From 2889616e69e0c7aac38e938d701ac748a0e9158d Mon Sep 17 00:00:00 2001 From: OpenTelekomCloud Proposal Bot Date: Sat, 12 Oct 2024 04:00:32 +0000 Subject: [PATCH] Update content --- .../images/en-us_image_0000001443711605.png | Bin 0 -> 1187 bytes .../images/en-us_image_0000001443792005.png | Bin 0 -> 1187 bytes .../images/en-us_image_0000001673130380.png | Bin 0 -> 1187 bytes .../images/en-us_image_0000001772296201.png | Bin 21812 -> 0 bytes .../images/en-us_image_0000001772299481.png | Bin 14058 -> 0 bytes .../images/en-us_image_0000001772301841.png | Bin 17746 -> 0 bytes .../images/en-us_image_0000001772421057.png | Bin 18555 -> 0 bytes .../images/en-us_image_0000001936832142.png | Bin 9620 -> 26329 bytes .../images/en-us_image_0000001936832146.png | Bin 10131 -> 27774 bytes .../images/en-us_image_0000001964045585.png | Bin 14697 -> 31630 bytes .../images/en-us_image_0000001986387925.png | Bin 0 -> 342 bytes .../images/en-us_image_0000001988385497.png | Bin 547 -> 0 bytes .../images/en-us_image_0000001988387381.png | Bin 547 -> 0 bytes .../attack_defense_overview.rst | 2 + .../blocking_network_attacks.rst | 2 +- umn/source/change_history.rst | 6 + umn/source/checking_the_dashboard.rst | 215 +++--- ...telist_items_to_block_or_allow_traffic.rst | 2 +- ...ection_rules_to_block_or_allow_traffic.rst | 638 +++++++++--------- ...le_4_configuring_snat_protection_rules.rst | 2 +- .../adding_a_domain_name_group.rst | 28 +- .../deleting_a_domain_name_group.rst | 4 +- ...ting_and_exporting_protection_policies.rst | 10 +- .../managing_protection_rules.rst | 4 +- ...fined_ip_addresses_and_address_groups.rst} | 23 +- .../deleting_ip_address_groups.rst | 4 +- .../managing_ip_address_groups/index.rst | 4 +- .../viewing_a_predefined_address_group.rst | 4 +- ...> adding_a_user-defined_service_group.rst} | 30 +- ...deleting_a_user-defined_service_group.rst} | 14 +- .../service_group_management/index.rst | 8 +- .../viewing_a_predefined_service_group.rst | 4 +- ...information_using_the_policy_assistant.rst | 2 +- umn/source/creating_a_pay-per-use_cfw.rst | 46 +- ...do_i_do_if_service_traffic_is_abnormal.rst | 4 +- .../constraints_and_limitations.rst | 8 +- .../product_overview/related_services.rst | 2 +- .../system_management/alarm_notification.rst | 146 ++++ umn/source/system_management/index.rst | 4 + ...pture_task_to_check_the_network_status.rst | 96 +++ .../downloading_packet_capture_results.rst | 45 ++ .../network_packet_capture/index.rst | 18 + .../viewing_a_packet_capture_task.rst | 75 ++ .../querying_logs.rst | 108 +-- .../viewing_inbound_traffic.rst | 20 +- .../viewing_inter-vpc_traffic.rst | 20 +- .../viewing_outbound_traffic.rst | 20 +- 47 files changed, 997 insertions(+), 621 deletions(-) create mode 100644 umn/source/_static/images/en-us_image_0000001443711605.png create mode 100644 umn/source/_static/images/en-us_image_0000001443792005.png create mode 100644 umn/source/_static/images/en-us_image_0000001673130380.png delete mode 100644 umn/source/_static/images/en-us_image_0000001772296201.png delete mode 100644 umn/source/_static/images/en-us_image_0000001772299481.png delete mode 100644 umn/source/_static/images/en-us_image_0000001772301841.png delete mode 100644 umn/source/_static/images/en-us_image_0000001772421057.png create mode 100644 umn/source/_static/images/en-us_image_0000001986387925.png delete mode 100644 umn/source/_static/images/en-us_image_0000001988385497.png delete mode 100644 umn/source/_static/images/en-us_image_0000001988387381.png rename umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/{adding_custom_ip_address_and_address_groups.rst => adding_user-defined_ip_addresses_and_address_groups.rst} (83%) rename umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/{adding_a_custom_service_group.rst => adding_a_user-defined_service_group.rst} (86%) rename umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/{deleting_a_service_group.rst => deleting_a_user-defined_service_group.rst} (72%) create mode 100644 umn/source/system_management/alarm_notification.rst create mode 100644 umn/source/system_management/network_packet_capture/creating_a_packet_capture_task_to_check_the_network_status.rst create mode 100644 umn/source/system_management/network_packet_capture/downloading_packet_capture_results.rst create mode 100644 umn/source/system_management/network_packet_capture/index.rst create mode 100644 umn/source/system_management/network_packet_capture/viewing_a_packet_capture_task.rst diff --git a/umn/source/_static/images/en-us_image_0000001443711605.png b/umn/source/_static/images/en-us_image_0000001443711605.png new file mode 100644 index 0000000000000000000000000000000000000000..e64877a0b753085e0767893319d9086144cb3b40 GIT binary patch literal 1187 zcmV;U1YG-xP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D1UN}VK~!i%?U@Nv z;y@6E_y7NwT~S22Zx0R;JP|n>s;j6Z^U}OzuFfxV zn2BSI297ZrIL2t;7^8t>j0TP|8aT#i;25KUV~hrtjrsceqUYxqx@)xPqFSfoS%pqc z&*eq2Or`TG)#^9YZa>od`;cX34NJzf?jLAx|A>O&E%JCHwCWDfpH(0Ic6p`7%9@|n zJR$P>V-$_=Di7y^US9_+%lVkgn3tDV%IqC1#RQ|V;f+$YcEvI_k11n5KR>C}dZ1ur z>st~qXniwG{!oG+BL0jgumS|mp@kj z_-Hg@S80Q5a4p)%etU4gcrrt8@9!)dF@}t3KXk|!j8AT~<_S`{Qd7H@Sd2q)E9RfN!(N0^hJyA5dzQg$bd3o`cP3(|%4Thz=~)Ccq0J|5cVKUIb$!P& zn2oM6*p!XMFwL1=RvQ7D(B>1D5u))@*BHLHtqY#o$SJ@V?5A= zHlMiN5mqLZ-cz4tFdJQCUIzoUDhDz5Mu@t-Cw69WKoiy8|0n(ZCCY#&kNpNgW28Nz{241+@4Ls*J#dBH9iBp)sS;2jvUXr|R{` zEf<;rG@!*NEh8Gu7Rx{%p)sJ_eNyYU5Joi&-3xzgp6MHH&{lRaePzw3%zj0dg&0G| zfZMy)WF?Fx^=>*(5071T);MT`w$S*Qyj_8N{oCsqpH&STgFOvCs`0NsYAMCig`vU^ zuEDjk>o0gKu^I07&3!2_Yz%-f{vf|1#*Oi@ExUh6H@8iCQMw6CMBq1$;T*1!*>%QI zI4r7*NVDDElrdul%KGN`q(ok2FXfWhC5#5XO2!gt<)JiK#^#yJm@%DhkIt0tv6ITF zpJ_3zFXOGi-e=PnRo`TMGOl0US}ws_G6vukMG}~~ur9$MjqZb|B`2C{!5*J@`u%4^ z-?)rm*_i(o#~2M9V>ED#(ZDfA1IHK*9Ajoe^cRs~wqbJchDiVb002ovPDHLkV1g5( B8PNa$ literal 0 HcmV?d00001 diff --git a/umn/source/_static/images/en-us_image_0000001443792005.png b/umn/source/_static/images/en-us_image_0000001443792005.png new file mode 100644 index 0000000000000000000000000000000000000000..e64877a0b753085e0767893319d9086144cb3b40 GIT binary patch literal 1187 zcmV;U1YG-xP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D1UN}VK~!i%?U@Nv z;y@6E_y7NwT~S22Zx0R;JP|n>s;j6Z^U}OzuFfxV zn2BSI297ZrIL2t;7^8t>j0TP|8aT#i;25KUV~hrtjrsceqUYxqx@)xPqFSfoS%pqc z&*eq2Or`TG)#^9YZa>od`;cX34NJzf?jLAx|A>O&E%JCHwCWDfpH(0Ic6p`7%9@|n zJR$P>V-$_=Di7y^US9_+%lVkgn3tDV%IqC1#RQ|V;f+$YcEvI_k11n5KR>C}dZ1ur z>st~qXniwG{!oG+BL0jgumS|mp@kj z_-Hg@S80Q5a4p)%etU4gcrrt8@9!)dF@}t3KXk|!j8AT~<_S`{Qd7H@Sd2q)E9RfN!(N0^hJyA5dzQg$bd3o`cP3(|%4Thz=~)Ccq0J|5cVKUIb$!P& zn2oM6*p!XMFwL1=RvQ7D(B>1D5u))@*BHLHtqY#o$SJ@V?5A= zHlMiN5mqLZ-cz4tFdJQCUIzoUDhDz5Mu@t-Cw69WKoiy8|0n(ZCCY#&kNpNgW28Nz{241+@4Ls*J#dBH9iBp)sS;2jvUXr|R{` zEf<;rG@!*NEh8Gu7Rx{%p)sJ_eNyYU5Joi&-3xzgp6MHH&{lRaePzw3%zj0dg&0G| zfZMy)WF?Fx^=>*(5071T);MT`w$S*Qyj_8N{oCsqpH&STgFOvCs`0NsYAMCig`vU^ zuEDjk>o0gKu^I07&3!2_Yz%-f{vf|1#*Oi@ExUh6H@8iCQMw6CMBq1$;T*1!*>%QI zI4r7*NVDDElrdul%KGN`q(ok2FXfWhC5#5XO2!gt<)JiK#^#yJm@%DhkIt0tv6ITF zpJ_3zFXOGi-e=PnRo`TMGOl0US}ws_G6vukMG}~~ur9$MjqZb|B`2C{!5*J@`u%4^ z-?)rm*_i(o#~2M9V>ED#(ZDfA1IHK*9Ajoe^cRs~wqbJchDiVb002ovPDHLkV1g5( B8PNa$ literal 0 HcmV?d00001 diff --git a/umn/source/_static/images/en-us_image_0000001673130380.png b/umn/source/_static/images/en-us_image_0000001673130380.png new file mode 100644 index 0000000000000000000000000000000000000000..e64877a0b753085e0767893319d9086144cb3b40 GIT binary patch literal 1187 zcmV;U1YG-xP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D1UN}VK~!i%?U@Nv z;y@6E_y7NwT~S22Zx0R;JP|n>s;j6Z^U}OzuFfxV zn2BSI297ZrIL2t;7^8t>j0TP|8aT#i;25KUV~hrtjrsceqUYxqx@)xPqFSfoS%pqc z&*eq2Or`TG)#^9YZa>od`;cX34NJzf?jLAx|A>O&E%JCHwCWDfpH(0Ic6p`7%9@|n zJR$P>V-$_=Di7y^US9_+%lVkgn3tDV%IqC1#RQ|V;f+$YcEvI_k11n5KR>C}dZ1ur z>st~qXniwG{!oG+BL0jgumS|mp@kj z_-Hg@S80Q5a4p)%etU4gcrrt8@9!)dF@}t3KXk|!j8AT~<_S`{Qd7H@Sd2q)E9RfN!(N0^hJyA5dzQg$bd3o`cP3(|%4Thz=~)Ccq0J|5cVKUIb$!P& zn2oM6*p!XMFwL1=RvQ7D(B>1D5u))@*BHLHtqY#o$SJ@V?5A= zHlMiN5mqLZ-cz4tFdJQCUIzoUDhDz5Mu@t-Cw69WKoiy8|0n(ZCCY#&kNpNgW28Nz{241+@4Ls*J#dBH9iBp)sS;2jvUXr|R{` zEf<;rG@!*NEh8Gu7Rx{%p)sJ_eNyYU5Joi&-3xzgp6MHH&{lRaePzw3%zj0dg&0G| zfZMy)WF?Fx^=>*(5071T);MT`w$S*Qyj_8N{oCsqpH&STgFOvCs`0NsYAMCig`vU^ zuEDjk>o0gKu^I07&3!2_Yz%-f{vf|1#*Oi@ExUh6H@8iCQMw6CMBq1$;T*1!*>%QI zI4r7*NVDDElrdul%KGN`q(ok2FXfWhC5#5XO2!gt<)JiK#^#yJm@%DhkIt0tv6ITF zpJ_3zFXOGi-e=PnRo`TMGOl0US}ws_G6vukMG}~~ur9$MjqZb|B`2C{!5*J@`u%4^ z-?)rm*_i(o#~2M9V>ED#(ZDfA1IHK*9Ajoe^cRs~wqbJchDiVb002ovPDHLkV1g5( B8PNa$ literal 0 HcmV?d00001 diff --git a/umn/source/_static/images/en-us_image_0000001772296201.png b/umn/source/_static/images/en-us_image_0000001772296201.png deleted file mode 100644 index 7b4a81ec4c2a359bac69a9cc26e294c0719bc90c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 21812 zcmd?RcUaR)*ESmL3W!SGfMB61NMIvGq(nhFh!hp1cceu`dPs0nrK+ePRhobZ2uKY@ zfq+O8=_N!HAV>=#w2%Pbg#EnldCzy9zfZXimnA5f-^`k|)~t2k_vG1~+gj`=_)kC} z5Oy8yTgDK`5g`bK#qrn?@Gp41o2%e279V3RHArc%;2-eKA(xv5HzAPnL{^5~VetL& zN808-5Xi|^=5Lk`M4=-DV%n*5>!xXd^%9Qtv!heUxgeL>S!ZV_QSTBZxxdH{{GG1I zb#^;0XT%W>$)Ax|6+7~(|CWBYHiyKogU|kHJ9;xvluu6cp=i!e%IV`L)b0d!3Ity6 zp8*&`;ckar8_)2#{?(y8>i-QtDC#%2Wh!}#$%^iJ^x3e1xE zCGo8N;Qos{{P9QkU%b1@&$0jF#>1;%vEVE8r>pY*3rK!{z`rkab1DD6c%?~X*?%Pw z|Nq=Tp~u(0T}%uwE^De6@W+SvS93uizg)zsyv$6Ac1z<`c3B}CfAMvk^|wq(OIy%H zT3RY}3oeY5k-bI?y{AkUoA-9@S|i!VhG#Ip{$bq+P$mAvWD%$dW#=If$=1frDFN%< z)#NDNhF^z++sbz5%Odrljh_XCY2UOeO2lns5mx$Bf(!r1yAOwFDET|}>ER zV|}rt&p+zl*EZW#ldDF9++^R(tLQ9=qo-mO3m}j;l{#etVoj7&7g2LlhRwGcVeKy- zLGMIk@{A?&368Zd-I0-?-o`lTbhFB2{}1A9Fhz}5n(NGy35{2 zIzme9O|1P?{f`F4;e*}`W8}B9GxXROA1)Fqrq)@D++(PD_9@Ef^YkmN#*N}T8%c1o z_lP|NlH{s5$ljGhk&$?NrB_L!{l#u-PbrawkQz0AU^ zPLwf$rXw(T`*C3B%KW6VlrremEUOP3bv_i{0ZQ_Kca|(K`8A1zCH_@adTH6=PWQ-F zKHp}iu?gT_p+jzUgY5ZNg(5GV+vXMwoBfv5eKT3_a<2es{&ioL_y_Evz11!#SsGfJ z7~?Z*l&<8JoVZY9K(0wP?t|)b3({)dA6atwLCqv@Z1iHwICn&l$N$u)4q;Qhz+%K2K8>JV( zvZQC%jbsZ{>5G+FX^2sNhaX6+AZ81>>d=)xpNgbU1?C{>C@Ob+1>VjkmQaqB=(R$6 zZhOk%gI`Jt843lS{Tq)uqC&pektLZx_TOcJ=;zEB!#>WptIMvI?+kZ*BWa6%lU-Ge ziBOXb;#|H7FG=uW8#inwsdQ7cu#}w(hTAL`rWgpI}ps$yiIVb0byX+2M+?%=GTsa8R>v@jk@2!e#_RHn~ImfN^pGHj21 z<{+ym=$w$E+%EEWzKz> zS%hku?7BeK^<6@>?CNGwt*18{0*UKuj~BqeBYJ(Xuk*k%s9nk(@h`r=h^2Y#vIKdX zdrz1qq(LRUc&U>qtD(5oOUks1rs;CEiH%XPoH>O31Nwyn=ksfFRCVV z*`usp!Lv-)W=UbQe+@~{&#paSyZ(N#9@`+EtGqXe%9*0N3=)NB7zZIKTwO(8DRaTf zY`NDE>F%mwXMS$^TV{&4X%zVuIrJs3$0|QPyFb&s%uR_7_?)la5(gxda((5?!Pc_9 z?XoC8OvV+RV3HF4FYB!q-bmg2msj3;U>hn^Y&NdN=}5g@_$S^9P8`-G6uTk^faH4C`=NWsMOLVD6wS%XxenXRLZ zUPa99w)UU&*4iTNF|wizkp#}Mm!#MQf?@IA24YXa;_v-z(Y%=K^M3WuV1;tla!*Du zc8OS9>zQ6qSSy`Kpl~Jb6y_$(Ya%Dp;99w}KWH08v{jNo?pC^q<{0@?nFhIj(7iEb zGtaDsYx6Y}I{bIh&aKA2;6WmJvwnR7_(GnUv~TMuwCa_(KQ^y1WitMyL;)8m-lwM^ zWtxX`yztt6*?y^nOUoC17qOnyaF}l#wypM>YL-t^-Zgm_?=fUY7Jt^iW~UQ)n@6vl znp%m3g?C9~q%8e$zIG#}R=AEbGMwV%)-Y@651m@u&OV)|os`W=ws(NjR zz+Lw3X+q3J(SgH=bY%nU&&d`-=8|8{z955bG1d>wWu(E1Bvg|JQQInHyF~Plg*U=z zGW9UTmeC8}W9%PkIQwiq@3FTonQuL-kX+PWd(;?|q#v>}kp?3<1W~8$r|VFZFjDPK zVGwlzC9DkKU^7^_R9T~KVOH(58q^fWBW@$A) z$R7c5wNdqr)O}IjpX{BunmHZQk)%alm_We8GB;&9@Q4ObC4HLIcf)-u{7=1fTLdzz(EoRprT_n)k!_i4Ur)qF zx4!F$TXvO`o-29sukkd6h~Y@~?7%*iY;S5$wl|hL8?{TzuJ^Kn5s0-?rLhxjo)#Ih zxbi;bfsA4$7Z)!G#Fi$I@8vq_XECZk52&4`$h8_OWbiJJ1!)90k_=l+1~&cQz)!z- zpJ?f=D^P2^%U&5@bjR~vMI!{_G!Ou3|Iio`?5eV1cC5$QRb}1Obuz%A=9x?|gJL)P zE39?R-J0|L?gILXD8W(=6!2q)s0vJCy8$d>c)&2qZ*r5E=${B$xfErmLG~eN$fe2V zrPLKTdgY&|lqTWbg-3+-GB%s09dra4{=}`8{azbU8#)7oPgQb1>YrW@jt@hmO2&7b->x@LE`V;>I$ViuiW zD$w2^Fc+U&7T{g`t3W)eq%zT;EFe3Q{yp;w9jU%l|2`j1dBpZ>-Cdb>;f9N25Wx9^7+3++8FteI``aPZ%lW(n0MvZUN+yf>ys z3aHJ53G0h(Nh)5}I?K%u!%v2=gLm(4_~AYc#z)yBH#&}n2UlC4zPxTVR?Gq^PHR8- zeAvx*?-|}WHHg-g^laxt%>9N7gMCV6^wjAx@aB&}oTjkFo_2L1a?=)X%iTnDK0Wnw zSUpSVkRFj`)TE*AaifqMIF$5fH45ID*OUf_H2_ci;&%0^Z>z{vp%}_e)NS@2Kb5N% z^G6`}gyWCCD^`Jx>^xkXbb+Vo6R_0WZCW2Zm?QeZm0)ggv^b?r*W3N%=Lkg7o8TNi z@kPsx=ODIKKLSFBN{3D?1*vq0Fo>PgR^7st9cM>E*scC~rXvf3@g^*!Cxh0+uom>C z75NZI>?gMQNF7h*X^MZ%PTvpLA$3fNmo0g`&d0^9(%GQK`kMpjcgG%tK6X|9;&!hj za{Dl^NYX}r!k>{Q(DOdIlk!Id{(7?!+AZXxpQ5t6CA0a*Flzo`fiJU0B-Ga$O#00( zAvgxg0u3Jb<|k}#HseDK>=3aU>ee@yC_rqr{(NM64=l>%vOo)LS@mxuZA1R|XNz4K z#(EEeP276#`wGQOP(mZP33Bw>nNgsD{_=vGY)MrfDplqDndk$rp&q5)l2mfiju-+pI znorxWZyw@+#neg^1wQoXiaS>nhCgsu7_=Dr6gZpxXknHdK~`PqT)|rGT@&2P4SC7_ zk9WIP>300eTK7TzQ&M#dJ>7Dz=ymnasGV)neAE`-J2rlfPvcklafn0tFX=ytqR`{7 zTTikMLD7m=$#n%5wV(YLk1eH4#!=h5GwO({geC%U80YVwn7x|0nV0CpCc9Z=7{94l zaY4ScQNi^3;V*+I`u;{l_LI}}01WfxpO634pP$+a{7@~wSgOLAS`rixKuT<-ab)uC zuC|Yeq#Y(kmrZ%QlCBN1$2n*Fs#9Whv3io+$;HB<6-*b9RT7xTZ{NG#50!PEq9n*{ zMnJ=7asE+1yrPERTsg0A;B>T{cWLVEI7ql5qYVqCG9x+_1jElJec9cG8NT;i?_b94 zw47T7}a^-pt-5tBPGZPuz!!!6Q&_k-1Yr8S;N}K!8j(ekwpT=F*f$baEMcXKJsPsex@&5#Qam!iEJa zFd?kH9j@LN*U?md2;|y&J3~ydMSXexs`gfIh%hVKkG7ZOA^7Sv1;up*mgy{1uAsex zzaM8eANh*0s#i`swQwTzZ(uE59;h5Zl5knl1utJ}U?r_j&)!xPy(%1V?sGwbddk~Q zzj`*`1h{I{?9OIXU6SER6DT@xTM;T|y;0#p-ubnvw>~ZOvf<+phkZCK&1@!3psmzY;m^ z{wXCo*?NBJ5JwO*Sc4<#?QS{?nArKu{C?EKxzO?=xlv;5mYKd~{qN7q2IblJ--7%( z@Vl0n!0JQMT!MdE`tc|?B4;4^OD;^C7+ge+8!#KsAymPI0#I!L2B_5AlOPcx&7 zmMV4ia+L5?W5N}#9@LzACsnk)5dL-;EIBgU%d8fhkumjhmwO-srO_iN~%aBDEUNmBHOwmzZu z*v)2;^_w(V<7by@%6dm$=>E?qBlM~ zqCHHhlw;|g*DrIYNy`TVEM_M_yc(MpXL}DAbWS_mq|D!sn!QpJzL9Wt?Bu;VKTI$c zGaAabH86ZSw++9_M3(V>o`p3Z#;nbjcuZg)$%F5}B8@?ke{JjhK6q!)@%*RI!i+%YW4V1r+8aH&xg1vo7n3+>@I!YNk{4spXy-#;u^!6~R|c zPr{XH{E25?J0!A~Lp$7V*JW%yTO~p87t&UYvA~4_IQxE#R|)?; zd;7W$=n_K@o51v||7>rpv<+JQ{t>%-x1vbKBR!C0XXkG~WeM#B$at4F;|?Zh`_G>o z+i!&c(W^{85(7_iRwnfI3B=zC+@mLvzkWK6*yZ(G?iM=?3H@Ct@Fq&Lm?w29Xsf$t zPi4%MPoWq6>(C|=VoLyd>F@r`)Du-ceFi*-TiYl1cJbNkqYh(naTdrDlIqT%>0nup z!9F1l`4A-ZD}Z$S1_n675tBP#9Zl>;YqvqstRJGKa1pW?0%Cyev*ha^wX>;? zMlv3QP3t8;f@a@(Xui>PUl_haZ->1kcYf-xU9LZModjAKwj3|BCcj>lv(iCZh?fQt zcEp4$yis+tPne@w@pH)hnVsdaQXYh2qz>Uz@$LjeoB*6*x7zrZLMnXQ=-7~(!bN5L zc$GWG=rcgs9}OC5MP%qb>MX5ItSzhUi!htpT3;B60^oTZLl9=z6S=oFLW<%Qq*kdA zY|yL1t!E9dEbd;GtJ2&GE3+1o4zYEpo^~Ommstke`8T)5I1ngnLd1vgdf0@00C{IQ zo|QjYG9j@Ks@k`OWJx(UAL)dsuf8(L81(`q)C$UGxj2E(_UXsUT zj21)!DU+ertz4&M|1^OLw|)Tt$u|?91tHVLmjfT$NU_CGc{;G3F+^tRgv1~%y)nq% zhI7#!oHYV|NE8xFk}W-OL2Nd#5aA_e!lvL4wmRTz9 zhtKekV&lZ4=LVPa)85^e?d!!VTi~9*_qqf7^a!~Bv(%m+4Wvxw;;xdLlny1&ytT~O zd>=Ss)w$`F65X7-5`Q&_n{(Mxzc%)8+t;JQ49kCnl2+|mj0Drf*8?lE#1|Sn(cU5D zkZ(zhsU-p)>u~wO+!l)3BMv>ciWr)HAzp_SQMxSF(+KtqbjZ^>KCi^5u#U>RR_Vp~ z$-pyH!ExSniCqgR#~{+BQYa5(XQSCEsFaRSMH_h|o0nqy(67LHH15DYx-R`V!9lK7 z95dq+Bb0$(;_tLU6wGB5)LQ==2xqD$?B+$GIy^_I8pLt;5Q#>?CsVoYukVZDTLXzs zP^u7B8EhE#mXa7z_EKVJpkOlZaU%rF3-Q&)XCbc=;}?QhLm8yrKtMo@)=I+@Ce=Ei z)gW}bjAVZ&#vFf?DZ!hx4OX9CX#-3kkZX2qIw)zyx=|+(VRvWJ1&lPlhciTw>8W`q zqS+_jXV!$w(=;19PTbHLWS6wA#2u^gxDFpPOMwnsZuw*nZ3tD0gFrjqYr(+O8vZBR z29_CGpO}Ru!M3R|BiIX^=vMI|8`0^0+x6QwMAXd$KO0_Rv3AcXvS>|pd7%(KsBi1Mk$X>Mm++2#MV*Wda&{K)-zmEB4meHT?md{yN#Hm- zABOHIQM(!6gGr|^*{?AuX|)ztIN}x`Lr+Yk%3_ydh_Uo53GrRA zBW`zZK;mB1+YJ>d6tvcm>8{MRFn(p5C=nY;%Ec+ITJw?Mu$e!?1FA4FZOlDArq|5$ z?RK+AC6{k(EZJ>*yO=~?LZ0T|b?EMEJA~QdBr3Bc+MiJ^4868KXoArR+8vmdxO-!| zYc*tgVRa_(WzdHxt%|c;!+k*>W0QT5Swl2o$5GW z8Z7X39ix|2TF&300RZ?Ntm5j7hIhBb;ajHZHMP=Wd*0^d$F!H=UcwzS3#&wE0(7|s zzj5MNCRy04y7BfEPg1Iz#;%8jq1^ho8;SQYuRWx@c>z?C z#sX>ABC>4cY%JsKHd=*m^BzB#Ln8|NS9IS~V3oX0YV@3Xq`ulH%vISTG_iv{1i1Iu z`lqk_TqBgS>aLDi@^QJ3G^=zE`#V)az65}>$a-+9N|I>?T}IJoj^z6d%c9AkkPJM@ zb^@Mz6k-O7-L=XedeT^Lh|FzJ_SBeOwp$)FNz!O}7p-x$SUtESVOmi};zJfq-?gva zSrYOk23TDP>X@#L$-#3J- z1WL2T_~GO&SRnV*>w07%-Oy! z8fhIYwtlTDzI|(5&t{dmXWTb%Uq0D${{Ezgx-@1x$4gRK*+(+}g1oZ?^G^ovXX&r~ z^WH+P!CqLivF(>-L?V*Pi1W%+9s2|)Nb z;*XlSRXr#SAqsR}$hPTb{K=}$%uCzN_~5L z0DI;e5H_yxI_0vwQwC-TC-h}X3Nvh(Q;07v zooBPm7{R5drk)T_f20;b6u@s;eza*;wZMG;{2<$V%&F5S&!!tRs3;w;EJDu--$@|fi=m7 zkBxb(%=f!hwag^j2<om|8t3Dbl69Eg$>3@vA2Kk;3?2Wgy@pRu|bGzo9jbQ8S9|Fbolpp;;tDQ2;MCT)R`nCE=?>bRPsM9T+Oubtb ze}dv{isQ~FegTgDH{UP*ejbZb9dp#i>cAQ<>yKD^9S>av5qjn!0-q_(wcR#(sUTbi zmK<+gr%E5|i?m^2ZS;AL7nv=^M{RL#*Kr!^XUgs5H2SzG@Bv{$ffpaHYQ$Q=dM$@n zbRlYJJfKj)r3HAZ_?Y7y??9F3m@C9g8MyR`^`OF#_2N#oY@5$QK@tKD6&X){>U18+ zw)wc-uCBH4^yo{Hesf{S&cZT~(|i&v6ws`8=tx-EsA*O)S86jWiI18qx2gfrx`DbSnY)8>PGKDej)GYHTYFB3*Zi}^H5J*=Nvni)C8#~to zrk*SN8_Vth4a%^IA@EX2is^i0|L2LN6cYMQNtlKcF89vV_z;eUSrsHI$X%nx?AYus`UnDD)=nePL<-? z)^MlJdQ5-k72tpdcIvfsif0KfW5`W_7q0JWUN1q2vL20(a>3fjdHhzJ|_7TsRz7N!8N%}aM&t~e#S-GsS+}qIx(PZ=< zJy*n>x%)2OG3h+F%T%CQ3I(J_-FFlSarn}a_Z-*GnM>v6Z2O~m)iz4@ zhV+ScLcj@1t8hOPIa&uCe~uSLf!z2D924F1$yRTqxL#6TCWiwVM7$*q$eogu z6Sr>>=Zh^^nD;1b(Uw`{Aa^Bm=!cr^0hjLL8e|&^k(3ksXK@Th!_C+Q1O}{M|680SzjZ-okWYH2+4GBCMU$?>OjKh0rJ51A``Z}6A`HX?LUT_+0JLsaauMVuevytn5?m!)~uHRLTQ=g)wYxbJQU*VrLVNPE0*FMLIu4 z&Q1mcuiukro~;uk1?P+A&-|7r{~G>iUa5sUwQwwyiBj>&BbpS=CGzY6=E$~mX{5jV zA$XcKN5Jg6u$Ls$%c(V!FXJ8a-=?Lp0!87Z5LR6%l>;I(Hpu=k4Td;*R4Cw=(E1IA zlC&Y<$I6WH+^XJ72+=gQqFThn(3tkURCWP{CuxC2_2-8<%S#~=VeJRwjF#MO^mtf{ zn8ZiD@CB+=eAMsHF3v5BhNjkXa z!)0OsNgmd011Pf@W_PJmO#QO-*h-y;h@`;>&2R3{_?kZNgNyBX^rtJ74)NFs(?J3| z!BUH=$j_lZpDs59Mac%<&bMC<=TrlU?ugt&uL(vNpf;O1Pc~0S;Gz?W6?W5yZ&56C zX*F+SdX7PCD+&d+2LdDvG1O+CWwbWjP2u2-B1pqJyM4S{T zu%(CGQcykaOvfHKRDQt@;6gs@;v|vxy+x+_&C9;oOZ+vQf65TM zGVwp#3U(@@e!{r_}7|i3)RG*#27#ToaVt=Ir zoI7uQI*FM!!XI1_(8;67G>mF%XPE5d?5qupX^VBz(OZ(tXV@h(9#`K@1yTbg@;=1N2%Jb*F%(iO|cmC~}3bn}Rp3fJ3{eM zU+sy%bMNmt|Bctj0v;Sp;bnz%Ro)*+9AIVRbQZoIO#++ZJp7T;lMl|ci_!5>{*97> zUimreE3IQU#5$8q{KaFV_*y4Lq@jW_8tSN|Ya?!lLp$@mBoe`4^18irrD$QpU^cBN z;PHGWuuWcEnx6Z0h#ue)+w;8XOP%)TxtR=S_}jN0A}`uokG(HY&o{Y~-&fTJkH7N>%P!JgAbYWW_-pkM;@ZCJip2}>%77!zeq)R1aO8P> z`02Zs?KYsh7nn9ey**$rD!J=%J@WlQh`xgFK|QBZ*|WX1JHMF684T`wTjAyF3(Z{a z<<@iT|A_^$Dl!Vj9B_FcYniRk>7w1$B{%u*j3BqwNnMSl25Q9%2xQT7{>U3$z>GGb zHjgq-3d{Aa``|xht}_F7zTTH<)uDmgU7BAH0K(Hp!WYbDqpHm5APZ!40#y62oiV4I zeDEF2_X32VxmWYRmpO18>Jy?cOatK#(7d zy1@rCZ4E}}lLpI^Qqg)>SRhh>TYsb5s7Nx_gGl|woJYG;vM9)1ZE0;)lCM2P;>0qQ zF5)b=SGy|zYYE>AVadCc0h04Y7TYIGUyc{>+V^FZ*_0odnZ5fn=w0mB67K`OGiDw}M|(AAWV1X-I#>dIX3u<^h}+*m3qh9%ab#wZ*qLbDlOA)MbzXDcQ^7`+^r^0t0R+wpHyHn+vRO>~%TNwnOSu3(G(>+vHwH2PfcKnY% zeeB}!lU;OIZ-!Fkl}OGS_S1z>>1XlXFc~2#plNj6xbbb>fbag zUIJ_|<&`jyapLlncY~*2X!$kwb0zon^!O&v;2+OhRqyT6{ejNUukIQ`f19|vMSgFP zrpYfn(y>HX4On#IK4ql;ojTo=GS|^jgkYPY0`w_d6?$%$akS=1az~4ZVSOyMJvxyJ zROU%~+^1;D7Vk;*drgebtXXLnANn4=~CNKJ!0SIK}d&eGM$vpl7k*w zMd+|AsX|o=wGv(?&H#$t^$xM*<(y8r*5MTRQy?~uFL3p&u$K1@dTT8ZhjwVYrD(WK z=N7}ZoRcOeTNa#%Mw+7pnGf(r(;6s&+*x}68CyD*KJa8aq2P5J;#j_%3{V0bI}9*hN|BBF7LU-OGsmwAl)QG{n6 z=i=TE>9iYzGU~m}-u919Mg>@)EK6VW*;iWD=cYSRnIAXB_OR>N1Lq7^gKJ{Z9qZnh zsc>{Qk=_H#!g8J3;YwQI3zY50lwLzn_=1u)a#9|3h&1p8{*#&5m9#k(7_$)D(NE{+ z>cFnk7Vek|!d>ZG{<{o7iew?Jtm7b`v_V$+21H|^=_}g$;N9G@sW+mT)6Fd zhwNVG;_l!WSKS2+PBJq!1-pF+rq-C2KaXjbA8`cfb6v7j``?lsYQpiy`mY==2sRIy=uc9YVs%1xd$Oj& zukWUbPth6z0T3>H5qc=bz6A&UBQ3USG+&1;-#HOIxJw*m_)1)60+;@Df}gh)Mc(8F zGMfK>S-tz!^^KbOiIC z|I6jchXg+bzQ{pEmk%~uYOCqG*vV(&?H+#%bnE`D`+os{8)nAp_;DpoD32`}AbkQ4 zOe$%~K1?uT%ojC2soB-v6mOY1?%3j z?>~d}G{%Rg8tOj@W{pl+Y)1&qbgj0*rr1hS1Un9019u;M+MGadf$i`%Z<035i9POH zE;ENi_X8A}tLDlw6kcl2@*I&ojs|-|i_tLjZl-O}s7pBX?zNbSwP0yToF?u|Z4Wp; zsuuPnnClZ2P)!CM!lhYKBLK%Ek-dzqA$F-qW}Q!*P1~=3rf9v(QQu@@0(zOEEU*n4 zxzBG@RB&;wTknVaUYw#$GPI91W@>3Q9R8j4pIT+ZUEb>`rpjfB=fRD&UCV2RDY^Cp zfut#9+LYrp8`Sq1f7RqW9fy>}#?iZB7Jy4@BB~Hmsuf7rPq6?1mUTmnzhWjXSB1(KGUea zpxgBZ7^9DP`g7n?MuC07YQb)o1@yf-5;A_PkX6K#8Q*fp&g2A?nx0e?36ut%&~y@p z1RxMju(^CagZ`08UIBNR&8@G$kkBlDFZ5sJ<0DY8cG_p#NWsc4t!SYcnJWu>wAX#H zK7I6?)k6d}H|4yIy|>LfnC1G~JqBfQ(Q<30JWJQB#*h`jHHSBI#f3;HfH@M_)`((Mz6&c+w2W_nHyoAFf zMW{8K^^Um5N8DsQf}_5{<5E^Q2GUc?C_fNZA1J31%eVZ^dtNkV%M*6aA|+2kY#)~Z zS*e-qNMd}ra#SDpLV|s-Ft#~XUWcKia5iRL&2m_Yq^mH$bC#*7)P|T{1Myh%_N@#M zlrnoq)8;KK&~CiRof!;>CJ^mkRD8UemR;}XxhklOU3+>oa%1fY6UTd288aVg)P`(? zxj=_cW7FZxMbU}P<(gZq{tZgzk{@|W{N#|N-9%AlF8+46`LweDrn3LvrFmVnF7pLF zx0=~|;Zp_t9OcKpp?{{M2P6;&)}+Zea8|bu1xS=8c2RfUqcT+<+H=~?a_q?jp3Kh) zMn{2ej2-f&&0NE`Rl+{gy1Or!x;NFXZYcx`fS{4}`4T|DtUOK2lE==LG zr}&p+9U(H&OhnG8Y-AkVv=OLlSW^(Pe`y1PCpNOSG-a}5T{g%5X1|3c7uMIix4}$; zhYhQiTSIxC7>njeMH^RTp{@rmuf+n{5GXa90l3P;?Rc0KC*ziC2+!IA|yia4m?(J9j;gMTb1 zn*xY6H2#BO!}&lqdqe{zXf#>sKi2kPNNxS|z)RBYW;1qtj5JDB^Jv-a-KXK1{BthWA6(w)#?M!81iHhj%8L-Vq zzOlPWPZMJ%3fcmL(|9CrR+%5yvfjvX3_H)=VY$9w*D=}tUl3@7v)o|Q?z&_759k9> zG%EzqqK^kpU5mCSSnE#_w^7LtV!BrKgf#+Jh4;=5TJnAN8f{lkC(gSg=2V5=-z=|@ zCu5+2y@1DnHP>DCQa%Rxv{>>IOeZh_HTPQ>W$j~ohj<=bW|PS#m4hat38K91fHNl7q79N%w;=KnD2Cgc z=#d*qhR(Ua&6nZ@S_ct(e%t9f`?3)dxTV_#^6}rwCS#{|M>O_aD!x9CNkWW5P3Oa) zI)@>-K!KM3(<^EmzGG5vHpjW%yHWhx*_*A%M|!YVQJl#oY)9}qhXLY-2efj=m3KMr zD{tpJ0xZ&UZyN3hco!xl9zH(g#^hWmM_P)1y9}^hnljz4Dl^EG+)-mW0r|uLC1KnH zABBd!s68=eU080;0%1yDM42?5X~Ol(=29RmW|A?oGB}@is7}#;i5VbxCj)FA5Hn_l zei&}Ap!r2dpKKfC@|(TiyC)&9Ko|DL3@8zpX)Z-|<;#8>SNWg{z+-DHM@9Nx0J!>h zJMdhY97212#WNgyT#cXJqR(@2$U>U9R2f( zvRVFh@=o{7qoRHBC?k3Ynk{?zdI{K!H}y|X8;n#(CfZPK_DQ8yc6Wd~cR54$SrO}( zm${B;$XP2C;CeMH-9YX{0Y=Ox2eDY0xIjMu`FN@miMUZHaIfGV<}WYYS|igQg2>;^ zb8#jxhzx*DKEb+sBIbFUQvkBB+3@6c56tLZhNi=G*62v@wcOwY7RaY=aF{Z8k|}U! z&cS;(OgtQH51?V0Y*Vma0iQO{iGw*nrlxwwT4TJjGJBs~u)EXd3>0&c;q^}gP1EF< zVqPgG_Zt63ukwJ5DtLA>Kql1yd7l)~^3K&0pV{+8cVxU?9?-5a^LU2Au?!zpNa*XE zK>Oo&4<;%Am{f~Rq(ry;`wGBgBEbN>RsKu5JjcVB%HQ*VERg$T?|Y*Ad+=0}^3fw2 z!MYUS4nGS8=3J`Fl^8SeWjYGHM>O)AB$*5{h|P`n8A|FibGiG^pG5iqGS>KCHWW!d ziUp8qBw(1wz}fwgZ~n;3@!vqMCJts{zqDNw^>#bKFMfM%l zSeo>~kj?;$CDlL833!%o;uYXqQ7$7Al<5?>%2q6{#8NoU0Wc2ozgUm_q>#F;D zoGL#p{>P>83pZt{)irf(XCPlLzwZaax;@hObd4^Ho0}XanWgC$Z!^o1Xpz48XP$P@&62_Qw97MkrO>VJrTqN zrRBPHUdu-}t7lyZfYka;@4o#FkDC|?|1)0g!E+Cj(#%Vx zDI3%3whu5-;FNQe*)N?J>@rh!ejQa0rf+!gyh+=r_RLSr zY@!}izU*mpyU+LpU+;RF4i*S_q!bx|ysFKFkoPxfX#&4I^)6-R{M0Y#)Eso3sXV%v z_~e=B#&hwxefbm@CpjgwFFBk;$uDJTR+4RXiD(J=(gGxQi6B~mP@CHM9%w*d@ZE#S zX7(JiT8VW*-Te-wQ;Gk1-YwRKDRf->-TOca^Y~6#)HVRgfKVW zQ$_>($w6yO%QB1iMESY7nv)PS5#QFB5!a!X#H{PEG1C<2$+|h4NM{S&m&{d;d4~k+ zIQxXMCdhXX0ZD}>5T*(qXe~H}2-euKJ)w}?Di22CZ3;k9# zVge^x+cY@#$TAlAjGjYqP9ItdrejidcFU-HfLOuTy32nvgrys>lwxKLk!T>ZOk$27 zv}K34O%=)5%&Ce-1v@NQ!u4(%Kle*Ebzs>Ue^2x~f<-P(Ohb=i49tIfn>ENp#H{h)zOEmdA z!R$(Yvh-;C{yURmdrF#u!Xy?5&rRH?3vI!FE7$I9gP})5jn-$k=ULye?ZzHTl1ABv z5aWSzZFFwxTIszmF~?4jCYX)Jrt_%l?pDY7&l6+eD@a-ML>)i!*m2h4-Iq?~Fz4Rc2M;rHPamd2w_ZtHM6&!DEZ?q^|>;};5RauTiT0r+YRV?&h zFETrMy%X*5LgUs>x(|~95_2s2?Bb%n^s#bZ49w^>yna_(CGGT20xZP-XQu9SEPhMJ zvnHjyXenr&u3*ei;yG9@!3RDtgbx&5V;=xrpD&=A{BT&M5m@4hDaG00?aWifim%UxrCyI}?%SHW; zz|9`+E-<^brkVL%t7sZETHfk)pDSr6Wv$?ZKm-fWrruCH9}aJH~*yMmU_{*Tnw*YG8be!OJ5dvkf=J|xCxnwX}--wfm4FU zx_*}JJeS=}MvsM**(r84d%n`$rXobKE1n_{iL83N3apK|M|wRB+!rCe>~g2w!2o4{dlpwv&HsRp`f4H zX2lJP<`bzqjQ1LtvzMcUQjzgsIB=d^6-LUW@j*a4jFVAx>lwQ}_Tyy1}0Nnh%- zDU9o7MgR-A1DgAnWiy3FJM;H3WKr;W6aZN!M_n#3Dmi~r6?|)>be)l^7fe=BbSQg}7N@tDA^0*Fdpc8Dg z6;AP-@kcaDna(R!HbTBk1I*>MqqEo`dM)?K%}-xaXhb+_<9aE@Ww5yXdErof{8Kai z9wwwD|G@QXX|pO&l}?IL%qR_14%XaTBQY;jWY!BhVKNikeX$oiMgwlr%-g;e`_ z6Vmr@fn>TMm#OB9)B~a18bD^U#Tqrr7rp7dwI#nNI;L#qI!WsmwJVj)SUS$!{*-za zrocbozfK}`jEA2o>?*W*tmE3(TbiJjLlq?Ycv>R8Q&fM2PP}AVa zzy*k9pW+Ok+bQ4&lFGi?=YY!I4=*5L@gX!?$CojCM?aI;45apsn`x?`-7CpqOu!qv z2(WPbii~mTWO1^0Aj5y)y+Lpskl@oX`^Y~HmKcNo5VPR$SoorFn(i900*HfS`jmL| zj3_DgZN9mxP>7kqAUi83`spX9*%yzn4mKyqd(03#$-~JDUmcUNns~Fs{yi7SgufUA z(CYO^;QLP-*<(U z&da%K|#)oe;Ng2M0T_EmXukQ58H0wCju*IH*Oem}cO54l;68^k}0=h&ANX{reQn`i?$-5VnK~2tF)q2ITQqu(<cjkHW%zHn%ulxF4 z(Yu3=`L~KqXroJJxLNv-$BIf!!99Az^XDTB-)6kG`;?wXE%lyhEZAINM%-76%(=|A zM>%Zgw374xUh;!_@6gh?1I|{rYuM6U8kHC!)PIDzjx&hfx9X`RNf$93tz8(n%vkQXxyuj%VqT~al@~Nsbhkw!3$KF zGbfSwibgK^k(ajp-L-v=mx_m*$5NzNVN_f3Nmdy|P`G5|PK=}*`Pg9P0n67qlpQMz z@fe{k82dYk~= z#gRj+uKa!b9Mc=b#@Kp?f?Y=Us4VeW+*xJVph=J?)Y~hMd+qTP*M<4r(4d~IlhdD_$jEKaHi%rvVB8^P)4i<&$fRX?|bopA5x)7vX< zPOI@%H~)=R-vLB8>I3S(Qhn26Zv}blrc**&G*XgFKB{ZJ!~Rw7fZ(xhDv>cWZf%^I zf7+iBjJ9OVwYw#lN<0;o;&Nm}!DZ8XR-ER!8eV)gGVBNpUJMU>0;?sD7O(Q^QG^3M z;0*05Cp~qz#yg5#7&-5)x{KMULTmq8i%P2@1n@UKF)CiIWCA4W{6}g);rQI!NFs$6X7a3$t$E)LAKXCpk7xO9HHPkdjukjZ>U}(Vh(mc3@v;*egTgTvE6#y zw$x>9c0kBi70t8tzWEPuDpLZs^qFWyLM=PB;r0ZsJon;�a77Nqmmn@gh~-$$d%R zgxsJ9O*f;tAP@r)m7J#DC1zQ-Zss(unq#HQUK>gq7MOVf82}P9biFkfr+%ajT{k=Y zFx0_JRsk>h8hUhSR?9xJS4sCFb)5&s5IxETsFeo2F?M0Pto=Pkd%Va^H6ZiY7WE6v zD8en7*@8|7+~q{hXStonEt4?8Bgi`+;~2m#*maX^pE9}&CE0lSjTD1Tzh&dYQReER za!WRV*DHkgE_KAM`Zr}H_Is#I0?Awld+B8fae>d3lD>!C%};Cb*IWloa-JlZazmUm z8RIJ%S39Na*Cyk78-!UYD}G$IekBXD+!k#PbT=hu{MW0I4E;1Sk`9i~OO|%)2Vyh% z9MYHh*)2sbF;p)dA351rtM8Bpzo>|yis#8z z%##&_{@+5j*p;9M>*7jReAS-{-H{;7wEbn+B!4t{k+Xu9N9gE%RWWvZ5YItPcvJF9 zvwuLRleZ7}VIKQWf1L!lyx#FiD{ct{A;Bgfa?IX0C+n7-)>5qZcs_n{!g_{(cO9ZS z3vvQ1NGHeQvzC`6S@iLx;^?T>s);j<4XWgWY);%n9;7SWfAj+jyJd%27Un~@c+^_w zS=+PlZ+BM5H`SD2we*} z&?|X*Llg}Fc$UTm@dgFY8(rk~Cbjm3XgK(``ENye{@TJ|e{^zWCERHr_4n@%`2=DP zf+!Wwkq@6K6%Rfqd4wxR3iaU%kg@RU!pDetz*sHp(!;#mkPxY`6F}#GoORk0Rfd(> zt$yK@uASt`b`sRCu#ZW{DHe8TP8Ky>g%s=mcM6+SZ-cJ%Wb!F~`wiaM!)g*cy3Nnn za3jW5Gu7=vUu*L3hNfRytn=Hh+%^^H*+}r0hAFP+I-ov>1F^gZw|JRSe|ekE%G}+B ztR=!2<`C#Z-mlMbO?M!+J?u2J50!$*Gpl5~nT^uGN=3tsCD9gg5;7aj1E)oP*ySXK zpM{BW_V2^3|8kSS2=j)zuR*uWOP!(1aM!8W!USsr2;8zMiw8YckBodAX1iG z?Q18Q%hIOuYU)0OsSi7IwNC!SOg!2UVGKIWfyTwVw}ysZ&{RE+G!IAfZ>Sy?qs8o( zyjTy#-(p3naZFw%CJk3vN{Fxg>D%EPNCkuFC}*7D@ZQ`jUP>RlNH)n4!hYa~>mI61 z@}8_0wAJ(3P3p)7+@u#pzzpAt8qt+0Mr4BasYh8*BKrZ)ra}8UMr^KT(KXfU)>JZh v9)bAtL@?@C`~UQvKU;9-|8Qz~nTl0IDsoSKEP|-75(wYpfj&PSi~R0CTd{35 diff --git a/umn/source/_static/images/en-us_image_0000001772299481.png b/umn/source/_static/images/en-us_image_0000001772299481.png deleted file mode 100644 index c9e2569568301351b9b852a69d81077e723ce4b3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 14058 zcmeHu3sjQn`fu&oQ!~?6r|F_4Y8S`aV`kDtH4*5K>e^LPWV7uswUv?El{DoVCtb>-^V$?Qbpc z{nq#Tz0dpHpWpj%=}<(d-Fq9~TefVOUD#*)zFf9!g|~J5^qm#f?<;-j1J*yw(O-ss zx{NLWOjvLJn7k)^&$4Aq$|~cDx2^Z@e*M`o^s;64Pi&v%eAL~O%a-|*!uIX?3JaSS zt840pj=VH1N=G4^KK*0V-ZiUtxUZP?7`*Yv*ZXg;`RugcdCmSmB>v&sAHTeUy?$YB zyvx+JU*4a6%=_N{uUFSP)wRd?9DPzZcb0hVQrMC4WOg%;9-LX=hX5lO1VLOf-d}cPc?t|^@g_Yvg5Dg=e7TTm-yzKnxMwFY^%&k*SD{Uyux{{ zt+W_B^fvh|tL@ghnMP+wMv=ped68sD=&XNr8P)pQ7l>oz%q+Hu9blXsZMpYl#~(gP z`Gu&ZN;x?zHeFO-+CFLH$PYhlk9#%Bxixa!Bl67JT>?PIs^go?*FoPz%kXd6o=;{_ z`SR54{VevuiecYS%^#c|>{<1CUSeDOL7-USgQLQprS2%Ip6ia{EL)NC^B;oSfVPLV z5iHz6$(`s7=PvoZVDwt=ZrW+GGPwv0!6r7^5YLzsXu3&>h@FQOsSH-TmMqiYTNj6Omh!> z*1z@ENQ_71w4YH6v1kW~U;E9~Stc3g$;VQYSlT)jTshH^H<&`{q^$ZJUX}B9vz>{G z{MPNs&9VL2lb@a&>j?2bea=JhL9s?W2z;M8ot>vMGF;^@pa;@GxKRCXUV zv(o&!IxAsuSd{6_dG&baS*V-1)zE`#8$=Z_qE-d0>&tWGr|=lf%QK-Jd9SXC4r&tJ z{tdr?^RvZV&LY!okty~z{o)Nd9vLrE4XxL8SgA+qAdm#%7jcw128P}XwKj!geNoHZ(0sD3K z>3zWf#t$0KP3!Dp!aPfyWl?)K@bB~Is3+Pl zVa3eTZtQ67!h*L^-C{8cv$A?kEbbW!3g^ub?_j+2zo9-S#VR~ovdlkO9^w}|tA}M1 zOcPz(YoS=sdS|Zr=b4}c6Q$9VV42{mi5e0S$8A`^bG0paQ{_C#oUO*v5-8O^>NL(u zqT*Z&EVQZN#$QLD$E&kNGu6b&>P(Bq&AYDd#a1`N)0twDq1fA41zD)-5*lc=*wwD} z&(;wpsoPwDPx#>zXOVI;RTWkqjiia%2EY~0GaB%M5Hrw5TBs&v>za^HmCg34lPmoq zf+3wUj4T)^3qp%AJykN=Zr%-$Lg-f`6d4a$((L)Q6V0L&RqHh&0(%iIVTB1MJd}Vf z!ZNjz%!z;!#>zf|J^!jZyK>1OQ=g@}Nc$ZSQ)~NARC>ZzV&KQm8+FA`K}|T1%@RX0SLN4%|Y3;><7>|D*D^P8uv>BlpPER>6y8lLeh-kri0eI?moKq?OOrw zpFekdF1)I)F}ZukcDdGlWUDYQ0Y9_l0GKitmyj>2!vnnAgk$^55m%;tV6g9YwC9Vq zccN!Gx9J*xt3QotTPeJ?Z~gKy7Jxo?7nV(%cEpDl@BeOieNx({yfr7*+9et{diU0x zzX0CWmf3M(mtwUtLz$a~tcB-`3V?G3N+vxfv>Z)aqrD7Y?VA`1h2=_#7F2wLRGytL z0xB_{{yF2G3G9-QZ4g6e*NqW)wr0y+=f*0`laGO4vixJv^&gYR51_>0JU(WxAF!}0 z0olF+0}qmk+Mv!I4Wuio`#!3{4QPa`OFZo-q2K4T*fLo^q7j2EMBi1t$J4nsC&|DL z@!ti-_uZVww8A-cy42Mg%7@DS@-?Y`N!?q!^#?1~B%p(R^l7PEa~I^8r-=7WJpI1* zE|5Gx1jOnk zSnt&dRSC2;)~{9%9Su+glkHMo(bj0+ttu&mOE1_Wkp73kgKl|_n5vMxbqxtLN9qh) z16w?=2>_~t_|lk*O3=~v4S9AAUcBB7HFkBtCZ)z6;hqxr0$L2`l6OXY$o~luH4>-_0A>0y2&WMCvTTR=dW~P;>oN?V ze5@~gEV>cK^5SV7uA&1Kw35&`Rm>N)_ky-90>%ziHrZ>SA87n8I^j%{GVl$NJFg27 zs|1pB8w_(SZY$ohC?y?fy2yW)xkHR!Z)5qe1_-FcBYdj@1By!1O(~d?xP(J zW|7&afG}{cmamyK!Xp|`Uf_PEAuBN5E|<;^;MI-1`p(UGTyJx`jwI1oV4GRTP)p2n zEOiCRJTCpFtS2nb@%rfdt=RA4kR^&cvp3i$+>ogUqZ|EMh^bMIc#@joya1BYNQK%i zgMuwe{d8qK?Q_@O5?$=~X~E694|OpOblh)w?J`MC6_+7D;6Btfr}|WoF47KXMPyBD zgQG-WD%YV~X9(!Kk#V^TK<`8t&NRkZ*eGhVntUHEixx!A)m;+3zM1RVyvtSk{qLO* z8cxUoBm0%i6t_z<8AzsOVl^M_B(2(Pb;W6d(~m^(4OO1@CoKV)@tRvu{msO^2TwEpgV#S$pi-%lF=GI3DGOTIV!|^;*%6+A7x=d%oYet@iD20YS=L z8)edI6s+H;d7do@IJ(M?*|q?tpiEaaGuiThhR8M)_FA(=Ypw(FhGr)^ zXtt4Nw=w3NlYJYotDT|Ij^^~Oj|!=BW+#A}Gz6(ct>&l0o5|E^_RXWf?-AVQOEfAA zN+_Zs#8U;tXGek5qG1R>IH`(}SJba6<=58R>Rd_b$Qzwvz`tL;ZLDDW#3Ks- zq2;JCAY{GwEiajJcoO8p6Jj;sS}y2=-WJW{9GIw*AINWFy|5;rv%wFLLg{VnRSI9z z+_NAsqHa8HKIf)%`3NQl@WU+u-oyMRF&0xU%aP%{Quc9~G0)a{&)A&s;?dFP_o^#~ zO;0Jtr!#tzMehxTg#+?}MWL=Z`NLBohw~iS6B~*`PO>({1L3l?X-A&ybXSjXlRp&Q zJ@{47odm}qV5+AK@GYR4T)xkk&m5@UDvL`-ZWIQ@Lj^3AqkQATuiwu=*zt5i#8H0T zG$tRw;!Q4OqU%zJ7!^TnNonAP4(3J%xk%MSrakeI)0)wVWZ9^!tX;PKoqo^({QF9| z%*$S9^=>|yg3aWPhD(hc7$_pAhnNPYN9VZkpP0fq+iZ+Ie(H@!J}n(?ccXNOM(_4Y zJuWtCXd0ZD)2p40p;dN#g9T`A5k4MPG4rpY^WY$sQ;WGL&j?+Qi{&Sbx^fq3o7 zo%M9IyfcTg%%Qx^iyEx4k<~gqHn=F!w~6z-+psuZ&K(OYimkytZC-xESzg|dfaGMF z();`_h7Zys1Cbt~BTcJaku?OJ%I``gE=Y zk`>E&s@%Y86tT@VGCPzxB-Se|{$F zN5R@JoK7K<^X^msdY!o|$}*nwSLA~`Vh<#eS8c0$7>XkFUAPOB<0Lu)EdOq!elWZ( zjXqGP+67~jkdU8KlqZ+p3Z%23h$~7(Am6Iyk}||DdRqP(K>ZyRto}G)TOvi(WdCof zp?_45Vr$7}63-y4Rn{rh1Us4ZV3D{9I6)D+^Kps)rtmAR!uniV@HSUnJcnWa`@**A z3!df9c1zyY+C011zwnnz?{5Ys{3)GF(XSNTkW3!yh~K^5J7uPhB6|N{7Ma$ymj7w+ zFK=hRNl|0Uk=hbYxGiVzJd9UZfrz*MO)*&kvR3ck{QHI9-t|ge6gksottVk2Z@u5H zZ&yMrhOT6rQ9tmo$hgD@;!ix5bmG+PwGh3j3n(?*vJ#V{#!FiUZx@hGMa-V6y6gC+ zkbSVbm-HI_o)g&9N?UQ~;SJ~W+&EZ+A}Ha12BLCjy*DgJ(;?P#Erde(tpl!=1^BnZ z=ylew^#0a!?x5_;_$U2i`+;W)<*|Z0d3y@ux`r}*J}X3ks5@7LrF$h;VfPe{qW$Cl z^j{`8cdROuSJY1=UU3(t|9--D*cEp@E!^=tclM3nPdK3Y)}5_PX?Ak&Z1|@MmmS?Z zgOmF@Higm0e?K9Lvng!mSAu>wp( z2_?bv&%bLCwa#Gb(snGIv``3BaK~wf;MYITK&1;pNlcdNaAa@;{`t9;JM;PRl|c=3 zt#75_;K;TfoZPR84he%Tsis;oAFUT3@K-}*tv|PhCIwP=@(wZ<*_(+GF9j{m>bYbJ zn4|#9jDft|kk>c!(qxF~EV`=}9Tlf)Qs|lsB-6bqvc*5srA|Osi$HA@3}}#m*#?DG zt$pLiC0DeZGc$o6$rV)oR9#2xq^cjs!T}SicPV$bC4{^>=ddG-&^hw8KjYrmekXoa z!fS33wVml&bX?s}9sT<3w|0a>9ypebRkJe%y{nce)z+*3Y~>034&OMs3tu!DL7Hnq zYFo`Y=ruCsw*g$b@5oU@>5G!eJbDZ9h1lGEL*!L}7&ZYKhjkySg;o!Aj6ZqD>H)f6|E!!aj)E7HzYj7EZB_c3|fc`H-2TUMLy)pmwF z4#p)ncno?ICcY3=pic*%XuWVE9-7^qz5B;%@yZ4GLcZwKl&|2!xbYR?74x#k9rhLh(5l{cvHn7b_bgZYO^a@&F;AD%lCmZS{8NtxB zNg8>gUKcoyVEaj5{p`0D*Sf@AVhm?OPg0a+S2j6j>Z=cDZ%@91gT!>s=vqXgIsa+@ z2RO^{ujYr4IIHap$3E8XbD~tGe%vcw0K`E&MaDH6boXAvc5RFa9AAg-0+(wUmE~yS z3!jcWL16D*eF2Rx^mEm|5;lCnXyHxF2O@{8oUGd@x&@Oy3#e|f2YSI$;Ply^uwC+$`Lisd<95_pzv8RWpI3x3Nr24<+8g5S!u8U~_R%MWT|^D#O*mhf-|O z{Z21_m%Fo)A275nM}9SQCwah(87<)-g$jK5b*VD!KuK~pi|i-xS#+(hK)QlNoTH+; zYQY&#LHXQO#JS zm-4e5xVqpLe%qi+jq8Z|QHc2!G)s+}%9~~m5j9Nxlw_fTpP7(C4%g*TrX^ZoZWcxQ zIwt#Ii(fF&bQL2a4z! zC`~vEC6}lA5sO8;kv-uc{Yz)%KB(eBpdL^ImHD7+OwH^8V(!#fE>tE5r!=pD1fbbtMT+Z0*8d+uG|s8fYqM8BJ41!x1X_R>T%`+zhX{q$r& z1+*v)Lqk7GEzj!C=G_KcoyV;Na#5z1OOMP-t?}Wfg=hkXCj;Eo-8P3Bi$0?$DzjKI z%ShPxq}4SD4FhvNmIAgHC6_5ITM6%;0ybkv z@5pck4Gm^ma?cB0YzAX*jFLv+1BfpdMkiER4El8HaO!b&4VF26Y^^srN;5`w(H?A2 z6n~35|(>^nC7s|3+D8>v9!?bhR0`+T z(Mmv`B9Ts&*iC~rqS$^Bz}#n3MG6BbH%>nYL0fJ%B)b(}c1$gNZ|l_qpBBJNYkB*e zmHkQ_l1%MP_q-bI%ihm@w6y1A4yJsWiH|dd&FwQIECTsQ7n5<8WPn#0d)x->ief05SXdpnq;hbT@%tdxfduTzKJ zNPjltT}OiFUYVJBiH}cNqSx)(34G<&GPy>(Bh6bFwFqkzHJxa016y9?A~cEcR$w~G zivR42qiPo7={2oMj_8r5M(0fR)zT%0v=@i^SbIEKaj6dc0U7il79EvLhN6!*C?rmh z;q*2?QIdTP&TDZT2Tg_JVJ(5en?wx`=Q|*)SIrO?v|> z%Rs+F!4>c@N;W7dE*BfZBO^W#-I?2b5BtpH-p55>dI)`K@E=pW??5*DU?0jX0Pz28*gh}35j`lM}X?JIX zR~xcnz&Kd$j2yqyU0G`3=M0w@`&iAK35sy>TpWliHZ=dX+)M*@Za8wPd(1SCQ=9nD11h5_JS5A$8d6xUcgbc3+nncIMzCow4la-9sn22jlz%C5QOR+`MoH)oqQeGpuv1DDnFw+!OQlu}^~iLnPY|#iiUXE-=*<=<@#X$r*;p9uO4A z!G1VXv+C_)KF`pv-GW@d`*DqOrI1RXd`*hz2&_Kgg10{TtE|j^@Yigjg~mLkxU^tO zKzI7~g6m63XGfTZp}(-34RZ zxK&v!V(_{fAHb-4$&4pQp#g%M0?5c&Zd`H+Jk#{hOXQjgvec>e&|lhYt4=BtjbGad z6vn0hgx@Qu=ecUX2v8I?x0R`9M^n1Ax4g8mkN6tvYhlW=)Dv_~i8Ww}N6&KiB3mzr z0nKeV69Ot|p!;_FXg6YHF3ks+0ze+8l4ecGP_XaeAKbgd^cbEj+3p)wkhEp$1C5jS zVm`e8cBZ&2-D?0DKS0B0?RDzW0m}F#Kl5erg|5@|zMCPd>s3XF_hg!zAwKq<)HebQ z3AkoKRCEzb5oft|04nH#;{GlzLeUpkdA8Wo_W+QxOG)#gls`Gmn)6}_D}4f0IkU!> z32uC5AVrWr)bk=DfqOV%WaQDv4-(e;4|(ARrWMNPqx`2v%4kOKo{rU|SK1_9FO9yltzrz~N13>dI;F)m&isMjo9S2D^H`jQ!~OgyDK z!#_U1RN}7QkGu$2O$e2Z?&UuLkh&o{PJllzoZ$=+u2yxLOGSYQduMGX4cK@DElEQv z+UW`LT|P1wY67DrG|uV^#lg1`HPhuF#x7;7s6v@(YHoZsoEtY_Gh1sNbizp6m>N&q zpjBaTk9Z?Lh3hJcWLc)ian^jI1<4s!Ux6}C0CV99RkY}Myo)ab>bUr`A49uUy)9W= z<_YVU?~=GbBpfVRDn?#6?~7X_EBPZjf2XjC9%-#bqI>x#qv8FAuVl0Um~y>qY~{U`%Cx&xI$G-h`^+x`fNF1?6oHA0iK(K>tK#l z1zf+K2iMVNjr2UnY2!{x0lGPxc)T@hiboqZ#D_?&N1~vWQ@_?Vz)t)Ld0zLiGrbk8Nfl^BI#;B*TemG1_D5^H?Al@b?BmH|5% zGMa-a?$IfIU`FbhR(nkozUN^iAvnD|&@vT0a#orFj-XF2Sqn%}LQ9W#otm90ac(xE z#jTt9b-4O2Z#c0|d(YroYw#>EC^QecuEHyKdb|0un86Et(To}Mv`+MZ`eYE&yTK}! z!>?-?q2y8#(sK@@UNcKX`&%J`&kC!vYzicF$TMtaE^fZL_+UeV3}^bwaJjS4VHihD z&2wO3cIsAsuX*y?sY>9r*spzmeVjOXm?=QlqNz!I|gA?NgECGQ-WCU6x%0FcATQKcctgPgW*eD2} zrXq>e%ss6Qn-gRi3dLMNlI~~Y!_-H}JJN|2c&nwVPnu*Ux{dkhpZxl@Pxiij@pKDS zq`vm1$kNw2FXmo$ET$S5+2)7Q)LHR?h5gVu7oeivbUoZqOnUPCh4=}GXh{98I1doM z9DcDSp7XSALsp6E)C>2Vd1moKe1{}PU68{LNcS^KFyzK!#cmi^gDaKBWZ(v3H~y`D z_zkf4cib*17C3-Dyg1mS-UX~if0vEW5&>Hmv#2AoI}1&l+t$HH2N})_y7_S6AWJC0 zoi^!WtHoGRM+>sN8f*HSVlPgK7t~j=qQB)#zX36S3m{oVQy;AvJNdtxl_KH(Ur&*t zGBc=y97`>UJN}gosQCx3`dgAJ33Ef4TmK!V^{bFK;q)Q;QS|ih0I4N#_Mf57baF4m z+Aha!)+c->Ch-ui3<76mv!0jodsy}F-2V;E`_HfX2f_aVf`12o{|DQC1Ni@4JOAIn z^*6j=MitkrnsG2ccgTb+)6tBqpjm!D0b72`8+$NhVO>z-5Lf{TLVn>&(?#FNE^`mUq?4QVL2+Obl9Xo znUnBEVKR@~u@Qw?HsH1%gWA;DXM=)M#Ll11KC%^OQ2mNRa9#Z|I#y%tR-GbRS2d1Z z_+XtTk}!F=MNQPVw0M&YT`ksw+SF(uHPnspD7excH)zW;RFY2$t1;GSG_D>rqU+&c-jTiZEM zg>Y!c5zhQlAC2{l43F`>RB$`n*txB8v{h4p;sngu`bAqvi!9PeP(&d|Vk17AF=J;{ z0Cn;bC{T<4&hDea(M(%twQXjiyywe~JXDU%xh1Pr6(0>OOY7V2PjtmTKbHsBU=Ulk z1IyECUvtiM6l|v~VfMDefKZpbwAsOc+@N58L6*^RS*~JlA<)L4QtKx7_B`XxA-I_@ z2CI4R@?&J0Y?v3U-Ka_fRmee0Kyk9zdCN+E>*iUM2uOy^KHVCvr)aRPB*5jpg`P_Y zzD;be1xZ#=J!Medvl)Q;IBFeba{i|CC&-A79`}(kUeqFA`?BcmZx@Un{6r%A*;j5- zc})H~IBzg*M?PC=bm-Z(SR@Z$D!