From e4d02b28712e667495f4d67ef8194e13904b99af Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 6 Nov 2023 12:11:52 -0500 Subject: [PATCH 01/21] Freshness - light review of legacy content --- education/index.yml | 2 +- education/windows/autopilot-reset.md | 32 +- .../set-up-shared-or-guest-pc.md | 2 +- windows/configuration/shared-pc-technical.md | 2 +- .../access-control/access-control.md | 2 +- .../smart-card-and-remote-desktop-services.md | 48 +-- .../smart-cards/smart-card-architecture.md | 214 ++++------ ...ertificate-requirements-and-enumeration.md | 268 +++++------- .../smart-card-debugging-information.md | 141 ++++--- ...card-group-policy-and-registry-settings.md | 390 ++++++++---------- ...how-smart-card-sign-in-works-in-windows.md | 19 +- ...rt-card-smart-cards-for-windows-service.md | 37 +- .../smart-card-tools-and-settings.md | 10 +- ...-windows-smart-card-technical-reference.md | 49 +-- 14 files changed, 518 insertions(+), 698 deletions(-) diff --git a/education/index.yml b/education/index.yml index a41a668122..a79c5f8617 100644 --- a/education/index.yml +++ b/education/index.yml @@ -8,7 +8,7 @@ metadata: title: Microsoft 365 Education Documentation description: Learn about product documentation and resources available for school IT administrators, teachers, students, and education app developers. ms.topic: hub-page - ms.date: 08/10/2022 + ms.date: 11/06/2023 productDirectory: title: For IT admins diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 0c9591c71b..996188d7bf 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -15,7 +15,7 @@ ms.collection: IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Microsoft Entra ID and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. -To enable Autopilot Reset you must: +To enable Autopilot Reset, you must: 1. [Enable the policy for the feature](#enable-autopilot-reset) 2. [Trigger a reset for each device](#trigger-autopilot-reset) @@ -38,7 +38,7 @@ You can set the policy using one of these methods: - Value: 0 - Windows Configuration Designer - + You can [use Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) to set the **Runtime settings > Policies > CredentialProviders > DisableAutomaticReDeploymentCredentials** setting and create a provisioning package. - Set up School PCs app @@ -62,14 +62,13 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo **To trigger Autopilot Reset** -1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. +1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) - This keystroke will open up a custom sign-in screen for Autopilot Reset. The screen serves two purposes: + This keystroke opens up a custom sign-in screen for Autopilot Reset. The screen serves two purposes: 1. Confirm/verify that the end user has the right to trigger Autopilot Reset - 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) @@ -80,35 +79,26 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo > To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. Once Autopilot Reset is triggered, the reset process starts. - + After reset, the device: - - Sets the region, language, and keyboard. - - - Connects to Wi-Fi. - - - If you provided a provisioning package when Autopilot Reset is triggered, the system will apply this new provisioning package. Otherwise, the system will reapply the original provisioning package on the device. - + - Sets the region, language, and keyboard + - Connects to Wi-Fi + - If you provided a provisioning package when Autopilot Reset is triggered, the system applies this new provisioning package. Otherwise, the system reapplies the original provisioning package on the device - Is returned to a known good managed state, connected to Microsoft Entra ID and MDM. ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) Once provisioning is complete, the device is again ready for use. - - ## Troubleshoot Autopilot Reset -Autopilot Reset will fail when the [Windows Recovery Environment (WinRE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) isn't enabled on the device. You'll see `Error code: ERROR_NOT_SUPPORTED (0x80070032)`. +Autopilot Reset fails when the [Windows Recovery Environment (WinRE)](/windows-hardware/manufacture/desktop/windows-recovery-environment--windows-re--technical-reference) isn't enabled on the device. The error code is: `ERROR_NOT_SUPPORTED (0x80070032)`. To make sure WinRE is enabled, use the [REAgentC.exe tool](/windows-hardware/manufacture/desktop/reagentc-command-line-options) to run the following command: -```console -reagentc /enable +```cmd +reagentc.exe /enable ``` If Autopilot Reset fails after enabling WinRE, or if you're unable to enable WinRE, kindly contact [Microsoft Support](https://support.microsoft.com) for assistance. - -## Related articles - -[Set up Windows devices for education](set-up-windows-10.md) diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index c8ef487740..6d7f554aea 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -1,7 +1,7 @@ --- title: Set up a shared or guest Windows device description: Description of how to configured Shared PC mode, which is a Windows feature that optimizes devices for shared use scenarios. -ms.date: 10/15/2022 +ms.date: 11/06/2023 ms.prod: windows-client ms.technology: itpro-configure ms.topic: reference diff --git a/windows/configuration/shared-pc-technical.md b/windows/configuration/shared-pc-technical.md index b0d626cff0..2c55e09d27 100644 --- a/windows/configuration/shared-pc-technical.md +++ b/windows/configuration/shared-pc-technical.md @@ -1,7 +1,7 @@ --- title: Shared PC technical reference description: List of policies and settings applied by the Shared PC options. -ms.date: 10/15/2022 +ms.date: 11/06/2023 ms.prod: windows-client ms.technology: itpro-configure ms.topic: reference diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index 0cc106f7cb..5ab8ca8c5f 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,5 +1,5 @@ --- -ms.date: 11/22/2022 +ms.date: 11/06/2023 title: Access Control Overview description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. ms.topic: overview diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 35ace33d60..2f0dcd3354 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,5 +1,5 @@ --- -ms.date: 09/24/2021 +ms.date: 11/06/2023 title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. ms.topic: conceptual @@ -13,9 +13,8 @@ Smart card redirection logic and **WinSCard** API are combined to support multip Smart card support is required to enable many Remote Desktop Services scenarios. These include: -- Using Fast User Switching or Remote Desktop Services. A user is not able to establish a redirected smart card-based remote desktop connection. That is, the connect attempt is not successful in Fast User Switching or from a Remote Desktop Services session. - -- Enabling Encrypting File System (EFS) to locate the user's smart card reader from the Local Security Authority (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS is not able to locate the smart card reader or certificate, EFS cannot decrypt user files. +- Using Fast User Switching or Remote Desktop Services. A user is not able to establish a redirected smart card-based remote desktop connection. That is, the connect attempt is not successful in Fast User Switching or from a Remote Desktop Services session +- Enabling Encrypting File System (EFS) to locate the user's smart card reader from the Local Security Authority (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS is not able to locate the smart card reader or certificate, EFS cannot decrypt user files ## Remote Desktop Services redirection @@ -23,23 +22,16 @@ In a Remote Desktop scenario, a user is using a remote server for running servic ![Smart card service redirects to smart card reader.](images/sc-image101.png) -**Remote Desktop redirection** +### Remote Desktop redirection Notes about the redirection model: -1. This scenario is a remote sign-in session on a computer with Remote Desktop Services. In the remote session (labeled as "Client session"), the user runs **net use /smartcard**. - -2. Arrows represent the flow of the PIN after the user types the PIN at the command prompt until it reaches the user's smart card in a smart card reader that is connected to the Remote Desktop Connection (RDC) client computer. - -3. The authentication is performed by the LSA in session 0. - -4. The CryptoAPI processing is performed in the LSA (Lsass.exe). This is possible because RDP redirector (rdpdr.sys) allows per-session, rather than per-process, context. - -5. The WinScard and SCRedir components, which were separate modules in operating systems earlier than Windows Vista, are now included in one module. The ScHelper library is a CryptoAPI wrapper that is specific to the Kerberos protocol. - -6. The redirection decision is made on a per smart card context basis, based on the session of the thread that performs the SCardEstablishContext call. - -7. Changes to WinSCard.dll implementation were made in Windows Vista to improve smart card redirection. +1. This scenario is a remote sign-in session on a computer with Remote Desktop Services. In the remote session (labeled as "Client session"), the user runs `net use /smartcard` +1. Arrows represent the flow of the PIN after the user types the PIN at the command prompt until it reaches the user's smart card in a smart card reader that is connected to the Remote Desktop Connection (RDC) client computer +1. The authentication is performed by the LSA in session 0 +1. The CryptoAPI processing is performed in the LSA (`lsass.exe`). This is possible because RDP redirector (`rdpdr.sys`) allows per-session, rather than per-process, context +1. The ScHelper library is a CryptoAPI wrapper that is specific to the Kerberos protocol +1. The redirection decision is made on a per smart card context basis, based on the session of the thread that performs the `SCardEstablishContext` call ## RD Session Host server single sign-in experience @@ -57,13 +49,17 @@ In addition, Group Policy settings that are specific to Remote Desktop Services To enable smart card sign-in to a Remote Desktop Session Host (RD Session Host) server, the Key Distribution Center (KDC) certificate must be present on the RDC client computer. If the computer is not in the same domain or workgroup, the following command can be used to deploy the certificate: -**certutil -dspublish NTAuthCA** "*DSCDPContainer*" +```cmd +certutil.exe -dspublish NTAuthCA "DSCDPContainer" +``` -The *DSCDPContainer* Common Name (CN) is usually the name of the certification authority. +The `DSCDPContainer` Common Name (CN) is usually the name of the certification authority. Example: -**certutil -dspublish NTAuthCA** <*CertFile*> **"CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=engineering,DC=contoso,DC=com"** +```cmd +certutil -dspublish NTAuthCA "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=engineering,DC=contoso,DC=com" +``` For information about this option for the command-line tool, see [-dsPublish](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_dsPublish). @@ -71,15 +67,19 @@ For information about this option for the command-line tool, see [-dsPublish](/p To enable remote access to resources in an enterprise, the root certificate for the domain must be provisioned on the smart card. From a computer that is joined to a domain, run the following command at the command line: -**certutil -scroots update** +```cmd +certutil.exe -scroots update +``` For information about this option for the command-line tool, see [-SCRoots](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_SCRoots). For Remote Desktop Services across domains, the KDC certificate of the RD Session Host server must also be present in the client computer's NTAUTH store. To add the store, run the following command at the command line: -**certutil -addstore -enterprise NTAUTH** <*CertFile*> +```cmd +certutil -addstore -enterprise NTAUTH +``` -Where <*CertFile*> is the root certificate of the KDC certificate issuer. +Where *CertFile* is the root certificate of the KDC certificate issuer. For information about this option for the command-line tool, see [-addstore](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_addstore). diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index f66eedf547..786822878b 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -3,7 +3,7 @@ title: Smart Card Architecture description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. ms.reviewer: ardenw ms.topic: reference-architecture -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Smart Card Architecture @@ -16,25 +16,20 @@ In a networking context, authentication is the act of proving identity to a netw For smart cards, Windows supports a provider architecture that meets the secure authentication requirements and is extensible so that you can include custom credential providers. This topic includes information about: -- [Credential provider architecture](#credential-provider-architecture) - -- [Smart card subsystem architecture](#smart-card-subsystem-architecture) - - +- [Credential provider architecture](#credential-provider-architecture) +- [Smart card subsystem architecture](#smart-card-subsystem-architecture) ## Credential provider architecture The following table lists the components that are included in the interactive sign-in architecture of the Windows Server and Windows operating systems. -| **Component** | **Description** | -|------------------------------------------------|-----| -| Winlogon | Provides an interactive sign-in infrastructure. | -| Logon UI | Provides interactive UI rendering. | -| Credential providers (password and smart card) | Describes credential information and serializing credentials. | -| Local Security Authority (LSA) | Processes sign-in credentials. | -| Authentication packages | Includes NTLM and the Kerberos protocol. Communicates with server authentication packages to authenticate users. | +| Component | Description | +|--|--| +| Winlogon | Provides an interactive sign-in infrastructure. | +| Logon UI | Provides interactive UI rendering. | +| Credential providers (password and smart card) | Describes credential information and serializing credentials. | +| Local Security Authority (LSA) | Processes sign-in credentials. | +| Authentication packages | Includes NTLM and the Kerberos protocol. Communicates with server authentication packages to authenticate users. | Interactive sign-in in Windows begins when the user presses CTRL+ALT+DEL. The CTRL+ALT+DEL key combination is called a secure attention sequence (SAS). To keep other programs and processes from using it, Winlogon registers this sequence during the boot process. @@ -42,8 +37,6 @@ After receiving the SAS, the UI then generates the sign-in tile from the informa ![Credential provider architecture.](images/sc-image201.gif) -**Figure 1**  **Credential provider architecture** - Typically, a user who signs in to a computer by using a local account or a domain account must enter a user name and password. These credentials are used to verify the user's identity. For smart card sign-in, a user's credentials are contained on the smart card's security chip. A smart card reader lets the computer interact with the security chip on the smart card. When users sign in with a smart card, they enter a personal identification number (PIN) instead of a user name and password. Credential providers are in-process COM objects that run on the local system and are used to collect credentials. The Logon UI provides interactive UI rendering, Winlogon provides interactive sign-in infrastructure, and credential providers work with both of these components to help gather and process credentials. @@ -52,7 +45,8 @@ Winlogon instructs the Logon UI to display credential provider tiles after it re Combined with supporting hardware, credential providers can extend the Windows operating system to enable users to sign in by using biometrics (for example, fingerprint, retinal, or voice recognition), password, PIN, smart card certificate, or any custom authentication package. Enterprises and IT professionals can develop and deploy custom authentication mechanisms for all domain users, and they may explicitly require users to use this custom sign-in mechanism. -> **Note**  Credential providers are not enforcement mechanisms. They are used to gather and serialize credentials. The LSA and authentication packages enforce security. +> [!NOTE] +> Credential providers are not enforcement mechanisms. They are used to gather and serialize credentials. The LSA and authentication packages enforce security. Credential providers can be designed to support single sign-in (SSO). In this process, they authenticate users to a secure network access point (by using RADIUS and other technologies) for signing in to the computer. Credential providers are also designed to support application-specific credential gathering, and they can be used for authentication to network resources, joining computers to a domain, or to provide administrator consent for User Account Control (UAC). @@ -60,13 +54,14 @@ Multiple credential providers can coexist on a computer. Credential providers must be registered on a computer running Windows, and they are responsible for: -- Describing the credential information that is required for authentication. +- Describing the credential information that is required for authentication +- Handling communication and logic with external authentication authorities +- Packaging credentials for interactive and network sign-in -- Handling communication and logic with external authentication authorities. - -- Packaging credentials for interactive and network sign-in. - -> **Note**  The Credential Provider API does not render the UI. It describes what needs to be rendered.
Only the password credential provider is available in safe mode.
The smart card credential provider is available in safe mode during networking. +> [!NOTE] +> The Credential Provider API does not render the UI. It describes what needs to be rendered.\ +> Only the password credential provider is available in safe mode.\ +> The smart card credential provider is available in safe mode during networking. ## Smart card subsystem architecture @@ -74,19 +69,16 @@ Vendors provide smart cards and smart card readers, and in many cases the vendor ### Base CSP and smart card minidriver architecture -Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Card Base Cryptographic Service Provider (Base CSP), and smart card minidrivers. +The following graphic shows the relationship between the CryptoAPI, CSPs, the Smart Card Base Cryptographic Service Provider (Base CSP), and smart card minidrivers. ![Base CSP and smart card minidriver architecture.](images/sc-image203.gif) -**Figure 2**  **Base CSP and smart card minidriver architecture** - ### Caching with Base CSP and smart card KSP Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user's access to a PIN. -- [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations. - -- [PIN caching](#pin-caching): The PIN cache helps the user from having to reenter a PIN each time the smart card is unauthenticated. +- [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations +- [PIN caching](#pin-caching): The PIN cache helps the user from having to reenter a PIN each time the smart card is unauthenticated #### Data caching @@ -94,13 +86,10 @@ Each CSP implements the current smart card data cache separately. The Base CSP i The existing global cache works as follows: -1. The application requests a cryptographic operation. For example, a user certificate is to be read from the smart card. - -2. The CSP checks its cache for the item. - -3. If the item is not found in the cache, or if the item is cached but is not up-to-date, the item is read from the smart card. - -4. After any item has been read from the smart card, it is added to the cache. Any existing out-of-date copy of that item is replaced. +1. The application requests a cryptographic operation. For example, a user certificate is to be read from the smart card +1. The CSP checks its cache for the item +1. If the item is not found in the cache, or if the item is cached but is not up-to-date, the item is read from the smart card +1. After any item has been read from the smart card, it is added to the cache. Any existing out-of-date copy of that item is replaced Three types of objects or data are cached by the CSP: pins (for more information, see [PIN caching](#pin-caching)), certificates, and files. If any of the cached data changes, the corresponding object is read from the smart card in successive operations. For example, if a file is written to the smart card, the CSP cache becomes out-of-date for the files, and other processes read the smart card at least once to refresh their CSP cache. @@ -114,19 +103,13 @@ To mitigate this, the smart card enters an exclusive state when an application a The following example illustrates how this works. In this scenario, there are two applications: Outlook and Internet Explorer. The applications use smart cards for different purposes. -1. The user starts Outlook and tries to send a signed e-mail. The private key is on the smart card. - -2. Outlook prompts the user for the smart card PIN. The user enters the correct PIN. - -3. E-mail data is sent to the smart card for the signature operation. The Outlook client formats the response and sends the e-mail. - -4. The user opens Internet Explorer and tries to access a protected site that requires Transport Layer Security (TLS) authentication for the client. - -5. Internet Explorer prompts the user for the smart card PIN. The user enters the correct PIN. - -6. The TLS-related private key operation occurs on the smart card, and the user is authenticated and signed in. - -7. The user returns to Outlook to send another signed e-mail. This time, the user is not prompted for a PIN because the PIN is cached from the previous operation. Similarly, if the user uses Internet Explorer again for another operation, Internet Explorer will not prompt the user for a PIN. +1. The user starts Outlook and tries to send a signed e-mail. The private key is on the smart card +1. Outlook prompts the user for the smart card PIN. The user enters the correct PIN +1. E-mail data is sent to the smart card for the signature operation. The Outlook client formats the response and sends the e-mail +1. The user opens Internet Explorer and tries to access a protected site that requires Transport Layer Security (TLS) authentication for the client +1. Internet Explorer prompts the user for the smart card PIN. The user enters the correct PIN +1. The TLS-related private key operation occurs on the smart card, and the user is authenticated and signed in +1. The user returns to Outlook to send another signed e-mail. This time, the user is not prompted for a PIN because the PIN is cached from the previous operation. Similarly, if the user uses Internet Explorer again for another operation, Internet Explorer will not prompt the user for a PIN The Base CSP internally maintains a per-process cache of the PIN. The PIN is encrypted and stored in memory. The functions that are used to secure the PIN are RtlEncryptMemory, RtlDecryptMemory, and RtlSecureZeroMemory, which will empty buffers that contained the PIN. @@ -134,27 +117,17 @@ The Base CSP internally maintains a per-process cache of the PIN. The PIN is enc The following sections in this topic describe how Windows leverages the smart card architecture to select the correct smart card reader software, provider, and credentials for a successful smart card sign-in: -- [Container specification levels](#container-specification-levels) - -- [Container operations](#container-operations) - -- [Context flags](#context-flags) - -- [Create a new container in silent context](#create-a-new-container-in-silent-context) - -- [Smart card selection behavior](#smart-card-selection-behavior) - -- [Make a smart card reader match](#make-a-smart-card-reader-match) - -- [Make a smart card match](#make-a-smart-card-match) - -- [Open an existing default container (no reader specified)](#open-an-existing-default-container-no-reader-specified) - -- [Open an existing GUID-named container (no reader specified)](#open-an-existing-guid-named-container-no-reader-specified) - -- [Create a new container (no reader specified)](#create-a-new-container-no-reader-specified) - -- [Delete a container](#delete-a-container) +- [Container specification levels](#container-specification-levels) +- [Container operations](#container-operations) +- [Context flags](#context-flags) +- [Create a new container in silent context](#create-a-new-container-in-silent-context) +- [Smart card selection behavior](#smart-card-selection-behavior) +- [Make a smart card reader match](#make-a-smart-card-reader-match) +- [Make a smart card match](#make-a-smart-card-match) +- [Open an existing default container (no reader specified)](#open-an-existing-default-container-no-reader-specified) +- [Open an existing GUID-named container (no reader specified)](#open-an-existing-guid-named-container-no-reader-specified) +- [Create a new container (no reader specified)](#create-a-new-container-no-reader-specified) +- [Delete a container](#delete-a-container) #### Container specification levels @@ -162,13 +135,15 @@ In response to a CryptAcquireContext call in CryptoAPI, the Base CSP tries to ma Similarly, in response to a NCryptOpenKey call in CNG, the smart card KSP tries to match the container the same way, and it takes the same container format, as shown in the following table. -> **Note**  Before opening a key by using the smart card KSP, a call to NCryptOpenStorageProvider (MS\_SMART\_CARD\_KEY\_STORAGE\_PROVIDER) must be made. +> **Note**   +> [!NOTE] +> Before opening a key by using the smart card KSP, a call to NCryptOpenStorageProvider (`MS\_SMART\_CARD\_KEY\_STORAGE\_PROVIDER`) must be made. | **Type** | **Name** | **Format** | |----------|----------|------------| -| I | Reader Name and Container Name | \\\\.\\<Reader Name>\\<Container Name> | -| II | Reader Name and Container Name (NULL) | \\\\.\\<Reader Name> | -| III | Container Name Only | <Container Name> | +| I | Reader Name and Container Name | `\\\\.\\\\` | +| II | Reader Name and Container Name (NULL) | `\\\\.\\` | +| III | Container Name Only | `` | | IV | Default Container (NULL) Only | NULL | The Base CSP and smart card KSP cache smart card handle information about the calling process and about the smart cards the process has accessed. When searching for a smart card container, the Base CSP or smart card KSP first checks its cache for the process. If the cached handle is invalid or no match is found, the SCardUIDlg API is called to get the card handle. @@ -177,11 +152,9 @@ The Base CSP and smart card KSP cache smart card handle information about the ca The following three container operations can be requested by using CryptAcquireContext: -1. Create a new container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_NEWKEYSET is NCryptCreatePersistedKey.) - -2. Open an existing container. (The CNG equivalent of CryptAcquireContext to open the container is NCryptOpenKey.) - -3. Delete a container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_DELETEKEYSET is NCryptDeleteKey.) +1. Create a new container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_NEWKEYSET is NCryptCreatePersistedKey.) +1. Open an existing container. (The CNG equivalent of CryptAcquireContext to open the container is NCryptOpenKey.) +1. Delete a container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_DELETEKEYSET is NCryptDeleteKey.) The heuristics that are used to associate a cryptographic handle with a particular smart card and reader are based on the container operation requested and the level of container specification used. @@ -210,24 +183,18 @@ In addition to container operations and container specifications, you must consi Applications can call the Base CSP with CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL, set the PIN in silent context, and then create a new container in silent context. This operation occurs as follows: -1. Call CryptAcquireContext by passing the smart card reader name in as a type II container specification level, and specifying the CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL flag. - -2. Call CryptSetProvParam by specifying PP\_KEYEXCHANGE\_PIN or PP\_SIGNATURE\_PIN and a null-terminated ASCII PIN. - -3. Release the context acquired in Step 1. - -4. Call CryptAcquireContext with CRYPT\_NEWKEYSET, and specify the type I container specification level. - -5. Call CryptGenKey to create the key. +1. Call CryptAcquireContext by passing the smart card reader name in as a type II container specification level, and specifying the CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL flag. +1. Call CryptSetProvParam by specifying PP\_KEYEXCHANGE\_PIN or PP\_SIGNATURE\_PIN and a null-terminated ASCII PIN. +1. Release the context acquired in Step 1. +1. Call CryptAcquireContext with CRYPT\_NEWKEYSET, and specify the type I container specification level. +1. Call CryptGenKey to create the key. #### Smart card selection behavior -In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart in Figure 3 shows the selection steps performed by the Windows operating system. +In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart shows the selection steps performed by the Windows operating system. ![Smart card selection process.](images/sc-image205.png) -**Figure 3**  **Smart card selection behavior** - In general, smart card selection behavior is handled by the SCardUIDlgSelectCard API. The Base CSP interacts with this API by calling it directly. The Base CSP also sends callback functions that have the purpose of filtering and matching candidate smart cards. Callers of CryptAcquireContext provide smart card matching information. Internally, the Base CSP uses a combination of smart card serial numbers, reader names, and container names to find specific smart cards. Each call to SCardUI \* may result in additional information read from a candidate smart card. The Base CSP smart card selection callbacks cache this information. @@ -236,15 +203,11 @@ Each call to SCardUI \* may result in additional information read from a candida For type I and type II container specification levels, the smart card selection process is less complex because only the smart card in the named reader can be considered a match. The process for matching a smart card with a smart card reader is: -1. Find the requested smart card reader. If it cannot be found, the process fails. (This requires a cache search by reader name.) - -2. If no smart card is in the reader, the user is prompted to insert a smart card. (This is only in non-silent mode; if the call is made in silent mode, it will fail.) - -3. For container specification level II only, the name of the default container on the chosen smart card is determined. - -4. To open an existing container or delete an existing container, find the specified container. If the specified container cannot be found on this smart card, the user is prompted to insert a smart card. - -5. If the system attempts to create a new container, if the specified container already exists on this smart card, the process fails. +1. Find the requested smart card reader. If it cannot be found, the process fails. (This requires a cache search by reader name.) +1. If no smart card is in the reader, the user is prompted to insert a smart card. (This is only in non-silent mode; if the call is made in silent mode, it will fail.) +1. For container specification level II only, the name of the default container on the chosen smart card is determined. +1. To open an existing container or delete an existing container, find the specified container. If the specified container cannot be found on this smart card, the user is prompted to insert a smart card. +1. If the system attempts to create a new container, if the specified container already exists on this smart card, the process fails. #### Make a smart card match @@ -254,17 +217,16 @@ For container specification levels III and IV, a broader method is used to match > **Note**  This operation requires that you use the smart card with the Base CSP. -1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the Base CSP continues to search for a new smart card. - -2. If a matching smart card is not found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container. +1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the Base CSP continues to search for a new smart card. +1. If a matching smart card is not found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container. #### Open an existing GUID-named container (no reader specified) > **Note**  This operation requires that you use the smart card with the Base CSP. -1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the smart card's serial number is passed to the SCardUI \* API to continue searching for this specific smart card (rather than only a general match for the container name). +1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the smart card's serial number is passed to the SCardUI \* API to continue searching for this specific smart card (rather than only a general match for the container name). -2. If a matching smart card is not found in the Base CSP cache, a call is made to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name. +1. If a matching smart card is not found in the Base CSP cache, a call is made to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name. #### Create a new container (no reader specified) @@ -274,41 +236,31 @@ If the PIN is not cached, no CRYPT\_SILENT is allowed for the container creation For other operations, the caller may be able to acquire a "verify" context against the default container (CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL) and then make a call with CryptSetProvParam to cache the user PIN for subsequent operations. -1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: - - 1. If the smart card has been removed, continue the search. - - 2. If the smart card is present, but it already has the named container, continue the search. - - 3. If the smart card is available, but a call to CardQueryFreeSpace indicates that the smart card has insufficient storage for an additional key container, continue the search. - - 4. Otherwise, use the first available smart card that meets the above criteria for the container creation. - -2. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards verifies that a candidate smart card does not already have the named container, and that CardQueryFreeSpace indicates the smart card has sufficient space for an additional container. If no suitable smart card is found, the user is prompted to insert a smart card. +1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: + 1. If the smart card has been removed, continue the search + 1. If the smart card is present, but it already has the named container, continue the search + 1. If the smart card is available, but a call to CardQueryFreeSpace indicates that the smart card has insufficient storage for an additional key container, continue the search + 1. Otherwise, use the first available smart card that meets the above criteria for the container creation +1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards verifies that a candidate smart card does not already have the named container, and that CardQueryFreeSpace indicates the smart card has sufficient space for an additional container. If no suitable smart card is found, the user is prompted to insert a smart card #### Delete a container -1. If the specified container name is NULL, the default container is deleted. Deleting the default container causes a new default container to be selected arbitrarily. For this reason, this operation is not recommended. - -2. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: - - 1. If the smart card does not have the named container, continue the search. - - 2. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI \*. - -3. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was provided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card. +1. If the specified container name is NULL, the default container is deleted. Deleting the default container causes a new default container to be selected arbitrarily. For this reason, this operation is not recommended +1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: + 1. If the smart card does not have the named container, continue the search + 1. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI +1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card. ### Base CSP and KSP-based architecture in Windows -Figure 4 shows the Cryptography architecture that is used by the Windows operating system. +The following diagram shows the Cryptography architecture that is used by the Windows operating system. ![Cryptography architecture.](images/sc-image206.gif) -**Figure 4**  **Cryptography architecture** - ### Base CSP and smart card KSP properties in Windows -> **Note**  The API definitions are located in WinCrypt.h and WinSCard.h. +> [!NOTE] +> The API definitions are located in WinCrypt.h and WinSCard.h. | **Property** | **Description** | |-----------------------|------------------| @@ -328,4 +280,4 @@ If a smart card is registered by a CSP and a smart card minidriver, the one that CSPs and KSPs are meant to be written only if specific functionality is not available in the current smart card minidriver architecture. For example, the smart card minidriver architecture supports hardware security modules, so a minidriver could be written for a hardware security module, and a CSP or KSP may not be required unless it is needed to support algorithms that are not implemented in the Base CSP or smart card KSP. -For more information about how to write a smart card minidriver, CSP, or KSP, see [Smart Card Minidrivers](/windows-hardware/drivers/smartcard/smart-card-minidrivers). \ No newline at end of file +For more information about how to write a smart card minidriver, CSP, or KSP, see [Smart Card Minidrivers](/windows-hardware/drivers/smartcard/smart-card-minidrivers). diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 9931e52d1f..0311f04e6f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -3,7 +3,7 @@ title: Certificate Requirements and Enumeration description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. ms.reviewer: ardenw ms.topic: concept-article -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Certificate Requirements and Enumeration @@ -12,64 +12,38 @@ This topic for the IT professional and smart card developers describes how certi When a smart card is inserted, the following steps are performed. -> **Note**  Unless otherwise mentioned, all operations are performed silently (CRYPT\_SILENT is passed to CryptAcquireContext). +> [!NOTE] +> Unless otherwise mentioned, all operations are performed silently (CRYPT\_SILENT is passed to CryptAcquireContext). -1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). +1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). +1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\\\.\\<Reader name>\\ +1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. +1. The name of the container is retrieved by using the PP\_CONTAINER parameter with CryptGetProvParam. +1. Using the context acquired in Step 3, the CSP is queried for the PP\_USER\_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. +1. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT\_KEYEXCHANGE key. +1. The certificate is then queried from the key context by using KP\_CERTIFICATE. The certificate is added to an in-memory certificate store. +1. For each certificate in the certificate store from Step 5 or Step 7, the following checks are performed: -2. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\\\.\\<Reader name>*\\ - -3. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. - -4. The name of the container is retrieved by using the PP\_CONTAINER parameter with CryptGetProvParam. - -5. Using the context acquired in Step 3, the CSP is queried for the PP\_USER\_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. - -6. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT\_KEYEXCHANGE key. - -7. The certificate is then queried from the key context by using KP\_CERTIFICATE. The certificate is added to an in-memory certificate store. - -8. For each certificate in the certificate store from Step 5 or Step 7, the following checks are performed: - - 1. The certificate must be valid, based on the computer system clock (not expired or valid with a future date). - - 2. The certificate must not be in the AT\_SIGNATURE part of a container. - - 3. The certificate must have a valid user principal name (UPN). - - 4. The certificate must have the digital signature key usage. - - 5. The certificate must have the smart card logon EKU. + 1. The certificate must be valid, based on the computer system clock (not expired or valid with a future date). + 1. The certificate must not be in the AT\_SIGNATURE part of a container. + 1. The certificate must have a valid user principal name (UPN). + 1. The certificate must have the digital signature key usage. + 1. The certificate must have the smart card logon EKU. Any certificate that meets these requirements is displayed to the user with the certificate's UPN (or e-mail address or subject, depending on the presence of the certificate extensions). - > **Note**  These requirements are the same as those in Windows Server 2003, but they are performed before the user enters the PIN. You can override many of them by using Group Policy settings. + > [!NOTE] + > These requirements are the same as those in Windows Server 2003, but they are performed before the user enters the PIN. You can override many of them by using Group Policy settings. -9. The process then chooses a certificate, and the PIN is entered. - -10. LogonUI.exe packages the information and sends it to Lsass.exe to process the sign-in attempt. - -11. If successful, LogonUI.exe closes. This causes the context acquired in Step 3 to be released. - -## About Certificate support for compatibility - -Although versions of Windows earlier than Windows Vista include support for smart cards, the types of certificates that smart cards can contain are limited. The limitations are: - -- Each certificate must have a user principal name (UPN) and the smart card sign-in object identifier (also known as OID) in the extended key usage (EKU) attribute field. There is a Group Policy setting, Allow ECC certificates to be used for logon and authentication, to make the EKU optional. - -- Each certificate must be stored in the AT\_KEYEXCHANGE portion of the default CryptoAPI container, and non-default CryptoAPI containers are not supported. - -The following table lists the certificate support in older Windows operating system versions. - -| **Operating system** | **Certificate support** | -|---------------------------------------|----------------------------------------------------------------------------------------------------------| -| Windows Server 2008 R2 and Windows 7 | Support for smart card sign-in with ECC-based certificates. ECC smart card sign-in is enabled through Group Policy.

ECDH\_P256
ECDH
Curve P-256 from FIPS 186-2

ECDSA\_P256
ECDSA
Curve P-256 from FIPS 186-2

ECDH\_P384
ECDH
Curve P-384 from FIPS 186-2

ECDH\_P521
ECDH
Curve P-521 from FIPS 186-2

ECDSA\_P256
ECDH
Curve P-256 from FIPS 186-2

ECDSA\_P384
ECDSA
Curve P-384 from FIPS 186-2

ECDSA\_P521
ECDSA
Curve P-384 from FIPS 186-2 | -| Windows Server 2008 and Windows Vista | Valid certificates are enumerated and displayed from all smart cards and presented to the user.
Keys are no longer restricted to the default container, and certificates in different containers can be chosen.
Elliptic curve cryptography (ECC)-based certificates are not supported for smart card sign-in | +1. The process then chooses a certificate, and the PIN is entered. +1. LogonUI.exe packages the information and sends it to Lsass.exe to process the sign-in attempt. +1. If successful, LogonUI.exe closes. This causes the context acquired in Step 3 to be released. ## Smart card sign-in flow in Windows Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) does not reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. -Client certificates that do not contain a UPN in the **subjectAltName** (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. +Client certificates that do not contain a UPN in the `subjectAltName`` (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy. @@ -79,51 +53,39 @@ The following diagram illustrates how smart card sign-in works in the supported ![Smart card sign-in flow.](images/sc-image402.png) -**Smart card sign-in flow** +### Smart card sign-in flow Following are the steps that are performed during a smart card sign-in: 1. Winlogon requests the sign-in UI credential information. +1. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: + 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). + 1. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. + 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. -2. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: + > [!NOTE] + > Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. - 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). + 1. Notifies the sign-in UI that it has new credentials. - 2. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. +1. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. +1. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. +1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB\_CERTIFICATE\_LOGON structure. The main contents of the KERB\_CERTIFICATE\_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. +1. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. +1. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. +1. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB\_AS\_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). - 3. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. + If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.
If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. - > **Note**  Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. +1. To sign the request digitally (as per RFC 4556), a call is made to the corresponding CSP for a private key operation. Because the private key in this case is stored in a smart card, the smart card subsystem is called, and the necessary operation is completed. The result is sent back to the Kerberos security support provider (SSP). +1. The Kerberos SSP sends an authentication request for a ticket-granting-ticket (TGT) (per RFC 4556) to the Key Distribution Center (KDC) service that runs on a domain controller. +1. The KDC finds the user's account object in Active Directory Domain Services (AD DS), as detailed in [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings), and uses the user's certificate to verify the signature. +1. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. +1. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. +1. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. - 4. Notifies the sign-in UI that it has new credentials. - -3. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. - -4. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. - -5. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB\_CERTIFICATE\_LOGON structure. The main contents of the KERB\_CERTIFICATE\_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. - -6. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. - -7. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. - -8. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB\_AS\_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). - - If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.
If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. - -9. To sign the request digitally (as per RFC 4556), a call is made to the corresponding CSP for a private key operation. Because the private key in this case is stored in a smart card, the smart card subsystem is called, and the necessary operation is completed. The result is sent back to the Kerberos security support provider (SSP). - -10. The Kerberos SSP sends an authentication request for a ticket-granting-ticket (TGT) (per RFC 4556) to the Key Distribution Center (KDC) service that runs on a domain controller. - -11. The KDC finds the user's account object in Active Directory Domain Services (AD DS), as detailed in [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings), and uses the user's certificate to verify the signature. - -12. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. - -13. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. - -14. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. - - > **Note**  The KRB\_AS\_REP packet consists of: + > [!NOTE] + > The KRB\_AS\_REP packet consists of: >- Privilege attribute certificate (PAC) >- User's SID >- SIDs of any groups of which the user is a member @@ -132,21 +94,16 @@ Following are the steps that are performed during a smart card sign-in: TGT is encrypted with the master key of the KDC, and the session key is encrypted with a temporary key. This temporary key is derived based on RFC 4556. Using CryptoAPI, the temporary key is decrypted. As part of the decryption process, if the private key is on a smart card, a call is made to the smart card subsystem by using the specified CSP to extract the certificate corresponding to the user's public key. (Programmatic calls for the certificate include CryptAcquireContext, CryptSetProvParam with the PIN, CryptgetUserKey, and CryptGetKeyParam.) After the temporary key is obtained, the Kerberos SSP decrypts the session key. -15. The client validates the reply from the KDC (time, path, and revocation status). It first verifies the KDC's signature by the construction of a certification path from the KDC's certificate to a trusted root CA, and then it uses the KDC's public key to verify the reply signature. +1. The client validates the reply from the KDC (time, path, and revocation status). It first verifies the KDC's signature by the construction of a certification path from the KDC's certificate to a trusted root CA, and then it uses the KDC's public key to verify the reply signature. +1. Now that a TGT has been obtained, the client obtains a service ticket, which is used to sign in to the local computer. +1. With success, LSA stores the tickets and returns a success message to LSALogonUser. After this success message is issued, user profile for the device is selected and set, Group Policy refresh is instantiated, and other actions are performed. +1. After the user profile is loaded, the Certification Propagation Service (CertPropSvc) detects this event, reads the certificates from the smart card (including the root certificates), and then populates them into the user's certificate store (MYSTORE) +1. CSP to smart card resource manager communication happens on the LRPC Channel. +1. On successful authentication, certificates are propagated to the user's store asynchronously by the Certificate Propagation Service (CertPropSvc). +1. When the card is removed, certificates in the temporary secure cache store are removed. The Certificates are no longer available for sign-in, but they remain in the user's certificate store. -16. Now that a TGT has been obtained, the client obtains a service ticket, which is used to sign in to the local computer. - -17. With success, LSA stores the tickets and returns a success message to LSALogonUser. After this success message is issued, user profile for the device is selected and set, Group Policy refresh is instantiated, and other actions are performed. - -18. After the user profile is loaded, the Certification Propagation Service (CertPropSvc) detects this event, reads the certificates from the smart card (including the root certificates), and then populates them into the user's certificate store (MYSTORE). - -19. CSP to smart card resource manager communication happens on the LRPC Channel. - -20. On successful authentication, certificates are propagated to the user's store asynchronously by the Certificate Propagation Service (CertPropSvc). - -21. When the card is removed, certificates in the temporary secure cache store are removed. The Certificates are no longer available for sign-in, but they remain in the user's certificate store. - -> **Note**  A SID is created for each user or group at the time a user account or a group account is created within the local security accounts database or within AD DS. The SID never changes, even if the user or group account is renamed. +> [!NOTE] +> A SID is created for each user or group at the time a user account or a group account is created within the local security accounts database or within AD DS. The SID never changes, even if the user or group account is renamed. For more information about the Kerberos protocol, see [Microsoft Kerberos](/windows/win32/secauthn/microsoft-kerberos). @@ -156,11 +113,9 @@ By default, the KDC verifies that the client's certificate contains the smart ca Active Directory Certificate Services provides three kinds of certificate templates: -- Domain controller - -- Domain controller authentication - -- Kerberos authentication +- Domain controller +- Domain controller authentication +- Kerberos authentication Depending on the configuration of the domain controller, one of these types of certificates is sent as a part of the AS\_REP packet. @@ -172,57 +127,54 @@ Certificate requirements are listed by versions of the Windows operating system. The smart card certificate has specific format requirements when it is used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. - -| **Component** | **Requirements for Windows 8.1, Windows 8, Windows 7, Windows Vista, Windows 10, and Windows 11** | **Requirements for Windows XP** | -|--------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| CRL distribution point location | Not required | The location must be specified, online, and available, for example:
\[1\]CRL Distribution Point
Distribution Point Name:
Full Name:
URL=`` | -| Key usage | Digital signature | Digital signature | -| Basic constraints | Not required | \[Subject Type=End Entity, Path Length Constraint=None\] (Optional) | -| extended key usage (EKU) | The smart card sign-in object identifier is not required.

**Note**  If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | - Client Authentication (1.3.6.1.5.5.7.3.2)
The client authentication object identifier is required only if a certificate is used for SSL authentication.

- Smart Card Sign-in (1.3.6.1.4.1.311.20.2.2) | -| Subject alternative name | E-mail ID is not required for smart card sign-in. | Other Name: Principal Name=(UPN), for example:
UPN=user1@contoso.com
The UPN OtherName object identifier is 1.3.6.1.4.1.311.20.2.3.
The UPN OtherName value must be an ASN1-encoded UTF8 string. | -| Subject | Not required | Distinguished name of user. This field is a mandatory extension, but the population of this field is optional. | -| Key exchange (AT\_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | Not required | -| CRL | Not required | Not required | -| UPN | Not required | Not required | -| Notes | You can enable any certificate to be visible for the smart card credential provider. | There are two predefined types of private keys. These keys are Signature Only (AT\_SIGNATURE) and Key Exchange (AT\_KEYEXCHANGE). Smart card sign-in certificates must have a Key Exchange (AT\_KEYEXCHANGE) private key type. | +| Component | Requirements | +|--|--| +| CRL distribution point location | Not required | +| Key usage | Digital signature | +| Basic constraints | Not required | +| extended key usage (EKU) | The smart card sign-in object identifier is not required.

**Note** If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | +| Subject alternative name | E-mail ID is not required for smart card sign-in. | +| Subject | Not required | +| Key exchange (AT\_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | +| CRL | Not required | +| UPN | Not required | +| Notes | You can enable any certificate to be visible for the smart card credential provider. | ### Client certificate mappings Certificate mapping is based on the UPN that is contained in the subjectAltName (SAN) field of the certificate. Client certificates that do not contain information in the SAN field are also supported. -SSL/TLS can map certificates that do not have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: <I>"*<Issuer Name>*"<S>"*<Subject Name>*. The *<Issuer Name>* and *<Subject Name>* are taken from the client certificate, with '\\r' and '\\n' replaced with ','. +SSL/TLS can map certificates that do not have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: `` `` and `` are taken from the client certificate, with '\\r' and '\\n' replaced with ','. -**Certificate revocation list distribution points** +#### Certificate revocation list distribution points ![Certificate revocation list distribution points.](images/sc-image403.png) -**UPN in Subject Alternative Name field** +#### UPN in Subject Alternative Name field ![UPN in Subject Alternative Name field.](images/sc-image404.png) -**Subject and Issuer fields** +#### Subject and Issuer fields ![Subject and Issuer fields.](images/sc-image405.png) This account mapping is supported by the KDC in addition to six other mapping methods. The following figure demonstrates a flow of user account mapping logic that is used by the KDC. -**High-level flow of certificate processing for sign-in** +#### High-level flow of certificate processing for sign-in ![High-level flow of certificate processing for sign-in.](images/sc-image406.png) The certificate object is parsed to look for content to perform user account mapping. -- When a user name is provided with the certificate, the user name is used to locate the account object. This operation is the fastest, because string matching occurs. - -- When only the certificate object is provided, a series of operations are performed to locate the user name to map the user name to an account object. - -- When no domain information is available for authentication, the local domain is used by default. If any other domain is to be used for lookup, a domain name hint should be provided to perform the mapping and binding. +- When a user name is provided with the certificate, the user name is used to locate the account object. This operation is the fastest, because string matching occurs +- When only the certificate object is provided, a series of operations are performed to locate the user name to map the user name to an account object +- When no domain information is available for authentication, the local domain is used by default. If any other domain is to be used for lookup, a domain name hint should be provided to perform the mapping and binding Mapping based on generic attributes is not possible because there is no generic API to retrieve attributes from a certificate. Currently, the first method that locates an account successfully stops the search. But a configuration error occurs if two methods map the same certificate to different user accounts when the client does not supply the client name through the mapping hints. The following figure illustrates the process of mapping user accounts for sign-in in the directory by viewing various entries in the certificate. -**Certificate processing logic** +#### Certificate processing logic ![Certificate processing logic.](images/sc-image407.png) @@ -232,21 +184,17 @@ NT\_AUTH policy is best described in the CERT\_CHAIN\_POLICY\_NT\_AUTH parameter A single user certificate can be mapped to multiple accounts. For example, a user might be able to sign in to a user account and also to sign in as a domain administrator. The mapping is done by using the constructed AltSecID based on attributes from client accounts. For information about how this mapping is evaluated, see [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings). -> **Note**  Because each account has a different user name, we recommend that you enable the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) to provide the optional fields that allow users to enter their user names and domain information to sign in. +> [!NOTE] +> Because each account has a different user name, we recommend that you enable the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) to provide the optional fields that allow users to enter their user names and domain information to sign in. Based on the information that is available in the certificate, the sign-in conditions are: -1. If no UPN is present in the certificate: - - 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts. - - 2. A hint must be supplied if mapping is not unique (for example, if multiple users are mapped to the same certificate). - -2. If a UPN is present in the certificate: - - 1. The certificate cannot be mapped to multiple users in the same forest. - - 2. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user. +1. If no UPN is present in the certificate: + 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts + 1. A hint must be supplied if mapping is not unique (for example, if multiple users are mapped to the same certificate) +1. If a UPN is present in the certificate: + 1. The certificate cannot be mapped to multiple users in the same forest + 1. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user ## Smart card sign-in for multiple users into a single account @@ -258,9 +206,10 @@ For example, if Certificate1 has CN=CNName1, Certificate2 has CN=User1, and Cert ## Smart card sign-in across forests -For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\\user*, or a fully qualified UPN such as user@contoso.com. +For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\\user*, or a fully qualified UPN such as `user@contoso.com`. -> **Note**  For the hint field to appear during smart card sign-in, the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) must be enabled on the client. +> [!NOTE] +> For the hint field to appear during smart card sign-in, the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) must be enabled on the client. ## OCSP support for PKINIT @@ -274,40 +223,29 @@ Windows client computers attempt to request the OCSP responses and use them in t For sign-in to work in a smart card-based domain, the smart card certificate must meet the following conditions: -- The KDC root certificate on the smart card must have an HTTP CRL distribution point listed in its certificate. - -- The smart card sign-in certificate must have the HTTP CRL distribution point listed in its certificate. - -- The CRL distribution point must have a valid CRL published and a delta CRL, if applicable, even if the CRL distribution point is empty. - +- The KDC root certificate on the smart card must have an HTTP CRL distribution point listed in its certificate +- The smart card sign-in certificate must have the HTTP CRL distribution point listed in its certificate +- The CRL distribution point must have a valid CRL published and a delta CRL, if applicable, even if the CRL distribution point is empty - The smart card certificate must contain one of the following: - - - A subject field that contains the DNS domain name in the distinguished name. If it does not, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail. - - - A UPN where the domain name resolves to the actual domain. For example, if the domain name is Engineering.Corp.Contoso, the UPN is username@engineering.corp.contoso.com. If any part of the domain name is omitted, the Kerberos client cannot find the appropriate domain. + - A subject field that contains the DNS domain name in the distinguished name. If it does not, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail + - A UPN where the domain name resolves to the actual domain. For example, if the domain name is `Engineering.Corp.Contoso`, the UPN is `username@engineering.corp.contoso.com`. If any part of the domain name is omitted, the Kerberos client cannot find the appropriate domain Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system do not include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: -1. Enable HTTP CRL distribution points on the CA. - -2. Restart the CA. - -3. Reissue the KDC certificate. - -4. Issue or reissue the smart card sign-in certificate. - -5. Propagate the updated root certificate to the smart card that you want to use for the domain sign-in. +1. Enable HTTP CRL distribution points on the CA +1. Restart the CA +1. Reissue the KDC certificate +1. Issue or reissue the smart card sign-in certificate +1. Propagate the updated root certificate to the smart card that you want to use for the domain sign-in The workaround is to enable the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key), which allows the user to supply a hint in the credentials user interface for domain sign-in. -If the client computer is not joined to the domain or if it is joined to a different domain, the client computer can resolve the server domain only by looking at the distinguished name on the certificate, not the UPN. For this scenario to work, the certificate requires a full subject, including DC=*<DomainControllerName>*, for domain name resolution. +If the client computer is not joined to the domain or if it is joined to a different domain, the client computer can resolve the server domain only by looking at the distinguished name on the certificate, not the UPN. For this scenario to work, the certificate requires a full subject, including `DC=`, for domain name resolution. To deploy root certificates on a smart card for the currently joined domain, you can use the following command: -**certutil -scroots update** +```cmd +certutil.exe -scroots update +``` For more information about this option for the command-line tool, see [-SCRoots](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc732443(v=ws.11)#BKMK_SCRoots). - -## See also - -[How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md) diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 8193759010..ba68729da2 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -6,7 +6,7 @@ ms.collection: - highpri - tier2 ms.topic: troubleshooting -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Smart Card Troubleshooting @@ -15,17 +15,12 @@ This article explains tools and services that smart card developers can use to h Debugging and tracing smart card issues requires a variety of tools and approaches. The following sections provide guidance about tools and approaches you can use. -- [Certutil](#certutil) - -- [Debugging and tracing using Windows software trace preprocessor (WPP)](#debugging-and-tracing-using-wpp) - -- [Kerberos protocol, Key Distribution Center (KDC), and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) - -- [Smart Card service](#smart-card-service) - -- [Smart card readers](#smart-card-readers) - -- [CryptoAPI 2.0 Diagnostics](#cryptoapi-20-diagnostics) +- [Certutil](#certutil) +- [Debugging and tracing using Windows software trace preprocessor (WPP)](#debugging-and-tracing-using-wpp) +- [Kerberos protocol, Key Distribution Center (KDC), and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) +- [Smart Card service](#smart-card-service) +- [Smart card readers](#smart-card-readers) +- [CryptoAPI 2.0 Diagnostics](#cryptoapi-20-diagnostics) ## Certutil @@ -44,7 +39,7 @@ Each certificate is enclosed in a container. When you delete a certificate on th To find the container value, type `certutil -scinfo`. -To delete a container, type **certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider"** "<*ContainerValue*>". +To delete a container, type `certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider" ""`. ## Debugging and tracing using WPP @@ -54,9 +49,10 @@ WPP simplifies tracing the operation of the trace provider. It provides a mechan Using WPP, use one of the following commands to enable tracing: -- **tracelog.exe -kd -rt -start** <*FriendlyName*> **-guid \#**<*GUID*> **-f .\\**<*LogFileName*>**.etl -flags** <*flags*> **-ft 1** - -- **logman start** <*FriendlyName*> **-ets -p {**<*GUID*>**} -**<*Flags*> **-ft 1 -rt -o .\\**<*LogFileName*>**.etl -mode 0x00080000** +```cmd +tracelog.exe -kd -rt -start -guid \ -f .\\.etl -flags -ft 1 +logman start -ets -p {} - -ft 1 -rt -o .\\.etl -mode 0x00080000 +``` You can use the parameters in the following table. @@ -72,77 +68,91 @@ You can use the parameters in the following table. | `scfilter` | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | | `wudfusbccid` | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | -Examples +### Examples To enable tracing for the SCardSvr service: -- **tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1** +```cmd +tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1 +logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000 +``` -- **logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000** +To enable tracing for `scfilter.sys`: -To enable tracing for scfilter.sys: - - - **tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1** +```cmd +tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1 +``` ### Stop the trace Using WPP, use one of the following commands to stop the tracing: -- **tracelog.exe -stop** <*FriendlyName*> - -- **logman -stop** <*FriendlyName*> **-ets** +```cmd +tracelog.exe -stop <*FriendlyName*> +logman -stop <*FriendlyName*> -ets +``` #### Examples To stop a trace: -- **tracelog.exe -stop scardsvr** - -- **logman -stop scardsvr -ets** +```cmd +tracelog.exe -stop scardsvr +logman -stop scardsvr -ets +``` ## Kerberos protocol, KDC, and NTLM debugging and tracing - - You can use these resources to troubleshoot these protocols and the KDC: -- [Kerberos and LDAP Troubleshooting Tips](/previous-versions/tn-archive/bb463167(v=technet.10)). +- [Kerberos and LDAP Troubleshooting Tips](/previous-versions/tn-archive/bb463167(v=technet.10)) +- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit). You can use the trace log tool in this SDK to debug Kerberos authentication failures. -- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit).  You can use the trace log tool in this SDK to debug Kerberos authentication failures. - -To begin tracing, you can use `Tracelog`. Different components use different control GUIDs as explained in these examples. For more information, see [`Tracelog`](/windows-hardware/drivers/devtest/tracelog). +To begin tracing, you can use `Tracelog`. Different components use different control GUIDs as explained in these examples. For more information, see [`Tracelog`](/windows-hardware/drivers/devtest/tracelog) ### NTLM To enable tracing for NTLM authentication, run the following command on the command line: - - **tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1** +```cmd +tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1 +``` To stop tracing for NTLM authentication, run this command: - - **tracelog -stop ntlm** +```cmd +tracelog -stop ntlm +``` ### Kerberos authentication To enable tracing for Kerberos authentication, run this command: - - **tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1** +```cmd +tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1 +``` To stop tracing for Kerberos authentication, run this command: - - **tracelog.exe -stop kerb** +```cmd +tracelog.exe -stop kerb +``` ### KDC To enable tracing for the KDC, run the following command on the command line: - - **tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1** +```cmd +tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1 +``` To stop tracing for the KDC, run the following command on the command line: - - **tracelog.exe -stop kdc** +```cmd +tracelog.exe -stop kdc +``` -To stop tracing from a remote computer, run this command: logman.exe -s *<ComputerName>*. +To stop tracing from a remote computer, run this command: logman.exe -s **. > [!NOTE] > The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. @@ -157,15 +167,13 @@ You can also configure tracing by editing the Kerberos registry values shown in | Kerberos | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos
Value name: LogToFile
Value type: DWORD
Value data: 00000001

HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
Value name: KerbDebugLevel
Value type: DWORD
Value data: c0000043

HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
Value name: LogToFile
Value type: DWORD
Value data: 00000001 | | KDC | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Kdc
Value name: KdcDebugLevel
Value type: DWORD
Value data: c0000803 | -If you used `Tracelog`, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. +If you used `Tracelog`, look for the following log file in your current directory: `kerb.etl/kdc.etl/ntlm.etl`. If you used the registry key settings shown in the previous table, look for the trace log files in the following locations: -- NTLM: %systemroot%\\tracing\\msv1\_0 - -- Kerberos: %systemroot%\\tracing\\kerberos  - -- KDC: %systemroot%\\tracing\\kdcsvc  +- NTLM: %systemroot%\\tracing\\msv1\_0 +- Kerberos: %systemroot%\\tracing\\kerberos +- KDC: %systemroot%\\tracing\\kdcsvc To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. `Tracefmt` can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [`Tracefmt`](/windows-hardware/drivers/devtest/tracefmt). @@ -173,25 +181,19 @@ To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` i The smart card resource manager service runs in the context of a local service. It's implemented as a shared service of the services host (svchost) process. -**To check if Smart Card service is running** +To check if Smart Card service is running: -1. Press CTRL+ALT+DEL, and then select **Start Task Manager**. +1. Press CTRL+ALT+DEL, and then select **Start Task Manager** +1. In the **Windows Task Manager** dialog box, select the **Services** tab +1. Select the **Name** column to sort the list alphabetically, and then type **s** +1. In the **Name** column, look for **SCardSvr**, and then look under the **Status** column to see if the service is running or stopped -2. In the **Windows Task Manager** dialog box, select the **Services** tab. +To restart Smart Card service: -3. Select the **Name** column to sort the list alphabetically, and then type **s**. - -4. In the **Name** column, look for **SCardSvr**, and then look under the **Status** column to see if the service is running or stopped. - -**To restart Smart Card service** - -1. Run as administrator at the command prompt. - -2. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes**. - -3. At the command prompt, type `net stop SCardSvr`. - -4. At the command prompt, type `net start SCardSvr`. +1. Run as administrator at the command prompt +1. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then select **Yes** +1. At the command prompt, type `net stop SCardSvr` +1. At the command prompt, type `net start SCardSvr` You can use the following command at the command prompt to check whether the service is running: `sc queryex scardsvr`. @@ -215,15 +217,12 @@ C:\> As with any device connected to a computer, Device Manager can be used to view properties and begin the debug process. -**To check if smart card reader is working** +To check if smart card reader is working: -1. Navigate to **Computer**. - -2. Right-click **Computer**, and then select **Properties**. - -3. Under **Tasks**, select **Device Manager**. - -4. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then select **Properties**. +1. Navigate to **Computer** +1. Right-click **Computer**, and then select **Properties** +1. Under **Tasks**, select **Device Manager** +1. In Device Manager, expand **Smart card readers**, select the name of the smart card reader you want to check, and then select **Properties** > [!NOTE] > If the smart card reader is not listed in Device Manager, in the **Action** menu, select **Scan for hardware changes**. diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 81d22a9785..099af97427 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -3,7 +3,7 @@ title: Smart Card Group Policy and Registry Settings description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. ms.reviewer: ardenw ms.topic: reference -ms.date: 11/02/2021 +ms.date: 11/06/2023 --- # Smart Card Group Policy and Registry Settings @@ -12,72 +12,51 @@ This article for IT professionals and smart card developers describes the Group The following sections and tables list the smart card-related Group Policy settings and registry keys that can be set on a per-computer basis. If you use domain Group Policy Objects (GPOs), you can edit and apply Group Policy settings to local or domain computers. -- [Primary Group Policy settings for smart cards](#primary-group-policy-settings-for-smart-cards) - - - [Allow certificates with no extended key usage certificate attribute](#allow-certificates-with-no-extended-key-usage-certificate-attribute) - - - [Allow ECC certificates to be used for logon and authentication](#allow-ecc-certificates-to-be-used-for-logon-and-authentication) - - - [Allow Integrated Unblock screen to be displayed at the time of logon](#allow-integrated-unblock-screen-to-be-displayed-at-the-time-of-logon) - - - [Allow signature keys valid for Logon](#allow-signature-keys-valid-for-logon) - - - [Allow time invalid certificates](#allow-time-invalid-certificates) - - - [Allow user name hint](#allow-user-name-hint) - - - [Configure root certificate clean up](#configure-root-certificate-clean-up) - - - [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked) - - - [Filter duplicate logon certificates](#filter-duplicate-logon-certificates) - - - [Force the reading of all certificates from the smart card](#force-the-reading-of-all-certificates-from-the-smart-card) - - - [Notify user of successful smart card driver installation](#notify-user-of-successful-smart-card-driver-installation) - - - [Prevent plaintext PINs from being returned by Credential Manager](#prevent-plaintext-pins-from-being-returned-by-credential-manager) - - - [Reverse the subject name stored in a certificate when displaying](#reverse-the-subject-name-stored-in-a-certificate-when-displaying) - - - [Turn on certificate propagation from smart card](#turn-on-certificate-propagation-from-smart-card) - - - [Turn on root certificate propagation from smart card](#turn-on-root-certificate-propagation-from-smart-card) - - - [Turn on Smart Card Plug and Play service](#turn-on-smart-card-plug-and-play-service) - -- [Base CSP and Smart Card KSP registry keys](#base-csp-and-smart-card-ksp-registry-keys) - -- [CRL checking registry keys](#crl-checking-registry-keys) - -- [Additional smart card Group Policy settings and registry keys](#additional-smart-card-group-policy-settings-and-registry-keys) +- [Primary Group Policy settings for smart cards](#primary-group-policy-settings-for-smart-cards) + - [Allow certificates with no extended key usage certificate attribute](#allow-certificates-with-no-extended-key-usage-certificate-attribute) + - [Allow ECC certificates to be used for logon and authentication](#allow-ecc-certificates-to-be-used-for-logon-and-authentication) + - [Allow Integrated Unblock screen to be displayed at the time of logon](#allow-integrated-unblock-screen-to-be-displayed-at-the-time-of-logon) + - [Allow signature keys valid for Logon](#allow-signature-keys-valid-for-logon) + - [Allow time invalid certificates](#allow-time-invalid-certificates) + - [Allow user name hint](#allow-user-name-hint) + - [Configure root certificate clean up](#configure-root-certificate-clean-up) + - [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked) + - [Filter duplicate logon certificates](#filter-duplicate-logon-certificates) + - [Force the reading of all certificates from the smart card](#force-the-reading-of-all-certificates-from-the-smart-card) + - [Notify user of successful smart card driver installation](#notify-user-of-successful-smart-card-driver-installation) + - [Prevent plaintext PINs from being returned by Credential Manager](#prevent-plaintext-pins-from-being-returned-by-credential-manager) + - [Reverse the subject name stored in a certificate when displaying](#reverse-the-subject-name-stored-in-a-certificate-when-displaying) + - [Turn on certificate propagation from smart card](#turn-on-certificate-propagation-from-smart-card) + - [Turn on root certificate propagation from smart card](#turn-on-root-certificate-propagation-from-smart-card) + - [Turn on Smart Card Plug and Play service](#turn-on-smart-card-plug-and-play-service) +- [Base CSP and Smart Card KSP registry keys](#base-csp-and-smart-card-ksp-registry-keys) +- [CRL checking registry keys](#crl-checking-registry-keys) +- [Additional smart card Group Policy settings and registry keys](#additional-smart-card-group-policy-settings-and-registry-keys) ## Primary Group Policy settings for smart cards -The following smart card Group Policy settings are in Computer Configuration\\Administrative Templates\\Windows Components\\Smart Card. +The following smart card Group Policy settings are in Computer Configuration\Administrative Templates\Windows Components\Smart Card. The registry keys are in the following locations: -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\Policies\\Microsoft\\Windows\\ScPnP\\EnableScPnP** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\SmartCardCredentialProvider** - -- **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CertProp** +- **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ScPnP\EnableScPnP** +- **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider** +- **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CertProp** > [!NOTE] -> Smart card reader registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\Readers**.
-Smart card registry information is in **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Cryptography\\Calais\\SmartCards**. +> Smart card reader registry information is in **HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Calais\Readers**.\ +> Smart card registry information is in **HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Calais\SmartCards**. The following table lists the default values for these GPO settings. Variations are documented under the policy descriptions in this article. -| **Server type or GPO** | **Default value** | -|----------------------------------------------|-------------------| -| Default Domain Policy | Not configured | -| Default Domain Controller Policy | Not configured | -| Stand-Alone Server Default Settings | Not configured | -| Domain Controller Effective Default Settings | Disabled | -| Member Server Effective Default Settings | Disabled | -| Client Computer Effective Default Settings | Disabled | +| Server type or GPO | Default value | +|--|--| +| Default Domain Policy | Not configured | +| Default Domain Controller Policy | Not configured | +| Stand-Alone Server Default Settings | Not configured | +| Domain Controller Effective Default Settings | Disabled | +| Member Server Effective Default Settings | Disabled | +| Client Computer Effective Default Settings | Disabled | ### Allow certificates with no extended key usage certificate attribute @@ -90,20 +69,17 @@ You can use this policy setting to allow certificates without an extended key us When this policy setting is turned on, certificates with the following attributes can also be used to sign in with a smart card: -- Certificates with no EKU - -- Certificates with an All Purpose EKU - -- Certificates with a Client Authentication EKU +- Certificates with no EKU +- Certificates with an All Purpose EKU +- Certificates with a Client Authentication EKU When this policy setting isn't turned on, only certificates that contain the smart card logon object identifier can be used to sign in with a smart card. -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | AllowCertificatesWithNoEKU | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | AllowCertificatesWithNoEKU | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Allow ECC certificates to be used for logon and authentication @@ -113,12 +89,12 @@ When this setting is turned on, ECC certificates on a smart card can be used to When this setting isn't turned on, ECC certificates on a smart card can't be used to sign in to a domain. -| **Item** | **Description** | -|--------------------------------------|-------------------------------| -| Registry key | **EnumerateECCCerts** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, aren't affected by this policy setting.
If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign in when you're not connected to the network. | +| Item | Description | +|--|--| +| Registry key | `EnumerateECCCerts` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | This policy setting only affects a user's ability to sign in to a domain. ECC certificates on a smart card that are used for other applications, such as document signing, aren't affected by this policy setting.
If you use an ECDSA key to sign in, you must also have an associated ECDH key to permit sign in when you're not connected to the network. | ### Allow Integrated Unblock screen to be displayed at the time of logon @@ -128,27 +104,26 @@ When this setting is turned on, the integrated unblock feature is available. When this setting isn't turned on, the feature is not available. -| **Item** | **Description** | -|--------------------------------------|---------------------------------------------------------------------------------------------------------------| -| Registry key | **AllowIntegratedUnblock** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
You can create a custom message that the user sees when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | +| Item | Description | +|--|--| +| Registry key | `AllowIntegratedUnblock` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | To use the integrated unblock feature, the smart card must support it. Check with the hardware manufacturer to verify that the smart card supports this feature.
You can create a custom message that the user sees when the smart card is blocked by configuring the policy setting [Display string when smart card is blocked](#display-string-when-smart-card-is-blocked). | ### Allow signature keys valid for Logon -You can use this policy setting to allow signature key–based certificates to be enumerated and available for sign-in. +You can use this policy setting to allow signature key-based certificates to be enumerated and available for sign-in. When this setting is turned on, any certificates that are available on the smart card with a signature-only key are listed on the sign-in screen. When this setting isn't turned on, certificates available on the smart card with a signature-only key aren't listed on the sign-in screen. -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | **AllowSignatureOnlyKeys**| -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | **AllowSignatureOnlyKeys** | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Allow time invalid certificates @@ -161,48 +136,43 @@ When this setting is turned on, certificates are listed on the sign-in screen wh When this policy setting isn't turned on, certificates that are expired or not yet valid aren't listed on the sign-in screen. -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | **AllowTimeInvalidCertificates** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | `AllowTimeInvalidCertificates` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Allow user name hint -You can use this policy setting to determine whether an optional field appears during sign-in and provides a subsequent elevation process where users can enter their username or username and domain, which associates a certificate with the user. +You can use this policy setting to determine whether an optional field appears during sign-in and provides a subsequent elevation process where users can enter their username or username and domain, which associates a certificate with the user. When this policy setting is turned on, users see an optional field where they can enter their username or username and domain. When this policy setting isn't turned on, users don't see this optional field. -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | **X509HintsNeeded**| -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | `X509HintsNeeded` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Configure root certificate clean-up -You can use this policy setting to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. +You can use this policy setting to manage the cleanup behavior of root certificates. Certificates are verified by using a trust chain, and the trust anchor for the digital certificate is the Root Certification Authority (CA). A CA can issue multiple certificates with the root certificate as the top certificate of the tree structure. A private key is used to sign other certificates. This creates an inherited trustworthiness for all certificates immediately under the root certificate. When this policy setting is turned on, you can set the following cleanup options: -- **No cleanup**. When the user signs out or removes the smart card, the root certificates used during their session persist on the computer. - -- **Clean up certificates on smart card removal**. When the smart card is removed, the root certificates are removed. - -- **Clean up certificates on log off**. When the user signs out of Windows, the root certificates are removed. +- **No cleanup**. When the user signs out or removes the smart card, the root certificates used during their session persist on the computer. +- **Clean up certificates on smart card removal**. When the smart card is removed, the root certificates are removed. +- **Clean up certificates on log off**. When the user signs out of Windows, the root certificates are removed. When this policy setting isn't turned on, root certificates are automatically removed when the user signs out of Windows. -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | **RootCertificateCleanupOption**| -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | `RootCertificateCleanupOption` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Display string when smart card is blocked @@ -212,12 +182,11 @@ When this policy setting is turned on, you can create and manage the displayed m When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system's default message when the smart card is blocked. -| **Item** | **Description** | -|--------------------------------------|-------------------------| -| Registry key | **IntegratedUnblockPromptString** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Item | Description | +|--|--| +| Registry key | `IntegratedUnblockPromptString` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: This policy setting is only effective when the [Allow Integrated Unblock screen to be displayed at the time of logon](#allow-integrated-unblock-screen-to-be-displayed-at-the-time-of-logon) policy is enabled. | -| Notes and resources | | ### Filter duplicate logon certificates @@ -234,12 +203,12 @@ If this policy setting isn't turned on, all the certificates are displayed to th This policy setting is applied to the computer after the [Allow time invalid certificates](#allow-time-invalid-certificates) policy setting is applied. -| **Item** | **Description** | -|--------------------------------------|--------------------------------------------------------------------------------------------------| -| Registry key | **FilterDuplicateCerts**| -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | +| Item | Description | +|--|--| +| Registry key | `FilterDuplicateCerts` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | ### Force the reading of all certificates from the smart card @@ -249,45 +218,45 @@ When this policy setting is turned on, Windows attempts to read all certificates When this policy isn't turned on, Windows attempts to read only the default certificate from smart cards that don't support retrieval of all certificates in a single call. Certificates other than the default aren't available for sign-in. -| **Item** | **Description** | -|--------------------------------------|----------------------------------------------------------------------------| -| Registry key | **ForceReadingAllCertificates** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None

**Important**: Enabling this policy setting can adversely impact performance during the sign-in process in certain situations. | -| Notes and resources | Contact the smart card vendor to determine if your smart card and associated CSP support the required behavior. | +| Item | Description | +|--|--| +| Registry key | `ForceReadingAllCertificates` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None

**Important**: Enabling this policy setting can adversely impact performance during the sign-in process in certain situations. | +| Notes and resources | Contact the smart card vendor to determine if your smart card and associated CSP support the required behavior. | ### Notify user of successful smart card driver installation -You can use this policy setting to control whether the user sees a confirmation message when a smart card device driver is installed. +You can use this policy setting to control whether the user sees a confirmation message when a smart card device driver is installed. -When this policy setting is turned on, the user sees a confirmation message when a smart card device driver is installed. +When this policy setting is turned on, the user sees a confirmation message when a smart card device driver is installed. When this setting isn't turned on, the user doesn't see a smart card device driver installation message. -| **Item** | **Description** | -|--------------------------------------|------------------------------------------------| -| Registry key | **ScPnPNotification** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | +|--|--| +| -------------------------------------- | ------------------------------------------------ | +| Registry key | `ScPnPNotification` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | ### Prevent plaintext PINs from being returned by Credential Manager -You can use this policy setting to prevent Credential Manager from returning plaintext PINs. +You can use this policy setting to prevent Credential Manager from returning plaintext PINs. > [!NOTE] -> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user's profile. +> Credential Manager is controlled by the user on the local computer, and it stores credentials from supported browsers and Windows applications. Credentials are saved in special encrypted folders on the computer under the user's profile. -When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. +When this policy setting is turned on, Credential Manager doesn't return a plaintext PIN. When this setting isn't turned on, Credential Manager can return plaintext PINs. -| **Item** | **Description** | -|--------------------------------------|-----------------------------------------------------------------------------------| -| Registry key | **DisallowPlaintextPin**| -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | If this policy setting is enabled, some smart cards might not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | +| Item | Description | +|--|--| +| Registry key | `DisallowPlaintextPin` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | If this policy setting is enabled, some smart cards might not work in computers running Windows. Consult the smart card manufacturer to determine whether this policy setting should be enabled. | ### Reverse the subject name stored in a certificate when displaying @@ -300,13 +269,11 @@ When this policy setting is turned on, the subject name during sign-in appears r When this policy setting isn't turned on, the subject name appears the same as it's stored in the certificate. - -| **Item** | **Description** | -|--------------------------------------|-------------------------------------------------------------------------------------------------------------| -| Registry key | **ReverseSubject** | -| Default values | No changes per operating system versions
Disabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | | +| Item | Description | +|--|--| +| Registry key | `ReverseSubject` | +| Default values | No changes per operating system versions
Disabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | ### Turn on certificate propagation from smart card @@ -318,128 +285,125 @@ When this policy setting is turned on, certificate propagation occurs when the u When this policy setting is turned off, certificate propagation doesn't occur, and the certificates aren't available to applications, like Outlook. -| **Item** | **Description** | -|--------------------------------------|----------------| -| Registry key | **CertPropEnabled**| -| Default values | No changes per operating system versions
Enabled and not configured are equivalent | +| Item | Description | +|--|--| +| Registry key | `CertPropEnabled` | +| Default values | No changes per operating system versions
Enabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: This policy setting must be enabled to allow the [Turn on root certificate propagation from smart card](#turn-on-root-certificate-propagation-from-smart-card) setting to work when it is enabled. | -| Notes and resources | | ### Turn on root certificate propagation from smart card You can use this policy setting to manage the root certificate propagation that occurs when a smart card is inserted. > [!NOTE] -> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. +> The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. When this policy setting is turned on, root certificate propagation occurs when the user inserts the smart card. When this policy setting isn't turned on, root certificate propagation doesn't occur when the user inserts the smart card. -| **Item** | **Description** | -|--------------------------------------|---------------------------------------------------------------------------------------------------------| -| Registry key | **EnableRootCertificate Propagation** | -| Default values | No changes per operating system versions
Enabled and not configured are equivalent | +| Item | Description | +|--|--| +| Registry key | `EnableRootCertificate Propagation` | +| Default values | No changes per operating system versions
Enabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: For this policy setting to work, the [Turn on certificate propagation from smart card](#turn-on-certificate-propagation-from-smart-card) policy setting must also be enabled. | -| Notes and resources | | +| Notes and resources | | ### Turn on Smart Card Plug and Play service -You can use this policy setting to control whether Smart Card Plug and Play is enabled. +You can use this policy setting to control whether Smart Card Plug and Play is enabled. > [!NOTE] > Your users can use smart cards from vendors who have published their drivers through Windows Update without needing special middleware. These drivers will be downloaded in the same way as drivers for other devices in Windows. If an appropriate driver isn't available from Windows Update, a PIV-compliant mini driver that's included with any of the supported versions of Windows is used for these cards. -When this policy setting is turned on, the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. +When this policy setting is turned on, the system attempts to install a smart card device driver the first time a smart card is inserted in a smart card reader. When this policy setting isn't turned on, a device driver isn't installed when a smart card is inserted in a smart card reader. -| **Item** | **Description** | -|--------------------------------------|------------------------------------------------| -| Registry key | **EnableScPnP** | -| Default values | No changes per operating system versions
Enabled and not configured are equivalent | -| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | +| Item | Description | +|--|--| +| Registry key | `EnableScPnP` | +| Default values | No changes per operating system versions
Enabled and not configured are equivalent | +| Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | +| Notes and resources | This policy setting applies only to smart card drivers that have passed the Windows Hardware Quality Labs (WHQL) testing process. | ## Base CSP and Smart Card KSP registry keys The following registry keys can be configured for the base cryptography service provider (CSP) and the smart card key storage provider (KSP). The following tables list the keys. All keys use the DWORD type. -The registry keys for the Base CSP are in the registry in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Base Smart Card Crypto Provider**. +The registry keys for the Base CSP are in the registry in `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Base Smart Card Crypto Provider`. -The registry keys for the smart card KSP are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Cryptography\\Providers\\Microsoft Smart Card Key Storage Provider**. +The registry keys for the smart card KSP are in `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cryptography\Providers\Microsoft Smart Card Key Storage Provider`. -**Registry keys for the base CSP and smart card KSP** +### Registry keys for the base CSP and smart card KSP -| **Registry Key** | **Description** | -|------------------------------------|---------------------------------------------------------------------------------| -| **AllowPrivateExchangeKeyImport** | A non-zero value allows RSA exchange (for example, encryption) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | -| **AllowPrivateSignatureKeyImport** | A non-zero value allows RSA signature private keys to be imported for use in key archival scenarios.
Default value: 00000000 | -| **DefaultPrivateKeyLenBits** | Defines the default length for private keys, if desired.
Default value: 00000400
Default key generation parameter: 1024-bit keys | -| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.
Default value: 00000000 | -| **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.
Default value: 000005dc
The default timeout for holding transactions to the smart card is 1.5 seconds. | +| Registry Key | Description | +|--|--| +| **AllowPrivateExchangeKeyImport** | A non-zero value allows RSA exchange (for example, encryption) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | +| **AllowPrivateSignatureKeyImport** | A non-zero value allows RSA signature private keys to be imported for use in key archival scenarios.
Default value: 00000000 | +| **DefaultPrivateKeyLenBits** | Defines the default length for private keys, if desired.
Default value: 00000400
Default key generation parameter: 1024-bit keys | +| **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.
Default value: 00000000 | +| **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.
Default value: 000005dc
The default timeout for holding transactions to the smart card is 1.5 seconds. | **Additional registry keys for the smart card KSP** -| **Registry Key** | **Description** | -|--------------------------------|-----------------------------------------------------| -| **AllowPrivateECDHEKeyImport** | This value allows Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | +| Registry Key | Description | +|--|--| +| **AllowPrivateECDHEKeyImport** | This value allows Ephemeral Elliptic Curve Diffie-Hellman (ECDHE) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | | **AllowPrivateECDSAKeyImport** | This value allows Elliptic Curve Digital Signature Algorithm (ECDSA) private keys to be imported for use in key archival scenarios.
Default value: 00000000 | ## CRL checking registry keys The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you must configure settings for both the KDC and the client. -**CRL checking registry keys** +### CRL checking registry keys -| **Registry Key** | **Details** | -|------------|-----------------------------| -| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Services\\Kdc\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
Value = 1 | -| **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CCS\\Control\\LSA\\Kerberos\\Parameters\\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors**| Type = DWORD
Value = 1 | +| Registry Key | Details | +|--|--| +| `HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\Kdc\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | +| `HKEY_LOCAL_MACHINE\SYSTEM\CCS\Control\LSA\Kerberos\Parameters\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | ## Additional smart card Group Policy settings and registry keys In a smart card deployment, additional Group Policy settings can be used to enhance ease-of-use or security. Two of these policy settings that can complement a smart card deployment are: -- Turning off delegation for computers +- Turning off delegation for computers +- Interactive logon: Do not require CTRL+ALT+DEL (not recommended) -- Interactive logon: Do not require CTRL+ALT+DEL (not recommended) +The following smart card-related Group Policy settings are in **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options**. -The following smart card-related Group Policy settings are in Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options. +### Local security policy settings -**Local security policy settings** - -| Group Policy setting and registry key | Default | Description | -|------------------------------------------|------------|---------------| -| Interactive logon: Require smart card

**scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

**Enabled** Users can sign in to the computer only by using a smart card.
**Disabled** Users can sign in to the computer by using any method.

NOTE: the Windows LAPS-managed local account is exempted from this policy when Enabled. For more information see [Windows LAPS integration with smart card policy](/windows-server/identity/laps/laps-concepts#windows-laps-integration-with-smart-card-policy).
| -| Interactive logon: Smart card removal behavior

**scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

**Note**: In earlier versions of Windows Server, Remote Desktop Services was called Terminal Services. | +| Group Policy setting and registry key | Default | Description | +|--|--|--| +| Interactive logon: Require smart card

**scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

**Enabled** Users can sign in to the computer only by using a smart card.
**Disabled** Users can sign in to the computer by using any method.

NOTE: the Windows LAPS-managed local account is exempted from this policy when Enabled. For more information see [Windows LAPS integration with smart card policy](/windows-server/identity/laps/laps-concepts#windows-laps-integration-with-smart-card-policy).
| +| Interactive logon: Smart card removal behavior

**scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

**Note**: In earlier versions of Windows Server, Remote Desktop Services was called Terminal Services. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. -The following smart card-related Group Policy settings are in Computer Configuration\\Administrative Templates\\System\\Credentials Delegation. +The following smart card-related Group Policy settings are in **Computer Configuration\Administrative Templates\System\Credentials Delegation**. -Registry keys are in **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**. +Registry keys are in `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\Credssp\PolicyDefaults`. > [!NOTE] > In the following table, fresh credentials are those that you are prompted for when running an application. -**Credential delegation policy settings** +### Credential delegation policy settings +| Group Policy setting and registry key | Default | Description | +|--|--|--| +| Allow Delegating Fresh Credentials

**AllowFreshCredentials** | Not configured | This policy setting applies:
When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
To applications that use the CredSSP component (for example, Remote Desktop Services).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
**Disabled**: Delegation of fresh credentials to any computer isn't permitted.

**Note**: This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | +| Allow Delegating Fresh Credentials with NTLM-only Server Authentication

**AllowFreshCredentialsWhenNTLMOnly** | Not configured | This policy setting applies:
When server authentication was achieved by using NTLM.
To applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
**Disabled**: Delegation of fresh credentials isn't permitted to any computer.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
See the **Allow Delegating Fresh Credentials** policy setting description for examples. | +| Deny Delegating Fresh Credentials

**DenyFreshCredentials** | Not configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can't be delegated.
**Disabled** or **Not configured**: A server is not specified.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can't be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
For examples, see the "Allow delegating fresh credentials" policy setting. | -| Group Policy setting and registry key | Default | Description | -|----------------------------------------------------------------------------------------------------------------------|----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Allow Delegating Fresh Credentials

**AllowFreshCredentials** | Not configured | This policy setting applies:
When server authentication was achieved through a trusted X509 certificate or Kerberos protocol.
To applications that use the CredSSP component (for example, Remote Desktop Services).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Services running on any computer.
**Disabled**: Delegation of fresh credentials to any computer isn't permitted.

**Note**: This policy setting can be set to one or more service principal names (SPNs). The SPN represents the target server where the user credentials can be delegated. A single wildcard character is permitted when specifying the SPN, for example:
Use \*TERMSRV/\*\* for Remote Desktop Session Host (RD Session Host) running on any computer.
Use *TERMSRV/host.humanresources.fabrikam.com* for RD Session Host running on the host.humanresources.fabrikam.com computer.
Use *TERMSRV/\*.humanresources.fabrikam.com* for RD Session Host running on all computers in .humanresources.fabrikam.com | -| Allow Delegating Fresh Credentials with NTLM-only Server Authentication

**AllowFreshCredentialsWhenNTLMOnly** | Not configured | This policy setting applies:
When server authentication was achieved by using NTLM.
To applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can be delegated.
**Not configured**: After proper mutual authentication, delegation of fresh credentials is permitted to RD Session Host running on any computer (TERMSRV/\*).
**Disabled**: Delegation of fresh credentials isn't permitted to any computer.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
See the **Allow Delegating Fresh Credentials** policy setting description for examples. | -| Deny Delegating Fresh Credentials

**DenyFreshCredentials** | Not configured | This policy setting applies to applications that use the CredSSP component (for example, Remote Desktop).

**Enabled**: You can specify the servers where the user's fresh credentials can't be delegated.
**Disabled** or **Not configured**: A server is not specified.

**Note**: This policy setting can be set to one or more SPNs. The SPN represents the target server where the user credentials can't be delegated. A single wildcard character (\*) is permitted when specifying the SPN.
For examples, see the "Allow delegating fresh credentials" policy setting. | +If you're using Remote Desktop Services with smart card logon, you can't delegate default and saved credentials. The registry keys in the following table, which are at `HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\Credssp\PolicyDefaults`, and the corresponding Group Policy settings are ignored. -If you're using Remote Desktop Services with smart card logon, you can't delegate default and saved credentials. The registry keys in the following table, which are at **HKEY\_LOCAL\_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\Credssp\\PolicyDefaults**, and the corresponding Group Policy settings are ignored. - -| **Registry key** | **Corresponding Group Policy setting** | -|-------------------------------------|---------------------------------------------------------------------------| -| **AllowDefaultCredentials** | Allow Delegating Default Credentials | +| Registry Key| **Corresponding Group Policy setting** | +|--|--| +| **AllowDefaultCredentials** | Allow Delegating Default Credentials | | **AllowDefaultCredentialsWhenNTLMOnly** | Allow Delegating Default Credentials with NTLM-only Server Authentication | -| **AllowSavedCredentials** | Allow Delegating Saved Credentials | -| **AllowSavedCredentialsWhenNTLMOnly** | Allow Delegating Saved Credentials with NTLM-only Server Authentication | +| **AllowSavedCredentials** | Allow Delegating Saved Credentials | +| **AllowSavedCredentialsWhenNTLMOnly** | Allow Delegating Saved Credentials with NTLM-only Server Authentication | ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 5ad7eb1205..d3cd7bcdca 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -3,23 +3,18 @@ title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. ms.reviewer: ardenw ms.topic: overview -ms.date: 09/24/2021 +ms.date: 1/06/2023 --- # How Smart Card Sign-in Works in Windows This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. It includes the following resources about the architecture, certificate management, and services that are related to smart card use: -- [Smart Card Architecture](smart-card-architecture.md): Learn about enabling communications with smart cards and smart card readers, which can be different according to the vendor that supplies them. - -- [Certificate Requirements and Enumeration](smart-card-certificate-requirements-and-enumeration.md): Learn about requirements for smart card certificates based on the operating system, and about the operations that are performed by the operating system when a smart card is inserted into the computer. - -- [Smart Card and Remote Desktop Services](smart-card-and-remote-desktop-services.md): Learn about using smart cards for remote desktop connections. - -- [Smart Cards for Windows Service](smart-card-smart-cards-for-windows-service.md): Learn about how the Smart Cards for Windows service is implemented. - -- [Certificate Propagation Service](smart-card-certificate-propagation-service.md): Learn about how the certificate propagation service works when a smart card is inserted into a computer. - -- [Smart Card Removal Policy Service](smart-card-removal-policy-service.md): Learn about using Group Policy to control what happens when a user removes a smart card. +- [Smart Card Architecture](smart-card-architecture.md): Learn about enabling communications with smart cards and smart card readers, which can be different according to the vendor that supplies them +- [Certificate Requirements and Enumeration](smart-card-certificate-requirements-and-enumeration.md): Learn about requirements for smart card certificates based on the operating system, and about the operations that are performed by the operating system when a smart card is inserted into the computer +- [Smart Card and Remote Desktop Services](smart-card-and-remote-desktop-services.md): Learn about using smart cards for remote desktop connections +- [Smart Cards for Windows Service](smart-card-smart-cards-for-windows-service.md): Learn about how the Smart Cards for Windows service is implemented +- [Certificate Propagation Service](smart-card-certificate-propagation-service.md): Learn about how the certificate propagation service works when a smart card is inserted into a computer +- [Smart Card Removal Policy Service](smart-card-removal-policy-service.md): Learn about using Group Policy to control what happens when a user removes a smart card [!INCLUDE [smart-cards-for-windows-service](../../../../includes/licensing/smart-cards-for-windows-service.md)] \ No newline at end of file diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index 2604d84270..c982c67613 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -3,7 +3,7 @@ title: Smart Cards for Windows Service description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. ms.reviewer: ardenw ms.topic: concept-article -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Smart Cards for Windows Service @@ -69,34 +69,31 @@ The Smart Cards for Windows service runs in the context of a local service, and ``` -> **Note**  For winscard.dll to be invoked as the proper class installer, the INF file for a smart card reader must specify the following for **Class** and **ClassGUID**:
-`Class=SmartCardReader`
`ClassGuid={50DD5230-BA8A-11D1-BF5D-0000F805F530}` +> [!NOTE] +> For winscard.dll to be invoked as the proper class installer, the INF file for a smart card reader must specify the following for **Class** and **ClassGUID**: +> +> `Class=SmartCardReader` +> `ClassGuid={50DD5230-BA8A-11D1-BF5D-0000F805F530}` By default, the service is configured for manual mode. Creators of smart card reader drivers must configure their INFs so that they start the service automatically and winscard.dll files call a predefined entry point to start the service during installation. The entry point is defined as part of the **SmartCardReader** class, and it is not called directly. If a device advertises itself as part of this class, the entry point is automatically invoked to start the service when the device is inserted. Using this method ensures that the service is enabled when it is needed, but it is also disabled for users who do not use smart cards. When the service is started, it performs several functions: -1. It registers itself for service notifications. +1. It registers itself for service notifications +1. It registers itself for Plug and Play (PnP) notifications related to device removal and additions +1. It initializes its data cache and a global event that signals that the service has started -2. It registers itself for Plug and Play (PnP) notifications related to device removal and additions. - -3. It initializes its data cache and a global event that signals that the service has started. - -> **Note**  For smart card implementations, consider sending all communications in Windows operating systems with smart card readers through the Smart Cards for Windows service. This provides an interface to track, select, and communicate with all drivers that declare themselves members of the smart card reader device group. +> [!NOTE] +> For smart card implementations, consider sending all communications in Windows operating systems with smart card readers through the Smart Cards for Windows service. This provides an interface to track, select, and communicate with all drivers that declare themselves members of the smart card reader device group. The Smart Cards for Windows service categorizes each smart card reader slot as a unique reader, and each slot is also managed separately, regardless of the device's physical characteristics. The Smart Cards for Windows service handles the following high-level actions: -- Device introduction - -- Reader initialization - -- Notifying clients of new readers - -- Serializing access to readers - -- Smart card access - -- Tunneling of reader-specific commands +- Device introduction +- Reader initialization +- Notifying clients of new readers +- Serializing access to readers +- Smart card access +- Tunneling of reader-specific commands ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index f18465fff3..00d223bfe5 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -3,7 +3,7 @@ title: Smart Card Tools and Settings description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. ms.reviewer: ardenw ms.topic: conceptual -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Smart Card Tools and Settings @@ -12,11 +12,9 @@ This topic for the IT professional and smart card developer links to information This section of the Smart Card Technical Reference contains information about the following: -- [Smart Cards Debugging Information](smart-card-debugging-information.md): Learn about tools and services in supported versions of Windows to help identify certificate issues. - -- [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md): Learn about smart card-related Group Policy settings and registry keys that can be set on a per-computer basis, including how to edit and apply Group Policy settings to local or domain computers. - -- [Smart Card Events](smart-card-events.md): Learn about events that can be used to manage smart cards in an organization, including how to monitor installation, use, and errors. +- [Smart Cards Debugging Information](smart-card-debugging-information.md): Learn about tools and services in supported versions of Windows to help identify certificate issues +- [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md): Learn about smart card-related Group Policy settings and registry keys that can be set on a per-computer basis, including how to edit and apply Group Policy settings to local or domain computers +- [Smart Card Events](smart-card-events.md): Learn about events that can be used to manage smart cards in an organization, including how to monitor installation, use, and errors ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index a7e5247fcc..230cd5d598 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -3,7 +3,7 @@ title: Smart Card Technical Reference description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.reviewer: ardenw ms.topic: reference -ms.date: 09/24/2021 +ms.date: 11/06/2023 --- # Smart Card Technical Reference @@ -14,9 +14,8 @@ The Smart Card Technical Reference describes the Windows smart card infrastructu This document explains how the Windows smart card infrastructure works. To understand this information, you should have basic knowledge of public key infrastructure (PKI) and smart card concepts. This document is intended for: -- Enterprise IT developers, managers, and staff who are planning to deploy or are using smart cards in their organization. - -- Smart card vendors who write smart card minidrivers or credential providers. +- Enterprise IT developers, managers, and staff who are planning to deploy or are using smart cards in their organization. +- Smart card vendors who write smart card minidrivers or credential providers. ## What are smart cards? @@ -24,11 +23,9 @@ Smart cards are tamper-resistant portable storage devices that can enhance the s Smart cards provide: -- Tamper-resistant storage for protecting private keys and other forms of personal information. - -- Isolation of security-critical computations that involve authentication, digital signatures, and key exchange from other parts of the computer. These computations are performed on the smart card. - -- Portability of credentials and other private information between computers at work, home, or on the road. +- Tamper-resistant storage for protecting private keys and other forms of personal information +- Isolation of security-critical computations that involve authentication, digital signatures, and key exchange from other parts of the computer. These computations are performed on the smart card +- Portability of credentials and other private information between computers at work, home, or on the road Smart cards can be used to sign in to domain accounts only, not local accounts. When you use a password to sign in interactively to a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. @@ -38,26 +35,16 @@ Smart cards can be used to sign in to domain accounts only, not local accounts. ## In this technical reference -This reference contains the following topics. +This reference contains the following topics: -- [How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md) - - - [Smart Card Architecture](smart-card-architecture.md) - - - [Certificate Requirements and Enumeration](smart-card-certificate-requirements-and-enumeration.md) - - - [Smart Card and Remote Desktop Services](smart-card-and-remote-desktop-services.md) - - - [Smart Cards for Windows Service](smart-card-smart-cards-for-windows-service.md) - - - [Certificate Propagation Service](smart-card-certificate-propagation-service.md) - - - [Smart Card Removal Policy Service](smart-card-removal-policy-service.md) - -- [Smart Card Tools and Settings](smart-card-tools-and-settings.md) - - - [Smart Cards Debugging Information](smart-card-debugging-information.md) - - - [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md) - - - [Smart Card Events](smart-card-events.md) +- [How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md) + - [Smart Card Architecture](smart-card-architecture.md) + - [Certificate Requirements and Enumeration](smart-card-certificate-requirements-and-enumeration.md) + - [Smart Card and Remote Desktop Services](smart-card-and-remote-desktop-services.md) + - [Smart Cards for Windows Service](smart-card-smart-cards-for-windows-service.md) + - [Certificate Propagation Service](smart-card-certificate-propagation-service.md) + - [Smart Card Removal Policy Service](smart-card-removal-policy-service.md) +- [Smart Card Tools and Settings](smart-card-tools-and-settings.md) + - [Smart Cards Debugging Information](smart-card-debugging-information.md) + - [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md) + - [Smart Card Events](smart-card-events.md) From 6f839514bf60065cc5896c847aabefbe02b93a76 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 6 Nov 2023 12:30:24 -0500 Subject: [PATCH 02/21] update --- education/windows/autopilot-reset.md | 21 +++--- .../smart-card-debugging-information.md | 70 ++++++++++--------- ...card-group-policy-and-registry-settings.md | 2 +- 3 files changed, 49 insertions(+), 44 deletions(-) diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 996188d7bf..7b14deeb86 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -11,7 +11,7 @@ ms.collection: - education --- -# Reset devices with Autopilot Reset +# Reset devices with Autopilot Reset IT admins or technical teachers can use Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen anytime and apply original settings and management enrollment (Microsoft Entra ID and device management) so the devices are ready to use. With Autopilot Reset, devices are returned to a fully configured or known IT-approved state. @@ -22,7 +22,7 @@ To enable Autopilot Reset, you must: ## Enable Autopilot Reset -To use Autopilot Reset, [Windows Recovery Environment (WinRE) must be enabled on the device](#winre). +To use Autopilot Reset, Windows Recovery Environment (WinRE) must be enabled on the device. **DisableAutomaticReDeploymentCredentials** is a policy that enables or disables the visibility of the credentials for Autopilot Reset. It's a policy node in the [Policy CSP](/windows/client-management/mdm/policy-csp-credentialproviders), **CredentialProviders/DisableAutomaticReDeploymentCredentials**. By default, this policy is set to 1 (Disable). This setting ensures that Autopilot Reset isn't triggered by accident. @@ -32,7 +32,7 @@ You can set the policy using one of these methods: Check your MDM provider documentation on how to set this policy. If your MDM provider doesn't explicitly support this policy, you can manually set this policy if your MDM provider allows specific OMA-URIs to be manually set. - For example, in Intune, create a new configuration policy and add an OMA-URI. + For example, in Intune, create a new configuration policy and add an OMA-URI. - OMA-URI: ./Vendor/MSFT/Policy/Config/CredentialProviders/DisableAutomaticReDeploymentCredentials - Data type: Integer - Value: 0 @@ -56,11 +56,12 @@ You can set the policy using one of these methods: - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: ![Configure student PC settings in Set up School PCs.](images/suspcs/suspc_configure_pc2.jpg) - -## Trigger Autopilot Reset -Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. -**To trigger Autopilot Reset** +## Trigger Autopilot Reset + +Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. +] +To trigger Autopilot Reset: 1. From the Windows device lock screen, enter the keystroke: CTRL + WIN + R. @@ -69,16 +70,16 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo This keystroke opens up a custom sign-in screen for Autopilot Reset. The screen serves two purposes: 1. Confirm/verify that the end user has the right to trigger Autopilot Reset - 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. + 1. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) -2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. +1. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. > [!IMPORTANT] > To reestablish Wi-Fi connectivity after reset, make sure the **Connect automatically** box is checked for the device's wireless network connection. - Once Autopilot Reset is triggered, the reset process starts. + Once Autopilot Reset is triggered, the reset process starts. After reset, the device: diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index ba68729da2..810ef34cf7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -28,7 +28,7 @@ For a complete description of Certutil including examples that show how to use i ### List certificates available on the smart card -To list certificates that are available on the smart card, type `certutil -scinfo`. +To list certificates that are available on the smart card, type `certutil.exe -scinfo`. > [!NOTE] > Entering a PIN is not required for this operation. You can press ESC if you are prompted for a PIN. @@ -37,9 +37,9 @@ To list certificates that are available on the smart card, type `certutil -scinf Each certificate is enclosed in a container. When you delete a certificate on the smart card, you're deleting the container for the certificate. -To find the container value, type `certutil -scinfo`. +To find the container value, type `certutil.exe -scinfo`. -To delete a container, type `certutil -delkey -csp "Microsoft Base Smart Card Crypto Provider" ""`. +To delete a container, type `certutil.exe -delkey -csp "Microsoft Base Smart Card Crypto Provider" ""`. ## Debugging and tracing using WPP @@ -50,37 +50,37 @@ WPP simplifies tracing the operation of the trace provider. It provides a mechan Using WPP, use one of the following commands to enable tracing: ```cmd -tracelog.exe -kd -rt -start -guid \ -f .\\.etl -flags -ft 1 -logman start -ets -p {} - -ft 1 -rt -o .\\.etl -mode 0x00080000 +tracelog.exe -kd -rt -start -guid \ -f .\.etl -flags -ft 1 +logman start -ets -p {} - -ft 1 -rt -o .\.etl -mode 0x00080000 ``` You can use the parameters in the following table. -| Friendly name | GUID | Flags | -|-------------------|--------------------------------------|-----------| -| `scardsvr` | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | -| `winscard` | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | -| `basecsp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| `scksp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | -| `msclmd` | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | -| `credprov` | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | -| `certprop` | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | -| `scfilter` | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | -| `wudfusbccid` | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | +| Friendly name | GUID | Flags | +|--|--|--| +| `scardsvr` | 13038e47-ffec-425d-bc69-5707708075fe | 0xffff | +| `winscard` | 3fce7c5f-fb3b-4bce-a9d8-55cc0ce1cf01 | 0xffff | +| `basecsp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `scksp` | 133a980d-035d-4e2d-b250-94577ad8fced | 0x7 | +| `msclmd` | fb36caf4-582b-4604-8841-9263574c4f2c | 0x7 | +| `credprov` | dba0e0e0-505a-4ab6-aa3f-22f6f743b480 | 0xffff | +| `certprop` | 30eae751-411f-414c-988b-a8bfa8913f49 | 0xffff | +| `scfilter` | eed7f3c9-62ba-400e-a001-658869df9a91 | 0xffff | +| `wudfusbccid` | a3c09ba3-2f62-4be5-a50f-8278a646ac9d | 0xffff | ### Examples To enable tracing for the SCardSvr service: ```cmd -tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\\scardsvr.etl -flags 0xffff -ft 1 -logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\\scardsvr.etl -mode 0x00080000 +tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\scardsvr.etl -flags 0xffff -ft 1 +logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\scardsvr.etl -mode 0x00080000 ``` To enable tracing for `scfilter.sys`: ```cmd -tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\\scfilter.etl -flags 0xffff -ft 1 +tracelog.exe -kd -rt -start scfilter -guid \#eed7f3c9-62ba-400e-a001-658869df9a91 -f .\scfilter.etl -flags 0xffff -ft 1 ``` ### Stop the trace @@ -115,7 +115,7 @@ To begin tracing, you can use `Tracelog`. Different components use different con To enable tracing for NTLM authentication, run the following command on the command line: ```cmd -tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1 +tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\ntlm.etl -flags 0x15003 -ft 1 ``` To stop tracing for NTLM authentication, run this command: @@ -129,7 +129,7 @@ tracelog -stop ntlm To enable tracing for Kerberos authentication, run this command: ```cmd -tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1 +tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\kerb.etl -flags 0x43 -ft 1 ``` To stop tracing for Kerberos authentication, run this command: @@ -143,7 +143,7 @@ tracelog.exe -stop kerb To enable tracing for the KDC, run the following command on the command line: ```cmd -tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\\kdc.etl -flags 0x803 -ft 1 +tracelog.exe -kd -rt -start kdc -guid \#1BBA8B19-7F31-43c0-9643-6E911F79A06B -f .\kdc.etl -flags 0x803 -ft 1 ``` To stop tracing for the KDC, run the following command on the command line: @@ -152,30 +152,34 @@ To stop tracing for the KDC, run the following command on the command line: tracelog.exe -stop kdc ``` -To stop tracing from a remote computer, run this command: logman.exe -s **. +To stop tracing from a remote computer, run this command: + +```cmd +logman.exe -s +``` > [!NOTE] -> The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. +> The default location for logman.exe is %systemroot%system32\. Use the **-s** option to supply a computer name. ### Configure tracing with the registry You can also configure tracing by editing the Kerberos registry values shown in the following table. -| Element | Registry Key Setting | -|-------------|----------------------------------------------------| -| NTLM | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1\_0
Value name: NtLmInfoLevel
Value type: DWORD
Value data: c0015003 | -| Kerberos | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos
Value name: LogToFile
Value type: DWORD
Value data: 00000001

HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
Value name: KerbDebugLevel
Value type: DWORD
Value data: c0000043

HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\\Kerberos\\Parameters
Value name: LogToFile
Value type: DWORD
Value data: 00000001 | -| KDC | HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Kdc
Value name: KdcDebugLevel
Value type: DWORD
Value data: c0000803 | +| Element | Registry Key Setting | +|--|--| +| NTLM | HKEY_LOCAL_MACHINESYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
Value name: NtLmInfoLevel
Value type: DWORD
Value data: c0015003 | +| Kerberos | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos
Value name: LogToFile
Value type: DWORD
Value data: 00000001

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value name: KerbDebugLevel
Value type: DWORD
Value data: c0000043

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
Value name: LogToFile
Value type: DWORD
Value data: 00000001 | +| KDC | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc
Value name: KdcDebugLevel
Value type: DWORD
Value data: c0000803 | If you used `Tracelog`, look for the following log file in your current directory: `kerb.etl/kdc.etl/ntlm.etl`. If you used the registry key settings shown in the previous table, look for the trace log files in the following locations: -- NTLM: %systemroot%\\tracing\\msv1\_0 -- Kerberos: %systemroot%\\tracing\\kerberos -- KDC: %systemroot%\\tracing\\kdcsvc +- NTLM: `%systemroot%\tracing\msv1_0` +- Kerberos: `%systemroot%\tracing\kerberos` +- KDC: `%systemroot%\tracing\kdcsvc` -To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. `Tracefmt` can display the messages in the Command Prompt window or save them in a text file. It is located in the \\tools\\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [`Tracefmt`](/windows-hardware/drivers/devtest/tracefmt). +To decode event trace files, you can use `Tracefmt` (tracefmt.exe). `Tracefmt` is a command-line tool that formats and displays trace messages from an event trace log file (.etl) or a real-time trace session. `Tracefmt` can display the messages in the Command Prompt window or save them in a text file. It is located in the \tools\tracing subdirectory of the Windows Driver Kit (WDK). For more information, see [`Tracefmt`](/windows-hardware/drivers/devtest/tracefmt). ## Smart Card service diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 099af97427..9cd57a98c5 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -64,7 +64,7 @@ You can use this policy setting to allow certificates without an extended key us > [!NOTE] > extended key usage certificate attribute is also known as extended key usage. -> +> > In versions of Windows before Windows Vista, smart card certificates that are used to sign in require an EKU extension with a smart card logon object identifier. This policy setting can be used to modify that restriction. When this policy setting is turned on, certificates with the following attributes can also be used to sign in with a smart card: From 5804b3ba1b5d1b59fcfc6933f65d82d3f393c3fc Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 6 Nov 2023 13:00:31 -0500 Subject: [PATCH 03/21] VSC updates --- ...l-smart-card-deploy-virtual-smart-cards.md | 42 +++++++---------- .../virtual-smart-card-evaluate-security.md | 6 +-- .../virtual-smart-card-get-started.md | 46 ++++++++----------- .../virtual-smart-card-overview.md | 2 +- .../virtual-smart-card-tpmvscmgr.md | 2 +- ...smart-card-understanding-and-evaluating.md | 2 +- ...tual-smart-card-use-virtual-smart-cards.md | 16 +++---- 7 files changed, 48 insertions(+), 68 deletions(-) diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index b20f03522b..c0e66c8f7e 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -2,7 +2,7 @@ title: Deploy Virtual Smart Cards description: Learn about what to consider when deploying a virtual smart card authentication solution ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Deploy Virtual Smart Cards @@ -19,11 +19,9 @@ A device manufacturer creates physical devices, and then an organization purchas This topic contains information about the following phases in a virtual smart card lifecycle: -- [Create and personalize virtual smart cards](#create-and-personalize-virtual-smart-cards) - -- [Provision virtual smart cards](#provision-virtual-smart-cards) - -- [Maintain virtual smart cards](#maintain-virtual-smart-cards) +- [Create and personalize virtual smart cards](#create-and-personalize-virtual-smart-cards) +- [Provision virtual smart cards](#provision-virtual-smart-cards) +- [Maintain virtual smart cards](#maintain-virtual-smart-cards) ## Create and personalize virtual smart cards @@ -54,9 +52,7 @@ A virtual smart card appears within the operating system as a physical smart car - **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and non-exportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). - - **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that is offered by physical smart cards, which is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM. - - **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for some time instead of blocking the card. This is also known as lockout. For more information, see [Blocked virtual smart card](#blocked-virtual-smart-card) and [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). @@ -70,12 +66,9 @@ During virtual smart card personalization, the values for the administrator key, Because the administrator key is critical to the security of the card, it's important to consider the deployment environment and decide on the proper administrator key setting strategy. Options for these strategies include: -- **Uniform**: Administrator keys for all the virtual smart cards deployed in the organization are the same. Although using the same key makes the maintenance infrastructure easy (only one key needs to be stored), it's highly insecure. This strategy might be sufficient for small organizations, but if the administrator key is compromised, all virtual smart cards that use the key must be reissued. - -- **Random, not stored**: Administrator keys are assigned randomly for all virtual smart cards, and they aren't recorded. This is a valid option if the deployment administrators don't require the ability to reset PINs, and instead prefer to delete and reissue virtual smart cards. This is a viable strategy if the administrator prefers to set PUK values for the virtual smart cards and then use this value to reset PINs, if necessary. - -- **Random, stored**: you assign the administrator keys randomly, storing them in a central location. Each card's security is independent of the others. This is a secure strategy on a large scale, unless the administrator key database is compromised. - +- **Uniform**: Administrator keys for all the virtual smart cards deployed in the organization are the same. Although using the same key makes the maintenance infrastructure easy (only one key needs to be stored), it's highly insecure. This strategy might be sufficient for small organizations, but if the administrator key is compromised, all virtual smart cards that use the key must be reissued +- **Random, not stored**: Administrator keys are assigned randomly for all virtual smart cards, and they aren't recorded. This is a valid option if the deployment administrators don't require the ability to reset PINs, and instead prefer to delete and reissue virtual smart cards. This is a viable strategy if the administrator prefers to set PUK values for the virtual smart cards and then use this value to reset PINs, if necessary +- **Random, stored**: you assign the administrator keys randomly, storing them in a central location. Each card's security is independent of the others. This is a secure strategy on a large scale, unless the administrator key database is compromised - **Deterministic**: Administrator keys are the result of some function or known information. For example, the user ID could be used to randomly generate data that can be further processed through a symmetric encryption algorithm by using a secret. This administrator key can be similarly regenerated when needed, and it doesn't need to be stored. The security of this method relies on the security of the secret used. Although the PUK and the administrator key methodologies provide unlocking and resetting functionality, they do so in different ways. The PUK is a PIN that is entered on the computer to enable a user PIN reset. @@ -112,9 +105,8 @@ You can use APIs to build Microsoft Store apps that you can use to manage the fu When a device or computer isn't joined to a domain, the TPM ownerAuth is stored in the registry under HKEY\_LOCAL\_MACHINE. This exposes some threats. Most of the threat vectors are protected by BitLocker, but threats that aren't protected include: -- A malicious user possesses a device that has an active local sign-in session before the device locks. The malicious user could attempt a brute-force attack on the virtual smart card PIN, and then access the corporate secrets. - -- A malicious user possesses a device that has an active virtual private network (VPN) session. The device is then compromised. +- A malicious user possesses a device that has an active local sign-in session before the device locks. The malicious user could attempt a brute-force attack on the virtual smart card PIN, and then access the corporate secrets +- A malicious user possesses a device that has an active virtual private network (VPN) session. The device is then compromised The proposed mitigation for the previous scenarios is to use Exchange ActiveSync (EAS) policies to reduce the automatic lockout time from five minutes to 30 seconds of inactivity. You can set policies for automatic lockout while provisioning virtual smart cards. If an organization wants more security, they can also configure a setting to remove the ownerAuth from the local device. @@ -189,11 +181,11 @@ This command creates a card with a randomized administrator key. The key is auto `tpmvscmgr.exe destroy /instance ` -where <instance ID> is the value that is printed on the screen when the user creates the card. Specifically, for the first card created, the instance ID is ROOT\\SMARTCARDREADER\\0000). +where `` is the value that is printed on the screen when the user creates the card. Specifically, for the first card created, the instance ID is `ROOT\SMARTCARDREADER\0000`. ### Certificate management for unmanaged cards -Depending on the security requirements that are unique to an organization, users can initially enroll for certificates from the certificate management console (certmgr.msc) or from within custom certificate enrollment applications. The latter method can create a request and submit it to a server that has access to the Certification Authority. This requires specific organizational configurations and deployments for certificate enrollment policies and certificate enrollment services. Windows has built-in tools, specifically Certreq.exe and Certutil.exe, which can be used by scripts to perform the enrollment from the command line. +Depending on the security requirements that are unique to an organization, users can initially enroll for certificates from the certificate management console (certmgr.msc) or from within custom certificate enrollment applications. The latter method can create a request and submit it to a server that has access to the Certification Authority. This requires specific organizational configurations and deployments for certificate enrollment policies and certificate enrollment services. Windows has built-in tools, specifically Certreq.exe and Certutil.exe, which can be used by scripts to perform the enrollment from the command line. #### Requesting the certificate by providing domain credentials only @@ -211,11 +203,9 @@ The user can import the certificate into the **MY** store (which is the user's c For deployments that require users to use a physical smart card to sign the certificate request, you can use the procedure: -1. Users initiate a request on a domain-joined computer. - -2. Users complete the request by using a physical smart card to sign the request. - -3. Users download the request to the virtual smart card on their client computer. +1. Users initiate a request on a domain-joined computer +1. Users complete the request by using a physical smart card to sign the request +1. Users download the request to the virtual smart card on their client computer #### Using one-time password for enrollment @@ -235,11 +225,11 @@ Maintenance is a significant portion of the virtual smart card lifecycle and one When renewing with a previously used key, no extra steps are required because a strong certificate with this key was issued during the initial provisioning. However, when the user requests a new key pair, you must take the same steps that were used during provisioning to assure the strength of the credentials. Renewal with new keys should occur periodically to counter sophisticated long-term attempts by malicious users to infiltrate the system. When new keys are assigned, you must ensure that the new keys are being used by the expected individuals on the same virtual smart cards. -**Resetting PINs**: Resetting virtual smart card PINs is also a frequent necessity, because employees forget their PINs. There are two ways to accomplish this, depending on choices made earlier in the deployment: Use a PUK (if the PUK is set), or use a challenge-response approach with the administration key. Before resetting the PIN, the user's identity must be verified by using some means other than the card—most likely the verification method that you used during initial provisioning (for example, in-person proofing). This is necessary in user-error scenarios when users forget their PINs. However, you should never reset a PIN if it has been compromised because the level of vulnerability after the PIN is exposed is difficult to identify. The entire card should be reissued. +**Reset PINs**: Resetting virtual smart card PINs is also a frequent necessity, because employees forget their PINs. There are two ways to accomplish this, depending on choices made earlier in the deployment: Use a PUK (if the PUK is set), or use a challenge-response approach with the administration key. Before resetting the PIN, the user's identity must be verified by using some means other than the card—most likely the verification method that you used during initial provisioning (for example, in-person proofing). This is necessary in user-error scenarios when users forget their PINs. However, you should never reset a PIN if it has been compromised because the level of vulnerability after the PIN is exposed is difficult to identify. The entire card should be reissued. **Lockout reset**: A frequent precursor to resetting a PIN is the necessity of resetting the TPM lockout time because the TPM anti-hammering logic will be engaged with multiple PIN entry failures for a virtual smart card. This is currently device specific. -**Retiring cards**: The final aspect of virtual smart card management is retiring cards when they're no longer needed. When an employee leaves the company, it's desirable to revoke domain access. Revoking sign-in credentials from the certification authority (CA) accomplishes this goal. +**Retire cards**: The final aspect of virtual smart card management is retiring cards when they're no longer needed. When an employee leaves the company, it's desirable to revoke domain access. Revoking sign-in credentials from the certification authority (CA) accomplishes this goal. The card should be reissued if the same computer is used by other employees without reinstalling the operating system. Reusing the former card can allow the former employee to change the PIN after leaving the organization, and then hijack certificates that belong to the new user to obtain unauthorized domain access. However, if the employee takes the virtual smart card-enabled computer, it's only necessary to revoke the certificates that are stored on the virtual smart card. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index d86c288331..55070ad4d8 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -2,7 +2,7 @@ title: Evaluate Virtual Smart Card Security description: Learn about the security characteristics and considerations when deploying TPM virtual smart cards. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Evaluate Virtual Smart Card Security @@ -39,7 +39,7 @@ The Trusted Computing Group specifies that if the response to attacks involves s 1. Allow only a limited number of wrong PIN attempts before enabling a lockout that enforces a time delay before any further commands are accepted by the TPM. > [!NOTE] - > + > > If the user enters the wrong PIN five consecutive times for a virtual smart card (which works in conjunction with the TPM), the card is blocked. When the card is blocked, it must be unblocked by using the administrative key or the PUK. 1. Increase the time delay exponentially as the user enters the wrong PIN so that an excessive number of wrong PIN attempts quickly trigger long delays in accepting commands. @@ -49,4 +49,4 @@ For example, it will take 14 years to guess an eight character PIN for a TPM tha 1. Number of wrong PINs allowed before entering lockout (threshold): 9 1. Time the TPM is in lockout after the threshold is reached: 10 seconds -1. Timed delay doubles for each wrong PIN after the threshold is reached \ No newline at end of file +1. Timed delay doubles for each wrong PIN after the threshold is reached diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index e3348db8ba..86f7640799 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -2,7 +2,7 @@ title: Get Started with Virtual Smart Cards - Walkthrough Guide description: This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Get Started with Virtual Smart Cards: Walkthrough Guide @@ -15,31 +15,27 @@ Virtual smart cards are a technology from Microsoft that offer comparable securi This step-by-step walkthrough shows you how to set up a basic test environment for using TPM virtual smart cards. After you complete this walkthrough, you will have a functional virtual smart card installed on the Windows computer. -**Time requirements** +### Time requirements You should be able to complete this walkthrough in less than one hour, excluding installing software and setting up the test domain. -**Walkthrough steps** +### Walkthrough steps -- [Prerequisites](#prerequisites) +- [Prerequisites](#prerequisites) +- [Step 1: Create the certificate template](#step-1-create-the-certificate-template) +- [Step 2: Create the TPM virtual smart card](#step-2-create-the-tpm-virtual-smart-card) +- [Step 3: Enroll for the certificate on the TPM Virtual Smart Card](#step-3-enroll-for-the-certificate-on-the-tpm-virtual-smart-card) -- [Step 1: Create the certificate template](#step-1-create-the-certificate-template) - -- [Step 2: Create the TPM virtual smart card](#step-2-create-the-tpm-virtual-smart-card) - -- [Step 3: Enroll for the certificate on the TPM Virtual Smart Card](#step-3-enroll-for-the-certificate-on-the-tpm-virtual-smart-card) - -> **Important**  This basic configuration is for test purposes only. It is not intended for use in a production environment. +> [!IMPORTANT] +> This basic configuration is for test purposes only. It is not intended for use in a production environment. ## Prerequisites You will need: -- A computer running Windows 10 with an installed and fully functional TPM (version 1.2 or version 2.0). - -- A test domain to which the computer listed above can be joined. - -- Access to a server in that domain with a fully installed and running certification authority (CA). +- A computer running Windows 10 with an installed and fully functional TPM (version 1.2 or version 2.0) +- A test domain to which the computer listed above can be joined +- Access to a server in that domain with a fully installed and running certification authority (CA) ## Step 1: Create the certificate template @@ -47,13 +43,12 @@ On your domain server, you need to create a template for the certificate that yo ### To create the certificate template -1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator**. - -2. Click **File**, and then click **Add/Remove Snap-in**. +1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator** +2. Select **File** > **Add/Remove Snap-in** ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) -3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. +3. In the available snap-ins list, click **Certificate Templates**, and then click **Add** ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) @@ -70,19 +65,16 @@ On your domain server, you need to create a template for the certificate that yo 7. On the **General** tab: 1. Specify a name, such as **TPM Virtual Smart Card Logon**. - 2. Set the validity period to the desired value. 8. On the **Request Handling** tab: 1. Set the **Purpose** to **Signature and smartcard logon**. - 2. Click **Prompt the user during enrollment**. 9. On the **Cryptography** tab: 1. Set the minimum key size to 2048. - 2. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. 10. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. @@ -155,8 +147,6 @@ The virtual smart card can now be used as an alternative credential to sign in t ## See also -- [Understanding and Evaluating Virtual Smart Cards](virtual-smart-card-understanding-and-evaluating.md) - -- [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md) - -- [Deploy Virtual Smart Cards](virtual-smart-card-deploy-virtual-smart-cards.md) +- [Understanding and Evaluating Virtual Smart Cards](virtual-smart-card-understanding-and-evaluating.md) +- [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md) +- [Deploy Virtual Smart Cards](virtual-smart-card-deploy-virtual-smart-cards.md) diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index 1445f06ad2..2790601237 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -2,7 +2,7 @@ title: Virtual Smart Card Overview description: Learn about virtual smart card technology for Windows. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Virtual Smart Card Overview diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index 5eca1fae1e..a6719fc684 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -2,7 +2,7 @@ title: Tpmvscmgr description: Learn about the Tpmvscmgr command-line tool, through which an administrator can create and delete TPM virtual smart cards on a computer. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Tpmvscmgr diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 77e78baaf2..89cc719e7d 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -3,7 +3,7 @@ title: Understanding and Evaluating Virtual Smart Cards description: Learn how smart card technology can fit into your authentication design. ms.prod: windows-client ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Understand and Evaluate Virtual Smart Cards diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index ddb91270e5..3143cf5fb7 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -2,7 +2,7 @@ title: Use Virtual Smart Cards description: Learn about the requirements for virtual smart cards, how to use and manage them. ms.topic: conceptual -ms.date: 02/22/2023 +ms.date: 11/06/2023 --- # Use Virtual Smart Cards @@ -13,13 +13,13 @@ Learn about the requirements for virtual smart cards, how to use and manage them ## Requirements, restrictions, and limitations -| Area | Requirements and details | -|-------------|---------------------------| -| Supported operating systems | Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows 10
Windows 8.1
Windows 8 | -| Supported Trusted Platform Module (TPM) | Any TPM that adheres to the TPM main specifications for version 1.2 or version 2.0 (as set by the Trusted Computing Group) is supported for use as a virtual smart card. For more information, see the [TPM Main Specification](http://www.trustedcomputinggroup.org/resources/tpm_main_specification). | -| Supported virtual smart cards per computer | Ten smart cards can be connected to a computer or device at one time. This includes physical and virtual smart cards combined.

**Note**
You can create more than one virtual smart card; however, after creating more than four virtual smart cards, you may start to notice performance degradation. Because all smart cards appear as if they're always inserted, if more than one person shares a computer or device, each person can see all the virtual smart cards that are created on that computer or device. If the user knows the PIN values for all the virtual smart cards, the user will also be able to use them.
| -| Supported number of certificates on a virtual smart card | A single TPM virtual smart card can contain 30 distinct certificates with the corresponding private keys. Users can continue to renew certificates on the card until the total number of certificates on a card exceeds 90. The reason that the total number of certificates is different from the total number of private keys is that sometimes the renewal can be done with the same private key—in which case a new private key isn't generated. | -| PIN, PIN Unlock Key (PUK), and Administrative key requirements | The PIN and the PUK must be a minimum of eight characters that can include numerals, alphabetic characters, and special characters.
The Administrative key must be entered as 48 hexadecimal characters. It's a 3-key triple DES with ISO/IEC 9797 padding method 2 in CBC chaining mode. | +| Area | Requirements and details | +|--|--| +| Supported operating systems | Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows 10
Windows 8.1
Windows 8 | +| Supported Trusted Platform Module (TPM) | Any TPM that adheres to the TPM main specifications for version 1.2 or version 2.0 (as set by the Trusted Computing Group) is supported for use as a virtual smart card. For more information, see the [TPM Main Specification](http://www.trustedcomputinggroup.org/resources/tpm_main_specification). | +| Supported virtual smart cards per computer | Ten smart cards can be connected to a computer or device at one time. This includes physical and virtual smart cards combined.

**Note**
You can create more than one virtual smart card; however, after creating more than four virtual smart cards, you may start to notice performance degradation. Because all smart cards appear as if they're always inserted, if more than one person shares a computer or device, each person can see all the virtual smart cards that are created on that computer or device. If the user knows the PIN values for all the virtual smart cards, the user will also be able to use them.
| +| Supported number of certificates on a virtual smart card | A single TPM virtual smart card can contain 30 distinct certificates with the corresponding private keys. Users can continue to renew certificates on the card until the total number of certificates on a card exceeds 90. The reason that the total number of certificates is different from the total number of private keys is that sometimes the renewal can be done with the same private key—in which case a new private key isn't generated. | +| PIN, PIN Unlock Key (PUK), and Administrative key requirements | The PIN and the PUK must be a minimum of eight characters that can include numerals, alphabetic characters, and special characters.
The Administrative key must be entered as 48 hexadecimal characters. It's a 3-key triple DES with ISO/IEC 9797 padding method 2 in CBC chaining mode. | ## Using Tpmvscmgr.exe From e514ba7c44e05c476e93832617890b02cd2fe42e Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 6 Nov 2023 16:11:25 -0500 Subject: [PATCH 04/21] updates --- .../smart-card-and-remote-desktop-services.md | 10 +- .../smart-cards/smart-card-architecture.md | 94 ++++++++++--------- ...rt-card-certificate-propagation-service.md | 52 +++++----- ...ertificate-requirements-and-enumeration.md | 55 +++++------ ...-windows-smart-card-technical-reference.md | 2 +- .../virtual-smart-card-get-started.md | 3 +- 6 files changed, 103 insertions(+), 113 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 2f0dcd3354..c71e953a49 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -9,12 +9,12 @@ ms.reviewer: ardenw This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. -Smart card redirection logic and **WinSCard** API are combined to support multiple redirected sessions into a single process. +Smart card redirection logic and *WinSCard API* are combined to support multiple redirected sessions into a single process. Smart card support is required to enable many Remote Desktop Services scenarios. These include: - Using Fast User Switching or Remote Desktop Services. A user is not able to establish a redirected smart card-based remote desktop connection. That is, the connect attempt is not successful in Fast User Switching or from a Remote Desktop Services session -- Enabling Encrypting File System (EFS) to locate the user's smart card reader from the Local Security Authority (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS is not able to locate the smart card reader or certificate, EFS cannot decrypt user files +- Enabling *Encrypting File System* (EFS) to locate the user's smart card reader from the *Local Security Authority* (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS is not able to locate the smart card reader or certificate, EFS cannot decrypt user files ## Remote Desktop Services redirection @@ -86,10 +86,6 @@ For information about this option for the command-line tool, see [-addstore](/pr > [!NOTE] > To sign in with a smart card from a computer that is not joined to a domain, the smart card must contain the root certification of the domain controller. A public key infrastructure (PKI) secure channel cannot be established without the root certification of the domain controller. -Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: <*ClientName*>@<*DomainDNSName*> +Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: `@`. The UPN in the certificate must include a domain that can be resolved. Otherwise, the Kerberos protocol cannot determine which domain to contact. You can resolve this issue by enabling GPO X509 domain hints. For more information about this setting, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). - -## See also - -[How Smart Card Sign-in Works in Windows](smart-card-how-smart-card-sign-in-works-in-windows.md) \ No newline at end of file diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 786822878b..3318a8ee19 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -135,14 +135,13 @@ In response to a CryptAcquireContext call in CryptoAPI, the Base CSP tries to ma Similarly, in response to a NCryptOpenKey call in CNG, the smart card KSP tries to match the container the same way, and it takes the same container format, as shown in the following table. -> **Note**   > [!NOTE] -> Before opening a key by using the smart card KSP, a call to NCryptOpenStorageProvider (`MS\_SMART\_CARD\_KEY\_STORAGE\_PROVIDER`) must be made. +> Before opening a key by using the smart card KSP, a call to NCryptOpenStorageProvider (`MS_SMART_CARD_KEY_STORAGE_PROVIDER`) must be made. | **Type** | **Name** | **Format** | |----------|----------|------------| -| I | Reader Name and Container Name | `\\\\.\\\\` | -| II | Reader Name and Container Name (NULL) | `\\\\.\\` | +| I | Reader Name and Container Name | `\.\\` | +| II | Reader Name and Container Name (NULL) | `\.\` | | III | Container Name Only | `` | | IV | Default Container (NULL) Only | NULL | @@ -152,62 +151,63 @@ The Base CSP and smart card KSP cache smart card handle information about the ca The following three container operations can be requested by using CryptAcquireContext: -1. Create a new container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_NEWKEYSET is NCryptCreatePersistedKey.) +1. Create a new container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT_NEWKEYSET is NCryptCreatePersistedKey.) 1. Open an existing container. (The CNG equivalent of CryptAcquireContext to open the container is NCryptOpenKey.) -1. Delete a container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT\_DELETEKEYSET is NCryptDeleteKey.) +1. Delete a container. (The CNG equivalent of CryptAcquireContext with dwFlags set to CRYPT_DELETEKEYSET is NCryptDeleteKey.) The heuristics that are used to associate a cryptographic handle with a particular smart card and reader are based on the container operation requested and the level of container specification used. The following table shows the restrictions for the container creation operation. -| **Specification** | **Restriction** | -|------------------------------------|-----------| -| No silent context | Key container creation must always be able to show UI, such as the PIN prompt. | +| Specification | Restriction | +|--|--| +| No silent context | Key container creation must always be able to show UI, such as the PIN prompt. | | No overwriting existing containers | If the specified container already exists on the chosen smart card, choose another smart card or cancel the operation. | #### Context flags The following table shows the context flags used as restrictions for the container creation operation. -| **Flag** | **Description** | -|------------------------|------------------------------------------------------| -| CRYPT\_SILENT | No UI can be displayed during this operation. | -| CRYPT\_MACHINE\_KEYSET | No cached data should be used during this operation. | -| CRYPT\_VERIFYCONTEXT | Only public data can be accessed on the smart card. | +| Flag | Description | +|--|--| +| `CRYPT_SILENT` | No UI can be displayed during this operation. | +| `CRYPT_MACHINE_KEYSET` | No cached data should be used during this operation. | +| `CRYPT_VERIFYCONTEXT` | Only public data can be accessed on the smart card. | In addition to container operations and container specifications, you must consider other user options, such as the CryptAcquireContext flags, during smart card selection. -> **Important**  The CRYPT\_SILENT flag cannot be used to create a new container. +> [!IMPORTANT] +> The CRYPT_SILENT flag cannot be used to create a new container. #### Create a new container in silent context -Applications can call the Base CSP with CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL, set the PIN in silent context, and then create a new container in silent context. This operation occurs as follows: +Applications can call the Base CSP with `CRYPT_DEFAULT_CONTAINER_OPTIONAL`, set the PIN in silent context, and then create a new container in silent context. This operation occurs as follows: -1. Call CryptAcquireContext by passing the smart card reader name in as a type II container specification level, and specifying the CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL flag. -1. Call CryptSetProvParam by specifying PP\_KEYEXCHANGE\_PIN or PP\_SIGNATURE\_PIN and a null-terminated ASCII PIN. -1. Release the context acquired in Step 1. -1. Call CryptAcquireContext with CRYPT\_NEWKEYSET, and specify the type I container specification level. -1. Call CryptGenKey to create the key. +1. Call CryptAcquireContext by passing the smart card reader name in as a type II container specification level, and specifying the `CRYPT_DEFAULT_CONTAINER_OPTIONAL` flag +1. Call CryptSetProvParam by specifying `PP_KEYEXCHANGE_PIN` or `PP_SIGNATURE_PIN` and a null-terminated ASCII PIN. +1. Release the context acquired in Step 1 +1. Call CryptAcquireContext with `CRYPT_NEWKEYSET`, and specify the type I container specification level +1. Call CryptGenKey to create the key #### Smart card selection behavior -In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart shows the selection steps performed by the Windows operating system. +In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or select **Cancel**. If the user cancels the operation, the operation fails. The flow chart shows the selection steps performed by the Windows operating system. ![Smart card selection process.](images/sc-image205.png) In general, smart card selection behavior is handled by the SCardUIDlgSelectCard API. The Base CSP interacts with this API by calling it directly. The Base CSP also sends callback functions that have the purpose of filtering and matching candidate smart cards. Callers of CryptAcquireContext provide smart card matching information. Internally, the Base CSP uses a combination of smart card serial numbers, reader names, and container names to find specific smart cards. -Each call to SCardUI \* may result in additional information read from a candidate smart card. The Base CSP smart card selection callbacks cache this information. +Each call to `SCardUI *` may result in additional information read from a candidate smart card. The Base CSP smart card selection callbacks cache this information. #### Make a smart card reader match For type I and type II container specification levels, the smart card selection process is less complex because only the smart card in the named reader can be considered a match. The process for matching a smart card with a smart card reader is: -1. Find the requested smart card reader. If it cannot be found, the process fails. (This requires a cache search by reader name.) -1. If no smart card is in the reader, the user is prompted to insert a smart card. (This is only in non-silent mode; if the call is made in silent mode, it will fail.) -1. For container specification level II only, the name of the default container on the chosen smart card is determined. -1. To open an existing container or delete an existing container, find the specified container. If the specified container cannot be found on this smart card, the user is prompted to insert a smart card. -1. If the system attempts to create a new container, if the specified container already exists on this smart card, the process fails. +1. Find the requested smart card reader. If it cannot be found, the process fails (this requires a cache search by reader name) +1. If no smart card is in the reader, the user is prompted to insert a smart card. (this is only in non-silent mode; if the call is made in silent mode, it will fail) +1. For container specification level II only, the name of the default container on the chosen smart card is determined +1. To open an existing container or delete an existing container, find the specified container. If the specified container cannot be found on this smart card, the user is prompted to insert a smart card +1. If the system attempts to create a new container, if the specified container already exists on this smart card, the process fails #### Make a smart card match @@ -215,26 +215,28 @@ For container specification levels III and IV, a broader method is used to match #### Open an existing default container (no reader specified) -> **Note**  This operation requires that you use the smart card with the Base CSP. +> [!NOTE] +> This operation requires that you use the smart card with the Base CSP. -1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the Base CSP continues to search for a new smart card. -1. If a matching smart card is not found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container. +1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the Base CSP continues to search for a new smart card +1. If a matching smart card is not found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container #### Open an existing GUID-named container (no reader specified) -> **Note**  This operation requires that you use the smart card with the Base CSP. +> [!NOTE] +> This operation requires that you use the smart card with the Base CSP. -1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the smart card's serial number is passed to the SCardUI \* API to continue searching for this specific smart card (rather than only a general match for the container name). - -1. If a matching smart card is not found in the Base CSP cache, a call is made to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name. +1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the smart card's serial number is passed to the `SCardUI *` API to continue searching for this specific smart card (rather than only a general match for the container name) +1. If a matching smart card is not found in the Base CSP cache, a call is made to the smart card subsystem. `SCardUIDlgSelectCard()` is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name #### Create a new container (no reader specified) -> **Note**  This operation requires that you use the smart card with the Base CSP. +> [!NOTE] +> This operation requires that you use the smart card with the Base CSP. -If the PIN is not cached, no CRYPT\_SILENT is allowed for the container creation because the user must be prompted for a PIN, at a minimum. +If the PIN is not cached, no CRYPT_SILENT is allowed for the container creation because the user must be prompted for a PIN, at a minimum. -For other operations, the caller may be able to acquire a "verify" context against the default container (CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL) and then make a call with CryptSetProvParam to cache the user PIN for subsequent operations. +For other operations, the caller may be able to acquire a *verify* context against the default container `CRYPT_DEFAULT_CONTAINER_OPTIONAL` and then make a call with CryptSetProvParam to cache the user PIN for subsequent operations. 1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: 1. If the smart card has been removed, continue the search @@ -249,7 +251,7 @@ For other operations, the caller may be able to acquire a "verify" context again 1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: 1. If the smart card does not have the named container, continue the search 1. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI -1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card. +1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card ### Base CSP and KSP-based architecture in Windows @@ -262,13 +264,13 @@ The following diagram shows the Cryptography architecture that is used by the Wi > [!NOTE] > The API definitions are located in WinCrypt.h and WinSCard.h. -| **Property** | **Description** | -|-----------------------|------------------| -| PP\_USER\_CERTSTORE | - Used to return an HCERTSTORE that contains all user certificates on the smart card
- Read-only (used only by CryptGetProvParam)
- Caller responsible for closing the certificate store
- Certificate encoded using PKCS\_7\_ASN\_ENCODING or X509\_ASN\_ENCODING
- CSP should set KEY\_PROV\_INFO on certificates
- Certificate store should be assumed to be an in-memory store
- Certificates should have a valid CRYPT\_KEY\_PROV\_INFO as a property | -| PP\_ROOT\_CERTSTORE | - Read and Write (used by CryptGetProvParam and CryptSetProvParam)
- Used to write a collection of root certificates to the smart card or return HCERTSTORE, which contains root certificates from the smart card
- Used primarily for joining a domain by using a smart card
- Caller responsible for closing the certificate store | -| PP\_SMARTCARD\_READER | - Read-only (used only by CryptGetProvParam)
- Returns the smart card reader name as an ANSI string that is used to construct a fully qualified container name (that is, a smart card reader plus a container) | -| PP\_SMARTCARD\_GUID | - Return smart card GUID (also known as a serial number), which should be unique for each smart card
- Used by the certificate propagation service to track the source of a root certificate| -| PP\_UI\_PROMPT | - Used to set the search string for the SCardUIDlgSelectCard card insertion dialog box
- Persistent for the entire process when it is set
- Write-only (used only by CryptSetProvParam) | +| Property | Description | +|--|--| +| `PP_USER_CERTSTORE` | - Used to return an `HCERTSTORE` that contains all user certificates on the smart card
- Read-only (used only by `CryptGetProvParam`)
- Caller responsible for closing the certificate store
- Certificate encoded using `PKCS_7_ASN_ENCODING` or `X509_ASN_ENCODING`
- CSP should set `KEY_PROV_INFO` on certificates
- Certificate store should be assumed to be an in-memory store
- Certificates should have a valid `CRYPT_KEY_PROV_INFO` as a property | +| `PP_ROOT_CERTSTORE` | - Read and Write (used by `CryptGetProvParam` and `CryptSetProvParam`)
- Used to write a collection of root certificates to the smart card or return `HCERTSTORE`, which contains root certificates from the smart card
- Used primarily for joining a domain by using a smart card
- Caller responsible for closing the certificate store | +| `PP_SMARTCARD_READER` | - Read-only (used only by `CryptGetProvParam`)
- Returns the smart card reader name as an ANSI string that is used to construct a fully qualified container name (that is, a smart card reader plus a container) | +| `PP_SMARTCARD_GUID `| - Return smart card GUID (also known as a serial number), which should be unique for each smart card
- Used by the certificate propagation service to track the source of a root certificate | +| `PP_UI_PROMPT` | - Used to set the search string for the `SCardUIDlgSelectCard` card insertion dialog box
- Persistent for the entire process when it is set
- Write-only (used only by `CryptSetProvParam`) | ### Implications for CSPs in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 62737034ae..9aa4972ebf 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -12,53 +12,43 @@ This topic for the IT professional describes the certificate propagation service The certificate propagation service activates when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. Certificate propagation service actions are controlled by using Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). -> **Note**  The certificate propagation service must be running for smart card Plug and Play to work. +> [!NOTE] +> The certificate propagation service must be running for smart card Plug and Play to work. The following figure shows the flow of the certificate propagation service. The action begins when a signed-in user inserts a smart card. -1. The arrow labeled **1** indicates that the Service Control Manager (SCM) notifies the certificate propagation service (CertPropSvc) when a user signs in, and CertPropSvc begins to monitor the smart cards in the user session. +1. The arrow labeled **1** indicates that the Service Control Manager (SCM) notifies the certificate propagation service (CertPropSvc) when a user signs in, and CertPropSvc begins to monitor the smart cards in the user session +1. The arrow labeled **R** represents the possibility of a remote session and the use of smart card redirection +1. The arrow labeled **2** indicates the certification to the reader +1. The arrow labeled **3** indicates the access to the certificate store during the client session -2. The arrow labeled **R** represents the possibility of a remote session and the use of smart card redirection. - -3. The arrow labeled **2** indicates the certification to the reader. - -4. The arrow labeled **3** indicates the access to the certificate store during the client session. - -**Certificate propagation service** +### Certificate propagation service ![Certificate propagation service.](images/sc-image302.gif) -1. A signed-in user inserts a smart card. +1. A signed-in user inserts a smart card +1. CertPropSvc is notified that a smart card was inserted +1. CertPropSvc reads all certificates from all inserted smart cards. The certificates are written to the user's personal certificate store -2. CertPropSvc is notified that a smart card was inserted. - -3. CertPropSvc reads all certificates from all inserted smart cards. The certificates are written to the user's personal certificate store. - -> **Note**  The certificate propagation service is started as a Remote Desktop Services dependency. +> [!NOTE] +> The certificate propagation service is started as a Remote Desktop Services dependency. Properties of the certificate propagation service include: -- CERT\_STORE\_ADD\_REPLACE\_EXISTING\_INHERIT\_PROPERTIES adds certificates to a user's Personal store. - -- If the certificate has the CERT\_ENROLLMENT\_PROP\_ID property (as defined by wincrypt.h), it filters empty requests and places them in the current user's request store, but it does not propagate them to the user's Personal store. - -- The service does not propagate any computer certificates to a user's Personal store or propagate user certificates to a computer store. - -- The service propagates certificates according to Group Policy options that are set, which may include: - - - **Turn on certificate propagation from the smart card** specifies whether a user's certificate should be propagated. - - - **Turn on root certificate propagation from smart card** specifies whether root certificates should be propagated. - - - **Configure root certificate cleanup** specifies how root certificates are removed. +- `CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES` adds certificates to a user's Personal store +- If the certificate has the `CERT_ENROLLMENT_PROP_ID` property (as defined by `wincrypt.h`), it filters empty requests and places them in the current user's request store, but it does not propagate them to the user's Personal store +- The service does not propagate any computer certificates to a user's Personal store or propagate user certificates to a computer store +- The service propagates certificates according to Group Policy options that are set, which may include: + - **Turn on certificate propagation from the smart card** specifies whether a user's certificate should be propagated + - **Turn on root certificate propagation from smart card** specifies whether root certificates should be propagated + - **Configure root certificate cleanup** specifies how root certificates are removed ## Root certificate propagation service Root certificate propagation is responsible for the following smart card deployment scenarios when public key infrastructure (PKI) trust has not yet been established: -- Joining the domain - -- Accessing a network remotely +- Joining the domain +- Accessing a network remotely In both cases, the computer is not joined to a domain, and therefore, trust is not being managed by Group Policy. However, the objective is to authenticate to a remote server, such as the domain controller. Root certificate propagation provides the ability to use the smart card to include the missing trust chain. diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 0311f04e6f..be6c3a00a1 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -13,19 +13,19 @@ This topic for the IT professional and smart card developers describes how certi When a smart card is inserted, the following steps are performed. > [!NOTE] -> Unless otherwise mentioned, all operations are performed silently (CRYPT\_SILENT is passed to CryptAcquireContext). +> Unless otherwise mentioned, all operations are performed silently (CRYPT_SILENT is passed to CryptAcquireContext). 1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). -1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\\\.\\<Reader name>\\ +1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\.\\ 1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. -1. The name of the container is retrieved by using the PP\_CONTAINER parameter with CryptGetProvParam. -1. Using the context acquired in Step 3, the CSP is queried for the PP\_USER\_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. -1. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT\_KEYEXCHANGE key. -1. The certificate is then queried from the key context by using KP\_CERTIFICATE. The certificate is added to an in-memory certificate store. +1. The name of the container is retrieved by using the PP_CONTAINER parameter with CryptGetProvParam. +1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. +1. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT_KEYEXCHANGE key. +1. The certificate is then queried from the key context by using KP_CERTIFICATE. The certificate is added to an in-memory certificate store. 1. For each certificate in the certificate store from Step 5 or Step 7, the following checks are performed: 1. The certificate must be valid, based on the computer system clock (not expired or valid with a future date). - 1. The certificate must not be in the AT\_SIGNATURE part of a container. + 1. The certificate must not be in the AT_SIGNATURE part of a container. 1. The certificate must have a valid user principal name (UPN). 1. The certificate must have the digital signature key usage. 1. The certificate must have the smart card logon EKU. @@ -59,9 +59,9 @@ Following are the steps that are performed during a smart card sign-in: 1. Winlogon requests the sign-in UI credential information. 1. Asynchronously, smart card resource manager starts, and the smart card credential provider does the following: - 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). - 1. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. - 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. + 1. Gets credential information (a list of known credentials, or if no credentials exist, the smart card reader information that Windows detected). + 1. Gets a list of smart card readers (by using the WinSCard API) and the list of smart cards inserted in each of them. + 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. > [!NOTE] > Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. @@ -70,27 +70,28 @@ Following are the steps that are performed during a smart card sign-in: 1. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. 1. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. -1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB\_CERTIFICATE\_LOGON structure. The main contents of the KERB\_CERTIFICATE\_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. +1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB_CERTIFICATE_LOGON structure. The main contents of the KERB_CERTIFICATE_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. 1. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. 1. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. -1. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB\_AS\_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). +1. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB_AS_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). - If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.
If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. + If the authentication is performed by using a certificate that uses a digital signature, the preauthentication data consists of the user's public certificate and the certificate that is digitally signed with the corresponding private key.\ + If the authentication is performed by using a certificate that uses key encipherment, the preauthentication data consists of the user's public certificate and the certificate that is encrypted with the corresponding private key. 1. To sign the request digitally (as per RFC 4556), a call is made to the corresponding CSP for a private key operation. Because the private key in this case is stored in a smart card, the smart card subsystem is called, and the necessary operation is completed. The result is sent back to the Kerberos security support provider (SSP). 1. The Kerberos SSP sends an authentication request for a ticket-granting-ticket (TGT) (per RFC 4556) to the Key Distribution Center (KDC) service that runs on a domain controller. 1. The KDC finds the user's account object in Active Directory Domain Services (AD DS), as detailed in [Client certificate requirements and mappings](#client-certificate-requirements-and-mappings), and uses the user's certificate to verify the signature. 1. The KDC validates the user's certificate (time, path, and revocation status) to ensure that the certificate is from a trusted source. The KDC uses CryptoAPI to build a certification path from the user's certificate to a root certification authority (CA) certificate that resides in the root store on the domain controller. The KDC then uses CryptoAPI to verify the digital signature on the signed authenticator that was included in the preauthentication data fields. The domain controller verifies the signature and uses the public key from the user's certificate to prove that the request originated from the owner of the private key that corresponds to the public key. The KDC also verifies that the issuer is trusted and appears in the NTAUTH certificate store. 1. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. -1. The domain controller returns the TGT to the client as part of the KRB\_AS\_REP response. +1. The domain controller returns the TGT to the client as part of the KRB_AS_REP response. - > [!NOTE] - > The KRB\_AS\_REP packet consists of: - >- Privilege attribute certificate (PAC) - >- User's SID - >- SIDs of any groups of which the user is a member - >- A request for ticket-granting service (TGS) - >- Preauthentication data + > [!NOTE] + > The KRB_AS_REP packet consists of: + >- Privilege attribute certificate (PAC) + >- User's SID + >- SIDs of any groups of which the user is a member + >- A request for ticket-granting service (TGS) + >- Preauthentication data TGT is encrypted with the master key of the KDC, and the session key is encrypted with a temporary key. This temporary key is derived based on RFC 4556. Using CryptoAPI, the temporary key is decrypted. As part of the decryption process, if the private key is on a smart card, a call is made to the smart card subsystem by using the specified CSP to extract the certificate corresponding to the user's public key. (Programmatic calls for the certificate include CryptAcquireContext, CryptSetProvParam with the PIN, CryptgetUserKey, and CryptGetKeyParam.) After the temporary key is obtained, the Kerberos SSP decrypts the session key. @@ -107,7 +108,7 @@ Following are the steps that are performed during a smart card sign-in: For more information about the Kerberos protocol, see [Microsoft Kerberos](/windows/win32/secauthn/microsoft-kerberos). -By default, the KDC verifies that the client's certificate contains the smart card client authentication EKU szOID\_KP\_SMARTCARD\_LOGON. However, if enabled, the **Allow certificates with no extended key usage certificate attribute** Group Policy setting allows the KDC to not require the SC-LOGON EKU. SC-LOGON EKU is not required for account mappings that are based on the public key. +By default, the KDC verifies that the client's certificate contains the smart card client authentication EKU szOID_KP_SMARTCARD_LOGON. However, if enabled, the **Allow certificates with no extended key usage certificate attribute** Group Policy setting allows the KDC to not require the SC-LOGON EKU. SC-LOGON EKU is not required for account mappings that are based on the public key. ## KDC certificate @@ -117,7 +118,7 @@ Active Directory Certificate Services provides three kinds of certificate templa - Domain controller authentication - Kerberos authentication -Depending on the configuration of the domain controller, one of these types of certificates is sent as a part of the AS\_REP packet. +Depending on the configuration of the domain controller, one of these types of certificates is sent as a part of the AS_REP packet. ## Client certificate requirements and mappings @@ -135,7 +136,7 @@ The smart card certificate has specific format requirements when it is used with | extended key usage (EKU) | The smart card sign-in object identifier is not required.

**Note** If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | | Subject alternative name | E-mail ID is not required for smart card sign-in. | | Subject | Not required | -| Key exchange (AT\_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | +| Key exchange (AT_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | | CRL | Not required | | UPN | Not required | | Notes | You can enable any certificate to be visible for the smart card credential provider. | @@ -144,7 +145,7 @@ The smart card certificate has specific format requirements when it is used with Certificate mapping is based on the UPN that is contained in the subjectAltName (SAN) field of the certificate. Client certificates that do not contain information in the SAN field are also supported. -SSL/TLS can map certificates that do not have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: `` `` and `` are taken from the client certificate, with '\\r' and '\\n' replaced with ','. +SSL/TLS can map certificates that do not have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: `` `` and `` are taken from the client certificate, with '\r' and '\n' replaced with ','. #### Certificate revocation list distribution points @@ -178,7 +179,7 @@ The following figure illustrates the process of mapping user accounts for sign-i ![Certificate processing logic.](images/sc-image407.png) -NT\_AUTH policy is best described in the CERT\_CHAIN\_POLICY\_NT\_AUTH parameter section of the CertVerifyCertificateChainPolicy function. For more information, see [CertVerifyCertificateChainPolicy](/windows/win32/api/wincrypt/nf-wincrypt-certverifycertificatechainpolicy). +NT_AUTH policy is best described in the CERT_CHAIN_POLICY_NT_AUTH parameter section of the CertVerifyCertificateChainPolicy function. For more information, see [CertVerifyCertificateChainPolicy](/windows/win32/api/wincrypt/nf-wincrypt-certverifycertificatechainpolicy). ## Smart card sign-in for a single user with one certificate into multiple accounts @@ -206,7 +207,7 @@ For example, if Certificate1 has CN=CNName1, Certificate2 has CN=User1, and Cert ## Smart card sign-in across forests -For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\\user*, or a fully qualified UPN such as `user@contoso.com`. +For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\user*, or a fully qualified UPN such as `user@contoso.com`. > [!NOTE] > For the hint field to appear during smart card sign-in, the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) must be enabled on the client. diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 230cd5d598..677009a880 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -2,7 +2,7 @@ title: Smart Card Technical Reference description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. ms.reviewer: ardenw -ms.topic: reference +ms.topic: overview ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index 86f7640799..afd2081f1b 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -93,7 +93,8 @@ On your domain server, you need to create a template for the certificate that yo 15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. - > **Note**  It can take some time for your template to replicate to all servers and become available in this list. + > [!NOTE] +> It can take some time for your template to replicate to all servers and become available in this list. ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) From f074e91d7fe079ab9594cff178be1be8b43b3622 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 6 Nov 2023 16:35:41 -0500 Subject: [PATCH 05/21] updates --- .../smart-cards/smart-card-architecture.md | 4 ++-- ...-card-certificate-requirements-and-enumeration.md | 12 ++++++------ .../smart-cards/smart-card-debugging-information.md | 10 +++++----- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 3318a8ee19..97b5d943d7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -140,8 +140,8 @@ Similarly, in response to a NCryptOpenKey call in CNG, the smart card KSP tries | **Type** | **Name** | **Format** | |----------|----------|------------| -| I | Reader Name and Container Name | `\.\\` | -| II | Reader Name and Container Name (NULL) | `\.\` | +| I | Reader Name and Container Name | `\.` | +| II | Reader Name and Container Name (NULL) | `\.` | | III | Container Name Only | `` | | IV | Default Container (NULL) Only | NULL | diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index be6c3a00a1..6d032bebd3 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -16,7 +16,7 @@ When a smart card is inserted, the following steps are performed. > Unless otherwise mentioned, all operations are performed silently (CRYPT_SILENT is passed to CryptAcquireContext). 1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). -1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\.\\ +1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\.\ 1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. 1. The name of the container is retrieved by using the PP_CONTAINER parameter with CryptGetProvParam. 1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. @@ -87,11 +87,11 @@ Following are the steps that are performed during a smart card sign-in: > [!NOTE] > The KRB_AS_REP packet consists of: - >- Privilege attribute certificate (PAC) - >- User's SID - >- SIDs of any groups of which the user is a member - >- A request for ticket-granting service (TGS) - >- Preauthentication data + > - Privilege attribute certificate (PAC) + > - User's SID + > - SIDs of any groups of which the user is a member + > - A request for ticket-granting service (TGS) + > - Preauthentication data TGT is encrypted with the master key of the KDC, and the session key is encrypted with a temporary key. This temporary key is derived based on RFC 4556. Using CryptoAPI, the temporary key is decrypted. As part of the decryption process, if the private key is on a smart card, a call is made to the smart card subsystem by using the specified CSP to extract the certificate corresponding to the user's public key. (Programmatic calls for the certificate include CryptAcquireContext, CryptSetProvParam with the PIN, CryptgetUserKey, and CryptGetKeyParam.) After the temporary key is obtained, the Kerberos SSP decrypts the session key. diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 810ef34cf7..86aa2d80de 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -50,8 +50,8 @@ WPP simplifies tracing the operation of the trace provider. It provides a mechan Using WPP, use one of the following commands to enable tracing: ```cmd -tracelog.exe -kd -rt -start -guid \ -f .\.etl -flags -ft 1 -logman start -ets -p {} - -ft 1 -rt -o .\.etl -mode 0x00080000 +tracelog.exe -kd -rt -start -guid -f ..etl -flags -ft 1 +logman.exe start -ets -p {} - -ft 1 -rt -o ..etl -mode 0x00080000 ``` You can use the parameters in the following table. @@ -74,7 +74,7 @@ To enable tracing for the SCardSvr service: ```cmd tracelog.exe -kd -rt -start scardsvr -guid \#13038e47-ffec-425d-bc69-5707708075fe -f .\scardsvr.etl -flags 0xffff -ft 1 -logman start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\scardsvr.etl -mode 0x00080000 +logman.exe start scardsvr -ets -p {13038e47-ffec-425d-bc69-5707708075fe} 0xffff -ft 1 -rt -o .\scardsvr.etl -mode 0x00080000 ``` To enable tracing for `scfilter.sys`: @@ -89,7 +89,7 @@ Using WPP, use one of the following commands to stop the tracing: ```cmd tracelog.exe -stop <*FriendlyName*> -logman -stop <*FriendlyName*> -ets +logman.exe -stop <*FriendlyName*> -ets ``` #### Examples @@ -98,7 +98,7 @@ To stop a trace: ```cmd tracelog.exe -stop scardsvr -logman -stop scardsvr -ets +logman.exe -stop scardsvr -ets ``` ## Kerberos protocol, KDC, and NTLM debugging and tracing From 5beab6114fb803eb3208accda2fcc0ea5d2d31e1 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 08:07:39 -0500 Subject: [PATCH 06/21] metadata updates --- windows/security/docfx.json | 4 +++- .../smart-card-and-remote-desktop-services.md | 13 ++++++------- .../smart-cards/smart-card-architecture.md | 1 - .../smart-card-certificate-propagation-service.md | 1 - ...card-certificate-requirements-and-enumeration.md | 1 - .../smart-cards/smart-card-debugging-information.md | 4 ---- ...smart-card-group-policy-and-registry-settings.md | 1 - ...-card-how-smart-card-sign-in-works-in-windows.md | 1 - .../smart-card-removal-policy-service.md | 1 - .../smart-card-smart-cards-for-windows-service.md | 1 - .../smart-cards/smart-card-tools-and-settings.md | 1 - ...t-card-windows-smart-card-technical-reference.md | 1 - ...rtual-smart-card-understanding-and-evaluating.md | 1 - 13 files changed, 9 insertions(+), 22 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index 040348819b..aa4f877c04 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -218,6 +218,8 @@ "identity-protection/hello-for-business/*.md": "erikdau", "identity-protection/credential-guard/*.md": "zwhittington", "identity-protection/access-control/*.md": "sulahiri", + "identity-protection/smart-cards/*.md": "ardenw", + "identity-protection/virtual-smart-cards/*.md": "ardenw", "operating-system-security/network-security/windows-firewall/*.md": "paoloma", "operating-system-security/network-security/vpn/*.md": "pesmith", "operating-system-security/data-protection/personal-data-encryption/*.md":"rhonnegowda", @@ -231,7 +233,7 @@ "threat-protection/auditing/*.md": "tier3", "operating-system-security/data-protection/bitlocker/*.md": "tier1", "operating-system-security/data-protection/personal-data-encryption/*.md": "tier1", - "operating-system-security/network-security/windows-firewall/*.md": [ "tier3", "must-keep" ] + "operating-system-security/network-security/windows-firewall/*.md": [ "tier2", "must-keep" ] } }, "template": [], diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index c71e953a49..d4578ba511 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -3,7 +3,6 @@ ms.date: 11/06/2023 title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. ms.topic: conceptual -ms.reviewer: ardenw --- # Smart Card and Remote Desktop Services @@ -13,8 +12,8 @@ Smart card redirection logic and *WinSCard API* are combined to support multiple Smart card support is required to enable many Remote Desktop Services scenarios. These include: -- Using Fast User Switching or Remote Desktop Services. A user is not able to establish a redirected smart card-based remote desktop connection. That is, the connect attempt is not successful in Fast User Switching or from a Remote Desktop Services session -- Enabling *Encrypting File System* (EFS) to locate the user's smart card reader from the *Local Security Authority* (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS is not able to locate the smart card reader or certificate, EFS cannot decrypt user files +- Using Fast User Switching or Remote Desktop Services. A user isn't able to establish a redirected smart card-based remote desktop connection. That is, the connect attempt isn't successful in Fast User Switching or from a Remote Desktop Services session +- Enabling *Encrypting File System* (EFS) to locate the user's smart card reader from the *Local Security Authority* (LSA) process in Fast User Switching or in a Remote Desktop Services session. If EFS isn't able to locate the smart card reader or certificate, EFS can't decrypt user files ## Remote Desktop Services redirection @@ -37,9 +36,9 @@ Notes about the redirection model: As a part of the Common Criteria compliance, the RDC client must be configurable to use Credential Manager to acquire and save the user's password or smart card PIN. Common Criteria compliance requires that applications not have direct access to the user's password or PIN. -Common Criteria compliance requires specifically that the password or PIN never leave the LSA unencrypted. A distributed scenario should allow the password or PIN to travel between one trusted LSA and another, and it cannot be unencrypted during transit. +Common Criteria compliance requires specifically that the password or PIN never leave the LSA unencrypted. A distributed scenario should allow the password or PIN to travel between one trusted LSA and another, and it can't be unencrypted during transit. -When smart card-enabled single sign-in (SSO) is used for Remote Desktop Services sessions, users still need to sign in for every new Remote Desktop Services session. However, the user is not prompted for a PIN more than once to establish a Remote Desktop Services session. For example, after the user double-clicks a Microsoft Word document icon that resides on a remote computer, the user is prompted to enter a PIN. This PIN is sent by using a secure channel that the credential SSP has established. The PIN is routed back to the RDC client over the secure channel and sent to Winlogon. The user does not receive any additional prompts for the PIN, unless the PIN is incorrect or there are smart card-related failures. +When smart card-enabled single sign-in (SSO) is used for Remote Desktop Services sessions, users still need to sign in for every new Remote Desktop Services session. However, the user isn't prompted for a PIN more than once to establish a Remote Desktop Services session. For example, after the user double-clicks a Microsoft Word document icon that resides on a remote computer, the user is prompted to enter a PIN. This PIN is sent by using a secure channel that the credential SSP has established. The PIN is routed back to the RDC client over the secure channel and sent to Winlogon. The user doesn't receive any additional prompts for the PIN, unless the PIN is incorrect or there are smart card-related failures. ### Remote Desktop Services and smart card sign-in @@ -47,7 +46,7 @@ Remote Desktop Services enables users to sign in with a smart card by entering a In addition, Group Policy settings that are specific to Remote Desktop Services need to be enabled for smart card-based sign-in. -To enable smart card sign-in to a Remote Desktop Session Host (RD Session Host) server, the Key Distribution Center (KDC) certificate must be present on the RDC client computer. If the computer is not in the same domain or workgroup, the following command can be used to deploy the certificate: +To enable smart card sign-in to a Remote Desktop Session Host (RD Session Host) server, the Key Distribution Center (KDC) certificate must be present on the RDC client computer. If the computer isn't in the same domain or workgroup, the following command can be used to deploy the certificate: ```cmd certutil.exe -dspublish NTAuthCA "DSCDPContainer" @@ -88,4 +87,4 @@ For information about this option for the command-line tool, see [-addstore](/pr Sign-in to Remote Desktop Services across a domain works only if the UPN in the certificate uses the following form: `@`. -The UPN in the certificate must include a domain that can be resolved. Otherwise, the Kerberos protocol cannot determine which domain to contact. You can resolve this issue by enabling GPO X509 domain hints. For more information about this setting, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). +The UPN in the certificate must include a domain that can be resolved. Otherwise, the Kerberos protocol can't determine which domain to contact. You can resolve this issue by enabling GPO X509 domain hints. For more information about this setting, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 97b5d943d7..1146a19d8a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -1,7 +1,6 @@ --- title: Smart Card Architecture description: This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system. -ms.reviewer: ardenw ms.topic: reference-architecture ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 9aa4972ebf..9c38e2a06c 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -1,7 +1,6 @@ --- title: Certificate Propagation Service description: This topic for the IT professional describes the certificate propagation service (CertPropSvc), which is used in smart card implementation. -ms.reviewer: ardenw ms.topic: concept-article ms.date: 08/24/2021 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 6d032bebd3..bbde74b92e 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -1,7 +1,6 @@ --- title: Certificate Requirements and Enumeration description: This topic for the IT professional and smart card developers describes how certificates are managed and used for smart card sign-in. -ms.reviewer: ardenw ms.topic: concept-article ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index 86aa2d80de..df3203f5f6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -1,10 +1,6 @@ --- title: Smart Card Troubleshooting description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. -ms.reviewer: ardenw -ms.collection: - - highpri - - tier2 ms.topic: troubleshooting ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 9cd57a98c5..f502e16622 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -1,7 +1,6 @@ --- title: Smart Card Group Policy and Registry Settings description: Discover the Group Policy, registry key, local security policy, and credential delegation policy settings that are available for configuring smart cards. -ms.reviewer: ardenw ms.topic: reference ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index d3cd7bcdca..15ffe7ff5d 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -1,7 +1,6 @@ --- title: How Smart Card Sign-in Works in Windows description: This topic for IT professional provides links to resources about the implementation of smart card technologies in the Windows operating system. -ms.reviewer: ardenw ms.topic: overview ms.date: 1/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 4b9fd9a3fd..73879b5833 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -1,7 +1,6 @@ --- title: Smart Card Removal Policy Service description: This topic for the IT professional describes the role of the removal policy service (ScPolicySvc) in smart card implementation. -ms.reviewer: ardenw ms.topic: concept-article ms.date: 09/24/2021 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md index c982c67613..6d468b9bda 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md @@ -1,7 +1,6 @@ --- title: Smart Cards for Windows Service description: This topic for the IT professional and smart card developers describes how the Smart Cards for Windows service manages readers and application interactions. -ms.reviewer: ardenw ms.topic: concept-article ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md index 00d223bfe5..737d2d83fc 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-tools-and-settings.md @@ -1,7 +1,6 @@ --- title: Smart Card Tools and Settings description: This topic for the IT professional and smart card developer links to information about smart card debugging, settings, and events. -ms.reviewer: ardenw ms.topic: conceptual ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 677009a880..23a8ac72f8 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -1,7 +1,6 @@ --- title: Smart Card Technical Reference description: Learn about the Windows smart card infrastructure for physical smart cards, and how smart card-related components work in Windows. -ms.reviewer: ardenw ms.topic: overview ms.date: 11/06/2023 --- diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 89cc719e7d..8fafa7059b 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -1,7 +1,6 @@ --- title: Understanding and Evaluating Virtual Smart Cards description: Learn how smart card technology can fit into your authentication design. -ms.prod: windows-client ms.topic: conceptual ms.date: 11/06/2023 --- From 062433f00ae40c92b8bb52096f4c30badc3cf5c4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:06:46 -0500 Subject: [PATCH 07/21] updates --- .../smart-card-and-remote-desktop-services.md | 4 +- .../smart-cards/smart-card-architecture.md | 14 +-- ...rt-card-certificate-propagation-service.md | 8 +- ...ertificate-requirements-and-enumeration.md | 18 +-- .../smart-card-debugging-information.md | 6 +- ...card-group-policy-and-registry-settings.md | 22 ++-- ...how-smart-card-sign-in-works-in-windows.md | 2 +- .../smart-card-removal-policy-service.md | 13 +- ...-windows-smart-card-technical-reference.md | 2 +- ...l-smart-card-deploy-virtual-smart-cards.md | 6 +- .../virtual-smart-card-get-started.md | 114 ++++++------------ .../virtual-smart-card-overview.md | 12 +- .../virtual-smart-card-tpmvscmgr.md | 2 +- ...smart-card-understanding-and-evaluating.md | 26 ++-- ...tual-smart-card-use-virtual-smart-cards.md | 50 ++++---- 15 files changed, 125 insertions(+), 174 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index d4578ba511..61e9d781c0 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -1,6 +1,6 @@ --- -ms.date: 11/06/2023 -title: Smart Card and Remote Desktop Services +ms.date: 11/07/2023 +title: Smart Card and Remote Desktop Services description: This topic for the IT professional describes the behavior of Remote Desktop Services when you implement smart card sign-in. ms.topic: conceptual --- diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 1146a19d8a..bd8330d478 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -248,8 +248,8 @@ For other operations, the caller may be able to acquire a *verify* context again 1. If the specified container name is NULL, the default container is deleted. Deleting the default container causes a new default container to be selected arbitrarily. For this reason, this operation is not recommended 1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: - 1. If the smart card does not have the named container, continue the search - 1. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI + 1. If the smart card does not have the named container, continue the search + 1. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI 1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card ### Base CSP and KSP-based architecture in Windows @@ -265,11 +265,11 @@ The following diagram shows the Cryptography architecture that is used by the Wi | Property | Description | |--|--| -| `PP_USER_CERTSTORE` | - Used to return an `HCERTSTORE` that contains all user certificates on the smart card
- Read-only (used only by `CryptGetProvParam`)
- Caller responsible for closing the certificate store
- Certificate encoded using `PKCS_7_ASN_ENCODING` or `X509_ASN_ENCODING`
- CSP should set `KEY_PROV_INFO` on certificates
- Certificate store should be assumed to be an in-memory store
- Certificates should have a valid `CRYPT_KEY_PROV_INFO` as a property | -| `PP_ROOT_CERTSTORE` | - Read and Write (used by `CryptGetProvParam` and `CryptSetProvParam`)
- Used to write a collection of root certificates to the smart card or return `HCERTSTORE`, which contains root certificates from the smart card
- Used primarily for joining a domain by using a smart card
- Caller responsible for closing the certificate store | -| `PP_SMARTCARD_READER` | - Read-only (used only by `CryptGetProvParam`)
- Returns the smart card reader name as an ANSI string that is used to construct a fully qualified container name (that is, a smart card reader plus a container) | -| `PP_SMARTCARD_GUID `| - Return smart card GUID (also known as a serial number), which should be unique for each smart card
- Used by the certificate propagation service to track the source of a root certificate | -| `PP_UI_PROMPT` | - Used to set the search string for the `SCardUIDlgSelectCard` card insertion dialog box
- Persistent for the entire process when it is set
- Write-only (used only by `CryptSetProvParam`) | +| `PP_USER_CERTSTORE` | - Used to return an `HCERTSTORE` that contains all user certificates on the smart card
- Read-only (used only by `CryptGetProvParam`)
- Caller responsible for closing the certificate store
- Certificate encoded using `PKCS_7_ASN_ENCODING` or `X509_ASN_ENCODING`
- CSP should set `KEY_PROV_INFO` on certificates
- Certificate store should be assumed to be an in-memory store
- Certificates should have a valid `CRYPT_KEY_PROV_INFO` as a property | +| `PP_ROOT_CERTSTORE` | - Read and Write (used by `CryptGetProvParam` and `CryptSetProvParam`)
- Used to write a collection of root certificates to the smart card or return `HCERTSTORE`, which contains root certificates from the smart card
- Used primarily for joining a domain by using a smart card
- Caller responsible for closing the certificate store | +| `PP_SMARTCARD_READER` | - Read-only (used only by `CryptGetProvParam`)
- Returns the smart card reader name as an ANSI string that is used to construct a fully qualified container name (that is, a smart card reader plus a container) | +| `PP_SMARTCARD_GUID` | - Return smart card GUID (also known as a serial number), which should be unique for each smart card
- Used by the certificate propagation service to track the source of a root certificate | +| `PP_UI_PROMPT` | - Used to set the search string for the `SCardUIDlgSelectCard` card insertion dialog box
- Persistent for the entire process when it is set
- Write-only (used only by `CryptSetProvParam`) | ### Implications for CSPs in Windows diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 9c38e2a06c..8cfae399fd 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -21,8 +21,6 @@ The following figure shows the flow of the certificate propagation service. The 1. The arrow labeled **2** indicates the certification to the reader 1. The arrow labeled **3** indicates the access to the certificate store during the client session -### Certificate propagation service - ![Certificate propagation service.](images/sc-image302.gif) 1. A signed-in user inserts a smart card @@ -38,9 +36,9 @@ Properties of the certificate propagation service include: - If the certificate has the `CERT_ENROLLMENT_PROP_ID` property (as defined by `wincrypt.h`), it filters empty requests and places them in the current user's request store, but it does not propagate them to the user's Personal store - The service does not propagate any computer certificates to a user's Personal store or propagate user certificates to a computer store - The service propagates certificates according to Group Policy options that are set, which may include: - - **Turn on certificate propagation from the smart card** specifies whether a user's certificate should be propagated - - **Turn on root certificate propagation from smart card** specifies whether root certificates should be propagated - - **Configure root certificate cleanup** specifies how root certificates are removed + - **Turn on certificate propagation from the smart card** specifies whether a user's certificate should be propagated + - **Turn on root certificate propagation from smart card** specifies whether root certificates should be propagated + - **Configure root certificate cleanup** specifies how root certificates are removed ## Root certificate propagation service diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index bbde74b92e..1ac825dde6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -15,7 +15,7 @@ When a smart card is inserted, the following steps are performed. > Unless otherwise mentioned, all operations are performed silently (CRYPT_SILENT is passed to CryptAcquireContext). 1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). -1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is *\\.\ +1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is `\\.\` 1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. 1. The name of the container is retrieved by using the PP_CONTAINER parameter with CryptGetProvParam. 1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. @@ -84,13 +84,13 @@ Following are the steps that are performed during a smart card sign-in: 1. The KDC service retrieves user account information from AD DS. The KDC constructs a TGT, which is based on the user account information that it retrieves from AD DS. The TGT's authorization data fields include the user's security identifier (SID), the SIDs for universal and global domain groups to which the user belongs, and (in a multidomain environment) the SIDs for any universal groups of which the user is a member. 1. The domain controller returns the TGT to the client as part of the KRB_AS_REP response. - > [!NOTE] - > The KRB_AS_REP packet consists of: - > - Privilege attribute certificate (PAC) - > - User's SID - > - SIDs of any groups of which the user is a member - > - A request for ticket-granting service (TGS) - > - Preauthentication data + > [!NOTE] + > The KRB_AS_REP packet consists of: + > - Privilege attribute certificate (PAC) + > - User's SID + > - SIDs of any groups of which the user is a member + > - A request for ticket-granting service (TGS) + > - Preauthentication data TGT is encrypted with the master key of the KDC, and the session key is encrypted with a temporary key. This temporary key is derived based on RFC 4556. Using CryptoAPI, the temporary key is decrypted. As part of the decryption process, if the private key is on a smart card, a call is made to the smart card subsystem by using the specified CSP to extract the certificate corresponding to the user's public key. (Programmatic calls for the certificate include CryptAcquireContext, CryptSetProvParam with the PIN, CryptgetUserKey, and CryptGetKeyParam.) After the temporary key is obtained, the Kerberos SSP decrypts the session key. @@ -150,7 +150,7 @@ SSL/TLS can map certificates that do not have SAN, and the mapping is done by us ![Certificate revocation list distribution points.](images/sc-image403.png) -#### UPN in Subject Alternative Name field +#### UPN in Subject Alternative Name field ![UPN in Subject Alternative Name field.](images/sc-image404.png) diff --git a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md index df3203f5f6..0ba2519568 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md +++ b/windows/security/identity-protection/smart-cards/smart-card-debugging-information.md @@ -88,9 +88,7 @@ tracelog.exe -stop <*FriendlyName*> logman.exe -stop <*FriendlyName*> -ets ``` -#### Examples - -To stop a trace: +For example, to stop a trace: ```cmd tracelog.exe -stop scardsvr @@ -102,7 +100,7 @@ logman.exe -stop scardsvr -ets You can use these resources to troubleshoot these protocols and the KDC: - [Kerberos and LDAP Troubleshooting Tips](/previous-versions/tn-archive/bb463167(v=technet.10)) -- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit). You can use the trace log tool in this SDK to debug Kerberos authentication failures. +- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/windows/hardware/windows-driver-kit). You can use the trace log tool in this SDK to debug Kerberos authentication failures. To begin tracing, you can use `Tracelog`. Different components use different control GUIDs as explained in these examples. For more information, see [`Tracelog`](/windows-hardware/drivers/devtest/tracelog) diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index f502e16622..6f8e44fde7 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -82,9 +82,9 @@ When this policy setting isn't turned on, only certificates that contain the sma ### Allow ECC certificates to be used for logon and authentication -You can use this policy setting to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. +You can use this policy setting to control whether elliptic curve cryptography (ECC) certificates on a smart card can be used to sign in to a domain. -When this setting is turned on, ECC certificates on a smart card can be used to sign in to a domain. +When this setting is turned on, ECC certificates on a smart card can be used to sign in to a domain. When this setting isn't turned on, ECC certificates on a smart card can't be used to sign in to a domain. @@ -99,7 +99,7 @@ When this setting isn't turned on, ECC certificates on a smart card can't be use You can use this policy setting to determine whether the integrated unblock feature is available in the sign-in user interface (UI). The feature was introduced as a standard feature in the Credential Security Support Provider in Windows Vista. -When this setting is turned on, the integrated unblock feature is available. +When this setting is turned on, the integrated unblock feature is available. When this setting isn't turned on, the feature is not available. @@ -145,7 +145,7 @@ When this policy setting isn't turned on, certificates that are expired or not y You can use this policy setting to determine whether an optional field appears during sign-in and provides a subsequent elevation process where users can enter their username or username and domain, which associates a certificate with the user. -When this policy setting is turned on, users see an optional field where they can enter their username or username and domain. +When this policy setting is turned on, users see an optional field where they can enter their username or username and domain. When this policy setting isn't turned on, users don't see this optional field. @@ -177,7 +177,7 @@ When this policy setting isn't turned on, root certificates are automatically re You can use this policy setting to change the default message that a user sees if their smart card is blocked. -When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. +When this policy setting is turned on, you can create and manage the displayed message that the user sees when a smart card is blocked. When this policy setting isn't turned on (and the integrated unblock feature is also enabled), the user sees the system's default message when the smart card is blocked. @@ -189,14 +189,14 @@ When this policy setting isn't turned on (and the integrated unblock feature is ### Filter duplicate logon certificates -You can use this policy setting to configure which valid sign-in certificates are displayed. +You can use this policy setting to configure which valid sign-in certificates are displayed. > [!NOTE] > During the certificate renewal period, a user's smart card can have multiple valid sign-in certificates issued from the same certificate template, which can cause confusion about which certificate to select. This behavior can occur when a certificate is renewed and the old certificate has not expired yet. -> +> > If two certificates are issued from the same template with the same major version and they are for the same user (this is determined by their UPN), they are determined to be the same. -When this policy setting is turned on, filtering occurs so that the user can select from only the most current valid certificates. +When this policy setting is turned on, filtering occurs so that the user can select from only the most current valid certificates. If this policy setting isn't turned on, all the certificates are displayed to the user. @@ -292,7 +292,7 @@ When this policy setting is turned off, certificate propagation doesn't occur, a ### Turn on root certificate propagation from smart card -You can use this policy setting to manage the root certificate propagation that occurs when a smart card is inserted. +You can use this policy setting to manage the root certificate propagation that occurs when a smart card is inserted. > [!NOTE] > The certificate propagation service applies when a signed-in user inserts a smart card in a reader that is attached to the computer. This action causes the certificate to be read from the smart card. The certificates are then added to the user's Personal store. @@ -344,7 +344,7 @@ The registry keys for the smart card KSP are in `HKEY_LOCAL_MACHINE\SYSTEM\Contr | **RequireOnCardPrivateKeyGen** | This key sets the flag that requires on-card private key generation (default). If this value is set, a key generated on a host can be imported into the smart card. This is used for smart cards that don't support on-card key generation or where key escrow is required.
Default value: 00000000 | | **TransactionTimeoutMilliseconds** | Default timeout values allow you to specify whether transactions that take an excessive amount of time will fail.
Default value: 000005dc
The default timeout for holding transactions to the smart card is 1.5 seconds. | -**Additional registry keys for the smart card KSP** +Additional registry keys for the smart card KSP: | Registry Key | Description | |--|--| @@ -355,8 +355,6 @@ The registry keys for the smart card KSP are in `HKEY_LOCAL_MACHINE\SYSTEM\Contr The following table lists the keys and the corresponding values to turn off certificate revocation list (CRL) checking at the Key Distribution Center (KDC) or client. To manage CRL checking, you must configure settings for both the KDC and the client. -### CRL checking registry keys - | Registry Key | Details | |--|--| | `HKEY_LOCAL_MACHINE\SYSTEM\CCS\Services\Kdc\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors` | Type = DWORD
Value = 1 | diff --git a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md index 15ffe7ff5d..2641967e6d 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md +++ b/windows/security/identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md @@ -16,4 +16,4 @@ This topic for IT professional provides links to resources about the implementat - [Certificate Propagation Service](smart-card-certificate-propagation-service.md): Learn about how the certificate propagation service works when a smart card is inserted into a computer - [Smart Card Removal Policy Service](smart-card-removal-policy-service.md): Learn about using Group Policy to control what happens when a user removes a smart card -[!INCLUDE [smart-cards-for-windows-service](../../../../includes/licensing/smart-cards-for-windows-service.md)] \ No newline at end of file +[!INCLUDE [smart-cards-for-windows-service](../../../../includes/licensing/smart-cards-for-windows-service.md)] diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 73879b5833..970bee548f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -11,19 +11,14 @@ This topic for the IT professional describes the role of the removal policy serv The smart card removal policy service is applicable when a user has signed in with a smart card and then removes that smart card from the reader. The action that is performed when the smart card is removed is controlled by Group Policy settings. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). -**Smart card removal policy service** - ![Smart card removal policy service.](images/sc-image501.gif) The numbers in the previous figure represent the following actions: -1. Winlogon is not directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated. - -2. The smart card resource manager service notifies the smart card removal policy service that a sign-in has occurred. - -3. ScPolicySvc retrieves the smart card information that the smart card credential provider stored in the registry. This call is redirected if the user is in a remote session. If the smart card is removed, ScPolicySvc is notified. - -4. ScPolicySvc calls Remote Desktop Services to take the appropriate action if the request is to sign out the user or to disconnect the user's session, which might result in data loss. If the setting is configured to lock the computer when the smart card is removed, ScPolicySvc sends a message to Winlogon to lock the computer. +1. Winlogon is not directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated. +1. The smart card resource manager service notifies the smart card removal policy service that a sign-in has occurred. +1. ScPolicySvc retrieves the smart card information that the smart card credential provider stored in the registry. This call is redirected if the user is in a remote session. If the smart card is removed, ScPolicySvc is notified. +1. ScPolicySvc calls Remote Desktop Services to take the appropriate action if the request is to sign out the user or to disconnect the user's session, which might result in data loss. If the setting is configured to lock the computer when the smart card is removed, ScPolicySvc sends a message to Winlogon to lock the computer. ## See also diff --git a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md index 23a8ac72f8..b832cf3024 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md +++ b/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md @@ -28,7 +28,7 @@ Smart cards provide: Smart cards can be used to sign in to domain accounts only, not local accounts. When you use a password to sign in interactively to a domain account, Windows uses the Kerberos version 5 (v5) protocol for authentication. If you use a smart card, the operating system uses Kerberos v5 authentication with X.509 v3 certificates. -**Virtual smart cards** were introduced in Windows Server 2012 and Windows 8 to alleviate the need for a physical smart card, the smart card reader, and the associated administration of that hardware. +Virtual smart cards were introduced to alleviate the need for a physical smart card, the smart card reader, and the associated administration of that hardware. [!INCLUDE [virtual-smart-card-deprecation-notice](../../includes/virtual-smart-card-deprecation-notice.md)] diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index c0e66c8f7e..9b7ee29239 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -157,7 +157,7 @@ Similar to physical smart cards, virtual smart cards require certificate enrollm #### Certificate issuance -Users can enroll for certificates from within a remote desktop session that is established to provision the card. This process can also be managed by the smart card management tool that the user runs through the remote desktop connection. This model works for deployments that require the user to sign a request for enrollment by using a physical smart card. The driver for the physical smart card doesn't need to be installed on the client computer if it's installed on the remote computer. This is made possible by smart card redirection functionality that was introduced in Windows Server 2003, which ensures that smart cards that are connected to the client computer are available for use during a remote session. +Users can enroll for certificates from within a remote desktop session that is established to provision the card. This process can also be managed by the smart card management tool that the user runs through the remote desktop connection. This model works for deployments that require the user to sign a request for enrollment by using a physical smart card. The driver for the physical smart card doesn't need to be installed on the client computer if it's installed on the remote computer. This is made possible by smart card redirection functionality, which ensures that smart cards that are connected to the client computer are available for use during a remote session. Alternatively, without establishing a remote desktop connection, users can enroll for certificates from the Certificate Management console (certmgr.msc) on a client computer. Users can also create a request and submit it to a server from within a custom certificate enrollment application (for example, a registration authority) that has controlled access to the certification authority (CA). This requires specific enterprise configuration and deployments for Certificate Enrollment Policies (CEP) and Certificate Enrollment Services (CES). @@ -211,9 +211,7 @@ For deployments that require users to use a physical smart card to sign the cert Another option to ensure that users are strongly authenticated before virtual smart card certificates are issued, is to send a user a one-time password through SMS, email, or phone. The user then types the one-time password during the certificate enrollment from an application or a script on a desktop that invokes built-in command-line tools. -#### Certificate lifecycle management - -Certificate renewal can be done from the same tools that are used for the initial certificate enrollment. Certificate enrollment policies and certificate enrollment services can also be used to perform automatic renewal. +**Certificate lifecycle management**: certificate renewal can be done from the same tools that are used for the initial certificate enrollment. Certificate enrollment policies and certificate enrollment services can also be used to perform automatic renewal. Certificate revocation requires careful planning. When information about the certificate to be revoked is reliably available, the specific certificate can be easily revoked. When information about the certificate to be revoked isn't easy to determine, all certificates issued to the user under the policy that was used to issue the certificate might need to be revoked. For example, if an employee reports a lost or compromised device, and information that associates the device with a certificate isn't available. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index afd2081f1b..fd30cb8172 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -15,11 +15,9 @@ Virtual smart cards are a technology from Microsoft that offer comparable securi This step-by-step walkthrough shows you how to set up a basic test environment for using TPM virtual smart cards. After you complete this walkthrough, you will have a functional virtual smart card installed on the Windows computer. -### Time requirements - You should be able to complete this walkthrough in less than one hour, excluding installing software and setting up the test domain. -### Walkthrough steps +## Walkthrough steps - [Prerequisites](#prerequisites) - [Step 1: Create the certificate template](#step-1-create-the-certificate-template) @@ -44,63 +42,41 @@ On your domain server, you need to create a template for the certificate that yo ### To create the certificate template 1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator** -2. Select **File** > **Add/Remove Snap-in** - +1. Select **File** > **Add/Remove Snap-in** ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) - -3. In the available snap-ins list, click **Certificate Templates**, and then click **Add** - +1. In the available snap-ins list, click **Certificate Templates**, and then click **Add** ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) - -4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. - -5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. - +1. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. +1. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) - -6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - +1. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) - -7. On the **General** tab: - - 1. Specify a name, such as **TPM Virtual Smart Card Logon**. - 2. Set the validity period to the desired value. - -8. On the **Request Handling** tab: - - 1. Set the **Purpose** to **Signature and smartcard logon**. - 2. Click **Prompt the user during enrollment**. - -9. On the **Cryptography** tab: - - 1. Set the minimum key size to 2048. - 2. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. - -10. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. - -11. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. - -12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. - +1. On the **General** tab: + 1. Specify a name, such as **TPM Virtual Smart Card Logon**. + 1. Set the validity period to the desired value. +1. On the **Request Handling** tab: + 1. Set the **Purpose** to **Signature and smartcard logon**. + 1. Click **Prompt the user during enrollment**. +1. On the **Cryptography** tab: + 1. Set the minimum key size to 2048. + 1. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. +1. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. +1. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. +1. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) - -13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. - -14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - +1. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. +1. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) +1. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. -15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. + > [!NOTE] + > It can take some time for your template to replicate to all servers and become available in this list. - > [!NOTE] -> It can take some time for your template to replicate to all servers and become available in this list. + ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) - ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) +1. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. -16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. - - ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) + ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) ## Step 2: Create the TPM virtual smart card @@ -108,19 +84,16 @@ In this step, you will create the virtual smart card on the client computer by u ### To create the TPM virtual smart card -1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. - +1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. ![Cmd prompt, Run as administrator.](images/vsc-10-cmd-run-as-administrator.png) +1. At the command prompt, type the following, and then press ENTER: -2. At the command prompt, type the following, and then press ENTER: + `tpmvscmgr.exe create /name TestVSC /pin default /adminkey random /generate` - `tpmvscmgr.exe create /name TestVSC /pin default /adminkey random /generate` + This will create a virtual smart card with the name **TestVSC**, omit the unlock key, and generate the file system on the card. The PIN will be set to the default, 12345678. To be prompted for a PIN, instead of **/pin default** you can type **/pin prompt**.\ + For more information about the Tpmvscmgr command-line tool, see [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md) and [Tpmvscmgr](virtual-smart-card-tpmvscmgr.md). - This will create a virtual smart card with the name **TestVSC**, omit the unlock key, and generate the file system on the card. The PIN will be set to the default, 12345678. To be prompted for a PIN, instead of **/pin default** you can type **/pin prompt**. - - For more information about the Tpmvscmgr command-line tool, see [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md) and [Tpmvscmgr](virtual-smart-card-tpmvscmgr.md). - -4. Wait several seconds for the process to finish. Upon completion, Tpmvscmgr.exe will provide you with the device instance ID for the TPM Virtual Smart Card. Store this ID for later reference because you will need it to manage or remove the virtual smart card. +1. Wait several seconds for the process to finish. Upon completion, Tpmvscmgr.exe will provide you with the device instance ID for the TPM Virtual Smart Card. Store this ID for later reference because you will need it to manage or remove the virtual smart card. ## Step 3: Enroll for the certificate on the TPM Virtual Smart Card @@ -128,21 +101,14 @@ The virtual smart card must be provisioned with a sign-in certificate for it to ### To enroll the certificate -1. Open the Certificates console by typing **certmgr.msc** on the **Start** menu. - -2. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate**. - - ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) - -3. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1). - - ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) - -4. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)**. - -5. Enter the PIN that was established when you created the TPM virtual smart card, and then click **OK**. - -6. Wait for the enrollment to finish, and then click **Finish**. +1. Open the Certificates console by typing **certmgr.msc** on the **Start** menu +1. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate** + ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) +1. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1) + ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) +1. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)** +1. Enter the PIN that was established when you created the TPM virtual smart card, and then click **OK** +1. Wait for the enrollment to finish, and then click **Finish** The virtual smart card can now be used as an alternative credential to sign in to your domain. To verify that your virtual smart card configuration and certificate enrollment were successful, sign out of your current session, and then sign in. When you sign in, you will see the icon for the new TPM virtual smart card on the Secure Desktop (sign in) screen or you will be automatically directed to the TPM smart card sign-in dialog box. Click the icon, enter your PIN (if necessary), and then click **OK**. You should be signed in to your domain account. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md index 2790601237..ed3cbe24d1 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-overview.md @@ -23,27 +23,27 @@ Virtual smart cards are functionally similar to physical smart cards, appearing ### Authentication use cases -**Two-factor authentication‒based remote access** +#### Two-factor authentication‒based remote access After a user has a fully functional TPM virtual smart card, provisioned with a sign-in certificate, the certificate is used to gain authenticated access to corporate resources. When the proper certificate is provisioned to the virtual card, the user need only provide the PIN for the virtual smart card, as if it was a physical smart card, to sign in to the domain. In practice, this is as easy as entering a password to access the system. Technically, it's far more secure. Using the virtual smart card to access the system proves to the domain that the user who is requesting authentication has possession of the personal computer upon which the card has been provisioned and knows the virtual smart card PIN. Because this request couldn't have possibly originated from a system other than the system certified by the domain for this user's access, and the user couldn't have initiated the request without knowing the PIN, a strong two-factor authentication is established. -**Client authentication** +#### Client authentication Virtual smart cards can also be used for client authentication by using TLS/SSL or a similar technology. Similar to domain access with a virtual smart card, an authentication certificate can be provisioned for the virtual smart card, provided to a remote service, as requested in the client authentication process. This adheres to the principles of two-factor authentication because the certificate is only accessible from the computer that hosts the virtual smart card, and the user is required to enter the PIN for initial access to the card. -**Virtual smart card redirection for remote desktop connections** +#### Virtual smart card redirection for remote desktop connections The concept of two-factor authentication associated with virtual smart cards relies on the proximity of users to the devices that they use to access domain. When you connect to a device that is hosting virtual smart cards, you can't use the virtual smart cards located on the remote device during the remote session. However, you can access the virtual smart cards on the connecting device (which is under your physical control), which are loaded onto the remote device. You can use the virtual smart cards as if they were installed by using the remote devices' TPM, extending your privileges to the remote device, while maintaining the principles of two-factor authentication. ### Confidentiality use cases -**S/MIME email encryption** +#### S/MIME email encryption Physical smart cards are designed to hold private keys. You can use the private keys for email encryption and decryption. The same functionality exists in virtual smart cards. By using S/MIME with a user's public key to encrypt email, the sender of an email is assured that only the person with the corresponding private key can decrypt the email. This assurance is a result of the non-exportability of the private key. It never exists within reach of malicious software, and it remains protected by the TPM—even during decryption. -**BitLocker for data volumes** +#### BitLocker for data volumes BitLocker Drive Encryption technology makes use of symmetric-key encryption to protect the content of a user's hard drive. BitLocker ensures that if the physical ownership of a hard drive is compromised, an adversary won't be able to read data off the drive. The key used to encrypt the drive can be stored in a virtual smart card, which necessitates knowledge of the virtual smart card PIN to access the drive, and possession of the device that is hosting the TPM virtual smart card. If the drive is obtained without access to the TPM that hosts the virtual smart card, any brute force attack will be difficult. @@ -51,7 +51,7 @@ You can use BitLocker to encrypt portable drives, storing keys in virtual smart ### Data integrity use case -**Signing data** +#### Signing data To verify authorship of data, a user can sign it by using a private key stored in the virtual smart card. Digital signatures confirm the integrity and origin of the data. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md index a6719fc684..89752f473d 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md @@ -84,4 +84,4 @@ The following command will create a TPM virtual smart card with the default valu ```console tpmvscmgr.exe create /name "VirtualSmartCardForCorpAccess" /PIN PROMPT /pinpolicy minlen 4 maxlen 8 /AdminKey DEFAULT /attestation AIK_AND_CERT /generate -``` \ No newline at end of file +``` diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 8fafa7059b..2ab0167682 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -17,10 +17,10 @@ Virtual smart cards are functionally similar to physical smart cards. They appea This topic contains the following sections: -- [Comparing virtual smart cards with physical smart cards](#comparing-virtual-smart-cards-with-physical-smart-cards): +- [Comparing virtual smart cards with physical smart cards](#comparing-virtual-smart-cards-with-physical-smart-cards): Compares properties, functional aspects, security, and cost. -- [Authentication design options](#authentication-design-options): +- [Authentication design options](#authentication-design-options): Describes how passwords, smart cards, and virtual smart cards can be used to reach authentication goals in your organization. ## Comparing virtual smart cards with physical smart cards @@ -33,17 +33,17 @@ All cryptographic operations occur in the secure, isolated environment of the TP Virtual smart cards maintain the three key properties of physical smart cards: -- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and non-exportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. +- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and non-exportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). -- **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that are offered by physical smart cards, and this is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM. +- **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that are offered by physical smart cards, and this is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM. -- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. +- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). The following subsections compare the functionality, security, and cost of virtual smart cards and physical smart cards. -**Functionality** +### Functionality The virtual smart card system that was designed by Microsoft closely mimics the functionality of conventional smart cards. The most striking difference to the end user is that the virtual smart card is essentially a smart card that is always inserted into the computer. There's no method to export the user's virtual smart card for use on other computers, which adds to the security of virtual smart cards. If a user requires access to network resources on multiple computers, multiple virtual smart cards can be issued for that user. Additionally, a computer that is shared among multiple users can host multiple virtual smart cards for different users. @@ -51,7 +51,7 @@ The basic user experience for a virtual smart card is as simple as using a passw Additionally, although the anti-hammering functionality of the virtual smart card is equally secure to that of a physical smart card, virtual smart card users are never required to contact an administrator to unblock the card. Instead, they simply wait a period of time (depending on the TPM specifications) before they reattempt to enter the PIN. Alternatively, the administrator can reset the lockout by providing owner authentication data to the TPM on the host computer. -**Security** +### Security Physical smart cards and virtual smart cards offer comparable levels of security. They both implement two-factor authentication for using network resources. However, they differ in certain aspects, including physical security and the practicality of an attack. Due to their compact and portable design, conventional smart cards are most frequently kept close to their intended user. They offer little opportunity for acquisition by a potential adversary, so any sort of interaction with the card is difficult without committing some variety of theft. @@ -59,13 +59,13 @@ TPM virtual smart cards, however, reside on a user's computer that may frequentl However, there are several advantages provided by virtual smart cards to mitigate these slight security deficits. Most importantly, a virtual smart card is much less likely to be lost. Virtual smart cards are integrated into computers and devices that the user already owns for other purposes and has incentive to keep safe. If the computer or device that hosts the virtual smart card is lost or stolen, a user will more immediately notice its loss than the loss of a physical smart card. When a computer or device is identified as lost, the user can notify the administrator of the system, who can revoke the certificate that is associated with the virtual smart card on that device. This precludes any future unauthorized access on that computer or device if the PIN for the virtual smart card is compromised. -**Cost** +### Cost If a company wants to deploy physical smart cards, they need to purchase smart cards and smart card readers for all employees. Although relatively inexpensive options can be found, options that ensure the three key properties of smart card security (most notably, non-exportability) are more expensive. If employees have computers with a built-in TPM, virtual smart cards can be deployed with no additional material costs. These computers and devices are relatively common in the market. The maintenance cost of virtual smart cards is less than that for physical smart cards, which are easily lost, stolen, or broken from normal wear. TPM virtual smart cards are only lost or broken if the host computer or device is lost or broken, which in most cases is much less frequently. -**Comparison summary** +### Comparison summary | Physical Smart Cards | TPM virtual smart cards | |---------------------|-------------------| @@ -87,17 +87,17 @@ The maintenance cost of virtual smart cards is less than that for physical smart The following section presents several commonly used options and their respective strengths and weaknesses, which organizations can consider for authentication. -**Passwords** +### Passwords A password is a secret string of characters that is tied to the identification credentials for a user's account. This establishes the user's identity. Although passwords are the most commonly used form of authentication, they're also the weakest. In a system where passwords are used as the sole method of user authentication, only individuals who know their passwords are considered valid users. Password authentication places a great deal of responsibility on the user. Passwords must be sufficiently complex so they can't be easily guessed, but they must be simple enough to be committed to memory and not stored in a physical location. Even if this balance is successfully achieved, a wide variety of attacks exist (such as brute force attacks, eavesdropping, and social engineering tactics) where a malicious user can acquire a user's password and impersonate that person's identity. A user often won't realize that the password is compromised, which makes it's easy for a malicious user to maintain access to a system if a valid password has been obtained. -**One-time passwords** +### One-time passwords A one-time password (OTP) is similar to a traditional password, but it's more secure in that it can be used only once to authenticate a user. The method for determining each new password varies by implementation. Assuming a secure deployment of each new password, OTPs have several advantages over the classic password model of authentication. Most importantly, if a given OTP token is intercepted in transmission between the user and the system, the interceptor can't use it for any future transactions. Similarly, if a malicious user obtains a valid user's OTP, the interceptor will have limited access to the system (only one session). -**Smart cards** +### Smart cards Smart cards are physical authentication devices, which improve on the concept of a password by requiring that users actually have their smart card device with them to access the system, in addition to knowing the PIN that provides access to the smart card. Smart cards have three key properties that help maintain their security: @@ -111,7 +111,7 @@ Additional security is achieved by the singular nature of the card because only The additional security comes with added material and support costs. Traditional smart cards are expensive to purchase (cards and card readers must be supplied to employees), and users can misplace or lose them. -**Virtual smart cards** +### Virtual smart cards Virtual smart cards emulate the functionality of traditional smart cards. Instead of requiring the purchase of additional hardware, virtual smart cards utilize technology that users already own and are more likely to always have with them. Theoretically, any device that can provide the three key properties of smart cards (non-exportability, isolated cryptography, and anti-hammering) can be commissioned as a virtual smart card. The virtual smart card platform is limited to the use of the Trusted Platform Module (TPM) chip, which is on most modern devices. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 3143cf5fb7..dd75945f31 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -29,35 +29,31 @@ To create and delete TPM virtual smart cards for end users, the Tpmvscmgr comman Virtual smart cards can also be created and deleted by using APIs. For more information, see the following classes and interfaces: -- [TpmVirtualSmartCardManager](/previous-versions/windows/desktop/legacy/hh707171(v=vs.85)) - -- [RemoteTpmVirtualSmartCardManager](/previous-versions/windows/desktop/legacy/hh707166(v=vs.85)) - -- [ITpmVirtualSmartCardManager](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanager) - -- [ITPMVirtualSmartCardManagerStatusCallBack](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanagerstatuscallback) +- [TpmVirtualSmartCardManager](/previous-versions/windows/desktop/legacy/hh707171(v=vs.85)) +- [RemoteTpmVirtualSmartCardManager](/previous-versions/windows/desktop/legacy/hh707166(v=vs.85)) +- [ITpmVirtualSmartCardManager](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanager) +- [ITPMVirtualSmartCardManagerStatusCallBack](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanagerstatuscallback) You can use APIs that were introduced in the Windows.Device.SmartCards namespace in Windows Server 2012 R2 and Windows 8.1 to build Microsoft Store apps to manage the full lifecycle of virtual smart cards. For information about how to build an app to do this, see [Strong Authentication: Building Apps That Leverage Virtual Smart Cards in Enterprise, BYOD, and Consumer Environments | Build 2013 | Channel 9](https://channel9.msdn.com/events/build/2013/2-041). The following table describes the features that can be developed in a Microsoft Store app: -| Feature | Physical Smart Card | Virtual Smart Card | -|----------------------------------------------|---------------------|--------------------| -| Query and monitor smart card readers | Yes | Yes | -| List available smart cards in a reader, and retrieve the card name and card ID | Yes | Yes | -| Verify if the administrative key of a card is correct | Yes | Yes | -| Provision (or reformat) a card with a given card ID | Yes | Yes | -| Change the PIN by entering the old PIN and specifying a new PIN | Yes | Yes | -| Change the administrative key, reset the PIN, or unblock the smart card by using a challenge/response method | Yes | Yes | -| Create a virtual smart card | Not applicable | Yes | -| Delete a virtual smart card | Not applicable | Yes | -| Set PIN policies | No | Yes | +| Feature | Physical Smart Card | Virtual Smart Card | +|--|--|--| +| Query and monitor smart card readers | Yes | Yes | +| List available smart cards in a reader, and retrieve the card name and card ID | Yes | Yes | +| Verify if the administrative key of a card is correct | Yes | Yes | +| Provision (or reformat) a card with a given card ID | Yes | Yes | +| Change the PIN by entering the old PIN and specifying a new PIN | Yes | Yes | +| Change the administrative key, reset the PIN, or unblock the smart card by using a challenge/response method | Yes | Yes | +| Create a virtual smart card | Not applicable | Yes | +| Delete a virtual smart card | Not applicable | Yes | +| Set PIN policies | No | Yes | For more information about these Windows APIs, see: -- [Windows.Devices.SmartCards namespace (Windows)](/uwp/api/Windows.Devices.SmartCards) - -- [Windows.Security.Cryptography.Certificates namespace (Windows)](/uwp/api/Windows.Security.Cryptography.Certificates) +- [Windows.Devices.SmartCards namespace (Windows)](/uwp/api/Windows.Devices.SmartCards) +- [Windows.Security.Cryptography.Certificates namespace (Windows)](/uwp/api/Windows.Security.Cryptography.Certificates) ## Distinguishing TPM-based virtual smart cards from physical smart cards @@ -70,11 +66,13 @@ A TPM-based virtual smart card is labeled **Security Device** in the user interf ## Changing the PIN The PIN for a virtual smart card can be changed by following these steps: -- Sign in with the old PIN or password. -- Press Ctrl+Alt+Del and choose **Change a password**. -- Select **Sign-in Options**. -- Select the virtual smart card icon. -- Enter and confirm the new PIN. + +- Sign in with the old PIN or password +- Press Ctrl+Alt+Del and choose **Change a password** +- Select **Sign-in Options** +- Select the virtual smart card icon +- Enter and confirm the new PIN + ## Resolving issues ### TPM not provisioned From c4c2b75ce9eda783ff6a631e92376daadcb147f5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:24:13 -0500 Subject: [PATCH 08/21] acrolinx --- .../smart-cards/smart-card-architecture.md | 46 +++++++------- ...rt-card-certificate-propagation-service.md | 12 ++-- ...ertificate-requirements-and-enumeration.md | 56 ++++++++--------- .../smart-card-removal-policy-service.md | 2 +- .../virtual-smart-card-get-started.md | 42 ++++++------- ...smart-card-understanding-and-evaluating.md | 61 +++++++++---------- 6 files changed, 107 insertions(+), 112 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index bd8330d478..5e28ca6340 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -9,7 +9,7 @@ ms.date: 11/06/2023 This topic for the IT professional describes the system architecture that supports smart cards in the Windows operating system, including credential provider architecture and the smart card subsystem architecture. -Authentication is a process for verifying the identity of an object or person. When you authenticate an object, such as a smart card, the goal is to verify that the object is genuine. When you authenticate a person, the goal is to verify that you are not dealing with an imposter. +Authentication is a process for verifying the identity of an object or person. When you authenticate an object, such as a smart card, the goal is to verify that the object is genuine. When you authenticate a person, the goal is to verify that you aren't dealing with an imposter. In a networking context, authentication is the act of proving identity to a network application or resource. Typically, identity is proven by a cryptographic operation that uses a key only the user knows (such as with public key cryptography), or a shared key. The server side of the authentication exchange compares the signed data with a known cryptographic key to validate the authentication attempt. Storing the cryptographic keys in a secure central location makes the authentication process scalable and maintainable. @@ -51,7 +51,7 @@ Credential providers can be designed to support single sign-in (SSO). In this pr Multiple credential providers can coexist on a computer. -Credential providers must be registered on a computer running Windows, and they are responsible for: +Credential providers must be registered on a computer running Windows, and they're responsible for: - Describing the credential information that is required for authentication - Handling communication and logic with external authentication authorities @@ -74,7 +74,7 @@ The following graphic shows the relationship between the CryptoAPI, CSPs, the Sm ### Caching with Base CSP and smart card KSP -Smart card architecture uses caching mechanisms to assist in streamlining operations and to improve a user's access to a PIN. +Smart card architecture uses caching mechanisms to help streamlining operations and to improve a user's access to a PIN. - [Data caching](#data-caching): The data cache provides for a single process to minimize smart card I/O operations - [PIN caching](#pin-caching): The PIN cache helps the user from having to reenter a PIN each time the smart card is unauthenticated @@ -87,8 +87,8 @@ The existing global cache works as follows: 1. The application requests a cryptographic operation. For example, a user certificate is to be read from the smart card 1. The CSP checks its cache for the item -1. If the item is not found in the cache, or if the item is cached but is not up-to-date, the item is read from the smart card -1. After any item has been read from the smart card, it is added to the cache. Any existing out-of-date copy of that item is replaced +1. If the item isn't found in the cache, or if the item is cached but isn't up-to-date, the item is read from the smart card +1. After any item has been read from the smart card, it's added to the cache. Any existing out-of-date copy of that item is replaced Three types of objects or data are cached by the CSP: pins (for more information, see [PIN caching](#pin-caching)), certificates, and files. If any of the cached data changes, the corresponding object is read from the smart card in successive operations. For example, if a file is written to the smart card, the CSP cache becomes out-of-date for the files, and other processes read the smart card at least once to refresh their CSP cache. @@ -98,7 +98,7 @@ The global data cache is hosted in the Smart Cards for Windows service. Windows The PIN cache protects the user from entering a PIN every time the smart card is unauthenticated. After a smart card is authenticated, it will not differentiate among host-side applications—any application can access private data on the smart card. -To mitigate this, the smart card enters an exclusive state when an application authenticates to the smart card. However, this means that other applications cannot communicate with the smart card and will be blocked. Therefore, such exclusive connections are minimized. The issue is that a protocol (such as the Kerberos protocol) requires multiple signing operations. Therefore, the protocol requires exclusive access to the smart card over an extended period, or it requires multiple authentication operations. This is where the PIN cache is used to minimize exclusive use of the smart card without forcing the user to enter a PIN multiple times. +To mitigate this, the smart card enters an exclusive state when an application authenticates to the smart card. However, this means that other applications can't communicate with the smart card and will be blocked. Therefore, such exclusive connections are minimized. The issue is that a protocol (such as the Kerberos protocol) requires multiple signing operations. Therefore, the protocol requires exclusive access to the smart card over an extended period, or it requires multiple authentication operations. This is where the PIN cache is used to minimize exclusive use of the smart card without forcing the user to enter a PIN multiple times. The following example illustrates how this works. In this scenario, there are two applications: Outlook and Internet Explorer. The applications use smart cards for different purposes. @@ -108,13 +108,13 @@ The following example illustrates how this works. In this scenario, there are tw 1. The user opens Internet Explorer and tries to access a protected site that requires Transport Layer Security (TLS) authentication for the client 1. Internet Explorer prompts the user for the smart card PIN. The user enters the correct PIN 1. The TLS-related private key operation occurs on the smart card, and the user is authenticated and signed in -1. The user returns to Outlook to send another signed e-mail. This time, the user is not prompted for a PIN because the PIN is cached from the previous operation. Similarly, if the user uses Internet Explorer again for another operation, Internet Explorer will not prompt the user for a PIN +1. The user returns to Outlook to send another signed e-mail. This time, the user isn't prompted for a PIN because the PIN is cached from the previous operation. Similarly, if the user uses Internet Explorer again for another operation, Internet Explorer won't prompt the user for a PIN The Base CSP internally maintains a per-process cache of the PIN. The PIN is encrypted and stored in memory. The functions that are used to secure the PIN are RtlEncryptMemory, RtlDecryptMemory, and RtlSecureZeroMemory, which will empty buffers that contained the PIN. ### Smart card selection -The following sections in this topic describe how Windows leverages the smart card architecture to select the correct smart card reader software, provider, and credentials for a successful smart card sign-in: +The following sections in this article describe how Windows uses the smart card architecture to select the correct smart card reader software, provider, and credentials for a successful smart card sign-in: - [Container specification levels](#container-specification-levels) - [Container operations](#container-operations) @@ -202,10 +202,10 @@ Each call to `SCardUI *` may result in additional information read from a candid For type I and type II container specification levels, the smart card selection process is less complex because only the smart card in the named reader can be considered a match. The process for matching a smart card with a smart card reader is: -1. Find the requested smart card reader. If it cannot be found, the process fails (this requires a cache search by reader name) -1. If no smart card is in the reader, the user is prompted to insert a smart card. (this is only in non-silent mode; if the call is made in silent mode, it will fail) +1. Find the requested smart card reader. If it can't be found, the process fails (this requires a cache search by reader name) +1. If no smart card is in the reader, the user is prompted to insert a smart card. (this is only in nonsilent mode; if the call is made in silent mode, it fails) 1. For container specification level II only, the name of the default container on the chosen smart card is determined -1. To open an existing container or delete an existing container, find the specified container. If the specified container cannot be found on this smart card, the user is prompted to insert a smart card +1. To open an existing container or delete an existing container, find the specified container. If the specified container can't be found on this smart card, the user is prompted to insert a smart card 1. If the system attempts to create a new container, if the specified container already exists on this smart card, the process fails #### Make a smart card match @@ -217,23 +217,23 @@ For container specification levels III and IV, a broader method is used to match > [!NOTE] > This operation requires that you use the smart card with the Base CSP. -1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the Base CSP continues to search for a new smart card -1. If a matching smart card is not found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container +1. For each smart card that has been accessed by the Base CSP and the handle and container information are cached, the Base CSP looks for a valid default container. An operation is attempted on the cached SCARDHANDLE to verify its validity. If the smart card handle isn't valid, the Base CSP continues to search for a new smart card +1. If a matching smart card isn't found in the Base CSP cache, the Base CSP calls to the smart card subsystem. SCardUIDlgSelectCard() is used with an appropriate callback filter to find a matching smart card with a valid default container #### Open an existing GUID-named container (no reader specified) > [!NOTE] > This operation requires that you use the smart card with the Base CSP. -1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle is not valid, the smart card's serial number is passed to the `SCardUI *` API to continue searching for this specific smart card (rather than only a general match for the container name) -1. If a matching smart card is not found in the Base CSP cache, a call is made to the smart card subsystem. `SCardUIDlgSelectCard()` is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name +1. For each smart card that is already registered with the Base CSP, search for the requested container. Attempt an operation on the cached SCARDHANDLE to verify its validity. If the smart card handle isn't valid, the smart card's serial number is passed to the `SCardUI *` API to continue searching for this specific smart card (rather than only a general match for the container name) +1. If a matching smart card isn't found in the Base CSP cache, a call is made to the smart card subsystem. `SCardUIDlgSelectCard()` is used with an appropriate callback filter to find a matching smart card with the requested container. Or, if a smart card serial number resulted from the search in Step 1, the callback filter attempts to match the serial number, not the container name #### Create a new container (no reader specified) > [!NOTE] > This operation requires that you use the smart card with the Base CSP. -If the PIN is not cached, no CRYPT_SILENT is allowed for the container creation because the user must be prompted for a PIN, at a minimum. +If the PIN isn't cached, no CRYPT_SILENT is allowed for the container creation because the user must be prompted for a PIN, at a minimum. For other operations, the caller may be able to acquire a *verify* context against the default container `CRYPT_DEFAULT_CONTAINER_OPTIONAL` and then make a call with CryptSetProvParam to cache the user PIN for subsequent operations. @@ -242,15 +242,15 @@ For other operations, the caller may be able to acquire a *verify* context again 1. If the smart card is present, but it already has the named container, continue the search 1. If the smart card is available, but a call to CardQueryFreeSpace indicates that the smart card has insufficient storage for an additional key container, continue the search 1. Otherwise, use the first available smart card that meets the above criteria for the container creation -1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards verifies that a candidate smart card does not already have the named container, and that CardQueryFreeSpace indicates the smart card has sufficient space for an additional container. If no suitable smart card is found, the user is prompted to insert a smart card +1. If a matching smart card isn't found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards verifies that a candidate smart card doesn't already have the named container, and that CardQueryFreeSpace indicates the smart card has sufficient space for an additional container. If no suitable smart card is found, the user is prompted to insert a smart card #### Delete a container -1. If the specified container name is NULL, the default container is deleted. Deleting the default container causes a new default container to be selected arbitrarily. For this reason, this operation is not recommended +1. If the specified container name is NULL, the default container is deleted. Deleting the default container causes a new default container to be selected arbitrarily. For this reason, this operation isn't recommended 1. For each smart card already known by the CSP, refresh the stored SCARDHANDLE and make the following checks: - 1. If the smart card does not have the named container, continue the search + 1. If the smart card doesn't have the named container, continue the search 1. If the smart card has the named container, but the smart card handle is no longer valid, store the serial number of the matching smart card and pass it to SCardUI -1. If a matching smart card is not found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card +1. If a matching smart card isn't found in the CSP cache, make a call to the smart card subsystem. The callback that is used to filter enumerated smart cards should verify that a candidate smart card has the named container. If a serial number was povided as a result of the previous cache search, the callback should filter enumerated smart cards on serial number rather than on container matches. If the context is non-silent and no suitable smart card is found, display UI that prompts the user to insert a smart card ### Base CSP and KSP-based architecture in Windows @@ -269,16 +269,16 @@ The following diagram shows the Cryptography architecture that is used by the Wi | `PP_ROOT_CERTSTORE` | - Read and Write (used by `CryptGetProvParam` and `CryptSetProvParam`)
- Used to write a collection of root certificates to the smart card or return `HCERTSTORE`, which contains root certificates from the smart card
- Used primarily for joining a domain by using a smart card
- Caller responsible for closing the certificate store | | `PP_SMARTCARD_READER` | - Read-only (used only by `CryptGetProvParam`)
- Returns the smart card reader name as an ANSI string that is used to construct a fully qualified container name (that is, a smart card reader plus a container) | | `PP_SMARTCARD_GUID` | - Return smart card GUID (also known as a serial number), which should be unique for each smart card
- Used by the certificate propagation service to track the source of a root certificate | -| `PP_UI_PROMPT` | - Used to set the search string for the `SCardUIDlgSelectCard` card insertion dialog box
- Persistent for the entire process when it is set
- Write-only (used only by `CryptSetProvParam`) | +| `PP_UI_PROMPT` | - Used to set the search string for the `SCardUIDlgSelectCard` card insertion dialog box
- Persistent for the entire process when it's set
- Write-only (used only by `CryptSetProvParam`) | ### Implications for CSPs in Windows -Cryptographic Service Providers (CSPs), including custom smart card CSPs, continue to be supported but this approach is not recommended. Using the existing Base CSP and smart card KSP with the smart card minidriver model for smart cards provides significant benefits in terms of performance, and PIN and data caching. One minidriver can be configured to work under CryptoAPI and CNG layers. This provides benefits from enhanced cryptographic support, including elliptic curve cryptography and AES. +Cryptographic Service Providers (CSPs), including custom smart card CSPs, continue to be supported but this approach isn't recommended. Using the existing Base CSP and smart card KSP with the smart card minidriver model for smart cards provides significant benefits in terms of performance, and PIN and data caching. One minidriver can be configured to work under CryptoAPI and CNG layers. This provides benefits from enhanced cryptographic support, including elliptic curve cryptography and AES. If a smart card is registered by a CSP and a smart card minidriver, the one that was installed most recently will be used to communicate with the smart card. ### Write a smart card minidriver, CSP, or KSP -CSPs and KSPs are meant to be written only if specific functionality is not available in the current smart card minidriver architecture. For example, the smart card minidriver architecture supports hardware security modules, so a minidriver could be written for a hardware security module, and a CSP or KSP may not be required unless it is needed to support algorithms that are not implemented in the Base CSP or smart card KSP. +CSPs and KSPs are meant to be written only if specific functionality isn't available in the current smart card minidriver architecture. For example, the smart card minidriver architecture supports hardware security modules, so a minidriver could be written for a hardware security module, and a CSP or KSP may not be required unless it's needed to support algorithms that aren't implemented in the Base CSP or smart card KSP. For more information about how to write a smart card minidriver, CSP, or KSP, see [Smart Card Minidrivers](/windows-hardware/drivers/smartcard/smart-card-minidrivers). diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index 8cfae399fd..851e89b13a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -33,23 +33,23 @@ The following figure shows the flow of the certificate propagation service. The Properties of the certificate propagation service include: - `CERT_STORE_ADD_REPLACE_EXISTING_INHERIT_PROPERTIES` adds certificates to a user's Personal store -- If the certificate has the `CERT_ENROLLMENT_PROP_ID` property (as defined by `wincrypt.h`), it filters empty requests and places them in the current user's request store, but it does not propagate them to the user's Personal store -- The service does not propagate any computer certificates to a user's Personal store or propagate user certificates to a computer store -- The service propagates certificates according to Group Policy options that are set, which may include: +- If the certificate has the `CERT_ENROLLMENT_PROP_ID` property (as defined by `wincrypt.h`), it filters empty requests and places them in the current user's request store, but it doesn't propagate them to the user's Personal store +- The service doesn't propagate any computer certificates to a user's Personal store or propagate user certificates to a computer store +- The service propagates certificates according to Group Policy options that are set, which might include: - **Turn on certificate propagation from the smart card** specifies whether a user's certificate should be propagated - **Turn on root certificate propagation from smart card** specifies whether root certificates should be propagated - **Configure root certificate cleanup** specifies how root certificates are removed ## Root certificate propagation service -Root certificate propagation is responsible for the following smart card deployment scenarios when public key infrastructure (PKI) trust has not yet been established: +Root certificate propagation is responsible for the following smart card deployment scenarios when public key infrastructure (PKI) trust hasn't yet been established: - Joining the domain - Accessing a network remotely -In both cases, the computer is not joined to a domain, and therefore, trust is not being managed by Group Policy. However, the objective is to authenticate to a remote server, such as the domain controller. Root certificate propagation provides the ability to use the smart card to include the missing trust chain. +In both cases, the computer isn't joined to a domain, and therefore, trust isn't being managed by Group Policy. However, the objective is to authenticate to a remote server, such as the domain controller. Root certificate propagation provides the ability to use the smart card to include the missing trust chain. -When the smart card is inserted, the certificate propagation service propagates any root certificates on the card to the trusted smart card root computer certificate stores. This process establishes a trust relationship with the enterprise resources. You may also use a subsequent cleanup action when the user's smart card is removed from the reader, or when the user signs out. This is configurable with Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). +When the smart card is inserted, the certificate propagation service propagates any root certificates on the card to the trusted smart card root computer certificate stores. This process establishes a trust relationship with the enterprise resources. You might also use a subsequent cleanup action when the user's smart card is removed from the reader, or when the user signs out. This is configurable with Group Policy. For more information, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). For more information about root certificate requirements, see [Smart card root certificate requirements for use with domain sign-in](smart-card-certificate-requirements-and-enumeration.md#smart-card-root-certificate-requirements-for-use-with-domain-sign-in). diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 1ac825dde6..79cf20942a 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -15,8 +15,8 @@ When a smart card is inserted, the following steps are performed. > Unless otherwise mentioned, all operations are performed silently (CRYPT_SILENT is passed to CryptAcquireContext). 1. The smart card resource manager database searches for the smart card's cryptographic service provider (CSP). -1. A qualified container name is constructed by using the smart card reader name, and it is passed to the CSP. The format is `\\.\` -1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card will be unusable for smart card sign-in. +1. A qualified container name is constructed by using the smart card reader name, and it's passed to the CSP. The format is `\\.\` +1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card is unusable for smart card sign-in. 1. The name of the container is retrieved by using the PP_CONTAINER parameter with CryptGetProvParam. 1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. 1. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT_KEYEXCHANGE key. @@ -40,13 +40,13 @@ When a smart card is inserted, the following steps are performed. ## Smart card sign-in flow in Windows -Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) does not reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. +Most issues during authentication occur because of session behavior changes. When changes occur, the Local Security Authority (LSA) doesn't reacquire the session context; it relies instead on the Cryptographic Service Provider to handle the session change. -Client certificates that do not contain a UPN in the `subjectAltName`` (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. +Client certificates that don't contain a UPN in the `subjectAltName`` (SAN) field of the certificate can be enabled for sign-in, which supports a wider variety of certificates and supports multiple sign-in certificates on the same card. Support for multiple certificates on the same card is enabled by default. New certificate types must be enabled through Group Policy. -If you enable the **Allow signature keys valid for Logon** credential provider policy, any certificates that are available on the smart card with a signature-only key are listed on the sign-in screen. This allows users to select their sign-in experience. If the policy is disabled or not configured, smart card signature-key-based certificates are not listed on the sign-in screen. +If you enable the **Allow signature keys valid for Logon** credential provider policy, any certificates that are available on the smart card with a signature-only key are listed on the sign-in screen. This allows users to select their sign-in experience. If the policy is disabled or not configured, smart card signature-key-based certificates aren't listed on the sign-in screen. The following diagram illustrates how smart card sign-in works in the supported versions of Windows. @@ -69,7 +69,7 @@ Following are the steps that are performed during a smart card sign-in: 1. The sign-in UI requests the new credentials from the smart card credential provider. As a response, the smart card credential provider provides each sign-in certificate to the sign-in UI, and corresponding sign-in tiles are displayed. The user selects a smart card-based sign-in certificate tile, and Windows displays a PIN dialog box. 1. The user enters the PIN, and then presses ENTER. The smart card credential provider encrypts the PIN. -1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB_CERTIFICATE_LOGON structure. The main contents of the KERB_CERTIFICATE_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain is not in the same forest because it enables a certificate to be mapped to multiple user accounts. +1. The credential provider that resides in the LogonUI system collects the PIN. As part of packaging credentials in the smart card credential provider, the data is packaged in a KERB_CERTIFICATE_LOGON structure. The main contents of the KERB_CERTIFICATE_LOGON structure are the smart card PIN, CSP data (such as reader name and container name), user name, and domain name. User name is required if the sign-in domain isn't in the same forest because it enables a certificate to be mapped to multiple user accounts. 1. The credential provider wraps the data (such as the encrypted PIN, container name, reader name, and card key specification) and sends it back to LogonUI. 1. Winlogon presents the data from LogonUI to the LSA with the user information in LSALogonUser. 1. LSA calls the Kerberos authentication package (Kerberos SSP) to create a Kerberos authentication service request (KRB_AS_REQ), which containing a preauthenticator (as specified in RFC 4556: [Public Key Cryptography for Initial Authentication in Kerberos (PKINIT)](http://www.ietf.org/rfc/rfc4556.txt)). @@ -107,7 +107,7 @@ Following are the steps that are performed during a smart card sign-in: For more information about the Kerberos protocol, see [Microsoft Kerberos](/windows/win32/secauthn/microsoft-kerberos). -By default, the KDC verifies that the client's certificate contains the smart card client authentication EKU szOID_KP_SMARTCARD_LOGON. However, if enabled, the **Allow certificates with no extended key usage certificate attribute** Group Policy setting allows the KDC to not require the SC-LOGON EKU. SC-LOGON EKU is not required for account mappings that are based on the public key. +By default, the KDC verifies that the client's certificate contains the smart card client authentication EKU szOID_KP_SMARTCARD_LOGON. However, if enabled, the **Allow certificates with no extended key usage certificate attribute** Group Policy setting allows the KDC to not require the SC-LOGON EKU. SC-LOGON EKU isn't required for account mappings that are based on the public key. ## KDC certificate @@ -125,26 +125,26 @@ Certificate requirements are listed by versions of the Windows operating system. ### Certificate requirements -The smart card certificate has specific format requirements when it is used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. +The smart card certificate has specific format requirements when it's used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. | Component | Requirements | |--|--| | CRL distribution point location | Not required | | Key usage | Digital signature | | Basic constraints | Not required | -| extended key usage (EKU) | The smart card sign-in object identifier is not required.

