From 0f7d228a70376c65327f2f847eb2ad0562bf12f7 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Tue, 31 Mar 2026 09:10:34 -0300 Subject: [PATCH 1/8] =?UTF-8?q?blog:=20add=20CRS=20migration=20series=20pa?= =?UTF-8?q?rt=204=20=E2=80=94=20anomaly=20scoring=20and=20reporting?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Covers the anomaly scoring refactor, the new tx.reporting_level model replacing 980xxx rules, tx.early_blocking, and the impact of paranoia level redistribution on anomaly score baselines. Co-Authored-By: Claude Sonnet 4.6 --- ...ting-from-crs-3-to-crs-4-part-4-scoring.md | 120 ++++++++++++++++++ .../04/pexels-thisisengineering-3861957.jpg | Bin 0 -> 67211 bytes 2 files changed, 120 insertions(+) create mode 100644 content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md create mode 100644 static/images/2026/04/pexels-thisisengineering-3861957.jpg diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md new file mode 100644 index 00000000..31c172c0 --- /dev/null +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -0,0 +1,120 @@ +--- +author: fzipi +categories: + - Blog +date: '2026-04-20T09:00:00-03:00' +tags: + - CRS-News + - Migration + - CRS-v4 +images: + - /images/2026/04/pexels-thisisengineering-3861957.jpg +title: 'Migrating from CRS 3.3 to CRS 4.25 LTS — Part 4: Anomaly Scoring and Reporting' +slug: 'migrating-crs-3-to-4-part-4-scoring' +--- + +This is Part 4 of the [CRS 3.3 → 4.25 LTS migration series]({{< ref "blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md" >}}). Part 3 covered the plugin architecture. This post covers anomaly scoring, the reporting model, and paranoia level changes — the areas most likely to affect your baseline after a migration. + +{{< figure src="/images/2026/04/pexels-thisisengineering-3861957.jpg" >}}*© ThisIsEngineering (pexels.com)* + +## How Anomaly Scoring Changed + +### The CRS 3 Model + +In CRS 3, every rule that fires adds to a single transaction variable `tx.anomaly_score`. At the end of phase 2 (for inbound) and phase 4 (for outbound), the total accumulated score is compared against `tx.inbound_anomaly_score_threshold` and `tx.outbound_anomaly_score_threshold`. If the score exceeds the threshold, the request is blocked. + +This model is simple but has one significant weakness: you cannot tell from the final score alone which paranoia levels contributed to it. A score of `15` at PL2 might come from three PL1 rules or one PL2 rule, and the log entry for the blocking action does not distinguish between them. + +### The CRS 4 Model + +CRS 4 refactored the anomaly scoring variables for consistency. The **threshold** variable names are unchanged — you still configure `tx.inbound_anomaly_score_threshold` and `tx.outbound_anomaly_score_threshold` in `crs-setup.conf` exactly as in CRS 3. + +What changed is the internal score accumulation and how the per-severity increments are named. The per-severity scoring variables are: + +```apache +# These existed in CRS 3 and carry over to CRS 4 unchanged: +tx.critical_anomaly_score = 5 +tx.error_anomaly_score = 4 +tx.warning_anomaly_score = 3 +tx.notice_anomaly_score = 2 +``` + +In CRS 3, the running total was accumulated in `tx.anomaly_score`. In CRS 4 the internal accumulation was refactored so that scores are tracked in a way that correlates with the paranoia level of the firing rule. The details are inside the engine rules — the operator-facing variables you configure (`tx.inbound_anomaly_score_threshold`, the severity scores) are unchanged. + +The visible change is in what gets reported. CRS 4 reporting rules (see the Reporting Model section below) include more structured context about which paranoia level and rule category contributed to the score, making it significantly easier to understand what drove a block. + +### Impact on Custom Rules + +If you have custom rules or Lua scripts that read `tx.anomaly_score` directly — for example, to make a routing decision mid-request — those rules need to be verified against CRS 4. Check your WAF configuration for any `@eq`/`@gt` checks against `tx.anomaly_score` and test that they behave as expected after upgrading. + +## The Reporting Model + +### CRS 3 Reporting: 980xxx Rules + +CRS 3 had a set of `980xxx` reporting rules that fired when a request exceeded the anomaly threshold. These rules were redundant — one for each combination of inbound/outbound and paranoia level — and produced noisy, repetitive log entries. The reporting model was widely criticised as difficult to parse and easy to misconfigure. + +### CRS 4 Reporting: Granular Control + +CRS 4 replaces the `980xxx` rules with a new, more structured reporting system controlled by `tx.reporting_level`. There is a single reporting action per direction in phase 5, governed by logic that decides *when* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. + +The six reporting levels (configured via rule id:900115) are: + +| Level | Behaviour | +|---|---| +| `0` | Reporting disabled | +| `1` | Report when blocking anomaly score ≥ threshold | +| `2` | Report when detection anomaly score ≥ threshold | +| `3` | Report when blocking anomaly score > 0 | +| `4` | Report when detection anomaly score > 0 (default) | +| `5` | Report all requests | + +The default is `4`, which is more verbose than CRS 3. This is intentional — the extra log output at level 4 is the mechanism that shows you near-miss requests (requests that scored above zero but did not hit the blocking threshold), which is essential for tuning. + +The practical migration impact: if you have SIEM rules, alerting logic, or log parsers that match on `980xxx` rule IDs, update them to the new CRS 4 reporting rule IDs. The log message format changed — run your log parser against a sample of CRS 4 output before cutting over. + +## Early Blocking + +The `tx.early_blocking` option (covered in detail in Part 2) changes the phase at which anomaly score evaluation can occur: + +| Mode | Inbound evaluation | Outbound evaluation | +|---|---|---| +| `tx.early_blocking` unset (default) | End of phase 2 | End of phase 4 | +| `tx.early_blocking=1` | End of phase 1 *and* phase 2 | End of phase 3 *and* phase 4 | + +With early blocking enabled, a request that trips a phase-1 rule (primarily header-based rules) can be blocked before the WAF processes the request body. This reduces latency for clearly malicious requests and reduces WAF load for attack traffic that signals itself early in the connection. + +The trade-off: if a request's score does not exceed the threshold based on headers alone but would have exceeded it after body inspection, early blocking will not block it in phase 1 — it will still be blocked in phase 2 as usual. Early blocking is additive, not a replacement. + +For migration, leave `tx.early_blocking` commented out (disabled). This matches CRS 3 behaviour exactly. After your initial migration is stable and your false positive rate is under control, consider enabling it. + +## Paranoia Level Redistribution + +CRS 4 made a broad effort to better distribute rules across paranoia levels. In CRS 3, PL1 carried a disproportionately large fraction of the total rule count. Many rules that were quite specialised or had higher false positive rates were at PL1 simply because PL2–PL4 were underused. + +In CRS 4, a significant number of rules were moved from lower to higher paranoia levels. The direction was almost always toward higher PLs — rules moved up, not down. + +### What This Means for You + +**If you run at PL1:** Your anomaly score baseline will likely *decrease* after migration. Rules that previously fired at PL1 in CRS 3 may now only fire at PL2 or higher. This is generally good — fewer false positives at PL1 — but it also means some attacks you were detecting at PL1 in CRS 3 may now only be detected at PL2 in CRS 4. Review your threat model. + +**If you run at PL2 or higher:** Your baseline may increase. Rules that were at PL1 in CRS 3 are now at PL2, so at PL2 you are covering more detection than before. This is the intended direction, but it means more tuning may be needed after the migration. + +**If you have PL-specific exclusions:** Some of your exclusions may no longer be necessary if the rules they targeted moved to a higher PL than the one you run at. Conversely, new rules may fire at your PL that were not present in CRS 3. After the migration, run in detection mode for at least a week before enabling blocking to establish a new baseline. + +## Verifying Your Scoring Setup + +After installing CRS 4 with your migrated configuration, verify that scoring is working as expected by sending a test request that should trigger detection. The CRS documentation and the [go-ftw](https://github.com/coreruleset/go-ftw) testing framework provide test cases for this purpose. + +A simple check: send a request containing a known attack pattern at your configured paranoia level and confirm that: + +1. The rule fires (visible in access or audit logs) +2. The anomaly score variables are populated correctly +3. The reporting rule fires and logs the expected block action + +If you have an anomaly score below the threshold but a rule fired, the per-PL breakdown in the CRS 4 logs will show you exactly which paranoia level bucket the score landed in. + +## What's Next + +[Part 5]({{< ref "blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md" >}}) covers the rule-level changes — new detection categories, removed and reorganized rules, RE2/Hyperscan compatibility, and how to audit your existing `SecRuleRemoveById` exclusions against the CRS 4 rule set. + +*Felipe Zipitria, CRS Co-Lead* diff --git a/static/images/2026/04/pexels-thisisengineering-3861957.jpg b/static/images/2026/04/pexels-thisisengineering-3861957.jpg new file mode 100644 index 0000000000000000000000000000000000000000..e64682ddfd79135b9a48bd27dc91c4ca49050952 GIT binary patch literal 67211 zcmbrl1yodD8!vn&=pGOx9bo8?mX?MA>2B%nl9cWoQo50rEwf2%IqNq&&e`+Z`#jHc_I~!C_kXqkVr2!S0ssPm041~le?H?IAZ2CE zHMG$}LXFqTE zzv*Amn9S1YF9t*ZVo!7f(fIyfZ1-=>`L8nn#!`Q=wTr7Yy3F4;yIZ?h|HXr79P8_2 zgT|02XdLb9VB?3zi)f5+_Hl7Q;~!{D=3-;v1prX|zvGxY6|g=lI`d{-@Oc9{lawf0ww>{8yiW$S41s z_TReyO>-*+0O2b%H>v+kvwQ&n9Z>*qf9=0%h++UBiUff6nScBr^1tK7-rL(<^x;E4 zKR<2<8!PU=g#PFFKNk2;$^SL@$Njkf-tRx$!R2ghEqt84;eScBa&va`@q~N1TUgn^ zx&FsN{C{2XAIC|6u>$;~tIC`Tsiq zzfRy3^iQytgB|>DvaFU4+{(w(_b*026Ms(_04_iTkO7nc9l!{%0$cze@CXnCqyTw9 z8Bhmw07JkGumbD>7r+zn1A>4sAR0&jQh`h$7bpVCfoh-uXa+if*T7p~7?