#6IZcVlk=GtrC;JL6*np45|byEVgSc0oENwcNG z4G+1jbjLB4Ci~9VosgTd%_Y?iE)>3@G=wssbZ0l)pe@@mT%&}N{;X62e@N)KQKl%yqdYSlS)#M%Rrp{+ewqfOo2F&Ym3*e3I&*}Me ze}$W=zAi){J5#WR=im(m#gVt+pi9`!2K|MvM^o-s_EA8v;Ea6t=%w=JA13r_$qf`J z{@D%0xLcau?MFXJlWnUMeV#S?@ucAyaMe2^mo7fMcG#Od&~tw;fA+vpR1RP8ca3e- zPfD(^1JLL>H#7>&(C{=`qf@=Ym|q0%)VTL{*l5SI^cQx`nz7z@aab@+`?{o_pA%VF zW2+7S=Jk@;WBc6~L|n7Z5m*G|ys&Hem%grS$=5;heI6!^9-39G2GXY10I9>(lF!J& z>v@A&_#MczK3wooR0ezb4Qq9NMIOH70k8T-60FLyak})os^EnKX0ptW5(+cRw?Wv& zMOx!jk#axYbnZiKHlSD*R*`2jpiExt=Jd3bjPYcRj{{%xv@e&OOnX4&ZR;HPC#Nd4 zn50=YudM&T^b#tWy&>+4gorC53&B&rckt?t*3JHZc|7A3)+YS@JGK~qDQ?TqFurP` z9{ft+Mlx#Vz=d+1Rhnt<+5Ah!(#X1p2YdF<5^Wyw@JpMLTg#92-j9asgB7f^ARl`R@6?`+vUS-tT!%o(I{y zdG~(TUVH7ee(SgPYuXoQ+&=jGfxl~LXnf#)8g^Dg<6Q#{jkg-#dl$HJJ}dPq@arwa zSvMDrx<1`m;E!$LC%jH*XpjjzHZH#d{H=NYv>!r4GAnYw~=h?0Lg{Vu~=a+?Jn=7+Q#kQd}Zk%rxp;&Y-Vm98~@su*3CN(|;wCsi7ul z$9_27$Hv!O6OjD7%m3N*wj?|xWD$w_$*+ID;I#b0%JH$U1a{aUMHY@tSQq)yTh2KI zr;HdI{C4|4RnXQ52Iz%m;l;>qF)Fd975e(8x2snLP?ex~Sdn-Ht8Lg0*Wx?iZgqTv zNq^_H?uM7`cq6ymSgiRDzOzl{GdB7L&xF_SoQk53P2O|ORjB%dYY4T@Z7*L>e%tXmK)b9 zt|0ocFW^@uPp$r<)BYpc$$Ft}xo>$bYo!a+j-Jle}i}IEJ=!Oxgna34$Si6>YZYwgkWhcM`GZS0T$|f zYyl4~e!0>aT)Z&M>aYEegJCLZVubm>=w!StMf$#||o*u}k)3K03ND$Q_s5+1Hev`qiUn zEq!lk99r3Xi@L|uQqyP7T*V8&n070vR(y(aB3H}QGC{f*N7dq zjY}^Gu1e1Xu$+grtoo$dwA2<%bZ-Bg=U4<&uSZ>Ep#;)79>( z3ha7CBKyJC3=_z-;VBnaafOLiX*-)4fHa>B2RHFsJ|T)Z;`{(HdD;e{oGdUr4mw9= zEwc2^^||}EU!m`CMeKN;or*I)iEG&?|IF)5qdV@>pahd~NYNuUdRvFvA)KL7e+6^H zgPXkOji!$?t@5uvx~fABEg$3^`{SIRdN|7^3Ie6Vq3nD(*5WJ41;Gx zCf7|#gGj9JcZV%z;ux1m5EvAA8oF#eyi$Q{pJ>)Dr6)tC8jf%}DfHJn=s%`=5uv)? z+!m~c##iSyjn37}oS~o+(Z~lpRJe6rqDne6`R<1GS=dF#K^30=hajR)>FH`0{6kq#;?#-*C)OH<=mg ztXXwyfil$n*zw?KU+s6Bz1n0s?}9AxBjr>KEb1V$e}Tjf=Gs7*u^q94mP{MVy2=bp zXM35M@Rb}Zp)ce~!Xccs-dH_%-5maE7QY~6Iy~j;L@_1)*$1|s^rfTp`t-TF*64~G zYD!*ef&Vs-c=FLw^Q5rxvA_BG>nomMV1eep4Y_6~(fN1kZ|lwl2}q$`WUAnKN4FV? zc{k(MwK{@*{280<3^Dl!zW?KaHY4oNXrxzQ2)PjM9MQIOc` zvKGnDS3b}JEG;RsY`M=-;)zuWu_+yYi@57LZer7HD?_L!5v5eGyG^Wba4lWn32UNd ztVF1=_kb_i=dixN%7)m6V(q`3Hw{7*I<&WZV9KQ|fHgEm&c}d~{C#w~1Q?UIkDvHL zXSgA-ZQ2C`&)+fMe6xhuAdcu)DJf(xMeR2uCfuoCFn6h-sirzF^T8C6ij&}zFAgbu zENHKx%R3?)GvE`}oFV%v?iFx6-YD*U`*w#C-0Acy{67}$((agCt@xjvb3befjMB*v zHs1{5x-t|2sS;Pk2j8p~VLDPck4_xRP+48hmU{Hhk*IXf2pCebT2`m;@910D=hilD z1Iq3iS-JEr!yrjMo>&1^kimtj-*&3Ls<={Ad)R<;XGv?vZXb3=zAj2GrF|#G zMmn9P^AS3(AI8-z+CLYT;^}(m=a9JUxY+^@1#Lf5#BfPTS^mMqn3MXM*>kt0LlCz> zvlXTyDeI1M_l}LlW(sLyIbc`m1?_hiA4s^{-1cw>1=k4GUM`ciM^SKl{UEGTIxA0+ z$P;wF5Mb`YBXZH9P`Nk6)MnIVL6D?BX;ne>qWIMhnv@tV*4{~0F(6B$=lJ1)kaMN< z8Qa0dCS`0rT%dYObBI|c8mI=yYO6m7oY7I-%- z=MYC|$H6UK#FO<9<5)3NBr3(O+*ed%UP$wakuRh=AW7)^WXXf1D&>$E(Ygr~-kCTC z^D>|O1!dmFZjoUEM_A$s#GvG!F|K9i=z10RRG>^RGRHd3GoH&42CS@Su$nR4U_ESR z6{S`)b=_W#ch!IPGPx0>i`4xlKL~ZrnnYBL2@^i=w68aY1;Plpj&zQ9>*}5`c>U!% zr_L`Fm5LUQYxZs3$YlIdbEP1LSyE33*cRYWP7w#yC7f|FdoHAEgc!6377^Z2)Kt6U zD1l~6ZiNpRr#;+pp5~31J4wA)n1BPXbeyp@uq&AeS`+hC;tPX9#$U}IL%A|(RSpRj zVf5rE%!g95rnI$6AgFiVW0j25LB5ON&RB>};vFe)g<$d^My;XoQ#mT*CvJMcp%^}O z$AVw}RBdGp^%|7wjypP^eDsh^TiIa)haqcwFe`i48Zd+6d#N*e^0O}wDe6$luvUlm zip#E zs{H}2W22_W7-q3wYllLiG=UX@CI4dF)Fvdh1W z&}L;f8^bWf_%+Wo)l&00LY0^h`K(K^T|>iW$bTE};@~^W%^j;>vh&zi=Qu3*E<+u0 zBp5^{js*MbgQnnt6e1Tp2GLZ{{S+=|T=DID| zrHvKi*eE3@5&2QL`hXcyhN{`?u9QMZSY%e&y1Puua zJJlFi>y}4v)&g;l9X2p5t&7eV^eqm~NOibjr3Q0WRUpijQUgl293I@vs^Q;&gg{5l zDXn`|Ca~3B{zmVtFl9klF6W_RDjr!3-%43B#l|)5y`klnms%N5>w2f|`;36?UM{Ht zU-YOV2NTftUF2_%R4ZzHbRtlpJDV}{W#;>aQ#h6IeBCP#kLau~`+~#%X4s+FDAa7K zGcj;66H)1qj|Rn7x3V=;6M`S&O@qKd7BH@yH`UAzt;$wLJxHxo2(EA^c_S>Pm3%A% z5)s&zGHpd1#e6u3rpe#0WR(sB&~D9M?%y+a39FW4u@`jUhYczx9%yLXeD-qFo*Q>e zuC-J5fg`x*by#zNwjZS8Sk3Rz>vPR;OIN}5`~&gyDoPKgd@K>Be{z1V)*`vK@Y4dv zZ?#C-y114e*>Vb&Pgkam$9y@cGDImWXwL~Bzk!luyLR_ohI4U?P^b_q5gMkn&OmgU ze;{V8!jWDFRt!Z5K8Usr29x=6PYtRs8PIB! zaWZaUta;WAyW&;>RSrPMKWaWZ*kQ>}5@b0ZRwO>c7PNT14=W5~A|_?~<#j zpP4ac>|o%vE;k@uqRS%bl=b)*!E4Wb%h|zLj8v7MGMj%fo~~%6JJJAf@900ze`suA zH)^)~1kre#ZV~!zK(B-T+xAWz2?f%OOSt~nu7!5R!t6;PA6QV&lz_shJk;Eo>f5=g zKe>Qje4l#rHX;VF{sO@IU39}Xy}}Mlhj-J0ox${JRlgfJP>JC^GyH!s!TrCL9p`9y zhW8cS{}-uzRg8)WoiX3GBli3o-F77jwma(ZyA3pdzA^jq@lc4*MsT$YE}r2Gl6MA; zL0tm&zaastB$!E1+Iz7zK(dy73FiaS#8LU<&8ufVbboJ)9{K9M|KBvqmn{McqE$0` z10C!j{zvu>JBw11)+Z|#M%Pw;-pvFrUmvWKwS1qtH7`3n4~<4i9EpWIw92AF-WLp| z$)CUNxTmo7#%%3uD0SSr*jYYyrn_xt$gYXURC6zCK+@&)G7`iJvl>h!mZ*3K9jz5Q z0@}iQVWJ>H`@I~kt${ORXA1`$gV(EOi(A#trWRjgOUe^1#Gi5sjTvo@K`oys6|6CP zWov6RKTEx!Tvdj%#Em1KFW6bOvFQ7gHj&au5TU)33=@Qf=3AR${PYSfS5!Z8IVee9z|NQ) zy0~~pJ^LKqz8LPP7gQHG*7wdbZlmdhUw%gKPUqyWspga{$k`}jd_0$DhzcwU=EUGI z!PsZV@}*btBV6x^&_U0ov%BV~RJ>)|6s! z@DOecePjGWy&=Jo$NUD{NSC({RNDZ#MXo!(CL;k^H!a&EB?p!Wii|$;dcelrJWeC{?g=Rm&c-xi=-EYA7si(<56w@Or+P!@e6vY+g z>>#ut-F4~vjB%RlN(I4K??l$Y zP|8l1U4Ppg^S6TiQd@(NhxU7m&INw8aLh(HA$33FvZC9;Pwi^{T>2Ef%%+gwD8xnK zjcdU^U~wttxs2ArizkDBH!o)IRxk|FA-&>)$5iL}%(ih!t&ddTglP z0qe(4>9c>23|Cs8_Q@wAh;YRi|7Cj!7r<(iT0u0E9Q=nI{pc8P2}Xz*K(o|SE4;P2 z3V9IntBMeWctRG`eKQFwT2Lga55>X{P9TPd=)PLV?`y@Auj(l$WgdzTEZgU);|Y)Q zc`cug$Gy5UOK4wzvGNLwNkOfnW9A3vz55XQCt)=|R$Jpt zORceidAn@=hQNzjx9bDMCYiQr2At!cYR1mK^dDeGw?^K(iSzy4$*%r3!XbsGZ@c}* z1T~Vc>$V!h81Za=TRI2wTtbtqhz{=Y!^*}G)h!#Ht}%{p#=ELpZ4C1=o8)JAvB*lP z?bz{R?5kfyh&JBq6inOKe|vlDHaiGj3XEPq2GA6DU2_a~fwF(V#hheN4Y$6&S(aD> zq|Sv2ij6&lFe$6qkt*8Ig?|9K2$CWq@ zDW44(P@wU0Wi{jE;83coN{OTBzL|i7zlTdeEiGr?n=XrnZ@itx`v9}Mb?N=sklzjT zr|$pbmw(>%?}o--boSq(jo7Fht$zgQEsv{FbOWdY1SE^4vz>*}#dWQ!>Dl#z(f9l4 z*DqI0$NA_>`^_ijn}rDx<^bQnwchN!w+|bb2cja^N8pLIyS5wb+L8S|jsd%umhS2F zqG`wP#&8{O|HUrD_VMe>Zjuo%lPhOSm3b!z-H?y<(+YacBR!)3_B80IG%or69v zCCxy0?OufARxdJ4%mb3Hp+xfo)k#xBzKNgTGySjcw{z__!K#VAR)ORvcU;SFP`RxE z3V`az4d#a^<8@S45}03pRq;l0iUg3{=B+PscS*TBf%Kg*M)LnVfCAymga9}2+8UY3 z3c47iZTx1l_1gg|gvA}od3Uk*_5mFG zg2hJx_Q5dsAl!bd^Yt4a7Nw3*WNgbfPi7YW?%+O2{iDH1bN{^{XPWWHwLic7cSA$t zAFBFq(FTL;?&5TP{nczPu_asx5DCEN`b#}K&Dg~zcE!P%miQI`30KU;JPmVD|8l4J z!O>0p{3H+-rOl=M8TaCTFlIdVi17lqit8>+9D?OsHgDF7@3*1&{o$>*cJze*PFw5> ze*Do%lf#CuzHnU=CzgD4vRD1#Te8cQX49^;ym)~|7GC(OKA0& zGVK873;){>CWl2N_vZ=sohsvNuUg6H@?4DfPOz<}z|ZiQ={NBdiQlZi12sE`?Vr1( zp8gQ_@=!bSi`=*2ONZ2yla1Bb<%fIRajU~HV=WZiNHca5rYW9iX0#B#{BWzIZt>fu z29#Q5{F_4gPm3mh#MVFK#J_{=rl$S@I{sA5|Fp*cZjddv;JVd6bbFJmXw)48Oemmb zWq5_mUEp{fDFQb1$3JVOeQV!uvup3~q4o98*MVJ?Jojpvz#|vl=z0V*HbRvuH#h8^ zKTzx^{|KvS&2Jz4P!OpN#8eQ!;40l3v=vl`d^fkMyr28V2JH?2PrmZY4-Y&(8C+_% zF?b#sVxayOmV$@>i*VX+-u_UFfBro*P@RF4nQ`Tmtoji*V?)CeKJqvFLAMq#Ytc7Y z4C`d^*SXpK&nYa-z6r|G@Przx&sl27flrc>cbKc7A_e`*%a* zFBBWG(TtfYw8Q#mW=h_qQVJ6&E0~cK>M1VJ6UG{x|~lQ_~cH z2v6HIYTjNg;%62#blVyjF0pNgRHYj{#TinLo*&Vj;Q7r8&(%_uiC&= z$~0QQ)7KL#gQFF`i_fcd{&%4-<$TInT|1!0y^#+T4~+lLnRM~C(Dc#XDaFi)t$0l8 zM>eBCMH={gGW?f-nqGXs_jddv*GR z*N20XCsM2)W_bpk&rW@+>^oPz&4m>TS}*S7 zTrJRIb)jKI>l<)ud}=uSxKZxGKf$f#r<(nWglA`gptg4@#(h#aQm67tOQO9}t|y7b zKwTC1*nP=dDAc-eH;l_m@Y$=t!C=NmCb(LQwK!0n<1%4@-a40HkgDbK-XH%=d?8>$ z5#xQIuQY`x0VBUFQ`j0rOg!{*Sy@k)FT&F)#FC0W2#vH_X0dTWKJk~Xz#w%dDxr5U zJ1{>e-8YE#w1ISih zUh~a#d63ucxI|uYISaeCvGQv!|3P1hKssARq63xJ7m0VYTy&T1mgkR-#{m;&T5Mz< zOVu(pdh^S)uU%~=YZmegASia(z+B9NSpxW6j+W%ifb-6jP}FbPI^{8KE4OEVIhy+) zrX5=&n6qea`rIX1E=^3h*h;9-&Q0BSI7h3ZePw9&p(%abIr|?P23m~R%+oH(f?woY zH}6c|HSwZZr@|2;pIn)>aB5iRT$aH8{>O@J^<*AyU#tat2CqI}o7Jw+CqmS}vde8P zXtah2%tk;ifbW~UYNmi3hmIGD;e*xz{Gv zEY{P{mtaxqymP<(w?SZ!cy6X0U98*4q<-3tqOD9nWMdCD5oF27hTum-=;HVQR&eK7 z{1>F==Fk~&SuG0^a>k~XdvVel@oV^5+O$aeGMd<5ILC2w%m>CwZ~K}P`9ldEM_b4b zg8J>{T8xuCfWmg@4Te4aLHOBIBqGYWcbo)j3PiW(i70!>d^_LRzWSOHdgkNMOrRvN zyl0uhwlwcOncUZM)pw4v2idE;a{q4soGDKz6K@P%dhi{}%R*{-eCdIo0~Ul}J$l?+ zgJ`@#H}8EGTTq6xtGf-!&6|!JfGjylIc7s}D-_~9Gp`?Qa;*2H!YM*hc0h`XBFzHo zbe&IJaHwNnm{Oovax;J0Fa^sc1j&CH_qFs#=?eLb=d;^BE&+pn~!a^LBklCmyZlguYSDBsR1A}*|sX}8)YK|Wg!!LyrN4)mMEfG#q5YZUPgv%$9&pDhR>)+%fAfgf`QL)5eN`C)`t$Bc$p3 zyD^hWz(QcbNUy;qUAKkESx!}a6Tv5&xjS@5j|=GTK)+30&sceJgI!;ni6~*q{;o{M z2KHKgWVAqDJ<$-YtrS}Scq6&roa*0_z-fWQ=8sO#M3lJiw^uprj17oQM(Yi{bYeux z?kimt6ku#YGhn<~PxV9lfOEn2`pms>kqyXW`PV+bVit#4*|o^nhZ2V8hQE9n(7EUe zMmoita}p3hxf8J)q-f)8UXOn1Ht1RioZy+-RN)n~-u`mHc9FOgqX`V!YY-QE1?<7@ zI}0u|lYAmMeYUnUSQ$E8u2$6mYtG%(blLu|BsGDIMiCcqxKP7qdLAOUF&vXZ)#IUCX)^+- z;GPNaH#F5{c$w;Z@-?tHmPzS%i`ulVkyDMrqdlTF_%7+b35;%V8znxzaJ6Xp0CCRV z|4B6_%80XkFN}r`{b+jAshyHMU2YF}(!=7W%aX(V#*Wei4>EX`t_;g@r2PI-na>>b zH0x3Ga@$}qdQ6H6_;ZAKUY;ST6*q7CT+}q+sDp0eHWJ`4bbEbGqSuNcC1WiO{X}dU zx^Q4dFENPV5x<7??=K;lWe67ZVk|<&#E9@*Brj5bqA5twAHCp|naQ&&i(1(KGGoMs z!%pEK^btBzX#mWu_oSmKf-SHq)eFxXLe6!hOvf#(=1sq{>-BNWGplC*9AMTvWrATW z4x>Nq)Cx_5=Zhl1K;13e(ao~mtHgcN8iSLgNo-!M5Yuu#pGe&!UQ5TxE!)2w&X7G7 zPPdBbooB&?EA*_HVv?7zQV-D>L)_nAjwxqf5{2ffw(hrtFF8e%vU$nj3n9 zl246}SyE%IF^x<;acFxe?~TZ^d&zyQ<9{MAi!Yp7hkiT_v~ng?0<7@Bdm;Ew&PonL<>i zkB%Zu9$ylPJcSRhs>_2Lg_ud5+!%Ioc*9b!yAo?RIFz=;aeEQo#zNML1u2Eqk#b81 zlpLA)xX-6J*DhbYmQ^rkil6QAZcFkDl!2J2W02g^Kw8Cdl=2G9ub2&V#yW3rB0g?0 z<6dN}qC>mwpCEP#>mk&+r;$)`8|(^399lJgHt-nt6ywr_ogk^ftTP*M9Pm;n;Uhed zG>xE@R|Z>vaWHKpb{K`0SK@BJz(bhs(q0=9qMW}5FCwG$OVF=#xa1%-}Tx-}8o z+9Qbl<`VKuC@CDV;=}Teso|#E=>bIu_#rTpc|Z7;jBs;pG4N5r?`U)W%R7BNT~2o$TfUOQK6If1VYzC_ng9$z;3h6 zUmvMf!%v}!%tfZI>!fZN25$vnURrMNxvEI-QiX6gl3!x;GTCQg_fvei zwfIE?4taLLvB@B0vL85p&8b@kf`emqW1V6H7Mt~h#YPY+J51Je-nR!2WaGMIfScNb z1y2wm%Tpc3uz;_mztr{*cf51JRuRfd4wv4nw%vT&<8h1N^=DB=c*~fUec_U?3F7<| z+b_jN!XtR==b~PJX2bdXFm8H+85|ZEwB5dsf_dTf!bcC=*u7mecGCKJ+`{oVr!5VG znD-FBR+E^6eLg98`+~VLF`Zr$4ikleA4LgjKvS_Xlh%Owl<5U$paA!fDOOk!pfK)iC)|*LBo{ zmD?hr+R2iq&==rq{!rvPr+KBnk@64Oo4p%ayw*x z`IzF#@Us}~J`5vZXs#Zxqc`hr`E4_BnJ6~mKuRIgm9lJNB$(_KRmgR{5)3GP-Y(Uc z0pc2Kg5Ut?AMiCcfT+8A24)d_qG}?~!rPX&Hn=jw=C_*Vi466Vr)y`QsaF^`SVpAz zym7@$^*}IYBYRfG45pWw^V|Yg3d6RiS@CD`S+1GO>sX=rRJ# zvM>v)5LGjYWC#@|Ev&y(2*b*wuhoq~OS$1`H?Wi+gMQ3ZPB$NwnUHkcHAM%BN zo-25<*|~jnEGXQ*#2Y)?G1~HFf;D;8dXFG;SzB1;3%0bSpuC!vbI60(7lDIAb4R&M zCFKcP^t|OUdBIkHjkA*_4`5h|hTpBu^|k*EpgatFDkT6&;XaBZ%AV}7ShcW#Jb6ilR-%UW2W(II%z8vZJQF4K+| zCrf1wgLS@gc_O6QZul8a#(#{HT|)OewkIsq6G={T8E`7N)JuZggJIZ65A>!a5Z#Mg zzT4Z0+UKJVOdpvHN?*Iix`rkWr|751#62R;x><%C0C4N`avkg$j)di~J*};r6DsZ) za~f`*lOnjz!9*1oy3zCTL=ra?56_!6SSPV#S_xjNK!=){aS!W|Hp>N+8EvLFY=x_O z|3c_B{X9{UH(co|(#rtwEc}4Q_G6RM0Gwbuo ztOg*&(!Ql4wjd3g&w+#ll?BpdOGU?=slraw^jejFN>l8bb3FtsE?TKuKH`rmd2w$@ z*mV}XT_xd8^B)6>SQQ}KyLDY*t*F|;geF3QV*UNmYC?01Sz!i`<>0H0BuonTJ>!p| z)~v@V-3jsLMgVXXLP!+=pq$0}gF@4ma}m3k+RXTv=02_sd}STSijPKNiXigosMgy~ zxhRmDHh7fp-6(XBfd#n58g5&wu;DAx`VmQOE~7o#X+Hd{X`PJM8h55H*#t8+Iu-u2 z31)?Jr4_f42pqR6AkiGr0p$bx-7g(z_k)2OA9t>~s!K z`9wJcXL(Y`+k40pz7%2o|gifg1SR9|$f zgxdflBXEWZ`*qNA0lC|0aHbdACy5@TK4C%3wf6I6lEah8lrOZu~}_}aXVG1>GHLsek9Oj;zD zHGH~L`rvtsSDz3!ll3^OS)gd}FPZQ2=@ViI>etC`U@St>kgvxNTK=`9FyV~tTH@@J z&~UINejjU()Un@@PrE8SzOLjtmb8`zW<5rZMB-ESEvwD-E{;)_`EPk_s%szFE}tM* zT$K<}@MA+mkc*b955CNr5(xJSE1fG4*~`BModXe{svUicGI(v%0DrKwe9!XhI?>`J zeZOT)ycrEKa@4;!(Q2nSc?g@Iw{Ewf#vGK$AC%!_ZPU$kI5MN4-mH_1Zs(~JtJvk8K~fM+kYNv3I~oZUUl84WkzO4tRA?0w z5mVun<+VQ3l(zb6td>v~1fV}zU9Ga?XW_@4AVD|F^4kTgSu6gSa_kh>?O<%OrJJ~E zFJkXhGsyv9SDFX{tsE`4n*3Cp9C#<;WLqac^(t0xV3t`zgelJN>?4Gaqk|PB0I#4h zW`U0IaT_DqXwc4hJP;g@u);I#nMy)p@wgs>b`cOF0o+7z_|6_X3J_X0WmJh>-Vu^i zS|GBrC4GlO&4c<)D80?ymB1T+DDhwm+-;t!ANj(=xvrA6yk8(5KR0TwxF&=Ip)qDn z{!cPkoAb3rnuKBC00TB{CTy{_7(O$kX>adT$~sPt6c3UCP(tUX1L9yz#KN^8YPH0cw#h`C zns1<4OkkX>MD{hT@4ZS)_tR9i;?3*~M8jD0`sf1WQ0@U*C`$!cX`>ooE^K8);&MTK zO`k{YoE{o@18ZLRE!Lp{oeA_rVdjU_n~E#Aolp}WBq}nO_P3gFAk!T21!^x2cp)Yipu4}<$N(f&;b*tGIx{g!==j0D}a8Q&dpKu$ow{$ z(NY1BrWCNgUx#qr8ZnJNbCF>22JoIVe(7<`y!`1VtSR(x8H9T3VYMe7GFi6#)TES_ zMVVWLS|Xt*`7!RuUR%Y~1)<|(LBoa4=HEQ+YVbl^0gT;I&cTlj0o(dMG$Z!wK$=hJ zi%}CJ>~F!Mvf{GUA~B~BSruLA1HK5dkD-yn0vkyJQugxra5%D9xS@+U2p5fQ&5leJ zRt6a%fp=(tZUF=XL*c_yTrAfuWkE_l56oULulznw5W(Eb4&*tCoiC7>2gHyF@EWp? zut^SWG;w;xah5?^*2qvVCr?Y7`NG#Y@UD%cz%bn=j*qFK=!fTQ}*3D??b5F?X1BzZr?U z)Y2CL76-5~z?Qa}c*+sN^Mv*_Ot4^V1-Yw#4h!8f8$;FwG=6&eNRTb2Y?30OJ=nC!m36 zO!p<~p2XMcV_*38`JEyWl7dMc4kS2uv7H@F+S0X5cWAC{GjB$Z2Lspbg%3;Kkg9bY z#9+{N)jdSxgY)Fb>OOa|1vU>kAYIiTKIeh6aHtKwYSyyWhB23F_t)i?hOvm`Nj diff --git a/umn/source/_static/images/en-us_image_0000001772421057.png b/umn/source/_static/images/en-us_image_0000001772421057.png deleted file mode 100644 index b9aba91e5bca13fec97ccd273f1aaaa66f1dd15b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18555 zcmeIa2~bm6)Gmsx4cZP!qlluQpx}gnG7rH4K|w^BWr~1`h!7FNoJ2(hWr&J^GDU?j zLqsN-5|tq;LYN~2NDD$BA;b`pkc1@f1Z@BA|NgID)w}mr{rAbO*S=k{sfAFKS1 z*&dUUsz9z?^!^?A_nI50E`&%)ZD^MKU4e%bUXqeJwehsYF~0u7 zDthN7_1;exrDJt3?lxO_M%>%^F6{8@B!AM%#M_4N-?6NQ1J%OjtPUU3UUQhf+fph1 zj^XL(gv#%Yt31Y+LuuiJ`b07=2~N&^4?nW za>ssKg#-OzwiS;*#J6kV8l&(gqdHa27_SkMk9P*%Mxa?;P-BPS_x68E(V(#v_H*O~ z?a0(*Vjp7xX)cOjGm(f!sEMvSz-m|6$i6bm;~310VEI`96K9x5b%K z1Flk_a7e>!8VjWjP*14vyY}F%H{;t=lT|3Yh7{Bir@{|05uNttN~-$9 z)N2j-U;FOM$*s1~el#C|syZJOFn{@x|LP?{)xXf)TH0qnP}*ZrVIN4`q$Ds<8$%4@ z#Wlz^KNcN+(~(n_AM3{Yv_2e!&i&YFn?*^LQAF?D$>G%zVC7$x@iW{tw;Iih?%&(P z3k;am61P~u8(8CbonB7lNm7nk^c6u0*SAYYCL0se(AWdwXQy|W5@H7)Tqc-thqLSw zzSpV%1Yg{jsveu__8H*vUgu(ZhELgDxk&Vb*`AiDV%_(nS-X)Lc8WSvC27*Od6Zhs zYhN{X9)~ZUzAx9@=~9U)>H%3(&}7)A{>7Hl)7XyzU6B$lxE}l$7c8qTx2Ij}$k2nD z31%vr2EwZUwA9t8VO{pWV@|dMd4pz&x_TNTEMfjTRWPOw=3sobl5dMOK&se3dZc1* zF4O!WKDg6m+Vy20rpM?b(#g$WKidFY8)*uxbqjqiW1aK0eF4t?uUw020^%1Gvcj8a zp8a;hKD&-0FfSEcG+R$AuNN&6D)G!!z}nyGdpg#LWB!bJ>1}Z^0s2bQ_Iuo0Q|hXy zjK8#;Mu}afaM!Df-MUjTN!u*vP2hX8NmZ~AoG@7iSnl;EK=~4!{BlU{+4YQjV{aNQ zJt2Q?#y=QOO*%*qKLp0XZ-Lr5=p z2shwzUy4~L)?#;@7Y4PzDPExrU-(9)AVidsTAYyHA6Pr$jL0M~$MLkfzrccOa0#4W zfT$NKy|++uTcehdGV;>sWsVD|&MQMvRydTIGAsNL&zmAr7Q+B`Tg!8Vopx}L4dta{ zbModkBQ5l0G->l)Ibh@ObobdxYdLG;wN=4k-`_;jZtWCJ(yGt1)~luY0;af0>$ql^ zq8te^lPeDHg!>#eS7-a)G`}Y!r>~n{P_vLJ^9PUPpXrDe+U~cAI1(qPWDrz3${(n8 zW<(OAsZy_|EAYxC@ac4Tk?3iQ37OaFMZ2VFt@zk3%&PTnI2IN2!Nm51!HGCHef&(l zmc=MJMirZ+?UTjYlL(L}RbQ&Rwb3;-Ze1{MCT*n?lnl2VD>bN`lv;Bzm_Q7aUNh~g^GPK|sMC%5PRoB-(`dHi$nUGBqn-?nyHdC+7^ECA z*K7p)6+9hgz}9jU3VA)?XO89b(?zmBRZht zQN!hLcSNFmGpAe*Ciu2hGU%k5@4-pPPoN$ZnIFB8s5wD4d ziCeHg?opcverg%9OvV8CYxop@L5f_Il>$HxhfXV}>0+c0v+_1%Ih(ssQSgnw8jR< z$Tf{zGg-Hd9n(UtvUOawEq64{x%jU|9;=@qnjttN7V(JTfD79awpm)BwRb|=H5zT? z$6tb@LwZaZV32o?dN)8(#vDnza88uG%`&kEQ-xd{&cjXy0=8f+v<~DMeSw7dk2Gq| zn@ViD}jy~s7pXWI!H6TVG-IW=3WN+ZqG1!@~lr7-qM#b54D`*6qAoSl22 zd-N&)>r4oIF-BZ*5VeSe<&RGYrfPAaW*E32;bD7soMD*qyYGVbT07EGbOTIkV%Ld` zi+1uX-kZsZm^*<$MoWo$^yV!Yocia? z^h|k%|AlLihZ7xv8N^KQmOW9ZKjX(+L_V2UPDW!7?#R_0L=7M>18%&BuDnS(4@R*T z*w7|~0oJrO@@_KxZ~IXna`<@e59v86Rot+acKihIJ3Pj1r=}fh`$wdFs@*~XtN^5Y zfP?F@v-~dDyTg2>(=|;-CRi{>^N+--j2y~FR-t0D`>?y6UI&tDj1%87u!1N}8{cmD zyZWsgTa3}SUiK;QtGSuFTDFZ8;f~$7q)0uaoHZU2gt8khU^|onED9TmQOV5#jDZ^N zb-YqGcEJCT{69Brm&MI|N=Vluv928o@Pgcz^PdBetsJ*&BonVAA95z&RKaoM__-^J za)Hwe(=`*M77(AVRcA z6W=YjFy=U@Mro5}9!Ot<>DzD>qFh^rTMW||C=ppNR0jg?%c8Y?K$P4_Y;VyceqFL_{r$XS7zX}26ODEirqy`R;+2*KAe`D9JMNKOGvBZ}R-Mdx2pu=qq2NAk+)P^k zhuSNj3s_HTIMvPzEo=?jcjHvM!&^DQsoN*6rvQ6TO@5w+i~@}r`Zs+I+J-oy8ne)> zQVwUkAgb$cd^?Uo&x9km;U(aOd*H&eS8 z+Z~0qWko4lwy<@#f@$}pyOn8iRpiFGadlqQ^t02(VUG3dgG+m5AqVcu2!l?<>Z)&jfx)ml!=k*#$%Z?Ct7TiWqkp=Pj5>x?guvsiA4ZUsu6 zl}V3`I9KeNlf1*}57k#aqB&^poX`q29(FRiG?TAP(-owvgtvxcikk1bf~dTy+R-OY zDoXm-3*nP~@O*v=j$h){j`q0_lij-ox6ta`Zp|rR;hO9e}P`Pz`-|Yx5_KF)j=cm*9bXg0A%|wiL%xCFURjw zUy8{8nS$0O93gek{a@fP|C#o0fQH_>T=H)`yliu?uQ$y>L@y0@0Z_Sr87dDjk2J}U zL;n_j_S>M?qsMI}f&#Ju=aU!V~eU)y573&oq~x;gKpB@>+|Xa_K9iZUxCnw7bm4+v2H&LG@OOE2N~V z&PuK$OZ;`y0JwZBXo*i{lIzi0iI8p$NUkqPl5HQQNv>Ui%hOA)Q~DB#bs0;pp_!72 zuVybzZ~Onb=`R|Y!1$r;nM#5)knO#-FLse2PLz_A_I~eGC#6Z&o^H%6?XS|ecygAn zvs&|L-H86K$~LHgJa!m|UM<$(6__Q)BgT6(YyVD!qiyOnf}*ox7uN^& z`5=5FW1}~z9vT2SUHhGpWWAZb{-ci{JARkHy4jO_Z`>!ZIR<=voX3$orsPNl*H;q}MIWNWB zpWd{8WKt;iu4kdwT-Zxpsj_es`u*c$uXYa?Fbpb$@1#CFP(D?CsHrnfZoH8>Ww0|S z`o;D+IEO~wz4iKu=YWdY&Ba_ zcRMH{Zk+clOIg2$fS)X~_MJaZ47e|a_Ql_gq`DXPAo8|Bo1R3J<^^UTGeeVKS<5f* zYMOzxpNRuPcvi9t72#M#AFTA_#IzA*^Vk`+kYTKDdg>XLAUBje?~WI!4Sff8GM2!E zH>xbeAr|7i+UL4?+N$e^eO^D4uIzY^z^!0{7hA!7{nrUHRlFBwPE~sAqjR5V5lFo| zja6=?^G&Eqk6JD&eO_0y!quADe@2D((W;mbGkK){fxJdkSxD<{NQ{qa(n=s@g>cgj zmiez&o2v*()bc&}T>X=cc$U(hnToWt^3+N`@8A!!=sQkw)A>BYkwI>|-cutU7Uziv8I z@v&^E?~7Df(H!C&i#@kZ!SZ|Tmn-OFo*$81t%p+gNf6)YmEXW-1h`9hd zl*oRiIbx7oo{nVpRsgV+qw}<82O!R#n%t|S`HxhN1lbJdKN?7~9-oaFSx_RLh?0F= zJ3*Vo+f4SRHwHcm?mTUL#Xs|EJH%mLZT|?vKXXBezN_tfx@`T8!eM$4k>Y!$CLB{)-f8lGH&zo#bTkYL)?lWzhfp zh+kA$JH85l*&f-*3l8qv5;V{iVe#!ePHy=Yq7D8u-G3wo$eu%T%Uzy8GP#kDrrhUs zYEF+&<%N=b8g~F$+v?ca*hWorFILmL7{QZKjde$;Mr(?+a<9w7lCZjDm5CnX*mZ6i zK_QFy;!x7K;&d1#z4uLMr!QjKLm&9Hz?WwnKI_3wg2aqJ;aYYpv|FB!`tn;>d8Hr0 znGr>7ppx$?s$&P(vf>}I0(fy$1=Kh({HtCU>eMS$9hJ0{S~AB8l%q#?@ii$H4twa+mlPEmFxwF{~z zxGr$q-P3F|>OA4}DdEAulu^Hy3J0`60|)B}(U}2luR1#{S`4_J3sgApVLYRc#3Uh_ zmBrsd(&ysm!e+i!P~Ws4%7j5SrRN4ZjswB$S(dq=(!2yNs6{j^1M`C-A)FCSHtC7* z(+Sm2{3sJ8EH-+VMC;CxT?ZtW3sy#Cu$TWkgR5OxG$J|XuV;C;p7+XL+?8(-o zykh}HTD-u|1kWsjw{S;Q@_YSQ#p^3yd!Q>)w0&-lk=Zd>ZpATK#?-H{K6Z~F9==%+ z58H#TfI4n#RtJp528nUSkPS_SGJU7vwUt!|YmhV^=(w?L2X|FRO(U{{bhrpRe`E@N z-5Owlys#6wm1sjTsj;Q8-8BrZX1^5*M^z^N7P%>jiztsE3e`5l68lNSt`H$W>uHJD|KSpZI3pSjn=*{8_Nyy5g9>lzevTUyBC)mGp4D zRZ2@bD%foO!W>&#sFov*@JBGs*}Y-@x1IroXczyHCxELcf}jJ(B6xr4mn&Vb>>C5= zeU-jg_aJ!wEx30RZVU6nTCH_L6^8`xZO!qDVm*92+FC54_;PiF))m2q*<+AW`M~ky z)5oa@5h(A{FdL{m9SX8?OXH-ped$gkcb=;c^cV9YOo60Zc%XW{@n{~u$F81W`Iv7% zq|Q%Eem;ZdC0##xdCmOM-y~p=(xmEO#-J&h6bFv^FTw(?u*;v_i~Vu>%$y?980Raiq74(Kv22`wdP+!lk zbMWu|GvSMRU$4|9;8#fJU;NSX-9%_LphS6V{FpO7`4y9Q~-ab?f<+7VGe+a`OR+N7W@S9fRfZQASGz*NT= zdm)ZjuAD;U*nF%TXH_l0G+y%PdbfqJM3Lu@o zPQ7gPd0wNfn)Ey~rLQg~3x#}dlQN19<^W!fEc=~t>?Tj}%rO%8#-d(4ys?s+ZJCfg{gzULx zSi>NW#yH3cP74CD?-eck;g^1(6!x2&6ejS4b$;Hvh0XtY2+^R5QY8uieHA#hIDFc57M=}bF z86bP7bWBmP396*n!7qAk+eUe+i%0d%njjCD3zXV79W{7!z1kszxIT#E-Ky4>^ z70(XhFviil+$b7+6e`_9QAb&lm)}?eT;I(bhhvLDqNZX#MBFuiRKr+X8-+Xw^8Ql|Vx-CR;^n^`;W=C@j{ zZHeGRy8yDEc`^OtuWWowZ6;5Z>At$+sy)4i)4D-T#F|8T{ArQLU$~Et4oEumTl^Ga zI_%#=H;}ztoWv8Ob?kCNYHWNV0$L#w<=E63b@`o2w=2XGH?|Vx&~{R~8ehj5dIy|0 z<9hbBV0+%UY7Icneg#9>?DR8K0&zTNi$)xn*yh6ft;^X;{**f|YcJA36AXtoh z@Obf9e1X~+YbPhebU z&NMx^e34UdQ8mb}M=Mb=wA{zMb{GzBg1=>m;wEE$cPu^fDWq!SuR6-D>DSLtiK}(w za*p4NxnnkziMo5LovUJKC|GkR|108PX6Qz_A<-oZYIJ=Eng$eWyXqcJRCqdiB-2rY zZ;M1qMBj!5llA{mqv&JYnHeEQDIz-MH`RDT)?opCkwWyVTQ58|D@B7r2MktBx|cPSySp2wG0BIsVy3 zE!bhzVzP_uy{~ql6)N)d3fmz>6@KpRXnroG(^)L)u1;SiCk~C!ypc40aXu&h#myd2y_XB}B894?iS-pxnH;J*~?J_L4f3J1A36?AeG z5_hTNSYkHnPW&Ug*9A14W2gb!6xwMIyY`;ED3CWweVXN4_3cAz)Q{?w{lxI=W!OeK znwldN6jyF}1r6<{Ow!i|Z|IS|z+J1>!}g}^mxb`}so0$UCHw!gN?;?padP42KdwUC z&CH9v%p;45K;7+3#!~fd1juY;WOoz=)%)5)g=OZY`az>T0l>Kv_2r6OkXv*7>YZaL zax~@We9>B<1bAYJ3qb%JTyV=@h{|8RyM_^i7KK_YcAPxL6lTsA)A%H~E8>aIx#(5f zip<2+0z=CXVd!F?vfxbHpsbYCL78Pm?p3t3_^}b({ZwXU0ZV0S)k{gwsNUvSPx_&K2OZWeaGNt_vAasj}-@UK-G`-)3sndyU2%*-%BlF zJonW2;%5$Y$+t@mIouksbyt)_9gep%(A5z3S|I-Ty=}dk^u1O7*{gTX*%`Fx2M@2_ zrtk(hhw$vmPm&ZYTP`8|51apXyRd8Vdy9jT0dZGbAw4*;&{ctU*Yx@+(!IAiH9Nxp zy~yLZ4RxzE=2YG!LwhvTRd=7V^e1ptXu2ddk5j15tI}%YGymMkS_yHjOLg-9ZdFu3 zCZ+D;OVC!Q1Aer&{&1&)v)Qwn5`9?Keu>;o81NSxb^}}BEEjxj0~9O#S!ttsK;75& zKln)0X(b*;W3JX;X)UIH?DlO!13k;UpF_qq)NV4Nw(ui>Dh@42GXuJ}Ma+JmiS@Nk zCgF_fY9PX;>|Tm<+$-zVHtaC=FvCsXtLMy&5Ci&iuA*MT?sK*d`TgTY$69dn=Ujon zTss^@N^(r!0c`%7|5zl++d{N*;0{oWzMB5i0`39+>)qH=LI1yTAzNa_R>{gG+6Hr zp8fe9?!|yOk4kJ>bD0B~ZQ81`JC}gdp`R12RU7Nw$SjHn+`go#aI|6B;{&-){7zMP zRsDs?qdE^y#BFdPK%!ojn?-ZkZq*w9lFUz8CH7#4e_3Yt_Y?`W%ZvQ8BQR1W=^FmM z$`U1#7J@=QP&JHBmzw%hLYAa^aO-5q7(1ok#=XXc(urbJ|LkroH5n2n7akC4+8+wk ze)cXTU5ksyHmDf6Wveh#HsFz{se5viC{5vx2>Qip@w@kc{-&AynmRIJqYteny=0_; zo4n~%o}FdZ*11pdC*qR(XeYZ?yvvOJyKV9APL^q8@z5KnRdoP2=jH8|z2M%^QttEv z;s#}EwbYL*JOA#JyuOIR!EfdrRlSq2dK+JO3+g7KiilB~QjHfROj+ugoUvH7hM8)M z!A89x+J{Y^5!;QUEYS`ADt6uic?N)faz43CWj+RPAYm!O=N#P1B?|vE><-3}Ajd}v9 zUO92CRGQK+?o`Z}-*~-2CV9KjK!88_fjq{=y|&2%Vg1{!34g#t0JznOSnBHJ8QlMw z5Agte-w*)(E?xqhNqKC1tc)zzO@Z*O*^26m0(eLK?cL48fWak(21WqTJsNdh@n z^_9edh(ZAq>XM)+7=2K1js5w6Ac|N_Z2?T?miN=BNXqOr?t$oNcTOz~UvB(;FWvWC zQ@!};4(sh^#xO8@#XEGqj>I)9ASKj#4OU`?LMkTJ;1{Ewsx&1Z^~Q?jp@QV>emHp7 z@2?O3((d`qsO#}ZeL%^|CSEe@ffmekwFh;9DbF@$3E{H~^Y_S=Qm)Fsl$rlfTNPXE z4?5)W_8j8oE>5s$Y$Css(&=Op1@6`be^`BMVhN2%O#21qUW~0nJo#C?9mrzp#?+6; z)P+_WJ{eWGfelwQq0T=Sp|TVwC(_jt4Z8rw>;7t4P6Ytx@C-vH&j_aH}qchZcdWbEHy&Ah{xgY zqI4EI{zaG;z~vOxU+=iYoa_Z$IVpUmn4zeLkL? z6R*+?ikf%D{C>+{(slj0%wPzmIFJM`H{T&=4l>g`+X#O%#GEVVr^rzVfFJx#yWdb%my2la^CQ&8mkH30|k8|7CP1_Fam@1$n`W|y*3T5$;m14Nfz_kTi3AaB^$AVCKr;}09(w*U!PKOG3I-~SQw z<&Kv&e$z)K16xV^8402lzx^W+)cbE(iZ+>Ya;E?Vqc3%_%Q6SFeMa~iTjt060km42 zL!LkG8O_BG{XYW%Al?I|x=nz#gCyRos~)hVv6PL>*nYSgK)b?{WUr1?0kjJ?0x9#{ zleq>-Sd!Sr^4kEZ|1YrGtqlwBlWJYW6A9$f0n>$3n9JpWS9J#0FOvFYiKf6wuxFu- zS76`TU7TIO4aGzCfqsw&83ptrRcxGaLcMp;lvG zCTWj_fcegBVXA?PK{+;{ro53_Pi2WCPI@9s5pQZa5wDP7VH>v?2wC%PQmz~R)`(jh zKAIQZ=y>SVKi%sWWpkxU&Js8&g|m(3(lJ<0SpZ*Jtr?I^nude{k|_IPrRw&D&qQ&Z z8?=1{x|7*ej|Ya$uT|5>y{@jGYan(=Zw=<%+fvI;;~4BsT&;v6c_40%O}aDa)s8^S zrWC7~&5u)2SZ34UxTmO^F#y)w+jI@%86ZetU9m7o6

eH3_kU7`KP#c73?l1(X{uyGx}d|Lx$qR-o;6eFqaay=?Zm4{*Yo{B}$b za_7!McAQoW?{gHHY4G9h0u_zmPxhZ^jz3@f`^D*B{(VOm3~_n1aw&!}TwNeKPu*<(7Hu3hleDII{sb`=IAvV}%yuR~G5Gsb zh4C}+Pn6pw?Y-)#44`np%qMrsrGAL_HoqwBfPhW>#&G`U6e|E&Lk%F;U*Q~hb(~+- znxdpXKun<+G&#bUa|dMZ%Z*DUEUD;X4{L)?ZaHSLxcP4wy8~dr>SuqAM_&9eK>f_{a?wh7XlH$W#92f|du-PVOd+OY=jhia*tO0LVGMd1@4l_p z^`cm$tJb~Ma{8rMb`JFbSWKbz3o-q)rm!DfGX+LtR2y2P0sWO|0%KhCxQVGCTQz_eF`XZaw(%iEnWW`pX&jzi{Z_ASE$4ZN}^eL zJ)eIKfPGDS{*j@&D+U8~Q>r8frVW^10F$dCZFZcoIQkQ#0RVL=XzYtmH5k@c0_ELM zJr1Oq7w05~ev~H3jk+Y#p7P9;Blc1QFey($B1}Jnc!Z&dx zXM&1z1MpZviE<%`+gH*w@P-j+Y)GPr1#wzzxAqJewkv=^K{Tv14kHQ^gdSI$c2Pt$b!hG6O*i=qOKdzBIOT~fN=c=P< zj{#mFM9c&I0NHU+VS!aR*R9jSZE-(krlFg;cV90Axqzbg98k| zQStGnz{{MN9sF&*hCwzMos}quEdj?cIz)4AZj`f^?>2zwCm5Y1!HY8DvtYjIY`~X2 zgnNyRZD00bbS~%#Oy3iqE%GFf&1Ki{@|Qfp)e&7FoB;J0cR6n?ZYy)l#=Qh^(c13f z-XxkI`QQeGJUPO_#uGEq2ihz5Yh>a4-mepMHlF{n>x3fc&cb5 z#;-|uV7p1b)5%@_9>f#Ih>*VrRR4hediGF6^8PxJwXX8_bl#_Hp&WeAY#M-dcJ^lm zzq--Mf<93Hqp3}IKhBo9?MNX3(2;}oiaMRNS42gOPNb%rqD~>f7u)6moWB=sV}%Fg zppI}%LnD3^MCKy{_3RhoacurRth3J}9=z%OZX9rLe<=%N@T>-N?g7SX zYahi`0et%rzj3?dH3c=X@so)kdbV+PD2ymQ6L!z~jVt(N&p<#T#y=yO_)H5Vq+Ulg zi1chbh$k^RUcOI)!M>v~Qe`D9=RU@N8)sYPKZ=@?!j31<&RBL|Ktg8>_%jILe|}Yj z6eYeUVfoZ%`C9K5hfG;VS+lyzsBaVF{VWpFna~(@O+_g#C3>`4ClV*8oU^@n`6TMK>KcZLXPlg1!=agQfTS1t!0lBs!>PH0~sB;iFmifIl%e7~tI60s~ShVD}fsCXn zZEN_b@TjC_S;8oP3nZ%DTZ)A;NGA+7tT8HPyp#HX!X;qOH&R~O_7id8cAn%5b@@^L z+y_RG-6;4sU}QDd2?=TnI4d|_Oa?*fSq}!W06L9{>}$v5lwon#JjqbYL43^qPKW8m zGxdZND#Wpf5NtHm!+gabspa{q9YWS$-_>u4vLRXNA&-#VuA&@LIY$a%yZW6`luG3J zk`9(>65;*4@$-QP?cHf;Rw^@*eM-NFV7#C)J>d<}m<*!j49LJ9FFSXXN(|8@A2=?^8c>>ld&_WA5B$hL#TJ3lms8*y+C;Ai=m%ZLV4ni|*y_+68MaX;B#Yur*@F}Jj;pZ) zeh%ytT+F)GK&T)W0-xH6?)T^MhaoBz2hAzGfX^`jFJZ}S--aoh#Ux?sK!P}FGmvw(z*7_%F0M?U(I~DG-*a|{DTk|!J1W7F z>G^CU!)xZ&wcfin3myn3gi6&~DPE91U@k8|8QV6?)J{(k#Jadgw8bqDm|r6@h;=QO zz#NXJoHEs#yWGq%y4F!kh)m@?cA3^cn5W)NF|3UpK>DtW%6d9mc{PDp9vtMiFY#k@ z+yYXMsdCMy(fDusz3y$n@3V+mC5k4Fc$#6E6QfU_Yme2FR5FhkrR^Vmt523nAANMF z%36>pY7w_3h&L;ya@7V72r+nebq8zt{jvPbGzul=Wpx(_UmuJzXAY10pfq5~xkFUe3)sP`p($3CnG6eL z6^->8#W$)87xs>bj={Fp0^$zV(2aAdBup#HnWC|I6X%1C_}eH44;e5}lXR_W%_?Au zLS!Zn;3pg|c+6*Jnk)NcF4i?X%7CC`=(!h~(~#~dQz2QnEAGWrxMPI(Rpcp~YYBk1 z6!sxQ6J4G8cb)eo#@n6Pjnub;mk`cm&R zh_$BN6{CAvxxH6uuF(vf!>Q2gve-go2^j5XTUewPiK@?X)xPA=-=(uL{(p z1-O*h7NX5RJjF2(96pQ6^%0}lTkJbP1+0u@paW~FewNkVT{|gss24VOeu^okgRIyM zvXkzC^O5bdL>jIGc802Rm<*B~vch_r%47mg2jE00>AKBkfl3&>7w$XKr;t9*$*);t z_A@Hf6PIc=ze70MV-MOi)ZlO7e(ZV9+Dd2#o!~-l6g{{moFvj{gxLt+L0_$$@^Uxf z87P+zs|<`Zs}#mmG=a^cD-JYswzA*dKhY1I3)UtTG``a0D+xPEEVxxGsJyYL5$U&$ zwxL8ufBQ@W#xXXTh#}ZD>V_N=O%JIMp~5CDCvpS3j=z0^hJNT#)aO+!gPJ9y91Y3_ zL8JmduS1v=ehwKty_lModaXGgnZn;by3qF#29I)�mLO`VIn-L z1;5PQ*ei>|D5a7qq2_s%zt(fHhChr9&*~wa>LL7`+_rJ8fd^1lP2pGW7hf1-PdmT= zMaT}yzD|4=$=nD0YL4{P1H*fU9O|MNc@)Eu^ed?GERV=u2R4sUd)7^BXbfVkfo5j} zHY=BO>~BhYDrkHOADNZ>id`4f0FXjMe`ds<_foP?^{NyAK9Ti;MVtv)bWg!-p)(be zDP*Dx$XRS+$TiYw^Zh=isD=X-5`xW?5wV?MM>kPlD-qW-_tjW_K_%VFWia_UP|7DhRO za|Sv=-BOaurI%xH=eJzZDu6m;%pPeXat9QKq=|Je1&Q_Jc&ie~NL3O4+x?XEDunPp zst>{96jpEHW`mK?a@T6!6WEu6Sy#lRDQpjOHk!(|84|F0R)h|E$nci*QI!j3=HbF) zPyxUBgkU?KPa)Oxr)N^MFfmQRX=pcrM_to};ACrVv{wkfF?b$Cm=W;0Rb+kV>#$^l zti6Yj`?GT+77>>xDqBCJl%P0B)|YX^{_7|uWPhVI3>!%gXcbwe<`8mC^)1W#D2B2^ zfTOUpd#EkoL}@Pu%mxLK-8`I2+pw&MA%9{BOylgK zwrLx;;aZ8r+yduqH72(HPVbC{bYE2TyUNIPGz08;MI^vhk z1=LeIfKGU3!&TYLnwh5W25Qcu97lG`T8s-<7y)6AI4Knu)aI1sMDvbU_*^KJr=_J4 z3M9Th51u!1AV_=~W;W0;R*$DbU(qLJYC3|_i4sRW0D=|rJCp1N@TUR+SK@{CJ(y=L za2KcehNK}vCisJbT@04&?2w}tlJi!X?%#9_@Hs#f=nOQbH1jv7Yp^3e2JC`$mQ8$N~(;-cdKwOg5ViM^|4l&pS z3uPJ^uBR9|&0_`?HV2|PSI|OBa7LiNU=cX0%@U=5h&PRiw>$m)TZ`^;!8-cLeYp_e zvrlHG91tB0o`MA;wUAbn3mz?YZ5R;1$Jqq=_};WAS6-L=Vclw3HUA1(=u z!Dlm49!gwo`jC$>M!dGn9>p3zIl(iUp)YJb zBt3&QX}|P6ThVDCc0LPR22meYFMr~u?($)^q#}Io$CV9gVRSPOv&HW<*TnC~p=K4q zF6`X(7zMKK&s5<-eE@xJe~!?K#-xlUAP{e7?~P7{MlClSnw~euzlIUtQTP_ObII(8tJ%VMU_X;cnE#b!%yuYS-i^zNLG!=yceENL zEPs4geV)lalNr99o^+~U`TI3V#sgL2IC0J1R1dushBA|0EiaH#su*sm$ozb}w@Gd~ zbQu}Yjw>=h9ubrX5RH{lVeJ(O(5k4()>vR}OHE9s^*%kXrqDcPU|8_g=j$+%ZvIgk zkbnU`Rk*w-$@TyLxbE-jH&9Lc)yDhZ^W~w9cMI^px0J|hoSk=DA$6;K*}4<7Rqw^_I(_o2MfvfIcm6LC=feX4 diff --git a/umn/source/_static/images/en-us_image_0000001936832142.png b/umn/source/_static/images/en-us_image_0000001936832142.png index 03f1d6078456516a3361de1f62352d24200a0860..78afa711ec0e8cd0d743c406356629545c0b2b35 100644 GIT binary patch literal 26329 zcmdSBXIPWj*Ds8tq7EXKQIx8Kh)M*cO3f&WN>%AKL@8234Lwn5Gb2SoLMI}<2M|J! z5~YQr1PBlyB81Qbfe@0ATd;+_99fWyBnE~T!eT_=emEH zH)ynM>-@fO0s=ZQuK!$r`Om(#AHxNjdj`4OOiAt5u6eeu2>iaLr5vpJJ( zAI9qgPYA9m#F1f}jf9FH$wzfh#*rTZbPn#fWBrEMdgG;Ec})&L{9$!|!RfEDv?I=N zF^xzq@PwnNoLb!No7B93v75&~4zh5p%wT!p?1`4v{3uhC#H_H;Yhz2G3%b;Qk}adprk6L8_WN>1ZL0&48!e2E+&F_W=6$!q9aj|k z;<0qn?leLOY?dzUar^>Y%_>vtxC0Wn=JlaJw2`G6lSOHX=WJqz-GZ<)%ANBx$R%?-q^kcAXa31G#N%)(!vAvbi_)%|7g6XxH@>p@#e>(&uSt` zweQEPwe3q*uU8#Qimmt(_9h|TReLIl6qk#x2iDPViob~^`yn$teqEtff<~j>P|?oW z#7b*$^DJy1s}~1Gwoo~w@-|J8_Ypb%VJ4moa7ZlXTn>u` zYaGYswjB8#fOF2&JDz>4oy%;Q2xHF$|BB6x6QvNtvN;?p*Y>}+E&}$&IUmW_u)0oB zk-p_gDE7VkK^qU7!8^HU=G*-DzLnfi0=RDtEo4Hh^-SI?CHn2ePjJ0;h`C1@w@Xkt ziO7M1rerNhAc}Oo(%N6@UsE}{Mg%-@%w`8MpMr9@noXL34P{AXpR3sK|u%0nh+I1hF7p zbOItdRx$Z65nOU*E^g`TR+Qd|*vyOIp19{{1JvivYsx^g@mm%wF}M z1~w-V2loFs`hV~BF;PbQMESH_ZV6OxVeYqkk1epC3x#RDn1e_9F-J#r_cpN0Xbh(+ zD=)A3>fay4tY}O{-ihO4oywl6al^G#-zUot0y@q4A56T?+)D>$jL8ZYv8fnR&;fz0 zyLvn_>E&&G8v~yJ*GpqBKJed=^_WF^nKj?{i@^J4!A;Tu{)=P){Libk9>oc~XgP{| zeyCHKFGl@q)Nz5**Qf-8i~m0!=S)=E$;fzKE**1IvGMjTd;9&Gn!A>$0Yam^c)NdL zWaK#t5Ofxt`Qd8$#6259fsuPQgN5J;p-R3HR9z*g`PvxNoI+gVi|xpto_{#Tkc}?` zQfYC;b9t z!Ocn?Do%}izk!>z{tfD!zv9VIlI;$*PPpTxFUa-^0D1C1G>CDPw8(`Ofo%mfNzyyT zTa@g0Y6{A`OOZ3E3}(ih{CB9to?z|E+5wYS0K`vTB{EF8e-_#xB8%u7M=h-GkE?!p?ygMtIOHYo>{_w0lc5SGf8P7EmO!C*RG6|d4)`)i4mHvfU)c|71EmN|q+?GFA z;EkZ4yOxSc$261Ca119Pco=*k@f#84jV-@+=8=!HFxJCg;!HrjlB9Tvfz649f^#}6F6;9^(;7bQzxvS<8*ocn5zsxRArb%Ks^`&)3*hGS zG1Fm1XvmSRv+Hfw6rh5!IjO z%3tPo{Ey1oUqRN^zVRGAQE*J-$KU)_bljPmswQ6 z!SjNAg?4_3Cl_jqVBh+cQ|1JxY5sNZy%6T|0HUvZF8-4w;58qF9?!?vI;Gp+F_WGh z6%MC$w)|zxQcmbsWp=GtA1!%Hj-9h`g2q=2SuPwDFp}V_4Ydf?Jl1FX9C3XLk!wcq z%>j%r8zL%7%0v!=a#aFf!?xiaU| zm_K3aZV<9q(XrOG^l|k%*fs+Ob=n(Lez9-OWrF1Q4b9_dTO%318z6X$-|HVX{Qbcb zdWyf}1)oBEKN`bFv(!x#d_mw5|JVOZkEc)I#D{?Txi_JSlV>h8UJb?{ZU-UP2&H6q zhxh7Tak&qAwL$`6YF27)`Cp%58sO0kC_<9-|;ZDknz#&L+oH5GlXiYbYx^ ziO{Gv)dM1G%p;5$ABasYuUG0HSLr=#wkvUOykBJxi?eHgEOP7i`rc%jmQ%>8E!rXX zaUGbo+lM*zIyAvm5)tC#Uf5k5u~p$Q)G|-{bF}xA;5m`~^*M?H2=CPjjV#yJkF>14 zoyFQEir}iOx&WNIBDYo+aB%wGz7|ygMj19R z`e4c<|3F%DBNJCA`imiJ1$9y!^eS@=xu>57sPW+ejEk_=NX6SD36$!B6Qv$-T~iN% z*Oid--Z^39t(!PZZ$bfO?vSy21U@(jJ#j5$M%h;#lf{jwnqZXg}%wk;e zHjol|3=ImA>sHl9P6x_|=cTt>UoF>Y7zf+lLBu45j;DNbCyDspy1G=Of7g3Yb*hk) z%5XUsV90W}Mwm1?<_2Z^w*|l3H0BFF+gGLyKbGJITcOdnf3aR-weFp))OW61_11E4 z-y$!}6?1aP%dS_t|42px@P}$g2b*TV{*9VMCp1!{4g+_6<3zfwV}y2$r_t@I#(Kl@ z<9ngEy4(G#=eL`G>mL%rxw18z3NGr%)ze4dQ~nE-P4q-AvNiWRQ;;*aVynY2DmfDV zC*SxiI@ut;xnPm1JJSX*K21R3un%o{s(^8>)<(vQ*&~~gnywt5j5@HU&~>fFrWLPr z(FBTRFRKMS5hD$8dh277zNAPJLA-raNbxDTi35J;{2ahJn!&S%m)dFQ0bQrzD#|G$ zaG?P+?Uwt>Cm3fhcgE&5o0#BEz&ciECRf>Q)z39dz-MyFyJ zV9YrUfDsA>Hofyg{G(O zLo#y{9_52(f|i-c3q#fDW7bPLdz;&hlg#G1F#P82@z) z*eC^^mfsFjFtrx&>K4BwXR!f0c6x`d%I9hlDv~rp~ONl}-;SNmB^XrPHv1 zmLh(|N5c0#!$mtAL|4?wlXcEd#x@jJY7V}}lP(Mi0Zh~ABG>>}@Z(p1AJd+=HLF@o zv`Sn1bHGSs>tGRj&#%K3cMNB1HO=|JPWP_YHd%tv`$+1NtQ?O*VtaYEFoBqPC zkb4t9LF>ZpKyCqaX1>xvGa?ezNe#h|l)xlf%pe#@?i#^5cb?J3C?!a&F z;Rm5OlM?)NxF&P&*Xcp%634P`pol$eU*Z>)OINC!{T#l##bCUY&q0zQkS63n+pA}b z3M!3xwdCC#A4P58BwbNkdWztRKd5W)FY~;z;b%Y-$+4F`aJiz96CI}c`C+^W9w>s8 z<)hkVGPEd$ft~L`(`M~6IPU||YtH*$c66OXqYM$B* z>U-S$=(Z)&hzI#5qE=Uimbjeoll<$Un*`E!;3Nb%AzUI`DxIsEmU2Y9i2Tk*o1*pJZ9->r{V)iQ(acsbI) zalS1KVw$Ep_gud`4-IO`UHe-~QKeei&5^6#Jw_1Dorruz-=I*b(GLDFt44=*u`-0K6yTgn6OCxf22QUvbN-=9+i7(IA6BNFEM z@YZM9<33ilyo-zPdDN8-2^6G?Pp33yR==zE(tx9rmXpp@6W$^hiQ(#nWEJ9w zf+1XPC=+&isct*y`^I8WYyN;R;+SotWHAK^$-t5plw87zWfVx4@E8_}!T3~o`Z4BTyWq-s3UY@mmZ@>Ys?Pi^1%B7~+toGDH9+>}_Q!{q3eKl_OYbPGbLxQn zwGh3*kGPtSE)Wcyp@OM2{$p%T7C$qufL?&T4IrpAa#;a*I z*-d|(BQVVIv~STAxohz8HAoh8Yis8=Hq) z?@g1JUoPpPx6tylhZJwD4(`Oh^{KZ|%F`w#US(a3!k_h0xpNCrTiYEI?THM_#UqZ9~bUw_5b`sDK?7c6t3{VC$-`j0eU z)BcGE{1;32pN)*?Q^|>TP}C|``mvebQt$GTSwxoBRsrw6Br)WwmcnR`mU_g4>Afvb zDNezmz{m;sk?I#T1unl5OMcd!RF)0tuyuq^xVFsG^+j}D;+|$mXa?MkT74#MZUzgW zY4Wy9DpZDa%%$N1)3^E9smcOKyV5{&Qp>Kgqj)t)S~A|#V0s%bKDvcu>(H02+YG0n zTac0BY+oxyPAkS*5x#`mUKv*%@grDcB437o7ji1)?hWxA2&DF1*%ohxk<<3m;P2%% z_e&(>Jnz_Wm#s17PTL2DQy} zH~;FrsYkca6&A!pU|Zt!@5wM#P7bJfczYmf*&JyIr0~{ABMSrBCZLOQNS~5iXjb@O zU|wpYWV#}uh?pcJv%HNrvqsN^S6pbF*xy*d$8jQqGc|*(FLI+od5lQOH-)G6IzljV z;@tI+4x=a!vgo$b1qgl`Ig3iEbGO3DMf2FEy0=M2|c z=A<}B(n@rg*OsXuT8QVU=nzC(Ppyg0fxxXfqaaRN$6?-&!S?U|Q(CBJHB#2a%o%it zxTO0dFB>e4f#Gqs&m+T%wL&-EFWIkudU-J1A#))fxR<~5y2uv_wTfcmKvs&d&DW#& zydBlxK~2gc%oVyeS%e)j&r69Mj$-r+J78Y{00wt3#@LZ zMp0Gt)5008q^geXBE==J^5BF!a(b7@I<}955bpFl+4E5wQPMrtCm&wqerKe_C10SF zQyt16&F={D?h7Mq62~bDS7hwfoiB))U*0^!T|TyakQ#DkOex%wm^0R5*rvJ>HmTu^)~=#ggF{IHYB15^JZ@z9afN z+N?!n>1{<%0QpCV2BeSGzU4!GB+Vo7Qi9E+9og%7-_etn%}>Y6cD(spaBvXy^P->U z#_~Htjzs%ejHlxkr((3X2IdnqesN4Gj!fv-Y4}d`t6)u0^h!+im@fF(qUWTJs3l5d zY^$KwM7_HiOB23bx)gnd$zMOB^km*{aW-z=Q(+mZ#fUR}v+bw`IUo9Bh! zvA$SVWX2} zeQ9adPGumYXoe7I_Z91>D5kW!eaCKE@iKZ5w&n#=akTMVZ>4r@2X@57h&TV-Bfx$1 zC?wiB`lo{;8Tt2EfiNBnA6xup=y01)_M#IsFp!r zb=Ng=ge{@@cpQL0BDU=5D^xi9*Qmp{f2p6UqP4xHlxzD=|4dYb+oXP4-4P!VYeem> zx&!SUVN7zdyqri#IFUG03?fohjGPe_hC>lETO*PoQ~B|>v_t$^!DucPGJ4C+QEYbP zCa4TPs)?9h;Y$-6DdOnckT|U#!CphJ$p7_RsyW(aAWN-SURLBqc216}V>2XjPTVsx zaw_Or6xsF_U3_Lk5MN^ZkNNr)XZAo$Pcf1!v<=LoDakdD(#p)j{tllYVJzC05=+8m zMId!^Jv>*jOsl;27qT_fLS?%-?!bD0MPTx&mt+g z#bye}aWti?MzE(3^8Q>)sTfkOxdNB-FN>JKITgcp>XDh%BXAxAzH%hAw`%uvsJG3z z)34_9O{^XKW0z7>T7{a{Ix^?k%Zia;7XBqI)35JZ$zsLV0N?f{69~<4UA>k+lwjh` zOe?gc_q->;+gJscB2T}y zj>lWWm*khR?t5@s4Yej&k?j=ZUw;dGi6W5ne)n(?5k=3k?y%#q;^{Y(&Ah4sQb60kN41gY)gfgX80G-$ z#4q+W;iDD9Lt&JM-4)g~R?^&!coWgAp9p*3??6%awdq!CMk+EfC6GL9q-aS&!aEeg zZVcUiL!u)5T^x+oo!^wWXbAHIXi5MubA?hfhRGM-Nr#^dnSoj7^BPUiO9qd|K^>$> zzF#5AGLN>V>&-0B+KkN1@Bh7Xv~O<5>8my5m!>=H zW!jr!tBN8}fo2CEy%iGq#8TtjU~aKI+K1TqaqavYssT5{H2t;?1oq__IFK8Pofp(!&HGLB85e&|abA(!>gzO0V7 zm3^*AvQc>iH9>l)D zr*|iYV2ys_J0(DlN7U<`D)h|qbli=Qk|{r|@c&d+JhTXd-hD;U1@TB@bJD!f;NjG~ z!h^%&AV#<&jrFh>n4sJ*X8 zKFy7|&GNIcZ&?fFW0S0~Z<&L8y_&^~zCn$PM}4}n@dFOo(f_hc0D3~t@j1$6%6hz^1j!&I%K-7ohpi`&#gi6*P1zvXD-}_`92W)_H$o5P@Donf%&jB z9kWMfH5@vpIYU#OtCPpk?w@8B^d?DaZ>!QI-I`;?2euR3b@X`>BRgwEI`xVWbFMeN zV_TLp$)7=5Tm33@uM5`27sSQo+p}HA_s>Z9Fc)oJM?dSu=6C~{&FSMIzmZtQ8t&E- zMe~=Om8+&ctR>y&k6{$pocc#zkfiubwO-&(GmG6<3m*A_(0OCTz4)}1e918&CuG_` zStHM$W+{B(ejdt~-Mhy0B1GcFA&>qU-W#0L?Q^t|XH3)OYR6V%51bXIBq=9sZYWg0u&R2V|KSR%um*B8EaRd^zVqf2SK1Sz| zFuOCAH7AMj94J;B~FIpAVPC}%&i=E zUX@h0-YI*jWjX?Hs+gc%y6Kqozxy+G_N*bT5@o+qc@UC-QSy2X+a*voJvNBpUr z6!m-K-l6aIGqiIYF(ageK69ovswMcWH7F{WrHSz`Sc)!YmB3kY93|ii1;`7Vghu{2 zfR}4Gx`&p8GmY?aoSZPed-AL$D}H~fHu87y2Yprbr?VJ*UzZQ?gf(o7<}Kl|*cXkN zr>|>=Ec%n(W0O{Akcs-j)*Khl+!Ot@RB-LA??n8|ht5gDC4!iB&a`@zo-rvyHQX53 zTrodyjj`eksO06tuP=|*gr=SNR?@cMLe)UHifIBT9siR0DAvXAcU+IzYc?jbQaisq z)GLRq+OVh5HL+Th+F_$%hqHSUK3GFmvVfS9@Ra{6K(GiS5CTJ}^ zl-sl?3YSV(w%^g6t;u^7TKv+%0|CtNX3`Bflag2F^fr%~ZF6_kkE}k7*mlSGWoaeS9Xs ztgh4f;uR3^ga_lZHIA=}#S#gUPF1h5tvBF3Hh^Ul+i6pG_i2q%oU1*My-8=4*X_}F z6}dkZgRXMNXo5jePMH7AU=*k?PnxZW{f4$D4we^HchEBgxS1TJGa<}`!yx15DFn_&(kDh19 z*T-?a*fy6ozK2iTzK3qGt6Hqun7$lxwrBs{Z<9l_;Q&Zg@b-V}eJR646JHDTJCrZ3}%4!8Bmv+4d zCWVBh?+MoH{4nYuDe(D3$qH^o+gCCV`0G2%Go5vzi}~?EbD$35bz$eQU#r_X=90Ag z&o4G~x<5!hIPp~!R0;W-Zoe{3Eh=!pB%c!e*DN7!s zW7Gonp> zB3r6nupMM8{PbcVfs|qo^#L*m-2K;^DQ+A-8PuCLTYrk;%(J)dz-awDL=-rBolzjo zxw;}(6RT4;vBTa$W2)G_XWD%*`|H1j)Xtd6rl%r%PSftX6RG@F6SFSoje*{KZm{qC zUj&G_HS=Cfz+%Wnmg_7LBTU`z01^HB9N()Obld;lz!7U`>(jE5tdW;x zZvYy6BfQUBwnNK??n6d`3wLi z+ zK89UWk0H8w(o<$S51d*hl2=BgR0_Ax_rgd`lhPVt4ZdN@fME!;rA?%qSnnI=Pl{kO z?)GdtRS)Z@NFig}64k4rNs!r`MJb4;j|E@)wxQD4OZ<38%NYbd&SA{P#FL+fAS?Yw z*V6@BP_F(eV!}q@H*naj>#I8P-!JQEcB6DwzoJOs(w?Z;dY1i?dn}q~ z{M?~OkKReUQvsrewdbf)Lm;}pv#VZHe*TOlt8O$Ue)*W+9&@nX_xYqj#NEpPb|NcQ zWBYNy%=jn#`uVf3?ud0F6hpd0qAx7dl437`{lG6jwsseSX5XROwof7++go=AeEcq| zx^5hOiz8ovKPg=O%hH>wXyeI~4tX(WGrI=m+K1DvW*(>>DEo#n*$oo^us~n#Y{UCJ zU^mYRatgPhmp>b_a660ZE_oB-%#~T+`;$E(=zNodS)QQVN{!^WG8#%EMnQ9|w{|Kc zH&r<)=ge28xuyI$RzG{DU92*>APo49uF-vogLRlRlh)?Uq~|+Q#WMr z!`)i|BOI3TefX0w)%4QaDg!~=JYY3$rv`-W888nN|WRDEICP(0kp zrdD{M5}chR9_Nbo&lWLi$&D)%g#|rpyfe;6m=)a1YVbgvYvgAEcvzIov4}qpAFN+( z%Qt=G^dO9K=V627{iN&&g}tCohQbm6vn1ql5^!--5et6TiE$>uzQz%cdRj+^hyrgw4^3=|2ny>%>6gyz6tI zzv6nwKJ#*DU0Z{o5FL0{rFLV-+qHqNExm$saeRBUXlkQgB>q>g_^`#;pIc&4jYQSc z(Hp1Y$b01vCmp@d#|d}UZN3U1T=V|evNE4kf>xYLN&(*vVM3dQqkzXB(Q!g1vPIas zz&u25g|gEmD9JY5Vd{lJ?t`>LI_{W=&z9FCfCvnbAK=&vZ3u(A;xE@sGlF-eL-ht6K7Y6go8fZ@ zRL;bW)ouP#{C%~$MnO9tJ-DRY>Aw}MA9Xg#eD!?u=PTMFE>6BpJ-k1MH+B9f8w58G zL@0)WC@x~aKbAMAhYmf~YKPDKcE=m4_Zz_|**Z+Kqcb39NQIHCydE0M5v>HNWA32q zlV7*AgJ#nPZn_>ALX@4==0;-enVYR|tiL!Gi6yNI~%b!%nq zX!