From a8a0190f46304c1993f5cf6974b811957677e590 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Mon, 4 Jul 2022 17:59:39 -0700 Subject: [PATCH 01/17] Text recode/revision --- .../hello-for-business/WebAuthnAPIs.md | 25 ++++++------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 9b8365686e..e8d712cf57 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -17,30 +17,21 @@ ms.reviewer: --- # WebAuthn APIs for password-less authentication on Windows -### Passwords leave your customers vulnerable. With the new WebAuthn APIs, your sites and apps can use password-less authentication. +Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use password-less authentication. -Microsoft has long been a proponent to do away with passwords. -While working towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs! -These APIs allow Microsoft developer partners and the developer community to use Windows Hello and FIDO2 security keys -as a password-less authentication mechanism for their applications on Windows devices. +Microsoft has long been a proponent of password-less authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. -#### What does this mean? +## What does this mean? + +Using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement password-less multi-factor authentication for their applications on Windows devices. + +Users of these apps or sites can use any browser that supports WebAuthn Windows 10 APIs for password-less authentication. The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. No matter which browser they use, they'll have a familiar and consistent experience on Windows 10, no matter which browser they use. -This opens opportunities for developers or relying parties (RPs') to enable password-less authentication. -They can now use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) -as a password-less multi-factor credential for authentication. -
-Users of these sites can use any browser that supports WebAuthn Windows 10 APIs for password-less authentication - and will have a familiar and consistent experience on Windows 10, no matter which browser they use to get to the RPs' site! -

-The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later - and latest versions of other browsers. -

Developers of FIDO2 authentication keys should use the new Windows 10 APIs, to enable these scenarios in a consistent way for users. Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC, and BLE without having to deal with the interaction and management overhead. This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. -#### Where can developers learn more? +## Where can developers learn more? The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) From a04dfd22a7548d515b350821eeb0e02145d86ead Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Mon, 4 Jul 2022 18:08:35 -0700 Subject: [PATCH 02/17] Revised --- .../hello-for-business/WebAuthnAPIs.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index e8d712cf57..50484d275a 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -27,10 +27,10 @@ Using these APIs, developer partners and the developer community can use [Window Users of these apps or sites can use any browser that supports WebAuthn Windows 10 APIs for password-less authentication. The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. No matter which browser they use, they'll have a familiar and consistent experience on Windows 10, no matter which browser they use. -Developers of FIDO2 authentication keys should use the new Windows 10 APIs, to enable these scenarios in a consistent way for users. - Moreover, this enables the use of all the transports available per FIDO2 specifications - USB, NFC, and BLE - without having to deal with the interaction and management overhead. -This also implies browsers or apps on Windows 10 will no longer have direct access to above transports for FIDO-related messaging. +Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. + +> [!NOTE] +> When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. ## Where can developers learn more? From db5faf75be5e6ec1a8f1033a3aa8f55da8ee1e7f Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Tue, 5 Jul 2022 13:36:11 -0700 Subject: [PATCH 03/17] Edits for MSTP --- .../hello-for-business/WebAuthnAPIs.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 50484d275a..6c6056a031 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -1,6 +1,6 @@ --- title: WebAuthn APIs -description: Learn how to use WebAuthn APIs to enable password-less authentication for your sites and apps. +description: Learn how to use WebAuthn APIs to enable passwordless authentication for your sites and apps. ms.prod: m365-security ms.mktglfcycl: deploy ms.sitesec: library @@ -15,17 +15,17 @@ localizationpriority: medium ms.date: 02/15/2019 ms.reviewer: --- -# WebAuthn APIs for password-less authentication on Windows +# WebAuthn APIs for passwordless authentication on Windows -Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use password-less authentication. +Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use passwordless authentication. -Microsoft has long been a proponent of password-less authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. +Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. ## What does this mean? -Using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement password-less multi-factor authentication for their applications on Windows devices. +Using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. -Users of these apps or sites can use any browser that supports WebAuthn Windows 10 APIs for password-less authentication. The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. No matter which browser they use, they'll have a familiar and consistent experience on Windows 10, no matter which browser they use. +Users of these apps or sites can use any browser that supports WebAuthn Windows 10 APIs for passwordless authentication. The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. No matter which browser they use, they'll have a familiar and consistent experience on Windows 10, no matter which browser they use. Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. From 83020687fbbf4110f47c1da41c1a66ac4b28a3f2 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 12:17:04 -0700 Subject: [PATCH 04/17] Added images for new section --- ...webauthnapis-fido2-overview-msft-version.png | Bin 0 -> 49169 bytes .../webauthnapis-fido2-overview.png | Bin 0 -> 47622 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview-msft-version.png create mode 100644 windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview.png diff --git a/windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview-msft-version.png b/windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview-msft-version.png new file mode 100644 index 0000000000000000000000000000000000000000..49639cefcf242161dec1ba4e4c1cab696f1f8ec4 GIT binary patch literal 49169 zcmXtA2RM~~*tW8=vMDQB*_oL|BC~`LviIJbN_Ipd$KGY{J)_9TI7SE|d+*Knod5TI zb-B7a-t(UK{k^~EdG6=F@8^U)Rh1{ir^QD@LnC~m@JJmE4IK$TLb%xQO5;5KJ@^OD zQ9;KA4UOss>Ic1>bx#@%jS=n1qlX%v$?GXzzT|SJS2H7$@|!ntgOVJ1oEhquGykH8 zhX*3?9(|yYJNKHaGk8VeF(&u@!uxL(?wcnh6j=AE?(UgvkMrvX4|H<#&^cIyliojIbgWOxg!hK0g%Li$ zy+Qd@1vxyiV$~|B!npsE9d&8FGKuMMAsJ84W#T^Hg;!*Du0JzIeIEXI-bZ0y;WzB$ zEhH?t|96n>RYF9e-v=4o>^KEHRztgJaty5Wuz9n>-Tw|47V?k(JW4*8&T%8KI80YX zuRTtIV-U+y`ng6CUkFo~l)t`;Q}r+T)Pj?XBl4ZD>creIE5vM(d|s9$>IBCdC(rl^ ztz_NMOR?It+$`0?(o*Cx$?M)K;QbsFD^g#tRB_R2$n|c@qa0P3{kkz7lNPXkw)Ny+ zlaNXQB^q-%aoiWU3%RLTHtpOSl((6#ll=`DLMtiZG?^X6KTM#BJ5#=k$y63vjyIP= zyW&KPsoUvjlJ-bU5Erk2gJrl>%!cffLXT^EFrlXeeZAY-V`XLKV=)yZI|qjmEWM!B zP*88LvZA6QJ3D*2%~ z0&mx}<;qIMZx#L<;Z^c7+TefeuJo6IDldlKp}n$W`_4DYu$e83U&;4vC#&D@%y+sB z%2B;Tez!vW$drrlJeu;T`}^j4?ZN0vj=Oi~-V#ftd+ja4?N?V_Y$Q{O_Zh%1>Q=+S(Bc~6531R)7sTS&&~COUaul!RoxTmz#@5Hi6b36WDAi_nS(y^ zbHv1t;A;n+qc;fKTUT6%GUcu}pRRJA9<0eLD=(+Md-rbrciCI5BHedAHCD*rPKJP6 z4O8?{9yZk26ciM9SXnczXxj|=^h!GC+h!fp*TiIS8x456PIaux=B1m%q=rJI|!Cxu;i7rZnbTg5w++oB9zt;Ucv7p=632wiHEM#kw%$dKS-Esqx6d|7R4v^H9_zdVQ;$lHAUW_VZwA!sG@ zF=YNfHb4_;K5oa6Jdwx-k}^NeuB5Ze`}XlR6zW5=~jlq4UHDP?9_arFSj+_ zq*Lq2bnV(TOT=SaTdo%dUMw^;G#Xl3<(7lDiRdLl`^>W}`cwBer;^Ic?@{s^^iDVV zzzO&FT^~nMzs|L4yf~bU`}8R$Ev-K%!Jxa^Zjzmwd!dK7<=^&fyPn&Krl9>F?f(LO z7~Oix!kTb9{)2!0Wc!F0j%B>1#eqs6^#n(1AQS)XMz0O;gMfNglAsP@Lj`Z4_vQ=l z`)G!x;*)ELcQ50^2LyT9UUg=#CU?$fs3Zwj+KfeM7HFaWJ@7u+?crS+uVBN&!<)6` zw695WXggwt;Tp7yY z(k=~j>6c7+_!j$_o?h?p*XQWk4es0!e`W*e4@bD>Arn@(Z|MG#zVgK;q!9>ot=qX;OZ_>)mXs z3Pqkhd-i+7UD*ClD9M|f4vjYg4>u+;OC4sUhK7cyrF=!XUshxNg(o(b8NrkJs>L78 z)YO#EX|BUjC#}B|wg-)bCtrQB%ldDAVcXxWDk4*l5_t3jKeVc)Nzs*zDWNt_v+w<> z1`jqNp-->@jg5^hryK9vO;!_@oZaP@y!f}Y6p^Epu>0et!n1?v-02$ z`IX;7PX<0b8W)s%~c^*fjLG|5SyK1rWL({Dj|y(!`eEK2boK7N!nH)n+-_V@R<{fdNOiRAgHI|Nn!*o%;mPINVv zNt-okJ0-8LuM09#I4&(NZnkXJuVr5NUv(mK^(Ts6)@0ojwzVAi`aCZ)gxf!~29GJk%`V}_zVggAj%>Ns6XM~5R%Iq`Oy|EX2Xr%x>Cn~i&_e%)~#kNbSo z5Q0x?r|bvQA7Xlq>3jSf%#!as_HF)setyo3mi74kka-`%EQ(er{~;f>uO{w}p@G44 z&Cws1Xe~WGWnEp`tJATTUc|v&^6+|Dco+($R&Ng885mriQ_r8W2=EC|qDdP6X|ecu zBlV@hBi;PB4Lph_3L)CJ>J2xfc%Msg&c6S|a!mMH>NZ^x>p<1Ou%mhYTY2p4-GP9J z6Gsac%*hTCK^Ea6_h(`IKQ<<7cq1seWyaj>8#b!9y?X9Z$OQG|<>k3-|9uFXQ654F z0`h^71+$Iy_=;=n=g$fdSX2g{On@z_Y{usHPAn&@x#gp7W$09xpKmw>nEZ&O=}i)e ze)5rZ)>TZW%9;WSDdyj`k``8e{up?C;SmvoZj$RCOz#Wme6#Yp(6uWyV9CY`!oEFB zGrdf7Y8Gu(qb8ybw9bdY-@eWXz{1k>C~pAiIUQg>5(i) z4rY30rc9c!ov!HQ8F$T}%%Y| z#nhLYGS>Miawhkdrv$}({m!sei`S_;OKb4GY~1jmuJC8NSiT<^>e=xl^*YZoHn(Fp zF-)TVP_ejc~2X2*I#_|4bqK|MgK{ZKMPn8HF#`2R{TjUecsv?!`wa!C*x={BtdJKQtgbQ z(J|-iP-u#f&1g(vVIe(Hh)EA*e@SNfs9rt-=2wa*gI}IyrMioyuw0$=2Yka2 zby-w)`PUT_7Hs5-R=u>elz_`5jBXz|X5iCDec#!%&izO*3pGO3-r>qy_75>)z*;bCW zg6B@~JaZ(p+O%e}?(%f)XIB?mIv{~RK3h$KmII7>i*pgYL~3cm05X&8>%)QxZ(=yE z71fkOWs9N{e>~IdcYm$0;>(vWhOj#UT)s=yQ517u?}F^qx7e42hy8YcYbNbiiZ~`8 z#BJ=ykM~`dNg!1c_>jHwoPCD^uXN(>j6q+jv6EtBWmHv(-a{%{Z5TL-j3mg8Gs3yE zre_orBHQ`K_mwG?l>BuJVV`*yhQvXZ`tu0auW}(cNA+QGjL8anXAAwQ4Ht?1*`ebS z?F1P1|u2prcx8AwcB0)q)bOwF-PWy17UEMW?UMOD9dI42ac;RGGVrZwRu~i`whhi?3e``SpoT z)+UxnKZsj5kKWmEb&?Aq%pojHzyFR7A%o5+LnNP26+K(U8&y^%s^I-ba((=ICtb9w zexAcjv!>m3p<*b%Bh4Pm15D?Vkn$kFZsMxsJeHGlx;$Bumw06<{YCRfd9VsH+pH(v zh`+L!N+zhurQqm!7e_v9M+oATAR8#v%OeFZs@z%c+;QCbPW7Uoo$n#i@cZd)g9}5E zpJip#Lwly@tgX)SW_U`V75-P|j>fpg^ z#|fKCVzkWrAhll^T&UBfSkRW0<{N>pp)PaYEFKbi-=HH9FX}u;B>MoqL zF>1*7c?gos926H3Y%z_hE%d(%8XChYQfXV(91CyNyLX`mPpfxlw2Fqb?-b2!1u#$( zOVk^G$0rmuveN=6R+sFWw$iqXc1$p#`F)JAXyIMq^Xxl@^u%;aTD}Q1 z3hvM*8(FnZSVWU8-_k}4ecVk(=Ti7ZMyu45!_0GIP?xPr!lXz@fiwM$rqqy&@a|^{ zU;2EU+?r;2?7R}45VsT~>XFnWswlcLk8TXGq zQMRzfpWbEOL8}*F+SMabzyR=EwXnG8jb2_}PVnH7oZRe=CjnCso0!jJi2C z#_PuXwJbrEy(b)5*>RJ*dwVnJj&*uT*>N24#&9|?{adk zspyZTi4e@kK49ci!{tBO>13GEStxbo;^gFfj2nZ0?sK}o^6CEl`z{!-TVDyO>?v~e zqtl{CpI!KqS#so@rj+L-XC}SYyn6iPi{hN*VV+QyboY`?%#dV8_1ZNkQX#IeT z1H{;x9a|84jJmfZz1s4Ds$!P4cNKwla#~t|NUOfbRF34?dWE^WySoq5qwNWslK0S^ zR^yP!gra2-I|Wj;+SfRI<~Ip8bGv6f{AIbZv2m6sp`aqpIiqI*Uy&mktr}2RcVQuy z3hp3wy0xN6^Xj{=8n|Tz0Ip^2n+~+_06B;(qX8UK(@(Q{%Dzg+R;B#@?i&BPAtzTG z-g`{uh94ER>5&#%pB$~uL^C&N(V1O;k&XnE@XUt1m9l5Bw`2I4U)fEI#4YN_E-3ut zZS;2JK>^~_{^Je#q)5@qEPt1`77_FW$L>v6r+yKt9%uf<*wY6qGw%k{t&0Y6X|a@( zs?1O8N#<--kkdWg-MVW#p1RkW+!J$8Fa|ni9YY^5{w0^mzJ~Ey^sg6FhhRbv1x_3l zCFNr?3yYZ-ER{56Wo7Z2pYgLb{HF0FmYwSmS|c}a-FMEu9DV6P6Kq5P*>wqn-Y{UK zrCPn46-_3zt~G@xfwNt(&s`>zJUs)s(z|!!%lx9mKyqxs*$x9yH?^7Yx(Wq*&ArGu z0hYEs8B<0YyW%ST@voS0QVEi>@OW==n2SZ}tKY3zf$ue!Ib15gbvcBFLZdUB(Xr!P zh&7*EY1L%6O{Z?lL@9of60p4(J*@Z7FXVPJieB8Ye9l^*J4=k8ZQeN?L}%FXJ0#QO zYBy-hwPtVZam~Xdmk-x^ZiLhn<+niJv|R>Eb$N#Ho|X6mHG5v{;PfYrbnU z-2TB?T>DMhZbC3H0H3KFEjvyPpUGX3L+MSMAzEu8Vv9bBTW*gu2{EFs^)w|d2+s*rLM?<`S3X+mm?=`h)*UU;x5K+ z|8ozeO|B0=qa6|?Q?CpTy=Q&K&%dU`h9#LT{!4M5M=yy}?=~C}%C%C=%1>2mfupDH zQrQ>bPKi^C(TBOItvU4d=OuL=>RjE9zS5BK7gXobt?Wws_>sAyynGQYl3sGcss8Hb zNfC|bSe_4$k7vOx&!xP6OoFqe*=?n12qtSnFRy!gJY&(DKbwF@XrGgGm~Kov5Ek}1 zTu;;RhdSWq?NBO{@#Pn6i<=#*rn%xe4gEb=;_}8wxlcz{T`^q_3e(5+kh@Vv2 zm%_q00LU#f4zLS*K8rY{YBze88E9#-y6Pw7TG7_k)pg(1WM924#EmrMqprTi#v{g+ zLhO*>qj-*b@|vSLY=+&>Dz3BC*u@jF`LS*3dMXr8Z^Y-MrWfwt+?|v)I5~=rFkM87 zv(!*@+3fj$uupr|XMCMD*Y>KH$7?+DB4aDw>_z)(MfaJn)X6XLt*$?R{*+QsSzV(I zzG3Y%QitfY(XEbIuo-nJ-x^)&5@ViRa&ItWBoWOZGD}QFJl8={yiTl7*T@l71v}wH zPRHl0F8JNA=ZR#Z&uc<;(moAj*%2reJ9G;q2>(l_&n6T^agDVZK>EFpr zlB9`Ei_{+6Vi+3th0%MOT`D#d7;p8q2^QQ+zCB@N_X7QQlaGi}JeSes`N=H_&r)3< zGfi~|{jv6+jW+br1fO43G`bZox_?H@6!pir(LV0_Fy7$73yU`*@#fPz6f1r3R`7 zw~*(#hDa<4*N6BK)tcL59>hC4gninF`q!FG9;VjbO{umbdh?h)Lb+-U&n_BID@Xrq zEFD{K|C_zJJ^TD_l#{ZaZ_pb|srX2{@TR-Eu~l++$_e8cod`6I%^ z@u8&{uW?{VF!1Jhi%pnWSs4e!n}F?azKI$KH95I!s1RJ@PmvCgGBY!qeE`YBOJchf zlRCI9S0#y0<>M#L7eiGxFAyRQmq{0v{}KKsPDA9jqnG`^-Y1{?D9HY3_6g-QzkE=~ zt1!>{EP0BnlJIdTS&Ac9fqDt)cynK-)o;FVIyry)tG^_?CHH^4#e80ytNv6Jmfq_2| z4SlnYhSb53zjjAnydsREm(*2KQK5(@8*C?*F5H-IdRb|O{K3V=H4Iq}%~bRAgH)iJ z%3PLIo3gVX0b@N6cOmG|xbv7PXyC%X#d4~?YG=EhI0#dpgR(eOQ!M@6u=el2N zm9a9t=EJJ4XXV(R$^2J@dWhw<*3S&3x48r%#-+}&iZsr@g;X4WGfsbXdRV}29^e*v z&>*S2oYqZ76^t>GW-T{JnuTJ%cXyrRdGy0)wmRo`g1B3^n$M!*;>e+C#eD#e;f72p zApeOCA(4Y+t4$g`;$E;Ob_wA3#;tm3pK;4yg-(?Z+S%!J<=Nm*p+g;4jmeJCe zo~DLD)(cxLSN=|*j`VcRM@t@l_S_$oH|r}0xvn&5;ET1qO*&rCz2V`}Q6K<+0ct1i z1z5p=cK2nZ%(I&ND}p6v6v0^P&PQGx*^k!#9JVn@T{g$Ayh@l|B~_Er;GSIJx)_kL znxwQX`dcAMU%GbQFJ~ojk5P!cF~ho`_vvO&0~4_{_PWAePyKb*6>$ktUSF}2T*2Bfu>9y!brgqa+%5x>h`W; zDHSNPmuK+XPbxF%6qBUyr%wMwVr*}3zqthXxg~ChL`ILOcSz8# z8MqTPJ)RfRt*Y#I)diS3UMA?fj~~9fP9=pa@z=TTUf{cu#@+5YIE^)EWzRvj9Db;3 zojCeuh9f3&xIXN?kqDLrCA<-L#0WA1`t`0xkg$AD zSMpHo2Qb=0l~&Ka4_3cJK}V@{`VH6uwNC8jEt)O{S%@KFWe#uc?&!+D!WszG8i$~>SyLlyP+Wk8!+kKku~`ejw@J8-}u+5Dj-s{e*2nhvM(8x>bcj~+nWuHBZ`V8xFz}lIK8x! z=j^IKg7C;Xlz5v=i&(MHjZI9XK{2_hjC93k5<`0nxi%O0A!hY%DIhY$bK=5eLK^|y za6^v6DJZ_EAj#wmjJrqkMX=;xB>Dfn04jSYH8cK`8_soN7_zp)FFOJB(f9oNWp9sI zG)kAj-BAVZ{R$0EjIQ4OR?}@+CiD;Vj4jcCiWiU0q(xNr`cFoylZ4-6wKZ{mN!T0aAY}orH-j1>88a&j7$Ml)c2&2u=(#odm0}}x?9~y`^ z5bm{lK+nmB5V4Tpe)#Z#q?*s6<-)zYr-z?_S#R3=$7@U+=fiOeGF+_C=;#vRA|Fs2 zG+pk}O8fgB>yVO?ein7Q4XWwv8K*y8eh|4#+oBzseT|QV<9iZgq72^yt@F7Pnb2AF z?vV#_5b2Z&Jwi9Av3q0HCvxIg(BQtuOksa!SWO_{5q*^j#o#de-kT^8js6d`lWUL{ zu}ir#pTy2jc4xlsM@Q*yCgbI1K0zd3LFG_{OcwPl>oH3oswJ};JxQ*_mup&-|1NmP zy|YLmiS^rP4l5Q1zZm93$Gvow^(Sk%FSDvVFH_H(Gn_%ZeQdsv>+0JoVbGQIPUy=^=Nftb$AxRC$ie6#KT#@F+Ps`3pji*T43E(G9I( zJJdsTnY5nCgr2=^`)fwB%Xj&{K^eF?R{z7RKk<&*#yiiieTwyZ0M!OFZ@?` z(p)z4Dl-;c*!`shEPe@I9oDpjK|HA-axbF$%x{7*M&zn~tr!W2#5pIf#s+biOEL$2 z`xTwj$`$61e+vtr&evXDk)mP_eG`&kr+EcoHP(F=mIcf3nbdR^hLFfDa+yD@Imy?bniNDq zuc|amxoog=mW45uCNXgFTuqX~pScdIiBKRwzGeAWSSW~qz6}b=rRBKO{0}QM$Zoh> z2M}D1o^xSrswcuAs2{}lEY#1OUM^=v-(7p2@g?NT`mJzj2|yNU$wD^q+O>`upT*qr z@%XHU?zo^R=!>Hns+E#tR2yuXr=Fvc7|fVFC1dl|aDWKOw(H9RuL|4l2H_47<9zW*`n4NF^Ngt}EaC zj;7dzRBq<2)uTI3+SOPA$k7&Ba{;v!F}V>BIOpl!1-_jAW1ZXpf;h8$^->Pf8E%n~!$|aKTLJN;P%sRgKN<*G$@NA)Q!G(&mgd1AL$3{p& zZfabtZ*`IYLc86aX+LN>y{WOEvL*>Xu-5HdLnlSgyjwr`jZF+&)#EM7ZM0(2%DNT34tgT)dTkc@y11PK4<* zaW*dQDQC1IQ{|eS@X|rsgN4|b-4}Zk( zmOT2CRX1hNO@f=u-^R2q|B7`jYAkCvFZpczornK6qUMef*x5 z28!-Jho&ircdVK=1s2o~17m+&T*bRC??t#xr5e$qx7bI!V-cKe%J=IZOSSGNq-xmY zgK4JH0fzeR~?lH2Ro9DU;wdWk8@lRKNu@=DuVV#l6%!saelNK5))?sUehVq!QpOr88WjX#hGYdu*?6rJa|khm7Wz|vHf7`^q#!h>s=B&}YUuf4OR@odzF~0D3mYYXJ)yJw>txX2fzWxxr~U$sU33=_gIR*|%+sRQj$r z5)%_4SMXc>y48HLc+*z+W?TBi)ZR>2F7f6Bvwte^&y3ETp8aE6TQCAM};8<>lrZpvm9VD97vEOTDg{yQ+Z4|U3M;aC6uP-xm$`22|&P4~oXNKzvoZ6j~#d*o#e$v_! zd3;dtzpqDnyIjqu`$xQD7|9ElCbedgM=>DbuR=+mqdYn6{!EI>6#sDq@7Vb@|8px+ zWp-%%-$A>JMN0}C1rGCQg>*QhKQMbN)I$fBx^}y>)ZvJ@&!aDIe;e{9zagiOHBk*q~Ls zCG+SFT^d{jDPh(8RmxCe!AS$}&}7J7FN#$ORxE$hnn z<{a+zLSb|LeOWZa!ol_`nP_~9h(pLE1y?gmOYKUB? ze_b~q@5+D$DKtF%^vPhbHGRPvhOMNDnHdX1z&Sq@C)cfMNnc-R-V`{%cGdI50*k9G zvhu-{y$FN5vvoC<+|+!5l;_Z2P%fnc{$GLG!8F2le2Z`accFxJWGq%$v*g56BE@N!v|G z3;ALm;>losH9EfYu;!VN9Il4fC4w|a<>`u$;{sK=wFgT*Wx21-%l1fHoK_$_yU$Pd ze)jiUfRWP@@dJ1$uhp-4?BJyx$dGM3+iaMvY6M~+)q9l#^xLra@6DhA0#chKsqaU* zS&t_eH&CA0`rS!nVL)NqhqYi1(lEN8P|cwLewzWV2xlWrah7P8(&aTVA$= zFi-`{zDfa6&lmrJ)?7isgYIB2S}p30(QR9% zf(kQcoOy3HC#MGOdO_#Er6ac`)OW$ybvbk1Zp*QsIetyko3`BD?#&y9Mv10X>VOte zLL^qk2*JtIgQ9NTTlY+H;Uf!1N5MLX1h#*>43@#9W)h4#D03{NJK$NO;lhBl21B)C!KstSlNqOOm~%el})i=03aSmr3ugwZl=X$mwKGn_- zon}wT_|jFlu4v+a