=QNfhAxa z*aCKeW8f=r4g5qaGAs}Qh!jK#dH`Yqae(+h!XQbIJm?8X3uFj-3bF&af_y+hpa@U` z2nEUom4K>2O`tB&ThJJ24zvpT1UdwrgKohPFg}cE{1!X`UIK4{kHJ?E0D=c0htNZ~Ai@w?h&sdwVhizvgh1jUS&&jl z1Ed==0$G4;K~5kyP)sN(6b|Krib0j2x=<^q2Q&nl2+f7QgtkKmp$pJY(67+n7z7wJ z7#tX)7)T5Q3_A=zjA)E3j7p3)j3JCAj9rXtOiWC2Ocu;Xm`a$2n2wl%n2DGLn2nhI zm~)uhm{(X>Sd>^CSQ1$3SQc2`SkYK7uF zgWZQckG+rm6Neaw2}cx19mg8SA14K;9H$#+24@%NCoTyt3$6sN4z43^7;X-31MU#+ z2JQtO9v%ap2%aXM170Xz4&E!gQM^xhH~27oc6?cU6MP^1Wc(`pe*9JZ3jzWHW&$Y! zBLZ)NWP)mfcLW~@eh`upauXs6tqGqK<`K3N&J&&y;SezqNfVh71rTKswGhn^oe<*? zGZV`aTM&m3=Mi@iuMl66kdp9{sFS#mB$CvSjFB9`uwcwEd6+dU5>^I#2iqovkTR0W zl3I~Qkd~7Uk?xXVlCh8>$sEZN$m+?a$-dr$-4nQ{ckkJ~ynDU(w#Xsm%;ZRNXYv&C zX7Xk7TMAkVX$l*PIEn^}d5Z7%sqahOx49pGzw!Rk{aZ>nr97n*Wg2A%7228_FqeT-)Q${mMb45!>t4Qlk`-1iz?Fk(@ofMrT zT?Snr-Qfe$2a*pQ9%MXt^WX@64=xRNhUdTs;a}-#=#}Vw=u7CQ>3=e?Fz7ObGc+=6 zGU74{Gukp{Fb*(&MLa;LB7zXLh&3i0CSfLfrfjAWrti!w%=*kR%pJ@JEcaQEECDRF zEE}u@tdCheSW8(K*)Z9J*__x4*k;+m?1Jp}?0M`n9AFM14hN0`jyX;YP7zL5&Qi`5 zE_^O&E?=%%u20!q=Kq~F@ghvzl0tMc?vZM9X>)ldip5;(TXsc zu!eA=@Tdreh>XZ{k=G(OqC%qHqRpaT#JI$q#A?J2#972`#LLCEB^V?uBuXTdod%BtzA8){5yu4*0XfI3n=U42u7MZ-g*M-x+1Lo-ivPm5P8NNYr!RNGv; zM*CVvMkhsQU6)nYM|VJvNY6yCTJO8QoIXl_%iy6wu)%~Om7#-SrxBKso>8UIm9e~W zrtz+cph>jJvMGz{Gt)6MDl=!ZUUMRI3-gwz7*F+|);ztlP`4 zxzPpN<*7@TE6ml&b48sj`3Y!Y&2}gxrM(9U$N76=yMs7zbM%6|WMterD#E8Wd#X@5pVyENy z<6gx5j<=2h+skqY68>Po80gvwu4u2owvwO$TZKdP>- zp{Yr!1=sr29@d%E&DP7+cQ$Y}lr)kzCcFY(`Mf%6dfK$ytkOKtBHYr@%G8?QM%otN z4r=#r|Jq^SvDInVIoGA!HP9{A-PXh1Q}vqubzbki-jqJvzR12mZvx(2^}F|^pMKX=&-`@yAkP;H=`1xug65ky2gdaJ0^rC+9w4k+olAk+NOo3 z+h-olbk2&*cF&2=_02z?f4d;JFuaIdoLEv@np@Uge!pU}vi08j{lTj9>bEuDwV&&u z8yFk$o5Y)0A80<5eq{UDxFxjJ`$_K8A>)Te_$2(p-ce{~$1bbQg5B94M_zqql zDjd!p86WK)yC45Ni9RJc%|By3YyBeiW%8@R*WGWP-~OB@UQk|CT?$+dTxnc=xOTbz z`91yz<&T#)!Z#zg`nUT({qC^ta(=P>>i(_rd*hGGpFe-rfk*%Y6B7#u3l|R$mw*s0 zq%dM)7%A;NanS(C+@2o#-06qkr zOAH}K`!?TXs~|mEfYD<%W z$ok_jOQk3fIr*A2zLZ#oS(LhMkta1XTDP^I&1=Lzwp^=FcHa+hLkggzP*SOhOeQm_ z$8XOH11}ywSiSi0Zts5G@i&)v%cC!2Sr!u2H{bQ2tJ`H37MQveYMr_Kk|=bX4({bj z4w$0q#(8z3?Yr1T&h|$2=6qnHp%%epb7fBX-kVTvj|CbPRYhz~hKGcG9=sj{wwb7H z2o%Z*If)3l)WF!${ho3zsWPLHH9ZWlnq5i{8qN3CB}UX~>!!GCv&L%t-iEA;xky7h zHx{$C_SR;%=!*QYQU`V}`O$-A)NEs(VXm&1Q;Gr=K~%P(YTLRi`>Vb7Df<^$SJ0z8 zRssmlemw;vmlN0^^E-Rz*4)R+?R^Ta6!TBDLm?_`lU<%Z^bVp)#mqRFwiT{HC)BM0 z;ym%q^kf3K4&X3E7{UOTL7tv0Ki%ju)|kU7pXBD2&ivO;IMw)<`XWu`BZS z@8ayZ{ye++vfD{~v+nkm`aZe+LXRYEytng2x`dy@8%f7~pCv@%sbtINlN>sc zCvGm&7Np@a@@xof6#dvxxHMvToW@dJD}gkXSAu~Tp17@r*oI-|tngM2Un`TeHfzLF zbE*{w@%s7jG>*BM^>;WwVjj*hYTDIxGAqp zPJjDkm$!k+Gg6yM8Hfkc0F)&Xgv3sj7HJ?sk~o=>l{qJASs)zVPKyQ;Q5{UQz8&X_ z$c<_%PF=%AEWd_5edbahpeAs+VJVewDYXuH3*Re8GWn6TSxJ10p6UxwZai{1*Yi3# zuJ_FLybK5wUwZvBfP>~&jlkJdoNetj(|BQRYxztrxk<48uwH@Tx6BB<^t8FIWb8Bq zB?1S9T`gboX(;a09y*+Ve^`mZzQS2mE-kOgfAYBFIOORcz~w`Y8Bx!v*3x6n-h*(W z@vg_gWsG|_5~P!YvYK6*s%A6ww4TBK@_I6ytimT8nvUz-GH&@ZIB`$nVkGFRd1$D# zy&|>|V{$eM==y1`vZK`&jsEAqsy%F)>wR*{T=V#j$9u)cn>I6ekJh%;k*~ys7PmlT zLRD}_Rxm3_i3Fp3uTvh3k^`*6+R2Owk)_foITA!DLJH96cc<2rwfA%>*`lJu9Q-PT z18l29ECXEP#z0dtnM)g)FAhW$jlN6Xo*bQdEMJ_RxSZ=Zdk5tGWvN@_E0^6;mylq* z+j2Tzz}ajtrG?FiE{d=DXeQy61wCIRQVmX^_MU26%pxr;_h(uROu{&%>si)F`}+nn z?Khh>6){ydGOC_vHGz`K-6Dv#Ul{o2=6$aCP+ZlwyNsNsz;`Wf82HA%(`IC^wlsO1 zvF_{G?%1x#R>C@Y&Z4{g;huH#75iBmT+20YZNT$NmRzVpGqjmC>{4nD2Bd`j3*vFoc2;Z<>eT1!c=+5yF|bPVfMvgZ|M=K zaH(1PFoXcg5(A$>x@43pKP+z4qbhnWKP>FPqg@Ia_qO#Kq;@-`uygZ8W36{uMYY#w zTIkGWGpbMTTCx%8RMeFnva?Fgf4G#*7a(9SnbBr!KhgC=i7sIs%d^Gw+cON?u5T)(G`2xDP;dfMKb={ z?L*B*_0=Aoz}ifP7h=vk6Kj(%3CZHUsFvBB6tG+~Ey%uF`GA{^sQm_^tTUPs%lMZF z>H8Th#5sibSZQSRl6g6h3J9FxLb5V-)mIYqaih*^fXNC11&5?Raa!BK<|@S_!IlT( zfDzbK7`zqq<>@dvX)5C)M7Mbeii zNR?xkBhsMgVFJkWuwV)b1B9HGp45;9kE)U;3Err|C+}yzzozz+$nEr&JSaXpW%jrN#f|(h|47{ZP*g zV_g4X)p>~8V8e60iw6R4pZo!&+8s8=X5YXH6bsM4Jlzw$FX_{GVnCNN=zo5A5nw`7 z!7s3ts0TK< z@4?HU{mRQtn$3qyCly{Q34gW0Ur7aa3FI#Ixl$-Twv2UE7w#u*QFc3ApSewx^fhdA zVEQ_UX2v(>D(%iV$SpYrnp290qg9AY)H9n1dHk&I?!4rN^2Uj*L$3RWaSA6ldYp}x z)8eQ`-wD`@^XK2X@;qXP(eJm9@onN z*))?Xc?#eEkiW+8`FqTEm%=AxW4MO7&Bd&;d2{^V54= zCEJYTYdw$rD+TnM`S*W^z;0z9?aLZpCq57??7GaqY+2##aFi)U~<<-DMHn}qEYnUdGUni)1X@hpXXVK4a#yl_iVlA%++xwZwpzp(>`}eR`=gF z7Fe?+$G~{uOlU>T%b`;S0}V4l;*`>3mEv&ZmWFpn8@4X_4VokgKM1+0B!oP1KArp! zQ#6x2Y2+nWuBORG{25jpsf?zaV7MHoNdhAK4ve;dV74%_eiWc-0Z(J1M`%lty_e@9 zGl=!l7b_AIFg$e{(lZT78@J#x*wI9W_#sMY2_{WH5H;F#wgzRlY-QE=-;`6=vMv_45yMd(VP{OS_ z(LQ^V#K*$(D!j&b<(8#3RfPFj`LRryLI_9bS1olue1w)2%`P)>E<#xPEhHS<>-d#l zv?+5(3Lj^R3Y}R+Tkr?eo{us{sWcX`R988TbcT}jphmCJ(71bH%HZvThx=S@<|}s% zf^ciJ!dgtChK30*%x=S=+puueToFcE>aLD&euA8K25;B1C3o~e~H(pe!smw;`nk?qSaqsy;L-i{YGeIHBdXNJ_C|OFs2i!y?LVU9Ks^c4|SxcE-%KI7m9A zAMHCd$Vm$WYBG+V>DVP$;6Y9M@_bDt7+dL{2%FD0hPU(CIeTd9gmu}s{W#ZGLe!_0 zt%`RjGAmRnB0pcLw*j00biKsW!jfc>f3ggu%8illj;9*AC3ud1gI{uo>pp9JfV{k3 z`F8pTXuEW7+@^~;W@FNy3TEk+9Dm*O@+k3myhtiOe<5Q#aNNb+9UKde?GGS@mJ7Ft z-F66C3n2P8kc9 zM#y&_J29?V4Jeeu?xQ^nPlxhKgf^04kR}(qGK+AAcI5OzApaxeGP_t>B$CbwB;evc zkxG*iuPHoJyq!8d;yZpf8fYgg9Q5H2P& z5qP26gsBTTsTLSTb}lz|W`ksEUTay`rBQvYHbTKpxw?8GaBRQwhAuc5Tfpm_)z$Xo zlZHAKZ>tDF+?ERwFt{Vcf>@kgjcjzZb@2Md6v5fqLwU1_;lw&v@&>a{U#Q`2PXv(J zoTx|ZTJIq#uPEIt$TkiyJ)SKh_g|{vUnihSeTQ&~cq~(x>|*jNZX1Y(1CO|a{{Ui#7ZfFzdUM;J zzwqYN-sCg}Yu1YX)?2*|U&_2Yoc$Szipg~IE%o_yu$ruiGT4z#q6HeMD`B;j-?p8U zHE~{jTJheY=P&=n&&<<_vJ7AtsEvPHK~q-h`GWN%Ur6xv1|w5FEhUE7{e5yFxl#G> zB|8ImJ)dj^lNOuw@xW)4T>Ul{_MFT09C{`3{Zfa!j(EIm9K&qR4awXy5*u3@lo_|IT>3um5=6$a_m$ ze|#N1ZIf}SEHad#W3!*Yy;pa*%{4;AY>FsgF##!!QaN&xMb}bwpA0LDqG{-e#&xn3 zg&|d`taFnj2FOhUb(q`JAmwSwJ>H!1J7U(uhTO|+yJEWIhUyF6W`So>?86f>jO^Hn zvEo-0{vVCrId&>~I!ZHj7CWvpJT-_rA5(maWU~26%~3LacF`9x>E-XWaP^V(P1Ur6 z%rE94=8$6NFm^++RiiF}^yqxJ2t-rXkri;ipV@I-7}cG1(^u&v$UHUsqTbp?vn^}i zTR#0|7Ygi&>e-54r_4^6^XerMGgaEmAFg5+kbs!P=Bt!p;%UhoksQi>2zb%1APBdj z`7SS4E=_G?{~0DYR&v$e{Bs~g~0xUCnO>@*kUKa@! z%AdG=<3?xdWM|>emc6xnRLkQl2OKGSnQ^4j;1CqrtA>+c#1i8)K;+?|(G(!(45Gk?{{e7zu0%;7Z9w=2BiCEQC0wTc54@=;;T)Z$8*eaj}$~yxnJ4TCWf?z4d*c zTc7(VYn0xHlMWT#Ckgd)@($W@7`M_+r}})E6%}0fv&5$@r48A>o#AZ_M8 zBwtJ(1?*c9j#!211>>;}r+dnM-Q5VXOZ=5Bzg?fJHh%sQg&T1Ol{(be_R7!kfJ6GB z8t|MvoZT zr#hpwMogL&mz$TW=v{>G+$=@{8c8M?B+MsJNR*?s!(8QMQZ|KuT`PK0Z}jNUe($1m z!}!@84mE3=aQTSjv+3652WH`ytRId_3%U&E1uT(pBq&d3ym0BapE`w|%~ylBACr4W zD+oiP&lJ_imx!o5peAzi3rSIV)=0d7Hu@&G(Rhx8NS;u-Va(So4>^x>Z@!|9+=b<+-huhf5WQhR?dQ!dR(x zLWPO3i;={RY)Nbc;4m=8+nSM?fHB)zeo9VXnVvl^y%qs*;3_mTX0COqUw6sk+pieP zqq~O!u~(0I)L=Lrj#H*R?L!TUEpboQE)~Xdw+qab`x41k?Txc~TFV>NOcNG#D>KA6 zYtshj9H(YU3Q9 zXBNH8z5d}Mrh8aSa@;yPGdL*j)N-|hd^3NF#`Fdy;F=;PleFqyJ42yAra*@Pc7{;~ z^E+@l@boqJAAo<}=;Dpk*A$7g)Z(;x!exIIk9)}U=KdxD?VYQ+ zSjpSt9|xLL9_6V6N*2VpN*i3Xg??51;Q~P2@?u~UfJORWi z>`R1#cS#$f-z4%nrOJ1?3w4%^=Oi;;e^F&JEJF=OsEC#9Z4;6&lE6uxD5XJnmNxHH zf2&sy-h5eltuhffzNsj2aM#fB`a5M{uo{O?jcH{5mKBRgGL}x8=JcwrJYlB)Mm(-y z2DUJqkV{GiP=-U^uMz?gp(s|cmmH213cdmckzvCLmBNu=dXN$b8-jlIB`8jH=Zd`f zqHn2O%sHkz*+Sx!u+C3O(z;yQVfHR5XOrOavxh_x>GAKtBv%5pKR{USJD06XPh)<| zli?!VrdRqgijtQ){0&3Zbc~nhSGz+U)B)5vzC3>4U2IH;-gl8X*BrH3*LS>7LC^1< zb)+Sdv}B=VahPY(^H9vQlZDk^499wAF7=48Sa~n$eYiOu8pkb^sb8Oocp~rkHBd^z7)S8(T+ug%1;S&;;HD1JHBl)Ta@PUN88~(uZCuOgLt;mSl%?_%;cHb8P8dFjq=FQR1MS?_xQ6A%Oi6xFbxVB8=fF0+(Rj@oWaN=Hb{^6@44ye}$FwGg~or;%M>U)pehc zyadOzec1ik`I*^*wxwXqwcF(qBdM1tVupDl0(b%*9hE`?cAO>F{S5}AuzvV6Y#NC4 z?n|0*sF8t+GAXR5zw4PhnKe2e>P5DNU}IN0+sd>VEtXjJ z#tLXgP5R`2fB8*3t8V3|q^R+e=a1)+R5cYCvgU3CFSHgv_9IJ==yIgT%4rO={F4~b z4xH|-PpvS-jB|$6Y*h)7hr>LeL;@v!e?@U%_r7MTRwRoj0PiTzqV#q;>77D7RrbYR zxp7DQV#YiMKEeotINgp~U9vBHICxsUIV~D{MvU5=v3BPei|ciycD`)92XfTVjPcM+ z{&QcodFB2u>X|^I=O-6e0k1^_s_kW5t&TYm&11yX8&jFt6&l0cxjF@6FG4CRjF2)N zU=V{rDx*AH4q$^L=^5q;aR7KY{lA_tX(07UfP=JD7#Cavo}ffVJc^70)7c0#`G3(_ z{YdRNVL{SshN&)Si@N}K&KzqwLmD><1|AF#Ebsp!%F5c)ZAc;i+OVincx&W8kbeH% zJ&#P|aLA&KF{vXfKzq*DJ5u0*jKh+H+`dU;_zn)|gxdq#rsZH-I^{R&2^|sg%`FO; zU>1Q?unYv@mS{aUvs|XLkas`uYxBC53;Qk4dNy6(rm9KMoF(mjMl~21*^07c!?~^= zg9J=7O`86?Uo%8a==6EB-$CKzaI~{D|1)DArSYD)P~W48-(RZFKJZ>Kii!D@uTRc* zm>H-Uc@1&6ibNBOoFm2RW}6Dwoc4}(88wCV3lP#^jWm3vu=3bcI4&!x*{nRVR2UY6 zKtxzMu{>P5AEtyWA2#I)V+Bd!Kw)x#JC!_EF4pSB?*_nyk6H9RUsv<2vn!S;rl3Tw zkR5fVvqpOzoqk}-sXO;-f7{a5DQCyY&PIh<)(6tVng9>cR-L1dj#T%~PZueu#8Dsp{AerG)$9$0CsaVJ)%xtO0?nqD2MTOKMa;0aasRrM3(O*+Gv1o0o; zr{c1#DuJoB2z%uZiwJErdeMr~_WRKZj$YA(Cn)Z}u{il%{_VNPp~si^Bg@SR&9Vp< zf*Oil=Xidq14rv46?v@Lm4f7Yb1mLfft43Sk#sp4Ul&JMM*gWM+;qU7h5TJIv@MLDsGi&wKkaSRA8m zW;KT)RZhG9=+}Y=S*Ls6-=7hv?Y}t5o0?iZ|EW4H)_I}r!hV&1y|;BVK_K)knBb=f z`AzVtVY92T{DRm|8Z5IitERm+(GQB%kyl@A?Y$(pTQe)h7HoZ^ZTozJXzL`aawaf( z&4o2oQMhVeW@XF`uI(<_&Lehthijay_H~?9RFfUh5}D{MmkgV|L#u=RPP=!mE^)kj z&Gmk}lHP~-du0m4)-ObFlgA8tjIn5E-#p!s9B+#b%I%u(uA?Oqd=T&V+iJTnjqqC0 z=k1l`uTAUsM_;e%?GB`;^FUUogI|N4C{fLq$DElVF%Pt~-yQget;TylipATb<|Qz!n|3q-Qf8hkhoq#vob@r-_;^}DFvq0xRoAg+*ZjfY`G zn-ROJ80VhC=&QZ`7RN%)M{^;Iofl5~M{l?s-qtgdvM!x$xV+~h!pkSK_y~Yr5~J56pdeNdJ!BS8Q4#@%!@#L7 zV}OT)QaNTU7Yx@1j2(`FfFcB>Ve&*%+kwJ#4TJmxM)86EgMT180rB+ppnr`|W`OMfvwYox2wRqaZd^-^g<(NfkFwaAsX(S4(V9^Zlr z4wMwqq$k_2WoQnq6kpTEY)eS2SnyNmyK?%eQN1{A-1v5FUH?dBMhVs2L0(?&?W&ol z!XDuKu_>M9@q&Y_4E`@J*5<87z4l;H!A&c6n!2@Y2{(%D!&UL6f`Z;a9}J_7$rtFfGI2sU5ndvsDjs8*0^dy=(dwQVCN zAZQnupz6Kn`1H$qRnF|lL8~_*!C-RYy_7^HDO_1kIpoVQIRY#Y@fL>QRxDf-0!_sr z#vq2Kf~LS)GV=Judkpa)w9gAhLF1`dW65Ind~4o>9Sx0Z^NF>xU{086cv@L2FSpf_ zzg+idnerCD+}h$R4bA=58ppoBQE5)wvAe)XmwsFOGQF(nZY9;RV()9Zci#fG zTTqSociz2rmAqQfTRC>GJ=N(eqj!;a667#swo0cQC(z6cxwbbe zWqv=r;p>pm>@g0tc)JCYiiN9au<%5rYX}d2^>DVU-cV4RMNmbrPP2oFS!mCDdw=6m z{nl#sRCWpFyXleA(2J}9F_L}AoRP}R&KGmtJAs0Q!?~dYpRDS+kw@)neY6GdI2$AF zd@%EaObQ~dc6K-4-{WQ=JnZuRMjmjpPbagY{@5*U@^M{JRsXi4bF0@6-|qyOL1KZC zijj7HFk#$~7%i%xkBo~g?mn;c@ZR&?(0-w}tJNRtnR@8Az%qPr#aT0Lo1&7DZ1>#=9Qv2QZ^i`dLPseo?}PFVlPJZo8&!JJEwB6+(jUo0ULJ`gH^g`r zJZ7t^TJ_2kZZhu5dYPP}KXKLI$|-W=#_8zU&Bu~6EB-1XK?61d;*v6138M!|B@M#e z0Xk{0v=ltCJW@+mO$k>C#)`{ok6u#4Aq$Ns;%QNn#H!9#7l38UggW{k6?c%ySC=L6 zO~w0`*XcDMt|S--Z7Pa)GYU>WDhKaV&bQGl1U!|rzliG&ot8z zs@CVro!P!LEmq2X-_B?3qO8o>ZsxJKny}W%V>6R#p9f_^2Fs+itWKELN!D3nLb>9? zqT~ueLu&1~4ciXaUp32O8aGxFI~SIRE5@vSpYasYMyy=$q}-eIzKg7>99#~?MzaM5 zhofH!*A1ylw3NG%SI<>{%yeFgXqikb%%vc|^|9ly9?m>zNRmlBXt{N|eb(I>7+Je# zI@zMPJgv|WViH%`&EH^sx?VkPS;ZL&_@l$H(e9iype(hM$|BgWDNFDSt5gaGh>*>r zmsn|}p=bfiP^YrW5wn3ZQeO|HzTXO{6)b7z(6wycNQ(OGm0*;pM(vWd>aa}7xpgDg zQXjRaOwWTIISMC@l&V4w9K!POCXH3%?<4pa_*k$fV>Ky?p9W~hDnaKnj=3$Hi8#5r zad@!=c^2o0HQq6M+bDBk>$KE5EUAk&BwP9$P>a9+)2s-f z^E=`JPQPZ7VKALp-4}WG=JI^(Ql2F5ZXdgPbkZU^Mzp% zOA||pG=S5nknmIm6dXtPyqb~%YhlbKa{=|PHlpx*8!2;UCbbQ3wnafLzg}jomJXM( z&bMXr)zk!`Xarlktbui$ z?9Dt&FO zMgT=e&i`A|vLT9+n;Ns%4-mJWcbmZ*haH~Y4U5eRCO=mf=4!&D{k+yUt~R-2h@Rtg zUf%7`w)%W?-SxI^bAd!mHu#n8yROa=-}15ug1lXE@Nh|U_JrH$hmxsN;XCt$^!@R& zFy4M8R#p;JDh&Ms2}9YJ0;PlTGV;t?h%os$L<$>w2vL>Qz1fD5H5;3!Q1%o2$noXM zE`^QEmxvkClJSXz!x8rWqY>uW%gMU@)if=#HEvwQK8ZWIw4OWi znLblH(Cw853HhtD?F2FAbA{W0mp2Bjn#;-3Y7Jd?fidq@N6ahF>a383KhtKNSzhvQ ztDBi1ojOz`v)G0Bc`mRIFBZFQWWI=D3e=?V8PwH>O+6(9NK*y6-cn`0H8p;wwbJPA zT^@cbT2v+Ox9)eo%Rd&PlI$EFmTEsEo4@i-Q29yIb3MmWJ8@d)`8=ZL7offj6tBRuY0B6BxhfkkTBer@^x2zL$#``1#AsJr;awO=~MG6{a#HrtP(1<}gBNA&?