnecukfhppeehvddrudehvddrvdefud drudefieenucevlhhushhtvghrufhiiigvpedvnecurfgrrhgrmhepmhgrihhlfhhrohhm peguohgpnhhothgprhgvphhlhiesmhhnohhtrdhnvght X-ME-Proxy: Received: from fv-az151.internal.cloudapp.net (unknown [52.152.231.136]) by mail.messagingengine.com (Postfix) with ESMTPA id C9BEE328005E for ; Sun, 16 Aug 2020 03:32:54 -0400 (EDT) Content-Type: multipart/alternative; boundary="===============2153663491103455664==" MIME-Version: 1.0 From: Repository Activity Summary Bot To: mls@ietf.org Message-Id: <20200816073254.C9BEE328005E@mailuser.nyi.internal> Date: Sun, 16 Aug 2020 03:32:54 -0400 (EDT) Archived-At: Subject: [MLS] Weekly github digest (MLS Working Group summary) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 16 Aug 2020 07:41:27 -0000 --===============2153663491103455664== MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Issues ------ * mlswg/mls-protocol (+3/-1/=F0=9F=92=AC1) 3 issues created: - Is the path secret used as PRK when doing Kdf.Expand? (by yihuang) https://github.com/mlswg/mls-protocol/issues/392=20 - impossible to verify the group creation process for the joiner without = knowing the random init_secret that the group creator used (by tomtau) https://github.com/mlswg/mls-protocol/issues/390=20 - Remove remaning raw Hash or add hash function to ciphersuite (by bifurc= ation) https://github.com/mlswg/mls-protocol/issues/386=20 1 issues received 1 new comments: - #386 Remove remaning raw Hash or add hash function to ciphersuite (1 by= ericcornelissen) https://github.com/mlswg/mls-protocol/issues/386=20 1 issues closed: - Remove remaning raw Hash or add hash function to ciphersuite https://gi= thub.com/mlswg/mls-protocol/issues/386=20 Pull requests ------------- * mlswg/mls-protocol (+6/-3/=F0=9F=92=AC6) 6 pull requests submitted: - Confirmation fix (by raphaelrobert) https://github.com/mlswg/mls-protocol/pull/394=20 - Application messages MUST be encrypted (by raphaelrobert) https://github.com/mlswg/mls-protocol/pull/393=20 - Rename DirectPath to UpdatePath (by chelseakomlo) https://github.com/mlswg/mls-protocol/pull/391=20 - 383: Enable Commit to cover new proposal types (by Bren2010) https://github.com/mlswg/mls-protocol/pull/389=20 - Clarify the transcript hash computation (by bifurcation) https://github.com/mlswg/mls-protocol/pull/388=20 - Make composite types 2^32 and make 0 invalid for enums (by Bren2010) https://github.com/mlswg/mls-protocol/pull/387=20 3 pull requests received 6 new comments: - #391 Rename DirectPath to UpdatePath (1 by Bren2010) https://github.com/mlswg/mls-protocol/pull/391=20 - #385 Require the initial init_secret to be a random value (3 by ericcor= nelissen, tomtau) https://github.com/mlswg/mls-protocol/pull/385=20 - #360 #302: Reduce encryption overhead to just auth tag (2 by Bren2010, = bifurcation) https://github.com/mlswg/mls-protocol/pull/360=20 3 pull requests merged: - Confirmation fix https://github.com/mlswg/mls-protocol/pull/394=20 - Make composite types 2^32 and make 0 invalid for enums https://github.com/mlswg/mls-protocol/pull/387=20 - Clarify the transcript hash computation https://github.com/mlswg/mls-protocol/pull/388=20 Repositories tracked by this digest: ----------------------------------- * https://github.com/mlswg/mls-architecture * https://github.com/mlswg/mls-protocol * https://github.com/mlswg/mls-federation --===============2153663491103455664== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Weekly github digest (MLS Working Group summary)

Sunday August 16, 2020

Issues

mlswg/mls-protocol (+3/-1/=F0=9F=92=AC1)

3 issues created:

1 issues received 1 new comments:

1 issues closed:

Pull requests

mlswg/mls-protocol (+6/-3/=F0=9F=92=AC6)

6 pull requests submitted:

3 pull requests received 6 new comments:

3 pull requests merged:

Repositories tracked by this digest:

--===============2153663491103455664==-- From nobody Tue Aug 18 07:27:23 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F2633A0B03 for ; Tue, 18 Aug 2020 07:27:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.096 X-Spam-Level: X-Spam-Status: No, score=-2.096 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UKR5b0fb2IlY for ; Tue, 18 Aug 2020 07:27:19 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 64DFE3A0B3B for ; Tue, 18 Aug 2020 07:27:16 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 8752A271673_F3BE540B; Tue, 18 Aug 2020 14:27:12 +0000 (GMT) Received: from exng2.org.aalto.fi (exng2.org.aalto.fi [130.233.223.21]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng2.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id D364E271634_F3BE53FF; Tue, 18 Aug 2020 14:27:11 +0000 (GMT) Received: from exng4.org.aalto.fi (130.233.223.23) by exng2.org.aalto.fi (130.233.223.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 18 Aug 2020 17:27:11 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Tue, 18 Aug 2020 17:27:11 +0300 From: Cornelissen Eric To: Richard Barnes CC: "mls@ietf.org" Thread-Topic: [MLS] Two poorly defined aspects of the spec Thread-Index: AQHWa9hzVoJJMfPk+kK5poDHTeMmXqkxOXWAgAG6Cor//+j8AIALIkv/ Date: Tue, 18 Aug 2020 14:27:11 +0000 Message-ID: <597d43a04e4947fb80a8fa6830f41a0d@aalto.fi> References: , In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_597d43a04e4947fb80a8fa6830f41a0daaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=h4OdWyoweKYICJ97sgqcoZvX7eclZXlf569b01FkHjg=; b=XY+S+Mj6wnNxPK7TfT/XIhc0hLXNeRFIVqr6OEHVMjxveBnaIiUHTDwjOsimo/7b/u/v+prLS4BpYErjM7c+WmuILkDE6cq4agz/SrvDdZCuVF3Lc/I0ltiYDg5ND1CWGlkX42G4mUWUluUB11+jGWVpo3ELmDGMXo51gAUNFoUsEaulIoOrDVyDqdNsdbUKxU78AxN6ngNXgKYsurr5+Fdm9whmJv3JCQ3GKry5lwht9DKu8pjV8iXVlHPOycoBtd3eF9e8VmG9gQN/8Lrc1t269+JIgy3QqY/bhmzn8Mrye8OFhM7obxSplgakEnXukTemCpRe6MI+T2VpJ8ooqw== Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 14:27:22 -0000 --_000_597d43a04e4947fb80a8fa6830f41a0daaltofi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks Richard Regarding my observations about Welcome. I would need some context about wh= ether or not we want joiners to verify group creation. (*) 1. We want to verify group creation. In this case, first of all, the changes in #385 need to be reverted (as pointe= d out in that thread and in #390). Then, to preven= t the attack for which that change was introduce I would propose the following: disallow the use of "add-onl= y" commits on group creation AND requiring the initial group member(s) to verify tha= t a "full" commit was used in the group creation. 2. We don't need to verify group creation. In this case the only thing (I think) that has to change is that the last= paragraph of the should be remove. (and #390 can be closed.) As I stated earlier, I would personally be in favor of option 2 as 1) it is= the simpler solution, 2) the existing method of detecting group creation i= s not foolproof (**), and 3) I don't see a reason to verify the group creat= ion process. In fact, a malicious client can always prevent joiners from be= ing able to do this verification by simply performing a separate commit bef= ore adding the actual group members (***). If you agree that 2 is the way to go, I'll get out a PR as soon as possible= . Regards, Eric (*): The git history isn't of much help here. As far as I can tell the grou= p creation verification paragraph was added in 5490d0e/2f2f5d8<= https://github.com/mlswg/mls-protocol/commit/2f2f5d813037f7cf3c3d0d78612bc5= 06f31eef5e>/#239. None of w= hich provide any insight into why the verification is useful. Perhaps this = was discussed in a meeting somewhere? (**): Nor do I think there exists any effective way of detecting group crea= tion. (***): In which case reverting #385 would only hurt th= e malicious client. ________________________________ From: Richard Barnes Sent: Tuesday, August 11, 2020 6:22:32 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec I filed #388 to fix (1) and (1a). https://github.com/mlswg/mls-protocol/pull/388 Not sure what to do with your observations about Welcome. If you have thou= ghts about how to clarify, please send a PR! --Richard On Tue, Aug 11, 2020 at 9:47 AM Cornelissen Eric > wrote: Hi Richard, 1. In that case I would agree that clarifying the indices is the way to go.= I personally think just adding interim_[0] =3D 0 to the current definition= would suffice and be clearer than your suggestion here, but that's just pe= rsonal taste. 2. The "secrets" array makes a ton of sense. If the welcome is ignored when the verification fails, then the fact that t= his is not strictly true seems to make it impossible to continue with a gro= up after all but one person left (unfortunately, the paragraph doesn't spec= ify what should happen if the verification fails). This is not a cryptograp= hic problem, but I'd imagine this being confusing for end users if the appl= ication layer doesn't deal with it properly. However, as I just pointed out in #385, it seems that we (I) made it impossible for joiners to verify = group creation at all. Regards, Eric ________________________________ From: Richard Barnes Sent: Monday, August 10, 2020 5:22:47 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec Hi Eric, Thanks for the analysis here. More good finds. 1. I think the right answer is a little of both. If you initialize a one-m= ember group, before any Commit messages have been sent, then it should be t= he zero-length octet string. But then as soon as the group is used for som= ething, it is updated. Maybe the way to clarify this is to fix the indices= . If we have the interim hash belong to the new epoch, then we could have = something like the following: interim_[0] =3D 0 confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]); interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); 1.a. BTW, this raises another issue: I had thought we had removed direct de= pendencies on hash functions when we move from invoking HKDF to invoking th= e KDF from HPKE. But this points out that we still have raw hash invocatio= ns. I filed an issue for this: https://github.com/mlswg/mls-protocol/issues/386 FWIW, I think the latter course there is the right answer, i.e., to keep th= e raw hash invocations and clarify that the ciphersuite specifies a hash fu= nction. 2. It seems like the right reference here is probably to the "secrets" arra= y in the Welcome message. There's one entry there for each member being ad= ded, so if len(secrets) =3D len(group_info.tree.leaves) - 1, then there was= only one member in the group to start with. It's not strictly true to say= that this is a new creation, since one commit could remove all but one of = the members of the group and re-add a new set of members. But this distinc= tion doesn't really seem salient. On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric > wrote: Hi All, I have two questions about things that are unclear to me in the current sta= te of the spec as they are undefined/poorly defined. 1. What is the intended value of interim_transcript_hash_[0]? >From the current draft I cannot definitively (i.e. with 100% certainty) say= whether the value of the first interim_transcript_hash should be: a. "the zero-length octet string" following the last line of Group state se= ction, or b. a value derived based on the MLSPlaintextCommitAutData for the first com= mit concatenated with 0: interim_transcript_hash_[0] =3D Hash(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthDat= a_[0]) =3D Hash(0 || MLSPlaintextCommitAuthData_[0]) The draft strongly suggests to me that it is the former, but the latter see= ms to more accurately reflect the statement "The confirmed_transcript_hash = field contains a running hash over the messages that led to this state." In the case that a is correct I would suggest updating the definition of in= terim_transcript_hash_[n] to: interim_transcript_hash_[0] =3D 0 interim_transcript_hash_[n] =3D Hash(confirmed_transcript_hash_[n] || MLSPlaintextCommitAuthData_[n]); In the case that b is correct I would suggest adding a "warning" that says = something along the lines of "as a placeholder value" to the place(s) where= the draft says that the interim_transcript_hash of a group is initialized = to 0. 2. What is the `members` array mentioned in the Group creation section? In that section it is stated that "A new member receiving a Welcome message= can recognize group creation if the number of entries in the `members` arr= ay is equal to the number of leaves in the tree minus one." First of all, i= t is not clear what this `members` array is. It seems this refers to a fiel= d of the now-removed Init struct. Interestingly this struct was removed in = the very same PR that added the above sentence (see #239). But I wasn't able to really figure out what= the draft-09 equivalent of it should be. In addition, I'm pretty sure this technique would no longer work to detect = group creation (but that would depend on how the sentence should be updated= ). Regards, Eric _______________________________________________ MLS mailing list MLS@ietf.org https://www.ietf.org/mailman/listinfo/mls --_000_597d43a04e4947fb80a8fa6830f41a0daaltofi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Thanks Richard

Regarding my observations abou= t Welcome. I would need some context about whether or not we want joiners t= o verify group creation. (*)

  1. We want to veri= fy group creation.

 
  In this case, first of all, the changes in #385 need to be reverted (a= s pointed
  out in that thread and in #390). Then, to prevent the attack = for which that change
  was introduce I would propose the following: disallow the use of &qu= ot;add-only" commits
  on group creation AND requiring the initial group member(s) to verif= y that a "full"
  commit was used in the group creation.

  2. We don't need to ver= ify group creation.

  In this case the only t= hing (I think) that has to change is that the last paragraph of
  the should be remove. (= and #390 can be closed.)


As I stated earlier, I would p= ersonally be in favor of option 2 as 1) it is the simpler solution, 2) the = existing method of detecting group creation is not foolproof (**), and 3) I= don't see a reason to verify the group creation process. In fact, a malicious client can always prevent joi= ners from being able to do this verification by simply performing a separat= e commit before adding the actual group members (***).


If you agree that 2 is the way= to go, I'll get out a PR as soon as possible.

Regards,
Eric


(*): The git history isn't of = much help here. As far as I can tell the group creation verification paragr= aph was added in 5490d0e/2f2f5d8/#239. None of which provide any insight into why the verification is useful. Per= haps this was discussed in a meeting somewhere?
(**): Nor do I think there exi= sts any effective way of detecting group creation.
(***): In which case reverting= #385 would only hurt the malicious = client.

From: Richard Barnes <rl= b@ipv.sx>
Sent: Tuesday, August 11, 2020 6:22:32 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
I filed #388 to fix (1) and (1a).


Not sure what to do with your observations about Welcome.  If you= have thoughts about how to clarify, please send a PR!

--Richard


On Tue, Aug 11, 2020 at 9:47 AM Corne= lissen Eric <eric.corneliss= en@aalto.fi> wrote:

Hi Richard,


1. In that case I would agree that clarifying the indices is the way to = go. I personally think just adding interim_[0] =3D 0 to the current definition would suffi= ce and be clearer than your suggestion here, but that's just personal taste= .


2. The "secrets" array makes a ton of sense.


If the welcome is ignored when the verification fails, then the fact tha= t this is not strictly true seems to make it impossible to continue with a = group after all but one person left (unfortunately, the paragraph doe= sn't specify what should happen if the verification fails). This is not a cryptographic problem, bu= t I'd imagine this being confusing for end users if the application layer doesn't deal with it properly.


However, as I just pointed out in #385, it seems that we (I) made it impossible for joiner= s to verify group creation at all.



Regards,

Eric


From= : Richard Barnes <rlb@ipv.sx>
Sent: Monday, August 10, 2020 5:22:47 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
Hi Eric,

Thanks for the analysis here.  More good finds.

1. I think the right answer is a little of both.  If you initiali= ze a one-member group, before any Commit messages have been sent, then it s= hould be the zero-length octet string.  But then as soon as the group = is used for something, it is updated.  Maybe the way to clarify this is to fix the indices.  If we have the interi= m hash belong to the new epoch, then we could have something like the follo= wing:

interim_[0] =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]);<= /div>
interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData= _[n]);


1.a. BTW, this raises another issue: I had thought we had removed dire= ct dependencies on hash functions when we move from invoking HKDF to invoki= ng the KDF from HPKE.  But this points out that we still have raw hash= invocations.  I filed an issue for this:

FWIW, I think the latter course there is the right answer, i.e., to ke= ep the raw hash invocations and clarify that the ciphersuite specifies a ha= sh function.


2. It seems like the right reference here is probably to the "sec= rets" array in the Welcome message.  There's one entry there for = each member being added, so if len(secrets) =3D len(group_info.tree.leaves)= - 1, then there was only one member in the group to start with.  It's not strictly true to say that this is a new crea= tion, since one commit could remove all but one of the members of the group= and re-add a new set of members.  But this distinction doesn't really= seem salient.



On Thu, Aug 6, 2020 at 6:02 AM Cornel= issen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1. What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
    interim_transcript_hash_[0]
        =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
        = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
    interim_transcript_hash_[0] =3D 0
=
    interim_transcript_hash_[n] =3D
        Hash(confirmed_transcript_hash_[n] ||
            MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the dra= ft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer work= to detect group creation (but that would depend on how the sentence should= be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--_000_597d43a04e4947fb80a8fa6830f41a0daaltofi_-- From nobody Tue Aug 18 07:36:23 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D889E3A0B4E for ; Tue, 18 Aug 2020 07:36:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HPl-oSviiQRN for ; Tue, 18 Aug 2020 07:36:18 -0700 (PDT) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5F58C3A0B79 for ; Tue, 18 Aug 2020 07:36:18 -0700 (PDT) Received: by mail-ed1-x52c.google.com with SMTP id a14so15445095edx.7 for ; Tue, 18 Aug 2020 07:36:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=from:subject:autocrypt:to:message-id:date:user-agent:mime-version :content-language:content-transfer-encoding; bh=AW79SmbYxYG2SFlgTcH1CvoT0vB1X1orO9Gy6/fbpCs=; b=05ZDuHWUYTwMNnf56gBHFXSBGds7km2OWGZqtJuxiQL04sQZ0EOdOGgJfWy7mpP7Zn Y57LsvhcIEsFI/H/+z4gX32b0BUf+vm2flLCLdlw4xhlYuy+0uEPysO08Qpx0Sm3bm01 Fe802xAr5hdXEDaeHrwP0SB/pJ9U7msYIjJidTNKTSwMSd87VtilQeEfHgg2TJ8g4vWO dP1wmCUW3Fanjz+pzU14kNHN2VDGwhCHqjGaaCQ9fVE8B6SYqwyl1G3G0OR+7jHllJjp o3xM30YCMwPzv4NsiG1PpL7IcAIMXvGGg/Jyh2t9/R9Wl2DrPr9HSVwmoB8byTI/tXOp mRww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:subject:autocrypt:to:message-id:date :user-agent:mime-version:content-language:content-transfer-encoding; bh=AW79SmbYxYG2SFlgTcH1CvoT0vB1X1orO9Gy6/fbpCs=; b=MYS1+MCc0NU/GXCEcCCgXFUQqt7rnO9FyUvhEmm4w4IIPXiZl20ROQKWapB4st0uep 3+OD7iYJqvMITiPHLC0BsuprHIaRHdSmdb9lw1XsV+F486LKQEyINtam68whbkBGaqXK uvooB8OHL3QHNHcRESICdN4ma5xFyLevtYmLs3Wdxa+L1022pyeTc/oz6nZ9AYXoiZDb X5fwhQcutGKNjZnOfwUaTzsa7r7U888Gle4WYcpSRZZg6ZTGmbSUNJZfEP/5OLHgaICw E6SogvE3UmqmJdSXJap0CHYTqTqXX+Dn4W2f6bdo97A7AvGrOwIvJIcg7G+A+ymoUN/U FFyQ== X-Gm-Message-State: AOAM532dwcS9T2bEaiw2CzCO1HKMZB41Djuljwjpobz1TDVC/6pmG3vk a6TqNvbZyLstTR73CK1RmACwSuN8gj72Nw== X-Google-Smtp-Source: ABdhPJzocSVKPWQxhK+WxENdv8AajYJQ6V0n2CX3GxSlWY5wUPNg2PVYHX11l7JscVaAVrbkuHt9Kw== X-Received: by 2002:a50:c089:: with SMTP id k9mr19557476edf.110.1597761376303; Tue, 18 Aug 2020 07:36:16 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id g25sm15647701edp.22.2020.08.18.07.36.15 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Aug 2020 07:36:15 -0700 (PDT) From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== To: Messaging Layer Security WG Message-ID: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> Date: Tue, 18 Aug 2020 16:36:15 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 14:36:20 -0000 Hey everyone, Something thats been bugging Marta Mularczyk and Daniel Jost and me for a bit now is that handshake messages sent out as MLSPlaintext packets are only authenticated using signatures, but not using the group's key schedule. For non-members that makes sense but for group members that's weaker than need be. Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt her to learn ssk. Now I loose access to her device again. Later she generates a fresh key package with her same spk but a new HPKE key for her leaf. She sends out and update proposal for her new key package and someone commits to the update. Expected result: she (and the group at large) has achieved PCS again. Actual result: using her stolen ssk I can still forge a new proposal's (sent as MLSPlaintext packets) coming from Alice. Some things I could do with this power: - I can generate a new key package kp for Alice using her spk and some HPKE key she doesn't know. Then I forge an update proposal for Alice with kp. If it gets committed I've effectively kicked her out of the group. - I could forge Add's and Remove's coming from Alice, so I could trick the group into thinking Alice is trying to Add my account to the group or remove some other group member. Lemme know if I've missed something here in that scenario... If I didn't miss anything and the attacks really work as advertised then IMO this is kinda weak sauce and worth avoiding if possible. So to that end, how about we modify MLS such that MLSPlaintext packets coming from group members must also be authenticated using something from the application key schedule. Now the above attacks fail. As soon as Alice's update is gets committed I no longer know the group's key schedule and so can't forged packet from Alice. More generally, this brings the PCS guarantees when using MLSPlaintexts frameing in line with what we're getting from MLSCiphertext packets. Any thoughts? - Joël PS. For concreteness, we could probably extend the current mechanism for getting concistancy (the confirmation_tag) to also provide symmetric key authentication. E.g. include most of the MLSPlaintext content into whats being tagged by confirmation_tag. That would cover the case of a commit packet and doesn't even grow the size of MLSPlaintext packets over the current design. For a proposal packet we could also have a confirmation_tag but this one is computed using the *current* epoch's confirmation_key and confirmed_transcript_hash. From nobody Tue Aug 18 07:40:37 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 43BD53A0BE3 for ; Tue, 18 Aug 2020 07:40:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Cybfcq7KzLvi for ; Tue, 18 Aug 2020 07:40:32 -0700 (PDT) Received: from mail-qv1-xf35.google.com (mail-qv1-xf35.google.com [IPv6:2607:f8b0:4864:20::f35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5417D3A0BD7 for ; Tue, 18 Aug 2020 07:40:32 -0700 (PDT) Received: by mail-qv1-xf35.google.com with SMTP id x7so9628058qvi.5 for ; Tue, 18 Aug 2020 07:40:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=OzE7jdt9nLbh+k95/ppyhu011K3/Q4vD81CpBCWZhFo=; b=cPhZ3hudr8+P0pbMf9huFTMHm7ojmR2hp0h/v/qpn6pvBEejFPrQu0RzgIj97WcB8G ceDMBWiJkfYZW8t+nhilFQpi0j9JgR85dYYDrf5nnYCq4m9lXgIS9cBgcfJhjL+Nt1jm P7x3+qrgcWUUXRZxDSEmSQAevNi1kn4hQGkfQdkRs9FpTC1ytdseUp2MWsJmt1qa7DZ0 0EG0PT+sE5CD8JJQIiiqivhHmfZn7wGIJeNGCUkXjc/WYzacwr21dZJT7UvsBVwMN7UN TqntbO4eNyOShCxNClTv3kmJsHIpoeAexH1UMeLnfzrgeEnuXoUL4gLsXxaG4dFTbiTs pD5Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=OzE7jdt9nLbh+k95/ppyhu011K3/Q4vD81CpBCWZhFo=; b=ic8vZUf6YJQtIuyKCiXvuLXws33MSTTO8plBvkRaO06IAuGDd9iB41CklWHMXefBR4 GMJeU5c9zdE/rvLChvxzVO38mry2L27TMeidNe832Inm1PAItF733JZRGQJJMKO5hNnW jvbPOYfxLwXhnmD/f9kBbVcKpvchATF82qtEXmyrX+iHXFdhRYgJ31BCjzVkNN2mxb+B H0RKCi18VmSgCZ8nJdDZvRr5tE7Wn93FaGCnYEWvDfCzHmAvwsI+52maMSYdj8cgJGJd mS6S9xrl9fSGthwkzA9+LPXwk/5MlZzmsw0q8fxFFyjXEyAnC/+KvCoxg9elShSxsU/Q OAMA== X-Gm-Message-State: AOAM532a6aeM41nmCGd9ahMfzZH0Xga9QWqfOyyrPJ6efF3kYhDTsMoE rpVBGSyr+HCi3BNKblhMkRETJHZcalDnToqnjzaT8A== X-Google-Smtp-Source: ABdhPJwNDZYjMx97gWhuWP9HNzbtITvE3MDDel5bA1rJE8YujqN1AzKF5WWu+1gspWcEXr2pHBNtMoDUqPMQNQxOoac= X-Received: by 2002:ad4:44f2:: with SMTP id p18mr19222259qvt.137.1597761631028; Tue, 18 Aug 2020 07:40:31 -0700 (PDT) MIME-Version: 1.0 References: <597d43a04e4947fb80a8fa6830f41a0d@aalto.fi> In-Reply-To: <597d43a04e4947fb80a8fa6830f41a0d@aalto.fi> From: Richard Barnes Date: Tue, 18 Aug 2020 10:40:10 -0400 Message-ID: To: Cornelissen Eric Cc: "mls@ietf.org" Content-Type: multipart/alternative; boundary="000000000000741e3905ad27de03" Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 14:40:35 -0000 --000000000000741e3905ad27de03 Content-Type: text/plain; charset="UTF-8" Hi Eric, I agree with (2). I think the stuff that's in the spec right now about verifying group creation is mainly just a legacy of the fact that we used to have separate Init and Add operations. When those got coalesced into Welcome, it must have seemed appealing to enable recipients to continue to distinguish the cases. But as you point out, that's not really tenable. So please feel free to send a PR! Thanks, --Richard On Tue, Aug 18, 2020 at 10:27 AM Cornelissen Eric wrote: > Thanks Richard > > Regarding my observations about Welcome. I would need some context about > whether or not we want joiners to verify group creation. (*) > > 1. We want to verify group creation. > > > In this case, first of all, the changes in > #385 > > need to be reverted (as > pointed > out in that thread and in #390 > > ). Then, to prevent the > attack for which that change > was introduce I would propose the following: disallow the use of > "add-only" commits > on group creation AND requiring the initial group member(s) to verify > that a "full" > commit was used in the group creation. > > 2. We don't need to verify group creation. > > In this case the only thing (I think) that has to change is that the > last paragraph of > the should be remove. (and #390 > can be closed.) > > > As I stated earlier, I would personally be in favor of option 2 as 1) it > is the simpler solution, 2) the existing method of detecting group creation > is not foolproof (**), and 3) I don't see a reason to verify the group > creation process. In fact, a malicious client can always prevent joiners > from being able to do this verification by simply performing a separate > commit before adding the actual group members (***). > > > If you agree that 2 is the way to go, I'll get out a PR as soon as > possible. > > Regards, > Eric > > > (*): The git history isn't of much help here. As far as I can tell the > group creation verification paragraph was added in 5490d0e > > /2f2f5d8 > > /#239 . None of which > provide any insight into why the verification is useful. Perhaps this was > discussed in a meeting somewhere? > (**): Nor do I think there exists any effective way of detecting group > creation. > (***): In which case reverting #385 > > would only hurt the > malicious client. > > ------------------------------ > *From:* Richard Barnes > *Sent:* Tuesday, August 11, 2020 6:22:32 PM > *To:* Cornelissen Eric > *Cc:* mls@ietf.org > *Subject:* Re: [MLS] Two poorly defined aspects of the spec > > I filed #388 to fix (1) and (1a). > > https://github.com/mlswg/mls-protocol/pull/388 > > Not sure what to do with your observations about Welcome. If you have > thoughts about how to clarify, please send a PR! > > --Richard > > > On Tue, Aug 11, 2020 at 9:47 AM Cornelissen Eric < > eric.cornelissen@aalto.fi> wrote: > >> Hi Richard, >> >> >> 1. In that case I would agree that clarifying the indices is the way to >> go. I personally think just adding *interim_[0] = 0* to the current >> definition would suffice and be clearer than your suggestion here, but >> that's just personal taste. >> >> >> 2. The "secrets" array makes a ton of sense. >> >> >> If the welcome is ignored when the verification fails, then the fact that >> this is not strictly true seems to make it impossible to continue with a >> group after all but one person left (unfortunately, the paragraph >> doesn't specify what should happen if the verification fails). This is >> not a cryptographic problem, but I'd imagine this being confusing for end >> users *if* the application layer doesn't deal with it properly. >> >> >> However, as I just pointed out in #385 >> , it seems that we (I) >> made it impossible for joiners to verify group creation at all. >> >> >> >> Regards, >> >> Eric >> >> ------------------------------ >> *From:* Richard Barnes >> *Sent:* Monday, August 10, 2020 5:22:47 PM >> *To:* Cornelissen Eric >> *Cc:* mls@ietf.org >> *Subject:* Re: [MLS] Two poorly defined aspects of the spec >> >> Hi Eric, >> >> Thanks for the analysis here. More good finds. >> >> 1. I think the right answer is a little of both. If you initialize a >> one-member group, before any Commit messages have been sent, then it should >> be the zero-length octet string. But then as soon as the group is used for >> something, it is updated. Maybe the way to clarify this is to fix the >> indices. If we have the interim hash belong to the new epoch, then we >> could have something like the following: >> >> interim_[0] = 0 >> confirmed_[n] = Hash(interim_[n] || MLSPlaintextCommitContent_[n]); >> interim_[n+1] = Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); >> >> >> 1.a. BTW, this raises another issue: I had thought we had removed direct >> dependencies on hash functions when we move from invoking HKDF to invoking >> the KDF from HPKE. But this points out that we still have raw hash >> invocations. I filed an issue for this: >> >> https://github.com/mlswg/mls-protocol/issues/386 >> >> FWIW, I think the latter course there is the right answer, i.e., to keep >> the raw hash invocations and clarify that the ciphersuite specifies a hash >> function. >> >> >> 2. It seems like the right reference here is probably to the "secrets" >> array in the Welcome message. There's one entry there for each member >> being added, so if len(secrets) = len(group_info.tree.leaves) - 1, then >> there was only one member in the group to start with. It's not strictly >> true to say that this is a new creation, since one commit could remove all >> but one of the members of the group and re-add a new set of members. But >> this distinction doesn't really seem salient. >> >> >> >> On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric < >> eric.cornelissen@aalto.fi> wrote: >> >>> Hi All, >>> >>> >>> I have two questions about things that are unclear to me in the current >>> state of the spec as they are undefined/poorly defined. >>> >>> >>> >>> 1. What is the intended value of *interim_transcript_hash_**[0]*? >>> >>> From the current draft I cannot definitively (i.e. with 100% certainty) >>> say whether the value of the first *interim_transcript_hash *should be: >>> >>> a. "the zero-length octet string" following the last line of Group >>> state section >>> >>> , >>> or >>> b. a value derived based on the MLSPlaintextCommitAutData for the first >>> commit concatenated with 0: >>> interim_transcript_hash_[0] >>> = Hash(confirmed_transcript_hash_[0] || >>> MLSPlaintextCommitAuthData_[0]) >>> = Hash(0 || MLSPlaintextCommitAuthData_[0]) >>> >>> The draft strongly suggests to me that it is the former, but the latter >>> seems to more accurately reflect the statement "The >>> *confirmed_transcript_hash* field contains a running hash over the >>> messages that led to this state." >>> >>> In the case that *a* is correct I would suggest updating the definition >>> of *interim_transcript_hash_**[n]* to: >>> >>> interim_transcript_hash_[0] = 0 >>> interim_transcript_hash_[n] = >>> Hash(confirmed_transcript_hash_[n] || >>> MLSPlaintextCommitAuthData_[n]); >>> >>> In the case that *b* is correct I would suggest adding a "warning" that >>> says something along the lines of "*as a placeholder value" *to the >>> place(s) where the draft says that the *interim_transcript_hash* of a >>> group is initialized to 0. >>> >>> >>> 2. What is the `members` array mentioned in the Group creation section >>> >>> ? >>> >>> In that section it is stated that "A new member receiving a Welcome >>> message can recognize group creation if the number of entries in the >>> `members` array is equal to the number of leaves in the tree minus one." >>> First of all, it is not clear what this `members` array is. It seems this >>> refers to a field of the now-removed Init struct. Interestingly this struct >>> was removed in the very same PR that added the above sentence (see #239 >>> ). But I wasn't able to >>> really figure out what the draft-09 equivalent of it should be. >>> >>> In addition, I'm pretty sure this technique would no longer work to >>> detect group creation (but that would depend on how the sentence should be >>> updated). >>> >>> >>> Regards, >>> Eric >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls >>> >> --000000000000741e3905ad27de03 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi Eric,

I agree with (2).= =C2=A0 I think the stuff that's in the spec right now about verifying g= roup creation is mainly just a legacy of the fact that we used to have sepa= rate Init and Add operations.=C2=A0 When those got coalesced into Welcome, = it must have seemed appealing to enable recipients to continue to distingui= sh the cases.=C2=A0 But as you point out, that's not really tenable.

So please feel free to send a PR!

Thanks,
--Richard

On Tue, Aug 18, 2020 at 10:27 A= M Cornelissen Eric <eric.co= rnelissen@aalto.fi> wrote:

Thanks Richard

Regarding my observations a= bout Welcome. I would need some context about whether or not we want joiner= s to verify group creation. (*)

=C2=A0 1.=C2=A0We want to v= erify group creation.

=C2=A0
=C2=A0 In this case, first of all, the changes in #385 need to be reverted (as po= inted
=C2=A0 out in that thread and in #390). Then, to prevent the attack = for which that change
=C2=A0 was introduce I would propose the following: disallow the use of &qu= ot;add-only" commits
=C2=A0 on group creation AND requiring the initial group member(s) to verif= y that a "full"
=C2=A0 commit was used in the group creation.

=C2=A0 2. We don't need= to verify group creation.

=C2=A0 In this case the onl= y thing (I think) that has to change is that the last paragraph of
=C2=A0 the should be remove= . (and #390 can be closed.)


As I stated earlier, I woul= d personally be in favor of option 2 as 1) it is the simpler solution, 2) t= he existing method of detecting group creation is not foolproof (**), and 3= ) I don't see a reason to verify the group creation process. In fact, a malicious client can always prevent joi= ners from being able to do this verification by simply performing a separat= e commit before adding the actual group members (***).


If you agree that 2 is the = way to go, I'll get out a PR as soon as possible.

Regards,
Eric


(*): The git history isn= 9;t of much help here. As far as I can tell the group creation verification= paragraph was added in 5490d0e/2f2f5d8/#239. None of which provide any insight into why the verification is useful. Per= haps this was discussed in a meeting somewhere?
(**): Nor do I think there = exists any effective way of detecting group creation.
(***): In which case revert= ing #385 would only hurt the malicious cl= ient.

Fro= m: Richard Barnes <rlb@ipv.sx>
Sent: Tuesday, August 11, 2020 6:22:32 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
=C2=A0
I filed #388 to fix (1) and (1a).

Not sure what to do with your observations about Welcome.=C2=A0 If you= have thoughts about how to clarify, please send a PR!

--Richard


On Tue, Aug 11, 2020 at 9:47 AM Corne= lissen Eric <eric.cornelissen@aalto.fi> wrote:

Hi Richard,


1. In that case I would agree that clarifying the indices is the way to = go. I personally think just adding interim_[0] =3D 0 to the current definition would suffi= ce and be clearer than your suggestion here, but that's just personal t= aste.


2. The "secrets" array makes a ton of sense.


If the welcome is ignored when the verification fails, then the fact tha= t this is not strictly true seems to make it impossible to continue with a = group after all but one person left (unfortunately, the paragraph doe= sn't specify what should happen if the verification fails). This is not a cryptographic problem, bu= t I'd imagine this being confusing for end users if the application layer doesn't deal with it properly.


However, as I just pointed out in #385, it seems that we (I) made it impossible for joiner= s to verify group creation at all.



Regards,

Eric


From: Richard Barnes <rlb@ipv.sx>
Sent: Monday, August 10, 2020 5:22:47 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
=C2=A0
Hi Eric,

Thanks for the analysis here.=C2=A0 More good finds.

1. I think the right answer is a little of both.=C2=A0 If you initiali= ze a one-member group, before any Commit messages have been sent, then it s= hould be the zero-length octet string.=C2=A0 But then as soon as the group = is used for something, it is updated.=C2=A0 Maybe the way to clarify this is to fix the indices.=C2=A0 If we have the interi= m hash belong to the new epoch, then we could have something like the follo= wing:

interim_[0] =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]);<= /div>
interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]= );


1.a. BTW, this raises another issue: I had thought we had removed dire= ct dependencies on hash functions when we move from invoking HKDF to invoki= ng the KDF from HPKE.=C2=A0 But this points out that we still have raw hash= invocations.=C2=A0 I filed an issue for this:

FWIW, I think the latter course there is the right answer, i.e., to ke= ep the raw hash invocations and clarify that the ciphersuite specifies a ha= sh function.


2. It seems like the right reference here is probably to the "sec= rets" array in the Welcome message.=C2=A0 There's one entry there = for each member being added, so if len(secrets) =3D len(group_info.tree.lea= ves) - 1, then there was only one member in the group to start with.=C2=A0 It's not strictly true to say that this is a new = creation, since one commit could remove all but one of the members of the g= roup and re-add a new set of members.=C2=A0 But this distinction doesn'= t really seem salient.



On Thu, Aug 6, 2020 at 6:02 AM Cornel= issen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1.=C2=A0What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0]
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
=C2=A0=C2=A0=C2=A0 =C2=A0=C2=A0=C2=A0 = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[0] =3D 0
=
=C2=A0=C2=A0=C2=A0 interim_transcript_hash_[n] =3D
    =C2=A0=C2=A0=C2=A0 Hash(confirmed_transcript_hash_[n] ||
        =C2=A0=C2=A0=C2=A0 MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the= draft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer = work to detect group creation (but that would depend on how the sentence sh= ould be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000741e3905ad27de03-- From nobody Tue Aug 18 07:48:36 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D30DE3A0BB1 for ; Tue, 18 Aug 2020 07:48:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id opYloc2gXFLe for ; Tue, 18 Aug 2020 07:48:30 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 655933A0BB6 for ; Tue, 18 Aug 2020 07:48:30 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 82CB311569E_F3BEA3AB; Tue, 18 Aug 2020 14:48:26 +0000 (GMT) Received: from exng1.org.aalto.fi (exng1.org.aalto.fi [130.233.223.20]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng1.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 08A4111552D_F3BEA3AF; Tue, 18 Aug 2020 14:48:26 +0000 (GMT) Received: from exng8.org.aalto.fi (130.233.223.27) by exng1.org.aalto.fi (130.233.223.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 18 Aug 2020 17:48:25 +0300 Received: from exng4.org.aalto.fi (130.233.223.23) by exng8.org.aalto.fi (130.233.223.27) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Tue, 18 Aug 2020 17:48:25 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Tue, 18 Aug 2020 17:48:25 +0300 From: Cornelissen Eric To: Richard Barnes CC: "mls@ietf.org" Thread-Topic: [MLS] Two poorly defined aspects of the spec Thread-Index: AQHWa9hzVoJJMfPk+kK5poDHTeMmXqkxOXWAgAG6Cor//+j8AIALIkv////SMACAADQ0nw== Date: Tue, 18 Aug 2020 14:48:25 +0000 Message-ID: <3d4e1be7bfd94853a13222dacee078cd@aalto.fi> References: <597d43a04e4947fb80a8fa6830f41a0d@aalto.fi>, In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_3d4e1be7bfd94853a13222dacee078cdaaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=MN0qvWcW7cdVieUFmRU+cIPNB8ZydAG4mu4DyfZ66lU=; b=q9UY/9z14lyavgLfOhyzPh0PLbzvRorRDM9b5pCz3wYH+hXUm6UOt3LwVbphWd6y1o/FyWIUeJfQ9lF0RPKsLHjBAIW+08R6CaHww2OluoF1lXAsALLnLQadqkz13oVtJQsrfGZurVFel+cTRFr5CYgOh1XXjHBa9QwMfbo2I6FPqmFViZNWH5cMxzBJkPpknBeIEIVUMENVbPZLk97ZVklcEbAgRrCFBHszLEgKqkieos7CHjoapOO3F9/gGkYoJpQv5PluUyMLPouOEX99F+vQ89kqwskXzD5Blh455Q3RoYB/612yGPf8zmqdq7sDvgTqGatsoJWTeHWcdMbecA== Archived-At: Subject: Re: [MLS] Two poorly defined aspects of the spec X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 14:48:34 -0000 --_000_3d4e1be7bfd94853a13222dacee078cdaaltofi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Richard, Thanks for the confirmation. I submitted a PR for this at https://github.co= m/mlswg/mls-protocol/pull/395. Regards, Eric ________________________________ From: Richard Barnes Sent: Tuesday, August 18, 2020 5:40:10 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec Hi Eric, I agree with (2). I think the stuff that's in the spec right now about ver= ifying group creation is mainly just a legacy of the fact that we used to h= ave separate Init and Add operations. When those got coalesced into Welcom= e, it must have seemed appealing to enable recipients to continue to distin= guish the cases. But as you point out, that's not really tenable. So please feel free to send a PR! Thanks, --Richard On Tue, Aug 18, 2020 at 10:27 AM Cornelissen Eric > wrote: Thanks Richard Regarding my observations about Welcome. I would need some context about wh= ether or not we want joiners to verify group creation. (*) 1. We want to verify group creation. In this case, first of all, the changes in #385 need to be reverted (as pointe= d out in that thread and in #390). Then, to preven= t the attack for which that change was introduce I would propose the following: disallow the use of "add-onl= y" commits on group creation AND requiring the initial group member(s) to verify tha= t a "full" commit was used in the group creation. 2. We don't need to verify group creation. In this case the only thing (I think) that has to change is that the last= paragraph of the should be remove. (and #390 can be closed.) As I stated earlier, I would personally be in favor of option 2 as 1) it is= the simpler solution, 2) the existing method of detecting group creation i= s not foolproof (**), and 3) I don't see a reason to verify the group creat= ion process. In fact, a malicious client can always prevent joiners from be= ing able to do this verification by simply performing a separate commit bef= ore adding the actual group members (***). If you agree that 2 is the way to go, I'll get out a PR as soon as possible= . Regards, Eric (*): The git history isn't of much help here. As far as I can tell the grou= p creation verification paragraph was added in 5490d0e/2f2f5d8<= https://github.com/mlswg/mls-protocol/commit/2f2f5d813037f7cf3c3d0d78612bc5= 06f31eef5e>/#239. None of w= hich provide any insight into why the verification is useful. Perhaps this = was discussed in a meeting somewhere? (**): Nor do I think there exists any effective way of detecting group crea= tion. (***): In which case reverting #385 would only hurt th= e malicious client. ________________________________ From: Richard Barnes Sent: Tuesday, August 11, 2020 6:22:32 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec I filed #388 to fix (1) and (1a). https://github.com/mlswg/mls-protocol/pull/388 Not sure what to do with your observations about Welcome. If you have thou= ghts about how to clarify, please send a PR! --Richard On Tue, Aug 11, 2020 at 9:47 AM Cornelissen Eric > wrote: Hi Richard, 1. In that case I would agree that clarifying the indices is the way to go.= I personally think just adding interim_[0] =3D 0 to the current definition= would suffice and be clearer than your suggestion here, but that's just pe= rsonal taste. 2. The "secrets" array makes a ton of sense. If the welcome is ignored when the verification fails, then the fact that t= his is not strictly true seems to make it impossible to continue with a gro= up after all but one person left (unfortunately, the paragraph doesn't spec= ify what should happen if the verification fails). This is not a cryptograp= hic problem, but I'd imagine this being confusing for end users if the appl= ication layer doesn't deal with it properly. However, as I just pointed out in #385, it seems that we (I) made it impossible for joiners to verify = group creation at all. Regards, Eric ________________________________ From: Richard Barnes Sent: Monday, August 10, 2020 5:22:47 PM To: Cornelissen Eric Cc: mls@ietf.org Subject: Re: [MLS] Two poorly defined aspects of the spec Hi Eric, Thanks for the analysis here. More good finds. 1. I think the right answer is a little of both. If you initialize a one-m= ember group, before any Commit messages have been sent, then it should be t= he zero-length octet string. But then as soon as the group is used for som= ething, it is updated. Maybe the way to clarify this is to fix the indices= . If we have the interim hash belong to the new epoch, then we could have = something like the following: interim_[0] =3D 0 confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]); interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData_[n]); 1.a. BTW, this raises another issue: I had thought we had removed direct de= pendencies on hash functions when we move from invoking HKDF to invoking th= e KDF from HPKE. But this points out that we still have raw hash invocatio= ns. I filed an issue for this: https://github.com/mlswg/mls-protocol/issues/386 FWIW, I think the latter course there is the right answer, i.e., to keep th= e raw hash invocations and clarify that the ciphersuite specifies a hash fu= nction. 2. It seems like the right reference here is probably to the "secrets" arra= y in the Welcome message. There's one entry there for each member being ad= ded, so if len(secrets) =3D len(group_info.tree.leaves) - 1, then there was= only one member in the group to start with. It's not strictly true to say= that this is a new creation, since one commit could remove all but one of = the members of the group and re-add a new set of members. But this distinc= tion doesn't really seem salient. On Thu, Aug 6, 2020 at 6:02 AM Cornelissen Eric > wrote: Hi All, I have two questions about things that are unclear to me in the current sta= te of the spec as they are undefined/poorly defined. 1. What is the intended value of interim_transcript_hash_[0]? >From the current draft I cannot definitively (i.e. with 100% certainty) say= whether the value of the first interim_transcript_hash should be: a. "the zero-length octet string" following the last line of Group state se= ction, or b. a value derived based on the MLSPlaintextCommitAutData for the first com= mit concatenated with 0: interim_transcript_hash_[0] =3D Hash(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthDat= a_[0]) =3D Hash(0 || MLSPlaintextCommitAuthData_[0]) The draft strongly suggests to me that it is the former, but the latter see= ms to more accurately reflect the statement "The confirmed_transcript_hash = field contains a running hash over the messages that led to this state." In the case that a is correct I would suggest updating the definition of in= terim_transcript_hash_[n] to: interim_transcript_hash_[0] =3D 0 interim_transcript_hash_[n] =3D Hash(confirmed_transcript_hash_[n] || MLSPlaintextCommitAuthData_[n]); In the case that b is correct I would suggest adding a "warning" that says = something along the lines of "as a placeholder value" to the place(s) where= the draft says that the interim_transcript_hash of a group is initialized = to 0. 2. What is the `members` array mentioned in the Group creation section? In that section it is stated that "A new member receiving a Welcome message= can recognize group creation if the number of entries in the `members` arr= ay is equal to the number of leaves in the tree minus one." First of all, i= t is not clear what this `members` array is. It seems this refers to a fiel= d of the now-removed Init struct. Interestingly this struct was removed in = the very same PR that added the above sentence (see #239). But I wasn't able to really figure out what= the draft-09 equivalent of it should be. In addition, I'm pretty sure this technique would no longer work to detect = group creation (but that would depend on how the sentence should be updated= ). Regards, Eric _______________________________________________ MLS mailing list MLS@ietf.org https://www.ietf.org/mailman/listinfo/mls --_000_3d4e1be7bfd94853a13222dacee078cdaaltofi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi Richard,


Thanks for the confirmation. I submitted a PR for this at https://github.com/mlswg/mls-protocol/pull/395.


Regards,

Eric

From: Richard Barnes <rl= b@ipv.sx>
Sent: Tuesday, August 18, 2020 5:40:10 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
Hi Eric,

I agree with (2).  I think the stuff that's in the spec right now= about verifying group creation is mainly just a legacy of the fact that we= used to have separate Init and Add operations.  When those got coales= ced into Welcome, it must have seemed appealing to enable recipients to continue to distinguish the cases.  But as yo= u point out, that's not really tenable.

So please feel free to send a PR!

Thanks,
--Richard

On Tue, Aug 18, 2020 at 10:27 AM Corn= elissen Eric <eric.cornelis= sen@aalto.fi> wrote:

Thanks Richard

Regarding my observations a= bout Welcome. I would need some context about whether or not we want joiner= s to verify group creation. (*)

  1. We want to v= erify group creation.

 
  In this case, first of all, the changes in #385 need to be reverted (as po= inted
  out in that thread and in #390). Then, to prevent the attack = for which that change
  was introduce I would propose the following: disallow the use of &qu= ot;add-only" commits
  on group creation AND requiring the initial group member(s) to verif= y that a "full"
  commit was used in the group creation.

  2. We don't need to = verify group creation.

  In this case the onl= y thing (I think) that has to change is that the last paragraph of
  the should be remove= . (and #390 can be closed.)


As I stated earlier, I woul= d personally be in favor of option 2 as 1) it is the simpler solution, 2) t= he existing method of detecting group creation is not foolproof (**), and 3= ) I don't see a reason to verify the group creation process. In fact, a malicious client can always prevent joi= ners from being able to do this verification by simply performing a separat= e commit before adding the actual group members (***).


If you agree that 2 is the = way to go, I'll get out a PR as soon as possible.

Regards,
Eric


(*): The git history isn't = of much help here. As far as I can tell the group creation verification par= agraph was added in 5490d0e/2f2f5d8/#239. None of which provide any insight into why the verification is useful. Per= haps this was discussed in a meeting somewhere?
(**): Nor do I think there = exists any effective way of detecting group creation.
(***): In which case revert= ing #385 would only hurt the malicious cl= ient.

Fro= m: Richard Barnes <rlb@ipv.sx>
Sent: Tuesday, August 11, 2020 6:22:32 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
I filed #388 to fix (1) and (1a).

Not sure what to do with your observations about Welcome.  If you= have thoughts about how to clarify, please send a PR!

--Richard


On Tue, Aug 11, 2020 at 9:47 AM Corne= lissen Eric <eric.cornelissen@aalto.fi> wrote:

Hi Richard,


1. In that case I would agree that clarifying the indices is the way to = go. I personally think just adding interim_[0] =3D 0 to the current definition would suffi= ce and be clearer than your suggestion here, but that's just personal taste= .


2. The "secrets" array makes a ton of sense.


If the welcome is ignored when the verification fails, then the fact tha= t this is not strictly true seems to make it impossible to continue with a = group after all but one person left (unfortunately, the paragraph doe= sn't specify what should happen if the verification fails). This is not a cryptographic problem, bu= t I'd imagine this being confusing for end users if the application layer doesn't deal with it properly.


However, as I just pointed out in #385, it seems that we (I) made it impossible for joiner= s to verify group creation at all.



Regards,

Eric


From: Richard Barnes <rlb@ipv.sx>
Sent: Monday, August 10, 2020 5:22:47 PM
To: Cornelissen Eric
Cc: mls@ietf.org
Subject: Re: [MLS] Two poorly defined aspects of the spec
 
Hi Eric,

Thanks for the analysis here.  More good finds.

1. I think the right answer is a little of both.  If you initiali= ze a one-member group, before any Commit messages have been sent, then it s= hould be the zero-length octet string.  But then as soon as the group = is used for something, it is updated.  Maybe the way to clarify this is to fix the indices.  If we have the interi= m hash belong to the new epoch, then we could have something like the follo= wing:

interim_[0] =3D 0
confirmed_[n] =3D Hash(interim_[n] || MLSPlaintextCommitContent_[n]);<= /div>
interim_[n+1] =3D Hash(confirmed_[n] || MLSPlaintextCommitAuthData= _[n]);


1.a. BTW, this raises another issue: I had thought we had removed dire= ct dependencies on hash functions when we move from invoking HKDF to invoki= ng the KDF from HPKE.  But this points out that we still have raw hash= invocations.  I filed an issue for this:

FWIW, I think the latter course there is the right answer, i.e., to ke= ep the raw hash invocations and clarify that the ciphersuite specifies a ha= sh function.


2. It seems like the right reference here is probably to the "sec= rets" array in the Welcome message.  There's one entry there for = each member being added, so if len(secrets) =3D len(group_info.tree.leaves)= - 1, then there was only one member in the group to start with.  It's not strictly true to say that this is a new crea= tion, since one commit could remove all but one of the members of the group= and re-add a new set of members.  But this distinction doesn't really= seem salient.



On Thu, Aug 6, 2020 at 6:02 AM Cornel= issen Eric <eric.cornelissen@aalto.fi> wrote:

Hi All,


I have two questions about things that are unclear to me in the current = state of the spec as they are undefined/poorly defined.



1. What is the intended value of interim_transcript_hash_<= /b>[0]?


From the current draft I cannot definitively (i.e. with 100% certainty= ) say whether the value of the first interim_transcript_hash should be:

a. "the zero-length octet string" following the last l= ine of Group state section, or
b. a value derived based on the MLSPlaintextCommitAutData for th= e first commit concatenated with 0:
    interim_transcript_hash_[0]
        =3D Ha= sh(confirmed_transcript_hash_[0] || MLSPlaintextCommitAuthData_[0])
        = =3D Hash(0 || MLSPlaintextCommitAuthData_[0])

The draft strongly suggests to me that it is the former, but the= latter seems to more accurately reflect the statement "The confirmed_transcript_hash field contains a running hash over the messages that led to this state.<= /span>"

In the case that a is correct I would suggest updating the defi= nition of interim_transcript_hash_[n] to:
    interim_transcript_hash_[0] =3D 0
=
    interim_transcript_hash_[n] =3D
        Hash(confirmed_transcript_hash_[n] ||
            MLSPlaintextCommitAuthData_[n]);
In the case that b is correct I would suggest adding a "warning= " that says something along the lines of "as a placeholder val= ue" to the place(s) where the draft says that the interim_transcri= pt_hash of a group is initialized to 0.


2. What is the `members` array mentioned in the Group creation section?

In that section it is stated that "A new member receiving a= Welcome message can recognize group creation if the number of entries in t= he `members` array is equal to the number of leaves in the tree minus one.&= quot; First of all, it is not clear what this `members` array is. It seems this refers to a field of the now-removed Ini= t struct. Interestingly this struct was removed in the very same PR that ad= ded the above sentence (see #239). But I wasn't able to really figure out what the dra= ft-09 equivalent of it should be.

In addition, I'm pretty sure this technique would no longer work= to detect group creation (but that would depend on how the sentence should= be updated).