**Note** If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | -| Subject alternative name | E-mail ID is not required for smart card sign-in. | +| extended key usage (EKU) | The smart card sign-in object identifier isn't required.

**Note** If an EKU is present, it must contain the smart card sign-in EKU. Certificates with no EKU can be used for sign-in. | +| Subject alternative name | E-mail ID isn't required for smart card sign-in. | | Subject | Not required | -| Key exchange (AT_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings are not enabled.) | +| Key exchange (AT_KEYEXCHANGE field) | Not required for smart card sign-in certificates if a Group Policy setting is enabled. (By default, Group Policy settings aren't enabled.) | | CRL | Not required | | UPN | Not required | | Notes | You can enable any certificate to be visible for the smart card credential provider. | ### Client certificate mappings -Certificate mapping is based on the UPN that is contained in the subjectAltName (SAN) field of the certificate. Client certificates that do not contain information in the SAN field are also supported. +Certificate mapping is based on the UPN that is contained in the subjectAltName (SAN) field of the certificate. Client certificates that don't contain information in the SAN field are also supported. -SSL/TLS can map certificates that do not have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: `` `` and `` are taken from the client certificate, with '\r' and '\n' replaced with ','. +SSL/TLS can map certificates that don't have SAN, and the mapping is done by using the AltSecID attributes on client accounts. The X509 AltSecID, which is used by SSL/TLS client authentication is of the form "X509: `` `` and `` are taken from the client certificate, with '\r' and '\n' replaced with ','. #### Certificate revocation list distribution points @@ -167,10 +167,10 @@ This account mapping is supported by the KDC in addition to six other mapping me The certificate object is parsed to look for content to perform user account mapping. - When a user name is provided with the certificate, the user name is used to locate the account object. This operation is the fastest, because string matching occurs -- When only the certificate object is provided, a series of operations are performed to locate the user name to map the user name to an account object +- When only the certificate object is provided, multiple operations are performed to locate the user name to map the user name to an account object - When no domain information is available for authentication, the local domain is used by default. If any other domain is to be used for lookup, a domain name hint should be provided to perform the mapping and binding -Mapping based on generic attributes is not possible because there is no generic API to retrieve attributes from a certificate. Currently, the first method that locates an account successfully stops the search. But a configuration error occurs if two methods map the same certificate to different user accounts when the client does not supply the client name through the mapping hints. +Mapping based on generic attributes isn't possible because there's no generic API to retrieve attributes from a certificate. Currently, the first method that locates an account successfully stops the search. But a configuration error occurs if two methods map the same certificate to different user accounts when the client doesn't supply the client name through the mapping hints. The following figure illustrates the process of mapping user accounts for sign-in in the directory by viewing various entries in the certificate. @@ -190,23 +190,23 @@ A single user certificate can be mapped to multiple accounts. For example, a use Based on the information that is available in the certificate, the sign-in conditions are: 1. If no UPN is present in the certificate: - 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts - 1. A hint must be supplied if mapping is not unique (for example, if multiple users are mapped to the same certificate) + 1. Sign-in can occur in the local forest or in another forest if a single user with one certificate needs to sign in to different accounts + 1. A hint must be supplied if mapping isn't unique (for example, if multiple users are mapped to the same certificate) 1. If a UPN is present in the certificate: - 1. The certificate cannot be mapped to multiple users in the same forest - 1. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user + 1. The certificate can't be mapped to multiple users in the same forest + 1. The certificate can be mapped to multiple users in different forests. For a user to sign in to other forests, an X509 hint must be supplied to the user ## Smart card sign-in for multiple users into a single account -A group of users might sign in to a single account (for example, an administrator account). For that account, user certificates are mapped so that they are enabled for sign-in. +A group of users might sign in to a single account (for example, an administrator account). For that account, user certificates are mapped so that they're enabled for sign-in. -Several distinct certificates can be mapped to a single account. For this to work properly, the certificate cannot have UPNs. +Several distinct certificates can be mapped to a single account. For this to work properly, the certificate can't have UPNs. For example, if Certificate1 has CN=CNName1, Certificate2 has CN=User1, and Certificate3 has CN=User2, the AltSecID of these certificates can be mapped to a single account by using the Active Directory Users and Computers name mapping. ## Smart card sign-in across forests -For account mapping to work across forests, particularly in cases where there is not enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\user*, or a fully qualified UPN such as `user@contoso.com`. +For account mapping to work across forests, particularly in cases where there isn't enough information available on the certificate, the user might enter a hint in the form of a user name, such as *domain\user*, or a fully qualified UPN such as `user@contoso.com`. > [!NOTE] > For the hint field to appear during smart card sign-in, the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key) must be enabled on the client. @@ -215,9 +215,9 @@ For account mapping to work across forests, particularly in cases where there is Online Certificate Status Protocol (OCSP), which is defined in RFC 2560, enables applications to obtain timely information about the revocation status of a certificate. Because OCSP responses are small and well bound, constrained clients might want to use OCSP to check the validity of the certificates for Kerberos on the KDC, to avoid transmission of large CRLs, and to save bandwidth on constrained networks. For information about CRL registry keys, see [Smart Card Group Policy and Registry Settings](smart-card-group-policy-and-registry-settings.md). -The KDCs in Windows attempt to get OCSP responses and use them when available. This behavior cannot be disabled. CryptoAPI for OCSP caches OCSP responses and the status of the responses. The KDC supports only OCSP responses for the signer certificate. +The KDCs in Windows attempt to get OCSP responses and use them when available. This behavior can't be disabled. CryptoAPI for OCSP caches OCSP responses and the status of the responses. The KDC supports only OCSP responses for the signer certificate. -Windows client computers attempt to request the OCSP responses and use them in the reply when they are available. This behavior cannot be disabled. +Windows client computers attempt to request the OCSP responses and use them in the reply when they're available. This behavior can't be disabled. ## Smart card root certificate requirements for use with domain sign-in @@ -227,10 +227,10 @@ For sign-in to work in a smart card-based domain, the smart card certificate mus - The smart card sign-in certificate must have the HTTP CRL distribution point listed in its certificate - The CRL distribution point must have a valid CRL published and a delta CRL, if applicable, even if the CRL distribution point is empty - The smart card certificate must contain one of the following: - - A subject field that contains the DNS domain name in the distinguished name. If it does not, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail - - A UPN where the domain name resolves to the actual domain. For example, if the domain name is `Engineering.Corp.Contoso`, the UPN is `username@engineering.corp.contoso.com`. If any part of the domain name is omitted, the Kerberos client cannot find the appropriate domain + - A subject field that contains the DNS domain name in the distinguished name. If it doesn't, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail + - A UPN where the domain name resolves to the actual domain. For example, if the domain name is `Engineering.Corp.Contoso`, the UPN is `username@engineering.corp.contoso.com`. If any part of the domain name is omitted, the Kerberos client can't find the appropriate domain -Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system do not include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: +Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system don't include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: 1. Enable HTTP CRL distribution points on the CA 1. Restart the CA @@ -240,7 +240,7 @@ Although the HTTP CRL distribution points are on by default in Windows Server 20 The workaround is to enable the **Allow user name hint** Group Policy setting (**X509HintsNeeded** registry key), which allows the user to supply a hint in the credentials user interface for domain sign-in. -If the client computer is not joined to the domain or if it is joined to a different domain, the client computer can resolve the server domain only by looking at the distinguished name on the certificate, not the UPN. For this scenario to work, the certificate requires a full subject, including `DC=`, for domain name resolution. +If the client computer isn't joined to the domain or if it's joined to a different domain, the client computer can resolve the server domain only by looking at the distinguished name on the certificate, not the UPN. For this scenario to work, the certificate requires a full subject, including `DC=`, for domain name resolution. To deploy root certificates on a smart card for the currently joined domain, you can use the following command: diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 970bee548f..616ea96b49 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -15,7 +15,7 @@ The smart card removal policy service is applicable when a user has signed in wi The numbers in the previous figure represent the following actions: -1. Winlogon is not directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated. +1. Winlogon isn't directly involved in monitoring for smart card removal events. The sequence of steps that are involved when a smart card is removed begins with the smart card credential provider in the sign-in UI process. When a user successfully signs in with a smart card, the smart card credential provider captures the reader name. This information is then stored in the registry with the session identifier where the sign-in was initiated. 1. The smart card resource manager service notifies the smart card removal policy service that a sign-in has occurred. 1. ScPolicySvc retrieves the smart card information that the smart card credential provider stored in the registry. This call is redirected if the user is in a remote session. If the smart card is removed, ScPolicySvc is notified. 1. ScPolicySvc calls Remote Desktop Services to take the appropriate action if the request is to sign out the user or to disconnect the user's session, which might result in data loss. If the setting is configured to lock the computer when the smart card is removed, ScPolicySvc sends a message to Winlogon to lock the computer. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index fd30cb8172..9993a82970 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -11,9 +11,9 @@ ms.date: 11/06/2023 This topic for the IT professional describes how to set up a basic test environment for using TPM virtual smart cards. -Virtual smart cards are a technology from Microsoft that offer comparable security benefits in two-factor authentication to physical smart cards. They also offer more convenience for users and lower cost for organizations to deploy. By utilizing Trusted Platform Module (TPM) devices that provide the same cryptographic capabilities as physical smart cards, virtual smart cards accomplish the three key properties that are desired by smart cards: non-exportability, isolated cryptography, and anti-hammering. +Virtual smart cards are a technology from Microsoft that offers comparable security benefits in two-factor authentication to physical smart cards. They also offer more convenience for users and lower cost for organizations to deploy. By utilizing Trusted Platform Module (TPM) devices that provide the same cryptographic capabilities as physical smart cards, virtual smart cards accomplish the three key properties that are desired by smart cards: nonexportability, isolated cryptography, and anti-hammering. -This step-by-step walkthrough shows you how to set up a basic test environment for using TPM virtual smart cards. After you complete this walkthrough, you will have a functional virtual smart card installed on the Windows computer. +This step-by-step walkthrough shows you how to set up a basic test environment for using TPM virtual smart cards. After you complete this walkthrough, you'll have a functional virtual smart card installed on the Windows computer. You should be able to complete this walkthrough in less than one hour, excluding installing software and setting up the test domain. @@ -29,7 +29,7 @@ You should be able to complete this walkthrough in less than one hour, excluding ## Prerequisites -You will need: +You'll need: - A computer running Windows 10 with an installed and fully functional TPM (version 1.2 or version 2.0) - A test domain to which the computer listed above can be joined @@ -37,17 +37,17 @@ You will need: ## Step 1: Create the certificate template -On your domain server, you need to create a template for the certificate that you will request for the virtual smart card. +On your domain server, you need to create a template for the certificate that you request for the virtual smart card. ### To create the certificate template -1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and click **Run as administrator** +1. On your server, open the Microsoft Management Console (MMC). One way to do this is to type **mmc.exe** from the **Start** menu, right-click **mmc.exe**, and select **Run as administrator** 1. Select **File** > **Add/Remove Snap-in** ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) -1. In the available snap-ins list, click **Certificate Templates**, and then click **Add** +1. In the available snap-ins list, select **Certificate Templates**, and then select **Add** ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) 1. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. -1. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. +1. Right-click the **Smartcard Logon** template, and select **Duplicate Template**. ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) 1. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) @@ -56,31 +56,31 @@ On your domain server, you need to create a template for the certificate that yo 1. Set the validity period to the desired value. 1. On the **Request Handling** tab: 1. Set the **Purpose** to **Signature and smartcard logon**. - 1. Click **Prompt the user during enrollment**. + 1. Select **Prompt the user during enrollment**. 1. On the **Cryptography** tab: 1. Set the minimum key size to 2048. - 1. Click **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. + 1. Select **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. 1. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. -1. Click **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. -1. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. +1. Select **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. +1. Select **File**, then select **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) 1. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. -1. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. +1. Right-click **Certificate Templates**, select **New**, and then select **Certificate Template to Issue**. ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) -1. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. +1. From the list, select the new template that you created (**TPM Virtual Smart Card Logon**), and then select **OK**. > [!NOTE] > It can take some time for your template to replicate to all servers and become available in this list. ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) -1. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. +1. After the template replicates, in the MMC, right-click in the Certification Authority list, select **All Tasks**, and then select **Stop Service**. Then, right-click the name of the CA again, select **All Tasks**, and then select **Start Service**. ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) ## Step 2: Create the TPM virtual smart card -In this step, you will create the virtual smart card on the client computer by using the command-line tool, [Tpmvscmgr.exe](virtual-smart-card-tpmvscmgr.md). +In this step, you create the virtual smart card on the client computer by using the command-line tool, [Tpmvscmgr.exe](virtual-smart-card-tpmvscmgr.md). ### To create the TPM virtual smart card @@ -90,10 +90,10 @@ In this step, you will create the virtual smart card on the client computer by u `tpmvscmgr.exe create /name TestVSC /pin default /adminkey random /generate` - This will create a virtual smart card with the name **TestVSC**, omit the unlock key, and generate the file system on the card. The PIN will be set to the default, 12345678. To be prompted for a PIN, instead of **/pin default** you can type **/pin prompt**.\ + This creates a virtual smart card with the name **TestVSC**, omit the unlock key, and generate the file system on the card. The PIN is set to the default, 12345678. To be prompted for a PIN, instead of **/pin default** you can type **/pin prompt**.\ For more information about the Tpmvscmgr command-line tool, see [Use Virtual Smart Cards](virtual-smart-card-use-virtual-smart-cards.md) and [Tpmvscmgr](virtual-smart-card-tpmvscmgr.md). -1. Wait several seconds for the process to finish. Upon completion, Tpmvscmgr.exe will provide you with the device instance ID for the TPM Virtual Smart Card. Store this ID for later reference because you will need it to manage or remove the virtual smart card. +1. Wait several seconds for the process to finish. Upon completion, Tpmvscmgr.exe provides you with the device instance ID for the TPM Virtual Smart Card. Store this ID for later reference because you need it to manage or remove the virtual smart card. ## Step 3: Enroll for the certificate on the TPM Virtual Smart Card @@ -102,15 +102,15 @@ The virtual smart card must be provisioned with a sign-in certificate for it to ### To enroll the certificate 1. Open the Certificates console by typing **certmgr.msc** on the **Start** menu -1. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate** +1. Right-click **Personal**, select **All Tasks**, and then select **Request New Certificate** ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) 1. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1) ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) 1. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)** -1. Enter the PIN that was established when you created the TPM virtual smart card, and then click **OK** -1. Wait for the enrollment to finish, and then click **Finish** +1. Enter the PIN that was established when you created the TPM virtual smart card, and then select **OK** +1. Wait for the enrollment to finish, and then select **Finish** -The virtual smart card can now be used as an alternative credential to sign in to your domain. To verify that your virtual smart card configuration and certificate enrollment were successful, sign out of your current session, and then sign in. When you sign in, you will see the icon for the new TPM virtual smart card on the Secure Desktop (sign in) screen or you will be automatically directed to the TPM smart card sign-in dialog box. Click the icon, enter your PIN (if necessary), and then click **OK**. You should be signed in to your domain account. +The virtual smart card can now be used as an alternative credential to sign in to your domain. To verify that your virtual smart card configuration and certificate enrollment were successful, sign out of your current session, and then sign in. When you sign in, you'll see the icon for the new TPM virtual smart card on the Secure Desktop (sign in) screen or you are automatically directed to the TPM smart card sign-in dialog box. Select the icon, enter your PIN (if necessary), and then select **OK**. You should be signed in to your domain account. ## See also diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index 2ab0167682..c5ac24e838 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -11,17 +11,14 @@ ms.date: 11/06/2023 This article describes the virtual smart card technology and how it can fit into your authentication design. -Virtual smart card technology uses cryptographic keys that are stored on computers that have the Trusted Platform Module (TPM) installed. Virtual smart cards offer comparable security benefits to conventional smart cards by using two-factor authentication. The technology also offers more convenience for users and has a lower cost to deploy. By utilizing TPM devices that provide the same cryptographic capabilities as conventional smart cards, virtual smart cards accomplish the three key properties that are desired for smart cards: non-exportability, isolated cryptography, and anti-hammering. +Virtual smart card technology uses cryptographic keys that are stored on computers that have the Trusted Platform Module (TPM) installed. Virtual smart cards offer comparable security benefits to conventional smart cards by using two-factor authentication. The technology also offers more convenience for users and has a lower cost to deploy. By utilizing TPM devices that provide the same cryptographic capabilities as conventional smart cards, virtual smart cards accomplish the three key properties that are desired for smart cards: nonexportability, isolated cryptography, and anti-hammering. -Virtual smart cards are functionally similar to physical smart cards. They appear as always-inserted smart cards, and they can be used for authentication to external resources, protection of data by secure encryption, and integrity through reliable signing. Because TPM-enabled hardware is readily available and virtual smart cards can be easily deployed by using existing certificate enrollment methods, virtual smart cards can become a full replacement for other methods of strong authentication in a corporate setting of any scale. +Virtual smart cards are functionally similar to physical smart cards. They appear as always-inserted smart cards, and they can be used for authentication to external resources, protection of data by secure encryption, and integrity through reliable signing. Since TPM-enabled hardware is readily available and virtual smart cards can be deployed using existing certificate enrollment methods, virtual smart cards can become a replacement for other methods of strong authentication in a corporate setting of any scale. This topic contains the following sections: -- [Comparing virtual smart cards with physical smart cards](#comparing-virtual-smart-cards-with-physical-smart-cards): - Compares properties, functional aspects, security, and cost. - -- [Authentication design options](#authentication-design-options): - Describes how passwords, smart cards, and virtual smart cards can be used to reach authentication goals in your organization. +- [Comparing virtual smart cards with physical smart cards](#comparing-virtual-smart-cards-with-physical-smart-cards): compares properties, functional aspects, security, and cost. +- [Authentication design options](#authentication-design-options): describes how passwords, smart cards, and virtual smart cards can be used to reach authentication goals in your organization. ## Comparing virtual smart cards with physical smart cards @@ -33,13 +30,11 @@ All cryptographic operations occur in the secure, isolated environment of the TP Virtual smart cards maintain the three key properties of physical smart cards: -- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and non-exportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. - For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). +- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and nonexportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). - **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that are offered by physical smart cards, and this is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM. -- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. - For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). +- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). The following subsections compare the functionality, security, and cost of virtual smart cards and physical smart cards. @@ -47,41 +42,41 @@ The following subsections compare the functionality, security, and cost of virtu The virtual smart card system that was designed by Microsoft closely mimics the functionality of conventional smart cards. The most striking difference to the end user is that the virtual smart card is essentially a smart card that is always inserted into the computer. There's no method to export the user's virtual smart card for use on other computers, which adds to the security of virtual smart cards. If a user requires access to network resources on multiple computers, multiple virtual smart cards can be issued for that user. Additionally, a computer that is shared among multiple users can host multiple virtual smart cards for different users. -The basic user experience for a virtual smart card is as simple as using a password to access a network. Because the smart card is loaded by default, the user must simply enter the PIN that is tied to the card to gain access. Users are no longer required to carry cards and readers or to take physical action to use the card. +The basic user experience for a virtual smart card is as simple as using a password to access a network. Because the smart card is loaded by default, the user must enter the PIN that is tied to the card to gain access. Users are no longer required to carry cards and readers or to take physical action to use the card. -Additionally, although the anti-hammering functionality of the virtual smart card is equally secure to that of a physical smart card, virtual smart card users are never required to contact an administrator to unblock the card. Instead, they simply wait a period of time (depending on the TPM specifications) before they reattempt to enter the PIN. Alternatively, the administrator can reset the lockout by providing owner authentication data to the TPM on the host computer. +Additionally, although the anti-hammering functionality of the virtual smart card is equally secure to that of a physical smart card, virtual smart card users are never required to contact an administrator to unblock the card. Instead, they wait a period of time (depending on the TPM specifications) before they reattempt to enter the PIN. Alternatively, the administrator can reset the lockout by providing owner authentication data to the TPM on the host computer. ### Security Physical smart cards and virtual smart cards offer comparable levels of security. They both implement two-factor authentication for using network resources. However, they differ in certain aspects, including physical security and the practicality of an attack. Due to their compact and portable design, conventional smart cards are most frequently kept close to their intended user. They offer little opportunity for acquisition by a potential adversary, so any sort of interaction with the card is difficult without committing some variety of theft. -TPM virtual smart cards, however, reside on a user's computer that may frequently be left unattended, which provides an opportunity for a malicious user to hammer the TPM. Although virtual smart cards are fully protected from hammering (as are physical smart cards), this accessibility makes the logistics of an attack somewhat simpler. Additionally, the anti-hammering behavior of a TPM smart card differs in that it only presents a time delay in response to repeated PIN failures, as opposed to fully blocking the user. +TPM virtual smart cards, however, reside on a user's computer that may frequently be left unattended, which provides an opportunity for a malicious user to hammer the TPM. Although virtual smart cards are fully protected from hammering (as are physical smart cards), this accessibility makes the logistics of an attack simpler. Additionally, the anti-hammering behavior of a TPM smart card differs in that it only presents a time delay in response to repeated PIN failures, as opposed to fully blocking the user. -However, there are several advantages provided by virtual smart cards to mitigate these slight security deficits. Most importantly, a virtual smart card is much less likely to be lost. Virtual smart cards are integrated into computers and devices that the user already owns for other purposes and has incentive to keep safe. If the computer or device that hosts the virtual smart card is lost or stolen, a user will more immediately notice its loss than the loss of a physical smart card. When a computer or device is identified as lost, the user can notify the administrator of the system, who can revoke the certificate that is associated with the virtual smart card on that device. This precludes any future unauthorized access on that computer or device if the PIN for the virtual smart card is compromised. +However, there are several advantages provided by virtual smart cards to mitigate these slight security deficits. Most importantly, a virtual smart card is much less likely to be lost. Virtual smart cards are integrated into computers and devices that the user already owns for other purposes and has incentive to keep safe. If the computer or device that hosts the virtual smart card is lost or stolen, a user notices its loss quicker than the loss of a physical smart card. When a computer or device is identified as lost, the user can notify the administrator of the system, who can revoke the certificate that is associated with the virtual smart card on that device. This precludes any future unauthorized access on that computer or device if the PIN for the virtual smart card is compromised. ### Cost -If a company wants to deploy physical smart cards, they need to purchase smart cards and smart card readers for all employees. Although relatively inexpensive options can be found, options that ensure the three key properties of smart card security (most notably, non-exportability) are more expensive. If employees have computers with a built-in TPM, virtual smart cards can be deployed with no additional material costs. These computers and devices are relatively common in the market. +If a company wants to deploy physical smart cards, they need to purchase smart cards and smart card readers for all employees. Although relatively inexpensive options can be found, options that ensure the three key properties of smart card security (most notably, nonexportability) are more expensive. If employees have computers with a built-in TPM, virtual smart cards can be deployed with no additional material costs. These computers and devices are relatively common in the market. The maintenance cost of virtual smart cards is less than that for physical smart cards, which are easily lost, stolen, or broken from normal wear. TPM virtual smart cards are only lost or broken if the host computer or device is lost or broken, which in most cases is much less frequently. ### Comparison summary -| Physical Smart Cards | TPM virtual smart cards | -|---------------------|-------------------| -| Protects private keys by using the built-in cryptographic functionality of the card. | Protects private keys by using the cryptographic functionality of the TPM. | -| Stores private keys in isolated non-volatile memory on the card, which means that access to private keys is only from the card, and access is never allowed to the operating system. | Stores encrypted private keys on the hard drive. The encryption ensures that these keys can only be decrypted and used in the TPM, not in the accessible memory of the operating system. | -| Guarantees non-exportability through the card manufacturer, which includes isolating private information from operating system access. | Guarantees non-exportability through the TPM manufacturer, which includes the inability of an adversary to replicate or remove the TPM. | -| Performs and isolates cryptographic operations within the built-in capabilities of the card. | Performs and isolates cryptographic operations in the TPM of the user's computer or device. | -| Provides anti-hammering through the card. After a certain number of failed PIN entry attempts, the card blocks further access until administrative action is taken. | Provides anti-hammering through the TPM. Successive failed attempts increase the device lockout time (the time the user has to wait before trying again). This can be reset by an administrator. | -| Requires that users carry their smart card and smart card reader with them to access network resources. | Allows users to access their TPM-enabled computers or devices, and potentially access the network, without other equipment. | -| Enables credential portability by inserting the smart card into smart card readers that are attached to other computers. | Prevents exporting credentials from a given computer or device. However, virtual smart cards can be issued for the same user on multiple computers or devices by using additional certificates. | -| Enables multiple users to access network resources through the same computer by inserting their personal smart cards. | Enables multiple users to access network resources through the same computer or device by issuing a virtual smart card for each user on that computer or device. | -| Requires the user to carry the card, making it more difficult for an attacker to access the device and launch a hammering attempt. | Stores virtual smart card on the user's computer, which may be left unattended and allow a greater risk window for hammering attempts. | -| Provides a generally single-purpose device that is carried explicitly for the purpose of authentication. The smart card can be easily misplaced or forgotten. | Installs the virtual smart card on a device that has other purposes for the user, so the user has greater incentive to be responsible for the computer or device. | -| Alerts users that their card is lost or stolen only when they need to sign in and notice it's missing. | Installs the virtual smart card on a device that the user likely needs for other purposes, so users will notice its loss much more quickly. This reduces the associated risk window. | -| Requires companies to invest in smart cards and smart card readers for all employees. | Requires that companies ensure all employees have TPM-enabled computers, which are relatively common. | -| Enables using a smart card removal policy to affect system behavior when the smart card is removed. For example, the policy can dictate if the user's sign-in session is locked or terminated when the user removes the card. | Eliminates the necessity for a smart card removal policy because a TPM virtual smart card is always present and can't be removed from the computer. | +| Physical Smart Cards | TPM virtual smart cards | +|--|--| +| Protects private keys by using the built-in cryptographic functionality of the card. | Protects private keys by using the cryptographic functionality of the TPM. | +| Stores private keys in isolated non-volatile memory on the card, which means that access to private keys is only from the card, and access is never allowed to the operating system. | Stores encrypted private keys on the hard drive. The encryption ensures that these keys can only be decrypted and used in the TPM, not in the accessible memory of the operating system. | +| Guarantees nonexportability through the card manufacturer, which includes isolating private information from operating system access. | Guarantees nonexportability through the TPM manufacturer, which includes the inability of an adversary to replicate or remove the TPM. | +| Performs and isolates cryptographic operations within the built-in capabilities of the card. | Performs and isolates cryptographic operations in the TPM of the user's computer or device. | +| Provides anti-hammering through the card. After some failed PIN entry attempts, the card blocks further access until administrative action is taken. | Provides anti-hammering through the TPM. Successive failed attempts increase the device lockout time (the time the user has to wait before trying again). This can be reset by an administrator. | +| Requires that users carry their smart card and smart card reader with them to access network resources. | Allows users to access their TPM-enabled computers or devices, and potentially access the network, without other equipment. | +| Enables credential portability by inserting the smart card into smart card readers that are attached to other computers. | Prevents exporting credentials from a given computer or device. However, virtual smart cards can be issued for the same user on multiple computers or devices by using additional certificates. | +| Enables multiple users to access network resources through the same computer by inserting their personal smart cards. | Enables multiple users to access network resources through the same computer or device by issuing a virtual smart card for each user on that computer or device. | +| Requires the user to carry the card, making it more difficult for an attacker to access the device and launch a hammering attempt. | Stores virtual smart card on the user's computer, which might be left unattended and allow a greater risk window for hammering attempts. | +| Provides a generally single-purpose device that is carried explicitly for the purpose of authentication. The smart card can be easily misplaced or forgotten. | Installs the virtual smart card on a device that has other purposes for the user, so the user has greater incentive to be responsible for the computer or device. | +| Alerts users that their card is lost or stolen only when they need to sign in and notice it's missing. | Installs the virtual smart card on a device that the user likely needs for other purposes, so users will notice its loss much more quickly. This reduces the associated risk window. | +| Requires companies to invest in smart cards and smart card readers for all employees. | Requires that companies ensure all employees have TPM-enabled computers, which are relatively common. | +| Enables using a smart card removal policy to affect system behavior when the smart card is removed. For example, the policy can dictate if the user's sign-in session is locked or terminated when the user removes the card. | Eliminates the necessity for a smart card removal policy because a TPM virtual smart card is always present and can't be removed from the computer. | ## Authentication design options @@ -113,6 +108,6 @@ The additional security comes with added material and support costs. Traditional ### Virtual smart cards -Virtual smart cards emulate the functionality of traditional smart cards. Instead of requiring the purchase of additional hardware, virtual smart cards utilize technology that users already own and are more likely to always have with them. Theoretically, any device that can provide the three key properties of smart cards (non-exportability, isolated cryptography, and anti-hammering) can be commissioned as a virtual smart card. The virtual smart card platform is limited to the use of the Trusted Platform Module (TPM) chip, which is on most modern devices. +Virtual smart cards emulate the functionality of traditional smart cards. Instead of requiring the purchase of additional hardware, virtual smart cards utilize technology that users already own and are more likely to always have with them. Theoretically, any device that can provide the three key properties of smart cards (nonexportability, isolated cryptography, and anti-hammering) can be commissioned as a virtual smart card. The virtual smart card platform is limited to the use of the Trusted Platform Module (TPM) chip, which is on most modern devices. -Virtual smart cards that utilize a TPM provide the three main security principles of traditional smart cards: non-exportability, isolated cryptography, and anti-hammering. Virtual smart cards are less expensive to implement and more convenient for users. Since many corporate computers already have a built-in TPM, there's no cost associated with purchasing new hardware. The user's possession of a computer or device is equivalent to the possession of a smart card, and a user's identity can't be assumed from any other computer or device without administrative provisioning of further credentials. Thus, two-factor authentication is achieved because the user must have a computer that is set up with a virtual smart card and know the PIN to use the virtual smart card. +Virtual smart cards that utilize a TPM provide the three main security principles of traditional smart cards: nonexportability, isolated cryptography, and anti-hammering. Virtual smart cards are less expensive to implement and more convenient for users. Since many corporate computers already have a built-in TPM, there's no cost associated with purchasing new hardware. The user's possession of a computer or device is equivalent to the possession of a smart card, and a user's identity can't be assumed from any other computer or device without administrative provisioning of further credentials. Thus, two-factor authentication is achieved because the user must have a computer that is set up with a virtual smart card and know the PIN to use the virtual smart card. From f1418cc69c9b780fe21642af00ad810bae79fa15 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:26:38 -0500 Subject: [PATCH 09/21] TOC updates --- .../identity-protection/smart-cards/toc.yml | 47 +++++++++---------- .../virtual-smart-cards/toc.yml | 26 +++++----- 2 files changed, 35 insertions(+), 38 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/toc.yml b/windows/security/identity-protection/smart-cards/toc.yml index 0d82f8c3a7..2b7e51db7b 100644 --- a/windows/security/identity-protection/smart-cards/toc.yml +++ b/windows/security/identity-protection/smart-cards/toc.yml @@ -1,28 +1,27 @@ items: - name: Smart Card Technical Reference href: smart-card-windows-smart-card-technical-reference.md +- name: How Smart Card Sign-in Works in Windows + href: smart-card-how-smart-card-sign-in-works-in-windows.md items: - - name: How Smart Card Sign-in Works in Windows - href: smart-card-how-smart-card-sign-in-works-in-windows.md - items: - - name: Smart Card Architecture - href: smart-card-architecture.md - - name: Certificate Requirements and Enumeration - href: smart-card-certificate-requirements-and-enumeration.md - - name: Smart Card and Remote Desktop Services - href: smart-card-and-remote-desktop-services.md - - name: Smart Cards for Windows Service - href: smart-card-smart-cards-for-windows-service.md - - name: Certificate Propagation Service - href: smart-card-certificate-propagation-service.md - - name: Smart Card Removal Policy Service - href: smart-card-removal-policy-service.md - - name: Smart Card Tools and Settings - href: smart-card-tools-and-settings.md - items: - - name: Smart Cards Debugging Information - href: smart-card-debugging-information.md - - name: Smart Card Group Policy and Registry Settings - href: smart-card-group-policy-and-registry-settings.md - - name: Smart Card Events - href: smart-card-events.md \ No newline at end of file + - name: Smart Card Architecture + href: smart-card-architecture.md + - name: Certificate Requirements and Enumeration + href: smart-card-certificate-requirements-and-enumeration.md + - name: Smart Card and Remote Desktop Services + href: smart-card-and-remote-desktop-services.md + - name: Smart Cards for Windows Service + href: smart-card-smart-cards-for-windows-service.md + - name: Certificate Propagation Service + href: smart-card-certificate-propagation-service.md + - name: Smart Card Removal Policy Service + href: smart-card-removal-policy-service.md +- name: Smart Card Tools and Settings + href: smart-card-tools-and-settings.md + items: + - name: Smart Cards Debugging Information + href: smart-card-debugging-information.md + - name: Smart Card Group Policy and Registry Settings + href: smart-card-group-policy-and-registry-settings.md + - name: Smart Card Events + href: smart-card-events.md \ No newline at end of file diff --git a/windows/security/identity-protection/virtual-smart-cards/toc.yml b/windows/security/identity-protection/virtual-smart-cards/toc.yml index 68842b6001..0eec1122c0 100644 --- a/windows/security/identity-protection/virtual-smart-cards/toc.yml +++ b/windows/security/identity-protection/virtual-smart-cards/toc.yml @@ -1,17 +1,15 @@ items: - name: Virtual Smart Card overview href: virtual-smart-card-overview.md - items: - - name: Understand and evaluate virtual smart cards - href: virtual-smart-card-understanding-and-evaluating.md - items: - - name: Get started with virtual smart cards - href: virtual-smart-card-get-started.md - - name: Use virtual smart cards - href: virtual-smart-card-use-virtual-smart-cards.md - - name: Deploy virtual smart cards - href: virtual-smart-card-deploy-virtual-smart-cards.md - - name: Evaluate virtual smart card security - href: virtual-smart-card-evaluate-security.md - - name: Tpmvscmgr - href: virtual-smart-card-tpmvscmgr.md \ No newline at end of file +- name: Understand and evaluate virtual smart cards + href: virtual-smart-card-understanding-and-evaluating.md +- name: Get started with virtual smart cards + href: virtual-smart-card-get-started.md +- name: Use virtual smart cards + href: virtual-smart-card-use-virtual-smart-cards.md +- name: Deploy virtual smart cards + href: virtual-smart-card-deploy-virtual-smart-cards.md +- name: Evaluate virtual smart card security + href: virtual-smart-card-evaluate-security.md +- name: Tpmvscmgr + href: virtual-smart-card-tpmvscmgr.md \ No newline at end of file From 93425b5eaf88c586a3a294a20cddd96f17c35c0c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:45:20 -0500 Subject: [PATCH 10/21] updates --- .../smart-cards/smart-card-architecture.md | 2 +- ...ertificate-requirements-and-enumeration.md | 11 ++--- ...card-group-policy-and-registry-settings.md | 4 +- .../images/vsc-02-mmc-add-snap-in.png | Bin 31991 -> 0 bytes ...c-03-add-certificate-templates-snap-in.png | Bin 69792 -> 0 bytes ...4-right-click-smartcard-logon-template.png | Bin 20834 -> 0 bytes ...-05-certificate-template-compatibility.png | Bin 45705 -> 0 bytes ...06-add-certification-authority-snap-in.png | Bin 77728 -> 0 bytes ...c-07-right-click-certificate-templates.png | Bin 43125 -> 0 bytes .../vsc-08-enable-certificate-template.png | Bin 90194 -> 0 bytes .../vsc-09-stop-service-start-service.png | Bin 60622 -> 0 bytes .../vsc-10-cmd-run-as-administrator.png | Bin 29695 -> 0 bytes ...1-certificates-request-new-certificate.png | Bin 87263 -> 0 bytes ...tificate-enrollment-select-certificate.png | Bin 82088 -> 0 bytes .../virtual-smart-card-get-started.md | 38 +++++++----------- ...smart-card-understanding-and-evaluating.md | 8 ++-- ...tual-smart-card-use-virtual-smart-cards.md | 14 +++---- 17 files changed, 30 insertions(+), 47 deletions(-) delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-02-mmc-add-snap-in.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-03-add-certificate-templates-snap-in.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-04-right-click-smartcard-logon-template.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-05-certificate-template-compatibility.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-06-add-certification-authority-snap-in.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-07-right-click-certificate-templates.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-08-enable-certificate-template.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-09-stop-service-start-service.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-10-cmd-run-as-administrator.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-11-certificates-request-new-certificate.png delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-12-certificate-enrollment-select-certificate.png diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 5e28ca6340..9aed975124 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -20,7 +20,7 @@ For smart cards, Windows supports a provider architecture that meets the secure ## Credential provider architecture -The following table lists the components that are included in the interactive sign-in architecture of the Windows Server and Windows operating systems. +The following table lists the components that are included in the interactive sign-in architecture: | Component | Description | |--|--| diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index 79cf20942a..4e345d6a7b 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -18,7 +18,7 @@ When a smart card is inserted, the following steps are performed. 1. A qualified container name is constructed by using the smart card reader name, and it's passed to the CSP. The format is `\\.\` 1. CryptAcquireContext is called to retrieve a context to the default container. If a failure occurs, the smart card is unusable for smart card sign-in. 1. The name of the container is retrieved by using the PP_CONTAINER parameter with CryptGetProvParam. -1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter (added in Windows Vista). For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. +1. Using the context acquired in Step 3, the CSP is queried for the PP_USER_CERTSTORE parameter. For more information, see [Smart Card Architecture](smart-card-architecture.md). If the operation is successful, the name of a certificate store is returned, and the program flow skips to Step 8. 1. If the operation in Step 5 fails, the default container context from Step 3 is queried for the AT_KEYEXCHANGE key. 1. The certificate is then queried from the key context by using KP_CERTIFICATE. The certificate is added to an in-memory certificate store. 1. For each certificate in the certificate store from Step 5 or Step 7, the following checks are performed: @@ -31,9 +31,6 @@ When a smart card is inserted, the following steps are performed. Any certificate that meets these requirements is displayed to the user with the certificate's UPN (or e-mail address or subject, depending on the presence of the certificate extensions). - > [!NOTE] - > These requirements are the same as those in Windows Server 2003, but they are performed before the user enters the PIN. You can override many of them by using Group Policy settings. - 1. The process then chooses a certificate, and the PIN is entered. 1. LogonUI.exe packages the information and sends it to Lsass.exe to process the sign-in attempt. 1. If successful, LogonUI.exe closes. This causes the context acquired in Step 3 to be released. @@ -63,7 +60,7 @@ Following are the steps that are performed during a smart card sign-in: 1. Enumerates each card to verify that a sign-in certificate that is controlled by Group Policy is present. If the certificate is present, the smart card credential provider copies it into a temporary, secure cache on the computer or terminal. > [!NOTE] - > Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior after Windows Vista, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. + > Smartcard cache entries are created for certificates with a subject name or with a subject key identifier. If the certificate has a subject name, it is stored with an index that is based on the subject name and certificate issuer. If another certificate with the same subject name and certificate issuer is used, it will replace the existing cached entry. A change in this behavior, allows for the condition when the certificate does not have a subject name, the cache is created with an index that is based on the subject key identifier and certificate issuer. If another certificate has the same the subject key identifier and certificate issuer, the cache entry is replaced. When certificates have neither a subject name nor subject key identifier, a cached entry is not created. 1. Notifies the sign-in UI that it has new credentials. @@ -125,8 +122,6 @@ Certificate requirements are listed by versions of the Windows operating system. ### Certificate requirements -The smart card certificate has specific format requirements when it's used with Windows XP and earlier operating systems. You can enable any certificate to be visible for the smart card credential provider. - | Component | Requirements | |--|--| | CRL distribution point location | Not required | @@ -230,7 +225,7 @@ For sign-in to work in a smart card-based domain, the smart card certificate mus - A subject field that contains the DNS domain name in the distinguished name. If it doesn't, resolution to an appropriate domain fails, so Remote Desktop Services and the domain sign-in with the smart card fail - A UPN where the domain name resolves to the actual domain. For example, if the domain name is `Engineering.Corp.Contoso`, the UPN is `username@engineering.corp.contoso.com`. If any part of the domain name is omitted, the Kerberos client can't find the appropriate domain -Although the HTTP CRL distribution points are on by default in Windows Server 2008, subsequent versions of the Windows Server operating system don't include HTTP CRL distribution points. To allow smart card sign-in to a domain in these versions, do the following: +To allow smart card sign-in to a domain in these versions, do the following: 1. Enable HTTP CRL distribution points on the CA 1. Restart the CA diff --git a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md index 6f8e44fde7..270eda4a77 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md +++ b/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md @@ -207,7 +207,7 @@ This policy setting is applied to the computer after the [Allow time invalid cer | Registry key | `FilterDuplicateCerts` | | Default values | No changes per operating system versions
Disabled and not configured are equivalent | | Policy management | Restart requirement: None
Sign off requirement: None
Policy conflicts: None | -| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate that is used to sign in to computers running Windows 2000, Windows XP, or Windows Server 2003 will be displayed. Otherwise, the certificate with the most distant expiration time will be displayed. | +| Notes and resources | If there are two or more of the same certificates on a smart card and this policy setting is enabled, the certificate with the most distant expiration time is displayed. | ### Force the reading of all certificates from the smart card @@ -374,7 +374,7 @@ The following smart card-related Group Policy settings are in **Computer Configu | Group Policy setting and registry key | Default | Description | |--|--|--| | Interactive logon: Require smart card

**scforceoption** | Disabled | This security policy setting requires users to sign in to a computer by using a smart card.

**Enabled** Users can sign in to the computer only by using a smart card.
**Disabled** Users can sign in to the computer by using any method.

NOTE: the Windows LAPS-managed local account is exempted from this policy when Enabled. For more information see [Windows LAPS integration with smart card policy](/windows-server/identity/laps/laps-concepts#windows-laps-integration-with-smart-card-policy).
| -| Interactive logon: Smart card removal behavior

**scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option.

**Note**: In earlier versions of Windows Server, Remote Desktop Services was called Terminal Services. | +| Interactive logon: Smart card removal behavior