+=Ve*%)%aEY3rHGm^nMw z&YSMHmq@<<+7Pw5-Rbu+uQ?&fcKW&VvsLb?Wp1rOmc=tqS|RR6b=!)Q;QQqro_Su5 z-rggLJ{2`4Mf?Xp)Fl0i4vuthBp-AR(2-Eg@(bTxvCNS^x@i33JsFU#}%@> zj@PPo_XEjjo}FlTavv*sCLbwzo*mAMRC&iqdThef3w>|!Db9$8hEIds%^AI}YgP;Q zTl|R@I`$5?+xjBnb07|2`@CGbD&9Y5CBT&-xE9FfEde0S`0 zy!Q^;9S|6tY+J-JnvrQB8!;TqmaXvB!zo%rDKKY?mH466TVY`r`hF$2mJ$<5xdsCb z1`BgMqnwC<78M%-TGfS7v4Opm#WPW=1D9#d?l}EIb~STPZsoJ`@K2gT>Tg&yRe0RJ%225E1N?xBY|Ft%m^S-+3RcA zrM`WH^qTp|Ev&vlAA4F_D6&eQ>`QDdW{|+NR?b&Y86mPVsukRNPq*|QLHWI?;(Jl$ z_jEJvMWx1cPjJlkB`$<~lH9CTKl&`ApiiitCcnDIiCnkDT;^1~qJr+jMUhY|-xZ9XBYUSE zPshP)8&RRz%lBgkyqC%$h)B7xn3rGMo1Ba zfNW|k90iZ3-+}dUQ75L6wl9LUR*Y>EaGLIv5qoAjJ^M5DG>M z0|*`MiWW2iumDg$n3XDCRyI`-mPZ=yLTLYNX0UI63svVZcfw-+`l_qNTZGDMzQdYd zsL9oMwsCfEuy(9+sb%g!y4FazJO9*V@-Few9 z=OfpeNB4wXr6Kt=IjrIC?qfL6w*Gwu8AXL~MV_RgavY3DaOpwB7$I1il8ucac2152 z$)_oUenAJrW70%9Odcbxti%jFbMhDK+?^g#1cduz4%j4_)KhZx)|qxKl?Z4XY7hb> zQsY#-ERzeHqlsrup6!r^5W2)N4@E|K6hfAtF|n0EMH*JfCSN^PoF7&_3T6uxfykz! zm(0-7v?BD?{b05vHEir+M>G?drO_lvL9%|DbVqm9&Ylpu2Mk`m^vwxo?{Eb) z#n!tT;sb;}5;pQzxG8!S9^CNd$#5Az(mv*IW83Z_Ul9>&G+ElSbI$42yZ4L2Tevq$ zn7{3!PIJ7ZEwd8&R`m4{3mBd(OGy(KiQr@#HQ1TR`HI#?V9*W;3I$o)l1mGZU5H3k zQKm6M3WqDDYO|7vw~e8&5wQ%h{`Ydexc}lVh;DnyvE%7*tD7QmY&1W*S~Kmj_9}cn zLcaFr3!^OE3PC5*y6{{_cOVX%|7xv>OS^VP>s^yL&Sp=n;=JnQ^!8i_)zcn3rnGE@ zY4i>@7V@3#pn3QDnjKD7C8b;=)?&~onu;m_eT7&6%}MH_HdQ|H;#Pk=Ktqc2mWKxX zIPQ1f-7z`z)oOEL(ZLs{YgL065_2JbmYXeARYg_IIu-SL1*Lor6Eq^XYRSsq_B7r% zmQ_^GoJ!-e)^=;PJeC)FtsB|p>#*EGS~I#ocn-_i$Sa^8-sef$O~w*wc#^7MvI0+) z%Ic&s`qUXo2ruq>>BQ0S_wEKxBnR_tWR`&lUr zstveH5d!GQIt@Xx;VLLp3aSCsdMZrt@|8Hn_Cw2WcE+yyN6wAwKWR2yHoBS`KQ@nX z>*i12xx}~3ar$Y>7LJhh&UNBzi;QhmQ0iDGW}NIzZ_;2n88@HfCOb!^AV=X3ouZWy z>A728xw|anB%=o#G33Nv+s{P4b-Jm#i$~_AO69MFyR%h+Uw9$WtbE3`ZX5N0(nwPw z!K_ha`Yf+!_d=0iF8JsEFlD9wEm^qMSzJnze5P`?FPDC#~T@WH9_X7vG!wJJe|%JB!q%YsFpN9=|x zGo&%XQ$^31FbfRVUfAxmE%)VBQOEF&n(}m|vzC)ZvycRH*lG_`2W2HUT5iOD9Tj!d zFO64zjUp#eGKgXP9FUQmG}hVn&fh^A3CW+wc-x=9La-Y}#L4KDyXE1aI&GDakgM>W z_edTQj`pXZI8X-$>~K+lTivH0E)~l5k|y`>IwF82080j~iwMe=nAFStRB%tl@)X9E z>m^UY&~22N-ukw0YHCg({~YOf*ZRZoviD170QA?z)K#yzu)6K?D*mSm-MW)rNlzh5 z_g*1{&GZ#DEuM)V*6HfY^BMJ-%I(AM-%M4kKjlBN9qH`S~$7z_%}Cr)l*KpT9pP;^ik(9~MFH#aD|_4IYzC zKJR?Q95wfEsr)n=EWUTzg|1w`(A5Qm^j8%sBg2Hym6XhOn$=F$7b3n5S5as zlKZKuX&X(-VFi)5D^^z|&5sXg(?bYP>}pUYlS&QkZO}rGE`3N({A_4wX%*Y@15d`511+AXzm;0C2E3K>&`5oUqs#%Gc&wjjUT1f3x z%6#oi;4&7)XskKg_j#4cOS4aIVN<7hwequ2fte+Dpvj1hV=v7ctyobu3u`Kq5AO{z z9|>&qQW_lAfnDR4^3RM$tXhhFwU4Ww?3l^7(C|jJj=Spb>|e6Drsv#xp;jOXNR})z z38)Ay^3*#{$S^kawuXlA*s!gkBElN$>?TfBc~Ox(OuYYd+LhUBbWZ0;nn7OmUJ zwDDR>9mhxSC&X&wrZqAJZ(%!lVnf{v_k~owL>Plq zK4s$^mvDHYi$rd{d5hjauKlRzV#-5DeNpNe?J`bOhg$nF%~p#V%$Uz=JxYHP_uh0% z9*2*q+8{lz)$G3DC<3PDWlG#tj;#bzqA}XKJ6CdwgC{l0;|Sv;q(sOD2pt7J562lq zcM3zSlcE4d(#2vr;>&5rBhgNf2l&whMz?j@M|I=5L;ZNoO&ng)bPElRO&svEkTol90gQ%$vJR&x~Us z_Q)%yQRyb5r2ZD)$SKWBNztKImVKt+7{!Tzlx)Y+5nZdMos;_acjN5~*IZwczSmbB z4L?)2aSge?FT|pX)7VPsn!)8PhASgxB{W+_n87i|hN-j|XKv6uQ7g_VN>Rm0N;2QZ z5xpnDW+PvXUt+nd!keGu!n7EHBlGTfloY-t2ltFFzO>jEj-8n6EMot(jSfYiQrCDO_R-N% zS)g&FHA9ca4(%3z`T;mG9IOPu(fjUM@6!_h*11VX2PMriC^hxVBSO=h;r|a)e*qTd z^Zk#*OGqdk3evE2Bhn$w(%}*!UDDm{BHbyiG)pfb-O|!s(jAi0{%_u&@9%n^v#{K| z>@{=d+;h&%yiTmd-%quC>@Ho7yDlXk6XshJZq#Abl0uhu=OZzV7lO;$Z}zVRmpR!l zVqdA|T(#h)D~KDqQoXbnd%EpxJEFow)SZe*KamnC({z%xpu2om7pPqoEh!?QWVlyPDCZ1rjdw*7Yl^V5w*&mhron)`S?8 zx9Yd4UWT&ow>&J;553(j{*blg&YQQVbcSQE`g{E*H%hg5u28i_rp_>g7ECJ1lN^MXKj;`igSJ_tlsg1RQ#H_CC_fPM@UdsdAqzkk z`>nfp`at34d^`7WSlkKwaV{!&cRc&k+h6?q--^-=QHqa-wdKAg)4SalFMNNLWa+ax zeZnsV5==F_dQXN@)Zs1`FCs|QKJH-0IHPXo&tvCKL)h>lq%~81>aj?+PDJqKJFaXC zLaLNe$ar6(zgf8C%^-Qi0Ift|0;q8TiUtql7o>6Gu*;L}2-kjX=(jB4S=F6kv zaaUsLBdR+h|3HPcn~zo(xHheXQM;E*#6@079~7*B1IvF07wRB-kdmOkfm~56<`(IN z1Ltb|fOk7eDcqj3}whmYJ~Ozok>xNcQ6A=56X(5$<-( zhuJgm!LO_KXupVkvHr>}(Rx3A)`5zGi~?t8ZXKUZSXUAR13;_g3Ep9p1d5e-g}$L% zI&1SEv8;Cyv!Abs%r?~_F?CW_LY}F8p~PkjJrCReIWn#2*O=8}9ykJLaX8PGT52q! zVzvJVB4%+t^MOpB>n&cZypc*aV$>KBvflEHq7J8)Kpq1?0hxS!c>r2YoSS<0iYvID znVDU9>F%&Hw6Uu-QWAbQniBe)u))-B6}Jy$EheJ6NOlnMYyQ2EP4@(X<*!{$}|3#2`Vla_vyd0 zc1|B~OZZ24<7bQ(4<^qFAJE~cBTdJm-5OiSX{>N zYDYQJjS+EweDzvxSE>Ek1sTmk&5&Ta-Bm?E`h~*b`F`tPI&*0GxKW)8QQi(u>+3F& zW~u5fV&*p`bp<4dh~5J^H3*47aAF*F=G3!Jz`@<~Swg-V41{&L##3iqW)k!m5F1a> z_1kyr#yRv1_R8{-<88KP=QoYy3}v|)+)dv%es>QjcW;C2*^geb|IWJg8b2bqDO`v( zIec--3-x-+pA@8ek(f3n!06_I<3gBp(-vyJq$(w=7-OzIPlHk@L6#jnp*A6p0XRM& zVBUC;1}YvZ0mjnKTUA`sc-3BCy1mgHOG^IS)*^SC)N_6|W<`Iqg+&5J(LtV)!R;2S zBgdhnylAD*y!-o_W$9)ftKH#bL{8_luE^VYEDHy&#F@WE_m&zS-8S2zcjz-leJD+n zvivtpJ2o8V97TRq&^on}<*N1{{#_=w-2A#S`|Iav^NpwECArFr?`e zNB}!^7-)wV7AY_KCw}-gpWehXH{ymqiFa;z(yOeTE|Xfr^mwO)qbUDeZc)3@HHUwt zEw`p8S$p(o(snc{niTUWhLAG%|Y$h>W*CL zB^BRc|E)Os2!F<&tP)b496B+(zt-zb7i;h6w=AOkbb~J@sJ5G;-J#dk7{{ll?(ZA7 zy;0X!_kH}Ir{>tI_tWk3wv0OW>zi_Q7uF29CC^RI@5t)Z!+Ae!FgTl{mo`!AYR(on zcomFfJS#-NWUOLpUdb;9#nX1gbHO4tRA{*BIxun2k^)oWn5dm`kgsTljle~3mk8=A zNHheZ-9I8hb&-Qkln8i(|JGp5YPRpFG*w#ciXcB+_>oqgr(9kE6{YIpf#wl|_%i@=b3Po%#J#_MPKptB`y#&HYUPcr)1Hsk)uJC66 zZ-VB=*+f$s8@+O3eo~Gd%}N@0e*;W@#i9lM&?R9v@GgcZD2O34;WY$v;J=Z?%VWyh zV!)LiKAh+nD!^#d?~e;AHbwd>mT`7=hQpvA zJg@&H%Tjm7Jk4BJI#+_)u>)Yi!{ZjJy#O!(52KD?=^t2IZ^RGo?LVMSTrju#V3Ag2 zm9EL0IA{KbR8c#$a(0ytA0tYcQ1-ON1guFqeH~s&ZlvDJLs3FX2JcA_3$!r!@o%U?PJVk?}%k z1Ym+?5E1?o5JYDX>f7I|JP0_vlm!m2S_3CIUI|EH$wp7e#G75!j#e$=)-Y@wlXgO- zb*71tJ+FiRoSr@>V%Elu%0?uB&^WMA6NX3bT&n+pm{E->I%hW5_jeAkv(@UZ#7!^Y zgGcTpTxMx}n&$2VZdn$(TF_*3UDTj%G%OM>{s8rb=4o{*N!tVnIC0)M^b0JXW;f^F zzE9@Zb^d3Z!XklP+oH;-0TQvgIx$r8%Zm-D4hG-w-1}l#P8b@Bzk$pOH~_&l1!Q)SWG5WOuVZ;Dnzok@`We$j}vSE-cy= zrFz-Kh@{y5oM-aFex=p)_4V~8L*G*a#lx@=D_TUHq2aO`Z6J}DHJF!|S89TlJLVB| zq3!Z|hP?6|Y7W(&IOH-K;<4>RWMEd+TlwT65u)(#PA6Rsd%Uxly3G9oyAEwul;+0KuACqa)5(!e0e7eXWkQ12R}_C3~6!ljZ3IGh#^ zZ-)BsJOJH5lXamf7)G5i@IW2qge^mtQVqD2rN5$roIfWgH8r73#EgO!U9NM|X*aBE z_Rw*IVqS2*<2ex;DwhB<+o!Ow;%W?OWF%0qBrQHhmuHn@=h>5%{U5a>{T1IUt1K|r z_AaZELc^*^?E694rIL_eO4|?C#%jc+LRXR)Z+c*T^|I>OY2|5V{Egl6!)$c!o0@H;Ch6bTc7c})8 zX^W{;+`o`*m$Ui9Tt>vMeFI^DG>VxfY(buJ%Y{ddRh7|_e2*a6c>nw*ym|S?>!pRs zw(Ng$`M>5%SrCY}&49M%ClNulbhsH`O?XrNa&6DDzG(55V1c&}nJ?(_@9eW@S1s*F zXBB8f6i0j)(SJ`1@2w8*gmE074E0yLFjn=Cj2zLtCwKY8>-N+V6#8D~zd!hfQvX1` z|Lbj|VI*yjLX=oNQ2T~sh!^2ZcuDkN$PZNX={A(a|t;bEb|Ii)W;|q`ErdIW-IBJZVbNY%PU- zT89De79L}N%uZegFH7IYCs61Z;fv_0oiDL9JxZ|vW<3IE{y!Q#1&Bqfl(jXW5bAy0_7P{j!Z-C z^{^6+I;i0hd=OqS-7Bs#R59p-TfRJR3eK2x!&=s^p7s%y5T{YH zFf}ERLOVY{zw!#zeW^80-sZG}-e#Dt62Cfe=Q;!u3+ z{7JEQv}d$SxsPX@`02I+W()crgh|kMVCI>IVGbW09Q+58afg?|`xo;Yl?CI2jy%k2 z5of{_sy`mk0(PUPQLKjunddkKGnL5!CuIZ(^t?>qXIkV-F^P)dN#{F#Rq>Cbv%;eK z;_PR>+A;#C@K=~5ksLFcOd4DujJsrRzS{JJJ=H!tCt-5MpHH*uzqth>CVnq#@@X@A z>@y&KI2?g!pVV*g*9_dp_A7|vPEcNMD_MF>Zhp{osT}2^sQGA9W-Y^~;%;Eoy2q>0 z$L1`%+Zoi{&fxBRcxJ0S_-mTrGIQBRTuXVlej+v`{RRA0RfmWV^mAWd9ll@ejxtgD z#J+0Yk6yc7e5mdd7tr^}W!9182I0o8p7XlaPdt>e?ip@Y7S?aa8pu3I8tw}lj=6hn zCs8gm1XeWJ(3X5~LM&?7DW61|Fz2QSn#KdR0n=kXBQ*zJbl{iWFtlW+Mp32bJXm@zU#=R-Jok>|CY2G4v zqzljaou6Lo^yGPL+oG)Eb2yRFE3+FNHB5vA3Jwz!dhN*qU*&9GcpTR4pp@s-^dLdO`Z!@TPSn5`|lB(-d8XD~|pwchuZ>vloI4 zwiaV^(U(!!q#w%QfZD-H30Y|?5>%EbdR9yfp@@81a%3 z=qml5L*+E@Q^z%tXF7HsEIpA`bXZeInqcNDz}aGJ*b65p!$6 zN_Cdj^(3n&x-YFiY*rEL#%v+s3GsT#hMQA|>g!9viGIE-o&xj_ z+;6w?iE1aC;-)Sns%VeXKb5Rae=raJoWgIl&AWoIUag%(K=^19hlK_aH;tLL`SB!! zJV^<(`A~Df0DYf-{Sw3sF=YlT)j_47LI1q_h6VOu8KUJG|L{KsfahE73C(_GR^0L% zbF3;Tp{!U=Xzt}dP-f?SpW#gp1>q}Ix!#K6KuJ8NL!QrL4y>b8hGnwPfSYUX-cH9n zCoK0VaHhrwC3oPt3qZsrF&2qzDZAqh(0AxjT{szAH-xt zGu#CY;H1?f7mAZ01{(Sw8Coy--S`+LmqET$p}$h-9QzX>I{WBVIacMG=}X`=R7UfM zZZoUjBHNR`4Alt9&%a%V`290;sFrTrVb)}m2hM2yJ*p(9VUQa=vac`3q!gWE2tx!< z!W-qp4RbDYqs|$f{=r+Q`}cTaZj)k-1ZiVW@C=g-*jRE#?@hzcxL+rbNI~CRV0QdJ zsw}X$Z{~9x7={~=>@Ax%N^O6g};5oJ>sS0(klu$(m}L)1Z%GVzp7tBE+M?r9uJ z!|o$Dn>hbKLvJjL-vNrEKFW&HA+v|~>=cJfCFbP$FM^JKo#B`W=|*AU(o9>U&fu`2 z3wUL5zZO@cG?zKcuIVSVlE9zqQl>ThQ$`l1$y3{#wQj(NbY)`3SA=(bk9`KXqSY}%r`OG{LY~tCx=OZz?Sv5~ zcYuF;FM=AiuVfwi5mYFXX8z0=pNYY=);!KOe`^4|ff*NDZmw+{SB#(CQ%`Or@gesM zDTP^g^1>a?g#;E0y!iS5N$4BPj~ss}xj{R22?4MAw+Ml*m)PVcoVc&c+E!#u8$4o8 zmxO`r1QJP_%QwD3Ok&lQry<3Y`ZAF-be9-@2E^A%FV+q}3gZp%#+CLOVUW^e-H6#y zgj&vi<&PJTj_5wi*Qs{mBBu`rXHo>_mLb?0fptcT1rbL3#6vCypz2Swxi#-+zSn9; z3L`CwJNLEsZbcFeH9Df`Zt+n0-9FSk@wP|oB^bR&+UWWp=+$arduXxLE*`4r0lM`e z`o?y}1dUmYAhk}v1|vZuMp&==LZXQtnqW81A%oNn(sNm&^&jyT4z#xJq|!WtmBD^2 zA!_Qleb*;Qs#LF$;bFNv2;g89_&iP-otw8vMeOUww@LF5iev*J!8YBDp}yID{Ohrf zTyfQJ*3r-z9Z?fb)qJ_oIzO9zo)gXksIDYm`1_yRU(XMQ*kGc{ugaglp@{m;$Vt?* zfo?)CYuJI>!y1&5=w`r*!h z>`xG>PSYaU3a2&VQYJ5c7iYUet?Cq)OjnJ?D0PiR5{2Qwkf59=kg>vtdLUF~H0PA^ zDPNMO6jV%%$IeAF+iCj#lxYwA-f;^!z^H>Hu$+STmCK7}48Bf|kKy$pA4D5hP~&^| z_><{G&OM-yxi?ennyXPs!LArN{%o-1Ny1Iel)Oy8Lblex5`+}>WbwBp(MbRltUi0B zpVyhX#TMnC>SPN(?Z?JD;E7)eEZ3R#Rj8r~eEv;cTU+=2mLEJU+C&->t9~T!MwolO z8z)161gq0t$^<>nWvxDup0%cun!Bn_4fuXoHqm>+hAk#R9`CJS9B-~=J4YTTE)j=E z?CXoAX)V?mRuruU4Ya`sq?I%MOG+lWFRO_;AwyRMk|S~|&LzWnsqyW3q4vOIvOc^x z+6hl$cyv$&ouYCwJz{qk-T0zNC>#o_^G9!8hFOA+q_v$w|EleW{mJEhhq7}*aFg4I z2SFQgW^C0ek$Ha#X9fE|6E(q&dOLytqC?6o_>qqG(^q#vrmxwnv=Xn&O$mm7u^{3X zG8hRGglDbc<;Hj)_sf@4W>u0W$0H}P-XUF3)Gxd}^iRF|#!}^nJLQLi`@M7F`Q`byW$LFrXI3nK`1e?BIcyqL1Nh?265r zEys41p0ZOaRD-MKh~mr4lftzu5;~k}GUE>;XfC=@jj%++?MLHHiq+uRSP1YRMKb?) zU8hyN+NSz>)L7FpC>*kBBb435b=%r!3`$>(Z)d%y@M9b-lQJ!mDELbbVu(Nf<~^LJ1+kQO^}@X4L^Le>QWUQgo36fe*FneAnXVyG2j zQG}parPlsoG`*l>t-9x|z7L(~92&YSZSJw?C-7Vkk?-Mk?5~ldtt~P;)8QeKL1yZj zd2{3SrnX>6a&ULGV|QXTS+DA^-*6$FsWIyLQl@OBh)Yu&5Vxx;E{eQ@0phn z%q}L^RgN+&92qH44aewX2KtpD9S_4~A}%;Av$`X00Rk7R<1fxi=ZV_6BWLg_k_ zhG-S?-779XnC2{OF{&4!EAP=xAkBF!xS<}nH#av^jCu>|zDHkLy`}1Zq;wi!i{m}2 zV0<6kGj=-|7==}iShRZ0K^-k;!PET8iadL@EV3G{O95;}npXe9-xN(+lL)F2i8wy% zhlqbd(B}P2k%`BE4}N2*dsF<^ok~~8P*s7B4Q$lw4dk>foHoaFH{Oy{oYZB{y7Syo z)om>=Z#^P2N=L_QV-S?`c4;Mvc;*@-_^Qohzi3wTys07GWZcINnVBafRf=Zl&KWZ^ z=jOttqM{-w1NVU+Hn`2KiAwvp9DSxeyu6N5glxu^d|6&n3p0Ayar=Nx>#54OfHS`S z@^2ePz|aCq$C+qP)G36w=}Z+&|0lQC1TSn_RxxpV4Go_J^`(`5RD$rs@pPi)X4-Q8>xVOt%4WuSMDh82|S_%myhCvl~;UCqu`4B^_Fog~S$0W#Z?vl3Ri zjcnv7^Taj15RK8jjqU2QLD(Ok9Run0@e9oK38eYS=CUTJ5hn7}^txy6lGrI0@$-f8 znbi*B;#_OpXonb>Br@T-DMFPUM*W}Rm7(EUx^#o$Vg33f@@AIFfHoemy4)$b&VKj2 zKBbREsvANqr1{u4HpmjLJpNtU0@fLIVqIP6W#s^LhG|Rwd-6+Mv|wf;Fod|kE;Vg@ z=H1qcoE11la%(6}G`sT&1)aeXfXA1~GS_X+P{&qvM$ln=_myWERA2wpe~*Sj)TL^w zaB}UO===t${FSoRZK44e_oBX!y;zgV?W#rlM3o=YgV(z>n ztXxg2K!24+x}xpj?jB#jljfJJ&eD%y4MEqZ!)MYcOX%Ze{6kVm8%!?X9Fgp18s9KUfxX5 zPMxFI)&}(!^2-Kyyq6@>+}Ma77MGYa>Wm8psT<-_5mbN)N(B?=zy#>$SEM3IH=$2} zM+mseU)9w6!)K24i6}Eq?hGCMBM3ZU0EiFZqwH?Di`jgT8(X~(-4+gICzLngF~Tn^ zuC6s+FdfPMKZpho4*mLpJ1kO? zNIa$|Xz0|KK`|jsvAsd*3F!H4E&gNq4lwlD@xAH>Ln$S>YRrE?#YaMYDG&gM;u z#9H@9okcR6+GZ)s-{AX-0imHWZ@eJ#cSylkt+uT{W>wU$FRGWacQ_6+MSBfRFR9co zsf@2fbV)bjm(6hLx`sP4MJqke*@t;miK+(?Wh*-=5dHZ`$?;Vrbs`Q9>PUQ8eyMoB zUr6$bCHg*>2}uO81MRjH9R!R}=A9g^7PhVE$W%V$NsAe>tKVA^wshIyq|VrD%ZRLN zY(%We09p~Q@#)V?J8JAvjs)j7dwn|t%H{Y&LoF?B9f_%a$B&_CouwqE@+MZ9Ua^g9}h5^oj+B-w)!