Regards,
Eric
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--_000_3d4e1be7bfd94853a13222dacee078cdaaltofi_-- From nobody Tue Aug 18 07:55:42 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A59EA3A0BA0 for ; Tue, 18 Aug 2020 07:55:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9ZmvsqnQn4QX for ; Tue, 18 Aug 2020 07:55:39 -0700 (PDT) Received: from mail-wr1-x42c.google.com (mail-wr1-x42c.google.com [IPv6:2a00:1450:4864:20::42c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8EF1F3A0B9B for ; Tue, 18 Aug 2020 07:55:38 -0700 (PDT) Received: by mail-wr1-x42c.google.com with SMTP id r4so18529795wrx.9 for ; Tue, 18 Aug 2020 07:55:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=nj5gi+Ht8oxksNM9XM8ocuIRPbYMK6u95I59PegSE9E=; b=vM6863SeakfZowX2FOWoVbdMnyZFMIe+CY3vSDsqArI5YvSim7aWlCRyaH/5G2hCE5 b1Yv+LdWhSQetWEVSrZLYnKQ+pDD/tilMoi54SyAy4IPaMLhqE3kGHMy/7OcAFG/jXKk yejVeEVBtKzcDpXH8l7PzwnfPFu1N6p0VBMckBy5u++WDLoFKMXZBNVTcq1I5V3bygbh LI6mO4RadTzLKcum2s12oHCyNoxPu8XG/Bua6NKln2sDaYQSwRoa+a72bQ7sItIXxn1Y k/xAhRrHfmhBh3m1oVeUUNTzmI66L+KUvOuUVkbdi6ZANDSYk6n23tl/XrOzrcPlH0H+ dxVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=nj5gi+Ht8oxksNM9XM8ocuIRPbYMK6u95I59PegSE9E=; b=KnvXF9lR43lBtJ14jC6/wY5wLkN48ZzcN9cH5JYjju22BQmTgz3iQUmA1BJjJey1SM hHuUoLE7oiSDb5vykPHkpAuu1eNv6+8hkr4CkOccPD9Dr+dgnDWWsayfC6BHpD6ywNKJ ACqgjvRet3ihIlauN5p7rhTiNQXJNBo7+ABcxEhRLsDCE/KhbgCNDyG3uNHeljPgQLHH MPP+XYcjwRM4x4TOy4LkpngG2XhvDqBu28ZeGwyVWaRvMUwCYeL8bWmfitar6PEH9eqq dQUbDEbMzHNSaaLuvU1NYmMlYVIIiU99zKQ8rrSykVCsC6Ak1YI6j0oLJMMu6aetsTea 2I9w== X-Gm-Message-State: AOAM5314sLdEvNB/5tFtG/LNlycCYBDbo5iphMcaWet8bABzaP9RLc3w uVaEtfHWT/99jtzaFjk18YEt7Q== X-Google-Smtp-Source: ABdhPJxMluANW6uT5bmyA0T65+yG4It4gO95vbmWw+C2oozJ2xAh4aEw+PBiS4t+aVZ4pQwfdfACtA== X-Received: by 2002:a5d:526d:: with SMTP id l13mr19553282wrc.279.1597762536592; Tue, 18 Aug 2020 07:55:36 -0700 (PDT) Received: from rmbp.fritz.box ([134.3.30.253]) by smtp.gmail.com with ESMTPSA id t14sm37951357wrg.38.2020.08.18.07.55.35 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Aug 2020 07:55:35 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) From: Raphael Robert In-Reply-To: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> Date: Tue, 18 Aug 2020 16:55:34 +0200 Cc: Messaging Layer Security WG Content-Transfer-Encoding: quoted-printable Message-Id: References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> To: Joel Alwen X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 14:55:41 -0000 Hi Joel, For context: this would only apply when applications use cleartext = MLSPlaintext for HS messages. The recommendation is still to encrypt = them and send them around as MLSCiphertext. That being said, we said we would like to support scenarios where HS = messages are not necessarily encrypted. Question: would this attack work with Commit messages? I=E2=80=99m = thinking that they would be rejected because the attacker cannot compute = the confirmation_tag. As you mention in the PS, the easy target would be Proposal messages. I=E2=80=99d be interested to see what exactly you would propose as a = mitigation mechanism. Raphael > On 18 Aug 2020, at 16:36, Joel Alwen wrote: >=20 > Hey everyone, >=20 > Something thats been bugging Marta Mularczyk and Daniel Jost and me = for a bit > now is that handshake messages sent out as MLSPlaintext packets are = only > authenticated using signatures, but not using the group's key = schedule. For > non-members that makes sense but for group members that's weaker than = need be. >=20 > Suppose Alice is in a group using signing key pair (spk, ssk). I = corrupt her to > learn ssk. Now I loose access to her device again. Later she generates = a fresh > key package with her same spk but a new HPKE key for her leaf. She = sends out and > update proposal for her new key package and someone commits to the = update. >=20 > Expected result: she (and the group at large) has achieved PCS again. >=20 > Actual result: using her stolen ssk I can still forge a new proposal's = (sent as > MLSPlaintext packets) coming from Alice. Some things I could do with = this power: > - I can generate a new key package kp for Alice using her spk and some = HPKE key > she doesn't know. Then I forge an update proposal for Alice with kp. = If it gets > committed I've effectively kicked her out of the group. > - I could forge Add's and Remove's coming from Alice, so I could trick = the > group into thinking Alice is trying to Add my account to the group or = remove > some other group member. >=20 > Lemme know if I've missed something here in that scenario... >=20 >=20 > If I didn't miss anything and the attacks really work as advertised = then IMO > this is kinda weak sauce and worth avoiding if possible. So to that = end, how > about we modify MLS such that MLSPlaintext packets coming from group = members > must also be authenticated using something from the application key = schedule. > Now the above attacks fail. As soon as Alice's update is gets = committed I no > longer know the group's key schedule and so can't forged packet from = Alice. More > generally, this brings the PCS guarantees when using MLSPlaintexts = frameing in > line with what we're getting from MLSCiphertext packets. >=20 > Any thoughts? >=20 > - Jo=C3=ABl >=20 >=20 >=20 > PS. For concreteness, we could probably extend the current mechanism = for getting > concistancy (the confirmation_tag) to also provide symmetric key = authentication. > E.g. include most of the MLSPlaintext content into whats being tagged = by > confirmation_tag. That would cover the case of a commit packet and = doesn't even > grow the size of MLSPlaintext packets over the current design. >=20 > For a proposal packet we could also have a confirmation_tag but this = one is > computed using the *current* epoch's confirmation_key and = confirmed_transcript_hash. >=20 > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls From nobody Tue Aug 18 08:16:00 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C7C93A0C7A for ; Tue, 18 Aug 2020 08:15:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mxh5MhD_yCim for ; Tue, 18 Aug 2020 08:15:57 -0700 (PDT) Received: from mule.nps.edu (mule.nps.edu [205.155.65.106]) by ietfa.amsl.com (Postfix) with ESMTP id 0730B3A0C78 for ; Tue, 18 Aug 2020 08:15:56 -0700 (PDT) X-ASG-Debug-ID: 1597763755-0e39454aed16860001-bGA3T6 Received: from mail.nps.edu (skywalker.ern.nps.edu [172.20.4.117]) by mule.nps.edu with ESMTP id EaGEmsLArd9opIBm; Tue, 18 Aug 2020 08:15:55 -0700 (PDT) X-Barracuda-Envelope-From: britta.hale@nps.edu Received: from synergos.ern.nps.edu (172.20.4.116) by skywalker.ern.nps.edu (172.20.4.117) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1531.3; Tue, 18 Aug 2020 08:15:55 -0700 Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.36.51) by synergos.ern.nps.edu (172.20.4.116) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1531.3 via Frontend Transport; Tue, 18 Aug 2020 08:15:55 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=kqarKBhaGrk3SN0ob2Uw2mr3LB3MdQrTOpq8FPmzecTpxaOjRwF32gofodwwPfn8gtlJpPbNbEzq9On61ef3g6lJcRu8wysgI0P9o7fsdIpk2Mv3+X9P6HAdOEniP/q1JxgTXJSwM7tT+kwRT1TPHAXwo3EK/9XHAJms9ceCfJQXE7XkC3Yc4KpzC6rDZfVwLV7utD4GIbyiJmp5/+kj4IcRHlyLYWmTPXjFLPBCC0HftLqo4PlvztZtBFh/G14TtyR/ieoAINR0Ma5cQJvPsE6gEAEXScF4EtfkJADo3mmV08e6b1Cdd4ggSj0z3Zrr8KBNVbLBTrq5L9M3EiV9Fg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Uom4JzL2QKScRJZHpqou/UJ9sncLiqVwxHyMTcEZC3Y=; b=Q2tQgn0BPtLEqHFldmf2IMshRK0JjRObqrIpy3WZi2VN4knyGdlFm+pWRCKkqyJ1KWftQj7p1FgKW6rDh8h9hYl7N8WPTTwZmKMX7gVmaLsRmNYeEifPioGK+unMVJZ8HKBTOQqkBkr6o4lNdA820vjFoX+ooA2D34k9BmUEv84Rk+ccREifGT7prLcjKSaGzVrmMBMTx4pZUhOh/sU7ZQS5Bt+c/LbrygRiho1llRmIwHl0J9mh4c/RbIJ6EacqRWD3qA4qZ9twK5daVKBBgi4y23Q3EqjlY6evX0AHCUvU+1jNM5kd4OrftQ4rKVzw81uxsMPx5JHlUdgAJSunAw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nps.edu; dmarc=pass action=none header.from=nps.edu; dkim=pass header.d=nps.edu; arc=none Received: from BY5PR13MB3348.namprd13.prod.outlook.com (2603:10b6:a03:1aa::23) by BYAPR13MB2760.namprd13.prod.outlook.com (2603:10b6:a03:fa::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3305.14; Tue, 18 Aug 2020 15:15:53 +0000 Received: from BY5PR13MB3348.namprd13.prod.outlook.com ([fe80::65b1:6350:343d:c101]) by BY5PR13MB3348.namprd13.prod.outlook.com ([fe80::65b1:6350:343d:c101%7]) with mapi id 15.20.3305.017; Tue, 18 Aug 2020 15:15:53 +0000 X-Barracuda-Effective-Source-IP: UNKNOWN[2603:10b6:a03:fa::29] X-Barracuda-Apparent-Source-IP: 2603:10b6:a03:fa::29 From: "Hale, Britta (CIV)" To: Raphael Robert , Joel Alwen CC: Messaging Layer Security WG Thread-Topic: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-ASG-Orig-Subj: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule Thread-Index: AQHWdWz00GMqSfzrNUeLjUcYEIMnS6k99GYA//+QUwA= Date: Tue, 18 Aug 2020 15:15:53 +0000 Message-ID: References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=nps.edu; x-originating-ip: [2601:647:cb00:2941:7484:2acb:d3b3:22bf] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 9b8928c9-ad38-4d61-f655-08d843899943 x-ms-traffictypediagnostic: BYAPR13MB2760: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Rzd94mkf13tDRJ4w47c/JQQZRu+6YV11rim+WVswBC6IjhCoszBmyad6VZoClS63fskEWGavuCK2xyre2uXVQUy/CcaT8aRzXmB51LFin7x75z4mchwXm7F/Vp4bFfrpMM4sJr1u9kFtVil1tKY5SVGEsAQODr/EHqSpomcYlgQEgrmyvVeBAvYL4cVkbqLnsWrorb1n5fTguIdC6bkOf67+nzzkhfr01WFBX+y5ij2vJ7XkcQ8Djsj3GjcvR9JwfbI59Tp2faU/UIfILXs61OtOlKszAC9N+6zMGoUGoCNbpo4bxo4PoBV55waeCAzJ/7l8Vn1wunBFriBu85gpSegElOeXlCRFIdEgZzqW78qv1bAEV/0RW3+z4B35azEBWLlVggfW+zbWv+n88kOFLw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR13MB3348.namprd13.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(366004)(76116006)(6512007)(498600001)(66446008)(66476007)(33656002)(66946007)(64756008)(66556008)(71200400001)(86362001)(75432002)(5660300002)(8676002)(110136005)(53546011)(6506007)(6486002)(66574015)(8936002)(966005)(83380400001)(2616005)(2906002)(4326008)(36756003)(186003); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: tmtoslxXkyMc6KxD/a3tMIJMrsV+xxMglt7LkUIBryto2cRpeCahUiBaCbyvOSF5sIV8DFV29AkDDj7HKFa79U2QynT5Flqgz/+8/1SmC+e7c+mL2B4SBZEZn4IiANJcXw7OLd4DAD1jENLCOTHudstGsXPuVlcYEZQY1TAmhjbZzX4JdyR7xjq4OGMBy6AVkFvddAbVlRix8bhoRyEqIIZjYrwuZfJU60ruWOtaZNr+2O3kDmEDkdmhJb369eAYFkwJsFF1pT+e22Oe7Y2pY6oVmAxP5CeTP2fuiD3mxOmvWxD7bHkSk8b0niVDMiqQEmFDX8h6kEGgcsNekCYpbpd6eMiv3C2B8n3r7HgPzamH7iBX4nLVTBCCr9DobjmBKWQ6N8j5PHBB30pdLMMl0CnNToLDq0dpKUxOpFIonvLzv2qAUKgeYRLEnbSbjVeGq7PsaJQp0k5lwpEGg7scy+4pfLrMB2iM+5Id9A94skGOLpt/GzTkFldwxHSLcmB0FGDxNmcWeST+21/RJ5uhF+Snowlw9CkLnegy0W8ofZxY+KJ9iXH++bEPF78CoN0XGUmEEk1gSxDjX6jFL4ALu0yz+Wa3xBkLOcslhFtpML/lpepR62BTjlqnCq/3HwWgN02cY1utVkEiWKBwsjvojq/tqdywGFOUJqUwqN7LHyXzBgLtlT4pLGuxP0bY6dykjEEkkMhr+xe5oEdLrVdi0g== x-ms-exchange-transport-forked: True Content-Type: text/plain; charset="utf-8" Content-ID: <2CC78B3DCAF3564392E3F71EFEA501B9@namprd13.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR13MB3348.namprd13.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9b8928c9-ad38-4d61-f655-08d843899943 X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Aug 2020 15:15:53.2014 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6d936231-a517-40ea-9199-f7578963378e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: QDD5cY9x2YF9sbFhjPMQqKpCl7McprXAK5JqkSOWkZ8OZzIJ1nc49GoYnOi4jHpT4U2x5OqmrAHllBe/k5NNOw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR13MB2760 X-OriginatorOrg: nps.edu X-Barracuda-Connect: skywalker.ern.nps.edu[172.20.4.117] X-Barracuda-Start-Time: 1597763755 X-Barracuda-URL: https://205.155.65.106:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at nps.edu X-Barracuda-Scan-Msg-Size: 4557 X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_SC5_SA210e X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.83987 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 BSF_SC5_SA210e Custom Rule SA210e Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 15:15:59 -0000 R29vZCBjYXRjaCBKb8OrbCwNCg0KVGhpcyBpcyBpbmRlZWQgdmVyeSBwcm9ibGVtYXRpYyBhZ2Fp bnN0IHRoZSBQQ1Mgc2VjdXJpdHkgZ29hbHMuDQoNCklmIHRoZSBtb3RpdmF0aW9uIGJlaGluZCB0 aGlzIGlzIHRvIHByb3ZpZGUgYSBjbGVhcnRleHQgYWx0ZXJuYXRpdmUgdG8gZW5jcnlwdGVkIEhT IG1lc3NhZ2VzLCB0aGVuIGEgcmVndWxhciBtZXNzYWdlIGF1dGhlbnRpY2F0aW9uIGNvZGUgYmFz ZWQgb24gdGhlIGN1cnJlbnQgZ3JvdXAgY29udGV4dCAodG8gcmVwbGFjZSB0aGUgZW5jcnlwdGlv biBzdGVwKSB3b3VsZCBiZSBhIHNpbXBsZSBzb2x1dGlvbi4gVGhhdCBiaW5kcyBhIGxldmVsIG9m IGF1dGhlbnRpY2F0aW9uIHRvIHRoZSBncm91cCBzdGF0ZSB3aGlsZSBhbGxvd2luZyBtZXNzYWdl cyB0byBiZSBpbiB0aGUgY2xlYXIgaWYgcmVxdWlyZWQuDQoNCkJyaXR0YQ0KDQoNCu+7v09uIDgv MTgvMjAsIDc6NTUgQU0sICJNTFMgb24gYmVoYWxmIG9mIFJhcGhhZWwgUm9iZXJ0IiA8bWxzLWJv dW5jZXNAaWV0Zi5vcmcgb24gYmVoYWxmIG9mIHJhcGhhZWw9NDB3aXJlLmNvbUBkbWFyYy5pZXRm Lm9yZz4gd3JvdGU6DQoNCiAgICBOUFMgV0FSTklORzogKmV4dGVybmFsIHNlbmRlciogdmVyaWZ5 IGJlZm9yZSBhY3RpbmcuDQogICAgDQogICAgDQogICAgSGkgSm9lbCwNCiAgICANCiAgICBGb3Ig Y29udGV4dDogdGhpcyB3b3VsZCBvbmx5IGFwcGx5IHdoZW4gYXBwbGljYXRpb25zIHVzZSBjbGVh cnRleHQgTUxTUGxhaW50ZXh0IGZvciBIUyBtZXNzYWdlcy4gVGhlIHJlY29tbWVuZGF0aW9uIGlz IHN0aWxsIHRvIGVuY3J5cHQgdGhlbSBhbmQgc2VuZCB0aGVtIGFyb3VuZCBhcyBNTFNDaXBoZXJ0 ZXh0Lg0KICAgIFRoYXQgYmVpbmcgc2FpZCwgd2Ugc2FpZCB3ZSB3b3VsZCBsaWtlIHRvIHN1cHBv cnQgc2NlbmFyaW9zIHdoZXJlIEhTIG1lc3NhZ2VzIGFyZSBub3QgbmVjZXNzYXJpbHkgZW5jcnlw dGVkLg0KICAgIA0KICAgIFF1ZXN0aW9uOiB3b3VsZCB0aGlzIGF0dGFjayB3b3JrIHdpdGggQ29t bWl0IG1lc3NhZ2VzPyBJ4oCZbSB0aGlua2luZyB0aGF0IHRoZXkgd291bGQgYmUgcmVqZWN0ZWQg YmVjYXVzZSB0aGUgYXR0YWNrZXIgY2Fubm90IGNvbXB1dGUgdGhlIGNvbmZpcm1hdGlvbl90YWcu DQogICAgDQogICAgQXMgeW91IG1lbnRpb24gaW4gdGhlIFBTLCB0aGUgZWFzeSB0YXJnZXQgd291 bGQgYmUgUHJvcG9zYWwgbWVzc2FnZXMuDQogICAgDQogICAgSeKAmWQgYmUgaW50ZXJlc3RlZCB0 byBzZWUgd2hhdCBleGFjdGx5IHlvdSB3b3VsZCBwcm9wb3NlIGFzIGEgbWl0aWdhdGlvbiBtZWNo YW5pc20uDQogICAgDQogICAgUmFwaGFlbA0KICAgIA0KICAgID4gT24gMTggQXVnIDIwMjAsIGF0 IDE2OjM2LCBKb2VsIEFsd2VuIDxqYWx3ZW5Ad2lja3IuY29tPiB3cm90ZToNCiAgICA+DQogICAg PiBIZXkgZXZlcnlvbmUsDQogICAgPg0KICAgID4gU29tZXRoaW5nIHRoYXRzIGJlZW4gYnVnZ2lu ZyBNYXJ0YSBNdWxhcmN6eWsgYW5kIERhbmllbCBKb3N0IGFuZCBtZSBmb3IgYSBiaXQNCiAgICA+ IG5vdyBpcyB0aGF0IGhhbmRzaGFrZSBtZXNzYWdlcyBzZW50IG91dCBhcyBNTFNQbGFpbnRleHQg cGFja2V0cyBhcmUgb25seQ0KICAgID4gYXV0aGVudGljYXRlZCB1c2luZyBzaWduYXR1cmVzLCBi dXQgbm90IHVzaW5nIHRoZSBncm91cCdzIGtleSBzY2hlZHVsZS4gRm9yDQogICAgPiBub24tbWVt YmVycyB0aGF0IG1ha2VzIHNlbnNlIGJ1dCBmb3IgZ3JvdXAgbWVtYmVycyB0aGF0J3Mgd2Vha2Vy IHRoYW4gbmVlZCBiZS4NCiAgICA+DQogICAgPiBTdXBwb3NlIEFsaWNlIGlzIGluIGEgZ3JvdXAg dXNpbmcgc2lnbmluZyBrZXkgcGFpciAoc3BrLCBzc2spLiBJIGNvcnJ1cHQgaGVyIHRvDQogICAg PiBsZWFybiBzc2suIE5vdyBJIGxvb3NlIGFjY2VzcyB0byBoZXIgZGV2aWNlIGFnYWluLiBMYXRl ciBzaGUgZ2VuZXJhdGVzIGEgZnJlc2gNCiAgICA+IGtleSBwYWNrYWdlIHdpdGggaGVyIHNhbWUg c3BrIGJ1dCBhIG5ldyBIUEtFIGtleSBmb3IgaGVyIGxlYWYuIFNoZSBzZW5kcyBvdXQgYW5kDQog ICAgPiB1cGRhdGUgcHJvcG9zYWwgZm9yIGhlciBuZXcga2V5IHBhY2thZ2UgYW5kIHNvbWVvbmUg Y29tbWl0cyB0byB0aGUgdXBkYXRlLg0KICAgID4NCiAgICA+IEV4cGVjdGVkIHJlc3VsdDogc2hl IChhbmQgdGhlIGdyb3VwIGF0IGxhcmdlKSBoYXMgYWNoaWV2ZWQgUENTIGFnYWluLg0KICAgID4N CiAgICA+IEFjdHVhbCByZXN1bHQ6IHVzaW5nIGhlciBzdG9sZW4gc3NrIEkgY2FuIHN0aWxsIGZv cmdlIGEgbmV3IHByb3Bvc2FsJ3MgKHNlbnQgYXMNCiAgICA+IE1MU1BsYWludGV4dCBwYWNrZXRz KSBjb21pbmcgZnJvbSBBbGljZS4gU29tZSB0aGluZ3MgSSBjb3VsZCBkbyB3aXRoIHRoaXMgcG93 ZXI6DQogICAgPiAtIEkgY2FuIGdlbmVyYXRlIGEgbmV3IGtleSBwYWNrYWdlIGtwIGZvciBBbGlj ZSB1c2luZyBoZXIgc3BrIGFuZCBzb21lIEhQS0Uga2V5DQogICAgPiBzaGUgZG9lc24ndCBrbm93 LiBUaGVuIEkgZm9yZ2UgYW4gdXBkYXRlIHByb3Bvc2FsIGZvciBBbGljZSB3aXRoIGtwLiBJZiBp dCBnZXRzDQogICAgPiBjb21taXR0ZWQgSSd2ZSBlZmZlY3RpdmVseSBraWNrZWQgaGVyIG91dCBv ZiB0aGUgZ3JvdXAuDQogICAgPiAtIEkgY291bGQgZm9yZ2UgQWRkJ3MgYW5kIFJlbW92ZSdzIGNv bWluZyBmcm9tIEFsaWNlLCBzbyBJIGNvdWxkIHRyaWNrIHRoZQ0KICAgID4gZ3JvdXAgaW50byB0 aGlua2luZyBBbGljZSBpcyB0cnlpbmcgdG8gQWRkIG15IGFjY291bnQgdG8gdGhlIGdyb3VwIG9y IHJlbW92ZQ0KICAgID4gc29tZSBvdGhlciBncm91cCBtZW1iZXIuDQogICAgPg0KICAgID4gTGVt bWUga25vdyBpZiBJJ3ZlIG1pc3NlZCBzb21ldGhpbmcgaGVyZSBpbiB0aGF0IHNjZW5hcmlvLi4u DQogICAgPg0KICAgID4NCiAgICA+IElmIEkgZGlkbid0IG1pc3MgYW55dGhpbmcgYW5kIHRoZSBh dHRhY2tzIHJlYWxseSB3b3JrIGFzIGFkdmVydGlzZWQgdGhlbiBJTU8NCiAgICA+IHRoaXMgaXMg a2luZGEgd2VhayBzYXVjZSBhbmQgd29ydGggYXZvaWRpbmcgaWYgcG9zc2libGUuIFNvIHRvIHRo YXQgZW5kLCBob3cNCiAgICA+IGFib3V0IHdlIG1vZGlmeSBNTFMgc3VjaCB0aGF0IE1MU1BsYWlu dGV4dCBwYWNrZXRzIGNvbWluZyBmcm9tIGdyb3VwIG1lbWJlcnMNCiAgICA+IG11c3QgYWxzbyBi ZSBhdXRoZW50aWNhdGVkIHVzaW5nIHNvbWV0aGluZyBmcm9tIHRoZSBhcHBsaWNhdGlvbiBrZXkg c2NoZWR1bGUuDQogICAgPiBOb3cgdGhlIGFib3ZlIGF0dGFja3MgZmFpbC4gQXMgc29vbiBhcyBB bGljZSdzIHVwZGF0ZSBpcyBnZXRzIGNvbW1pdHRlZCBJIG5vDQogICAgPiBsb25nZXIga25vdyB0 aGUgZ3JvdXAncyBrZXkgc2NoZWR1bGUgYW5kIHNvIGNhbid0IGZvcmdlZCBwYWNrZXQgZnJvbSBB bGljZS4gTW9yZQ0KICAgID4gZ2VuZXJhbGx5LCB0aGlzIGJyaW5ncyB0aGUgUENTIGd1YXJhbnRl ZXMgd2hlbiB1c2luZyBNTFNQbGFpbnRleHRzIGZyYW1laW5nIGluDQogICAgPiBsaW5lIHdpdGgg d2hhdCB3ZSdyZSBnZXR0aW5nIGZyb20gTUxTQ2lwaGVydGV4dCBwYWNrZXRzLg0KICAgID4NCiAg ICA+IEFueSB0aG91Z2h0cz8NCiAgICA+DQogICAgPiAtIEpvw6tsDQogICAgPg0KICAgID4NCiAg ICA+DQogICAgPiBQUy4gRm9yIGNvbmNyZXRlbmVzcywgd2UgY291bGQgcHJvYmFibHkgZXh0ZW5k IHRoZSBjdXJyZW50IG1lY2hhbmlzbSBmb3IgZ2V0dGluZw0KICAgID4gY29uY2lzdGFuY3kgKHRo ZSBjb25maXJtYXRpb25fdGFnKSB0byBhbHNvIHByb3ZpZGUgc3ltbWV0cmljIGtleSBhdXRoZW50 aWNhdGlvbi4NCiAgICA+IEUuZy4gaW5jbHVkZSBtb3N0IG9mIHRoZSBNTFNQbGFpbnRleHQgY29u dGVudCBpbnRvIHdoYXRzIGJlaW5nIHRhZ2dlZCBieQ0KICAgID4gY29uZmlybWF0aW9uX3RhZy4g VGhhdCB3b3VsZCBjb3ZlciB0aGUgY2FzZSBvZiBhIGNvbW1pdCBwYWNrZXQgYW5kIGRvZXNuJ3Qg ZXZlbg0KICAgID4gZ3JvdyB0aGUgc2l6ZSBvZiBNTFNQbGFpbnRleHQgcGFja2V0cyBvdmVyIHRo ZSBjdXJyZW50IGRlc2lnbi4NCiAgICA+DQogICAgPiBGb3IgYSBwcm9wb3NhbCBwYWNrZXQgd2Ug Y291bGQgYWxzbyBoYXZlIGEgY29uZmlybWF0aW9uX3RhZyBidXQgdGhpcyBvbmUgaXMNCiAgICA+ IGNvbXB1dGVkIHVzaW5nIHRoZSAqY3VycmVudCogZXBvY2gncyBjb25maXJtYXRpb25fa2V5IGFu ZCBjb25maXJtZWRfdHJhbnNjcmlwdF9oYXNoLg0KICAgID4NCiAgICA+IF9fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fDQogICAgPiBNTFMgbWFpbGluZyBsaXN0 DQogICAgPiBNTFNAaWV0Zi5vcmcNCiAgICA+IGh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4v bGlzdGluZm8vbWxzDQogICAgDQogICAgX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX18NCiAgICBNTFMgbWFpbGluZyBsaXN0DQogICAgTUxTQGlldGYub3JnDQog ICAgaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMNCiAgICANCg0K From nobody Tue Aug 18 08:16:59 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6BDE03A0C92 for ; Tue, 18 Aug 2020 08:16:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Aod31OGpYkDS for ; Tue, 18 Aug 2020 08:16:55 -0700 (PDT) Received: from mail-ej1-x631.google.com (mail-ej1-x631.google.com [IPv6:2a00:1450:4864:20::631]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9A86D3A0C8B for ; Tue, 18 Aug 2020 08:16:48 -0700 (PDT) Received: by mail-ej1-x631.google.com with SMTP id t10so22519735ejs.8 for ; Tue, 18 Aug 2020 08:16:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=S1JKtN4K4AqKtaVmuSCvrySYYE1sgggA4D2Mpn0aVe8=; b=ohmtDr/gnUOVEk/ZAhDyCc8wxXcMQjNeX5N3Yjg8egN4y2PN7HtL20ftouXWMwXMIZ EM+VlSMjl76iaGs8C3NurB+tMWIdoXr3MgaPkTRL7C1zLdMH5EP4/vyo3CVhsfqszxpk 3khhjvDOlQk8EMR8a0cSjndhujZNOE6FZqtKmM1WNh3j3pLIj2AYjNjYuXbcylL3m7q2 mwG+f+9kD0EAxx/Z3JNAVUlga5DmD7unlo498wnUP6D3scVrPYYlIJ0lYTo54qXGt/Hv ENwrL5/i+dBog4zlpz1zEwv3MCSeMDpZLeguRUdRO/i4tWrf8tYQ/iyGXMVsUY/iKYJh V2Sw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=S1JKtN4K4AqKtaVmuSCvrySYYE1sgggA4D2Mpn0aVe8=; b=ZpIN8jVYX15L/Fp5cpIQ1B35XhNCKFzO+mtX9XK18tgmejV6AKdi4z7tHovPFyqU6K SzsoVN3kSXqBBjcjBrOW7LOs7msy18cvLnMDlkN0BwvoqDG1iam3XASKU/Ilfmftnfy+ tphug75VVP1jDvOkAi/3RGGnUhSUHcqMBGFyHbhxqJRpz3j6JpFphxkP0YLOeSNtmEp9 ZnSHhs+oPul6F9VntPLTMm1jAIdX8vxPM0t8rGiaCtdg6u/C+FVDn28i9ORzdyonzWYR 1aL2eSn5GjCpBFb6iX8vf8HRjacO/vosihaQDLqhVkFzazr7QQDwIr6KXitkorNeGZcS mhpg== X-Gm-Message-State: AOAM530Ydfhiz5FUaJeq+O4YVfwF+tQaXo1RdQrF/plBVgDkzANcEpxv 3AzyYIuAl1q10dp68VZe4dhK7g4/fCmTXw== X-Google-Smtp-Source: ABdhPJx7Q8jOC0myziVSk1sVIyAhEs+6pRNbDSmuJYp66K5K+WEW165vJAesMy8TaTITtBqx4YdVHg== X-Received: by 2002:a17:906:2e51:: with SMTP id r17mr20092646eji.308.1597763806499; Tue, 18 Aug 2020 08:16:46 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id qk30sm16653467ejb.125.2020.08.18.08.16.45 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Aug 2020 08:16:46 -0700 (PDT) To: Raphael Robert Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: Date: Tue, 18 Aug 2020 17:16:45 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 15:16:57 -0000 > For context: this would only apply when applications use cleartext MLSPlaintext for HS messages. The recommendation is still to encrypt them and send them around as MLSCiphertext. Yup, all this only applies for that case. > Question: would this attack work with Commit messages? I’m thinking that they would be rejected because the attacker cannot compute the confirmation_tag. TBH for commit messages I haven't thought it through yet. (The attack on Proposals looked like enough of an issue that we might wanna do something already.) But on further thought we might be OK already for commit msgs. The confirmation_tag is, in particular, also a MAC of the MLSPlaintext packet's content as that's part of the confirmed_transcript_hash. That really doesn't leave any room to reuse Alice's confirmation_tag values to forge a non-trivial commit on her behalf. So a non-trivial forgery requires computing fresh tag values but that won't work with out the symmetric key schedule which was the goal. > As you mention in the PS, the easy target would be Proposal messages. Indeed. As far as I can tell those simply having nothing at all that depends on the symmetric key schedule. > I’d be interested to see what exactly you would propose as a mitigation mechanism. Given that Commit's seem ok as is, how about adding an opaque tag<0...255> to MLSPlaintext struct if and only if content_type == proposal && sender_type == member. In that case we set tag := KDF.Extract(confirmation_key, MLSPlaintextTBS). (Here, conf key is taken from the current epoch.) - Joël On 18/08/2020 16:55, Raphael Robert wrote: > Hi Joel, > > For context: this would only apply when applications use cleartext MLSPlaintext for HS messages. The recommendation is still to encrypt them and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I’m thinking that they would be rejected because the attacker cannot compute the confirmation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I’d be interested to see what exactly you would propose as a mitigation mechanism. > > Raphael > >> On 18 Aug 2020, at 16:36, Joel Alwen wrote: >> >> Hey everyone, >> >> Something thats been bugging Marta Mularczyk and Daniel Jost and me for a bit >> now is that handshake messages sent out as MLSPlaintext packets are only >> authenticated using signatures, but not using the group's key schedule. For >> non-members that makes sense but for group members that's weaker than need be. >> >> Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt her to >> learn ssk. Now I loose access to her device again. Later she generates a fresh >> key package with her same spk but a new HPKE key for her leaf. She sends out and >> update proposal for her new key package and someone commits to the update. >> >> Expected result: she (and the group at large) has achieved PCS again. >> >> Actual result: using her stolen ssk I can still forge a new proposal's (sent as >> MLSPlaintext packets) coming from Alice. Some things I could do with this power: >> - I can generate a new key package kp for Alice using her spk and some HPKE key >> she doesn't know. Then I forge an update proposal for Alice with kp. If it gets >> committed I've effectively kicked her out of the group. >> - I could forge Add's and Remove's coming from Alice, so I could trick the >> group into thinking Alice is trying to Add my account to the group or remove >> some other group member. >> >> Lemme know if I've missed something here in that scenario... >> >> >> If I didn't miss anything and the attacks really work as advertised then IMO >> this is kinda weak sauce and worth avoiding if possible. So to that end, how >> about we modify MLS such that MLSPlaintext packets coming from group members >> must also be authenticated using something from the application key schedule. >> Now the above attacks fail. As soon as Alice's update is gets committed I no >> longer know the group's key schedule and so can't forged packet from Alice. More >> generally, this brings the PCS guarantees when using MLSPlaintexts frameing in >> line with what we're getting from MLSCiphertext packets. >> >> Any thoughts? >> >> - Joël >> >> >> >> PS. For concreteness, we could probably extend the current mechanism for getting >> concistancy (the confirmation_tag) to also provide symmetric key authentication. >> E.g. include most of the MLSPlaintext content into whats being tagged by >> confirmation_tag. That would cover the case of a commit packet and doesn't even >> grow the size of MLSPlaintext packets over the current design. >> >> For a proposal packet we could also have a confirmation_tag but this one is >> computed using the *current* epoch's confirmation_key and confirmed_transcript_hash. >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls > From nobody Tue Aug 18 08:26:44 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 233EF3A0CF3 for ; Tue, 18 Aug 2020 08:26:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id phV0NKEHg_Tz for ; Tue, 18 Aug 2020 08:26:40 -0700 (PDT) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 5D59D3A0CF1 for ; Tue, 18 Aug 2020 08:26:40 -0700 (PDT) Received: by mail-qk1-x72a.google.com with SMTP id 2so18560857qkf.10 for ; Tue, 18 Aug 2020 08:26:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=h7Lto+a3CHlxihkraWWYezJFZPe3GrDK0iwbwyyIsOQ=; b=HljuG/h4oHViXCNMRHW+n92oKo7tyJhjhxLKBPOwa/Hiv6Zwz5+iSwPuwNxvsqKnpu RomC/eOb2sbbsQmLUUuSY8rWnqVKcjUZikkgO6N9vqbktD+R8wgT9emLolFWrmQnBZhQ 4gG3mQmz/37uu9dih6pca5FHTgslFHiuqwF42qkWYhhzwfknQmtF93CAluf+CPncNhzn dN31mJ7hrWhxpA7fbMhmGTmlGPLErvEgBH/XIYg8i/NH5DAFiMp7W+m71SDpfeaCIn+R 6SUVDpvErV+SjtOXOebWzRMpSQmSRTtrf4DYWnE0IyoX2toLBM/tpJzyvrkvzrIP+Gx+ 7/GQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=h7Lto+a3CHlxihkraWWYezJFZPe3GrDK0iwbwyyIsOQ=; b=R3TTKEHeMWu4AmpFDAWiNmVQk5YrWsV6c8PZjpiCcTHP81SnXkxoj1ZhbGtwTvHy8M Rl92toG7tpi429rrGSm3NdYuOA9ZvIrbSfwlMCrPWa24S0ige9kUp5tr8MnvIuOAp88V 2/4AsJPmbTKenlgalLEobiEp0YiZykeCcFAMckncvQKBBWvZUfRB6nrS480d5mgFyDFS 0owcUrrmK6FJxDX/63euaEtpJek1hdrIS/rQK0zEoW1GAHZ8d4/956CD4er7twyJgwkW eSAA0eeJg5SjyUru7HCWF4cYmTjaD0Tgqn0zAv8RtnhCNR2P5Wq5Rlrvzf+F5F73hA0t BINA== X-Gm-Message-State: AOAM531TxLZLO1ObBgopYV70XO6QDLdQ+Mdqa7JAxzp4ky0iU5VioWRx S4ytLck+eROOyOPFSTUoiMAJB7IP6OYwzDirzzvmfw== X-Google-Smtp-Source: ABdhPJyKQWXmgGYqYZu7WjcuVEHoWLcbzX+Sgzn1imhLqvwx4dh03vZAHnbkRjoyk3KuvjOADp9CA/cjq8QzxP1jpWM= X-Received: by 2002:a37:8287:: with SMTP id e129mr15712084qkd.132.1597764399138; Tue, 18 Aug 2020 08:26:39 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: From: Richard Barnes Date: Tue, 18 Aug 2020 11:26:18 -0400 Message-ID: To: Raphael Robert Cc: Joel Alwen , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000007223f005ad288354" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 15:26:43 -0000 --0000000000007223f005ad288354 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Thanks for pointing this out, Jo=C3=ABl. I agree that the attacks you're describing should work as things are currently specified. And they're salient, especially the "replace Alice in the group" one. Also agree with Raphael is correct that Commit is not affected by this, since someone who is not a member won't be able to generate the right confirmation value. However, I don't think this is actually the right design to adopt for a general solution to this problem. Confirmation verifies group membership *after* processing the handshake message; the point here is that we should also have a membership check *before* processing handshake messages. In particular, I would propose that we do need something additional on Commit messages as well as Proposals. Thinking about solutions here, a couple of options come to mind: 1. Use MLSCiphertext, but with an integrity-only encapsulation 2. Incorporate in the signature something that is only known to the group (e.g., confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || Proposal/Commit)) Option (1) has the appeal that you would only ever send MLSCiphertext, though switching between encrypted/not could be problematic. Option (2) seems a lot more appealing: It doesn't add any overhead, since the group-secret value doesn't need to be sent. And we already switch between the signature context that is added for group members vs. external. In fact, I think option (2) would just amount to a one-line change to include an extra, secret value in the context at the top of the MLSPlaintextTBS struct. https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.m= d#content-signing-and-encryption The only thing that seems odd about (2) is overloading signature verification in that way, i.e., using the ability to generate a signature over a secret thing to prove you know the secret thing. That doesn't seem obviously flawed to me, but worth thinking about. Does that make sense to folks? --Richard On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert wrote: > Hi Joel, > > For context: this would only apply when applications use cleartext > MLSPlaintext for HS messages. The recommendation is still to encrypt them > and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS > messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I=E2=80=99m thinki= ng that > they would be rejected because the attacker cannot compute the > confirmation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I=E2=80=99d be interested to see what exactly you would propose as a miti= gation > mechanism. > > Raphael > > > On 18 Aug 2020, at 16:36, Joel Alwen wrote: > > > > Hey everyone, > > > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for > a bit > > now is that handshake messages sent out as MLSPlaintext packets are onl= y > > authenticated using signatures, but not using the group's key schedule. > For > > non-members that makes sense but for group members that's weaker than > need be. > > > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrup= t > her to > > learn ssk. Now I loose access to her device again. Later she generates = a > fresh > > key package with her same spk but a new HPKE key for her leaf. She send= s > out and > > update proposal for her new key package and someone commits to the > update. > > > > Expected result: she (and the group at large) has achieved PCS again. > > > > Actual result: using her stolen ssk I can still forge a new proposal's > (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do with > this power: > > - I can generate a new key package kp for Alice using her spk and some > HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp. If > it gets > > committed I've effectively kicked her out of the group. > > - I could forge Add's and Remove's coming from Alice, so I could trick > the > > group into thinking Alice is trying to Add my account to the group or > remove > > some other group member. > > > > Lemme know if I've missed something here in that scenario... > > > > > > If I didn't miss anything and the attacks really work as advertised the= n > IMO > > this is kinda weak sauce and worth avoiding if possible. So to that end= , > how > > about we modify MLS such that MLSPlaintext packets coming from group > members > > must also be authenticated using something from the application key > schedule. > > Now the above attacks fail. As soon as Alice's update is gets committed > I no > > longer know the group's key schedule and so can't forged packet from > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts > frameing in > > line with what we're getting from MLSCiphertext packets. > > > > Any thoughts? > > > > - Jo=C3=ABl > > > > > > > > PS. For concreteness, we could probably extend the current mechanism fo= r > getting > > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > > E.g. include most of the MLSPlaintext content into whats being tagged b= y > > confirmation_tag. That would cover the case of a commit packet and > doesn't even > > grow the size of MLSPlaintext packets over the current design. > > > > For a proposal packet we could also have a confirmation_tag but this on= e > is > > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000007223f005ad288354 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Thanks for pointing this out, Jo=C3=ABl.=C2=A0 I agre= e that the attacks you're describing should work as things are currentl= y specified.=C2=A0 And they're salient, especially the "replace Al= ice in the group" one.

Also agree with Ra= phael is correct that Commit is not affected by this, since someone who is = not a member won't be able to generate the right confirmation value.=C2= =A0 However, I don't think this is actually the right design to adopt f= or a general solution to this problem.=C2=A0 Confirmation verifies group me= mbership *after* processing the handshake message; the point here is that w= e should also have a membership check *before* processing handshake message= s.=C2=A0 In particular, I would propose that we do need something additiona= l on Commit messages as well as Proposals.

Thi= nking about solutions here, a couple of options come to mind:
1. Use MLSCiphertext, but with an integrity-only encapsulation<= /div>
2. Incorporate in the signature something that is only known to t= he group (e.g., confirmation_key or MAC(confirmation_key; confirmed_transcr= ipt_hash || Proposal/Commit))

Option (1) has the a= ppeal that you would only ever send MLSCiphertext, though switching between= encrypted/not could be problematic.=C2=A0 Option (2) seems a lot more appe= aling: It doesn't add any overhead, since the group-secret value doesn&= #39;t need to be sent.=C2=A0 And we already switch between the signature co= ntext that is added for group members vs. external.=C2=A0 In fact, I think = option (2) would just amount to a one-line change to include an extra, secr= et value in the context at the top of the MLSPlaintextTBS struct.
https://github.com/mlswg/mls-= protocol/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encrypt= ion

The only thing that seems odd about (2) is= overloading signature verification in that way, i.e., using the ability to= generate a signature over a secret thing to prove you know the secret thin= g.=C2=A0 That doesn't seem obviously flawed to me, but worth thinking a= bout.

Does that make sense to folks?

--Richard


On Tue, Aug 18, 2020 at 1= 0:55 AM Raphael Robert <raphael=3D40wire.com@dmarc.ietf.org> wrote:
Hi Joel,

For context: this would only apply when applications use cleartext MLSPlain= text for HS messages. The recommendation is still to encrypt them and send = them around as MLSCiphertext.
That being said, we said we would like to support scenarios where HS messag= es are not necessarily encrypted.

Question: would this attack work with Commit messages? I=E2=80=99m thinking= that they would be rejected because the attacker cannot compute the confir= mation_tag.

As you mention in the PS, the easy target would be Proposal messages.

I=E2=80=99d be interested to see what exactly you would propose as a mitiga= tion mechanism.

Raphael

> On 18 Aug 2020, at 16:36, Joel Alwen <jalwen@wickr.com> wrote:
>
> Hey everyone,
>
> Something thats been bugging Marta Mularczyk and Daniel Jost and me fo= r a bit
> now is that handshake messages sent out as MLSPlaintext packets are on= ly
> authenticated using signatures, but not using the group's key sche= dule. For
> non-members that makes sense but for group members that's weaker t= han need be.
>
> Suppose Alice is in a group using signing key pair (spk, ssk). I corru= pt her to
> learn ssk. Now I loose access to her device again. Later she generates= a fresh
> key package with her same spk but a new HPKE key for her leaf. She sen= ds out and
> update proposal for her new key package and someone commits to the upd= ate.
>
> Expected result: she (and the group at large) has achieved PCS again.<= br> >
> Actual result: using her stolen ssk I can still forge a new proposal&#= 39;s (sent as
> MLSPlaintext packets) coming from Alice. Some things I could do with t= his power:
> - I can generate a new key package kp for Alice using her spk and some= HPKE key
> she doesn't know. Then I forge an update proposal for Alice with k= p. If it gets
> committed I've effectively kicked her out of the group.
> - I could forge Add's and Remove's coming from Alice, so I cou= ld trick the
> group into thinking Alice is trying to Add my account to the group or = remove
> some other group member.
>
> Lemme know if I've missed something here in that scenario...
>
>
> If I didn't miss anything and the attacks really work as advertise= d then IMO
> this is kinda weak sauce and worth avoiding if possible. So to that en= d, how
> about we modify MLS such that MLSPlaintext packets coming from group m= embers
> must also be authenticated using something from the application key sc= hedule.
> Now the above attacks fail. As soon as Alice's update is gets comm= itted I no
> longer know the group's key schedule and so can't forged packe= t from Alice. More
> generally, this brings the PCS guarantees when using MLSPlaintexts fra= meing in
> line with what we're getting from MLSCiphertext packets.
>
> Any thoughts?
>
> - Jo=C3=ABl
>
>
>
> PS. For concreteness, we could probably extend the current mechanism f= or getting
> concistancy (the confirmation_tag) to also provide symmetric key authe= ntication.
> E.g. include most of the MLSPlaintext content into whats being tagged = by
> confirmation_tag. That would cover the case of a commit packet and doe= sn't even
> grow the size of MLSPlaintext packets over the current design.
>
> For a proposal packet we could also have a confirmation_tag but this o= ne is
> computed using the *current* epoch's confirmation_key and confirme= d_transcript_hash.
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000007223f005ad288354-- From nobody Tue Aug 18 08:51:36 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61B2A3A0DD5 for ; Tue, 18 Aug 2020 08:51:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DJfb8cb_fLCb for ; Tue, 18 Aug 2020 08:51:34 -0700 (PDT) Received: from mail-qt1-x833.google.com (mail-qt1-x833.google.com [IPv6:2607:f8b0:4864:20::833]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EBD113A0DD3 for ; Tue, 18 Aug 2020 08:51:33 -0700 (PDT) Received: by mail-qt1-x833.google.com with SMTP id d27so15457694qtg.4 for ; Tue, 18 Aug 2020 08:51:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=iQoKutv6tbGcnsQX7RazZmlFtpWnUvspVJQGtnWUx4Y=; b=aKQM2MFxltlRTzZruDGL5rM9C6a067S1Jq31tSq3vos56tkSGP+bT2wLl6R+UX/A6y pC83BxyLQx2ZYfM4uaI3Qr1AYuAZ85dSlyd26Qjzg5qmHrVgokforLb/N6+Go1vTHTqZ +kyYBFNM+JTkOLX3eDq/2c358MGe/irmJrInM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=iQoKutv6tbGcnsQX7RazZmlFtpWnUvspVJQGtnWUx4Y=; b=ms3KdRktDnlyL5WfKeDVC5u8Yox1UxZEshUR7w+j7j3YN+PZDRj1bkpd+reCtVUQ+u Liu/iRNqT0BP13pZ174oXtDZV1Td3dJZMm/L5M/9Tg2VpRmswvcKKuuS7ZgczQGfG+il OVboefiedL9N89rMlhYEfFDk8awZEahIDHW9boPnGcwAI9doxqyV4KRcUncoXBBgs/HX Xl+U6FnGkSXXecBt6qZREb67ia/peZda4UqKBc0kAgPhVfMYUeA0hvboPmI5T+eFPvqI 5lB1KEpiPZHWQlwzDwEcGdPaI+S9jEMf4I/7/FurhohnG//202dGS5y3Z4YnMBjrfazi eZWw== X-Gm-Message-State: AOAM533AH5nC1HqRP/C/ETB9X01x7QllCl3Pycft60rqpreYdd50YJgP /irc403SxWEww92LYVjOF2OmjG3nbajLyQ== X-Google-Smtp-Source: ABdhPJwe/IElBOBMkCxhwnAxo9XaXTrjSUQImXumPxKSt9cdrfPhDleSug7V0K7LVfqWKSiR74oLPQ== X-Received: by 2002:ac8:86b:: with SMTP id x40mr17997093qth.75.1597765892450; Tue, 18 Aug 2020 08:51:32 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id j15sm20491012qkl.63.2020.08.18.08.51.30 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Aug 2020 08:51:31 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Message-Id: <97C7371E-F607-4C4A-ABDA-64E99FF706C2@sn3rd.com> Date: Tue, 18 Aug 2020 11:51:22 -0400 To: MLS List X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: [MLS] IETF 108 minutes uploaded X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 15:51:35 -0000 I based theses off of Richard=E2=80=99s notes (thanks!). Comments = welcome: https://github.com/mlswg/wg-materials/blob/master/ietf108/minutes.md also: https://www.ietf.org/proceedings/108/minutes/minutes-108-mls-00 spt= From nobody Tue Aug 18 08:52:34 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7B7253A0DD8 for ; Tue, 18 Aug 2020 08:52:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u8wxdsSXIqLI for ; Tue, 18 Aug 2020 08:52:32 -0700 (PDT) Received: from mail-qk1-x72c.google.com (mail-qk1-x72c.google.com [IPv6:2607:f8b0:4864:20::72c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id F28B83A0D01 for ; Tue, 18 Aug 2020 08:52:31 -0700 (PDT) Received: by mail-qk1-x72c.google.com with SMTP id 62so18669201qkj.7 for ; Tue, 18 Aug 2020 08:52:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=6pO0Jn4kEGIt6u4+535bnVjrcM1zK5vhDDErbwB9Nzs=; b=bax8ug+CsgwR+IcedyaIKb1yBYZFOW83nlLI018QkIz5G6xtif4sEx+L2dIBpl+IIS DhOcFGjukWu0xfp7/WW2oHuqcFIq412gGqUSavgQ3lAUq0yUNU6PJVwPrHNCG0wSZsAq y24Cdmfo0GnDvVnSWaZ4XIP95/Xr1oEHl0v68= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=6pO0Jn4kEGIt6u4+535bnVjrcM1zK5vhDDErbwB9Nzs=; b=BiURW+fqsee4pXOge+34V7xVtP6v3Pk8DSy9DGbqv8YFXP9rdZN5moQCjYybCNn5Iv LHUE5V2XZd3Lm/z4Dgr0VC8Fhy8ODNW3n4OUez3+iAOqxd5HthEpZWfm4FdKe0a7bLs+ o4dN4to1P7n4q47jPM7YFx10IFR85x8F4h1KyFhw8JYYnMOuiD+0dLMuT4QPPqxi4FNq i4vzpH0H3i04c4z2/7D1n6jksqOd/DFatw1i1ZQbs47K0OfeOoYQTxn/ga1rSSl+G6ve RwsOEzKccm/hk7GNHOMnrP/Z+q5s8AwGvBGz70qKI9xk/qzJQTpALtCLk+TZmAQvMsxa VIwQ== X-Gm-Message-State: AOAM532QywQOq6aNxHn6Y9qV/Cd6VqUpi5wkwrBrAORdttzWxZ4Su5Gr /xyeVWE3Na2lc8Zee9Ogg9wr1Vi5V//H4A== X-Google-Smtp-Source: ABdhPJwyGfRBvM1Two7EvhOVAzmoCE6ELtunYoP4jgQ1bIToC93Q6GLzeBhSvMZmWNmTz2xZZ5Aobg== X-Received: by 2002:a05:620a:1212:: with SMTP id u18mr17272157qkj.319.1597765950560; Tue, 18 Aug 2020 08:52:30 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id j15sm20491012qkl.63.2020.08.18.08.52.28 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Aug 2020 08:52:29 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Message-Id: <8FE2C9C7-837E-4F6D-BA6D-1FB4954BB5BF@sn3rd.com> Date: Tue, 18 Aug 2020 11:52:21 -0400 To: MLS List X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: [MLS] 08-11-2020 virtual interim minutes X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 15:52:33 -0000 Comments welcome on the uploaded minutes: = https://github.com/mlswg/wg-materials/blob/master/virtual-interim-recurrin= g/08-11-2020.md also: = https://datatracker.ietf.org/doc/minutes-interim-2020-mls-18-202008111200/= From nobody Tue Aug 18 09:16:12 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 00CA83A0E8C for ; Tue, 18 Aug 2020 09:16:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iF_Mlq_XdCpw for ; Tue, 18 Aug 2020 09:16:08 -0700 (PDT) Received: from mail-ed1-x52e.google.com (mail-ed1-x52e.google.com [IPv6:2a00:1450:4864:20::52e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FF373A0E8F for ; Tue, 18 Aug 2020 09:16:08 -0700 (PDT) Received: by mail-ed1-x52e.google.com with SMTP id l23so15700916edv.11 for ; Tue, 18 Aug 2020 09:16:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=b1gCE2bMkv4utZ3lEMuP5J3N58JAo+Zk2ZxyQ7ZNyIg=; b=RosDhtW2EkPL9+VSyoTV+u9lGSB0od8oERaTBtLxP6/lGn/tSFGXJ2kwc5jUWqU8z/ wSKTX/3A4EfIpSxqCz3bFZ3pawiPQu7+Z2g23CikngnHSU8EqqGG9MyfeKm3DthtUmz2 fAf0NQ4Osk1fj8zcR2ABfWcN9Q5hLBzXPzXCLX5bL3XXtb9tuvtRWyDkvvYivIt4KaQA t/bFdUbEwhvBlwBBHcNX8V6BvzgR3AatBmXQ63LDw3at/2DQDmETHa98+daY8+qkYP7z WoSelGfkAkhDIcLEYNrIBGXjP2RP4kdpMt4YePWMQl0LijhlV2LPvyUq6pezyw593PJr RRwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=b1gCE2bMkv4utZ3lEMuP5J3N58JAo+Zk2ZxyQ7ZNyIg=; b=FfjfhQI2xgd1VVWhWD2Gm9hERO9Gl9wSzSKr6X1I/nqkvNtOb/vEhyRaUIpm7ZCYg6 EP15PCwD0cdfEMmEwhgHZ+DFPRrhkcnJhJrAVx3X2skejyUdtplDwxB/AtWyAOnqMYA+ thrVXcbC2PZPiiAM+sC0Q9P8pnVu8mS2z/Pdj53M9/UtolH8BGEtD/UrSKrSpQyaFTu2 Iokcv0wUsVIYbbUjWgusY8lfT40xtjcH4fxN8w2C5zuVKdnT0Folvz8cx3gWJtm+mIMf nIbFXI5/09JaFp50P8SG55HK4w6j3n+Ex3Otlay+JF7UMZAzicifOpcvnyiDQXs8idQf 5cTw== X-Gm-Message-State: AOAM533LfuBFhDEoj8KOnyVYGU+Wl+ZAVbvCS6OEN0O1woAwz1mlXaVz zGQQtRKLleSOf2TltKZSa0EffUSj0a1NqQ== X-Google-Smtp-Source: ABdhPJxbYqkSGnBIBjHHREURLDQ46Rg9zyjhXLa6lhla3qC4V7yPMJmgxQkqR/ydRAv1u1lK1hU1OQ== X-Received: by 2002:aa7:c1d4:: with SMTP id d20mr20716730edp.81.1597767366210; Tue, 18 Aug 2020 09:16:06 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id v5sm16643826ejv.114.2020.08.18.09.16.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Aug 2020 09:16:05 -0700 (PDT) To: Richard Barnes , Raphael Robert Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> Date: Tue, 18 Aug 2020 18:16:04 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 16:16:11 -0000 Yeah, I like Option 2 here. I like that it avoids growing packet size. One caveat though: I'd go for the MAC(...) version rather than the confirmation_key. For starters thing including confirmation_key doesnt authenticate the contents of the packet. But even if it did, signatures aren't meant to hide the contents of what was signed. (Amend you favorite sig scheme to tack on the message at the end a signature and you've still got a secure signature scheme. But clearly not a message hiding one.) That means that AFAIK neither ECDSA nor EdDSA etc. were designed or analyzed for such a property. So this would amount to a very non-standard use of a signature schemes by MLS. Not saying it doesn't work for the particular sig schemes in our ciphersuite. But its def. not how signatures are "meant" to be used. But that leaves Option 2 with, say, including tag = MAC(conf_key, conf_trans_hash || MLSPlaintext.content) into whats being signed which I like and think gets the job done. Both conf_* values are taken from the current epoch. By MLSPlaintext.content I mean whats now called MLSPlaintextTBS. > I would propose that we do need something additional on Commit messages as > well as Proposals. @Richard: For Proopsals I think this works. Is that about what you had in mind for commits too? - Joël On 18/08/2020 17:26, Richard Barnes wrote: > Thanks for pointing this out, Joël.  I agree that the attacks you're describing > should work as things are currently specified.  And they're salient, especially > the "replace Alice in the group" one. > > Also agree with Raphael is correct that Commit is not affected by this, since > someone who is not a member won't be able to generate the right confirmation > value.  However, I don't think this is actually the right design to adopt for a > general solution to this problem.  Confirmation verifies group membership > *after* processing the handshake message; the point here is that we should also > have a membership check *before* processing handshake messages.  In particular, > I would propose that we do need something additional on Commit messages as well > as Proposals. > > Thinking about solutions here, a couple of options come to mind: > > 1. Use MLSCiphertext, but with an integrity-only encapsulation > 2. Incorporate in the signature something that is only known to the group (e.g., > confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || > Proposal/Commit)) > > Option (1) has the appeal that you would only ever send MLSCiphertext, though > switching between encrypted/not could be problematic.  Option (2) seems a lot > more appealing: It doesn't add any overhead, since the group-secret value > doesn't need to be sent.  And we already switch between the signature context > that is added for group members vs. external.  In fact, I think option (2) would > just amount to a one-line change to include an extra, secret value in the > context at the top of the MLSPlaintextTBS struct. > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption > > The only thing that seems odd about (2) is overloading signature verification in > that way, i.e., using the ability to generate a signature over a secret thing to > prove you know the secret thing.  That doesn't seem obviously flawed to me, but > worth thinking about. > > Does that make sense to folks? > > --Richard > > > On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > > wrote: > > Hi Joel, > > For context: this would only apply when applications use cleartext > MLSPlaintext for HS messages. The recommendation is still to encrypt them > and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS > messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I’m thinking that > they would be rejected because the attacker cannot compute the confirmation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I’d be interested to see what exactly you would propose as a mitigation > mechanism. > > Raphael > > > On 18 Aug 2020, at 16:36, Joel Alwen > wrote: > > > > Hey everyone, > > > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a bit > > now is that handshake messages sent out as MLSPlaintext packets are only > > authenticated using signatures, but not using the group's key schedule. For > > non-members that makes sense but for group members that's weaker than need be. > > > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt > her to > > learn ssk. Now I loose access to her device again. Later she generates a fresh > > key package with her same spk but a new HPKE key for her leaf. She sends > out and > > update proposal for her new key package and someone commits to the update. > > > > Expected result: she (and the group at large) has achieved PCS again. > > > > Actual result: using her stolen ssk I can still forge a new proposal's > (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do with this > power: > > - I can generate a new key package kp for Alice using her spk and some > HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp. If it > gets > > committed I've effectively kicked her out of the group. > > - I could forge Add's and Remove's coming from Alice, so I could trick the > > group into thinking Alice is trying to Add my account to the group or remove > > some other group member. > > > > Lemme know if I've missed something here in that scenario... > > > > > > If I didn't miss anything and the attacks really work as advertised then IMO > > this is kinda weak sauce and worth avoiding if possible. So to that end, how > > about we modify MLS such that MLSPlaintext packets coming from group members > > must also be authenticated using something from the application key schedule. > > Now the above attacks fail. As soon as Alice's update is gets committed I no > > longer know the group's key schedule and so can't forged packet from > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts frameing in > > line with what we're getting from MLSCiphertext packets. > > > > Any thoughts? > > > > - Joël > > > > > > > > PS. For concreteness, we could probably extend the current mechanism for > getting > > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > > E.g. include most of the MLSPlaintext content into whats being tagged by > > confirmation_tag. That would cover the case of a commit packet and doesn't > even > > grow the size of MLSPlaintext packets over the current design. > > > > For a proposal packet we could also have a confirmation_tag but this one is > > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > From nobody Tue Aug 18 09:24:50 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DD3EF3A0F07 for ; Tue, 18 Aug 2020 09:24:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SfrGfjhTFFcZ for ; Tue, 18 Aug 2020 09:24:42 -0700 (PDT) Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B50303A0ECE for ; Tue, 18 Aug 2020 09:24:41 -0700 (PDT) Received: by mail-wr1-x42b.google.com with SMTP id a15so18822319wrh.10 for ; Tue, 18 Aug 2020 09:24:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=H4h3tF12ZEfzFPQYMHCWJSsoJtIfIJv7oryRTFK6VaQ=; b=HTZvW3fHCLgVHQr6RPIkoZqaLgT8VXOEFNyhRKtToUfuBahrZH3VLPbKrpmYTDOuMI tQ36ky9Sbp/s4wMQKpqLtqxvEuxYrTyMtVEkz6kl5NsAxxC9Ee53731GkA38jGIqWO2B MLkhKssfgzhOsVvYHm6Lx3XgH4DkQ7YUj6swSsIfvQp3AykKFkJwERTNEBCnzFJu8Y1p c/2K/owHRIuKqWrEChfPoZXnlZq6bGpXf5hE5aaXVJwY1QKmGTuyhD1m7aidbmJmz/ab L62ARF4Npq8jlWlgqkGfUa4BgH/jNhCJIDNJEiGa0NSEWNUo8++ImI6kNs70fEImf1mV cInA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=H4h3tF12ZEfzFPQYMHCWJSsoJtIfIJv7oryRTFK6VaQ=; b=nEKBJeDI7FdaDPcIuImBUQdgnPtk88PQ17oBpxdQ/YDGG6AoQRhH2NoRqi1Q1RViVp PaSw650T4OUVTupIwkcnK1qdpmhC2ozbW/wbINRiH6RjUv4lw47p/AaWHxkDaad/7y20 yGXomcOM+XG+RbGTjImc0rK50klEiF5VZthsp+6G2x+Xqj8Aj1OGEWs8u22ASZA3IIj3 umcFcujg9mh53yB+6kN8uNV6+V9LWxMelxa2yOkVoAgkqVCqPvYT5FvX3ha3IEvyc44K NU1BFu6hjZNV3OwgY3VryfyhENOWAFj++D37larqhbPsMtOPBa8LYBR4fpZMwI3gB+78 F0yg== X-Gm-Message-State: AOAM531tgGCvySja+jsziruq/LhBvHXm3eqJTAHUbpaj3dwJzcp9+izi DJRRVixenoA4qH9Tnl/Mvq8BLA== X-Google-Smtp-Source: ABdhPJzSEdoMuGkMsQU87mhZZ10+bxh5s3XWJggfWKyfrVhlR4Hx/v0KWI2o4KQ0Xa+qCQn/xJjv9A== X-Received: by 2002:adf:94c3:: with SMTP id 61mr20017637wrr.289.1597767879882; Tue, 18 Aug 2020 09:24:39 -0700 (PDT) Received: from rmbp.fritz.box ([134.3.30.253]) by smtp.gmail.com with ESMTPSA id p8sm36106657wrq.9.2020.08.18.09.24.38 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 18 Aug 2020 09:24:39 -0700 (PDT) From: Raphael Robert Message-Id: <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_FE883FF8-0E7B-4904-AC68-CAF55A2D2D68" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Tue, 18 Aug 2020 18:24:38 +0200 In-Reply-To: <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> Cc: Richard Barnes , Messaging Layer Security WG To: Joel Alwen References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 16:24:49 -0000 --Apple-Mail=_FE883FF8-0E7B-4904-AC68-CAF55A2D2D68 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I think what you just described is indeed a combination of option 1 & 2. = It=E2=80=99s a MAC over the payload we want to authenticate, but it=E2=80=99= s implicit and we only include it in the MLSPlaintextTBS. Or in other = words, we stripped it from MLSPlaintext because it is implicitly known = to any valid member of the group. Raphael > On 18 Aug 2020, at 18:16, Joel Alwen wrote: >=20 > Yeah, I like Option 2 here. I like that it avoids growing packet size. >=20 > One caveat though: I'd go for the MAC(...) version rather than the > confirmation_key. For starters thing including confirmation_key doesnt > authenticate the contents of the packet. But even if it did, = signatures aren't > meant to hide the contents of what was signed. (Amend you favorite sig = scheme to > tack on the message at the end a signature and you've still got a = secure > signature scheme. But clearly not a message hiding one.) That means = that AFAIK > neither ECDSA nor EdDSA etc. were designed or analyzed for such a = property. So > this would amount to a very non-standard use of a signature schemes by = MLS. Not > saying it doesn't work for the particular sig schemes in our = ciphersuite. But > its def. not how signatures are "meant" to be used. >=20 > But that leaves Option 2 with, say, including tag =3D MAC(conf_key, > conf_trans_hash || MLSPlaintext.content) into whats being signed which = I like > and think gets the job done. Both conf_* values are taken from the = current > epoch. By MLSPlaintext.content I mean whats now called = MLSPlaintextTBS. >=20 >> I would propose that we do need something additional on Commit = messages as >> well as Proposals. >=20 > @Richard: For Proopsals I think this works. Is that about what you had = in mind > for commits too? >=20 > - Jo=C3=ABl >=20 >=20 > On 18/08/2020 17:26, Richard Barnes wrote: >> Thanks for pointing this out, Jo=C3=ABl. I agree that the attacks = you're describing >> should work as things are currently specified. And they're salient, = especially >> the "replace Alice in the group" one. >>=20 >> Also agree with Raphael is correct that Commit is not affected by = this, since >> someone who is not a member won't be able to generate the right = confirmation >> value. However, I don't think this is actually the right design to = adopt for a >> general solution to this problem. Confirmation verifies group = membership >> *after* processing the handshake message; the point here is that we = should also >> have a membership check *before* processing handshake messages. In = particular, >> I would propose that we do need something additional on Commit = messages as well >> as Proposals. >>=20 >> Thinking about solutions here, a couple of options come to mind: >>=20 >> 1. Use MLSCiphertext, but with an integrity-only encapsulation >> 2. Incorporate in the signature something that is only known to the = group (e.g., >> confirmation_key or MAC(confirmation_key; confirmed_transcript_hash = || >> Proposal/Commit)) >>=20 >> Option (1) has the appeal that you would only ever send = MLSCiphertext, though >> switching between encrypted/not could be problematic. Option (2) = seems a lot >> more appealing: It doesn't add any overhead, since the group-secret = value >> doesn't need to be sent. And we already switch between the signature = context >> that is added for group members vs. external. In fact, I think = option (2) would >> just amount to a one-line change to include an extra, secret value in = the >> context at the top of the MLSPlaintextTBS struct. >> = https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.= md#content-signing-and-encryption >>=20 >> The only thing that seems odd about (2) is overloading signature = verification in >> that way, i.e., using the ability to generate a signature over a = secret thing to >> prove you know the secret thing. That doesn't seem obviously flawed = to me, but >> worth thinking about. >>=20 >> Does that make sense to folks? >>=20 >> --Richard >>=20 >>=20 >> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert >> = >> = wrote: >>=20 >> Hi Joel, >>=20 >> For context: this would only apply when applications use cleartext >> MLSPlaintext for HS messages. The recommendation is still to = encrypt them >> and send them around as MLSCiphertext. >> That being said, we said we would like to support scenarios where = HS >> messages are not necessarily encrypted. >>=20 >> Question: would this attack work with Commit messages? I=E2=80=99m = thinking that >> they would be rejected because the attacker cannot compute the = confirmation_tag. >>=20 >> As you mention in the PS, the easy target would be Proposal = messages. >>=20 >> I=E2=80=99d be interested to see what exactly you would propose as = a mitigation >> mechanism. >>=20 >> Raphael >>=20 >>> On 18 Aug 2020, at 16:36, Joel Alwen >> >> wrote: >>>=20 >>> Hey everyone, >>>=20 >>> Something thats been bugging Marta Mularczyk and Daniel Jost and me = for a bit >>> now is that handshake messages sent out as MLSPlaintext packets are = only >>> authenticated using signatures, but not using the group's key = schedule. For >>> non-members that makes sense but for group members that's weaker = than need be. >>>=20 >>> Suppose Alice is in a group using signing key pair (spk, ssk). I = corrupt >> her to >>> learn ssk. Now I loose access to her device again. Later she = generates a fresh >>> key package with her same spk but a new HPKE key for her leaf. She = sends >> out and >>> update proposal for her new key package and someone commits to the = update. >>>=20 >>> Expected result: she (and the group at large) has achieved PCS = again. >>>=20 >>> Actual result: using her stolen ssk I can still forge a new = proposal's >> (sent as >>> MLSPlaintext packets) coming from Alice. Some things I could do with = this >> power: >>> - I can generate a new key package kp for Alice using her spk and = some >> HPKE key >>> she doesn't know. Then I forge an update proposal for Alice with kp. = If it >> gets >>> committed I've effectively kicked her out of the group. >>> - I could forge Add's and Remove's coming from Alice, so I could = trick the >>> group into thinking Alice is trying to Add my account to the group = or remove >>> some other group member. >>>=20 >>> Lemme know if I've missed something here in that scenario... >>>=20 >>>=20 >>> If I didn't miss anything and the attacks really work as advertised = then IMO >>> this is kinda weak sauce and worth avoiding if possible. So to that = end, how >>> about we modify MLS such that MLSPlaintext packets coming from group = members >>> must also be authenticated using something from the application key = schedule. >>> Now the above attacks fail. As soon as Alice's update is gets = committed I no >>> longer know the group's key schedule and so can't forged packet from >> Alice. More >>> generally, this brings the PCS guarantees when using MLSPlaintexts = frameing in >>> line with what we're getting from MLSCiphertext packets. >>>=20 >>> Any thoughts? >>>=20 >>> - Jo=C3=ABl >>>=20 >>>=20 >>>=20 >>> PS. For concreteness, we could probably extend the current mechanism = for >> getting >>> concistancy (the confirmation_tag) to also provide symmetric key >> authentication. >>> E.g. include most of the MLSPlaintext content into whats being = tagged by >>> confirmation_tag. That would cover the case of a commit packet and = doesn't >> even >>> grow the size of MLSPlaintext packets over the current design. >>>=20 >>> For a proposal packet we could also have a confirmation_tag but this = one is >>> computed using the *current* epoch's confirmation_key and >> confirmed_transcript_hash. >>>=20 >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org > >>> https://www.ietf.org/mailman/listinfo/mls = >>=20 >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org > >> https://www.ietf.org/mailman/listinfo/mls = --Apple-Mail=_FE883FF8-0E7B-4904-AC68-CAF55A2D2D68 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = think what you just described is indeed a combination of option 1 & = 2. It=E2=80=99s a MAC over the payload we want to authenticate, but = it=E2=80=99s implicit and we only include it in the MLSPlaintextTBS. Or = in other words, we stripped it from MLSPlaintext because it is = implicitly known to any valid member of the group.

Raphael

On 18 = Aug 2020, at 18:16, Joel Alwen <jalwen@wickr.com> wrote:

Yeah, I like Option 2 here. I = like that it avoids growing packet size.

One caveat though: I'd go for the MAC(...) version rather = than the
confirmation_key. For starters thing including = confirmation_key doesnt
authenticate the contents of the packet. But even if it did, = signatures aren't
meant to hide the contents of what was signed. (Amend you = favorite sig scheme to
tack on the message at the end a signature and you've still = got a secure
signature = scheme. But clearly not a message hiding one.) That means that = AFAIK
neither ECDSA = nor EdDSA etc. were designed or analyzed for such a property. = So
this would = amount to a very non-standard use of a signature schemes by MLS. = Not
saying it = doesn't work for the particular sig schemes in our ciphersuite. = But
its def. not = how signatures are "meant" to be used.

But that leaves Option 2 with, say, including tag =3D = MAC(conf_key,
conf_trans_hash= || MLSPlaintext.content) into whats being signed which I like
and think gets the job done. = Both conf_* values are taken from the current
epoch. By MLSPlaintext.content I = mean whats now called MLSPlaintextTBS.

I would propose that we do need = something additional on Commit messages as
well as = Proposals.

@Richard: For Proopsals I think this works. Is that about = what you had in mind
for commits too?

- Jo=C3=ABl


On 18/08/2020 17:26, Richard Barnes wrote:
Thanks = for pointing this out, Jo=C3=ABl.  I agree that the attacks you're = describing
should work as things are currently = specified.  And they're salient, especially
the = "replace Alice in the group" one.

Also = agree with Raphael is correct that Commit is not affected by this, = since
someone who is not a member won't be able to = generate the right confirmation
value.  However, I = don't think this is actually the right design to adopt for a
general solution to this problem.  Confirmation verifies = group membership
*after* processing the handshake message; = the point here is that we should also
have a membership = check *before* processing handshake messages.  In particular,
I would propose that we do need something additional on = Commit messages as well
as Proposals.

Thinking about solutions here, a couple of options come to = mind:

1. Use MLSCiphertext, but with an = integrity-only encapsulation
2. Incorporate in the = signature something that is only known to the group (e.g.,
confirmation_key or MAC(confirmation_key; = confirmed_transcript_hash ||
Proposal/Commit))

Option (1) has the appeal that you would only = ever send MLSCiphertext, though
switching between = encrypted/not could be problematic.  Option (2) seems a lot
more appealing: It doesn't add any overhead, since the = group-secret value
doesn't need to be sent.  And we = already switch between the signature context
that is added = for group members vs. external.  In fact, I think option (2) = would
just amount to a one-line change to include an = extra, secret value in the
context at the top of the = MLSPlaintextTBS struct.
https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-ml= s-protocol.md#content-signing-and-encryption

The only thing that seems odd about (2) is overloading = signature verification in
that way, i.e., using the = ability to generate a signature over a secret thing to
prove= you know the secret thing.  That doesn't seem obviously flawed to = me, but
worth thinking about.

Does that make sense to folks?

--Richard


On Tue, = Aug 18, 2020 at 10:55 AM Raphael Robert
<raphael=3D40wire.com@dmarc.ietf.org <mailto:40wire.com@dmarc.ietf.org>> wrote:

   Hi Joel,

   For context: this would only apply when = applications use cleartext
   MLSPlaintext = for HS messages. The recommendation is still to encrypt them
   and send them around as MLSCiphertext.
   That being said, we said we would like to = support scenarios where HS
   messages are = not necessarily encrypted.

   Question: would this attack work with = Commit messages? I=E2=80=99m thinking that
   they would be rejected because the attacker = cannot compute the confirmation_tag.

   As you mention in the PS, the easy target = would be Proposal messages.

   I=E2=80=99d be interested to see what = exactly you would propose as a mitigation
   mechanism.

   Raphael

On 18 Aug 2020, at = 16:36, Joel Alwen <jalwen@wickr.com
   <mailto:jalwen@wickr.com>> wrote:

Hey = everyone,

Something thats been bugging = Marta Mularczyk and Daniel Jost and me for a bit
now is = that handshake messages sent out as MLSPlaintext packets are only
authenticated using signatures, but not using the group's key = schedule. For
non-members that makes sense but for group = members that's weaker than need be.

Suppose = Alice is in a group using signing key pair (spk, ssk). I corrupt
   her to
learn ssk. Now I loose access to her device = again. Later she generates a fresh
key package with her = same spk but a new HPKE key for her leaf. She sends
   out and
update proposal for her = new key package and someone commits to the update.

Expected result: she (and the group at large) has achieved = PCS again.

Actual result: using her stolen = ssk I can still forge a new proposal's
   (sent as
MLSPlaintext packets) = coming from Alice. Some things I could do with this
   power:
- I can generate a new key package kp for = Alice using her spk and some
   HPKE key
she doesn't know. Then I = forge an update proposal for Alice with kp. If it
   gets
committed I've effectively kicked her out of = the group.
- I could forge Add's and Remove's coming from = Alice, so I could trick the
group into thinking Alice is = trying to Add my account to the group or remove
some other = group member.

Lemme know if I've missed = something here in that scenario...


If I didn't miss anything and the attacks really work as = advertised then IMO
this is kinda weak sauce and worth = avoiding if possible. So to that end, how
about we modify = MLS such that MLSPlaintext packets coming from group members
must also be authenticated using something from the = application key schedule.
Now the above attacks fail. As = soon as Alice's update is gets committed I no
longer know = the group's key schedule and so can't forged packet from
   Alice. More
generally, this brings = the PCS guarantees when using MLSPlaintexts frameing in
line= with what we're getting from MLSCiphertext packets.

Any thoughts?

- Jo=C3=ABl



PS. For = concreteness, we could probably extend the current mechanism for
   getting
concistancy (the = confirmation_tag) to also provide symmetric key
   authentication.
E.g. include most of the = MLSPlaintext content into whats being tagged by
confirmation_tag. That would cover the case of a commit = packet and doesn't
   even
grow the size of = MLSPlaintext packets over the current design.

For a proposal packet we could also have a confirmation_tag = but this one is
computed using the *current* epoch's = confirmation_key and
   confirmed_transcript_hash.

_______________________________________________
MLS mailing list
MLS@ietf.org <mailto:MLS@ietf.org>
https://www.ietf.org/mailman/listinfo/mls

   _____________________________________________= __
   MLS mailing list
   MLS@ietf.org <mailto:MLS@ietf.org>
   https://www.ietf.org/mailman/listinfo/mls

= --Apple-Mail=_FE883FF8-0E7B-4904-AC68-CAF55A2D2D68-- From nobody Tue Aug 18 09:34:58 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EC5943A0EAC for ; Tue, 18 Aug 2020 09:34:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wSUmIN1LtYsz for ; Tue, 18 Aug 2020 09:34:55 -0700 (PDT) Received: from mail-qt1-x82f.google.com (mail-qt1-x82f.google.com [IPv6:2607:f8b0:4864:20::82f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 74DA83A0F2E for ; Tue, 18 Aug 2020 09:34:53 -0700 (PDT) Received: by mail-qt1-x82f.google.com with SMTP id e5so15568424qth.5 for ; Tue, 18 Aug 2020 09:34:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=cWOE9XzEZMCYeqS37aXBMiH/VA3kMr54zVletvoFxLE=; b=ylA4j8QhEVOoeUnOcrj6Sous/jPj7YUHhxod+GKT2NmIlkaM50wRPz7q0L525rUGqn +1twNnlOO3CcvhHf+5c7qtqGs85czyM554HjclPPyW19WDiG7PcO7ee+an+S32h76Qx2 9pjYWcbUqDUVjTVSWP0KpXlSQn2vzdnc9azFw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=cWOE9XzEZMCYeqS37aXBMiH/VA3kMr54zVletvoFxLE=; b=A4jE/dynburXLg0FlEH45epWDRnz3EOofRP7ss8NcHxnrjWK+UpVZFlihGOQhDGYMK B6EHMEmrywcrFtrVEWbrf+/+NWbc91oJ8Qw/L7sy50qkWi14/dpt+CZPjESbnGHIaURK 0x7hM9Cg1+LlSyr9M3Nd82PG+cpFfUFuIndgniozjNlCDSXPBKHJ7omZgtwXp7GXZ4Um cQax8CrAiHdlGrG5xIrvhRP4WoiyRExDeSvZ5KjSdHE/BnJ/sxOpvDSTCOVy/Avv6b0I DY//rwQtXAlXV72Jama6MoafUA78EK/oWd2merSHYVSWpt3Vcp0mrzOW2EKfgWeXa57H +DMw== X-Gm-Message-State: AOAM5302mnQ+zNDidfqpZiVL/OraADhiemrbpt0cLX3Ya6HlPLx7dSOQ N2n9m2j/A1OLqpQg1b1zpg2EoJh0YgBTBTcN1kYpxQ== X-Google-Smtp-Source: ABdhPJwDC2NbaGWgNcaUkebFMssY5UyHDJnsBoSHDogj9E18jKYbbqnhznKmZNXFX6YyC+nY02nSPXq08nd9v6T0e1Y= X-Received: by 2002:aed:27d5:: with SMTP id m21mr19264377qtg.4.1597768492263; Tue, 18 Aug 2020 09:34:52 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> From: Brendan McMillion Date: Tue, 18 Aug 2020 09:34:41 -0700 Message-ID: To: Joel Alwen Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000006a547d05ad2977ed" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 16:34:57 -0000 --0000000000006a547d05ad2977ed Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > > So to that end, how > about we modify MLS such that MLSPlaintext packets coming from group > members > must also be authenticated using something from the application key > schedule. My objection to this is that Alice can still be impersonated by members in the group, if we only have symmetric forward-secure authentication. There's been some discussion in the past about using forward-secure signatures that might be worth looking into instead, which would fully address this attack vector: https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen wrote: > Hey everyone, > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a > bit > now is that handshake messages sent out as MLSPlaintext packets are only > authenticated using signatures, but not using the group's key schedule. F= or > non-members that makes sense but for group members that's weaker than nee= d > be. > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt > her to > learn ssk. Now I loose access to her device again. Later she generates a > fresh > key package with her same spk but a new HPKE key for her leaf. She sends > out and > update proposal for her new key package and someone commits to the update= . > > Expected result: she (and the group at large) has achieved PCS again. > > Actual result: using her stolen ssk I can still forge a new proposal's > (sent as > MLSPlaintext packets) coming from Alice. Some things I could do with this > power: > - I can generate a new key package kp for Alice using her spk and some > HPKE key > she doesn't know. Then I forge an update proposal for Alice with kp. If i= t > gets > committed I've effectively kicked her out of the group. > - I could forge Add's and Remove's coming from Alice, so I could trick t= he > group into thinking Alice is trying to Add my account to the group or > remove > some other group member. > > Lemme know if I've missed something here in that scenario... > > > If I didn't miss anything and the attacks really work as advertised then > IMO > this is kinda weak sauce and worth avoiding if possible. So to that end, > how > about we modify MLS such that MLSPlaintext packets coming from group > members > must also be authenticated using something from the application key > schedule. > Now the above attacks fail. As soon as Alice's update is gets committed I > no > longer know the group's key schedule and so can't forged packet from > Alice. More > generally, this brings the PCS guarantees when using MLSPlaintexts > frameing in > line with what we're getting from MLSCiphertext packets. > > Any thoughts? > > - Jo=C3=ABl > > > > PS. For concreteness, we could probably extend the current mechanism for > getting > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > E.g. include most of the MLSPlaintext content into whats being tagged by > confirmation_tag. That would cover the case of a commit packet and doesn'= t > even > grow the size of MLSPlaintext packets over the current design. > > For a proposal packet we could also have a confirmation_tag but this one = is > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --0000000000006a547d05ad2977ed Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
So to th= at end, how
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.

My objection to this is that Alice can s= till be impersonated by members in the group, if we only have symmetric for= ward-secure authentication.

There's been some = discussion in the past about using forward-secure signatures that might be = worth looking into instead, which would fully address this attack vector: <= a href=3D"https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cj= ADpw/">https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADp= w/


On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen <<= a href=3D"mailto:jalwen@wickr.com">jalwen@wickr.com> wrote:
Hey everyone,

Something thats been bugging Marta Mularczyk and Daniel Jost and me for a b= it
now is that handshake messages sent out as MLSPlaintext packets are only authenticated using signatures, but not using the group's key schedule.= For
non-members that makes sense but for group members that's weaker than n= eed be.

Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt he= r to
learn ssk. Now I loose access to her device again. Later she generates a fr= esh
key package with her same spk but a new HPKE key for her leaf. She sends ou= t and
update proposal for her new key package and someone commits to the update.<= br>
Expected result: she (and the group at large) has achieved PCS again.