**scremoveoption** | This policy setting isn't defined, which means that the system treats it as **No Action**. | This setting determines what happens when the smart card for a signed-in user is removed from the smart card reader. The options are:
**No Action**
**Lock Workstation**: The workstation is locked when the smart card is removed, so users can leave the area, take their smart card with them, and still maintain a protected session.
**Force Logoff**: The user is automatically signed out when the smart card is removed.
**Disconnect if a Remote Desktop Services session**: Removal of the smart card disconnects the session without signing out the user. The user can reinsert the smart card and resume the session later, or at another computer that's equipped with a smart card reader, without having to sign in again. If the session is local, this policy setting functions identically to the **Lock Workstation** option. | From the Local Security Policy Editor (secpol.msc), you can edit and apply system policies to manage credential delegation for local or domain computers. diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-02-mmc-add-snap-in.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-02-mmc-add-snap-in.png deleted file mode 100644 index 2d626ecf9494aa2a5b58183cc5dc517bc63b7027..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 31991 zcmYIP1yI{hu*Th`xO;)%#oZlRq(E>eP%IQE?(PJ4FIu2bB)GdvNpW{~he!YO-n^TM z{AMn9dwY9(-?zJo&`^`dL?cCmfq}tPRFL@y0|N_q`~HA}^!84bRzCjr0qguxUJ9ma zoP7W70l`XART2iKCJz0{6!GmD6{Mi&3cK%qwVj=vL;@5F<@d0+kGVWJc)y#RoUCeO zWVEvN7#9yuhe?W7sw_KJU8Tg02kgz~wFHEp@`!|foxgwo z&a(RQ<%5T(XGVJZJz|af^Y-Djj!7Z{w`QyYT$(^ssfU`+wx&M=s(wKy9&$3hLLTh>MANlS-UHx!gIPtggl&t5WXD&-Uq`}Q zZLim2=`T2rFSlymL2R!Njbgpf!3RfgKV+lF6Q-rw>SrkO(gkz{w>50MaKxD5b^l@M z(eI4Jh+(8dZP#h0C!l|5bPOKKL?Id`Yz!vD*0gq-5!eb?X{BBvc)L z+Yki*ul*6}tHVP}k;>{~1hk_gO68PkkEj&?&0?Pdj0E4 zP^0g+@YdX<2o=8|Hm^%2Eh&sA%)GESn@I?gwP+%FAleQLADy@J>Z7YPhsR4;rV9+FRwcZ_DX z>$0vyU5u+=LE?JtsjXK0E7UWqd5@2$K6j+ctLm}wHnl#@Sm&AIqLI2GZ>v^G?O+6| zm8^Q7GPg^P^r)UP98%%7rzQoozqXlgJzEH}A{Js2PivtF+jS>)gqGo~^Xl#O;B>2d2T7y$AWG+m7>@ME9uHTtK1kW?Q1g zy<)9#*JHwmQMpm|^jW(T78Cm(VxkC{wNDVFk5Ss(AITPmlYQ&4}UA zHfx+*-@wo^P*3-$XR+PX_%^tjK``fS_v?IFYAw9**7pNrmbPs$?9KUV3N z@%VaEJ??xsbK9ZxbmLfbPMWU%d@!N5IcA)=?LyUC4c>Nq)*-D<^l7~pwrN$I^Lcb5 zIu~M@;otv0*l@oOwH6%mT776^Gol-5KR-lw&;I#3N40gfQ2k?wcRBXThZ7%pJ_zPU z;4A?J(0uWFd+Borb$rI7%9-?UGiDog2 z(7&jgeBu>%tk{m@8q=HRef6yHuvnPoyIbLQ(6h>XX;^_PmR66YE}$v!#Z(;H4i|DA*fWyg51F zJY-~KL2OJ+Q+M|}vG8+EV(gj;^lJ95>-yIxm>XCp^16bNFx*dE-J_$UPZGD+*G?y= zrvsgxFvwhJoL`;%BTC{n&O9wZ=aU7j9p}&4oNgUGnpX~8@8xj~_#|KA?7!Ll5!fha z5}4Vpu@IdKGJTsYfgT=SN+TL4lnL8i6GmT+H?fQz8td!x+uA7Jnj4KA zY`?szNT)R#3#w587#j4kzgi*io#B15qt7oAAcD;LJq4)!82NP);Vz`t84E+%zfhjo zA+4onavB{AV1zPew^qP$9%T0A%geWxvNF`Mu`z2Kn}OVPvRIog7?uM5_hm zFRZIgake*SEil8wi8mVP>>GW;Yc4NG`}5~dX=UX$%-rN;r>rS~NkRdKlY7L9y|>0N zgaLvObD7yin6w;u7ff)4iABxagd+w<1zlf;99$nx^78uoY0*pJC$1aM#z2~FdVjTm zM@Ko5M}~(rjErK3hlf>RHt9IUe2S)Y)zv2$-KRcqOtr*_w9?BO8smn&`$1-S|L4@( zg$ferynsWI8(rKjMNgL5DLBC{n}YDR5=e_Zpv<4mv@!OdQcA-_u~FDN0{oA2U098@37WL&4csdwU<|*4|HY=cR{YAkF3}LgV}KXL}&;hSKn`bS0Ql zA7CgkaX(`%`U`p6?-5B9SiW^}-mb=1d`N~)s`$`V{eU27v`IJ!*@ zTIY979e232Y80|-$bOOwaqU5~ZmW`=D-&yvkH$2|udOk675(8322H1(Y3b=5t>dGk zGT*=7F#0DaB`E|G#k5)%iiQv!187(*m);+|8HtkM`G=}Bw1qMkVps&Dh%oH@wT@S8 zxU6GSPj{*d-zR&5mxHh~XSaa9faSrLI6t|h6fQGjNLsq_`;wv}YIb%^5)u;f&WnqS z6FK9JvjUq!_u;#|Qd@k;9u*~!m%PxWFsZN*u(ayzi&4WqGAQJY(f4}0igQ`AN)uTW z7INy1F1zZ7JmvR7VK(G4ms!0L+sbGrJjYK#@CHj#7g14B6_k`VU{Z2&+EIfqh=DfqlaoMs!_PjdS7HM+?7 zQHc59Ry3NMo8wYZ#r5{~hIL29HScB1EvQO;ob4-#db9f+ z#*f2o=h6%P3>ohu)8LM1iVv4=#s2-So{o+Vmx3Y&0)afP$u73;8Okr17;9<L(~2I z*f600;28!M!=ujuM6Mccb;{=Vl|;BOkmj^qWUKd*?xw#rs-v|vli-k$_3>c5w zg~e9uAkntXw8X@qz(6>FWsy&-wE@v_*6^w+fhv)#*GyD#ltExrs8zN1t~o$kg=Q@h zK()?BJQs>(erX*`7h9b}P3hO2L%m3u3Q>Ps+U~BuKMa;petv%DT5?uaD~n|kfolZ+ zwBw)gdQ_kb<7&HX&+kUxy0F86zM!b@VJI9&0e+rzPdpivL$K+pXR7x8@@DKJi8;~x z4c;FQhZ-^&P7>ch;Qc%ldJAZ^-g?uPnVA`+CB}PL;n966)bqg|=a^EGYP9&d*}7Sw zMJ~KJDq*3Cxw-)X3hnrfk4i6|ZMe`my7B&;6iuH|W05N+Wu+;s*~|J}ge=A1{Nvb} zFQx*Pqz^LQ{UR8-*3EQmzhOmtep?^BdGi&(&BaACdUbq!JhGf2uOWeB(e6xN*qcHO zd7tnQi45v#k$=K+39+Bp7=xGfb$V1B2Ch2y|@Cfm8kV$deF46w*_1xaEzPdy&lq1M-wH;Gk zUH$Iv&W^WZ@fHQdR8-n46kSuoXk z?k62g_l_ppsz*_oDUD#`&mqwVG}btvWOX~c$c$PqA`MQYq{JxyW@~rE5OXqSVj%71 z{%fD=VN{00q5fb{7oSjDfaFISIR<~Tcz-u<+_W^h>H(d}DgHQL?o&mhXn2d3CtJ__ z+qmld7C*{mI$LrrS?F^?vHuZShP?7FLWb8)`(zD9Ecyhphp6oMaU$ID8ibm5*F;T3 zYG>-Qn>}+$;&c*D2sx!`LglILRz>X7#k{i7O<$YGqQUXue#-iYiLNeGRZ~|(0|zQg z`~LmcPt6Lafa&jmg%ahD!bJ9Yev{dKZ!lxn%}qHPV%>)lr6eWcPD_hli<_MkboLix zDPlxM%M8m2(E3Cdud5MpRW6CTrZ4ky23K$yX?j2bC*7!VN6<*eT!UhIO&31yDB;pW z@C}*1=g@R5!)RW@(;qR`s78Xd3`L~XT8sOGavmQxua;|GyBjL}@t}yGB+Nb7TN0yDr)#tyuc@tb$%3aUN2f146!T}C zYxmzi_{O%A&arBkwk`CKVzQ^3d;3X_jFkqwy&?U4P_RTY+wL$28@yX|_p1ob{VO() zXhT<*9P!YKlv3E*()F!QkH#E9x~PS5(UXfYzJ;%wG8an_16tUSr-j(9AleAE%_2vk zArN>H_0Kgte*e!-yBeKEoj^Xv+1Yqqe}u7Q`hFBZ>fp{<1W_WCB&D6nzM)5g(?9u_ zXCPfPqj=D7C{-sRR1qePsY@Kr(md_^<858BnWXBVSD&c_*Vjp1mts_f))l0|)J6jd z2)E!yPyJ*-;OpJc7N^4uQY@+tjOq=N(J3Vr5nhp~&<0J6@tE$TA_5okC{E7CP*YOO zc%SGAhrA{q0`{%UT%8S?+T8UTOWyA)d0|PGN4Turyeyv*QW?gL)nUpU!#TP9Bh+z2 ziRKiyXkcXc1tTyioPl**ypqEb!=f@NQwqU4VgM=J#VYz4G{ao{P-XeiDV3Z02Dt{w z2I!n%WdAq`M*J~WEE}qc?2>qMsATOkID+8>=#o&HDwiX@Nw!Dx>nqcM7q%RyGpZy59GPt&FK7e zOq_~&6+g^F3c#4r>flT127al6_Tq6T7w}+ajwz0mm zSV69up2xM$)eUr-#u!W`{rW`*M|UCS>IG1m-5P9*E6Pko7S^VV6YYHwKiv`C>MQvc zFaS+OF2$!J(0%fgVUp{b6v7Nf-m_r|sXAiG5^#pSd4Uyp>Tx^IRM*By$VMMw{lH9b zDw7lgxFK)ze;(Mz(c}q8V8+f`W(_hQz&3?4AZx`{nP=%>fu9vGh*_lNH8HA~N%EV` ziIE=q6%MlG>(W`s=@uvT!RUPZBM|p-oRcmZ$o4@{%Dyb*YiSql7nE#Q63z>@wf1c) z9g@BChNS+r-rTsJV43QCmhC-8gsXb3fZ2#k&gN_^M`3sf0h_sb0e&d|7^tKa>-#~f zQ*c()=C?U!Dm{rbFyqaUR-k<+#pi>??u`_{%Hy2ZUoTcT_A%98vl?Mb42XZ_wCMy{ zh?!ysCAucz`RFgw+=HFD>)Qi9dzlOLrqb|rA}@UH|K+MA`_T*``X`S@23deXKiA-R zbYEXv5wIj~Es>{D<3mm0120w9Umv&z6Gu@?n*z}9nNGZ#Lx{;CdP4O`tS4{+jiPzVd$_FX4q=)Uv zvcTH?gl!TQe|97f({MkMl{+1$VE~3%O?FqD&xUf=+J6zZ!pO_Z0}j5qx$T~CPP>4= z$KcrS7A(`sknQbf_YEKstrAL+1FN6+{ChtDNS*qASQN4eqcf!FoQZiOh&_HUe8>Pa zkE-DKJTU`bb~%`JKS>wK6Y#=cqT0!vzMl@a#cSS;-AJX%?Z(x^6iDTlx~zk%8X(v_ z@E{~+|E4N$V+QIgZ8LIZf7%QWpt{wX6q{xKxrrAZ{aHSF3#8&^U3 zBaIe!NF-&Ats0|Z(jgi{dt=y$LdKFo`b#5e$@`Hw(< z1}Ub_?e9q@>@1Geid|Se(?L@bE## zUp1la=_E%N{hCDEXbhId^s+4*zn2>)1w|2`%`ZS|fY6#+ByZ=PDI?;*&Btn*4?I}A zxBCU2B+M5rh=%xH#0FlSTt#pJasy{I3lzPNLefwG+A?o;;eKT>_xYPOkyM5~8M{d+ z^+X4?oM^)psn^8=bHeCOpK+Nis!eY5FF7%zyJMV-70SlDhE}sB+!uM3f}&}vPZ9AX z#61(cQ~zRNVQu|(ZO;TuSK)dKr&_~{9?PmzweFml~2(LF2qm?)&%~do95T-r&s=LmC4?=oRz@)7FoENZ>Hi4C%wC zoZEmjrvqHwsbD=2wXlrjRXoIIvGxjc$mLrj(7xwz$~!nS9eC}aqI`)bvJ0czB4@1s zX&zdffj7+f^m<&$$bLZa+7k+)6K2FCvb1pO5yS^K$O-%a zQ5dmEr|J2)6VNLVvgS1#TITYKYXSy26u*(obr82MpRoC_2ob|UR4>3f|$ zK_B==t-?o{B`z>Ux4chZXAH$My64DW$f6H04 zNS`(Nl01&T-`sYv4(dV z+{^%ZSr^WwQ8w$Xk6pQ!O%iUQ+ZA7tD=+4D`1+OlzGPMQyk%8xm`|0sqKtZX`89C+ z)(mf2w`AJ?sK|84^3QWIW<<;Ek(~s;`Ag+ zg_m`?0$Hxt1JmS(U!c>I`8&J=#q_46@+wS{raz_oMm?PQQj#9{2MU0xc~R+U$qRcy zv8b%4uLK`dOrn9oKF>VXhlccJt4Ko4#glxrt=Sw)t34tr7t`YolF&fh+L)>wmOAX8 zrU^++`3>o;%9@uLa>a8~bAltwpZAV)r41$m^YZoVyzo?qc_c1=>3oZJ5nrO{NXO*W z;-{|onR?_HU>i+EoJBu1O|Dx5=|9Plw3v3DYU!5!Zn*quk6gb8NAYz*$ZAr(VMY;< za}?=|k+{8_?K3!BA?GkgO`6#p4>k@fpF^zDe9$EAEZc87q@ZP?n#WcxLz3H_dTN%u5F9lR@3amM{xHAw`@KWX&H{n_kf0sY zcCm4JP@%Fljj_v>x6=DC8Rr4fF}@&B?s+da|FZfpmzj26#+Jg^Lv{Xj{IC%EIJjXQOhNM04$=-L$rkn2Mnz+oL*Q@}Hku9$Hp408n(0xktvr58t9W8bu znnX#HJs9eeJ>bwmJ)pw+;aIA3nVoKNV=BR%Rxwa=*H6T$%%fG{J zs~p^_ja|k>SKiYXD)F{e6=Lx3nPN1hiiw7biYZT*d# zGShz?Krw`=)^F|EL-c#>X|;wZo;W?XE~qusZq z{CQmoVdDZNH>ejBw8OiOWlOo)@6W|j((me;#+4IdeO=g?Osq|z5Yy%jGIn|Q-j-D3 z^UV=ZODC@2LTD#-GNCH$cqecgDM`1!psI$fKE`mOZ-N52`m`@;QOt-6X3!vk)s_B4 zwy?M`IXCwr;r9J|eq9klS;V=ut%HoY;TXQNvo!nH@(K-2%~++k#LoC1?PL^eY*|%% zc>P5o#f9smv7o5a5n18etGD;cE(x3-va&9FqRH;*ysh`x6m(c2{@0BPGK>oG97yF7`W*@0AERU} zzULde4=Wk8g{#ge22>fm_VaNGkOwjf+Kl|-8)YPmC<%{vZ z?T_E74;yIe1d-ja$NGf4|L+kgJQ4m34?(552xI{jV$Gir5D{Z_vWry(_4V9p|4>!g z$@d#$_JgamfdLVXn;C=`91s<;Kd(p*1m@O7Se?H0^m|%=k&lEh*OimCfJS;TLXr4! z@Nh?5KcyMKlP*5yzK1;6I^%%#>9XKF%ZD`s^$9K_hZGt zFf^mzbba;If)*z{1iWS5pHTV?Gc-I&!IyIhE1TfgRtE%K}+PP8bQ)ha{JW zsdy}e{(MH?IoaO&16M2M*fYceH)d#G>R7rZXTA5HMT&>w(83iX`Pzk^ld*WBx~ajX zRCy>r3G0DT%h;9R=4mfgz^R8yby<{|CYg^@h{A}!&U8P4OkRieQ8l(;5Clil;PR!zLaMquuL(Z(@l_p4J7^NZ zriz{fhpisd9ByuoiPHEUrf|8qxa0sJqpqgkTj0_hg4#pgIT$s?cAjBCSQOW1X1;Q^ z{lHHBixDg&*geD!Lz%*FVt0&*%wsOIh2H(`P1K6AhtJH$kkAv=V|_Z1Ky|=|W`aV4 zoYZz5L(1Ti9gpD!LuSx0f$<=@u>bAr1uDRpUv`FVGItwQRo1a~j$GuZKEK2ZGgLnS z1DJ~pG`@ey39ECeG|kvDMr7avfj}Fbvhsp1^woyTOY27)NVc|%B^mGgNtib?^n`Ak z>E>}(Uv~UDsf*!;Zgk(EALbZ4`yPowr*$!=*qt^16I#EodGMk&Pw~lub{n?LWf%1g#sW`ybv!Jls&4O3NvvS6>Z^5iAcGm6~ z{ky4LBK6Uc%?%}7>rZZ`9B|9dqA0ptQV zOkzMph_U;5@mbD4QGF03bv&2qi|r`_BkD2h=;x(|2C@2*EfuiFH{>$y)nX*|9a`2z zi^P6buU6m}jv=iMSRK8&700KeJ-X}7 z0vkGt!!}3(CA50~%`Z@*)2HQkjOZ>-_dGapaf!k&BLnc-oi>L>&EGB{(XZkFN~5}( z_Mgq^Ei(dK9pgfI++3p4HQ~xARn>M=6a`k^h;#^AJu{iAZ&@w{aG(_-6rw3$o6$@H zNlVKKkm>rf!hd@acu3{PykE7!i`2iv$<^k6UWV-D>5J$Zquv-36%nCGtqF3yjWP57 z5>OO1u`!=LU{yt&i z=@5{WC(8!D6&*Z0v<1SxWh~Qj+TB5x@mfxH-UuTV=$}95c--#7V&czUd>9xo_ypRIRcf2{9s;&6KQXeeM%g8SB0J$t%8u z#UX8(m7EY*7Yna%mBKkU6Sn_j4Cy^EtwllJn4N}qyp4?og@uTl*ImSP4(xFCzoim+(-{db|r`GV}!0T82e>6n`#5zLzy7ivh(bW#aalV^EmXwPoT|> zB=2PC?B{jcf^rQ5AYUw=8mzR3WQ>Xj%$NQkeW$Cx9 ztk?#=&WDhbbHqBLzxgG9QQEW{tVdcR8Z2DdzRMQo)1rPCg9C|DjCJoei?x0f4w;eo z(Ln>N%iZk&?6T>DQJJ{uzKZ1C7`b%X=J4xF9~l<#xS~J8FUY^y=aQ+9Dd^QBsugmh zJZ$1*WGoLTFk!Ah3KzXyK#xki2)70H0?j$qe2e_C@cvk37zeeYoS_t>~(EoTW`cCGWdZ{A;^N9KG)ha!Cqx}vT)MwG1ON12(?#nFVu%J5)*zMEFC zqriGkgp-&Gmwp@9DcnfPPT`YA4hZh5sjz0Wb?IG@*6pE^HV@i6rs(5+UX_ovb%9wn zG*>S>QZYti$JUnEz4AqvyD(1%n0%|kf5%isZROAA7#rA6!U~{O=9vo&QO1(<%D{16 zd{=$}jRyh)hAcn&9CU*el_+AmzgH5&y8;`>o`BeT9an1)2QBiHcutz281tX$Ft(F1 zThTfa9hec$h7oNjgRKe#JK;}HQr|v?khxE1oCbvD2&t8pZVvaEPu8ex^m8h4>2&6( zb4VOt*f8(QntyX8Fb&lO9c3|IISNsiaN`$SxoWCcMW~++wZlC>t_Rd|u_c@KYXKOa7S?Fg$QzS4Kv5)wb zT-1vg61?`XpdO10vd?~_UG><}g&otBWXp4(?b}1@-+i*HOEa&Z3J&JxpGvnqyXtby zox|~wM!$Kf@3vtq=ID^=;*)AmB2p|DQ2*Fyb^PCjc!9zFi9c=xfK}D-;&hd)XIA)! zoK?I3b0t@oekDmt#n>-RFZAQ|33woVP!{pPECvfb{)}?LV^_VDMD5k+Kdr@yi#<$+ zS5!J;PzXYQX;g&`c~htm8f}WCS4R!evTF_4iuCn+FfuY4VE{!SD?T7HUH5x}W_c^k zjFadK7p5fe>yNTnW|cZwho21Gg$}f{%Gih@vRgmV_&eX|i&pPHoDTK7SPLIvawNv2 zvn?foD@Tsl_rrz8!IEghGn-)Rz2R}!h`_@i4q2<^RJu~%kW!$Ez1rN-gSEIa$uUab z?**Pde$Bb~9r;FQv@+?cxY+Q*M>*n~pQE3jKJ~HFR{fRfng|e$M0$Aq`|E>>%7lan zWN(lyG4a!9L&Kiog9DyhXJn`jg$5Ne@U7}iodo!MF#4K~X%|ah?t{3-zdK0Vz_3eu zwznvWT?kN}Us;JMn*AgJb6fF~I&4u+dvo*Iq=p${ZRl&{dGc=;%NNn~T4Jj2N`@r4$bldUW&?bn+YePugcl12&}Cq{0QMxywFqD8_a4 z21>iMi2O42gP3GrPFgi)4eG!905+J4#T=#K7{(TBS0vu?n&sj0ksPbHlDJ;7)WTSe za`7xT|8>|VF0sN*PVpR6s;Vldq7M+cuI}z{3pcPbcR=%5?s>zBD*UQhb2o%)xa5&f z)<-@6ZCj%CrsqQ0hJv%$RS}ki<^)n3{U;z!5Xq>1?J>7RLr zl+hSe%2`6*u#qLP(oC%?{}=&BaZVOYscnd(C$nb}7uJC9BR{hcV_pp>4D#wD0oITQ zO1lT)_Z-vP*i1KDkYB)SPTqVoP8_&cLC>*grGUiF>lE{s1UQ z<_ads9gwXMwq_ah&&hcQIC{Yt-{%{=ybd<@MtfQkot&IOEV)EJPfsGfa@BTXZIyw* z{uAbWSb^EFIRtmTPJ-@NOJ2x@qDdJIhLV-Nz^@;fd!6(AR17tg0&RZ$FArhZPMV7- zu7!baV02PTNlyWKFMJATwhd1^kk50Q{Yrm5Z%}cqNK$=0-HZXzFu!BBge0NP)co00 z6UNLW($9(HjnP<9jo(;38~vnGd_VHtc`(|1o{2M`z0JLNxRy({H6dS*L#`^RPf{z( zN6;sQ{$f>ZmaHXA#jX@c00qAwMJ7UQbxkaC2iol0o6t02ZMw&$4vD`qOF0;lWlS%F zo)X?2FcL#3$$-_bUo#t>Dy#Ep`iRg{0h0P7aO{audmN}C1y8cpduennzWzV!5X8yo zg5O;`IqFeVgzgjS4Gs-;aep~H??_Lh)UAlh22JVqF?5i=svX&_G_mGQf13OtRg7(7d7KKZknIGN9P& z>bEKKZ?qfyf1JkH?-T(Rx)b*E|GRk}6Ip@5!~d{1ZFs;N^!K})vMF*r?7znxbtTv= z?|L}K(|0)CLCmor&g}S**@dncMq6t zj5Bfdfj>ONrdry0;nM+=n?#EW$8}cZ84AQjI>ZG;+dM}7o2&X+>uY9^ElEUGGbGO> z@Sw`cVO&dDDEiN=lTi;6qFw~#ct1d__V7C8^U_spkBKhgPu`^bVw3P_tcS;LxXOvT z?x{hzvXFC5F7)jk*JRoC$XQutVxhvg=V_9e4@CdgT>WwcH~p#6OS}qm%YC^sq9+VT z<1aGXP1kxcso3N3>Kb_p%3@}U!YQ%5UK*xUZS7hGASCWaX>&Mz0<`pCq#L)6M`dj= zU}kEAva>)sNR=iZ*keiFbPzX%_}~RqQCT#=07`+Tw77VD$Zj|F4f;1CsrNIL_`6L1 zkexv+;n81F1Z;-8#hOTh`fxcpc|#-Gu#v2a*O^@rY8&A+KI#PAmn~VVaAe+EjYG3LChG9AsgEENjIvdb$$ew%D;(E$hx{W*g`!+n{v;r%oecz zGYM945!H`<_83*$dIX_@QlHeZFH!-WJOGk_lm&s3;*gO6wJtz2_~$J0zPebi_5|>R z{m=Rr0Vj=jDJdx^t4_ReE{ACKhS&d-AUQXO2^V^E;xEKA85vzfU-XV2RW3K{EllD0 zKC(Q6i;siY(KfFF)#sD9U0rNSf*n2hmY@;C$$4%^Zi;8p?KF0)ACG@|UMr$#OG~S9 z`sTObl^cecgDKK;_SGxzgAkI!&;H&z(f=GUzpt;8SINI?&+Weuj;`NZZk`*&#np!L zzv>W(sU!Fxgz$eyr2QrF5(B8B!V&)Oba)=`5`o7*$}$!cN&VYCpX+5NXus@uIS30M ze`W>`o(L8y{&dDR-RHZ#8zlo&X0=T-1a^_X6{h0zRqBpZToDBkL(UG=_b12VV5*Q2 zJ`n&3f5=)NW%@^ZQC^*BZRoor{_9+)_8GD2j=;p_+dI8P}T1Rdegg@vz{{}=(bG*#f-rG?I+nCYu z4@=F=E+k&kKX=5YkmTK;T(wz_xx8F8o3!`3@=tQNbyY$?FoDoJ#5%G|ENkQBOg(Z2 zeHkdJEV>ugF9XVmY~6O|scr<9mquC_Pj4yovL>p zeBeWfhbLkE)&ili8*5{tZOT7?qPvnP8Txti={vkGdXvV1ffDHMFDir}Cf@+!^APhV zjL)5zqrU$Wyu_c)fy?rkQ zi@xM+iHi0Ha;0zF0^TPCRi1=-u}NTGFXu%(hZe=pu`M%8jWs5eAs-t397OR%v0OX* z7s#e6mG`I@H-<+l8}D1W{J8kz5A&UEFyF4Cc(70uey=WhqJ~s^@O0#YrnETSI^Q%G z6#h91x@O4LBP)01TmY5cq@QeSN7EIRZS|Wb-(Ir9aA6g?%2mCngLw4+GKSlOYG25?_P2qwIXemv*h@aTfNQnD zj{Qf?7=ymW!Fk_JTr3G1N9}MICXo`ObWIZL!%tFVyr0|%>G40ijImLd)DZR2ci899 zJdzp9>FrYUFAE9A9rgQaB@7lP|6Kgg7+bJIxm6ca7!g%a+~jDHQ9OsiUJ&bF>12U7 zkLgoNY{VcjFL8SD9*8ju`b$lA#dT7kb5SWOLHh%&cY(PQR*QRqDW<%#DjxYW)QA8R zfNN4&XljR8ACx#~Ln%j5No_{-A%>fbQ6Wi@b|mt|bgKc(obdCOtza;<=a708oq70t zV1K3-rPM%%D&Vt+F%>PH59rQZ7Qt<-AjBK#PunMpw^E6lq3$MkQo}7zLJL?{3t{PKAOn==jU5LZR-ERvI3mp26FPz8n|(Zq z1PMo>_-oL;Cv27)7Z0KW;g#vqsCe}8w32^zOhBY(7 zE53AA6Wx zHiB&@86}dI+oRxCX)%2r1w`s8a}L4S*mSkMAyVqR22{D-ar4|+hNHVR9%}^t!l<82 zIZ8Z!Scx3@D}NXS$o3`2nu0sSa&*7Fpaui0a|doao|UuC)nwwMNWMR9W4Js^<$cp3 zY*gOilAKdTi4HaPCAw`lV(XSYeXo|S5!$SXpg+_K!-TFdG$bu42=il$$9&CGLA18vKB@R|fRg@n-s#unbaTC#I+%<7}l4IfPB;Y%Yes zgqYU3SZth?)Q0aHOF~lFubvmV0vXa2a{FE`Q_pV=l^`?ffRxbBt*rS7%7};_8xb84<4rkU^g9PyvL)iE{1(vQz%VmpsVmH8L3R6b&0mBEM8$cY zXK*S!@>3d_=<}?#ch7O+LFOLtE?87Swd(j8i|EvDdZ+=i$r{Pv9ujTiE%gS;&3JB+ zVOE;PO&k^H0Wi^i_;bmThMYKdhG)EOMnlipYi5JBm+4Bk6iASSL}H{eq4TX2UgmXc zDMh> zQ@J9Z2;6`lRAo%{FvOl`NFd3s1+9K)h(D$v?pKUxgCBa>9VO;D;qAA4ga(q<6O^VW z3{!Drs@86r*_gi`(6smvheE42ein#{*cO8c%_2KaC*|lBVWV1XNSk86;Hf6pW9LWM zIs5y63#+4b07vP{(!sfeOK+kN|H4!YOc-_j{9{W}T8R>iL3=W_8Koi%(ZzL3dM6OC zpn32{`74g`T-d|@hf<1<-N(~tK+%F|3A}#7FL#m;b%Y;>tiW1-Lkn&kdWq@^ODpkf zn(Rv%_L-u3DF+U%=_H1t7>rSvIOr0*Pw4&Smj{Uxcuv;3O+RVH+q`BjXmAZNtdWK; zzzRa%#pIV4k`$9d^Y?K=wZ6r;Bygw-6I$*e&d~{ulK4IE@$9XX$;-7O1As2(YY)J+ z2a@A~>ptN;F-*{uu-~z045XkK<~GCiqi!EAWyv&vS?R#;7$~l!_|A)DHOq z&+xo!Ak0bS1n!2s73opJZ4Wu=o7;8shho#>Jgnb;jjq@+q@{Pz*mx>TDysd})tRN_ zCMaKqrZiei0+w9i0K(>_>0k0)&EY(EdDpc0LYX<>y&HDnZYWa1JXEle6g@;L|C}{$ zHbTBfepncHx}m>OWZisX_uImZcRcRXE@HZ0@10i`aM?nr3v$LKb0JgG$F*Mg95Qcd zFTkYJt&mDSAgD+Fmjin>^vjZnGX@oQ zt3k0^u9&>Eml;stu_)5Q6~ow)Sq*KiSQx(;JMiBXE)nr|qydp_X&ahiedH$!Zl%&v&3_8Wh z9TT14Nw0GQ!aN=;{JoX7)3jMZyI7U;S7Ni1GhswOepN82;fF6!7=ZlTNoz6dmS`PO zOiUT8LUd!tyu$!D~t3=nn}5*()AZG*G*39KAT- z7mMtjCf8Za39&h=o=yh1w@Mb)LsJS3*;nPs8T%|EmzNf(vEt-Z+$q6dH2`fDE6lMk zXMLBU*74iFhzqOlPY`FvEGP}*z8mL_G>zwNb=#F_V(2xdf9K14q#Z$A#zi>&aS5qH zLddCWL2Lx17cb@?IuS8@jJZZpS2rDlxhIc7hm*nyw5NqLSFxMR++g$kWtP21YyOC; zZ5rZ1>rO#Gyl499=8nvuwZHq1kPEaCMt61*q?gaZulyak_cf!&x?7j))l3VrVS&Mi zVm)JLZ!U-km!{S=<`C42pkbKchEQH)od1Jhr?w6-IHyLB zc&W@^&yMdOgK1E7A!OSu=i(EN8;!n7ZF4d@Xz%xsoVe%h>ZJ>0<=`+D=z9xi^48aO z_iuLFc0k@ze3$-Fn9HNRS66+Z4)5N=75@>h=>LuLTDyfGV^{t7pPs%tAgb?qTe`cu zyStmEyJP82my(d~E-4X-B?SaTVnJ$YDd`sJ4k-x%--XZj_x=l9&b@QyoHOT{dFEN; zH!(Nsou0??D?RFMGk2>JruqKf&je2k2Gfx}-|=#bX%_wL1 z1A-`7e;aE2-Uk~`o0Lec`wbp?mVUe(V&STN^X+*X+vQZ-^>&Op^_vKewkCux328UO zKV}dX1SRW#MZZ=m0+Cmt^M~uZ)AwF+Z#5z-He+UQ2u~Va z%Y}TWVx`nqw05S=`Z3H<{sqBv?~iS6EmAP1y_d-piJzZ;!{xeIbiX|~EI--}hBz2B zrGBoh*!ohE4NVZWt z2*J(1xrtWs2fmocIBJ(?BIdmg8NrMX@iT(+`oRqDJ=+Qe(4a5-T*pX1EI$kBK`G>7t z7s7YC_xr9~16Up&Kmk<6vqMqu$3ESk3vuqhK(kjjbfYYYh9MZMZ{Oz?zQAaiv!dNp zP`_>?yjo@)fqJtIL4uiFs~5=NWG@#DA}mvLYa8xHbZZbKxfVW z|E0)N!24!c4!@K31>Cr{`tl71eefhcuPAW0{rEF{XZ!M?@iVk%Ny-O8gI@2xCTxZ6 z>i6W1Z#mYF*HhZR{Eb5bQdUR2D-@rd^TX4fjq%fqP8kR-L#ePcfM{t43N{`gNge;? zXvC$_M;4Dgbk{}#U!bQ`Q>Hf7iFw``xqhdok@x%nIy@KDG1TayJcNXJn^7r4lHl0B z64PU}4+j!V!gq>v6fWfE(O?Yd>B6p=p~%K;fNhW5z5M?DyL?1DOIdGc_B-E zTo+`gCi+-K?p&|nrOLJ{xLsn4pSDrxUA9Bqqic$+CK9}EUz607Iz&U$BD{#S2KAL4 zB)YW{0vr@uKW$Yp&r&Axd*;EmGpY6$#A(NPCCr4Pm?DRTC}Wb9oQR9|s-2!wek6JZ z-q1;rK3tLSBT+_!k2WIU=baj;7- zv`{IzG>glMBlGgTE+()HhSp;76MzO2BRwOXS!3ie-3i=T*@SooyzyTuFw3%M5+xG? z(s-|M>9OA!fg7rcmf&_L4fN&A+(^KlD-2zksn%a2G}3BBOSb8g0|qllPm_q%rU$g5 z6=gx`I)&pGDt+GauG%r-ZNqWZ8p{rCifL&0O! z8$;RBl{JfqXgz;gqeUMIZ{CC_SPqJej?X=s{$)k&8LA1zQ-1z$II|iPth9 zKj?9EBq?NYy*QL$1HjPh5`j*?YE8U=THD+Qg(6_tm1$7S{BAXh@mE3y7TBhr?j;W+ zhBXY!AU?u#dwJgfMm(X%5SXE@CB=1S*S+I%`wN7u}exxAx z6N~ANPp7*qW|5SKb-CZVf{!@v%}KP65)S`^#`^wAV&71?3cHyy`xA0Sb+7g2$DwR5 zy9C(@BZQ$;YB@6p49W59^$eMawq4Xkla=0HMIz<7?@uVmlj(=C`bC*lkPuWR>V<}_ zt#>*ZV#$}S3b=2!@TFJF(+U_xf-hRNtx4X+r5`nl*3-l-#SpLRiKa2II}W>&@BaBV zn~R0z5J-rX>BFy&W&W0CGNWdJnZ1OC1FN+vIBTxiwowElcleKe9dNMZ5;5^R6!Lp7 z3YCp3s(L>`o?uP}q(8!1 zAU}Uu*K0;4GmP~;XLvUpnOVb1=x;DaYiQX$*|FqXs?evp7Ub> zVy=cwi2$}*9H!1M3&hW*EY@2mIBnWbD9dXxtZ7ZrV{LAzzZ;pRlDL*t1PxC?_}$Xp z1R4+d}KI6g;XOvsToYG2uJnm4q--5cawHYG2M$9(# ze&{IN0<<6XFF(YtNI@^YC_cK*4*b~3quX{Vn7)a^q zeAvL+*&+shFg!Ly%H+=6QkL-bw~}*I#=3eFitHhQlUFm`%U|`X`MZ`*SHOp6uMq5) zQyey9&{d&VE}A~^Y!tG<0p5pc@(hSYPcv_dsJ8i{gm`)tGwQhAhcf^d&RkE*(;B#( z;X+kSaMCQbwmlTun?lwPF{N)w>Bnbe8XF!_kRdUuEiU85yY3^j9d#aNliynu&A&kZ z{?DOy{0~_4Yhul+2NGUG(^mxpcV=>P=bBmm#z>3rPsciH6ix9J;%@1H9{IVvcQN^% z{9$z%g<3{st9bi`cn`0J7sO3%uuw=94lp;G`*A3cj!~x=$KZIDjrZxmKGV9 zlhy`SW#zJ@j!V_Q9}#W;I%oXb60QA4ti6UqcSZ5+<3tI2>8q%uo=p(N2u5|ff}Tx# zp|Ud{NlZ>=);x3#+sNJ$WQIgSWfMZ_59G{P>rTvuxdS8S@z zoE7{$g_bY^M@<+cf4ZkHi^fbHvcg~U3br&Cvv)^ir2;XC2C6(tPND>=##o{2_EH+y z1#xvTLbX2?+WvfvSrhkuGKXBhr`CQB_Bx+9048ln^reB==R{E|wd4_D_kZ9PNamIg z;T?&o|D7()Oo=;wcWSuvk9N$Ualx6ZX>leaT15)UF|#Py+mpKy>MqVd%7vXQ*$Nu;fQl%vPwA-We{XoSnX;@J;z5Usfp`sZPbJw_KgXhQ>59(2Oou zVxz1sjh${UAAbxa&=LREg2)+hiNh0!bjouzC{(0Uh8$g7b_u0Q@uo_#KFH)K2$H;Z zjO`g@|9#3JlvYR7L~LxG{^l_Zlj~15RQ8D9KJ7F-(hz-+<$m3!Iu-*(CL+fPoxWBR zPj`_G__xqV`J$M|A-clp*T>`oyqDBt_me4=W8DfFFext&*O#Zev^4ps4*pd}8m`a= zGNjg%o01zjFQ2rpf0omcm?WLt75>a#Zl}N{H4Yq#nQ9k84yD(=1DyB3Np0A=H{B!@yL@5j-0e|Hiueh)lSPnWtJpAND zoXaOL87q!&^9RR3{xM357pERkCr_S5&U`YwS*&>6KqoaaeFhM_8vXFfWKC;(WW=rbGu#~0#-w;K)wuo7_fJN% zb3(S6ow~e>wZ7TB2qz(B!Dw(^DyPv4&_sa?{D2az z<~RsX@wDJVS(Dr7uD9qF_N!tU2d0_nBjR_W1$diLGVyl zFoeg31YEpC%UVtR(lCo4l8qty_6}X^bTP#o&XCkKc__QoshHLuU#-Hx68^~auS^lZCR7bZf zdaLq>{K6PIdgaYVI&w%rAQ91&=j6;xLKb`$tN;imK ziBr(GGs@z1)j-F-GFnU@0)Ob*&dP9vnT43X(74Fr5TCTU`v;zMF6->9j>vMX^Rft9m@>+?@D$yx5$7)12(sU zc^ysdiKf@jDH6N9sJ{RQPhV7tPXZtn8sz0ITK^HuI|u*ba;hE=k<(au&S3rZ`Wm>e zwBq9M>wYJk@c0DQ&P0)igfhe53!}=dkRy-Baf^slr;Q!@b8oB*XRour*qWH6SEY6E z%$TD%)wh>8d6QpSm`=|9ky|lg0)7tBvBFOjXcT94CS&27V=O42OP|tQG(U;E`S-UT z0IQlM%6Bf`?? zUiuQVO2X*7kPSSo2r*E|fu_(BQ1uRb(^X}_%1TMQi$+WJqoSpVs#}N#ZHOE-wdsj{ryu8a)>icxwTS~^ z&)q6fzev4x#VX2QnJi_SJyd2#;z@JDS1DiL0Kb_wMj+SzJc!4X;$7v5yYk%F<9!!5 zgVL^Y=Z0DhMj%5M{PhuAe`O`l^h0EGBKoFVuF527^p-@nYBeNv=Lvm(geKh3 zTC}NLHOSNgUf;!3aaQWoq*g;)@A=SrTq&BfX-`>!2s{2QX*~O}=yeRwZIKnB%}iye zUzP2p*yg-3N#~-XKH4Mki7-KWUgw4zm($8QF6D{KK%>?sgg4G$b4KN`B1I}{QnCf( z&B4`OPvET^8U3d&JZO8YO6`Xo)}zW zUI#1*-yijM?Xv_$)S?j;u$aKtUP1Mgf1+?+{?8|>im!X6k4xRg&Eq$jyS-cJs1qrz&z+c*M$OKN_loZg(N!$vO)7N(I$*Jf^2OApXZ@OdWgu0HP_^CW!y{PHcD^CW)=Ox_puPyQwqImTk) zf2#m-_lOxQ=TS8f66TN2@XGj>eJQ2#gG2Ua5i{`L@1MG4iR`ZM3SC4jL$dWTXFw-VbbLu&5J%jKW zeAgBc_e*rf{fRRTj9$$hB;Y0g$PCGJI4Z+r=xf649lV_jOioRH=hF}f#HeuMc?n}~ zKQ3cT4qopVy2Oid4Mhw+(v;>7U$CQpw)@_GGn|{ahr?;DcMd>7=ns%S343o#!(lPBL%xq?7zgCLmxjjEWss zQ%-k`kU9KzOQo&8SEe$1g?LUwnSXZ9f|s6B5$|$mGE-RD;x*Ipn5SJh!hxWtm7ct{ zCqcE!w&BXx@arY5GQh5_dqx3|hysvh?~```ydR%UL-Unvuoj&6_n5$yduI1wJ6*#( zl|P@c&M?LAk;Dj2+90YUwp$x%wPWI#I4$(6BgEKG2e_1MGkgCrTWRvac-+ zHe>Y&nY=-nuKc4g$cd`C73?(5CtCGOF#u0yEJfBdLU^)UU)gyMUgE8`;7qVr2zqD^ zJL>Rw)Q3JQ#sF~!ZXrbR*43#lQN+Ek-l!b)5jz{&Uh+c({u)GH+le&o_g{+x^|0m6 zzfVd(kYPrur|&r-wv8I8XkJB4mmjIbpNE4zIEk0>L7*Wm$PPBG#3bPx>N?Rk7o75X ziG2LsvFFpWdH4FiJ!mHkktE8vbe<7ZXAD-8vWzx6M90J5sGz|*0&f-8S~=slcv&*5 z7^OY*n9UV(Po+|jTKY7G#QS)StARCt|6VCh%Icw~R0i=i6|BY{r?-An?H%#w4 z)rdV^u6t>UEo7@=Fl!lH_tE6Q^<46!`=vTQpzgB7-_z(2HLFPNKcq$|`Xz5vXug}m zEqa*{C$tIWnH|PKC%P5ZIPp>jq;I$5ih7wCDa}~^!N^|JDp)Opry&bE5?T}A3JBdF zGB>KcapSfvbhFPAEV{)a<6&LvrXB7dU`Z$nuTSUbA6=HB|&odOa+T#+AuWX1CKoSq$v1=VvT}>%ZO(jZ6~(bD_391 zfD3NRnb`Nos=S((=+*cPJ-8$#Hp2c~4K2Lh7k2+QpUZ2ebeEqF&Z5AJU z8$n3eN8t#Bf*&bmgtGrU`#4p@w7#^7F2dXfXx> z^WEhU;c8O8awPt3Uw@;E5feR*!9*SKZ||@5&L;Zb9uvX}WZAt)DiU2s(we^2(wq+R zfpLZ0i~$^7;e3n(scL6hU2BU(3>wG~4>Cwgljf_5qjIh5 z10w5kOjL@bUnwk@^baC4bT(k>Ql~%ua`G20-vd3#JBsoK905c|OMzE|FfGYfl7R!B8)HcbsGK#x2k@ei4+K9~^sXXJ6Y zd3?(6=o~N^`QC!At3PG8xc56n6)8~m-&d8CXuyRE-NK^iBNmzH#@BRQ*p2k=>r@Nz z2^(5v(TmpqpajDw=5h*&Tu)Cje{p|FYh8SkBP>(goQ6_0eCLR09rJQ-D=+D0BTGd2 z(I@cbRm|MD^YBINrVT;nKAe{^&sK#UTi{&6(OY}G9P@;x+W^J3{H;V6R96A1^GX~X z=(!fX-d7A>Ep4bRhw9(sNnt6(R-eY-<0tYtQIgwO9k}+Di8#_m00z~{Bs~V&Z~p`q zclLUo$~ftdNO<*Wkna$bXv+Z?SWK%8B|{4+k5b+$9xl;Q$7rOhsj=^N*;HHtz=C}^ z)q5wV`L~Gw!5rQCF>U5myoQv3W8ow0FJE|LKqv^Skdm}@1L&(zaQ+Erbomoj<0>Ip zbI5-6xIzbrl+0aYBQ=U`QyjHjrJ8{1T|D>cS4(+EZ`6?>7c5I92R&r7SY@4$nW?)a zOto76v>bKu6d5Jlb13(NgTFD7`rip%39|+bIZHK$I$9z6UJ={ zH@;hXBWgn0(?5&D)k|}l=QbKq`hlmham&Wq7sGM`zNc>fR>4d^u3vrI?=_nz87Xv3 zIPt?N4>sd(KZToBWaJUsV(qlK_dQi#sAJf6fcDyj87*2YX4 zs-|Nno4oCONhAHfO=x4=8h zhwh(wD0-R^B|!?qUjUn%Zr8q5sjOiAIuMMGLjmck$|0%blm2EAYiBxedo|m+0g6XH z^tSebUFYAYtbPiuF#FKQD-%3HFhhQK!76X*iQS|{9Uh9Bg805Lixi?r&&_Sfh-d7+ zLwY3kFL^GV{FT$$?ce*#PKcSDS2V0H49jLOgZsF!_p0n=&ds|WV0?%mU06&Pb(D6< z+fAj`(>w+X@S4V7f`pZ@nb%Oh)?e%0o2Z&84{{l&u-XD07copg20ZQVzaFyz2aeTx+Rxk*wt4RUpkx~V zEw5&|KXeC*sDHk&Ka`h!ZW0xU`LvY#O@#D0IsWgd3mc`5kQ$h6x6+tWv#5y?w{r|x zTfPyD1GBQQe*6}WK{C-NT}_D5RKe}nqxqNkF#1QUAPcMjL}{|9N_Y&OJ%0_jHw~Sp zCB0Rq`@TXGbAr=_dSNkceMa}tIXGmX?MPa1+}nozA+3_gcR|qB_w+oxZPqyPsG46i z%o%02z=u~z2o=YUsbJ|J+Evt7JUh1((JypC$ZC9Yi}b6S-}4&!`D$;%GFrXeIvS;Vhs>Kh*3~*xp6rWIHmIXG@qw?g zhM$L0(l*kDygd_Dtpl^SD2Z`MW{~RNwxralUm5cI%~dj&#eUR6(qgj@MYMb0khDk$ z*FUaC_<28YV9e~(&`QwfQyxMm%Nj%$@5$#?`#ZGge>KODd0P3@XdmRSRJ_30&D~Xa zAS8?)reuh4R1%Q%YB`|i`rH@VoZP`0W@1Vqf0kH-3aMDHs6hI4915eDv7N^1pjGv2 zyymVwe&kbQpBfBi0oGXo_~3LPDR`KEKXsNY(Ih-1vatNQ_LDT>Q~PXJ$#Y@MrU^CcOVC1f#X zV7)z)kWjE07k4}LN7oIvbS9qy0h~o-iZnNe#UNI$$*f4ZT*xm|RyJVIcMNadmM^ha zUw(>yB2nAS6`HL?>Kj>oHSdoOIis%5;I{$_U_xi%?~=zgb$QuuJB*ZSY}}3`t9K>y zDE|8Vcr)SaB>#8Y3#gL=eY*L<(A-Hh;iM%y*H6_d^>H1~BJ%uHko8PVVT4w51ax3Y z=Ba3H+lW(<&!5gRM5C)F-JC5gO12CJcOvE>x3&!j+B9G)?P<#&CURnTg~8(qeU6_s zW}5nnZjXHyJI!TI`sw2Ui^LE5PhsTEP;3y^Fl>Wmn4nG{Y1^z@2XWR&*)fHEw)!jW20}bbTJ!D9#C>IoFC~2Bu(5(eYMBsxC zDtwBs5V$%?T0s=nB#DKvX&T3$tb`HFdwCJ9DT|lSAF{shie~YaCfS;})gcR4*A&5A zkB^HWs9_a^!e7ayV?c(c>4)QKl85>c))hcqA-xbeIiz~HfC%DRq+l%xmtrVNE`UHA z@6Bcw#E&BCD@LA&dhEPm*p=1- zbZ%3a{Q@3z6)CJH?gWeeH(&?%bXRK3@~hzAQQfk-cl>XxW@SOqBokr2NK`)Rs75l0 zNyK;dEGduP^AN7NR>3~&T`Np8%Occ!ng7C*M;h03yzsD}((pz*{f)=_v3 ztpb2-pwz0pmfS)Oa*fo~qGtG#l9owooA8z7bjA)qFSM1gtj%i3G@BQH<67RQn{#s| z#si)w;^h>#Iy>sQdXxSNm<_9(lWRL&!en`&>z3yXIOmZ(OaPH5}8jUJ_z4_XA*v247&ttZ+u)!mCL+Lk-5*}44ylG2&B-(nbOju=f@-XIQo5-Kk}qLb2ybTuLfhEHX}bPnGpT$ zZu-6rJQBbGQa&yBYN27$6qBk=q2UL2KttUOAh=uKK{heKvc7z-=jza?Y#wW=lx}QZpcjXu`g^KBW#UztrMXO8zF6 zB^hn!J1zv(`$g#|aAb0%J_ObN!_X47OBAB>a2%4yGEFXx^LocEzW!63Ov3tRwG#}; zhC>jOz{k6W>Ta-V4YRF3M3gq5)%UR`q-UiS^)tN}fY=miZ3-2OZIfev7qhVmM0?7& z549&@0}&+qWz+g>!*`$~+C?^R$M&pokuxoA=;&p}jS=ZLjn~?M7pZ7Yq!ZiQ3~PON zR2K5#h{0YXRs9-eW_)?PWV*A~M)hke5`lZ}Wkxd|i){}2|kMttP znyjp71i2Uuzw*v{!LQUoi23cnYw5_2X(CwFW=Xai0Z_55h9UBCwK#Bw(xO-PO(zpM z`!2V0jY`BZ^bt}VN;c$=hwInWV-6rm(A+kUEE_;pGu{YfdF5Cg$!~A=GrZJFC~ywP zZHa=lsxBfW0^eSnwU=R$qFo8OiWrk!9o)_7Oln@-B~C-m@@K0fpI+;I|{gQSd>uk3dKZXhJuLz)Ls^|U6H$&pz?gz?7H*U zG(m*|Rv@-5Y!KmjqXyn?-`39ELSf#?rP!7hZVj&5jO$@9?(^1bW8DuVakbdw1n$-u z!Rrrya~Ftdofm%6>JGsh&8tNBJpSq#6kl2>Sf^gUpJr4o5$EOm8b8M*XE(BHLenbq z#JzEU$i5Uydu*Q1uu@E6`9WEP%~<(nzmxxmFD;!Efd>M^_TveoH~y-{(FiE2;WXsso<<*7Z)2m zAAQCP#ueuyLQJC0cHWeY2usgzCqF|>2wTv`TkIJ)E3q-u!8Z~jyqXgTbC_Zif7al} z-dzQUgrrDlkM?q7U|mh8CtICK2GL;X zN0n)Gmf>^TeGEm$u&23t@Tm1Jf|K%hD+^9i=P+Ti!c=cs>F57gQN(w5ynh#}B9i#O z%=)E*N1fLbH^h1CK^SoXhKg*=LugBr@Ws=K2xb&sg3<0!?~g~=8NHQ>n7|(fK3fW; z)NeycXlIg`UI2poZ^E^!h*UauFFfn!mvrY}1TRpE0F0pOq5lF@YtvZ9lyl&4Llx#< zt|s~~IQ8Ywf;AnYu|_#A@X8eMd^z!Wp;@op>!9qydOrE0hMG_i!zw{NU`fC8_51Mf zQ6^H=aoEqF|MrCQW%wr@65`&H4=(*opJ*2P0$xyW_m}sUnF$5MaQsxm zAhFlPqbW)Wy>}zk{BnEwIy5HykVwN2QPy|>VJ_Q?*9Zq9Vk8MG0@is6kj@jZ;f!gg zDPmwPGf}HnP=RP7LZBILW8N=aku9P;luMm7o@gHXoEK0-BqzchWQE5_EM%EI?fC!C zR4$VKhOLh8w#EzLF;q;D-c&tPY(iv!D`G~w%5(qU0qU&_pKo-gLd|{ zWM(Y>a^p9bkI|(6M{j-#NrU738JV%v(cu9FG~`vEd92_Nto}Ru?8uH}O3O5Ff6a{(V zn1*SAh=|ZayVDaA4h|BKQD#j|O?gCM7t~KfDMQx)C;-N;nU9T)MRwdJSx!kwS=DZv z`uF)W7p(DK24wBhTVJ1mo`IpQ{h{NE7c?+9NYBQWfMBepg-x=Um76Og2Rfl$huzW5 zwx&C$=oF!V@M~Vs)VB~KA|gs%mkpR!kv$0^VegR0D<-A^)NX>9{XEfxBPpKToE&gV z3-Qs1*PmqcrC{B$Mm-hqz0j5+(mb&G=`Ia3OH+UWkpHH=0RnF*gth8c@fN)9?duy| zQ^O%CDY?G2)fd4bD43OmytTQRUQob^2NZNI)8%|D*(off#>B*wgqgwbmuB9#7}}K7 z@aO&t(eIbU6bBh?9URC4k(gL(s_?jNHm`wDfN}7Flz^n;xcVs>q0>11185 zg+2!-Cs;R2n79lcF>!2F6>I;{kk2~UUj`;3r3(a(MbuPOD8U*oD=AUqz&dhXiEDg> zPhW0eeMPe1QwRWRJkK>X_j26m_wQ)1Zqq-IfwKYv0(trQn??_nQn9=~*!Y4I>g_ed zJp)&n2@yvdV64mFJ^g2CnEQKrR#w!Fjg9!!)ZL!!%*@EKF^%n=9j|q;$Zu8%qQ9H@ z)Y8)TYZY81k{$dVf*r!ngH~AcVTXU3CZLo{j_1tor9yzld_41{N!>8rqb5cC5?%VZR_iMb>4H0d=jpvH!zDlH5iD@U6E`2Jn%_3 zOhPI1l=UJ6;#?o73xY|KNs)mbFD)6kH^GmP=Q@0tbpYTgVoid(KU`C>fz-gOg*NBP zrRr+-gpb;Bv9Y2cO$`kY*5#FMMO@^O)t{fyJ3o~}|Mw*KxpR^>fy>|j9uHDJx9Qxa zAp`otSwz&`?$%L6!uo+08rrYh27T}ExdxqE&^oUWr?fbWpyo4AD~Ig&%?1A@{>A%` z7Bn?c*(A^*3faek>CV7-uG7MGTr`c2|M%pSL_!lrbU+hKk}6STENM-*ECfQ0&Mh8` z6C$_4w1$?wmRN>m-&B$;oHrFKupF*LG3{)rMpIa^L5=m-`BvFQ?UUMp8k@S0c@Rey zHKG)0kWSXHU_n_Mug7p{i1a>}f$K6#^c(Ba&esQ}2$>ov>@Xp;P;uh=*G=4dGeN4F zN35S~u1@JbcQ;Yb+-n>Oef|}ksB+X<_Wb>K8}6*i{S>=*b-3nIruqI#)#vo>KX}y_yHgpbho2ej;BLR>2%4>7M>CFCMMkc1!Ipfl!bDDL#NRh-57t!lU$19s>F=Vl9x@<-*x3YdcMIf=T zsqxKd`7>h_c3zbv?WTB!s}f0~Nx|0P>>nn54@Oa8;H9<|>?mUi&rcg};g@n58ynLe z$~>eL!eKKrcKKLdacxX#(o{He-$m5K%F@5m!m6!!#yl-}E_Y&13E59mNvuqQ>2BQm z>PjAhTe;b|4yfR!vUCY81trU5bW|yJo%aNE!>0Mx>r{2kGBjX4@>yWv1Nl&-K z9FNV)$>nh;0&qq-eXn^W_W7)-EnXXk4ab=$5H>;n_<(P+zdg*ec!Kk9i~oFvtx?!i zgvDhD*G|b#_D;&5XOR5b1yF3??k7>>7Qu`kwF8@x4vJ75U zp;*72)g`oU`X+d_$)10X?K3lY)RunReqg~lFeGXPkJHQ zaLbzHEvr`sXoHFj>laFLF2kIwrluxfwkpXp>nwf5KMgnT*+ysND)6K*XG*`ahIvy| zWrYp_5(SL=cPU^+b9b+L#4cpz?;=%kK>K;2iAtT)Bnu%6B?}`92Rym?O(tF;=?osK zY#y9HERcBNst!7bEeHV`zl6$UL7sAn$`rTf*I#8dbWveN=UwhBicP*McD_}?NvCGT z5eWJ{OXw=O$oO97#Zqg}mP!kL+&-!itqL$X?=BfZNJ?vDC1IsuWw{*;=(0#Ud+NDa z0e9e~wVWa>EH9HQZZPF@>n)$NG5o4edRc}Tau^D1YJcs2Pm%ok1HcK7O>A00eEz&y z$+3RTjX{LxmA{l6c`d~ig&h-hlZ?>y( zp|iP~)w?`aTo=sylS3wv17K4<0uD|`@*SQCstRqto^qt8ibCLlZxX-xX%mYb(iJEb@sdkwVq^^^MC)D+61giyo0cV z7(=`hTc(n9FULl|L%5Tz2s;10S<3CInnCiD%|nMEtt%iL_D_QemFNbQZ95JkE_4Wl zr0_Dwik{UFSzfF9rJ8kwUR>wY4>eiN+>iIE3HIV65z{#6da9`51Ul;`Rm9&!xP^pJ z&1SB{WEl05lq{RzQiRK99GoC$wc{3b)cGVKSeMAn=*T@ zPZPRH3))?4iSrKB2D8Dw0L?&JG?O9{vzv${GyIMg_&n!BR%~8XT$s&xsa?UlaIM(@ z?Prjv>O~96_04RhJanj%X%oqDJLD9Eu>J2}yuYCf1^a z*&g~^cB_QhRTl!Y&TE{c1^uq4i`}DUXA6?JY)0z@1@$bEOnR<0d?%{8P4yv9Dg`Iw!Of~AwhQ@p#;Yw>(ElIdV#<*!r$T8ee@){*}Y D1S8+n diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-03-add-certificate-templates-snap-in.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-03-add-certificate-templates-snap-in.png deleted file mode 100644 index e5c40ce136ec0772734b32ddc455fdc0f7d326fb..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 69792 zcmYhi1yCGM&_0}m2!!ASmtcpxdx9Js?k>UI-GjRyZo!?y;n3g?!QCx5hadXq_rC8} z^=;Mc)^6?2^!D`h^fU8xxPqJn%4dSlZ{EB?0ZED}y?OIC{k2ddetdlrrxZN+dU@-l zBq8#qYMkic_2#|V57{4Y-qge*KN@^^y+^W_)O33D2DRtE@^-+k#Q4pdmqL)(4;6R4 zUTnb~zzn^^c-;dY;;$Vma33spix#3oC|K6gDtVo<5DZcZ50Ous1(H&skAf*&Z-Et15W)R}@Wf z4YRE(Ki1_o1!K~p*C~M>+wXB!9b?pj(kbDm9(D3G;_kIbMMXth!0xWe|L+U^`Aur1 ze=b|RfXw-!J(WD(6V*kKBQJ<$fT0*uFfDCchQ!R*!UEK@wY4?h-Q6AVzXGna%1t-v z2OF*WB!tNw-cL*JyCCm>m?Y9>OH53pq^3?xO9OcV0r>d%|MNedkE3x+3If0HzQekY zb}so~-d{J{L^y^MKyq^AlpLAW^_DvMmoV>4H#z~5{q5)G?`Z$Y7<-1m8oW-glaGuf z4I$IG`$kI}4u$ffTwY#6G=KvIm#RUR>I2E6u%lWTgPOP*x`>aiLq|HkAK=t+^H34F z{q+Bn_EXDTCu?m(Cm}fM`yvlE3b7JTwfrI;`16HlDIi3OI%MW=V`H2l*l@7J)`Xb){Q{6|72|pv_dL~$fYo@eYCH$)Ptz2yO z7NLIcB4NL`=g_b7Oq^P9mGG|K2XU?lG;HRm*jRQ}*4%brMtb^G*goX}5mrpCyI5D-hF++P0xr9;Vyzn`!Xp(ioDedIJ1HG@i4@(U|C?Jb0-(@rD5`PNB zrd`mL!*kp4x9!_4Q=F2pwC(N3MH}P-DT3k<9}0~))D|Fcn}b#a^&lZIPmZNZBEVutvBd5|O^4)n17DmI7#CtaSojRGW zL9X2A347!cK)#i@q*-u62j>d85=;0IImGF}L?_Q$wRi~gLefg*mN{;*k&@U{T)F$e zrrcO%#^JP1_+RC9WH;T57J~rjN z7>TojV(LYz$7inB)~#4omaPoL%u(4o-0(>9vc8##l9JI0g3jNVoWINM6A?% zKIwr}W6w~E(Yxk@)2%$fS|cy_b}z&)+b`$qMn{CAuyd!%mrR^zJnHbG;^NS?HNE@$ zd%d`Eiy)_|7G6MxdKeIzd+3PJM zYxLNO5~9v;iQJg6j1nM+o|mKroSKA-f=iViE7{)*j8jzDr;Cu~7nC_9&;gNrwB&Uf z2y$)W5|X;pw7C%>IRm}tsAp-yl!adUQ<>doAYP<~@}0&pbbbEr?Ev6A#}FEl1xf~} z21T%r;@zSlk|4eH)(>k=3*zMhmDr1BZ=e@S{2C8XMZ6Pz4ZzAfD=>;j4)M~Z$c?%o z&MuO;Y)U!9)Tj|NG(ccAL7<$CfmM`Ytp@?73Rg5mVk{b-+%Dpjk>J|9xjEZs)_Y~$#g^hZjx#9??w=Y!YtqTkCpO!&F(#ozB5@@#hew7rx5#k(WGS`JfILgG_a zR+h7iOZ&I1=V#w&`xyQ5Qgut}$_%4gczNPn)P=|Yj3?gScY_whTUEKpO}fXtW*Fjf z>p~X0vO3(X`#su?kN4}oK{e`(_zlr3%_e`$+(z&8*LWuy&gFRia+ny|On_yW$$E(En4=1oBtAO&77 zj=ibvC*vcJo3JLqyyFOrwUyKps{3;fLeVr_HLkb2VBk*E*Kdn4>qjgURhZ%Js=R#Z z?R*&x6ZSD2-y0Tw~c@CS>VWTF3_H6$J5CY}%EAMaOCg!r5?*pr_r8*P!&P8B(- zg*34OZT+!qGufa;JD{QhH-G9xGBsG_lG#fh5AVnIiA~ zP=_yM%QALSI=$4rOl~%zM>8o10vRXNViBt-sT#J&onnr;mVP5eZ<`i0z&zz_?|eP4zpy8{hA zuuhoB;ZBo0*rxIB$QT>BThSAyxD`V!W# zZj=oL4kx~OKDfmN5%czr{z+`j=GAF22$Vj2@3K9j!(PABqAieuViR7H+Be*VZ?x_% z#LlwyW0P)zE$7?~=ugQ3i6_fahDL^n_g;ps>+Z0J)0f*sjNtl??1tG66C4FqGofqL zjZRPfcqH$E>pzcCYe>vH?s1d;Oknwb@`r{Lf35e?0;@_7t=V$V-%Jj-pJ{w0!nXVB z_(PQ^SZRuXv;pnd;R2`jsgSB>b=f$a^YUq2;sDmZ$%%QVrQnogXd!{?e9>Hzv2$-R z77$K*N=DZiXx4yr;RU<$`ta(Sa&!Ir`+?~h8Jyh~R#wv$MB+TdExf*2t^|wbVoq&s zQ5SCiGfWuwXpeQfx~~Xc);qmoV<9WM`Y)}1J+r^xjaH5uBniqry%TVZ>3{acS@NFslbpmSSP==ZFQO~j33qZmgCYf+GbJPqz zcCJdz*i6wKd+=lHZM8<|eAvHJ?|h7#u+ut+ZYq;smfiii|C~MhP*BwO)A!}AX8wdj zgJkcVP=fv%jI7Nf_OR54WI^0vtmY%BFf$YHd;6}zoWUrL=S|WVPQPZ$9_o~=nwUe% zb|1xy-+T7SGz1}2YqaCu_pC)^i>cZ=eU(3xw}3-U^TYz#Y7V=3_#c^KJ@)0fG~TB; z?pIL99yOJcYWDo0zz!_o3)rF*ewIi2s>J5%fRR_)cTq-oyZw>oUrz5{6h9eUIcOjl z_JFKj6Ja%_7n=FZaCN7+jZJ>nq5zq|W?M?;7|7UOUpI~^YH3MdTGBc^I?^Z0G(z5Y zf8OJ$_4vUtaFp`j#BhdrP-#_w^Y!vb*e60_=p9@zqgNn&DKpW6pXW_(Y+ z^O>`0mCk*`qC2!G7BNbCOa0|s$P7W77Bf%D2@ubA@3$Yt$|O(6;#RZmH2>b4M9luw zkP`oCK&K?WzfUG0RXI@KOge%57iiDWUQiN@fai;3rl7j9C)io86lFf@qHeyud- zY5dS#QGEm_MOL#(_)I!UTORwl3`5uXuy{q_G}P9Wfv@W0DtnO6-&7`Jo(wP*m|>q9SLA_ z3W^HRi$Xc!aU1w3dQ16uLCtY%oHcSzq(|bP$yvSYRL+u@t|mEHfmNu-JQw7Mr*IIS z2QlxX00iC@ab9SJI3P+=Rhg1NHWWZ3F(Y%&z2NKZ>^K>*lh378E&?(PEs1(Og;>foN5o}5O+Z93=YGgtrV=|3X4X-g-$(>< zg2XKt)lpsppjqkkUVt8akN1tHHm>?nv398#2?_Fzyga!apk(Ieb3Q>3AAh(N`EYfI zw24jbKFtH-5EmB*gTV@FYB!%ZiL|+?hk(3DCA@^ZHo?eM5h4IgRF@5wo~xZL90*jTOq+i|s(BBE>4kRhI0 zYdHI?rcgC~P&tB4vM+j3wI%gNmrEBh3r zGg=(94dM*iraVgC!;{O||z6c!e$sHiBYs$RcF zC0bkqPF%xJn(ZRfVZe4S<+-T)0A+a&&wnr<) zQ&N(+oE$0~4#&p9u{6%tD{hzLvK-%A__1;KHT~6e|87_QY142Xxrcrg>>zrLM>G0C zc_3-&X`K1d@$tEe*LX)UIodN?OKH3poVa@#T>r##CtM%(=loq~I39?m$r>FTo z4vTmI{=>7c;vk6lFgyzWh>y~$ByV*hZZdz3c6=<9l$Bo?7CAUMEg*lvs!qpv=K&1W|5c}V@MNUu{W}Z*001cnO%_Xt zxxX%!RAwgy{<;7vS55qd~3}hZ&FV-mk`mYOLmjtf< zo~w#sk&wu#sDOc7Fc^#y07ytk$kXJ6LZOh+S(@^_0_8vSV)@BV|4qpMwJ?FDFV2yh zn=2+JhE7Z@tD}?2rJrAses$$+Qw8+V&)3T##u^)%H}lM!{GSFyd(<&x?d@3%3=Ej{ za%s!=7FahH$`m0JGZO#F0y<-lHV0ePN$q4{j+JF<>npEWmh;tmp4_{|nk1{wEv&8@ z=uYVgaYot39-fgimzP^HAMQ!#Hqz;???7i}*KUe#9%k&dItsG68W&c1QEyjwuknU+ zjeMLUiH9Qje0N*!89fBSZKr3}KH_?vh^n}sm-+dvZ7V=4#i0*O)h&%xh4}!0iwSy# z&7jkIa!UeNb=!UW&bI6i!Anm3g)G;TBatL8C$G?xvFm(3KEV}wh0OvIw1OHT;f2}5 ziy3=AoR-G6#u{21ct!)o2gWn)WotVhk2UqqiWthaLpy!yRpw~XY6g>q#guIOW@ZDh z9^5b$g3L%Pi#|$w5=Iq;}g>+e(zW~8R=FXbsu#P+gWg2B1cwa zhV6^oUwjsHOs*YQsx6RW~}ZM?a9AoF6@@RWIEL%P&>1ccy2!8Kp!9 zm4b!ixmC@yd}n;9V`H~?Jml1?^1Uqv=(1gg&ORfv8-XM6_2zl|8_|o%_xr+`*lI^K zifJWP5zXyiG$$x0*|@tr z7?95oTWta_C&2~*XBnG#se@M$7d*2KHZBw86WcVx)Z4QcRGo#4%pmRTV>|Nl-!Tou z2MAhPkVXk&y|GBoe*Wd7desyKrTKw52SPy%wdig;o6d$%K0sKO{UcbPS-{?TFYqs~Lc(7honT?_q>NUjJu!g_4Qy#3FvWCmpiNjr>$`OKK`n~RaE&Qz z`lcT1SL$f;cU^Q5(z262FI)?7XVhJikBm5=kRpYOPi=j9X6p z7^xG;38oqfeN^o&;d^QGk zY=b~vpea?C@&*W86EMRYuD)yLqB_qy|B6RIYt%)ii;Fs#RN&aGLPl1P6HK{7dxOBj zXTzwm_Jb^494Bl4P`Ma^auQQB(L!P7gUH$>jH=qbx#az{G(US&U7pme{jmV^34G|BH$oLb#)wt;Hsa-}=LRj#jz=30=IcO)bzYj!KCwv4Nh zrMSUGwfInIHoKUbS`*A>OHAAQ)na+VZ7=NNdI$95lh-G0t<(>tv5feeM@u6COlZ;< zqlJDYu3oi%6(w9WCq8aQAvDa?-rMDcD7MnRjT*_%EJCb>vt4cVlfhJ9&v446r{)W? zNF^gn5HC0ORHXy9l<+eXT{{Jeb*HiaIV{ey#|tozj!Qmhr0}I0NF6GdZ*wXR*PRI1 z`-lN8In>4#WkBoNiCnFWK1OO6Jk&m-4a$WY+b&dHF-{vh>}#7r8Ew@0^>#T!myEdhD{(U6S;!vFF0b@r zgAicCM0EJ(f;X&6M|W!JI^wDnrL>qaye_{gGh)wR=%sAONb6AUzB@#~k2W$w)axeT zdQ5lED-!CuN8~y_-t5uGR@2cFF>{tV6MIvUoRXUL+D|SMx6u&t^k2Vz;i`>UKqkPq zi$|9n1MAa|ePa1C=k2qKd4kbU@3~(EWh4a32zSTR$QmBO38~=kY9_)ImGJk#{W>T! z;LscQ8K((q@Kegyg6dhWU#HCgWatV&4f(jz;f;Yc;f~XYwvbJ_8Go&7yTY{vGDQu4 zi`MLP%jb^~>u`w*;1)z_UFL?m&c~-`+inStHe1@qE-ZZWy_|pX_j;zaCOT$QN$9SW zR%dmwADEuT?;%X#af1WIZH#t=T(`%QM&47KVf-^68r@te(DivNm=hKgqcp=8-0 zYup21o__8}Bd2jE=-G{IVsSz?k^&z+YmvJ7!QI*}(=fW;-a;>iJVpgYh9tvx4$bBz zX{-(1>~g~U%^s)qUl8_fS9a>;nT+h8Fk{|g^a6~}ui{Blm{z-|C=x8lB37e$l@Ly# z&LeUEdf$69MDg6hZMH6)kgA*hY#gfEYIrH8W;4NCVsfR?3q4|?PeYovse<3g4p`Ad z69y4)llWRAq$L57m}k#7cxq=a>H3`y`1|8IJ-u@hqbpx3AUa!hBXh=J({1~w&+{Kl zffoW5g7_K>JMc?J!%U{j+s=C|bte7&bb(@Ib-Q@gI9jRXu1; zmWz}f^l{tTZY=r;2kaVC=T|+UpiFlwBpe%Dkb@16LoTa)5R>xFZ@wN1UE$)|UOPEb zdUhw#NOO2N5il=QhQ{QlouhfR_&+pEj_v8ge&6D;oGl$khDwwkd z22bCXI^^m+NX8J8O6|uE{9EFz(z}a_tH5l7`1A^QTq4a^w9_)n^(igA6gs6;x1EU^ zJATceM-clU*ge@#B+9NXH6jh;VBb0XDymfWQ4A(*R>hyP{yesR3BM-vX0m~wUXN&e z5Xx_$#JxP?hB{0Hw{%gVqBfSwBJMo~Yim3Jm9n2?vSEy)#6Io?!2TNi-Ul8d`-jh6 z2QKx=LVNd%M*@h6T?@OncLVZgarcyO%QLuHyeNpE;JJE^-WyAHqd2>#xKG;f$RE><3%U;LTp9MlhN0OQs3x@ zX(iX&dD_^E-OG`W&F&uC$3LSt8|Zb|T=T8$!+xr>GwE`X=>d=B+)$cbt}&ae1Msw$ zH=$o}2qLFou&b__b5!mfd;#}N(P2?_rgfG-)PRhJcH-6FrcSX3H`Yu!?BCQXenmZ6 zLb+oyNV9g+4-jgR6QJ}HTZ$q=^sUQFf{=eJXK!E8#q;xXx+)eX=0$|^uL~jm>|#aR z@xH#kb+XAp8fU9BUR~a|I!*4B3_=03x>g_e_S~&qV%@}H0M%%=wM@DQvUt&K<%?dz zlnrafHTW8xK*bpE3#>J>-36Du*gn~mkA>4E*T^;WB+YbmLZ^pYAPZdm@OX+#`qR`Q zw0tUz$h)o3C}%f{BkBkjV!xk_bQ`F=km!E9pYCA)_BG8Yx~gb}vSJ zODd+Qh#pz$gDtIWqk%_gczhh3m`e))=o#;U*;?yH%(G~Wm*31#D@R+rU2r$65l{*D z2g5US1p~1XgFM#+wegczTe|n z(99QlKvHA-eHSXMw`t)hK+-iyDgH^?n-feGWZ-y9(D`uuc`oJ_N^$ayRZt#yatn2M z_7UnZ2s(M9QR6CxH9N*jKUcb#6Bepj$L&?Vl--`$SEiF9v3%K z2bck&b|w-rbdgagwlPNzXs{E3eiby7g0FW!9|c#DoivSq*U zF=aw;dv2BAeL$s#Ln%1W>x-2L2L-=?(!v0lTt0bJV+yv&hPtzsH^ZoVRJ z&731LYJU7r_=5WJiu0ArbH=J1f0xxl$`i5rKXTik=-YvKa8f5O12P(tzhy+Lb zlv*vsjn(R$8*QS^8;i87J1qSD;&5+#p~n@@Kh3=5u@fj*4Qs?7c+Q7DxgF>V|IBSd zM8=}0Tk@p!JPZtn3V#?)%2*N==9sZQ#csZ^sVseG;xt?t0 zR#D?r-8J|pXh#HJwf?rYK+?f4m>R7;OiHF_dN%YX?dxaqtU{8UFx6e!;c;}gnxLs1 zDGI64KQCPf7wObHL&ORhcmdJZKAC5&iR*knL~o3uzC_nxmX~NC?u--T=cZs^45|S) z*$z7$wyUDzq)Tk9&1_vVR^h0py3Hc>Q9HJ}%`#Hkc;aZ$yjB=eenz=bduMUkWY<0i z8sI;tH^~|zkzy^{8(3-5er~*tZl^GrrIywMK_&v8xXi@J95-~h zxTeM`d;j15jF34xfl3u0Jj`>Rl!3M6h0ubyf7>xlQA;OhD}R{zVv}QVy1hxz(~Fiy zVl<|YD1}%C2FU^>NeK@~=W9>~f4VuLb9?d2?7;hrus3XdwSha=7v8RtILLRtf7m^} z2%GH;#jd7x9t#EaT1WsVpkzJ)%)(OXLe2RD6z_S zqNLo$*xEJxGp-rU87Ge62I+|>=__u7$Ez~xWAN^IMubjCzEUctd zfM0vCC@7_gS8vh!R=2op(Go3e4+_3tSR4_Fs%3t{9ebxKEMVN$nGH6pS$Vqq!fmTN zs|QJz_QK1_AX}Zsm$q1zUJe~a1ON1%PUsH6K3#*#|1hYH15!$haI{+0sU+=VY@Pmr z3qOZPs{I&+Ou#5N{J$tc419$H2A)ybs@tRcp3s*vE~%K1rTB_8^wY=~S3;3fPPd*4 zLZZ{O7{-V}^rHg<|LB^=d}!q+Fpt`jvI0f>38q<`qUJvK4Jxp8PriQ%a~9FH?t919 zMc*P>b<*y>dgHTQ9@alUukPi8gN=P%tc;DMoP3XH#V2}P(rf`~>f#Dj zk|i4a19((8XKf9~_v)wwYhnTO1JYa$A#^Nu3>zX1_(3q6I6 zG!<@(@7I3wP<0|nd}0*vx{u=E+=Oz8S||#ESjkeg7txb6OULYvtr-Pd_2@(TyYbm84v=+J9EA2<$J+zVGP?J#zgMzY}nB|rc1EaM&SZ5UM%wyKmy5J$4 z3(fbBI5aJr>SpC?_`}H%yx1V?+NfTd@?c4zO*2YgU}qXV2G@I65J;#cSWwdnA^@St zUVl}YZBkHDkPMBAYARq#mf-jJ=ZNc-!{a%C`!A7?0b-NO)1`l5`a@Bj+e6V;V{su) zd0tlDgRQ@RPs3A;g{P^g-47y()GhLnOm1!RN`{eLC5Zwd5mv?#tN|1L*j%ijTxc6h-qbSWfG+! zPgd5-cK*+rjJr6%M3M4C8dOVjMqqXG9*+qSLdh-fRLv(Amk-rYSi2fyRKVUH62!uK z*Nr79HInb-o{X})Q48(q{?3WYmRfs>QryUZtL!lso4u#3uP>W5W8q+cf1;bUBNVw& zC;Swy4eS>)o?+*nii+$LtdUwNunobt8}8rr|J3J^wt$~zu=^ZW5T#?O71{tN;hbk# z)9mt*E)_Pj+bZxgPU5KR;QJ9H@G`z6Vl5NBlP+!X zGZa{hHC!P13O8gk{cMxn>A!P7PL1?s#uyRhz6Mx~;Fizf#g=>tS+aCU=~D6i zA!J(w&{%*^t*wd|gffP(p@$Du7+JZc9CS!!Mll-yMITxC_e;R*ldc!dk!go|)#9?G z9?s(8;%_cS8Oi>*y9+s-Vm{DFm7(TR&*=?Yu!FybB&m0L62*x;!`AMHGHEGVdfGqB zT_RUtVTX8s@4Io*LiwRzwI#u0tHcN8gwC@mupJO)a6@~=I9gmrifB|ExZx@|Vb1q( zT1k@8e0nd{G*nA+jKNHC3}$W1zOEmg{{^$bcUe!OBOOc4NeXhXbcXzjxrBs-Uc;RE zeT$h}4oj2$#B8(SK264Ik4MI_CUOGKnzBKltW@~}cca^G%s$bvjTKg2sNquCJiZsd zL{%eO*&2VG6C37YlGJ<^DM@u_6a8l|(F`$u0R?L&194V5#anu+_ByxU#AhQu{373m z1(hn?QFnbgJ>0x?Wq0h(h^0teV*sIUJ8i?$*?TyZfFRCW{ct1wU2&>fPPxa#FGaoS z==@q<++`Q#!$o=-=2c*NzLX_hc;(iz-=<}29<3p#2V`n0Nk2>qYL{&CwYH{eqBP;HzoqfIm9@C6x@J{=TxOO# z>y=$~m z<;t;=M#$9MRw56V3)6yfTy7^~U8y$A_TWVa88ISmESIp^)}EFH(6a>L2!rX6c=)3!g-Tw96B; zx3sF<%r8^j#HX}gRa^N<{`wOY9iuAg0MnEf>D+w;SmG$Ltg}Q2;6i<1^(1O+QXjrh zpfpCn%i{ncz@rh&U1?B#n9k&^cMPwjJy9YwE*J6xuj>vy)F?*`Z%6vl+rW5MaGg(X zgPIb}JFr_&Aq4C5X@8ZXzjL;f){uqtn-&;B>Ntc!b}uZ_2~B4atEzm%89*oD-UoXeUXuNd@lxTCXO812Qs9wIysamxz^|DKk69K zO-;9@Vot|f6>5kI$krr&()mJ5k8)vqeG>BI{OPkb%)>yEkS|@g>LH*B1``KqphWkn z)QqIFgy#Fh(DW;Cy^Gr!`+{0vN+j~6hu~7$ZnigTN?@8W!8qyZ8Bz3bN`qoT0s{WQ z$;lCrc4D`Mz~gXBIp1kjQs#jwUn*&REZRiNs$9%q!eT$E1Y<8bsy^wsoh@DAvuO0= zY?#h4t>3JqV)*^S$&Mtf4^jM3l)F2{y|ALC%!6suxPXd6<77VE@gKvtp&WvC(&)ze z$ri3D!DJN2$5p87NZ6ldLoSyO*oyhgCZJM`rrNfdFn#WORVjUBGPut4l+wEHV3-mx zyp`?UddmK!Zt|}{{UV&06W(DdI=n1>;d{ZL{7PIOdOF+*&UuF<{oU*;FITUnL3jNv z^?VoAbzPT2FjvgrHNq;pI}?Q!Qho(GRheyU&hpI`OJCu2#qqyGu_XQ3eMN;ay4A(` zCms^xrK|Lg=EIZx95p?n*aKCxP6%*To#6V{X_F<7iy@|LlUw7aE{%ZDKi%|(U3DUif=WIcn?;!SyR9ccZ*TvuFUMAKer|mF zyB&#m@$}^CP$IhUv9fAJsv2_v^ok&0S#I9l% zw7s(-VsQEEM#|ElIa)#Z+B#=yZd&w_!p|__693qy_e|_T0a9)HkbwxkkSNBUTAPzG z{)1qBY+ZVso>wOzj;ybsDH_y-++>Tl38#q(SP>Hln8GusPi#CC2fC1!E9(X|FWH|4 zqQO9AxKlH)#13JbN8UWeY%^-z%-PTXEx}sir`w5hNGYOnxn6Xwzr@Q6!#PP;Z}K=! zSW|@IL|*H7eA?119Mu3avV;jg*r##tn@?*mI|Td8dH`~!;D;L=4T6lzuCpril!UO1 z3_)%P!OwkIDs_jPPP288)gMuY@vQy)385X~$JJ2dhKb={uBZdI>)Qb}!uUwO-uH{D zN=k`PpMj9tJ<~QB2rTyHPTN*%!O(sry!(--DwCC}vn-+Hr`@OwBh&$o*~IW98GW-C z6V1-;cPj*7ilwQjFwza_(6UN!P^0X8Jrd6?GKin7LHp zahbXhQU`G1R7nX)f+9e_qC}y%VQrZY^1ocg>NM7G_7}Dq7YKeG=}l;14fis6gJxxv zH(gdj8?n14ORtn*RKvoxJsgbe9*X3@lnSF^MKL35`t`={RCD2{jir>1W5`ZloD=sb zsEo+?H&+t>d=+fbL$qv3+rHD$A591z*ZHt4oS?u?F8c75T-PTI#d$v_oVH8kZ&gTB zv+qRk$_|a~DrfiTBq6SuRU4^bekm7LAhJ3~if&!2TQ~$iWvUY0+Br+O{o(D)d5)jF zz0}*>xmzB;C#JMQ*@B=J!+k8NxLv`ur|E~s8+E^pi-sc|R!6D_3q&`YtmcQ)fu-9| zAXZ-up4EZ=-lzej341o~?YV}LRA>+e;YL(VQ2X7;t;0oRQC?w|OAQZqF(2hb%I@N` zTy_?fI#asR{9@44;>6v#@xxD4NI9jW|iZF#0)L zKf5zJsr~~b&P<@5b?=dpe#OU|^=`vxJku+7-N#-Oaq3IXpZ6jwCouU6)m8s7&I5Yt zdw&woNAUR^#@Nj%m+bDfw|jp;W&&Fo!Na2Fzs;V`XEUAK@_=Zj%wv&KCa-S%gL-_b zBo1(q)oJy%AxdHJ{T7uJKQrfBZVHMo;^BJS)ntXfA$@ya#@pRK5OPZ}W%9}^c*jHy zj^Jl&nmV~8m*oj`uL#z(xga3S^W0=JV{Gn5z;xLK9*vNk+XeoZO=o9BeFqh;7!j9!iTT;FHD0($1u3Ex|c z3FDbl%YCtdV?Ga|o5zD#b)=y~!$$Tj{>HA7fvHrCs7e}ks%!ZtmL_B}z@Hd-CcS}i z;iUc0X@P2&e8=yHc4Z{WMiPLVpY7a)qL=75w?z&De*W@j%~OK;$%BYwe5`@L{~$`y zN!zn>ZLH{`sb!xfU>)@IA@@_NM^9=$2hq>lZr@4zQj>0fO_Brsz(+`QDrpjL z7k}1)9(`B&$r5v;_FfFQ{Z;GDG6GLVhO}N^ItL3yr?l+n*lqKpv7LT8hYph7uh)S) zt2Y;B3!elE>r2G4H&Ia(iypaO_K5FsvX${kWmGKjyKcByz0gHfO*q3hI|STy#-1I^ zX>7P_KSv-sISf3;U;r+NzQ~YNH@E+&@6%o5H5t74NyESMb23Q1#WoxsQniizoZf6t2=xmxB$Y*c?tUUcPhRc0 zu;*0+;Ao__o^w$7XQWIx4D}|3)W|L+lE7f0O*O97JI7}8?&->MqN-#!rZ+RFRSKB< zf%A!mz}^Ic?9BN+8@Zbg|15-oZIpLPe2G{i!#g zIW&!?wB%SI`{R9FdTMBAB|X(@kC@i_A1z=w+DV1U%$bfduPWv z?_>43Vs}gu(687}{XkPZd~HK3vw_ev-@$h6d57q6Q`HPqo&p9ct--#epl+tU&@ve8 zdSF?+B1bwUY^a=Ua{i;&3xn(Jt%mlxflqw|y_wzL+GYu>GUk2Zwm&FVq?UA_Svx)B zrQaz}m{}7MRkN-aYN~v^m8qX+2ZV&+NyA5vbzsq>hCV*vZ#h2+LUDK&mcI#i$Fqxs zy`5BiAIa(P{3tGvZ-|Hzo@e47k^tsWsznYD_Y~3ec-v(lFNy3I7M@1i`S6d8><7k5 zt3#6Xyf~D<86?1KO>C=3Lhs_b`bFaQ+tL6I2U^`hqs*u*Dcj%Kpz=^=Xy4*{AZ|^~ zjOZT(H=TD|w8K$5dyB{#i>W_1iN&K96#wX~qn6Ss$-A!WPaLFV$-XR7I#>&?*iQ$?)is3MZR+P zSQn|`@&1Abkba#0BZT1c{08mM>RjegN)?9w-|^i0pByl<~8z~<^)N6N@I>F^K3Edhu6%?N0nDk z7=5v%rGA9ZIR1Bie&qb_HNaxGwmz$_Wf`cr(9lvkQXi{n5t#TDgin+;gM+1VOOKYa z+vgGT@PMD8`BRqx@!HGS{8uha6O3G?g(Y1n&%w4JfA$CQ($c@JffJ{wA0H3T*uX@0 zYfg5p+1uv;O@zUx_wdm&w5go<7g-xwa)89fVH<0!>r6hH3|IY5wJC;BStmDck zted|XQ`xGnO=^n^yuXXTy-V3Bt~jQV2zBWX`ILq|Vrgd=c>p8(xFf{5ShY1b=;j;J zv8HDu*f69>JF);)n=9P*F00>#q;D(Pridc=M9Gx6EGEC^{~3FzR$>$b8dUXM5|>A$ zTRJl`_&N6IO#DJ7WZUrdR!!wDSOkPB1!JjbGcJBFE5V5p_>M>od5v{`n6(OBW8hv~Kc>)mRh=n2?#S9qh}Cs3iWq(NTtS zLMs{hsM_i_z%{R!-Ps#uCuFV1;Tn-bVQ$|3KO1p3uo6eoRqRL$bNla05n9S8B{B8& z$!Q7RC1!btDuwMejTIi@(K6$Q!)3d=m8Gt=J|(qf7j`U6Cz45iK*s8_i{D#G&MEtV ze<_dju`Nl#nx%fT&o~Y4$y7oOuFF6Dn4fyEDn_8Jv}dW7J!RQAxDBpF^og%_aP>;u z-QL|T^r?qGVU9WU2Ypi^vizX7`&?&lXbXL%kYzVrD zFS~fuUB${RSXBA3vX6{s9MV#Sv#kQ>gVXJrtWh#ES9R)CD@Z@kRP5<_Vy`<8m)dJ- z)*mq+egDCz!ZWuHl(orw<{2;k?3bCWrpA~vusfgh#3R4du>Bwh2JOOv zBQL|<<=66KRNIzBlIWs_rxo#%#*eNmPN$O&N=BJ|kERrmZAk`T<4UbPhi zHhabkiMu@GFN!33R*->#mMi@|P{ZuDyGr^}1Fpltf1GGL#>uwISDdMgQ>^pg_z%1( zy<6eE?_vz^s}}wO=C8T`CQ}*nblCL$e^QaxQU5>g@^-Yye?{W|HA)|3eNrc zHC^m~DeFKO);EGI^{J6?S6VRFr0=m{LF+SH+w1GPcOyhHF|fWH$ZM`P;hI#Q;%$jI zE9bnd8%A{4Sn;=ENHrP9`QfPi$E3w=sknrj8<+eE^015E33cZkqu__x z?n+CzC+GJEriTa;PnxzQvATvo!T%Xa#dK-(X-Y5-&k!yV!^_ds5e?Dt${U`{_ND;9BcbF5V4VbxS?s;^mbA z3^?&j^|tcqf(-@{gU^$C7#W20&Rnz8LM-`N>UlS33kyP8v>sNX%iOztdH_h0d~6OW zR}&Y$HN&5-@#Kdt`82Jm%IZqv0wEM?NU=51)0*&-^uBqng=r{%i6xQoi~WoF?y0Da zdRGyx3yMLtR~Gx=91 zgp{{IP-5hobV^fO3h2ujjPE$Mo>S!SVN=|>A%R9~aayQdrOttBuHV&)JJt#!>rKzuZzZQ5{Ygr&5Sv1gWsq_G$+qdG8)hP@YLHJ6Es;Vv^7i0)6JfViO~zu$WCLVt4v z#m32G?>I0R9gFuCSy^Wkv}AERoGKj+SpNUN+$AFdel&H#yui$YClydhVd zb4NcrU;C?@_O?fT3Fs>La;D~W`hfK$mr-|2+nc*X{K}j@C$gaV__Yr~j;+oBGy%Vy zw|{pz@yoQSL)R31Vl7I+M2k)YpXaB$`?YGnpxSyWR7y%dB;@TY285PhP@`YtHqU;Sq9 zmP>UtXU{Lq?ihOVjp7T6)JorqUH9N%E+;$RleZXAj^`|_B zB~_j{>unDvS_RK8sST4MNX#5lx$u@`tI5OaRE+-~``AmM1m$yY&VukaQ6To_rh0G?>aC`^+E87*T-uQ zwL<|)KG@o%!@4acj;=^5ppmXAWzIoGUa!pKLAKyVTtHcjet0NQnEZ+yYUQ05l9u0jQYot8o-O-)U50n~m7Bw9g`PeDT%zxjw}NlPPsnbKCH zppiVgYl+o~%=Y0qmLOwUlRVhda6gk)JTw({e)|3BbX&wpj5A-(a+TxC#K;Uc4wkJi1r||| zr5|%Lz)G>bq6nAo>YO@lfev+TVKLE7DChXbR%R2+$nH(HHd4Q3zrCXMdJ=Aq@h3gq zhxAQzwvU_*uqy=dv;1rd&FvI?SXSIc@j`2a40PxtO; z_5NqoE-U`0@k|3fdwp!%fn$R4?B2W8`EC`@Cy&hoYB>0E!RmJFeuF(eNhr-y-Ymc= zfkQ}CS?m0TjEVz4N_*fQ?o-lNk`Q-;Pv}N4caJw_vc@l6p=9tjD9D`o%U&U_E>D<3 zJk!rcxl6>)e+%je^)bm%P^zvjRlU8i-Ig=YyEgh$c@LP3Oe`X`Jy=%g*6y30HZ5!e zQ`(cVI0rQ7a}_36`*!zr`EpW6zDf_{*S7%}x$5Q!uQwQ$onVaJ~cGCA%io72V9E_g3&4uHvclNSGbZ;;9DcwY@60OETl$Cuko0pyLd=xog={u+ zap@7l+AarDng7Yg-#HY0WumQVphSQCP%30g0(_lDbjoiJo(e3rKQ}dXj&ilkFQ=24 zxuwD*$T6@plzQx{_y<6Q6q2Yky42IYm>PM6mvXm@()kbU&FNpm^{pA;Ey0`b^ty?3-IpE~9{FeGu0Yo-0-lz}O-mA!K?O-}}RkqeH z0}?mZCfVxs7elHdmD|14?n-V;to^O%94u!g4ABZ-CKck?xQl=0C4s%>aK3>H$Ip;d z-hQtGp&k4Tf@PB>9Zlud=Mr1~BfohhzM#qrh}^W#EF_R65bMV*KJBfTPY>~9CMCJJ z-Av7|J$=j%%U*vEV~jNH%=R8$uH}WDW$TsRbyNo<%`OW5J@vdc{!WlGSX=98xwxi< z*U8vYDBmFi6WN|#QU2Zem*4A89w?x*)z>pYQhxxYre#h~PhDJG4ll6|&(0QHUWff2 zU=3Rf69ZXT;tY}%6#w6SMlQH2p$y7%`rwZ>LRTgwD?OW>jV}bW5wRzL315=Z!+-0_ z)aZ6tpiqE|g+*>@bJBjQyp|TPrHxhEqeVfH8g$RLZ@T`m^apS8pY0i^@iOJf-|ZAq zva;m#^s+01dNjZIJHnHbzs0cQ6A*wnMFxF0E6MOVoQCMA&Fs(bKgza0ubLPc35&nw z%PJ`NBNnCOk}Q4`_Lf+TgM};i3L!UXqXIJ5A7$mgF!NFFHuK~H*VfijIxZL-u3qg4 z7SZR*J91j+85xyzl&aciR3?AZjPLH6$TgS#EP<2|>j%%=M1Hffw)Q6!&F`4lSYA#U zJF5YKuD50OMQ%DgWXAJL?jZieP`#TfZ~t?^+MRI-ZN8GcmS^MMd3Ww@hhF=eAVZs- zyj5JU2$uZWThGloPHXGaznh!-&bRrGG0V%E<8?=eC$H0AQJ1h;KP$aBu|uSIXWbe-24&iD|jYlNZnemYIj)il)I5Z&57l z6<-Qq;v8An4*)Fs2!%o$czEqZ?D?lHMy?)+clcv=%?@Tbz(d_z&buTq=~M!<;zH+j zCB?W5|_|iEO0SNq&`TF|)RJC7ycx()% z&@@HRDzDULq_~JXD0G5eI+IOGGUhuCS>jw4E{5`t^c;YpOm^>n4=(qSWx+uj8%rnU zO#{W0Ek#uuTZ(Zcn62ztZBQFv6?MpQdT-z#RosyKI`Mj3b(8ASF*{+U_M}%i=smid~TtStooP2VOi;HU{yq%$H%_Qwj zM5224WqM;)$XA4p%-A?OI?@i~g`JDJ>yHi~D}x_NaC~W~rq7XZ@q7LbW^`PPh4Vml z@eNOCsD$5F)~9KV@ebH9?k z7PgkgUY^PoIliQ+A0IQ1OKb_uE#0yfz^JJU{m*Gl3d$~mZq&WipoY}0!G3xL(Dv4A zx)^EJ*)3`jw&^E2!vT06%VS~#g%9@C4AXkq;Q_gvv)bM$ZeTXPW_q$i{vz>ET;iPB zq34E%^-q5CqRMMZQohPO<6jWjL4{LOnNq$ose}jdsaX9D8n&&-BA+yH4K_CeVlpuM zPetfuZ)c~L`Xm3&ZW+097FX{6k{RO$QKiJwa$+ zT7wM9+7#c4-^f*Egm^`2>7~H74`Gwr4rQbL1|@A}BHT1T=Ba1;TK$fu9iA%|9C@Mo zP?tmK@D{4D4tW3g^Z4=PIk1nTI$>#dtgTOw=~Kz))5)a8 z#qPLN3zf#K3foO673a{|x5CDSxR;yqbXyH2jY&_{o1 zGC3T)nBhUbp8ZBnv1xQXRB7GF(&362^_LGUHcVUSomuz9Vtnw69=s)O!G0r_<(#NJgjNb1uWL)7cLyUko3kA?I;!mwPBz)Aemh{1h z+uIYoin_B`R#NQFf10=tp@^KR{Ju1br>v~3R9LNM-fv)QD)!5QOJNqdl*wzP-FraP z{F|a`Vo+KVcM+ITh2t)f_%xz0gI_a+A+ylMio1i`2r*koOzS!O>N^RQ>9&b!9s`#1WEbIvhm?QeN9)$# zskb@x?vZ&Swq1Z;J(2G&MiezQrT_W!uClhYUq%(6bfx?~GZG?9 zYrS1s8kunLtvI(#iD=MDw7#z8m!}%pZT5qN`!Bx&x@<&SzMQJPM83sxw*Z^7s;}F7 zkx}&scDHE5UfA8XA~KJQ*~(ZhIcO8<2FA7{PySq^AFH3zSK!%TD{;szy}-j7ug?|0 z-N8#~(8ZmS67@211OxS8;_}s$E_5L$>D-y*eDf1AoWyiz(;#esC+KPpl&VFEl%@lP zNY4|dSj9zJBnJ`@`^|sgn#cc|mjO8GI)mb^zda*`noR`rIrVR5!YL{SthRX(ky+~# zBeXi7MRKGN8I{Iz7~LOv`*>aQxR0$;(~tM>Ur|ixvVAAbj}MbCN^kLSej6}dPdKGPw6T^_<@s&@X5DZ-oP}3%|yN3n<2)C50 zE#}=}Z%20;t#FCDYU6XOC}bi*kmEMRS~u7#jz>Z=uXp5|Yoi}fO`e&-gdqpfHl8Lt zV`Ju$vM|Aio9uCHGmj}X{#M>PO8)8I;SNeB1;~b z97FRXTG11En`9>SGmWh+gP`K#x!OVwv!7L>xBsPR`Dtfr{PYU+feq z+{vjDN_rUbVw&Vw&?fr8vPel9_jhc_*A-vD#*YuCeAxvFUvGjBze>nP>wb1{?OvKe zLQa!Z`$=`_?$o7Sh49qu^qPdMp_#e4j~^VA!A%LS;%enGWEi0ks1F}0Vq7T94zo(C z{dR0t)k$0qz~;k7UYhBOj{jv(O6cwbtaNC8`#j5AWTLikJ#~nUwtc0kw=yH}`b;yr zyPGV|-a3-UEyO-zdsiTqFS$P&Zf2$ek7yRV%Moi8w6{u)X4CGJ4rSW9O&MJUT~g67 zezGq1*k4djKVcZu$+nf-Kq;3&rmtp9+P%knn|#}7b&(rO+PwZ#Q@qTz@rttZlxtFC z{&n*#T-yWDSl832nJYd%E4(=4i+lCPK-VGT;#m_bi(upv=(_E?l=Mi|SEVq_&}v8Q zs-CNYX@i1U0PvXU#q;=RSyfg5ZjQEnW$nBU?7s}$vR0s z7G{2c6T{!4hOu0Pt0xt%$(Izw8_-=);-;q|gO9iHzCd4;TerloxA7PEvUN)JO^?GQ zmxw62V0-zeI{jwj*t@&mG(?5g4zZ{6miPd#x0h=Vx&xdQ7tT>z_C97e@K#E0Ah#Jf0Ni%zp3Y0RA`DLQMk@5%>Obw&si9wqaXuA zLU7Yj=W#z|p0H1&%fSJGg79}{z+yE!J#+-B@S-OAq`BzdGxa|tM^UJ_8G?(Y;=*Mv z$jE1sj_^wTYgY$XWG=DG*Vvd-w=%eCO}_6PVac7}GvD0U=EY-M*xMH6ea9r}e8+0- zr2#l2>+4M#w8TP*`8PAqE3B=Vi9+5MF3Di(=^XXosK^5%vN=DWRZkHSkDvx*67uo2 zm7e98dgsO&M3DU`RawC)>!eMYS~4lZ=Jac+o|vPS+hxyF49YGlDq^C@gz-DlzD60? z)e*S&%J^I?i`lJpl+*l9qQiOkccNLf&eA*0mRL4JSmk$*@XU6snQb))oiX?EdPQ2a z&&0qz2?6wy8Ts2-}>3p7sX4{CjZ_i6LEZ%Xe-^~oaAbpW&OjbzlP zXKG)5{~qb!jwx_|p&YHl2P2J86_$iVj^PrLSAe$UCbF8z7nI}h#ELTW*N5kYYD#8+_H-N6`v-0H z4vIROsMX%~6?ORpryfUR!B5Mi1XgTym2yYMEkyeBFVeU3c3IX0ka|^u7h8+7@naj} zoBZB(+f)icx^kzt+oDuX&{MHenN_a<#mdN<=Zz_hB?MVIZ~m9NS15+}$EQ}|m3+4Z zxlNvZ(3yQCPqBJJo_0~00YBhJ)_T=Xt1`OMlCQ_D=6}v6D9fw~j!p^wR#(Rvl2$U- z5@$kMKpx&aS|!-!!j*=LOLMaB8(%SvdmBLREPOnYGRhy@KZ-Ogs4MF!ig>HXG5QL< z{p#F*r=+SZu@S$k*b{?#C-XS3#U~Q<0{L$DtLNtKZdym1;^U-RgnM#FHgU6m{Hxwt zB*8}~-O4T&u7CYbzF2-H*mAJ8Hr^>$h0JQL#4D<*NEULOcxWM+pU(oE7(jtQm2eMf z7kQ3zuk^7MtMy~gXLklef`UXU-&}$c>+mds=~z{d zHCH%O?o#H+8gZ3O==pRz^xTmT+7c(AYaBk;T>6ZDin`uF!keN{h zp=9&8D|Y34iTS^JVP3w9YHHFES`SUfgUk~7-ma-h>dzzPZ0&9BPA4dT!^MxNZ(b6V zyvpQg(~O7^sq3b8$mhxsBQ30~to*V>otqj59z_XPMvdAlIO{-J!w^~OmqP!7&J(C2 zb$go>-l=V#t;7D|A^>wfqqU_)FB+;hcz@s2Q0NsYGxAR~KaKMTRfM>0{$DlF#L&>@ zbiPF2z<^bFM8rcq7wVI<5De9`PgI6Y@}h__{yKrrALEB|S1??yDa4ELV$Zew|JlohH`?AQwLdc6(e@~qxJx$n zTZtapMS*G!#!W;Lp2Xjgf90hKvKOwsU7Kyh5@RpRh3X;tO!KLmz(NPbRQT;}ES_ua z5BE0*W7A&VumbeMjk@3HWy9@V)Ktimr_gv#$2x-FH_`mtP)ob>t|v#7pJxJdDNoD` zM*Y8m??3LHfUA~*8rjGe#jY+QYBR(e{~&xnZo_P697FX#CYZ3#{^Aw^eS#J2Iw z%NNJ_n(Z68C^|rg)}>(gPjLsM$6$&g46zJqNAnabOjhSeptR9lVViK#uT&BJW{W9o z5q918bpJIwS*oPh_SIn_vZ~uJk@x{4MQ8kK;De{a&M;Hu-_kPnCTq9cZ7cwooR}9ONqwS5i(^hu*s>CzrZ2fk7c{?dKYXav2 z>5jlWBN|$IDhigQWh`zSsKRd;WJn8X$McY6{Qim-#&%NjS4dx5A%9%JTjxI*s;74M zdpMq?v6*Ig)OcFLaZY27!Hq;7$p9Rasa)lxZ~U0_%N$D|{I+;!W!PB-(>R#~8`>Hy zTtxG;cOVd2g1nr$D?WW3>6{nBOD_@+7;V>cuFnL^;Grum_#fYlSOy%`fU(spshGk9 z^O}!%_9ps4dSDdTH;G@TF3?Our5obGL_ZH{hel{Ie>be3<=MSzCbiG99~i}fg-aK>YdsD_q@~F zwo!f;w)4#L{oCaxruz+ASXm4`?8?D$xhaTMxD9B`wkRqxAHs;*)^vN%_?j4S?}K!e zRD$v>sQk3~_RG5OEvS}~F8h4K=<$J9r^7X96Av%#=UB$P zR#F&s1qaC*Kir`?EF_J3BhScdFl9vWJIyXS91-+p1!?Q{c8SZwz-n94ZIl)Pv)Siy zUCt>=rlf+pYkDFjfb4v>C3&zQ4SY#H1&GC>F&6(!;^zUZ$wEDSG?E|=HD4d(-9E&c z)xxo}n=V;VZ$)-sX73$hl+`8eTT0w*K{un^r;rGvmzAxrb?+MJ;d7QD&`M`Yf_~ ztTYz8k>PXvbD)aSXfaoM#Q@#k-(o-NgbGry6e1};P-wR=W%AU04+9wz`#9_~PL8;y zE{}{w+r>2Bm=>9HH75dj*TjnO_G626%w{FLQI8iW_s%zRm`Yu42RWB})W;C{M^U5}hc**!6b0|}XxKw`g_CUSKY*W2UPeoU1e(;w|TImDmW+wWy z%`@>nd6!RDfR(S^Q;lOpR2Bd1HRQzpX3K`K%d!d%X3ZEyV`xz~$AS=!XCBs!-?+*} zl%a*B6xQV#imkY9c^t#>iz-K~pP!uN+8g{LJJ`8~O=Y8F6}E9wgAD_*4$fbR2?pIA zqi7Cdqq9gLFM)!Qi71V4I42}sXO||ATLMq5VJ8(#(;JI}GyAz3d@@=(0IPYa1mJj@ z@li+w>Ek23h5%1vCurotK=31(GvxfhTjHs$M0D;Ps0vTMjy~L(SepADe$bq~+}qF$ zhFcPWbr%^~%Bh3SZf-917l2;Vru*QUd!v~*Zfj&^En;)^xa<1Ssm*tE+O*(k(=_yjTSXszN~rOuZml1?XVpra_$hb3iJ8ftfL!#2f(i+H#PqbQI5|2< zLLJIKHm*V&jIEtL8u+lHhMkX~t$7$bOa@bysiUFHP2Id9Zjv(1rD&~bZt$dzC$%At zc%%vz$w5EL?W+e-czXJMk8zSQUv8)T-&3XnzE?|2D>Buhw5k1<*4eNoo(!o)U3 zYz0cx^nQC=z7#q>|Nd>a*)Axar^w32Us#Em5}!P>lT1ihcdp!8pM!6*vNZsp4RMmUD$Sdnd8)e1r^E-vDpr|rT}8~l|K91 zJTf#BL`abSyHdu08G`o0Qj^Zcq4UcFh*9DR0WBJ17G4nktN zRvSCJ93J~iIT%>6`)pb`PZ|}i|C9Qq-|QGLxmOhrIdODoJ?o? z|F0OxGf!b``BSsfaPi9i`#_V}Sbg=D4P0S%@0BPO>@?=@EsizKkt3-B172dJRQzN# z9DvA3)|qUI#Kcr-GcSCY?cRl5b*R~ev{(rOo7Gz!8X1~}*F|b&mPtz{y!TQPM^qj) zdT28o-ItJKwoT>9w z-FuzH1_kr>kVY3nK{ww{FiCya;Vsz7UtTd8;h+l7&|!yfx_SIxVJZKT5BX@Qv)>?RXa(9nf%z-Shlo&n3rVvT}%Xe_gm?aOp-V6{An7OVt&irt^oVwd>6Fo5%S!e5s<%FI2a ztc`u!$k;PcWeEBTzh@ayu>Vbw@wENBVB8~^7~h)K^87Tvj4Q05;RALf+F=!aUS3B= zODGT23Tk<7L(ah%&~xR4bTxvjt1*u`9)$uFW@lhv;FAldQc8c2^5Vgq-Qkj7-_pN* z=6u$j@E6nS$7ER5(1pLV)9In04GU^lop~l|GBpu3x-wpWihIi_-@l89kj3CLmZ<<# zEPb;Yp}PdL?`Ibx5Y3L9-p88@1?++=!aZ3+8$p=e2@!q4Ax4G<@@}Tc6o`iD+W41T zjX@c?tYecKU6+Pje%R`;=uA~&N=Eej9vv zZ{@6aoI`%}Nm+suqi%F~qV#VwHF|y&XOqWpdKu|jk^Y8gW+o-q^_FQO67;jPz~lpg zU7{b&%UU6qPG>-26ec5hV%7hvytNGCPxWetwZ1ex#mxkHC7ipgQmfJ*OWnaTIAb(8 z^?d)JVb8OzjTeqA`}VK5jpWI6J?mus{i*RbYwp4T`3oF?tSq1RAcq_nZS|^13|-D~*;16vKhWZ5oP#WTUY~v#&zozmCOdL6 zPO3$A4*xvGxA}QxWyN1YQv5-^`3;;Z%Ck$bo`eI)zowF$qNI{8BPGSroT2$|qJm{v z>6eWc9`a~?@}9|W%?+WqDO@_M)^K}izm2cBh*azK5-i^FtDq?t$ZP5z&y}`;_xbz5q#c@8^&0&0h0rtSPYyzY@WVkJsaVKBAZN z$p>E#-;$e}zAM#@NJ>QvtgJ>WFs*LSWGHy1L#hhX@bP8cfLaP)BHQ?yEe)cMDtSMV z|Ev{Inm~9vic3#l-@a0Hw#iy6A((47DwmGg)70ar?XXL3m{cTsioZ5zGCW8t&}28g z+~T`J>Y9BcogH~{_y0CKDY!SV=e&9?Z))j_BIxaH7X>#%_Jxw{gmf6IrBJUUVvbWD z6a6)sp!0>d;sfUA>)U~c4xFFZsL5`~jzrN$o-2WRr0t?iRIFA5mePngFa_qY4R5$P zrB9%4kQ1B@<6>5v_6$#ACr+N4de*?e+jtT*44bA<>6Pbc1-Fa(x?)qCjFWfn6TtRp zZ;cM{1B4S@jGc&x2twPesHoV~+`M&kG#rG0)?jT#sozo z(}0sMCH4j)iUyQ-mJxNt;uv;d&xyX`W9A!=Rom3ncl=V9pklkO7iQ*AS@?-)7;Tl^ zG^?DH>B=F%GJdtq{w2>x+gp4IvSMoLmYADB1HQY}$RsWT*9Ag~7_rq|J^A=g&*5Qd zEiz$t>2nepYv)-2X{M;+*-MYb8s>lJny|4HQ&#JpCKsd2xk?bA_csSeJ*1~AkA|yw zo%2h;>#SNjU6@%}ro=1@pa{IZGglN(6BLY!Y0WVa$a;^5Ud?c~QzVe>gCC(TiC7+# zf~(UZB=p3t8Srz-n_^~eb)qLUukd5`BmZ}DP(;9jun&;`;_~0Y1OqQA2+xgDy2*7t zy$2%xC=UPGe^b&(5kc8mMukdrlL$ir7EeReydf9#>6%|j4W{6**jv)J=-zzUz)1J_ z$Firzd7HXEr;4>{aUv!q!mZ~fkBiT(G|%xXt5c9W#rB)PsIi@YTxx|5epqVyaTyg| zryR~8jgsC^NfT-Qaf(70*Pok~wo$-(rn}Qq$sv1lr#w^y(l|L9>&#BFt%#HY1W&_b z5-POXPlHj5O}=-i#Bp_&V^RI<%46sMG>Fab>N%7GN)tF|t;@Pkk`4|6Q@q>6kxu2{ znlv(!l-Ea$-4RYxbba*VQj7Ob2%(QS8c_QmY@JEHYnC(F-@d!;;OwSb%t6N$as()t znSWdV5fTz&A2s-|&G4LMB^6cHQ0fL-X-kOC{t#tj60Of)1?)BQ6#vXoCUK^ntf`Et zWZHBUdv^V6>sQ?FwPK_`By2lVqUTOh(yZQG)Ha%YkTH|c(rM)^0Rq%OcIB_~Iv!S* z7h+S&8}N6DPtN_As%BsxMv}C|ZS@pKv(UyWszN<1u%_Wd-VSTTFrty4OQIc{G1Tt~*(<3R7m#ge<`WwTHDq{JQeX%X z1MT)B7+6_KX`b`NSjN@VxKqk#W0+>|4w+CEOrDQ}cT7z~D^Go`;9W@!z&L%*lXD;F zycHhJQje_5NLfge%oLOPHgfq$KRXj>e@HCTBrG31t3qTXl^Tmi-G1r{2&`k}lRMwq z1W2mu^I~yGY&_T~7?>MLg;n>alUaJ;^%=OivJ zD2R))&ax_%N=fD^jj*oihzEWhP8;6rBE*uDxK`n<-z_$cSDYG}Gx&HX7vt#QPC?m> zs@ltotjovD(KEsjo6xLBtfjH@^&)+EnI`cW$jsWNaB%f=$JTYOVe-PqKj{#`tdF=7 z<-*5Yik^#?zA(FeCn|%WVqjpCSTA8&_yfZn_)yKO%I`6{ZbEaPw>(_Ia@)W>Yw3IK zc0+mfh*T6MJNq{T1Oy!&9S0{TjKI=Gz5mYSVX{}!`x;Yc5vvCTHMrK*G?n-!mk0zd ztVY3Qw$_5N9?o$7>O}d=doULKWM+4vogQPPPnzM95MD#EJT2#v*iU3^y8vRwNT{HC z63G;B$|kI{UxOkj`PtH*?nFdkKH9zE>e8~R{N}pknP4t_2)?N10a1ugtEq2EVADUH zQ`dF%VGG~7uQ^zZ0hZyhZ_C55OXc852@n5#ilt>@Qn1i8*B0~NUPdW)2dxlxwpVL? zM^{*CTe&*hyE#<@ZV`Xmtl2!Qb~}s0B_w{(G<31a%6uG9jxZAsr)>Ako-5*ZYFTjb z&w6u1A8(@00)y3{yu23B!|8pSmZv=-`LWqG-jStXI{`5!!7tpF(G6muT8rZr)M+2xHj z1K;D;2kPtcUGnL+*rfmdZg~myI2Vimc7@iIG|~F;k-At5_Hcn&p$W_1gICdT)^z3i zUBhk{&I8&C>@s;vv=R$L$2vbijsdCDt}wUo;jz4N?qEg)BnfBje!dfAE z_P{{Ap3>;yA$!z}L2>cEyw9)4aZ^{j%pUwTO1oA%W%i$ov%Fm03p5+ie!4JYXV2?| zT$|AhF3|60B|D(V$kzW~MTG93f5<>H?&E!w=lf_cRzZ`k11F6HHLhF z`2`eF^w&4`?V=>eABVlG^WW*7&FZ^FjL?WN-!ZFBGP0XA%VB}?khP5RgT}X4e=_E3 zv8Q&PX^C8us`BBY-1@&_J+6GG|m zVmz=O3#9Fr_QtpNN;#Ctsu~cVw3rx0JpdZ}QA;|q#KLATBZt3{K_p#Yw>ZBn{qYtt z;yQk70%i_+%E-(Rot}s6l1D+n?~p|`d9DtJ*@TTSY3M8qTg&0|uQ?@4@C|$|rDe>W z_AJan)ig0FTXxCjuWUY~t$lNIkGu9sPo>h;{G22VVqwK%h#_X;d8>ipaY%kMdRo=;Z$<5p z1K^5I+Z78us^YFGoU!j@MEI`kk2P6t|H0J3IGtMNn!cr;kj>BfjJ{65z&h!kz&2{z zW3s-L6o{c}2SeVNy#Ze0P=y97oD^b#S%IO$zOzm*i44yjIZ%PydUJ4$b2GCjmAgWg z(4q5u;N_`k3F5tTL!BL6AhDFmh4Jll5;QrngPtI-cqJlhpJ`0Jl`|yL{t81YokKi0SS?Nb*UiZMD zRWAR5KY5|{W=H?)cYQdfsi_0eUnmEeYM@l-{$Khd-QI2Y~YHIbBqj(hDg?%B|UW5g%qqBxD2BIgyEswEuu53 zsfrD=`H+Mr>1+M^8-osii-w4XnpdMpGbxhTD@=VhQ%xTR$oaGB#`5XM)XZ(h$3fr zRLVm-C_$hkJ}H`>{ga#v8Cvqym5+@GXie6KlAZh7?NMRMe{PB7Dgc-_*EJe=aRCVg zwdjcC{C=UW?KFxMO4Y5E=>%}Ue`m^@#XM(M?-{C8Mv9tbykpaj^ol!}EplXbpI*?g zj=0@?L90erX8o({>6g5CptLVy3uLdoi5WZUZoj&YqA0FoV(oyh{6{yJ7bZwFK8unSv+SuGTtg_jScxlPt0A0%G z{v&-Q48eQxm2Ks7?*0LL(Y?_RQ#Q_eGIp|{Vnf4KZht(q9E2qRWXHmCxVJ*fiq$xL zwBjdl;DdnqgT|vO52TSlIq;(+o>5Pc;5NBoUTyk z=6pNaSfDfdXn@-9&)YT{_Z&(^ZF}?NT%KLetAlMoMkxj5W2U5(RIa@m{-_6Xb4Y)* zY&k>t9quW?q9&G&a#{}K7AxKqSPz>R|D2MIKc!*S3K5Y2c@_n=^d`*3Q;X1&Om&;V z26ywJ8=u0m)Fh3ww!T%)*YtgUJ@VXsk)jT7*X%tZ`W`2IOEWJZbqqvwFEnf433);B#wb)2Y>9`D4b)Llb`d=mfIodU(IkItz zg2FWG)X9NudN!FBE^qv+(sOSq^xjIVwWe<)JXFE5i!||%C3Ym{*47yrp1QyZB%zWv zJ0>|c=CJ zfWtTYS$e2TL2aA0oMOKvf5Shru=-9ns71=X-KY6~zfo3JKKE;^cw8qTY)0M|FT!!F zdK;2y@*Aj{5Y;jJ`t5(Rh!|OBz8HtTPfaOyMe+ucbf+&-NgR&9+tS?8Ym)D#gb+Jj zR6coV7Aeg(eMI;9^}p$Jsn7RV)5QLAj*&Mo@%mXs^ndzF$~-_Uj7GNzqHAtW)!yFj z;_mLx;No`oOwYo}`G&OoOdW1!ZJQN9$rQ>}BIr+fxPDF0*1HD&S+GI5E*z@^`qM2SEJpXQit;$y7_(nQnZRFxp zmHMF0H?@|W!$*T>OB?c`ypU#Nf;_p~$%cciv+MYgP`jTU{VEF{zLZ7ogpwoU-y8o~ z2ofc<--sDK6SDmLIlw}GI@GR+c6`CzKw2e31P<lzfOSqPb)_c8 zs5p!Nd}Y#?)_Odup6p$m)Rwf!eu;Vi%usO|8F`Rk$;`T}P?E%fDln;$ z5~`i`^-of};2Ng!u9&B><lbJVCAasR?vH?Mp~pXiXsO z$^l|wQHiO~zzR^1!2=vp?gk)aV6^~cI;*Jjj-b$)7$gaa&UYM{Ha0f@S01Nlk!Pmy z+PLL|oz@rJmY&aQJ4*Mt7GlAF)R0}vzRb^oZ1H9R`2%dUt%l((9=#zkmw3 zwoO1FEpBo_*c*Uebz7g?1xQVW@6)!uaql3B{{)Hu6K|Vx zEZ7MZ`Ny>d-GPxkn%ydRYdxl1!;8N_Keg58|g5V-t%mTTCX(VslBP>z(0Qc0S+LBVBAI%sfZuxL>|@Eo{@llOOF- zUR_|&36l{dMirp9w9@Ku2}I_TXQH5hzzrfOP)j5AlWx*vIKKA?#hFq} z`4e$NR+N^!a`i!Azp8-&I-@#)mk^uUXP%6CvLCz!1mG^ivvB)E1Tys*t(@zhpM7ZQ zU^c3f`ww#u+uJ`#&!qor*J6f_L}zc{!^I_N@fAOl+EmfhO;mLS6+Er9vL^HqHS<@k!01u2k&d@e37m`34Q-&ulq%ez~dk1 zas}}>;^?T9dI%t{|K*nz9e%iz)8N&*?SwvSZcSaP8ENo*p(PJQqCa%0s8}kweAl_H z9#H$Rv!|~oZQ4)Gg2zD)_o(z+H>NWxNkfJ>9l-OOzwF!Ex3jxmiXxG1e!?MJ?IJe* zZIUQ5I@-7~bwZL6O!A_tc6n0l8P#M0vXzMfl*_mZzcoQ|Ex zmoisaYU(7W$#4Yt?PY~CCV<{`trDZh`_EjuzHEGg8in=E3P$&N|L*Q!n%(&LI4}~H z4uVI3r>3dS(}n)}Z{Mlfdm_URhz|*bbah} zQ{CI!U{Ub544V}$EL_jfMX01LySut7wBr7|LS913*2q!D8hI=i)2 z3CBe)&DRB(@Euts}LAQMETS06Zs*?&L3-FZ-14;R-&{4-Yb{;4895 z`m|*FH4JtuWJ~WL?Qf{W{wB>L#!l3Yb{jh_xkMqr@w|H=GfPu%eV|iaFJH5{X_&bV zOA^tZM`YlJdF;Eqo{AKv|i$+8t^c}SSo zP9JnpEQW%{o&-picGJZ4{RnJulLTy}=T;TP)CMq0iy`97H`F(E^maqILg4yQ#;faV zxugx{5lvN7b_>Xp61DsKu3C2WH5IG(_IP{ZGA*!+ygoa=#ECw1iZl&&QuXcSVD4V{ zA9SB~Zbziq360M#j3pYfSz{D`Z5ev6O|{KOgTPCWcuU**G$_6K8^5b8y;%RY1KON= zej~T$e#%Q=jiDw%{M4$grFRQnT=qP@jp@c{6EW8GW~e8?ScIf9UIeg%IV}GS)>Tyv zTkOtVy};GAHV>4gA5iVAq+Qvc9!}WEG%q&BvHCTU#q1^9-|ao8Rw>1qD0sUKYR}u) zSJmG!5Tb>Kg@GbQs}q+q@cwV98Ud3%ou~jb~Vh=AYr@En`sd zudn54l4~NyNimfb=zX)+QX>Y6BsHYqC}}B*ILeU`0p-}|=94bj6HG`GmIjAiCPv6vIHI#e@vu&nh7>h3Di%s zNaju_v6mHULxe-TQYT#x&l(hOP!lH#@p{@ba0k5f+UExNQ~u8|;DkTT4su1B9;>DJ zNF#;;`SgO=R^`%3NPAMQA^0ORAy!MeUkML-oNL__7P{?I$0}_>l2rhr4jRa2K~$DE zGNVcQe_VY7dtK|=^=@O^wr#huZEMB0vt!$CY}?I>-PlR9;>LFJu7mG7=X~=Q%=tX? z_C3Z>GsCp7P+piD9XqC#BPcRzTcMqqDz>ys4{Jo8ziAq$XSDROP9Fh^!U+u29TzU# z-k<+t+`eFL?ib%UF47;BWfSLqi*ckmF$~OE9tX{F#UVsAP&jH>rv-JbfBf)%q9J0Gm*y%cdOQofN#W&Z`^dA zL7T*-eJ#tR5X0Ho#dxa$Sv696npx0heVwBt7!%B=WG{wrTb<*gc+*KYN~uM&TdSPEqgYvd*1PK)B0(VM4$&Dp-W0PqE<5Jx%$nA$sJZDC;G4Q?@U zw!4i*f~qlxgJ^qMW<9m+`IgRi?Apis#UDxr6qqY21Cl}vR9u>;m}*GR?^x0Y&#k}a zO<%{&W z@_s`8M<<1xU^FFnLLE^zt)qR#lSERrt*+0+sXWmn7Zd==8awHwn@YUmLhG7Vi7V*1 z#D4sCWINvD-Mp{g_U!y(o`>~mj}rf2zDk&XKK=*?m!#lFPme0P?R+1mR(~2{o#)lK z$Vc+(pJJ@!$F|J;Y*RoRk`|271VK(k&AG{A=64VGya0QX^sobk^z3FfXJk{;lDtT% z%5|Jqo1$*Pkqp~Md1uzvU2AWiS(J8gq1XBK=L8T@?lgHP#97~dvyxap8GgqEpi_Q^ zb7--em?UemNg=x6_S)PdV_jW$5VBa zrtmOi)5Vul-EL(f+PJi zA8f9S0IRi8r)&c?^l3i(5zee*DNYGFQA2?56M1Ht-Em z*1K-^^nhDKeCvpm+%nSEriB}oE;>=ySeaX&SB%ldQHWzwk5R3yTJ+DDH_8u=>7{$5 zm|xq@q(1DU^ORSRkxkewHhN30#*Pmaj;5kz4F=$Sp_Cj_PRx&buLYBQILO=%!MCb- z_&sIO#ij5=b+hRv#O=Q0ICOv&3qsckoDU`xM4MeAZ(N4Pep6?}o>e;39suhDrZq4) z9P<0WUoGg%szG%6Jn&=Z7Y+$WQL}yK*xSBkNUPlv(a*L~ zZA|vt=nycqaYBKarTs&n49+sM39c=aowrp{8gno3eBPcBh=nHx#AX@Y8LKocR zpj`eww-^e1dlk8%2)Pg1XWojE*> z{#QZBHh1Q5X~l2j?;m$@L40loT29BF6Jg56`ZOp!fvwNivTo^n@+Ul`G=$qJ`mxM$`e(V&TaE2Co}a+Usdy-@YOO#T(p!wRb3zK%5n!f0~jBY)YN2y zl$Pc$DtwRblJb|FSgv?fz{81q`bulGA;D=%jw8B0 z>_=YD4fN*j_NZ#i$r8?3FlUOpWI}9y=d!%r`JTIoIJN+LgU57YF@Uh%a2IIc8=n3+ z76V6B*^qi%f#|ay-RK?(O2oRz+0IBzJO_-@;4sP5s>`+a=u}o096IYmw+B9wG$cq< zZLT2T@Sw=Y5+zpQ=m6)YqD~<02g)d@-n$WThOD|H`N6s;=^B!m2}lEYAw_f54Xh|d zKWM{JZ)6_Is;>}O7UoqLAiQ$;7b=#2&6&r+q$|drf0sCh5Pp6_M@b=wuk-i+muCfo ze9}wUEViDOACo?o&U^h8|kgg3n;p3)Di6gUb;?C zrADh=X8)*oowut#N%0ClQWqZ9sOu>HbCEao?81g%%XWT!UDDki0xPW*pFYgoCd^Nh z#+R+bFX~qX?UaMj@WeEXk|#^Ftxaa``N4n?fnRWs69TiDZ&Nq{do;_jQ3>S)n!w7a zsHOtqBj*k88=DErmNU}$oJZj1PWI2+Wg@?V0~G^xMNQSema#9)0o29-Kzx`P?1G+v zxde2Ip{i6vUU7PSh-KSmuVi8?-CUH8pi{%ZFJKnUPKbn>A-}kl4F*MCuRJ0b$N~`6 zD)(2w1u~?#h1yPLP^m)2{>9&Ktd_)2)TsLxv9{vm!<|`~fdRze)u`Mpa+&zMVJgm) zca~zTYefWe_~a)&n?Y6X>>D$R_;!HSU%tat6DCOA7l6 z1){k4+UZv`HD1;oxA^WK0k})sZo6(P>Rtu}i{GWJ9MPj0jV>YRjU2&kd#WOGCT8Z+ z%1Q(DO0?$Iyzm$7Mu%)LwL)=QTlnxZ7k;;UjDvl`)f~h5?UXO|WZkg9o zFeY2>W=;dnSX9fGVXMJhA9V%FJeECQNs=|zYd0jleUmF-T$mX%N~ht7cRWXVnDg%Q zm}K`zK>LKiry18nXaQ@I^{G7Uz2Vp6 zU-)0#Ty==TBsh^|B8Y5Cf3#!__TssuOzzA0sr>8M6=&vXE&sYF#K}m{%Fed%@sWhF z4xwSYWnvZLs5Ut~zI66m-_hY?;YH@CjW_z{S>GirAW$yg=~mFiU25_G6~7mdqWtXD zivn&v6<;XH$Q)kpX}h@Gj7>89BK#sN$3V-(P+rjyS_Hn88p8nmf5-P^t2S)|!};7V z*&F1vhn+JBJ*@*o)%`1aLg z?)vrjm{&@B`#E_m!0rbz<@A=lOdny zlgNL%{+O8}6#+Zh4Ss6;M$^TKT>-t*_0hDhchf~(fGtZx|CdD@h(GnZ*5BHZeuhgT z{~^drIsIX6TUdGJ^8N&&gk;NLC;h6b2T5zH`mAk)aViH=+ga(6mhvz0M#LH=7%KQQ zzGb4y9v-)_xrwc0@%X`hOHVcXAsuknPeXD1DPdSd)_d`Vlb;`q6|v=8-2gmR1TQw+aqsecG} zs4vIpR{AM`EBM+ILLxXi5GsTChUhmYJ=d@E+bdLWBVDL*$E&^XV&`$Q10VTA;N?(2bk|qi1tJnp`hxynh9j^W1OH(ZEbC~;OBL;m&5a7 z`#dYpaD%9$-LlK~r%$(US2aQxD?&1Tb8;!BSSUFrm}LXr0{m#Qa&WjFw;w&>6kt}y zPN~w1QPFJ}oxnZLqJV`*Ndi&Y9#xaj!^<6`oA#*eRB%axGcs@tx6u$8tu6Xk+_Zi_ zlExKAc^{V1WaI$oG~A8BXt zG9C3W!WShbjL!v;A{TaeB11k$-aVjD4xEikoP_1%-m}ycgxH67>(MgN{g7nlYWDuw zH%2l)o3Gy(5aHh$IKBPFcjI+J(&qIQCO9{qFPQ;Knw*~{a5ics-RglmT$>Qy!oDo? z{6LmFV;;}m*|csh`UVUOp@ektdbx2>(zqGf`QZ8v$dl(Rb6xqFP}KxE#dIbUtu(xw z&w!msNBbTPF=gmxMt?{u@9{IVTyg5Arn>)qm=PGWRB;+`o=;V;0e=%3_1X%oPpY65%y9>B;$aY1~DVk#)g5NJE*@ISqi`51k5fP6t;P1zDE1fmy@j ze9KzcC-$etUT(U6yu@(ix#g4sDI;~v+4Q%xb$cq8&v)8$^T9hVo#_Xj^-1Kk*YenCJ zpq^^R2W_<^^N}EPM+wCW88lf=Iz*aFt3TB@unNnxv-!E0Z)YJ5Y%5yJfADoTi`vQa zBBvsv1q4El{qK^Rva(#Y@t^5Fw6nXee-3`}r?3U8MN40C?A2M5rr6dC&$UE%xi>hE z{`nBH%e8lQxdDzd1g|=w=;ww=&&KVp!xW(Bsz`jVxw1TruWc0y8X(huUxM+9C`S;z z9ssVQDftTYsK!WNvrCPFzN|$V`uUAV9+FM7UVT&Z#kVL}lnKv(YD4~5UFH1^GM`DS zwrIIi$n6r&5oDPgt5=)`h1Nrx2blM%7kR($!_A$&e<|V{R)c?>wZ%KaK)8MsAI0Es%wket09%PPEX0lsjBM9xXTDvj*p8E(Qt6K4v%kt zO#`^g*AqFpG>`(*l39Qm8Jfvjy3zo5h+6mB)YLMybpc5|iKwC;TN~T)nTb+I3j=N5 z>^FT#L#84$IDd>H9Slm>hOAMq2m*>u{wbbqvcbn!#8ya#08BnzFu{qQ{z~T{LI2ZV zJI7w=u3V?lX^`G%xtq)tuw4^_zu2NmI)w{XH<^d?mY54;i-~7Xq#vA%U2u`Xw0Vm> zWQ?V;^EH$%_=XAJVUUm(D9yF@oG1#T=gW9(ktbmPxrVDvOM+daTwTnaI$Y@d zPGhExCqR3@ihVND-QO>!I^6+kVYoP*`9K?e1tB=AnSQvK;$ocHXg|P?;~WWd<>A+JL)v_k&5Km`xQtwRS7%)O1G5EG zC*gVIbT$*z`kpw>Zh>2P? z+~OHwi;}9vZEs)Buhuc9LF(jNC)BZJ*(!wBbX!#YCS40!*AxH~b6npHRO&KI+UWb; z2X~@6!==IDVQ8gKFZ>PL2ClZBD@$3pCWV3xo#O%poz^c_9ucfPcYMpt4jtYSs+ojw zyFwHfCnqkmi}7PMk}s1Ooj#L^GizFbdch+vY~)nq!swqXFIR1zKj&DIf>ZyxyU6^F zbsU=IPuQf_-_J<6HS69{Y$?{{g*vFe)#-6&TX`sYq2J5=XASD{7q5%yW{2k>ECd6NXc2`B{jWs-x^9?p_Z0aRz;BS& z$eaVo!{a-jBh#s)EN28rB1!h$M_fp=^IiL($1l_3p^#*yLh#ci3pLHkkj0z3XpJu{ z-HI|OH>4S|_}kOgmg%K&!O4dMy>0gzA0IY}*{x{O^8BW@>~~4JEFC^XW(0tcx{`|r zU$yVX9Ve!mw!Xx|pyGE)0m3t8}nS@^%Q1Ti)1+`kVqeZ`49uU0uFVNM zhY(oXU6{W9{(DaNdg+(Q%*YEhfk2bBRYBoL1fxUVBhrV>cwYk{cbXsqT6##+dW{z? z0A<%$ii7DKL}sw2!YD{ryjAOlH1-7p*jt*_79?}d3)efVbd2HeJ zFrNO`X>&+XJ^>bo{xZPRmSb>%K#+gU(p9h7@7MA~bd$mT+yym5wSb_H+s_*y{ZX8f z7jY4oBoG_kaNiTdCM@W_Nu~Gea+U#Ow51VM_KH#;FYfPg%^AzbV(%K`c1|g4oj|x? zZORr(*X5VBjSX{Kv#_OBh41{n@Ili|b_dYA#?yoDH#?V6dH zxB%rI3c2c>=zM*nOhAug;y51|7Q-At{&Af|W+9=!@#Y3byv2d)LegqO8fTsX7! zbuIn(y1{S27iket6lcEU3G3n&0)s3<@jg&5bNk7sg1mENq7ey_O1n%KM43a3oi)zd zlAA_PozC|&OGU`9)kih4+`p7kXBK_t`^d+lB1b-*0&o0#f`2uUENpQ#9}8d^B|hJ+ zA(-}y6o2iLx}I(@7m72q>6Pk?ev~CSHr;C94`(``9cU0G)!ZJt86)Y??nj&YP}f7f zdGJc=UbX3IVdMup376G`5h#Zogx#fD2h&-vkKueVeg$fWZFa>!nknOr798s^f6ML= z-&U+`jsc#^aoz$QJ-C^su{e3O=6@-Zk)l`EV^?6}jR7Yo^{%TYJjDzt=ThOxD^V%u zJCLwkvuzJR+MHc7Ggoz_gwFOB1!qA>vY7Kp7YUfTaYrcM!FQ#H86$}rXF69?PggQO zw^n=BNzU`A>d}EYTS3Uo*jWBe{}Y|_0$l(;^hOJqhcZ1CXzz!AHqk;{?g$A86{yriFQ+o*K=0Q9Svjjh%D7`~{ zeHvHl@p`o<*$xy*y}cw>9_+BYT-#X|C#Qd!c$~Dt<$y2U zZ$R$2}%dw0*){c=YoeEbUWTc622Vf<^t31P*` zjP&%3%*S0N23IDL$I zEpsu*b<8zXJG>s_nh)K;>)(K%8M&4a9RG|N*2!bOp1@FWbi~Ta`V3D?YiH$n6+u8a zWYN+7btaIKemLtGa4Y6~-ac{JIU@)L3lckw56h#pswoR0zN(S;>7om{Kc5ivi#_I} zh5LBUv9%SsIwalD;#_R96*V;H0H2KY4SFJH=?nY%(*Kg;U^eI!`)-e5Vu+l{2g%XF z8+Y(3a(F)L4l7e>c4opRxpE0Y&6V*~g2-Pk+wAttNrj#stKAKk-+n#lrqu9AzW#w<8`IwUL_)=kk0zxJUdpXxQDi=5_4I`L4!K* zwb5QuJm%gxOV-aHU+qQ%MI(4pqMg9*0!KnQ#w`4oK;B%7N|OC0-Va?hJ=lqmU4 zAA#^LDwtAPGqdC@hvd{=LViH3ihXd7jeU5HBkFq2V#?jE(?hMG>qBN<>}|{;%d(3v ztD3*=P62t(wr+Hz-y345$A_I_aEy+b`sbhqEdUI?8D*w1b#BMe3eyH6ePrO`iUB@ZoFsZ6gl^gxl%XN;62;|dqQ0`6O9hhy831vy)Z~Ov z!9)|&aQC1=f!hU~so&!ZQ-JqIL5&Vr;m=Z2jKNc0 z$ccfd)P|@EXQ{0DvMaaMs>PhV(IdK3gSvq@b4HpV2W}xI44KYL z07~}v(SDyqHx_a!yf2jaZa6=O)6sD)5Hc;p4cC!n=g&ia_rl^lv{c<$7H@zxb6QF4 zm{RSjxo|yc@*iO6hU%)7hiG6Nz~?=l8#Znz_tMXVJog_O#9gN z*v$KSY{(nPmz({^nY=ltLSCu3v=~i^z}7BTu(7Ryy52keyq5S(BJa#eJiDDqhRR=k z=*9F9O-#)UX@=+0MM?^0CsS84hoiwQwvd-6eif+VK~n{}7SUMBXzTwiJtvNIg&eF% zhPZ5OYoX}Bv$*#nO-rD9!>Oz%_Za$wpL1N=WfGcFOhu1?&sQIG6ULP{O`IaqC3ixo z&LlQ|j9jV)L)ngqy1~uz_HFkUVN$D@Im)FiaH>F=wMF9O>mpoCg+A)o!gW3jI5%_j z&bBIHPMLiIn`(c-H{W-SQ5}QV(IIe=OI~fSqI0WS=l?u`s^IMWWn^S$uifzjQtZ0* zd647-)zXqBsZxZB@7cGb!!N;e=Y5t@zBXB>C@W0(vmtn>0`cn>(;U|?@M3*_-T_(< zW1T4ofBI?SONtPZ`eLgp=E20d9`rtEyK<`5!1^v3%4s#Nbi&c0rB;Jed~p*wj4y{8 zA`=mvot|--L}Kb3(;J2@t~JZg-(VI&2sLY)>e4Rv@Q|ed)n?9j+yw(J^9<`7Dy@Q< zNxE`vZ5Zq_3!v&16+L&{pLm`4c1dv}jU=MWsLo0>&22bDK|A2Ed_ls_J60PU)?&HP z@4hUkzD7E8^EB3LECj!Y$7waUb+^$EPCQUJl?B55aox|G8G|VzdoNVIC_A@}deDhULJya5C*E)nU-T51jtqqX6xc};8bO&gx#!^(Agmx8)?0s8yy2;-Lr zXwWt;2s3R~+;R@*PjQn(F6|AACs)GI10i{99Hd9&^NDYYH&>gyNqOoG+F!>4mGvN3_#`^qe+pJed* z$+_dPy{T^qd)qQHX#bP^+x%{+rJsy#`E z?~N}0?q(>KS|V>f{%IzDswnmOVXz-ixxF6wBInNwE3;jBM*;ac59?ZaB60OjdTYX_ zHqJ3?_ZV&Q`7Rj# zeF-E$4#c5DC7UU5Ndctc`Zn#adP?@u&5d!D?l*IAwU7N8VjN6yWg%iGX-1d?5ov4v z04K#%xSHe>YFOX^bp9f0*qi$Z?XJX8q(@dy=039iq*I$!V7-7^kgA0AxwZ zWO|Q>@Ah)^N5}Zz0{wSIo(2kh2Kv#SJV9@>Uw;P%;(uH@hV2BhY?hLEFXn$b0^d)8 zW4Fy0H*Y&pr|d#d+vLodCT&zH?gMr9>YM+J5Jh+o0)4cQnpgju5-Xk1stv z4(D+aaZmmYBo4Fs2%$`XaiYU*^|+tE(Z1YEh6z>STPN*G!MN+L z)W|aqs9o@*^XC{Jxc%QIs#jpa`ty2*evsllR$-?3lL9(o+!{lo&q|Q67 z=ui?ZY2*nD6xo~p(7l@T#{%z@z}hC&<_@+=0O{Di0~IgkPm#!$ZAJ8bGElb~Rb)Nf z$0=RZyJqO?&hUMI0@}%>8`OzR@-u&tb-n#T|NDD{Jdtn_*>7vbFn9vUt#c>YPgakj9tHt>`?;_u)W8r3<9VV^IfUZipWh>_*QiCGD@8o{w_ z7|%Hfa6`Zjy5J4E{aDI)czi0up&<2Mv3DA8s; zFN6BrO9OjZMp|))_FbFY-+#AUe8`bbn)Z9>`8^#dtmCyfZb7ms~REYp`YOKpC^ z9~HF70z&?74!Ed#EAp`?TmhbIv7{s%0Usly`>kUplN;i?+DR+b=d}DK^fO@_T9>Xn zBPkucfx@3x)X(lk4LjfdbFNzXR>XOP@Dh1J{^R7_&((g!n`1EB?%D^;&Ky38f9FQr zArw7VHo%&OC4W3#T=m1h(QBCjR$-~m$?Iqk4nEXOOx~nSguGy>KDrUV(*|21%7xxw zV~004kh?(Qy~)#Fe&)c|Q@{=yB+9I@>MO$dqRr}&%TH%UHj56CF(&k5!yD22uf1VY z*N|I#55a#H2LB?28V`jtWyKz{&_dvW)Ol`;@q=}F=J+mMpe{C>N{aTKon2TfDWJ+J zMIq2r!bdasY2OhBEhBEMIEPmj=&iJG#Jw|K)?H7YJyNCvQj1}G+fs5?pasLp_O3N& z-n-{ViJ6!4rE@5@m-0vWv}+W_kMbc|^qi0ctU~=T4MlIqfZvp*^~;o9b#)`fr zhEd|9jVPfiWH&^{h7RvD%`2gLM`P@#Q^uE(lUS3-qd?7#?OX&`044NE;9Pu_h5+>Q zGiZ{bagkEU*iZaLm6iBpl+7Wn&sfWr{7!5<7o>1iUf;I;gO7NINzDXOOk+v2W;U&_pJ<&i$hKR;L zPM_tU9@o1liM_vTIPW*~g;cv4=0d!)od7gQpQgxww%)ol;cy3z>eGn)r#Na{n({S_7Lf-hWY5*2C$12XL)Ki%>AmFcULQM))B--bR7=tFI0ZGgsTRM z4pGP)*Nbd9+8A=lo*Nb~wrog`jbQdGray`oMAisPE+*EcnE^)-(JxDkZ^FB>W@+ zJ=G7Xgnt%L+glnfEaJKhvDF=Fy~1Jg;)VIv&_X{~TMZ z7jUKu4ray+#OwP5?%FIA(#W1!Y~MP;;RIRB~DMUL?M zJxH7iU&FBN|E01XJsE#;S)tb_@h)nNk4^X}3^Yy9dN0$Mfv& zcqY8v;%v?R5{tEuU>P0;5XITkwUWq>276JNYUX(ejz{hA@bHRyJ7beN1Q8lb)7xwv z-F!-kMHA;e9t!I;D|PR+BJ}BDP#R74$sBVyKSNeF7@Fajv|WZ7uG@@9ltVgqW`qWK zbcKEu$Rg4nrfQIcqX0DbC(j1la2NPJAZOHXA1&XX4y8S?ZK?eo6hwg%{1zoUHM}#2 z{0Z|VbIl9=_*C3VUYKc%0+GwY`F_Fk=>wpr8^#5&1BrV0aApL22p9OhV6R*Xm_7}R zZnop3YuIm`DDP^C=?=%;IU#{56eBXby?-AZM&+GCeC;8EL!2$^qst&5F(fa2A>%8I z@9-W*JH7~xsfNi2xJE0alQ19cHnk@ZSB>OR+|4o%kJ>S`Uc{1c(whw{)Zw%9hB7h{ zYGbjsen7icEE9~B9$gq9R@?L4T=q0m4#4w+_;3FZW6@Cjwe#H1$bdDj?-PQ^@H2K> zl%Z~?L#|TV&(ShxI0-J+jRbb7JSklsObD=;tD4k!*yVR-K(36xU~zi=Fj?3toDdr8 zGLN2OZRJR@IEd%}of<=SV^)y3?7XO_Zq8_B2HGek zUXpj;ZMy{fM(w5^#~xn@wtMkLQ!S9ma_v-c_s2^0pm9$&l8rRPJCs}6W@bcB$}ljK zfjz%$654RCxI3nf9+^@POM31Q|LA2$MopLUi-hKA-8rMckF2eK^@ZVZAn;-36_WZf zjgllOUG91d%RFTc?7l3ZB2NkFn)1GTdfRQ&cwD`Z?R`JQTH>EFGO~zA)id+w{ zHD}USeM-p6-4xr)3SX~}^t+G5Wqi{blo>;ZO+~-U5IaEg>vxvOX+A=39pIH{#yhvL zg*`8!MAa=aGBvX=#?GBHWM*a>57cI`BOW5 zIUqd0-!sRhrG20LFQ0uQP66!7Xy*;{+?6Iqlj5Zk)N5e zeUV4z&dSaO%L$8R{jR+C?EokA^Vwb}B+h<*Q&C>e3Gtlp#?}_mYo+eU58Pnru7#~u zbNtHO1-0QVts3xn?oCCbZb_>gL0^9?#>5`7N zAXG>uuvWFRvD`}-gGX-eFgYf(HK35&Glmh$8_|^F6NpDU+gpcj!bkd3%~W_~^X#n8 zx`x-RRkX_QJ#_1(U?RxhD2SuHkW+hdof-n4cu_1R{^RzUA|)B7DNxm*bWjR=)cj5Q ztN-gHu*E5A!()@-Ma@j56&1=_t4|jt(k_cC#ET~;|J7fCnu}FXR9ReBFm|Ed#q%~- z=gjM>xG})|kBe$0&HgAvv%$~tTGf@bS762)H*w>^n%htn^)&l3t8)0eqwLPt*>Kz zd_13aK}l8F?I{hfFu$p-t(1)3;j_-c{_)?n{`Tt$yu7H7rfNgCXDWU=@mf(2ZB(qa z!6BpXBKY1d{WDKbyfHaOO31VH{|Tnxo0qnx2<}Oy+9F*>qlks)(YRN`-k?7>HNiEKbgAQy90xSV^k$^P_z%hh zZrZ#Tsn_na3nC{suPa`Z2n7457pet@dArMnDY&%_U-Zkl0pbdxf`qwy+E^$}nx6%P7tZUJEcDxi3m(d@tSJI(tq!cqD2SLJ9aemsGqJpL-Hksy1G>CCX(i03+Lrd@kk5*Oi zgHIL@^fEc zYH}xGnNPObdPde)P;;#!h;41?FSM80K6B1Wor1bJ+V7Am@v?rmz5$;3cNr{i6^OQOJ!gBf9zV4pkW`1 z*|@Vb3t@$dYXy{YEiQ8pmZCT$rW#2k?orhpccABJDjI3Qaq~EuUDzeWWnn!KC$+R= zn>gR&uORgv;}cSj$)Z4r;Uq=KeyzQ5J!oPB6jOw5`4klNSBGT82nRmC8>Q$o9L*3W z{xO#Es*)x(}8>cZ}WN_?AJWADY%^9jJt}y;~2yS`-3?pI+c?%yrY(WOquwiMmuU z$l*-1r?!NOR}uWV@^l{=+Kj4$s)R+hW{DgfQ;r~c+fE#rffgNfwXS9ODgG!NAK*<$ zEN|j_N?owSRqX4NSEI~Q!~ppUw?dY$F`KaiArv=cBd_JqMhOH|*=67w;3={?Rwt z>doC7KWm#T8g~9XJ;yg9>;byaXD`#sv-rv=rq<%76GwamAy>)vM@YPlB$f*aEk(!| zA5C1NcGBX8^vu6(-%YuOdRz3+w8WF~pu_yX5XCwDXgUO5}{ z-7Rw05IA5E1UxYi{k4qA3nOb1gwO7NYnQgQE~UqvHt#nC$zm&Tr3#s6e!SU zDb?6vD(+*(@?MKFF6VTZUk9%4Pi$Z;{=|?MBW>AGx}y3L2!KtE~f$ zP9xCx+Nw@=<6W{y9l1ilGu(8z52jWf@^4P*M=8b*t*dK)MMkl*V;tF3CK1~}J$ytS zOSqybv{T=IKwC<(@N*g@G(wRR?yXJe4C3HhVtQK3LDNuIYKajraW+})wuJvA2=(?h zwzd;>v%!-2Qn$IxK|!m4I%&cZ&&}2AsHH(rqFel)ir%ZEyUwRijkfs4u$iLrDLf zyCB4!HheX!Vz;l3A*DL_I!r+W|2Q^D3^N3XZ(~h6v^EhMTLcZ%ujyo} z>FFS!4xLV)VzhZp*S@f&6sk|z3$a!uztK_C@2CBrJ6M_~5--C-Jw6JSdwPtzeRV{9 z{vfG;`L8Gy3JRuIL1ZRVr64=esFPD;MC$rqwd3WId;9wKtJ6-<2o=!}ATd0`v^*-!Y2pSo zHgak7LU69MH?#%Pj@9NzP&8@nOKZykrlf@!OUUX&|0I7Uw4Z9cMJ)F8D2NK@v?H>Y zW=fAyxKK4(04{3d^c{|@zLs+E&Pj#nlRbL{-AqKB*-fE=9KKtB!Xv>6cTlR^l7GVE zk?586-7bRo^h8bC%I?+(Yf(U!Cb4l^^c=Q>kb3LCF_V9S z*3mnQ9O7bya5wpl+uG9(`y_~oE|ZQeWlZmXP=6FFs0QaYw6qMd)MmGiYn~y=U&XKh zj5}h|>+ptiWI4etam9a@3E&vaSy;og71HpSaCjTu|J!jZIV#eAPpDfld`53@Uw}a> z)m-A*X}8+PvX9_@5&#Y+2cOHIsByLah_DPLjlMW*m%=Tu8{L0mUJWq*+f(7wA>58a zLdL7=^A9dR@NaDViO<~8_^+g#ps2F8060+>*08FXz2SR&j0ftfwvX)Nn>jNL6mcb?(iJ zgsXK45&3R@etqEZg4rN0ZU69~nUv4kQ}JmUU~G~1zNJ9CoRO%dTRP>oqeocQ(h{5H zu2NPCg+Jj+=lI7Y(2;Npg&8e#qbhM)+n##)adVtrp1j)b@8VjW3Gt4BH7pPA6|4IC z(%#~P&S9e6*U;zfh}1>F{om#ZBX9b$e+1Un3=365PqLEb!20a!I^xd$mptp*wXJO- zpARdStR3#s-p5P2!pjBW-OLBJh7xcCkCrp>ZY->mZo02{*;Yc`TQ2})O{x}LRmAHa54V<(5I}? zGqCA!?NA#DyZyegy>Xa}5;n*8ajx4ntGXSDm5pb3eH$-N0Q-p-*JWq9fRsnB#xA$P z=^i*aj%Wa3YbSrXi zy(oYfUbWZrY1W^F3-n(@CwZnC*g8iI%tR(!K~BhurY2P=Gdx`sY>8A3Sac&vsmm4F~Dk&6~xp{fBOl^Z=~WE&KGbDjEuR;DY*Yj&L5#BZptgsNT#S*SnF<6 z8rE|^4=i4|#1z5gh-zmcx76`qC`2yu3!g#^M!q)h`nL6Gp2kPr-OA&)pXUGky?8`~ zr3)K5GiUl$)$G=^PG&adsq;Z!h2y+K(&r+k9%s!Q(wyfLl)J zJ|)P^tik!pM6*FwO!MmrdBL2?ctU%EFh8H^r&UhT;y1TT+?!_@Em%2uYHIQ?G%#AS zz6VojLg>XIR|v61J!Pq^ELtXL9Y3<}n?`DRb|^>{L!%TaSQtXQc3CDw@}m~GM)M`` z@hzptYJNW4KEh5hVpwoy3GUv zvtMd<&TOW{&2r{6w*XsHQHvl) z07h`#hE169F#gvxpA4}6p?|R$s8{T zuRt<22g)KHXzJ`SxWE$`eSt;2adVA+^d+7fa)eq{TQ9ubm$mrRHu4L5z6K9hRYAazk!Q&6!>D!`ub4@yfur4es~-T_IQh6K3d0rYS;@<#M4mx7i7$ z;+Nfl-QBmX37s@8)qnO;!Ifyg&k>IYUXB4e%1`oJgqT<*c{X9;X%Mih$-R+0f)_nVM9~T#KSVQ90LJ)oV)CvUuW@=qKQh11=u#dciSU(JCQuv zR#sQhmZNyv(aO-qfu7jDA#I%|0!pGb^~;Ls6h<~{ zK37><=FbDa%G&B>{r?Q2;&+&QQI9O>~SE zLFUnK;vH8n zJ!kjYKl{7;>Z-S@-;&!N1`Hn`HLbew^JC_+~-uC1w{#?#|l=hZlwR?IeFKK)t96P7N*K3k5_@gsALUb4TL^ZDz zOA7Y@&{bV&`Qhq6!ZGuhd?FnrFY~PEkK)C$F~@b^@XGA5=413J@}6jzVUoO~_4?+= znwEP$o3{eAs&_r2;=44aLXZ6agY?wK(Sfkm(Y8&dUM9=GfosDaatgGHEx0GFQn`_d z1niuu&27A}7>yLN%XIYevMfE!vwGpZ&o{ll`3B@R?7~|GgD#`lI$y(VPY<_3;+Sb7 zBP|!XH1y^t>s2SJZzs5LWUh;Q9`Qqbxw&@Bw)W5EB&Nuy>D7GvBG_r}vjL!ATVXBi zm&!IJlnDi|H^dE${v(O^g9GGW7q-<9!Ibr!yn~e8xfAnx;$7>mmx)&ArkTz0Xz_}Q zuIQc(9GtSrag5|K12?zLU<;>sZ(BUnwX^8jLm}^)kwrO&Yr3A7WwB&1iEY$~i#Rqu6@5!P!!9xQR zn$s157qIsynCI*(@6C7SqgzUfQcU?5qA$p-<{E1)z;j_5xXQXto3A>K?8O#&56ggL zy+_s5dYk{CrzNAv{S#2PWtm&# zO4%1A;l}jqK1U`d3A>7kf!*%E?mrVDpnegXn#)TjV|CtK7@B0v+sGiQ>3JmKJ;Rjx zZbZ>30j(`NGz|zJ?S&D3fn2ouoqc36TG(4~GIArJT~6N#ZHe-^B+G`wX?eW7`n(oM zLGN%#GqD+)wE2jgIZ?&_hrPI>8Xw6Wm%#t|lD%uJHu#q2le075^3yE+=$`38^n8Lr zfZGv=%li}M`7z$k9%gt%4F22ikhK;h3k~||Mg@hFzu$s@hcD-uS$=TnWX>hksYzs_ z0vOk;_&MKY4rY`_pJ|5S>nN!TQ#{Pr_4QWVZ(DR?#wsY7)zPBKrrX!(96K?G75u)c zC}Mw{u*+Hrum4FNrNX-71XeuQnO+~P_99x5Dkz^+sDFD2rxFW$t8Yy-TwWYNkashy(1|Igv?a#QM7El2=u4%MwW~8cv z=kmCb1tyq?yb*V0=HeEy-x=k=`H9pc*qC*jQNN#i4zks#1fCUIms{2KO(K#WdR?kw zb_TH(>~r)FFKYUK19GL#ded@*T3ZMI=|<~whlqEV)h?0Yd3#SvKsgZ zQnCMn!z8Bso5DTjzG-h(p`{Ly4#RmY+`qlh{r1xv!d@s@`$+6(%C6S@l3|}?0td)d zG-f~BXy3V=a^ixWL-I*J@yz1V@6-LqzD5TJn&=TbDq6#2D~*rccV0^Xe^YC7iTQ6- z(FnQ3ed*leDT0n8PM~rjW_XKo_-x7SjVI~D!?iszeO!mIfh>av4b5a(@e#h~RIMd` zssbLy^Hi{DjJJ64OlC7h%Lq?>iMO$?^j|0eFKy^@=`&a8^uni>l7^f4q{YSlk*Pb} zE64tS#v300gI_bsW2BEcVy@3?V@2YjItpppa@WfwGImZl3jy3v^VE9JTX13KGVr&Kl!s+OFo<({Z>45FG#Sj`k@Z;UW2VX1^@fXQW`b8yqGVw&kUE2T&2ud(<^bmKD%dfM z&~gKaX~&-NvJJrdgyM?!)Jfs#nrR>fX>qO$X___MQQ^k#z*AKf#hcn|17cqO;opCAyEN891As?pCdN-fR`w&lxQ){&;s+aNHn* zuDxXkNt7bl8-*hPY+tUq#hu95)QYG_iy53+00&#>qyBwWK_Jkp`Rp>_UTdIn2g(?x zH+{ZRs2pLgD5{*vVuNwx4<(oai-~InY@@R@2N#R#>m)U@%1fHn}8r&_sNfVU}1%$lF+2*^zCi% z?;ZDSgsdcJ?I{y|^+^*rz|w}LBKmc6S4Hxf> zNMj#lGJ6KO#s4b0dQXq0ynt?WUlaH3u3RTwX~Nzj!S^7N*1&)d@M>)Tbm33&$2*3*O63QT9?#zyQP0`B0F-=U>d%xjDAOWL1nP1LCf+jm< zJDDdkT7-E@s=AQ?b-td~xsVZjuRBydoKgLK7pI^U5bT6uW|xv!-45sIvsYak-RL*+ zrBP7<=Mz{}EnqZAi7swbkRZ#6weK=txTdCt@1eh*(mXeZ$i`Pf1KprffvMu!7HW2# z*gaCSQBN8=33ag}3mAi37B$Bg}U27_eNp z)h4B(^jS(?dfaSRhvCyH%?S67Jki7>WUZ@A#>WwngeSA@LVwuD1>KK-vF!v+)?5+3 zo!7>-k|DPrU0ry+z;4P@wtzbD6YeUycZLE&%Gw zs!4s-jCdelb$w7sTnLK}>rv{)v{cCk?aR~0zyQO~58Fwb03&?UOkD?s8GV%&R)LLD z_P$Jqf;I6?VNpRcHN*Eqetf8)7>d4bKf;b`&)7yFWs8&Cm*JDJHXu+EPNWp4GdWTq)|hVw!$`or|$&bvyx$RmTr6 z5kp3@*NKKk8`xehF?#&p`B_*NmO9GSjPpgmD1K@Kx%Si2nwMCJ+Ip3PdnkV8wuo^4 z+89OadGOoQ4^*arAn2_<&7*!voFo(E0>*}N84{oRT+CJ;;$@}kbB^uHQlsRvW0enX zk-_f;im~x}G9T&TnmiK^WNpsxg?ZP4!S-|K9&ebzx3J^#ZO_&<^W zsC*eG;j|d29j_U1babStqobjvB_$;l@rQAbVe(s9nKXIa;GlHr$m-9Vl7d;+?xLio^;u{q zE|)3E)bmw>;>S?MRN}z$2sRYK7>TzD2bepfi+U5(-?uYZ;BGMC0uT!RQgImtCm%RVMPMq4H20>4# z4=UO)O7k0Ml^q)T9saFObM35(t-+0g$Aq)Kk%J?)_YSbXs(_H>vg;F^X4(Q1ahi`K z#}#b5^fUveu=)qy58aiU1rcpPrN%i%Gcz-Xhlgm+oQg_H>;OQ8sku3rvGDd<1vU=c zm8NZ?p^WtR5o;Dz~MoGmgGeTW+=#u0Z5ED_#UG$&_KVs*=8wT z11_(w3SDIzAGH0|IE*(osM0-SOlSqG98I0?W$Cv5D#OjNV~)ptgYt7ZB~0vCF54{) zGP4I90&5DJOLkFDZy2Z@gGVkCLyN0%CAo;%IRaU_YgXP)+2`E|`lIGjR=%lv(_<^P zl%HB^u69V@Gx`_g{1|4^14^*8rZ>2Uo1tI?F4eU=;Z1xli>TL6>5kSTC1Og)>O{<) zoseK%ywY2VZ00IdT-mF8GPdU2gjYa{#?Kc?8Q85w?{io_)Okm>5m|&<3)<$ zijd2|ScJN-uMZg+nJ)ZVEBSn$+tZ^Gx~EEwwq4u8Ov9Ig@_~hPtq_Q-w6rvdgmA4* za4=^)!_@WR&SqbHqDt&dIo_i-#GdS$<~gyvoVMFaxZrcc2$O)o^DSjI=uwL3MSPmO zap=z=tjzltqJX~e^y{xVy(xd#-G40$$U>ff3?F|X-Ux;HSfrpE9Fq68sRjJVRbsw@ zZ2~ljz=w$HXjbARFyJzo$Z#DU#fGN#f6;CWB7|irxNRJ&hafzyIE;+b+xVEjApd3e zV*8qqoA0m=bxCxwRR3sh=WvTX#w&QC5bK8TY?gHQ2&lT5Wn!s?<`_!qKwV|ntIP9! zOZ_De_QsZat(8~n=#La*ck8vO0}-%INz&92aZxA$DThf^ULj!#g8d9ol8YNKFgI6%(Ni{JAM3j9;^UJR zQ-Kg+IcU|mKF5U==e{e`W?@M>HU~b%jXsguYN95fhl6{D#=ggm5?P36Rbz%8$wWrk zIyZPBp9TGG4+AFlyXwB{CJ}2xD*HaT$Q8!6LHP9Ww7;F)DM@>-kbdl zTzQZ6)~6T7m_5M*aElX{ckm?+Zqd4%Y=t6?b-W9EqehGvjWhK#T@!mrBE3vxVa+RC z&hO_IH>c}zak1d@yqv7Ip+D*cQ6uvzzRwB4yZHu)?g|Xkf`hY?oV>i{mWE!vBjV%o z3%FTWFthpwO3KpwO--J$o3*KZuSU&HsfL=qEFi)Qt1nkM%A*1Oi9R^p_Jz~eyH!${ z7#Kxs{s2Bv;rOf4jDPVO$w_j8HkgSB%!xyoYYn5N!$VUCn_k*XrD#O=zHyd}=5`N9 zrx(c8PbxMJ1aDODQHRmG#jeTPU+Xf9vFAh;p-GrR$eYc zML?ORgro&cx82`YH#8JiP(sp?2#)rQX2GujoW}nA+sM$>tD*dxXYTr~Z#$gIfj2yU zmGX{QsCB7j!l_yohEh=6S}Z<6torx!)Q|4(tqpAK{lB1vT2`e-UY6iP>fL$>mvWD( zm>E->&w(!7@MfMRB(nlf;U(77kk2Rd)Lgkwg$c7J!McM7CSIyCs6QNhEe$ zA<#p#VQ#=9sq7->MJE4w~QwO{Q4hmeaudfsk z(GW-Bw+F$lVf4X}JA18xjc(2_Ef1YpMfik|khLRR$es zhCn45m6|*&u3~{roa#oJ>B%JW$V{3Q-q6M~4A=7j*NJIx_e{=djnrrg&CG5lT~aP=eytYZO>?@tTF$C(_L;n&t$Hvy0}s4G1)Ua> zYFcmx{tj4DQ5e*tIy#$*LCWl7tI(j
1CkjR`yj+CS>Vxxh8M|wFrM)trcgamRg zyxldGH=^ivkg#c7`ol&V(gT=PFjt3$&gU`JR;y}c)ucI@K1TNq1VK^7hr^V=5>lsx z%buC0Wq~+Vxh-F`|H1eKft%!0kuoOzc0SdDT^wJ3)^T!h*g84A&V1)&&Oa{z@=X== z@6N%b10a&++714l3R-?l(`K%G*&BPQCoNx)7)`wzJ_f_7j6RpyF~>^X4=OpYxBQyr z&B~hN7?jbEj#n&i=L<0)HR>H6$%$`8b2e-nF)~A+*V?u4IpN53KElk@P>$^piIHNS zvl#^AXZ4AC!%k|4{8UklZv9`A?)H29#}CBVSbeEa<}oobIEcdV?nta850N{2+XGvs z1q~cugNuj;kyEkt4ui^)G7DH2H(t=DF1gIZh^O1^W0Qg@J|Z>b1%rm+P%rD6F-%~* z*;~BG%k94&V|lZ5U4POc7G&%2O#M}7doz$JeY=HRU-Q)Ycx_^ip8o5jf_pCpI6Yzf zZ=$>h%>cR1+l44R0t53Zs1eM+g{`q}aCklnO-4r8_g!N9jUK9mU7Km76z<2@c=tdA zueUkvjvUSmDAm|Gne;Dj5MFoi*1Ng>nqS70Nn)c2GlX2mQ}j>)9eUo=qC5SriVd+i z*Ow>7=9I{EHXhL4vmD)0gzDKmDgR6$-1i5}yg0Je#eHL&C>UF0I>ehF{|d-*7`hy^ z3VPe%J~cdTt#qJ0Ucr_~5)E(~hhFLXMW?a{V`%#!QM-0U0F{5H+z=QKsZ!lV5+ND; z$zgUKC+S|OWJ3{8G|nZ&T@hZ8m5n3sCttsnejaj!uKI>fBu7JIl^NQ}Lm#9dLc!uH%mQBY;#O2rW}}xibqi2Tt%(ozFzgozEPUmuWu6|c z&2LN;hrtc z5G!#Y>(%u1V$1c2n$1<522=^z-IXiB)kshT#N=L7hWiLzn`erE5|MkHKOz?V0RCqM z3{(|+yStqv(CT-Fg;_1?G_aUMLqk9iNK8|cDkcVjs(*+v=K1+qO<%w0!646M=gCT9 zZT$>B5sk*#qI&oX)wEc57U9~^@8yEdAKEDr%p+AfIOJY2erUx^-Sk%9gbU!_%v$+$ zG4Zw{BdR$!e&Zuf&+V5WoX~%OgX3K@I=e(3Bh!1R_iR4Mh@rKLkZaZDM@P?>H8bX4 z9#GQ6-c#RP5!071tNWYcOM?eB1%HB|m}o_5s4fZ|LK3}2O$)*6YWq)Rp=aE8(v+G+ zU-eOy7B^u$+PPJv&1fR~xFUA!1&~X$K%z0U;c+fn3pWkYK(j8a=6N(qCdt0%GRyt4 zZ7b*4!WzDdY}0T2IpZt%YEGQG>zx!NIDnOltXyaj$j+Dgrlx_xktD$p{f>{4l4U^r z-55|hfcM7ekmQi+7ms|2uVP9bDlsFR2ek|)sI*>uD)!2gruzm5XMZZH&U!b~)Iy_? zW9`+GEE`*l>#9wA?-s3%B0$cUyW?t^zsWWwC54WWQR7qj&z2Su;pV0$`k`yG^*4I4 zyNaQK0s6|eG5&w9#zfP@=<@h_u$qfJ(=!WlffkGj6KCbNn2RJcYfs5{Q9^UvKk1U+ z^z~Qdu&JNj6bw`HMMyE{8^DRkjbq3 zJNr9s5Mo0LlrY9M;Y`q+=bB-fsjP6&PSf{OCz>8Pz;uRGE((%L)_r zGqiz00uu@IlF~y+;A%`0K4vgAwv1Xq`X2WjkGHB0^Oe^1o*OS$lN$MzA^qA^m`5f0 zZB9zQgo?{MR4D7#Rh9OW2(tb)efR6c0#{mNd#_VVPYu#UZMyh zV$z|=cv7s{!Dbb9(@IlaUjl)#CXO%N&F}+Ps=msO#>{luqpPr_Ust*3w-VMd_AmM<1A(d) znfY&KzytF3e&2Gso)j1KG9AOk$Y6EUFcYR6bsK^fVLchJU($CC{IU)g(HM<|qn&{K zknyNH;b82vXV#fill&`yz%z1JY_cyAF>&yVVWkf`+El^=oga^EPkHh-*07CAQ4Wf0 zfwlF)655mOhDgOwiE`?Mm`bgBVT6Z2!NKEmjf6gj+n%+a&C0=hIwe8O*%>o%n>Yep z>pLH6gPa7|lMJ7ESD;XMkrhRKB(MCm2VWVxjL$jdxhd!=Ku(CJplR{Q*FXJI9wPw} zn?bWv&~|v&&V2f~vC-t1A^$V<`mS0C7J!ladlN?mETF)pp8|CyjO4GkAjwkf z#)iOehN%kPMCTWE-StrI2Li3kvtyMDqB{Tn!-Fn<$Lrzl*TVCtQT038BobGOUZPVc z4t~C04>v>~g^c2-YTcRE5~X|qHa72Ds*skJ#(}{Fo@f7T&@Y?ol7D-WPYPXbpg&(& zdl40EiFNl>u!Fw&Yh$0um!dv95&h14@jJ^nS?Ra@TWI$A)r_3-R8eVh)YFx?+f`hJ z^La_3U{cAPB2EM>rn7sF!zUCfn@rBGI#DHKf@NxECYP!|)2dSPZiuKdIJzK$veN3L zc_rXIr>}b9KdnzC=_K0THS^YAvsih&MyIB;Ljc8_97ATPZq{{vT~rvGDi|?4^re zyYBAd<|%X)XJm{kc}XlMY9gM!nyy$buP>BD77klqU=)y8pAItha!o9icAp*d|EK94 zXw!XRfyn1=W@p^J6) zcED3vlk<(XAx~mPBE@)!e02#qcWwu-@Iih$E&0Yw5j)nlVjV8*4LrTIO&hU5l&*{`xLpzIgqtI-u* zeUOE%Wo$wd?5C(f5I$*1SFy=iu^M!;W0Cq9Ww>VEH-3k3V4Pl>>KGbWSSWBFpYF;g zimnO~htRAk%Y36Rp1kvd0XWvt)~F!gvGKM2om)q}gWK=wQ-aXg);17=>`tYFw{Goi zqfk;ma(>QZuqtp$5BXj^`Olbwi!Pzda5!>f`%|Z`7QDn{sh*LZ(2&tTZ=7bQtYGyl zRDz~wsB0-^>gsxw-q+h3`_CuPBbG!24M_^K2vS zc`o;^K+x-%VVJsms^iUSxV6RWj!#(F++U+Z@_`i2ttT#Tow)gJ_(&L&Wbu)uL*Ob% zc<+sPurk18m*dVKE{cfwTqG!X^4c4iZ09KKY%jc-govG!bHc=2jhNT-<0S)nkT{LL z)=9OMji*JYO|@qaPy?STz_GN}X~tF~FAkCkb*?c%T-Ma_rp_P)6$v z*4xOKx@xQqCEwgDZKIbSv?jUWr|%nmoBg&Ei2X9BEZ{;(U)6~j53&;x+uKJ53Ab^uUvh^?CpXZmUC-!r<dw8%zO;wtWikeRF2{Hu^p6A_}-(pU&De9duXJbk7${p_l+hVad*pj_l{Mk;QzP z{2k993YGXogyl`8QJ`%aN0*JQ{4Uyr*Rj}O`UYhc4X|afRCvWV7xRSF)Y+zwR*zEI z4XEy&Eufk9zkm`D6}jEro7ZF#sn-}pfH1%2@bORk!%D^eK}w_RHv|BH-`wnm9JZAB zG_DhBzgOSywHpf{lU4IA%l8}73gCr2p(m&^5fVC#E1_T7q|M@MOEuUW)AdK^Y4$3?nODui4=YglfJ%!i>)kPt6yzDv zes1h0nHyAC5zp$<*hqf`m{!P&!SnSB!EtO|w@Y-XKhej)+g9CGj64kq zZ*KwAj;HU8OvV0=vH62u*~e~QJY6Z;ek$n}`H$Z%#?_unXJnQQbbSY#X|OLW@K|cM zKoZKm>3wKrJcq<*x7fr!rE?S}r*+JBEviOA4k1e5|ac zpL1e7o=8Av@ev+D85bqGx4%Gd!?A7_5gF4jR1wJdL<}l$Ki3u_xO`1k9qa3g+7}QQ zqsVAs=b)oo4gP2@_uyUko0~7u7?_C$S}fxC<2OLK_ZRh5V!z*bhb2AHPoaqB`)wRW z`u1Rv`$BP)n^nY54`tj!0R{>r9%2R=Lu z-_9PuiM&T&MG0XIMs5-2if;~os3`1)36Ds@!&VH?CTIRU|Io1n1{2B$IV0x3;s0E) zK_@#dy4i*~18hKv^-d}MbqRZpoy*(L=|je>_?e4EGWko7(XS+4Bb zZWn(%pEytr&6eW&Evo+lDYned0}O+lpQs}Ac+ zk6L?rba~inZ1Fi+uUzZ&CG|(56z(WuooU?9NEGIESyoLZ9jd+;+0FJvJ0niuTYHTU ze%K}q$JW_)vX2jTBpSR39KH~FCGH70;oom@hD=_>M=Ounn7e1@foO!E-&pH!+cb;bkDgz)s#VxH*nj__`1%vgz(ejHpYFwvnkfNcq~&>;CmY95`=QN8}46>YT5oZ2%q~W67t8EmOD8 z2fO0t0iCUnl`U;f+X`a7#12tlhoDYGN=^~P1`0OMx}m#n1Rw$=E6(Q}Z%O@+pqN7t z3`)@BsLs`>D!|)08-tiM`ZuuyhQ&*p-RZ>XIpxA2VI8Kny}lkX{a@Cd?-j7jMz=*l z8@LA-mwhH{r4{8Ld0#7EwxUF6$$C;m87%_L!EEna78~!oMsIJV!i6O+Vs_ejwo?-K zsrL`RI|?jpJy3->UBq~l5A_AiolM2ewF&NT&ul?h3!{dV-Xd*bO%*7Mp8Z4N_4xQr zc~m}lkeq_I@Jbx*wZ|78`U-@#xu(Lxj*mKBjG@Ru32i$pd6m*qY-I%tj-@iv-O(bt?C?}y$2@6V*k zo7}YaPrAvexK9iD{eCNu1;UHV6W*YSdBXO?BaoTbJI_-YPnH45ZD-Vp=oJ&bk#~1} zbNv@@VM=oY9n1SU?#p3hTwONCG`j~C{dkUd@Ey-Z=PgpriGlkoZ%^M6y{xWMHM~D$ zjYbfAQwU1*H3ruyXz9Z{n`u=kX~*C)E7O%)^{x>=yo8~$dBqe}Ri!0{(4#~&Orh2d z^>Sk_KS6BW5mCdYTAlDEwLF>i>O+}~2aIZwS${EN4ja>@OziK%2^DjtrmT#dhY=}>IK418#J z;gP7~kIUrG-`*^GXX5BsD~sBjb9cXqj^E}U8e*6{R#IXeSb|-SzP=e55m7p9o5I+* zGcv_9#YD^X-b`w-Y&KDKxaP|!%pV%n7yoF=pL_Vg6tC1)X(My?3z0a29URxL`R5v4 zYWsYNFADS6dc2$$xvst$v)_EgiCCcU=02vrY2ZQ(-is&F=YeM1p+Z5_6}Cx=8b*Hw zT7h$X^bL5mXNW-~yPYSnn`vokeM*@&i4t<}0=c`m&{%1bRZvFb33(iSUBT%;G9?sK zlETnd#ur>UgO;`(ym2JrT+N_QJNdZRjhr^Hjbl7EVvSVrdiSxYLB67*hGK0(nQjMf zP03}4AWu$F6fZqt{xJB4U2Fsv3s;l9xpicFkS#xysdp!Zz0)&&$~gz9&pkQw1^ZLW zxhXiAOkJ;c#Bgrn5T|4I^OAt1s#=Ql7fY7MitVi9oUJVaF~?+PQj_kGCY>MO+pv4r za@n}q1_an}NF4%$?w_aFP?@kH%xGJ-edXZ3-^@&5GevHn$}#|etltyk@ePH6+cpI2 z_nSikJek>}h%f7gG0Y@bi;GgaCi2iat{9}SZl3XfvI1f`d)qwESj0e1y{K5906Sac zOsr!ae33|%tZZowPXzI-fuX_T`EO6NLSDus7{q}d-DtJoFbA2DR6jDm2zl?HoyP^{leu)%) z?MlTQw0Hm0b(QEd(pgbmOGQT)Guq(TTQnng$+^8EgxMK5kXf9MQdZWE*Gj`ar#-k% zsN;i15E?oj)?1k8WZWKY$sHh8p3m9-!g z1bD$>zWe-W0Jr*{Mb@#^Zh=&X3hN9}d2lazJ87yuu!_O>8Ft?QCgrS7Nl5B@xRrj+ z3e{|I4vNo>h4s^josUuZ>qgfG`FEOg$YPp2`T5bT;gBM2KN8RNx4Mpv=c=mE-t_A< z7n?9q#u*TuGeH${(S;!T_E5HQDg4GCky)oK)NFM5@H$8}>#gJEEoX<>t5)94N}cc! z%?xXdJY7+<3^E-R()f!L3tRJOV1%p)pMqfKY^YB!#M8SM8u3X6d4`cLL+JJTwRXee zvgwL8D)^x*hla2H6Xc7zTrvcGox0HQaSM@0_^n^)Qv9L@b`rH0AqY*<-VT+P)*lNF z;QF`{1*W6}wU06tVImI8sZcNrVZ*&TKp2673@YGtL)^(7Nu*sNzPrdI(Um|3EDnBr6>R0J)MMB2^yWXFA9E zxlwTeLg0e7`SdsXM#Ym(z&n*KwMaPz1qfFGUsK-#9dmPKS%xWoZG?7!HwO1I(GL!l zt9;7tQN6owYAPR`x1susnE82ZZEfv=Hl|;(e4~6i>D%SA79VeJZrHo(s<0HjLS3pS zW*29b-XG#;KmcBLNpEk~)JCKvT1+P=7Yzz#Ox$jkzmsMCwJ-HLJkO0|Gt}>2*L$^A5?!9-iavF^ zg!T&V(%W1yQ`&WS%#{mZ==S%ij6Jj8S!(Qd$E*MN${%O4eL*2=36?Hq9UKlZY|k#pAF2NV%-2%=TdT7lh3z&Dw<5YY&cimQR_u2Ev~?H3WTO+(a7r4(E=>> zA{XZ>X$q2N|CCks(;w^iGhPStuuyk5dioJaFXY^1r}WJ7kuGk7{8Bv&ncp)nl3H2D z$i{q+%b3f{lvT#)zIB<5USCJFXL`E&u}0)zM3Lp?FWB3k=*4G&j;P8hl+>2cUSB-`_&!(eN?ZrX|DEE>aKFuEtkllXJ(hg`+(eyyL4YN7qZ`u& zl^5?dQ?Cx0h}%?2BfM&8bM%@ouR<+$CK{-q&3RPpI z{{u}`q2l)c7z;Y6P~czCo)zm~W(5lA;v)V_nm}Q6qya`TuJdUrtlO&8b$-@pYluU% zwcfwv$#)>bWd0=<#t>u?U@r ztiHbO?HE15aVG~?JK?9}e-OWvnVRW#DA|s_rK_3T@6i6vKPT65D%q39Rz<)(+5euv zoV+?77g3BQ#dKkzgawz%Jys{>A1VquswW?oGrI>@j?}_5TACUquMzM5p|qd_FT&H! z_rc)|%ceFDRg6n~N+B1jH6&nO;DwoHs!3Vxz6!V9{od&K-|T=p5Gr2M_p2KpilnYQ zB`H0hQ#UEb>8I%|DZ%qR1%cGlH|JabO+|NHa;&??VQJrb_2P$BM<+yLzijVixQ3RN z`|7%$p5V7z&Oe5$HaemtR#~sFoIwK@VPRpjCj_?ZcV72P%gb71IpbJGfLV{baNB0s z=`^Ux1lrpR5~>lX;!%B`TUl-huN2ipExI#3X6NRmL7XSWa#yw%x}Qjm1QBxa@{0UE zYSMPySXrZ*%u#v$`G@Lq$p|3No6s>nq$k+DQ1r-rFk`zvEjwm&4Ke-jA7z&}6jFy} z?@!Z4s4wl|id6VGQA<@6tIrl)MON+nH5H1)+JCRD9h#a->g*Kc;N&bo!pFeJw`AaZ zWnL#S!5kh(3*wLyi2w&JB;DO>$f~I5+;kQch$ty3#d6=={NJraQDw(YBJ?62VX6%%OYAUk8x1_YW8pB*fY(P)>m4Ps?w)<`xHwU8(tz7F~Bu5=Ark@;ubf;o~U zHI})5hpo{_6(+^Uccx_J5m8ojCTN;X+r~&UEJ0(Fr3wph_x0EWIjV?csHF$E5qtx6 z!_bd}`NzM#2=Nd0&rxAw7RRH+oJdH-+wB0)%MWbWDP?H|7!7o}CRC!O^|_C~b3!?g z7meQo=o8=f6-?;N?XaP;9mF`(l=^zty?ZDY-xm9z2RVz8#)zb0ouzP@;m0S$_Qjy$ zU>cU%R|;`sc|mdbM*ZzCsMFOkyt)08e#f(D1V#ARR+)Q? zTX9DWlBt36TsGO03#7bx2rPdv68Mw;S#36@43Vef5hM8Joa5mN0)o<$YERTu^^_bX zIfOn2!mJ!_12tKqZH{y6rXpRGxI!(h2R}t$*KapEEVh-ns93!7ja61Mu_|%`0F$R{ z9M?!=hr{=G@(|)J*H)#GUWu z93HN0o$n13JMj9+lo|h!;_Tp)ij4wzCy=nU{~XuVp(H8uX7`5g{jHdJFVdMW-w7@xSnvY`h%%D>=xx+%wSx`mc$IAQhbr5VK<2jwCBfL%yE zsaywU89_MUWl{zY0KnYd>z`L>&jPgXoSnAD)w1>nF!@m_zGH#6Z}eo}Z@>?oS^U!u|@6VCP|{zv5%MT2j{8 zL`%io@$mHG@Z*u)i;4l1N`9UK}=+jM)VyL(z%I(l?BS4LC1 zY9Y_oh>z_Qnk*hK;48qxb>;}}J;o}AxaJj0fC<~yn^&yg{+(ElQ!4T(D^909L?XoPO@mjsc(1? zgD2vQw@(8uzH_Fk{Q_)!WL1R-Rxvq#VzF*OB`0XZh(&t( zL8?{FR7J1jy0N}q+SsV^c$`^W4+ewtQN=@s1_lwNNLa~&9cttTNZkGAT7%JDU3<^i z&BHg#(Um+De}Y-AmuBY&Chro}4+#Ix$#EDLmf~W;RpMe~Wc;7m_&Nu0d#xTw=gu%z z8}6)*795=~YkCxZ-e&PUzBbkR{ev&l&sXcQy0yBdj_Gpgq9Oc}*7f)eW{jy;Fo9Z$ z2yFPYxw4`TFFkVq^eM+6#ny6mnSL6YL>|Me=JR`X_1UmUPF`NUigMYIE~c!iD*pJ` zo`8S=s|eU%`QLNv<+c>ORYqQW6wg&`elkGJKZW#^67BK8*pR&pcfFJD*okn|H1vVq|~WqVP(~MsvsaF?7@dx z%nLoIVL@6)XHf?&!IVvo zOV26Jl4}a6$tkb?e|2^3e@SIqynJNk^s;;bE??y>Mh1AgMrlFRp)ll}PGvJ8tFTf-ekEgv3yxj?U&vOY!z2Ya87?tXixCp09`|M5WiGLqfeum6NuKGQns?=jbD`U~6Txr5`i}v`N;~ z6fM|y$gL9_xY=o?=~yf32f-MCS`}hjLS0GwJiWlfRFU;m{w;R=mb}zo1X$E|dNP&m zws5#Q16sLMhDEiR2cO8Cnwq0NvI{kT_~ixb0_M((^jwiUduPko?w#D8tH0mgx`?HC zK|$_;$#PfeBEj{BjvM&GOs~_2yplO>5hnu@RE$#9!1L#4CT+c!J{#?b8~X>NQbE0l zsU2FaA@+jOaxNbIYOS5`(o>g@AQzfyiRjPuE!L*&moNCSy3Ba)%PlB%{%eTTuPBJS zZ#J55u>*~`vfJ#zhP9%Sr-9EJaj3TP;P1ZB*92x zosAEq*G4?P?tk##%U8TlJkWvCthi}@=Fqa>MBjjNz-)rerG|zjJ&j2iYK+4qPPJ*_ zYCTNY483Sy{q)hkw6w^x{_#0EdCU2cMJcHp95w_N^|R+WY`Fh`)A`yYz`MO^^8W*$ z=&CkMHQ!^ieew-=C@a*!>($9rGW{U+taZU7`Ym=pHRi8V=*{aN=N@fZn|bmhZXo0h z2X!B~g$XlPr4?nWI=`)JIVE%=E&7;?TiVF|`bfyzV@ya0@+yrlDd*+KKbREMm>Fdu zp%E&{w9-=AT5pY?FkrSeDLTnKe;De>9iqw_*7|32~f z0C`i@r^}ux>64s#-6(U41DoH`)6@Jx4=&igy_Z6v(2|nENGrnJ-Z}R?;z>jg!t8ZJ z&Lv0rt>%Q~L}7@A2ErHXKl_4JwCiQC31bmebRP7}UXLCUx5^p(Crt&u|az9?{E8 z;A!;_pOAqd08RfAC-3IKy0fStl6^gK3)=|@Y!W9K2aU!3%G~V zfhXVONO)S~!}sCC6^b~-8bVTsx`L;Q12^69^XNUgvcX1#5bAWKSn(^FioTcL)nd{P z7PN8O&NADJW3I%;4gP^u7WO)Ok{n&%GL*r9-}l<|eAiWSndCl+#q%LUo-zRY$w)*> z{m(sq$0*g%;szO}0=D!F+`I}| zF5{Z|niE52ZGUa&pR@_^?Xs&AmA=-7Cx9}6KlNn-dY>G~cfP4G(ZG<=YvvTwc z<5h(5%xxZZ6+?|f7-=NN%j=@MmVLxiLjjGA%bo26PC8O5KUr>7$WNsmmv^g4Ek+f& zmrbU-yLPfRyD*bB%b+%}~CdVKJ?GGu9utDTOB2u6sIFmG5G;InSsx{#j` zwA=Eib~e}Y+{_U{`I6z6kqcbKgd;BR>-ZG86=xb75bZ_`nrKdN71R)eSlOecyl#$1 z2!c)+$CfbEb}QVWOQr5wZ774T9AaXGqcESMWLmM1pDMoxcQQvhnO{P#o<+3(T$h6U zWc~X;qELXnRI#sWobN*!VKwjtqTj@cZd#Bd`e(J-DPkBFqVUTHWJcEOXV3g}n9odu zu7~8wG7&zOk^6F-bpYVi>uaZ5hX{6r@F=snUNUZ^@81A8-kPmTAkzz%-X$d3Quc#_$mAYu$W7E z6F}bMa|+tD4n7)n;-2J8MDh#Lj~(M|0}D7`UHSP}VTy{fiV|~kbx(+z%eZRbz zeDdWNWbfo>U*BZUURShk&7b}e<{WA(sx-E6Qam5%vPz9)JrrFQ|pzHH8*v9#) znnSby@#+&dNZwuVGCo6ZeQ#HH_4$WI&i*RvZoiO`871SK+UR+3W17}^?Dig6Viqn> z2)<~OS2Z!{8Dh>50~ByIr%i+qf=Ioay*fy8@o!XzszOOcYA`UJCJ5v2Yn@(D&c zhqS5!L7Dd;VgHyYG&D3RDk_Qs6C2y3Up?^QTU--$1YPh0Y~YCL;4OkKd*8Qts}5&}E$Zw2(ne%C*Xe(&ZpGc%JJpPrVq zx37Vi|M>W@7pcfv?u|hAvk%l<HqUD*r$SVBUOZHOqyXz3+MCIZBTfh>U*f4wB#F?|qo98OC|2RAo27ZDqqVnheZ$jG1zQg2gH5vC(q)93qY zQtyG!69}PQM+ecv=4BO}^BwKngivJN76v@I2@|+73^=W*R(0A&QrUJ)Stg6`QJMW zT!PEmLCtdXtl~^w=M)}VzAIw(;jSIMXWx7AcPU`aSkyJh9nM_OT{FKFQ20%*Q}~Hb zu%meWYE@hawS^R*1G>`#7voB@TQ$LG?7}Ao4t;tTU>h?NT9k4n+J*N%=Uo-&JcR|a zhu4qyle72~zVcj%(qwLfU$PdpmW8W@^1hxOJFXOGpT~dJSkSZ4Y|l2|0`-|U8MiZs zR!a7o*YGj0u)=O`9K|IiWm(J;8pturyQR-DH!VF-G!zeep_PG3CG^aT=%DEFbEm~} z9I1;&#~~(oi!8Ey8*e0R+pFCo8==MN&b=Zj%#w5OKH)f9s$qdSr{Oj)x2u( z>^3e9L?r8hBJ#Y1^CG;X40y~&An%jwZi1W}>5jE3-XKV|9^9S^e3~|}+yXk{Xts%6 zrEe3bj~sl=0V2sIa6z%@v++RkccRV$*QTXz_%(XfRG?{77rdW4NrF;|v#$gn8f^Lk zSB(lT)I4NY{L!s{)oH61YMmNv9x`m+F$Q4V=x?&($}h_`?8})*|H`?Zmy(-ER9=_0 z9(=o*tc@X7zU5cf`xofyQbM@4`Ma9izNd9pavtQWqJ3e|#76#In<}r;EUW)=J2BMt zU8Txw+rf`mZ2fwfW#L?=b`wFraI9>{VJCX6^eyL5D2463EC+#9)WJd^@s#Oo(ti>g@D-$`Pn-+E3NFNXv$gECRcnwnYTz%yXciu= z08hVkt$LFfbrxJy`<1a zp;(?nogW(9Y<26iFzjxd`EJ6p5thrQmS8@G&f5-B0>vQ-m9uoi3b+@S2~) zkB@gh0n9nEsS6l17e?}mtMC=mXD5=dRP2%`!h)E;PatM?C6)U*4%_2;ze5LvDmyas zQO7bXtnMZpPH7%vEEl!6YG(LWE22SDUBHYcA>s|T__%p1!|a^P;Nal!^77I*Gou7X z%RfIms|;I&FqfX5&J+k(MOP1RCP`OvTXhU(sTnDZ#2=nGo`0?y#=eEA zZKNC*+X}~eXbbzauCCLy@sRm^iZ*UykgXmpp4}u>!oBB z(2Gcf9DRNg@G^t_78I5(KE1X|?hzUgS z6mmt@{U!m$b}S&f-%bJE!5fs>xw@_!e6F_qZBaoSf620$gFEO67ev5Wi zk*D6%+EzC(l?Z0Py_fEW8|a0!9k=w)@C_2MR_K9eS64{L$jGooJv}{17NTYLwxR!?*ZdbcuErNbuzI4^1^4-)Pk{eF#x(=OhoB*j%|9#x}HBGS4nCP>1C7 zVkiL(xN8Y{aXUnUMpF+gaO7v7bA+A+81HNdL~|^}kmK60K=8iB3QSj16>|IZVbezu zGzegKj%6qJ^NBm&s3~avh+>Vo^v{q#PZD@eKU2KwSK&h@e&Mn(6q;3cqk7AE(+pci zYxp>o>PwKTj(`p9MH8_d*v-EsNwM~<80-eYyB@+Zl}>UAQuN?yKT%LW5??!}T}y-9 zgkXa^6+nT}ns*XM5m)*NFDPZzsl~ve8Q&sx#h#%0EOQVRj?M#a1M~Ed39NycU7bX$ z;&>2aOJVNm!gTtFAVn$Fn@AgqaOGeNBruyHX0@w27vBMA7Z(WF*x0Z|1_lO6_?Rdf zt_205Ii0+2TEujEWhQvFC!(EzaaXgUi?I!#}P51G1;!g<@Hg8+V=ne=hzi1GHo@e#LwR-x$t zHNiG?5&Q5V`9N_If^U<=&20-zCG`nK3%O9A#KSyTz}9dzDai$wBlmkD+8qsC7DY~|{et2>bb8PPaB z6GLHm?4Qalv_EEu49CUiYVR!{Gh43tbP+Mq3l1;xUW$P+K9e6ZiRq1wuOHP28!o)< zvCHv{A@jHPZ>APmWxrbh?zwvQ%ud*A2SNMG{^hnDN*`)PHEP-GhjudeGA4qG=fk(Y zGG;I5v^((-51R*U=)ac~uLP*BYA9Oz9g{m)=kACT+xB~SxC?AIfgC9W)+Uhr!MO&J zDVNd(%yG&lX3rCX@k7{&+45u#m6>J+aeOVc+E>K7Po=c=QSp`UUSINineMJuF4!P= zRenMmGt(%5&!+dy4vF>+MR_YghDDhH|dDyp-c_JMgVw zZetBNYq-~Vv*Fk>j_)`H21cW=L{BcIQ1ce<-WPBQsHSR_3zVjD5D^HX{k7r17I0<$ z$Ks#t7L84&PeP@2wVW^4X41$w{!=fJ;ltu4_Q>%WN1xkI!P+vtJ%UG$FNyKZ=p{nX zih<+c=y$M=PItq!tLN@@e3kUS=nBj2PWG&AKt zIa7o)A2VKRo0|{|i?ZxtyU$O@`~s$?&XJ<4`IlUTJVuCFjg~$Nu-{GVy$lM}PT+XY z1UOQ7O2?pL7jKUVVY#37Kxo8E6^)k)AlyM7#IXjp(OR%eTV@s*HnN}m%Xb>}xNwp} zTxmOq`SWsygNN1fyQc5XdbEff*+*vc#~WN3iZz_@m@KO;a4uLlecdIfD&Nc^XslA7 zQlv+JN=)1~{Bk249a%q`X=gmxv+~z5Wq9(dL=x=9`##6v?q1$RY=x^@agg-qu!XFq z4xy)>))Brp1oApQc*%IQG~reqh)EaUJ*&ZRBwxd&X7-G;$*`DDupyOPVPdu zIfIa)KPh#0KV@9@yyTX(mCEQjqFh;+I9Qr4p2xg=<6^mTu+C?|I}6!Hl51-J(v=XO zHnftX2r6TX*(~s=c*N)#6WiCPv3uR-+3oabDick-x~hsIBFfbOq|TahJss+d_oW9o zM9x}i6g(8@r4DRqZ7JwrflqnGO`>yNP)_|BHD85+VL_2k!-(o7!&*i&F6HAh%4heG zISQHbxNm0R5Z`s7g*i&tM^XEt24aSRj=}u2KIn#z~pcs{Mgf-5kLA=C-!j1^7vXLX0ZzCSXDi!w8 zJY)d&vHiyI<>>Iia>nkJRjkWOwc{TlFyP_ijmygDP;2jiyn@-DS%7$~Mn;ZId0JX6HPfv3+w(rkx9zC9WCqW0 zs=>KuR3`1!0op>$#Cj2)fPJEx4snvUA1zvHhz?&60#Qmsi173$!U(~{3NsFJ16!~z z^{>_xWR>_d8ck<3t!f;>^ftT39(bl-Pn<_YU9q}zOJjurWrh*VOwR4s;v_{`l>mS3 zl(EWGHW2#0iShLl3gcz{FaPW zbioT_?^#}=Pt%+AFbl(vc!hMog;BY%r zshdyrBTYbvV{rF>40to>mqzUtVu=o}LQ+w47hDtn4U3mz7$|xF9TDvueiW6W{H+lQ zzO+niffAh6)j%AMaj8`k%6OrVclDhG8uoxr4IlQ3D0Q{Xk=K0Q+r{E?;Maku0LP!` z#Os*8#pZQZH+4e!2`QqaI=@+NoRS8pdyDeCZLPuj19gV6 zT2Lm?8Yg6|!8!e;T%}!WCo@ql&ufBE%T05C@aqHrElxi&`{^{o?;?UwPSc3)GGMDI zcJ(?t+%weq*_;-fLx?LZ@L=94@u{HAX&;J#fuVzB+^t}|T%c3=A8llc#jd_BAbKbV zU?NKEsjQ)cGSALY4*vpRh2o?i+{CI{(F-;&QLny7D?>X|BVYIbnS^<_kOxI{D;(=M zcUA4!<937PB?m)6Ya8zeAF|Mv4-_BD)u~Q=1GCJlMa6pB{-Ns{^vgCob_V)lUY%)0^BP&#LMh- zwmM>}nvM_v-PD$GwBuqa?4f1w>0gPLm+U$1qVm|sd+5FEvsP5~p;LD$!sBOv?E0k5 z@8L)@^qVw^1c58K_j8?>v+6%Qs7s>d8T?d#Km8^-CM6MdjGO#0C1=Z-2!de{}|BQ9xF{(O zflm2~FpjO_3ANy3S)l7NQV4G^*D8upIe2KF&K0=XL)~gr(AUmD3s>7#dtm!drGf5l z0t;-WkqSTih$6Nyh;)}j$02gG#o;(?#$rg?y@UF%WLqm#6(ni1qEYs^JR^HFrDTZ+0D%@W!}?X-us_pVh7UUC9IY_ zoq#ekl=XDt9@K|C3>a6pMM7d-5WDWkPcSR^vuRAv( z!CR+y3|MEA-}J&S_I*~4I18-QW_94K@qX`j+{B5&>A^Yf65a8$!l$YgP%=!VhTq7s z44HB{+Dq4kvbG6!@*FscyO+@MSjK|l@~4>!5CjPJTEiYyZU*{jAQDM!4rZvJ*S+!$ z7DKLhC=71cjoggY_7BRPdG=oGY}D8V{!T5&VcP{%HCpc+y8`LN-1mq!eQU3EqF?1| z2OEWmbl+!&fX`r_yoMu9PL28Jx^Y8EctdI2eU~Hlz5=&oqQC3)*K4AFovrL@q`}12 zmYTe8x>9g1?YCT6BM`Qrr@lhC^L>?bDz(&j05|~Wy;*UB$PJXx8S6SR(dXtSLsgBA z#rqS~QrS}WPk$*HC-GbW$Q7`8oI%;=2MerR`z2SJlR4hNE4%htJXXL@cYe~UDwvY+ zR+Bd{u@}x`F^daZOTF7cLUcx7zA2cwvI6`Ww8>3-$m=_4+Y4^QjHg#=yNVIF>R}u% zMQG$PMr>ELtF5YBcn~52f|0Fl%=t>K+++TQsD%DM!ZxFyAuf2*h?kTM97mLyK~%PP z8lPZJ0^li4v!^i$arcUg7cY^LGvcm1v=kOJz)8gsqH74i2K1GwO0i`P)3R&V!d8wxiq0`WT||5Xv|txb*t6!=1b1sEp-> zkGkY2#0TGdd5>S!jUGOrr(5>vho;y*{~8qma#p0hTIVe!IbH(isH{d?K`zVRe$U;% z?-ye+dO;&-k`u+a6ix|DzI)*^SHO#z=_&BK$1?5rBwXcK?9&z_{P`X~+!slHBk|S0 zYO4~=u-N}`LsYeC0-4)^agp1FC$%Y?xTTFK=ZA>!>B<6yfEV0Mg$g4d*EeGIIqPtM z5rfkR(4AiGtL?!($}qkC8iQB*dZKh5JL?4U{MPxi5nmPw%{EyYT9#3zM7fae+GHH1Ns`7%($6$i%OVVj`6`p zHd&HY^K3o>Sv0{>Ddt2mLnDfQ-A*_z_X1y~N9Vk3>YmL7z<&DHdk>_Y2%Gass*1 zIA@m>eON|ce?RBJ-}UFRAoum*S-hj|jv?}@iwR>n4{2m)MEu>sx;DBKwdGs)Di~h8 z+XkaaH0BrUZT(chz`8efu6Cm%$j1A}V3#qlNvWBz`bD-Jy&Vx6xA5R%ZR{h)FY99L z%&cJU978fYu~kpum$tNnhEU!vBt5c*eD5$Y7?;MPUmkJF(;>5k_J{m}trzex^E1KLjq{N}N0|Q)KlL236TY%aU^UYh|pX z#U1>X^J1El9Du|h`9bWh0hpk zR#~gl*uyM9`@ZQmCO zY%7q3nCJUj-c{{Al)^>QQ3rGyKbIagj88AXD&iV4TDkFBwZFrOZz$Jm=ak-Q(3-ys z%^np+iJ2;PE=}2EP3x?Zq4V&yq6}V$MoHTKfw30g>%U~Y9*_5ox{{w{m`f;HMXUV~Pjc2OIfkNH0T-7XCgEKpc5kiid%uGz zGWcRn*8M_7mVes62tt&e84F(C>Q(|v2L0Ui!nL8A8A=sPK64rsj7oA8WB43pVc2TH zccJzRHJ)(aIf)F><}zi2@>?U0el(qxp1_2{GreBJ)Mg7n8)4uU6>%X4W3~+$@7xBN z9g>yF;|6;Kd};ae`a{OGALKJJBZPGx8QtMvmdWQLH zgls%-)ma;Z;&RS zam0ydX?^?gi5*iHaK?9NUUZFa1b(%J7%R|Pd~=3gz0<4aD8owWFViVg^)B{S4U3y%~O zvrbOLGjZM%(}%g88%kHb@6OMPpL&3b+S)I1yni%j{4p;IQAU^-^k-U9LgJ^Xe8{DO zA5OM@c%RExFn%}`=<9&UllPma4Brq863Y>pzc zL~RHjY%kY3JeRt`-)yGI?<46(G{1*w@3vhb$@_Vrxc`zUAX&kq7bXago>z2sG{5Dz z=z7uC;hPpm-1hB8B6=A1Vw1hu*5X4z$^2(1%;{K$Kb{t>;D3;LIPjulRQX=tG zv_pH4g*f@&q3J#Oq2)cRrEG7B{PiKxadR8}Jb4u;@6QqrIu(WmYwIMKjGW#>Ju z#IxE5(Wz^A^l#9EBl~VBzhnU3Osu7JOc9B6Hby8XU<7JN`-FhCxutE>eC<@o+=`id z-XPMwlQw_YnI8J{W3XAdG^XA06ncFtft3&)9Ua-nyaN88&SFV8dgAr;KRt`?rGUu` z9$P^4_JZL1H7bIJijd}NNb^fL30VVp1?Hb{4bMJE>a2LXT^0mkR@)-!@wgn4mp^)w zm5v82kJtz}<0yJ%dG41--%x!})>OfeH~q9*%;}$qH-kbC*s{-Tc1l~}Gd1xMNi7Sgh|+G|L5z({b?*sGizA9dDxJ~?-`7mvNgk)Yr;RSw zebHJ!aF0L|!IT_Oc0Vdb;c9W*{Jn96&1mJ-_Kdk)SRbnP6H`vYz^#28Z_k`gvN}Rl z`AXQyk43h*(P{s#oOnKwB>@5)4pl8rz4G(e@TAflLjK0Otacv@?cfP z_>*^G;*}6wT;xdadU2F|??`_QzOs|0h$vC}<07pmNhDCzdFXGyN1g7OH^T5+#iMsp zxU z3}fd{GG}pG;kS~boZ;-cq%k{6645}7-8Ci?$%7I3>a+V@c#==VF%Bh+qvO1pJ4?#p zJJIiX^~*o%Zc^++}L8crw4XwtpWj?YmJT~YFQj#q#5*jvFJx__7c@w;w+h;`+9!wpWuY; zof~hPl=2pDSM#><`9MBYQM^aXr=8EPIYY^)-g`4lE9k~Xb4~L!9Wj zi6Dsm8(4-np7dxHnFjVlUw?}NJ&A1X8gCP zxj(OU8Nw7qXX+c@;xdP;8@P2jvn12E%RRhuA%LA5=GgwHnOUKzb)&V2f-w@COO&#~ zw^+$5?zOcaYvXtvZijD|WeihdSSj^w9Yly4ZrNt&b5Rw(Yfzig4R>-X+uyF2R0#L!qyJo}eRWZbi<3+<6Y$l8LLy+57_K+fAh3wXZT ztf5X4*P^CP) z?*8p(q`;@1xQA}EJm;>So#YVyXXorP0_UzP6!Qvh@Z@#VHZeir<=^_h#0`~+wyysB zX+_*T;r#?4osG6hM+lWcpGvQd&EF@tEwp-OF-OZaO{=$gtn#4%f(A+B;p@QHO zy3mu0OT$!rLN31ZV+ZCUofvQ!M=2-eZ{_d{X_ix@kTb(`&6ztFg*u5|4&p+ASzu3K z0?1;GZ;67}JBf@*%ZxOmcdDrC1%pE)NykgLNx1OU*y{wfheN7IC+3jnfV^SnPC}=M zC;J}T(w-UVBioQ3N%42{S@N7?SDX-VTrl?Byf_a-X(}fAifQjzPw)S(p7g~vvD1Oq zyC33oeL9F4VQ9o`++?nD9g(2@u3xLD9ZYWh8zhlxT!tR6x3{dQWTM1Gk<0qi{lUw-J^8rc63HA3)_|Zt}AQy@5`!{#5@>n8H;6aYO~rF1oTb z&g6Re+snnaaNkC@l+(ZvRwNvENvT9dCK1-7KKOITG_3PSQU753t!dm0IvdCkC9li* zyDLKyIXDX8PUuA+yL9_2Q$<%#v6WC;Ri~V{>zz*_Yx8p7{+=}gaVvPvse*pFy;TxE z0%zRbU5aTsmp?%Zp0H?4BPvz^Khb_k|;JJVN@9*8FY?B&hWgkc1f=l?{$u z;aO8k_|EwFly>I0MYo`(Jb7-_@^)Xq8u~_I7rZG;RgSFtE?VaX3WgvJ0<{w;}0{M zcIOIf*)p%f>BKvp6iv+D53B~)?4v70jg3|KmwbLgs%=Frr@G-uy%vggS;sOdwbMCX zB-_wyNAQXBAt@cl_UX}yTK~NbY@#2}uD6->_H;#nq?hoqX?#cx87aYnq*gQ>rxH4n zY-(yIAJiqb3AgUkVtckrhIC_Er&_l2FRyieErtd^bO?CQsuLMMW>u5C{SV~o0Fodx|^z&79R)KW381mjxmj(Xy zuY=*HtFya2mp?-mr6gBbyom=gDt5XYP$g^IeynEk;Ml43m!S@_NPMCM^BYi+jLN|f zsqas5Zx2Zk`%xgijv$T-h9b;j188z-{DnAZd4HwSOG!8(F>OQ#y~qAi-mD3qE#pW| z!B8d*_9jsN)%(M&e0r7Ljzt~uBN4+kj?=Ie}oWW9b_TGsx7M@NRjE56BJsneki#hz16 zMS9=Ej;e$@3p|N)qEHUqy$J>sydUq)5Jmd8+LoaS-$9_RTnDDm)pmPkL zo$c)?XL_EEI2e0wlsaNqlSGW5yjVK8@Rz9OtYU7;g}b1Utj^&ajbZLyT*OQ;Lw7y# z^#qSAMmyZp^?tMU8so$Hgzr%(hWW^PfV~F;@nE{QGCpO06iPVpep%OHS1I5PJ!~O1 zCcOTF_IqFt0Q4HyV)SHs~ z-4`fgw5y_~N((JtP4o&~ZZ-qQAv7R)c=%W6AV0kUI@Ybo+lsmHQ_)8(+?^0h<)5ss z0VGr9L)DlQh6H(+Dbnr5;kfKnrt?LKIGpb6V3qW{PVV5TRa@X8??@4h*5U@~kVju< zTAro@zUkDiRcl#)QTS7tf<|P}dEO)n?;aN|Kh&TC0=7N(5fKP@l-WcOe&_th$pMnL zWk(UkHY#(^r7kWBcg`*V)c&;*(SjF5YqB$`cX91?0s}5ui&*3j)3mm$`QX{$I?BKJ z5WSJ+r0=ru~7J5lo6Bk+CkUcEj$LHg*F)W{&!L zI-m@~SBy_5T?oPHxJUL+Zj@NQ>0_tnAJQOjhQ2+}YWIXbdA#rls73EOv|tZXGmP#o zgtInYvsiBW$5g4?RCxyoRkh~?I^uh~(@G*_#u7p!86VFlzFZVyI%)wdPI3!`NP@{J_=oZ0=#WIjMIFx0M1# zY&j;eX8K1ynRd?lz@}WzzvWXaK-VEa9 z`rbu8$iMt|OIi-PV_R>r`#JJ)P%oS^40%NQ@O-&W-F!qVDboebWOdb_BbYJUj?UDL z+1SnlRnsbvz=%kt7Yd{610jwn6APj7YuB;a7ve}+<3TKIyB2bay><6sC+Z^A{2=VD zZ<99aLrJR0Cx@DcIMhp7>MLE|Lylms;Pa9nW~E89Nz0<|>canm*BA4M+YTjLEBGvm z!*k0u(Ex!;!iB2}AzoC?hB+pyYgcS`JaL?gjCk5R{1oR2be<0DOL?P7evm^LOq+dB z#!LfpmPX^t=#{n1ArJmt--$yskhrg9M4TPr$;|x%WhN8XRa}BV>(83aTvjQWTn!Fp z0;jT_3>)4!dQ#GVY>VtVwdwR2$L`!{AP71qL##KN6F6yLaREvi^Bj#eV$<}t%4^BOpe z%?wP;Wr{+TAf)M zTjQ}vSP9MVDD#8h2^a^lA59degfh-u8~@w$KLTdM&YXD&bdl++DcibjSnX|dqHWF= zoQ(g7XJzoig_j}*9i7ZL`6j|Optb476EL&?mw}2xSt0|vJ^z$7!YE0qnF^x)Ha1UM zpNv5e(a{E|ihd;EoP>A=I1Igdk@lUEB2DH-8S$S_Hy?O@BL!EF+xmBW#RqUwJh8$T zee>OsyCiB2N?i+!yl)sG-mePf?+FpvXZ7yuEQdk0Bn$q2+;<}cptfm?H zmYN3LFmS@ZDtr$3z<@%xDu*A6Jk@n%7I|=D40?>al$r1?p9{jf0UB7cO^x;pnZx5+TBEuM7 z8z3#hL1dl^6B?OQu`wnW#QAbAV7tT9^s9%OhKqOR(&`l1U-;IBMOvl<_z8Jm|Ck4F zFdPW_FERg*V4#k^e(Y)+1clT)Iqf`l^8p?CZDPK|2XtYRO2O(>A14c2PvzU z{;$2G!XI%`jQG*0*SqlCU}~f1ylaUkR*2}PrW;)@M7rU&L7f8=5}7sv_3xFTEU^`* zS*kFNW^(oKZPdK8T;IL6gX$Ae?bn1wa~@zU5eKpvta3-%j*}TQbdxEl$;SsFH8pc0 z=v4&pXORBC!3Ros3d|;_12#DMV2^(qk_;axU~GSSq-X2Lv-9C6q~^dfGFD&5LhGP- zLua^{8=c}2ZuoBOuE-8PvhGjKu)0JeEi)3uim<1eL{F32>UU%8zdsJDZ-Q=2&nS02 z@=BY*br&s+CnwpZsi_GZy%{Ax?O2ZNHh-khQ|&i$e+BK{bL3sCMT}Eu5p1)7yBt*w zjcc4c3HKmgVp_EY*yFojsSl2+Sl1yifb9DH7(VxXaCifl6?G*^`cG+6W3qx@>9vfP z?#gl4J@3)?gPtH}yQ#YqvJay$qmMv-m)5p|_AxJOctab)(baNG^`^&~wyGSe(sx=(VJCWbi339Cm-;B-p(&j$PER0Q`9LeuN_V3;bp5pRT?|W-eER zLqqvKsMEx2Y)1Yn_?e3(CbPOOM!M^PJB>ChpSri+v7XYv2SioszcRFjzkcyhL)sJ^zm z=F@`PtO(oi|Bd3PJ-7!7U3T9rFE7uZI89Ga*Fxn9%xrHH|2ry3LrV$$M+Z53owKgN zWx%!?hr*nD771?W_!!>K?(&*fc^HO=4HBGl3iZqn9Iw!Qz!0yC8e5V*O=N{f6%U4Y zU5*%E(wel27Wvuzs&7rO)X3He&!$HsR81f8ub19`Uv?~TbCnZ zdmkV)^)KJhM&}Ps7x%rWVFgRYT%^r#)UoNN(I=5J$E1e8C>PtF7+5`o`&DV9Iz|(D zv5smik=1UAvzhfc+-O4)IKO!W?I@r0;YIw!fCB{fyJM+;(tG#8&}8?Vj4n7BHu9le z)=GC0I>W=nlTYsNDz6Jhv@cnwY!{SvfrV;Ev77Xq;Nm8-g>Jz?iO_3Rd+r?J9|GS>7_3y zT5I1|6^iE=v-^ozkg;R#m#+H!$W>;g*dIwtH`@e58Yt8kHj~<4638uj`mz?O-7y6g z`3hOL@GCf8SQnBT5;|(xdSf0ZnDv~AoK~2a)*YI~{RnLXp-`Z=I8xCZ63rILX!mZZ z?U(3iyDylzeS73Z1{4PeS3!F<+Eb^dX>0{-N6Z=gkN?E_)IQjO$x?gAVGcylkJLb# z0IPdgybaKIE2}>$5$_(3GvjDn5AR3{ojxmYIXO8zUUvsS0d_W`1tCP{$Vbob2qS5g z(hzL)T|RByt6 zjd=gSCk~&UUQY;1v#kxuUS@e9=7RJgI>_s8M_KmKGI{~6ZI?x|Ak<1&RUvZ45&p=h zo2YYrvfj8+5*MkVcD1+;l?p!O(}@cC(+|`Q@>@0H6Zy z5uuQO#hb?6&aX?Hhaj?eT`0#8uoBrc+a;{bhaG`gTx9Vc_>)|6`ZC5HOjb>Ph~F-5mk?h69-F2&x6!b93|ZamgS(yeW{4aqttG^wyUdfAqS-XCCAXO5Q18U7rv`YfEf`k z4o=_dDh{{(MgqY5`AUC0)voCJXLPh&E8y_Cm-64KV?jZE?`+h}(SP~Ce}Jt^F)*Ww zO#5?PUE5+FkxU!<>o!x^c=h*{0l^EpWEC*%Ly1_vV{y(k{i-7VvI7d{w_2C!@7s!h zsEQkK2>CtmY1%Uzz^Q>BDAbz?87}&UQyl%TXvVPq!5c@lo52wz2hZPPJ0yw7UX?B2c)Kv_v~+r!2VWx*~xw}K`A=7-1VESP~W~&`fkHHC-n)lt*b9RkROH*l}(zZEb zlvm@A0O9%}n0}FyMG8c?L$r`z-hS_r?&G;uW*He7ouEyI^XJcB(8W)uJt!NfRdR~F zX=sSy7+zX(PE5_r%(N^3?gEevLDkUq1BIi5iIZnh%Vmz+wzQ=PzPy{x7MET(a~c#N z!ZtexCGA_5umag*0#mfG_AZJT`4O4W1_@{Qc*ypywc-A~jr9H2mOw}5`QN|0Tq;r+ zlVHofPGp~Uq_>RxgYiC{d%JVN{NKdY2EHu(EDAVIDUJ8;9^Jkq|LFX{$&nodXnzoH zhV&8QP_{!AbmMPplxc~aOkpI*_UhgJW)bmbW$u(CYew8*>F!;b zD+9@fk6EO5K`UpxYAlb8L4(L3@K6w+?##?g2}q^0*2dWDZ~c`$kEOR-!*63YU!Bl- zo9?%s({_XSr5;7d$L-Wue51btXoKDjw*YMZQDIZ3OO7K3fb1& z&Jwj)trLCFKEl#)r{sLs<~5ZIVTc!TES>q2s;fia=mVWNC4W9EY*@m=Q2>+GE~Ixl z>IAF407;N*=2=JpE{hW8&zq0f^yGcJV`Ady>WZCde!M*25mNW|Z6?F&>MA=N4*xDk zJUa}CpV< zB=kNt`QnNem+NBs3~g5U4v!F5|LfC^{PFss@YYtuPl8EL3T7AS9QiAcldi2^SN9ll zw6Jx!$eWENt&4nl=vGwN%JxivvxgV*co=;rsvK|+^e%159r_J}j_{_&1s&X5g}k=QtL;J3#%efezHxxO#X z;~=FbzPM)wF?JwlA?6|`$-%&;oE%22l+5kSSZECSCE=-@$Oaw z5lF941THB5*C_Y15lP%;HexTR&tOmDOZS}yGd59*=4Cy z>tbxq)$cviN+4|TNOo?8v?IU5{D61J#&16uR(?9*L5Xb&i31w=2in;H)$N`bB|wfB zC+Y`!d&LwLxhpFxM`Nx7z(`9=>lz!sPi1sh4)gsW^Qt5&vjHUzTn}PjfAKlc21D!h z-kBsDdZ9Res$j&1`-=XE8z!||xpYwv7pjEv6g~7qX6*hGe2) z)4k^pG2pTCN?r7-N=06PE;MI+Fy3x+X5lv{$I3?4 ztje6{^d7|;wk=NzO;0?{!8Mq3kaLn~=&a>|o50R5rzPza6f@ud30nC|*+&Nfd=S@l zadC+dirfw=ltA;o6Zg@=t%*-B@c9ycB}i$`YFz<7I#710E>b}{<|~Gpk2WVwAt8Z3 zi1K$hZe;F+Do$iebkC8PD{tjZMi{9~lo8XLGL1Jh$y;jPvuwq+i)N4jW3ooM@j&Y% z_47GrZqZaD>fH_Wa95tzOkPQMKwTHgr3qhFy|$*x@N>X$^A^T|Hziw(FMI8&rU z9boQM7_5v|e2l6G8UO9HG@!8$9R!>^ytPN@y0^{_Z*Tim5<1GtsPUl2x(X{Hb4^4q zcb}@R)lKcucg7D(rIx2Fe^k7#!q(Jmq%TKZ(0N&1qZ_s%w65tV5Z~-UNiw@6^n{{o zJR9&j2m{(kp8a8X!y#Yw)3G88W>h9^-6J_9kQ=VC=X*_D_M;C?uTe$mQ^QNadNrx~ z@I}k@@iLcduVb!1aiieGu5F$?t%xm%;$9C`@{sY8PTA`9Qs(?(DX33|55#?}dIy#N z9Sr^ys(ElU@StuHeS}*1#tU3gSA9bS^GL27nDy}mQ9qC6$3#f#27`wv%um45@Z8*g z0-DXlZ#%yykh+>(7<1)#@o7Y{R+6sT3U9+tw$RP zGw@jQ@;thAE-()|pPJYT*7jWM;>oH+HnKQEy{mEYs{dAR>hwXA-^Pv~S!j6v`+68% zCV-b18q>afk-y)J@M|pm?++GF#RcSEB+iX}wz#`RXL5JZ6PaxfO}qQE6#~j!MjHT( z>Pd$zJluUhmwn?v9$SxkeZu2_10EYw{5Ae5(1>j&hfvqe>DIaAZkYjDB8H}Y!9zT< zXhpO8!X^EC-IPz49zJw+q5<8JDgB@3BN=)=@3}q~%H`?zm3i8Ju3B(nyp|Q{C@mPZJTA<^sOGfc` z?B>pb$Mj50-9fnYC`6>U`(#h_c=;J}Q8WOR(bQNpyml39j21|`rcT@vz3>;8PdGmx zsbjXMVWZDy*a5p+5|B-Ry%Is=Ycy0s&r?Z|n`6gG$fLuq<=u!q4y;I6K~G`23@T3A2vj3WhCh7yJ!M zevpJme0oKe$aIp#$N{X)V}N5XWUm+mjCiu;2#f?4 z&>bq4K}uMenq)K+M}K&%5TCJz$gw4cA>>YLRxzi0Dj*L8Ix=%>lmnQ7rp!0h=#UR; z*{9Q8YD$5U^DL(N8&qABNpUOs{)@bM72-y5S9leynW`eI01u(?sS7%eYOIcLaKa=` zDl5|Cs=d@iF#A_11!{@0*oDqY(O;GSDH8aK*|@|9jr&ZxIW@Uo{X2&k(1(LN46|1X zLZ}TLVJ|qWO;(t1OdDhFAYLS#~Asoxohu1vU5C zX>zX9yaI+vC&!Rf>V`K<>r|%YTc1oZn>Q8d=&4){u;m1FM9QW3W&}oSr4wZz-<_)O zo1A5|g0CYc0{YWgX$a0}joBnlnRn?TaVhTgW0|B**M*gAh$U2h z)54R}_g|hhqw-)JE`%X-T!>+T*`3Jhl?5_3`M`#qnN1~+*swdu(X z9u~XrLs8ygwk8XiYse5LcMPC?1H`yi_qmI6$;vnI#aV~<6o2#T!B!1 z=#@Hk+3GqQFu;&SVN#CSzkIj&tSR;UzZzI6x{+YMcz~^Euv;hF?v%q?oAb$#eB?Ig zib|&x|Ddp~=?b39ULcL^KL@rQ_LIpr`Yu=!st{@}-tm*>E?2{_iPP}+(E*23E zjW}V3;CN*T=c%mp8-g!9DL5qQGL_pualh9!HMn%rr&s4aWxarpJ65O|PS$vbu`i+^me_#`pciK?KHgIw3jF)SvdMuL^PZmg2+T{?HH0EW9Y zGoY`1jDwYLC+!r0Ptp2}H{(U+bI6W90ih7m2n~aZ?Yw9S(@3uWH$^Rp`LgR7dW@zx zPQ37ay9JXJJptbv>TC+_Ne`B6l}pSz&HPIL6&rtl`Yuq&^bL~Ronf_SEdbQ=q}648 zFHb%5i^|!XwT{$-jfQ}%K-M+?I&KkUz&1cy-o!FNnBX{3a26ORe#gyS3G-jf+DxhG z-)eeip9txM_!TTLN}o_TlRR|BY&0|Z&7`3ER-Y36=t%xsEf(_9{5U5d-^?calvr)_ zmP2$O3!GslulEm1$gYg8lW5Lp{%D9k(SzMR>4~X<5BmhPRVIMN%z_4`RIVco4#=}# zqQY7k2A7z5F2gMM^TlARHw@O=eO}s|%hx&o1-1a50sp|^}36+O|X+aZe*^;`*# zy8_0M_(6Blsv25mN{iQcs(+ZpNVzQxZlLNn8aN7%u8;gL;z?Y9sMh=Ll8sE-D1dyV zNs#0<{udnZ^RYChP)AvW(V}JB#e%bc&f?Fa!aNd=?>(Iq-6q@F++oqE#zy5@oE@;I z?_$U(!TdphMCtML5O5*5c&>C?b`h`)yFkMM-eEU+MWHbn9B{`$XUyOd@?c&ao?g>rhWdX$<9C?$SUR5rA!uVy10i@thvu zoh6U+DY3sRufl&{0|l}M*??>fx`9*swvE|^b}nbEf*I3;yCh))ccs(}!uwfEY`H=b zNgD(Vg`v9I+1c$f@K(0JxyZ|fzLlJDU$CS&+^WSAgu0B728Np0C<)U4bF^4tJRRA> zS=nk>$*k^4Rt|!>;%K)NXsanY2=OuO7Q+f;h|$8}IqbTXV98*Ol|`toEJ6b`xlzLE zaEg}_fY)6hz0oq!%A`wK?qbf0DsjsXcQW1};W}*$2eJvU7%PB-dOV^~ek<-Wa0RjG zO)m&Wv_9ouzTuxxBAT788QT3m*Yb>;SxtjfP$0)}xt>)d5Xk-~K8L-6y$;s%Cno$U zlWm4W*>fe0|4E`)Vaq86N;%OA2G!(Hg$S_{LdWEH|B&YN0)oaR^;s5UK%Zf;D2kpz_HCRVc z=2g`s#o@~Y1thI5{pwY10ww~8`Z7m%Rx$#=dWGHhzwvs=sm$`#t2!!WIqA<{W+zV| zXDa2ilBk95r%vnkMf+6`hm(y)%36tf34XD4G1K|R`C@tfBQ?GhF>+kbZ>v!$BL>CBqB zezH_j0TsiAiV1|?cmKA9pgkdIn~6C&IZnejH#b7i=ch+*1``vL-(>}(cBvr`%hDHq zdF$}8soQJ+WmvF({1Pk{)@o_aFvU`Ii3oF|&kDhZT!@dHkZk?zRb5_N`z%kS7x2ne z3+bny%UtM0pPx>f2WQ9$8Qzyyw(kByPEHbyieom-Sxe^ynHhe0wL1-ti9*N^5}nl-_^$b z80vy>J%m`gxM;s@ z;EgU)M*Z}08D98!!NKZJjxM1oxoLebt|^Xjcw!>l{e11j`&Vdd*p^dLs*?5jcR@58 zJox0sld~9!+!yM8#FX*L4SgoN_aiy?lNY@x%1=U%(frvEm~|0E=~(viwiN!d{__Tf zUkm#!6@_yL`94k3lj)7`GBPf1A|o%)z!C`DCQnOY_z9}aBVo(~MZuUKL+LeDO4yGB zKW*fA|L=^7Os$n*8EeQU>ggDvdsT9vr?yB}fbT8BGwKAXIAz1n&);`)!T|<@qs28p zJuXa1zV3W~jzB$BS`cI5|DOVJ45Cqc7$BY(kGGOg^T2Bpfh*4Q=&`*iYU*u}6cRN( z_LSw&j2V8`8*~egIYB17F)=e|{`jF|>EmNeoA3XhPp)6CXKOBVZZ}Pie{T|Vu~TXC zWQ=l`O$VYK&HS-8lA}*(>d8IKk7&8Fw0iF+&u-nJZJHJ+_2;d!5tf6ESQd|!%WEv+3T_xL zxXE_V5sEH|{(F7c&p&bmr$Pz-cdx>;w;U`KJTlPy+> zGaSPj`^rVlc~k4+XT|J+@Zv_34b(8gojM&a1`FphHv)eEv;*6{R}$bq zeZ0qt+~dh_saPBrxC5R{p8L8VrG%?N`M4U|L(#5Je;#v_{AUi2j|;oI^L%g5SfQ63 zuaz&nH!hO&r<#q#rxM`*=RYc5uFN5h}_k(42TYRS`W8A&M;Z z3~G?+Z!E`3X$cp;0BzDGolzu7L;9gO+H>{N%8&mUUGEZlD686Od-s~Qf0WUmJ>jRc z*Kk{~VtlesN-y`+XFbLXb$z5NF{b`W8IWSf$%iN?$Pg4o1|hctpA`KZIb6V7cp|8_ zh?8KF+PEFbq)kK`dR-QXm8i(QQ}4%R@^`t?Gecq*rC?l?pYN^Dk_WESl&j`%oqG%; z5&%xlPdBkOHTtc_QZiLF#4%#frx-%aW0l;oGc3*e61}a*#TJdVe&> z%JIDf9Y1FVy{Hevnm@}Z{iwcBMQUXOD5k=W6)`xNQ1(rmD@nmNA=W9i!vp9Lg(iCj zKD`%Ic3J!(BOLgAh50(4(|{H&&m43xi7E-f#QIXiRo@%1IT zApP*+ZuDWajwr#`7k<$>M;xkku*a$65(D+GiDqVH(Gbw6> z0(t2oDG?2$E#j`6 zQ37W_TVf+drRX@gv~B^{_A~-Opg_zZ;RnccR_N#m9Rn->!a0o_5Yw77oKy*6Zoeid~wW1P=N%10n z&%Th^pg-DguDht4tzJ2#JM~^Yj~K%)<}S|c9XccjAZ`_>IL*N*l}T#m=SV%)hz%qfdBFE(foBi?oet;cUAG)mjEUdspWhxr5f%Ok zOH3$-yq0>}6X9Ed{Y6~D@1+6{#~=%|0+YGDtzTY=)mtE_k@ht2zUAN=uuCFmvijHD zG_nj6*VpX_ja%;5AoU_{OG`q4g zy58dVh)E?OmER^a>&@IdvYvUX$%SGg zx6=c+Qc~Ig4b?y0zF-&b5-*j;Yxy=S8xoc}|6VGp3ydIFZ$wNoysw6S4siNFFWTp? zJ(PgrVw+F>VZ8hKJn1#V7W{n6>9f^m~nTKyz>y78ps{7fQ zjJ6J0cS9iO?E=*9`)fstS#G*gj$Ct-RdBHd=9^uqe^W5i+JEm9WM_5fTqIEaotO`Y z&&fnQ7$2)C7Fi*V4K$gq`LaTAiJ}Hi-Ih*n$&%TnB_&;50!~g&jQh1#FpNBHDh7Y* z(lHH67UstA=2y|>S31s|?^=}4TUqk+i3jgG$=41j6_J?iCp$i6XJ@-*3*H=6YSRKZ zdys*SQljWUYtinu6X|eg6Efze+UB-cQ-q!*Vt%N1Ua6mxF5>4-z(v-I@MZ2tpb)5K z*^?S=YS$0nH|FN>tdHSgR{J%t~VFkctTwwOE>7hCN3r50*q%|&77W)n|1A+JFQgG&3a z)#kg@$YapKTkCCnu6XvhtgT|f_r>&x=Qqq>G0CRycEr2?eq?9}Q0;Gp^`0cf2Zdmf z?1=uW6Wjw)lkVcC#MsG*EIy>Ud~{V@ZOiyQjb;BtchC1va6ZJOwv}3sTe-fu+$qgte0>SkTAt>; zFYe#`@Tp@S6Uart&~c+lG}F==J1S89E?VLw3C7{)n+kAYAf<1i=ABS?GrdWRBzBv% zU)5f0Q!yG@Kx?o28e!Em?{i;-2Q&uT(H)U@cZkP)@s=t&zSF?mJSm=tnZAv+ifeD_ zTs6D?0u~&ElN)B*V(f)E!>Xe+G$<6z{pLn#$RKg@S}=QU^72*+83|U<@Vm<7eVgA2 z7>n6$2$PsLsJMx58e%{mw-1qs`9(M{MWBv+QX&!`O>s`{yWRfUJU0-F`&R$MU7wZ1i1LIwS?X2 zOI4X1_4y^X-%&aXSmFy%u1XsE%j@4e~|DsYK(IF-V#zSftvUqWjLzPabWe zh4<5bC8?D)hu|-*)**?`%7rVh9f%4*-VC7o4Q0Ag zcTG^y+A4yN;QD&*N}P25lwncx%=nE1JD~thlGeh+b^OPR0jKT*JCz>+VVzLV3g^lj zDpI01qiVX=R$@^?1D&Uv4Ghrtratc6BaOWeN2@gK&De`dN$E>`_{X3Y9f?oI^BJz@ z)~7$q(pjwpx!S8zj+=*g-J7>HOGfS(_qTIa0iu*Op34PnhHkDG`PbF)Ij*&w6W!0v&-+_li#wew8K_R$ zkFZ|*3msP*y(F6bcuSfQxtCfZa-3DSb|%^D#xEbh!2*gU?DkH=-_{+oJ>Ua=B*eI7 z=9kLZBppgxe^P2ucU|w_sY>8fRtYE2S>Ytv;nbRAT&z9mQl%fVhBo3)_jIYqYVc!H zn?`k;beYo+7yI6}e6HHQA1n~T%R4AD-;*C?pCoas2yjR`Q3gJe$rtpo&yMn)-VjOu zY(EyeSWOROZ%x;<&}bQjWS5oNuq(QTfI4M_r}xD$Ofj& zo`$KI4i7kt`EGmcwl9B-`BhE;Ds1~jaAwg;V{0Y7Ws0ZK&pM`$uwPE~BK9~oLuX&q z^XKnu_8vvJ4@({r5)ogR5LhvallICx%bxW`jh7A|k{u@|9LrX1aHGu3&7IKOD--5bG=J&PPmh*;IpHQ|+Cd{oZ?1{p+HV&VW2HuR62rLj6TmdaOjs8P_>%PsPQ`5FL&6@UO~m6lp0(KA|PY^Q`W%Df|z5I3-%1%45zs zIkB$-v=-oM1_X4;h))@dzo>J_^QJNYbLICQ>D!o}w=%^DU0;ciDwt^vUMp52ls{zKOe=ZKUrnEdg;r_7Z zS^GbLXb4<%Uszo_RezAV^3}yV4((QGX+!6KdolfQFQ=E&hXn=EDl02vyu=p8HscrB zVROOTjfjYdq8sVaAbU&k*(1r^QIcXmIY=RaV3Z)kiNk#NURAyDVd~yuvC=b(r{SRuAyjPHV zW-lV3q*Mn0D59dG0_RtjJ!_#Rhcg2{v@%5zgY!6p1=IV@bGYTMNVoe;lN6gh1g=Xxq)?Eu6r$% zBaLD)Y4wY^SXI4L1_!7ncO3*PRszX}LUNcnWiyPztO(04WOP2erlel6hsrbQXnpQt zM+<$dRRNx3(OD!bt4->R`e=R7dv2n8EI(jCdIs7#NCdt&ENeO?6g?lMfw7!u70tePgm9 zjVLHXH6_s9V@=NP-5g&= z=#*BQSO!9#^lvsvXme_6YF^GA0;qU0;t;92Jo$3*>_d6KfB*b`;c|ALTU~UQAZ0Yg zSTNPH+8}MfN`EmeGfl0fX85Js9t>tQ@Zi5RG5@H08wq#`^Ukeh?pBrG2)msl6KcJ%J>U*9z2W=0&e zd=7K7G{V8SEU0T?=`Lfr=KT>{$JIo=0djCj7UT3J{gI)2K@0J-)gG)b6PP(V zB8#cF=xt~p%AWZZ=3Xlzo7^d>PrD}`(54`*BfuKwxxBKBAJ_JqrRlS?5%$2S&hr`D zR8@+YZaxifL|mKJ(Z1c&GOqs0DZ*J2x%CdlZS!yMJcVK7#Gpcmaih~KS6$JY zhRqw-r$bzJ_0)77K=342%kh$R_FaUe+OIp!bLI81hcAD$fWCTt-w5JO>;EXtiZd0=2APf}A=_3;}36v$&#wU|U6FydKz1FC^G+)Ew~+g^eekA~fl zOhxq#9V7OEyv9Ql2Y_Yknx^2373}>R(V>MSVHe4&yM97mVab8P3*qAX;;YyxetyAE ziXfc&7a1*!rwhKf|_0w=blMEwk8$J+}GK@ZG#PTi6U?JTkyiR{lKjcV#Q zn1W}PZmtR}Gj#N~DC`OG{DJ~B&l+`2U4zh?ceBeAu{70INqHfo|M)Ielt3|4`VKn3fM6xdQUCCFnk}jlP-q<|Hy`Vf7XFEIAdacTlT3bk z|12oEE7xqW6lN|V<$KYl1hR4n**LO%&$*kioKf1`9)UjXQD<@M=E=`ik%*e#Q4hZC z#m5Z{D;DCN;U?@1$qfP$_xF9(F#O(`bNW6uvT1GYE6_C++r{6_Lm793t?-S6o5wXj zcP|(E%<>ALgl7`1d6-QehQ^k{^Dz>5GfnoCLwSWW<|UYshkyRAvsFmEDps4t8~3_N zKupd^8r}0P(+BFVp?^y#g|hy=6N$DQ{6b;_pUiPAbamg~T=VfVM}D&k3aZj*LsKxq zfBNR=6WvvX&17A|s_v|~NgD@2%ZkOm`76foP6>Kl(|=i4L_k4N(PF5rt^NNwRHNNu z7nxcB<4ls{*cpM-d0f)uPO=yNI1cVnMM!=oGpc(|!#tpezbNB02l(~rP0h!7XyL8Y z-W`k#B}QgYu^3&q3I&H=oy%M}Lh~D?gu3lPpm#Pu8H{H^c;KZ(?q+T($eO5Br>cnY zLLh1ydFVMlW>wtT(CLni#Mkv|!Ni%kg8IYmz&GHeK@qH2uAKeQr1Y{D6R#|Q!sU(; zz(OU%+=OJ*+gZfyvl+?ZxGJWj`ww=!1)F11yj;_<{XWzx1us{9RRS=1;7oFItMd+F zX?#aQm=gvjee+))kHVc%z43;|)(V%Xxf6kLH!fGeY+BnS>mItVmJc^ub&A`|C9Kvx zhEd{=vLU4+&y7+s4^tw+P}irSIaKayTnw_I4^Cr4>u|QlV(kxP2hRI-uhD-Ue#j9E zSt!QLp7AVft7iXHn?f z?9Ry4o;-T;N`TAOReMu!P8;VJ6;rl^XY?jzYh+HT)JT|Vg}Tu8@s9Er8$wBqCK&_n zt^K3u;#y*oDO&wn7L?*D2%X}+1 zAC(CtwM}AfsH2ygaF{uDx0S(luWn(FfqDB=)K}ZvXa*evLkCa+8*}I=nk`cY!VQs9t|Bl992uQe5e5~W$zlj$PPrZPi^GL_Xf3UIJ&T>hg&(Au@ z=?u-R7m8nj-OoEo5!}yh%^9gTTywJ8s|K1`-E5+Mu=E&Yb+^3tw>aW%J|(?NM4+^#M}?hppcnL=JM3^iN2b0x0axr2|^r(6RiTteXu+-n$L``SYWOJ?{P5 zsKVtKy`iY0mak_9#2w;>EibCde*C^!FUikIBOFDV>EPQD9^$ST)PCFK~pZSXgQ0<#H+HBuCbjS;=EcHE?bekI!e6{_6 z``qMFw5Y)|OEx5hgqeTcK8W9w$1!dz=b4}0PR^GgMHPy=x!rw;!;tChsF`k!?Q$hc?QNmzX8M@nSg=Zh8X6W7%|Wt3F#aODYoGLg+%+xKAOn>lxD7@#c* z9ojLkU6g;WHusyHm;~Z;a(y9ijnm&AEeZ81w7{cT@l4XQs@UDSdWjb0zIrL~QJKwJ zXYZ5y-zdWoR=vryBT7+&h#40yvnJZkmKdt-x3(+7+s>0(2T3;Un&guQA1qEG6Hi0B za;@!Of!6VbH8&*-#5SGUk;i-W8IL8iKIPf{E&nMPEG*%j=><7guUUK}%7L@Q_5A&- zZ>UCAq}QzD&!~71Mz278-YWy|S>JeT@x~;0=Qxv+MOt&}6{el<)wP2Xan%_Sj{p1h zr#dou*xO;C;PkrF$wP8Zg7w;MplBg@|B0Q;t)#0 z@YgmI6=e<>9b5mmSU~LKm4UyEk@SE6iG!x76#K?QSTw~X@9#bg35>IR`$cQmBFi|@D7Spz zdNybKpUyGq5o<4^pI0MSSQT)iccNj3pKUZXdXwfXJE%lJr2m&^e7BNUTs# zL^7Q#cfbB}@GhDe3^D>3u zj@$)tB{B(cF0giuPFtgy%$xtT*_+T1`}ylkc__Zr*Pr4FhVSC9DkZG~YA7NwLBe1_ zUT7>uQu=2frZB$e?@EfKN?oRE88nX#GxfUI;&#;jZPOBN=|PUVJHEnG~Dtg$Q};8K2T0H8u8U4QT{qnTioL zGinJ@O)XzI*UIgK3tf$te=u@?j4F$Kb)~uN%E?V>x^0#t=vLI`4`}(rEm`Q1h$vGA z+571jz4AbItszv;d>=6Ac2<|#rf&AhFngm7H*u}cCjAGTAa8QXv$E)()wQQp?Hx~f zK9demYnuG!_0Jm;Bd5C@vv+_8Pv?{Kzu{@~k zF_ESL*I)INE&OGR@&W1Xb51Nd^3UsS-4kh%iu!;3GfO*Lo(tY{)8bH{X_@-QB>wYa zl*n9=-tN+s>l|rY!PArw@ulMoq148y&DH9xE&RJt2>y@Q+3} zlr8~Q+J-)PoLt69FjccyiQQR#nlj&{z|1qv_n+rYVV$r3-0_bK+(hs78y1^o(=}vU2-KU#N$xrs^cO*zYG-*#~<@qJe zN+*fZJ)Xu?%_bGmzuY%-1k>45aOiSC28_r?16s38H)!%vY{hZIT9>LW_&C3)b*~Cv z6FipFEu2Od*t}s|SRkC&u;%*XrV1Xu9Akm>g5L%J+RvlBa-S-P%_ts+CfWnDx*i_w zCA%h%flx;iv`i82ySH*DC9Ua`>@h8Y%~Ur#%VGgt6wM~9gv;IV<2D~GZ!ZN)GU@!< zUdmzZ|GQJBcXmh^l)wT5-8)DekzPXMj=pf@)5FGklSAh$*99W>SrWXtc->3_=f53c z_O_D8YQ$-I6q<8?7 zo@jhkNX@NaScnGiE}|cg4L~4u{)l1BJ7xC+1!eJ#1m>3?v`s>PEYb~^vV6k zfN{)#77F^-sO;|We5 zh6C}s#m&+r;U#>6G}YA(jxh-F{li&ialF92rCChaapoPA=Jf1-z1zIf+W!sRkig7L zb#kV^DJi=!%XmyoMY`3QlvmMQL`4?bYF!s}>!uu{Zj@hM!4uHq! z;U5U9zOk}(&&kXs%f5D>Uig?_W(6p6Z_$3}#?`Khn-@7!!DK0iTj{Y4@Gp|2>t|AT zs_N^r7G4HtF9_L=V#;b7K$TTZ=Ax+bz2kNeD?+0XPsVqE^GT%MpAQ@4e+ZU*Sk1joM9BZw2-B9r$=CwCgAKix2(ULid z^Z{mlY(gCWM|vS%DVFhV`J2V`%uXMRqQcwvhvGyt613x*(|A@N7*pu#FHoxrcKBST zj)KB`fkptJ9XOGO-r_$3RTd3wW`U~YYi2QysOa>1yyH=|-V&`;bzt!@DWmlFonM{p z=NZEZ;@r6ht~WqkV?OfoQM*^|L*%2r?Ci%T1w8CU53O4%elZd6VpP_;X?F=6hxS95 zE3ngmKVj;(<8>FrcS`2uLeaazx8>k|;*FpFUt}^T5)VhibuJiZQZ&^w(-?}LI_yX8 z&L9ParwXtWvQ@hAg-MHrp|G!QgVR#X=9{=cD=I;c;{bo|szylhVu@Qd#4SxuWFP(| zKsm3hT*&qtA;yBppQFJh7Nl$w%=p|jro`@>HtV9}a_Cpg&ShlPk8IRbIJt7n<#wOC zsMGq-qPDEc2(i)F_>L|%DjAiW(MS2m;eT19Cw~X?7gbKj>=-F+pVq1Ad)El_%KjVW zFL)QtVtqa>d&YiUQ`OPl*w$svEECu-Qk+AQmg=#*w6fjvP~^q3kH1CG-}u9~_p8rO z!}SYE5xd(0%jZQXnyM)Gky$6Ps-nQs!UIZ@#)EKp(X^Pr*aejGs|7gIG^ey}iwzxJ zxy6Va{Cq;{SLak)E2tJ6@v(#{4Z0|pL~xw2ZAAdc2K=3GjRb#YO?iXml|jZ@Z6JWn zJ!480x8GWixG|TaX*dwXTI}Qf$WP1DslehYMJxD_{dDmrz<&iodp>83H`>|3Bs!}@ zZboLdX6pSXrP!CjYdO-5v&C$F_`09xJy&k;+{hc>K2&PE*fJgKg1YY zg!`Q@6_`Bsi9ak0;}Svp1CbHP^s;EKHZ~o(XEm3&mce1?ZXGnT0*bH+3mIPXgyP#a zW!SSHId*s&1M%G7>G{5iY?f@E^!^d%@+1Wl{J-^1nJ%pOn_}-L?02iQZNE6FvZiG!|aVBF8as@@=6&v4qUIS zsBl<3rhMm@;HF|x2=-9dTtBlYAwjv8wGeCs<6H(F%#^M!b70RsptXrl&CI{?xQ-Sa z8h>#}0uu4mNnb*^c4$!V4Wl~r(u4nflpM*E5}8cTLqyHC2`(8LX)icu@fe8NudfL| z4Q;yITo^t7+d!{4t#H23ggNSog04CaveK)y-hmC=>cW080jAn!Xc5=pUWx&i$5MqZ z&#IClKH*@{`$)CezO4#CN#6IIFd}0RH$fUW<~ZpLuprbo$eCNU@wP+V{eEZnR=AQi z@-N@_{e>)>r}K1*cCXyq03_=T*9PEjOQL~Oe5Cxq+UhuK72NT=!*OQW=xA_%9Is2b zG%6^FmzR{WAI*G!F;JN49RoUnEY1=9v&Gf6ld#XTI5lFMUO-^d#ds{FD%XeNMB<%? z$JUY}H4sJ>ln}$-gk80?ET+Aw6BANNv>*P$g`to!@FiWqmPA?2aDmp-8;T6LfNT^D zt0DrecCXtEWFibg-P;9}vddpHC)nU7gDJBt;OB>#mwtBbqLfl_Tx&dd>R_#A<4CPZLe3*_Q3CSVBb~ABzi+@aJsyLK*n*+S?0fTjMPc{AFWZU^xz8aw} zYu5%7Rz;SYV^o#AMJYC@a|^uu%l@b+EFy;u^9uB`=Y&`V66SXbKw;K)PXX;-sV;Yp9=9D#+ z6!DNYq-)AX+@Ul>haPo)LDbjs#pRf?MSM1^)FVE@Cap@l7ps;L9EHCd@h;EC?WqBF?LsLkMo zj}_Z4?CA>(S|7@%$+*kwacGBM@MS_ek=w>N5+ z(-$R6=s76cFNcH!q)7+}2x8sB*jWKfJ9gWnaEm~3RT~9XZ{^7kKUTf~j}*TAlycm* z5?`Xi&6!GIkHEmG>ESp5q4!u7Jab^W?vi*z0|{VH z=1&J3MISZ32hil#GH@C}Z*h}HYTIY|$ZDJ>1yR7?XiHlVp#u;LE%oZc`LSkUsS07E ztcZQ5J~hsE`J|JyceTMDGyLc1fp{$C>9gJ%ZkjB2mYCRhoV&JneXy8B$ebyr{OWMT z@BP)-sj7>uZGQzZld`f3tFOSM!*iE?xd_8tyaf$+qIC;Q@in8;V|^lsyQksG3eev% zyX`lIwO%YQ~ZLGoM)!E zqe85yj=48X`9FKxaW|H{%>FF&jO-GnTJ}P=A$P({p(PcEZs0neSl#w%znnf^{f}q{$`b z{7}-GBa)`UN`-6?s`-b^WHs*iP!<;x(b*TX+{IPzu)Ltn=Nm-;L|Q*XH4#MLMVHE8 zPK)CL;l8Aj^o%v?xWIZ2*~A@syw`y;c?ScsP`6pdj;6+0`BimgM403mH6jO7AR>~y z6KhvI^Svs^WIu@YqiM>|*X;;Wc7C)dZU}MiWaQ=$1TuTV@nF`V68S>4$V<9dn^bh^ zfw&f8os% zC1LJCSBjTH-&^;;x%$b&&1^9`*UfR6eL;f{ySd~XWvzy%yLcEkG~48nYNNSYA;+)A z%|txizkRdLop05yVvtWXTBaT4yxzUPGE=uiEMBUliat*##=ih9w?f~Je=Kcm;9399 zUO_y|dDDU)X%naJ+danT z?3Bm{JRH4ES`llLqr9g4aORMFmMd9Tz0bbM@;IHOahwz1SHBJ( z{}y6YYcQmnEABly%bd{C{ZTQ_Ic_kW`owHS%)mfn)zelDHS{9o;^Y;>H>vvV3^vPnH)7k(V~&rK%jM;i%S_yf>D9+uJao;ixIWJ2Tps?{7h}AV zA`BOWWV7BxGe)f@u}QzMtkl&BOCJbwKA-FLb&?H6Vsww*^$K9=wJsSwPK$Pu?A{18 zLcCj6+EcPkWJem`<5#V1blyZK7J=&v6f)68Z4|y3K#k+v7fO7TqR{CDII@#VB)6%k ztd)D{#>OzOJU5CfL7{sjhIw>E%J@YLl=nY^?59F{Pe%*1w!BxqVMN8hXBH5MZ9rtH zaXZy@2nT+;OUKiu9&;_xO*MC{W;izcD=NtkvS5blNUDuc!d{00brpTu;?BT`XG9$Wd~f z1_*D}@F%%iT{t_THLt>1%_IMZ4@92qO0_MQ8_?#=oRHyTD=m^LquzEJI|MJ@F)B-ub}7e+`cfF0w~Lv&FNy{D-GD7YEsgBkBUqQ_0HduT}6?xq(j|xQ853 zZJDRcO>c}Pne04&oc=pg=Y_aK&nj0PT__w?4aRAPoa({h z;#)nkw0yC>h2)l~ty_2o6Z;|XT!lc^86&{n_8=~m4;g^Rg^_6#X9Cm5^7H$1C2?Y? zYL2U{KK8hh|{aso|N#;@j60*d1yoZ3z? z?bTXKWFlHCy!7Lt+I|%d%B>xR zY8;i9|E3)~&%z0YG^sE#y>7#RBAPZ-$>*{iL|z?+-2a z-BR>KIy_Ml_J24xI2SY)QgUmOWZT=jTq`rIjA3_23KYoxS0gCUGjmM#L>Xp7cE{f) zEEk(XO2#a?pPdWQ>T)JCVLx|w>r+GWxrCjjGTd2M?nbA#lSl@<78ddPVr?0(XipmF z4ZM>pNzNjc{bGEnYGlkUBYJVkP`L*&6z#90IrDz7iMY>Xl~w=?5Et(pACJYYuDdk} zrjYH0q|{>)<;+%Sc;M4lp$-CI8+W*(}*4nz_R5=-Y|B6oi7hMOCjmNwqx-QpTIN?ayRvR~Zsemr+H1lhX{8 zHG)~nTe|P`*(5)e!I##+9~tBodDPx z7krXd#;r`lC6dCU$sCM7R@Qbj7>HcfW`nEG>O!Il3keK<`=GRP=wuVd7M9H(RLJ}; zkB<6>#Yo3SC?#c%pij1eQ~zY)$HQ^a^l`y-FCO`DWW0O2EA3-OYH(T2>JL6~WF7d( zIVu*4w)bS@4N@xQgo{?;g|(w4q_;u{f-_g$_jve+DJ?K@s`Q$413pIW_)I7M!ZXYe zPVv+A*c8b=1)zg3>4dLD_jb%AbWPS|z?s?Km_M=nXf$OY2$oNS1LV!8-kKv{`E@)w zyPWsEfH2#w{&cyl*%J*d_J>1%7RInHI^MmY3RPN$bMdP7^lQ{ie{bj%H8K)2A>S83 z)GlW`E-n>u&tU}FLRU0`!`NWY{GU~#em+pbJpVh^HiZ%jq?)YT2{}OdLIysAE-79T zRY?<86Kk@Gc__X{(Wi+->3%#AhH3iuvQl#Ya7_Psd7dZYdyWDR1S)-&E2E(>myRd) zb9=yVV+zK7i;`)U(7(b;$X!U_=W<2??+&EE>Bi-HKD^E5tr;{nNSXS0(!wt}b+qzU zjJA!fR}?!D(R(CXHvWHfv^JX5 z@WIy{PmXoZpITIVQTxNzX0tfex;-dxC=#J_)q!=w&}YbEwHde2rW7IK_w)nI$-1vHz4Q_r&GS&>NTRX!O^m z=+0}X9I(6w@Zj{-$|kf)$xcC>UNo9OetmhHgF}u41X5Ew8F9!2?U{wuM9T{kI6-U7 z6kYzK+P13b{LcPRm!_eq%TBzIq^1f#A0bGSUm+gcxSFg;rnVcCe`7*7QxJ9*&U5p@ z$CVx>>39d?71H#BVH^Mr@rZZ_V&?(~&=hDHBQ5S$m%n`3(U|Du{cZ7|i_1ly2JV!+ zgzkxdm9hif&_uW{==z_^H(W*fmgNW?w~u7H1pea^GA;bA=Q4RpJ|HE^rYBiJWTm6%<5FN9# zSNGg?s)(ra{SXDbK|GTvp2x-a>*Ctzc>MPAL9+k?6H=O zTpPzA5fj^~pG8MkqhVZn!^tTYyfz_Xv8^20$l2s5Z5V|XS)wakD@lyfkD1=fo|?L3 zNMV1kw9e?<<~Dd#4&h^y{EHCc1^8yFXmdu646 z1_K$Y<<=!oxMj_yp^$$5&sBDe^?NTuSbB+APX3|5+lX4if@D-oG>X`Nij@J+pf4tS zPDu8);&l(6+^r^!}NC zT-jL@U&V+a08IUb0q>%o8Kz6z@YI_bi0aTmbCG^B)dWxO^d5)quNdBgO$1; zeHXI0U&tjDT3b4-@7p7W+ZvPd|98yx!2#M!rdA>FJf0Vs-R9pSmCH}Oy zmE!L1?pEAMDGmXOx465s#l5&gad&qQ?(R+q?kd9Ks34X|jfANXq7*aNy0piA1M`99klUMX zF-_Z;sWR_vDFtO47?EDeRc&;%##TskLU{Q;obOBNhEdkcaBjv89{B+t9SMWtwo#+- zx;U^ZdeDyC<)poid)>&3>0TkLs4~_L&tVD2woZ=}8 z)ty!14MVT6y1B*f3%YA%Ww`gqV>25tsPgbC#?i)bmyoFWCsR~EhrI{S3&AVh zd;1_02e(#kXOq*9h12ID0Zv{p_Rrl@S7X?8N1CCs#GvQ0$8~afwfWYifU2k4&jBKT z;25isuI@R&Rm!LAWUgB<+(x5s?F z=hpAgW$Y7jE%3;rK_ZuDG#`WVMIVofw#!P*dZ!*=-XL1vt{}<7XmYuGG{*3Xm?0jrR;}x;MoDa9#|h zNWCNo57tqd%*ZD`D0j+8NR;riO~1+T>uh|_>6nrB5%aU*J6-G}j#V@DdfvOS!%Asj zcJlISl*p;sc%zpq%&kp}CZvbqKmW;BkhAfLvsbfa>dYs` zR!L}Y!8~C)vV6OLV7E&fg8+EH)a_1`aN; zsu#KIO|lB(K&l5{pL5Ac1PW$oN4anq)t~tto>YRTqy5zLu2|8iOFv&Uh|`cj|Inri zC5|Kl!}yRBoYjjyU&v&~Mj_)cuG6bet7c2|69p;=GD1(yb+?iS4;|8nzPnvqISXy2 zOOdu=tN%Ga^3|a(F4g>@;rb|WwO{$v{LW|lA~(2f4E3|l%+Pw8GO}x8aDQ`D<+$>O zRqpHf;`&sniBC&(iJnj8_4{Md{UD*DR*@RFYfN``Sr;>u5%dq8n~qkmq#E@Z*0y4s zcGbRDLp#CNXYG1-COvwJf&e#7h;?y4K#|BK4YtG7Yq@uh_5@{W_MSt944hH19r-rX zwrBi1v8Q(02R_E{kWABaO=Q6wTZx)Oe3BFLAA^W5SNt8tuY`kg3)$AaEJ1eAl^Me$W5p@6EoD}8%Bn*0Dp7S z<|c{4)d{0nDJ)D(g`X~(GS8A!9uMc5Mv#9KAO9XLk(b?fG2LUj`3Vd>I-$#>(=UeU zk?qAO0v;X#9s*mtBopV46&cNwYJ>e)VD{M=s+_8DS@Z(AbGOf@W6eCH!|j@@m-y?skAx1 z#^EbCOr~Bfspx)>mHY$w+h#{0^?{=Bt{oA!qQ-4o$Wb}Ms#>BJDYWLq^Yu44&@hf=#C@r${TLzPIPW=w9PaqJb z=7e4mW7N5j@ib-KWCU6jQg^-doz6Fd@SpiSr`UZAK9aUpQ@*9x zT24O1{yib~wOuS7QnPW;7_?PRmvLBSk6G*G;n@jyG9x%!cY{H;siu*Tq>z#%iM!&7I>ZPUn~DLALuTE)yN{bN*!WawIlskS?NTM?zX1iB!K>sy}9 zZJJ>)q$f1j(D*Dy20U8u#nzQJ#HIdY#uE&ypm`|wG2-xda=yOU&C7Q(u+8{~-!ESa z!BtM^Jxkqic2h`+=CBxq5Qpm>s3^DDsK`!S--KwL7kAMemdTENCG#nst7WrKtBhNN^v z9?WuK_qXJ_U7$pz!vEg?K5?;QaURaRY1u?Y=64O3N@(b)G=t&C<~1Fb%7D8yM#&g| z&ns)?03FZKbi!h_t!P>%%rzm9w6lZ5P0Ws1$E&;EB)tWVtMh7^6y^`jJ*rfIU_-`< zBO%r3&3_8}$^5(mj&Yj}xmL$6wi)aeyByzN7m7~;;M40}?DI|ez776ZI*6Y0k)6n7d)`0t_ z&Ex%uYe@?`vER+b8BDG3P8jgLF$h9b};7WBI`6 za}g8;P16G__X^aC6m!HEi${LD;b_&GJiPn3cYml{!DFQ$LxI1{eb zs|OI&$Tp%jb-8lC;*F|kT?y1QMVw}5-|gct8J0Fz%bk{@QMhu;xZlKIrUN1JyP+N( z0Bv!1e`7+TeLhj-!raJ8}4+AKOn#-cA2s~~t_ zH`Kd6t=WXxswcZI<8J(IU&8wJ4}WU!22ViFC1%B5-;TM_#8~$ls5JpQtk6O*U*O$0 zO(Z**>y|JPbZb(?n-$~;Do2rGpM z$9pU%fJ`6<-$Htz+9DcFRC9xsw%74I!1E6g$lR7XDKb2lLmb%%mEoy65^FPKbkY=| z!`5NAq2k0Wg+EQl{;@V3SXn}$7vJgd*}y|0yOfj;6{e_!o{EPjSR0Qm2kSB*VJj%} z3!8Mrhqa!OZnVzd>}7xqsRfbH;mh}&T*&k+Z3?>H{NgH_$sTsFgxu~#AjhfiF2|Lus8r{mP=GbNZ&0@cLdx?pGIspqgTT8)_~#+n#a>@;K&HJxfQKL&!NNZ-Tra4(<1EsAGhhy zpbovhCf%LAqoCFaje zv#qsylqPxE`-REFjw4`uxR#|+<6ym{V@WZ7R77zkxr_$RRps@qr4U4RR8b0-jb9Zf z5GQ#^bS)V=4r|fx`V0JWMmxW}+g3ChOYsQW+&T64^Zr0!z^cvfY2^LN{1{~md_1Su zyfsgLlyRV;ODKxR9Oi1XKffO67W}>6y~d(VXIW|Dyaek9z={HL;@ZmLD^n3&FG!hK zY*Pba=^RU_ReKKCn7l8q09EyPE-Z3Q*(LajHfl!w$(Pj)LQ5AvzaeR98~&En(P4cz z&+Cq&#mAZZ6J+e?%tq*Ncrc(XbLv`An1JvBFRanbYP~7N{4zBwHq=U#;MITe;?Wf7sN2A?ISv~63^9~-ZxpqVT(zMk3hWueejso*ibA)TF7 zpLe^a0cVY=G%uB;|8rAeX|798Pe(xJPbA-8RcyXS03SOnq)Z97=Qc#7h+a1GUt#;L z)It4IvkqyWqU{CEp)N0))+{3=>#pvM-g|+8JZ2zMAF~vetvFF&%AbaUpe<=5zcV8z z*Z8Q`UWKOYeL+jTM_3#Yb2EoX1feu$7CU-F&-5cEtkY1K<~bhJ@zAHNbqkN1cPm!8 z3h9w9hvrSjJ@aV5zwjrshy0i;f8KIt105uY2kr_(0a(u|5gTD4hm|9LTA=J7$ zE`E-YegDE=+!n>9rDnh=ZBgt8?F7r)&$CPL08*Q&CE!FxwtlH(_Y6ymuJr2>5kcy@ z&$3M@vfFfZ-oYN#tH}^IXfQb!SV}K$L+p=k0qecK0gf;Yu z)TX9};quKrl2#RTyX8Ssp)YJ))EaY`>iH;Bm;i`f)q>Z`nqK&U(gVWL-Q-xnP(oku|anBZXxXLtH-aF zWnGLc_cCE^3lC)judeMLBuR-}>AQm5Zb2`*;o;MYfFE1~UyTgn@rxoaiHm1V!c z{_YQEbbV$ir#oh;M^?pl-^?rxPNkZl-ivy}4S81*mDB|-x<$oS(i~+C=HH4cEv#QC z^wfHtouhp8Uo*@IrSv|Gu38+b;I_bv=CBf`Y^+eYeJ@fY4tFLKHkPa#YiPO{dePZZ z8FKw@;oy`}9mNVSCBlZHZvb4LI~tqAnF8$7M_vtlx>EGbHv(*28f*pny7F#pk8h%K zz3^4f*6rNRRxpW9EsU~cSEBcKX0M!#hL(6$aWh_i?%iGHT}dOdUf(cx(Yfx`EF!ly~sVOikC|Y++}5b_Y?<=4kM?f4H_28 z^`h$x^+IdTTYFx)p-6D{{iID&MkUN0-*jx8Xb7GrHkx*;zpH*cj_;j`Y|T9xC%6E+)kbY@*)J)Uw;anyhT!om4b#t{+9 z@(KXD!KLJbQBXTmWr%Dpu-P*_q5k{fNNsfkl96@vAZcZks@D~x%B=yApJk~&p~HzL@`ffkxlzLfMnQr^-;VLYndc8)g&nS18b$7;b}Wzx zH*{5X8U!pp`qnR_2dmtH4&wI@G+dOJw)8`^vvj{kkFnc?+v#nZl$BkCj)>Iq5crM2 z$@H0rBXz6vRKpYR3cK9*PsQ>}g$V$B0L!Pl=eNS>?<`9q3;Z=h{t(UgFE8?}MO18~ zA$||J6fj=qiiTD&e5I-M&9Pxgaa7e0%3i*&FvvY^a?Beq4Gn$%8Nt`;d5opSin_AN zq;_=U3z2{F)E%V+a-0+(XD8$geUbqexh4<>E6F+7$A=v}3|TW@?9SIDbomyCa6KM4 zemxx%Gox@VDI}+y2%dfccdsD(@;uamaI(uMlleZg{Ha>zd&`=@n#aVoHW7oaiP0ZS zjfDx`L*4%U9lFm_1Y9G8L)Y{B(F3R)ozEPysQyLmb8^ZyD1kaiO+tdPU#6IBmudN? zQ4kPhF-Kao@ol>oM*Qz{<~xTJ3~>DP+UoPT77QYyY{*|4M>t%sDY-@y*rGBwpD);& ztiOiN3rHH*)UZF!c%^gJPzv&6(rtW;rOI%)QYPmZL@7M~s07HOW-d*pH^h_JuBjHf zqyVF_$c$mCtwH>1Rfy=Gp4T=UEmFuyv+#wGCxJPzTdciQXhQvB?H;@mYs#_Fx+ zo!+Sn5-`J&PEPZj6l6dU<_o#KDBL|g?JDl`dBA}>kT_PDeubR=jP_?q87r{O8@naI;PcDn= zE5&`2=QiHQkhol?WkS4alyMAGE6K%rMg>d>L^-R^@N_i1g{k(lfzy`34G-*Rrc3%I}&Mv9EgDd}|%9d2> zkt5W4FI}XP{fhE5BdihGuG*_!+8~5Ww?#9aw=w2xPPfjM@vbTLN36r}Kt*JfXxF0g z2vz2|19C&*K0`$(I$Pz?6+XQx&g!0SE)2*=mxO{XvIIpVU1nd>ioX1{Ps?n8MvFnk zkiLzDtmLogQLnFv;wf5ks3=rj3&E32PaZyUI=bAv^HHz`tC~?%tM7{m;<*r`>2VT2 zsT(C>ej#lHqV%%nsR$@sJAf8@!iiXXu=8lYtj&+yG<_7;t=Mgl_cDD?bRk5;8T-{w zRn$=EnuQoiuFTZ71cyvW_IM2|fng=(P`!>#Z-)pwpp(8b*z2G1sE)ja@m>|8`TZWt z3&cVT8@p%lln?K1f&OVi{-46^ktDKAa!xR^LwEMQ=TnUS+(brLX*~ChniI9`29*F)nyoGDd~dN9 z0X|Z;%5U#8PO5q4K;wKU@_6VLg6G_P1M^B`78`QYxgv;R%5>9gLA&=~xub+8dFa3r zWNPX7K`F&(2Gy}ji5In31^er#&PTd_Jo}(WSmYYVdR}ryMtCwks@2uiDl{Z2PU`d{ zzO?;XRua+&8f>Jbeh^m>xtGZJlAwvhQc%;bRGYByl#nAP z6Pqe8f_SnP7m~eezkX9f)Obgez*2Vc)YjY z)u^=kAEN@>VFYzuomrTt4Q3duMR3lL*Da?#+5`Z0VD?rfwaiIP&&cZt%za)ye6kem z2KZ6*RZ6BOBU!A|bhrBBr2XJt)ogS4?3(-X*nQ2_G z%B%+cZF6aKpcmJ#t#?gTa-K=3D>B%pVdCggU|7MC3_>7 zQ0!gt2~tfxTz`DyW8xNlfsyqITQnf0q+?10b<Q$hfTuZr=N=xXI=?yX+id!z~@_uaK_jO!%--+<@O^0I-*ICj{KkfP7o z+mRCgzfkM{CZ-z!z%n&%4ExBs-Ndf>&2p3ZTo& z%MJ=SI5-7!MMXuA%iWZ-PsM-Ve)I2T-klR8ua%{D@bcgT0v5|4H~JIcpC%LWXMIy6 zkDGjX@abBssf7ho=*bAw1XHUM3lnp3b@io;F?ydtE{clvgwO% zO~ra9O`%z0PXipT;ZNt~m6ZfL4zcK}Dt1&eYh;VGcjLqhx?p-sKbL7}oh=Dskk>bw9^7xTM=B=Os=`-r-XSYr1bD| zox-o@7N$jLg`U;mPvKF`gm4{vR3O#rkoN8GAu zq(>%tucO$~?H^lX^=corsQdZfR*LDlhM! zo{nYfxR)3j6?@$gyS&PJ1IqJ@iDgAb>K}bIX(6D?z)GL3%5N(s-kAZ*w`hhG=As}m z47m#}#U^5ghgu-Y|1^-IHQThghr^xHLUg+Vn`cq`lTePiuscQ5t;)o)sbuWzg0qZH z@uI=aSn1PTw3OtiPEVhA?`}?UX^p<`MV0!~Sg`5D`qhT~!-sx7K{~)n9vJ@_uZ^-Y zcGF76)RL7I-ZNl-ge|eh+KVD;-xY|3lZpQ^pnlv;Nk6AKaW}NyP#_%3Ws&I6VRwej z;qqK!XBV#K62+mxiHd~>LrVyuV&CGA*`|t21Ug+b@y<3R7wC*iH~Kj^7d*am;1Spy z%y?4d{sN_r3UhP)K_D5k&HJ<0)3f`mH}G3Z=i5_fVWnN;&hSO%SUHRP<);V4j6OLH zLFj0V37(^}K*dDV!06!nth%)`H-zS3RV^PhI$6cGXaDoM29OX%oX#E-XKCM4@RTsO z!a@Jew`Q5&gk&nl<`{uXq0p)mlW03KMXl|!IUy#MNqfZ;bMq|N!u@B_Z`)t`z-m|2 zJS(Jm1V)FtDo_uLj*NxQ&l3+6A2*yoD)t{v%|wl;=S%zW)u|1>w$W{#d= zWRx|zcAU^)sRTL=&QhpK)E&f05S}1-}q7-#Kbw^z2 z85cfFP4yZRd^XSJOHk_>hg zCnq&f%?s#{O-KRcHKMToDq=oKN33$~XJSTnlGLwb243LUCKV^*ILHsVx3qk<+#5L= z3RbEEcK7o|rsE5F_r_MuOwp9=X2wp(l2dD8Vf9E;!3qi(8E=bkt>KU=sc&s!s5CXB z`8w#hrySaY`rwm(038-2r=?*)g?XE2#&oYB$Dzsawo;D!CivJ4e1L)@#!z?WVyj>- zOCGwP)XF<0b!M|aPgc#(H{2fhqLUjOvDP{;T0%^> zTp&pGvuT!6Q%dTpeU2LW3q;3#w0G&l_KvZ9o2&n82St#yuV9Jo7vJ2_pD`4kUI;pC zzCE|Y*#0|L5!`zw*={L@uUk%-b`xi`H0*Pl%ISkn`V)w1CRn2t!ka_4?_d0{%8*JK zXhfp|@|ad3B%AB!WlcNKDYG2m@Y;CLQ;yrI3Dn&2=X05X#rG(BL-^dDmDS8sate;n zr+?~9Q#dcgepeqy67c?iZ31L@yde z27y5E8%<2itA0&xuNoKF&3KDDvgk|6WV@g-&4ycEkmvKkyEGKZ)v|9!4o9NsWFilx zhT7T(6hzJMCl~^Pg5bZr z2R0c%ndH5>DjwhPgFH)IFnnbYCh^QJFH6mcm6XEI z3=wv}4#@~^rNn@EB`jxa>^1%>WCEhq$Xvy8^pn8UsRMh*&pB^jDPRThv66KpY=(G< zmFu9O8FXL+gQ|XLQGkDw7+=Qm2hH1axXEt3mJ<~l8kUW69ozREY=gc@Q}l=LNbXNE zjxW0K;Eg8%vhRyqI2hd`-AX(41i;d>FEtmtuOCVGgG@DCYU!tcH>rJOo35s7-h{VJ zCA;btpc?nRR^(3KDK09@+w^?bead@q_$}@W7pONuWfhHQYHFIgAuppM%z0GlI;3g6 zz+3pUuZ#z{ySMUCG9f7@SXfg`@H-Hc-CC}N8K^2=tXmOa*q z+R?CG=+?5-vB+PSoo-MsiL9hzPuz6%LM{1&CGUC#X|fg3$MiWRAC-ULGZ#{_th?k5 zvvSEu`ny&?&~+*iS~@w@)JOs*k`D_=dopa;oi4lQ`qTb=@&l&pbIdkUS0C^S_%`IN zwTU;CHWuwx@_q7SpZQgr$!c-EO5ceo3TCb zIcBE221U}mMED#Wk!WTIq85)Lx%d0O9$^J{?lX)Nq+u~Jb381iWssg$2PshLYo0Op0Q<)O<=>#>P96b#Zi%1zSuolA^@%tAp*P|P4^Y_WL*apS;+^w-_cF6dX)9p5ApSFJR!i4V z94LNa!HI_giLdb!;~DDjtW*h;vwyU5-d9)MQn$K_uX2QB#WCR~R;=n{;*Ob$tiM9k z_bp6=fA>ivX4x*1WPf}S0d&A;doqbk6l zl&m7`GyT0n1++d(C}e_$s=p(DUL&Dsh@dw?y^k(rP$BWN&YcwHQuX2xT5nkRSUr83 zj#*5GXmKuzu#Ud}Id?%ym?oHTmbkH@z4JQ$!K&2iSoou#76{43t&fd1Yrn#Q<~i=E zmYa`za(cOUcpe^WtsPZ)w6>#qeD*V5WFsNIYDe(RkNkeKeCrV_B5US}X|KlMflggBH`9622J@$Q@0-X9`hn;Lb17gWzWx%1YWd`XLv-^4!=q6D#+*iCQsPq68)D{Z zRUPx?ltEy4GX->%$>R9(5!!$%D>`v;rCHK>=qIbngD2hT& z%GsC*f35s0>oF9k$>^2*HwV3EgbhrZoO`SV(_gFXXn2-R$?)Fxg?PE_MnKo7 z{O9K)m?3DUg8i?Lx1_VR-tHAK@wPXTjj%&eJG0}Rh2l%Lx?yhhv|^a(dHpr`1Yu)! zSFu0sr-EScfRM7FkW>5p@=>#wtQM!f6Buxw2@fK%azJR%&lCLp}0M$@2pVIX%!dF z?%Q`0*PP7ofg1)($e)hvVA*X$Lq!o~w}JR;&3!Ob%#@$+6=0!pzjX*JpBc1xZ_Zv_ z*FC+RDj~X(#|FsWSi*7dSBBdt43$xa2u5bE#FjMUgoY1 zH-_?z3dIoxby1tZ!bsmNTMH`P`uA&8t!`{yx){C9){6_!vCPh|3{7!DjPbPvih4yw zufKh4Jx4Y6KYrNhd`(oO?Fbks_^hih6Oe(i-=L|z+&{fE_p2}v18*V=G(Ddf{pK9- z`&tR3;fG#7#Xh4U*V z3|^F3{m|`Q1iwvxC)Zum0Q=h}cvs#6d@qZcb!QwbqvG$GyyP``|B%7>uv%q;`F(?;SDqN;!$H%1VUy|leBkb9;@%7w*ySY?GxtnI(Cxhp z9tY2o%oXk4WtnvkvXU=fuRo z@LIfwdN+BrTRNuB^lyHEh%w+`Wrwn>HLR#;ru#$xl#qM$7geO!mc;vh^=Vz)UN|Zg z<}&}{3YMNVmVmEzM3|0g^l~WO^CKu0cj~0b0}Nu*fF`k4C|F(aPU!BdQA~(`q-vY8 z=uYp1$N}jgUC-DD5+@dY-W`&*&59qB6^xtwGts#M^4PC~J(8C28;yfSbyzHjm z_AqYg$XR-44kDdmUM>9xkM271X37n*prj%Fs}nkA<-VGSmqLI}4tr-*^O7i~_03cb zqS;s92qI}0B_(u+9dn%Kscv_K#F~cLpgCz6LAN^uwTrNS|7nf#;EZlzUsq39i<4Fd zMgyF`K?LfwjpF{8962^-HyT^)&hs}g{#$@6e)`{o?-@5_baeEyo?fY`W1OwIXS;BLgfnz3JFL^P2GWv>!?)z{t?P5TwEeUgXh0vAHZhz-vWk; z|Uvw)0m~Qu>{oT-2nJo12Re6vHVhS^+ijo%H{k z$}Yy^RLnGZOngZC0^w%d?P5-ezArAqO$mre>dPR$zAIimAu^Zx7=GN<`-ChgJiKd9 z#Nfc7zIJM+PpS8~#}fo-o1uJ$}E4C{KEsQF#>rv@&h!L_+VaO>h6IVl+eUHiFsY{)oD7 z5bBJMvQ6Z{I^HPtfs!O&*Ngfa?hkZRYtDnnfe_wnRpMN=7}d znN$m(xw~$SF-*(sf59Q`F%U2v1sJOpo(c(!6403wVMaXq1_Y*kgp2nxOO{vtOmp1V zM0vSBRE*T`NJx^FS1JmVu|tc^J&Sp=uQ(s+Y7V;;85w#m@j#b1#CDdJj%mu>6T&aX zP?k{bAg)5mrqH&17hl&v4T)4{cP@O-Cq{M|hEl~d-NnaDtgnVwksoYiVkE7ugczg} zV+y~rb%^r`Xw4k6P_b2NrL;Te8Iu@dQVG+cd?^fxh=`zPjjy}R8$9ywY0;1eKLsBe zXsCzQ4TL&5Lmj~~yVwEOHW~6NV|2`2gq8QiUyO4uoU3Gxo{>}zmr=s=vYg4(RJ2dqww^HI$R!J zH=MnxNZj5M!=^o#S@|w@^Lt=a1??6AoM}H?w#z@la+jD8bg*1+^QW_XcsVz8bRLERJw7tNohqz4c+ z>WThA`l4w`BkIVNCw2U~xufGVo8a*Z`9y3KF|~@E+-9NJ3q$99KifUn@6}>FT_9Im z*bxY>j2Z9QjwL5){uvVXH|gTwjD|#Tn+I=yHTqTR_px|s$vs(T(;6bHpvf$g#Om~X zFO7VdhUiq^Ke~#{#pI^ig{%}gT3y8rT9<9oX~qCnT~hT8;j`Jfb=>bpFS;Y_91}$} zo=S^~dZJnlxTih^CL+el4pMoxO>d-Ni2LFf79dn)Cqr~ zS8?g5d?rM>)3tZw-mUq`YLqWB%3Y8H-V~qcBW$d=cU0MVpTZ}EZFTza;fZ&!Hm}xh z&ii)B;(3=&Y|9V2m`K)aUjcL6O-E2M90eK>p(P{YbV{;;X#rP~nBTeA^>HQpn$9m! z(%Y~{lJ_CX_ThFk2*yUyvF%kiq7Q4x zMPGM?JARR0i+YmX9a9chnq%M||2*~3zdS=_rvc{j8o_C-lHdsFPz*1}n~?dA$HbWf zJ5?pV{6Y7G*QCa2gK5Q|~t@+eqJXjXspt2HFa!a9#G*hQxxHTOJ zm|74X(ebex)*Zg!nv>E4pa>z55fkgn4_X=7xWs;5yYn!liyxwyVvpekw*3ijNaPXq zU0?Lb=M?7ZhYm7OOw?s-i6z>rCA}*ct1d7f2Ot#_ys8jT{QlUk2o$AuZ%Jwq|6$ zdi6*XnExqF^12JcKRC;;t&JP6$ZTiNVfUxHc3Ul|tBcTM$%qJzTAu$b4T zAQf378IE^9>-q;q(j)@y=Ch80%!|IjOudj7B|<=}9wP%IYj$(FA%WDXoz)jyriM`O z)uW^Q#Ie>C!G)Oi{>ggNDs220bM32_t0+dFJiiAtJvG$mA* zlm#DU58BmOE_KH{b2BzX(l_R`h?9uMqEyCh2GisB zLkuKxL^wnt-XqpwD5YGL#;?^wO^SGAiIrd=-u>4|-QCP@uCJ1mcEdOAR=rfM53vrB z!f}<2%6U9g@`d&F8sFpo)($PuOnVpZmg*c978b9hIMbq~i&@fEPniJdxTM5!`lOwO z5Ew)0LP1L_qaX7uvYkPjvA=Jg{|UMoXBZPYQDhKfLrg$WtSz)Lw_aUcZEZa$V)FKH zqX^ydaR9!IQ@fl|yTnqL-O!v~8i4MG)$l+tB}35n(tIWS?>blXzlfqc(tle!{mbED z{;gd8!j@r4KmL|UKl83Cm_I8{`q6`v#k{c+l{&Eygg>zB=stn zy|JpRn=f{2@5u|?iBxO~$P(3@HYBm7o$L)t^*TBhezqFEQ(wK)e)dBY_80_#UhI57 zXbUvnXo+DwUqi6!O}qhrKg7LwoXYE+k{}h|m&w}OyuERf%N-xNk=9nXJssg~T?yn! z5tF)&c4hOghpXvV(smC`{WTAr17A8qlj`@E_L-)3;}m|p_$b-k2HUX1D=z< zSpd!aF-fs|#=jL>p*)>PNqk#Dbvsq)05>qQZ@fG4`f_Epm<_a~9_RN0>HKq+B;8$) zFZ$a5Hp0Oo<`~9^pPo^`*o|VNPx3r-m~vp%x6(~Y?M6N%m~+Wq`J0t zK;)Y73f8OI&W>PJM$+@0tVPyUioL;HFu4itBP3@;?DbIiq*h2lm(hUiKZR*% zh|Qk)z=9sW^)2pYKbvoO;<}mW!!EZV6m}Xg#W=*1Q$1nXeg;nRR8iFyrCui^wu!7= zd{8nnwM@Spm4K%^#ejSp4vZsnQkg)u8engcZE<+M6j8CXyt*LU=snX-iq%w0j1IF4;y>hz9e$sFIS7 zhZMz$j<6t}d~}tiXKV^bZ{;I=AYJ2pOn65H&ub0_vr2jwuV7Zor8lR^`|9ga&C}wE zsNU(-nBNh!d)oa+{}T_mqdVQUEcS2Cr|}eAHZ@=(ry9f%;=_CPHbFv*EU0t&@$0ii z*{BagZe6QH6(&YzO>ZwORM%wyFK(G+ZgxF%Fg)@T#<<4Xv1EHFK_M@3Ai zJQLf~BeLx)!5~J#a;g0Nqi41U6oucyp<%(PME~1k zL0cy|VS}_Uw__)yOD?sUwxiRGQ5N%V?$2M-p3t+ZYB@)~ZXhZW5tWr!)V5#!7`s6; z`{8Es{R@&*{5uZ$+9=>=}hzIa)(!#zHIF-2(7HFq-17_vPWPOsQA89e`+y=U? zJL=n55I|Hk2Pb1xzgdpG-lXyUKP+s zR8Y|KD?Y={&Q6%IBAf`~zmJbFL|s#ZYkoz>^aoobeBuG4d|%&e+HIgtN!*M5T|{BN zmz;A4Mo@4tjw-gg>wQdXpDajiYI@{;@jz>#1DUI>bg*@x_3p!222on_zPSpyIFiR` zWtl@EHCEQ5yRmQ?zr!Ia-Gm_}6r3!+c=^CNI(v=CSIgCGu-;YVt{Z*Fvu#l^0#O^V zM{XVeLmq%3jykb#V(5BB<$LzF_V%LGAtN&YX;llXz2H#E5|(u~LZK?pPtFkQzEGT3 zca4~dB?2wQ(Fs^#scf{1Z;RaU`yRp?>D)vBqR#eig6SrpTX$S)**O1KNBaGqRr8Th zYVP*)t_3vezRHGq!iUt)$oBRHuM&+ZjZGjPfitUMWuz%UIMc}_CEZFZ>FKEk=7ISf z)XZ5(;-XX%#raBzD3(gU6Vxv`#7TQ|{G;WM#9i%;RB!kUrO)z6Aqjg;R^KswXz=u4 z)V5Iw>6I_KyV!quUG*Gd;_xve8nxxZvmxL?YxU|jZkd8;92rfARhxG4-{b@HF-RcU zJZb6~j4f&1FdUjorgBW32TrzJO28egQAF5|gOPsZu$NSmgORkx9?fQ4vgFGg`RHh* zgX>iv#W5qnYvO${tg)F5z}=O>7dKU^z!Vc3S5fsle4<5pQ5zp9AmnIi{8cgrEH9g= zrCU5b7fUH`(f9$nw67z(MGGf^xe__h*%31^f|h(0iwXhikg|Yu(+Cn0O}js5PiKy3 zcD}_oG-$}FC{Ls26X_7XM0(qEBgCGK-z;(Z1rQSiSg*Tym#;N{@rolyal1UU#oRxT z1-c{R0Z75=4*$5F4MnjsC#AsYhEqNizCGJbeHb^fs>buOv03d=3%#!C?coT_Ze|E{ zrY)dtj`{dQ)|*4ERxJmUt|?|~gvLhlOGN@FdwW;A-U3Hw-cJw>lVcc)1K%7}03yqu zVrpg^8#LN0 zg%7p`1^l}3zcaCdr_7X9GUxY$oa&lz~lLSRQ3ZZ0I^h# zd-DF8*gx_C*kT{rbhH=XNra`wGj4Cj3@?*3Rqs?#;1(LIjZ(J5w3teS>yi^5MZT!F z*3&|`=CtSg^^zF^wJFgRvY5!+qZ4~T^1E~MD^yBQ?0H~SwD|4-Tbe;Ff zgQLJQI0hQLy&X%4g3$=R9+9E~LSn`A^)-IK!@GNGY))RT{HFIN{yvm%(yJLw6S)x2 zYXER}cOdKQVUommgAZENvRu!` znmKZ_;7uT##%B}|^(-CyMlpDGnxHNvAZZ3oZc5pTM_}nyrn&!Oz|1RmnKkI<3&px9 z3sMnA*0eM3iSMpGQ^VD&*z0?ic~ZUN{PSQRFk_PC|IB$r5kI7F5cA~xp+}2T%er_d zw73{9HqL28eNnSuuxpA89EZa!5gbIR+I*Q%vG1NtSsqt4%8!V(^wVi#`mPl2SdShp*~#Afu;0Gy z-ur#~w)1-CobIlw?k@SO%DmJexZ$gimq4!S2{tWmJO*Y-4Fb0c_qdOICi$CO#e_IY zvtHu!agtFr*UOl><v*WK9_iw0#IS8{Q)9Vqndkog~bRNs0wWX zpAlcgu-233Mg|9=edRe_LJ)Nq7w#UvE@bHW@!n>F#%i92RhWZ=PaQybePLDcy>W~M zXDk+WG{Rl<#Sm7c4@$&nX!g9ij4@|h7YZq%vV^E_{Pe9LV=X?uGuSaD?-mE>bbOcfb-ebkZ#za$<*A%9~imZmq`M&f3>Vn&m z@UgD3BjXs?fhz;vs};51%8v6Q4>sXm5R0mZx|)prij3N_DJqE1-JByA!^!O_ z&UyHm6s_uG9?56=zjS400MMr_vh;BkZ@7O#-<$R*;hnP8E3DV%gf6{9D>>McyHd6)+)YI z!<4@`-yr`WRBMWl#a`95lnb~hUgc97WK zcNJ)7j-$?9d-9?!m#Ujw8TQ5+c}Mhv>8&U~41=ARpk6vUxT-0aIy634{w?eZc(Ira zQ+wI`_5N$%q<^vS|D|-rf9vIc>rvMUj|2;hNUGzC`N_mqJ4H_0Z$GWvoucE?i0>Y1 zJ>0<>O*l8TwhrT(Pn4IdQ(sB$pFRy~Y5tB7^{?aePk5{m%6W3XNB{w>fGot@K|a@mUv_1ojvgmK?=WRzJbTk?R%vhv2{MKuV@}f2 zpE9#(iW*zLobPTCzaw%L{`ttnPpr)+H(T1{g8)u57{saAH_}w$xd#YrggI?}+ zWzD-cF|9>M zDc6)f$P<{%-1yiOHeC{n5pJEMVsCoieR~TGZ$3`?fm+{Q5fjxQ*m?VQvf5?llK>XQ zJBM9mpdQ)r;OK1Ngw8-LSG6ns42hv3<}CZ;vY)WHb;)laQ@FPtDoJBEK)E^_Tc_23 z-z4VOi|H%1-)E=SU#8*=On*^IhviCSBS1FZnKAM>*Bnl>#-x*B6RSCMUy3VhVi>r! zxDHold79V8ioZ=$viH%{rqxfu*#CM5{Q3jF=tx;rZ`li)U zC(ezifGNh$ZMtoLOqU%}N}AIV86<<{MHctGC*h~K642VZ=K5*Gm8>@?Tb*;&?Lyn#u(KUaL;I9@?)Ka`#{+n<*aqY*3N{X!#cR; z2e6vkcsnT^Whcy7`88iuubg%e+Yb@b*S8x@k()&41O@qrc?lDfg>!XCNH!tO>vOqY z`KGy3Gc^gO!%2@8v~x)+vgeJwwYR62m$`+7n(;Y@cGM=+!7j;ww`^X^DU|o`^%eIR z%h>S7hyl3Xl`h1w-PI)fBpio);`Q%o?t$S)!`8E>fR6mL7sRt3n(2ru7$)-i^lam) z-RFF>ux(@YH&TU}tIZ_%^|hO@5DVOUUc zT(<4m;NhjkC1mT|Kd$xd&Cm4h91NAa&WPYGXji&|i6k5V!(sc8P0Z7@HMKMyiLb6* zzrqZK#Ad{KB5m$Ox1aiP(-gaOHr&}N_p$hP z+^WwJuGHj>4&tHCAf{kI=kN08XC!2Xwv{f4)w$WPX`c%9i{4Cs1K&20IP2)hqMS4y**Tr z9;AE&_7Q5|Z78VelLdF5@6Bd{TrZ{uU3ICAjQzH~Cg6F)PAe2IB6@T?XJPI=;$`Z4 zjDwsWJSrl15>%4QM~?O_@5m<|X4n1T8e#Fm`Y(TEgJ)H3?#?ixX-URHIArG$XA$P9D z>}-1=#*x&$rDdaT<67IZvY^bNqAqyRpU;k@QL7MENAh%LtjaEs(6gg` zaPvky??G(H%gt$Z-7~hjQT#upd2>hsE!uHp)%Q)#23_g_z!a(fSCK$mr25aKEPICD zNU1C|81i7rbK3$n0<+xh`ygVf_OD2cxDfv!la}DDSiSBzi~&CzLnF~oq`Ez(g^j`# zbs>IkFV6grKJ2b{CZgUx%5qG!;u|gz(F{hGn1|fvF2`s#b+)Vcv%&dq_pLApl9P6< z0?5>pg^nH@+a-}kwP}TRM0P(rBv8IV%I`912Px3146q(6*q)9JugFAfUo(*NDckch z_g}!-VPAQ^)4>snplCnyBzd75b|zVY46ER@-|@?=NK~?M!ENH7?#}Rw)|%kMpM9Ne zrA9IqjXqXS)=W%~&L~kOm| zi5sa)w8z@~)EixhTlc{0wBdnYvwR>tkv6$V7elMZ0wv z=2;<>>M(HcPGV4~g-Gs)8ydbgXV?rHOAp(1KRbcVW)gW2+N|Q zA<%hKT~{l}abtv&hqFoO=CHet3Z;A9vnH#gQ^l0h=yI?qO2($R-M-|Zan`TYr!(q^Q zf;4|xZ?HP)@SO1Ty33$iAU_8XJ1UCx!mSgbF9QJoH+KPc0?#Cuqs8Mh&idBemw2;A zm$;XR;mUrL7vH6RH?+8dFC$Ri@)h%w$|ro^EAkVny21Cpgrh#^$X zJvjV>pig3-P2-Z7I^u6=7i;dg0~(N<=83M`B{9Y`dEa7i>lHyt?} zu^dl#q0Vt5>n#5KuPdIQj?M+ass96qh9xMO)LA7kIjqHYPCK;BBZ|{z=YH5Q&nP`&bNaNK8}2SQ&<#7Ym@#VcPZ6g;WB|5_MQQn-AT4kFxDQ z4Kl+1yKE-J)JV(vIxade2C z+ekkt)Lc6~aC_BXT!$72-Ad^!w&o)VI8d-lxwp-nFpmi(cArBWe~G0Jm-luJ^X35E z$<<|l2rQ+>p7)AG6_%2H-|PsMp`++}>8B9lsM&dCL3A%2Xm|F)ZcTUI>tH$PM&z4e z3p^mnipVPRyqAc>qv0YJ_Io6v4*eCyt^`+1k4cT2JVV!dg~2j1tBNYhMLlr1r{js2 zA9_(<$WmP^6KTp~Z}1H{77-#Yx6>DXq(PG->>Ncn8rMJY?nBCpx-H z*+PKhEi11BqZrvIuGOJG5Zro9Hr+>I`ncmvm+7H{OqOF4txWM~ICb@QpL==$ zKcz?7sN2!Cm+XQ2$^HIBZ^ZPUK?JOrD*ndUj*hQVUBh8siEWYPSjn~o`Ao%_6vg-< z#+BvtPEyVR3Xoh?17P-gNOHN|V{IAiWge$EJ7H}eY8LPb6Ke?;9JnSA7)vLPE1;m9-Pj59(YY@MGefYz}T|^J_6A-elhBz(L?!JMnnVAYDU#Dz0F_n(+tZ`0}58RAi za?Yu52=bU2CB{;nwz!-^@*Z}}!(SR)U+)%fEm8-IO>!4?@gv8jPw%a{^oA&;e#Ly(ts}Mpd2H5Pmn_KunzIIeqb46P{6iX`kP#43xz)VQ+^7+wt5%jq6 z(^>lWApI;Vq9=#Z=ifWNU7ZY@0ZJ=z{z=44kFb(pm6W5}mz}>--?%wr>**U0Jg+0@ z{Q9`^C<-(rpII-Akm?5e*%8#xjg_S>)++~zsw@q43d80{3dy2C?26G5zL-+KU{6K7 zn<)A|&l)f{QLk$ATw{ADYCZg zx9~A1x;t&^GWjQDQjz9*h=OO;2T+iW;KX<9A#H56;z>ppmXSg*>4dN&Hg!wK`#vQ@ zIjV=GC2lbo+)V^?g$3TIO{ety70BddmGUbF;olG3>jmI8(k2~jWOK{~=;{s8jAM8ke1 zPN03o8pLK6(#vm@mGniY^IdmaxoHLLN&s}?yV5x?ukN;XV{ZhOm!FDist9y@pXlQZ z@&;)9@5GA6g%+3U^{P)DwxpT4`*7W?#Kx{#2h?@$5@1NW1NeAZLBdcRW3g^gI!I|< zSlcnS(U(7n*i*fgQDMVB*xL#3De>>lhRzQiLLb_9yKDHmhcI{-a^q-TUle4mE$McZ zXrqCG);4+^i?=NSqu|DIx9fT#`z$Tj^G-xx(X+SPc05MsNCmYWlwVxJi#mF+HqXAe zP7NaHr01G@O}*J+<@LPhAu?}UH$Of>M~x{KKJ=hS$62GTt*7LDopue_#uQQr;6E&% z$6p2Y0o`1>{`Z|SSx{E7-Uw6$$1a)usfSsG;(s(?a^mRM~!W)>c8 z=PA|=xA8EpwARVZ>+qYUp@!*mBu5qw!A52a$B7vRRFVQYh$l)cp!Iqj$^2*FIj-#+wlM8HJWg z%BD(HL0P==*4b9*Zpz}+G*bdhjs#{Bw5}sgC)Utf3nZU`;$GL8!SO{5KU$umLt~w! zZR}PGB+Cm6y_z04h#l%G)xOuQNGoIlTrxBOxk4`1=6X3KkV+W?dt&dK5aUoe77D!Ia)`}c_{zSB& zN+(f=^w7b`GPVVls^ocDw>pTqBR)^h)}6F&k{A%_kRv4}gSRIdK>s(VtgLVeS0ef|KW#%h+zgnOp#b#O?X++t;T-L7MFIjOpLI{da{j zI$z8X5h%93w))^KgsPo~p7IFwSDJ12=BfXb@L;bdTS-8dC)CS&tnJ$#a}?3u+c`R% z38GZQX7^YE&yKFl(jZD&8$P9y5#%q^*MCjb5TqnGqz-YV8nkr!?w(AHGD6fpan_1+ z2RnRZHM)&-kxk!`c7^};4yB&qQPTYm0>OjzN($cIHVX|6Jt0FyL1A;s%gXw&%_kud zaYjvrp{%T_X&m$CTb9^P^bt8xY8tF2zV@}bNk=cVdwyQ1puJoAO5nFW@ChQF;P26wl%2Z;(H?n0pvdo`W4W&x!!RLvbk zaotH>dX<091-^mu0tE{xn+N=R5Q1SXuduEUzwc3FeT_4(=+pHw@u69}f(BB@izDRv zClWaH$gdSqb;61ysk1pzQ=hDPs(oIo**EaPZtu{kSI=MT}D@|Axb^Bv%p6a zTAqT2cVmAJ%HCv!UPlVvwdoFR4N))E8p|k3zXkWaKxdXc9F8I74pQD07|~UR1xv^L ztuwdNG73mLgA`z)rDBkoH0z9b>qgOXt$O$0?d9giKRP~Lr(U`R^nrX5d`!wVVr2)| zJd^K>y0juLGesICR^^X7xP@eFP^%YE{=`X@D=-5xa74ef4(v>{U94|mGsl@q>8QNR z+iD%{IbdXo?Fp;<>qbyn`W|{b=WuS5y@?Oi$o5&=KDP}5wYK3?d*ce)R43}JLtz%EWVDo$uqt1 zwshd`$@p1onjHE(Y3OFf921jh%)AS)jN;WKxTWJ3pcZnhi*lSIKJ4f~!~8S)<`}ab zJcX`p3}R738$N8Z+4;0Ya+5pc`SM-G(T8fKqrny28&zLIj`fOJC<9_2>eTu8QKz`5 z1fhpMq=J)ER$iHn%@B-`=AE){1*=R!u@Ul8!8$G@ZI9zEZzC6Ytg$p7E_4;6{I2=- zFYh@yc;sDTRt{><*od|KJGri_86jYB**Klsq{@s?g^Z>LHQVu#W==K?YJdP=Af)$b z8-91ZNeJOJDVJGu!lL^t6r}bS4~7(SI|)TKkdNRI1xB8f=hgQ;BALfKUG%+<{{8;< zb%Y>ngOK#-X||!5Dp+lc*1plSfBd&NQ1;>`lJ=a2pwicm+K5Aax2w)SW-m=p`2OX~ z1zP0D#xcpxwm*%BAPIg#LMUAPTKoA)EMmYt9}e|13M$TXU@?giUgm9G7*0)z6PKE- zkpVRUs3_6!W90G@tF4`jwD%_fU^W>q`$K4483sdn39V2a-Vfe}u_{N&&+mB~m9xzC z^aTl_978+{Aj}9BWi=FfWIw7F1*(fDflTQc`-s0w^Gfz1dSPu5cR(a+-#1K!~uSk3QY>-wg~hV?sSsQn~G~D)l}D@ro|Y z>;6fxX!$Y1XBR{-#UO~^Z?l?fHA#i?a~XyAw zg7;5Kn0lsnvQH4&B!q6)Kle&Tu3pjlaGycmNX8CnBO4?H>i*_vIH9C}`xTAL?wfr5*x%1P*7auwq+zJvPUh=joAmKyO{e?Fw>3Kg1CLRJS=8LU!^%GF&^ zAo%cgbL?8{Ke%PKpO$Gv-b_KEj-wNj0rwKvlGY~Te^ibka|=;fM}T>LaFKBe?JHfX ze`-$HYXez|&2S9nG)<{MDobUxyfFwBobSrf7Cc>U4dh1@5EPBXPkcWerS2V^)>{b2 zO-G>dcKULEzMX|8=7Q}l>Wx!w(RJR)^7nSn_sjr-IgN4(lJf^I(AzF}sx0&D{M{w6!SA5DK+`P`mQKSmw~3?T5Ln6es?CRq^1r=5??fAws15%OzzU(;At)I3pq@{ z?8c_2O3AUh83-K~h%r zt%jnDo1?egS`f|ZW-r-hFDyia@Mb+1JtWST0N21pQl}JU{)_dhCDu}g7iUjb$?IZ5 zKSY`Fzfa%KpN3n(lwGk~Ak6dY44f%7PPXIEwiqjcD?i?X!PpkRIHycFE%dg+@`9AQ zjZH(Op7V%l3roG)@yk?7O9*#;FfL5P^zIrit+XtQ91^)H>2*IJIB#kx5$LFicv z1`l-G31q-7+u-T<@VSp^9$2@BDe5mh+m$;e_l&x}a8%^|#Xj}d-Y; zb`?9($8c^Q&R0X?Cw(1i!cZ2y)XLBB@KzL;pY6Qf9A|4y(VT&N%Bt-@_UmE-iG+|a zYnDz!NkY?y8w^Yc&fh*(v`m#}q!B?*1=qr+ixuLx&(Grn1L1xd!E|hPNK{mml!e7^ z8srcP)e!f5wDk&a_qY=SV_`P6zZQ{RBDajc=pq+ktzyXej}6xG#r3$*m~A{!e4A9Z!vAuu_6I7g*=q|UV( z%1PqX$ZSmSZe;-EOr0YX^+FyBiSlRfdo1nw^!-er(&g%U7@Ix&Uj_UAZb(x6bZ~K* zF6)H|l;*^97RWe&VJW4lE*J%MtSg#ONSGw{vO2`PX{GP1ra&fS>?kaVKT~SO0SxBf z-Q7*d$*GoPW@bi(k&uO(Ten~i0x6J;=uHY^;*KqpIe)5xWM+AVJcvBr0tK^s@>Sj5 zU)CT~=^Iqq)XrBWe!&L*XelNoB^zB{7M5RjyzK>G2jfQHtJP9HzyUuR*kRMDKubzW zXzA$@J32a8xVUr*w6wJTRg`LOZDk{*<&RNP5rfu^LH@*;hN)Sc3R|$F;2A?YTqw06 z=4o+)gbppITGcH-bL$s(gr%6k0&zPspzFTOl|#KMQB0M?PEHF^+!TpG-CS z>WD@4_h~yw&k{iaM8PN z1E#%h@;QNU7VWdcTOKO}2jqcGAbbf*@h7f{#L_oYdE=LqH?)nRIGl+ER#flbzdz^1 zDsky9u_C+{V7q=F!yowq4+a3!kcB@&9tVN zXv?O9P|ZU4o$6XfNXu%Od5yULd^9j$iVLzf>P2(mU7?L+WX8kQMhoC@=L>xkpy}6YaXo3+qfqVHeFTugoFns5~uiL z=(J0~)4QBDV4bCCfEd_-Y;Q%qOguC7Z-aSF>nl6Q+EvHm>VcZxagWEGfs^OY=C2}p zRZirKM|-F`tzyOB{{}pd2J~h#rRz^u>DFy#v+1VmjD(Ewe`Z{Q+Da>M5hr0HrDnf| zN2J2jlA{&Dza=LvGWhCjSk50k%c@+((o@7ABj0$4!b5IZ)EQs4SkaJ@rMVZCl~Svj ztBClK|F62%CrbldNz6oBWCqTjMSx!+UiQ>x?^jUdZj5S!d|7+(eX%}Uw33LJT7xpL zN<$U(L?K6nh0(Nu=E=kw&AzSy9{oNo;C(uwOe_hCKN0X_h$g4}A%3Y+3YX@p>>**P zrmP?xWnx^U!ahC1haLrYnoutxMYM$b^zAJEWkqi>FkZfe(Q}>*cOh(^Ou#qtn?0Noni5{a$_aN{EGrpk zmgozhsW78tnPFMOLk6}y_8=LnRLTiW8Ty82}5^WNXMbnC@Gnp1(q=eDd z(wg3!-i4!VIh70tULj3;1SB$|ALs2CNBL9pr_l^)BLbC3hNEb0F;_#RnJgglRD(+4 zhO$)8Fen10ATnbf{|L`r6(JI+l17_U7E&k(|Bq5zBfKSX+|eS@66oa07z~b<9x@Fo zys8bV{hGMcT9XqElos&3Qk(mgTs8ZiIE;YC=As=+WZ?BSh>`fKv7WbTq_M)SPrv`5vG!Snydp`wKyPJR@l3BXxd1fMU&%a0{KmaEnZfEDJ+xVf$?jeMS;Q^7vn*FsUL{{^T#S zb=IogNsql~AdbuRBjGN% z^B2fo-PqrcO-88ZCg9O&9iYiu!nhmVtcn`;PlOEIWYZet-I(EJ%9cxHrGn+H1wRgG zsA@TC#cEYgU@0Idh{@HW#O1&aAROLsy(?<4WvdLu4@U)KYrCKbWlp-hN$(2tPt^*8 z3NZ1MNuw=NOF~y9P&P)O{c%G3MUnx!h(?%ReQ|ti!sHbIz9OC5BWW)#F%ooTup?j!mZW0fj zmd%fOH%=8j*e*U@5e~PEt=x;_fS0*ca#JoV39``5UD0r?f{pPK53gXXLk1%{IWiEi zrU{Et>BBbEkuZ5fnY`kC1s_e8LHbI3D4u(yB!hX06%fu*@M)svjj1JB2vNNKm?A{u z^u*72vMnB#;BU`=<>@vSOv870^l1$;j&x3lgp7N6lmw*
zYpnK$DK}3e_7@cs9F4%e!l1Y0v_(R+7h^D%M5q=o6Nt;oqtmuj%2*yzW&%4?7a%Zs z>T|9Urklt}PHSKRCGVzkG?4>_n?tc{1`0FMSH4p63!=p7=*uxJ!p>NIYd?-X80oCV z?C&*-EpKJMrjjMBA~B#dqLJ+P$9CiZQHV|WicCX*y*8_6|bl)w59$^)1d+?3M_ z67{k5tp!KwABeW`9Q?0tPYrE@4nP;0>4pXuZ?*R3@si4L6ls-M>{jmK>Q_#FHtF~# zT49Z6@W*LKn>Ld369^Jr9i5D{=Ooq7AmB8}2Thj;!xmw1kqDQRh6m$~;%fVlqoB_h wC(00jpw(_coH+<$J1{~jY#&|`^l!Z9fO5@4Dt7HrxPLz-IW^f@X|v$}0m34png9R* diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-06-add-certification-authority-snap-in.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-06-add-certification-authority-snap-in.png deleted file mode 100644 index f770d2f259cb7b3f013c5eed728c6bb8f52dd0ed..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 77728 zcmXtf1yCH#6K@g-2@u@fIh^1Q!QI{6g1bY4yE_~NcXtndcyM>ugF_DI@%`U>TQxg1 zTRYo5v%l_b+Xy8ENhAb(gbyD+AW2J!seJhGvE#k{_zL%ag^GV>;Jy3kq9Q5sp?Z?= z_<;g>)BA(?3HviLSh6$v-aE4F zjEoGt08{ts&98CsvIxh=(qzY(H-=6xgnV#MwhcXYe5>QHXZQE%1qB6cPM)5nTU%Q{ zdS71!eSCbFYdbnBj4UlBd++X=1FNd4Y6cGuisA6B{``jPAkh*PAT3)}b0hYY3z5TICOIv&T z$A5FT0KpB9kOoI=fK)bh|KfLbfU2kFWM0k{dSounDS;H^on2h63rj5HvyuvWJ;dDI zIo;hA3X2Q34i2QXJohrL{$n}~O zc*HNz^;MC+pO*%vBVG=vo9gVd9{F`G%ESN{Q^DG;zU4Ur(` z^VK|9=094E^%}1eJr5q^CN(dBTxhz6KqV;VVW=*`8!>r`@f3WJ+2L040 zuW|~7PU-Kw-A=vwyj}-9*a)_HCcWJnK2LpmL&VNWh}`#BX!t1=d!<;d2C_FZ3$CkU z`CNmMyRyP3?>#f>ql%~~?}=U$ukY+jj%=)rUq8Dg`Iiu{iXPM5E^(gRzsH?fmA!T? zhlAC;Gs)(7B5Kd0DskPJ_acj|%R2U~no%YUndZU}$18^j942B9tyW15jHN2FwH$nK zN40KbQ2uwjyC@%&OXAF{AyrPadu;=~e|vf8+1-4}3Yd7iN((4M)zA6Y7JU%HEZ~BV zuuN43vUhZh&&wkV4GY5~B2t%f@b!KEd|bvT@SqRQ`U-9gfl}40VgRErm)~}4uHXbQvYQRy=lzI?J*~11>5$X`i2~UhwVl=~NK$FDJNnfuDoAU0y4TDI#DgkEVu&C_BJYKE3pC^T?KLsy5_1~=r)ZVmq?jK{h=kJl3D6M8=Jcs_mK{6FSavJtqo=3T;k zyz=f{U0pY~x6_-OZ-Mu73meums_)pB^!!d5oZY_4OqzHmokv;0clov_yx2JJ1*FgzcXY9$tp$8a=M6V}p*HQC87 zn3HDPgq7d0y?}|Xg|{@bE10NWh>7E;%f(X9jEti<)Y91%n0FP|x|kZ7qzcw~9FvLj z?*d#x38tE^Zl*a|CDn~@8HJ!*dyE^II}CzJmLrs%a4pEJ3*EyTy~Vx6iOcU1`y#Ox za!Cit6BKi3L_pZIzRPJ?0tpF_{I`RNaJI zsENG4N2h|V<#y#E`@K{AdNaey0m8}w)AR7#J;_7M+oK`Gw|95q&ECy{HT{2xaXVEYoL+wo zd!7gypXq6ngUO`mS(xLlJ%|f#|Au_Qd6qsAqO7RTkmTjnW4qm2K%v)8gnoN17dF~-2w=sj9<8|1ANjh`+jt;9NGus6wG5MQO^*4Eo%t0AO= zbN}jxKlp^h;3RcaRBDGiM#_A_BM@IvewhALxe>5cu`p|bm zYi*~>?Nhju$^GN?FOwo0`g9bCqQ(3Z1%a&KJObeEfq^H#Govby@-)*EI?0!gX+O;# zMLNWhh$vGBfgJvBqR3s3p{zDe35@kxgUNr`g233$tcrJEx3=^5uS}#dGg%jaRYl#? zDAk28K55(0n=QH-5hjb8X$!f#J8AJQUFS733Su<`N@+%*-#(x1z{rW{j9{~Rg)ngZ z+oC76)G3VBU*tT?6*??I4MnUg^6oCQI9;} z=`BQ1=9MO%de}yQdC6&+v!D)wLwDLl-isGk6+*2^3v+||Rl2yL$vayXqdmToae#Sx zgk^IN2UHS_5kNi+RLZXR-%|MI2>>lOXQbyX_f=@kd4jA?!rur7TOAA+OPzZSJ*;$$ zlshOG^Kcv^CVRG~BsqORkJlKqTxsXFn1hUbc{6-{H2!oUEciUw^CD~iU~##$7LH8#P5@O0pT;l*9tgfHN}wIevIhmn=_gVr?->Gz|OgoT%+oGqj|KtA`CjnP)Cr zcL`}vy@ELJF9vv$f|{c8oup*px0zp|LWlX5v=-E%zV?{Z3?L`DbqKta%=QcYBlkX% z)9GTs*xOw~X%EfmVcO=ly;&FOpt%Y`v9yggRZD$(0DAq+h}{8D=*>m&JM!S*A`n{b zb4|&q4x0UtTgjVa#+kI%ng6b0HondXQ?>5`Q4W%uqFq-^f+{Ngpb^Fc)Mge&{l2bTiccR5mKK6V5~tXIPGoq40U`l=H@X~ zn%@`%4E^@RoJw5nmXqGZ^kB-k{MQjuA7KhPU2T2rW~(L}(c?apGTHp-bq-mb|K!z2 z?!w+P8rC9rU(xgE@XXakNjJ3culq%iBujD^C#zRol-X6Jq0P)0>8W0Sw0!hmw@+HS zfoE#^RLt1bQOB~&@-5H)?y#EcE#%nCfpEvU&3_Si)OWZx*WAm&lz`HGA2{4Q=m{5m z$@iiZ_!E1?I>j7qfWET4_R{kCqQOS*rizl0G1BGHf}h}5XCG{}wh(o(8!&!=(BAs= z8vM5765WSC_~Gx@)d691KUGH&Sn$&RC1qcR$K?7J(F-ZLEZxJ8MXZ`}Z+l-WF{>9Q zs`HnlfU|H1UzS|oyAS8JCg=nU!9`vR9S_@=C&~NEPVAmhqzoN_8+MU!cd&-Gw6aJD zPaY{fE_{pK(<3MB%K`zf+3oGT`1tq+WbdLxTg5N!2?GN&+IXNH45;Fh_N-B~?0!9e zSAQdckm9vI@rw`tLBRieW0eY})bT9y#-WD}@*11VVG>HfAW3DCle5o&R}aDo4k-sm zlCI|S)eZ7id#X^#b>LZMmZ#(x+SJTvVRun&60vQ&~x6s3cbhZTfp$^TOtJE>pV6(IqTf54E#R*8RZIr-eZq z%;Yqq`+LCzJIMh6<{v+Lcu`4!U{kf2BTkcFklyn@wA^Q>N?YRV(=0eW7Z9L@9ry-O z3>f@e061C+-A!T@aSuD`&~8^rg~^FJL>xolfj)4o6_~a?ETy+9fItCs3?epqdgS+K z*+|<(L2KRiVFpS_-kOY#avAx;Ai#I>a3Su9PS^~9P%dekQv{*#B-n}%vEF9uAdC}M zoiT}?!L&c_48CR+Yj16WqAM%A1(~wV?^M#wB!M!`?Gw`S%d=DFS$TPRX?1mRbF&7S zfb}s47gvwTei^)?-L`ZIRvWu;7lSZ*jyF<{H}AEqSxNH=CBaXS!n@_k6ZlJn0_Of! z9C0R0osSh$pk{yFBc?8Da;s~~-eqbsE{?ft7%b>Y(NvZ(#x?2EJCOU-!gNjY+WU3$ z=XAuFwOoRRtq3L9-xbK0>aW-C6DOyqu{gLSHJTB@xEGoaxxh zoARsGbEC^RG{Tb7+dgl=Z1FN;`%nuTp`M;zL=nn~W;Z-AeCT-n6aUI9#P>DKrtcB5 zd+_q4*BD1y01i)2|L{84^XQR&IHkNS&?_LSD!2&kADG8!_(P~1$6?M(Q)2$9<%8ly zdaKiEFU1A!7qkT2K`MP1tmXY7r{Pruz!$?w{kh@4y@_wThFxJ!W_(a)y?tgOzwp>9 zK103sDBT5AFOy)#o-$C`_F6f*zsuCesc7%&E*ptIBJMz31d+Q5s~?*z;ganudhBk8 z+QXB&;JUKjsW0ze|Hj5-2*jC=o*ru^Db>KwugheA1nhNwe$MbE+SB!%kiI?CJ`|?&f*=shQB6>I$WSqB69wQ zsK(Sm91T&6(@*f?NMh>IiR;ZGI_IQ{=k=r zptT||GS8ShF($8v!wO43nnR}&ngwW!aaGgEeyPt4g`adFYqOR{ox;y>TVJ}DFx^3m z(ey^lIH%7a5B#HB?1>J=RE?vN^Ggc4EvCp6GM72Rrz9Uh{{V2?+%=UUyBTvchaOVjHGq(qQqW-R~~4t-XBqur_Z_SD&k zNQnc@(ue%(!*f<(m>@ydo@lTX+4Xw39=5KhXJ9C7ZN2||EG?^O_aE+cJWpulr9Ee4 zRheWx{diT+E1kXRROLPY=U@zF@9>m52WT4VqGE5hiv;uNuVUVw(^S9mIMe>B$JJv( zQffOqjIya=%ES&XX}yoK^yX57?ghFE2S#@E@aBMInGoX*5+F|^7OSjYGK9vrZWTFc zV@QRI+V;ckqvXkZb9p*TOgL?auH~cI6k`Q@Ek(Xzs@_iHdh!|2;;$gQ z`!gTawfER9sw)dh6_q!ePxuTfYX267P><2ij96eC#l3oxfCW4guU`%PoVMO)KJ zASdr5)yyf1Bx^FMDvc-?lhuqB;q7FW)~MvX+9jmPz}4_S!Tdnib-x}@`$N`|E2NO5 z@9!`8`SWLl?Ua-hWo6~7zCP7};Uv|}nf4@u%#sqe`HhU4fDTnf^PJ`j%=#n-8u=d9 z-b(l0jsa?7fCM?#VB?ph`Gtw9PfNdBMV`P8#FtPe`y-j$d0 zyYiZuogEn;SCdji&&gikmw)$7ux?$8^%5`J-JtTS8HVJ1ReUX1;f!hsfODZ=}X#tHy$kH zV}?!D9#Cvx zRh={XtW%$KojJ3Ybe-K|zn(9i9(hvR==B3UfZ(&blPCWliT`3MckzVeZDP)mysq$w z=Y|ONQL(Z9A(t~VGnjp26BFv)nU8albM|3w0R!);;v;W87?v!uoO9_^d&O;bGx_mc;*Ny%yf{)+55hlkxLsmzL6)n3`gp zD)3gAnVEIoyT7mDnXYD>i=3~?C6fJx{r^WVpfNQR9e@6iiinCDYI(rJ!yEFX&~~xz zXLi)Q-*(Xce@{Skr3FN(tWI{0s6hEm&O)xKW#t}Gp5>=el=W3 z+uGXKHMKb%baC}^6}`Rej5+J-Ch=ZDR#0?va^bogE%LF{7YhE;A)}t5&>1ullmC&;`34N80hsMa}o{ z(b2;v>0Ca~m0*>S@C;#J_d%so2rD%eTU$#HJLa+JmeSs7{PvzY!OSM$>P zvWkB$-XW~bX;x*;_{{op@7@|jle08s-pw8AzO1Ed;qR~f%xF%RY+{oIJVz4mwiJNs zlkL}*w(k4$=x2Zz7N}=;VO(#K>nTU?ik($QJG&@cje|lSK4VWwz4?SZ>Syl(_KUk) z>N_bh{iLTOYAV2r@XR-2sQt(7{y4rK8R5vLrWxHE2E{m2T;uEG+8hE54M2!ljgxO*c~DU+msaP-37b>spSU# zxdSCX$oN0KqaNE#(@!P22GDU{g;cI9VMStSV%nayR_T1ue8(fmuO{VaYO3nQqmRYx zsQb)_CD;8`8t#dFvfHyvSC@}4a?>YJj5C;{v7ux5_q~rKKVVnJe06C>edjFvc|lB+ zhnpXrYPE=g7Pe=J4tdZ}5&$)SKJW5Fj*DH^Auj2z%en;;Etqe}lsNs}?#-F0tGHH4 zXp)1*!wAO`h!CIn)a%t7S4GuNM7yf4{u{gN6@2g$?v(~Sz;_Pp3V(ig{+em_b@OMzoHR;uzG1uluCZp){U$GRFwA_%QZhob zw6oNQks`mHjZ{yGlNuRKPVsI!{SB;J^hes0>X~c(ySV1EfX86wZtl4GB!<)$lw@Zq z?RPxv+x|N9EF!i?Jd+Vf<8{dwa=xSapoTlTASmDjg#I0Xdnm@tsHwK2f$%Qj zJmlVBCGvL{vO&}xzHOZ!iQ2t=8Xg{&;o0+18GF8WjH~NL=6$pb*88kI!anCT8Q)({ zlU8~9JDlF~i+i#M*$H(-WsPbf8$H}407f5AbFYs1F_K7ms&3TGKD#Fr+JLUX=`p~k zbX@Dpth?jqS5~8R<0y(ZR}M*bQ@vHps$iR2zke7Tr&PKMzx`X(Z%!nv9i zrDi#}d%PW+m4)*#^|XZcDbdLg>|($VrPw|NO-@ZI)?H98i;IcTsAiPBt5OfXHdtY% z?{BXlrd5@A{dH;O?wm7slvo-mgdrZzIJp4RZvv`=vRTvswxG~zCl=>SGf&&prW77H zI0>y};Bv85VH5_Yd9kX}yp)3^hIT$V(s__ca*LFtXps?w!F%W+WeC96x}2clT+eEC zmSt>e9o%`QxAG`SBlB&5tvqsmP|&&F#fl&k4aqodvYdRTA<~WdteAlJaBzIEN|b`NduhsA zpblKvBkhEINnv#q5NNkzBmUAbh6}`?Y+y|8*`@`*rNxDpUSOCz;CPwMa0yO5uVLQq zQ?a|pgird!ogecycDMdM#bEySZB1%yBEPvvH@PCGJoMwxQ*Kg9hUnr^wvtZXQod76 z(_#X(+*9ndcIc`N2*hCW(>h~h8m&Bv4a8Jttp1H#f|owU^2t&|8`lowsy-t#i*#l- z#d7~e4vGEi=TS>5cX3y>`XDW`jXh+N0ApdV!w>Qt`;90HEL{HO&kY4?*!wec%krY) z2`bg{)9J`}8WA4TyVc!D$aj{v#Y4|0T>qJkvz7xDXcG##hbS7`ga}84yn)$IU5=g z7_kv|wQ@5Lnd5Ak(a;ojfqr0{-JQd}Pt8eX;vazG$Kmz6`tz#1Hvl87>nH}y;v+<8qTHVO2KbVDk(}PW%qDP;_ zh}RdWn+tROLSQ*l?h-RI2SID(b}3$F`wMlAb)$|BTvQ@cW0{Z3T2}j$n_XckhLj`A zO_jC`N-0@nk5TCDaG|)^=hl9H5z~3X(}EHq{>d|(+_d3Us@7TOqO;{6i%Aa;N8Ux& zA~>yufHQVmL=z#zzpA!}Ls7i?XpT--3r&m^-ot0Na3W_RV@>72qQkM-vB=&t^x|-E z??9ckg%++(76UV~yC^>|M+)G_wC-WV_daqNH(`r(wm*yzG8PL3HVF2iz<;yxeV?+ zsyX2k|HA*T1XSDDorQGee=_PK_7H`at8e7nnl_W|S}$v(y|#n}S>861Ed&~hB^^=d z*dVHd?aeiB6z#|-0Kde(GZf>oN(d5&My>|t3pzyMO;Re9E-GR)Gq0Fs@z9%J9;Oi?qMeB93 zfPXI_sDj=kPFLMug2vdybl3J5U|=rrw0Bhifwrg;!=9w^4ziYy8KcQ zHC>$?uZNhw!#TW2u624OjG+k7(1j1)PwJno`HsjT?4Sg^2`a!-*%A@`OT(B1fPF(l zg1D+VQFsE5s}mRHpTvgXezN#GWUsP*@qA_aY27Xw>Cq-UKb=|HQ$b9BkolL&I+ zFPl$i*wqP6o?5yl+o?Z1B-@ZT2A9=wdfdo4-rNBAxgVPziEDd!Bx)m4 zWi(^X;Sn6Sc4*g=Zh4n7$^P}m2aggbiV!-wLHopHK`Nj%-hU(jK8MU<>@w-N0V&N~ z#9aSaNik$L6W5*=xBSC6Tlh$n;W4eW4jBV?a%N3?U&!aQ8iT!FKgNp;EfZ5n`f1C} z_fD6Pr?{%`ZsA7OKEH8ENK7y=TCcai9JM~|J}o7ms=U?UZS7c1T9O!$NyN{Vw;v0G~r)xm|b3zrfN~9$OOg% zpW-UND##2?oiULZ`2P_5CA5-O9m$=$i<&AI{BI=985g^2jVWX!wG*0vtwH>|Z~(S^ z=J}qGX*y(p*XHU1;6Zbmv3=wTv=zdz*IU2>3+LWE$}mj62+vJLM_%B$r#-Tyy`=m` z`q=GGzCkq}{7tCmG2DdZpEMHt;bRHOA23dI*PQ_IQDmdw6K2|g1olCQ(?9*+aZ&Vf z;LV+tbIGI4uE2*RtuuSQozNVfSLI^{8Cj*{fX~Zz$i@Y3NQ{0iXXoo9xwdb@{w+zes0v9ySCxl?5rxb}=g}Vr0y<&M z;SegSTcjBnfx4CkEap8{s2j;{5-DWkeCNs(1#ZB~)x+)=DVy%v8V1PwWZ1Ij4Hpq$ z$v~oO3OfhYS=QA#^gTJzd}j%S zQ4w1vTK99}@}OYnPH4|jZoWg-$}R0(W>k(|Nn)v!PH5Y8JH$S$79y`RQG52IkvMl& zTZrnArR;jST}t;NE0ngV?KmQxxVk~>f6|6F&Cy|({sTVOhGt#_i| zAYKZ$z@*WeQlfUhEMdTMJ`wFgL1YlKfpO|zgPewd&mr}pSP)aWS8Q4V%D!8XR_4?9 z+QyNqUh2WAJ}Cw(D!!SR`$%gIxY22!`yZ$e7}|P?l`+$7ZbK8JNx}Eua+U;k)=@6H zY5JFnJs0UsMT$4_r&l1;VT)2sOaL18UzdN4&>=FV6OqHceW4vV%;CLpNU_bFORcbp zuQxXxY<-Ms{w^EC*F$dAcuOX)I)1~=Ma0Esc3{TyA^A zQIlFEIEsp&0)0QjH%0-1$3JW9`<*etd3H4J4gGog@kKVyGJiGryh=Y6E(%M)5Idk@ zI=H%--uX^GWl_My<)p8mCqXwmB9pR@ZLVRBbJN|JZDeYK< zef`9Egw><*wULFQ+gqWHm==z03V&gl0Cc$GW9Ya^{lWM;Y3p2A#hAADBTJ(z$BvEl zz~Ji8ja{!*Rc#^o*qB6(K}CylX*o3v<(qUF#)CW6_2i~+cv1-)oOd;Q46}1BGaQg3 z|3zHwp9=bK)g>3PP!m+^@g_x~-JCL@72;5E5f=>s6gm4p9W*ox?_(pG9X$Uk6+d#w z72}BZz`LSz4H}o6lffFz3AwCnP5P!NAlPX^v$M2qWJ>D_NhXB&z!1cPjun(1ef(0k%=niP5ChpNl0jL$clt^IP0j~kcIWtyL@LSBQHo!O+}7Odj8iU zn@07bl6%dmXzJ~Q*uOugR{U&V;;y1x(~@KcP!x$T$;dVEcl53TdK*7zp65dlmNOpV zR5S}tl+5qF>vb_kJA@6AabkPb3D0j$J)oR|#?$zBXRJApPv zKM+fJ41)O6AZt=Ai5;>g?)VbW!SKgwvTk_!GX}MS5_;amc>&JD4k@oYOq4D@lf9=8 z6n=i6b`Z;Ktf_hWP+VjQ#$lz04i{&ZmSv5zt+a*|_QHpjH?@Oa9|*+Mo9j9nq!nGz zSn3k^pN}Y5X4=EjNEgfd&`%Vhv{adpSgrZyGes#X9hB zAT~JP;0~o3tK#0#=3ClRTdCtO`9=?rVq_lIYSZ+c0~Xb(_L ziGnv!c=QhWOo6_q>t<*vDT?caoR{s6#MnJLmSV1v?P&$Sjni=_?vEprOOV=}Zt8X& zE?GyULNB_hA0LFyrWA~;)GZ8xrV|{8IG9l<_y^X?glZEriGbVhq#sC3tqw#il+o<( zx|205j3G<1-=tudi6SS-hcu(9W4?1XkhM8SPYyVgT9gMt!7}3B+ejlRfdwN-0bABI+cwA^9WOTq2Ira%}!cK*Y*&IY}reQ&jtvHi)w#k@|L*ZDEPPe6|xrmhqE;f*`x6#&<WR-Rf6bLOxZ*`VV z>wM66E=%& zFQ7!sJQ$ULn;IcZyN1k@Q1=7Pg{6&k(?Z^qFs{Zrr{*EX{G9a=-tl*>oN;W#4A-Qt zK7XS)-q6sc;E`n2z>-jNA~)~SzB1;7{SsABL{@C!pS-v*y}lUSa_pzqH&beFUBdnd zA4iNRyE3ddx2YL1JFgnF>jz_=DwQC5^1FnM zZU`|-bu98O1BsBiH;oT$>SMbYrWytXh>Nu)>V<+OJo8lTR`ap%=gU3YyTx8h zx8j!Fg2=0b;$^faUQAke+Hz4)!Mq_ULU&;i=M-J0x6ClOm{ zX0es$0_5{Hz@!Fj5vcuroMw@%(9eIXFY%TVze4o$Ix_I_bkDsmdVLBT)D?GkCNq#0 z-fmf8vUPEZ=}tXV;}|V#(;w17tgUY(=T~(lTy>$mUp3v|lQ2;bi0aEuMtmAtjjU~| zA7bVVN<8B}8wh8RdS+szEvfd4j@dVkjLK!}pp%=5kyh~y!J?3R%KWWu!7Dom0^!@V z7(rwztiS|C1^n>zP7`F`V=_Wm(EW(&n%(~xTSYv66Y4Z|(ZYIAxK-Ps=9SD1WHnfVn z@?uA4_&dciiKok=8Et7q^fQQ1_iIeeeUh5{xEVtDA^7b_R@Eg<9x?;U6F^z!nw(L~ z)>c0F2ll$|CJ`Tfj?W=jb8{M~WD*sVf@H2=9~>O)>RY;`jGr+oE30U2&;HzKqo!(H zup=WY19*ScwV8+VWr_RAs82nHvVQLn(Uk6sVr^_;pW)&!=eIGp3o;a8k3Gj)4v<%TR1a;Sm zA4u?(R-PJHHo)3k`Kl>UsG1^qYOQWFgu^sU=RiO@0~=t(J>j?fDP%Vk&f%H{xa%bczGAiTDm-{(;Q-&sxV!a zbDI7(>Zd=|7F^)qbjs}T{mXpv4NeJG&zNsbib@nU7PF6zGzN@DH9>1Bp;zh_9Wo&y z#*C1dlG4)b$aW@;!Ejv#EIZ)B^*uwoE?u2Zf+j%>qsS!Et?M1i^t#^f0^D&wS8+`( z;kxKb@IU=WwP|bGu-7s-xN?jTTT^Q^?50!1mzqD_c2Y+PAl1gIiFvR3K~m7rM$S_5 zr|BHJBm5lA4e=CDoR`~WfOYY#0RQm99TOitMLvZ)>iJ;G&;@bM1CNP0iS*_kYKl2h zWDZwUuY=|07}P*}wpU4&_)&-JzNF`kvHCb>&N9r%{E2n*?so>pi!`d&%GTu`UO`lT zG-P#WlrSR!nfpO9>Q1oCH;lQ=%Hn6Ex|Tz}J?A85b2N?Lpjb=!M0Yt`evcIDi?}*Q zQW6a1BTp1WH%eH8Yqo2DDT3E~(2RwHMI^WfBgAc@5Vn=hNrkQ**M3xh>Wgr>2oCR< zN?n}`B|}MSOp0{QBX7h#CqLu4g^O{#l7ntNfrR*)e(G@M6()Fw>U)woih)sI|e%_l2CxZQ>Gs!a`%tP4ydZ z%R+Hk1r0^bAGzC$q4u)UYH})&YT>bj-5aK8lermAb1ikwvJNmmzc8`4Ong5JdU5es zVRzRgcsM+;m;g*mTTBBfc$-mEQ+F@n>U2H-sBYrxl048hgR1L>c8R!ex&whbF#ujW zYn~ByP7gIK9>I76d4lrk$gg1#Fa|TnaW+~1)wZC|7dqzl-2xc%6%lVF>A22 zqWFt}8G2{Y!Ujf(Y-TP1@S=*EwnO{Dj|RWeS0h!|DPsf29Q#UBysIUo{yZ|F99=AP zhCp>l7t35Jl^?|YRQ`A#1xK|jJEce!OWuLi?5#daDYNE61X;5j}4V)g1 zH}|Hlw44fhgYIyoM;0%zKw!GA%5sa}+H&tcV{V#<`*Rnw9QA@j)s@s@jO$(xSi?`Ds5?HrTJRP6@JtthIdcumx zr|w;94+KdzdL2{In}XqaD&~J04k-6PXPuYOd251Uromrlyb=yBif3|CT+Or<)1(W_ z8=aO>fQ>fG67%OOsbE(_vJqWIo4XQe`Ed(d_0%(|2e=mUC&{Z$-(i*9Ij}-Ahg)X3 zpwdbA3XEnGgZN2wVh{PX=IYt;e^6J56-$Yga`CyneDg!-7TCM&B+LHS)=_M7;f z!I5*Y+HZkoPa+BcVN(>!K z*;qN~0nKEMk+YX>^uRoYudqM)E==2nENokY62UVw@egGeM6}q+l#NKma5}VQXImkRj+6}j zI0XvYBq@3ZbLz*ngW<~0U5t`7BA(@~VKT%WB@#~Mv8VG189G>y}!n?b8<@#lU~9_+%S2t=;Ni(SgEk(4M|$M zN@MqzJptkox9IX)`EsGpXp#JL4`psUAxywz;gjHciBs`qgOfNtQ|dA5plp$pdX*j$ z>mqQeA*^gLH(!Dt1rT*|M*873SiB_M9iN$ii_Y6ZEK}%pE&&d|lkwg<2}tNyqo|yY zE9@x6+V6sqTxj{7yJb?z6ltESOz-g={M|Qk^2q2*LT|5GGA9eCpoqUrW$7O-EZ{6d zY%?nEmZGf=vAVfe>ynnK?N3=FGkk${b1iK+Hda27NK6qEGPcuI8Oi1*eo-QMOC5^~P)rfj>I#nfB7$I{N)hy)!^`PY(rtJRel!a_vV}Xx04r6w>+6ut?`a!X;t1^kJP~bqpN&1+lmedBfwC_<$8p% z+|s=`mu4DOBsZ0kf4v?6@GFCifscW(d5d}MZtm!( z;K;m$3C)u|$m_=-xBRml4PW2hUn|>GNXyoLdTD(%>-oB(A}RUWqDHyS;~pf;G~=@X z>DLn=d&TH_dWs|-=xd4Z-A2bz$6(T)Xk(|0;ak;k?ENZ%(a(#JsvJ%(@QLw$64kfAEWWl?Z9e-h)ixc< z>KRda@!K3#F3$&k`uNlfAt~Guxe)+sCq++BLr`gHD(dX8UXQ!Hc2dd9)<^FhBCiMd zPt6>E=~)x*Np-vLpNWly4YGUeWL|e#H7R4;M(4LO# zV?w!+1gtwF8GYW2RQsQ!s}y>%cyPT0xf?T7(BL(aSoZ1s5+5JUy{ zFR$V1V?f#5ASgX=n7SkZ48&HuIM|@utRaNubHvjJNnq&wd#&SF2cl)|NM$Ge+bl+b z_*t8elgfHC%>WHo6Y0*UaDDk;r-ZlRHoB_kAX< zd_HgYnIJe{^)IY^%PmA+I_;et7mlu7zk+-l&|{kPy~M34J(ThL1h&CI%@PgH#gL#L z;$PtEpJU0kyOV;yRO6j2A=~!U@lpQAKk#_K>Vg=R-)(b7M56RIj&g3p_4RAq(C~al zbSfiq7(yH5Y0C2mm!7g-F*}T6I>e8>1?yAggx905@JI(0<5wGkwtv@Xny|(heByKu zg17EebcWTt%EN|gJCe&;No$2NZzmmwmr@{a%^~O&byIEdj~<##-jl1Q@0f+AL;pTT zFPi`H(frc!3tinCIhB8|jTX&BY2%dNc7K)EM4uzQ_*wM3=V zS%50Ti@kg*yKne>9iRZZme=x+1-c;g6XA^-k+Tc_4hC7BRoab|8XC2=pt|Ui%$Vdr z26)1MC~7jCSGKQzpm8wPUj017O$IWz)cDq{ z=j4K-wDA-Z7Rvn@o9;?}Dj+iNy;4C)z=X6`(y8<_IH0(MVMQStd3c~N;Z55drMxhwyiuvp6xMdY$ju?22eZF;63d=F?VV;P9W(-|HR^ zkB`e37=*f_Mvoc$Un$Mf;xic-ew8QX`wA?d6BDW=VNOxBQPZ#_oJ?}EKCfN6-k=wl z5(sOV!k%spDrsp5!-BS{h znuk$rVZl8Hq|5e$cV_F?(jryFNVLLF*SOO;E0yk_m;n0VOuDGb;(&uK+_6vVIGTpF z4nH;c&bSe175igu8Jc^c))7jQqwak+khO8?aULopk}w|Fz%QxoN4#$O$GBSv)213fk; zm;Dmbc1s)e3vl%6Co?KOk0HXI;jqy($n z&B@*7e#+MF1<`Qjcvk+tc1NCql6WKo@Nb-H_D z-CIQ8;%Q|hDzi^>Iy+T|uF>Fg&xY;Pgs5nCO;xe5 z>OC3D^%X|Qo7%g!)fvynSYCI1c2Iyk;w+KBlaSC$gQd?(6^^*h-Ni8>VKjp52L9A9qqTJ+p0{bYcl+{#aR9zYoL}vg5$b!jkgzTu z#*S~Z8GTmh(tmM4h?Sw3(uXzAp<<}cn6sSMlb3q1EpG8tAw5ECVpf`EnSd5NT%x+U zApHi4#(kLlx4tUr;w7leQa9(0@}2ej4_&{{EYk@C7W1`@yo#EK-|1y{&4$GzeND>1 zKqUl0p%rNrHB9M2j{N-o8zlL#@aD2=I~+km)uqVmd*l-knC+zwe!5psFJ>F}OK z&9y2;V^j0=0>|IcM}&SDKUWX-1av%c6KjmD*$G^{4Atq5=rvS#Q=i<719sv_<=4L_ zAH!Col1qlsur&YXlg30$B9K#%ivu?P-rtZrQ)~byKBEDCUxG>+UESkTP{s9h1gq@y zUBe$oeZRDK;Ns`{;0cKipu`n8n1r5G!shQprE6yvRTLOv^^}AqT)}&HJf&yj7nB49 zPN(YKG*w^6z1<7G7WqZ9AEKdQ$v#}W^RDvY<)lk8+2Ed*qMLsM@HVB>wxw+j!O1q5 zHgdT(Gk{BODxWe z(bd~ab#@Xl!eVP59HFmgM0xM&LKl*A8<}66q_b;;4Uuo3(3{SNDq^Cd$*Jp9JZLvX z8K(Q66D!_(N?s)$qHJA#Bg*oHtrule>5o+Y-Q5k^D}|LWbT_TAijJ;6#fx%sq@RJI z37X52h=`7*qP~lsrpm9;$v9e^=YhWVOp-&dqb~G4K(;U9Y%3eRN_Sdi?a9WPvernhiIMAxRL*^J*L>0WD2^Y} zsX#uXs=Rz&7D)ZK+__xt5HB4Ml=X8ece)q5(#vCoWSYk!eYw;6%QQvBM82w09Wyu5 zPFbzoF+${VYF(1D^k7%6E!$G+BNv6rO`p|%jcXH~R5doSAjn&GSaRp_(bi&0>f038 zYnj)+^mGwcf?Ow~UcV!~|KwUTnUCUKDGPplq^z@1ejch$4p8SSJrZB+#;=YqY9>84 zm32ijeIbV(xg6poz9cCr7r80y!O#5 zB5$c%%JLHtN3I<^6u;GFkb0pmn=FIW1-ZGnD4il3`5x8lCZ!kehWM@aGLwwL-N(^0PjlRNE8Z&~F%D~s%fOr$sFi45i1 zLmAH2$s=VAp0ZX;#FtAIlv5Pmc&UX38vOk6){$LyK`xc$Z@Tp0Cje0|)tVr=EI_@C z;0++-N)iwqrd$@Fz9wDUB`GUQ5ng}hM}mBJFBZz8B3{k6A`LXq;BCTNM|L?sp_9rr z&_DwXH27)Yts}edZwD0(G|)f;4Kz?eLv|Wypn(P&{OqA2I}J3@Km!ea_IUfqE?Yx( z8fc(_1{!?7cp%UDhE}=NmnwV{*~xWb@&p5UPLxdJtT+-fo;<#1 zdVGw@nMKi%CE=-#L>V0(Wo~f=d3?&^+!Vv3Q@r`{F>eNWbjsw;M1j`~~MTd2=&JlbBMt+ogkYX=fa zR13V7u+@j7g&WP&s^e1nD-$qvNMJ+x3*=#&>IK6uj*w9nrtb)nRidblhB;YhraD4M zy?|JrKyz}atUOV@wT{}B5mg!@9Lj~%qQg=CRt|oZM-=TV3!pXY)HL`e$VK$)bA5z5 zT3~2sKuT3V2Pel&$@Pv!vA(#3mc7t7d90FL$bNFRCc8_66cpC8zPHcr$+1UD9MP_1 zm~P3!%JC^H%E8BL?5fUtQXLAquZsVQ4$F-QHiQnJ+*6LMIw3lFdVWbs11su7N=01d z7^9OkcQ)ms_&wDDwkL$Gfd=0v-a4}T^`HGY%{}cWMfrNNTi-fheY}Ft|KYE>WfREa z+7dOz4J__$GThQZS8E6P8Bv6W#nLGX(pa8@y_FNs@){`1jU_ZZfq~&R+$=1xad0Ol zt%ByN6l~p6n4j+u@F2*W2Zf})HNe*bqL5?s*0P+PTfLUU=$s35Q<<=8A6gPYv7PGIwJpB>Tu z8cUz?#4m)Bx;AP{a#T88)y2y65Q$MCghggBJUzv8aWB~0hsd-N7Pt159eMUvM#<04 zr{;M*$&o(zMkJkL!XJ6uffpdV1eXj>*a*T3L5mmc8YV9oXGCWLyM^2IerT80OxF3snO zhYOFjA94QTZ9<-Sa@)`n7ehVX|M(G}p-HrN7GQGAh{{n>H(?3BT3-z`cojPb2ehWe za{2mog0kzFS?b68)=kdKqpaS$g0ZbTKE6SiU%AS)JD>CZc@yG6D)M5u z@aY{fcne4WlS@jR4=))L;%|%218ck-AERye6nT8@TuUaO{PjE7_(T!zWxyxrZV4TB z=lnfe+Jt^TvC`rF-~9o7Pj4PwxQSO#Ah$lbOh{fUolR9_rG#Ss*aEG~pJQU@fr-w2 zEM0xL_M4BebPuGgp_&9&b6g^;M7{Pj)14Z8?|AFT?v0lotZ%~B6wdcP=G-kU{_tP^ z7Qey)x=IqTbM+!D>KV;-c{rH4iV>)_Ag+fvI5}ft=7_(~6I>m9l{pc>XF1B3y=sd20VFdbwQqw)D?1|V?l1_k&KM~%(A{|RI8WvgZFUG>$g+MP4 zVdVvI^XgT!bS;Q2k_5Sc+2`6M=H=nxV1_m=T)2&~tP~4}c-D^&Se$4j z+B*<`*C4!|tuXh=Q*_wh!3ke4FPt5HakqNFr8_#U;@;Q*YjBxIW&cNC?o5O=qJS?s83<|~D z%bD|^Xi->|kI@Z%Dn>Mxod(~GgM(eNGYYY?^~K-W0k0=f_*m&FdYfKQNPMUt4lbTJ zJ~qHRI*qLIMyfM>d7!03KxhLspUzm2I^E=Px>f~XuY*44ql(jQMp6K-i6qJ38zzb76%xNkyw%als_ z7hAA3(C49{Gp*x`R6YyB)W)5#kSFM!KZk2XI&n^BIEGhhEISSUB>2f%cI)DqnVCge zduBK|K4NQSil(X-7B^PtsBK|vaa~-SCO;{Hkk}+@8#?IfY^S-Uo6(VBic-Us>(85e zXe!SkEHs4F@(z|3C+O@MXJMj4jB-N=j!dR!Vo@pRa7!g&VG-m$Z(*RPkKxG$7N&=k z_`Qv}gocDtRMSj~zcpW6dQ5bD8hwH&r3a>5?l3;oM^j@n?LDK)F)=;eJ+#-A6Cu*f ztnFldX`1SiDn{ou-|RH_W^5<}z80c|o`y!IF}}9P>Ug_KZ=+L$ZmW()8tbeQx*1GZ zQVEM|3zVnEiUu7{=lCl9&(ldStz)3AMinQyRJ6k>vJ%6INX($Qb4)qD;o;%EBb=EiE*) zbTT84F&gftv$Ktym@uLeGnrVD-@U78=oD>3Sa@gER|5_H82n_(PGVgU$nK8n2o=>a zF)FXI9eJdSjK8*_@`@B>s5)w9huvM(F+Qr3T#gjavfUGx%_Gq;H{`K9+nb`n$uAW$ z9I|zCJk93G(J+VmyUNir%F!@N{4KV3)ehkM^taUVyhAmjmB+cL*D1-R2lBWXnZEqy zs2ne}dve^2>=ZT9?{pZSlq~# zxNt0WT0SewE0-SZ?kdMM$$_do#z?kDl{2O+``Qa{OwGDJ4gM7PNt2y?PM&=x|9v~4 zD%aMIJcdVg9^2XRG` z9K4@?x3Ys&U01zh4c-h=W>R*iWvR&X?I*iEy2lp3M0T=Lb93{gr00;CT}XCbu?8Bv zL~aqe1*PN{m6Kms_SF#gbMi|_6?!y3KdmerP^L%Zw1@^8s3A{$pP8MbtGk=t-oCFycXy9a&~Xa# z3mF}i-%@`%-;3llWoc=JXl%Xg$|=AT$XR(g4JjdiZ*8owy}rQl&XRKQ@2*@#ek%Si z8**w@jkE6m5ZI->>N!o#?aB%C%DWZU;^N|{tgNJ`r-#nYP7U4wQdSie6^iVn3{SV0 zx1Q`~*LUa}oBc|%D=RBk;+?HT8vHQW=kQ2=7d`9VkAuU*BcXi5OiWBDy7EQN6s+@%Z+5a% z8W|a-Sd46C*xA`tD!21uJ0cm5l@Y$`-kV{2dzT|QDn8g(exDWR=ME{iUGcAU9ymTa z{02D)a@pBrW_pg*4e0>1cSf8a9tQ`9LitA&z51pg6||`2r$=_uvMZ~oVPNPb+3jx5 zG1*|tT(=u@{l4^-88cpE&uB|DSvdjp6dSU=GIA38j}HgCn=Gwtp8TZ=-!;@Vw46zH zvO|?K4zeSCGYm5#;>%|wMuz3JL57CMn4X?gJkf^)DU8T})z64_qK-d0I>PWP=?$F_ z$*b4C4&OHZ_X$~thK7b;0NL#xu)n`bL9`#HW+sH^yxfUJhW)+W7hYqsLw~W2pa{nY zdu)r2dw+kE4k4`mN!9*usW}Lrw2;|_&Qr*Wob!D?aTN4ZGzlC)7~@dtp>~!}mpYl4N>2+i0k-r@p>{&Ypfje&Y;v z)shgOPGd(80|SE$4hjNPo)N?}*iTza6LocUG&Hr+FRz`Dl_WkHckm>ANtCC_P!gN^ zw?d-gxgOE^_w)@Y_g=YwDqV?J?|nb`#gLtBCSAF;Jl680y1kmr{3`m|I>~w(Oz6`r zmNxcjugDOUh^47#oXOEXGULMu3XP_JUQL9@bktT-R@2Gz;w*xLLaFPU<6wXPMMwH` zg|x~Jwl?v!a;9;5o|FK0l550Buc?^mm_+)f7a8jAB0V9Pkc2Fj1=CG+)es)&%(<%; zbj&PKl@?7?#8?-;KA}u+K;pJV0@XpHfPlc}{yV==Uh2YfT=SFs$E90yT1_&1N z7AC7JOuECo_dx;c{ysTwh3{F<5 zE6E}vJd*aw9gbETRlCb`elUggY1S! zh2_>!$o+Glar54N?%&hpX>lv_%WI6ZWT36}n2^ML8mhCgvkRbYXq?%Z31J+#@ZtOC zdHCod`sQ9V4ox#VHO|gx@0hIH3*!Cb@rxn5L(y@~w>9wa z>LpwgDi~cD!tUk;OzgaPeE&9qMFX_w1#$P%hnzFC$I0|D4-8%LHrC>4X8$djqWjZfPnd7JWX8DT6O~6wf;V}E#XS1t0@rVT z#_dN|=-#=CnS(dRIuCISkHSIw5#Axe+|#!u)XyIMN48iSn`8gPhkKu&!znb6sg1XT z>;?t~FfuYCB_-wL%FmDNHkQU&?C}&t=f=^X6URd?;$LSD`yDtQc4DCT5vz;CERC&V zVVx>SMjd8&Vt5}rH-C&Q?D6)n;=0iPaPdwbIS1f+PmA-9Jb0F#PK1{+=B7S^z|3(C z4kIWemOx_zuHU`EyYJp4uX9nPcfd0rCwv6i)fUF%7GBC!M;3;69^>s|i+N}Q$$plY zn)zU)XH0ri8$m`l(6x(XVogJK-;M017-~xA)}@C;rDT$kS4MY7H68}{xbXS={NaK& z{?TcqMLO}H|KhK>=NiML=#}(Q%HTGB1rsS~t1*&=k+02=WU>KPvjw&(GZ?GQWUm zZzt~GJkRIXACN8vRzdcUxPIjZ{?Ce;n3??2)aiG{FNW+Sw)ghgKi;P{Czu;o^f0yb zVQ3wCiW0GR@F&32kI-;Gu3Xnb-_#RjkLRsM^e$LaSeAjUttt9?)|eRD5Ry3{dc#4i zOrJ2malpaPp6qs&&TphDA5-mz1g2I~mF&icpXm`D8%3-bg_~P@GOz}{Wl22H(#9sB zN|FClUnlN}j;v6go-|p>jrT91=NgMbHTysQG^SKWYin!8V@tXw%f_G%KPR$VTO4Dy z-HAg%bUWSl?Dsmd*W5nqzou|;@*^YR8BspbJoA6TBO_l|v4lK{rfot_XYZ5j zZpzg=cX|I0cWK=c9ZOaKJ}G13-U{aDFLPPfg;nv_cxDg|UMZv|J*8&o)VGCSQ24&c zZnQ0%%kRFAmX1EgVvz6WW{S?^Cp0zWVfsjiJ398HrN^QB$d2;1e&%MU$O^XNcfUW6 zq48s!!ZK*D%HjGS{)x{X+0)tIiIhN*KReHRzj=oXm#%U7t|g5PB^VeO zpnL5aAAc$aEm_a7vM@&b?p+Km!>BEaNBD+F|bAFkrBy>K|HvtgQ0;j`qqB9TbN-LUi4y=n-S#2-Fv14q;$e+6DE)Snb`bg zkloJyu^|5u9)0?I{3{okYfHsY%b56#OseXOvA6J`eP)Z=^avareX-Lw#mmQmi-PEa z{2kGMXob0fQho{a|)Az{R(#NuadfQ^$kkIigw z^Ys;-Q;!f<4-S@2#6C?Rz*Tfq4~+41wZPoO17kyJ*#+b67fO(m86F|&Wad}1ur1}f zL$sFAM*_!TQvLie&vVB5faTb=BuVL;HLseNh z74@C;w$_rFS>XlhV~5%C zVa6tx7;GsfEIg9p+J5ou8WriWgvS)Ku(3=}*U*n9H#ONUFE1YN-|d^-SZ5LU zKK+pMm#=dDhBh%mz6LigbMDdwwDioearCFMz8ROhAEV_M!uae0C9$r&`@4_0cH7=CyE`uSmg4z4 zJTf-M*1?DPr*T-{z04;cUBoRe25(nCD%$!edKRvnKJ)n2b*^5yK}=2|A*L31C)Utb z7>)J=UxpXjvAtnPe0e*Q<8M}XHGa}$r&?4#{nhL2O3RdZ(pysTm^?Xg`AtII^Li%d zRIcg!yK>oqOha^(a_xZ#%JPGqebH>CE50iIUj|gunFo8Sr5G>WIaJ@c_5_*i9~^Ob zcyQ{Qk6i2cQuh1eJxELY$CBH(Av^gIy`-e{Cr5U&G0V0xJT!b#6B&+$-X19Rm)IA- z_xBH!fuM9ilK;v$n(%go?}O|lq_<;VcLz=4xrT-&`UXen?-hTywlg>=tR(3SB8-IL z!7kd`I~kN7l0yS@w6)OK&`5J@8=YO<43AAPHatjIPd}q$Lv*&cF(~@m?)GLSU3p!d zr%Yq8znA8wMmqWi6>DrnJU`UmMYG(DT(m1?`NNBHiga6>M4387K4YRR1EOrI>uN92 zS3E$!1%A?G_f3n+vS zAC}ifMpVy;YwGy&+K7N8P1$}%Wc-u+N?IrJUP(**J1m}2U6;?QmKZ2`oILkRTmf}D z(lJFH|MdDlncjDCT9Ik~?7!Ka4!hecq=jD~CE@~!0ly>O`@a(H`WM8w{#$~~{uxul zbtf@3;pZHBdwUf!tFNzDl=Cc9RaH?fP*V2OBfGPvG2b-EspYVc82o&~@%9YE#qkOD z);^dRIG}gifSK_LWmg<&8Oyf$U9h&cE(VtJ)Q_|8|H&a_BsXV2^WK|6q#;jfIP>23 zg#GN-3s{>gVtFEl z`C%W1YOm3j`G2xH({d716MpEhvb4zd5A;b!lATmY*$AW(o&`Colp{f@N53Sp+uJ{+ za$tju>K;-`8px<@Att+=%=#hh0y60Ck)Fts>{i&^J~{s9_)uwwXPu7?HTF(Ef$WLDS2wm^ zOc?KMtt)Z2wzoycC;K}=XnQYfS6AQk3fakh9TO4~2nq^PI$Zf%gKvhEm6VzM{gc}p z^Sh882b-*ohOx6)EdG#N8A%uFA!d8cY0LOq)@D^ZtE^3SQ&r#d%6BIv9Er5Y7TDcd zq;GKcUcG5Ttz|GJ z?_q9bL+N~Ee!J?k`Q$gvyhjnBaEXDF^DpQ6JE*N|WVkJd+gFXq5S1#gYG-~{wRPCu%DOTl zUYQvX)<6rZCo(%)ZsOjB+k}YD+Cuv}0jWX|HFZkIFxK0}n~{l0F}jwEbYW|Lo>g&A)DVY<_ppBwiJRF?OntHx z!k+AHrlEQ0k90pc=EGlo!Q-$JF=&|N+8_P_L#H?z+Q-Gc9Xjf3Y3}N0eqo6Lx!bjaYpCmh>3o}i*=-#@cY#`udS)FiEqEus^zM(64s z{Nqz8C~u}J(UVVpf0vldEUH?CTo=bEEh?lz5Mpn8JtbuoqJ3;I-lddZ6R=F*2Ba9!7)^vYIdCI=}mEu(*8j>Uy(nrbWQ8XTgd@j1g& z^Wy#}b>+p>wDr*0vh+x_J~QNLMkZ||i%ir%<2S$lh{Wg943tE3`?fAmgwFeWhEZHnLwjfU z3$l}tx+ptH4Zc0jYR5k-vXkEkvMcMb_ZFk2oDw3E@(521#?|XSIZ65~_8HJy^bYF_ zog8h=5g+nIbgp*9)XuOlSb&+9;BU7;(j~5zoa86KJh`W8bYn$N~5Q3x8Bd%UIp``XX;Z~;He{hor77^6f zkr7OndmX+h?=|Ru*G*6rys2Y+M(KJ3T zK@2G*y-tv|H;FNR=-<50?Q0JSt5I*+^zDOOdgkI3frFg~5kYP|diWT7TVEoRiz!KV zMO()j&nJ%D{QMdY{_)flM4@x-K3doHh%2ikNLLH3$JRuoC6VA`fz~~J?pyfM(O1RQ zU%iXAgFp60sp^OM;g%|M=T;+!S%W;xmYKH{iCu6>+&0 z6ed04!Ie+AY9B>&MLfUzhxf4w48ud$fLr%3arL1)y>sir5|RVM9TNO~$!wU1?FqcK zABZ?t&^B?w)!LlvpMA{dS8wy^&Q)}sys*-F$ld$8+&F&;0~=R7g7fIAPeS+hWj?-d zM{QdrH-Gbc?mGGqWNE{#JJ-2%$DH_xaBiIY0zG{@@|t_u6RI{@8_Pq72*uIO@UlJQ z`)h>g8}qEHTeY3m)Ev88OC$$6;S^TR!Qn1TGd+abI}n}xoW{Z^uDo{>x2M@muk5qG zIgFQ$9jTQKgqRqUSSJUNG92>!dE+b7n6f{VouguT3aeFvH;0s&l%15}>GtxoBD=xi zQDQQ3@rjJbBPf!jv?9`rstI%Zd(y4{d)i|E1HFasva>$Od`lXaF6&@xcpGiYAmT#( z$!w9GuLzs1c=+ctHC&BfU@jHK(FDY1l9`rBTD%V*y>|x}7i%6{L?XNBWx;SF;*d9|0D{?wcHcb|Jd5XLy`Uq6qKo)$ z;qc%P&+t}qyzldykM5G5osWaL6Yh?VnA?S%d_x(++{jCrZcK8sBd1eb9WUqMT?;(T zTnG@IWpP#*x@N&j>=YYoqO;414SULh=tR1UlZeYd>7b8iaMiV;Zt~^#ix@{+RhpC4 z+&Om*UB_T$r;TqLG-US`;rNKw;YBi<=O}2K!9KPGeP?f+pSB575f->d0{x>?O4K0N z3_{XhZm3=vY0IyFa}|3>OH3bI@aVB6m4iat4u)`diJ+_JInEB@)YfF-AC^yJMJoFD zbTIcg*|BD8jA#!RtgQ_AhfnpWZ7IjoH-q8!4Br16L3+;C+`VH%{n#QqqH{RjofYlZ zg=dxH%rqzP&VQ3}Y%$U?#lXl`3Ok9Wp8Vl`kYvt>^Qe?ne$H6DhR6m`o6tkV0shF2X_q#nu+RCcWLOgjzU98zXdcCWYP zpB353V=Pj03rR@L#l|}X*OXvo`8~xohD^e4H;= z?i%6a>w>d~Xr#6EEKamyrDaS&q&L>yMI5a5V{!8wz9lnE)W@Q)?LBYmv zdbDpDQ!E6K65v2UPz+B*1J%~EBfnL2O4H>$7UY%pyovU~aVnpAVC@|8A}{khVw9H` zjp=v~(~vGAAWNSj>7B zl(lu>XYVZt`jD>lP_zxb8C#T;d`L~0EBAC=6$Q%A$st@=1$M$xP7Ltkv9%pGjxoxh zf|Wj=h(X25NnLW9X4x2ej-PiXCo|En1P$4p9rh28g>DVun_5S7Q5Vihy;#Ne^LTVsl%=eR?!G2`9b8DsFTl;gm(r>N?2S#( z(Gyl$W+5TYHfU)-#?;h`d$+VnE6C>2O)cU}Yw^)H#3w!svpe?)PAaFVwT-6w5|R^R zx&7Ps@lI=026D4a&xAGV!R+=SvtzyF$GP&z*ptwSxX*2qPzKtn zh)+qQFf|wpeH-%23I#D%;-jZWP*yWL%e@%hyn$^*F8P7Z+?=bbY;}i9E)q zyk_`?WjNj6L2+Rj&D~Qh4pn1qVU1^CFgc~YDo2w28Ii9o7B*4L?5~g)U#iW371Q6HzMd@+)qC&9}O3)?8h zmS(7{YEzNf#snGhMZ&t3b;+l$f0^y+Zqie0MG9XI8nQb(NG)Dj-@?E>R#+!#SO=wJ z6P%7^fcPDfjfuE6Hod^{;ep6wotlhb32o9SwM&hwUjn#DasBV)pn^GFVN!PLSGzo=ZMm)0qZcfmV8 zgX*j}9vhip=@rMw;=1Ahv$MHKZAmc=LjQJmH>k@9SK`?FN0BS??iBC1yrhcW!G3Cs zQqjHqIaluKqIVo?0p7*nSJO3U+b z5rZ>_;CO~-*V&SeF6*N>JiJeMNr%WcSk&2;=l%2SDGn{GtZ(hIG}MTjl@Uf}4pi4Z z$JfyWBau#Z?-Jw9IT$@Q5@n5NW^6ATh6CLkM z2Nm@?yN-?y&C-K!0VylFT;pfI&aS1S3y*-O+)samzV+uk^>~0+R33k)H^D7E7yjGB z27GKkVQISK@L#?FDv zpN#%?Hsulm^%}WlR)zJck_Jj=b|M-PZ;f?XCK*J&vOa5@Cy6L>Tw_liS%kVX*4cg6 zMdiO_NLl?N7M07!P}|VN^ST!1=a<+K%9K`7L~-LLZT;&si$39{dTGMXJ!r`8j|;N1 zkZn`CaQ_srCW%;(>6Wkv*Uq^AZ6VW;PBMGDg1le5_kH5vVE@cTSAbMdkn zh2>9q^qDp(&-)qeswPl${)ssibaplKG%SGFlvFa}BgC~zrl*EU3G>0z?%p>I@a!Sm51iS>^$2i zpCG!)p?zBmbDvOU zIYwGtD?v`?I5>E4=fh7qckVZQc*BW~F<~7Jt2TN5Q{rb!c5+wkqLP>2_axc%^>nj5 zKg#^d1T$m9!m>-jtoarfCw|56s{azN5_7grJ{%W?oAImn9x`=8fQLJqqJYb+Pt;;% z8Az)btyIKU9B^*Y*7oCS6dPM-PJ;h4{Ue+|25(jjIIgUcUa;+a5wn`+6z#)^1>>#9Bf zw$@bycpwG^t734V3j3_CEGz4jWLRAlbykWpkK0u(f^!=vi1)`mtd#8&$AQ`QG9Ev8 zfTfV1o|!k3`v)9suZc8YxSuNDVbp#GZyMg5?CKOf8XX-MdiClSLvJ%QWcTw4KQ7r# z)07v&N5A=i&wu+H?m1<#I9<-UzyCdE&hEI{yJKZ$#*^4=!o1yxP0!y`#M8$EN7pFYL|;8BPc}Fs|L+sO7_yV0?)h_~ zqayK(jpoVI1Yv5=@^mJM|JwH-`Ojtl11`CGY_9FW?i?}xPUsrykywn5M_^bG6GBi=eSN7OkXGO{UM?X>$NkB|Xq-J$#S18+vbvlnCXcu) z>T$z7k}WlBev2T+3)q-=VBr!(Sxz|DF5ke`DU{UWCORs@xqDq3OE)_nYa3wY5=?7z zK4v$raq-e)iU$VC_7Q}ytxJHYLq&=gmoDE_7AcR8SMup!{tcH+oG{h;h`;^Kc?vqE z6}&^dxe<}&Cmr_QHshVy7+$@?#Vcmyw?4=F@k0zP{per&c5J66J9+GgYy?sX)h@~t z6Y`sbhU_%q?Fc`%WmlONfWB=!3zKaaU%7=%Xb?6JwXkpwBPl(d0C#)b0u%6eb0jh` z8E0F294vIvx}lHWo!dMP$z!3noQI#ji*-^9oy9?DU3x%Z%u|x`Di{=f^>;b4=iA~Z zMt0deudX^N3M_9Oek-zTZf+*0u!yH+r9>4Kuq5Ix*R*j>_g~_aahZh)k@5B(t3CNV zHn1nq%@i}YL^5Lii7g&bC9>3ni)RYmt@(KQrjwE4Lv(g6SxI5UhWqmIZ!Yopu@;}- za2Ga~2#ZbF*+nSi11p5xH^9)r1)~SrM3+voKVHJe|MfkLjdZwpK?gHyYo1k{9Js0E zl}cZGHf9!a!g5=~OHYrRw;vFmr`q-_CBTnx@e-W;1DI3Z(;_Ypu5#(xH7?wDVQg)K zg6Kf>9%|zfRVNs02ph{_RoT8}I27iSXJiwJ_Sg8Q_pcM1l!2Y4BQ7qkSlbJ$OImCj z&FJ2uhapMLk?_aBv_b zBt&T#0|NsZveSegJ^ZK+Dxx3l7K6&dlIM)g&e2(&L(H>WTARx8c6P$aD}?OAQl5)4 z)>c>2(9}$MX%#(v9Xt#2z{Ne9w&8K6$9gHwD4?Nxh}r283ZI4H9gQk%+rGRfrb|r%BLduE>$uB1+t(wukZhG_` znF)-dPRo?xj$XwYD+@8_y-T`+6twwF%NQ>&S3;7ilydCNHejLaNq+HD9Q_JepKixW zZt$EpKwo(f4v5v`mq&O$I39Xj6$AMp6P3a|I;Sg z^CQtQ^QEb&lc)9;+`FlTj*$y}!xMO!n3GZU9Di3odRGr=Ne;xyBa>}GgmOW7ma`eA z9_cIz`Hgfn^Tg4Bz-KMA7sc`5z8)6tPf@;{ZcdPsSgI^4@5nEtad3s5nI5t;>c4hT zxl}&6jgVAiNpgXKfy#MT(&E#QohG~u;m0I9c|y4K$ef%USG*=ig{3DwFvrFwSP*^k z;`|&_lM{-Q$@usLW1>8AW<-+Y%>07rw`Um}mZyskGdVrQ*vQH6nK`9TpPQLfosfQJ z-rq02iR`+^muMPYr+;>fp~Zc&%NqDs|N2KFyWE@{Yywlr>0BkXeu~8BQ=)*&Y;C;S z(7%f8GMifo$t))_x`ddd7$(QY>9ew<={LWp@$r2j^gcGXHpvtniL08qoaWGvNa1iCIkUN}}z+#o7#ys4TkMJBfC;MEA})e)lMV z@$PE;ymLhSP2wB^X4+pY1qE0L3)9|S?p$N75T3@e(}cGrd==TXwzewM?y?ir;F}?3 z)zZ>(CfP|2>6ut2p>CF>`WZ4i*YSE<&cFFL|L(^lJI9bTih9<_Zk{2vVdh(r-P4p@ zT%8he_731y(%(~6U(2Yl7OMRG=xnK?q)J$O!leEwh54pLJmYeNCG`zqXNCwjBlPY( zBB-S6^rw;^N|nj*cchJzcTvG~etr;cW=7lbw2ROzFe${P}aLtE)A5 z14vnAW@aj~dwp+AHQ6OM&MBLq=l5*jpH%TvAiH%zc4J>6yT}1C%byrTer=_K7@GT%^CS@mOc)Gp3rDT^%u^_vg z?_k-T6%KY+nI3u0%xDAi6RjNVpEc>F2|u@>COfHs@)TqFTh8apb#>B_X?S>8W7%oK zTM=F-JJ}z~y-D}?_m%V6G@?wr4jQuiaqzPuyS%OiZl@3Pal`=c1@)t!GKydIJmF=<>`i*JJY>f}>4$>s zR3|Stq}uT#}2_%M-q9IOfh(eS!+Q#qUGB zP4D3pl0tpUi0bxt4x7Z87~>URKz`a&l8R2&G>Wh}-H*GO${SP5)Q1`MHZy-@(2$)b zyp2Iac0Ue&R%91ZGR&{SdiZtxB>xyU#--$89w(2Z6BI;4!f&Za_zh3(|L;ry*hfsH#!$$2Ejq$Affx8)a7+t5wv(?D!( zEy!*hQ+5zLny<&gGE{NbAFYnY+}wwZoIFw!6RyaG}(Qdkn!R%v_!jYEFfV3f^3NTw@rEM8OuOxCZB)!A(qb3 z6xa7N)0@xZdpcNqdE)2khpT5O17jWd7-@6ozBApc>$GNtU|?uKSauyl^~q?7ayrMB zu{dADhkx-`T(k7V>fT5E&95&|*d>=%9Fpa1ic5TrlK<-1IMY*&xEtK(&I5Par-w=M zcf-!{3H|HeZ3h(%*=fSt6uy$|+P=6`UiUf=Y;R#=dq*hK6r1A>c(??T5blO^Xc6V<0r*B0Fg-oX%4nq^uRw|l5^!;Q zN>rE~={0?1#Q6~t=+76w{epXU&+*O|jx5NG7n=l;g{yuGT8un>1zQ_hv-N3vC=_>> zqQTv@SSjxA#odELOL2F1*8su2I0P$BaDux#g)i@W@BQ)vl6kWC%xIfp>=fM^*Kt==xlMNEZt~AxV+{IXXJ! zZZ)VD3w9=JD~F6u4nobb&)`{04^4^TSa`>=V>tvPOP1CJ2D=K&G}q!$_<4m?8Nd8I zE{%|T;X?~U9QF#)M&axpL^NKd`OJ;3kAj#j@^71fkP1|2;>6@#3+rl`%lF)BfR>kx z=A|$-sTm2t{neSgWAi<+U7l&7ldPExg`=ygw*{Uk`q|u#azt+sg_8KAJ-u7Edh3DE z3=q;eiBUJm1Ww%7O*l9ta@Cek1LsNudrErCD1{WgNZ@5e0O?Eh2y1CwUXLqiJ1~&* zxA8}JHy#_pl_ks9sz8c2R_mW)7}-)iDi(*_1DV&J=LWE?95+9osrM9YY>8DvDZb3} zW)4`AGBQ}?KSRb*7fh`jzes7JusjB=w(rYH%9H%W4}TO1pURed@zjE14VbHGIZijP58m;)=g>Q9lgV;# zr2meI6Q%hK5`WCvW}(B^z{w+eH@Vtf9rea_`5tT*F=}*wyfJ$njPSwp@+UZ6VzrdmH82^bvsWX#r>b22`(hWNJF=lKgo9cr-V5fmb zzgQU}$<{OldKWWEwF;utq@=9iHi*rzIrEv3jLdL&YJ$LbW=A(g8IszAuUJ-Cfz;G9 zPxnj42Lp!6B-C77ez}?qv+2Y7U4({h;mxt=AHOQO-=Za8;e{5}k&X#z!^e4)3+v%w zLzX&-mK+=^L8CQHY*&%&Z4nmV=(m7FtF0~{(w1=5u=CVb{ajZkUXeoi&Qw753JiUh zbfd3YtN!J21sQcuoU`F_6;`T_13vp7r$=3uMErs?=*{&0Vmee{wSJsOqC4*2>n6Ak zBIZ2JiC}!Vy6@`$CD|Edr&2q2OfNqSosLS6wzcJ2ZF84IWRh{S?*ikw=ABP|J-@Tuz44lhychm1ff~$dNS) zoGy&*Tkl?_sr2|{KxS${|!up z-7{d{%Lzxt+t|fo56|yg5wEJ!UPpF;dYvFU<1p=9JgJ(Y#i8eqov$bNKj9<85J1ai zk8a8)UGC$4-ri+}zYzXA%@@WxtS~Uct5aZJs8KnD1D3M={Z2ENM#wIzFn`uwUP-{f z%G4#~FHRbyUtI}D#+O7P3VDLfsZ(V&C&prT8Pd$SRrKov`oAuuIbOl8ox>+LxU&G1 zZsXBolN<|gsn}>P>T2oT1nR*CjnI-kDQ3TIqr*RO_q-YShb-0QAUO;TB3>;5+_*no zF|^VLOj&*Cf}*fZl>!U&JB(ybipZ;q*+7wz)+3=|nJ_8`EbTVu@xF1~29&Xr3gn95 z(U=c>j$*jG<1I3R~f6?jMIh$+lNWfeV(pYctHjZ_V%&oq53)2Rfsvy;HE z=%HV4plPqA6_SnIK(H#I{VaQju(M%|qB}IppE6m&Zyf8%2x=EDyRaqyuV0lR51)Xh zTpOvYqfWi=n(+lzjlMg%$r8$MOmeB>1T6pWPdHI^+|GL}z|~wF9qSncN6@BK9qs+e zq_WR{cqD)Zjt|F#EryxjQgUvzC5NE+Q&p5Rn)!0q(!#VXF2-cqkAH1-jfPXb&V(dO zDId0O;lKy#j*vrEn4j2ZjtBUj&<5?~b6)u6gVR9k8=%neEi^}QqC24{Isd<*xt~uD z7<57t8Y*M$;8ax9kaQOtn|AOL@P}^3=coFjML_MBRWXvQTxR{UZ<4p?^4XDP#j_>( zhCf^1kd2tqS{D|kZ*!(+7C_GZPjD9HM=KeiK9giL@PTvsEqZ$L%SU3CL(oj2z%$<* z?HhH6J|l*V;saLS0(Zp}whh@EI-ouv?81#!sOiJ+$w}Vbl*AJalvfLYkCsg3CnxO( zOK{R`I*D+tlZlCQd_;xp&_DwHuMO~o+HJ5Q5UH#TCl;yift(B|n0vBJ(;4QbE4Lp8}Tax-~6)f?G|&pXlJ zahA5DE5;=?RB}l-<=I$n3hB@v+UvDV){Y`-?)1DH1o|2IZ?)m%#m-6|O>JFD%&pB) z=DNv#{Mx6NiQDOv^>p5Kg_`pjt;K<>tP?-lE6AvbuG+b%MQE%?%zx50KqJyHb=^Y`7xfzlk&tpZS7%kf0keyXJIc^OK zb)IrXt8D-0ZbO6wAGf{Ns>}gpAF}k9(+S8*g)1%fJC7YqM+5Vg5)aSL>WWOBcQy>8H9CwrMqNI)jhe6T`v-@r{ZfSt$8} zjP&$MWk=3#E5`H4;On2!_3XHiK5OE!Bwg5siY21KAdCpp_UfV zEARg@9MU~18%cFq=N?s1T^&?exj%sLQFUIV*Il{9YwwdZi#jag1G4h&?aJE|>pO3c zn>lkcr}Hl%;bH=F;`Sy;2r2V(3z|$}Nx-y}Ss~gkJb(*af6i1c)fZWtgd(@a1B+xQ z!pxb@uEQ=_6m2&mP`GHrbrFlmF~E<&a06GX)b?Sg=RFN$Lazh?yN`^7G5AtMEGxBwhl-yPqll(BQNFDbzw>0^FJRbj0 z_IDCyqiE+y&I-kKuZOa!Sw!7ZaE^a*UA?&u-A(tq&^uPb_4Xi;1L({p7;NYiC81@ZS?XxGd>{!&`PA-G&=w){caY2M@YZbK|6} zn+vfMKuphyHemvXh%mgrtHaNAJ+eCJeXfr#T-IyM;AO|K@q{y3t;;4}sNC!0?zU4w z{~F>lf7_Fp-C_81(#V^bZy;H=ZfdD_kbv3qFz9qC^RybeG=4MAJ$Iv^J%#J;>EWSi z<)NizMXROeZ2p5Qi6+fp9R5j++Wl^6`7tdjBco&^*G+8H@N5ffiyVubNX@VIWZH9U z)ouO5z5ki-`MV$ymf$pP1rKlT{dEClH4COktmbsx5bV9P@R-1V+Is>isHddF?>;RZ z9Aguuh5qbDkd8^wu|C31GKPyD5$Rcq%T4K~51sx*i)onp*2cI@ZWd+ICv3>>>AE@j z7$s%iQuh!!_Cyv%BLw|Y;t3$xA5&3Pr6iYQq-U(qNXpUc#(OjX<6u-Lo|uy{nJ+HC zzK7O`(6%`RpDbwWY9d)@8E(0pB2OvGn%OCPed{|;G^hFOkuZ!$7QB|ytW7BpF|T>a zBs5#ixDIQ+xLYt^$}wz~eqJ@w$GRM8+;M?E?qp5>y}sz8?ifsIbBzzvb?T~?zodG4tFlocY;udLTxY5A!R)^NB{x? zZ1NP6F|VYgx5j2+Y&5~1X<3R<|59mT=O!{HLhWp=v4p)N znXu)v@ae=fdz?yNvA#ZbhOUB_GcHb_wBuMLmGJe$?FH4lcGn@?d2>5XvDXF5ox6yM zLpjGzPa?^4^OEdc{(=3QjrDyKv!+caX#!?sb6WB4MiC;>PD2m~^k^KlCo(g`(n zx_Apfo61KVkHb%bO*KXwfm&V~01=^-{o4u5(31p)PmZ}mSKn=k5tqc4_GLS~_^Z#& z%#1NNyX%aFeC^Lq8X8zS#R|q2&d~KG@_u!Z-2pwJdMmgz4ZTU-W${00dpt@mIR9t$nk)?4s$I7*x=r>(?c9wE}HqLs?_?M_BtN;tmSY=>Q#d z++aFRx_|n8iTMTFXQ?|GFk;dK?9%HnfG8%1B!s~zWm*d@qUQgwOdJA@RKVBr^V;O@|T z2Xy9l+$(w!lKg0k73h^1hIGs7VF%UUS7FzH2pULOA*eJqTFt=>(N~?{zzwb}rsBL=SGG+(H0i!+JRyK;Wt9N*Pu=S}Yds7wq|f8f ze`^rwR@t2`OnjohY|#SQ$T(FKMoO+18ICo()W~ZlH}^`a3WZ7Q-9HsbkX+!o-ywC?9E?+;7}fjdZ@Lzu`<9 zNsGoB`HRYULFx&di?@$qzS2OqBr@U1E+x}cEP>I*k!bI$&|V*M zNpxxMiMuCjhqpUF(}goIuO*{vfrp}Y+a(QGoH-OZ@)r;j3e*S{x@p$Dl(KyNwkNZU z=U>&XIopOtKG??gy0@RI@pR(A?jrFP(nNOGqLogV7g#wan;^K#m6~`2)0J8ZWA>ipwn}MnQ_6WG`ZW_)J>nO z6)Zy??qDbBMVC|*jfz&+QIzX?{7mydrgbx!w=mit3=QFTRBb2k;Bj$wK_(|Znn~6q zCu>dXXnp%Chdv4oQK&wzo6}eFvn5K(B0=TFOUTfcbMU9`$Kistv!v4H#%CqSs>(7z zA8EOp=Mw0I+Y?`y!N|55Mr-)yG_p#Hzzrm57yZ??wYoY=oA=}Rq<{UE`WO_O2U@Y) zL2vvGsO)P7LIJCziKuv}s1jXU)w1`9LTenV8AUi+cv}#}nd@5XhtBRO^~a*dCqNBg zUTG&!0yCTjW+w-xYaJy;<@&ak!6yiJe;1iM@Q%H^^Y`)|BgsnEcwF3{^=Wvi^8WhQ zZE-2V^n%F9Lt)+4O5ed4cixe6GNQoTrnE5Hwa#Vs}nw`F~=JG(63SkXQkZbtpSh7s@0tVq+dJ`8u55bFv61?}lD1 z@8sWxpot@W_YHK&`4vMZE|_J1>QL9x)qho)J>{Bn>Hz(ve*1K7Vijh%^~v!BnaxF= z@Mf2%c>%%u>=TBgXWC<%%@D$2eGkAsokk0*CtPyRO0u*H)fdy-mnin?xgBn7PMxJh z1s!L@RUEo-Qbw*EHo4|S#+E)}RHH|1WMo!Jmpo6>$e2aOOQXS%)bSeec~Qj{l$koq zjHOjT5O%O5Gdn_%bTU3-_B1TY6*rb}l8C#hyyr4C&c_-?BRrmOqr($sEwB6WF~!6E zE@15j!$$sMySbUcCBuTMXX-xB9ulYSW9BnJPMVVTK^26V=6wg`y!l7Ah=n$uQgDLN=4F%6`{%@q z=G_xU*wSS4%(RnX_Qn!64MUpr%9@##x^Q)r*$TFdsi#!-3RU&MbwgG8=YD^@6XZlg zT%(<;gtg^ES|I^VxH7RY`-Rj%6LSC}yap_&sL-X?X2P{AYi`a>(X_F?mvvr*oxfgE z3C-6!uRrYDNaTToH_eP!%rh@*!?k9({P4o_Qz1xIHfAGf=j%*}V$>#5vtxcYcr zu!s@@c0T!+oG7)J78OJo>%D8c9L43kf#Mvf?g?d0qcv(V9DaBK>aEj>w(|^QBs0Gy!3Q=lP%CRn&GWP3jaQdnVuQi!a^P28p|1 zcp_)LNxPZlMnvS7xX8=P;~*mA zZKOsT$Kzk+KSFvnBf>Q9IRAFZLcB&CWZZ1nS!y zJZrxPhJ~LlUYTpKqAEIW4EZ?Ecg7-aa$#}9m=eCJe3^V`96lyNG75x(`=WiUpMPC0 zx8?y8|G>nzu(J^0=EQEJb7*EfczfydfV)-A#j{#>%8 zXDYJY^dE_-3fc#sXU-4tO=))8*2xhJyVS(yz42l}Nh>ft1kP;mn*5Z@>eLp$KVI(C z#&MBkaz?iKlR~Y}XX>h&8coZg_|W{OCPn)B&&gG#orR%CM<0<<H+tL< z*7Pad)_(u0`^VU|BNp|{hY7U)s1UcXMUpL}?tz>uK3yz^?L+H**^7Ap3H`30i(T7` z8HGRa20iWXm4;bwFgM+^>9&@0BO(skC7}Qw<4SMlJ-_ElaALPVI$fpnrN5MejiA8% zujI0S6Xxj*UI9=-p-K=&YD0zfa{PvH%}I| zFzh1rEr?_}T~&$SJ@~Qa7I~#`=eg>Nchwp>V&s@0Vy3dE z(9)ZBjlN1)D(@42>~<$v*}VdvW>|JDYQ{QBEj#TbE>t$*+##-{t1G9y{VQYDQF$du zn^;3tHG*^0rZ9{eKVYls6zlaBl%BO56`6_X>>#uCMRV{UeyB&j_rdDBE;Vtw{S=^DGk?KXXVhU$X9vxekw-uUM9A`3?r z`1MYDJp5w=d&gHpNABfJy4Htb%rnz)Nfl1$;p+jR44Bq&b4bBoX1J+XCZ~CtPXgeJw(GY8T z?MRY`>X?+DhgLQ5q~4vqDJM1^XLeNm^+a$$#$ zw5i(oDH~;5MnOrJ)j3P4!*KmLs0MRn#^AsLDtD5Y(1N4u)hVd1QhNG)oh4!r!6X5@t9yhbeBnXVaRq zeRHLi8O?ZQj3J4Mh7!{1VVs)tPbzGR4pZG#4hoG}G<^>U18~`ErtlhEV`H(*Fv|>5 z67%n-Sve`Pg3ne`H}X3uzbMjl`^UkR9ph5I({5YCmOYV9*H5lq&fk3RlfjT*$sw1N zdYLO;!i+~I%~>V|>gL~(n;fwO%Hdb(!I3Kknv z_4FvfZOn~Qb$tW7greq@l@JkJ(ajt{+3|DCLU+#G^JzzZ)KQlBgl7*QpGb4TItx2q zgan~9HXu(T*Y^`$H&PN~xU(5H&Mb1Wo6KS?+14S?HXuJcOM_jo;_0u#1CAH8ZTmQH zOP9Y*j1_77_{;h|8}@nzRYyey1Ds+ZJSM6rKR>*)^L>F1fX6I#H^QkKA(zwX%Wd`;i7+dE?-~P# z&TXaw%>m7oKQs`KCS`ik{kUi1iG2`70u!$H+|^Sp$Kpbs$oBbZKjetF3YJa^-~_;o zF&EFy^Flc6Y#%uVR^UUL5l4BrjVj&gCmLiLG*F(VM)sc8d{mKm`7?TyGDio|5Ca7d z8B$+7;SQkWPuJ7fPNR7XW1ex7sI_f7^QCPEqOaNNpbcR;;~_vj6KDm?^k0qP0RdX0 zd5jpy=PEd~hkF|4E9#l1 z)B&gE<5(+k3O2RqVQc=)Jp&IFyC);MaEx5-2q2ILnq%~+1{S(H$<))&NSzJ&#Hr%Z zts@B{YjHuXe}iD&T|Ed2R5WtlDFRushIbkNC9$KLNU_*m<;abbH0Y?O3W&SKTm(U4 z>5hY{7gX_qDVHM~Xf{iEiY}!liXJ)GQ=iHg2Gu=+RPlX8f}-!MHs{b7-zv@dmb2tl zj~pPJ?jwN@SWql6YLU&_Z}-oO=D}}~1;yO9j;rRfaUfBk@4D2>pgZ{o?^ z#)(pv9|yETu$(k0hm)_AeKV20xHlPi&OmcWN){-fVX9HY&aY%QndIbF&L$ z5f@H8$p!Ee^>ivJUDAd-s&AIJ6i3^+`73*=J)fMziAv*Fo+^I`!wX`aI4hdF=nLLF z>|9i8UvG%8BboSF70BPv&uPTbtso@jk`TDCY+4)lD@U%LOeV0`w-sTHijE;t&lfQ@ zRAb203>d!PIA0Aw>CZ72m7~5@Wo?il6AW8nl2w!~@%KsuILu45ybmSN1jO~16&I`M zZQRfONGky(==~YL=^UBu6RxTizn@^-ePL0be8w{YT?Bh?_xR;-d7(VEzI1{T{(*4LB~O;EeJNF?yIEEa|?@kP%TT?5jhBI$#*)ybVBeBZ0v?FCS{SyW1m=5EtL>Ss{R1X(km z6e(4Wp*WZ+t3xjCfyH!|RzngCPG?Cbt_YlBc;y7^=Q&y4xqP;}zCAe=-ZH7pZ5lKe zoB{pOISvC=@veQS^jI`M|E(Zq7;qDH%p7s*P9O<77T9+5Ml{^FKB{7JS*WMxp8L@A z@I6vu{GqIc`!F|w32<_u!m41qCF$o!+O}&*O6qvoTJ{OR7pCx7^>>`0Lo`rw5#h8aKnH^lj3$%UBjo*T3aGxJ+Zg2l; zGW^F3_BE3t$)!>d+o7fgP69Okw0@kjtxMZ6I7o{C`SStpd4i9A;A32xI#&CwNSF%` zqd8!IDA~O1D%mLPAU8GwCw`~G9t8%~A*SS}{~g6y1gFq9>c@Nz%KjSqHJK74 ztAS*^h7Ann7~F%=bp+AK4El2l2rzuJ%US!Yc{DcjZIU^kn=PlYQ%-9Efs%ESgPXG# z{4LPTG^EMl=c5DfzcwIdMYv}5X*j=_AXk}R!-@gUjI5^8WCSg@o}9Ibwo-;6oVVG320D*LA-cpSL++z&u$!<*;{cC6wO_>U`Yi!7M^m z!Q?ygOMbD{O)TdCPv9-WV!C8&?uvg2V4H(x!)tw92&3+3rcAo7+Ly3udcs#FF zo1soCGNc~=6P~OkFd#|$p~=NMw+FI2_9Vc_r5RK_<|GIn}S#eH=ch?wK2+>t-X60()iiPF8~TqgF02BM|Xk7q?_opZE#N(Alsue5U2eSdBKv zo^d_MFwi7l(%NOx5cjI=Jsy6r7d1xs&j~tww-FAl*+tz8{cEGp+2p0wgk50eCS@~yv^YoVyDg{5o$|y*yxW&Wv+!nmAL z4@SJ1U%X&vNQmT}#^*SAu>Q4j{dS zy-#}c9$;=~xS+-~s7U4?a`e4ot%yhmCCLpMiH8~m0d}F&I{ZLU+O%0KV z(_cI!tN1C*j%Mm3-95BgG%$saW)>(YT~xu!Lbs%e z0mx$po4x$u;2d1#2$il_g_!k;BqlFT&QH7GHcx>?SHI|}yv}}luLRMi6oOXS+XCN} z-B_L=kWw`HS(&6Q1YZ|f7Ho8Kjs>5TvXu26i$TSu;Y~{KN8rer6d}}G>MlN+2HZAy zq#yRb0#IUgC-IZu@#wgdiG6GAL6|qHJ9=VXuAG0*1@^UF z2%2FrsP#vCu52^VGbEO&uN#F;dC5IO@#p?cAliQ(43_0VXLJN|*E#eTUGkN)fZ|ZU zZ<2Sl$39B!Jf^R*GPc`timnzqZx|Ao^ULt(9|aS-Ga{#Tb>LDT zlh}-AQdP@#FWR|q?3Ds=KB{UX>G=J&X_buQ^K{kNFAud}_8gcNHux9eO(|G?_Gr@_ zsQFHo;ov?Wi&SDQ#0ZRW6X|$Ee>LP?!)yEKCQK5|%1pST#UuR6_sHC!E4u=kGvYAVcw9vi^sQM}Kf9#K;m6~=;vITR za>^%iu|o?DFXz!w-MM=-a6`+mvlCN{L($3EIj6`UDI*_Vfk91$@$lxBCb>X;o(vnJ z9gDOXF^+yv-RRmpj~t+yP+uv5OclJUg_p%b2&&jW|et zLI1q5ENU(tTeG5L;ie5z2P`L%`nHtmbtskgfa`1Gi?aXmQAa0FBO3q$p*X={stBor zcBZ~_lyiIafd;z1vq-?E2vHbPLmORo=o%VU94U7j{h`ET}X?ay;GsA3FIC4NWYkQyMzm0dC7inqdwTh=}UhfZeSXc#fcK&y67 z#uh1swi}fgL$-B=y)R1WGXyo9JB_(rzGQrBR{P>epcr{dE2}fr=ZB|(0@{nX!bCm!IgX+mX0kyU792cX@X9#ffJKF2UE|^(ni{_7OOc zu{CpqWK)N?G*{%7IajCe>bFEgyP zorhR0PAgh_F~@Pb$&QT(1R2Ehq_u_-4Ghv=+^sk6W!quo*zZwr6sf2oq7>~M!?b!l%RC=YiF{lN>uk98W7Jk$?(7(Zqy->U^+1^S3Z)0!Y2RB}8czRw+5PKd%xB_pr z1Lb99r>F631;(!SM$v7xFzVoXuV!Poa#|WR3qJn@Z1t{QRhNhtPj_>Uog%V6@PO3Y z{y|VqmBr@Mf6TmiFp5yod@um3PvyHF?OK>Gu0s_)41ay@(i-%txsGhDqk|}2?a45J`f6xY z$;&Mz&bQU)np3Q+TxN$5msiVmw-jIOZ`u8Hv^~v^DLch#>tNth7prMk2QoAzmd(V< zY06^kTVZ=@IsU}4W@l%TIl!tuem10H^vr%F3eGoaPcZN0KLQpSCBTL^agL4zk&qsm zRF0+?SYO|qw}*Q2OG;E9P1;)!uhet=Vls^L^>{j&A&DCS`D5eq%u)_taXD;g2M`_; z4eq2cH{hD_OyL(9NL2dd1=XD?JPAKuE*N)B0x<+u?z{U`R%kvxBxypG{5`0zudez< zfXeZ?G>cZ|z%Pl{A^`!DdWRNE+21ERwC!~TmduWAvKbR-Dic4HFg;DKHzaXRcKzMv zz8h?k*+~lpo1?4m`gs^5W^!~J->x;^X#3ok#ZOo1|Hz{ULGexy zB(uA$uExJ?E0Hy^L__#Q`7pd#@0tASXG~VA=Q+*CzL}eVxDBp04!<^W3QMbeMz|^+ z1*yerXt-iyteX8{ukYn9!J;;!MlB+7zQfo9ccbld8z9x%ZC5rki92K=o2HC^4)6?@ z3#1SKLzon-6^Sq$NVFwF-4Rh{UY3jWWIr-Cq7>tV5C4a4ZTsk%UvTgVrV2`K-?q!d z{-O*Gm!-IQc-XwW-oNGcJirI3-WD0j-QY=9(e*w=+;?ize?z#PZ&u!74TUf&5HHCC+k%*qP7g_R8 z8ax`N7UsdF^@urK+d6?SI01hzElyrIi4N!oj}|m1jhpkUTS72NxX7(nVU?f{f2+XP zeR8nBq|-C(Mc+3YjFRjAri(cL9-vKbPb6gZ zb0udAV=s^q`s?Ac+U1I&ZY4C1HeTnBTwGM8kdhWPq=Dkf@X2E{cF+GM3B_jQ(@qdQ zljMfR5P;F^T0x?K*DsJXxwyvM}V`Pj8vo)*2A|f^qO@)0pxY;Ew@@ zB#P6MmQvjd(+CM|M}?#<{yjSv|CDi$N7BaY?9@X}w-Dd$-*Aebe_EZ_+e)XtKI0E=?Oo*WgVZ8Si*f(P>iR2 z>V6!L;Wa7p&+~-Sti2#-j>JS2mzU-q{G*KOeiOk&YT3w&7jt~yT4dKh0An;&;vJYD zsgSypjX(m>F-I!D9%Iyh@(qtO=KSE_v~;w(|F=c-OaB}yb(G4&LRlS$XF+pA(r0m? zwpc*aSSfEhi2y@VgXPx;)5|Y;7_W!If`W^!Ua}~Pr-89_8lLgDL=EX3fxOW&n(Os44Vax>*D+bd$}8Ic;KF(NN5Q9*q7$uP}g6m=xw$AYqjmm7OIVHj|D-fp$*pIuZbpXZY#vn}V7I~jIOPO&XxPj{4c z4l$Ew4nZc-y26pKtP14Fv%I_o0hhwi3QLuQS`Nh65v9n?6Q#29(X)wdg#<&ZGBzS2 zu}!|7NBOTZfQ#GPq9V9F5(OstMxL6{>(s-ja=;fwe+-9+*q5VzeZoV-eT)`z6SF-D z*LnWGyI6!M$`!m!#BUc0FzTRDI~*HPhW?oWQZqBFA*-|qFz;UbMJ&~Is7cEQyDaNW zTlH3_o!>V@#Ov)C;iENxIVFs#WY?JwFW)BFC^>(lNQ#Sccz;0E0=Vsm(v_YuNId&v zcZqzf$X01C66qYNJjA8Rkn(jBA?F1i*c@E3_xz-{!U5S3e^RT&H`PXR^XT2o<#oiO z#ijLey^h7#8xkFNa7@G@3J&?n+a4;~=y}h}(DR&)wa(-sErKcF^i7*;b zqLEUZ&o(kNEuENyvKG~GGC5~rNkm)z_Xjryio`(wZxd^vBb5kFKs0xeuNx1X@TO5$r1V3^5b0&{=uqaffL0$Y*pC#WfV?vI6pRP2J?D+*&4xbgSBUR(C7HwZXwx%g*po9I{4zaq=A>0 zuR+lPzr|jU_|h}=FSaS(2r2SDXXosCc2aDf{{67-e~+l4!JUw#s(hZnmw<)+^}9Ri z6ER;~K|zSIo)8HRi;i_bp9q(jUKpP)UanqWkz8i7w%a1dy?kMNbNINLERdRpZXa{s zao}9EEB03)Z(H2^KMON^XCKr#iOVvoaiqM?h3Uv`gwL3V_a=E*4eE;U3MJtgAN@ONO{Xt2>%V z9PWarwrrHrcNMA5%i@nY`UKK{kyA0jUHrjS(=2Ce9but{{QYrE^=mT z?MD{hoAJwul^7<3m)!6&i1bY4RHq;@EejovOTFIx(Nz?S_w38|L;^4)2$Dp@tg6!3YhOx3*Llr1cGO9qK{8!LYsI zNidh7h|#d|U%*NNcTH zy1E(N_0&tH6OW-?$tQF6o{aFugA=(`>`AjHP}jhyu!J*ZIL8C^wkba6K+;K>Bteyf z85uzdj>?*hIF~a19ENx@X3+^PrDymjua#7*2PRX}|H~g3_c3qmC)5`p6VVf-fN?*= z!|vO7e>(Cr@xB(|>n7sm+p4}?a+H2m*y(E6S=h-6MMDAW<2a}`vq9;UVdg8(W}C(6 z^4NVH>Pc%*cz*Bl&K3Z#EG?N^=V$$lmHRkMa7dC_P{|*4l*la6N0n?>Vn2bg?Nl_i z=6m1jus1v&ks*_t)HFOG!fY1c68+R{`jv!>y~`@dQ%9H#vJ7NPdjvEMl#S|s6J?qu zdn8=%=zTs9_`OTw8BTvDAb4%7mUI#(Z+<$xo=|;LZn;0)ni^-)}yADRg3DVivkCB`;0qpRun?|4IvW0pacyZyi(Q(=gL6u3;U=`weEL zpPZVxo_&fCom_$nP~UHiwVpCPMj`?5&DC)mk97pTN;)n*eJ^@^_x2f5*DB)!Mcir6FePIQe`;m56ujVDl$M`Ldwp~P zQ@?k1LHllUd)o;w`a9CRfq<12&rfhS_5D9jqNXlFMMqajO_Qj6jvIA-U6eu)R54a( zKrPL>>XM9X@F1^ob1hDngZNc@AJ@1UJUobi)_i_XWZjS0<(b%2lS+QTATN>L+(}Xr zcl}KM^YUM>_N~pG;3^sVQ>vnCrYQ4|P}l7ui@eXvD4dTMhW-4Ea9AANsD5>|`t&DCB?f>=0)W|39I^*r3v9eT+O_CV2*z$?ESm$G zfEQxQtS0$LO4gmm{KD)yk1LF4JN=?n_)s5OM!l9H-$I(qo@1!V-xfRzRSyf3;aoFJ zSt3mTP7q&Yph;prhSFF{k& zGF+y^sj`7jL~Vh&BSaeZ{=_ycalMn2L04DI3TXB&uI|6*7ASTHPmS1ko2TU-!X~wf zd7SF*`Qth~$tv*3&m^rdm~T8sTKv&Rogr=W0bs7FlR zMnP6XmU-XJY15ei_eFVmn`x}*wzqOd3b{%38y>8UVUf-F-Ku!ppQacD%2GQUXY1}PUc6d@a1S)Cd117@a&{_w`P%E$))J7nTiNqIBBU73pV z%Z=;b1A`%9{%{i}b#k5MO>#CydRkPG57cLe&}lwj?)DcHsl=QHCj@z!X9wv~9eqKZ zR09d!LJFRXdmWNg^`ckmB3d;{IdS<;h<(Ntk!#T%*yp~tgHS1QT2`Ck#5b}duB4RZQHhOn-fipj-82Zdt$3&V`AI3 zZGOGqeZF({`#0Cs&q_bNs#dM48^+6P9?6d#>v-%O?8_TT5-wOCwA9WfnQU=`yNog_ zBD`42NQ*anjPKtR5=;9`o+!S>q#39s4K5T7T~1rAxdX=6PFMsU`&&7&4i}2bD)uo) z;FKnq!||r=8(k5=w9Z3=>z(s-bA~mp&*b@*ss3FNnJL4wry`1$CNCyv5c8NSJ`Z8U zue(NFMGxD`#OnnS^4xp46zk8KJRShZhvg>-T520f39A#jBsBHB47b%9GEJ30$W!@< zf8rrt&(#>oIq156ac@dJOHN0QJ?q{bweTh3dFqogQG25GZ`gIQ*x!%4PCUadlCn!D zZ}LRT=>yJ6xvc7(jz#hnQS(H0CNmdFyrRiQ-!b!Wja==z#FOa82>Uu8V*pZEoqY4_ zyuBDqT>X06aXpGVy&(HIi2eq_Tl`b)Pysz>v_!;ymJqfY;Wwd0Yzn{VL|BwclF&~@ z=ML%>h`Uo7BDgLNqp!ZaykNTXnLOX7TA9TIM{MIhSn0BiX<^lj0k81j@SXKhc-1ct zT3T5r`RxzO)_27c@YnWmMZb-;mq&du1+9M~jpI%J$Ec?Ium23kyxQapfO0zu;q+L|$m~9}6?mrCEE0GNryU+JEU6gvUIyhV zF~|*a6~!NM3{TU{$>n7Wz8aD(QrEC3rzK}&%ScXl^Lb2ow1*7Kt?vvlUzd4%=y-h! zA!Pw}{`sL6tSmWi(?Oi=*83;Vy}d@xGo3`>d0tGK8~nI>oP?J*zVq4J<)^2p;R{OA ze0QBs?j~K!)2o&FYf&x#;?Qf?TNvR3r{&7vk`_MU+H6Ek0qck~2&OV(;$ocEyYyH4 z+f3{`rJ3g_cesHvn`8BI zlO%{S!$tQ`k~>_ELZ~Oi<*Ln+F~0Iu2w3&~W1a*Pjh_D0k}*A7m44kf$Qd7bu$%PF z1&Xa>*jdC*IUZ$LDy+Ac3VeTbMj2(|Vp%qNZU-k(M5Lc&23osxB5L0+7{7&7eU8e8EuSU0xLcGWTkU65be@LB%9X1)Zt>ihFm4qEl~oj2fxug zU4q(>xq>cih?bn0HJGZ$0*{MHbU&K<@CSYlgt$q4NjvX$2#UF}d}pSjX;nJTrG9TW z&9(X32EPtY8Ix<9j?UTHFu2a*gqKsAnP(5#lmZuO{8ESd1-MTMb))T z7PJ(fgCtS4sl&?k`RlsmGdX%nV7rL`6H(b7RdGmAi5R3x*}FOjK~ZhbjKat0{X;@m zmsbr9OLH|4hK1I|26FXOW4e~HkL>ra^j^0-mC<20Ofe@})Q8~5Yh*y+3ukVjv6yHq zoW@-M7M}T5&;BXc0K|`c8*x!xT(R*6UJuN$h)N_4yJg1u54^iG&}fhgjfEi;M8E$P zyoPz_G8i z?5w%)Q1J1I@dJLti2;vM8+ouW!nG7%(YpzUQr@kK9*C^#X1@yQZDYKaCv5K!sXpKD z#qzUhU6rL|X$eJze?Zz5pZq1xz#AOxZ>k3mp(W7smQ%%q!qfPnadBovQOH3a>DuK} zu=MiNFG3?$u`FcS_;6ctpshSb9)c2L^l2^Q zBR;;)NLpO(vQiq>j`3rWu<0*qfh=6?!>y4|_5lNBx~&x1ba8h^dQR%$oVV%A{A-2| zUgCw57u4VQ9DJrlenNz#YOfjDd1w0#CP=jMGW=JP=Am-OvtRU#7@C2L%!`q0((Y9F zo0OV~{+~v98cADii!+jsUr{GkSzA$%S;NrD!EH6ns03jP&Wz`LYy?7msW?_9*T2uj zxUBYR$Mk__0`&ocvEF7wf)GdPZ>ydT>-A(&zYSAjGg0| zbw5_%-v4t|2h&U8Y0>C)6QbMK4eM?D^Tx014rSYWd$Ru$;m`Kr*H3wC-wo%RwNJ9% z&;Ds=2AEssH=W$kF0}2>lb~G(gOh8FokzO>0nZN*^Pme6@Rla|IvMR_fG#f_UnKXe z^raK9Z06;ZT3Bf}NcyixEE0MBHAX{L*$f@i{ln*o zxBHVw@+`}#1|>!30O~7Lpa9w)1!%do9GLj0CI=o!em6=;den^=6j9_aetNwD)*%Xc zTc047Yjs?~jV}yy{A&E#M;+lGkgSXZaeMp4WZ$(f$seelxIU^dnc#QFxCJJFlu>&u z*$(L2=w_w>Ms|IvoRJPUkUZWb3y$?5d>JM_tpFXQI;E$z8}WMu@&eJpO-5T9!XY^@ z>z`4aB;8Os;0DLd44!68^ykOxGB;TqVsn4M>mk z{<<^!#BvM2LGNELKji}kuXdGz=ttU24tdoDx$~Mv7#7q2u{x|sYaJ#=uPY1YEyQZt z@jHXAHw5YislY)8an95K_l6A8V#L#je(caIvDdLNl6>YXC;o?cU`HC&ki^@EV!?eU zq$ka{kMgS-RAgk6hr=DW<;)?G4nkrfNdc6;2Ldr&UxrYXc-_wC7mTbF$t6bpoVn!i!JJTdKy-eA!#ap^Nt%?~#Bl zUU=7R`-_~9FM1)ICp-f|#*M;iKKQ22bg(gzv&x%et&pFZh(?A|8Aj$!7~quj)W1C) zzC9dJQ4bYcIRyn|`CNSL^0*bK#cvsQv*9UZkCj1I^Uy@LJ<>_a$&f4w1Ye)4d7R2n z(w-}N7*0gOPpd9=_dcAaIsBc@>O=o&SzgG(Qm4dgPRHmA!siYzC*Iqk7&M40&%;6` zIjTkp3hFX{F65y+s!ySqTusJw`gTxAQsooiL-|94E|EKbfoVYJNuz+VLQl(W(ZmC- ze);oD9)G#Ty|Vg3AVi)5hGdx(e%J3@YidtVPzFv^hLzdhnezmPVfaUMjh;AK7~maC zxC#llm<-Y&?-)V|gr_GSpAvrxn4(kFy%iDi5B8577xj|zKQroUi8tKV3*Tf#3W=K{ zl6Ffs?47+s0t|B|h;c9YcUQm!P8bP@^cj;mIiUi)NF_B7WIB7jv6hFW^mKKN0ridj ztLxx;dMXu_>rmm7V6?{!+f4n?Gicg7H9Uom|0w}Ai zAULvbbylSEk7o43CuqBnpU zS$}<=SIth`RfzD@z-rr243a_G&3oc&KXEofkj9ZJY!^nhVLV|WrI6-lKmsSjgc=mE zouM7rg?>B;iWw^*USDEfu0eJ*B{WC}XQag!D1^&RcW7nwMN6odY5juFS4<%%;iga0 z=uPCkWSSiZG_VH&cc^$Y6HQvlOS)sOaN|b*vpeZP3971R6#%X39+!HbubNx_=fRQM z0SI{jk<pEU|*}`^aF?+m2m*Z6*{n! zBJPqW@Hno@QpF2wBxNp7ObvD0TiIO~gX%+vR8Weu&~2bA!R5!tcMuHhKx^6Q2}q;1 z?R160JA}-R8uE1h*I6CnWz<$m4B-)3Rur3t4XtU$(E8P0&yJwgQH$dZUoFnwJ4UFQe-y6Kf#UbTtDuOcrWj0MPZYoc1?|g$bgd@Y!#y;`~Gr3cV&C z_ho=Qv;!k5gsPs=MJ&w?<qp_s8p#n=8lMIwf{vI$Adj=G^;LOAM% zl;bxg;St9qob&j7P#4+V0c{EyERA&MRl$EP63ks4QsJ^1tmT78$SFs{MchS9wvv{a zsa4R%mi3V>67Ud4I5iKM6Y`vR7?N*{>X+GEPCWoGqT=hHX~XmwQ^3iS^Ov#Q#oBCt z?^I~bktjYdV{vO6jGc~aYcl-NIP7*~(fjmTDg;TkvM_$H*2BQ2!WjFq3u!FlS zhW7XaOCu)C4jLP2kqK^|XyV;9@Z}wRbBGgo1O4RP2klEdv;!ohcNG$s_YeHw)^yY9 zg^7P%(drFAF}V{F0tbo=OBij+#SWMX$qQf<+;v{vY#t9<-RPqh`6cS`Uh^HXV2M*dEpbUC52q^_-#t`Zib&SKpBA&cFHF**$#%`M^uI+ zi=vwWG5j;M+KDmE(0xj8>5F^b6>JbbcW+zb=F?tg^^U9x6*#C*rNDF+an__-Dio#Wq_0NkUvj zmm`$<_pZHPJs}6~dOR3Zr3yCQuaG8&EEXN>DE2MNUIAL2c((+$5+J6cp{EyQ`Zzt5eXc zbum<9c1p)L{{Pob02~ZW@YRN&(#K5QQSAj}>b&t(%U1k3Y{6%gEFol}B7pLLHqhHL zXzu-__4!PDO5(%(>}YWF>7k4q@p6^!ab6giWVygKEH zpr5NQ-+{~OzpKsd((kPyS6#~mOkiedph5K!w%vd{wUQyuy*wxwwRErh_iChV z;bj0>+Vm?(^Ss=5sPU|TJ6?P>by|(lM~S}~le5JCxh^=Ga4ix4od6b)m&!Nf zCm<;1|6YeBT;MACRGZ+HvI(T)pFcAWhCV5X#6Q1@yl3@tcF#qgBptYUv#+?a0i2xr zhI&J4*Yy@KK(LhfZ&`+BR&vv3W@ZWf-_@#n&hNI{z3i2y&51aMgJR5miEw*48Hw9zRE@BWE# z$P`nFx(Z|Nb*FID)~B>tq^;%kQ&#n0?CYvWKGsJoKMtOCIAD{|XUVm&qa+9lrJ1 zpavKIqW583Hd7=M?oWXuucytpgPX3aJpddX%J|$pD-Af&z)H%KcG8za`q_L5 zOr7fy3`E|G7hjgKe-|D~>V^t@0Q%2t#<%QFBh8LTv{%FJ5wA~(Y}GTFBB9KW7ghk0d20_)3ZRa&LvrA0qUk~-3zO9W9Qkw zs<*ycM&t)wY=j?TSQ*Oe`h1V;QHq2)IHwGy;8l@tBR2gCvfWHKi*X6!Esw|tvN;;R z(RkUa{a=H5EN=a7h|_t2{m#^+mb&8Y<|J9tBxX7d3ST`$Wp%zJkmkz%&`+))PuJ5M z%`dvuEigqX4Lv+L`pZH#RXv-@_C=1Ihy^qFO3~755exT9SVSq*N;<+-M3o!%#u}Fp zW;)-D$XgBT!r;(S$ijs_`A;7E`WvGkrZK@1hJl6Z@!O|?p1Nc>!d(GTP~kM%iHn&% zjnS#6$42Hmo;%tK+7xP?T4s49IU{Kj!4OclcfHdKUvo;l;zE>=*I=0(rGFPU#k4Gc zDJwe(15Ohq>XKO5tjkXSB9oclv*!WhsQT~5- z)aJxtC?E|r7t?!4Y{xnucaSRwH+%odNxGzY)bjIp@_}MZy!4-@T5Pp*+Y`98 zwgcv;M?bdGhI*|D_y-~3-?jvCvRTO6i6zyoj{6Nt8jHc=776sK|WA??6 zYt|_bY<_`qZN+tdII=>gd%lCXE=k5ReI^TZU?;!N|W7m2>r%vy*J8l?~a@ z2%;W9Pgn};x{BT3K5Ezk*PCwg;>YK&xij17VpDv}O7d+(>i+u}EE_45jUsq;dU??z zcH*qc^?iI^Sk{*OWBJJu&M^4{>DGQd#lkaKL zP`1|cCrd1EJu0zvO5-FC!+=B!1HV4%J}yVAG#$sWB}cIdOvnpDReV5kihcCOo)08d zQ--Ck9}8kDEepbgk6>ZrBb{5`x41m$1*V@(WdCQfqMEQi%F9F5wiBJBuW4v+9o!Qq zJxDx9JdnR&aKCNeyS_p-$S|-a9dY-qyDI)gbF? z&Y|_+{Ui|7>yJVS?POs~ZD`Spa2fSYzYjjz{xT}YPwFrb?jMA?_}4RoAu?(j#t*7L z%QAV2SXl4u6c<{g^mnnz$i#%h@@qk;_}PC~6vS;H&o_Jl{NI%=h{ko+K34&#ACCkv zD$`%(Vsi7|1u1og*4C5+9@o|S3FR3^o##8VanCO6x;{;d4q|PlQ=4K!BJeJ1J6^fh zB|7nzm)3TUpUwmDYP%*@22LXvJX3Qtw)OCX?qmG%*JMYjvKqUzL?4ejgL0 zq-?hozG))@ucO$w-!wvHHz_Cq37KoS$$j_bBVBMD>ON01IJV?+ z4A~@T@y}qBlhI{GojWt@i5<+OC!V?l7IQG^hTX59>UP@7yxVgi!6&aRw)zE>;{=0? zn`q4M*cuJJdves?L~Sem{355Iu7zVq#8w^;IqLZKq>&S=r!5khfEFA)(VK5gG&YRP zLSy%m)OqXZhGXTZx0)Rs%zan&0sid~8h^3)hvm;u6?1N9XVWDtzO9R>ayK*AI#%6~ zmNYC6^$%D&21RtE!6+WrmY+L=3Aux!+^IAcYK@JEC+0zo3vyy+dP2BpBn&!TuMuKP zK9Q_}A5}>8i=@}X5FqtbCjYe)+h84)=~fp677Yp9O57S}_`E{^AL#UK@fwdmNaM2H z;hUc7RQRFIl~ow0+v4yoA{Mu(nA-i2;gba;GK;b09$w&Od2r8Fns|j|egLuhPMz!> z<228T;CNod?phydj=TOtp;j0L z>{SB!&~(tw=fP_2j}c@fwP67pgq{$l!0Q&Ycu{a_iz%ak^00RuqTw%`+Lr2`)h=%W zJWq%UTK`n-^uEo0EEzbujZej-g?SwAqcnGcc`l|An2;rKGP`OL2XM5QEA2eGs+)|* zYDDC;Ukzz^(N*|Mt2`jq*vN}0R}+K9Y)6fBaLo5Fz_sw5DVAEH!>kC-VAN^dgkPOi za4`}^U_BY}+Uj9l83>iTGOESjw~@4lC$dSa0l3a*76SV9x z!q2jQ#n|%A*#HGqNeKl#U(Q~pu<}i~{mnfEDSh-#xNvaDiiL&6&eqm1QXGZM{5_Mw z8g{;4)lvAhWWvMAu(k%B0foNcdgJa-V29JXX~DVCSo#2G;ye0W@yDmDcZj`udZq=$ zm^2M+wzTO$QnffNqwri6f68C@18osCHArBk1;nPX8alq|+&E!ZVTHAYu%0L|u=tuP z3z{)m+2pQw6=4%N=!OvX4fXv;okZ6y4Wir`kT-LEQ*<(!tE3Z)IN!!~{4o=9icEJi z1qb6MoW-ue_$mwwIuy7d|e4>9<@ERZy^yTi-4+o z?|x{}6ZD$P9*o2iwzM3^hG=xKr(cF`(M2($SY}g+dAT{#)7vDSY9u7waUk=05iIkBf~U0M%H*mXn%56I~vmmS#+3GKeX zRjqeM=?Jrw|7kGaY!SEiV20Pm?k%6A;3i9(3bjtoet1YF=cWwaa8HubKB^|AWsblU zP;qj;%(pR*NHL&{p%(vP7dv$2q@1_bTwOVeXJZ_HdolzK=pT}d$nmxmv{8X-#CFXo zLc`J!-He;4Y;ZTxsEzpIAwe22y?PZy2z=YVWipE9*VUXejPtyO#$0&#oK*lJL5feqF7Dxp4 zks@PfL>id0T4+5>wA6T?mE(k%e7dC#SUmx5fRP7Q_6IA0{-3n zj9x84 zuCAiQRqs%tcDX79&}dWxK6=F}KrVGl$lN?_iT2U--&G$JuAAA>@k9*B4~mAuuKLIM z(mUe}rDtT~Zet?n7UOYqnT#@MM+mds0eRcwPnK+op>fFQUr_qr@AoO!%G`ZG_n+VZSkh+q5 zv1Lvp_MpAj`10I&xugINu$`SquvHz)(NxSdO#%yhej3Cq0fk;yrv`>Qm@;Ccj5H{4 zoaw2%*dXSB7jsV!AaXng`Oq?~)}3*;?G<*Rz{tuB(Pw3n0e$n<3UZlrsRj?^j}h_kBL?M1Uhp;LCTEqaS~QVkQg^55f$r z;aEDJ*SfsJa(ujCXmE^K@4QQ>B6o_kNLlLeG|krzG`f5UGGYnOoGYnH%e&XcusKv% z_O*(Kf%lCJFUWj%WRu7C^;#)ShH&WM{^w1Q;K zIZ+8?WQ@%&Sz9ZC79#bfX7V^>;t|C?tyd0$9|y0YCnI2E&Tx{GR6T3mk?pP2XZ@G? zCoVGq=S)tarj}ar^n5|1-+0nv2Joe+VCs5CxZ)BO?ILOETD*_3rI;_PkFT?AfI3P; zRrM9paxP|q`lLKurQVj7)E^%o;nPv!;mW&cgrm~P$+SFL!4#KiAd-oFU6_|DWtxt+ zvnN^j?7T8ejwZkJ4QYTocnQL!92t9TZ`ai>K}T6!Obll<9Ary0%N6;uq8rIJPGwQj zw?2SHVTCbsd&@N48d8)?R~wX1dj$rk<%q-I#B6co+}Q6zbooPAl>!-0pvgxEbmhn}Vm1@RYR