==Fk}1(LBU#F-_N_@8;zXyq_d5%=zqb;CN1?1MU3twT6Y$4JsM z5u@9IGoZE3I^Km83}!p*hXQ{>g*b`ciBzxT1Q;5bk=%4bbo+Mf(>=dq>u^5r;)FX; zHy2f}Vo^C7q1d?Qv>nFa%R*Y5`(LQ<5;U<7uDGthgbv=hTk@ZJ1 zDlgb9=S8RuG})fb$jj4POgDX&{CZ1DBpS(Xejm@op{QR&Z4^2{^_!D7N)mSip7>w` zP%}%E_x00u<7=xjwpL&%H=Cv#Li@RYL9zg&xsNCHas&$ri}lmRZ_mf{>GZ@1e?t++ zjtLrv6S{>xG3R7hRj+sT-3i8Nj3)7eeTxz5XIe z6j}wuG|AC_#v=Fccs-3j7pQ09IjE^k&v^2Njz6i!6)C)atI=M>t6oCew{p9Um_UhA z_{y+Hdw%b%Q(c@wl#LZ%s%*{edXL|D*X5=Ih@VCfcdI`;#-E4ezD|Sy9CQ+jD1X3a zJ^~xXt>v%;CI#6aLhqW-usnMEswhxzJtBWOVknB*g8#@&=+P4$_NSrN;3vN5d+*xL z_7?iEZJ``{u=zmn=(v~M}lV8>=kXnFxab5k8ac3@YB+%)+& zCnB?%Vw+7~Tu=G6QAKa6`k4zRxb_^iua5Xaz3^?i+TZxu##3bnYkdR^x?ab-s^qTC z9xD4sww$Gcwz%gm>~Dv;VV8nFq1f&Cn}$8RwD*^(O`EzrhKA?0b zXW}N{e)K~vGsQp5CFlx(X9VQhWUy`KWp zI2&E&eRYXhH;vfP4#7epDsf*BUgCobPGGQW67w4}oQ_Yn|w>5Fd74kjgIn z^>f{7JE06CQNJC`f`*VF$28t7qr4W<5>^GDv?jF>g=)F9`oR3@fKG5yIe5ZedbT=3 z9pc{FfYRQb8eVaw%;v4^w4VV{wElrGmY-dE)$^p6KUP`5`Q-oG`KJFzGi6)Nw9F*g z>&4Fx@&Wr>Y&~U&mzipn1wU2JUW33Z)-n78ro#fyPxEUx;70`cLGcFN0P5}OM=A0` z{9F!;dPA-=tEc^+S`ZGGfguRXHrM^}m|w0@F~0@kN}gB!SJjTde|jO>fBky_;|0lj zj!ZMT|A@;EYX00Dt>e4;5-2j{_paW~MV6BD+>t-W-RxfmdsMdZ#LLve1n(a7*At-tPc37HHwKe=N90L}ynA z5F35)b02`W6s}^MUw+;BB#W^MECIQ-^sQ;rp9BX5Oa`e9y{)n?PkSamQeII!niL%t z{fztLgj&?-^@gY3MJ)jMd#AwYVE`>XcxOo(TVwdNuQZ2c*6C<_mh7{(~%TVlB+t zO)fpbI|Q)pZZt06+*I>qyrbPG9_CF?Kp7&Z8o&zks8u;SFx4bjzMYtVpC^KZ?`+&SrSuk#60K zB5pChKN0$}#;@oT`GuKOHx<67wNpSUYge=_T4zhUFQpKMhZ?q$)63>W2<#K}k?IX8 z@Pp^JZ9m#1$@;vmJ=Opl3wq6rUans9P-|aOAn&a?l}*q+p8`B8-lQLR?;ide0{?zh zJtas#M$UUgQM&f@+r)?3O%9O0D>5)?vqA*_Mge#}jDCza;T+7btM1l0q$m3X4 zB?GeEbO^2!SfXP6vJm6@qXl{9`v28W;JxDzPA#s=RTms&PC+h-aEVqyM_Kz4g1oTA>4V2T*JS%T-tFnujHB?it)muuHPZAMWES`yR z#S3iksve4K*xG+s11^$F zzIo!r(@IdE`n%HsNzKB~0tbsyGXuXIHxthv4C)Q_c-EUh0pRQ#eZ5OovXB+we>6(* zRbcXu3S7i88)e!-wBQ<;Lw^K8>XEK=L?nLbu(q+8v_yOmbbYfNX1u+!D)DAXYg?pg z%Vg-3N*>zx_c}=^S5gnZx0YDbeTPn&T12ha&MmDTfrD6V%@zcmr*Z zIHg`byuRIri)SXLrNIt5gPXz&OTp<~qAP|OHva+sEsB6;>D zgPLY$nI|WJv*GUSFGtZbq=!x+(3!jGUJKIw+EXXo$8;|Ng=Nj!8rRwQ`VY5l4dZO# zYxg?EI-j>|AxZ7r{=Oqx#2ej%tJ%(3+{q7D(oL@Lf_w4H0~MKG^l9(x zHgtfun7|+C?VST4mNcd9(i-RB*t&EOMY^08_izHZK}*gfVodd4@bR&EfMxR!yAzi@ zyCGj#!Z|zJO@o?pu0t216z+)+%r>VD%B`IkLT>L}w~uR$3`xVWLhv7A$mQZ^BF}|d z!-SBBJwi(6Ea@4G%tM^Jw!8#(bD<{1b@#$K-*|1`#+kAWl^Z%{A6DxA;G4jyC`*f5 zc@ugGl0)k3i9xL7xg<(ZYqzFih!%dxQNyeSHnaVGPE=wmg}xcXp$C1g>({|D>|s(x z*zK^uJCyu4o2#_nS0)b2NgzVxz?zwjVjSIr=eS|R#e!b-jr)3`-=#s(hhx#9efs3_qe-VAYa%(Fm1<2Cn*UtqQxubotNdZGQ zaXtxx6a;Zi9X%2t@FS=X5Yf9D{f?0l5NL}&}9erAnl zQXUGk0rUK%HTfj2wSK5#F<_3u&)aRZkB=P>>AS}Yc~{kk27>~#CmAB6zStAVX@9QE z-M9s-o31J=L{5NS{~i#MeY3Tr=*rmrJgq*Tae;5<{Hl7Ebnb>Um?B*)#(N(xjEigp zqb(a|CHQ-_WsiP~>HGoEsPwscX>55uVC<10#dYWmBRHJvGKULuA9@(2H)&wGsk1fK zogkkJ(>F$>4c1h`(Kr4&5_zwg?dX;&QL?&Q%qFZ$>kfHeaP6*O-P}C*(l}iKT?y~W ztwGOx?m(?9`^1O%PB2U6infB#54BwLHt9B{Gr%A6vpywCM0ZAgpu--R8|uTTXH%oK z0TMMz08q{9_#u2xz!t;9v?kfnO&J=xx4KY-T@4rpZ*EPV;u{!Du6v8(Q{rs(eJx&) ztp{&-ONn?w1)|&DIy0P^kPfjRNJ#NSg6H@6r`n<-yEI0a0Wy6_ub+|nrzFrFej{a= z^1k2K(q6{oq}0Y?f%Z|p72yJRvj}gNH$=ie-ag62x)s;!=EU8tg`*UFHbgAl}%_}ex~Pj zWN{@tgud5wNSN)}Et{s!!mml^POehTx1>zsO=Q`9$3*_w5l7af`;r}7d>7h|@5C;6 z-#?$w8Hi&W2j&&)@V7v+greiDU^905(UV(840q~{ktXiRCdxVzit4$J)p(MwB2GVr z%{3_=7`vn+;@Y+sSkYuM$g-IY|J7ZKmn^c*YN5RK&I>#dfj`3jG|{C4kTcvd)7bYO z_no}VYKtOd601OEbQ5U7@z93Di-zaq*xf|4*g4VF?yslW_maM>Dqa~K8T(Q3+g{Lb z0^1HE5G+*u{FBeXr>?yBa+B(ScKBD0AVja93R;l{a`VgQ`Dv18A!Vk$P0GUIujhvK zwH^hjJouuA504LgmQhF<{BWc-E2+BOav&F4wzTX`S|OAksVSvB>hV3w9k2Z}$tTld zZtfxRciItF|L4LgWxeVv=r`{UyiaE_a>)leffl2yBn;-sT(&_7+~1+)E3d$QRs<$A zMnVB@X$WS7&^5|ndAA(5Kh1xfWONxBTQ^5RYzmTK6f6AbvxQ`a(NeO={YIxUtE8$& z71dc*+9wv^rAT0tz6q$ouhS@l#FP)S(eoA^IosAZyRDS5|~saL3T{6SuxylhPo za;ocLK`ZZnxVe0HadZ&qRE$a9`<4vBoAn|}oPa?CKFd9#@M=i=I_WG~)*EK!lVw+M z#VVo96^B?7v%i@?X6*B%o-XYxB5>mr`Uw(SOlS2=x4SI+AdxrFTy~0k~R8h4* zRLnQ^MCZy9@)#Laf&cg=k z)q?`xj{MgXoBgjK_`jK;{eKg$rhU>ijoH&`pf-q>Il`fQ(j^BfTnDnXg7+B78MXWY zW+kE$4o_g8|ouft&aCYh8ta9nX8>i!2^`7_lTd+116F)+*u(7IV*Ts5Qf0XKA_t-%&bZ!!)DoQKAc^|b5gd_UJa)-HJT42|M^V2 zc;w4?j2+M`oc}c?`6C4=09elZE}ySW6v=qRxE?SN8x`_+(=5!pcxbz?_C_i{Su-(9 z?|Jwai5x4huI|x!g!+w!dsj&ORD#fz6p!*KYxUEJ=+yg1O6txS4klX3XWnN&)A|p5 z?GouR!oJ3_8@8?8z>uvNiQ>%x9BFo}W+-=4Ie2eYj08pmx~PUx6BnqYmnktn(&ke8 z*t@#Q1&yX=6-!kreH@iyt_~{R%68 zYU{|TAJnh{D95a z+jO&Nu!HRmY9S?RpEW)9DDaJ&|FE^dNh(sYmA@h5GxzBz|SYLDh!xoOLpJ9n8EwqiS=www!A6Hpf@xBih&xuOm z-M-{V8MDxHtQiyz%OK1u@}`1hrSAjxswSBk$@h)oY~$@UO7$rYkQS{}pH!c#d*8q0 zXy0&0mP8Ne`5C0mJqf=R?&;)Xr&2uT9iW$x?DIHP-m26x)oXPAOOqI=RqX=q?*tJ( zNQS)5fDeAISG|tPS&orZwdfyeIX!~#NU3XMd%eqHBf{1|SDAFwyHGm4z+Yt)_Qk7n8WLtv?0b+lDhS-shJq~c|RcmGxZL2|9*RPy3- zi7ZZlO<1=oA;Qlzz;ZMGiCzNGJBtKK8C0Z4(d^v!;g}jfSE{k|-unD*hv~_vMC}~y z3@ze~>;&Nh1MrzK=>0?yyl9mQpoaNogW_7-fnl^x^h;x^T-ZdJt!OIISNE5Xb&J&2{M#c)fejFl=$eU7 zC%UaqH*Nbs+hQVVDjMAi5(3kk%xmiv!1+V5F?bgNKHfMg!lKkd*WLuK*t~3Iy0vxO zH6m)x$0u^H&Gi?|$u2_` zg~Lz7;Pckf2@n3TC|WL5op_Dj0*aDLAALBm$RQ#84lCg_Z+j7weT?are4oS@xf(64 zwnYrAjNoHjo);`Du4z(GaeX@|j(mvRR4AqE!;OqK?y>naeQNy_Y*)(Pd}yQ0(}J1y z3C+J$HsGJR?m=maAf8W4$RivC-i#4s*krvS8(|6PZLVg{!7$ow>aB`GTUu_afq9?E zrmH!m+5~-f_X6KNzzbuQMUfR#WN&(cZ<5J?rzleUr&p9 zibp~cr&INNYEvk=hH}brz(mU&E4}l4wUeEoTsZn=)PWMb2Dj%`9%(j#$et8&UH~c^bOdumP> zS!qvd$!W>#F+HO^l{wK~P?O;XhsZuC=p{Y|vAVbkWmLoej7HV3Z4lF!*T zsTx1tt;_|sLti%|MTzViPcn$A3fKWs=9F?G2U~%}U53y$C=I@(>OEVLv?kflm0Zkk z?S8CHoGex6_r$8O_4Rml@a@IG1<9`Xob@jKV0eZCJ)%_=V&pCHxn6mIYm9yrj~V7t z9;7!tR^^Wm`&pSG(i1*P4rQQzCVXM0^?(eM7VmSNTm3F(73@x>H(|8-a2H0^OYw^j{8G-p|R-uZe#tOz+bF2_TUpz$F>EQebWBO}D3J z{`Z0<0286h9;p9jC9$Z?K#c0`w=9LIR{f*!`e=IpJlG3IL)^0aGDC9&21f?_7 z1*RJZ0D}rRLYV&l{I_;sqt2wo)Q{EoM&(SCQ zvV#h%?lFvX@I}R~3toEzec52VeUAbJiXrKM{^#$y!bnv>&&OL4-8(y9L7>R4?O*Ph zuwD80(TMpoUL;hY0e@1NK0nl_avPtDuZT7es9Y*tD`w=8pJ5!yIXq zj0ACLLial!w|oO9*`f64=9D*}*xO-fv%0^zZP4sxFh}RQut!o@jTV`*1G2KRnI&!{ z*NP?(v7sFkN$p4BXP;>y@~3pFo585?nM4>H&B&*3RW;SqmTBso{6r&M|bX>(}&} z?7f)b=Gkz%{Yp)1Y=|-W)eOUrqkqv98>?der9A!a-OO%-m+u$a#)ORHa({t2k+KuB zSgw+uROAqcG^1yk$a@1|c5{BLxhQAnf18hZJzeC7NcXmB7wE7b>iy3quv9-qI1@he z2wJ9Pa3%{}XUXhIUU@2Ao~{jXYiQW8oAe&7uuXO(m20;lJF<6XTD4z$@9{ml0BWv* zOA{-#sEpp7@o^+;8D-Px^`;dQ*mcjvopIRQCSDqcR|5KpIy6UGA?N)qCArw+Up)d1 z`~*L$+jaLcd@Wvg%Y$EaqZ%P^^;{|d|DJ!gy0zaCp6UA7<9rr%?^LsvVws0BD&sug zm`X%uy(|)XC@XZ85Sn3UKW{k#LJ+}fPeb+2O+i*(`mB5pM)VH>(bb5vyXtWr@ctQ} zZlAkIhm#(Mbx?^lg3$GNd8z8a9eL^a`<4qNbByXFt-*_(Ouyf!9n+_&_QBkzm_N;5 zz>c3-;Db}yUaJ?oWYu5#15{?yfl)8dRuzUpW zB|;Rb|2BMAo19|1cRKoxKi`l(47L757JjWzCZGF(lZ?DzR((lU<7wcxYs5NwJT`k> zIGh{>yYqvEiD~A|NZ8~vr}tbf_wye@GKbDd=Jx7FW%njy9T#6fdiuX_f7UIKqc6vb zN(rh2_QMTDIkRIO6bUiVop)Q)u_{!m*&l1Q@*6u$=ev@uTerqv+Z+ss&u&eztxOTM zF}k*-Zs|N)7r$;BA=+L=3R9OtDG82)o8`i~a0tj~mL2)E23lw+5JbR#5!q@k5kf zm)w1ZPrg7ei1qJ9%?fNeT=M&g1!F(;G<%bQWOJ;8?VzS@3UV>dg&-sRH~g#IPuH~T z%QYJFe2~h7!YRc5VpG02NRzUK^8hikG{1NV_xVK01n>0q*&dF)!8;=%DX4NIlJ_Es z^=yir97TMny!PD0dt-;XTL%6DpYcNX`g5JPe8>DAr|;q?ZM%F<(7H}AE7|*vOoz44 zFTyLwndkY#VLs(r5@KYX+ST!#7qF_OF$9))l4v=g@}>>HBS*CYOi`x-OAF#H`AyOg zCpd%vM^}i-EU>h*KkUEEiDT*0&4Ss8d-e1#vo*D_0%+=D674b;q7b}r>HWp%2K4&Z zf%h*Cb#+ATSzB)c<>7Rz}hODY!$YJ!tQVhBhN<{{~q4UFXS6%x1hBBzT zx8jNDt~R;g9^yiw73yBQPIcuXz2+l{fheIOiP;OT&RnI|`(@EKNw{nJaYg=~wWtSg z$zRrTftcYBM6?fiWSGbjSf>`kM_%yV#&_j9Wz+~NmIBg^a~?FsaX;%uRx{uvSaTlp zr-u|CAflFhXDi-Oj^R^__g73-82Ut+IIY4-^TnJ}{UZ2NDbpjVTc0G#XdRSbt_-4DIQ?XXM&> z2&c228J&@t*|RcUuWc+UGHMHJYE9bx!-uNvY+(^y2{UuLT_WWpoKO) zT)}L-Zn26#f2jLReyOS$d!57H<*lgekPEx&(0u0#3;w=;4FOrFf^hPfwl4SJ)6p=0 zr5uC^_5MO;TC84RU-#$1<2%~XsOW=COuOB9BAP{M;X6X%%5_?#hBQ{XET;pFiayE0 z!KVjcos>C}Verg34LRa)jv*r*KZ zV|}ci@`^@f zy=S@0>Ln60_Wud4%h)?o^h?1N`>CGhaJHUJ0ILf~pX{OsRPVLs+DJjWw;L09c&qhX z-i=Y60DrJ**d#}^bCp3pAM~Sun2EhE&m|y$LyS?Hw2^>;u&!MK zN-{RKZ*@6)j+FhPj?Sl3FNnB3yq7)SgL@#+s|pcT-nUeoxoo5NC0^eS{)&Xkee?Bd?Ppt4e%A9D8zD4`+Nka^15Cx88BkZ zL#x4$uwAf7r{^t#Q)Sbt*Uio@!)-TOKslL0tP1b}4=XMI*6Rl1pMvInCK}%4kpSqU z^^ySvf@$@@z`&zj4t|9=3bEA9lC(V>ytivwU0z;}qbT|=gUo>L0{%Ao?O7h`YeARp zlr^pKYe0uCHD*zimT$Q`5eVWnlxB@p<@a1v{Vcm@Mahap-I18xIZ>2U2`Z4jo{I`B z7(}f4K{HW-sYJx8JgE?|N={r9-7BEvqIQVRw8rXzsu|$ZCF%}d^xD=4sHeX5)~nvu zptXVvOK=g;3ocw4cZR`55E2o~>#W*%3cN$Uk@|M0yAV+VZJJZBuB!#aG>qflZbg>z zQ9_EL6JQ>{?Fe^ljVk^v1?u=2I{=4==6OQ43TGYD=ZQUc;?M*hZf---l7JmAR0_}H z5{^OX9uhtqV3P32{r9&Y#Mb5>#bW1ESX${T8-}|<#qZ`h80~@2uD6yy;(oKCrC_Aw z{+=@cZPLjcYc$aXrK9-gAr?nEYn0S8V^uD^lenC8!yhJZQo`jtozb1Ot~;d|Z+>}+ z4^f=^tx*Nt#g&;=y3_$7EcPm==xS*vIe49>o@cz`20r!(0U^g0iV^pW^td6$bt~|6GAXfu<7%Zkt02`?OdoUrCsx$A>mn4KtnRmT$)^8*^`Z=3EixS~UtP2-4Y z7bZe2CZ)j{?OA{xTuyw=73NAbKUOc2$2A3rsw;7RWgB=80h2XDY}Y$KTkC;VDH-i= zl1XzCC|NjI`W~^)_iO-2Bm`<9T6zN%w*E@WsEl!JlA+0psX7K2~Ip8=j+oMe)U0 z=a{rBzJMp8*y~ER6%o8eFkyZue37qEhXyPfz&_RA$wtsATO%-6hH>3UuQs>PGj$hF zvX>b`SsZ+9J=|2A&;QZRq-5=Cn7$&)nbc$Hqbf$Y#NVsz{T0whgM-JJH5_(=`MbNy z((>}$lX!<$_~P6?jXQYE5w%P%A*UCx%7RuwCdn=TsjeRAhMLJ4@D-tg_P9UYa_qfn zfOZ-j-$wuaBy<{1UBGZ|=Bt6aKt^~`6f$N@PC5)rYn;wzDeSk6W_-sc5S1f%)31#1 z`(bfMIn9Go;NIXxu{4~?w@=}jQ6>!_1-IG-thp(52hT_=!M-z6hR#eqLdd#$2Awr_ z`Qm;G9{U0)c!P>U?y&1}@28*xe^9QKoQpgx=IGn>J0oT6z_55CLElo$N+18=?tThx zJ&8d_Z9hH`$&)I%p8_!RTYxerVc$aq*KA2zqRQmlkNCAPwi}i*r`a{UN780S4z?Oj1(}($d6xc(4b`PRWYdG`>2Vck>Es-L&NgBh=Gp zgJ-FtVkx0Yqt;tg%jsQ}3UlS0=Oa>(xtf(65#?GoB88WKuO+k)1>$2V6vflvBPs~nR5Zw z^2o&Myqe3PC|~;Uz}eQvY|Q#Y=Nr3gQ7axk;L`7aP8iLv9D-H~i;3bpSMHCto|N&w z0J6&vnn?ZzIWNan#uyh-s0c^aewkm1?MSLBBq@>ib7*dF=tJU7TfEkZm|el3zkY*sYkdIkZ?_=VVsM8Q_X;q-42j|Aa=*L!mi!|( zd8B3CUE{igy&vLmhlvPdQ?;iEFFBqBiXlvNb8ZRF6C`cg2I1b@aq9l@8LB%jZo>pR zXx`0B{Qighvb@v^xIVd*vNpgt)bL6;XNKBf==ey;90Wv>lst);ZOX6GDU_E7a@eONjjs? zT$;{7liI?@l8qC(AYF~uPQ_BtYlSO?Mx2kqxR5?#c#I&jGlv*1$B69~LyPfGnLqDm z=2q*m-t?3Q(M9H`SwCVisr!49KWWR4*u{3qvK*D6@D%aq*;Acx%^7b>=t;KK@zxkFtlI)`P1*hQb)=^TU zz}`SXg=?EE<(hnZv>MMm+P~Og$`ldXn7k*z6JnCy1mp&YrpL2p)Qx$ z+FVU^G+8VlM{rXKPA$w6qpv&>b%RN+zwM81%F+SLvljnzVjv9G&BbQYy&QLfkuv6m zf0R%RImM{pe?da2PmiCEc^Zd&JIW}C#vPs81!`8${{y5?j`sin literal 9620 zcmc(Fc{G&$`~QS6*`lJwzN9jiHcMqs2-z9345G4)CF>XrN>N#|rbr?~F_L90V{FNu z$G*)VOAIE<7>wb2tIzqJ=X`(X_x=1n&-0w~{bSDD_jT_3yjzcF8 zfj}S*U7hPDAP@rt1Ug{F$_!Yly&mlU9q={L)&LcC@y`P{On21{)Ip$Ac^EYp|tgLwk9$1qfx|3{R0b$n=E18hh zveM_Z64pBT!~mk@4s8^Tap9IVwopG)@8B+%su%_Gj;KGc$oGnkQvANEpsK1mSf+Id zjouA?H#ZTwePPMla4>E`X>P~x00<=h9M1p(C2GTf>sB!g2oyfe4F!SJR#}0W2nR9o zfd2ykt$z;KkJ9U#oGWr)S zG}lgQ(oM&f^Wk0D_Da~CNxQ-i8*A3$)T(8VSbEnVQmOCj;2==VeeI*rwgaY5qn*QM z@lzUI42c>C zGo}2riAbncfu^?SOz@MkMHR!8R1uyZ8F8vqImM*{W1?VAqIg88laP{GkI=%J6misA zm@Ui_8R|s4icJNF&27>I*n(elyOmQpK;g|+A+UL_{%`F5{_&;sU9WqC6%P~N>L0!b zhCDkkm~`rlTm6~*p$P#Qg|^pDP7?#Pjl!1vH4!oX$%i#uyOnQ)7T>m^>iqJ)2!-H? z*cI9h#`g8Km%F$FAPiLdFm$YLhL6$aeC2#r%gpwVH?tZsr|y&5Lt!4Aue1Wsu#ksf z%J+w}USxg5LDpITtd6lrK(tGMT}fU7Sg+p zbQP{tQT9iF@M8~o9~ z<6K49iGq=)yN-)wSXj%feD6T&oDI&SH*{`+Cf^=pfFOcE(9bzwNN6~TPx%CW0hJ@D zlP4{!1xx7v6o$kPc5J22%|5ps_p}yHFUJLq&DZ%-kQp;IFI$9x1NMA?`yj7E_%UbZ za_fnFu5!=A?i`R%7zcB2n|wcNFt8Ip6-SP<+O?Zex%>=y{b%S9kqDnlDceTKNnO9n>&!NhX|Pe4t<%J@jpH7X zly#H>>&fywjq19y0+w!G0kGz8^s{x(^pYbM1JDC)!$99lG*#6W$h_OLTQ>7w5 zvOl7z%knE`MCKNLfeCWHEEa%X_sU##EORPHXWb2vD~^s_knd%Toh4XS?|sF2-iD!f zRAwon_>NZ}E9A(-Qf`Oj0{}4aD>JlTO4gRqN{+h+ z0^z;)m*#Kz-hb$-|9V_6PcY2ibR0pdsiM{G28!Q~8&DF#=`s`Lz};&CFP{g`N}> z*}6)8Tgw4w%6hg*x5~4RSEshuQK2kC`PwCZPxc2zxPuI`qXaA4)4R#d6@`PZ^$Lhr zi@#8^;;{azVfGY4^*ett5<%y{PZu@_A7S8fIh#ie-UQ5X)y>t2EUkYWY6P@ma+aZ; zl)B%XQF=X&=h8B|2XUn`n{&H|FR? z(MXit9QAB)PkMUWVrPNfp^D^hCK(PT>gX}Th2pvb3n|)&U-}acAGDbSMn^GlQ%$*d z^4-tt%5=5zQq)ZB?KV1BlBGr$i*p^1Ovj2RTDiK0+I%Fp9Ct3RLc*cx0)2KR#)B2I z*3WTyv9|a|!0C08`gIp4eZ_c>u@6t};1#FRLE^O|-i=oLLNYO4mv;W}7z`Po)Ly>a zu=HT-du?%r2nK|91w&YF+SV5IWzz9FFsvhEJE7c;FT>*rON!{Vp>IZP5UKhvq{8}7 z?t`n9Elk3thr2LQqeth?V|1JN71;H6`7`F?UknMS-n`5ZYtixUXtpT(aTUchwaJDK z%bUB}?c?XC16AJXgCWUFrv>8h7worw8rxekf!FTkU&j2%YV@1EDmK=oybkW|1qR8)KwRX!mqj%a6?Zk zH-K@CQ`EwTuWoLpZ3UJgSs}%iN0_%QfiC>jH}8eCG{LV*W18$Mynz@T|KTiZMh(sO zK52Wipy-7uF7Ol=99Q=9#xM=N;c6eqV&D)ZQ*o|pIh`_zACvE5}mtRn`*@n3pSIUOVT*-^E4Ch zYZDcvLimQiu{*K=;UH$l^l;nh^-aOF!%&+aUbJK)yvIHK>;QK7NJVW_%E-#wQ8%U( zao0>d&u&FjLyM+XxOc(iTUP!lRPdE{vFwo*yM@7!8?d0V3l{~0zg5g=L>G$ce7z!Y zS_RG=y&0x=hF!g?VUV@)A;-mLlHJSs1S5K&X03e|aH#ILiHSf8|08^2O3`m-Ryvop z`U|xV{23qt>t6#%1pIXz=L0iA0A!WU#RcEl4S0C~3Us8ryLdWV;`^#2qd?h?gu_hG zR^1GH_&y~|0sVi_v%eN1{$J$p&ce^1Mjr0&`J};OQ#1K8EcSkp2WVUq)|xanM5R)f zc;Z>Gc@mEqe+UAYK25xV;`jDo9KQ~0J*wb09piTD$7#S`i59c88C6pN;z+ZB0CsAG zx#|f%@vP^<*JFe7-wc3Bdz)$(RhFYXMS)P1amA;(jN?IX1Y>)ZwXK!06wbnr1>R6d z=xb@rT%c&X4$3g10r(ofbQ^~KSzc6Pd(Si~xqjrit%d7d54C$ins)PfxT_}gT_X+} z^0H`&urU+wn+yQyEmh1GR*}`;9Pb)%STLXaDrL>>XkqJke)PJF{eWeE8_WP}Yw+#- z)usG06sI~PSY^h0z_Q(nKg_+_qm*b+>|;t4pqSfB9^1MLKh9(ZzMw2{=gvm1rCCX^ z<+JVOxrmN$QSJD*+|Y2(KSAr>Vm#ibnK`A_qgF;9G&CP^{}e+6M`%byeup%3u9Pcl@DLL z|HwFoI`|{+EJ}-bUFMa^!uP_eTeo(nK1Myik;ux>!haDm^Zj)&Ed5gBA4}S5erw}> zGsd@+-F3RV3iR0_T0`@3H?DCuba)bRAG=;DIo%A+WZ7@86{Ur%_F0H%m0nQe(t3X@ ziRgU)aYtyH)iFNt7|KVY1KNX+3*xUj$f{vjD#Ru~etyuvmO)3%{iuEZW#a909%u}u z{wcd$q}yOo`b)n3Cc!AJ_eq9b=gOS_Ms?=`e*O%f9^ zULSKyA{EeOR5^Lp#`-!_?}<6&1nR$wZ2OFNY~%sPK$PMS+(@~DI`myZG5({n@uWUB#d?VFs; z#+J0#Ju@+rkx;k!?cM)KqWGU8QHs8RpkTqXXB>X?ZNHedJb49$&N7ZS2w?t+r)ayo zI9rBQ;la;L-oNo@XY@?GSdqs+vp&`^n3ZLrl$2|(MIp(bB4urFYaCf7Q1Qls*{w~c z6TS}^7L@dX(5`R)BMvd8+*CWCJwegXlfcvzb!guFk?gs!pDuItV~CbwJZwB#ume^1 z%ke%lnz=H>3N{Z>l-8)#DYLs;cT$?VaGy6k^5tkFnPBPAN6y+GIo91iGSi}DZIn{3 zzV~9*5vmikdpmb|#*b&?oC0Os*q-8Nk`T7>NL?*ixVKmRhKqf$*0I8X{(N$%%vW}U zN_NP}{Ue)#_j%LTUwCtAc(0oi46$^F4UZ0x9K}qoVa!}EcXTtF>!%%cc*6?%R7~Pi zZ|*E;5&{n+Z835Vjm!2y&!(WE)nBkts@1++-EIveanFAkp9t%Cp4T4d+xzi6FM*1H zw$>6Ym3GeqU@te)V4|eiz}HP3NK=Kl$To73nafRm7+CPgv*;PBO#}U1_xhpJfh$uF zs{&UX#Xjg5{>H?8x4M$-Zg0E*0FMvs0XG2oedT+ zgNNU*o-}396Vuu9dtoo>yhiBj)PI5;``-SLi>C8cJ3$WfWADMmivYerI5|1{u)cF4 z(1fg91t|u$Zw96evA8ETin)C)mVU2atu~Ja!oZE;TiAqqFB_I-IU(w57j{&v^>z3w5s)DV|XLS5#naUx30FC~A!SBKr#iM0J5tgYj#(9Q_ZrL<3lN1jqu% z`Vyr6uFvk%5jq`N%`~lEG~d~2P|fs455R~k*REYs@ZYL1j%mvkf872XIsQU@>pz99 z|GRpYh;D4uEGsF=F0!w?Wjx$BJDZ0sKk$GHn7@w`kw~o2QxlwinIg>j8{5K89rS4e z2+u#VK5U%-%A_}~`(Gclwl|lGyj(HxV^&kBPYSOYoK&+}UXEc*P#$7unrE7YP&c zK=w0dkFdwCkGtQ((w|%R(iCXptN#dKoj5url6}%nf5>Z6GeYOEe@Dkt)yIo>2M?lh zKRp9$Xn`)YNZY^j8Iwuh%afUG?ELVw--zYto~1l0_in>eR-seojRqd7Z)X3<)mvDf z@9jzSD+P)&<43t5(N~gQAuZ8I;8K)jEBe~iDwP4%tZ%h1w&&V|PgQ%o27?n$aQ1S! zm`B9-K>1|ayB#p+Rrw~r3XK+a{`l;fTK7-TsGsK(z#`7^XA6{kP0rjk-}x@w>p$8b z`NVXcRD2|~I8SP}7M+pKL#u2_WfR&+h>sI>fc5OnySN1MM_KXn^XL1{b!}lpRrTN& z`^+Jai5GbU>vaUAx8#QByGBgshGyoAT*<8nXnS zx#IVBM@CQc&VVMvBd){!l;k~TV@O9D(z1XKt8NQ0k4S&zqRQ*Os_>VX)g9MT0eQ7c z1I-Mv$`&);x16h2^>8N6XV4qfn~FLezNQNHZ=Xdyn>wGsd9IfsmP29s7(dG|Towd7 zSP75}Y6b6wi(LnTE|77covP6pExH{=6Px=E@TX+s@Aw`Xpe$u|b@0^iYhN$d0vS>& z=m8k;_2}s6*)KAC@;8mKNlf0q5#ZmK*Z)5J{P$YFGz4Q)7doDLgfw31-ALV~kyU$d z+uKuX0bZX*=*&<+lDF38@~E8(#7#o!-EMvOH9;BypoQ}uo}SwTAl0~yAR?)+$;zQS zL+j<`WmqsvDrB5ShG+JH&X+WBY*!&5+4~NqT1VZNg zI1V{V-Q6b1_E!7OJtr?MFTW(n*6mCo!gf})-N=LXVU$`Lm7GC<*U@JYSFc{p3m_Ae zi7&E9wZyQ!@%8EBMUpMNT!Pnr)>a3QUuM?eNUcF&rGUW~MBT6CAHl2DY(cU%h6FJY zayqFMadx`aPdTXj;SPt5;jX;Kt_3A?$H3NbcR*uzqeyZvDsXlB2^mRSs>qWZd`4=e zi0{&=_QcVlAvtBNyscr8mB=85)LJGzZ5^Pz#r`-|)_$7+jL{>wf%5JZRCZ%4@q1+^ zzkQR6eTm)Tnnc}uQY%^3F-tax2#mpyo7REcqf>Ewv=A&IPIdPOB5aRdG2g7>TheX$ zfx6bMN+V>2?cNVA4V|41272IsJT#}LqFSUdza}wSoyo7=vAq>TnWlOxZz(sELT0Dw z{>ocdAK%YX+NzEjy1VSBV(%kRm1&bDx&b@~^t<({GBYHUfAEFI$ux)m74H7ugCHD* za{lnBHgiF%Ky{>Sv?g!Gi1Ns(8pG<-rAg27zYl#y*06v35b@EjxY%xK37tt>&aWGy zo&<$Q@$117f|pQc4Ke&~4)+^g!SFX41S<%iLH)v@=NJAV`k3X0x9%m(B^FP#kCCTR z-igh-?2u=JWi#?#fCBMCaIJDJ(W4=2$<=As7tWM&e~z%atGi_YsAx?k$~-=iZ@3_n z`9GKkVR`i&_|R(WpWf}A;f{=^-_s~w6I~VT(0;thqerV|<0>1+RWOxKUpCNS7v~sF z{j?M5-^U7D(kI90K5KAOB|Z>{#|wgz;IBDVdffWMT-+S&dcSVldiHEyYj?!s3HzpN8o%0BFX7$|J6%fu^mLzHoEF)qq=Y@?S!m$a=U z2<|)y-BBttTMEdS8!JRPXKHKI6WvA-hd}sKi8o+i<{?*Xy?G(~#vcL2mQq53*3ah$ zEvc#MRoq`4+!6lN{dfBq7=aoVzUO~Q zV)=9ZEU|D-HhEuN3FAcbxBr%0J^o31lnL~eWU|)s#_YGW0 z#DBt7y#Lv&D>1n$QV2iP-0BD;ON?+DhVl2ZZk{D z>&usqe<#rn8Vun;#6IoI|7Pk>tD*E&&`yxmR z7*YgE;uVDY4=}sF>5bm;%{^}}I(bLyW14lpUh~tNC6Me~`9{&n_n&IZa0M3nXAV)z zNJjgkHv1kIBPY7I7#3P=Gsp{FwlSgG8B+AI@xGcYnbiItw@Nyf=g6Z-=b%=`IAHx! zvQMINc}!eU%~2=jP{Gqw^haNjT%hjbWNz;kbV%)fJ&;sIvvKjv@)u#KceM!vu?3&_NWPnzLu96-P2gJo+ zf>p=`JJixqkmfYMq+0dvOYrcbY0xtX$ggcnpD;FMjupOV7V-3Uxk&C(Pu!BK-+??_ z=o4VF*{EhFmOa*%6gHl+cw?Z5`D`h2sY5LL!f|e>C@}EEq;!#$xPX||xQC7?t>EP0 z#0lg0jO>K4n`%9yZ6)Gg%>*w?-v-XD=ZS))1S4*_2)yWI&g${}SLVaCDP07tCli_7 zXy8ugITrp01Ebyw>-(3dBH~MaoZw|>zq9|^xikUvhP!aO@1xwb>>iT4(Rq?emD%eu zt1rJ7?jmLgA?vQ{B(>Ei!=mMkmMoCXbOcS8%Y=>A%Ywy4-ELa+w>+x95V_q-~L--Q|R!C9VQ{3P`TuJOHTt?FQm9 zn^~@$i~H55_P$57P!GwI1>)%N@cCK9j*D4f0AlOGu-t_G;O2@D} V5dzHhfiI~*x>~oc7iqvE{tJmO!7l&+ diff --git a/umn/source/_static/images/en-us_image_0000001936832146.png b/umn/source/_static/images/en-us_image_0000001936832146.png index 96c82aae94692c21ab0223f20b7032c013b19229..6a307cf97bbc21cae227077fb9770851a59b1e54 100644 GIT binary patch literal 27774 zcmdqJc{tSX`#3sClA=7zFQU6<3K>&bw$M&B<1do;Jsy5OkQ`i;@WAW! zqgJ)om#^aoo1n-)V z%*I;OdZ^GgW=fW^DnhxxMlRsfh3fYb^!5y-blNx|;y_ADv1$fMPoDmb|G-$B@WQ3d z@yA|0q63;g%(t4spF=VVe#v+3Ei#P_&FZ}U)-g;8)s^S6$FQo7T^r>(<|*V}v+VmC zc7Mju^_YEa$hhLn_aZ9YqA`ltxR-12yUMFE3jafAY^;eSGc{QQ(ye!>swe-=wfJI& zK*XnFYn`YM11{r9*2+T|mDBUZ@g63zRXYsqG@FF463Q&!2cr~SvT6>Tt_w(Fdn6q_XlAr?~(K-ePs)FbLHMg69V13)}Y>_HmZx;kIgHw0{ zo9LRu{z5sqU>3lW{~T}CwWOA}m4&tSZ8Rk<`yt;Em+A@I zGd|v@d^c7_aP;2fSr4T>e>oaZh6z#v))ClEM?miaQ8laA6fa-(kpDAAhtT)WqvfXY zfW6z#t}5S)ZG3t`Rkl73Ad?7^?(q}~-oKISKfiZI1;K+F4>i@kwuJpqCl0SR?_ zKenVg#wd52_UZ^PJlTA54CgZ(o)=HfthU8@{3G3a(89Y1Oc!dA>Z3ar?u^ZXcicbE zU=8TevzMnMBN;B1;yKHw2qZ07;Am)1saICX}h?#UnV7Bk4j`YTGEmhW#H0>#uAI~LwKI)#wu=h9E z1X6?9n*l?@0QUn-b{6QP_%XrDZ@(XU{_FOk?I~XVQ#wf8uJ5$E+0PjzuZ1;;O6=* zsi&f^^Uwl2d2Qg{2;zu>Uy6M*y~-C^s{*kU9c(}3E;)gn-mAyU^bDWLj&c7_tbG;b z;OlB$*Sz<^!B>R*ytE0IY*g zQax^``yw$)eoVR_=6m$Jmtg%-G#xmwV?q1Gf6mtv?-eH9m}Q3F;VvCV4kI!O)z99W z=Pct~fUOA&k0S=B)%g$oClddcHLm~*M9h7|m@7^~(z9P|R8;uDYzJvqQtUX@FAv_h zzg|Y%4?hJ#_0E{q`Y6vc6{ko0G7DoYZvy=HZ41x>{RW>ao&#RpLiJI56~)pf!L7-N zpiVi>@u&H6e8D<=K;YP`8?n9)+p@N^E%UMgWLN5>kl{l<8y~lC3!&IyIMm-NR50kn zcnMDxyr1gHfy;Cy4h1kVvS$xl$hX~wSq|@&+`AHihE{x&&!7l-vZED;2VOB2c*vYA z`?IAO`^I0F?jO9d_m;9tEak}Sj>lyk0siLWM{k0z562|B6(coy zn-uO9dW6H%T)#APh|^o!nJEg$JjGW4FGr!^&?mp^iPM+GaP|-jSZmi^1&NlL#XW>D zce{~v3lzkK;Bddd8$Qrcj9gF8l2*QeU508%i~uQ zm*m9LbyvJ~`s9VF_b4yjzMUUMvAJ3T#|$vX4GL=xYZ~AIUOfpG(oZ`6vX=d}W9sDN zuEfQY1|ma)>&O}5p&yC|7WgW-^K+((!F>D0GX_!;2aWj<0J42us4dx4r$3Jeb1njPf9s;y`1Ylt8xP z0N?gB@F_8#{GspU)Q(%yfxAu&D0&LkN8*|}hunuI(*eDQ+yU`V`KHR63Xn~F=y!y7 zCn)OuCT^y+G6f)eS6x*dx^0DoY>kh?fx=yP{u1w~8Sv@5{Ke68?jmxwbjql9=OLO^wG5MFQ6ER~H;I zG^V1fL<@=4Zxk$(u8zK(X)qV`a*ml+>t3h$XXv>6?<_HvgV(Lv?(it<>$cg8_ zR8@JSBXTK%!Go@)>9iRL-)tV+;1f`paiaE9%Vm!^ANvEz9V-%eHSdxFAur7dP3aW*nD)^4SexBg#XT&i$u?V`kyTNz!WJ3VBhzGZr z5!$eC2-wfi=C4PD4PO+_?D=e6I#OxfT8(VVmV>+GWyMS#fIpo)x&8c6_?gF_Tf+TJ z2AY7ZqzSh0xY$k&vW~&m#H?ypd>yp4mf7H=DrhkYB@hpo_WDyUEe&KNNsgX|R?gua z)iZZ1a#KI>>|BrN$tncvkaAQDQGKS(Lz#{#iy_T+Up&T$!T1fjhdNpXgHcMeePy2^ z>&jiGEcph?O!hJ2^AgB zojGF*CFGHZ{)C05RW1bBGwcgKJu52~A2`r@`uSI(_X!597=Ix{6O{Pjn(6hw(vfZ} z-6uDP>!rYOlizk(Avun%F7KxAqU1^fpW*V*3AfbSUJ(N$PJ9k!+Qq1iw5#PnF6P%w z5Tme;>zZ!pi2O1AfeyFz%hTR@>YtG|xgjbeqdx09=}5%JPi&5`=VBxF9>$h5d{bK` z7-S{kh5@H$yw%T)TMQRy@db)N+r_BmfmlJCPZha2#*E_}z@K6o=AYqU@G zNMA)ZF+`|d^!jA|Nm6$I5DX))d8+-k89vo%4m3*sV}i9ah31a0wNXcV2@XFiOZVgT z=Nd4Rt{>t;La;VxC7)E_@q65|I`R-7QY))U+>*TNIA3TCdMQ$d8H2>mzA8;h@$pJt zidOcC&8&75%HJWRbve7*<5-W{!_j;ZF?^NbGf~x;eHZ5Wm#@6PX*hltOQulAnZh06 z&R2k@OB+Sto{b;=q0J`0drGGzN=I>~{jz=1rOWg$m0I@IDz4X|HZ5$p8(~ne~Bs`IFP(N zowx&RhuR^EBpj_$nZPBYPrjR-M(nv`dX5%ne0Evo%1m&!eJ_bo*WMS&R}hdASWKeEN=OFAmGB{w{z&h8@%YnP-3$ab7q%rxIS z;Bv2W=h&02_K2-@@<{_A9=@E_Kk9(_oJ*_C&}{oo@*j7#W7E?7B-$!BVkAl(M?L^d zl%McDoe_aEQS!fDAKbaC!Y5KqS;2YnvFmt>Oy-M5se-Q(P^+|)O$}n{XwTQLOb|oV zEcWVxh&E&k$FwL>6}l-@JVgEs4u*bk+ zL=CnDMsL?enz>YMoPT*K?!;d$>lHcBo`|m{#Vq0V(V1aySSY^J2Vv8fK>qXW8+?g{ zGZ}S2(giN9j0{PP48i;et#Q+FKKHhTBf8iG!40vr6JA*0V#_H<;Gcv)74!Amww7V| z!TFNud(rq@^HI43SVYLQ;^89ps+9bR96)?+GP`9~%a`U06JM!-}3 zFvt;ICqj_K0B+IhMr3gG3=3{~c)f)XI8O~x#*-Q&uSKF}PS_@0BLqL4Jhe^S0eHvb zQbmc~;r_4H-bKT6)CxP2#KrCEa~4^S*Au;_>=WOq-RoAL!{kZ!!{_pA5u`3K>>{t*+O$*!R5;fHJ{)s_zq z_4MSWs#D5y{MP0j7U%CG&Pis|{KuLg&Fkbq)U9UhQJa`HGyF@3M=XF3e))28Ond0M zpl1_wA~4I$esqWZc?i13=~0h#DPg0P{3n=nVf2(O6a%~>-Zs;1=YS$ObqU;{HD>ZP z`uBs}&8+gP?P#MOwTuzUPEpCkyBT$r9%j1-etr-+t%rCOntMz-zkHHc95+3&c$ghR&(fM#0S~HLii6JW#4GR1$=7o5 z0|H5}&v$8<0U#p^%TiTIbG|U|i9mEHbk;o8W;DM{Pi{Ft5j*MnuT4y^Sy1nBu_4&x z7e5Wa4>W2O2ZU}WRon^N5!-(K?*P4yS|#Xe4xxScc+L}$0?;#>#I=9^2!;tfR@-L! z|C0d!zwH)QNC`x&Ot$eo%i#m&%R$XK*5v?M8!3Kf#52GXy`5jE`X|0^68t;C@ZX02 zpLv4+A-nNk0ABtgg!-2wtsN7IiI}wNf2hi)Ie?{Ne)B$!EzS%&mdy<>4+n%WAQ(gy zDzHr@obz?##X@!bBa__&b#--16x52vs2wD4`-Y_1d-Rdh3TF9_qiREJse27cS2xQXZhgv){qgR9V{qjPwz8%YJ(_aV_NQ(A3S>!Y?cn%_Of6lcnl zWCy7jWm8tlM%(5ZwnDsRJgZ6Tu(oS$R3hRYW-|rzi3D+=dD=CyaEPdk7EiKN;f(k- zjS~h??m7&Nh$1RtquD4-Ma8c!L`*}=QhCLXfdvSJ5Rw%!hP5x5-2A3h&RW4Z_z+sm z+vYS7_Ysi<(uUXZ&OFFu8Je1bSQu{&uk(1eonYD<7@Oa;F0#~$Y&CD&L_&=?R8?NB zbpy4qWtNsa6<(vmn^+%iO3ox)ULXUb#w}3*z3>V~plka6M?Ca-e36%~alF7M5g!L~*JWuh zO=w|mq|KN*?elysw9z2}`aH>=)2f))*TQ%4Hq4e%fs_I8S>^CHkD;?6V=h@`^STQ7 zuKE0muB*_k6&}}*_EaM3I4{?s?puAPKD{Q52wRuud>U``$?*`rLmdm944*HP!fbXj zn`g?+TQ-_!k`FDh*ZaYY$w3hCmgyqqB7=}t) zP~%v~AA|FV4%{9 zucc-7t#PnT9*4ys8EmlU-C*k&Mx-Zsyul~QNL`n^IkWUJMdg7il!>LuKbe*Ah0?%K zm#qu5d`7EL^qe|uaGNkybkmxH=(Y>7Q`x{cEVFuJ60?=_=g!-NSwBut=q2aG=0z{9 zCA6KKlg_*suUI(R(E%|Z(AaKx0>dK(wIL>FP^#+H?+k$Rf zuG-vi4?a>3GOjv_jp4LIxQgQ#yKcrumkB+_N-}+=>)2O-GWZRQv+OO;`z=y(Chz5` z8GY*aQzgRK3|p7XXqpyuU26%%TL+nVwcveGCLBJGiu1o60^2%T4_-cyPn1wwiC&3J z0X{l?8cMR6`ibZ?(IOOKcAhlNy;8vCbIBUI_xd-V3)=~i0l|$a363AlZH1lw(FQ$q z0cqbNA^5hUH}KhX7sO9_e3I4$E!W?`@X!k-Tc{HG{9)u`v8~neBM}G%H>4A?;9d{H zK|}iFb7k9Jff{_7Svj~dzo>`x4xo|aI~TOt7EK0i!X9#FK-@wd)^eSRRA%Ag;vzdp zf0`0!DlVt{9@+=faj_ma4dpSQ2<~z}_ebz~j$SzPP7*8jYV-K#epx8nY3SoHYLccx zE074`F}2VAEvCB%sCGA+Y4p`Xk(5S75F?z%WpFCBa^Kk&py$NEhY0FvGWS%&xMFj` z#c!=+8vMFCww%w6nBCz%KM5{@lC?1tE%8haF)lUgSnY?n44oil^abM)l(RiQzIBA4$yuZF`MoSs~GNrk3=qdI^ zRTz3jMrio+33&`BZ;OVBqV0?>zIv^G0!RIMNcFzNB#Izy&;51w#JCS>^jJNBgU4|2 zOIsv_mfe}~*kO6znmlQg&Kf-Mk+?Ku?6CEK_B&o;DJD}loN-1q{Kevzz#`DRmu~~+ zcbwR;JZDgTam7fCX^)yHkwy{ePetSgz%qlnfu-GBG?EF}RPK_NrlxDl9fz%-S;ODI zKVN*XwYwpKjBF(;mlRw5OE&uZOcU+bYO_etd&H;r19RrY@_A9T@u|pH5qO(^+8w!l zE=g~A*ejQ+beq*Read-v=qw1A9Eu=EPI0SZZvD!cTou`pP}DRq?v}TiWvyzxjP8{- zsxlD&Np3Nza$=QiL~;t0K~)=K{6w?LuNZ2&8}+m=-p7~{b~M3FVb6ouOnf*^KW5>? z(1YDV^}7B&Z(+c<3IV9u3k`QGx~BqcDfX=K(ejn3d0>emqirSH40QUg?@ZP{XQBGn zk55Y^woE5V-!(R+T>G8Laecdj!TdSI>_5`u_Cw-9jwTSIF^w)HADD|U*X;*HLy zjx}vf)I9y0e$fGjH@ATM;wV1aeN>-7|1-surInf4mQ->6;FhRn(KoYN?bGx2V3yCQ z4t0F54%KbGaNcabk?@F@sS8+M3IQJ`1d^)QP6`sQ)2lZqpy;d!RUvs74H?wA!dEH{anD%5%O4J2t-&iM5NS;Yt)S(GJi)3^gMHieV8}Ec~D> zJS}f$g5t7o4Xw&&zR!LPiPD2^lhqqxO-NEo>?_ zq}waJDvphA+HOI2x58NU*dREANSifGTe7Jq?hdx|X1{!lfb|SQy-PVaFXZDw^v)q1+AG$ zH^){m*m$^gWoFE)xy?UPm`_kG-J*V321UcJI1dP!n@<&BqBqRJb}lX1@%*&)v3CGv z%qRL#b{N*)=hoNAU;Y#7HdF zdE&hq-z0j9J|I`A8GnE4@g)2$tYC{X#pC>;C4tzEoR(Df2vU{{<1t}0Kj!Y{C(-kH zkfl*~apvCDZ8a#V;L`(H(X>0m^t`2HfW7Q&ZDP3Xo85`cR9NU?Wcwi7p4rG9+2}Ub zw{L#Nnvrt&=(mDqVAwWIM9(2vX^dU)LyjF)B9ATL!gs;WSDowei^0rxDz>hCO*%8> zlcCUr9ePi^O{npB$N}4+8Kl`IV59eN5UD2{pqlt6dI}YSP`Jj1$&r3 z;O-H)!{!&MrBQNj$cWXJf=_i6-(D*%d*d4`n<@-qU|>1Gd<;}WDV$oX3%G+OshBO@ zT>mcFM2zgs+(!8NX17^PZJ-#V3&ahGj%2hkCP{=Z%8;6gfG*jR3hjT1XBT50Bf_L+ zq3`mhMpSuJ)rz`&maS~|x*cbCrJ46)NG%kjh7WvULHp=9w3guI0T~ z|Fw==ua=$NPXk3KX;TslQz4m}q9B;ndRb4kmkKkXWmSl0gvoSt$(@#fUT<5_ngN%7 z;wmx2%m0oL8rY841sm9t5W*pMQ4?qs7dV{Hf-DBi0tW+GNT5kM#yG!E1@ig3SNH{_ zjAS4y=8CQ5rI&2>2e#vl7Gmk@vNDfjAAcB5Txxh=zAS`nq@5TxYMn=xCrOv^iw z7!LVQsDqLNb^Xylv4ZHuS`6`gPY4)Jlu)21z0-@NFZ=^fD|=BZW=3nn>>=ODH0D*+ zy#{@X+IA!ncGP_}Vydn8{vl*~dK_iHQDe!JL%7Np84bzIMDCZy)IS8LTni;Q-0Rvvz~Q(PML)? z&Mvk}YkI5MSys(X`vr#F%g>&uG>iHp8G$Kmo<-*I7i+f2{X|&iM4Sr6XUw=;Eu2D#j^$a)EzE(4gt@7IQ3-xSNo|OIUHrnX7ka;JVqw6923Tf zO!oEkzk?Q1cI?tO2NwHsBe)6n%s%hWAl%fM6-GalzMJo0eLo3uquXGZIi6j54D-Z{ znfXo(2N-dLb=o)F{}-?ih`HpA8G#GC2W*Eg+m6&$!w#kJY`PzRrzw*KhAwDkML{jl zqvtw)DFk5qPqfX*t_&b**xmZ?RxaX8JxiOIb2;n%Ol6z9V%bamJa#`#NT_lphJoV8 zK~8BOGTFX|qbZy5^6xX*L366yKdN`Z>wlBUXCwViGua|;qdhM&BxhngdL|2@n)oK& zA-w5*tN!YMoZe^l*THU~q!hy_UF3{x6Y0Bu})g@DG3)UW#8y$#l725&r(!JB~6%shYW1mzB& zT%1+EUdoi9pFy-!$KIteelXaheqc7ap1t3NmDad0>I*tb*Y1x=Wr#Fi{lt$i|42`5 zCPvWf>Y`<$vhG)1GLGdpn?we5j=gn+t>?}!h}uQ}--uToot&Ju7@bq=`Hc7IJ3Mr26gYyjMcb0lpyH<~hnCK67rS;|G{A55VF*lu4EP~$>-_EG3)L%YPs?Ja&vH=cK$rXWpjuAB zLiO;^OkDx6=ZW}iTl1(D2hJ<5eFb}tLFPqNi1$$m%wPS|_g$2~ajlZy@&TrwX*Rqn zrxv=#leLg%CP`F)!dXC?pPn&BQD5(vEMz@<`yFe@?=beuim~&)!f++v4vE^93;!l%`k{t^% zGw80*F@6;lF?&2HRGUB)!Y6&I=x~;OgvVf`-;_S#ECl#Vlc|q>4RfgT$^Pmp%6ItAz~qO9*c|N2(OTIICE)^^>IEWnw{r|d*ic?-FX z43w(HfXkw?W?63feuc`UT#k+Q*@&(jGig5Z35=r}pzZpnpI~rIAUO9g*O1k@lv;^i zVV$+*8^!rYRA)tli+2sIt4ih*9-nyHGnPaXxH7@LRGBhd?j7Os7q%2M_1EY`4@j|< z>=rj0)mSD4pSMY&<&Um=tj91iPt_74!jx3(V*3nVNB(&ai&CB0S81kCei3#3v;j+D zYaPTi>J4x*yoZW@Bq|ZEX4B9kJGs|uArq;(NA&r+SXmoEA?1*z=l~}P@anXl=)j<4 z`|pJQ+|%>WSHY&H@fA08!btw7bMox#7KPF|T1!v; zddPSDgk!ws`8GMLUvERL z9^Q|FNlsts3~b0TEA5ACu7vnau94?t5$m7Mhz$(FB@;~bUXE2!ZaetnZo%qFZ+_r9 zl=gLB3Dw!!F?qLi4`Ob~skp7TI|Ai@wl#g|vE9oXdRB4RG9KT58skIR-moWapQ>~?gvDin zW2p1OM_|^m9Lbj@Ft`~n5gnF>?BDg9hhs6@z?X*5+=|{#C$eO;OP>&^|<*%9RpyO z2chOd2a#OcPv!hc)bvy_m)y!FQ=VCs{oz>hxb9MLEC)BoF@Krf7CJRL9jR-pLO`T2 zn~F>A^bW80i{ht#;JuOlzwBjGjHTdvgPwR)=z{i`ZcIoT&liE;6)1qpluU1$KrZ%P zJK{`A6nih}0SONo+u!EWH@{!pMn$?Ms~Yx%^?fg}v*y%LppX$WDI>K@z%xXAz-KbD zoz-%BX0zad#7fNB=i_UfnUVwEDKiBvwh>LU%*_ky0s8$Dpy8$t^G1j2sLt(11kK%Z z8LF5?x_;ptUyZ*ldBlbq!`L6vzyG;DM2DEF#i##NbI(*5XNo#&9O+;CT1z=?RZelX zMi^Z|Y(@lIBYJ{^F<&M9${T~PGzt`zj7vCm)Uq+UXT9I67;0!B%fsbK3=4D{E%Hnh zG;GCuXs#7AF6_=zFN%UL&is{Uw5+$%TD61q(SgMr&XmLOyN?2geUNgvw<7LYkspuc z??_a5-gn#e2ppUKd)1lHgKu*>UO{!PzZrH?mTGEBntRnOW@vc5G`fh9vRt^#>%4e+ zC?jB*7jkOuxE!3o8R52-c1es=1D0a~CTARv1cRi4K~On*+Yx@POs zi51TT@??TXY{XD`KBw2q?{;j6jk?Hf>s#{e;TUQ(|iL>z6Ot z+6`>Pr3F!~d?Yf@SWvplARn{M3Ejcf`Fzt!Psy_d5-8nh>BDTFQwT}Z)-ufud9BX1 z<3w4fJfZqMsuBoA!4L0bM6$5)bK@_K&b;Hv{XB$r3xQN)W;q91&4|&nF(p6r404>l zp%n6)GKq_SFoW`er`R>04 z@cCA^*R-j;Q3QKn=A}F_FZbq%gx+s?scT8%C<2gN_>zx;6P0cfdbiRVXxsi4U66$v-Hx$Q2}C6n099<$XRn;UVGhC$R13`MiJ;tkPSk15L? zy{ko!dUETt7vFK%^h=xd+HWdzj{vc=&m2(p+}pwWs&3s2F4krT=PNS(Noj2 zIi3%>Yx{irQw4O6Sx`M93bL~epTQ)<&EpEhn;N0a$sas-m+=k;c%+13wl;}nSZVt( z*8kGGS=)#z=QkQ^(Z}w6fTEa9hFmVS=7`tifFV^PR240L9RcWZ2h_Szl(pX=}y-4jhtA z)78%u6{AAa#3QGx^hanIcHsAJ^=>T#(T!c_3a4LlqdR!%l_s7y*3swy~ zrC|_>JvHH?T0;JeJRB+lvx#V4zC7VXKtujuC-!bf50LHN)8wTt>+$VwRQ|!K|37u3 z{^y~F|IzFHpZah``daSx#zcE<6!H5Sl8-IF?dNsZjl75M|4D#MMK5ix&6J1%22N9% zm}pk$kj9l=1GlKdg+{dQbla!=W^%szQjLa7<@BC#Z`@+crkgFLD>MsU;|+SCl0Q!x8bQ2i@EeD0`*wsx6Z#KMV&5R!!*HG;?Gw8&?tI0+fQa@q$_ z+qG+8VZ016QAp=38x4040&&aVM23e%%oeiSXaa;rhMPtCLurbJp;L{Fev~C4s9$es zpuli@L6$Zahg$ei=WWa>qty2WgQsPrEj?x8UznPeRnCxb3rmg-fy6s@9Ti5nt+h(e zrTU{g0o6sj22OC-JV`ZPF-5L@n7&|Kjy}UW#MApruwy~*j~}1xP@x~HB7hLeaK}gO zE1K2AS9T8NP6QNMtG8NLws~A5Yg_00=jyi@nM~AMRLa>G`c4G=tQQ1i?iLtt2icRm zGv?o|dYi!b1vK`Sa!Ez{_Gz12uX2J)eJT%mb|zO_kKGH|K4hbLw<2cOMgFlti#@O0 z43ns9Ny~y8`iL>dnBWq!@uZO zLjZu~Zasd3a9l*#leXuZT@`xFzPgD8mk(27$? zF|NL~?}_F-VetXZc*NoS3iwkc4_HcEc9f2P00S$VxtZ1 z2YY&^ACv9tGygsSsCJGx0$*QU&cCvlJ{5E2>2G;NDnDVQpwF@!%J8Z6n=Ga4lMDyn z#*DlekzLw6gUqQ4)e&)zzGf|1veErevx$ufq*j?Z6D4#E$3!#bzi&hpP2D?;PLYI4 z3MS5OHh?exIOMA*%easI-d!Qesg$aO4q+c**2lQT0mpVA5 z$PTvA0+Sr%;Cl4~=oRmV3abe7N=RK4$#^~*yVZNDsjla#3!+`5%LXWpVvLqNPOxz zQUH!pIhJ2s1k+&oF)9{=sxCBbjvyW=FNZO{BX7{U8>8aQeE@Z+16t zt#+C!c}_i7UDa=LYlp7G2-Om&mrVTRwW1LoSE-v&YI7;|CH~E%3bD3yMQVMr0r<$Q zi!#LyYNrp)h_Ft;a#5I{j2AI>GD4T^ljyNP0{h6tj&SVRlO)H|scH3IhpElLAESR{ zq-8Vp8bNvF-+snWpb@fyA_cVYhIpe|)vpC_sw+c4QbS%rwx};e z&6zRE($>}xva4iIR=?sU2S4V4M$8^?@J3&pe0*jdds?4Hk4KSRa{uUEz!&PO90rG? z2dxWzL(DFf_?mmwuBWmSo6d)jvNL%iF^f~weq#V2r8Ef)?*;Ysy@*A0fT*1yXC^3i zvO8J5y%t6}XZn6)!yBdVaf{RS8ru5cd;g>E^v23)5aj-4UE|vz<8N;Qfax=Z6K>4g zX7~Co{#i5S#z_|Z{uPLFk(+*DF_|Y1aRKpmjMB4wSHgma8yMN_Juh{;8~@?sx}2mP zSt_j#8t)N7XkaNu!yc75;u<2^GXta%?BYgBRnnsT4@LIf6nRKn!>_KJkG!Ev0lA#w zhOs`%<%#gb4sFf`U3|U*)xpUriQzrN%F0Q+Axo-2YD`}G>-D^v4Uy_H2}Zkawbysh z{Li)>Kg>RI+1chG=_F}oIg<0ioX!sl=y_wB?N?H~P{(YvGdZJY%+6^c&idgXZ9X(j zCvO?RUr!b}hF>>8zlhxpj5KQ$bT$v#x@2at#2w6n?jq2AO~p666gzW;Hl8XO@V>|h z1&@pWND4{SJ|FpG!RdU&Nm)4?W-yhqy4jtEXbEpxhe$P7wPhU!o(`#V*l5%w!NBaI z$vmS{PDYE_MsS?w{ZV^=P}b%7rahpJFEsxoX!z!@ZzHF>vZ$0?b4)vVDG9&VKTbzPnyYV z1?h-C+v7GbWz{EVx$1N;Xtcv3+;(e470SB}3RlLvoS2OFSn5|u^*v^;m}Ik5B0CNF z#^3m>-$ls7?Y6EL%*~!$lxP0xPR9Fmas^EE&J*Pk2Z!7oilOskchJvRnJnCfJbmsk zP2GP~F+1EIek?kdz9ESGbeq`r479s+5n zhZBb?yjB`q*7nt$gP^d^wVX%GQ&FsOa$%{}k3wH)@roqq^!G4k6lvU$65K`YDz?v`T zJeK+3$JAF|B-X6|NEBzl?Alskd1jNUF}6Uy@fbo5{XpLE)|()HFNO6h`XThhQ)p^K zBQq$ha^9Ff@eb|BTfOh5@>xtxC1m<@GRQ4b`OWxz`Calo;K|bCy4UvrGA$$!{QRLn zHY5-?EzexIeQh%>?`Xf~6$L3A{jt?Jf9LD#W6z#%;5$RvRklC-Ejh!_mVOMK2O0f= z4TQ7mEPA^imPACk5CZRhA4KehKlh7;Tsh~4ZA3!QT2bWA^)8Dr{@DFIgU zxf2XOP2ZY5(*fr?GGI2ikig8Y-B}N>%rK#^{j)~(Qk`kJPQRoJIMaFsZSHQHy2X5xa7UnOTx`)6@hl`3<{e4zP}-8-gF4} zVUOa>@u%WP+xAG+^w&S@sJVEH>g3klVV{-BxOjvu;4IqfEC2A+sj=o8vuX5ag=5V< z-=81Dn?~%6Ev~PgdP+IPp2?W2sS(xSjCkDzw=E(+gG!%`t6-uCcwDv*F1rnFjfDKv25Nf%#aQv{iurxYX825z#JtT7*{w#O zDqU55?X`FKGelq#b)Q`L+sb#XnVQYYZ)1n={@?q?LZWYpnqM_bvp4KB2H}AqwcU_9zAlN-{&*CxD;7=ay@7arp z%l*^{{|&F=q>ChvBcXxzL{qG(Lr>qs9+j?kLuT#m?ph0ye@zv?m)+zX^JP|l1ORX^ zjh~DUd=j$!>*7#xD?m?qTKh2E#9*(`#%%kgiIxJb!^y>T%DNZqk@FRZb$a@`#K3kS zcvKZe0|5Bv(2w1oT}s$KTOY5${wx9j==0C^Hz}B#>2ZQ{0CtH3Ck><+|Eca z6bzn!OWpzCB=DgaMDB1u9bi^|T4r1%saZlIg`aq#`$)r0s_otb>?V82JKbeJdI<*0 zedMev9oqS)`5<6Jay!%{?}xuh0O%nFV`HxI-zxyufY^bXJHs;LKfX}_bE>^)w9Y~qgMtNq!oeWWihQ#ybBcP`j7 zEI(V{RhF1R~FWoOywg3#6ZD$GUjbd-U^^Da&R(9zY zexLQuM+&!$pVO|@D~qCI-kU0GT{aGHZ*KC5EZ^1V8y0FQDPcPFOh-8JF6s5Vy}gZ3rmaNWA>r8F9jmsx0b8Q{_YlO= z`KguzI~NMOQh_0Nv!p*&IO<@2dUe$At<#*HbE!H4yxL^9_BJM~z4o6!<Bdv8zg0 zPejpt$mauz^AG-w_ydfhrL{4I;s33>?~ZD6+x89EHy|n-+#tnDRGLbW4#HM9(m_HE zMX7;=4$=`RDgthiCS9cWl7xfu_k@CY~uGT}wAQnWz0!to*m6$Mu(?>?20*c4J@^ilRpz zn--l)rrEu=+t@wvvQ%C4gs)-MKS(v+P*;T#z94tdaSKu7dz+9LZj=AO#`G$G&kHM| zjMEa#g!;b|`D408v6-^^rJ`Dz+}Q+w7QAnazjpum1+4J3A9y}UXvouNls6SHT+-7RL+U1U%&UMay=(V4;GVw*3S;Yzc4OA)4cTLCJw7SgOs1Gn5KEVP7U^(h9}f#)*lW^q)Zw^DjxKx;rI%6?254P`o;)(mM=_RHSLSI@w~i)jnX|lGP&_r&1VOTCc4Q zveeOg3lja(L7PV8(GF~(q>A5Xc0j%r>chmsrrV?NN?YSO#|7ly#R{pE>0~OGYFcWh zt}A%VKIP?$j@Sv4&u{jKBWzU*=|k_X-mg9*q^B#SnC-kde8h`5k!e~844)Bpl108Q z6_$Fl#HjRlCJ^?yBohCdb19+14=e9SU_S_f@WnuyO#U}mh6s3oG2kc{G+M@Ciwc$H zucxM@=r{OKZooHusN;oE9bcJ~csTOow=ZcS=}Sd7gQ#fo&}jG);>{q!gO-4>t-c+a8yh$G~lZinOefyMvpk2HIq&V+_szg}40_whVq;WC&rgnkS-7c<*!Mj@p z&r*kr@a@h+F$y|whUYZP-15SuG~3L!xqJUa&RnpiXth$4lQ5ApMLjS0gg!?);W^I% zx*5P+^M}i#p7QQXc&Kt!7Q@cofodx4~e$GW*%{-Xlz2Z_^#6;2oa9 z1RbH%L5-PtGBHKd{qAUoVX0rcsl3KH?Kz0S*G^#7#SFDW#8@sXR$6Au&!)uAekeIA z?eSJAGhXT@`@vT0?CyPwa2fwWfAEB-ms+V1ul_?KF|A4LI(@ffoON7`7fNZs0=^A? zMR_f}fS!j-4HGY09lXWX$JT81fTccl=T#V_>FlgRuLlw1ylJiii?VEjQ5Zs}mtKtw z%o7-cBKQ<&!*`t;{tN130j>psdz%TOzm)Ux8cyI=J2lV`AE;@sB;TiI%4{sq--tS< zq9BkyMJ3L@3BMX;dWO~0P1f~5F#|{OZu?f*#s}`(1q3muy}7T*!h;$MR{flI(>}{Q zUNb?pOOrX2;npWdHq=Yym-(~2`-+Yk-e_bORI>C^jaOM@FNAe*+WIRG=pKP6lpPy1 zJ$rfYsBM|s@=`6X=1;_oC$Qz>LC2<`9LA;ZId2p)=q@ieVIoKS{{KKStR5~>@!HA< zhZg7hs<@nghV1p&l57R8hWvINr_(hy@8??0k#@_jWr!Mk$lDAFS1B2G^;Ul2fGw`X z7vl+)90(V$Ut?TGf9J5f9SKabn5qikT-1f#Pvdtm8bRs&x>1{_ooUMh&7D7}mH8;u z{YQ0Wl~QqIQoxN&ZQvyQF-N|Zd0ZGbQXoBp`Yq+3;btv?pW@TzZ0?g@x!aES$RAmB zd^Bil0qv{BB^;BbI|{p{?9%_3dy&ME6vg`|@MY4Ogy-a#^8j!SA#62iD(F?S)f&&RI<_$BV7WE$4xe3hWj_C#a1*ZNa?rN)gI z;JN;5JTASKcwM&V%jR=rW`}=>S7O9m!b3#y(f}s5Fu~MOMxcJrXE0Y|?|M1VI#Qp) zjx7GTc-5zBG2=v6?VQHDG>bYYyhG!Wy8+^(w=S$H-Xg@T!!5zi-RcOGLhVGkC=1xx z)S>T?$ilOQ=J+?FQVYJGx`pN=H9v|62U_N$$a8AJ$2Bq*fi&FxNa4)&2HhfdiW zs8gm64oY_L=Rv1X627UmGa8KZjmB^DWC~$(lExX9nJw}u5q5QUL`Jo}7eA1opQHJ* zny!gF=PLU44n3Q0!PAb@$(xxm)*-AMD`yY{?)-+Oj&uZGT@yL8>-~J~!^-+>>2@M= zPv`xpY*+iMgNq;H$tDHWjFR1C=hL=n*Yf6YJ|x9)dPB6u$b_cmsVqa|J1udakyG$< zK6y($IfJ|RNKk+ITd4)k5{q{3lQTW;ye`q7{cGEKy3z+}cs8N3D0Z`IQJT~OByT+$6Vu>(|af%(-cjYA*a} zqpflDbxi}Hsi{0H=qq*M?5A3ijoX!mh5E_m$mRLkr5=yk2vCJyXMg7Kpcc`}6X4sA zVDJE0(uX;odLsLolDl=JHF_crK1x#fM+7TxyiI`mu-`u55b;-K->8qc>gjYF9{4N| z>LFwFp3!(G$IV%O#JWjDM?JlLfA@QK9quhdeloM;8@2LnTvR+w267CZA<6?yYkiiOR#Okny?x?}&il4_rxa{TnXkcV1ykvrtL2pSZrS>r zFM+3qlz(o^GWfiIBFOzxmN=aL6 zWomb}jBhgD5jXYfR@dw#ads7AQVvRO*LVfZCmf#BtlJ{wW&RoTlpgZ6glh6>D*z+b zM&Sm2n;4JdPJBo3$E$3g8*sRx`Kj`hA1}BekVU^x3^W1_jq2&F3}{=*aA|;=V&Iu8 zJW%WDXGv$8$Kz*9kf{Nu9Fi*MXUlHv`Oq{@FnEi*hqiD--(#nK`gmiHSH%7AFdJ)| zN-Lh1yB2QB(0Qc0`b;6mR#6JAOd6i9-Qw5e|0D9X1JAnZ3g;ckHSOi=H=Jn8+nsemg(Dsrab4zDJmx7^FEHNHE+fPbNP5tg_YVw z{A|h2fdwaNg*rHr&$)2=cM<%&28sm4a_MMa^wezZ8T^}RJc6Rlh3M^HJGipmuY~xT zhem9CU_`R&eQUUGJXJ zEqYjtG8}ZRzem}lYkFyC1|`V*{DCBQ>t@_g2i``O6{xU4w}UkF0BYS`0eP?A1XO}8 z(v^eEk^s85O{N>DW(eS4VGf>zAYe&38!;qtm=IM&a!>k}aEPS-j`)_W60rqch!QsrI ze+-c;VHT|YSKbH}rqIeIfpGLT!P5CsuferF&9qU?1~Kf|q0u}F!ecnNA_G<(PsHa{ zCh`f^86Yz*-aY^coqGZiaQDE)AijJl-}kwb8H=J(1@KJ29o2(p(TdFP=N4K9=!Bqf9YB+`)N!+<9nb#PvFS z34^W*BH)N2`&vN2IKW<8{liLzyR^Jwk&Jc<@G?U$4bMPGd(f4C8Z4J_2tIJ9IZ6b3 z%2)HF2IIJE@CtiOQh=|0V8Iry??&q;zt&p1LmiSR%_tQrRxh_K-rR|c_Ud$Y@}%r6 zC6K%0;ek+p;FEBm?>jsGCf86KV%z%Y%ctZuWi?%$A^|Qg!~@(rk3GdgmG}|cTSPCA zA0nD7czBUT)+Q4utw-pYb$ztC4jDs*^>jGa1-`u#Rh>n8$u7oO{c3f_XL+ji$@a8~ zfW}#qlaY^qBqPQS{Km;epLwy{{#kFrbkDxyHqG5LJ&K6aww8YlxCgxpq$#7f zOog5&u2<{SQ1x&UbtEru;bmdQd-z>#*HjmV(dO-Dq48UGsiJ-Mi&Hg(`e2jNNpfIT z56bvqF>v}Go*5cle9AXgapBD8=j@yiNX4)Ir?VK;@Fs*uV2qh0H8TDR+R4iVJ?yG? zrpzKI^6pJLv0U=ECz=^Y#W>OAL{Q@I1EXTUE7RgGHLX%A&*CCHSLoSlA0>CvW^iXd zh96%V7!-5(s*Oz=%~1B0RT5K3qjz7ncTFVjW|visZ+d@(3oBV%cMTy0Xk=i-IN7U@ zH+}W&|0a5Ar(`Uo!Ad*R6TL+Kb+fcVyvLz%%(9YVNQ&!u6n&MgO9VFr8_Y!t7>ZQ) zxyXC%QSvn7cOP1^K_Ks6ElzVU26L*KnxIPcvGvFN$S|}p+ZQ@%+>kshEw)FlS$Cyp z`|EY~UhRy}Zn!k_skU=nxhw9%s>uMwM(-NQMg?nbY0L@>F5wvz4{t3()zTjZ)TeFL z&U*nXZM&}P%J?p|%I+!)A*FJUcTizX(rE1+(s{BM{xe6f!9Xw51-V$&)8qfSp1b(3 z<}PbV$g4u_A|v|vYiRF6xsJV!DQawUSBh5vctqBJZ0w$U;PC*nqC5IYpa9c-yG#6Q_RGOcD0GJ?;s{in4RKTNAo%5lwu?$4?7FVH1Kq`M`bVvFHP`xa}UU?Rhv1*W2%dad!{lOKdu z|BamrC_wliqFha!ePzu*sczVOU(C}-d(`Hl2q%N5>*QGcTV3T6gUrXWdxTW4;+|d@ zkN~wQ+>cwO-b@>mhl}%L@^uxSzoo=2B zmfnd1QOJc%_uaSHG0Rq&-@m1YoF3n~@Zmx9cpK71$h`15*sjOhfZ9)dHgU*NPQN(q z<)$IzIry&@5>eQ%{X5R%<{}UEP{^W@=r5mk#W(XORa$;>P*YtQ9hk8{*NOCvq_Mu{ zYAd2t&baI{S6^+QX}3q@<33UBPEN95uehP@&WhBATZh+qV&2_YtH4xwce?!`8p3&U zaQTKJsTt#Iqx^X;{RC9b8#p# z0N?F5@}{gOZ?e%+DY%`#Wn`jsROn*jr=dK3X~j2(W@Iw6t4;d^V*-Vlk0c>t=eU>9 zfU&}zDr^3_uNJaz4pDwTDLrqc>=X{ROK600na?