c}#Zpvhd26JYZbWKCSEN3@(T@Jawe z2Gaf`h&D*DVgg6c!NGyDKS5IB)6>$)4nI}6ps`xz$R$u&+T_98zO1pwRjda`^Y~{1 z`UbxDluz8Jr!`cU0=8IwWeke81(O(#wQ3!x;cnlIb6hiEJ8y;EwDQWU%O7Z{gW*Xy7dSv1a)Q#I(gO>n53jqVJ+2l zbi$A;Sm_`gK|$n$J|op@kp?B(0BMH?dnP+G^UcqXY$#7OIBaJf!DEC(BCQ59ug&R5^!~{!EUoL;4Gs_p6aCnP8Lf&l#OOo>TQ=nOjPSOfz9 z0f=;7e_!K(+nN&-n*i765hjY~gkq8ej<|tpyO&@k?)v#N14Q8m%N{rRjjB9z{mcMYIu(8$CHC-Ko)V6)%eog@9)ewW?$BL3 z|F-?F0JYDdeSvOJLNu=KcC1>`k%&(pBh-+=VJ&Vx5}Z`{DHAhPOm(NzqT z=dV@v94u6Nj_B~yhPO2Bccgz$K;Y-EU)X&0`gR@QVXFTbSv-!-jtoOhX086B1MBqmgmTS*FgcYH)kFRqHEe!Mo8u9r3ZyuEmO z4-B(cgY_~r=GFvpqpgK_iW1lh%};Ylb&9%n+9sVHzY^+?708K|=enKkugJoRu=DUd zR(#^@>@0Mha~H9yQqUlSpUfC8)IUN=mtWm1Hhv(T)12m9B=c+xfNe-wVQ>d~O7VL) zWg5~US&E0wB3gk46!)Ggym@HF9ia81jqEPr3;Hs9+WJRijF_Y?J8L>DF{5h0<5)tW zt8$6y|BCGhOi4W?*pM&+F^2mahdafJQE@oY*Ru!~_y}zVqb-M=)TVJc7dm;*z7I#5 zli#1xekD3yS?rzolwFk<3X|xYuJiZ|%(RW2*G7Q`O@GwrBGj~$H8@tks+W%Fy}GXN zVQjqJ=CwK60s=p5Oyf%D7JcDg zg_lRFE~ozhfN6HGO<(F$cZXWK)W|6T@RA8g}5gWoz_X4lH*4ckJxq%s`SrZD(C6Oq)45u3qTQND6Rni zTO>6zB9p7n{BsV;!eyV+qP)~)@;wE6b~rLjpG4rZ?2)V;X7<>FF0)o zljA>YQ^pASS*e7Kx~ufHjggihCMCFHLb<3;B!|4ug}B)Z{BVfrfh0ot(HL_~A+G~m zOqsNA;J)>gY3NLtnjrY9ermHcP{*J@<|5mQ7Uo*;#O+2Fzu)9YXR8op9tWERq)z}+ z@nAdvq!T>3VGfN1TamQ0@NEFCupj|vlQRlRN(Bf0EpjcKQ=Zt(?&6TlM-GHL0aI)Lvk$$a#=z1U|D{#~;#J@xt89)uB z`Sj@%fG}typrUvD_z{dV0-Ge8;F=Z{YBmaNGIxN;*JItKZB{0dWl?1_pBA&wq9FYgkl;Mt9h z$)G1=yheiwDIlF71-_U;}&# z_HJ;7?S#lfa6H6)sA=h4pDX@g?12_X2G8#o|15^&zf1U8wLi6NWq7i0XD3wkfH}$3n&HpnLT;@(zq7-PH8JSg(Lfh{4FfgLH8eV6nB_shfaW&&&mTRA&PXHbY#8YP zBtk|-)d>csAL$R@F8`?$0PMgbEuCglTo(*8cV(y^JK)L>SY!w~yz5jvU^g_ZnWTY9 zBzR%ga2xP~XOjUoF}-pK5uGR)%Q;^ZcWfP1K!*s{)OH9dT|2RZG2o}(fcY2jIEtZO z8O*|gbprzk3aG+Rm(@@<-gQbYm`vm`1ii~BV#vIL-|y5FA#B%uyfcsP320{=V8TaM zmAQ9R2I*j@MnyGnPAVpz4E4l*@IXp$=2*0fNQw=mTbY_z?Q z@G7`QvhOqh+q_ioa2O+d3cCi>f$uQyAp>nyz{sT*yZ?2lnPlLV=belYFme1XbpAT@ znmS#oj^-Oytms#tX`|v??{Q`5SB$kQr6mj%guR_S%hA{nk!(KHekl&~7?4{E4Vn;u zK|aL9+=x2zh5;^=&*5Y#tsga+p`>I2%ZUPgpkRTx;R*JXpFKVExk>il)(*-+PKEBV z7qTR3I2eWWAn)1!sf~dx3A$;bnA_d=H$}{0r^8162t6T8+<3t$P}5?NC1$~4@((lx z3!r`f*M+14MxVDh#6+Dn7ggNMDo9c9eReRwn87qMY7>EHA9EY7ZEvGyW)~V+^io)} zRKG)=U;-M_>c)2@dj2O1pb5_Hcsh!uKx-Ey@Ezv)-eFF?j9&*)7bZ;%hq9j(YL~r% z4tj6q>M{YPD7&wtS~)KeQ~8<_bM& zf2@p*N)bMH{&Kr(&dz?(_U=-|g@K|XhTzRO_wtu%pvUcROeUaXVwYO<)1%@B=DNPW zx;lLkM3SAGi<-fK$Yfz*K|LAqt;UaFiN`=Sqp?XzN?u;~QI`yD9F8I6A=Kn1SQOAp zz4pveLfQo5w2MmH+V|&=!^d@<@^lf-JH1Q?_O-n2lrVTfdg84o#@Q=McSYB-%IbRJi zo95oPN?d1Ly{b4`bW+z?`gT>5@4YpCWF%}JZ1>rS=8(pes_o0eL0ko8g2e>6taysU z^8fb&G(Y>O_c86K&qp=mx%W>tubGe%@;qXz#W~2tdSv#>EP*cQwb9{9;>t=<{@O*> z*UW}QqY#}hTT7ToeSNppJ`T#Uy7;tg^$L$QDR+Q-$VPT*n5D30R zWz_H^jC8H8u70@lWb0fAGq+$c<7JT+BuNFx*l^|ri1ut)afR4N?(V{<#@NcnrrlQ9 zf+!DmepE*@o`10>+teU#}mXF&E#EdzSVSBQ7DK!u!Db z5;{!e#DpTuk&#$onHvsh@&~QBb!W@qNYkWsZC&bzSiWO?vpM{bFGM5MzU15Cyq&G| zqLfPpe+3z0(Bxfa`jZqgBUAva{}@C-Qc&4>@(Fn0HZurNT>5K*xl$1a;NWqdY_uK=g{;9Hr zZ=WCu?lSuKDnVsdvZA6Q_|gIJSbi-jv4G5QS_PKkw0^3XsGp`X@n+QyGsQN{z{Enz zl!mpx4FC#ec-Q);Thj|naFJ^S4{>#-!r!#==H78B*D)UqX2psKbexzf&aaal@)ff@ zdzLkXPfX&Uagmar55xm%$GLA!tGKubu&Je@U?y5+Rn_3cM1KDx0N}OrQR3iY<_8Ds z!)N5M=W4;dx3AL=)zu498OmV-H-SoDauJj}1G2OWY z;VS%9&7V(qXkFb1jJ)YGe5P(- z#ifT&aqT8dBA=8h^}d>-F5mpbIKgBX@=^7m(&ZctD=tbkyu-R`7lvh%VBTw`0wLvh zx?J%AjOb6bwW-S(oS<5Q^~MR%&YdTyuPXrX+4PYCs#(9pUSzYXHVCP(E=3N^{E5oG zTRt-=H}aSK{8z-=5Mycm(pSmB!PtdboRE;vpcd`6ViGSe=@Ygy;}(&D4|vr_aei*j zbGr@aV8)?-h1I@x78{-|6mMvGFd8B*gTD6t;!$lK9Nvn03_>xIH~U>k)-VS6okp^%_tsL{@r$NYIyu9<3y~V@&z^ zx5JoTua<_M_uGAq+_GD`^4II%B%4O6`i_K-TP@3Mq|xefQal=(>+7Yt)!uj`L$%qY zrRh!cClmN`fE!wfz-D18x)$Lw&PEo z%L+1&*pcaDsn5#dcY=+01EzJ8xF%AY3Y_Jj~jL*!_y7#-RY=PqPO>| z=EF1jK&#RhH|$j;tS1ZRYa$Ax{Bo-Not59lk*fl`b7=MYu3S-cKIOHRTOGIY?o6;a zlPUjW(fy?;;GH`(Em_sFF14`^Mo=ZETQq^mb+cQB%`A z!mW}u=-Z6k@t$q}%}?$I@I5UZ%|pw3-`*LyUjF)YH%-|H)w~`k(;fTUeZ%gVZ*l+ZOg~$YSiMwof!X(4DbZ2ghK2+B zd{C->=~R3|UVY8aZy*?^n%-6Yc7sTYRb*^L^{&nz&_n)NRvQNXrmY{F0H}{r} zp(6`_&{y;U|4uh1e`=nZmWB^HV+YEWr{@}P6Fl>18Z^a9tfyLA|4ta;K7Xsq{Eb9T zvp-zerK#W~^Igs)=l{_39q?T4?f-T%LfOj5NHU64GBQg_ktkb|y+dV(3K>QA$S5l# zvmzssBC=;l%1j8AtpEEy&+q@dUe9yRb57;^z36L$Bbaa(F?|pK>8}2Iw5>=YxIw7n=xo`G zw4CcjM+=)Ix!jEDt_(J`U-TW`-+cG<&i5MbT3z3=iyO~BJ0*0exASRF+~CrjwZqZD z^!o2w`s3+&HT2N}QI9!P@*DC;*F3Xidt3rj@$tPF1Du84#(tWdWlbrl*krRKzo+|l zPB$liwxnS%liY(4m-mo|~So6c!$?8*b(HT}wA+V#1P-oh}bLNz#KsHj#=; z+*gkz4LrX>4)#R8<(lawHM=h*qS1*bq8|M)7qK(YFSkFWG;ohM*!V(9cAg09{X4t% zotxTp8VkGh7~~X=KtHgzY)mT4=8M}byz>HIlV;}T%hdhs*~ci@Wi!cXJpan*%thTs z+j7@m-%bx}*Sz5XcqJjX+^!O5vPvgTqZ0p{L{*!xb`K63ARFYS9^*t|gs{fV&#jNb z@+W!+D1$RXR7`tIuFai_{}?O2|Ex4_A?`wYWnXt=aW?36Sq|tK#qyTxiwTFG(l=wDDXLdzxm&L64b~ z&mKCf-@Wd#K=VP@H$0f zm3Rl)PNHR6|Ldaioi^X-)dez(FMZGvO>;+PpJC9b;>yeW>UJENL@S{g`BYeBxMfLe zN6%lm!UucFaKEsMB6GkGg|8WnnGfPpHBY*3Id+g*&t^j19R1-fE_vLOamhEdnVny; zbn|nQNq)N)zyJMncdi~EE8ft(;o;%Jq2|;&ynK9P%NqWko#Ts77`Wy7qZ1PLSG;)V ztf(?_(ZSG2dI_$S)sr*gxRoWfEBWKw!G$#T7TI4wJ}$JdOLZ!F@$L z=N~g&{%u17)62l8lAY zqJ5A0(!8!`6^8yRBt0FqxA&K9iEH)FKM}z`qM^o}ck2!+N=``z4c_Th=WXK~drot? zb+3?idmqEtkGaFcx2;P(b#))A-X63}sI;U!&l}t$`e66f#-gD5BKNowj%E9@N<(8~ zO;pRF8N8==f@cPx36pijJ}uduWo*}t7%9*h=H%w4`)zHiM|F>t@A=LzH+NvTA}k?S zDNfmrM1%1M>+Mc5*+9=B_27ql?Qd2k@!t8pluw}>(L+ToEV8&GB;P_RG?Y)BzLMFX z$_Ow7Y?V6+y#|pTl6_)hKR}}UjAmnJc69`f{Eii^kFU${k5X+6prkhu5nEA_1W0KQ5h1-fR4COPhB`Ts&;aye*Q^`_5aU_EofIt%CZ2SuH&` zHv~TbM8HW)%dGSX>8VxKXWl>bZufQ#UHv@5I}~|yz;L>Ojk@(`Wr|G%$%udRL(UVj zHFR+QCQ;BxipD=F?J=jKGTweV>e$T%Ufh@j#opc5CuP?wN}*&1jA$K}A|cSzL?@%8 z(*W_zqGvV0kFIG8ppiuW3{sYU!7odyb?H*mkW+0dUjD(XKit9gK*UmnNk1sTvBMqL`y_<@Q2)&s8KgE+KtqqF$DgAKX?!y zPi>SU$b8k(w*4vf4f8LHl&d8t-}SJ{RZs35Tvz(RN?PhRc;>>s$v+v|Dy0{r+5bIT z`%a&#P0kh2opyjfbZ>@m2@pMK##a))G{+p^IPNBlFUmlIE|t)06F3*zeaWlu=pg!m zYz;V@w!VIDHd>kwuWv0qzbp!eaum3w#o>8hHh*Y&oYBegGFSClmQK$JfOCKiI_9? z`t*iHmyI7uqNi?TskkhPoh)CoV7mE>jZotK{yBUGP>z3%rRUQ_mbeFKG+$B#itI>I zKV2B^v(NkGXBr_LYbvWK#i*d4*nwl`g_ygg_GyZ@T1vm{IBtp=(^SbivPZs-8 zmhjx8Fm~JA^_$72N{r793NGsEqQL~=pZ4liLKC-F7%T$RZ@mBaDMOuEtPbYvv}4=< zp)`tlAJYRB`i}xMe5TdI8o!c1k#N3wAv!9UCyL&gWFYUlrkE)df zp`d)bqfR5l=Q3SwzC_^Ue(U2r`anoPXqbWU#aeinoE+9@K1LvWep`S12pjqGVQ&Q< z@whW=t|mosXuv(@VG_1+bfi+28hrQe9d%&iyLTtoeNUhfh3l{clocuqf;(A-e2c&0 zlaWnWf(-+|cWZH#=cnzTO7n9rpCwZp(A$x^oKi6p!+57%kHcZOxGIh2OI#pc!oUYh zSDn`Wg1sd>r~O`5b+82a-SBoCrkvY|jft5K(A3q14(IQ?qcyji#`!=1A!jj}fMN#+ zn_)X86nP|AwH70Eb^fu=_1u?w(Yt)tAHKk+?Cp`aKmtom7R zUd#xQ0?s1PbCkR|ogh4Wn3&iMAHy_&AP6CG-ookH3{CQ<=<^Dv|I2G@@8`VQekk#o z7`3ij>A+{f0yX4;B|*#ZLbNvXEBCO)hyJl%#er!?&~h15Wu{R2V;3eot(HakhcdLiECXPz8axZ_9= zJ?}@m2N_c%aFTI>758yqwFqR_1a#v)gjJBUr0B2y@%@Tpy&lIRh!wwLD}{;hCidvghLhhyQx+O z6Ri%icYo^HJzzK5FwfyDo>nE@{gban5_l|f6B8hTx`TyHhcK=-bm>Kd`OGMa3vf&V zz*zzYOZ@lLx)3!P)*Hb+06n(Q|M|qoME@geuo7>7xa^sva<55K6sHQMm0D|!6XE=RK`J`DTT6Q{0crkt`K^}@!5 z{qHKk)4V(YLOA*U-9lk`?7rE-;2zsX#}~8w;sw#N?la7|jfD95GfPWt+5`U&+C=S3 z06u)LdUNtL3=IvlX|D&i@fjT83*CDzTk7kLm!4j)=&uZhA4+NkbPj3D+e@|obg?l2 zbziEIU-~F@_~_B-hYwwPE^<-zNhDSRI}Hce>jE?hjIS~;)<@BTmZ60m)`Le4U*VQtK6O0K}zGw@fq>qg~X<%URb{^QK)!duV z32(czah>lg$@av|Dn}Tf4Xo1J)7-doIJb#+dYq#(4cZIc<>hmuTbpGzVU$}LtB$d6sEQy~wpoV+q&)P$Q z?fS96_Sv2|%9=Kf8p~!)xt32ZRq&s9$)+>$o72*2tuMT0>(0cp>T@f~&1oFrU}SuJ zHVxtoqXghTefy;&%_n2F?oM~)Z>pZL$$O`KUnP5vcKC?LT>rkN0dSbxU+<8rcGv>7 zYq8Wb0E7mHh7YfCz`Kb~O(^=bljz{@Kd&izy z=)p60bnfO$%F$O5N2R5wZJp*W1AK+$0tAHo1`3(ajxT)ktG(5DXc@jg$rI`6>46O3 z>-hM}_*iVnm|k|`afM29+VeV6W$lnqgtUjr_?LD@rrt)~hB6gShI-tOP1Pn6=*Iwp zQz)SyQyLwb#8GK$yB8j~y~9gAN@BGgC-+`TTJY@Iv(2}UbB${>xg7QIAri~L%mh36%o?Ju3vQGB zoNc+h7$IV`?4p^bDx2KP=~CA7SnpLszJY-&wxkI3Yj)0xU=3->>{hrp?b~Zf%qHvj6n0uhDFYc{^Qm zvl2eN6T-j=w%WgxCpH%&U(HnvEgwDt%RGKd9JOg4bPO3#UK7sTdneX!k8b{cf!5l? za4tw`&3b+b_bgGAgEP=U+N82_fcWc-ZEwfsO|LgQgIXj{_ncnwbZ?^RApf^eS(L&f z@4REwHZ!HxW&EVAt?f$)1#fGmcvKC8f!gr8$wkBVb?jPCgcDrTK(Yx&UUi*yLegcsydE+3~-#80W~0yQqzr@OWx~?O`ko69B{Tq1O$+w(&85xLu8!{?o)!r zg)HIwc;pGdr=%zXR8+|Eb|CCP(u)u$CnriAQgW(;z>C4nTt);e3eSdVw+niDCmkKd z^YTi-HRa{yEvymgrcz*;NkFM7UcJf>2Vc8byqdNJ&~iuuf}#3@E^UQM*TA58-(zoO z-0HXtGRn(ia2sR)AM;&*S@UKcmOBVD2~-G*8d;AY?SEP|;}71Bk7p;q+N0k%Y6Ye5oV-_j``E?oHq}@CxZj0nyb(g-*E3!HzBBbVdpuT)Ww?UU6tM z@0XCs28RTaHaazRM;&7PPD9`P{P_dFt+i387_h8K{~|t@I5_*CUttP2*75p@vJHO} zkqD7>E+tQv5(t8YrRA^trt1OtXjmG4gf%-5_44rX&x~pEyEKmxOfM7F#At>iCobsf-Vtp9wMk+{k=!@?9pE@< zU1%5586wW7%AE!?gUwFxMtBZ@u26QN(a|w9Z29sg5RBnocnQ|#Yk8`M3+)<=#M$tR zku)+(+Aupi>wfj)>(_Gf)o5CrK@rGTLlp|r1I0d1DNWgZlaN*_D-? z(H~SbG@51TW#~s=Qym}6>jztaXWfF59Ly83-M|t}Puj59LW@ttUJ}JPo(KpXh+^^$ z%0od8Ass^ox_Rs*ArS3wUqVcYK3{HYeTmRa;2+>Y5KYF~pZQaa6a>4E1@Rsl3^+Kg z<_61i@|r;-+=7m>ztoC>afZFjCjuQ2E~+nKG(->}UK4-K6};mi*|?yia~fHk5IGRWD||Rr?Qc$gYg}StVyKsx)vkbJ`HZbagp*(! zZY2DKtO&Nji(4bz-GnX*EdvN5kb;EY06Yb1&?`rh^h+$ZM*H60uZeg?^{%Q;XT!o~sTi=y??0N1h+Cl?oy z`a;B~Eb98jdRmDEWU``L8T;nZsUVeqysd|N#Ah-u={Z0_F527@` zg-3D|LeyLT&Zqyv6oLQE2$;^sW`s}U0Vw#6&Q4{dqHuT4!GSXVqIN@!;EwTp55t;3 zrMww1ivFBc^m5(2-j7#sh@Yb2 z#zPCx7RqwqCAdPUc`aesz{`JT1x!~RDzgMch50@Pz}MB?{gx=BK#!3SJ08wh4g$-; z%EWt#Mrb$uAcWcqiKhbc@+lxmiT8)Sh0^GsXi0uP9T;M5*3(h%VO0U_;{E-A=@?)R zNb3#~uz~#mS&-$^D1qrr8yHitd(md8sv3Yd1vSD%z5O%JJJ90;kV#`LA^rjNFGxKG zpv1VrfvEtB^*kOWK-iMd%0o9qLhK{-?|Yv0Xdq-6h2AFvU0o2y%N*Bm2m=*ILc~1; ziZCa&vKGhfXv>fBgO%Cy^#>esxS}|rAh@) zTy{67((j>J#+F8P;6>^;sEs$3lb-+HiNn^ zmId*_7Q-4fiRvEskpD;pSlMw8aD{iA`A_aOt#O?%n-i> z$;`k2&}eBmIuZ3A+i>R9tSy2!BqLz?kbRc6rakIO!&F1~Id; zmU#Vfga+^f#EgT(G=~xG;)axQ z`ATsnPW&1qOE~dhbD*sQ-h}?}&EyiH)oA%{j!giv`0UZ<&QAKHl^6a)-Jtfw^@lSI zT{7-(`vJ+{^P@$RML9X@wU*$*MU5*T;lMz$NZT*Rr{Vu@{ODIg>`z`E0itZ<@m936 zBbI0-UoRvoH_%7p+#~EWh&vsfKYH=CJo8+2p=qs&X9 z&pID-i+jo_`2(mR_5*^G+3)Vy(~Lgy=_$xy7hxB;FWQ2Q0FdtXgW)uxIvw4P%axkeC zcPPnopEVDJgCd`hj?rLe^M?;tfTyC?!LU*1UDCo5Squ!GbPtP3AFa1{~bL_Wwd zDZ`%4#Ir)EV2ONR06Qq-QQ~0eKu6!NFJW8KdldTTvUTSB;mkp8{~1DO;{L;;o9Q@O4@by1tVWz*&r#ukF8l6U z4BlDjY<$`_3vn?qK|Fqxj@8kxVq;%Y^|5L*=R)9tZ$yaRuz=9j;*%1ZSiDEwOIvm; zA_hwxBe7M^b~joJc|RX}j(kfr%ebA0n0FkUO@NGJHwWE2^cu$84-M9d4}Q^Rq|hrg z`T#ZItHpO*fD^*3Wjm%R$w-aKzx`Qrj|-gJes<1xQc_tmC|8LBJF}9J`bESp3MHNp znt(bSGs`}Ah-7q>1B5PuEo+QL5^hgy{u(3?&Nkud$S5K=D9|IpdXH=vLwXKSKqxN- zB_tvV;0lYL;L%mJAp}2&wY0fDdEz=)GVIRWqlpV^wvVO9Q}8ygmKzXu5kkHN-5qvX z#;JmKPW#iRL%0i+52&EO!-=^~namrdMCJ2pd|}iim^^?Gq*i$KULuMHi~sPEBV?CGZK=P^8^C0sMN=>!P)c3YsIWm=yuU~o>+r<|yznLZ+u73wU`JM!Efo%%} z`8s5VuqazOprzgn)_Ltf0BDfPMzpXIv zf~0bWNqLd(5?Y9&dllv7(_}8V(FkvAZ?B%bh}vJDaw;Oh8=A}WMn=hw#g}kp#flk1 zoy1gsQJWb`+9q@t1FvtD{-n#StV|^61vHu^*e(dFBF42qhDk60#5cu#Ds(Pc-O!MW z`0;Op!D8tyHXkT@4s%$l-{vjjf+u*w{1uw{+`u_}BG4-{^#(0| zX!nVSu>N-uy}&_)v*F}Qki14?>b-c!(c;_U&E>Tqt{BR|H^Fio%c6uW1D70G&`he( zGFk}&&jg>53Gq}dmOtU7j~%E;|$V2da&WFYd!gfY%2765L=^u=_w>ocaZt zS!91+M}w0S+jKR-qUosBfSafO^V?XXT)rwm`6H53z0u61qWKA4vg{|%+q`A<$Pj>&Y zYa+i*Ld+XMDQ`|*8k+_50M~U~3*wfDG@JD%eI{3WKn3$wG z?w@f!hJi!rkO9oh*rG&2pboS)rlwX11r$I-1-Ju%OR5Rnf`p$F7$Z^FT)vzWSA=xg zqt-MMrqJ*P@Dh#k@LWa(tCZ)mHRNr3EiECu!(N{;Btw4%Ej?hguFs!8B2f+9YX(Rc zNQBW3t>|ZWO~1v~!v_%+eS)(E_gH6tKP3AqFOiYIx4W`Lvhz$;L?*GbX(qJs06 zx?pv#4(m^^(LbUvKZFJ5<5gdtI$-+=M@e`ydcd<$0@ancodV&y*omM(x8ZP_labtF zj{VP-#KgsY>&%OvgtH$~Zf$Pf3Car=VeAn|UES_c<4Hidxv>ZD>H)ELA$rA@c#qrs z!^e+r?T^Q!cNin-a zZJfbN?H<5;5&dgvy3|PN8>%?eYK6$mM{{VrnX4G2k8=9PGwLG3fP4{!b1Pkw#ld5F!1= zUFOP7I9dgX$sAsjpv$^ZLyF*2m54rG`J6HPwQ-qca;>`B(>J}(_~UAv>+8&`Y@G_| zzQ2J^$c0X2mGEZyytynTeT-pD{7r^@dd?N82MgE5ndcI%8TdQwf^D}+?OBntegFH{ zjhfMhmX6dHPk;a7OpW~gi!0UAjYC$%(CZdmcJ-Pn&wcT(r?2?~Q%|`K(-%o71{v1; zrVB4yYWw5$_r}~~57ESk!m0;rWql*ZZMnuKZ#;VU>X)lHA@p=9q+!|^TCI6;V_muJ z)dM^6<^DULGc&zXX8+KNHQjmQ$2Tf5amz^k_~dbq{qu{;$9D$)RPj3LIp?D=TGGDi zTid=Qu~K<`!?*D2T+FLXuTy>}E*V0A#IW!4>dV`2Vg$VJM;;oIemQao{|sjBcAQnR z!AFk2F1)v?adFCV2{kSlLhy!DhCy_6g_nT;lXnDJ;<`f ztDoj)l0T(2*QI5f13eDzO~144n{=4^-VV|0x+`bDEZMDw324`SkCk!FxSiEY!g@$C zgFn{nxmQiLvz?Pl8mCbt0Pbx&9ofwpLwY;BL4=JuK4YW~2}}{nkA8d7|#w zs36|pVDmq0s>AYIR8(;RkXjTTID7?ec|GECB041ozrQNXY9R|0ZgaoLZC^;qOHSnx zWGtYmnD)Uz5mFl7x`8($;w-JML+uL5;lv+t2A4LLBaXKl9(s62?8LPreMW_&&i+V? zWvTuR!2y$?^!tsBPv)+o#Gc*xpH`pAB;q)^5(#PMRmqo++d*rOcwHSkFcRm?> zQ)oD`H+-m5_uECyKp(`S{5spU{l{pTZS@ z_5k+5uwLe2`5IZ2So($dm|EaGg^5zWUg zwn4NV&Ps#0!a$;(#yl{$rb%ZPrLyu*bH;2wBaInPK^6YT{9J$8ORfB#`h#dlu(9)R zM>8|$G4{=g!mEe*@YeSuE%a?)&2MQS`R@?FMoe3Sq@(Mo*S%*BV_}JI$f|galG^iP zBC5+wVH$+B90eWS{>ee2(&tpbVY!WkPh&Pl=MtoQDnwg^LoR!>RuHs{8R2g3Oh$YpQ|paR~kI z1{y&7=P;ZeL$r<|FXMB}vdiK40xBZCzrFnns#i;0-RiB4(XF}Z*E`wWSfE5AB|#lU zNI$^5LKi{|YV((>k&E0Td$(!)3ffY_Ekw-3Lj!@j)X-VReD184@!tY7XXe--KtL3 zf8ycr_v5l_*X!NNlAjsB^(7KTC7G7)${04k&EO&;g^yj+-_%i2QE8i=zu_sDT8sRz ztwg*P3DR>Z$ECX`m#Rfuer@S8e}4r}j9>P34Hp+{ccaqIxN98xvF_t4b1w?bzmE(b zgfcio7@%!E0E{}6jqlKGp=?YqDA2sIso?re9p*TKaR9giB%CO<2@DaX0)mk`YyJH2 zusMK4p=sb}q+TGbEKuDz!!uY4NC6G=_~JrLk@p>t91mk-@Al0;MKJ`JfheZ&Q(q$M zFaZ=dp_@VBSNHuBZ$sY=O`%;t3Hka9r4zRa3@rG&wW1VfA-$-(hjzIq;(mrT3&q$D zCB~0P|7z3LUGekp$q=p)q*m^l?)pbUS$E?0c?zYQu4ucil5l%3yb9#=iD4t5RYw*_x1F)Fl#Yihxz(3qjqvGR{eu(XjLgkOOava14;F`})1D;6$58 zdnT^sPOD{C7v4CNi{73cr&PJi+%e?s9{OhBkF|HWq>LT)DV4qe_#}uW)LVz35;=EB z8SmAw8~3=X0?aFAkqAy9i<1t3)~*AQSK{oX4GBxn{fI<<&>8PR)aiEm?laf zJx|29mWKeYqvGP4(29VEkU%#>0vO5T=jRV7W#51NNTFQMNK}&qR*Ke55+x}rByv=R z4+IFvZ!GbwHuHuFNE)>kj5lcAOTJ`I+Cbh}E_8MmU&Z)- zbqaF=q5g?jyWcGVy!OOjpG67CFCi%|mBd?d8s`hQwr)9{)(?+0FA|B`^%7+^bhpEt zemJv05U}gVf{Rd$y@pN`GBF_rxdjq%VlyRP4OPdD&k0^}o@?iX%$^SWrqa19D0JAd zkMakKJ3@q5yV~l6>kV!oE`PKT=vn+Wmmb?#Tl1n_0m%bw9L{TEHXI5;e}V`kAsljq zwHoc=@@s%S?awYr$eRKV`uFj$jEw#$gQsANuVD3Cqa7mbzhC#o=e$WEd+t1@tP~}{ zqIFR>h6EKj&n4XzZY4$y7B&6N0wkW+MfkNsG zyN@XX5r#9J$b&|Gnn-vT*D-Pr0EVRB=6Z0sPT>89_ym(CYeQwC;D$)cU;R=5D9H71 z`%WlWDh{)%8iT;0$3Z5<(76e!!mv zweA3hzc?~cD6vpnF;r7)d`vR&F`<;_CiBgaX*Um<{ZGmX+vr2+&W_eBh6j&INlM-X zw@P?wLBs4rH~sUlY{1VjzOzMF>nW|46}0Axj^ySB>D{+!ds1o8N>iHiXYD0sHG$Kel-Jx0#`;q19$UF3%KMzp zAs!ck47JW}`4}<=f!E(d`I*+9O>Hq9fVyyA9@T9!UETSMy5$sqk#gU-Ux_h-#0z(g zv2G7X5M8t{h1rp$z&)Q!x`089V}9ICxzy5p4?8^`YOxTA+$U;ZJg`v{^UYUFV35x zxn8kI`tshD77Y6hLUQ*}MQd3)fnO^h$MCmDPnEC1@A`%*83Tm!4l7JYMU=)HT5NZExkuI`u9Y|{hfJ(ogoclUodM3oGp;!5#6>O}jbbM}~;Vzbe=#n3QuI?cDyqpJQqoI)uJc@lw#6CNyzfdc9PoOx!t+JGQ2ca(c4`A^$njQ39Kj}(tx zmfCuhJ@=&B`)L;b1#H_8y}2L~_e~^|%8v3w_j$>IO}~Npn#p&k`d$mFPmI8wCFqgk9B@Mvqv?Yc`0&#0H@0vcL#o|izr&${hQ~}Kv>r{O*JqQT zb|G*y@j}zmXdwwBt^LTY$vsfB1@+i|Cm3e{P=xFUpd|!6wFJr^!E>Sw(FO=gu^`A? z5R~|xi{QeE;lUtzP<>gVRYJ-QMv*81(}e~LX=;b?Taks<@auaEN@PnQM|3<2$xgmY zNkoMU(2NNG#Gm^PGZFqG-0DML?WQ|2O>Ti6Cko8~UT5Uw5cwfUNF!dx|7bmEci52v zi%;_ng|!7_JpWNOxIJNff;OAum@}^_X4ZmBUH{5f%Zo`dd3ho~5uXiubm*EGvu^9g zL+6cxiZi&2AwRwG(_IP94;sbe48qg_>h|^lX2tp} z_Xm<4}dy%zFKBhen>* z5~00~i|ZSkgWf02OG%3EfjBp@@kCi^(O>}ac0pJKNXZtiwUa+0|GyRhnI!1m*$ zM2gSv&ggl~W=HKVz3?w^_puI*q)UAJTF>>mPmu0^-7w-)me6d#kh@(kYFvz|w9C5e zMoiq#FG*dlA(4l6(cL{P1edB7&KtqT#Kn+P7)+&g?ZEI2OBzOs3;z2_gzk3LzPh=A>6$Ga_c3x8+&fM zaTCWi-a|3+K=BQ5Y!Lqk6a?J9&av(7yTuf9_&YCVC02S63<*dEA`pY5X8qS0w0gMw z6}6c`6EUhW>BsID7l(9*gId3(x4RpHP1c7Mu{Drgg91eB%MM)vR7toefRGVMnil$5 zxw+eMN5Ks;yE0RJiWIpx9|02FZs#?JZhN-YP( zHQ7tw$2)r|g=_0m-tIT{GD6flNgsR3kQLv`G#gvrh0X!t;XEde+sG^fY| zU9N^sgNTZjKOW6@R^q?)i@F)SZaQ>_xY7W2H6x6s9;GWyP*B7XDIAYjvOe;H>~u3! zGMtH|7kC-l8?pxMj}UDhVwq5qdpbKg6kJrPimc$yEa(cF?3s2u8RV*?8{@YzYf5z2 z#Du0F!&Pxa@!;9e`@4+{7WfSVe<1#VUNS~yy|=9YdT`FoL(@dep8ZmH`?KHHhH$8> z-fGbi+?rY&*7l3L9t6Tss%*g2Hg!N&^6;+nv=?P^QY$86oU1l&S|p{Z7r)HU>@qv> z!rL#MKmM?W!tA?Y62UJl7d#pM^zAl^-t%bV0EN;zZN~Cgs8zE8spIOZZ`ZckA2&uy zYz}$d2djnVrVYDq6@QHo4kc(l;+-`&!$X2m0qz5W4+|p*|0s9lJvdDyfkB{J&*m{j z0xH2=K|Gglw7NAYyR;yZx3*Q=_VKgWD}7!HWokp=_l3b)`rRTI3s^e_dA?Cyq<9u! z&T_v>&+wU^l94mHSipn(XVhkY70?=}70_O$7dwxjLOt!$ddb( zzMZz5NKSZlRB9>plg#7qI>gKr#P48)nNzoy1g`U=qu$ZrDseIxrA@TwIJ6ogKMPW5 zbU@U1l)(!`r=(OrW;4qVhOQM(8F>(kASe(@j-@Gs;g`2CtSCYDhB(wa(ED{}X>vhN z^d3;uUlpKJq{UIJ-RTsU z>POfsTD4b@o?_k;_<3TY7Ang(^hZA{;-*S^A~3dybnRWih<`);r>do;rJMT2uEPj9 zx_5=07<-RI0i5e~30A2gjATW9v~@(%24rJ410{k8ww`_(cQV=>%8-Xdra2!4VgG=* zjNqM7K~e449XvFbg`--V!Pp{06c`r6XPz|z{I8a;SB(m{~ zlRXA)fR`Cm*q;WlPV~2s5F*wF39ayNnIqm4{}v&XpNJial?Jed9^HWqwsm~g2XyI# z6Jp1@;t{$)dr!-Oy*v z_Pq>uzLQR4d53;)~k%S%hhWNu+s@u?ap2AOBVz$Py|v zVe!e|LY9{$mU4A^(seNFWk-^e!`wLQTB8R}zK&_OmJ$T$OPkcqef!<&qneEmbkXI4 zdG?+#`WH5dOJAO}`djR}mG(IQ@#fUkdpm3wo1P~spqaK5xwtxEX*cRdZwED%tfjv)VfOdzn1VevmZbHR>&c^wbdAz zBPeJ|35g-fTmeBf8oC_55tUQ=S)tLPJ_FawJmq5}SwzS$gppr35b3ITJoN2xE@GXb zbCCqCc~0g#v+w4r6%kB|*V^rE!