Actual result: using her stolen ssk I can still forge a new proposal's = (sent as
MLSPlaintext packets) coming from Alice. Some things I could do with this p= ower:
=C2=A0- I can generate a new key package kp for Alice using her spk and som= e HPKE key
she doesn't know. Then I forge an update proposal for Alice with kp. If= it gets
committed I've effectively kicked her out of the group.
=C2=A0- I could forge Add's and Remove's coming from Alice, so I co= uld trick the
group into thinking Alice is trying to Add my account to the group or remov= e
some other group member.

Lemme know if I've missed something here in that scenario...


If I didn't miss anything and the attacks really work as advertised the= n IMO
this is kinda weak sauce and worth avoiding if possible. So to that end, ho= w
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.
Now the above attacks fail. As soon as Alice's update is gets committed= I no
longer know the group's key schedule and so can't forged packet fro= m Alice. More
generally, this brings the PCS guarantees when using MLSPlaintexts frameing= in
line with what we're getting from MLSCiphertext packets.

Any thoughts?

- Jo=C3=ABl



PS. For concreteness, we could probably extend the current mechanism for ge= tting
concistancy (the confirmation_tag) to also provide symmetric key authentica= tion.
E.g. include most of the MLSPlaintext content into whats being tagged by confirmation_tag. That would cover the case of a commit packet and doesn= 9;t even
grow the size of MLSPlaintext packets over the current design.

For a proposal packet we could also have a confirmation_tag but this one is=
computed using the *current* epoch's confirmation_key and confirmed_tra= nscript_hash.

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--0000000000006a547d05ad2977ed-- From nobody Tue Aug 18 09:55:13 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9672F3A0F6F for ; Tue, 18 Aug 2020 09:55:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WNpwUv_lCHrh for ; Tue, 18 Aug 2020 09:55:10 -0700 (PDT) Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 309153A0F86 for ; Tue, 18 Aug 2020 09:55:10 -0700 (PDT) Received: by mail-ej1-x62e.google.com with SMTP id jp10so22950341ejb.0 for ; Tue, 18 Aug 2020 09:55:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=DZ0iFGKXqtIqJJmn8BiOI5xndHr6PH8pNjOlPx7fy4Y=; b=nUNANdirj3PCwAHIJLdGDjn1SzDaS+lt9R6kjm1+XsAeQodE/Ay0d/2lfrcX/B3WZK Vvn6A2nt/6mFIiwSvmauYo03V/G78Clsr+u5tLMmwjKFlN5Hbq9BcYsvcw2QOVDRx6ju e5dHxWGO+JAUfcHVKNPXQIfruBBdZ4azBDMZ/iUvgTBhhIyZlI6tadic76tLqICQGLJ9 mgctS/0tNCNeXxAr3cVzawIyUkXcUlDBFUsMkU3tDm4o9qnu9SSWuUYrsJJJvyRrx/Ox fBUW4fA2I5Ai7f0i4s5SaTNirmtJGkICxqx8QmIwJH8WbAWf2NDU/ZX1m025R336QopY t9JA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=DZ0iFGKXqtIqJJmn8BiOI5xndHr6PH8pNjOlPx7fy4Y=; b=ZXw++FIpaenoFX3/rGS8OQ52U3ORvivt+qPdyAAhuGugNSQv4NqYfbiW6ANIEurpBi pRtd9BmkBS/oRepRZXvM9AkyRDm21kDnSMshYrRQ10oGMakjVmCabA15V7puPozJApb+ 7guzy/gJmN2zQVoZNAIbpIolAZK6Z7hRb59x3soBWAOjlI/UrHuoCauta9uSh5bEbIgV oqfU6U7e4bemkuC3YIQ2euuWLJ7kMq7ipoPaE8awPpxH8RI3Diyqjs60jBBxZF7YWPMh TUx2eUsggq7b1Zm2B54VlZBIlEpcotJb/8AAYbysB+f85WYwv+cRCgRp4+Rv2tPjEcti ZGNw== X-Gm-Message-State: AOAM531PJp7s8Bj4pjt9uX824xyFWaoJrcrjIvXKROQggBhI4DyspZCb tR0LmGf4CrkxKJsOIG5pO/3J+R0eD4avjg== X-Google-Smtp-Source: ABdhPJxaAcQPe3lvkbPPCqSXFUIy2qn3RNR0ki3Qk9Y8zTblI0M6fcclnXQsZpLkAfFok568djoTEQ== X-Received: by 2002:a17:906:d102:: with SMTP id b2mr20013556ejz.465.1597769708132; Tue, 18 Aug 2020 09:55:08 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id i35sm4811017edi.41.2020.08.18.09.55.07 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Aug 2020 09:55:07 -0700 (PDT) To: Brendan McMillion Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: <7abf555f-a266-f62f-2a22-8b0f389304d5@wickr.com> Date: Tue, 18 Aug 2020 18:55:07 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 16:55:13 -0000 > My objection to this is that Alice can still be impersonated by members in the group, if we only have symmetric forward-secure authentication. I'm missing how FS sigs (or any other FS auth primitive) helps. My understanding is FS auth primitives prevent leaked keys from being used to authenticate messages in *past* time periods. But the attack involves signing messages for time periods (epochs) after the leak occurred not before the leak. Imagine we could deterministically ratchet sig key pairs forward much like we can MAC keys. We'd have an FS sig scheme but I dont see how this fixes the problem. Which is not to say that FS sigs dont solve an auth problem for MLS. Just, AFAIK, not this one. (Rather they help prevent forgeries in bygone epochs.) What I do agree with is that other group members (that know Alice's sig key) can still impersonate her in future epochs till she updates the key. The same is true when sending MLSCiphertexts. Unfortunately, for epochs between when Alice's state is leaked and when Alice finally updates her (authentication specific) asymmetric key material I see no way around this. It seems inherent to the adversarial model since other group member know and can do everything Alice can during those epochs. One thing we could look at are PCS signatures. Something like the Updateable PKE scheme in the RTreeKEM work. Namely every time you sign you also re-randomize your signing key (or simply sample new ones). That way leaking your old key doesnt let me sign under your re-randomized new key just like in UPKE leaking your old decryption key doesnt let me read ciphertexts encrypted to your re-randomized new key. Make sense? - Joël On 18/08/2020 18:34, Brendan McMillion wrote: > So to that end, how > about we modify MLS such that MLSPlaintext packets coming from group members > must also be authenticated using something from the application key schedule. > > > My objection to this is that Alice can still be impersonated by members in the > group, if we only have symmetric forward-secure authentication. > > There's been some discussion in the past about using forward-secure signatures > that might be worth looking into instead, which would fully address this attack > vector: https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ > > > On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen > wrote: > > Hey everyone, > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a bit > now is that handshake messages sent out as MLSPlaintext packets are only > authenticated using signatures, but not using the group's key schedule. For > non-members that makes sense but for group members that's weaker than need be. > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt her to > learn ssk. Now I loose access to her device again. Later she generates a fresh > key package with her same spk but a new HPKE key for her leaf. She sends out and > update proposal for her new key package and someone commits to the update. > > Expected result: she (and the group at large) has achieved PCS again. > > Actual result: using her stolen ssk I can still forge a new proposal's (sent as > MLSPlaintext packets) coming from Alice. Some things I could do with this power: >  - I can generate a new key package kp for Alice using her spk and some HPKE key > she doesn't know. Then I forge an update proposal for Alice with kp. If it gets > committed I've effectively kicked her out of the group. >  - I could forge Add's and Remove's coming from Alice, so I could trick the > group into thinking Alice is trying to Add my account to the group or remove > some other group member. > > Lemme know if I've missed something here in that scenario... > > > If I didn't miss anything and the attacks really work as advertised then IMO > this is kinda weak sauce and worth avoiding if possible. So to that end, how > about we modify MLS such that MLSPlaintext packets coming from group members > must also be authenticated using something from the application key schedule. > Now the above attacks fail. As soon as Alice's update is gets committed I no > longer know the group's key schedule and so can't forged packet from Alice. More > generally, this brings the PCS guarantees when using MLSPlaintexts frameing in > line with what we're getting from MLSCiphertext packets. > > Any thoughts? > > - Joël > > > > PS. For concreteness, we could probably extend the current mechanism for getting > concistancy (the confirmation_tag) to also provide symmetric key authentication. > E.g. include most of the MLSPlaintext content into whats being tagged by > confirmation_tag. That would cover the case of a commit packet and doesn't even > grow the size of MLSPlaintext packets over the current design. > > For a proposal packet we could also have a confirmation_tag but this one is > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > From nobody Tue Aug 18 10:20:46 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7DFDA3A079F for ; Tue, 18 Aug 2020 10:20:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u-CXI9atfnG1 for ; Tue, 18 Aug 2020 10:20:42 -0700 (PDT) Received: from mail-qk1-x736.google.com (mail-qk1-x736.google.com [IPv6:2607:f8b0:4864:20::736]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4CC273A0788 for ; Tue, 18 Aug 2020 10:20:42 -0700 (PDT) Received: by mail-qk1-x736.google.com with SMTP id n129so18972973qkd.6 for ; Tue, 18 Aug 2020 10:20:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=YFEnYxFmK/+VdV9hQq0inKGQCXyumB4cCj9Pj0OQvls=; b=GtgP20+LOR7DJw/DbBP8YVovxL3yh3kWp+hmkyistnohrc1XBdcQ25BOkLy55lcaw1 R48b8aNAiXfOMf6N4nctzqgkt/MTD8OLSeXFJbj2AsC3F16lOsFOFDISZSd9qz4XawaL e8cLGFyNlbm1ANeDn+1uPfyxVuCi46ROE26VE+yULzcdTA4IxXPasOBPFjMVfkuM3QGT NHVgrEuKneV+WweLFm3aIIsqVMx/1cIM6qvMJHYsmIqZ/Y2fkd8sbdnvNWXE2H+ouhqY Ojo2F7jQNYoCYatZ+V08+tSAQNUOhhFORw3CFc9WffudikiMi1ozwhd55Nbzh6BnLYH5 qtYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=YFEnYxFmK/+VdV9hQq0inKGQCXyumB4cCj9Pj0OQvls=; b=qRPmPqW8Zq/3OGsBVg9imtWpBG7J8w5YWf1frls7lLqKpxZ1WPYDEomdr8IUoTORGf G2TzaDkg5r6EMpbOPe90SZmuqBpdcBh2nfZniv5+IcqD7uI5/lvwqP1qH3kvNuZ+fboZ QfTN9RXQMYJKbAHJuhrlAHQWiZDOOBLdvMrTqtwo+T5IRrTcnjFeB1APzMdP4yv8bKve 9H3Ry6tXsxGgIMy8LCBJLZDg8WHEMjQICU6F597NhP3pROlto4hx8JnanLKvm3SqYVNe EXnMAW93kW24FYGyH55hClzXeskT8BNMmCJUosGo+gFiWJryA5YGrfMk4OY8f0zXcIc6 8roA== X-Gm-Message-State: AOAM532ho2ae0aAEFII8YFarxZ9O6yiqNZERrCAS7vh9ZBiob9WATR58 hO+PqvufArcsQmfDEwuGya7KosIsUkdSSjUcKil5cw== X-Google-Smtp-Source: ABdhPJz7s5ih8QjkhfJDlVSyZQw1FAZ3wqUHelHOUYHbFPO0UN0uMgWg3EPYCD/AItlA1V4WJmQFnELf1l0VTKee2T8= X-Received: by 2002:a05:620a:132c:: with SMTP id p12mr17900611qkj.159.1597771240893; Tue, 18 Aug 2020 10:20:40 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> In-Reply-To: <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> From: Richard Barnes Date: Tue, 18 Aug 2020 13:20:20 -0400 Message-ID: To: Raphael Robert Cc: Joel Alwen , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000003f1a1005ad2a1b05" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 17:20:45 -0000 --0000000000003f1a1005ad2a1b05 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Sounds like we're converging here. The only question in my mind is what goes in the MAC -- seems like the easy option is probably "the remainder of the MLSPlaintextTBS", i.e., everything from group_id to the end. That seems like it minimizes multiple serialization: tbs_content =3D serialize(group_id, ...) membership_token =3D KDF.Extract(confirmation_key, tbs_content) tbs =3D group_context || membership_token || tbs_content So the PR would be to basically pop the context off of MLSPlaintextTBS and add the three lines above (with the switch for internal/external in prose). Jo=C3=ABl, do you want to write a PR? If not, I could probably get to it i= n the next couple days. --Richard On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert wrote: > I think what you just described is indeed a combination of option 1 & 2. > It=E2=80=99s a MAC over the payload we want to authenticate, but it=E2=80= =99s implicit and > we only include it in the MLSPlaintextTBS. Or in other words, we stripped > it from MLSPlaintext because it is implicitly known to any valid member o= f > the group. > > Raphael > > On 18 Aug 2020, at 18:16, Joel Alwen wrote: > > Yeah, I like Option 2 here. I like that it avoids growing packet size. > > One caveat though: I'd go for the MAC(...) version rather than the > confirmation_key. For starters thing including confirmation_key doesnt > authenticate the contents of the packet. But even if it did, signatures > aren't > meant to hide the contents of what was signed. (Amend you favorite sig > scheme to > tack on the message at the end a signature and you've still got a secure > signature scheme. But clearly not a message hiding one.) That means that > AFAIK > neither ECDSA nor EdDSA etc. were designed or analyzed for such a > property. So > this would amount to a very non-standard use of a signature schemes by > MLS. Not > saying it doesn't work for the particular sig schemes in our ciphersuite. > But > its def. not how signatures are "meant" to be used. > > But that leaves Option 2 with, say, including tag =3D MAC(conf_key, > conf_trans_hash || MLSPlaintext.content) into whats being signed which I > like > and think gets the job done. Both conf_* values are taken from the curren= t > epoch. By MLSPlaintext.content I mean whats now called MLSPlaintextTBS. > > I would propose that we do need something additional on Commit messages a= s > well as Proposals. > > > @Richard: For Proopsals I think this works. Is that about what you had in > mind > for commits too? > > - Jo=C3=ABl > > > On 18/08/2020 17:26, Richard Barnes wrote: > > Thanks for pointing this out, Jo=C3=ABl. I agree that the attacks you're > describing > should work as things are currently specified. And they're salient, > especially > the "replace Alice in the group" one. > > Also agree with Raphael is correct that Commit is not affected by this, > since > someone who is not a member won't be able to generate the right > confirmation > value. However, I don't think this is actually the right design to adopt > for a > general solution to this problem. Confirmation verifies group membership > *after* processing the handshake message; the point here is that we shoul= d > also > have a membership check *before* processing handshake messages. In > particular, > I would propose that we do need something additional on Commit messages a= s > well > as Proposals. > > Thinking about solutions here, a couple of options come to mind: > > 1. Use MLSCiphertext, but with an integrity-only encapsulation > 2. Incorporate in the signature something that is only known to the group > (e.g., > confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || > Proposal/Commit)) > > Option (1) has the appeal that you would only ever send MLSCiphertext, > though > switching between encrypted/not could be problematic. Option (2) seems a > lot > more appealing: It doesn't add any overhead, since the group-secret value > doesn't need to be sent. And we already switch between the signature > context > that is added for group members vs. external. In fact, I think option (2= ) > would > just amount to a one-line change to include an extra, secret value in the > context at the top of the MLSPlaintextTBS struct. > > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol= .md#content-signing-and-encryption > > The only thing that seems odd about (2) is overloading signature > verification in > that way, i.e., using the ability to generate a signature over a secret > thing to > prove you know the secret thing. That doesn't seem obviously flawed to > me, but > worth thinking about. > > Does that make sense to folks? > > --Richard > > > On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > <40wire.com@dmarc.ietf.org>>> wrote: > > Hi Joel, > > For context: this would only apply when applications use cleartext > MLSPlaintext for HS messages. The recommendation is still to encrypt > them > and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS > messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I=E2=80=99m thi= nking that > they would be rejected because the attacker cannot compute the > confirmation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I=E2=80=99d be interested to see what exactly you would propose as a m= itigation > mechanism. > > Raphael > > On 18 Aug 2020, at 16:36, Joel Alwen > >> wrote: > > > Hey everyone, > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a > bit > now is that handshake messages sent out as MLSPlaintext packets are only > authenticated using signatures, but not using the group's key schedule. F= or > non-members that makes sense but for group members that's weaker than nee= d > be. > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt > > her to > > learn ssk. Now I loose access to her device again. Later she generates a > fresh > key package with her same spk but a new HPKE key for her leaf. She sends > > out and > > update proposal for her new key package and someone commits to the update= . > > Expected result: she (and the group at large) has achieved PCS again. > > Actual result: using her stolen ssk I can still forge a new proposal's > > (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do with this > > power: > > - I can generate a new key package kp for Alice using her spk and some > > HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp. If i= t > > gets > > committed I've effectively kicked her out of the group. > - I could forge Add's and Remove's coming from Alice, so I could trick th= e > group into thinking Alice is trying to Add my account to the group or > remove > some other group member. > > Lemme know if I've missed something here in that scenario... > > > If I didn't miss anything and the attacks really work as advertised then > IMO > this is kinda weak sauce and worth avoiding if possible. So to that end, > how > about we modify MLS such that MLSPlaintext packets coming from group > members > must also be authenticated using something from the application key > schedule. > Now the above attacks fail. As soon as Alice's update is gets committed I > no > longer know the group's key schedule and so can't forged packet from > > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts > frameing in > line with what we're getting from MLSCiphertext packets. > > Any thoughts? > > - Jo=C3=ABl > > > > PS. For concreteness, we could probably extend the current mechanism for > > getting > > concistancy (the confirmation_tag) to also provide symmetric key > > authentication. > > E.g. include most of the MLSPlaintext content into whats being tagged by > confirmation_tag. That would cover the case of a commit packet and doesn'= t > > even > > grow the size of MLSPlaintext packets over the current design. > > For a proposal packet we could also have a confirmation_tag but this one = is > computed using the *current* epoch's confirmation_key and > > confirmed_transcript_hash. > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > _______________________________________________ > MLS mailing list > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > --0000000000003f1a1005ad2a1b05 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Sounds like we're converging here.=C2=A0 The only= question in my mind is what goes in the MAC -- seems like the easy option = is probably "the remainder of the MLSPlaintextTBS", i.e., everyth= ing from group_id to the end.=C2=A0 That seems like it minimizes multiple s= erialization:

tbs_content =3D serialize(group_id, = ...)
membership_token =3D KDF.Extract(confirmation_key, tbs_conte= nt)
tbs =3D group_context || membership_token || tbs_content

So the PR would be to basically pop the context off of= MLSPlaintextTBS and add the three lines above (with the switch for interna= l/external in prose).

Jo=C3=ABl, do you want to wr= ite a PR?=C2=A0 If not, I could probably get to it in the next couple days.=

--Richard

On Tue, Aug 18, 2020 at 12:24 = PM Raphael Robert <raphael@wire.com<= /a>> wrote:
<= div style=3D"overflow-wrap: break-word;">I think what you just described is= indeed a combination of option 1 & 2. It=E2=80=99s a MAC over the payl= oad we want to authenticate, but it=E2=80=99s implicit and we only include = it in the MLSPlaintextTBS. Or in other words, we stripped it from MLSPlaint= ext because it is implicitly known to any valid member of the group.
Raphael


Yeah, I like Option 2 here. I like that it avoi= ds growing packet size.

One caveat though: I'd go fo= r the MAC(...) version rather than the
confirmation_key. For starters thing = including confirmation_key doesnt
authenticate the contents of the packet. B= ut even if it did, signatures aren't
meant to hide the contents of what = was signed. (Amend you favorite sig scheme to
tack on the message at the end= a signature and you've still got a secure
signature scheme. But clearly= not a message hiding one.) That means that AFAIK
neither ECDSA nor EdDSA et= c. were designed or analyzed for such a property. So
this would amount to a = very non-standard use of a signature schemes by MLS. Not
saying it doesn'= ;t work for the particular sig schemes in our ciphersuite. But
its def. not = how signatures are "meant" to be used.
=
But tha= t leaves Option 2 with, say, including tag =3D MAC(conf_key,
conf_trans_hash= || MLSPlaintext.content) into whats being signed which I like
and think get= s the job done. Both conf_* values are taken from the current
epoch. By MLSP= laintext.content I mean whats now called MLSPlaintextTBS.

I = would propose that we do need something additional on Commit messages aswell as Proposals.

@Richard: For Proopsals I think this works. Is= that about what you had in mind
for commits too?
=
- Jo=C3= =ABl


On 18/08/2020 17:26, Richard Ba= rnes wrote:
Thanks for pointing this out, Jo=C3=ABl.=C2=A0 I agree that the attack= s you're describing
should work as things are currently specified.= =C2=A0 And they're salient, especially
the "replace Alice in th= e group" one.

Also agree with Raphael is correct that Commit is= not affected by this, since
someone who is not a member won't be ab= le to generate the right confirmation
value.=C2=A0 However, I don't = think this is actually the right design to adopt for a
general solution = to this problem.=C2=A0 Confirmation verifies group membership
*after* pr= ocessing the handshake message; the point here is that we should also
ha= ve a membership check *before* processing handshake messages.=C2=A0 In part= icular,
I would propose that we do need something additional on Commit m= essages as well
as Proposals.

Thinking about solutions here, a co= uple of options come to mind:

1. Use MLSCiphertext, but with an inte= grity-only encapsulation
2. Incorporate in the signature something that = is only known to the group (e.g.,
confirmation_key or MAC(confirmation_k= ey; confirmed_transcript_hash ||
Proposal/Commit))

Option (1) has= the appeal that you would only ever send MLSCiphertext, though
switchin= g between encrypted/not could be problematic.=C2=A0 Option (2) seems a lot<= br>more appealing: It doesn't add any overhead, since the group-secret = value
doesn't need to be sent.=C2=A0 And we already switch between t= he signature context
that is added for group members vs. external.=C2=A0= In fact, I think option (2) would
just amount to a one-line change to i= nclude an extra, secret value in the
context at the top of the MLSPlaint= extTBS struct.
https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-prot= ocol.md#content-signing-and-encryption

The only thing that seems= odd about (2) is overloading signature verification in
that way, i.e., = using the ability to generate a signature over a secret thing to
prove y= ou know the secret thing.=C2=A0 That doesn't seem obviously flawed to m= e, but
worth thinking about.

Does that make sense to folks?
--Richard


On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert
&= lt;raphael=3D40wire.com@dmarc.ietf.org=C2=A0<mailto:40wire.com@dmarc.= ietf.org>> wrote:

=C2=A0=C2=A0=C2=A0Hi Joel,

=C2=A0= =C2=A0=C2=A0For context: this would only apply when applications use cleart= ext
=C2=A0=C2=A0=C2=A0MLSPlaintext for HS messages. The recommendation i= s still to encrypt them
=C2=A0=C2=A0=C2=A0and send them around as MLSCip= hertext.
=C2=A0=C2=A0=C2=A0That being said, we said we would like to sup= port scenarios where HS
=C2=A0=C2=A0=C2=A0messages are not necessarily e= ncrypted.

=C2=A0=C2=A0=C2=A0Question: would this attack work with Co= mmit messages? I=E2=80=99m thinking that
=C2=A0=C2=A0=C2=A0they would be= rejected because the attacker cannot compute the confirmation_tag.

= =C2=A0=C2=A0=C2=A0As you mention in the PS, the easy target would be Propos= al messages.

=C2=A0=C2=A0=C2=A0I=E2=80=99d be interested to see what= exactly you would propose as a mitigation
=C2=A0=C2=A0=C2=A0mechanism.<= br>
=C2=A0=C2=A0=C2=A0Raphael

On 18 Aug= 2020, at 16:36, Joel Alwen <jalwen@wickr.com
=C2=A0=C2=A0=C2=A0<mailto:jalwen@wickr.com>> wrote:

Hey everyone,

Som= ething thats been bugging Marta Mularczyk and Daniel Jost and me for a bit<= br>now is that handshake messages sent out as MLSPlaintext packets are only=
authenticated using signatures, but not using the group's key sched= ule. For
non-members that makes sense but for group members that's w= eaker than need be.

Suppose Alice is in a group using signing key pa= ir (spk, ssk). I corrupt
=C2=A0=C2=A0=C2=A0her to
learn ssk. Now I loose access to her device again. Late= r she generates a fresh
key package with her same spk but a new HPKE key= for her leaf. She sends
=C2=A0=C2=A0=C2=A0out and
update proposal for her new key package and someone co= mmits to the update.

Expected result: she (and the group at large) h= as achieved PCS again.

Actual result: using her stolen ssk I can sti= ll forge a new proposal's
=C2=A0=C2=A0=C2=A0(sent as
MLSPlaintext packets) coming from Alice. Some th= ings I could do with this
=C2=A0=C2=A0=C2=A0power:
- I can generate a new key package kp for Alice using = her spk and some
=C2=A0=C2=A0=C2=A0HPKE key
she doesn't know. Then I forge an update proposal for Ali= ce with kp. If it
=C2=A0=C2=A0=C2=A0gets
committed I've effectively kicked her out of the group.
-= I could forge Add's and Remove's coming from Alice, so I could tri= ck the
group into thinking Alice is trying to Add my account to the grou= p or remove
some other group member.

Lemme know if I've misse= d something here in that scenario...


If I didn't miss anythi= ng and the attacks really work as advertised then IMO
this is kinda weak= sauce and worth avoiding if possible. So to that end, how
about we modi= fy MLS such that MLSPlaintext packets coming from group members
must als= o be authenticated using something from the application key schedule.
No= w the above attacks fail. As soon as Alice's update is gets committed I= no
longer know the group's key schedule and so can't forged pac= ket from
=C2=A0=C2=A0=C2=A0Alice. More
generally, this brings the PCS guarantees when using MLSPlaintext= s frameing in
line with what we're getting from MLSCiphertext packet= s.

Any thoughts?

- Jo=C3=ABl



PS. For concreten= ess, we could probably extend the current mechanism for
=C2= =A0=C2=A0=C2=A0getting
concistancy (the confir= mation_tag) to also provide symmetric key
=C2=A0=C2=A0=C2= =A0authentication.
E.g. include most of the ML= SPlaintext content into whats being tagged by
confirmation_tag. That wou= ld cover the case of a commit packet and doesn't
=C2=A0= =C2=A0=C2=A0even
grow the size of MLSPlaintext= packets over the current design.

For a proposal packet we could als= o have a confirmation_tag but this one is
computed using the *current* e= poch's confirmation_key and
=C2=A0=C2=A0=C2=A0confirmed= _transcript_hash.

________________________= _______________________
MLS mailing list
MLS@ietf.org=C2=A0<mailto:MLS@ietf.org>
https://ww= w.ietf.org/mailman/listinfo/mls

=C2=A0=C2=A0=C2=A0_= ______________________________________________
=C2=A0=C2=A0=C2=A0MLS mai= ling list
=C2=A0=C2=A0=C2=A0MLS@ietf.org=C2=A0<mailto:MLS@ietf.org>
=C2=A0=C2=A0=C2=A0https://w= ww.ietf.org/mailman/listinfo/mls
<= br>
--0000000000003f1a1005ad2a1b05-- From nobody Tue Aug 18 10:30:30 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C7A33A086C for ; Tue, 18 Aug 2020 10:30:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MzGkVFPq7_KH for ; Tue, 18 Aug 2020 10:30:26 -0700 (PDT) Received: from mail-ej1-x62e.google.com (mail-ej1-x62e.google.com [IPv6:2a00:1450:4864:20::62e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EF3953A086A for ; Tue, 18 Aug 2020 10:30:25 -0700 (PDT) Received: by mail-ej1-x62e.google.com with SMTP id a26so23056839ejc.2 for ; Tue, 18 Aug 2020 10:30:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=+A8+18wJhvjEtU2e2Kx/7XqCV2cozFMrRMBkGJ3ntJk=; b=yfyWjh1L7a8Z7waosmjdXFhQJG45NoyghEwlga+9Vz9oBpfqn0Q4Z/IXzxQRnIDjux JgsrQnEvjEXbmXsDXOHNELuWSCdkNwXf4clJyd0DcJG8kzcLR42X4a3wdhzj0cJIjM3U yD2zF505pFHelnps3dhZJ7tuasp8u5vZ59iNYLRtcPb+K0UvPfB0DWFy9oJmemzAIrdg eSqtcC5zY5+jxvADs8Oo4e6MwyspFBj0w1dPRwzCkJ1uTrPmKbjocRn/2eLs5FGkW//A jqDxQKwAUq+h50lL9lfaVNWL4wxahx25cbYDz6NCQZ7+oXWu78vnmAnyBKLQkTY27Fe8 ddyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=+A8+18wJhvjEtU2e2Kx/7XqCV2cozFMrRMBkGJ3ntJk=; b=siBDTwkFno3TXTd0PvJy5J+IcLZeMUsyAprhZ00XOBy1XLKVYnBAN6jVg/7+lZe3Mf ppEj5SPSiAJ2pxvpYREGdNQdq8bg6UQKdFDg/J5Pv0aqnLOfAAi0Gdi7yYGf/bioL7qY 9BjuCIjRHlxI54nTsndqhVqNISvV3w5s9ZhIEsF1t14gh2v0Oxa6qg7YSlb0JH8/Nb6P Rh02wkKkJ6ldjs9U9HhEjsAcRosU2bS9REdu2zSH/JeDENtkjuxRkQxyGYKHvizEf1Ke Bw5eGX1gqdetnaGG7sUAPBWjr/cbD5Hhmj2NRyUaZqbI66JtZtr7JhG0sScSinuic1Pd xcbQ== X-Gm-Message-State: AOAM5336tlinJRhXj1Z53fL0F1YQRkrvOXHun8XPuENimqivOo6hbHEK 7Cwq2avaqmvskpCtKPqyGTjWCtbsPlfsBw== X-Google-Smtp-Source: ABdhPJzaXKp2OcnAsOPYDYukxUMaQ1IsIpBptSd1dHN9T0E4gNZ1ufrDAMq6MfX3hg1M6n3BRVzzJA== X-Received: by 2002:a17:906:f24c:: with SMTP id gy12mr333487ejb.275.1597771823829; Tue, 18 Aug 2020 10:30:23 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id t18sm15883390edr.79.2020.08.18.10.30.22 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Aug 2020 10:30:23 -0700 (PDT) To: Richard Barnes , Raphael Robert Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: Date: Tue, 18 Aug 2020 19:30:22 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 17:30:29 -0000 > Joël, do you want to write a PR? If not, I could probably get to it in the > next couple days. Thanks. :-) If you could that would be really nice. - Joël On 18/08/2020 19:20, Richard Barnes wrote: > Sounds like we're converging here.  The only question in my mind is what goes in > the MAC -- seems like the easy option is probably "the remainder of the > MLSPlaintextTBS", i.e., everything from group_id to the end.  That seems like it > minimizes multiple serialization: > > tbs_content = serialize(group_id, ...) > membership_token = KDF.Extract(confirmation_key, tbs_content) > tbs = group_context || membership_token || tbs_content > > So the PR would be to basically pop the context off of MLSPlaintextTBS and add > the three lines above (with the switch for internal/external in prose). > > Joël, do you want to write a PR?  If not, I could probably get to it in the next > couple days. > > --Richard > > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert > wrote: > > I think what you just described is indeed a combination of option 1 & 2. > It’s a MAC over the payload we want to authenticate, but it’s implicit and > we only include it in the MLSPlaintextTBS. Or in other words, we stripped it > from MLSPlaintext because it is implicitly known to any valid member of the > group. > > Raphael > >> On 18 Aug 2020, at 18:16, Joel Alwen > > wrote: >> >> Yeah, I like Option 2 here. I like that it avoids growing packet size. >> >> One caveat though: I'd go for the MAC(...) version rather than the >> confirmation_key. For starters thing including confirmation_key doesnt >> authenticate the contents of the packet. But even if it did, signatures aren't >> meant to hide the contents of what was signed. (Amend you favorite sig >> scheme to >> tack on the message at the end a signature and you've still got a secure >> signature scheme. But clearly not a message hiding one.) That means that AFAIK >> neither ECDSA nor EdDSA etc. were designed or analyzed for such a property. So >> this would amount to a very non-standard use of a signature schemes by >> MLS. Not >> saying it doesn't work for the particular sig schemes in our ciphersuite. But >> its def. not how signatures are "meant" to be used. >> >> But that leaves Option 2 with, say, including tag = MAC(conf_key, >> conf_trans_hash || MLSPlaintext.content) into whats being signed which I like >> and think gets the job done. Both conf_* values are taken from the current >> epoch. By MLSPlaintext.content I mean whats now called MLSPlaintextTBS. >> >>> I would propose that we do need something additional on Commit messages as >>> well as Proposals. >> >> @Richard: For Proopsals I think this works. Is that about what you had in mind >> for commits too? >> >> - Joël >> >> >> On 18/08/2020 17:26, Richard Barnes wrote: >>> Thanks for pointing this out, Joël.  I agree that the attacks you're >>> describing >>> should work as things are currently specified.  And they're salient, >>> especially >>> the "replace Alice in the group" one. >>> >>> Also agree with Raphael is correct that Commit is not affected by this, since >>> someone who is not a member won't be able to generate the right confirmation >>> value.  However, I don't think this is actually the right design to adopt >>> for a >>> general solution to this problem.  Confirmation verifies group membership >>> *after* processing the handshake message; the point here is that we >>> should also >>> have a membership check *before* processing handshake messages.  In >>> particular, >>> I would propose that we do need something additional on Commit messages >>> as well >>> as Proposals. >>> >>> Thinking about solutions here, a couple of options come to mind: >>> >>> 1. Use MLSCiphertext, but with an integrity-only encapsulation >>> 2. Incorporate in the signature something that is only known to the group >>> (e.g., >>> confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || >>> Proposal/Commit)) >>> >>> Option (1) has the appeal that you would only ever send MLSCiphertext, though >>> switching between encrypted/not could be problematic.  Option (2) seems a lot >>> more appealing: It doesn't add any overhead, since the group-secret value >>> doesn't need to be sent.  And we already switch between the signature context >>> that is added for group members vs. external.  In fact, I think option >>> (2) would >>> just amount to a one-line change to include an extra, secret value in the >>> context at the top of the MLSPlaintextTBS struct. >>> https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption >>> >>> The only thing that seems odd about (2) is overloading signature >>> verification in >>> that way, i.e., using the ability to generate a signature over a secret >>> thing to >>> prove you know the secret thing.  That doesn't seem obviously flawed to >>> me, but >>> worth thinking about. >>> >>> Does that make sense to folks? >>> >>> --Richard >>> >>> >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert >>> >>  > >>> wrote: >>> >>>    Hi Joel, >>> >>>    For context: this would only apply when applications use cleartext >>>    MLSPlaintext for HS messages. The recommendation is still to encrypt them >>>    and send them around as MLSCiphertext. >>>    That being said, we said we would like to support scenarios where HS >>>    messages are not necessarily encrypted. >>> >>>    Question: would this attack work with Commit messages? I’m thinking that >>>    they would be rejected because the attacker cannot compute the >>> confirmation_tag. >>> >>>    As you mention in the PS, the easy target would be Proposal messages. >>> >>>    I’d be interested to see what exactly you would propose as a mitigation >>>    mechanism. >>> >>>    Raphael >>> >>>> On 18 Aug 2020, at 16:36, Joel Alwen >>> >>>    > wrote: >>>> >>>> Hey everyone, >>>> >>>> Something thats been bugging Marta Mularczyk and Daniel Jost and me for >>>> a bit >>>> now is that handshake messages sent out as MLSPlaintext packets are only >>>> authenticated using signatures, but not using the group's key schedule. For >>>> non-members that makes sense but for group members that's weaker than >>>> need be. >>>> >>>> Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt >>>    her to >>>> learn ssk. Now I loose access to her device again. Later she generates a >>>> fresh >>>> key package with her same spk but a new HPKE key for her leaf. She sends >>>    out and >>>> update proposal for her new key package and someone commits to the update. >>>> >>>> Expected result: she (and the group at large) has achieved PCS again. >>>> >>>> Actual result: using her stolen ssk I can still forge a new proposal's >>>    (sent as >>>> MLSPlaintext packets) coming from Alice. Some things I could do with this >>>    power: >>>> - I can generate a new key package kp for Alice using her spk and some >>>    HPKE key >>>> she doesn't know. Then I forge an update proposal for Alice with kp. If it >>>    gets >>>> committed I've effectively kicked her out of the group. >>>> - I could forge Add's and Remove's coming from Alice, so I could trick the >>>> group into thinking Alice is trying to Add my account to the group or remove >>>> some other group member. >>>> >>>> Lemme know if I've missed something here in that scenario... >>>> >>>> >>>> If I didn't miss anything and the attacks really work as advertised then IMO >>>> this is kinda weak sauce and worth avoiding if possible. So to that end, how >>>> about we modify MLS such that MLSPlaintext packets coming from group members >>>> must also be authenticated using something from the application key >>>> schedule. >>>> Now the above attacks fail. As soon as Alice's update is gets committed I no >>>> longer know the group's key schedule and so can't forged packet from >>>    Alice. More >>>> generally, this brings the PCS guarantees when using MLSPlaintexts >>>> frameing in >>>> line with what we're getting from MLSCiphertext packets. >>>> >>>> Any thoughts? >>>> >>>> - Joël >>>> >>>> >>>> >>>> PS. For concreteness, we could probably extend the current mechanism for >>>    getting >>>> concistancy (the confirmation_tag) to also provide symmetric key >>>    authentication. >>>> E.g. include most of the MLSPlaintext content into whats being tagged by >>>> confirmation_tag. That would cover the case of a commit packet and doesn't >>>    even >>>> grow the size of MLSPlaintext packets over the current design. >>>> >>>> For a proposal packet we could also have a confirmation_tag but this one is >>>> computed using the *current* epoch's confirmation_key and >>>    confirmed_transcript_hash. >>>> >>>> _______________________________________________ >>>> MLS mailing list >>>> MLS@ietf.org   >>>> https://www.ietf.org/mailman/listinfo/mls >>> >>>    _______________________________________________ >>>    MLS mailing list >>>    MLS@ietf.org   >>>    https://www.ietf.org/mailman/listinfo/mls > From nobody Tue Aug 18 10:37:09 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CFF143A088C for ; Tue, 18 Aug 2020 10:37:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P5vxcXG4x_op for ; Tue, 18 Aug 2020 10:37:05 -0700 (PDT) Received: from mail-qv1-xf2e.google.com (mail-qv1-xf2e.google.com [IPv6:2607:f8b0:4864:20::f2e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 9024C3A088A for ; Tue, 18 Aug 2020 10:37:05 -0700 (PDT) Received: by mail-qv1-xf2e.google.com with SMTP id j10so9915504qvo.13 for ; Tue, 18 Aug 2020 10:37:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=q4YfoYK+bD8WyG0Ib8J342bEBZjmhz8Afu+Kawkt5HQ=; b=CoVCuAbjTtyj8ESGTv0j5OflRq9+pPXRtom2292lRs+l6evk4sWzOV76B9115vCdlp 0kxXqzBixl5ySjDhQuz/1AbRO5hV8/JTxTu7amTLt9AhF7uh97FrtJPC2XWgsKgE4eLM ip00eojjclltEWaZ411eCuEvJAK4X16vsm3+8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=q4YfoYK+bD8WyG0Ib8J342bEBZjmhz8Afu+Kawkt5HQ=; b=Bo9Onl3iyc6EAEN1KdHPVmBpk1y6pkRSRlXb6MHWN8akXqwhl/ldfxVDSVlR70SwIv FXrlAh3XnQQSwbTVx9ZcleO0jBlmg/+e9x8obGC76DYscpa+LlZvSbC+92Xupu9mahse jdFBzTCUWHEp3JOvAX3QdGRA+rBOZJzbGwpsrw+gEakuI9O/sA1zrII7f3PxEFJywaKG 1WVQIMv2Upi+PBl6br/L/TpNAnZINC6d8PfY223p8CkZvzXSiVdg36FXXt9B9y9Oa+ys /BVWxQrZGz8r9iGLioL70he5udmLjrNkizerAk2QuMxvod7PlF5gywAlXx0bxT/InFCN fIwQ== X-Gm-Message-State: AOAM5305px7/U0LFbuMzF4zMYAFpzKEfC0xIiI6iUvD9H5nzPppYTrl7 M2WxPos8tNhUEWxyprtBtio2mA4VnxWMLCIc7G3WjQdy3IaJsQ== X-Google-Smtp-Source: ABdhPJzIQ0DttwiuWTnr/8OaTYuCWOuomul2o1AjwmhbaD1PU/sp7/cGkDX7WbnETNUcq/mQL4iuibgZc5e18AO3x8s= X-Received: by 2002:ad4:41c9:: with SMTP id a9mr19951427qvq.171.1597772224471; Tue, 18 Aug 2020 10:37:04 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <7abf555f-a266-f62f-2a22-8b0f389304d5@wickr.com> In-Reply-To: <7abf555f-a266-f62f-2a22-8b0f389304d5@wickr.com> From: Brendan McMillion Date: Tue, 18 Aug 2020 10:36:53 -0700 Message-ID: To: Joel Alwen Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000dfdd9d05ad2a5522" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 17:37:08 -0000 --000000000000dfdd9d05ad2a5522 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I actually describe in the thread I linked how to take a standard FS signature and turn it into a PCS signature. While it's baked into the primitive, essentially what's happening is that every time Alice sends an Update, she generates a new signing key and certifies it with her old signing key before discarding the old signing key. So if Alice's Update is accepted by the group, anyone who compromised the old signing key can't sign new messages because they don't have the private key of the *new* signing key. On Tue, Aug 18, 2020 at 9:55 AM Joel Alwen wrote: > > My objection to this is that Alice can still be impersonated by members > in the group, if we only have symmetric forward-secure authentication. > > I'm missing how FS sigs (or any other FS auth primitive) helps. My > understanding > is FS auth primitives prevent leaked keys from being used to authenticate > messages in *past* time periods. But the attack involves signing messages > for > time periods (epochs) after the leak occurred not before the leak. Imagin= e > we > could deterministically ratchet sig key pairs forward much like we can MA= C > keys. > We'd have an FS sig scheme but I dont see how this fixes the problem. > > Which is not to say that FS sigs dont solve an auth problem for MLS. Just= , > AFAIK, not this one. (Rather they help prevent forgeries in bygone epochs= .) > > What I do agree with is that other group members (that know Alice's sig > key) can > still impersonate her in future epochs till she updates the key. The same > is > true when sending MLSCiphertexts. > > Unfortunately, for epochs between when Alice's state is leaked and when > Alice > finally updates her (authentication specific) asymmetric key material I > see no > way around this. It seems inherent to the adversarial model since other > group > member know and can do everything Alice can during those epochs. > > One thing we could look at are PCS signatures. Something like the > Updateable PKE > scheme in the RTreeKEM work. Namely every time you sign you also > re-randomize > your signing key (or simply sample new ones). That way leaking your old k= ey > doesnt let me sign under your re-randomized new key just like in UPKE > leaking > your old decryption key doesnt let me read ciphertexts encrypted to your > re-randomized new key. Make sense? > > > - Jo=C3=ABl > > > On 18/08/2020 18:34, Brendan McMillion wrote: > > So to that end, how > > about we modify MLS such that MLSPlaintext packets coming from grou= p > members > > must also be authenticated using something from the application key > schedule. > > > > > > My objection to this is that Alice can still be impersonated by members > in the > > group, if we only have symmetric forward-secure authentication. > > > > There's been some discussion in the past about using forward-secure > signatures > > that might be worth looking into instead, which would fully address thi= s > attack > > vector: > https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ > > > > > > On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen > > wrote: > > > > Hey everyone, > > > > Something thats been bugging Marta Mularczyk and Daniel Jost and me > for a bit > > now is that handshake messages sent out as MLSPlaintext packets are > only > > authenticated using signatures, but not using the group's key > schedule. For > > non-members that makes sense but for group members that's weaker > than need be. > > > > Suppose Alice is in a group using signing key pair (spk, ssk). I > corrupt her to > > learn ssk. Now I loose access to her device again. Later she > generates a fresh > > key package with her same spk but a new HPKE key for her leaf. She > sends out and > > update proposal for her new key package and someone commits to the > update. > > > > Expected result: she (and the group at large) has achieved PCS agai= n. > > > > Actual result: using her stolen ssk I can still forge a new > proposal's (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do wit= h > this power: > > - I can generate a new key package kp for Alice using her spk and > some HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp= . > If it gets > > committed I've effectively kicked her out of the group. > > - I could forge Add's and Remove's coming from Alice, so I could > trick the > > group into thinking Alice is trying to Add my account to the group > or remove > > some other group member. > > > > Lemme know if I've missed something here in that scenario... > > > > > > If I didn't miss anything and the attacks really work as advertised > then IMO > > this is kinda weak sauce and worth avoiding if possible. So to that > end, how > > about we modify MLS such that MLSPlaintext packets coming from grou= p > members > > must also be authenticated using something from the application key > schedule. > > Now the above attacks fail. As soon as Alice's update is gets > committed I no > > longer know the group's key schedule and so can't forged packet fro= m > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts > frameing in > > line with what we're getting from MLSCiphertext packets. > > > > Any thoughts? > > > > - Jo=C3=ABl > > > > > > > > PS. For concreteness, we could probably extend the current mechanis= m > for getting > > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > > E.g. include most of the MLSPlaintext content into whats being > tagged by > > confirmation_tag. That would cover the case of a commit packet and > doesn't even > > grow the size of MLSPlaintext packets over the current design. > > > > For a proposal packet we could also have a confirmation_tag but thi= s > one is > > computed using the *current* epoch's confirmation_key and > > confirmed_transcript_hash. > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > > --000000000000dfdd9d05ad2a5522 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I actually describe in the thread I linked how to take a s= tandard FS signature and turn it into a PCS signature. While it's baked= into the primitive, essentially what's happening is that every time Al= ice sends an Update, she generates a new signing key and certifies it with = her old signing key before discarding the old signing key. So if Alice'= s Update is accepted by the group, anyone who compromised the old signing k= ey can't sign new messages because they don't have the private key = of the *new* signing key.

On Tue, Aug 18, 2020 at 9:55 AM Joel Alwen &l= t;jalwen@wickr.com> wrote:
> My objection to = this is that Alice can still be impersonated by members in the group, if we= only have symmetric forward-secure authentication.

I'm missing how FS sigs (or any other FS auth primitive) helps. My unde= rstanding
is FS auth primitives prevent leaked keys from being used to authenticate messages in *past* time periods. But the attack involves signing messages f= or
time periods (epochs) after the leak occurred not before the leak. Imagine = we
could deterministically ratchet sig key pairs forward much like we can MAC = keys.
We'd have an FS sig scheme but I dont see how this fixes the problem.
Which is not to say that FS sigs dont solve an auth problem for MLS. Just,<= br> AFAIK, not this one. (Rather they help prevent forgeries in bygone epochs.)=

What I do agree with is that other group members (that know Alice's sig= key) can
still impersonate her in future epochs till she updates the key. The same i= s
true when sending MLSCiphertexts.

Unfortunately, for epochs between when Alice's state is leaked and when= Alice
finally updates her (authentication specific) asymmetric key material I see= no
way around this. It seems inherent to the adversarial model since other gro= up
member know and can do everything Alice can during those epochs.

One thing we could look at are PCS signatures. Something like the Updateabl= e PKE
scheme in the RTreeKEM work. Namely every time you sign you also re-randomi= ze
your signing key (or simply sample new ones). That way leaking your old key=
doesnt let me sign under your re-randomized new key just like in UPKE leaki= ng
your old decryption key doesnt let me read ciphertexts encrypted to your re-randomized new key. Make sense?


- Jo=C3=ABl


On 18/08/2020 18:34, Brendan McMillion wrote:
>=C2=A0 =C2=A0 =C2=A0So to that end, how
>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaintext packets = coming from group members
>=C2=A0 =C2=A0 =C2=A0must also be authenticated using something from the= application key schedule.
>
>
> My objection to this is that Alice can still be impersonated by member= s in the
> group, if we only have symmetric forward-secure authentication.
>
> There's been some discussion in the past about using forward-secur= e signatures
> that might be worth looking into instead, which would fully address th= is attack
> vector: https://mailarchi= ve.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/
>
>
> On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen <jalwen@wickr.com
> <mailto:jalwe= n@wickr.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Hey everyone,
>
>=C2=A0 =C2=A0 =C2=A0Something thats been bugging Marta Mularczyk and Da= niel Jost and me for a bit
>=C2=A0 =C2=A0 =C2=A0now is that handshake messages sent out as MLSPlain= text packets are only
>=C2=A0 =C2=A0 =C2=A0authenticated using signatures, but not using the g= roup's key schedule. For
>=C2=A0 =C2=A0 =C2=A0non-members that makes sense but for group members = that's weaker than need be.
>
>=C2=A0 =C2=A0 =C2=A0Suppose Alice is in a group using signing key pair = (spk, ssk). I corrupt her to
>=C2=A0 =C2=A0 =C2=A0learn ssk. Now I loose access to her device again. = Later she generates a fresh
>=C2=A0 =C2=A0 =C2=A0key package with her same spk but a new HPKE key fo= r her leaf. She sends out and
>=C2=A0 =C2=A0 =C2=A0update proposal for her new key package and someone= commits to the update.
>
>=C2=A0 =C2=A0 =C2=A0Expected result: she (and the group at large) has a= chieved PCS again.
>
>=C2=A0 =C2=A0 =C2=A0Actual result: using her stolen ssk I can still for= ge a new proposal's (sent as
>=C2=A0 =C2=A0 =C2=A0MLSPlaintext packets) coming from Alice. Some thing= s I could do with this power:
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I can generate a new key package kp for Ali= ce using her spk and some HPKE key
>=C2=A0 =C2=A0 =C2=A0she doesn't know. Then I forge an update propos= al for Alice with kp. If it gets
>=C2=A0 =C2=A0 =C2=A0committed I've effectively kicked her out of th= e group.
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I could forge Add's and Remove's co= ming from Alice, so I could trick the
>=C2=A0 =C2=A0 =C2=A0group into thinking Alice is trying to Add my accou= nt to the group or remove
>=C2=A0 =C2=A0 =C2=A0some other group member.
>
>=C2=A0 =C2=A0 =C2=A0Lemme know if I've missed something here in tha= t scenario...
>
>
>=C2=A0 =C2=A0 =C2=A0If I didn't miss anything and the attacks reall= y work as advertised then IMO
>=C2=A0 =C2=A0 =C2=A0this is kinda weak sauce and worth avoiding if poss= ible. So to that end, how
>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaintext packets = coming from group members
>=C2=A0 =C2=A0 =C2=A0must also be authenticated using something from the= application key schedule.
>=C2=A0 =C2=A0 =C2=A0Now the above attacks fail. As soon as Alice's = update is gets committed I no
>=C2=A0 =C2=A0 =C2=A0longer know the group's key schedule and so can= 't forged packet from Alice. More
>=C2=A0 =C2=A0 =C2=A0generally, this brings the PCS guarantees when usin= g MLSPlaintexts frameing in
>=C2=A0 =C2=A0 =C2=A0line with what we're getting from MLSCiphertext= packets.
>
>=C2=A0 =C2=A0 =C2=A0Any thoughts?
>
>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>
>
>
>=C2=A0 =C2=A0 =C2=A0PS. For concreteness, we could probably extend the = current mechanism for getting
>=C2=A0 =C2=A0 =C2=A0concistancy (the confirmation_tag) to also provide = symmetric key authentication.
>=C2=A0 =C2=A0 =C2=A0E.g. include most of the MLSPlaintext content into = whats being tagged by
>=C2=A0 =C2=A0 =C2=A0confirmation_tag. That would cover the case of a co= mmit packet and doesn't even
>=C2=A0 =C2=A0 =C2=A0grow the size of MLSPlaintext packets over the curr= ent design.
>
>=C2=A0 =C2=A0 =C2=A0For a proposal packet we could also have a confirma= tion_tag but this one is
>=C2=A0 =C2=A0 =C2=A0computed using the *current* epoch's confirmati= on_key and
>=C2=A0 =C2=A0 =C2=A0confirmed_transcript_hash.
>
>=C2=A0 =C2=A0 =C2=A0_______________________________________________
>=C2=A0 =C2=A0 =C2=A0MLS mailing list
>=C2=A0 =C2=A0 =C2=A0M= LS@ietf.org <mailto:MLS@ietf.org>
>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/listin= fo/mls
>
--000000000000dfdd9d05ad2a5522-- From nobody Tue Aug 18 11:26:09 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D55573A0966 for ; Tue, 18 Aug 2020 11:26:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5M1_a3whxv_0 for ; Tue, 18 Aug 2020 11:26:03 -0700 (PDT) Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BBAC83A095E for ; Tue, 18 Aug 2020 11:26:03 -0700 (PDT) Received: by mail-pf1-x435.google.com with SMTP id y206so10357002pfb.10 for ; Tue, 18 Aug 2020 11:26:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=31RQ+lrlOpPLSPmWmjwymUUGTO85xDB9pc/NHxvzAZw=; b=UPMGbx/pMnp+6+cQ0YlxdUPxJX0PcaqdngnMROl7BhVsMvuCdPuOudlZZehO8tgKs1 P+4LnZl5eH+DIrvuoQPs6mKjyikwRHjLSbusSxJd1XX+W/SP3bLnDStwXUD4gTYUckgJ 3aDQWqMyFhyQJKKo3ETPYCeGWC0tSVTYTkTcjhcEOoBsMB6DiNKSLbxSaKtrYVqXLqYh BnS/VQ0C9aHnDchkpLIFEizrzx0b1xYTugRE3wAccUzXI/5omb1JFMjZDIhesRJGZV8q yVn9geXJp6tiVSLLgllZ9V36FeQb8j9cZVmi8GQMlIlobhqAcL+xgDy821Kekf4gRncd GXIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=31RQ+lrlOpPLSPmWmjwymUUGTO85xDB9pc/NHxvzAZw=; b=rJpkg35BgNEqgXCNH/QKK80dzEHlOfXKaBy3KUO1t1OhQWVw+ZBJE455MFD1e0ayg8 M3N/gYnOnpx3vw1QQcthwS/HefuLybp37ycaBxrrz9Ere1fxlN95FssNmA4/BOXW2qG2 xzGBgEHVlEfErVqMepwRxd0WZC0roawYp4qMM1tqFuVRnyLMZnsJiS0GPL6AquoN2XPs JiZKFmtXVCJAY09g6rzeHTANGLj3c1bGdd1aG1eFQtshTvskTeKqFqJo5XvfN5LQZsSy YQusczoaZxzprQz189aHgH2C8pb8AuM77BPRy72zSNz0Jqd7WM07X8wWmb5jsI8FpG2e NV+g== X-Gm-Message-State: AOAM530vhfktrT3aKWWdw+5ewcROL1/+oPozxTO5/+iFqADdOdHXBLZt ug/lgrn0jIDGDjjJj6KnOnG3O0aGB360yd8CY4iaXg== X-Google-Smtp-Source: ABdhPJz2BMIDUut9E5Z7yNgl/PFxQk27QQmlFJKSgt4Bz8AVXmD88/BcvE2vpDswmFMl8Hz78kZCLYyDj6S2hNmT8KU= X-Received: by 2002:aa7:9ec4:: with SMTP id r4mr16665811pfq.48.1597775163020; Tue, 18 Aug 2020 11:26:03 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <7abf555f-a266-f62f-2a22-8b0f389304d5@wickr.com> In-Reply-To: From: Joel Alwen Date: Tue, 18 Aug 2020 20:25:53 +0200 Message-ID: To: Brendan McMillion Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="00000000000005f37005ad2b05fc" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 18:26:08 -0000 --00000000000005f37005ad2b05fc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Chaining key pairs builds a PCS sig scheme from a standard one. (No FS needed.) PCS sigs could be helpful as a complementary mechanism for getting yet more PCS auth. If so it seems worth it to think if we cant get a more efficient construction of PCS sigs. Regardless, proving to receivers that the author of a message knows the current group key schedule still seems prudent to me. - Jo=C3=ABl. On Tue, 18 Aug 2020, 19:37 Brendan McMillion, wrote: > I actually describe in the thread I linked how to take a standard FS > signature and turn it into a PCS signature. While it's baked into the > primitive, essentially what's happening is that every time Alice sends an > Update, she generates a new signing key and certifies it with her old > signing key before discarding the old signing key. So if Alice's Update i= s > accepted by the group, anyone who compromised the old signing key can't > sign new messages because they don't have the private key of the *new* > signing key. > > On Tue, Aug 18, 2020 at 9:55 AM Joel Alwen wrote: > >> > My objection to this is that Alice can still be impersonated by member= s >> in the group, if we only have symmetric forward-secure authentication. >> >> I'm missing how FS sigs (or any other FS auth primitive) helps. My >> understanding >> is FS auth primitives prevent leaked keys from being used to authenticat= e >> messages in *past* time periods. But the attack involves signing message= s >> for >> time periods (epochs) after the leak occurred not before the leak. >> Imagine we >> could deterministically ratchet sig key pairs forward much like we can >> MAC keys. >> We'd have an FS sig scheme but I dont see how this fixes the problem. >> >> Which is not to say that FS sigs dont solve an auth problem for MLS. Jus= t, >> AFAIK, not this one. (Rather they help prevent forgeries in bygone >> epochs.) >> >> What I do agree with is that other group members (that know Alice's sig >> key) can >> still impersonate her in future epochs till she updates the key. The sam= e >> is >> true when sending MLSCiphertexts. >> >> Unfortunately, for epochs between when Alice's state is leaked and when >> Alice >> finally updates her (authentication specific) asymmetric key material I >> see no >> way around this. It seems inherent to the adversarial model since other >> group >> member know and can do everything Alice can during those epochs. >> >> One thing we could look at are PCS signatures. Something like the >> Updateable PKE >> scheme in the RTreeKEM work. Namely every time you sign you also >> re-randomize >> your signing key (or simply sample new ones). That way leaking your old >> key >> doesnt let me sign under your re-randomized new key just like in UPKE >> leaking >> your old decryption key doesnt let me read ciphertexts encrypted to your >> re-randomized new key. Make sense? >> >> >> - Jo=C3=ABl >> >> >> On 18/08/2020 18:34, Brendan McMillion wrote: >> > So to that end, how >> > about we modify MLS such that MLSPlaintext packets coming from >> group members >> > must also be authenticated using something from the application ke= y >> schedule. >> > >> > >> > My objection to this is that Alice can still be impersonated by member= s >> in the >> > group, if we only have symmetric forward-secure authentication. >> > >> > There's been some discussion in the past about using forward-secure >> signatures >> > that might be worth looking into instead, which would fully address >> this attack >> > vector: >> https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ >> > >> > >> > On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen > > > wrote: >> > >> > Hey everyone, >> > >> > Something thats been bugging Marta Mularczyk and Daniel Jost and m= e >> for a bit >> > now is that handshake messages sent out as MLSPlaintext packets ar= e >> only >> > authenticated using signatures, but not using the group's key >> schedule. For >> > non-members that makes sense but for group members that's weaker >> than need be. >> > >> > Suppose Alice is in a group using signing key pair (spk, ssk). I >> corrupt her to >> > learn ssk. Now I loose access to her device again. Later she >> generates a fresh >> > key package with her same spk but a new HPKE key for her leaf. She >> sends out and >> > update proposal for her new key package and someone commits to the >> update. >> > >> > Expected result: she (and the group at large) has achieved PCS >> again. >> > >> > Actual result: using her stolen ssk I can still forge a new >> proposal's (sent as >> > MLSPlaintext packets) coming from Alice. Some things I could do >> with this power: >> > - I can generate a new key package kp for Alice using her spk and >> some HPKE key >> > she doesn't know. Then I forge an update proposal for Alice with >> kp. If it gets >> > committed I've effectively kicked her out of the group. >> > - I could forge Add's and Remove's coming from Alice, so I could >> trick the >> > group into thinking Alice is trying to Add my account to the group >> or remove >> > some other group member. >> > >> > Lemme know if I've missed something here in that scenario... >> > >> > >> > If I didn't miss anything and the attacks really work as advertise= d >> then IMO >> > this is kinda weak sauce and worth avoiding if possible. So to tha= t >> end, how >> > about we modify MLS such that MLSPlaintext packets coming from >> group members >> > must also be authenticated using something from the application ke= y >> schedule. >> > Now the above attacks fail. As soon as Alice's update is gets >> committed I no >> > longer know the group's key schedule and so can't forged packet >> from Alice. More >> > generally, this brings the PCS guarantees when using MLSPlaintexts >> frameing in >> > line with what we're getting from MLSCiphertext packets. >> > >> > Any thoughts? >> > >> > - Jo=C3=ABl >> > >> > >> > >> > PS. For concreteness, we could probably extend the current >> mechanism for getting >> > concistancy (the confirmation_tag) to also provide symmetric key >> authentication. >> > E.g. include most of the MLSPlaintext content into whats being >> tagged by >> > confirmation_tag. That would cover the case of a commit packet and >> doesn't even >> > grow the size of MLSPlaintext packets over the current design. >> > >> > For a proposal packet we could also have a confirmation_tag but >> this one is >> > computed using the *current* epoch's confirmation_key and >> > confirmed_transcript_hash. >> > >> > _______________________________________________ >> > MLS mailing list >> > MLS@ietf.org >> > https://www.ietf.org/mailman/listinfo/mls >> > >> > --00000000000005f37005ad2b05fc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Chaining key pairs builds a PCS sig scheme from a standar= d one. (No FS needed.)

PCS sig= s could be helpful as a complementary mechanism for getting yet more PCS au= th. If so it seems worth it to think if we cant get a more efficient constr= uction of PCS sigs.

Rega= rdless, proving to receivers that the author of a message knows the current= group key schedule still seems prudent to me.

<= /div>
- Jo=C3=ABl.

On Tue, 18 Aug 2020, 19:37 Brendan= McMillion, <brendan@cloudflar= e.com> wrote:
I actually describe in the thread I linked how to take a standard FS sig= nature and turn it into a PCS signature. While it's baked into the prim= itive, essentially what's happening is that every time Alice sends an U= pdate, she generates a new signing key and certifies it with her old signin= g key before discarding the old signing key. So if Alice's Update is ac= cepted by the group, anyone who compromised the old signing key can't s= ign new messages because they don't have the private key of the *new* s= igning key.