^}K63T=fC_-0si^n=Ch(QxgjyQ`# z8C{QM8L&MnAMHB{^&Kx5W-o_1yS~v2h)smL=EqU>xo(yk6-SK}obgSQD*bZdmJUiK zarN70_0rkSK7%zg!mP~0HcxrxehCu85UaZ7LzAwFlYWW$o?ZKyHBjZCsAgn9KM3PJ z{MXo>h7Z`dy4YFjdzP-Cy#t&0;7DEa?1Isq{Uo>N@$x$YmVPG^6;GN4!%Ci51kcmj?|)i`;{U^nn=%Ef@xDPK1%q_xNxM?-3rdq6k-dsEt$s|v z7WKAs!1hvpG$u+YxV9LRpW$ER7yv5scuFZC@9;J;Cr-KE5eeA9ZTm3}y&1Qi8K7+4 zpoT(fz!qbm8IRsN60xq6Z_!_RdU%kGtyQa+7@SZ@qho4Xnnex9FkgoodE_|%B2XAO zK@kFAc&T+n0-`8U0sww%z@Iv4mkEHlryijY{Nqu-jFM85BN7)YAVRRWw+CZb?9aJP z1X%IuQp%^_K|ygNHBURwhGlY^CFr7Z;B{Fh?E~)&`XuL441sT6}`zCU&xf;0^ zY*8XZPpd?((W_06Yjp_XEDe(?Ls!Hi*W_BjH>*j=_>d8vV(ncd2D#?CsaDhJ7ln+c z{f;8c27;FT`W~P=>FMB`<_<(W&6Fs-PzU;0SjA}fEH^mCk6RNj>WacrXD-Dft&`rILpT<>`I518DjiJad8#L z{*!;u$yy^c+V;(*YkY#AqYr=fic#c;H%{cUZ+^)Vp-I~vsbHx$prE=iU4Y}KT-&vj zVOM@|QK!qYdgtBqTl@2fxZMyzjI27Z+HmDdq|(B@5{~c=w_7K$B>a09)O}*PEq(hBl z=@+G+dXsAmbd?_Z+yGOW2lcQQ!xvi1)I^u6yVJRvW@n)g{m*=|uPo(osS?KgEdn1MFDCqT@NeY2Zi z?!7Ht0J_8wR4IMiD9ZjBZ%G(3H)ZbY_H7)s(hW7|JIc(Z|sMVw;ScEwS&D8_z z-L-sth{EBQ93APkEPP!?qFx(D8hXLj_tIg8snnzYiiSAkH*S!|C@ry9aE>7^CGftzS_K#*bHZ$?5nb*h@y+ns%z8adW% zS%D!5OO23@qj$E?y=BIHte&X3X55mAs~LV zeclHNmytSRoYy5n?0K{UPQ!vECrv2-%6>rP->W6gffS^D4FskQ)C}nN?^GC2Gyjna zn|)6ck3KAcxW=5=ko8dEpgojnpO-Ofj=po4AL~D05n=M}?RLvWMU{;gW1Y--iTu}9 f6A4_|*gFtVEYa_L#aIaR4bix*^J|%!b=dy`>Grnj literal 10131 zcmch7dpy(a|Npw{?x<7}a#%-}LI^qE5$euiij-q0syPochv^^^ahH{f(Q=nc$St;+ zSrN;GTMol!4l~1S%N%BA_IvBTAD{dC{XKra&++^C{;|id_jP)|uEYEJdR@=wl@4`w z*t~JqMi2kQL{EUMQsH{zG0(e*xeB9|c2vm{1 zY03Xb;CVyD$qR50XiLM&Zxto{)g=%}3v%kjakn^M-at#XPd8?KdO2LUu8aIJ<-S&? z0p$6sU**1T4}i)kpRmzRH-EO@Oy{`Y9y^m!>PXKA=R>6t9S@&I2lPkxrBAFePf2Te zxt)Fw+4oa9k%q#ML>D9$RCkV>PO{Zky{-$A$XG?K`P|ab1tMUJ<2JzdUv{Hcfp#B< ztOosb6S@|3eGOI)u+l~a1lpcr00Qk_e;EWix%K~Bk)l9NOYnyU?h8RzD$Z}=&Rt0^ z_SFl5=|!8g?#QP1mHU0E1jkZEy$9=lHfPYa%l%6bky=H_^5#rGTI4k*PF(S#j)ONw zTFN+ULErFZH=qS6p6|(q7yOQ)^YB(pP~V445k2pt^-uZN{UP!%>QzA3-z#ijpBge= z<>jJ<&byM=-$PpM)3zTap+q-SDo_Vt6FXQ(wriD(%xK3l``YFx+>-Lpqetm5!CHxb zFa1q>$D!V~#V-A6x9&yf$fTS?-Vk_A%^)l?Nirwus&x`2ILm6!%C756YIaHpt3dfl z6jiF1xqoryTeGssxl#-!UUFW}f(V4^~uDTgh$ZwBp_r>Id|eOk5OzImlx z$1DtSX>wDbI1O+1!yPwK4{?9*{9Io#z0wy)>tbR`iy|la-}dkA#42o9&i z*G0PdJ=S9BNf*V@Cz-RjQ>x;K3cDphHpMuR1mA#J{Utq6p54saAjyfC3M-dCSasjM z{m4eG#$2m9qgq4HE9FII0jQ(%wutxy|A@A_v4vA#vQG^n%gAYq3Hi)m=6th}3o2x$ zj&YjQ2Wz($ z;F1<=XUKoHv`PbZm@xVWEFY+>02RYw3#BG=SPt}4U5fB9$wBqa6N` zIl{Bh@`!00N8WZ}jJOzX0OIaP8}5HFQ*ciEH%ASHK$YuN3RIP!8y_|Yd%pf)AeIBc zw9tm=yN7bx-=B%REK~vYI75OViXNJUS6_@!M-4%5G0--scA2A9=l52i^XAxmtef|f z#Fr0OT7llh+L+qD#v6zo53RIXb&;16mAcZ^lXEMrR)6SMKMV2OLd?tahaVy4a$7st z1Mdh)`f6QzV5dYfFQUSt?>HWB8COp6)-H2yNkr+S2$+fc2%!eyDdqgsZ{NDRsuc=6 z!j-H)(uZfds?Qpfx_OtvQ8PBZy}eh0xpR3F($txc;&)ZkHoagJX~Z;9n&!`1$7%2n zpnI;pUX=%?>RGyeK}iD~6{)22mU!jrG#KTjDpl^q$mIJ>C~6iM>NTgc_Cb0P;i)9> zj*m+@h_UN>ywzQywu%Lok;NQeb3EzQ8kc$dh1|RCf)Gt!30I#2TZN=dB)BSji2= zi3pir@h)(snqFT4&Lb7!t(uQZpw-;#*QO#+ol_>#I&U+b(5Gj5&8WFjky1 zL^PilV+C0KzQdex?#B@E`lc%oB|il2p`X&Q=U_U2fL)4n$I?lGmU?Kd>>E>*iv>V^ zxt}P}5Nk-l0-@M8PME&609CfIC~2%cpD4Xl5eua61r){)_6V_zPgAoMm~T9dLBs9T z25Adz4s{vgQtkBI-1;@%Ovg~2ngdZ!4HfA|C3vf}Vt(P-&*no5^7Wb`lN^PKHptg1 zo7viqx$^rr#JeupBuQ=7bM9WW@>nx7 zXFeBCJqbauqPJ3Wl1c(gD0?)|rq1pT)3UcgUX!(_+7PV%6u<(Q+=D8;XU51}{bu%`m(z>%81u97H%X+qCPwlMRdc8XLF9g%% zXL{fAS`sk3Pt#3QC-J)#? z@G?Hv|8o=VHI%Pm7&pi?J+snxbY@yqqOtgOF4cF7DB~n*vbnjEdKTEp_Sb?#kD^&G z+h*!XtVIqcMRXEElVn>J9Y)ivT2i8jrK%0DgYV`^sl*1UbSzc4o7yt7f&HRbZZPZ@ z{&HD-|F!G~)uwgRwOw;(14n6j?E_@O0Vntp$&b(Czm;ltuTh}r&* zd-&I)z_#CSt&^{Rc*vvv#p&G4=Ae;aGgLKaT5QtvxRx{7U9w4vicka04A{>gCE!p$ zBJUJVEc6vnIN;skBL0BaxabyZH`;KA?CPed_n(95Kz?$`VwEo>_$1_)lFPQ@;fAzf zCaJw1V=nr#!D&g{RA~4?d&A`{M@SA(d|`ii&`7(=#fK>d4w~rZ?%%NacWW-pbU2u3 z%|sf3U0RPXEaY6Xx;i#i8c~U%cdIeBtV<`va63mCbxHW&6Bj4^9JJ;vORs^>or1tG z**x*aL_?AnhP86UubyVV)ZErFaAkS)oDnHbS94qI?Zy!L% zKBpKE%*4>;xFd!)O^cv)F_p^&VW_8!y3c#udi)28c_7ilsDUkN37z3iJjMogjAtI8Hp_$L-YiJ)^6 za;ZZ0J0d~FnBJ#z?tB{C%0l8F9C&C-y{A0ZxW1_=BK9sx!!9xV-n*P*&BM%dy}kXL z=I9NMHe$SuxZzu#U+q`<(T}yljO0z={n<|PAG9$AP}D?vz}V$8ip_K-`AOOyHE+hw z7MSoe)&kOR5Onq-@d)Sh@4S0hN=L3UK( zr-88+qCZ>`aAk|mYNEyXZf}O}NP_uV(Wpf(LJLt!htnj^<<R;}Gbqf#+8Ruii>m;ft@^9iB9(R-DUM!aySigTxvz_P4%-sx=VdNA;H~O&StBmQ8DWnxjm2QmKh`NbmG~L^Tg*5{ja1v^ zUxHAs?n8D!mm^{!BH1r~M%lZlt!k#|WJF!o(6y0$JKYa^+_y;F&sq{}=bV)Lpk1nm z2Jg^cVs!4Y5T97@V(pPAl?M18u0#EH-W*8VSGbS_P?gv2M?}vF3RN%o>f=ZRnm$tM zi>M(O^am>IbKzB42rdGs0KYKs0-)S`(R|eMhUQ$8>X@ zbe{fA*rMlR7v-Hn-?;~^1@D5^O_$K(_o#6m&g9mwO9Q74VhT}V;wnF>DY9S~^!Dqb z4Z*$Z+uWu-`G;_#Aou0HC!+MjG;zYcz|4r{T2HTjrNXu0a#pCsUm0do}jgJf_)^0L_Y0gDzH>S}{D zaM;Y2M_J0T7oCOWdFCwxp>`12V#6phb@jWSi+7_l25WuewNsP^wZ|A!*1szSBHmmy z#}YrOvzr5VG(Zbt9K_S8u7E2>Sc_T~od9D<%qD9K;0~rqb$!$Y=c!}WZSe#6$bA-) zsY>>z^4vcsV1{X(=Fz{EZylzOlq>36{&|6&kPhF!_Ts}HFm<|bwAfcW!IYsFz@`{C6$(zWN51njLvvYAZ###$lo#JzoUV8T&H6~x-#}+#Sj=kvz}TeP z1XLrx$f}It%QPxjI!?k5eu;6$;095|{L7d)2rZJ4J?gewelI~(e&^5+ri#tCe$v>) zcH4o_`s1UV5W^R`VKM7vQ#K28Lr+FMP}4#9-Dcm&d zDK)5>zgE%XqrA)N2Yq~t*Se6ZQi-y?dd=KoV~2y@^J}HZ?B?p_Mb=WU-TS9d-L6&M z&XJCjSrIeqKlxUaT847)7}DM_2OCrE^5Pkddj`+*=8RubXwA2vR#{NpF&CM^+?~eR z+MTGm;!hR(fQ5l=x!m@fds5uRZf7%eo-*IrB(vpUJzfG}ysV z1X8|V{cXRc!?i-{q2XXMek*E@Xq}qjh-F-V%?Fm%VLra}Xl3hQkm6~w&M5IVR z!&h1UIX-{yO_n2Ny5rWdw&KF&m}_SSJKq3H`lq`&l@?|2Aiij9$Hwpmzqy5>La61{)(m$e~~L89n_!DN%B`lkkh z(c+y()-LKaNABIvHc$2`P)D!zK~W3ehQC&XJjz>`xn~{xH>+Dx4M0d>1br($cz}rD zdi;{M@Fc5{hfG{vC5#m?NfC3C-HYAL+o>vxi`?>-^LJ$LFFWcgSa(iWT4uMC^_xa5 zr)dl8HSXu%k0Vs#zYQJ7N3nm#M^8M^?{i#oq_i7@-rj|_{oY;T(LhQN zO#&k!A_R{r`&h?(9=AW@qx$gcHO#Q!3gahPFYJ!b4 zM4khU`&cKtltw)tCV+rbGU$y7yx6RXx=4X{t5J*~PKg7yhYM@QYTFOSq8}e)&^LP7 z?V*svrlOZWLe|dOZ~J{ZY{uTGd#vFdt~=2u9q}u%d>Fq0F!SIxs>n8uTe_8R@yfRe zS_e%NVz`afZW~_M5)ewbrFe5UlRG8rOY03a=x;r4Fc@~u*72@j`kGJ`!rU}T^s23! zZxW+3P@V@9_|h^(rtC-A>B^*5%&7F;*_22Lf*{8RzU(4COGWxhLv7va|LViO&y(3d z^h)6{6hup)n_DiyGK>xZ=ekRoU~AKtM|M&NlAasfVO1Ysa?lsdG^rF_&2~)@UoIER zK&k~M2Mg8UB0QcSYhait;o*kaxqbzANAWvxIyMjhO@N>sa&2Mp_SQDVkBMdL$GC{e zIrM#KSW)E`_QHZqc+Ie9dCc>ea}XD13HaUgV`jpa4eZy~!*Q*s!p@Ms#}I)WE!+Kl z=ZSFXxLw|d0jTaWj-bG+*t9cJwk-X&G}Df|uSU*-Wo)Mc&MgzFi<*g_c)is(vE(rv zzWft_=EQBDC`kFUKM4By$u29(pA8U+`wM={OL#(%QHy{83ggTPpZOk zfUaX%P4~V{RklA;Ap5350hDR7HMPoH>N32@$u5}0uVsY=8+GK7=l}APu-^K$VIvh0m7p5S#)qTutRxAmQz+KP_L;}-hgR}6c zh$W~Fw;Js%Ul++Fmd#7S*-%|sgzw&{5{mxap9++yF>c&T=KvP@`|JV! zmz9A42Y_=s71)8Qe9cO;mG=W+v|VA88m#)CBx_dC10nF0ZWKlUX9;2D=I=l;JM{6^ z3g!v0p8%fSQaRp(!b zv5CW!J++Y~DE*P4fLgu#);am4;=X?$D~5$-rF3{xKhc&$hh zA;Gdww%hw~R-tclt=a+2Eu!lBbFQDK%T>)W$w%(4BDt=KuBF$yI#r2}OobZxd5ow} z@L|WoR<_B{f8(Fz-{k%kfxFw}{NzNrYW=k3bLexEwGmpswU~GCPK`v)Rj<%U2Upi_ z6bNf`OeQd*$lnqjKaGd-_Y2Z6do$_emdlWE^fvVvaQnE!+|V)QW68^jabr({A1M5Z z9G%#uXLp7<1zU!jwQS-R2_syA(oDegTux&@kT$uSG?|n}J?6yd(4mCDBB4C5O_toKqlT&q7&>F~(1R5C2)6o&6J zMXA$veqTlvpm=QV>)AcE3+MDXL9!cl$`xnX{e&WO#Rm2CQ1{(_x>*7XvktxqH%rJ8 zziRwFN`D*piL!l|cZpzcyBu5lH{ATZMeN7=Fa~~GLDGC*)CjEwkcZxWje}5va|+{M zPq8D&C!ZA;Q& z=hEe8zG81-KD4YF!T+h@2PR6wi+c3k=KE0H$%W$f+YzNG6`zEv^IToI&EOAV&BLZoM}8e%v*IaFL4vPb23D+kILx2~AU^*GVhkWk!LC365W)16@0Oo7RJW#s z-f08Gw_ma}MrFtJcXaw&)bp>)ZvPY%{dXZx?KH%%Ci*p|X)jDB9h42!p*R?XJ*`f{ zC&uyyfh-5w%Hb}SCuFx2!3Gm&oQU&$qQFYn-;gFxuaYff%anZ*fVhoVO(t8{%+JyM za4?TDZxtWOWJ!5{Rf$J=!RP*5KU80tbXi0O`$$GI^!lr;mxkqwV1>!cNZ>X7RUK6l zkpKr1kVH%ym`q$KGp(8L3og`oKkp}-^W*h{Web#!sss_g3YNUsS!hq=GfDI^l5AO0 z1Viu{S7~K_WYk_*vV=a^U!`gimRTm9D^CukEiZAbv&+;qG^%0X#BU$R`-=-v{bf?N zUNUmDijE7%!N916;qm@bFI<0Bw$+P1Al|$+`e!-SfJn zv;5SwdS`N}50L5~c-!dL33Mj-5qPs@K#0yV^XuEjL3k68<-U?N1#~MQ04Y)&P^iHK z3h9)d0EMHl3dN?LfI#5i5-`sgTDg;cB}B*Ay>h1)4EXm1o_}?(H$Pv-Gu*R*D_B;9)$)Lmfl-fDvr7IrWx^Z^r|enY-LZ zq^RHg(@X=7B=K63d&(-#KF{yZL7;xX>ZC&kKK||A3kD&atz9SFvUV~4c zOch2SX?pT$=(B0dkoOUEF%wr1l%|O;4(eg;XpL!1s_~=coo?}yxIx;9^Y;t=@?(`i z*C~vjHAq)RN;b2@?isn#2$lUQe#F7u_&i#tzjxYVmuZ@7KQOc@3DzRLyZMDNrHgaL zmS7q@`S?bg&-mmHL;f1QNS<`&a0HLXogkZ#V5>lJnE(%f0QBLq&^=W>1?B0D$04{q zmPYRDHCMk6HZxA3>96m%hchdZ;^_)6%V15Wj|lTj{S5Df5w+I#^ML&C<~-k#al>s# zF-!Og>y6<+D*DLPA0@PSS`ENZ@@HSZG#!J`nASlzU@rN#K!e#*OEi7G^BT@bwy)e# zN&BYZ4&G^t_=+nK9POyVEkWoLm>^APknJ12jB1rU`2l1R1dt(^cU%{RnA^UWn&!r& zYdh_^pH1mJDJxLT*@u3<*Vz293bj>SZ1djKMN;Xt+%LhZA)df_ugQMEetgE+krH(@ zvtbxnLr+84DVYYvCjcVW<4X{STSHTJqi3)TZuj~ZKxxp9blYiT0Y`j=G zx7ZplX?-WUb?@Cw-UMssQ{XayF)G4J?PWEl3ed{3OwjVWsXX4mJL146fyDrH4FBuM zq@$DE2n^TI5MiEZ<*h`W8)VyPm$iLBV*!Cx69&$g_foZ%O8|eO*$~u0J^b^w;-Qh) zUfnk)%Q5iDo`}qm)^``$!lvKU-0~)6RaoGQ)QX6>WS%gr_i$isLI~;J8KAqbiKx=M zLkl!OG!FbN^e{Sk7WH^(U2-0NIdogUUurqZjR)tn>Tv^E+)DL+K!(BGc(Rf0t0r$l z$Q&PQo7v<~whVe#n$GftcyK1kG?iU|Day8{sbLDG`geh#Fz#)@_OF52zHYASMa0DJ zq{6~TR75b@7DcS%x};)jgQ5sQv$QkcX1P(j>+Q+ zU#zU64!Y%HDEQ&4;tjpW8P1t0!meeEltI7*CeNx|##)>O zn$^$BKKK}R8-C^uu>2wIarT6G^+Knx`Fq(HKhYXQ$GrYnpW6aRd%QhCwRHd7Ql`F&fu4i8WHo#)>-NCMX+d`K#Z3&Ns zx=}>{yQ)9^xXsgob^$fD*ZKRGM194xDD-w#Z3Fm+mze`WqoZvnCe zq)3w*AcP130)!;e36SK4eeQX0pK-@{f4ukZedmvim1M0o=Qrp2ef|5^8#5Cp!~xn2n9SgN^Oz^^+%9|4hK=zOxQT0w3$$V=EsJTxR_^=6TonE*o2A^63NT zfr{MN*uup0@85kA;zY)UH9J~HP$PguXzd{BU~B`UMqU;n zK9TbB^(Jlml?s<$Sm8DgtJK!^jd=S7o3C{ta8=^Ij`-h?RZ@yh9;v%>=Dw`GfwbML z`STZ!>g#ss98Kw!Se-s6sw01S@E}pGGsiVSZPCt~5ML~n9Jc&N9=#$1+REJ!aT?3J6>n~QY!Y? z$y#%<=uI&73b1NSol04-%kI;W%zk1B%1_gLi`CF5#>y`%`N^-=t=|G!118B+?H940 zmos=F+J1+W$`8Z{#%<_GDA%s9IdZrNeA&Mg7yAPXM81UGxb#AvFV^MA<-_Y%e3qhA zd8?F*vI34)a(hNUqX@Y>Lc6yz{Mif7#o_8yd*r!Z(f*W;bjsJLlQXt6>(WmAEF=5L z<4Zjx`_-Gjt|Z7wiQ{7< z*+m!Jv77U%Zlnu8f)QyPy~7&)lRrzzfzGh}sD?n4x`@i**q4NKxjMFG-LHHa{_{a| z=7VW+jD)~T-;~p_)xWK{Jf5lcw>wL7)d>tteZcuD%~m|GSK*Cc)A2!IY1j%9I7x3@ zxSHKolqdO(ZQ-v-L^TT zmHl8GU|aDafGIqgiOIA&32rOPm*xWVfKA>hjV&A2y7bO3M1E-UX${XaiBiQAU4l<_ zJnM;!>H7BXC&Jqy6x$*%=`6)%=_fB0bK5?;VkxF7kG=Bw)J=iY8M7&t#khwJdnU)PV`K0JPUf08Au*w|h?yvE0V_~pu*{}vY{l{*w~D(A(`vi^0!WQEWMe&8W)_x zx~jd8{+$7?SWt48Km2PK!pXuI~7%Ov{bW+l|>~lKefhdc9FYuvc zwNz5z3;P^IEz9ES+Da6NyZzTOmqViYSqL?|5T#lP0V|-Ta&T8os7od$5+haa!~R1W zy)!tXmBRdh)MwQOU7wdB+UU>q_{TCJTSac)Gyi2ZpWBN$3+{^MJ@=Ry4Ty1XO-a@z zz4*p4txnDMzPlfQ#Ac0L@N zdmgFfvp5o^3Qv#q4!ZZR1)PbC7P$9HCucBQHajvwO-|_JE52+g&W>nWF0G1;IN5;{ zSIwVE&{!o`ue$w>o9*MT+Hj_7`y*&rKcRIjDBBb`Ns2}iF<*rMTt?z=imDOxk4dg8 zz|I?CeB*21u!xnY{TS8Y`kVXJ7ar7iM^{f_dO_B=k|n7PVLg5E@)50z8vVfeS@}cEks8%x&MModN&OaA z`8Y^J*!te%BqOP_zgV2RT$A;xsv-q-R8e25T(rOTY9CWn`cVh0jmXl~wtx8TTYrkT~ z5_BB6P?Vjt`zi$<$R z)JKgD78BH7l;bmuG;(rvy*pYWsCv#X?t*yKM2plkgQxN`K0~KZ$c1f7hc&Zws3=c+ zp-M7LQdQgZfa0fKeovHVJTrY#`w&Q1FfJ$NOzu|jeQd9g+En!vn$;A?+Dzd2Al2mU z&zb0}C(JlllC1L!$DErgZ}WS$5)2_`avfSF?_FnclMm~R=zmtkQ}@99yk)iBsE)MJ zrA=y97FtM_GlSOr9`qN_t5Vxe0qc{W-jky@f?CKtkoPECUbY0)!(|Pz`=5=eekyIb zdosAy0R^r4QzA84?o?{>8CAO@- z`koW6sGLmPXX;E{He#d>#o5u8P)(YHuy#&>HAOz~Pz1ldGRWdSF1AaO|L=tIf3v$c zHTXacyFtNwqy1hGx2Z3qLK$4GT3A0TLsRs9-#BCYNBY_OjjeBM_dBacm-+D*a;>cP zn&H|xfz(m=ckK4JeZIAy^`%Hz=~Prm`_K6;*X1jZlbtkJ}Wiv%+glIh@c5zM6P#}Gq{PZia5=JWhYbR@7 z%f&q)ChCVS3xS(Te1?*dD`#s1R-|h^?A<~gOV^@8V(k<=0!>50QJXQKA{iUF!F>8Czl~;+Wf2_#bD-RKbkL0h@P^h&eyS+@yESO z67;ZVdn#%0sD*mO!jH4c{o#HB!6%KoNKgY^tFJB2A^ziO$Sxlyk7BY@^0{ldbYtui zrP_kh6iu6jO}jRT!Fq0m^ergMUmvYd=nkyLbC*UiMyR` zo)g-aO{Q8U?9s64FIeu9OBD+u!K(p_f)|nuXDdckQskKDAhcGfx0e%@t zyg7X&7$f)jR~g87#zgK(S{;6Y!%=86#n-b}jXY4FJ(!&oSXWw~nZvFHt1>=UXQjRo ziuf@}^nv00XZjdxY5Gkq`a0>(*qC+jw{9dj3A*d)lf3uG~~2xLR8g?px1kwyb_Y z+iacMYTSVK&bK?+Y^9&x{vo|2VweGIZKDtO{+JT+j>Xksl3wt8ZMcf|B1i_wfkDiv zV{Kv6d8f9{^_Zqu_R zw)!;lh!2E#YRi34wN%#T>YzE^;}nzl<+ky<_oK5tZdK36F*Hl$N((ubB!e}v8K^4} z=GSU)gZ1qcpre>O{#t!uY}km5CE z)gmkDgR!};7kqj(s5mF~^JB4x(pe}>^2H+rp!cjF0&l78^fF3gCKD-LmKM_>?e^7K zmRH-Pd-LU^Yk~u+y+L+B{rw2ao?GR-k_6zdQ2O#y6uGc>*|{Y*JR;iJ6TP{1YmzwZ zx?FqH2RXtcmMvV<4n)Ja9A@{VVX$_B&-jHLT}XB%xU-HBxZSe4_m@iRYUp#33>jXo zODq#%2&q%X-nQJ6{n1|hs#s|q;Z?BO>>~~?MQz@X;)Lo?kA)v$qXkeDpYXC4laQNb zQrY7Ye6b|ob1~BqqYFNzKmFh2$w5TgbUYXRG1=C)`H0`EFBw&DaqKUH>hFnylkRHE z;L6c3eYJh}Qq>nyV z>vPB`YWG^cS=yC$+jW-Be0RJOJp0RYleTu+KV!)vVpyM@ z-3!}lf_O@3oREN`X^rvUY*9Kw3nKu1surl01>eqQN?U9*n#-Rn^8`JU^uuT$ke+PV{7$y=05 z8~u3sUSx4@<5B?@Qg7`XQE;$r&Dp`IRBj_&=FuRp>lP!!v(RMuN1ZYJ!g2AW>Z-LN zdLsN)narX;3XB+z=*Qc+`{gTL8 zlK=clCwk3;9@+4YHkCZ6t9R+0o3KE`G`V2o$18)cjtX!Ar%l3BM-!cmqn33MJ2shr z+oA!u4U_<%KUt zhAx9&WeNzNtMb(_Mgs7+W6^`o?>4tBkoZ1C zVJ%tUrv3K@J4yn`4E=g)J#f*m-a>iC4{vfy7_sS3TmSp%nL~V>>`>>L`1JcpX6E9I*q(oZc0VzOC^2?YA-YppEvSFFgvOTxvtZ-dx!NKS6Vqxs$}Py={dGUp;C zc2OAaHW`lE4*!}aXRoYn9;!7#vYMLlfIfY3XhF12UoE#?=CeGT$MWM>tm4734IV)@ zw_e|6E0ScvlI3%LfMm!PSE1Sut#aw3Ye%6FYRcOgp%X7cukqz8pJZ9w=KZp)c*v() z|6KoX|Mq|H>3or>kgg;l7CocaELVdY4P>lDlgOu82Dnnr$_18S{eEaPv)q1`3Cw1B zh?sx5x`*fQ{uht?zxnBsH^KAoBUW5R7;&L9`hym72f282&&W+!aef%j17bmzg&vW& z7!|qc8a!4|8q`CO+!0I~ut#`37S#^jENUW^qed;Q9SaPF0krv4k6SDA-S5R%!|i_z zo!Lmi(D+-;a-oZvdk5@Gyod7XX4LLBjP`kNZ^3%m4nmq*(tM)0k|Z)+?zEkfQKHhy z;9hA(F&urH39?&RfIZi(CQP#xAW24d4Ar_BZ8$0gWSrU(K(7fjF_tWmmhTzz%rAt{o<88=ElfU)f4&(9@gv>v8kK7f@bb8%hTZ-nQfb< z^pVH7+YCgqoOyO+0K{3{5*@lUvp;5ULQ~wD#z&Sn{b}A9^YxDW1kiel=q1$FhXWm- zQ#{84^XP(G+x5+sa)k1H9!sLm!7p9j;`-(VnU%&tpgay z-{DizUYo2aU{KbvTf?*tEO?R;#^PGkiDid;n_T^OI#N$22CPD%%OSOU|8!O!J7HrZmlsMJ7Ag!a@7!% zole`vpfBWlI+T`2?XoauIJlPSS;Ef2^RaSan~Fyg)78R$xNN_+B zZ2g>KVOUjy^nN_>pe^BhQ3~qsfN})%PV3R^Kj#&WRTgXqM@DsXmPaE0)RHKwV2s0Z*Sg|$(z`QC@*ooTKyn_H-#PsK)O=`nP zJT2v2B3gX8CW*k@b%dlIKpF3g3&$m{%&WBCRQDAuO^Vtz28CK|idEy(nFkwVJ(6&r z82Pu`tCOj%0}%fmbSe%7K_EAh0e+pI^ck}vjJxzPAU*B!<2`EMg6WNEx#?8Y_a^FY zH9YgSK?_lfYA(VI*}@DqiLx}w%K5kj5Pd$sd|!AbHxacN4}2^_`yJa%`#R6FegW7j zEikhmuQz%+kNNUAPXFseB-ju72;%25@^xP1!Ti7)2tcgg3a6@X-PxL;(1)M}Zo)fF zUpnjO{g@=+KHwB#VT&+@bo?gL3rKg|TwYiSBm#^4XahdZPB&@7FXc>;aV7%wCHA7} z8WBhsoz!n;!m!$%@V}MjGzRrq}%%q5$>(~Pszb(y&fm?J%|Ij%cO8l zPWb@hZaoa!Jb)%Su2gmjD_X>Fk`7uUJWd*4MV?+?gYHZNLzfFy#6)Oumw)yM%}bRx zv~k_6g;1TgUh-d$=sF&*{+Z`cC#xTyOJ#1Fj+LYVw>o?HulI*5LDvF0^&_@YO@{sp0=o1pE*{LcEXfgADty!R2gjCv+KbfX8cgqBO66)0!aF^VEqT{i$g zv_9;osGw=0C;fZ8)7SFWb%E%$^#U&#V*ozJsrx%my;n zjP6xx_&JpNMeXu3e)EowSp$7z0@kAqU<@LxTm;LS!%P|y>$EqVQL;}(15K;vv)zH~ zDH$KHCS0Sd1J{SPM@#{ZEwp~nI1DH~Pipzu7|5|9&2{~EmZesipFe~z zPxbXBT>crcRSLB1O_x#BHNf9Z|8p>2-#V7??Bb#RF^Srp)F&=pkPB;!eDy)jEG79t z>u=hiHIh!i6hWHFWTzf}iAm@@lf`0Ec%#eqDoT;!M0zYUyi|pPkNhJ>FR%rLw!>Fo zH!7oS3>a(o8F>d;nV`_#ZlN~y2+g{l;OE5V$Z|l%EGu8>ESiovu3;Sc#jy3+6c0AV z^y}y>isKNXgz7y(z@HbFQ%|#3h95~42Mmhg?~qea-Bslh%*5YCVPtP$Y2|3 zG#!gxmg`SR?l&xAP5S89dpU!q#Vqf>j~~JfUL<#`q#n?BrJUX~R`Z%Aasqzd+$%>q z*i%EgG@4UP6DL@UX`+6VF5OS!K8!ewiu2)HD2P2t^VL83Sn!I!9HSlZgg;{OXz+ry ztTjJy6UtI+(Ba02NkgYX;(I7LAOK_58ZpIVL9kzsw#h&?-w{Yp{`oUIBm8sLYxoXh zA#79w&)|vR|1~ba=z=dnr$ORC8cnW*7asXg*(edzlkr!Nsq~M++S46!dvyE`qoZvc z&gc;s%dN+mUjq19B6OsIapHi=^CPl+=%oj8>)NND^*GLJP@6}%oJYI)T^u863m!M< z4b73cum!0tS|l|LUphk@fUKAvod|6gn0ePapn(@{4p=bQn&pK}aDBc>Y2EjuTX>J> zCu^5<^_a@`)CMf1S(n7iwc2E8rc=e=;p@|(Zcc{UZ$$ChxI3)S<3q=zYu2((#V}W8 zK{-&UMkM2@^TBxH&T^88suN>ox9S4$W&)xUIiTg8*-Da1CJKkxz^>a-_%g<_Na#|4 zxM=c1{NyS=>1W2bTJ5l?dOt5sQi-8;F*@A(Y}~bxHXUiC(E76!YxKJ1-nrwIaF0}& zDs9T$`eJ9Y{n$-DVDOmbiX3xYuK%4JSI3?pnjo|?hK#Ij&AznHd4bacxIcyI<9pcO zNX#px?!9enRHMKDt5Mg%%6q(Q2(md}8U7}PzVALvoX#ux>vBW`JP(*u8qU=xOs-mPxkddMEba#1;o&_paiHk%%r1kvqC-G>e4) zpffAx&_pp5O$WuLp-=1v3M$N&kXgT5qv%f5o1`U8TjBm=q%X;HiO zE72^G{WPy)-mrEafpZz@EM_sYiqFI+07LNHi8=n(Khb;s8j`s|DGbhw39@u``0EVg zY-M){ePPFW;q=fnn#pC@YHQQVr_Zo*Xnk{~UkooV1LOCZOg8G}--y_*hRcMz?Tx@0 zH4N1)t(|E?gqxkVdjQtAKJ)Y9Kl<%#952}bmi%WyE+UhG{)Rv3$3KzO+G$ij)cOXu-+ZY%fGdA1UGURJUuwEZA7~zjJ0cexSh?4AbTGHOQW$73Vz8B=| zWWNq6Tu+t?FzyMjOrEnK*slAouRA2uUt5joga-{?Z7H9q@h??B?sAnVzKyN1WUmYg z*;4C#lnS@X%F7#1Ha)Z!M~qd9K@lYTz51`c-S{j+KJ}obcX@K#mA0es92kxn2HlG; zs|&)feNEj2lr@umK_lYH3l`$ht*%vN6b)f*pYbWd|6s$)QL034w!1z8j72jYnB^4- zsq!1N1^x?*j*$bNqnRRf;9g~)RIgFQTH3cM+Vfvxll{WsYQDUC3J{#`bqq!dFxXvrC zAPvBI09*hR%X%GYJdYG4vg7+Jj^L*$$v?r@Ho8r>9!c6B{N@03Ydggci31RuO_&xF zK)TsAqJ67)!zxeZfo|MEd-paOyQQ$M@?+iK`_2fJL7}d|A5Yc!W-}a}uQGMkX@f8) z0JtZ^>mTRnpQRWZr$yc>p!|pCc3J-PQx7qJ`opR!t@y(Po~w0Vh}uUHH0a?6^;E6< zdqK3lnhhy)J(5S~1-`nDV8=WMw5^%+=RQ}ITE&4c#hFXau?z8)^P1EqCjU&hUk}`} zTXVgC0h|;5A#$q(3EfEa9+Tng&3HPg@%>(_u?^#45T@MG!|44qcRF<5K3;~lJvmlt zoqaXo7ER$!W0)lVl*5>(_QvIinIVUDY#YluH5bB2eE`r znswIg{(Fb2<|dzEPsVh&$}#M$NCXwQrDrFMZ2<^)!s4H3U-9nB-5akjMnkFlRn8^a z;xJw5*&mVKK`Oz7`eD$gG_+cxF`^SSPh%9wIecN+TUp(MAUcCe&zlO^X^Dm|>_OK= z4nF5~MUK>jzaK}LXnm8XHdx_~R;q4|T8w3&58UZCM^nS?H>pepwN%EwZpmMkwr@d0 z>0}<>a}Yj=n%R=2U&=Qf_o6ws&<(t;+kcpWVVTUmU6&VJ%g-i2K)BCcJ$l7R`qbE@=5S`3 z95$sZS+l}%Pzul!$a1zPHJ`Ms>{ojS-AIRH-x@=DBadXfo|_2rIv~x$eaA5Ed)U;Z z#LJR!9yMAb=rMW+g)W78EGHsiuXuV82g^M(AiiFOfQTAYzNVjLmyWbZY{bk)9s(`e zm4Z^0gojt{wahpF9F%TZO9YKxrG2n4S&MwNivZAzoyJ>SUk~ljsW4!y3+-8s$twSI z{TnCd2d~fPZ?H(G&V2ia^peN8N1DQ|L$J2Fcpc{*;NfqK7+C;U%Azn=gz~<$k5mgqwC4OPU0SVD654l#4%cPm9429`~&9 zsPw)amQ$Zuxm0gedVxL>3g|(wv$z_t{ysSbLY7$&Y#H_AF?=%1GKb>V9?1P{twApTBR)7>?1!UrTNXpsW8)JgMA2E{6mHo zV_kgrgj^$OCknkEMu&V}&mO6t35w@wTdyZp!U><(uXNIE6H@S!83W1TFLhd64=_2j{~V#$&#v!R)X#*LvgU+*+21BB243~BA^tVm14!r} z7+ArVq??}WCIAoS_&shNJIrIe)-g&nom81y<%YiaPFhdPSV`{tsrM9zK2z}1`y5_mhgWGWh={T*GF#TWM@)l|D!V|Ts2aJVN8l#$l8gNLCr*d62Z3j>K!igZGO0G% zkh=r;+U2+&9bfIA9T}P|yi;pw?LioiU@B`-Q255%0+Pw@)5(5xXJv|jb>EV|0Hr}n zV5dN?{1-vE738fzG5W2z_Q>gmCkt*wGluG2MM2BN|$ zl)%0#JO1uUNuPUt(c&V=TEe`_`yVXBFFO(27>E#-gg>kx%u^?$4;(%U)%)Sp59g=* zDVqqNrk!xppa|f1V}vE~AAGwamJNZ!1mVctS)ZJP<`3^c26Y7OwKt|q{%uL#*2i35 zvk=35bS)%(U&6iXOq^cn^ft!b!S+mC7pn>=zb7KemY`i;cCzD`OM=LML}n8oUzmBp zX(wix0}s6zb*cSv2=`UDM8SbGP5)7$Rcv0e%Kh<^QpyinvFDk%+tQQXC$DOd2HZo5mB>b5#^5b10U|GKfZ=d-knaOc}Hz zPIOyN)EJ)CkTpk`;>y4r8$phgz{q!luolW(Wp}v>2)jlYN0OfVv#-TG#al_ZKAfN^ zi4*&4>`m+U`6$`NX<{w0uGduS3^7GG4})d36hfoFR19szAjlFgf zJ;mi-vadYa&Tk?w@l@$L+&Jn_b#JQ>IDcJKjaZ@iE2axL9-MBMRVK&lv%D9^{k;F% zW^J2Bq{OA|0HYS2X>V?l8nS+5kw&Q%3z*&uk&$JU66q#l&lqWphzY(8_8bQHiCv4D zpf>ExWa{+^NYY_O-|=#8k55LS7gKJci2 zjVpi9ZzF^X9di#+eR;Zn=&oICT1|ER9nR}j367?rU9zk#{_CEZb9nZPWw3HTAuT!> zvHvb9kjUMszf6DBmYR@3A8PMWuLje|&v(Sg-KhOvg{elhNYR6-0Co$gD9_8Z9MZgl zUw65Fre67*xxHdPsf(+98#67XrGxoU?GK46#H;kK`k)+b$X=sl@5jGGDyxlVMGRJ( z4DvQ8r27p<mc2bJRJU~(QJF#5H134-p?`V>Va|(ZW+{8#S`m&Q~ltV5rd68c8`ZyM^d|i=S(=!7}dA?Td7B+{`sLv4WsZ8on==m3ev!f z%{nd`skTI=TotYkKMrMhI+sT71G(QzJl_0K!(^Y8E^)H=$W58mSd`<4zX@?`=LhK^ z+n1Q@-}YQ?!SS^C7+6>hM5(==ydaq7fP6CcmIF1nF{I5qO-y1Qyd%Ef&*^{Z3{L8+ zsw5WGCr$(o`^GcX&BIOVCzH4`EPuu9Zti-U+KG1s9H|X~#BB^9u*tmzxhh!wQ6YD% z+A3chF3DNjnD=^@68YrH*5q0f`;^3zT`0}zsK4g*e0z!WH5%qZ1MeMp!L-%N99ZDv zX43JrWdc!CMMgz1U3;gQSexS=CcFT370DL85ug2wKP>T2-5E{lbX@~BC<8+vD`R~S zxozMoB`M7h=T>HYj4u!R+_D|J1&rc_{qi1^6M*>!q=#ztf;yu`^#{?<*QxLi`r zs$Cjwcr9RHcw;U`-s`I6*|{77CEB8Rm1e^@_=`VoV`FTQmL`*`35H{412ugz@~oUS z{Fa0Hkv}$r+e}oj%3U%!^+3$r+;Nxop!2>9^p;PAMezAtld^7IqbdD9^$ZVHdrt|j zLidg1MqLxWNLkb;%wmwhY%>&V=EzUH2~L{+lj5jRC99${&omoeQ`adTh-&B$lnZep zx?KibU!mbJ$IP3WVYu@zy}(-Mu?0j@s77lWI0vJ+BjPkoJJluk7qG6its*etrEdXQ zrG3Wx3Fy$)Xg%RlALKa@bgDWjKbI18>6MAcCBcoPz^SX!CveBX=X=##9=qqdwusEu z&Fv38L!TlIjWn%3vM4BMFXuilJ{Bn~5V^plDLJ?M3#SxETlQ?&0P2Sc-{4ZS8|`7` zS^fhXrH-Q8K;3m>Mk~*>Z%5w70O6k5U|}uZd{K)JHJ#)+QG8k> z+yrr(s{@KqUJbWj4xwIobc^bceo~|JDze(P&R5#u($Q<`xndDc^Mc~c!SbuNNNHCl zQqSecT-1aXhzt)4r9E|MO3;!U2-M_)P)INH7D4UW{Di26-SGZJ@A_QjIjnvycgJ1S z2=u!Uw2g@rsP)XpoSom{vMp=n^V1hF z#+Jn)6@l#@42Lx$XKyYtK$Hi0Zii;KJ@tFQHFm2;8C$v0X@ErahtH56A2e*0UXbUcZB%Lf-8nlA-@ffQ3p-WV16oPMuo^V zB*2#XleXy@4D>xp z74%wcrZt?k733*?iXrbIG#JxYlY+*BJcq#B!^=*hl|sGU;qKpuPAiyrR;g5MGDk%#TTt!gcVV_kFR4J~4XK({(n9saFztFQ1;{uE^SnClKV?)%D-ssI}bU$Kf zQ2r`@As#a&tru+02z+F{n={t_ot8p0{G*x15y28%wHUg;HyD#6kId18uiPI3#6<|(#RL@>s9KkYC*`)=NpN!ccHSV zLI3>;Xj0f<{r!u_Mxf2|E1LZ7`<0(oYDXdxZ{keC+_7gUt)UyoF`${kKeaM~;NQa!X#G1H`1qxNxAyLTtD=cVgJ&j*EEv+BI?EPytz zg0FgEbW-_BRd#kHU%YSGz2->kUc)xT=o|NkaUSZ(=e@TR>$ ze(v?RtP<-PaU?TPQbvV(5{KHE2^(WYz54msKIzYI0cSWK9*?@D1zntFZ&JJtIr&eo zM%qFCk|Hnl@cJ-T0y)T&)wp4HSjBM*O3&DdGQa!(LzmkB(nh$5;DcR%B^4EfaLDf? zwf=;MtTYKLWEOhmA_wufdlF!+Mm=a7U8E%mECkc{)S9+)0&Ep1VJjULgC84Te7_kM zk>cO1eT3}rBhcBuq`AAjrdj4n3Y(=CTDa;H3-@7b_^)>7QoY7Eqm^qVMmz4?d~+*T2pd~< zQ!p(J=V7(XJT^8OkO+(&UXb)<@9fqY?47YyS{B?{Ar_p@wksgr005U_rY}<@xa`Ab zBBMj+R=7Qi4EGKeFzq^U-S1mV&s2PG*EE*z-_46B{0UW>*x`=VW}Yi)xBt6ay$Sk| z74QsJ#R^RpExYPL<3bd@Oc||)+QU|9(jz#0%!8x; zzp963i^}T7atE!XZ1wiN%l)E4eiOwn#+Bw|`0>SY++%pyXiJdQ_i*rHJz&c{@`0)6 za!QxNKrO*Kz37}Ngr@RiZ+c-68wE&yD6?6o_*+Ml=LEC$eJZBVYF+r(i1(0-TGpma zVd2;mR8cxf$c(ofh#Uuno2fCik)sE8N?K`~mfam}W|MqJ{jbE}lHO7Jl5}HVsN^Tj z8)nW^n@grz!s;1q9|qJpTyWo|IrW+pKlI5m<$^kcyPhzjJQSAYX-5n}dWFUk&g!J@ zY!mud2lRH*t48*37{W~SpDrR+RsauV2gtE{sUpJjiQ>B)3J|qG6}?W9N!h;o87-jY zz?(p)f*ekFLWBuw3sCiu^tc|X@a&b5A~|?Fzk+w*b`Nt%)Hl#u8R%z*>HJ=Rx6o_- zBc}MFxexaoIki@ntY=tgtEasq7QCBd-*2X|nDd&&pHtlO5$4yL&$4kb%whDU3MmMM2jLKC3Y@Y;JJ+6z!GcbU@hP*B8GdUX!B@R)K zAwX`+>N&yL(0GCdp}$CxCSgWfPc3n~Y+I*@7Rw*>e}2}L@VHL#!#nRj@p zm`CW;P*A$zqM^op4{cBTnY!Rubyni(+X|~IgTToBnZ6FyV&nUt%%4a5dQ4AjBGX|p*J0wL@envYg zLmILUzkMa9z%6TQ9)L$|A51QI6eapi32VRy{Qo2uz;g1tEKTDbrNF9S2OL=)`~GGR zw5QxWqczV3(_)(umRG%1+gR@CjOq^nH#DFbd*s@i8wJ?6J{WHxe;07E_r#tjYhPnV z7=Lm?iQl!htBke<(+KZ@{OxI*Dt5hNGJcY-jEl9J%aE@kHrdwo(jXf1soaQtB>EWJ zuSq@%U$%-pF%gHEHP#4oHNgLB9*C`O3(penR@VuQ05?;P1??|(W}Ba>B%e6Qs=;!$IpE;@1kEQlI87G*62&&cxF$2++6r)PC06?x2YzN3#{DNj&o= zB6BZrw?9_sKb$hDjh_4_*R&-eu(d|HYtk_m)&E@EGfR7B7QFR5Bobv2$!G(|Vsz(s zUy}!t-khQ6MZRmEU2S^fhbaTtKpI2_N;q6t`*c(7;$&+#Lxbpq_EEn=+AGo-$V>6hsNHn<6`@iIvY`(9?3qy>J-d=f>QA%_7^p8m~TtS zf_x~uw?Ny?mxEpZ2nnF`S0FA^BOB_NoDVG?o3-c3mtrwiO?g48&5^^TQXc`zHclcV zk&1|dXZ(iRFElT?`fdZhg-GIX4-p$OIFB_wL10KaRfe%i6+S(my9rQ$-E z?rL3X4+|bAm_sVW(089diP`*Y>6ET-zwBU7slb~D#A1U&vA433*o9JoT_~qI)e+9$ zGAQ09&vnc(7a5(G`dqElC%j=s7Avz^k*P9~e9%yU<-wfCB#qgD9-`60?jv)@X;D(VeT>zo&SHQ+9+GYp>N5-c%HEWkW4-ZKY zbl#tyUER9Xgxd|asY8>ee#Ns^{4wIxl(3eG-E)Q;+P=C+HL&^OgLw9K`BDVHZYNq-DTI zz@1pSA2$V+3h?#wSq4$T8x zmb;I?jr*>cSp!Sb{%l)(q*r%Ms>w0#z*_6NCL>_a5z!kL3Kz&f2aGEcd{kh0i$P(l z%BhX*8=erkT#x!xlXxH|sRHLg2j?zV#*t&ONkR1Gy5Y3~jB}lc2QCy^k5l;AmqC4k z=VC;(0~RkwI2Lxv15B=g899X7M+WE&x5)UZv&%346xgv<$m=%fuA+;*oji-%v%#Cj zfbb24-pMm2o}UkWNC6gi)ct}F+Mpv_)cxmPU-s&veu5IKpXhtuFmG;6ab~4=u@Sig z$$6%x-o=w;fey`-)rL6)Z{L>JEnuNfIE?$C`B?4_Wx((jc>=KyP($?q3K!L~OtOuW z($4XHA(sABD^}P307upME;ex`MK7-EU5ae;?hP{zY%K_3DZV#|Jadi6;5U~Ig14#- znX^X0a~T&R*E`jKO>IH}2-Nrd=iDCzJ#Dq^2lBGrLREo2YA8p~<}k-}j;lMgZ0YRU ztIa&_tp~xS4W=exWfi$?wyadiiTV~w@O2c?p?zlk`|ao3w|P6>q!30-+o2Kb$=0{D zU;*LHgeR)7@BR+bmB6M)eaw)D{eGO<0Rw}wNB(}vy(~83CwcEyNdB#`5tACSW+-(u z5}^!VOh#^==*l*?KCGIo^TTy?3b2x?tMJ8ld5o88flzH+Y1oZ%%at|I zjBAYi*=AIOKKDl3a{l}92nD7Nz<~MpbGP1FFWM;7>&F&pY@3}1=oHbYaQudjj8+GE zH8z0_84sXrFT756IR0kMH|+dA`FjsOrY8g5t@6^K$Mv$L2t+K1TZCny=QV`Bnp%@G z9GxBa-Gjs|U=a)0uM4MZlENu^d#=ONmpet*_C^a_H@pa|x0E7gKG;>cy(ur=C>$%9 zO!R8q;|H^|2_BpCTk{ybK*P$@+Rh)E0#L4-P-)=nVH}>zl}}afM&R7C=jdlsT*;v- z-jmFnN2JYTzw*NO>0U5JE@?ibDcg%5|DV3WLkqgMj2LU#nJFDd0!_`&KNzb}2F;WK zNk`a<#14D$g$i_Ic`~oE>EOD(n-AJ0+1P?vgbenOdTy;J{(Zmxf=)OwKfsi7p zR@KtF*MwI`Uzi_m>_4k1z8D870l{y79%%6M3rQx3kevPECeT&T~ z1py&3nbwp$_<{kIUgI2ChAr^1L>&M4O~Rl}`M_YEC&h}ihAAe4p_5h$Ip2^qJVi1X zm{ab)rQ~@@=iO2wtJavvVE^9y|4sQN{k(c*dOduPc55>3}3rG@QSbIdgxQ`E0NCEjgxb1X=EJx2m$2N?lM%W1X{ zXPZ-Oq33viw7hmc^xgm2#$}9<3n$!9wC?KU>0akgJTchgbDNY(3qMh?_7(Cs-NGK% z$s|QnYb6+>X>NM3G!uDT1Wqwy`-Rdxk5_<{5#^=-PgtZKt!%^!>@QV{#2HdLW$*BD zK%!1V;(Cu(I_d4H{H#>YNT+?=H0Bl7kI79o?ONnM#kSWTGj~&I%=Oa6!#6%So{1Yu z^@>uxDP)36zE33hER8|}eQ%6?#?ZTikWmu{xzDYmCT479IhQJ@V9BkDtIYli+Lv!q z6!ZOQsMv8fy4dHCXuF|*5BD?5CgZi`#*n+C^Y1&K$BYIk11!qINQRxbWogV+zSt3s zaYpQDx>}>6pozv8FpkL=b?I-L{|mg*e95K@A`3~TRLH+UJ*vXTA@WW5@qhV`&a+l= z`kw}VHZ$vEE}JY@9RF|7Ugg`V|E~-;d`=IZ5TjXw`k%NikG3Gk`Q!Be#H35tkLb|X z?0El!Jp-sMJ0-6;c(eWo_cxETvzh6!rk*cGblz>R@H3<-k0vaHY2%(375Fmt*AcPhm@SQOCnYs7A_bbo) zyx;rXFMpk6!#Vrxz1P}nt^HfSrREFhk@wMnxWDuUQluJ;LFy~Jc}eRyZ7b>&O5}%U z$~@KJxhggs0_2N-a57v3`lta~5Qs?MA@!IA=ox@1{_psHP({#f+xUUkf+H_dc<=We zAsrq68XvNEB2b}_+P-cuvb;6vVW-SX`g!}uTq6{h?A$|qnv{d)=jqFgIt0`%-Ibva z>jo&1zRw5jU!{}Ev40}Cn!f#`)@HD^#gq-0#H{2R7$TEbLlY3 zYFgO^HE-nb(NtqpoeMr)h;TC289mg;QgNwwzY(|=4hq8sEw81`8}8`d&tPFcnQ{#k zL_sasg>k68rY*qI=yW7SAcvI=KX%V<=>CDIz=N%@{3p!AA@9r|FN;KKW$lRF1V}*j zl&;ulS+v_G(NS=83j&)M-%eB;t+^oMreJiiHSAty1e0P59&M;{VO`Xs>1gw%%l0_R zueB+H-5gJPvNR;7V3ApPzL1(?)p5CodaQbTJ?rXMrn%<J)QdRU1;cI|Hk zOSjDnh$_A7)gs{#4RXoHlbdXFkfxZUb7QE5yp11Q=&h+77m40f14IDwYYw;@KIm-| zDp2vT0^~aLQgR+1jfG;49vC4sYz%sjH0Wa-lU%bf8CwRs)sA zr{cP)ql~R9c3^1HWQ}yT>S!&z^jMzc&^l!3eI*B?SUI}+NGXT*${Mro(@HQXCstCb z^@27UI72 z92CHoPhxEg{gL5oXL-w0JeA|>WElq;gnW_`8foQL z4}ybRIdT+_t{WN2EP>QZj4Mgf^WHOL6xPmvRAqeg$p%vJ4PT^tO>qb9GQY>T4@fZk z5X&Rck<}>a9^A~F8F$5yN;{%Ao|BIb<(>*QY)9GRu|S+=4|5@LKTWn}i1U>+!e*#w z&3T6TW~Xs%a9MU(&U##2AchJ_ms%khLQJw-^0vBZH^an)Vm!`Ew} zm(?3NR5;_bcRNEGuvl6FAvlZ7Hl;a!LNQx>*AfowTCm(!N_Gei80yj9RWVS|m)Xqh z9DeVDhkwU|8^Rp*BOW0h@iV-Wx^xgPx>V3nQ+P0FN}kz|Pug>UEU@ZP%&nt>M6i__ zv2U$1#?mJO=!>pDToKAZeS+q_CHHr1#Jl34S*4fAj)pn7z%$HPhz+?H8fy#SaU|Ug z8>8-EwO6!=C(xfe2joptxwo~IY>5lnix=4(r zryFD(#Y90@aH=cQ9;UA34l*5MHeE%IVdCCvTLtqhHb4;_rJw(-Y`|YA5nLQyhG;H- zE6^(X9aqvMmaI@2;CSn&3Ud2F<*Fbh{`%Z@lj!TTf;IRTiIx?IF*?w1&A5B8jP;@?pXFgh_Gu6BStC2@20cbb)N zTHr*&$DErS zQ-e#C2cEdQ*kS1bTX4W(tqY}gyJG1pX)+rVsHUzhUq&2L8P{7jX*w&tF0&C=Ycji+B@^&b?oAJ#?}1Lum3jHZI4 zTJcfB4KgP)de^<;A!ivcjfZ1VqO#Rfu-~B)7D+32K%4 z0gnYuWowg>Z?OUW^4JEuKtHppQF+k%mB($KC#-00W0DB}_R1g{MH=*=v!12Wz2FMY zsYgrM1#dF#s91`=kKT(Z5kBnZjp1`sNNW-r&Gha-x0FivmzvhHmBc81SWMyn+s;4p_%vO`s7REiUiGkm5LNtY7U7GKjtDSul5>uz zqc_VVObb3G)RH@{DQ?CMJo@|fWjHm=k%VoI@?YxBX_qnDissSKm_Pkk@PFC&2V)xbnv|t8Z2vrLnW1R9qBZn2!6b+E@PuAkrt2^$)!1qg{86;= ziI%symA-!#$-ih06R8gD`?f*+aGM`D&h}BZmau8mbIc^}KH36-{W!)UxQGJli{QSY z9syhN7mf=L%nrOGmxietFs%NxkL1n@YUN31f4L@zuVcgKYsX)w|0EewGj?t8hXDph zr0J|6?yvozVqfcpnUS~Nb6E)aDscL=K)%TQ?hoGuDn#Hk>2QhtfkE%IX$zS7=vNWa z`_IAa4vDjB+%1Qcm(*ZQ$Z8ulhe~K@9a;%P%ud-^Gi!cRtR>k6R&WOy%T_g*sW^`*@InyR3K^yK2)(k3bSV^p|G9CBp@>xCY`DJ6<^jr0intt?kv}NEX zg`2=e3Iwld(mfhyL=d1U@-l9N7&B+y&ptnH>PEa`fmXv{^0r_Gd|r7Aidf^oSFcg@=gd1|Y_Zg7AbWZw7-Xk#F^o-)^BvJg$cfd0m|`#9jjtg6gX?$FO?sHWOPIgaqB{z#b7|~DV{;GQ7g4iuhE9|AA2srIGFnqjm zibmk~e_&Zs*5#v`R!UZv|Ga`5K8h{rhYIX z%7B~@xM|q2Kd%R!TF=ZQFH9R0)*#{R+9#POBU>Onj-RK~O5Z<719$w3*Ha)HgsJkBYo0PAn>V`qUa-Ll z;Sr2DLN&P^0rWcpwCt^T_($K`aj}C@euMk-!dBpvS~rD^vHlr(@D*yJC_D{VA)ucg z7}M9*0tnPfuNe@=U5K;LzB;CV`B%3<=oiMgH)SiRL;f6-m^;LtQWKytY?@j+rsE+< z=d&&d`ucG7r@)bAk9`A4CPTGtNr#gpu>=aIW7=_tZ4kC&^{a&_&Oi3g?9ufCGoZV2 zNsdXdyEri8O)4xQLcA%fBnid*IxaoBAJGyr0B>l#;~xsKfp+e?VKv3(FyNYZidCn` zdaFces!1$#c!~?zT$xOWCQg%Za+QZ6*Y(}T_Ex(K5o*0wZspRsuSfEWciwy7S71{9si}RI=qB9Ie{v*L1!f)0|Ly2UD;nrPX-e9JX_TF3D|m^?2=|dUs72c z9rBJkcXl@#veO_u-w-Ayu}QY04wF1>;7TF9zZ*)`wqqn#hl;HUS%Hb*82N zoJZm~uzCi`t`Xc=4;JTO2H#Lk+j^zEc%Q4fcC;pz4J{M3>}C%-i=m+gG&Z?s`;x<-4FUe`xit9Y_9s+i2=i~E2 z1pjVirT=+G)vU5;QT5X4>FM5GhgIIoyN=}Rh|CY8bPQT1zSY0)T#!gN=1U4PVEU3E zP6NS8S_A3v(uRD*t#svuURis<5Za+IaRV~G@_0F?%QIOqg+Rcyz!n$H0|n^kGRK<6 zI-{P912>~uH(4+@V=^9U<+_<@4QxK*dagdP)Nfoc>1ly+?PJ?00&!{f;4wsDL!Kohyo2exkubZEylkKE7+p{cODcpI zN?xmiSEYcRtl!2IWO=3b4JRk2n8ORq6|^qx{o(N=fWfvqR&tE#S{^97N7Iuu8E{py`4TNvyK6{qrt&;+e68gf@1&<&Xcpi1Ux@qgU#~k!Wy>|e z&Gqz%g-ork$jB_RL*G(wwK>@BHZTztGA}f)gj|@rXpk?!$v#Ja3ORF2nb6=}H$n*f z+AaDvE7hU55>nK=zRUh*XUMWsUnRuJ-Ya!<@N9gOdP2;Iu{hp)6;l+eA^b>1SvbM+ zo+q^0yj^)XgH*R?0ytPT6)W|$ssr*v_Hk05aNbojW)Q)-B7w^X0F(|A;6TAE4n$j< zeb8629C!PD>U6Shx_>-}jVL~U9l@zQHPx^wl5A+vUuMF+v5dzT&_Nz;-$icgYh zAImgG`LDWi#SM@EM~Sjx!i#gs*7h-0(#r1b>R)vWjq!&~{lGGMh#6+(1z`!$=B6mD z6ZEt}WHn{wUm!rV00anoSd3~>A||LsG)eH9NHh7>;l_|p2FaBhb7i`&7n-g+EJo7x zM{+ODg?i~O2Fu+ckEC=Z3H74RSigs@@vF;dw&S}Gtrmia>psQD5hh49aCW z(N5~Jj5@%e&Hw6XCTi9awL%cwYXA7B;y4Z#5bPU&0q*|^{M z{ryx|Hgk!$z&R9i5`m;{RZHzO4 z_)9~aTYRGQ*GiGV&nL2;m}&!PnQh)N^jmz_Jqeb_!BQ`;dK;XBDKUl+_Z@3@8!D$c z{N)tt{Qgh&8U|x7;d04p)F^;a+V*kxPaea+{tnw35h%Tqia3x{H3|PvsSoRKm&4Z~ z4a!KfWtUUSz8+uo__`kfE~{XAzkM;*?+JUA>O*t8kB=8j3-a@`qEyyTjj1NmCDqTz z9N=(7IA13IK)Gz6{)(hcrujgKns*2~@bOyE(oI3#ktg%R+LJAGUt(U^09@HJoEsfj z3LHfP2dXv1_?tQG2@ir>xxQP?5)aLCfKlG@#eb9WRj42E{co+d=pIHV0NB)^w&E@K zrZ(cGc7?kZ;9zF))02sDj)_;!;o-MdhK3A=lIGH0;P9#!Se`OL`-lno98{r^PgjDQ zgMldMZgW|{&EXA)jv0Vy`*ANojK9)c(58IniG&;tcD#yXi=?hChUvd!eyoe3_`W#E za6E=Kd^76%eg51esKnL_GZS-XBcuM6r0nVA;(~~wyU}5C{)CRQTKK2d{U+vq&?IOJ zrI9>YxxlTy7*azI-k+3@QjCW(5s)V2FC&l~nYFXq7H5`&5qj)@w>rU$$ zM)r{Vq7JWW+Dkg>#2gon6utY?LK)&jB!!xsK&c&E01!~Z5lg1+TL}NV%a*C`SO{wK z$j3{|RQIz$(DGSDHGqVm%iRVWpj)!R2KH&B*d^sxP%zF{qW{p@(e)956t*b_KV+{~ z!i5iCK8)e(*Dn$`l!S2;zaI|QQV@)3*2>LVsy#q>>7O3@ctRlJ`gu{S8DHttvJRMG z*Tn!kW&M@f$&-5-bF2W#rL-4#fR?Uh89wBi8PQe$DQFTWNpTILgtc(1Xp{J*`GXdg z!FKD@8@=i3jOlZvai!zXXcKqcNf^QtE}uM>>@agyG+ADrc;)_(M4n}U-D%(zve_w7S;^(d_!?2e~R(63K`A&r|AJS0KsY-(2x19m8&(OgF1U) z`(0-3z=sV*)r_G{7V1M;M5TssH4pDFx?F(yS9pi@Gxy45$+w4iVz*W%TluJtQn_#j z(O`uQwS7XKWkw*NL(6&W9ESJm-MtXx0(@!q>(H2CgtV1I_+9{Iz+y|pvoh2!j4vFp zcIZ;V6WeVrZpRg$BP(bHg%<<_0s49PxP%}W*&CoZzX<`gy{Dc>-owNv?|D_Mc?=#6 zA=@`tNl5l{@;>8vFmlo%3DCXPn*6Qkc$48FFJ-JNUk_6Si@X4~LReJ^ z7!AgHw!9_N^}awo!4PzmI1<&oLWbt?S7caf{|%DB`t9`^QR*dkW3{Nn0+W(Su(LAT z8~WMzlo+?}TfP30OU;?@3w^8k4S80M;mTxoqS5S2=Q>X6wpt{2SIgOCYj8z}!N*9s17|InW>zSm}9u+tAkgPOd{^z1h}+g6^`J*xU0nryB0d_>k(&ESDx)ap zr1Wqn#q?$G&6jz7JP@q^sCV-4vNfR_1*p#6PgPBM`YOw>llg&B4ZSUPdu)!3F`xvl zQf9lgM2#W@Ko0=2L4XJYlBP>;0&L@QG?}Gy!Vt>|pNXG?e2+5iS5q(JV!4Jo@xcZUVC6Ke!3<5hLw$ z7wXN9OcYXvMgVyDQKz#-#xl7v@~Ga{$>P%qrtJ&G61B1;dMD8<_1pu?fV6bpTa`z} zc`1Lv1qU&!Q&Q56$T2BD|Ez@}7SanGQSi~%!0?*BKeK0IVg8vYMI|dy(juo{^tW?1 z0>vgpiIRr0spO?er`uc6Mrw5yJ3#M`xdVhrmmv5mL4RfY^y#04iGFcSrxIiCVxxmr z9cH^t%I<-;NoIAE6|cRRYYF1Bt)ydHxjsPohcuUh{>f}l{e`tV&smEQ*$)5xsxo=# zVjhG$*^s5KFgq|gb=O_K1?Ut1)fXC%LIu`#Z25CLw!8%NZ??R`jx8?~_i_r4oSZi+ z+QD>J=0|6Ts{agUk(>)5(qgIxlcE+&>Th*(Nf(+58kOi*;@^NB*Xs^$UB5N%hc^d9a9~U(6{p05{rAxBbs(l z+Swz2p|m3`Fa?^l5gr;WFy8AMD=Rlf&vWwt?X2oyR()1BgqU{%a?j{uxgHZk#SL9 zl9Y)d$vOUN?ZoD?_?XWX>&1r&JS#6T1GA>YE)x%AF;QXzVO~tmnd^zNq%;OD758G_ zsUAj`!bAxsLor>AcMbv0@a<}ocN>OokC%LP-B27y-z6qN$z!WQ|0`SC)0GnFVWrcx z@H;4D!q+=dsPO!zRPueHt~Y3p+md&0l%M)aQb;|cmrL}q1?KG1sbjtnaCk&LF|`H zU*ATMcRA;y=jy_cCNj|H&EBIE8&b4r|l!0Hm~IBnkRr)dfeT?+@IU%sF(xfM`? zAD%?FY2`+B$?7~@X?Hv!nhfk|s;2|Q5~EErLzVPHE-c16+6F;&^va?FnBJjkGLqJl z)o-Lj;vgcvlRwM$>St$3)4<@2t)(TYWO^^IRIeL_2K2K`(sReq`H*a2<;#K$;^D_dT3l=!3XxyR=erEGYYDmL+tdrxjp$CN&Z z31*AP$~|5eJ$?Hd%YFJk7<{0AW$TIk_w;|batSp4Do}A7^<0p!J~%jJ9~&bLmmK}FEUAh z)di^HMTHjdR!edVR#v4s8svMg#G>H_Dp9XMTqp7TwVXthaef~|v_yK)ZO~?Ki4*bHBu0i^ zT!t~ADb>7LC9^kA0Dx3LX>W-EA`5)}O{z})=L5O_hi^eQ1EQiv=wjC|fG>7dXcP@4 zfBgcOb}B-v-$D-yKu36#oGv4phgBasj>r;K;-fY`O9x%8_5chu{1?^D?=6}_yxLa| zRJ7ZeTD6CP>heQ*SD-QBiz>i@46ww25x`x#v$U!JrgrA(wi-%TNu6!_lS!d4X@E$W;zRpnobp zzX@Rgf~L$Uu=_U+c~`*8(GsR-aDxSX5Ro_E_A4;MzBa z%fGbySAitvheA(Ea0S5n>*tKV+zrM>#|M2a|8jSm09=d#7s36&1&j9!1-J-I@Q4$d zQ*1v9JVL2GI(}2G*aL3bar#S55LMvcy3X1EX2m(~3-RFvv-4lx(Ic>~v6r42>gZL= zCx-;Rk;lYsr(^;==#8!)UQqg5TeHmv#}~+r2zX@^?le!RoNVszs(47euGd^%T;%51 zhgLY8&_We0n#I{)B@6KWf(nTYQQYTv{Y@9E8Qr<&ven=OmqAX)7!1OG$=!3NUNA8f zrcbzFd$at}gUY8%0v_d1>3SB@C|*X*Y~BTq!+3q{VohJbeU!3(^ue5*g@`1hR4oj2 zx>6vpW6@`Lk9duVL3zOwg%sR- zC>Ef*tw=65a`QhUh;Z_6Ux@Fp=M}AccG`3)Mwk31VULXhZ0P&+$gij$rBkK%^}}mU zKGPGEE|xu*fo|}9wz|thM4O#E4Cz#^)NmO%WpUx#h>^ZY_cXyZ486gie_#%|FO2v= zckX!=lOHm8C?X77{&KL!B~bpCy&;PHonhL$tmU5i{hrz5tR?tJ5<6PyTTlNv4309> zN?p1L_|F?{-eSjtsAoJgLliBEH*VyNp&xIA5A=70C^mTsUB-6a z7-mV6ZjsM1{?K#zS+N4GW`j|?@ho*2P&pfMpgxCmIl!)ttdWK)$bKGJ)B{%+G~u*W zdo?P940+>sQZox6^7w(4bjWSLv~GtFw&8uHyLlzSrLL*|#m5`uj-QH=nKoi*hV*WI zZ2H`wksDSt5|StYjY0B`_IRUrdO_n#v*5{698zR-YR*1+Vrfpw`vCx%c>b6k_E|e* z5Z$+*lU$GFc=ioj?Q8vDNv>K^WQhOql9^}zaG8I&eHe%i0-yhulAr&TZhCjBL-gh4 zwW~SNDtdhtuYuD6MWYtKN#7Is5~V{=3A_!SEg0D?)a>4Xj|}^@P((Zvc+vL-0G?Ry z%FX-Bzn(juoxlDI@MpkbYj>(?k z(BRZg1MpJ{kZUm7dgB+P44ItXS04s`R_jr?1JlrEp zn^6i)6$LpLyl3D^*GRvetPs3*8#O*5H`lS9G+J{m!}xe4hEklE9#p4nnRKWdAs({M zt1P8VWC;;v@EzaZ@j0D4{^3jJfsjG|PuIozpA4m##5mx0lU(+#{Nzz56>LG}NsivN zY~VbuKiqJClYZnOH31~wbY+Zg-ndyaO2kt=Trxy4Ig#LS1D5#Vsvyt>dGYK0FU&T`5-C0&}oRdv)+B!oAch2y(zxE}OPw+L~7-NR^%3ENd^bR@Ecvs@0~jVA)k zH(lk{F9C0ovxLiGjtS^|@0wq{y{n=TJomyvHBBmO{s03e&bAJy8h&$-0jY<+egZ70 zYXUi;P_e_M`frw>SAyiv)XZgd+i%9pi$#!d`Mjm(bP*_eLz+8B$aT4Q=!Q$_dBGFY zh-s2&G9gqU#AhGy2D;i~<6UZ7X~ruRbb!RxW0Yb=%j#JXsM@st$z7(bSm$}=>is#7 z%R8gop(caeYbqhAQ?smg0XcR|t$gLFub95DMd}OM;L_DgJQ+BB1E}pcF-LnK(YmrB za5coIhBrc#C>WiC0v=h7&L z1a^6(Hl5Lrm~x9?)-QHDo)W-ZwFd;MSMlKhuo-a=RR~2>V0G7(4)*?Sg?|Ss6FHxM zn=6_nf8A_s3MHC{9#=Z_sjmr=qM`B-7~jQ&@R32SbbkKnn=lzpzw$iVO|A{kGjhf@ILp(hy2Tc z{QQGF1NjdZj(^Bs=iTLDAW$><9~2GH@ZY6q*lQI&Z$8Z4-%(}xTIq-oB|I?xJW5fw zbS3?ZrCz5h#BN0e-#r;LkrFk11+Z}C{++e}4Q=lBW-C`Evs!h>h`M`A|7Pip$It%< DKsDz9 literal 14697 zcmeHuXH-+$+HS0Xh~Tz>Qete_=t?IDsGwj0YzQ$R0xBd(uSrx8wt|E$N)Z8tARtW$ z5J-fm2oWifPy&R25-A~sNJ}6g;V#(wobQ}_$31s^0yL`v9IP!tC2cA|4`{8I#aRmw zs0=H+=(Y~{FLT$%DF6i8RKNUNMe)tQ2?7~PPM@&27pW0 zO(-k8`?gK%@`u%%v~}ZGMg9OiconZ1`1<&VBR6GLiY7n~+gHD=eD9in-@^E=tHzIA z4o40>i%mFfyIZ4q^TDti4x8sLkrw)a|m@sBuSR3!+ ziy`_};KA;_RiLc`ny>#wP0@ZFc%q>AiCm?dw=Gw-I@ldUspRzaIr?|md6F_v1Z`?v zUm2yRy>xmLziL9MD*Iz`todd5uwU_0^AfU8O@KZ^JiW*PKEyp1AtrGk_Jlho&lhfp z6S^GK|nA#S2y55q{Dp z#eMVbV{-Z8=}aZ}ow$bi*7^RP#}I>fnB=PAg$QRP*gkwaHww{GLgcHO)k*sHn_K>@ z8K2^k0;XgC7=1||r~w<`DV04zYe1k6_C@+QUv9pt@-LTn0bFMj6C~>3?;#%bz7U+e zV0m*U1hKqROYA+DC%#*T@&u+%xtzia*$L zhV;QWbsKMu4-_Ywt6SQL9vljfo~qs=4Kb_Tk4*nK-!Q+ucD*>rwk@o&dOhWAsWNc? z1fO9@EoSdcvV5_BE#vcsRn$v6ZA2AmgHRi<=t}JbWZc62W1D*G=dP7gQwQsoAofqQ z{6a>*xB2yW4G7UKVvqEYwy7ZJn=UgYEB8arLCm6w#U-tK>yF;cgG3HYAFw1kA*#+> zm3UGHv8_ClNdv8Ds7PW4Uc-J7k#doVp-nCoKwM<4ZLs?{bJt<1?qxpdd-HuBoz=U*wq=!@GB#x9UOg(%gmo|>5c{jHR-=q`z**VDsy98{k<`71y_#? zrv5etpAB0-K1C(tSS?aLM-?cjk=Vdi_!WXU(*$`CXFckUO{qZ!H2z&s_TvZ#)_!-w ze*s?phw;s{xSvJ%B4`C5MIg>`o2-4|FL8yEsV%@?S2O8lfI05*Z_>yKC#-!7yy2Kr zwM&&`+|Hu!NhTNL=Gd^@y7!|4H$fjRZl)=pIPOb&;PN4-@4%MMRiLC(Hog}$d+fOv z6JaQ^8c7{C+~sFyPUp*pbt1;(lgoMizeHCK2YsCw+giXN#ek(<<5d# ziWB+48$jB(qi5F-FL$o1akZ{=1l>Em2WN0#x%1GMbtZ2!R)g$zLTW8mIxUu0+X`}} zUEWI5%4fEotxW5jTu11uepjeZpuXiGr*5@ORdqR$@SO39VE>{=&Fe_l#yf1!FeByy zgJJNzE=7aqM9~c-^982?JG*Vs2KB=E%4uL_!7k36S7&46sr=%U(qU2V+`z%g%BlFi z^Kfv0>ib2F%Bfbz@m=`I`^&43#Lgzkv-?71_rYwi52okvcT5n@J9g0i_zEodI1xR& z!T;mrs^@am_SJQ7_;m&K!Vce4;_{O=RK-7M>kZnE&&DEO@7+SHH+y|2>l`R5iIo9)hX~ zcjWp++Hz|Ra?IogJ-eCfZ*)+ob)319!Av>v8;#!5m&Nk;i6V=4Gen+&>111nM5#Qh z_U4UG;29XHd3h?5;g+YScRqfVzLq8lI1Dqoo;_7{aiaUu76*A4H*`95w_3~nfA zUkQEI5Q8S|@}hZUAypWfD2DheSjH{BUZ-NO;>4W-3mZCd$Bd>;^99vU<#O%N4@(Yd z7;Pr6enM;Qj1k0a+`tMZw}&DZfZrYhrVD2bBKu=UgM(= zXC>|Fs4d-ITr7Y$`Jc6MgY6cJP1euD=OMXjCk5eq9OS;FoBDsBr69ICN}CQ9=yd;i&vXw==G*k&i(a3*@lA>y~> zSZvuB;L-P`bSNN_10XPDl8Ql}H4?M@vG;w2FiqnmUrwiYb!n)61BX>(^ijLE&=AMB zBN`HsmmiJR=WvI_{MTd!8f#{PoVMVQS>?Zlu%dd^* zVMW+jFWKR{1P>{5tNFD^*hnkM!o))<4ha?Y5vlm+z}1{_^Q&gT&L?M@E-8n!59x zrq(s0aEdNCZ&t|1Kob z>m+vi{q_g|euFP6&lQLT{;NP+08swsWgZ^)YT)j=n!DCd$acq<%9jj+R)IQBESpZy zA*+9n#`jx>Nl0fyoMP9)%;>?lX}W@n8p7xgN#23ScSzgCP$d()O|lO!G1R`=Th`6t607i^-A(f3PzWt!pJtOJ{T*|bk0NvRse{v5(KNAp_b;S zNJd2CqCv$u1FeFNrNt6rGV_hg@-nlzE*D7Y>38%xOOPLTI845B{zR7h`FzI|J@JcTK^Mmy4cRn$ zy7m_fW6$#-v?