%r+1GltfnhA~do*esh4gVZCx4_eu~d>N$X`@J+% z>c{iZrinFousFM-;k*xPTH&nwL`S*kvy)M4fhkTZkv8`_-uBAs?)G{_-q|7e+oWXv z3dYxC_>}cfg&3mgo>+ZKCB$a8esNQ2oQ=F{pI%IBJtP=op6he9zomTFr#>}%(>0+k zcb{6h*V|_8wuT?5{wiLID^4)vl+3;*5OFJCo8tlThrg>~12XvFLMJ-yDd`i?MgtnU z$WI!Y;UauUK4SYFWi)WbZqpZ((;1P|rTy%AUS237T2ep_%v&W)K$LWI@hiFBH^_67 zueZryB$jP$nDD6g50>;Vk2ol9KW~ zyY>g&mu(vh_ z-=T3w_$pM8`eoKk1dlXg#mJ#)0Qo#2l_f?&w!2CDMp`|J=WYsWxB?@~e!PZ-^QqZ4V*o8TZ9Q zC*IxhIeHD}8I&cD{WfI`PLv(N2X_yhhB7u@-peC}%miHwR1ECEKYh(@6NLy8$JA#< z_i%-Hg%grG@g40X54p1kl*Kyk{JLAmwE9QO*8tZUkfwzXJetRw&t^@XY*k z2C4Fdln7DcX%MqZf7N24R|%PRK@1|2lG}lupOatd=8Uz$pIz2;`HDf7yUcG~3mB6(i+@?-;^DXUCpSB_8FPmXi>?`5T0urP5l%hb zS2XGyo9j@GWTE-K`O9Oj*2_QQwK9FJt_yl_4^22v_9aG>cLE7616-v#S^-VoUT(j2 zm+eHy2dBRplqYwunCZu^!zsc?`Yw`3;>ja(phB*g+SBTJ6Co9@z4}%i1%^jWZjMnF z0@{H-fJQac0-2&v^PNGf*z>>%r-|q8tL#)*gur2w(Ao6b823n94d&?{z_=Or_KhaJ z$mcxCguM?(8T|~GtRDyb#=%VdJEr4*Yq>xvK0Q*s#>b=6w_@$k8@OWkUT&eIu0)F0 zrqxi(jy7A6U+vYbh--Vi&(U)7PDuRn2?W&~{L{`l)(ij5CfbzfF~g_+M+|c#bH&^v z$SSqHa1JCoq-ABELCchc;0r@vW-<(|afd#*_Q+C5TLU zdArD6Qw%LXD|Wg&pe$eg%Fl-43rT~dHi&z6iM=LxF6oHa9|)~kA&!28Lsd+)g+{{Y z<#RXiMj^4+%9)g{W3SmHX3gn8H&gO0e*o!gC8-+0UZo1Hvu}IrtAHK^*3#{DxGf22 zkWdceBO~q~_hp@g?;@?V>7e?f_*AoQ?o^rfb|aOX1BWNH*0`OTg*qWhe0uR1UBSE6-kRQ-(M#Xvvpf_fHJ5hty}gQlgaMI`zgA|Jk|=(V zOeAK>>{vLxzm{As%ch3*H8#_fl(c5mF5w3kg#LNg6jhtdhhfX{=q>)_50{@IJQ-*P z7;i0ZHcI%uAz*i02bG18uFwcSD=QY3nxJTi5WFv@rZ?*9bHZb2u$JNJ{G!Llt06gU z{uWc5clD$w@Og)s=SV`E8`fXG3M#t9w$RlkSwFGq?#8g}(<|5;Lmd3=hd%kcAYDJtIh2D3E;O@X#23bHy?j*i5+-xX zFNoQ)KN4yoyOiSEyuafK-S6WqCCIhpN5EQ3$&B~@3y0~hC5SL<2G0eRzBoqxs3YqR zms7HmzFNF7rLHuOt+M|kYXkQ^-6}ShI4m#ujt`yQ-w~8%e1PHHJ;go>wQGE#%_{bz zhNt6}Z+7a)^_S8WXVR4Ow5)OWr_l=MQWsyb8aO2JMo(Aw+LjH86M1~rt!)eYcrR~| zGm?3TAvS>F`L?>rr41%w_!7pddmJiAO%>1san@nLT~at_V`%mqkJi=xn!%Rp-)CaJ zw&Rl4I?Qz8gq&c+z0bI{jr0Sn`cS&W?j8I=!8^7RvqBh^R}FU~_7ZiCa$nu-p**pG z;L9>$!D+|n!Uc-RTSChjNo`(q*_KI(y*ghuW54gW6PtWw;#}1Do*=vOXn*m&b58`! zduXWd@y}g|PA=1Q8F!gm3T0Jhq%r&)F=Fh}UuTW6hPLO37YZhV9(SE1okv9( z@d-YQkB-h&yh1Pn?U}P}V@#{~hyFuVQ>X0G7+!iSjK^YxmV1 ztiN<{ojL8BiXCfgFQ0l)D9Eo;ZLo6C;m2fGP~Du|LVJ2kZuG;MD{HAV$Fm#N?j=Q1 zLah4QAzYkXV{Sz`nBzk8^GCm0W^}dhF9S&1F?#)z{8vPa<$r8z+e~>RNjoJTBuwH8 zTCA4#i#pBzIxhydnA)0^0~=vKlzJOB8u{ji&QVtWUsnlgXBv63;d8`v7%+)Y*0B}! zJ)9aA^Po2HdBE=F29Jr5T%uJ>KJEN%Vu#UeF#%U^og7DROjyXTId>Y_-;v> zB~&LzN9&vvpm;a3>0!SH@Lp@gtxNMO?tc+d%RO^TYbyn&ji;ZiWljguDkSchJiqa7 z%&|jZy{M{_YdL0MD-gU%Cp>034+ggotNXsW*&L%y2>Cn=JtBu3D2U-!jY=|Fl41Sd z`|mlaeAS#2j_>^-9#y?#H~sQNInQ#e;Gt*xlHH9Nj|gTlE7Q=QxgYj;{xFs7z4MEE zUb6qJk)je9=^eI6b1proNxQ!wr^k5hx|5Sn=<9E(E_-+HxcaK|$SW_0!z0p@i7*@X}a*#P3s8mqxN>TZ!I3V4S?ft5b`6~~8l3$wA#21m`o{TBVF_ne-I z+(lt_+NPqetUik)>aLWp`mu{Ls?ohK$8>7EweO$tU2WLrb!TQMWRK|}N=3w6aB1#m z=elI8&kC^wpP--`{o;|Gf>|_oGER5=IMzp{P|MF+V0Owx&}rRj-*my}pn6tiYXN~L zHf?_+vbx6Drw)aw4~-kJQFPKVKsKBdY%D=ASv8W_T*l9;V%#<9CLcE4(yJogk$8kggXYj>!1S)3j$ zgg*Lcu$$>Z)tqnt2M%H`J%M-wvOj~80&31Qm={t^ zSRD<7j&T`DpX{TEeMI-8BOuvp+gtnXi*L)Cl;JVBF371io|>}tA#U5}4=!&PlHx3A z8vdS^GKzl_s(YciPxOP-V+9wz&Ga8lhc%(!Z3W4WuT4z4oCKspq)Gy3XYM*|*Day9 zn-kllN!tC6+1tBTZwsGE7-gob7?%G@zx#H_V- z`MD#H(z|}jknN?0kx%3qHeIQU`xU(H&8Ri)uIf){9MGyEdAr^y)i$_&A<0W`dh3r_ zk;*@NVixz_E0PGA=11S~ofw@5JH@fx5rNBk-S>9tG`eUSFNPPlxHro83VPGCyd`hc z5!sRQ?l|wj=nEl=M3apzUh`sGvhA$ORGR*Jx~6wbQxqm%GV5@)PH%S5>1}u{hNTaY zv_1Y;!2h(x|M`|@N7|=rhDlb*E>uLAD~{O4gLJ+K<^P5HiGMA!BwjB1nXQ?{Gxhy zm7kZF%7tHhKD|B8n=&H(>dg-Ief;;Wl6$6(=l*t&g=`1ujf4#Lt1YpNQ81<_LKQ4g=L$ zxx31IgpD1oEu0x^6F>7PT|npq!tE$DmW_($zt#a=5k^!XzlF*ln>KTnAQ#ZZKm&A8 zlL#N*Nk^ss!f_9pZw$dne|N)u@AaG=>Y*wPtX+g_3*tJkk{7S85g7%TTHJ~>e^2Gw z*Lxg@SHif~**d_m^{FDJ_=V)hfw^&;J(K+spK>=0ce)7e&y!qrGvo+47k(vWr$76c zykbt8!yM`IkAY~yk4;$oJ39%dK6oy|JiU(BMhM=aK75dvsDa%M2mEBmDW2~@3pc&Ov=`K+dj^4 zcf|{bBVcO+GkW{IH0>AHS5x>6kf&a1e8aFyFe{W_Isbv)UC}~sC)s)Xux@q7J@aP0 zcQ}mtWk}Cxoqc&YRqGq}Ht!HSNg=Xj+DH^7B5h;{v6H9>rA!G$ zDx@-{l*&*$W!#2jOejJqNs%a`OocK=Cqs(wUj4p5zQ4b7UFSMo9m8I0z3Y9S=YHb1xCoyfCmFnS_MrLxE@f`Dk^3mm4HiXwZLxR zp15)%fE&mItP_u5wGd{#bFdBA0w=1|VDl3}YM7CsYW{&B1A~auJ&>pqK@%u{8eYEa zh43#b>M-CC!dsU(QJ|lLtq^`CfJ=NAp+;8$kOO_230@zRdh3DJwNQs{K4Vx47}tlR zi-Yv28EWinjRR462jTpNd7Y`T;Bt+l_cf(aS?_Hger?OF7ti4(hbpsYJfE&m9G~@E zc~+^$l`i#hv+{!_+fAy!HZ`C4SXO?+u|t|tG+X6oxOKMYDJj(D?@!I?L^&d$iAbj_ zKQ-~9NEtx-F3=e<{^WzJBO+4`Z=UAB?wjS}v5Fh++`!&Mh|DysR9-$lU~a_u1bxRB z|8fwFhF))MzB2v=s`kTJL1_P%*|!t(67bm^fh}N!fPhqC^S)`qApt*vP^v-YZ2*ms zYfq&P5&G0i47fqYX-OGc{$7zQwLjZ~JpxFkdq?{WL@&@^ejyeq;p~LUeh77-Gh(TT zaiir=R>Vad5X)*SmnIC_(2e_5!3!M}e(;*FsI+Ljpe!}{`Aj(n`KV0s^S4~LZcO+p zxsT84)kiN&Y_-siCS1{=Zh}ogBuvz5^GDv{t2|Q-w^OY5by|415*P} zK#5ylYSO>!67a%9B}8YCDgOjsNepBE?+66%X-@m*?LOYb>#sRh!Ts%ee>0QRcwv)| zmV?pf&2EV*#xr8Z8{avwyI$bWfB3AvcnygF>LC=uY&sO31LZEz^KMiLkWM&PRM9up`>NXOAH;t+b(HxWO&V zR4ulE8;D`UOR%ZyF^Sj$xiuRRZ%9*6a0HZ2z+I3+wx70;muAH|1vll_xEEL5Pu2CT zf=4`|Fd^a~5IyMxdMP2H#^jLwe8|+I+BsJeX-$NQ!FKCG9kaH??EXk6>nf(XXv{04 z{ib%MIqdvwWH0fzQ398mTuYeW60>8Aqc)cPd~I{!=YqiN7_RvAASJ<5_ipos1jp>H z?1<2V?>N}}#FM~n<>)=B1)~=}0*!?8l*aGy+CJAsM^#(>3Z%UjA9#OA> z)~q9*FPTm*pOwCQ^KM}O2)${TK5Y}arRoHGt(IJy>wfJ~7kZEIlhTtvyLZXTJW&tS z+4okhLG(@S8CB<*Q{Yrkc*7uLy5hA4jv^R;oo?e;DFuBl;tQm-wh=jMTNJ}dga$Ho z&J;D)YrH(WtgM##`1oKV0yevV9*%(9TTgGmme=y7vp$~4(0jbNFwd4cp9C2noeZ)w z8=}uvA(cfD(58%>+>O{+>o4NQo#@%txp25_ z@G1r=D*Sx$WF1^E1u!mqV9fn3wuZ~7ryY?bVnO>RO zHkz-pw);MJI@A;Bw3A^e$}M(w_xSp1t~e+9k-z%S3O{&wK976y;r%1Qvv=(axu)|6 zQ^TvS5*!J-mkMzuOR*M@#30DaJEk?A*kmldu0^+AM@k^i+@_VM*& z1{G(;H_WW`XxO*G_YjQUB^icueDfAzwS}HglpMeQ&GRV z$lO8a87skCX(8AVX4eHvd?;E_DrG%Uv-+m4<=a z6F;T1IRsVZ_Z?cJ)@3ewx~#IID5Pug=f-gTFFiSY9}fsW@Tqw6o9E(oFdx$dd8yJG zraz~qQbz<1-{z$faV~gV`mO53DFmIR!IrrprH5K2^*fT_{XVe!}0Sd-O$;e%@UVg6V0@%2QXUkzj&D#Kb~s|DZ*8x?Zx$zRcUH zSaKN3Jc3awU4LbAJU6I&xbMVltWD_0>zNy*B-V{OeS(VW+$Yo(L|ii=KDQGIcWV3o zIWKQS-)M^zO+b9N>8J1)u-PpPJSE%3$3fQr@@{}}@~sg&4sqhf-V_&iih3XG<>lSe*@=@LZcO6FKlU zz|llyjhD*6__Jf0r59ITvpTV0Wol9#tNhWSNq_Nk?YWZpR5y0f6645Is`EAc+{MwC zdEJ6GKhAI~JCG+fz#1K}WjlzRCc;(;nhaQb-9Y!kKCdnHT<&QP#_71cG#HS81#h7} zrY@Uq6gk)*qJFd~@tdJ9&O;Bdud~~2t{&@2EX;3(I}$-k4`Jh&1w)q*ffAkS_sk@M zDoWK4_XeP6wEN)wk>3Plt*M-9p=-eD7m&%haN16O;m3mihlxB=#EWyM;(vCvZ)#z& zE}zg2_9|&zqett0`q;>wTL1A)&HJ#>SNgplK3WTZ&HS^qpkwn3`N+dB z+c~YnmU&%VJmtZL3f!qG!C%0 zR;>@!6zn+0JhC&Xd2{Q;%(+KUV5k5;|M6k}aUC{KHt_3=*~U5ck)Fr9goS*p9wwZQ zoFU79Gkl@oAbl*L6*U40p6jSNI;t_XUq)924M@vxm@}Edw~3v&1=2T8I3*=KP~psw zbxZnoxcm9o+__Ad$zi5+_uuSW{i#ylF1T;pSj4fD?s99^Kz`+^>(- z$Tr$~&c!d%Y)m+mN8c1@{u0=UAmBVWIJj;8!+>v!n;53@z34fRLoHmZnrh?u;OL>T zhz1=#$;a_hWAq$f~Jt zPqG#aV(45Mzi!rX-{Lh%(_Lq4ZTyv0`5Maa!XR4M)kqc*sX*uu4xg0C*yR6sJ7_ohmr!&ww2zptGpm3yFcqcHh54wJF$@Rzf(+WmuaNW2@LQ^v z!14Tj6LLtOlu#FP)Q{|1QZP~IXv(;qZKIYWmF&Ui8Mqz&q_T*$* zi#}S{qF;V#%qiRJ^Ak0fSFvLC$J+BGAn-bR(jNH4UVFdy!Se;mmqG3&$O;qZ){LdO zi4nr&v=LA1#P5AAiK}BsJIRwJJrn0d1GXqBjhvtj4A3KYk#>`Rmks`=&_+mau~ zv}TA87aUBt2!C@pmZHUqrB!q3Cgtl`vW;>Jv0@Wu11n{uBxk!PX4Yu5{#Rr)9c6eb zeUs^fV^&+yf@2=D4L1-Q;U$Qih@c$9+9N1LN_(EBxN5#ywDbA2d_+Bc~b8_WoEqpXtc!bOJR?>Cyz{*TdrG^VK6n6Y)msUq3vSJd(+S`x4pHP zPOa0{+tusayOnAn`a|IDvRMgLGjfZVBdh|91};Rdc&A-?J>n$)Jga%Yx24EsCmIBp zZjcD>L}DV5UYmCM%$RPJzP{Z*V82iz#+g-IN&U}Nh@DpWz`gl6F@cFU2nlaHpjB<* z^W@8^bImz>MU@*=FfI7n{!|vnCpL9l_(^pJJ7fw zWyJS+uFdG$(od5w*N0VXGK$LG7MLIOV`jmR$EbZW=wsRj4F6+eL7;L3^ZyUJ%*q^bUl~cX=?KQlr_J+--bF!aqVV_RycLUu0P_+ zR6A}{Vk>wnK_@Y1{gaJj$rs!YHD8m1Ukeligaf(6sZZxK+>mL_1@Ofn(@;1fTxd5o zF`14H9f}Pm&WX>u`=v}K1rA&d5}bOXynDa#se!$PC+(?{nF2&oYzL#;B0q97ZThf7 z@c6N2)<|Cs=UXw=Wwv*tmE0v8nO&m?-*wxR2aV|(g&04$?Pk}fLN=3X>N73VUajyn z7$5Q;m#@g@+a=Sz2=m;0Cgvtn1{|C&YUSG`XY z@AZ6dy=EeknyZ>}Ux*|s5F378I6`}}+j~#LSEt>T0Vdy?cyxn39ces~ZI7y|Adduu z)#9f!Y?_2HoF46TAbFA2@HK(+Up*@$lulYwLsgIV-b1VArSycX$jUF35c>&yVFL)| zV9=*F?I@Yaixn#EdIOK9Z|(U>LajTJ>#S2O)t3|sdYCV-D_`3GdB@Vr#s1n-`(}F| z=+Xk!gUC#7X2x!)P9gfckh3?}H>#}UP(sqL>QsTA^%iQ6%D(L0%aT>ET~S=~ESO#Q zEq_8m4V#irx|J2b=Bz{HV*Uw&?Gu(hmFQXHl z{aGp9FaGygL?P=fbTaa@Gj6dI%(UpU#vQ76towHr**6dU}ROb5jaIVe+kD*v@fS5yH75~~W`bMknCxM8iP*LrnCemi>?DBJNU zMwcG{TX}&ztw>vY;=DudkFq^sTLz}cCFXw%)+2>dMd z`b?o00J|m_fL`Ten+Ov!6gU9%9=;m(``-*O>d5PFnYHwN8Pf^DHD6WxkAtV*0k3}& zA)zA3&j8#A$|p4SS%DQ1m&6A5Cs(_W?Vnn-Ts6_}gB_qo?>8Flmavxs z;?G+RA71dyuY|u=5Q`|nd^)V3^M%TX81RP?e)j^c3x)?A(EHJ3k@ajBJ?$P@`j4O? z9JTzGZKiZY?RKDc9uG)p{k{LbDrz~W zc`H3+XS-jy`kjl$E#3`mQ4wqSGh3G+m{Ch8GoS`oND5-qDK&lG&cVTilGDPx6(G1V z4Ye4nz$0E#F~bcvPbgP8ElZr3>(YJLrC71Bq(ZHiWtBI~$-l>|RJ*ayyZBr8({j(& zjA(L1ZS+;yF|ddcEgKSLl*=cZAy4rSG79TIJaD*jA&eq)YgM_5w)VVPetTCxI;Qx{ zMBi7-tn?a-EPgXH{et{uGwQc6Ub*fe*Q&OOr}d{Bw*UI})Vs(Rt)URPZOMYJiL8Bx)#)B|{hrb*Gb(%Kcr5~+Ep2R$n9}^Ji}Ka* znP8>y7DYr&)xxj!L_o*qw#+n3b)K#8k)N9Kl^8COvfv(V&UIsU6)E34Jt$fa@_B3B zQNMmERvX^u6w8K_uGUmIFLPl@5_kP0P-fcz(B-g;zz{3CKfY`mhd-r<0DBw}o4!(6Dx zv;U`?5Q>MRfAZ&iTe3$sP;0j$(IR6qN3+eiDG``Pa2g`C^_iru# zw`$`NvuIoSq-J@zO$Au@C;bVoA{+Z$PIsOKNUs z*IcRqpUp?ZSLXN%=kLuv7(K3G=na7+rT{S;ElBsENAlgSF^4UH7k+HlRuq0C{L3cWQvDF5 zyLmR-SEQKw`(sJA`V!~h5^N_HR<4Ez7iLx&O8hx3rABY#6Nz+Z5U{LEW(jy}@%;)1W+-k!p zi^BAD4whb}i(M0FqkpABHR}g_bD6467hwAB6hc_JS`dz;?FC{7p|1Hhb@x;^P2QZD z&PJw=lU}s>sW41=VmM#NFs^=39}A=ntgKeT>#jS7X;-P|v+{-CBfl^$bH{k7_<`<= z;ATTPLOg%NpjeO1r4 zoHKits4kUKQu0tp77bsvfSIQbJ{-^+<&Ii`E{Qv{v-qTvy_28Dw zcTrE*`(g8t_Aau|I#oBcj#u$Ote`op;#>{Z>7oN@j{6~jk{tgz$36FVfrnTQgrDR0 zpL3G&jLOyg-1u~TXdE`4R|M?9`D2BM$cv*cE0<3)+w&x7^`%z3w=q_<%CIYq5ulPTUk8$lncldE}%$nC;MD> zV}1uBQx?M*BvU&{>-nf!#47j<9MkM?h(^ zB*3MYb=FZsRY_h*ES1nRox4Oy-K=-|^jtJOvMXfQ`Q}i{wYk8`9&4UQJ^A+#SEjOx{|VOUUfO_kH7(SZ*9S6_$w-z_(K?6DZ$h)sbwpy!K90bCCyy7Kng!!SyRS)@Jc`!cP8%C1Q zBdf8^vUdR5knE6Stsa}1KNrhbAYHldHFT2^91k9vjs2zvX6?VERJW50KTOOV9GRI< zg6Zne>8_B_|VdLCNTEVBkz$Irfda{&n{3Xx$<^* zKk(C7*fu%7hj8(8|z)_#I1WE?NaE95JGu1j_+n zUzTdlwwvNF;~5TIn&%VPaN=55SESk{4}u9f*f>D>?V?pP`%H zULR`9cq+cr)Xipp#kQTa2o9V#Re>OyALFl8;OAu54x>y4S1qc9z`kV|!yWEwK%H^7 z6q#ITtD}xYWw@2@kN-7+y>t<^#Zy5|R&1?u;}cWU@7S=cGjFtoQD}@;BGpwPcg`mS z>h^T$Ipgb`{r#tVG|V@ex0*fNxx?7S#Kdn2tSofNkRU--Solbf$0Jf*-KV z4ZTVo@0{i#aXHo~`G7Jj@G-y~zWcjQm&8tmBmH=D%zg&LH=N=u`6CH$od$mXL3w%k zgL@Ag2)x!a(c=(gb}hEZ1zr`r)In2P{%h<#%jkiJn1cb0MMa^MW>P-BMQ2^8?IRSB zP1ORu--+$C6RAFN$%@R?8n1IK)prA~Dp?gisnlyuHPEhJ$Ev`uI7%z9FrB00e;J$F zv29fh?Rbb~9}@dcp7m$_52apVYTYohRfHOg0ASRQDnh`LMhdv`(p#CCp(D!*Ow$VA z!%hr;Nwum#%Ql|hkZj~h*Q+tVk(X-2OTBkO>+bfdo~j+>$;D90ifVjy71oRfo}7}@otLV=RB0@6TW-qA zm8X37EZU%4c%CwuQ1yq^WWe=npwGV8)hg|V_$Q2+qlae(?;PJT{~5$;o=^373EVyJ zX!@ky(mv%C?U!Hq+x_le5RZc63bwb5TGdwY8g3kb=i*HmoC`tLkn64O5-m062(y5SA9D=OjjYW7bbghE0 z=iAlU2!4V<4>B{Rfc1;Oeq0UqP=?S^(Gi%je`(I~{<=$79aR-bII3Myq0W`}{8iDa z|BXoQ2AFapp2n3r};8l5TB9dV_fd@qCOG&BpZeTfQ8{RY6it;gB+2xgN( z3xDQPptS`EohcrkGV;VibyYE*ZVjx=t19}Vluqhx=I6kBhA8RR^7jJhODF!7?60Zv|K8(xp5yubaNqZJeXs9%o}cx-qaJ7~6JMsij6$J^RqiY3pio$|@UH{`9{l9l zk2}NgA3~S=hVCd74H@z;R^QEi85D{MrJ^9G>z(;4%g37%{jGi*^INm<^$-I=7<=gx zep#jndgd#ktV;{L8dH>}o=L|ZE;p33T$Sh#(8>X1J!CXEH*Ck`NM~Oul19*55{BIl z<{|WBQsHPpXKlw9*ozYpkcYQ5R>bs|V;&Z2W3nO zr1Hia*7xCe?@}r^nlyEFDeunv3;z81^T=OX7u_$JcMGcjy8}U&>B~+>iPxCJ8tKnZ3LCPugN{BRf5JwiR(83ZS+lA9t(}qZ zqQKwqRFZj`z=5>)4ho+HQuwa7mY9wfsZAc(duEZKH%aDGklS81ubQy7inxDWE%r*g zz_|m@-OFbG$UjxwWJXhVU2(rgMyCCAT3zE{v*{%Uvqq`DlvcjE-t@A|oPSebg5^<} z9#<1`$;DLma~){P@cew1Pba^dRn5KkmQ^Oo9=#Y|6TJQT@tx1zadccSkJ76fzA zRNQHIowI%7(#wnOXg4P-Y$nT1iZIdTn`@M+_Z*3z2>02icXQ3^KfURwf(0T*Y7r)S$iYo8NXW$*tAZGS90 zx&OVzZ@Sj*wPC@A>)Qddi+}p2L1&)sIg4M*H$I4LJU}OJw_ao`#!xRF_zwC_HMp|+ z9sb5GnqcTODc|(1vyd4-sz%m!L%Qx(Lj+y@qk5-z@7}#iO|>z4d2+bT!OR?Tdg}i$ z?eN$1z0m><6%7sCHv2mBI-@EBp5zX-Z;m3c8INZw@5j}KqWV*Aztzf-F2eNvJJ{ql zY+U?pZZYE`LqkQi`$d_N?D}=WFojX4`ivQ`<~hmv%E-9C*PkXYwft{KFxz`xp^*=@ zs+qp8p8BZ#%pR27r`tAiQWCA@fIsBfE(W6+jX zR#?n2M=Pmj*2|w0-W3$&+tE_oRA=Jgz%Lo^Tkd`R#WU*#gKuPJ<_)KYMZ8iyZhR7k z<(9+m7I2U7V%JHNXJlk#?S0AIT%4S3KRv3=yDtCu@uOjXNWyNesgCP2a#IPqD;y7B zyrh@VdGG)gR{AJd?m3?8pLK0`v@d&>@`{Qg|8C7(+G)pUtPHvc%=X_?VesFP`*i-# z;e0>m0=3{GI`t_)LOLhD%A)7Tf$wpT%=r_e%FT%~R%z*Mhw{dV^Rts0n_-6Nm>75* z>rF%DCe56DeE9O%AK|AjZ-~jixJti1Q_pwx#q-%&W8Z^~a0~|Lx!eb*IaMPg+Glf~ zG-@e4Po}G_P|ysd&yOtNTDyz1-#(xW|2bNypU!j>DN+@*y@?BPjF6z<>*(mqFBzoz z+MnaQif4KJ{EFK=_rDM2;rVZE|4Y6iQ5b2dQC+n4V0zWFZBu_~#)O0f$Jqw5V0fW` zfWS3z56-QbdYeD%Uv5bIPf`96c9PL88#4*hi9&f72M4anVx1pKO3YFLdQ^I}wAj4PiD2Q!Ga&pZV}q<^KI#?YBxd#N2R9CVPj6ZRS4(5HLr^#}}%l@}gD~nFyku zoc%i(bfA|B%)Equm6VFA3wF(*l>!vdd$ZQSWaE$M)C*Z#ouq{95d$w>VT;5r^I{>p zK4klgWDGjKU0!?gUnH3xa~Lfh9k*tVbXmRqxN6Y9pM}p+OFi-W;iS<$OJvTiXMcwU zx=usz86HS6#EW}wj6EK=aQ?WfR2KlPZDX0^dZ+Mzl`t`QOq!BzYNU^p8VaJStE;?T-|S6X_dWZbAYuyB;{!R^Y3c9Prt ziKqVlu!F}H23FkW-gEXv>6-<3E_O`>L9;4xZaJ9ni8;t{{#1Nvyl+0>a89IRQi3{d z+pGCd@_6}mpZl;BN9zDvVo6et<(0|Gzv9n+s|N;37i#5*;MT(f&Xf*FhkhvT^@~8( z(vt1$BCr&i&D(=V@T8&%o3t1ERyywH&*`yS6PDbim$n?`2sh zC#Tx}72l2(w}4HzM(PIRa&4RFhA`5}OYlEwUJ%oHNwxj?Im*{CKcw%t-MlT0`*^DI z$#Y}g$x#$^IiU)Uuu7~$tlKEK4rZG%6*hhT6sYjk3TTzaeH08_8$F~9SbaY|p!NP7 zE2ell^Fi38)2lfPM$qf5tfx&5uxr(fjM5vu>J4kGJ$}z#f6*B-zg=k2^HRuRA{JI| zw8ih4Q}dRHBm>FH$_kX=bJ!T8QjYaAP|Kn>u73Uc73%E2%>x}%)1kP#-|r*+9#&0E z?9ID(Y&tqRqOL!1?Ck7>9H&SL;otC=e?7r1sz__T2HG{>mzyhSecml_?*X6%>wOGdItu^gf*IRk8bku zZJ&5rzACSTdHyincUv4k z)_Li8mFc;>lj))xcny^FzgzT^Z?{LK<|aKicTJdDuyZsM%-p0XbUf zLMrZ!#tFgLxtx83%whPCk9HP`g*E6fc1EnJ{mB&=jNiXMKUa8DH@)N;vJG;x@;Mn5 z6&1@4y(JG(&x1K&Li`&afFg)zkoxxf@T4pDy5Q+s<@lF-$Nru5PIKSBuDF%CG|%N= z7lxA-4%PM;>F6X9887W0Uq-#i=e!l%zoL5S_qPUDivajI8ag_Or%*itNpBR~k{@h_ z(rGrJ#%mn`o#cM=@-|#LYV6aiqbzZn^eDAASz}GFlTuL~#np@HNG*x4v_9dAj_)zl z?D=!=;alIoLCfvE42v;%u3fE}0q>Que&F!nXSeQF38(a2Ora&*8|W$n;NJX{Vy``+ zyYpDqWvocMn}20MCXAG~ZU1EcB5)K2m6%By_N*I}f?8%^J@9!ZU)zG^;<4}M6% z-}v#PB>ogWQBpkz)Q&ke!{~u5I*iKB)Detp0oA>k_s^?o1<^S(gwZ5>Erq zAW`Au3L`V`>GZ$)RKxC3Zbwz=<$fRBhdl=|hu(SX;*Ud!CA4-I^DhahMxk$O(|e-P z>B>q|=|qbQvDwCX1hR7bsTS`4E#8)(C6r{$n&LSvU=0yKF^4tTkKYPBnVC1@(9FCh z`7lI|RMZo8e|dDiF}^yL{2yG$HW&F&I^2&-Ud?9o(*EAH1$O-*t1y*wd|STD6k)_I zUb2= zT)wFid^0SPGLMfg`4!Wpqu__K4+!#_=Y9t@8uQBBnO$*fC$Rc8RYk@S zubjyh-?OA00xif^J`yMQ$AEBFo4=y=C%?nFXUPD*OnZmXED4#59G+bID~`O&80wYr zNJZkg6AdZ4I}OUW+}DQ2rDv)hjE6Oyb_TTw{^_0%oNZ(LvffAENhM#W%#q?N#W7Kw z63I3+kV_*AWrg(seW0c>dj3FH_s=2BtfK^|xd|HiSlF%e@{vpzXMTEEFEE%HAq{T4 z%d<|0zY`(##9QB*#tU-m73x1T-ue7Od?}dx^c1aoMZxPGuHYlok-~tHFg0%r+K?f1NK?Xv&+;mI~ioUD4_F3R-r+nFs>QS<*Iy){M? zflP8+4`mi#p%?#y$s*-QFur}t*-rcnOJBoG-;>^9e11*P+Nds2Q9JNX>(=oHL!eqt z4rnx=4>tDFzpH-h38IeTm?G3|1FSncF%mDOjUNP*ttEH!b@P$vtX#iBH>PyD8MrB};*vz(JF!t#M^tk^eaXsvV3CbZKsTJD3Fw^!B-mCTz5B1sE;XDZeb2a?V z(qxiqAq%(}p9D1aL7Q^I9mzXiR@}Dm^ez#FaMsVX46V3H;eY($)@TldihqavL8aS@ zYVxafHK^e-j>+=O~S7LCT85?Xhi$$Fao$^7)Wu)o$8wtBb(-a$A`rC z#L?OKEXCa&umG0x%A7mF7}q!{eDm;Ry2+CpdWS4Q$mmZtR@UcfY1ahZHPOrhfqaJ5 zVSw5ru3XnCQ*SsbGpGs$qzJwJbqu-iTPfw2H=Y2-N=i+A%XwKNL*zY-RT|61h?v7J zqwkBJ^2GKQJQ;h86pT`ou3b&^6&Gh1qNaM}PG~H*UJ%V5KQ65*i#q)7w~b$6f_CI9 zxD9x=Z$VkH;SSH)sazb#>E9)q?IPiNAE9jIZh3ji_`+W!(=8MeJh?JOsU1yCEe zXmwSXN0S)`D$oirI?DRT;SSqQw@<{$bc5cw18w;>6}R4m9DXnLlqEP&Pt zzaU{;jpE3Dy!EZ_3a!w3scRIL;19~j-NGU`T(esz9YlO-dY0a&OPDRu$-0j4A^WtyFXUI^ONV=+FFg*mXVvA+pWflPLt)j6>{WbRpwUn zZMYoLBZg^ce^gI9T4Q4oydOV-$3FGpDIEsmc6KniA7ggfAvtVb<+A*l?0ewJQ>a{r z%ijUB?i~9!81sJjULyYYcS{X~B=60#dfPAgxcFCZJcdvA*cgkF*#1aSIBLih((=Sm z#O`Yt!Y)0;xeech$f9zFl|dmwI2!Qiqq9K0GNZ1KKKnbqEe2(JPE9{=`X2s{E8jeY z>Dmpf*L6wB+`>XdUET6{Zv_V%D{wz!-erIAt~;>Y#Kgpg-EKN8SUY^=@gPL|-Mh~? z2XzB!{1!>@=(U=N;eN9g^5@T^^DA8zOZE0L=o0W8&f>RMh@FJiG=h43#PB8Vcos@KL}9?HF{) z(Z9`#kO!r6Wsm9w0#Cj1NEp<8e8dn`*CjIBH0DVk-*Zn<5qE!Wm;*?{*qCm9em)Q; zf_Ry8QQ&z?Z{wwZoNTu$qtRYl-@4!$kR?S(=(FwbK!d{pAT#)`GnY6276+|h-hV&t z7^~X%z+RFe{`zY}qlP*)6N(vlGlO%i`vC3hs;^Gk*QH}m)Yxdv>nc{bMt)iC0jHIyZBDNkKK;*s8@C*IW?_cb-I zq7ab@>JbH$H4NbdiHY*Y#y4QyyB1y2)~>F6gc=M(gAoO5U;_KI3JUs7!Y{+u1?tyN2@5vM9;^JbYU_vh8 z=W||ef4o!5>)IRcj?g`Zc#dxSx|EL>=O?MU-rFsQramk8PQuk9zKr>oXj4;oaN<4&6T-3HYK zc=DUWTRpCP**%Ow#y*STGzx}>hO8Q+*_ZL2lVGi|D#cccXK5-H zQVMdw7{ar#c1G@z7{YU@*!te`sBUI!;|;&pT$*rZMutOFY^-j8G$SD)VS5w>M>NcK z49H2;8G{jn)}x4m7jSyCOKmbK=JhM>DIm1(K+ax-P%gy7kgU?v)m`uq-}RQn%sEZo z)XFZ6yCL?KngE9uCVgg7(()T1YE-QSMxZ~f=Hu$4(GSz0Y6tTbW2UODh+xyRvap0c za%v0*^=Z<(oLRcJx3|`LKAS}5l$06g65bWmo#&>yx6LS^4D&%Q6tW+StgRJl^4f}? zbGqB3(P?u-Sy}mYa;qshX(|+(Q=%|x1Db>`s*vRb|SoV-irv7K>9MfVo8N(rB!OrKOQ6 zTJ~mm|MPo}?nP%i z6jbBSf{f37eVC*%`ds)WqE1-a*knZgM5DW)+k{>tz!{h)?R!W^5Jq0bcJpR+;F)h< zU*7=#B(jmm#>P}TY}NN}@$pp%eJa7+f+8t3X@&>doi6Mk>b;X|r>OswPxkdqjib~3 z;Wu!zSrX3*945;>w!R?}M77hLIMO^(<8Pf+0wsZ;uvx6(WH}w39Hi6-eK<;h$2M=npz`0oZG_HlH?EWsjAzl{JxH2UDE;^9$iNA=yMlepG#nw-Eez8i-v znAfB!jc?