zfM55wskpu4w*zI4K{mdWqbWryJhRI3+-yxd2JCmwQDW0qf z;zl!={qn(l8)b^F&yljuf!|&LjEsUociLoXq9Wh6ex#pDLKfk}K|?&!9WoMbB%4YY zYRjrC^RHAcak7;yY+-27H8?_a@*+~&hnZ*=E0fn;NC`BhYD>iB?ezpbA#(TnoBa^3 z@`HIE3V!Xxf~)+Ykgy`)7A>eHybN$pW$~JV12>P{*kOR-iD99KEAf=--6fQc$qn!CkvKD` zeMQY;zGfGnUjCD&uo^EKWzssxjHK%Fw+n!2z)}~M$8lJmuCT4$ZH&q|$<;m7+lAJM zB|&YSJ1LjLUoTZmK+mTrGG^mFu}5nFho?vALO3XQl5aAP#k(IYO(3}>O}o&-c-;}z zl*mhjzP(JBCBiSfn%vQ$z*i>r4h;vkp2H(`RJKkLGolRx_EQnUwC1Oaul-UP>>gjx zIzctgg@t*1&?NM!S zU`uf1!0I4D2Izo^vUPA~74`uRHlVm#J&hF3|Iy|N?cG(Z>r~PbHKzc&3M%+I_G)w+ z4DXv@>jxUw#DW=Wv%Y-`*>Z=XiLh|pMxP7?3PUd5yC#G7vF%Rpy29=g0vYc&#;uCF>=TD z3zo=r)zFO*@txDwsG}9^`Z$MnSw&H4UKdP_Jf@<|AKI^4e;!NF9F%#7Bp*Q}--Tzr zmByal6VVJ#Dg;At2vVaCr{9&1T9!0)V5NkO8FfE8*-?uy<8j8^3y2j&6--*_`QwXk z4ZF7|t=k}P(*8dH%|J508M`ZY8)0SRSZXbRo)XE8+()=;?2goobYxXbQ5B9*7HEl^ za(D5bq6u=Ot`$c+BgN3XLFp+Uc_lMsR+b{b@Dc9ZR6}&rEY&V{v-|i6LniUMEP~>_Ko)0X8mX5TYYN{lw*NrE_d_=TqHoQ`_#s z+${{ng%wDOOG0F936_tSQRrcYJ5&cVaWYz4st}nV{qXfbbpeudix8lv3mf-BS^JMs z6Y7J6f`KPM+FO(gCw)trFi`s+-iMx39O{Z=p!1P2>02`5b9%UxE&1uluA9QfL@sox z4RQ}mP}b5x6Y_L)&ykCGG>W*`Y!s&kLi>g}!ZTBlUNMHfr3#plp32MJL`cab*1Jn+ zGDF9AZs4Y=H!8{#p!cB>LerCxSTKma*^*Dz$)piIFSAZyM>{@= z8Avflsimd)bpg&s7}~m{W_Sy^?b1qTQsuu4aIzPW8@oqP+0u`iwt;83y0ss*ougRW zKIS$yoI!e3NV3M{t#Fc#uSvr*&k4Q2 zFk6ZK1Y*F+K!`D+h=9y=ndFJ_L^8eui1V4?d z@iAgx$U>$vz+u4iNz4M?Fp%Pb^Gg6H3zx+${dO)Ry0i~5rTxT%h$(ABY5x>FQu2{f z7{Ga)e~1Ep;0yed5Act&!Td-1{lfs@yX>5de-H@#B1oF<`*iJJLx7*qe|GIhbp97~ z{4@Ih9m?y+?3e)g=k))(bj+^*oE;OhGz_dSk3Wf7y6^b`KfQX6>hK*|eZJ%WV)XvvU4fR@d)Pc}y?A|2bs; zy7sgBGo5ET^!zo(mw7Y&{@y2~`6Ry7?@PWe%~igd?z*~u+xdTyy^VUhS^Hze1LsQw z&ZFZKl=LhkFsBV}@f8G^1fFGsaE%Ef0F6Ot;V9CIn>gV7k8t2G=|Ds;5Z@!^#7;ml z1F&nBE+r(=z&?&ABNhqxw*m%qjVbb0 zxJ}2Gfb>(DVm&WFSD7i$FQWnT5(0KIRO}vRKz>T)ySGz)s7}rW1m5htEZ-MlmhaW{ zEYF`%9qm~=sofFvz}r;Ut3dxeb9vA`rlr7Jl=df-#}DY7S|RW#k=jY^ei4Jg^Jg&i zDFdqeMbhz(Zvk%6B=3jR-`A%91b$xLm|T8DvcvLBq%k)k*=J+;iDO3hvk8%04xmkP z{}Yn)AJg$4Xspd>%>SK!U!B~2mCS(a-$iyEGZ++V1G*2(?$s_)9AVv0Wv9F z*F4}!#_xNc!2d~LYeT@QmO#Ku0>cc_zmo9$fQ%7SRF((xc-g)GmPBI{8LYH^G9q;CA1EyYapu{wJikx*aGo&zW_f*&e*cL0zft*eWH3ckmmg4i zrmR1tvK_jqJp}&uXcFK-pd3m-|07u){x_v#_4+=|^#6(FMRoWmI{y!$Ko+%Af%=W* z{g0GaP#+-9lX{*^Ay^$Qz4sq8C80F`EUOdqY?(3pzO22hj?8$oHn4J7xnIP)`Zh81 z3g0Ff%pNA7Ah2*JP&TDD;JmJ$$)@)%j}pjll7}I!R}$Q!rH)HN6gXGDO0RK-?PG;PGNybK%>(lf(xowB_S%nb4^8q+EQ&Nm1Q z{%IV(# zA0f$^C&{TQwX>hv??q`?`&r&hUf&^o^di0SrE)b$hi=pHhg83RVRfQ9Cz6h|)5Or2 z`jTyGa-n|qq}{l{kEkD&s9%{!X+`y8 za;`+}e}nqQh3@D2n(p-`{bM@G(yEZ&{+uSIc67~;@?$Gk?^FE@na3RZ{Q%n37<;iCIZ&F=z>Dq7TH&aHY?pfrM!x$j#gx-`r9H}(kaRgfbat&~@XPxpi=_#Y} zbfG$x(Rq0SffTxz0Zt~>KbXeVgYr$L_QaD;v1QjJDx;KS%9doJlw{+tGFfNsXI`x$ zm6t;4e?n!lrBb%y@qpwaj_zUKEik6vY~>@2$}A^YW#HAjNO{vFB9!Dbi@fPZs<#8l zIrDZ|ds*EzN!G$ie~szBa7r6MePU1g^uOtPBIQ>}^(vtZ?LZlSBQVOYJnLeB-EHYyy%_dD+qR464&T8Y^2Gp8)Ek zYU&@h`?!qmH)Q=m<7H0i^C_Jdm61rc!<~M2la5q8M{O( zCzbf^OJhRJmV1P4BIEWqs$U{0wj3F)1TuheWH=f~>7pnf z2b!%uB(Mr1Bk+C7hk3DoA_JO93i@Yi8=Gx2F#RWLhau&aMd$O$fUp^V3YGINc{_fj z#JbcM|0ktMq`V)<`tA}qnSo-S#v7DxAzl9kdEI{@FioM~tei)b$N!-I38OrdC@;3O z`+t!4>`BKgwth18$^R0Qr$ELdiu(4_U|y$i-*&#-!17NtHov2ZkSq018gV9#u%&KZ%>7f|0NQ9ss@p^sy-Lvp|#L&Q+Ozeh5}y!Y?Wn6tiiAo*d-?`&!F zA4wMeK;sop`LVPu1T+x@2wnt)A5pqwlGp#+g~o(ro~@+(=n8OVkX-zl>i9n>A78rH zkvy*dFXb0VzuEKCXd1)+O84r}e-^DTo6`S`#`~{KCI~E2DUBNG#Q&o9WDw}wWUCA^ zualK=mw+mT+VM*&lhvOY+1oU!W3m!K^$Mjt#%LmuK>4N-kVR6x8EAdqozgLYrF03D zj;-2os~5!VKU@ASC;crV-6$nJN~Zfw$m3(c8Ax?vdAm|MAF(!4`AjBNsO`~|Un7-Q zLhXyEvLmRhLeeumno$2YsyCaIL{lB?=sxBN$58qlO7|h<``@Wwm}mYs>gyQR*Hli+ z3=l%&=0X1AgJbX}qD$uyRnh~u#2RFlHa-KK%-~y+&@}%;`9cl)!+}Ud{rUm!v=dIJ-hKY*L=L2~60R z$`}C2(QMJ56vmW<-;5L{gh2ZH1SGMfAmMbJM+*IWy5E!(H;X9|G4nWC-oGH@=|pv7 z0QN&NHVLHoEE4#gcLf5W~s@PkB|((W17JyQ8_=S zGMLf)DJf?NrS+$JvUrno($|mI>+k9 zo^kq-QoB(;>>1MUsedvlUlpqJW6C3mJOM8k6FIpUm@Dq=}9dfy_V9*qBg%@^;s&(%tzF} z0o1R-G-i2p?N^k}j;^y+kPQ0&XG)hz-#jGDGW$xoc&2w-llQRrF{QJGUrDB69_ynmulamu`Hx~{>1Vn7SQ-blYIV)#y6eP zGH*4V^7%cr$CAdCO(IiBMwF<|>XZ+g7{-wtsM7IIi1Vr38&{U+e?mI<{buDGQN38**b*xH z7PcPA`}e7jm>#pbd6M_YRsdKXqv+U*K=GH)$8cOQJTjve>=?c>-J3 zCt-9fB%AS9Vm8?fr9Ko>J^q2}8%g=|zV&aq{1jjx7@Z#I(hYq)rom%#abG6-5Ez-;r(PwDr+lVXIDqP$7K#b%1^q5f~k z3uVhff1&~ZBPsjO2=v_PScTHEJeVM`C86Jva2Jq*JS1iM3jr8=#^X_Z|#7w9j?@}4n1o-+?U$#WY>dd?irpyJT z#4Ih_IcZG_&qDUHv}~uXFRMElwO^5e$e}#hrl~3dd1icBKFpJ`V#|V5uOb5Ubo#AJ zhNq5>+0vgJ8HryIh_mIc6uLe{ZFrN6SrA=gAyK`^pvaM-@TI!5jZ13OE;l;&6EgI# ztH;S!1ekY{MB|W4eU?qK@qpydj{xXTB(px$$L~@fI?>o@kkR)dfGDK2>@%xABs*+* zl|4rcCOKfw>JA^G!DVk*LO)?vZ;(hI@tC7B}w{v$faCQE-HSt}>`D5ZRgNOmk~yh3PvnQVB_y=;?_G09FEjd44vCwtDy zHrq7)|J!@(=QxtJ-}8^S5xYO!A9nY~#>U3(-gw`8?s*TNIXvi@@r)T|u_fCA%L0p8 zEoKG_EZLT2fyH1kGg!>b%=q1Ws=MrVPn%|JzmlC##8>LB&Z^3+%F0hZNyY9rd2B!4 zW#?h>AgKQjCYsCl1xvRp1I;zr^F-$%K&P`b5Ln4$wP*RtgB>@3=?C^a5wIx^sq8mH zb`DB6J-_GKb4=YS6ep^Xea6yH>CvP7%$}A1N#JBsVK7dkXNBcw;hABT0aI2P&1T-9 z4}-5SRc>W@(up1aJC^PYmWBcrmin1J*tMnS|Nmoo+>6}{8@5jty9VCuzl0r!`ioQ9 zv2xk94P(ckeqU-{&SLvl(sg6;%#xkUi~arutAyvU{fk(5-9!dyb}ua1vq57TBv`kBPf&$h|_ z(?c!v3(9SK7KUoK1Y6nu^j!=?Aowi<4sH82E5!cD9yl6VOW`TZAK3TbGFZ~SFPxu! zCNJc7B_oy<8ab>WqiFy%+Ln$b zOpB2_o)A~r=TBKwVWNBUCw5JL!@d(tpIsx_J)!SHUSa>mdnkUVJVXC~%kGCbLYd|Q zQ$G4V-6z?#r$J%Ap?k+f;l%yv9CTlP&$iR~#r!OumqyM~KB4o{9A}Cv9rM4l`~7F; zy-65!16iS1%D`sGp#R_4cFMmLNBOh}$7B0bdT%fQf6tytIxlUf{7HFMcuv?hu_>1% z} z|L@)qhOi5ZAjtj;pV>_nKfi37vM`F<>6qei#i8c%pOt-=-$!2ZzYF`kSX~Mviq&U?mbPH zQW}=)la|I~Y4_91jDzz7f^%nQ2hPsUFf}z5-b8P0Z7s;g#tye{+v3)(D=01XmxboW zjT<*^htW7VKd{G1Zw((97(h);jZAf@tu4jKNGD5Z08&z}%R+PG#*G`d!)P3w9}t{$ zK6(vJad9#3-Ah1GQ3+E8;^K^1V%*q`XkrOXmxTsq+OptoX9EXkCpbFV!NxTNb)y@y zU*FR9W>HyEhwGy%EG{mJ=U`zV- zo!MenF8qAl(W>~O{q-q44zq!+odcX)9AV4yW(cif@w03nqn(YYZk>>Qe+ygbLWGkI zdp2xQ(77nv$n8@w4$cn@PP&kJd3o&rDDyH0FflQWuC7NYE3;<_t9t>QOG9-?ijRWc zm*3;Ostw{EW@BVc_TwvU29NG$Vqjrc_MO>Q3ruw#P|~+5e4Xm5K{_opB4-nAC3rv+ zg+fKNeuDTzny_s zTpV&*-|VH-y)}7AexdVf7x{NwVL@|c$acn&neqgKOY#|f6!&7YF}^PQO13|SyQZeF zb-RN&e+!u2^v8qj0+xQccq+9Olw{?hW#ng8fVmwC`_SM_s+&ey!<3->?hWYK_))gNhmLOL}_WgkWfV{arH-BO26=VtnVrE9z1Gp) zF@Tk|RkW2QA?9upYMat<@$biAbHDL9xVGD1XX1g1K`D6`M%q!;IKj%GPTY%$L2`LL zQrxfN@84UYbNcy1-IePH4gFBrH(+(53ni7^IKU2?bCcN3ip2fwN({0JKwC{I9>j#> zer_!mmS#{_)rjtaQPdYwxF{6U+I7rE8w(J@ZgT9sZ1gX@Yd?kC`?jaW_n`Id6$Fl!i0Dr>v*-MAkSj;Q23%mx{x3P;Sta*U3bLF=nCu=9z8k?L_=vQELGLM?1>vI1@z(d-Fe zwmFT;f(+bcdAW$zw_~<2K7iig6|7G;AvQV&88r=vvAl#YF1Rx=iY+g@C{FN$Q&^Sk z>ny4(TCuRQg!(7<5OY5b_0;g_mLrwlRms+IkGmY+`M^ z1#v9>cVd#!)Hj5_u0E7zL?Ar!F8bz{(B0UKmaZW@ZKy$Nd^n<$3$RSbSQ|!aR0JZT zVo=aD{QO+p4xK52le*uiY^VRCI5^)CIJdU8SR@BfSXhdnfMf8G{8!``|5wDu{Tj8k zekd-kRRYc}WZJnQl$Nozo`yb- ze{&ob(bWuZG84f$B&{~L=S9KNI}wR?rcl+<#1$1o=wJB}|2k=jX1S{M?$Q9_U9aNo z1#Osmr(tBc1m>1;s4EP>^(#7%NG$Q~DSddj7_)O;gon2TS9OgM8WRtRlNW4mT) zfrP9lEWhZ$$X)`ATQ}h4;D*cJpTkWXKloUxLPO6I)>qY`mym~sqzGu9I15#ktMI#D zh1_smXk2%Ok(M@$d|aUM<#AjybHddN$8h%ceatEJGR$}9!v1nF$j9qQa=~|>UxFUx zHqe=Zfp+ zeuSQ-16<5BVdHfNe(t{Ta4^GwFx*%;dkb^itsoFDz~9CN4z^ZskV%ODI6<{c!lwLaWbA2F~zm z>DR4RIN1asD<=(BYHBcYk3nfk2JBt#pm*t~KHzM39f}e>p=aa>i6?tDoE>3GZ(d+F zQ1Spywk|L>bw$S}+pt{2o{+ySgt29iH2sqWFtdnf{y4Y8 zY9csCMn(kixVX5$$jC^TF=1k20y8r+G&VM3baeF70%v7;sSvsRp3Qdx&ehdbR903B zF8t)=1ZsN*5L#Z0K)+d3SC2DQAt~u0GBYz}dx*A$bSq~B#nIr0F;;8!M9t^`9yq!p zI+qHQUYHqLu3~74}oYuFpf zgchsB%=`j4@A;BjS4o`l@052 z0bskJDJ2N@!4;V5NyqIQ@q%Yq5$DD#l5xmQN=IvZ1su z8x~exm|;J(=f=X(#tCM&kr-h0)s2B%SerV+$=L%gPR_8VcZ@MBy%z)r*FZQ}SfHAb zbE_{M#^xNHhuIXtnUs`-n3x#E#l;CCcoCQgNF1EM0GxCl8c`b(5`u>hA0jn58QE#+ z$jN?$)YL~vPtQP9R22Ixt%W|fZ4`I}B9`9sgGmHB2cl|X2Md)Cq4wi(oM*uMMoogU z!gLs&{}N{|>)=jSCIW6~LE~DKv<6GIKM0BDX?*kJ8Js_V9>*_hz$3H(dEsXG*Y_8o zW8;V1tSDUgvkD&6kBd8DxFHofD&Meu&fd%;O?1@+38BS>uck>&Sm`W8*O;8 zbOppWvVHcDcQ*^S@FaKacYoXK_(42(|eSp>y(IICohe@%fo>Q&q*a+li13 zB*yOi0IM*n;N;o!IQNY%Vp*j)Av_YP1~>o&5*?b^Q*=N#%ApO%a@7VPSA{b7SS5 z7d$;Z;qC1$z=?k6;QWP6wPXaw#Kc4)QHqL>k4HnpPuF?c+up&>E)4`azz&PE@R31n zadsS|W0P1~lh%ZH*5+8^r=-&YHkL6nz4Ux=5ZiZaZ4r~>V?y)6#OwmLg&%h@Gr=y{ ziu4#OGc#D;cyScQ*5U-)XAFyL(t>Mia|cuH_~s#-PvIm zn8jK4e|L}S|NGe9+QHgXClY+zVP$>|$5afF(j)a|xg8zb-=+I1mq+$@pFLF4v8cP4 z9vj8@tQ0eQv|ZN9xiT}3u_+Nh!0N&z#;4|G`yF6zg5}M5DKaRpQ`R}yS;rg;vndVq z%ntVVu+8$Kkh>^OV*cA&z!=Nplk+Rs7xvl06wCK>>-0N&Zl-6ky8Rr&2fLe?pP3Y% zi_wXxXV25t$_#s+W`x#}efI3k&aOy3Owo2%FwW9BHX%*VKFjYr>*L4`_lKR88P1)( z4Av$IoJr?$GfnyD7GwH4^;X=m=fD^gOlWTCln z$}fB%ii7hVfs@WRH8mwnOQAOLf`TVZC5VeNWeM?TH=>axG({Gg1}!Y0qoMv=Y=`~_PdsE{5v z=nlH)*D=!FgNYZG+4~u`HH{~^B^X+HRo>l1&(jW!%)UiJxE(rE1n0}d!TFBBNi~t& z++6ha4Pb1H`ZecR0`8-<)Q%;LmfU;3R_)$u9c;d_MT6`aD-ZC5gH4t&ituf0aj+7u z8iug<@xm=NO}GU=LTX_>7M@Q_dqZ15-s1xF&HlV0J!?<%aN~+Dti8P8a6=o$ZfSV& z3NhQL!!2DGG}GifZimvQ+Y8{JW(Zf7pY$%OBQUi?_RG7qy{UX$`r;HU+`NQg{y}jp zzq}FKW>Jz;fM`EwSo##pwmrA??gAKH(}bA^JFc@nEcJAtp(8QY1-GTZK9(B z8AU%`@oKT$2gg494Q%q1RS6f6lU9n^)gky<+2KLW+sx7&M|x^G7B}Wlo?C>DvDYnF zJ%^mfC74{AM}1K-8pYN4xxF*{(BM2Wi@d)taMFdOwQ7flCsADN#ef;lBL7%et5&+m z`|~CD_SPEVaz=t?*@Uj@@IZLG7h`_*DKay%&@du>AjY3oB0W7FP5pDs8)Y@x);bjB zmSbEPeh&syc;X_9M;ZNK1Q+yvkNgE-YiDw*$r5tN>x(iK~L}&S(M5ZIfi*q_!|IgxbPP6t{GtucZ=C%IZMVJ13qN z3i&iMzYO!6t7xxlKvJYP9D~bcdy2M=0zYdw#Z}6_Gt3N@z{$cD(J4i!6BdhKLtTCb z(ld%Nv$=zn#T9n0a-_58q`r3qS^kDNcEJN9OY$|(J(R~rARx#Eo?h8l-dGox&zG*0%`H#m;O$veVL#Q{5(vOrMmcKdZ1D!(-*pICci!DK%(mY{Br{Hn!&a zkeQx_QelqvF2;w((Nggkk27*Hw#rBFzO8X^en4>2;2$7H7s-ji zIQ_35U}7JPmU$_*_Lh1P?WBz>8YXZI&BfwEJ#4LG(NY@^Bb5sG zJp&6{6I@c!MqJ!mw)Y&uoZaB&Y=hHZpM#ZyH$1HMp=)FcU5#r9 zNbh>qqOw0z0*$Yae3KE0}b z8Qyo25a8wmR~HvZ!k+_DYNPP6kszf`{@I*Hq{JOAF0OD1FG5>>Fm7nwfawh#xP&Dk z%w7*CPN~D(L?0SAZDFZ(5`X^M2=!yn*K}rXEFz;LP|?tZ7*BB}FxiCHPBeacf;ucGbaX=YgY~d}9gYyG|lOjkFU0Yj6No58i z?)?_lY2Tr^A(x$V0FjY*URXJ3Z>_`S_iOmw zACBS1bzL0)<}{3No5RRXalKn+2XiP)djKl~Q`iQCz|GAc5<5$TWDe7hxa;Y|zTd`8 zhh!mm-Ge~5M^|I2JsY>LUWfYG<50il40oTq=ouYEoVN$=mQerEC<5%=A+fcBQ&=rF zCv))4|NS3Oy>T6vPqTQrW=I!g*zbbP<=e=Yy`6=T6d7(37+p7j&g~H4!JTbLhV^ZG zIC$Mf!MzYjy#0{)AOf~`XhkA!hsw6ckeeD0lN)C6hz!S-KmQS@b*@8O28wh)ljO64Llvd@z!NdXOePc-Vks!XX3sq@%;FnN~@s{;+a+09xK-q&gWc_Fi!IjK|RI2qLX- zBD9cFxd=adPx#vEVD2nk_`WeU0Jp83VRF+BZB(wz z6~pjmr1J3w++J$DkMje8lg>errg=RJ3-f3goIqfCE?nKGQCq(tT-f{f@4vWK?e-Lc z4b>qmNy{uX%nc49nJCRDKvQKJEUu`q2S67Fw((eF>1fS+f_stPxb2$7e1PXR)LMoL zTJwzA(}#i3(KLpwR~Y=9E#UW%*1+9GoSPS19G&45ByHNtzY_#WU>F=OSfG4z6C=gZ z&^NV%jeQ8(r$+IB6(I3N^tesJ#oPuqP7?UUHDICrAyiM?MEmk4#+xdTU(_KqCDA#G zJxpQZ_eA)H=_(i-*dX-bJ=i-u65`vL9}jygXIR+Z!N_aom`4OC*+!6nTns6r(z#!&i&yE`*|1yMql&AT@DW(pyGc)MQ zh=z&YS*TvUC*=K^iUizb6+&x=2=q@4BGSbhsdeOw_QBo83x3u{&@l|a9D9blii?pP z>yKLwDT3$SS-_qN3rAQu#$aM$0O8Kw@N#p6rAvbF`~LI*>Wc2c_ea4v7@A0zE#&s*#=-dk!ATd9 z5=L)8$;!w;es&(76l5YRD;+sGxx(VWFT5S)U>|*DAuv=|g}VABXuHIswYw7$*UsR3 zRc+=S#-gLW4nemxp`opfYkFR|pBN20&rBJtq&8HS0_`i`vSX;>lDZ4B>a*eE^ZYH8!L=lgQe?d7RH4jFs=xXU2fq#JNCt6f5#c;U<4XpgZ9l>H0H%a z>%>W@Yn{c{=S|@6=L7FMbvW3YLw0}>E~#nb@&$d|E9rl>OxgZS4?GODa7JAnmrh(k zXnH&5`wC!TbzgX>yNePbad3ydV>qaYZSYaSH`hX?9xJy)Vho(6aZtN-oaHAKT-K7H zYG?va(_Nr`RvTB&Y9KhZ0|VXnVR+&q3v(9wwy~(rc?^ToKeF%V@%brz`1<=n5>Uhn z|20&^S>nn?mS4_kBQ&j3=vyZ{n5}^3mtW!R6?L|sI<6aQLq*FAZ3F#C3=Bkic_)e= zMj|A>2q}&?ap9^q&VTh!T(ELOfKL#-T-{k^t`;j(ElBjwd*;dR&-Eb0S{o--*>NxZ z$ROehd)r|6c`$HBlwqVZ9)_n?nD?v-cmD(g`1&KEfcgff5F+tMB&#f({<9j=TBNmy zgRMUJ>KG!eNA}chbwYCOIxc;C7Ux*JPn|joBhM&!8(hP!o33#7@<&D;y$r1%5~~o@ z_B7zG{WYkt=S=geGZG)&g|*8g;Ti6Jav!d~k#N-1hPkCDoV>zO+T4U>j~h74j(zT; zIuf!f@X*Ep7g_o*eEoNvcMXN#Ej<|OF^}6n1i57mNcGajx98Mx(by9;PfOrp8Hzzx zLs{#|#%;^H9Gq`y9Go8roTAY*l-Sr_Kg5@50O~yH<1K=;@kdFxQ+A%u0h>g`% zEX(%A_6j=KJ{?0!rUGovpoPVwtw*+y{O$%8W%1qJT4(oQMbL0t9!xLaLR$TpG#s}> zW%EOAEI+Y4I4L&0Z)2d9<&)0gXO*^@z78SZ&d9RG!~n~K&8-+5pBM7i@`|iy?O+qV zElp_c8GA9`9&BTJxJSr;ly_U(J25)7jJ>^G_6)9KV`~SS>#JDbJiy+@BwB?qJ(yiu z5#C0$!t&AT`VMA?D-rFNFMZ*)Xq&Ur}=E+ZvqQ7qp^DAr8is;4yp0e=m zgRz1Bthn?Vng>Pfmcz}7Obo@nj-d%PATBmnuX-$X&w>LKq z&JPUE!(^ki8Iai6!p_bf4~q}i>%BVj!r>5|_hMnkjT<*^hrl>EKOi`1ty=LMiu=&E z6;_*MLAY__#*Nz{HV)1Y2u_-gLT?JEw}e|+S;5lMQV@N=9&CJW7t8#iv;4x@2!eqfJt zc6L^X_`Q4gke8RwRD}3=OLTTdvKv7w2PMiv12Y4i7?Qp8cWts44XvX>C;razFxs0s zu%fg_e-E?cBN&@`-LhQo!FHC=Sl5Qxtyi@-Z)0?D7_+h$XLCE6Hq?*{dLesec`G*e zcQHKh=I>;EnXOL^qPBHVZjjAS?O<~reSH&nWftSc?L8X@=LZBQolm+}Z4Luv7skdW zFflR55)q5iQd^cVS~(~~78SYQ#g*ut5@*Xjx7mRvl+=!5bE%u%Wa*N7Z(}Q!zWDO9Kf$$}M(!%w0!j+% zv9LY>Un@tXG`z(C`29%~<~L$>i`|zeZYFLt&@kegkL#aEG> z+b3xpoF5pRbRqNe3otS=i?Xs{R8}OTrzcD4TD2Q3cX7cW3Jd#F2r@9mH4_6A4sM_> z(FHf7+gONg^fcC@u5m~hy1u@?grUw#NQ`g6Kb;n#UO{_9CziGkurkw)`nqO}&$qz* zvMOAX+Oe@Vi;l(`)YQ~tV0sRv(N;LE6@sCWE>zXgDlfoTX9H^MJFw0Q55Z#|>qkRP z4LVu;U$g^M#RS6L(+Y0>#n{~2WH&%I)P83T<2@O;a#9zm6=eu<4?x`GB6i+7j0o$O zvY1Zxp_U!DcU)R(F3!xLyR`=O?R{7nEx@JYSCQJ#g~r-uOtO-1e|1`jM{}QaTFd-U zv+%06hPE!u&s9U`lqRAJThZFsjG?)0?5$0szP1KkLsYOIU~!(V6-#@43znYGu;=y~ zJJ{ZY_YET?cFU?&>*J_@91KI#P!!fRVsK_ldac>LXz891^5ycvGKRaP*Lr5D6Ba6} za7<`?v0}D2kB2U%u=VssYHmM!hE}k+BAxEBwla^JBq#iE(GzW5d9W}GLsd%+Y8%=h zeG$nXhMqQ{hUJZgtv&2)@3MT_C&Zy=d99OBAp(> z?UOPN&JPIA-Q8W`1*ds=g@}$;g|GL&F;D8(NPO^j22K~IrWe3@u+a`Tbx+hcB*P){ z4x$t8BPq2386oDl*R_VBbQ_%dUKQuQRz(Q&tP-3}apA;qeE#J*ggj|RRkRDP-taU17oR zvHB$FoIi)Z{_!)IhbAJxS|1lLsX$BXJT&a?W3aCmk=ECtZ)k`c<{>C3NQBmjGte{C z!UZ)AI5^tkpTGGF?C#u0fbSiYwbkQ+vkoq3vEMJM;$ChyYLXps^QIxRb=6_#?1Jz9 z@Fy7h#vv>y61kOic<8EzA1-O(^?_e9FP>6GTscmiS;HE`3 zrsbMS52nlDVD17puV7@9wje*u3L5NQYF~FiMoBI#R4+mMni@1!PUE(d2QL2gclh4) z{tJ`tH+xgzo!X3%!UP1xCLkpt3SP0z?3Zmk3UR~bZ~uy4{pAW0a~?qd+6Tz%5e*Pa4Xl~YhVe;U_(?xQR} z3KzdU&7K>UpDyYkjlat0lQRy^4+u_zCcVUZetrSD1<{Cz`F|kE{R8qUV=*(+#b6ru z!dkW1UqgPJEv)U`@F1@Ot%d3EcXx#Cjd1iXwz2}@HtNZN8cBzNnG>8%t&mhXgt~ZJ z{OVW#hJR@VNEdIOsKl+Wj>CXKr#w3k9v%TGc*>BrKZ|4^d+6({+Qrqm$f%Z3l#OVu{@!4OF z!6`Td)=m$EX0gHY2XM0UfTKq|hUbP6YIY5Q`LuG%G`ws*5$JdmfBWs{xS_9)<6nFa zedC+Z(DRc*x8ebdiv;!_iI`sOL9nwYJY4Nz>Gp_Di-VZ~v^5W6v@rwbH}s*#3R5jJ z2_#-|=${-w9Lrd4EUxB`cZKk!_dH>4FTt(rx6ve=AQuL=?(mgU-p~k~Mi!YbfD^Oj zaI#?e&&?0P-V*%y+do3hKp&S+9E0YKo6yv@fUv^cd^zkWpSlGhuldE*QJZ3o@c9=f zarxAj_|qAE_y+jGE54QevWW-2zHoE*f^%>gwib$^d)XA-)B@6%4I5iOIBOoq-%qGP z|Aq>_Id+*jz0t2{x8%;Ar6~yuctRomyaK;bLtEiM<*0tR4vam$UsOk}l}IrpA(?mfKF4LQGp zp6+hAZ*9Vt&u!ac?pEDd8Fk@nYrJ+x`3VU>aLK896drqvf0xPkna#XJ&4?Xx!KQb^)x*IUoXGnmrwGuk8Fo^~wCHYXYwEL#O|}Ff7TZ;p$mA$Rc+)9I zOBAt)|L1RCC>ET8^_$k>IRnPC_Yab3wn%85H~d`&UON8riijGxH(2cl7xQZTINjb4 z3&@>x9yQ4zkEeCwW64zWwZNl%BHJ-5O%Cwo*08-bV1gy|W!&JJN;_$>brT3L_m$&4 z2}d74nr{w0nelO-xAq{B&Dk3tS9gEwzK1L0rp11`TqoTm!uEX6zdCC3O-?CWj#}8m zTjXp}%a~Qxgl#-#z(-0{Vx{+xSx+2H8PBZc+Jr;T#qr3w=ZZ;XKpU?_)kh$y#j- zQK!Qm5>R;6Rz|eM%UXSY48QpB`GKl%dK-MnNIZfQKh8;G;_KHIW5PFBto_8~Bu7bp zYNXKvE>#EsEQCKfKF*zh8S3j(e9l&GWSM~NP&$@2(_j+X7hW`m)lINOwO#yWs*WPx z2MM-a3RFaCE)I@RdnSm3{R+w|l6tWODhvR&q}n zrXEIqFMbOU5b&H9KSfLGx6hDSiif4vrgO|2GM-^D4F$^))2E`DG9a>xB9EC-uRT(D z7rhX)u~KP_he>aTc-6%*A8)hZ2P` z@&WHDMIvX(8(w{#^hEwym0~x#sRafz=GfamNhC%dy!2rIhOW{#GYZFV`fK6F_MMx$o{jBT#y*7OCq8%gWc(rzL z`86cm)!X8W)Zrh(WU109GG?SJur>-V?LTz!CNAH+tZZs;aAXx~#tUuSVbjhX8~Mrv z5I1?4xzN~s|2DpY0u>?XsFFH9*6#=&7Rx*^B@?Sb+U}uA-k8I_bj%|eu)Q@hn!zC} z&FaKoCMqu3xp)~s9x&QIa%M%rS;Z;ptEr;Cd~d$dk9caL#+EKSws}HhI+&5nd+6rD zi)WN1KT4b?2w`4Yx|q8s%@%YO<>fbi6REE61X+3s7d?K&)>n%Rv{Go7i0i1JXEGme zLJi2j#8_1K_VzlHrSfZGWJyU$solW)b#1lqUsZPR$hgmMR^E}1S~Zz*NslyL*VxN<1>*-78ux%CcqGxW#*o=PQZV=z&9a>D% zpq{S1kI!v^Lr34+tJ@YC5;rSR)k&@aN%c&illpWq>89AIswWevb#|KRHm1(qVltqX z#YZHTTbb*uk800+?D|dp=Qt*(7)BqO#MHg!Oc)j zGJl=*pcs>RZ%}X8HhFa}ao?imq^iSCO{OEbx>hYVtjQgItRHh|h5q^zSBpr=)1MW0 z%t1_w``%x3W|*gWVx!gHthVwY|Y91Z^$=3&nN6Tqm~tPj&T7VqC<9{+9!$Uv|Hx zezedTD;60E=eTkrKsHU5R<2XX)#pf2NTg@oI!RSjBr+0twVjrCMUsGP>G+jW znUt(JmzP$q->uhMpljb)U*}6G)6%vKCTafZVpV7hj^u!nxp;?}B42oMsoyyS}KSCEr!xuFgnT<4-a(GmG*$a~Q)NUDDerx$}=)3%8Jn zh+TM^iDWJ}pZlh=_ra(c5T>rVh1ZSwK^SN#V`gfK^KFDjM-vx(x@0moGmA+~Ow5}% za{Lb^bqkw^?VqOUbbr%#Kz~CL*jYofN@|x$E@_I51MI?JXT-_5xvVQIE1za&ZsCeL z$Hv7;?{hWa1SEY`hzQ5Fq%mF#G$l(D{^6MyLG(!`xQ@VBh$Xc437+n6fQFz)7(Oa1 zE33D^zoVlgLcf9CG5JLM5|_6Ub@@*{>>7k$UKfz9_e>S}5%Zy@752-V_G*T9x;|GY zGJet=(T2fj$piRTlB(CcCJz-rAe9$<|7enoofH0`#iU5*2dBB-;>&t8*F97BAU`2a zp7DdPsStkG_Fc!GQ|VxZrR~p4y_tA~W9yZ4R&6Sw7XT(U)~?gQ=3{x?fENM1{>Iz710+ zmj^1S*eHe;1^7(MR5~18wRQ_-JlbSUQoCO6>H8{i8>84%_F` z>!ie)88V_!PzXCavqS!)9%iOazRazpdr?U}PgxdT(#G9d6RY@zMqj#U8>*nU%Ycex%41Wk zj>oUCP`7n)q=0?6;Ir?6yeU;voOF=W9aix_FgnE5w|P@XBYi6=*~T;;e+_-}q;{F? z{PkL@B1leC?vz)6LaM* z7XA8!mxe~nB;STI-R54h zqvs{{0w`x@+o(NOq@%2r%=gCyRbPIi-gLa$wZ#uG4u5}ZG`sz$T;tbh`!CPo<(S=8 zc$BjYIa{Fe#WqoCZX4nG3t6wKYPk9}uHmL|@+b+3v&IdAh$qWtd2g`r=-XdT?-tnK z;4=+C<-Iu}(!K2bvBZ-1x+_rcRI94 z_1m;XJNij&mXZJByF*$}sk78~PxlJZDvF9uWT2%53HB9Tn{h7_kXCym{A1C5YBgp&S}r4`Tmmqufv-H6lctSOHqmJ}Z`abamj zClsPKezC1|t5-XK@+;nw2)XAquIW*zRo<&eM9e!c1fY0>jtWUF^g{2%LR< z?pz~d1|I>~X60f%&Q|ks@hjKvKcMx*J#8`FmcV@s=F~Y4YD(URlru>x(l8}fuh-fe z7#Qqs*V?}aI0pwedR>sB&}ejNMFqoxNB@<5I_lF5N%r@ciajJ65xP*f?i#w_dyIAk zDTF5bJ2(_AK@1AQCR8`px3~ZF-8136Hh2|JOC2#kk4(1R-`SsY1JP0WANgS1X+3Y> zzEzUG5OZ~KSO%XMWi1e*!o$Or#yuZBDqb3;fzr~_Ca0uCBqUI-tgZ1AIpYrS1qTPi zpPSw0P^G8)XG$x$%ejekXOsUK(Jcj|_kfbTyhXiFS+8EbxK7HJG+{DVT@n-&RC(~= z7Op-ap%<=xEkDr@T=|-RHh60E>((btUua}R1T_Q0aUMW71=_J;vb3FR-mx&rFE#le zGoBYK*@?;sM-mgq#j}sNe8a`n=9`{UX=-YA%$pH7TU)as5D0y1YvC72VhbSD^@X9Q z=lebRvC+{{oc&?}vC%NTQ8;D{KQQ=4hsaSMnU{t~-@IB42v?kxtW|J!qwM6$a*fG# ztFqG7CdSGXaps{R?6S4eZR8ozkIBjOy+|LgvpZf-?g7B6XU~6A@1#?5v>IDS?wTWd zE{Dws;-?Id)qc&o{fP(i=s$niO(AVgF9yd z^BB#3>^p6(;}*;L;Y{(^nqXpgM&jR3e~y2{m#&f1{@|2&0@PdwB&uTO`+wP^{l?o zf$ffCWgx301lF@vybawo+89z-NBsV)k9e)e>v(efzj(V)q1zFKJwT;tJUAojL)9_1 zZ-8GQ*E|tJHT`N62w$k{SB@Yr`Ove&i|_+tfb)}+_$6arble5c6)ngRb&OU2*e@A~ z?3eS2vg$s&~yed@(WaYr7>7D=$EC;9DF< zh!$jhkE~v9)`P?YrbJ%V)*JUfmldR0K82yTr*|#-znpWT1$7aIb&GZ>)ldOsb?7S3 zGPT$SqMtrBJ^fxzgi>hEipQ7)of`&?K6debS`}u*!gR>*HHIarIZfh%y4sE~MqYH9vhPNO`@`9i1`RuxiGou|UW z0i=z+ArYJ&s5sB@oLW5=Y)>oXt(H{}ks3$5r{#VExk*V=QrO(*^URY{*X@MoHc}S$ zMCfDv%34Yj>g8t~@$=3y#RP@o}LxK=YB4^7X$!l}imLHLH$C@7Bc zA6*xi;MD3s2#xm(6>SdrUVzc|INd!RV0LFtMo`XsHw?Y{L~CD}A^~)RDm2-%B8{Cx zg%z!02Sn9K0EG-xo(O+zS~(u$<0<^uJf*4p!j-R5POk4IMrEuQtW_g--*un=Azjcb z1Xq54yfEmWjx)?F1~Ptwuy~qq^tv6*-A;L(AQyyAO((140P0!nw+I!c; z$iSLRw@|3|!0?$!IC9?H$GK~5)+{JjVocM$IxPk)IY%Ss%BmRjB4s^-T1E90Lezv8 zSb4pVQMW{_HktoL#**w;f~b%UihuIM?|0G$=^4R!Ul#M+Y#E#jc_3b1{dZ_80y%F$ z&UcgAaB>(THPt$}Rh$g7M+&LFrs0&DGn^CuO77yr&yz``%XlBo_mD1y)Tq(CUxo2% z86LlN)p3jiVL|$c1s>^#`=3C#v-@-f5UEj`B)S$IEW$SU{?cCI7YRI06!e9DC5Tt*DP1ivP?x_9R~_R@mR8%Xz$7f{q=k#Syr% z$`d?J%JZAoGAJ;m$x2_J!*62jk#W$AvHqJ}ICYJw7Q}NCq+QD~o^1Y?mO`VGC>hvE z0nC)}Ne{&B*<1Bb@~7ose+o<@I(aQ_YYHe3scz4KUdIj9c+R%{R$B^5n}Q@(q7zLK zbgGG5kl@$$d0_t$!~&Q{-@TQ`0DILZXbR=Rco3E8wHZk=vJVnTzw9JP=_SSz{))(c z6vsM|0wF-2Dxs23ByO}eU(In}y{A_-lP>e93uB4X z*1kHIil!evDaKDs<-M`BU)72#O>VCsIQppZ}~vG(WyXov4WBF+f= zf&)9X)jVVtf&AP2a!L~nWK^LpDdFod+CC^Y(C){>c}8e-;u!6;7$a5m(?|raCrAlr z)gQ*7`|ccZ?>L_5`wDu)&&24%HRn11Qpd!q?~l-x-@3`#j?zY`V z6;5fA(6;Dy@mjipF}?cEZ>Qa1td%N3KFO>2S_7=f6gqLBr`a^xWdET?-(IGTCA#(v z$jllFE_UtPtc3THsOlpsK@~V0IJ^_5+{ukifih`qPvJ<$9!SM`A{N#J+BL)IzC#wR zV2AWM?p;B-xL%QygBa3D7s?DJ16%Z}c9AqH72-OUKu)bV-Z)Vcx^@#n!E4ES1ge@D z(Y*jHT#irGoW?8_A4jH3UT1VXH3kzxTV8mDa{bB&X-lBd#H*p~ZbPi+osF3GgQYU! z^9Sdz$QWT&^ipZG3p?ZQoA5U3Ur%-R_o-RBzVc!4=D0PL^&07<^?yz0q?}e>_|1^rdDTS1jUnshqZI zem|`F{`H^drK{YG4dF12eMP6JDaTnsZKGn_|11lq8X83;6g@Z&YH_74FU^QBf|soO zr=$kGrX$<5H93@5eSx^hD`eE7roU%kkm?02!wt?NZEV!?l{W^ba?@@kT@Z(l(h9LR zJdmryaN%<*31;1qrX*Ez7%>9syF1#-fGSLFH)`!m2kizK#_;>UGgRrsSQa*t>eGDe z-KS1FQBgJMP%XtlYr>sA<&1wLQtQDjJwseqk|i^D0sS`PnTm25%4Mk9+d*iK37oW)$TNu0T6wrA7Pq=!Z@bU?!Ku;>6ti;$qJw)etqMm7%aw4IZv(s_Lp#DA`8* EKUx09^8f$< diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-09-stop-service-start-service.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-09-stop-service-start-service.png deleted file mode 100644 index 4f3a65766f8b0330319054c9955bad3f6252a8f1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 60622 zcmXt<1yozX*0x)uxVt+PcSz9U9vq67;_gttcekH=@Aqe| zljLO0IhmO=vuE#TzZ0bflEXkHMSb_~9fpFuw8p!4?EAxyyJ^Tt zzN?-j-+wznu#!-bc=xU@0qw~Y@$DSNSzgcW-8;br z^fuPb-iy)6&w5;Isuk46E#jVL)8Bc?W*QwNeON@=qfg3ED6Bu4G96jg4F)r8x0r?_#}NIAH!0#?x7g(EY}1Y@_nurb!OAkZO*)vm|xL zeliIY$)^L^od2fa48H7u#AW`cTBT~|4$_))fb5){{FyHdQJ_UhE5-lRD-6J&4T1Oy zG?sd;$d|o!@LMZ3bmo_q=BB4VnVJ0zE~77>k>sa;uo!jIhk>ho7nv$3HjXAaLmLGb zs{ZfR?dqDEQVtGP!R_rrVeL>f?X;K zn)0SK&f=8uR zDroA1Nln854r{GW`@vaN3Eu@Fa2HE=1xPIuhFpGsqYI)$Ej{yCT+075j(c!K=CV=P z$Z7cKGL%}B0fmR5KF*@=eQIi$riB|2TO!%Ub79UPyZ%R@MrzTLq8d=K^Q3(kmiYTg zal7owoRQFVtDB(YwDn8I@8}xp!`gBhu!t0(+DuYH;(b_H7(NjZD}qp#G((UrpV|cA ztt(B6e7fyBFM+UB!u*(8>Pe)8P(~7BkeW0cO;Qv>_%I$@K*-NzWE|vpWn6u0WGsA` zR)_6>CLJtCjSX25__Awc)8XyKy%>`+Eaz;@p77d-EC5JxXMqwtXB|-( zf2%$n9ti5V%jKJr!CrK`Db{PA=4vR`;|)MG`b~UTxBF*dO_ico+-*(OW?1!s;TZ&# z^L<6!oqS+;J?-ddC0LgDls+BGzv=hhum17;jDN2r-*041^x-$;3I}ZbE9_WKuhUw5 ztl1_hB}K~7k>mdU9yN%NfPh)wT2F5|#nBKW$hL8clXl7`%B{SanO%%%|B8@}LPSAz ziW*3VB&8`=?}nx@HO|NY9b1tt+>s@p5aiqK191a7E6q zN`1Djlv-5g0ZrU5o*8F9Kd{zFkHd#i-3R}QMsUd{uHF0@x28(M$kk);yKG3YwL!t2 zuJwoJozYNN2Z&s}DS?W!EmY$3B`dBKm17>H(|?fg(H@zTZSM*aH*VsVwkk#-ttBBV z`{B*Tnp;`1B4lS|lvo!ee=3<1D@oqlUT)?*tk1=9QC!%7j^-RyqF=DuwVED>l;y&g zR2y1GESkP&2Oa+Vvcsm&pJ(b#q$19%`(FdrN$FkEvYC=O+D&lz+agWMeE(hdeq7;; zBh4r4q!(91ZoY&RCV{gOJ*7Lp-VgCv7MsR=u_5;igjI%vvr=+*{f}dMuD=jF8bN+| zu5IqmaDh+W9Qlqy5kAUPL1o2;VqN*F;wF7a`A2)do{_=PADp>5M#B>XP18}{D})&e z)nz1DO>L?^I)3?Q9OL9jCSie%yFZXGU?Ra;>Y@+3B3vuzHFpaGbdBF_wLN~O$Aazp zrQ9y&_kXNQsOIrGAiNXz_kvX;K9SS@ZZnxu-@O9NsKS?&5vO zXc2Rkwmz6#4^eW<@87nRr9MlRrzgN+BkqNXYOC8HO?yaIYpo+@41%%ta3|I2c|`kb z7B2yRxkU7GG4y}d@`q%v?;>-SC&zJQkcen<(-<@Z8&6!MRpL~g^#)X1CUWg~T8GeW1|M2>Tk$>79 zVz!PPAhGUuHK~6iGSWY~OGzfa9NtEKcF3g5dwM1%A`Q6ZaI%~^P!fTXP*b;HsrE!X znQmEBBdN-PC!pjcCWuwus^4x>0V>{^+>wI|7;M7+cqPg+pECdHgXHC@xw(_Jx3_Ij z+%N9-#zx$1Gmf>YE=gdi<3bcJig9y8tf}NwoXJZyg}d|WyS zDyA(9&Qz}oLFdYC@1LK*`c?143vicGD8ga!V}T^Rzq2pUPNlQ1Y0+vO=@971%s1y= z5F{H~3!5@%!}%j2?AmMyBUJ^lo_kg=v6< zf*<#~yL`FaL0-$wQ29eDbBtq(@Cmiu1skFHd~S!hBn~@sIo9L_dpBH3 z&+I6Cr^~Gp;Eo!z9T0r+fs0#zG`nNcd+!GJZ@+gqe|)ds;{$O!V*SajZyV79%bWRn zt*5E1J~H31fj==2!5?Tt+xi6{eEOs6bGXIO`MNB*Zd4xwUyX=>`q&M8_P#ejfprE4 z$fry@GTDIZ?F8DgC&mq$!Yj{N}TqhkjYpfNtmEby1}ZZnZg zYS7lIlAg`K?{bUpg2JQ*_IB!ar}cC;&|&`$ygpl{syLs&Grcb+Uu%k+5TcP3?ivnH zX#PT|3k@1{Y8Wg`jf|#|tj~6iXBnW;!**E57JIML*mq^ANAvS)s`5)0eb?ji=yLljqbQ$2r{k zZK+&7&$qAef~)U3(I8m`75{Y@jnTF>@LsQ6Cr?(VRs+HP`Qj!;?!Mg(%gC48l$Di^ zmopKkmy<_>Pxt-zY-?MiTTeLTlwh;#I;GEyw>X)r31#Ox&8yyK7GL`d6ZS6mR4vbY z+ck*?JvO&(`qor8wkS4leW}Lx8jdl4<6~@^dn7nq-kN6d#&%WUxQY4Xds(r={$Qmy zY-)X^yk9UBZI5c%@XdL>pW8S)6z8-Y^PyUEYqx65)1(0bD{krun)m&o67(nCd6gzl zOaZt1aO=QnRfzG?FFrvbj}(TRO=lkTFl8Dox(Svi<6` z?R&+6eZAiauTq>}Urt}Ck^=AZQJy(piIQG-#PP08UX$g6uw5vgUZ0ryUN2q;wqEbv zJ7W2t5jsLHmHxNJeJDb`z+ch-@=et9#pZ45sYd;vHPl>19&!A|ECTPAuXWBwwv@_P zu-pX8(uz}(Y~sn6@jU%TuN`f5-8!85g<&n{5n@KA9bYqj@Wf-_f-wa?ql+1K*&6#I zl49!|S1~}>g&1f$EQ1$slJ0Dfpc;-W%mgqbbzSbVmw9V(FQ&q{RnityPN!xD(sdyc`4FH>R zba;;3lWy?CHt{kQepsj7QMQHl45&N!G5xLbz?teNa$XWjIP7ik{$R1iu%`Tf*4aC5 z#ClM7{{;M<99~O+(;8>HgggKDzfX>X8DibKhr19Mie#qJqAIcgm06(MK*= zB~x{0&0=kWuz##QS&D#nt@_lDkOOxRsN({+0w!bm7`6$6jq6a3mV}_;KW_j=|wuU}$WscD<*8eX-Q>}2b8Jipu|o>)}24@n~|vK8Xz`TyY(#aq}0 z5EkCr-GwBUKvs3)eV`~(>gwuHbDCuf)+P{eky%hKQNILiD%{rLdEqFT(qUJ^04mD{ z5z+i#IJt^0EZku;%FD%dhSoG$mJ({rH+dflC=Rmp(=3O~$;fjkoU8vgpknDRuC1$6 zADJ5+RoHJ%Gs`nJHip_8EL)Hf5<;wVT?-S*4^zi9w};NM6(n74pxY-a`$IqmE07YH zLjfaYI@0bd1*W=%Nc6}5f4?;EyR%K+H&b%@78?OQk`o~vH)v6s<#{Pln)+~qy}dX}HjBUiTnS7`$zG&Hoz%F5cNrorCcpy326R-(aaCLVq~U_Q0g9|E%_Y2Iqf!;n~>P z>zbPb3Kp3=>~_-q>N|AuAhaEJJ$x?EUR5CSn@6#`c$26rEbTD&ZZyk+zBnT>Rs8`U zCMH@E+<4@AZU9o$Az4rf;q&|?)e-H4M#^uU^I#tvzBi6gwCuji(%n=_v~z7V1)vU`Uo^$ zn33+#Gf3TIG0g^Ak`t^+{i3AWClPw^{y^qlpeaGactg%cMR>UlBb7g4HEWUT{e5M5 zb58w=#6iz)XC68U$U%y;SlfR->hS#5C-edeVv#XcD)jqmVz|_TuBJaDnkO4~&$_i^ zQ7k!lOENSxq}n*S-)^^av{JSOPFZ>zH=2B8G@bSeP*xl(Sw{v!0nl9p12!=Sc2cC5 zS}feg-_L#nH73>~Se4`>&>9~a7te(2^RvI-)*qht#!cG6RYH@}VPQXf7qS{5Upd%U zhWm>sSA2(AsW2c9ym;;yn16qC#9;{-Gw9M+StRQeowu}EB{pW-YbZYcJF4v6E_}b3 z6vx*?{WNM>qu;B*&iVI6On^*ohUMwh@w9j74&Caguy&>`#7twjb&;DHeIJAuzZ-CH ztvoG?9yQr=e^%0Cl|FJSW1za3CM;b-EsUYCs3>kh>4AJP|E2J4WHIS2E5(&pRFJUd z=43`_F>@N*Yf$iOjAfgfY*`*WD^vGd6J%Mq`3q;juV9Z-Pb`HJQ>&W>8^kaF9x9_65Q+T2D+7_RvZI-?$T9XTBt#4!GSgF6STVxQXILdZKdQc>V4e zOjTa)pygX@Ue{>MI2r;}h6$9NtA?^}#K6$SF~`MKzEoNJbyB~Wpr-+}JKI{lPV)*q z-T;+&7Crrv2Z(YnbxdR164@jQursI}r5SH3=6OvoDoo|88%VweH!{k}$j+NFA4@)4 ze=)-Rk)$QX;QA}92>xf>YTFl`?|(5Lq<0qBSfWqV^&}uauQwT$w|xJR;@03F?Jl7-&zR9{bT#wFOx$XN*ki~D^-D8 zk*KD&W?we_#)4s;BT{y*iKS^?mjo&GWd~98%gF~`)G*6MwWR(qeqk5(uwL%X{MZz9 z-MflV)>-yTh<2vJv3z^Rk|L=wjVe8}XY>V}18Ld&h z(yev}tmB*Pc|%)od&NxT5!2#VGVyzFsvG9uJ2W$(+a3K0Ef%8g4DD0;c^U>MLw9hh zxp(%(5neO7Duv|+iW4*}1axjVq%gV{b;n}#$deHE%$c%*OF`R1S9SHfeI--Gg?;04 zJxOtLYUS7QFUHWq7kUvNBk)OYGZrSyK-5t;s>hr0@=m6UVal}7>(dKLiy*xiEdR1B4M3e8O+6nCd_O?+ZUAMd@#`PzXQ%47wGm4ZMKyP1lX(v<1dEnqe zKC*N63ky+b%2A2HJpnvl$PI2zHU|b{ygwkqj)*?V%8)rE6GLdy9NSxa99TQ1+Hi6- zd1G_0BioX1HlB9y%bi`YtBXQi8JBaHA(} z87;lmy@it7qaU9M(b=Mbkj&E_)-bi?%+#ooEJ>umtOS?@=j4Q?sLF= zJ|u~7Ji%y7-H*uOdT?!eWo*TRtj#_vx+RA4Hso-h#QN`KuhQqi>zRejkUSskHtnCh zq!lS?$!e4+f<1i)40~sj?DXs<$)vrIf&`9Qmn}xZ6K-mHmiJp@x@RA8>E~C&a`!#l zMWD6GA3j<9(pfzPKm;kxdwm6(}>bMj(Yodo(4Wy|Dm>{G2$2r zgS$zAj(a7Ucqqmx-I{A9MGV$-XMWPY@c%G^%?)-G< zaTFR@%r~ppZLjtvTD%z60G=VPzgs^*^kMOyJ%0Jq+xQ_wK+d=B`sW;iV5+O>4JEm&9oK48bOMo$ z%l<#l^;N&DUtbG+A{TG9ULj$nA0ONGx%gY-Z9a?BIShhRnA-Vb)hJE}Rt61fBdZ~$ zl|ki;xE$jqqb@(qZ6C8kZ`$7b*Z8enW7gU>aNE%0sU$dB<_BT9^kUuhi*x*9>qf|k zdAxJ)Vvv!vv&k)xrRHCZzu~C7!g8Cbiu!Ai1K87%IQ>jvCB90{GOq#VID&pwIP2_MMk(70SOlQM?rA@wXNNcG z)DFv-zFsF$R~_zQX^Q)FiK@_nGIsqs23*fUcq)yfdrP(HqEE*Q=(30$H{%54d25i3q_>|OJTIN$Wl%#ANgA(9e~C`S)-ptbVD z>D)&#suMQ|fbKiPsr>+3(}xx^q~*q`@T(`d_=(3vm4~E(hn(6A-hv$h?JXz2bc_y1 z*uLq|>{t??6=JQ!xiA~wNXf_P)Lf#8QEP1a7u12Qf40ATUk?TSn$6p+xschiCVHNn zDRqDt0Pt@p63nQ_+m$Nc9+*(vLL|4BOV?POOxN=$>W0;kluI_a9yZ2}?xf8(z2BD= zdp;@=9NPUeljALgGmh_dvZmf{SMuh&UV~kU3PySDc9QXZ^r72LU`;`Z>9@p_3bt_^ zpaH?P-mdq!BoacC(^k*rQy}hG77gvEjB984j4>_Q(Oa?Dw(Dvd)EIs`; zeOh}bmrl<$n%L*!u*J!^rz?|}Up7mw$y8+Zu4(+*wDtvlv#Pugtf4xGE8~%oxp~tf zu_AbF9eW6JjwN)JY6o6%c!C(`?jDv?Jn*iedU>z#%@aL};7H9!bbh8N%z~=H_Eoos zI~h!>_INi}EKxIlYtEH88EeLt=Bk}PVUK{HKgWP(s(nBEro}u$47{jZ4<8&jjJRYC ztixK4c*2J0S z)GSyHY0>N1;l8Lk9Y@<)E29u0w3!2zjj7PtC2h2{dY@2c)ELXWnxbO#^Nu;8D1g-$ z1%KDAr}`Bf-^SD*kX6BEgGCF^6T@D@wL5!`sI96GqW!KIXrUqS4O6Ib4Z*Bvo?r6l zMXb(wjmOVF%%-tgKvD$E-YNr?+M#RX&0x*569F^oZ;fR1?Ba* z2IYQY>ij7qANCrPkA2ninmtfuU_+QTI6rVb9kiK!P0lS}Bq4H2jBhHvTL1E_iLgZE z0-GYM8!aF5o6^^za>3nf(a@Sxsv?icfh{#+uV|NiF+26u?`-%-dvoF_;(EEgxVcaX zw3IaW`)H6+xdr+}Ljv5HzY#R6^+WWn4pU#$PMCbU{^zs1<#EZyy7Y%0@*`0gDZzP0 zDEs#(w8g-0QCdlyB#te5m&-D+c9S?jjx^$Lo%F#xuh--r6H{4DDZhy=tMU4 z{I1V2-M(AZ)`PXU=?@=@XPwv;rntUe+!r73!@>KffH{ZG`iOl(jL`kQOw=-$8_YPI zuciIzaeMMOCqf7)+m=IhemAIvJafOBlw!tY)nl(x-M((1Sax-g)Lgv(ppOP<{eo#_ z-;az5+Wp-=F)*J|>-&h}NG#2z$oVKh(R(BzVmh?+x#@-v<+=)CLv#$BCU?&1P^{c3 z#V_elSyMKs?#tlhz)ve--9h2X=8}B}ikO_iDYWOfyzF^00b^NPeGc{Yx%YiK?b%R_ zC1S-0js2!m7>z^_MU%^Q)lbn77#`KLST zvP*Z~4}6=-;fi3Eb#r1;(l?lq&A{x6MB}3$ZOLA;hOj9!P_~S)`4(_VJbw(^VF!3W z;5C}RF9>`NgjF>q#FT*kK5V_pj3m6I*LnqxiKaZRJ#702zwC^ky1LvU~#Rc@7p&>}!f#8E$Z^sf^+rF$#w)TW$w9EC+MTfJZjFfujL2i!{`7 zv%o6U<1<>W(E>5$>fqDh*s|whmI%&NpSQ`?q!^=WQ3bWWVZN_2WEx<#qFwRn_woMW z5NMA!gKe%9FUjuIZs6jGogB}1-=2B*;ACRl;Nxu99-)giT~T|s>vl2|0bSx>_k=B7 zzmNFmSvIZ7fDUP6rVgJk&a2Vn>QQ4SQ+YRpCx_&w=k*S3t8OGyXZGRJ#JgCzK+l`z z=_^@cVq$t;#>A$WbS|$KPd2|85^|DHugw&c)g+R38A~?^ciWn21VbMRjw$$^OKQ3Z zyDm#IyS@OGnvIA5%w;r48W=YFB}_jhmlEvfmEADXkdb2mH_7K`2ZdGtB?sU2BPN}+ zZp!4!EBPC7gv+T!mfCHe@2vg~7nlRihaHC*{Fe2aHOd{Vt76S+aY2f}JaBzg7hn$w z@m?35B2QWxlO~sf4*$#WIrHp8#cKwUHqL_F$@h~o5>swJ0=?*(;LhD{u^+TTSrq@g_;Xw{oL-z8binltJH2z z?#@y!)ris@%!ze+15R34A9zc)?I|@$qXT;j`Db%>B2+J^IOqcQJ?U znca^_g|FvMC?+jYmZpI$F3brSdyPv=&j{sf$4B_wFN$?bK1a zIq95F*pB#x3!yYmhuCQ~mEX5{+t$@Q14n&h8Aw`Om*>?_GO18Chb!LTb_0X+0lY>*JM6z%ylQXs_E{xYe{cjawdM~y}q+u&A@CT4R&1>#c%<&9Ixv#g6>VnxW|eZVo+XH zUxU8)JR11D?A9PZI=!Zi^xWI^z1-BCKXvrboYlOTJiR`fU<0fuCnW#mD1vJcHg6V| z>L<`OpZ(Q|qq}UzO;{OWH-!NIKbZ=jdE=(Egr{0_3aDx@IFVno00AkP$hvsVPY%Z% zy9ed{p9kDOV#M#Qbt1e;F1%CDs~A9S0z8jU4;T>#jmbfH9M)ki?*Iv+3m-9Yc)4bxK@r6(|2&r62Y!1-w6v8y3t`dB^K6e-G&2IZwaj| z2~3<34(H+mp`AB~x?$1io*>riKGnn0?J}ycBJ-afe4OH#|CP$))v~R^QZBJ3rpo7}f}qXwwpDovSA+t)|D1`5Ni{`ocd8$CKZ)&r8`vCTo(hYKVY)lu&}-mHA$7STN-KD zQPWp3a=X>#KWsM1FHtV1o#1pt!ZAV)%)PK6!R8w8d zfm=R8BRsxQ1}GNf4ni$(7t8LB=G{w8@tbtef^yTpS+2;KF*GH$HwwU!Vsg=7WZw@a z@6MHRSGK)xBHitl8C?bi6NXLd$*Vu$Hz=n{89R=qxF)(lIZAO{VztwUtot zx5ly#)kb<>D3Rh9W*vYeffyEjFEP}&eWJ&iiqOTE&0pxa4}TH1DTb4 z8Dkd;hBWrAlJ?GzfBHHrAt6s+_aU1k+bF!iYEdIS`Pc1>pikI+6@hPdQDbQb7E z=%e9|Zeh{Kh|oK4XhlvMNnXmIQITg_SnAU3pUUU`r`su7A160dB}~gY=Rig!EX#%~ zH38Np*UydOG0VQZr4A&%7x6ZcbF3{{JeyM)%t%vDH*e-N3)4d2Q2LuO0Z+cg=UJy6 zui0y~u}@*qf^T*X^yy?|cAgu`psS9u9tWwnF&~nXQ3)-ipLKPKgf~}PGFTa0-#2M{L|0s&X8!(O zm}HjC$l4BmS-zgOwF)TZf-@ZDHXM%LB3; z8*4{MZDaBkn6{E~S@ZME3%QTNNTcO;>h!Eg9sDEy=+qb=}yHr+Vk+WZo6`8%al<~9Y56oFE))6M=dXv7D zivAH1?{h|@YI}SCq&|&|@o8I#%!u$0>@!6+XcTSLnSAt&uWm)dn4VCw4N=|PCmVsc zV;Zjnzo`hnhb_>-E}`el`_GavWqH=#vEd8|gs|QXb%gU{K~ZORJ(Lt$VVkBPo%|_6 z#&SitT}|!fD@=Kc1JYfs&s;IHj^ldR5akqA*jN`j+sOmlf}vod7HMHa-2;js7Ch5S z)Z|{sa1Lhn(xrQ56zEudC@KP3t-s~ZlVxK3sC<$)F1#QEZPKi{ucEBrxV;z`v{O7% zSN=&#^}>Q_kd6dd#5FW*H;Y!@?i;L<6wa#0SsjyulLIMdxR9JYKUJ#ITKO*Hx(n9@ zT6IqQRfCJKGcHiAl8a1x$cJgwhh*E=)?sg`FDxdr=Sxs<+vP5|?+v--M0Q-*_15_@ zYKcpQ-bx?DiK+X>wRBHE6*g}T}bUlo;W+t4Rf z(b&cWyb{Sgm?$xh{*k<>lqf+FBg$912iyVXJ_A?kc&dP-!R8o5V$qY`SP2$kP((`J zl8l5Yb4~(MgCVOz)>ZM$1tXqS(+DTi>6eqPBJ%3BdYqjv{KlBKm5~!14;lj`n(MN!Q=h>BN%^wMq*Xo8Xox`ZF)5i_bbn=aHi*0q?uA45MJVU!1 zvpY2kU@HA&Dq!e`g+l&-W&WHg_J(`<)(o#;q`O}&A>yrkXX#QDJ@w_=rzhK&)p{Hy zMwg{FKIJMS(Nef2c`pu=V6o9ryx}(I7jhvX-L?QDte?KOjJWm{;9dXA8-LemvQ)j& z*<@DrcUNQj7 zCim~4U1y{>D4VnM{k20sK+DP{P3qI zd?lX!aJk1LlFXjO%rmJvuFp2u$?jtg2cJeeL%R}qO0CHQ(gB0lGRGBb?H+jk{{9vf z^a{xr0Ads$|HDOg$Mw!p6?pg)Qt=<9^-?s^Bsf-w#7&Z`g@dH!7$_jIUyDQchUX?S zPIV+^>^JEA%d@Heaj9xb*-R{pZ?ZgRFu?ygL_ui^JIxjyi$Vk?2Be0Km&3s$7BgMy zO}mv`=jKeq=(|f=LO(g)NbV|wk;ld|4{6uGK#Tdv#!*nz2%fEH(U`4waS23mL4BR$ zjUMHMT4>JWqHA#SvXSyfBa3^)#Jg2JAuRXh2NPji`4v(Rp9sl*Fd!ze#xJ$1H5lju z#>6+XMe7>^lF!QIGg@3vO2JPIm;P^-&_0m(^(qP8U~1R3w=zZ;^oK77Ak;cs>)ydo zp}JT1@T29zSVaz8|9*=;a&Am8GV(V)Y^xzEZcGjOX}u%LDgo>-j~$xN(rC5ZM46^{ zR~*SpPm5z$5dke|NuUyDKK=69{h{$*fQ0Ay;)+-SOyzghEt#Dk_|gXFBWg8yUvT$ zY)pRbaR_(56mcv8*d(JH+ph9_(S+ruYhXE485V9$upK10Ovl18_hRD69BzIZj+siu~uP z|074$FPie;#8lh@nl>(aB$qHPPkdYxDmDUH8C+ak6je@d2G}@gibkQ<^GEHHzOEF= zk+SXnJ{X`>R$k4-PIrqI#mio$mMFpK3tPliJAn)omv!YuXY)+bpO^&>edEF99g5N% zFe|63bBRL7YQiQXkXDf3K_nr$3u|@ZbQAy3cG#9(2mTp$3COHV{5AV&=Ql^0&txh< z_vCVyiRzD4|EN3W+EE{{G9Oz0ZSknV^m>$B2V8ExASPF^jG>|ghJJ3K9&TSDWpJ2T z2*7W)6dS!Q4OJ#Lf>&U+85C{`+AhNH({Ss-cL|qej7m7kyGUAI6@^V2;nkxam;?b5 zE>DC5HIOxJvy=JuCUS;hGH5{WyUhP!Fze2`0cJX;VL`i4Pv?n}?{N|;PxRKY;t}Ze zqV*|*dDm?2<>u8MI1S46dVb=${=opIsmyuoJ%ZfBwRW2y*jsn!oC&opEqLtD!-_Bu z4-amEC{T2*waX)Oia3tdxPcc?w`{z-HD zbt118qo^2?Y$77+B0D@Vx1lNLpe^7K=hL`Al#+Sachl}+~jMM4x6u&yX#D6t^r|PrO?rEIhx0~xcQuBzxBQ3p~Rm?_~ufZd=f!m~2?SA8^Sy>-XH;;vfigvUn ztR)kad*~;-9x+)5m`61{mpF_&Gt*dg>%T21-kgXR;g&=Tk~;CZD2`;+^H1~>Bcz_S zS>dt%L_(CXa2aJsqNssG)D=Z*{hKalE-^gN`cLz=UNSA_iR!ahU!US+D0#%al<-yc z20lSXSF*F7&!|UkHmclL$bep^bAHhoT`QovgnOrxt98=4juQU9{c3NYORH2#>M4nH z9^iHnQ-{II_^}R|R|4GMMF${Qv(gz!;F|12DEvxALc+)>bdwgT3Brt49iis!NGwc7 zg(^XriRg{!)jk_m#|A=*cK#lmTx-B$2?DeT)6@;~r<(un5DyqaAdTVub;5V7J+Hq` zMw&z}T5wGp->B>+jyn2{7K#IJ(8GcI0jq1If~Qr@9$ zb`FdA&-zupZUN<77lvNIZ`!x5^f6pA7HX^lz6mEF4v*crn{cptk@l!Iv=S*TXl((TQ=iCE$c{c|G%u!RET+wzy8Ew8(saGNr*|d}? z$DPPL&$G{n$9A39tARUP31V79Z(^^4`^!C^!%J15*LnH>=F|BAGtFp2vk$WW>sNtq z3$+Uz5fAA&7H_)`)YWay3U@vxE1M6}8(iVmYb5pDDzo7q&rOenZdbYv#zX3pdfq_Q z>_+>d3yhp)$%YIzR8P4TuJB?F(o-8jR0udVn5|h z-uhy4Y&B!^MNtFqxr`+qLeCW6iYy_GQjJgGgRAM0WmFgVi(^VrFOXS5vpx6i(JWi^ zac&6rB|mRgc27es#sqjS$$);#DN~r{=e_HGI>&tYr;}HtCEbrQONAI|X z033x6H8oRQmVr29MXloskJg(v7^DcsOSE!dY{GO~D2c?_WuA()=w>nBVP(xf6hxm{ z=un8Jo+x8?_Yu{EjbkqTk6OsR@GARWaZ3ACl>19Hr?mL zXZ7%;)3>!BYU+;2^{A!1SfRA%`?p|>DP9A#+O0joa z57Yrow25Jdjb%>$?_Ds1Lge0M?eFs~3MLw-%G=1`VDMw`%`a^dk;jEKq3yR>NJG-G z@rmU>D^9ZFl^hi(?#wgvrO*rAFDq038FT(7SKx$Nl;y{Gth}f5MgiWxQGnn|<%*n$ zs1XN>4Ogc^Tz_qAmW%I+-nesNp7bouWdWm)S=c3fW09WJz>&mMY%|2DAg`$FE|sD^ z3`s+ebGOdeiXHB+eQSAIg`}`6PV#*1L#mAUkPgoEpn}#r1k=-#DYH}RpihSWea^RW zzZ49Wc!hPTcvy1II1U1sU7!po9<=$v{VBE0ZoQME@V@UgkyKAse7~Oji>m5k#i9b5 zF;L$&q|x*9bJ7){0u`$nul)XN4AfF z;edtQQVPu}XpVve(4%7m{CG=6R}*0e0{gqX3}P{vxio-G1la&WCWU96iL@ zb6w$YGbF6h=dycPip1w08EyxwoG5TsEZCYR;Gtc7PRAq+LIPQRJU}-sGn1_;Wv&xQ zhf`{WBZ)m<)ZbbMxCmpM2r7o!dkHpuS&r0nE#~v&m*z;o4#5I$PU6FW{eyQWGO6I4 zsn8>5pRUX6eBAhLc(Zz+3~-+BT3i#8`ei@4oh4NQ-$TZ@Y~mCIffig`T{ zS8JRdHU6ZMxt;5=Gf3LoUvNr2_Tc0t#8eXTz2yL|GAB>>&)69zN26X^!eURA$Gg$n z%|ArR_UTHr{L%^(X6S|h0u0WK*pQ-54S;W5%ri1{+=B>-8O!K(4^TyVlRy4416x)T!}6McGV>2{kgcQPK8zywtaenaF# zNz`!0p!Y*&E_O^u3FnFN%bV2Q8^hW2l14~C{hli)$KZ`__Abmh>36&d zPKejvw>~2HU!Gz5ad70V2dHvgFQc8Kp1N06H2Hyr+ z{{1~tFfrlWAxLZWd0^fBY4#=>7v~ZXxIy?Y&DFuRa`L(j9lhdNG>}kwG0VOHBYDeqKUSrN{o0TFqb40hH8s)a?LB0fAK<$Y=2Ga=ac1|z4S{2?@# z1V;A1FpC?B>sC_uZ6oA%I=7Vg>*sfGWsz|kWq_R1-W@P{PC>~BQ%_HCTesOJUiWFm z+`Km9CLPp<^oV9*UzG4r|J7BR`~qsbZAw;Ndf`ONOEbCNE%AYAr9diV>(>974%))Y z!zX=8|JH+kt7k)aR$fXt*EU2XTNSz^l_w+eTxtN`}3+f zA^+!HrF+sp%aI_DF})^R0}}M?y+Un5Kr7g%gD@c*Da5 z;2Z6J%P4V_4lHZP`5&awVW0|ia_-!-3=FD$5OS9;%I)wqivXKgy!FM;0PWRGKB<1;UN-^!l zd!%%-X}ap1t{QHqN$v6>s?m4(4dRrLA!p>%xekDLUtINQlA25!Cyj|R_~Mb6VekPx z@b&bS@c0L9aj$?#Vqes)&KY&JdR@&uT#@XGAlG=Jw@E};fu9r-;tZy0XStN5RNBi8 z8iCH1r5b}VK@EIsb(Ts*QdK^T}2fo}1g+TSkPA?#PJayyf9eZ~91*4%&QTl35 zvl+f2(B)O@!B!I3e_zxJ))!j?5>2q^7% zQc={zTe9ureT3xX5$b4wmX0@l3{o0!hgGu{v1sn6=(!XKiiF-GFAgkOEaEnY!*~5C zEsA0L&;E%Y{p63zzP75U@>OJJ#5qiYwE;UmoXyIkw@GgiZ}Mm+=Re#T^?KPw& zrI4CkN^AcJ1KpjpHa1gLT0lx>F+BrAROF?SoKZka?=XV{qYMvrkSi*W#MBbndWTf4 zRmE$=8&8~_O@%b(8AAO%DAj}V8;nVm=`&iQr(mpHk1U^kG}jbNxY9@gS9V;)DRI1o z{8U;o-?o^;`XMwmm1DGX6$XLnBw3x{cW)mcyQ++b`!})YS`evW*ZAYAOXSOnL$swM zZti8n);m-;HQ}$jo5R-~$w~F#*z#-Scja*6o%dLG7Gi~jy! znLYP?-rZnIyEJSKWB-SXuu5s7DbI_2%eN6yUxCTGg`9nuD&m&QwT&w=iO<0M;$aRQ zx1+XaK=Dr%RlcmulsMzeFL7j_CDs;4IC|NK9*Vd$dn5Ll{WPRL=G@-hESt9)eWz?% z%e~qD_8d0t*~ik4-(l;;Tb$XymU+Mb16%JV(oYw07J6)1yNBJYc4HJ?M4$LL1_qw3 zkW{GnI`GC5XL~~-^;!Bt)4a_{p)SLP*BB|*W4K6r!v}t!>evmJ=lcV z;X^o-4MLea8$Pzxu6rKn5m-5SCN?$ z=SBAKdPrkWIl8-#Vww`mou%8cP8Hv0M*&8<$5{Qz?^&bui2Pztmi}Zu_QgH4$KT}l zzg|I9muwpvv3Sl^^4b#F{)=BTZ|f1X)_u&Mj@r;FUhyGS>s0X?@WvBoTYUjFsaF{; zy+L2j6@jY^!hkEg*&@GWtVLTQ5I*}xaJax z!Y}I+N71v1pd`bd-Jf3|r#p`ea~E*MIek1cI>yOQN=1Y*TR%NRnYeC>zsHWX`lQt* zabezkZg^&p5%iFQ8+FL(t;1%=Vh-y0h`0rCZtW3#E2@aPd4$bdZ<1cyG47!%s(eX# z72@2x)eQNi7KRzJW8X^FynhJaj7%OJKFI|OH|+EeqjklGjBFo{E<8)Nu-lU9z~Omk z$P_Km7V&Kynty?W;s`dqwE!LGU=otj$S!Z9Z(vANY|mCmDpY(Oc;kt)rA`v(B}Pj1 z=*_xJU+z_fH2ZTU#I?Xk(KT|U#yJgfN@>n=#)dWP*|b5M@Txw>Mq6;v(_)qI>);hfnuK3H zrD2#~dyMQ5?#Ogz_tKS0SVyd5W$=nL=Z9df=ZrE(X|RTe2D-TAw9t|3%B~fwS-tWA z9+~5$INA`)rLAj)A8Rml&rvkso;)uOZCZ(zZL(rV6;-~h%#=8z?j2{-%G;DHPn)qj z@IHU>7r)_gS{B;7Hi&QO78kd#Ve1JC(lXuH{_b89heX3L*_@5<>?2ut)0iNx-#bE5 zPZg%y7qMcOKKAzZIL8#wJ1|VY+EuIKH9#fK+FTOcc9G+MkW8NgWC^5u?j^}}7jaJ8 zh_u^Cn9VvIZp@*+GIzq2DypdRBKczC98zY&R%XNy-l|k=EFH*f8=*eU z2i=PoxOUHh*o=H?>x&6-iJ)d+gwEO=0$n1h9Te9!BZ1ep~8GXsRuyp}LT|%6zKJbEzrMVQBDa*QhG0 zs4~5LF>#J>c%YfsHqbYq+zXylWOPtG8^3%agA)dWva*`?T2y9J7B2U_rb`&pWdiP;!}IzH z9%~=Q=F~21PVb{6J!QhSDyqC0GL<;x`J7VZPE{|$M6c~LBF(0=t3t*19p7u>Y^g3K z%K9b=j~@{0U`B+s5rL*R@iR8SRsRxto0jwF;>iiys;Kg2$cu>cWir-RM@LmOoz>Bd zG)B{37th#0>%>!4RC%-Hdrh3Zy?yiz4pUj2MoyAH1?iy_XN40J+k9w(-@Zzbc*wH|;6zoiLap1^$-o6=^zp&7PWP zlgmJB4sQ2cDeIpwn2;|b&XK_$s&afNO17go#fg$s2O1Ku(4J>OQ%L}K9(&^Fdxg#% zGm$@X>53|#4lT3JunepbeY zN-#aKhJ)G<2nYxuz{`e!w5BH;S5GgZB0i)~x+Ke?HVSh~=@C`F&+(BV8sMvh($er^^e zG~sys8W9y!YU?kOu}UoUE_2<=6~ohOxNPQ&(UH}xzUa-f^?Ns7548B`4}W0GZfj+W z!oi+KlA;0$2z2Mf@>QI8m_TXtJ?8)EAil|oBxaRUljh2y{j>SgKQG0jbRyPcJp>!= zW$WI{xXQBhwZkta6G!7?tULDr7oGhqyXqoRE2S2_weRt#_fJzc){E=?z5MxCe`McD zcV&bAajD_zia+trM`tLVFkz^WOFNhH(Y$RWD*GvZP14^?VSYJX)9_PIK>()?tmC0a z7`IOC=djI`VTT4EcK&fYkyGN+-P4QxV~-aSXKO_`wMi#wE4fEonJEo7735Rd&_rE%1VM4=#1$i})5E(#-r` zx95lRz~nwQ-qEy+556SEUikX}ySM^6n+v%*>s>zhWIMKriw%+OhDTf5Y0-=A_9*dNkl`Wrpbk zPs%034Av5C`+)nVR%9yA$E7#hjSKoW35yLwcby4}qFEcj(Zzd+dxr1F=jQ@?(T)LM)WxO#T|H~?joC0Z(mF7?%?X6LqpS2UuqVWbwbBaCtR&6JG zvZCLg%jFewv6b5!_k^?SV=dxEG`nN0*sHaj-AnZ-QsU5t&())xIqinfQ59(kH)r>u zZR}g2|AaW(V;*qsnjxmQFL2G{37t;JFomHGn23+eH+g(JfwAUX98K?I>gY#iPBx{2 zz-00obF;-qB~v>}WmOe5;-f0hET&_$pPJ+}Qlk91Z(>eRZUf!9ew^N;O-6eQem75` zV>iBzd9W!PTj95rvk^yTA16t^ZlewOS(}Ov{Q)_7g}8e9znD17gXyoe5D7IC?W23* z)v=(p*o0)SqvS`NqayAiB~cg14!t6X^C=Z&J8ARb&)#Frn$>(ZYqhcm^Ou#e{uD0G z+l_bW%o>?veTkf(zmI^b$$cZkWQSXGeDi7%r!}nHeU_l2ZY7^zD8nseN2k*)k~LTp zhtXAY3I_%#wmrgcKi-0wS0Im#?h~9lxv$|xGD=-e26;taUk{Ti-wyd+6K7RbHN{0m zq(*sBUlc-~-OuSu*+o=EX0^*fgA*XEM;Zr=Z=w^(<{j`WI1wC8NY+}DAvzj=!}o34^rTZP$*b=>l< zpefgf6FY=Pd-f7HZT)B!-+NJr5f{!Mq%{U zydcZ1gw~AE9e0aQXV1mIdQ3DbYKb*rVnCjMgkG+6%Kz5i7N^kyJsn`v}j? z;jW=6F3$HjweH3fQjENDf)l6QgbpmED_^APJ}!=TIJM!{M1J?;dru!L|2)xH3PR`N z!zb~T(pBie@-^$YqI(_J*b@3`61a7AEjtfi;)=0734X?G(=nsHyB!y;*?e})m*I|5 zZr#?!-p`fOpB*B8poW{Dz03P+PIBq!YTlZ4mb~FXe6MWh=l}Y1-g)hD=gZVPD%LAd*bypTAX%fslc6r@>q2dWLk?=8XT zfRwjuwR@takB$sab9CObGA8Vd zXzcVSaas_SXZbi0$_W`7k?+SdGCIs)PdsNn+ktPz(`WU`rtDh12KU^FSd7$AQmu*6 z*z^8~@200dkbQ4&!nb<#DZ!3apfh(4H+`l*D1Su8d*X#18