On Tue, Aug 18, 2020 at 9:55 AM Joel Alwen <jalwen@wickr.c= om> wrote:
https:= //mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/
>
>
> On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen <jalwen@wickr.com
> <mailto:jalwen@wickr.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Hey everyone,
>
>=C2=A0 =C2=A0 =C2=A0Something thats been bugging Marta Mularczyk and Da= niel Jost and me for a bit
>=C2=A0 =C2=A0 =C2=A0now is that handshake messages sent out as MLSPlain= text packets are only
>=C2=A0 =C2=A0 =C2=A0authenticated using signatures, but not using the g= roup's key schedule. For
>=C2=A0 =C2=A0 =C2=A0non-members that makes sense but for group members = that's weaker than need be.
>
>=C2=A0 =C2=A0 =C2=A0Suppose Alice is in a group using signing key pair = (spk, ssk). I corrupt her to
>=C2=A0 =C2=A0 =C2=A0learn ssk. Now I loose access to her device again. = Later she generates a fresh
>=C2=A0 =C2=A0 =C2=A0key package with her same spk but a new HPKE key fo= r her leaf. She sends out and
>=C2=A0 =C2=A0 =C2=A0update proposal for her new key package and someone= commits to the update.
>
>=C2=A0 =C2=A0 =C2=A0Expected result: she (and the group at large) has a= chieved PCS again.
>
>=C2=A0 =C2=A0 =C2=A0Actual result: using her stolen ssk I can still for= ge a new proposal's (sent as
>=C2=A0 =C2=A0 =C2=A0MLSPlaintext packets) coming from Alice. Some thing= s I could do with this power:
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I can generate a new key package kp for Ali= ce using her spk and some HPKE key
>=C2=A0 =C2=A0 =C2=A0she doesn't know. Then I forge an update propos= al for Alice with kp. If it gets
>=C2=A0 =C2=A0 =C2=A0committed I've effectively kicked her out of th= e group.
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I could forge Add's and Remove's co= ming from Alice, so I could trick the
>=C2=A0 =C2=A0 =C2=A0group into thinking Alice is trying to Add my accou= nt to the group or remove
>=C2=A0 =C2=A0 =C2=A0some other group member.
>
>=C2=A0 =C2=A0 =C2=A0Lemme know if I've missed something here in tha= t scenario...
>
>
>=C2=A0 =C2=A0 =C2=A0If I didn't miss anything and the attacks reall= y work as advertised then IMO
>=C2=A0 =C2=A0 =C2=A0this is kinda weak sauce and worth avoiding if poss= ible. So to that end, how
>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaintext packets = coming from group members
>=C2=A0 =C2=A0 =C2=A0must also be authenticated using something from the= application key schedule.
>=C2=A0 =C2=A0 =C2=A0Now the above attacks fail. As soon as Alice's = update is gets committed I no
>=C2=A0 =C2=A0 =C2=A0longer know the group's key schedule and so can= 't forged packet from Alice. More
>=C2=A0 =C2=A0 =C2=A0generally, this brings the PCS guarantees when usin= g MLSPlaintexts frameing in
>=C2=A0 =C2=A0 =C2=A0line with what we're getting from MLSCiphertext= packets.
>
>=C2=A0 =C2=A0 =C2=A0Any thoughts?
>
>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>
>
>
>=C2=A0 =C2=A0 =C2=A0PS. For concreteness, we could probably extend the = current mechanism for getting
>=C2=A0 =C2=A0 =C2=A0concistancy (the confirmation_tag) to also provide = symmetric key authentication.
>=C2=A0 =C2=A0 =C2=A0E.g. include most of the MLSPlaintext content into = whats being tagged by
>=C2=A0 =C2=A0 =C2=A0confirmation_tag. That would cover the case of a co= mmit packet and doesn't even
>=C2=A0 =C2=A0 =C2=A0grow the size of MLSPlaintext packets over the curr= ent design.
>
>=C2=A0 =C2=A0 =C2=A0For a proposal packet we could also have a confirma= tion_tag but this one is
>=C2=A0 =C2=A0 =C2=A0computed using the *current* epoch's confirmati= on_key and
>=C2=A0 =C2=A0 =C2=A0confirmed_transcript_hash.
>
>=C2=A0 =C2=A0 =C2=A0_______________________________________________
>=C2=A0 =C2=A0 =C2=A0MLS mailing list
>=C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org>
>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mai= lman/listinfo/mls
>
--00000000000005f37005ad2b05fc-- From nobody Tue Aug 18 12:02:10 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EC183A0A3A for ; Tue, 18 Aug 2020 12:02:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id I14uBMu-eryQ for ; Tue, 18 Aug 2020 12:02:06 -0700 (PDT) Received: from mail-qv1-xf30.google.com (mail-qv1-xf30.google.com [IPv6:2607:f8b0:4864:20::f30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E7633A0BE3 for ; Tue, 18 Aug 2020 12:01:41 -0700 (PDT) Received: by mail-qv1-xf30.google.com with SMTP id v1so8232835qvn.3 for ; Tue, 18 Aug 2020 12:01:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=89T5VqMV03a/+WuDn0Z9BKkBmJErgrw8wk+/oPV/690=; b=rpEFHPiSLWAnPa8U26fJIaPDAvUq9+HZrNvvLmapUIeF0hcQJatOJp8IXSrxRO7/gD cfV1jsnHcKRNllZdyyWeOiz8pmIK3p6IJTMWghxmMXtdJ5y5fE45G31N7Hx54HucNrG/ FwfzKKC9q0uXZ4WuXtlCYwi8DRjk4KhN8Pps9V6kG70gDg6G3ZidOx/FLw07zD6748d5 p8tJAegPwuOtbiTM/XXbAoCgS7KccGt+T3VoLISMZ7zactMFITN98nPrUgj2aBcsOwf2 zMkcpY0U9Fp7un2QGwX00uVbkjThkMnS8rEU54qGXfURKBBWUY9ITmACuPMIO1ykn8Ea MEKg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=89T5VqMV03a/+WuDn0Z9BKkBmJErgrw8wk+/oPV/690=; b=GBSFcQZVuzSwjjvhZRZcIsMXCOlzfr17UTAWNFnJMEmo3rIxzQJPwJTuPFmJvJCmW4 /Fzu4VDaN2dNA0H1G4CBGwNQ+Ss15x7ui8p/PrahIyvpxVmDA6K9UFt3ElDoYz0UfCld w0wqCG+mT1XRjs9xQNUiMzuucJdh9qXcklXZq2AXH3nQ9B10qnWgxzBF9XEPqJskXmjS aQzL1F7LcTugU4pO8MzfVagEUYXZAj3SVqD5qgkx6CcnRjBuCu2Xjin/0jxO+Y5RD/h7 3kbAyluZitHLLXeONwpVNqkMEvZWMP4g/WdlErS54BnByj4nYsXSJ9Jvy9vORzLOTKEK iGVQ== X-Gm-Message-State: AOAM533YBILkD6WdIjcGr+RQ9XkC2yOtqtfLALBGvSNpMfOjLT2HfmFs 9iC9U6cG21m1bPppFGgT8BP3viBLuheVseM4jYhcWA== X-Google-Smtp-Source: ABdhPJzLeRJVYIZVOi7rfX38SGk8DjbxoIhfCZtdPPoWr4Z+49tCRAKXbdInnHiz9CEoHWaOCJuCO39lS/zMhAcoiqI= X-Received: by 2002:a0c:fc07:: with SMTP id z7mr21006233qvo.65.1597777300833; Tue, 18 Aug 2020 12:01:40 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> In-Reply-To: From: Richard Barnes Date: Tue, 18 Aug 2020 15:01:20 -0400 Message-ID: To: Joel Alwen Cc: Raphael Robert , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="00000000000072613205ad2b8400" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 19:02:09 -0000 --00000000000072613205ad2b8400 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Here ya go: https://github.com/mlswg/mls-protocol/pull/396 On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen wrote: > > Jo=C3=ABl, do you want to write a PR? If not, I could probably get to = it in > the > > next couple days. > > Thanks. :-) If you could that would be really nice. > > - Jo=C3=ABl > > On 18/08/2020 19:20, Richard Barnes wrote: > > Sounds like we're converging here. The only question in my mind is wha= t > goes in > > the MAC -- seems like the easy option is probably "the remainder of the > > MLSPlaintextTBS", i.e., everything from group_id to the end. That seem= s > like it > > minimizes multiple serialization: > > > > tbs_content =3D serialize(group_id, ...) > > membership_token =3D KDF.Extract(confirmation_key, tbs_content) > > tbs =3D group_context || membership_token || tbs_content > > > > So the PR would be to basically pop the context off of MLSPlaintextTBS > and add > > the three lines above (with the switch for internal/external in prose). > > > > Jo=C3=ABl, do you want to write a PR? If not, I could probably get to = it in > the next > > couple days. > > > > --Richard > > > > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert > > wrote: > > > > I think what you just described is indeed a combination of option 1 > & 2. > > It=E2=80=99s a MAC over the payload we want to authenticate, but it= =E2=80=99s > implicit and > > we only include it in the MLSPlaintextTBS. Or in other words, we > stripped it > > from MLSPlaintext because it is implicitly known to any valid membe= r > of the > > group. > > > > Raphael > > > >> On 18 Aug 2020, at 18:16, Joel Alwen >> > wrote: > >> > >> Yeah, I like Option 2 here. I like that it avoids growing packet > size. > >> > >> One caveat though: I'd go for the MAC(...) version rather than the > >> confirmation_key. For starters thing including confirmation_key > doesnt > >> authenticate the contents of the packet. But even if it did, > signatures aren't > >> meant to hide the contents of what was signed. (Amend you favorite > sig > >> scheme to > >> tack on the message at the end a signature and you've still got a > secure > >> signature scheme. But clearly not a message hiding one.) That mean= s > that AFAIK > >> neither ECDSA nor EdDSA etc. were designed or analyzed for such a > property. So > >> this would amount to a very non-standard use of a signature scheme= s > by > >> MLS. Not > >> saying it doesn't work for the particular sig schemes in our > ciphersuite. But > >> its def. not how signatures are "meant" to be used. > >> > >> But that leaves Option 2 with, say, including tag =3D MAC(conf_key= , > >> conf_trans_hash || MLSPlaintext.content) into whats being signed > which I like > >> and think gets the job done. Both conf_* values are taken from the > current > >> epoch. By MLSPlaintext.content I mean whats now called > MLSPlaintextTBS. > >> > >>> I would propose that we do need something additional on Commit > messages as > >>> well as Proposals. > >> > >> @Richard: For Proopsals I think this works. Is that about what you > had in mind > >> for commits too? > >> > >> - Jo=C3=ABl > >> > >> > >> On 18/08/2020 17:26, Richard Barnes wrote: > >>> Thanks for pointing this out, Jo=C3=ABl. I agree that the attack= s > you're > >>> describing > >>> should work as things are currently specified. And they're > salient, > >>> especially > >>> the "replace Alice in the group" one. > >>> > >>> Also agree with Raphael is correct that Commit is not affected by > this, since > >>> someone who is not a member won't be able to generate the right > confirmation > >>> value. However, I don't think this is actually the right design > to adopt > >>> for a > >>> general solution to this problem. Confirmation verifies group > membership > >>> *after* processing the handshake message; the point here is that = we > >>> should also > >>> have a membership check *before* processing handshake messages. = In > >>> particular, > >>> I would propose that we do need something additional on Commit > messages > >>> as well > >>> as Proposals. > >>> > >>> Thinking about solutions here, a couple of options come to mind: > >>> > >>> 1. Use MLSCiphertext, but with an integrity-only encapsulation > >>> 2. Incorporate in the signature something that is only known to > the group > >>> (e.g., > >>> confirmation_key or MAC(confirmation_key; > confirmed_transcript_hash || > >>> Proposal/Commit)) > >>> > >>> Option (1) has the appeal that you would only ever send > MLSCiphertext, though > >>> switching between encrypted/not could be problematic. Option (2) > seems a lot > >>> more appealing: It doesn't add any overhead, since the > group-secret value > >>> doesn't need to be sent. And we already switch between the > signature context > >>> that is added for group members vs. external. In fact, I think > option > >>> (2) would > >>> just amount to a one-line change to include an extra, secret valu= e > in the > >>> context at the top of the MLSPlaintextTBS struct. > >>> > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol= .md#content-signing-and-encryption > >>> > >>> The only thing that seems odd about (2) is overloading signature > >>> verification in > >>> that way, i.e., using the ability to generate a signature over a > secret > >>> thing to > >>> prove you know the secret thing. That doesn't seem obviously > flawed to > >>> me, but > >>> worth thinking about. > >>> > >>> Does that make sense to folks? > >>> > >>> --Richard > >>> > >>> > >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > >>> >>> 40wire.com@dmarc.ietf.org>> > >>> wrote: > >>> > >>> Hi Joel, > >>> > >>> For context: this would only apply when applications use > cleartext > >>> MLSPlaintext for HS messages. The recommendation is still to > encrypt them > >>> and send them around as MLSCiphertext. > >>> That being said, we said we would like to support scenarios > where HS > >>> messages are not necessarily encrypted. > >>> > >>> Question: would this attack work with Commit messages? I=E2=80= =99m > thinking that > >>> they would be rejected because the attacker cannot compute the > >>> confirmation_tag. > >>> > >>> As you mention in the PS, the easy target would be Proposal > messages. > >>> > >>> I=E2=80=99d be interested to see what exactly you would propos= e as a > mitigation > >>> mechanism. > >>> > >>> Raphael > >>> > >>>> On 18 Aug 2020, at 16:36, Joel Alwen >>>> > >>> > wrote: > >>>> > >>>> Hey everyone, > >>>> > >>>> Something thats been bugging Marta Mularczyk and Daniel Jost and > me for > >>>> a bit > >>>> now is that handshake messages sent out as MLSPlaintext packets > are only > >>>> authenticated using signatures, but not using the group's key > schedule. For > >>>> non-members that makes sense but for group members that's weaker > than > >>>> need be. > >>>> > >>>> Suppose Alice is in a group using signing key pair (spk, ssk). I > corrupt > >>> her to > >>>> learn ssk. Now I loose access to her device again. Later she > generates a > >>>> fresh > >>>> key package with her same spk but a new HPKE key for her leaf. > She sends > >>> out and > >>>> update proposal for her new key package and someone commits to > the update. > >>>> > >>>> Expected result: she (and the group at large) has achieved PCS > again. > >>>> > >>>> Actual result: using her stolen ssk I can still forge a new > proposal's > >>> (sent as > >>>> MLSPlaintext packets) coming from Alice. Some things I could do > with this > >>> power: > >>>> - I can generate a new key package kp for Alice using her spk an= d > some > >>> HPKE key > >>>> she doesn't know. Then I forge an update proposal for Alice with > kp. If it > >>> gets > >>>> committed I've effectively kicked her out of the group. > >>>> - I could forge Add's and Remove's coming from Alice, so I could > trick the > >>>> group into thinking Alice is trying to Add my account to the > group or remove > >>>> some other group member. > >>>> > >>>> Lemme know if I've missed something here in that scenario... > >>>> > >>>> > >>>> If I didn't miss anything and the attacks really work as > advertised then IMO > >>>> this is kinda weak sauce and worth avoiding if possible. So to > that end, how > >>>> about we modify MLS such that MLSPlaintext packets coming from > group members > >>>> must also be authenticated using something from the application > key > >>>> schedule. > >>>> Now the above attacks fail. As soon as Alice's update is gets > committed I no > >>>> longer know the group's key schedule and so can't forged packet > from > >>> Alice. More > >>>> generally, this brings the PCS guarantees when using MLSPlaintex= ts > >>>> frameing in > >>>> line with what we're getting from MLSCiphertext packets. > >>>> > >>>> Any thoughts? > >>>> > >>>> - Jo=C3=ABl > >>>> > >>>> > >>>> > >>>> PS. For concreteness, we could probably extend the current > mechanism for > >>> getting > >>>> concistancy (the confirmation_tag) to also provide symmetric key > >>> authentication. > >>>> E.g. include most of the MLSPlaintext content into whats being > tagged by > >>>> confirmation_tag. That would cover the case of a commit packet > and doesn't > >>> even > >>>> grow the size of MLSPlaintext packets over the current design. > >>>> > >>>> For a proposal packet we could also have a confirmation_tag but > this one is > >>>> computed using the *current* epoch's confirmation_key and > >>> confirmed_transcript_hash. > >>>> > >>>> _______________________________________________ > >>>> MLS mailing list > >>>> MLS@ietf.org > >>>> https://www.ietf.org/mailman/listinfo/mls > >>> > >>> _______________________________________________ > >>> MLS mailing list > >>> MLS@ietf.org > >>> https://www.ietf.org/mailman/listinfo/mls > > > --00000000000072613205ad2b8400 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
<= br>
On Tue,= Aug 18, 2020 at 1:30 PM Joel Alwen <jalwen@wickr.com> wrote:
> Jo=C3=ABl, do you want to write a PR?=C2=A0 If not, I= could probably get to it in the
> next couple days.

Thanks. :-) If you could that would be really nice.

- Jo=C3=ABl

On 18/08/2020 19:20, Richard Barnes wrote:
> Sounds like we're converging here.=C2=A0 The only question in my m= ind is what goes in
> the MAC -- seems like the easy option is probably "the remainder = of the
> MLSPlaintextTBS", i.e., everything from group_id to the end.=C2= =A0 That seems like it
> minimizes multiple serialization:
>
> tbs_content =3D serialize(group_id, ...)
> membership_token =3D KDF.Extract(confirmation_key, tbs_content)
> tbs =3D group_context || membership_token || tbs_content
>
> So the PR would be to basically pop the context off of MLSPlaintextTBS= and add
> the three lines above (with the switch for internal/external in prose)= .
>
> Jo=C3=ABl, do you want to write a PR?=C2=A0 If not, I could probably g= et to it in the next
> couple days.
>
> --Richard
>
> On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert <raphael@wire.com
> <mailto:rapha= el@wire.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0I think what you just described is indeed a combina= tion of option 1 & 2.
>=C2=A0 =C2=A0 =C2=A0It=E2=80=99s a MAC over the payload we want to auth= enticate, but it=E2=80=99s implicit and
>=C2=A0 =C2=A0 =C2=A0we only include it in the MLSPlaintextTBS. Or in ot= her words, we stripped it
>=C2=A0 =C2=A0 =C2=A0from MLSPlaintext because it is implicitly known to= any valid member of the
>=C2=A0 =C2=A0 =C2=A0group.
>
>=C2=A0 =C2=A0 =C2=A0Raphael
>
>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2020, at 18:16, Joel Alwen <jalwen@wickr.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>> wrote:
>>
>>=C2=A0 =C2=A0 =C2=A0Yeah, I like Option 2 here. I like that it avoi= ds growing packet size.
>>
>>=C2=A0 =C2=A0 =C2=A0One caveat though: I'd go for the MAC(...) = version rather than the
>>=C2=A0 =C2=A0 =C2=A0confirmation_key. For starters thing including = confirmation_key doesnt
>>=C2=A0 =C2=A0 =C2=A0authenticate the contents of the packet. But ev= en if it did, signatures aren't
>>=C2=A0 =C2=A0 =C2=A0meant to hide the contents of what was signed. = (Amend you favorite sig
>>=C2=A0 =C2=A0 =C2=A0scheme to
>>=C2=A0 =C2=A0 =C2=A0tack on the message at the end a signature and = you've still got a secure
>>=C2=A0 =C2=A0 =C2=A0signature scheme. But clearly not a message hid= ing one.) That means that AFAIK
>>=C2=A0 =C2=A0 =C2=A0neither ECDSA nor EdDSA etc. were designed or a= nalyzed for such a property. So
>>=C2=A0 =C2=A0 =C2=A0this would amount to a very non-standard use of= a signature schemes by
>>=C2=A0 =C2=A0 =C2=A0MLS. Not
>>=C2=A0 =C2=A0 =C2=A0saying it doesn't work for the particular s= ig schemes in our ciphersuite. But
>>=C2=A0 =C2=A0 =C2=A0its def. not how signatures are "meant&quo= t; to be used.
>>
>>=C2=A0 =C2=A0 =C2=A0But that leaves Option 2 with, say, including t= ag =3D MAC(conf_key,
>>=C2=A0 =C2=A0 =C2=A0conf_trans_hash || MLSPlaintext.content) into w= hats being signed which I like
>>=C2=A0 =C2=A0 =C2=A0and think gets the job done. Both conf_* values= are taken from the current
>>=C2=A0 =C2=A0 =C2=A0epoch. By MLSPlaintext.content I mean whats now= called MLSPlaintextTBS.
>>
>>>=C2=A0 =C2=A0 =C2=A0I would propose that we do need something a= dditional on Commit messages as
>>>=C2=A0 =C2=A0 =C2=A0well as Proposals.
>>
>>=C2=A0 =C2=A0 =C2=A0@Richard: For Proopsals I think this works. Is = that about what you had in mind
>>=C2=A0 =C2=A0 =C2=A0for commits too?
>>
>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>
>>
>>=C2=A0 =C2=A0 =C2=A0On 18/08/2020 17:26, Richard Barnes wrote:
>>>=C2=A0 =C2=A0 =C2=A0Thanks for pointing this out, Jo=C3=ABl.=C2= =A0 I agree that the attacks you're
>>>=C2=A0 =C2=A0 =C2=A0describing
>>>=C2=A0 =C2=A0 =C2=A0should work as things are currently specifi= ed.=C2=A0 And they're salient,
>>>=C2=A0 =C2=A0 =C2=A0especially
>>>=C2=A0 =C2=A0 =C2=A0the "replace Alice in the group" = one.
>>>
>>>=C2=A0 =C2=A0 =C2=A0Also agree with Raphael is correct that Com= mit is not affected by this, since
>>>=C2=A0 =C2=A0 =C2=A0someone who is not a member won't be ab= le to generate the right confirmation
>>>=C2=A0 =C2=A0 =C2=A0value.=C2=A0 However, I don't think thi= s is actually the right design to adopt
>>>=C2=A0 =C2=A0 =C2=A0for a
>>>=C2=A0 =C2=A0 =C2=A0general solution to this problem.=C2=A0 Con= firmation verifies group membership
>>>=C2=A0 =C2=A0 =C2=A0*after* processing the handshake message; t= he point here is that we
>>>=C2=A0 =C2=A0 =C2=A0should also
>>>=C2=A0 =C2=A0 =C2=A0have a membership check *before* processing= handshake messages.=C2=A0 In
>>>=C2=A0 =C2=A0 =C2=A0particular,
>>>=C2=A0 =C2=A0 =C2=A0I would propose that we do need something a= dditional on Commit messages
>>>=C2=A0 =C2=A0 =C2=A0as well
>>>=C2=A0 =C2=A0 =C2=A0as Proposals.
>>>
>>>=C2=A0 =C2=A0 =C2=A0Thinking about solutions here, a couple of = options come to mind:
>>>
>>>=C2=A0 =C2=A0 =C2=A01. Use MLSCiphertext, but with an integrity= -only encapsulation
>>>=C2=A0 =C2=A0 =C2=A02. Incorporate in the signature something t= hat is only known to the group
>>>=C2=A0 =C2=A0 =C2=A0(e.g.,
>>>=C2=A0 =C2=A0 =C2=A0confirmation_key or MAC(confirmation_key; c= onfirmed_transcript_hash ||
>>>=C2=A0 =C2=A0 =C2=A0Proposal/Commit))
>>>
>>>=C2=A0 =C2=A0 =C2=A0Option (1) has the appeal that you would on= ly ever send MLSCiphertext, though
>>>=C2=A0 =C2=A0 =C2=A0switching between encrypted/not could be pr= oblematic.=C2=A0 Option (2) seems a lot
>>>=C2=A0 =C2=A0 =C2=A0more appealing: It doesn't add any over= head, since the group-secret value
>>>=C2=A0 =C2=A0 =C2=A0doesn't need to be sent.=C2=A0 And we a= lready switch between the signature context
>>>=C2=A0 =C2=A0 =C2=A0that is added for group members vs. externa= l.=C2=A0 In fact, I think option
>>>=C2=A0 =C2=A0 =C2=A0(2) would
>>>=C2=A0 =C2=A0 =C2=A0just amount to a one-line change to include= an extra, secret value in the
>>>=C2=A0 =C2=A0 =C2=A0context at the top of the MLSPlaintextTBS s= truct.
>>>=C2=A0 =C2=A0 =C2=A0https://github.com/mlswg/mls-protoco= l/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption=
>>>
>>>=C2=A0 =C2=A0 =C2=A0The only thing that seems odd about (2) is = overloading signature
>>>=C2=A0 =C2=A0 =C2=A0verification in
>>>=C2=A0 =C2=A0 =C2=A0that way, i.e., using the ability to genera= te a signature over a secret
>>>=C2=A0 =C2=A0 =C2=A0thing to
>>>=C2=A0 =C2=A0 =C2=A0prove you know the secret thing.=C2=A0 That= doesn't seem obviously flawed to
>>>=C2=A0 =C2=A0 =C2=A0me, but
>>>=C2=A0 =C2=A0 =C2=A0worth thinking about.
>>>
>>>=C2=A0 =C2=A0 =C2=A0Does that make sense to folks?
>>>
>>>=C2=A0 =C2=A0 =C2=A0--Richard
>>>
>>>
>>>=C2=A0 =C2=A0 =C2=A0On Tue, Aug 18, 2020 at 10:55 AM Raphael Ro= bert
>>>=C2=A0 =C2=A0 =C2=A0<raphael=3D40wire.com@dmarc.ietf.org
>>>=C2=A0 =C2=A0 =C2=A0<mailto:raphael=3D40wire.com@dmarc.ietf.org>=C2=A0<mailto:40wire.com@dmarc.ietf.= org>>
>>>=C2=A0 =C2=A0 =C2=A0wrote:
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0Hi Joel,
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0For context: this would o= nly apply when applications use cleartext
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0MLSPlaintext for HS messa= ges. The recommendation is still to encrypt them
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0and send them around as M= LSCiphertext.
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0That being said, we said = we would like to support scenarios where HS
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0messages are not necessar= ily encrypted.
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0Question: would this atta= ck work with Commit messages? I=E2=80=99m thinking that
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0they would be rejected be= cause the attacker cannot compute the
>>>=C2=A0 =C2=A0 =C2=A0confirmation_tag.
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0As you mention in the PS,= the easy target would be Proposal messages.
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0I=E2=80=99d be interested= to see what exactly you would propose as a mitigation
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0mechanism.
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0Raphael
>>>
>>>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2020, at 16:36, Joel Alwen &l= t;jalwen@wickr.com
>>>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0<mailto:jalwen@wickr.com>> wrote:=
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Hey everyone,
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Something thats been bugging Marta Mula= rczyk and Daniel Jost and me for
>>>>=C2=A0 =C2=A0 =C2=A0a bit
>>>>=C2=A0 =C2=A0 =C2=A0now is that handshake messages sent out= as MLSPlaintext packets are only
>>>>=C2=A0 =C2=A0 =C2=A0authenticated using signatures, but not= using the group's key schedule. For
>>>>=C2=A0 =C2=A0 =C2=A0non-members that makes sense but for gr= oup members that's weaker than
>>>>=C2=A0 =C2=A0 =C2=A0need be.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Suppose Alice is in a group using signi= ng key pair (spk, ssk). I corrupt
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0her to
>>>>=C2=A0 =C2=A0 =C2=A0learn ssk. Now I loose access to her de= vice again. Later she generates a
>>>>=C2=A0 =C2=A0 =C2=A0fresh
>>>>=C2=A0 =C2=A0 =C2=A0key package with her same spk but a new= HPKE key for her leaf. She sends
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0out and
>>>>=C2=A0 =C2=A0 =C2=A0update proposal for her new key package= and someone commits to the update.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Expected result: she (and the group at = large) has achieved PCS again.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Actual result: using her stolen ssk I c= an still forge a new proposal's
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0(sent as
>>>>=C2=A0 =C2=A0 =C2=A0MLSPlaintext packets) coming from Alice= . Some things I could do with this
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0power:
>>>>=C2=A0 =C2=A0 =C2=A0- I can generate a new key package kp f= or Alice using her spk and some
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0HPKE key
>>>>=C2=A0 =C2=A0 =C2=A0she doesn't know. Then I forge an u= pdate proposal for Alice with kp. If it
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0gets
>>>>=C2=A0 =C2=A0 =C2=A0committed I've effectively kicked h= er out of the group.
>>>>=C2=A0 =C2=A0 =C2=A0- I could forge Add's and Remove= 9;s coming from Alice, so I could trick the
>>>>=C2=A0 =C2=A0 =C2=A0group into thinking Alice is trying to = Add my account to the group or remove
>>>>=C2=A0 =C2=A0 =C2=A0some other group member.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Lemme know if I've missed something= here in that scenario...
>>>>
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0If I didn't miss anything and the a= ttacks really work as advertised then IMO
>>>>=C2=A0 =C2=A0 =C2=A0this is kinda weak sauce and worth avoi= ding if possible. So to that end, how
>>>>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaint= ext packets coming from group members
>>>>=C2=A0 =C2=A0 =C2=A0must also be authenticated using someth= ing from the application key
>>>>=C2=A0 =C2=A0 =C2=A0schedule.
>>>>=C2=A0 =C2=A0 =C2=A0Now the above attacks fail. As soon as = Alice's update is gets committed I no
>>>>=C2=A0 =C2=A0 =C2=A0longer know the group's key schedul= e and so can't forged packet from
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0Alice. More
>>>>=C2=A0 =C2=A0 =C2=A0generally, this brings the PCS guarante= es when using MLSPlaintexts
>>>>=C2=A0 =C2=A0 =C2=A0frameing in
>>>>=C2=A0 =C2=A0 =C2=A0line with what we're getting from M= LSCiphertext packets.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0Any thoughts?
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>>>
>>>>
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0PS. For concreteness, we could probably= extend the current mechanism for
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0getting
>>>>=C2=A0 =C2=A0 =C2=A0concistancy (the confirmation_tag) to a= lso provide symmetric key
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0authentication.
>>>>=C2=A0 =C2=A0 =C2=A0E.g. include most of the MLSPlaintext c= ontent into whats being tagged by
>>>>=C2=A0 =C2=A0 =C2=A0confirmation_tag. That would cover the = case of a commit packet and doesn't
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0even
>>>>=C2=A0 =C2=A0 =C2=A0grow the size of MLSPlaintext packets o= ver the current design.
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0For a proposal packet we could also hav= e a confirmation_tag but this one is
>>>>=C2=A0 =C2=A0 =C2=A0computed using the *current* epoch'= s confirmation_key and
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0confirmed_transcript_hash= .
>>>>
>>>>=C2=A0 =C2=A0 =C2=A0_______________________________________= ________
>>>>=C2=A0 =C2=A0 =C2=A0MLS mailing list
>>>>=C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org>=C2=A0<mailto:MLS@ietf.org>
>>>>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/ma= ilman/listinfo/mls
>>>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0_________________________= ______________________
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0MLS mailing list
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0MLS@ietf.org <mailto:MLS@ietf.org>=C2=A0<mailto:MLS@ietf.org>
>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2=A0https://w= ww.ietf.org/mailman/listinfo/mls
>
--00000000000072613205ad2b8400-- From nobody Tue Aug 18 12:20:20 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0E5FC3A0A74 for ; Tue, 18 Aug 2020 12:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xj886SPnmM0w for ; Tue, 18 Aug 2020 12:20:16 -0700 (PDT) Received: from mail-qk1-x730.google.com (mail-qk1-x730.google.com [IPv6:2607:f8b0:4864:20::730]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FB4A3A0A73 for ; Tue, 18 Aug 2020 12:20:16 -0700 (PDT) Received: by mail-qk1-x730.google.com with SMTP id 62so19356109qkj.7 for ; Tue, 18 Aug 2020 12:20:16 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=bXOD5teVqO0FklLapSZ+3YfuugqNYcopqfvWgQCHl1E=; b=09VTvinkFaKK6Q6eICS9VMSy68Hp4SE6THwh1PIA5q4xyra22xFlZEsdAIov8TkIcb x2CceB8HNEKXvM1ZuwZB4YXx4EGrHXFQnftM5azV4tNTqJlo8y5yWpnChbH3JCp8E+1c QcVSRY/H04nn0Oxziq5Rsoz3tJPFLjxcdlifLydNtd+/uxw4gDuIV6sL67TcqLhBAhk1 +SSnmtEfBx8BKqonmNUbvMZNbtT2Z568kihcLO1LFpo02iwoFM1wZh0n7ICsE5U5e4j4 soIclN5nzxS3miHoHu0+9RzoSct15TWdfjzSowGyNUtOYuLQ7iTc51Z1p18+B7P3DARu lPNw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=bXOD5teVqO0FklLapSZ+3YfuugqNYcopqfvWgQCHl1E=; b=DZ6hPVh8lGS6QOWjESxnlFMjiPWCyb7UVV3n/9tR9iaAV1wwmETe9tK7y2t2+e1Wve w0UpEAVx7U3zDVKJpajBsdK79EXoUXC8tz6RNjvs3jla579C8oVV6aigE3TJXa1T5kuw Q7N8th8NpjOTWOj+zB8jedXh94Ws+dh6Vo0wtGU4Z7+F77jceHk2mLqZyPvoaFOu85xI 0dXAYHHodIac1iK0pALvanvcB4vz2VzikIhJAOqMOXV1x/ZQyIn/4ZL0yiyrCCDT7FBZ CSuR1mHgTnvsehtAqeebeDxKouQXkmZ5qOPUS0gby58FzlKiUIlfUbkCI8+8msUizAvh 6Cog== X-Gm-Message-State: AOAM530IUGrZEhxm8wKUJEKijQYIUgcvMVbeo8+fQPsWd+wnd2PDkNDZ KebkDjxdrmVQss2fi2iNl8khkz/UmUd4maMDFuLlIQ== X-Google-Smtp-Source: ABdhPJxds/oVM9V66WDOcM/s+JLxsOgAOj0ylxmJ/RHaJjDYoA2SNV2/3hlMt7vEHLDOKqQBiYWLGaSlOOODZsWYuyc= X-Received: by 2002:a05:620a:132c:: with SMTP id p12mr18355194qkj.159.1597778415217; Tue, 18 Aug 2020 12:20:15 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <7abf555f-a266-f62f-2a22-8b0f389304d5@wickr.com> In-Reply-To: From: Richard Barnes Date: Tue, 18 Aug 2020 15:19:54 -0400 Message-ID: To: Joel Alwen Cc: Brendan McMillion , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000de83f805ad2bc6be" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 19:20:19 -0000 --000000000000de83f805ad2bc6be Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'm not really grokking the PCS sig scheme, but it seems like it's (a) not general to all signature schemes, and (b) complicated enough I would want review from CFRG. Both of which seem like deal breakers for being a requirement here. Much like SIV, it would be nice if we could support it as an option, but I wouldn't want to require it. On Tue, Aug 18, 2020 at 2:26 PM Joel Alwen wrote: > Chaining key pairs builds a PCS sig scheme from a standard one. (No FS > needed.) > > PCS sigs could be helpful as a complementary mechanism for getting yet > more PCS auth. If so it seems worth it to think if we cant get a more > efficient construction of PCS sigs. > > Regardless, proving to receivers that the author of a message knows the > current group key schedule still seems prudent to me. > > - Jo=C3=ABl. > > On Tue, 18 Aug 2020, 19:37 Brendan McMillion, > wrote: > >> I actually describe in the thread I linked how to take a standard FS >> signature and turn it into a PCS signature. While it's baked into the >> primitive, essentially what's happening is that every time Alice sends a= n >> Update, she generates a new signing key and certifies it with her old >> signing key before discarding the old signing key. So if Alice's Update = is >> accepted by the group, anyone who compromised the old signing key can't >> sign new messages because they don't have the private key of the *new* >> signing key. >> >> On Tue, Aug 18, 2020 at 9:55 AM Joel Alwen wrote: >> >>> > My objection to this is that Alice can still be impersonated by >>> members in the group, if we only have symmetric forward-secure >>> authentication. >>> >>> I'm missing how FS sigs (or any other FS auth primitive) helps. My >>> understanding >>> is FS auth primitives prevent leaked keys from being used to authentica= te >>> messages in *past* time periods. But the attack involves signing >>> messages for >>> time periods (epochs) after the leak occurred not before the leak. >>> Imagine we >>> could deterministically ratchet sig key pairs forward much like we can >>> MAC keys. >>> We'd have an FS sig scheme but I dont see how this fixes the problem. >>> >>> Which is not to say that FS sigs dont solve an auth problem for MLS. >>> Just, >>> AFAIK, not this one. (Rather they help prevent forgeries in bygone >>> epochs.) >>> >>> What I do agree with is that other group members (that know Alice's sig >>> key) can >>> still impersonate her in future epochs till she updates the key. The >>> same is >>> true when sending MLSCiphertexts. >>> >>> Unfortunately, for epochs between when Alice's state is leaked and when >>> Alice >>> finally updates her (authentication specific) asymmetric key material I >>> see no >>> way around this. It seems inherent to the adversarial model since other >>> group >>> member know and can do everything Alice can during those epochs. >>> >>> One thing we could look at are PCS signatures. Something like the >>> Updateable PKE >>> scheme in the RTreeKEM work. Namely every time you sign you also >>> re-randomize >>> your signing key (or simply sample new ones). That way leaking your old >>> key >>> doesnt let me sign under your re-randomized new key just like in UPKE >>> leaking >>> your old decryption key doesnt let me read ciphertexts encrypted to you= r >>> re-randomized new key. Make sense? >>> >>> >>> - Jo=C3=ABl >>> >>> >>> On 18/08/2020 18:34, Brendan McMillion wrote: >>> > So to that end, how >>> > about we modify MLS such that MLSPlaintext packets coming from >>> group members >>> > must also be authenticated using something from the application >>> key schedule. >>> > >>> > >>> > My objection to this is that Alice can still be impersonated by >>> members in the >>> > group, if we only have symmetric forward-secure authentication. >>> > >>> > There's been some discussion in the past about using forward-secure >>> signatures >>> > that might be worth looking into instead, which would fully address >>> this attack >>> > vector: >>> https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ >>> > >>> > >>> > On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen >> > > wrote: >>> > >>> > Hey everyone, >>> > >>> > Something thats been bugging Marta Mularczyk and Daniel Jost and >>> me for a bit >>> > now is that handshake messages sent out as MLSPlaintext packets >>> are only >>> > authenticated using signatures, but not using the group's key >>> schedule. For >>> > non-members that makes sense but for group members that's weaker >>> than need be. >>> > >>> > Suppose Alice is in a group using signing key pair (spk, ssk). I >>> corrupt her to >>> > learn ssk. Now I loose access to her device again. Later she >>> generates a fresh >>> > key package with her same spk but a new HPKE key for her leaf. Sh= e >>> sends out and >>> > update proposal for her new key package and someone commits to th= e >>> update. >>> > >>> > Expected result: she (and the group at large) has achieved PCS >>> again. >>> > >>> > Actual result: using her stolen ssk I can still forge a new >>> proposal's (sent as >>> > MLSPlaintext packets) coming from Alice. Some things I could do >>> with this power: >>> > - I can generate a new key package kp for Alice using her spk an= d >>> some HPKE key >>> > she doesn't know. Then I forge an update proposal for Alice with >>> kp. If it gets >>> > committed I've effectively kicked her out of the group. >>> > - I could forge Add's and Remove's coming from Alice, so I could >>> trick the >>> > group into thinking Alice is trying to Add my account to the grou= p >>> or remove >>> > some other group member. >>> > >>> > Lemme know if I've missed something here in that scenario... >>> > >>> > >>> > If I didn't miss anything and the attacks really work as >>> advertised then IMO >>> > this is kinda weak sauce and worth avoiding if possible. So to >>> that end, how >>> > about we modify MLS such that MLSPlaintext packets coming from >>> group members >>> > must also be authenticated using something from the application >>> key schedule. >>> > Now the above attacks fail. As soon as Alice's update is gets >>> committed I no >>> > longer know the group's key schedule and so can't forged packet >>> from Alice. More >>> > generally, this brings the PCS guarantees when using MLSPlaintext= s >>> frameing in >>> > line with what we're getting from MLSCiphertext packets. >>> > >>> > Any thoughts? >>> > >>> > - Jo=C3=ABl >>> > >>> > >>> > >>> > PS. For concreteness, we could probably extend the current >>> mechanism for getting >>> > concistancy (the confirmation_tag) to also provide symmetric key >>> authentication. >>> > E.g. include most of the MLSPlaintext content into whats being >>> tagged by >>> > confirmation_tag. That would cover the case of a commit packet an= d >>> doesn't even >>> > grow the size of MLSPlaintext packets over the current design. >>> > >>> > For a proposal packet we could also have a confirmation_tag but >>> this one is >>> > computed using the *current* epoch's confirmation_key and >>> > confirmed_transcript_hash. >>> > >>> > _______________________________________________ >>> > MLS mailing list >>> > MLS@ietf.org >>> > https://www.ietf.org/mailman/listinfo/mls >>> > >>> >> _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000de83f805ad2bc6be Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'm not really grokking the PCS sig scheme, but i= t seems like it's (a) not general to all signature schemes, and (b) com= plicated enough I would want review from CFRG.=C2=A0 Both of which seem lik= e deal breakers for being a requirement here.

Much= like SIV, it would be nice if we could support it as an option, but I woul= dn't want to require it.

=
On Tue, Aug 18, 2020 at 2:26 PM Joel = Alwen <jalwen@wickr.com> wrot= e:
Chaining key pairs builds a PCS sig scheme from a standard one. (No FS= needed.)

PCS sigs could be he= lpful as a complementary mechanism for getting yet more PCS auth. If so it = seems worth it to think if we cant get a more efficient construction of PCS= sigs.

Regardless, provi= ng to receivers that the author of a message knows the current group key sc= hedule still seems prudent to me.

- Jo=C3=ABl.

On Tue, 18 Aug 2020, 19:37 Brendan McMillion,= <brendan@cl= oudflare.com> wrote:
I actually describe in the thread I linked how= to take a standard FS signature and turn it into a PCS signature. While it= 's baked into the primitive, essentially what's happening is that e= very time Alice sends an Update, she generates a new signing key and certif= ies it with her old signing key before discarding the old signing key. So i= f Alice's Update is accepted by the group, anyone who compromised the o= ld signing key can't sign new messages because they don't have the = private key of the *new* signing key.

On Tue, Aug 18, 2020 at 9:55 AM Jo= el Alwen <jalwen@wickr.com> wrote:
> My objection to this is that Alice can sti= ll be impersonated by members in the group, if we only have symmetric forwa= rd-secure authentication.

I'm missing how FS sigs (or any other FS auth primitive) helps. My unde= rstanding
is FS auth primitives prevent leaked keys from being used to authenticate messages in *past* time periods. But the attack involves signing messages f= or
time periods (epochs) after the leak occurred not before the leak. Imagine = we
could deterministically ratchet sig key pairs forward much like we can MAC = keys.
We'd have an FS sig scheme but I dont see how this fixes the problem.
Which is not to say that FS sigs dont solve an auth problem for MLS. Just,<= br> AFAIK, not this one. (Rather they help prevent forgeries in bygone epochs.)=

What I do agree with is that other group members (that know Alice's sig= key) can
still impersonate her in future epochs till she updates the key. The same i= s
true when sending MLSCiphertexts.

Unfortunately, for epochs between when Alice's state is leaked and when= Alice
finally updates her (authentication specific) asymmetric key material I see= no
way around this. It seems inherent to the adversarial model since other gro= up
member know and can do everything Alice can during those epochs.

One thing we could look at are PCS signatures. Something like the Updateabl= e PKE
scheme in the RTreeKEM work. Namely every time you sign you also re-randomi= ze
your signing key (or simply sample new ones). That way leaking your old key=
doesnt let me sign under your re-randomized new key just like in UPKE leaki= ng
your old decryption key doesnt let me read ciphertexts encrypted to your re-randomized new key. Make sense?


- Jo=C3=ABl


On 18/08/2020 18:34, Brendan McMillion wrote:
>=C2=A0 =C2=A0 =C2=A0So to that end, how
>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaintext packets = coming from group members
>=C2=A0 =C2=A0 =C2=A0must also be authenticated using something from the= application key schedule.
>
>
> My objection to this is that Alice can still be impersonated by member= s in the
> group, if we only have symmetric forward-secure authentication.
>
> There's been some discussion in the past about using forward-secur= e signatures
> that might be worth looking into instead, which would fully address th= is attack
> vector: https:= //mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/
>
>
> On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen <jalwen@wickr.com
> <mailto:jalwen@wickr.com>> wrote:
>
>=C2=A0 =C2=A0 =C2=A0Hey everyone,
>
>=C2=A0 =C2=A0 =C2=A0Something thats been bugging Marta Mularczyk and Da= niel Jost and me for a bit
>=C2=A0 =C2=A0 =C2=A0now is that handshake messages sent out as MLSPlain= text packets are only
>=C2=A0 =C2=A0 =C2=A0authenticated using signatures, but not using the g= roup's key schedule. For
>=C2=A0 =C2=A0 =C2=A0non-members that makes sense but for group members = that's weaker than need be.
>
>=C2=A0 =C2=A0 =C2=A0Suppose Alice is in a group using signing key pair = (spk, ssk). I corrupt her to
>=C2=A0 =C2=A0 =C2=A0learn ssk. Now I loose access to her device again. = Later she generates a fresh
>=C2=A0 =C2=A0 =C2=A0key package with her same spk but a new HPKE key fo= r her leaf. She sends out and
>=C2=A0 =C2=A0 =C2=A0update proposal for her new key package and someone= commits to the update.
>
>=C2=A0 =C2=A0 =C2=A0Expected result: she (and the group at large) has a= chieved PCS again.
>
>=C2=A0 =C2=A0 =C2=A0Actual result: using her stolen ssk I can still for= ge a new proposal's (sent as
>=C2=A0 =C2=A0 =C2=A0MLSPlaintext packets) coming from Alice. Some thing= s I could do with this power:
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I can generate a new key package kp for Ali= ce using her spk and some HPKE key
>=C2=A0 =C2=A0 =C2=A0she doesn't know. Then I forge an update propos= al for Alice with kp. If it gets
>=C2=A0 =C2=A0 =C2=A0committed I've effectively kicked her out of th= e group.
>=C2=A0 =C2=A0 =C2=A0=C2=A0- I could forge Add's and Remove's co= ming from Alice, so I could trick the
>=C2=A0 =C2=A0 =C2=A0group into thinking Alice is trying to Add my accou= nt to the group or remove
>=C2=A0 =C2=A0 =C2=A0some other group member.
>
>=C2=A0 =C2=A0 =C2=A0Lemme know if I've missed something here in tha= t scenario...
>
>
>=C2=A0 =C2=A0 =C2=A0If I didn't miss anything and the attacks reall= y work as advertised then IMO
>=C2=A0 =C2=A0 =C2=A0this is kinda weak sauce and worth avoiding if poss= ible. So to that end, how
>=C2=A0 =C2=A0 =C2=A0about we modify MLS such that MLSPlaintext packets = coming from group members
>=C2=A0 =C2=A0 =C2=A0must also be authenticated using something from the= application key schedule.
>=C2=A0 =C2=A0 =C2=A0Now the above attacks fail. As soon as Alice's = update is gets committed I no
>=C2=A0 =C2=A0 =C2=A0longer know the group's key schedule and so can= 't forged packet from Alice. More
>=C2=A0 =C2=A0 =C2=A0generally, this brings the PCS guarantees when usin= g MLSPlaintexts frameing in
>=C2=A0 =C2=A0 =C2=A0line with what we're getting from MLSCiphertext= packets.
>
>=C2=A0 =C2=A0 =C2=A0Any thoughts?
>
>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>
>
>
>=C2=A0 =C2=A0 =C2=A0PS. For concreteness, we could probably extend the = current mechanism for getting
>=C2=A0 =C2=A0 =C2=A0concistancy (the confirmation_tag) to also provide = symmetric key authentication.
>=C2=A0 =C2=A0 =C2=A0E.g. include most of the MLSPlaintext content into = whats being tagged by
>=C2=A0 =C2=A0 =C2=A0confirmation_tag. That would cover the case of a co= mmit packet and doesn't even
>=C2=A0 =C2=A0 =C2=A0grow the size of MLSPlaintext packets over the curr= ent design.
>
>=C2=A0 =C2=A0 =C2=A0For a proposal packet we could also have a confirma= tion_tag but this one is
>=C2=A0 =C2=A0 =C2=A0computed using the *current* epoch's confirmati= on_key and
>=C2=A0 =C2=A0 =C2=A0confirmed_transcript_hash.
>
>=C2=A0 =C2=A0 =C2=A0_______________________________________________
>=C2=A0 =C2=A0 =C2=A0MLS mailing list
>=C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org>
>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mai= lman/listinfo/mls
>
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000de83f805ad2bc6be-- From nobody Tue Aug 18 12:21:46 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D97493A0A83 for ; Tue, 18 Aug 2020 12:21:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Tk7r3k_sEKOM for ; Tue, 18 Aug 2020 12:21:41 -0700 (PDT) Received: from mail-qk1-x734.google.com (mail-qk1-x734.google.com [IPv6:2607:f8b0:4864:20::734]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BC6BB3A0A79 for ; Tue, 18 Aug 2020 12:21:41 -0700 (PDT) Received: by mail-qk1-x734.google.com with SMTP id m7so19341354qki.12 for ; Tue, 18 Aug 2020 12:21:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fe50VgcC9Dh4BlXx99VjCdwIoaLbJrpkCXOuN49Dh9g=; b=PD8yLJ7KNkY/+18f+V9Pkiar2VV0y9B2X3Y5RR3EUTtb+E0tCq3YVWdEqQ/60eB0Uu f+hn8yreVTU9O8YuBcp6rAZkw0DEJhPvHee/zJDdHHevC4C1i6WLrg76xtBBUbhyyzbT nbN4LANyZ9jh/qccZNjvBT/enedBfeFkX900hv6FAOM8HDfQFxgqDkKJp8EcftAbJB/k OgGt0H3xB3lKH7HitZC67bFWuDL7DMGJ892LL924dkCzZ8QeXULMf+8lpRq6PufciAOt AIswNW0/LvLxDLyOvP6hTqFX+dQ4ynDsHLLVWQIPcpjMwP077vIuHlFcTj5idUCCa/Um LWlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fe50VgcC9Dh4BlXx99VjCdwIoaLbJrpkCXOuN49Dh9g=; b=O/tnxjqqNbDZ6WOUdR9iWVdI3abbvQ9LEhUjO766ziiY97xh6qJ1RyiGfdJSmQHcKz ncY93coLq2UGAJ3VlFc6gcmP0FW1NwLaIiexrQ4yYAIgkgkOpz9RBYyBfs/hmWt4rQJ6 pufdWR45XTS6Qpa++EX0COU/IluCIPK5eEeQE8ofLWUsJvI5D+v+4WVhUaPtu6QWyR0u cImOggKrwMsREVorJ5cpl8aFCqqisvEyTcWL6VQ2HUjwWh/BVBHsXZJgcDEI2gd6V7/v 5HzwaXWKs4xWyQ0q1gMI0Jl1nuKLcfQIc65uD/Lw2M6oSm2mnX/zYX7Y1qiXqKZv780y 4BpA== X-Gm-Message-State: AOAM5303f3/jj0MN7Sx+2Z98GyiHxYKRt2gPGs1Ml3QYkDsxAuILdGVe w2XrTuRtSKGKX7KuQqcYwRIijp8UXD59tlkLAMhUxqhLy5paRA== X-Google-Smtp-Source: ABdhPJxOTU/R5lZodfuwS3UbbHaqeUO0j7jvgX1jjYY8HiXFt6CD4I6zlI4mZGysLvb5tGgy2YNooHAksmwoxtKWtkA= X-Received: by 2002:a37:8287:: with SMTP id e129mr16611766qkd.132.1597778500634; Tue, 18 Aug 2020 12:21:40 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: From: Richard Barnes Date: Tue, 18 Aug 2020 15:21:20 -0400 Message-ID: To: Brendan McMillion Cc: Joel Alwen , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000f5e0a005ad2bcb06" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 19:21:45 -0000 --000000000000f5e0a005ad2bcb06 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Brendan: I think you might have the wrong premise in mind here. The proposal we have been discussing would authenticate *both* that Alice is the sender of the message *and* that she's a member of the group. So other members of the group could only impersonate Alice if they had compromised her signing key. On Tue, Aug 18, 2020 at 12:35 PM Brendan McMillion wrote: > So to that end, how >> about we modify MLS such that MLSPlaintext packets coming from group >> members >> must also be authenticated using something from the application key >> schedule. > > > My objection to this is that Alice can still be impersonated by members i= n > the group, if we only have symmetric forward-secure authentication. > > There's been some discussion in the past about using forward-secure > signatures that might be worth looking into instead, which would fully > address this attack vector: > https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ > > > On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen wrote: > >> Hey everyone, >> >> Something thats been bugging Marta Mularczyk and Daniel Jost and me for = a >> bit >> now is that handshake messages sent out as MLSPlaintext packets are only >> authenticated using signatures, but not using the group's key schedule. >> For >> non-members that makes sense but for group members that's weaker than >> need be. >> >> Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt >> her to >> learn ssk. Now I loose access to her device again. Later she generates a >> fresh >> key package with her same spk but a new HPKE key for her leaf. She sends >> out and >> update proposal for her new key package and someone commits to the updat= e. >> >> Expected result: she (and the group at large) has achieved PCS again. >> >> Actual result: using her stolen ssk I can still forge a new proposal's >> (sent as >> MLSPlaintext packets) coming from Alice. Some things I could do with thi= s >> power: >> - I can generate a new key package kp for Alice using her spk and some >> HPKE key >> she doesn't know. Then I forge an update proposal for Alice with kp. If >> it gets >> committed I've effectively kicked her out of the group. >> - I could forge Add's and Remove's coming from Alice, so I could trick >> the >> group into thinking Alice is trying to Add my account to the group or >> remove >> some other group member. >> >> Lemme know if I've missed something here in that scenario... >> >> >> If I didn't miss anything and the attacks really work as advertised then >> IMO >> this is kinda weak sauce and worth avoiding if possible. So to that end, >> how >> about we modify MLS such that MLSPlaintext packets coming from group >> members >> must also be authenticated using something from the application key >> schedule. >> Now the above attacks fail. As soon as Alice's update is gets committed = I >> no >> longer know the group's key schedule and so can't forged packet from >> Alice. More >> generally, this brings the PCS guarantees when using MLSPlaintexts >> frameing in >> line with what we're getting from MLSCiphertext packets. >> >> Any thoughts? >> >> - Jo=C3=ABl >> >> >> >> PS. For concreteness, we could probably extend the current mechanism for >> getting >> concistancy (the confirmation_tag) to also provide symmetric key >> authentication. >> E.g. include most of the MLSPlaintext content into whats being tagged by >> confirmation_tag. That would cover the case of a commit packet and >> doesn't even >> grow the size of MLSPlaintext packets over the current design. >> >> For a proposal packet we could also have a confirmation_tag but this one >> is >> computed using the *current* epoch's confirmation_key and >> confirmed_transcript_hash. >> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000f5e0a005ad2bcb06 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Brendan: I think you might have the wrong premise in = mind here.=C2=A0 The proposal we have been discussing would authenticate *b= oth* that Alice is the sender of the message *and* that she's a member = of the group.=C2=A0 So other members of the group could only impersonate Al= ice if they had compromised her signing key.


On Tue, Aug 18, 2020= at 12:35 PM Brendan McMillion <brendan=3D40cloudflare.com@dmarc.ietf.org> wrote:
So to that end, how
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.

My objection to this is that Alice can s= till be impersonated by members in the group, if we only have symmetric for= ward-secure authentication.

There's been some = discussion in the past about using forward-secure signatures that might be = worth looking into instead, which would fully address this attack vector: <= a href=3D"https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cj= ADpw/" target=3D"_blank">https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_= 4s6STmnqmz514cjADpw/


On Tue, Aug 18, 2020 at 7:36 A= M Joel Alwen <jalw= en@wickr.com> wrote:
Hey everyone,

Something thats been bugging Marta Mularczyk and Daniel Jost and me for a b= it
now is that handshake messages sent out as MLSPlaintext packets are only authenticated using signatures, but not using the group's key schedule.= For
non-members that makes sense but for group members that's weaker than n= eed be.

Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt he= r to
learn ssk. Now I loose access to her device again. Later she generates a fr= esh
key package with her same spk but a new HPKE key for her leaf. She sends ou= t and
update proposal for her new key package and someone commits to the update.<= br>
Expected result: she (and the group at large) has achieved PCS again.

Actual result: using her stolen ssk I can still forge a new proposal's = (sent as
MLSPlaintext packets) coming from Alice. Some things I could do with this p= ower:
=C2=A0- I can generate a new key package kp for Alice using her spk and som= e HPKE key
she doesn't know. Then I forge an update proposal for Alice with kp. If= it gets
committed I've effectively kicked her out of the group.
=C2=A0- I could forge Add's and Remove's coming from Alice, so I co= uld trick the
group into thinking Alice is trying to Add my account to the group or remov= e
some other group member.

Lemme know if I've missed something here in that scenario...


If I didn't miss anything and the attacks really work as advertised the= n IMO
this is kinda weak sauce and worth avoiding if possible. So to that end, ho= w
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.
Now the above attacks fail. As soon as Alice's update is gets committed= I no
longer know the group's key schedule and so can't forged packet fro= m Alice. More
generally, this brings the PCS guarantees when using MLSPlaintexts frameing= in
line with what we're getting from MLSCiphertext packets.

Any thoughts?

- Jo=C3=ABl



PS. For concreteness, we could probably extend the current mechanism for ge= tting
concistancy (the confirmation_tag) to also provide symmetric key authentica= tion.
E.g. include most of the MLSPlaintext content into whats being tagged by confirmation_tag. That would cover the case of a commit packet and doesn= 9;t even
grow the size of MLSPlaintext packets over the current design.

For a proposal packet we could also have a confirmation_tag but this one is=
computed using the *current* epoch's confirmation_key and confirmed_tra= nscript_hash.

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000f5e0a005ad2bcb06-- From nobody Tue Aug 18 15:08:40 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EF5733A0E1F for ; Tue, 18 Aug 2020 15:08:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.099 X-Spam-Level: X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cloudflare.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7EUb0zDf9Lm1 for ; Tue, 18 Aug 2020 15:08:37 -0700 (PDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 14EB83A0E1D for ; Tue, 18 Aug 2020 15:08:37 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id 2so19815693qkf.10 for ; Tue, 18 Aug 2020 15:08:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HJiWAV7EPNuskQsBTVllkI2c/4VtdMG3NCpPBDhcmAI=; b=dGhLRqViQEQgTJgF3FI1KVKfI+/ahsadxn6nEcf8eA1hRU/ijx5hyovECoeY4JCYUO 3eBWNDnKmEXIn9WazWACHWg3pAuRUXBQmJw8Z09v4hi/JibUwKr1o8W8VD7EP3nMoOe9 PlYHPylUj8h7nApBdG4t6dcqmBcqfkMpiWJYU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HJiWAV7EPNuskQsBTVllkI2c/4VtdMG3NCpPBDhcmAI=; b=MQ4sL6vl8rpyailu/2HsZ0uQGaQy3ON8P3r9uMY+3txuvYWi0rHy2QiYakbZ3ZOcIO cTg1Bzu3Xrki4iwJY1o5Bs0qMUnGTvm0p0uhZDk40vXQW9nOK8McUq3tLWNO3mCmpJLc 0b1iGGalcrimJppTeGPeOq0KT7PMNdoA3akONaJVY7/dsIy3tp4dJa2SPw3KFM1tbTYv oLOM1iGs2Pl8wXXxdCnTJC8/5DDnSDtwmZ24DEJAJrSOzltAPeL/nZ3bXq9O4TUjYQd5 xwmuV2ZS3qPlu+/WGRIl1vOdjDyyJZUn/q910TZlXTTjfKs//ND+r3hZcflPmH1eEBpv sFDA== X-Gm-Message-State: AOAM533FU5wGSm6lEIuHASHXC2NOYgKNuTuew2X37hPeMvPL+VUnU8Ub ROoN3q1y0gUIOfKPjGqRxVI5PWyOGE0z0eZE7E99jgObIBjniQ== X-Google-Smtp-Source: ABdhPJz1u1jOJp/MIMs+W7WBFLSabrDsPoaoAHQQNBHWJm7eS3XS6T8s0O9QxtTLyapq00dvR6hdHXR2kWutPfC3K7k= X-Received: by 2002:ae9:ef8d:: with SMTP id d135mr18479627qkg.109.1597788515874; Tue, 18 Aug 2020 15:08:35 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: From: Brendan McMillion Date: Tue, 18 Aug 2020 15:08:24 -0700 Message-ID: To: Richard Barnes Cc: Joel Alwen , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000ea6c6b05ad2e208f" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Aug 2020 22:08:40 -0000 --000000000000ea6c6b05ad2e208f Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > > Brendan: I think you might have the wrong premise in mind here. The > proposal we have been discussing would authenticate *both* that Alice is > the sender of the message *and* that she's a member of the group. So oth= er > members of the group could only impersonate Alice if they had compromised > her signing key. > Sorry to change arguments, but I think you're right that I missed the point. I actually don't think we should do anything here. That's because: if Alice's long-term signing key is compromised, how can she be impersonated? In all of these ways: 1. An outsider can send a message to an existing group. 2. An insider can send a message to an existing group. 3. An attacker can generate new KeyPackages and intercept Welcome messages intended for her. 4. An attacker can forge her existence in a group she's not in. The PR you opened only addresses attack vector #1. You still have all the other attack vectors and to address them, Alice needs to rotate her long-term signing key. Rotating the long-term signing key should be the resolution here, not heading off an individual attack. In the past, we usually considered the long-term signing key to be stored somewhere more secure than everything else, such that it was very unlikely to be compromised, or that it was rotated regularly. That's why we haven't worried about this in the past. On Tue, Aug 18, 2020 at 12:21 PM Richard Barnes wrote: > Brendan: I think you might have the wrong premise in mind here. The > proposal we have been discussing would authenticate *both* that Alice is > the sender of the message *and* that she's a member of the group. So oth= er > members of the group could only impersonate Alice if they had compromised > her signing key. > > > On Tue, Aug 18, 2020 at 12:35 PM Brendan McMillion 40cloudflare.com@dmarc.ietf.org <40cloudflare..com@dmarc.ietf.org>> wrote= : > >> So to that end, how >>> about we modify MLS such that MLSPlaintext packets coming from group >>> members >>> must also be authenticated using something from the application key >>> schedule. >> >> >> My objection to this is that Alice can still be impersonated by members >> in the group, if we only have symmetric forward-secure authentication. >> >> There's been some discussion in the past about using forward-secure >> signatures that might be worth looking into instead, which would fully >> address this attack vector: >> https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cjADpw/ >> >> >> On Tue, Aug 18, 2020 at 7:36 AM Joel Alwen wrote: >> >>> Hey everyone, >>> >>> Something thats been bugging Marta Mularczyk and Daniel Jost and me for >>> a bit >>> now is that handshake messages sent out as MLSPlaintext packets are onl= y >>> authenticated using signatures, but not using the group's key schedule. >>> For >>> non-members that makes sense but for group members that's weaker than >>> need be. >>> >>> Suppose Alice is in a group using signing key pair (spk, ssk). I corrup= t >>> her to >>> learn ssk. Now I loose access to her device again. Later she generates = a >>> fresh >>> key package with her same spk but a new HPKE key for her leaf. She send= s >>> out and >>> update proposal for her new key package and someone commits to the >>> update. >>> >>> Expected result: she (and the group at large) has achieved PCS again. >>> >>> Actual result: using her stolen ssk I can still forge a new proposal's >>> (sent as >>> MLSPlaintext packets) coming from Alice. Some things I could do with >>> this power: >>> - I can generate a new key package kp for Alice using her spk and some >>> HPKE key >>> she doesn't know. Then I forge an update proposal for Alice with kp. If >>> it gets >>> committed I've effectively kicked her out of the group. >>> - I could forge Add's and Remove's coming from Alice, so I could trick >>> the >>> group into thinking Alice is trying to Add my account to the group or >>> remove >>> some other group member. >>> >>> Lemme know if I've missed something here in that scenario... >>> >>> >>> If I didn't miss anything and the attacks really work as advertised the= n >>> IMO >>> this is kinda weak sauce and worth avoiding if possible. So to that end= , >>> how >>> about we modify MLS such that MLSPlaintext packets coming from group >>> members >>> must also be authenticated using something from the application key >>> schedule. >>> Now the above attacks fail. As soon as Alice's update is gets committed >>> I no >>> longer know the group's key schedule and so can't forged packet from >>> Alice. More >>> generally, this brings the PCS guarantees when using MLSPlaintexts >>> frameing in >>> line with what we're getting from MLSCiphertext packets. >>> >>> Any thoughts? >>> >>> - Jo=C3=ABl >>> >>> >>> >>> PS. For concreteness, we could probably extend the current mechanism fo= r >>> getting >>> concistancy (the confirmation_tag) to also provide symmetric key >>> authentication. >>> E.g. include most of the MLSPlaintext content into whats being tagged b= y >>> confirmation_tag. That would cover the case of a commit packet and >>> doesn't even >>> grow the size of MLSPlaintext packets over the current design. >>> >>> For a proposal packet we could also have a confirmation_tag but this on= e >>> is >>> computed using the *current* epoch's confirmation_key and >>> confirmed_transcript_hash. >>> >>> _______________________________________________ >>> MLS mailing list >>> MLS@ietf.org >>> https://www.ietf.org/mailman/listinfo/mls >>> >> _______________________________________________ >> MLS mailing list >> MLS@ietf.org >> https://www.ietf.org/mailman/listinfo/mls >> > --000000000000ea6c6b05ad2e208f Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Brendan: I think you might have the wrong premise in mind here.=C2=A0=20 The proposal we have been discussing would authenticate *both* that=20 Alice is the sender of the message *and* that she's a member of the=20 group.=C2=A0 So other members of the group could only impersonate Alice if= =20 they had compromised her signing key.

Sorry to change arguments, but I think you're right that I misse= d the point. I actually don't think we should do anything here. That= 9;s because: if Alice's long-term signing key is compromised, how can s= he be impersonated? In all of these ways:
  1. An outsider= can send a message to an existing group.
  2. An insider can send a mes= sage to an existing group.
  3. An attacker can generate new KeyPackages= and intercept Welcome messages intended for her.
  4. An attacker can f= orge her existence in a group she's not in.
The PR you op= ened only addresses attack vector #1. You still have all the other attack v= ectors and to address them, Alice needs to rotate her long-term signing key= . Rotating the long-term signing key should be the resolution here, not hea= ding off an individual attack.

In the past, we= usually considered the long-term signing key to be stored somewhere more s= ecure than everything else, such that it was very unlikely to be compromise= d, or that it was rotated regularly. That's why we haven't worried = about this in the past.

On Tue, Aug 18, 2020 at 12:21 PM Ric= hard Barnes <rlb@ipv.sx> wrote:
Brendan: I think you might have= the wrong premise in mind here.=C2=A0 The proposal we have been discussing= would authenticate *both* that Alice is the sender of the message *and* th= at she's a member of the group.=C2=A0 So other members of the group cou= ld only impersonate Alice if they had compromised her signing key.

On Tue, Aug 18, 2020 at 12:35 PM Brendan McMillion <brendan=3D40cloudflare= .com@dmarc.ietf.org> wrote:
So to that end, how
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.

My objection to this is that Alice can s= till be impersonated by members in the group, if we only have symmetric for= ward-secure authentication.

There's been some = discussion in the past about using forward-secure signatures that might be = worth looking into instead, which would fully address this attack vector: <= a href=3D"https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_4s6STmnqmz514cj= ADpw/" target=3D"_blank">https://mailarchive.ietf.org/arch/msg/mls/o3fmIul_= 4s6STmnqmz514cjADpw/


On Tue, Aug 18, 2020 at 7:36 A= M Joel Alwen <jalw= en@wickr.com> wrote:
Hey everyone,

Something thats been bugging Marta Mularczyk and Daniel Jost and me for a b= it
now is that handshake messages sent out as MLSPlaintext packets are only authenticated using signatures, but not using the group's key schedule.= For
non-members that makes sense but for group members that's weaker than n= eed be.

Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt he= r to
learn ssk. Now I loose access to her device again. Later she generates a fr= esh
key package with her same spk but a new HPKE key for her leaf. She sends ou= t and
update proposal for her new key package and someone commits to the update.<= br>
Expected result: she (and the group at large) has achieved PCS again.

Actual result: using her stolen ssk I can still forge a new proposal's = (sent as
MLSPlaintext packets) coming from Alice. Some things I could do with this p= ower:
=C2=A0- I can generate a new key package kp for Alice using her spk and som= e HPKE key
she doesn't know. Then I forge an update proposal for Alice with kp. If= it gets
committed I've effectively kicked her out of the group.
=C2=A0- I could forge Add's and Remove's coming from Alice, so I co= uld trick the
group into thinking Alice is trying to Add my account to the group or remov= e
some other group member.

Lemme know if I've missed something here in that scenario...


If I didn't miss anything and the attacks really work as advertised the= n IMO
this is kinda weak sauce and worth avoiding if possible. So to that end, ho= w
about we modify MLS such that MLSPlaintext packets coming from group member= s
must also be authenticated using something from the application key schedul= e.
Now the above attacks fail. As soon as Alice's update is gets committed= I no
longer know the group's key schedule and so can't forged packet fro= m Alice. More
generally, this brings the PCS guarantees when using MLSPlaintexts frameing= in
line with what we're getting from MLSCiphertext packets.

Any thoughts?

- Jo=C3=ABl



PS. For concreteness, we could probably extend the current mechanism for ge= tting
concistancy (the confirmation_tag) to also provide symmetric key authentica= tion.
E.g. include most of the MLSPlaintext content into whats being tagged by confirmation_tag. That would cover the case of a commit packet and doesn= 9;t even
grow the size of MLSPlaintext packets over the current design.

For a proposal packet we could also have a confirmation_tag but this one is=
computed using the *current* epoch's confirmation_key and confirmed_tra= nscript_hash.