_v%)WUGX9W{TkGFBM(v^GSSJ0 zCm3_8Rp&eW4Umw;Jd0~>6~0_{aXgZdQJ2&=n}rS= z@H^J4DN+YwgcIgVR-d0lSWo1b%NX!WYB@>07~{!rBm5Mf4y?N^&ygHViSwk{GSUN> zG&)VKkYOE4%0~Q@FV-*C!jX&5nUxh}8a|Jqmek5mGRv2WWVpfWB{Fl-uso|;m?YCU zXk3O)Z~3y6BrIVdXGlvw`FYJ^L#2t13iBzmIp$qcgF;`%(sdZ0k?!6!T;CnLl#QN< znwN)PO3{);g&$lylhS!!tF9O=u_7;Gx;S7@{vQWHS7RT=%sQXRFv%k`Cj;a5K;YNQEmE(7mH;{7pNMQC0FI0hZwcVn-=n)_69=ZE%uGNEgeYwe6Z63`%6v_3ATZ zAHYf`RwEU40m}xx_dP{nrChNW}pXiU^kC_w1jbFg9XbRI&#Q zhgXMQ87WKF%nw;*hT1sNshozoxdG%rnL}v@*C(Q_rKZ%um&Sj@J`0~cEfy*hGrLN` z-3awrP6rXoNiSd38@VHB+jOOLXY$LiEQ2I9S}@^=E-9&{M^SW^G7T}?V!6*GDZTAR zI${Lazm2shkzyx$6co%iGAn^?r#L-eW=RuJ@6J;+O00W$% z>hqWT2#{KEQh%(B7!|5D;oU?O;#0B}kmC;>N4p}Vc!dV%*w?hW7jxNFU%J>L2=Yg z@1x$StR4oO1oZTpr~tWpA53a&T^j(j1T1B_Np&=gsCW&L7t=J*{lWbH*ij^EDs2`A zhvG=w$S7%HJ>MlYDV#;?Od|SWxARw9b2nJ8?J86 zo}_18?7AMoJ?7ke4Q@mCSc8vznd>`a(bE<#dgT*U9oave4`G^x)LpO<=>2*KmWzEm zSddlw({f&(nxCakeMSDoy3(~{NzocEv<^B(!n&>caD=l6RU%p1(3=*e&L0YD(%6}D zy%SLmc@7PJ+JYqg>Mu^h)>S8R`>5N&Av#2TOgtLa4;{9K#al6}_4Ct@j~|kY@UNAQ zhk>|#1U_H*Ej6a+z%AmdJKcF=f5rmqF<)~nDcC6Uck={>e!Sad8~Xauy^X9~*3r+w zY|QOkFfXA`7Q%RW9o)j=CV3~yv9J9QR@^CuFq37ziM^V%*OGQ|yJMXu>SJbaVTfGC z8zjJWhmoI#kAkJJl^Z$x=I|l9jO~C)ar*>Ob=QBW9P)lBE&Pa=7=kkGGLK1uV|t9M zBhQJm6#aj=&}GdXmUz=y<&5WlH^Eo-zuONd-N2W)@0Hw0 zroMo0+P?()R&^2(&;%gjWe|KB>GZ{~xctjs|8iuqvJbrFUYiB9?SGL0c;Uaq=XHt2 z=2rxR^E*%4Z|%B~Mhz7^4H{b--+PlP&x?@KDvSs*&pGfo``Qul4qqt8+1f_x+g82i zr{W8MH_c1ETaL|Je8^l98%XTPl3jzb*#{n9ivU6t*PGqjY2?teOcO1M)A$Tk zJN=yf*13C+0oQsDzA6#v*^ZfmcZoyJj|qK+bM~Gc@GC10(_6BG*8p|yEa$B;o?B(K z5bi1VyJC>ZH1Owa&lkY$8R^slgATfTG0QkBXHxWJv~z@ics#0~=;8gbEb>Tc)e(%kF=-|nIZ4~rd6P^{-};)>0#m1He^=xEG?846dVx-C6>NlAG}B{U}|q) zSh}s?9*CMY|7|EBZQB{dT|e-!CszSitkSie}@vN|u88V^- zL6R!AxTS13Oo-_4*5Ijv74QPbHygx0znd=f|LUh9KK0PR&qiGOMXsfka?Ev_ILLiN zGrm!^gnbw6#&~y@u3oD}40y_m)eJ)f2+~y?f9vcpU&Aznvjt#bvrb6qaIk+C=g6|K zw0yM+pFI-3lNO|UN558d<2k%#YU1*H=q9t>SF6#IIGu4Xa{Nh!3it%N7ge?&PJ0u> zO0+mas9pSYJ+Oaw{+ACBI7xf+x>W|6CXHjJEN^zR8u{+oobvmghHaV^U&?B@OwL4* z`S^m$h@oELU8cNV=2-1^!DA)c9&)dK!MDL9UVH}mO12Mq5#?QKJt;oj)~iBLb~Kgb zXVt2S_3;UZ4;!nK$o-))tjSV)`tb2;0SzFN|n7|6F9$-gDzq!kse>_$|IV{T6f$NcBR3!qlZma*I;ZIKgJVME)6n60ESh*;U zqBlWDXj$DZFpIZH=y;~Wp^bK^S|_x3>r&F}8#w6HsZ@kNrNUi@{?&A+y_zE?zNLD@ zsJkfF-B0Wp12fpqFjrA$0VY%;FpL)^qD8!?!Kju& zO}+F?AO#SoweaAH?b^7bJw3w zx~#<^zfq{HOWG7$C-BF6leQA*xzrl4&ta&t=Syl)K+>|b(JHr7uzhsLkpMyvkWo2X zcHd~`eqErPXZvWU1D>6x<+(%Y=^Wqo*jmuS$)33+_}d?GMshOklBBxqm{p%t3Dtle zW$H}!^Yo8aF&v^58M8vnO7K5`pMX-W{OnSAb49XpXBYHz?h4}x>Hz!3>T~u zg`1%MHN*C(WXGr?w^`+iOGou=Wd$a!D{sp?mk0-kuUZru%{Q zGS^KuZF|1Zk5GlE9(Qb!3YlDkV()CpP8Wj5C0UYlbhuZyhFon*FZ$o|BQ_C66TE4IbKh9G|Y}o>fE$&4y(O%K<3gIom>hMQc zEnBtozRFUMt9|bJqdc;FNGf>+w~AtovgQq6quN_z;_Va5=@GIQty=xEj%)J$4|mxe3UdDGY@T^ z>93*|lTiCcx73o+F4L&z;)%LN40B%yYS`OPlXzydEI~J`rg#r-&8^3B&1v$pxo-{Q zG8aloUxwfiGfDYt?^DM!Y*4?FM)zan)UM{5JLJ0`oJnK+Wwj^!rGyU8Gfo=Jkvqi^ z@G)Yd6TQoy`o=M~;8wCA)r&V?R5;$!v_r4GQ~0&@On|%^CXLGI28`CxhV{cOQo^Ci zpZKxcX}z-(XuziDUwXdq{vTidl<+t+f^`w30q2|bef4~O7{+_IK z1O!rPho$jJ`-`F#(+0sg0+-?c;&NKB6>4$oXQPsUT3oR9dmsEK&uN*d%4}kg8ITwOV=|Kw-b_txj zm~+l6K1s`7%kW^a+npi^bAkjWEabIde=C<^7naP$e9fsFWF58)FIn+2a-`Xsks0l7 zdra1-c*Zd8$`FbWjf~TT=JF-&Z)v-BO1&>R9~s%3EFZmp*TNk1KvPv9+zrfsx!wHS zl^V1kV`)*@Zz8Fb!ELD#Rvm3=3i8C%%se_Ix?b&ynXdUsRA=-(rlh0H@et-(J#t1^ zDQqcgmKSt%;FDqO^GSMTbA(L=#oYCCs@NMP_sNetmon--z(a;PFXihZNWNcC&#=k_ z3I_VA)<-n<0f`;0(%_y?@D>?WDmT9C3H7WSobI!xOcat6CPSk*$w(GuUt@+#Y=I&~ z6?Dqe6jHn7UuDsbVUvP%kAL~q5xWJve#l85ynX^&pF(CQ$;#Iw>J76ms9pgZMv@I% zHa4b5f2+d|)o91M; z)lw(tYXlU2Tp+LOqvj5ayi%g z;QsKQG9kKt>RE}EM4UX@r>Y*JHAnaB4oZ5SaG37Zw<1A1&fBEGi9@zMk+(%!cOCh* z{n2Ztay9Cm`vz0kd!ml(S2SrY?NzE7?!CVUY0xEQPB1r_;Y7VD(3H-luv1X2xmX9lQF^9ZJN|6GBagxGXVqU3mZ#jOdoBucLt zvJF+J_P4O|F&_heo#m}LCGf~fUYs^4Wug6!AFd2xZCEOeaNMn(UY7AFVNg|lywp4N zrIYyPy&W;Lf$2!*uf@pcZTQ9OKT9q6I~jvV^i1MIlD^bho7AcWfJZAeapFNjIKa)Ih zWn7QD;;6*??}urozuH9}v%0GQ@6&yW6Q2yaKeA1{PAe+*$ii?|Of0fSem|<|!_)On zq$8_mT;Iz|B{+$P$~>_~Udm2>pe>gowML?=F2Ew{vO;0u@;RJjwHz{3ydVmC_?T~y z!_*8BB~Uw5^zM{bo&!{{~cf@?*p(!_I@!nK6l4uq|s z<{utV9VdVb?Y{+aZr)1;s_=>0B3-v#(Q65%{`ca@i`*)-ihklq)cuV|+IzSXUDnyE zrYB|c8mQ-@22t|I0|uGXex#Ws_qam=c4XB1v!g1oWbv{R^ zw>1>uN7EQtBsDZxT=~^Soq(z+rOnsZiIskGDzaSK;whP>{nt~BN@^xYOozix(kT~j zW13L*rdXti7WAcVut}-KPl!g%F{ngjIn8faXh&KB6_yN}S^(R!I`F{nOYjMz%kS^D zS)Mjh`YBRpMC&^-h0u7>aLE})&<{#%f@V)3V@xNltVah&Nw(MnJ*U|jcxhab$4H>W z`oi>GY7jRg*o#9mQz+QB5`<300ynaWJ9o9*O~VC$lW`Z(8j+#4M+P}<$QJKy9xzEm z=LRoGG9ypMyLE>y2I)87Cf_tNo_sl@gP0cEEvZCTwMagt2DTbwKLw@Ep+zFfWj@OE zj*Y;bCv0#}L$1U!jaz9scgqrtOIQ~=Q@=`TzN~Y$kaXvP{|Ho{i3o#u@PKFXLm*bX z^RC6~y`;z&@FRd)MgGQrkEYflWU}90QS17}QEFCRzUN91zaHee0Vn|Jx{ZvqrXyu; zMb+fB*2;lCY*hei6P~K~xBL070lj$uR3#p4yw(8pq;3Ez8q&JAwh8n>u7`lByT81; z)XxCjE7*lI_bgjzq4$+bO`4=R}5mA$XjJZYtc zc!uyQ>4tLH_giqZo&Os+&s=Vz*RR#+T*Ia_`6z))@`MR`o{0|-h({g&fMd8jtTUapA zq-AMuHzDLlKQ(g{9OB0iY9rQEF`&k$2&LbAfoQr93rp~B^gBd|Ow_s0puXZ2s;Yji zC;3E71_~oSWCN>R7teUTP9H<*Sb@*XmFXf$Ef06T$;d3YBFFn>U zp;vp(4nJjD!yavsi8z4cZ_?3r)Yx-=ys)%$hH7puJ@%%x$ayUw+}hjp)I!=%Fa8fD z;@A%yOJdl~y@z(ZfTc^f;4Q;3MTVy7h-~*38Fmy{-i

  • h$T|=OKo;a>h96oRIMY|5v7Bg0eY^t#!}w)Jo+$95vW;~{wXh>r z#El>LbGsVko6xqgfm1mjHZX2IOjMiG`2>CQ8?Dv-(CrWU2qZt!(}uTN(mkMtCAzx( zWA+vRjt>`~SrNmwi~mT{FD!I6Mw?CFUGfng-;ZPLI?^}cuggMwD%;rdLWT`Z1#93! z#3MkK@Fh~2r2R)C(o(R?H3W086B-Lu$AxejT1?*EqhF6`?Jfr}`Ch?+=)jB?%rBfn zN`JN=`y_L}GENg`jZKUGez-@0OQ(D^t%!3%3?ie1yCKY2ACeX`*g^vO<=)xcBp-Fl z<;Q%7G@GyWz;ku5KstWY=nPQvn7tXO0_6VyY4bFld{AcGy(=ju)b+{Aa)2I=^*o42 zU5s%GQ~|FH`cJFrznJjqzsnNpgFueQfqE^MK|rMH;1jlXok@%60}ugZx9Z;m`2GUn ze-Hdq`iu0lk{^*A~^o80jNn2LYU><_MdW`NW4H&)Jfp;KjTP4S6SbmI3qjw6wq zl;%Ou`^jJuxhY-Ej2p__PbIQTO?JfF0z4nJ#2GIdK=(j3Vr6utBAoBo<^{}^o5_=@X`wY6i*~N4eOe;gwjf~i8PPA#`6xsjFUvM484Ie} z+8xV^)J|AKlIwxqP5-5_x-R3syonB@CTKU#8s#(3vm`TpF^RXxj^+Qy(aj^u&vQSc zDh}YY6iIP@mWOH7zeh2}yQD>%o~DUzkog*_Hz#s5#rU!I_-Z-!(B@QehNLE_CgZl( zPF20gxvneY3!_=!wSgU;-5L-6#2YMWY%h8^-a$R^syR>~d#+r9vY6hir2Jm=YoP0H z%=->%W~?>L2hU51@hkN{kKL1%l=avnDn4U#2(~cF3h933cb2>ToPWrA#aXZ7r^V{vH{77B{G9O7NHg|C*{6&bN- zEAITvRC1@kMWgAPr|W$>Mm(urF|(TAeYxDJeA(^6bK{rh=2=*VZfVLg&(Q9q5iZ@U z9c*+PPbB8D=zHV^)Hm`sJqc&?H@!Bx4i=}t{Z|bjNjnH}=yv?*jYf1&rtA#Y`Ouft zZ)VaxO!$UM>T9YDn;EV%v+2n9O8Rwt<#ImN_0Zp#EuH%aw_L*Q2~9B6&$3KETjAXk?eodA8a{eDFoOiR$*}!Ofts&2zg;7 zy`d^XF!`_wBc@|Cs!)Iszvg~=DBDn_MPAgcsGaL}wnma71jt*Wu2S?RA5y^Rxm%3E zL9Hrg9m=Ev_CB<%hu@$GkFJ6*3F+RqMT;|3D+XE2Aa7$pMHBdM{Pe-aH$8lIURF$% zZHneL1|Y!O`ZVEn?=LWXF(SqdhI&?H`2_|>GKz_*A`GHQJ^U#OIJPQeAS|yZcxI&a z8-J3-+s;7tS8whsaj7X!t}++1&%fr5cNI2NEzM(>q!DBhllK@QB_;KmTPqkiTqT~u zVm2bkOJW|jpWki`epn?K#E^UVKVrc#RpyI765~Z$1QCC7{LTRHbeF$*|K0?r%5Duc z#z07M0SHk3O`EiB4`)%8__Ejfx|Nk7--Rmel7zmV-VoVB*T(lbOQp_z>_!sJYU{i^ zKpiTmhh>IN02ZgPwj0<_=&Nou+F4a2(--%U{L1pRTna;q$=U)h94>8*QZWHWB-B5) z3ja+d>8`40VTen_80HnfiWuZa8WHGROP@Xp8J^D zr^^i|N4R-LqQ^Gj2ZTH4xv|bi4EPgv!lJTR@kG8Ep}6=XkhunZi28NhGF)Xt$GypB zvkgz>*!AxK@XCIO>U&3WwE?TppYy(3314}deHx;82*1#gm6eM!D9zk>cg-P_@jr_FrH_Qhl)+beHqF4R$UA`>- zW=rCr7cxCM6~znIabF+#sEi_Va-DDsn;$sg4jhR1u%?WksJVvYT6L|t@}YR))r;s^ zg(0b~hu?hWpKOdm9!=P57l9_{LfeJ$AFDkl+|$ae8Ao*aEzred`vE@!WE#pr_3!&b z_UD3YL{H)XcU0TLK+V}dQhg_f2C2>Z(e`|BMB5!p02WO{tsK4>pZZ`GF8w|29ciAW zDKm(NXKv1I>`Telz`tP}{lmurlq*-icGIf(sHSDTmOZYsH2lZnCmy7fu=9sMffLZ@V(L z@$rf}+`F{wHGx3S|1BHBSaZY~RQQ#G^OF}el4m4z$Jh*bG_IBf1WPL^{q5p zWA`fp?40Izd&D!DanQZndjKx}GL8Ie)5AY$RX1#t#rQpi_u=OndZF0XdnKI(f$Ttv}dn$s{h4kM;w-CD+U{M zjqsgSez3oa5_h_9Ln0?NLQ-0SZS-`!f{YVei_P{V6p>t~|%kQnif6@vMP;=wRj zQM!W>&>th5eQL7m$3S5oQ`j*cmwtwc@~dWA&J9_gVMbnIekoRVS_OK8sDy}@-PPK{ zU;^q_rgcnU5kL@sQedZq5$>qOFEiK~GVIB-YGF3y+2%SfgZDOKJYcSY(5eez0&MiY z%R6bMSyl(f_Yth=Pm|^C?2Mj0 zkg5)0t`FtynY-Py-)S@|Y%7g~YM|^qzr2x$5N5OwIQ8r<#gE2e&vNCbaw#z4ao^Qs z*i-Dc)Wi~ckl5v$e3RN`V0&-us)H>U(L9BsAP*}ddoVU^%LGbE;70adN*+kr_^auN zIQ47OI+D&s^nRw)-5oSc!Q^;}#9oO6lm70Rk%i)Q_o5*LUK8lIPcYdR*C0T4-^L4vg1A=Qb>r2 zi5h0g=hy1Ov*v^tKO49q*ABdbQJQKr=Bubt7ep_?K$#Hvy$#D%}BSU`|wA^9N1A!TN}u)7F=l zAMvye0b;!68Ohq!C6s{w0emd*7|C_H6oXgRC18AtSRqyeP4X^U+MG$+&;X*9loy*b$S8rS|bEujGO!6 zB1VO@oeArg1Gb$BNzyO{8`o~?%#V%cP3mVlPLFp007q2~ARwo)TBGkx=6j7RmxGsC z>g-Y|53&@>i)2FGzRZneLWU`5m?9TKW=zd_mN==EA-o8d?W6fP#>IIB`<3mL(=8Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D0k}y-K~zXf?Ug-C z13?gm{Sp2)yL2h-1dEhuENl*Jt`M}b^uWSStkR_r#6r@gJ3F!Pz-D~jbvMjizV1Nb z40&M4&hBP2?|kTi?ErfbePO$ZFSB>7&#VnZu|b>CkSQSs35E;<4~!xD4Oyx)p9 zDoFqtR-S{KD)A3u{bgy0ft@8WgSqnGX`=OP~lXm(HWOlt8`FTEu;B_RMGX$xM7;yg0_f znmv(or?rUKO6k4=T~sy(x)9}kRlx_{^c_ng)bsgkbOc|nwG(Hxnb|^UAp)xzLIMgb z1udM2r5WfV!pOD;a2m6&{wdT$qIuQ=wM+94f%Zas{Z%CbJT^L`BD_|rjj$Q(A$t${ z@wPNG9Z`R$Iq>V+On^^7rgTSO_*|U%tfD20tc2mT~51 l%d=6$e_=18FYJH_vu~m*JZCJYujT*%002ovPDHLkV1jD`=sy4e diff --git a/umn/source/_static/images/en-us_image_0000001988387381.png b/umn/source/_static/images/en-us_image_0000001988387381.png deleted file mode 100644 index 5521f5f0608053962d37e0b57e4785b88312b73d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 547 zcmV+;0^I$HP)Px#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D0k}y-K~zXf?Ug-C z13?gm{Sp2)yL2h-1dEhuENl*Jt`M}b^uWSStkR_r#6r@gJ3F!Pz-D~jbvMjizV1Nb z40&M4&hBP2?|kTi?ErfbePO$ZFSB>7&#VnZu|b>CkSQSs35E;<4~!xD4Oyx)p9 zDoFqtR-S{KD)A3u{bgy0ft@8WgSqnGX`=OP~lXm(HWOlt8`FTEu;B_RMGX$xM7;yg0_f znmv(or?rUKO6k4=T~sy(x)9}kRlx_{^c_ng)bsgkbOc|nwG(Hxnb|^UAp)xzLIMgb z1udM2r5WfV!pOD;a2m6&{wdT$qIuQ=wM+94f%Zas{Z%CbJT^L`BD_|rjj$Q(A$t${ z@wPNG9Z`R$Iq>V+On^^7rgTSO_*|U%tfD20tc2mT~51 l%d=6$e_=18FYJH_vu~m*JZCJYujT*%002ovPDHLkV1jD`=sy4e diff --git a/umn/source/attack_defense/attack_defense_overview.rst b/umn/source/attack_defense/attack_defense_overview.rst index ecbe7fb..6f8611c 100644 --- a/umn/source/attack_defense/attack_defense_overview.rst +++ b/umn/source/attack_defense/attack_defense_overview.rst @@ -49,6 +49,8 @@ The following methods can be used: | Virtual patch | Hot patches are provided for IPS at the network layer to intercept high-risk remote attacks in real time and prevent service interruption during vulnerability fixing. | | | | | | | | | | Updated rules are added to the virtual patch library first. You can determine whether to add the rules to the basic defense library. | | | + | | | | | + | | To add defense rules, enable this function to apply virtual patch rules. The protection action can be manually modified. | | | +-------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------+ | Custom IPS signature (supported only by the professional edition) | If the built-in rule library cannot meet your requirements, you can customize signature rules. | The check types are the same as those of **Basic defense**. | For details, see :ref:`Customizing IPS Signatures `. | | | | | | diff --git a/umn/source/attack_defense/blocking_network_attacks.rst b/umn/source/attack_defense/blocking_network_attacks.rst index 72f5ab1..099ebd6 100644 --- a/umn/source/attack_defense/blocking_network_attacks.rst +++ b/umn/source/attack_defense/blocking_network_attacks.rst @@ -27,7 +27,7 @@ Adjusting the IPS Protection Mode to Block Network Attacks .. note:: - - You are advised to use the **observe** mode for a period of time before using the **intercept** mode. For details about how to view attack event logs, see :ref:`Attack Event Logs ` + - You are advised to use the **observe** mode for a period of time before using the **intercept** mode. For details about how to view attack event logs, see :ref:`Attack Event Logs `. - If packets are incorrectly blocked by a defense rule, you can modify the action of the rule in the basic defense rule library. For details, see :ref:`IPS Rule Management `. .. _cfw_01_0032__section61321527141315: diff --git a/umn/source/change_history.rst b/umn/source/change_history.rst index 8d9c49a..25034a9 100644 --- a/umn/source/change_history.rst +++ b/umn/source/change_history.rst @@ -8,6 +8,12 @@ Change History +-----------------------------------+------------------------------------------------------------------------------------------+ | Date | Description | +===================================+==========================================================================================+ +| 2024-10-12 | This is the fifth official release. | +| | | +| | Optimized: | +| | | +| | Adapted to the new layout in :ref:`Checking the Dashboard `. | ++-----------------------------------+------------------------------------------------------------------------------------------+ | 2024-09-19 | This is the fourth official release. | | | | | | Added: | diff --git a/umn/source/checking_the_dashboard.rst b/umn/source/checking_the_dashboard.rst index 650f04d..bdb878d 100644 --- a/umn/source/checking_the_dashboard.rst +++ b/umn/source/checking_the_dashboard.rst @@ -20,154 +20,111 @@ Checking the Dashboard #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. -#. (Optional) If the current account has only one firewall instance, the firewall details page will be automatically displayed. In this case, skip this step. +#. (Optional) Switch or view firewall instances. - Check the information about each firewall instance under the account. Click **View** in the **Operation** column. + - Switch to another firewall instance: Select a firewall from the drop-down list in the upper left corner of the page. - .. table:: **Table 1** Firewall instance parameters + - View firewall instance information: Click **Firewall List** in the upper right corner. For details about parameters, see :ref:`Firewall instance information `. - +--------------------------------+---------------------------------------------------------------+ - | Parameter | Description | - +================================+===============================================================+ - | Name/ID | Name and ID of the firewall. | - +--------------------------------+---------------------------------------------------------------+ - | Status | Firewall status. | - +--------------------------------+---------------------------------------------------------------+ - | Edition | Firewall edition. | - +--------------------------------+---------------------------------------------------------------+ - | Available EIP Protection Quota | Maximum number of EIPs that can be protected by the firewall. | - +--------------------------------+---------------------------------------------------------------+ - | Peak Traffic Protection | Maximum peak traffic that can be protected by the firewall. | - +--------------------------------+---------------------------------------------------------------+ - | Billing Mode | Billing mode of the current firewall. | - +--------------------------------+---------------------------------------------------------------+ - | Enterprise Project | Enterprise project that the firewall belongs to. | - +--------------------------------+---------------------------------------------------------------+ - | Operation | Check instance details. | - +--------------------------------+---------------------------------------------------------------+ + .. _cfw_01_0009__table14973162216315: -#. View details about the firewall. For more information, see :ref:`Table 2 `. + .. table:: **Table 1** Firewall instance information - .. _cfw_01_0009__table10415235151815: + +--------------------------------+---------------------------------------------------------------+ + | Parameter | Description | + +================================+===============================================================+ + | Firewall Name/ID | Name and ID of the firewall. | + +--------------------------------+---------------------------------------------------------------+ + | Status | Firewall status. | + +--------------------------------+---------------------------------------------------------------+ + | Edition | Edition of a firewall. | + +--------------------------------+---------------------------------------------------------------+ + | Available EIP Protection Quota | Maximum number of EIPs that can be protected by the firewall. | + +--------------------------------+---------------------------------------------------------------+ + | Peak Traffic Protection | Maximum peak traffic that can be protected by the firewall. | + +--------------------------------+---------------------------------------------------------------+ + | Billing Mode | Billing mode of the current firewall. | + +--------------------------------+---------------------------------------------------------------+ + | Enterprise Project | Enterprise project that the firewall belongs to. | + +--------------------------------+---------------------------------------------------------------+ + | Operation | Check instance details. | + +--------------------------------+---------------------------------------------------------------+ - .. table:: **Table 2** Detailed firewall information +#. In the **Resource Protection Overview** area, view the protection status of all cloud resources (EIPs and VPCs) in the current region under the current account. - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +=====================================+================================================================================================================================+ - | Firewall Name | Firewall instance name. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Firewall ID | Firewall instance ID. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Status | Firewall status. It takes about 5 minutes to update the firewall status after purchase or unsubscription. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Engine | Firewall engine type. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Used/Available EIP Protection Quota | *Number of protected EIPs*\ **/**\ *Total number of EIPs* under a CFW instance. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Protected VPCs/VPC Protection Quota | *Number of protected VPCs*\ **/**\ *Total number of VPCs* under a firewall instance. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Peak Traffic Protection | Peak north-south traffic that can be protected. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Protected Peak Traffic Between VPCs | Peak east-west traffic that can be protected. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Used/Available Protection Rules | *Number of created protection rules*\ **/**\ *Total number of protection rules that can be created* under a firewall instance. | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - | Billing Mode | Billing mode | - +-------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ +#. View firewall instance information. -#. View firewall protection statistics. For more information, see :ref:`Table 3 `. + :ref:`Table 2 ` describes the parameters in the **Firewall Details** area on the right part of the page. - - EIP Protection - - Inter-VPC Protection + .. _cfw_01_0009__table16203648134114: + .. table:: **Table 2** Firewall instance details - .. figure:: /_static/images/en-us_image_0000001772296201.png - :alt: **Figure 1** Protection statistics + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | | Description | + +=======================+======================================+================================================================================================================================+ + | Basic Information | Version | Firewall edition. Standard and professional editions are supported. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Firewall Name | Firewall instance name. You can click |image2| to change the name. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Firewall ID | Firewall instance ID. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Status | Firewall status. It takes about 5 minutes to update the firewall status after purchase or unsubscription. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Enterprise Project | Enterprise project that the firewall belongs to. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | Flavor | Used/Available EIP Protection Quota | *Number of protected EIPs*\ **/**\ *Total number of EIPs* under the current CFW instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Used/Available VPC Protection Quota | *Number of protected VPCs*\ **/**\ *Total number of VPCs* under a firewall instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Internet Border Protection Bandwidth | Maximum inbound or outbound traffic of all EIPs protected by CFW. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | VPC Border Protection Bandwidth | Peak east-west traffic that can be protected. | + | | | | + | | | Maximum total traffic of all VPCs protected by CFW. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Used/Available Protection Rules | *Number of created protection rules*\ **/**\ *Total number of protection rules that can be created* under a firewall instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | Flavor | Available EIP Protection Quota | Number of EIPs protected by the current firewall instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Available VPC Protection Quotas | Total number of VPCs that can be protected by the current firewall instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | CFW instance | Firewall instance specifications. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | | Used/Available Protection Rules | *Number of created protection rules*\ **/**\ *Total number of protection rules that can be created* under a firewall instance. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | Other Information | Billing Mode | Billing mode. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ + | Tags | | Configure tags to identify firewalls so that you can classify and trace firewall instances. | + +-----------------------+--------------------------------------+--------------------------------------------------------------------------------------------------------------------------------+ - **Figure 1** Protection statistics +#. On the **Operations Dashboard** page, view the overall protection data of cloud resources. - .. _cfw_01_0009__table107281510153: + Click the **Internet Boundaries** or **Inter-VPC Borders** tab to view the corresponding overall protection data. - .. table:: **Table 3** Firewall protection statistics + In the upper right corner, change the query range. - +-----------------+---------------------------------------------------------------------------------------+ - | Parameter | Description | - +=================+=======================================================================================+ - | Total EIPs | Total number of EIPs, both the protected and the unprotected. | - +-----------------+---------------------------------------------------------------------------------------+ - | Total VPCs | Total number of VPCs, both the protected and the unprotected. | - +-----------------+---------------------------------------------------------------------------------------+ - | Unprotected | The number of unprotected EIPs/VPCs. | - +-----------------+---------------------------------------------------------------------------------------+ - | Protected | Number of protected EIPs/VPCs. | - +-----------------+---------------------------------------------------------------------------------------+ - | Protection Rate | The percentage of the number of protected EIPs/VPCs to the total number of EIPs/VPCs. | - +-----------------+---------------------------------------------------------------------------------------+ + - View the blocking results of access control policies and the maximum inbound and outbound traffic. + - **Traffic Trend** displays the inbound, outbound, and overall traffic trends.. -#. **Operations Dashboard**: View the overall Internet border and VPC border protection details. For details about the parameters, see :ref:`Table 4 `. + .. table:: **Table 3** Values - The query time can be **Last 1 hour**, **Last 24 hours**, or **Last 7 days**. + +---------------+-----------------------------------+-----------------------------------+ + | Time Range | Average | Maximum | + +===============+===================================+===================================+ + | Last 1 hour | Average value within every minute | Maximum value within every minute | + +---------------+-----------------------------------+-----------------------------------+ + | Last 24 hours | Average value within 5 minutes | Maximum value within 5 minutes | + +---------------+-----------------------------------+-----------------------------------+ + | Last 7 days | Average value within one hour | Maximum value within one hour | + +---------------+-----------------------------------+-----------------------------------+ + .. note:: - .. figure:: /_static/images/en-us_image_0000001772299481.png - :alt: **Figure 2** Security Dashboard + Data is updated in real time based on traffic statistics. - **Figure 2** Security Dashboard - - .. _cfw_01_0009__table184404359171: - - .. table:: **Table 4** Operations Dashboard - - +-----------------------+-------------------------------------------------------------------+ - | Parameter | Description | - +=======================+===================================================================+ - | Blocked Accesses | Number of times accesses are blocked based on protection rules. | - +-----------------------+-------------------------------------------------------------------+ - | Intrusion Prevention | Intrusion prevention mode and the number of intercepted attacks. | - +-----------------------+-------------------------------------------------------------------+ - | Peak Outbound Traffic | Maximum traffic initiated from internal services to the Internet. | - +-----------------------+-------------------------------------------------------------------+ - | Peak Inbound Traffic | Maximum traffic initiated from the Internet to internal servers. | - +-----------------------+-------------------------------------------------------------------+ - -#. **Traffic Situation**: View the traffic trend at the Internet border and VPC border. For details, see :ref:`Table 5 `. - - The query time can be **Last 1 hour**, **Last 24 hours**, or **Last 7 days**. - - - .. figure:: /_static/images/en-us_image_0000001772421057.png - :alt: **Figure 3** Traffic Situation - - **Figure 3** Traffic Situation - - .. _cfw_01_0009__table111816441112: - - .. table:: **Table 5** Traffic trend parameters - - ============== ====================================================== - Parameter Description - ============== ====================================================== - Attacks Blocked and allowed accesses. - Access Control Traffic blocked and allowed based on protection rules. - ============== ====================================================== - -#. In the **Traffic Trend** area, click **Internet Boundaries** or **Inter-VPC Borders** to check the corresponding statistics. - - - .. figure:: /_static/images/en-us_image_0000001772301841.png - :alt: **Figure 4** Traffic Trend - - **Figure 4** Traffic Trend - - **Internet Boundaries**: Select an EIP and a query duration from the drop-down list boxes to view inbound and outbound traffic. - - VPC boundary: Select a query duration to view the traffic between VPCs. - - .. note:: - - The traffic data of all EIPs and VPCs under the current account is displayed. - -#. Configure tags to identify firewalls so that you can classify and trace firewall instances. + - **Attacks**: View the traffic blocked or allowed by intrusion prevention. + - **Access Control**: View the traffic blocked or allowed by access control policies. .. |image1| image:: /_static/images/en-us_image_0000001259322747.png +.. |image2| image:: /_static/images/en-us_image_0000001986387925.png diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/adding_blacklist_or_whitelist_items_to_block_or_allow_traffic.rst b/umn/source/configuring_access_control_policies_to_control_traffic/adding_blacklist_or_whitelist_items_to_block_or_allow_traffic.rst index d128a1d..5abafad 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/adding_blacklist_or_whitelist_items_to_block_or_allow_traffic.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/adding_blacklist_or_whitelist_items_to_block_or_allow_traffic.rst @@ -20,7 +20,7 @@ Specification Limitations - CFW supports up to 2,000 blacklist items and 2,000 whitelist items. If there are too many IP addresses to be specified, you can put them in an IP address group and select the IP address group when configuring protection rules. - - For details about how to add an IP address group, see :ref:`Adding Custom IP Address and Address Groups `. + - For details about how to add an IP address group, see :ref:`Adding User-defined IP Addresses and Address Groups `. - For details about how to add a protection rule, see :ref:`Adding Protection Rules to Block or Allow Traffic `. - To protect private IP addresses, use the professional edition firewall and enable :ref:`VPC border firewall ` protection. diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/adding_protection_rules_to_block_or_allow_traffic.rst b/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/adding_protection_rules_to_block_or_allow_traffic.rst index 1ddc750..9daa6dd 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/adding_protection_rules_to_block_or_allow_traffic.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/adding_protection_rules_to_block_or_allow_traffic.rst @@ -65,127 +65,127 @@ Adding an Internet Boundary Protection Rule .. table:: **Table 1** Internet boundary rule parameters - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+==========================================================================================================================================================================================================================================================================================================================================+ - | Rule Type | Protection type of a rule. | - | | | - | | - **EIP**: Protect EIP traffic. Only EIPs can be configured. | - | | - **NAT**: Protect NAT traffic. Private IP addresses can be configured. | - | | | - | | .. note:: | - | | | - | | By default, EIP rules are configured. NAT rules can be configured after the professional firewall and :ref:`VPC border firewall ` are configured. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Name | Name of the custom security policy. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Direction | Select a traffic direction if you set **Protection Rule** to **EIP protection**. | - | | | - | | - **Inbound**: Cloud assets (EIPs) are accessed from the Internet. | - | | - **Outbound**: Cloud assets (EIPs) access the Internet. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Source | Source address of access traffic. | - | | | - | | - **IP address**: Enter EIPs. This parameter can be configured in the following formats: | - | | | - | | - A single EIP, for example, *xx.xx.*\ **10.5** | - | | - Consecutive EIPs, for example, *xx.xx.*\ **0.2-**\ *xx.xx.*\ **0.10** | - | | - EIP segment, for example, *xx.xx.*\ **2.0/24** | - | | | - | | - IP address group: A collection of EIPs. For details about how to add custom IP address groups, see :ref:`Adding Custom IP Address and Address Groups `. For details about how to add a predefined address group, see :ref:`Viewing a Predefined Address Group `. | - | | | - | | .. note:: | - | | | - | | If **Direction** is set to **Inbound**, a predefined address group can be configured for the source address. | - | | | - | | - **Countries and regions**: If **Direction** is set to **Inbound**, you can control access based on continents and countries. | - | | - **Any**: any source address | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Destination | Destination address of access traffic. | - | | | - | | - **IP address**: Enter EIPs. This parameter can be configured in the following formats: | - | | | - | | - A single EIP, for example, *xx.xx.*\ **10.5** | - | | - Consecutive EIPs, for example, *xx.xx.*\ **0.2-**\ *xx.xx.*\ **0.10** | - | | - EIP segment, for example, *xx.xx.