`=G*M!@%}9wy(Ahb zPvS4aRT|(Lk?|0D^F^7X%C}0s*Th*=R7_EE36Xw|SZXgI?e<@ga{n*UJ+_MQ09PEH zTwXw&J$PL`!I|696ZaY!#_!Tbe(|f%*|B{SvsdoMHZGKF3pe4eoS|Kc&in(!C|zSI zocv@TG5u}0?Aeb+kQ_1V=Ki{!ScjzHdiF4f4Z@|xaTysP*TaMj+c)yjk3QsKemzO1 zSGjzBe9X*6Ybn3@{d{(8ThAw}_Tp9WY)kxE;_Sk9?_z%W_CjHQ9UpHvhG(n~$3NJB zN3D3=6U?gLtsq?P7tt2Xc2T*eii+8A;Y##8#>Yp!&n@6iVm3Z!jtGr2j)C50?Ddbc zVZ#DG`tw1uX~TT=9z2vIP&3&2%YWsQ)mz!NZXS!yo8w`8f>rx(l2O;r(35&%lz1~E zbk7Ef>Y|sh`}_Ie)5R>?v4bt^PLtJAj`6|OELyaRd*0(G-K0FY^bB#fm1htT=)vt% z7rAN?GimHKokM?GgG;FlEQ1S^h_l%DE<1Nwj1!+mhSJfVcZevd3=E}ldFcUe>1(s+ zwAxa+#94@o@_*HDob=mOQLE>6OMcgfjdhZ5wT~o=3 zdBn<9Yq8FJ8d`s@Ju6o4#xbsf?tx*_t*)|eqsh~*>49{PpS(+Gcnpr$*0TJh9id(} z=^&|t<=_WgH@2om z@LNSXBdYR%e;BU=j0{tl&|6w;<4Tp>ZA*4Xa8V&+cT;tx$%#tFY5P%$6-1 zIcpe5*U%u9{)Q}{wTO+!ce3{VJp@1LBI?BX)B(K^b zmSD1RCtG)KX2IO|_~-xjL*Ch@OH_6O_7`tpZGD3e{^vjNn|XT)si?r~>=oRS+ZY{a z#qIho<}O^s?rV06mKtHUSNOY*wc0jhr+BjdNB_u=fBrtFT=VGf$mia%U2NIBfgAQo zbaa(*`|xU3E?dlX_sp+#9)T*aSH8EzDZ`TE8uj({4D__&8d-y_)95LkGKcbM~Jp3p!tXJ+prK=RFSA}2oCL$vJ0 z8B68Fr+bKKspa98?HIbq?cF;uUcUpYU_nS%kFrH_Q5+Lm zPijv&`U|$>A^B}IgB^cZz}=|or>%4;6;T{n^DbxHH7)fqQf-XUIp;hvo+zb{;Jb&} zw%>tPK~3H5t>WEirF&wVnLIl^P91SoNNci$8ysN65$7kB%~+iq8$Q}Vxa?sT&4;TC z_7PUEJfgoghLbBk;A)W4x)Cx=du<*!ckjSL9^qQy%9;(A@btCh(3-U@o%J?9`X9eR z&v*QM*A%1koWB&JT$coxvq#uj^4TBx(ck?ZlZaxnKS*)!bXL4ci#$s)74kwz7ZcP7Z7zAEWOIHs`RGDcPmo?AfTNOl%s=G-uVv zM@VVR;MfOiaaEE(N>_Uw_Rd}}B+fdaHFp%>Xx(^byO?_$y`BmTtq6pT5t&OWGV-zYHxCb50-DA)8hWE|F1#GPg9F>o(tV5Am<`RlQYtsv^&QMR7AM@eG~ zZC$;}yWf)I%@yqfeE8FOIOLb&c4Dv4IDP5t8^Y`K20r?HJK7iaF?ZWZEG@3_(W+yl zR6p(RR^_`P-&^7=Dk{Ry&yU#HSdtUtc;ps~+2b?}tWyXKjvzcN6mM@YY;0^MTuhZt zLLMIB^UqeYLuf?X51uBVxSM+MVQl|=E~|FzVb7U6#NxwmE$Mm{xkRmX5*D6@rP4}E6;>2uCK&Y>>Nk@X+XWy5X}?m1(j$xZHfghIbN!o5BkYN$?p$f^(L zvT2X7f7zU*3_niKIY4ZuB+DQUeY}@AIkB`ZkVBsxA+@i8drRgpciC=sY+c0aUDni( z^x<)GKYB(HBnO+aVE%HUY42dwk|SgfcjLPEQ$ARsgj`RmRgXo~~3EE?&J$R!tEPwDt=7o7u4M95JGzdR7LAu)M&+cmI{2i;DNK zX&~iAQCvT?L&QO}=(k=aw4{Zo2j`UXSukfImt3Q1s)*pq-X;9%Z-2yRYtG`AEyvl$ z$Pc^Al6ec+Anfkgxd+S8Lb79RS-Eft8&+>aKj`Tp=&h-bIJEpaRf1$fjE^(>cfa5l zzx;&bX2DOi#HKha4z0YYj48WZT*0BovSBnXeKEJ$bXE@^$NTJCa*cwDL@pfNE6QgD zXRM-WZV(#Ik=4v!xr1G&b;%T5*dJ@aM}Jt3n`mQq^Bs7~_C|9shd(LU16 z53^|226k*&O+s{xXe0!`kT`4d18B|DWmpiVJVaq2UzeeRYYgP+(3dlQxI%BvrRRt< z@xdidpKznKIfpBU&Jr)8+8JTUhd*C{_H9G%7+DfgQA^GPJ@jpyd1z{YTVgx)fp^%r z#$tTpPDd8E&#xn-x*FYo{X72SuV!IiqEO|Ub$qns0Jo(-kNhYo4dH^&ZlmQGdruT6KNF2g zSD8h z^5x4oI5^_u_=v{>u8(c8wY5z{DzXU;7G_bY)Uk;CM^7t0s+z=%fkrTDpgaXsxWGsa;kJBf_k5;#yQH@>p7uoy-Q!3N4HkAn z$fN4Uu<8DGCrofV^m6P8@6wD?Cmt4RnA zBQ`Ofi10YdnxF1p++Lb7o*$t}LW7ZU9-%BLl;DJ7L6J{osHc^h@x$~K15@_L-zeO^eMRe1rlOc5}s`Rc#Y7|%BifX zrdg)HB}iz(bJ?P0NUgZ-%CKeIXKQ&BmrCdZU9^r`Q9YE!`S(|G!SEI*E}kcn8!8uRN@>@@rR$x$FoYKaf)234PoEPciDBzi`3Lq5~Dpy zsA?tb_F1J3HYVP>S zE{r<#X05_Jx`s6S^Q_-~mXM@Wa?9$di7@7)Md!(^i0Aa&71-og6LNV!TlSccU)MpP z&Q4ZtGbC43mX-CbqMqxZsw4yJqjOlQZBN^DpMfghO8H)oaaM~~t4x$k&{Wvk+A4`n zN=llr{iaJX+8;0H!T12}Yn6^HZ?4(}z0%SERlYvy?CN^ya+H#ESF(M#Q4(^1qQHF$ z^8NRauhP2Ix1G3!^YVePsd z+zpq53B5QPoaClYzO*T1h)j>$tXZ>`^}BURQL2VAoOG-x6s?0)$15Da;Vv2m&A93v zVU@7AcK=lp>jr3xdBE~jYdN5IjXM{u$ZmT|oKlABW4X9}BWu?RH%E-f>lDw&>ae|d zfYs8UBL>73rsJXikSwJwHbju&W>z22BQ`%Bcl}2c4zv<-$An(`wGT7K&C~C1xjgvs%XGtOFA>>-%t6X4G=n-N+`?nry@60L3vIH zC7D4Kru&nd>`i8Z2Px5y$xilTR5Sfq6;<9KQHfI(Ro*c9GF$GcqKYa{<$Ftq7tVns(dy1-V*2F;2=rqS?HSEvg+_@)~w&e zmD~5Q_X%NWcS=aeW zai1z(9d*bFvNM&zo=#euyIyUY{75&IMP;;T7Ld+RI@{~1@9d$wxs{&5uRd-jH!5!v zaqnoUp|Sf_^ZWZPUy3+K`Wfh~X0WqTd|XwG_13|tIt^5nH&ed98t1?u$!VD+W@M3* zmrhz{JQ2~sSlc|HI4h3w{3Hbx1qR1B! zr`$HKr8CtZFB=~UsjKB>xw&{YSM8?mU@|VlLxT(rk0^ePjtoum zcL=XjJJ_e?MEf*sJuK4qWJ^qqjEyk(%s!Y;r8>%x%^UY}^5PW|U${T@80n9+*}Pbf zdJ(50m+KtdbdT!Edx%cRh!XE9h9dl@aq7fs%Q{ZzhtdDso}j|&q;ckSw+kG-FHeCf z=F(@IaLjm~IEO@fr}{EBJjmeCkg^A=tn3v#6W-P*S+jTE1xmzqxZ!cm`pGL*qe)iA&^N-)=q(=E`jdB_ zo6zyoRU+?P!}#I&QB*O;2HZ1w$eH=?@(+LaOV${9km6<}$Y%=&_ip5qS*x&3mwT}E zlWc!U*{Ns2ytx?pH;S;Du-&(twaX83Q&h+{x;L<~H)F*={*a&kVFCLuo#CdD86}eW zdNR1Cqk~6*rp%hLIkF$8Jh==epUZQ$;*|N6IERD=`{39X=85z!+N4E3bm*NKA*E+`wdS4En!=Zx2v*4Dpo@ovh^_8>wlOXaoqmL8jL{)J{L@M4d-I&TVbju3nA5F0k#qDG`Q((oYrFFvF& zHFlP_9@7%@M z#+&@A7<3lwBT$|?LMmrJ-%GgMnsqFN)1U1lqN9#S+jer-Q=X~WiRt=X*aRi;Nb4Bq zOrIW7JzSs4ja|n$b>}8KXD#PZK^fr&XE}c*LU|r~^(dFGdlCNVHamAaDQ47!qo=)_ z(EKc}%s)uHR0w;bIr-@xLMBeakdkY2jNkm>&#c?AgPqIXP9kWO>0!%r&)m#||EpgLFOI%BDE4*)VY`ZBbiOy`9Z!muD=STw&&M(2etb%*X zcHopDE4DIp=kCO-vKo(L2e@vLC2f*tsgJIy12*RRSOzFNu}?@A*A`qNPD7k?ci>*A z(U%ACICTUq-6-X5G~FB>gY)=0*s^t%$)wXx8t~P*%z=wnIKO)(#|=Hm&z8h_ULnrz zY+tVKG@wK!PDQ?mI2%ht=q@)F@0X!+Dhic11q=klb%i`FMW2D9E6<;fVsV*cha6}g zZp2YEw07;-jze-iofV1b?cdFg{bxyN?jp_6f#5_ray~?Y?IVJeb36M9dw7il2M%z{ zHbEh^-l9NGZrje$o9Ef{(LMqyG#Y0=fmip7_ri0UiEC{HnqE=-F?Pum?{O0WH|}!v z@^Q9qoX0Qz=EuxBbeDvZLSh|V@o_h0&JTaW`>Re6UDH7FBL|}M#^*a^xZYsf_U)X! z>q3hNI>GL=;_q?mU@8m3+5M}Z@~hv@=BkezhH1mY@SO78(yveua2MXUjHh3%Y6t@C}RMabOHy_P1#gnqQ}A97kGzOwzp{ z5P$6lq?!J!usI?$&J$BKPGQ;_&xsB1vQg(T$;rtiM|l!k)9wx&|n+r z>WJm|yX$c)6K&OzY|eZz7k%FXn%iSI_U;yfTB~@lat(TpveU4GJB#F=m!;%->9c;* z5qx8l$t%s)X=c_Nn@tZZKh&Jfvknke)C z4-X#1rBG@vd7ONE4wq~rlsqr2>mc3kEbEt_BvRbloIb`Cvv8Uk<2br{8Mj;$MclK+ zyOhSB<(s)37?11a{p`QwKu)F$yFWfIVk4BMXmj?R^ia3>n~*Oe&ibNYI!kT|f;3>X zWc*|l<#d$d>kJoNQ!w4>C`snpoIY$vT$BkPuF}FkI*r=425b!WFlX;QVp8*H8*Jgh z>eXB_&lWEFFcsg%4cAQ4-3?hYYctobooDmz6F8?NV7z$==gdOzw>rW5zg>>^lYMAg zu(@!F>yMsp%s(z8Bw1Z#<=k!P32ku0z6-c#gmd`UzvrN_sKf${SpC*~@qK1eUl+=; z_qXDj8O_;GW^?d{FEw2?+?u-#0>u=*{bd%#K;7HWiw8p5#K(e__JTnn%dq0ysz(M z{k8*~zi^X;x*>W>f;qNr4QD(O1kpO;=q9zdQIhPhv0B7wtJWO~BnkEBVt3V&JVoQo z;gPt`nV2LzRF{IKkgN-#XUhRyeU z$&dBtkx8(kan>h!VR9evNqOnTYt0(UxY% zj?HUDi+uce3peeL*?52an6$}~;&g`N=CWJ7701*2S+jPnlIObaB920@^t*G4wc`GO zwjDJSDn@1OBX+MA_C)0tQ$I?Pzag79tYz2XD|keuQB#?M?G0z)qbQU6r#bF9{p74S zQND;cYYPHt&DUc@kmf+X_`V8sm7~N4^W`S*a)WnyO3L%6qa<5sbKrHgNf zBgeEXCeC5a=KQSfc$aFv^FI78AK=7|z=?Z}^x%AK9lw2Vsp8M(WBP<;hHz#69>SEa zqcqOVK1jT*UixD={>ee&2AZ(lvpx*_wu0;%{|9xpKj4A>O1zw{3G;EJr~7%W zRh6$#hFWvbKY5JM^2x`Dj7x7_5+{$H!8QBqFN4ZRL)Py)%QV5hvGPU4SuKwh%e}&2 zp)S4hbd+34mVz|JujW{>z8r1ReI}odGDfV>x^`_f8z0^ns>9;IJ1o`nQMxI|YGOIC z;ytd$RuFi8EvL*980;zI*sM8R6&hf~oujPWe4i&r40J_uVEzU?iw5aPH)GbX7vfg_ zv}3k2*NzPfKjKDknbL6XZ^|aWz6tLOJ6XNQ@@Y4IS2Rb2W*I1ZhI?Z;`u=8otA-gB z{vUaNH<6vyn66mQ9UpmyTNAeyZRBBeDdC1k*mCj#jlJWu-kT%u^2yTMB7RL6t>1)A zP6+{*4s+~607D~#xM;0o;|Z536VN(vJNp^4PgyBly{deFdn=W5OoMo9Flt%8SA^sS((MPC_IYLd;5vn2%Q4xNSGC4;ea3`TQ+XZQj zmzkVZtH1hB{9(=sd_2uryLtty79PMorGR)>9hRHsiQ)bZ9g=$* zc&v3ga2v|+RV1op8l4EL09clRphi1_TfWcYFeyD&HIV{%V|k{kVAfV=F2M z8)q-9oZT>Xu;aK%1s?HGB$~Fm&V39_oTI7A>yt6jBJb|({(>2gs(e%OMa0=qodX#UzN3H{zkip(A+Pk`iHYeT+%_lfENT+buF5Z=)iI=6PtDUX^p{~8)4+PiucO}wj9#H(v!*0CzzEBW3M=c`JeXcGFTHRGMq zgiq>I_@=ce@JnmOFTEB2^fqzbg3lCtZxY-S8!49CBdPM8lrJJqRa8;s<)RYjgfw;x za4)cixRO3%ipCKw5SiCOTtOGf<%5b@V0se~d0oU5KehKJA)&MnyVw?jGoCL$RlXad z5~nJvd^J&tb3!C>+Ql?d+Xa>F3xM`fsF7v@)gno9siHJ*8xr>u_7(H7Ddue=>`rJM5q^p174lyEwhDW4vaDS6 zA?-K!Jsb9Ps1g>XUz6`O@#_%&$(159Jo&7CK!hQlY3x=Ccg-RWE&Y@12>W4qJ%neg zHm^?fqL>xo#`Ft_PASc&ApF7Zzr6ao@Q4 z?i)d5NrDo7mzNcD#XujYj3Jr@p=Bk9qP1%qE7xyl)rRfD{tk3J%Bd6#SSI{>E-o5~ zXXV0Ad0i&bR?|C*tBDS)MEq84yM|M0mqOkWzD{>IXO}{iOk3L+HMKR|)zwGOvy3ts zC*fDM2roFNTP4o#uzXqKl=}gXjmq&nWuB~Jriv1_QMbf4o$csv zSS8N|ogo{QIwu??%IN|0utlQkD~@9;1zmg~FL@avz< z-@38-pG1}S}IOA9&;yFS^Uo&@h??vl! zq_WY1B+W)i>IH*D=D+?jQswnXPj4R%E?&xv*qYipT-<#po{Y;-M{)pci}(&|B~eMc!d^pN8atO?;$dPJHBwWQ=8~)hc^2eGb70SX(nNT7k6qwiXst5F zStCd>+~pn{7hWeq_|Y^pLYSQ~>lW|g@X`IOKW@gO01pPa}UPeEs%(a2o>K!1O^3RVQH;=)ZRWmSU$9Q=DDB8LxMf@iH@)*I?|Ew zKx-a9yh4!6b%LC)5#@1>Ft_V?Io>8bJnR{_uM4vBna*5=ir0bA&`{;@fEURdN1WN& z*&IE3R5^-BCPE|1&#oPuDxhPp7=wv->gwUE^t*YV!!liag; z$l7%WxaD0;g&@CJ9}9M_c|fs9qu;$NY}oIt?B7}?NLmtgjR?CsFM_S>Hgd`)fglGX zK3cGedqSn{Wr+Lx_A10Fx8n5+jwU85oaXu(IvT5KuB%e<9YjlgHJvRD;<}pFhMI}% zNzWS^XlZN_*V4RRly@U-Ev<@KOJnl{T4-%*e#YJFK{fSNWjHxHKB;U0LLQ+eNBBySXP78Mn7VPs^4QDu_?6)Ij2q{PI;D17lE zd1Ht(KR=(3KmJ%bO+}LC`|rQ6XrCI9#Oawd#MPjy{PfZPho3q9N8Ww(&v+F)=0lyg z(7Jt=polDV?^xg*lsGMMR(Fk(9P)^Di?^_P?Q-5E5x}#5U1?! z6=aznZo}gDX0dSn4%VJ}pp3^JJhYQF3s-UQVIpzyfvo()@0qLPO=;T@q0ZO%|9FvO>ah zYFK_Zg1ZsL+z2XEq2l!+xQJ_hx!5|p)6>!`fd3kxt zZ$Ux9GpDLZ;`B-$=9tSde)Hh3(1|&TUAj4EeUI?}UH=0P=%2&BaXmV|Z}HeSYkG}S zsBy*h?F4v-W9J!#f8KyH5lD8;*0yxv;~OE&BXEyzRK__gL^5leJB7KlAAx6b8~N1@ z#1}MDEd6U0ZUr(+>WM1qQ6?@GRJM|k*-U}#Y87^BMLbecvvBkjegx-{lvgFlGXe+S zbW&>MB&1=Y;}UR;tRPQlwoM|*$%$#$OZ)!0q*nElnqNwWAZj^lR$0E%&`o$&8394j zI0q-=9vF*%dK2E^3DlGp5RzHNHUE5tWUFOYuL>2f336P&yk`tgA3x>zK$SREd7Uyg zHl`BitB52{x5Pdyqh0v%<^L*Lx)+HrjpBzV{|ox)b&#MJ_O80V>tlYFft{av2au%#~Un9)rQWfc^GOnqyFYL)p9;E;BS0R51 zaa}7(UAmiyTk{b3g~m}Wh%+>+8g1_!rDDr(A9<}P=p3VCq(mrj*9Re8;#66Y&QgCI_usAh8OyEtxrl|LSPiyv+L zAwS&skDR=B1DDW5+pLWY9aL}Q@fiJ2ri zaXp3b@>=@I6fKghmO*k`2gG$R*{#D*p1%-N{891EBd=|QBGK3>5}&=ip8V|Jia3Xd zhQ>Fb|C(fUSok;e<>D?ko*0?5vAim;PgLT3Md|Dt#v-%^hu9`;B5KibisiJWA2(f7 zafoZiJ+%whzqkM3T2tQ+%EndL8@4m}#{`e6eF5SY-h-NDK#-{Z@ zUuf0kBSW~D+~kCgKdA#_6wN?GRq^$suycgusy2lnOM0Ir&u^MIwTudnJvH4$|H6^kkQD8Kylq0<#DAxO?Xzu_euD4qus>j8U5vNkC+d zG6zAG*DES_$yi-F#QNQK$obU` z!n{OiK4rt>&#OfGG@7o8*9TcXw=M12v}+&b{iBrhJbkaeY2xfFjmFf>huYym`diDX z>Fg&z#0{^I7gwTBWT+Td6K5*qRK0~;n_KWLeA-f=r9dg}#oZw|6nA&01PBhnowm5U z2WWBk;!+#}goC>UD-bleew^R^?tSk41Kwx9d$!EXn%Qf`g^=uz4Gb=Pk4Y0lZL46a zumzr8(o3Y)d}anekw%J4s6A+L&Lt|jRp)%8xm=8!vDW8VNa6j8Y-eCnc$Y%B*BuB) ze1pTVobtqaJvhwba%XzD>(XU~CYL*s-Bim2vi{aurSrXe;rt63q+T87c_7Dx)m!C> zGUdCL<7L@cMzFPe9)pg4kqYc$sxPUJr2^aaTfr>Xn#^_6;uFU_YyByMwL#Awh8>?YTXuOEnWBym%p)Ckq^%`j-eYhEsU;?E_|f4YF6Vf!P!!P1?Em-P=PN#+Fj z%PXeZfZq`xGxlE{_`nWUXgJ#y{JRHG+6{m^2&H1kOMoM3_vN#gShc><+Rpii8&R9A zCc_%B%pJ6rzct>u+@a0ZGU5Ef1yMy7LZ7K7{svDvbnE139H?^j9%%<;I~hHRLn4LzS@ttAo1N$ET>5lg-ac^Cl;SPV_T_ zWPAsalxu;LCYgUst_2G!ib2-xAn?#$Q43Co>TASctdjQXKK8_+}im;4A^()A{G4nwy%S z+h>>YVadfXO|kpkA%SokX2m~OFg}Vq+Udnr)yAB6)=d)H=#rq)*s+$+6q)Or-vh|1 z-V9{eoAt4EMZj0o$1Y;tjnouekG#5tFWWKqug-kC_moUNA}_8I_=H@x_P)Obf*vDE zqqtwkR0DTYC2Xy~4M)3JnRqF+aU5^HvmChp3dEIgQ)3gGBe)sZRoB*(H8K;=eC4?k zv=P%?@`fHOFy(i}%&m?z9n4u@=s?pJ+R-oH@cSEEA6pZiv?=xS-bcDk&@i^BTHvt4 zdr8%IaEJe>Q)KUP1y2vx&lk%vEAJ8U4lN{=4w|PsmLJ!n!v#xlX$>2A5~(`W$TvCy zGp5RC|42EPgC8T@k-zHU6)u)O8O-UiOpe5pVzXg46pna zE^-<}B|H^;sCNSYi-`E0-^1WbKR1ylS z%A1r}g~6iO&!fVB*MIjf?&AQ~xOlHh`~SD$52yDlISI|um}XYK6${7kiWc&o3C->| zmris^IUbvEzgC@|))3!3DErVP2R=Yb6^>+Ao2NZGVf?~1qKm`2oSv__CCPi_l$9Mk z87d^7d`;d>+Pk;%3Wk238g+R3=NmVS*{ZfCzDuHr#>QASJY=1`C2wKEr}JNie!(S^ zsF9}$!Kcp>XHtrGjVwEKbT#P$?LV6Y(;Zp#IGt+%Aom(K&Am^^wVctT2UjPjwWk%L zy%){zLcbV~Z?U(7+rsV7-4yK7*gPs#(7Bp2m0xmOk)H;6lhPV?5M{C^P<#X1RY;&n+GjN zRW@yw;C}0GHZ@)E{d0l7#x|&p`wP~gmZF_9g*|~At?myvGT26Vc{`yV}3MeOB;kcj3B$0mY zFTYHecRc>JGLce6+FWZJ3`nf%yWkrFe;ubLa5R}%n$Y{{h{wk0Wo$T&K=Cp8W%2T0 z-`Kz2=CW&zOV!8UKsTRddBS+G#@3&KX0h(b+&3!#wy6*49P_|wYF`bAgLu%C1;to| z3Jft)k`K;~{Zr+ZON$+&u{s|+av9tqZjY76wgUATRez8|3|zWePl$ymsM1yMdI|Um z$CZBY(ydvXP&t%ySZRt8M9zbI0g0>{ROJnhW*pm|v0gBrt$?v4H~ z-)IyO+Y>ubL&xLp!i?4I&330r3j}gpbDuIEAAj;weGnQ{H%AF%#L?HJsffrueTQ{|Kp6R_-q^T z)(9+p^hz1$iCNmYUIoZ1UEsx}n9{7?|C3Xd%T1bqXX7{@L#nTL=?g8E zm_v;mpLFJi)H^9jpLQIZAalDHgFX(vf1~ebSIMR^^9!neL`RER#(y2VDMX>de5Z?8 za6&43fsKtH__-?pH695f8fSP>if$_o{#910haYeA`NW+7tjr6xbGGjr81QS%SM%c} zrtF1=KaStO){xi(TqkO-s@kpo6KYZ~tiC|#xkJ(m8KmGQ^;4*@Wsqq+K!)5)rt+Ez zr+7f9pLZls*TXy@G*ZDA*Vp0=m6n#?2@-;Iro*Qj-?&E~A|s$zWigxr0vBURxUFGs zUv5gk;_Sc=SQpdcoWrM$hgyTVlhh1oTq2CCnCM=(sQEpNk0*Jbs+nupUjoU#DdSW{ zt+>x)QQ02|58fLC3-#3=4!HDxR+yK{>wVnov5j;q70sGm6JcA35e>p68^wx>r*X?bj>KC#_pKZgzPl?N_Thzbk6SDxs=8D))dRVPAC(9GMrt@Crv-MxsvQ zBdNAFo-|HTYS)R;{(aZUrk}lREiWzC=os~z#$Emgh5o1r{JJIQ$6bg$Y^PLLksalV=EKv2{ z*smhe+w`YT_j!&*)_LHWUdNN+3U@Jcu_PoZ$hc78QW@y;-h)_t_eKfok4 zs4ovzyokgr$t~m1>d*8{prWflj0oiqBTK1OsMOKMfjGf$u`ESa6#YiM4h6#fqFRnv zNeCi91^sKTLyvX!o4!2YCQi%8yGx?Bwdt6IsSKCcRah5qOi?&ZY@|Szv-%ovxTwS; z!*00EEBNOrw=W4?(84XD6zY`4eNt;XF0>PXDuBX5?C2$?I)_@>+%!0_DMB^z-i!}r zYHFZCNlw4S|Jt`82kK>7Qq&YvJElk`dCuz*zthQW`QWZGiAI-0gA(U)&aP_rX+-U1 zCKP2XDxWv2i4CZPhtZd+`vID-*%Z)gKM$^lxOB&gbk?IjCo9?56Yz_51Qiz3+6sM% zU@HZljeroH*kszfs^CJ(@^NZRuJIRa;gNSH7ycruiz5R^I zoiB4q3X%>F2nd8f`$mCQT(BT3`CpeHel%x>%{)^%r^Ao7n2+3+%8G?7iL)XRp=u&J z<2khb3SdS0cXelOcwne6eWcinSEZ(TrXR4ojIiscF_~0Hw10|&?ZO+B zMkD&KN-^4V-uRdb%P%HScRW!tR7>u75$IV0gI4gf3-ns@=Bp!ow#m`3K1x+$;t=1) zAg`wsPCjK$N}nX3U5DZA;Z06!D(_<$F;7EEVL~!iZ7jstY_=2KUz{&-bEQS;sh6Um z837j_d@%tBe8gT8=H}*q788EdF(nUtB))cXIng+7F;e*{0wp|*C0%R*ldf&j1vSj$ z{LgQ4fTMb*-H=;#hW3%a3Rvda<2F(k$CB^81ikq4sCWKh{>ZIW?Kg^sm&u%2R*V~~ zO2?x^(M^`k-u4ZzQzH__YYM>MZ1iDZ@uCEtyfQ+Z>?SS#>d^D)wx)oB-W$p>>gGl} z-9zyu(iyv@klFnUb&AErNa`dd2?I-aX1I1&h4$^r;fY2U5aB1Iv4uTiZPkIr1Y^qY z1Z2jggMRg48?sB3aEuR__P=$Y-3YVy%PJDn?quA!uC_05umikZQuH)*{sP{nxF>q;3N`9&sdUZA>%GM%SM|%gPWG{BS;&|778vT z_Wp7kTNEnce^vHMk69X*VOSFerp8d=VA|eIwxK8lFcbg%IC481LT3f1%$0QTXr@-# zxo&hviqxcSFR^p?^X@d>)OThNZE_i7$1>Dg=;Q2iYA7f`ktozD?yW5#X(&=Ie>?E)Md4kVuvGM2Z0?8od(Nqiig#Sw`h&@OsUV(i zJN{n;EWA5^FswmbJT?O@xY#_bXl1Nv+JcYE#u+4hD#_ZR9Xzf6Q?bbuR5P}kqY|G^ zOnWao7>350;eYRxkzx{N18$z|CNk=?3n-XNU0ikI=C_kyPxl zejORa9MiXfg*M7kQ|9etn@w014G?ra_@felrWv)l|MYs&ks=)b^aToIq-AZLbH15O zw3g5ixgY1R^Bo1uIeG3mttugQVeo00<;4~|b_|n~q-uE)4mc~zRo?oxq3xtpYZm!~NE zac+opN+K!z`x%5LtB!_+GVhP&CYPe`=vf_Sufz4%E7D9jnUV6`8@V|)&Yc?rkZ!=8 zUQ=#dAYY@tRy`$sm>yC0Thyg`Fh6g<|H)T}SXO}w%XA3<%PoQfl}vcESD{%HI{36d zuxLawU=<|JoRVB%-Uy(m8N%sDy>Z=_6@d!MoPVck6Y?YVt=Q7$=Hn7l^O2)TH}T}u z!by=ce8W$6RX0nOCbT1Y-qK_DA;$v8L_l1mlXwev{$0!7z}UKhOSjgD7_ho_&Rh7q z2b5~PXiO_pmrtZuN*s*w3Yt6#Uler^DmP39(qx2WjE|S{-e8e=f-8Y zBd;F7(^Wz)NSq}5bDik}J{Xk&r2%osw&FM&M>Hd_^lkOL=4JeJ- z=umEF0fn9y0z`)_z&pL z+BHvT=(TJ8zqFP}^7?O-UL*kyew8+5VicnatdHvj8uAP^Q*4?lvYFufSQhHqtW9cs z>dQ=a@?MoMuBM7dKv>5^B^r|IN*HW8-Z76xGgbRPUlj#O_mAv~Kkq$P3f{)Z<;4cq zPf6A`dGyci2q4pI{yfe|o!;`H>n^a=F8hP8vsxr8?mPlS*U1@gBW}W-Be{g+gnHYmp03O-bYJ@^SS7*Pg zh$UWKBq`X)?RJ7J$$P{}=1GiLO8GMJhV}W1mCI3wY_%;VRQ772)%UcvBOT4O{njGv zm7l7w>%uiL7hhjiR{(>d7_l?RKb8$BQj$#nkodi#RlUkYVjs45{bdn+Oe6M~77ngZ|^7TOGf)K9+3R1EsM0jKE_R$m(rO)e@9Hb z;+rHFcW&frX66U?j1H^n)+d?<#Kb09-^V3l$Y0ZKl_C>0qf*>U*qvLJpo>CAVlpxfHSs+N*7$ zHC0+_m)}q&cP~aBW(bYcTcae+R`fyYPyg!Ct^YLO418WTn_~L-f1J69j2|VS{7@sV zv)Fq}vCWh5mTDK3g-V-mFh|hM{r|m;8UY8sFuEk z?#su3vfLiOBB8t*A9%vOZZs>pQfo?aY{ar~OrLF;k%+XuDkMHI`N(S>O(k{Bs0BE4(>kBGof; zStDh=VocBLDM&9I^Z6&$fS^nxUs?kBj*KZJp57H$lYs9LIpf0dDbM#5KFLJ=+Qi#a zZA8AE{y7ad;4`4>>39o4=Y3-F#2G}sM`6ozfx;o|dD0;vo6n*2)Rx+)I&O)XnSNCZ zZeWVj;~DPUAIufq)%T%~?_|zAj!1?Pn)yorfm;hH^M7?-%I4Ctf{Mx)xW=lY^j-ET z76#onreSy`+YD0OaP8_`=aX%{ZZjze;5+?hFO{d^?ewHkPbk}HM(glDQb45+(;04K zaCT8pX0Tq|`CvV1WnO1ibY{(oajLR&RCIJ%b*^_y=Na7JctJ5XsqUSRsz-;ms!l%g zRpMD{^xl?f`dMJe@STjkaCM0P@W*ttpf0AF@@hZVLve`_J+(uCYeuJnmk zl5N-I^F@cTnyGmCrV`JW$#*K74AQ&)iO5L)R$SjEf-i`UM8lX zpvY!UR2IueV*v;HO$-QHW1sEGMM;}A&KFOmc!VTco6$WGIh_@7F6CCffT!ZkMH{z) z=XpoP8<}ixMAuEO61${XgD#D%Yq-o8K|Bk-d}liA_2MBtyDpyNOR(rH#p67&A>N+mIzPzi@~HSI<1keDtAj~bMeDYZ>L7M zPeqSW#j{8ViFYXoDjgSA8cgnVZ;l3dJ994(1Ru?((MF)uJ-s>vIZ`6@ogj{ABQ+;~5di}1BrT^o$y=!qe1`FpLOlL( z#nRz-@D0s3bD1?e6%%`4dd&|S#qvjY61(Gu!*@qvl@AsS3Z1bx&f;HOB={oJO==CD zUuvK0r;AZ0{k$KTh@IZ*Ibz;e_ejQ!0qTNIR7~5OVz!X!7Jgze{Wt$qI<6`>Q)mJn zFk~RD|D`C@15A^Inh@XOBB9vbA6n{esEYACh6m@&vWn8-C$JCQcsU(vB0^9Xwb!~q zH?JF{h88=0@duA5@W|&j+id6?=9gTCeeunX1*L8twZ3205l+(v2rdNJq?f#EfQTwHp{;_l>5hx=mIAJ^@@e_29G_NsdrenqmRgK21VZL5DF%1zkX6#%3DSsV)en|fv2JuOf zmaG?V^(7{^3Tevv^uEHZCgxX{r`_n`{yolpk4+Ha_$B^Dd_Yr4QD$1P(-Ax0l#+)Q zPwcGK_Fh_dpMIWHqqffU)Gg4ErMtL_K0YJFe~^S#?KO@2i-OX>B2C5?P;&;49gmBS zy?Mbqf;}5AIxZX>=|RTjy;#7jn*9@p;-+!~zq-5X4_@k!L@CFiLPz%zTAG0}(7~u? zsfuvv2y=S_7E69(i5^ZV`dJIZQ117K0!xwF!p@y`j~Au0ffZq&SV$8XV<|W85Ww>R z6LZo3nCh+VB#QBSsm4^t(ddoc0nWD6q1nWAPEOALxz#t6&0mil-O~A%AEU7z!;RB=F^p&FdxyQ$ z;{?PqEC~6VO_m6t87ZADJC0b;(0tH!ruhtl>+Xk2lq`0@QBr{u>yb~IPHj01 zZH>WE+ul>I&sS@JRoh`DDyBL_Ffq;b%eAGOwKY&CMog)tWMWJG&TD++eH}f`aMZ=m zqe2uXIx%xxuBT#=Yo5-0OzOG~8U=wHr@+;N^YO!3-CbLJL$Xo! zxPb`LzOo~USIe;8$z0G6n;5A3_we9nfjuHDMk{KM~f*(%=l1?0Fho&@2_ zK<2XR#90Ra{>wc@GzhC{?)(G_YOaR~dEA}o1lp@z>)Rhqz8ZJE!1~L6cJU<-?hq?D zP8c0$&#s(Wp<8~CdRYJomPVf$dMk14VC41#zUI{CJ3AE~*`zb?)tu@&X2NIEr`sOh zc-ajT`)$T0>FmX@Dl|RN=w!9*eidO0&6f4>s;ujNUvtg%c4u?goN~2u=~4ayxjZ>J z{%=Km+|+8BgLB=w-LtJ&4eYD7;NTEJCRN=BC@6d=H{K?fCGY5DYa~&Hh!|3EH~VxK zhzyKw@Kc6ZjM_?yP(<_R{vDj*E<_aORPnht&P^`rmfS9{X;#SBhou$UWsx%5R#O zUhWA?=w^T#K(EcE>1%45vsN29?P>HktRZs(p?3lFj*T|Te*YudH7 zcQ&>eowz9&d2#|yt$#+pb9c-UThx2tVt@jFOzxwjrc5-0R{s1w zbk?t%{e~Z8FfuSKbZ0m%Xx*6f7K5<9fBTn|fL_s1sc+TF8p{Q#WLNVSFCoctGMIJpf9o)|#hu7NZPj$+7-aGg^aepzr|BmK&t zUFR!V`zBY0nye&3{snFz)uAJM;=F#ZC7NJ;8Cvz{<{;jF%$*W~!(Qu;hrXf7kb{Km2ghPC=LBm#Uxs<0Z3aj=!vl z$!iz^^vt3bXI{9>{jw1!&{w!&m%ZP7nZ9xiropY>^ESCNqzmt``J-1~r$_}!egkh3 zjWsl|Ve(r;j{z?)eZzz~&S*O8?)K%O{?pU??Oxs^#TG{5^akt0HPSSyLA|x@zFJ_w zEawJ>!bdBPPNzhwUQP5u6y||ja3Yfjzu@8Dn^`4;0s|H-{X#=x%&*u)6+PwH0h9s# zuA_Zq_4>n8k0pYeu6WHu9=vEyyYWi=ZlXW~`6rmHT8=sxs%Ok7dI3_#F*%X0q%x00 zDzX)g?!h}Wb4M>45D+4m-7vJ6-p;R9w`Iq*3WklD)}!2S*qzs$Sg*(S*LAvwJp9yh zc!533e|;^_6XHIh;n5UE^YMA+v?m}h)Xp>;F_9Z%%Ncf*w|o>2`ti8+NoWdo9&Q#e z9{WHcWa`Zc8g$||yG-JeKYfbze<%@j;N_jcJE}2y!p{qAdI?T65uk_A(5Mw`M}skb zEU}RLg*uyE_9#@;k@nW~i6@}gJr=q7PV=Zs)Xj07VCvuYIJXuJoS%#SyOpa_zA9+H z(3-yj3Cn$s&eqt-M2KI!y-e5Lfa?!4fCdR7YCzY@Xg1pM^6b#@aY=FY;8oS6!tsLo_FABWw4_;3ZcZ;Id`aM=CVl%|VQ zcsM6qZ=neqR+%PNU+uIP&EYV7%rW?N*LQqlAz|Q&cu=H_aWCrZwKe-9^p_~=7^hww zetdv`SI?^*5{<7Z!?^8>U6;(5(1FG9KYmoOi+ax~sE|B)^yvdY#Q$U;Zcfq2n1*wjR(GYwG;RfC3<|xu{$g1kFhIQYg+Iw+S-`t(iRz+AoBL#8< zV)rtmZ+uPR4+?S)S2=XeQhQ!lyR{R$ADe_#T$B#N4*ZC+k2ik)CMWLvH_JWrXcRKC z59|4QY~3q!IW14}QeMC@$cX9ujRDTWxD#WqYW{O#@H%kW%fgFGO1Y4xH?fZb6d512 zv0Vpj$!m>SmvQbej;p)=i7|mRi|;W!p9!vFS>^SBrv3sgc3rVLLbtTzgNdA5D}1o6 zs07ICXhk@3XfV8zm|>tQ97K+zN>YNAl0bWRJ?)*&No;=Hv}P-#JgHyxzXXv-9gl^& zbims)eh1I1e=8f%MnVgX#bK%#lyup;O%=-ku{>Lt&k4)TYM`=2uqybN_r=rAupNI8 zt&iC;{T@QLIPx91^eK2RyxHyV7!Nm1$D-}VFI%%OiQ;~#9+UaGg+g&UG>-1se?!F&p z9R2%A{9=J#5gg1k$|JrxFki4nq!I&+<-YSxJNC`g%|VHm>$EE_yB;!isH%n4sGobZ zz}u`9dRd}CE86;Pw&&xx@O|{L1>ZBLL6ks_HR-ARjJ5i=9M=yb9AogCse#G`urhKn zdvl*xcMsPGDdOj8=)(0x#~~7D-oE#}DeJ2?-ih4{MVapm+fx9gH%GsZcv)Dxf(Hui zto=))56xcnT96jx{gMjTmApenq=gW-&===JC10cWzmyiyb2x~J{oNMV7%muKp6pd7 zxCE*n zGi00;YQkuyx%;<*qi>!c<2l|<(`vtUc*uM1XQ=4lH6fjo^|RnU{Agg3xe!<%hK3LA z@6vAyvivhmZ}r@08rCBglrPnJvupMgVXrJW(&eY$y%e{Hg9E8ufQ_^pe8ALo^F89Y z$=M0WvS&VBzatb|C6~`p<dj3jW`aJe*soc*3zS`)vrD-S2>tyaaV(bjR9Ws(f zlnvTHQnNyiZRZRmRCq@8uq^6(O$4j*EtO%c*;cU55Y~FvXj?>}+qeqf9p2s-Fzx*7 z+>gY>p<7Km3#haSZXj{eu`Ap&II)rS6aLmT4xV)0?qN{QMCz%$|FyHlP@?%kdy3;F zh=y7?#Zjlmp+cM(r^a&*VM4_O?B5NYl-M+x*dqTSe+SCAPG7G(GG&pnCFC-Fz)WlI$Euk69=~ab z)e?R6N(yC>xV9I8$7En&nLhJxMo_xSI%^M)z>jRXxzk&IKPEC=%l1psCf^VooWK1; z&u!oSEYbhCayFl}#-2)@*iD(6nlx6@wLqzsZCG#>j=CAWsx)#?8XNUZ>L3$1Ad>!S z%83SONnAG?j@(&(#}*WHAijwo^BXl_FZas3^KJL5=52!WbMrvVJsI%Xaum)l`Dl-dbqPEr@|#I?c}1 zp3Ud`^DV>7)%-{QrFaMM6$$gslY+QwYBJ^Qq<%Ju#ik3M8psU(zQ14h^{NA3_tw9y zB|uEYyU1?vt95hmZ|q2Zj*V-^>sa_{7{tZNHcF@LM? zA)tocC+HU$%Mqe9xV^|{P;T3H>8j_Phh*zfrz(9e)uOn+m$qj=u!Gk$EPinic2f;y zx<9lL420$O&oPQSm4;LdP2iYSEzACjFU+1tk7S<~BWK*~?W)SM;ubk5F($%HB6Zhn z==7p&`a1eU3Xf6P#%s<*dB6{gd^e^O+b5sMvKD<}6?oV;o7Whz?7+>{(+fu#fxi7K z59C(Wl|{7TDm_i#qpYYD7c*xbmQZT)sZ0GFwVEOgf;$2t{XfHJasdO+H59Rg#UxtF zFDjE(91dlw;<74Nw&gr(31|N%HLV~ow8Kt$nKOp}BDDt*1vU0RtpD~Ec^hRmIK9wh z*Q`f?GKvcp_=!ptHXz9yGH)EEy-l|bim%-70jNuEE#R?q5pdi*r{ZxRGNTH2y$;L1 zIeX^m+qPs7JVoBL;6w-(MC*&;1U%c(KdYD47(t^^btG=pjRht_7>hHmmhglWMN>kC z)D&pgzm#CJad3PL^1{fZ(oK;?CL!)7ITDr=`_!~g~bM2 z0C9_6P$Rjh7h;Rwr(8pTykc|TRG1p^f9O{yAm>VxgEyyDuT64XVW*CvAhxThZcB&-+-ZS?_Azeq`j!bIvcC z8+37$UUZDQe!^E@RNhkzkqNpT;R#zC;69coT2f+PJN4}w$L(h3{bmB}CGj0Lu~L0Z z-x@mW$}X-VMbvB*SKvB5y$TVJDXIUR)8EhVQbPJaaMynwY4#o@RWhKTsv|<9CO_dJ zo+)@ZJ45(9R<870eq1H>iZmYqm-<2lqIM3VGVcBjiflG;16$EwQdp5gv z+}fx9lwp`1dkxo)qVd~B?1`^Uy+3H=DmjH;m*r7Li{od@8r#HEMOpf55)4S`BQP z6mvo|8Sq_}QF-&mP;!xb`bUHwUEdp#`UcBoSc9=xQ+(A`Jg=5pN7e16cu>^$I;v4! zqD^A|bg8tsLffSXZ3}TP8h%X-1(kN@7g$vI1*!|6dcmKvm^I5L+_mc!_3n^lFPw!I zwHrjiP_xO&_K5G2L(NfIFZSN6PzmX7>-?FPyqjHz&6>}3M53F$GHkCj**HT&T>%7nXi8r(&`+N_DPyZ5ODVT7yEGch@df*h+_ zvRA&qFog-&UGohuH_e%a^)k++#|rsFRr1(+I0_(*jlxj^82``akn(wdNqnWK>tj4! z*M9t$u~X0xjKvHed%q@D_o6zqcs*_{spA*x{>gVTZ4sGP=YPx0S}Dq8H@ZD6Vh_gy zo0@{4I~l%N?@xdim#keT-QO|W)spq}Mx>Ul{5#Cqc8zp-p52rz%6-+JUtB=kx}5K&H1vnO64MC#%vKHZ+u zZep+e-6!xO=;laqb02i|#}$^>k^XNZ@&B)l#FRXyiAKy|CVR9|bG5Ozu<1 zcC3PSEw2eX1(ExDU}RaIC%|WTqyii}lrLx*dJ{Vc8Af6~ix_9Ja?|yQZ4@^xu6KHy-ZQ zSw#^X3bISi1gaiu~m3Vh2B2qiXIY#E{D&-+ME%*_Z^)3kUwU z6W5xjV_^@VrVkgYBE5lLGGxboW1NdNKO!Svh1Y~ko${*|&X$2`i*#7*i_=?3(_4wJ zl8&?VJ=vd&*||;QJ?iLl?99IG*^% zzVyiCwPd$@PWQM;5qp&n8~@IAZkM)qYzzO@f;_5hB5uY)Kq@pJ(#8K=Xt7wV@8A8# z+iR^5yhgNN+dLEb4sg1luA86aNuK=q=Z#~lB_8148bo8?tVD(*r#1{HO~gLq&TTzB ziPtQQ;ghTo+qOyil#}uq9P@7H6tS-d$1wQqJKZ1aCtl2NGyt)5 zDY$CtrOvvn$0dXn(;0;hi2P&>RuX%}cBH5Nc#K|V7_I*NWu}rRJJQh_KihE4{qo-Q z(ZsQ_scEvLBf!1XOpA7QZMMXq+wpDl!cDk`NabG&7F3d7TK>)@S6N0uaKxXWLtQM& zGxK@aQNIpTcl%$gLJAFnral@XSNC8wqkmeL`kd(i6;OspIX+v#Zb81E! zAQ#fObsFn(E_t$fcs%lboYbJ9FVz?jNET2zuS5kNeyV#fG1?2oiLcqkE ztxH*=YN0Qdei$QS>_ihLuzC-r+ik)ZfHd%o={^`9DSi^RydS;5mfa)%Y}RejzV7DQ z=M1my%a#o*i@Y9me=>eKy(6m+8ouu-fgq>;@*;X~kvO`WVbrJjphx1M-!63Bt;rq2 zC5txZAw6L<9X7h=~N#S^0~z*oX7ILv+Omc;ya>C*-}( z6%?nww*y?yvoR`ekTj<=^t)=^;^;hNM&6m=@fbr@_OCH39|PQ`J3V2{_n6!$*14|! zxk=0lIkemHSDpQ5Oj=#<#m6B}(%QQ}w#GS*0v~7o$VcG@-MVs7yfaBzTMbV2dRX`% z?r^~bOFY(ReL7md9bE|>d$xGPkcV#r(6wGyUr4NfcVl>$^VC+H#4PD zQV6x;)YuVbYSm65Xg(Ai!;Ctps$`NXq5rTLVzbi-&_sTWR%2B_)WH8TbnnDWpFYC6c7bvq}i1qC1lrUB*eI0`9 ztc*DV&CS(~^td%gkD`Y-&F<*dNlbs1QV}dWH!(4sP{}f%G(5aOqmygF3zaz|SeIq4y|uDSoLlI31E=W{zVR`Bx;221nNAKxKeGUsqy&w)3DHGU|* zg1{4(C^yq|@Y=~2hsW%lwwi%5(douc<$jN4UDiteI+sCNYC95ijorGF4UOuzGSf?X z!)rm03{QDM8A==a;3KyZ6NKQ$e4mw1*5R?q!bPobAq!ohDs#K6ch zFBEwEgkmZ-z{NnQns>Rm{i_dUPt|z)`PZ-cmc$~_6-#6H z0rPA+(p~?7uic!~?5!4Ug60UVA0#WF$IR#X=UX>2ixfPa@apo9mDc)+w4Uv|AVjXC zl%_KsD4hh%CS!#4aP!xJjG}ztR;tjO(h?aL9aB@bKhids#3A12orkO1M0$HmN#IJO zl!jCz_%CrQ<4zqU1IdoA5;41L!ioB1U|HR7-o_~kaOrPf%&D%0XD2T_fMFGc><95{tkyDqTg;O)cdo=#uawuxO zu3s>7H->Ws5HLW!XX86`L{Jd$4)NqpejWAuP+)O6O^|?p|3G!X`U&;5QaG=l5x7 zs|OgLtP#j-ING{I>2fIHJE5>vQjU}lgbm6pdz;o6>yy`6*2ocs)&&w(E=fu&V6YwK ze2CND00g}XOS`Xgb^l!5c&LN1|9w#Zip?k{$P|O`E6o26gdvm9*TQx~LVDtENRqtJ zu#k{#P(zA|#oJ{*4~<`N=SrgA30cxiR`hh@;*WC#&SgCs3+zSi-9{q}uJHY;#c3EG zsPx!HO3Jz3oJi^U2&xZtN|i+T3Tk|<*>;o%A7l=m;~j9vaqGK6a=|$r*OtPJ;FKqS zv?)qeR#m#a&$C__dFdwF8GJgU-m!`$N)q^?ab^;1XnTcPBt_+n3~j&e^-q-TPsmoo_R5 zzti2-C0)O+sy3R)hYF&hOex=#5tp!2 zYhl_Nj2Trr;o!cZF`FK1DV*PD;lrGk9FD1;jccwcfx}(6US{!yP@pIxMpHX%!}p74 z!?o^dt-tb2@(|oMw?{*9l7g0L%6*+5V~E6LAU9O2%;w<&OdxuJOWY8_Q4}9~kyrr< zq|(00bm}sEKi^+hR5{;P?OZJ=J)D(Zs^Z52t3CSib%w^T&57io-N zGkuw4Z)mmq8VtlaQQ{49{GiQ=Z}lZ3tF<-TUw#c-X+n6=mDEcN4L+J~Z{!QrGHOo$ zU2V3%FVK0Mfj9CP{riVP;-}k|Hd*Ps3;Ld1nn}6-&&O$U>4@^zW|y-Wb?f3KP|QE9 z5FV$ZG>spzx)f`7ikgaORkp_G(oN|(FThjV%6Z=WHa{=lIa0{5^KiKC7BbN2S~l5~ zwexw6ALeq%s%e%f0{D1BAj5ch+k#ZHC$ane?ICaWxH7YTuTNT&g>DWB$X z2?zBd6JiLma&W=NoCNUG@GRpSm{=0$XlQylA$sXK%ICi+FvM_t=}J%H1y{bt5r#+L z<_8F`%9v1a!Jj|Tb1$J=w;cGg817n|LAhBNv>22aaiJk9cV*d&Y%)Z{!FZNR&C2-h zIBhdjmvv@GCiwgF>56@0Q%dhXn%Q<)X$6^akjkC_D}Vpu;@6y@%L8L^KDNTEp*%+; zvXRQ#)S#uMcWorDM#j(x?lqI!b%We~DQM{rYso-@%VD0=FY+TtO?QB|Ko4ZNqK40; zwPROyj5mTmZDo9$a-F~GZ0doNB-cbSi1vf07Ak|F?Qqwy^yJmtw;`aRu{fG&`-xBe zk*Ow6_Ff5fhphgv?Le}jnO+Fn&_r`zZbH8U^)*YSj3xtjzX_S9jK*P6h97(=)&J>N zO!`^`4MZ`Ro|aI{%+<-Vgm`ltZTS({V-k{W=N1;Hm7I2J4o{80g<1>QGC5arBYw^* zXI}`gA9<5q8?D?Khk|;hXCyGhg2BAKLg@JWdN9h9oI7v zh=!B`Jn@)toLm$7$iI<@Jy}$6x}+C>9dr=;7T~$(JOX_BX5hIzKk#xsFuQw<+mhB6p6k}fr=FA2(6I#ImyberFPycztNnu`2eUpmUr^`3pT&-KeYO% z6R!|R852pS&jo?p1f&*h*t?5n5Zm0opN6~GH5bVvwQ`~Id(B~RJc#s4kCS$d!yrxE zq7(LcKZLgb<_0{ue7l(1IT3el|L>vw%;mizqM8&K(h!KZy@SMi+4P2TA7%yaCg%DD zz(KiN+y#McljeTHP(?)*=9186qhTwkkwJ9`e*U1$Vo!{6v|ObZ7KU@RYEr6%jVCi{ z?{UdANm@WabY!*w_ra^-+=22*C>h&zK|Do0w5m(@=;ZOPtK(YPXKXga5y3Uxe@F%h z_O_?*8u&Kk+nx%^oF1RM0Qwq^Deaa=xZniVBq063jE2#`sx@==89n7}(p`&i=lLcY`%xyJah>)>5tnYY0JchI zIEHSI3<`0hC_`u34y#%xU156`=Y+#qEtO__<&Bmc4L*P%0)=Dts;Vp{4U^&7kE&D`j%AOrXmR{OZf0KD@9#zOz3 z;wNbgx(^eEcikHcunM>Zg`o{(t^SI6T{|Visc3ZBT*}s-Hzr4rsCDK&TD8FzY^x5R z#~8ZAE%T1dMr-+N54T*&%&+8huK@owJiH;pA5pa17BYyG>M}AOm%{k8N)&?WTF}pF z$^EJ(#yOv)b)LZFIQd6^xcA<{g|<8PW6V+r2|bBPDzrxdAzdJ{aVDNtl(p!;g-l>r zb_@qyMdOk*sI#Byv8N7OtJs2`K+SYxN<0-##E@K4LQE2kT)eA4e!g{3LyV1%2z@!(O565tkOuiaCBbY`LC6RNpc`O z&6Hg}r~c0=r!;nn;I_joj9l~?$gKk`dPO#e;S$H(XOyGb+vW#|&2!uSVIW@ds<=EE zTbgc?z!0jrx%uF;PSwP70$N(6{#X>&vr5X5Mw>(~W2TL^z8;^|{>uwuUMCBYoWeci zzT(_hlTSxqGsD;%XB-cV_^rv-T?Tp68#_W(Q(HkZ5c{d}kM4yo^ywl%&QC%R21du& zA>D@30Da*&^N$=|Vw+>! z#`m4CbV0Q0#}hwKyv);3d?N8--bTl!J1X<4eAeqhO(9v)#h$rVikGN_6u*Gal{Fr? zsXz2ujTy|--m(2giiZ%=eMcv3?o!@8`EX$-B5%_YKJi{SeQ?JAOosUO2>-DizJ<<5 z=^P5+RJZ#r_7n@d1xcYx5pxhNy%g#VLS~hTys@#d_L9?or2ox;@xcz;w3XkW(Ic=2 zgjQR37k086zJBtP)7JT|k^&ZC&uiJ+yle`dkUspzUq{Unve^XBH3Nrf($4kAJm-0+ zldH!a*(*R>Kec~XZ|f}^(9_Npp@z`wS`;(W2xNX5Ondg-z-0Jxv?K=u?;o*saa6#X zH%PG7tFCArKlV4X%8FrYxkOA55Zjsz!}eweWZJCPT-rD{3gk}*bd=s_AC>Whtlb?E zuiJ8V+7F0^DJ@W}UJHj6%?0%^Y_G3`k7U~|&5Sq7XI+Q$vr zor0L^-$&x1GEUExIIHr2F@Eb*YenqObFuG1L9 znJX7RL|Ir(%8a=)n0YpSwJjGyjM5N8fw8yT8`v1dmUvvd5-Ym#OI{OwEnRnn#>3=AAl}+RTXP z|8pqxN7Kswb4H}C#*pL$SSJtw7l|8ocfR|_5dRw-2VRnYdXK3e`UZiJRYD;3um0a` zF`(YVM|7f;#*UTAggnG;T&9$GJ$f*|u*l_u_lTkBbI$Or92^Ry#6&UxKg*np&FVPf zT*adJ5XG5iEWhJ>w3-XMxv>-t9=sJ6RWM~%PX&u~RpHZG2%l}b^A|rBS=5_c5Z4gp zuY!>_1+Lb*@cRCu!ah@AC?XT@S&o#My9q2WaZ``U@lBOB*^oJUo&XtZ(v3 zs4$t@yObBsXCps<)TtBOH{H~iP6zy^)vNza!1g_sdCs{`{Aup5&aT%Ye1H_%o1>bw zoTH(jG66R5Il~?q9dtlR0p)`xdIkKabVUnzdPm%;ZhZ2yLQhfBA(9Jl0@;90PO}n) zKi>H)kuJSrvOY#PxC+(tfZmGsq7`CLP1j|w`H*MUtH*-$+hR47PikFS#aa5{?*Q@$ z&{%6#OL~2gn?VN-L(6LWVmnal^1%n4Zz6!hYi$+2A;#wMExvg$yu9$2O1*~%ApwDE zNnyaIgST2~b85Hu;9!|xbIU>{N2vV>1BDmcz&EE$#(%h(NRc^dV1IO4C20PA7I@dqYJ$<# zN3((*V~v{SvW|rGm0Jtj&O};97D(5KV|JqCVtz2~43vFP!`qO}n@a`gar_CM;;#2I zbe}$n_LMNLgzwO#fY(N&-4gWoC)}M@sAuAnE2i9@rh8Suc7jQJd-9Ur(xNoOS`zsn z8_Q&>U9Vo(GHJK=qU~rmZpz)B_}m>_yZbW@$&G!Qlw>aASq;ra9tEuIhfp|D*F;5?XJvPx;iZfmCF|2D{I`exuxTt;96D5}{#CN)Dv|~*lip;|8wYg z^r~E#i2wAOOK9Nf`R+n^R4|rCpqxE z=b*^#r@NCOpC7xbBy%V3dSz2Z?p_n+0&1s?J{zY0GA=7ErhGm(j(o}72kRO(e5rdE zDQt%Aj+w?LYE_XAw)j3bb9j#R9^G~I345pb(&5d6o!T0!^hj>zBkJ6QT2W)FL3@VH z%T8I2d?K(xUu_ye#$l%4mnFOmnJi_dJr1fIb{vqX=U8jgH-+rIa!LDdzpW>U8*WzR zRWrm7wA?0U@5KK~9&(M&=fjPIxQ*v}R=D6_)iAF>W-9y^9M%d&V39>8@q`9YEjy1m zST*wa?e&?>r1MAposIXKo@trk%(Ef+6lcpXylckO%w^nX?aNlJsy&u8T6>tTYJaPt zQeV-uo1RTNbR$ItjSD%M7D6BB8*5Yke(Bho=0&^GmDWPD70s1??Lk(JbXvAM!&NIG z;dq@4w)a#kZPfXAqi4Lo8WP5h)KD7cuBHpOl|xDKa*VZnd`>{%$p0$UuTW~TY>k?$ zwD4|=;mhJrZ)>x=We!Ct+?PIEZyJgYEWXbsVw-vX4$LN*Z29aiH?bJ^`?l)kzjinR zngiSpin)0jV;kp5cf@zLNrh&H-Ho+CF`|7dgRL;f*3+`bN_H1U-=|Rq9OmPFXPQs^ z;_+7Me|(~a9jnq`waj-w9B$qGF>{{-S&dTL_-ZY+e%X}W8NM!#8RUz#){m>3Kdg%D zwR^yybCQ#j8h!N%!ZIZ%-6dDM4QJitM9ORY< zg-RP`Jr|S@&&YmpHu)7HnNL-J0*QE>Qlq4o3qwE~;^SQe*)T(xT&9HGD<#U-$ z(L=g@%O%>XFC{O(_cJVur?Xp{{DWeAe_}Yx*vH7^LN`CxC03Cm-jD zHtMKR;*iQ{H0qs(QfC(pz~>o795Bn zHE^3UZr~9=b}TE#GGv))9{^$w+LrUT2;P4MzlGSKh8m0Ufy3TRT`eyDn!ND5qyTKO z)BWLO;{=PDe-Z=6=TB~FDKh=~7~#9ZJxPzH4m~m3LwBG_SDIpWg5E)y}yo&_N{;3k-}z#uj;v7FHdT*8N4Y_Nl% z+DfSV9RZD;p8Hf<>#h57c@sf_yP<|Uev`JQ_GM3tu}6h()F)jVo!_s`Cg2aYO9}H) zO-Fl&*!UdvD=_9Unx!23A>3fSf#Hwhj&a7!HE-)MInSf@>zxn1;3<>bG48sRT{1tL z7z76jHM8~ykF+KApm=gNM)8zoCcDD=!G`s|1KgN@~Fbzc3UZOc7u^$uP+ib9O?zszZO^|Bw4TaDq zRjtnQw~f^4A_u88^Sn-|mz1bPam5_gX?GrFa+6x4!+#k#1=PtMeE)kCNW1*&2uBgR zJ=`hQoosaHaKSHu^v%SSWe7_$82xI@PN8m0DNnTR&LK@McR2iJwOi1@xlW`TH)J#8 zlP0PlWWuGyJWErf4Q(5!g(COObp;hG_oZJ-*Sp8>#ZMnN))Fd8$naC}7~x>$IyepC zRcn*3JH%Tg4fpC#6x;A!MYa|3lAZg3CN$frA|A+IP6r>?DXN_+Ej&9WM*{$nyavDb zr42Ziitnhho)|94iu0l3Etf-+&B&+Lj{TPVc|U>0t#!0&)+Hc!I+ZlWHbYRq;v?Yx zU?vBsYLUF1{FidHPm%p zC8W35-4uVwg6)JuIn!rsc4QX-c`)665q z@T=qDgktB-gSHsB=?_*qS38D?DmZ(Rt6*izmY-u79l6qxKu7!@l+U3zxe{jZjJSfg zX(3vOXC&73?4<)-`>N?`2vaj!=^WmGb6OeWwntMgQH3M*6q_Kigb5cG0BntENN<9V z!Ppyi?ePOVU8g8LfnmaMx{EGJ0K?jnr*$w}X!wzj9g%Ar6>%TB@h6?OCyOJs18DQ^ ze}Jl-;B;i6H%dT_E6NW4q;m#9x;g)B&LguoI~ofMLw$XHHHQ}#Sj0NB0$P^bxBW=Hy}dy}K?G2ms7-Q!F$L~XIIE6kT1DQa zr6pq!^~)RJm%p8V0bl}tz%%$izX9i)OTJ_<;+?$wVkuPayHO5VuoST^sh9B;%!D6E zh)qHV=s8aaICBX|P_*;DT!@z78Or#ies<1X?o=mf6>e+-4~M+Sp|?37R7l00I;rFy z{(B67F0PXIpi5Wx1F3XR_&1iRCP%b=3XuWcg!0_eveEVVO44=dBO0LL7JyT(rULON zrLbg3uOUMpapyCVmN;1%Jy!I9b(`vjcZj!WzJmhiE*FmDd-jwy)_%9!TFeI`o#j;A zjJl044)7IVO}Tt46b-0hZ1bCMMWM8>ms}m#YfPH9h?>tMeAa;S#X+eL*;WM`eM=29 zzI(QtJW1*NF_~Bl1uOILN*^(qj~5$!nTkS*?TdBly*I7ELF?;-u-lF)_=&;}>#Rfg zkHQkqhECY8Y3A>qHOFgGcpaLY(YqC)Cxz%Su=I$QR5lIfGdFF_AN_ZGL%h#kN7?uJ zq6J9x*s`>Fk82h!U8juc=)bVh;fVF*Y)Bi%-PMO@mvYFFw>lHobXBB5Zum@HqK~O$7>d4q!^NZaDGvg*7a_C+-b_z_aA595;nshP6 z2l~IS$ARy-t^M@o@nckUjN@5%qkiU)0DtAfs? zP2zN;wx@GcB5Op2W{KD;h*D28We%gZ#rGn0XBh0}YtKY`*KWDh|3ja2!i|`fK|M5P zf|-3CM{>Qkn+{|CxUTk_?DKsd)1_rN!7i_oEloo3&3{Ju^9**+mF03GYp!Mv{Xf5KsFr?oQ|RA*t%ooMJZ@;d697fB#23E$l7 zlF5ZhM0Wo7wR^M-0G6|p0xa0bF{%#~%Jg!oa<$%Oeog)#QAyfgj`ckM&s>2Q5dY1$ zQBaD$F~G_U_v+{WrUCx{JOlPPWNCHjZ6cL!ySMrlEMHby;)sL(@Z1wR5E&L%ZgT; z?$!QZg8l^rhXl%e7W6|5 z=T~;_hQN~^y$Kaip0eKAn4_g~ZCPPtfNY}=@0Biqo47a*v_JgZH z9fOzh9~J=74@Oq%&<&m;dzq!w0A-6^m{!yar*l#ocC{U1MK8PS%F|0lE(5?VH+VbA zOC3=1uG{X%A$_83S0@{c+&X>Nr5pB_??}IAowkeK6OPyGlGA)BZSDHvSg+pcIXO9b ziD63#xr1a@99EG@D&_H5NQHI?gy;`|v@j4jyi9i)(A}wZ4SIlM_VH@#)^oY>Q9&;^KQzF)^T=RYnG-tejka zQBhWPwMNLX*gfO?6)X^q;vo${R1}KAPoEwQ7&|qc63BWMt;RI|9i{G0+zY4aVE}2V94adj=@*G8xreuD>tYP za9usUEO$oqWuvuMWOr#>L>Ctq;*ye9r((e-1(;{{9v&XsQYn=D0s@v`aKf@D23Fjp z5iMp?ZrB-5TRRnS)!mEXVHH0??|xJ8!t(_leX-rorlzLG&}{JxAMy5A!xydoDEPll zPuI5*g|m(BF&{rZAQN=^inTGCs}vj*v3E4rcfLvhD`=aYz3F_`V;$8`7=PF zP#{qtdP@|zQ|k8NyRa}+5J*?*$4z9pCiTmnhOc;|1x!{q*Vn(!&L(Et`SO=>?ttQ) z)F35mT>+j0L1pxQvff^XS_q5VE^e^+5px(z4r0$vDTsrb+OMpPRiR4M#->Oz#nRH! z#N6DvfLMHkX>DyyO;Z!3sVM~l#Q>-$`~7A|`c}B(COIQQrz%mSMxxjQBX`<564P8& z_2t&q7RBswGX+`wL+C0 zXn@=KU_mX^(s_pm5%A6`RL22hV*w}kT&Wx4NsF98SdvGA8<&;wT}=%Z(hE`vrtkHG zD>G&^P(~evjA>^5$bd%^R7LL%x27DbAK^EIX{q}uAlK3rOpzW z!$FRH6n|`DH@AP`Sjp+w<-j4@=P_NC`SH1VV2E#4aMyA33#C6u&@-s&L`{d_XlB*7 z&1P7ZTI5rQG50g~#z=S+F(^6UzM{90xTv64c8Dn`5r_9GOBD2~@r=dMiUpt&vI{pV z51rJLVN%S#5_J>h71K<#O3i^;ZsQFXI44_G)9Ibmgjgc*s=zy3(o}=Dx87fP;ZNqC ziDsy(5oqG(ZU#s@Nm2jPKY?zdE`eU69)W(Mex<=n5v{DA`Xd~k%#f#JxOufI>O~Lq zqY5be3W$xed;X!p7^JBL>7EA4ruk-xZLfjO=@lHVf~Q|e*GdDcSu1O+z(B&?T-XFm z-Vdc~A%rsJg4E$fMF_jTN;N|VovKDueF3}*+{Z6bSFU4H$e_e^jI%b7G4xj7Hv|)f zg}NX_EpAKv+Y62R*_wE|vE8PW^1t)5_bXwP2%yuWOrf+BzzWAIA!JclqMoZ)n6o*) z3bCXuSnw1}p*+FCMm!V6MnL}Q;*!BT@!WT1jjlHd-WJ60u-x8=0^U~e5|`nvA3dnt zh~`E4h)Fjvx6VMqm7$9QY$u6)vjj>kVix%&q9qa)K>-6;n~K$3&h#7U0q!pRQE$VW z^&dZeBroHzG#A%uRC2y#3a9Dim)Oaw=>ai*%u7+PP%5|27}1E!lP-q0g(`E5)c9+C zV88EVr9CWo@QPAR=7k|LI0zG+@NXx>Vn4-4a7spsXVfYb=Ef^C5>KzTdAI=S-@=>N zo{!JKn+PA`m#EN>axP%9K~U=IyB9d8WvFUYRwHopEXayv)o}B*9vVsHiN*npib{Al z`HlbGIY2W1ZL}p!^~7aig(ZUf=?rVB^8(96$|uW|fjg)Qem7h^gA)!4wQMQ%K8C_C zytH$t+cdK3mXY#~)Hsyp_?5V>a8NSMzEXC4Dxg$1rPug`TrTPar~ku=w+^DtAGe<@ zAz>A;_zC!li93IVeR$CoWTL<;#rZ^)V<0#yzdB2Ohr5MkW~|BQ7|kJsz)(*>Wt`58 zv0t#c+oe%ZLQ_&SE#qlS$y)@fnxB?3g(?>@0Oa};_I{xP6J6^F` zvAAsMe(`{O2Kgw{7f8?X^Wha%3_4Xo8nG$Oa@BMxdC9iT6oalk{0O}2dWq`#q+Fd1 zI(kDyhVJ1CTr|iZ>+EOVOI!*(jczr@T3Fn6fEHUlg+}~6t975V8ejAIG-CVF`f;eK zZ1<{CTNSYSL;XJcg^tOC;&SZc?Gpe#=iLLFCIc2~adEMbb|Jwzgs^~=GOs2#EFm}V z80QGbEM59*fjB~5EiPZn9!s>K-sqoYsRfqB+3%M>GJ?GAbq23StprX_I6j~>JZ6IJ zV@o&@GfJIupr)r11KbEB9Yjo95_Sk^fFF*8D1vxK6~Dp8Gh|fNubR|QtA3G*QnB+w z&1r~s#I*b^r86E1EuQK>{S|1@zHt5*?O5(iB{ znf67w>R%BR(U4z#jMauu>GYaTv{r&wvQ|fR2G- zO}1&4ij6z9-3wx>#$9X6XpM}_g?YWmEF{d+xuerz4SuS^p`xEuAc{b9HoeyXfZ!Am ztC=JF18H=*fvXQQ)yEdg|+Epo5CoYON0K5U0_*lE#EAalBQP>jvvxH zb~u$wuUvHt8W4ql%1g>4GNMq=2UzPlwts!}Kk5Y^JM~N=%++rj9r3!2sg13TtBtRo zFsFnS!3e6g&REt~hfz9(TC`9NMnz!_d_FuHWBQK!E!q9A6>C;ws>gk%`IKHXtG)gu zVn7^$iIOj?&eI{A_{J%l;jd*VO5AK@F>0hzbIoJMvcn1=1{NTaUS5U0z%0pXxX6Ce z&GHrq&s>sS>IZVmn7(`IuIDo-&FzBX^3K0m;T15b%>9r5x_K!cmkn!tj+9TBgFMFw zsyQjLhtbQc!xj>3n_q5V#O1P9oQq<$P1Zlc<<@*%VD`=Ep<2{-Kx6^E#vCTY`;4FZ zGXE&Tkb6bgDIn?`SfZq+5~5roht(#7{rtE~7T}9!g)}gBp55@Co3A4E{g|?WnX0um zGdXES{}t3Sqm1KbySx%*(u{y@yd`3+`tNG~bR^lyrr|6wb^i-)%VzZyO79>+#4bql z>vG_i1Yk|xseLO@MWE@|{b5y9LdwntQRg6{0$nFB4ug2?=a5ED=Tsh*ocu3Xw|5-O WZadeVPdXm}9~lWn@e6t_ZgcPJ1jR*DvPDDJ@u#arBiyF+o8;O-XO-JP5FyZ^m= z<*bvFwQ^?f*|VRSd1ihCRphYHNzvip;II_rrPbl!0F1DU7Zn-yi-xMN9_$8iR+p26 zs~96cfIT2uNGMCd!Bxj#JR2jyp3xlTzd6IfVfXxZ0U!=Vrf_i1@e0xs8Xg8GZ74c~ z^Gml5L!PRhZ%~23hqbfo%gpVW?Q|Yx)h|DC`qv0$Z~?_Xx(rOt2)&7V4LYOI(Q~E{ z59I%>J)L4TzKwrMn`E<(Quv%xb9&Tlc9z0xGgl^Zv{ySvV@YT~$(Tpd zyR)t?EO^9Fp)%SSd1+7&q79PB z{nHfx7C1Y zKcFa#BwrF8z1}5nOAZ46Vyu#j^YZfkEiEnWNGdHUfyuJ7v^hC8PF$|CRRW2i>WoU< zfWr>eXp7y_*WIrgw%)ury56oYy3e3g!BBsmVB1i!38=yTSImr23pDXhEy6E_v zOXrRFdiz_%;Kh>I;K7k`@l^C}=Y{6pIaK1_#Czx}L*jmQIp}=Z9XT#^o$usi77?Y!MP3}VFLdb7vfh1*S94iY>(V&`N6kWA4G$v5z4nb=)>`J>eQxIIJvfw1bpQ0%-Gc*;yN~>^=;2OujCabk z&s6Bj@^JG3`5#-mZ=d|FjctxPMze0)_+o?#b|^gcryo`C7aEV-g!8sq#$9ZwCIt=N zoE+Syo&JjLnB@DMe%fQ14O;x^^>9UTC7SkaNwwC@-A8rtzGabW&E(4AQfjp0gf4BG z@7tOIGg-nnQA*LZ-E(W~ve1CT7Rm6{X#8ifhKGBbyNml}5Yqk8!03HM&|>A^H(BVL zz)y_VtvZSmxwGz;ik6GD{Z$XB8P1Z>Y47)*hApw%?-$4q%9pV3n-nOQVQd~I3$m@B z2Z;R7I($EbgJ3{Xja&IQe>~>+=6=|5C_>qD_3Y-}@X@=YnEcrIxE?y}PuaYioj8SM zHf_-|>k;z$n(*wd`-;QdbA+9C{%cFi#c?elX2osm(|Fsyu$x$O^lB)F@XLAe5xb9k z$7stnS)0;V)8CzyDk7w*!c=I&NvGDc!yG5eeXjfYrQ(Eb6!PQ1p}i$^)R=F!t0Co3{$E{3 z!B5Agd*W@AvZA6`y>H(DT;Y{zhY$xD1n?hU3K{O5RyLU~ZzqgyGzt?wv zT(;wSExhu1-i&ZKhh~lStBR&a5kXDHyD-j1d7peQL!B=+A<*?c)!lU&#k<_`0mG4g zf7ev0S7fo*a1kQ0Q`=kB=8?jmDQp~1?5`X{XA-ZINzRl;%_=1aX&YmDL&h+>pm~rBfNex6?qjf!ZOH)ZmC|k zy!<<&eSSUayZ;W=^sw1S_TjfC6ZAapo8Q7t6}g3L_BfIH$mj2p_ogQ(c-B>@(sJ?p z%Kq^*bX@P{BIL=yDy>o&VPerntU0p!#~A~k@7Wj6H3wb$rl@$8+cv9?AJebxm)jlY z(81hqqWWz(@{md2XNhZKfBDDd(ai;ZDt7;m?qV)ETN@?`$6X9nd^@YIBLH||JGo^g zPi6jKO3_gIyK8};5D^CQf}2*V+Lnvg4_A9qQ@4N94jWk#q};B|+z+ExJTVibY98)Q z{mnKwiqr2>hTim7e;;lC`EtXs_?&SE>4?&J(>S~2N=Qu1DJ#R=+1dF^qQzab9d@{! zQ@jiEBFc`Xx^dv z3VP-$e=>dF^?SsTmN7Y7Lfp8>B{TFb=hx6H7eMh}ou2NST|sN=GoAG{&SgXfv9u}j zlt=-$zXXG&4+p*@rM;q*qt{05!Tsdk^acLo^YpmIW``A2tnl*f@8N~JMwb7n3G&R5 z8`*^*;LrhKZj%GCNX*4B9O{zIqffM18NaIxKZ6pzT%7#~wW8K9Hg-gKT}jAcN1iUy zzh9^xR0cn~@C4ZKbcK`N?Ad!?AT@ox>cHgU_J0kW#zhs)6&5gDY}L~pKRC@xm_Ors z8gs7|z+s{?U_Z&a;{3kEw{w+`5)=m~1?e&RapmNiFFTV$mWcRqjmS=JXS1ey=hDX$ zrTysxQ2s$4MEk^(Y zN*`_wL0h|9`9*|^EcUX5S(G&aeKV)N`5rBXrTbg^L~A2!=H&hk)v#6IhluM=s_+bv z1Lj5kTea_GX0!U4y8Cw9pX;QRwJxGJ%74gj#C7nM*M*|->OB^TOoN2VdG}~P)^lyvZQ$JPi%6FefUg>t;j5z*0hXUrl zn4P@&Do>8~ti()Re`kEa@g-VUy}lcNdB4H&lC-YL{3aG!mcxE6=;F8_zbbIrelgM z3x2}J7S3y^;Oy97>n@wGX*~F4U+KW~>a(w}B?*TEcj3XOOuMy$yGDlTy>|S8_;xA> zx|FMJ*WH)f9A77r`<6Pkv)aMkmo&B=y2W(Wx8EpSMwc|0scwjFpQ0zZ{v2ExU4ofH zxr~NrtX@D0p?M~I*DoKY-3?SIi&MtW6y)jy{>!T?dLjaXl>ovZ#pn`NiCN*)$A9vQzvAhOK8Uv+wIgxhf%EL~ zWthay>Jcl2%4FToW{G)yDP)zuBP1QztP46*te8J`+x_BLVLO%>ZZ$85BrlQ;9OaKw z*7|G+ny~2=l>eHZ(In>eB$QRr^Q`>H>&fjo#LQn)SkZ2?GUcfdlH41P4TC_Fi&uStLpuLeB$6V-u z>!EI=%6Fwj+>}%137!Af#&*kPE9?47;o|hC339RLD z4gSe#Q_#fJB zw!r}^tD=Ja)7kl~vji5lwugm7ic({gMOgoOQG@vX%^8E5@OkmU+aYQ9Q86 zy9XkXBw&LvprZE!Fd!H?*jHYv;C!3H-A7Z znmeF4SC?R;J+=5K!GDsxin_bI-%(OVmugokf`7>O_4lv+E=ZM9q>QU+ZJuu}oo`LE zKx6s@maT+D7>;ztpsIHqw-KLVXZ)^!)c-@%%XI<6 zjjaIZU-810?Cv+)uq{lpV1pqnjn>m-yT`_r6=Kl=Vo`|4yb7G6y!^gjhM+6D#aOz8 zqa!D~L8}K&9xWXmz5Jkwx-eE(O{oQm%(rM6k+QV;XtcSt5V#u>z+r^dy;&vF|1_mV zNK71t|4~KwojSR~Md!n48sC}A4QnnVCFfpsk=)5HFTk1tU|m826hQ;7^bP+{UCr8Z zF_e85TM#OACQAOK7OzA#f^nX=fA(v>pv`wm|C^SY%l-rnxxi29z?s3gkN=xb5{F?T z^4P;6rQu>+E~6)_Vy4@@$ zC)SF+BcNLgoSaH;XU_xm^Okk~ELQ!jPW|==N&BPxGnhQ(*Vk8f>b_MG5_OC5%)Sr| zqPz-9IW=LUF*O2Jp>-B7AC^dA9d`FCN;C2ybnx!xDh&>b#?a&yG3OJh%X7X#NXV9( z@$)I`K>(&|?GJ2&;PC>D1Ah2MnuyCqCF-#B}xXgv3YZGcolC1gS0jTxXzlo>5j}GcD@-n^Nfbd0Ef8 zZB8CMWqi_$pyQmcsM~K1Oju82D#ZQDlo>}qb6e-Ur-G*LeRtXyfPmt7e{O6g99~Fu zPR{h7T{31`*)NXT`0=VD&jcY4?bv4`ff?|?44XTr&Zxkze_r2-=Tml|KFM$?LrJTh z#|$EcVsTuJKR3G?0AjGXP@B~eGZX^slvKMc7U_>MzH}~mLe`rZ$sdFxr@@`ScI3Fc zRQPWxlzOqD)U7uM42XH^JsjgQl@-Gqbqwf`9`x+58r}Z>JSxE}-5W17=c(R=eZ56B zRgSG!53;Q1s=e7gYL0GKp-*|WI<;>Mx0LOXe)e*>vO?247ABAJ)V3mi_(ItFJ!8{- zyE)(Gv(jYr=dK2Tylk;~{di}-I%G~nKxtK5U0--1Ix}Gmw0eq@g=&Nrx0ArEtgKl^ z#nW9GX=(Yd*pxijHv_N}H;l=cC5Nmrw+M8p69d(I(^gycF?q0egxg{v(JU4d+wO(3 zkPpPFj~VpGUJyAo1m$&?ad}rWm0)ZBt|s30BYpTuox={AMio0&Ww?9?J`O$YU&M=0 zF=@kAqxpTl><2KszC-zxdwIxv?Is$)>MR~|9u+#V_yWJ(IOzZCH^Q$4n%ZW(Ci{tb z@T-7OOC!?}e>zcL!t<-aUs4S%xLHu{_wgSGi+>Bw?!u{R`Uu%rpIN<*=E~i3ia;PZ zrtnR`6&OsNF6#T3X`kuC8w1HM!-^l)zDz|J`U!4D1D2k5e?(*qoEcs<&+S=f!a3PA z%fy!1n+)K0p}{JYbOxI7a8xQO2lOPH$lHZWj@b)fH|$vLawrS79U__|?@+UUAQ-FN zbi7N|!P<=y2!8opm&b#W+lo#14;HOnZu5Le@kC^~Em+?kWW1(o!r34skO(mh?a3Q1 zidP440rocP7~gY;s+42)CbL-;@f|w4J(2K7ioxyWtIb5&GFOEtI`kW#9v-=0{=J41 z&sg&XD3wVYvmz5{!#sNJKHK+yMlhUOX!CBE8C~x1@0c0g>iT)Qd(q06`E$aDT#=IT z%@0Ic{}+xo;D4V8INpbB&?fs@RmkL>G6yg(-za!b?E`NJrxS#u(|#zSpqeoeJHq$Y zcy*R}TfZf+y@KdeRy$l6(|sYxmx-YJ9hh7Mo2KM9#>ctSpq?6nDm)%m`feL|Hc^X9f%7Z-Ifg!Pw?7W=gQoLy=Sb3Oa z2Pf6q2vBqpgITm4WHDizM(Ds1f6C8gQ1ZAE|c2|9FjeJ9{0v@q^OJ?z&^rYrI|RKIl-Q1)E; z1x*dQf3jG{mCaUBkmvVm$qZUq3}0}AM<~!wK%V^;x=R6qBodes?HOkoa(7qk{n$Ii zPyR>u&|c~or5SRb;)XuYJhH$x&LJc3fk*yiAAIzSUoV z)mDGh9b9;er|=H=fu8^;e)%1c<-A*N>zr2NaHrD3j|E)9{WD+Ud{bWgUTA#sd8QToezal>eB!2V;c?=C{M+9Ja1!H-%RFM~X1@RLUjvHJRKha3D3x z8w(!7M=ForGvJ3H79``-hvSqwzO+N)jFqURh@p-xr*2hADHyi#mk8v>0n_C^^6DRdz-9g;uY7NKC`iWdF;*Iht2m zZM9qervNjN|A|1@VMAb)gP(zzpaHkef6kM5B*EQOm3sUG`r2{rj*CPqM2wm2=F}2@ zI>HS6`~7LE4HwtAAy(J?<)>kgVgN=GH;~=SUD8gYy}kX;6=rvbj?*xMOAxmCinZ+x zgN#FoINme(Ln(Ly*sfGeqXFY|$$@3fm%4d*Ni+iGm}cYM<=m2zOPZ^#ZJ z<5>%c^x6ZC{=j&tz-V-Y{>oP9rtjDrwgzpPJ*1|0WY zmrF)$}C;d$1Egd0598{1;Bxp#Y%L8DOR*$fsSKsIp8ebe*gZwKbE2 zmGv33*%fZ53UR#cOkq`+qjkm;eU0LN6_C&Od0pC+2JdQipqOXVEgwxl^Tzb`i8F0_ zrNFL+W#Cy`N9X?cH7q2~Zvu{fw9y@7aG(+Qd867S9Is0kZNMh}8*iY*TH1{; zR?WPdjr*;Bw=5jlRBMK=v`fx4Gu;R)X1rG#VPUNjOUL@NDJxaLDkI;cIaO4dL$2EiLOAq@1p)pq7Glh5z3E$ev!Dt=svmc_ZX*6%B|#Y20~# z=0m8O{|SM)fwZw4POBUmtzzhdEeH9tKiMWE`fzXJaf6)O!Bxyzu^Aur2&d`K4@L67RDSG-v1w+Z!?k>0 zt{3BE(pK%bA=%j6+&wmiJ)Fc5T3Gne@2&;9!PoJC<#!QbC=Yr(Q1uHe2YifGa8zQk zk+x>)lHrySi>KnSaLiAbgrX-W{Shc{6^)usie*w}IO!~I+3P(NrS0VSLd6Rx$hngaEVurcCp+>RvKYNOvFJuJL!pFxK!t{aj zlLcTcnt8MyNVG<#3?hxeeu4Pyp(?@?$N*Ci!(HG<6`>~{l|4cpFE{fSS6Of5VhpHG zb=Q}}99!BQkAw!^C%je^{;z|oevzZE5_qP66-oc-d|4F^TsiO+n#}DGInMZHvU%!~ zj*cs`VcQ*ku4^qst+ad-MC?KKSZ|1fS)5Fof$Gs+&evL2^bHMq#fA!mUd3~1zM9k*6 zF@SxY;YltB|1al_(Z6@UDD4}7)$lXnX^VQSa%ZbV0t-xZ&q_GxC#|>uKDb{Icg8)# zoEm{SKfc)tkvQh!Q(5;wYEwjm-#FR|E8qtPDXyGnaE4g4N>&p!HQB)Q#N}Tv^2Ih{ zDT_04a@WP^leI9l3cp5`D#12~PhQG6y~X1GK9eS-foQR2ytiK}1M^I*u3fE$dUi;be7Rcg?KL^!sJ6#7%e2pvf4To zMf7Y7JLb1&vTxP9(7TGj)kwRreD>uHeKO7|PreG~fH*+fgjqLDujZ_AVuMICW*X8N z$<@UeQN~6yixjC(%#e+xCWHX*0}~#>`+p%OgOf-xZ>=y~811_{i|odrNI#$2Lu5SM z^sPi?&VfVgiwY~~Z)9P_6Lr=yo@%X6=J8(@$>fF-#ifa=rnew}eP0IYn$QTucND3_ zop&aCr;tFUT?AP(A*%9HMUC#Wc_;A#!LKH)s{m{$?C_I(`)xzuW}v_hsorOn#wE`! za%f;%C)c7->OQ#VPFJ2(Z^u&4EZ_6eYyI}?lbR>L6bch;i!ws1>I9|nc*?Sz*|z2Y zGgS`f&&zZdlHPKy*C|AT*A!Q6{a|c-@FoVC6MY(7oLm+4x^Ot%ptb|w%AQSACl)0q zN8uYU<0$XYr(d0YM-|iVuUXrqClN^yJc7z83j<2IgRSDU0X2-5=)0XK{!xe{ljd(a zxfmJ-K|HlT|6EPCT}y{Uvh?NTVZ@7~)24c}OQGfT~$hcjfqgZc+WRjMgQN z$9jmg`(j2md-_UE32?lHXh1qNU?w7CW5l980cAFEo}-e#xOhDod*WNm3F?V%_TEt9a} zqDQE*T13E*6}eA0%I}s29V2pV=2@z!i#Zm=wEZR2gZ_rV$~{(mvV+ID3}qP!rtcKn1cn6rfW$`-oA zN^plH1lm427ziba>v?kr+2zcg{lzaA22ZyhZ@HQ0BJZ&%NWnSyEf2Tus*g`e-wJB= z*jFACX^T=x4+yuP51s6fv9MzH`Wng+7+X?2PL;h|&u<;!Ijb>mfk>g7V4L+)zg-sp-BJlz%UQ)4CXETQQv)QP zeI6jQ6^U;%;hT0;pNpwH1#2;>zCH#><%@z{tD=1vR$a4pqG2+aZI#LekANMElF z-aECpIo`I}t~p)M``o9w-DkzD;wDidjdO^F%+D0>->e;Zbj&jbTO0)-V~yFK_kMqS zC0e^LBEyy@%%&9~#-~v?A_I7X;CLfx8NI{7 zdT2m<+Q6FZ#?9||z!jNNKFf8!hp%-ucMR~KO4J;9z_{pTRM&zAK08X}qC24tXa-__ zCrTbs$G@|t_b5MMQ;RMTRX%S+?(5#;5v?!w(fueu1o?E>LvIN@h3nF1AwKs70_DUbrO5Q{)eS@>UG!-EDB zrc6b_cvsD@Bw~*?+K3s@n7b@*k}Yg#&JJm$_nE~#)c*9o|98U!!ZAcS=qR@G{5IB! z-^u6G8Z~3or4rI%#k!c-BbS$|7@Uk0oyL#Ow%OHNI9^lIO#dEij#gd*4&Ti{>^A*B zi8Rd~|M0YZhNC5ByNq~fxh!e?6pS7g%n+C@JNlCNw&pqh^?c8rr)8l>b*O)0lC9{# zjN`^ac)e_OaWZ{K9>W9Ag{}ogUk;CsN?4DuGX;{?@}d38!Pr0F%F2e8NdeKtMR4DP z@IW=iuvL1+wyNaIwEZJqX29??BzI9a^yb}K6z?8NhqI~{!>9|0NV$wy@s+iT0+DN2` zK7RAWz`fK>qrHUCO;AZLRWgm4#`o1vgH3UIx0z8?U@js=lc{jB29|^mHZGz#2w?kXCv3L$G8K%cu2@ zIidjLL7-(FP{)e1J7yjp2oL;B2-71%$pNAkqw(fOA;SSLvt{v<_Pbhqf3UpeKyz3D zuPmdL&?)61>t{}D&7!Z?`Qr?adZj?6EHX@8uF-Wgr)7kh^=#n~IY}c@bzcJJHDnB`@pt zZm%3IFz^|^Qp=f@;wCwOTlvK{ELJDCw|#gC6vII_%LL#89)L9`z?wkt`o9-6Zua!B zOBM4{iyFpU3L+fNAkUPHRD31No=CRz6^R#Ath9@7A3mbmwhmEI)Xts3XaLNYTo17G zQMXCs$fUu~P{Yr3plpQjp#rG}L3k!Wm?b_ZoDUaiqyo%1_p_(=KiJ&J7S#(9OvVs; zo{+L5g?`{?uKm6hZ?T)2Ji`qm|@Q1IBjX@sxI)u)~F-*_LKhR}Islt%UR3;)htkTY&r zK+yv=@+D(D0E|QcMzTXnal-xV`LB18>wi-d16Zo9_ zt+5#?`AUi^`cftsM?~X)2|&0xtqe)M%D#x}Y%_yhcrc4|)ts9+R4UJCMc8$&*g)!2 zkC$nX$?B`na}m;j2{6|FbQBzsA)5@HU@qD$ffFNU)YP7!tH^Z}oNvOMO`VsO$R7Pm zzGWml$xPgDr(NU{t^hYWw&_EUSOXQ+cT;IewIrRb6^T>Mlx5#7v^S2J$bk9zH}P42 zZilU+u5qZy{6Ej~sW-VWvJc3tjDCq%Be{-G96iE{Pi_%xn4XSxEJfvA@+y9AjgHB0 z=g0m^WG~bF_qGe7u$*E^G2b9*p#qsxYtT_;`JsB!kJ%xw+YKp1FmwMH^>AMYrj<9_ zc^Lp(vNh<7W2Fc08B&3WUO&C#@a4xlQzue|8*=*#(40kN#Nv&;EYVHJ`W-lbOK^Rw z+?DlF8ob&W!B4S|x$Tem;V$svu&}YwhEtN=Fs@l-b|#Ef-ym0#qW+ZGTHdv;o#&O` zt2t6ORT_zqp$WTZsA^drLnI{E;&1-`hXZxa+bntUv6G{7XgxwH(O6)_GHbButh)Oo z^^T_0c?tWM-b*X|^^JoNhkqGzNUmJG^bJ)%)}%cey?ex1FtTM~oGQRpRoREiQ1*W0~}ic9j(y5Z9Pyx%_?}sUFp-^`dWG5vjV>;b*5@Msmk- zXN8hUz?I7>_BxSA$;;Sj0-{e>1KG&tyJu&yge0fH1vfN>x9dN2+3Lb+ZNCfPQ&Ji% z_;I7lX$fs4_}4?gi_7mQs3J_Be7W4ax$m=-q`T|s&UY_8M|uZ)NoRIty2_uP?vGGJ zs`o7ky2e4yufrRH{bUteyPIEr(#vEC>WNkpmTH&vPm#3bzZqHYiy>F!&T%5tmTAE$ z!VUG;Ai@IMa0#GResBIcs;!6{90ol6dW|We>_|q8tB?q;%TR_emXN#W`a)NISh#ZV z-)=yrmeIi_EZufZDLF(15_HAWXUN3ZQ~lT_6|-G#1z;qiP*=87LiQpd+aVSb3XYTR zG{P3?;)>5IKKGT_3m)v0X$8@pRZMC>afq?^KXxhZ(x)6;SwZXA!=2A}CiR?3Y^{8C5gNMUz;Fel4M=Q<}@ z!##_E0^(GDbG5xjOE_cGF!R7=wO_dNvkL|s5xIk%9Z=H8%jNE|RU69%ur*ytj|E%N z@9K$gTm5OgFs~)7qbO|(Z@ZT!$a_z}MH-*Bhy88~ubrQcby=hmL2l_0V6*}>j z>&`jPfxOtX6V~d2Zh>FpwCF(79F-aKJwE|eNBF%6q(Vy3nD+;odCxCZh?TXx#VxC3 z)`oLz1<<(sN^XCv8c%!c3dk}m)D?JG#H*)l9|y8l1$m9({a0!HfjRUab|mzRPsU(p z8_xqX<#E5Ry<7j>f{>nA(NERC+Sy^zyEPt7RPB0ZwK6mi82Ct~IU~-hFAFN67uTHn zt+WS=#834_JL7j)I2&yoY_T>%E8yhbk94Ld5OujPgxDEIF=33+a(ST$_j5=CB#QSB z4KS&MaRy1n2eE((t8J;I>9^kzsIt)Z=c>teGv#HDCtdfKovGm~64X9SGxBP!x${z} zI`u2FW(g6-35RZ-P{!e=5JoTsG0^ajuMD<${y;(=Sp=9V6Pia-g`Lc6*45!f9Ftca zG2aZ54s*J;;{1b@INCu8zAU()^U|Xw@7u=Idd6#HAfAby@~7zjw!1p1<|=!)NaII5 zk&hzr86Vv`tAE8YlDPJr6M8tq7IydSC<4#h0L7L6frPrm6E9?dLv;?Q{NfQ&%_t;bsAmXKJW}>)$mEJKjYdw1LD5wW|LLXZ4>1o)yUf>rQo)zzy z-aj75Gn{4oacl{NoGhm!1niHy4MwHxb zz0|&$7@FD+L-46?y%HrC)FKGDoF5{C(&6hkzDP}@+!iIouz`+Kc^r1 zE-RT9OGo=%Y-&p|oTf5}xe&i06;6}bnV90~u0O=qy7`7zXLALCZay87A2dAaz2Fk8 zraiC~6f@!ei1tAbil|-b5Gw;3LN!p;m!j%bH>sd=JjC45Ip9X$noF1ZF=FL2yCL;u zjqq1;X`vG<0|sDNf4$y_N)a`9mLQRkKC|!KevJR;)q9l(mCjO%Ut3;G681x={39#T z!FgoKMsK*UC(XEr&5B>{4g=V572&_Io8LP1M%&CH7A>Fuyy)DuX2spnZ8%IF1G~%CAOI?i}zAnVu`LhfTbrvDR@QFN<|);Wu5e*7LJhkAooG{fX&sa6`Xf*pun= z&7d?cr)cJwJ6(Vfw5{aEX?oLB_X0UzOXp`@@p_-c9;z0fCy^i6930=?6v3hyUx;hQ z>vE}X(3j$*Q|&6WiGc+qA^YQYf>tXk&{P+2GThQBU*>KWoEwYKaveMse_lT}HI)^9i!rx@Y-ZezDp*HUbI^=E}LQGH$`Q$g8Hq?M&^P)o2 z)E#`;YC1x-7j5ND3!XY~GQZ<)^zbsdj;BW*o)RyeU%zfI=f^jsc`?@;FF*MClPjeB zf9aK`v-pLtrWqo!TS7A>+JOurlm7?3;|Tf|KI43-S+D`Rl(7tjj4mR$pl(!O8nk(n z@3NVwWdkhWlu*XSjnR&uxKj*w87Yq?%P0fI~*Hjk8#SwVn zl)oAv3iE>VoiiKuTz$@{kbI`{Jq-FyjMQ}p1t-|^TwTJ{Ntmshgl~Y(l*+@J@#2cZ z`cgqm|C-H7%an_XJMXZ*bYm$k3!&*KQ_*G5_XJ_EXsDCg z3&V1w2Qlnu@IBi5|EVz!vxqcY^2Ze>B6HidSbP2vDhdYzOo(W40VSLjj=m*Q})ECQI(ris8;CD!6wso*XZXL-0KUMk0D{}VN=~wG= z2WJR6A*L+83@9GQzp(Yb%UAYb2M4|`X7e*@5v-^sN+5BQk2*w2;T4H@1-50ZxKBim zm&}*Y|Awt{x(b?Q(KbprGceUSGzPxkiifJ`sW5|dpVsG+(=aEgLzJ{xt|CO&)lP^RsEQb1)>MpDhd~F)Bx*#oRJ|md z0p=sBeH!Rd+W}sK3dSa(0XG9&|KV%a2f83~JS;ZjlYx zcP@OFparMzi|~b@?Oepx2a=+w=KV2zlI-XY32s<@0H38k9YNg)x8hXknXHiyUOsS1 z|2rS}snEYqd+gH&l_N1<&9HHv@4ytVT~7>sVm@9DY)%v#V?+6nj@Q$Z}EbU zAR2+d`<-|hBwTxJ1@>a-)ENP^9Izx+{8)EAm+11~faakl^S5!RqBV$d?^(O6L2Noz zMgr^%@A2esikRd(Z_O|`{ktT|(UgJ)!E)FXJx$Z0)lM`rwgNjY+-buzi7POcF%xb! z0&X@9j#mSgKWv8k+k#R>(U5KkE=-ZSJog>-nsGymO&;m;P#c?#3D#b~M6gD66X}>S z9WP-(0WyWgjEF{jp2}kF)G4BA{Q8Z;wB9aMbr!NgR3-3hHh(7;m z1&O9+vRM1ag0q-S_gty(Uw=iQ@EOmiC@s`>Vn`L($y#+OkC2O!D!EYxLlZ?B6Dgz2 z;#Qn!*hy+LI{G!BSB*~g^rEkIBJb^mB7IAJC+v#&>YlPVX ziqiJ3ecFaMU56)of7JBQ2xY8B$akmk_rAyR7`aLsBG?t8u>XnxoL-<-{>qt3`p(&dFkRaaT<@y0%ZV3( z%^+_Tpf^IsP5Qdgz(hMGAGIwiKAUDJ4rW${w4c~i+lJGv9q~~VBmF*qXvSz?^j7nF zu53SK*cEi?{+NZ+_56~perhFw!D-ZOtKkSgV^luv$SRa9AEgp>Wbs^OeqihJ+Di0U zpF=zzis&(VmqgiqCm(b<4qm1NKk@+%dEsZg;er2PyxSHWfmoc+OqjvKJ4fWbN`?SK zw~En-{&)s){nf(|0WwuZ9J7{2H#~BPgPe?SE>FiV!)(gk22^a8v56(U$Rn#z&7_~6 zMWGtuuFgHhg<{hbS!Wll$!21;!G6|=-Hzy<|m0j zZv6#)zQ8DJiycd$6L1t=A##Yfe{U{scR?JaTu57Wm!?20U`~^99N<__^;>!V68B&) z=-W{cc!C#5QpUG#v1<1Y);{qp=8XsT!UZ3r0;6G6BCJjTBPem{)c}qpd(m}*OIEoO zUI&HTdxHI*n9}mbblrUXCR0Onc;GR%tA5}(TTvdYc^lJ9Z}BtAs>ocf`uEUIPkZ9y zR@4K6Y*U%zUq@jIjhTgw&I!=~Gg|Rcmor4Fx1%YiUBkr?Kt|i2GA>&CagFD~IFwCp z`%SMO*h5#jT=tf#_Zc{SH5btf{?CZ%Ue`TyrHk?+yi^W;mo$N2ZDNV45nh^`w-nv* z+DSMuZGvjE2Qeg)?!-bl0EbH|s$cZ{P+gm4nS*YSpUb}gFFxK3cd!z_m@U7IkI>m@ z!Lu^+vebx|Ef2}zBq5s{m9s6zgY&M(qgu8$7 zrZ3oz2&^6d;|$LM)7h<`Gl>f|ax6fiux(o2<4w?v*R3KWaCau{8u8NW?}#Z%ie}LFM!SEquz?}y8i$bM*Bs#sr$zT z9MWH|0Zv7g9|w>sLNiw7BQv;BzFM$J0M)th#>;wkgOc)+WKhNHNyMY*#c!y^ZwNrv zfd3U>@)V*K3F~wN|Lz3Kg}d<7eJL(VFvu!bE6uwWev@Ce9mD6CR&dTAIl7rS+458n zhA5WKuB17{@gjbPwcx67E_Fmx_b;C(NCahyvS&m5RyE}=UyM@4> z6JM0A^O`a=?bd{CTxj=Zv;$i0xtMXLY{hyNmjqQXsUFko-yJ@<%DAzcwj=+Kn5TpB zmM~`tLHdtv{Xgcs6;^~RhdJrlakBB3T%pW2ZJcLVZ>%MBRRR`oZ-x_r@ctz%e*iC` ziPtALZX$t$?RGw67j^v~K~DBTn>pL|GDE`Zbpw;6XI;vQ11Z(|cB{ z@V$=i{~3!vD<}tfB8pg)M-H*5 z8E(7pE@X%^#PAw?@EYzgqTA)&|62ed1q!RxGF+ke$K0b!$whZ}8c0&0B&9XtZq*vv3ea07p-%jpLFa^OO*LNzql*JS81K! zg`b>4)@Z69e}bfru`wf{EJsmrlHb2Cu6$QWdd9<^Wqy<=@g`4Ms*g#6KyORyhlk~FTfa3LFN!##HZ>RNuwsLG#S~3L~eQSc4l1`Fvz!r0)Q^PF$tv$kzMT83017r1iOSgx94FrIE`HOkZWd=P&ME z?}&&nDSpJ{hgQnRZpv125&t1;$3o~hjsat~(=V2dM37A$WW24PaG>;X&|*AjKW}h% zBaQVSn{=nr6@8l7nu;Dgzdi50pTywu_wsLjtZbOHI9C6#J&*SxVIl=&gHmAPn59Cz zQ;WH1J*1-@8RfisAp->@H@^u26eGe+j@H-r;R^%kHoR$(hDtnGNsd4Y)8;?qv&NF! zx8P+AtaL=&L}@SUErAwBuqH143?1sOQQaPY-IdRPo4d-3XR($IA_`c*#s)jHfT9{Q zx%FLM^rUGeN8@FU1tDcQU3>0=sC@a7B3xXu^mCakCq|8fD(`TF{tA8swlBabg>ltS zsCVCkaU-I$0m$k4f@rzE|8nbai^IOppO33>U=5Ptmf#ACyz$4iX*h zDyXVa-9@UM&DE}k!68t;##^ZT~6D(*Rc_0)VN z$lf-VJloJA$_(v)^y0}OC(972zOik7aANV{F0PBmkl*phRTySrG<=9&4i9H@}& z%$PZM5KI1(JZ@F4dw3f6%#}1C?%NK3{S;aRLIwVNfG^B_-z7&Kg&;Cuh=Sd#sSn+GmKaEGFBU7ukD8==cM2UKmvI=4GozXniS2vlT z7fdrvA>V@Jw!}@_XBs`rifU@$>z4{-)d<6BsP4LMS{0A)&4qU}hUf<9O=jeLtLc6{ zrahWQl5d9P9^~`4{Uk`dHw=lU{p7o3h50ijD7e{c#%5Ie^@I4yd4I361n_;INk3@( z;vwvtJfj-5<(26d8gY8u#z(=5|EI364vVVm-kzbmK^mmH1VJPQkgfsgM!G|hMkJ+? zmTrdb6p%(rY0v?rrMp4>4*2lA@B6#1?@zeqoE>NFz3+9eweH<=jCJf4h@PnXlXuFO zs0(v*RFSK@J{dFMMYoN&paEOavq93xt8p+`5YrUT|7wB2-wOp8s1VA4V(xjTP2?j- zq8Y`&g&SdJ3zb#GEL4HvWlyLuo4)I!u+QNo$R1PvnHG$O^7^cw(iZ6@^GA~-^*0G@ zr{flW8AcKL?7t73)87I0N-vnCdAXiH&Ku9~9_TeY{6-tDx13kiH;->da`|G#$LXfX z*9pl|lh(SLYJCqYF#61nBPvk;yn?jNUa&@yc(f#86kn9v{&jGF$uEsTFC?X%sAv@m zhHNUGUF62yCF?Tz?%~c1-WSU+%8Yn%?aqU8>9~o+qF*;@K_uVMvzawy2su$RcT!fOryQw-98vGeNL{v#a_pMd9Xi+}1M3vtF5; z{O>*=3{z)ybb}~(wci^T$e8L8Evq{!GD{e_a#Zx^=Y@#9eAe?aCZWC;?MWS>UuX5= zgO*ihgANi~B>l4th+h=7SNp1}O(NTOZF%8nrypzrahz~f+R7vqwkVP*>0+TKJBk2S z_2PD_s9k-*mC<6Jo;jswuXP1n<0>9L%!8&*XOEY>_xy#_a7`s4<5GUILHy;ZxF|XA zfbMvhp4?B<>2kWwmzD}xx#LIKV-#x7@nYH%&euoa&Wr_UTU(NI?^;6;gjL+!#OSz< zr5zJdw!*O}=NgbvRYM+fap5;cu-W`jJvS(6K!<(8&;BjpZ_5p`u=@+eTpkvLwAkKw zofgi>55zyjmI;sZs7L^N1q2YeY+hJ=`2I1T?~=QqfSQIp&FC{t%JxO(9xSK0H( zVxoQTahR7iZ0z{)je#r4Coq5-%mh+kA8i(YJ{d!YJtFu#{5601rcP$Cm+pP%$ zJ9EuJ?dD?)7#9+(0txo}4lLavEe;SP$l|$6FYsgdpaU+{R|E~3fetl9gZ>&_+FttW zD<~p_tLoWp2WKh2M7%p1ZxdB8pf`a@iHSM6xspxTDHQyFLMQt`YtgUYFhYK1fKG7` z2aWCkn-e}nQ!5;;1iJ-W21t(JWChrf@N6MfzgDzARb39eqzm2r(NYX|2U`Z1>jz-O{GzdxxRwMmqHJGz=z)$p@QCL7kMd8d=+dX zvNDcf-(;t<0$&yZm{UvtuC7nQUcAX~s!Q<)?FXg~q91p`C5;r{+pZWh|G>2`df~pn ziO6wF`4EW*eiY`WjwlrF9I+!{ilz$ne5xW@Fr%O<%#*sMX6zK8RY2RslD(AX?B=DX z#Xa9@*KVT&&Ul+ef^3db*}M2HO|5hsaBw@`>uTaeXEjH@&@0p&t9g1k-97qBsxzO3Yg@@xzcjzU|H94@#u`)_8rx5TO7-q>?y{z`~$MG?}?%=XgquTHYDd=S6=~!j?YUf@bt+-E4}VJMxkV6dbNJ zyzxgY#A~GUStEF3SNOqYi%bu-KKNq}B9GI8$n5FfyRU`z!FqPFne+KtleDul#7?c( zWa$s~Bvo|DaK0Y*L4H=J2*N2uDf^by^@>k6;@7biF2+X2U=b0RMm~qq!zsLodVXfu zzfes-6holP?V>bjSLw8?tbQTU@QGIhosFEqd3J!l` zH^l#s6Lj0J8Hs|i4>WW|tlbsTd1Etf*j(4#U2q!QKJ_1(I(5$I)B9pUCuPq#$ev;q zIpG`D4W#hRBKw7&b=Lo32udyZ)O6K^6HThLcifDi6}CH%cNy?uIcc9yi*Qq{TlJ53~tAvIY#g#ddlbw_3uv86iY!+=@%>c zO`Ktx09+Am{~tQ`C<*9SCyzG7UlF_js;3NRgE9>b@ScwpYaXO6z13~c8RZ}4)w9v) zirI^cBiMAWZ;0mnXOC*+$lfyHvBmRte6-U7@AMuf#oFX0utUgWZ5Ugg4CmeWX2l}X zmd@kghG$zcUhSGos8X~!22<(VS^6U6k%#dO|EbAL9z|bd8iICm4yni+Txkns?ZX5; z(rrhxYBQ&kL!-#LIJR_S!7%?df8M?BB>{KQ8n%rdb|kD?o8R@Hd8P_`GaUUdu(V-TUhW(<%; zK&3zyVRm~gXsSJe3e1*QEGH=rID81ut_D|%Xn?QPll=Qv%{>(m=f503{oQNHYGTe` z`Zig`65wH2A&0nndU|YaLK005DHOH0KfcYsqw_B*OE_Ak(P-LDu}Zr;qm&E|b0e7T z*W7T8hpC-^P)FR^uMPR_0GP!!LZ#1$9LX<{OVP3%@Cz^>c8o1 ze?&Z7^Wxw5w7*>(q~CpSApixRC2vI3jQSd>D3&tHvmaYV&p0$Fwzi2h69ch{$HWedjR5YpO*nt*uM? z^feRLD$6MBr~CK$A9z7oO8?>tOqej~_Gwd%1)EotUbw>dqA(iaB7sq6?C7ro)zzO<;oy_oCT+x6R-p*+Y}E!=R{iM==QLgiXK~xM3I9R zb@Rc*i~q3RTNP{kNkbm%7i~Xi>Xa@9UZ){W!bQ^$=KlDF|1{owXWaVm4mye(LD0pA z?wh+~uo^I7+P8J{+iV~U#edM)Kco5|m?o|QVNFng*ng1DcVUDClfQn{Vnf_)|Vq&Op6t%4dRmmoUb}vYFa1apDg|XDhGi4NYFcEj9LuZG#Qpxqz_w1`9i@eJ<|SoEo)!P> zFM@4^PN$i`2D+2TDmJ!-$mvnB1HSgHKuO=C{b40tTMF5XpW|KKZr7poAVk)7e{nH9 z#UcnAj65b4cO>X?oRQ$pd~n*+gpFWJ1l}ST^joV?kBXvt1%T?s6Cd+L4hfX26VO=y09`~ ziQ%l^85VX&`7<7*HXsxCp}?dC_rv~Ob>sdeg2i}3Un#l^sr;kQSVgN;q_ePsQ>+9j zYhxJ4)WyPxXMaAzX_p;$b~*PL{zie|7iZ{eMxBKFvU_Y+l2Ugo#6q^xWQI<=Oe7IV zMtM`%?7aQ&eznP!Ic@z+Ys1oKeuVk~pT;_s;8uL|-fpaaWmaVt8Qf zy{%S6$jK#~*ZB}xEV=;M_q56uRQpiQPp~w7cPjj4lj+zed8X{%6Oo{O67^ne+(%MB zW;f*#$mU}v0sGbMjIyq3Y>vwPJZ|R9OsTWQ{6Zt_@86-wQasVofy*VhZW2CZy%YX9 zbO6>?`4+9Q;y$pLgqq-kz|OK|12HqBZ>HAU$~^Q+oHj9v#PEfp^*iPrMfRhzR zMqx8;oO&hX8+Gx2^&=JVeiWV{vqcxaHy>|#zrqi}TVrJ!CD8QvaQ$ZKadTyx4+>F7 zaC9M;D}KjBwt`~ho7UrXIL3ckXU2xQQEJ+}8ZEh0`=ks%md_o}UC_YINL|!`+fytt zcL5&PJk{9VSDKaPPd))ze~Q?@yOZ2yRA&hRn?(KnCIM6?_>Al6bKlsfQdHd^rRx66 zG<9WVN>@3-@Q`NS`?Hi20XC?x8M^vaWRw$#hQG1%dm8iaBltwB*o%bPevpiVTBm;o zW`q@o2_Kw$2jq1x;QQOE-Ft&1(65BqeiHs$wEuAt@3-0^#1fKv48{`_!maJ?k;mlO z>XV}8kA-lXQnM;pEhEK6|Lr*?6p7hF899zl%7yNLG@4p8JU%%$hX;&eSKIX@CRM?F zK|xZ&lT+h-{$+p1^G;vXSU!9bHgK4HFT3WZ^==6-SjM8YSv$g=?WCG|Yk8a$&<(mZWBuWB z-E{n8BfLk~+NgD!xzYMxb9QM{ed_seL0Oji1aK`hSH{`gUv2G0BQmR)P7E(yxPE5X zBG7tqwW^E8n#*O{=i>A0>}N{tE{n7&#n`Xz#%h7wpq7vuexz+|`6i2df+CiYnCd1vOUiV?fg{~A=2*UYcJ(pHFx_e*>}P}< z#p5L%9R#cb`2*^wWJP?5pT(OgoqTxk*gdZk?W!F1ALbKJ%j15koqiXj|K%S8y;&g- zB;OLH#&6d9ZindVMA^|%c};&{NgUqw`UR9*mEnj@-Np!AW37?Ldk%zDFimT}i-bi} zi$89gM;;uU2${kb!gcHJ)EE@s%Kuzf-M=hSUrtq3R>FoVqe(_jWjoP!qh5i?+=@2C4<5%BK;BtUQbI5#fF&f# zAC9qkx2uKp5Rywl18usDF-c|ZJQGWK<@rGA%Jgs{i@t-Ed(ww;e)>egsPQySNm|^U{ z4?zk|oK4uW0LQMO_>SEOq%f;>KZaZ6V{y;RFoJuT%j-|Oz7_(}cQ3r`-`b#(0>EFm z+vMu%G=NPm%l8v_DyY;&otdJ8lwrn6^tqH5;?YOvH zCHEtzmM}+xr2Al3Q=a(EfN7GY0rW!u&cw@J{(L^!Qe_e+7 zZ*bZZGKO2mC;s%N_0J2XEHSDHOAaX=Th=Y*^=9>knvm=S5^8_4i5c1(86t$o_7HO; zD!yFRMSJs_S8=-V=<>-8XcAc%t#Fv4ZJqnx<+b0sH?Af$Zc0E}sKtd?MaB{z$Tl7q zdwM^?`jk)%Y-w)BS&?3R-(6okQXd@DY3>exv2JJKQp!^=s>nhV*S2QpDGF=A``m}& zKEt_ka?(){X*K*$4JDm7JIsEfKc&}(l(`Q85M!c((@B(GNsv)pn>pew5iH@VI zFGR*(zsdRBca%thr>T^6>LwT78j`<57e1;nN|qWOZ$4R4AW~m9Y;G$&E%OrToWI?% z6dPeM40Os0E};jPJO$g{dk+5N1RgcTOXt76NGlQ-M0LM9QAe1H=|k0Y{c9z_LM?Be z`Y=WI=NkT0Q(RlB(CV9#Iv^7Vi%m?^<|xIqw2~rGAN5zbDe^eZDFqcKrWnU&=Z935 z^=&FIcw9TtbXn}0np-if-1JVc%pi1981hYC-fhETVegdiWWKeR;x0RJUPU; z53e1Y`gsvuX{t^hYj^d?F;8bds@Vfa8CzEI>0Tt|Z=Ci|8`;Wo8 zqavys`?EJi3*;<1L;p_xXSxrEbz3>U!iXI+ZDN`B?Anv{V75mT}N*%8g-tDH^zkEfI)= zu#V2nOwu!D+EQ5)E2=BciL?al1{V(UBRD1R!f)Lk4Y z)BIm^xpm=T`h@jXVpmZ{{&8Nm0bUt(`?K9IO@20zUp4|sIyWrOR?|>jEB17PfLtH@ zl%=;4&l~7@MUh<&(LZxmN`0vpP2o3X8`p%m-GFD$&wAyrW2ziI#(t_>fmHHqM2Dc*?*sf@@*tl11)g_`?h;7q*z!&w9tT z`%PNr`6)%K(0#AIK$z;AQA80n10R(Zn)=UU87Qmt^=)!F&pVSrnY-rgFuquhoe>YD z@VW?fJ%3qcyUH^xlt4?xOa*Reis_twDd=L}OsGYroNvLlle!Uf2vp)48gqkAsTe?~ zSmEsL1^wAXY*!M*A5vDvvRZ7sV_n#(-gkmY$36<4&2bB7kaT zD0WVB6IBawU`tHLK#x6xj4UmkFrg>!(N_Qcr<2mteWdp^Mbxi|D(qbPDII zEvZ?~Pasmh#f7gp5rHq%w4LKyJlb6Nq#}ZRkHVGj za*(w}&Ja@gUa5d-Ay4qS{6y9@k;LuW``LDHcE=fVm*Y8-3uM{ONvNvYtVHC?*FmLe zm`NAG(3w$@0!TrDqt&>l{pq=EPA<4*ki%YIh$OGL)#&9kZNanPkSm!4CgUEgulUYx zZk-K}!eF0UqCc3WFA6(y`OG-=d|5=YS-c+1ly*Kyj~;RvK$~mCnW@o)39{gCHIhc> z87}Q?20lLw9@m*zL$q@ip^IpEzPy|nHLGm$eDhRwKF#JkfJ_Loe*@qn5p>D~E-3{i zaNgw*FUKe65!Iu}Y&9ILop{w46}{E7lXTPLnVSn;w#83|;h)MlrT~Fba7J}zHl!-| zM6aH}O(9A{%Z858_wm&8MwN%gaYYsw#BQuMx)WZ3ojwCb$_Gp5hli8M^h2h9zz(<^f(7G2Kg45=RP0Z^Kq2F6;9_E05omNU%n) zTwkDOS3jKn-nIQF#Q47)aq7ltKX}rA7z2RAk3$*0-1BL7SFW5;IRB{o zbilzh^L>T7-SGMTl%6WRy*CgSk79!Os`y_8fTl2a0mAy0#u)csE<&0#H}2+7&LkBZ zB$Gmk?5Y^$x3+FeFe*;?eS}^CWy#6k2jqX(E!IWSxPQXr^!niXg$4Vzi3A0~&7ZkA zLKn=tqOwPH>exWNb*hPLuaC^!)@~B%2Cp9e3+u?Cw!ZWVW@p`F4oDU2lMh*~8C%Zk zWOXu0qL>0Sl!@8cOLGcOY^AXW2M3{fP$}m5O;zSLE!Fq2lES828p>+#B^k>rD_CTu z-8iMK$ODKno)HzW+S+AnYAqjZ*^sua^Yb%_+Lp4h{BRxAW|ekzn<8eZgoT7OJZHV^ zd7cw@RFdDi2T{Cu`d`RaAe;XTuazlAN)LNiBO_=a4~2G766rM;Id&s{{1SyT)mrlm z&wwY7OcZ(Wg5v~Urf%5P7W^P%KScNVXZL`M&{gvnDaj8QJT`bPuc$(BX@Zv!4Xd7V z;D*Pslx6G&@#g(BTR7Py9X(aPSqZGH-kMZ?Mx`I_Cfg1DVbWFpF3{PX8YkIQs@h}U zjYVKesNMx91d9Ufp0y@dHZH}SS#r=e*9V@82MHvA62ECM)6a_Mmo+eWB>w43-nA#`(3|_mGcKY0#;=mr|G-SsMC$Ndcee)A-gTIqHS| zQ%q%ftX9;hp0fj`1cr2f-z-xhN*|&;;h3(1R$GnLeEQOK6&ZYKU+(*52SjEx2a0$v zN@sYTSFN$!GQ(pNFeVqoFlkiX=dxi6SyeP`E!VUXW|D24LEq<~O4K5R)w;zOmf`eY ztd3p|Q@p2YA$&BaZSwWI{Kfgl`6aPFM6NG5&L8+`-j6*@;hiR|wn*0qgZ$7vnDbB* z{!+UwYu50GaW&I0aOU?VZ+crBk5?Vxj%<{SoGbNfRqCL(U*eq~*MNlcn(b`L!5HFm z0E^XTIJP&%eQ@(bcAS6>70c0~^9`-VkVtb{KldC1UBE+}N;cH6x zE8t3gQt5Wdfp905(nYtJNzxT3 zE-E@20=3mrJqZ?~ag<|lrk9V_zirH#@vATsE$@7PPujRiL_QU)!&ieE5@Q@R?>%kS zyFS4J6sUP(YIQpO#E8t|0na#=7Dv9o+Pc1X!f%tBYuidOC-6z|Lvq>bPXZ8v)q}U< zlnk&xM&7VtYup$(IS_MEevc$(*D^WZ+=iy1Jqi}&wMrG$a)O7R+M(0sgpF>yjjH!( zq`oGj(5mPeOx$*6Z6+-V-+6j@Xg9R2@W{nvNN=YtJ$!DJy(uXLT)qIZkmtL3T-Jl} z{p?~&A3C$TveDqC(`;Lx5OX5p%pRqB0S9zUrrKlJGq3HK5hjxfvW0y_l_DkX!vEMT z$3tlRll6}ljsp;pKTZ1oz!)A9%8-;c{8Sil7=b$}3_Ef%36M2T|HAj_5iV0k9cPjD zcI3JRL-gPl5z(d2YX9|WIr+&}VKS3-{+hy|wpLqa(wN`nE*}Sdr#zctZ3y#?wPUyc zGFnM8C?V?Z9IkPt6A$+sFU&1L5`01D{4qhrk2mZn%$))?;oV)@A~P{`9FrJL-K*{W zqK2%et~~wCv*r=-R)(0PM<(dB>&K@a#r+d}fFQWYUk2*s{QjhUyUA>%c|pI{$y~^J zMBwK&yetD8ndXEp1;;TD$jDfKncQf<*3g*5t>HYv^J}4`qKX34p}S^g8i7m$I8Q#n zKPW{-MUCUCL81O#U6SUOmI~r@e@2IrIJ=M5hJu4X)y|abhXT5$M8w4MKWA5BK^hcz zSxQ)J(S9EG3OX0p7lVoHx8m6$c$vPCU%QH}2Qifg>fT^j5=rQa!R3wF!Epibn#$&f z$4x+#H8vKSro9a+seB6FVn@&bLWsr)2|&c=Rz}*E7*fv+5oNwpFyyplgm|Js08MJ& zQaxPg8$fRC_cvs2H$aLD5I8i~ypu0fEz?7WQeAm2UVd_KMufS4#0E030nKgIazY89 zB#Rc(cJcLZN)e!^tpx~>0n&&)C5fQ5um``#h`E24vK#p&gQk3eM8Ufb08I*jx9kum zAz+q=4NQ zg`Fr+*fWX6f-eEgp}+(o2v&%8_b}`OFlqZZl&SzML4qyN1>9; zCg^vPCFXJ2ZHfd_yBo^6{C&e9TR?|+|7uaz>7rWyuYyLk+~wcgd1FvMFwpHYUFbZ0h4%ye*2+CtG$RI zKmrjxKR*#5KQ3Wz&fqxL^tPv`hXw@eM1uV}>5f_0i81yQ325;ExYS#X^kP7U>(B^t zY6-CrAeNVtll#npGT9eJQSG*^wKLaD=;!A*+vt>q1Y7BkS(z+;j*F~eY02d3>Iwx6 z9?0Ri`_AyqYQ%8u*Q5Y;&J*`LnTFgP#lQEcjEV3_eS2#cN2jOt7_jb8TzVcJydu@C zzRTmEj1WM+n3jzV0}zBK$Q~abznefk6%kb1i9+QV3TQkU6!GqV)NItWKjl;54G!HE zh94LA_hWutpRas=PmhLy(e>ex6$8Yu%T&SCy z8xuQLt^2T z<6>ZVRhjC(?-BlX&4KG5nQ!OIBMXC%uayxre0)UW;^W_EW=8Mq*srdwv8REDL(zE$M#g_v+LX^uSRQk;cfTOIajSkumnZp%n8bGRTX5pFDiNr2tL3Xo&u=+6}Ls!2C8`POD92KfT?`Ux}!izO3~ zJQtxZTb5v_Ze5n(pdMb9;M{w9lt&<>u@W04C5W>ml(2&D-Tow&*_v1W1I)mgiGv1h zB1uYeukmP+{Ah#P*PP@)$Uwtl*_f*OMUZ~A6L%?w6~i^ zT;XevhaEn^>*nfL8ooToY}y@)(OKFE`$qd?nNHj?n2ZiL_LvCKayUA0LIVf?_rFIAjlj)%PoYj64YDhIQd2Mm*{mK9>( zGD;1NyB45hV#51e;WhT|_Kp$uj>&T}oSi)mDexM~Cx;yuOWmObkDZ>J1CwVNxOP*7 z8YQl4)alKVeQ`w1yxhsgL>_9ym+he^tXi>*7bUy=;hmBU6GMDl*ud)Qm^T+osCQEA zvb=$kfgkP6gSj?U#>G1Zo zS;ATgKRK#LQkmJTz_4S)2M||>Gf|a!V?n*E%VMTkFhh4Z33j`Df?XBHkph(?ER%KhQ`E6LqtPK zlaIwN=G=hAS%GJ_K1e`9(vXqX$lHuP2w6U3l?p?|icaAGrtwfrKeC)}EeeR)Q8GpB1>!dnKZFn9%HN|S>)mdY^7P&M;Vr_1FQmHR%m#f>}y(cP=3 zb6GCKGv}sO+6%E*J(a>yhc33LX^?2JXc8F9%uNnEAJv&V1D{^pZ^$7Qp2rw#&f;=w zb;s#K7mE!ejkTY(cbayO6MZe;&efaAe149}0W7*w_ZYt4uW+-0%MqB;>sb`2c^ZQf zEEsx`*Gs*Xv~Dl7sJ;YQm<)_AW0*W@oXhI$A5f%)HA$praA%`b8P*_fH_|dRs4`15o3(>0HNR$r4_2d*qX?E52zAw zbH%8EhZvfoPW2@%nVwIFYl4MM1)kzd#@prcWdyEs{P^>392|zlpvd9^q6?IdPHoy1 zj7c{a(tW+#>dFl3gaPmj2#C8@Q3-XcCb+ez}u}sYn1iP_>M>f|!ugi#lxSp^Kmd zD6t;uIR?6>0c$@A&faLa*EaxNZWwWxop zODZb`5f!3yJrJLS*X#ghA1?LyN!+poPxFu!I$Jwu2(CYFkQ79WMNH_n_x2&lSUh$~ zck}f4cAg%yG|D$eJw}bA#r9{UJRBzQTp)Z@=y`GifgCD4 z36J~eb=1nzTnbzOGQ`Wu#P}e5fYtrFX_RvBP&t6F?4o0quP!z1AyXhQoTfF-#wXuK zfK{fcNc(pv>2TpjPsi(F&=cFZ{`9iWff~CR5wEz9?n%yZpk8*)hm7v0z$GZ2i|MlK z&5)$*IC?gm^9#`G=WyKc5mc7Iq10wRKzUhzVfs5w8k`wUAmf_f;{cqA7Ck+HDhjQv za*~+}U;3(qi=DIA=qzAJhYBG?%$7rjqKa|@^P+pQgD>+}t%0jkCRYaN6DkHDYb zCo%#{Kv%B<3D9VruAU=Vdpx+S8G@e%=WDcagwOS@RZyngzI!+%R9a<6cJsRcKfjz~ zKRct(o?PzaT=+1zwqmV-LY&qu ztf-?aqg8XcXzrn#io1}?xdbezn{J2y^HRV9(~>)TMA6t3C?Maktu*hOqzSvN0R~e9Ws&kOcl68r?*iee4zj7i%0mJ61{Z^ri`+h2F_$U zNtPZ1pxQd0gAoUG!CTQ=N4wp~`BvpY;Ks_2u4(IMBT0FT4V1hBs1vxs&!wagf4>=L YXfVj%4*CUL+6j`ER(Vz-X%g`N04saCeEPx#1ZP1_K>z@;j|==^1poj532;bRa{vGi!vFvd!vV){sAK>D|D{PpK~#8N?EM9l zCCQoR3u@o)+p}lS%)Xh~nfF!=)7{fur7Cr+yQLO0RH;BkDrU$^W{$|nU}k1!W@ct) zW@hHd%>RC$`Sl2o8#gkuR8=XJ6n@S>%-qb}9Il7`>@)JO-Me=WvhLo!yH9uS+!5N@ z*%8{_-WJ;0+R~`a%}t?=jSZpo^>v}OwKa`eU0prWk&bkvBmEJisZ3T%F2CjSTrS_$ z%YB&(GACqisPp8ZVWSB$4+|Ih=2li#gqD|=_i1Tq=}1R9(vgnz2&G;Q%jNT7Fwz7c zB@Z+~N6C|~J*-8e%v1>(b+~APiuz41E-voV!otFlj&!6W9qAEDy&P6ArOg+&`|>CYlp!`hKv$4he1Xrp$r)LV&$8VZ*G2mUTAJ^?hn%J?Cg<_bfhC4=|0j_ zc0P>c@>vNZb@-@*=RuZ^5;$K|hYagUJtzE+=Rd$>KYR}FozlX`7xeMrIbD2ofpk$1 zA79ePu`7l+e$5D{v`lf~wk56_+Ckgg8HTo=Fmv*SwR<4!y+h&X69xxzmEv%FuaJkA zw=C7MD%p9-3VEPxJ@;fI6ue&^!LSwz+9xY_lI)T!m2zVR3R#ffLb!o2SCbUZ@jzJc*y3Yk6zh*t|>0xHo=vBG8N&Hq%>DaAD+I9%R0tV_<>^-(q-|nl6y_x94F3R#+mb1a6`uk z*KZk+4263`NMGgt;ga*bp<{>>r!V5&W9RVHTOZ@U{`ANAzdm^ve}DY~{+HejJZ7$s z$L-AUgtIlC^svP@z3lK!Z~M=sCww%?c30o!Bao3jN?F=#lipnxP-j48xcMlw~&B%u|iiTvDJVI1EADt8ey5xKx%|_Vk2ymo9TUN zp?9YZE}0#0&+exG7kba=ee=ohgAcubeuaGqDDH<}Q9ry2`r(*E;W;e`Nz6j$^cHFc z7EswgkBZ(ol=sY{taldWB;FV5n?q&ayigUTW4CT-5m}|RXdL3>W>7OoVI#|^A6bz! zx`GCk8pl@AG`@z$QHmd0LNlMUvL5Zp2^h`Dz*t5aCNfenlaYdj%w#N)R)vzVm7R>c zq&uXIEGc|jwZ9jZgf$9Z=3}!`FqfHvY0^YyDyFhCQ5zYK;Dj7F=MUkgxd;C1559-5 zfBHWD?%H|$Fa4W%%)$UqI9T9GH*0*;lYpZEAfH7_$b7@wPUUKb%Y(un=9oP{r{4p{ zK5(dmM76JUccp;IVUXD;6-*u{*f3~>%TfV`T_N&MPfrWY%*^bwlo&ipYv*C1BLhdk zMz(0=rnA3$?sXV@rsJY#4Nlt?;Iw@{PCFFfjB^prxRN|daNeg3R{|<=E3_Jhk+ra- ze?G^QW_V_{At0|4p@rRuEa^dXX)mJ5Wq)LGHzJC<5nj}Z@Io~eNDAAh4xv!;hfE>`1l=^{|ewgH>D|EMx0n5mN{Am|B=c*T5{Q8m1%@ zl2K$8j3TOFNHU11gnl@y3VLCc&?8ru{Sno|W!riuZJ{6aNC21-R%lWJfXT}!GX=&|Z0KP!sjI9{o!S^^}i zjzCurlh_88>S0P@mgKjmLfefBaUUx5{i*N|$mk~Zz@Owt@+BDgr1z3bkXN~W8NEWj zEZX-@BhV8l90&qdbRP5ATA0Sx&^hRNv!YdssUg*h^PAA`V@id+iMTGhKE6)+o%SSM zwaFY?@J}U zH&t{mHR7GJOR9$hzi;&3Ij1!fpy`=qu-gKA3Nt03*~eGFEjS+eEu%=R=t691C!&hm z5mDGm|1*-36XQRN~1(hyNsB&>covS07NNuhT=ybJ552@G99;J3RNHQ@&f`K8L zY|Sz5>3}>FBg7jTBE!N0%}%!Hr*yrPzMIrRd9=7WqJdOP{yI8GnynQa{bFz>ypAd? zZFu^fkMW~Z{q)@A&Y$!&bY))Y^;SmDXf0h=dPQo=?CjyfPduQcbi2ag9y z36}%=UV9)p3^x114}pygnqAiNY-CIf&Xj)!KJO z`&M+UU1AelQ(ECeR$vfWhoL#W2+Qpg3MK0|gcM8`OVF+cgo1PSD=?ctl+gu`w08PE zn(23-!k2yzt^nB3Z(*H46#%XT(6#V+Eh(I@!-~>bB{fO=6fRvWyK3V5qvIK3Eb;ph z#299#1TmIL6u;YhGF7;yQI(_$m6U!-W-6JJEMh8Q6n z^iAOT$tQ@3NI=ifID%r*5PS79`pj;lozl0`agB6*otZu=P4!V~O8J^Gm~`Rb8;$D` zb+D#N$|)T){6Bv5J^b~jAK>qTpr7)!Q%2rwa}U}5QWs6f+BplKJN@yVeYcXk^=u@zqY z56=JSRGW08e|#7ECzn9e1V;fH1#B2J0yZiuN5H05z(xQ^6j*Y>&d`w{BSc}6xVB9q z5HKJFFl69pl7NZ?8&NYC7L;_Hu>cL%?j_JD!NS*JM%QDN)C!yAW&uNs_$Jt-cEFyj z3=zhlq~LleyFgvP=P}f)Knl_CN#m03VcgSXOq$nd-B_)bx>F?c?D(L8U$mv0NULPXz`pK0PMq=oM<_-vjs9d4E0g4|KE<-7hVC9$D z1+R>Dc%;*BMS1#Aem?mFaHTL?`dzGr_&TI(u}PLB?MuyAa=Zj05`&2EjqjbGK^#3F zvN+7ia|#q{Pja9*hxjr$k{sen;Z6{84oQSxS`~$t!^9;7xObNdgLR~379c0TOei&@ zfC`Ld@Mi5E4i7q)Pfim;LgJ8NW{ezN9pvlXLb09}%JsESLj`{WshQMHu*tc40sb!D z*rwwrre=_mmMijV?(B#6wVPs=>Zf6V?1ANR4X`<=J*!5Bjj(1EdYphWI5>!*p&_A>k&y>NhpikL zIO-OT(z^MYI%rsb|AQCcLWSZ<+d{H#iecoQfa;oB6qVNrRn#=0q@o_>RaD!GND)mr zR#aedA?->3EP;6hn<4^7DFLQjf=nD)HL=37;c$iuLq^tq$n3LlXg^X&vTWF*VXKKj z6IRqIK}GLxhY4I3N&OLa9<8XLb7bQ8D|eLlEowMlb@_088*9C zjj(29*hs)p!iFsuEKvHSQb9jb%J?HH*VN_;`!soIBnpFbB;-{O>dV#Lx5q>NU$MGk;45l zI|Ni>OGXiu-!Fg@L6BgD)4l|sLE0ZAm%>;gj`l?u1F4U!oL&TGk)@hHgn-Ou=-Bw+ zg^w@eltVIX=)ATnpxBUWqks(qRS6(=twk8Yk$zL@zUes$;4o|m&UEkARJo90!(sY? zS?`tr{j(M(s0%)2>KCaq6y6^zD58?G^26F zMl_+d5OBz=fNN-m)u+!k&Hv~ zU=o@~aRo39FMt`zG%Sx`R1CX-Sh&WQP;tjBx`Nu;Mx4-f#%-@8=#oz8xuUeJ z8e5wiFmVbdfECmKK{fpSBav#Li;QcRk$wF#@^4&3$;}I>(z<{;QUj@x)OqU?(oTE` zFEbm=%r6SiR8-W!^~5POTs?)>TNlx!N?T8=*1CvtQqj#z$h&cwbQKZTufU$}bsud0 zS+Xz~(?21z31+z+=2mV*fv>!uEs4oMcAFNv@EpX>Fe%m>| zI!Rk}S|PN9%0%JoNdMH_Bo#mfd>C07Y>fzO=DwhjV512%auZsFaJyC348ev#CR;NM znGl9do+JSoIzLN5Mp!ZuWV|w4B*>85xJIdhjPovJ$ciCJkZITl86{}gDqsn?5Nx>f z*gCn53jZq6U%;Kp7F5u2lbJSWlQeNDA zW*XZdn$XPRTVWJlDFy+U(e*HF%qTqrhWm&1TQ>^e#8M#}SAd^A^EO`BiGyWiE?#){ z6TEWH5^rBL!6!!HbUrGmxr3anFl+8yr+em3bz8DnY{`naVCF*wdLccFa-6YB^X z7MKM=#G3Zmf5R>aADP6G)z%__!_VUV;~(SYt3j}#_r;bhhTpvQIzDm8f<5gUN0y1_ zZbrX{6}>0M5f#EJWYDms$j{6uAQ?|T{XE__42K=T#gc(Tu(2WQ#*VIso6MXEHZBAi zSAvZbxeP}`?gJ&uM#s(%XC313wox!%(+|S4H@)$b^G^8jSx5Z%oD+UZ`Z?|Y;-U+F zbJYVc>jvNzU4Oi!PmuWAA0p$KA0nSrL@Ioi zTvF{*-+|H3e~yg&Qmk!n!R(eXqJH!(R6qNDivJOcDGjTDlui37q_}5(g7Bw*hR~;e z3b&V^g|%BSZbZ@lof0h_-Es{ zZ(YH!KfZzEPC4Sb7&d02&!tiHr^v9ejLODSuit_}QV%{jehkl_^MOmjFdQ9{=U*PvC8RH(W3Y!0DUU@L&Gx z|G@wJ$%pvJ*agR3Q{Y0+_EQ}b{OXNUc-tTbR#AC)=fVxV@XrBJxjdv!FAmBDL^b$8g3if;*Af_L)X6?2?U@h0!?($2w6j81g8-Jn_zB= zD;dF!8`tpSH4j8q&l0?b;X^<&aSOo**BoG%I|3bh7rNG9+;)q=Z{NR+H+78g?hR)= zOa51G`@t|Y2d|yIiswGj!L_hj+;$AX)9-8HwPTm@^hrCI24>>B|MHE>|UxrtX zY2&GnPvW?HIxbwkg?DZT5)i2pLa?!<_d@`OD>oG8K)`V#z_C^1K<_47i~2DQa7e7i zbxSY2NuYU(K=PwAj`;YxEleDPBsobkRq2+w2Yze=D z^TURv1{)Daz)>Ie{2*z9jppO;4;kgY9JUw7VQR2Z^wr!?Jmh(AU$STzHUc;*&}dR? zYb)B?+R)L_u@5@xmX6ZOc@S^}Y}Bn9j`+L(Aj^ho<;QIZHg-j@4$Q*HKsTD>lhAdQ zOy1L{;Qz~Cz~kH*_;>`s$d}A^s&U&>AINRhjs z*#nN;HzSWk+if~y&=6z-bK3-H{IbcKVZf-gYt5)2Bdi&Q4A&}UYlbZu0*y^V-QLJE zl>}f|0x(pVt02RpowyH%hu5Cc(!ozZ(uaOz9SlOs@&2h(_{BR$xNJ-RL(~ z4{<%b8K<>w;+xN3#x3s{g4A#Dsbd~lJd$O@9oE|3$++T@2_LUd#mPs^Tdi}@v^#u>A>DS_=w?4&h zj@d)sI}9(rc?q`z)A5sEJ%@KKl5tY|I$kyj#T7#%{PLtZSzBbq1(k|UaJ`^>TrnU3 zy<-WNz%cys%@1K2)_}{`F5smL_HYge!_zN)id*`&_{l3*5mq)On#p2{hDoD{%x;HU zcnKWonfPUP!#}&5K-G@d-aC#9ZiQ5VXs6$<362?E(6e#I3-4*czGxcP4R7PAvo5%9 zVSs;p`aM`>_2JbI-^ahbWlRNnHJ*9l9lT}`iqqP+@q^cOaL&XEkNxsPm{Gz0^6T%D zH4uVN&)vXJ-nfNZVP&E}N3v`PHdlis*d&zWsW;!lrxxD$;g4UzMelN0MOWdJjyAsg z+F4w8564e_{Q{0#Mc{i>c)n;r79qWR$4_1&*buPjx_JDBo1loW9*aCjRv8pzOgWLE(AAbIc5q@;RO;|tAT=&3n16QgD z_~HAf?ePx5W~9FxV~G)2&>&%@(8 z{{r9de+$7s_!q?d@S8~a@i&o0%Kh<^DEPr+aC`cfh>TCe0+k=p5wXy}a2;(uedwK< zg`JizV(FNIAAbXRKY0>4Klvuoe*DjfCq@3~Ul91ie}(_|z6D3Ja0F~38(^&to72Y# zHkUs)Y*X1=}DUaVDw+9tjO4ukNBTL#pcnrfveL%pzW;GRL z4#Gxd)i7`vEWQ-Rb8pmO)7aRErluyew6qB5w70hlYloqu$;wd&j&hWmvN`Qg*f=q4 z$g(-*P>kEYImif)LepEXqSo3RMK3>tj-US!6~Foga$k8FIp6y}ybN4molXS>73RCJ zAyCLrQG#Zll%S#XyPzS1=}y5dl|nXi{uDOWh=_Tbe|wDFEzZqjvMrh@%dQ(wIO?g^apt$=f8I~+2*pyTX~SC8x9-7~lF zn>S1ml3I*6uNok#asqF@@CshLXoHKl>~Kok0d5HuIDPUuUVF6Za>W%3 zd%Sqw7k<^_c<1zGyl;~Om)HdS$FH8j>sM{?)Zdc(bR9Ow14@sc4G zbYvN@72}lCNtSvw?9$ut?x!E)mFwa3JG9U{Q%%qGZJcn+mAGl`i+9bU@Z3#bs*JeeEImK(fGD_lhYPu?WnRZ zan%REyyTAGY5C%$kvrZe%joA9-SO&0YdE<0QTi}S9|=!C61yZfpD;MN`Qu%BMlWgm z;`fH3(9*U*@O!Vp`&U0gz*9d)*wa5o%x`~)Y^k`tiQUQm>!=43fxEW0i80zr2pOny1hDm-2I7*nvQo=-Cn$wbhS4xd?^8un#)2r6V`3v6VACJiHG$+=rtar6vQ1x$-q7 zXqY}6p@hvj=R%zFq?g_>1U3Kq1X5pn0rlVf2c(ec8~yVipzQI#L;nBuUlIAi8CYfa z2+M{G{SX2HgX2)p5L}d?i6pB-dyugbfRQA1{HsAm07fyAOo-A`&G_A8r||q$KbZ04zo-f- z+&{rvhEcFf>w*d8uj?9u-~RqAbP~E?8B>T~QQ>sTzYb?_Tj5t9J5u4_ju+p%f;SCQ zVI7r=pTDYwPjoEsqc^U@D5VdV4Gi&}m#*WwTMT~ss;-#i$$d6L1RS0~${qTaR7i1u z&Ms_Ty^foa9k`@th@U=x9(oMNxO&m-c0orUzx>o3cDci_CP>;*LHfJnWC3|s!Y#iW z@1MDWS8l|?E<6#>(Y2c<){%AaCN2dx;ezfBylfmGW|+UC8%_m(2U)eH_~~=c>O|Q*FF&oo8^`e4xvO~o ziZ2}VddXsGf_Zove(~ZJTnVH+sG@W1#09*i69`L!ig9EGS)&!wC^iNTSvgh$I0Pno zFS&ooge+;T@ES2xn)__7dS>GT%Ot#Q7LVWQgy9#LeDL#2zWC*3Km3aH>nncv%~gLq zdoviX8OPyulX$#l6oU_~5^>Eg1Q(ps@H)MZZ=1&86`dgb{#FoPCHJ-4!FZh@_y)Oe z=mz60yS6UI!bX-lY@QJFYz{V~eHPfXKkXg}w|M z2FtGHvMaJ+gj9n76rhnOcmh74VU)Lho6YA$O~ zYcAutGF(ZbWmb@AKx-ov-wB5?R*;+6BxFoW ze5_}TO99mczb>j#d*WBGoWdEqV0?Vl4yJtFXLWHSyb(8S9Pxo&5?NtIc=3ZvcT zju}PZw2=vZ`w`{;{tdi(&JDrz`+Rir65hWN2)AIe0N%QQ4=(88v~dJn0<-YZ@!NRk z#8qgy=93jWgpizGgyi^1oPw6>*@R0!gEtfESXb=y#qHdhL?Tph-xo|1$!ws^$pMK>mUjFnNPB>;j+bI<9 z>PEmJrw>=H?D2tZJWQyj|Eu4BfDi3b#HclHlC+K^>+IP3`0dAJt-byhKC*~_6;&8s zJADN&e0&kFlf_{Yk&hSOI*aFzU&o8*te_u~i#N{N;6_j-tjX#-d4?(y+T52@M-_x} z7_$gErje>qYxG;Ng=0Qh4DBUI7P+YO2^ahSFbc@1uJF-+9!$}cz?-95~(sAC?ZI=k> zx&hU!f>bHNhFlpqQXdYFOrsidOaXrW?3;MyN~joW zZJp8~?$emgVM_U%$2Eb64)c5ww&1v*fR}&a;m>9~ID!Dh!-LtXv*LL`~z4L`CN+{o{l)&}p?Hh9qc z;z4Qr$=dLueebk(coSe)oQ6TeD>~Q`=(vBwo~#_6ufhei7}Z62+0psAIm$MzQ#2FW z&^2%v$8n#F4ZREOx2NmjCMupM!z1U!FlchQKaS@T@rX7a^3B7d8N||%b~+aWC$X7; z!XwW(EnBYyc7lZw!-Dc-OOYYLATgom$>P-xOh|g(@%ZJhpTQgY(!i13)dghWh+)!I z!jj^9&~l4|w!5TT9&yki-S&)! zt`{o-2A**+b&G(hXAI1}<6!9%4=djUSo^UOVdGBOPraSWY<@L(yyqm+6&DGftJ2F;$7 zeK$%;O>282&<+zrsGy(#MMXvXpi^C4tr0kE;qbr#1`ZF6*3_IPTQ>(_!xUoJIMYAd zNrxhwcPG$zlDtX?I3+meQ;IYGRX7vcKraUslpa}Bh;m`Wg}O9AK-r8YL*^i8luc%u zteJL^$L>fowq{6T6#xbePt4r4W||IKGXxn1jXc6^uj60URHlRs7tnG+EedPyk0B5U z&`<%Puw?dT`LlSYze*|q84>{GeFFj$yS!`+FAKxZNw@?V&U0^R8EI)7St33(AFrR+ z!wV;L@a!koaD@sU?k5uY?w(U}`JA$KBLPR6`=jNVfQt@kRCrQ>7)>H@utXCfL5mC0 z-PHqFRFF!NRuB*q80neqiPOsSa#RyQ$pWzCxj7WZaNi%E`@Mv~-r+TEA@ zLX?LSLB*L|X956=!+5@vSTTTM!yW1@^7HBeVg&*EU9IT%<&kv^5;3oaK|;q$b8Msu zoYLe|PQ!qaMtgCXSY<$UpYmu!wmx`%jMS9MR_=aDlR0_LjcT<43fr6O#4i5^{Cf~g z$gk^@iZj+>&-R^-%Wnb2K3%BWG)1h<0JP%yzY>X=Pk4G3&T`= z?^Xi-csmh4)=j`qbmQ?;(l7K9 z@GJcU{Kha5zco(6GozKes7hE*Q`_VhD{pYw9mpjF8O%h zy$BzAmf{#yG(RPspm*_T#Jx{)>SXxDrr;Oa3KaYM+g)CkZq{?B}7+UJRZ6a8QTMgW#hnUK#edmmJQ( zIcU8o0iz64#!1KQ2Z}scK$bF27F#xA6q>Mp4njs2!zMdB8@ai;$j{Fg&?zk~-L-Pm zfx}H|>dk3~SvR||;U+Yu4^wCtHck?3&M|0IV!zlYOXq4p1+?i!;lhy%a4s0Qz~@eS z9vv25z`*H1M4_a8{V*!9>{&4~T-p#s$4aBiTH&vfG?bZV{!^`)@)w=|Y{~2bh6=N! zdI3B;Du{Tdzcm+5bX}HIAnd_~3*&0h!7e)4sqmK9G!rl(sK{%Eu`AXWV+ip2W1*}H zNo0*2CS4Y#(WUgd^7>_5L#4cg*iVoUahyg@s}QeqW<=JISX48yUDS5<zpJX^lu#gtMl)xfDqS_bn1SK(P zmG>!5i2MSueBG3fSam_%BSS+a0TGqRn&Ej=nq(x4EFFUgvQh~o1|+d&8dU^L=pAIh z=!df9OA0Nacc?`84H!NI9V70`VNlVzbm=#|PPP2Aer5Q`tq`x;X5ksrRQ!zK@tqq4 znakmL@=_Qn9N#2;>q-Rv?OGJReIo|n(Tc%$wPNvoa(}2DjUSPId@Bk+CH+Dt8o$(y z!LRjW@U%f3erp(qXN}_Uym1^}Fp0y9rtx^$EFQnNNW^QFNqEC58E@OA;XTJJeBhje zkKJGN-~L|f|qLf+)QN@#S2XmC|QwpV%V~NR6VHy z`q2&0W6{1Yh3iJ}eX?pa>h__k71E{Jn=a+6r;=_YDWYySUYS-F$Md=Q8YI!Nk(3XI zi|bKbLqrWhjI18{e)!(Vk};%vFrs@lifP;xH|Gh_b1^0uneZf0u_`q~jaP@}6{DM_ zaE@1#X+o1|mNTQYW=X9uCka1?(Q!iYECL;+Jxmr#(eGuM*evE2vADU8WhslpIbL1d zl*e)0oQ=esVhwKi7@JFZJT_Yr_OQZIrlY-IylfMY3$zx_QMa1+S82^SVts-m=fY zJC51-z$FhKlZAE6vj``=i*eewgg{t|^ZsRIkq|I~DupfwOS(dq%oVa^xLNF~O4n%r zS|};38aL>jy-Dx!O?tnDOYiOts(@W05Q%2A)b>XX8x}XCJG_|y$Ove#48B6kacj}xd=DOL^krz#%23xTyc!u)m5ihTyu)U4VO4* zyTwDtBLR9|NigzBhKX-7%>7ef5s(T?p%fttSsX_)_fHk+g#1!qrjjWgZ|a*u`H(0- zW7;wbQyj;ui^E0QL}*j`UCGCg*sm?z`|Flc^#0tUJcT@y z6jFs9klJyaj?;T3?;W>$tTJyFr<3z1QMk5{>i+22Xp(qlyU$J~N-w192f4v=q2EF% zhJKU76s?l9e}mFW$4kHYW%}(d(El0t#T>JWzz1fbc*i&xZx{sPb^QRmrV{&KHwd8c zATjy#Eu#>;ZA>x>5-S0`LwZ-G_lyJaKIub~Abe!X3dYA~!T7{H7{^GTT7=*@>4YW8 zDg>vjLvh+B9A|7JaLzsw=N+POf#n#5OODaF?8J(}6}o=z6B45Pko@!>lYdXVuaX^A*Bn?_gQJXuD6Y}o8U;o+qTIGQ2!Agg6h%5?jWA*mpvgw12zk0a9V zL56{%v}goiR8n8AMuts7LIRSKl8~C3dH^`whr^@Qc+fyS&(&&fK49G_N2V#8()PiI z>BE74|3k8D66*1ZOEGi;i{RiFjk@Lz)VFr+R|~5Xbt=_1@2Q5>bcp15m6XTbUtM&b zF4PLC&P(C)`6Wqdl#;IVA*6nPUlnP(mxt9KnxDpFI@KhHKa3RVHRjDy&tH}zt(<<} zv8pt3xO)0OF*OKvqp?j=Q@f;QQcFkAL#tU<`+hYE?d7XUjj~kNAge)0zQ#XH2k*BN zap`%`CE#2o3y3F5pSbzQfsJyIfGkZ-XzC#0ea&#$FXi9>86fKW5-`*OqfAfkVa;gb zxV?RbhnUQ%vSt`CnkI586&o9i`1tq(z>)iK7&vnOjV9}cN2c*|HtJ1jUt`e7O=ujz zCeLHPcnMBq*&K5%!Bww31jc2l<|rR+N88bMw0-egTUS3>bg=?9{9(J}Uj}TvRMHT~ zeKt>e5m*>Ds*ZdaGWYARkpc6Ez(xkh9z-;Usr!WpBn%u`d$8F94eK$sUgTyohK;aj z_Q1l{jId~Ai^sq(S4i6gOk!r=o#V9W?7tLur2Z#G^c*3VV zGELc(rd(Cv0BqRgdE%*82sZUN=2n7h-udv3Ovl}Oz~ai5(8BT-RyH9PE1@?T}YdYT7IJ_ldhJYPFqCtvUSHn5~2 z{liK;2fFvQjl06XyiR_#``~Nmb1$v3fB*4EI?|E0uucEll@0B<;THF$!{(pw1DkIW zXjo4O=mHZ00kPfwSNYdh*d(CL-u#qLgdBhrl zCoC*X04F*+dLMAIvaIeq@_ggzmqjxg!{)kAK0L$I2nN99 z+`7=r(iVC^Je zn-7=Z6pT)8qN8s?XmDx=0nUavt>c84v}%-9bs(?27d~!gaE`8`f^-Yjb-iflnn&-@ zGTQs*caPntfhCNL&*9dIH}KX)H}p*2LC?rK+PlV3UO$5R%1Y?l_@lgil5VsFRb7kd z8=ON~bq`wlm(eq{gwFmsR5uXh23N?xK<7Gmo}sC2_}G|0$0Z#LWZhWa)`E3l9&&PP z(K5V&4gy4Z{V=-eTHAVO(K)z;Zo0NEQfu$rq1WF(v5oLRPZ;>+QocY=d?553LohlA zG`0+&x@`tSeZ$bv)k03wG6qMNQC;7Q#-2rbE=z|$mm?kNFGvHU>&Pr>#7*}&TnVoH z(qSXkM^l5%6C9>$LQ|h_!%{YrDgElwYz48qA2dqIVahmVm?lZ-$WI{A1REZaCd7Ub zrWrQ7;VianC@df#U>7)1QBn7`Zn!B;eV~Bcly(3%@)9*NY&b%|CY~%C*Ag*KLaN&+MtQ7u&dXNkepuwC;uqaH4ebc z%m!LFEa2cC0zHQ?G7l^8$r*j*m$ky$$sg6-YiQ}7JCJYJ@D?Hhy>P)a0HxIgTPI8C zyCnBl}VD-^X5#Cqlr44)hH#?;fjE|HKyDOmE?;WhgB5Zo)jU7`~QfF!rm!*gVi$U4!f90ch?Vf`Pdy zyj%haLQ$CB0o;u3U}NWnYdSWlY3#&>(*`IeD0K83JWosa0($$$VQOFtkAMi6I3=Q? zx*Ue~u5h!o!tX!64O2sXT+_2A@KKnDKi+x!4D1}dVd|WKuCYxGdCsAGbO&+4o_OWM z%dm0q!A1I~F!7Fu>6J@3cHIuzm(Ib&F&vimj!4Za!I^8?XrBeV%}inASB}2XRgL)` z=}3P`>KR%^dO?F|M!QU~F;8xLbg*?o6*Z(+m$+IitN{rj?lALBN065z+ydip;p21gO0Gj*VGC;7rqM<fhH%@<|g}k;^vZD5%M^@kX7UBZk@$;X(grNKpv{V#8&)NyD=5{!(>x;sw zPE@x}A;QN2FTAaV;D|`P_|j`)QOG{J7EO6}k8B~>*Bu7_g;?1J@{+<};SmJmD_YQX zOG8n42db-DaNE!TDcR*XbLASUdlzAGLl>^G&FC9h(U|X%j`Wu#C2TGQRlw{K!$ywd zW;7W#>?)z5gb+&|Hun$bu)_hO$*+_guAWZXCzl|i2|5SE*t${m)u>>@uKG}DFE6is z)=fl2gcuH;n3%Y)DUC;^alZ}ExzW^b!-E8rBhn6qjU&P4V}^~-LD+N+t&=qqhLE&I z42*9hCoKg5iIqr-i$+XgFY*%OaQ?CZ^ligX)vi}%5 z{884ijCPHd%^cbW*3nQ}fKSisptO4jjaAif35-WW^AL=6v~iOl7gscl%DgOG)Ac}o zM>nqDutG`eA_45+^|LzZ9#RsM;T~Iw!HI3;XQshBt^{@EHMnv08g3f7Bd@Fre!-E* zFRI4zV{hQ%H6z@#2tiZdDna;Qo<};;Uz+yArW~e8tzQ~!4wD%A%&<{FLLD5+efBG* zOs7o4uGD8E!(l&2WO%6W-!Dw|OH#t*LD~-$hRp6j0fjt0Jr7tn+?2+1Z{(&l9tJJ< z+k7#wan%eP?iXqAUlE;q+~(TWw?zI$wD(bA-@Aa$p*5+{CyM|9LH@p`RfAQttDXgP z4X&WIdzSVkf5*Uz=$LQroF(gLk;0bg98|DVcpL3^53f?(3>EaNbUp&X09zgNs(dt@ zLl#|UD_vjT=mr(?biSTNboMWyt$!Kad=7EGdAgTn^p31ing#R-S3_R1#J!V+*1x## zIdlxHiopte-Fy$++*Vgs1YHY9)b(tMd*J8OtSQeU9qBJj`(P9J`Cy}L7E?+rxTzMV z)Het=Y}qKmp$Q~%n0mOn_NQU@AVBUX^|bQ-KFBC1Z)#kkM%G@x%)TZwmI5*|c--CH zcdZ-srZjm}nzG+U(|j9wa;I|m^L?7pxX-3UG^05Or($SglfbdCCn`i+2`rLdmMV_N%g5}VPlWBI*-d*tsg60Jc7{=*e;RZ4m6k&g72s)4~#Bxg}s;~Gn_ zsrW)iqp8D2xq^TaHd5OCuz46M0VDg>tszOD4>tSa6@vmaK}R&HDd*VmdT0cZZ>W~8 zISf29Y+PJiL{pl#xA#8S@B~lgAb~#!Hp-=Hc$k`iO=3MhQLP~05|W0I$!)av@kB({ zBD#mx&^5SJ#tV{<2sGBB}+ zyH6yVx@J+^GDi9Ggwee``8?d0(?7n0-q9_w&wV=b`PgLV^X)s1!+RId)Hy5iWmojQ z(Dm%5QK`9Wp3=-w8t!kI7yV1hcs?IrS990QzT>%1hx>pUI_6N{J||r6uj-(4D~~_Y zk^U0ZKe~ym;%3|=%SM`K^EqLouwZ1^NS4c9xE!`?*^qek03ia75)?8-)GZg~z9zuP zVTXO0Q(fwikyjW{hDrOHA;Z!PpFOZBAtU?cePQ7cY@D5)MN^ux-$ps#h8O2lAO0-Q zwb3-O^PynF%hlXa8z8_P;S8DLs&15!7&hu1eoApcUe!2^ywX-t81IG?XsVk=5u22c z{;^GD7d7F!mLUNr3BeKR2nXuiYF0VrN5E2?tD$`g z74-v%jLkq&dI{=U$Hn!^=c{cQ7w6-`Up|K6($L(A-u^)h4US=GU<{4T9cb;Irg&*^ z14F8=nJkpfHuUxPkb1>KZEWoq_b2DoNzhD8FGYDxH~kZFe~%RYfnGCSyViuO*4@x? z?88O#Zk#dcM0vwBrP~`oApj*HC5iV1KuLTJ^1U4CNPkX}2M921u8I`|J{xT0zL?!G zHP{HKuwRZ-?W@Cv!SJL?N@yryqYfT9OtUp3YY!UgU{UVNVd{QOX+8^VGy!JUPaygR z!-&OAYJUvaxTuz^xv5$~K!VMzuxLuEdZ4Fogs8Y|3{7Fz%8?6K7F!tIWX%jt-bFUO zNV<9k$SrE7FljbE7ydQPV@OCX!oc_@QnRaJZtaeY+#19sMrc$z z0i+oIAxY%VqIA`}u;IM8Ahxx4L0~{2OpJ|SXJ-pnS2wtM2BT+WL!_x|oe<|!!lu4` z50IV$>TS*V?m)+QwdNu8wgk(mFQRCQ(^lhT4YSUEnZm zk~1q%QQIS6)25p9^P^*Rc>Zz^@~X%R?4Cq!7y(5ZvDZZB$||U#XH|oo zLRKxZ@~Z{B_`a(e2E~8_`MQsEq(2uaVZ+PS@Fxa7D{KTvG)RC*wp`T16>+?R00ToB zBp``FAw%STmW#SymJB3Gdti~Z4<3iaDW!~4hYIg2!}k39`)f3bVIwRX7Qx2J$>{)W zh=@rS%}2a888=PEB;>-$)fe7=VX$*>r;B%mm$x4>^Xt(?FIQVHTN+~olOhaG zY$7eE2KFui!ea3bjzw5(7D8h(5geTXSHCz|I)}hNG=VIfG=#@w3)plGa?{wHD1;d{ z`Ub{mXsFx$kWX}U1oVxp&_BK{&R5?yAwSp5@@@IR**ulsjTZEh;Z{F zgJcfB`6v(X+-QYu;0Qtz`%&NAk2fynp`>n-fGLe!YwVbWZ%_>U!;%pYo&tZ8ANj3Z zLSW_Ohy2ne@%*LhKGKo?eAGLg^?mS5YhY-C`uaN2F~v6-6&V3zb9=I`c0}Rd zNMPaf^@znmdC^XS4)?*dwBbhOX_O5VVR2~zmfcz?ZZAMfJNLaTiGH6tg3aVu7ejvu|0<%Sp|yBrBwkz`#vl44ef#{ZSfTy;ui_$Ss26GPEo* z@alzpR5Xmy^Wy%YB>|iGlx!4N)T5%J4J8!~NJuY0PEj@8cRoEcvI^DvSq^~(&XXKypq8EU?Z>oe7_}Y?h6~Y#KaU0ZDZ&oh;YGfX>A8V{Ke}L7vTQ6ZE#Tnjf|9BZ^p9IZV-F&;8&O|J>6TlO)Eg+8xoR6)5gd_*=!87v6x7m7 zx+<&`o|M_qzW^g+Gc-0fh?%S0Ru~-}2~!Juj85O7G}2rbJ|8a=!^iRD(T<)4%C`~b z4L7m4I*-bc61-gYGsILz(nDJid9#^c*VK!N(N0W^bYP&j2IkEl;(GTh&>ndc?#-6y z9azJ_*d|$ARj6s~r`p;I9mgw2FXH(R1Mu950@z1w!!xu3FI;TI8&``c-JrM@K1V~_ zINfg>##Z_f(&31WJ8LK?u0>`=C-Q4LQBmDSY1dTOeWWA(`Dkc-16jpQ0ya0os$lb3 zVdEu@GCS;BH9{Pxh?mnVk7FpXH6u$M7!M1XgXviNK_W{NP}r}O9KNT|1{(&5`bq)+ zL}1wsQ-S7>1{;r*Mx6C7!!7?pxDsq8XLm3-zKQzQF?jg|!rz}RA}9h0$+?J*O+{jA zKDz0}=^I%U%FL}qOk5h0(((`*ksvPI&CQc)?rj*F*b;>?7yfBkWtf<|ha57aT|Glk zQr?Kdx^9GLH=~UT?Z_c#7}uYcU{l|MpzsvY$)8tLN7u71tQ0oG87BJrMyRYP7iJtU znGhTt0Ao{I${*rsYj?m_WzHbNSG5Z@Vr-&a0`r1AuGkk!Kl zJcF^Op^HG%jLDHkvTQ10mUj+@t#3ki@NGnOgkfN41H*J*S$Q>LFhT$5ng9u(=cV^; z@$|>3xb3@vh>QWec%u(5o=HbT%K%-=y10G@Z&Q6I`j^`9QSmP@u{KCQVk=V1I+0Cq zuBs)Aimrq6JJONn!h{7B#@jHyqWq z9Vn`9Mtp89O3G?6F*}Nq?i|d|k=0S%KvqpI;u0m;@Hckkytq%v+`<-@E?-9ZB28!Cyg1*;PK&IN2&{{jk1 z8wn_PD6eriy3$QWriuXvegP5i@Ck#De-r`($TA|oUtkP;17c8G)rpeIc2Q98o{PZI zJG@MV_Ux`Y`{pG0Q5>JIdvH;lZ&<)aI)+t9VcGeWC?J6471ko3lv`MX9BfqFdEUH;R%FV4pWBsU@gT(ob5)6tf+6l(vVtF4vCx^$SRv{=d55ZA|@Cz#t zZe&7<$e$s})(u~0S#<}>=)P)d`sw~!QB>Z7%9?hRRkfh4ds^hVd%s6I(w~VYsREi; z){0vm@wgpX3&*UkFC8{KSU}bjVt~LN95gkdDfOUu%{mAW^{~UjW!UUVGh_}66Z348 zfKitMG%QC)M=`PUk-^3%y$P56E1(}z0&DLW^bJg*rDIsAxqS%j-Q!dMjtRdUu1Or< z+Bu4jo(b|(7)ue~+BveDUr}iTB4bhzn~=GynD`8mI-b@WWC+zGla@{`zY>l&qW_kY$$I?`8BJ$;jiODiVW zBtS2^4$j%#IHhI$rNTxY^1L_nS%ShJ29gJfts%{Dk#)cL{h(p(hY9PjCNk&23A2oxC9#8 z^8b?0aik;t8EI#89i>&Z(D6)wK}Giob8Hw4>afw&Y$k`R?;oD- z{>^AC86---y7tAX0Yx1)`}ZY?XatQ)qIr$PlRFWTm<{|;;Pd+@%-bVoYUpPBC6*+x};Gj0=XjA9$$p4a>3z((0evun|)=GZ78 zqx8!VkwK#F@_+$lIuWMWm!ugmEG0B{fJJ@C^PV`I0Ha!tM)c7rAfpspK#v?YVR>yZh^&WgTs1E0+hc=X2nNp1 z&K+!QY>@f8NLtzz_or-cZ(~cP?VTOm6SHIP?F-ke9o)TpSERdh_nz?IQSEC^|M|uD zA+GM;U5)X7sJ7`|?%cVfx^|`iaB=*-d-sGzGf1#0udEf%;AlJAzUmv73p~M^%N7=Y z#zbA*MDGZftH~bDIkC zd)w&i?nGDLDAwtP+uYowIE4sUTRT#Ly0Ny5(UDQC(Qzva(-b$R2S%r-azHg|X66%++6muNVow;{M}2xo4Yd@-<5 zEkz^m%gtv`sQPMT*eKzk1c!Q)nkJyg;hN&4FwL;}Oz=^q-G$GgO=g;;0*t)=8SkqA zv)iP`VXC-C4x7k=4w%I?!6~s;z-E1Q4O8R8XsOOZb#5pIJ1Q~MS%s#`Z1i+AB0Dh% zJ5-3Tt#9Ja_9DWat)ORWPZ#cm_Ni6z;xUZw?2rYdDo2;b`;b@Fimi=BloXU=VQB)+ z2KtE1EJsyYDMlC8MY_8L7BL!)3SeTL*ro?NkYC+~9kNXBvNgnc-(idDj<6EA@Lwfs zjPFmW_01iu%?`lXSPzy?uHySRGsKH~+XOALFm`sxx}tO3rMx5--lcz-t=)6%5SXNJ z)rD-#qo|}Dlgo5{bYqKSjqr4H!}Rt&EDzMe(jyEjBB69m!iuAO*rM9p+7>Z8+nZv) zwq7%A)(OVzTRW<~`)}K;3m6@nRPAZrIKM5vN!7N!GEFZ^BZjA!R3V>z+gznWWKDwR zot;hcOTXRG_LsdWVZ&hI${v?BT;|AOGHkS6qv4#{j##T}{2*v#|1LN*#H*(f`vNd52_ifo zKu7_egVqi2OR$k8Lq{I+EW<{OMkDu;!sao8O-xZItP+~xl3Xufv$3&--nJTaHsoV? zXaYUG6Br#|K}l8=a$+1%lo=}u&uuD{tCDFfK zwM9wG08%})@T*roK+DK1YVzaZXm5*xx?XhE6~Nrw5~(FkWHD@!m9ZwS;~u@xE6XcX z&~G8y#TX8u`Qo1e_tsI7nU1>lF$^?RA-}i=*$G~7af?PqYAEb1Tv6N7i#+l>*f^u6 zYXlWp;jptbhrM?cdKz=^+h?AKbxaY#_AcfJt6*(mfpIE#7rM)!?-+pgmKs=^S|G8o z2~)!zaC3BkUw9^2a2@b-Fh@Xm9ySR!^#mL4vtih5Zc52FE~e=3~YIS zN5ziCi6K-~H$z6#Hj$A5&G3@(66R}xvhG>opXqOaos~I4!Xl7dM8N54KxTQXh~sU0 zTRMXb`5o1X?+DA1!tY4?)p1t%`Sb5#a)a{hDuHECoCx1*u9PykCugME7~;I~v*Ya! zrRV!T(pO*n+pn#!@4|+ghTW(lcJAz1F%X8!on6=jMnT6d25vbWh^!jH*@uRWO7gy% z`iXsQ$05{m8QVRGX|aI zNqGOmb8vSu$EBM(u)M7c8?P9QP0wMOtg(gJQDnwOBQd=MGs|mKt)GDLWo_hi&0uGp z;Das1+FKw#zYC42QE>MPgQebC-GsCGE!-q)&DQ7|Leq-j zVQheu>_S*tTcf;Z5*uXIP4|_<#?lgFRIy*^u7H(S5PYl*U|o9=LTw8=VAgw#wMDkzvDdU*C`{AAdJp1Y|b||MJuj+-yu?YGj1u${sAujlF5-jp+TPWQq>`nDx=IV#O{$WJ;y1>ZB9letai10B%LHm@*Z=^OEXU^(k zRt2wM^V4|xt+VKxm_uri8_XF{)MhQ6gY7FO2LRFVOE zdci~KJSzk@1})$Fk-pmE@?e$9mx+l9Vd3yf@xS=RFL3GNMWm;vV`XJUG^sIcJOd-4 z>k$jD{BFe5jN#nF!sY>Dz}ycul7+J$HcD`)>$8kh(*%zDNmDxI@ec!=gW3-pS!~H@ z8kNSMhJNI*Nh<4xb9y_x(i?Xzo1WGhwASQdu&*0+{{MhJ->)Iv>r-6Pvct$wKOIkI z^411YeXXG55Ge{Fs;eT-K_4GqwL(Qr6&hL^5#VTuoTe#E)Mr57Jr0ZGjZ^^HV5p}J zmIj^}9BGBKyA1;D?P2PhC2|>QDuCWCYs5u*;iQfe>PypM7nXyXcn`dD+7M-wcX?Gk zh6mf=XrKj`;54j~WivN5jGUwdq-K?3a()Thn+tF?xDL1Y3X$(!tRU3d3@K%OsErMT zt!p5>+$_*Dzk@hW1LQXiA=yzECvQ2UvbqwD%?+-0O4(ILYAE^j(>O(VVOlJE2~6B4q0k0K2%`e!RE&L zE^I2QYU!VqVI%bi1-cs`D7TS(_YiJpjev|6tS)rHo~*6_HxC4-)?==x2&YY)P+Ob? z-`E(0JJ=wQe!I1eRm@J$AU{1C+82(&F}fH@;dUru*zh0(f?RoeFixC2kA#{5^p>Z< zDXs`DIk7NzNu+C7fxCqx;-Z6KXzGZ$=^>nY??X6ydExlSpP;NyY9uU5@-3x*3LUL<##3Lmz1xB%jEM~00a!N$L+2Z{9) zICq<2^DTnSYbw}$zIirMKaFBv0UHL$!@@?BQz{%Aftu4(kxOx^=PR>Y;kB7dt9_(#QaM8#U zeQo79ci{%|%BYsDuLUO`U*zN!BQr4^W_sH23Qxr%75>vy(5~=3t}Ka{e2#!K+*JXc z3m0JP>;k{2B;;m9LHoK6w2ohZlV219y=>7jxr#(zhENyA>0AakufomS3#B!U2=}r; zRreTToh=cYSq^toZPU}|#XMnTwcUOBA$H9(V6xaarn5TN^B)=V^?> zoOF1mRG=c-8z#PaA}-v)4WYsQ@C{4C@^BkIdjA}Xnp)A&*n-(*sh=i4)(IiG1ijuW zyz}zQFp5kc2!%|>xa1#NkB?$DfCJ1jL!rB2H!%IjE4PZP3E?c;);XWHKZ`i6~0Ljg03>!nQIE0q=BfWVF=Wm;Sp|FwrYUF(x zHr$NHu-SzS0Y`>~5+0mJ-aiPHJ>cvQSAydHK#^S@2q655xV?A^+Xs`wAR|k%X5_vZ z87}O~ex6sul7aK+Ve|CM$g1f>KzF5z3 zJmcEV;Gp!~>cPPQ%*-ufq>qm)$MEl(QQqBy zBj{~wLU~0kCZ^{wHMw_9viLgZ7M3tR)Ge;3zNMQWF^A@w8Z@`}h=(&YG$`f{jgZSD z8|-ct>3fI9#P#!Bqv63pjL>zB^mn4JsSOj8WUWn3V}525HRYwKZs;K3EupWY znXah{qtgpmoSQ;zc{!>YTE%@bT=-o4&!>b9542ca+Yo~Z5(7+e=7v68e4|iPRseHD zJy@EVAfcd{uB#g6#-?y`Fv2kdXSCK8AR?m>1C1rnx_SXFL2<}QjE9N24UF~m5tvqm zj0A6#cTI^l^x>{5Sm;~8(ZUSA(FGXkt;1DqBh<9C!OPMJR(6)~j>>O>#JltQ>J$M;}Qg^@xq|!oU(i z+{+i8LkmcY2}53UKkZw?%*h>*DWzE3+NMH@3Zx@_<;Cyt%F3$vzvHrnB?Cq&hK&co z#@HtT(Un8UZkxdc-7gk4>QY)ZG8~jZd5{hR&i*h76f!K7QV-uvEAOkMjNdmn;Jy}( zED1IOIBemlfO0=EgdTY_T5jC{LW+73p5KOx`gWq3XKs$6GLG@Fag2;jQ-MA&3U3jn zCN6k6uUP^L?@y71!TSt=Ns8ko^!eE7nHgbmOimIsD2y*`g2LHV9>?jY33juTerk#* zkxmHsiTtLfRe4WhQjuPHJ?fH=nIUM2yx33I%GWU|u7T3*UZ>(ZRM$T-!FfpWoY%~> zbf2sVf(NIS?_ECEBpt(Gk>fa>bf07NPq%=Y+C~fwj|kZCKkLfsx}@c0j0_K>r+)-% z+xM_IJBhx5F>KxeR^}&=o)iZgV{>>?;lHtcM+}PK(PlG~qv#_T^C-K~kzq{Etxy55 zA>x-+dGl{SLeT7`{MNa@WNQo4bdPf@R5M*<}$7mN#~=L6+?jSwVbV+uNHM92mst z)V#=#^AUNHR#rDelk3v*I@N5~snRfn*(Ey9nv_OPE4fs|UEjeLr5orU!1(N<0FAik zBmEhOe@n@-;lhR`Lr0cqM#Eir1VqBrHv#cAL&)!(!$n;)eC-j#=0Q5Fzvgg2?ZHMV zC0vv+QSPft#Hsph9^8B;i}%%l!>+791=#%4Q!k;gVGvPe1Bfna#|1rG+@S)CCn$3I z^>sFfN#wGh!!(KtsP&CaNmR?xnC3`AJo&ATEE^vB%&_5teV!~Z)*@L0a$&x(xJ+@9 zpF3Y?hC7iQACIKeA_Bw))>ozVrk2S9<$TxIs6Z!Jt@C;4cU~nw$8#7@(v{;_9LF8D ze4LbSRSI8O7U`sX=@@dQ{G@$3jMK57)2)ef$myhOkk6~`?&e3X$dAH~^wrlY{r(H{ z^Qft**;RFQ^{%R_s!&>5hFPlcc?ZY9+%FNS^&=?hna4%FM*|zF8Ep?3hXI9kXxxEg zWp_Vhl-dP|8dTJ^?-&Az3>i(ZQED%KKWt>bkQ!wEXs{`59!5gd5aLTa1#EVxF#JQd zdpqmEon`W=hC3Z?hi>wu&Wfr!VYRX4#6Q$w8s#Ru$$2agWEKccqZ88@9-9(Pjz>Du zA6ui7v*_vVM>`cjyh_Hx;vz;y#xOiQDw@kXI=ZQ_Dxvrm_=d&9G9U@r&10zSU&JMS zg3Z4(Y`&Zo1k_<8gG1d)Ic)!MYetHb;`aka07D%hs(npxQ4g0Pq6CfX*VK>m7=cDu zFl^B%K(o)UfXzSoNS4ndhRutpXdOWs)iRPRx<3;%l$UPLf~fs!1G~8I?|t> zei;n77ffKJw-r2fVtRTO-93Hi>h48*dly+c4amtYKu24vfQ@xv67t(7P&c%U%MS}1 zF{yJuNFGMJuo0ut6tGZ0WS=FY2AKoUQ5?4$rUs5Dd>BFpVIzk<=4m0)DC1iB1{kgJ4^{5fb|d{ane*>LzHw`{80N0Hq$j`ZptGHDOOh9~Lm z>>QlczOg)x`A%D`k2zzu-5Nb5CTJ^jKy&VGtS=0!QUNiZw_)Mv4g(#1RP{)sroO0c zv9A>F!Stqo#kSA7T+O*O;D6c!|Li8|U);Y0eOdV)>Caw&?*v$7PGGE0Gi+*W8tcsH6bNp;Dw3^KVFUpN$L_**z30he&h$;owjg$1`ly z!}e2c3T4V&M*h`P=(6tqr=QE3dDZ8g}4(NlB+ zo~)(Z)|V%+Hs}S6*#Q&I*coxf-ElXJRvTe{s$Z1~hzzjB1i1|f*6>X%M@Mxw++3ZI zTRVXM<_y@FJEJhS2!3vk@Q=;M;_MWBoh)E!YKhYBDU7$~!^zefCZ;y%n_I$QT`t@` zoDq>-gN4CLIQscYC;AF)nqb3AzYI*wpm%&0jolqcsOg7qQ8&7WdT}Eg_(%GO{;oIh z0}}s({|7z#FH-;J0enY8_>qqEAbo=>Dz@1V37gP3*oUN`f-0VE6Kf9-o6n-p02_6E z7T8GsJ34D4@NPS zxDZ^5;Jk92PrZjR+8@T#q zz=kBxw~?FC9(FX^7Xce3IOMRy;xtJK7F6f|mv z4Udm+XlOudYpXa;-c}aIFxza3?KUH9wHafx%>>&WCKxHcz7IBGu3GSj%D~XfIz~!k z@X=`_G_|#(iwf852nVE9^y1#u63Wv)oIu7vN>>i`Xa+br|6Mcm?O|U8H8ihl46?_US;E`Vi=d5y486pZRaXR@P zUQY(hGl3t41F?<359zkG@_`FUz>mqeyF}K{xfI~N1i+{W_>B+n3i(Y7fl~yheb7)dFt>5qOSZbEMCx&jK4Cf{jyHD(VO4&^xpFrNBlB znLX{nh9MzCL+L+Ehgm^;ItUD9pNvv6aFpOt`o%s0L;!}|C&_Yo!i)BmaM37LKaB>! zD8;amt(!;QXVW<_g@(a-l(r6OgblAKP*+!Xpx1|M5r;auAxl#u zIM`buyS580#gWKs7{o|*HiCi@5aK}($Hx=5Ox)1aT8+@y7?Jl^Y10Io(#~PnrIV$W zQv$D?GI-^d!8NlO5d~#9L!fzyz~Nm6Tq6s_hGbg?SNS>5Z?y8OHfJZ0M5n& zug3$v1d!Lm01tA{rUJ>Gz!id02p#(~0@TGUAg-H0l}I3?ykGqjh7C9I{p*n)x!CIc zHc8WOBI~ol#w{WZ9b-!vS=_;OBMUXy@X+Vm_&i_g)C3#(TQ=%oQ9?%*tTJebqLNmQDL0Y*Gs0o>2_<%o4a|l)x#ykYH1e z(`3E8K(I+}1#YB~RYOon?<32E0CI+Of@DwD%#+T*hZOHj;4rHq7!g?h-^RdYvTp3j zqOm6TTV(P05PY-icALa6UB>V$m+>P#0{xQo8`m-X z*lXjy{du3M87(XxRso5~ZXQJy4}Io&Hje-{O3OwDg(g?2J(%ndm$etK1`9Qq+z&2F z?WH4EST-z%&K`jFMxc>Yg9g6gqX9PTYJ!ZcM-7`NpLqor-1G3n`6&F}GzsT*ZE<%; zTHW_(`|>tTuqkNngI;(#EMv1_9+M5zs7&aEq`)UNPgpju5pXOB9)E2|P;m!L2`1KL z(VQR%u@&Q50(_6GmGkLj(bNIAa{za8uQGfpfcGg4TSDItAPb3L<3z{X6KuR&B-mII zY+m~lg$>uRf8jcf^3q}q5A>k7yYonoK>fYl=xeUTM?M{R(o^$q!+L1gw6`KOIvFqD zbjQD44aZAXnRx%QF8=rL{+kLmpAc*=eMy$h!9JUZg~|QWNZJn^P0|D*W!(O-J-A3P zp?wkqM(OUQ*_+V02OI@h6jDOxk;3Mi&%T29tkUqG-|@%KZbl!$<`He0V8dT49h{uQ z@bm(Prsl~%i@vdGjL**F5&`62>7V`SKxr_*cL)gIAq(Zx6yTFssn6zV0>yW{$+96R zeGm=&vnv(Qp}=XfdY+@>{*4NSXM?2?ZO?|#G5)|Yg4ml;z|Z}Frzq}6l;@w~h%|=H z&zvWy0PLbCbr)Nk8xJM%Rn_%1$pWW+UW(~R4=?_J;MU>{=#9SlqT3bsKZ|g8BL&34}1Ip zA5S|h{2*lHI3-9V*vR0~B%ahMgG7dj3?6mBDD}u;^NvL-{?l8&WZ6W0CfMA&vxTX? zT#R;QV6-V1^X>j9EsaNGsSECH%}a^yY@ofdiY~4Nbu~2@o%{T&2<&XFV_vmfK5xr2 zBb0YF8oKueC4A;>a{<*=RcP)Q-u=quVcX8yA_fMeb4?EQqL=)`!y|Z@r?#~`N01pq zZF3v_Ko1Wa(;~7w$Z~ll;xALbBfa7OMZjhW{ONCbt+yo+uBo71z~a&})$ZwB>{sn? zZEuV9-}rxNS;KMsf5nTAa{hd-nX( zXab9-6$1_&dkAb;hXdsxbatf%n_YQH0|r>iaCrp*b+D-W)#D#2Z2tMV-{UQ_WccG|D(%shuZuN#1%a()*l#-_1LVri`4SgaU1{!l=ADN~KpqJeG0!%%EVQr#^ z_~JGxkkaix0}mvSd_&C@NG)p-gARDxobQFbp+4M$!VwXbjCs}VD^JV$4YgK@>snu! zL}NoMmWEn!`|@oRS2v-xrEM2BJKNHzy?bI{gYcrKz66<79axzeMRRi}YFauz6KwcW zIj_HD@haNw1RMF=_75W^Y#0LT3ls3MzYSAM8)TI?pt>+0jlJXaZb*Yrw$`Q37jN@9 zmqrkol#Ho`HOgxRo9jzR4e@}Hg%wP+}^lmUn_=}Z1++}fQk}6en-r){p z=9FS(c?y2cu1L!*p?}&!Of9d8-<*%*&v|U^(2Ggu=LJfqC&n>4vq1h8Y;3905Y$%J zH_3kwYb(Dgyo_Rq{O}~q*@remBJ>p?t!_8>_?E`mw=Xw<0Iyg9eP17X&@2`5`$JZh>!iN7*`997zdlk>WcL{^j^C%=xx!OCRplJ+a12wQRH^R;97jQc;Rmzw)7kh0K_b;I>Cmh}x z4VWEl6ho)=&23OWGKZCk4%pIhCT3Qs>KsOl%{e^x?j>|jadY22BzjoDH;eA5Ao1eb==bc9DF z)A=_r*j9$*}QocSl`qjp~=syzwVFJ_~IA%X@D4_iK@Au=!#~ zqup;J=Y!|Yd=^Qt(F7CqF!gYa$0>kv|K>AxDPC<-r@AzO=8=CqjbZb;aU%Y=m)-Hh ztKk}9!~d+KqoZPCCx5R(-d4p50uIs&0zFo^(`|`+y%rcP-M@kWuL5mrt&OUY9o!u& zgPy(x7B}bMX5b3OSFE!iB7*#&d&?5T^Q-8tN{3HoE&7Th@%{-d_<304wwXCxt=!Q# zv5t>|IZ-ST;ih7o@F zWWzPSM0NBXINmZs!N6X#T&A}fPF}Z!hqVqY+yoW~k>!5%5Ha9s;_cno@-HZ?0?qYss23u@#-rW!d)WZB6)~QCXY2)t?eO}nC zP50vVmG|J_8I1PMZg{#Fp`@x9mp}awUfy2NHFZT^Mm$U`9T6R1hqtckV{VNuaB~Lc zSGADdI*EH*>)@wWof3p=Iz}+MehKyg;jq>|4$p`}ggWcvf@Lsj3L@Yd5`l`uU|hOJ zm5z!eI0XixHah{g^sJGZm4U9FA>^k;LhI5QI7Mb5#?1gX9m7$V7mu5_3}A8VIxL*r zVR};=-VsUYr02??YtRISFGDhH+zB@P*?{|PTsAx`Y<_*g0so(OUGcA1Bk|@VfXyHB z3Fyxzws`gfLqLPAl+OU6JyHC9AR|i*e-?VMWuqR({W*^uHorHF$JbtT#SborYJ?4^ z=NFCt(fOZN-c}YyG1F*_%~k_!v>0N&g;x?V#Bkx2eQTp}fo@@T73IU**cmB-t5-1n ztFFRc&jG7c$k<&oMD5rd8VaJIXXJqL{51FxY#Nh&aKXTnYKXlU8R>$hwjtVx2}6}J zxa}FK${TRB)kb;$BvR=GODigarIrEO$!NJdUJoB@HyGVELDdA6e9N71vkgZ@VXF8( zzq}>;SivqNU)s61g8-9TF!G2;S8p%ICkNs0Y>FW=GWv_-;FwU0b-D)^s+BJEHo?g? z4U5wa@Cy$>B!7B3Q)N;`EeYZQysHkh9g7L6z5uPEz zm}Uctw$73WoW86L7b_EZMC7V9Lu%MI7f@c`wl7^td>{-=&EY`>WWz9jEK9?7cLf#o zt@KvhLqk~^=C-$x>}e0bxFWJNYB4gWc@=MNPU0o(KM!nHC%Ry)e*tNQb(k6-hL@We z3d{20?Bs&g^#!;Z8RPbKW285b8NM?N16v!6EztkN_B^bv-#}cg+%LEdyDP_W(a0S! z;r;}URJht%V2Iwk#;i#AWsePhJdN@e zCtNIV!N4a46*=)ptm!7}`zB6k+aoS25DD2uC?X5r)XW)81Jj~;c7sROZEcF?wlA|; z?MsEtJFfWFl?Z~(ErQLrzi`+vXe8j+;t4MTj^Z=WpGTUT(li0%a2*CASqu`n3GLya zBf&=b+2_L~z@r*G@W+A8@0{`73&9#;!_8-$IrrTtx3#57bd^}6zuZO?j2#8$XwET2 zY1|Dg%#5f~@pcD+{tjrK+`*lxMnps>QrJDDhPc4o*a9ZH&eA`;n=69i(=pW723;cy zwDt8P$iWycUY@A#m_$!~1`Lf%VQi)k=eR;CYuX}098opAj;--pSUCElzC0IZrY5kk zvqSU93`SauVQOp$ODZ_3y2r3Q+<+T8#%Ld35y$VWjf>AB+c>)-Fg^$Uoo#S7*M*y> zA3FMnkP+*T5h_GhhH9Z>WQ)>@JS5RS&hkh%BBM*OJl~0^lr+qb_Q6W;8XUbtP+eL= zR+JqaY^>m(P>zNE8t9n0pu9W_>BVJe?dUrQo5?EN9d!~5o8B9D#m0a$?hHGiuhNmy zNYB1B)t#)XGT|>v3xuD4EHYBEF*d)2(Ut}@we*T68W*n!6la9ssTW>DO5-r*hnnHx z<%Q(@W~^;2BPrAw_SRUXx$S(guQ`u$2<#xT)a3SU=$ zM0ncJb-j+Hibk}yH(;Qv0StljpKR9M;Dp|p7b-L-}A@%2DJVjgagKvG&4&*2o7${!pTM#dBwT(JK14+W|S-lL-_mqK;Oa<@$_E3cHtIg zSMP{{0S$%GxO`Cu8F~3AC@n{PfH#b-oKaF%iT<7zdS`B-W0oo!=|Q+);)6=EY#f6l z(N~@aYllP(bY#QM*AGSU;kc=5hMbZz#JD>`%g_~mjz+lU7LS_r5Ztg0KtVzXLE8=` z<(24YX+~8=0nBtR!^X)Q8Of|C=Eb7{4 z;gJ84!{!x(IDG9nNBqZyAdRrO-*)HDJ<);B+NJ_=Yx|CHA9h<_lnQ)q!r^O@8&I}3 zR#hGDJD8uF$F?fVwdF;ubMNgT+r2wd4x6isSX$fb@7P|adtO#m;c466T*Ic?bKe&Z>>?Nj|5hc{cN-<=E`C#JwI; zpEd6GTH$WDG5X7Fb_Yr1#XA#d3&?j5Hd-f<-!+CrCwo+MFQPd)4gtPlFrXTEQPVIM zCR(Xx?v1gDe%v^53hq?sU%Yq;{=UKR3CY0NKs8S480^BPCD$KsetHtxT1IFcSU_V+ z7@Pt!F*Vr-2TK!&;i1L}ODOrsr3%x-^g0mU;{g522;Gh0@KU zzPbUkOAE+L3`1ya63QFfu&^YJEZe64i%&fY#uj}D=^r4KV?B{#Np5G+@bmlT4a$P^5ZjUp{R0&!GfXzCfp z;?w~BlP6$!dL9*7Q3wnQM;BFi3R9vHomPP1{vK48RiL`629*T7hSq+pl69jA6kmkC zEZF>tVDq2fcEvwm`to4ID+WACz>z`2V*ef>4u_2<{0A z%Kan{krtK>St`3y0Oo#rx2g$S~P1HpNARx6KBV8ph(zQTcQwKYpmNftv`AvXuDL!T_KDHVgOGJIecm5j!8DrnQokl<#A;3BEn zDAvghX19#sm)1#Z!3INvj^*W@_!HV(F_H3Kk^E#S^8YV4BMQ;AepQ>%7&iauZ5RCW#c;fF?u&(u z0F96x?Msl6L8IQ3c0af%by&K`DL*A_l;F7ELY$i1{h~1S=CcFMY4SdSgCx(ZISe+M zn%EvWY+lrl!PlO#$G6W19>L}jZJJ;+(Nlo#{2S;m(noKBE;_Qc$-20J$`m6ifJ71$ zC40g%nXQMr2=%lDF$S%LkuWr}g#I~g1jnT#F*Y0)Ru*V(YJA({U99Q;F& zR?vXajv5&2>A>C17RPQ|U|E%SU2ZU(V{^#20y6_cWaJjW-pm-D9(D*yD8y)AD{Kt) z;py!Juh2BCEY8AI`v#I~yT$SM?yMn-3I`)oCjarjy2z?KTQ(vmVbnOYzy)E^%myNc?j zp3esx4F&3v4%e62jK;9}=Eblt95(Wh=WnWD!;lf6@wOJ0%pWoe?LkmFY*MFE4}uKu z?}e#@g~YH?HmQkW&jb+_IAqvJIyfLelO8#2UeJps*x2IR=K?+#Y_?aYu)Q*lyPJET zAvoGJZ<=7Uv%QJ6l?AM=E>dlFfoj-uSeT!|>hj*mv+Yf)EmQ59H(rKCo;x(s+l#5W z72KuT?{IG?hNh%rR_7-$Hp@+wJLu}@z{r&J+bm5Dp|fuo>sx!H(RQ{ruto(1Z|lno z*rJGy#R;@`bnVU|+FYKd!lMJ5s)JVMCNQeXQ{D!;I?&!dB;~ukgwFPMOfRj|d$om4 z)f}YN`APBJdYs{Koi;d+eboCCQe|Usm@Xs;NMg^QBJ-oQQ z_|jnWjw_!0f?>mu5q&jcUxJN15{-ee3!8@k&f`kI0yd8+{CnXFXej*mlM*&c07=I) zSTuk}2^-;>)4fPdXiC`p6Mqg`1r)iT<{!ybAC>mUfz5Ai@$YB-KND>3?rdVRI~60H zi5RK(#cYcgii=}VUt~|fQLWfa+tSn^N{S0nP*{QaHM!B{^KRSdp+aw&OT_zZD>Fm% zkcv@WUWS75TCDzw7;TzhbF|%mo1K}Vg6j{14g2|@fZzEeJ)HQtv30{k&bd&ktgKZ1 z5}G$IY`73wr;5Ymx@Rn;LgD;KRTO$dsJ!w*ha;%hJ4<8My};&;cc z;A>AlhX3^P^Y}kLdI$gg@@f2E`q%K+mU{SGM-%){SBrv`PKAwSABflO&|Y1SG`?Vi2Pz-NEJse$NiOuf%ux|9}zY-__s5D8ezlj z&wQ-KX=%7scx%S44QFE5|`B}mWAhIe=(Yyy+u5|NI8@Mu`MyTLv%01jaxaEgk6Q(QEh z6XW2L91oY2#D|jeuA86=V>dzU?h5b?|GWzAAJ4@qtOIxp0>fip4JQ-t{w6Vx4*#Wrj`k;@(KbYHdL)~1jaS5AP^Pe zg1GW7tZr;!bG8HaCb}@vH$Zr11ya0q@Z5Xn(LXVRoP-d#+S?+tsuPtNUNAE8K|yvR zEUfflWoZWY_#(^Uqd(TAL+sBpV>x9O)Cca`^8dK{LLyZ zKjh{}P2&C?PQ&F3mlaBJI8UKqKU=2vcDAU}N1}@2Zh6CP!u-F$O|4Yv6WXLSM|ud! z&x&15ewApO9vs4t$jbYle~h8eFX$3%o+8*BV%e}c%^C66I>*PyRiVK_JfG92cm7_l-=)aAz@$Ozp8SJqSw^Pc+t-z(1=V10|7o^W$sq^|Xa9 z!6Jan;mqcFOf|$o*U4Ap<89@Ds4#Ch`9zZmvj{gIN7UqJ;?_-LjLj|~$WjZJ3>@KT zbQ!iGS>hPpR)?ygWoae+#SvEUPp`#PQyzSL3vg$tA3iSO2y(TCqi-?+ahpKohk{nqDD+q)HIU}!I>abq!D};-82=1;;!c^B0rG=Sd z>6q5cU|iI5L-)WS#>mQv^D#rk;2liV#lplR7X^wRQHdZ|;ar?e)z&qQ8N|lufa`t*y~#+EpCb7M`ES^JMsh~oIVd4S2{BA;_xSWxThYrFX!X%9BvzI_3I<9O>& z4>tUxagB2Sr=7VOZ5rL>PUx?6LNB=;MRsV;wLn>-9v0`uRH=Blt{-k0S;E=P8};?& zNXy8hvTGKh0dW`~?S+Z41zHD35bbUO2Uk~Awho{=HwvxeJD6@s#_6*k!_3qeA(;)B z?xW-LYpAxrgru}Mv^Q77&e<8^X?f`D?1Y2aZ8*94p?iF9S)KLCcDRRx3V&;HEQ%V3 zu(LV^H!Cw(8dxGAFbM@Yaj>(tK~2{HnzEx|tjGV;SP;*s|IVdcLbzAt3Q*8~7N`pVM+hfcx==I-AKF>n32$qokk^HMR9RN;S4l40|$6Yt^c=2!moU~|8XixDo~glLB+ zx~q!6ecKMN<3vBKY9jpp?cUz!0C>`yGD%NmJbYr3>1C4I8#Qg4s^PlQc8B12cv|&M zUPOQ=%qa&A@H5bKsbAEl5jGQ5*co;ps@MPooV%lLz^J2Gu7NHq~rBO|fFZvFW z0_OS&cPmr4*r;4 zoI$vg9()3GkW-j~!O=0Khx)+Y-V4L?3n)_l?=d>mk8p2Wyzurr2u&@;$lMzJ zGfiN0W(8|obbcx?ksi&$S-#MtOK0c1^7X6NSS z#oB-R9>LgPOLJ=*O$Bkdaa|YjNwJ7a&BxN_JM!08)O;HPL5(|WSp$0CHid#F+taWttCVS`698bjsB;2 z5!w-qPR>v{u!Y6>X(~WR2zq~BbF+3~bNpTWmDyJeHedF(wYEh6zz=BR`3i2DU^72b zhRq%e-0kMRFDvYHTVSWtNGw;w+h}73J~(j>uC88aA0C0T(G}DWO(Ve466LiGaPg1A z+)N)%zxx3^e7tex$~Ae>|)H;tmVG!Acla1p+q4mf|)7|XlH%QkGRwNW>54_iZp&^NTf^2Q8Y4c)Lw#degF zKO%#9^=>PSF07%WJO$3Ndkda^-c1Rch2>4mEmI-&5Sm$}S~L3z083OaX|K#77<<9d z$sIlPY8558BPgQ+2_be!DDM%4-4gu^ERHnchPfs9?VBEKhnJfxw2bUf)!Kn@4;NV2 zc_TeL5x&9UNQ?`IgR>t2+6k5vUO%)%we?NRF0KE`Yo4sJ#kFnx;0Hg%rzcKfnO9ZV zxQnKi&kvi?<~$f%o1=ex5%Xi+h=_|oYeNb2wXQ+u=1qF;)#z=^gOPzQu3tKZ^L9b> z|8Ni6OG7ZE_qVWH>N~wl71HjS0@&MG!ra0Q6%AEzFt`FY_i&v3=oNgR?}MVecofxC z!Tsh5e0ecGV=T=)ZLyrWShO0q2E5UI++{LV&NEn5-G=Z-T=1amQX_O)r7HuI(+!-FL1^(g061} zx6YnNTyY0xSGF*>xK5z^)7LydOLCuk?s>R-`4Mcku|$?l;}-y%sg7ctKK>RQ+``e` zQUeE9Ta@M}z|hJQqn$M{GqQxOi4977$V#k;#SMEOG2LNvv5F;5m{N{A;C>&H-$etQZ%K+B0Q}H^#y?lh>n26Z9QZ( zjstf#F)`4I_y|8-p}c(4Dv%r*fa1;pxN4okB}03dX`O|gn-7ey-#~In8{LD{@3Xol zji}>~-5u<2`szpto4@+X!sgyxY%PyqV{s7MYhP~X`k%vASKo91Hj@Ko=q@rrA6YWp z#a3v`Geuq6EmUXPi}>lTGF-lX6VA@g$gi$NT5Kq0Ht!)L$R7>eqX@J!K}=a2DiQ)< zXy=UR%qsLX~vm=O$3=yAZD@Y4LZBqlnecb3D%>$hs zorrWZhl9I2aw|F%u-T!P(Gl%4^jnYDAu2Y7!tNqD*coPqW-v8yLvdL?99$d`l9Y|% zz7}ZTHbU#zUjNzW*<{#s6KrM(9Mg*gl84YFk%QgY6*_LX4QD?75cd8Na5mS$8AD&B z#QVWNrBuuZiz@EI+WHP=seBu1Eybx@x|pK}5Nc}tijju(w1pSs<={F_`JAh0#p|=<66Evv~r|*#S6f?han(c84rx zTivVhNvyy&uR}M{1?`ik;FDB@?yes6G~~eA(n`#;i*U66D169R2sBBSwOzn%`wpQmcHn)V?;a+qPefE!ktxfkMB{dBN zHQ~;$-$iX<3Y>z{ z#cy?IYl;5RJP;BSgUre{ovCp3M$_N|<_L(B^Xp#;@$*?+zqh+Tw{i#d z&7Ti8JYZtHtBRg)6cz|POA|eah>1XBZ873f^Dr~m3V;82G&dGO|CSc?O$Y>$8KQr7 zWo?5h1}(7Exd|(4b3{;~-&I!tLmh2cxCWuEwH7gv5m?yXL1RuNbZxwmof(6?x@NQ& zW+Sz*9UZl4WS!Jvq_GgUu3mz3U<`^fl3`+I21BYGrPXw!Au|kmj)CZ?FN2xhHJCg3 ziPg;A?5yDI7l`!OID`d;A~G}rf%GmEHVj}>_37}hqGZ_o3&G~=f1Ey>`@@EZ9`Z5j z8?PX+(&vPG)2>(@a3nL>6hn13=ql2~ioAlr-A$NZ{}d+SQrrC!y@*`PSski}OF%Rh z#S;AY#QIBek+el->+%XW_}szV?3@T&q#M}nsNSKP>df9en5Fq?)D_0VF*ciE(}&)X z8M+55jHaYK?=B6%%_jr{++a`J44rGYOr>pUqyZ+k^bnbvh4hR(EYJns*;vB#oLnQn zhgEuB4Mi#N{{OT07eKOQSz;yHHfEan_BE1PFwknr^d%K^wOZYhM$*{Kn2r9QR!i!t zhODYCPG)+H5igjTnVFfHnVCG8Il_Z^{d2Cnzwn6gc#xU(-pkC`7TYdET)%g(v(MRQ zpVTtem*?s48)CkNhdSBxyZHReM z%AZpVu6Fz8p>n(&(`IgYlO^FDt!^DKx3r=3M_Cc;mo^TRG)(f?nZ*s}*AJ8`yE%Cd zt?~Z4>GD?q8zr1sy}`DyIhrtNwV0O;`Mtm7(gp zJ2DaIlG0Ewhtu9zUuAh^RoDkjXHi)o+7fn69a>itFj3*uJj%%ELzP zFEa?pslF%~1V;Te(NojznhXL9e#|zTv!a(lAT7e5jJhTwTurdHv=XJoR9b|~{NH~1 zCbdJ;)aNJT<>f(mY9*a@$r#D8&@p($qqp-8KqqwDyXuFU3o6ntSX)K|*u8|($-JGvRyOJl1 zu2ZLK@rcpIeI}NLEF*x0>-)o8NXMrIC> zSzo88r?qQk$$geJC4+ziM?;Pr>SqvGJgqiM4DlkVqy%qAE0%Wm@wIYR##Ql8Dq(%R zfuH^OZNfr=d1!7!e54OCc`br){g^tsaj?ID*)40f_qXs33?VMmi`PGVM5vz=Hm=UN zS^F~~Jduf}R6J8ksm=B$Te!#bs&*oRy!gcj_k^c2iGNfY>r2DD{WrfNC^UrI*FUFi zMpG5#X>38+*lEODhNlVd-*q6s)g1Sb2m;(~7!Xd*LT3rV#l7rKRpS+#%+}-}A>kEl zt#lF+7eQ)(FQIvwVWIanmW9inChqSZkAiYhwU!cFH^HhhEOa)#gJV~)c}~%#tC3;P z1Jhgd3muqwnr_oKwZY)*wz4dbxzeYrYJQ)p=Dw>80^cxw<=brJ{&jVA42zqTFP=^| zR;QS6F=ea6n9X(*HrgJE`A3Wte|{!6T9mf~;n}%F3QuGEYpSZMvGa{*vbToM zJ~g3lbe!qgMQYLon9BM%S?ItuFj%OQxq&Dug6 zK`~)u1PYHUsahFMxiKvqGy5pY(gQK_Nu#?W9nZ{m=6iAoOwOctX#7&x$hMo4eKosl zV{EUEa&$FhgCb`Wajrj;?raGIxW2-+n96FBO|>wDSNc@l+u5YIyX#9uqv@){uJqMW z*^lv+hK)?br&6i3OQ*84xrC}AfYGKvhQ)NC+J~-kH|n!(QLk!yxF2mQA*Sw8DU_BJ zuzP$=UR*MhbBlzy*;CpxNke8BwyqvzSNAa7UP5ixBq!=|vWkj@XR}6ba*;5|J7ne* zv9!KSf}bre9`3XZEi*q{i;bl8nV?+`)y2)KU&~gTWkakQ(GJfaFeCY6%Oo0x+&-xVih%KQ={mVJdS1HoFV`*g1Jn z-B?XoLlawb!cD!bY}LJd4U+_wsnnRF21VrLT(0-$S;ay+qi&_Egxs5P9B| zCSN24%F_-xIcvqwr{{TAId>X^(qbU=Sv^z3!K5oJ`LNXI!f3rMQ!Ta(*Ly148&bXa z)h!2Pn8UVuMM;^$@dknZ0o158(SIxRv#f1vem^;M@ygP=@^7y$&ao@VvA40Rbcoc* z3A5q_QDQWN9LR`1RU1~m{>+GXqrYDzaB$3m*hlufmvBf74mYm z33jl=KPH9pf_(btWQ5v*cnMDf6Ly6WnjdP#%|Dz;@g9y0^s%g-!|uj)LUS4!9vWa} zN8Zqpa&KFEhaB#1D(9G8SXM$)zX)t(Nn5`ASNd!!pK-4MyAC#sD{2;=K^Ipym|0k5 zWqpg~wJUvL#kf99L;fcFy{?3cg6(}Qj5zuSeqdxG#E2` z54r~Xx&Q93xE+wg%wW5CL51gN=SIVjCKLEjSpw#6iORep!pq4?h``s|gNU?Bn#-dw ze&|GUgbzRZ>Feaxw+hcNg`vJ?UVrTk((Ag&%ZwHt(FU2pp4bX+wW4K+!RB%T1KoJw z6rkkJ+83Vod8k~bI@rjmth3ftCtT^1RoaSfZ8h5X(mwq&dkoI)GC2Dbo!etzW``l| z^h#eH?VH|VX7zw^t!MN5Hm_hb+Le6uVhA=XQ#I@k*>N;zuLN8i4A^tfZ^>w#i?V&B zJ_nbW3^F1dDDPjSK0c7l!bTF4lbK#$#`wKAaSRH>>fvqTl41mS{FURp9PXnM-a?X- zIgP3f$}(e!OibW|-@HRuSSTjukMMEwA-!r`?7f7gcOcy@rTE7svbHcwMq&g;*WM$s zrl0cM6nYoe@O$_PM$SRFn%^WMuT{BDV_Xo9(WmKY7Fx6U@lQS=EHnsH8z?e=YUw+nWzF5`W>+sSEszEJmzD}Jwb#idg7T_&H8*hpIA84(^5uQS^_CvUIZtX5#(S@RB1a|Q2`Wp zj}m5SL`Zg>@;|IAeWGA-poTklEEt|$V{dDf?y^*_-Lz(4OuUG5%akR$l2SPYyHgn3 zc(by(g13h?^WuHnHjj4a8KdSyoI zXH%IqT9X}n8}-({lKOvPS)6nKSUfLHhG|2Yr=MNL`F9SL9Cq?rn(G`WnFr*xWcBj) z&VjPt@bPC=-j6t)xVJ4OA*p&xlO6oxe!J|7|6xP?56i1+B^{9*iehbDyf3R8Vp&{I zY`b`@Oav?J zS+h1bLVM3?gqk54?rLRXN!t_s339ZxL_t=Hl4`%Wwo6&JxiC&gw=iVCB{@0RU}RXO z>3zSarhjAo&nTaGPX0fn!tf>zlKMR|ssWwy%evCDTifJ%?)qb=UJJVhn zu57Q%4C0=HKV_xaj4$spP*p&E_Y}=}G5DrdFw<9$gS9Qb(b>#S4p353rW{vRn8M=z zAuYm)PcH4!Syx8;w3?pM1gxChNXTzwTP*`NtZ?>l$2+-@xrsi?o0^&Iti##W4Oe$x z8b+5HZ_L3dG>wJvemw0>aq){_diAtHzpo|-D>FOXeM6a4uTzs2guR;w1q}nJ+Dd5b zoff5&J!1U?cuH%jD9=MJN`s~8MXZXFS9wt?EBpIYrTAm*=tx~_KY0mZc=-5XY41n7 z_>B+tzgRVzGIq`C431`>VP$8Fse=#WbL&beT*`rf*umBc5pIses**rGC)(AMEGeO1Z4f6a&)@l!63b>T0*v(=pw&*w`X&*#uN)`G1KQY?EuP}N64#T%7<3PevA!$*N1>YaC(89D>|TUQ zh$^rd(!$326|6>+W249q_Podp0$ZbAN`v;!q!(iiw#>9Up{g=tb7eximqxPu9`IMM zKR~U^vU0e^*x0x@?7YKB1p0NJp-DoU;L1v=bb6(#S}kwuqgCzzgFq_sE+kEk5Yu+RHy#zw~; zr<&Q_QZq9(r$o(3kuI{lo1@h}+?^ayp2B=5CN81M`kAQ-mbKASbCcsNX&c}7wl`Q1 z|BGUl4%PVC7~vn6MOjvoFuuMNHTQ{Qr_R9UN}ep6n*#EEygzy6GzrVeWI5=ly}Vs>tn=-?ny1(en5Winzz ziOa4aJI)m|b6dhA;~8CCSAb*4aDN^33~UyK;S`2yRg~zXpqLPX_l9!2nz}$ zrKnvPOf@NSk;G(F5ba~ek6!U3|&PgI5 zB8$%cAjFZ; z$rJDzZ_DGq{ngKjtWvQ&J0{+@Ffz-#S=&8eMF8hTs2oZ{sYcVm#^x36XCpHR$Yb;) zv}6W>%~3y127xIzVQqb2!I#;lvl#@AH^#&V8An=t1f^Z`;=nlq9Bgp$_M|93gJ1sa z7X;@wQBsgdZf+Xk8CC4B3=tBUKwV{#cpzRlIQWW}UK9B=)>epHa*;C6;WXB!9+Xw( zQP$EnkakXLlc=>T)cwKbBL~=&6k1A?(!(t zK70)mGc!DcQdn9X$KvKSoV>jF@cqxpE6l~@wjIr#W!!xK9V%M~a5ue&wW}95KKT?6 z;icWYZbIA8BpG3LJhJsB*wF&-_;TU#>>D)PUq{u4jm+2}tHWT5aJ7mXcym> zS70h$;@Mid`f%;jYq-06bK`~uP5l$(r-bmCg%4BfdkE);y23a@Vxq9KbEBxT8kgu~ zO4H)_{GK&7kM0YbV2-(4By}b6{P|BmrKG43XWv+4JxWJzJhyFPlqk=&tz$Np#&~$` zI*wjGe0fT`-ZW)tWJwS-B75Q~7I2)S~lP|oS zt`UZMy96jb`Q^tCX=rKS#(hhwdj_z*cNaTPU*381eM$#b+1}Y#vTpyjRTc#FVe?9c zKFg1FZf;Hi&V>vD{jMCVPBRD`4PDG2(3um&4GV9wV>~dG9UO}jaR@EZZr#E^ID%zi zZxcf8l>v{U!XijZO(HEVo!jrdgLilsruS}8J*e@n#@oe<5|^XQ!#ci>fn;UJky=(k zexx%sBWjuxTzTU&3qt)IarJb;?4c85TK8p0fG56gfR6MC{4+Y0b%`GSB*cZ`ACV%K z_6YJ1CL=Y5*xY7i`?2tBJl$MTvZbvK3U4Zr;-m=dUBa20o#xhCuj3+0G1iank(eBf zx38wXM2e~?2{X@3?Gp5+xse(a!R*q~6>OeEz6#iE&ku3e_y##yDOlSFG2B_f&wuh3 zsRc!(q-QeJ-69NJ6l3F!xOoH!k9nLofAULF0LmjZC5g`7e$qqT@Cr^NJ=T@1ngIrj z;suP7*gFwM*?{5xI_i1Y$o2}E`|VkDVO0+4u*Zrh8;*BZaZMERvJzr&49cguFrL?b zeV43~VhT#~vASbJi71yIiUOQ2ra-VRsdeS7wh7?uE`B2AhUvj#u7ew=VKh=QgJo9$93BkVEo|Ka znbrlm6&i>;-aIuZLAr#1Gb6q^dlrZiuXQ!NNr~?PX39E47KyK z*WM&HuY|aSRQhIj+1fi6kUL~ucv%wGi!u}UZ$afS8!s6)&*s@wS63@xkg|iPPGkmw z*(TYT{SbAl5o;|*V)~Gwf=`5Jqv?xra=eX)$u*oqQpn0o;@a)|;zy6b&OKVZm@8~; z&f{R?K=;BXG5+TCt?W}3Wy{asGGc0a6wB+kDd`+!d}5kCS@|hstR)ANfH>juZc?5i zUY^)0dh3&k&M&4Y#+CY!4Vn^tF>#4xbaIN7#R(i97*pCaAxdbQv==1d5?@MNZZtN& zX{@a;5h`AyysTJ)qf(V?lnF!f^Ve@Oyrw18{t8aECgKHKMOB@QnRg_c>Lm(dys@&f z#r%OeInDjbXn<4Q1$g>~C@-#*y#*C!CZ=?ZF0wYO!p+W-l)^>Tz{)Wo>Vpa0hcd!jdQ|ucx=Y zp7^*3EUaw^3vedAqLYrSaIC(;uo+s=7{T)iPA^lLxKw84md&rj?d5!K>43~T;$(Us zkMJ}cEG!jcTirHBQEE8%EZv2tV8#3PA=DJ5^U&N4i_dOir)^q|tYNRr3B@&94ta5c(~V#7UvGQTT#|>eg(K;?CG<^iQ=Z_( zPv5nqy|;?L{Hr(VnB8Y>^MLg&QDAkj6ke)7$%(0yHMHX@?$JNBkdnqh%Ckc7j4I-I ze+!Fy_Xsa&!q3Z^hS3E=Y}~2pUn1P!hWy5UJWL^BeqCu9o@ZgGNkG#ce{r94Q{n}!sD2C^DKi5NxY~*Paq*y`f12(=m3XFS0|cbV zPFMTFm>zCSi2LbcezKkY4Q&SPZ@GL~*vKpb>eVIs2Kq!nXN%RjaoT%SEYFXMf>0)v z%{{2sR>a3RCcce%hE*zIh_=~So}wTtlj7Po@!O6HuPB?Ykr@_e#+aB{U|~uaZDT2cnm z8=IV_cXW>BjeRDkCaG;7MZJ4MeN`z*=|%L<$YH%_Y3-k6VP&0`?h)pMOC&RVFQ^Y$ zT~||(n@e&=DT50K%ubIh_gLB@4C(Y7eF7}<+&u6Y^lVIpXY&NueA{GWrVmGZbE^7gv}?Y4F*JDE)>04C9bU}zhB8`h z!Bk6-_^~}0Z}AaZwYc72A}2GSO?{H-MBARWI?*p);Ae=;J2{|4cypm)p#+7;GPNRG zr?zRVu0{Qf&Xz9Y&-2JoR|B(($9POvM?13{&-T8}eOcIu<#l0HWS;}|x+ZjaR~gP? zTNy?}rni^dw|C?>BGccCW$~TJ)b)pA`@x<}+p?+5?{04?$0@1o#d&tbvfS5@;r=?R zK5Y8uH6x=+Z{=B3mZIg54a&f5>V4L?k694wR<>ky(E-a_CrUeuj0}@NlJD~B{1hq0 zHOy}uD-HWH&PKVW`hYF5uNr0aw@AI<^7!Z7QYIW zzs=ynDQsTO5ChV)`7Z)CpM+h(M##bTnv%Qiw<(4?b*g7;IhL6NmVHqVdn&1FR=VvN zY48%pP-E4{n$!8=pZ$p9PFuZN&T&XBsO)@enO6TjEHZECOKM)+6 zAM2$}Km2@WmWP%mH1rNoSDeDlTb81#vj^Po2S2{m$3y+8XcJoQ@x{kuVTF(Q8gfI$Pe*! zb)`v`I!F72m!YY8U7GBtwNnGjos9(sh4-y@5WX)C(ByOpZ* zv88>wrgrI>em3oz+!50~y2UZiregn@L!~`I&Kut6O24djPVO?ZddT?56>Pp$VlZ9J zYy$^lE`lgdFeS$a@)lE>Bh6KmrsW=oBt=JwAH9^wcv(MvNV>lpwjRFZmzLvX^clCj zGH9$wCNnQpyg(tMB)3UafDZ-5rFeO|<6vq^LV1TgnJC6h^>!mJHIIbM zWCq)cxbg8dYMc8>i15eD#|vAxZ~?YD?98kPOGu(LeT-i~4CaoWqSUrYn1?gn3z`t|lptFghGnRQ9A-M4-26POA6b!BRL5X@JsxhZ zxL8_|R9sEC;|=V*(pi)x;-$qe1sff3uJq|D^Px%D=*F{IT2()jF0XAcwQK#9+Fb z$r^SBZ8;p!Pgi5bSe=XVH1}p&dGF2lNJ&lL?GNwL)6s;nv4?W3l(NitN=Nn>t&1VG zvXSb{1R`T&NJ`Db-|7LkZ2SrJwkIaHUUR_q3=V$&N}m%cSs{L;q~{Tp6is_=4q<7P z9L==wSEYmz z5fepVc=F>mtTPIx4cf&#gDXeY4&)$am_5mUt?(><62jKxOM5kvE;v-C92rwS@2$;EC0If}e_6%2pQ)*Qb#k~lN8iB3VHAE_ zVhA>Ksv_p$2+@&_RceU=^UA$tvVAc zhahHWhwu*eqqRyH`oto(W(Rn1(}dQ+VJ4=RDUR~P&L&U1++Gn6ZIJ1{GCbVf=^s=njdxO(rd14# zYT8EjwpW=Pn`L)@n}PmbmNzt2LSIx2!Dek?knzq`rh2j&@5)5gnnHJ7H2tlzPtgfg zMY&9>H8|Z_=%=uzgSo*boZUSrZXQNG-A_nN3Z31p^oo1sL``O97OUcr8{016tq+1uGx&hP6N%INGOy{$DYYmfcX(P(1X&7ggE{U7O7pg^f%% zGgzI>Pk#O;Et5(QH4enPekAP6!Qr9!t+#{?*cHo1!p0mb0U9zloie|Fpu7tk!ZsWp zA9K9DOnFr;bL$!}$C^ShNS!Yw>+@4!BX3eR{>uH2wP{?WY|9J+BYuJa&LGEO zk!=j~KFl_moyi~|#na7%cFC*tE*^gNA@Qj>1bIZU%P|>&G2~}vU~OtgPDu^1zGnRT znuRdNBSZvv1Zv*=-MaP+gRZhSH$>Wr}!b< zaj>+fpstBPo9p;T)ca66%KN%MIjb?->&r>Vt>B2hL``NIye8Sd49irt_tgXt!(J zHMPPoGM(P0V!}hpgrQp?%rBGN++gC$d&FKx_}ci9krhpLRV(Eg{*<(I6X$77Y<45_ z!_~O^Mu_9q@V9rv+UO2<#Qp)UmPDl_6X5Bp^e`@o^u*0Sk(p&}L&6u7Zv|{lWR_b| z3iyiTtANegx?1_*Wa(IDYnCbHH#ao%@?(_mx{}sLd@FMP{Kxuj(XRqF8v-^fssav4*?^7EZDl#zfil-panH#n~jP})FW#LGqZvY;lIZTc=U~A<~YK%J% zExlQs9>mzpn!4e6cDFQDbUHP3|5s{QUuv7pzx#`y@>9zUe&>f?{F~1V!$!V9@`Fo=KHKRJz%-XB*MYqPlb(2~lMJe(qP=qyRX*xC=3_(v9(=LIax$Y~pZ1-Y(AqCQv#eSd|j-W-8y7`Zj5lphd6{}DcAd=@~wc) zS1eyer_RmQMOxb1m|a#2&wP!pjwUAOHO5hXAKTkIObz$Y)jy<+%Ocax%k}DSS=G%~ z0UPPrtdF)}<`O_zQ9MDZ1dDPW-y7c$wPp;HDAr)v^Qm z4*pgigok+&nOZK&rgK=@doV2f<*co+y0R)%4t2b0@cysVu)b8-{PMjI`I&V#f9tOU z`1jYMxMl!0`}_N6a-!*EZ+nfgjwB{JlNf7HMAaNiZ(Rf}rGZK+ms2^Wv?P=9wIhz# zN2#i5P}X+UWZ~}UNkV)fUG24a`S?=O+{c!B9)Di}nT2)AlLG{tyl5U;W@~u>PiH5* zLc%C$?pMwsrKPTr@fA(`&+)+yS9qBQk*Cge;~ehG=MP<7jW4;({7sn3jd>Zi}a11QWCKG}l$IcXUW~W(?kbAq>x{ zmFs;`xq{8}%a?_X?1Z_$IE<;iErW}P!t>g~+xb4Vs#T7*m&FIvrE~&p%JIi7GFfRm zn4cb_vu8jV`{vu!R`6B8Mz-0gYLfZM>z|R396?l85z}3j`1)k9IN6CycqYXep1l3h zhd5e3!YjI%fwl@v9vF%5*Ou^WdqjT95 z1z;IzW$6F7(zALNHaA}^Y(D(_2EVq;@K#mG2OsWe>Gc6a&*fp`6^&@urh(U#RHP^t7)w(!^Gqc9i#JPMfv08;(&{P z3Z?l`L}ryyp5o5u!thy}KEx-XkUdf8GV}p|6ZNZrjhvUT?&|7ca(aeEVQlpeUuJoclhK&-9_JU#a!(YA0yDlaCFTaW5Kiy5_x~c0GY+isEg3ZQ! z3v(TgEDZQDQf10`gAe)HE{rzHzBDH^6(?eAWr~TF4GBe!$}vxqHSqyoE(he7m7>=E z-17s~*xNZ^@8C_(j3#Y8S~kn=;TigWmKexG6a zDqwTCKFy;CpWxsXLQGfypWVGnNp2cH|M9O03=QC+sV&J#;l$>a3J=+Vu)+@59mf2Y z6=UoBqA+0iBmSo8R{c}y`4=`!z{4~O=WXOrjzNRwz84F{t+cj z`NrbBGBoYXNC!CuRSY!e^ZNUrQ!~0OXt6?GULL(;nto1$ZRKR8#c|8Ql|@YrB&`KO z1ZR~qR-eKn2QMba=adxg^OLho_Eg~DVnbnmF0I2094&R>=;O)C+9JbZ`|<87`MEjt zj;aXrFeN&rfQBwjyWR3suef$Ti(4n`tWQu|UaMrsZm2Azx@F)(->A#vtExsbaj<7Z zMtca@2KiW!la;}ZPw&$>ILyezA~jil1f~{}8)b`AR5ru)Sv)lIVrlPyO#>hBH&MST z*gQ$44U!{(%1)nh-q1c*`qk=7twxif&+iM*M#AR58l`bdz($rbo>iow+!rO6!<}Vz zmO5FS?n1rLE4G}5NMFfCF$9~nnR*UJonh1oCR{ZsYsMWIt#eU^#g$T?;f;5Cr84h! z|7}7tDv5P#_W~aR#@{-34s4W4Js; z4)@f|b_X-v7s6PBBh!t}l$V6lP-w>Cwyt;nF@5dzENn`PvQKMk8_NdzLq02-PPF5{ zUnXgP6BwT*-~5`M*okyzr9IIpT?hc-SGsFpB(r=$tuZ zpdgL->;|z{@9zE^VUbE%3yd2nYpAydQq!dXJ@(_UnhIAN}JLCYfqIg3mdtt34PY| zM3>>tyGrP@Shs(`t}v?G+nY-0vvjwz*NCi~f(mmT#CI}?6N27$v_U#42^S?+aWwALK;vM!y> z0b#C>Xql1*bpt0SH(F=atS(H_(caCrFtnwy?wEQfuq^IteqsdG(1bGPxeS?JUz7b= z4(M)cVPt%oXm2YVqKg$HI6vA$OP4mq%+V&TO-+OZxe!*WO*DD3Ntm-WL8&F;oLvk| z3e$YDLrZfrGpn-h=#aUIae6xHFfukFr)`|+@loa$7ID7u36?>5jE)Yopq9^LpEhxR z)zlLETdOoRiF2&&aj-VXorh+W4@u*FOour4*u181$!LEEo&DnmtBDN3W_GBM$;!`| zt-iyI(20thj23@HYmSisnz9Q82~If0%dvirh38?)q`0+;SWkSylX1Cm2d|iX@gg)} z@!%$<<<;1j+fXNrhPyEOx%Dmd4o=fvl!S@BHxW3pQ`q=kY)PI$FRc(;#f*%h%f4s+{QX zP?tCcw$(C&fUhQlfUNeJ@e;0u7qg9~dKm-`i1V|hb5`PE6aU~S%Bpj@f8!Qz4t4}3 z6_XZd#z*FXw3Nqi_m(j^q68iqoX5%03K8Bhq$fmRY2!^pODj&sA9LF)nbFQV+}z!9 zG&d)$qMrO%U;KhX_~f&92`!V=c(B@2$^(njvHvA7GQ$0E6A#zMF_5Z?6z<)4KtXmc zZ@=|6F=ZWOB>K^*8pQm)4+zL^A}`gS*0DK?!o0Bc@S~uno!Q}T!ovNzFYalur;fMY z`GAb(LCRC2aPt)Bw)G$@BNKCD8?s93*fQYw7=q2_+BCBxwakw-ifKKQgVm_IOBf$K z4F;H>8f0)%dRixp4EC@oBY5{0$xcY5sI-aMnMq2rlE|-VQ%dJuH3ii4&#*l|NOWu* zC5?T`d74VnNJz`3v1dpben85q_{~OVPQAFri7t|3lBpBNtf^OMZzv`%HkO8=d2#M- zhDJwGuPrb+H^Z<1c4ATniyK=^jSR3O{-v?L9t4jW>nI~OKA!GzVZ5hREN>pLHrYd5 zViNsR&z>t!4o%+G)uk9eY1AZitGqmlSt};`IG$dcP z8co`nD}6Oo{vKxn1YUGC+8+woye?q#Km97|QrO6SFV7(0!tu~)1_3!gQ){G`K|pvm zo|befc{va84+@@1FV zh#MLj$jr#y|58Wk0#^sl>Wv-#$zK5TyPg}2%K@W=e-DX@_*P(?+B z0vtJ_p-yB5fyp{e)_~=Pdo0x5WwA~e;H>vpnLEuOkQL*Ke^Ldi_Hs7o!hEh_jqd-N0SF66*MqDHpEC@GiG-lQQ1AfxbP18 zs-g*q%@=!~;Amk%m1>^YKnr^2S4ng6pm}tI>{w??YU*(@Hl@6yo9U^3%s#zOQEeS} zuHB|pHHx#XBTfDNINmp+u&tNz@mZD^CTXb5;>NW*Ol@4G%@u6EoXB@rzWixvX=G$% zT;hD*iST*a^ z?8zZegxxwm(u7y*QWHIo%46jJBs-68@9eU@wfPm^_gAmF-{SoG$FTW8z{c*Sz$Rb7 z=JIMZnW9FXVV^a{^MCwr?CgnGLY5D>z^(jJS0b+~!?l3LQj zvVc^3j~sgkI?FSN&#R=nvw`L9T?U(4lrhRx-F4#pCoB)v;^N^&SumB_ZCD&Tfg|wluMkEE7*KFIXO8|-b+JOKv(+Z zRTe6xA(6uad^y+%W52UPN_2!Mn9Z>(fU~aNP=Z3{#Wzw^-^QW%9p%1TTbe#J5)KFZ znq-?2NHTb1Z&#D6ZgYD_smkBl6xZ9_Qs#FQ!@th1_!bY;v*edovbd(npSHiZO;vU* zuEMDLN2as9wJY}DQu_GF>&oB|dF;;KzF3x!lKp&k#Wi=uy=-Z-Q;Yi&|JU;J3cLIJ zv{jYR*gY(c*;TenU@G@7?oE@edP{+myzl)zx$VV5N&er`w#(l_+I)Q|zT|4Or^Dt- zzIwTW&6T|BBHL@eENr%R511dSQyfC`IX*dNdt-%$+G?UhJTUc-VtRHOwE)f3 z#Hjct#;7eVq@uA~81F5nCsfo`meJCq(gZ4v_D~>(i!~Uw#whDr>BRTH*YFIHTquWnb7AKA0TiAo0lPm zU~?p1`qlXXR%ZKAj~BB(Rw91bT-K+n#a06iKQBS#i~KB+-p5CxbSg@y+9kycIbFVz zuY*X?d^y;xad@;(Zfpn{`6Yw|_%pkANO80mwys{7-2W6~FMqt<-5HpgBhcA_(uP(t z;)A(%{U&*hZFm^HkA)5?>cH z{^phiE8F5FJy^x*-aRtgGWZ7GVvWd-+vD) zduNQz9Vy64=I+f$q!m^$yDmHAjWu*jr=(e5lY_4GQ?GQt- zQP0-1)NRM=us5T%W{lLiQ&Hf^NWGibdP09)1|m(P?FucEnUK&9kt%&)Vbw^{s>KtW4nL z;xGQsR+`(Moa1e2ZibcJXCT>?yb$@)u-TC5fhM^1&d+fR4(H?7e@$9>J)V#37!@XF zswESbxC|=Oqw)6j!8<4#)j*GcK@jG5KgKgLn@~?{M%Q;q^>XFW9V48=HSgq1Ln=S| zi#Ldj6UX|w;b3e>cC&c*_r`eSTV}Iu%x!syRf7^4dSUt2OB+QHWvM#Y^ z4PP^BZh!VEH_SZ=^K~L7DG^U+aerGdSYJ$NpcmKP`%r+di>R;=23Ph-3UeemJ_h4Q z-pYB$%F=Lm4#3;Xo~eyJBJAymOU=Q<+MKMi4%EU!dl{b12OoT(KtS4j-8OyLyo3w_ zuW4ZOYuV2x>$zcbu(!+3<~sWuGwduhGc(@G%8ZN#yDG&#Nm|=FFTiGFzLAp|@d7V+ za5&@3`k*WOqb`gzcq-c)GQEk;(PYdnP7Ecgw3YsrGGfESC}|oHfQsjbKYNRc&OX{J zbIHmqp{c1$0mEolFAIyyROBR)m{~@Cj1zzHn@>-_h$SJTlAXgn+NyF$OU%Xi`Ww7u8OqS`AX76_ zBst#UHy_zEI6NRgC_eh*1F}TPH7qHI)wLBR;3GP-To|bpOh5V+A3DZyaC}5nL6Z3J zi`d;ips%5ru+VsBWt{hwyfFE)u#s&jZF!-5ddq|cVW3h1ZMiE-{T_DKMCH{I>1o7u zuSB+{TKMsw{u!AqqhxqmVds~Em(_h7Ba;dBuwZauoe(QC+}-?nBtX^D-9bxvKKE`s zRNnRB(Mhty+_CVAp*}y7pML&;#myt7J*6%;jQbX@^a}$U;bDb;S|vqs_S|#wqc%4d z8^=&$1KhFoj-scxpUII<+-!^)U)#j})^);C^2Iy-DH%2G$`B{1b$vwpo0DB!hRxmk z6tr{^@9Ro}fQzq-1tUxAcs;mFOkN#z#Yuep(dYCpNE`X$`fADFL5{2}`+wiD>y8kuncI62zm=@UY2b0Zy{ zrzPBl;U1dWHNy{|k&_L|8=BBhoHN*zi zv$OZ~wvr?9!k)d7c!Bd0@eK$dCAU@>M(yhJa-=zKV@5@NOP^TYAuTS6`o=ceI(ljD z84y3vS=g-3)UiL}#L0-GC@wi`bi`IkS0kk zG?w$g+LO_VPK-bMklNk>{LEcgI6NWSFNCPzQ10J0r*mY6&WdCnxP&n|+``=(5AgSK z=AMNUNzu_nq!tU9dGU#3uyQR97BIbI#faW(ksa*JBYO|5?tD&gViL9wKBKmKjD!FO zJTlwpEDI;Lq=vTiD4YX|=xIzQGAEz1xM18uQt9aLV|i(niu^?GT>Fs3iZ+r1oe3@N zq%I{8BWqXejc(!Q8-T?vBV`EeC;jGE^3}_ih0V^+E=}dRRCj2CaQ4?H$;i%USk;ZM zyEA^_(UgjB<6vuvbYa*=SN547Y{u8yli-L18oT>xt}SDBWsSy?Vuq%csmYGO#od+m z(It9ovv6{AC%LeZt<5Fkg52;73?ZesnpNRdsnr`C>~B$?8H1-VsA0(k?1}HSD9(=C z4whKvHk6QCCsS-0B)l73EZw7c0l+*R(1@4ljBL1o>OY-#{NUQuSf;dp0*- zJ=n;GIXQ6JdD)TP%tU~aLEvc4kJ%0f*7}_otJBLMaD2$p{3Lg8zfDHt1S_g?TpaDF zs;Xsi>xj*zNycXvl|DP|jUBA*95CM3Kv{Mo_uc)`&uo(xVn#}JH@TrU_@`DdH_}UG zRW9giQjI7u9B8kjwp9bn z<=GM18rlhPeuR-YZhCrB=nUmiF1+!cIep@oshL^Yy8147HY<}=>HF{C7L!YHekPr*l?3_wDO+TfNZ#N!lTGo&S2QzKTS`K1AJhH$BxNPxZel}+ zk^~dF%5n(^juFqwi15Nz%5#%xn^_^q_;aj-(kLm+rgLC~uIfze?Y!xmJDZ96N`AZY zWnm+2%+BtcpuB^-HwM{JX!(PDm6y~f7&t`cc@EWF#@Z5cJT z&xSCPG74;abAvrmx|1oZ-hQ>Js--P;#%SYumUTb^IGKW=TPmFpcH>_9*+vtkH@d#Kxfs(jCk*yVJGVah1Yb{gTth@Dp(37~`WDi? z?_%wpPE%UjI{vo+>&XjadQW@t$RAwautrbdxplxI>UFG52 zylq28aTafVbc2}G1l)sDQ7;XP(uW@#iap=O(&$}6;**JvjAw9hgMv^$yd&Zj02ViN zQgXy@$IjUuyGJIXL{);T@khj@ zSK(uGo7cGazn)I|3%xqlfpBf`vcqD4^r36~p3lFge3uALi8%hcG^W%sU;=S#J z7Z$?pw{DYOQA<`vDps}*v@|ty|BJvmkc|G&vodkNj2~0z4W+=u!Dby85kzCa*V3to*dZ!W^ zADve!fSG`)r9C<2HKYal;ph{MhxH>ui#uo*$6AGE(3qc$vxkpz?y1oMN(!>EHoZq> z*Tn(+uH?5T5;QU*O@=~Ch&+o*$gB$6B5jQhK(Ct0kY+hFfuU{Rbd?z~#swT+0oWM! zY~;SOC-LPO1nf^U2&i-!1mw`JIyu6{=^>3%2OQ4S;T0I8RFiqw29uQ&MXo53XNEa5 zvUx(Dmm8%+()cdo5F8?mO*fvNo|LwZQ&Il8V}uWtkVv+Uzp|gM0)aV%c07G(M7c^wbhZ7+t1=iF`?nyEn&etuDt8Ez&|Mw0}wN-TXkFdUb$jR;sO)VYD zc?R36D6ei7rNndpJ*MFa`v$+~}OE2P~p1Q?x4&`A3t=jBviw}qFY zvp>>PI@}i?%)zekLUt4bcp^NT)MrOw5uC-gl0fW)^3(uK zZ2al%>!U|COq7Q!KCzhs9;2+z^y2MogTz2%N+34T<#boa5RqTWWK|)7v5idk=ir}| zLEq5$1=w84mApzKA=B2@rbIT?)YK?ONE)P&kdO-+8XAh9@TO(KQ0^m*m$$c%qF!F! zxVwAc?Cc`uJ+ZZSulQ$Dmb z=R+$CKD5@UIUhW)T3s^#Bvtk^)2epfO1G@1x^;%OonJ5KFWb+cn(FEK46ev21}U|)3KgHhT3!JX-sEl zOItCo$O)}2HOy}wD=B2;nC{01+q5u+O0N$avrPQ3W16H+K|?Nv(W zIvE{kWqeUn`aV9|ry@6r$k=46I;02Ck7`^dU^}6uG=uE=K9;)*Fm{U2cq)n<(AZSN zs`&Sg)`X{2*@Aj$oUp)P;&aNB{f<^AhzbrOD!o8y3)x>#5gnhz{NrqzC)DL75hi|= z;-*1SD%&PK+Lw^%H0H%K>hEq>s+0DFw-BG4LGM5>BQtYs&P~y$T3~B!g5HraI%LY6 zE7)Ag*F>bvkTn}+Wo1h0s`Dygl#-I7K&P;dR?P`M>nrsufMOp%5A?Z&h<|p zeZqIVOS9C7=(A@Pev#5*AoTf4uH;n}O{2Xi zEMB5gq_L6JZrj^C%+D_}FsPz`U`PomZfa_yxVVhoo-SgAXaE0PcjNEB>CeA?kj&3N zH{!ql_kYaq{pu(DlaJr#pFh08cWjLLzMC~a@NwV|{ayG$peui%sEbf%z8~oHSicwG zcxL&+Is@CKD*Nbdlgp2f3vdwg_F^hDP^!b@d1bv^C#G`#yy|Z|Jzg%`@x8!{`gr@9 z^)`Gr!20a;68%n~^%?!HR^>4lRGjPkQUk5{Zm`vhht1DzbNPS$G?f4QUNSeoA;UtS z93L6XN%pG9v!tszK9sR|(oedQD|z)rrbdwlXm4+yrKJ^A!=p;XW`F+>t*xDumQ^y) z-%EUIHh+4`eH+hb=$wcjgB{ z?)*Wp&=9F^LS6ZOuz-$ss?2Mr=jWfM-wP7plJjyZ^zm}AoEPAc8Z6+Wr^G`qTiD$m!*bW)b9j~{m!o!>*O&y{k~Se zr>qyy5&GR=>lX`~KN7I{sdYC0-Cqatzu%1Kx{2#I0yeL@7=q2g&Ke72HO!CJvD_EW zsw#(ysw9?1a>UjX)|Y0Po}FiYcAD9xRV7)Xt_khraF6AsWlbafIXM)+rwlcHEGNfG zZ~cks%SSGKn#k+TO;0j0s|gnPqB1)7^qZtPh_uDy)32&oWBu?&dlx+TaK&``a=+STD-t8zOSNA=$noLxUH^ z?;}AoI5bRO-=Hv19h8(-(BIcXTuPSkY~1;Kulw;Qca!+VHRDs*eDV(e+(>vfwvYI} zyA40^a}r*S08Fq>g?A%hpwq{Yklu)P{&`gYI5~g1ET;klUrMz=(E>y_)mQ!PI{mKn zY=Wd}L8FC^q7p2Z=y!r7K*UtLtbe@b92&rUFG!=`4SM08&1?MFDvRIwOF#a%>oHt2 zad|G->}{*rTwi2&b%gENTE>SPS(vC3U+WdHo+Jj-)y&keK48bzq!$y7Rt(oT(OhQF zaJ{>Do+q?br1S9RyS#hTh>VJQQlbNy(RM^S*;%Ebw$Y#;l#~=s%fx9Pm4&_%?%sQV zqnQPvnKjzA7iFNkozWG;o>h6W8=srl;%sX{LZLR=?+LQMHbd>>zD!c~$PDqs%E1#~ z-!MkhhEZ_5F;8vBpdic^O*QrGAFL5-Z%ax^gED0I@)I1t?WIZTyGO*O)@T&ZW?Q@d zStQNZnEQ@#+NHBH-rvpe@-E$_Q4}?u4yAFKERXfm+C9wpU^l(ftE^8C)6}LJ#O|9U z&jXwP-!(V>?(4q%>pKaWYP2W7<`0A1gm-fhHabY?K%qZolN|^M+xg1IlG8x9j%NKmL1S-S-4&bg=oZ(C@qq*t{lT z^A~>nn`_a}1)GDN73R9Um>=|KywR44IyAcE`Lpnsj5N!9(n$c^f+2hx9`z1b83}G8&ioE#u}zEHMeE3zk`6_Kw|T1+1XhnE!>x=@I>B! z<263A@FF2c6D-kMkxR$KnsSbm2wM`H#yK9V#?&W?qa8I-{;s$Bza9@G9d2?8c= zE>6@A%+Q+V%>VP+>om$yK85s_#$)ahqs&V=+~1?IES&&fKibDuP_edc=`nwpY&ET*8{8yBA_R`uW|A!;0vtn>^bD?Wwj@Hr){CvD=8l0vw%98*5H}BIZ zK8&{RPVvI-k`?Wbo0|g#?PKgN4iFXWi=({@O(UmX-l2K|Uq?&Ktlf~0ZKktS>{Oe2#rlK!}U*BRDFXrKKeb62tNIi)Q|7njh|YVe>!!+M7SR9e)a& zUkTWJEMOzsY|g>vF>rz|!sZkZXF+nA8rt{bI(beBjEgWaq=sOlS*O)=kkP3j*ckF` zr0RP&PlS$cKiNhjrW)0FHBu#H{$-%0qA$G7<~6Hq;n@W6Z!hs|WT!6K!Rx&2Y|OGd z87PWw-ki+)vC!p&ddP)|dUMv7wEZGZj@VdV!ua6_iW(OPE?wbezXXA}y|k;2jf zf)nCtE{wp+BZj$w791S{nV+5H-lKcMm@ZIXluJoXH{+f87+cs9>gz#hN+GL@6C}k3 z^5zG(DX%ZV;^714S2u_a@+7Z)kc0p)8oGP%cXnY+>wy$RTl41U*D*11Vp6yl1;IW< z=C(0A(Ts;%Fe&1t4Nk6MVYU}X+d#USE3ov6RyyZONpW=~qT)0>eylc?cRsvFu&)CT zY}^U;vLHOSi}k@8%zfff3oy9)c(O7-fs17zbIW7+1&YE;Sss>lAxtmKvbw5fq^m~2 z)|`*5LKy9;z&0dHc#LiMLyP? zRe4_6{Ow_5Av?pgCQZz|n_{ zRKox=44N})2rydJc{aLzzZJR~(K8e6Xf+G{gOC@!b1I0GvucdYK+ zBBu1zYx-@8A=oTWRI=4)#(uB0lCoyM&xV6Ob76>`1ZuMw|(w@lDdMaZ5$rA;KAS)}% z#$<_nml$VH0W3>$yEWnO!S?<%*H_{aA={obQk(3LmEUQBp)Aaq4<2~X+}cXd;4mqn z&eV_Xb28b8eRzTJl%{a^^JQ~&0UyUG)Z24}Mf#E!5{gTVrYdl2yafj<9}08h_}nUp zk)B%Ilf<@-0Yc+KiSzI#vO-e`igybnF(HhU!bbKcTCubU(uTa*j?=w4&8HI>x7Ozdu4CpfE`mgYvL<`x-fF2KylhQ38jhuyE6d=c3E z;mufnriIP_dafGndlELj8raAxwC@YA=KIe98=d#_B-or^e-=I$p`x4Wuh-wEuczze zzG8YQV03C2GG{#$&GH4%$n`??tI?Ez0NpWCwLt+2bhO}kX|VZsH{vdZjm(WEJ&E7Zr8bQ;Xq1JGu?$z{Pc}`q^2YhpByXTVN08mUgm@l zyHHXyB1kCjRE`U^6UHhtf!v}@Ty9?z#xI_@a9`mq=yyo{?T8`R%ng?_RCbTiN;8Jb zP3bFoNJsWH8nWe>6v{4CW(N`|43vaTtoZomc27tT@FO#~fW*9PI;%5CDQ*=W+yWjp zM)(N>{r1f}bk3drrju>CMCa&+57;EqNdP@8g8L6`D620cE?SfAxhmclBcCK?pWAP~ zPHxX>->KY0cVepsq=m;!Jo}2$LhNm9@bPjcv!a`^t_G~lE%6u7kIQXjQ+T>}Z{MeW zP?PTcaDRaSJ9BJ3f(VaGWvI6UU$Gn>A5YuBBqhl{)TuT&S(RBHOek-tCMrIft+fS$ zJrf0N<_V7!p4-$YuBLbK79Wbtap!2|K&bG@?mI=XK0n00hgQ@yRuG$(!pu+?_7>&@ z_`4FFS;KH!o_J>UY>u_!>=L7RHd|B8SlN1LbMo!u<6=Xy0I`#mEe>}d;vG}PV0|XW z9uX90g;CZ%!FWxUfLRIUDPh>S_~7d1PS?=5GLr20w#)$+NnXnUYdYUk+^kDviiXnA=n%q?6JMM#?F?S zt<7~dH&$6+TUO?EB8SVBY4@eJAiRW)-TgDs zXvc>#QQ&D`s^fjNVieRn;&}1f%W6|aj&?*LV~noGY^>daQER;`DRQ`5U6t78`kG>> z*XPF>5Jpxf8%t9R42(Rko?2a)W?@agnf`#GfqsU@H2{*?e+T;e#eK+xhr1kTBfZuZ zXP94JS4Lx$i4S+R2@rR8H0P4Tix2bB{^xi>n(-HLaAL^*M1* zgPO>+W6iTVIXYxVoKwo-?lv1cr{4SS&X%(8>WuJU=2o;3YKNlGHHCU>M|hman&gc8 zntL4`9AHx0@mLNgENedx#s8wYpF?J}$L;G17~?|>j!tuQe8jjoc6Rl7!WdpHd0yE3 zzklJ$A6$>V6gJ=Uu;KguPW-`R&*maLo&=lA^sM)C9y}Vz7>35FUIv)wfz5Z%tvm18 zJPTYds1`O-m2+reqp41N>9COj0y$5Fjm#h*Q`Vf9!~HGhM(UU!t!GwDCkLw;?JZ-l zqey(D`um^I+tbF<_A$rXn$BKQ=7w8Ih)SZNNsc2SUc$HpI>#0{Io>8WGo2~*0fUWs z#KgwZFH3ueE2PFokycPj--M>2S<0xYi>1v|<2fQcqiAtV^Pn8&;FyY>1Y+XTSQY