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000ea6c6b05ad2e208f-- From nobody Tue Aug 18 17:43:17 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2ACC53A1070 for ; Tue, 18 Aug 2020 17:43:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lxzsKyCqRTj2 for ; Tue, 18 Aug 2020 17:43:13 -0700 (PDT) Received: from mule.nps.edu (mule.nps.edu [205.155.65.106]) by ietfa.amsl.com (Postfix) with ESMTP id A1E133A1067 for ; Tue, 18 Aug 2020 17:43:13 -0700 (PDT) X-ASG-Debug-ID: 1597797791-0e39454aef1fa50001-bGA3T6 Received: from mail.nps.edu (skywalker.ern.nps.edu [172.20.4.117]) by mule.nps.edu with ESMTP id UysXkMGgiBemBBrD; Tue, 18 Aug 2020 17:43:11 -0700 (PDT) X-Barracuda-Envelope-From: britta.hale@nps.edu Received: from skywalker.ern.nps.edu (172.20.4.117) by skywalker.ern.nps.edu (172.20.4.117) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1531.3; Tue, 18 Aug 2020 17:43:11 -0700 Received: from NAM04-BN8-obe.outbound.protection.outlook.com (104.47.74.46) by skywalker.ern.nps.edu (172.20.4.117) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.1.1531.3 via Frontend Transport; Tue, 18 Aug 2020 17:43:11 -0700 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HVBfmNH7SAGYzqUrdxyz3l+bk5zF1K729pUwaIPiesdGI0uCfwHTho8UeCIBuYrWp5tJSF6KO+p0xuTBt9bjlASKf1oWwf9kXKO0MWf4ln3qPlwgqwTKWsIZ54PimAE7vxGXjohgt3Y4GK/A9dSN+rsX0Ui2/AUEzaXMol6zF1kAjRRYV99lv35BsqpxvM3zlY6cq6zsQoN7QrX6ALTWGrNyACMZWE+WDKlf+8yPcZYFg+ietmffVnMskU23zZgy4T698NYXpdFaN/iuYNVsSDG+nagcmJWBS4l5hJWnO/jo559dZSU4rVIcu45HFpH5Gup/pSOWHhh2XiHHjxJ9aQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6NWZWX9UfdFNnJoKfLzE+G9ET2bOfaY4XBcNZ+0/wj4=; b=cfF1/eTew1mZ1JNIM+hyBk0JtV6ioUmg1oMZIyS9pCqj5xbQlluDQUw7OukFpdFl1FHIQEuewSfpsKjbx6lFvZxaPuclIj4iRWpDnlXD6ZgXxMGS6EdYIjFgHxLsviCOQMwMoCvOgRYgtH2oaBG3D3HIoPKeua1GwMJb2Z9eOEOLiG7shPD8fxNWmcIGByngGelAEVBn8MsMbBlEMJuiD26TpDNNqX8ni2rnYV58MS//7RdyKlOzSZtgfHs9LfIEDbUbmtQql3g2vjatXSDIX0UMkkzujSOIO3DBYnW1yegArfnPx5B98aRSJ6R4UvTj+RegpcUfpkK5aObuCafjuQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=nps.edu; dmarc=pass action=none header.from=nps.edu; dkim=pass header.d=nps.edu; arc=none Received: from BY5PR13MB3348.namprd13.prod.outlook.com (2603:10b6:a03:1aa::23) by BY5PR13MB3634.namprd13.prod.outlook.com (2603:10b6:a03:226::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3305.10; Wed, 19 Aug 2020 00:43:07 +0000 Received: from BY5PR13MB3348.namprd13.prod.outlook.com ([fe80::65b1:6350:343d:c101]) by BY5PR13MB3348.namprd13.prod.outlook.com ([fe80::65b1:6350:343d:c101%7]) with mapi id 15.20.3305.017; Wed, 19 Aug 2020 00:43:07 +0000 X-Barracuda-Effective-Source-IP: UNKNOWN[2603:10b6:a03:226::10] X-Barracuda-Apparent-Source-IP: 2603:10b6:a03:226::10 From: "Hale, Britta (CIV)" To: Brendan McMillion , "Richard Barnes" CC: Messaging Layer Security WG , Joel Alwen Thread-Topic: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-ASG-Orig-Subj: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule Thread-Index: AQHWdWz00GMqSfzrNUeLjUcYEIMnS6k+EBeAgAAukACAAC6tAP//teAA Date: Wed, 19 Aug 2020 00:43:07 +0000 Message-ID: References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.10.17.200615 authentication-results: dmarc.ietf.org; dkim=none (message not signed) header.d=none;dmarc.ietf.org; dmarc=none action=none header.from=nps.edu; x-originating-ip: [205.155.65.226] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 18b3b593-61a9-41c0-1e09-08d843d8d73d x-ms-traffictypediagnostic: BY5PR13MB3634: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: QlTSeFCnMDYsVqVAieskDardpvYICB2WnUZtx363X+D1ZA34EkWyJlKOH3xVXLN25WfTgBhqOrw0edLNKk9T9bbY7NtDtvoR8/n9T2tmyDeAJzuKAs5C4uvkNgoFlqsuCWTNybmGprIO/DjesZDqyL+4//wIqftLAJtV4fH0e00Y5GeNWOK7M3XRFpr+M3y9H3F8MFAJbWMW1PzNEhVDSgyp7AY/JXcsZ5mNNIdhpR30bDD/IoK8t65ct5ebR/Qg1rMFf9FFibnnqv7YohnqzE+2VpeZZFruk8QKaaNGCGdxSCON1EC6WKbv3JTS3jo2ZCjwjzTgwo4ABJLx6rcfks7E/wyJUyFMFoVJko+7oxqATIwelV8/87J+yOeheSLHalbJQtd+gRTaZP2iwOSAMw== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:BY5PR13MB3348.namprd13.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(136003)(376002)(346002)(366004)(39850400004)(396003)(966005)(83380400001)(36756003)(6506007)(478600001)(75432002)(33656002)(53546011)(2616005)(4326008)(54906003)(786003)(166002)(110136005)(86362001)(66556008)(6486002)(6512007)(66946007)(71200400001)(66446008)(64756008)(66476007)(2906002)(5660300002)(316002)(8936002)(66574015)(76116006)(186003)(26005)(8676002); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: xjQzXPcYmgItLV6+yvZqMJ1BuqTQ/hsixjcF9qhoDS+XYSq4gNRj+FyqStcG3inhNmGFyQ47eXTi1k1NkSytq70708Z6lV0wJUEFHP7g/ILl5GlT7zITV8nrbjog5EN5mHN3TdCWmi5143zcn3/WC9v51sSIe+fEABW/YneiRVN/S1mou9FVE5pi2j8qCrOCGa78BmFeuqG4JAzZJ6EQTsbkQOERNZwYi+EVlmFhoJvt9bOoq3WDiZ5DGNwA/vuHzpn18uKIU3iecZKZpwDjNQS3CKTR3TgCL1CLhUE1VBJZaApZavjJe7G9P7fOATajmT3Fl4l0VGCZyjx+QeIMpY8ZxAkLS7rsUNFYErVxduNCX1zAIOSuWcDk4hcNA5fIMGJ/NTVUzn+T7FcVL1RabieehR1Hl0rrwrF0Ra/k00dbz5l1fkWQq8dfZVzERVaWKVq4AkZ9DMPgtCgiBDrh/RrI+bhNEfP/dj5V2Ig2yqvBQcp4snShvlWYg32+/pIN1s1iPV2HupIwOnn9m4Atc591uJZklDSlYa7ywJF1VXEM/qf+3xSSB4Q0h29CP2139qYGKRfac+88nX43mjDFG50j76EvsExiHsFX64/3ZSA9sKOqJiZwaatzT8AaDp7jV1FXx4+FCHIuyS7LgUywRg== x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_D2243F58192A41EEBE51D69C410AF6C2npsedu_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: BY5PR13MB3348.namprd13.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 18b3b593-61a9-41c0-1e09-08d843d8d73d X-MS-Exchange-CrossTenant-originalarrivaltime: 19 Aug 2020 00:43:07.4319 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 6d936231-a517-40ea-9199-f7578963378e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: Ng3zEJxyRL09QQuIS8W7iZQ0zLQwmLS5x355uHj64ZhRBwb8+IvAiipej8bf8rMfpqGf9N3jdfe/osK4rNSeeQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY5PR13MB3634 X-OriginatorOrg: nps.edu X-Barracuda-Connect: skywalker.ern.nps.edu[172.20.4.117] X-Barracuda-Start-Time: 1597797791 X-Barracuda-URL: https://205.155.65.106:443/cgi-mod/mark.cgi X-Virus-Scanned: by bsmtpd at nps.edu X-Barracuda-Scan-Msg-Size: 18170 X-Barracuda-BRTS-Status: 1 X-Barracuda-Spam-Score: 0.00 X-Barracuda-Spam-Status: No, SCORE=0.00 using global scores of TAG_LEVEL=1000.0 QUARANTINE_LEVEL=1000.0 KILL_LEVEL=9.0 tests=BSF_SC5_SA210e, HTML_MESSAGE X-Barracuda-Spam-Report: Code version 3.2, rules version 3.2.3.83996 Rule breakdown below pts rule name description ---- ---------------------- -------------------------------------------------- 0.00 HTML_MESSAGE BODY: HTML included in message 0.00 BSF_SC5_SA210e Custom Rule SA210e Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Aug 2020 00:43:16 -0000 --_000_D2243F58192A41EEBE51D69C410AF6C2npsedu_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SXQgaXMgdHJ1ZSB0aGF0IHRoaXMgb25seSBhZGRyZXNzZXMgb25lIGFzcGVjdCBhbmQgdGhhdCBy b3RhdGluZyBzaWduYXR1cmUga2V5cyBpcyB0aGUgY29ycmVjdCBhbnN3ZXIsIGVzcGVjaWFsbHkg d2l0aCByZXNwZWN0IHRvIFBDUy4gVGhlIGN1cnJlbnRseSBwcm9wb3NlZCBzb2x1dGlvbiBvbmx5 IHByb3ZpZGVzIGEgbWl0aWdhdGlvbiB0byB0aGUgKmN1cnJlbnQqIGdyb3VwLiBQQ1MgaW4gY29u Y3VycmVudCBncm91cHMgYW5kIHRob3NlIGdyb3VwcyB0aGF0IHRoZSBtZW1iZXIgaGFzIG5vdCB5 ZXQgam9pbmVkIGlzIG5vdCBjb3ZlcmVkIGJ5IHRoZSBwcm9wb3NlZCBzb2x1dGlvbiwgd2hpbGUg aXQgd291bGQgYmUgdGhyb3VnaCByb3RhdGlvbiBvZiBzaWduaW5nIGtleXMuDQoNClRoYXQgc2Fp ZCwgaWYgcm90YXRpb24gb2Ygc2lnbmF0dXJlIGtleXMgaXMgbm90IGdvaW5nIHRvIGJlIGNvbnNp ZGVyZWQgYXQgYWxsIGZvciB0aGUgc3BlYywgdGhlbiBtaXRpZ2F0aW5nIGp1c3Qgb25lIG9mIHRo ZXNlIGF0dGFja3MgaXMgYmV0dGVyIHRoYW4gbm90aGluZy4NCg0KDQpCcml0dGENCg0KDQpGcm9t OiBNTFMgPG1scy1ib3VuY2VzQGlldGYub3JnPiBvbiBiZWhhbGYgb2YgQnJlbmRhbiBNY01pbGxp b24gPGJyZW5kYW49NDBjbG91ZGZsYXJlLmNvbUBkbWFyYy5pZXRmLm9yZz4NCkRhdGU6IFR1ZXNk YXksIEF1Z3VzdCAxOCwgMjAyMCBhdCAzOjA4IFBNDQpUbzogUmljaGFyZCBCYXJuZXMgPHJsYkBp cHYuc3g+DQpDYzogTWVzc2FnaW5nIExheWVyIFNlY3VyaXR5IFdHIDxtbHNAaWV0Zi5vcmc+LCBK b2VsIEFsd2VuIDxqYWx3ZW5Ad2lja3IuY29tPg0KU3ViamVjdDogUmU6IFtNTFNdIE1MU1BsYWlu dGV4dCBwYWNrZXRzIGFyZW4ndCBhdXRoZW50aWNhdGVkIHVzaW5nIHN5bW1ldHJpYyBrZXkgc2No ZWR1bGUNCg0KDQpCcmVuZGFuOiBJIHRoaW5rIHlvdSBtaWdodCBoYXZlIHRoZSB3cm9uZyBwcmVt aXNlIGluIG1pbmQgaGVyZS4gIFRoZSBwcm9wb3NhbCB3ZSBoYXZlIGJlZW4gZGlzY3Vzc2luZyB3 b3VsZCBhdXRoZW50aWNhdGUgKmJvdGgqIHRoYXQgQWxpY2UgaXMgdGhlIHNlbmRlciBvZiB0aGUg bWVzc2FnZSAqYW5kKiB0aGF0IHNoZSdzIGEgbWVtYmVyIG9mIHRoZSBncm91cC4gIFNvIG90aGVy IG1lbWJlcnMgb2YgdGhlIGdyb3VwIGNvdWxkIG9ubHkgaW1wZXJzb25hdGUgQWxpY2UgaWYgdGhl eSBoYWQgY29tcHJvbWlzZWQgaGVyIHNpZ25pbmcga2V5Lg0KDQpTb3JyeSB0byBjaGFuZ2UgYXJn dW1lbnRzLCBidXQgSSB0aGluayB5b3UncmUgcmlnaHQgdGhhdCBJIG1pc3NlZCB0aGUgcG9pbnQu IEkgYWN0dWFsbHkgZG9uJ3QgdGhpbmsgd2Ugc2hvdWxkIGRvIGFueXRoaW5nIGhlcmUuIFRoYXQn cyBiZWNhdXNlOiBpZiBBbGljZSdzIGxvbmctdGVybSBzaWduaW5nIGtleSBpcyBjb21wcm9taXNl ZCwgaG93IGNhbiBzaGUgYmUgaW1wZXJzb25hdGVkPyBJbiBhbGwgb2YgdGhlc2Ugd2F5czoNCg0K ICAxLiAgQW4gb3V0c2lkZXIgY2FuIHNlbmQgYSBtZXNzYWdlIHRvIGFuIGV4aXN0aW5nIGdyb3Vw Lg0KICAyLiAgQW4gaW5zaWRlciBjYW4gc2VuZCBhIG1lc3NhZ2UgdG8gYW4gZXhpc3RpbmcgZ3Jv dXAuDQogIDMuICBBbiBhdHRhY2tlciBjYW4gZ2VuZXJhdGUgbmV3IEtleVBhY2thZ2VzIGFuZCBp bnRlcmNlcHQgV2VsY29tZSBtZXNzYWdlcyBpbnRlbmRlZCBmb3IgaGVyLg0KICA0LiAgQW4gYXR0 YWNrZXIgY2FuIGZvcmdlIGhlciBleGlzdGVuY2UgaW4gYSBncm91cCBzaGUncyBub3QgaW4uDQpU aGUgUFIgeW91IG9wZW5lZCBvbmx5IGFkZHJlc3NlcyBhdHRhY2sgdmVjdG9yICMxLiBZb3Ugc3Rp bGwgaGF2ZSBhbGwgdGhlIG90aGVyIGF0dGFjayB2ZWN0b3JzIGFuZCB0byBhZGRyZXNzIHRoZW0s IEFsaWNlIG5lZWRzIHRvIHJvdGF0ZSBoZXIgbG9uZy10ZXJtIHNpZ25pbmcga2V5Li4gUm90YXRp bmcgdGhlIGxvbmctdGVybSBzaWduaW5nIGtleSBzaG91bGQgYmUgdGhlIHJlc29sdXRpb24gaGVy ZSwgbm90IGhlYWRpbmcgb2ZmIGFuIGluZGl2aWR1YWwgYXR0YWNrLg0KDQpJbiB0aGUgcGFzdCwg d2UgdXN1YWxseSBjb25zaWRlcmVkIHRoZSBsb25nLXRlcm0gc2lnbmluZyBrZXkgdG8gYmUgc3Rv cmVkIHNvbWV3aGVyZSBtb3JlIHNlY3VyZSB0aGFuIGV2ZXJ5dGhpbmcgZWxzZSwgc3VjaCB0aGF0 IGl0IHdhcyB2ZXJ5IHVubGlrZWx5IHRvIGJlIGNvbXByb21pc2VkLCBvciB0aGF0IGl0IHdhcyBy b3RhdGVkIHJlZ3VsYXJseS4gVGhhdCdzIHdoeSB3ZSBoYXZlbid0IHdvcnJpZWQgYWJvdXQgdGhp cyBpbiB0aGUgcGFzdC4NCg0KT24gVHVlLCBBdWcgMTgsIDIwMjAgYXQgMTI6MjEgUE0gUmljaGFy ZCBCYXJuZXMgPHJsYkBpcHYuc3g+IHdyb3RlOg0KQnJlbmRhbjogSSB0aGluayB5b3UgbWlnaHQg aGF2ZSB0aGUgd3JvbmcgcHJlbWlzZSBpbiBtaW5kIGhlcmUuICBUaGUgcHJvcG9zYWwgd2UgaGF2 ZSBiZWVuIGRpc2N1c3Npbmcgd291bGQgYXV0aGVudGljYXRlICpib3RoKiB0aGF0IEFsaWNlIGlz IHRoZSBzZW5kZXIgb2YgdGhlIG1lc3NhZ2UgKmFuZCogdGhhdCBzaGUncyBhIG1lbWJlciBvZiB0 aGUgZ3JvdXAuICBTbyBvdGhlciBtZW1iZXJzIG9mIHRoZSBncm91cCBjb3VsZCBvbmx5IGltcGVy c29uYXRlIEFsaWNlIGlmIHRoZXkgaGFkIGNvbXByb21pc2VkIGhlciBzaWduaW5nIGtleS4NCg0K DQpPbiBUdWUsIEF1ZyAxOCwgMjAyMCBhdCAxMjozNSBQTSBCcmVuZGFuIE1jTWlsbGlvbiA8YnJl bmRhbj00MGNsb3VkZmxhcmUuLmNvbUBkbWFyYy5pZXRmLm9yZzxtYWlsdG86NDBjbG91ZGZsYXJl Li5jb21AZG1hcmMuaWV0Zi5vcmc+PiB3cm90ZToNClNvIHRvIHRoYXQgZW5kLCBob3cNCmFib3V0 IHdlIG1vZGlmeSBNTFMgc3VjaCB0aGF0IE1MU1BsYWludGV4dCBwYWNrZXRzIGNvbWluZyBmcm9t IGdyb3VwIG1lbWJlcnMNCm11c3QgYWxzbyBiZSBhdXRoZW50aWNhdGVkIHVzaW5nIHNvbWV0aGlu ZyBmcm9tIHRoZSBhcHBsaWNhdGlvbiBrZXkgc2NoZWR1bGUuDQoNCk15IG9iamVjdGlvbiB0byB0 aGlzIGlzIHRoYXQgQWxpY2UgY2FuIHN0aWxsIGJlIGltcGVyc29uYXRlZCBieSBtZW1iZXJzIGlu IHRoZSBncm91cCwgaWYgd2Ugb25seSBoYXZlIHN5bW1ldHJpYyBmb3J3YXJkLXNlY3VyZSBhdXRo ZW50aWNhdGlvbi4NCg0KVGhlcmUncyBiZWVuIHNvbWUgZGlzY3Vzc2lvbiBpbiB0aGUgcGFzdCBh Ym91dCB1c2luZyBmb3J3YXJkLXNlY3VyZSBzaWduYXR1cmVzIHRoYXQgbWlnaHQgYmUgd29ydGgg bG9va2luZyBpbnRvIGluc3RlYWQsIHdoaWNoIHdvdWxkIGZ1bGx5IGFkZHJlc3MgdGhpcyBhdHRh Y2sgdmVjdG9yOiBodHRwczovL21haWxhcmNoaXZlLmlldGYub3JnL2FyY2gvbXNnL21scy9vM2Zt SXVsXzRzNlNUbW5xbXo1MTRjakFEcHcvDQoNCg0KT24gVHVlLCBBdWcgMTgsIDIwMjAgYXQgNzoz NiBBTSBKb2VsIEFsd2VuIDxqYWx3ZW5Ad2lja3IuY29tPG1haWx0bzpqYWx3ZW5Ad2lja3IuY29t Pj4gd3JvdGU6DQpIZXkgZXZlcnlvbmUsDQoNClNvbWV0aGluZyB0aGF0cyBiZWVuIGJ1Z2dpbmcg TWFydGEgTXVsYXJjenlrIGFuZCBEYW5pZWwgSm9zdCBhbmQgbWUgZm9yIGEgYml0DQpub3cgaXMg dGhhdCBoYW5kc2hha2UgbWVzc2FnZXMgc2VudCBvdXQgYXMgTUxTUGxhaW50ZXh0IHBhY2tldHMg YXJlIG9ubHkNCmF1dGhlbnRpY2F0ZWQgdXNpbmcgc2lnbmF0dXJlcywgYnV0IG5vdCB1c2luZyB0 aGUgZ3JvdXAncyBrZXkgc2NoZWR1bGUuIEZvcg0Kbm9uLW1lbWJlcnMgdGhhdCBtYWtlcyBzZW5z ZSBidXQgZm9yIGdyb3VwIG1lbWJlcnMgdGhhdCdzIHdlYWtlciB0aGFuIG5lZWQgYmUuDQoNClN1 cHBvc2UgQWxpY2UgaXMgaW4gYSBncm91cCB1c2luZyBzaWduaW5nIGtleSBwYWlyIChzcGssIHNz aykuIEkgY29ycnVwdCBoZXIgdG8NCmxlYXJuIHNzay4gTm93IEkgbG9vc2UgYWNjZXNzIHRvIGhl ciBkZXZpY2UgYWdhaW4uIExhdGVyIHNoZSBnZW5lcmF0ZXMgYSBmcmVzaA0Ka2V5IHBhY2thZ2Ug d2l0aCBoZXIgc2FtZSBzcGsgYnV0IGEgbmV3IEhQS0Uga2V5IGZvciBoZXIgbGVhZi4gU2hlIHNl bmRzIG91dCBhbmQNCnVwZGF0ZSBwcm9wb3NhbCBmb3IgaGVyIG5ldyBrZXkgcGFja2FnZSBhbmQg c29tZW9uZSBjb21taXRzIHRvIHRoZSB1cGRhdGUuDQoNCkV4cGVjdGVkIHJlc3VsdDogc2hlIChh bmQgdGhlIGdyb3VwIGF0IGxhcmdlKSBoYXMgYWNoaWV2ZWQgUENTIGFnYWluLg0KDQpBY3R1YWwg cmVzdWx0OiB1c2luZyBoZXIgc3RvbGVuIHNzayBJIGNhbiBzdGlsbCBmb3JnZSBhIG5ldyBwcm9w b3NhbCdzIChzZW50IGFzDQpNTFNQbGFpbnRleHQgcGFja2V0cykgY29taW5nIGZyb20gQWxpY2Uu IFNvbWUgdGhpbmdzIEkgY291bGQgZG8gd2l0aCB0aGlzIHBvd2VyOg0KIC0gSSBjYW4gZ2VuZXJh dGUgYSBuZXcga2V5IHBhY2thZ2Uga3AgZm9yIEFsaWNlIHVzaW5nIGhlciBzcGsgYW5kIHNvbWUg SFBLRSBrZXkNCnNoZSBkb2Vzbid0IGtub3cuIFRoZW4gSSBmb3JnZSBhbiB1cGRhdGUgcHJvcG9z YWwgZm9yIEFsaWNlIHdpdGgga3AuIElmIGl0IGdldHMNCmNvbW1pdHRlZCBJJ3ZlIGVmZmVjdGl2 ZWx5IGtpY2tlZCBoZXIgb3V0IG9mIHRoZSBncm91cC4NCiAtIEkgY291bGQgZm9yZ2UgQWRkJ3Mg YW5kIFJlbW92ZSdzIGNvbWluZyBmcm9tIEFsaWNlLCBzbyBJIGNvdWxkIHRyaWNrIHRoZQ0KZ3Jv dXAgaW50byB0aGlua2luZyBBbGljZSBpcyB0cnlpbmcgdG8gQWRkIG15IGFjY291bnQgdG8gdGhl IGdyb3VwIG9yIHJlbW92ZQ0Kc29tZSBvdGhlciBncm91cCBtZW1iZXIuDQoNCkxlbW1lIGtub3cg aWYgSSd2ZSBtaXNzZWQgc29tZXRoaW5nIGhlcmUgaW4gdGhhdCBzY2VuYXJpby4uLg0KDQoNCklm IEkgZGlkbid0IG1pc3MgYW55dGhpbmcgYW5kIHRoZSBhdHRhY2tzIHJlYWxseSB3b3JrIGFzIGFk dmVydGlzZWQgdGhlbiBJTU8NCnRoaXMgaXMga2luZGEgd2VhayBzYXVjZSBhbmQgd29ydGggYXZv aWRpbmcgaWYgcG9zc2libGUuIFNvIHRvIHRoYXQgZW5kLCBob3cNCmFib3V0IHdlIG1vZGlmeSBN TFMgc3VjaCB0aGF0IE1MU1BsYWludGV4dCBwYWNrZXRzIGNvbWluZyBmcm9tIGdyb3VwIG1lbWJl cnMNCm11c3QgYWxzbyBiZSBhdXRoZW50aWNhdGVkIHVzaW5nIHNvbWV0aGluZyBmcm9tIHRoZSBh cHBsaWNhdGlvbiBrZXkgc2NoZWR1bGUuDQpOb3cgdGhlIGFib3ZlIGF0dGFja3MgZmFpbC4gQXMg c29vbiBhcyBBbGljZSdzIHVwZGF0ZSBpcyBnZXRzIGNvbW1pdHRlZCBJIG5vDQpsb25nZXIga25v dyB0aGUgZ3JvdXAncyBrZXkgc2NoZWR1bGUgYW5kIHNvIGNhbid0IGZvcmdlZCBwYWNrZXQgZnJv bSBBbGljZS4gTW9yZQ0KZ2VuZXJhbGx5LCB0aGlzIGJyaW5ncyB0aGUgUENTIGd1YXJhbnRlZXMg d2hlbiB1c2luZyBNTFNQbGFpbnRleHRzIGZyYW1laW5nIGluDQpsaW5lIHdpdGggd2hhdCB3ZSdy ZSBnZXR0aW5nIGZyb20gTUxTQ2lwaGVydGV4dCBwYWNrZXRzLg0KDQpBbnkgdGhvdWdodHM/DQoN Ci0gSm/Dq2wNCg0KDQoNClBTLiBGb3IgY29uY3JldGVuZXNzLCB3ZSBjb3VsZCBwcm9iYWJseSBl eHRlbmQgdGhlIGN1cnJlbnQgbWVjaGFuaXNtIGZvciBnZXR0aW5nDQpjb25jaXN0YW5jeSAodGhl IGNvbmZpcm1hdGlvbl90YWcpIHRvIGFsc28gcHJvdmlkZSBzeW1tZXRyaWMga2V5IGF1dGhlbnRp Y2F0aW9uLg0KRS5nLiBpbmNsdWRlIG1vc3Qgb2YgdGhlIE1MU1BsYWludGV4dCBjb250ZW50IGlu dG8gd2hhdHMgYmVpbmcgdGFnZ2VkIGJ5DQpjb25maXJtYXRpb25fdGFnLiBUaGF0IHdvdWxkIGNv dmVyIHRoZSBjYXNlIG9mIGEgY29tbWl0IHBhY2tldCBhbmQgZG9lc24ndCBldmVuDQpncm93IHRo ZSBzaXplIG9mIE1MU1BsYWludGV4dCBwYWNrZXRzIG92ZXIgdGhlIGN1cnJlbnQgZGVzaWduLg0K DQpGb3IgYSBwcm9wb3NhbCBwYWNrZXQgd2UgY291bGQgYWxzbyBoYXZlIGEgY29uZmlybWF0aW9u X3RhZyBidXQgdGhpcyBvbmUgaXMNCmNvbXB1dGVkIHVzaW5nIHRoZSAqY3VycmVudCogZXBvY2gn cyBjb25maXJtYXRpb25fa2V5IGFuZCBjb25maXJtZWRfdHJhbnNjcmlwdF9oYXNoLg0KDQpfX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXw0KTUxTIG1haWxpbmcg bGlzdA0KTUxTQGlldGYub3JnPG1haWx0bzpNTFNAaWV0Zi5vcmc+DQpodHRwczovL3d3dy5pZXRm Lm9yZy9tYWlsbWFuL2xpc3RpbmZvL21scw0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18NCk1MUyBtYWlsaW5nIGxpc3QNCk1MU0BpZXRmLm9yZzxtYWlsdG86 TUxTQGlldGYub3JnPg0KaHR0cHM6Ly93d3cuaWV0Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMN Cg== --_000_D2243F58192A41EEBE51D69C410AF6C2npsedu_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCW1hcmdpbi1i b3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTEuMHB0Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJp IixzYW5zLXNlcmlmO30NCmE6bGluaywgc3Bhbi5Nc29IeXBlcmxpbmsNCgl7bXNvLXN0eWxlLXBy aW9yaXR5Ojk5Ow0KCWNvbG9yOmJsdWU7DQoJdGV4dC1kZWNvcmF0aW9uOnVuZGVybGluZTt9DQph OnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7bXNvLXN0eWxlLXByaW9yaXR5 Ojk5Ow0KCWNvbG9yOnB1cnBsZTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnAubXNv bm9ybWFsMCwgbGkubXNvbm9ybWFsMCwgZGl2Lm1zb25vcm1hbDANCgl7bXNvLXN0eWxlLW5hbWU6 bXNvbm9ybWFsOw0KCW1zby1tYXJnaW4tdG9wLWFsdDphdXRvOw0KCW1hcmdpbi1yaWdodDowaW47 DQoJbXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87DQoJbWFyZ2luLWxlZnQ6MGluOw0KCWZvbnQt c2l6ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0Kc3Bhbi5F bWFpbFN0eWxlMTkNCgl7bXNvLXN0eWxlLXR5cGU6cGVyc29uYWwtcmVwbHk7DQoJZm9udC1mYW1p bHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVm YXVsdA0KCXttc28tc3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LXNpemU6MTAuMHB0O30N CkBwYWdlIFdvcmRTZWN0aW9uMQ0KCXtzaXplOjguNWluIDExLjBpbjsNCgltYXJnaW46MS4waW4g MS4waW4gMS4waW4gMS4waW47fQ0KZGl2LldvcmRTZWN0aW9uMQ0KCXtwYWdlOldvcmRTZWN0aW9u MTt9DQovKiBMaXN0IERlZmluaXRpb25zICovDQpAbGlzdCBsMA0KCXttc28tbGlzdC1pZDoxNDg1 MTc3Nzg7DQoJbXNvLWxpc3QtdGVtcGxhdGUtaWRzOjE4MTcyMzU4NzQ7fQ0Kb2wNCgl7bWFyZ2lu LWJvdHRvbTowaW47fQ0KdWwNCgl7bWFyZ2luLWJvdHRvbTowaW47fQ0KLS0+PC9zdHlsZT4NCjwv aGVhZD4NCjxib2R5IGxhbmc9IkVOLVVTIiBsaW5rPSJibHVlIiB2bGluaz0icHVycGxlIj4NCjxk aXYgY2xhc3M9IldvcmRTZWN0aW9uMSI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JdCBpcyB0cnVl IHRoYXQgdGhpcyBvbmx5IGFkZHJlc3NlcyBvbmUgYXNwZWN0IGFuZCB0aGF0IHJvdGF0aW5nIHNp Z25hdHVyZSBrZXlzIGlzIHRoZSBjb3JyZWN0IGFuc3dlciwgZXNwZWNpYWxseSB3aXRoIHJlc3Bl Y3QgdG8gUENTLiBUaGUgY3VycmVudGx5IHByb3Bvc2VkIHNvbHV0aW9uIG9ubHkgcHJvdmlkZXMg YSBtaXRpZ2F0aW9uIHRvIHRoZSAqY3VycmVudCogZ3JvdXAuIFBDUyBpbiBjb25jdXJyZW50DQog Z3JvdXBzIGFuZCB0aG9zZSBncm91cHMgdGhhdCB0aGUgbWVtYmVyIGhhcyBub3QgeWV0IGpvaW5l ZCBpcyBub3QgY292ZXJlZCBieSB0aGUgcHJvcG9zZWQgc29sdXRpb24sIHdoaWxlIGl0IHdvdWxk IGJlIHRocm91Z2ggcm90YXRpb24gb2Ygc2lnbmluZyBrZXlzLg0KPG86cD48L286cD48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPlRoYXQgc2FpZCwgaWYgcm90YXRpb24gb2Ygc2lnbmF0dXJlIGtleXMgaXMgbm90IGdv aW5nIHRvIGJlIGNvbnNpZGVyZWQgYXQgYWxsIGZvciB0aGUgc3BlYywgdGhlbiBtaXRpZ2F0aW5n IGp1c3Qgb25lIG9mIHRoZXNlIGF0dGFja3MgaXMgYmV0dGVyIHRoYW4gbm90aGluZy48bzpwPjwv bzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5Ccml0dGE8bzpwPjwvbzpwPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2IHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItdG9wOnNvbGlkICNCNUM0REYgMS4wcHQ7 cGFkZGluZzozLjBwdCAwaW4gMGluIDBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48Yj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+RnJvbTogPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjEyLjBwdDtjb2xvcjpibGFjayI+TUxTICZsdDttbHMtYm91 bmNlc0BpZXRmLm9yZyZndDsgb24gYmVoYWxmIG9mIEJyZW5kYW4gTWNNaWxsaW9uICZsdDticmVu ZGFuPTQwY2xvdWRmbGFyZS5jb21AZG1hcmMuaWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+RGF0ZTogPC9i PlR1ZXNkYXksIEF1Z3VzdCAxOCwgMjAyMCBhdCAzOjA4IFBNPGJyPg0KPGI+VG86IDwvYj5SaWNo YXJkIEJhcm5lcyAmbHQ7cmxiQGlwdi5zeCZndDs8YnI+DQo8Yj5DYzogPC9iPk1lc3NhZ2luZyBM YXllciBTZWN1cml0eSBXRyAmbHQ7bWxzQGlldGYub3JnJmd0OywgSm9lbCBBbHdlbiAmbHQ7amFs d2VuQHdpY2tyLmNvbSZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+UmU6IFtNTFNdIE1MU1BsYWlu dGV4dCBwYWNrZXRzIGFyZW4ndCBhdXRoZW50aWNhdGVkIHVzaW5nIHN5bW1ldHJpYyBrZXkgc2No ZWR1bGU8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8ZGl2Pg0KPGJsb2Nr cXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4wcHQ7 cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmlnaHQ6 MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZv bnQtc2l6ZToxMC4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJN c29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnJl bmRhbjogSSB0aGluayB5b3UgbWlnaHQgaGF2ZSB0aGUgd3JvbmcgcHJlbWlzZSBpbiBtaW5kIGhl cmUuJm5ic3A7IFRoZSBwcm9wb3NhbCB3ZSBoYXZlIGJlZW4gZGlzY3Vzc2luZyB3b3VsZCBhdXRo ZW50aWNhdGUgKmJvdGgqIHRoYXQgQWxpY2UgaXMgdGhlIHNlbmRlciBvZiB0aGUgbWVzc2FnZSAq YW5kKiB0aGF0IHNoZSdzIGEgbWVtYmVyIG9mIHRoZSBncm91cC4mbmJzcDsgU28gb3RoZXIgbWVt YmVycyBvZiB0aGUgZ3JvdXANCiBjb3VsZCBvbmx5IGltcGVyc29uYXRlIEFsaWNlIGlmIHRoZXkg aGFkIGNvbXByb21pc2VkIGhlciBzaWduaW5nIGtleS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PC9kaXY+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5Tb3Jy eSB0byBjaGFuZ2UgYXJndW1lbnRzLCBidXQgSSB0aGluayB5b3UncmUgcmlnaHQgdGhhdCBJIG1p c3NlZCB0aGUgcG9pbnQuIEkgYWN0dWFsbHkgZG9uJ3QgdGhpbmsgd2Ugc2hvdWxkIGRvIGFueXRo aW5nIGhlcmUuIFRoYXQncyBiZWNhdXNlOiBpZiBBbGljZSdzIGxvbmctdGVybSBzaWduaW5nIGtl eSBpcyBjb21wcm9taXNlZCwgaG93IGNhbiBzaGUgYmUgaW1wZXJzb25hdGVkPyBJbiBhbGwgb2Yg dGhlc2UNCiB3YXlzOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPG9sIHN0YXJ0PSIx IiB0eXBlPSIxIj4NCjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3At YWx0OmF1dG87bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxm bzEiPg0KQW4gb3V0c2lkZXIgY2FuIHNlbmQgYSBtZXNzYWdlIHRvIGFuIGV4aXN0aW5nIGdyb3Vw LjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJnaW4t dG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxldmVs MSBsZm8xIj4NCkFuIGluc2lkZXIgY2FuIHNlbmQgYSBtZXNzYWdlIHRvIGFuIGV4aXN0aW5nIGdy b3VwLjxvOnA+PC9vOnA+PC9saT48bGkgY2xhc3M9Ik1zb05vcm1hbCIgc3R5bGU9Im1zby1tYXJn aW4tdG9wLWFsdDphdXRvO21zby1tYXJnaW4tYm90dG9tLWFsdDphdXRvO21zby1saXN0OmwwIGxl dmVsMSBsZm8xIj4NCkFuIGF0dGFja2VyIGNhbiBnZW5lcmF0ZSBuZXcgS2V5UGFja2FnZXMgYW5k IGludGVyY2VwdCBXZWxjb21lIG1lc3NhZ2VzIGludGVuZGVkIGZvciBoZXIuPG86cD48L286cD48 L2xpPjxsaSBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0ibXNvLW1hcmdpbi10b3AtYWx0OmF1dG87 bXNvLW1hcmdpbi1ib3R0b20tYWx0OmF1dG87bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPg0KQW4g YXR0YWNrZXIgY2FuIGZvcmdlIGhlciBleGlzdGVuY2UgaW4gYSBncm91cCBzaGUncyBub3QgaW4u PG86cD48L286cD48L2xpPjwvb2w+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIFBS IHlvdSBvcGVuZWQgb25seSBhZGRyZXNzZXMgYXR0YWNrIHZlY3RvciAjMS4gWW91IHN0aWxsIGhh dmUgYWxsIHRoZSBvdGhlciBhdHRhY2sgdmVjdG9ycyBhbmQgdG8gYWRkcmVzcyB0aGVtLCBBbGlj ZSBuZWVkcyB0byByb3RhdGUgaGVyIGxvbmctdGVybSBzaWduaW5nIGtleS4uIFJvdGF0aW5nIHRo ZSBsb25nLXRlcm0gc2lnbmluZyBrZXkgc2hvdWxkIGJlIHRoZSByZXNvbHV0aW9uIGhlcmUsIG5v dA0KIGhlYWRpbmcgb2ZmIGFuIGluZGl2aWR1YWwgYXR0YWNrLjxvOnA+PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8 L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5JbiB0aGUgcGFzdCwgd2UgdXN1YWxs eSBjb25zaWRlcmVkIHRoZSBsb25nLXRlcm0gc2lnbmluZyBrZXkgdG8gYmUgc3RvcmVkIHNvbWV3 aGVyZSBtb3JlIHNlY3VyZSB0aGFuIGV2ZXJ5dGhpbmcgZWxzZSwgc3VjaCB0aGF0IGl0IHdhcyB2 ZXJ5IHVubGlrZWx5IHRvIGJlIGNvbXByb21pc2VkLCBvciB0aGF0IGl0IHdhcyByb3RhdGVkIHJl Z3VsYXJseS4gVGhhdCdzIHdoeSB3ZSBoYXZlbid0IHdvcnJpZWQgYWJvdXQNCiB0aGlzIGluIHRo ZSBwYXN0LjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8L2Rpdj4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8ZGl2Pg0KPGRpdj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPk9uIFR1ZSwgQXVnIDE4LCAyMDIwIGF0IDEyOjIxIFBNIFJpY2hhcmQgQmFy bmVzICZsdDtybGJAaXB2LnN4Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGJs b2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0NDQ0MgMS4w cHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJnaW4tcmln aHQ6MGluIj4NCjxkaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+QnJlbmRhbjogSSB0 aGluayB5b3UgbWlnaHQgaGF2ZSB0aGUgd3JvbmcgcHJlbWlzZSBpbiBtaW5kIGhlcmUuJm5ic3A7 IFRoZSBwcm9wb3NhbCB3ZSBoYXZlIGJlZW4gZGlzY3Vzc2luZyB3b3VsZCBhdXRoZW50aWNhdGUg KmJvdGgqIHRoYXQgQWxpY2UgaXMgdGhlIHNlbmRlciBvZiB0aGUgbWVzc2FnZSAqYW5kKiB0aGF0 IHNoZSdzIGEgbWVtYmVyIG9mIHRoZSBncm91cC4mbmJzcDsgU28gb3RoZXIgbWVtYmVycyBvZiB0 aGUgZ3JvdXANCiBjb3VsZCBvbmx5IGltcGVyc29uYXRlIEFsaWNlIGlmIHRoZXkgaGFkIGNvbXBy b21pc2VkIGhlciBzaWduaW5nIGtleS48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxwIGNsYXNzPSJNc29O b3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPGRpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj5PbiBUdWUsIEF1ZyAxOCwgMjAyMCBhdCAxMjozNSBQTSBCcmVuZGFuIE1jTWlsbGlv biAmbHQ7YnJlbmRhbj08YSBocmVmPSJtYWlsdG86NDBjbG91ZGZsYXJlLi5jb21AZG1hcmMuaWV0 Zi5vcmciIHRhcmdldD0iX2JsYW5rIj40MGNsb3VkZmxhcmUuLmNvbUBkbWFyYy5pZXRmLm9yZzwv YT4mZ3Q7IHdyb3RlOjxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8YmxvY2txdW90ZSBzdHlsZT0i Ym9yZGVyOm5vbmU7Ym9yZGVyLWxlZnQ6c29saWQgI0NDQ0NDQyAxLjBwdDtwYWRkaW5nOjBpbiAw aW4gMGluIDYuMHB0O21hcmdpbi1sZWZ0OjQuOHB0O21hcmdpbi1yaWdodDowaW4iPg0KPGRpdj4N CjxibG9ja3F1b3RlIHN0eWxlPSJib3JkZXI6bm9uZTtib3JkZXItbGVmdDpzb2xpZCAjQ0NDQ0ND IDEuMHB0O3BhZGRpbmc6MGluIDBpbiAwaW4gNi4wcHQ7bWFyZ2luLWxlZnQ6NC44cHQ7bWFyZ2lu LXJpZ2h0OjBpbiI+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5TbyB0byB0aGF0IGVuZCwgaG93PGJy Pg0KYWJvdXQgd2UgbW9kaWZ5IE1MUyBzdWNoIHRoYXQgTUxTUGxhaW50ZXh0IHBhY2tldHMgY29t aW5nIGZyb20gZ3JvdXAgbWVtYmVyczxicj4NCm11c3QgYWxzbyBiZSBhdXRoZW50aWNhdGVkIHVz aW5nIHNvbWV0aGluZyBmcm9tIHRoZSBhcHBsaWNhdGlvbiBrZXkgc2NoZWR1bGUuPG86cD48L286 cD48L3A+DQo8L2Jsb2NrcXVvdGU+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5NeSBv YmplY3Rpb24gdG8gdGhpcyBpcyB0aGF0IEFsaWNlIGNhbiBzdGlsbCBiZSBpbXBlcnNvbmF0ZWQg YnkgbWVtYmVycyBpbiB0aGUgZ3JvdXAsIGlmIHdlIG9ubHkgaGF2ZSBzeW1tZXRyaWMgZm9yd2Fy ZC1zZWN1cmUgYXV0aGVudGljYXRpb24uPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPlRoZXJlJ3MgYmVlbiBzb21lIGRpc2N1c3Npb24gaW4gdGhl IHBhc3QgYWJvdXQgdXNpbmcgZm9yd2FyZC1zZWN1cmUgc2lnbmF0dXJlcyB0aGF0IG1pZ2h0IGJl IHdvcnRoIGxvb2tpbmcgaW50byBpbnN0ZWFkLCB3aGljaCB3b3VsZCBmdWxseSBhZGRyZXNzIHRo aXMgYXR0YWNrIHZlY3RvcjoNCjxhIGhyZWY9Imh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcv YXJjaC9tc2cvbWxzL28zZm1JdWxfNHM2U1RtbnFtejUxNGNqQURwdy8iIHRhcmdldD0iX2JsYW5r Ij4NCmh0dHBzOi8vbWFpbGFyY2hpdmUuaWV0Zi5vcmcvYXJjaC9tc2cvbWxzL28zZm1JdWxfNHM2 U1RtbnFtejUxNGNqQURwdy88L2E+PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXY+DQo8ZGl2Pg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+T24gVHVlLCBBdWcgMTgsIDIwMjAgYXQgNzozNiBBTSBKb2Vs IEFsd2VuICZsdDs8YSBocmVmPSJtYWlsdG86amFsd2VuQHdpY2tyLmNvbSIgdGFyZ2V0PSJfYmxh bmsiPmphbHdlbkB3aWNrci5jb208L2E+Jmd0OyB3cm90ZTo8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGJsb2NrcXVvdGUgc3R5bGU9ImJvcmRlcjpub25lO2JvcmRlci1sZWZ0OnNvbGlkICNDQ0ND Q0MgMS4wcHQ7cGFkZGluZzowaW4gMGluIDBpbiA2LjBwdDttYXJnaW4tbGVmdDo0LjhwdDttYXJn aW4tcmlnaHQ6MGluIj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPkhleSBldmVyeW9uZSw8YnI+DQo8 YnI+DQpTb21ldGhpbmcgdGhhdHMgYmVlbiBidWdnaW5nIE1hcnRhIE11bGFyY3p5ayBhbmQgRGFu aWVsIEpvc3QgYW5kIG1lIGZvciBhIGJpdDxicj4NCm5vdyBpcyB0aGF0IGhhbmRzaGFrZSBtZXNz YWdlcyBzZW50IG91dCBhcyBNTFNQbGFpbnRleHQgcGFja2V0cyBhcmUgb25seTxicj4NCmF1dGhl bnRpY2F0ZWQgdXNpbmcgc2lnbmF0dXJlcywgYnV0IG5vdCB1c2luZyB0aGUgZ3JvdXAncyBrZXkg c2NoZWR1bGUuIEZvcjxicj4NCm5vbi1tZW1iZXJzIHRoYXQgbWFrZXMgc2Vuc2UgYnV0IGZvciBn cm91cCBtZW1iZXJzIHRoYXQncyB3ZWFrZXIgdGhhbiBuZWVkIGJlLjxicj4NCjxicj4NClN1cHBv c2UgQWxpY2UgaXMgaW4gYSBncm91cCB1c2luZyBzaWduaW5nIGtleSBwYWlyIChzcGssIHNzayku IEkgY29ycnVwdCBoZXIgdG88YnI+DQpsZWFybiBzc2suIE5vdyBJIGxvb3NlIGFjY2VzcyB0byBo ZXIgZGV2aWNlIGFnYWluLiBMYXRlciBzaGUgZ2VuZXJhdGVzIGEgZnJlc2g8YnI+DQprZXkgcGFj a2FnZSB3aXRoIGhlciBzYW1lIHNwayBidXQgYSBuZXcgSFBLRSBrZXkgZm9yIGhlciBsZWFmLiBT aGUgc2VuZHMgb3V0IGFuZDxicj4NCnVwZGF0ZSBwcm9wb3NhbCBmb3IgaGVyIG5ldyBrZXkgcGFj a2FnZSBhbmQgc29tZW9uZSBjb21taXRzIHRvIHRoZSB1cGRhdGUuPGJyPg0KPGJyPg0KRXhwZWN0 ZWQgcmVzdWx0OiBzaGUgKGFuZCB0aGUgZ3JvdXAgYXQgbGFyZ2UpIGhhcyBhY2hpZXZlZCBQQ1Mg YWdhaW4uPGJyPg0KPGJyPg0KQWN0dWFsIHJlc3VsdDogdXNpbmcgaGVyIHN0b2xlbiBzc2sgSSBj YW4gc3RpbGwgZm9yZ2UgYSBuZXcgcHJvcG9zYWwncyAoc2VudCBhczxicj4NCk1MU1BsYWludGV4 dCBwYWNrZXRzKSBjb21pbmcgZnJvbSBBbGljZS4gU29tZSB0aGluZ3MgSSBjb3VsZCBkbyB3aXRo IHRoaXMgcG93ZXI6PGJyPg0KJm5ic3A7LSBJIGNhbiBnZW5lcmF0ZSBhIG5ldyBrZXkgcGFja2Fn ZSBrcCBmb3IgQWxpY2UgdXNpbmcgaGVyIHNwayBhbmQgc29tZSBIUEtFIGtleTxicj4NCnNoZSBk b2Vzbid0IGtub3cuIFRoZW4gSSBmb3JnZSBhbiB1cGRhdGUgcHJvcG9zYWwgZm9yIEFsaWNlIHdp dGgga3AuIElmIGl0IGdldHM8YnI+DQpjb21taXR0ZWQgSSd2ZSBlZmZlY3RpdmVseSBraWNrZWQg aGVyIG91dCBvZiB0aGUgZ3JvdXAuPGJyPg0KJm5ic3A7LSBJIGNvdWxkIGZvcmdlIEFkZCdzIGFu ZCBSZW1vdmUncyBjb21pbmcgZnJvbSBBbGljZSwgc28gSSBjb3VsZCB0cmljayB0aGU8YnI+DQpn cm91cCBpbnRvIHRoaW5raW5nIEFsaWNlIGlzIHRyeWluZyB0byBBZGQgbXkgYWNjb3VudCB0byB0 aGUgZ3JvdXAgb3IgcmVtb3ZlPGJyPg0Kc29tZSBvdGhlciBncm91cCBtZW1iZXIuPGJyPg0KPGJy Pg0KTGVtbWUga25vdyBpZiBJJ3ZlIG1pc3NlZCBzb21ldGhpbmcgaGVyZSBpbiB0aGF0IHNjZW5h cmlvLi4uPGJyPg0KPGJyPg0KPGJyPg0KSWYgSSBkaWRuJ3QgbWlzcyBhbnl0aGluZyBhbmQgdGhl IGF0dGFja3MgcmVhbGx5IHdvcmsgYXMgYWR2ZXJ0aXNlZCB0aGVuIElNTzxicj4NCnRoaXMgaXMg a2luZGEgd2VhayBzYXVjZSBhbmQgd29ydGggYXZvaWRpbmcgaWYgcG9zc2libGUuIFNvIHRvIHRo YXQgZW5kLCBob3c8YnI+DQphYm91dCB3ZSBtb2RpZnkgTUxTIHN1Y2ggdGhhdCBNTFNQbGFpbnRl eHQgcGFja2V0cyBjb21pbmcgZnJvbSBncm91cCBtZW1iZXJzPGJyPg0KbXVzdCBhbHNvIGJlIGF1 dGhlbnRpY2F0ZWQgdXNpbmcgc29tZXRoaW5nIGZyb20gdGhlIGFwcGxpY2F0aW9uIGtleSBzY2hl ZHVsZS48YnI+DQpOb3cgdGhlIGFib3ZlIGF0dGFja3MgZmFpbC4gQXMgc29vbiBhcyBBbGljZSdz IHVwZGF0ZSBpcyBnZXRzIGNvbW1pdHRlZCBJIG5vPGJyPg0KbG9uZ2VyIGtub3cgdGhlIGdyb3Vw J3Mga2V5IHNjaGVkdWxlIGFuZCBzbyBjYW4ndCBmb3JnZWQgcGFja2V0IGZyb20gQWxpY2UuIE1v cmU8YnI+DQpnZW5lcmFsbHksIHRoaXMgYnJpbmdzIHRoZSBQQ1MgZ3VhcmFudGVlcyB3aGVuIHVz aW5nIE1MU1BsYWludGV4dHMgZnJhbWVpbmcgaW48YnI+DQpsaW5lIHdpdGggd2hhdCB3ZSdyZSBn ZXR0aW5nIGZyb20gTUxTQ2lwaGVydGV4dCBwYWNrZXRzLjxicj4NCjxicj4NCkFueSB0aG91Z2h0 cz88YnI+DQo8YnI+DQotIEpvw6tsPGJyPg0KPGJyPg0KPGJyPg0KPGJyPg0KUFMuIEZvciBjb25j cmV0ZW5lc3MsIHdlIGNvdWxkIHByb2JhYmx5IGV4dGVuZCB0aGUgY3VycmVudCBtZWNoYW5pc20g Zm9yIGdldHRpbmc8YnI+DQpjb25jaXN0YW5jeSAodGhlIGNvbmZpcm1hdGlvbl90YWcpIHRvIGFs c28gcHJvdmlkZSBzeW1tZXRyaWMga2V5IGF1dGhlbnRpY2F0aW9uLjxicj4NCkUuZy4gaW5jbHVk ZSBtb3N0IG9mIHRoZSBNTFNQbGFpbnRleHQgY29udGVudCBpbnRvIHdoYXRzIGJlaW5nIHRhZ2dl ZCBieTxicj4NCmNvbmZpcm1hdGlvbl90YWcuIFRoYXQgd291bGQgY292ZXIgdGhlIGNhc2Ugb2Yg YSBjb21taXQgcGFja2V0IGFuZCBkb2Vzbid0IGV2ZW48YnI+DQpncm93IHRoZSBzaXplIG9mIE1M U1BsYWludGV4dCBwYWNrZXRzIG92ZXIgdGhlIGN1cnJlbnQgZGVzaWduLjxicj4NCjxicj4NCkZv ciBhIHByb3Bvc2FsIHBhY2tldCB3ZSBjb3VsZCBhbHNvIGhhdmUgYSBjb25maXJtYXRpb25fdGFn IGJ1dCB0aGlzIG9uZSBpczxicj4NCmNvbXB1dGVkIHVzaW5nIHRoZSAqY3VycmVudCogZXBvY2gn cyBjb25maXJtYXRpb25fa2V5IGFuZCBjb25maXJtZWRfdHJhbnNjcmlwdF9oYXNoLjxicj4NCjxi cj4NCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fPGJyPg0K TUxTIG1haWxpbmcgbGlzdDxicj4NCjxhIGhyZWY9Im1haWx0bzpNTFNAaWV0Zi5vcmciIHRhcmdl dD0iX2JsYW5rIj5NTFNAaWV0Zi5vcmc8L2E+PGJyPg0KPGEgaHJlZj0iaHR0cHM6Ly93d3cuaWV0 Zi5vcmcvbWFpbG1hbi9saXN0aW5mby9tbHMiIHRhcmdldD0iX2JsYW5rIj5odHRwczovL3d3dy5p ZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21sczwvYT48bzpwPjwvbzpwPjwvcD4NCjwvYmxvY2tx dW90ZT4NCjwvZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+X19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX188YnI+DQpNTFMgbWFpbGluZyBsaXN0PGJyPg0KPGEg aHJlZj0ibWFpbHRvOk1MU0BpZXRmLm9yZyIgdGFyZ2V0PSJfYmxhbmsiPk1MU0BpZXRmLm9yZzwv YT48YnI+DQo8YSBocmVmPSJodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL21s cyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8v bWxzPC9hPjxvOnA+PC9vOnA+PC9wPg0KPC9ibG9ja3F1b3RlPg0KPC9kaXY+DQo8L2Jsb2NrcXVv dGU+DQo8L2Rpdj4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8L2h0bWw+DQo= --_000_D2243F58192A41EEBE51D69C410AF6C2npsedu_-- From nobody Wed Aug 19 00:24:31 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6B6523A1083 for ; Wed, 19 Aug 2020 00:24:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0eHIuuEoea2l for ; Wed, 19 Aug 2020 00:24:26 -0700 (PDT) Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com [IPv6:2a00:1450:4864:20::32d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 361F63A1081 for ; Wed, 19 Aug 2020 00:24:26 -0700 (PDT) Received: by mail-wm1-x32d.google.com with SMTP id c19so1034084wmd.1 for ; Wed, 19 Aug 2020 00:24:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=K7AG4/gtkHaEeuQ8Qb9JJCz5Q71Je7RCD2s3+ONNn3g=; b=DfxhdEoCkG4g7JapjFVYr+P+ENADDNkiCCECaqt7BUrTsFlysBUghr9nVJsLwHuXnG y13Cb7QoJU3YjuZz82bNL6KURaIIFcHeRjXZ01zmaAzU90LraP8fTpfhMzL0/4OJtv+y r66pRWBAAWBB8XxlZUCERzZIQue6dkTXXauG1dYD1XWN1dBkWzUvfwdQrrI0XMOAnsPw +AVeHqOYC1LPu/b7XEKnXhFlhfeahFzfVBV47gUZdMceyOCvGyIsKXrsed1TTG9kYcYs oGZMW9iJlfxNNi36Voy4tqtaAuuWGRka+V+4G23YcHgvDE2E1t+xHXwlfiv7aJ+a4kJB LMdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=K7AG4/gtkHaEeuQ8Qb9JJCz5Q71Je7RCD2s3+ONNn3g=; b=B5dPU1tX7vV+5D3wqPa9AS4pwPBEE8j5gh2PS0AVTFaTHS3Q7ZppaEv7WlhSnR7xNZ D+pkthBJgFyle05nALU/VoKn80jSn1v0A7JjjNm5h+4CIOK6Bs0S3HtR0guIv7Rv6UAA GqvQgUDkYujYHQfBt1Sih6ECOuKx6nLQHD6K6NidfGaXOHHtNM9fQUZ2dUMUnySGL9pF XhoFUiOzQsE2ilUTyh68tdKmXqeJvpAaCof18xtei0k6sJ23Z6U/6lpgXPcylALL5FmE HGhqrnPHhkSvGmZC03vTdQkQcJ+YnV+uToNZY3RK3leHUAaE/ERhJMf8NfrUWv4K9Ltk hCLA== X-Gm-Message-State: AOAM532pU0kPF0sA3oi/FbPqoxjIkjF5/tDesiBQcWvarK4gXByDLb0X Qho7DDWnAIKb69Gy4pKbAyU6mP0eT/U/Vpcf X-Google-Smtp-Source: ABdhPJx1pPOTxSWEs29qY4Im+iC5ckbmGvIGH9uN5czqAgETz/8/vuj6LS8j7AzX9a8lHBfpn3CNWA== X-Received: by 2002:a7b:c1c2:: with SMTP id a2mr3453858wmj.74.1597821864075; Wed, 19 Aug 2020 00:24:24 -0700 (PDT) Received: from rmbp.fritz.box ([134.3.30.253]) by smtp.gmail.com with ESMTPSA id z6sm3903222wml.41.2020.08.19.00.24.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 19 Aug 2020 00:24:23 -0700 (PDT) From: Raphael Robert Message-Id: <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_FFC04E64-978A-4A87-AB4C-A1EB004244F6" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Wed, 19 Aug 2020 09:24:22 +0200 In-Reply-To: Cc: Joel Alwen , Messaging Layer Security WG To: Richard Barnes References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Aug 2020 07:24:29 -0000 --Apple-Mail=_FFC04E64-978A-4A87-AB4C-A1EB004244F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 I thought about this some more and now I=E2=80=99m not sure that the = membership_token should only be implicit: The whole reason for HS messages to not be encrypted is that they can be = inspected along the way by an external party (e.g. the Delivery = Service). If this is not a requirement, MLSCiphertext should really be = used instead. Hiding the membership_token from external inspector means the inspector = can not verify the signature anymore. I think that defies the point of = HS messages being inspectable. The obvious fix is to include the membership_token in MLSPlaintext as = well. Raphael > On 18 Aug 2020, at 21:01, Richard Barnes wrote: >=20 > Here ya go: https://github.com/mlswg/mls-protocol/pull/396 = > On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen > wrote: > > Jo=C3=ABl, do you want to write a PR? If not, I could probably get = to it in the > > next couple days. >=20 > Thanks. :-) If you could that would be really nice. >=20 > - Jo=C3=ABl >=20 > On 18/08/2020 19:20, Richard Barnes wrote: > > Sounds like we're converging here. The only question in my mind is = what goes in > > the MAC -- seems like the easy option is probably "the remainder of = the > > MLSPlaintextTBS", i.e., everything from group_id to the end. That = seems like it > > minimizes multiple serialization: > >=20 > > tbs_content =3D serialize(group_id, ...) > > membership_token =3D KDF.Extract(confirmation_key, tbs_content) > > tbs =3D group_context || membership_token || tbs_content > >=20 > > So the PR would be to basically pop the context off of = MLSPlaintextTBS and add > > the three lines above (with the switch for internal/external in = prose). > >=20 > > Jo=C3=ABl, do you want to write a PR? If not, I could probably get = to it in the next > > couple days. > >=20 > > --Richard > >=20 > > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert > > >> wrote: > >=20 > > I think what you just described is indeed a combination of = option 1 & 2. > > It=E2=80=99s a MAC over the payload we want to authenticate, but = it=E2=80=99s implicit and > > we only include it in the MLSPlaintextTBS. Or in other words, we = stripped it > > from MLSPlaintext because it is implicitly known to any valid = member of the > > group. > >=20 > > Raphael > >=20 > >> On 18 Aug 2020, at 18:16, Joel Alwen > >> >> wrote: > >> > >> Yeah, I like Option 2 here. I like that it avoids growing = packet size. > >> > >> One caveat though: I'd go for the MAC(...) version rather than = the > >> confirmation_key. For starters thing including confirmation_key = doesnt > >> authenticate the contents of the packet. But even if it did, = signatures aren't > >> meant to hide the contents of what was signed. (Amend you = favorite sig > >> scheme to > >> tack on the message at the end a signature and you've still got = a secure > >> signature scheme. But clearly not a message hiding one.) That = means that AFAIK > >> neither ECDSA nor EdDSA etc. were designed or analyzed for such = a property. So > >> this would amount to a very non-standard use of a signature = schemes by > >> MLS. Not > >> saying it doesn't work for the particular sig schemes in our = ciphersuite. But > >> its def. not how signatures are "meant" to be used. > >> > >> But that leaves Option 2 with, say, including tag =3D = MAC(conf_key, > >> conf_trans_hash || MLSPlaintext.content) into whats being = signed which I like > >> and think gets the job done. Both conf_* values are taken from = the current > >> epoch. By MLSPlaintext.content I mean whats now called = MLSPlaintextTBS. > >> > >>> I would propose that we do need something additional on Commit = messages as > >>> well as Proposals. > >> > >> @Richard: For Proopsals I think this works. Is that about what = you had in mind > >> for commits too? > >> > >> - Jo=C3=ABl > >> > >> > >> On 18/08/2020 17:26, Richard Barnes wrote: > >>> Thanks for pointing this out, Jo=C3=ABl. I agree that the = attacks you're > >>> describing > >>> should work as things are currently specified. And they're = salient, > >>> especially > >>> the "replace Alice in the group" one. > >>> > >>> Also agree with Raphael is correct that Commit is not affected = by this, since > >>> someone who is not a member won't be able to generate the = right confirmation > >>> value. However, I don't think this is actually the right = design to adopt > >>> for a > >>> general solution to this problem. Confirmation verifies group = membership > >>> *after* processing the handshake message; the point here is = that we > >>> should also > >>> have a membership check *before* processing handshake = messages. In > >>> particular, > >>> I would propose that we do need something additional on Commit = messages > >>> as well > >>> as Proposals. > >>> > >>> Thinking about solutions here, a couple of options come to = mind: > >>> > >>> 1. Use MLSCiphertext, but with an integrity-only encapsulation > >>> 2. Incorporate in the signature something that is only known = to the group > >>> (e.g., > >>> confirmation_key or MAC(confirmation_key; = confirmed_transcript_hash || > >>> Proposal/Commit)) > >>> > >>> Option (1) has the appeal that you would only ever send = MLSCiphertext, though > >>> switching between encrypted/not could be problematic. Option = (2) seems a lot > >>> more appealing: It doesn't add any overhead, since the = group-secret value > >>> doesn't need to be sent. And we already switch between the = signature context > >>> that is added for group members vs. external. In fact, I = think option > >>> (2) would > >>> just amount to a one-line change to include an extra, secret = value in the > >>> context at the top of the MLSPlaintextTBS struct. > >>> = https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.= md#content-signing-and-encryption = > >>> > >>> The only thing that seems odd about (2) is overloading = signature > >>> verification in > >>> that way, i.e., using the ability to generate a signature over = a secret > >>> thing to > >>> prove you know the secret thing. That doesn't seem obviously = flawed to > >>> me, but > >>> worth thinking about. > >>> > >>> Does that make sense to folks? > >>> > >>> --Richard > >>> > >>> > >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > >>> > >>> =3D40wire.com@dmarc.ietf.org = > >> > >>> wrote: > >>> > >>> Hi Joel, > >>> > >>> For context: this would only apply when applications use = cleartext > >>> MLSPlaintext for HS messages. The recommendation is still = to encrypt them > >>> and send them around as MLSCiphertext. > >>> That being said, we said we would like to support scenarios = where HS > >>> messages are not necessarily encrypted. > >>> > >>> Question: would this attack work with Commit messages? = I=E2=80=99m thinking that > >>> they would be rejected because the attacker cannot compute = the > >>> confirmation_tag. > >>> > >>> As you mention in the PS, the easy target would be Proposal = messages. > >>> > >>> I=E2=80=99d be interested to see what exactly you would = propose as a mitigation > >>> mechanism. > >>> > >>> Raphael > >>> > >>>> On 18 Aug 2020, at 16:36, Joel Alwen > >>>> > > >>> >> wrote: > >>>> > >>>> Hey everyone, > >>>> > >>>> Something thats been bugging Marta Mularczyk and Daniel Jost = and me for > >>>> a bit > >>>> now is that handshake messages sent out as MLSPlaintext = packets are only > >>>> authenticated using signatures, but not using the group's key = schedule. For > >>>> non-members that makes sense but for group members that's = weaker than > >>>> need be. > >>>> > >>>> Suppose Alice is in a group using signing key pair (spk, = ssk). I corrupt > >>> her to > >>>> learn ssk. Now I loose access to her device again. Later she = generates a > >>>> fresh > >>>> key package with her same spk but a new HPKE key for her = leaf. She sends > >>> out and > >>>> update proposal for her new key package and someone commits = to the update. > >>>> > >>>> Expected result: she (and the group at large) has achieved = PCS again. > >>>> > >>>> Actual result: using her stolen ssk I can still forge a new = proposal's > >>> (sent as > >>>> MLSPlaintext packets) coming from Alice. Some things I could = do with this > >>> power: > >>>> - I can generate a new key package kp for Alice using her spk = and some > >>> HPKE key > >>>> she doesn't know. Then I forge an update proposal for Alice = with kp. If it > >>> gets > >>>> committed I've effectively kicked her out of the group. > >>>> - I could forge Add's and Remove's coming from Alice, so I = could trick the > >>>> group into thinking Alice is trying to Add my account to the = group or remove > >>>> some other group member. > >>>> > >>>> Lemme know if I've missed something here in that scenario... > >>>> > >>>> > >>>> If I didn't miss anything and the attacks really work as = advertised then IMO > >>>> this is kinda weak sauce and worth avoiding if possible. So = to that end, how > >>>> about we modify MLS such that MLSPlaintext packets coming = from group members > >>>> must also be authenticated using something from the = application key > >>>> schedule. > >>>> Now the above attacks fail. As soon as Alice's update is gets = committed I no > >>>> longer know the group's key schedule and so can't forged = packet from > >>> Alice. More > >>>> generally, this brings the PCS guarantees when using = MLSPlaintexts > >>>> frameing in > >>>> line with what we're getting from MLSCiphertext packets. > >>>> > >>>> Any thoughts? > >>>> > >>>> - Jo=C3=ABl > >>>> > >>>> > >>>> > >>>> PS. For concreteness, we could probably extend the current = mechanism for > >>> getting > >>>> concistancy (the confirmation_tag) to also provide symmetric = key > >>> authentication. > >>>> E.g. include most of the MLSPlaintext content into whats = being tagged by > >>>> confirmation_tag. That would cover the case of a commit = packet and doesn't > >>> even > >>>> grow the size of MLSPlaintext packets over the current = design. > >>>> > >>>> For a proposal packet we could also have a confirmation_tag = but this one is > >>>> computed using the *current* epoch's confirmation_key and > >>> confirmed_transcript_hash. > >>>> > >>>> _______________________________________________ > >>>> MLS mailing list > >>>> MLS@ietf.org > > > >>>> https://www.ietf.org/mailman/listinfo/mls = > >>> > >>> _______________________________________________ > >>> MLS mailing list > >>> MLS@ietf.org > > > >>> https://www.ietf.org/mailman/listinfo/mls = > >=20 --Apple-Mail=_FFC04E64-978A-4A87-AB4C-A1EB004244F6 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 I = thought about this some more and now I=E2=80=99m not sure that the = membership_token should only be implicit:

The whole reason for HS messages to not = be encrypted is that they can be inspected along the way by an external = party (e.g. the Delivery Service). If this is not a requirement, = MLSCiphertext should really be used instead.
Hiding = the membership_token from external inspector means the inspector can not = verify the signature anymore. I think that defies the point of HS = messages being inspectable.

The obvious fix is to include the membership_token in = MLSPlaintext as well.

Raphael

On 18 Aug 2020, at 21:01, = Richard Barnes <rlb@ipv.sx> wrote:

Here ya go: https://github.com/mlswg/mls-protocol/pull/396

On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen <jalwen@wickr.com> = wrote:
> Jo=C3=ABl, do you want to write = a PR?  If not, I could probably get to it in the
> next couple days.

Thanks. :-) If you could that would be really nice.