*\ **2.0/24** | - | | | - | | - **IP address group**: A collection of EIPs. For details about how to add custom IP address groups, see :ref:`Adding Custom IP Address and Address Groups `. | - | | - **Countries and regions**: If **Direction** is set to **Outbound**, you can control access based on continents countries. | - | | - **Domain name/Domain name group**: When **Direction** is set to **Outbound**, the protection of the domain name or domain name group is supported. | - | | | - | | - **Application**: Supports the protection for domain names or wildcard domain names. Application-layer protocols such as HTTP and HTTPS are supported. Domain names are used for matching. | - | | - **Network**: Supports protection for one or multiple domain names. Applies to network-layer protocols and supports all protocols. The resolved IP addresses are used for matching. | - | | | - | | .. note:: | - | | | - | | - To protect the domain names of HTTP and HTTPS applications, you can select any options. | - | | - To protect the wildcard domain names of HTTP and HTTPS applications, select **Application** and then select any option from the drop-down list. | - | | - To protect a single domain name of other application types (such as FTP, MySQL, and SMTP), select **Network** and select any option from the drop-down list. (If **Application Domain Name Group** is selected, up to 600 IP addresses can be resolved.) | - | | - To protect multiple domain names of other application types (such as FTP, MySQL, and SMTP), select **Network** and **Network Domain Group** from the drop-down list. | - | | - If you need to configure the wildcard domain names or application domain name groups of the HTTP/HTTPS applications, and the network domain groups of other application types for the same domain name, ensure that the priority of the **Network** protection rule is higher than that of the **Application** protection rule. | - | | - For details about application and network types, see :ref:`Adding a Domain Name Group `. | - | | | - | | - **Any**: any destination address | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Service | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | - | | | - | | - **Protocol Type**: The value can be TCP, UDP, or ICMP. | - | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | - | | | - | | .. note:: | - | | | - | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | - | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | - | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | - | | | - | | - **Service group**: A collection of services (protocols, source ports, and destination ports) is supported. For details about how to add a custom service group, see :ref:`Adding a Custom Service Group `. For details about a pre-defined service group, see :ref:`Viewing a Predefined Service Group `. | - | | - **Any**: any protocol type or port number | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Action | Set the action to be taken when traffic passes through the firewall. | - | | | - | | - **Allow**: Traffic is forwarded. | - | | - **Block**: Traffic is not forwarded. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | - | | | - | | - **Yes**: Configure the long connection duration. | - | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | - | | | - | | - TCP: 1800s | - | | - UDP: 60s | - | | | - | | .. note:: | - | | | - | | Up to 50 rules can be configured with long connections. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | - | | | - | | Configure the long connection duration. Configure the hour, minute, and second. | - | | | - | | .. note:: | - | | | - | | The duration range is 1 second to 1000 days. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Tags | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Priority | Priority of the rule. Its value can be: | - | | | - | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | - | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | - | | | - | | .. note:: | - | | | - | | - A smaller value indicates a higher priority. | - | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Status | Whether a policy is enabled. | - | | | - | | |image2|: enabled | - | | | - | | |image3|: disabled | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Description | (Optional) Usage and application scenario | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=================================================================================================================================================================================================================================================================================================================================================+ + | Rule Type | Protection type of a rule. | + | | | + | | - **EIP**: Protect EIP traffic. Only EIPs can be configured. | + | | - **NAT**: Protect NAT traffic. Private IP addresses can be configured. | + | | | + | | .. note:: | + | | | + | | By default, EIP rules are configured. NAT rules can be configured after the professional firewall and :ref:`VPC border firewall ` are configured. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Name | Name of the custom security policy. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Direction | Select a traffic direction if you set **Protection Rule** to **EIP protection**. | + | | | + | | - **Inbound**: Cloud assets (EIPs) are accessed from the Internet. | + | | - **Outbound**: Cloud assets (EIPs) access the Internet. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source | Source address of access traffic. | + | | | + | | - **IP address**: Enter EIPs. This parameter can be configured in the following formats: | + | | | + | | - A single EIP, for example, *xx.xx.*\ **10.5** | + | | - Consecutive EIPs, for example, *xx.xx.*\ **0.2-**\ *xx.xx.*\ **0.10** | + | | - EIP segment, for example, *xx.xx.*\ **2.0/24** | + | | | + | | - IP address group: A collection of EIPs. For details about how to add custom IP address groups, see :ref:`Adding User-defined IP Addresses and Address Groups `. For details about how to add a predefined address group, see :ref:`Viewing a Predefined Address Group `. | + | | | + | | .. note:: | + | | | + | | If **Direction** is set to **Inbound**, a predefined address group can be configured for the source address. | + | | | + | | - **Countries and regions**: If **Direction** is set to **Inbound**, you can control access based on continents, countries, and regions. | + | | - **Any**: any source address | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination | Destination address of access traffic. | + | | | + | | - **IP address**: Enter EIPs. This parameter can be configured in the following formats: | + | | | + | | - A single EIP, for example, *xx.xx.*\ **10.5** | + | | - Consecutive EIPs, for example, *xx.xx.*\ **0.2-**\ *xx.xx.*\ **0.10** | + | | - EIP segment, for example, *xx.xx.*\ **2.0/24** | + | | | + | | - **IP address group**: You can add multiple EIPs to an IP address group. For details about how to add a custom IP address group, see :ref:`Adding User-defined IP Addresses and Address Groups `. | + | | - **Countries and regions**: If **Direction** is set to **Outbound**, you can control access based on continents, countries, and regions. | + | | - **Domain name/Domain name group**: When **Direction** is set to **Outbound**, the protection of the domain name or domain name group is supported. | + | | | + | | - **Application**: Supports the protection for domain names or wildcard domain names. Application-layer protocols such as HTTP and HTTPS are supported. Domain names are used for matching. | + | | - **Network**: Supports protection for one or multiple domain names. Applies to network-layer protocols and supports all protocols. The resolved IP addresses are used for matching. | + | | | + | | .. note:: | + | | | + | | - To protect the domain names of HTTP and HTTPS applications, you can select any options. | + | | - To protect the wildcard domain names of HTTP and HTTPS applications, select **Application** and then select any option from the drop-down list. | + | | - To protect a single domain name of other application types (such as FTP, MySQL, and SMTP), select **Network** and select any option from the drop-down list. (If **Application Domain Name Group** is selected, up to 600 IP addresses can be resolved.) | + | | - To protect multiple domain names of other application types (such as FTP, MySQL, and SMTP), select **Network** and **Network Domain Group** from the drop-down list. | + | | - If you need to configure the wildcard domain names or application domain name groups of the HTTP/HTTPS applications, and the network domain groups of other application types for the same domain name, ensure that the priority of the **Network** protection rule is higher than that of the **Application** protection rule. | + | | - For details about application and network types, see :ref:`Adding a Domain Name Group `. | + | | | + | | - **Any**: any destination address | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Service | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | + | | | + | | - **Protocol Type**: The value can be TCP, UDP, or ICMP. | + | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | + | | | + | | .. note:: | + | | | + | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | + | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | + | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | + | | | + | | - **Service group**: A service group is a set of services (protocols, source ports, and destination ports). For details about how to add a user-defined service group, see :ref:`Adding a User-defined Service Group `. For details about predefined service groups, see :ref:`Viewing a Predefined Service Group `. | + | | - **Any**: any protocol type or port number | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Action | Set the action to be taken when traffic passes through the firewall. | + | | | + | | - **Allow**: Traffic is forwarded. | + | | - **Block**: Traffic is not forwarded. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | + | | | + | | - **Yes**: Configure the long connection duration. | + | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | + | | | + | | - TCP: 1800s | + | | - UDP: 60s | + | | | + | | .. note:: | + | | | + | | Up to 50 rules can be configured with long connections. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | + | | | + | | Configure the long connection duration. Configure the hour, minute, and second. | + | | | + | | .. note:: | + | | | + | | The duration range is 1 second to 1000 days. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Tags | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Priority | Priority of the rule. Its value can be: | + | | | + | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | + | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | + | | | + | | .. note:: | + | | | + | | - A smaller value indicates a higher priority. | + | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Status | Whether a policy is enabled. | + | | | + | | |image2|: enabled | + | | | + | | |image3|: disabled | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Description | (Optional) Usage and application scenario | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ #. Click **OK** to complete the protection rule configuration. @@ -207,96 +207,101 @@ Adding a VPC Border Protection Rule .. table:: **Table 2** VPC border protection rule parameters - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+=====================================================================================================================================================================================================================+ - | Name | Name of the custom security policy. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Direction | You do not need to configure it for an inter-VPC protection rule. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Source | Source address of access traffic. | - | | | - | | - **IP address**: You can set a single IP address, consecutive IP addresses, or an IP address segment. | - | | | - | | - A single IP address, for example, **192.168.10.5** | - | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | - | | - Address segment, for example, **192.168.2.0/24** | - | | | - | | - **IP address group**: A collection of IP addresses. For details, see :ref:`Adding an IP Address Group `. | - | | - **Any**: any source address | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Destination | Destination address of access traffic. | - | | | - | | - **IP address**: You can set a single IP address, consecutive IP addresses, or an IP address segment. | - | | | - | | - A single IP address, for example, **192.168.10.5** | - | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | - | | - Address segment, for example, **192.168.2.0/24** | - | | | - | | - **IP address group**: A collection of IP addresses. For details, see :ref:`Adding an IP Address Group `. | - | | - **Any**: any destination address | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Service | Set the protocol type and port number of the access traffic. | - | | | - | | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | - | | | - | | - **Protocol Type**: The value can be **TCP**, **UDP**, or **ICMP**. | - | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | - | | | - | | .. note:: | - | | | - | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | - | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | - | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | - | | | - | | - **Service group**: A collection of services (protocols, source ports, and destination ports) is supported. For details about how to add a service group, see :ref:`Adding a Custom Service Group `. | - | | - **Any**: any protocol type or port number | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Action | Set the action to be taken when traffic passes through the firewall. | - | | | - | | - **Allow**: Traffic is forwarded. | - | | - **Block**: Traffic is not forwarded. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | - | | | - | | - **Yes**: Configure the long connection duration. | - | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | - | | | - | | - TCP: 1800s | - | | - UDP: 60s | - | | | - | | .. note:: | - | | | - | | Up to 50 rules can be configured with long connections. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | - | | | - | | Configure the long connection duration. Configure the hour, minute, and second. | - | | | - | | .. note:: | - | | | - | | The duration range is 1 second to 1000 days. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Tag | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Priority | Priority of the rule. Its value can be: | - | | | - | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | - | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | - | | | - | | .. note:: | - | | | - | | - A smaller value indicates a higher priority. | - | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Status | Whether a policy is enabled. | - | | | - | | |image5|: enabled | - | | | - | | |image6|: disabled | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Description | (Optional) Usage and application scenario | - +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+============================================================================================================================================================================================================================================================================================================================================+ + | Name | Name of the custom security policy. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Direction | You do not need to configure it for an inter-VPC protection rule. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source | Source address of access traffic. | + | | | + | | - **IP address**: You can set a single IP address, consecutive IP addresses, or an IP address segment. | + | | | + | | - A single IP address, for example, **192.168.10.5** | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | + | | - Address segment, for example, **192.168.2.0/24** | + | | | + | | - **IP address group**: A collection of IP addresses. For details, see :ref:`Adding an IP Address Group `. | + | | - **Any**: any source address | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination | Destination address of access traffic. | + | | | + | | - **IP address**: You can set a single IP address, consecutive IP addresses, or an IP address segment. | + | | | + | | - A single IP address, for example, **192.168.10.5** | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | + | | - Address segment, for example, **192.168.2.0/24** | + | | | + | | - **IP address group**: A collection of IP addresses. For details, see :ref:`Adding an IP Address Group `. | + | | | + | | - **Domain Name/Domain Name Group**: Domain names or domain groups can be protected. | + | | | + | | **Application**: Supports the protection for domain names or wildcard domain names. Application-layer protocols such as HTTP and HTTPS are supported. Domain names are used for matching. | + | | | + | | - **Any**: any destination address | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Service | Set the protocol type and port number of the access traffic. | + | | | + | | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | + | | | + | | - **Protocol Type**: The value can be **TCP**, **UDP**, or **ICMP**. | + | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | + | | | + | | .. note:: | + | | | + | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | + | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | + | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | + | | | + | | - **Service group**: A collection of services (protocols, source ports, and destination ports) is supported. For details about how to add a custom service group, see :ref:`Adding a User-defined Service Group `. For details about predefined service groups, see :ref:`Viewing a Predefined Service Group `. | + | | - **Any**: any protocol type or port number | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Action | Set the action to be taken when traffic passes through the firewall. | + | | | + | | - **Allow**: Traffic is forwarded. | + | | - **Block**: Traffic is not forwarded. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | + | | | + | | - **Yes**: Configure the long connection duration. | + | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | + | | | + | | - TCP: 1800s | + | | - UDP: 60s | + | | | + | | .. note:: | + | | | + | | Up to 50 rules can be configured with long connections. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | + | | | + | | Configure the long connection duration. Configure the hour, minute, and second. | + | | | + | | .. note:: | + | | | + | | The duration range is 1 second to 1000 days. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Tag | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Priority | Priority of the rule. Its value can be: | + | | | + | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | + | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | + | | | + | | .. note:: | + | | | + | | - A smaller value indicates a higher priority. | + | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Status | Whether a policy is enabled. | + | | | + | | |image5|: enabled | + | | | + | | |image6|: disabled | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Description | (Optional) Usage and application scenario | + +-----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ 6. Click **OK** to complete the protection rule configuration. @@ -319,105 +324,118 @@ Adding a NAT Traffic Protection Rule .. table:: **Table 3** SNAT protection rule parameters - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+========================================================================================================================================================================================================================================================================================================================================+ - | Rule Type | Select **NAT** to protect the traffic of the NAT gateway. Private IP addresses can be configured. | - | | | - | | .. note:: | - | | | - | | To select **NAT**, ensure that: | - | | | - | | - The professional edition firewall is used. | - | | - The VPC border firewalls have been configured. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Name | Name of the custom security policy. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Direction | Select **SNAT**. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Source | Source address of access traffic. | - | | | - | | - **IP address**: Enter private IP addresses. You can set a single IP address, consecutive IP addresses, or an IP address segment. | - | | | - | | - A single IP address, for example, **192.168.10.5** | - | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | - | | - Address segment, for example, **192.168.2.0/24** | - | | | - | | - **IP address group**: A collection of private IP addresses. For details, see :ref:`Adding Custom IP Address and Address Groups `. | - | | - **Countries and regions**: A continent or a country | - | | - **Any**: any source address | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Destination | Destination address of access traffic. | - | | | - | | - **IP address**: Enter private IP addresses. You can set a single IP address, consecutive IP addresses, or an IP address segment. | - | | | - | | - A single IP address, for example, **192.168.10.5** | - | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | - | | - Address segment, for example, **192.168.2.0/24** | - | | | - | | - **IP address group**: A collection of private IP addresses. For details about how to add IP address groups, see :ref:`Adding Custom IP Address and Address Groups `. | - | | - **Countries and regions**: A continent or a country | - | | - **Any**: any destination address | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Service | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | - | | | - | | - **Protocol Type**: The value can be TCP, UDP, or ICMP. | - | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | - | | | - | | .. note:: | - | | | - | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | - | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | - | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | - | | | - | | - **Service group**: A collection of services (protocols, source ports, and destination ports) is supported. For details about how to add a custom service group, see :ref:`Adding a Custom Service Group `. For details about a pre-defined service group, see :ref:`Viewing a Predefined Service Group `. | - | | - **Any**: any protocol type or port number | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Action | Set the action to be taken when traffic passes through the firewall. | - | | | - | | - **Allow**: Traffic is forwarded. | - | | - **Block**: Traffic is not forwarded. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | - | | | - | | - **Yes**: Configure the long connection duration. | - | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | - | | | - | | - TCP: 1800s | - | | - UDP: 60s | - | | | - | | .. note:: | - | | | - | | Up to 50 rules can be configured with long connections. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | - | | | - | | Configure the long connection duration. Configure the hour, minute, and second. | - | | | - | | .. note:: | - | | | - | | The duration range is 1 second to 1000 days. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Tags | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Priority | Priority of the rule. Its value can be: | - | | | - | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | - | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | - | | | - | | .. note:: | - | | | - | | - A smaller value indicates a higher priority. | - | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Status | Whether a policy is enabled. | - | | | - | | |image8|: enabled | - | | | - | | |image9|: disabled | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Description | (Optional) Usage and application scenario | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=================================================================================================================================================================================================================================================================================================================================================+ + | Rule Type | Select **NAT** to protect the traffic of the NAT gateway. Private IP addresses can be configured. | + | | | + | | .. note:: | + | | | + | | To select **NAT**, ensure that: | + | | | + | | - The professional edition firewall is used. | + | | - The VPC border firewalls have been configured. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Name | Name of the custom security policy. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Direction | Select **SNAT**. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source | Source address of access traffic. | + | | | + | | - **IP address**: Enter private IP addresses. You can set a single IP address, consecutive IP addresses, or an IP address segment. | + | | | + | | - A single IP address, for example, **192.168.10.5** | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | + | | - Address segment, for example, **192.168.2.0/24** | + | | | + | | - **IP address group**: You can add multiple private IP addresses to an IP address group. For details about how to add a IP address group, see :ref:`Adding User-defined IP Addresses and Address Groups `. | + | | - **Countries and regions**: A continent, a country, or a region | + | | - **Any**: any source address | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination | Destination address of access traffic. | + | | | + | | - **IP address**: Enter private IP addresses. You can set a single IP address, consecutive IP addresses, or an IP address segment. | + | | | + | | - A single IP address, for example, **192.168.10.5** | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | + | | - Address segment, for example, **192.168.2.0/24** | + | | | + | | - **IP address group**: You can add multiple private IP addresses to an IP address group. For details about how to add an IP address group, see :ref:`Adding User-defined IP Addresses and Address Groups `. | + | | - **Countries and regions**: A continent, a country, or a region | + | | - **Domain Name/Domain Name Group**: When **Direction** is set to **Outbound**, the protection of a domain name or domain name group is supported. | + | | | + | | - **Application**: Supports the protection for domain names or wildcard domain names. Application-layer protocols such as HTTP and HTTPS are supported. Domain names are used for matching. | + | | - **Network**: Supports protection for one or multiple domain names. Applies to network-layer protocols and supports all protocols. The resolved IP addresses are used for matching. | + | | | + | | .. note:: | + | | | + | | - To protect the domain names of HTTP and HTTPS applications, you can select any options. | + | | - To protect the wildcard domain names of HTTP and HTTPS applications, select **Application** and then select any option from the drop-down list. | + | | - To protect a single domain name of other application types (such as FTP, MySQL, and SMTP), select **Network** and select any option from the drop-down list. (If **Application Domain Name Group** is selected, up to 600 IP addresses can be resolved.) | + | | - If you need to configure the wildcard domain names or application domain name groups of the HTTP/HTTPS applications, and the network domain groups of other application types for the same domain name, ensure that the priority of the **Network** protection rule is higher than that of the **Application** protection rule. | + | | - For details about application and network types, see :ref:`Adding a Domain Name Group `. | + | | | + | | - **Any**: any destination address | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Service | - **Service**: Set **Protocol Type**, **Source Port**, and **Destination Port**. | + | | | + | | - **Protocol Type**: The value can be TCP, UDP, or ICMP. | + | | - **Source/Destination Port**: If **Protocol Type** is set to **TCP** or **UDP**, you need to set the port number. | + | | | + | | .. note:: | + | | | + | | - To specify all the ports of an IP address, set **Port** to **1-65535**. | + | | - You can specify a single port. For example, to manage access on port 22, set **Port** to **22**. | + | | - To set a port range, use a hyphen (-) between the starting and ending ports. For example, to manage access on ports 80 to 443, set **Port** to **80-443**. | + | | | + | | - **Service group**: A service group is a set of services (protocols, source ports, and destination ports). For details about how to add a user-defined service group, see :ref:`Adding a User-defined Service Group `. For details about predefined service groups, see :ref:`Viewing a Predefined Service Group `. | + | | - **Any**: any protocol type or port number | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Action | Set the action to be taken when traffic passes through the firewall. | + | | | + | | - **Allow**: Traffic is forwarded. | + | | - **Block**: Traffic is not forwarded. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Allow Long Connection | If only one service is configured in the current protection rule and **Protocol Type** is set to **TCP** or **UDP**, you can configure the service session aging time. | + | | | + | | - **Yes**: Configure the long connection duration. | + | | - **No**: Retain the default durations. The default connection durations for different protocols are as follows: | + | | | + | | - TCP: 1800s | + | | - UDP: 60s | + | | | + | | .. note:: | + | | | + | | Up to 50 rules can be configured with long connections. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Long Connection Duration | This parameter is mandatory if **Allow Long Connection** is set to **Yes**. | + | | | + | | Configure the long connection duration. Configure the hour, minute, and second. | + | | | + | | .. note:: | + | | | + | | The duration range is 1 second to 1000 days. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Tags | (Optional) Tags are used to identify rules. You can use tags to classify and search for security policies. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Priority | Priority of the rule. Its value can be: | + | | | + | | - **Pin on top**: indicates that the priority of the policy is set to the highest. | + | | - **Lower than the selected rule**: indicates that the policy priority is lower than a specified rule. | + | | | + | | .. note:: | + | | | + | | - A smaller value indicates a higher priority. | + | | - The default priority of the first protection rule is 1. You do not need to configure its priority. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Status | Whether a policy is enabled. | + | | | + | | |image8|: enabled | + | | | + | | |image9|: disabled | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Description | (Optional) Usage and application scenario | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ #. Click **OK** to complete the protection rule configuration. diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/example_4_configuring_snat_protection_rules.rst b/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/example_4_configuring_snat_protection_rules.rst index 184420d..180d9f5 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/example_4_configuring_snat_protection_rules.