>m}3DtUS`e0#Y@kuzS*$)@xO;|OXr zdlCFC`#8Y?R|00R8VLRk1gA2dyQ1iG3Pm4_Pfhi>BbCC`O$p%37Bow?cte_(!q48a zG_b9J;Av`zlb@)KdX&PG0z1=4k_#ckb81zO{$|C-A79m=q3>gG_a~An{d%KfX&26z z;ANSvn^WDTRA`Zw&-UT?_^eY7;U*`sYXko(i zX>%0F-|8=iw;om9vDe<&)!%8@LPQdpIW6eZ0E~{|Zh0AokrgO^>!Ltn5<|^Z|CQ8v zpu32!u5aJjGCnb?%VDVhM{1mj{h!raobJ{~l>0o<#^X`%)MT&~YFj65jm7@ixby4Z zgzLVBQEqL_v)A44tt${VeW>2+xawg&rq5q>8sih0KQAuXgF*p!h^|?UaLa_9*iuH3 z=P}>xj}9AOi}3CgHVEUMhdYK)mt2r{fVK)fh>5hBp~-z~XJc&}(#4k{S3NXz`*bFN zY8x-a;5H0(KH}mbC*#BWN?SMLDBcb>IKsUe7+jjy+L_F?KZZ=}cJvVxT zyN79>>=S@&MpteX$||9oOhGwT6%j^RWy`JLXF= z&9SD_gT9JtqGSe$Q#knd%<++<`!of5-{T|mF z-%bgIs;)(Imz-)t-9mo!Uiay(-y24_spRdoCGIJH=On+^bF%x%`BGqdbiuz9&R;&8_Vx)4KK>oZiX*nq!$9;36J4uz8wkan^-^4%ARHM-i zv-_8#Prpa!5-|NzXgPRl`rUb!>bMqk(s(gmUn#u?-_n{h6kL z6DEaQ4>GQ5(fIC#Hx~NGgZdilwv0W#@QqQbKVn$vH4?mf+(+R2YR}MI-1>>-sDA6*y}*zbi^qtZ-oLn2GRS!sECXEliG9Zllcu}8_I~hh zHw=pEHQ}nou2?v#SlH43o-P_Zr(fM-X&QPS#*MDyN*QduAT*AoM*=z;SZCrU0S7fC zko8+k&Kd`<7^ofk!_aVc(5C{@@-@t4txUblLo8E&A9-m=GktsZV&i|b_JoeDKZAN+ zKRvEz!wsqM>XHq_#NI-o>uSBGpXQ&-Gmr_^WK{Mm(vgd2!)=8Ev-tC2wCbtlb18Nb zY?+$-wo2!+&2)86@7UElgrlC;fEJ1YicqJU*kR5xl;^D7M9$Jxx6`L)?A{6Uu)Jw)_m2Y>D!mGvj#a+Q!z?`90om2rCUA; zPWb1V&ZmblMh7_TT$Xe{ep+v>9doTx^o>Qpb3y+=8gG=MEaklN5+DR7TSv$&t3Ubw zfBgVm`9IO9apL^pm5*rlsKbxNqpLKfwiAy!^D9!Ua@JoQJ$J&wdOpG#!gnfj0Rq!8 zHZh;a!nJ8T7eB>xILBgXqJR2IGE%1P3wROFTBrhn$%CX{dcjov)iiqTvtVurPl3HG zPSjV7fTy7#4`4Ye%fLeJn@nftC3B2I|9E8)C4Vo!F&a~ID9v+*^$~sw zVmG=a^e}qB!7T=g2g*lTNLpy<>V{xUkgUHKIG&`4O*~T>9k>x^-SW*zJoAUl-7s2i zX5}QGwW$u=7_x3rR3`DYX%7m^*=$i%*PVq-9J2jlRXo1(3GTAYR!-w9T%22+TbNsz zpPx(087b8@<6>0V+wV1s)qO{XTbP=m+`~!793mQhZKP~fWft4r2OLeX+P?uuia=`I zZ$s@J{^4YOMq_`+8$+% zrk#zZs}02 z9UB-q@iruF(j|T4o9A`creBCX{+uQCUi_i6hNEMAnSkukfFi2L*48HWTIZZQscFNp zFm9dp4azIh!vZ$cPuV$|y~K)qLr0?wYsu zqEfYybMA2X;34)LP%}?Ud$seWQYhmmN-w(1;mL5{I9WvW?54ZLioHZ5;Q*!5S&1?pa@yC%xi z=170SCT+O6&bj`5ii_&)=k4oyy^4-1K+}bT=a~0}oNKKQPvHAc9JbSC{iZJ&hGYT-SD2WjnYvs@GzLO#>ihv0PFI;_UHwytLY zS4D1)K%&YKw*$arib)NNJO4`1Nt-7yGo~=-C$5yabP2?p3!gf-n6--j1Eo`N{sSdZ zFbF}sRm751zQz`67m2U?Vq9Ne8+YPhI4X8lVhBLjv_lP;oTMVjjW*;c0B4HR(^@_L znzgVgPsb)qR4hj>Z|n);q}sR-h&_FvjFroq-230+P&&Q;_F|lr^5+=B3DdbmH~kB zE#QBZ=r_{^&SkjLFB)83jB^bj>;AOtAyYF6`o=|>7tIr&tPAI3qi4!Vi&w=YT2cW( zlcLW!MOb@Pyf+^4lf2sIr-%~`gw(>Tr|N48URb=hpID`KN$y<4r?<3UnDhKBCUT-9 zqh~(9H3K?6GCX?1u}Akad%HnZe_mTH;M4WAcxRGf+F|_gROBS zl4W&{{3@$%gLHU0o7+!uJ5!jFX+Dsu&|7Vu%dbb!2mTDdqBTpFlBywJYYRrx(qfUb zE`wJ-zIxL*;t&-pL?+87R4w-->e2gPc%(a0QNCBAdXoG6O;@*`uwrYuh1A<8~j;%u*P|=FCH>@lE`eEkooHg1HM2*l!EHrw+XDS>UBdhHH;? z!y|(PV(402Z$5e{*EOATG$e=;jZc#H|C&l8aNbDKCoHNAW$@!Akv|kh(y!>O^6$P! zITS~Y;6|<&_L()}O=BR@A{kd{j3hi!O6UZmafbupM1#X%tgdlbYI~hu=>uCp$vKvZ zLFV*yjQn(c!A9XE%$mKm9Ahm)2Gye1cK^+%zCnJ9^1O2I9ji<2s$)k#bnA-lx;Z}V z)!W#r2RY-oj!3#=yP;w0v-I-~Ij~|`Q~ZGxxj6~{QfW6sbBF0EszUP%1Yf#S?S0r5 z%@P^qDc4uUBOtcJ@XqV#*w6#-LM4hNO>cN1-N`vPy6y!bG7l3k!t)|UKvu5}emwFG zDewlZ{oA2%%_hWB z4HzUjheqdVHWi#REgAUy)t1O$u6EJiYnvfL?RVmp=fYUXa-G()_zz<;5^5E-ai5Sz{7C*xX0`o)S#qj!B=IiI(`H`;nUr&sc!x1PRr> z?02d*$$W<_PB)t$nikGq)2bt*2f1DG*OleV5B87WLJ9832Uwk{E@Ht;@tb5$g(hl! zO=hp1dS6PX(L;!nAe8+Zo72p<+DB8FsdRM_-ej`WjbN!)d>$89_uY3eAQsJtukiRU zVMJC@p*`=7mzRD_H~N^LobeJ_+eXzL?zem2$`cO{AY#zN@Ay80VQOxQAVj{6vsWKt zy6J`4sPZNT7HP*Y#YHU4bzFGS5;9Boy}3Zd8Re?|G{Ah@!dmBA)Ro2Qy{R0LZbN+3 zvmeG^<;m-DdNQRKr-AC!l*es4w(ucTvX&?4APh*wdVFi>!*M6h-H0jpe#^^V>TybB z`-k8^knQ=vuak3O-`Ho9A4ERv)o1LfmbWz5^tHnI2;;~tcBqDI&YVsd78Jx^Jm|OQ zpEKfnJ7|A^hA}w_H5l0%9r76P%c=77X{SV}a#JVq@u>Eed0VwIzI5N(*lI8Ca6Tjl zw$gL{um^rK0t>sDEvj^TXO&N9zxw&k?f4GPii!md@>4U&|A8LEE>WCY>}O&jPWr5+ zx!()?!hi7HU^n(rl=SrF-`g&cU7Vl#Klqza8mcCJ4j4Q+-Cxmmwrz`^nobaW|M|@n z-FMnUG%So0)!b)iXzX=ERtb*h2S14xgqrfR`mZ{xm;CtyzI9&D-5TgmdnVi|5Bvko zhzw^gx?m5qt)=DL)o;=7lX}-1)Fzf~?l%gBH(D%*Utty1ny?$BPHv35lO?BS<`ft0 z%WZAw`@b=aj)c5z6aOjXylZ><#xZfXv-ziOufvJ{@yWqMX*y7X@FJTjL;fA#D|b;K zoUj#}gmNpVpWk?~56!`NG z)@oUDl$yLL0L<2`V_< zsW-8#^Q7)KpllobQ00N9;0_!uHKMMtZ%nJ*OF_Y(u~2-lyq64$=cDp<#p<%5BUA5(-Ay z_l13UtZ|@w8HuAADLQWFKaj}8o~P%hw`g8389u{@ZE^?km9N0NH(+RZf6sa?+^vBs-yH(^|l#4aM;;?03PF&~8EbI4t#dEBzoR#Pa z>P88W4c?cb6q7#?(LmXR7~;?M?b474^&`+x{oOWnbL~QwLOvhP{dXupda#B7d7Hz!USVJG9}@$Hr35h^6GUY&ATP%m3xMYQM9-V*7Nz z=L(gk1Wg3$JJx&gg~ky3X+wzxX2Lk2GqQE3W5d~CDXn_loqL)3QL_3AMMXCuVzdL&NrnjvC^u3Ji~cSa6gzJTr`QoFNd4=+^9>uz@cq5$Fw zP@{!rs(`WGHa4Is*oY()H01o3T7W0;&?&lvqU?w9ocs4sHl!qBauUa&WGO-|4ji0# zSZ>{|xZIZw6L^U`pEtt3WMQB57H&|I3b)vwIbd$ux*Zg}ehgX<$lP;}mRGEHb z`69#!PX1K$OrE3{=5seTq_z3TkMS!@(^<;bcW4 zOwE?Bc5-yBXqW07S94wRH46RpH(+nCEv(CHbXWLeVesP8RUd7O!H@IWM^(;q!m-!w zzZ%+iUit@jVbii_J>y^`2)`Ny0-iD&=iOX}pi_lsnrx^)jIHsx21nxPm1kltQK z^6L2zPw>yQs)H;ITu0|VBVirJrZw9#0aA12JVeQ9j`V(+kju%Td|wsIsq=?r^`ec8cKos`fXqAAR2hz%~ z#;;Map z7+{|VCx()cQ*XSQ!)dDQbFfl=Zq>qCT|HRIlmXNK#+t0-m_55>j8d0bv6cc|(4Bc_ zKASDJ3QMWPr7xel&9W?-5n5J77klWpzlQSLQ<_xzuCFqh8P;d5G^7h?Hbl@F-6)3ZX)CtB5((`wbH)c zAYk9;dpylPnO@L)BD}KYoM29Kf*cXk(UPlJ- z>7BQ?2)p)_yB)r|?U_^MtwlSpYp(_f?}Yi*OVzM(JYlTrzvxxBxZh}1g}7@OP%ss4 zaRyJFUq8r{PB&%gmQRhjRGp2Vy{M&cfpyfs}SCig`R8aIUyD%wSipRpgG>!kS-6)xC&7p_~Z zZf%^2y|c$qsaCkd5-kS8evCU)O;l+`EeJ7#e{L8`gq=Ecj_zM-RlYxP1Ct+qZ1Ih- zE9*R@{A&dBZe_*^43wtD55@#c-d%Qw{Gx^%70R&HyW6FewsWH|Z+n>Y^N&zGJeHoH zQa9WFpuUI6H#N1O{E;f!S#OGshz*b{rQWCTOUbr3wJa&xx2lg-IdJW1WoHw*Z);~R z8F6O$b*MEc$(QKK*79+Qs72~shD{sSeyv=?Q1z|h6o1uQBJQv0oQ7YFI+x8N{c(J> zOD>x-42!?*&~9yPCc3$!e!mYIstQ5|Anu!D?D*!IX$^ac%D$nWHctJeFr<$l5KA$W z;d36b%}khGCf6~fWLTmGtI0P!IU{a9g<=HPr+{J2WYb+Ro*@;xXmY~!-U_XEd%L%A z_8B8(W|F>CO@G#$cFg#~s(WoGa*F5Q-~=nxF4blW_xV^(iM zQ9ozbysDfbXg0vorTq=doY@!k&zs#@+s@s}dtz40m^z{KyyEgov?Z$i2P1R)6nT;Q z=Z$K~82Z(^@_(F{PKGk=sv?-orAO@!4V~BWwxVY_$J1tAQB3uLvs|)-yo9ls1ONZ*O6SnW1Ts$+7Xuzt3(+ z$t;v_8nd!X77w!8e$4F)@*|O8{G=m_0z@kvYW_pdWuc?HuBND+2*x3J>4ld4$wL4~ zs(|m-Q?YdPz$M;U%I@#h*3S0U)_OK2%`Lx8zS&G{yn%te-nL8;uBu#TnRoc0wQ?V% zbf>8Q5Ewd{(`k&DKXa;xhV-KD0<&l1HFJa3w0`gs0m%Y#j^ZtDk6#Nc6Ah^JnT5H>2Q`r zQbJ~l`Cl$zw0vwzup>=lOmOD`k1MrNW@*nZO>JW}hw185_4Pm~yA(GVg73xp@EKC; z_@uKL7*u8hw_pqZKzPPq1a4e)ePQ}n6vfXEx!h~h0mu=^2UG;|0f7v_XV1`3&`<$F z2LWk+DEO!}+;{{M>c-EgX}O#TdEQ9|#cO=8CZc9S&`sBBLuk4NK;cG~cCs4>NDHdYzLFTnpBZRJ|D!f2l;bV#gU+acq zC#81{zJa}FX8vzJd0$zM9fKYH)`0Y_9Zv4(Sd%mUBzoPYioJRE}S>7!j)8}S&FeBuk4}0+^Ii6 zSK|mdfogBoSg_PzI375;cz&iWo{V;!{}yD<#@c7cY^x@6T;BGiH`)RQ~_C`VOe3vUXAD zADvOL(LqFp5I_h7>C&G-fP^-5fdC_fULsxk{goPO0wjbgy@R3mj8a2_^b)EdARtY8 z_Z|Pacdd6HoSdBOleKcbvcJB+4e@+8M$eCH%Yt6o(Gz*WdU>n9bUc}j9$mUU zntaA_mcvglEN{5fCxu5eR*M0_{7tNiI`GDXJDg?v|tgFX{bk}^q_q1{#49X))a zHuuIx6$0Cp+d_!6r8nn<%mzJZASF_4_C}leyH>4xjjBWS)onL|>I$wRl?$s<%nW{9 zi!r#ob4NPR1q!;UH8|TFcDsTw^dH8u;T{e=5nu*tVvl@V0nd;q?W> ztY_u0Tfs=virl*najYs?61Za!9YbhkiF4O=kzO;&X_vXm->W&%@O|>(br~!~=Z;F3 z{?LbyN0$iUBTtxo!1mm}y-b}@{dQhTvfji> zmYVvIR#CX$Wj!tQW>^| z2G`MJgcBboEAwgZj?FKuL%qhIUc}fGX@K(GKk1LB5!W)rai52+&POh~d+b@O>{$!c z>$KKhypM+8$`4#h$yT@Di&xBmIlXFrvXOq$*k@1JJA9OE$F%^o8l%i{8T?Y?gvcFwU$naYW_dpxTGeYe@l*IKi!>h-S+e4U#jG3rXTFI%(maI z^()q!FLs(Z-CDC1{whSd)V^;k;ww))EvLMhfQRVZ6)Cp9wbx8HE-e+FAJJdI0IBx$ zD>iQOb}Csr?KG$=ReBh$Lfg7UW)sdw<}cb{g{!;18l5k%oTU-Xd+v)$h}W9;QztKD z8kfpCh$)qs%L`Mv+<#iA~D+Mftk@ zUUI~2XxHb>@eX$ARu36Jc*|UwotA5z=`N)KcMt$UVpJa=jGSc=qO9e2ZH#K1tyDeG zc>>!d!=V*hfyZ?z>}p(A^S(t_1uNxl4h~v1Gxz~*c$Ut2x$T~FuQ}f>{rOU!=KqSs z%^%PT+WU3SmTfJA$`~(bsOs~hc2>-|Si2l`LZ@2J>iO599(X9LhrQX3@i`==sbBw_ z-95tY(C97so#V9h#Bb;!fJ5AmB_t#jH6ks&MB)bLB}=nA5UU0WwHmjx>uvpf#J=cs zLbkhW%8zXc<>JZY9Z`U~u7>ChGs15);}+J(wL&v;GJl%xVl80zWAGhs8;}XVKUd1J z6V*sx+IH=Hx49YKpd{iX>dRU$xubEGgfz=ci|Er;Omu`)Dl>G~NKk9EI;&}V8YYh5lzNiZeTN%xL_TvI)(p$a%{ zTQMj*T4iYoW(aAn3PHio1dIu-Y&2g@V4iT7n`vonA<}znuBA&e>(rh+nwX8KRSCDd zf}asNw@hb}YWWc1WuCQfx~ zBAi2RYim{iS09Bad5k+esi5cVTPopE>`duPhBo5QgZnx)ziP1EIvM7)(pWKXFd;DI zFX`gsNDKsTCA_MlEZu937Qh)BldXf)s0H?JB0%EzK^Y|qpKA8hI0zz|L!+W3Wavo2iedwORA1r0`xWnpX` zkJHx!REBvjLWeTeZ$7!I%!;^iK8QB?am^Umd3Dt8iaQVY;##CV z>T}K#c6zk2uE*#N&>WVgY(2wefgCf`yioZqvvjN!-7R|+_1Ca-?=Py~V&fN9Uphln z~6^N<}Ecv%u>>co0|In zZphn4)(%k@p@0D4Z8%olI-I)bZdkQQT2;&H#~nKlTyjoJE77DDmi@M@o*o@4conxl z>0Pt6cQj+UigJVmAyWAd9bXzXUU9+?6@&@R5k(ylH-qYy+L=I2jL4fK6*ws*f?Jwtbz-Ef`DP}$3>r>alvh(h79D&u+*{?4QC+@2B<$ya17FdsX zmco)+F8e}R#6)iVWdx zv2kxG2tSE+naSy$mJt&iYGv!Pc`K~MD@MZLQ-}#U6gwVewlj`W7rLPPw-nZDmcPEZ ze&FB;j{c~Ia00YfM;H5b7^4LivBEXImRIPCEzLyiqW##lx<1t!M&yA&%e^P&P%VNq z@OZZ0j{oQ|wxl8ZL{S*XDh!Hx4NG2RD*tR6jHq4}I3aDSg8HzY&|X(udyJ-p?hDVc zIO1;+!I7!M{AqL_QQ~oxrHX=V&1DyrU43cK4BX^S4ggzi_1WTQ$cgo5?4gCD!b^`W zWDsyGiF@-*xW)*M*M+b18F*4ToGzmCx&OepzWF0MDY8&plu?;c7~Z~&u>M9encfq- zJ0HQnmokCX*r0%wZP|If_CfVH>xxcMm(CsU`zIL(vAiEM7wD{yQ#v-gRPYSjH0{%o z1DIna{O-o`Ro*gGm67SXUU)O}vJOFfpJViKc(S65BI?mi8UA-$Ud}k!Fk3{e6_Mm$ z6&o;VCUPEY`=FUI_@?y{lhs7zLg1kNm5Se8qBN~7a%7dxJ!R#jN(XC*#D_O={|?q$ z(abf$CFErcFd}c9X!hAM5eTg1TAjTX*z+{sec5%kzE{Pv2ik|I6T@@rWwN-K)`yUV zbB^Nu!gbcGMo7EMSeRufo@<aiBh*vT_7z7n&JQU08%! zOKQp`tE~A@^`CT>*eY>VnmZVl- z9mBkzwu5zONbd!1m=w?vu~163W^B-URZ#PIZKu>}RYT`(;BBzkFJ8>*z^rb_Wp|Hx zU{PmiBk`mIxA3k zSxP+s9TWm`4O>0Y?O60M%#8J_NPHcUehAo~>bCQ>g*;k~S0yBQ>DM2am@`ww-sW#eU2d&hl1!P|ZD^a8|49_|#Y{{}sLcO8LVw{0DXZ%4(M z3A=94ZQ`B8w0>M`Wu9b~UAI32y&az*OxUd3-TiTGtNL;xtehoe`avQ+G`bRv1?bB9 zxSoB4FK~>oOdd*P7d*5V`#Yx!#fG&(N4U{qW7zsU*i)-Kde%~6{trH%o#|ee8%p86 zxH-nikM1CVvkjS15zm|3yvU48WZui*nx5=}@5(widfNE1V;48NH$gCCy`>{(M!n4l zL{K5CTYl;7S8%34Rvw9bK^lP#iUQ=%BI@M-l%F8lM)-S*rxH0SDL<~=$tnM%uAn2| zLiJ|OlJ=TP&s8`&Bl!%tbALgCL94nkklLD)c9G#AUeUA1&+b`gX(*aB2cly^W+W^Y z>(sGzv_g`isz8*_km{n%$2AX=_iA7SuP+?)1)}dFlP*^0RaI3Z1lQ2U$|Mw-@-2^>8^Ck!@lgT-jvpi%y*s_*X!FL-iI%X= zy~I^uDeJ>!2F{8BOF_Ywth6ZNXF{=m7jzYtby4r}Ma>-KzM-Ag1GViaJa2^Z7h?lJ z)b=5(x!`RDCYHa(sWpe}&&R8SJXv@jHL-oR!H%f{vww~ErZvaDtpOn00d;jJ zb*L)2E0@iT%Ps+xt)5F1Vl$8FdkdPvzlGoHB$a-42$?CIYauyY^w#vD$xk)}1bds} z7LsfMkk}&HQ5N7TI8(EyN32iZZpU#1bOVK|p(N|8BGb;}*JNwxx7^+@Bs-WB-TPoU zft%V<0sb{2j;n%7W!ccddwYdHl+XW$EwI1 zR7cg1(2I`3k!{qg?bWzeJnIqU+k9VNTiYPdsD147Zt(`Ru8&fc5MmZ~+rWweAFBH< ze*llMx;P@mZ3ISJdY`N&O^rTE8f7+T{DXdX1Zv4m>7K$pZk1LPYrD*ouv!)+gv>{3 za>uKPDIXTjwTBZt^EzE-L_}lVM@1HhOQ9LELb5{(W#cD=WKp(Ld^l%LS}5#)UpW1#3Ecp})HF z7R5pjmw|>zGFJWQ*qxO*%1QtKhGfB*lP+AFLpc)0{ ztp&N+`ccGHQ_P;Thg@z{?$KTRmIkKy>xusR+l~j@&a=Qo?1V(e_f5qznRE3y)0s#h zt<(ysO47|q_m!F}y&&(Y^lg-5EnnAV@JhpK$Y#7v(w6PH*RxYh>MhEyTIPIUDYV-zfq)LcHdL`w@|`O4>Ltj zGu!hTsI5p`l!F7oNP^s+R#dXYp#4SN!JcBs zEFcwlRTGxJl#)$#S|4o~y;JdB1xL=8%K0`XZ7QoRE5GHDEX7wG zPB#Odfl92cs#AO)Bk*b>q&BgE5#VZ1(o~;nG81FyWo*X*f$=-L#5V_xAVslHR3HSW za5~Sw%kZkLXs1ZaL*r0A$j!x%!j+O&`FDB%FV(66r#3^5S?A8Eqqpkv!l2dtgUvZ< z9iT62c(phDpg;LVD6ki)+e$HcP_P^CL%b$tUjM$prooZ>)Zkn@nj&Nrw6gd;8fu-l}ee5H520t z%;OIB@}t~lS!!WSW(sg`H4wo8D2{s#bDJv`9IBT(X&ZEm%CMNGj%R<0;~Vt|4Yi_O zi6`&{WV9r}@b=5m+t~R(`WRbSBivgy2b;0}HPpecBroRA9v#^p+8x^$V>$j}f_`^1 z#ziMqW&k7)AH};oDNrMJS<03*QeEJ+fkrv9HRtb<<|r)LA|Bd0IP5QfA3GErMY;cO z=kJi;2kxhHAIfLxRcw5!I8+LXZR&Uk@Ub~YTf7+idKP~enM#q+O6Grez#ZjIJl?b- z%Wrmcfkd4UV$=cu>U!