- Jo=C3=ABl

On 18/08/2020 19:20, Richard Barnes wrote:
> Sounds like we're converging here.  The only question in my = mind is what goes in
> the MAC -- seems like the easy option is probably "the remainder of = the
> MLSPlaintextTBS", i.e., everything from group_id to the end.  = That seems like it
> minimizes multiple serialization:
>
> tbs_content =3D serialize(group_id, ...)
> membership_token =3D KDF.Extract(confirmation_key, tbs_content)
> tbs =3D group_context || membership_token || tbs_content
>
> So the PR would be to basically pop the context off of = MLSPlaintextTBS and add
> the three lines above (with the switch for internal/external in = prose).
>
> Jo=C3=ABl, do you want to write a PR?  If not, I could = probably get to it in the next
> couple days.
>
> --Richard
>
> On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert <raphael@wire.com
> <mailto:raphael@wire.com>> wrote:
>
>     I think what you just described is indeed a = combination of option 1 & 2.
>     It=E2=80=99s a MAC over the payload we want to = authenticate, but it=E2=80=99s implicit and
>     we only include it in the MLSPlaintextTBS. Or in = other words, we stripped it
>     from MLSPlaintext because it is implicitly known = to any valid member of the
>     group.
>
>     Raphael
>
>>     On 18 Aug 2020, at 18:16, Joel Alwen <jalwen@wickr.com
>>     <mailto:jalwen@wickr.com>> wrote:
>>
>>     Yeah, I like Option 2 here. I like that it = avoids growing packet size.
>>
>>     One caveat though: I'd go for the MAC(...) = version rather than the
>>     confirmation_key. For starters thing = including confirmation_key doesnt
>>     authenticate the contents of the packet. But = even if it did, signatures aren't
>>     meant to hide the contents of what was = signed. (Amend you favorite sig
>>     scheme to
>>     tack on the message at the end a signature = and you've still got a secure
>>     signature scheme. But clearly not a message = hiding one.) That means that AFAIK
>>     neither ECDSA nor EdDSA etc. were designed = or analyzed for such a property. So
>>     this would amount to a very non-standard use = of a signature schemes by
>>     MLS. Not
>>     saying it doesn't work for the particular = sig schemes in our ciphersuite. But
>>     its def. not how signatures are "meant" to = be used.
>>
>>     But that leaves Option 2 with, say, = including tag =3D MAC(conf_key,
>>     conf_trans_hash || MLSPlaintext.content) = into whats being signed which I like
>>     and think gets the job done. Both conf_* = values are taken from the current
>>     epoch. By MLSPlaintext.content I mean whats = now called MLSPlaintextTBS.
>>
>>>     I would propose that we do need = something additional on Commit messages as
>>>     well as Proposals.
>>
>>     @Richard: For Proopsals I think this works. = Is that about what you had in mind
>>     for commits too?
>>
>>     - Jo=C3=ABl
>>
>>
>>     On 18/08/2020 17:26, Richard Barnes = wrote:
>>>     Thanks for pointing this out, = Jo=C3=ABl.  I agree that the attacks you're
>>>     describing
>>>     should work as things are currently = specified.  And they're salient,
>>>     especially
>>>     the "replace Alice in the group" one.
>>>
>>>     Also agree with Raphael is correct that = Commit is not affected by this, since
>>>     someone who is not a member won't be = able to generate the right confirmation
>>>     value.  However, I don't think this = is actually the right design to adopt
>>>     for a
>>>     general solution to this problem.  = Confirmation verifies group membership
>>>     *after* processing the handshake = message; the point here is that we
>>>     should also
>>>     have a membership check *before* = processing handshake messages.  In
>>>     particular,
>>>     I would propose that we do need = something additional on Commit messages
>>>     as well
>>>     as Proposals.
>>>
>>>     Thinking about solutions here, a couple = of options come to mind:
>>>
>>>     1. Use MLSCiphertext, but with an = integrity-only encapsulation
>>>     2. Incorporate in the signature = something that is only known to the group
>>>     (e.g.,
>>>     confirmation_key or = MAC(confirmation_key; confirmed_transcript_hash ||
>>>     Proposal/Commit))
>>>
>>>     Option (1) has the appeal that you would = only ever send MLSCiphertext, though
>>>     switching between encrypted/not could be = problematic.  Option (2) seems a lot
>>>     more appealing: It doesn't add any = overhead, since the group-secret value
>>>     doesn't need to be sent.  And we = already switch between the signature context
>>>     that is added for group members vs. = external.  In fact, I think option
>>>     (2) would
>>>     just amount to a one-line change to = include an extra, secret value in the
>>>     context at the top of the = MLSPlaintextTBS struct.
>>>     https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-ml= s-protocol.md#content-signing-and-encryption
>>>
>>>     The only thing that seems odd about (2) = is overloading signature
>>>     verification in
>>>     that way, i.e., using the ability to = generate a signature over a secret
>>>     thing to
>>>     prove you know the secret thing.  = That doesn't seem obviously flawed to
>>>     me, but
>>>     worth thinking about.
>>>
>>>     Does that make sense to folks?
>>>
>>>     --Richard
>>>
>>>
>>>     On Tue, Aug 18, 2020 at 10:55 AM Raphael = Robert
>>>     <raphael=3D40wire.com@dmarc.ietf.org
>>>     <mailto:raphael=3D40wire.com@dmarc.ietf.org> <mailto:40wire.com@dmarc.ietf.org>>
>>>     wrote:
>>>
>>>        Hi Joel,
>>>
>>>        For context: this = would only apply when applications use cleartext
>>>        MLSPlaintext for HS = messages. The recommendation is still to encrypt them
>>>        and send them around = as MLSCiphertext.
>>>        That being said, we = said we would like to support scenarios where HS
>>>        messages are not = necessarily encrypted.
>>>
>>>        Question: would this = attack work with Commit messages? I=E2=80=99m thinking that
= >>>        they would be rejected = because the attacker cannot compute the
>>>     confirmation_tag.
>>>
>>>        As you mention in the = PS, the easy target would be Proposal messages.
>>>
>>>        I=E2=80=99d be = interested to see what exactly you would propose as a mitigation
>>>        mechanism.
>>>
>>>        Raphael
>>>
>>>>     On 18 Aug 2020, at 16:36, Joel Alwen = <jalwen@wickr.com
>>>>     <mailto:jalwen@wickr.com>
>>>        <mailto:jalwen@wickr.com>> wrote:
>>>>
>>>>     Hey everyone,
>>>>
>>>>     Something thats been bugging Marta = Mularczyk and Daniel Jost and me for
>>>>     a bit
>>>>     now is that handshake messages sent = out as MLSPlaintext packets are only
>>>>     authenticated using signatures, but = not using the group's key schedule. For
>>>>     non-members that makes sense but for = group members that's weaker than
>>>>     need be.
>>>>
>>>>     Suppose Alice is in a group using = signing key pair (spk, ssk). I corrupt
>>>        her to
>>>>     learn ssk. Now I loose access to her = device again. Later she generates a
>>>>     fresh
>>>>     key package with her same spk but a = new HPKE key for her leaf. She sends
>>>        out and
>>>>     update proposal for her new key = package and someone commits to the update.
>>>>
>>>>     Expected result: she (and the group = at large) has achieved PCS again.
>>>>
>>>>     Actual result: using her stolen ssk = I can still forge a new proposal's
>>>        (sent as
>>>>     MLSPlaintext packets) coming from = Alice. Some things I could do with this
>>>        power:
>>>>     - I can generate a new key package = kp for Alice using her spk and some
>>>        HPKE key
>>>>     she doesn't know. Then I forge an = update proposal for Alice with kp. If it
>>>        gets
>>>>     committed I've effectively kicked = her out of the group.
>>>>     - I could forge Add's and Remove's = coming from Alice, so I could trick the
>>>>     group into thinking Alice is trying = to Add my account to the group or remove
>>>>     some other group member.
>>>>
>>>>     Lemme know if I've missed something = here in that scenario...
>>>>
>>>>
>>>>     If I didn't miss anything and the = attacks really work as advertised then IMO
>>>>     this is kinda weak sauce and worth = avoiding if possible. So to that end, how
>>>>     about we modify MLS such that = MLSPlaintext packets coming from group members
>>>>     must also be authenticated using = something from the application key
>>>>     schedule.
>>>>     Now the above attacks fail. As soon = as Alice's update is gets committed I no
>>>>     longer know the group's key schedule = and so can't forged packet from
>>>        Alice. More
>>>>     generally, this brings the PCS = guarantees when using MLSPlaintexts
>>>>     frameing in
>>>>     line with what we're getting from = MLSCiphertext packets.
>>>>
>>>>     Any thoughts?
>>>>
>>>>     - Jo=C3=ABl
>>>>
>>>>
>>>>
>>>>     PS. For concreteness, we could = probably extend the current mechanism for
>>>        getting
>>>>     concistancy (the confirmation_tag) = to also provide symmetric key
>>>        authentication.
>>>>     E.g. include most of the = MLSPlaintext content into whats being tagged by
>>>>     confirmation_tag. That would cover = the case of a commit packet and doesn't
>>>        even
>>>>     grow the size of MLSPlaintext = packets over the current design.
>>>>
>>>>     For a proposal packet we could also = have a confirmation_tag but this one is
>>>>     computed using the *current* epoch's = confirmation_key and
>>>    =     confirmed_transcript_hash.
>>>>
>>>>    =  _______________________________________________
>>>>     MLS mailing list
>>>>     MLS@ietf.org <mailto:MLS@ietf.org> <mailto:MLS@ietf.org>
>>>>     https://www.ietf.org/mailman/listinfo/mls
>>>
>>>    =     _______________________________________________ >>>        MLS mailing list
>>>        MLS@ietf.org= <mailto:MLS@ietf.org> <mailto:MLS@ietf.org>
>>>        https://www.ietf.org/mailman/listinfo/mls
>

= --Apple-Mail=_FFC04E64-978A-4A87-AB4C-A1EB004244F6-- From nobody Wed Aug 19 01:17:57 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AFA093A1117 for ; Wed, 19 Aug 2020 01:17:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.086 X-Spam-Level: X-Spam-Status: No, score=-2.086 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KuDUOrpOvAzJ for ; Wed, 19 Aug 2020 01:17:53 -0700 (PDT) Received: from smtp-out-02.aalto.fi (smtp-out-02.aalto.fi [130.233.228.121]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F3CE3A111B for ; Wed, 19 Aug 2020 01:17:50 -0700 (PDT) Received: from smtp-out-02.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 59248271636_F3CE029B; Wed, 19 Aug 2020 08:17:45 +0000 (GMT) Received: from exng1.org.aalto.fi (exng1.org.aalto.fi [130.233.223.20]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng1.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-02.aalto.fi (Sophos Email Appliance) with ESMTPS id C632F271653_F3CE028F; Wed, 19 Aug 2020 08:17:44 +0000 (GMT) Received: from exng6.org.aalto.fi (130.233.223.25) by exng1.org.aalto.fi (130.233.223.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Wed, 19 Aug 2020 11:17:44 +0300 Received: from exng4.org.aalto.fi (130.233.223.23) by exng6.org.aalto.fi (130.233.223.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Wed, 19 Aug 2020 11:17:44 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Wed, 19 Aug 2020 11:17:44 +0300 From: Cornelissen Eric To: Richard Barnes , Raphael Robert CC: Joel Alwen , Messaging Layer Security WG Thread-Topic: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule Thread-Index: AQHWdXrucaCL3fuq50uSJkTFSJfo5ak/Fzvd Date: Wed, 19 Aug 2020 08:17:44 +0000 Message-ID: <19861857231648008e6c280815c86546@aalto.fi> References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> , In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_19861857231648008e6c280815c86546aaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=lo7lt9YBAMXPJgV7KO54bgid16f8tnc3l0d8hGESm58=; b=e4WRnUoqdCyBCK3S+3dLhrEP4yb+0Fl0l09zqhXwEaFqW0RfqTqEtg0e0bfIswFFItGz6iDMEdnU1z6cwfc6WXHXeJmlp+HWggpJ/VrCl24prQ+0yftt4Wg+EAdm7DkdmWNO6+hjqUoLIfrGZkAgNoINXphWfxjH+FA7CL//Qr/SoHP4eu6Ulr1H0hY1D7+ejFxDqCsHEjCmNGyUDNHik6uW7NOOQxR4WvFYk418vVMO68+jrpJuGycjTXa95WULxzcCelwmr/HmbwEuCVxHditu3KE0agIXxa2Pk5TRLjmR9f7N7GZBt7PjTtIWvwLq2/jf8GSOU49Fc6YYSTeDfw== Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Aug 2020 08:17:56 -0000 --_000_19861857231648008e6c280815c86546aaltofi_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable I was wondering what the implications are of using the key advertised in an= update Proposal's KeyPackage for signing, instead of the long-term key pai= r, just like new_member external proposals. I'm confident it prevents the original weakness po= inted out by Jo=EBl, but I'm unsure as to whether or not it introduces any = new problems. Then again, I would be very much in favor of including something group-bind= ing in handshake messages as it would prevent some replay attacks (*) that = I have been considering for a while. Regards, Eric (*): Replays from adversarially controlled groups where the attacker manage= d to have the group id, epoch, and tree structure to match those of a targe= t group. ________________________________ From: Richard Barnes Sent: Tuesday, August 18, 2020 6:26 PM To: Raphael Robert Cc: Joel Alwen; Messaging Layer Security WG Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetri= c key schedule Thanks for pointing this out, Jo=EBl. I agree that the attacks you're desc= ribing should work as things are currently specified. And they're salient,= especially the "replace Alice in the group" one. Also agree with Raphael is correct that Commit is not affected by this, sin= ce someone who is not a member won't be able to generate the right confirma= tion value. However, I don't think this is actually the right design to ad= opt for a general solution to this problem. Confirmation verifies group me= mbership *after* processing the handshake message; the point here is that w= e should also have a membership check *before* processing handshake message= s. In particular, I would propose that we do need something additional on = Commit messages as well as Proposals. Thinking about solutions here, a couple of options come to mind: 1. Use MLSCiphertext, but with an integrity-only encapsulation 2. Incorporate in the signature something that is only known to the group (= e.g., confirmation_key or MAC(confirmation_key; confirmed_transcript_hash |= | Proposal/Commit)) Option (1) has the appeal that you would only ever send MLSCiphertext, thou= gh switching between encrypted/not could be problematic. Option (2) seems = a lot more appealing: It doesn't add any overhead, since the group-secret v= alue doesn't need to be sent. And we already switch between the signature = context that is added for group members vs. external. In fact, I think opt= ion (2) would just amount to a one-line change to include an extra, secret = value in the context at the top of the MLSPlaintextTBS struct. https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.m= d#content-signing-and-encryption [https://avatars1.githubusercontent.com/u/36107802?s=3D400&v=3D4] mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protocol = =B7 GitHub github.com MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub. The only thing that seems odd about (2) is overloading signature verificati= on in that way, i.e., using the ability to generate a signature over a secr= et thing to prove you know the secret thing. That doesn't seem obviously f= lawed to me, but worth thinking about. Does that make sense to folks? --Richard On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > wrote: Hi Joel, For context: this would only apply when applications use cleartext MLSPlain= text for HS messages. The recommendation is still to encrypt them and send = them around as MLSCiphertext. That being said, we said we would like to support scenarios where HS messag= es are not necessarily encrypted. Question: would this attack work with Commit messages? I=92m thinking that = they would be rejected because the attacker cannot compute the confirmation= _tag. As you mention in the PS, the easy target would be Proposal messages. I=92d be interested to see what exactly you would propose as a mitigation m= echanism. Raphael > On 18 Aug 2020, at 16:36, Joel Alwen > wrote: > > Hey everyone, > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a= bit > now is that handshake messages sent out as MLSPlaintext packets are only > authenticated using signatures, but not using the group's key schedule. F= or > non-members that makes sense but for group members that's weaker than nee= d be. > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt = her to > learn ssk. Now I loose access to her device again. Later she generates a = fresh > key package with her same spk but a new HPKE key for her leaf. She sends = out and > update proposal for her new key package and someone commits to the update= . > > Expected result: she (and the group at large) has achieved PCS again. > > Actual result: using her stolen ssk I can still forge a new proposal's (s= ent as > MLSPlaintext packets) coming from Alice. Some things I could do with this= power: > - I can generate a new key package kp for Alice using her spk and some HP= KE key > she doesn't know. Then I forge an update proposal for Alice with kp. If i= t gets > committed I've effectively kicked her out of the group. > - I could forge Add's and Remove's coming from Alice, so I could trick th= e > group into thinking Alice is trying to Add my account to the group or rem= ove > some other group member. > > Lemme know if I've missed something here in that scenario... > > > If I didn't miss anything and the attacks really work as advertised then = IMO > this is kinda weak sauce and worth avoiding if possible. So to that end, = how > about we modify MLS such that MLSPlaintext packets coming from group memb= ers > must also be authenticated using something from the application key sched= ule. > Now the above attacks fail. As soon as Alice's update is gets committed I= no > longer know the group's key schedule and so can't forged packet from Alic= e. More > generally, this brings the PCS guarantees when using MLSPlaintexts framei= ng in > line with what we're getting from MLSCiphertext packets. > > Any thoughts? > > - Jo=EBl > > > > PS. For concreteness, we could probably extend the current mechanism for = getting > concistancy (the confirmation_tag) to also provide symmetric key authenti= cation. > E.g. include most of the MLSPlaintext content into whats being tagged by > confirmation_tag. That would cover the case of a commit packet and doesn'= t even > grow the size of MLSPlaintext packets over the current design. > > For a proposal packet we could also have a confirmation_tag but this one = is > computed using the *current* epoch's confirmation_key and confirmed_trans= cript_hash. > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls _______________________________________________ MLS mailing list MLS@ietf.org https://www.ietf.org/mailman/listinfo/mls --_000_19861857231648008e6c280815c86546aaltofi_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

I was wondering what the implications are of using the key advertised = in an update Proposal's KeyPackage for signing, instead of the long-term ke= y pair, just like new_member external proposals. I'm confident= it prevents the original weakness pointed out by Jo=EBl, but I'm unsure as to whether or not it introduces any new p= roblems.


Then again, I would be very much in favor of including something group-b= inding in handshake messages as it would prevent some replay attacks (*) th= at I have been considering for a while.


Regards,

Eric



(*): Replays from adversarially controlled groups where the attacker = managed to have the group id, epoch, and tree structure to match those of&n= bsp;a target group.



From: Richard Barnes <= rlb@ipv.sx>
Sent: Tuesday, August 18, 2020 6:26 PM
To: Raphael Robert
Cc: Joel Alwen; Messaging Layer Security WG
Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using s= ymmetric key schedule
 
Thanks for pointing this out, Jo=EBl.  I agree that the attacks y= ou're describing should work as things are currently specified.  And t= hey're salient, especially the "replace Alice in the group" one.<= br>

Also agree with Raphael is correct that Commit is not affected by this= , since someone who is not a member won't be able to generate the right con= firmation value.  However, I don't think this is actually the right de= sign to adopt for a general solution to this problem.  Confirmation verifies group membership *after* proc= essing the handshake message; the point here is that we should also have a = membership check *before* processing handshake messages.  In particula= r, I would propose that we do need something additional on Commit messages as well as Proposals.

Thinking about solutions here, a couple of options come to mind:

1. Use MLSCiphertext, but with an integrity-only encapsulation
2. Incorporate in the signature something that is only known to the gr= oup (e.g., confirmation_key or MAC(confirmation_key; confirmed_transcript_h= ash || Proposal/Commit))

Option (1) has the appeal that you would only ever send MLSCiphertext,= though switching between encrypted/not could be problematic.  Option = (2) seems a lot more appealing: It doesn't add any overhead, since the grou= p-secret value doesn't need to be sent.  And we already switch between the signature context that is added for grou= p members vs. external.  In fact, I think option (2) would just amount= to a one-line change to include an extra, secret value in the context at t= he top of the MLSPlaintextTBS struct.
github.com
MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub.

The only thing that seems odd about (2) is overloading signature verif= ication in that way, i.e., using the ability to generate a signature over a= secret thing to prove you know the secret thing.  That doesn't seem o= bviously flawed to me, but worth thinking about.

Does that make sense to folks?

--Richard


On Tue, Aug 18, 2020 at 10:55 AM Raph= ael Robert <raphael=3D40wir= e.com@dmarc.ietf.org> wrote:
Hi Joel,

For context: this would only apply when applications use cleartext MLSPlain= text for HS messages. The recommendation is still to encrypt them and send = them around as MLSCiphertext.
That being said, we said we would like to support scenarios where HS messag= es are not necessarily encrypted.

Question: would this attack work with Commit messages? I=92m thinking that = they would be rejected because the attacker cannot compute the confirmation= _tag.

As you mention in the PS, the easy target would be Proposal messages.

I=92d be interested to see what exactly you would propose as a mitigation m= echanism.

Raphael

> On 18 Aug 2020, at 16:36, Joel Alwen <jalwen@wickr.com> wrote:
>
> Hey everyone,
>
> Something thats been bugging Marta Mularczyk and Daniel Jost and me fo= r a bit
> now is that handshake messages sent out as MLSPlaintext packets are on= ly
> authenticated using signatures, but not using the group's key schedule= . For
> non-members that makes sense but for group members that's weaker than = need be.
>
> Suppose Alice is in a group using signing key pair (spk, ssk). I corru= pt her to
> learn ssk. Now I loose access to her device again. Later she generates= a fresh
> key package with her same spk but a new HPKE key for her leaf. She sen= ds out and
> update proposal for her new key package and someone commits to the upd= ate.
>
> Expected result: she (and the group at large) has achieved PCS again.<= br> >
> Actual result: using her stolen ssk I can still forge a new proposal's= (sent as
> MLSPlaintext packets) coming from Alice. Some things I could do with t= his power:
> - I can generate a new key package kp for Alice using her spk and some= HPKE key
> she doesn't know. Then I forge an update proposal for Alice with kp. I= f it gets
> committed I've effectively kicked her out of the group.
> - I could forge Add's and Remove's coming from Alice, so I could trick= the
> group into thinking Alice is trying to Add my account to the group or = remove
> some other group member.
>
> Lemme know if I've missed something here in that scenario...
>
>
> If I didn't miss anything and the attacks really work as advertised th= en IMO
> this is kinda weak sauce and worth avoiding if possible. So to that en= d, how
> about we modify MLS such that MLSPlaintext packets coming from group m= embers
> must also be authenticated using something from the application key sc= hedule.
> Now the above attacks fail. As soon as Alice's update is gets committe= d I no
> longer know the group's key schedule and so can't forged packet from A= lice. More
> generally, this brings the PCS guarantees when using MLSPlaintexts fra= meing in
> line with what we're getting from MLSCiphertext packets.
>
> Any thoughts?
>
> - Jo=EBl
>
>
>
> PS. For concreteness, we could probably extend the current mechanism f= or getting
> concistancy (the confirmation_tag) to also provide symmetric key authe= ntication.
> E.g. include most of the MLSPlaintext content into whats being tagged = by
> confirmation_tag. That would cover the case of a commit packet and doe= sn't even
> grow the size of MLSPlaintext packets over the current design.
>
> For a proposal packet we could also have a confirmation_tag but this o= ne is
> computed using the *current* epoch's confirmation_key and confirmed_tr= anscript_hash.
>
> _______________________________________________
> MLS mailing list
> MLS@ietf.org
> https://www.ietf.org/mailman/listinfo/mls

_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--_000_19861857231648008e6c280815c86546aaltofi_-- From nobody Thu Aug 20 07:20:57 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F39373A0B53 for ; Thu, 20 Aug 2020 07:20:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A2apxchFAt3o for ; Thu, 20 Aug 2020 07:20:53 -0700 (PDT) Received: from mail-ed1-x52c.google.com (mail-ed1-x52c.google.com [IPv6:2a00:1450:4864:20::52c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63C7B3A0B18 for ; Thu, 20 Aug 2020 07:20:53 -0700 (PDT) Received: by mail-ed1-x52c.google.com with SMTP id w2so1471484edv.7 for ; Thu, 20 Aug 2020 07:20:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=GvDatw6Rm6yR5LuhDmxchI377lt2rkest2/yaYzyrpo=; b=GU93Mnh3LJh5qVhn9euZmns9chljhkluaSuELa1cSol5Oore769G5imGwQ2+kE2U+Z G1deMJhHS6KwHl/Zq9ZkotH+4oXGmtCFxkZhQVjXWyLroyfiEn7b3NPXUrWVlLXDy+s7 FRSPk2QHFHsyagLT2jhqUR1B6NlnTQSPGpos52Af2YTmANuI4BQp1Oypw4J527Z+jSIa KUnt9GtshIkAsPmeki9Ujfv3zqi4IGGaVRqBkA8rC20eUFZJ2tFAOGtqhW+CgQjfRH1M Gk1eaDqB7QXxyh3SPNV6XXZN+XVvR7qs85HP65olgPp3LWspzd9WwJqLE5sz8a2Vrq0+ lqNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=GvDatw6Rm6yR5LuhDmxchI377lt2rkest2/yaYzyrpo=; b=aFDdUfk9FEnjsYsTpwOy7OzrIhD2nZkboTTbzIo2qE4APlvnGdaJvK50st/geGe0qd dezQvN0gz1YA9lEM0zCXUqNBX/k3U7EIWleyXk2rzfg+EpwsmHM2gx8F8KaWCZlDY1jf gN0DwYXW872gc8FsKoDY/NcJeQM6LtRr6iFRNS9yXlm8SGa2Ln+ARpAsUuwELOs2d+r9 bVIj7Pxx1RZxovQf0lPPaLYvBDiNN54jcVJ0HZwgCJE3n66I7ll2FBwPrTJIRgVCd5OS XmuQP2EjASVEPR2kKQpRijfyGvdQZkP1qeWuw8Vbxx7FJxS856bKO1v9mZP5rGfVaf1g xmiw== X-Gm-Message-State: AOAM533YgzB1+ZGHaxyRaVricM1HCiiDxoPnaYW/uUdCDtnh8j1CCBku atl5T383TGbh2fMz1gwJluDQC58MdArl9A== X-Google-Smtp-Source: ABdhPJwSrAEZjlmqln8fjL3XEah7LPvbMEFIHgzwqztDYY8yRWRZduZ9Sst4CPq6XS5L6KuIfuoRww== X-Received: by 2002:a50:ee93:: with SMTP id f19mr3088103edr.31.1597933251346; Thu, 20 Aug 2020 07:20:51 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id bz19sm484605ejc.72.2020.08.20.07.20.49 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 20 Aug 2020 07:20:50 -0700 (PDT) To: Raphael Robert , Richard Barnes Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: <1bd2268c-7f27-e24a-bcd7-3192afae13c9@wickr.com> Date: Thu, 20 Aug 2020 16:20:49 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 14:20:56 -0000 Yeah, good point. While I'm not sure every case of server inspection would require checking sigs on packets I am sure it would be useful for some cases. > The obvious fix is to include the membership_token in MLSPlaintext as well. Yup, I'm all for it. (Or at least for making it an optional field in that struct.) - Joël On 19/08/2020 09:24, Raphael Robert wrote: > I thought about this some more and now I’m not sure that the membership_token > should only be implicit: > > The whole reason for HS messages to not be encrypted is that they can be > inspected along the way by an external party (e.g. the Delivery Service). If > this is not a requirement, MLSCiphertext should really be used instead. > Hiding the membership_token from external inspector means the inspector can not > verify the signature anymore. I think that defies the point of HS messages being > inspectable. > > The obvious fix is to include the membership_token in MLSPlaintext as well. > > Raphael > >> On 18 Aug 2020, at 21:01, Richard Barnes > wrote: >> >> Here ya go: https://github.com/mlswg/mls-protocol/pull/396 >> >> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen > > wrote: >> >> > Joël, do you want to write a PR?  If not, I could probably get to it in the >> > next couple days. >> >> Thanks. :-) If you could that would be really nice. >> >> - Joël >> >> On 18/08/2020 19:20, Richard Barnes wrote: >> > Sounds like we're converging here.  The only question in my mind is what >> goes in >> > the MAC -- seems like the easy option is probably "the remainder of the >> > MLSPlaintextTBS", i.e., everything from group_id to the end.  That seems >> like it >> > minimizes multiple serialization: >> > >> > tbs_content = serialize(group_id, ...) >> > membership_token = KDF.Extract(confirmation_key, tbs_content) >> > tbs = group_context || membership_token || tbs_content >> > >> > So the PR would be to basically pop the context off of MLSPlaintextTBS >> and add >> > the three lines above (with the switch for internal/external in prose). >> > >> > Joël, do you want to write a PR?  If not, I could probably get to it in >> the next >> > couple days. >> > >> > --Richard >> > >> > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert > >> > >> wrote: >> > >> >     I think what you just described is indeed a combination of option 1 & 2. >> >     It’s a MAC over the payload we want to authenticate, but it’s >> implicit and >> >     we only include it in the MLSPlaintextTBS. Or in other words, we >> stripped it >> >     from MLSPlaintext because it is implicitly known to any valid member >> of the >> >     group. >> > >> >     Raphael >> > >> >>     On 18 Aug 2020, at 18:16, Joel Alwen > >> >>     >> wrote: >> >> >> >>     Yeah, I like Option 2 here. I like that it avoids growing packet size. >> >> >> >>     One caveat though: I'd go for the MAC(...) version rather than the >> >>     confirmation_key. For starters thing including confirmation_key doesnt >> >>     authenticate the contents of the packet. But even if it did, >> signatures aren't >> >>     meant to hide the contents of what was signed. (Amend you favorite sig >> >>     scheme to >> >>     tack on the message at the end a signature and you've still got a >> secure >> >>     signature scheme. But clearly not a message hiding one.) That means >> that AFAIK >> >>     neither ECDSA nor EdDSA etc. were designed or analyzed for such a >> property. So >> >>     this would amount to a very non-standard use of a signature schemes by >> >>     MLS. Not >> >>     saying it doesn't work for the particular sig schemes in our >> ciphersuite. But >> >>     its def. not how signatures are "meant" to be used. >> >> >> >>     But that leaves Option 2 with, say, including tag = MAC(conf_key, >> >>     conf_trans_hash || MLSPlaintext.content) into whats being signed >> which I like >> >>     and think gets the job done. Both conf_* values are taken from the >> current >> >>     epoch. By MLSPlaintext.content I mean whats now called MLSPlaintextTBS. >> >> >> >>>     I would propose that we do need something additional on Commit >> messages as >> >>>     well as Proposals. >> >> >> >>     @Richard: For Proopsals I think this works. Is that about what you >> had in mind >> >>     for commits too? >> >> >> >>     - Joël >> >> >> >> >> >>     On 18/08/2020 17:26, Richard Barnes wrote: >> >>>     Thanks for pointing this out, Joël.  I agree that the attacks you're >> >>>     describing >> >>>     should work as things are currently specified.  And they're salient, >> >>>     especially >> >>>     the "replace Alice in the group" one. >> >>> >> >>>     Also agree with Raphael is correct that Commit is not affected by >> this, since >> >>>     someone who is not a member won't be able to generate the right >> confirmation >> >>>     value.  However, I don't think this is actually the right design >> to adopt >> >>>     for a >> >>>     general solution to this problem.  Confirmation verifies group >> membership >> >>>     *after* processing the handshake message; the point here is that we >> >>>     should also >> >>>     have a membership check *before* processing handshake messages.  In >> >>>     particular, >> >>>     I would propose that we do need something additional on Commit >> messages >> >>>     as well >> >>>     as Proposals. >> >>> >> >>>     Thinking about solutions here, a couple of options come to mind: >> >>> >> >>>     1. Use MLSCiphertext, but with an integrity-only encapsulation >> >>>     2. Incorporate in the signature something that is only known to >> the group >> >>>     (e.g., >> >>>     confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || >> >>>     Proposal/Commit)) >> >>> >> >>>     Option (1) has the appeal that you would only ever send >> MLSCiphertext, though >> >>>     switching between encrypted/not could be problematic.  Option (2) >> seems a lot >> >>>     more appealing: It doesn't add any overhead, since the >> group-secret value >> >>>     doesn't need to be sent.  And we already switch between the >> signature context >> >>>     that is added for group members vs. external.  In fact, I think option >> >>>     (2) would >> >>>     just amount to a one-line change to include an extra, secret value >> in the >> >>>     context at the top of the MLSPlaintextTBS struct. >> >>>    >>  https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption >> >>> >> >>>     The only thing that seems odd about (2) is overloading signature >> >>>     verification in >> >>>     that way, i.e., using the ability to generate a signature over a >> secret >> >>>     thing to >> >>>     prove you know the secret thing.  That doesn't seem obviously >> flawed to >> >>>     me, but >> >>>     worth thinking about. >> >>> >> >>>     Does that make sense to folks? >> >>> >> >>>     --Richard >> >>> >> >>> >> >>>     On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert >> >>>      >> >>>     =40wire.com@dmarc.ietf.org >> > > >> >> >>>     wrote: >> >>> >> >>>        Hi Joel, >> >>> >> >>>        For context: this would only apply when applications use cleartext >> >>>        MLSPlaintext for HS messages. The recommendation is still to >> encrypt them >> >>>        and send them around as MLSCiphertext. >> >>>        That being said, we said we would like to support scenarios >> where HS >> >>>        messages are not necessarily encrypted. >> >>> >> >>>        Question: would this attack work with Commit messages? I’m >> thinking that >> >>>        they would be rejected because the attacker cannot compute the >> >>>     confirmation_tag. >> >>> >> >>>        As you mention in the PS, the easy target would be Proposal >> messages. >> >>> >> >>>        I’d be interested to see what exactly you would propose as a >> mitigation >> >>>        mechanism. >> >>> >> >>>        Raphael >> >>> >> >>>>     On 18 Aug 2020, at 16:36, Joel Alwen > >> >>>>     > >> >>>        >> wrote: >> >>>> >> >>>>     Hey everyone, >> >>>> >> >>>>     Something thats been bugging Marta Mularczyk and Daniel Jost and >> me for >> >>>>     a bit >> >>>>     now is that handshake messages sent out as MLSPlaintext packets >> are only >> >>>>     authenticated using signatures, but not using the group's key >> schedule. For >> >>>>     non-members that makes sense but for group members that's weaker than >> >>>>     need be. >> >>>> >> >>>>     Suppose Alice is in a group using signing key pair (spk, ssk). I >> corrupt >> >>>        her to >> >>>>     learn ssk. Now I loose access to her device again. Later she >> generates a >> >>>>     fresh >> >>>>     key package with her same spk but a new HPKE key for her leaf. >> She sends >> >>>        out and >> >>>>     update proposal for her new key package and someone commits to >> the update. >> >>>> >> >>>>     Expected result: she (and the group at large) has achieved PCS again. >> >>>> >> >>>>     Actual result: using her stolen ssk I can still forge a new >> proposal's >> >>>        (sent as >> >>>>     MLSPlaintext packets) coming from Alice. Some things I could do >> with this >> >>>        power: >> >>>>     - I can generate a new key package kp for Alice using her spk and >> some >> >>>        HPKE key >> >>>>     she doesn't know. Then I forge an update proposal for Alice with >> kp. If it >> >>>        gets >> >>>>     committed I've effectively kicked her out of the group. >> >>>>     - I could forge Add's and Remove's coming from Alice, so I could >> trick the >> >>>>     group into thinking Alice is trying to Add my account to the >> group or remove >> >>>>     some other group member. >> >>>> >> >>>>     Lemme know if I've missed something here in that scenario... >> >>>> >> >>>> >> >>>>     If I didn't miss anything and the attacks really work as >> advertised then IMO >> >>>>     this is kinda weak sauce and worth avoiding if possible. So to >> that end, how >> >>>>     about we modify MLS such that MLSPlaintext packets coming from >> group members >> >>>>     must also be authenticated using something from the application key >> >>>>     schedule. >> >>>>     Now the above attacks fail. As soon as Alice's update is gets >> committed I no >> >>>>     longer know the group's key schedule and so can't forged packet from >> >>>        Alice. More >> >>>>     generally, this brings the PCS guarantees when using MLSPlaintexts >> >>>>     frameing in >> >>>>     line with what we're getting from MLSCiphertext packets. >> >>>> >> >>>>     Any thoughts? >> >>>> >> >>>>     - Joël >> >>>> >> >>>> >> >>>> >> >>>>     PS. For concreteness, we could probably extend the current >> mechanism for >> >>>        getting >> >>>>     concistancy (the confirmation_tag) to also provide symmetric key >> >>>        authentication. >> >>>>     E.g. include most of the MLSPlaintext content into whats being >> tagged by >> >>>>     confirmation_tag. That would cover the case of a commit packet >> and doesn't >> >>>        even >> >>>>     grow the size of MLSPlaintext packets over the current design. >> >>>> >> >>>>     For a proposal packet we could also have a confirmation_tag but >> this one is >> >>>>     computed using the *current* epoch's confirmation_key and >> >>>        confirmed_transcript_hash. >> >>>> >> >>>>     _______________________________________________ >> >>>>     MLS mailing list >> >>>>     MLS@ietf.org > > > >> >>>>     https://www.ietf.org/mailman/listinfo/mls >> >>> >> >>>        _______________________________________________ >> >>>        MLS mailing list >> >>>        MLS@ietf.org > > > >> >>>        https://www.ietf.org/mailman/listinfo/mls >> > >> > From nobody Thu Aug 20 08:02:06 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D79503A0A97 for ; Thu, 20 Aug 2020 08:02:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.848 X-Spam-Level: X-Spam-Status: No, score=-2.848 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wickr-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nJGld0ZCbdQx for ; Thu, 20 Aug 2020 08:02:00 -0700 (PDT) Received: from mail-ej1-x62a.google.com (mail-ej1-x62a.google.com [IPv6:2a00:1450:4864:20::62a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 69C383A0A9D for ; Thu, 20 Aug 2020 08:02:00 -0700 (PDT) Received: by mail-ej1-x62a.google.com with SMTP id t10so2877165ejs.8 for ; Thu, 20 Aug 2020 08:02:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wickr-com.20150623.gappssmtp.com; s=20150623; h=subject:to:cc:references:from:autocrypt:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=mFodT7JPFT+C51brw7Zl729KBG48mOgTMjYbLU9SF5E=; b=sOOIig+v/5RaYn3dERoy8z2TihGJsfw/HIL9hMBz7Cek8PQdsNYvdqfY2wVfUUiUY1 rfE1BQUcHWK5wnQVn8YTQ1SDCxn2ch6SlPdii7DcQfzyZNUulnyRGjvU/klFIN9l/F3d 9DCnFogsAKwzNRs9K4ODhpyW+3jPcHPpN0p+LEg6qPnKJ/oYC0IXLgvgnavheMbFbpr5 PDr9jMou8viw3ise1S1KhXCxF5o6PC9aNMeXchniYHH2eJXyUSjOFRF3ZFGEvVucAV/q xL7ndMqbik5fpib8UM7JH3/w/BqCxO/7c7fG1DAvOGHVW5+ENRWJNJ2HtR2Yvfkye57M A0Kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:autocrypt :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=mFodT7JPFT+C51brw7Zl729KBG48mOgTMjYbLU9SF5E=; b=kyu3yZ221+Fih86nTnUOJhh8gn639PHpTsu91SAApfPDYa2G+/QDAdqnKrkbCUnT9s Elgro3mSMTmipfPZd3Uy4I9zaXfNVZdclek+6CeCTI93Fg+CykH/5TWQ9JUcF5HxbroV 8hV6xrGjFZV5wou/TTtxSabvJSE9SsM3wKK2gAMNYGa14CJJfzgMprqeITRV3wLbyFqR tz3cyH5rG6KUyK7rrGzAMJSB8EweXW/tv6CKN9Qv41SZ18iuJJm7DiorgYWhRcYT9Rad AQEk/FxR5ZLGSoW04v1RJlXsg5nwroFDB0+l+UEySG4VHE2C02Wc14BBHS5bhwZxoiRL AqvQ== X-Gm-Message-State: AOAM532bI7A5Yk/NIkzae7wDBt76dBQKZ3OIr8KfkJf41SGALQBfT0qN jNZRNYXCfgxsqIJidPppaTbgaP7lCIaHDw== X-Google-Smtp-Source: ABdhPJxhA/rQLHNc5jCbCg4bFB/0nCKFqbNTy9uLN/Y57TaVZZ95/2X0NC2LDLQxfbVK//ZuDQ9QKw== X-Received: by 2002:a17:906:5902:: with SMTP id h2mr3839127ejq.423.1597935718243; Thu, 20 Aug 2020 08:01:58 -0700 (PDT) Received: from [192.168.1.137] (84-114-27-5.cable.dynamic.surfer.at. [84.114.27.5]) by smtp.gmail.com with ESMTPSA id sd17sm1601749ejb.93.2020.08.20.08.01.56 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 20 Aug 2020 08:01:57 -0700 (PDT) To: Cornelissen Eric , Richard Barnes , Raphael Robert Cc: Messaging Layer Security WG References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <19861857231648008e6c280815c86546@aalto.fi> From: Joel Alwen Autocrypt: addr=jalwen@wickr.com; keydata= mQENBFyIZvABCAC65JupY1w7gzhhNo41ftIk09n7Lid9p31jDR8Jefv9R5sWL+HZFGDeABAY 1J1JvV6vOaMsfdy9iUFfGS1GhMJ3+mh799SIsB3JSfPq/eq6Jut57D2yPtILmc7ZbuJyBHg0 xuYfKCQQAYikW+v2LJQU1Y+BUDbVldpzxSc8Z3PPSfunWdzhY6qAAhyCv+Y8EzJlQivMwD5B f6737krf8SoBsjsqCHQrRo/r+BSj5Wtd5/K3FkmWLOUAFoYK23+cpoFntGJKZfss27gDPhyS gX9ibXcBGQqBEF4qDPEzEHK8iQmXTxLul5Y7lQ6ADf69xH15WM4GmRBeCvR3Uanxcr2/ABEB AAG0HUpvZWwgQWx3ZW4gPGphbHdlbkB3aWNrci5jb20+iQFUBBMBCAA+FiEEYFNg9IH2SV6e 03O3FR5tDZv8eygFAlyIZvICGwMFCQHhM4AFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQ FR5tDZv8eyjSywgApQNIRcL4IKTJ0I4XwcQRhICu1Bht3c2fUnG2YziJXjGf6DZ49uKKtuIu fk8mNS+vKRLoLZ7+u+Pv/Yjmk8jtrr6Saz1vnfsle3GgmXG5JaKOM5cOfeo5JnlNUP3QonR7 LMZwY1qVKg2mzNmwi0jG1zIGgQ5fiAwqe+YTNFli5bc/H1O9LcSmbrLV9OyucARq11DIiAvU fDknZ17OahQls+9mgfAXH5vZjzo296tYvzkOJQ2A6GPxdMHIXGbJM/vjuMe2QJl6C0zaqOtm JvFcx/HpNhmugYI9OsNAd7846HASDp8BKyfY5FYP7bn0/JBuCpg18Aykru6xyFjG3gv0Lw== Message-ID: Date: Thu, 20 Aug 2020 17:01:55 +0200 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: <19861857231648008e6c280815c86546@aalto.fi> Content-Type: text/plain; charset=windows-1252 Content-Language: en-US Content-Transfer-Encoding: 8bit Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 15:02:04 -0000 Hey Eric, What I think ur saying here is that an update proposal (MLSPLaintext) packets should be signed using the sig key contained in that packet's key package. Am I getting that right? This makes no difference for the forging of Add and Remove proposals so those attacks should still work as before. It might prevent forging updates but only if both: A) all updates proposals MUST update to new credentials and B) when leaking Alice's state I only obtained 1 valid credential of hers. But for that we'd have to mandate A) as thats not currently the case. I think would be a mistake though, at least in general. Fresh certs may be comparatively difficult to come by even for honest users. Yet that shouldn't stop them from updating their HPKE keys frequently. At best, maybe this could be a group specific policy? E.g. for deployments where fresh certs are very easy to come by (say, generated locally) so people could be expected to refresh their sig keys just as often as their HPKE keys. > Then again, I would be very much in favor of including something group-binding > in handshake messages as it would prevent some replay attacks (*) that I have > been considering for a while. Yup, this seems more like a complimentary solution. I'm curious about those replay attacks though! :-) If you're ready to tell us more I'm all ears... - Joël On 19/08/2020 10:17, Cornelissen Eric wrote: > I was wondering what the implications are of using the key advertised in an > update Proposal's KeyPackage for signing, instead of the long-term key pair, > just like new_memberexternal proposals > . > I'm confident it prevents the original weakness pointed out by Joël, but I'm > unsure as to whether or not it introduces any new problems. > > > Then again, I would be very much in favor of including something group-binding > in handshake messages as it would prevent some replay attacks (*) that I have > been considering for a while. > > > Regards, > > Eric > > > > (*): Replays from adversarially controlled groups where the attacker managed to > have the group id, epoch, and tree structure to match those of a target group. > > > > -------------------------------------------------------------------------------- > *From:* Richard Barnes > *Sent:* Tuesday, August 18, 2020 6:26 PM > *To:* Raphael Robert > *Cc:* Joel Alwen; Messaging Layer Security WG > *Subject:* Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric > key schedule >   > Thanks for pointing this out, Joël.  I agree that the attacks you're describing > should work as things are currently specified.  And they're salient, especially > the "replace Alice in the group" one. > > Also agree with Raphael is correct that Commit is not affected by this, since > someone who is not a member won't be able to generate the right confirmation > value.  However, I don't think this is actually the right design to adopt for a > general solution to this problem.  Confirmation verifies group membership > *after* processing the handshake message; the point here is that we should also > have a membership check *before* processing handshake messages.  In particular, > I would propose that we do need something additional on Commit messages as well > as Proposals. > > Thinking about solutions here, a couple of options come to mind: > > 1. Use MLSCiphertext, but with an integrity-only encapsulation > 2. Incorporate in the signature something that is only known to the group (e.g., > confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || > Proposal/Commit)) > > Option (1) has the appeal that you would only ever send MLSCiphertext, though > switching between encrypted/not could be problematic.  Option (2) seems a lot > more appealing: It doesn't add any overhead, since the group-secret value > doesn't need to be sent.  And we already switch between the signature context > that is added for group members vs. external.  In fact, I think option (2) would > just amount to a one-line change to include an extra, secret value in the > context at the top of the MLSPlaintextTBS struct. > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption > > > mls-protocol/draft-ietf-mls-protocol.md at master · mlswg/mls-protocol · GitHub > > github.com > MLS protocol. Contribute to mlswg/mls-protocol development by creating an > account on GitHub. > > > The only thing that seems odd about (2) is overloading signature verification in > that way, i.e., using the ability to generate a signature over a secret thing to > prove you know the secret thing.  That doesn't seem obviously flawed to me, but > worth thinking about. > > Does that make sense to folks? > > --Richard > > > On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > > wrote: > > Hi Joel, > > For context: this would only apply when applications use cleartext > MLSPlaintext for HS messages. The recommendation is still to encrypt them > and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS > messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I’m thinking that > they would be rejected because the attacker cannot compute the confirmation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I’d be interested to see what exactly you would propose as a mitigation > mechanism. > > Raphael > > > On 18 Aug 2020, at 16:36, Joel Alwen > wrote: > > > > Hey everyone, > > > > Something thats been bugging Marta Mularczyk and Daniel Jost and me for a bit > > now is that handshake messages sent out as MLSPlaintext packets are only > > authenticated using signatures, but not using the group's key schedule. For > > non-members that makes sense but for group members that's weaker than need be. > > > > Suppose Alice is in a group using signing key pair (spk, ssk). I corrupt > her to > > learn ssk. Now I loose access to her device again. Later she generates a fresh > > key package with her same spk but a new HPKE key for her leaf. She sends > out and > > update proposal for her new key package and someone commits to the update. > > > > Expected result: she (and the group at large) has achieved PCS again. > > > > Actual result: using her stolen ssk I can still forge a new proposal's > (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do with this > power: > > - I can generate a new key package kp for Alice using her spk and some > HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp. If it > gets > > committed I've effectively kicked her out of the group. > > - I could forge Add's and Remove's coming from Alice, so I could trick the > > group into thinking Alice is trying to Add my account to the group or remove > > some other group member. > > > > Lemme know if I've missed something here in that scenario... > > > > > > If I didn't miss anything and the attacks really work as advertised then IMO > > this is kinda weak sauce and worth avoiding if possible. So to that end, how > > about we modify MLS such that MLSPlaintext packets coming from group members > > must also be authenticated using something from the application key schedule. > > Now the above attacks fail. As soon as Alice's update is gets committed I no > > longer know the group's key schedule and so can't forged packet from > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts frameing in > > line with what we're getting from MLSCiphertext packets. > > > > Any thoughts? > > > > - Joël > > > > > > > > PS. For concreteness, we could probably extend the current mechanism for > getting > > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > > E.g. include most of the MLSPlaintext content into whats being tagged by > > confirmation_tag. That would cover the case of a commit packet and doesn't > even > > grow the size of MLSPlaintext packets over the current design. > > > > For a proposal packet we could also have a confirmation_tag but this one is > > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > From nobody Thu Aug 20 11:40:23 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9FC53A12C5 for ; Thu, 20 Aug 2020 11:40:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uxCSGQOs5BwY for ; Thu, 20 Aug 2020 11:40:20 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E7CF93A12C4 for ; Thu, 20 Aug 2020 11:40:18 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id 8F4E011590B_F3EC38EB for ; Thu, 20 Aug 2020 18:40:14 +0000 (GMT) Received: from exng3.org.aalto.fi (exng3.org.aalto.fi [130.233.223.22]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng3.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 67144115901_F3EC38EF for ; Thu, 20 Aug 2020 18:40:14 +0000 (GMT) Received: from exng6.org.aalto.fi (130.233.223.25) by exng3.org.aalto.fi (130.233.223.22) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 20 Aug 2020 21:40:14 +0300 Received: from [192.168.1.116] (130.233.0.5) by exng6.org.aalto.fi (130.233.223.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Thu, 20 Aug 2020 21:40:13 +0300 To: Messaging Layer Security WG From: Chris Brzuska Message-ID: <504ca35e-ca0a-47db-a861-774867c169b9@aalto.fi> Date: Thu, 20 Aug 2020 21:40:14 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="------------73C88BA9EDCDC5EE60A06117" Content-Language: en-GB X-Originating-IP: [130.233.0.5] X-ClientProxiedBy: exng3.org.aalto.fi (130.233.223.22) To exng6.org.aalto.fi (130.233.223.25) X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=to:from:subject:message-id:date:mime-version:content-type; s=its18; bh=GYUIi5yBm2npr93eHq77eltct6CXi/oNr7KGUy6q6eE=; b=KfHpsgJTZUYtZpvOaC1sQoMR/+MhCA4Z1VhZ1DI+DX8SElHRriIVF5+6zE3NE5FqxIAc01J1ahshHJJGY+QCqrtSCSg0YQJdqzalHZzhz4lB8hSc55AaFxZ/yRSDn2+hQ6d+ViW43cuUIZ9e2Pvaxdv2Jdz0ySc2ynjZxysR7cywnNX2XECsF11nkXzBV9yrwDifSPCxSgUkhsdDC5RPpDxnyBjty0gmzfIbEkS10x7AUDOV7RygbBJMbllnNTpSqz4+R0NKL3y+1izJ0JbP78NgDidvEZ5P3qrM+N0c9uThZGOlTbJ6rbQ2HvQzEC+rv+rMqkYb4Gr/SV3bjZ7CUQ== Archived-At: Subject: [MLS] Double-use of the same key X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 18:40:22 -0000 --------------73C88BA9EDCDC5EE60A06117 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 7bit Hey all, I realized that that path_secret is now used to key two different cryptographic primitives which violates key separation. Namely, the path_secret is used to key the two functions ExpandWithLabel and KEM.DeriveKeyPair. Downsides: * Violates the good crypto practice of key separation via HKDF.Expand which we use in other parts of MLS. * Moves MLS outside the scope of provable security, because crypto assumptions assume that a key is only used in one cryptographic primitive and not in two. Chris |path_secret[n] = ExpandWithLabel(path_secret[n-1], "path", "", KEM.Nsk) node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])| --------------73C88BA9EDCDC5EE60A06117 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: base64 PGh0bWw+DQogIDxoZWFkPg0KDQogICAgPG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBl IiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPg0KICA8L2hlYWQ+DQogIDxi b2R5Pg0KICAgIDxwPkhleSBhbGwsPC9wPg0KICAgIDxwPkkgcmVhbGl6ZWQgdGhhdCB0aGF0 IHBhdGhfc2VjcmV0IGlzIG5vdyB1c2VkIHRvIGtleSB0d28gZGlmZmVyZW50DQogICAgICBj cnlwdG9ncmFwaGljIHByaW1pdGl2ZXMgd2hpY2ggdmlvbGF0ZXMga2V5IHNlcGFyYXRpb24u IE5hbWVseSwNCiAgICAgIHRoZSBwYXRoX3NlY3JldCBpcyB1c2VkIHRvIGtleSB0aGUgdHdv IGZ1bmN0aW9ucyBFeHBhbmRXaXRoTGFiZWwNCiAgICAgIGFuZCBLRU0uRGVyaXZlS2V5UGFp ci48L3A+DQogICAgPHA+RG93bnNpZGVzOjwvcD4NCiAgICA8dWw+DQogICAgICA8bGk+Vmlv bGF0ZXMgdGhlIGdvb2QgY3J5cHRvIHByYWN0aWNlIG9mIGtleSBzZXBhcmF0aW9uIHZpYQ0K ICAgICAgICBIS0RGLkV4cGFuZCB3aGljaCB3ZSB1c2UgaW4gb3RoZXIgcGFydHMgb2YgTUxT Ljxicj4NCiAgICAgIDwvbGk+DQogICAgICA8bGk+TW92ZXMgTUxTIG91dHNpZGUgdGhlIHNj b3BlIG9mIHByb3ZhYmxlIHNlY3VyaXR5LCBiZWNhdXNlDQogICAgICAgIGNyeXB0byBhc3N1 bXB0aW9ucyBhc3N1bWUgdGhhdCBhIGtleSBpcyBvbmx5IHVzZWQgaW4gb25lDQogICAgICAg IGNyeXB0b2dyYXBoaWMgcHJpbWl0aXZlIGFuZCBub3QgaW4gdHdvLjxicj4NCiAgICAgIDwv bGk+DQogICAgPC91bD4NCiAgICBDaHJpcw0KICAgIDxwcmUgc3R5bGU9ImJveC1zaXppbmc6 IGJvcmRlci1ib3g7IGZvbnQtZmFtaWx5OiBTRk1vbm8tUmVndWxhciwgQ29uc29sYXMsICZx dW90O0xpYmVyYXRpb24gTW9ubyZxdW90OywgTWVubG8sIG1vbm9zcGFjZTsgZm9udC1zaXpl OiAxMy42cHg7IG1hcmdpbi10b3A6IDBweDsgbWFyZ2luLWJvdHRvbTogMTZweDsgb3ZlcmZs b3ctd3JhcDogbm9ybWFsOyBwYWRkaW5nOiAxNnB4OyBvdmVyZmxvdzogYXV0bzsgbGluZS1o ZWlnaHQ6IDEuNDU7IGJhY2tncm91bmQtY29sb3I6IHJnYigyNDYsIDI0OCwgMjUwKTsgYm9y ZGVyLXJhZGl1czogNnB4OyBjb2xvcjogcmdiKDM2LCA0MSwgNDYpOyBmb250LXN0eWxlOiBu b3JtYWw7IGZvbnQtdmFyaWFudC1saWdhdHVyZXM6IG5vcm1hbDsgZm9udC12YXJpYW50LWNh cHM6IG5vcm1hbDsgZm9udC13ZWlnaHQ6IDQwMDsgbGV0dGVyLXNwYWNpbmc6IG5vcm1hbDsg b3JwaGFuczogMjsgdGV4dC1hbGlnbjogc3RhcnQ7IHRleHQtaW5kZW50OiAwcHg7IHRleHQt dHJhbnNmb3JtOiBub25lOyB3aWRvd3M6IDI7IHdvcmQtc3BhY2luZzogMHB4OyAtd2Via2l0 LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7IHRleHQtZGVjb3JhdGlvbi1zdHlsZTogaW5pdGlh bDsgdGV4dC1kZWNvcmF0aW9uLWNvbG9yOiBpbml0aWFsOyI+PGNvZGUgc3R5bGU9ImJveC1z aXppbmc6IGJvcmRlci1ib3g7IGZvbnQtZmFtaWx5OiBTRk1vbm8tUmVndWxhciwgQ29uc29s YXMsICZxdW90O0xpYmVyYXRpb24gTW9ubyZxdW90OywgTWVubG8sIG1vbm9zcGFjZTsgZm9u dC1zaXplOiAxMy42cHg7IHBhZGRpbmc6IDBweDsgbWFyZ2luOiAwcHg7IGJhY2tncm91bmQ6 IGluaXRpYWw7IGJvcmRlci1yYWRpdXM6IDZweDsgd29yZC1icmVhazogbm9ybWFsOyB3aGl0 ZS1zcGFjZTogcHJlOyBib3JkZXI6IDBweDsgZGlzcGxheTogaW5saW5lOyBvdmVyZmxvdzog dmlzaWJsZTsgbGluZS1oZWlnaHQ6IGluaGVyaXQ7IG92ZXJmbG93LXdyYXA6IG5vcm1hbDsi PnBhdGhfc2VjcmV0W25dID0gRXhwYW5kV2l0aExhYmVsKHBhdGhfc2VjcmV0W24tMV0sDQog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJwYXRoIiwgIiIsIEtFTS5Oc2sp DQpub2RlX3ByaXZbbl0sIG5vZGVfcHViW25dID0gS0VNLkRlcml2ZUtleVBhaXIocGF0aF9z ZWNyZXRbbl0pPC9jb2RlPjwvcHJlPg0KICA8L2JvZHk+DQo8L2h0bWw+DQo= --------------73C88BA9EDCDC5EE60A06117-- From nobody Thu Aug 20 11:55:42 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 84A243A12D8 for ; Thu, 20 Aug 2020 11:55:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dQDS9Pt38Hk9 for ; Thu, 20 Aug 2020 11:55:34 -0700 (PDT) Received: from mail-qk1-x735.google.com (mail-qk1-x735.google.com [IPv6:2607:f8b0:4864:20::735]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 30F8E3A12D7 for ; Thu, 20 Aug 2020 11:55:34 -0700 (PDT) Received: by mail-qk1-x735.google.com with SMTP id b79so2444657qkg.9 for ; Thu, 20 Aug 2020 11:55:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=0YeE3oZ+I3N6a8iNtA77awMJM4z+UKMGHvXRvEz1GYw=; b=jT7bXd/FWCixmwvhTjjyATF+co3PtticB/HgZjATPUAk4e2NM9xtyq0YFSkJMkyJ6G Um4F+1TEeamwYY2NQUgAZAP9oy5ComJA9VaBsIozybMvQGPhDvOD1lZXHfpii7OCaaqi XEDVTO6YP6PDOY5TdQEV7AvHFqMm4qWXJTCzPJSJ6mNBQ3tjWpL/Md1t/UEe0R4P0Nt6 nvf0j6kHbehk8csU/irTIO9jbKwZYPhaasitfacMhZUQh1uOKnook8ZUf4k36T12mONO vCQQQOn6lR0F1FcppFQPqB5Ts6uHRjcq7WrBBx9IPcQ5eA2kCQmmRAIBHor30/wGl8ZK owww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=0YeE3oZ+I3N6a8iNtA77awMJM4z+UKMGHvXRvEz1GYw=; b=uWKnV1lc9r7dgt+vcdLOzlJhcdB7ptAYiHs6ic6fdtVmLZU9CtshsmLMqw3kRP76wJ bYORIDFCe2tob2VIORo7HvtQnhsoBIs66HedUtOp/fYTy3UpE6efG208vtL4jcfS+fAp /pme05Wp0663PoVgzby2BNsZ5vAkVesTkZ5UKZq4pTJV9qRacTIHe2RWSoV0CJa5uFAM dYfIvokLE1YZNCQDWEjcARIzFjbMfbvZbfJqAxC68B3wkBxvFyFdHLmmLptyWlJBSEqn S5oTFs+Mi06TeEHzrMm7+VcMMJZoubzEbiJdgQAHRPAXYjy3+/AJJBmvUm/3NXL2nih2 RnnQ== X-Gm-Message-State: AOAM530sX8NaQtd735bKzK5N6EDDXVw57G3WC/AmiuW72tLD6aKUFera t73W6fzWADSF5NirQOZy9xrFTn77V4rzfMxaOBGFkA== X-Google-Smtp-Source: ABdhPJyGT3KIcIdctmSMgWq40xPE3NQkkhWkpjhKzf8aztN1QJi0o5qQUOZDocwBefFqSWv/C90QZC7/n9oyji1V4DA= X-Received: by 2002:a05:620a:125b:: with SMTP id a27mr3923340qkl.371.1597949733084; Thu, 20 Aug 2020 11:55:33 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> <1bd2268c-7f27-e24a-bcd7-3192afae13c9@wickr.com> In-Reply-To: <1bd2268c-7f27-e24a-bcd7-3192afae13c9@wickr.com> From: Richard Barnes Date: Thu, 20 Aug 2020 14:55:11 -0400 Message-ID: To: Joel Alwen Cc: Raphael Robert , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="00000000000035c17d05ad53aaa9" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 18:55:39 -0000 --00000000000035c17d05ad53aaa9 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Aug 20, 2020 at 10:20 AM Joel Alwen wrote: > Yeah, good point. While I'm not sure every case of server inspection woul= d > require checking sigs on packets I am sure it would be useful for some > cases. > > > The obvious fix is to include the membership_token in MLSPlaintext as > well. > > Yup, I'm all for it. (Or at least for making it an optional field in that > struct.) > The PR has been updated. There is now a member_token field before the signature, which non-member senders set to zero length. https://github.com/mlswg/mls-protocol/pull/396/files Note that this allows the server to verify the signature, but the membership_token is opaque to it; the server can't authenticate the sender's membership. --Richard > > - Jo=C3=ABl > > On 19/08/2020 09:24, Raphael Robert wrote: > > I thought about this some more and now I=E2=80=99m not sure that the > membership_token > > should only be implicit: > > > > The whole reason for HS messages to not be encrypted is that they can b= e > > inspected along the way by an external party (e.g. the Delivery > Service). If > > this is not a requirement, MLSCiphertext should really be used instead. > > Hiding the membership_token from external inspector means the inspector > can not > > verify the signature anymore. I think that defies the point of HS > messages being > > inspectable. > > > > The obvious fix is to include the membership_token in MLSPlaintext as > well. > > > > Raphael > > > >> On 18 Aug 2020, at 21:01, Richard Barnes > > wrote: > >> > >> Here ya go: https://github.com/mlswg/mls-protocol/pull/396 > >> > >> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen >> > wrote: > >> > >> > Jo=C3=ABl, do you want to write a PR? If not, I could probably = get to > it in the > >> > next couple days. > >> > >> Thanks. :-) If you could that would be really nice. > >> > >> - Jo=C3=ABl > >> > >> On 18/08/2020 19:20, Richard Barnes wrote: > >> > Sounds like we're converging here. The only question in my mind > is what > >> goes in > >> > the MAC -- seems like the easy option is probably "the remainder > of the > >> > MLSPlaintextTBS", i.e., everything from group_id to the end. > That seems > >> like it > >> > minimizes multiple serialization: > >> > > >> > tbs_content =3D serialize(group_id, ...) > >> > membership_token =3D KDF.Extract(confirmation_key, tbs_content) > >> > tbs =3D group_context || membership_token || tbs_content > >> > > >> > So the PR would be to basically pop the context off of > MLSPlaintextTBS > >> and add > >> > the three lines above (with the switch for internal/external in > prose). > >> > > >> > Jo=C3=ABl, do you want to write a PR? If not, I could probably = get to > it in > >> the next > >> > couple days. > >> > > >> > --Richard > >> > > >> > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert >> > >> > >> wrote: > >> > > >> > I think what you just described is indeed a combination of > option 1 & 2. > >> > It=E2=80=99s a MAC over the payload we want to authenticate,= but it=E2=80=99s > >> implicit and > >> > we only include it in the MLSPlaintextTBS. Or in other words= , > we > >> stripped it > >> > from MLSPlaintext because it is implicitly known to any vali= d > member > >> of the > >> > group. > >> > > >> > Raphael > >> > > >> >> On 18 Aug 2020, at 18:16, Joel Alwen >> > >> >> >> wrote: > >> >> > >> >> Yeah, I like Option 2 here. I like that it avoids growing > packet size. > >> >> > >> >> One caveat though: I'd go for the MAC(...) version rather > than the > >> >> confirmation_key. For starters thing including > confirmation_key doesnt > >> >> authenticate the contents of the packet. But even if it did= , > >> signatures aren't > >> >> meant to hide the contents of what was signed. (Amend you > favorite sig > >> >> scheme to > >> >> tack on the message at the end a signature and you've still > got a > >> secure > >> >> signature scheme. But clearly not a message hiding one.) > That means > >> that AFAIK > >> >> neither ECDSA nor EdDSA etc. were designed or analyzed for > such a > >> property. So > >> >> this would amount to a very non-standard use of a signature > schemes by > >> >> MLS. Not > >> >> saying it doesn't work for the particular sig schemes in ou= r > >> ciphersuite. But > >> >> its def. not how signatures are "meant" to be used. > >> >> > >> >> But that leaves Option 2 with, say, including tag =3D > MAC(conf_key, > >> >> conf_trans_hash || MLSPlaintext.content) into whats being > signed > >> which I like > >> >> and think gets the job done. Both conf_* values are taken > from the > >> current > >> >> epoch. By MLSPlaintext.content I mean whats now called > MLSPlaintextTBS. > >> >> > >> >>> I would propose that we do need something additional on > Commit > >> messages as > >> >>> well as Proposals. > >> >> > >> >> @Richard: For Proopsals I think this works. Is that about > what you > >> had in mind > >> >> for commits too? > >> >> > >> >> - Jo=C3=ABl > >> >> > >> >> > >> >> On 18/08/2020 17:26, Richard Barnes wrote: > >> >>> Thanks for pointing this out, Jo=C3=ABl. I agree that the > attacks you're > >> >>> describing > >> >>> should work as things are currently specified. And they'r= e > salient, > >> >>> especially > >> >>> the "replace Alice in the group" one. > >> >>> > >> >>> Also agree with Raphael is correct that Commit is not > affected by > >> this, since > >> >>> someone who is not a member won't be able to generate the > right > >> confirmation > >> >>> value. However, I don't think this is actually the right > design > >> to adopt > >> >>> for a > >> >>> general solution to this problem. Confirmation verifies > group > >> membership > >> >>> *after* processing the handshake message; the point here i= s > that we > >> >>> should also > >> >>> have a membership check *before* processing handshake > messages. In > >> >>> particular, > >> >>> I would propose that we do need something additional on > Commit > >> messages > >> >>> as well > >> >>> as Proposals. > >> >>> > >> >>> Thinking about solutions here, a couple of options come to > mind: > >> >>> > >> >>> 1. Use MLSCiphertext, but with an integrity-only > encapsulation > >> >>> 2. Incorporate in the signature something that is only > known to > >> the group > >> >>> (e.g., > >> >>> confirmation_key or MAC(confirmation_key; > confirmed_transcript_hash || > >> >>> Proposal/Commit)) > >> >>> > >> >>> Option (1) has the appeal that you would only ever send > >> MLSCiphertext, though > >> >>> switching between encrypted/not could be problematic. > Option (2) > >> seems a lot > >> >>> more appealing: It doesn't add any overhead, since the > >> group-secret value > >> >>> doesn't need to be sent. And we already switch between th= e > >> signature context > >> >>> that is added for group members vs. external. In fact, I > think option > >> >>> (2) would > >> >>> just amount to a one-line change to include an extra, > secret value > >> in the > >> >>> context at the top of the MLSPlaintextTBS struct. > >> >>> > >> > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol= .md#content-signing-and-encryption > >> >>> > >> >>> The only thing that seems odd about (2) is overloading > signature > >> >>> verification in > >> >>> that way, i.e., using the ability to generate a signature > over a > >> secret > >> >>> thing to > >> >>> prove you know the secret thing. That doesn't seem > obviously > >> flawed to > >> >>> me, but > >> >>> worth thinking about. > >> >>> > >> >>> Does that make sense to folks? > >> >>> > >> >>> --Richard > >> >>> > >> >>> > >> >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > >> >>> 40wire.com@dmarc.ietf.org> > >> >>> =3D40wire.com@dmarc.ietf.o= rg > >> > 40wire.com@dmarc.ietf.org > >> >> > >> >>> wrote: > >> >>> > >> >>> Hi Joel, > >> >>> > >> >>> For context: this would only apply when applications us= e > cleartext > >> >>> MLSPlaintext for HS messages. The recommendation is > still to > >> encrypt them > >> >>> and send them around as MLSCiphertext. > >> >>> That being said, we said we would like to support > scenarios > >> where HS > >> >>> messages are not necessarily encrypted. > >> >>> > >> >>> Question: would this attack work with Commit messages? > I=E2=80=99m > >> thinking that > >> >>> they would be rejected because the attacker cannot > compute the > >> >>> confirmation_tag. > >> >>> > >> >>> As you mention in the PS, the easy target would be > Proposal > >> messages. > >> >>> > >> >>> I=E2=80=99d be interested to see what exactly you would= propose > as a > >> mitigation > >> >>> mechanism. > >> >>> > >> >>> Raphael > >> >>> > >> >>>> On 18 Aug 2020, at 16:36, Joel Alwen >> > >> >>>> > > >> >>> >> > wrote: > >> >>>> > >> >>>> Hey everyone, > >> >>>> > >> >>>> Something thats been bugging Marta Mularczyk and Daniel > Jost and > >> me for > >> >>>> a bit > >> >>>> now is that handshake messages sent out as MLSPlaintext > packets > >> are only > >> >>>> authenticated using signatures, but not using the group's > key > >> schedule. For > >> >>>> non-members that makes sense but for group members that's > weaker than > >> >>>> need be. > >> >>>> > >> >>>> Suppose Alice is in a group using signing key pair (spk, > ssk). I > >> corrupt > >> >>> her to > >> >>>> learn ssk. Now I loose access to her device again. Later > she > >> generates a > >> >>>> fresh > >> >>>> key package with her same spk but a new HPKE key for her > leaf. > >> She sends > >> >>> out and > >> >>>> update proposal for her new key package and someone > commits to > >> the update. > >> >>>> > >> >>>> Expected result: she (and the group at large) has achieve= d > PCS again. > >> >>>> > >> >>>> Actual result: using her stolen ssk I can still forge a n= ew > >> proposal's > >> >>> (sent as > >> >>>> MLSPlaintext packets) coming from Alice. Some things I > could do > >> with this > >> >>> power: > >> >>>> - I can generate a new key package kp for Alice using her > spk and > >> some > >> >>> HPKE key > >> >>>> she doesn't know. Then I forge an update proposal for > Alice with > >> kp. If it > >> >>> gets > >> >>>> committed I've effectively kicked her out of the group. > >> >>>> - I could forge Add's and Remove's coming from Alice, so = I > could > >> trick the > >> >>>> group into thinking Alice is trying to Add my account to > the > >> group or remove > >> >>>> some other group member. > >> >>>> > >> >>>> Lemme know if I've missed something here in that > scenario... > >> >>>> > >> >>>> > >> >>>> If I didn't miss anything and the attacks really work as > >> advertised then IMO > >> >>>> this is kinda weak sauce and worth avoiding if possible. > So to > >> that end, how > >> >>>> about we modify MLS such that MLSPlaintext packets coming > from > >> group members > >> >>>> must also be authenticated using something from the > application key > >> >>>> schedule. > >> >>>> Now the above attacks fail. As soon as Alice's update is > gets > >> committed I no > >> >>>> longer know the group's key schedule and so can't forged > packet from > >> >>> Alice. More > >> >>>> generally, this brings the PCS guarantees when using > MLSPlaintexts > >> >>>> frameing in > >> >>>> line with what we're getting from MLSCiphertext packets. > >> >>>> > >> >>>> Any thoughts? > >> >>>> > >> >>>> - Jo=C3=ABl > >> >>>> > >> >>>> > >> >>>> > >> >>>> PS. For concreteness, we could probably extend the curren= t > >> mechanism for > >> >>> getting > >> >>>> concistancy (the confirmation_tag) to also provide > symmetric key > >> >>> authentication. > >> >>>> E.g. include most of the MLSPlaintext content into whats > being > >> tagged by > >> >>>> confirmation_tag. That would cover the case of a commit > packet > >> and doesn't > >> >>> even > >> >>>> grow the size of MLSPlaintext packets over the current > design. > >> >>>> > >> >>>> For a proposal packet we could also have a > confirmation_tag but > >> this one is > >> >>>> computed using the *current* epoch's confirmation_key and > >> >>> confirmed_transcript_hash. > >> >>>> > >> >>>> _______________________________________________ > >> >>>> MLS mailing list > >> >>>> MLS@ietf.org >> > > > >> >>>> https://www.ietf.org/mailman/listinfo/mls > >> >>> > >> >>> _______________________________________________ > >> >>> MLS mailing list > >> >>> MLS@ietf.org >> > > > >> >>> https://www.ietf.org/mailman/listinfo/mls > >> > > >> > > > --00000000000035c17d05ad53aaa9 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
On Thu, Aug 20, 2020 at 10:20 AM Joel Alw= en <jalwen@wickr.com> wrote:<= br>
Yeah, good point. While I'm not sure every case of server in= spection would
require checking sigs on packets I am sure it would be useful for some case= s.

> The obvious fix is to include the membership_token in MLSPlaintext as = well.

Yup, I'm all for it. (Or at least for making it an optional field in th= at struct.)

The PR has been updated.=C2= =A0 There is now a member_token field before the signature, which non-membe= r senders set to zero length.