&KhZdj<3Q)u&FqnZHnH&=7qhNr>*P7>?J~RTvP*7BSLv7bUDh;Cmk-Ojp z$S?%?L&Myhg_JfYE-DJ^eDm^fU!OS)8%jz_7~S|`DH5L0p`o!RCMSDNpqLUFm8S%_ zaVv{3n9U{zVtVJ(Ho za7Vl8XeYH*KIsGsSb$xDJrhjUR9=Dm8(Wh*THw2Vof9z*_EKn_qH;LrJcv3y>0s z7y%HyudH+lBh9}6vU0xa*4P(DIs+`H3TTQ}a_<^@Vo8jVekg`T?;%cc`c$nQ#qCEQ z-l0qM#=D({!^<~eEAT&VLm>bWNI;sXD+`zvYeN#-rIaO&H#_c$XFES~Xp(vR5)`Dx z!xIp*Np{TgQpc|HeLBj&3Q`G|EbLyn#{QL!vdt#CNc_Jj21V^mC=T2O&qm|UU_A_G zXkc(qgG%1Nh*R~EqW0xra%P1wd`5qljxDbXasv`|8TXe7QlAwjJ&E$(5oTA;Es{)$ z4slm}WFdIJ{1C$+D9M8;w2S#QxYw^OB`vb(zFv>mCRzLDQ1Mw_l#1Ho_URMEk^Z|~G@hybP8v=(=pKtW6$hM%pn;JY)3~& z;U}qMv{dquSL7|;Yh9Y!`fDhiQ&Cr7r-juM5>H6T*w#9fbVk}{UGwzs$r&HkQW&Xn zh)-Lf`~{!oMpHK7FMagE3Owy?c!*1$Cao%jD<99g&8sr6;yrhuR1~9}D43I77;vV` z+g&b~rCHFfpLx1G8bH>7o;(;0(a#YzyaKC0Gs|cZ)EKBsEx^O4VmEKDWdfG`nba$O3 zo!|$4SWpxmCFB2OFc|4yUd@F8ptUnBY{Ph=i~V58lfp--=yNh)jlB~Ng{OxezkqAH z5a??JxuY24TR(1pwl+NK02{IT2UG_ozy~sDGUW0EWLNOQm%rw1Hj&Clf?#|M)P@)M zvTiWIL?z>m*5sVT&7f9Q+@r3e6*}ir_fOaE1Rk%UTF)KY4O{MjSfPjd4V=p8BHj0R zC6y`|+>$qp?{fnG{UkB%0m8oM))?sQNCHYiV$hf>TVnsEV}Vy=DqvMhTlFPzVYd-% z9nH+2e^8S9xR&jQ*^W$JPoIy}nn>_X1u1X3T6cta&wG zoY%LWX&}yyfcxrz>hG5q$2k`XOGMVQEyYl3!uJBmYv))NPrK8!WrVy~=38*8z?qk8EEI z*t#2%W~VLM%WB^i4zyZty4fn-!0R{o|FQr;5vfAZ=<&yQu2~MI3j>HwlVxJMU8)v~ z!Tg$Se8^h+p8|flcSYwUpB0^4wI?cM1WVfQrj*OXYs8Mf`UEhc9y1QGg~9huF>F^% zCd;(7wUbg(#IgLP=c!JpgccI0z7QnD<|h&4DHE7nN?Jc(O6@VyRjclz_Sq?+5kCp4 zWI--Ewh9kB1owedN8)ng+vJp#o7fImK)*2WUzcoN`L~4Ee|oW%Pssc&_^8i522*$} z)h^q`l_&dBm}R4Ol~0Cp$Hy0IKHltBlK#o9Jra<*##Bn3>irhpJB2OJO765>+SsgU zHMPh_2g{r;lGv-LL@7qP_XK^K<&?T3*Ld(f^;gcvZw{To^S6&l^Wumke(678Aq@%Q z@x8rv^5kN_p=CX*xeH92N6(xdxJ~D7ic9Bc0aWl@C@#!S47!)77J2{rtJDph&;(7!(}v-fOt?BxtsTOp;;A{a6-7eK)SkPsghnZaS*;upx=rDd`$Co3d~*7~YR!4-#E0 zqKBu+NcBu6qj(L+k5ac~F5XLfq~+)K)4W?&e#@zfx{swKeK7WLehwJv2GGjQ4Q0%` zmn@U0@h1qQUs1o@pa-D6Q8&J$l>o=aL+O+?{J|z>dM(&D#_QD}D(U z#oFb1@9;hN1yBkgr`1;d)CWNLq2*x0vv{qcS!@6dg0Pi^hRzUuO{sgV8)SwExWL%YrsZjmY7_7@o zO%C2vqL?n7LhBv1a`kr$rgG~|njRiP2!(N&dmtbakWZYwNs=^dn# zpn-vX*gH7bWnMMbQu!(x+w&JLq&oQd`TY;Z^-GN#tJ8C{!KZ|*0BAV~x8%@Ov1c@y z1Y7O&_p{a|h-ZGGWVC4U))3zDR%SRRapSWl)*Vz z$J(rov#&z^!db#(M}@?^4g_H(s-_*+{@lFQ6T8N8Y&RlATrz&^;x~ILy^c%8; zJMFVt6QEK$?(@v%Qmu? z%iobJMYqDHnI$Clz7c3bzDJ(((;wK$dr4St!|OWA zQup@U1nbLpLl1mgj?T_iPq0H!rWJ>od>cQ0m{ao_-v{atM@ZGNi76^7`l4E{>P@GM zR@A2SFj3Z~yviW?ITV*@M5t_t-KD{xv6>=|?pYwYlJp4pv1V!-p_V1Xa` ze<~^0Vo&^r+#79#trXPsK(-VeK}*A;f>}$Aa-44hjdwk+bxaER*b=YeHsy zU0q!WxdlJ|5+tc^h06)`wLronmRU&M8g%I5;zQsikUT()>&@xrXM7;M zya%@&9Av!b$zeT3!?q>bhsO;De9vP23_p7FgX5x}AySqoD}6ZY4rGS%$k`0^vl_+@ znZ)Sm=$(@@6j)9>%dfT4*Z#rsFxoB#7}q(!rvp|W%3Umf6e9+V2My)POqOcAWCppc8f9Ea+mlVSb6e$T47xd~hx z4+jOms=UlxX~1J`Y>Pz9(htDJ1v_2V)YSC-wJr#F6%}#9dy8ZcqtP1t{2Mh!W$?y= zC0~=5Zyp@`BND-TwbW_|eF&xn9SMs3`{Hd)9n&>14H|+GB1ZzW4Sw)7yobRr_V--# zr91`V#fi#sdqp%FWcRvH;pryhpty$J=uFmS@pmi-+uCueG6ePlIXU@MqdNy=t8R#U zM9wuo8~qgEclCy7FeGR|m_i{xwdzlC{rATX>hve1T}a6_GX|AFAV%^?AazLx{2Te` z;~v`1q*sy*a`1!JzyPRJU?L!QMIRk`qxSapcDyA$HYbRKfkZt7)&*{8nxM^9*Z@4B zg9BF=aGbjH@WEZ@?*ot|ii(SS4)DO z(3~Jt0Vyn?_gU-AJtQxsR=q|AS=>=6Flfr%4eg7ziyzF3O9HKiAn;58@G$s06W!5`Bn7nJ9 zFh;u=av&%m03QvDg!L*XN6X7g1m4dAkc#YQ&rJ_;yV(YQxWA8(oB|bp6oMlNodRt$ z_?4m`kP#$@1PLC5SV0Mc8=38?rTF=v=`KIui^!aVK;L92sUI&Hk$Kc(0NRq@tRqYQ4oxcW(hOTbf z6vtqG?0Pqx{hgVvu^}nZufQwv2!eVlsH`LfZL()+ajSm5AU7BFqVq|hHzYntuU}Vz zRTQ)ycnnJqx3GVHvh5CWG1TAf`S_Ww?xkIqodr1v#VCNJO-v^O;JgNcF8k?UJCcpd zpy%m!x}1n*Y3e+DI1L(gQ~5(39eKFGb;wsVKikGb-WIYGS3n@L$q7(`H-TCuf!xrK z)eL9rpI_fYlu8%fJTzo109*=?%h<71ry=H0pAD1);7I6 zSMK>WF*i2QMVL?-cb)MX%yDSse}JnY2+^*tOfh%Vt@n z>vWN)s=)nV+^uH&{mu(G`HKRT08($zW#V7yga;`l7?*A*TlM=T zW@pjAemMdb37gzZo+w+!C^aRqj}z3(!krnm21-GN%WG583fam!I`RN0&&$mXhPs6c zLy5X9pg@*gNKj^ACMAFn5#U?!5ug%5m=&`7ii3jT4xAQAmXOl&Ne28A0xOgm?v|2@ z%JtV2KRih-h@o(6e8d_cM9UN0x^-*BlRjtIhG9}D4mdHbh$8{=u~691&qmz@znS|R zUwi$$oGn(m34|384$s?QQn-j`ttu<3s1S}8Y9TT?KnZspy2qN{d%i6NYqFD`?mBva zXbkJ@salV^_>j#EHIJ8DS@{Y&&VKX!*-)nXI4rc?v}(C8Bvpryy6sQpvw^z(uczmA zW@apDXjm8yly+?SrjYaZ8w7?~Z{EC#rMp{h1WvQRbdDG^zWnb2KqyR>CSIUOf#?X2 z+jg{o80y9vQhh>Cza>4sa~~$pFhH~MiSJ4vc=Zsg-6AD`DBwVqp+zeOWBsUugVaRj z+Urgjn6QecAeb%#I=^}CO1i}&W6&voPdwuqG=obE(>6I}W5W>=)3RuEO%C`${W2HF zT6(1hP)y8%f)oTA=5&(YcUr-dE2&d?xu{xhU0!-O_MIL<5c34=326DN!#P?Yxd)G^ z)qwaika0JDYRUjoVK}ne-&>G}Zx(pW4usMissRxJWIxCGz+(f5*ahj7p2D2KKJW>U z#2%81gTNyqJ0l&k!b}D>$mgLUYgjVB+i7ufs}(kpgy26U@C$ zO$0svJt%%C&+piR-yn_{08uj9hsH~gP~G}41Ly)q7itG7?VyX3dH>Vh9_SMZpy&t6 zdj6h$18bJTV;Bn826Gs!f$zUKf?)If*M@^*Eqb2` z0@~4(#=VC8vq2D#r3c4`U0nQ|Mf8U3XB`H9 za~!C6;JxV%mf@tvep_|0nB$c9O2(r}LxGtf-qI47Vg@|13{vT^$YeA$5IypiWO%6F z=8heeuLz4RX^20IhqA@<$UI?9Gt_j(aO6QP(mD-zMzR4&=-W#t77*nZZX^U2lEcPjZVK|V4Rq0N2kzM-F zAK@2DWda+d^5DkxTw$)DUDHR8+glNr=n`oEl+69=b#%Zaq{1yCGV!q`Ap` zcx||?ZJo&C!!vKvgym&R)V>&955(=K*JSIY>mh-?K}14xor=opWeMGIMSiI+h5 zz|7lha%>*GeQex=VIY~;KX_YQ(E7Y-ww}DV3mAhAt8j~d2}4D(`uIh5$;%pg34MB- zlC>A6KV(+_c_!B!m}#6075?gyZ00U=W``)d6N#S62AjToXmCH-bOm|uN*vTrUEj3v z7d-UsOzy#~6N}@#w)3@(3jy~KAudTPIr}=6fwQR2dD>+g0kNlk3RWyUs zcwM-&=jP^y!6HeW*r~LG+h}%)*|6S4*Pkzqn+g@ zXirH_Ufe&foOXn*po_Lz8_J@jrv3_Vm4)3wJh*{JcPI~tB z_jBVOL`Fr4Rm7)3&wKOb)6mWG^n%4*@5tC#pt<>aJhPAQMD{H4UwWaStPEjgAGzOK znBm=?4{9upnFu-;?l4Oakqw3r?H*v3^kZ!az-M#M<~1PN3i)9qAN=cET?|-R$%Waz z(ST6W9ArCfr04{bgf&X6aj!4ZYC$4;a`QdJRjvQ#HCg_o-IDa)VFG323XHnXpYOvR zAinh98RxtGKbuUs;wzbTU>x;0)xUo8#;!n8=wBPbO*d%8Fzv;Z;u$pb^d`hkYB%Z@ zS{GS54V%4gBZ&$~bFNlbE_S{cEq=%WO>LMYC_DJgScmtj(ut4;D;HPqfc6#LzTy%) zT970(rOcvmVD{N3xa4I*CIj(QLHUQKgWxO>jN8D=ten|`3GZQ22$&r4?Ezd28y^}{ zv0ioamiN2VICg#<0lc?Tllocd;NS|w{HEY>R~AH(DdeUT$1Gakk}LfMN{^~ z;6BU@9@CH4Qu`HQzF`3r<6vdI)TT}g&;=Ut^2!R><|JT$fr-8V4RIB~IcT^pF!?Az zzXmi4y_{WGI2qh3ZDV6~fZSQ)p5}loc#LWZ;(IzF39SM@oSvSx&e-^>Hf>u%rk<}~ zVG884Ye2%G&IqK~xa%a1aEhYVX^ytdLoP?sClQ#H0Jt6I=H{gGm5?e3BlXz+o&}$Q zPzB&e290j)Ab=oy>N!5iS9q3!#)ajZrKTu0pl$*^3IdN8(Vekwu-z!Uu1 zD0l-`2zkR+f}Nv0=?U+@KG%E~UV`_yJrws{VPOrJoRo@ra8aw<&%XP-fCdO>4ImtU zXKon@ExZ%S%A}N#$QbwgR|*VCy`k=aLULY?w4i6lDYH)-f`Q?p%ZeGU;U9kc*kF zbD&`i_>fS`y=M19BdGbx<9iA zkuBv{?J&s;j}SfQDRElK+ zCGLeHyACHsP)OV#9`h5ZA7mY15fRgGf4jK6rzOSM1Q^_yIHH&*Cu;+916N7R4ztma zzdLg+^%S@uBqWdyv^rI)owHc3siML^92XZSY|~BK`!zs1$H&wpQ`7=P&=m~e6dE|rt2}Ev zhM&8=#-)WfAQ1LncQyzb6z|~1d?2E+4lovK zoErs^uL_^pv^+=SNm%s`$LHhrD`1CO!6buc_@&xP&Hc)?jcojTZl0`X{BVmd`|qK< zLY{0NIViRP4V>gwvIv7}{ZYpSbX$q70a1K3w< zKOT*+19+P~7~cHwR_<3O;f&IR1&lD0CXdC}TGITtRR{3@Dm_l?6 zA$8FGkmEx+!}=BY53#RSzwZy;!!>YmSSH3upRjYAlI&d~~AP%n7uNNFPz7(@y7%M23JJnf&+k6a6%0UtO%!08oLt%-xsP#&CWLEGW6Bcqehf6 z&{>C!q@kWbt7unOv#ps%;(Hn)*QI=gKowhq6UK1lXaoXmz)fzg z{1+D)$s{N^TG|S*-b@|R$*ab#sr3+dZziAGvp#VzrI%!gK|T`XexlN4SxrGCf#V$ zA!>OIQ6uV0^CQ6B{^%m7JI}4=%j52j;*36d+5f2C7J1W|=3}(xp5oSA@7FTN@p2&(GH? zP*6}b!jt3T=Ds&71V{dYM_Q05ugF|2218DO110t6*Yqe41wH*BJSFwX6UgnMdx-(Q zJ%%fQDn^ohKu;!5MM0FIg|%4*xd$`$_y3+#8sz`C6Q5OD%7ZXAXv@31yU5;LiMUE{ ze=btG3Jt*x_|QXB)0d+^g`OJ&3xZ&l{Yz#wHcv97FR=QP$M8qcW*^OcwsMFpaFvui z3f&DQrXeS2c@<~5+AVD{GgXMe_>?t?1k#=7=^Q*~{um!CEmW%THZz~I;67c*9Y`Ch zK-s_NAI6-myNKR0=@+G@ptuLh*U?TV$uw*{hzv9F@x=q1f3MRVNBD4&;z!3l$IHwB zk%jI_MVM7=>|&Ol z+i=sE9!{5|Q&aH5gNm+=d6+3(j9Iq4P=0}pR1-|SWb>OB4;Zg|!Z92qYY8Xy1^{o~ zS5vcqBnKE-dNBlE(w=&^{XVolPw$>9)8ht_eO1)sXe3-gClwAH7khTtFy(A|Ygi4f zW$qWR8GD+%%q$rWRA(e)hUk|-klFpYh;>CJrLT1kld3%>f$HOIfii!LhtTC4(#$w8 zAn&H~h6kmMyQ%dJ*pYm+t{ge&wg zf92%z@N>+1?6qx^X*I&?{w3am6vQzYcenC*TOyw^-g=uma<4^HqSuv7LD|T`SlLLw zIFA444;`8Co|bj_5mB*d-`&6VldtZxrP6>Sg}sr8F5ksY5a@eBn;Mw>zKy50ZF z0&KjGnYN`^mmg9QA(ba3Ba;KI8_d`tw~7!r7G%~4PzyKr?C}$oGS}lz?QAp<5rDEr z4mXQ9&3@h(FX8ii&3jEzd)G%w$aysUk&=|syH2_D^5>-nLUipbPrI(0)dHo2VEjJ2 z8Gs#trjV#)Atg91@*`mPt$eIag&o2)K_KBu$aUlPw-*>AEG|wo;C^U?5GJrXd$#W` z=)S6M1+p+4Qmn%_GAz@p7_@#(uiI}6S@X4;B8+dJbxpusIAVI4t3jUtf+&y?RXVQ+@^9~zH8%*Yjpm?;R!$xa5UhH1lGT|NPq;B zoJe3yfL+On?L5-QrS$F0%Gg{wUGnkjoRYGi8m$;K~`(@TLS4SC|AHHfdJUb{aX?`}>qHowN`}?vg`oVwbSGO)lP^-$`Cm{TJP$sy4vSbzEGavRn@y`4( z2cvgkrkIWOkmQ=rkb5@Az|9Bx597WmeZv1&Gm@hm5O5~8<}xlsY)D>Y|6nTMbKGzR z^FMYBYu5e5;DRr!E%kiVzMri6-`$AqZP${{M)yer0c*x!QX8$eF8z;kgYIbHvr$|K ztX)J=8>bS-sk!}B4&aiU%G?b3D(YGy(_!5etted03dc)e8u+D{Vmw#>K=+kgDXbNG;= za@>*osNpm)sOH>`&^Si#h2gqtzHEzHSBb1ui@YxriBHC;+c2&i=>y8R&J}50;tqP2 z;$4A!7fG*bDw}UVupgT;I<;u6X{m|5_vCpLqgbLqileK+I>0=_tSV35zJe~s9I{5y z+zeK5U=z)gyivCMaE{dA)*EsT3JTsueXX!Y$N0mxj{FvL1);JYU~5d`Is&JP6`|>tjH+R-fD>*ZrZD2xd)F5WMU@%`{|}<7JXRv zUc9zD(A=(p8vJ4#u`k*>=1=dl2sKdN+N5Gz3`?0|xD#~8QYE)Qdr|gHDqdedTGKQ}s`0TcyIbp3a_R(Zb*QlCQU}_>L6--e$ya5R8 zaHQ!!3v%xS=O=roYGcjJD$02iA_)87%AWO=056lV^`R@BdT%mL)do_ zse{~tke))V8F7LNA*7exVI z8KIIG`mfkYI-k=DIN zF(Sd7(ST^d1AO|Q$2@#P2dIUXKmLolpQ!Ng;r}xD#l=zJnY>C*xBs&X;yGfBQ7VFi z^BPk5Or%83O-<>L1g->|4?KmRAmM0eXgJO_CBq104fF@!5`-2YhL;c*7>sSs+qV%b z1~4X^?;svL1ZNjy7!s94_%Z;HiJG2mJK1)nL^!xAJ`rJ^whY-5muZfX3JH+SQe&Ux z9pUSY`r*9Q7?#d@d1U>|RM6Nx*Km>wnaA?+S7}sU5_=4*Eqa(gas32i1%@0Nja3OM z5~if2aWR4pHHBm&RtK0N_XN%``0fbDcmrQn0KnM)Xz>M*N)`fa;5BQI6uim7@d5;` zJ>c?)K#2lA**i3}3e7w0#fygq2A_c(AyIm`-P6gSGaBTy4v-6TIEy4CB0^429|x{6 zd`-wIoCrWvwo~JC)0ha|?AiH92%LEsHv@R6D59IqMRgF`wSfWHDg262A+Hqp6 zaXxVt@8uPdQcZYK2+Ot^mli!3&t-}V3B&2-hZe;m{m^&k!@HJ8#%~Bh+kl`PZKjk#h%l0Akn2@O=Uex!t;E7Y;fm1Gaqq z`t|dC&auf!cObWdwj)f^r#tt+tZT0smR4&GJUfCDUty==-k|h{be}72;?{KXN#A<{~*8sWU?ssoika!{GkR#G%TeP-U{F47- zqLst%@2@<_8i8Mx@cMOUFxDkapWoqa>77q|YB_A^G)8xhnfZ<6Q*Qj?-5XigbNz;E zsWM64euL+2-CMh0yg)@oZ6Q)-E~R{j>MVj6kr>z6{idh*A8pIDgLrs(ZfgX<^L+_w zDtt#tBgAx(NX)Rzg=96)>$J4b_ei90+MpPxA*ll5-5rob@;-g~Zt(4`#SquiPfF{; z!Wx1vg&k^LSg4qB)W3lgmJh-<(wUI&7wMsYb_X&(x$G)5;TUxg6DS~I;rd>bB%@mT6S@+z;$I*TCub?D7V(=zQ%~dyMMh=i|Dox-1F?SFw~>mFnORa43XzeO8HKD+*@hS`=qZX$cwg*hV6U2g| z{sz$Z44_ha9+|Op;XMhjTsIEyyVPW_&P0s{`)a^uLpIM+i>N0dfhz4(u^K7qRPTO| zI)8a7u;WxhW#4TDy4jcSLQ3Mq@^{+!Kgw0&?aC09ez<;iK|)Nd`R^mESovYz?7<_4 z**Vw?*Q=kC|2X+VC>q*J?p{07-9Y4IJ6$5ZWw)ZT-EjL^_2IIb)H^opBZDg{t#fLl z8FZ&rnXaF?2PmlZ)2BnOuA(S{3Hz$rVC^6h-n$ul6gnz&8gPoFk{A1O+(Q=o`a1-T z;Ez%B_uh8YZ~yjf{>MOek5KxJ%L87WKWox*_CP*@#m%~X`}UtNy@YQFT&b_u#0_vm z;CDes#zF6bqX(C&T5a`B^n?T(DSQh01r<6iwp(U|z&`dDAxE#l(?c^ujxRiFDd*bA zI+mB?6yT0dp5!FL(-YN8x0$8aQ}KVu%Gy0qI>eiG^q!ioZj)mQbI+zI&E9$wwUxlO zsH9V=&bMLYgQlFQ)3`5GH%1CY*VWZA;c967Rpv71keB>E;P=tU&)xD$DWj!fHgl~R zHuq?+^|~|-m`SO#X#jzN@{H6bFTc3`;O9UEfLrDW_CI2(!1T;{o#_0&DGj7F;ie(( zu)X#(QaL2I9>Ph$}i+Gr7GFR*SMd7fdS+hvU)Z~xkg^`=dm=o`3WZhG%$o$999Q7C*siuUyzCVSB{tn%Hyv#w=fu2*8DWs9mR z#;FVU2Aw>4@;XD)g}onpU!WWRHcT2RH{YGA5+=g=0_A9ftIiK5NCr- zaM9Tz;eq$Bqw5z-=et{{^*SdC-{2Ke&(NiZ4sX$rsE};=nJJNEZnmUi`Jwb$%$3q+ z`$^5<@~Wm}1*7d1$*$&24aLS2zslV0)0{%82A5kudUr}S$qLSXO`$ELV6Wo9$KN2xyLU!pi>x=K{04E+EiN~}D%w77aZpPH&eO9|jmGXMo#-H$18+~NEW zlNXoH2m6}k)OK2j>LS7jYB%Zk9lZ{p&qIA0FR=cF@~m9cW~$lO#ySfs)surucO%E4 z8W9o_I)xh?rxRCiOmuV?j@Y@mIh2GDXThPV!lr?Gd~x8?b{KW;PEjiLE{u9H$n<>t z_Q%VXT?u?%HdI(JdZR=vN-HW=PF+64UxF^v4=QE!_4KC zioS@_j@`8BHWi_tjV%gXa3j`=&D)iZIywpi$W}s?uX&hOdhf_~Z_@;Z*J&GjTMs8e zMXD7~udB7z9@n`(FF+w#{B}}{1RbMkLK3aKB}&pIoFO32nAdO`TfT)t30fi!Iv2uMkqn`Hhqj#*03C4I#SYM& za=bduy0YR`YC(d{;GZMaY*^~+;>F<3<#p6cEubUhJidjsO#d}NW$~h!$LUwx zP62J}3%k?a{YyCy!1mfIW%%3U@H|NNu%6E??MvA36X9MmD0`bed`fF5F|L+u`zp%N zna&k2Kxo~G>a`Fc>wi)E61Ia&(w-h>1L)x+z{YaDZkW@PJ=?tXkl{}xD4aop8_3?C zx9+Cq=8Y%c$lO$S9D zjx4xfiSOFdavNS5MADy`K7!M@7#X>PhKhvEVFeQj87@swi=>VPV+p>AKYAw!U6RE@ zgs!-bI8Be?KtngM{jQvMR-0Tu^uvU<1xyA?_0B*S(rmck&LBIJ~RbGPMCO@RW*C(Lh0z}9G#p_!}3T(#^f8dSSFl7*8@}Pm5SkmnB4|=hpGp*@5ThM|XB7nJ0V0Ml|Bc!Lj|$yV z8N{QMgc5fS!-pRiT(5idx@<2XR^U%x=k?cTeW z&NLxlEWZJy#|ALlLeVuOumHgc@9`E6<4=;!8Nv4l3<9~x_)qLsfdl|5%R!5;By+Ft0iBvb7CN4#X`#YiAA?Vvf>RyO-K};WF)4-RZe1&I&_6j2J zZ+_(<1?>=krHGW24~fz-kW3MFpDhxSVo4}M;2d6;lam8Q5GZuW^h%dTo}i;7;S2SZ z_#aLK1yEfGL|7;KN0O*=-~T%;kYng%h*rhIyGeTM!SlD!lTw8<2maTcQ;{?U5aZ8X zy7wdQ!Dhb_Jo{~ag?`IOs6(OA1iABvH1$hDA|mvON${daB|Nxs16d1TZfa*;+p5}@ z-+}dd`|h0$KDm^X)N@cJKki};P2ndwtBK?s`2$y>27(gW#Dui1{h@0I0lNCg%lQm5 zp`9k`$O>$6>@G%{iWWK!v7hdt%RJbHM7>S~p6Go*kglyxuKoQo8S+12CU#T6@60<0 zjKn!{|KrDF6nG-nR{ueQo)6JJ1>7)o=u+PjAt$l}{6WJ4PX?1Xg$OyR$2P)yX}Z(=xDIXDhud6Qp)6R$phX?PA&8^qj5eCp^RDvBFPNjjiuQCofb z{284$2Vbhm$V{fZb7SEVuUr|xr_Fr%@-A?iLx%LzT^&+QfA+*hNACpu z0dR)EFOtc;1+1v9?_(!s&_g1Gh6>+|q)Q?Nfik<@@sp9Ve!`hPw*%<)Z14$5Ck?K! z3QBoC*5v-lA^Zds2!IMyArrun!^Xk!zXPjM|Msn02DtG-i{|I&&yM%rfeVb=>~a4j zBX^K+v>FyL&bL0VMp2^HAI&X~g^QDG844jn*Q1mnM-N^&p}uiSpfaCgv~RiJgl34` zFeH`%Ez&wT9MS<%!PYT@Qr5u8s1|5l1N7rB=X;#F4!CV4ggUBbe}e+5FX@H;Q>V%0 z12&kP!4TzLPJg?$9J7X8oXdh>f!d^53vPNG);r=;f$EK>k%a#`Fd*A)ZE-yB7guC1&|T64xW?xsPuL^ z1As@iaR)Wg^xzgQ&hJO(PdPSMngHQ?)!*-Q*z*9A(jg{*J;ctm9+y<(el0C6f;*u> z6lp{P3Y;*D0I5)bai$A>_bdP1nzjz7GvO6xM>=9~dfiA#xmG)nif3pwJK$$W}to>f|ckHN?k z5?76w%dxRpP!RzPMl%O>0bOEYhvU0)%Lb&Uz}AgpGhC%d382IIN~n23A9W*LiWI|> z3y{Y-pESiAfo+BY(8f(jivBVWcSW{{K)kIsO(JloY z%$ZMU^od^v1qs9JjGR62ghw^Ze18*z%w|^P2YrJ=ey5^hGEhnGSav+BpY=TME`z5| z%M9J8*Dyq4%4r03;!^N{P>*O`So0&Wgg(HiRtwFU9vZpU;7@raIE?|(ETZ-yqI|Tx ziHY1;81JEKnp$4L^Y%vg7Yi@1-W@T^tKQE_d*|bF@2$X)gx_9E!yOM83R0~u7;g}_ z13O;oLdSrI)M#~@+5P)+$gJgot+NW12FXN1k&9(V=+CNqKadP%oxM%7bV_1& zDXra#0xzusg(TurB$2g*N)DMikrHR0I+|VIqGQdRnz3-gTWxb*r?W-xnBf-|f}TfZ zt&itL7)uh0BwIKA(C$NqbpsxpYCbpy$+-nt=pjRJ{81=txTy~K6p@IcvF^fauE-(V zp{%?emXL}u;zUU}gWUn=DDmjQ%Dx{(GCUa{aFDprOybvIRRlmgNHj@c5LLbPm@1?m zo^82L-XyjxQGHY3{{xNVDOA9txRoXdx+z-TRvXtTM1J zBii;bzzHZTp`9lO698t!V!`M1LA)Pse7@JcEIB#ciE`9bawNj4D=+jYqW0bq7ztR~ z5i>J0gWl1RkuH>&2fp~Q!jt$gEsau@iNq+8{0q`I-VcO@=jy_%F^bdoZuK6(DTpPh zt*uQkE}T9W^7C*E{|6;)gr`)Gw0Hi) zu-oqehK_p!h4rb!|+4WJ#fV!qmcQ31(>4$b=;M+ z)S9Dn8?JdYxeoW0N3KFnn7=l=cBW3pk5;zl6S zNK!}oJhi5a=-e9RB*Q+wai!D^5G$A*+u-6=hGFyr1SJMZ^zNo0D}t)g1U8|fJPIfQ zk0Yv;8v-xL(tjaY;h6-*`iKo~5lojozkqQeJ|1$^kSboXMX?sAm6QMS=(_gS^J=ds z_XD!-|2KFb>YEhZD|Dr8U0rX{h3lX$yny6koUugFz4kY5?Hf1_oZ!+?GDsUHtt_nR zgYYP2ps9dFmsn)*(#-Fl9}z~i|KS3o(&gF#@q{lax{oY$YF~)AD&uYVkr#STqDCt2 z8*;GgF4D5Xv#A+>5yjzs0B;$RM2L=7xgB8U@#6_;qEvSF_AFdnju(54Ot!$phu*FR znpj!1Rw(gEa|`V@g*b91YCEdY{vc0|xm7_X7sGY#-N{oUlA|H~oY2 zPdI*XR%_kdeFMHtP0c975-6G}IK2;+)qcXq0W_Na=n+jA?#J`?e;u%Se6FwYB93p!YvNkMw(T zBA};`r2dFBcmgq{t<3*!zl314CZRxlKt$Ei+-Z#Dqd`H%|EF#;bS;p7szNB5=xw9E z#iH^BU4XaSCNzqTeBf(8DGpJcwYIi~i8R*pEunCdN$C1*?_#O`01YF+v4df0Q%HHf z2?mVE$hAyP4(sL7wzCntJVfbd}+)oIyf9erwjc?7EYspQ}u1# z$h0M7lvTITMY!KC5x)f!ia9c~lCpI&4 zMf7%Xj#tairL)I|jBd9dtJLpIXlLfWGJ3R^>HO2u&7vzxrsev_vzizC79_7cvTd7} zOHNzvt_ z&CZV}&KgzEIA&)Km~js8yTH4#yXO1p^ak(Z=g(!scX{+mlqCTE!+k`7D*66?mgqOX z-Y9Z9JuyqKk^yj4(k*lHqy;?)ir6;guLRTq-K#kBLGrj_-|^TSCx`ijkc|YmGbDXxy9oMnZ;!ly6)w&v8>&Rhf;_xJ{c`VblGL-#< zJZPPUy9eo?1@sQy-6(*7ijrP%b{F%9*N)L%X6^iVeHZg3-J0Dx4eR_aUq0Q-aon|X zm7Se~sKBnOYUp+V6_R4v;NX@BAN%MBfz z7D=>4$9zIDF^j<5$YTWPR4+ppGhc^OI){?`+XjevtV~R<(dcuWzW*grURD|v)^k24 zs^;H5#hcp8`HH^Cna6zAL1cX%9NO|*uLD*=s`s(@5g+;P>d@-v*g`V}BXDIR4j&J= z;NpbvbL!m4^@2M+EcKd>^Pkc?&c>k8ahsVgX2uq${q(=ZnUz-~q01$qqmL8}mV%U| zbd4~sz!l!kA&V-ZXuQZ{$kAK-*Rn=^hNgg~9_y9;88zi)A8moUt}C1GFpG-5{!Vp0 zIr(W^-yT4ptFd91UXAW%{qv*kPRIiebnLT>>}?bI_!Js@RhjtscSRIE^blZ%{`@8T zP@JRN@p*qmERLl9$piXb_d8>DYq8+`xYN=0{Mjj}c5a?-u1HHtYqrxpqZ2;)Z0@dL zLy+~D3}w0F1K(;9F@XXR9t+;v)HSJ$8}_&tyDj-`d{@q7Qe@q>S_cL>i(%C=i(e#sdDl6hJnreboq4wl{n& zhhU%;X~fk+R?>RtT3~O)U!&h7@i^&Tleh99Q_PZ*FD)aCeq& zr8+@zh*H2%c0#u5h9Ib#0p4UDqv8wjEo!g?k3JD zTM8kZ{~k_N{>E_6K734CI=UZ`99E~GIgIjXZ@Iu)qr27~`FJ(dd(~=2!d~)kDT|Z# z!tzRe*f+0zj0FxnimQKrsAi-?9eu(d3@S;B_`oe{DpmUtmjJaYA4(rce)r?XMp@>M zyB^~4^?DZ-d`d0GzLeitS~?GWM-!03A|T1X2+ufzG9ICVuyx*q_60yF>O*_orU_vD2O#YD@c{W%*NnqJn7)6nU4t85;3vvy;978foTd3qz!#*A!68^jU^w`K z-x2Ty=9qM$X~btG;A8&4WSH4@eJ!MGBGv|FwS>>Gfg7Ta_*iF3Pkr{7t2SU*@;Y^8 zsj&fu1>w~J#!!Q^0P{85r4CzJeZ8|()z{aTM6D_-AG-Rl34f-f>BrOuiv3|bO%s%t z0oOk9^7fwG5Kl?1+O?OaCK>|#(tSF%%@M6tr|K0WGuDb_4~T?2+oYa*1luuuk^~ci zULhl2zmo!;m9DR^bV&6B0+GU0gf`RO;o13*Q?Mr^BkZnHusr61Yy)=q58Ml>uMoRB zg#|5%>}$XbM9u_H_jU@nw@B(A6pR45iDr>B$AEN*VF~s2H?L9}Iy!}Y?Rlopi+@sM z57Ef#J+438ax6hi8bByZs#BuhIwpo7$DWncEXUEXCf>LqOTKL?FMXbIE_m*8ybp9Ig$uHEI}x_U|dEa*)$K| zcp|H+?$c`Wyw8)nyLqAB0PF=0xNG^Jtd!I$aL`>(4XovIG5)Vv%V++9`3|H^m}+ZhfG|Q z7yR7WX#|l;|D>S2d?G+d0WGJ&R}Qpa3L8ifQI^#S4?1`Xhr2g?C7(>tOP`ytAbITo zcs@MItNNcdhWb%#H|-vLFM!nl8ElaN%F4`aW4A}bIcG@@-;Zv#>2bAK(Z>A#$+Kwv zV1K-faaZvOcH-)+x<$QHH}Youw>mMp;}0KyzSKST=SG%e-q7ISYW5emwP7Gm=eG5W zIVL9DOiFr!_a^%M=?gmZO8o#uUZRL1RI01%v$i3`WZuI9!b?znLNC(H3w0ys@RhDP zHs8Tt%Diz6vTh)JDsYM704T)b!|AYr`siD5pBaGmKng%c1^oqbb6~G{55&?RVgj5Q zsbyt79`yi)H|^;MX^JM(XABYs^+(G=O6Z>%D1*~9dqA>8MQ!