~N$+zdxNLme7sNM>j+<5YaOs|kpQB$4pGcCv~Sscr2yd~3H z2eX-0*nWUmX)7EWxh1CzWb{KB9P7F#N5pZst+&mxE0?3}Nb5lBx z>C%efk`N^!H8cuy0zlh4gVa_6(ILV;wu9(!(G&G@f3K1)`6rei^VNa2Qed||kx8-b zEig|}*2ZbG@Mj|Pv@blR$pqP?(vi#sDqHUzDX|^xu1o8X&4!g_-kYjyUA)1FW-i8g zzL#jmIkw9x(UBdyhp42U0UctFuk*4p5W8-4&~62yAM^lo(Kx&JJ>r}G-e2x00nL zx1m82+pCr?e7w641Gc`48S&RDuLiNF;&wW=+A>JcrRi|0+g!o;$vt0z(^|=Z(Kq7& z37$b-X=rFz%Gxfd37l@t6$B~4Ds09_PsK;HAO{_E=9*hY30&6NTy~GCxe}dfUa;0?&dpIuTiclQ zLi0<1(=J{%(OZxWYmI~9b4{mSNC}1|uNefNrg^!dBQ!HaSsHdGigmqP<=F~3Lgg&i zYVE7Gh74lS>Q(ZoyaG8f{pDvX%(>Z7YGZ3YjvC53YqUDMI{~V6F8$R;f%5t;r zcf~14Pe1TJf9{i2ggRCLj)LF&!kxA`$TLZ$H77M#wqV^c=U$TZoaD5<9nomjnK7N< zo`zhv4XC40>DY!ZTQ>~>5RON6v+hyi{d!j;kYa1b;TF|H;|f%8B7z^dFw@f956Gxn zYTA&F@U$3nVYv8sxjaFbODyoB<7df)RdC`1oS1~dn+3iWjV=$>W!Y#XfF{uih~#m$ z{Y3`g25q*rWr*9?`%7$3pAxr_-6U_OCE)iz&fKa8t{1P1DVy-|hlF4F!fHfnzL|r|7A1#FWH&w~&h?2dQrN zW;S|`-`oy+Dj|#yNHKABpsL_^zSRQA5#I-ECG}_}O>!p$*r@KwmhmnrAmr?so`%~E z#br$;!`S2!;F%5OF=?NyvHw2mQ<4(X-Y zGk5H`_UKLy4i-$L5Y#?hnHeCp2W!dE(J+fZy&HQ+6_>yLZp=5AC} zpR7sxpbD{MinEb1)}4!o-Kin-_8XO)km6>G1u6H8%FVy~sdg?xOu|Gs@iYpNLY@${(C#N{X3&qeaNFf1?GvJa9o&WN7uMq{c!^<~7sLkBTF=xW&Go*M3+ z)EG1}r~#bSD-r`nd{M9V(v8n;B8s=hj{zdTFF3}F=ci)r_;vZGF`>5XBl@=;00~GZ z863mJ@1-8&`ZCUL`h4KNeG_rRCI;vSNXjjc-hHIqH(wGJz4dJ6KSCByt&3~$7^xX= z<*Hk1ai8t1?_LfPk$(2Qp1$R%cCU6Jot#J0tK<8~NL~QTXBD&VjT9}M7RZk`nhi>` zuK&0;HJ|E|`RLg0@;&uXa@%p1wiZEQNUGv>v+D7k0+=C;k?U5CLY~)H!Xo#cLV?z7 zM0C;|UklLcXA*yn_z zPLl<+uu!|zUK-xsa>c6!lGg|duwq&^cb=`?uNs)P6y?;SjJwJVOd+$+EGxV|&4d&Q zFn+FOn>6FrzzuehXKS>MF3U}esR)Jg@tB=~@952_hc7UL^O+Uop}8yso?KHjZ8I*C zRQhtgbGKV?!?m`G)=CT$@#pRhx_A8etvL>_{tjV|BMHD;ne;j}EXDqAtCMHI{(R_v z&i{dio$o(jaNnr|0yO`8pbt@>drd|3t@->j6#Dy5pc!7VgJ!P--kFPw<5z1f3wEwJ zp~B3xlE2o=U$NGL@DceWe(%77uM<>T7TX!62Kh?U8cfZhZLzBNa+H4UoaT;+hs{}y zYGI^nUgCL1TA=a1ZsmH|&IY=SF>Gnv7fde7&dG{wN=!RVOovvb`wyQb;(qdtfRAHI zOSCHBBIWFRVhA? zJxZ?(s>^?9a0VeyI$Gh1-;{mclHLBDNWI*LI&#lU^cMYCia8>{_`{gr@3 zb?yEUHJ5&e*_dBaTG~ z;#SAcyWL-F-hfiI*k=lOHT~7%0ohd9j_3J!>FwZU!g&S>qYbW*za(7(8@!bF&6gUQ z25wiYTNegyDZmuMcGd*VKcPF}{XnZjmx0T{i@QQ~V`XB_;KQ~Hn+;%^Hwd@qM!u{5 ztk-sG{@OOD-2d$1Dd%Z(uYFsVYw zk83(!{LoK@vh1A3Zz#K7s~S;`bFBhd8mAh??ZmRA~y|0y)a5!k&n)=Bb>5m2L`MT8&!p*>D z^Fb}F?yS58ksc!ef3$3fVx%s$4N^5LmZ!c%yh>~rA&k>+bLT{T=(HG(5Zn7EMq&3^ z*97v=8<1HAX1$-avI6 zPrsj%KTJOsYUUrzTWl>6T zvc-DHciR(V0Zv3u8|Qw!3#`5%@SoO5x4Oy!8-2^VueTdr;#j_&>+akw1fPlB29hK* zc16p35z_1%~3Y?VbS|?%U4Kj zt#IkmEyC|7TRE2{$HxS?@N?zu4a9&H3Rt2aG;`(2NN_j&e0;(rV7D~KW_Qzm z@}ciGuQ$77=@{}NyA^O73Y)TYy`^cB;*`@#Y*vFz>8J%I_vNnf7mw@C(<|~Z+wBYh zqXi7Up}5ys20z&NvXqUr9300yNNI);vIW}eI+j9st5?m+&3LTgrM8eV&sZvd&N@m% zN}xI=y@=cZw8$$J`fJW6gHce$#^nOC&iXP)NAyPe+gR5OfD4JeRSW2u7nt1 zf|qnk62Zw_?DL4P#bQ7kp-L-rtwPbV^-a-olYGL!Spo53TA4V;lGL^}Y|ldhv5F_? zSquLDq{_Kftfq1Ha4P?IfjxNR!J}9ES+(V+MxoVKSu*y^UsuSnGz4gV?4MYm+jFhR zbuLVIZ$8md}FGHjvb&Ez)Mqm=o{~;)XBO z>humlKtEYHl+7dz0#Qj#{i~WE^<<=BU<#pjT!^J4=q6v?but(Kc3tZ zL}Wiq@$&Ky0o6KgndFVs8CSHFtS(IQ+W4J5`FiC>)=ntYfjMu_cL?ZTqB7D z!>ac`7XZ-zq5scufXjhHu*-j}y;g#rO^bCyRlr{fE8j5tyJ8{|q_6higd@@{Fx5t) z*f2QlR5D+sz$V-#JaLhIk?%z7iZPUlMNlu@x^V9QoenoMFmvL!&Cp<_@esWXRvn$f zk8-@;bkqzt683CAXb|Wuic;FNGQkzHB6#LR&0Bf4Fp1-LfqP=e$t7eP1I62iKwxVk8@>ba`#X|7R+6wVud%i|$ayWn6&dHPVs|J1%^}oKL9rdTR z&o^YxAStAfVvD+b|J$To_@05~sO!X$ic9z6E9$fHERmFueqv2+uNX(U^6{T9bpp%D7kxgRc|m*F|3 z^()y(`|?f#nU(=m@McA^AUwL>Me(PNRX`X?H<)fQLTQo7vc@sz@E4`DQd*7#sy{-n z&_k!{M1s8Nzzg77r%U-a-n1xM)oE&uMER=jzQBq2p5sAGaPdLTh}g&f{SP@W0BSFP z+L!;&!Pl3_>jj*EEK=XkilhI1B=FR346H2Ll}DGWbj!Nq;|eS?Dki*a!?~7?=HVON zLN?gIvCr++REj20I+a1v(kp!S$}F=TBxjhac?F*B$o#Ew`qZw4+!DamByWtbM|E_$ zd~r2fyg%1@88&p}K~t}2k_=V2jF)e9MWemDMJ->XBI@<}NeX&2V* zs26@sG|WQU!*&ddA4=`?_|=4&!!I#DPwPs028`ZB&45@1E%GNicqyVhHJ!^H3EKNY zns+0OJ{gux99zoiY2zzW7ERkS+Rd9qniMDL=1i-~Z+*~R^9uk^XF?~|L^YFNzM zb6YB8w&7h_lm^5)8uN-{}qwq$iaFgcjw<#_N9tNz0CH!S$g;xC#jyxg{bBJU_R zu@vU1|8EZdhn4@EjsNrZGX(VWK;GzEgIdi4UJX0nyJm)@2rBydO>5OoKjga{jJa58 zfTdk>v97B?gxU=~na|q)K{(BMl@uuZ7M|3ZxyI&{eRpEd{kW_d7YS$ZdyKQEfp9!8c^4R|p`D!8^>ml?A$GO%#A4X50txf zObH!UU-JtwhgF{P-?aIzyInnY^x|Q%Yk+xSSo#2YfMlFyydRIK+dZDx&1>9HDQ~ft zPVlPBEH-6@2m;-T%?zxdn?Y`daam(!CRry>MqNaITqDLZn@oI>$CXuHhP6grJ~6;( ztGC7dxQ2)R%RHtcmW#^Uz5I!%I&&XNw^<`5zk!`zL^rod*x90sfP#d+$Wjj#%CuBt1;(+j5#Mh z?y?^~RWxpdRNCs_wPbZ|Mk5%q{S)Wc@I1d-h=)EKEshMY584~Qq;m|2&Vc6#{P(Yi zJ!gfObhUqNewgw8Oaxd(zt2AuoRGo3N0*VRkl7chVP^y>w@LOfkt7-kJfNjwp&sIgqvQS$wtL*tB7mu{w_cdR07W{$4w0v(h)0D^p)j z7@PgrnK5wIPCPz~3+rcs^~mMs)==%7YEfvv=UVZ@K5_W&WtpxBk0s^@cFYP z{CX2svAg{K8`Qow?76*I)L4Yhr7BaMtkg@TmF@_z;^8iLohHO&=5u4h&j z7-G%&97iL%|qzQjEYBSTj$Gi1@ET@@aBIjt-Jk;Sz z<*uRojzOVN(~oObX0_8taeTogqh4WiiiG8~vZdLIbX{_RB4pn!LYUP>G3Ae$Gmt@+ zqmb-oijYm_R=e!6ZOZp&F)G)K4bD{4=Pr)T4YL##{Y@`~oQ%h2|t?uoQY_#|h zt?YHdw5hi8P3KMh=$wGc#w+tjGQU;A6)Z$?-FA=(kE;>)%V%zLZ?Ua#VA9p3)T^^p zH1Q&Q76<0eKpuGp0iT>h9*lieGGP)u!_&G zOiVd3O0ce>9w>DP*EJcJKZM{{R9MK0(LF|Z|76`u)`SA*MbBr=>w-Xw1H7E(c4|NQ zitBd0r7uLz*u9l5>qAhLT7$vs*+tjG+*P6K};_^3B}>v!4wl9elq05Mv|5fV!^1i;TJLr?4bu9lGW3EPurH6su zPDQO-@UZ-Aiv$@%+@Dd${}J6G8EU`7rM?+QaLk0876^^T@uk?Y;MO9n>*eKCoDEs( zPD4&FAHr`NuNQBB3>^l_-C@Thj>&Qh^9rTAVO7O3)s|qiVLHAx#rbTeTkO+UqaZfI zV#L+zijcC*MOVSXB0}k~KJgU6wp&Spf{n&vnV-eaF?l;i8!(Y@d&y8KDJl3J9aURq zkuC_sDFWW1xn)(eF7(=|ci)~K07UAaE7&s)!Mz~O*77eZN~SF+GvdP^TU}j21@FgQ z#-XqGu<5ar20_!la~*EKQFmaPLe)a%(l}~4Q=?YLd$&m zG_U<^HWPx_m%C*}6sD$fyZE5UgwW*gnLe(e^ObA!H6Y(nhzRGDd)DYaXvkGx(? z_~t!rm?DPSLl-j%C#TzVWfmU?gsRU=_=0PU$6g)|#F$%(V#M8db>j`<4=1-Z7_;Ec zZSNvlDw?=8X^zi<;0`tWDAMAN7ZN75odNoqazj__R!f}-U@yX6fx=&qJeJr4Zf)AB zar8*&qD&3kWo%2A+~pLI3mBRo$7vkki*2gfU&&7Spd z>|4p#*g`>`yV8PT8v&siOe0+ZoG3a!d&~Cbru?%&pF>ZK?tZZOFqR?`*Fbr>;_gM= zcruE{2^(MH*>+npM$Q~8MazLo-PG<^Ob?>>cmX#fz|9F*;KO?psQi48G&D5P*Mu?Q z;+9HghBKmG_lw4AhKLiuSO&|x%A#cgXkN$-0;H_$H%N)O;W${x|9s~ccUhuy+a z%ky3V4*WPRRc5`@+_6-Sid;^#N>QwX6>V|>ZMca{03t#Uoju)Op?M- zm_^pJO`6S~+CxsyU3)D&kWUgPKxN=K(OeI3CY(1K*`=;y3a&#{6Mf=3pd62>U8czm zn_Pm{^$1+3aI#mJ73OKO!xpKpoK^rjvt{6|^Z%ek^#8X&Tc zZBq{$`fCeYZ}^?e4|tKL8Ou2urP&3mVSIwG6*^#?$XnUh+#8v32R8Q0c6MCt6mNg!|w;HR6mLN&V1s_(Qv|dw7pR6Y|RqP zFlp*wl~d=3OSa~4KpV&To9_IYk}fQmtUu0d@!^uY&(rVFlzCJ|r@Ovm*-@6?5Z;i{ zqHCqt%v1ZJd~ScO`EaV_2q-DdHLbTwo zQ91eBM(8=~d<#A8@r6T(*axvTn=_onM;mSFs}+^5Xjer*)sTR(G zC@{_v;-N_gx+oI(xHwB%SGUr+le)RB!dJ=~`b=ER>Ih8Y7PCR?A5D=4n}`0~x3?}T z{;j7seJl3Vd$~tBLaH|XDQP0_sdG^GJ-4Ddwa=Ix49tIDqISY9W4s1pN*K%KcG28^ z$ycfVSMGkO!#(+Dm;I2rFqCoV1{Q;lxum%@71;6br^P64Na(K4Jj}biKTn->BMM3T z8HV%P|BZPgq=pfKxnQ(cVbc4z*81zYQ|U2f2lkpJgkPZl0^Dz)pikXmD7+fWvZr2J zfk`O`A3XXTTOBdiIrKrpd<=g;Zs1=&lCO6jv5{2kG$_`mFXKKNr5M$k{c&nDdWqRR zc2wy&-muLt3vV|{JkJNO=((0zQm-=70$PQ!WP!~qnk9OyFgP#yDwC{Qge`@5`C%;- zdBrroTz#?Vaa|7^Dq3i(rfQyUB9DL~pQ-*-RHnTvM~QJ_%#@4pIjgjvQSw+z3(BEl z7%|O~?J8i58BfjI*2aMP)We&wt2TW$oNr=3y$~~EIu%p5wXf*k zoA5eM4t{ZDlu(N~OM4PD{^eK!nsY+Q%Hi?bEJoiIJQDXheu*YcOD++{dZ`vAXM zLW=q{=9$Dl14^pNKPjTml)^AAW>BKOdjX2$7yNLaXXd1|)S6|XHgVJ{8>~Ik+&$yF z>=z-DnKCI53oaX?W}4Hb-LlMn???1JtkKJQ0r&Bz>#i0#Ps*mvNurNkM&T)6)@ldgWHFF$6YG*cfT)^ma`hlOY zsNk`gaCNGRrtNeo=sxB_>qdbaZHMjIbHQ3a(HNPu;-Ws~>m07kiS~#*Abl0( ztUa5LP%-^P&p8=RJnGt#&pr~!Kbxu+SusUl&{_vo44{WZVvg4(jr!*q50C-qL9~t5 z_w_RbD&E#!5we_vvG0L0tqu4dUpM;~We}+#!YoG8#&Xx5P3Qow{VChYllx z&z7GMWk>qA)28yvFAio=&GNA$mfyBij>VJ4KibS@@+?Rp=7l8>)@zgYRp;$;uj_U#JYud zoyRUJc;)@LHqaD?0+EeB4Ofr@;<~hfe2?dkYwPcecjm+9XUT@*BSL|oFFSmE(EaTx z{~6*rVNKS6E=!CnxnMzEMY&A49{V*b@^c7%g@Wx^u}ol~K%bDFgtIln1jJJUvsvtS z370uHI9-mvu5({sJ~B%Y+MYHW7t9rQkuUyx>ptC4)u;_sADA%h`}AN@P!8Vj=`wt3 zHnxDPaS<{PG5zH8hylUVmTHWl$$0ZSET0kBv37S@VN}`k$2)o#=lA8lz@@d5w@j zj&}5;UzB5U<1@*FhoGDYFwo+)=_*qAp)uhU=KxYZ;1knCk3|h|YOWdJlU2XgGX~$& zNng@+@c}_YP6ixQPr1tNNY85gWs@Ro!GETuoiORR+R`0Kx1z0srefXv==cG@g}%Yo zjG1)Em;BZ{1c_9ELg}{C+Pk`9|2k)}D=^@A#bom_!>ZI5s3|t-hL6vyG4=RXWzWu~mofRGCOkFYbPim3n(B|l&134P z{m1-=s-sHD@RI(C_T)>%R7tUdAbZ);mYoEiy`~HT{4S9TE$u6A|B#0-r_K|e(Je`oJ9p$>A{?syyH^SOwkk6@Qja0mc0R# z+3cbh*Yz^=eb~02Xpo@EhdmrAyrNpKj(_b4wh^s--J-9Q$4{3d&9j+*N4@Bxo;PIZ4WOnchq__r)Bq*_)Prv& zWrbw6MvDgbtD@fu+}1mh$LQaW23Q1=Bg{2`1^`we!zSY?pvKGqj`_j3ckddJDVeCs zbQRYR{g}dLvb2!-3gJdg1i}=4u6~8*b$R+$-%qBmzdP71Jsj;0f4R}rZeV!td$M)h zR?D9Y#d7_SY^SZ;dgCv>Zy5IH&4uUJ_Qpltqi|G%1;6XMDrqbBl} zVAx>4TsJ$OR8NU+{6rK`9?G8HM3BdPY1*1K4tjML4lapyNj5;^>?u@34|+NmG3__0bMZ8H#Rg(sVFLV*rKOs%&RCarA8iD|YHwqbtD3O<;8t?68O z>qL7nJJ{^tVzICg_E}A$4ycv{VthGH`cAao{Ax zaw~(!isXC7)&)yONI3Lfxt&(FYE(i!Ez@sHB1U6=3&v8LC?p4yPnFxuW1R*lse4QX z(Z$ZEuNgB|=2DkNt(Kdc$(|}31U+r^q{PyDex=OSR_bY8e2j|gO*54`f;I0*wd(rJ zmtb`G3axQheUm6nTt(uCF1>YGJZ}b>b?*W7^A>zuKZjZa;W>S@l`9q>>8x`jP`3ZrLw(b`YIS81$=UWh+I#4L&nOqiz^ULl=m{Gyk~l^XVN5e zSFHkwh2g7Cra{7KEbU$Yf{B*qh^MH77#4P%K~l>>vcjoip5R{50i*^fFVy9dWtIipYXg%5}oqC4JWh>n=bvjRdgyV_b z_E!H4F2AjB3=L0|AvnR&OrTMZ2g?Yr38qyk^Wr5g;65;vt%D5}?P@=ZK{FM{*lC-z z7tl^+zFGWftz~rY&RG2v`k1dnPkW_L)osfQC)j(U{1M?~Mx=F}=C-@otJ!w*>7In~ zeVvnNVQ}KOMy;$V_uzEgc8%xiRI&KW_~ z27gD$(FQiIEYuY;rJ4L4p13^M`W=qPTyqdOM%rR)U-d|pkMCfoBPnrcguY#nh|r-Lip%3A@ZQ$id!=$ zD{U|uTAU@str0VKtd)*CR0jic+K^GvwJ;K0&zZN9VYj$!VHj5OTqbdMBrM&5{ z47{hFq3_QX@1K~3T1X%=2d=o7N9N1Oy58zM$I|ARTCst^wmt?c$k}Baa*Bfhz_^%;6a!l9j8$C(?(KQd5OA;5RG<0M|2B$ zRO;TZV91^deENiwcB&PMFUS)=TsCD=kbebrLHjR z8EDd;u9c42DoQ78b_(sfAtZBeUeM+b14gz%llosF)P4 z<0fzP>9p~+LEr?YWOlVGUphZRZy(xwOUyrxECvLxrtYmR=ZsNA#D)miQK))?soIOt z(S1vF7k&-ANx#F<+i6+T&ylv6Jb7EC9D2S7`r0vOM*Rceb!CM_bhQ;|!l^8k^$a1N zz)IRAW}yB32Y9>Co{<42CzM%=m{{$-iYau|GA*!93zh!mxaaWBTnKh6H+Tq8C#a@L zrY56y8m;8d@?S-~#-~J{j@ECEpDuj+ERCPYe`nX2v`{+A*K-LQd!Pg(Kw~ zSHJO(*wEkZr~O_#e&S6`L#sn&`s?*Rj??R0ccf7=$-AR%emEuVB$@fDNUzMMS^GCO5Yi5AAgoCzIahx5)JJb!2_*E|+aOwXp=Hf#e9 z%-c>^J8(|w&ni+NV3UVzCPO2VY-%CSm#eF;AG8Md0hS%TCygtq2CjYcjyC&k1&3;7 zwTQA}QLGIR{STAUhynAdr#n~dMuChQ;TIOMPc=VX})e7d4kT2phgqa z_*&y!YQ&|-G_cd-7>;YwW=%1Y@wmeNh&H1$vlu@|^ZRL{aZNcxIbQZ**M5r?QFa#u zGDu~jG;pg@Oo=PIqg1A+p1S$;kEeR@ajc{LtKwbS%QL$@RlR2tP@MN2?snkPjJ6nj ztesyAHuO$oR*zG)MeHlDEB(x(Y43~nK?9U`w0Bp_yHYmEre#=F(J^3-&(pgq@ARK! z+y9D=08Ep zC8hS5veG|s3VZz-J2BJnoNOq|*yv!9_GiHEg_q9Etr>7> zq~{y!Cc%onxYf&Q=4qVhnlflElSI2%_tDLttN@fJookVOSvpusY7vWy^H?<$@EM2w zr;k`TmF|Q4?|W-oouwwFG8uz}5kZA}uglt>UW9NpNk9^(Zv>f9H;p>Jn{hScJyS{^ z>sbbI^bEC!?F4V4o(BpQJt+O!3Q7Z1itA}yJsGr25a+c|ic8XG3W_`%AX-!q}5mR%-seX8xCk=1~a zRbQ3{av**v!%nJrO%_0b}RL)IJ>PKGJaf3lG9rmk$nT4$!1hG z#+H%k{|GU`7?%DFK^X~;nCPZ0wxU93S+DP*uFqLoD!~iYEIe{uAR1LDR`btBfw?>u4aKh3!!P{*yy||jRAzbRpegmA@*k2*mz4kVt0FX+g7vrVqlj|t$5*4z$L z*ry3QXiPFxvW$nMq+Jwwu$Bf|?_NATNkxxcr?@Jz!u@$TGe9%S$uX_G2#nz)|rI}Zon{ecH zNt;Z{ybVGgJF)=s{TXS37g-bsn`46JHtC8RZk@N)ZV$$1YT| zegf|f-#Zvay2=PL=YTtCHDc3RI5Q36`kJt1N`;e>jj6DHOKX0aKFcDMo%6cq&tF)w zBs@)u@Q)R{PnND2Qe>v86{ZK}I(DrR&4QJd_AT=sXa|FLfgBPg9^q| zMWsmAcnqgenoY6ERNHOkUZdf(qSG|nBZCQCXO_*D@(EEYhSA&xRJrwEuVwVQl8i~l zYD%I(3#F`ZeaTYB8mk4F50uDLx$c%WH%zk24)%xG|9csFGgYI=EKJD5rFF58qm*44 zMh<1k@~(K);x3rejsgZJ1HL?+>sDT=sGc2&Mn+SGa@90{uDS1^9p1MU83*k~gLau6 zQpuzpb0|d#k;<|e7nD~zzd^Uqdv6k)3r}A_A|rLBEixiQ+Y?