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/configuring_protection_rules_to_block_or_allow_traffic/example_4_configuring_snat_protection_rules.rst @@ -12,7 +12,7 @@ SNAT Protection Configuration Assume your private IP address is **10.1.1.2** and the external domain name accessed through the NAT gateway is **www.example.com**. Configure NAT protection as follows and set other parameters based on your deployment: -- **Rule Type**: **NAT** +- **Rule Type**: Select **NAT**. - **Direction**: Select **SNAT**. - **Source**: Select **IP address** and enter **10.1.1.2**. - **Destination**: Select **Domain Name/Domain Group** and **Network**, and enter **www.example.com**. diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/adding_a_domain_name_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/adding_a_domain_name_group.rst index f852e95..ccfbe7f 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/adding_a_domain_name_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/adding_a_domain_name_group.rst @@ -17,13 +17,13 @@ Constraints - The domain names in a domain name group can be referenced by protection rules for up to 40,000 times, and wildcard domain names can be referenced for up to 2,000 times. -**Application Domain Name Group (Layer 7 Protocol Parsing)** +**Application domain name group (layer 7 protocol parsing)** - A firewall instance can have up to 500 domain name groups. - A firewall instance can have up to 2,500 domain names. - A domain name group can have up to 1,500 domain names. -**Network Domain Name Group (Layer 4 Protocol Parsing)** +**Network domain name group (layer 4 protocol parsing)** - A firewall instance can have up to 1,000 domain names. - A network domain name group can have up to 15 domain names. @@ -40,11 +40,11 @@ Adding a Domain Name Group #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Domain Name Groups**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. #. (Optional) To add a network domain group, click the **Network Domain Name Group** tab. -#. Click **Add Domain Name Group** and configure :ref:`parameters `. +#. Click the **Domain Name Groups** tab. Click **Add Domain Name Group** and configure :ref:`parameters `. .. _cfw_01_0183__table12362103114169: @@ -53,10 +53,10 @@ Adding a Domain Name Group +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Parameter | Description | +===================================+====================================================================================================================================================================================================+ - | Group Name | Name of a user-defined domain name group. | - +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Domain Name Group Type | Application/Network | +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Group Name | Name of a user-defined domain name group. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Description | (Optional) Enter remarks for the domain name group. | +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Domain Name | Enter one or multiple domain names. | @@ -78,25 +78,25 @@ Adding a Domain Name to a Domain Group #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Service Groups**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. -#. Click the name of a domain name group. The **Basic Information** and **Domain Names** areas are displayed. +#. Click the **Domain Name Groups** tab. Click the name of a domain name group. The **Domain Name Groups** dialog box is displayed. -#. Click **Add Domain** under the domain name list and enter domain name information. +#. Click **Add Domain** and enter domain name information. - You can click |image3| to add multiple services. + You can click **Add** to add multiple domain names. #. Confirm the information and click **OK**. Related Operation ----------------- -- Batch deleting domain names: Select domain names and click **Delete** above the list. +- Exporting domain name groups: Click **Export** above the list and select a data range. +- Batch deleting domain names: Select domain names in the domain name list and click **Delete** above the list. -- To edit a domain name group, click the name of the target domain name group and click **Edit** on the right of **Basic Information**. +- Editing a domain name group: Click the name of the target domain name group and click **Edit** on the right of **Basic Information**. - A domain name group takes effect only after it is set in a protection rule. For more information, see :ref:`Adding Protection Rules to Block or Allow Traffic `. -- To view the IP addresses resolved by a domain name group of the network domain name group type, click the domain name group name to go to the **Basic Information** page, and click **IP address** in the **Operation** column of the domain name list. +- Viewing the IP addresses resolved by a domain name group of the network domain name group type: Click a domain name group name to go to the **Basic Information** page, and click **IP address** in the **Operation** column of the domain name list. .. |image1| image:: /_static/images/en-us_image_0000001259322747.png .. |image2| image:: /_static/images/en-us_image_0000001259322747.png -.. |image3| image:: /_static/images/en-us_image_0000001988387381.png diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/deleting_a_domain_name_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/deleting_a_domain_name_group.rst index caf74eb..d0777b4 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/deleting_a_domain_name_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/domain_name_management/deleting_a_domain_name_group.rst @@ -17,9 +17,9 @@ Deleting a Domain Name Group #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Domain Name Groups**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. #. (Optional) To delete a network domain group, click the **Network Domain Name Group** tab. -#. Locate the row that contains the item to be deleted. Click **Delete** in the **Operation** column. In the displayed dialog box, enter **DELETE** and click **OK**. +#. Click the **Domain Name Groups** tab. Locate the row that contains the item to be deleted. Click **Delete** in the **Operation** column. In the displayed dialog box, enter **DELETE** and click **OK**. .. warning:: diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/importing_and_exporting_protection_policies.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/importing_and_exporting_protection_policies.rst index ad4ce83..27fc4e6 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/importing_and_exporting_protection_policies.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/importing_and_exporting_protection_policies.rst @@ -5,7 +5,7 @@ Importing and Exporting Protection Policies =========================================== -You can add and export protection rules, blacklist/whitelist items, IP address groups, service groups, and domain name groups in batches. +You can add and export protection rules, blacklist/whitelist items, IP address groups, domain name groups, and service groups in batches. Specification Limitations ------------------------- @@ -19,7 +19,7 @@ Importing Protection Rules in Batches #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. #. In the navigation pane, choose **Access Control** > **Access Policies**. -#. Click **Download Center** on the upper right of the list. +#. Click **Download Center** on the upper right corner of the list. #. Click **Download Template** to download the rule import template to the local host. #. Configure protection policy information as required. @@ -29,8 +29,8 @@ Importing Protection Rules in Batches - For details about VPC border protection rule parameters, see :ref:`Parameters of Rule Import Template - Vpc-Rule-Acl-Table (VPC Border Protection Rule) `. - For details about the blacklist and whitelist parameters, see :ref:`Adding Blacklist or Whitelist Items to Block or Allow Traffic `. - - For details about IP address group parameters, see :ref:`Adding Custom IP Address and Address Groups `. - - For details about service group parameters, see :ref:`Adding a Custom Service Group `. + - For details about IP address group parameters, see :ref:`Adding User-defined IP Addresses and Address Groups `. + - For details about service group parameters, see :ref:`Adding a User-defined Service Group `. - For details about domain name group parameters, see :ref:`Domain Name Management `. .. important:: @@ -56,7 +56,7 @@ Exporting Protection Rules in Batches #. In the navigation pane on the left, click |image2| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. #. In the navigation pane, choose **Access Control** > **Access Policies**. -#. Click **Download Center** on the upper right of the list. +#. Click **Download Center** on the upper right corner of the list. #. Click **Export Rule** to export rules to a local PC. .. _cfw_01_0129__section738713134471: diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/managing_protection_rules.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/managing_protection_rules.rst index c3868d0..bbb81c3 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/managing_protection_rules.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_access_control_policies/managing_protection_rules.rst @@ -28,7 +28,9 @@ Viewing Protection Rules | | | | | A smaller value indicates a higher priority. | +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ - | Name | Custom rule name | + | Name/Rule ID | Custom rule name and ID | + +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Rule Type | Protection type of the rule. It can be an EIP or NAT rule. | +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Direction | Traffic direction of the protection rule. | +-----------------------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_custom_ip_address_and_address_groups.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_user-defined_ip_addresses_and_address_groups.rst similarity index 83% rename from umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_custom_ip_address_and_address_groups.rst rename to umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_user-defined_ip_addresses_and_address_groups.rst index b1fc8fc..f444ce8 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_custom_ip_address_and_address_groups.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/adding_user-defined_ip_addresses_and_address_groups.rst @@ -2,15 +2,15 @@ .. _cfw_01_0068: -Adding Custom IP Address and Address Groups -=========================================== +Adding User-defined IP Addresses and Address Groups +=================================================== An IP address group contains multiple IP addresses. An IP address group frees you from repeatedly modifying access rules and allows you to manage access rules in batch. Constraints ----------- -- A firewall instance can contain up to 3898 IP address groups. +- A firewall instance can have up to 3800 IP address groups. - An IP address group can contain up to 640 IP addresses. - A firewall instance can contain up to 30,000 IP addresses. @@ -23,9 +23,9 @@ Adding Custom Address Groups #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **IP Address Groups**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. -#. Click **Add IP Address Group** and configure parameters in the **Basic Information** area. For more information, see :ref:`IP address group parameters `. +#. Click the **IP Address Groups** tab. Click **Add IP Address Group** and configure parameters on the **Add IP Address Group** slide-out panel. For more information, see :ref:`IP address group parameters `. .. _cfw_01_0068__table12707131818297: @@ -51,15 +51,15 @@ Adding Custom Address Groups #. Confirm the information and click **OK**. The IP address group is added. -Adding an IP Address --------------------- +Adding an IP address to a user-defined address group +---------------------------------------------------- #. Log in to the management console. #. In the navigation pane on the left, click |image2| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **IP Address Groups**. -#. Click the name of an IP address group. The **Basic Information** and **IP Addresses** areas are displayed. -#. Click **Add IP Address** under the IP address list. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the name of an IP address group on the **IP Address Groups** tab. The **IP Address Group Details** dialog box is displayed.. +#. Click **Add IP Address**. The **Add IP Address** slide-out panel is displayed. - To add IP addresses in batches, enter the IP addresses in the text box and click **Parse**. - To add a single IP address, click **Add**, and enter the IP address and description. @@ -69,7 +69,8 @@ Adding an IP Address Related Operations ------------------ -- Batch deleting IP addresses: In the IP address list, select IP addresses and click **Delete** above the list. +- Exporting IP address groups: Click **Export** above the list and select a data range. +- Batch deleting IP addresses: In the **IP Address Group Details** slide-out panel, select IP addresses and click **Delete** above the list. Follow-up Operations -------------------- diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/deleting_ip_address_groups.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/deleting_ip_address_groups.rst index 818fbf5..ed50b53 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/deleting_ip_address_groups.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/deleting_ip_address_groups.rst @@ -19,8 +19,8 @@ Deleting IP Address Groups #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **IP Address Groups**. -#. In the **Operation** column of an IP address group, click **Delete**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **IP Address Groups** tab. In the **Operation** column of an IP address group, click **Delete**. #. In the displayed dialog box, confirm the information, enter **DELETE**, and click **OK**. .. warning:: diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/index.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/index.rst index 9bebe2d..5b79c50 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/index.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/index.rst @@ -5,7 +5,7 @@ Managing IP Address Groups ========================== -- :ref:`Adding Custom IP Address and Address Groups ` +- :ref:`Adding User-defined IP Addresses and Address Groups ` - :ref:`Viewing a Predefined Address Group ` - :ref:`Deleting IP Address Groups ` @@ -13,6 +13,6 @@ Managing IP Address Groups :maxdepth: 1 :hidden: - adding_custom_ip_address_and_address_groups + adding_user-defined_ip_addresses_and_address_groups viewing_a_predefined_address_group deleting_ip_address_groups diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/viewing_a_predefined_address_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/viewing_a_predefined_address_group.rst index 9078766..291dfc6 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/viewing_a_predefined_address_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/managing_ip_address_groups/viewing_a_predefined_address_group.rst @@ -29,7 +29,7 @@ Viewing a Predefined Address Group #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **IP Address Groups**. -#. Click the **Pre-defined Address Group** tab and click the name of an address group. On the details page that is displayed, view the address group information. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **IP Address Groups** tab. Click the **Pre-defined Address Groups** tab and click the name of an address group. On the details page that is displayed, view the address group information. .. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_custom_service_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_user-defined_service_group.rst similarity index 86% rename from umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_custom_service_group.rst rename to umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_user-defined_service_group.rst index 64fdd19..37cf07a 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_custom_service_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/adding_a_user-defined_service_group.rst @@ -2,8 +2,8 @@ .. _cfw_01_0070: -Adding a Custom Service Group -============================= +Adding a User-defined Service Group +=================================== A service group is a collection of services (protocols, source ports, and destination ports). A service group frees you from repeatedly modifying access rules and simplifies security group rule management. @@ -15,14 +15,14 @@ Constraints - A firewall instance can have up to 900 services. -Adding a Custom Service Group ------------------------------ +Adding a User-defined Service Group +----------------------------------- #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Service Groups**. -#. Click **Add Service Group** and configure parameters in the **Basic Information** area. Enter the service group name and description. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **Service Groups** tab. Click **Add Service Group** and configure parameters in the **Add Service Group** area. Enter the service group name and description. .. table:: **Table 1** Service group parameters @@ -41,23 +41,21 @@ Adding a Custom Service Group #. Confirm the information and click **OK**. -Adding a Service ----------------- +Adding a Service to a User-defined Service Group +------------------------------------------------ #. Log in to the management console. #. In the navigation pane on the left, click |image2| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Service Groups**. -#. Click the name of a service group. The **Basic Information** and **Services** areas are displayed. -#. Click **Add Service** in the **Services** area. The **Add Service** dialog box is displayed. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **Service Groups** tab. Click the name of a service group. The **Service Group Details** dialog box is displayed.. +#. Click **Add Service**. .. table:: **Table 2** Adding a service +-----------------------+-------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Parameter | Description | Example Value | +=======================+===============================================================================================================================+=======================+ - | Service Name | User-defined service name | test | - +-----------------------+-------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Protocol | Its value can be **TCP**, **UDP**, or **ICMP**. | TCP | +-----------------------+-------------------------------------------------------------------------------------------------------------------------------+-----------------------+ | Source Port | Source ports to be allowed or blocked. You can configure a single port or consecutive port groups (example: **80-443**). | 80 | @@ -75,13 +73,14 @@ Adding a Service | Description | Usage and application scenario | ``-`` | +-----------------------+-------------------------------------------------------------------------------------------------------------------------------+-----------------------+ -#. You can click |image3| to add multiple services. +#. You can click **Add** to add multiple services. #. Confirm the information and click **OK**. Related Operations ------------------ -- Batch deleting services: Select services in the service list and click **Delete** above the list. +- Exporting service groups: Click **Export** above the list and select a data range. +- Deleting services in batches: On the **Service Groups** tab, select services and click **Delete** above the list. Follow-up Operations -------------------- @@ -90,4 +89,3 @@ A service group takes effect only after it is set in a protection rule. For more .. |image1| image:: /_static/images/en-us_image_0000001259322747.png .. |image2| image:: /_static/images/en-us_image_0000001259322747.png -.. |image3| image:: /_static/images/en-us_image_0000001988385497.png diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_service_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_user-defined_service_group.rst similarity index 72% rename from umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_service_group.rst rename to umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_user-defined_service_group.rst index 80973a8..1a3bdcf 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_service_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/deleting_a_user-defined_service_group.rst @@ -2,12 +2,12 @@ .. _cfw_01_0071: -Deleting a Service Group -======================== +Deleting a User-defined Service Group +===================================== A service group is a collection of ports. You can use service groups to easily protect high-risk ports and manage access rules, free from repeated editing of access rules. -This section describes how to delete a custom service group. +This section describes how to delete a user-defined service group. Constraints ----------- @@ -15,14 +15,14 @@ Constraints The service group referenced by a protection rule cannot be deleted. Modify or delete the rule first. -Deleting a Service Group ------------------------- +Deleting a User-defined Service Group +------------------------------------- #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Service Groups**. -#. In the **Operation** column of a service group, click **Delete**. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **Service Groups** tab. In the **Operation** column of a service group, click **Delete**. #. In the displayed dialog box, confirm the information, enter **DELETE**, and click **OK**. .. warning:: diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/index.rst b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/index.rst index a7ad971..edf4b97 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/index.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/index.rst @@ -5,14 +5,14 @@ Service Group Management ======================== -- :ref:`Adding a Custom Service Group ` +- :ref:`Adding a User-defined Service Group ` - :ref:`Viewing a Predefined Service Group ` -- :ref:`Deleting a Service Group ` +- :ref:`Deleting a User-defined Service Group ` .. toctree:: :maxdepth: 1 :hidden: - adding_a_custom_service_group + adding_a_user-defined_service_group viewing_a_predefined_service_group - deleting_a_service_group + deleting_a_user-defined_service_group diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/viewing_a_predefined_service_group.rst b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/viewing_a_predefined_service_group.rst index c84b34f..1bbf081 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/viewing_a_predefined_service_group.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/service_group_management/viewing_a_predefined_service_group.rst @@ -16,7 +16,7 @@ Viewing a Predefined Service Group #. Log in to the management console. #. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. #. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. -#. In the navigation pane, choose **Access Control** > **Service Groups**. -#. Click the **Pre-defined Service Groups** tab and click the name of a service group. On the details page that is displayed, view the service group information. +#. In the navigation pane, choose **Access Control** > **Object Groups**. +#. Click the **Service Groups** tab. Click the **Pre-defined Service Groups** tab and click the name of a service group. On the details page that is displayed, view the service group information. .. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/configuring_access_control_policies_to_control_traffic/viewing_protection_information_using_the_policy_assistant.rst b/umn/source/configuring_access_control_policies_to_control_traffic/viewing_protection_information_using_the_policy_assistant.rst index f1683f3..f20d420 100644 --- a/umn/source/configuring_access_control_policies_to_control_traffic/viewing_protection_information_using_the_policy_assistant.rst +++ b/umn/source/configuring_access_control_policies_to_control_traffic/viewing_protection_information_using_the_policy_assistant.rst @@ -41,6 +41,6 @@ Viewing Protection Information Using the Policy Assistant | Top Blocked IP Address Regions | Regions of blocked IP addresses. You can click **Destination of outbound access** or **Source of inbound access** to check IP addresses. | +-----------------------------------+------------------------------------------------------------------------------------------------------------------------------------------+ - - **Inactive Policies**: Policies that have not been hit or enabled for more than three months. You are advised to modify or delete the policies in a timely manner. + - **Inactive Policies**: Policies that have not been hit or enabled for more than a week, a month, three months, or six months. You are advised to modify or delete the policies in a timely manner. .. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/creating_a_pay-per-use_cfw.rst b/umn/source/creating_a_pay-per-use_cfw.rst index a57b227..408454b 100644 --- a/umn/source/creating_a_pay-per-use_cfw.rst +++ b/umn/source/creating_a_pay-per-use_cfw.rst @@ -30,26 +30,32 @@ Creating a Pay-per-Use Professional CFW .. table:: **Table 1** Parameters for creating CFW - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+==================================================================================================================+ - | Billing Mode | **Pay-per-use** indicates that you will be charged for the protection on your workloads. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Region | Region where the CFW is to be purchased. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Edition | Currently, only the professional edition is supported. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Firewall Name | Firewall name. | - | | | - | | It must meet the following requirements: | - | | | - | | - Only letters (A to Z and a to z), numbers (0 to 9), spaces, and the following characters are allowed: -\_ | - | | - The value can contain 1 to 48 characters. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Enterprise Project | | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ - | Tags | It is recommended that you use the TMS predefined tag function to add the same tag to different cloud resources. | - +-----------------------------------+------------------------------------------------------------------------------------------------------------------+ + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=======================================================================================================================================================================================================================================+ + | Billing Mode | **Pay-per-use** indicates that you will be charged for the protection on your workloads. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Region | Region where the CFW is to be purchased. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Edition | Currently, only the professional edition is supported. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Firewall Name | Firewall name. | + | | | + | | It must meet the following requirements: | + | | | + | | - Only letters (A to Z and a to z), numbers (0 to 9), spaces, and the following characters are allowed: -\_ | + | | - The value can contain 1 to 48 characters. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Enterprise Project | In the drop-down list, select the enterprise project that you belong to. The purchased CFW then belongs to that enterprise project and protects all resources in that project. | + | | | + | | This option is only available if you have enabled enterprise projects, or if you are logged in using an enterprise master account. You can use an enterprise project to centrally manage your cloud resources and members by project. | + | | | + | | .. note:: | + | | | + | | Value **default** indicates the default enterprise project. Resources that are not allocated to any enterprise projects under your account are displayed in the default enterprise project. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Tags | It is recommended that you use the TMS predefined tag function to add the same tag to different cloud resources. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ #. Confirm the information and click **Create Firewall**. diff --git a/umn/source/faqs/troubleshooting/what_do_i_do_if_service_traffic_is_abnormal.rst b/umn/source/faqs/troubleshooting/what_do_i_do_if_service_traffic_is_abnormal.rst index f5ab4e4..3f524b7 100644 --- a/umn/source/faqs/troubleshooting/what_do_i_do_if_service_traffic_is_abnormal.rst +++ b/umn/source/faqs/troubleshooting/what_do_i_do_if_service_traffic_is_abnormal.rst @@ -98,7 +98,7 @@ The firewall administrator took the following measures: **Figure 2** EIPs -#. The administrator chose **Log Audit** > **Log Query** and clicked the **Access Control Logs** tab. He searched for the blocking logs of the access source IP address **xx.xx.xx.126**. A blocking rule named **Block-Malicious-Outreach** was found, and this rule blocked the traffic from the EIP **xx.xx.xx.126** to the Internet. +#. The administrator chose **Log Audit** > **Log Query** and clicked the **Access Control Logs** tab. He searched for the blocking logs of the access source IP address **xx.xx.xx.126**. A blocking rule named **Block-Malicious-Outreach** was found, and this rule blocked the traffic from the attack source IP address to the Internet. .. figure:: /_static/images/en-us_image_0000001950170221.png @@ -164,7 +164,7 @@ The firewall administrator took the following measures: **Figure 5** Filtering attack event logs -#. The administrator clicked **Details** in the **Operation** column, clicked **Payload Content** in the display page, and created a packet capture task to determine that the service is normal. The administrator searched for the rule whose ID is 334841 from the list on the **Basic Protection** tab page by referring to :ref:`Modifying the Protection Action of an Intrusion Prevention Rule `. +#. The administrator clicked **Details** in the **Operation** column, clicked **Payload Content** in the display page, and created a packet capture task to verify that the service is normal. The administrator searched for the rule whose ID is 334841 from the list on the **Basic Protection** tab page by referring to :ref:`Modifying the Protection Action of an Intrusion Prevention Rule `. .. figure:: /_static/images/en-us_image_0000001950170229.png diff --git a/umn/source/product_overview/constraints_and_limitations.rst b/umn/source/product_overview/constraints_and_limitations.rst index 791e3ef..b503334 100644 --- a/umn/source/product_overview/constraints_and_limitations.rst +++ b/umn/source/product_overview/constraints_and_limitations.rst @@ -29,7 +29,7 @@ Protection Policy Quota Limit - IP address groups - - A firewall instance can contain up to 3898 IP address groups. + - A firewall instance can have up to 3800 IP address groups. - An IP address group can contain up to 640 IP addresses. - A firewall instance can contain up to 30,000 IP addresses. @@ -42,13 +42,13 @@ Protection Policy Quota Limit - Domain name groups - The domain names in a domain name group can be referenced by protection rules for up to 40,000 times, and wildcard domain names can be referenced for up to 2,000 times. - - **Application Domain Name Group (Layer 7 Protocol Parsing)** + - **Application domain name group (layer 7 protocol parsing)** - A firewall instance can have up to 500 domain name groups. - A firewall instance can have up to 2,500 domain names. - - A domain name group in application mode can have up to 1,500 domain names. + - A domain name group can have up to 1,500 domain names. - - **Network Domain Name Group (Layer 4 Protocol Parsing)** + - **Network domain name group (layer 4 protocol parsing)** - A firewall instance can have up to 1,000 domain names. - A network domain name group can have up to 15 domain names. diff --git a/umn/source/product_overview/related_services.rst b/umn/source/product_overview/related_services.rst index 0a783de..041c8c7 100644 --- a/umn/source/product_overview/related_services.rst +++ b/umn/source/product_overview/related_services.rst @@ -25,7 +25,7 @@ CTS records operations related to CFW, facilitating your further queries, audits Cloud Eye --------- -`Cloud Eye `__ provides a comprehensive monitoring platform for resources such as the ECS and bandwidth. Cloud Eye monitors the metrics of CFW, so that you can understand the protection status of CFW in a timely manner, and set protection policies accordingly. +`Cloud Eye `__ provides a comprehensive monitoring platform for resources such as the ECS and bandwidth. Cloud Eye monitors the metrics of CFW, so that you can understand the protection status of the service in a timely manner, and set protection policies accordingly. Log Tank Service (LTS) ---------------------- diff --git a/umn/source/system_management/alarm_notification.rst b/umn/source/system_management/alarm_notification.rst new file mode 100644 index 0000000..99a4e84 --- /dev/null +++ b/umn/source/system_management/alarm_notification.rst @@ -0,0 +1,146 @@ +:original_name: cfw_01_0166.html + +.. _cfw_01_0166: + +Alarm Notification +================== + +After alarm notification is enabled, CFW will send notifications to you through the method you specified (such as email or SMS) so that you can monitor the firewall status and quickly detect exceptions. + +CFW supports the following alarms: + +- Attack alarm: An alarm is triggered when the IPS detects an attack. +- High traffic warning: An alarm is triggered if the traffic reaches the specified percentage of the traffic processing capability you purchased. +- EIP not protected: An alarm is triggered when the current account has EIPs that are not protected. + +Prerequisites +------------- + +The SMN service has been enabled. + +Attack Alarm +------------ + +#. Log in to the management console. + +#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. + +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. + +#. In the navigation pane, choose **System Management** > **Notifications**. + +#. In the **Operation** column of **Attack alarm**, click **Edit**, and configure notification item parameters. For details, see :ref:`Table 1 `. + + .. _cfw_01_0166__table1854192020589: + + .. table:: **Table 1** Attack alarm parameters + + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=========================================================================================================================================================================+ + | Description | IPS attack alarm | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Level | Select the risk levels that trigger notifications. | + | | | + | | The options are **Serious**, **High**, **Medium**, and **Low**. Multiple options can be selected. | + | | | + | | For example, if you select **High** and **Medium**, the firewall will notify you by SMS message or email when detecting an intrusion with a high- or medium-level risk. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Notification Time | Select a time range for sending notifications. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Trigger Condition | Configure the trigger condition. | + | | | + | | .. note:: | + | | | + | | Alarm notifications are sent if the number of attacks is at least equal to the threshold configured for a certain period. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Recipient Group | Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications. | + +-----------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +#. Click **OK**. + +#. In the **Status** column of **Attack alarm**, click |image2| to enable it. + +High Traffic Warning +-------------------- + +#. Log in to the management console. + +#. In the navigation pane on the left, click |image3| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. + +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. + +#. In the navigation pane, choose **System Management** > **Notifications**. + +#. In the **Operation** column of **High Traffic Warning**, click **Edit**, and configure notification item parameters. For details, see :ref:`Table 2 `. + + .. _cfw_01_0166__table20810102320332: + + .. table:: **Table 2** High traffic warning parameters + + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+=======================================================================================================================================================================================+ + | Description | An alarm is generated if the traffic reaches the specified percentage of the traffic processing capability you purchased. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Level | Select a percentage. When the maximum peak inbound or outbound traffic reaches the percentage of the traffic processing capability you purchased, an alarm notification is triggered. | + | | | + | | For example, you can select **70%**, **80%**, or **90%**. | + | | | + | | If this parameter is set to **80%**, an alarm notification is sent when the used traffic reaches 80% of the purchased traffic. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Notification Time | Select a time range for sending notifications. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Trigger Condition | Once a day | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Recipient Group | Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + +#. Click **OK**. + +#. In the **Status** column of **High Traffic Warning**, click |image4| to enable it. + +EIP Not Protected +----------------- + +#. Log in to the management console. + +#. In the navigation pane on the left, click |image5| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. + +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. + +#. In the navigation pane, choose **System Management** > **Notifications**. + +#. In the **Operation** column of the **EIP Not Protected** alarm, click **Edit**, and configure notification item parameters. For details, see :ref:`Table 3 `. + + .. _cfw_01_0166__table19573228199: + + .. table:: **Table 3** Parameters of the alarm **EIP Not Protected** + + +-------------------+------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================+======================================================================================================+ + | Description | This alarm indicates there are unprotected EIPs. | + +-------------------+------------------------------------------------------------------------------------------------------+ + | Notification Time | Select a time range for sending notifications. | + +-------------------+------------------------------------------------------------------------------------------------------+ + | Trigger Condition | Once a day | + +-------------------+------------------------------------------------------------------------------------------------------+ + | Recipient Group | Select a topic from the drop-down list to configure the endpoints for receiving alarm notifications. | + +-------------------+------------------------------------------------------------------------------------------------------+ + +#. Click **OK**. + +#. In the **Status** column of **EIP Not Protected**, click |image6| to enable it. + +Related Operations +------------------ + +To add assets to the **EIP Not Protected** alarm whitelist, click **Add to Alarm Whitelist** in the **Operation** column of the alarm. Select EIPs, add them to the whitelist on the right, and click **OK**. The whitelisted EIPs will no longer trigger this alarm. + +.. |image1| image:: /_static/images/en-us_image_0000001259322747.png +.. |image2| image:: /_static/images/en-us_image_0000001443711605.png +.. |image3| image:: /_static/images/en-us_image_0000001259322747.png +.. |image4| image:: /_static/images/en-us_image_0000001443792005.png +.. |image5| image:: /_static/images/en-us_image_0000001259322747.png +.. |image6| image:: /_static/images/en-us_image_0000001673130380.png diff --git a/umn/source/system_management/index.rst b/umn/source/system_management/index.rst index 0dd2b7c..bc7db00 100644 --- a/umn/source/system_management/index.rst +++ b/umn/source/system_management/index.rst @@ -5,6 +5,8 @@ System Management ================= +- :ref:`Alarm Notification ` +- :ref:`Network Packet Capture ` - :ref:`Configuring a DNS Server ` - :ref:`Security Report Management ` @@ -12,5 +14,7 @@ System Management :maxdepth: 1 :hidden: + alarm_notification + network_packet_capture/index configuring_a_dns_server security_report_management/index diff --git a/umn/source/system_management/network_packet_capture/creating_a_packet_capture_task_to_check_the_network_status.rst b/umn/source/system_management/network_packet_capture/creating_a_packet_capture_task_to_check_the_network_status.rst new file mode 100644 index 0000000..699d524 --- /dev/null +++ b/umn/source/system_management/network_packet_capture/creating_a_packet_capture_task_to_check_the_network_status.rst @@ -0,0 +1,96 @@ +:original_name: cfw_01_0179.html + +.. _cfw_01_0179: + +Creating a Packet Capture Task to Check the Network Status +========================================================== + +You can create network packet capture tasks to locate network faults and attacks. + +Specification Limitations +------------------------- + +Only the professional edition instances can capture network packets. + +Constraints +----------- + +- Only one packet capture task can be executed at a time. +- A maximum of 20 packet capture tasks can be created every day. +- A maximum of 1 million packets can be captured. + + +Creating a Packet Capture Task to Check the Network Status +---------------------------------------------------------- + +#. Log in to the management console. + +#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. + +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. + +#. In the navigation tree on the left, choose **System Management** > **Packet Capture**. + +#. Click **Create Capture Task** and configure :ref:`parameters `. + + .. _cfw_01_0179__table20466164010119: + + .. table:: **Table 1** Packet capture task parameters + + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Parameter Name | Description | Example Value | + +========================+===================================================================================+=======================+ + | Task Name | Task name. | cfw | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Max. Packets Captured | Maximum number of captured packets. Enter an integer in the range 1 to 1,000,000. | 100000 | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Capture Duration (min) | Maximum duration for capturing packets. Enter an integer in the range 1 to 10. | 3 | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | IP Type | IP address type for packet capture. The value is **IPv4** by default. | IPv4 | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Protocol Type | Protocol type of captured packets. It can be: | Any | + | | | | + | | - Any | | + | | - TCP | | + | | - UDP | | + | | - ICMP | | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Source Address | It can be: | 192.168.10.5 | + | | | | + | | - A single IP address, for example, **192.168.10.5** | | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | | + | | - Address segment, for example, **192.168.2.0/24** | | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Source Port | (Optional) Source port. | 80 | + | | | | + | | The input rules are as follows: | | + | | | | + | | - If this parameter is left blank, it indicates all port numbers (1 to 65535). | | + | | - Enter a single port number in the range 1 to 65535. | | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Destination Address | It can be: | 192.168.10.6 | + | | | | + | | - A single IP address, for example, **192.168.10.5** | | + | | - Consecutive IP addresses, for example, **192.168.0.2-192.168.0.10** | | + | | - Address segment, for example, **192.168.2.0/24** | | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + | Destination Port | (Optional) Destination port. | ``-`` | + | | | | + | | The input rules are as follows: | | + | | | | + | | - If this parameter is left blank, it indicates all port numbers (1 to 65535). | | + | | - Enter a single port number in the range 1 to 65535. | | + +------------------------+-----------------------------------------------------------------------------------+-----------------------+ + +#. Click **OK**. + +Related Operations +------------------ + +- To copy a task, click **Copy** in its **Operation** column. In the displayed dialog box, enter the task name and click **OK**. +- To stop a packet capture task, click **Stop** in its **Operation** column. +- To delete packet capture tasks, select them and click **Delete** above the list. +- :ref:`Viewing a Packet Capture Task ` +- :ref:`Downloading Packet Capture Results ` + +.. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/system_management/network_packet_capture/downloading_packet_capture_results.rst b/umn/source/system_management/network_packet_capture/downloading_packet_capture_results.rst new file mode 100644 index 0000000..a64859f --- /dev/null +++ b/umn/source/system_management/network_packet_capture/downloading_packet_capture_results.rst @@ -0,0 +1,45 @@ +:original_name: cfw_01_0181.html + +.. _cfw_01_0181: + +Downloading Packet Capture Results +================================== + +Constraints +----------- + +For an abnormal task, its possible packet capture results are as follows: + +- The packet capture data is completely lost and cannot be downloaded. +- Some packet capture data is lost. Existing data can be downloaded. + + +Downloading Packet Capture Results +---------------------------------- + +#. Log in to the management console. +#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. +#. In the navigation tree on the left, choose **System Management** > **Packet Capture**. +#. In the row of a task, click **Download** in the **Operation** column to view the packet capture result. + + .. note:: + + For an abnormal task, its possible packet capture results are as follows: + + - The packet capture data is completely lost and cannot be downloaded. + - Some packet capture data is lost. Existing data can be downloaded. + +#. Obtain the packet capture result. + + - You can click **Copy all** to share the link with others. + - You can click **Open URL** to open it in a new browser tab. Switch back to this dialog box, click **Copy access code**, paste the copied code to the **Extraction Code** text box on the new tab, and click **Obtain Shared File List**. + - You can click **Copy link**, and paste and open the link it in a new browser tab. Switch back to this dialog box, click **Copy access code**, paste the copied code to the **Extraction Code** text box on the new tab, and click **Obtain Shared File List**. + + .. note:: + + You can switch between Chinese and English in the lower left corner of the browser. + +#. Click **Download** or **Download As**. + +.. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/system_management/network_packet_capture/index.rst b/umn/source/system_management/network_packet_capture/index.rst new file mode 100644 index 0000000..629f2ee --- /dev/null +++ b/umn/source/system_management/network_packet_capture/index.rst @@ -0,0 +1,18 @@ +:original_name: cfw_01_0178.html + +.. _cfw_01_0178: + +Network Packet Capture +====================== + +- :ref:`Creating a Packet Capture Task to Check the Network Status ` +- :ref:`Viewing a Packet Capture Task ` +- :ref:`Downloading Packet Capture Results ` + +.. toctree:: + :maxdepth: 1 + :hidden: + + creating_a_packet_capture_task_to_check_the_network_status + viewing_a_packet_capture_task + downloading_packet_capture_results diff --git a/umn/source/system_management/network_packet_capture/viewing_a_packet_capture_task.rst b/umn/source/system_management/network_packet_capture/viewing_a_packet_capture_task.rst new file mode 100644 index 0000000..a5356c8 --- /dev/null +++ b/umn/source/system_management/network_packet_capture/viewing_a_packet_capture_task.rst @@ -0,0 +1,75 @@ +:original_name: cfw_01_0180.html + +.. _cfw_01_0180: + +Viewing a Packet Capture Task +============================= + + +Viewing a Packet Capture Task +----------------------------- + +#. Log in to the management console. + +#. In the navigation pane on the left, click |image1| and choose **Security** > **Cloud Firewall**. The **Dashboard** page will be displayed. + +#. (Optional) If the current account has only one firewall instance, the firewall details page is displayed. If there are multiple firewall instances, click **View** in the **Operation** column of a firewall to go to its details page. + +#. In the navigation tree on the left, choose **System Management** > **Packet Capture**. + +#. (Optional) Search for a task by task name or IP address. + + - Task name search supports fuzzy match. The input rules are as follows: + - To search by IP address, enter a single complete IP address, for example, 0.0.0.0. + +#. Check the packet capture task. For more information, see :ref:`Table 1 ` + + .. _cfw_01_0180__table1190315241617: + + .. table:: **Table 1** Packet capture task parameters + + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Parameter Name | Description | + +===================================+===========================================================================================================================+ + | Task Name | Task name | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Status | Task status. | + | | | + | | - **Running**: The packet capture command has been delivered and the task is in progress. | + | | - **Completed**: The packet capture result has been uploaded and the task is complete. | + | | - **Exception**: Packet capture data upload times out due to network problems, and some packet capture results are lost. | + | | | + | | .. note:: | + | | | + | | To retry a task, you can click **Copy** in its **Operation** column to create and execute it again. | + | | | + | | - **Stopping**: The task is being stopped and the packet capture result is being uploaded. | + | | - **Expired**: The packet capture result has been uploaded and the task has been manually stopped. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Protocol Type | Protocol type specified for packet capture. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | IP Address | IP addresses specified for packet capture, including the source and destination addresses. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Port | Ports specified for packet capture, including the source and destination ports. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Max. Packets Captured | Maximum number of captured packets in the current task. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Packet Capture Time | Start time and end time of a packet capture task. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Capture Duration (min) | Duration of packet capture. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Remaining Retention Period (Days) | Number of days for storing a packet capture task. The default value is 7. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + | Capture Size | Size of captured packets. | + +-----------------------------------+---------------------------------------------------------------------------------------------------------------------------+ + +Related Operations +------------------ + +- To copy a task, click **Copy** in its **Operation** column. In the displayed dialog box, enter the task name and click **OK**. +- To stop a packet capture task, click **Stop** in its **Operation** column. +- To delete packet capture tasks, select them and click **Delete** above the list. +- :ref:`Creating a Packet Capture Task to Check the Network Status ` +- :ref:`Downloading Packet Capture Results ` + +.. |image1| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/viewing_cfw_protection_logs/querying_logs.rst b/umn/source/viewing_cfw_protection_logs/querying_logs.rst index c9e0b27..c5da69d 100644 --- a/umn/source/viewing_cfw_protection_logs/querying_logs.rst +++ b/umn/source/viewing_cfw_protection_logs/querying_logs.rst @@ -40,46 +40,54 @@ Attack Event Logs .. table:: **Table 1** Attack event log parameters - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Parameter | Description | - +===================================+=========================================================================================+ - | Time | Time when an attack occurred. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Attack Type | Type of the attack event, including IMAP, DNS, FTP, HTTP, POP3, TCP, and UDP. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Severity | It can be **Critical**, **High**, **Medium**, or **Low**. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Rule ID | Rule ID | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Rule Name | Matched rule in the library. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Source IP Address | Source IP address of an attack event. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Source Country/Region | Geographical location of the attack source IP address. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Source Port | Source port of an attack. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Destination IP Address | Attacked IP address. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Destination Country/Region | Geographical location of the attack target IP address. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Destination Port | Destination port of an attack. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Protocol | Protocol type of an attack. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Application | Application type of an attack. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Direction | It can be outbound or inbound. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Action | Action of the firewall. It can be: | - | | | - | | - **Allow** | - | | - **Block** | - | | - **Block IP** | - | | - **Discard** | - +-----------------------------------+-----------------------------------------------------------------------------------------+ - | Operation | You can click **Details** to view the basic information and attack payload of an event. | - +-----------------------------------+-----------------------------------------------------------------------------------------+ + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Parameter | Description | + +===================================+==================================================================================================================================================================================================================================+ + | Time | Time when an attack occurred. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Attack Type | Type of the attack event, including IMAP, DNS, FTP, HTTP, POP3, TCP, and UDP. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Risk Level | It can be **Critical**, **High**, **Medium**, or **Low**. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Rule ID | Rule ID | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Rule Name | Matched rule in the library. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source IP Address | Source IP address of an attack event. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Tags | IP address type identifier. | + | | | + | | - Other tags: IP addresses that are not WAF back-to-source IP addresses. No special actions required. | + | | | + | | - **WAF back-to-source IP addresses**: **Source IP Address** is a WAF back-to-source IP address. If the **Action** of this record is **Block**, **Block IP**, or **Discard**, you need to manually set the action to **Allow**. | + | | | + | | Operation: Find the rule based on its ID. In the **Operation** column of the rule, click **Observe**. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source Country/Region | Geographical location of the attack source IP address. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Source Port | Source port of an attack. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination IP Address | Attacked IP address. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination Country/Region | Geographical location of the attack target IP address. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Destination Port | Destination port of an attack. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Protocol | Protocol type of an attack. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Application | Application type of an attack. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Direction | It can be outbound or inbound. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Action | Action of the firewall. It can be: | + | | | + | | - **Allow** | + | | - **Block** | + | | - **Block IP** | + | | - **Discard** | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ + | Operation | You can click **View** to view the basic information and attack payload of an event. | + +-----------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ .. _cfw_01_0139__section8485135919336: @@ -103,13 +111,13 @@ Access Control Logs +============================+================================================================================================================+ | Hit Time | Time of access. | +----------------------------+----------------------------------------------------------------------------------------------------------------+ - | Source IP | Source IP address of the access. | + | Source IP Address | Source IP address of the access. | +----------------------------+----------------------------------------------------------------------------------------------------------------+ | Source Country/Region | Geographical location of the source IP address. | +----------------------------+----------------------------------------------------------------------------------------------------------------+ | Source Port | Source port for access control. It can be a single port or consecutive port groups (example: **80-443**). | +----------------------------+----------------------------------------------------------------------------------------------------------------+ - | Destination IP | Destination IP address. | + | Destination IP Address | Destination IP address. | +----------------------------+----------------------------------------------------------------------------------------------------------------+ | Destination Host | Destination domain name | +----------------------------+----------------------------------------------------------------------------------------------------------------+ @@ -143,13 +151,13 @@ Traffic Logs +----------------------------+--------------------------------------------------------+ | End Time | Time when traffic protection ended. | +----------------------------+--------------------------------------------------------+ - | Source | Source IP address of the traffic | + | Source IP Address | Source IP address of the traffic | +----------------------------+--------------------------------------------------------+ | Source Country/Region | Geographical location of the access source IP address. | +----------------------------+--------------------------------------------------------+ | Source Port | Source port of the traffic. | +----------------------------+--------------------------------------------------------+ - | Destination IP | Destination IP address. | + | Destination IP Address | Destination IP address. | +----------------------------+--------------------------------------------------------+ | Destination Country/Region | Geographical location of the destination IP address. | +----------------------------+--------------------------------------------------------+ @@ -167,6 +175,18 @@ Related Operations Exporting logs: Click |image4| in the upper right corner to export the logs in the list. +Follow-up Operations +-------------------- + +- If improper blocking is recorded in access control logs, check whether your protection rules, blacklist, and whitelist configurations are correct. +- If improper blocking is recorded in attack event logs, your normal workloads may be blocked by IPS. + + - If the traffic from an IP address is improperly blocked, add it to the whitelist. + - If the traffic from multiple IP addresses is blocked, check logs to see whether it is blocked by a single rule or multiple rules. + + - Blocked by a single rule: Modify the protection action of the rule. For details, see :ref:`Modifying the Action of a Basic Protection Rule `. + - Blocked by multiple rules: Modify the protection mode. For details, see :ref:`Adjusting the IPS Protection Mode to Block Network Attacks `. + .. |image1| image:: /_static/images/en-us_image_0000001259322747.png .. |image2| image:: /_static/images/en-us_image_0000001259322747.png .. |image3| image:: /_static/images/en-us_image_0000001259322747.png diff --git a/umn/source/viewing_traffic_statistics/viewing_inbound_traffic.rst b/umn/source/viewing_traffic_statistics/viewing_inbound_traffic.rst index 4727cf8..400f347 100644 --- a/umn/source/viewing_traffic_statistics/viewing_inbound_traffic.rst +++ b/umn/source/viewing_traffic_statistics/viewing_inbound_traffic.rst @@ -28,19 +28,13 @@ Viewing Inbound Traffic .. table:: **Table 1** Value description - +-----------------------------------+-----------------------------------------------------------------------------+ - | Time Range | Value | - +===================================+=============================================================================+ - | Last 1 hour | Average value within every minute | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 24 hours | Average value within every 5 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 7 days | Average value within every hour | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Custom | - 5 minutes to 6 hours: average value within every minute | - | | - 6 hours (included) to 3 days: average value within every 5 minutes | - | | - 3 (included) to 7 days (included): average value within every 30 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ + ============= ==================================== + Time Range Value + ============= ==================================== + Last 1 hour Average value within every minute + Last 24 hours Average value within every 5 minutes + Last 7 days Average value within every hour + ============= ==================================== - **Visualizations**: Top 5 items ranked by certain parameters regarding inbound traffic within a specified time range. For more information, see :ref:`Table 2 `. You can click a data record to view the traffic details. A maximum of 50 data records can be viewed. diff --git a/umn/source/viewing_traffic_statistics/viewing_inter-vpc_traffic.rst b/umn/source/viewing_traffic_statistics/viewing_inter-vpc_traffic.rst index 92d9a8e..bece851 100644 --- a/umn/source/viewing_traffic_statistics/viewing_inter-vpc_traffic.rst +++ b/umn/source/viewing_traffic_statistics/viewing_inter-vpc_traffic.rst @@ -28,19 +28,13 @@ Viewing Inter-VPC Traffic .. table:: **Table 1** Value description - +-----------------------------------+-----------------------------------------------------------------------------+ - | Time Range | Value | - +===================================+=============================================================================+ - | Last 1 hour | Average value within every minute | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 24 hours | Average value within every 5 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 7 days | Average value within every hour | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Custom | - 5 minutes to 6 hours: average value within every minute | - | | - 6 hours (included) to 3 days: average value within every 5 minutes | - | | - 3 (included) to 7 days (included): average value within every 30 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ + ============= ==================================== + Time Range Value + ============= ==================================== + Last 1 hour Average value within every minute + Last 24 hours Average value within every 5 minutes + Last 7 days Average value within every hour + ============= ==================================== - **Visualizations**: Top 5 items ranked by certain parameters regarding inter-VPC traffic within a specified time range. For more information, see :ref:`Table 2 `. You can click a data record to view the traffic details. A maximum of 50 data records can be viewed. diff --git a/umn/source/viewing_traffic_statistics/viewing_outbound_traffic.rst b/umn/source/viewing_traffic_statistics/viewing_outbound_traffic.rst index be0915b..6c42160 100644 --- a/umn/source/viewing_traffic_statistics/viewing_outbound_traffic.rst +++ b/umn/source/viewing_traffic_statistics/viewing_outbound_traffic.rst @@ -28,19 +28,13 @@ Viewing Outbound Traffic .. table:: **Table 1** Value description - +-----------------------------------+-----------------------------------------------------------------------------+ - | Time Range | Value | - +===================================+=============================================================================+ - | Last 1 hour | Average value within every minute | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 24 hours | Average value within every 5 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Last 7 days | Average value within every hour | - +-----------------------------------+-----------------------------------------------------------------------------+ - | Custom | - 5 minutes to 6 hours: average value within every minute | - | | - 6 hours (included) to 3 days: average value within every 5 minutes | - | | - 3 (included) to 7 days (included): average value within every 30 minutes | - +-----------------------------------+-----------------------------------------------------------------------------+ + ============= ==================================== + Time Range Value + ============= ==================================== + Last 1 hour Average value within every minute + Last 24 hours Average value within every 5 minutes + Last 7 days Average value within every hour + ============= ==================================== - **Visualizations**: Top 5 items ranked by certain parameters regarding outbound traffic within a specified time range. For more information, see :ref:`Table 2 `. You can click a data record to view the traffic details. A maximum of 50 data records can be viewed.