*Ye}|>eQDNuN-8;wX zlyq*se0s5Gc71S?NMrTv@(LrRKISYelMU3;*x0+iE8IE!Ntkokg*yc`XJZyu%$}bj z6NpZMi2_lzLyHBQpMb9YD--7`{?yQ+K}q)f!xJ+IK(pqRTZuRJ3YS^7X>B?D=T~DF zk^Aoj?=23Fdx`-C`4$fF`;gf$CMFO+;cOr}GF!P8M6WdhA4R`JghGjln_i`y`^x3> z3@0CnAKZXD5=(NrVG)9bAmbN2+~RO`hTN@Fo&ne9qeBP;tdGFiTAQ`eR0050!|fXyW_ayHbfk* zO3dP#c?^pUvQwaji+JDK*)`(*i~@)n;4Plz@&6&Vo8&k0VOI^8z#B6d3;7XsAtXM? zieYAMdm1~W^W;cNwyI}o%!N!{pQ9cuJdTH1p2hWKf=XIh-$kc*J1MDG0iX1oo7)71 zZhP6Lh(GLPw2z=xJU8xL^Q5GtW!Bc;e*-W8$`?r`X@M}LHAv~+3>W`aP-QNtKBuO`E>XC3~#^Kp*+hQDU<4?8G8z_|M|8c!<3 z3t+Y3+5r^AuX63{0UmDd>u0*(dk5Y>8RZ|7O2K4bm=jQXba+iYLp{=s@fxRZ*~|wu z$=Qm8_u^}A`qWhNo3gCg@30(9eY3XGzqSY|r~Nv{bxC2N&5ezL-~UQ1A2O`C^eR48 z(KMl<`GIoix-dSPxOD-q?7vM_R8*Lv#&jikv-w=@Q9V6~mF{;uIkAp&^UVU0_SRMv z0NyAh4kw)1%g`Ti%JJp+tpv60_pfPko?ngpw7aFmjpKrWYKWYpuT$%m_aLDz0)Gf* z3}XD#XuWzY2ms%wAIl+BAs^!`iyUrwetRBDB8qn5GTXB=ND<@|UP*y|({gm6c(Lqb-{=~w&_p}G+)o9GM;_pHr3oc`S z@@p}j^GZ~)Mi`yZ>4jC_omx#dG9~As+kSl)rAbFC6E%}ToS@>r)gw<8fB)WotNnH< zD<3N|1YuV zM$0ZcO2b=^+#OQ;k_5`OeG!TslXLqg>Hb#6U8^YSlV4>hHKkM&qnWbq)H=0zJH}Am zDVf#j#D?l%jax2s_{waQQVvtu!8dS35uzCR_AY~LyBhc73(ZdUuYE82wW$Vc_U_1t z6Kb|vz~v3lDnEYuQ~+Qou2$T=n$S92iH;`fLZX8J$wRb6(0oIJw)Q4O!<<_5eqx;_7&LgwWbl>1MeX?hmpaf%IDaH>3;@ zpMj1!EM15=v=L_jv5Ehg$`}qxXHx?O5~pTjf)N2bQNKXWL}38Q5Jp?HfGnW^le`fT zzQRm*3vp{j**li>3X6*VLfuz0xgZHD1&IIpSFncv1%7u#ON;0ZND5FG43pE)A@;-T zLuhj3JA`AW#tVQHD-gk)iAT?#{URZ9_yhH8aTrVqLXHTO07@e^0g8V#UKL1IMB}re zqiw(g)x19jtC8`S1tNv`4ya%m$)&Kba+U>A#hW*6?@knV?wQjKiS6)zQ_zo2Ppu?wFbllL!zfjMm4YfUC)F{$ zM3YHlJg;9~Z||$bnd_zY}}pAg&IgLxz~3W0tfGc>gE8N+kNsFr}AHx5(4 z!n^|&{DZZBL(oMS8XMOkwgF-e;%6qR4_q=gplk=p0Rig(CY@>~oFOp{ASgc|l?K!y zCmuaXgQJYl9nPNVs`})>{m=OG+kyQY?>sjzovlArU9(g7p7OBowUBvs>FbH#> zxBC5l*iJ$5(UbMxti-l=zga_T9$Hwp)Wj*zZ&UJlI~X@Sm3P~)^O>)IOi!^EmoCNY zODdsEUsaf{+m)yO?Yp#6m8DFR{&(t5UhE#q;eT(v_x~Fb?lrTtY$84fbW)t?s)#NO z3hdxapz` zNk^rKT%-^Enn=79+Jv=^Lk6xR*sbf}xhQP;(-04#~){&d$oJ zr`b;1ns0j;#2WJR7?By90rCw+ojTLfN(lcu;=Kf=uNepo0&4+W6nZ;6V@=BsYM=i& znV66Z4ZG=xzP=!asus{#GW=PV?z39|z}i(gu}h9+;udH3fpGDLD*^v*-n+R&yz_|@ zw=k{VF_z?dzv>g;oXsQ6Mi#FeI@24a5gL4I^iAGM=0Kw0=L0n9m$R1Q{s!ls(0C^^ z*?7V$ma=bl^3C^n>+HujPIow3qgxOliX{S7kSs^oFo%XFXQw*PnWe{- zw_g0vGg>O(lVZ?fadepe(e4tlTh^mnGK0cx`AxZud4IWnxyYjz$E@z|dm8k64-AFI zZx;5d#;=wwG4hYju2g@`rCs}~Z$N1m_*bj3Z8BRx>;DET5Fi%cAM7E?ivU)H^8W*< z_Y2?eo2xC1kviuW{u7k6%-fr?Ff~B|NceN)GBsg15jl0yHV}13E7VM2YY6H45+idU zE~5FUh}1S3Mn*yC_i(P>AOWVp4nfVL?FEH%0sOQ&KRb0eUj89N0TGd_IGsp#Cx8a% z+V~|Tm>;w>;8G=HY$y6kAyNV_NeETM#*pk9+-J}+(eHqO(xYl=WG`d}LM<|=o`POB;ZR22cIth=-ty*%LsF=}13qdeF z@`p*#6(*l1HXb}ooCq);_8}$RXRM1^mbq?#ktYT!mm zJODPKHq=59e4I6Or%*jaweny|W38i@WJZ_)Ktjs9;x-YUx`u3}NDF}u2T?j?vN41$ zh-gm4VH}B9DWLTo`ouKcn(#tEJwf3QT`GYWq5qe@DD#S_`|xhB_2YU3F~*OxxD9F$ z{*-?3Nah-|LNPOk)(vb*YEd!@SuM}_{@ptB{=zra?av{Lh1IDRco=bYp(-X72&AYd z-_bS0rdg~Guo2-?G`z1z9*@uZ79mWsUam~V*hE_B8LtW^y-K8aNZV9i1*1-^B(7m; z%%h#3BeUJg_GkZT-?;vK!1?`wUwpQrU-t9!GgzMWnp+wj@|@X?zxc)PpWDd;zaA#%J?~h)*)n7cdYMSWnvxEXfl^p7L^1gr25*Q! zR2$5b527o&G_1P)L))znQ@4D_+qd3(w^j80)&T8&`)0S!xO@NH{e@ObxqhpFdUb5N zP}7Kg?C+e;cUy(uZ%zNW_1B1xFRiP$^Xkdrv~4E3`nLXOlE#;OuW3I2Ij(USodKp% z6JIzV4cTZ&z(vvp35NGfmXo)1o;duBa5Y9|(bt^VT?W^Z;%E;p7%!_e%HFh9%P@+Z zpc9?6GkjvUXTi?9P|$hkcWmXS%Ty0{%X;?gLTUf7k;$q+I)ClRI%b>wzuyU-Tgrba z4j(3w_#m2+hS7a7WOU^-OYu-FFh7x4R_=3)$80`x9{Zm1uh zl=XVcc^)xZs1=EXrN@k`q5S`A0U(vi$q8d^-_PXF$j{G@wN)t9H}i_{AJkHgNlktM z1=RPBu39~a)~B^A_3X-ZnXxpunO8AreGJkEf6Sbs7d!;J?d(QFHe7agfYSR=JRfJd z@V{SjLJ@+;FTR~nnz_pQSn|H6+o+QyBzEow=VL?{7=Vm{#m$m9^N6K&op( z?s#$kP;uD9U`q0iL5pJrK6?7pC86up_c72sZ??qbLR@+T%C3%}l9>iuc>$ng*J z#4WLyfO6?JWl8zxS?oHmD^CswWAHh*mKNWs(-V->n3{$sSEJrHK7QOP*QuB%*CmfW zW-oW4FeXr;3zl&AH68S#mDSUV4->E|y^-Y;9V=~U)ho}cSH$rlSjCX7;;Tx;Wt?J4 zE3-!Y@B8q%Ak>X|*ZsZkzmL^zYtE)&XS!M2#iO*fh}AGY*Y17JLF0~%)M38LVhraE zl6u|BuR)i>8#pErG8JPDziSKpx|AY?(*dWTm|-qE&dzPBWgX4Red+l2j{Dk4@LiiG znA86YE%VkeJQN?Hn=$0&=8#UQA?HhDagZx`*tccAZ*QC7V`)g(HAezQ4K3I{1nW$? zpRX&mUR&xUv(4cnMz|!70|v8xch7m^FF{of;Xv&{o%l#=o+F8Lrzr6mXa-CS zZ+kZvs-vw<66P?7rQ6~O9}U{i-0IcyNdHY5SAggp4TED$Cz}Q{I40mF2xOsSnZL7% z!N3Gw_UO|Zi6eKot_hjx8QqD%Rb%Bpus#G4f06+54;f1BtXT|FB2HI`AL{TodyMaX z`Wyuom=akMCB1UzXN7>)(rIsnazF*`FBAyRc6c<|uyvvsCj;qxe0(Imp8#b>*;_Bv z37PaSh?c+MNRE1E3j7F{0%$0HLBWQuT@BZ;fQ_Y)CaP(;dtf=avqCKtk& zZ4o@z0q}xbLVu2Wtn4~1L%S@5>PyHPO8;hLavPQk_PpOd^2EULI4{p#Vk-u=W}y>R z?VbApdm~|p(e657izaFkby&fNA*kYSz>_%i&^tdmy-3J~lK72b*8KEcdhYd=kcmvT z;-~~snumgyHb(BR=o=h2VwTsSd~LLONXM`=rt1jLyQ$_zc1I^L2;adgT&TE6ggFBX z)oYa-JYZ#svC8Anisw}Dd+LXrSFV&{=yjM#<)F$$Jq}#MwSz@_O^<|6lkj{p^HlNQ zpIXi9M2;WwZ|X1#6VMz|nWo9~WI_9cLvPu@H{&jpw*3fxue8%A$3}O@&7FX|akQm$ zlrBwzK!L^2OLHjkg|BY=k)ua{W+l1FXOCjDh{K3dST>Q#=MWI@_q{~O;v}VC8m+F9 zjh->(kn%~Ure?W2j~CNw*i|@+DL{ru%wuk3FGa=dN1Ym6Fm-6rj0XNzyuz0dssbqZ z>~rM_HVu^Y#9e{`^8@;!ORV~eQ`AOTM-fICu}dd`$hma7?hE4b6TCYlxe^i@W8a=o zajPY3tTnWy*vfUP><)|W1@%nbTgS_<#1*tZv!yORzSVJ$Pikt?D-#oiiNC%f3x-T$ zlYQf8#oXGZL_OhZ+7*g@5gEF8C$wz>3+^YKJ*zv;w zChJlpSN?v#YT45_`^M3I_;$)=PwM0>IMhNf>+GvEHcRN(cK1x;pgF>#%QmK_r41;i zGXBZN5Cos=$HXXsT2BHH!IuEJ&+A`a!ur3~9ip9(ct64G6j*NjWi_Gt!17pQmF|L^g{uZIAR2MSbjI5tW( zDTM1>WICWNTtayv^VYU7cHx)Dw4wKt!&{|HS6^4`N*XQ{w_z;37s6O9BGX~8YA{|6 zF=BX3>-O>H!IQ;y<{Ag3=Z;HNJ-;BjODRq->65IKu7Md>YQgT8I!eO3#MCo%owmB& zsh{7bs$H_tk6Bf#D||11_l16E1EcMy%{3^@-=~BNdF&R|+8_TzoIYHq^HDCHp$X4v zBh!Q1%$MJ~{ito_*~sF!8ZMgA_At3(RHpO#@VOfaKjoh48R_}g9#N>Kl+h8MTqj1M zrV@N~{v&ci^N<4lZUdn33cKFoJW4m@urBe%50&E|*cYF=a=+c}_sr?6Jnz`m`m8MK zZJeUhI}L@Tb^%lk}sZ*T;Cc0wEtM+;53Dp`k^;khvv2Pr?1~1Q*EbC zY8*8!%+Kl$nzFj^)1Slbj;5)}I_tbA(apZT)7{KAvEHM9D>o=OsXzUfpLo5)ZcHz# zx9`B=R7WavZF=3>1Otxef9->}^tay5}37W?Z zmF-V@&Wwqu*WYs0(MmRtQxa!T{}$8UcIZdYF>QLwm`(Y)bQQeY8l(OB6&7jM&JJ@Y zh%z7I{Z_2|Hs1fBJeI;gPt78WouSSnq9Z&{>lwZHn2NM?yk>qBo5lYVlehny?s$o3 z$HiO6&I4rayqC2o_2=+6Up@-H%uh5i6Z$t?&82h;fy-(?UI)Q9q_+L1x8yjss2fcN z4Fx{U>^)XF7`Nfpw>@m4)I0dHpFNm=R>5p@(|>1#^KgXQ_>bS8>N{OHo~Jnu-;n5! zeHL7#HzhS=K!0w_@=n_)&x{lWmgxO%7kYH&9}r94_ii#hwA0Sc*vZ!G{qv50-dfve zRD&->c4o9IeNn$ezuoc5ghSOIiKy*eqa~mI{P-;2ms@WeVIr-%VNRQ0vMJ`ip45tm z(l^^4eo8rHx>{;48uKy9^86M3WB>Ccz3{ID_+TR-HI<{dhX)m8;1Kuxk8gYPj3ICchpNblhS`( zcvv-}8Q)7aQR%j`cNMSb3RrH8hw}VB^)18(Ydnx~HM{MYC>eH1xBcoy8H(y+5oa#( z(dS!VDKRbYM2O`cOjXtk4n7D<39;+MrbgzmAf`ky7q(i<^bX;9hFvc=ymZOR`4PeR+Ik?^pl&lv%*Hhcnl>N0`NA=QYC7D~F@@>qw9V}o;%zwtX4Q**N zr8^b-NEt5$lE0Rnfwh;>J=(yec1ue*Mv+(FSK!MAjGYLnz?>_3SvpzDt|N7Ol#DGr zh7Nqcro7OzZ^32)z;d*{S_Pet^N1t+nH(o)60L6BKCfFtW17-d3mVc&%Bn5A2IE;rm>^b zJJz_;`+VAUSyE9sKdG>qTn9Y~Wf&<=iu)%Yj4UjlrGQ}}Z=+kv!9c%*uh2H^dS#@4 z@C*kBM+I5n5Jxh< zT-njg-f?^AL<#eY=z-IwpKanKLPXL;EF#tNt!dgSd~?TNm(OvCX55`VZ@25)$CTjt zKHhAl#)K}vmmzodiuA~+@%e}_4^jOs$jJ-*S()TlDC^Y~;1Dpkxo^lPe_wNH!>-JW zWlg7TdxZUbeZy>SHk2uIxMupgaRk~;I_d?*|KU7)>IqFp!sRV@?sHhk-0g`e|2n!U zVfBRfi;=T*o*s2MX<5cy$JL*w6}$XteHSB06_+9&^yiLbGpo$2KgvN)6*GSvnOlYr zK2U5dz+7>NiKALnelE~&xBv+~X3#7Gc*CHBYgwEBTS1Yht1oYIx;hu|yy9deQ&(}_ z*GpS&CI|cIN|`wdOTW`dX1|_jqWfeiuY^j(-_Cf&jjreR7n&K~kJ}m60vIBe4LX%1 ze5SvPmNh21uOFQ`Q8m-{)TSipUrl)&z1ehgZFZ#QzbU#ecRs$}?Do>TWLcrw2m-}p z+63&8jwh_~LJP5#Q^~@n{SJO9j799*`v2a!LG@h4&iu7J z&vi|UnipwHBU9>v`|iiITKO-(UfoV%5!n9e;3^-gdGfl6lhPvhQJWr`07&$cQHqB} zX9n?+L!V8QB~GXI*(BTC!2z0yjn=pKyRMq`JPe@OP}_d;-zsm^jlNE=@~c;@EDvk< z-!Pq=Ol9`tzj^%nso>kxhaOdxQHoo5UOBOT^vU!kJ*$5OhrasMKRN5xdo!@;j45Po z7m(9h2oDB*E#LkJNHKo{Xc3S@Omm0Hz_tZO@<7rxPIt5D)XVCQt8P!RdvI9rV7IPW zL{jPxAB_tFY^~}E*VAf8B7EOospnI5aN9xsdTEb}d?Rg4v6h6@=J`01XPQR!nG;-Ze~N81ckF$V}i%Ps5MsD@88^li%=8NBMp$ zDD2sBoij@H%$Z$Iy2lIJ&CC3ELP;NaKJmZSiNIieO zb+#n3HUHU$#sm>cxsJ;*Yn{CdDRz`Ut$kN`AIv~B18DGuxqIc7#)6knK`xHFhsGeF zfmjScjwhbDGO?OLeIm`E=t!T~!I8|01G1aVJ>61d&wbF=pcPXzyYOk;tb(Ec4*$hD z_FG${WwyITeJyx+tmnAO>0qkUJ%MqXt%e_32DQX}f3Y?yWWK9x{(XAqoJW^_tvE!4 z#D#%LPmnD0pB3I!yc~xcLalA*;^acFR_wVp_kAf@iF$@!^*k4LToIKP;7(w_&+gN~ zaBes>_s z66N24bmic@?vLN+%FD+KhhE%@hcOkGfHs-8hI+E(iysfd9Y{|^{SEW|IApc5%qsJQ>K;*$o&|iSq@B*ZfB<)FEwDBC1 z!M16#&6@PRLSC;ddJo!2HO{DTrU=yw8wf`RS=hW|#~zKD z|J$PKaaXQ9y_%!0?J_G=E1v$~ATMLM%C{pj<9F3)bJfxuZcvMA34M0d_H6YmyCf+o z33&P+EEJgq1@V~Q1A2%E%;3BNV%d=r#AIOmzkL^fd*IrJ=LRi{>X&Y@Aj<}9X6SNn z|4Y~vG19NG07>k`fZP`3WY!v<_TOsld03Y=UOOEW9W3Z)Ap;VJpwjprB8@fT^k@k( zzBFmOFmCvBY*1cS2dsWVt;5@TMLWpOO+U z%{jrnuMdj<_rtoJ~$v)qrXl3^(WyxY=zi{%1t4^Jrnw|wggb`=}z z8C{A$xx=-L+rXvIZddWfjnZoAvTmNdLe1w>^LyD2-=7sYpcTTAiZ8h(Uu{I>Wa>n? z`Xv^NH=bH!NeBN;^ZW~^@oo>k{c`f4WzU=TT$8>VZuJt^yqiuK8~*{>3!!jimSfwL z*-(hXg#7U_g&dtl*|f*c>%K}gUwcu`BRoG?=&HayD0=*1@_5sDdy$ghAq($_pPFbMfy z8l<^|bp9_m;T*H&ne~(Sx^eucHJ+8ed=$tM*0pk4!}i=S=`F2Uj`_YaO`R6q%X^MB zUDKBiK1s6!rq1;w*c-T8Q-XW1Okx%WRkrz7c1OOn9rdzeN*pW{p%dN}Wi!?}wblL8 zdY3-2z5jmE2v10NTJQrr#CJtnKnjs~`+Wpk$%hGJb$~jUD^rOE3mRKNtUeg3;lVUn zZCU%LA9Gw#co$5Y$ooiv>SG$BXCe)NQ%4=l1Q&)(!K_d-G@~)|WYllXAR=%pv$G9m zz>t|t_*J-`A&tC8lHs8~^sy8a6N`m_6YG?u@*|iGgN+blrUIKCc*)oV;ftrhpSeKN zj&U!IzjlJRJO0c}W7Mk9o&iZ&{*_iZH`uQ=j__UNeM)%Xi2$p$=ID%ZPM-CTxnkqJ3Nx>EzTc*l!mAb!@aUHP0ZDh$P;ruR164YcJ;9$eHwZ+PUR3q z2nEhyUN*34U_8W`iIe3lG^O~uQ?QdF0tUG#{bH8GdOT`rOeA6pw+`l3ZPaal^yCS$ z@5yu)pfp<}n1wkD)k+fYf<1HbgWNs{$&sFC$w(i{9RDfm-5^@8l{(tLbJBvX7VYS-i6w~rAe z9TpwQ)F_2mw#_#MD;crsZXq*C{UnPYGvUf|$)+$Xabx&j6yvTt7A&Iu<9?E->u8`^ zp?rz;?@tWS5W+!{{}8d5=z9v$74ioCQ6+g9NRm0{cou*66Sprk_BB7I4pld7av7T% z7kh@B3iz9&=(#=~xf{tu=7zzP{So6X0dF5gFj@WQ9(K!{b1rxZaN_wv~ zZkbQ~Vo7nXR{ZaB{~9sb{YG+hsOqn{ctRk7WsyFPWTDyI0e!s3aFz=BRpt6TrrJ4d=dabBFG`F-Ifc8s0;mj|} zjPRC+x3pfx|NZ-SC>-!verGiQLwFD%J|Mz75@2!@o>Q$XmZRhY8)%z# zUm*MmiDDR$peywZ0!$n}(oPz335heW{M-uA$$i9A)|3A&fKsPYGs3x7Ce1)-X$4l3 z!Tz0I204 zYd#HPj}-7klkQhuiXmPJ!J46tqKcu_(&4HmSp195^!( zaN+LKi--zuq`8oL8c%^_J>i-C#Gg3}R+?bJ2;sN~O%TZ!B7{2;GeI8$WPuOIkd9dC zMOZZXGk>D|dLvFx*a{Nh0hKw?VYT{_X+ubb>2X;2N-|+EC551on8V&B(eY(rT)(3( zkin~GiE)|94I0jrxM$%k4_eMSTUvhM6aHo0*w|>jK7qnAY&(TZuU}&4W+9y;M_#@t zE0b4mFWRPZnLXP38BPnBbL-K+nU?uD79AiAB|yXL;Pab8pITTSrjiyNmVM0}O$_e0 zZ?7L?V;ai4*}z=Vm7hY=SrAd7C74o&h4uK^voknj4Gk~;VX;m)V~F|zp`?U80&&q> zoUwDBs7jEF0=1E!W5$mg7AQN{F)F?yGI<=6WWsC4+*8Z)1c-Q(apvEEcL@4I!tf)s zhUEQ_c|RCFL_$$X@&zytSv(HxM?9Rnbo(lpP;W_zmbGAFC-;lm04_2?1@V{BW|{eV zmZT{RU0ozmixB-A8W@DR_R@3hzld*2hBR(DVWEms;s4wv$-bXWuX0OA<0}#wGxoJE zCTbudhNRK}`sTZM3Ij3;(L!`5I2mun1NEQAn5%YZn6OjTFdLZh;4Ble3r@ieLA126 zbz6o^X51TBi1_qLqi95YJMf{(83}5aP^5m1hR?lf8Dncb&qo7?*+`K%jd63L^pi9! z;3Pbm6U1y(@^`x}(Wc=hMkGDavXIjww{qT$>Uu4yzs7bE~TJ&1QaGd9uBaX!H42cu4Qj+iv zb`j!>#!Rg9B}UhY3;;t*UY}xuL>pH&Q!p(tdpUIEY(dz;`c!D`f^e+_E&a~62wD7v zC|>A-N#a9xiXS%x4A-^4yxOWmL!rC=UnlVT@b=(Ch;&SEwruwQO;T>YhOPyZ9RejE zhp3>Rh%W-FNkRmgNnG-8u?jGsnu{Q6lM9$fygXb=d`d{%=Vm~e&B?E z#`sy?BybE3$PGL$cJjH3)R0}rF{sgo;K_ED@?q5(i+NGtv9NvDOPqKNcv)nEaoF?7 zQ4ygppCmT=nQ4IwCPoaX)1kZ67w3FfTui1ffu`GxXO=G#gRoQ&V5i?_7KcAS<0;Fv zHD!;oLDWzak#eE%csZONlbF&z)b|#V0rFUSmx~cV^7V4@GvvqMuTj~=^oY~r2_cL6 z4OnPcxUB+yZ6VA*?*6S}FTYWtVmqdd`wVne8^=|22;xY9(42{I?Hxp!_z-6^8PJ35 zghwh3_ZtwPGL5`ABnhZM8FfrsEzRK572)E*gPim-BVPTup=LQrg85<)iK#%FGdzje z0xugUIeOpR2X=w$PHHXxrO?ZL&3w(ib}3mqrSDK!vlP3z=ZlQWpW1CxZoUpgyu8im zaf&mqvM-irl&m9(TbC*ames^LvHFy*eC6Sd6Fh%VVZi}-0B*M#327J4mxd^?zV&TI zM3x;2l>emzjrSf%tn&KxUh}izSW^*VyNUad4C%ufeD0d`pPc_>nU65W4*MBK0Tj*ThQAM{9-rYt!w*$$u9U-%9J!&v6=d5aEx)l@;(`D7D~6Y{v-a(PSQ0HJ z83|P%x1FR1KF-axhlJ|ddj}_BS>8Gd2+#iE5TIz2aqW9~1C7|e#1i4ACR;bL*0=eG zCdcad2c@?BP!$Wy1F^tCaX0JUW{bNI9w;lYZCW2LANKz$JJWb5-}a5qWQmAL6D^X_ z#?M;WB1=P*vKNwF%ES<|Bx{yrkBMJnDKsP7D8?wVWQm9f*(0)!t%O88=k58weBS(f z)92GNX70J}>prjJIL_~R+GAYNzfI|7=IhtLV|so9W#I|G(;(g_yjr~Q?fq`%xo%IS zHwdZgfsqF_BYY5qBmy;~VA`?l9&ggH(9Kl$Cb3kwZpb!>Oj!jUap_RNML@tHm5qAm z{yRdG$TVDt^cos^0Mx+_4E|LAD!i6g!HrAVJ15 zOA5o>2i_hsx)6dxnWGIbSpE;@5Hx%OVs@-u`w#^-H)y_v@wlJBoaPKIh_R9BnY3s~ zXF0AvL(im6HEaU|>)m|Uho*&t%VqY|xT(m3N0bx9a zTQkd`@WJVUxiPP(f$SG>`H-YVY7}75fSd#a&-Mi&ND@f0utMw<1bL(qO}Hp^mSfj! z0>JlDJz7t<|4ExVqo>@e#LRzjxCd&%Pq3fwP19R~XTN57ux`h9i1rA8C1LpL5GYyT z4Wnz)`@9F-wj-+m25*nU!)iFcxHU4ifOoIVv-Z!9z(Xr5gE!pym-_HDH7 z%h9K0%x)&mI(Df~V?sW4Ew)pNsQlr|=+pweBFd__>HEs)147Z@ z)iD|vYF~0)d@WwN&Z>9j>R-6fD?Jg{<4abGm)#RG_;~2ox}2xr8pYq+^h@Q8hwQMt z?Ay89$(5M$aAOzWeA{e=hcwPR#EIojO#vZEVY$5U=VkLcXsf{KT;Juym2j?tV0`SEs>sAd?Np-57w8Q%HVFzc%mV}77woUS z2a_6flXox6Pn*4$8yNU$sB*lwR{07nkItNr{rl7puhdy3dxKPVk7~Nqt%2 z+KUX%TvVz~9~}3R}7OQ4t0R2VlL-{lrhYzrl#S zRfLAP!*X&Z?E#Vg8l1F|*TT!+FwDF8Li;77s46Ukhc4{PI+W)p)vxGsG;f4`O=z@^ zyLh<$CT6~i^Qx`WC4sY{M1ogHHGj>I8l|RPb)k+)L0lQOa-G}qNsV!=o%#C|jTXM; zRryqd;x!PkHVbSxtw-ajbEE3Q)v(V)g1W{f#2#57h~;7D*jGP)Qr2kq!1H4>sd0k? z7}n6Ve3bhGui=r7ei2!jJ0VT8kI!rlEbesrLUS8s%J}M*Di7USTC6g9zH2BmdwN}j zar8Mogku(q`(@fLiz9Lou34YYSGzZItzzkYXZjLq_SnW(8{VknP-QQ|NDQsfB;_v! zr{caAN%*N+XGIuC`fG2A^oBDo>uO%yL#skjiTv|&5pX7;ukPektuWc2p|if^a3E<= zgt7Y}%9DNyOh;Y$o|>X0G%wSwGVrZO;3lTJZq*1I&403Mg==uzE?M2$iABirW%WZv ziX8H%oOyDU?{5Cr;ljoUzOyR}^xk84cE+PBXY9Z%&rThQoWo&J@#&N3*Xy~;(FVx} z;>@{9iSvvzp0DEha?e^7Pqv?W>O{`Ap~s`huO^n96o9u1W#k8_lg|THjoDpz6I$f} zhja?`Iw=soCUvaJQ<5k>r~c1V`J+A*l4#aJEH|&j2#t``d-|9i?e;^S+T(_5@oQhR zZsu<@v0SzZn>=&m$piL>{z}KR6`gL~f(IuE`r8&D;ehmmAV*G6V1XcEQ7GmiW${ji8?gx>b=TP1%1$!f49-Ms4$)Zq)Z2xo zmY#d81OLiFy^jQwgTPV(eBkfN$ZI;cdACd`yjv3C;F+;&)K3h}%P0%nU+3HUyw4!YQLW_HR zZ0rrOU-g-9Dki>+cE~0w&Jqe@4Mo=%83vOarJ5OvKNWujYh=Xlw~zh?M92x~%x{3m zTWGaRbO_%9K5as#)ee(k;F!Fa%eu1n9fJsgOq3OT0ZTj1g@T_m;8GgNBKQrO0tHa9 zS(i0^9IpGBy2V3`kU}U7R;q14B{^Jxo)S=~zk{5sD~vJVxsTZf_)?g~3hJU3ODxmvJ=LliZV2xJs|xdqj6>H$FpsHWHR}PWp~wfX!BBZaZNA~{r++2E``BhoRN~E zDXFSjv7J?FJTK;;p%HS8<3}+jbNzg&HnJq(yZ>Lmjr{vPH;?uiV$W0j--v&pGR-(g z*T{grYiS2q{k5_!8`XQ%`CjUD(AmHUTzf^M&7~pYzbgyx6YA;xjfBCnrI3zn{Zc@O z33JzCfC~a$BOd@*Es^6jrI z?KYoK@9vIgF$>!1M0}fxNgWkU~XW{y) zfl!6(kez>I6rcjYmt>K(D2SUw3)2S>k+Rl+W)lhW|a!16twglm7suP1_#1H<$-g5rIMQ3W)nc{ zB0)!oyKWf)2$qpPzIGdp7O?WcVZ|9JmC$t+i-@KnuShQ21xk&@kU>H2TUz2 z{GKMJr=%#${5*kOeK0g1NMkTeq(wy?QU5|PNK`?gG>cSJ(#^Eo0M;?<7QDi>->U{N zdGaaLUJZ_2z(0Rq1|75Jg#`sIsGq@w9v&W5pJj=oAb01HWefR5C8VU%S>ltEz2k`e z%^DePD%JDg4Tz(~;l)|n-ZPhIK8OqlZ|W~Tf&qdt6Oz6JG%{*w2x9O`Dk}c|SFiS7 zuNpc8EZc4oyJo;r-*Y0HfEP313F2C@Dgf5S-PipoqzrJp9|QD34XYN6cQY_ZOxqL5 z52LUj@(5D|d4QPy6eXj3iuUZ8ItYXQd>^Joe)3rw8+*i%+*_ejR6^wLp(G)zBtZ-o8)mW_*pq9sO^mG z8zcF_c!gXn@J1)^G%T~40K>Ek4K4WH`l*VBFn7EB@KnM})V3omY0~90Ckf>7O;j=` z&ZW!qudmoxa&_$^KSuwo5UVr#J&QDpH~fceE?hcWB^y5%?ihi*ET>*~E2f?uQc+8f z=7&&Ufot=I$z)2iT*B3<;3I}m^IW(a&^1+v7DXRJS$K9`5gOL18SDTF{4%Pak-g0d zSJzd2D3~232EgG8%!s*e#|G+7ve8#ogDY1kzVlc~9#2C^RtmyC=tl|?;%49KR!d4s z($dh-@My*3s&`d42md2BhG{MeI9elq?T);z@%CTg;o&W1G_}*P5)wcIv=bZKndIOA zW}Lq*dEDz69m3Fq>3uoOGIle31gjW@LLl?*|_70qjyWps=0J%3wo)YNXIWBPsl7b{3) zO*L2Oili{){({k_lbU^-{EA{2jw7fZhGaItpFaJ2;;xKn&i+`WPDrFE3(yn_%qx?`0S5x zIX^aPbB3mt7#l%}jdAh|cf zE)$}Dt@==}A#Y;+EQ@MtzqZe{!Gn)xcB|NNB#ovxTGZ*rEC4Z$}sF+(nmoR z&7Zacu{WqKRXxBulkXRogNB^RWk{!$7^Va7mvVJ`Ch+Z7;}!W^QcoKznk+zb1HIc5 z_IEuN1ew3}5SB0BoDW!0MjR%w2GM%Mu%g?0BC{eOS@UUmr^3LqH-j#=d)dK*frCk} zzRD7bNTwoF&euThp-;4=9EWrKaiptu4b-nku!crpJMV}yW@D#VZFjJHjCAgSi~i4N(*G>L{y%@H7`-02-&FW?