o$9 z&CU4d4t@T*iK?}bs_u)y4li21KCroxD|t3~ZrJ?Ni$Ay~VDs5S{)gv)jm{g9>-1H( z{k&fEUJR?Qjph^-hP)KRdKNJHQ=wX@$f<5#dNoh?Y$PD0%6UCC02ZCJNI9C5I{$jR=K(zb9VSMsXM^TI|32q@KPhG1j&NWezZW}}HhI|~Y(8iJ3ZZRhnO zXyo!ma7aB5l~a(M-A|{w?cX~G8hzmC<~4xPt&=LDb20kN(7d90pwU+aIQsi30Mful zU%ytK&CbRW>g6f67JJ#6E@yb4mYI<;GngL8Wwy%h-rL|4zIo~~e8Ws4(<%kvW9_TW@9PX^s-qK8y?6Loxa&olK>e{L{ zeE3Sfjq+t+BLf8f7Xh2!7qI#N2-tkrR=~zx7*^@o$i$m^V7N@5=H2M4;i|Q>VA0J# z4J_xEAFDPn;4;|gFH2Rt8vzP^m>2@h8Q`3Qj6s#&kmA)yZ^lxn1~f0PpUoG5&HnZ> zb6xH%4*4?CWW!jEEj6Y7G!+=Lzp2e2AmngsnfL%V+&$dLF7KeFsffYpWqRtW7+yF# zK-YQMRIjtE3un^GKwSo2AsO1GvvRm2{y%a1OGDLEw+?C7K3R_UcUayOa1@?IWqGYO z?A5UBZEvx@cf|JmC{;Br+OU4k2rEL=gn+~J;Sy3 z^w-)kT<@u5-R*BF!~EX6ynD}_(q?VClOw}ba0ds69B<5!m|4J@Hv7QA!P(z+Up@Bi*~QrozM56IloSS+XdAFi~dw!6~M@; z(CYuN&F2u6?#`B@q;MPr-6MmQMam40Yn;=|y087RzfZbx9z4$ZkV>y!-70yf`KU}GhY72we>zjCmV`^uL{jz=!fp%W#8fJ&P|U`*(w zn=p>9%rqFEW)RpM=g~b|P6L%8C)S19u0i6$9OxNV;bviqkB=7*E!|0t^Tf#9g%EcK z5_78vaxud(p+f0HA!T#CiIBtsx@vRDs8=!DluJ-p1^Y___{q&|Hy;)x%r(q*YNA>&7Gh9Qx`~h|DdZB{u`Nzyu01BJhpMqa?u@V{1?R9W04c zhN%{^JBO3Fc6L%65ANI1F)&J9NB;%btWF89N@dUSkn9}m$l;(phXa-Sh^X zD?8--deWd$)03M{RAdVF#t$fMn-t(4!%5uR>Y|GGfB6Q1!9m=-Kjp3QY*OPuVSsi-dF!N(us5fsGzo1fwB;fHrfKF1sp*qqNGAUk#bfuDXq8^e8V zr0PI&9w_?jFNe)pa9p-*XuX`**E8$2)o40B+diX#kS<6-frA8wo=Si`jx5vDGyBLY zGNH=6+^)b#o=X5nct9F2NW#TRfy=*CfFr#ejlQ%1fq(Y|*o=!3e^XPFazdRb83g(+ zW)PUIGd|5Ausegv9W%x>{r?onj&T;S86rK=kK*)1e*K%z$rk@qQbrbe$$=EKjI-QU zNN`v#`MIf7jhe5`O(x^O;}Nn_(!`$$v=uv2WK+7G#&F+ zM%oDt2q)av7VC&YdK-&LXBC=S8OD+tx}if{xc`Si_?DeLTKcw~(7Xn(8)WTm9}_>-Sk zfRm>vV8~@JPtr0AiB1Y7Cn}Vi<^c>0ix+T8zld=q-*kCi*!+)AfQ^2ejZD6&2@=qx zt1(nvrVo7YB@kaDK8l9d4jRq*E z+b>kDJqC>4IkcXPK4e}JY)(C!%U~lj2*{yd^eakCR3t??Q{6E@e3&C`-QBobSWr~gNZ;@*4Ou>&f)e6sEy@!2>p*F3 zJq6KWnAruB7~+CSU=FIfEFO9$(NUX1R8BsXNy0nwi6l>WHqoi2l%@M9upAKHlB2&S zH`(4|4{yBn4w=;r6y_vgVQEKUlZu(?v#?nht7E9rhLKtqhN_(CEw!aJ*O;aPH#x$9 zB8{bS!eeR{bH`-H1v4i=G0|0sm8m7x5A4Y*EG0JFA6MT1#>XZJcCsX`p`Y5cP%MQ< zk|3YS>b95PpXo|ooIK;D86N-uRKrO`K~xWH z>YG2ivD60i|QSwKMo<_BW>gG*qeuR6#WhRb=q95$Ef`F+lV zM>Ex`9$YTd$FLC~ISUC1mW!T^4oZf=a(11Z>V-TDuSOU0{K~>c4$`GxeWsJcgB=zp z+gY6IU}2)2+0hmzh8h^{t7U)pY%;;l>H?)*rh9aO<%J1WH@29WR4LUgYm;51q@~d^ zIK$@34D+j7?5xf+CQ8`5tCJLzRI)8$v$H~1?||lnLT1MXm{?q)uc4g0yh=u=mc>nN zP+nF_zjy$PD{2llml+;k692>o1!*bdlsAiKpcY=mG{;B#3=fWSc(g}tMG3tl<4lVW zMoL>%7HK)Xzb>XF~i3eYXN+ab>jo4@mGAAax^!bTr5UlcZmR39QbecG}{^?;&Rg{G8%?K9Yrf|zjIs1m1Q-m#MyL8)IU%}=@$`x#` zkH1H6E~^gKLts=xkn zy&Ni+sSYIP*Xb`S>&}2hY&RGnAlq#&!bMJ%v23(3F%;d0_U(lcQc}|>C~sqBZIRif6;`K5=~YcC+n-C0Hfe9|d~#oy!%d}s z)$>Y!dnty-w6u0mT2?_{Z?^)QKfNJf^SZAxEVN4C;P;E*$|f9 zq6~Pou3i@};}!)O@nn~@aUeXP_L@R+(hIr!*_+((Ol5RT#mww9VWyw*&RrjdM+O<6 zUy;-xD>013yb9E7%j6~{l3v=(&gK$#-uVspg7U>R4ynjXCN;O_ahjW>`5w&uLNyCQ z=0>|I%uFFsTysZw8GVg~Wal)nxwS@aas=TCS*!~Ws3g&uf~Fpl!)$3CTcy9Pg2b38 zO6!{`5yxkhwkqda80#Q0A)bNRO*R&Xl}rT*X$35=E^znV-*7)D2c0c-vcE&i+%d!A zM;aTSI0GB?ObrLJW9*VIOMR}4)!PV&+bZd5q-=`+!^X%&0JDsWih62F69`JqVr_1M zp>a*0mZjM#RY!Nog>p(QmV{XMM6cy&3@ z*wmERe#pVLnyIN71)J)T2Aut)SXy6YsJDk5x$3gJu-|^ut^K%QQ(Qe0k*x!8@ z$CO5n_BWWE(nJn!i03@Fw65H@93<{Uc*44TZ!_ZBTiS=eyR{+Sza94X#C^=@o%c$< z5|K8guC9*ujt-ieTd1zCp{lByipnZstjfsC%V%_0MO<>`6JevtARu95We_$}p9B}3 z>Tf@<`a?b|fVc!Q7eJzgi@u(2m-8C9NY#Nx=iQtK&Y5AGWp$XGm+d#gE0M5ys#hab z?sL8xO`c1@=5g4w7B;%bw3i5**Z8STE`RH9!uh}MrEtRlY~;TE{r#e(GJIwbHBANq zFHHu4QK925FzLcfy%DPm+S2gGD8~2f(T`h7^>x77%^TC3*NI9?!s5V&AY2|`7D@1z52}6HKW@s|m$^QK1FW#l3p%UA>pJHWc ziAz`}3$qi128iFq)`{ZgZW4Vhu(Y(s$|;bp=6wG8Z+=CZOqr7z&C=F7X#sB7y17u* zHcWp*34T6~_$C(7RT9CEe(?^K&CR4`C$S~Gv@kaZJbm173Q1#jq794t;{MG{2}qV1 z6Eu=0-hs5z8lnXNgTfMNswv0O!j9yEQZi!_XdhlfRZ&20c{iQ4xww0I;~9`lXL~Uw zx9^fI3K(84&iIGKGrjd})w);mY$8XCm4;_@bVTunCnm-fBQ!BNAqo)_%IKzYl-S6) z6agC#{@&|;24VBhjBfHT>>lwQr5a5d@Ux(h?KXxWqQCBYN&tY%nRWUek+R(YaL&R* z=(%NOyLO#!UnTNPnHMU-q6eB&u$)~!t6E4%Jr5Ew)rZan0G$EMc@IY}>j6egb$xDh z`ocY%U)UG$cYYPapBiUy)69({@j~c}+*h8kSr`UcFRK$x1_39I2kkggQmg1P2pFAu zHhXiJ-Z4S7qgfR6;no{(;G2|3c3Lvcb%g{4YrKx!gm7wSPUtHOA-kmyRZ$LE)sv`N zQ%TKE#?iKV zyCeUNco!em_8==Ijv#+e-u~br1qB7$md8Vq;h=?vEBQ24}nbYbd4~ILX zR5sAv)ha&1=`*ldnG)XEkmgw)4LNc!V9!CnC8Kq&%JyJO8?w5WlzAy*O=(2smeW`q zLrz%{<{!V0Q&1SzMz@Jeiow%6goB+$oUHum=%^#D?SPAI*V!3hPH6=yFITg?JEOSV4fb2}KPfOm&oC_RxyKxg~Og{HX6= zXSkw}sGx8@dH+2E!@_uEY(!E*7=h859Pcg)c;2O~Y2?Y(hgb64B8L;7pPyF>q&k%y z!u3@Soe`mf%^QCF(e3y%u#vgZ{+Y3iMw8>&So3{cX%S@^&QNr8t@hWtgPrLjr7DevWUu@Kyq4o=*>t zE<*!@7XkzpMoL&|xr4gZh>f;KthESeH{GVc)Kb~roEMI<)5q_Lm%prJ^AdeEg2aZJi7TQ zAt@R7+IurOJBraqX0-RVVd)gg{6Y`j9^M=tZR2TXi;Jxzj)AF+O-`}AGE11J6|>?o z$Jkp_SXzgpvp2Kqbwb4lSeBoMiMcn+!ssjw*K_YPE1H_i`0$oBqr;t;I)$;J7GMwY zq&PVNOZNmew$(&?_>+?nM`&~!2Ww+Ix^0i9`|OGEek=$nY+-Sx53?Jektcqi-o`>q zga_pB?oC1c0C_&{xO#uuYpW6mtBkRJY zi+o;=4)<7@8xT6k^6UT$Q+>>gcQHBA!NLC7Xf#!OjZ*sWpOWnZht!qkQ&iK+_U;bz z!dsFi@IXCBtuVeb^K-0k@36DF%(4K+&c-4O>#~2oIIbk0>Xt$FcGf5_DWbJ|h_&4# z_SdGUZfqClIia;GpMvr_HXrw*KcKt0nnH2?hK_!gmloLAJz#5Pfw_5c?)h15(83`N z<@pqf`;xM;Jj2@N4l9c@Z0*SVoaXT4MEsv(|D$6T=Vld8M?Kq5zVg2&o9Iy$>Az-DQxo#6(5#+t(zZVaKX#-Fxg7uqYsmF?0y zC=|f8b@3oHxmWm&8VWff6ZoPwjZ6Fxpk!gJdq#@C&+k`gM*E0in?IZ5KYi;F~g zS>o#ML*Mue4P{xZh<~mwE1iMKWpW~YNGPnPsv?*5gMBKJ{jhOzqM=M05b6-`V|_2O=0hnuZ84FijeH0NPy?@V-d4Ku^7R5o;rQ_SG&>On|C z8mrp2ttU)xhRo=)>j-9*TZDj82~h9gPGq>63Q~{43 zY%T}SMX%;b%er-^U^%<2Stry$HJV}7dNfLVivWlrXlV5eSmZHUy#OVtkD+9spN#~K z9&Dt(P}uyj@N7QxsN}mJW$`nc67E`F!RAHC6>P5Ln$P`HvdU z=AS5@&9yHKn`hUH5Yb+ba{Uq4PPMtD?fI(Oou0lJ%e7T+li2nRpfSlFy+x3_AbD`<$dC+Lq%Xv+e zm<~4Q!J*S9K}G6gXz8|#Z8927w$bQ=<)y>solibjJexncRv=(g!F?;QXNJxG)&h&& zF077vG2Ld%NVN@3be)MQq*|59Ck4EJw+#AkPnNiNd_0z6Spb{QNy9Wd^qY!H>2hFbe? z4b&!co{v zKfs^jk2{4*(42#fA$_5+`9J^ar^2(T+bGF8QCgarjs zP+3EAcqlp5y&NALP?nWQcw{mQ+Xu`J){+vNL5#OKfBuX2Xc^W3XQCyKM;6|wC1XzZ z*xcHnJUfZ-h$QB=4wzTf6Bm)f@YEu;g>eM=y7P&(0HPj~^5dQG&C>Ka>8!~nB{`q! zszz3~kC+=8U~F=p_L_XcVzX!{jN#9J`Z^VZ3&Qvh5g8Rlb;qQ576+7OMiAuV#;0~3 zY-o8=p6Z2PK{Kd(xM}Idk$`PQb{xS$0kn*2`p7hwWl~sH#q{*d8Q5$s^)TJx#Y}G~ zqtzBnwFHSD+k^3DZ?RQ_t?8aR{DMM=PAp*K2?NF`J?M9qsjF>Lmg@_1sHknFwWXEK zr*xfvlAqOCldJTLij2#84DhGP#=E!M z*jFSc+R*STd473r*t{LUAKy(h3>!Nm{^jFzHBWDYF%%?Vcwf0rZj<0R1%*CLbPzee zPN(|Ybdb@hA-J4Z+38c08%@GO0^$iU(XG>;f4okk%JIs)#-mY!1C&%Xh5@6mFBCTa z>d*h0cU{Z)XYZx*W2*v#0RnPgc~Ys$3!@d8K|np^31iNj$P5Bv%7imBb$S^DgpurP z$l~_(>qHi{alA3iXV*TarnZRpUjKlKnre(J9hp||(OR90tasm+{(U{zRAfPhJ^gu25tc1az8pizAE&Tlb zxN-X-3Gs>eh9uEmm&scXtsdt;YsvNFm!Dk2*2abQp+&m$lW_4*p{J`FN9Q2Qax(Gp zPo$}*kIBiYGq6$5)^aQ}2Q2%b9`RIC)vR>eG1B0rY+q2-VDiwKy3T%jIy+bs-qgyB zisqIcCH2bw)-uDrgA^wPaMvz?Y4PDtjE^gTe)|_6P}?=g*x0Cot@Zg)8XKG0+&^Sy zxR;hz0erE(I>ncV&S3&%l2sElH|yt4JHp%3imXPJ5;DHKx6AVU1nq5IO1hcD-8ED_ z1FQ*Xs~1MZ`J0fA=VE6zJ_(t$ltdGjUCF`T2E%b_ZbhNfGIx$U{y9F*uRqP+^(%IU~_}o~hdJisN;V(SS!Y zFZ5h=+IiK$MM6fx>U7;1n4Di0s_*3}UX2o!rUAy2ycd1d!AG~hGFAHLi0u+Ma#;XI z=h1vefJ9eirmH?XUxg-@Uo32X_+#F5mZ8r{{FQ~apUpYg$d_bjXo%LmfH1ORk1$Ug%@j=V5*}EAI~t7BHXbIO{Xx`m#*1u zDnmR;s*~Q(0k)p5Ea-Ln$%}WvPw{Ma2=;V9nznQgcLrAkERv!~DC(rAHXVD1U{tCO zykZMj8*ShhzxbGvvU19*$_cf1Cc9l8xs8pd2P@iYw3;kGoMVzH2=}F+X@F!mN76bp zoncely)nOQMn>~IYNpUQUbYo{` zNtpN@hQ=0XDoe-7{1GA9H55kJ@YX#iCPw@5^K`?U@lD-oVYtLCIv06Jg7nH>{al)%=hRxdB|a z^P((2i{yd^;nB9?;^K;1w9m?VBGHP*_HmZzwZ6#}ovIQ_<8-e6Tk@ z-tM>s#E=yij+MPHjl%1*eee-RL8%l(24dylM_t$O6Ft2vIhE&y%|8&Z`Qv*@n$Twn zn_vH!fBeZQY|dAsNhANPeQpfvDOfb%I18IoPvz|L`Sm(gz#>%(5=GB13q22;$H4&- zB)X{q)q&-*WknUxT!f82RCHi@1z@A?)G1)|7Z$>cFaR5QOm%g&GS!#O)oF&xA23<< zfbq%)442+zu;>PL3GcEZO3sQLZIP7_LuPgkPL@u>lc^vmJcOOSH3IAcMX6I5{Ln}; zg-2mw<4c&21J(jIg-Kpi4{mU>IKYjY4`>5v1G2tHk`ku8Wk))8SOh3HRD}|de z$0K8Na`bDGl}{wt7}MBHkr{jErPrMIl4NCZoEY!bCUfW;W@`2qm*( zl9}!b0;6NO_3pd)i5K0~$&T#ISb`$c#B*H4#WqB|;59^)i2q3|jd_7wx3tE=*o^*} z9df)L@zFy!B7@us3k$^FGDO+0uQGvef>{>7b5&fDC}6nqt2aI;COQ(&pkN9! zGH`MBVPtBV(wrn}rncxSPQ<~8ubV%=uVz2pdU=0(Fww6{lVH*6cg3<)&Aiql zc|s(brfTf$b_pBZxHpeg3mOG7I@ss|MIS8sQ{DV42OIgq$T4Nk%kj|x>q`@?FHf>2 zrpxnVEX)iuH#Kx7$Y7$sld7sJhLr39CoGBU9-kbsvbZ9q$KpO#IT9~nZ+io6Ju23= zcG*~8W@}e-&C&i2RI_^38M~|0i1XF84~ny$(BILh$t19~!=^ZHb4OzuC;MBJd|h)Z z>*6}fDn&Ndmsr`5(Q+rOEH5h6DiS>Hb@dF6%(A_urlX;nE-^1aMX=e~+bx`^?wgVYccsx(ZB`?E`gb+%s~bOEs?iz_}3tSi6QXI65Yt=@L<% zrgSdCa%TbeTw=t1*WeZ!fqHTPXU7EASNjB{{izbh-$KAaCA_Qp^e7&f22hz3&JBlX zRLzB01f?h#W5uAcWq$; zXEPJ3x_SxmFe9*_f)p^sX=zE5#8(TOKf9%YjmEPv zHVB*VxLavLpOtE>r-9^hJw5gmHi}AE=v06GC8~jpMo-sk!E%{OxSWBFoN7R!csG~8 zMp-XmB-D_Hqf@zE0~-O6bD)thxePM8=_?1DEBWfBy|d>+==0jb5aV5GO!el7X%?!s zRC?-S>2J+ZwoB=($imYvfSAm3c6WCvP7J`;KY;$p1qM56SrE?W@%}Qgkr4vM9d!2f zu_pl7*wD}3?lKLnEnCFetuqbOssLRK0#~0 zin;L~`p0J(>u+RoeVf@nQHYpWXIa3oeSDSe*xsb@YP*M(`O@4hQIMIZFu@OBzhFj}4^U6F2{3vKZ`p(p;SsG(wh8ae zmxTB{mUfQ?;4;K>^ru=BSO%Jk2?z{AwXlhLypzcIL@G;i#kvp%r!`sGuH@;W^K9gh zBqhbg{N^{m!OYA|sTGknN2&swSmD_S*!;tHgZY#D$r{-Fhd(}Bjdm^??L2Ir2R?FN z&HiU$qYsa>06Dvl{`{GJ<-CB0uA0nXIvTxg8sMCICg+EP)~P;R9#^+XmFp#BB!qO^ zv_MkEtl3X<_sG`mph^A}WOG@5|T_YDl5b{;f_p`!!K`Tg`^aXECJv|ayr36N)jjZ%%KcsCk= z7;39|8f+c|Mt}a2fB=2f2hI8UmkyirBXwTMS1&${``mQUAdz@p4+N9~mBE(3^E9Y73illmAi`YJ&3 z*tv(Z3AQ3(uXD&V4>KV86L19PWc|?`}8v2cWGOsO_6Ojm+A4*p)xG=pWXK6e|kTZfBP`iuxBG-BRv~`Y19QI z^q`{CC&NangoIqDnVy{&)5o1VH7enuzkJ#HOJVaA??$Qu8?EXC&Yin&;_=vF$|*&Iz!1=u zmS*H0F2I@Uvp8_*2+m8ID!%D&D`Qh!pOcf*D}UziFN$=%=v8m-vc7zlW!3eg$`J6r zE-rxpDb)la15rakpU&v&@xBIQzBdqwWcgWdP{$1T=lwiIYDhR4xOW~{e%xY%XF z<{Q5c!4D_JS+2LuXyjNy`1G=2!v?h@ zF6Wd_=zM~zsi{@Ee3{GdOwG+LDuaaug=%{2STQzl+ANi~!7=@9NzRQoAM?PQfdz3t z#AC61*R5M8=W$uxj4Vsun4O&hKm#@`OAQrXpVHD&L`O%f^xT%>`4gHA4P54s&o7WJ zUAl}gxhaZSPd0B>gNr66BuE*zI;Q{Ps8%)2=H?z!b;qe*-mTa?7Z(?YJy}_5o_2)x zg!THiVe>|)BW(V0(kK-mphpn6Q`lJQ8#rFz@ced4W6qnhdoNC~Q7>~U^#+MGO7mRV zk0*G*Ca&X0(YpI^xXgr2fWXEWIl%N}`jSrb3BV@93pNcN*l;5@m%Z}JD;Ph1yfT;? zHr$p*{M4yRIp9f@m6hL-jvqgP>gscdii$#UaS5U&lcgo4szP%(7p`~OuD>dk?KygZ z_880?=U$4(VmY(y{N!TlC&0d7!!*Uk#dzY0CsYOCle&h@#fulzg+3$3#3`R&6tO;> zEU!?IDUo^-9~Y1O`~qx~8{+K8P+valDkwav>WTKIKW=d}5kEgay!P5_sHmvuwkNj@ zoAHE=<=MQb0tB32>U@}^K6@b20}yBVN~4CBQB7W!On8{;28hFQr)5^?a}Q{o^suCP zNWI7@F!4Y`gQPp^jL@(_M1h29WW9ooAqz4(EhPZy2Vk@`XzsgbGeBT7OknekR|%VR zFW4|0pQfJ_y3vY;h`*M()nkx0B$}#;HNk{Sv?WQ9D9AD4<(dWR}OnRrGt7KQRumX?+#89A!PQ#yI_6pkJ(aoDE+I(oDi zSy_7|FZUldEF(5Q>T=ZHjW5`+TzP#CNVzhof$4R56PCQtm6cVJue&Rg&$ddWzLl!_ zQY7_-^&~Ivh`Pq*<#%6SKI_WM%fF|vVbmG#(f#}P-(54>ct3pe%`l&^QGGT(0tD=E zahkWJKSdzG2oy+ACPWO`LDJWHuVn%iy>AVfo_UUm)-xmx;X+uj$&4WRmIpR!a7}_k zc`DXa!A6!VAbHa1^`?A5#I8>TZ0Om%G=Dq(`jsgBT0ENx25h*YZr;(qwYV)0d{l1! zg9r0Ohwo5%YGmajM+#9;a1{A^nqMS0PJvqQyj_2lCtkvCm5=)g8!eU3adjTisrb z28M&2)|t!ffFXQ(*82vDmbuQJ?!J3AFU(8FUk%%Yr>3VV*f2nV29SW!vj1kq%E>u^ zox8H+>2jxdK6fG6J~MNd@WQX>rRV5;}E3+fB)AM4a zn%-*}FS?mxnO#*w0o_!iKA$^(L7-Ep);X22DQ=gXrvmyA|4VcjKkL0L~M;qa!hMia_V-+{JH8w>74FBn#h{}e2e*HJ#nf(_gu+o zNK8)msRU7qcwRH+EydFl*V$lWc{bexaS}G3Xfy)kR-c0I4IN)ziUk`55*utDUdLlO zZ6o_K0Moau5uUrlo&$8#mrWj65FkpNH-9^U#X%1VY`z^J;GhhM*a2goYTaMhJT({t zXC>o-!Rztkv750XC<>*;$52>U=;~gnpip^T<#M5pmzJvEj_F+8wTcRhP>^2$j ! zr!=1@6>%!{DgVf)FTXsuqhh2|wq;=OlpuWb%@A+c3>$Jw*l=Ehr8i*A#X&jJ{t#6XqkZN3pTyid4t1*OMhXra^*_(-V|Rx=a*H(!om<48L42y zcO5@=*bJI2o{hlf(RacS9Gwna?L?Do;L6o!UCjcTE0-?elH3S{j#HY?lbS^Y&Bb%) zRNkG^d{W~1G+wDie&JCMY(nvqDLOzvU_;NwX>2sZgYo6f^wzCGW6Fd}Z`g3&8!UZ^ zo{I$;Pe^k=U}MTD4dvyb~XherRbv4OxozvV~HHzAso6%Y?6<^MU#;2{hRi1cT&?4nQIc-PjZChkp zr}a&B4d`lbM|-2}p8@b$JJ5i%-+sbWu z&QcbArR}d8CGTxbEMqC#mNq%B2DQv7tyT-KMT4Z5?b>AOl)h2&MlX=ptfQ@6p5R-Q zXV}`nbq%=Q)g^VyI+nFu_9NTTz|~!@abfc*kT+~X@ZeiE*qEWu{GN?!MiZmGjt1We zC_U;89sahUVfRw>GQHd>jkjdI15|wJA?4xdz8W#=Ui~S(VWQr%u`Satb#?~`sAaOf zh$9B*Q3Etk>~Q(GV3VAjtfF}d8;-=ncPoz^IdW&Pc~oFCWR3+JHlu~c?Zl1xN-UT* z4)f>Ez`BholD-A)VmNT^8akUTqjs(9s(3(M=n@0mMv1|q(d&@)GZO5crL89Q*Pu1OvqWIHKS8sRR^%RbnoQFq}yE?sFx zT}2VLrR_vRODnE-%C(jK((t!PnO^Jc!cDo>gtYx!3943kDACvdnv}_<>a%EWZAV_l z7UY(kgCtb>ZxNVqo12n`#;2oI_JJEH%h`qfhmN7H<`Qbg zqEJwA9%WgHm_B6&=Fj&-Np&4=v|YrSh4YY8d=6c8XAz&6fa;44*7?izI&*X%E}S{l z=flM3MV}kk`0#9QCEZ^`nayZUaIyc^^Lm>edBetRK2yN}#yV>~ry4jOFmxOE9=Q1O zVz^wxN&!o+GeM)rL-X2q4`iG`V_){r`kD71HqXvY!2^TV<1v9vSi&B(oXo=8lc$K$ zyM*^gkH(?OCe)tHLzJAvvGNOIDC@B^F%p}j6LF;U1kRL}pt4d9RCxl&k5{9ut{U-@ zcE`S>0**%PPL4rJ#(pFU)rY=00VmGZh#_e~=*F*b&WVfVoj zwAWum!Y1n+n(EHu(C!TEN{GkXzkLPs!nfg6X%VWc$}#WFm+{uLK%6Koz=>1m(0S!7 z;x>jMIdeZQo-W7M$W6%1IfnLgh4}68;aI*k8`qj^ks2L|v>mzN;E(NMSj+cr!H{1) zhxmO3C_T7S40jG{FI6KkGF$+(9gWRxs6KueX|bD;vVA8GXYat4s8rOdeDkTk9))|i zAxiRHD(BHosLQ&}##&^?Z^WjU6f`!qAwMfgwoAd~D-Eb9%EpeAo$#MC7Q@EOM%jr{ zx%lPC-n|Wv2jBb&Qzbn{TMnvO`0IcS839`}>ur(%Gpwwu2EKPNC9%*u}Q8;<_63&+utLtA= zRf)>t0!$tK8%zmIK%7+WMa$M9EiDrb0+#x!Vnl|ABVNk3UEpy%Z#U8tcOozE5UNj> zVD`Je!PxnM$jv_@d2Pk1V@FU@enve2oGsdmRiRr^QMel)yf*~}B8m{mI<37(?ak!Z-wFUsfm5VMh{oh z3n<>pw0dB(uvedr6JYxK-MzdI*id%Z^r*+f@q&f|hi};E5e1xJ(+!z^!o~!Qxy+IU z8-IU)1Ox;iI5-&La(@yw90)i*J{~D4DcHV!yCZBkU~qYPx!n7e>XS4alIxbuXwT0R z*bLUN$wFs!E?#?WDEycCAt*8x7fv0;^!Go&iY0R}e#$~5ZrOkZOZ*YGd@5d_y#%R& zYZ0?eNS7XswE;1RT)Pl+7B0j1(c`dw?Has4W-_vKi;xty1iu?M1E(*_Q@$AK#~m^m7Fm{pw3tvvw^ePhEn2J5w?7!zoxabrPmdn~rG<*P`TL5}q0I z8usnkjb+RIP}h0`owXHMGI1i-Y=}nA!2<|gG7obWEX8{x#|aceG4{LuicO_xPoDVQ!>IyWrc8c@ShK%6l zm^ynI(&S?AjE%yi$`9Hn)b~bWNq906*3A?HAAv*L!?A92G!DdV#%w9$ zxUf}NvUV$yL+0S!4`yS@)DICHCtlmtc62mc!NDB~ST=J4CawrVQlLL#w;e_4wivAS z--IQz-p9htnNm(uFnQ(@%%AijVz*}@birJN#3p0m%;`wZ*o}qbhGYGf97G4rMPg6@KN)|c52EIo&_#Wu;~qwTZ!A< zN7!&7hpTyEUMjxyY#_cn(t=HU)d7rre=H(aErFjH;kgh>eRD_bL=~$IrsP zQ(Zt!A?63JL%e_?E&CKI_ol&r;ZpqW)z`6p(^doptU=EHg9uwX8{u2`qGVqxmT%my znpHYln^C-XI|BUHVbMpUupmN~-@J~7)45nYe<51r2|IB1984NB8gEWmh}g}cNJ>k` z=HS&>D4<(1V>af_o{9~L`(=MXRn}IF`EaG0M}09~{`Iq18ySsIF}A6(VenfUrd9>{ ztw!PbHl&5kMn?W|WQ7DHGxrR3$N3>@b2uiBorxNi@&@+BM!oN$Vu_uI?!BIh?Vog#9KOyrAt?%>C!2T8!-(HvZv0ny;w0j z2qB@1kW+CH`#1O@byqo#W^TsP$V_ES8_$;`Lds(Onq_$X-I=)1B<0(D1|PjM76;B+ zFT<_-@GZPEc{ySugOQYyC=i>2@;ab=*H)}eK8(7OZCDz#0T+r6iEEsKi>I=&E@Z73 z@tN3|RjKxIxilB+R<6OC#R7s=(KxiUS`aQ<){LN*3r;e;8;J}t+VQt+F;41ocQ zk&-QyYI`K+F57}@H?E`pY#G8)zM@L{!c@1_( z%tOYJDikGc#I&&!F=KAg2sAr(;FOiDS&vyK{oqZry*kZ zW+)RjRL^IjxlfsT-m$S{z=YrsIYGutT<%G$_hE;PwO?=VMgQ&rOK*KEV5UrGVAZNs zyC3m6n82@6STz<$AH@9f(;n9W$1NW99Vmm=%<& zhO%g=Jc#+TX5n(p1uU5G5kl4nW7aG&(mDHZy1EuelKk=1vm;S(bT^)P;u#z~eo;=d z4b9ahm^S8JgvTZ0NbW(boH_+T(do!NT#Vv9QCPHeje^oN z5T8|!jLi$NC2c1{W>3cQz|A;(cpv7EeP5s%iw{P=jimjB2$(YkVX0XNnL8b8HYQ?U zHoucoi`M2gG@LwyIg?hS{Nw>Fn!5n?&CT$iG6DXPiP-4B2+;}I*d!Nsrx?u4fMrPB zUX17{lM1jPp$$;_#G0TuBtlCT&oWxVT7DxQuKPf`QZYj$An-mum8Aru`nP7$)U@!U_%Pxq(Y}2IDzblmGXcP zgk{sGATl)*0gLA&B|TFfOs0q@0wf1dN8;XmY!hQKb!{BlYEIydflpy=f_Q!6NwJ@5 zZ^C*6$LFBsLO$LfIR=~JGq88h9z=<8nKWx9PFGc7*QRAsZ&%{-$pZ1{HleAd9qp}M zII?A$>)Ct?)E8{}^lWTU=?gslg^f8imusnIoF_zlz=kqCn;uz_Xg#2@fI)y*9*d=0 z!A7UGAfx+nJoDPiAyfi;U}H*y#cBRq0W)MeL%n0OMr_3T^>TlG+_0fIjuFS{(y)1P zK`Q>}`5=6MbOb_TGH|W&A`Zw-`Srhwf*c$wIDv{II}s{R_F0EY(a~Ik)aZ=}S+@-1 z#K<%^T|r9Z2E@mvp{(Kp8qSttLr@T6)Aq;{Wf3Am!&U!Fd&4E9#6;n6X_e};xl(l; zTQ-IxAvpsj<+6j>v*&TT zs1T=4UqsdMBRE-g3C-t@W21OOX}j{oK;P-yi^LK7SHhLW8h5VLO^z+E6YYN7eaDs5(}FQ>V`3 zTzN5yj#o;)o6y!!i|q6mL~f43zC(rJhvV3}-Bx=R2^-d9b8LosNZ6Ao4+J3_aH8T2 z$_jIF;c_EdFIOQcHU_yz@^Sq5aa^fBjUp-UD{`I%g+=mo-;6A77ZIyE^3r1>u{AaY z`6Z{&e6bSoF|jyOP=M0o<>+j#!}b{QaKoc;zP1VHq+H5RoyCO{$B-|cU@L<`>T9qk zbt^VS#Ue*w-c*0ybN$nC{N!0&t|&lkd@>62593VrMO2p*pt$TTuADxG&>->3cH~H& z8*nV|AZo6(pt3j*6;&5dE0Bnm^SUJIrcL??`KRmA*;tR}#wN5>mtygfTeH0dEf{2I+^|_arm>47`CMwu)WcA&E*B-xK~gArY9SC@GeAy!wfqOlm+#eJ)EjOyYzY>dFF^+co5`;v3(Y?JM!f_8OS z(NXOUVt5*wa835hbGX)SMJ+LMi)s@C&tr8lB2JFWNHRu@F)FO1Me;1iWFWzf4te5j zw!&ixpf)jRjAUz9hRr(nYi+Vz(lCPSx};|$R-2T8ia?Wd;J$Bm_8i|jZ$`d(&R=dS zbq|nQ|w|LCv?tC+%?JA?bIDVS!hf#ReeyxZ$YaexzMn{S@sQtC@_)NpG zsU$CqFk>_zuNkB8xQr2GYP+kQ3XIo15pgQAP;J{O+e!WfW-5A6rM05ZSS~8kOwN`2 zHC>56l->KbM;a1uGPaZqC1V*|)(BaKqBl{NK@1^fj6G{3*|KDxG{%r*AIdV8DEl%- zhLN2RQ`Rx|-}LtVJ%7M`pXa`>>w3=Toa;QtMd%vU1ouahbxsuXI4P&|g4 zv<3om%$=AWyU|{0VQ|zgzg^11eu?LD@efhbr@aS1DPBv+j}Nnj$)(rcg{{aOdz+w1 z`%hECGY`GAnj3uV#6+&$2Yzd`rVJFHv+eg!)b`t5*hSQo_}K7RlUQ?-KDgpx`m&>D zTd0I`*J`n8I?B-DZ5}l5s;Y)n z_X!^i**Ua6UHTy%2RE zCT14Hm&2}hf1Pl9Ccx80jU%434f{KKmhY$6V?XeYM53YYy20(z4nsrwD?iOk>OY(> z>M2a4PmgJzOKK7w#(rdJ*zU|hmhN=A+k_jfh|JsUpn9!px09M`#F7Z2FFGc4Al(b%d*q%vMg7^X)pf{Fc@sdYqz{ri+VV zUC<_=hu3twGsd;0_R2hu?Z#*gRZT|EOs4n`b)Q*H?R09OFV#4_iOVH3{djUio+BQ= z^^SMDrtGmXLFrP*N^)A95v$9DGxi2HYMr1UK|gB1)^}QJ1TQRy5<9sSZn)(&K-N%pT(ts?!r^cRe|JXAY#u{}&N~Jv zd+L!6m0f+pQBZSpo{f!-;kWP2!HA8hq-a31?>uKt^WM&JJNI0MQ_G2EI;G;)H~&rC zBFlQqtL*?sA11MLpLlpRtIzTtP^9EmtiGGm6mCH}2OY=!!B6ULiu+c0YQPgbe}g+V z_)EXCTExAvT_Bp6T2N~8cd9@xWBfe^JvU56+ZV(RyJ3e`Ra8<{lG{8z>R=7$MxN~f zmv!V31mepZMIy@qylrIrI;GHmYjMNctNVQPup05bmquYKvNx7{!0ak}aSM|=&Eg_4t;+U`1hbKqDywnJ+(m7( zCpxvEfwBAROU8xd#moDf4^mHX7;C}oe`n3B*+xmrknCrJvUrl0eJyDN<*nk46=xlS zo}i_f!XOB(Bl<#%_hFa3se_o=F9U~dd4x`;(&3Bj)qvsw)(-u($uVY zQT&&%JRKq4E2A$ef1_UdZ)REg=RtWj_cm{6{cKmKl-xm21bBA*cwaE!cKGJ(XUHi#JOC_vv!i;GB=6#VnIo2?-?&w& zIykOp|Ln)tq33{_s-+nLBDlbGjsYm&CDT30Q@QBq>-iDY{0csIBaPNg26|UxT;X40 zofz%5C6IY@g+MPmrpLI>DT4S0x&n#(BK0@BJ)T^%x32=UrF%DDBs8|Ckm_NkO7-L^ z6L25|v9980-k3NrV9{E=nKG=-n|*b`pf9CyE9Kwxi6M8ii^YoR#CT`T89??N-{StA z#!F*HJB@DW8gMadZ&J!I_tiQn))zkoyp@?Ga>t6yy zH0gv(P&O$f3Tv@DYTovhNAL)_fe=${oo2l-;ls7jQmldQ%^43SaC&ryCouoRFWZ!! z^A@I)zyZ(_F?_4=eeBn_(VRiXOxRTtI90jKp2L$kFWXYtJlf@>jQmxR8iUqa-GVLh zYDA1`cSzut^@y+YO${i?K?UM6ohsU>p7rR!*95GmhZmX% z-7{x$+mrS_JzeO2ePya@97?(KlJ+{k6xa7~Scoc5RiG+Tm8f`cZR{a(!vn#eeS~KU zbmZk3gbf6}13txBj8+g55c#Gz$S>s1*j=hOL!g)RlD!K=+>L%FKPxzIbYdYky9E}* zKhC0zprhV%iMiUh8L@Vz$;n!mJ*a!SAnOH&-ZvpOS>kK(4N@)$@dO$i0*7~m1}cXt zW0r414igh1p`fWMBIG{b~v~jv}G_Aqg80ODsiidU&O{t+jmzum7(8Zv52@Rb78(pmz(4X7BehD8?=3MX7MUU*-_+AYGF>v!Y% z;I5ylf0amp7!VtC&Fx^esfPttAH5x{JdaxbR`G2$;t{#*I%|ig$;AW& z!*lf8P_-zlWrjJ>(K4}egwjI{RoAqscQ}gW4a1B;6=SS`_d2hAtc zb$KNLr9z2$$+MAvu@b62cITx^hGMH8QJchI63Lt7?s%GsT1Rt*FQRp^tSq^@`fmo4 z1E=@4S1N*4&Hs=ekqR7NItS66hJ#~UE5QHQ1790r*TAzy+&bd@2I-zcQcwya;bT+BM*k5RO#;$^ca z)CG7aKYNa_s&@;QnyWAHVUXJD0St7SH$UgwO?80iOYd|pG145-sSxtQOo3#sc>Rys zTbBj(bRjK~8YR^7+7A2xo&=N^pngJ~x?hP`#pd*NGHbwB``of+v|-pBQb?ehl#dyh zp&p<@f+)Xc;s1}(?ABkrO+Kwcr%m*G>_4KoP~0{Ch-}tmypW%v9J~`gm}w8SwiZ0n YY1o^CaYxJMF)<{9 diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-12-certificate-enrollment-select-certificate.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-12-certificate-enrollment-select-certificate.png deleted file mode 100644 index b8fb5e9635903cc6fe29e37cde1034ccf5561ba9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 82088 zcmX6^2|UyP|7V6dbKm3~a?P>6(y9NxzrTmi!()3q#_aQYzn|wj%fZf?hf{)+iHV5^ZUb{-Vq&gmT<1Y-jAuq* zZ5oUp%u!C(=1k2~Qgp@xV1OCQjEU(<0oNZdR>otFaGNVpOia9k|6RNU$U0|Z8V+Jy}6XA8`bk(y=8cUTSV2q{%${f?D-&Iy7Ipl zT)J`;<`fn2)_r4HhaE4+;-tlbXKwh&LbL6siP^B_O0ZCw9HW?YVtR*UDMyPq zzj^;o=zp*Dn|}e%^LfhO$^&J4lVj?)OOjw2!{C@3NB;0%!BClI|9!I`zH@CCqnV>W z7@Bi>B$SIn&^RHU4Sw3b&<XZ`vZ-|m1123 zEDEL0wjZ?3+lKNYhwlz|i*!M5_Pd9wes8!p^ z@Y7q#R*!Gaw>6v9Mng4q@4qg$iZnrtw5;uPK7LWl|8H2LYpL*gg}=n`>hyNPUq;H@^vE0kr=1sH^!Xa9BX8KRy?irHSEA2xT9O)z%hB}l z6fM!89obmBp&jbBRJl-kUH36g)TX}7UVo%GcRhysOWp6rUKYQvqK4+& zOCJfjmE6(gWjw#Ar@F9~pLMnKRPZzOgIdx0&)?ec7S5;;yZlN*=RB+6XKC$8YL1`G zV^W~|B~nILKF7TZNDGg`DLvFii%rL^&%ZPXy~7-RCF+CMN+w3G z%G}dn^2dxxIZZM@Fl6^@8|VYsO{UQATX}MQx3rcChWv2s;%}< z-habmDA)bWy|Ee{Ep)=Kc%<#Q%s|x|T>=rNR5^l=JF_cPKU6ueMi3;3#d8ZPz8sIoAI_hRy`Mea$R{g9}fR0G(u)CrBfqZ z%uVW5zSP7*kU(Lu+hw z%k@2<(uMNnxtQn0KQAWXm|nedQOul&^C3;hEi1WN7{Ow$chvAJ9bc<8uiR-)e&*EW zq{Vyey`=lnK|BHI_Mit|ww##=cn^s!1#?q&Fi zUva(Dd~no?_j zoGTh$%#?pnxXB~zh&f*q{(n?kEux^ts%V6I^!v&BM^~v)-0eac;ZwV}iR(86(aSF6zQjOcph#&=9B!HoIzo z7ma>-n;TT0^4;51cKwCq-&?Bp6AlmFrQfc^k7^z&MJEWJ?W=e=GyVi%5)0W1RkhOp zEg$W9zhG)-|5YGL)2M06YE<}2x6Vv_47mHzw0S|3;nsS2&U2ZcTbqM|^UBkt=S%*d z;!bb$^+nCRR}<~S@8c5^HmZB9dAoa@Cwd$`U{YTn;q&a8|J-_}9*tgFQj+}Qt~2x6 zP%xxi_gkeio11e}`RvSCQKXH9?M%K)+nb{LL*C4f^-J%X>8O&vCm#6hg|Zh@fsY@q zxb$|Ius#kEj3E4y%;fnSb5-Z0`yxK&1w{Yw!ZWby-}a)Deff~pKeT^+8Z$_#kHlAx zd{174SH1|f9|`7N)ZC7-4!v;vQzO8UZD~W>F>-R~976p13Nc+I^er(?%2MM)>nrSf z%_Zadym{h*L_+Doi=Dm5zD@GDnq)|CBw=U2!{r`$>@T}tS7pcf$%hqTp{+qX<8&8E z{!PKY&B-tNs$5?a{I2h>b*+~*=WG(3jNB5w{fXS{TAzxV&|v-AsdNyhysA+OLrrn~ z(UQpcC}cQ%@UKQ{mAD1XyxeOSxVjhgR>VC(?Iiz(wd6-++retr*ZZ}!e)C?LKTnZC zJEJ=Tt|cq&D-~9Cs~#I)6Y3&PJ9YlWTkE(blB(Jh1>Cx+VM-2ri>FRHUPANV%RD@+ z*NrNYC|K#p`t&Vd^GZjZwS2)vfdW6ycfaeZeN07+*!LuOr>qwEJm7>cR?wR=}=a>7QPQqv{?4ZU|6^ga!cTWvMEsg{>JK799$)EUvifw`FlU5Q)9HJ2l%C^l32 z<#WG&4b_|)XJ>B+KQW%Nh0BDgTni+fHwM=Mb!(lT$o7d@{P;c2weu=?29We;ZxnGq zX+LY0!B2ux@C*#+-M+X&6LSzjW5un*_J%+2t38sI_6}L&yMg5$02jprgr`?JQy1T+ ziit$=S=91+gP5U;Z*nY)`)Uk8^dCdS`{R`d$PCALsA{5*;zwm4e#eYId(^ZeG% z(7WT<*Dv)&Ye(zNqu&=6G^aV2LXD}H{A$O?ZbW;QrE5NHeHG#%k`PKYJ3Z=tcykjD zgYXXss>~;b)Y66tm#_~gZ`8-tE z=3}{^*PP`Z`KoHV2Ozl#+BJ!{@tBIob8Sm+hp-(zBfMCrVC*o?Db8b#x3+tZT+v@ z_HyZOruJf{7y9@%~G!MQpakZp<><4Q;?rxpW3|RQD~Chnws!7gp5!yX zoKUmSxHGC{%rTgP1x=gt+~D|`CLPu6(?-c()iFNbBotLM*P_x29OQV|6@78F!)TR3 z&-Lh3oHE#^kJ};d!`wrohJXINN@WqBzcWo}yvSXl0-eXaa&79dyn+rc0Ac&#Knam3 zkVQ?S4In#QLJE=oc~G_+%mopbFK3I}gaM|ojnbKkwvR+V*RD|F+x8Pjmo0LiYG7(8NzqiHrqn59>KOk_i`EFx2V5s`_0 zvmd7H&s;A$NM*v=P)IO?zQ5)MGe>-ioQUV?antsthUK12;2E`4Y9VjKNA|hXEGjIf zT24`>I*JaA=?Pg*%24lzsY3SL74Yx29fGWx+LS@>SnnQ;eR?9~I?trc40kpNL9OXb{s02Z8II>62rro7#mPsiH)!DaMJn_+H{U2^B#5=djXWJ^~)Z~+J z+dSqvvj_ZDL)!cfx614rdi+1FYbtV2;0c&0lA z1^)gnb7?33&o>tJx1W=LnY{af%Pe^EQh|H0_Ng9-gP?M?hzU_e10lI|bF_1JD(oSs zHyhcRr%sLQJJEItunQfCh{^op`N|Llm& z-g~7e+NhVoGp~+^SYDT`qMMi_ z`Vm!1=mh3+&n+S`75g&WPKybrgojPCY+js~%AJ@8+Awzm4#f2i+P#?Zrx!+lzSjph zCrTr~Bt7MjD}g(^$!?xfHSMWNVpR?F#({NM>;UzzQ50BTcJTiuX#?kXH4$Vp+l49v z=3}g*?DFQtkXSW?G72m!*a;mJj^aTFjX+f)&`vNj4jkeh8(M_>z(PT;5-W-;j> zcqCyIEhRmdrpJTKnX~1n=ge)uwXSyaK;F*$)a$HI3bj9<5xQp;Kdjl_d`)axiE7kv zV{c&jE_aIaP1`)*6hSjzfO7_0eY|B4q!Qhoc&xemp(peA@z;B@M?dyf!5Hjshm1s> zkT2U9FWy}ihu5%0o3a;qMU%_Dl<5Dp2(oXO|pv|Ei_gRV%0>WCB3@7eM zB$HocVzQd4U7WY1>BNp1XozODLQOC>5e2B9?`4XH#JH81)dh#U-Os9gzg14_1E;{5 zsS`>Zg`h|0frSxw$jU5NPO%yC*zjmlnVbT;8eo~UB1n+^O~qsUkX(C2jcv`6lCPWd zhN;tW5r~IXse~(cX`?qRs_U8iQ?h#Ra7^~nT8m9FJpuPZE@2S)Sa<8{-CbmsDL&D7 z`*s1ZY8N|W@FwQf3B)MWi&M(USiK!Mu96wdWgw2;*N`P-&zyB|Njd&ANr5r7pIE!& zwph_mF*xz6iE5fzmf3Uu8=jT`0aS@>(4!Ft0kIfPby&kP8wbhg*Jd!fMxCPAg~^J) znk?Yqln5aET<2eLxf`2??^GFta+vBtH;JB2@WW@uaS~WLjHbUWAe;{AAp5k+$1rI-LuyG}=l*eQCE=kAek<$kgVIQG>JdHVSY=YpnZa+9l`mH#|iFIkr`9tuJXX??tvbI>rY2FYvi(P77Na}h@7 zCjT3K=j!fFMS+$#;YqLjwbn%OYAO{MqL^3pyM1gFE3kSi!|TvwtQ-&WrxtK-@}7Rg z&TEauuBcHUnf;W^WhMmi2lp{e%x+_f+PO(94-OJR`gHvA2`$rG4@658$0Ad)2H*%= zf3$=@Z@o>5>VOoo`|7M0$*|6Y2&z8`jR87C`(3h@-mAUxi4yNtg9!5>;w1(sJx`JEmSc*ik(&7^I^k(>>0Hkb?%xuMW*Y{1*pRaQtdBDj| zOw~dzcc ze+8^4c4-%=D@zNL;E$W^Gj@qU#A7xviye5umjPo)wsN<`@N;z*z z%tK=2YPV9jG<^H{#dG&vPGTjV*`_*|@)izn$BJgtRK7EUZ`vo}dQfT!B%%TZ*A0`7#VbH373A z7n(f=k9HPNnC@G@I{^5VDv2KD+Q6@tQ`BDgV-5nhN>&;g0H%XA(E`u(&J?2&@!Eup z6HP*_YM{eAGSwprdFvjAOhBK3EwlsY&afcMwmJKD(6lU>YRxYAVb-=E24%w;mfsddW_U6qOIGjPXE?R;xU1gl*$&$hm$IAr z{am_AGD~X|J`@-imH z@x+6ZowX1NhbRPToC7|x+$pe5N*LwS+$~a3Yce~U`rG)R6^|Dda-rn6h$D_`iN~NC zIIzE$AzBq&GM?T@57Rq;`v<1QAcvLr)a~hCeqgi3t$>nHwBY zOm)S5AY`eg$H4k{X~fa?MOLz;eyEC#IPX}v{m5Ts7Q0F4&R8Mkv zFqL(BjqRt{=h;ik-*bEtCbROhWRnaD1|GD|RhTYX;BOyV=f#4rfwExv)@PFH*JBE) zJM9I4@a~UHAvZJ@mGGc(YqDXV^4Qf`mjaWl3IoO<_L zyEOEz2>J|-qIg^esy{wliU%mn^P8VO32=92A%H-d0dyh>{&l|p@Jut^V~h#6QKAP4 z^q}$>Kv|uAs7bTjD&aw^xQUObi>QQ(6cW5Z*l~btYr|5GC)pZSlT7QznOt0X?QLZ5 znqwgvOlkn)PLR+7XzBB6LE^GRzF9Q#-CyNyO(R15Y)*djb;zjeFWAcJ z@0;J&2Cd_gev8O_?47Afyty|#R}k@sBA2_D+kZI)UjABL8i|ugrb^iX>Kr-J37-XW ziBE(6{P<)0`9tez=S$~g<)G{zllH`$D@`)}G?QDhs-grybhOiK1=gnf{`;BYNdZXR z)f74d$PDhB7;Ad=Hp(ht5*V2aiuZxxF-@vmLZ1%h0<$2@HOm~AzCn7{1e!MG0B{yu z-pg=X{05%a=WeGGE0}&(6OFBm=Rr#>H$mTLSqM=3l$4$s9hN2{HRrb!(C;qgFI^pb z73G`-aCQwGyGl+bv-Hz$^9P6KIL+Lav)rTwDy_7gXZg_KSKFZWfj@W$tOqgEiLwoHPQU;21p6Ae@?D`+)U`_vq}=>sU4)wj>st$6uPd=@gS{@@oAtl#UluaZbJox29 zfvNNXkrL&Hi6|gWZ&e(Z|{w+x&q3dhTSb25NKTy6*+bFu^2a)uvXUK1)PaX3DoS@Ia?<+ zh(%}*p5yFyq=NEot*@Kcr<;G$4dlxTKqeKFTy92)+iU1T*BR?ZfkTom zFLMu{{_2h1MEK#TY;s`~q&H=i?|w;U(~?&U2V8Dw>k&vXzMfiWNEq2hV>byCU$rZY zVmKS@?~lA~4G<;)9X?eJnTTTqjunq9xi=Lj6Y|c%^qzmDE%t#032E+Ni14+VBRz`m zYf1YmU&e}3fjd`<6G*Ny{dyDzFXXh^CI0G~uhEirz9x;l)p1b;a`esx0THI7KfyK8 zZUeYPFNxypST3hmB|-KJv_OstGh_}$ekf==9t#%D;Fgjt78yVKU83?J7Ow8N4gNkwEYk3*2FcVMMiSZ$f z|Cuag%Ce(dItV~n1v9TPBWqrWA~%kS6Ny{o%s^J;bJn<0bi&sc5=fLxbbH$D9Vo$w zRkYgndR9tNBbQv=uI>|eBdhBkFMmq9+jS|jAU_fRbWO=N=a~NQ_Cq*YB)ap0O?4J7 z><|_8H;O_x0pKf-JHg2lITXbp?t0N4a7vbd3KT>ABje0c&i$>C{l=sz?J{^_t&9?* zd?2Q6)eE%a!A3TT-e+!{>VFGFXoKm;gzg#bquiISCO?fL`=pbcUS-8Ae{_kiKDRUW zk-mLDdpDUbCU*61f7&b`f2p)JWfG;D5fa3@8juy~$TIM>5m}ckB_mWh-1)X@WhQ>i zD^DqHq|Vh_MDB?}tJJEYv1g?pcAw_79t88DzZ~JL0-a%=sCuQx&25*Ax=|U_fy=zX zo=);IHPy+0vxD-vhF~M9?e*+81Qn-iU>&;P7Wi#WdktoIqsUtx$cgZO#k~=@C9ZzoP9-_Q7ymmGXL?^=ST9T|;y}<^(gwlL7*bEK zPNpq{X^v85B7zp+%W}zNUoetJK;M~w*#`o9Fl3jTNZ=eXX`Mi__WZ46Oy&SHJKc+? z{qb$PIw9z5dB!LNX}us_wzYxv+bEoH$BGxef_L~c zAhuI+QkA0+iPh0$gn)w@3u}1KxoY1Oj+IyC>J+a_p>kJFZqk^*9`3t!zm!*ejiY~? zLs<1NbdL-9l70KpV$e%IkUk;1e?S6kvVZd;O$?Uj2XIy}hyjJ<~MFi6{3y$WKri>ZpRPmqhz#%O>KZ)U*L3DQtf zoj6Aq@l%v`-cMSZ6f&>j(^GBe*_^QN$&ksv?kXjG_`^UtfTK66hD&a$+&o`L9r z*`v6i5NYE$zD!=}ftgxs;i@6C3d5+8waSSVU%efwuKfloVWUEB2+DDD;@$zbL7x~h z!stK#i6s2A|kLstryB7*)$Hi}E z`uF>?HQoUtdBT4^X2bC+Ni#5~Z7Cki@d%{k)6J$lsoj1oI68FT!O-)A*`DzMep^qYnfc!!UmsYYjuU44JwhyL?@L%8+@Em-a1b(RhLb#-xYDniPjKN3UZT2j14+@jAQqoliKh#7CH9>ORts?3k=KZ+)iCEs_#laCrtRh z`yuDn@9(On(&v*d8>&Pd`|>KUR^p=X7XC)%-8;;EX3^Vd`1M7Z{%ThH(+{6Buds^F z|5b>wr(&>IbSvpg*xeG+>R?s)ndlcB$Ze1KN&uM0X7+z_s96~c9c8}BvmJvI%Pk9b@MaQ~b-eQdscHas2&huNt4>*iLH3@t-TWYap!0^S z9BayUfN6df-rqY`;hDyB~Z7M^sn?%_D4d+NzE2UB| zJ->TS`PyV*F*U?PjE9@j2p#Kh6#qIf<#4DLOedCK$y2=o#jnj1#=KBEp6TSWVuZ8K znZ`(@oz|#gkhh!o#RmxsC>ws^ovymI+ZP2R#LrEI^;+9g^ct%2(UJYl9z71%u03XI zzw__*dZol5bxTOj{2i4t;A(f_sZThr=7Qth9}{sJLy^1ds37?vQ;L%kL%}SljgXaU+;g82f=Cc2@6DU zkFgal$q6mhFUdoeNJ51mDW&8YfBsZ$KW0UbJ8!X#RR<5yPT@|g31yM)0I(xVw5R3d zz)Sak@{lYbBJw_Yudn{*mJ1ZJ9(+tlQSYY_s{*+dqM+y6|6ie8sDKCA^hmi}u--+_l#$i1}+d-TvMbY@{^qE)uHFSo>Ad3>za8S6XX2i5oD!;Y$&zpJ}^d}(}`GiLE`%lHVhOCcn2*JligpjDvi&3uEZ zlJvgOB;Y|22hmDN=plRbx@Akp#HeC1`qAA&$$O91V<*-tv5QwF?vXaLMp8TW{n_K! z3zy20o5Or>@LFY&YAulY=PPX^WQv0&0#)*{ekioS=voSqC_$T_S2g(ZwsjO>r)*d5 z5RUas1Sr$_yl%gsUZ2&yiP8$5`WyP1U-n&xcXDC38exw$*0=nwF?eY0X!k%y zeXrjmGfjqiI`fPcB%*~aGv4zbu3a~-Od7xbcA>uNLy2D7O~pb`?T99v8P3o$F}7@9 zM1ZLPfg|wBH@0LiW+g+%n^rvW!&wnOenQ=3Z0%m#xoSd1Ums{_y+kWSwhMfTL7|&157VIu8bB|Cb+$jC&08=aJ}$F05WeLghZ_zPGhK2 z=68UEi3-6|hNpvQt$gko1&PU0S0W&2lCs1UGBaW$T<0dL$vu9l=eb1r5`P&*F(1CH z__ZDvkdFN+IZG;SMjz-vVqW=C$bGyGqFwbP$3(Z8y*5R6*t>BL9#@(%VJ&3sOld&5 z!Q&KMfVtoTO}ix?5=hYr+tyW_HW!~g2PYgY>r!anFwNiDvd#l>6!IMx&3=4l^8R;F zGLD%sQvfi6!ic)66eTpmDbj>+z zB4SL51K;QwZQB?9?0?2ma9vL)CQDR9n&Dqh8Z!%OJuNf#3it-A=*LB$wSPX`i@u~( zn`aUn^?r`X1SfUh(Y^kxYKdRPF^nH3QK;8v_ew?fZ7`#4VtGecB}6{$tkSa9cRX`l zDTdA?jg0&XUp^3R{-?!x{nJx*#yw0SQx7*}eVeTqUc74zY6I=mOl3G_wLVyxxZ9ST z2nhlwN4+s?{p;N;lK`rFUcYb3+y!p1t!&xDco0;;OCg8}tNHiDfu-D6rn2>pGQo%= zZK7W>UbcZX>Uj&pgn)PTTG%f!G%W-E4GGBbNagYqUP#$8DWk5mk_|l1KVXuz0}Y;? z>-S++QnH1JhX)0$5cMF?3>+02KMSR!b(VeUL{Dxot1?5sx*bPEFw9INpk4-!jkMv5 zp%yYL(~YZ{A28b?GNNjHg2L^(wycjD5+zhH^5sB>jj2GfWKvfH+oo?P!-*3ZB{3uR zt-@!O&;sIUoqjl)L^`#Dp7mu@w3sxgpPhBWmzL^t{XgDAh=&s%&Z~*2N$4h{N7?y8 zu>|pG{(4HFRjdMp?jT_$n}zKA2CD1#N5y?AVPkux@ss+D5KDe`S50L`?kMJwBK{1A zBC0ReVV3Tt_5rK68gj;Ln#WDov-D#8R&TlJBXNS;^hP=qCpsDJ37LxrOnu_$#3=7( z!+Lv)+Pj)mw`H7sN=cX@N?1^bpcub^JdaIQT9HjAmU6cX%Up-rV}y9XZ!SE@=C?fP zNRp4d%KR~o$c*d$sQ8o#*Qk2qM5a&5Y7)BgWFqcgWiw;dH$Dl*hUxYxOzSW{StC;r z!7aWIKmaKerSQwqs@NdVQw=vz`}@vHC08h9RffyORWrhHQLDXpNh80cAyCXq430ba zzc@$l%ZzwgDm(@wOE6-K=#fmO*D*d`m{=A!Co^sy@NsBBtR+Fe$@G7?cjT?;B~R{_(^ezWUv_(d*x@r<;S8 zkIRrm*U(xzl~#2{CrtyHsulb8e*NAxzw@|a>#OEu+(n>MdO}Xz>CDLD;}YIeF88JP zO~A>5(zxwnSCUMNFe93q5=?-feW$U;s$W`IR-Aj&UvasKY|Pv+{3);ONnDhs{Yxd| z_yy(aBazBC+(TnZjv5?nt7VEaSGgC%B4y^uW>q9Kt?C88F+g6)oUWxlS4B#NM@B&$ z@2q!oL#U~(k9(*V?S?P>6fzNRia9L$)(9z>mq1I{8$-pL~vmTt@fad2)PUtcmTKGg_fme6+?|wenOVd z8I==Ls2IV=T4PMkQO)q@lO&1|jCDNLd7rz)G}~{?l3vANA!wc8sbF3^Pe21>)NZ4S z*yO*QCxB~_<$~)72*1AuNB!$1>h;y}FLhV9Wg(m!XLBUwFB|bg5NUQ%XdO~AxjJha zsFDI-rlFQzSgT|u@F9sHRRH;>Z$5|JUr@uwB4aMEEG5n|`7wko9s?I-hRLehKvNh< zz^Xj9Mg+pPm$0VrT`0Aat&YDt_csCzaU8r7ic!_qKTZ$FE+tsuJfoWbOAGuU@Z`3= ztUB!33-5U(2pLu~pE6E^`wCR@?p~;Q-mhm&v||9vNeMeMwwK=j%oEouIbF-kvbeS+ zz^rKc&ar;~Ineo91LBCvMQ57%SY}w^axKE?s_o3U=dSJyRJ?B=?<0R>i?CG5U!dPG zyppH-Bre2_+w(rkK;sj&J45-2iM@X}INqUSJ~qCtus8amGuQSPX?mKo#1cN!TVJ;- z^7c9wB$kY2153jIN?Z`SfNYktz-BFr72riLvpeN~bmPV7p=jvzHPGV`v`$F~C)n}e zReYJmt`@&0m{0s0d|}DX&UJ3>%euU3DZSkF{Ifj?vjcth(9D%eVluXo+6Qjl(Rilb z#s^Y`6ss6eqfkwt;!D6n4u*qfREU%v3;0rkeTMrjQp1y6Pa3iO$?YAF2)PxhvCKer zYVRa7SvpxENGt63rB5xnQA9($9!MDSBb)U8nQ@NdZ1;Cr(7%~*zpY?uoY^S2@ z*M5^+a`DWB@^SUh75FBHR=4r#6xw}W4TzvL(5f1!GG7Lvo5$3@rz1PBV+2H%7$Hup z=Pmb4fzlmBDJ_p_TcoI9x9I1V*%2whQn)HWXp~$DbPNN)X-q0~p_%1Mpk4ij$piRY zC5N45i&7F0$!P~rU2XkXWXVNxU~1nsWGFy6<7alPSL01-ww>|A_g1DM>M+;%q8*({Xy3U~(HW!>qsp+L zJi6RYrm6F4Ri(O3;x4h{l4?GgD0{YPzKts=jGHb_E{G2QwA7o7k~(l(q%w^^?TCk?7Pxa7u~DG_}ypReu@`~u*d znYw@QYhAYy%F^gR&rJX#j0%myE2PQ1X$1x{Uv6V5mdpLiXZScZ{UKO(zx6LXM5D|I zV-jJG)gf=$m&qCpp3AepwsmSDoAyT}2v}ce9$oSbyMv1VL?BtD0dV&}yRt9BUDGW_0{f%2}NA!{0h7{%Eyd9G*T@8qp{-4TYri!${Ub(;SWo=5;dKmRqWiwX^4Gy4{8HBv6$nu!#A;Qdha&v7)pB zw<%A~WCLU8o&R%-LAMkIR02&7^%&IGfsvt+h+lv(1_U`GWo{UR`T%fpx{!#aw+T1* zCMJ+;YiqI>E}XWswB)oaE-ps7BAldSvmi5Ql%&FA28qJ4*y)ETDoA0Fq)m|4HQI_r(8whk6y3KtGO!yP))nW=quQ}%Q)A#`XpbxWX zbAO2R9J-XV&Z~01W$%5KquG&|;PX?lj_eT44cQU?=+&C@ALCk7+>)@*kD~5TwWP} z2R`6k;tsD&zrHi|t_zc07zB4c>R`$?jZ3YHPYvCQ8LK%+Wn#GV0ZP-*zW(?;{hSvH zVbaQJZTi8RGa75FA@K^Goyq_wjNG&l9Cu&f&fwPJw_mZ@$^UrjT#l~9SiBPrr4PXX z($Wr-jC4+5)0vk_#T4<%G4q*KdxCa`zv#eZRp_f>)aa?-^^&D4`+&1wVr*vH7L3b> zw6AnBHcbWK$7-%1x`i0O9-#gb0DO|ca6P)fS~7_z9pBB&PEK=L0Z+-%&UVsBvHgq$ zyi)Rvq&X_=((J4OHmNw%)Ngz@ zVc%55s5@x`GI>}2*&orc=C zL~(-Nl>sVahtrgmw^Dy9c3ZDvWGUiZ@u=7VHOeVuK*1g_~L?fS0^qi;v`S^4u z*{(4vj^E2=jA_zGpox4>6Dl+8(_rx+3aG{$?I@iBHE2H)h442T5hRF*(Gap7A5XXw zFJcVl3GZEs7OxVpRyvpsXU5U{>1P{vg-xwx~&B3wg21!6>0+1 z2CT{*a2qD#yw%(){GlIefL4|++TEifwbtd0FtYNzTBY|DExR417N^3o+IwS`TCE!< zbA8Hvf%ZF>>>#QJfhdM+a8S<({^g@KX_qIH1Mw7w^ZGI)pV0$VDwil{D5TlhS)p=9 z>!hlRX?S?}0epH9O6{v3nT+2!wJ0$eueHM@HyMwj=-rNDx`cNhrnRjS%Hjd7t@hrr zQ}Br~qhxV$0J)Z6WAJuZW~i~{R!g;ygw>|53kJrcfX{F~D?bpJmMCl$f6=EcOyhIP zj&>0f5gQKD1@)DsEq&%b$+$bH>s;WS@JSAtwN$VtcO>@ZVtO@i-PVhujyOvZBTerw z0h)4pIm*kA;@SwJ1tqh7Nj?%rMjKV<`sdz17P`g4(OwvI$kXJwJ-JfZe{oC3A*=be zA5bI}xH6y57ra_tcjuG&5?FKE0B+3@zjbyV86B)13}eu)#+n0E&Ul3bO0(QDJ=8Fuwd6{q;Eswp+G9@cWqe6j1wv)ng*s$Sqy+Rg&BtAfP(CIU0EPnGzJAA5%HlW@c z)>uAtf@m8E7)!H?01GJA?nM-GEuQN-5b-IW*0ama5XdgKUVlnwsC=jU&t+*afPQ@P z!{OdZ8|V%{vLXf&<44h_C{89yZ#~Lg5EXC!udOx#6_J0nJ) zmt@OSx2%Y|WyopQrvP*?++M=Xv^6lFvF|5${kC(PtNhRVWqQz}N{BY#Ahab~OO)Th zM;p-pYsH<)31o6cAUJ2|=8B4o{klK;?h<3aE;SJk)`~4>WB&LZmw9p^tw!0OT*7s* zdV8$@CRoZ&PM^!``We7DF=y<*Rxx~7&Nv_!FCpk`KcKm1U^Ob0jC#ZT2Dm#4VvM@0 zv{k}uK9%;C^>3HI8s#1|4Gt}P5Jb8}TLpN%Z;xoJPZ_4yu?Dm}`o>)%dVhFd9+7dS zg8^qEe$u0V)&>dU?V^G#+mLs4QWl@NW&&b(yERbOqv@*A4yxCm>9I<`uCM*g`}%xu zwzguYfP#FmwvNAOFk4UY4R6rY)(0`ED+S5?=VmUniQM8KpHE)jS|5FvuWxU4smIt4a3{liB2Gf`J_OySRTwTe-ge)06mQW6*R#8S{SF^j%K>Q_<9bV_8qkZSM2j zlrNyH4)=NzqL@*3IJ%><>&T?5>u)82{pDVi3TG^?XvZgT=oPwidk6QG-b?>KMf8Cn)Kd)^2;9KPVtlzSX zww=!_;&1hzFWqoiGD@j>#hbq!0DuT!1NWn@a?NfU*eF%8tq(icu)hc zmk}d6qZ)$^=#U^bB=|of2BMz(yq5RT%P&nRbJ#?c-BLxB@N(QWhP-i(KlP!udX=M= zUooTBkiCR&AnpN?<;}MW;6q2`($4)w2=RpIs7ya2GeqpsTj#fW!Ct>XJX}+Hj7YPW zyf7t5S>=0)Alw~f^pKbKQOdTXBt=<9)p3N5Uy8sbngD=o37Tr*!Gc3yKr6Rjn$(3G z@fs;Rx+=X5^Vpb71RLxT(xa|zc?0b}mB0HTP&L^JZh{w>VlzYiE|0Mqoh;sdP<&b~ z3Rq-75^--tT(8KiTdv4CC1UKi(&i@=n$z;3DaHC68wabbQoPsLr zQ4-a#&S=3ZM~~r{h}){AjIx*G7(7B|zE^oN9-s<9M9vS1dSGN6GgmzVf{ec#RJ6*SHiwLtk_gE@^P_3iM_b87}eSx9_0$z6@d6(H?mrz26BmKWWglm7tDmQ)TJr348x zx67{zZCFWBfX9g3Mb8woor705FN!2IO~D=?UD@iC zKbj%!OfXqgcJ1?l7e>IJeL}oWSq;&A;%IhnV6VNd$3fWy!GFaUe?9g8_&)Q}y-@S> z!#4q=hpac$E56Li!6vox!^u4v<@y31pqf6 zXq?moaEk%*1UE+2wyOP91PiO;39z0&q%p&jB}BsOZC#(d3DD?PRTX8*dLO7B7%Rw5 zsv6?t^~1o4-z3fpHKtPAa+M0#WNo$hMup7;|l>o#FrhZkwrpEHB~BrBp{j ze#CxOY_ik2l;#kK61pZzXA!&S4`KyN+i8@?7|_u{W-9H4Qv%$-nzo)ZDn+x}S;0XH z$JrqA_u1ceUyByXT6A1RQy$t94EX6U<@(Dcjm=M*Tl7>IG~zD7nS>%`oAzR1T6BM7%iocO9M{$V7Km+zkt!QUVq9sD;$ zUEP3j=C+i-sIw2D&Jz{j?`-q%Mm;IzGYb6MJsdtMvEJryZXsq3U28ycOA1W8cqg$ zL~XdPxJ8K{Tv@$0Xxb;gtK$EQhVFGXyzxxfd+pMRVg4TrV}!QhBi>elV{fk!vqvgM zmd7yyIS2V(Uc1^8(}vlGW!4adiYkO$Blf!&VDtX~BthH0ot%0Q6BGAfT-;8KiL8Px zgWO2Ep5Y8w!vc#il<*nKfH#a9&VV?Q0nnDf8OIkg zhfBy6i^5q^&KbkF5x?58C`^lD&us4mFgrx7)n#00+YZ^ zTob1?I41dBg2`M4s02=&S8LA8MGLvlM4+^kraXZZhu(aYP1q{B-H=NE>EF!Z$~$Bi&3VaZS=37b5PVR6$8K=gInv4iGxT8l-irR^7)1 zOoUJuaZCaa)S6JSfRpZ+EWo6@BLyWork3KK zRL2PEy(gU_jE8O$c)rQo$5VM8rEA^CrH7r~L}xgmE`*K-CvGz(!wN(eK;nKGUCtZb zk23Y%lY3IqYfk_rE=m9u+W@BS5!vVwuBjK*JDh+bq?CK21`tw)d(xWraVFPf+-owL^Q7yz+-H(! znv8Da#w&`94iLtJwvFEa(Oj4DCSaQB9D?n;Z(~uBG~t~^-mweni-`B`KEbV9AL7>S zk8p>>j~_q9qsO1&m+!wsdTIphf@?4><}hYQAH0I)eTyoX~0F0(73dgn*00tfW1d8dHVI(Uq7;Cp0mV0AfBVvJz7W zndzK1JD~>ilIpN1WhYkV9)PXAH>Ud~VZ37qCV9tUW$|$=%HD^0>ANvIc_*gF^O(d{ z6I@kl-AXb{O^>U>jD%{Fro~rb3d?MHVGsAs#30tJdoYl8aAOUXuH|h);kB)a`0M5b z{8c(=P^uRnA)~nQfydRMQ{bmN+JX z(l-7km-*Y41Wj8lCF@a5ddf9v-Nxmarj~R*^6|h1aa?sD&(XS%yJg^A!c5fKm4QYn zo#RrjPvdsH=RpamxolgyO}W3M?lTce9VDmYRA3Sac`_(_GT1dIFL4^uby-}K+>F;? zB+YjnrE`KbV zEZ%aC!COvIR3zSZj^s8+bH8KJ+9RI7lf>hciVg&ndK*Lt9ghG<_0$u9QUWEBlpEvH z)m-)5<1zthN*(2Wd`hWGsyvViO4mR|Ky@X^x)C%AQp~#(K;6Q!&^;s*-9j?ZgX$TY ziQX*hLrC@I^nTO;0!)LGao?#aoRoVK0O`(2z%-h`GT_wElt*zn({oBDIMF?s!AXE* z6U#V64KV{#Y;3Frn4~#RIzbrsndCisjXOa6!C<4+=s;k%F@)`EUUwklzObl*o$QZ z(W;C+*pPb=>$CP?ThU=Sm7l=0?fzIAl8)K#5ttv41n1iG*j9d$U_6Kog-5U|b1znM zxz$uZ##NpQosn-dMH|SWTx8NHB2adl^aA?zY*~|RRsbQWsxZIlr z)LV2=Z@XwOW__EGc~hLwcCK@)%%?ABAKO%0;_&9S1TLSVmTy6rw4&Q-O^F*4*Q4I* zAkQ&zpIW;xusE~kD{^8$dXYF?)RyzNb*0>SJP4ll0&PD!2s)*Xgi=Qtrps(E(>yqj zI|H;^nweyrHG59$Ksa@x)9Fk&2`swM6{(yqste1yia5P1kAD}=+r=vrT|F}_)a3>0 z>Xm_R-kIo5*z_QrdeR~Flu8C2RCj?D!PS|7=*;<=l}saiy3*}*4P+n-A>0H~9PUhL zbtHH?5=0$58C0qEo+)VOk;46=WSns7KxlPPkRuQTVgfG@27UtRJvyWJ2%y%4Piw-b zl_7^%v~-9;%N?RJ}z%j3AT9&z$6GY#$$chy z;I_FA5Jt~D`O2;I%#$wT#8GFZ>C@-< z{43xWRl>6GzCdbnI3`Ez#GJ%qSekMQ17_P}9s`9_=~cLvoJT%1 zz1;^%XC7i>R3>I^@xTHnKMb5O6aB_ahHvp+_!jI&P}uEjo^kxreDk7`b9Qmc^FAKL02-=O4iWo;YJyJ7K`IB}(>mUh_QTFl^phj9Ow3 z`{YWDT(k~0b5_7^nLYfgPGXT;DEA=?%Y34-J}Mg<;tDWng9`>tUxe8%p#+y7`i!52 zg}!m{tU804PC*zrbsOMV$WkNY+I-wW2d?O*pltQxdhJ zBWp?Ewb;USZf1ZYgj(7&SZ&hOLL}n^Rx3KE)^t}2Gz42aLP#VXIy!PcIuceL2)hol zKLl8NLa!t94wU50sgohXNr}+wOh?s)>+4E5b)!q_&U39h^KJxFSAwZ4q11&S>Ovry zt1HX85>DL-ryhh(54xdVbVa=gB$ZRWS=NV+sxQ~w--|)PLRp&l8v_X0hFq7-Ll-rW z%MPZ?8tl(N!gY!UalQQst3CuzFT$fI9ZpZe!X!^AqX?&-1Y0l8+ndYxCeTE^2+E#> zO?NKajq`W&NLA`e2c$$Wb>%v{$#nikcLGoVDWL4a`8v508iZ0urvx7NIHh)kQ9FXD z-3|t6(e@anHrt}9NW8Z#N~z6ujuTRnYh{sYdYkQ$TsE5PibW?ntuAy@-RP`(5Rg3y zPYV%Ny$H;nR4+f-w;c4OdJt6I1Y{mb=;)e&4unewXKojvCu&Q`v~}P%5R^&;VjCxJ zD`D7m8A-z=iWX4CVC@!t+%WY?73{yDbdwZ4X!LZRZrtV-kzbbY@*V zx$SgpJ?P$g5SBdxb;)o*7R%+B@*MI`=5bEs@#g#<2`^B*Qdf~@0=j!Ap@(k@*OAV3 z@fZYBk`r(}3B{h?iAp_uC|}M?Q1v39dJ|B62r_|F|HvE#C(&TKn;`-x9Z(ieNBv7KvVPwE*xEYv4L!ukN6dfI{n)8y9l2q4m>76I{nT!q)#`8?_?!12* zOy&>Q8erO5e+vr=7)W!^Am`Wxe9IZnU;P+QKmP&0{_-m0Dm zBLdUbI`Fr)BB1gVM$KJ`)!{jqV($gpHLh5eRF7$)r5Nj1fMFiA_09~YJ9uGiV*s)c zgVT0hGEUdig}KNy&sI%c=&G7i=dF@+`VQ9Y92wjQm98!fY9jt_SC*-1=F4qOqF5tj zF6u&fb>VNzyxqB6ch@ZRB#?S>+k4Y7_3@xM-p4HqeK@VJYbN?~KFRxu2(5mc){oPa zWSHvj#*32bCpnkz&-IB0c;#WBPd)>FAqEE&69PpTLiaRS%Dj02)1eLY;>GN#i^GGc z!6E`|C|#Dij~G;pVZo&s7F43{B@SoVNXnM$v-2;;#DEe^X8DxBQY9Il%(6)VrA;(h zO)tZgAS$>FQ$xy?rf~fe0*hfsK#e3|YzVDk1kW&^Yz#G*D$m6*f7XUMuT4-9hO=@q zoQ`f7$A_|f2&WGw{04hxnKVem@R+Bdk8?75 zQ$3v$(TnQosHuk|gQ!CSdN{=MT#HBd9dQjJ$VA4;`+@r3Py zRoKh}AW-tiuSfpPXISYQjg16R-us_pxmP&Cs*lqpWnc%Lh=1;GtZ|RRqAkAI%vwxL zBsJ3@^X9l=Ilmf^=ZttcjLMO(U-8A zNx+Sou^1Zy60yQP3{KqEm>N-wnbf?8*w4Y`Bv4&bL!_=DC z16UJxfYT0Yisvx3hSOHX?7`CLU0A^1n#KQfT37|9gqCAcXc;DklCM_Q zWkXmid1PZa-KU{pbhyJMuh3giF5`Nl|Pz?bK&R2sMq1NgiBxZXZ=$bFpX9vm5@MNXnr z^kR8Wsu#DTHznmg9SF4TbShh8(QS)}(AgY~?pvs>(dc1P40;i+eF)%wT&}-sDh3hU zLkaca1o{Y8SVpq4GAdX)Je8_WPa`;P!)>&oGq<5Lx8Zy?tlW&CB)4G&V1!7PSCU~v z94CxN(EW~-iU}(lBc(^Ldsa7x*QkgCgw*m(`B zSxZ^v8HeP9_pr_{iGcIRa=NCq-m%C$`T%q2p4NIqA^Ye(tZ)v(dhcj#p(Ao9SnLA@ zOl8>Qp9sh3d}JPbfQgIN!!K_iqHE7$+R821#uH1R6uVeS_h5R|9?Xc|ioA)jp3D82AIJTS--`uG`;_K!cn-^FbKhr1@8ou}Qo+iE zEh`*0tbh&krt|eGzyOaty09EVijG;t;l74k8;1M2(9Jm0eLE6l4s%nNh#4y|VaZlZTkD2^;^T0j z3$mHE1a6soVINt95wlid%z}+{N7V@6e)-aA1yo(d)ODV)nYj|S^EY5!P!_humcu?Q z4>5$?RxY>BFBKbuGO?Lu3Hxp%sN@8Hhugk%GiI-MBUrA{%@q)uyWkL84A0DZZci~> zQ)-b&xGkph@h>`xh}w%-;v9i6Q3Q$U>iaBhwU+GYUpmIDY_jSAVtT5!F#oLa|j){ghk z1?-^<*vlZqeTWq8V*uT6(hM`rVg<*fXwd;pQ9KT@2Q|eVB3KR+Dn~Fo@hIjd9aEae z;dzNiFgNiq1G?xS=Ef5|@sd+4o5yA5B^|~5xlorQDm zMR*rpMPSKwgp}SyXz4AbkkZ=-F1@1^s4J-SZX>b0AUspx97$Lypc7c(1VOj}tB&VPtqz5zFRtpXbK&KPONp)1i*#HjE6c#4z774E8R?0J`pebnt!M3($v-U-G{09QP=q z3h69lynw*UM}NBZe$H9w@05vw)NsPej$oTi=u9O%r~4LS8l`fdB1|O!ComsNjiN&z z#r+r?LTH4uBE@YP7rh&H)L0Rn^H}cJ7#=gbuv%UtHLNt%Vm6^QpYzU-+KC0a=10|G zF3V?eJyQs@3Dh`QE`rwvD-3pA*Em)l#xWls$!kvBIw3fbfEq`KJBki#urw2T&@r*1 z+|4%;-RYX7*IqAHxO+!r5l{qi+bb_)Yw20+sJaNpx+~QC*j{@DTL`UfHCn#0 z^fb1VpM!nTNo>tKjvd)Y8LW@NIsF863Le=P2&$uS%Q()!f1WxE--6Q!uDSyM(sOi0 zm*G>&+HEn*tKNru@j18@oPh_S=301O7i+y7cj0m_bcSxseM&FDm-6Ove#`^PE+Mc& zlYiNHwf>NrtMDs6gRt875mJ4XVwtG+8iH#m?oTj>1Eg%{4FqxiKq{2OA)FSz`xf0A z*G-qE=9hW7ULV5Jm$39K=QfsJ#P))7*udkxnzihu44@0*7=Rg=XA=H1sOh?zF7N4J8hoV3Ozc1Uwb%~}CF5;}GQ!}CuF>vaNImBSvpxG=lq~N53YPL+1;}L%Za}X(V+nG)$yw2Kkx_dID1p>&&2=gVsyWmt;>JViVtK6^nk1lNpq>~+ zND&r|rGUj?F7TR2h)pKcrg0q_n8Y0sxU5vk{w(AEEGLYYXPm$?YAGeaUC8MI*O_#P zQzZC@)nNo(_7J-Ff!<~4?^TLEp2g@*5cMLEdb<~?;ocs_=tZevmiKWZpj`5(91L{H zhK*Y;#?x`lqhnc4m$HId8D53ubS*NxiY{_FH7}$BQ|OY$_?KfO_s5p|tXvYe#g2}9 zEa5(e`!a@3dki6BOQ_pXlL(qw1ky4(!gUGzurcWX?2`{*6SY2ZA6CZg#sWIVX-{U{t8Yx3QmI?!O6Jqq(O>6GE;+F(j1fKnzB_dyrBwCbWDWO;OI;XFiFom zdC*o~Ph`9S;$>ixw?Dk>wM4HBrU{$(~e*o-O@BdYAW+79G}GUNht?0 zjwjUE*!>vAz+>ZIk0G9Q80uEbno2cBx>Ui|jWqy|N=)*p#&p)A=kX7gw?8b;Ifa!3 z!OEgD)LATJzJ%jT@=swAwJ?VlT>4=K7uL9F_m}dITge*sTGpi3Ge~WTKMH4Fpx#+0 z;ZN8F7o9^0VG_vo_!JOa`KRHOcN*LHJ6m!Hx!g0@Ms3YLO-X(R+jGuhJKe~3mhZ?B zorVJe<;Z26DCb-O)@itMJ+54z$c=DwD>w`H!gDHjBRt&s+wO#;d+`OhiAv0M5w524 zi>7jS4!g^6F#$=ra2<|Zp98fm{|q+s_cw6gRuRNY89WzC?LL;lnE`zUAz=X|Lk#>D zVA3THMM($LBo0p!_`FC4Ot?->`*~pzO5%P5Oaza(p{8Kcp%kLIBn2l~m#jnoO#@C- zBQ-G1AZ$beBtx_4yk`=?Gw2RyM($SG zOHu)PA0f9_6N9xlC(SW2*fZ#xz?5+s8wn=Iyi4#bB$&!>AiUx>fpizKHTMx$`;hrV z#MC@OG!<3-Sl0)LsxjAxh^!GvJw#~5JyvvX!<){_t?)A8bPk&druB49tCA0487po} zcwH$tiK8HVOi<$XC~g!cP01--5PeRF%R#uFjs+_=brK57q zLmy`bXxChf_RPl&|6;6Su(yw?#|FBXH5^_QR;_aTm|fV!^5qP^RpFkSjud2vIVa#rIi?@MdctZEe`5;4 zByMRe!6aZC%k_-q`UFe@C;^kWriq+Bfv#yncr|S0;eO8yIzj367mKc53FzXVf^Na- z=uR;82+Jg#GEH#mYX&FPDZ&g+A{*U3S-?q^6HM_9V3Mxk!v#u&k-$koO28B)V5K;Rw28Sr$2arBF^TSM zizric!lbQP(&R(n5pE)ZplGuUQ=17xCBnu+*(a6k37}1sxTE#dTK?8*Zo_g0%q0xE z3*!$fD9w=o&VW3f!CgVf0Fti8KxzP!F3ux>(!eC{Xm=wSj;TQtlsh7H0(oHt)+*U4 zNz7Y_D)49}!v~AhwpO`%vWquZZdgbWe8)ryKApx&jwgjJEO|U7vUWD;cDg z#_q+E`2GCP4-rswO$MCIBo0HG_oSIm0g30e1oj0y&lgDZp142(v2scRB!VcC`_6zm zoz7^wfQXWOsx;pbHdBJCl_rVnp(X?nFsf-z?nO07gHX99PB(yL=Us#`9tFI%3t{J5 zqL!P=z%2lr!|Qkf_eYxSmhxItV9F$zsHGfU%rbK@O%@PvS#eCmOpd7p{pgsa>8_7B zBSJ|@IVKHC;-q@H=39ViEZx%Vz*4Mq zuww0!c?@e32<9j{D{)^0ldMm`B(O7qi5eem1|~YV@dBoRVjWCL=;{`W&U8%zrmn$h z1QX#DCU6qx^b$DHJt;WpfD$-~v?e}H+PLnPIG=QSkluOXk_}O!5v;k6Wo^@rC%Z_7Z5ceoB@GYSjX~Z!(ciTOeH^RM zYik91Z7xSI`%?7Y#FJ+uYcU&Wuc>~U@-bj*5e7MxV~9sJhWqgZWB?n%KsADa$c7rm zKsbcKZIEv*`n#2*-ww{dl?Qf99>(k_#bnoN%=Ouc)gk-g%D^2;Hxow~C6`}7O2q}l zm7YUz{z{4&|Qh8Mq~wG0Mp7(muCm?<%Eh}Q68TP@dbv}>xTyDE+!V@S7gb0?YRAV5Sz{E1qWIB_^5-16TvZ& zOk??1V+<<=qZk-Q@WQv@g>U0lh>;8kqvXAWUWUqG>s`)yD>eDiDf@~l^}I@zjbT34 zpBG*rFIK`zwskry7&CO|q&4Rq;64&utdLCPZ;xkSn!w*5&)*!+;55OzRFzNV^l4!d zXzMYPwSNhM$_?;>mu9Nz3>s4jp(*|qn9SfQn&eZ22_Cr^=ax<7a=nErAj|S|#69s? z&*w2;%nFlqe31Xxp8wkpR#IFj5B{eq&{Q`a>SSmC8N5kW^3RUxkG zA>!*kK>V%`5x?^TIxM;=mW2~c!32{}!9}>xF>FrUkF_zov4VkV32V+vSc6_1$C|cu zz>t7WEuC!x$mM`41BW~Kxgn62z&*?YX6nW33h@b zgdh_52uOT+OgU|WPcg<3E@SC5#(EYg;EZFS9>;mc`xdM5u{>sDJSmkIV2pbnY+bW4 z$|(b*T(V&6k&kf%)?`9&I{$~++^%`DFFeNuOwxoWP+CT(XaW>?%zzGLV~IS>sY>=`5c0349|~Y+(#RNSGgv_M1hF=VaxMtGyy-FKo>BH z#?nM_K3CkA-dvW8NP zUOOt$V@o-@Z!AN%4JGKht_WS$=A+B%9CTTgg)S>H(Rq0mIH#>#@1cd?g?XWJpNlm{!f!T%^}J|;ia~G@gZ*M^ zDV@kt2Bf8Qe@h75B`h-}Wu|gnYF=uYNr$kEfLoTp3oq$dgA&E<9K&KlZ!uvgKwKPW zDFLNuA=k5zzav^e&FAmTB~0gVTcxwZEY;z`5=u&}7`z&g4yb$*r%9)V@x18A`c)7n z8dwA}qgVqS=}Mc=i+cp~5t6&`M0L!jmti^7QsKt($dN>mdo~-5jFsS-6xcX+EhF>OY%Gu`-lz$0f#n=a}O7#^n)j%f-uqg}EUcx(xsQO@ZY$#R*dDHX#VQZRgb5|s!W zhg8BTTe&7_2As-cIg^fUPTT>yIiBwXkTl;d)xorc$8Hgi;Q|2@r%x9!G5Fg_5a&5M zj+F*+bkl>YF^l^?oBz>lak(LMz0xbruS_|d0iH$Z%?eX*o_D>jN*Qb66a(A zCb}TPSDHW<(iLq;*aOeZBk<2T4xg-}{BI9nSJiqUCJAv&ziCseZ0Zh0o!E=fn5MQM0XKJvF94XqcX zqxGUpv|5sdR?D){dSwn;ugXO$5r^MdnuWI)rQ^*x$#`orZk52Ow(Pt$C;3n3Z zohq?_F3ll)Hv)M=#K!MLQcM*R!b=bpQV4(ld^q^zV+BvLIjm7l^QqtkE49aZ%wiy% z!yrAM0dN6b-$FCVc=M8ZbrBW|b;+v{XW-@} z4BoL=+6%w+)Icozm2$>2ZYlD#1Tl5m3I(U zb`wFR*WsOi0ZwU0VIRMbP}-%Sv@&il1KA!dVsM(z;53KZF*CRV)42^(xeb$8)1Txm zDpatUNH;K%!BwPOpgUcldk&9>F2ZCiVIn}1<1k`#JZ!ckVI(UP0-#BRhd9QubdMq_ z8zb-`Xl!_#hT6ws7?&B&VbQQHaTsDBgTWi3Flb{m6@x*XXV7MrQ^RDw9X#Gn{I3Xm zxgRCn|EDtu&mwT7SEO`ukRFCh2qSSzO9-h&X~!|2ke@?WI4x$c0@JwAI*bdU2CeQ}TYeryYbVp|q88X+=~WX7j(C$o&wAH3ridf@$na!IX|Z zZVBk(DqxD$!IXwB!RhEqD2ZMfP6Up5k3E5r0+J3YftK<7lF=(qn(^fMr6C5Ga;gX> z=YKDlY!NCgOiijKyCkMC0u#(P%q64n3A;&@~k**EGwm5}ODdFJ81^o|%YoibvFzFobRh zfbZG>IIIoA>h+OWz+gGuIiDw<8Jy^z<}e7(Wze4|F6sr6>CKAJXwZHgFan>$N^=RM zxiQ*3A!&k}E!~?5h}m*agqmfDzag4QiBr&S@Jn#kBtVjYZK!E4yFFUo7)mA}HAr(y zyJ6?glb%k*h8OTK0%;fn)eu5t;HE_MUmK%oT`UHyi^IV6@ffJU6OX>@V$gd{1Qm%s zYobkXGSq*4Ecz2*N?c|jml0VO*`nCINw+X^zjn({YvRPDlvnAn#r2>EC#DN z9ywURpuf~J2P?hvu-cDs;yJf5uoRmZ?6%OsY-8};!Jy+5wFj;VhvAcP7GWhf5M3$v zq3$BOLb{hcGBHU5QoD6I$mJpN)T`##&F-q@L1S#pKW=(#0@IRF`+xO;r@=;D#s`j zMyThyy7Vu9o-2g-z0PjNJVFYsWV+u7fN$a(jh_vl)y=v_6#^_&pI`APD6DtY0|(n zOrS&!jTIvyfrTsZ_G|4fD-Vx>2ZWjJpQlA@%TR{CgA@wAs+wladG%RM0Rob zA9k_$->LsiG$t1R>*#3w_mL6!-$#Yvf7*rPovHkD7N(*%p*Lh>5f4x?7H`kNX4c5v z*90SQu^R$sZHE8kweXs_8jh1TVEs%-ELt3Z>6?-<-nkIteHaV_b~3o_!Zg;_r-$sp zOa^z8WSp82vRhNIrs*73l3_KzhbJUOz$p<7s_QlZpy?o{(Xprw3Ixa0(0#Q0bTy#_ zi-^mMChMBSbxxAb2ZW|bItXZ;1vHHd(qyM=Y#?RiT-J{3u;Y5|_&au?`(el55{>1! zp)tXGFq&Yt@nj8?E@{yAObpnPj(+wj=u2SqS`&lrDp6G8~C+E5lWJ&$Waf|FdCk zrL6Q+!q%?_V|=S&>%*F_zufEE$$-WS-oFO6gx3fMUMSl#sC0~QB+%UC20NV;-IOhZ z&*cf^iN*lc4t;X8s3&W7iU4d=Jno(!8E zsjB&Dgt!XUmd7$+kN45;wM=x+#UwhhDGc&68EhBQl`QotzzWvDSJA1h<~(cZvNqBg z*fU6NrnZIEV>>GtE{P`)karcKCASb>CeJ(Fgn!{xc;;P#OU`-qknJi4rG*S?vk17E zLFLM&NfXsHu2Wpmc>cbf+_NEc1TdqWIL!SS%SwfkJC6l}sla5EzzS2{@ki|t$&;V_!Vag2W@>;ies$%EAL zP_*0wjFpF(4{04#l8$0l(hBdS-SMFOkR<^qEKkv4KL7f`NV=>A(3*&e!$1|Vcl8N!UCa`QQ z_kTF&>%Tn}J?QkiZ_hw40!p5X8o-LsApZUkR)mJq!3||TEVvfKncDH1f-Q}e+ zGmG0KE_V+9Q_*bxmor!{&BU@FBk8_uxDFdStq}y&2)eJ41k@;kYBZgat#l_3t5wfX zjiyr`#)?uumlW<(4B9wGptW-(T6xCfU7tj}=bwx=0Vzst11aY1nRf`Hf>Y5cIE~;+ zGd20ieJJIo2&+B{R@$2*G!e$p%%de2mzAZ|FESJTBSaahp@Ow5%7w$u6}(`|F^U@LSjG#TwTx}W7`nBP!J+_z?el2) zN$U;V;dR{EwLCCuve9c*w)#YR_hp&rPFK}!Nd~$urkHnO-enVeLN^8=Vx=1*7CRt(!8Qaha)8$=Z#Zm; z#756ttm28Xg0+&B@%ynlVL#R;9>BWfgIG^(NIs;rK8fQm(K?e3sO8pi8KsoNSeJSP z>r;;^txKaMPdS3MoVF%e-XI`4q_l?XSS?D_w2E5E@s(V!Xa&a&Ef*zdS{8pm7l&nB z#OX_u4q+MBzl^m}3nj6PlIcr1-{QD^SP;pYW=J_^2b5r@ZxLp&Rz8DHV46oZrt(-$ zV=a8TXC9{0EzD#MQ*Iv54l2Wp0M;yh@-dAyc#*t0e!4uc$RMq9j!)xpp5mT`$!-}+ zliboVi5J%-msCt<`7{RHS-e>1^I}}Yn&J|12@KFnsb%r|up)u`pSWN3a$3UL=0XPS z`2nR=2^P|wEDEh)c{OXI)mR)>!Lky}XH9q>w{1a4DHev6V{v39mPFNHS#%wiM%AkM z76+GNaZpKvLa0!dg>#*h1-Rg2XzHFN{q4sO%3&=M>OEv8DbEW8rSxnC<|c@DE?zB0BB zE4Z!8x!udc%dwQ(C~xs!8eX9(qKf;&eTv{Q3FEN|p<__{%=x2hu_C^n`%1Sa(}D|m zjPo(qKTnfiE@t~?(=ldZx<@Lexus}wPvdw7W_V@uyvgDDlZ#otc@*d8GIRXsP67%r zFSHzsxUEZK=^D7L%M*6p9BVU=VpST?=j44@ z$oc1UKNrN*VFA~(ShkZ|%>7*~W%>&0+P0T54