Note that this allows t= he server to verify the signature, but the membership_token is opaque to it= ; the server can't authenticate the sender's membership.
=
--Richard=C2=A0
=C2=A0

- Jo=C3=ABl

On 19/08/2020 09:24, Raphael Robert wrote:
> I thought about this some more and now I=E2=80=99m not sure that the m= embership_token
> should only be implicit:
>
> The whole reason for HS messages to not be encrypted is that they can = be
> inspected along the way by an external party (e.g. the Delivery Servic= e). If
> this is not a requirement, MLSCiphertext should really be used instead= .
> Hiding the membership_token from external inspector means the inspecto= r can not
> verify the signature anymore. I think that defies the point of HS mess= ages being
> inspectable.
>
> The obvious fix is to include the membership_token in MLSPlaintext as = well.
>
> Raphael
>
>> On 18 Aug 2020, at 21:01, Richard Barnes <rlb@ipv.sx <mailto= :rlb@ipv.sx>> wro= te:
>>
>> Here ya go: https://github.com/mlswg/mls-prot= ocol/pull/396
>>
>> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen <jalwen@wickr.com
>> <mailto:j= alwen@wickr.com>> wrote:
>>
>>=C2=A0 =C2=A0 =C2=A0> Jo=C3=ABl, do you want to write a PR?=C2= =A0 If not, I could probably get to it in the
>>=C2=A0 =C2=A0 =C2=A0> next couple days.
>>
>>=C2=A0 =C2=A0 =C2=A0Thanks. :-) If you could that would be really n= ice.
>>
>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>
>>=C2=A0 =C2=A0 =C2=A0On 18/08/2020 19:20, Richard Barnes wrote:
>>=C2=A0 =C2=A0 =C2=A0> Sounds like we're converging here.=C2= =A0 The only question in my mind is what
>>=C2=A0 =C2=A0 =C2=A0goes in
>>=C2=A0 =C2=A0 =C2=A0> the MAC -- seems like the easy option is p= robably "the remainder of the
>>=C2=A0 =C2=A0 =C2=A0> MLSPlaintextTBS", i.e., everything fr= om group_id to the end.=C2=A0 That seems
>>=C2=A0 =C2=A0 =C2=A0like it
>>=C2=A0 =C2=A0 =C2=A0> minimizes multiple serialization:
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> tbs_content =3D serialize(group_id, ...) >>=C2=A0 =C2=A0 =C2=A0> membership_token =3D KDF.Extract(confirmat= ion_key, tbs_content)
>>=C2=A0 =C2=A0 =C2=A0> tbs =3D group_context || membership_token = || tbs_content
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> So the PR would be to basically pop the co= ntext off of MLSPlaintextTBS
>>=C2=A0 =C2=A0 =C2=A0and add
>>=C2=A0 =C2=A0 =C2=A0> the three lines above (with the switch for= internal/external in prose).
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> Jo=C3=ABl, do you want to write a PR?=C2= =A0 If not, I could probably get to it in
>>=C2=A0 =C2=A0 =C2=A0the next
>>=C2=A0 =C2=A0 =C2=A0> couple days.
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> --Richard
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> On Tue, Aug 18, 2020 at 12:24 PM Raphael R= obert <raphael@wir= e.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:raphael@wire.com>
>>=C2=A0 =C2=A0 =C2=A0> <mailto:raphael@wire.com <mailto:raphael@wire.com>>> wrote: >>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0I think what you just d= escribed is indeed a combination of option 1 & 2.
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0It=E2=80=99s a MAC over= the payload we want to authenticate, but it=E2=80=99s
>>=C2=A0 =C2=A0 =C2=A0implicit and
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0we only include it in t= he MLSPlaintextTBS. Or in other words, we
>>=C2=A0 =C2=A0 =C2=A0stripped it
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0from MLSPlaintext becau= se it is implicitly known to any valid member
>>=C2=A0 =C2=A0 =C2=A0of the
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0group.
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0Raphael
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2020, at = 18:16, Joel Alwen <jalwen@wickr.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com <mai= lto:jalwen@wickr.com<= /a>>>> wrote:
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0Yeah, I like Option= 2 here. I like that it avoids growing packet size.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0One caveat though: = I'd go for the MAC(...) version rather than the
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0confirmation_key. F= or starters thing including confirmation_key doesnt
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0authenticate the co= ntents of the packet. But even if it did,
>>=C2=A0 =C2=A0 =C2=A0signatures aren't
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0meant to hide the c= ontents of what was signed. (Amend you favorite sig
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0scheme to
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0tack on the message= at the end a signature and you've still got a
>>=C2=A0 =C2=A0 =C2=A0secure
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0signature scheme. B= ut clearly not a message hiding one.) That means
>>=C2=A0 =C2=A0 =C2=A0that AFAIK
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0neither ECDSA nor E= dDSA etc. were designed or analyzed for such a
>>=C2=A0 =C2=A0 =C2=A0property. So
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0this would amount t= o a very non-standard use of a signature schemes by
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0MLS. Not
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0saying it doesn'= ;t work for the particular sig schemes in our
>>=C2=A0 =C2=A0 =C2=A0ciphersuite. But
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0its def. not how si= gnatures are "meant" to be used.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0But that leaves Opt= ion 2 with, say, including tag =3D MAC(conf_key,
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0conf_trans_hash || = MLSPlaintext.content) into whats being signed
>>=C2=A0 =C2=A0 =C2=A0which I like
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0and think gets the = job done. Both conf_* values are taken from the
>>=C2=A0 =C2=A0 =C2=A0current
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0epoch. By MLSPlaint= ext.content I mean whats now called MLSPlaintextTBS.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0I would propose= that we do need something additional on Commit
>>=C2=A0 =C2=A0 =C2=A0messages as
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0well as Proposa= ls.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0@Richard: For Proop= sals I think this works. Is that about what you
>>=C2=A0 =C2=A0 =C2=A0had in mind
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0for commits too? >>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0On 18/08/2020 17:26= , Richard Barnes wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Thanks for poin= ting this out, Jo=C3=ABl.=C2=A0 I agree that the attacks you're
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0describing
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0should work as = things are currently specified.=C2=A0 And they're salient,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0especially
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0the "repla= ce Alice in the group" one.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Also agree with= Raphael is correct that Commit is not affected by
>>=C2=A0 =C2=A0 =C2=A0this, since
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0someone who is = not a member won't be able to generate the right
>>=C2=A0 =C2=A0 =C2=A0confirmation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0value.=C2=A0 Ho= wever, I don't think this is actually the right design
>>=C2=A0 =C2=A0 =C2=A0to adopt
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0for a
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0general solutio= n to this problem.=C2=A0 Confirmation verifies group
>>=C2=A0 =C2=A0 =C2=A0membership
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0*after* process= ing the handshake message; the point here is that we
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0should also
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0have a membersh= ip check *before* processing handshake messages.=C2=A0 In
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0particular,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0I would propose= that we do need something additional on Commit
>>=C2=A0 =C2=A0 =C2=A0messages
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0as well
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0as Proposals. >>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Thinking about = solutions here, a couple of options come to mind:
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A01. Use MLSCiphe= rtext, but with an integrity-only encapsulation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A02. Incorporate = in the signature something that is only known to
>>=C2=A0 =C2=A0 =C2=A0the group
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0(e.g.,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0confirmation_ke= y or MAC(confirmation_key; confirmed_transcript_hash ||
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Proposal/Commit= ))
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Option (1) has = the appeal that you would only ever send
>>=C2=A0 =C2=A0 =C2=A0MLSCiphertext, though
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0switching betwe= en encrypted/not could be problematic.=C2=A0 Option (2)
>>=C2=A0 =C2=A0 =C2=A0seems a lot
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0more appealing:= It doesn't add any overhead, since the
>>=C2=A0 =C2=A0 =C2=A0group-secret value
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0doesn't nee= d to be sent.=C2=A0 And we already switch between the
>>=C2=A0 =C2=A0 =C2=A0signature context
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0that is added f= or group members vs. external.=C2=A0 In fact, I think option
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0(2) would
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0just amount to = a one-line change to include an extra, secret value
>>=C2=A0 =C2=A0 =C2=A0in the
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0context at the = top of the MLSPlaintextTBS struct.
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0
>>=C2=A0 =C2=A0 =C2=A0=C2=A0https://github.com/mlswg/mls-proto= col/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0The only thing = that seems odd about (2) is overloading signature
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0verification in=
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0that way, i.e.,= using the ability to generate a signature over a
>>=C2=A0 =C2=A0 =C2=A0secret
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0thing to
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0prove you know = the secret thing.=C2=A0 That doesn't seem obviously
>>=C2=A0 =C2=A0 =C2=A0flawed to
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0me, but
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0worth thinking = about.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Does that make = sense to folks?
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0--Richard
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0On Tue, Aug 18,= 2020 at 10:55 AM Raphael Robert
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0<raphael=3D<= a href=3D"mailto:40wire.com@dmarc.ietf.org" target=3D"_blank">40wire.com@dm= arc.ietf.org <mailto:40wire.com@dmarc.ietf.org>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0<mailto:raphael <mailto:raphael>=3D40wire.com@dmarc.ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:40wire.com@dmarc.ietf.org>>=C2=A0<m= ailto:40wire= .com@dmarc.ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:40wire.com@dmarc.ietf.org>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Hi Joel,
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0For context: this would only apply when applications use cleartext
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLSPlaintext for HS messages. The recommendation is still to
>>=C2=A0 =C2=A0 =C2=A0encrypt them
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0and send them around as MLSCiphertext.
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0That being said, we said we would like to support scenarios
>>=C2=A0 =C2=A0 =C2=A0where HS
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0messages are not necessarily encrypted.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Question: would this attack work with Commit messages? I=E2=80=99m
>>=C2=A0 =C2=A0 =C2=A0thinking that
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0they would be rejected because the attacker cannot compute the
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0confirmation_ta= g.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0As you mention in the PS, the easy target would be Proposal
>>=C2=A0 =C2=A0 =C2=A0messages.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0I=E2=80=99d be interested to see what exactly you would propose as a
>>=C2=A0 =C2=A0 =C2=A0mitigation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0mechanism.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Raphael
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2= 020, at 16:36, Joel Alwen <jalwen@wickr.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0<mailto:= jalwen@wickr.com = <mailto:jalwen@wic= kr.com>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0<mailto:jalwen@= wickr.com <mailto:jalwen@wickr.com>>> wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Hey everyon= e,
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Something t= hats been bugging Marta Mularczyk and Daniel Jost and
>>=C2=A0 =C2=A0 =C2=A0me for
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0a bit
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0now is that= handshake messages sent out as MLSPlaintext packets
>>=C2=A0 =C2=A0 =C2=A0are only
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0authenticat= ed using signatures, but not using the group's key
>>=C2=A0 =C2=A0 =C2=A0schedule. For
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0non-members= that makes sense but for group members that's weaker than
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0need be. >>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Suppose Ali= ce is in a group using signing key pair (spk, ssk). I
>>=C2=A0 =C2=A0 =C2=A0corrupt
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0her to
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0learn ssk. = Now I loose access to her device again. Later she
>>=C2=A0 =C2=A0 =C2=A0generates a
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0fresh
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0key package= with her same spk but a new HPKE key for her leaf.
>>=C2=A0 =C2=A0 =C2=A0She sends
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0out and
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0update prop= osal for her new key package and someone commits to
>>=C2=A0 =C2=A0 =C2=A0the update.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Expected re= sult: she (and the group at large) has achieved PCS again.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Actual resu= lt: using her stolen ssk I can still forge a new
>>=C2=A0 =C2=A0 =C2=A0proposal's
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0(sent as
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLSPlaintex= t packets) coming from Alice. Some things I could do
>>=C2=A0 =C2=A0 =C2=A0with this
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0power:
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- I can gen= erate a new key package kp for Alice using her spk and
>>=C2=A0 =C2=A0 =C2=A0some
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0HPKE key
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0she doesn&#= 39;t know. Then I forge an update proposal for Alice with
>>=C2=A0 =C2=A0 =C2=A0kp. If it
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0gets
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0committed I= 've effectively kicked her out of the group.
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- I could f= orge Add's and Remove's coming from Alice, so I could
>>=C2=A0 =C2=A0 =C2=A0trick the
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0group into = thinking Alice is trying to Add my account to the
>>=C2=A0 =C2=A0 =C2=A0group or remove
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0some other = group member.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Lemme know = if I've missed something here in that scenario...
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0If I didn&#= 39;t miss anything and the attacks really work as
>>=C2=A0 =C2=A0 =C2=A0advertised then IMO
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0this is kin= da weak sauce and worth avoiding if possible. So to
>>=C2=A0 =C2=A0 =C2=A0that end, how
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0about we mo= dify MLS such that MLSPlaintext packets coming from
>>=C2=A0 =C2=A0 =C2=A0group members
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0must also b= e authenticated using something from the application key
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0schedule. >>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Now the abo= ve attacks fail. As soon as Alice's update is gets
>>=C2=A0 =C2=A0 =C2=A0committed I no
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0longer know= the group's key schedule and so can't forged packet from
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Alice. More
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0generally, = this brings the PCS guarantees when using MLSPlaintexts
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0frameing in=
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0line with w= hat we're getting from MLSCiphertext packets.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Any thought= s?
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl=
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0PS. For con= creteness, we could probably extend the current
>>=C2=A0 =C2=A0 =C2=A0mechanism for
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0getting
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0concistancy= (the confirmation_tag) to also provide symmetric key
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0authentication.
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0E.g. includ= e most of the MLSPlaintext content into whats being
>>=C2=A0 =C2=A0 =C2=A0tagged by
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0confirmatio= n_tag. That would cover the case of a commit packet
>>=C2=A0 =C2=A0 =C2=A0and doesn't
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0even
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0grow the si= ze of MLSPlaintext packets over the current design.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0For a propo= sal packet we could also have a confirmation_tag but
>>=C2=A0 =C2=A0 =C2=A0this one is
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0computed us= ing the *current* epoch's confirmation_key and
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0confirmed_transcript_hash.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0___________= ____________________________________
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLS mailing= list
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org> <mailto:= MLS@ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:MLS@ietf.org>>=C2=A0<mailto:MLS@ietf.org <mailto:MLS@ietf.org>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/listinfo/mls
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0_______________________________________________
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLS mailing list
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLS@ietf.org <m= ailto:MLS@ietf.org>= ; <mailto:MLS@ietf.org=
>>=C2=A0 =C2=A0 =C2=A0<mailto:MLS@ietf.org>>=C2=A0<mailto:MLS@ietf.org <mailto:MLS@ietf.org>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0https://www.ietf.org/mailman/listinfo/mls
>>=C2=A0 =C2=A0 =C2=A0>
>>
>
--00000000000035c17d05ad53aaa9-- From nobody Thu Aug 20 11:58:33 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E7D893A12D7 for ; Thu, 20 Aug 2020 11:58:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.139 X-Spam-Level: X-Spam-Status: No, score=0.139 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, LONGWORDS=2.035, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nmksEHmA393n for ; Thu, 20 Aug 2020 11:58:31 -0700 (PDT) Received: from mail-qk1-x72f.google.com (mail-qk1-x72f.google.com [IPv6:2607:f8b0:4864:20::72f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2741D3A12D6 for ; Thu, 20 Aug 2020 11:58:31 -0700 (PDT) Received: by mail-qk1-x72f.google.com with SMTP id g26so2474226qka.3 for ; Thu, 20 Aug 2020 11:58:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=shJLwOHWvG3hoE8hISnuz7VE9KNM/pGH3TfGXbL86mI=; b=k+ShY70BmP/boELkoydgTUmfZsgT9B0iUFbThb93ZU7dSC8V7TvjObhxMIeRDmClRN aNuCJ3hNpD9a805a+bGV4sUQoMyLYgf+FAelb4HZOW1S0QNSOF8lNA5b9e8r+AI2vHib oT3+dWpwl9EJSVG8B1/OYgH8WctKDjb9zuIwj48sixgat7qEsnnz70FDn6ntinxZRp20 sK3GSlrzQjLTZzP3icq9xm1zhhUc7g9JpLfhx5jRQHRUaXiJ4fXcbG0oyByeRkX4fd2z OvM3k2JtoNYDzaFU11ueUbmXCvaaLjDc/0MRVPWokfOZgLcVzm3KAqr7pqt2B3waW77o ly4w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=shJLwOHWvG3hoE8hISnuz7VE9KNM/pGH3TfGXbL86mI=; b=LdtK70MDZXHcWGJRu1x88VPXcADYWyAceQUyA1JE+RIJL9YzElEtnVIwWZrB/gX8Ah SVsYOUIv4ioNN6vsJRzaJyFazEinJjnC0k3ENcqG7S9asf4c4HPoge7OlsWes/r5QkIq G8ecGLqG1EeMxuneeRc15wXoWujFXol56wgOR42cP8s9k+H/ADsVXwPu8Uxe8XXZuegG IcsoA83GUBrv1BNSdBQqVzyT6/PRc/IwPTkbUvpbaBBikrxKVEgZw6cAgzac+FIHMv8c d8QAYYWWs/A+mshV2TCnoqSm1oaC6ofu0008qDpNyO8ijMB77ajwVTgHW1A9ZtiqPaVS QTXw== X-Gm-Message-State: AOAM530nqyk+dsvkO0SfrOCnMVBcvtnbN0Qab1WjZfraZ33XEiG/MKHY gNxk6/SEEB1rcsYaCfk04JWUi4aYa13JKtAKxQh6/4PLo3Oz3n6n X-Google-Smtp-Source: ABdhPJzVw1Fzvd8s0ma7uE6XrUSDZBhDQRVHO1QXn0T/iJtSkIIRkKnp73nlTqRbdZ+Q2yD1wVs+UHixDEKmBI1L914= X-Received: by 2002:a37:99c7:: with SMTP id b190mr3863090qke.347.1597949909834; Thu, 20 Aug 2020 11:58:29 -0700 (PDT) MIME-Version: 1.0 References: <202008201351.07KDp5db018195@easychair.org> In-Reply-To: <202008201351.07KDp5db018195@easychair.org> From: Richard Barnes Date: Thu, 20 Aug 2020 14:58:09 -0400 Message-ID: To: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000bea89c05ad53b432" Archived-At: Subject: [MLS] Fwd: SSR 2020 Paper Submission Extended Deadline: 31 August 2020 X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 18:58:33 -0000 --000000000000bea89c05ad53b432 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable FYI, the deadline for the Security Standardisation Research Conference has been extended to August 31. ---------- Forwarded message --------- From: SSR 2020 Date: Thu, Aug 20, 2020 at 9:51 AM Subject: SSR 2020 Paper Submission Extended Deadline: 31 August 2020 To: Richard Barnes =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ***SSR 2020 (Virtual Conference) The 6th Security Standardisation Research Conference https://ssr2020.mozilla.org/ =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ***Important Dates: Paper Deadline (Extended): 31 Aug 2020 Notification: 1 Oct 2020 Camera Ready: 12 Oct 2020 Conference: 30 November 2020 - 1 December 2020 Submissions page: https://easychair.org/account/signin?l=3DgUlMvW71SRWpVzOfHjItS5# =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *** Summary: The purpose of this conference is to discuss the many research problems deriving from studies of existing standards, the development of revisions to existing standards, and the exploration of completely new areas of standardisation. This conference is intended to cover the full spectrum of research on security and privacy standardisation, including, but not restricted to, work on cryptographic techniques, security management, security and privacy evaluation criteria, security policy, network security, privacy and identity management, smart cards and RFID tags, biometrics, security modules, and industry-specific security standards. This year, we would also like to encourage active law researchers in data protection and privacy to submit to the conference. This aligns with the presence of the GDPR in the EU. Submissions relating to regulation-related aspects of Covid-19 technologies, blockchain technology and the IoT are particularly welcomed. We would also love to see more standardisation efforts being open to interaction with academics. This follows in the footsteps of IETF=E2=80=99s design approach for TLS 1.3, which has seen sub= stantial academic input. Similarly, several post-quantum standardisation efforts have seen interaction between academia and industry =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ***Types of Contributions: Full paper: discussing original research, answering well-defined research questions, and presenting full and stable results. Systematisation of Knowledge (SoK): integrating experience and previous research, drawing new comprehensive conclusions. Vision papers: reporting on work in progress or concrete ideas for work that has yet to begin. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *** Topics (including, but not limited to): access control biometrics cloud computing security/privacy critical national infrastructure protection standards consistency & comparison critiques of standards cryptanalysis cryptographic protocols cryptographic techniques evaluation criteria formal analysis of standards history of standardization identity management industrial control systems security internet security interoperability of standards intrusion detection key management and PKIs standardisation process management mobile security network security open standards and open source payment system security privacy regional and international standards RFID tag security risk analysis security controls security management security protocols security services security tokens smart cards telecommunications security trusted computing web security blockchain internet of things security/privacy data protection and law/regulation =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *** Invited Speakers: Professor Lilian Edwards, Newcastle University Nick Sullivan, Cloudflare =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The proceedings of SSR 2020 will be published by Springer in the Lecture Notes in Computer Science series. An overview of the previous SSR conferences can be found at ssresearch.eu. --000000000000bea89c05ad53b432 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
FYI, the deadline for the Security Standardisation Researc= h Conference has been extended to August 31.=C2=A0

---------- Forwarded= message ---------
From: SSR = 2020 <ss= r2020@easychair.org>
Date: Thu, Aug 20, 2020 at 9:51 AMSubject: SSR 2020 Paper Submission Extended Deadline: 31 August 2020
To= : Richard Barnes <rlb@ipv.sx>

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ***SSR 2020 (Virtual Conference)

The 6th Security Standardisation Research Conference
https://ssr2020.mozilla.org/

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D ***Important Dates:
Paper Deadline (Extended): 31 Aug 2020
Notification: 1 Oct 2020
Camera Ready: 12 Oct 2020
Conference: 30 November 2020 - 1 December 2020

Submissions page: https://easychair.= org/account/signin?l=3DgUlMvW71SRWpVzOfHjItS5#

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D *** Summary: The purpose of this conference is to discuss the many research= problems deriving from studies of existing standards, the development of r= evisions to existing standards, and the exploration of completely new areas= of standardisation. This conference is intended to cover the full spectrum= of research on security and privacy standardisation, including, but not re= stricted to, work on cryptographic techniques, security management, securit= y and privacy evaluation criteria, security policy, network security, priva= cy and identity management, smart cards and RFID tags, biometrics, security= modules, and industry-specific security standards.

This year, we would also like to encourage active law researchers in data p= rotection and privacy to submit to the conference. This aligns with the pre= sence of the GDPR in the EU. Submissions relating to regulation-related asp= ects of Covid-19 technologies, blockchain technology and the IoT are partic= ularly welcomed. We would also love to see more standardisation efforts bei= ng open to interaction with academics. This follows in the footsteps of IET= F=E2=80=99s design approach for TLS 1.3, which has seen substantial academi= c input. Similarly, several post-quantum standardisation efforts have seen = interaction between academia and industry

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
***Types of Contributions:
Full paper: discussing original research, answering well-defined research q= uestions, and presenting full and stable results.
Systematisation of Knowledge (SoK): integrating experience and previous res= earch, drawing new comprehensive conclusions.
Vision papers: reporting on work in progress or concrete ideas for work tha= t has yet to begin.

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
*** Topics (including, but not limited to):
access control
biometrics
cloud computing security/privacy
critical national infrastructure protection
standards consistency & comparison critiques of standards
cryptanalysis
cryptographic protocols
cryptographic techniques
evaluation criteria
formal analysis of standards
history of standardization
identity management
industrial control systems security
internet security
interoperability of standards
intrusion detection
key management and PKIs
standardisation process management
mobile security
network security
open standards and open source
payment system security
privacy regional and international standards
RFID tag security
risk analysis
security controls
security management
security protocols
security services
security tokens
smart cards
telecommunications security
trusted computing
web security
blockchain
internet of things security/privacy
data protection and law/regulation

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
*** Invited Speakers:
Professor Lilian Edwards, Newcastle University
Nick Sullivan, Cloudflare

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
The proceedings of SSR 2020 will be published by Springer in the Lecture No= tes in Computer Science series.

An overview of the previous SSR conferences can be found at ssresearch.eu.
--000000000000bea89c05ad53b432-- From nobody Thu Aug 20 14:05:18 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CE45D3A1418 for ; Thu, 20 Aug 2020 14:05:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ytJTbxTu959S for ; Thu, 20 Aug 2020 14:05:15 -0700 (PDT) Received: from mail-qv1-xf2f.google.com (mail-qv1-xf2f.google.com [IPv6:2607:f8b0:4864:20::f2f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id EC1323A0DF1 for ; Thu, 20 Aug 2020 14:05:14 -0700 (PDT) Received: by mail-qv1-xf2f.google.com with SMTP id dd12so1628246qvb.0 for ; Thu, 20 Aug 2020 14:05:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=y8vG64fayeAXruweKpq/a49kwWZ3zMCKwnBG+F4UW2g=; b=dqrcbcDzelrdmmY/lKDYaz/FjwLgXMGjnDFrNegC+/QJPRW5N3FhFybKvGPO4C7mQ5 ncPT0m8kkKSd1LKJK+3HKz2iMxKKx8xW6NsaBZnUG4yZ6NbQccjyEbcp88GbXCk/Hlaz h/K2l5jqJb/hvEWTfg+VUwTo57HniFO99ciTRuX3j5GZ6IHd1lVsqvWk8LchtoUH4ws0 1XwkKd1QTamh33XTB+BhrGaK3vM14XWdL7cNniUtB58T9wAHKSwd0DF9WTh7sxq0fYdY 3rrWPrm5nJWD0Ysn0QHS3canncR0gzovR9SgynF94908Pfo1P2Dmr68bMkAvVIB6QG/W BEvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=y8vG64fayeAXruweKpq/a49kwWZ3zMCKwnBG+F4UW2g=; b=pLsYh+h3k8vnGXl2QFlvY5+EsKA24FqphluaIurPONuBzaUDAYYnmMa5LWqH4+/qtX EAlVMsEZ6BiP2Hs8+1pLtxYbQLjcshoDkqtU5zHupacpK2xCHHqM1d5Hei6NYuDIw1uX V5kDPMiNlRetvxSL/ZiNpHJBJ/1byV/vkIyWxcM+i06qk+bfUHnQlK890puy4JSt9AMu Wd1s4hssqqi3jGm0RS64Yw1Vg20b6PYvnBR5/+5tQ+TG7OVNl1fTNdfimmEeFwdkd4Uv gAfjCIxqvCeQGa0P5pHtTk4l//DmNQ9Ve/ZuxQQ6Kx1oKCDvO0SYs8mtb1pq9wOwuoGB /efg== X-Gm-Message-State: AOAM531QYht4ny5zUF8aXzzlZ3/sB8587FxpsPvOQac1jgb9VhNA3+/+ m+PwJoA0fLZfzO0eopB2vE85302bKm/qS9Lu0HJhLQ== X-Google-Smtp-Source: ABdhPJya0GNz5ADfVEU9xXZijP/o9TCJq28/qE0aRSb2gYJwdEH8hWIgHRuPTYqsAOca5ZR3j1YF1ZycWY/oJrI2Vvg= X-Received: by 2002:ad4:4503:: with SMTP id k3mr735717qvu.43.1597957513729; Thu, 20 Aug 2020 14:05:13 -0700 (PDT) MIME-Version: 1.0 References: <504ca35e-ca0a-47db-a861-774867c169b9@aalto.fi> In-Reply-To: <504ca35e-ca0a-47db-a861-774867c169b9@aalto.fi> From: Richard Barnes Date: Thu, 20 Aug 2020 17:04:52 -0400 Message-ID: To: Chris Brzuska Cc: Messaging Layer Security WG Content-Type: multipart/alternative; boundary="000000000000f8f5d805ad55792e" Archived-At: Subject: Re: [MLS] Double-use of the same key X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 21:05:18 -0000 --000000000000f8f5d805ad55792e Content-Type: text/plain; charset="UTF-8" Argh, we *used* to have an Expand call there, but got rid of it because the first step of DeriveKeyPair was also Expand. But now that we're delegating to the KEM here, it probably makes sense to add it back, especially since the first step of DeriveKeyPair is now Extract. https://github.com/mlswg/mls-protocol/pull/397 I think I owe Konrad a beer since he initially proposed it and I reverted it :) --Richard [1] https://github.com/cfrg/draft-irtf-cfrg-hpke/blob/master/draft-irtf-cfrg-hpke.md#derivekeypair-derive-key-pair On Thu, Aug 20, 2020 at 2:40 PM Chris Brzuska wrote: > Hey all, > > I realized that that path_secret is now used to key two different > cryptographic primitives which violates key separation. Namely, the > path_secret is used to key the two functions ExpandWithLabel and > KEM.DeriveKeyPair. > > Downsides: > > - Violates the good crypto practice of key separation via HKDF.Expand > which we use in other parts of MLS. > - Moves MLS outside the scope of provable security, because crypto > assumptions assume that a key is only used in one cryptographic primitive > and not in two. > > Chris > > path_secret[n] = ExpandWithLabel(path_secret[n-1], > "path", "", KEM.Nsk) > node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n]) > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --000000000000f8f5d805ad55792e Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Argh, we *used* to have an Expand call there, but got= rid of it because the first step of DeriveKeyPair was also Expand.=C2=A0 B= ut now that we're delegating to the KEM here, it probably makes sense t= o add it back, especially since the first step of DeriveKeyPair is now Extr= act.

=
I think I owe Konrad a beer since he initially proposed it a= nd I reverted it :)

--Richard

On Thu, Aug 20, 2020 at 2:40 PM Chris Brzusk= a <chris.brzuska@aalto.fi&= gt; wrote:
=20 =20 =20

Hey all,

I realized that that path_secret is now used to key two different cryptographic primitives which violates key separation. Namely, the path_secret is used to key the two functions ExpandWithLabel and KEM.DeriveKeyPair.

Downsides:

  • Violates the good crypto practice of key separation via HKDF.Expand which we use in other parts of MLS.
  • Moves MLS outside the scope of provable security, because crypto assumptions assume that a key is only used in one cryptographic primitive and not in two.
Chris 
path_secret[n] =3D ExpandWithLabel(path_secret[n-1],
                                   "path", "", KEM.Nsk)
node_priv[n], node_pub[n] =3D KEM.DeriveKeyPair(path_secret[n])
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--000000000000f8f5d805ad55792e-- From nobody Thu Aug 20 14:14:09 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3A1AA3A1435 for ; Thu, 20 Aug 2020 14:14:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.047 X-Spam-Level: X-Spam-Status: No, score=-3.047 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, NICE_REPLY_A=-0.949, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pldr2NAUVUrS for ; Thu, 20 Aug 2020 14:14:02 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 085F83A12CA for ; Thu, 20 Aug 2020 14:14:01 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id D0301115817_F3EE794B; Thu, 20 Aug 2020 21:13:56 +0000 (GMT) Received: from exng4.org.aalto.fi (exng4.org.aalto.fi [130.233.223.23]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng4.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 8E1F411580D_F3EE794F; Thu, 20 Aug 2020 21:13:56 +0000 (GMT) Received: from exng6.org.aalto.fi (130.233.223.25) by exng4.org.aalto.fi (130.233.223.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Fri, 21 Aug 2020 00:13:56 +0300 Received: from [192.168.1.14] (130.233.0.5) by exng6.org.aalto.fi (130.233.223.25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Fri, 21 Aug 2020 00:13:56 +0300 To: Richard Barnes CC: Messaging Layer Security WG References: <504ca35e-ca0a-47db-a861-774867c169b9@aalto.fi> From: Chris Brzuska Message-ID: <3b13972c-836c-ac48-41cc-8b8dad35e1af@aalto.fi> Date: Fri, 21 Aug 2020 00:13:55 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101 Thunderbird/68.11.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------DF010F23035C4F9EF7979C31" Content-Language: en-GB X-Originating-IP: [130.233.0.5] X-ClientProxiedBy: exng8.org.aalto.fi (130.233.223.27) To exng6.org.aalto.fi (130.233.223.25) X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=subject:to:cc:references:from:message-id:date:mime-version:in-reply-to:content-type; s=its18; bh=7OlMUBg4m+7AOWjDEDnpFoA0F4h7waxb7GhRpTfjfxI=; b=gNXMCrpsLiBkc7GZkiNy8/kVfS3WEM+Wi/76ZiS++cbonApcdDcMi7JAz6/H/SmqiUx6EKs4cof9jCLPM35eDGGIG13qqYDkthc6u87oBhBIuc7HUCzpGf091WdVIrMPQ3vyCwIUIdkeKo1POJyKlDgj12q1Uc7nCkoMWmULzkKMm6YVobWUATkFgtJCQk1lbDMxHp0kd5G6E3zg2ef0z0/m6ruqqR2SlYJSm8Fp4YHRUemNRf57vqZPDZ0RGcKTG0oA/GSY5Rce/ql+0xHzhK4bodT+BQta3oxRcg+JVVUTmhTnYA4m+rHoDPw7gg93pikveTBfAzrgVAMrgwiNTg== Archived-At: Subject: Re: [MLS] Double-use of the same key X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 20 Aug 2020 21:14:08 -0000 --------------DF010F23035C4F9EF7979C31 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: 8bit Excellent, thanks :-) Chris On 21/08/2020 00:04, Richard Barnes wrote: > Argh, we *used* to have an Expand call there, but got rid of it > because the first step of DeriveKeyPair was also Expand.  But now that > we're delegating to the KEM here, it probably makes sense to add it > back, especially since the first step of DeriveKeyPair is now Extract. > > https://github.com/mlswg/mls-protocol/pull/397 > > I think I owe Konrad a beer since he initially proposed it and I > reverted it :) > > --Richard > > [1] > https://github.com/cfrg/draft-irtf-cfrg-hpke/blob/master/draft-irtf-cfrg-hpke.md#derivekeypair-derive-key-pair > > On Thu, Aug 20, 2020 at 2:40 PM Chris Brzuska > wrote: > > Hey all, > > I realized that that path_secret is now used to key two different > cryptographic primitives which violates key separation. Namely, > the path_secret is used to key the two functions ExpandWithLabel > and KEM.DeriveKeyPair. > > Downsides: > > * Violates the good crypto practice of key separation via > HKDF.Expand which we use in other parts of MLS. > * Moves MLS outside the scope of provable security, because > crypto assumptions assume that a key is only used in one > cryptographic primitive and not in two. > > Chris > > |path_secret[n] = ExpandWithLabel(path_secret[n-1], "path", "", > KEM.Nsk) node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])| > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --------------DF010F23035C4F9EF7979C31 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: 8bit

Excellent, thanks :-)

Chris

On 21/08/2020 00:04, Richard Barnes wrote:

Argh, we *used* to have an Expand call there, but got rid of it because the first step of DeriveKeyPair was also Expand.  But now that we're delegating to the KEM here, it probably makes sense to add it back, especially since the first step of DeriveKeyPair is now Extract.


I think I owe Konrad a beer since he initially proposed it and I reverted it :)

--Richard


On Thu, Aug 20, 2020 at 2:40 PM Chris Brzuska <chris.brzuska@aalto.fi> wrote:

Hey all,

I realized that that path_secret is now used to key two different cryptographic primitives which violates key separation. Namely, the path_secret is used to key the two functions ExpandWithLabel and KEM.DeriveKeyPair.

Downsides:

  • Violates the good crypto practice of key separation via HKDF.Expand which we use in other parts of MLS.
  • Moves MLS outside the scope of provable security, because crypto assumptions assume that a key is only used in one cryptographic primitive and not in two.
Chris 
path_secret[n] = ExpandWithLabel(path_secret[n-1],
                                   "path", "", KEM.Nsk)
node_priv[n], node_pub[n] = KEM.DeriveKeyPair(path_secret[n])
_______________________________________________
MLS mailing list
MLS@ietf.org
https://www.ietf.org/mailman/listinfo/mls
--------------DF010F23035C4F9EF7979C31-- From nobody Thu Aug 20 23:28:35 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C06F3A189C for ; Thu, 20 Aug 2020 23:28:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.088 X-Spam-Level: X-Spam-Status: No, score=-2.088 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=aalto.fi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HiFf5QKVonNc for ; Thu, 20 Aug 2020 23:28:29 -0700 (PDT) Received: from smtp-out-01.aalto.fi (smtp-out-01.aalto.fi [130.233.228.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1098E3A1897 for ; Thu, 20 Aug 2020 23:28:27 -0700 (PDT) Received: from smtp-out-01.aalto.fi (localhost.localdomain [127.0.0.1]) by localhost (Email Security Appliance) with SMTP id AEA19115742_F3F6985B; Fri, 21 Aug 2020 06:28:21 +0000 (GMT) Received: from exng1.org.aalto.fi (exng1.org.aalto.fi [130.233.223.20]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (Client CN "exng1.org.aalto.fi", Issuer "org.aalto.fi RootCA" (not verified)) by smtp-out-01.aalto.fi (Sophos Email Appliance) with ESMTPS id 3293011565D_F3F6985F; Fri, 21 Aug 2020 06:28:21 +0000 (GMT) Received: from exng4.org.aalto.fi (130.233.223.23) by exng1.org.aalto.fi (130.233.223.20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1979.3; Fri, 21 Aug 2020 09:28:20 +0300 Received: from exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8]) by exng4.org.aalto.fi ([fe80::4047:1ae:cfdf:c1a8%18]) with mapi id 15.01.1979.003; Fri, 21 Aug 2020 09:28:20 +0300 From: Cornelissen Eric To: Joel Alwen CC: Messaging Layer Security WG Thread-Topic: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule Thread-Index: AQHWdXrucaCL3fuq50uSJkTFSJfo5ak/FzvdgAHRNICAATCjgA== Date: Fri, 21 Aug 2020 06:28:20 +0000 Message-ID: References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <19861857231648008e6c280815c86546@aalto.fi>, In-Reply-To: Accept-Language: en-US, fi-FI Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.233.0.5] Content-Type: multipart/alternative; boundary="_000_b9de81ae2d044b3289ba3d583e2c040daaltofi_" MIME-Version: 1.0 X-SASI-RCODE: 200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=aalto.fi; h=from:to:cc:subject:date:message-id:references:in-reply-to:content-type:mime-version; s=its18; bh=Sobr6gu/NXbD9JpqNcIs5kRaioxkET0FrsJlqd9x7tA=; b=j1UHEsihA2+uu0qYHvzebqP/m5YrPtYBC8Bj6zO6yiRrfv50pBzng8tkLiQ7bb8VDlJW6rGJ0uDtaakwXfwl/j7O+VxEcD8Po93ChISTol5MbGuZxye5g3Ux9O3L57DMQxifxD/tuyDUqhvGJYODaiNnME+xw7KiV/vOlhbi+Ygz4/owzQm4CZ+U8uHp4YnMd+sQNCyQ69AoRVjZm+lAvBAKxMl3QC+uBTgvaYqbdr63i8r3h+lxhtHMuaZlJGza1cmby5oBlUXRo78RSCZEOm7WnhRx4+F2xyWT5QLv02pmV+1dvlD/SNs9KpaBNigwSn/DGnuDjOt2kDuPZ1th0A== Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2020 06:28:33 -0000 --_000_b9de81ae2d044b3289ba3d583e2c040daaltofi_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi Jo=EBl, Thanks for getting back to me. I was indeed assuming A (i.e. that the updat= ed credentials are fresh), but didn't think about the practicalities of get= ting new credentials. *After* such an update it should also prevent the adv= ersary from forging Add and Remove proposals. Regards, Eric ________________________________ From: Joel Alwen Sent: Thursday, August 20, 2020 6:01:55 PM To: Cornelissen Eric; Richard Barnes; Raphael Robert Cc: Messaging Layer Security WG Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetri= c key schedule Hey Eric, What I think ur saying here is that an update proposal (MLSPLaintext) packe= ts should be signed using the sig key contained in that packet's key package. = Am I getting that right? This makes no difference for the forging of Add and Remove proposals so tho= se attacks should still work as before. It might prevent forging updates but o= nly if both: A) all updates proposals MUST update to new credentials and B) when leaking Alice's state I only obtained 1 valid credential of hers. But for that we'd have to mandate A) as thats not currently the case. I thi= nk would be a mistake though, at least in general. Fresh certs may be comparat= ively difficult to come by even for honest users. Yet that shouldn't stop them fr= om updating their HPKE keys frequently. At best, maybe this could be a group specific policy? E.g. for deployments where fresh certs are very easy to co= me by (say, generated locally) so people could be expected to refresh their sig k= eys just as often as their HPKE keys. > Then again, I would be very much in favor of including something group-bi= nding > in handshake messages as it would prevent some replay attacks (*) that I = have > been considering for a while. Yup, this seems more like a complimentary solution. I'm curious about those replay attacks though! :-) If you're ready to tell = us more I'm all ears... - Jo=EBl On 19/08/2020 10:17, Cornelissen Eric wrote: > I was wondering what the implications are of using the key advertised in = an > update Proposal's KeyPackage for signing, instead of the long-term key pa= ir, > just like new_memberexternal proposals > . [https://avatars1.githubusercontent.com/u/36107802?s=3D400&v=3D4] mls-protocol/draft-ietf-mls-protocol.md at c3db39266505e9d202158d642d65918d= 35870e77 =B7 mlswg/mls-protocol =B7 GitHub github.com MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub. > I'm confident it prevents the original weakness pointed out by Jo=EBl, bu= t I'm > unsure as to whether or not it introduces any new problems. > > > Then again, I would be very much in favor of including something group-bi= nding > in handshake messages as it would prevent some replay attacks (*) that I = have > been considering for a while. > > > Regards, > > Eric > > > > (*): Replays from adversarially controlled groups where the attacker mana= ged to > have the group id, epoch, and tree structure to match those of a target g= roup. > > > > -------------------------------------------------------------------------= ------- > *From:* Richard Barnes > *Sent:* Tuesday, August 18, 2020 6:26 PM > *To:* Raphael Robert > *Cc:* Joel Alwen; Messaging Layer Security WG > *Subject:* Re: [MLS] MLSPlaintext packets aren't authenticated using symm= etric > key schedule > > Thanks for pointing this out, Jo=EBl. I agree that the attacks you're de= scribing > should work as things are currently specified. And they're salient, espe= cially > the "replace Alice in the group" one. > > Also agree with Raphael is correct that Commit is not affected by this, s= ince > someone who is not a member won't be able to generate the right confirmat= ion > value. However, I don't think this is actually the right design to adopt= for a > general solution to this problem. Confirmation verifies group membership > *after* processing the handshake message; the point here is that we shoul= d also > have a membership check *before* processing handshake messages. In parti= cular, > I would propose that we do need something additional on Commit messages a= s well > as Proposals. > > Thinking about solutions here, a couple of options come to mind: > > 1. Use MLSCiphertext, but with an integrity-only encapsulation > 2. Incorporate in the signature something that is only known to the group= (e.g., > confirmation_key or MAC(confirmation_key; confirmed_transcript_hash || > Proposal/Commit)) > > Option (1) has the appeal that you would only ever send MLSCiphertext, th= ough > switching between encrypted/not could be problematic. Option (2) seems a= lot > more appealing: It doesn't add any overhead, since the group-secret value > doesn't need to be sent. And we already switch between the signature con= text > that is added for group members vs. external. In fact, I think option (2= ) would > just amount to a one-line change to include an extra, secret value in the > context at the top of the MLSPlaintextTBS struct. > https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol= .md#content-signing-and-encryption [https://avatars1.githubusercontent.com/u/36107802?s=3D400&v=3D4] mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protocol = =B7 GitHub github.com MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub. > [https://avatars1.githubusercontent.com/u/36107802?s=3D400&v=3D4] mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protocol = =B7 GitHub github.com MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub. > > mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protocol = =B7 GitHub > [https://avatars1.githubusercontent.com/u/36107802?s=3D400&v=3D4] mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protocol = =B7 GitHub github.com MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub. > github.com > MLS protocol. Contribute to mlswg/mls-protocol development by creating an > account on GitHub. > > > The only thing that seems odd about (2) is overloading signature verifica= tion in > that way, i.e., using the ability to generate a signature over a secret t= hing to > prove you know the secret thing. That doesn't seem obviously flawed to m= e, but > worth thinking about. > > Does that make sense to folks? > > --Richard > > > On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > > = wrote: > > Hi Joel, > > For context: this would only apply when applications use cleartext > MLSPlaintext for HS messages. The recommendation is still to encrypt = them > and send them around as MLSCiphertext. > That being said, we said we would like to support scenarios where HS > messages are not necessarily encrypted. > > Question: would this attack work with Commit messages? I=92m thinking= that > they would be rejected because the attacker cannot compute the confir= mation_tag. > > As you mention in the PS, the easy target would be Proposal messages. > > I=92d be interested to see what exactly you would propose as a mitiga= tion > mechanism. > > Raphael > > > On 18 Aug 2020, at 16:36, Joel Alwen > wrote: > > > > Hey everyone, > > > > Something thats been bugging Marta Mularczyk and Daniel Jost and me= for a bit > > now is that handshake messages sent out as MLSPlaintext packets are= only > > authenticated using signatures, but not using the group's key sched= ule. For > > non-members that makes sense but for group members that's weaker th= an need be. > > > > Suppose Alice is in a group using signing key pair (spk, ssk). I co= rrupt > her to > > learn ssk. Now I loose access to her device again. Later she genera= tes a fresh > > key package with her same spk but a new HPKE key for her leaf. She = sends > out and > > update proposal for her new key package and someone commits to the = update. > > > > Expected result: she (and the group at large) has achieved PCS agai= n. > > > > Actual result: using her stolen ssk I can still forge a new proposa= l's > (sent as > > MLSPlaintext packets) coming from Alice. Some things I could do wit= h this > power: > > - I can generate a new key package kp for Alice using her spk and s= ome > HPKE key > > she doesn't know. Then I forge an update proposal for Alice with kp= . If it > gets > > committed I've effectively kicked her out of the group. > > - I could forge Add's and Remove's coming from Alice, so I could tr= ick the > > group into thinking Alice is trying to Add my account to the group = or remove > > some other group member. > > > > Lemme know if I've missed something here in that scenario... > > > > > > If I didn't miss anything and the attacks really work as advertised= then IMO > > this is kinda weak sauce and worth avoiding if possible. So to that= end, how > > about we modify MLS such that MLSPlaintext packets coming from grou= p members > > must also be authenticated using something from the application key= schedule. > > Now the above attacks fail. As soon as Alice's update is gets commi= tted I no > > longer know the group's key schedule and so can't forged packet fro= m > Alice. More > > generally, this brings the PCS guarantees when using MLSPlaintexts = frameing in > > line with what we're getting from MLSCiphertext packets. > > > > Any thoughts? > > > > - Jo=EBl > > > > > > > > PS. For concreteness, we could probably extend the current mechanis= m for > getting > > concistancy (the confirmation_tag) to also provide symmetric key > authentication. > > E.g. include most of the MLSPlaintext content into whats being tagg= ed by > > confirmation_tag. That would cover the case of a commit packet and = doesn't > even > > grow the size of MLSPlaintext packets over the current design. > > > > For a proposal packet we could also have a confirmation_tag but thi= s one is > > computed using the *current* epoch's confirmation_key and > confirmed_transcript_hash. > > > > _______________________________________________ > > MLS mailing list > > MLS@ietf.org > > https://www.ietf.org/mailman/listinfo/mls > > _______________________________________________ > MLS mailing list > MLS@ietf.org > https://www.ietf.org/mailman/listinfo/mls > --_000_b9de81ae2d044b3289ba3d583e2c040daaltofi_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Hi Jo=EBl,


Thanks for getting back to me. I was indeed assuming A (i.e. that the up= dated credentials are fresh), but didn't think about the practicalities of = getting new credentials. *After* such an update it should also prevent the adversary from forging Add and Remove proposals.


Regards,

Eric


From: Joel Alwen <jalw= en@wickr.com>
Sent: Thursday, August 20, 2020 6:01:55 PM
To: Cornelissen Eric; Richard Barnes; Raphael Robert
Cc: Messaging Layer Security WG
Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using s= ymmetric key schedule
 
Hey Eric,

What I think ur saying here is that an update proposal (MLSPLaintext) packe= ts
should be signed using the sig key contained in that packet's key package. = Am I
getting that right?

This makes no difference for the forging of Add and Remove proposals so tho= se
attacks should still work as before. It might prevent forging updates but o= nly
if both:

A) all updates proposals MUST update to new credentials and
B) when leaking Alice's state I only obtained 1 valid credential of hers.
But for that we'd have to mandate A) as thats not currently the case. I thi= nk
would be a mistake though, at least in general. Fresh certs may be comparat= ively
difficult to come by even for honest users. Yet that shouldn't stop them fr= om
updating their HPKE keys frequently. At best, maybe this could be a group specific policy? E.g. for deployments where fresh certs are very easy to co= me by
(say, generated locally) so people could be expected to refresh their sig k= eys
just as often as their HPKE keys.

> Then again, I would be very much in favor of including something group= -binding
> in handshake messages as it would prevent some replay attacks (*) that= I have
> been considering for a while.

Yup, this seems more like a complimentary solution.

I'm curious about those replay attacks though! :-) If you're ready to tell = us
more I'm all ears...

- Jo=EBl

On 19/08/2020 10:17, Cornelissen Eric wrote:
> I was wondering what the implications are of using the key advertised = in an
> update Proposal's KeyPackage for signing, instead of the long-term key= pair,
> just like new_memberexternal proposals
> <https://github.com/mlswg/mls-pr= otocol/blob/c3db39266505e9d202158d642d65918d35870e77/draft-ietf-mls-protoco= l.md#external-proposals>.
github.com
MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub.

> I'm confident it prevents the original weakness pointed out by Jo=EBl,= but I'm
> unsure as to whether or not it introduces any new problems.
>
>
> Then again, I would be very much in favor of including something group= -binding
> in handshake messages as it would prevent some replay attacks (*) that= I have
> been considering for a while.
>
>
> Regards,
>
> Eric
>
>
>
> (*): Replays from adversarially controlled groups where the attacker m= anaged to
> have the group id, epoch, and tree structure to match those of a = target group.
>
>
>
> ----------------------------------------------------------------------= ----------
> *From:* Richard Barnes <rlb@ipv.sx>
> *Sent:* Tuesday, August 18, 2020 6:26 PM
> *To:* Raphael Robert
> *Cc:* Joel Alwen; Messaging Layer Security WG
> *Subject:* Re: [MLS] MLSPlaintext packets aren't authenticated using s= ymmetric
> key schedule
>  
> Thanks for pointing this out, Jo=EBl.  I agree that the attacks y= ou're describing
> should work as things are currently specified.  And they're salie= nt, especially
> the "replace Alice in the group" one.
>
> Also agree with Raphael is correct that Commit is not affected by this= , since
> someone who is not a member won't be able to generate the right confir= mation
> value.  However, I don't think this is actually the right design = to adopt for a
> general solution to this problem.  Confirmation verifies group me= mbership
> *after* processing the handshake message; the point here is that we sh= ould also
> have a membership check *before* processing handshake messages.  = In particular,
> I would propose that we do need something additional on Commit message= s as well
> as Proposals.
>
> Thinking about solutions here, a couple of options come to mind:
>
> 1. Use MLSCiphertext, but with an integrity-only encapsulation
> 2. Incorporate in the signature something that is only known to the gr= oup (e.g.,
> confirmation_key or MAC(confirmation_key; confirmed_transcript_hash ||=
> Proposal/Commit))
>
> Option (1) has the appeal that you would only ever send MLSCiphertext,= though
> switching between encrypted/not could be problematic.  Option (2)= seems a lot
> more appealing: It doesn't add any overhead, since the group-secret va= lue
> doesn't need to be sent.  And we already switch between the signa= ture context
> that is added for group members vs. external.  In fact, I think o= ption (2) would
> just amount to a one-line change to include an extra, secret value in = the
> context at the top of the MLSPlaintextTBS struct.
> https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.m= d#content-signing-and-encryption
github.com
MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub.

> <https://github.com/mlswg/mls-protocol/blob/master/dra= ft-ietf-mls-protocol.md#content-signing-and-encryption>
github.com
MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub.

>       
> mls-protocol/draft-ietf-mls-protocol.md at master =B7 mlswg/mls-protoc= ol =B7 GitHub
> <https://github.com/mlswg/mls-protocol/blob/master/dra= ft-ietf-mls-protocol.md#content-signing-and-encryption>
github.com
MLS protocol. Contribute to mlswg/mls-protocol development by creating an a= ccount on GitHub.

> github.com
> MLS protocol. Contribute to mlswg/mls-protocol development by creating= an
> account on GitHub.
>
>
> The only thing that seems odd about (2) is overloading signature verif= ication in
> that way, i.e., using the ability to generate a signature over a secre= t thing to
> prove you know the secret thing.  That doesn't seem obviously fla= wed to me, but
> worth thinking about.
>
> Does that make sense to folks?
>
> --Richard
>
>
> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert
> <raphael=3D40wire.com@dmarc.ietf.org <mailto:40wire.com@dmarc.ietf.org>> wrote:
>
>     Hi Joel,
>
>     For context: this would only apply when applic= ations use cleartext
>     MLSPlaintext for HS messages. The recommendati= on is still to encrypt them
>     and send them around as MLSCiphertext.
>     That being said, we said we would like to supp= ort scenarios where HS
>     messages are not necessarily encrypted.
>
>     Question: would this attack work with Commit m= essages? I=92m thinking that
>     they would be rejected because the attacker ca= nnot compute the confirmation_tag.
>
>     As you mention in the PS, the easy target woul= d be Proposal messages.
>
>     I=92d be interested to see what exactly you wo= uld propose as a mitigation
>     mechanism.
>
>     Raphael
>
>     > On 18 Aug 2020, at 16:36, Joel Alwen <= jalwen@wickr.com
>     <mailto= :jalwen@wickr.com>> wrote:
>     >
>     > Hey everyone,
>     >
>     > Something thats been bugging Marta Mularc= zyk and Daniel Jost and me for a bit
>     > now is that handshake messages sent out a= s MLSPlaintext packets are only
>     > authenticated using signatures, but not u= sing the group's key schedule. For
>     > non-members that makes sense but for grou= p members that's weaker than need be.
>     >
>     > Suppose Alice is in a group using signing= key pair (spk, ssk). I corrupt
>     her to
>     > learn ssk. Now I loose access to her devi= ce again. Later she generates a fresh
>     > key package with her same spk but a new H= PKE key for her leaf. She sends
>     out and
>     > update proposal for her new key package a= nd someone commits to the update.
>     >
>     > Expected result: she (and the group at la= rge) has achieved PCS again.
>     >
>     > Actual result: using her stolen ssk I can= still forge a new proposal's
>     (sent as
>     > MLSPlaintext packets) coming from Alice. = Some things I could do with this
>     power:
>     > - I can generate a new key package kp for= Alice using her spk and some
>     HPKE key
>     > she doesn't know. Then I forge an update = proposal for Alice with kp. If it
>     gets
>     > committed I've effectively kicked her out= of the group.
>     > - I could forge Add's and Remove's coming= from Alice, so I could trick the
>     > group into thinking Alice is trying to Ad= d my account to the group or remove
>     > some other group member.
>     >
>     > Lemme know if I've missed something here = in that scenario...
>     >
>     >
>     > If I didn't miss anything and the attacks= really work as advertised then IMO
>     > this is kinda weak sauce and worth avoidi= ng if possible. So to that end, how
>     > about we modify MLS such that MLSPlaintex= t packets coming from group members
>     > must also be authenticated using somethin= g from the application key schedule.
>     > Now the above attacks fail. As soon as Al= ice's update is gets committed I no
>     > longer know the group's key schedule and = so can't forged packet from
>     Alice. More
>     > generally, this brings the PCS guarantees= when using MLSPlaintexts frameing in
>     > line with what we're getting from MLSCiph= ertext packets.
>     >
>     > Any thoughts?
>     >
>     > - Jo=EBl
>     >
>     >
>     >
>     > PS. For concreteness, we could probably e= xtend the current mechanism for
>     getting
>     > concistancy (the confirmation_tag) to als= o provide symmetric key
>     authentication.
>     > E.g. include most of the MLSPlaintext con= tent into whats being tagged by
>     > confirmation_tag. That would cover the ca= se of a commit packet and doesn't
>     even
>     > grow the size of MLSPlaintext packets ove= r the current design.
>     >
>     > For a proposal packet we could also have = a confirmation_tag but this one is
>     > computed using the *current* epoch's conf= irmation_key and
>     confirmed_transcript_hash.
>     >
>     > _________________________________________= ______
>     > MLS mailing list
>     > MLS@ietf.org <mailto:MLS@ietf.org>
>     > https://www.ietf.org/mailman/listinfo/mls
>
>     ______________________________________________= _
>     MLS mailing list
>     MLS@ietf.org <mailto:MLS@ietf.org>
>     https://www.ietf.org/mailman/listinfo/mls
>
--_000_b9de81ae2d044b3289ba3d583e2c040daaltofi_-- From nobody Fri Aug 21 02:49:43 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9B15D3A0964 for ; Fri, 21 Aug 2020 02:49:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=wire-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sfMLINutMf7O for ; Fri, 21 Aug 2020 02:49:38 -0700 (PDT) Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 178FC3A094C for ; Fri, 21 Aug 2020 02:49:38 -0700 (PDT) Received: by mail-wr1-x42b.google.com with SMTP id c15so1340934wrs.11 for ; Fri, 21 Aug 2020 02:49:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wire-com.20150623.gappssmtp.com; s=20150623; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ZKPv8HtKUitj4gvJG+KD+vgny+dfnROB+28qbT/7X4o=; b=DSurumrj1upRrGO+0GcP6blCpNg7MZWCkpFPZ2GeEuB95iW8iwFxEksQ03XL6ChHu9 AgOulx7KMxHJ4RYaEHpVbrQMaPe5DNQTwPwQVZGCRK4ZAeeTUbTyrMp36Q3Q8Z2VqHsW e36YxPGGs/bvenJ2iFn1NSTFFRK3pPpmKDEWgfw1KNSWCy6Qj0A8KR1zy0aarINhVASS gf4UEyzpeWX+Q/eoJ9oHPzsMIzTtgHYgrMB3TWkavWgebPuemXlTR9ApTomihiDDlexn 8EVaUJRlzJxwX9xp2At+9/E/9if+Ud7hkknuqNT9JM/ASmU8lPVQuAQZr8hEb+dR8pZY Xfsw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ZKPv8HtKUitj4gvJG+KD+vgny+dfnROB+28qbT/7X4o=; b=Np7yPanf53R4zmVna1prIvaK8nFd/YDPT69hyW7WybrjBbcv8h4ETP9dukogqpeopI dVDo2+e1Ufjqabi/kluqSv84NWhAWqDDfu06aeMY11dRJP6Lt69HsyMh96ahqHlu+Pu8 x7YOR76+3mWwugRtoAh/Haa1b9Mcw7WaghPJwS7HaucyLraQKUAvQGMpgRoKniQM3xvL 50FaIwWmEVeqc9DmBZt7TK69XZ5CNXV3Tc6tX5dwkT8/dQAyud728mcAeXBaluV9naRy 0LMxoPUg1YevmzN641DYbLAl7+2zDqVwr83bFL0fWVrxee7a1papvdDUe6bG7BYqyV06 lJ7g== X-Gm-Message-State: AOAM531arKcp4r4gMgzuJAo83sOzttOvs2YFGDiN0sAWPaKkFZtgcIsa MBvQhPTWgQkcqHOcVo93Th6mKQ== X-Google-Smtp-Source: ABdhPJxLt0JPuz3AL4rH2TsSpeO3NBJHFoOOfd/WzqfnEsc/hIRPlNCmTo4BpMNgl0rkFUqU8xepqA== X-Received: by 2002:adf:9ec1:: with SMTP id b1mr1957952wrf.171.1598003376247; Fri, 21 Aug 2020 02:49:36 -0700 (PDT) Received: from rmbp.fritz.box ([134.3.30.253]) by smtp.gmail.com with ESMTPSA id z7sm3327149wmk.6.2020.08.21.02.49.34 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 21 Aug 2020 02:49:34 -0700 (PDT) From: Raphael Robert Message-Id: <5E549D21-1DE7-4F55-9EC6-A64128957950@wire.com> Content-Type: multipart/alternative; boundary="Apple-Mail=_B4E0D015-E904-4D5B-904F-E8AFDC7DB324" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.80.23.2.2\)) Date: Fri, 21 Aug 2020 11:49:33 +0200 In-Reply-To: Cc: Joel Alwen , Messaging Layer Security WG To: Richard Barnes References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> <1bd2268c-7f27-e24a-bcd7-3192afae13c9@wickr.com> X-Mailer: Apple Mail (2.3608.80.23.2.2) Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 21 Aug 2020 09:49:42 -0000 --Apple-Mail=_B4E0D015-E904-4D5B-904F-E8AFDC7DB324 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Thanks Richard, I think this now meets all requirements as such. = However, I stumbled upon the (group) context field that is already in = MLSPlaintextTBS. Wouldn=E2=80=99t this a) mean that the server cannot verify a signature of a member, = since the group context is not known outside of the group? b) address Joel=E2=80=99s concerns in the first place? I=E2=80=99m a bit confused as to what the intention was initially when = we introduced that. Right now it doesn=E2=80=99t seem to serve any extra = purpose and I think we could remove it. Raphael > On 20 Aug 2020, at 20:55, Richard Barnes wrote: >=20 > On Thu, Aug 20, 2020 at 10:20 AM Joel Alwen > wrote: > Yeah, good point. While I'm not sure every case of server inspection = would > require checking sigs on packets I am sure it would be useful for some = cases. >=20 > > The obvious fix is to include the membership_token in MLSPlaintext = as well. >=20 > Yup, I'm all for it. (Or at least for making it an optional field in = that struct.) >=20 > The PR has been updated. There is now a member_token field before the = signature, which non-member senders set to zero length. >=20 > https://github.com/mlswg/mls-protocol/pull/396/files = >=20 > Note that this allows the server to verify the signature, but the = membership_token is opaque to it; the server can't authenticate the = sender's membership. >=20 > --Richard=20 > =20 >=20 > - Jo=C3=ABl >=20 > On 19/08/2020 09:24, Raphael Robert wrote: > > I thought about this some more and now I=E2=80=99m not sure that the = membership_token > > should only be implicit: > >=20 > > The whole reason for HS messages to not be encrypted is that they = can be > > inspected along the way by an external party (e.g. the Delivery = Service). If > > this is not a requirement, MLSCiphertext should really be used = instead. > > Hiding the membership_token from external inspector means the = inspector can not > > verify the signature anymore. I think that defies the point of HS = messages being > > inspectable. > >=20 > > The obvious fix is to include the membership_token in MLSPlaintext = as well. > >=20 > > Raphael > >=20 > >> On 18 Aug 2020, at 21:01, Richard Barnes >> wrote: > >> > >> Here ya go: https://github.com/mlswg/mls-protocol/pull/396 = > >> > >> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen > >> >> wrote: > >> > >> > Jo=C3=ABl, do you want to write a PR? If not, I could = probably get to it in the > >> > next couple days. > >> > >> Thanks. :-) If you could that would be really nice. > >> > >> - Jo=C3=ABl > >> > >> On 18/08/2020 19:20, Richard Barnes wrote: > >> > Sounds like we're converging here. The only question in my = mind is what > >> goes in > >> > the MAC -- seems like the easy option is probably "the = remainder of the > >> > MLSPlaintextTBS", i.e., everything from group_id to the end. = That seems > >> like it > >> > minimizes multiple serialization: > >> > > >> > tbs_content =3D serialize(group_id, ...) > >> > membership_token =3D KDF.Extract(confirmation_key, = tbs_content) > >> > tbs =3D group_context || membership_token || tbs_content > >> > > >> > So the PR would be to basically pop the context off of = MLSPlaintextTBS > >> and add > >> > the three lines above (with the switch for internal/external = in prose). > >> > > >> > Jo=C3=ABl, do you want to write a PR? If not, I could = probably get to it in > >> the next > >> > couple days. > >> > > >> > --Richard > >> > > >> > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert = > >> > > >> > = >>> wrote: > >> > > >> > I think what you just described is indeed a combination = of option 1 & 2. > >> > It=E2=80=99s a MAC over the payload we want to = authenticate, but it=E2=80=99s > >> implicit and > >> > we only include it in the MLSPlaintextTBS. Or in other = words, we > >> stripped it > >> > from MLSPlaintext because it is implicitly known to any = valid member > >> of the > >> > group. > >> > > >> > Raphael > >> > > >> >> On 18 Aug 2020, at 18:16, Joel Alwen > >> > > >> >> = >>> wrote: > >> >> > >> >> Yeah, I like Option 2 here. I like that it avoids = growing packet size. > >> >> > >> >> One caveat though: I'd go for the MAC(...) version = rather than the > >> >> confirmation_key. For starters thing including = confirmation_key doesnt > >> >> authenticate the contents of the packet. But even if it = did, > >> signatures aren't > >> >> meant to hide the contents of what was signed. (Amend = you favorite sig > >> >> scheme to > >> >> tack on the message at the end a signature and you've = still got a > >> secure > >> >> signature scheme. But clearly not a message hiding one.) = That means > >> that AFAIK > >> >> neither ECDSA nor EdDSA etc. were designed or analyzed = for such a > >> property. So > >> >> this would amount to a very non-standard use of a = signature schemes by > >> >> MLS. Not > >> >> saying it doesn't work for the particular sig schemes in = our > >> ciphersuite. But > >> >> its def. not how signatures are "meant" to be used. > >> >> > >> >> But that leaves Option 2 with, say, including tag =3D = MAC(conf_key, > >> >> conf_trans_hash || MLSPlaintext.content) into whats = being signed > >> which I like > >> >> and think gets the job done. Both conf_* values are = taken from the > >> current > >> >> epoch. By MLSPlaintext.content I mean whats now called = MLSPlaintextTBS. > >> >> > >> >>> I would propose that we do need something additional on = Commit > >> messages as > >> >>> well as Proposals. > >> >> > >> >> @Richard: For Proopsals I think this works. Is that = about what you > >> had in mind > >> >> for commits too? > >> >> > >> >> - Jo=C3=ABl > >> >> > >> >> > >> >> On 18/08/2020 17:26, Richard Barnes wrote: > >> >>> Thanks for pointing this out, Jo=C3=ABl. I agree that = the attacks you're > >> >>> describing > >> >>> should work as things are currently specified. And = they're salient, > >> >>> especially > >> >>> the "replace Alice in the group" one. > >> >>> > >> >>> Also agree with Raphael is correct that Commit is not = affected by > >> this, since > >> >>> someone who is not a member won't be able to generate = the right > >> confirmation > >> >>> value. However, I don't think this is actually the = right design > >> to adopt > >> >>> for a > >> >>> general solution to this problem. Confirmation = verifies group > >> membership > >> >>> *after* processing the handshake message; the point = here is that we > >> >>> should also > >> >>> have a membership check *before* processing handshake = messages. In > >> >>> particular, > >> >>> I would propose that we do need something additional on = Commit > >> messages > >> >>> as well > >> >>> as Proposals. > >> >>> > >> >>> Thinking about solutions here, a couple of options come = to mind: > >> >>> > >> >>> 1. Use MLSCiphertext, but with an integrity-only = encapsulation > >> >>> 2. Incorporate in the signature something that is only = known to > >> the group > >> >>> (e.g., > >> >>> confirmation_key or MAC(confirmation_key; = confirmed_transcript_hash || > >> >>> Proposal/Commit)) > >> >>> > >> >>> Option (1) has the appeal that you would only ever send > >> MLSCiphertext, though > >> >>> switching between encrypted/not could be problematic. = Option (2) > >> seems a lot > >> >>> more appealing: It doesn't add any overhead, since the > >> group-secret value > >> >>> doesn't need to be sent. And we already switch between = the > >> signature context > >> >>> that is added for group members vs. external. In fact, = I think option > >> >>> (2) would > >> >>> just amount to a one-line change to include an extra, = secret value > >> in the > >> >>> context at the top of the MLSPlaintextTBS struct. > >> >>> =20 > >> = https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protocol.= md#content-signing-and-encryption = > >> >>> > >> >>> The only thing that seems odd about (2) is overloading = signature > >> >>> verification in > >> >>> that way, i.e., using the ability to generate a = signature over a > >> secret > >> >>> thing to > >> >>> prove you know the secret thing. That doesn't seem = obviously > >> flawed to > >> >>> me, but > >> >>> worth thinking about. > >> >>> > >> >>> Does that make sense to folks? > >> >>> > >> >>> --Richard > >> >>> > >> >>> > >> >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert > >> >>> > > >> >>> >=3D40wire.com@dmarc.ietf.org = > >> >> > >> >>> > >> >>> wrote: > >> >>> > >> >>> Hi Joel, > >> >>> > >> >>> For context: this would only apply when applications = use cleartext > >> >>> MLSPlaintext for HS messages. The recommendation is = still to > >> encrypt them > >> >>> and send them around as MLSCiphertext. > >> >>> That being said, we said we would like to support = scenarios > >> where HS > >> >>> messages are not necessarily encrypted. > >> >>> > >> >>> Question: would this attack work with Commit = messages? I=E2=80=99m > >> thinking that > >> >>> they would be rejected because the attacker cannot = compute the > >> >>> confirmation_tag. > >> >>> > >> >>> As you mention in the PS, the easy target would be = Proposal > >> messages. > >> >>> > >> >>> I=E2=80=99d be interested to see what exactly you = would propose as a > >> mitigation > >> >>> mechanism. > >> >>> > >> >>> Raphael > >> >>> > >> >>>> On 18 Aug 2020, at 16:36, Joel Alwen > >> > > >> >>>> = >> > >> >>> = >>> wrote: > >> >>>> > >> >>>> Hey everyone, > >> >>>> > >> >>>> Something thats been bugging Marta Mularczyk and = Daniel Jost and > >> me for > >> >>>> a bit > >> >>>> now is that handshake messages sent out as = MLSPlaintext packets > >> are only > >> >>>> authenticated using signatures, but not using the = group's key > >> schedule. For > >> >>>> non-members that makes sense but for group members = that's weaker than > >> >>>> need be. > >> >>>> > >> >>>> Suppose Alice is in a group using signing key pair = (spk, ssk). I > >> corrupt > >> >>> her to > >> >>>> learn ssk. Now I loose access to her device again. = Later she > >> generates a > >> >>>> fresh > >> >>>> key package with her same spk but a new HPKE key for = her leaf. > >> She sends > >> >>> out and > >> >>>> update proposal for her new key package and someone = commits to > >> the update. > >> >>>> > >> >>>> Expected result: she (and the group at large) has = achieved PCS again. > >> >>>> > >> >>>> Actual result: using her stolen ssk I can still forge = a new > >> proposal's > >> >>> (sent as > >> >>>> MLSPlaintext packets) coming from Alice. Some things I = could do > >> with this > >> >>> power: > >> >>>> - I can generate a new key package kp for Alice using = her spk and > >> some > >> >>> HPKE key > >> >>>> she doesn't know. Then I forge an update proposal for = Alice with > >> kp. If it > >> >>> gets > >> >>>> committed I've effectively kicked her out of the = group. > >> >>>> - I could forge Add's and Remove's coming from Alice, = so I could > >> trick the > >> >>>> group into thinking Alice is trying to Add my account = to the > >> group or remove > >> >>>> some other group member. > >> >>>> > >> >>>> Lemme know if I've missed something here in that = scenario... > >> >>>> > >> >>>> > >> >>>> If I didn't miss anything and the attacks really work = as > >> advertised then IMO > >> >>>> this is kinda weak sauce and worth avoiding if = possible. So to > >> that end, how > >> >>>> about we modify MLS such that MLSPlaintext packets = coming from > >> group members > >> >>>> must also be authenticated using something from the = application key > >> >>>> schedule. > >> >>>> Now the above attacks fail. As soon as Alice's update = is gets > >> committed I no > >> >>>> longer know the group's key schedule and so can't = forged packet from > >> >>> Alice. More > >> >>>> generally, this brings the PCS guarantees when using = MLSPlaintexts > >> >>>> frameing in > >> >>>> line with what we're getting from MLSCiphertext = packets. > >> >>>> > >> >>>> Any thoughts? > >> >>>> > >> >>>> - Jo=C3=ABl > >> >>>> > >> >>>> > >> >>>> > >> >>>> PS. For concreteness, we could probably extend the = current > >> mechanism for > >> >>> getting > >> >>>> concistancy (the confirmation_tag) to also provide = symmetric key > >> >>> authentication. > >> >>>> E.g. include most of the MLSPlaintext content into = whats being > >> tagged by > >> >>>> confirmation_tag. That would cover the case of a = commit packet > >> and doesn't > >> >>> even > >> >>>> grow the size of MLSPlaintext packets over the current = design. > >> >>>> > >> >>>> For a proposal packet we could also have a = confirmation_tag but > >> this one is > >> >>>> computed using the *current* epoch's confirmation_key = and > >> >>> confirmed_transcript_hash. > >> >>>> > >> >>>> _______________________________________________ > >> >>>> MLS mailing list > >> >>>> MLS@ietf.org = > > >> >> = >> > >> >>>> https://www.ietf.org/mailman/listinfo/mls = > >> >>> > >> >>> _______________________________________________ > >> >>> MLS mailing list > >> >>> MLS@ietf.org = > > >> >> = >> > >> >>> https://www.ietf.org/mailman/listinfo/mls = > >> > > >> > >=20 --Apple-Mail=_B4E0D015-E904-4D5B-904F-E8AFDC7DB324 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Thanks Richard, I think this now meets all requirements as = such. However, I stumbled upon the (group) context field that is already = in MLSPlaintextTBS. Wouldn=E2=80=99t this

a) mean that the server cannot = verify a signature of a member, since the group context is not known = outside of the group?
b) address Joel=E2=80=99s = concerns in the first place?