#GdAP P6#TkyPEV7Dx4Hix@MLh} literal 0 HcmV?d00001 From a20054e08b0e81582a73d6107e2a0bcf9d23186a Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 12:24:54 -0700 Subject: [PATCH 05/17] Added blog content --- .../hello-for-business/WebAuthnAPIs.md | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 6c6056a031..cfe779b0ec 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -35,3 +35,94 @@ Developers should use the new Windows 10 APIs to support FIDO2 authentication ke ## Where can developers learn more? The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) + +## All about FIDO2, CTAP2 and WebAuthn + +To understand how FIDO2 authenticators work, review the following two specifications: + +- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/), which is available at the W3C site. This document is known as the WebAuthn spec. + +- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of Fast IDentity Online). + +### The Big Picture + +CTAP2 and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Such authenticators include platform authenticators (which are built into the client device) or roaming authenticators (which connect to the client device by using USB, BLE, or NFC connections). + +The authentication process starts when the user performs a specific user gesture that indicates consent for the operation. At the request of the client, the authenticator securely creates strong cryptographic keys and locally stores them. + +After these client-specific keys are created, clients can request attestations for registration and authentication. The type of signature performed by the private key reflects the user gesture that was performed. + +The following diagram shows how CTAP and WebAuthn interact. The light blue dotted arrows represent interactions that depend on the specific implementation of the platform APIs. + +:::image type="content" source="images/webauthnapis/webauthnapis-fido2-overview.png" alt-text="The diagram shows how the WebAuthn API interacts with the relying parties and the CTAPI2 API."::: + +*Relationships of the components that participate in passwordless authentication* + +A combined WebAuthn/CTAP2 dance includes the following cast of characters: + +- **Client device**. The *client device* is the hardware hosting a given strong authentication. Laptops and phones are examples of client devices. + +- **Relying parties and clients**. *Relying parties* are web or native applications that consume strong credentials. The relying parties run on client devices. + + - As a relying party, a native application can also act as a WebAuthn client to make direct WebAuthn calls. + + - As a relying party, a web application can't directly interact with the WebAuthn API. The relying party must broker the deal through the browser. + + > [!NOTE] + > The preceding diagram doesn't depict single sign-on authentication. Don't confuse FIDO relying parties with federated relying parties. + +- **WebAuthn API**. The *WebAuthn API* enables clients to make requests to authenticators. The client can request that the authenticator create a key, provide an assertion about a key, report capabilities, manage a PIN, and so forth. + +- **CTAP2 platform/host**. The *platform* (also called the host in the CTAP2 spec) is the part of the client device that negotiates with authenticators. The platform is responsible for securely reporting the origin of the request and for calling the CTAP2 Concise Binary Object Representation (CBOR) APIs. If the platform isn't CTAP2-aware, the clients themselves take on more of the burden and the internals of the preceding diagram may differ. + +- **Platform authenticator**. A *platform authenticator* usually resides on a client device. Examples of platform authenticators include fingerprint recognition technology that uses a built-in laptop fingerprint reader or facial recognition technology that uses a built-in smartphone camera. Cross-platform transport protocols such as USB, NFC or BLE can't access platform authenticators. + +- **Roaming authenticator**. A *roaming authenticator* can connect to multiple client devices. Client devices must use a supported transport protocol to negotiate interactions. Examples of roaming authenticators include USB security keys, BLE-enabled smartphone applications, or NFC-enabled proximity cards. Roaming authenticators may support CTAP1, CTAP2, or both protocols. + +Many relying parties and clients can interact with many authenticators on a single client device. A user can install multiple browsers that support WebAuthn, and might simultaneously have access to a built-in fingerprint reader, a plugged-in security key, and a BLE-enabled mobile app. + +### Interoperability + +Before there was WebAuthn and CTAP2, there was U2F and CTAP1. U2F is the FIDO Alliance’s universal second-factor specification and there are many authenticators that speak CTAP1 and manage U2F credentials. WebAuthn was designed to be interoperable with CTAP1 Authenticators. A relying party that uses WebAuthn can still use U2F credentials, as long as the relying party doesn't require FIDO2-only functionality. + +FIDO2 authenticators have already implemented and WebAuthn relying parties might require the following optional features: + +- Keys for multiple accounts can be stored per relying party +- Client PIN +- Location (the authenticator returns a location) +- [Hash-based Message Authentication Code (HMAC)-secret](dotnet/api/system.security.cryptography.hmac) (enables offline scenarios) + +The following options are cool and might be useful in the future, but haven't been seen in the wild yet: + +- Transactional approval +- User verification index (servers can determine whether biometric data that's stored locally has changed over time) +- User verification method (the authenticator returns the exact method) +- Biometric performance bounds (the relying party can specify acceptable false acceptance and false rejection rates) + +### Microsoft Implementation + +The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10 October 2018 release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won’t be interoperable yet. + +Here's an approximate layout of where the Microsoft bits go: + +:::image type="content" source="images/webauthnapis/webauthnapis-fido2-overview-msft-version.png" alt-text="The diagram shows how the WebAuthn API interacts with the Microsoft relying parties and the CTAPI2 API."::: + +*Microsoft's implementation of WebAuthn and CATP2 APIs* + +- **WebAuthn relying party: Microsoft Account**. If you aren’t familiar with Microsoft Account, it's the sign-in service for services such as Skype, Xbox, Outlook, and many other sites. The sign-in experience uses client-side JavaScript to trigger Microsoft Edge to talk to the WebAuthn APIs. Microsoft Account requires that authenticators have the following capabilities: + + - Keys are stored locally on the authenticator and not on a server somewhere + - Offline scenarios work (enabled by using HMAC) + - Users can put keys for multiple user accounts on the same authenticator + - If needed, authenticators can use a client PIN to unlock a TPM + > [!IMPORTANT] + > Because Microsoft Account requires features and extensions that are unique to FIDO2 CTAP2 authenticators, it doesn't accept CTAP1 (U2F) credentials. + +- **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes, and also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators, which means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol, so relying parties must use only the WebAuthn specification. Microsoft Edge on Android does't support WebAuthn. + + > [!NOTE] + > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](microsoft-edge/dev-guide/windows-integration/web-authentication). + +- **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. + +- **Roaming Authenticators**. You might notice that there's no “Microsoft” roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) have different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, you can find that at [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. From 7f9e14451094ba7a0f66b27f37f8bad6d3986f50 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 13:00:04 -0700 Subject: [PATCH 06/17] Link fixes --- .../identity-protection/hello-for-business/WebAuthnAPIs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index cfe779b0ec..f070f9fcc1 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -90,7 +90,7 @@ FIDO2 authenticators have already implemented and WebAuthn relying parties might - Keys for multiple accounts can be stored per relying party - Client PIN - Location (the authenticator returns a location) -- [Hash-based Message Authentication Code (HMAC)-secret](dotnet/api/system.security.cryptography.hmac) (enables offline scenarios) +- [Hash-based Message Authentication Code (HMAC)-secret](./dotnet/api/system.security.cryptography.hmac.md) (enables offline scenarios) The following options are cool and might be useful in the future, but haven't been seen in the wild yet: @@ -121,7 +121,7 @@ Here's an approximate layout of where the Microsoft bits go: - **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes, and also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators, which means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol, so relying parties must use only the WebAuthn specification. Microsoft Edge on Android does't support WebAuthn. > [!NOTE] - > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](microsoft-edge/dev-guide/windows-integration/web-authentication). + > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](./microsoft-edge/dev-guide/windows-integration/web-authentication.md). - **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. From 62af69f294157f5df85445a01cad6c32a890b215 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 13:07:13 -0700 Subject: [PATCH 07/17] Link fixes --- .../identity-protection/hello-for-business/WebAuthnAPIs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index f070f9fcc1..42c82937a4 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -90,7 +90,7 @@ FIDO2 authenticators have already implemented and WebAuthn relying parties might - Keys for multiple accounts can be stored per relying party - Client PIN - Location (the authenticator returns a location) -- [Hash-based Message Authentication Code (HMAC)-secret](./dotnet/api/system.security.cryptography.hmac.md) (enables offline scenarios) +- [Hash-based Message Authentication Code (HMAC)-secret](/dotnet/api/system.security.cryptography.hmac) (enables offline scenarios) The following options are cool and might be useful in the future, but haven't been seen in the wild yet: @@ -121,7 +121,7 @@ Here's an approximate layout of where the Microsoft bits go: - **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes, and also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators, which means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol, so relying parties must use only the WebAuthn specification. Microsoft Edge on Android does't support WebAuthn. > [!NOTE] - > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](./microsoft-edge/dev-guide/windows-integration/web-authentication.md). + > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](/microsoft-edge/dev-guide/windows-integration/web-authentication). - **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. From 36fb955526c177e6f613c340e06aeee9241d2073 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 13:33:15 -0700 Subject: [PATCH 08/17] Added to TOC --- .../hello-for-business/WebAuthnAPIs.md | 8 ++++---- .../identity-protection/hello-for-business/toc.yml | 2 ++ 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 42c82937a4..f5b734fcb3 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -32,10 +32,6 @@ Developers should use the new Windows 10 APIs to support FIDO2 authentication ke > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. -## Where can developers learn more? - -The new Windows 10 APIs are documented on [GitHub](https://github.com/Microsoft/webauthn) - ## All about FIDO2, CTAP2 and WebAuthn To understand how FIDO2 authenticators work, review the following two specifications: @@ -126,3 +122,7 @@ Here's an approximate layout of where the Microsoft bits go: - **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. - **Roaming Authenticators**. You might notice that there's no “Microsoft” roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) have different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, you can find that at [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. + +## Where can developers learn more? + +The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) Github repo. diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 1e3bd031b3..6453d6dc2b 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -21,6 +21,8 @@ href: hello-how-it-works-provisioning.md - name: Authentication href: hello-how-it-works-authentication.md + - name: WebAuthn APIs + href: webauthnapis.md - name: How-to Guides items: - name: Windows Hello for Business Deployment Overview From 14372c68b13bec28c27f6a16b48ac72b85c5d5f9 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Wed, 6 Jul 2022 14:10:23 -0700 Subject: [PATCH 09/17] integrating --- .../hello-for-business/WebAuthnAPIs.md | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index f5b734fcb3..73677209be 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -19,28 +19,20 @@ ms.reviewer: Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use passwordless authentication. -Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. +Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. ## What does this mean? Using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. -Users of these apps or sites can use any browser that supports WebAuthn Windows 10 APIs for passwordless authentication. The native Windows 10 WebAuthn APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. No matter which browser they use, they'll have a familiar and consistent experience on Windows 10, no matter which browser they use. +Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. -## All about FIDO2, CTAP2 and WebAuthn - -To understand how FIDO2 authenticators work, review the following two specifications: - -- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/), which is available at the W3C site. This document is known as the WebAuthn spec. - -- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of Fast IDentity Online). - -### The Big Picture +## The Big Picture CTAP2 and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Such authenticators include platform authenticators (which are built into the client device) or roaming authenticators (which connect to the client device by using USB, BLE, or NFC connections). @@ -77,7 +69,7 @@ A combined WebAuthn/CTAP2 dance includes the following cast of characters: Many relying parties and clients can interact with many authenticators on a single client device. A user can install multiple browsers that support WebAuthn, and might simultaneously have access to a built-in fingerprint reader, a plugged-in security key, and a BLE-enabled mobile app. -### Interoperability +## Interoperability Before there was WebAuthn and CTAP2, there was U2F and CTAP1. U2F is the FIDO Alliance’s universal second-factor specification and there are many authenticators that speak CTAP1 and manage U2F credentials. WebAuthn was designed to be interoperable with CTAP1 Authenticators. A relying party that uses WebAuthn can still use U2F credentials, as long as the relying party doesn't require FIDO2-only functionality. @@ -95,7 +87,7 @@ The following options are cool and might be useful in the future, but haven't be - User verification method (the authenticator returns the exact method) - Biometric performance bounds (the relying party can specify acceptable false acceptance and false rejection rates) -### Microsoft Implementation +## Microsoft Implementation The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10 October 2018 release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won’t be interoperable yet. @@ -125,4 +117,8 @@ Here's an approximate layout of where the Microsoft bits go: ## Where can developers learn more? -The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) Github repo. +The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) Github repo. To understand how FIDO2 authenticators work, review the following two specifications: + +- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/), which is available at the W3C site. This document is known as the WebAuthn spec. + +- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of Fast IDentity Online). From fc7945196d42e0aaa388e99d735135fee1938ca2 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Thu, 14 Jul 2022 13:40:19 -0700 Subject: [PATCH 10/17] Acronym check --- .../hello-for-business/WebAuthnAPIs.