Ii(m=Qn_zwC77O8iW%vYD@l$UT^@?w?G&MH?; zdi^8P{v2SkS?r8q1W(JQX_)L)hV7)U8)@rFJLt)S^Fl>g=3b<+Ay1K%N9Mr8P=qG; zaONguo8%dh4R8LgAD0c}fe+yU4@oXU7!{FRfat_L9-vGl#-<@TIvFXENl1-IKuSa+ zl44SkkdTGA)B?ovpvPvFAtt*5aiSb5w*v9Gl}!})LTSrbs=4_Z6f5Fyy-YDLP_!X# zucmS{nN5EcahWI)k3l4lMMOG}Uz(^8;UXR*B@RoOOpnYcMg-@L%;fws%(8GUBT~z! zOPL{knye!wA7LqZ2u;q_#9=8{^JSK*ZIErT+@A(%+sJv<_UTG5M5Js}BWc^AZL4f& zlqgGnLzj$a6d{W9C~-ceOp(lQ4C_+UwRxkd7%G-!37j`EyHqL3l$Rknr@V<$cwVIC zS0lZ!78yl#O6f(lNGqs8N+)JjWw5pDtNW{f=on zMcV%w!($V}V-u@Oh7HL%8kNKUo%#IM__I6EoPxahY(^WV1rkMYxm`O&n@faP3QwF1O z&0i~t7#{XszeE`LPUH5|@OQnxy(uhl`FXioLWZaUH$WT>Nd2_4On{=Q4Ck{O$%eLidK=#Ui(*JNC-qjDPAO zfOdCwnwxP**9{D(FeB?2p)ByVo%FUM8^BZ6FA}{``NL>i_fm`D!AXW~==F%oxQA(y zT#K-_?$1qY=WNkE^D3YlJr1|X*mINbIZHorMIQ4dDV z@fu=TFLEg7*H8SX!kFlLxo;lpg^D8#Vch(?D6KvzmUTefI@Y8AE45IVky2Us6WpI` z*qXDrgj!B*{hKl-i;U{7y`NUq|3*RcLQ+%~bhy6uU=Deq=^YXZ$a&^3R|DG5QvKgn z%v}9ZmLpv|fDlVOE~}gmHC+bE=rtegZ%qDgtMnin&D&f=W$;0oH{v9B2>8WS`&nh~ zrCw7fBP#Qv6jN;iiMZ_0yJn)dU%peT{0aQueQ>`O zGi(Px_ZT03a|oF_zF=>uiQ_M1@&NR)#EHvS0E5A)09lz;@fG-ywcnA_^p&+^v`|pZ z%uvn!R>k>cZ%r3AH85DXT28;m_<2*#_u-VaQb}#%4ESoWkM%L_KTjAK=!eIp!jRTl zK8_7U;96XKviRI*(y)|O1IkJ_zC{KlgqsIl<(Ig6sE(SUQ3i zMnvy-L_Y_uTYD2-g$y|QZ_VgO+~E}h9Or%7EA$E=Hyc9e2zX6 z5h)F{ZGJ3+ZaE0KY|@bvX9bl|3=x(0p}<{Z-)E?GRtJ3#5o+hmfkTh>4 z0x3dsJE3T#{bC%m&=~4j1IOJSzdo1ra^74U`@jG02H47I%1-(Rcqsvw`Y&@9qkkTf z=P!CW0KvdmXUXlje`C7!xZI?7-i)u$1nMiH1_V{y*?-OfhUVt_At9glmbTn8$Ih4r z`t`W^KFkU_=0!!Uz;LWN{KDhGTD7$hW{FPcuIJK;zzY*28}6$d>v4AGhc(9bjhl2U}eR(2APxT6LLB3)DG`2Ntaz1w=m_6~^m ze@5NJmBVSZ67uP%pXGW#v)#Lf;~F>cEN&N&Nh_gHNb##|NFP-O*;9| zan5F!N3wy%^WNPy(>%~U3S*ctU6OyGLzl^Y(z@1@%fS-y{l##qkoPXLy)h_CU-Whp zw%@t&^;AFFqz&8pT%wovnR>Ycs~~5&v-1{#qTYUcYtb<6(2<1L0T>IOmzaNL_wROr z{6cGxEd}OQb@RU$46>O)^SE}Y?1BrkzLuIRdRK9e4L#|1ST~2IuvDUo$0ZxGY^p=m z2~8y&saE&qXbWzM>YP>0uNz_S*Ss)YI>t*66Ceq97KXDW_gk>1v{Pq-b;ZrpT(f}Q z*DKHqr7D&AKeu;64-@pO*>|~V!dK&3EE3? z>Wh^NfKfyVoJjWXa$XGYPdJ@U33}dk52m#hV=)k;hJ@u>Ku?sv*LX*og6=8m=gxa_ zGAA7ECxqL1|4_t%;DiyIPrn&p0uo-2>}#EH47JWjEL{iR0Bchq_S5O7q2^n0dy3X* zW{$zjiz{ljv%gsYPf{(xQz>yEygSTvdnTRf9{S)SBy=h{q)OFQvc5S2s~KuJuU%`Q z+VyB~@1zF!L@pj5tNZMeOCFPtts4c@`5=OOk)hdi-*Tji!nm2Y{GbphdF6s$%mR#h zvwNG<@vs}eQqMFf9G1In8CW^n>`SovK)Sx-6Rtphw*eVk--^Np^qjc0{k~e_^@S|X zH{a}#`$C6#SG=HnQ24*tD~nQ@z>eq=N@)3_Tg8PLrb>`ihHGVWc$ z%^j^UyCUjxNJYtc5APmD-H|%=zO1gvEL81h5szP z8WM#f0#GCTpQ%Xot$()P1%-}dd$)R>QHdo^(9pvWe6?yeQ3Wr3B)NoAmXkbRGnC|R z&71nmoUSc1g9k1{PLy`eXET_ojeLG&6&P5q3#v&- zePx*+v|IAa{@nsc^(~lq_h*k0Z^VA1T!f=DuMt9vpyVKR;Rhdi25rb9tY}W z!p?ms^vs69TeCGC_QHMnA9(XT^paw~B8a)|NbOZI>GG7nKjU+19vp!ShR+Oeqn_In zpC0@ltTauIE*5(YUZ{)&yh(Hawc5@G%tnXnzmPbL;WhY$QE~cVa~+$J`1%%i@bmxc-$K(YlK&03vy)k^ zOS>`y@_hwdb(i+Q|td!L#v zH}{wJ&*1Ub!`sOBCoR5FM}lI_F2rgQ&xmmV&z=q#aiM9>_DE4wv-e$4@iF|yS`5A? z><SUODQrO$P}$jt8}GaGZo^Fem);eh={bR?8K?r5)HM zWxwyL<~i0D+Q~?2Hhsnov&n!&UIGN^ErR!{*NuHW+_~}$h`LdDbo$=JO~4^1ukm_2aEWq*FOq1* zU~3Scr%rJ{YIBVM&qq-JbgC*!$p0AMFZwXGruKY@lrSlBOU!Bfq~XCDJX_D?v<*JL zSY^6%yk78nXhf6r5c>5QE^M^b@RSQ`m%R9!D7xVB+$eFouh_(qJy3+*IX9RFf+4oW z8BfYR+k)%E=AAYYZkaQI@BKWmO}HbtvSR_jkPf-=@+(om5+yNwe01A1dyEpCThi9- zFx-iu4Dj_OJ)_!e_VgAM3(}hLh*zEYLibLHq_+R*qL*`hTkq6==+N_g$0@6&*e^(7 z`bth0=VUu1{2I^xeE+>_gtVh0g}v`BC8*tltmRPQ;ttYJ!)xa23452&Ls#npSMj~w zL8I-V`)T6(3Q)V`bN8Ll7Xbm6EH#?WgKF!R`)wCCsNaKntuH|8eEVf<{NQCz(G!H{ zw10Je(SNFia)B+qdsYzcoDsFjJGa%-%Q<_#0!WVg*egp{cZ;I9ZM=C%jMmxp{sy<# z6a**Hk1$7x8SmcS_tt*ebh&5Gj80dAT|_e-KRk-TNKOW@JD($?zshAX{Dy2(Ivw?z zUceGcff_`?cNihsNi@#g)wn$*uu zY&0w*9Tz~mGmd#Y?)w$D0H#S7?a%#m?}c!&JMBx6O~kdaOwZ)xbqGPQ2cJHNoFHZw zN+&ov-4Hyqz72hI)UQm~2^ruECpdIk8E>Zbz1^N@cICp3&=8hKclnUJxg8I@$E!9K zjfs=+#za7PP2+*^;Yk2p?~uxH0GlP z%!xooxO*8u@!VbO3BjL;agdPq_I=-Dd38DEfr$fq-Zl)sxRZ92BmzA@5N83@gG(=P zC|YlsbAZ06ixClGB|KcfCHXN|mEIfjRLAXSzpR?b?)RDL3qChk)kZ?))dkibYP}O+ zjxL@u$ulKPA-nuOED9kn0pL}G(ug(Z8c&8ak*>V-7x2BXdvAm(4z@&xuh%#1N1truL%URrM z%>&ffH(&i5`%JU(Wth$rG@52^Hti+OVX_C7!xK_K-k!L%(VX28NS*^%cXPuAg-ioI^PCiSx$r=0P-|GTIw#_j zw^^A70ceUd*$`QC5_q6Te=ZRK4X0cZ#>Ihbi#~y z0r58X(c5ss7gE?kz=SxX_4Uh1XHx-2^I+Y9&K)Xnbu`YHQ6m|#9{TgWGN#e$mgC(e z9sT{|FVA_CzP7hz6Uo%kak7fSwgJkWunTTZPoE?%^;JJd>Io2(j9AslWW8#E!ZhUS z53b%RPJdz>%CgZGiOC<=_oGO+Im7o`!^T3@CP6dp2;WUXD2G=3C>~b>v!Zvnr?q(Y z{i3y^EEsOqfL`MLm++Qyj8BW33uokUD~`HCh!@gM&axDFw~NHNmZs)xS=*zRP~_A6 zhv&mj-`%zzCE#fK61F&>JW&Xpp5ODQ)J4%0{>O9?sn~q~aCGI1+zh2is3WmQR;L?w*=yTckvi$+x1lo?ZM?PO zbtoPjXTfUHG&vFyVH-nY+Mj(a(qCfi)<9_Ur}je5J2;J1YvC(B2$iNF1OVMBd)RPAGPZbCz1k5WM=ky# zX;k2z$%?MWoG`F%1ZTSyV_39idpi@kc8visSM2HSa9-vi4``se^c}s9Nq3M-2+AmD z|C0}-wwI2yiF)WIIqa3(c|j{JHabyFkC(l!B+f+1Rh&~E?dxO8K=mZ5NEHr@Nf78F zhP_uVSE3*Li&?%(?;2E{&A5@MpXr?U$Y@X&%i1MZkWD`l;urQai7ZCWqs9yjxe+6J z&}(u0Cb^yxx$miWF`^?HALt61gYM&wpIL8Y0AR!+FevMGOoRsV-&0yu?&{!R!Rc?kTimHQ_GL!N1u-&G%*QgjAf7(qGqbvshfa4;WrI zJC#%6Mp${?K7=h8o5o^}5)~xvySMj>(a&c|n*1h5b2t5f1h4r$jUSwH%OvgtUX z8A4eKXHT~hN+O7veiL^I%eF+p8k6!<5IZrZQ~$XU#!mG*{0bs1@15PcrlwtFZs*Ls*vgYj4nFF*QoN=gUWj?lP`P-tHc$?c-kR?FlVb4hCtBAhyw7!Y$!EvG*N+uT zXwUsG<_3cRdiGATG$}A}KTQ@-*$<|4F|VRP^1z7z))l-nM}iY5%vJ`3elpVPZTf~D zkCPiw*hMe@rf+!c^V=q+Z%Y$*SeE@uufVC+4%9Vr>Sh?ucyG+8^&{(_G~*3{A;~S| zj&;~Q){nk&N|NfHI}-ja_1N13oRS&}+-T_NwKYQMXa4=)a@q#ba7{ajZ@9UIoUi13 zfmbB9@6#RE8t`6_{Cf_LuIGAPr*nwHy|74LH1XeLsiJU;4gR8Y>Ru*3TvMmtY-^a- z@^jc&$?sMKDQr{OS5CSX6=G^=?x`0B5bgTBNukD4Y&sMrLu- zTNVUKNgL0|YU;U!7=kqfV)q8NjbibnuTz6z-|nyK-NGZPdjIsc{YmXe32)gIcRxXu@asgg zv0@l1l2QPCYu=vt*_&be&46(Z{}n7W0}G* zI=rjfgHeOx8j`Pq_Ri8&tg^g&_8(C1ggZ-7nrgD8EW9aVwRbG0D`SrI2vSoEqW>5+ zHLpHSi#b&A;?zg&=f~%)2U+VyKGHgwH?USa!q4!_ai8P$Y8{y^Q1ln!mZ|49S3qZ~ z3SDoOCb}|~&!T&FSbJW2(at(6vGc_=e|COkq@+^Bbi_5^5u@SgtB-EGBh#$u-zPiD zM`Cwv8h;A5XwT4{?ic@rf)%mtYlfOPff-|xpk&?1-AnCv~A2Zb4(`I_+cOk>-Q z!lPao+9U`T(wD#9Ssy^n5E5aXSjqq~v53FzLVdGq0E1Ze+cP0aTk7roxZeF5+U{jk zq&D|nuK_V>ZJWRH_h-zK0yT1y8kFP4py-~TuRMR>HgWVf zv<=aaT{_|o{HQwpZ%Ec|4K+OW&^U}i5!TooU5ozs?$i=*f%}9nxvC=ZWw!F3HU72KTbF#k{NRVlio;76*%RKre7@RWda^U{sLa zrtKkEu44rwt^|$OP#mhP?mrr;bk%iyq4w~#g{>|GChZtk~n5@V?9w_steBX+gc;#QkhDbM9)i+p4ki+IY zm~fgS)CXIs<0m2J%ng{=VWI#zztOE(?H$Cf-Z~ftU;H+WY`rqLxIbC?_}#Dx)2Er* z#vD{C?1Vjk48bK^fAs@O#1z|`QjRx!W>i3dYw+J#VA@m@EO)o^m~2p@3uQZsv2e2UeU7S0L@r{mpg`}O8<7{9Qivzv^~M+Vi^$qefppgVH% zZkyvK#OvN}F?RaM8&ODTyQ}E9+4qJc2k40FpC{4mvCSjaD70}fOWy3dizQL4wbJ+n zKl|{b(H79Hm<7FJW&83{*Si6Fi`!VW9_`n3Mknf7vD9g6#eGqr^*7=|PO<;v8T^x& zSNS^j;~}X9g#Zmt8yeGusfAq!3WxniqdWGM_9xWplh~Kf?=*e%f4-jw;y3#XCB~Ko zzJ3r9^XS7@TBoCRM5Y8wAzrl(m#zh&>(4lnM9g*y6lLx3sy=?!W4Go zL^gQTmUtIGh7XAaONBTsj96ap-Yt2*5MuD?R6BKrEPLQ=H((Bbdiou9#w}K@{n2## zucU{#; zeDs&aLmN4E4DH?kW3LUyAVWP~-1AIcJY*_fYG)>WD$Lf8ThIDbGt!@v&$XE5m;__r zNpMH-f8Y#GqU?3(^bhSRq$fx{=_?|47KF&n?BaXE0k>-iCUM*C%eV8lc2A8CU_P6S z!cEBpM!PO7zKx%D!vuq|%wH0|bJt@Xaq<4I^xphEyP`OhPx-!>Qi*R{bJYg4Hg|V- z_i%r9nK-L&svtg8o9$IImC*+>lGFnxg~{h%cxv@TEO<|lMS_-o33=CLA4wsCRCM<}t!>Yfp`e}35h z4smy(H(#C*Z^T(TX0iA25PM>Krpl46QhHi;-bcR4=^T-Y(F44g$M2m7UJsA?HEwvB z2dq@l*Ej-exF;D*{E3?(`uB^yEZHPrB8f!O|wnuG!20XO?!5E)3N(iqg0Sqtp zM~AxztZIZ>t7AlMSrGU6M7dVaxMG3za@7;U|Rf7QMb{K~Z8)0pIA9M0i=(RroCEktNymyT!WsgRLZngi%= z$5~Hjm%oN0sKB*q9OL2GfRpkiqqVQD$fkTGLk4D20xFiiZQXmab#!*66{*iyjF9jZ z>*J4BD9%^$%*<5ki#Rr&5gs*C6UG|nKxEwE6&3#Qs~JSYjHD|bW~*?u)BeX>$bfHb z*qo}lwHeHl4=HDvF1WZxp%pFB44+TNBv;}oJIXL~0mWTs@p$Q*8do5!dbukdJnopIWGn zbQPaB4a+RxrOH!ai^x}YOWu4RJ25x#3iiV_-Xc^U+apj4zqIlg|0=UEtZk%sCZ@x( zfq-HAXixQOGH~GrW2z_U(z&UBgh{LV4c>M(q4VQGpK=EBz@crGnVEO;L$?k~q1gOD z|BV~LJa+tT!-m;_ecKpTrW@(7r*&tj`!kfS>{V>+Qu<{{(HLmtoF_YY>9y#_sd^x)3_4V!OZ(P zQjjS-PVG@x2W1OeHlqv`6B3rh69wnBvzcYBp*5NrO=#K2EjLi4Yf>R76>}hzi z$7Mu%DIufsJ=f7V#pi}zSNE#8#ik^3S4G=YCv#UFFXzp9`5EB@X3Z7J0hbj(`PMqF zzcXWPVcErDZOrT(g};6UZyvICK<}(9V}^&Fbmr&MGAJzFju$HfUrLYFXLIMN5Q*|1RI1eaB8!J_8sN*>rYUPFHVm z@r2%5CF|l6wb1QgwZ~102)S>#LwaI^3rk?h)wC)I?Vp06ke1_iyB{VXA-35W6nx0a z~PGcyt9y%}fNfjXVK=l4IGF zZ|5>1xtQO-e{U2<$)wyC%(coHd{|K;=C!afhrR2z_txpClD~rvmT!iCFMO;%&HeE= z7zvWGbL%iL4BAgczpG*wf7B}*JQY)No z+%B&8_+3@vanOXW$u<%JD5q?U-`|aGR-LD0Z$oK69vV6LvJAg2sD^rWwkA3x)1Gl~ zI(dT+b-!@?o;DE2k=(C3n=3X<4ZfGZAty#P9gHGqQo}j4Rd&~5DTyOBdDdB!Z=nV} zLv&jXN*=4iBl#&PqvdT#EI&PJbU6cJzohPPaukYYY*G;fl_Z8h$*EFZN+L>icT+Y` zK1gdbp4l_9nAg3ey-9@6mHe~l$g+6F`$h=O69cJCZ}8j$xolQ+%*iU1ckjEm`wAJ= z!81XrFeEgC!H_}M9B3mA0_M2I7KOaK0#b_;l~7BwWl2SZu{2o}q+IEn7Zmtu~L4xV>NV zy=K(;o|_)roc^PN*&+1G6X@oT@i@gL?!jD?GdqHNPLgT91m>FR>gvtt8o>(x8HZdR z9wR)PLAjH#=h{IsjY{i3*Eg#zM=c*~vjIR1Wo@y4m0EOkoPZIXM%kM1-!8}((|bNM z2OnnPFw)7S5xkT$fohb*^>LhHWUQ}_H6Iakg^vatI3I8vi4oDXU!;{F-jX7v|jw8XdTQ>cVJ zJ42if1zb0`H{h8SMJ3xOD_h(1!j1x^=k=vIr$qyU8fB&9!UjspRo9#Asl~F4)XK85 zkj8O|NAFe}o8vELo=JJ#uQU4nmqfh365C|-L&mE)W(C;o_yjyA*8v|Y(#}uLlGThV zvOMBMR9Iu!v#;+kC#RTGJjxsG?9TJ0UhvPe$H=ING)UZ8Vj3jU)_QnwhHK;9FOV;0 z;UzcmsyAQRucM>8e-Skj#i zX`!EzjmXU5av!MB+1<5#WS!%7J#P(EUt+q$F#X5PSOTl8(s*@CERs*t-#CA)$}T$} zay`6Xuawl%aXP~P=)zr=^L;j%$_dow^J$PZyUkt$kYQL|X!q?K(SB9xb2qM&$;|RK zrb*5j5m+4Jb%;0rO+L%kM${=NV%KoKxS-7xv{`uQ9}ZH+UFE3OPc;%0?SEm|(bvlqx~n?P=fIBP7UH9?mI*Tg6kbDs@nH@A>NC0B z-5+n9XWcbPMf)xrqrB->b+hxMrShNcX1hI7WopTnlb;MTQkPI{Ky4oCAde!KCA#rH zD^%Yr@TVdEWgOu?=plwAblE-ACuujSD zbf}adXmbyRpy&Evl~K9g1$}0=X^061Q6MBDPyL{-$A`}R^IiA+P`P~~xxUSlrvoe1$_?TgDIvk2NbUZG{y3$0BuI;dlsops z{{)rFXUnRmo_sg7vxPP)XaX=`yHwo}IUwF8OB^<-JS~+yRfk0&=)!a(Gu-~L(@Rl{ zTEfSTNcl$1%k)9RKg}>Kfsj19RwY|ju670x*k!fAuoQOmxt)t2lh@GNBrrNh>jnCQs( zW93wwJwV5oao)kzkPkN+Mh4yK^<|U+DO$a3f9-I48!ds7Hs(ggMg8x81*wYR_e2Lx-FHn08Ooukuy&2zi#ajmcb6+l zseyBTnh6>O_FnLU&DS+3$CMiuTn_lG^8LSaMp>Mj-!Ob7AxY4x%HUK(AC#UzgP~gs zmDz;W&S|I~8sL)?g$MXFtbD8-Qt6wKPo0k?PfSn#5g$Xz;8jMlyqt(f*45ohmc$ns zTT;rje3zVVIyw)u?oB;!qGxD(EO(pFmW^%G=vS+#@7%1kD*OvaH@1gipW|YI2$r)7MtrxQ7*g~% zrZ4FTW?U`&uhl5#xccO;xYSN(w-hP56L|{xekgwL!4>q_);q_PrFva zXIO|~3>)SSY_S*?fB&G2P=^+AtWcaD;v@fAN}#c)1qk~UXW|-Uv}TF8;1)!Mc|xZI z6;vbTCKlvO&Z|7agGWZ4PT=23NJ$wvIdwgyV(#zz@bFlQ$qg2P!=&&7HaC_9BO*88 zr$UG5y{o&G-iQr@TG#B=JHHG%e}2eyJsjo%-7Nu)shz`!?!x&5NP{dMgaA+DC6lq= zlIv)8whEy84(stH+c&wpxj+byrIL%YUugsn&N7S;G^;5zYMW-a^M{EVH=BT$qy35r zD`PMmeI~9YULsUBr6JO1dbBI}U`N|kMm(nGh-OSHb0AL`!MLG}P_U&fha1)AFiX@o zX)Kh=$Zj0W^6Bx9PIQBe9KB%p#S8(|Rn=vjBYJuokL74t`$@N1crL7ko@}qGvH1NA zt{|M`I`*WOg-t69Oq@5;^jEA zVLL!nH|pPGSXx-_{}i$M8f3Myx3UtA|ap#Ig~+pVU^v`umRDe|aK~WM z*wd?-LkIFx$J~rvYJB(JSZq-@nUxk5ZX_>goy3Z(+2 z9>e1TIc+iY62ACz3U4`Vw185pR_2&6e;9%IDEe0rjBhS)*EN~J(MY=|?VXQ_u#JM1 z0%9Y_M~gQ8{O{LX&KC@f5+R$z`X?M6Bg|U5Jp~D6<7%>3Gs1zrQrtWZzcjAO!oK+F6Ez884zF*pRWj^-0`}64Xfs67RGn_@0Y&Tv%|zkabOBxE`aPj(MPeM%`!8Lqc-J+(L$`OFGPC`44{ zzf***`9{6pq(N%^roPG>P*cFTdxJ?rB`WjTm(9m?S;>3*6_It$Mtd@{fMmFlMfq3e z3tTww*9oN!C=w-&MFfG4d#TbdM=dsNm%W)~A>n|*KqcbSb2wG!C-K?ZCe-Y#w&$o%a;td{d>KXBDB{nHOzPKX6d|vC-UPs!o zleoEop`oRh*F&AWAA$K}D^9T~s`-+iAi9>mJ}J_cnWB;sGj2}&4&|_p5u0H(PEq8D zqT5khYTeAMlhf1MdTc9C9aIb;ue_U&{aNpwG9iIG?Q)0$9u2Aj-1J_p5dbvz-uS@?FQ~yQ ze)`wiTc|Y>O=@aw^?o2toEcg#&uh=7Qx02cF&)hOv5a#o`LER$H-2N{|FiFFo1aDS zq0i$KwAcK<;&?oYxL}I=w|$nH{~DMDE~%(m1i2z7-8HWN6;bxS$MwH<>1IIz3YcB` zzrDuNDmVQkM@@81D4M6x)zMkAnsy!*5L}0KOa0?*YKw2vPV)umm?waenf%aeewQ8? z>(GBcHX|gEz?eQ4B_NPcSmE!vZhJ!pIZrza=2BSiWo53R6&6ozs6;S-sI%H3(o{E6 z^pi@=lKr?DG-sk{DzLf*j{G7{!TNbtO(5qwDGOlO`Tv6hjNE~ohAbx6@HLGrx1 zk%^L>R6TU|@|)8S2HKcwnf2lUGTFi(3Q9rJOvQ8|d}SkOiE26~V6KWpV?=MC?ZZ8_ z)P>m*PuABK*{LO>GAiZhd{bH>O(n!@Q>0@x6`?3?N5MjK?xSG5UONWQ$WtgjM6czH zYYVST!`+@Nb_ zYZaT`fgFOAE~J;Xd2$pRR7L3CUH-VPnH3!-hcYeLBA4mH&0F6kQ&`*7*u~17y9Z&L zMlZTov7lyW2<}tjZk6_9QRm zH*fR@`>!#ha(wwZ_v&kN#R-mgCBL)w8aY~ho(^#tv#;~=%$JsyXL}lAlmEQ#U!_AN z&+Ve&$qjrj=*lMco|84NvMlZq!&>!dIUaYjoAeEF0xhNIRn`k^RG^T^Q*tvV71`(b zsju@<)}00){UvnUwC|`7EcVb?3)O$>A2%A$nxpT`&x+2n_@bjN_0e)GcwGMSE#l4a z+KHE8*hsO+7~5$XS(>?ucFL*zM880A8pmH%ZUKLW=)S#27I0!Yr^$p`EVnR|jE7;D z>K%#IQ6ulr6k?69!u$C?FA^(#aWZ~!iIK6bxyczubS>V>YLkxjHbR>r)yRDYn%PsA zeP~3SRz#>PT}e^V@H%#)9wo>2vx9F&?wNnAb*`Umc;cHHz!eJcF7@srdHz{T=SA~huY@{oNll4F=*X!h7qUjg`4R(m2<@F%fjgkz=YCbTGjeK z@xr_4Cfa-OC&bh~PSin%(`?%WZLh@JulitF4G9QxkvvsZBXEYf;NR6XRa_!GBMGhi z$9A?~K7T{-soy5JtNvZvN?&6d&k4tv`(n*}O5kRvNjP07GDXA-`1E7+Z?drLEDaZd z#H;)_zDHv;J-lecYM9#>wqXk2)n{vyTNG%7%3X}f&STsh-zwRXSB{~7B+&}f)Xy&Z z(_-vuP&bK7NqDHq!KutE!tL_O?|?dcaIGXGBHii>v91#iIQx9c{2%p$to02~y>I8Un)VUk^5L;*hZRTL(s}yI`6Awv_y~j5N#4ac`wG zCBHv8KSTd+2$Ovthsau%yUF=iZA%9F(;7|H$4J?7i+l!TAL~skVZHcue$FEcQn@>d zU%%~GRl&5EXF6HDT${~}+?X&+M3bdKEl!)CX&b##*y6DP1+0v!p!^b0_|ya4=RfQk z@kAeVWW{+fFy?cJ+`T#_EXCRp+q7l-bJ9wDcSf9T~TW+PRf#&gaQ<%Jo3X zBkr8Ly3})_d*(|ObzDuqdln|s8Jz-Pf3aLNMveIfBCQ!{_@7r-b=%jNOd)$3t7bP8 z(sE&=z210H>=DoooHSj`f*mhHa_HqVr;~s(VVF(fOk6J9SI|MCKFZjEWO!7XeJ_9- zhzsVM4S|UL$&_24OD%C(jlDcwMP^oX#Id*~PLnPRM0Nk-bvgN_X4;>DuTELz+q-Is zk3xC|yc`CVo&a*qj4yh)Zheb_kxN^Al@upaTrQu@EOLS!~kIjA8nx7eqV49ULZ7IzC?u^{_dkiLua=Em){4Ymdw%a^w zyZ)c86O&0h-CkGkW#5W8{l;Hw%n`O>xDhh;4Or!T`5FcczvjZ8QkWc&;E8*v{Q}Lm zBsnkd>sd_>h-Jk1)4)wMU+HnF7*^Nf6WRITAa~{`kd)g&&~54qPB}^;m-`7i4nBkr z_gr6slADav=p7VTnm=nU4h#(J{t93*U+PlAjcgTeRFB|gzO3mLvAH#ue^6vWDT5!o6h-T^}~if-r!}s{f=WVpq-LA2FF`oEYBddS*O7aUiJd96 zfKwvM<1=GUY%CwP3Rp8Iq@+WFGpnw+ksgnohAp3T_gZNpfBz(8Fl5^?@{522b%X=*2qEVE*C<#$7YNem0j7VK` z-8j6Wfw-2G>Mpg8kNq`9O-enn>&AY*Qi3jX=KL}`%T~R*p8ySMI4~RV=$$@bc6zQR z&51dH?jO!IX~c^SjyH7yP%)8s6=$;f0_=-Qv0ZCDu^#b6X-50XYU zHW9V>5m&)oL*3prQ$?oMO0IXZpAbTtee}gPU*e4|KJgfToQtv=-wY#@u-%r5iaFV> z(=Kg4S=FZ&&z7{yL6~<#W0Kj~NsqiPW}`&T%$GjLol-3EZPs(LxeA-y9fxz5P0rvC z$pYm;5ooarsRJxR%i@>VJxY|@5I1}v4@1JBQ||8P}p@0rV)$>YdjQaVsKt<+CzBe;O$Gu$-q_uDe;&#=8C6&)K}42ll^V z9@0foaS?+Cca+M|#IGZ28~MeopZaT0+P*3k;V?4g3gs!$op?RFS&Wi>wY9Z!b*Ats z;4S=9Mupd$W=h}g{ByBPhmFIiZ)!MRyarXRvO1!1?#n=^p(7tSPb(t8gK#<~BO^o6 z-kyVdin)-1C?P9hB8us6#Hc1}Y+sKj=c-o4m}?0{cvHAzn|ZcIhU#H>U+Bn?p_pmm z=B9J+T;j?Kbae{f;FKn-+VHOR4L0>Zum38;C%=eeb+W?+yHbmnyU=2Zt02u&Yg9{*-A&C4JCprA61 z7R4>*7hRel5V-oMEIwGlwQwZ!m|MI|#omcIV=yjJb2YYLm-MLUkxMHoCq+o!X?(PXLgS)%CI|O&P!GpWIhr!+5g1b8m@J;Ty zx9WR;Pwkp*Rl9rjvsRzsI_9bu*B=(L$WBmbw6(L$YKGKx5muan<`}{cj=I_AV{{?{ zJH-??;CQtAC@%y4)vu3e#rbI4btjrJXb-(eyKoT|^g9)qS8tXLRBe82be@T#v_dBYOIgeFrLTiZK+msrc2 zlvW&}K10l0ofDHrC#clHy$D?H5{-?OW%ky6BA5K)vDG+7_zIhX;`(|7ZbX_!QD4U8 zi3fS}fX@#)IbL@Zp`2=B1HPDtKrI;j25#R2v>dtOvjvC3W_~R5DdxHjm~=rko%x18 z3v}^vGeK4~QQK#lx;p2w-1Y|pzbyWO1=g84X2}_AfGYBIjQ|3N+b9g|Rw(xh85in= z`mGR`K1xc;#O!Q2VH*N(cAephRy0aoqddOM*Ph!;pT~}^9ll2afL~^5TIL+T=ZE@C zxQ!Y4RKS$~^{Xg0S7c@d{M*vyp~RGBZ5`)8b*>+7mxZbyVxKGj?VJ6r{T7%~|E1*; zU2}dwK@4u|ebxVJYwHE3=XnmEb?43FEN`hAZ&b!@sgF|hrj??&&BKLQm8_y4_k26v zw7!%mX*o-X?j({6_L1m&UVRiZlkdq3CA`y8NqZ4gN7SLi?Zd&jK-h>SE=ciEK5Ldu zLIO_H!Hte^;FAaW9;-&uRERRw_01!i@KPn*9IT=1*BCZ?WGX zOVWW|iGG%b8P^dkyeH**>;(-c*xwe-%1~Y{2^G5BI@_rybGAmlJf1m($haCLY<})@fgOz&8@gi@xJoVY7zGgvInj%B4W(GwTg{( zeyFk3;1)f|)pq1*m!OcGvN4%Jfz_j{ZNx>fxMG^N zMq>G&(XZ#W8|vToWuw2b^*EU_n|nDWx9z*CVVk9Es>DFk%OZz+=Z7YgX{JKhg4|3a zF`cXD6)8^~3&VQ#`Bz@?0pF(1_Q9Lkue!1vDx7X3Yc)&}o%4?%QGd4md_hRe4au_* zwecIFN~CvBeX~fHsF=TYlf|!!bj?)88yG@{Z_!gV%JU_o)X+0XVK1GHSskXEg z2;;a*NA06fILheDBl>eYsbBYy#rFgWF6n=0h>8Dympr*a0hql6k{h-c{?E@KIWg2? z?ePDOMTxUJeaao)B-$VIu#DI1r z|0NTATrPMGU%W{GkEdS#l^}9VN!8&B`Lk51(`5b2f3xXQh5vTSqob3QR9tDDonUuO zzn=l%Y<|nGKv3Av@+$;{TyhM<_Kfsv-PHBDZk zsPOcC?;uTiWu9^C&+O6(q?M=nCl7csL3+heDuEJUeK`!R6@FQzZGKx-Q0k(Z)#(X! z!Y)g%qy+B6ftm*I7v|Rc{Y&KGlhNki0OH^Y&Dq=A^o>;?=a`dqIQoGQ=co~LS34Xb zd9D{G|4N^fy;8XHj1D+=wqAzzU!cA3XptEUr-rRu*(PAq{(SWBEW8a_IR2J$S&d18qL|2QHF@yI$h(j89XvebWi+gI#-dk~b% z<(aAzd7ZhB%wy-k>A_J2rc~EM19U;lDE<_R7X%*WOt6zDb00*+iE`g=OIn`~L>oxy zLW(z0%g0!ca=Q;8TNf0Qb4QPwQ7^YSXSOS>6{l!?s5#T5;2=AG9O)39S*2CN(3xkZtpAV=c=Ga4o)^+HabzWobCt8mq9ZPZQ$>^GG#)0vy|#$uMA$8y|$Qp z3d+zh3+rm(*PSomTNSReGYc+P*BGbeh_)HOlT-ZkB<+uHSO=6xR;OvV_~(}Sb)=c- z;>BtB8SjY>v01G7{uaLm59F|5BA@rUgo4C`Gdum-YJTOuUBraX;5Pf)fAvKE zwxK)DSX1B5FQIPDMmA@qsgsTRyvV}N(pTQzyEP(dG{3dQBtJDdS#O_9<@ZUQ|2#Pv zqpe$p{_)_dO8$c)uFEqNu_SJHhdB7**w^RbW3$iy{RNkupwGZI5WDBm-Kkb+Y!6A? z3Z2LC%Ju#IW4-UuttVR30L=~7zweDnH~x0KcCF9cAB={{^9~-{0yB8aA3K5jSrAsK zMB73YC4RPz--sf<=DaWr0fhIT)6=C~cbj|f*7>8HlWtrIvy^n>0xsMfV@m4Sc%-F1 z5XKseZ(b5KX#j%+oMt5>l(=S->TA1Q$Vuy%TvcuCBxMXYoAvk$CCJu?l8)6~+5&Qc{j_bhO%Z(UsPnHLj7Qq#*? z>+>0o?bB*z+!CxVGq+3aIBj?QFR%C|TzY1L`@hX zFE$gJ;-R8jic=SnZ67_#pT8Eq)+T6-w&Mt={?TSiW&X~3Av+o5)RDgUQYft zb7EWuW0M!{?aT#HyTVUQ-7lP)RSh=LOHq0+GFdm#=G85U=sVmQ17c@{-AW`>8IT+- zdq(|rNbru9Q>R#vce2c(yb)GBgIyry9b}R!Odw+Bi0g*E1?ryT3 z&kBL{lU@sN&Z7Z!##j&lK~suB?c1hWh(?arF57n$h%c1bb=^;&&7*Cm1)K>kqrFxU z!H%&bCgSYBn>p25wQzP&fbWa}Djvv%(+FxvjIaw-?P$Q5}*%Mg&8Io&r#^zRpj1`yQPuMZ>wd@_JYIM+N$I zgNTWupZwqCZ)f4j+9k}Gm-vLEEHn@V?j55sKC@_yTb_Q$GN+V`K>7pNMWM<#%|5F4Hbo;V`)>33duVY40sADCxfGjd^hIB1l5@~6y zv6-o)gte3$+d3pWuaaDomyYI^5q|NzN7do6=T>I_wYio2aA+k2r^ zK7Aq#EDvUmX;%Gve$fw+Bc!}^xni+OsFTFMsAn+GJ5bP(g-4@knh;sAUDSY~Pcc?07H zN~;JQZI_G260zrXHH1QiF(v9Jgk)D0XfygwF;Py|jV$r!pCaZesMTWl8@Licd1K9YY#qL< zf6*4^t7mF-OxkhrMiu)M8QW`xEc6Q2ze@Liq=eU@Mco$UK4 z**sj;YqN6uGJS4Yy>F@Gw?HGlO zG2Hn#DOW{{F^wE|P>3vDcd}yHcm(7%qp21nTmcJ%&fsJ+-SaP! z`-c}ZiWVqd@NT(p4g{rNHyH#8p&BlaX>1*r;F1V>)r11&iCqtW`U(XKiW??+wH58B zs6a%IB_>ZmLA@=e4rFatg|yBJEO+*GKXkw%NK!){1&`zSz$fms4mmx z&|<|TqDdZGNK2!qkP^Jr=JrS+3E)TdL!uhBkZq*8^q~ohn^8LcHyI zdz}wdxKeh`k167y+*8G!PoAUzvaTM=Yl*n7an2elf*WkS8bDppykJ)MCasQ-Pk)9f zAmrCVbahhFk%W;H!(xg4L9i_OHR^*362lzEVPJweW9FPJ5VpUbeRe!g#5*|6C^pC) zM|-Ln+e_Nx@Qv%cY>B0rf5E(!jz>+RhU9lbzdL#r^Dd ze+5pkOw2U`@6h`n8e8930zNUdUAT$@R{}wgth;)r&!0sF1tvV&+s25L<3qmiaGXQ0 z=z!J-W1+(I23WsG5qx3)C z8Suh_`Pz6UtmW6E9F6dUR*-yNy*p^mA&k)Q)GoLI{Gv*@s9xfEkw9#aP>9#9n|Z!_ z)Yr4O^>Hiod=TfRyv#f4VT-Z#I_Q6;zx5)o$8RbnrS&~d@aaTV#8WC~(1UWZ{7{Xh z%|m!T3X_#k&T&RSJ=s)^J&+fuwc>C#Y{`1!9r3NX(9$4-dS=8DV~C6+@nDgY088L% zCsxsiVRJiqkwT7Gh%wme*Jh*xSUC!KQZ9BlPeL!c5j$n8AQYt9O0!rT{OE~7i0%xy zk9PPfmw1_QF)KQm%^w{Sf>~6R6wP7Y@DWVe=DC7nZEb973L>$kY7Z{iL&fRWu!kb* z4QNz5%(u4-YReYbFeZL)NpFz>el{_@S=R)))F`s+^Y8av$_By90@ShZ7ahqAN5{tt zJM$A~>shU=tOt78M;F)E0ovM`N3QG%=_wQ?+4#f>VOC~Xs#;BwMFCGI^Hu$%YuuAw21_W>hLe{M@XJvv$L#NeFfKZrg*i$r?g`W>?#NvS#DeJ#hoY})t94>z)q=4*DNklbcRH`wTlB}i9bosjp&hEp6;vD3 z_H&>;&L+0^kxnp0_?Vlwc=cQ7(@D`VddWoz3+#iP@}{PbO|x?NXO=$gY2RpRHmoS|3$ zU{Vb(?=9UU;dej>vSr;GXUc2LF85I?08oC?g4>b^ffxQO*f>K(p8^RNk3o(wp=EQ2 zQK}$~|0N{IA@68m8ZlAb_1_8@Iq)dM*(BoJWt`p)M=q(J)7W99J>?8dxjAnO+J6ra z7I4*xYk?Z|=xYd{6Fe5B^!J(i9}*v;@T~D9Kh`$!>Cd?D`7KTJF#-Jf%ccVU zB5d9;Lbm_%qDtZZyAA)D+`7Ld@3A?3mYHRzxJqqd-}3S@FTn08Olx@8Ir zH>XT>w~S5g2^h$_A0d~<9aV-9{mTiE>t8iJ9!+Chxs^$a|Mx%K#bfy01Dz*&!=63# z`~Txd2q7Fj$0!b?*LhOc<@4Jn@Hq^D6j5NFNB$hQ@x-msDB1t|4h*TBv_nSLLzpbq zuAEE0yKPw-Ci)q?*81Z0aLDYHN}NE57bV=n&oWeA9v(-u_;`5v{=fAFXa14@2rcSB zB6jzKTdhU#IEw<@+%q2?02yL@NIQTB$GPFybN8d(v%JUBkdXytb@JCc-wwA8-rOJ# zW1iN}Z$Yl+>9?dlL0UIQ$?q$vZ8wBDC^I=9xxU2Q)z^mCCqgXBW3uW;+<~k8xo+?b ze{yZybya75J?l->ScJ?ZDFs{ZUNpbqv&kM-qP~i>u5ZErup}siX<}xc**ZNGQ`!*u z4rGf-socc8a*ks7LL4Odehh@|_y&fTi#NJo*Mhu~PQU+Dey+cfh5)<8&2=%nhS?ik zE-r3LOi0y*q6nMKKefeZLwR9zSe=W^r6bW_dlO zRrbzJb;>TWy6k(^dq4IWz4N?ZEt7Q`ABcFxbC?m8U+v4{3KGn_nYh{};NZ&=`Fdc- zb+yJlXnNkeE|X7BCKs}*8uUFDuyf?RT#z`;iC7Z%6vNms#%H07|5XcT{wZ(EOCzQp zC`ao9$BA|2JTC!hLZEbI1C7S25hA(=R&Pk>#xCtt7tO;YW919{e}_CJ?`5{y+sCfa z0D9P5_i~xEu8g(y-8LKzS8EWe-jTyLo+c>tKMNgr0FGC_>|vzNtzG9l=!;Bh29Isihr)!V z=i=sd=&R1atc?zjGZq><1Q(@XnhnC1($M^FFVffBTH5GcpJi1xepA8RS6-_|h-|H6 z2B?`)s>%`q#_g>~-p3O}%W7)mb5c(pbM;($M`r^HQ&b{fk!Y!dmhKQOX^>fqOn6ESL7aVk)Y{u zB?6?kQ2j0+#YwigcU!@a26Y;M+kyQ@PmlNz2?{nW9Rhy4C}EAEHo0wjTYwc(*A>pt z*SG!Wyk0vqwf>YX4Tyjkd|W5ULk`eQ!$`$~@mfvS%o^Cd!!d=T8%J`Fyw_yEm+Jk% zs%7I7(}^ub_r!GC)y%aCOV^L?JU8%8DP8+Au2-X~+R75;n}r^zvLQ4vuRz!Sy4g#k zib-ByrR7qLXr-~X{(ba;-n)qaCtcU%cbihyDZyZ2sD*EA^`;=DR>Mp)bCNMn(>zAR zdAa7Q8ZjO(mFHcI1%g#*nFY~d-BJOKy^8MRsUu&=aSLUv&qE-OQ2jM3$i)s8F6kfp zHyoqCkvDzfDTWDgD~(Y3h%V317y9gUw71hRGN5C7!pQgSLg-L6ZvSe{e<$m*inzW@ zS@OED@JUy@)9d@M4e{O+9yoY}cK*VaS@m&u!P_*SkH?|XBlQ6$G|cFdiw`t&5mh}k zkwOw7ZveZf*X#2&8SK8e*pnXkVo1NAT$bV{hsynSnGfd1rFxC!{Wi~c9$V}t{o~dD zsgDIe^iU0l@$RrLY%6~^L-2=QAzz*6LU7yKED!88k$7SC4&9z3{Ci&_XM8WACxulv&{vLTvTJXI17qWo`bUbKDaQQ)H$h4%wkIq;h= zBlrEbjrMAiT4UP(u%P_9d~J`LBO*CFR+5_Lv~U!+At>w*dIJ(v-v>Ti}VTvDHJ@N=tC zxhGJWF#=<7^>211!q1D7J>ew~+T@`e>e_FlgJu?qh^ufLn+Z>|DNkuDr#j|_6m_1Q znIhp>Nr8S(vVt+9r2bVCD!2BbWqXW2k`g?Of=Evtt>|gMz?Lv3qIbrA^~VH=9;PlX zP^Q=n4gI{kiwkhkV15q>0K$s1E$R1dl7;O>Wixg*o<}#O z?Fzk;N^}(&8goDPyFXn@AfcZYOqIMpAdAzjw9*LG$C!8j1)x8pudA5T- zzUF?+G~6)TnA=h^2|hs*@@0hbY_53iMi0obAG&{e+hm|5cL609*p^aby4-Q{^xVi* zzs+dthevf`UUq_ESoR5nJ&ts+ip%r9wA0o*)HfX5r#&XBtwmI1!+fhBbTca7CdG^V z4pLHvXXhTElVIF7u14@+(Ad~ZBIeA$UZ22tm3a1|%Gi@O74W5u6OW?<| zG29&DrNEK?`Ka&WCf`pWdkDlH{}>j+>^n}R9D!1t1tzsR!QcOEpRG|= zJBzOx6cmJ!mOMJ;5;~;X6|PW#zWhqQdt50}(i-Zi#~EDg)-atAm19mFaPYDmlA=ts z`^Rxj62YkIS|%ab@*BFY?`UZ8^^!oGcKu#z&5SC_K!7i$k-qF1pF?bCB*3N;qMrAk z+`;EtQE3p;9)uK>;3^6kXXIv^XkC0^%4@qsVcFSPZtGxP*Xw0N77+bm$Q6N#6b!kO z^j>{-WljB0I;1VGzfjJXJYE{3N^4DZT)rA~>au6aeRAqvOV1*Zi0$oAnA+~jC@c=y zM#Yp0OyUv$6tW`@+<#g@$KagbHY#U$xka%ok8syWMKKV-U4=HArj`F*@3841 z;{h_v3l2x>r<1r#*VKlj5gp2x=LD=+3!xT^$3bolxXXjOrm_ zChVB6M`&ErgJ3u{twSk>>Va!WX)%ir)CL;6*-16BT>wRsS#_{_x0CX}9no#yi?p+| zV;LUojXQ*?ATtbb0F7%KA`5D|#Qm01OZ-A;whiN^I{k<5<3xZLO*gB!pgRFb<-Q%x z*E4(n>>*HGuS8p6U0PX=MWozA{Zwj`l%!nGEDMl}WKXHAiT>*#g$M-&&JE#zkC*$-yWdS17hc&FIOID4Zkf zzel;f{Tk@+hK5EHyqjtdjq>)9p-hqE2-_1DXZwL7UoEA&=VPj;Q_usy^4L7zYZD^qMh1{l1cl?&JP-6?qr#C!?fI~=d$WrLq64rYB4&jlp zc1A(`V!8V4sl9rIdur&!yE2ao#Hay+PE3LuL)q&uehB#+ERD50^CMk2(7rc%eQEt= zdLHrV>9`>4JJBtcWERDxmIh9>zT2J`RH4pCJw5KzY)^Bm-RyMxwwceac zY!%9!8&E70?Usp9R@O{9T{THKj44T|=w%O{ogY5EBm4bf%Jqm^oS`VzR(iUB>}G;K z7o1!To&^&368nE}X0L_b%zn0kpXxxvT^<0Wo#dHHe~zhxOUvVTXvHDef5?UyQzuWQQ8BntNe9=5-nYOWJd$p z3{PU3ZI+6&=KAJV2BP@8fX|}k3d-z%1;nzD;Fg=u8CQu}Yufyi`nd|z=@T&f)vN$o3{8r;&> z=rr-x(KfiV(|p=cS8Qj$sG-+&ovx?%a zfh_GksV{diAo51l`MIr&tE;Z*Y%fG~7}gKLLBsxc0zV;Yh%##rn`3gwF)W`L(2p_r zILchm@1Nl&O&v7Mk$Je)io*knjlfyKWOrVsLI8ns0r^z0Ml7^bRq9sR@>%CLPM2u@H z7WTfqZZ#uQeSPtZ$xgk-!}f}at7*u+_LHm3u}CG|>E&(jB62|TW%+FPCc9riME{=p zFjtw22)HdONkx9i&Qwgb)v_?Im65T_J-YC;zO6U1)vo2Gd_xs@xG;}Qd;yowR`EZiU?f5gTu$~e`FqM~AKs6q@ zdChY+)fMXA%u62deNh#e?Bnyo_$vFP+ah~xnP>s|X4Kz8egx&j;}t9cTW7<_&4|a3 zz~>tWsBV$~nq z=z;DLL7YBNiS3rUs?yZMB)KoU6de5)>8|W76F?&*y6Vp{8Qz#PjoQS!ck^tRZyes zs@RdqtD&J=RHlI$Ty5%+)3oj6G7-I3T8CzPY}e@w(#p}(&oY)`SNOK@MKlaradTZt zObty@isI&F<(*PkRIu#CqDkqhwzA&_&1b^%DV zD4A{h7C9>n9|6cOtkZq>`Pi|b`$;M*nrgL${#J!?Sct|r3-EnXU~TzUX1=;sfgr;K zKYy9)vX{S-;*}L2|9xv14RN9lyybnd-KtAp#1mlxKgG{QmU!uVUgLQO#NUmPYAW?W+ zzg^-M!%j%T6Ol5-G|Y>*AAo$uKbPDI?B8xI>P$>`y8J9DwLdp#Es?6WPRA^F zxE9Ek9cP@}HStS~%u^j)t=PNwY|=G4M?*5Bf)AIYq^3{6o$=r-;xWQSp|W37Nfoz{ zWDjca-_+Y3npFG!gJ!y^m9e=5$q-AEvW9jfnv$J1X{E>%{B84KMdT%4gil7svE4^^ zRYHu)(l*p>=DU2;q2tJ^w2K%gjdUD|s0&()e&orbV|T-tybC#R_|)k(AM%TmhWGB_ zNsBg6(7QL^t+8F}lIAuTl{8B0Uf&L|SX=<3seGS*Y@zc4m=bMr@4P+^I8 zIDsY*tCmYh=6sl)6!1CJ}WsFKMVYw*AJlC}5UaaptpT#_69w z%c<#YsN+?4M;I}GMwW6Zxr+iN)d?T0c$Ad0eud=FmRI&^qSLkyl`=?EOpgWnt|EQC zTQssWr-408(jc<$JsS6OsRH9*WS2~I`{;Q+^W>9?cx;zZIl@OC?nD&ytKP9KX#Vs7 z;DjL&l9iOiuE%pr)`C~ClgHlK^P z8p8LUQlR5V4#mEX0`y<46Cv@4Rn$xHUl{)h@c_aj6ciZbZw+dVs?HS_QChi$}%Tf`n=5A9#OpF{ljx~Y&9)>(%& z#K@T-v7tHEyz`bn;Ot zWKjlPw zZUZ`KO@%zu1wkQP4sqly4AG*Cc5KVrIYE1+PPXD(8y?__G=_Cspl9Kr1}f;r2liyb z!``inhBaW2Nl=A$Sk>NNL*n=njH$j#P0^TGT#tqTbF{b9cSqK5i8oVu z!%e&)BH<@CDd0G!AuSC<9^j4^D*wjg{TDV9@%_Qd8`0Nq@~nJp3`nK+nam93AyNof z-GR^P<~(lOXlfUVfT^j!$9B>HQJl>SKaW@FaC|RZ!a`o2_CIIa3EH zscyxM?(;^bW+ZW69@F}bGBx^Ef50yeDv4@cvDB6nc4a1ix39Dre@Z$cPADp?ll@>QyPqJVAO@hE?zicO=lOo}*&wWGcZ zgJp-Uv`xBsKQZ|Fdv3@Tl$T3)laR+9FT-O`p1?b9Y7EfP;(mj&C(%=fQC`F0?xmq~x3WACbmaMPP>v*)Q83eCB!f73sFc|Jsr?BUM!I4SW)oD?z11VOA~S zKV-i(n^r>SBY)HOnv>AC%mi>Pcw4+|J+$xs>6Y91Vzn5`^Rh!+dj~HJacvzvrPZ-2 zM8-rRZ%!_naKtI5CH<;u`U0!JB?Ezx@^aeeALMo}3#AsOzp7f!ENf`i9p1kcE;R0L zS4wp7Coe^X6w_H+{uC{w+^zD>T9U`xF|ZFPD`+7F5JO7==_iiWwtfZeUu$T$J6%r` z$whMZZYmK!Ub$G^COXPhVZR-q=KHKeA~?1~3MkoI!mUp(dL`94AUSB!F7t*i@6f&Z zzHK>Y{H~-SVaVj2_Ppuf?oG@oiAnmR=I+?Va+bnb{AHD=X2!Ovew@tQ+~g81 zs&#)tobBT`X`dIJHE@VZ#5s7$>>eBeF;mk#ya5+7$d2O-xz(dM?CYxE&ajRzw7`4V z{)N&Ws`PG#7R53$)|dz4;!bck%`X0v%R|g;3gaOSYG3b~95n7cpn?Q=9A^Xa-dXj0 z4?nxc6yap(68)v$lc!M`5XlgAl)0a6~lGOEcz zrl5&!6~k&^nVGB$DzU`RiT8fCM`T$c6f{mxU5Z+{%D zBt)gpFRE)V^fL5-sx%#)yUVj;d{f`?L(vqzM2}DE^#}1G@)=oOyNt)_6q*j{i9xE+ zs@Y8Pp~o(2l4xYZmry(Sar*Iy(6bYiTZGF#BjQ6Bjxs`^VP{E#jQNz3%2vQsk#j4B z8Y>@H-}o78isOaFtI4b`3aB?}@~hP2j35IZ9wLjQgGp(@XJ0z!L8_r6tQ{BdecFhv z|6`K|c4T9@U)gC_>jvm<3Y(#I>V*-T(vrHSxH)HaRSPCe0v9L4$kXyChMor`1q=|$ zDxJ5aT8V;sA+;MmzokJ*K?2mX{Gn@Pn_3u*QrvH%DosDYFb8l+Lr>SP(yB2l7feUo z*&EB2ndy^~j5YNr4BHEa_FNg&Kn!h9qdq43&hY0`kc=7ka>y*(bW}|?OK~da^79~K zTy<1%GPLG6`C$7fGk;A~T>v9VSra{=1wD<_*V!Q{x)!I9P(*0N^>i0*V` zS%l*r_sKBmnVItuM2}*=#@j!i*}58~Wz}$8-w**U80fT}YuS-5bJ9~8PR`D?*qe1p z{seUR>Oy~4fR?*Q&T$Rak7QXK4<>Tua+%IRiwm+=n_s=3{by<|#$2WH*~hcqcqbtO zPJ#P7AxOGq{Ws?4Z*q0kON`rM`bIX6Ng)@X^_IJ$HsbhWeLaW-Qlvl?JkARWdUDBJ zma6KcaABUS%0it0-$W`w+(fQsX*D2S=-`3IYP;ebo4BGHx4`c0UP;J|5R1H7EmZVS3_rW9TO$MI;7isLXTGUTLR~6>(iom*ZtkCnv(GStFyxpmn>Sqjf-^Ss;Yb03 zUgCo|_^a`Geh+*?^WjAoQeVFUXfCr1Eg>sAeaRxNPp(~=2LS7t5ARZ6zcnQ#rw`m& zaEU*v73@4MhvZl6iG#@BVrhDQ{|XEgrmdhYt*9sh5NK#>@?c`7 z)VCCZV~-zL+2(~!Ja8uS^PJ-*&F;~sy`+TbhB1gn;*S)lseKY#-#{jlzMPxxEzD9x zivIpR;4g4xe`j5Ko_aVo)|RMpEkf3Y)-@oW#+5yc#j;HcNYLVP-MXJ4D>}#}&HMlI zK_K)6>_oOI(cFe$atQ?P`0a4Ju4m}9Z3zO-#tP)un+xsj8?bXll~<$69wt5z`-CT;$bU9t2gE2ajlC z73VIW|HshlE}V0!)%>$Jd)5biKDZ##HyyI z?2{8M5;RW}^FwBcVQ8ZHQNnAmu^{-Eg#^Ilxqlt)3{&DW8!p{;udk)>zsV(JAs!Hq z=}nfFmR3Y;BpN9Gr?AiGFVB!TDZJqcI&uzhICos;Uf{ zE1rc#MgGi&(voIrMQr-h&8s9J7nQK35azD4)V?p8!0LYHc2x-fTX^{w6DuvAM$V+z zL8yhEjw=@oB9$H+9gyn2-&cGpB=aSAR`!#m-}nQuU|}=|TY7qGJ^&Mw&_by95CSBz zKnmoD%5HA&RH8timSCDFV4Nbb5Y_{iC#0X;EHN>?hLdLAD*~lbsl42Jk6nq3ET&4D z_%K-mdv4Zz2NR<@EXo|?r{;iDQCfE!^+x{^B!y^fe7&=ECM_L(4iPbGd}@NV`k`j$-#Dvxw`{kI*zfQWlBs;)9GGWJ6AK)7K*99wt66wuS)7+$?@fRQOn1H zKIyWNv#(gACwgThqBBqB2ZKS!(ERGEw3&D)c;>XT(}$L>qO`gi0#O?ZP-1tN8c)cd zy91fCu|ao^UI3-#sJpYzP6%UV_7}g43Nkqjp@Ky2B4CQj+R_te5oTDUcg_u@O9&dR zgP4iA67lTc3+a676ZG;@cHE`LCnmPHab+BfXzANju8X{y+so0?CsJ5!V&5X{{Z7|> zZee@={Lx6u^?ek2I#KT)U+TWT1V3TQ@?=j0Y+bKR`G$cMEoAHeW`0~>`iK=izx2HE z#pTxZZXFSBax)FA2k!i^eSb_x2gJHNU#x6hL*UO$`?tMM<&^siONI$DuzG_e?Meb4 zn<|HebMt(X;WfAmP)p%w2lShE#V%!_vr+c_r(Mjnyd32xg-Th&Qb!b9V`l(Uw#d+* z%-+-B3Lw!*e)q?Q?b;xidc~6G&MkRo?|dW%{BVCSdw{Ltsw|x0S0gvzW@u$+N5Vq# z({F}^g(U(M2#VWdIq#+i_?@W*m;KTq0TAkTIT`#omQ5NNf%n8IZm7^^0EjFf=J#}kM()r9WOZ=cW-o@nE|@xAKYf}!?Fi36P^Cz3l#eV6`E)Z@er!eCC&ms< zQbtivHNUDcncNznTQ#X5&?)S18>?|CZQ_QRnK{OtPSiI-g`(}v^n%T0IpWgG%dNPn zZm30FEl0%u%}$vy7HBHOf0ECYJSE&4XQ;Fa&3LrM|OS)Tb6!PA>sq6UCss!apdqaT;CZ|4q*D z8+h(9d$^+g`ZBILSn9-rgPk1>8(X6LDzy;%yR@|Q0_bj=znH=BMIW{&`}(HO+Fb>B zGeTGXyP`z?UF`P1=Bu;`-L>G68I2%Lo~vD$ce_c^;^NB~>RKIOmVOzq zBVSN4^L#mfn?g_C?7xXb8{bZfWmi#BS9f2b^SZ4iM#c{wo|}EDsfcP>pGjCoAq1vf zd?0;1EfD7)=8_7;+*+$#zKA9OSQCa&?q z9opSvB-*m4mOu2&`n%=V5%xZb;CH`KbCp7TLHWHZE8>NHGK8{~XI~yJe>+xT%>jY#?|EJeiL9S+=Q5Dm%p|-ye zkn~*QJ~+(jW2FxpSKxCw&o3K61o81?7T+nzS!JM~7>>Tr6_3-lfF{U7)LNJels9Z- z=L-#t&gl9F2xXnsJ7t-E+v1B#mqL{=K&5K}OWJ7D449ntgzQD^z2QS2kiNPv7#yC8 zL6EwzSbXJ$Y0%RRW}Ku|uADZO+aX;l0qdx#Hj!GltVL@P= z8_JQBlTY$3N`zY(fh&p}kcxFzMmX{RRrS_kZEer@a9e7)yA^kr;#`VDfZ`5?phbf_ zZE-Jd0SZNn26swuFM*;3in|5(-{IcR_kEr>|0daI@7Z={X3bg^t*`C(#hSc6U=x>% z9l5!_VU_k`)`tldOm%^XvjsgG8|RL8Q28B=1+u;$0cHZ(L`=BT;rvp8kLh+`C< zoD8|{5O6PK4491nwX@sXoCrMjOrx)jEU5YOU>Z2`bcrlQWc6zA;X?QJI0j|UfAfjt z-Q3d2Zo_`asz4`p$FVLHOCzM*NzrqoH0K)aCXRZO>EWEKHJ2DEqV`|Cjbev?$$Oz&pQ8oVKbV_;ZgVP| zSrTHnnjQSrV;rtksjL(UtFEHuKM={8HlX;qGE76GdILdI0vjV~1&NQ`1sTgB(aVu~ zwIH!IYe~HQrcM%}u|~z;VJysB2pGC9)8_5*o*t{OK&c;sF-8y zgO^YIPJ&zShHi-hX7}I}>BEssbKhq1D0bh-I2oOtZYa^)w1bjwjZ%$vyUH@&>0nz2 zSr7NPk6~zU`!;w{J4f~A^uTtzvJM@$pA2iIgYp)}yAX)%=KB{@n?4X1=Wjpi67>R^ zD2&=r)e^-nB+z8(#3florjrRV>e0sr22;YL@pRUeE|$NVoW_$~4h$$Zop7d~!pA%k z=PqF|$arCZo*CKr62Yj6t!lK-m)8y?9WI@A&So4Y%91=2FWt0t=D60TH0om)= znXUejr8G3OK&(Hbl~I!H!Q0BI_MShu{ryY>^ax%gBn9q1cS>JlQ5-4=`ifTmugfG0 z0Q9}-4{gwGn@-JxC+h>f%v}D%tpluqFb0qY`Qo2H(SUn#etwRu`Q05X)3luWe7EcM zgd>n;oT^#hR26-f24KxyN0y=gBUeb_Fq5MAB@S6U^R(2;T~B@Ji}NS>DmvZ-B1_fGCTTh%-Pf!GSu%p+OO%^d7M#=;cM z5D(-t{oT=fIDgpZL$(7_KTx%k|4++cvl=BtF-*7he*y)DO|(GwwbLB${%5-^4si9d<{fUTkVajMMh(q>sfLaO3__{KD^u z_a;<<%`tF(0dbW8si(=w$u3anK4ZwM6s$G0(#h1+_Zq+ZS9U~B_!7(7Me&Zqz~Gqe zZI-F2>7ED0DMv{0Hb6E)v`A;t@t+U<(F|=C&~W%@)|^F^s8tnRW*@18rv!v;g(GB8+UHRdb3q|K5b{FU^NhF0PM5HR@)_ z^D^~xoEKK$@0@hH#{5#}n;>0Ua6-VwD?3Hj5>2NLIa?R*6rGJrhSaKNq3D7-9C{ki zl#WPhh;5^A$kOe`)7Tb9Si6{7V@ z2WQ&si8VUiFlA7>7W^kbO!9}u1IjJVDh@^h(l`4=g;24`K|5R9!@Pz{Kzo2jxUm1{ z&umg=V2N5kZP8_GNcM!)QyDLt@7rY3#?_Q#Z51lkzAyS}*|+zK*UqMM3iDh)=@FwCJv&iE zBmAN%-n|3jvSm@HSU6#o3fZ@KF%Kp;9eJ-!;ne0I`s;(~Ii*l!W)_Dv=N#g#$moAZ zfoC`+GsvKIEtyRcEVBEEr(|PFO^6g}ZuTXmiZ`E%8_cnxCL?QCO0!4_8yEE_IqY}4 z4gRWtrPW@Eve8@!ope?&&_C=km`KiBu{e!UId(_Fr)NnpHOY76b=T?bCMbo-_5bc3 zjx7dRv)DRzUWve;158~aJgu!i3&bnGtrCE=+~~atRp?(B;u$XVDalh|O&!zjH8;mc#IVT@7qzHNv}crHn6Ctq^(cBKjBrHrgB zZfZu)uMd*BSUy{ZmwZiS%)rKkXGt-D4n&8*J_CGVn+$Q=f@qrcIE6o&8TG^K(U_8D zBgr+2i3(%Zc>s-UW@gq-lU1>RahAq3I|S3*9>Kh_&}G5j!a&^VVy(P8duQa3g*!N! zIKW+!W?j6y5xO$lfHCWH_o2S+tF%*gK{0>kw5j+%X5d7z;Ay%+@JE;I?4g{5jGnb& z)K(X}{-fH?{>9Y6A80VixHS9m zO56Mga2p*#YJj~QCFyN(Qs&B7V1jXJ`Cq*m5GDqN6d~2PLU>!ag3oKGhw2)K$8@ zs$LD=HlqP`cq*-XZb0^2Ro>7FYd(e=2^xREN)$P5TwQDIRT3gB6aG0nSIQ0t&S+qP z{X;gW3AlFh*Pr(R`K*O70qaY%_6pU@>m~LdH!H3P)#_pO#{Tp*p!IB zn;YYPt6#X((q7_G

uL__wJA-~vkF^wS@6v<`0b+WPkLf;8;pO7mck_mqxXLfcsD zU+tcjr-1lPweyClyTclgTr*0e68qMPjoEd%2O*~VbwTrnQ}+LU`I!xFF~S8!@eJj@ z`{(t9B&ykUR{I49VPVrf*&pdHu7?U6rW)aSH7$Fgp`EKtOM7zz@v}}n0|RSEN}bIV z#o}~aWx)Yf(w-W>(3KR@kG)Hqo+{+z(VTyNRL%p#`ZEGZd3|fb2jY$^o2pMe?{`-c zxc!&jM5|G|E;sm?G-#zUk|oTzngkJ^wVsmaBA^7-k>u-5SMi)08XCnmq)D4hp`y%O z#rbVTah(T@yqbI@87;JSrBM@Z^;2KtGkSkb@)HV^YVl(g>r|*Dav+sh-rwEZS~>=Y zM)K}t%FAR*N@wWl&hpY%&gXSBDeXxnSHNV`9J=~1pKV_?7n} zQU9bL`jV*!q0$@HyKSqm88W@dnBS<9tf%7Mhry!as<4!83^isf@X0XQ?$gU8cf;gB zTTbudE{mdL!N&kq@`}|AzJK5kthS+RwoYFjAnZ2peEC9U!oq{Sx*n$JK95nNa-vX5 zW+&&>TOKxtx*df}Zt+`9lh&XAJ-0}^g3>-lmvY19$u>}rn4>^%=JRtne#}n)h)+Jy zgIdxvEM)tyY$A;(d=kAu^jwl_uO|?z1dLL;4%zE%9G! zyr1!j#LS0eKi6-gwnXR?NUcV)+vFitjosdSl1(%zTm2`?Jq?SULj#|zP5jWE)UeN~ zoBo;a7lPC?rU~7cndOJ5eSD#PY}MMd$!5ihe&QGVpX-)jT9DpBORFxrUk{T39uf z`K{6^RM%dlf6ug+%i+_`wmZV*R!~JW%1wDCgD&3<~@vK2Nhxg6`D|>Li2##?0SU3>6udy_W->5 z&q!wAB}(dE7SFVBtSjj0zI#EVh#usqPCS@Mdl_6H+ZTFdf&5c-o*dvN8ajpR|MK^~ zoonn{xpu_GP9cw2Arlw+iAV2S=C4s?6-Y6@7`+`IJbXvx_a34c#K-+Xf!zbMs3Z6{ zie*~9dZl~>O!8)S)&n(8S-H)1Pc@bOuk7$L+g|9|W#+msh9e=`$S2b1&u(ua4a#3P zjom1>srEXj#uLXm`YbF%CfddMONR_~#QM9ijD@UYoh5v}t_?!=su|bZ(|f+loR-6Q zMS>z~?ZJdMm$)=bf7yarIxI6Lr0#|XN`sv{U2@}GeX+jIi4FhxBX$BFf%@%}2#BMk<%l!3M&jMt^V{MM{>pZYlm5WS z?%}+%A9ebp?^$MzIP55nFb@&8ZL6$*)Jo~_IwERw&kWONbDE@71wP0Kon&TvHjx=j zm4X~KwBCk7!9M1Z>)OBjH2UoDW*Vlyb}s9j?~BS>+R-t^waK0QK@%8v)DsRhFLI6l zdFv=R)mt@DN6)~6hk|0dVSOzGfL9G(iu@YqEwt6)c(Pk+ggj*Qc1}Kv!9&K;Lz%jRhy?;uWS1OF=VJ)2TB$xuuJ9a0G&?q^x>G#*zXeMK;GVwsNf;v(C;i z;fXig!&$lIme99!a_OWwt6H}tQG8Jp=R3Jl`I*K>)&UTeThkuiV)VYqA!?LIVY5aW zz@}5(*<&W$>wWc$d(9{C{LTxE3c#147&IiUSREdJJ3cYpM^_&_I;h176^V(3i5pAP z<-eMN4E%h~LCFWm_$kJn7CMo>EH#f9D8@6HdgCa#82v;1YkLL(9Dy$NS~lDckbPr` zr_sXTKx7cY(@&ah$TB84Tfa`-zSjU^0GVrHv##$}@#L_cg4j#69KDrZ2bFMMGs5|J zU5h;3NIXjux3+eiPxE*dChUe!e}BmLe<@D$UfnyUjB{+otT3peP$IR~nAFsi5urmY zy+jWqCPWeEgQD(iXv`Jg`mwXO1u=x(uA7-7$~lXQX(ZK~?}|S2 zYLAHNwpj@L^b>y)6Y7MzbpVGqXb{_8l0Si|mNp5ZJ(E$jKY@5C_ulTXFdV8hZt$Ny zcc@GaxDgqsPf?!OoyIkPM1|V{z9>-rH0(c>y(i+~VU3!ITz~cWMN1U$UQgyX=B%71 z_CLRMXoeGXVE_P;fWq=+fL5>=zhnG=T7Hh;7Vf)W2!Csg^}Dzu0EeyducBW_3$|if z0NB2-Xp9V?#{QK>RQL+JBouis^@SfawEE#Fl#yq=X?b^xsq z$@1vZ`@~4eHEso9Eo$YSvJ!tfRf<9jbNKaxz@0& zs&c;-tOwgm@mDM78BMcQPL3+=@BaFQ)78}_+Pkr_k(SlgJp6wR{*y@dkXLA868mHG zxL7Vb`eXCzxvzTcCM~%_$w7jwtFL!~pw35V7aYD8>dU0(;!@2{9}y9e8e&%3`hRUa zNen&IDP;1dYtFVNn|3BenU5EB(hy$U`SbTU{AHoMe0pXZ;+JxagO(P7zrTN3Ma3ZI zVOIV6x+S1MqoAPh4IsSZT-EXRtl|y<*f9Z%?F%Ia+uFK(u?A>pgrAo=a(DQF4fSR% zY%!C|9ZlYj#DL~J%q({we4W^m>AcXW!athXJ72PzC4>&;zcl<9Tu^^5$4I@jR|XAG z^)lu|9-Bz+-^|u>+lD*ZT^sMpE+!}t5fJp}<-Se?A})n9VYM7)J`&BSt4}S|N%UJ` zF`NzvQ3(~zC1!{3Cm3ADk_++zB@~PJRX{1h<*$|yMKa#R06O{+WrzJUdq=Z~o-3AS znbn22+^jN6A5)#6_iYZlP-Ca8LHbG-F0MEr+O_-0vJhL%efOd0^~6OC{A!X%F|8HI z*aI`{5p7IVn8t{4V~!7v5}tSHGZ_w5T8i&$=XL?f_CKWoGx7pEAIFLAaSq^dW;?Nv`-aUZ>DcK z!S`+Hs)x@swf?r zZK+abXliH%X(c9pC9O2qo1T-^d>}zgOgu0$(gx#B7eS_rg%R6&rrTE!Z^o^+q3aJvcJ zCWL1`$9#XK)5(GnSqqUWoMD)b$1@A^wxDq}pZ#x8V;4A#C7tasZk6g-YShYhnySL|I9uQQTyLTkDjlVE%dj>eO(bbs-#1NVw4(8KA~0pbL_ZLy4}UtU zsA!-b$ak4R_q5kNjR9ytuFRaB-#aEX%>V5d0;>q`d9RbK2fdRCeML%@1teJ_(!&2? zuZx9^{mlBJCz>5_z#&GdBJ4Jr0FQRYYI6;(nsKg1B4JZvQQ0x*MHj8Ht_sftt*jL) zx54IaTgEp@AiROSy}jLzTO8bxAggz2oC@$YSWWPD!+#r9w4dJ0AUor4(-vcF1F%1v zMZeM{)5k#hBeGZ3n6Fx(r@$P2U9*SO6-1#Xu<47HO~92x;DGI$d6W8 zT-*NTyY(Fm%|%MG5bN-bDCbK;4S_EA3p)MZ{bZs3N8gUp7(?YMfM9D(GTB~zy&#|z zwB(Q_?xtIaoXf%bx-d8Pk0(>x-Q6Tn0l2I@DtihwTk@j}sEW`>Cm`BgHy3ir-*-XX z+y6Fky$ATm_y|GQY{x{cqq0e~>f|KHM_GWx-S^LuqmGnvJ>FIC%*bb#mN<#(! zn2DFuxsa&n>cIh!6MB1pe;*ti?B@qRwWR@JlU)C0L7m8;1wC%}tcHEKTdhMPGFJfk zveHRb69r~SYWKpg<@>(sZm>& zutRD{P!0oe*AM3tp4B8ZtmM3r_Qe4D#KGL9lSMdv#OFz&jv<5jtz8E~sV*fSw2Bem)jgGp2X~%h{eN3 zeQCEu_*OdE!g*i5Wq}f8kCLomIDHjhzehi0Yzs6tN#Pi)Oq{C$#intQg!!52zq7AL zSYeeQ6s`cQXM!TY6)?Bf*-wt1NUsF2R!>e(n@*FFWp3^5_|1Tba!0h!&56il>>et!hSg@R zEhv2P1_SEkiOH{8fcigi`rz$NqH#aNiJWPQJk&@@%a6KF(IiOBxs;lfd zEzmbOg(NLr)K5Biw4KfGTTK|-dFN4Nz`@t|2|M(oBhhogEuJTkczD=quFyZdA6)=Cues_;R0=-V+Oir?rdXIKwo@flgh>Evs@ z;KDIs<%vSuiE=hTB=>RpMqyV?q|G<-RSI^0%{5Tw20Rz}WrQ&_$!zw>ES59k8kH)e zl*e52b2&?v7g-pS==3*s!M1L%qE%<4u) z?C6>f4&`FCUgeJvy~S4UyZbaOE}xAfAgZ`|%ZD1Htn=^q=6M7e>`lDr*+)?`7liBi znF95VSeLZd2^~r&FO@MX*2MSu=S_45EC9l$K498h=YtimF%toP(Ta)+FCU*p6SD-y z`W1*mM79_tqTv?Z`!`)`O#tchKF0rEZdg20XHvMuEe`VW810g|6}cqrA0Xub2Kw{o z&n`mPw#6EFg_Dz7)z#JgV`D}6`D?&?O+er8-@o0j!g>KQvwcm(8^tL4+|~+iaet*8 zlupamZS9}7OK#7=c(VX>@8A2ZqN+T%HH;lPIhLjcuN8=HxQl5muax-XVdirX{Zt;# z>NU~wY1M=!xSN5lrv69u+3w6#vmMB1#E4gMhQ3mn*Vf1G>ZZKIBzt}zd2aV(e~~S2 z$d;?fP^W-!-X!x}XRhU)qr#IS=76hbv>Qu?uC_w$_Hd>-o~1UXR2nr!o`8 zhkz^AbI9BrA^v4w_kgtbL!Rwu+@!QOf_w4I#BT<`97@;O+S($mWAmNK61cT>bOyQn z6rAqs8XAVifZF?;b%l1s^i(Ai2=VsG5(9_}DzM@u!{Fq#0ihAX1`|`?e#bw09n~w& z{_^4%2mXm6V`a;nn2bT?k)9vz>g#aTq_F2f-GSSl>WjD#ugEimEO+`vxoDv=vgAr~6@bdmx2zZsO~ckzZ51Wfi=mYCk5PH0CN=enm!VCrkOa6)Ynvq^&X7%7Ij?N5rp{gytjDWl#A%y; zcj#kwU~)L*7(8HdU@E|6EQlY?fy$*NHSlw-uC~ zD@}v051EYlU`Axs@ks5g2`}%q+OZ+qHJ1|PT(jJ~gB`U=Jdexu8+DzMKR^6ruDGbf zgyhY$w6JVVf2<}W!!`B_IgltbF$gD)rR>As8{~vh6^U$WB3DRZOujnqtmMEBddyYD zvDEs|!=B z4^>dSe)Xp=k$RoXmk#fSo`1{5j*HsAx4`eExsc&}ZsF4VHcOgHvDJdQGm)rM%z4KE;{hx^@vsb}ia6B+Us4aTd& z+nJ#{HWl_^t(r1a<6;i@gNGbJ7B}DBUsr}(z7kIy#~77m;y1NV9HmMXy0;*aeZ*k61q;lfUP&6je2b0i8*-p3oFBJShNs-eqPgc9|6_i|@(>=YJ#p z8XMqD)N9s661E8$= z1zKbui-e0+>|k?Y>{>4{m1C=$cP{ABE*68AEHayr0DV*RMigcbC98gVSU}l zWeWs|b1fU1;_O?xVSBtMR;eXIy7PPLu!A_kr>z?Vov2F|qfxFdO3*NryuH8#WF2yy zN0~ai`kZ)^26|_n!zA0hDxuiQF<3h-pk%ZuyFN37zmC4Qg9Hb?A2nDu_p%qmrnVtkR64N=iEjoDq6teX#14Mb<%y>XHe+d(D} zBaDGHKj)WBw+Y@|92!v9Kw)f_j@?;KWyoTgzt`MiP8-!Y6cZ%N#ZEp^{4AR8WE^`8 z*PS6~!hGp4{ESOP(H$Np&o15r^9twnJ^FUpp`6ix#M>C?n#%hl2(P~{-B%}9$Nqhu z*1sC*-7!S<5Pt3}Iv(JVe)s!)CS^9l-?+}i{sxvY-Ll6cs+K&fw9)x}exz3#D({)B z-*Q})%)Q-FwV+c`yXZctZ(bBNAo@hkk!piE2CgqWEQc$MhbdzKdz*>0fKA~{??&7qvb zt>?%N#(1&SgaMNdbCVO!zqUMgu2CfIEK~l*LvdVomq*D%8$-Gw{wg!m0{&On`%l`P zaNyEYsI7mqNACY>oWDpt&bNEnf#dC`TXy5=AUWIqow$2!agAhg^rlhG zWt}X=65h=<{Ds>6RoSZ?;nhybh=&Bli3EQgkg4Tn1?*&AWsPpnR3^Z*ajU0e_wwOk zKg-%xTQ?;%utF?<**7k%k>8#xyxV4_3x56XI5HZC z`N=bSUdEZ;G!L7WKj5*jl8h_jSi8jwgJ^XSHI7z`Xn9fj!2SlQ_Nc&RhF8ycI`;eQZ-; z&{f#Xo3rI9I2JPUBhi}IPAaDF4Y!xPxI|(QUQLa@Rc@Oy*5cQE>9@a@I3rl>Qc}^e z29&R2kWRAlmMhtOy!bc6*rq+EDaO3@dD?Qz*MW=kcL8|4mQ?jImG+6c%G{hZevE+J zIZ>tclqvk&khcK7q5p?3%ih;aSC-y$ep8--`R^jSEJDN zFw6It}QoM4$Gx-&_B?XfX5Qh6nj%1BCt zHgt%FJ!mJYrtofG_SSDPzM#?3e3g*2ra?O($|2~)xt+p@?~}EQouxvt)IDJ!j!K0H z+feK~KL>1jw`JD>$%iJ3>^qsMoYp8R0Tq&15 zQkvYEE8^Y$Z4sak)N54|B&Pmq-*3A= zaPxXi*YeLI7OBZ1V<4-Yf4HuqEjpF|-?n8-2i|%l#WN&>{)C%aea=m3e$E|85E}3% zVmb4*RTgi-b;7ViD@*2_L<+Qmi(&Pac=6<_f0A+9CvNNk~Mow(q$gqO4v9s@pi~` zAmu!6JqzqFCc&j7mf?2}mkawJ9tD(jpS`Ta-RRLIPxL%6yBkbh;) z_6N%e-`D4<^hA9E7;pmkiUb=w)}!&^R`H1<|-t=ej&9$-m$+n1D&_9T3ap%^=534 z;(5av2lY4Vz~nEb4=gN{ISPmYQQqAnfpo1U2K-%~Me)`Uk8S}YWPQ0~&)7ekn|RIV zbp%Ea27*~PdPD*XDWqYQgZZJH-lb3bPUY@o_oi7Uu%)V)oRrb#(gXL|24u+*Tmg)V zMF)d!P&=2)1klgAflHBF=%mTlnYk0*`VDBboQK4ZAI5SAPF>a$Um#AMn{I=vnA~`k zV3_#RY5fQZhMXoY(ygVG^PB3w{qE_Zdm>o+7sJk}4gTQyFsjmw!@<4YAztx6sLSt= zURjIBuzaZRo1yV3nOfnBgVy1nkfF?@S5HP$1Mcx>e|e~FP_^wikQ;|A5nI$J?uuG0 zN028(gZVfESPdcB$wEu~P|^Bk*beGL86LB_tpFe+;?^WAy>T3Hg} zkYmjKyH})iq|@Q@VGy%hRiD35@o1;+do|4LrGh$QgI`oG2Il1bETo2qh-e5slepY( zes|6JV2I@6$mi8didZF#G$U7|4GY5lZw0P&vv?0B=vK+#YPO_)&)k@Sw>`U`QNyU(U}1Pv^Gq6ho6 z&lCs$u-G9zhJHZN6bD%^Muo+NO|9~STQ`+Glfb?V^@r!#W3vYIs527o$`znl=<3gD z@ehV#Y3XDMFXkgH^*x%(Mk-JB66z*I`=XQloN_MLjM8K67*^Umd50_nD(VCS<2=i+ z=A+s?j{FkGH-wDB;^KZ@+`MsAew%pJKm9>u?rXS2wTj)Z`rjmB4EmM}{@wK@Gt(^| zW01wBQ(R{Zyo3`A&U4dda8X&eDNiYq)dKaJha4=*!GPUo?YpV?k0elYW}z-u!Y;j} z12(PZwI((>OzKH5n9+%rAYS$hv622vUl?*k8e(x@PixQBX>P z{|PEflTaZ}j#>J2XkD(7e(2o>xI=%N#>uy}t5&O4TmXCiS7Dik{^$CmH1`+2^enzb z!?L1QNTEGGj&~Q3@wD`8t`p}!ytRp&2KaLvL$03Q4o9QODNM&RTvVGo0h8z7uyMIf z24;DCUM*#Y?$P$si0{!ZuCu~e%F=eT^=j3O;LS@gm62izZtC(Ib5^q zWZQ=bC~tbI`lsVPs!Aa!*J~4N1J=s;sIf+pjy}R_m~&-*l9r+iB-x&Gj)@%Y($zH9 zZe`QfkgB53!*Y3s9g0Hl*)=Ws`MgMCFzM4pVWE{cgU@KrIk#rj$k=49DVC-N-}u3B z7}fWLgyYu`mU*d{65laMVfIa8=q%zL{>By&jhP%x7hJZaV_Bw%5NxCPq6_XbWe_Oq z_U)_-DK%4(kYdjOtEvG68JVb8Mv5#Q_U_}>6fATEEjQ8znfi`Ka8FS-MSrFIFxQ7Q zUJrVqU$jO~Hr?fVMY9}Z*jk!q>WzzePp2JfM$-H9b!2HUER`qif`y05^^6kC4;BCm zg5QE0Q;taHNmtW3csBUX?MT%+A{91M|Ab&4XdExL$8KdhwMTF=PCc;|EHnXirbY5F zfIs#U#FUVYC`coc_!&nAeCSjL`PJ5ChIn6C_-nlAX$dn{gm7zV1qZFcKl5R9alZ`h z)p$FK*J}b78cy3oi{QzG8S*hCCx|xW&*G&*c$1+Z&e>kPKs2rv?K{N6VvDK z{Wz>m5=NS6Ov7Wv=W)Zw(CgLf)9d%vFb{w0<;6Y29V_hv{8clfP01yld0vy=33xxw z+qe5qz=3mo8BeKEo%PS04V>ZeKk&*f(N?Yfwi%55YnS-h2nc>K1Z zlM4btCEE9!Vz10fo#F{$GWx6j5WN5FBU#vdtRvgqEoIrQHdQt(T04X$*i?1z2~(eulamMtmWRoG+m z2~5BM3`Sj3W9)?0bT@6MWKgOdi`h<%gs=FRR3jlhp=`{YTw02Cb#>lZOcbw2eth}+ z>EGwjF<0Ov&gSNN;k=v zUS)a$8$-&`Y3N*gHG@cB4u}8Ee#3(Kj@nedtBL_)HN-tRn~g~|z}9w*kU+F&6xSd% z>$m-2ND%JxSA*ObT_hy;X*+Rk(S5Finy>x?eR8Dh~N1;WM>0(smIhS-l6{XlVpz6_m{YPK8ep%Htx(i2l~7#Q&0y z3ZF2ZjgFBlfQCoeeAs$#8kwb}m>PCdkgwb=V2I$&W-9B)e27U zE|wnX8R1z*!nTTB8Bn)TMcrKp;Y;#utM^7a75W6Cy;yk3$<%{vudxz+nQ8In?>u!0}g#Oe4tO>jvHWorcGkMg4^%X2&?*U8r|7#0=MVB0(vZtlc z-2a*LR|uBW;~Iu2dp(-61NtX{3Igme69`@u@oxkb`S*44JO&BDY&mVkrmDnXO2#Bz zr^XL6U7Sbod2Zjx%_SYUto3m81!10~`zExB)C@MZxkcvV@5#r+JpD70^F> ziZ9l!)b~DFX>cZ`L@KZUCO>%dIM;FV?~NG9f(TT(rf&>jMEzUVbT?3%2y<YBzp4IZbextpx1QFx>^DHFLJX4fL;Uyd|9cD zVx!H&I%+X{^G@TMfiYRr=?ij|IK_jJObX=#Fq^mF*O5aq;6^+Z8KuCG{Kj`0wB{OL zu;|C17d#jEB`b=L8MuiF3@DI73Np*UT+vdDeosY%dq3^O!xA9HQjxFlzU%S(howt! zTOQ|od1fgpnt%)D&*n&cw|6TYjchD **Add/Remove Snap-in** - ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) 1. In the available snap-ins list, select **Certificate Templates**, and then select **Add** - ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) -1. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. -1. Right-click the **Smartcard Logon** template, and select **Duplicate Template**. - ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) -1. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) +1. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates +1. Right-click the **Smartcard Logon** template, and select **Duplicate Template** +1. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed 1. On the **General** tab: - 1. Specify a name, such as **TPM Virtual Smart Card Logon**. - 1. Set the validity period to the desired value. + 1. Specify a name, such as **TPM Virtual Smart Card Logon** + 1. Set the validity period to the desired value 1. On the **Request Handling** tab: - 1. Set the **Purpose** to **Signature and smartcard logon**. - 1. Select **Prompt the user during enrollment**. + 1. Set the **Purpose** to **Signature and smartcard logon** + 1. Select **Prompt the user during enrollment** 1. On the **Cryptography** tab: - 1. Set the minimum key size to 2048. - 1. Select **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider**. -1. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them. -1. Select **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates. -1. Select **File**, then select **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. - ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) -1. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. -1. Right-click **Certificate Templates**, select **New**, and then select **Certificate Template to Issue**. - ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) -1. From the list, select the new template that you created (**TPM Virtual Smart Card Logon**), and then select **OK**. + 1. Set the minimum key size to 2048 + 1. Select **Requests must use one of the following providers**, and then select **Microsoft Base Smart Card Crypto Provider** +1. On the **Security** tab, add the security group that you want to give **Enroll** access to. For example, if you want to give access to all users, select the **Authenticated users** group, and then select **Enroll** permissions for them +1. Select **OK** to finalize your changes and create the new template. Your new template should now appear in the list of Certificate Templates +1. Select **File**, then select **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer** +1. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list +1. Right-click **Certificate Templates**, select **New**, and then select **Certificate Template to Issue** +1. From the list, select the new template that you created (**TPM Virtual Smart Card Logon**), and then select **OK** > [!NOTE] > It can take some time for your template to replicate to all servers and become available in this list. @@ -103,9 +97,7 @@ The virtual smart card must be provisioned with a sign-in certificate for it to 1. Open the Certificates console by typing **certmgr.msc** on the **Start** menu 1. Right-click **Personal**, select **All Tasks**, and then select **Request New Certificate** - ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) 1. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1) - ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) 1. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)** 1. Enter the PIN that was established when you created the TPM virtual smart card, and then select **OK** 1. Wait for the enrollment to finish, and then select **Finish** diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md index c5ac24e838..afc26113cb 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md @@ -30,11 +30,9 @@ All cryptographic operations occur in the secure, isolated environment of the TP Virtual smart cards maintain the three key properties of physical smart cards: -- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and nonexportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). - -- **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that are offered by physical smart cards, and this is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM. - -- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md). +- **Non-exportability**: Because all private information on the virtual smart card is encrypted by using the TPM on the host computer, it can't be used on a different computer with a different TPM. Additionally, TPMs are designed to be tamper-resistant and nonexportable, so a malicious user can't reverse engineer an identical TPM or install the same TPM on a different computer. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md) +- **Isolated cryptography**: TPMs provide the same properties of isolated cryptography that are offered by physical smart cards, and this is utilized by virtual smart cards. Unencrypted copies of private keys are loaded only within the TPM and never into memory that is accessible by the operating system. All cryptographic operations with these private keys occur inside the TPM +- **Anti-hammering**: If a user enters a PIN incorrectly, the virtual smart card responds by using the anti-hammering logic of the TPM, which rejects further attempts for a period of time instead of blocking the card. This is also known as lockout. For more information, see [Evaluate Virtual Smart Card Security](virtual-smart-card-evaluate-security.md) The following subsections compare the functionality, security, and cost of virtual smart cards and physical smart cards. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index dd75945f31..611ae4d3b6 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -15,7 +15,6 @@ Learn about the requirements for virtual smart cards, how to use and manage them | Area | Requirements and details | |--|--| -| Supported operating systems | Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows 10
Windows 8.1
Windows 8 | | Supported Trusted Platform Module (TPM) | Any TPM that adheres to the TPM main specifications for version 1.2 or version 2.0 (as set by the Trusted Computing Group) is supported for use as a virtual smart card. For more information, see the [TPM Main Specification](http://www.trustedcomputinggroup.org/resources/tpm_main_specification). | | Supported virtual smart cards per computer | Ten smart cards can be connected to a computer or device at one time. This includes physical and virtual smart cards combined.

**Note**
You can create more than one virtual smart card; however, after creating more than four virtual smart cards, you may start to notice performance degradation. Because all smart cards appear as if they're always inserted, if more than one person shares a computer or device, each person can see all the virtual smart cards that are created on that computer or device. If the user knows the PIN values for all the virtual smart cards, the user will also be able to use them.
| | Supported number of certificates on a virtual smart card | A single TPM virtual smart card can contain 30 distinct certificates with the corresponding private keys. Users can continue to renew certificates on the card until the total number of certificates on a card exceeds 90. The reason that the total number of certificates is different from the total number of private keys is that sometimes the renewal can be done with the same private key—in which case a new private key isn't generated. | @@ -34,7 +33,7 @@ Virtual smart cards can also be created and deleted by using APIs. For more info - [ITpmVirtualSmartCardManager](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanager) - [ITPMVirtualSmartCardManagerStatusCallBack](/windows/win32/api/tpmvscmgr/nn-tpmvscmgr-itpmvirtualsmartcardmanagerstatuscallback) -You can use APIs that were introduced in the Windows.Device.SmartCards namespace in Windows Server 2012 R2 and Windows 8.1 to build Microsoft Store apps to manage the full lifecycle of virtual smart cards. For information about how to build an app to do this, see [Strong Authentication: Building Apps That Leverage Virtual Smart Cards in Enterprise, BYOD, and Consumer Environments | Build 2013 | Channel 9](https://channel9.msdn.com/events/build/2013/2-041). +You can use APIs in the `Windows.Device.SmartCards` namespace to build Microsoft Store apps to manage the full lifecycle of virtual smart cards. For information about how to build an app to do this, see [Strong Authentication: Building Apps That Leverage Virtual Smart Cards in Enterprise, BYOD, and Consumer Environments](https://channel9.msdn.com/events/build/2013/2-041). The following table describes the features that can be developed in a Microsoft Store app: @@ -77,13 +76,12 @@ The PIN for a virtual smart card can be changed by following these steps: ### TPM not provisioned -For a TPM-based virtual smart card to function properly, a provisioned TPM must be available on the computer. If the TPM is disabled in the BIOS, or it isn't provisioned with full ownership and the storage root key, the TPM virtual smart card creation will fail. +For a TPM-based virtual smart card to function properly, a provisioned TPM must be available on the computer: -If the TPM is initialized after creating a virtual smart card, the card will no longer function, and it will need to be re-created. - -If the TPM ownership was established on a Windows Vista installation, the TPM won't be ready to use virtual smart cards. The system administrator needs to clear and initialize the TPM for it to be suitable for creating TPM virtual smart cards. - -If the operating system is reinstalled, prior TPM virtual smart cards are no longer available and need to be re-created. If the operating system is upgraded, prior TPM virtual smart cards will be available to use in the upgraded operating system. +- If the TPM is disabled in the BIOS, or it isn't provisioned with full ownership and the storage root key, the TPM virtual smart card creation fails +- If the TPM is initialized after creating a virtual smart card, the card will no longer function, and it must be re-created +- If the operating system is reinstalled, prior TPM virtual smart cards are no longer available and need to be re-created +- If the operating system is upgraded, prior TPM virtual smart cards are available to use in the upgraded operating system ### TPM in lockout state From a8677e947c6bdb18f12290889dc7a8c557cc4c87 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:52:06 -0500 Subject: [PATCH 11/21] TOC update --- .../identity-protection/smart-cards/toc.yml | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/identity-protection/smart-cards/toc.yml b/windows/security/identity-protection/smart-cards/toc.yml index 2b7e51db7b..bca4cb0bbd 100644 --- a/windows/security/identity-protection/smart-cards/toc.yml +++ b/windows/security/identity-protection/smart-cards/toc.yml @@ -1,27 +1,27 @@ items: -- name: Smart Card Technical Reference +- name: Smart card technical reference href: smart-card-windows-smart-card-technical-reference.md -- name: How Smart Card Sign-in Works in Windows +- name: How smart card sign-in works href: smart-card-how-smart-card-sign-in-works-in-windows.md items: - - name: Smart Card Architecture + - name: Smart card architecture href: smart-card-architecture.md - - name: Certificate Requirements and Enumeration + - name: Certificate requirements and enumeration href: smart-card-certificate-requirements-and-enumeration.md - - name: Smart Card and Remote Desktop Services + - name: Smart card and Remote Desktop Services href: smart-card-and-remote-desktop-services.md - - name: Smart Cards for Windows Service + - name: Smart cards for Windows Service href: smart-card-smart-cards-for-windows-service.md - name: Certificate Propagation Service href: smart-card-certificate-propagation-service.md - - name: Smart Card Removal Policy Service + - name: Smart card Removal Policy Service href: smart-card-removal-policy-service.md -- name: Smart Card Tools and Settings +- name: Smart Card tools and settings href: smart-card-tools-and-settings.md items: - - name: Smart Cards Debugging Information + - name: Smart cards debugging information href: smart-card-debugging-information.md - - name: Smart Card Group Policy and Registry Settings + - name: Smart card group policy and registry settings href: smart-card-group-policy-and-registry-settings.md - - name: Smart Card Events + - name: Smart card events href: smart-card-events.md \ No newline at end of file From 796abd87714b0e7e00bc7ecfcd9aa4f0c5a7bb06 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 09:53:04 -0500 Subject: [PATCH 12/21] removed graphics --- .../virtual-smart-cards/virtual-smart-card-get-started.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index a724c1f9ef..711c4ed802 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -66,12 +66,8 @@ On your domain server, you need to create a template for the certificate that yo > [!NOTE] > It can take some time for your template to replicate to all servers and become available in this list. - ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) - 1. After the template replicates, in the MMC, right-click in the Certification Authority list, select **All Tasks**, and then select **Stop Service**. Then, right-click the name of the CA again, select **All Tasks**, and then select **Start Service**. - ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) - ## Step 2: Create the TPM virtual smart card In this step, you create the virtual smart card on the client computer by using the command-line tool, [Tpmvscmgr.exe](virtual-smart-card-tpmvscmgr.md). @@ -79,7 +75,6 @@ In this step, you create the virtual smart card on the client computer by using ### To create the TPM virtual smart card 1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. - ![Cmd prompt, Run as administrator.](images/vsc-10-cmd-run-as-administrator.png) 1. At the command prompt, type the following, and then press ENTER: `tpmvscmgr.exe create /name TestVSC /pin default /adminkey random /generate` From a31e8c3874e53f4add07275495d24ca485df4a01 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 10:21:24 -0500 Subject: [PATCH 13/21] removed graphics --- .../images/virtual-smart-card-icon.svg | 4 ++++ .../images/vsc-virtual-smart-card-icon.png | Bin 2171 -> 0 bytes ...virtual-smart-card-use-virtual-smart-cards.md | 8 +++----- 3 files changed, 7 insertions(+), 5 deletions(-) create mode 100644 windows/security/identity-protection/virtual-smart-cards/images/virtual-smart-card-icon.svg delete mode 100644 windows/security/identity-protection/virtual-smart-cards/images/vsc-virtual-smart-card-icon.png diff --git a/windows/security/identity-protection/virtual-smart-cards/images/virtual-smart-card-icon.svg b/windows/security/identity-protection/virtual-smart-cards/images/virtual-smart-card-icon.svg new file mode 100644 index 0000000000..02fb8d7434 --- /dev/null +++ b/windows/security/identity-protection/virtual-smart-cards/images/virtual-smart-card-icon.svg @@ -0,0 +1,4 @@ + + + + diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-virtual-smart-card-icon.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-virtual-smart-card-icon.png deleted file mode 100644 index 4614d7684bb61bb1a01792758f529dba78288dfe..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2171 zcmd5;`#;lUSMt3l`YNU}SEv6cpcG?CN z)zU`JGD@k`B{4+WLxq~4ZY?GVL69IKCtY{W`3uhLwI80(^Spofd|uDzd7jVv{mJq5 zKB=Lus}2BwhKIYWpUStWtN^-Gwbp>9X(|Uw@jK}ZRCXVnRRKthla~_!R8wGE=hReq zSE74R3IJ%fy*Cgqp&|+Zpl}aYr+~Du1)72q(0_m@r~Y8ecyX_h`J`zVi}d6+my2pG zxT}U^viK_O}eW zpgl*#yh_~GjtOR0d-fu1^km1FRd?sQ*j=`uJhfuY79kstSWF@lewE*#lnDqtVU>VK z+Z)^kU0U+5RI+1F7uL7-2 zAA`&DbRh8Q@8PKU+5&jQ&_s}Un7^|XEUgp=SWPvd2zYe1I6@hQCJKzJ5wpQ>rbqI~ z55}A0*n>G;w4te;Hx@NVwX*9Qg8X^p<`*lWWM>(NsCS{$KAKE(#}7wgXXkr+#_PXp zz9+DDo5wYs9X@(7OB_fYPolx-svWPT2iiWmi9kC{nx1(^y~KFP%>)7+FWFdzwR3>- z5_(Mk&&~tL>PKNyg1X&5$}AQker7c>qM}x|!anbJasXBV^PO`Y`>N*Gp75a|Q>jC| zO_BO2#YZ2GzXjWot*)@^GrQg#pt>!T1bp$j!<+=1fR|p=(E>Ns{P8@|Nw1f^HCy0V z*ArToer1q+aJ~PhcjDeabPnwrC#+&j=1-2k-t3+_&}o!vD7r8DWL5a3z*6e4y;<5I z;)_&iJsQ)_x*WUW5@~ftRY3sb0t1t9wZ`Tx`LM@X6tG;$nUPl(S!6VemyUfI+9;{S6JjVV9Y(2%IcQ6bsg(T7Dwh?JxX3sd z#a2p~Ap@g_Dm~QCdz>OsiObBC@#1`h`W#P29p&0&b8S69hdp+^<;(3B4(M-h%;G1C z%1L+2A%n_O6xK0c;x=LJHp|q!R1H*W3NHm=NWD8ix}+k=(g5`HaVI#X*t$r*X?n=Xz`^eUQ8= zi${t#V|O#OaO~LA=f*AU*ZQ*O#MKI`YqV=h2(w{)>}b$DF51%|WQHx31Xm-L>BsvC z%3&0P`f0Ey)OY(3RmrIOePxvy>^HNS63Re4PhH3uR)~aL?};q0x$PJ8jo8Me+;t<);@3~DxAnQ$52U+}s9qdf-^x8^ zrNvgOS{-1AXbXPE3o!- zSzNF@V8(!uny)(MvrG%Z58p(O-&lJf;`cqm**cL<$?iFBeN#-u$Ctrl+Alt+Del and select **Change a password** - Select **Sign-in Options** - Select the virtual smart card icon - Enter and confirm the new PIN From 7543036398867573f16e05446df4ff0980ba0faa Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 13:35:32 -0500 Subject: [PATCH 14/21] Light updates to legacy firewall content --- .../basic-firewall-policy-design.md | 34 +- ...create-windows-firewall-rules-in-intune.md | 88 +- .../filter-origin-documentation.md | 83 +- .../firewall-settings-lost-on-upgrade.md | 11 +- .../troubleshooting-uwp-firewall.md | 1438 ++++++++--------- .../zero-trust-windows-device-health.md | 41 +- 6 files changed, 823 insertions(+), 872 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md b/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md index 5733a89690..748a749676 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/basic-firewall-policy-design.md @@ -1,14 +1,12 @@ --- title: Basic Firewall Policy Design description: Protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses by using basic firewall policy design. -ms.prod: windows-client ms.topic: conceptual -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Basic Firewall Policy Design - Many organizations have a network perimeter firewall that is designed to prevent the entry of malicious traffic in to the organization's network, but don't have a host-based firewall enabled on each device in the organization. The Basic Firewall Policy Design helps you to protect the devices in your organization from unwanted network traffic that gets through the perimeter defenses, or that originates from inside your network. In this design, you deploy firewall rules to each device in your organization to allow traffic that is required by the programs that are used. Traffic that doesn't match the rules is dropped. @@ -17,22 +15,16 @@ Traffic can be blocked or permitted based on the characteristics of each network Many network administrators don't want to tackle the difficult task of determining all the appropriate rules for every program that is used by the organization, and then maintaining that list over time. In fact, most programs don't require specific firewall rules. The default behavior of Windows and most contemporary applications makes this task easy: -- On client devices, the default firewall behavior already supports typical client programs. Programs create any required rules for you as part of the installation process. You only have to create a rule if the client program must be able to receive unsolicited inbound network traffic from another device. - -- When you install a server program that must accept unsolicited inbound network traffic, the installation program likely creates or enables the appropriate rules on the server for you. - - For example, when you install a server role, the appropriate firewall rules are created and enabled automatically. - -- For other standard network behavior, the predefined rules that are built into Windows 11, Windows 10, Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, Windows 8, and Windows 7 can easily be configured in a GPO and deployed to the devices in your organization. - - For example, by using the predefined groups for Core Networking and File and Printer Sharing you can easily configure GPOs with rules for those frequently used networking protocols. +- On client devices, the default firewall behavior already supports typical client programs. Programs create any required rules for you as part of the installation process. You only have to create a rule if the client program must be able to receive unsolicited inbound network traffic from another device +- When you install a server program that must accept unsolicited inbound network traffic, the installation program likely creates or enables the appropriate rules on the server for you. For example, when you install a server role, the appropriate firewall rules are created and enabled automatically +- For other standard network behavior, the predefined rules that are built into Windows can be configured in a GPO and deployed to the devices in your organization. For example, by using the predefined groups for Core Networking and File and Printer Sharing you can easily configure GPOs with rules for those frequently used networking protocols. With a few exceptions, the firewall can be enabled on all configurations. Therefore, we recommend that you enable the firewall on every device in your organization. The term "device" includes servers in your perimeter network, on mobile and remote clients that connect to the network, and on all servers and clients in your internal network. > [!CAUTION] > Stopping the service associated with Windows Defender Firewall with Advanced Security is not supported by Microsoft. -By default, in new installations, Windows Defender Firewall with Advanced Security is turned on in Windows Server 2012, Windows 8, and later. +Windows Defender Firewall with Advanced Security is turned on by default. If you turn off the Windows Defender Firewall service you lose other benefits provided by the service, such as the ability to use IPsec connection security rules, Windows Service Hardening, and network protection from forms of attacks that use network fingerprinting. @@ -42,22 +34,18 @@ An organization typically uses this design as a first step toward a more compreh After implementing this design, you'll have centralized management of the firewall rules applied to all devices that are running Windows in your organization. -> [!IMPORTANT] +> [!IMPORTANT] > If you also intend to deploy the [Domain Isolation Policy Design](domain-isolation-policy-design.md), or the [Server Isolation Policy Design](server-isolation-policy-design.md), we recommend that you do the design work for all three designs together, and then deploy in layers that correspond with each design. The basic firewall design can be applied to devices that are part of an Active Directory forest. Active Directory is required to provide the centralized management and deployment of Group Policy objects that contain the firewall settings and rules. For more information about this design: -- This design coincides with the deployment goal to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md). - -- To learn more about this design, see [Firewall Policy Design Example](firewall-policy-design-example.md). - -- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md). - -- To help you make the decisions required in this design, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md). - -- For a list of detailed tasks that you can use to deploy your basic firewall policy design, see [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md). +- This design coincides with the deployment goal to [Protect Devices from Unwanted Network Traffic](protect-devices-from-unwanted-network-traffic.md) +- To learn more about this design, see [Firewall Policy Design Example](firewall-policy-design-example.md) +- Before completing the design, gather the information described in [Designing a Windows Defender Firewall with Advanced Security Strategy](designing-a-windows-firewall-with-advanced-security-strategy.md) +- To help you make the decisions required in this design, see [Planning Settings for a Basic Firewall Policy](planning-settings-for-a-basic-firewall-policy.md) +- For a list of detailed tasks that you can use to deploy your basic firewall policy design, see [Checklist: Implementing a Basic Firewall Policy Design](checklist-implementing-a-basic-firewall-policy-design.md) > [!div class="nextstepaction"] > [Domain Isolation Policy Design](domain-isolation-policy-design.md) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md index f2316edf7e..2ee70cb742 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -1,18 +1,16 @@ --- title: Create Windows Firewall rules in Intune description: Learn how to use Intune to create rules in Windows Defender Firewall with Advanced Security. Start by creating a profile in Device Configuration in Intune. -ms.prod: windows-client ms.topic: conceptual -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Create Windows Firewall rules in Intune - >[!IMPORTANT] >This information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. -To get started, Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Devices** > **Windows** > **Configuration profiles** > **Create profile** > Choose **Windows 10 and later** as the platform, Choose **Templates**, then **Endpoint protection** as the profile type. +To get started, Open the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431), and then go to **Devices** > **Windows** > **Configuration profiles** > **Create profile** > Choose **Windows 10 and later** as the platform, Choose **Templates**, then **Endpoint protection** as the profile type. Select Windows Defender Firewall. :::image type="content" source="images/windows-firewall-intune.png" alt-text="Example of a Windows Defender Firewall policy in Microsoft Intune and the Intune admin center."::: @@ -24,76 +22,86 @@ Select Windows Defender Firewall. The firewall rule configurations in Intune use the Windows CSP for Firewall. For more information, see [Firewall CSP](/windows/client-management/mdm/firewall-csp). ## Application -Control connections for an app or program. -Apps and programs can be specified either file path, package family name, or Windows service short name. -The file path of an app is its location on the client device. -For example, C:\Windows\System\Notepad.exe. -[Learn more](/windows/client-management/mdm/firewall-csp#filepath) +Control connections for an app or program. +Apps and programs can be specified either file path, package family name, or Windows service short name. -Package family names can be retrieved by running the Get-AppxPackage command from PowerShell. -[Learn more](https://aka.ms/intunefirewallPackageNameFromPowerShell) +The file path of an app is its location on the client device. +For example, C:\Windows\System\Notepad.exe. +[Learn more](/windows/client-management/mdm/firewall-csp#filepath) -Windows service short names are used in cases when a service, not an application, is sending or receiving traffic. -Default is All. +Package family names can be retrieved by running the Get-AppxPackage command from PowerShell. +[Learn more](https://aka.ms/intunefirewallPackageNameFromPowerShell) + +Windows service short names are used in cases when a service, not an application, is sending or receiving traffic. +Default is All. [Learn more](/windows/client-management/mdm/firewall-csp#servicename) ## Protocol -Select the protocol for this port rule. Transport layer protocols—TCP and UDP—allow you to specify ports or port ranges. For custom protocols, enter a number between 0 and 255 representing the IP protocol. -Default is Any. +Select the protocol for this port rule. Transport layer protocols—TCP and UDP—allow you to specify ports or port ranges. For custom protocols, enter a number between 0 and 255 representing the IP protocol. + +Default is Any. [Learn more](/windows/client-management/mdm/firewall-csp#protocol) ## Local ports -Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. + +Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. [Learn more](/windows/client-management/mdm/firewall-csp#localportranges) ## Remote ports -Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. + +Comma separated list of ranges. For example, *100-120,200,300-320*. Default is All. [Learn more](/windows/client-management/mdm/firewall-csp#remoteportranges) ## Local addresses + Comma-separated list of local addresses covered by the rule. Valid tokens include: -- \* indicates any local address. If present, this token must be the only one included. -- A subnet can be specified using either the subnet mask or network prefix notation. If a subnet mask or a network prefix isn't specified, the subnet mask default is 255.255.255.255. -- A valid IPv6 address. -- An IPv4 address range in the format of "start address-end address" with no spaces included. -- An IPv6 address range in the format of "start address-end address" with no spaces included. Default is Any address. + +- `*` indicates any local address. If present, this token must be the only one included +- A subnet can be specified using either the subnet mask or network prefix notation. If a subnet mask or a network prefix isn't specified, the subnet mask default is 255.255.255.255 +- A valid IPv6 address +- An IPv4 address range in the format of "start address-end address" with no spaces included +- An IPv6 address range in the format of "start address-end address" with no spaces included. Default is Any address [Learn more](/windows/client-management/mdm/firewall-csp#localaddressranges) ## Remote addresses -List of comma separated tokens specifying the remote addresses covered by the rule. Tokens are case insensitive. Valid tokens include: -- \* indicates any remote address. If present, this token must be the only one included. -- Defaultgateway -- DHCP -- DNS -- WINS -- Intranet (supported on Windows versions 1809+) -- RmtIntranet (supported on Windows versions 1809+) -- Internet (supported on Windows versions 1809+) -- Ply2Renders (supported on Windows versions 1809+) -- LocalSubnet indicates any local address on the local subnet. -- A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255. -- A valid IPv6 address. -- An IPv4 address range in the format of "start address-end address" with no spaces included. -- An IPv6 address range in the format of "start address-end address" with no spaces included. -Default is Any address. +List of comma separated tokens specifying the remote addresses covered by the rule. Tokens are case insensitive. Valid tokens include: + +- `*` indicates any remote address. If present, this token must be the only one included +- Defaultgateway +- DHCP +- DNS +- WINS +- Intranet +- RmtIntranet +- Internet +- Ply2Renders +- LocalSubnet indicates any local address on the local subnet +- A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask not a network prefix is specified, the subnet mask defaults to 255.255.255.255 +- A valid IPv6 address +- An IPv4 address range in the format of "start address-end address" with no spaces included +- An IPv6 address range in the format of "start address-end address" with no spaces included + +Default is Any address [Learn more](https://aka.ms/intunefirewallremotaddressrule) ## Edge traversal (UI coming soon) -Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. This setting can only be configured via Intune Graph at this time. + +Indicates whether edge traversal is enabled or disabled for this rule. The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address. New rules have the EdgeTraversal property disabled by default. This setting can only be configured via Intune Graph at this time. [Learn more](/windows/client-management/mdm/firewall-csp#edgetraversal) ## Authorized users -Specifies the list of authorized local users for this rule. A list of authorized users can't be specified if the rule being authored is targeting a Windows service. Default is all users. + +Specifies the list of authorized local users for this rule. A list of authorized users can't be specified if the rule being authored is targeting a Windows service. Default is all users. [Learn more](/windows/client-management/mdm/firewall-csp#localuserauthorizedlist) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md index 31071302f6..3f99ba346f 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md @@ -1,20 +1,19 @@ --- title: Filter origin audit log improvements description: Filter origin documentation audit log improvements -ms.prod: windows-client ms.topic: troubleshooting -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Filter origin audit log improvements Debugging packet drops is a continuous issue to Windows customers. In the past, customers had limited information about packet drops. -Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. +Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. ![Event properties.](images/event-properties-5157.png) -The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. +The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. However, the filter ID isn't a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. This change in ID makes the diagnosis process error-prone and difficult. @@ -23,29 +22,21 @@ For customers to debug packet drop events correctly and efficiently, they would The blocking filters can be categorized under these filter origins: 1. Firewall rules - -2. Firewall default block filters - - a. AppContainer loopback - - b. Boottime default - - c. Quarantine default - - d. Query user default - - e. Stealth - - f. Universal Windows Platform (UWP) default - - g. Windows Service Hardening (WSH) default +1. Firewall default block filters + 1. AppContainer loopback + 1. Boottime default + 1. Quarantine default + 1. Query user default + 1. Stealth + 1. Universal Windows Platform (UWP) default + 1. Windows Service Hardening (WSH) default The next section describes the improvements made to audits 5157 and 5152, and how the above filter origins are used in these events. These improvements were added in the Windows Server 2022 and Windows 11 releases. - - ## Improved firewall audit - + +## Improved firewall audit + The two new fields added to the audit 5157 and 5152 events are `Filter Origin` and `Interface Index`. - + The `Filter Origin` field helps identify the cause of the drop. Packet drops from firewall are explicitly dropped by default block filters created by the Windows Firewall service or a firewall rule that may be created by users, policies, services, apps, etc. `Filter Origin` specifies either the rule ID (a unique identifier of a Firewall rule) or the name of one of the default block filters. @@ -54,12 +45,12 @@ The `Interface Index` field specifies the network interface in which the packet To enable a specific audit event, run the corresponding command in an administrator command prompt: -|**Audit #**|**Enable command**|**Link**| +|Audit #|Enable command|Link| |:-----|:-----|:-----| -|**5157**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5157(F): The Windows Filtering Platform has blocked a connection.](../../../threat-protection/auditing/event-5157.md)| -|**5152**|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Packet Drop" /success:enable /failure:enable`|[5152(F): The Windows Filtering Platform blocked a packet.](../../../threat-protection/auditing/event-5152.md)| +|5157|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable`|[5157(F): The Windows Filtering Platform has blocked a connection.](../../../threat-protection/auditing/event-5157.md)| +|5152|`Auditpol /set /category:"System" /SubCategory:"Filtering Platform Packet Drop" /success:enable /failure:enable`|[5152(F): The Windows Filtering Platform blocked a packet.](../../../threat-protection/auditing/event-5152.md)| -## Example flow of debugging packet drops with filter origin +## Example flow of debugging packet drops with filter origin As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on. @@ -69,7 +60,7 @@ The next sections are divided by `Filter Origin` type, the value is either a rul ## Firewall rules -Run the following PowerShell command to generate the rule information using `Filter Origin`. +Run the following PowerShell command to generate the rule information using `Filter Origin`. ```Powershell Get-NetFirewallRule -Name "" @@ -85,7 +76,7 @@ After identifying the rule that caused the drop, the network admin can now modif ## Firewall default block filters -**AppContainer loopback** +### AppContainer loopback Network drop events from the AppContainer loopback block filter origin occur when localhost loopback isn't enabled properly for the Universal Windows Platform (UWP) app. @@ -93,19 +84,19 @@ To enable localhost loopback in a local debugging environment, see [Communicatin To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged win32 app, see [uap4:LoopbackAccessRules](/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules). -**Boottime default** +### Boottime default Network drop events from the boottime default block filter origin occur when the computer is booting up and the firewall service isn't yet running. Services will need to create a boottime allow filter to allow the traffic. It should be noted that it's not possible to add boottime filters through firewall rules. -**Quarantine default** +### Quarantine default -Network drops from the quarantine default block filter occur when the interface is temporarily quarantined by Firewall service. The firewall service quarantines an interface when it detects a change on the network, and based on several other factors, the firewall service may put the interface in quarantine as a safeguard. When an interface is in quarantine, the quarantine default block filter will block any new non-loopback inbound connections. +Network drops from the quarantine default block filter occur when the interface is temporarily quarantined by Firewall service. The firewall service quarantines an interface when it detects a change on the network, and based on several other factors, the firewall service may put the interface in quarantine as a safeguard. When an interface is in quarantine, the quarantine default block filter will block any new non-loopback inbound connections. Run the following PowerShell command to generate more information about the interface: ```Powershell -Get-NetIPInterface –InterfaceIndex -Get-NetIPInterface –InterfaceIndex 5 +Get-NetIPInterface -InterfaceIndex +Get-NetIPInterface -InterfaceIndex 5 ``` ![Quarantine default block filter.](images/quarantine-default-block-filter.png) @@ -115,13 +106,12 @@ To learn more about the quarantine feature, see [Quarantine behavior](quarantine >[!NOTE] > Quarantine-related packet drops are often transient and signify nothing more than a network change on the interface. -**Query user default** +### Query user default -Network packet drops from query user default block filters occur when there's no explicit rule created to allow an inbound connection for the packet. When an application binds to a socket but doesn't have a corresponding inbound rule to allow packets on that port, Windows generates a pop up for the user to allow or deny the app to receive packets on the available network categories. If the user clicks to deny the connection in this popup, subsequent inbound packets to the app will be dropped. To resolve the drops: +Network packet drops from query user default block filters occur when there's no explicit rule created to allow an inbound connection for the packet. When an application binds to a socket but doesn't have a corresponding inbound rule to allow packets on that port, Windows generates a pop up for the user to allow or deny the app to receive packets on the available network categories. If the user clicks to deny the connection in this popup, subsequent inbound packets to the app will be dropped. To resolve the drops: -1. Create an inbound firewall rule to allow the packet for this application. This packet will allow the packet to bypass any query user default block filters. - -2. Delete any block query user rules that may have been auto generated by the firewall service. +1. Create an inbound firewall rule to allow the packet for this application. This packet will allow the packet to bypass any query user default block filters +1. Delete any block query user rules that may have been auto generated by the firewall service To generate a list of all the query user block rules, you can run the following PowerShell command: @@ -131,31 +121,32 @@ Get-NetFirewallRule | Where {$_.Name -like "*Query User*"} ![Query user default block filter.](images/query-user-default-block-filters.png) -The query user pop-up feature is enabled by default. +The query user pop-up feature is enabled by default. To disable the query user pop-up, you can run the following command in administrative command prompt: -```Console +```cmd Netsh set allprofiles inboundusernotification disable ``` + Or in PowerShell: ```Powershell Set-NetFirewallProfile -NotifyOnListen False ``` -**Stealth** +### Stealth Network drops from stealth filters are typically made to prevent port scanning. To disable stealth-mode, see [Disable stealth mode in Windows](/troubleshoot/windows-server/networking/disable-stealth-mode). -**UWP default** +### UWP default -Network drops from Universal Windows Platform (UWP) default inbound/outbound block filters are often caused by the UWP app not being configured correctly (that is, the UWP app is missing the correct capability tokens or loopback isn't enabled) or the private range is configured incorrectly. +Network drops from Universal Windows Platform (UWP) default inbound/outbound block filters are often caused by the UWP app not being configured correctly (that is, the UWP app is missing the correct capability tokens or loopback isn't enabled) or the private range is configured incorrectly. For more information on how to debug drops caused by UWP default block filters, see [Troubleshooting UWP App Connectivity Issues](troubleshooting-uwp-firewall.md). -**WSH default** +### WSH default Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn't an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner will need to configure allow rules for the service if the block isn't expected. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md b/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md index 0d63234aba..89ffce298a 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/firewall-settings-lost-on-upgrade.md @@ -1,9 +1,8 @@ --- title: Troubleshooting Windows Firewall settings after a Windows upgrade description: Firewall settings lost on upgrade -ms.prod: windows-client ms.topic: troubleshooting -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Troubleshooting Windows Firewall settings after a Windows upgrade @@ -14,9 +13,9 @@ Use this article to troubleshoot firewall settings that are turned off after upg To help you organize your list, individual built-in firewall rules are categorized within a group. For example, the following rules form part of the Remote Desktop group. -- Remote Desktop – Shadow (TCP-In) -- Remote Desktop – User Mode (TCP-In) -- Remote Desktop – User-Mode (UDP-In) +- Remote Desktop - Shadow (TCP-In) +- Remote Desktop - User Mode (TCP-In) +- Remote Desktop - User-Mode (UDP-In) Other group examples include **core networking**, **file and print sharing**, and **network discovery**. Grouping allows administrators to manage sets of similar rules by filtering on categories in the firewall interface (wf.msc). Do this filtering by right-clicking on either **Inbound** or **Outbound Rules** and selecting **Filter by Group**. Optionally, you can use PowerShell using the `Get-NetFirewallRule` cmdlet with the `-Group` switch. @@ -24,7 +23,7 @@ Other group examples include **core networking**, **file and print sharing**, an Get-NetFirewallRule -Group ``` -> [!NOTE] +> [!NOTE] > Microsoft recommends to enable or disable an entire group instead of individual rules. Microsoft recommends that you enable/disable all of the rules within a group instead of one or two individual rules. This recommendation is because groups aren't only used to organize rules and allow batch rule modification by type, but they also represent a 'unit' by which rule state is maintained across a Windows upgrade. Rule groups, as opposed to individual rules, are the unit by which the update process determines what should be enabled/disabled when the upgrade is complete. diff --git a/windows/security/operating-system-security/network-security/windows-firewall/troubleshooting-uwp-firewall.md b/windows/security/operating-system-security/network-security/windows-firewall/troubleshooting-uwp-firewall.md index e120af6116..36ec68be9d 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/troubleshooting-uwp-firewall.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/troubleshooting-uwp-firewall.md @@ -1,9 +1,8 @@ --- title: Troubleshooting UWP App Connectivity Issues in Windows Firewall description: Troubleshooting UWP App Connectivity Issues in Windows Firewall -ms.prod: windows-client ms.topic: troubleshooting -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Troubleshooting UWP App Connectivity Issues @@ -15,28 +14,24 @@ This document guides you through steps to debug Universal Windows Platform (UWP ## Typical causes of connectivity issues -UWP app network connectivity issues are typically caused by: +UWP app network connectivity issues are typically caused by: -1. The UWP applications not being permitted to receive loopback traffic. This permission must be configured. By default, UWP applications aren't allowed to receive loopback traffic. -2. The UWP app is missing the proper capability tokens. -3. The private range is configured incorrectly. For example, the private range is set incorrectly through GP/MDM policies, etc. +1. The UWP applications not being permitted to receive loopback traffic. This permission must be configured. By default, UWP applications aren't allowed to receive loopback traffic +1. The UWP app is missing the proper capability tokens +1. The private range is configured incorrectly. For example, the private range is set incorrectly through GP/MDM policies, etc. To understand these causes more thoroughly, there are several concepts to review. -The traffic of network packets (what's permitted and what’s not) on Windows is determined by the Windows Filtering Platform (WFP). When a UWP app -or the private range is configured incorrectly, it affects how the UWP app’s network traffic will be processed by WFP. +The traffic of network packets (what's permitted and what's not) on Windows is determined by the Windows Filtering Platform (WFP). When a UWP app +or the private range is configured incorrectly, it affects how the UWP app's network traffic will be processed by WFP. -When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet doesn't match any of the filter conditions, leading the packet to be dropped by a default block filter. The presence of the default block filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that doesn't have the correct capabilities for the resource it's trying to reach. Such a packet drop ensures the application’s granular access to each resource type and preventing the application from escaping its environment. +When a packet is processed by WFP, the characteristics of that packet must explicitly match all the conditions of a filter to either be permitted or dropped to its target address. Connectivity issues typically happen when the packet doesn't match any of the filter conditions, leading the packet to be dropped by a default block filter. The presence of the default block filters ensures network isolation for UWP applications. Specifically, it guarantees a network drop for a packet that doesn't have the correct capabilities for the resource it's trying to reach. Such a packet drop ensures the application's granular access to each resource type and preventing the application from escaping its environment. -For more information on the filter arbitration algorithm and network isolation, -see [Filter -Arbitration](/windows/win32/fwp/filter-arbitration) -and -[Isolation](/windows/win32/secauthz/appcontainer-isolation). +For more information on the filter arbitration algorithm and network isolation, see [Filter Arbitration](/windows/win32/fwp/filter-arbitration) and [Isolation](/windows/win32/secauthz/appcontainer-isolation). The following sections cover debugging case examples for loopback and non-loopback UWP app network connectivity issues. -> [!NOTE] +> [!NOTE] > As improvements to debugging and diagnostics in the Windows Filtering Platform are made, the trace examples in this document may not exactly match the traces collected on previous releases of Windows. @@ -46,15 +41,17 @@ If you need to establish a TCP/IP connection between two processes on the same h To enable loopback for client outbound connections, run the following command at a command prompt: -```console +```cmd CheckNetIsolation.exe LoopbackExempt -a -n= ``` To enable loopback for server inbound connections, run the following command at a command prompt: -```console + +```cmd CheckNetIsolation.exe LoopbackExempt -is -n= ``` + You can ensure loopback is enabled by checking the appx manifests of both the sender and receiver. For more information about loopback scenarios, see [Communicating with @@ -62,7 +59,7 @@ localhost (loopback)](/windows/iot-core/develop-your-app/loopback). >[!NOTE] ->If you are in the middle of developing a UWA application and want to test its loopback, ensure to uninstall and re-install the UWA app if the network capabilities change for whatever reason. +>If you are in the middle of developing a UWA application and want to test its loopback, ensure to uninstall and re-install the UWA app if the network capabilities change for whatever reason. Also, see [How to enable loopback and troubleshoot network isolation (Windows Runtime apps)](/previous-versions/windows/apps/hh780593(v=win.10)). @@ -78,7 +75,7 @@ Netsh wfp capture start keywords=19 Netsh wfp capture stop ``` -These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains any allow or drop netEvents and filters that existed during that repro. Without “keywords=19”, the trace will only collect drop netEvents. +These commands generate a wfpdiag.cab. Inside the .cab exists a wfpdiag.xml, which contains any allow or drop netEvents and filters that existed during that repro. Without "keywords=19", the trace will only collect drop netEvents. Inside the wfpdiag.xml, search for netEvents that have FWPM_NET_EVENT_TYPE_CLASSIFY_DROP as the netEvent type. To find the relevant drop events, search for the drop events with matching destination IP address, @@ -86,7 +83,7 @@ package SID, or application ID name. The characters in the application ID name will be separated by periods: ```XML -(ex) +(ex) \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.w.i.n.d.o.w.s.\\.s.y.s.t.e.m.3.2.\\.s.v.c.h.o.s.t...e.x.e... @@ -108,7 +105,8 @@ In this scenario, the app could successfully send a packet to the Internet targe The following code shows the allow netEvent of the app connecting to the target IP. The netEvent contains information about the packet including its local address, remote address, capabilities, etc. -**Classify Allow netEvent, Wfpdiag-Case-1.xml** +### Classify Allow netEvent, `Wfpdiag-Case-1.xml` + ```xml

@@ -120,18 +118,18 @@ remote address, capabilities, etc. FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET FWPM_NET_EVENT_FLAG_APP_ID_SET - FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET FWPM_NET_EVENT_FLAG_IP_VERSION_SET FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET FWP_IP_VERSION_V6 - 6 - 2001:4898:30:3:256c:e5ba:12f3:beb1 + 6 + 2001:4898:30:3:256c:e5ba:12f3:beb1 2620:1ec:c11::200 52127 443 0 - + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... @@ -154,7 +152,7 @@ remote address, capabilities, etc. 0000000000000000 - + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK @@ -168,9 +166,9 @@ remote address, capabilities, etc. FWP_ACTION_PERMIT - 121167 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF - FWP_ACTION_PERMIT + 121167 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT @@ -181,7 +179,8 @@ The following is the filter that permitted the packet to be sent to the target address according to the **terminatingFiltersInfo** in the **netEvent**. This packet was allowed by Filter #125918, from the InternetClient Default Rule. -**InternetClient Default Rule Filter #125918, Wfpdiag-Case-1.xml** +### InternetClient Default Rule Filter #125918, `Wfpdiag-Case-1.xml` + ```xml {3389708e-f7ae-4ebc-a61a-f659065ab24e} @@ -196,7 +195,7 @@ allowed by Filter #125918, from the InternetClient Default Rule. .+...... FWPM_LAYER_ALE_AUTH_CONNECT_V6 - FWPM_SUBLAYER_MPSSVC_WSHFWPM_SUBLAYER_MPSSVC_WSH FWP_EMPTY @@ -211,61 +210,62 @@ allowed by Filter #125918, from the InternetClient Default Rule. FWPM_CONDITION_IP_REMOTE_ADDRESS - FWP_MATCH_RANGE - - FWP_RANGE_TYPE - - + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + FWP_BYTE_ARRAY16_TYPE :: FWP_BYTE_ARRAY16_TYPE ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff - - - - - - FWPM_CONDITION_ORIGINAL_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_CURRENT_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_ALE_USER_ID - FWP_MATCH_EQUAL - - FWP_SECURITY_DESCRIPTOR_TYPE - O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) - - - - - FWP_ACTION_PERMIT - - - 0 - - 125918 - - FWP_UINT64 - 103079219136 - + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 125918 + + FWP_UINT64 + 103079219136 + ``` -**Capabilities Condition in Filter \#125918, Wfpdiag-Case-1.xml** +### Capabilities Condition in Filter #125918, `Wfpdiag-Case-1.xml` + ```xml FWPM_CONDITION_ALE_USER_ID @@ -276,26 +276,23 @@ allowed by Filter #125918, from the InternetClient Default Rule. ``` + This condition enables checking capabilities in this filter. -The important part of this condition is **S-1-15-3-1**, which is the capability SID -for **INTERNET_CLIENT** privileges. +The important part of this condition is **S-1-15-3-1**, which is the capability SID for **INTERNET_CLIENT** privileges. + +From the **netEvent** capabilities section, capabilities from netEvent, Wfpdiag-Case-1.xml. -From the **netEvent** capabilities section, -capabilities from netEvent, Wfpdiag-Case-1.xml. ```xml - - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK ``` -These capabilities show the packet came from an app with an Internet client token (**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**) which matches the capability SID in the -filter. All the other conditions are also met for the filter, so the packet is -allowed. -Something to note is that the only capability token required for the packet to -reach bing.com was the Internet client token, even though this example showed -the packet having all capabilities. +These capabilities show the packet came from an app with an Internet client token (**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**) which matches the capability SID in the filter. All the other conditions are also met for the filter, so the packet is +allowed. Something to note is that the only capability token required for the packet to reach bing.com was the Internet client token, even though this example showed the packet having all capabilities. ## Case 2: UWP APP can't reach Internet target address and has no capabilities @@ -304,7 +301,8 @@ In this example, the UWP app is unable to connect to bing.com The following example is that of a drop netEvent that was captured in the trace. -**Classify Drop netEvent, Wfpdiag-Case-2.xml** +### Classify Drop netEvent, `Wfpdiag-Case-2.xml` + ```xml
@@ -373,12 +371,11 @@ The following example is that of a drop netEvent that was captured in the trace. ``` -The first thing that you should check in the **netEvent** is the capabilities -field. In this example, the capabilities field is empty, indicating that the -UWP app wasn't configured with any capability tokens to allow it to connect to -a network. -**Internal Fields from netEvent, Wfpdiag-Case-2.xml** +The first thing that you should check in the **netEvent** is the capabilities field. In this example, the capabilities field is empty, indicating that the UWP app wasn't configured with any capability tokens to allow it to connect to a network. + +### Internal Fields from netEvent, `Wfpdiag-Case-2.xml` + ```xml @@ -400,9 +397,11 @@ a network. ``` + The **netEvent** also shows information about the filter that explicitly dropped this packet, like the **FilterId**, listed under classify drop. -**Classify Drop from netEvent, Wfpdiag-Case-2.xml** +### Classify Drop from netEvent, `Wfpdiag-Case-2.xml` + ```xml 68893 @@ -417,71 +416,66 @@ The **netEvent** also shows information about the filter that explicitly dropped 0 ``` + If you search for the filter #68893 in Wfpdiag-Case2.xml, you'll see that the packet was dropped by a Block Outbound Default Rule filter. -**Block Outbound Default Rule Filter #68893, Wfpdiag-Case-2.xml** +### Block Outbound Default Rule Filter #68893, `Wfpdiag-Case-2.xml` ```xml - {6d51582f-bcf8-42c4-afc9-e2ce7155c11b} + {6d51582f-bcf8-42c4-afc9-e2ce7155c11b} /t - **Block Outbound Default Rule** - Block Outbound Default Rule - - - {4b153735-1049-4480-aab4-d1b9bdc03710} - - b001000000000000 - ........ - - FWPM_LAYER_ALE_AUTH_CONNECT_V6 - {b3cdd441-af90-41ba-a745-7c6008ff2300} - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - - FWP_ACTION_BLOCK - - - 0 - - 68893 - - FWP_UINT64 - 68719476736 - + **Block Outbound Default Rule** + Block Outbound Default Rule + + + {4b153735-1049-4480-aab4-d1b9bdc03710} + + b001000000000000 + ........ + + FWPM_LAYER_ALE_AUTH_CONNECT_V6 + {b3cdd441-af90-41ba-a745-7c6008ff2300} + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 68893 + + FWP_UINT64 + 68719476736 + ``` -A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and not allowed by the other filters in -the same sublayer. +A packet will reach a default block filter if the packet was unable to match any of the conditions of other filters, and not allowed by the other filters in the same sublayer. -If the packet had the correct capability token, -**FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**, it would have matched a condition for a -non-default block filter, and would have been permitted to reach bing.com. -Without the correct capability tokens, the packet will be explicitly dropped by -a default block outbound filter. +If the packet had the correct capability token, **FWP_CAPABILITIES_FLAG_INTERNET_CLIENT**, it would have matched a condition for a non-default block filter, and would have been permitted to reach bing.com. Without the correct capability tokens, the packet will be explicitly dropped by a default block outbound filter. ## Case 3: UWP app can't reach Internet target address without Internet Client capability In this example, the app is unable to connect to bing.com [2620:1ec:c11::200]. -The app in this scenario only has private network capabilities (Client and -Server). The app is trying to connect to an Internet resource (bing.com), but -only has a private network token. Therefore, the packet will be dropped. +The app in this scenario only has private network capabilities (Client and Server). The app is trying to connect to an Internet resource (bing.com), but only has a private network token. Therefore, the packet will be dropped. + +### Classify Drop netEvent, `Wfpdiag-Case-3.xml` -**Classify Drop netEvent, Wfpdiag-Case-3.xml** ```xml
@@ -555,489 +549,473 @@ only has a private network token. Therefore, the packet will be dropped. ## Case 4: UWP app can't reach Intranet target address without Private Network capability -In this example, the UWP app is unable to reach the Intranet target address, -10.50.50.50, because it doesn't have a Private Network capability. +In this example, the UWP app is unable to reach the Intranet target address, 10.50.50.50, because it doesn't have a Private Network capability. + +### Classify Drop netEvent, `Wfpdiag-Case-4.xml` -**Classify Drop netEvent, Wfpdiag-Case-4.xml** ```xml
- 2020-05-22T21:29:28.601Z - - FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET - FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET - FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET - FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET - FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET - FWPM_NET_EVENT_FLAG_APP_ID_SET - FWPM_NET_EVENT_FLAG_USER_ID_SET - FWPM_NET_EVENT_FLAG_IP_VERSION_SET - FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET - - FWP_IP_VERSION_V4 - 6 - 10.216.117.17 - 10.50.50.50 - 52998 - 53 - 0 - - 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. - .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... - - S-1-5-21-2993214446-1947230185-131795049-1000 - FWP_AF_INET - S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 - - 0 - + 2020-05-22T21:29:28.601Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.50.50.50 + 52998 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310031002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.1...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 +
- FWPM_NET_EVENT_TYPE_CLASSIFY_DROP - - 121180 - 48 - 0 - 1 - 1 - MS_FWP_DIRECTION_OUT - false - - 0 - 0 + FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 - - 0000000000000000 - - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER - - 0 - - - - 121180 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH - FWP_ACTION_BLOCK - - - 121165 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF - FWP_ACTION_PERMIT - - + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + ``` -## Case 5: UWP app can't reach “Intranet” target address with Private Network capability -In this example, the UWP app is unable to reach the Intranet target address, -10.1.1.1, even though it has a Private Network capability token. +## Case 5: UWP app can't reach "Intranet" target address with Private Network capability + +In this example, the UWP app is unable to reach the Intranet target address, 10.1.1.1, even though it has a Private Network capability token. + +### Classify Drop netEvent, `Wfpdiag-Case-5.xml` -**Classify Drop netEvent, Wfpdiag-Case-5.xml** ```xml -
- 2020-05-22T20:54:53.499Z - - FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET - FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET - FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET - FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET - FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET - FWPM_NET_EVENT_FLAG_APP_ID_SET - FWPM_NET_EVENT_FLAG_USER_ID_SET - FWPM_NET_EVENT_FLAG_IP_VERSION_SET - FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET - - FWP_IP_VERSION_V4 - 6 - 10.216.117.17 - 10.1.1.1 - 52956 - 53 - 0 - - 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. - .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... - - S-1-5-21-2993214446-1947230185-131795049-1000 - FWP_AF_INET - S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 - - 0 - +
+ 2020-05-22T20:54:53.499Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.216.117.17 + 10.1.1.1 + 52956 + 53 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310033002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.3...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-2993214446-1947230185-131795049-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 +
- FWPM_NET_EVENT_TYPE_CLASSIFY_DROP - - 121180 - 48 - 0 - 1 - 1 - MS_FWP_DIRECTION_OUT - false - - 0 - 0 - - - - 0000000000000000 - - FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK - - 0 - - - - 121180 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH - FWP_ACTION_BLOCK - - - 121165 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF - FWP_ACTION_PERMIT - - - + FWPM_NET_EVENT_TYPE_CLASSIFY_DROP + + 121180 + 48 + 0 + 1 + 1 + MS_FWP_DIRECTION_OUT + false + + 0 + 0 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 121180 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_BLOCK + + + 121165 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + ``` + The following shows the filter that blocked the event: -**Block Outbound Default Rule Filter \#121180, Wfpdiag-Case-5.xml** +### Block Outbound Default Rule Filter #121180, `Wfpdiag-Case-5.xml` ```xml - {e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6} - - Block Outbound Default Rule - Block Outbound Default Rule - - - FWPM_PROVIDER_MPSSVC_WSH - - c029000000000000 - .)...... - - FWPM_LAYER_ALE_AUTH_CONNECT_V4 - FWPM_SUBLAYER_MPSSVC_WSH - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - - FWP_ACTION_BLOCK - - - 0 - - 121180 - - FWP_UINT64 - 274877906944 - + {e62a1a22-c80a-4518-a7f8-e7d1ef3a9ff6} + + Block Outbound Default Rule + Block Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + c029000000000000 + .)...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + + FWP_ACTION_BLOCK + + + 0 + + 121180 + + FWP_UINT64 + 274877906944 + ``` -If the target was in the private range, then it should have been allowed by a -PrivateNetwork Outbound Default Rule filter. -The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, -10.1.1.1, isn't included in these filters it becomes clear that the address isn't in the private range. Check the policies that configure the private range -on the device (MDM, Group Policy, etc.) and make sure it includes the private target address you wanted to reach. +If the target was in the private range, then it should have been allowed by a PrivateNetwork Outbound Default Rule filter. + +The following PrivateNetwork Outbound Default Rule filters have conditions for matching Intranet IP addresses. Since the expected Intranet target address, 10.1.1.1, isn't included in these filters it becomes clear that the address isn't in the private range. Check the policies that configure the private range on the device (MDM, Group Policy, etc.) and make sure it includes the private target address you wanted to reach. + +### PrivateNetwork Outbound Default Rule Filters, `Wfpdiag-Case-5.xml` -**PrivateNetwork Outbound Default Rule Filters, Wfpdiag-Case-5.xml** ```xml - {fd65507b-e356-4e2f-966f-0c9f9c1c6e78} - - PrivateNetwork Outbound Default Rule - PrivateNetwork Outbound Default Rule - - - FWPM_PROVIDER_MPSSVC_WSH - - f22d000000000000 - .-...... - - FWPM_LAYER_ALE_AUTH_CONNECT_V4 - FWPM_SUBLAYER_MPSSVC_WSH - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - FWPM_CONDITION_IP_REMOTE_ADDRESS - FWP_MATCH_EQUAL - - FWP_UINT32 - 1.1.1.1 - - - - FWPM_CONDITION_ORIGINAL_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_CURRENT_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_ALE_USER_ID - FWP_MATCH_EQUAL - - FWP_SECURITY_DESCRIPTOR_TYPE - O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) - - - - - FWP_ACTION_PERMIT - - - 0 - - 129656 - - FWP_UINT64 - 144115600392724416 - - - - {b11b4f8a-222e-49d6-8d69-02728681d8bc} - - PrivateNetwork Outbound Default Rule - PrivateNetwork Outbound Default Rule - - - FWPM_PROVIDER_MPSSVC_WSH - - f22d000000000000 - .-...... - - FWPM_LAYER_ALE_AUTH_CONNECT_V4 - FWPM_SUBLAYER_MPSSVC_WSH - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - FWPM_CONDITION_IP_REMOTE_ADDRESS - FWP_MATCH_RANGE - - FWP_RANGE_TYPE - - - FWP_UINT32 - 172.16.0.0 - - - FWP_UINT32 - 172.31.255.255 - - - - - - FWPM_CONDITION_ORIGINAL_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_CURRENT_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_ALE_USER_ID - FWP_MATCH_EQUAL - - FWP_SECURITY_DESCRIPTOR_TYPE - O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) - - - - - FWP_ACTION_PERMIT - - - 0 - - 129657 - - FWP_UINT64 - 36029209335832512 - + {fd65507b-e356-4e2f-966f-0c9f9c1c6e78} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_EQUAL + + FWP_UINT32 + 1.1.1.1 + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129656 + + FWP_UINT64 + 144115600392724416 + + + + {b11b4f8a-222e-49d6-8d69-02728681d8bc} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 172.16.0.0 + + + FWP_UINT32 + 172.31.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129657 + + FWP_UINT64 + 36029209335832512 + - {21cd82bc-6077-4069-94bf-750e5a43ca23} - - PrivateNetwork Outbound Default Rule - PrivateNetwork Outbound Default Rule - - - FWPM_PROVIDER_MPSSVC_WSH - - f22d000000000000 - .-...... - - FWPM_LAYER_ALE_AUTH_CONNECT_V4 - FWPM_SUBLAYER_MPSSVC_WSH - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - FWPM_CONDITION_IP_REMOTE_ADDRESS - FWP_MATCH_RANGE - - FWP_RANGE_TYPE - - - FWP_UINT32 - 192.168.0.0 - - - FWP_UINT32 - 192.168.255.255 - - - - - - FWPM_CONDITION_ORIGINAL_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_CURRENT_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_ALE_USER_ID - FWP_MATCH_EQUAL - - FWP_SECURITY_DESCRIPTOR_TYPE - O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) - - - - - FWP_ACTION_PERMIT - - - 0 - - 129658 - - FWP_UINT64 - 36029209335832512 - + {21cd82bc-6077-4069-94bf-750e5a43ca23} + + PrivateNetwork Outbound Default Rule + PrivateNetwork Outbound Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + f22d000000000000 + .-...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 192.168.0.0 + + + FWP_UINT32 + 192.168.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-3)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 129658 + + FWP_UINT64 + 36029209335832512 + ``` -## Debugging Past Drops -If you're debugging a network drop from the past or from a remote machine, you -may have traces already collected from Feedback Hub, such as nettrace.etl and -wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the -netEvents of the reproduced event, and wfpstate.xml will contain the filters -that were present on the machine at the time. +## Debugging Past Drops -If you don't have a live repro or traces already collected, you can still -collect traces after the UWP network connectivity issue has happened by running -these commands in an admin command prompt +If you're debugging a network drop from the past or from a remote machine, you may have traces already collected from Feedback Hub, such as nettrace.etl and wfpstate.xml. Once nettrace.etl is converted, nettrace.txt will have the netEvents of the reproduced event, and wfpstate.xml will contain the filters that were present on the machine at the time. + +If you don't have a live repro or traces already collected, you can still collect traces after the UWP network connectivity issue has happened by running these commands in an admin command prompt: ```xml - - Netsh wfp show netevents - Netsh wfp show state + + Netsh wfp show netevents + Netsh wfp show state ``` -**Netsh wfp show netevents** creates netevents.xml, which contains the past -net events. **Netsh wfp show state** creates wfpstate.xml, which contains -the current filters present on the machine. +`Netsh wfp show netevents` creates `netevents.xml`, which contains the past net events. `Netsh wfp show state` creates wfpstate.xml, which contains the current filters present on the machine. Unfortunately, collecting traces after the UWP network connectivity issue isn't always reliable. -NetEvents on the device are stored in a buffer. Once that buffer has reached -maximum capacity, the buffer will overwrite older net events. Due to the buffer -overwrite, it's possible that the collected netevents.xml won't contain the -net event associated with the UWP network connectivity issue. It could have been ov -overwritten. Additionally, filters on the device can get deleted and re-added -with different filterIds due to miscellaneous events on the device. Because of -these implications, a **filterId** from **netsh wfp show netevents** may not necessarily match any -filter in **netsh wfp show state** because that **filterId** may be outdated. +NetEvents on the device are stored in a buffer. Once that buffer has reached maximum capacity, the buffer will overwrite older net events. Due to the buffer overwrite, it's possible that the collected netevents.xml won't contain the net event associated with the UWP network connectivity issue. It could have been overwritten. Additionally, filters on the device can get deleted and re-added with different filterIds due to miscellaneous events on the device. Because of these implications, a **filterId** from **netsh wfp show netevents** may not necessarily match any filter in **netsh wfp show state** because that **filterId** may be outdated. -If you can reproduce the UWP network connectivity issue consistently, we -recommend using the commands from Debugging Live Drops instead. +If you can reproduce the UWP network connectivity issue consistently, we recommend using the commands from Debugging Live Drops instead. -Additionally, you can still follow the examples from Debugging Live Drops -section using the trace commands in this section, even if you don't have a live -repro. The **netEvents** and filters are stored in one file in Debugging Live Drops +Additionally, you can still follow the examples from Debugging Live Drops section using the trace commands in this section, even if you don't have a live repro. The **netEvents** and filters are stored in one file in Debugging Live Drops as opposed to two separate files in the following Debugging Past Drops examples. ## Case 7: Debugging Past Drop - UWP app can't reach Internet target address and has no capabilities In this example, the UWP app is unable to connect to bing.com. -Classify Drop Net Event, NetEvents-Case-7.xml +### Classify Drop Net Event, `NetEvents-Case-7.xml` ```xml @@ -1108,15 +1086,12 @@ Classify Drop Net Event, NetEvents-Case-7.xml ``` -The Internal fields list no active capabilities, and the packet is dropped at -filter 206064. +The Internal fields list no active capabilities, and the packet is dropped at nfilter 206064. -This filter is a default block rule filter, meaning the packet passed through every -filter that could have allowed it, but because conditions didn’t match for any of -those filters, the packet fell to the filter that blocks any packet that the -Security Descriptor doesn’t match. +This filter is a default block rule filter, meaning the packet passed through every filter that could have allowed it, but because conditions didn't match for any of those filters, the packet fell to the filter that blocks any packet that the +Security Descriptor doesn't match. -**Block Outbound Default Rule Filter \#206064, FilterState-Case-7.xml** +### Block Outbound Default Rule Filter #206064, `FilterState-Case-7.xml` ```xml @@ -1159,165 +1134,166 @@ Security Descriptor doesn’t match. ``` + ## Case 8: Debugging Past Drop - UWP app connects to Internet target address with all capabilities In this example, the UWP app successfully connects to bing.com [204.79.197.200]. -**Classify Allow Net Event, NetEvents-Case-8.xml** +### Classify Allow Net Event, `NetEvents-Case-8.xml` ```xml -
- 2020-05-04T18:49:55.101Z - - FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET - FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET - FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET - FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET - FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET - FWPM_NET_EVENT_FLAG_APP_ID_SET - FWPM_NET_EVENT_FLAG_USER_ID_SET - FWPM_NET_EVENT_FLAG_IP_VERSION_SET - FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET - - FWP_IP_VERSION_V4 - 6 - 10.195.36.30 - 204.79.197.200 - 61673 - 443 - 0 - - 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 - \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. - .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... - - S-1-5-21-1578316205-4060061518-881547182-1000 - FWP_AF_INET - S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 - - 0 - -
- FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW - - 208757 - 48 - 0 - 1 - 1 - - - - 0000000000000000 - - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT - FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER - FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK - - 0 - - - - 208757 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH - FWP_ACTION_PERMIT - - - 206049 - FWPP_SUBLAYER_INTERNAL_FIREWALL_WF - FWP_ACTION_PERMIT - - - +
+ 2020-05-04T18:49:55.101Z + + FWPM_NET_EVENT_FLAG_IP_PROTOCOL_SET + FWPM_NET_EVENT_FLAG_LOCAL_ADDR_SET + FWPM_NET_EVENT_FLAG_REMOTE_ADDR_SET + FWPM_NET_EVENT_FLAG_LOCAL_PORT_SET + FWPM_NET_EVENT_FLAG_REMOTE_PORT_SET + FWPM_NET_EVENT_FLAG_APP_ID_SET + FWPM_NET_EVENT_FLAG_USER_ID_SET + FWPM_NET_EVENT_FLAG_IP_VERSION_SET + FWPM_NET_EVENT_FLAG_PACKAGE_ID_SET + + FWP_IP_VERSION_V4 + 6 + 10.195.36.30 + 204.79.197.200 + 61673 + 443 + 0 + + 5c006400650076006900630065005c0068006100720064006400690073006b0076006f006c0075006d00650031005c00700072006f006700720061006d002000660069006c00650073005c00770069006e0064006f007700730061007000700073005c00610066003600390032006200660066002d0036003700370039002d0034003200340066002d0038003700300065002d006600360065003500390063003500300032003300340039005f0031002e0031002e00310030002e0030005f007800360034005f005f00350063003000330037006a0061007200350038003300390072005c0075007700700073006f0063006b006500740063006c00690065006e0074002e006500780065000000 + \\.d.e.v.i.c.e.\\.h.a.r.d.d.i.s.k.v.o.l.u.m.e.1.\\.p.r.o.g.r.a.m. + .f.i.l.e.s.\\.w.i.n.d.o.w.s.a.p.p.s.\\.a.f.6.9.2.b.f.f.-.6.7.7.9.-.4.2.4.f.-.8.7.0.e.-.f.6.e.5.9.c.5.0.2.3.4.9._.1...1...1.0...0._.x.6.4._._.5.c.0.3.7.j.a.r.5.8.3.9.r.\\.u.w.p.s.o.c.k.e.t.c.l.i.e.n.t...e.x.e... + + S-1-5-21-1578316205-4060061518-881547182-1000 + FWP_AF_INET + S-1-15-2-4163697451-3176919390-1155390458-2883473650-3020241727-522149888-4067122936 + + 0 + +
+ FWPM_NET_EVENT_TYPE_CLASSIFY_ALLOW + + 208757 + 48 + 0 + 1 + 1 + + + + 0000000000000000 + + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT + FWP_CAPABILITIES_FLAG_INTERNET_CLIENT_SERVER + FWP_CAPABILITIES_FLAG_PRIVATE_NETWORK + + 0 + + + + 208757 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WSH + FWP_ACTION_PERMIT + + + 206049 + FWPP_SUBLAYER_INTERNAL_FIREWALL_WF + FWP_ACTION_PERMIT + + + ``` + All capabilities are enabled and the resulting filter determining the flow of the packet is 208757. The filter stated above with action permit: -**InternetClient Default Rule Filter \#208757, FilterState-Case-8.xml** +### InternetClient Default Rule Filter #208757, `FilterState-Case-8.xml` + ```xml - {e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5} - - InternetClient Default Rule - InternetClient Default Rule - - - FWPM_PROVIDER_MPSSVC_WSH - - e167000000000000 - .g...... - - FWPM_LAYER_ALE_AUTH_CONNECT_V4 - FWPM_SUBLAYER_MPSSVC_WSH - - FWP_EMPTY - - - - FWPM_CONDITION_ALE_PACKAGE_ID - FWP_MATCH_NOT_EQUAL - - FWP_SID - S-1-0-0 - - - - FWPM_CONDITION_IP_REMOTE_ADDRESS - FWP_MATCH_RANGE - - FWP_RANGE_TYPE - - - FWP_UINT32 - 0.0.0.0 - - - FWP_UINT32 - 255.255.255.255 - - - - - - FWPM_CONDITION_ORIGINAL_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_CURRENT_PROFILE_ID - FWP_MATCH_EQUAL - - FWP_UINT32 - 1 - - - - FWPM_CONDITION_ALE_USER_ID - FWP_MATCH_EQUAL - - FWP_SECURITY_DESCRIPTOR_TYPE - O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) - - - - - FWP_ACTION_PERMIT - - - 0 - - 208757 - - FWP_UINT64 - 412316868544 - - + {e0f6f24e-1f0a-4f1a-bdd8-b9277c144fb5} + + InternetClient Default Rule + InternetClient Default Rule + + + FWPM_PROVIDER_MPSSVC_WSH + + e167000000000000 + .g...... + + FWPM_LAYER_ALE_AUTH_CONNECT_V4 + FWPM_SUBLAYER_MPSSVC_WSH + + FWP_EMPTY + + + + FWPM_CONDITION_ALE_PACKAGE_ID + FWP_MATCH_NOT_EQUAL + + FWP_SID + S-1-0-0 + + + + FWPM_CONDITION_IP_REMOTE_ADDRESS + FWP_MATCH_RANGE + + FWP_RANGE_TYPE + + + FWP_UINT32 + 0.0.0.0 + + + FWP_UINT32 + 255.255.255.255 + + + + + + FWPM_CONDITION_ORIGINAL_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_CURRENT_PROFILE_ID + FWP_MATCH_EQUAL + + FWP_UINT32 + 1 + + + + FWPM_CONDITION_ALE_USER_ID + FWP_MATCH_EQUAL + + FWP_SECURITY_DESCRIPTOR_TYPE + O:LSD:(A;;CC;;;S-1-15-3-1)(A;;CC;;;WD)(A;;CC;;;AN) + + + + + FWP_ACTION_PERMIT + + + 0 + + 208757 + + FWP_UINT64 + 412316868544 + + ``` -The capabilities field in a netEvent was added to the traces in the Windows 10 -May 2019 Update. diff --git a/windows/security/security-foundations/zero-trust-windows-device-health.md b/windows/security/security-foundations/zero-trust-windows-device-health.md index 65cc2e9e7d..f80e2bf591 100644 --- a/windows/security/security-foundations/zero-trust-windows-device-health.md +++ b/windows/security/security-foundations/zero-trust-windows-device-health.md @@ -1,14 +1,11 @@ --- title: Zero Trust and Windows device health description: Describes the process of Windows device health attestation -ms.reviewer: ms.topic: conceptual manager: aaroncz ms.author: paoloma author: paolomatarazzo -ms.prod: windows-client -ms.technology: itpro-security -ms.date: 12/31/2017 +ms.date: 11/07/2023 --- # Zero Trust and Windows device health @@ -17,11 +14,9 @@ Organizations need a security model that more effectively adapts to the complexi The [Zero Trust](https://www.microsoft.com/security/business/zero-trust) principles are: -- **Verify explicitly**. Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification, and monitor anomalies. - -- **Use least-privileged access**. Limit user access with just-in-time and just-enough-access, risk-based adaptive policies, and data protection to help secure data and maintain productivity. - -- **Assume breach**. Prevent attackers from obtaining access to minimize potential damage to data and systems. Protect privileged roles, verify end-to-end encryption, use analytics to get visibility, and drive threat detection to improve defenses. +- **Verify explicitly**. Always authenticate and authorize based on all available data points, including user identity, location, device health, service or workload, data classification, and monitor anomalies +- **Use least-privileged access**. Limit user access with just-in-time and just-enough-access, risk-based adaptive policies, and data protection to help secure data and maintain productivity +- **Assume breach**. Prevent attackers from obtaining access to minimize potential damage to data and systems. Protect privileged roles, verify end-to-end encryption, use analytics to get visibility, and drive threat detection to improve defenses The Zero Trust concept of **verify explicitly** applies to the risks introduced by both devices and users. Windows enables **device health attestation** and **conditional access** capabilities, which are used to grant access to corporate resources. @@ -45,25 +40,19 @@ Windows includes many security features to help protect users from malware and a A summary of the steps involved in attestation and Zero Trust on the device side are as follows: -1. During each step of the boot process, such as a file load, update of special variables, and more, information such as file hashes and signature are measured in the TPM PCRs. The measurements are bound by a [Trusted Computing Group specification](https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/) (TCG) that dictates what events can be recorded and the format of each event. +1. During each step of the boot process, such as a file load, update of special variables, and more, information such as file hashes and signature are measured in the TPM PCRs. The measurements are bound by a [Trusted Computing Group specification](https://trustedcomputinggroup.org/resource/pc-client-platform-tpm-profile-ptp-specification/) (TCG) that dictates what events can be recorded and the format of each event +1. Once Windows has booted, the attestor/verifier requests the TPM to fetch the measurements stored in its Platform Configuration Register (PCR) alongside a TCG log. The measurements in both these components together form the attestation evidence that is then sent to the attestation service +1. The TPM is verified by using the keys/cryptographic material available on the chipset with an [Azure Certificate Service](/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation) +1. This information is then sent to the attestation service in the cloud to verify that the device is safe. Microsoft Endpoint Manger integrates with Microsoft Azure Attestation to review device health comprehensively and connect this information with Microsoft Entra Conditional Access. This integration is key for Zero Trust solutions that help bind trust to an untrusted device +1. The attestation service does the following tasks: -2. Once Windows has booted, the attestor/verifier requests the TPM to fetch the measurements stored in its Platform Configuration Register (PCR) alongside a TCG log. The measurements in both these components together form the attestation evidence that is then sent to the attestation service. + - Verify the integrity of the evidence. This verification is done by validating the PCRs that match the values recomputed by replaying the TCG log + - Verify that the TPM has a valid Attestation Identity Key issued by the authenticated TPM + - Verify that the security features are in the expected states -3. The TPM is verified by using the keys/cryptographic material available on the chipset with an [Azure Certificate Service](/windows-server/identity/ad-ds/manage/component-updates/tpm-key-attestation). - -4. This information is then sent to the attestation service in the cloud to verify that the device is safe. Microsoft Endpoint Manger integrates with Microsoft Azure Attestation to review device health comprehensively and connect this information with Microsoft Entra Conditional Access. This integration is key for Zero Trust solutions that help bind trust to an untrusted device. - -5. The attestation service does the following tasks: - - - Verify the integrity of the evidence. This verification is done by validating the PCRs that match the values recomputed by replaying the TCG log. - - Verify that the TPM has a valid Attestation Identity Key issued by the authenticated TPM. - - Verify that the security features are in the expected states. - -6. The attestation service returns an attestation report that contains information about the security features based on the policy configured in the attestation service. - -7. The device then sends the report to the Microsoft Intune cloud to assess the trustworthiness of the platform according to the admin-configured device compliance rules. - -8. Conditional access, along with device-compliance state then decides to allow or deny access. +1. The attestation service returns an attestation report that contains information about the security features based on the policy configured in the attestation service +1. The device then sends the report to the Microsoft Intune cloud to assess the trustworthiness of the platform according to the admin-configured device compliance rules +1. Conditional access, along with device-compliance state then decides to allow or deny access ## Other Resources From 5882e4dd9e55204f4ff313a90ed089eb2d942be9 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 14:02:37 -0500 Subject: [PATCH 15/21] Acrolinx --- .../filter-origin-documentation.md | 26 ++++++++----------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md index 3f99ba346f..b875b47bbf 100644 --- a/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md +++ b/windows/security/operating-system-security/network-security/windows-firewall/filter-origin-documentation.md @@ -13,18 +13,14 @@ Typically, when investigating packet drop events, a customer would use the field ![Event properties.](images/event-properties-5157.png) -The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. +The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. However, the filter ID isn't a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. This change in ID makes the diagnosis process error-prone and difficult. -However, the filter ID isn't a reliable source for tracing back to the filter or the rule, as the filter ID can change for many reasons despite the rule not changing at all. This change in ID makes the diagnosis process error-prone and difficult. - -For customers to debug packet drop events correctly and efficiently, they would need more context about the blocking filter such as its origin. - -The blocking filters can be categorized under these filter origins: +For customers to debug packet drop events correctly and efficiently, they would need more context about the blocking filter such as its origin. The blocking filters can be categorized under these filter origins: 1. Firewall rules 1. Firewall default block filters 1. AppContainer loopback - 1. Boottime default + 1. Boot time default 1. Quarantine default 1. Query user default 1. Stealth @@ -52,7 +48,7 @@ To enable a specific audit event, run the corresponding command in an administra ## Example flow of debugging packet drops with filter origin -As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on. +As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop, and the interface it happened on. ![Event audit.](images/event-audit-5157.png) @@ -82,15 +78,15 @@ Network drop events from the AppContainer loopback block filter origin occur whe To enable localhost loopback in a local debugging environment, see [Communicating with localhost](/windows/iot-core/develop-your-app/loopback). -To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged win32 app, see [uap4:LoopbackAccessRules](/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules). +To enable localhost loopback for a published app that requires loopback access to communicate with another UWP or packaged Win32 app, see [uap4:LoopbackAccessRules](/uwp/schemas/appxpackage/uapmanifestschema/element-uap4-loopbackaccessrules). -### Boottime default +### Boot time default -Network drop events from the boottime default block filter origin occur when the computer is booting up and the firewall service isn't yet running. Services will need to create a boottime allow filter to allow the traffic. It should be noted that it's not possible to add boottime filters through firewall rules. +Network drop events from the boot time default block filter origin occur when the computer is booting up and the firewall service isn't yet running. Services need to create a boot time allow filter to allow the traffic. It should be noted that it's not possible to add boot time filters through firewall rules. ### Quarantine default -Network drops from the quarantine default block filter occur when the interface is temporarily quarantined by Firewall service. The firewall service quarantines an interface when it detects a change on the network, and based on several other factors, the firewall service may put the interface in quarantine as a safeguard. When an interface is in quarantine, the quarantine default block filter will block any new non-loopback inbound connections. +Network drops from the quarantine default *block filter* occur when the interface is temporarily quarantined by the Firewall service. The firewall service quarantines an interface when it detects a change on the network, and based on several other factors, the firewall service might put the interface in quarantine as a safeguard. When an interface quarantined, the quarantine default *block filter* blocks any new non-loopback inbound connections. Run the following PowerShell command to generate more information about the interface: @@ -108,9 +104,9 @@ To learn more about the quarantine feature, see [Quarantine behavior](quarantine ### Query user default -Network packet drops from query user default block filters occur when there's no explicit rule created to allow an inbound connection for the packet. When an application binds to a socket but doesn't have a corresponding inbound rule to allow packets on that port, Windows generates a pop up for the user to allow or deny the app to receive packets on the available network categories. If the user clicks to deny the connection in this popup, subsequent inbound packets to the app will be dropped. To resolve the drops: +Network packet drops from query user default block filters occur when there's no explicit rule created to allow an inbound connection for the packet. When an application binds to a socket but doesn't have a corresponding inbound rule to allow packets on that port, Windows generates a pop-up for the user to allow or deny the app to receive packets on the available network categories. If the user selects to deny the connection in the pop-up, subsequent inbound packets to the app will be dropped. To resolve the drops: -1. Create an inbound firewall rule to allow the packet for this application. This packet will allow the packet to bypass any query user default block filters +1. Create an inbound firewall rule to allow the packet for this application. The rule allows the packet to bypass any query user default block filters 1. Delete any block query user rules that may have been auto generated by the firewall service To generate a list of all the query user block rules, you can run the following PowerShell command: @@ -149,4 +145,4 @@ For more information on how to debug drops caused by UWP default block filters, ### WSH default -Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn't an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner will need to configure allow rules for the service if the block isn't expected. +Network drops from Windows Service Hardening (WSH) default filters indicate that there wasn't an explicit Windows Service Hardening allow rule to allow network traffic for the protected service. The service owner needs to configure *allow rules* for the service if the block isn't expected. From adf2ad6b0afd86f35e29289ef77ab2363c793d5b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 16:10:34 -0500 Subject: [PATCH 16/21] move some content to include files for consistency --- .../passkeys/includes/create-passkey.md | 44 +++++++++ .../passkeys/includes/use-passkey.md | 38 ++++++++ .../identity-protection/passkeys/index.md | 90 ++++--------------- 3 files changed, 98 insertions(+), 74 deletions(-) create mode 100644 windows/security/identity-protection/passkeys/includes/create-passkey.md create mode 100644 windows/security/identity-protection/passkeys/includes/use-passkey.md diff --git a/windows/security/identity-protection/passkeys/includes/create-passkey.md b/windows/security/identity-protection/passkeys/includes/create-passkey.md new file mode 100644 index 0000000000..64e07b4dd3 --- /dev/null +++ b/windows/security/identity-protection/passkeys/includes/create-passkey.md @@ -0,0 +1,44 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 11/07/2023 +ms.topic: include +--- + +:::row::: + :::column span="4"::: + + 1. Open a website or app that supports passkeys + + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + + 2. Create a passkey from your account settings + + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + 3. Choose where to save the passkey. By default, Windows offers to save the passkey locally if you're using Windows Hello or Windows Hello for Business. If you select the option **Use another device**, you can choose to save the passkey in one of the following locations: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + + - **This Windows device**: the passkey is saved locally on your Windows device, and protected by Windows Hello (biometrics and PIN) + - **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device + - **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices + - **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) + + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/save-passkey.png" alt-text="Screenshot showing a dialog box prompting the user to pick a location to store the passkey." lightbox="images/save-passkey.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="4"::: + 4. Select **Next** + :::column-end::: +:::row-end::: diff --git a/windows/security/identity-protection/passkeys/includes/use-passkey.md b/windows/security/identity-protection/passkeys/includes/use-passkey.md new file mode 100644 index 0000000000..0d40b21a54 --- /dev/null +++ b/windows/security/identity-protection/passkeys/includes/use-passkey.md @@ -0,0 +1,38 @@ +--- +author: paolomatarazzo +ms.author: paoloma +ms.date: 11/07/2023 +ms.topic: include +--- + +:::row::: + :::column span="3"::: + 1. Open a website or app that supports passkeys + :::column-end::: + :::column span="1"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + 2. Select **Sign in with a passkey**, or a similar option + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/website.png" alt-text="Screenshot of a website offering the passkey sign in option." lightbox="images/website.png" border="false"::: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + 3. If a passkey is stored locally and protected by Windows Hello, you're prompted to use Windows Hello to sign in. If you select the option **Use another device**, you can choose one of the following options: + :::column-end::: +:::row-end::: +:::row::: + :::column span="3"::: + - **This Windows device**: use this option to use a passkey that is stored locally on your Windows device, and protected by Windows Hello + - **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device + - **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices + - **Security key**: use this option if you want to sign in with a passkey stored on a FIDO2 security key + :::column-end::: + :::column span="1"::: + :::image type="content" source="images/use-passkey.png" alt-text="Screenshot of the passkey dialog prompting the user to pick where the passkey is stored." lightbox="images/use-passkey.png" border="false"::: + :::column-end::: +:::row-end::: \ No newline at end of file diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index 06247b9a94..1b0736293b 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -40,50 +40,12 @@ Passkeys have several advantages over passwords, including their ease of use and ### Create a passkey -Follow these steps to create a passkey from a Windows device: - -:::row::: - :::column span="4"::: - - 1. Open a website or app that supports passkeys - - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - - 2. Create a passkey from your account settings - - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - 3. Choose where to save the passkey. By default, Windows offers to save the passkey locally if you're using Windows Hello or Windows Hello for Business. If you select the option **Use another device**, you can choose to save the passkey in one of the following locations: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - -- **This Windows device**: the passkey is saved locally on your Windows device, and protected by Windows Hello (biometrics and PIN) -- **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device -- **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices -- **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) - - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/save-passkey.png" alt-text="Screenshot showing a dialog box prompting the user to pick a location to store the passkey." lightbox="images/save-passkey.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="4"::: - 4. Select **Next** - :::column-end::: -:::row-end::: - Pick one of the following options to learn how to save a passkey, based on where you want to store it. #### [:::image type="icon" source="images/laptop.svg" border="false"::: **Windows device**](#tab/windows) +[!INCLUDE [use-passkey](includes/create-passkey.md)] + :::row::: :::column span="3"::: @@ -107,6 +69,8 @@ Pick one of the following options to learn how to save a passkey, based on where #### [:::image type="icon" source="images/qr-code.svg" border="false"::: **New phone or tablet**](#tab/mobile) +[!INCLUDE [use-passkey](includes/create-passkey.md)] + :::row::: :::column span="3"::: @@ -130,6 +94,8 @@ Pick one of the following options to learn how to save a passkey, based on where #### [:::image type="icon" source="images/phone.svg" border="false"::: **Linked phone or tablet**](#tab/linked) +[!INCLUDE [use-passkey](includes/create-passkey.md)] + :::row::: :::column span="3"::: @@ -153,6 +119,8 @@ Pick one of the following options to learn how to save a passkey, based on where #### [:::image type="icon" source="images/usb.svg" border="false"::: **Security key**](#tab/key) +[!INCLUDE [use-passkey](includes/create-passkey.md)] + :::row::: :::column span="3"::: @@ -178,44 +146,12 @@ Pick one of the following options to learn how to save a passkey, based on where ### Use a passkey -Follow these steps to use a passkey: - -:::row::: - :::column span="3"::: - 1. Open a website or app that supports passkeys - :::column-end::: - :::column span="1"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - 2. Select **Sign in with a passkey**, or a similar option - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/website.png" alt-text="Screenshot of a website offering the passkey sign in option." lightbox="images/website.png" border="false"::: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - 3. If a passkey is stored locally and protected by Windows Hello, you're prompted to use Windows Hello to sign in. If you select the option **Use another device**, you can choose one of the following options: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: -- **This Windows device**: use this option to use a passkey that is stored locally on your Windows device, and protected by Windows Hello -- **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device -- **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices -- **Security key**: use this option if you want to sign in with a passkey stored on a FIDO2 security key - :::column-end::: - :::column span="1"::: - :::image type="content" source="images/use-passkey.png" alt-text="Screenshot of the passkey dialog prompting the user to pick where the passkey is stored." lightbox="images/use-passkey.png" border="false"::: - :::column-end::: -:::row-end::: - Pick one of the following options to learn how to use a passkey, based on where you saved it. #### [:::image type="icon" source="images/laptop.svg" border="false"::: **Windows device**](#tab/windows) +[!INCLUDE [use-passkey](includes/use-passkey.md)] + :::row::: :::column span="3"::: @@ -238,6 +174,8 @@ Pick one of the following options to learn how to use a passkey, based on where #### [:::image type="icon" source="images/qr-code.svg" border="false"::: **Phone or tablet**](#tab/mobile) +[!INCLUDE [use-passkey](includes/use-passkey.md)] + :::row::: :::column span="3"::: @@ -258,6 +196,8 @@ Pick one of the following options to learn how to use a passkey, based on where #### [:::image type="icon" source="images/phone.svg" border="false"::: **Linked phone or tablet**](#tab/linked) +[!INCLUDE [use-passkey](includes/use-passkey.md)] + :::row::: :::column span="3"::: @@ -280,6 +220,8 @@ Pick one of the following options to learn how to use a passkey, based on where #### [:::image type="icon" source="images/usb.svg" border="false"::: **Security key**](#tab/key) +[!INCLUDE [use-passkey](includes/use-passkey.md)] + :::row::: :::column span="3"::: From f861f450ac08232ddd08a712ab7e010b467a2eb0 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 16:19:20 -0500 Subject: [PATCH 17/21] design update --- .../passkeys/includes/create-passkey.md | 18 ++++++------------ .../passkeys/includes/use-passkey.md | 8 ++------ 2 files changed, 8 insertions(+), 18 deletions(-) diff --git a/windows/security/identity-protection/passkeys/includes/create-passkey.md b/windows/security/identity-protection/passkeys/includes/create-passkey.md index 64e07b4dd3..cc2fd7a085 100644 --- a/windows/security/identity-protection/passkeys/includes/create-passkey.md +++ b/windows/security/identity-protection/passkeys/includes/create-passkey.md @@ -19,22 +19,16 @@ ms.topic: include :::column-end::: :::row-end::: -:::row::: - :::column span="4"::: - 3. Choose where to save the passkey. By default, Windows offers to save the passkey locally if you're using Windows Hello or Windows Hello for Business. If you select the option **Use another device**, you can choose to save the passkey in one of the following locations: - :::column-end::: -:::row-end::: :::row::: :::column span="3"::: - - - **This Windows device**: the passkey is saved locally on your Windows device, and protected by Windows Hello (biometrics and PIN) - - **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - - **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices - - **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) - + 3. Choose where to save the passkey. By default, Windows offers to save the passkey locally if you're using Windows Hello or Windows Hello for Business. If you select the option **Use another device**, you can choose to save the passkey in one of the following locations: + - **This Windows device**: the passkey is saved locally on your Windows device, and protected by Windows Hello (biometrics and PIN) + - **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device + - **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices + - **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) :::column-end::: :::column span="1"::: - :::image type="content" source="images/save-passkey.png" alt-text="Screenshot showing a dialog box prompting the user to pick a location to store the passkey." lightbox="images/save-passkey.png" border="false"::: + :::image type="content" source="../images/save-passkey.png" alt-text="Screenshot showing a dialog box prompting the user to pick a location to store the passkey." lightbox="../images/save-passkey.png" border="false"::: :::column-end::: :::row-end::: :::row::: diff --git a/windows/security/identity-protection/passkeys/includes/use-passkey.md b/windows/security/identity-protection/passkeys/includes/use-passkey.md index 0d40b21a54..787b267f0c 100644 --- a/windows/security/identity-protection/passkeys/includes/use-passkey.md +++ b/windows/security/identity-protection/passkeys/includes/use-passkey.md @@ -17,22 +17,18 @@ ms.topic: include 2. Select **Sign in with a passkey**, or a similar option :::column-end::: :::column span="1"::: - :::image type="content" source="images/website.png" alt-text="Screenshot of a website offering the passkey sign in option." lightbox="images/website.png" border="false"::: + :::image type="content" source="../images/website.png" alt-text="Screenshot of a website offering the passkey sign in option." lightbox="../images/website.png" border="false"::: :::column-end::: :::row-end::: :::row::: :::column span="3"::: 3. If a passkey is stored locally and protected by Windows Hello, you're prompted to use Windows Hello to sign in. If you select the option **Use another device**, you can choose one of the following options: - :::column-end::: -:::row-end::: -:::row::: - :::column span="3"::: - **This Windows device**: use this option to use a passkey that is stored locally on your Windows device, and protected by Windows Hello - **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices - **Security key**: use this option if you want to sign in with a passkey stored on a FIDO2 security key :::column-end::: :::column span="1"::: - :::image type="content" source="images/use-passkey.png" alt-text="Screenshot of the passkey dialog prompting the user to pick where the passkey is stored." lightbox="images/use-passkey.png" border="false"::: + :::image type="content" source="../images/use-passkey.png" alt-text="Screenshot of the passkey dialog prompting the user to pick where the passkey is stored." lightbox="../images/use-passkey.png" border="false"::: :::column-end::: :::row-end::: \ No newline at end of file From a45295b1d2bc68d01225d65833ebd6db8d83d731 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 16:58:53 -0500 Subject: [PATCH 18/21] design update --- .../passkeys/includes/create-passkey.md | 11 +-- .../passkeys/includes/use-passkey.md | 6 +- .../identity-protection/passkeys/index.md | 68 ++++++++++++++++--- 3 files changed, 62 insertions(+), 23 deletions(-) diff --git a/windows/security/identity-protection/passkeys/includes/create-passkey.md b/windows/security/identity-protection/passkeys/includes/create-passkey.md index cc2fd7a085..f5ec391065 100644 --- a/windows/security/identity-protection/passkeys/includes/create-passkey.md +++ b/windows/security/identity-protection/passkeys/includes/create-passkey.md @@ -21,18 +21,9 @@ ms.topic: include :::row-end::: :::row::: :::column span="3"::: - 3. Choose where to save the passkey. By default, Windows offers to save the passkey locally if you're using Windows Hello or Windows Hello for Business. If you select the option **Use another device**, you can choose to save the passkey in one of the following locations: - - **This Windows device**: the passkey is saved locally on your Windows device, and protected by Windows Hello (biometrics and PIN) - - **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - - **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices - - **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) + 3. Select the option **Use another device** > **Next** :::column-end::: :::column span="1"::: :::image type="content" source="../images/save-passkey.png" alt-text="Screenshot showing a dialog box prompting the user to pick a location to store the passkey." lightbox="../images/save-passkey.png" border="false"::: :::column-end::: :::row-end::: -:::row::: - :::column span="4"::: - 4. Select **Next** - :::column-end::: -:::row-end::: diff --git a/windows/security/identity-protection/passkeys/includes/use-passkey.md b/windows/security/identity-protection/passkeys/includes/use-passkey.md index 787b267f0c..39aa37f431 100644 --- a/windows/security/identity-protection/passkeys/includes/use-passkey.md +++ b/windows/security/identity-protection/passkeys/includes/use-passkey.md @@ -22,11 +22,7 @@ ms.topic: include :::row-end::: :::row::: :::column span="3"::: - 3. If a passkey is stored locally and protected by Windows Hello, you're prompted to use Windows Hello to sign in. If you select the option **Use another device**, you can choose one of the following options: - - **This Windows device**: use this option to use a passkey that is stored locally on your Windows device, and protected by Windows Hello - - **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - - **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices - - **Security key**: use this option if you want to sign in with a passkey stored on a FIDO2 security key + 3. Select the option **Use another device** > **Next** :::column-end::: :::column span="1"::: :::image type="content" source="../images/use-passkey.png" alt-text="Screenshot of the passkey dialog prompting the user to pick where the passkey is stored." lightbox="../images/use-passkey.png" border="false"::: diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index 1b0736293b..db33e65363 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -40,12 +40,23 @@ Passkeys have several advantages over passwords, including their ease of use and ### Create a passkey +By default, Windows offers to save the passkey locally on the **Windows device**, in which case the passkey is protected by Windows Hello (biometrics and PIN). You can also chose to save the passkey in one of the following locations: + +- **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device +- **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices +- **Security key**: the passkey is saved to a FIDO2 security key, protected by the key's unlock mechanism (for example, biometrics or PIN) + Pick one of the following options to learn how to save a passkey, based on where you want to store it. #### [:::image type="icon" source="images/laptop.svg" border="false"::: **Windows device**](#tab/windows) [!INCLUDE [use-passkey](includes/create-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **This Windows device** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: @@ -71,6 +82,11 @@ Pick one of the following options to learn how to save a passkey, based on where [!INCLUDE [use-passkey](includes/create-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **iPhone, iPad or Android device** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: @@ -96,6 +112,11 @@ Pick one of the following options to learn how to save a passkey, based on where [!INCLUDE [use-passkey](includes/create-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **Linked device** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: @@ -121,6 +142,11 @@ Pick one of the following options to learn how to save a passkey, based on where [!INCLUDE [use-passkey](includes/create-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **Security key*** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: @@ -146,16 +172,27 @@ Pick one of the following options to learn how to save a passkey, based on where ### Use a passkey +When you open a website or app that supports passkeys, if a passkey is stored locally, you're automatically prompted to use Windows Hello to sign in. You can also chose to use a passkey from one of the following locations: + +- **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device +- **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices +- **Security key**: use this option if you want to sign in with a passkey stored on a FIDO2 security key + Pick one of the following options to learn how to use a passkey, based on where you saved it. #### [:::image type="icon" source="images/laptop.svg" border="false"::: **Windows device**](#tab/windows) [!INCLUDE [use-passkey](includes/use-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **This Windows device** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: - 4. Select a Windows Hello unlock option + 5. Select a Windows Hello unlock option :::column-end::: :::column span="1"::: @@ -165,7 +202,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="3"::: - 5. Select **OK** to continue signing in + 6. Select **OK** to continue signing in :::column-end::: :::column span="1"::: @@ -176,10 +213,15 @@ Pick one of the following options to learn how to use a passkey, based on where [!INCLUDE [use-passkey](includes/use-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **Phone or tablet** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: - 4. Scan the QR code with your phone or tablet where you saved the passkey. Once the connection to the device is established, follow the instructions to use the passkey + 5. Scan the QR code with your phone or tablet where you saved the passkey. Once the connection to the device is established, follow the instructions to use the passkey :::column-end::: :::column span="1"::: @@ -189,7 +231,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="4"::: - 5. You're signed in to the website or app + 6. You're signed in to the website or app :::column-end::: :::row-end::: @@ -198,10 +240,15 @@ Pick one of the following options to learn how to use a passkey, based on where [!INCLUDE [use-passkey](includes/use-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **Linked phone or tablet** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: - 4. Once the connection to the linked device is established, follow the instructions on the device to use the passkey + 5. Once the connection to the linked device is established, follow the instructions on the device to use the passkey :::column-end::: :::column span="1"::: @@ -211,7 +258,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="3"::: - 5. You're signed in to the website or app + 6. You're signed in to the website or app :::column-end::: :::column span="1"::: @@ -222,10 +269,15 @@ Pick one of the following options to learn how to use a passkey, based on where [!INCLUDE [use-passkey](includes/use-passkey.md)] +:::row::: + :::column span="4"::: + 4. Select **Security key** > **Next** + :::column-end::: +:::row-end::: :::row::: :::column span="3"::: - 4. Unlock the security key using the key's unlock mechanism + 5. Unlock the security key using the key's unlock mechanism :::column-end::: :::column span="1"::: @@ -235,7 +287,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="3"::: - 5. You're signed in to the website or app + 6. You're signed in to the website or app :::column-end::: :::column span="1"::: From debc80830bb1ea43b34b922ad476d000eac7cb2c Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 17:09:57 -0500 Subject: [PATCH 19/21] design update --- windows/security/identity-protection/passkeys/index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index db33e65363..a47ca0e1fd 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -114,7 +114,7 @@ Pick one of the following options to learn how to save a passkey, based on where :::row::: :::column span="4"::: - 4. Select **Linked device** > **Next** + 4. Select your linked device name (e.g. **Pixel**) > **Next** :::column-end::: :::row-end::: :::row::: @@ -144,7 +144,7 @@ Pick one of the following options to learn how to save a passkey, based on where :::row::: :::column span="4"::: - 4. Select **Security key*** > **Next** + 4. Select **Security key** > **Next** :::column-end::: :::row-end::: :::row::: @@ -215,7 +215,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="4"::: - 4. Select **Phone or tablet** > **Next** + 4. Select **iPhone, iPad or Android device** > **Next** :::column-end::: :::row-end::: :::row::: @@ -242,7 +242,7 @@ Pick one of the following options to learn how to use a passkey, based on where :::row::: :::column span="4"::: - 4. Select **Linked phone or tablet** > **Next** + 4. Select your linked device name (e.g. **Pixel**) > **Next** :::column-end::: :::row-end::: :::row::: From 466030edf95e7ad568c1f2c4bf0bea8521276567 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 7 Nov 2023 17:11:32 -0500 Subject: [PATCH 20/21] Date --- windows/security/identity-protection/passkeys/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index a47ca0e1fd..d77c476566 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -5,7 +5,7 @@ ms.collection: - highpri - tier1 ms.topic: overview -ms.date: 09/27/2023 +ms.date: 11/07/2023 appliesto: - ✅ Windows 11 - ✅ Windows 10 From c87650e4a11d48f603ec5cb3a8acbf0bcb356d59 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 7 Nov 2023 14:54:36 -0800 Subject: [PATCH 21/21] Fixes for Acrolinx: Correctness --- windows/security/identity-protection/passkeys/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/passkeys/index.md b/windows/security/identity-protection/passkeys/index.md index d77c476566..9ca4657426 100644 --- a/windows/security/identity-protection/passkeys/index.md +++ b/windows/security/identity-protection/passkeys/index.md @@ -40,7 +40,7 @@ Passkeys have several advantages over passwords, including their ease of use and ### Create a passkey -By default, Windows offers to save the passkey locally on the **Windows device**, in which case the passkey is protected by Windows Hello (biometrics and PIN). You can also chose to save the passkey in one of the following locations: +By default, Windows offers to save the passkey locally on the **Windows device**, in which case the passkey is protected by Windows Hello (biometrics and PIN). You can also choose to save the passkey in one of the following locations: - **iPhone, iPad or Android device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - **Linked device**: the passkey is saved on a phone or tablet, protected by the device's biometrics, if offered by the device. This option requires the linked device to be in proximity of the Windows device, and it's only supported for Android devices @@ -172,7 +172,7 @@ Pick one of the following options to learn how to save a passkey, based on where ### Use a passkey -When you open a website or app that supports passkeys, if a passkey is stored locally, you're automatically prompted to use Windows Hello to sign in. You can also chose to use a passkey from one of the following locations: +When you open a website or app that supports passkeys, if a passkey is stored locally, you're automatically prompted to use Windows Hello to sign in. You can also choose to use a passkey from one of the following locations: - **iPhone, iPad or Android device**: use this option if you want to sign in with a passkey stored on a phone or tablet. This option requires you to scan a QR code with your phone or tablet, which must be in proximity of the Windows device - **Linked device**: use this option if you want to sign in with a passkey stored on a device that is in proximity of the Windows device. This option is only supported for Android devices