($s3A|rhEmPSW=5}V zB#bqr*;1cav^l4P2@0Duf?x8%HN9ZYCzbQE(#jbFckAeQcF-#dFHz;&lEX+Wn$|wXabCt6l&lyowzkIjHGl zSWS{mJsA2E!x#NK?ST1{SECPd*H|r~j)+3-7xG;^V=DH9z7-q$pk;U!#wUFp{AT@_ z6g$RZQti$Kn`&`i$ApP5LPT57abheWF zLqm7MmM|(x=jv$ku1HK`dPOlC9Q|nUt|B@kF7@!9jToSr)i0~~krn1;8S z*C}j6#YTH>2=FR3CIA{53Kj+mk^uip|KY9zU@@>LusI~)aMW=B2dD}S1qBU=3!hhr zNsPaj#*pp6Tq30rPa!LaitV4}Va1FbR;x6qt%riY^6me0vyH=m!+{;Dt%Glyqc)#$ zV$+v3tr5BWTN2K4e(DDk7W!n!UC@b^*5I0FQ2!jkIPRWyyI=rQ`^^uI932F+3t>By zk^_%+mtcXgcy=RQB90pElPV@NM`4LM9$Bt1fu-f3%|F0l^9pVdR!I-=2$4yWI9HT< zo}dee8(qDuZCtemuBeP^zJdXoGpN<7ZJm!>b7u+VO0}r#Ae6ddMt+7+QJOe9YiSn- z2=~u{6J6R;#|>ZNWsw@wUB63WM9N}E8q?Y{GecN@nC&+F|4Lu6HQqZ4I$N&DXb2SD z6m{9P-|XVBD!tgh%+92xb!+Qr2N+CA&-*dOpG5yNgghpJDML|;pZTnVQAzaIp^+oFKNFI4JU$k57>38nkh)^!`= z6zxog5sHFVWO)XZ-ueMSoA;gL6R@~bj5<0B2zK79l5#qmS!3ga4065qbeA~5|7F9- ztuNi&yfQ@anBrq&W|rN|p@l7pqHyq}35zPazLpHxe02+={0Kb4K>XFYc6s?&N5+XC zGcsIXz~$^3g3l98xm~E3UrxgU4_&)|NC?1{k?1=i;P+fqDmTs;zj6{2CrB8^`spM1 zERwHE&)gl3R*cVMkEMWXp}aT|4h0Moa3K)N-6vnP>{ZpycKL-yCQhCZ4!R{o$yf2O zyL|WZLm|j|-gczgO%tU->B3jt<`m)>HB!0lrI?`pOsgO)tiXRf8ASF?l|GTvzBkqM zJnMOV91Rq2x*QghEC0yMBFz}pN~hDJg{{ivvK^+NsQSm~-JNvoaJF#hadxe1})@1n8{5&==&`-3o9>vCIazw zcM4m98&^wjz7U=xV_`4c7@8+cx1?}U2O#wAd>oAgu!~}Pv|abOU}3GO0L>fc(8eaQ zho3P;^6L_$F-fRTgHVhRWgaJcxt8UA*05p*`wsvxv&x!Fr174<%~MnX!)NV(a~0uo zPvroZWv*Rb?@R+#8NL=YiUG^boA$oGM5u?rOI$~$;`>-G*r64PY7tc&ROkA9=NcW{fkF(=;?ihNk;sDv?n+jG?a zCd`+!|64)e0?+VsYUBw9vH@swFlhlWqEO=J2&|OVmIAFGAXtm`Gz(L7SOLBstDd2< z7%KKBMM5Y9sGF^W11cZAu%Ws7anX^BqK%pQsqE65;XIHzqsHb@~H z%@l|k)?Fc#0MGy{Fz|z8&`~*W$OjV{%n(lME&>EH-VFbrpab)H=<`mQr2U(pbmZ3% zO0;`zE$W-heinQD(80MIs>nJ@V8UnS#uWe!i`dJGsVbogueJmeiy2))a1}i?O~1+@ zl!T*~mp2E1&!H64!b%b^M?)-UqI;Qgm^Ievid9ePz}6>9WXqY+Z>@TP3vLKG5}%-q zPBG~7ALR!EbSl>zQ)jjhZ<$z1U`^~GvKR6_X*K)++cku*9VU=#8wQ?4;0M>&X`0cI zGtvwMAiG=8i!=KI7X_zFjo#$NC&su#w`B4L(&a{6KavBlTWQF7#EzSqK`SXPZ!E^q z%-`9$Rm}qP{U@l`*A&3mBGTHO$o|LZiampwfTLxF;x!%$YkMFBX<}0m6DRHicXPKA zR{N&7#hT*Rt2wEx4r=%paXM?*04-`F*AgPiVj{_M%$^Z6P#54+9Zz?)eU~8t7^S9* z?1vA?aOc+#C3w0ar}{JZOxfV{A4_EI!8D!@#iab^!k1GTYG{CY_z)??U<*% zh8M%Fb)`{#rv$#Bcs`*;p+bRN(F=V)ZATyLZ-&pSu)0H)qUS9)nmYd-VC-o&YvxBkR z(zd)8^a@!pYC+KPP!>!{yC4$TkKK1+^+Fy9Qg7_%>dqh;6w4U-9=fMSQ`1#-pKJ|5 zAP@>q$zL?WM#gUO-225q{D;kQ0)8u@L1>cB+z(!V_=kd_udZG7S~o>CNN}(Wa)kMs zu<53S$`Q-DU@_fRY?DoNu5eBBQmN3|cl*IlgmnL5Gi-1|+C|K zHjiD*srQAYU^fb`&aR}fKKbvbqD4fJ$=>z}^2Mq@U3k~x>0R;*g6N6Gx9fpE~^DCAF zm744KBy34Mjssa_09i@D-is5V4pU->B3b`+~CJb$42xts26dkPs=Q^6{Eoq z)SF02Nr{?}Jv%!woS`EkKQA!rSZe=k*y#HMfld0nV}!^6S16HK5K z&F~9*hVD5f+s)^lk!Foo4+m9*hWBh~yt2`pYb8$wA6AsaKiY%lD`qCtF@5)#xRs>X zw2l1rqDmFR!{TW}ccm3Q#dBC2&gITovEG!(ha>{ksmU+7aI1f2Rht!hVGFz#_4w3A zf=_|$J36v=Q3JcxF|Ux|rFO@&LNS`0l%DDp^V2S~&SsaT5_hRNDrfZ_1_hqcj%Jtg zH6xEpQn??IaT%LQD@rO=0`^@=14gwu(m9J%s*jw1X`)yaMl{%8Bb6;)oHst&kV-c_ zX_0sq%|{9zuJ=Di?lmq`zt#K=bcf*TQGglKzp%O&bv8@du|}Q9=e$okcfZ0bU@2R% zQI-EGJO8#9Hu!N&7pM^UvV4#WAp}NazKD0Qn~5}UHsI>R+=$w?Xd~A@S3Y(n%ll-m zjF+Lr75jcLmN#-Hg8Spio*`FvmBy8}l791EZ;* zbDzzDpH-U}(cHmZ-Y*73BhQK$1J9X&zu+~K zb;Dx2^SNcl+?%t;He*cR?AW4>y;qd7)wiU$5hSmG4A0rh`RXa=FcW2-&gg~rR3h83 zoWz@%&etg4=6x`heC%7cn&aoD;kGR;r^||7QEqBhO7Dc zB>A{-N7>0H6jS6lE|c!oW7m6`bM`-W2j{RCo;797KDSKW5Dt@j`j%wyf)8%dqsXxs zzh+rU=R*J|xcf7B>+CJr6us5`+r)_qDu+|M_N}%yTF5ImpB@be-TdXN$Z5gpjK`KX zla_4R_m6EI|7Fb(GLhoHbU&IwKG7K9RB*HW-6X;Yf*{iuk>ke+Ud}{yHW)s)7~`73>20>7?mHl2q;X z6TKs&dC68!I;dEUWkz~g-ogXBhCkgXL6lBDcu#Z*3wsP~5a)K?_6Hg|y?c00|^8OQ^g^er6`P zHYd!ImCGfK$>NG0e(|DdY?EnPr0I(GcSiaLKm-+3o;cKDnFOXcbH=3(hqutSKa%Z{ zdJ!);n4cQfJJ@aEo~DmhD4gD!fIhCCWb-fIyUm6v(a)T#`3e)uV3$lY1tf z#pw6ghj9^W?;d$*Z(G-7Xv4D7e~TJwlQ(2{LmaFSD=GslpDx~_6w}8)I^vo$Jdaf) z&%k2=cuE^(^cQ*%^TEoSZma0liq+O=DWf+;MH-{tGsga)S&L^9ys82E2Z(mQTJiMfefbmQOp8?xZC zvathIArTgA)Xty(0iX@#7?~CL9|NL4vV1)M0U!=UjnnBjA140*dc|ZUcu8%Kk2A@< zSpxKf38;fxMb0^(a!Sso=ILS+hOI1aH$#wWea;jN+ZD27^${3_;CBE&+-vZX_ zLiWx3{Bj}d$fY6;cfZ2Ny3F+p&BysYuMGVjRlAG9xQ=kiU!}YCHzZl*0E{(fXZLeY z;b$3e!xZ%*6F!7CGxSnp>CcN8^Ex+}J@TyCEcrD*A3ObL%Ln|PG5%2}b9nmY`+VVB zG1Y;0S65aWn2Fsh$(e2RUZDP2v1g*ad<5jf?0g(?lG@_f+Y?4hivNyp9C$u++&$lG z)m>*LD+|G-)EPe77;m%OUTi6`ztu9yjgF4KURh_e>~+5e8u#hVzUP-VtLt@+Fpcb* zXwI>8y_LqAlQ97CO{kJ?j9J{R*R!)NECp>FMYX98*1*qLcqmEy#ds@CB7>BsFVF8B zrHf9r55N{yPwH>guc)0$bi98yyQ6x>a&-#_{m}KPgqkAuck0(9ZDI?UkJ-v}doVXt z+pa}N7Tx7lJ1Bh;12TsbhgWGj<`;{70ufN{rmq);_2kyI6pla~=97BfkZL?y#gAsKnL-FA6fd>$zqR@V1YyC!EIXpwNW+Jn) zUC9nqs5|kbM_N>xUtiob9&Axa@=FTH?n6fSt=AHQiGNWgio+j#YI#4C4~fcY6cvXJ z;3@gN`XO6ab*4E_)G1zU^7N`GR+Ug@^0Qk`kk^sQP;g0^@Jo!eiB+SXSj@qMdT<@IvbY6}rflV}2J4G5<;a^n0M#gWX#hg|wNfVDf zvTi0THOeQSkJZz7NRyRKdb8yWv0cVvy^n@RfemO}$%+H^1N0tfe;&j*nM6L3_^**G zuBRa*gv^r> z_i7dz8--_PV+_-W;OpOxd0Naux_U~#8vAW?OX`@?bR=ZOzoPIo)a9LRlbb7aC+Mz{3LtVE&3|$nG(>{?U;0nY^#8R?aM%2!6xC<>mDf!;%Kn1~L#9SWh|lr~#hNlz9B+E?CaE#%WMc|KO&|V*Z-ASZNg0 z(ydjK2{S{|_eW!h%hf>tFBpB-8OEpx%nRQYy=@G!!6AheR^2_YNZeRz3z!Vz7Y27H(AU+ z(GX}3e@`~chyU_G(mw#C2qgDuC+9QbL$bDqDX6NKGFDa-8Xg73Wc5$4nRCnL=EH?2 zB->JKyUruYP^Q!KfBY z+y}X0f@fu^bBrOsAV(B&XE$nlX}{%W z%Jjf~q0LvDeTA7uLd9z|ESLCTPK;Pq-No;>QgSVY`&}N8eywo8CVb^nH-J3I<<(tu z;73gktaZ$kWeho;n5@NW*d8_86`=n2L|#J506H_$1f;cYAMn7(0rg8t7ISz^|5Gd4P&pjnJUrPR;@W! zj1%x~ZXUdo+}ufYpJ$VxSF>0N%Q;+-rZA4zk5`1`^vmyuJGwYsUT&|(1Dm9%^hAr~ zfiZ$iqlI<<_4PwUtam6_A@Q8FsogWaFS$DA&7rq%|L{;uKACP(*UQT`yQZ24`;5zw zGl)pJ{V{O;YQ$sOkqgp2_;f!>jOt`~7>XGxw#R z1y?mYzL)O=F;+h$@O0|L=7E?Q1`n3^;bI*!KbwOci5G$s9mq@7EWJ&Tl3w5y*jA!X06 z@&dlq>(-Ymj(=ds<=eI|CR#*J+|=BRU1f|WP;@5F5R+^M#em&+^r9!~$x`f;YY_Rp zT;=L3_e>KT?jyU6n`6oiK1OB)ycaFtS@W>6>?#4+4xsw#=9)babF;F1q(d{Ql`drB zZlX|J+2&23RIdb{kG>#<6~)vlV8*%cEja4$(eLstCl*janHMAKTc&u5R?reQh8}GG zi6$zhHx(d&I68OjXB|yT)z+62n7OW^*b{L%4E)6Jn<7k|Lg|PpuCLFTN25riO`$XF zVIM*#ieEuMil%Y?1&LuE&4sn!YMyP{fzemSx&Bx~6om$tYG~b}A#wdN|$2Th<|aLP&NDi84--a)n%fvoOd} zl^uaHK?SvS$D8mIg#0(iHGCgLGt~%=Ok#mizR$-`P$8h=JRj(+ADfbmO#U2VN74N$ zNm91=87*hf?ZaM^kA%dDc4XlFD40*z%BWJ5a|lJK!@iO)ekML2m0-uX6K2exWL|!L z$&6D3>p0IUsGnkSR+;>|HFZt%G;qpR7!OX0Ak_S8>j(_{J$awdh5Z;*Faz&>VN6uf z+Opn`hhy$7p&`j{PFF2zW%Iq#8@XYrLipsfz}z#Xa{Bmq(Xz%!PHr91uiXCtu7{uV z33Cc4#UdAmNk|F_vZIdOCyY<3VgFvFjr5i@_aKAVM7WD>Ed2f^F4>!N&<+0m*Q( z*n!!GyS8|q+;$*d2?GNoyI*f+?Pt{(3I=TBQDWkt>L`sK$rr@d5zn-hg2KTnxP`HV zMC5YCbH^AplD_xF5!Zy^{XJ7I!X_inct!E9=&Cxve)JDSih7l9p?m16#;7-f#zE|6 zd#Z8DsmM9LKhI~ERUP+d%eC6N#?3BmPRrUxzV{S+>SM~cj6M8IlL3L&1|S=7-iM2>=!PzQF&Hi?l(CkThStk_s)k)qY~Tc@tJcU zixmhZj1m%o0Ko|2*?hUGi9{YTK_dVup-$j$e5XU43F-dw)5xK>c~f*{kgjpJZ?pB6 zw+V!bp<@hRpydH%*MJ-wD~AIl%kr`{E>Sspk~xWCTj?X$YUI^l)xO&x3+e|>4_Xb7 zNHX;&Np-SJkpz_IX~LUaiW5CKfA8ZDi2U&CHw;U&7?eL)=Bk$q$jaOvctzjX^ADDB z;Yc_XpP(QVgjP16{yF*{1P&4&$;dZR{IdAAEXTWW`irUF;> zQm1eZghY=I3_8QGr7whjquwWPeAd=B7jUI-I0)w0?uVWu^k1HE<^KBIMK=vYH`20Y zVev{XbzN0e94-a+LOam;1e!Ta5eEeX^7bqDsG5X?a7T_|WZV6LG9sD`jV>7zezEoa+ykX{{X3d0?a# zKI)r<<@2Uu1p*2c#8dq5*Es27I2?5rIc{Zisi6d*ri)oEACLxHb$Y7Nw zPS38I-oXmM!-cj9ewv{gtY@+-M?chbi`N@(C=Y7I+7O4oo}kxDYziU?diI&VIdq~X zI{;9pKtcU!Gf39t#4DBKRti#CohFN`*R@#1PU5%<3IUwT(Qx^hSJm zbUZ^PiSChCnp`ppz1}Zfcr-bLM3RhW0tnrs>otZm8i#<3>Cni)ui@=$ffkB<`v(H3 zz7PZe24`aiM2Zx_1VF(+K^P+8p`hWR;Qo^$0nnI~Fc?^zlIj#3Uty^v{?i6>0o4i{ zHK_aGOwHzYZg4a~!QlS?X$4`RAX-5eo+?DDBLqx|qHR-;!~_Ot!T^Fzf4P`18Z_Dz%nKEY>MT9z`gYd^3=Jp^jI`oSmNOGr9jbY zgsOApv7s$Ve|1&|w908-AXi5;Iz#Hdmn6R>87$67^8}C&jm_rrly83`_=j>RG;|Ny z+UNw?;WO^~t{8WBa9iMv&D|m7tcAo{kEz4SgbSrwFv5fuk6{jC%T`SWNF_-x>vv=` zxDu1e05i29SOvEu-^o!}68poCNi`iKY0_5Lf9g2mAUaMV(xHq#>PVd`&tl~j2Qn?3 zLO0XZF@qxL^fZScZq&2_R)PdZ2(j3d??ISFSK?-s7lPq+%SYD=Bi>lvqSo>T2vWwuQd`nQtE?L>^yIroZ0_40Vq=1v zVk>g8)E^ngBZ}v?d3sa^sKaw)PDvrD&=LnD;sdcF;)^~YRb4-AVk4$LB00#b5H@ce zSC;;zGgM!zy7!Y?=4VwQ1nO2-EuQjEIoA3*W6478b++RpByV7$DXs zgU5c$KUD0$2z}y`N=M0YoXv%Zw;w~pc9Zv{Wc&%uR7(zJi(7(Xc#*GI%hd}kx$LEy zERaxu@9tBhV$+FR2=x9MN7lpCWwiK?|7^%HhO0cpQBkywvj$5EOUc`38i-4ExW*Hl zzpPQUxEAWL0=K}QE}|1HYm*q`h;lac&QT)x@%`&pChOpmbDVb6h4%O0m=`vgD`Gev z2|y5{BG{3xlaUvWqe}_` zN(EZ4a=W4-wu|sjs8NPIZ3yFfEd-EU7GR*n2dxX2*K9NUK^*6u@7uXjo)GPH*W2lq4DA$x0^~gY#NXRVTBnxb^H^hVcTW zn0#Lo0CF+1CwW@wP|8Dv@M}xROn%Ls3bioG)xB3 zpL&2TO$BL=FcCZ4><-LHqwQ{lxvEK{r`va4y6;u+f{cvRV+fsrRl4_8^SFn$f;hXf zIVePl@J%`(5(8Li#6AXKheH~JuK>Xsx+E=!Dw1H8OCwfDNgu!$q9!6$mZGN9eob5yzY zV(}TK`X8XBaw+|AZp|#Pt{^P}9OOS!uyQtrNC_sUz@UWT(Q)Fn(b2rE7ELQKai6XX z+Si0t=k0JSOmb&H^Bj2e#I(2j7EW--gNzzheecfUd-SAN{;mQu*P_o~e_HVKl@W5Z zs!3V!K|YdlsDiwZphD*BRUSKgPqg9T(?>HgNz+EKRblDK)ao}pY)%2<3{CBKYouot zay!E>=2n|V>|)L2^|!P*JZW_2DlqQIlNJo3c=X?YnqarIPFf&3x7sE|`~wIBOM_2=YbDAH2=+re{iKLi_LbrXF?I61E44jN8}#39rRidgcqcf4B}tq=@()K6Gt( zwJXjKxV>c4?cSWOMPjxOAGWtf0A)ZuVsU>IiJ!fWHTQq!nG)Xlx>lJ&f=-ZI6g}MxmQ|j*=u+1E5 zqVg)g#bzQRXaXY6JqiXFVZEMZ}-(LasQEQH*WejA%0y9KP z4>d#_>miL3j}>7-p@J9S^iasDOLFA--{*W&-#NaSX8mR&{bnrH+kikQ|1Yx5I^`Q_ zVReAH?!J?P4r;Jo1KNFU8C!$+iI9?>Z7Ba_N6;(Mon%e3pA9v#f0Nj4?qT;D57Is7 zhje&yNvcv1(T}6m)ezNlhPXCcRH8%#1sxEeSW+y`2BK%{x3#};6zg)P{ww+qVE>Z& z4-nhAVEHV|vcmmwfZz!x)>+kWslB7hZ|EVn3MlK|6@N*X#E5Ew1_8)Q9uqFUo?noU z&0p*uC#+F6c5mJWM!uEf>wog9T&~|ikFmA0Blzt0eil*Q0V+YaR#JpkE#6e4-l#xS6jbu^mD5$?tzJ5oiar}zwsZycAAwa zyMQa4g9m^-vl;<)-P~bB%=E0S5ALgVxiSzTmv;2if`LK8Ze^ltoz!ohyQ)0qm6@iO zq<=+jK)@?VpFp|)76=YuapdQ@)noZ$u`)L;oI9U?t77r7B)hG)wYy!1Pd4QI%<3YXr;)+FS&e|pm2XBY^T76uh>$R!9gtc z(q;%1Y?f3I6_`Q#^m~>=ApbbD|6z@&BbnOL!cmNYqF@j4=Snt%z4T6I0*3RaNvrLe z@Ty50wYgG==v6Oc_pK<`gQ-m$ptgycv>sY1r()^Uyrvm$w&O~IJ-p4$cmv;KTh13| zrfjKClAFi4{h7*LI#bmq-y=ULtx23|;TXDAT%%cB{Zabnm!!^~D27y$wu+(7ZZ1*^ zzdklxWzrqcd;F818~k?oTa#OO-BC0Ha`4PQ4c z0|2xX0TXO5%Rg6$F87^p^BDp1_Oq)&zfI`Pw39rsLo+iMxhqr%ac#tsbW)*dh^6)*Lt2zbyt6^tcqIKQ}MqV@;fjY=N+QFdzL z;79fKr!iEuA+kSd1kwT(msdwKks>umT%Wei-ejsE?;g|a{_k3JnGl0()LCU6JCGec z_jxwgAuRuqxtnVf2E2_X*{;DPjD=Dt(dTl`Wb6y6#@J|U8}J~aZQA#PcCad(kevwT ze*6BX79pT#37wrHn1~J)?)Habv)=#+lcOOrn<9LyTzalZWS~zBYS{FJ+6oo3$%=py zK_F{Nx#WlYXCcZ$RU&$n5dq`9L|TJ_l4_|6M7zD?n(*YzjUYs}-1yV0=D!q$F4r1i zb49sHM=+Vn3?Wi|GD38u7_;TEDd8DtUx3G&9n`%%p^{UWRliH2f{Cbb>nH$8wZ9`}P*c>~ zy$QDwqz8(K=uxqQ#b8m!?dWM#{3X$#-1l=akw)t>aCUq;wUJhAqHx=bU9M$NE=2&x uneI}+d`u#jIn7W892I&oy^c?%!!IuL!MRqLBGkVY)pf2by;lSOt^Pl7$q@Mf literal 0 HcmV?d00001 From 1758680b20ef84240fa186e259e32dc18f246b45 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Tue, 31 Mar 2026 12:02:31 -0300 Subject: [PATCH 2/8] chore: demote broken ref links to warnings Sets refLinksErrorLevel=WARNING so cross-post ref links don't break the build when sibling posts don't yet exist on the same branch. Co-Authored-By: Claude Sonnet 4.6 --- config/_default/hugo.