I=E2=80=99m a bit confused as to what = the intention was initially when we introduced that. Right now it = doesn=E2=80=99t seem to serve any extra purpose and I think we could = remove it.

Raphael

On 20 Aug 2020, at 20:55, = Richard Barnes <rlb@ipv.sx> wrote:

On Thu, Aug 20, 2020 at 10:20 AM = Joel Alwen <jalwen@wickr.com> wrote:
Yeah, good point. While I'm not sure = every case of server inspection would
require checking sigs on packets I am sure it would be useful for some = cases.

> The obvious fix is to include the membership_token in MLSPlaintext = as well.

Yup, I'm all for it. (Or at least for making it an optional field in = that struct.)

The PR has been updated.  There is = now a member_token field before the signature, which non-member senders = set to zero length.

https://github.com/mlswg/mls-protocol/pull/396/files
<= div class=3D"">
Note that this = allows the server to verify the signature, but the membership_token is = opaque to it; the server can't authenticate the sender's = membership.

--Richard 
 

- Jo=C3=ABl

On 19/08/2020 09:24, Raphael Robert wrote:
> I thought about this some more and now I=E2=80=99m not sure that = the membership_token
> should only be implicit:
>
> The whole reason for HS messages to not be encrypted is that they = can be
> inspected along the way by an external party (e.g. the Delivery = Service). If
> this is not a requirement, MLSCiphertext should really be used = instead.
> Hiding the membership_token from external inspector means the = inspector can not
> verify the signature anymore. I think that defies the point of HS = messages being
> inspectable.
>
> The obvious fix is to include the membership_token in MLSPlaintext = as well.
>
> Raphael
>
>> On 18 Aug 2020, at 21:01, Richard Barnes <rlb@ipv.sx <mailto:rlb@ipv.sx>> wrote:
>>
>> Here ya go: https://github.com/mlswg/mls-protocol/pull/396
>>
>> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen <jalwen@wickr.com
>> <mailto:jalwen@wickr.com>> wrote:
>>
>>     > Jo=C3=ABl, do you want to write a = PR?  If not, I could probably get to it in the
>>     > next couple days.
>>
>>     Thanks. :-) If you could that would be = really nice.
>>
>>     - Jo=C3=ABl
>>
>>     On 18/08/2020 19:20, Richard Barnes = wrote:
>>     > Sounds like we're converging = here.  The only question in my mind is what
>>     goes in
>>     > the MAC -- seems like the easy option = is probably "the remainder of the
>>     > MLSPlaintextTBS", i.e., everything from = group_id to the end.  That seems
>>     like it
>>     > minimizes multiple serialization:
>>     >
>>     > tbs_content =3D serialize(group_id, = ...)
>>     > membership_token =3D = KDF.Extract(confirmation_key, tbs_content)
>>     > tbs =3D group_context || = membership_token || tbs_content
>>     >
>>     > So the PR would be to basically pop the = context off of MLSPlaintextTBS
>>     and add
>>     > the three lines above (with the switch = for internal/external in prose).
>>     >
>>     > Jo=C3=ABl, do you want to write a = PR?  If not, I could probably get to it in
>>     the next
>>     > couple days.
>>     >
>>     > --Richard
>>     >
>>     > On Tue, Aug 18, 2020 at 12:24 PM = Raphael Robert <raphael@wire.com
>>     <mailto:raphael@wire.com>
>>     > <mailto:raphael@wire.com <mailto:raphael@wire.com>>> wrote:
>>     >
>>     >     I think what you = just described is indeed a combination of option 1 & 2.
= >>     >     It=E2=80=99s a MAC = over the payload we want to authenticate, but it=E2=80=99s
>>     implicit and
>>     >     we only include it = in the MLSPlaintextTBS. Or in other words, we
>>     stripped it
>>     >     from MLSPlaintext = because it is implicitly known to any valid member
>>     of the
>>     >     group.
>>     >
>>     >     Raphael
= >>     >
>>     >>     On 18 Aug 2020, = at 18:16, Joel Alwen <jalwen@wickr.com
>>     <mailto:jalwen@wickr.com>
>>     >>     <mailto:jalwen@wickr.com <mailto:jalwen@wickr.com>>> wrote:
>>     >>
>>     >>     Yeah, I like = Option 2 here. I like that it avoids growing packet size.
>>     >>
>>     >>     One caveat = though: I'd go for the MAC(...) version rather than the
>>     >>    =  confirmation_key. For starters thing including confirmation_key = doesnt
>>     >>     authenticate the = contents of the packet. But even if it did,
>>     signatures aren't
>>     >>     meant to hide = the contents of what was signed. (Amend you favorite sig
>>     >>     scheme to
>>     >>     tack on the = message at the end a signature and you've still got a
>>     secure
>>     >>     signature = scheme. But clearly not a message hiding one.) That means
>>     that AFAIK
>>     >>     neither ECDSA = nor EdDSA etc. were designed or analyzed for such a
>>     property. So
>>     >>     this would = amount to a very non-standard use of a signature schemes by
= >>     >>     MLS. Not
>>     >>     saying it = doesn't work for the particular sig schemes in our
>>     ciphersuite. But
>>     >>     its def. not how = signatures are "meant" to be used.
>>     >>
>>     >>     But that leaves = Option 2 with, say, including tag =3D MAC(conf_key,
>>     >>     conf_trans_hash = || MLSPlaintext.content) into whats being signed
>>     which I like
>>     >>     and think gets = the job done. Both conf_* values are taken from the
>>     current
>>     >>     epoch. By = MLSPlaintext.content I mean whats now called MLSPlaintextTBS.
>>     >>
>>     >>>     I would = propose that we do need something additional on Commit
>>     messages as
>>     >>>     well as = Proposals.
>>     >>
>>     >>     @Richard: For = Proopsals I think this works. Is that about what you
>>     had in mind
>>     >>     for commits = too?
>>     >>
>>     >>     - Jo=C3=ABl
>>     >>
>>     >>
>>     >>     On 18/08/2020 = 17:26, Richard Barnes wrote:
>>     >>>     Thanks for = pointing this out, Jo=C3=ABl.  I agree that the attacks you're
>>     >>>    =  describing
>>     >>>     should work = as things are currently specified.  And they're salient,
>>     >>>    =  especially
>>     >>>     the "replace = Alice in the group" one.
>>     >>>
>>     >>>     Also agree = with Raphael is correct that Commit is not affected by
>>     this, since
>>     >>>     someone who = is not a member won't be able to generate the right
>>     confirmation
>>     >>>     value.  = However, I don't think this is actually the right design
>>     to adopt
>>     >>>     for a
>>     >>>     general = solution to this problem.  Confirmation verifies group
= >>     membership
>>     >>>     *after* = processing the handshake message; the point here is that we
= >>     >>>     should = also
>>     >>>     have a = membership check *before* processing handshake messages.  In
>>     >>>    =  particular,
>>     >>>     I would = propose that we do need something additional on Commit
>>     messages
>>     >>>     as well
>>     >>>     as = Proposals.
>>     >>>
>>     >>>     Thinking = about solutions here, a couple of options come to mind:
>>     >>>
>>     >>>     1. Use = MLSCiphertext, but with an integrity-only encapsulation
>>     >>>     2. = Incorporate in the signature something that is only known to
>>     the group
>>     >>>     (e.g.,
>>     >>>    =  confirmation_key or MAC(confirmation_key; = confirmed_transcript_hash ||
>>     >>>    =  Proposal/Commit))
>>     >>>
>>     >>>     Option (1) = has the appeal that you would only ever send
>>     MLSCiphertext, though
>>     >>>     switching = between encrypted/not could be problematic.  Option (2)
>>     seems a lot
>>     >>>     more = appealing: It doesn't add any overhead, since the
>>     group-secret value
>>     >>>     doesn't need = to be sent.  And we already switch between the
>>     signature context
>>     >>>     that is = added for group members vs. external.  In fact, I think option
>>     >>>     (2) would
>>     >>>     just amount = to a one-line change to include an extra, secret value
>>     in the
>>     >>>     context at = the top of the MLSPlaintextTBS struct.
>>     >>>   
>>      https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-ml= s-protocol.md#content-signing-and-encryption
>>     >>>
>>     >>>     The only = thing that seems odd about (2) is overloading signature
>>     >>>     verification = in
>>     >>>     that way, = i.e., using the ability to generate a signature over a
>>     secret
>>     >>>     thing to
>>     >>>     prove you = know the secret thing.  That doesn't seem obviously
>>     flawed to
>>     >>>     me, but
>>     >>>     worth = thinking about.
>>     >>>
>>     >>>     Does that = make sense to folks?
>>     >>>
>>     >>>     --Richard
>>     >>>
>>     >>>
>>     >>>     On Tue, Aug = 18, 2020 at 10:55 AM Raphael Robert
>>     >>>    =  <raphael=3D40wire.com@dmarc.ietf.org <mailto:40wire.com@dmarc.ietf.org>
>>     >>>    =  <mailto:raphael <mailto:raphael>=3D40wire.com@dmarc.ietf.org
>>     <mailto:40wire.com@dmarc.ietf.org>> <mailto:40wire.com@dmarc.ietf.org
>>     <mailto:40wire.com@dmarc.ietf.org>>>
>>     >>>     wrote:
>>     >>>
>>     >>>    =     Hi Joel,
>>     >>>
>>     >>>    =     For context: this would only apply when = applications use cleartext
>>     >>>    =     MLSPlaintext for HS messages. The recommendation = is still to
>>     encrypt them
>>     >>>    =     and send them around as MLSCiphertext.
>>     >>>    =     That being said, we said we would like to = support scenarios
>>     where HS
>>     >>>    =     messages are not necessarily encrypted.
>>     >>>
>>     >>>    =     Question: would this attack work with Commit = messages? I=E2=80=99m
>>     thinking that
>>     >>>    =     they would be rejected because the attacker = cannot compute the
>>     >>>    =  confirmation_tag.
>>     >>>
>>     >>>    =     As you mention in the PS, the easy target would = be Proposal
>>     messages.
>>     >>>
>>     >>>    =     I=E2=80=99d be interested to see what exactly = you would propose as a
>>     mitigation
>>     >>>    =     mechanism.
>>     >>>
>>     >>>    =     Raphael
>>     >>>
>>     >>>>     On 18 = Aug 2020, at 16:36, Joel Alwen <jalwen@wickr.com
>>     <mailto:jalwen@wickr.com>
>>     >>>>    =  <mailto:jalwen@wickr.com <mailto:jalwen@wickr.com>>
>>     >>>    =     <mailto:jalwen@wickr.com <mailto:jalwen@wickr.com>>> wrote:
>>     >>>>
>>     >>>>     Hey = everyone,
>>     >>>>
>>     >>>>    =  Something thats been bugging Marta Mularczyk and Daniel Jost = and
>>     me for
>>     >>>>     a bit
>>     >>>>     now is = that handshake messages sent out as MLSPlaintext packets
>>     are only
>>     >>>>    =  authenticated using signatures, but not using the group's key
>>     schedule. For
>>     >>>>    =  non-members that makes sense but for group members that's weaker = than
>>     >>>>     need = be.
>>     >>>>
>>     >>>>     Suppose = Alice is in a group using signing key pair (spk, ssk). I
>>     corrupt
>>     >>>    =     her to
>>     >>>>     learn = ssk. Now I loose access to her device again. Later she
>>     generates a
>>     >>>>     fresh
>>     >>>>     key = package with her same spk but a new HPKE key for her leaf.
>>     She sends
>>     >>>    =     out and
>>     >>>>     update = proposal for her new key package and someone commits to
>>     the update.
>>     >>>>
>>     >>>>     Expected = result: she (and the group at large) has achieved PCS again.
>>     >>>>
>>     >>>>     Actual = result: using her stolen ssk I can still forge a new
>>     proposal's
>>     >>>    =     (sent as
>>     >>>>    =  MLSPlaintext packets) coming from Alice. Some things I could do
>>     with this
>>     >>>    =     power:
>>     >>>>     - I can = generate a new key package kp for Alice using her spk and
>>     some
>>     >>>    =     HPKE key
>>     >>>>     she = doesn't know. Then I forge an update proposal for Alice with
>>     kp. If it
>>     >>>    =     gets
>>     >>>>    =  committed I've effectively kicked her out of the group.
>>     >>>>     - I = could forge Add's and Remove's coming from Alice, so I could
>>     trick the
>>     >>>>     group = into thinking Alice is trying to Add my account to the
>>     group or remove
>>     >>>>     some = other group member.
>>     >>>>
>>     >>>>     Lemme = know if I've missed something here in that scenario...
>>     >>>>
>>     >>>>
>>     >>>>     If I = didn't miss anything and the attacks really work as
>>     advertised then IMO
>>     >>>>     this is = kinda weak sauce and worth avoiding if possible. So to
>>     that end, how
>>     >>>>     about we = modify MLS such that MLSPlaintext packets coming from
>>     group members
>>     >>>>     must = also be authenticated using something from the application key
>>     >>>>    =  schedule.
>>     >>>>     Now the = above attacks fail. As soon as Alice's update is gets
>>     committed I no
>>     >>>>     longer = know the group's key schedule and so can't forged packet from
>>     >>>    =     Alice. More
>>     >>>>    =  generally, this brings the PCS guarantees when using = MLSPlaintexts
>>     >>>>     frameing = in
>>     >>>>     line = with what we're getting from MLSCiphertext packets.
>>     >>>>
>>     >>>>     Any = thoughts?
>>     >>>>
>>     >>>>     - = Jo=C3=ABl
>>     >>>>
>>     >>>>
>>     >>>>
>>     >>>>     PS. For = concreteness, we could probably extend the current
>>     mechanism for
>>     >>>    =     getting
>>     >>>>    =  concistancy (the confirmation_tag) to also provide symmetric = key
>>     >>>    =     authentication.
>>     >>>>     E.g. = include most of the MLSPlaintext content into whats being
>>     tagged by
>>     >>>>    =  confirmation_tag. That would cover the case of a commit packet
>>     and doesn't
>>     >>>    =     even
>>     >>>>     grow the = size of MLSPlaintext packets over the current design.
>>     >>>>
>>     >>>>     For a = proposal packet we could also have a confirmation_tag but
>>     this one is
>>     >>>>     computed = using the *current* epoch's confirmation_key and
>>     >>>    =     confirmed_transcript_hash.
>>     >>>>
>>     >>>>    =  _______________________________________________
>>     >>>>     MLS = mailing list
>>     >>>>     MLS@ietf.org= <mailto:MLS@ietf.org> <mailto:MLS@ietf.org
>>     <mailto:MLS@ietf.org>> <mailto:MLS@ietf.org= <mailto:MLS@ietf.org>>
>>     >>>>     https://www.ietf.org/mailman/listinfo/mls
>>     >>>
>>     >>>    =     _______________________________________________ >>     >>>    =     MLS mailing list
>>     >>>    =     MLS@ietf.org <mailto:MLS@ietf.org> <mailto:MLS@ietf.org
>>     <mailto:MLS@ietf.org>> <mailto:MLS@ietf.org= <mailto:MLS@ietf.org>>
>>     >>>    =     https://www.ietf.org/mailman/listinfo/mls
>>     >
>>
>

= --Apple-Mail=_B4E0D015-E904-4D5B-904F-E8AFDC7DB324-- From nobody Sun Aug 23 00:41:35 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7F5443A08CF for ; Sun, 23 Aug 2020 00:41:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.197 X-Spam-Level: X-Spam-Status: No, score=-0.197 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=Z9bqOLac; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=NcwHHyZS Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsT5M92nYxwF for ; Sun, 23 Aug 2020 00:41:28 -0700 (PDT) Received: from out5-smtp.messagingengine.com (out5-smtp.messagingengine.com [66.111.4.29]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0F1A03A08D1 for ; Sun, 23 Aug 2020 00:41:27 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id A566C5C00E1 for ; Sun, 23 Aug 2020 03:32:37 -0400 (EDT) Received: from mailfrontend2 ([10.202.2.163]) by compute1.internal (MEProxy); Sun, 23 Aug 2020 03:32:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:from:to:subject:message-id:date; s= fm3; bh=cWxwhnz/DUpBx2j3Zxa6xe6jOzJUKBbRR4RY8uydxQY=; b=Z9bqOLac kuj/CjAS63IRn7Tdueb3j197RPyjGVEq+omHeboXsKEW/mjByeke7XuwHoNzgolC ITeGnc40LgUGgLxOhv3rpPjsh6z72eTN1YOweyNIcshm6H3BKT3mbM90c4lOuai5 XYf4vmmvs7yOWKzLx00x+iDGubB4J5apzae977oiPRpZUdJwfj/1yp6oSNgbU/bK v7bAO9imrVEpQGxUmUiuAKo5swBXYiVDR6o5emgu4URc40TFGosMs/joaT4ywtQE Dn5w/4w7RJkDabNiIwROUswNJSl8gTpLkC0azIPi09VZBCTInex1biPLiuRgdsNz f6drPurnd07qwA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=cWxwhnz/DUpBx2j3Zxa6xe6jOzJUK BbRR4RY8uydxQY=; b=NcwHHyZSiqYF4pxKPk4cn3kWiumgJ/KyG8fZz3ZscfeiJ i4Oz7qLDjoCwe4LYl8Auw5gRBFucRwFvQyCDUZM7lCjivRkvwv6M4xhkovw1XZOR 5CoJYhQusrgZ0JPWgEzn5gtEqUcuAzPdNH3XmqZeBOKe9U901BZiQ8ZOkl+hasDY kbxcE+q86Fwrt2BTLBa5YN0kFsdDCax5VF+XPpjsH6eNfT0fxxeMC5KS2+umgbsD ncrTmjWV4JLKVJB99VDYknsskQ/vA4Ridqkk+ZwrD5FD8cRdCz8Wixbit1nEpV0r b3fHx7iemGsMiRk36p9t53xAH2si7+y/fk2o5TP8Q== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrudduhedguddujecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurheptggghffvufesrgdttdertddtje enucfhrhhomheptfgvphhoshhithhorhihucettghtihhvihhthicuufhumhhmrghrhicu uehothcuoeguohgpnhhothgprhgvphhlhiesmhhnohhtrdhnvghtqeenucggtffrrghtth gvrhhnpeekfedvudetjedvfeekheeiveeugfefhfetteevgeffkefffeetffdvleehudei teenucffohhmrghinhepghhithhhuhgsrdgtohhmnecukfhppeehvddrvdehuddruddvhe drvdduudenucevlhhushhtvghrufhiiigvpedunecurfgrrhgrmhepmhgrihhlfhhrohhm peguohgpnhhothgprhgvphhlhiesmhhnohhtrdhnvght X-ME-Proxy: Received: from fv-az184.internal.cloudapp.net (unknown [52.251.125.211]) by mail.messagingengine.com (Postfix) with ESMTPA id 71E24306005F for ; Sun, 23 Aug 2020 03:32:37 -0400 (EDT) Content-Type: multipart/alternative; boundary="===============6578632371236812110==" MIME-Version: 1.0 From: Repository Activity Summary Bot To: mls@ietf.org Message-Id: <20200823073237.71E24306005F@mailuser.nyi.internal> Date: Sun, 23 Aug 2020 03:32:37 -0400 (EDT) Archived-At: Subject: [MLS] Weekly github digest (MLS Working Group summary) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 23 Aug 2020 07:41:30 -0000 --===============6578632371236812110== MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Issues ------ * mlswg/mls-protocol (+0/-1/=F0=9F=92=AC4) 1 issues received 4 new comments: - #392 Is the path secret used as PRK when doing Kdf.Expand? (4 by Bren20= 10, yihuang) https://github.com/mlswg/mls-protocol/issues/392=20 1 issues closed: - impossible to verify the group creation process for the joiner without = knowing the random init_secret that the group creator used https://github.c= om/mlswg/mls-protocol/issues/390=20 Pull requests ------------- * mlswg/mls-protocol (+3/-2/=F0=9F=92=AC2) 3 pull requests submitted: - Always use path secrets with KDF.Expand (by bifurcation) https://github.com/mlswg/mls-protocol/pull/397=20 - Authenticate group membership in MLSPlaintext.Signature (by bifurcation) https://github.com/mlswg/mls-protocol/pull/396=20 - Remove requirement to verify the group creation process (by ericcorneli= ssen) https://github.com/mlswg/mls-protocol/pull/395=20 2 pull requests received 2 new comments: - #397 Always use path secrets with KDF.Expand (1 by ericcornelissen) https://github.com/mlswg/mls-protocol/pull/397=20 - #391 Rename DirectPath to UpdatePath (1 by bifurcation) https://github.com/mlswg/mls-protocol/pull/391=20 2 pull requests merged: - Rename DirectPath to UpdatePath https://github.com/mlswg/mls-protocol/pull/391=20 - Remove requirement to verify the group creation process https://github.com/mlswg/mls-protocol/pull/395=20 Repositories tracked by this digest: ----------------------------------- * https://github.com/mlswg/mls-architecture * https://github.com/mlswg/mls-protocol * https://github.com/mlswg/mls-federation --===============6578632371236812110== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Weekly github digest (MLS Working Group summary)

Sunday August 23, 2020

Issues

mlswg/mls-protocol (+0/-1/=F0=9F=92=AC4)

1 issues received 4 new comments:

1 issues closed:

Pull requests

mlswg/mls-protocol (+3/-2/=F0=9F=92=AC2)

3 pull requests submitted:

2 pull requests received 2 new comments:

2 pull requests merged:

Repositories tracked by this digest:

--===============6578632371236812110==-- From nobody Mon Aug 24 12:28:18 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 456223A0A38 for ; Mon, 24 Aug 2020 12:28:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.199 X-Spam-Level: X-Spam-Status: No, score=-0.199 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=sn3rd.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HR0ww1l56cWv for ; Mon, 24 Aug 2020 12:28:14 -0700 (PDT) Received: from mail-qt1-x830.google.com (mail-qt1-x830.google.com [IPv6:2607:f8b0:4864:20::830]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 870CE3A0A2E for ; Mon, 24 Aug 2020 12:28:14 -0700 (PDT) Received: by mail-qt1-x830.google.com with SMTP id t23so7142629qto.3 for ; Mon, 24 Aug 2020 12:28:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sn3rd.com; s=google; h=from:content-transfer-encoding:mime-version:subject:message-id:date :to; bh=4rH6ruPEs/YzO1uDkUgfvYDC+EUcew0lcubG9JFUrDY=; b=bzBKS95KWUzjjNPN6zuFGeJNrnfu8C2p81gr7FxLmO6m9mRci6kvVSg/zdd+jlHwuv X+0877SvEBRhPzzoniJEY5GebIC6Sa/Ym0uDTFvqickMQhgmCCpYvWd3oDgraO3XPB1h RwCWqLav6xt07YeVbCvNjsoaETDa1oA2zDtRk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:content-transfer-encoding:mime-version :subject:message-id:date:to; bh=4rH6ruPEs/YzO1uDkUgfvYDC+EUcew0lcubG9JFUrDY=; b=JK+A+GSaLqXC7ZAn5sqjwSp9OQlvqcPO5yE+T5XN2uHJxPXPF5AfqxOhr791j63HSi UriwUnbYzppib+B9RTyfUFrj3uajqQ3QzbvtKx5VrIFGjqD2HHBNBMvYV01feHTzbDY3 N4FvsmgqKztkPvgnVNzU/TT3rXPAo+tOjGu84z1G0tMlL4A9M9jUN2zVEuB/eebz6puj 0JvH94MxeizPQzqqv6ck4DdV3IIY9ZhfD9YXqCdPP1GiGOxcQWoKA628W9oN6olUbXuX UuT6ZOq7fFMsytz0ORO7LeRXp9t/4g60axwnVaTMPwunc+Bd35D4MElkR3EQ3fVmYHnb A1HA== X-Gm-Message-State: AOAM533HzngDABrZu3aCER0cgY8XVoiW/xpukWC1RF3kzTFyZ/cC3S7M 5ByhRp8PGb3ZOe49hA4CszNTzUrrYs8eKQ== X-Google-Smtp-Source: ABdhPJz8JQuoA38gOsXlBM1X30TYLNeFa228qmuAERRRLCcEHtbgRa15YVIPam6A3T+W3i+YT5U5ew== X-Received: by 2002:aed:2ca2:: with SMTP id g31mr5484557qtd.82.1598297288967; Mon, 24 Aug 2020 12:28:08 -0700 (PDT) Received: from [192.168.1.152] (pool-108-31-39-252.washdc.fios.verizon.net. [108.31.39.252]) by smtp.gmail.com with ESMTPSA id z10sm11706156qtf.24.2020.08.24.12.28.07 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 24 Aug 2020 12:28:07 -0700 (PDT) From: Sean Turner Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\)) Message-Id: <09DAE9AC-3E4D-4493-BFA2-B8DBFB50A398@sn3rd.com> Date: Mon, 24 Aug 2020 15:27:50 -0400 To: MLS List X-Mailer: Apple Mail (2.3608.120.23.2.1) Archived-At: Subject: [MLS] 20200825 MLS WG Virtual Interim X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Aug 2020 19:28:16 -0000 Hi! We are having a virtual interim Tuesday 25 August 2020 at 1600 UTC. = Webex details can be found here: https://datatracker.ietf.org/meeting/interim-2020-mls-19/session/mls Our agenda is to address protocol related issues and PRs. Outstanding = Issues and PRs can be found here: https://github.com/mlswg/mls-protocol Nick and Sean= From nobody Tue Aug 25 12:04:37 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8EF3A3A0840 for ; Tue, 25 Aug 2020 12:04:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.004 X-Spam-Level: X-Spam-Status: No, score=0.004 tagged_above=-999 required=5 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=ipv-sx.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6Dh3Z0qEByjR for ; Tue, 25 Aug 2020 12:04:30 -0700 (PDT) Received: from mail-qk1-x72e.google.com (mail-qk1-x72e.google.com [IPv6:2607:f8b0:4864:20::72e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 781A23A083F for ; Tue, 25 Aug 2020 12:04:30 -0700 (PDT) Received: by mail-qk1-x72e.google.com with SMTP id z3so7755277qkz.7 for ; Tue, 25 Aug 2020 12:04:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipv-sx.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=ES7FkKmTb1zeBgbtPaX9gam5c1ubG4T/UGzvfbU/WtQ=; b=YMT3IGP+uQCsxQZYo9WNSAyyMGTEoRcI3xFeBG61nsyZY+r8BCyZpsd52S9ctMs3Px Njh11ubQZAj4N4Xsy1bmv548VPd/aEzJ8VZA4LGcpVECbPEtlZiOqtywLAwIrofUYKef /4GcARn/rYSHXm5W2MBYRT7Nwvd7JCCQ6UNZmGOOkJSzdPoaL+zqdgQgWnPAE8t768L+ 5XDgjTle3HJVxnwFIu3YD+dyHttRma4lXhusNAj7phXq8nWiTib81d8SkTKkrUR23vKo FsV3rAlXFTDirEb61XQGZygKQWV/I6AKuitRNAUpx9TucS/z4zXyi86cQStVC16y/wmh +KuQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=ES7FkKmTb1zeBgbtPaX9gam5c1ubG4T/UGzvfbU/WtQ=; b=bVdh2F7nZghixV9kcF7kKPx1gZxAX4kbs4yAT8z/LdkgxdPqtQtUS33wLAJUyyeLKl aarR2Co5NSbyvZIKAsf55fp2O/9RvwzdwgKOEXjdPIHjKS/NJagF1QYtful5hq/4BzCo 8wWrTgZmeQYIIYoKGbNA2KkndQEdb1xzJIMkJFTjoAb9IXEm7gelfDOKJRhgda5Hek4a Apl9ZIYGW8wGmXnJ3HqpEF/dehkaQ/7Z/WBkXu9hGVIY1E9V6iKt+0+3foox/XVBRzh3 754S/feEaQUcGlw7y2NTt6whEqoI2TNRvz1+TABmsBxhh2UXXGigJP5eu5EWAomIPej5 5pZA== X-Gm-Message-State: AOAM531s5zaeJavGZoPyO2k4AJOTkM+9+Lhaas2O1GUT5Okx5IcWh7nc soirgoWEeV8UA8q7s0ItHGnLiR+vSpDyQBwkt2hdMA== X-Google-Smtp-Source: ABdhPJwt/6MXfmg/LbXhF1l3KkNhBECqI0Qdewjcxwwx9ehGcizZvs+N7IRtF8tHVAY5MgFQMp5oMxQqam6oKa2Ecmg= X-Received: by 2002:a37:84d:: with SMTP id 74mr10608907qki.490.1598382268890; Tue, 25 Aug 2020 12:04:28 -0700 (PDT) MIME-Version: 1.0 References: <7d7283b6-8c70-d045-81c2-f552219869ad@wickr.com> <87d72ad5-dce9-18f7-f1c4-7a8317fd0739@wickr.com> <30DD617C-A8A8-4801-A62A-43A722B1B597@wire.com> <26970E9E-6EED-46D5-BD5D-8E1ADB40A93F@wire.com> <1bd2268c-7f27-e24a-bcd7-3192afae13c9@wickr.com> <5E549D21-1DE7-4F55-9EC6-A64128957950@wire.com> In-Reply-To: <5E549D21-1DE7-4F55-9EC6-A64128957950@wire.com> From: Richard Barnes Date: Tue, 25 Aug 2020 15:03:58 -0400 Message-ID: To: Raphael Robert Cc: Joel Alwen , Messaging Layer Security WG Content-Type: multipart/alternative; boundary="0000000000005a626a05adb85fc1" Archived-At: Subject: Re: [MLS] MLSPlaintext packets aren't authenticated using symmetric key schedule X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 25 Aug 2020 19:04:35 -0000 --0000000000005a626a05adb85fc1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable To close the loop on context: As mentioned on the call, the content of the GroupContext is public, so it shouldn't interfere with the DS verifying signatures. After the discussion on the interim call today, I made two updates to this PR: 1. Use an explicit MAC and separate keys https://github.com/mlswg/mls-protocol/pull/396/commits/10e1ba799e44a7e858d7= 832ec5c6c39bd214010a 2. Have the membership MAC cover the signature https://github.com/mlswg/mls-protocol/pull/396/commits/52a06e4021d654c60afe= a85681f4cb2c91bd05f1 We didn't really close on the latter change on the call, but it seems like it adds a bit more rigidity than the parallel MAC-and-Sign construction we had before, and makes things more parallel to MLSCiphertext. (Puts me in mind of the encrypt-then-MAC / MAC-then-encrypt / encrypt-and-MAC discussions of yore.) On Fri, Aug 21, 2020 at 5:49 AM Raphael Robert wrote: > Thanks Richard, I think this now meets all requirements as such. However, > I stumbled upon the (group) context field that is already in > MLSPlaintextTBS. Wouldn=E2=80=99t this > > a) mean that the server cannot verify a signature of a member, since the > group context is not known outside of the group? > b) address Joel=E2=80=99s concerns in the first place? > > I=E2=80=99m a bit confused as to what the intention was initially when we > introduced that. Right now it doesn=E2=80=99t seem to serve any extra pur= pose and I > think we could remove it. > > Raphael > > On 20 Aug 2020, at 20:55, Richard Barnes wrote: > > On Thu, Aug 20, 2020 at 10:20 AM Joel Alwen wrote: > >> Yeah, good point. While I'm not sure every case of server inspection wou= ld >> require checking sigs on packets I am sure it would be useful for some >> cases. >> >> > The obvious fix is to include the membership_token in MLSPlaintext as >> well. >> >> Yup, I'm all for it. (Or at least for making it an optional field in tha= t >> struct.) >> > > The PR has been updated. There is now a member_token field before the > signature, which non-member senders set to zero length. > > https://github.com/mlswg/mls-protocol/pull/396/files > > Note that this allows the server to verify the signature, but the > membership_token is opaque to it; the server can't authenticate the > sender's membership. > > --Richard > > >> >> - Jo=C3=ABl >> >> On 19/08/2020 09:24, Raphael Robert wrote: >> > I thought about this some more and now I=E2=80=99m not sure that the >> membership_token >> > should only be implicit: >> > >> > The whole reason for HS messages to not be encrypted is that they can = be >> > inspected along the way by an external party (e.g. the Delivery >> Service). If >> > this is not a requirement, MLSCiphertext should really be used instead= . >> > Hiding the membership_token from external inspector means the inspecto= r >> can not >> > verify the signature anymore. I think that defies the point of HS >> messages being >> > inspectable. >> > >> > The obvious fix is to include the membership_token in MLSPlaintext as >> well. >> > >> > Raphael >> > >> >> On 18 Aug 2020, at 21:01, Richard Barnes > rlb@ipv.sx>> wrote: >> >> >> >> Here ya go: https://github.com/mlswg/mls-protocol/pull/396 >> >> >> >> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen > >> > wrote: >> >> >> >> > Jo=C3=ABl, do you want to write a PR? If not, I could probably= get >> to it in the >> >> > next couple days. >> >> >> >> Thanks. :-) If you could that would be really nice. >> >> >> >> - Jo=C3=ABl >> >> >> >> On 18/08/2020 19:20, Richard Barnes wrote: >> >> > Sounds like we're converging here. The only question in my min= d >> is what >> >> goes in >> >> > the MAC -- seems like the easy option is probably "the remainde= r >> of the >> >> > MLSPlaintextTBS", i.e., everything from group_id to the end. >> That seems >> >> like it >> >> > minimizes multiple serialization: >> >> > >> >> > tbs_content =3D serialize(group_id, ...) >> >> > membership_token =3D KDF.Extract(confirmation_key, tbs_content) >> >> > tbs =3D group_context || membership_token || tbs_content >> >> > >> >> > So the PR would be to basically pop the context off of >> MLSPlaintextTBS >> >> and add >> >> > the three lines above (with the switch for internal/external in >> prose). >> >> > >> >> > Jo=C3=ABl, do you want to write a PR? If not, I could probably= get >> to it in >> >> the next >> >> > couple days. >> >> > >> >> > --Richard >> >> > >> >> > On Tue, Aug 18, 2020 at 12:24 PM Raphael Robert < >> raphael@wire.com >> >> >> >> > >> wrote: >> >> > >> >> > I think what you just described is indeed a combination of >> option 1 & 2. >> >> > It=E2=80=99s a MAC over the payload we want to authenticate= , but it=E2=80=99s >> >> implicit and >> >> > we only include it in the MLSPlaintextTBS. Or in other >> words, we >> >> stripped it >> >> > from MLSPlaintext because it is implicitly known to any >> valid member >> >> of the >> >> > group. >> >> > >> >> > Raphael >> >> > >> >> >> On 18 Aug 2020, at 18:16, Joel Alwen > >> >> >> >> >> wrote= : >> >> >> >> >> >> Yeah, I like Option 2 here. I like that it avoids growing >> packet size. >> >> >> >> >> >> One caveat though: I'd go for the MAC(...) version rather >> than the >> >> >> confirmation_key. For starters thing including >> confirmation_key doesnt >> >> >> authenticate the contents of the packet. But even if it di= d, >> >> signatures aren't >> >> >> meant to hide the contents of what was signed. (Amend you >> favorite sig >> >> >> scheme to >> >> >> tack on the message at the end a signature and you've stil= l >> got a >> >> secure >> >> >> signature scheme. But clearly not a message hiding one.) >> That means >> >> that AFAIK >> >> >> neither ECDSA nor EdDSA etc. were designed or analyzed for >> such a >> >> property. So >> >> >> this would amount to a very non-standard use of a signatur= e >> schemes by >> >> >> MLS. Not >> >> >> saying it doesn't work for the particular sig schemes in o= ur >> >> ciphersuite. But >> >> >> its def. not how signatures are "meant" to be used. >> >> >> >> >> >> But that leaves Option 2 with, say, including tag =3D >> MAC(conf_key, >> >> >> conf_trans_hash || MLSPlaintext.content) into whats being >> signed >> >> which I like >> >> >> and think gets the job done. Both conf_* values are taken >> from the >> >> current >> >> >> epoch. By MLSPlaintext.content I mean whats now called >> MLSPlaintextTBS. >> >> >> >> >> >>> I would propose that we do need something additional on >> Commit >> >> messages as >> >> >>> well as Proposals. >> >> >> >> >> >> @Richard: For Proopsals I think this works. Is that about >> what you >> >> had in mind >> >> >> for commits too? >> >> >> >> >> >> - Jo=C3=ABl >> >> >> >> >> >> >> >> >> On 18/08/2020 17:26, Richard Barnes wrote: >> >> >>> Thanks for pointing this out, Jo=C3=ABl. I agree that th= e >> attacks you're >> >> >>> describing >> >> >>> should work as things are currently specified. And >> they're salient, >> >> >>> especially >> >> >>> the "replace Alice in the group" one. >> >> >>> >> >> >>> Also agree with Raphael is correct that Commit is not >> affected by >> >> this, since >> >> >>> someone who is not a member won't be able to generate the >> right >> >> confirmation >> >> >>> value. However, I don't think this is actually the right >> design >> >> to adopt >> >> >>> for a >> >> >>> general solution to this problem. Confirmation verifies >> group >> >> membership >> >> >>> *after* processing the handshake message; the point here >> is that we >> >> >>> should also >> >> >>> have a membership check *before* processing handshake >> messages. In >> >> >>> particular, >> >> >>> I would propose that we do need something additional on >> Commit >> >> messages >> >> >>> as well >> >> >>> as Proposals. >> >> >>> >> >> >>> Thinking about solutions here, a couple of options come t= o >> mind: >> >> >>> >> >> >>> 1. Use MLSCiphertext, but with an integrity-only >> encapsulation >> >> >>> 2. Incorporate in the signature something that is only >> known to >> >> the group >> >> >>> (e.g., >> >> >>> confirmation_key or MAC(confirmation_key; >> confirmed_transcript_hash || >> >> >>> Proposal/Commit)) >> >> >>> >> >> >>> Option (1) has the appeal that you would only ever send >> >> MLSCiphertext, though >> >> >>> switching between encrypted/not could be problematic. >> Option (2) >> >> seems a lot >> >> >>> more appealing: It doesn't add any overhead, since the >> >> group-secret value >> >> >>> doesn't need to be sent. And we already switch between t= he >> >> signature context >> >> >>> that is added for group members vs. external. In fact, I >> think option >> >> >>> (2) would >> >> >>> just amount to a one-line change to include an extra, >> secret value >> >> in the >> >> >>> context at the top of the MLSPlaintextTBS struct. >> >> >>> >> >> >> https://github.com/mlswg/mls-protocol/blob/master/draft-ietf-mls-protoco= l.md#content-signing-and-encryption >> >> >>> >> >> >>> The only thing that seems odd about (2) is overloading >> signature >> >> >>> verification in >> >> >>> that way, i.e., using the ability to generate a signature >> over a >> >> secret >> >> >>> thing to >> >> >>> prove you know the secret thing. That doesn't seem >> obviously >> >> flawed to >> >> >>> me, but >> >> >>> worth thinking about. >> >> >>> >> >> >>> Does that make sense to folks? >> >> >>> >> >> >>> --Richard >> >> >>> >> >> >>> >> >> >>> On Tue, Aug 18, 2020 at 10:55 AM Raphael Robert >> >> >>> > 40wire.com@dmarc.ietf.org> >> >> >>> =3D40wire.com@dmarc.ietf.= org >> >> > > 40wire.com@dmarc.ietf.org >> >> >> >> >> >>> wrote: >> >> >>> >> >> >>> Hi Joel, >> >> >>> >> >> >>> For context: this would only apply when applications >> use cleartext >> >> >>> MLSPlaintext for HS messages. The recommendation is >> still to >> >> encrypt them >> >> >>> and send them around as MLSCiphertext. >> >> >>> That being said, we said we would like to support >> scenarios >> >> where HS >> >> >>> messages are not necessarily encrypted. >> >> >>> >> >> >>> Question: would this attack work with Commit messages? >> I=E2=80=99m >> >> thinking that >> >> >>> they would be rejected because the attacker cannot >> compute the >> >> >>> confirmation_tag. >> >> >>> >> >> >>> As you mention in the PS, the easy target would be >> Proposal >> >> messages. >> >> >>> >> >> >>> I=E2=80=99d be interested to see what exactly you woul= d propose >> as a >> >> mitigation >> >> >>> mechanism. >> >> >>> >> >> >>> Raphael >> >> >>> >> >> >>>> On 18 Aug 2020, at 16:36, Joel Alwen > >> >> >> >>>> > >> >> >>> >> >> wrote: >> >> >>>> >> >> >>>> Hey everyone, >> >> >>>> >> >> >>>> Something thats been bugging Marta Mularczyk and Daniel >> Jost and >> >> me for >> >> >>>> a bit >> >> >>>> now is that handshake messages sent out as MLSPlaintext >> packets >> >> are only >> >> >>>> authenticated using signatures, but not using the group'= s >> key >> >> schedule. For >> >> >>>> non-members that makes sense but for group members that'= s >> weaker than >> >> >>>> need be. >> >> >>>> >> >> >>>> Suppose Alice is in a group using signing key pair (spk, >> ssk). I >> >> corrupt >> >> >>> her to >> >> >>>> learn ssk. Now I loose access to her device again. Later >> she >> >> generates a >> >> >>>> fresh >> >> >>>> key package with her same spk but a new HPKE key for her >> leaf. >> >> She sends >> >> >>> out and >> >> >>>> update proposal for her new key package and someone >> commits to >> >> the update. >> >> >>>> >> >> >>>> Expected result: she (and the group at large) has >> achieved PCS again. >> >> >>>> >> >> >>>> Actual result: using her stolen ssk I can still forge a >> new >> >> proposal's >> >> >>> (sent as >> >> >>>> MLSPlaintext packets) coming from Alice. Some things I >> could do >> >> with this >> >> >>> power: >> >> >>>> - I can generate a new key package kp for Alice using he= r >> spk and >> >> some >> >> >>> HPKE key >> >> >>>> she doesn't know. Then I forge an update proposal for >> Alice with >> >> kp. If it >> >> >>> gets >> >> >>>> committed I've effectively kicked her out of the group. >> >> >>>> - I could forge Add's and Remove's coming from Alice, so >> I could >> >> trick the >> >> >>>> group into thinking Alice is trying to Add my account to >> the >> >> group or remove >> >> >>>> some other group member. >> >> >>>> >> >> >>>> Lemme know if I've missed something here in that >> scenario... >> >> >>>> >> >> >>>> >> >> >>>> If I didn't miss anything and the attacks really work as >> >> advertised then IMO >> >> >>>> this is kinda weak sauce and worth avoiding if possible. >> So to >> >> that end, how >> >> >>>> about we modify MLS such that MLSPlaintext packets comin= g >> from >> >> group members >> >> >>>> must also be authenticated using something from the >> application key >> >> >>>> schedule. >> >> >>>> Now the above attacks fail. As soon as Alice's update is >> gets >> >> committed I no >> >> >>>> longer know the group's key schedule and so can't forged >> packet from >> >> >>> Alice. More >> >> >>>> generally, this brings the PCS guarantees when using >> MLSPlaintexts >> >> >>>> frameing in >> >> >>>> line with what we're getting from MLSCiphertext packets. >> >> >>>> >> >> >>>> Any thoughts? >> >> >>>> >> >> >>>> - Jo=C3=ABl >> >> >>>> >> >> >>>> >> >> >>>> >> >> >>>> PS. For concreteness, we could probably extend the curre= nt >> >> mechanism for >> >> >>> getting >> >> >>>> concistancy (the confirmation_tag) to also provide >> symmetric key >> >> >>> authentication. >> >> >>>> E.g. include most of the MLSPlaintext content into whats >> being >> >> tagged by >> >> >>>> confirmation_tag. That would cover the case of a commit >> packet >> >> and doesn't >> >> >>> even >> >> >>>> grow the size of MLSPlaintext packets over the current >> design. >> >> >>>> >> >> >>>> For a proposal packet we could also have a >> confirmation_tag but >> >> this one is >> >> >>>> computed using the *current* epoch's confirmation_key an= d >> >> >>> confirmed_transcript_hash. >> >> >>>> >> >> >>>> _______________________________________________ >> >> >>>> MLS mailing list >> >> >>>> MLS@ietf.org > >> > = > >> >> >>>> https://www.ietf.org/mailman/listinfo/mls >> >> >>> >> >> >>> _______________________________________________ >> >> >>> MLS mailing list >> >> >>> MLS@ietf.org > >> > = > >> >> >>> https://www.ietf.org/mailman/listinfo/mls >> >> > >> >> >> > >> > > --0000000000005a626a05adb85fc1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
To close the loop on context: As mentioned on the cal= l, the content of the GroupContext is public, so it shouldn't interfere= with the DS verifying signatures.

After the discu= ssion on the interim call today, I made two updates to this PR:
We didn't really close on the latter change on the call, b= ut it seems like it adds a bit more rigidity than the parallel MAC-and-Sign= construction we had before, and makes things more parallel to MLSCiphertex= t.=C2=A0 (Puts me in mind of the encrypt-then-MAC / MAC-then-encrypt / encr= ypt-and-MAC discussions of yore.)

On Fri, Aug 21, 2020 at 5:49 AM = Raphael Robert <raphael@wire.com= > wrote:
Thanks Richard, I think this now meet= s all requirements as such. However, I stumbled upon the (group) context fi= eld that is already in MLSPlaintextTBS. Wouldn=E2=80=99t this

a) mean that the server = cannot verify a signature of a member, since the group context is not known= outside of the group?
b) address Joel=E2=80=99s concerns in the first place?

I=E2=80=99m a bit confused as to what the intention was initially w= hen we introduced that. Right now it doesn=E2=80=99t seem to serve any extr= a purpose and I think we could remove it.

Raphael<= br>

On 20 Aug 2020, at 20:55, Richar= d Barnes <rlb@ipv.sx= > wrote:

On Thu, Aug 20,= 2020 at 10:20 AM Joel Alwen <jalwen@wickr.com> wrote:
Yeah, good point. Wh= ile I'm not sure every case of server inspection would
require checking sigs on packets I am sure it would be useful for some case= s.

> The obvious fix is to include the membership_token in MLSPlaintext as = well.

Yup, I'm all for it. (Or at least for making it an optional field in th= at struct.)

The PR has been updated.=C2= =A0 There is now a member_token field before the signature, which non-membe= r senders set to zero length.


Note = that this allows the server to verify the signature, but the membership_tok= en is opaque to it; the server can't authenticate the sender's memb= ership.

--Richard=C2=A0
=C2=A0

- Jo=C3=ABl

On 19/08/2020 09:24, Raphael Robert wrote:
> I thought about this some more and now I=E2=80=99m not sure that the m= embership_token
> should only be implicit:
>
> The whole reason for HS messages to not be encrypted is that they can = be
> inspected along the way by an external party (e.g. the Delivery Servic= e). If
> this is not a requirement, MLSCiphertext should really be used instead= .
> Hiding the membership_token from external inspector means the inspecto= r can not
> verify the signature anymore. I think that defies the point of HS mess= ages being
> inspectable.
>
> The obvious fix is to include the membership_token in MLSPlaintext as = well.
>
> Raphael
>
>> On 18 Aug 2020, at 21:01, Richard Barnes <rlb@ipv.sx <mailto:rlb@ipv.sx>> wrote:
>>
>> Here ya go: https://github.com/mlswg/mls-prot= ocol/pull/396
>>
>> On Tue, Aug 18, 2020 at 1:30 PM Joel Alwen <jalwen@wickr.com
>> <mailto:j= alwen@wickr.com>> wrote:
>>
>>=C2=A0 =C2=A0 =C2=A0> Jo=C3=ABl, do you want to write a PR?=C2= =A0 If not, I could probably get to it in the
>>=C2=A0 =C2=A0 =C2=A0> next couple days.
>>
>>=C2=A0 =C2=A0 =C2=A0Thanks. :-) If you could that would be really n= ice.
>>
>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>
>>=C2=A0 =C2=A0 =C2=A0On 18/08/2020 19:20, Richard Barnes wrote:
>>=C2=A0 =C2=A0 =C2=A0> Sounds like we're converging here.=C2= =A0 The only question in my mind is what
>>=C2=A0 =C2=A0 =C2=A0goes in
>>=C2=A0 =C2=A0 =C2=A0> the MAC -- seems like the easy option is p= robably "the remainder of the
>>=C2=A0 =C2=A0 =C2=A0> MLSPlaintextTBS", i.e., everything fr= om group_id to the end.=C2=A0 That seems
>>=C2=A0 =C2=A0 =C2=A0like it
>>=C2=A0 =C2=A0 =C2=A0> minimizes multiple serialization:
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> tbs_content =3D serialize(group_id, ...) >>=C2=A0 =C2=A0 =C2=A0> membership_token =3D KDF.Extract(confirmat= ion_key, tbs_content)
>>=C2=A0 =C2=A0 =C2=A0> tbs =3D group_context || membership_token = || tbs_content
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> So the PR would be to basically pop the co= ntext off of MLSPlaintextTBS
>>=C2=A0 =C2=A0 =C2=A0and add
>>=C2=A0 =C2=A0 =C2=A0> the three lines above (with the switch for= internal/external in prose).
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> Jo=C3=ABl, do you want to write a PR?=C2= =A0 If not, I could probably get to it in
>>=C2=A0 =C2=A0 =C2=A0the next
>>=C2=A0 =C2=A0 =C2=A0> couple days.
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> --Richard
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0> On Tue, Aug 18, 2020 at 12:24 PM Raphael R= obert <raphael@wir= e.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:raphael@wire.com>
>>=C2=A0 =C2=A0 =C2=A0> <mailto:raphael@wire.com <mailto:raphael@wire.com>>> wrote: >>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0I think what you just d= escribed is indeed a combination of option 1 & 2.
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0It=E2=80=99s a MAC over= the payload we want to authenticate, but it=E2=80=99s
>>=C2=A0 =C2=A0 =C2=A0implicit and
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0we only include it in t= he MLSPlaintextTBS. Or in other words, we
>>=C2=A0 =C2=A0 =C2=A0stripped it
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0from MLSPlaintext becau= se it is implicitly known to any valid member
>>=C2=A0 =C2=A0 =C2=A0of the
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0group.
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>=C2=A0 =C2=A0 =C2=A0Raphael
>>=C2=A0 =C2=A0 =C2=A0>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2020, at = 18:16, Joel Alwen <jalwen@wickr.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com <mai= lto:jalwen@wickr.com<= /a>>>> wrote:
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0Yeah, I like Option= 2 here. I like that it avoids growing packet size.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0One caveat though: = I'd go for the MAC(...) version rather than the
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0confirmation_key. F= or starters thing including confirmation_key doesnt
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0authenticate the co= ntents of the packet. But even if it did,
>>=C2=A0 =C2=A0 =C2=A0signatures aren't
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0meant to hide the c= ontents of what was signed. (Amend you favorite sig
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0scheme to
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0tack on the message= at the end a signature and you've still got a
>>=C2=A0 =C2=A0 =C2=A0secure
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0signature scheme. B= ut clearly not a message hiding one.) That means
>>=C2=A0 =C2=A0 =C2=A0that AFAIK
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0neither ECDSA nor E= dDSA etc. were designed or analyzed for such a
>>=C2=A0 =C2=A0 =C2=A0property. So
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0this would amount t= o a very non-standard use of a signature schemes by
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0MLS. Not
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0saying it doesn'= ;t work for the particular sig schemes in our
>>=C2=A0 =C2=A0 =C2=A0ciphersuite. But
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0its def. not how si= gnatures are "meant" to be used.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0But that leaves Opt= ion 2 with, say, including tag =3D MAC(conf_key,
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0conf_trans_hash || = MLSPlaintext.content) into whats being signed
>>=C2=A0 =C2=A0 =C2=A0which I like
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0and think gets the = job done. Both conf_* values are taken from the
>>=C2=A0 =C2=A0 =C2=A0current
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0epoch. By MLSPlaint= ext.content I mean whats now called MLSPlaintextTBS.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0I would propose= that we do need something additional on Commit
>>=C2=A0 =C2=A0 =C2=A0messages as
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0well as Proposa= ls.
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0@Richard: For Proop= sals I think this works. Is that about what you
>>=C2=A0 =C2=A0 =C2=A0had in mind
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0for commits too? >>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>
>>=C2=A0 =C2=A0 =C2=A0>>=C2=A0 =C2=A0 =C2=A0On 18/08/2020 17:26= , Richard Barnes wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Thanks for poin= ting this out, Jo=C3=ABl.=C2=A0 I agree that the attacks you're
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0describing
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0should work as = things are currently specified.=C2=A0 And they're salient,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0especially
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0the "repla= ce Alice in the group" one.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Also agree with= Raphael is correct that Commit is not affected by
>>=C2=A0 =C2=A0 =C2=A0this, since
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0someone who is = not a member won't be able to generate the right
>>=C2=A0 =C2=A0 =C2=A0confirmation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0value.=C2=A0 Ho= wever, I don't think this is actually the right design
>>=C2=A0 =C2=A0 =C2=A0to adopt
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0for a
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0general solutio= n to this problem.=C2=A0 Confirmation verifies group
>>=C2=A0 =C2=A0 =C2=A0membership
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0*after* process= ing the handshake message; the point here is that we
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0should also
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0have a membersh= ip check *before* processing handshake messages.=C2=A0 In
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0particular,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0I would propose= that we do need something additional on Commit
>>=C2=A0 =C2=A0 =C2=A0messages
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0as well
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0as Proposals. >>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Thinking about = solutions here, a couple of options come to mind:
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A01. Use MLSCiphe= rtext, but with an integrity-only encapsulation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A02. Incorporate = in the signature something that is only known to
>>=C2=A0 =C2=A0 =C2=A0the group
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0(e.g.,
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0confirmation_ke= y or MAC(confirmation_key; confirmed_transcript_hash ||
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Proposal/Commit= ))
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Option (1) has = the appeal that you would only ever send
>>=C2=A0 =C2=A0 =C2=A0MLSCiphertext, though
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0switching betwe= en encrypted/not could be problematic.=C2=A0 Option (2)
>>=C2=A0 =C2=A0 =C2=A0seems a lot
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0more appealing:= It doesn't add any overhead, since the
>>=C2=A0 =C2=A0 =C2=A0group-secret value
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0doesn't nee= d to be sent.=C2=A0 And we already switch between the
>>=C2=A0 =C2=A0 =C2=A0signature context
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0that is added f= or group members vs. external.=C2=A0 In fact, I think option
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0(2) would
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0just amount to = a one-line change to include an extra, secret value
>>=C2=A0 =C2=A0 =C2=A0in the
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0context at the = top of the MLSPlaintextTBS struct.
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0
>>=C2=A0 =C2=A0 =C2=A0=C2=A0https://github.com/mlswg/mls-proto= col/blob/master/draft-ietf-mls-protocol.md#content-signing-and-encryption
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0The only thing = that seems odd about (2) is overloading signature
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0verification in=
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0that way, i.e.,= using the ability to generate a signature over a
>>=C2=A0 =C2=A0 =C2=A0secret
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0thing to
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0prove you know = the secret thing.=C2=A0 That doesn't seem obviously
>>=C2=A0 =C2=A0 =C2=A0flawed to
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0me, but
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0worth thinking = about.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0Does that make = sense to folks?
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0--Richard
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0On Tue, Aug 18,= 2020 at 10:55 AM Raphael Robert
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0<raphael=3D<= a href=3D"mailto:40wire.com@dmarc.ietf.org" target=3D"_blank">40wire.com@dm= arc.ietf.org <mailto:40wire.com@dmarc.ietf.org>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0<mailto:raphael <mailto:raphael>=3D40wire.com@dmarc.ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:40wire.com@dmarc.ietf.org>>=C2=A0<m= ailto:40wire= .com@dmarc.ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:40wire.com@dmarc.ietf.org>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Hi Joel,
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0For context: this would only apply when applications use cleartext
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLSPlaintext for HS messages. The recommendation is still to
>>=C2=A0 =C2=A0 =C2=A0encrypt them
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0and send them around as MLSCiphertext.
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0That being said, we said we would like to support scenarios
>>=C2=A0 =C2=A0 =C2=A0where HS
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0messages are not necessarily encrypted.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Question: would this attack work with Commit messages? I=E2=80=99m
>>=C2=A0 =C2=A0 =C2=A0thinking that
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0they would be rejected because the attacker cannot compute the
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0confirmation_ta= g.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0As you mention in the PS, the easy target would be Proposal
>>=C2=A0 =C2=A0 =C2=A0messages.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0I=E2=80=99d be interested to see what exactly you would propose as a
>>=C2=A0 =C2=A0 =C2=A0mitigation
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0mechanism.
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Raphael
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0On 18 Aug 2= 020, at 16:36, Joel Alwen <jalwen@wickr.com
>>=C2=A0 =C2=A0 =C2=A0<mailto:jalwen@wickr.com>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0<mailto:= jalwen@wickr.com = <mailto:jalwen@wic= kr.com>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0<mailto:jalwen@= wickr.com <mailto:jalwen@wickr.com>>> wrote:
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Hey everyon= e,
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Something t= hats been bugging Marta Mularczyk and Daniel Jost and
>>=C2=A0 =C2=A0 =C2=A0me for
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0a bit
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0now is that= handshake messages sent out as MLSPlaintext packets
>>=C2=A0 =C2=A0 =C2=A0are only
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0authenticat= ed using signatures, but not using the group's key
>>=C2=A0 =C2=A0 =C2=A0schedule. For
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0non-members= that makes sense but for group members that's weaker than
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0need be. >>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Suppose Ali= ce is in a group using signing key pair (spk, ssk). I
>>=C2=A0 =C2=A0 =C2=A0corrupt
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0her to
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0learn ssk. = Now I loose access to her device again. Later she
>>=C2=A0 =C2=A0 =C2=A0generates a
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0fresh
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0key package= with her same spk but a new HPKE key for her leaf.
>>=C2=A0 =C2=A0 =C2=A0She sends
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0out and
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0update prop= osal for her new key package and someone commits to
>>=C2=A0 =C2=A0 =C2=A0the update.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Expected re= sult: she (and the group at large) has achieved PCS again.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Actual resu= lt: using her stolen ssk I can still forge a new
>>=C2=A0 =C2=A0 =C2=A0proposal's
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0(sent as
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLSPlaintex= t packets) coming from Alice. Some things I could do
>>=C2=A0 =C2=A0 =C2=A0with this
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0power:
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- I can gen= erate a new key package kp for Alice using her spk and
>>=C2=A0 =C2=A0 =C2=A0some
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0HPKE key
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0she doesn&#= 39;t know. Then I forge an update proposal for Alice with
>>=C2=A0 =C2=A0 =C2=A0kp. If it
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0gets
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0committed I= 've effectively kicked her out of the group.
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- I could f= orge Add's and Remove's coming from Alice, so I could
>>=C2=A0 =C2=A0 =C2=A0trick the
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0group into = thinking Alice is trying to Add my account to the
>>=C2=A0 =C2=A0 =C2=A0group or remove
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0some other = group member.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Lemme know = if I've missed something here in that scenario...
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0If I didn&#= 39;t miss anything and the attacks really work as
>>=C2=A0 =C2=A0 =C2=A0advertised then IMO
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0this is kin= da weak sauce and worth avoiding if possible. So to
>>=C2=A0 =C2=A0 =C2=A0that end, how
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0about we mo= dify MLS such that MLSPlaintext packets coming from
>>=C2=A0 =C2=A0 =C2=A0group members
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0must also b= e authenticated using something from the application key
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0schedule. >>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Now the abo= ve attacks fail. As soon as Alice's update is gets
>>=C2=A0 =C2=A0 =C2=A0committed I no
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0longer know= the group's key schedule and so can't forged packet from
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0Alice. More
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0generally, = this brings the PCS guarantees when using MLSPlaintexts
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0frameing in=
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0line with w= hat we're getting from MLSCiphertext packets.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0Any thought= s?
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0- Jo=C3=ABl=
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0PS. For con= creteness, we could probably extend the current
>>=C2=A0 =C2=A0 =C2=A0mechanism for
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0getting
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0concistancy= (the confirmation_tag) to also provide symmetric key
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0authentication.
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0E.g. includ= e most of the MLSPlaintext content into whats being
>>=C2=A0 =C2=A0 =C2=A0tagged by
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0confirmatio= n_tag. That would cover the case of a commit packet
>>=C2=A0 =C2=A0 =C2=A0and doesn't
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0even
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0grow the si= ze of MLSPlaintext packets over the current design.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0For a propo= sal packet we could also have a confirmation_tag but
>>=C2=A0 =C2=A0 =C2=A0this one is
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0computed us= ing the *current* epoch's confirmation_key and
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0confirmed_transcript_hash.
>>=C2=A0 =C2=A0 =C2=A0>>>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0___________= ____________________________________
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLS mailing= list
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0MLS@ietf.org <mailto:MLS@ietf.org> <mailto:= MLS@ietf.org
>>=C2=A0 =C2=A0 =C2=A0<mailto:MLS@ietf.org>>=C2=A0<mailto:MLS@ietf.org <mailto:MLS@ietf.org>>
>>=C2=A0 =C2=A0 =C2=A0>>>>=C2=A0 =C2=A0 =C2=A0https://www.ietf.org/mailman/listinfo/mls
>>=C2=A0 =C2=A0 =C2=A0>>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0_______________________________________________
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLS mailing list
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0MLS@ietf.org <m= ailto:MLS@ietf.org>= ; <mailto:MLS@ietf.org=
>>=C2=A0 =C2=A0 =C2=A0<mailto:MLS@ietf.org>>=C2=A0<mailto:MLS@ietf.org <mailto:MLS@ietf.org>>
>>=C2=A0 =C2=A0 =C2=A0>>>=C2=A0 =C2=A0 =C2=A0=C2=A0=C2=A0=C2= =A0https://www.ietf.org/mailman/listinfo/mls
>>=C2=A0 =C2=A0 =C2=A0>
>>
>

--0000000000005a626a05adb85fc1-- From nobody Sun Aug 30 00:41:28 2020 Return-Path: X-Original-To: mls@ietfa.amsl.com Delivered-To: mls@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5D8323A14FB for ; Sun, 30 Aug 2020 00:41:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.097 X-Spam-Level: X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=mnot.net header.b=eNSILlIz; dkim=pass (2048-bit key) header.d=messagingengine.com header.b=tEfxRdkt Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XgUNiib2llYH for ; Sun, 30 Aug 2020 00:41:24 -0700 (PDT) Received: from wout3-smtp.messagingengine.com (wout3-smtp.messagingengine.com [64.147.123.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 8B1DF3A14F6 for ; Sun, 30 Aug 2020 00:41:24 -0700 (PDT) Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.west.internal (Postfix) with ESMTP id CFEA2D55 for ; Sun, 30 Aug 2020 03:32:26 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Sun, 30 Aug 2020 03:32:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mnot.net; h= content-type:mime-version:from:to:subject:message-id:date; s= fm3; bh=8rlBksGlBi6AuX94NwBxCTDjS47C+pzm8BKZOqsm5Yk=; b=eNSILlIz fRxOb58c36jBXhMPqIJYCictNKGjyQW+IgW3cUYkBW6UvHEVk0eYuoMZg6wHL7Qv 7jUy+pjB+iluOgNFg6FuN7JOJUQxC5/GhCNh5tYkE0wOAitxP5kkotL454OhdhRS RmRgcwAVGrqBSXFqoY/LG5WXK8CIX+reGnOPPLpRDr9WxtS6Afann07jjq+qo21k +TxvEEki2xKFotFav0+yhMqBj1bLs1CIx06phUyeU20dCiatyOK/j/i/RuLeXIp0 iBXqKtIkSlRMYmG3pkKso+ztVBsj2nXjxfZ5Kp617BhO3uMKy1qDgnl+hWXGp9hh SAVz0qFm7n82nA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; bh=8rlBksGlBi6AuX94NwBxCTDjS47C+ pzm8BKZOqsm5Yk=; b=tEfxRdktxtQ4t19GhUTynUp2yhFGQpfrCnDXyM3j8VKvH pOXCeHfa5kSEudPXVZTigpPvAhLZkaRSd9LnmbSbRk78CWycV0lBjBsIstup9bv8 c6qFAuplv3d1rtCaz/9XLKsWGsYrYjUcAAUCUxONRyXj8ZZ9sukwUnQwkjnoipAi TBn9kG94ddzTKnxCyyJ8IfJuOO8V8sVRnrfS1tJwrVUUk9Wjy9a0NY7lZ79FYw1z FGIGFjg6kUSkV3myfE0FGR+PxcdslMEowu9+GTwE4ySkN/9rAz0C6b0W+NYpLBQ4 yUqj5MQ+vDhtpOd2dulrIZjXQNOoazJtgtFGItkvw== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduiedrudefvddguddujecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurheptggghffvufesrgdttdertddtje enucfhrhhomheptfgvphhoshhithhorhihucettghtihhvihhthicuufhumhhmrghrhicu uehothcuoeguohgpnhhothgprhgvphhlhiesmhhnohhtrdhnvghtqeenucggtffrrghtth gvrhhnpeekfedvudetjedvfeekheeiveeugfefhfetteevgeffkefffeetffdvleehudei teenucffohhmrghinhepghhithhhuhgsrdgtohhmnecukfhppeehvddrudejjedrudejvd drvddvnecuvehluhhsthgvrhfuihiivgepgeenucfrrghrrghmpehmrghilhhfrhhomhep ughopghnohhtpghrvghplhihsehmnhhothdrnhgvth X-ME-Proxy: Received: from fv-az50.internal.cloudapp.net (unknown [52.177.172.22]) by mail.messagingengine.com (Postfix) with ESMTPA id 431DF328005A for ; Sun, 30 Aug 2020 03:32:26 -0400 (EDT) Content-Type: multipart/alternative; boundary="===============7447077989648644470==" MIME-Version: 1.0 From: Repository Activity Summary Bot To: mls@ietf.org Message-Id: <20200830073226.431DF328005A@mailuser.nyi.internal> Date: Sun, 30 Aug 2020 03:32:26 -0400 (EDT) Archived-At: Subject: [MLS] Weekly github digest (MLS Working Group summary) X-BeenThere: mls@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Messaging Layer Security List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 30 Aug 2020 07:41:26 -0000 --===============7447077989648644470== MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; format="flowed" Issues ------ * mlswg/mls-protocol (+0/-2/=F0=9F=92=AC2) 2 issues received 2 new comments: - #392 Is the path secret used as PRK when doing Kdf.Expand? (1 by bifurc= ation) https://github.com/mlswg/mls-protocol/issues/392=20 - #366 Add extensions to the Commit message (1 by bifurcation) https://github.com/mlswg/mls-protocol/issues/366=20 2 issues closed: - Enable Commit to cover new proposal types https://github.com/mlswg/mls-= protocol/issues/383=20 - Add extensions to the Commit message https://github.com/mlswg/mls-proto= col/issues/366=20 Pull requests ------------- * mlswg/mls-protocol (+2/-3/=F0=9F=92=AC2) 2 pull requests submitted: - Use UpdatePath instead of Commit when describing tree updates (by chels= eakomlo) https://github.com/mlswg/mls-protocol/pull/399=20 - Use full-size path secrets (by bifurcation) https://github.com/mlswg/mls-protocol/pull/398=20 1 pull requests received 2 new comments: - #397 Always use path secrets with KDF.Expand (2 by bifurcation) https://github.com/mlswg/mls-protocol/pull/397=20 3 pull requests merged: - #383: Enable Commit to cover new proposal types https://github.com/mlswg/mls-protocol/pull/389=20 - Application messages MUST be encrypted https://github.com/mlswg/mls-protocol/pull/393=20 - Always use path secrets with KDF.Expand https://github.com/mlswg/mls-protocol/pull/397=20 Repositories tracked by this digest: ----------------------------------- * https://github.com/mlswg/mls-architecture * https://github.com/mlswg/mls-protocol * https://github.com/mlswg/mls-federation --===============7447077989648644470== Content-Type: text/html; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Weekly github digest (MLS Working Group summary)

Sunday August 30, 2020

Issues

mlswg/mls-protocol (+0/-2/=F0=9F=92=AC2)

2 issues received 2 new comments:

2 issues closed:

Pull requests

mlswg/mls-protocol (+2/-3/=F0=9F=92=AC2)

2 pull requests submitted:

1 pull requests received 2 new comments:

3 pull requests merged:

Repositories tracked by this digest:

--===============7447077989648644470==--