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 6df213bf6c..7720a79122 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -23,14 +23,14 @@ Using these APIs, developer partners and the developer community can use [Window Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. -Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. +Developers should use the new Windows 10 APIs to support Fast IDentity Online 2 (FIDO2) authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. ## The Big Picture -CTAP2 and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Such authenticators include platform authenticators (which are built into the client device) or roaming authenticators (which connect to the client device by using USB, BLE, or NFC connections). +Client to Authenticator Protocol 2 (CTAP2) and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Such authenticators include platform authenticators (which are built into the client device) or roaming authenticators (which connect to the client device by using USB, BLE, or NFC connections). The authentication process starts when the user performs a specific user gesture that indicates consent for the operation. At the request of the client, the authenticator securely creates strong cryptographic keys and locally stores them. @@ -113,8 +113,8 @@ Here's an approximate layout of where the Microsoft bits go: ## Where can developers learn more? -The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) Github repo. To understand how FIDO2 authenticators work, review the following two specifications: +The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: - [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/), which is available at the W3C site. This document is known as the WebAuthn spec. -- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of Fast IDentity Online). +- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of FIDO authentication). From 58296a1117f08a63b77bf9b7a7c7415dafb56b4b Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Thu, 14 Jul 2022 14:37:13 -0700 Subject: [PATCH 11/17] Acronym fix --- .../identity-protection/hello-for-business/WebAuthnAPIs.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 7720a79122..ba33c54dc4 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -15,7 +15,7 @@ ms.reviewer: Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use passwordless authentication. -Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/FIDO2 Win32 WebAuthn platform APIs. +Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/Fast IDentity Online 2 (FIDO2) Win32 WebAuthn platform APIs. ## What does this mean? @@ -23,7 +23,7 @@ Using these APIs, developer partners and the developer community can use [Window Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. -Developers should use the new Windows 10 APIs to support Fast IDentity Online 2 (FIDO2) authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. +Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. From ec925b7a2aff2e226bbc82fe666003dd3ed16107 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Fri, 15 Jul 2022 13:57:40 -0700 Subject: [PATCH 12/17] Edits --- .../hello-for-business/WebAuthnAPIs.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index ba33c54dc4..3141737937 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -13,28 +13,28 @@ ms.reviewer: --- # WebAuthn APIs for passwordless authentication on Windows -Passwords leave your customers vulnerable. When you use the new WebAuthn APIs in your sites and apps, your customers can use passwordless authentication. +Passwords can leave your customers vulnerable to data breaches and security attacks by malicious users. -Microsoft has long been a proponent of passwordless authentication. While we work towards that goal, we'd like to introduce you to the latest Windows 10 (version 1903) W3C/Fast IDentity Online 2 (FIDO2) Win32 WebAuthn platform APIs. +Microsoft has long been a proponent of passwordless authentication. With that goal in mind, we'd like to introduce the latest W3C/Fast IDentity Online 2 (FIDO2) Win32 WebAuthn platform APIs for Windows 10 (version 1903). -## What does this mean? +## What this means -Using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. +By using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. -Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10 1809 or later and on the latest versions of other browsers. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. +Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10, version 1809 and later versions and on the latest browse versions. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. -Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Moreover, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) without having to deal with the interaction and management overhead. +Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Additionally, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) while avoiding the interaction and management overhead. > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. -## The Big Picture +## The big picture -Client to Authenticator Protocol 2 (CTAP2) and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Such authenticators include platform authenticators (which are built into the client device) or roaming authenticators (which connect to the client device by using USB, BLE, or NFC connections). +Client to Authenticator Protocol 2 (CTAP2) and WebAuthn define an abstraction layer that creates an ecosystem for strongly authenticated credentials. In this ecosystem, any interoperable client (such as a native app or browser) that runs on a given client device uses a standardized method to interact with any interoperable authenticator. Interoperable authenticators include authenticators that are built into the client device (platform authenticators) and authenticators that connect to the client device by using USB, BLE, or NFC connections (roaming authenticators). -The authentication process starts when the user performs a specific user gesture that indicates consent for the operation. At the request of the client, the authenticator securely creates strong cryptographic keys and locally stores them. +The authentication process starts when the user makes a specific user gesture that indicates consent for the operation. At the request of the client, the authenticator securely creates strong cryptographic keys and stores them locally. -After these client-specific keys are created, clients can request attestations for registration and authentication. The type of signature performed by the private key reflects the user gesture that was performed. +After these client-specific keys are created, clients can request attestations for registration and authentication. The type of signature that the private key uses reflects the user gesture that was made. The following diagram shows how CTAP and WebAuthn interact. The light blue dotted arrows represent interactions that depend on the specific implementation of the platform APIs. @@ -44,7 +44,7 @@ The following diagram shows how CTAP and WebAuthn interact. The light blue dotte A combined WebAuthn/CTAP2 dance includes the following cast of characters: -- **Client device**. The *client device* is the hardware hosting a given strong authentication. Laptops and phones are examples of client devices. +- **Client device**. The *client device* is the hardware that hosts a given strong authentication. Laptops and phones are examples of client devices. - **Relying parties and clients**. *Relying parties* are web or native applications that consume strong credentials. The relying parties run on client devices. @@ -53,39 +53,39 @@ A combined WebAuthn/CTAP2 dance includes the following cast of characters: - As a relying party, a web application can't directly interact with the WebAuthn API. The relying party must broker the deal through the browser. > [!NOTE] - > The preceding diagram doesn't depict single sign-on authentication. Don't confuse FIDO relying parties with federated relying parties. + > The preceding diagram doesn't depict single sign-on authentication. Be careful not to confuse FIDO relying parties with federated relying parties. -- **WebAuthn API**. The *WebAuthn API* enables clients to make requests to authenticators. The client can request that the authenticator create a key, provide an assertion about a key, report capabilities, manage a PIN, and so forth. +- **WebAuthn API**. The *WebAuthn API* enables clients to make requests to authenticators. The client can request that the authenticator create a key, provide an assertion about a key, report capabilities, manage a PIN, and so on. -- **CTAP2 platform/host**. The *platform* (also called the host in the CTAP2 spec) is the part of the client device that negotiates with authenticators. The platform is responsible for securely reporting the origin of the request and for calling the CTAP2 Concise Binary Object Representation (CBOR) APIs. If the platform isn't CTAP2-aware, the clients themselves take on more of the burden and the internals of the preceding diagram may differ. +- **CTAP2 platform/host**. The *platform* (also called the host in the CTAP2 spec) is the part of the client device that negotiates with authenticators. The platform is responsible for securely reporting the origin of the request and for calling the CTAP2 Concise Binary Object Representation (CBOR) APIs. If the platform isn't CTAP2-aware, the clients themselves take on more of the burden. In this case, the components and interactions of the preceding diagram may differ. -- **Platform authenticator**. A *platform authenticator* usually resides on a client device. Examples of platform authenticators include fingerprint recognition technology that uses a built-in laptop fingerprint reader or facial recognition technology that uses a built-in smartphone camera. Cross-platform transport protocols such as USB, NFC or BLE can't access platform authenticators. +- **Platform authenticator**. A *platform authenticator* usually resides on a client device. Examples of platform authenticators include fingerprint recognition technology that uses a built-in laptop fingerprint reader and facial recognition technology that uses a built-in smartphone camera. Cross-platform transport protocols such as USB, NFC or BLE can't access platform authenticators. -- **Roaming authenticator**. A *roaming authenticator* can connect to multiple client devices. Client devices must use a supported transport protocol to negotiate interactions. Examples of roaming authenticators include USB security keys, BLE-enabled smartphone applications, or NFC-enabled proximity cards. Roaming authenticators may support CTAP1, CTAP2, or both protocols. +- **Roaming authenticator**. A *roaming authenticator* can connect to multiple client devices. Client devices must use a supported transport protocol to negotiate interactions. Examples of roaming authenticators include USB security keys, BLE-enabled smartphone applications, and NFC-enabled proximity cards. Roaming authenticators can support CTAP1, CTAP2, or both protocols. Many relying parties and clients can interact with many authenticators on a single client device. A user can install multiple browsers that support WebAuthn, and might simultaneously have access to a built-in fingerprint reader, a plugged-in security key, and a BLE-enabled mobile app. ## Interoperability -Before there was WebAuthn and CTAP2, there was U2F and CTAP1. U2F is the FIDO Alliance’s universal second-factor specification and there are many authenticators that speak CTAP1 and manage U2F credentials. WebAuthn was designed to be interoperable with CTAP1 Authenticators. A relying party that uses WebAuthn can still use U2F credentials, as long as the relying party doesn't require FIDO2-only functionality. +Before there was WebAuthn and CTAP2, there was U2F and CTAP1. U2F is the FIDO Alliance universal second-factor specification. There are many authenticators that speak CTAP1 and manage U2F credentials. WebAuthn was designed to be interoperable with CTAP1 Authenticators. A relying party that uses WebAuthn can still use U2F credentials if the relying party doesn't require FIDO2-only functionality. FIDO2 authenticators have already implemented and WebAuthn relying parties might require the following optional features: -- Keys for multiple accounts can be stored per relying party +- Keys for multiple accounts (keys can be stored per relying party) - Client PIN - Location (the authenticator returns a location) - [Hash-based Message Authentication Code (HMAC)-secret](/dotnet/api/system.security.cryptography.hmac) (enables offline scenarios) -The following options are cool and might be useful in the future, but haven't been seen in the wild yet: +The following options and might be useful in the future, but haven't been observed in the wild yet: - Transactional approval - User verification index (servers can determine whether biometric data that's stored locally has changed over time) - User verification method (the authenticator returns the exact method) - Biometric performance bounds (the relying party can specify acceptable false acceptance and false rejection rates) -## Microsoft Implementation +## Microsoft implementation -The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10 October 2018 release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won’t be interoperable yet. +The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10, version 1809 (October 2018) release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won’t be interoperable yet. Here's an approximate layout of where the Microsoft bits go: @@ -93,28 +93,28 @@ Here's an approximate layout of where the Microsoft bits go: *Microsoft's implementation of WebAuthn and CATP2 APIs* -- **WebAuthn relying party: Microsoft Account**. If you aren’t familiar with Microsoft Account, it's the sign-in service for services such as Skype, Xbox, Outlook, and many other sites. The sign-in experience uses client-side JavaScript to trigger Microsoft Edge to talk to the WebAuthn APIs. Microsoft Account requires that authenticators have the following capabilities: +- **WebAuthn relying party: Microsoft Account**. If you aren’t familiar with Microsoft Account, it's the sign-in service for Skype, Xbox, Outlook, and many other sites. The sign-in experience uses client-side JavaScript to trigger Microsoft Edge to talk to the WebAuthn APIs. Microsoft Account requires that authenticators have the following characteristics: - - Keys are stored locally on the authenticator and not on a server somewhere + - Keys are stored locally on the authenticator and not on a remote server - Offline scenarios work (enabled by using HMAC) - Users can put keys for multiple user accounts on the same authenticator - - If needed, authenticators can use a client PIN to unlock a TPM + - If it's necessary, authenticators can use a client PIN to unlock a TPM > [!IMPORTANT] > Because Microsoft Account requires features and extensions that are unique to FIDO2 CTAP2 authenticators, it doesn't accept CTAP1 (U2F) credentials. -- **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes, and also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators, which means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol, so relying parties must use only the WebAuthn specification. Microsoft Edge on Android does't support WebAuthn. +- **WebAuthn client: Microsoft Edge**. Microsoft Edge can handle the user interface for the WebAuthn and CTAP2 features that this article describes. It also supports the AppID extension. Microsoft Edge can interact with both CTAP1 and CTAP2 authenticators. This means that it can create and use both U2F and FIDO2 credentials. However, Microsoft Edge doesn't speak the U2F protocol. Therefore, relying parties must use only the WebAuthn specification. Microsoft Edge on Android doesn't support