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/_default/hugo.yaml b/config/_default/hugo.yaml index 3d004a76..1809f01e 100644 --- a/config/_default/hugo.yaml +++ b/config/_default/hugo.yaml @@ -9,6 +9,7 @@ timeZone: "Europe/London" enableEmoji: true enableGitInfo: true +refLinksErrorLevel: WARNING ######################## i18n #################### # Auto-detect Chinese/Japanese/Korean Languages in the content. see: https://gohugo.io/getting-started/configuration/#hascjklanguage hasCJKLanguage: false From 6f7763652e405b457f9257a96ecb22f976d90520 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Wed, 1 Apr 2026 11:10:36 -0300 Subject: [PATCH 3/8] fix: use proper figure shortcode caption and attr parameters Co-Authored-By: Claude Opus 4.6 (1M context) --- .../2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md index 31c172c0..9edd3e3c 100644 --- a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -15,7 +15,7 @@ slug: 'migrating-crs-3-to-4-part-4-scoring' This is Part 4 of the [CRS 3.3 → 4.25 LTS migration series]({{< ref "blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md" >}}). Part 3 covered the plugin architecture. This post covers anomaly scoring, the reporting model, and paranoia level changes — the areas most likely to affect your baseline after a migration. -{{< figure src="/images/2026/04/pexels-thisisengineering-3861957.jpg" >}}*© ThisIsEngineering (pexels.com)* +{{< figure src="/images/2026/04/pexels-thisisengineering-3861957.jpg" caption="Measuring and scoring every request" attr="ThisIsEngineering on Pexels" attrlink="https://www.pexels.com" >}} ## How Anomaly Scoring Changed From b2adc9792ea477d8c16da79e84e9dc61884ded62 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Wed, 1 Apr 2026 11:14:52 -0300 Subject: [PATCH 4/8] fix: replace author byline with related-pages shortcode The author is already shown from the front matter. Adds the related-pages shortcode to cross-link migration series posts. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md index 9edd3e3c..fd5eb25d 100644 --- a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -117,4 +117,4 @@ If you have an anomaly score below the threshold but a rule fired, the per-PL br [Part 5]({{< ref "blog/2026-04-27-migrating-from-crs-3-to-crs-4-part-5-rule-changes.md" >}}) covers the rule-level changes — new detection categories, removed and reorganized rules, RE2/Hyperscan compatibility, and how to audit your existing `SecRuleRemoveById` exclusions against the CRS 4 rule set. -*Felipe Zipitria, CRS Co-Lead* +{{< related-pages "Migration" "CRS-v4" >}} From 6e211a3c5a564c4fbdf1e1fc7a6e364eaee2a6e9 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Thu, 2 Apr 2026 11:34:21 -0300 Subject: [PATCH 5/8] fix: add What's Next section to part 1 linking to part 2 Co-Authored-By: Claude Opus 4.6 (1M context) --- ...ing-from-crs-3-to-crs-4-part-1-overview.md | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 content/blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md diff --git a/content/blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md b/content/blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md new file mode 100644 index 00000000..a200fc36 --- /dev/null +++ b/content/blog/2026-03-30-migrating-from-crs-3-to-crs-4-part-1-overview.md @@ -0,0 +1,75 @@ +--- +author: fzipi +categories: + - Blog +date: '2026-03-30T09:00:00-03:00' +tags: + - CRS-News + - Migration + - CRS-v4 +images: + - /images/2026/04/pexels-toulouse-18332033.jpg +title: 'Migrating from CRS 3.3 to CRS 4.25 LTS — Part 1: Overview' +slug: 'migrating-crs-3-to-4-part-1-overview' +--- + +The release of [CRS v4.25.0 LTS]({{< ref "blog/2026-03-28-announcing-crs-v4-25-lts.md" >}}) marks the moment the CRS 4 generation has its long-term support anchor. If you have been running CRS 3.3.x — waiting for stability before committing to an upgrade — that moment is now. + +This is the first post in a series walking through everything you need to know to migrate from CRS 3.3.9 (the last CRS 3 LTS release) to CRS 4.25.0 LTS. The series is not a quick upgrade guide. It is a deliberate, post-by-post treatment of each dimension of the migration so that you can plan and execute without surprises. + +{{< figure src="/images/2026/04/pexels-toulouse-18332033.jpg" caption="Charting the path from CRS 3 to CRS 4" attr="Maël BALLAND on Pexels" attrlink="https://www.pexels.com" >}} + +## Why Migrate? + +CRS 3.3.x is in security-only maintenance. It receives backports for confirmed security vulnerabilities but nothing else: no false positive fixes, no new detections, no engine compatibility improvements. Every month you stay on CRS 3.3.x, the gap between your deployment and the state of the art widens. + +CRS 4.25.0 LTS closes that gap and gives you a new stability baseline. Its [backport policy](https://github.com/coreruleset/coreruleset/blob/lts/v4.25.x/BACKPORT_POLICY.md) is explicit about what goes in (security fixes, regressions, critical false positive fixes) and what does not (new features, refactoring, toolchain changes). You get meaningful improvements without being forced to track monthly releases. + +## What Changed at a Glance + +CRS 4 is not a drop-in replacement for CRS 3. There are roughly 500 changes between the two release lines. The ones that matter most for migration fall into a handful of categories: + +**Plugin architecture.** This is the biggest structural change. Application-specific rule exclusion packages — previously shipped as optional files inside the CRS release tarball — are no longer part of the core rule set. They are now separate plugins, installed independently. If you use any application exclusion package (WordPress, Nextcloud, phpBB, phpMyAdmin, or others), you will need to install the corresponding plugin before your existing exclusion coverage is restored. + +**Configuration file changes.** The `crs-setup.conf` file has new variables, renamed variables, and removed variables. You cannot simply drop your old `crs-setup.conf` into a CRS 4 installation and expect things to work. Anomaly scoring variables were renamed for consistency, and several new options were added. + +**Rule-level changes.** Hundreds of rules were modified, reorganized, or removed. Many rules moved between paranoia levels as part of a broad effort to spread detection better across PL1–PL4. New rule categories were added (notably, response-phase web shell detection). Some HTTP behaviours that were tolerated in CRS 3 (HTTP/0.9) were dropped, and new ones were added (HTTP/3, RE2/Hyperscan compatibility). + +**Anomaly scoring and reporting.** The variables used to accumulate and report anomaly scores were refactored. The old `980xxx` reporting rules were replaced with new, granular reporting logic. A new `blocking_early` option allows anomaly evaluation at the end of phase 1 (in addition to phase 2) and at the end of phase 3 (in addition to phase 4). + +**Engine compatibility.** All formerly PCRE-only regular expressions are now compatible with the RE2 and Hyperscan engines. ModSecurity v2, ModSecurity v3 (libmodsecurity), and Coraza are all supported, though with differences in capability. + +## What This Migration Is Not + +It is worth being direct about what this migration is not. + +**It is not a drop-in upgrade.** Running `cp -r crs4/ crs3/` and reloading your WAF will cause problems. Your old `crs-setup.conf` has variables that no longer exist in CRS 4 and is missing variables that CRS 4 requires. Your old exclusion rules may reference rule IDs that have changed. Your application exclusion packages will simply be absent until you install their plugin replacements. + +**It does not preserve your false positive tuning automatically.** Rules have moved between paranoia levels. Rule IDs have changed or been removed. Exclusions you wrote against specific rule IDs in CRS 3 need to be reviewed against the CRS 4 rule set before you go live. + +**It does not require starting from scratch.** A systematic approach — covered in detail in Part 6 of this series — lets you carry forward your existing tuning with a clear mapping between old and new rule IDs. + +## What to Expect From Each Post in the Series + +The series covers the migration in six more posts after this one: + +- **Part 2: Configuration** — A side-by-side walk through the `crs-setup.conf` changes, including every renamed and new variable. Includes a migration checklist. +- **Part 3: Plugin Architecture** — The conceptual model, how to install plugins, the official plugin registry, and a mapping from every CRS 3 application exclusion package to its CRS 4 plugin equivalent. +- **Part 4: Anomaly Scoring and Reporting** — The renamed scoring variables, the new reporting model, early blocking, and how paranoia level redistribution affects your anomaly score baseline. +- **Part 5: Rule Changes** — New rule categories, removed and reorganized rules, RE2/Hyperscan compatibility, and how to audit your existing `SecRuleRemoveById` and exclusion rules against the new rule set. +- **Part 6: False Positive Tuning** — Two migration strategies (start fresh vs. carry over), a step-by-step method for mapping old exclusions to new rule IDs, and how to run a production migration in shadow mode. +- **Part 7: Engine-Specific Notes** — The CRS 4 engine support matrix, differences between ModSecurity v2, ModSecurity v3, and Coraza, and the container image tagging scheme. + +## Before You Start + +Before reading the rest of this series, do two things. + +First, download CRS v4.25.0 and open the `crs-setup.conf.example` alongside your existing `crs-setup.conf`. Having both files open makes the configuration changes in Part 2 immediately concrete. + +Second, open the [CRS 4.0 CHANGES.md](https://github.com/coreruleset/coreruleset/blob/v4.0/dev/CHANGES.md) on GitHub. It is a long file, but it is the authoritative record of what changed. You do not need to read it end to end now — the series will reference specific entries — but knowing it exists and how to search it will be useful throughout. + +## What's Next + +[Part 2]({{< ref "blog/2026-04-06-migrating-from-crs-3-to-crs-4-part-2-configuration.md" >}}) covers the configuration file changes in detail — a side-by-side walk through every renamed, removed, and new variable in `crs-setup.conf`, plus a migration checklist and an interactive tool to convert your CRS 3 config. + +{{< related-pages "Migration" "CRS-v4" >}} From d6fae2fa6372f931e1869e4976dfc5916c09dcb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Zipitr=C3=ADa?