WebAuthn. > [!NOTE] > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](/microsoft-edge/dev-guide/windows-integration/web-authentication). - **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. -- **Roaming Authenticators**. You might notice that there's no “Microsoft” roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) have different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, you can find that at [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. +- **Roaming Authenticators**. You might notice that there's no “Microsoft” roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) has different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, see [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. -## Where can developers learn more? +## Developer references The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: -- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/), which is available at the W3C site. This document is known as the WebAuthn spec. +- [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/) (available on the W3C site). This document is known as the WebAuthn spec. -- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html), which is available at the [FIDO Alliance](http://fidoalliance.org/) site. (where hardware and platform folks have joined to solve the problem of FIDO authentication). +- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html). This is available at the [FIDO Alliance](http://fidoalliance.org/) site. (on which hardware and platform teams are working together to solve the problem of FIDO authentication). From 6b4e40ec127ec03232c1efdeb99df25aa5ccdf5a Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 30 Aug 2022 10:36:02 -0400 Subject: [PATCH 13/17] updated text for Win11 --- .../hello-for-business/WebAuthnAPIs.md | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md index 5ea3f07aca..ebfeb9d088 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md @@ -9,21 +9,24 @@ ms.reviewer: prsriva ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 02/15/2019 +ms.date: 08/30/2022 +appliesto: +- ✅ Windows 10 +- ✅ Windows 11 --- # WebAuthn APIs for passwordless authentication on Windows Passwords can leave your customers vulnerable to data breaches and security attacks by malicious users. -Microsoft has long been a proponent of passwordless authentication. With that goal in mind, we'd like to introduce the latest W3C/Fast IDentity Online 2 (FIDO2) Win32 WebAuthn platform APIs for Windows 10 (version 1903). +Microsoft has long been a proponent of passwordless authentication, and introduced the W3C/Fast IDentity Online 2 (FIDO2) Win32 WebAuthn platform APIs in Windows 10 (version 1903). -## What this means +## What does this mean? -By using these APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. +By using WebAuthn APIs, developer partners and the developer community can use [Windows Hello](./index.yml) or [FIDO2 Security Keys](./microsoft-compatible-security-key.md) to implement passwordless multi-factor authentication for their applications on Windows devices. -Users of these apps or sites can use any browser that supports Windows 10 WebAuthn APIs for passwordless authentication. These APIs are currently supported by Microsoft Edge on Windows 10, version 1809 and later versions and on the latest browse versions. Users will have a familiar and consistent experience on Windows 10, no matter which browser they use. +Users of these apps or sites can use any browser that supports WebAuthn APIs for passwordless authentication. Users will have a familiar and consistent experience on Windows, no matter which browser they use. -Developers should use the new Windows 10 APIs to support FIDO2 authentication keys in a consistent way for users. Additionally, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) while avoiding the interaction and management overhead. +Developers should use the WebAuthn APIs to support FIDO2 authentication keys in a consistent way for users. Additionally, developers can use all the transports that are available per FIDO2 specifications (USB, NFC, and BLE) while avoiding the interaction and management overhead. > [!NOTE] > When these APIs are in use, Windows 10 browsers or apps don't have direct access to the FIDO2 transports for FIDO-related messaging. @@ -85,7 +88,7 @@ The following options and might be useful in the future, but haven't been observ ## Microsoft implementation -The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10, version 1809 (October 2018) release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won’t be interoperable yet. +The Microsoft FIDO2 implementation has been years in the making. Software and services are implemented independently as standards-compliant entities. As of the Windows 10, version 1809 (October 2018) release, all Microsoft components use the latest WebAuthn Candidate Release. It's a stable release that's not expected to normatively change before the specification is finally ratified. Because Microsoft is among the first in the world to deploy FIDO2, some combinations of popular non-Microsoft components won't be interoperable yet. Here's an approximate layout of where the Microsoft bits go: @@ -93,7 +96,7 @@ Here's an approximate layout of where the Microsoft bits go: *Microsoft's implementation of WebAuthn and CATP2 APIs* -- **WebAuthn relying party: Microsoft Account**. If you aren’t familiar with Microsoft Account, it's the sign-in service for Skype, Xbox, Outlook, and many other sites. The sign-in experience uses client-side JavaScript to trigger Microsoft Edge to talk to the WebAuthn APIs. Microsoft Account requires that authenticators have the following characteristics: +- **WebAuthn relying party: Microsoft Account**. If you aren't familiar with Microsoft Account, it's the sign-in service for Xbox, Outlook, and many other sites. The sign-in experience uses client-side JavaScript to trigger Microsoft Edge to talk to the WebAuthn APIs. Microsoft Account requires that authenticators have the following characteristics: - Keys are stored locally on the authenticator and not on a remote server - Offline scenarios work (enabled by using HMAC) @@ -107,14 +110,13 @@ Here's an approximate layout of where the Microsoft bits go: > [!NOTE] > For authoritative information about Microsoft Edge support for WebAuthn and CTAP, see [Legacy Microsoft Edge developer documentation](/microsoft-edge/dev-guide/windows-integration/web-authentication). -- **Platform: Windows 10**. Windows 10 hosts the Win32 Platform WebAuthn APIs. +- **Platform: Windows 10, Windows 11**. Windows 10 and Windows 11 host the Win32 Platform WebAuthn APIs. -- **Roaming Authenticators**. You might notice that there's no “Microsoft” roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) has different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, see [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. +- **Roaming Authenticators**. You might notice that there's no *Microsoft* roaming authenticator. That's because there's already a strong ecosystem of products that specialize in strong authentication, and every one of our customers (whether corporations or individuals) has different requirements for security, ease of use, distribution, and account recovery. To see the ever-growing list of FIDO2 certified authenticators, see [FIDO Certified Products](https://fidoalliance.org/certification/fido-certified-products/). The list includes built-in authenticators, roaming authenticators, and even chip manufacturers who have certified designs. ## Developer references -The new Windows 10 WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: +The WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: - [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/) (available on the W3C site). This document is known as the WebAuthn spec. - - [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html). This is available at the [FIDO Alliance](http://fidoalliance.org/) site. (on which hardware and platform teams are working together to solve the problem of FIDO authentication). From eb7740e97b057e7be7e2c1ea1c16a29c41087acb Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Tue, 30 Aug 2022 11:33:35 -0700 Subject: [PATCH 14/17] Filename changes, sentence fix --- windows/security/identity-protection/hello-for-business/toc.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 6453d6dc2b..6e71a47657 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -22,7 +22,7 @@ - name: Authentication href: hello-how-it-works-authentication.md - name: WebAuthn APIs - href: webauthnapis.md + href: webauthn-apis.md - name: How-to Guides items: - name: Windows Hello for Business Deployment Overview From b79437aa79448eed3b57a4dc93778663f57fe9a8 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Tue, 30 Aug 2022 11:34:16 -0700 Subject: [PATCH 15/17] File name changes & sentence fix --- ...authn-apis-fido2-overview-microsoft-version.png} | Bin .../webauthn-apis-fido2-overview.png} | Bin .../{WebAuthnAPIs.md => webauthn-apiIs.md} | 6 +++--- 3 files changed, 3 insertions(+), 3 deletions(-) rename windows/security/identity-protection/hello-for-business/images/{webauthnapis/webauthnapis-fido2-overview-msft-version.png => webauthn-apis/webauthn-apis-fido2-overview-microsoft-version.png} (100%) rename windows/security/identity-protection/hello-for-business/images/{webauthnapis/webauthnapis-fido2-overview.png => webauthn-apis/webauthn-apis-fido2-overview.png} (100%) rename windows/security/identity-protection/hello-for-business/{WebAuthnAPIs.md => webauthn-apiIs.md} (94%) diff --git a/windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview-msft-version.png b/windows/security/identity-protection/hello-for-business/images/webauthn-apis/webauthn-apis-fido2-overview-microsoft-version.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview-msft-version.png rename to windows/security/identity-protection/hello-for-business/images/webauthn-apis/webauthn-apis-fido2-overview-microsoft-version.png diff --git a/windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview.png b/windows/security/identity-protection/hello-for-business/images/webauthn-apis/webauthn-apis-fido2-overview.png similarity index 100% rename from windows/security/identity-protection/hello-for-business/images/webauthnapis/webauthnapis-fido2-overview.png rename to windows/security/identity-protection/hello-for-business/images/webauthn-apis/webauthn-apis-fido2-overview.png diff --git a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md b/windows/security/identity-protection/hello-for-business/webauthn-apiIs.md similarity index 94% rename from windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md rename to windows/security/identity-protection/hello-for-business/webauthn-apiIs.md index ebfeb9d088..d4721e84a1 100644 --- a/windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apiIs.md @@ -41,7 +41,7 @@ After these client-specific keys are created, clients can request attestations f The following diagram shows how CTAP and WebAuthn interact. The light blue dotted arrows represent interactions that depend on the specific implementation of the platform APIs. -:::image type="content" source="images/webauthnapis/webauthnapis-fido2-overview.png" alt-text="The diagram shows how the WebAuthn API interacts with the relying parties and the CTAPI2 API."::: +:::image type="content" source="images/webauthn-apis/webauthn-apis-fido2-overview.png" alt-text="The diagram shows how the WebAuthn API interacts with the relying parties and the CTAPI2 API."::: *Relationships of the components that participate in passwordless authentication* @@ -92,7 +92,7 @@ The Microsoft FIDO2 implementation has been years in the making. Software and se Here's an approximate layout of where the Microsoft bits go: -:::image type="content" source="images/webauthnapis/webauthnapis-fido2-overview-msft-version.png" alt-text="The diagram shows how the WebAuthn API interacts with the Microsoft relying parties and the CTAPI2 API."::: +:::image type="content" source="images/webauthn-apis/web-authnapis-fido2-overview-microsoft-version.png" alt-text="The diagram shows how the WebAuthn API interacts with the Microsoft relying parties and the CTAPI2 API."::: *Microsoft's implementation of WebAuthn and CATP2 APIs* @@ -119,4 +119,4 @@ Here's an approximate layout of where the Microsoft bits go: The WebAuthn APIs are documented in the [Microsoft/webauthn](https://github.com/Microsoft/webauthn) GitHub repo. To understand how FIDO2 authenticators work, review the following two specifications: - [Web Authentication: An API for accessing Public Key Credentials](https://www.w3.org/TR/webauthn/) (available on the W3C site). This document is known as the WebAuthn spec. -- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html). This is available at the [FIDO Alliance](http://fidoalliance.org/) site. (on which hardware and platform teams are working together to solve the problem of FIDO authentication). +- [Client to Authenticator Protocol (CTAP)](https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-client-to-authenticator-protocol-v2.0-id-20180227.html). This is available at the [FIDO Alliance](http://fidoalliance.org/) site, on which hardware and platform teams are working together to solve the problem of FIDO authentication. From a4e797755734c1fe87ffc5529aea2c2db19ecf55 Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Tue, 30 Aug 2022 11:43:11 -0700 Subject: [PATCH 16/17] Filename fixes --- .../hello-for-business/{webauthn-apiIs.md => webauthn-apis.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename windows/security/identity-protection/hello-for-business/{webauthn-apiIs.md => webauthn-apis.md} (99%) diff --git a/windows/security/identity-protection/hello-for-business/webauthn-apiIs.md b/windows/security/identity-protection/hello-for-business/webauthn-apis.md similarity index 99% rename from windows/security/identity-protection/hello-for-business/webauthn-apiIs.md rename to windows/security/identity-protection/hello-for-business/webauthn-apis.md index d4721e84a1..8926ad4417 100644 --- a/windows/security/identity-protection/hello-for-business/webauthn-apiIs.md +++ b/windows/security/identity-protection/hello-for-business/webauthn-apis.md @@ -92,7 +92,7 @@ The Microsoft FIDO2 implementation has been years in the making. Software and se Here's an approximate layout of where the Microsoft bits go: -:::image type="content" source="images/webauthn-apis/web-authnapis-fido2-overview-microsoft-version.png" alt-text="The diagram shows how the WebAuthn API interacts with the Microsoft relying parties and the CTAPI2 API."::: +:::image type="content" source="images/webauthn-apis/webauthn-apis-fido2-overview-microsoft-version.png" alt-text="The diagram shows how the WebAuthn API interacts with the Microsoft relying parties and the CTAPI2 API."::: *Microsoft's implementation of WebAuthn and CATP2 APIs* From 8e324e38d6dbadfef89da0c75ae78bff5b190b4c Mon Sep 17 00:00:00 2001 From: v-tappelgate <91994953+v-tappelgate@users.noreply.github.com> Date: Tue, 30 Aug 2022 11:52:38 -0700 Subject: [PATCH 17/17] filename change --- .openpublishing.redirection.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index da1fa1a88d..2c59b009f8 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,5 +1,10 @@ { "redirections": [ + { + "source_path": "windows/security/identity-protection/hello-for-business/WebAuthnAPIs.md", + "redirect_url": "/windows/security/windows/security/identity-protection/hello-for-business/webauthn-apis", + "redirect_document_id": false + }, { "source_path": "windows/application-management/manage-windows-mixed-reality.md", "redirect_url": "/windows/mixed-reality/enthusiast-guide/manage-windows-mixed-reality",