= <3012076+fzipi@users.noreply.github.com> Date: Sun, 19 Apr 2026 09:54:36 -0300 Subject: [PATCH 6/8] Apply suggestions from code review Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com> --- ...26-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md index fd5eb25d..e99fee9d 100644 --- a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -41,7 +41,7 @@ tx.notice_anomaly_score = 2 In CRS 3, the running total was accumulated in `tx.anomaly_score`. In CRS 4 the internal accumulation was refactored so that scores are tracked in a way that correlates with the paranoia level of the firing rule. The details are inside the engine rules — the operator-facing variables you configure (`tx.inbound_anomaly_score_threshold`, the severity scores) are unchanged. -The visible change is in what gets reported. CRS 4 reporting rules (see the Reporting Model section below) include more structured context about which paranoia level and rule category contributed to the score, making it significantly easier to understand what drove a block. +The visible change is in what gets reported. CRS 4 reporting rules (see the Reporting Model section below) include more structured context about which paranoia level and rule category contributed to the score, making it significantly easier to understand what drove a blocking action. ### Impact on Custom Rules @@ -57,7 +57,7 @@ CRS 3 had a set of `980xxx` reporting rules that fired when a request exceeded t CRS 4 replaces the `980xxx` rules with a new, more structured reporting system controlled by `tx.reporting_level`. There is a single reporting action per direction in phase 5, governed by logic that decides *when* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. -The six reporting levels (configured via rule id:900115) are: +The six reporting levels (configured via rule 900115) are: | Level | Behaviour | |---|---| @@ -70,7 +70,7 @@ The six reporting levels (configured via rule id:900115) are: The default is `4`, which is more verbose than CRS 3. This is intentional — the extra log output at level 4 is the mechanism that shows you near-miss requests (requests that scored above zero but did not hit the blocking threshold), which is essential for tuning. -The practical migration impact: if you have SIEM rules, alerting logic, or log parsers that match on `980xxx` rule IDs, update them to the new CRS 4 reporting rule IDs. The log message format changed — run your log parser against a sample of CRS 4 output before cutting over. +The practical migration impact: if you have SIEM rules, alerting logic, or log parsers that match on `980xxx` rule IDs, update them to the new CRS 4 reporting rule IDs. Also, the log message format changed — run your log parser against a sample of CRS 4 output before cutting over. ## Early Blocking From dbb4dc6a25f7d56f7b4c352dab441b4464085fb9 Mon Sep 17 00:00:00 2001 From: Felipe Zipitria Date: Sun, 19 Apr 2026 10:20:13 -0300 Subject: [PATCH 7/8] fix: address review feedback on part 4 scoring post - Clarify that per-severity and threshold variables are unchanged from CRS 3 - List the actual CRS 4 accumulator variables (per-PL, per-direction, and combined inbound+outbound aggregates) so the custom-rule advice below has concrete names to reference - Correct the PL redistribution claim for PL2+ baselines: rules shifted up do not add coverage at levels that already included them - Link "Reporting Model" reference to the section anchor - Describe the new reporting flow as a restructure within the 980xxx range, with a single phase 5 action covering both directions --- ...ting-from-crs-3-to-crs-4-part-4-scoring.md | 30 +++++++++++++++---- 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md index e99fee9d..99ec07f2 100644 --- a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -27,9 +27,9 @@ This model is simple but has one significant weakness: you cannot tell from the ### The CRS 4 Model -CRS 4 refactored the anomaly scoring variables for consistency. The **threshold** variable names are unchanged — you still configure `tx.inbound_anomaly_score_threshold` and `tx.outbound_anomaly_score_threshold` in `crs-setup.conf` exactly as in CRS 3. +CRS 4 refactored how anomaly scores are accumulated and reported. The variables you configure in `crs-setup.conf` are unchanged — you still set `tx.inbound_anomaly_score_threshold` and `tx.outbound_anomaly_score_threshold` exactly as in CRS 3. -What changed is the internal score accumulation and how the per-severity increments are named. The per-severity scoring variables are: +The per-severity scoring variables are unchanged from CRS 3: ```apache # These existed in CRS 3 and carry over to CRS 4 unchanged: @@ -39,9 +39,27 @@ tx.warning_anomaly_score = 3 tx.notice_anomaly_score = 2 ``` -In CRS 3, the running total was accumulated in `tx.anomaly_score`. In CRS 4 the internal accumulation was refactored so that scores are tracked in a way that correlates with the paranoia level of the firing rule. The details are inside the engine rules — the operator-facing variables you configure (`tx.inbound_anomaly_score_threshold`, the severity scores) are unchanged. +What changed is the internal score accumulation. In CRS 3, the running total lived in `tx.anomaly_score`. In CRS 4 the score is tracked per paranoia level, and a set of new aggregate variables is computed at evaluation time: -The visible change is in what gets reported. CRS 4 reporting rules (see the Reporting Model section below) include more structured context about which paranoia level and rule category contributed to the score, making it significantly easier to understand what drove a blocking action. +```apache +# New per-PL accumulators (inbound; outbound has the same shape): +tx.inbound_anomaly_score_pl1 +tx.inbound_anomaly_score_pl2 +tx.inbound_anomaly_score_pl3 +tx.inbound_anomaly_score_pl4 + +# New per-direction aggregates used by the blocking and reporting logic: +tx.blocking_inbound_anomaly_score # sum of per-PL scores up to tx.blocking_paranoia_level +tx.detection_inbound_anomaly_score # sum of per-PL scores up to tx.detection_paranoia_level + +# New combined inbound+outbound aggregates, set in phase 5: +tx.blocking_anomaly_score # tx.blocking_inbound_anomaly_score + tx.blocking_outbound_anomaly_score +tx.detection_anomaly_score # tx.detection_inbound_anomaly_score + tx.detection_outbound_anomaly_score +``` + +The equivalent `tx.outbound_anomaly_score_pl1..pl4`, `tx.blocking_outbound_anomaly_score`, and `tx.detection_outbound_anomaly_score` variables exist for the response side. `tx.anomaly_score` still exists but is now a derived combined value set by the correlation rule — it is no longer the accumulator. + +The visible change is in what gets reported. CRS 4 reporting rules (see [The Reporting Model](#the-reporting-model) below) include more structured context about which paranoia level and rule category contributed to the score, making it significantly easier to understand what drove a blocking action. ### Impact on Custom Rules @@ -55,7 +73,7 @@ CRS 3 had a set of `980xxx` reporting rules that fired when a request exceeded t ### CRS 4 Reporting: Granular Control -CRS 4 replaces the `980xxx` rules with a new, more structured reporting system controlled by `tx.reporting_level`. There is a single reporting action per direction in phase 5, governed by logic that decides *when* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. +CRS 4 restructures the `980xxx` reporting rules into a consolidated reporting system controlled by `tx.reporting_level`. A single reporting action (`id:980170`, phase 5) emits one combined message covering both inbound and outbound scores, gated by rules that decide *whether* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. The six reporting levels (configured via rule 900115) are: @@ -97,7 +115,7 @@ In CRS 4, a significant number of rules were moved from lower to higher paranoia **If you run at PL1:** Your anomaly score baseline will likely *decrease* after migration. Rules that previously fired at PL1 in CRS 3 may now only fire at PL2 or higher. This is generally good — fewer false positives at PL1 — but it also means some attacks you were detecting at PL1 in CRS 3 may now only be detected at PL2 in CRS 4. Review your threat model. -**If you run at PL2 or higher:** Your baseline may increase. Rules that were at PL1 in CRS 3 are now at PL2, so at PL2 you are covering more detection than before. This is the intended direction, but it means more tuning may be needed after the migration. +**If you run at PL2 or higher:** Your baseline should remain stable or decrease. A rule that moved from PL1 in CRS 3 to PL2 in CRS 4 still fires for you at PL2 — it was already part of your coverage. Shifting a rule to a higher PL does not add detection at levels that already included it. Any baseline changes you observe at PL2+ come from genuinely new rules, removed rules, or revised detection logic, not from the PL redistribution itself. **If you have PL-specific exclusions:** Some of your exclusions may no longer be necessary if the rules they targeted moved to a higher PL than the one you run at. Conversely, new rules may fire at your PL that were not present in CRS 3. After the migration, run in detection mode for at least a week before enabling blocking to establish a new baseline. From c2ae1b59e66f525caaadb258d8f4e7bfb890a09d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Felipe=20Zipitr=C3=ADa?= <3012076+fzipi@users.noreply.github.com> Date: Sun, 19 Apr 2026 14:28:21 -0300 Subject: [PATCH 8/8] Apply suggestions from code review Co-authored-by: Max Leske <250711+theseion@users.noreply.github.com> --- ...2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md index 99ec07f2..fbc9f9cf 100644 --- a/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md +++ b/content/blog/2026-04-20-migrating-from-crs-3-to-crs-4-part-4-scoring.md @@ -73,9 +73,9 @@ CRS 3 had a set of `980xxx` reporting rules that fired when a request exceeded t ### CRS 4 Reporting: Granular Control -CRS 4 restructures the `980xxx` reporting rules into a consolidated reporting system controlled by `tx.reporting_level`. A single reporting action (`id:980170`, phase 5) emits one combined message covering both inbound and outbound scores, gated by rules that decide *whether* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. +CRS 4 restructures the `980xxx` reporting rules into a consolidated reporting system controlled by `tx.reporting_level`. A single reporting action (`980170`, phase 5) emits one combined message covering both inbound and outbound scores, gated by rules that decide *whether* it fires based on the level you configure. The result is cleaner logs and operator control over verbosity. -The six reporting levels (configured via rule 900115) are: +The six reporting levels (configured via rule `900115`) are: | Level | Behaviour | |---|---|