k~Oq-}4aG^N=X zP9KZ*jw=+t*Z>yi6-2vX7~qbrA~+W^UE*+7*w2ot~oT zF;}gu8}v=Cq*lmp_eZ4wcK?)Px))RGv%hA@Moj`K#$HD5U?Wc3&g?3g*;Ct(cRT3N|3)q_Cn(meS1`09VZ`LfbdDXRZ{^_A=1 zn$6!4(Q>-+Y`o8S18M*W-NPKHU0aCtk+joIE~b_)@CG4@7e^UC3SNH&0?A*}XPMgH z|Ki}_0Ahb9vWeVvdPIlPqq#$+K*COuifn_&CjZ%2B+xgxhKfSL(Qb6BrA~WJx)I%3 zKUuOCb3E}?S5FvF>+vg~jxJr>BUQTvF@xi;HgC5U@ZEEh;M#@+=G86*6Ktf32hNt| zn;vHrV4V@u>=edJb3$5%f1MTXt%8}6yCd=N#6*7NZYgyJ3^F52BMBpa&Ko98m1X+& zj;&vuO}wz+AGYZ=9^Zgd4X3awTH=LyB;zO?&hGTX+N6?|{Vsd%GI9`D!=YHnV9bPf(78Ai+B zqUmm5)vke@n_wo|${JxQSpsyiFQXpr%Pk2@o14B=AleQ&HMm-%f`#P#lfw|u(%f8e zGv05Qj-7#-t!<*0X|RcG;?_KRlHQ!g@zcV}w!qaq{Jld@8pRqE>fRe1kUymQ zxLDi@Vy=EJEN~c{ba?F&&*t{%%;hGmW zh8ANtX!>#S<35o;DV6sApU%?GZQj}GqFO_ntO^txUaT|2E)NNjIJC|$tLKe2`W$0zcn_^ELU-8#73O<6?NI`9^PIWgbD|60u#__!>5>hlCRwhJv9Y z)0?pofQDv&H*&^9)>f}p5SN}V|G8Ip+&FhLzdzOm(qhuklCjYvVW}%~7w?iJb(aM4 zSnwK<_NQ!fo^5UY_TPQa%_TDZ?B7fO z-^p3rN9Kfsg{7Xwvypt98OlP{rIZ*zJ;4zL5^%ta@S-D3d5wb_#W52_{k0~r^r`Me z(%>Z_ijBQo)F~@ zMnS}f;(oDrIojJnZ{n@0s!Cb?TcK{K5u|%paP6Jum0`lc$vV-OK+XR?ya^bj_rK=K z-93Vg;Td6?ZH?B|s z*qrYoAhIqR$xm>!v5+VFhB>{F%f$4eJ5_V+us3Od85voHjg9Ip&)NKR&}5cYr=mox zR8dlNn+RM|E;BMqYhI11mAn*ETdW{-m4vEdTo$gXzM7sw7Gaz5r0u7mm~})%M00a9 zCC64RNEmMHvKHXx5tG?{-7*;fOA-|xDL_Od^b8Vh?^#$#zOXe!?J5HBmz!v)sRdP6 zSKs{Qpxh}3#7RrfzzxUZ#}A91pr*-f92CC?Iuh5?W476$}j{ zk+1f!Vfl@WSOFOvZl@Yu`)}uM<|m#|F;ys5?-06e0F2E7><0u4$f?dT1z*?f(-eV& znfX=S#TrBx&qPQHp0CJOn!0JmqK!C)5fn*_1%G7a6qsr6;x`}k%Puv#AA`>dz5)OM zR*pp_ZS6ePii!&BbgOixu=at5*c_B?g3$uEk!sXI(9z1|dSznboKu_ak}WIXd1E&Q zJ4n%aZLUB@_gw2Hpi1}DdexjB8YsIbSt}4c1dn%LX}7bw3)&L^)w@#3JZ75Yxn75r zR@E%A&Q@GSg5$8FI6f#WF(=qgFTRe+ga(R2PLH4X=N;*pq&!rhHixE;4o!ip*Bh(5 z3o?keRz%pwZF!2Fn(h7IU9P`&R#a59L+<%gv2X~7g+n7Aq(@QeasQN8>xKr}oP~vj z%#BhX10cCtbMq4NHk2D;kZkO8f-}kJk!B|y$Or)=MEkbo`9h(&$f|!F!FQ0$#u)Y@ zJ;6XJ^5VYy$+Srk+h}Ap#hI$CqVMblO_yZGo~iW@1ct5AQEK;@HA^En`O(H=_Xje$cDmJ00EH63n$G$Dr3eTzB0(XzF@L18>D&de+`Xst#z2K!CYrY34RV&d`wh z8ORpgD3qu+$IQtsqGExJ#DqmE`W+=@eL~O?4Nk#?BIKLVIqMTcSNq7;0KLV;92$X{_n>P=~;#LIq`CN#EDxM+8h; zDx{#a-lHAt{CArIvH|7Q73u6NL5TvCI%d(l(6$QqUrF<(ClM@A2ob*>Eu$u2IehLH z=)zaK-o8DZj!=9$g}wS-Uj;meuGH-?Vy`zmNcl0*J4LU zN0-J|7-=nz1iQVKQrXz?;Uw^7WWbrh9-slOK?? zC&uk?KcWVh0CQ#V6*juXBCw;NrA!7ft;X#1wr&dt3;tlHUQD_Ls0k^*u8EZ)V}7UK;G2$Y7Tzk zC>A^k-YcoY!xsZLHoN$hmW|{BFP`eT$H+48Upipp^SWV*`>mtJ`GbACXG3?!#ZWP} zEGGz^;O&5pHo-Bp*6UY-D<$_M{?;Wy^hOKKTKhedD}ko*@B6zUx> ziN_REMw_axw+Su`ZEU-fbOr+5bsQvk_2&1$ucx0O5?y`jHr6{SkvVc$*XSadSXlbT zdXcPTDB6Wl!VrMn8#L*2ssbPefbrK^X-au}GzGWDCG3oCbb^p)0)F9D{?xH{u(ff5 zAD253MSgViHfX%f_GpVoPG7AXnw=JtCjd#VO+4$7*JdMADXRnWq9L9?ejCShl|y+{ z8BErBre$gab+pvt^wjX2@8x7CapSUX49FZf{Yl%5zgpYbp>S9?3cFAXqr{Rv5JyjD z1vGdo)=Qm-pHsCh(e*b7$qeIV`+*cre!F5)j*_0 z8j#UhKE*ETt1-%MZ$QFEVe?Pf1GCU;scj1%@xkg4P(d=BArd`VT1JgBQn-75PA5tB zYidd`4ol-&)wC4$E^!BIs{8j1lzEgS3JiW~GhzZMZ)*+aj(62J2)~1dSJCHWO8~_OQlt?gh>*lr(|;*hG7qpTT9q2e5-B? zAjDI>OiM!B5#Pw|k^PV!8wn3Z%Gw%rVPgA^-*#Y}%`bby19v>K*1Dnmsm}66Qttw=CW*5rLw-$K~WzKVFJ_HqVB7Fh1}4=NX&A zwb)@N@dWEKT1pvge&Rt9x!CsB7GZ9C2IFu1k!sbA>1n0qja8MntU71Xhu${mn;If& zqJWU??Wf>=WQI_Q&lA&n*t1aCiT=&qFH&gKy`D$AV(OqxqSM<<->_|a>DN%pzoA6c ztc{afYUfvMRI(U)b=R{n2S&4q+3Qs?4U*xXnt+apRm3+xLczuIk0|A{(9)W7QQzIh zmd|){c9hAhYk=g4LG0C|yAB^BZmW+Td-~x&`x+E=*|R~EJ^jJ$M88H@y_;bWxiABw zrU_BD5$Di}`KR7jTtO+2F-^hBOj0T%do$KVYJj`C?mzu@-2~UU?%qm^m)95mnjMUd zsRgO9JOK-#K~N8icbtt$G_;&Dxbwxhoi#gy1I`>Lh0izziWLNX*o!c2mJW6OODS(m zZhXzYeolCkA?0E%Wao>Zj|^U)(x8GaoICwRUy6^*2(5*e>9tl&orLD@h?X`%at&{Jg)lIL{F! zpCtLErAqGRN#G`ih94GsS?sWIaN)dnop)m4*pSD ze_cq&o8NYV{%MdGIY?1N%sT~=N7&gJ2CuTgUsewQ6PcTL4Hcs!19r^4yMx1U!zyJe zP77}&@MM@ATAp^XVM|TjZ|BORcHaT(vbaU%<6!@vkdsaea*r~Ag98zJTUwe$oPiSmx`>Kw)EzR)iIli=j-+FHb}+B5 zfpTzCQWPxz1xU39Zt)l8h*+A_oQ8_#0ugVRj{`vxGb59fo)8n7-23Fdh|$(?Y{?+H z5O`${jC*H!TS{U*?X==PEcK=yFyS#Qkd%9VD!>MG0TxSBi^!-_*(;9v8Acw*;RkZ- z`R>rBwWl^wudJ~s*l-1I6$q#-EyXymzaT3?Gt~dZseVtFr+rj3rzf*&c5+t#TkDAa zd}?$8PvoFBzb<1evv*P!EGs*^N*0Wc=Zl!Qc-b{{?0@v&vS|M#JWiI9@wi998qj7B z-9nEh+R>AlswF0B&`?&EAib7>WW_I1)E20#`AnC>)5WpVSNljEkg=G1CFLXczQ*@!`|GbG0uVry#ilTZ%C@?{ z`uWwMaMY>sr^s_Wm*Ux#JPs|}@kyuuo)lC|f{yeA5NI1lLk-kISAk>eM2=pavLNP$ za-WpkrR-X_xwH;#uc)IU^fl-^SV*_@)IkG@#0DpDx_^-BtGifwp&*{ydCF)xslwB6 zRT(VfE6_`p4V3SiKHij)^RUf5b&5n6CTQw&`NSu68AKKq_7}S?KTi(cT9oGwSonj$ z9E!V%JE=#gKoIVD9`eljN(&G4r+PuqXt4wUea)PwqZ`kW5`LDr8{YKT&xtjevTf>7 z0{X1qe?E)47^%p~+l&FxZfiXTx+R0POZhtfA zxz>LpHcN7Yu`M&*GxdQ9aTR6c$jJ`PO@B_T_)5cTXskeW4A5ccX(ryX<|0_p*3l|~ zEiO3I@Z;HPUQq;&ZH`lpvjJr8-8ir|$7-9bj){Y{g_knAGXRg1QO0%z@3ODTRDMQ1 zOL0+0KeM#9tTJ(aXYb`?PijBu)+;ao)S&IxNhw2 z995Zxw>K9V^2!4(WqW=BY$3n*)fZr!`+MC^p1+r^ZIQP-Buue&S5!&}Xc<8BB5|Mb%1j$Zjzmsmp_emok!c1L5Adz`(#_m2@S-6nS}g0?z!IPjDU=pRVqQ-|%Lbk!zb8cP4^pQkOh_yFPz)$vx&gHaP5zgAzx#1#8K0{EVg=;0D)x zZ3Z0fD%d+X9^RnAIcRfV&nyrZd4*=t&1e44Pv`Y$-#T1nj7dW3ds&qrsuO(?`1E3-bSAP3uk=^2m7Xb4yVPX+e9gpkWI+m z5TM%h7>l~s*I>0`;(Af@S@27y>m5_>)xL3wtYNpibaKF$VPq(2qy`mCwq76(?eFXdL?tr1ODJ(^ zW$nYPe^_;Xk?|&}zpymA+zuJ`=IaeV9ex0co%*43lhcDWrvpB#(wfx?R9q>>#sX3| z(@FZK;|ly8+MS$3D`T_QUmRab|K7SK*Xuo?RLZq{xU+^!6=(SL@)B>bIr;Iy@2HRt zi3a^DUNAMcBADs>7gAbbg|*F$a%x4O+yqs=)sOV~B&`>n@Tm?5EIk}okhxb~d(-HS zA`QZKzaq3o=#HXcUrc{rNpfRHlzMjO+U8bCJ5L@3(E)5}nIp_hL%sKLc~A@}?(#&a z$haWiaL;Sc*R*xy_SLr5R&v`nPaYg3pS<E@MJOWWK{N1t>J1R+JPNq1F!1;!Uk}n=+CdMxKhf{+7J$=(9D&Asi+h(GcQ2lLbB_zbLm|xw$th|agE-ZX)nN(yHPm)T z<8;$MU6wXh+-#vcF|NxVLnA*=>&wZMqHk7Pt!3hyqnixSAE=^N=2y~npS^cW_&YTZ z)eOyCL_2fV%ge39>pM#ua|cehP1^|pjYIORbNkOyFE2SY?%0~)x5wd8FLjpWpLtSkfMcS5EJwYs96MpS9K49T^x?j!~u#?h$f^kV&V}cN)j8PFb=t8=6M1oMXeR zWJI{d`77#lIt;TZAff+pCVr+rYh#=-A;rs?1l_Yo;2L*XN9l+N2pJL<0v-BE1HEgk z2`Y863XxYPZpx;J(Y<^!GDV)upOZVv#|$wr9b#T}EVHz9@=CGkvQoF9gs*f-)2Q3g zv${xz8jD~^wDPl?0)1y|kyGC4n7C@0Wvrqf(K9MSYT^pJv8_}d!{>+pud}a;YO{-? zY)dIEv;=E$x8hnfNb%yu0)-&OU4jJn;_mL&LV)0eLUD&8#oaZyQ<(IhHEU+g!#qr$ zbI(2B{`T4D-sIkM_Rkx!MH65^Hx1XC33bKM5iUMpUtib4gcoJQ+a~Yv-y%xumcU-i z@6PkHv$;*Y2^$OV_}qfq_4EzByaIxYwl93%Em!Nqmtxl3(_uq*5!2*Z_yTDhMdW?g z(H+_4CEIJB=}X&*oxiEn6|7(XDRkUiL)SAN)LvZBLN=_|yJjva9N{|Z^-oV+(oATZ zIXSD={$QHoiyj0O`et%8u{r2b$dj`;l5aak1!hT~s>i>#BQtYz3v1bs8iUE?)U#|p zh&De6L~nKr78h?5TXE1b=S9~2Bg zthCXj))w*3k+GHjjx${G&$ZU^Pb$RWBDqlbvzrjghv>O7`tJ#Wjoy;@kQmRE5(eMTsm75E>BlwN0^^P+*@~bKX&2-7uM;L9G=RZK>=;hA z*I`~lnszd)^lT%F+`PO)`Etf~R*GG;Z~DGD(T)s_@chvY&GX05RC3XnbW?k`I<%Of z)m3ah4&>~enxmoZl%(OPQH+iW-DjMcn=Sak`@%TGVK3u*sRa>%jORtES7Ae4d&ki8 zf^{0yO)r81n)9q|GE=BYq_obZ%A4!(z(1}^5RoTMWK3hHqk>i%M+2Ir&xH)OubHlon(k9u4E;kyTD)9C^AssgW{q3H?@= zr1LGLS6e?}X%=%`Vj9(IlQyu0m4b$W2=8QQ09yEf#Ul?M;B6?vs1o=X5c7ubsq}$U z-^f=+z86{>m>tWDvnF0P8i~Qj0@?8$m^|tUtf7a39|Z2Q&und{op6s00yQS^F#MWsEa_f|>tx!5T~689H;6P}?`=*usWxDFSe0Zn6mQ9wE zZVd6%ot&>Njo^~r9=>?nOftY^O@z}tg!Q*q8*h_^(n+T4vZayots1^+3*U)@@LjEK z1Rw2b9p8LJL>LpU`_HxPF9f@DIEiY5EsbX24g1ea%lSXc!|UM!90z^3d}n`yi88L^ zvvB?6ObLwFd=|BJb6abJk{>L!x;j%^%uRdiHF161ONr<28X9fCj%3aE5V%Cu2x;}$ zKb(o-XiQSeX$1+6t4G;mETh47jXb^mCvnV?mJ1!*p9S9tR_|C4uad+|=tqk9Uhh1+ zB7fH3r%26Imda~nD4{U-UgZ;`XkWzqGz=m=5uF_7e%T$BN@^sj{Rsf32b`QoF?8tU zsECP#fV(6qWMt!XIr^&E0B(aMv!V9^`)6K2B?dy$i#2?lpY$8Y< zY+_!smwb2v)$h5m;Hl`Lt~Ni(;UYqMf1S#Wm0#9kH0FHZc1-j4m?A3aaj6IkNo_CZ?55Y%_*(eM2_$MzV8aWp3CT!PUF(8U)$rXuwJ93 zq7j6ARV!Vu)jg%_9`magTa()b-jX|80D;m?M%x{|Th!sFVRnWo9S{@cT`7SYEwG8c z1AM)K2IQHWnVmP2#ZgeM#Rnku+Jyv?ORL_WlE@J6zo+7)A@`kt+;5~DIULTh!N9FU zMG#8d*kwhXLN-cf7eYll<=6aTP0=A1iPT{?g}0=~(_;6GnLo1}&tuHLHUnfKZuE~% za(&ImoHDwQMz<5@2AF}w#88x>7(Xn#P1ebX>$5T-doL4jwY?52rSW?84q80@IfLwb zVo7TqWj~;^@udH)ggWFH-{ax$=+c^h9iW>&DQJ$QAkPu4t&sb)WASEV&K9Zrf}8oJ zFDO+U-Y`~w#>n>JU4=EM$@KwWkrvZ}DRiZ{Z{D-*;my?NKL=PfExf8-2;Vyc z0Y>Mjv+8wq$A{uHN|odW!5J_e+wU-iqqboeTM>$d>*ocrG%`X8T))TG=DbPOPPw^S zy%U7LkJgRdiE!2dYh568 zvar!{cOpak`gsB|ZrB!KVqh!yiC`IS%NgY()=`#lOtK{KFsk3;?^Zxjj^;cx?Og#)!rDOP< zy}@pgkynTU1VJ4&hzk6HFUnAe8N2%3A(IQG*QpEl;@ zJHD&zcsR*2_6TscqTIHIPd@~yMDFEX-sIGoJTxTrno`@)+T6b$hGxuy^*n>r$ZAj7 zuY|*=<98Z*5FQ?JR7|TVKP=4pbbuHq-0tXL9F!K+l*a$DbxHsoYHUU_a69$hwZYzD z6~;vDf*;vXX#ADD7v3m1o6RuP8Id_)wV)WubeL7}dl^$?o7MDTjQH{(6J$0e&7|Pfl%g_k9yWy(fM6|Wm#0V644-H zkPZWyOZ{?gNEn3U%?NrtnO?x-zZY)1P3;?hDxgO@Fq`OC`z~&cx|+f5y2P#0X}bp< zwu~dQ-b!4dj$sp-XlzO;4R+^tg}ov$lg7(d6}Kwn5K0F)VE3EJc2#|NOnpgc%?oQC zM=!WFp z5_MlI`}uLwnCh)*|4gHKdpn)o)<}@Yyb+SHcRVg`c4jHBMBv$*pPZ{7*w$H2A0n2$ zBviFxN)ZIe{TECwR=!v72-&Uiz`!mE5FfwK9Yx#SpO6Lj+;&-e@CI^mKGma;MW$lM zh-$UJyRi2<&v%=`{_mP`ZC$0KK9Ed%VPeJqb8aKkcVYwZ+Y7j&q!#ZjNyE*Ja87+_4}{X6PQJPML#M0R;a`I&%OU1WRzRLtBK&Fc>p#JGo3AYdW1$Srgd z^b*cX%gsfO<*jfM8yD_h#$Q)=GqW(g@^ks;pbNQ(^Kd|rtVm>V-kYXP)9WupPB-hz zC;i^u6u>G}+mR5<_Us*zKabo;*)>KEkesM$tJk%|yNMjc??{@QCSjtLWNQIl=v0l9HYP#GSDG{g&C(!rv9X_AvTHb9Bf>1OLlU%+ze-#Iy~HxQ}#CN3eJF znul~L_0~r&&h*+UqLN!1m(fq?ZX5AIR3ZpdiHhJ95NBV)nyTIM6*Z_9La56@mNoR= z9X_%&f*qkE-~AIuNnM&Oy}7l+leD{g=!p`oa3(8j<4GLF$!@pvYgB_zU8-L*iKWjR zE5oMhm@qbwN=B&b6iXjrUiX)_Ry|Xjzx3<*HSNFX*BV)Qoe8X)G;~ZoJY{2Yy}zsg zRM&H_EdoaJ%n!p`qhGy4-NSMoDm_AWtolFY+SL(A)9;yVNR;Kf;tUHdfc*?^*>GTg zoN(tBV(h{%fOdc>dJP`0yqs8qls{U{k&K*+S#~KZ1kUqcymFsZEP_63wZmhGY=SZ@ zXV7;IW&YZ5){DB3W8S4&(uw`y8z#|BbV*MecJg+6yhm^ADy4?(6TaA{Ta2 zwF}SlD1GA6q;5SEGC@+Y5pNn`mMd8rD&{WCJ#)7moPraA3sDhq&@ZjVp}zT0=0%Iu zhmw@g0oz=}kCffux7e4UPp90yf~Y@VH!W#wf~e~wa|?X^dX>_4h;O;!KELJ+iJKd2 zKe-b`S13GdV)}TE)uHtItVeYeM>ytvv9$X(x(-BPIw!n^YGm0ZznP90U($Y+J|wrY zBEmn6KSuf{6|2(+Jg9~KsHIXJECxW zGzSN)-qFFRje*ZHU${9ZKS+Vf5Oyt*wM}00;!xF!gCUTS1(~?15%B7RNb1Z|0e`Q* z!Q(n*-}j_t(`bxG`w87Rzc?i_teQoE2u37;gP0k>tWM5ku>`?$ne$8Q0VDUmB&f0i zZ^i|XU_|?$LAS6$YZJp`uChF&KuEv4Hh>9l{?ZON2*cCJ;W3+v(|oVlgUD-~O|B%K z&HzKyTQ*|K)M!J7rSWVR3}=?-nr>+?LgcpwJH@6(XZDqVpc;QcdiLG-i5eF#pd78ESUt!N3QX*4#?}$II z#(ILMwPyr77YtvKSeQ3JHjJU2qW3SMdmHT5c&Sy-P#U72P>R=gLweE}T@M~;b*exY>x%C^T?DxN$~ zY3olDgkdlQ&t}J2QmdLl>o^Cxq-5Lb{4<04wm2e*@LH- zn7i4?4gQ$1SX^l-OWF&aJiWGp;4;v2NuJZYJ`#+O{jS-4V{%Of)>tUsCEsR8umZGj zntSd`=+p&^-p?Pw=8A&*!n!txHWNvt?2*OnmX;?wnTW0r_Vs_c7wVxxu!!#fM6eyV~hEhs3awA7yN1AW5QfJFH@Z{u-0N23L~ zf>9(32xcHX-xZb{D>oh?G&4V+E83m14?23u(c^#1Sktj`R0C9t>dqQmXswX7a}-sc zbL)!wL7$zw9vV6P)yq9Fs}6mQjJGkrh!*&RB>lTnU%ZfsxvCCGB`7c&r3gxf&cOOx z{wB8Uakig4sc94)gW}MzTi1<5zF2&#g2WhuFQV?mmWlO|JY!%PZ5!Ml2+wk5k)C-y z97GS>Yx06pc4*K@#SeMnTZSnfVO5rwtN2LF@$$oLv;30GnGHOvn7xr9Mt^uXncA6< z4xtP$5U5Usc$!%^y2>sGX{OK6y<#O=5HLC0$=Lfw)t;BG?eq7ljlk3)!mrQ^&aK8| zM`mOWQPwOWQqZ`oPT(!& zb%O59S6IMwKE>@u!#$aDC($rJS6rxt&8dX4Dm~9cTT=Wt<+I*h+Z(%f;H+!2GDQYo zuQtSfdNFS~I0`X3_)9!u1G&IX%HuYeO`bvjxAO*W*pJzyH*eO9eup^f%hrrA?a6F9 z^_hG8w6)A*d$-comxcyEJi^#WaUmV1R017t6ga%54P)%)K^Vq1&)?^No%+gYXdBQY zdB#&*oe^Qk?4UA=hG2b)j}h?dCAgidm?~Au{}XxYWptYJ)$phYTT*ulw* zdnj=hV5m)?ByT!%RKJ(q_7_Qvr|XlpX+6Na=dddfUfwIJJfzW#HQk$N0s&{1R8A{1 zKts7x4agL+e_c|jW83r&!F>{{mtgFP^f|1&UlkKXQu4QA_GD#x1VA|zDx7tha3 zGh6J@cb$bqy5^8!3=x^Wtq-sm;;2RjhA2Y`iORAJTSnot;Ylo0ah=X$QaB z1R0A{jI}8C0=+qR(NMJ{0{-L7WBh_4x-wvw!Xk7=r+US{pp z4A-e=JLVyW^|puSj_PK$#3PmiOUsXP%12=K9}vaZBT8)MRBQtXJE+wlgK?4J4#~4E zPJDn5QFN%uDYGPWAE)-5dZZI9QC#6UjMzV4qu@Fut_2@AJ-4;mvlz6iU-i0HRJzM$ zodNLk4TQhqY3FsGbl=!6+Uz~4x4ZOtJt77)6`i42XxJhNylPq^wYai_D0y<^D{nz- zlWcYGJPk*9t|=HY&(AMsImksX2IX%yVi;;3oB}7EF9#?5TiZ_oDnuQv?*V&-SDFj1 zzeH9Odwnil<3n#04@bY$uVl6#G3~+bo?p@Kh0zmT6JBBY5ZcTt2|vH0K%zl_^%+86 zE&Y}hE-B!LHY35W_-4$aJuLi!V#&Ms&jb2ylR!xo#1|GFY$u_Lg zX$R6d&$+~p#z9%Eyik>^G%=@>Gc-@TNhWPLPS-n#%8ZcV<4QJNg2KQc`+YV*&%CyM z?f5SBV%neBf9sp;m7@Vd3^5F(nP-=MB2gg1- z5-dRsU$vUn!XsUQK2y`3E-?x_&=v~E$iME#b)BW#p@&cApS?S5JJ0BrF-Zb4e7G~PY03>gqv``HfJ_eApPM&E6n zwOT(^?NnVwB4V=LHtPLW*9~lh(>&fI9C6D*9&zG4Wkjoa)yJSs1r7x~<7uUvfW+A? zn0iDAIOhuUIctW0`W;iti}R$;CBjN5X(3f2IdxEMVhEfz2q*qj)inr5LXBb|8b?BI zKynsW;^imz_rek{shI$#vM;IWHuDZ%QU?_R|Gx$?u_6%v2I64x{GTR2>CD#E*UwL9 zWufNQcbS_<<0wo#P_0g$LX2CnDx>E6^~%__KdOCV8mz7AdR6n!j0xTjvYCU;_7D!-j%OWgeZRb|FYi&C z$>ug^dqW)qhjaH24b}Sl3RSu6Yca91)|$GB0scY5;Gd0TFZ*tvBxcW&3=g+rVyaa1 zP#x)>k0_c;B;BMWB8rs^!TzMBm5e$fFNZq+tA=*7vAsPQO)gwmS;=wk{txDO2MyOj zA3??jQe(UbnRtpsi2GC%_3Xvf)!`2P@BXA?SH`cl%{=E&ww_%Ck#o^L8rNBuo(7?q2soL@+-9@!H-33EN zlMaaXL!AsxwsEfnjS0xyf^#!su{>`7?R3$Lc)sh)C|NqZgysRP_ymX|^M2%{$ldjS z$cBH)JfImj*>H4PCUM^f*bfL-KBjmznZ=MTH7NOv2(e7Z*vCDlT~u$ROe?6{d?nVW zF(I_JiQf;Nj3=sV!wk{j6!t(_$3Glz)A zixv5@=lGm9d9@l=AB=GD|dx; z{sqn_eLQ-^w;o+5<~znucL(N8f0h{B5b5+sy-D2rQOkpE_h)VLbKksnTYN$JE*x#7 zJa`EDIzqU~(h$9x>kmzm0$j_V^GtR0?(w2$wl`P4cYqrzTmPZdICe&rje&cy;{LVK z@y#DcJe%@==ye(_vhTO}EBk#Px9vCU_{9=~4NT;i{)KM8LOu%NM*6qih|NHLLOI7m zum@5v&R#5=qee_Ip=jBpFTc%;mGpGv(|$#@64eQp(X2FSVQam%=*?fn{-HMZtScdU zH4jD6I}4cC;{^5%gKd4w%@Xite}Hv&r!@9$&ST}!?Fy|<4n#)^IXEZHv+=W*a-%Oy zLeO!=Jgv=v_+Qk2GDG2!5m&lk6)Hbfeu&^Dnf_{3^17Y<@Twgw}w#A+8S4IU2( zE$!G7HWfgF4}NYb_h!Ltd|vz|YvC2nSY9nul>#_L~hzV^>C^&ey!&$nuN8t=CiQ1!6(tjbzH)5ghV zX=rLH)QU2IIKD2^lrg>~mRim`0W~>rc z?LvGeK-{o2D&fy#{!)GHPfRfftWxBpj4xdRadoS-IQu4@$+MB9F8Y#s(8pOwuQ}W# zB_)MXHkzy&&ce=~93PK|fM%hdspVAsT~f7{PMjvql`d&v9aHjoZYE2OLg7H7u4xEW z%oE@35pvSLgtVzCttO8P=6{q?M>qLAJ;?x>%1Ly=7*&wbKMiymS#(gdOLr=`hw?FS zBO)VT_xJb5{k^+l{D3pDHJo9(J(6YY!N*_{A_OyNTcU^w`6TJ;d4)_mIIt0f9_QL( zhIm`SIz5eo_~Pcj?;j5W}qURPP5T|r(qd)n(gnz6J2F>eU$Rb>LHQHdT_wRt3Gs; zSVxSRGnVWx1Hykt+P%c#~2zOu7eA^9;6Zw5cKU%lvErX|8<@M$%)8n ztP@(s=ix_sfd@ih4#bG!(?;d|<1F9u>k;AL13ptZKCjKlkfUpw3FeYuFlM#AFrG8gZ0b)&qiZwyyW|DR(Z_T*x?g!gUdkiAm&B)0TwA_6)_a>dpyu zy;)5S4Mjy)13Lk#Htdm}=kA+suiY>nv-Hl>!+yCva0Q;VNMWaQ(~-71^>n&<(e$$@ zuzOvtDzx9nVS45CYZRCg16t3N2$o$Ku$C`m{k--0TAhNA|Jb&OJ2NBxct%tlER~%b(fuv$rGWWF0Z8tb(th`pI0 z43Eb#kG!=DPmEpq_Nq3XfK#E0L=;ad)?I`IO?hXHJ_=IA;w6($Jx0YY9?sipLHmyT zuEpnmI`6v0XC<+*Xx+cp^;z0mj6p5dOtC2+G*8b|W{6X@?Qll+I>4!`{Y*$j#qw%T z*g@3_HmQq|V6pAjSU{jR(Rt?z<%_3WM4>)vKGkuxr&4JHR-xh?)xeh;A>#MidIob(kblv_e*B6x498~B&c}WkXWxJ?R>f>BpxZ- z;znO$?3_MUwzCog)mgMa(Fvai^%~0$jytjn1KLGqKAVR0R;@U)$`Qv2(FAwd5NS^h zBRNF~CZxct)b!HQoSiS;LW)ArgGw7&#L)4aKN|mAUW@W7Be=+@U}$eM&76+?qQ{!@ zCy)xzu9QFR!gIm9q71A+L39c%4&h%7oUi+_-${uv-U?F-7Y50_sbhiE9$=5MP9POQ z(4Fz1H(*FRH7SOi_VuT*SR$}|x(T<-o6#N3%$&}=GzE*_N z>uV8KVomVt^Gmo2ed^}7D*>mSz=elm$B>EyIOu=amCk>5Olebv%I7(i7KQ`fVla#I zh5~rs{lkWqtnx!P!fApPJ1mAp@cL=?%Lruz$7+g$76zbQc9nf-tY`mNx>3t@hNzMS zzebO9o<4JNb=D-6cpaajnU@*}+>@>WYG9^ihXcx3nBVZ8MPQJGqxK!As}Zx}-QToh zQUN%Ro$-N;D-qEAK=Te`m*Y5LEPQZkLDaO)EOj@eM!126Cv(v#ov}PTjnmGpm<3pv zeRFf;>VS*&47_V3-4d>{84_ObR3iYTr^Os3qqy@=*IIhKx_pz!%=9_{$Ird|^EeNi zgH(=d2@YGkUMspa`A7e0SD6bIoP%b8TnkLygm~}+0~bG$vUANxxxA zewg3yHT+6};*yQrbf{z@^832tgshs}qFi=C_FmSFUeAw0Jc-QfseL0cSlb!-S~2oZ zRPvvu{rztyA(U005!~Lh?%)Hqxp8LIU z{7CyBOFB-ztT&R*;~wE&X*$RS{YKl7$6oRiTfs$nZ*Z(BD#RpB7$?T@BXD$~d}IJy z49J0)NJ~RulCf%;!tesOPIn@Sg5n~74Xu>!c_^m!<#xdTVOxl76n7o>NYf6s5*`r| zLRT_N23#B5Ss~9#d`2n4@xxQb^?KO?bui1hEJVY0l_jP;q;iyq8hJDpLB|c{ueJ37*Wge0yzCR1!Kb87NIFnZisw=p|TPuV)JI)f}D$c9b&D682=zJ?m2LC90 zI4)(t#84p)P2X&9P2b&xQea}ASoUmVs?zV|M~S1htsVuA;B}F&ZQ)9rFT{S~9|y~i z{4)oAkss*hMNCdqafg@hd4GLUb)W%FUwmrtEd+o!Xt{Fq>kI1 zdn#J%h}vG$5w@nj={Nzew|YF$_oLKsuw&SkSFRC+_D;K$<)hhMZSuf7u|QBeHwFhD z;Ol2!IdKRl?38A-iZEjBn%5xz+nnBKJd~tScyW;its{E8FP^kK5i4DJa-SD3d6Z`c znX`TM7$kkwf>a1a_9rlo4k#md)=iOX;!UXT6udV6byT{kJ)0p6?q6M$zA@6F29si7xb@er|{d zUVr6#+3OZ{2gA~^6R#0?l5VRA8X5jux`+tS@E6w7@_4VR?S;vli>HCx+$ix+ z3I4w7b&q-s_h@&K)^-r>50>7(9Y`5tl7yqdj`eoS1Z5NSwY~l&8I^ysq^~rIwf73- zV4Or2iux9<35Evr1P;tOPlTSTYXle(|3lQa<3#KL1B41sKY4b2zU^@KgW3|6oG;mN zV3aIVp7n1jNRd2mQ_KmoFs=V9S>u zL>F~gNrduIvi+AAWD5yp2?T_y81#p4C@=4C9p!Xf5D+lC{ym6&4uz%&2!&|!QW9T0 z4UZmCU6-{p3*PQzih@Q@_V*!>6Dw}vMQ*$Nmf`}7Vwd9PYGxJ|mKrWv?g^=on9uzn z2d42*&1{@9OKBLBH>?f50veNrwRx->2INX{GUCZlhaibVvQ}O>IyoV3EMq-KL_|>9 z+1t~2nV4)6S5#CC8S3eQ+nSr1L1t!VMjRX*Lx#G#@okNbjG%Adz8Q^;jj?E!YFBMg zrocD<*uyGKe$oru&JSgfGaP@g{;AUIM;4c7^OBI*P9yn~(ebT3nxtasQ-zZeMwf+OYg}5xw^DW4*_2enCOj+0;~maZfk_ z%Tu5y$E#~DV^r^ZLc*St7?Tzc$k0tH^u=&H&CLSIC2v}RV%7Oa7$y9APEav3sQIL{? z7-$l{HV7AkH2%uR-jAzn)laf|T^_xw7M=|)Bb#42C3@=yz6-FK~7fdH-?LmV0(1<#EWOUqA%wN$<39Lf?83vb0&~7|%ne zx)VI6Z<>R`0_ND-g}iov-@){s**mB4a{0#aGU7)C>+bdWLTPKAzXu)oPPAtW3kmHV z9p$#P=)Hz)wYRqeDi;wUQ?5;vTkf*X!pe!_3-9=?dJQ{*30-l>aAcjN$;ah&w%%*0 zYs^ZzeInJkD%&DR*uaZZ@HyT}MtfPAFVE6#pD|h@n4GkePd0R z=M=uxE6ug2C1;nx&~7bN`Aw$7F|gL06KZD|^3`^lNdDag&AA?Rp1q_}%*4cmq>T;B z@$oU&o_m)H(z1$FgG-i5_)aF_z%h@8*eikmE>k%b#oWWXZ&y1G>joBDPP=pifpM8vc6%=qE$SlDYJ@C8B{}T7hLio zzquTKciDy}Z)rfy#YBw9FMjfdilU8}m8Ok&f&}1%j=2V&oaKC1L0e}Q783HBgp}0E z-abiUc4me_*3H1cKsAlS<6{HfNE?Q;_yT#GJohycI}a4Bjo3JI&ef@0+W0(B;Asez ztS@`lZr$+V@c}3aON~#NmnxNe-hP$+KiWgnQjJ{^`aWaDR!bHkZv$D(9~?-t}rhz z@6^nUx{(pbkMg1-`RD_>zsH0l$H7Y{D~T`0A5sL9q8Ipym zT^t&HzSZ)V*!I7JCp^zX=@0*^8Rumt40f&m+tCm1x=8wq*lB&W<8F+!d1jiKlt#kR z#uCI9;*ZD|M>^*qYN3hb8f&3BP|NA90k^RbH4|HkOaALQkk{EQpy5Nr0ZoZ-qzzP1 zN?IBvF){IrmX`RdW=N?0E(HXCM4nvD{gX;FprOTM8*|IFL*5ab2FN1@ArflNDa$D# zZ3D1?r;|{+%S$Jk=M!k$?e24u>Dm6(A5izR!!vgg^agb!*J3w;QRTnIs2&ryR38fY zV1AMZzVXi)h9YHk$(L7)}Q*85K31siJ0*p$c;o-KU}1ZAM%lL2{IT%JBOYVxvyV zM-jFJ`ZZSJw&CdS8vO9!gNBaI#Ln*b+Esnh%)kJG(X_0b)RNAU7Y$H{4KBksa~V%$ zTXOirJjak!8oeWLc2J!C;h^y6p68#9&*xck_s>s?3QzveX-m&Hu+XO(f7R>f(^VY! zuD^=XEwlDxMdxPeyUq%iu2gE=OhW<<~pn4vBtZn60oCD0`)^=mg0hb%hj~x>GqG`A5uD4i=t|bA>aP| zWKut{kT1>htF~8Y!^e+`OG=WFk?F<^;Y6m}|2ict7j<=9CMKrbf&y@A>MgRfI-QoL z=Cu+X;Hol#s$ud=lMz0g0HNT2{hU}|UmrLnh4IrrU_%uw+8j^;=Hd6q$6y^1_Q;PU zh%YRQFyT0ecl0R2*Z+5j*{!`jOJfrgc{w>MLBU(%etGy-u3?gTAGo-fx#^$o+&u*5 z$$O4@fMSRl_-*n5_YYeH@#)E-jHK@=sEd6wV;7kr2bfB4{N)Ss81-_8@h=yd~nX}v49 z6yv_?50-3B=g&gXH-L#0S1E@Nr4Ni&P&E|lx*Mv!n@34B-O`NB1j_iyi+%#8M=Eul zCTuut4U~&VS%^*2L>@8)Ow}AD$=%@ zeuFB#xlS19;F#ga`tiwMlM;t6(7UpLDf5Syu`}0!br+zcpDu-|CubkV~^yuv>;vKiLD9T z{d(t$M)Bi;HLK*~jn}AAbKq|ep;s5A&h6?wB8=zYHRiz2cVzFggzukB^)_78JF0$v zK#loj+>Ejfdab!-0$^JOkr`eQ$(ap>`74>;A}elm(sz!7PailncXr=KDt3y0CW}bX z4Y?*m_wqdxtf`l1wZIQV~jQTKAMZxdb~MHv8laa1Olo0d{K98xKGH?ZgHGDkSN zDdho?PTU3awPxin(df7=9BmejMVox?w_XCy4cMrmq2bNl-3AP%>gf34B_D7G=3U+d zOsz{b6DEVf7oFyVkb6gAa%ID}j-olF-Q5Lhx@w=k7&Gh((ogZ#tLtk@TbZ%(zGIW> zE12MKzRMewa||&pK-F)$P1y-!@(xMfd%s4Ux&H|^sVKsp31%4xtm17_2QznTHPIw8 z7wk-Uiuu7sYnLat2ET-pbOw z)vxl=QSOdinw+Dhn9yqHr(UDCPIAzDwVhtvT3E_wkq?TnH7*kxXx09^JLxGF>92U5 z&d5z|qHkL{P{Op?4T!$b-#FccQk$6oU9UzyaJ93u^UV;&*HaI2vT2OcJpSsh@i+gp zk{nnyUG|87k;|j5ZR>+EA(~!St@ZmmB-7Gp(tBwMWA*% zyp&IN%U%^YnRu8YYA=H?{dzS3e>%*LB^FqEGcw=R^~%A);o;#Slk^|rPkc61=gzyl zMl4D_&kF!k;KX`=7Q=E}rah!9FrO?tU=S+6-R+Re@M&$dF%4=D7JM3y3kuu*l)bSS zhUw1AFmPGFvlWIKRA8Yd{6QuK!apv}tDP~+Q0<+zVd>AV50u^g#>&Q>&E-Rk5M&{Z zk8KKn0}c8ztRzxMhP#+X-Ut7UDXU`8d*VdZ_jG75r5>BurJq=Kd* z@{-Ygo#!$ExvuCytnO^oqMd(0dPk%0MwiCu6;;2(z#I?CHn@ zaN19lOU)4p%*xvRyRRo@=7F~dQy4fUIg6eV=)E4F`4S0~A_p3$-zS>&O?dJ1tqdN+ zRnI#B!Hrw^86$4pt21ECGY@xep0x#Da>!Rt3H|AjnF>gs;GU)Tj);q>?{c8=XfYR_2Lq zr#Lq0>wT}V`pzo$03TIeVa&*SAySsZYIb6@>F$j zltqtcVp1#tHfp*A4@ zDMwZw!#L_oWTHg=aQcR2J#L0NIwcqH#5T}PDZ*#W1zLTiEwtMU5N^C(gbS8f1%@@D zG>lSi58F{1|H!!QQ59eBY%(FMx$cr4!idRLkBrWcTCIp%a1}4N3X@YkO2!{QPKKHm zS>3!{!%Ts*R2cWH0$Q4z#lkiyV9kU8UZ4U*IoDjls`Q`BnAk*GMO$m`CU8@b5Ok|g z;>i?Hn%&RgX?q4K_+8_nJ#UBu@1Tzr_|JX*iYGD89^Ry1B2S7V={o3z^|Ec^!&2C4 z!ElIIHClfBDv4I$=YpR+ljOl-g*;m&V zdgZp6W+<>}%yPJqb*SuygMtyxmFKeC$`&YQd<*&9G(R=8#Ped_WAScC29HS(i zm(h88H^kyul)GgcPh~mj<+|m+-lZ~Bbcuc=rjMZQms;q=sc%C!fa81Y08(dQ`W^$6L z7@NmnwB(fC=%QgSv)sVCn8Z;WLi+bc^5^%evdw7?+?eZkS`W*mw>SN-oJkk=Q`5RN zlu7$iXiCcq*R`r;JPaB6d2Oxm7K!}-G!-DIRBg;!SXk@=)Rz2464V_A+u-Z&;#h#T zZ(j=l+oL&1_XsCDn#YxFZyk%P-Wj_n%0a!NmYz>5-ZnWS&Wg8w>h-_L>c1&@CT}2} z^?cBJ4z7K^giZjL2lmSIDT=s;Fi+S1bYZ+kN!j5`I-O~tqbeb>DEmpr8;M6-ekm^O z4Niw=FrDaH+@U0-9#u3Hc|u!^BFgnKC*brB$?I~RyO&DxE2^0QJL?`PSV(y+}g-Fr9G5NWd`Iob$m2dP9~?fE}* zSt!M0`{eR4VB-z(=nAtm`EB7ROI=zfPszx-BgnEZ{1vK;1n=+;8{eh)>Ht$Jrv!63 z>7(x9c2>Bngj#%WFRFKrint&4BiVI&AeXfb=i~QUj5vg^BhY~YX$R-~MK()Qm%l8G zrKF@z67b#Qf%*Zd@;t{)VLqn=UdGNgp%-<#U0sBYCVSHA#%Oo^_D)CPZ|8kkl%Tm` z>ea|=&88e;0>!dmf%j2NhOHiZ>~z>{+^)DR;B8^t6USl6-_(vW0 zI^RY6I;VDY;wTs|3qI_lL}yOXR~v@}pP83uHOg5&zV7ks)#s7VH9CS$aXUkukF=4N z`YnaA%G1Ep^iN_oG)SWnyY2RjY>&r#8KOf?hX>ldTex2js79f>N9>uKKgPz+g9R}C zQcZ?KegFAqmVlRt4?SFV-7i6UuU#MLXo~qG~#(oo!x1$e4 z;w&dYSTHnPv02FBm?*#ASJIDe-3%vV>#5325Mo-SQ|7O~MNd;QUPVu$`_qzC-^A7& zGLz}lEIYGhr$DY4(&K+cW4(`eC?CU!5m`p-QMUr@P1aqgzgeoPZJ!F0IC$Xt!1Kv> zD7H{rnpk>1q+3j$oITghH*t45cV`7r&A!NI!Y^96Vsc7Qe)exX*|xmdUb;5HBH^v# zJ^K!CxG#(X59e2_sFTtb+UG&pgTN+vSs3f`Cl;mf!kRLZgu83`X4IW-PU1Y1uiGr5 z2bC8o-J`1#Vo%0Tqg4ss)0j$fiLiYA_eEAN+GM{%qB)x^%3WFO2RW61uxuX()lr}j zYVIb(3_1R7|M+~S9n8T>Sg%hpE$O<&NJ;V5{&D$dxBGjkCcYGXip@V&HUhnMp__s% zS)?2-m1-}n!r5U>P7W(IOpv9bgdU?*e(i;<6Vfa-=KUP#{7e(_w{aob8#%!4@czD18@bz}iHFvB@ zdbg4#5SBfvV-5}1{y<6g_#cQlz#+}x!P50A=TA?vw=9QsPb;&9!=1)tWN5f4l>Bq) z4V9NgN8n@9u?2DS>fifq5H_2Eexy>wo{lGU+hKurQeAOOf_+tUKG*rA;X(P{>h{{` ziQ#B%jfx+5(uM^P#R5cGSGNH2E(-%L-2<1$I*%BwrITOc z5fpub$j}YvJWvKqqajz;|x-&wC{i=8C-vXh>d1BKOU@v-`|X{lsauC_Mu7mi|) z0uR~{wvRGD0e_rmm5)(n6JuKS8(OXP7-UFvd9l+3>XpNN2tvcM)NRJ+>-3;TVRD@7 z(PZy7jcE^{=5#A>P`n&BXIo$g#|?l+uEd$$$s}#<429%h1Iit&bIPkAft*fmHTRj>j6bK`!~xLDfsP5>fQX?( zD{IPl#3TdGF5b!4wYGYHt8BKT&Coqcb^pF!oi0mr3M2A6|9hUn7^C4sJHO0*$p$le zYSRpJE0#&-3@Zo6JcFy5G#}W!(Wz{zw*y<@@)rzjZn1OBtACJBN2|btO{?ephXwwN zKakg6p)?Y!Rn1-vn@~*3^_?DQ9YitcASJ^$KhqdbW?^)<)Er3%TrhqaXQ9c`jBD4) z5E%i2Sa<5eUWh(-pvoleg!SDnUK`fhos5>Hmh!~3Vc+@r8%6XVtQ;6&FcThrMZ2jh zqyThP_#=IQ-ZJv)*4w9nitwAOX@-*ptTj?``L7#vGUc@TTnD@HPD5blBLwz3Uv-Kz zLz15^uqPhnvZ0HH>$eNiQ<@@`0Zs`>0zDODXlw1MSx8cdOC{c@jxAZiV2bM`!|%*d zFFai%yOqe`EK;M6S`q*Cu=4^m$w)9^LcDq~E!6NmiV_{nP6$jR^7f01dd+gZmedO0 z^=L|p2o*cM(d!<}Ekk61v1~(PN6!7*?tD|ctW0?KTVgLH(|KemdK@B%q@^vIvI+Xq zJLUyK#|b^u1rWo&MqTJcsH8*qJ8Cb(VVk^PRLL9h3SRf;Pw3D$jx0!y5=@&9W6+Up z?lMhWbV4h8;P^~=HV|KTGCxMoT-gXo-+LG1s>>y)r(oc|5|o9@ebMva`albQ6RJcf zR`L6=y+ZqrL& zLs}4NZwnL}uzK$mHt4b2M7fW+Sp1rx{b~I?Le2LTjVBp?VEL2p_wPtOm`ymz8F0FI z5Yt+c^d%u(`+eUUX~s>rAGLhrowSMVao4NGJ`v}u96v{rAbM({~_3!40o2;u8M_Fn}=t zq_H?ZKkx#9oE`E6)&^r_7Ct368dKQfWBS{alZ3bFbMj9#ra}Ij3nTunwj17ZuS98z z7l~61ylLyeCHxB>yyLTzJyVy6Sd_X0s%46*rT3mMWdOIILo!@D75;kaAn#IAsCp_f zkB7~7)9vC?Bs0;}W6&7agoTdLaEXzsLO&e*G(>2u($H-I5FI%bl+}gjhd3XU6b~qj z{uXJ7Y-(c8wl+W+=42y#Dz?aN%@q+pASexe! zAE7tOw?1^eNgm4lB&E;y&Dg)wm^(~mFcA*49(@-YTF_{On6WWygW|Y4tcsY8aH8=j zg9zxdc8(hIOMGB<{@7s`>_2R{T`@6p>oKnQ05>#w=&yx5k7oz6AiB9?l#3uPB_K@D z0ON2DwLl zbxJ`MP8C(g#v{Kh4f2+kQ^{#|*a!}=*(b><$qBr@r8Wm>3`duIen+Ur|6V3~FeIG- z+70dbWNTCkM+-ogS3iS2{YmaRAg~l1Ra>Z)uvdFUX@s$pBOFyI+V3-w?!v#u4C)Of zyr)ZSsc#Cr#w36kv?XZHoC(lnsynfUGpC0t4&+vPsQlA__5Z5@jgw98^xT>Mru;`#t9Tj__|zdv-Qd3)d2 z8}93W(N}0f=zCGtl3+-2OI-OV$wHcfWl2d7lV18Jf%v-j1!{_lp={eR@Vj1XD(*)w zrZrr>+Zb`~?a4#IrOH%V9$#G1A#Jg7+ci~>h0olPD};`D5L$fv#QyDTYaaT_Wka9E zua2JIV++5ak^Jm0C#3^a#QID}{zJOy{~zh@qWIMmf>ZDayd@?D3XC-#OlFw*@x1?r z*=`xyqQ4$zvkaQrG!mc+Xyk28u8l@6id;g=Flalye%IZ{At!(hu;BLsPzVZbY!lL~ z)zht3faXPCv{ad;W}Dnos;$GKTWCB1aG{KQtC?`o;wj5aqZ! zCngC}q@M(nM`FFT#Hh#qY}-pXAik?IBAbF~(DCb$jtL^K6n0tb!|vTw`gnlPXyn`<($0-!I?rh; zK}y}|y~-zfA~V4gPciqep2p})6%zw=jQQXFpN&+{YOu;~M^d%@oOlwl+8qW~eU3)` zZ+{4D@j$lJlyjX$T(DGlWf~bPzMOPcBNdle7nT&!3O8W$S5R?XC`eD~N}1}@1p8k6 zGot4IZA27-feA*2Vl^DIevZ0_^K(L-!HOmueF|k${v|qbEJye}yK7YcG@MXfg*J8e|kveiHvrf4i;Qi;0Oa3o+9QZ23 z^cE%le%PNt@hkZ2Mcyrv^>lVTM}^;eM=X(?rY*hipUg?!bqwZqT}`qcjTggeWo_}~ zS4#P?<6$Hr2a#IDt5kg zUR<5)rlj8<+|x~PjEd{M?r~@+XnzH3Sk}7oyY*dMacHSHcs#%7Yg^?rn*JvR2zuOJ z3?G6m*4IM#UpI2%l(DjpqIbMx2%_-LncZ3+C+;ZMC)luXe#&@UWQZt!S+L3H(r6SFR|ZZKDdIKI=ybC zU$WGeMcOqYF030|wm0jyUkyzuLB+Vp3 zofODdHBYzV#DV%ZGP;{Z6`}Z9oRxen5cRn19{{Fsa2it{BfBVzQD#G9ZS_zIt0;Hb zjooP{>A9bo*W^n@W>VW~HUIW2#Ky#1oMy$cJ=TW2lEJY2%NC`nIj))1NL77-x>S!; z(&9OlHbqh}-R(jc#PN5boh@i*cGlH_n;`FaA{KmanRJ!r@8JKV&!FnC*Dd0tHT`H zTKyG$M-(6T;_>SrNY1`k-?{^%s8zpl@b&uav9!rLOx7r;nIR_a>B-uv+F7}{e7Cf4 zajmVBDk-G8+%{`uR6CnBAc#|+iPb2XrGkeV;q+mUlhMz1gSAWr!Uu_2M= z&&uW|sfA5hZJow(f#ya?3);}+K>{Y58m?_b90-RrJqKBgM{>9PJ#o||%?N`=Si9xn z!CI=mjKe21=yMIF%U-)Ut?)dfH_Mezhx{?3jTEW=ChY0X;2}b`+f_Uy%ZR4kFD-9h z?e4Wqih+)WPOg!mp|PiB%I&uD4udQ)5yV&;DLwSYyvNnynJ5CuPr+pu@yze^mc7+T zXQh&$!_J0dE&peFO45qPj19Vh=3h3dS-T$dg5b4q`r=l-OTJyZf}~pc?`^#0YGsR) zdd%-WtoPah!kvv9LH87SZp37d_o{DHls87lOQbB!T<#CvmP(=#r|Qsct+<`c_r($z zM`Y%qq6~bS(+yI?-W;%Kets5CE)!}C5| zaeCCTF)}JiZYBuL=SgcXH>rHp#l6eQ>g6m7?5R7p#cxaWRzn7q*M{=>2jmrr!d*wK zi1+)hTZK~DxD#Y`oE|$lBSl>HOXPQU))fm41bd|2Ua>~G2|N^h^4!Ma64Va9EhAlO z&6W8o0Vp|4AA5);fKtOyvtXU~iQDh=5SQw&k?fr-1J7g>`C3?Y>^M!@M!wf+x@e}2 z%vm;kOw5sS7_#q>Fo|U2zsm5$C9-43%P$FY)BY(!Z0Q#qdc-r#p*Liuj^TD1TKc=K z9oIvT_F;mnQYcTtxgtR~xUCM8GY&^U=QTEKyTA8nP;P>$f^NMb_?4)LNQI&r5U^ry zKJ{)4ySyk`_FD5kCwW^L$)|060wbw_rH%J=K)L5CcW{KtKb=Qp_BOAe)zNkBjmeWVvLE(ma0D^^|eiTjIytX`*$4L_~ z<)rIslK(?{NpPMX-;XZdlnn7c(Fjz_6)&lwJ%o0COs5&v*zre)BPMUf%MFG>0!i2D z%JZV{b!taEE1Mk88+1+s! zFa({Zqs`-<|K5}$@%NyPz5qlWp(Aavb=qXbo7ke?gYD9)*UHUY<&#O?(l=aQev}hx zHIrW&^)3=}>ElvTB>MOynr+VI6$ZabdB-jEiufA*kemGr{P9C6ta>WREIv)GyD`Hj z>L3F@o@;QMFrs`ca$>fHAg<^jT&g_`zX5Y_Qk|Z6YI>+Np(6CH-hz;h8Tk6#Ha^}Z zb?L-gko&Jxymp0^qrFWtG^F;svpMt|Dv>m*-WbZ#dGXQ!-Sl!;$CmN!qaQ@NC_~gW zva|kuo3!CHeAq(y z#J2h_kFwUd$6@e)W*{R?3@60lZUIKA;?LWBjypV~?Q732s-dsOy>R<~NQ1T4-Nb}*@5`pym^0HmE;3Ouqo_JP+Eqn9;9@KL>Z z@6XI5VAOu~;3tNE;8pqpUWbbaOM?$QirjeBgav)6S!5>mK2ko>4h5fc_gW_X0u}?4 zFO|}#zOzNWqw<0|DzeasEXtSMfJ~ckm(ep}or{FRsKXN-DDiN;>->i{B%yXp$bgbi~LGP)OGj=?g z58f=M2zg2K3+gXvI@rd>Vs}mCqkp1Ujbeq?@KJSsN$+ds|8Td}FlC-+SMcT17wpP$ zrTh{K?StMnUR}A}%76@0khu*_oA5`-2Hw%HNkw4XbVik=mrp;vI&p6+0!7cp4`U1mz;%s02$}{Ibm*phh z*1Ju%B!imbf7#r$`dqG6pZljl<6O0OHr$mB4V&k2HOTL$@T{DF;_;81VX79Cv|&G@ z!_Ma4lICyK<>46WHqEEhQ8hzX4(;_4$r%2|&m`N_!CnYg+wv9}65NPf=@)U;{Fu(qZx_@$D?(LLS z5}-A;vqPeYuBb=Iu_{HXI9y&@#l@@8Q0)KgWWukRqO;J9tqaM@&B+1(2`gKjTbRIj zEVdT{{cISj9*AU|wJ#fs4s{bEO8Y`{2y1C?2p}aQ%a;D~K4%k%AKqW)@HJuUgU5ul zgo#w%S*d1N!&Ju-KM3SqB1>`z%tgLG7vM3HA|I;V+QB}8^=zy9^}$wJl%4d%bC&H) zMf^HA{LaPBj(O(oS%X1^Z32+n3PWQ86Wy^i=&<oUBfJZiR2c8)IWQq72{)FvI|j(x>hX!sC?F$2~;UOjd~3>MSi^pO`8z5TKW4^1ziS~C9FP2f7?2Cr-Q!*L?{HJ7cB=4 z1G0x(1(x%9Lw#i>A2ReB?47svG@M&d<*H}4Cc(4gRc~`kD&C`(fipDV<^T#99-%$M z!EBFE!w1(WQ)9SBW;P7co*ba3uaBRoK}z7oG}XO7dH6hLrK|zyUzW!gFtmRS(!`r9 zN{^eVy+>`9C@$m6^7V`dzXY-L+~hytVq2LOL|7G+n|s8H2hA)W#Qn8CcBOKx2&$Nu zgk#$&`)nS{gKVQ`d`TrufT`GZ=AX`KNB!=E+4nuM_rG?mtHM67@X7_;P*aF`M{{5r z(bezoSD3kFll=g`u9Zu?*g(9)gG@_~SPt3cfbLE&H!da4%M%EQ->3aw1 z+$^T{Y8#5w3Na}+mvuBI`xEyhu;=|28C^NytK&i_yP6_f{mvR0!GMV<9xih(r}*w$ zN9Q~z=Rh)}GyaOz@0nE50Y6?-8r0K3n<3*uYOmFrntleUYp4EL|3rGwGyU+x1@?_- zS;8xWR%QK8N+{)&L>(Gy=pz$1mw!lGr#Kn}Ddve?u>D4j(v<_f?nqM-ll zxK-R9;uF)dh^L^s=kaw^D_}fh_rD6=a*k8h|e*HKpvspR;Vo z`k+GcXE&@vE*Grq4!^5P@{(h%MQ2qs<%6>CIR4v-S*dw5)r zyjc2d>ES9QRnvv6wS4laaVs02?AmH+DV+=C6`@fkr_4*$2(Xjgcigyk-;dT?h6Op*+7HVl z+H(wZcb4?^6zo9)jhn=}^yaR=d^LY~?4(ag%-OMv06j zNxOCmJtUp!mNtvcVNXlW*nZ>doBMim2oUD5gmiMZksGSJT@l`1aA%05GFVeq28r%v zMl!gPufD@-)LF^Rrb-X^_;QpFLTpe@5NF0Oy$WdkWgp9#zaQqP? zS!o_&vx?JxGW65p$}23`N9+5nCtXdzVExOT5PTN`vio@$r}I@W8&!O30u@HN?XoNe zHi7Gx5!@2HFd}PEEFLT>PCmYsb@+xXa0AN()Rl1%BBalDT=}7S)VJV`bC>Tank8Nl z$?cJYUrg$p?ChF0^B`L2sZ*CQE5`JZCdynqS@`m+eTh3|G+L2Lo{62-!pO9rdEW*w zyuRWw$$s$N7t>CmA3U_R0=vqZoalxApb>9q}bb3T?@I1Z?UcoYYVX+<0TF_1zX#`@~nmvOm46giBy>QD~C?&|pr{V&{n-8Pj@O;b=%c8_Fd#Se}k(c;^{bc}c}SCO44kw)^Ld%%c8X5rA}X*K{-Ra1_)Lfu_bSqA+m_X z$k~E!hlJWgMoyg91JT(`E?jqhniRUlzv$@EKlKAHr*UuZ}!G2 zH5g-5q-b4-oI_@lJE{z1Vbdnk>JxZB%9*tNZ41%Z1gtAfU_O|$Ygr3H~5Bx*0VNmX})g0zyEKRo? z`+hy5dBqpQ&FyT!{^PW|Y_!TD`^v%CrSe*`Q|mJm@M=Va4Gr2BhP{tVT1 zM#2y**p*NV3}pvWx+p3`-Z)h^rv(2xuwfWhi|9&*0b{eGPPR)nvZ;eMW;l0PkUZhb zV*{2cG}|i{WFYO11s~Bnz~unb`|%YfbU|;7SuNSa1-n}N6dc^O$mn`PHeUjoY>_Tn zBmYt8Jt#xnTCRF>BP5Ado@QfogasdGDLI`n4^z#~&h8w`v=K@Q{rkaInPU?#<4?fN zqJV%%y#E)yv|eT4kI?Y(V=MW|4apA3DW7}$Md!n|n8%^wq zZ6|G`#PF4t)0qdWjDhT5ZdL&^n|>?#jTWoO$QI0neKPe*&pT?PoKnejHBhvM%3&@81Nb#ZyoJ3Jhvpc=ckrSkxekV_GmW{SrFT;UDWI(mnU9(w-h z8{9cPmG!oa@uOz8CH!a#+dMaDhdW(v9@e&%VnEND+{hv2mKE6-Vq*HTa&dLJ#m%yhGL9}|nNYCOjz-dWrR%B!Vkn5OJ)t4eb6f;}q5gm#H0BxotD zhtthIzBh5K3Jxy(nP}X0F5D6lf>2jqKR7f5uB*$;ZDCmXV;e5RRM=6W^O`4&khw76 zt{-cpLfKdsQPlP&Jxs%UrFFzG!y1FalapUB_SMSkXYALIC;u7uApGo#tygwo4g_#x zTzX_ZA*|%i8(%HT`jf2?%3th#4Rqm$-^AVKa%x~?fxFee$^j#zQB4r#TNA%$Do<5Y zvfhyOKS$GM?R0=kK{C53Ko(Qf&DImU(3G9EHtJ;dcGMgKo)4W+bG>#%X_iUL0Xw3e z(N1r>^KJrjqvqm)F)z4;Jq*bzCIb6&d;Y0JW*mYPAadlQUeb{F+h(nRV<0ecfFHHt zE{081P*SmtH-}U}qR94Gt(=t=(>Ki76399_eq2FI@ACS#9M7d>uAzZlTU$HM2LOCw znOQDNCuck(axl&ch&rkqq-wZ06?UxFA3v6)H=IOALo=nyC$+M|6I#u>ymIazo&BJ! z%=&;t_mZ1!8+3$iJacB9Yw}fobwQvU%R^_SHKM49A_7Nq2cDLV?pys#a#+=w;nr~3 zUu5Ni&fE&P<41#ebcay@vsN6c3 zy(NyxRu>{gIHEG7Y@_hXF?Y;ktnqL^iY9s%{QSw5(%7O9!NT1>uoUj#H%62X#Yz>t z%Z5s>U+67dj12BCh`r8M094x4EJlwqC<+CE9Z07T+^gR;#R}M*s-u7; zUH3tV={#N7dsNQa+UUO3T$b}qzu8y6HMZ0!$}8`76%~E!LJyKxHeo6)rXqBJxg+A` zde3T|%h!*Ais}KaBBrep(@q$`-RSG}YTVWHX~dS&t;Zbm)*>?|vG!{1w>z^>;T~IG z(3Pb|!zu+cN*WnVD-+f8?{nBeIw3SYWlVTAjvv+hw1FQ+?vx6 z#Ha=dh2n=VpSWjqq*Pr7>{>r1p7lVlGCr=gFT5?`YpJ-siq+$JE52$Un8Wv;#w$l?|_Dl4rzHaBT^8;ELX6_7R_ z|F&}Z)xt9sG-ebEotcuexQwvPzocXO`J0#LlMh&X9#OqM@ni+)-NmDunr$f-UE;3ikc>2nf`SIer$o8A6$x!^9JaQ|;Zf)m%oIs;=|W4k*Va`d`CX>aB5{5s zTbOUj`plQ(DiK+3@#W5^u8PB3fg>Vmlf0DRzbKY?Pqp0v9}UNKT-DV}PJRN{g^las zDm64^ddwAn;--BrUg5r;ZJf~lg-7PEpmy!nRL>_Pxi+WrbrUE6ZwVP*H!f=G&~Pn# zRMiAc*OpWMPH7N|uJ44K)MeLMugQP1YkE(;th2F27@d)bGaFQmICowSd}~|t?cnm+p6S%fS(}YqPeG5TW$9jhXBMh1ZLA$L^G08?7gDvjpu!0 z0Y|yv4XR;IEDhR)>*5?TfR%NEWUX@jG8{KAPSMZQ`0=E#A!RIK(IbA3R#t-zZDUC1 ztGN|ksUZ=v50|jGh_do>RMlF*AF>K)s1tgIa;`v@tIwG28pJm;XMHzp zj3IMyU!RIm`nYwVAmyK+GF%!dub8MN5m_-;K!i=9LdO?KcP*Qg|IM5==XM#;70P#Z zvIcvd;0RV%j8151j^A%-+uJPY-0`?k)mQReb@lWC ze~hA(*B(Bdj|gy(rfuS`jZ9hd7YTGJbjOk+AxW^p8bqb$Xlh9L<)Rkaz;J%6l)n1n&A;O)V@WfvbPr1Z`2Y_f$1lezov@R+8e6s%OT} z0wE%d=jGRggT5Dw_na1A&T-Un7EU@A(PQG-!WmzVqF`0ZK3_Hml2^IBd9gVvG$&#h zvIGYDUDJGTrM$XJDJ{#OU#r`?yATWj!Z!#nZ3B#j$ z-wU0L(rM5u4mc&EF>U+^3gY*nulFKi~qu5fhx*6?!>K8r1Gh|2(FR z!)520id(0AIh{$^yPVY=;Pt&z{)!gWL*{x=CW3xOgqf5$(&M%yBYJl`A>HyQr}*t9 zHIqHRr4&EoSm_GK^hDVIN4`3nNTuxSSY_cN3?P$aqRThJZiyvncVOcyJ?cqEY!9_C zrdoch|B6B^>HZaQ&4;_5@n4_fxV~3!8aU=~Sy^%Qm6nly1s#gmE!3{_&gN&C@i>e%TkF z4>YvCZO^)mM;iJ_ukHhRFFP$f%cqy-@^mtw6AVtc`1`TBMv7-o&j)N0byPl^v(DK0 z-dVBo)EqY@9%K9WGlb8uj9);aZ*{f1|JPrJmsM1W$Hk~5qF&vVKO=$1A*Bggpgvtn zKpSM@^B1#W9c(KTUonwQin!K?%l79>bwh@B#55I;ghSsPuh(0wDUF`!I|!Q)b(V{~ zc?fU|1A90%e1gzT`~ylPSl1v^VpX`m`t1^Bu~InN6GGleVdIjE#;S@DY+)~)!8>Ol z?Wo3;E%Mu4XnLkgw%^Q7VMNjUAcJO{zy=HF%RE?zOIlwMwKV(ge%CmFjs+znVrG6j zuTykQM65yCA?y7p!Uxwvbtd$Wol<66G_`}R4UuLGvnruWtN~+qUZnByS(ND3EOOEo zn#^$5`q~C0HY_?}IQ1NA(Psqe*y2vR@OKK?LnhQ>_uAR%9 zDqo={DkMq5`MCn7c5}@7kWVd>U}!cmv;nQOM#Lv$rw*VnZiM-Xd9ya2Vl#vq{&=mA zRsYVBa8iCOW;9yqFs1R%@{!qgmRLnH+7a%g zLPa=Pa|%r0;|a&^wjg8?JTZ*h-C*g0U^JAxo=KHol2nF^5A(BePimHh+B!``%CWef z2y~xbNG}^R$u-wp^Q4L)^SfpVUo(1)I1-5=1kyDg+IF+M1>$n>lC|5xwtA+JA8A|% z7v%Lq1kngasO17ddQ4Y!S~t42h41>ZZoA%?j8^;|<3X&zYpEjmLHM)!I_BG7bDyN_ zBR;#aaOC1+DUo13+lz+*FFG5iUs47&7Tj}N&Zn@J*{}EpoeJhQ!mmfg4<}o2_KrE5 z9jYhOXwvc|d`tJ7jT|xS;z+q;yqOGO1SGDb6mgDh@e*p^#+)~f8OU*pTM8N7<6$7jE$FK9w}x_Wo! z>Y7?*S~_{io_pF`3N_>HpWaosc;bc))y!PROaD-Xcpm(MakRFUaZGpd^xWI*2}?>! zvWF^oCdx8flI75z261p0 zoQpB>6dc*H+Yi3ctyBA>dfG5#AB&ll-80hrF2M6{lCzQgmuOI0vc=Zwxk--BXG5u? zk_}4<5eINTC_Lu{@qr@t;P4Pro1xE0-8`fi;9+yXJX+KuXRs=NF2Knx4Q%~wo(Gqr znAxkR%)N{mm+ir(F5d&6PLN+*9ard-5Kf{sh*pz$tyH!G939e;#|>QqE+7_j2rNZ~ zC5wcD95viMr`1yBeOB2*@@{qdWibwx%kf~U@|)tr8~mWdGprl~BC=x{%AVig3Y*?o zr5NoGj;v``=9Rz(l%LN-OWX@RgGpjcActX@vyHz;`+^{KC`{u-;W|doXwUW+ACpb5 zS)#|&Rn&6gW>K{to+Bq_u`rAQh|=7p3yyC_M2`KVQ)u-_UMjq|MSPUe(mYe2$A=e; zW@st+F&owAT$dJ!eNXaXFQ&NxEiw{1{%O|P{&YFg36J%L52IwF+uuv+&)@b^gcwe8 zXO@Yj0}s{8uo9yzvF9yKDoM$U(cAo^a(}q+Xb|Ar2?73$qEUub&cjp7GNYy)>O>-Q z9!4{}aP@K0#HEI5fn~Ha-9{JE1u(ET6&DiC>ZN9c^)Ww&=@5)=uTc~EROrak7q#L0 z&JC@bov>^ZVGd<+&M9xK7$-**hH&3Gkq+?aNyN-qdiOQe@)(76f+)qET+|=Y6_L6U z2LsA%t$%a#p?T$apM?d)iaoqV6fC0J3I#@I*HX;RCP$+%jQ4dah?;n_{G*m>L!gPvR++%F*>r@Dy=;J~&|)?oeeE-bVcZ*i z4Cz|}IXWY(q2f-1`Yc5zzyHVfZ*=(pSbFUnEQ``UMH0NadgQ|+dd&Dy5<*F8gSUm$ zM7+_`QxTfpOc-W81OSC(xDpYfXcQTa@`@qa5s_=S{;V+CDr(>3D;Ys?u#;#Ldn!8~A}!r=rn>?;`pk5+ z2aIL(f{_!!YP;V4$j~JDYN+foRt`h7W+3(cmGJ2xkbHKl+WO|1wq?#}djr!P3B{k^Fi7jpq5Il&5!XBMzMm{&7_?Go!cm+7twqUA2@DUNq4leU zeBlmZ;MqZoLk8ADH|zM>Ln8)>HCN8-C8lHxepdo>2c>v@)#0gUs>|;z3%S~OK- zTd|To7>0@K&Xouv4j-RdS5e{^y21Qf#87))@u9l9ieSY)2s%po9Dhg2ps6pBd0gJF z$#kboZ|UioWNj?H^0IwEOp;ez6*?CyW@@0|JZh6N%?K2Pbi!vsLU+>AbS?KR({haB z*I@swY|T|Wm`FaaCD9;CuGd2MKzJ}0q%xDO32jSm3#kLkKc)vb?M=&dJqWiOJ3c%E zA_?v%F&k>X6A`G9viw5FzrLZkt<1F;92G}~WqhX#CyAuCF8|Blu+quCh6>f5@qJ52 zUH=XwTIf?1KyqD!6?Wy<1X~QV16O0zLAk7?#SOlqKY1rja*qDUtg&*0xgc4$}eMpn8Q3B@tRef?!v6 zcCafuUv}nsdsONy4+mJ2D}Y>@%tR24c-`&rtL=XSROi_ zteu^5ORFX!H?taHJ=i6v)UVprie%SobI0cdW|09VuSttpbaR&u0YwKfGBB9{NhD<_ zk_}Kw&RfH5MfjZS$EXN7xdB!N7~h;vG)1>I-DIr0J9+wCGG50i18Mly{f~1Wend6_ zEyt8l+1Iq=`eLwx2iuCpW*au)puoaC(kWeqLcl(;7v(Cfxl1n2oD$ zJh%BcQDWiPOx_EuXltT{=t6<>tFaNe-lNH~x}YBI^mtbE5inn9W$=9A=yMIf zanz)&p{)hz<6oez%j*ix3?yr?YGh;SFcF`>_0ySUzw+Dgx*2wMcuE)jB+fXw?f1o&d>(>&hE96|9ovH(#q6S zg3wh22!xx$Vwiy3u77Ga+ClVUe2@2CbjvB|mD!4nY^$mqL-jH_RS=$yqe&T_S6D*a zjh3@M=%75SU$p!qSr#iB%1DZ|o{gQIrEN`A7_VqQSA|aY{OqifNi-u_S0J$)C+7%C z)#c)(e#3Y~i&HJ;sj`zgwWKqngLQx_cFK;P2Ao;`GcrVz#^rX0;(3abO(0+DVTQPe zKbE-LJL3n4B0iAO&_PjWMPQ&-Ff=tS&Fyp|r)587SjGug`^`P1l4Cg8%5VP^}a3>8W$0YTaj?W zJo5V1DyvaKgusBI=TP##_PSWUYqv>ETkQS(n89A?cM@o;^TCRi^f=egya)a-imbVN zAgZZKwfK!ceaQ1IMUG#TWHDg!UX?@TOe=O|^Un?bqx{DL zX(yVV>I`pTv)zDvmY?5TodVn;($AYqs#UYkyh`^k+y(yQfh1u7$!dmwFG1(cw+!QS zao&5hbAq>YGUGS5fbvU5*!+SIad4CskwmbL?DD7orVc*XI7EVJaVl#pw0YU!3NHSU zH-@>0rTD7A^)#tQBJG|)TY$P|UqOF&iY?6e?@yxtwp<{qiTkn(jOG$#TQOHQD-#gc zjI(AzCud)bk0mAn?dOm<+PM{CWeo4P0#6y5V+;=sUn93I9Z){mZYy5z$V(*|904Yl z;?4}wJ;qVyw@U&OkLRm5Ftx|rcspxHW)`@JDt?lYeo=iwp|tpIFi}IrE)u%{zM^Ff zUNJ6Lh*RpKf(r59tE%>{SsJU%eNI})WQ3q-1==$-m1*|bxb*`i_a2w!K|LF12efBs zxW~sD%5Zuc5>iSTGsT&u8#mU?v=Spt^$~S;VB>A)40mOG%vsGfSCIJ0IJ`VwU&+bK zJKjH52C&T}pqJR^L@jHU#?vRR>fhPZ{o$5DKtz;V*eOn$XY^z8WM$enCc|zRWp1Fr zW9TPn*8+r#t7Aa?8`?9W6FkEv*!}Cz)|ig5X?uM=Y!VSb%@FE`jY6096sUm%Ty%sh za?Pzxe^;KTJ@)o3bsr<)WV;prCl|u=LGwc8UzK-xHQXpm$P2AKCFME?Qu3hK@ZiU0 zbtfB-y6ELVA+gW)C}_7VU~UCYgTxYC`9vkYJt(SHmG{mnam*$Ch`nWY)VWW9&evamT{L!GqK_Y36CiGwRqgi4 z$(&OH2uHU9kI~|(g_jHOH)a3r=RR)ST7x-b3LW(i>b}-bt1U#vpdrsKk1n2Y6!R-) z9bQ_6P3UE??BAY?>|M1^TQ67)U)#q8{E{B1cHM;7ka|Cvm|;lFf8{n}5!sRQan&D{ z?-jO#CoraH0b^$@1?M_Gu3BiM}OE|_X~cE;mq{7_^o`0OXFC`6o*sbHHT^QwT_O2nY0*pqo7pU zbyx_lwG037@h4;f#_;&y)bg+5p5E1Dms^BafM;}c(Z>qbwPJmy!Mcty)AASW;7DV7{gUaBTs=YgRy(A1#+sok;|#f_FwYM%uEW;V z^sPFL-6!UBAxrT4cPqlI)t8ZKmV_g--;2mc;D*@AjIBR6`fD5;e@3|?N}2ml(7U&+ z24?9FiOf3w#woA2i@B)N!kL-%3J`8$PyU(GA>Ci=mOH&=Jh5!!Xm#0xmvxx3X0lUI zh*90J>&q*+D>*$d^|pEC?(Xcu1X|UXd$7b|;b7gYcpc5D& zU5ld-4cX2O2w`k?G9$>6P0!%OI9#=_h&6LL#DaWLm-TX?ECq)igrV(tF>~nQgcW#T zMqLN-l^Q2y&|%pMgx|4kj_fi561ehA>?6rL%`%(gOw}|ae?QchL^!}x?S9&`?2WnB ze*f1=^Br`UU3@+qC4#f>j3$<(;gttQsm(-EnUeUGL)o^I3a&@UR?Rh43)zbre6#jc z(C*cKojWlYjp)gPL)S`+X}R6p%p+~~G|jD^bA-iy(%#JDdu!o~F+oi&(>sRPyP?EW z8K3cRh_Xye;V91D-Pm&ZD7VjQJl>XDm;NA+BfyVyyN(LgtnV%9;x4C1VCHmD9`3-pe}|Gb*Pf3yXVr>`CU8 zy2Rz5ol;13eFqNJ4UX6>W-m>BR{Tig)i}xHQsD80w9MStp`yCJws!DJg;LcdjmfDh ze#JYIrC) zu|Cv&Tsggna|}-A4-KV7NHuGHKIFb?dn6ztG1DUDIe93HyZkdt8R#oFsU82{O)}ZS z5S1K|QkmEGSYdLH5e;aG6e7F~BI|`-3PT6$cAqlwRB}<%O8`06^czi_UL)zmI znvJb&T3|Ip(pWAip#y6DZ@CMy4w>#2#G0uy47K#n8om~oS(Q`?8UxWBeHz|RGlHmS zS}qTD4Q-M7393KtC=WQQtOx*L%WU06CUX_Rqs^SXgM!KA1$NJyJ?hZTDz`I);IHMS z$|i}CpF6Lu7mJ)M6j&{JN9l-`NPHAc+_or19=C*~(MkGPXrkN6G64m?-{^V-Qw8=p zsfWy*`@?q{R2s(gINDl*=aZL%t&+B!_iw^z#4(I6Tnh7fpU=*UR%r4EA7g) zY*ATL+V?Y|Xr+w5lwkAp<87Q-%5eSBmnhtw6e<(HRl~7)WyOrYJ6tGAHfpsm6}Kub zN#SfH5s>Dct}IdAyt4&C?Qm*`%=0TW4Kdt>N zkLkutQ^6(twN;fc&ee`d?t?SY>0X0{wVzE%)tm<2>!p(jfQuPn+P5vU-7oIBO^%e1 z(D|sB`D5FojAzT>;_(sj(*-B7+3_JA+SYUYH9k>B!t9i6{;XoGQP*f8t4L4psSQG_ z0NvL@&vZ90u1PMoLVM?gBN_cM;?CGhI3(9$&YDgWdQ;)=h0e%O8f)TAf;(|z79E59 z?=L+>5msVeH!@`eg)ED)>S3$}R{Qee7HIPxzo3l)Yqou$PU zx~9d^-us$`YN=Xd*0Yd@|5t=7Gw;M#HBs*7*el8`YTDDg#^iuYLkHGO`Sqnb-^|)$ zl;iUq{+)^ZE2vxl@o)S6uQhQJ`|qxf1L5uKWM*JzoBA|lUe3uNrYBlgyfi;h`PA93#E0{FQrm3E)Yq( zkegklH(7P1gNh$ZnC+xywWN(quC=|#>?5x3RWf^dI{&Dru4b1XjQ$5&L3-!B+@mi` zw(bWmcdEENGuJ}OG?_xS^dqQfE@Uu@xwUryUU@(*yNS)&VlACEZDb21E@vBeV|bTS zTegB|+33o((jD4NHWCcl6j>4g*D4ult{yzUVpYHa*o1sPUQd*rKCH(|*-gK{WnIfw zgK+#OPm6(bR1ZLnAzy}pfu^UpjBt()x26?^$D*~bZ1Qhy_ zt?Pt5aJ+G1V{@BO=cMm0569DSFuGb%6%#Z1RNTzn;Ta$Fry)eiAm*mU%Q&ljKFj9V zsX$G_wXsGjO754 zkGXxczsmdA`MB%EZeUzZq$eQERcDZuhU9xcas9`2SV6fE_r{o5yH{+uk$h%!ecL|sKbui*% zz*#Qq%DeGh9EH8AEwj}`*+lOX`k62dWpC!4$Q-TkQV8Y1Xvrbn#u|bLCP#hi!`gXG z^pel?XVJU$Ct))GXNqFTk5rs6_GR5L(bw1aR-$j%FExCAs56)0BYz%lF{;wTexBGy zq#1sHXTbR=4WTO=-#!uy-1t+7MLf@i@pT3>$FZRlIOxf{H9{c2q^X%H?1JCCVA^k) ztg4U=HRb<+8vp$3<}Ehv60@!or&;5yf}dXac;%$R+;R@5M#{UD7-&`zpV+>@Ym=0y zd*%#8!6rp4jBbiqCaG>G`)>X~poL ziz?wL!0y*N&VC*Yu($r@-)f_g!_8MotSR-N`yD*#4-v{Vl@-}tv51(@_O*A&U^bTb zMAwz<>_l?)&VD6fPL}0DmH#i8Kxm&FdIYTD*3eE&6VjN!x>YeecGznu4D>0f`X^OU zO8@JGyfDR~>v+c(D2DD-O+G~A#wJ`U-L8{x{x!U3`wIhrnGbl&g4nF=`W#6jscWK> z4j=x0jNm$KY8hSwKW8GZt{o!^S$dMEd27X&Y&(f=7f_0oSkO$DfuS;Xy&D^k=M#}_ zAmBmd=?!r0>67b1~eX}!mou*}ZP1GE+^(j>jHGzY**lihk(G_@l7$9nvm z5Y5hs3Rw`PnnB~|04dnCLT(gDET&g~u)6ggHU!@O>PJHE=d45&@39S2J z28v27E#%jC3C1tI3I_8m+ibB8Y!nKLDU!#Q%=OB*Z0Mqj+Q_3BOb+>5&lQfbdVO`j zRs|+<@{&#PzswrzOedd&Tz0BFRKorbS%rq{bCp&wDeCpmX^s0$IcW>0WF3htNwv()GC&c$QKg^tc?bz=lW?fc<$2ju)_+SKH>MiFlM z+!tdhomxpvOBI&?C8R)>V`wNU(SkA!CIHD7u1%*gX8!2a+Ruy*(J1I??!Y? z1m&aE@hlITYYSklE}}FS)^TYyXUWCq7ypL_3hjI8DP~EWZTf65OLxhQ1#jL=qVtPc zp7PlI*osRb&&!T|v zjRzz;(rj{hpm*gOXlu_lH{G)U8AF!TJ}6;EXE2y%<1l$AyD8 z$*~ah)VLgsEA$lp+YzC(d^2&SmAiK7$D`Al`219)e3|c zFn_7nxDvuWX6HAfLoe3caF6pfn&PxZHkW?fCd(Y{NY%@+?pyCkK1dR3)1X9Y;GSIL z9NjyDZ={Zatz?_|$@nIA{Dh~IaR`_hNDPN47(km~vy5{Ja^2uHeK5009X0M4oK9Zb z{ueDQ5ta>`*p*a~!tf6=99JH$g>e-J`cNg_EXuLGtcp5Aws4|X0lF)hfCZ(DyTDg{ z19gT7_SP`3FQl(+QdC-8Th%`Cl(b`RkPbw4g27bduGsP%-r~0l43URrj5Q!qdiN_% zjz6?H5jP%X+$mw-V#JD!cz-5uo6mgjllM7I5n7iu*$bAQV?^&FzS+Kh&yqcX0Bv-s zBfZ#5!FY@71OEJIX05+>3Kn53c9f`5?wN&%Xoa$mnaI8p$pAlHc6LP8o~op==6{1F z>7LV4CQqH(Nyjn04F2O&(ABq|8!x2ZnM;18M1ox$OWfd3hofr>tK* z0zvqU^04a2J{3-KU!)kc1FvZzq(1LULOx-gMJyIneq@(;p%JlJz48JPvGW&7x>^zz zg({6yRBpPwBFC;Y{Tg140*}z09Y)HimvD~Y%HK(tk|xOkuBRJU>>qx>m|T=hlDywI(4m>jrex_w*LG5N&A978l$m6d|36gVRtBnJp1x2A zAvF!nU(-i+&h08K8;VYOHMB_yb5;vIp4RlUj#;25 z!FXF6{N7NdO7qz*A)KDzbAgG=9Uy)i@NyYlBBi#d#m!Q7oMiIsWFLw2RZ^t_3T>37 zb3=>c?kJ60e#a>NW8d+!o`?u4Lpiv-5KE>nSY&f zOg(Zx(ppJZG;-H83}O!0L>|1uBYyeucibT^7e}#?FGKvEV#L&sBcnyf# z@)=bD!nqU7!4&}^+ay@T%;8)b-TA72gZ4T1> zj`DC0G*A=tRFsXTQT*$3mm2+=rL`m<`K^!e^Aw0v@(}184)VZ0!B<79OOokEzk@rE zPrY^Q?Nlndy}INWrWY^~EN;v--4nDIF*!(N(tvWbFx z5!&fXfqUe~4mZDH|7#Vag#N5@-d1n@AR>Ec8@;!7`@$PqGDKerp?+b>Bz%)tI z{4y3mn7-Ll&MOjDC`nWyo` zbcdG!yHDM*z~rK-{?^N|xtMfX-?Zv}hHaFN*FZ%wrsyW*wp#J;pgkja2?n zH`P_rd;8dTXTt8JL450sWarLY_vw2k%A859(fLV22l}kI{>I7bnlk;lWBi>`YoW#B zDDpo>Q4Jyme&?uBWY@_N_je@KQe4uf}hrif@D% z1k4j03sJ9|qL+QBqDM5K5~nP%_~&wU?$4jSKe8A0G(cjppkS~}d}PyaT&1@cr&jAU zsdgD{?e))}6-cR90YjM1huD+p!HMvAMDC+kpDN6CzBN{K$blL2ZJiC10;7LSA^zAJ zE;-GjW}t~FnGz%LYg80B$J4mttAZY;65indt;hyVF+Y=HQda_5kEap)Vo*6CuFZ+N z6E@Vs0tax8X)Dzy;^iLYuRz&l8Z4qJa+qEC&o095`~b~9=Ct5>mF>g@j$dK{#POjA zm}fY-L^XIOF_rHX12o4y`vrYAV0=mjJdTH4T`0l7k&BZ6_=Kvq4q0lyU5(V!7SiTV84OM zS;;=na5gHUitz2?OqUd)&lzIXy`_Ho*>yOw)dRvbpiH`d0;SNwOSd6xAofw9Hgif( z)5REFb~aIEx#eVU-CwF(hnjDC-{A({t7K*1#a%s33*a9dUyk|O_Ikv8_1^iElR3G+ za+$b-UPU!E3bPtU&E=(?=kmnS?R}1WCieUJusX0$b{YGsPMz;<(I%EmFsMrz00cJk zyAFVU{vhSAgW~Km@%g;e2+qq(Hu?5t@+O5(6d5E_Y=*e@?mBgAmcRAN`7^TixQa{F z*Dtw#Bz~P!i688%N2kNVfYO{n;3xGPg!tzx)_`Hu9wdXt+uy5exZIWSQhi2*S?pBG z6)BqzP_iJ0*w%)=C~orhSJY-@{f*P@@k9A8S4bn1L2`1?o-kb3{VMGOcz(lqABJ5~ zh1haH`E{9sD+aaIocsC1h$(8Ra zkHP^EbFIj1ZyF`JICD{j`81If`3UD`VBgu|lqD(ViPr4le!qbicF9yVuvJG8Vya(@ z&iyc0JvQib+%~Xrv=jN=kj|zt$d$8vN}}}t)+7N&yYaKQCT5gFk-oSGw*%@dwLc3_ zYTc5lTog*nZ`yCi34o$QAJW6Dji`1JFt+BWcvU$qBiv#UzJY=nsUZzG|yc=>%UUe+U38RgAvfE*zuf+bo^TUkd%5>lNGs504>QUuQoA}UX z4vsFAa`}|W+e&iQ$((VKIdU*K{<-Lb0Ql-XdPEP7z2h&BQ+Ti{XZ;Vd%S$Vugf^F& zut4Z)qkbyF-Goj?e`}mVJmNuJdr7E=`3D*+rGm}$koHCY2E&94uZDpMzE7y!Bn`r* z6MP;dDHRMTv6;U)3WLmzi9`fV75pr)s2vgkZKr?qUXa)3FY?qSoPC&)lNylIyLbP8 zX17ug+{6@msK;!{=#g4FW6>lRXLIRa_9dg$*1^_{Rds%nb=^1d9j&;M-#ONXGaKjb zk%J**#Z6+jOV-lhJ)YB%>#9gXZv)^*0nq^lhLPVll6iY^83lR(M`s#j#sE-!MI_=qA7437M**whCtx6szY;E^*&h4hR*(R|)jj(s{{$vC|jP zYV~@-kd)4wHh-JQP0hvz0U6Og4nvP2z{~_^N0u2L$A(*|S)tM!+Zf1|N?Yc9+X3IR z+^8jyD*v2{adJ|x!|uD0UB)^DpUQT!g(28OU6o1-^u!mufYyP6RMtvPsv(h9p8ov- zl)v=Z@$0;_HzP@3`RT6WuQEObhPu?Qiqsl)HyGB&LRxxjQfZlq;;(Ra7arDl8a{hF z3LhdQ1L_Wa%1LlCWCFx6sHqEsrTfk@q%J|w1IzG9NN_}t=il13AU&Xeg%`;5#2~V! zDiCSX+CXxr$|^dyKS1$(>2A&AhZ^dO{LCF|)VM|4s;o{^`(=+(Q_J?qioRVV^#TAwD=5{<1#crQ1$Y)E?>p3OkBqF&PGA zFf9D?$_Hd|K_cDNN@dyPl|^yU=}Ma{Qz3=tk`ChL^W{y&-Cb^W?cp+i!PRez+Q{^3 z4Gj$vN=jq5Nl=Okv|Jakkr4ZOTmvpk*V9{GYKD%gT}sg4HMg>IQicln5gPMN+No=5 z;y5@=iNA+d_-4^Il4#^4tM#GIx|0VQD>vjo!G_1Gf898J47<`%_RSX2#d&g@)@O%7iF~=lrzLndoF^Dzb+38_b)=H~)XP9A3 zyHqDx{po*) zIoK6zn}rFR&zx@$Y+&UFOlt91ISs2;+438#zNf7joMj6RC@Oj|RhXq3r&9kOM1k^{ zzFaTsXny(QWC(qYzc$ng95fz!z*JS!!K$XQvXt*VlINDe<@Ywzoib@Sn6-Fx7sM%*Pw^SeR<73DkqQw09sS~|L!#Uv-sR$g1^6CImo`}NodMQpCs8+12$r__Xn-r)T$W4|@KK z2UC_bDk|!g&kcb7?w?H{`_0bbpRmK)Ofz86Mq8Vf@`a&4^pW7?RIB2i(YK{Kj0Gmk z+eL(#g~c)F>k~9x&Yv$jI%0SP3dmNU4*ox|0kwGQqZk*8x&Hot zrG0f!9Br3xa0u=Mmk`_&V9?<1?g4_^Fu>pt+#xst0>PcY;2tcvy9FDZ;I2E#x9@&? zZ{1t9RXhJo)%4Rxe#f5f=|1P20ya=HGG&ax`AKnvO-)nxM^{%D*rBH5ul@-y_+D2w zmgCu;GW}*K@=m#kwdob*v~nH6GvSkUG^UIZrYjE9R-fmSk=}_m>opme^vt7FmkZ*L zi$p&sgdykxqforx#Z(b*5673xPrPKs*HJCF{Y?QnQ_Ulc{nhN(FV{%y(1H$?l@p;` zq+3w$$1lr0Yl98<*NXrKa5gaqB&l5^NkN{)7c95)`K@q+|D8@<<{TIRh4=(LfK#12 zwoK*(`{W0`JGM|3COyr+Ousf^`~$6Y9T{*kx%EQAAxr<6s8xQd_G0s6wngM>QpTG( z8+`vnEVUikRrl?NVSDv=oGb{+rD?;7q-tz_3jTuCUx}K!e&s`~GADm|rWf&DDX}D% z7}+;yFt5%hFir`v<+ieE3~6EwtMTy5tlXrhJ)JcR9z@wjE0-L$TsiekdetE$CS59P z@NmmC*@9R)_Be_joBbfz@XGhe>vFF`t_^;%4o)&&wOM`)Xs#yoyi>5jswz1DDO9Zn zvmD>|Ik?7HdPbJ0&4vzYOxnWc`rM^KdqxeOETY=}Q zrA6M2Uc;!pYGL}fe7ht{=Ylqbra3fzrsL5srppu~{IvUD=;n^_)%obM5h%>a)Gy{~ zzanhZ7$lXnRws64A(1YYRi7#rSQZmk*bz7GfLERP$&Si~tUP$=Jt0sz5c#F}vn9RRI@Uq`#F+X}K_ptE23?b14Am=>p~`1H(n~vhSxI7p1_G20 z=NU;2u8AzlVAxPJZpY&&#JS*{)}lJVgvx1+D{ zi@vJ{tXtf^tgG}FGu(1g=WCYio-c)Onu9v3G4*ZhoQ<}06xDj;BsZ>oroO&=(I7TA zDDVVs05}my#%MCdVI;6HKaYmEfl3Yf?Xw67uaWCYZ6aF?#zp-@U9NLWGL7+)Z-ks_ zv>#60=VWmv4A1+8-0*2t)anBlEfZ`tL5SMZ2b#5R3A3Dx zGC4|gQPY^wQ9?__xKqi5&Y8ky^0B%_#g!4YKh*?giMcv}=`MG;)8Va4Qooo8*$A%L zCfG+$kLslCj}14V4x)p-t~KQP?*-dltX3s-pCg@Oyw7y#=Fp%7C|*k z1=pyuwZ}8e%!Cch2E-yPVa%|+{|id z3b;|Wz9A(3#8_1A!xJn-h?*%t*eFLpZV4N0YWCR__Pf)O;UB6~NJAz3q*Z z21;~7FJ)xqfjj;2=!RV9h1MPv9nb#WR(G0GDckFJ=-X40eLiX5&n;kY3Yg_u6`B`% z+ZGBGwp3Iymks(dA>qR55J(#05F_I1S;(kKiV-b{!7YgKihW#dWu?839V~p>Zbj>p zccRy_klI4J^riLdTyff_KlVKG9vv9Qktx5oWKj+-TAQEcIC1iy4`i942tRZ06Np-w z_j`?_hj7jr{<1O#QO6f$c4=9SkvZ#V0M1b0AUGz4x9T)pZ1}6ee3d-v;3E90{=)kB zz~;>v$HBVV1;HMlaP=L!U7DVK$n6(I0?pNKV{|G4>^PdWT!i*JONLRI0<-Jvr%%rh z%S6tX$cWi4UE4;pRjy4D5H+>E81RR&=SSkFM}Icwnkz2x74oW|gOmru_PAN z_lz^EfRehizK5$F_}Z~W@rE;~C}F~!g06VgmlY>fF4DRSBu6{FokzNFBlYc^ty3}U zzZi4_PI2{ny=5VWlIPDujsp_`H zCWog3PV*p7@F7%8Z) z6IDz*hH&HSIL7IirAhtwGdy3Gbv(Q>Ijrq=*S>e=-6y(o07w4<3;g?74>TBHkq-mjr%d;B_#@tf`p@k8F-i^ur#1 zHxvBb@1CiCUSQ2&s5{)}0)9n&dm2esEtv+?FPK%Z)h zGAdGIQb@`b`NOg3Gd6gBX?;l8>a*nwl2AqWS5aF;`I_eg*n6H@g-u-Y#r&`vTB%f+<%&Lk{2GPw-k8xt( zKiAx>6d8PQunS?M9I!4t8nf6f{n*LHf^3AyKw6!70Zel^m#XlHE6;bi>05okC#OAk z{^du-x{{!3wkx)BLJ*kAyIIplBdeqwa(fk16=f@RJ+yVZb;~8Wm&;oD)AIbQHK{K< zGty%V;~vV`@6X-3ZO8E3OUTY0Ih05aY*kAS6j&k9JVV*~auMQ|+06F=*0x`vtNMM;2JDy$hxADllj)@?iU+cMR}8&f)aWNpH841@x*A(r(-{xl4^Vq8 zV-z^^E5rJy3;9YT@mz+bGsi3yN@gyQewu|sE$G$ z5`_cJ4z7(<_qhA`&GCr7%eM>1;2wi;=3?2XN{B4*FqD^E*gi;UR>t}C3L#0P8JlP5 z>j}qiLeW~r5bB#|BptzWz_SZ`&vs?o~cMe>b+OXr>MpvO#P)5UG2Ww^R_PV zV%Pd=x@p0fEmw4K}UOO!jYtIDyDQa3x| z=cDNUNu07lJY1G>IjcLm{@HZ_Kx?cx^DsJ z)E{4KWq}T*dgkua4VS0CDLlFkkhL-Hl`vwFB6@bdGvc=|q~p%tG&C)0sWQ1Wlr?c3 zHaJEua*vqPJ7-xbC2A%Y8BE%2Tmg5%mX(u=?=N@C%hnk2(VyKdI@sf9BXkB?`>{?t zobZRldElv{?rpqnavUU=m3eHbqB?2~5FV59C9QdB9c1241X}_oU2F_AepdF_O)5%w zeNQ=^8{ACpi&&Z_#Ee0hyppaVBI`3|IaV6;<*`ec^*w#m?>*mrci($W|4>e6Z{+d; zC)H*)pBo_|MQ&N;SR&PiBKfzWVWEY``C=``h2OrLp`moTZ%KLCjbYMr)Q!k^w0inu z32R)VN)u~}$`?=hp{AQx*$zqtM92lsj0{II?6Z@^;v14ENXX(U>quRz85z}Q)`nhw6^}fVk0(GTO1orWqu*D z?>6q^kaxe@9Cx_q?;?$$Uhi!W4i5vg>IFnNlR z;80~H&2NtNGi+Q6r#Y=VCWs-lqM^v;-p3s=>&g=tlhBaXv~_jZ6Yy%`0N=`L?R_i5fw zIw^5`duJ!W@Z7v=jbuf26s3;h|M1iGYZjgMqA|SE_Mry;TCro5)a~ z*W!N6ESlzrK}4QM<|FMSJ@W9-3JR3Bea+3olRPvvHAOxu7*Mdga?p;ju*a=M7k4SZxuN&tc+ALi|k@|L#VZR0<^`-q??uB-=b-{?S5`?}KwYIR! zDcxtnYJC4{ctZ_CqY6k1B;fTo1nRS8Dj=S`Y>**d3PgGBs6Lqew z?$kpE1g+vx$wQ)1dqs^^hVnc7L51m|vFa>u*jRU>) zzeGQl&6yOEIYzdt@nn{PG#me;NUsBrZ6r}~-Q zMv!V5PvV8vAb-bYj34{X08CS7OW-h&>I`UqVUF-flHnD)ex;oR{YcIJ4ux*e9y(V% zq9Wy^P7>?rCLP6iR_JAmOV`eNdnuge&lSm_;+<5{)Y48dWw!8B8kzI0w2EHUfxQo9nXCSK>f<`j?d+bQiO}Nxipb2c$f@hgBhE-_Z>nw>Le_h1!i9sNRJt z8)98ZYK?VGZ&V&~A~O7>*_(ARY$AzHg7PB?N@?b z&@Qdn;(A0}P&|zI1MBR_RhNv=vF#KZk&rtbSJm?0tORPPzLn0_>@r(Y zKKzE$raq9r(gZUs1M&jsLupLlCfv7&J7TG!>9>PNna$kW%0#P0Vtideyq#-eY@FgQu{aX;9_rCoRf z^;?i~|bW+emO_ z)-O@>vfvws#nH8Rk~lcaoZMf^OiYhQM$MY6t;HPoE$uscZ=Q5AR)1Cb;ns%v(#xdt zGwiXQlp<#aIxMTWyNw*N*6mR9!3dU`QSwk756o=_mJc1XxNK2@WldXXGWQwitHhlZ zbXTYweT2IOrdVUdISt_?dsoFBPdBV-7XDZ=V18g2}kO-X$6ZY+ZS4TmG72sh-K z(#$k#Qvup5wPrk3+&CX5t3uq^*hu%?4KcA|t1(f=2s9R-odnl?v$UjUAjQjFCXhVD zwq?`r(+F%5`HrKsqN0|l5ndUQnzri^oJ&i(N!mT~LZ=Zaj7GRgbK3O1yHuoyD6yo) z49nQpBhTR4T9Ac-ACQ6K-O4Hzi&NtxO(eQOk8e%!aKBU$M5u-_9Fyp~GggS}WW`)J zqcVp!^GM|xttKDF`i#A3B)2?gJ-;9Cv_6}0kz6_8^yNs%ZSeul*4jt1K%>#F-Vv%^ zOr_#>ok(1-sJWnU?8a}bR^q)~0_+T|{697S6svIs;P5@Hpl}hwDhwYiT8RER0*e}b z*b0r#Kyz0ZO4hJ%MWlZ!&z}>9IQX}NLjGSz{>P-+5c&8fLVBt`+}z*O)ij%*&Nh^= zDR#{yorU0kc|xS4h%pN~GEVCq+J#+k{!7FQyydCMgZZ;QqwttEjPuKSMnCZ|qo=H< zb~AFr4vKhs(c?B2Iz#7WfafV`9^XIO!1Q!&&fKimk?MUHf)4KcymX2&)>69WJ%K;* zN=g>9w$K0ZfcZ6_`?q%-2qKO&jC>g1>fXM}$|6=<=8mo|(mDYFqCVG}X}&h@RwJ{@ z6x|B81E8ZQ!FmY%HxH_MgLUA4|Em4g3*BdmYKjfG^uWgJxD>}kggo8aUO z1Rl7}ySzdBjh%3^Vr9~~Xp0W!_gs6>GdKjsN_roo?&GzcT<%=SDxh{2V#-Y1WRe*R z|5vilB3ypecVO)U#NK(tJF(9t6cl}gKjKUHoM05)4EdP3L<~trH zHVC+v^v-@1h2~M3)6i(LHxFg4`I0))OBd+X1#_VgImCvAVN%bEF_Y>vjq5(_~$W1cn76kgEjenpRQ%nk`bBTnsN`Q0^Rojn`xUN6VblHRMwB>Qi@Goxh$twVur6tT+GRK{HwL7o zrJ3je=_@v27gQK9X|+hu7+S)6?cU3+AsNQX1|9n;kY6c?OK1p6OH*}@Y`i|B++NRL zkc$rQ6Gjz;kK0WMVc;5qfzL(w2ABLRHhaS*lKN^Uc4Y|CHSV|6wJhz|KYri1DY6=m zVK;}Dp}pHJj_j_)TynnHwaM2a+8E@bN_v;vxjt4_ZQg;&>fZ9rR8?8YH07_o{S<*{ zXlSxZO1&#B?(vCNAnb_KlW67)9CHM^Dot}*@rPS zX?_4OguZ~b{u&UCotpXu4Gm2rXzL{{EiLeTTS*ES5fLG)pdevsxt$Q0cQy2Z^IJ;` zSzBA10@|oFs^gt^=N4p51X(+9EiD=44=T;*jvqft;u?Yv&@0zOxc^DwH@CMoFWGr{ ziR9$uWK~pj5K}WUqH=R-laiB}0?R5Yq|D7Xu@U+B`HSiK?LIaL$(&`#y%CB!GylY! zG&(xkYll(uyR|hV>`yZ1$2&JkDJdFucC3Mcfygxo z1d@b+O+ZY{vT9Vfwz#-BJ~45s5xB&L*uXjPI;MqDl+?J@BY;6Ai;)cF@$qwFT0%g= zy~Urs$xRQzNFR_$e5rePcXva(i}Q}Ag<%UrULaD=)%ESh=BB@Jrvnb5VM_6uE^s(Z zUd$OlNhUBcH5HZlu+eMqDpXH7x`n}p7|t_|9gqBy)56M%CG3HPiAfDnMp(to&CS}@ zR@~dWg?m_BbolP>j`Qu?+S)aBJ>W2kyfLgL%@So4hXfzQ#nUIkR2#nbnT#Sx9jr3= zDrw($4XUOn3nU~Y^td^p**`d#SYCcOM=Ux-nG@&^G#Am;1!B~keV)l!?#yUruz84i zlUD4GOWiqP+HBqaUP);L8+>-Ow3NfJ ziXmT-m-g@;sG*@TSPB0&t<|&z6Os;-??2c6GG;h9Y*P$1gKx1{?YZS?%@?j7kPM}<;9rM zO5Wz<#Vg8d@Y-0Sze-V5cr4J=E~S^zE)0;^H%ZRT`+7SK$xBY@N}SY?@slNo$)M*M z?@-rFQKY)0oCD5U^r@Tw!(Okcq~*=ld`3BpvFMDjoYX5qD`*v8AWxRHc#zA-_e}iE zkGq_VnlIJmWD96sB`L~F)7K=J4%EI~3L%OfRH%bm7YTFM>burTP*oJ`dvL!Naog=) z2lA7T4o2IT&HUyMSp-KWrI*k5BS8^CK}lp3DGJK0G^xdXFpi+B*MR<;zxpb3-Uh5e z`N=Ph64r{R^Ac3R8thuVY8}OgrJ4%L+Mwxd`7lG+92c-r!eRbN{spW-c0Y_wW-{?6 zuR;ADf$ipudS0YbWX$sWSZW=Tp_t5EN^cDvC;j^lm{)*Enhx;=(n`H@BWC$C4+{-T zBl95fM4yOybV1W`^5{yIg~{K1$*c?V53Qw`)V(g?tV2Zpp!P4zL6mgRV=QImOX6WR zgV@sPeC8>Jy=>qJB>`N$VMy)YAAvo79NQ5;^b0li=X%P1Vg47Ux1Wl%dME5t3SP^g z%LfHR(({tPbxJS^GRxV}GeNoxm@hhEC}CMyNSCb?%6?JvR{7oj2PdcpSyN!9m<;Pg z0$G!^@Ks@!A+42)`gK0JzXl>74^JMs^_+)0+=7ygVef>iV(A7nT7E&RBqftPF|SiB z-Kd0!Lg_vUlGv3;SU{MvvH8ao_Y@0-8u!XM^~Ux0&=-2ua@FxH{jc8I#FLA&=X|+) zd-SH|%>V#2_u_J%3?L7S>r+1F*|$j7=31GVYI0jNZShH&&h#?qjAa0QYrP3I>po#7 zAtqscy_Xe@`k(&baInq5Q~)~9u)9)Q;JOh#-?t3d4} z!QG4L9PE%kj>W?B)1lseXy&(I-R<;MB0@is<_opnLLxFP2Ph6G;xHwt=8eT%{&Mww zUnw8x3+xu2M(@C@t_oGf|1;LjIp1xAcIA|RQ)p)9`=GbpQ=uN z^?W})$o&Nfqe*%+J*frhkJm~a(T2qj`BC%h^_Ey^!az~aW@v*;4u`ZPAV2n3eblep z-K{d#w44mo7?5KTW1%aMVUeY|m4maD@?-p0oO3zWSY)s-c`R&`p)1M980HX>U1B6? z^s_-pKr!XZ(8i2qw)aQZ(xVA8WKD;Ou)BOxz2ddOvA-Q>H2}HWu;95KaeHtc_it$00 zzZgYodn@N$W#y*43i%tw#l6z(G)1boQn3>W8JU{7^n9QNhV%1tRUK!2qh#BGfg}0- z>--3Y*8shdcvA~0hQ1wZ)z5z@+wRGomeA>>|8baO|Bp-TOFp*G1;dQ6e2ds5Zd6@T z#tTC|6e@i*QM$|su}gqTvwJH5e;OqdRLI8~ry*ZPmjRdr03r-!0{S2H76!%#Wp7I) zSjq@*P5(yimJ}>%Ng7Tezf;+%`99M@Niv$vG@_KW9iWsIj&e+VF9%`_uLg!vIZRmr zZaVZ*MgtSnl$hHSQA6ws+@%B*A%n7YhttVlF)E^yvIS}(`f5Y*f8Co!|2J=MV@#?; zhbvrD0C`RdDL^tZ#_OfU3=G`?v7aCfccp~oev9&=u{6k+}U z$t|L&+d^b%!}=p*aw`|7Yv>2$)a}(BVMP}4dVhwcH456FbkRk?U99i=Q3vM1GZTUG z>m?FriSU|X+L|o;*g^l7d@zF61bP)}{Y?61_W+PLU1P!PhNRtTqm-YyQwgxJJyG}D zm&Ii#ybSAv*&#ETumWsAu`sKE(l5*RnS;@`1eS-)r?oPiQ(=8;^c|rPzCdrCfdN}( zHUa$?<}lFV6;9=DOY%~vVTl+h5>3)@ISI!-i3#iRtDvM{4}(H5ikw$eH0~LNgl2^9 UC|!Ht1?(dyr7T$~{vq%`01vVk4gdfE diff --git a/windows/security/identity-protection/virtual-smart-cards/images/vsc-08-enable-certificate-template.png b/windows/security/identity-protection/virtual-smart-cards/images/vsc-08-enable-certificate-template.png deleted file mode 100644 index f060ca7e3e7db1c93225ef408b208a81a2fe1120..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 90194 zcmYhi1yEeU5-tpjJBz!!1b1iA;1b*=I4th&?!i3)LK0kpyAve1FBaTw@yGq|eXssg zHFauEo$BeX?&<0IzL{8cRe20l5>yx%7z{-P8BG`%*va=shm83CrCex6`~3y$t|>1K zQ$0y`_}+oHky4R@fvHPIdp1XS@1uYf^xa`#F#G@0V252Qtzcl@zA4H`Y5SO*yhP?1 zDW);Toppn|@6Y`2*W11C&&~uoc~oXO6X%VMzNLL+`^K%M`SIiD&v90t|M&cxP*6R* zpHP$eDqW?m`>Ee!ie;OXbx&xxcWrGg=yTB8%X5Wpjfs>DhiO+p_=gW41cfCe_76@@ z63S+0X9W&+cj1SJhXsX&w+}8ZQfS4Cre=D3VdbBmp2$v5PhS*Q*4HyrBIxL-Q4|k8 zCYaIn;R0j9QRYd=;Y3`@7SI83+{`L;kTY>B5BYp!ND3HhxfhJn?IThm2=2njrm4k) zEf>^_le{{Oii59fXy~80ySvM5Y-*x^7pNeOlQu1IAr(Qn4H;7)bC8i_!7MH9QH3wv z_F(|10YkbHBNGPdt|VTVd#o~f`T0w#n+g6T-oBZSEH7h3`nEE$jqJR3u_XRaKM96; z90opqejGXSF4$Tc$rpZ@P8IUp>W zeUZYeUznSt5$2~DXO!F{qQu`}tfY{Trhj4mzt-KC#?CI@Bsy$$x|Cei;j-leW?U63 ztE+pDj#%U!931paO@rZNWZz}NKN|O58^b)RLacI*N%Bfuc4Cj}K)c>GWxxH2BiDbd zZQ`W;*AamN1|aiuhOsCtb^bni<`=`c?!><(foE-w*~z6{PP^W}j8pIP270uH7bp{N zJ@pI>+P-FHW(r8&yo>j`c?hJP5(v>ET7ZXulVYvDL8Q}*t$zmU$4Y>y+4%HM)!FD*1Uo7pKEZEB3^aN_}r@Q z)W!WGP?InnUgmEb-_Q|coQR%zR>AbZ%}$ZIDC1FR z#aReL?$DY-Eb1$qDU z1(SRyT>rrlsSMVO;o@BA<3G$@d|jGvpCf4IFq|(s71`QcKHHxV`ujFu28 z`o-x8Vd-a?PG~PWXkG*=ZO|T^c4B^>faH)4Gmz;NyRSqDQ}m`|Z}_YB4SUl=`#v0% zC#7g=qO2BsK+BU$JhDU1+B+<%YuSib=~K%6R&9W~YoS(EEgoQ8E?GV>@|3K$6ydf~ zRLb~gvuc(dr&2$(CoGM>Z%$_Iq0%Jb%zKIX=mj*WTZ&hW75u+#8Xoz(4Ffl&5wumE zubH-49#iLKt%E@21GGY1_~9a(R-ii9F)F& z+}=@e-GDDyr3O+ah}eJ))F&^dQc+38a~c{r;S@2Ch_oo-gQN8@rGDnBs*jh@A)DVN z$MB?D6gM~FDf}K|O%)-f0t-nrb==FIqcHI}i|V}Ki2N!*gznw!W*F+Mo_Ma-CmpbjVg5f&>AfI<40mxgj=R_!u7l8n*{REP$``btr*dCZ)5= zm9X*;*7gxknum&Xtao&z%5HFSNSI(hcJzTBe!r2n>?Z|r69@;Afh|uTK74VNHbg1v zrXhedr&>^AVM{9X3vI-f7RHW@_Pha3$m&^X6q^uz+RQ#r(pHBShjc-M>lXE)H559n zfV<)OBWBD=N_v$<;8V_`WY5F!F_^_bR><(%Vt2&B8pA-NrZz7Pfg(=Gr`tqnc_qRk zmdCytd)z;0`wBmfqg`frLj{XUE9nPzwKk$Ku2Sxqs`BM^o^WK_%VI`cqD^f%gYGS9 zm&)&G%FF?-^xqU{VXhkM!cQuOkR8^gbbJLYP#;rf8^SfO>f=`tf%(f35s$=pH|Hfk zU5ICV6Jsj#i}!~|j&sB6PAXCs?x-&E<(xMuE;~a9wizOHIZ7P0YbBGLsFPvpY$4c* z*OImgJmS0@^7Ay)obFL+Ulb#(o2bgpVfJ?6tpqrzDgwiYECguA<ka3g8 zzanKx)e-y8!s$8yThW64dXO5POI+-?O|;jKr0`L3p!?MXWvYl}dxg;ywDN(R*(yIi zPuSe)5xr<5Z77j371_D?;D;z8rNk@VBE{-XzsS9-$|R06UmlZ_Q`lp)07SDn@~TjO z$&du{xb6=vi^A<__@^OC7b6<~y=$NnW-a(8fmb$h+jL>(E%ho7BmmgJhvcxO$+v?kW7Ib})9~{pT(e<5#%#DQl_Er~~ z_4X*TrhXsYnM2>m`<%ju@^w#pyR{royzLq$`PXd9Y7=q`Hpla260ftkdYJA4a^GKz z%Z9fr(~EG*V0is_PAi~9Cd7Ahyo@TD_j8HA{<75Vy<&Nq1PGuGZYTHr_ff6$$*WGc(F=#x+_8OFAq zeQ!Q$#vh4lHJby3E9NmSLUNz01itb$V$ZmTWy}FY+o_|cC`6--WQ6{X370^lgL~hO zO@ksf$5Y9UTGZ9E!=C=yLwEM$rf)|;43}BCIjGF~d;vF2yy!F{8p<;V$NUNhfz-`= zbex@tZ;v$+gTZecZ;U|?J#=K^HQ%<^-DjIR?r-}_v6O?>(r#C#XP77v9$9K|2F~CJr zH&S)<5=~t*!2ftvFS}@XY=v9+%c{n@N%HP{>@ZWq)_q@*ERu)1bibi5e!~Or$N9R$F@5mkqhMKcJyXC42cVRiK+x)i9jXP;W54cc!!&sdA zpLVim*4Fp9WM0}-d7!H%9ahWDDNt7@X)5?}^TL1CKwC3IS35U( zGXN(hVv8qZQCIr%0b_~(j8;G#H|j5tX$g_$rziE>8e9&0!SCRE;WKDsiJu=O3ceQJ zGDg4HFXB-+Mg>&QJ{L+oYWowsuDJT?Iu2=sc_6V48g9}lwVA(>ib z%hriFDM7SXRvC;lgheUIRSc`*FkGvl6P@dc&?miiaZUM*h{=cd?cd-I(%aJ%c=anv zCT*FI-#I}-!{=0@;r_SF;8)BjF3ZXy3PrXmI+SLwhxJnnf+d~`;$<(OZt{Q^ zTD!S$C`g%pl44s)U_K0OH6-%c;JSzzm3Q7}dDdcSb#QM{kFeqc*8r-=-uPqTY_zm+ zbMx|qV4PfBf@uNdWMmx);>132G-|FFcut>u{m1Uq02P9^+&Hp%=$@Mx`Tb0^AWzy6 zeDAUoSCI|u(L{PO@Z{7K4(+k_D3{+OVv70($A2=CHn#`B)Wz=E=ntkz?57LmYH7E9 z0-SBji#!M52$6*R`W*L9Z9s|LY*_u4rwowD&Q@%gGUyrDl9i%ugc(Q? zxV%x{w?=Z2Vi8vp84}Cc{LAf92bxdT1zhI#_3h09@w22(!cR2w7D{fl<>*>EMK3>fy zAntzDrX3wk@~;VUIN4lGpR?_#>EB?{g|9IU$LPy{Kwvkl^2$ewAZSr{gyMuKH_z#X z11&4v4eSi{M<^jPXh{qHjG_SbldJ@hKX3n^DI9^K)*hj1)K-u`6V5CWN~c7|V$)FP zaWzgM&Hw=l3Z@Lieep!xA8Ycjaps#74$@>>oABJ?VmEAYDY7)>V1>gb;*mH!whRhic+i9M4!foA!5(iZ;ykP3aq5kAD0Qf*lF$h#Bda1BTZUZ z=@RU023-KFM-M>;ij-51{i&h>A?k}TBciDE6}$NM1|*l?ypZ!he$n7-M6qcRnO3Eg zQSJ~4s>lj`)^L+651sQ-V)BR5(1-)nJTR~|*3pbJ{h=Sl0e0l+)7>ucv$cv}tuHPd zv`D{dYUdM`CBNO})qr(pkdyIlOHPf#)?me}7_flE1c`>GYZ2%*6bQ7A{^NOm)YK?} zrtcoFs$$XB)pdtinV#-}wRLb{MJg=)Zb;x;Z)Z3oqSkB{(|I1Sm~q;oviQpAI*nIU zZoPHX9@6l;3+cLHHak0K0D2=hWW&fQAQ8U)3&RoD$@!+9ky;3)@gin+4)G#wvLnt8QDZgYQ4S9*qHL5~)xJ15M~ta@(_xT_ z4_`f8&~(D@PD(An0FpRO=z}E|bibLJsf+?P=TyPTFziR!hc2CXseoBLoOn`fO~J6; z1iF!t^-!gC*eYbfhASTCHl7d_0}1Z9II6cB_lqO%6ao^YTT<~6BUtG_b5!>O_}`oG zeds*lj-(Qir<|m%UIaT%U#L8%Nb8KXE_ii@f?rzspPw)xzdQ(&@kE*b007~R$nc%m zCL*z4>vf#XH8dM)G4e$bdJea2!c32>((lDle^sbm&=h0lXvq|~rw4t&rofIySo>>ifEx+6F<0zO z9Hva_^~u>$^0DbKt$Tnej_1b%4hB~U8!Icw*H;Lsn2(Q-EF>Y`UJhP4FDxcPunVmY1q&l1PY% zpm4k@^>Bd`U~~;B*=v} z!bno~92xyKrhApGhRh=%uX2(>udR*tt1r^G7ZIi-lJM3wv@r+FtR)gbpZ1<^YczfR zPvH77(A^x$c7LDQUP|2BsO117{Pv{N0w%Fh%ed4>5UEEK1=w>f@P^D=r5=0LHzHw; zbFGaYf!Wdx+ph&;+ka&CJSw@tO{)Kb9`WpSmI#uT4UhHOEA^wR!jl zZRFT$_@)yj7Y7oc7Q4DTCBL`CH71WG#6rHby}|LtUCYNI48Iz5B1W|;(i(qNN9*jb zh%nx-lX>SjdwcwhU-rcGk09T%G@`oI`-`^8GV%^Sjd(vG6R}nrHMeD*`mz!S{gFSM#$=?t=|1Rz- zc_fmUTL?&#$Q$}#Hp4CgjJ=dTWM#rg|3q;duL0Nv_IAyb_P!_ujYlsttDaDpj$ozl zF%0joI;EsUbaA{FbtWbhSJ&4#}KUoS7O(w3Gi|IN{I$H6kyX7w1^ zg3?pwP3yKhf4GW}rSI%{MmG;mbUEekc>AmCcUv zPG)9gem)tdZV7kZ|+xq!tvsAo|pM7dACD**ZGPC@G-{SdW*!tEcd6 zTmeO0Jr_1+eP1gS4>}p^+=J=g1;M;SucM=*S&&hhsjx7>SwV$uZwfTy*MTwPY9Wn* zIjaHPjSU>5(!f8@cLo0WzR`i}nf3k)F27s0a6|AK17{;G-A4+^$;%rLwNX?=x$jC> zS+1{4XUFsNZ~HDz#2mAqB1#H9 zo`@kw1gW&78gpi5hRlb7o}QYI@0R+!vAN2h=pE1XS8`TltY+>WPYBHOm1*sfJ$7v5KfK2 z^IfE4eB6O?g>BoN@ehYL3kV)Ny2Ta?+~h@!K&X4rG5kw|p`h^6AjP-z|4Y-j$f7$C z{o_0VzRAj=hVY1rl4)pYWN9_C9R)0Uup1hW-+6SQ3Cf~HY#^#$B1i`V!4#U7dcyzD zLplSs|I}b@^z@cUH5mODb5c`#f7RlvEXL_9#%;LAHGfkG(RycY-iN#CCJQ75M@2+* z06pW%9rWi$%N>@F3@-2UPi8Gk5u_a@Dr~J!SKlXL+h!BJEFk~C6h=v~-XlK*9Tj!E zR24D5uC8v);}`VE;I1&;Ny$8#`uS6+RwMrZ?{B*Q{Ed#jTRIsNgY4Y)<@6ZuS2cd; zet>^y$^jMpB|CFz+5HAW{`~UBm@Q?3CVr7$BRV?3+3s?6irDf=dw=!*?O$UHR@bz?Ahs~tW~`pL`1tkW z&O=i|gv<*#^Jf>@%lfV_zAMM#pmlq6VB5wM&#D*xsYY;z{&36eYp9vlb-Txvabt_x z!xB;J_VQ-f9TsNK+n44Sq0_AQV4|IAfvxE7ej|O4OR);u&=gwQ22QgtMyP((W)mYr9M+&Ui|ONV^&ro2g%t)6+p|}m3{o`kGSS}MR%uy{NVILde&(MV|8_tgb%9F~LZWidYJF|N0YY!Wc(NXvC-BxxJ z!WWf}qI|N>2GJqLH$&*NyRD5s+A(R~TyUxXY8bvlusQk94!Bp~Xi;*(FO@0~gghv# z`3ft!uDey?iel(sm(43#RZ-r1zy~iyfk8eR3Eu20$JbzyJhbfGa?xmItPvsKiVyWy zcZ#M-f)xp~#vk7TJ+cz}+0)jK9vKqL1jtLgTi(_i8$gJX2Yfu8FZY1p_teDk?M=OB zlt1*9zGt+wvMiiF1F8o(3$$B%J|fAtXs-?SnjpsgoM1xEK{c}ow-uM!pfI`w3)tL zWJEc_TD9Wf(HcEcEVaq$%+n|v?)!@wj-c>l@op4mc9FS6CrCa_9&6U$&dH}XGM&x6 zz*jC4a#fnSK{&-sOF<#R(VRyQcZyCiTD|okB{}IFGHmdK3c4lO@lr+n&=gn%z}b-+ z!G#ODY%HzELP`1J=WgbVAHEESDESpkS^%!Uk)DTeALbW3omYeOD1LzS7@qRhS2s5Y z|MCin;f@nIs78GQ2`@|$WozV+&e}Sk4D}6Rwq)dwGqUB4+In{pI?JiKs_77TpP57l zf`xSMm^hjYGrr8bk8INCB$!#bp~TOE4v2H4zWi~2hta9NSs=TQlfs*XU7239Foloi zcejUyb^(9>WH0M3!v$&m*p=xlctw4&l4*0FG?mYNa555z8+_hUBE!8fxg&h(6y+Ie z3htmsAh@&B6Zytp>-L*_;|q1DKrpFgpxD955omK7uemZwX_-e{CRj;9`pxXdspoKi z{~iNk#p>`*ZgXG-5;`fG`wI^)>>jW4f1miGR5bzLIq*MX{p55*y%=6iNi~YU zjn^V`bg{5>pcFKfi3sQG&}wrH<#E)yX&n>|(Sui#ORvVN6l?#P@W&}M)lynetl!O@MH}BkT^wZQUKcvHWR}tR z$GvBihQHT?4dob${-g7|y7pb)^fvs_4<+C~Gc=oX%>=cUvfuVF(S$Zj`$tQCy}HL{r(_M`Z9v9x3BuZ_c(7rBf&0`ZkzOmSbu&8TFf z3id1)pX6=y4izKYbg&s>76V@qYG)B~F-S8oe{P@1P#u$}@d?b2$d=F%9(gYm{vrpM zRwseTPU;jqo@9! z`s`fT*os$CdQjrS?j?Bq*W z^%-jRkIJpVPKj-#w;PnT^m^c)OA<%$o#pch)=`W?qC8nxe5LZ?3kg+F1B#sM-^j5PEMkOtemsjnfh&Wg*$u2sM!28zl?p$1V#trb|!QevaRfd zd!TGd_~3>QbYAR87cL{ogLZJ3T$qJBpMvOd&+-<6w=W-$tocCuy4P|Qql6Y+-za)} zNxSxCUed%E*TT|mTEi4T%4c^(NDTiELkm7A>H5@p=}51vF*v6uE1#^(jH+70%CVGb zdNg8;ACDeU@+B5e{B?fnVwQAhFXL=etXjTQ#&kUS$~7O zW5TEYq@Lpi3?b+zUK+g@OlQ%Vkk~J5;&0N3emc&`=%`Uci$##uF5=zuU|42PktIW0 z+WJ~b2c^J~Ti3|)a%KQeJJ=&=!uRZj9(H=cbKqctcg+dieCI4=|Gu!q7K~Bg3(MJz z5uRL#=R8u?r)`MXO+%~2r{X#^NZi2Y^@F6X07dwc%E2#9xK z;J*>IHKBLPWTZ~0XSFZs-_ z%qa-hx~`Curzte2Orq4tH|2F3_Gf2*O4>})uLiUZBZsiMX4?bg^{NZyeqOo<>oAQR&|&<}RK3h~;YsAG2+AEPo`Z4F+6|9K^y=>XbM1n=Y4} zp)|Fp8rm;+QuwtqPH*(kA2}r3_T@9_`*8RUj7vYh_p-APYIId|a`A^JS)&h?8<@T7 z5nK2Fsny{JeSYU5LVs*rzZXKmrtj-adS*jceaM~|fem0h@lyR;3`9sa^(d)VK}AJI zQ=938d~M6#I<7s~M^eKWHO;a#mE>4uCI)v!_qSe3X|D!!S%{|E9+ktiVEe=hDbv+T zaGkYv*cV=Vs9cA$S!rP9fmp5z*UWAU=9ghhi45dRZf*#qm=2I+oZlrXt*Zl*z$RTg zv4=Q$|2g&ZuQ0V52O0(*IMNV6dz!`8c;1}ZH~!#|NSd+wpF76*5GC!EPFC|EH7mDz%1KPkha9)OTq(Z zerz|>ky>G?5KTjxd8M+XOg*>v#O~G9Cs~kIFN{vL33x`MPj_)-i%NeO9)Y?h2-&}a zaEbWOH>PDccaG4`US%TNoc@UwID`WDFaGTCeyWwErWHdJ#r*SFcfGgShf1_Ij0H!6 zvLNBn*nD`NJSuJeIrR(zOeHZDpJ8o_og4ZON&kQrU&E)bfYpIDA13PrJ|SjGn1olQ zD=>o0RLs&fS7Pg}f}s^2#ogkmk1GTW9oXo~UOk&bunX`h`?^X z4mwMa{ZxkRl7viSa}Y6$MRp`%Y>yK#-_r#AbTS`ph&1%z`TR6n?2;;%G|ZgK-EU@Y zkKzR4NJx?JP!%?p!K@IP!jM(z9Era}ni@kapR_9;wpDG2I&lvalpV74y9d~uh}A8z z!oP0?DMMdz-uL!mF|dpxVh5{}KVI4ajBf|8vm}ju1-ckfL z2Q&P}U03b)au1IvLWvj2MGU)4;}0}|#aIeOIUF1<$AFx0?_>{-pFN5CV*C)>rH`~I z$L;4Hg;$idm+%sM+o+TXst?@xWqwF;;l*|oiEBhWdU{B-96~UnZD*THgEN=JNd#?X z6)$8fs?-V$JGRo+PY=-Ep&p`31mBCgtFWRLxVee+x?1%(8>`*)dJA*8fNY{XoFY%# ziR4$|wV70EEXPM4QSfOY4jZ}3jRk!A z7KWtX0;_1@UZGNw z#7J|_a%5F`Rs81HncaYcUN%uO6Yb_`7i{HkO+eE$IM&EvAA4&gl{ju%G(&Z4XL$EK z>@*2tjd&t-XL88=xN$~=p|rsy+-WC5txh0-u^U`@XiHt{jJjX(ezMp|HY!h;jjSvc z7Z;gQo-#YzfQrdGfz5;RXDnf`n#+M0zqG0yiMBNbXnqawmr^W@l({}9mBI+O%*^H_ zE@BS6L`p)%&<#UTuBuQ?Hn>H6JATGXqw=l92{iR*^f0D07$qc)P*Y1YjQsqG?_VWCsBF3Uyvy<;vxv!Ih#jbba-hquI@bW5YnanOu(2Zwu2;|rG6G9 zTBQ|ckMb~xUHO8ps}=a$KdQ&*Bb<1SFEV%Lu#<6|;C$oODJ6>kQF_XfkKnObWTFe6 z2Rg=95gsC(ioi`ZxkU*d;*~w@*Hw8zdQQqoa8#Ns(ZWcmS$CVQ%JZw~IcRl+c+^!D z`WVXnvw-cwXb6@#r%RnHW>CDTTX+&9DoIh{QX}e%KDH6N-9##vEA_P6FGrAl3Mre9 zj*pivnot4SQsG#?yabe3G=BIJH2{5~sW{jJ)<4a=5a$u8^d41k8IafiLOxgiyJv0= z@9vB^TSR=AI2e^#^$RDDyUcA5d|MvrG*@$2;&;T~c{zQ5`AGT=2i7(Ow@>widGIhN z%sa$Moxf~Z*?Ntz?(f`K5f(&htX)^uOPx3+6jxRv93vs=kvV}B=c%9-Xd~b~4H82< z&ncYj25YE@AeFdRMee9VF3{z3%!k9?(I03xgsGv7CNEm{oMIvo^>NOQl#?{$>!iR- zA*LD^NtI80x&GyxVry|@<*pa^!`S^iWx^90b1k9$-zeZ)4SMD#0GK7q2d6*eLNc+A zJ}=fy>!OO-mvsgUmwPGvd!q48{h72lqoE#q7plK~ju+j&qfpyY>}ISk!5uj{Bqn|b_MX_;T4xzqO+d!vN<*&P~9Go=78K`Wh3VJl~}RxyuHfk<|w7= zZkJm1WTN8vG99ARHhi7ACbzgK(ZcaB>aS$SPf(*Av;0il1zbnC zaezN-(}Kd0NsoSw80YBnu8q^7W?P(p?6dLD;uaJtoFYn1?5Gwm{_X@2d)V2 zKX^D*0YeuG6=sRIyD~_q zaj~poCSA}@QjsJpZ{gt7A(RK!5Kl1osZ~44;|dwV7P^kq*!7H@urTCu3+h9yo74Mw zBh&g2Nz|T}vJd4n6iFBE9(W17r*$E7WTmfwJ&0cm5zlyXCDaz6r=u8eAipj2a#TG2#ANj-ZAicHB!z0K|`VM%syj{ z_#OtEyD$Zodt6NWlu&+VcT(r1xNWH~jq@n-_Z^F^sp0TO4uc*_Z4aNl3*$j<6se4=l%Al`C^m}>gfx;F`#<9DNV zpVDf6@7GKw)wTr3T)T5$4T!9IfxY|`4)y35p#`btt!rf?f62PeBC;}yRMf~(#`_0R zMz@h|$ZW~L)*W9JASc>joh=mNFX14ZZItvZ!J^&oxIG=O#*hPr>FV_GKr%9vib5g% zj#lrK(*_aoiY`G>$nMl#Zrqrd5Z*}aDYK}k_}0dh2JWR>1IFatO!ksZfYwB9ce3U7 zWz65Ae6*|jO`%(k9}n~6xc14}$`Mce`hiH%fQ_WsDO!yRls)D&;`GZrQLdonjg`Q- zf7ugIL0tOcP3Fr0--jdgCx4_ckFS>Ur4bxzC^GQ%W&s@w;qGL$VmUSyf)=d)-zg^* z!~@*;e|z*ritW!)8kx?Dy#kxk{}yRPOz1qDTzxENUIC3B{>iB=Ivno09oE6>UjFb` zF|JLfBOmRlAalH#xImNK@fhh%bA+SyRa7+4_)O`ezgus$soTRc-oaL^`jw-#;JmL_ zP~RWHlhnz4_qL(OF!VuYSmIebd)#*MVlU&4FLa|<&zd#xr#6q{D{2AU1)^p@8kduA z5@u1-s7)(HWXQ6V5~qDGkyTwg1%pSg8pMGIl&nf$v)-Ap&Ag3wYJljiA)Y66t1Q%4 z0TB|z)3^<%b#eIRygoOX7}$K30^1KH&eAf6_x-eTu0|ss;SV`D-)V3MFyCz)iYOb$ zHh(g@RaRK@LfzVElZak=?Mb)n9UB)o;|Yo#IPa92V_4wt-GXrp-f#CcTh)5iP%8!I zr}f{7*Mpe5n4`P11%)~{?tSr5F!=@lH6O-wqwT^ZiO7V#3BXZEJ-v|xf;wDWEIgeG z$i)7Rvd%vH(g_mB<->1n0crG~nKxu#Mhm-r!I6?Kn;rL*nc414bL1q!%BHWmFQblV z>GStuGYLXr6AZ2$7g()9Q2F$Ge}sI;^QA|16vrFmX~AG+3MlGFO`KGHKIP*3m4nk$ zM{}o4qQITTJk}WDyBk|_zSi#}OsDU)8d~LQw1s_M$b;M1^%P^XyjubK=-nNG&XP&t zH)5Hbjp#yMK-B*0&8S?0S2neQ@jgw(k3yc1O+C~8$Dx)iPyD)<$k}yk_p6SJx=Bmvo9nlIPg~;KMdr~)g~zyf0MCHb*Ie9u=qQ0Ie0SrA-eR1Hs2A8mY)vD zUdC$Wg7sUhb4~9lensx(cYADPt1laSjYVPs%`N$GL=Qvi>C)P^Cc#aRQw;N3?6nx$eemhscn%W`gkXh015o%Tm_=~c17S^DGE&SQGhrGy0mA0^m zb1INf-iA?dn}C%Jf*Hy z)&_+@Z!-?5{Y}TX8e^~*CFkx`ip#1IBU=?~wY@;IdOVuxtX$oJFf+<$to(y=A@t(x ztvovD4y#sdsTF_ja^iv*+4??r6#b;4<%OAf2p9DCjKZDay&hzi<%s_6L*FL8W7Tsc zNaNd4y^T*2|Iy6eHtCZqtY%lnh>X?#o*OH@+J_3sDP(Qt0-n5u%hSY*%gCoWl8+OWku5ABbK}7y zXl1?gA1r|Omxq~lBT%hdS)c9bNsSajZeb6r&DyeFOw6lkaYgsZ9MdPk zv#S}&9J#OGC>IyfXO+694szA%TTeF8_&;$}zi|jvTtg0SJH*G`J=mCb=)Z05`&iDd z_Gy|FrkGrQKj%>3fNxP%9L}-y@7t97>VhmRJO(7+MjSryk^=mlxD559+noz9!03I+ z#;k3_O6HnPgHgedr`sneaq`(q3+~95OKG6|C`{<;_UQKm-JLAEu&99+NzqxkCMh}T zgJ-l#OGBNz^y8n$Xm$p?4o#}O+Nq&jbv2Gj1YbQ7#TwZ_K=aE{MqvSkR-tkA>6&19 z_p(Qe?az9yA+qE}tvf5VN)=^FS&1*n$H88gZbYI^6jv+zt?RJ;o};zbEDVP!*Bo~w z(Va;+2k>GguI|#7(3F*)Bt5I0*iLC-f+Mnfk$jM^32a(v*cP$I6nSx9`9rHNOkdpy zfcP$MOIvw3M8zr+iKe8IQY-w|h$3=GZn;Ps!RYAg51GDTa=-47bYY(o0j$TkqiH@K zQ2z*<=8F+_#(Ma}8M-aY_nsbc1gFGQ=&pQsn1LC45+(!oo*5u85RPs!NsG~?jDa7` zbDd|25%h9o1^2+^_51c|bIUaN1;69(^4J_MCOG;>saaJ8R-l-%OxB%wmYQ6ce?@bA z^9>AlBg?cW>JaoF%D>fmv(g$YP#zeaUA2r;h`@PB?czB2g}(4|TYWJfPV4afhKs4V zjEt8!cf3KZZ%0G`2Ze5ur7|-C;b-7Ghu3k`FV2KWEcF?BnJg}?J`aEQFAp+tDGd>C z8)81*vS+-hc_R&CJdQXiXc1DLqv=mb?hQUe%jS=vR2nf@OZpn zVfXNh)uLBCin>(J7LSn3I^ntbd2C&g@TM8W--ZXS9q`}2_AKflN<5z8W?(v{gyow# z)S^;Q91`tMmGRP%!X01RDtweOcV*x1KzLvi?c?kU3M+h;JUFuLV{XPFeHs=NTIpA? z5fc5$zI8wp))A&hr0J*B0X~*8gG|(s;S=1n35on^I5MwU7^`N&YO9+0!8tynOGZ^ zzla%;DN}FEhaJs;jP{U|y#A%`TBAE*h<)W(O_%x#tEge%>qQY}lpsic{l}gbyacj~ zAkQod3%L=-i~0_cmv|w${G+vI@{bl!Few^Jad=Ej(`}8NXe|V8n2xGX`=EIg%_U@j zCE?F%n~J%NkZG9(1>mTrkBQ z9v@3f*78lR3{AQXYEGpIQV-T3SKLKj)z0pvUtp_=U``%c!4I_A{8Q;Px9+by4xF{@$*^ zB2P4}8%y)QcI?9)1f@WHL3xJWO=Scf4Sc;^a=EWOq*H!iWL2pk9o{f^QX!;j{(iz` zr#ZEX_5-J%a@iHMH;UcL9XO*J;=@*fIEk`>*@7}=R{H>?Sqw0r*;S+L!wA1gnsI!i zKxkANUeIl%@R%I`sL&E9_g3r~y8oAn+^}C-Uf2e=Ntu>QI>dJ*#MvQXNDqFD;q#24 zQP|iJb%NIyYOyXH`kcZw!9|{W8P9XUqxe~K=mFgG4d|1$TDAL7pk*6|;_gk2I{5vV zWz5M0VE6MLO^;&qqY6gdt|RH@3%R(@NzB!dT!xj56VvOFhz&C?daCo(#kB^J zJiGtc9lRV}HU_Ciu+9~Z@1*8)eIzPQ^Y#UU!~WzjzzZ$+8W|!k?&WjU%2Dh-Ff)*p znpaju4pfmuh+JVGP$D=CMyCkWM%15xD*twW#474v-b5mqn#ayCiBR`u9g+CbZ;3B( zlPOY}EA8V{?M!unqsp9I=7Q!N?WM#4r9 zA26?G_?){x9^pXx%-<;a7{-ZHx4OoKL}XomZb>z;sVbpdF6y)w>wum-;@sIrRCSZk znQ1qMi6d)EwA(Kp0<81&P>1S}y&c18cQtAKT-MztY0fUu$b2x?Qf?KbJcDEcosX*G zEPjUls&SO_e3HLkPZd9sPv7Te*tB0L{_#%=O?57HBSEy=X)ySld2NT8q|Fm)Ow^L- zD5})PH%s&cP8*(hXW^aPwUUv#J;SKXG2A{Z5aGN?kgqIbA%k;M&-jN$cx)EYP6E2C zqxq?f2Yw1=V8bW`stqw!vxR&s0V>}#epg$YS;|FYr6v7Kst=FXSS&n=EBtvzkG|sN z#tadtGu3|sG6iUH z1YWI>xXck8k+6a$>Q{}Sg<-cAw3YBxfx-j5Ks^^XQUq&0MOgz|gvi3Z6z9uWGB8^Q z(*+KJ$&Z10;r{@eKxDsJ5tcsLh;h(`qJIXeBdj4M^&D1a%DDbO8^QkGc=pL{=vi69 z*|P-eFDZIB8iVcQYj|QDg37`$sOx$llkNA^GC+Dp5>$0`VdG>5xfeEQo!{UV8y%2y zxIA1AFI#Kqt31RDeP{60oEElf0}@kG-e_Bx7?RdPjb&m?xw&au!Fgqlk>R6(`_HUVT9FM?T{Ad1I>FRE5`h|uc&wxf z9ZeVHHcwN;e?gIS290@Zn37W$;73mGr?;TvU;_su9u!_E!YQs1yA%lvroY+B=mV7c z89+fV6l0S$(0^_W4;KxX*he5c*beg6PVls+{1I)W{c~_NG(~XUAQxS(w8!Gk$IlTG z;|i&3FAyB*0eK}mG>*=qJ}Z#)SqBduD#F~{6!Hr87~AZF$pa1K4X;w}edM|-;ETHk zD5)wSN8J?R$>fy1xC2FFvKbF0t{U>ujtp*AnQ2U}m)&9%eSMva*6_(g4+WiUe~rXlfb5+$R+c zc@Z$6h{Bu(*-dF(IJkKrzGM(RX*T%PPp-p&$~7X-IV`sgJ7+I(I9CB<<0#CobihW> z9+l%qz-9xCjJ#1%k_sDDD$7b2U*1%Ny}K(M0@AJzw+lpji z4Uf23GmZzgf>!?ABGSA>0@YF zTfme6%FELlFEj!$C7RVbpMd?nuPAa>CP%^omgYS0tgYb`$)@}Ek?7$9o{b%NK4n;& zFM*+1B09?gU}!^z-q8+m?W=gjPGXuVfx412`ges>S*PT%SlT1EeGJ7EvHto)X_ycX zM%1TiC4~qj1F2(fPGBw#Lpvu}x};-mvlCh$e2Cjj#w2$KI|5BII?)wNRNyi^&7F|h zG)=mBMg}Pas>Uf?RsF@WurjrPmJvA~d}`8s8AWzHm_ELXkM1Z?yUd|)?2O#13WV62 zLPOsSF`3QSplI#Y{vcdUtdY{Z!AZ^hM*?GPeM4 zmVncO93d+kHzeg(BGJtf8U_|fjE{wly%!2Q7Rgv0VV^H}C%boahU2MvvI9o2clLyD zT0DWQ1B%(9*cUzE>6mi+o_$i-*jYs&=}1)ZFljV9$})v)QXH07n+VVYFtOYX7Ylb} z7v{i=qHaTL6WsagF@n=-5Fcs=o|7xA!?Un)aE4c>8^{iFfNfYSmAj7wFL&6R8RE;I ze+G3+bC?>Nz|W5z5Bde}tLt;%>+EO)4Q-yVPv+oc?1aLu1-yK9f<6K>3-@v?jHW|X zD-vudOjU(K!z2k?7bheeV7kN+YG(HEu{VMN&j-HFR!HieMzx7@gN?p5c=j$xD(yv6 zek82SZD42-BmvI9FL0h>t~Cyds{U9!2NoM#@q_=*uV57#4M!R{DYb)$^)`jEk1s6L zEs@*Wj|?Xb*aVeed7%q29*O9nNON^|9!sn25OF^Djx)v2nFg*YG>w8WzP%6r{t>Ck zG<>9#;E~>qm97Nblrcxs{0?5eJjFm+AoR2>Q8zw;qR2pmc=^IqT@!f&D;TUOL}H*1 z)b!oaIobhN12e=@L>1~m-mxixw@o@`#tWdQi2(Kk6jUbYXsta%jicwl;a z8op+_P_?jvriLdvC%WOQMILR*5aznd5bB$YDfZ5TfHTIC24X-tx=I6}uj`0@>Y%Fl z6omP*!xoY-Gg%0AHGhoF)RR(Mf@fd|eR48JhsvREVhmRwZ&)#Q=Wuz{+WIHVT$W1oPNKU)fwCp^@&7Q$G|7Nvt*IGQVkfr%5m zDUvg@&cNnc3$&FrX>giDQ!gAdY;`Ts$>|BkDjo6L-#kHS#~`e({Q}BC1?a4ZgO-#N zCbwtcXQ~BF$6!QwMc zAtbvUea$%tbq#@sxhCv`3$eV|kIcYGINDi&7t}ynw~SCb8<<;|Lro_Xo$V=5)dunk3kjWQYYc2vaKL&+@$8SeV9^vcB2$`H~55|A7d z0{_rVr1~3Eglmmq_R5*x4?A6R#Mds6O>QNl?tsuhdl*q4wYJs5*whHF0Upp$@kHOs z7WfD39UkSmu88p32~1W7Lt4cMmO6&q7hi^(5}<6xgTIpa{)lSfgzGU?RL80<7v;hfut!Aej3%YXkA89j5{`{!3DYe@68 zfki+)m9&H)TU)qz`V&y=qI7H>Jq4LaOvr+Vu_A)<`>@bQ;2WNeC_i#aT$0dT6OWs> z>rZ@ zW`v%NZdiSxf~=uMbfmgMM%@^eR`%donvh+LrhtMO`V(wUSHkp>8H)RdkRNP~Ct4=Z zH*!RA?s zLQc;P9Sb{{ZjOWMLm5cDutIrTGh)KiF}%Kr5`P=$DBB@CEuFmGctj-EV`;7#!DP%A zcgGNKp$TajY3R8n(ZHKQq^&Y!Wgg+~19iky6v16y6)tg2SYED%<-!II53JC(y@=`v;z?Qt8dec#YO6w6OeGc<+7LqWnp+w`dUOH;y-e}-hc_Yn zL=Mg=jhG&;MnrraMw-%~CP!_Rx(_+)5R~SHK;?lM8dew4nBa^@RIZ|-AG#LzC|YOl z!p7jQrUh$zb_hZSx~6u(Uv5WecmamGs$rug3t8!h6k*vSzd9X;_tX$uI|@E|`D`)7 z@<0*%+`KTk&PO2)u*kZ3obF8_j3;dWJr%@P_nsmWHVG z4(?rRSB@{9O3C1q{}O#MKF`1a;co~tO}&XrJ$^R z5oae$WMK6mE&T{aZt0j?T|$bh7Gz|laqo^If{Tk0sHq8_e+5>yTi{6gB>nIiLW+iQ zurmlhy%&&r@BmMBz0f(ihC|k`C);RFae)-+)7=+Zh{^BA%1{>6?>)jpWqZ`m?2;Tt z5oVwS8IrMmWHlBiyWpt#0J3uGNURy<_GF&zPa-8E4wbztINKXSWJo$jW=E0krj3WB zOAg76*w|=+#a#yI?c@;AxIH>VPmVvHP=8B5ybpc1V0b#};MPZ^GqM^;Y8paokr!@! za04<=Wnmgxg58r-(*FeRoZN>`jZi$Wj)|&h$UkOny$5Ap01}gvkw^W1bb3hkfKTIY z6{R8Oxc^WZ27yJGpKnEIP&VfG4l&*2emOS(0FW#kmN*Ul#kNAW#p3) zi;ay(Y(^70ivl5iUk1uH!5APNVDE{ShHDWO7K@npbTVvB2)23-X*os2RJWkm-xkU* z{4stq0zYL3?$D0IBf%oF{%8xx8+c)n0!==FgvGN5kb0zt?EV!T&vn3F;}K+Jq# zjN0A>4*XU}st`bOSX}HtSa1%e7y6M9nMsDU4S`mQoIc-vpn>c$0*WW;kixrY4s1eA77VYDt13Z&OE3Rb8d-^KQPC9Futq#wv5s$v5C&2G4B zK7*9hLp(R|M;|$lY@yD|cnNgxDj}|J2!mDR_>fI}W)X^!4H~!Pw6aBH2Ya)mqsGYZ z-y_E+3D&VSI6FT?eVhXx$&d}ZCk1o=7$m1a zObJfU&$x})+(vD-shr!>#HLyWE5`OIVqlxKPiSz9KDNt!=1JIzf>oM=kMXkaIbJUL zr~7P^I4kqyl)W1e9A(Ga!Rlp;0@!AJ_MGj>WFIr;>L(Hige{q8t0O5t@pME6k*k9S zDE9$ts*8P_Q^1=b4f|A;==zM>bxeG5oAv2F_mN?a7iQep=c3pONVW%6up*9a>}RX~ z7*DJ$0S|(@IC)VN4T6Q-5EnQ`G;^LZTkXh}?lYd)enHl6tgYN}c&zQhav9JG+A7*> z$W|A#6`PC~)-LubFp`SeNG(_~DRf|Y`Ax1Y~F zV~ai5id&YJwfXWx-n%5j$e@^af-=IJ@L~S^s@;NzCoy_s$9X+poE_po^5OK0YZn_#tZzvU)K*r%NWa*p($Ftg2-nyyiaR zMt^htbRdu^*Vil`mBadmiw3A}wz`x#jjSGSVdpD~?s#^HDW70Nm5cZ*;yq#MQwjF? zoa+~IHpTQ`Fdkoz9d=j)(-Za%mGvJd(>>yixhEQMl2McJbYQgl<7RSSQRRBeAD#&hF zB$?3or2Z0&33hk|TP-f^FXEf^m*7LA)_r5C$@?HX}7=7dZ}b}sEE&V8f1d6vk3Eup1*V8u>KOBoFfD(L0zxY{ONk%s)rGm|IIw#EQ2{f z?4%uLWat?ga{lfH2HWe=I<`RfzWG%T0bf`1BH~vdJK>&7Vfr`naM!}Wh4lJ4$%1$i zE%84k$4C4?1THNZP!?&64j6copLg>oPT%C|&F73nX%6@SXV zqNZa2o217Fm-*go)1R^jSCb$;+nTaDJA|6%b}Via*ndlVIC{Gtc6|jeudjt9mgf8M zDop=&nOE@ot>u1~_Wd2{y#r3}6c+JLVFr%?p*qnPUU7w3+GPVl?D_W~wzrIVe9T+p zPP=&*P<;!r6E{|;x=~!#fpse9yC^OLdloeuu}F&Z>_|Cj;o%Dh{<yONl9zB`ASvKsVHtrCA!{#EJz+C%_#urYzM;yO&N(Lkblx&CL79z`)6u!^Ps z*7g&z6NqMqT2WfnhaHL_*oUr}*Z%g2K<^}ur%94UH4WZsG;~hkfa68*oaw{HTpx-{ zTCqZ9|2e1gFa!R5^jgqv8ppymFdbs2O>u`^ke&*nS{89!T_(#nGt_~~ifWWsHezCN zlatd`Y5$(YwTqlx7HM%a8*e@T%ZUsoMbd2cggfH#$}|%C_oDX-I2ov9W_Ms zEjkfQqp{V!>|EAYuTC-2RDjsbE*!t2sEs0vt?5RDMb}|#u>$G}_UPRdR(!mO;*1>B z_bm!GThou*^iD?X{CEvz8EGhLoWco3CZbK|Y;!)F8f2Ty8Jiar0kFL6{8M(6+3Q0A z&e2~S07dNxYzXggzgOg(NJ1t`>PK;S!PZC$eoQy^g=g&w ze(!ESn^F{|9Vrimx={i)U%kYu!&zj+rlM(Rg~r3t<-rIdy{csHN5ozd|WeexdIk~gx`BTv# zp%%1c2SQKV1e$sdsOVo2jsYs~QYT4PboX4ChtITr- z)sNYVw6jYq+Nui>-?zj5OqN?aQw2$L7uw z>Prid5EX)=rdH&~1S7YpAJbDKD9cJffPWyWy5=#~8V3WbG>i;alZ=B96cT~f{#H22 z-^5L|Fsu=fO|%wq<))Q(Vw;>3KK}%}Q)MvFbV5|DAIE3!(h*jNY7rAcWe|@QY$f5r z1_4k6Lchtm8ZsaA#BfGE`ZA}6`v#R^J_BWIlA}-h; z(dk_{*lvXt8S}*a3bYL_fxkP24ALF{kZ267pJBPL3=x;@ZxOaXl-hrc$<|_F`#Z2t zylqW(AR#OeRyr@BY@GpiM*iV!C7yqN4JsZb85s%>o*Evi24nSj8x5IJ)b=QJO{`*N zd5ron88I}tYntki93FzY@hz+l*ImlLx_1mCy`89S=s;&jCkm4N5fBtj{lE-~z=1ot zAh{Q&!r#vySq(!tB?n-lr3is!M6xS~$w6918|hw7f#Z?sOWVywAOhngWCdhajhU zh|l z4;qhOz&wkKl=oCpD085*?l~Dt_yW#Sy+U3V5TPxJaaQ>D?fsgt`!vS zd<7M|aD@4}!80-+Nv_ZET+1Gcj}_sWmk!?JTaZ;VhNFcdo*PDBa*Iu`Qq-|BhGc(h zG7uVg^h_6Fk^Xq}#b?klcEoe3XYe7wZ;H^ulNTm1eD)kh)Iq*Bwg|``p(tSl4tlzH zeCtzu_Rs=t^V{4zq0UrG0?x-sE>4Bc!`o0Zv4V}>bC@~>!pY8+KqeMu52T=|DGNoN zSS+$*!ZvzfF7*ZO8pM*3ECo;LDRj*ZASZ81O5lNqU&v52BZnK;y{Git#$E8ork!La9BCyU~IS;E*2Ir(vZe8O$%r~`U-b-!Z9>h1qW3*Xqy>A_OS+H zt0yU%dI|na85FKxhlV*1R$4O9@u9(?&a8J zQPROE>|cC^+fQ_0srnqxJW|l#oDVa3IT)JjK=y?N@~RsVYN7xILsQDD0iUoSDBijO zRa0y5bY!97kc$m=rr-H8qRka?{k8@?T^ylD<+1iZl{Z01D7F9dhcLHwz*A{u_~xa; z$Jzl_Ry?>x79u-D3u+p6;2A!Lu|+z%x=P_@MeWy=#&c2owZkwxR1HVfr_eGp!jq>u zNT_H)ob3}R=sG~>(HFRBnTA7Z);>8B&p-PD%HCxdZU}+8+%s6}tKq($3%Zy2+?4R) z?k1{JTwrNRJU)2}=fG&V*gC;R1e`d>$?+!gJr(do!5r2q_wb=cFdB+Ipe&~hOKoMy zI|Lvxh=QeSI5!kzn?Fx7nwd7FI9jn}}_#u8>aPw+z55x(BOu;cL{ck3p!Ep1_; zE(2ZnQtX_tg*>Mitqp_@m22x}2Mq;Nq-UkWR$UspCYF#OAb0d3{b&n#`&jm5XeW*?Lfpb_L1{#xK;gX5b zjvSaMC`0M#E!?Al?BpJRverQq#QMY9${O0nf#9}&H^x9u&kDx+X2|P529DaHukM2O z`7Lh6;Qrbm;vCJPs-cL_KYauXdmi*GBEV)XM{@k2@=O~V#!hHw+pShAps#7lZ9b1I znjqjDg}0R>oSa?Y5?0S`Hf9mr`cOVh$Ox~k)IpDoSnC?$!a^m?buD0N>xP)LTzIO> zLCM@6N$D+EA(`WJ2?@U5NU0h{Ypf}L{*zCkq@@O#hmT=wZUQaKOsuXp!a&Uz)9Zck zG_!@JnJHZ3`iQY(gd6BXUB?7wo>`a}ECWwf4QdJx@WlfiID7gaseBl{8MgT4zkCEm zEp^B|xDSW8dhES?g?+YXRKXHGJ0za*JZKvVK*mW+gB+Dd`28It@luPK=f+9^HQio|Pd!{?P}J(@@8AS!w8- z7(!9q5j|VfBZ*R;I4N!N3g3wNu<`#iPAN zR7HD2RYet2H^@0MwS%LhD{O_p$#^}SuY``WHF|dGVzC-lCblp&GDCdrI^CFrt)Ut9 zp&6XQ8ZgIWXyp{HJSQy*D$|(W^Qv;Nj zhpgsdd4-1|%9GHxqz2RZ3jNkn1b3vaxU^;0`4oE7=?ht8a3V5!o zhrqBBOm6N_r2X&ozFR`?9ldwJ>EMt73v(mb1+xvq>xlDkhJ}R{^sJLHztRc|WerqL z9bvp85NgIe@GRU32s;o>>0%4p2oOEt5mkq_(g>KldBgURHc~s*u-TmoWldw4SU4i9 zrV}}l-mr0WhbaMN=js_cvfL?>vLgfKj`BeQ%f&Kiskx$ak-fz{L}R2Afi^Rq>j<_r zhn|@wbaf-?>I@apWRx8P;A*0SjIJ%Lcf>={)E4e!0E5$q$U+UkLe~gJR#vd`DFvVM zu+7FxT`5r4i^A+&6$~`p(X)DpmA)*P=vl(T$^k*4iO9*VM^&a5 zZ4p|~kB($}GEhEPK0iZmaWUcoouFltfjI&=9o;ZY&DK-&ZVhXS8XVclC9kI7Kv9&X zJsED_0JuEYLU6$ZPUcFXrfx(aZiA4VUi9a>K|#qGb7$x1E6hV-^&s|7FR(ja04)t~ z3~e1_zBL6#cAjuo)`nL?FV5HNp{8n%sH8L$R&*fKOBXNH-7ra5hl3vQ$Z1LK*u?2f z0aVD@3AECMmU$F5E{@TWUyRfc7bre4K-bJ2jkW7N$Z z;c#^nHH8VVe4vit{4t!&mqSBC)czg}R+Z?@{=V*?zf}Clh z;NABA033~Mk>4?ff*@1agjVBpuOB*E2FPq(U~ly>PkN_$%?txa$Ec5Ug(~T+tqnPX zq|>fZO$3~;aJ=3DD+1QM!F?>$he2N34sN!3@J{W<=~^>%^^IU_XAjr#TJ+UL!q7e! zQv=yB70TZut_K&JP0-aegqbj!)w2l0SLg;AB836z?`ik$w?P>;Z@{1oT9(9 z01+NEwk*T2bGVC8XH%GvlWJlajpdVL43TCzk=q9{+wSkNff4I83f#;fzHMSu>)e5)1e1IEI zjZxIyfKZnJRCe|tCD;$CWt}Kb3qep)6FRHn;Tl|oiU>R0eIN~~>mT83Lr+Ay8{^p> z1GokGAv&iOO(|x$eq9Q;lz6D_uY-@R4=RT?akNwmE3-iEC@Ho`WxcnGBBgtH^5g-2 z_mMPQLwq6k;YYYF{RsC}ZBW0ogV_o%NPTe!x9+JRx^oH(Rmpg9=LTeDZsRLCOC-e8 z^ADaPseKwJ=NH&ps)Fi=Qm}RR5_t71e5?%>!O6xAt{#C%OC~4c`E}fpm4R(wE|zys zaPe{nr9mdR`MD`tmirLTQ^9>189Y^TL~2$XY&~)@H(dcMt2j*0x5CfS3(hsm zA<)qSu5RuK&1yw&g(seTC4~pnC(hCJs88^N^g~hmdDMOzuKo23gGh7Hz+KjU>bI)l zY1Bp=;Kq$d`24G{pyQfP5jeH$Y#Fhpiqr;Q3{I87>gg@q{rUk6!wRr^!1g2_;$U?Q zLAr8y_*4eh{_q9VoqgfwA>W69KE8kbaF_}iX$F;aSu0dehwLY2P5k_i~ z;p7trHyssdl8)PZ`Xak|i5!m_SU#h+-h2Slh&(h@rNf<^P&?Nsw2rnT)>@g-K87YQ921*Ms0d9)Rp&IfviSRKsgRI_zKz~1;AFJ1K@r== z2DY|$!M2@jZfs(6i)eEjdj|*H)|Bb7VT{hKa_>ksxwPBZ+9alT_pw81Hz@5k`*(va z&tJ#X*a(KlCa|=&iS3PL%#6=qd2OBY?NJ@um>eC(#QX-1k0_p8r}Eee#2w;;{uX>^ zkpywDhn2-i650qRXBH{%CYI)>FhWA)Hdr&69PVR&d;}wti`;&{L;g1Ar$;d~Jcjw@ zb?ohIV1AMSl^q92GTWoJtjx?{W{w2U_!p~}5!-OQy*7u@kx?vfv$pSn?e*H(T*37C zG&T+nvA3~AJPc!YWs~}14;$;7RL&MBM^?wd&NAu>QxKCyLHr zyQAyaq`p2p+`}yO^)T_aMbYc=fq47Z-)#SusQv5QhI;f*vuisvHukVQ zyMUGTZ~GRcU~3k$Gwe9W%lmBM728(!Mp_9;NI>r$aI$@jtW0iC88bX=a8UVdN{7|K z1`Mm0?K5Nh=-8%hwtA5ppk&0>*d9YFgFESjotQys*hxYhuT&N@WXveBLCE$Za-SR$ zmM0jbtUSgG<$GgbvT`ULOH0Oqo!G%n-8efx=T7F>Bw$!x-^2NZ;G`oiALENl&*Vh+ zs7_WlpUPn;qHtxhYcdRsA3+}0CU$}eJE4W0C?eopd>`E&wc(KRvGnY;6H(hZprn7f zc2Ihe;btJkoeIQGCt{}#5ijidW!o8X_r%KO6F)7g1Y8aul>nn2+l_(g)&4aAJ&LZ!SA+g*zqavdq^! za;LFS``PONwmO&N;al3z@kaOG;EkS(_l2Mh0$mif`|UlCuiMU^F+K$(ewvO*S2$e| z@-8Tk@ha#mQJ-<;Gx-RwMLH&EgQ#qwyjXhnH`4_wk2#y{1RR!LBzFOSBAE!}&K=gk z=?|4h&zT$qV@5D8`A4U?VBdx1cwuP-^{}>x_v>q&WHNlSzgeC?xgVIyW#eRXWgas# zvsl?;`(_35V&!tq^jor)kc1e$cfh$vk-+I%7i{IOLpN~%FAs(h=;94;Z!h@AH-Z0> z?JE?frFt115m=4n1>*7TYlv%E;r7w3P&7C}QRzf$I&54ru||Nwr?i*#2=j`rFG+a+ z^|LpxIm5NHO3}z9dG*T}9vs71cRehmK81czI@}^nVGlp4;_5{XKL~oXL_5FPUvOTmHM#0Iy40~kUxNj0tUHtt`ioPit zTU_Ui*4z0n+b-mTMW$l|y%-o@B7hfw8Kc*Hu49}cqV26|BnSE-wrG&s11SQ=Z_4sD zy*5)0|PfcKQZUu`o!|3Xp#x8-t>$Gq3 zb192&+<)`=H|~q2zdFD0p75IK!S?z*4Z~1U(De zmyV2h+qYKdFf=@aEp}h5|3vkR^C15B8|lQ_Be*A44iP(CVzed!@-nyZ=+Q&SDCwiL zYnl73*mQvdzLwHK#T?0voMuru5|R+3_YOD@&(1N^kPCa&&+yE-0$a|I9uv9cvRSkI9UcFOVS_HX?GHU#LS;b-I!2ZSyi;V&&IDyfmy3Y-#N(?iWCl3FIie1;lPxGH?*spW zwOzb^%13QxkrJz46jiZk{%u(^KAFCYA~7aAPWGH0k>0R#JE@I=sEn0M*G#soeVmM` z9Qyb4{1r9^GNG>NkMSMig}~}!s}1Jbb|~y##5p-U4A=yD#rjDs!s28@&sjS-y=Jcm zm_tN*%<2{A^X&8xlYMO{&5DAKjtd$lH*g~4jp^i2MJO~(ldwhlMnOD|=Srcj?1=V- zUCPT&>v~;3J7RCPEfMOvq1=)y)-(kigT#{YO%eH}S^M;x?L7Js_{53QdbpbdPny*V+PFPd~#CfA9aFc%msYiEV>Q{vE!8Ul9C_zm{0VW;+@G*Lf zAN=q-QoH6b)esMLMHMKhS)*)dgAC>cw#Et}_46O&Bh6^6ZBHWJK_4orig1c5MQ>LL z%vDt&|Kb6R?A>AT^bRZ|^H7u$4jp+}Jh=N1E-5vrFA0aWdnwvVeW+elC@CqzKPnQ> zKKLUaA*Efz(;xPw-e;3L4HySlK&3O^hQHh*xc^Q1q>m z5;5Qa7MInz{hv?ReuO$Dk-&)^y!1LJ$Y z!B1}(BBL-HX+?cl=uLsrW&QnBe*{dmUf|)w`_S{sz{2hcP6+^~yYgY8q6UTM_h4Y> z4kMDaURWLG2dZGF$NEzq7M?K(^t6OaS|`r=bBJ*@MQ;BV&d*m-7#mLI%0v3$18BLX zVf|nmg?@Utb@u@@9paD`Yk+_L!N0*NyBo*nFS%_ywi*g}bpIwE+*UwD(-cnl(};C2 z;QF5zn2*H+AxQ14A=^)z?yKO18vEdQH^MDUklebA=p%QKz<;0+z5)Iy%?*Rx ztp~UxWrg~w9wdgupk{C#r<*;942VK}Tre~rKjpT0&7PfMtSSaZX3^Y7yN?J=nT*)! zL#OK<2#U%=ePKHMJt8rE^a_V>N8=KDuj#!4PR>)_nMH`f4agaLahuKc17qN8?+n{Z z;G}_bFb#jh=kU(xM0cJqo*P@j*2olY(GA!;J0|aR2bHmo(6PzHU{fd_-cd!($Q<%R zonYl23lFtBxG%2<1I0V|{S8y}ZXV<1D?Vytt)Xujh~bra6i0?5%FhE&zxV>Gre=`& z`Z`{y>q1V(2su?*FjTigO=mqkEiGZdK4$Bffv%_Mz^2%1Nx zQIi$~o~b&n-+Tsho)vT~<1w?;2IH?k!ecE{s7hbMS1)|AK;HhvUOyc5j1gHrfaZ8> zT)%c7rWRWG?87_I(ba;Sq6f;0gCKj~9Hlj>Fg37&rMe>YT=Fq9SOhgiP1ra)!N#W& zJKH@7u(5!i@(HV@q9p@!@S)d-+4{qpzUn=?-7d0?e>z z?Q{__9!{_{F@V(l7bxhNMRkG`w0W6eTMjR_x?rPiij=B0#M{1rqD3MpQY(1I_6Q61 zf!r6LL(|+8_dov#YHr0Kmj%3c6Oo7@zHd zm8LNgs>d+VmJVBU13bDT4P#pe$Ul%mROJ|Y%feu!&x4V%Es`oHaJ)MKA5~dA^DV;} ze-g1C4lvVwiW^c|u(C9RQ)nq_a)V)N8w@Wi6$D?_?*>P;hfsCM#=>+h^vQuK>RrYw zipl%)+#w}phqAIz$lf(UNlg;e)qOC!K97aI)pWz{nGw10_(CV@DF6 zQgpwBAf5YoW}bxkxn@`!+95dD1IC6tv=0u!#aa($&W_O4^+ea=7DZpDcuBx%{`eNG zV_Gm&7J?_*j))Ji#I3LH!NfuvAOH3`yz_@}a?ZxzA*MQV;9zcy7Z1ONs&gTVqqLwK zScU#fN646mV`Fy(dEp+gGE&5~J1VesaV1&UQlAH+cWxdv6v0`Ws^P1f3UG3^fb3%( z)c3Pbzv)27)&=%XA&B!f!);;xpHTf?d4pgF?@iQ3KtbIPql?{e(R_{=>XWKyOFXto z!tM#BI9)}Ip)y?J@==%&3?m~)(hCiw)K8!|!WtS5F5r<&vf9@0a-$v=x|XoeB4^ep z8WZa~I6C2@r!bJ5t}N`mr0A2I5jw!}OJJ!c08gJO!p4}!!~-Rijq`DSEICX;La*t) z0?z$|V{A;9Kvz`<-ag*2H#LI3rXm?rFF4zYfD<@dsiQQu+<^huu7jzzIjndNh@?Ty zKIe0GyoZK#f7k`pVYWXN`WC6&2`$Z8VX(He!HdssLenJxk>Nq`4@$$x27$!c5~3U} z;g-Y>3Shqr^rt)Fqo3V_du$BC1A-7A;Q;Uw2qr+rZd98QUb2f#MM8S*Kz96;-uA09Q+Q)C~+G(c29n z`Ro9IDfrkp!NEWsU;N=Qe5m|TUoWJTbYScBC5{&=psDPL{(a!(LK%!TO^H8O6g2iA zBghdR$s<(89wOQCd@-?b*D!{AR20lqRG@EV2NPZdCic#`Eh^>|g_>D9A-8>nqMk6A z7>0tKlv)>H4}CpXM2FZyMou5LjxLDI?LkjPS)3Zl` z@N4_MC802OEWrGD9t=#9I9Xd-cq1dmAEv52M8)~w;Uhg1R9C~_#}t~HCh#lo!YMm! z;Ak2l4h{$}nxghh!rRi0@|wcTr<$&T;&6AEP#>8(CS&>d1bou{i>-E88@Qu>j)Z&E z4l@M<7%Ir(D`Efpdr;KYIR*a78FrRh;iaTQdKU#Jz2{J}&&S4EC){+^pr*q^Ue`E! zvqNB@VuPqyPsqrUGv(?52Rm{eodS>%7Xk}qOVY_eym+hzO9w}Cp2|7iIud=LscH-> zHy=2tJi(XubcOZ%p`>F9M-)-cwIxH}IumP4<XK=?Iu^|aEBa>y=CMkxIvQ~9RC0xs6Bdyz~XMO?ZVtNJ=vkFY>R~6FM6+l^Z4u> zB_77mi)a*Nq=+X_`?vUSzfp$0tvM{c%L#@qaC*FsG{+avwhlwMiz#%x{ornC4WCpp zTCdpm9S_iw=?YmHN95)DL&YEl`#3^%oI4Ec$7decYg=7l`qt78uE@BRnAy4wgKani#{xtq`M~ ziO@0%MOLgS3=BPxnHL2I6FYcW+Cy8(3H8kxcuoUd*U=g;9`R7y*McB(Wq2o6A}7=v z9)6`*y|^I2nuLe8D$Lvq&{XORGXr~+)RiE}&L3XxJm@;)VxlJr%G%MGo-Bc}mL(Z{ zZK&({A~VJf3YLxt3Gjl2YY4m)wcrq2gyJwWT$eY1CAG(tqN|pw5SZ&(qp+?V0d@gM zh>d_HMMD9Bws;|{i{@1pH7z3A)eeS+CQvttz{>dvI+!2-CgMI4Xlfxy%TR(xWT?~R8jbZ2)02fnh zL|05=ygmRL%6dr3N`{uQA$$S@VI-xGoW@GntG&Pz>Jx1PZwzc4VZJR1y6PqbXpYFp z$tMH)8$7lQMQvLXLe%wO?2?H398X-AR)?jH5wx@dkdojD6Q=|ucq+l*jry$+QaDNa z)(t~tbL4a^keNP3SH2(AP17*J06`<1WL*kFBWHxzSVKqK3ypR0xP9{(68e_V9H)mL z{_GK2SJ-<|8mvc?@TF+mD`Q9q$ToG(##r0wjKy|u!oMaGa8!GAt(JD zy5ywZ`;5xVO`+(}0G{#TupkE`EzyH?Mo_;u)nCv)%Pr1X>`8?5HC>c;cOcyA3F&_l zym*?>2rlN{RqpK_;uYx+PwE4FsS<+y(|H8yNx{r36>gT=FiXirnz;pxog$DE#luY* z4H&c2k-{6n4!&pKSv}dBL9n?Zlx%~LpO+3NeHHk41jEF@1Vz)Fg}`dHFO-eF(bO@7 z;h|aVa_^e2wl5NTf9SmePPVY3l8k&^&kXjd?9-E7bQMLx);SVoHI*oD7$F107Lgod zZ@wK~M!L`?V>!CIjP~jZ)OF8*f6Nwp@VPyGo(7JH&nrZJMK|R;z*t8$ifYM7?G7T? zkn-xUV)`)1_D7V0R9(ACj}V?-|2$ z15b}=Su9;9zShap6rW0Yh~w5H3pZFSkUjV{}^-DTT$mu=g&ZQJb0@7|d; z`7?55oXp5L`)tMgq-ZbkMZG6bpsB|hl<+{BeW>*0@^>vz&uL`>@kCCEE4a<29?Yg( z=BPy3{?Jbt`xoTkMT^aJ#B&J(_#`(Ve#C1m)wp0|Hp(2094g1KR6?|+DYAFKRh zZg$5Q<}y9Y)1>@9F?P#G_AKVp&^r^7*P|Kt3Wrc(IVtf%I$Xf3op5$AC{@mqg$G8lmG>BSV`!l(+1tibz^-&T|eO~m#IiP6Djh+=fk1Q5OXuOlK%4ox0^L{tSTAi2o_$?cA^o0-SY_EiO=@Ep zN4*2s10_*nfPmzUzWgmz4*{`HpD$~cEtUZ04(BPv1-6*(XXj@iqP6nVWKZuXbSMPv zXJqFd=_q8f)}6PfG^l5u!Y{F2^(|`A)EwKabpa&TD;hlKtdo%I6aIcc!g3_(jz{i_ zMQ%$Xs9d%sJ)+V&?^s_1AS;za9#g){*zSx2t>yHC5O#Kzh4|C-6h8i_n3v2gCP0FNv7anw_*iHtf*( zxe@3#o6{;aaNS^Q}Id=C?JrmiSs$B|g-t>0( zpT9}0f9U^AqNh|X{<9TVa#FA-$CC!@pF_#8-7<;~|$L|+KYfl8EZ<-Oc zQfjPEf6qAfeZ>1KJ$Z{A#^8@QIMHGaX3ORKX$t5^9vwtq!N&-_taBj~R@tBNFM`^^ z#!=M+TZsHCo^j_1glJe@UA>;1Ow$RF`s91T~0~aIiykOZA#>iNsS@FHSYD4$7%;rP)-3{UE z$EwT^yV(>b#zD=8wd1RPU>lp;BM)D+80*jqO9JY}34l&GwI@9gN**(NLr3_=s7sA) zGVvP8$6K+fL4DorzKs>td{Gb*(!z^Z5QkM;x?q*JnVM(jj+}lI;N$~Iw|skTR&n4Sy?rk>mw5r5G$?eB)5)EI(nN! z6BiUKt-b3QH+>)rl;Trs%-!6D;c_l}!yMs9-E!O<3O;o4KB?*}?Z*GuYp6bFiQT%g z_r}DS3a#z(%GXM~TQ-t-u%&77qhK=dURv0hTI(X)kL4nVez<+QlhV7^przFLK6#Mb z59Zt*|NPgA!Q8D5KtdVc+D!GWRzrR0q1Pc)ON`HPbC?eEdaKPA@9)>_GK&^^4}2c@ zMFH~UbKR?}ARP}}*bhZH=trlngc5OcMdQM6} z5nma(SOfF#s5RbF27i^qiqL?;&<3Kc{L1~eX8`G}9F?xO)4%`1+~C|X$J-lId}D{@ zp+;K$2cWOQXOX*ekc}XO{Zy-gUFfZiYmJ4k-_L#D&xcuzzA_$5lYNdG=&phNl=Dzv zrVn4$D_ztd@RySX~R8pumh$kf&x zP=9Y)bpvH4NS_z+0N@VXLjP9@tLKD3oYiWoeGEtfWj2@^G!K>Zg zeMdaYFfarGhWnm=U}VTk>{MtnS0KaC4Br5J=qx67=^!NvN}lVi-vpEU0=tSjTd}vObJ~d zG^|OWByct7o1l}f1I}!iz(4M1PtdM+^kK&-H~h@&`5;BT$HJ>}5w2jsuzOM`vg zaPx9eCUdWhYYXtX=3G;t)bZQhLW1?-N8vbYA+3t6b-}SCcAStaL`2<$#wrXvn=f|` z_+lB?WjPw+GGdebRo_&NTH+auTYCbr)n{o=eAX-c{P8~@$wSbVAlk81eK&g zuRw7V=9#0Po-n{lS^HONVWilK!ec7^YuwQvAUPa5dLtIPAl5>ciJF|?a$>F(S0qD? zByqJuDHAeQVhXDHre2=<`ZuCkSvCKKlo9!64y|Sk#{#AohvSSL+i|*g}0zpZtFd$e753I3F)CK?BykMBi78vua zs)F7;(BBJ@KwhM=hYAF}IqKg?-wOPbVZ6pmY$40Z&gzzH?`u;M7oep`&|pO-InXkXzt`U#QuX5&s8J2Xs&5@XXj z+OTk&ogkwM3Tp7lgu0^a{Ge0iWQ#Pp^AB+uFAyzm($>9$eCawHqybtI3-r#`j*07? zp-G>o8J{it_YT0w?25+-wFb!o;;7nys~3|T+{Pq+pTb~Bco|qF!LF`(X?S7~H(4T| z9(Cgp&=W@r@)Wsav^$bBLY?<7z%9==LRxmt=tX5!Y zhSP6?#Nw@9FRs^?E?DYl1@i;OY`Hy|j(-*=1C*1M6VPc)|5a(mIKKsB90vhsbL%vc zd8vM}*tl%T`H4=PZYlLfXs49#aMJ(!ZJV;vxoD0CejbV}OtqrdC z<6z%XhSB? zG{UX>E*@p1k+!*H@;-utc{3xr5wt_6+)WXl@V~Z*CIuc=tE#BB^owW1;)3KLtccHY zgY@9Tv9St`h6>WvKtSjnkC8HRlKLCObS1cy&PaUCecJK?;=OWx~Z6nfZVj^-?d%&XQz~)ERi7hRJ~a z=6arM9WUs~%pVuT-#Yjl@7xxYcVTK8R)vCN2$1){9Z`30(-_BBt#(i#7WDH1n%FU5CV!Y_>k` zNMp1Fh#zcWq(^nk>N1Qp#?WLDFLaZe7{*?7a1V+sk(zbJwxF^Q1Luz%mOe3Jmghir z8g&vhVCSa(w{t5WN$;Mj#6~}W9o)hjV}7+o(I{~@%5hy6`NJuU^s)XP%Nir2F3HOP7F9A!@b9m+)qRx~mZ19w1;p4c$9m3@_;+=JZ@LK6(Pv&=+*UJLX~yG04Md zs<|=j>Bip(L>XFz%g_IV2HI$C;^4-$7Y$oMb|@etUW=o2?9ADZg91X6uqY7q6^tXQ zI(=wj4PjJazDxou)fjaJ1`^$mO}5b8{*Ak~n;p!sTyE)!h`R_H@4;r2{^8J36x7!M z$`@pO)XzrL(uOY2-)uo_j4uVz;Fj7IcdX>$v04-XS5&D@$GvV1;cYD$O(U^C$4W9j zr#=fPryzTHEajV;5@Lom6ib7oZs*8F!^;zqS0f08fLd5z1Qz&0A82UfQUY4|_Q+`c z$x3m-n?)?Jw2o3i<6>LpwNxM}9|BJ_snU~tZ&LEUQ!Lxs(fWQhqlPpOTI6I(n5yA} zG>kZg)0v2?5fvC>w`qujd4`J>fhE>2hgWO%&5x4+EUDszaHpp_NfHIKfunwG>zvXC zjMQ)3!bI!6)Fl8pLY z0h3$Egjadg*lklXFm<9TyV#rVeD;JZ)|kTd5%MO3NH0Uw^Zlif5~iUf9|<-F#SZ0# zAp9n@CE>~TL~B3COSDi4$o*s8u$^w@Y=+oDfkGVBpr_qdf*_uw;~Kicj=&2%{is0x zmX3z^=9`X_j8pXpeStl)eAI{uB_4@T?=(8t8X}$=xY&AKDq71B&MNqzP1tY}g|%(ssH1d1v2tZvE*fjki0C{7i@{6=m^JFBO10Z3mD2V z6m5xfsr6X+uMlP400kx3p?!R;om`3ZzhLD#U<0_QNXj|Xr*3uJE3lAhI8WCJY3oZM zN`kl-nVkkF%3*~a2x}-n9Q5?WE0sV8ATM4cL|Z!JusQlf_BCKPmcCv%eS}bz-`qtI7%zT= z`i3A!M?zVQgAkE3MuFrKeIfeqh*KvUHeszXJfenvO&W^xVsvhfCuluI?)*{eWIV^d zkhdDfEm^L3Qaq17NtDK>WX)c9UvBG4j zpciMbi;<5vf)D{Z)iqv_x*%6!AIM?3ImPqsQZJ0aIk&gV-I z_BBycdjPo7no5=?1X*{I@{YdhN_=pLd1C_C0CO#P;DW#d91xWnLX(fD+|A&PBCjAT z?BOZ+ukUWbboz6fs3H{lI$@)B^XYspmVZwlRV&EPn~X9M0*ir4%9Qjd;E!x=u<~ZZ zBK=mF;N^=OG0V*N#3accDI@BEU|Me6ayCB?jx^8h?f%jNrkpf4b_Hf*BgN9*KFBS1 z%#+v35b+Wx?K;$I+fJ7VyR@h#6h1w|ImMRhu25~7Yri>%&(vios4>GLrCDHjQeTcX zw969ow8BHae}ETHe+Ko8_+=S$CuJe>xCG%jXl+r0D?AIg zY^khOIctBfWRW85OG8`eL!XanqXpD{yK7A*1DM;+u#gf&D1vo~gZ-xoHPMdkQ zwKPKCa#DhnwFK0gjNrl$@7~xL?KRB&&6;^G0jVxx(J%H-ijAPF#ro{jkD~qbWdF)M*<2VHwirfgZya zbXMrNv8ydEB@fG6bQ!O(*Cr^Op1$BuWaaF-3YWUdp{Tq7)*EP8Wow(?Sq|Bgz;-8j zTj*$pnnh=0GZ$=aj~b*)T6Ug3h%*kl`L~gkE#NHJOY$HyULq-IXJy}f!rZB$UH(v? zPr89U$|CP~_^)bvBUCH#ayuTdNH!7HUu%615`-Yp#o7`Nc z?Ug-oEvjq+{PYC4HzARe=ltiUfMso}3mP4f;6bl+m47rTXLtYnsrFAYe(6dKStgxJ zzF|(mvBw}kJ&5-Gh)QV|3pGWARF4LFy#U*$qzj^BxiO66TTD0}b&I}n=NQ~8OLgzjnk$3cfr-Nnb1A!KJh@Ay2DV3 zs=o5*n%HAM+GT@57jm7*Yi9emqy9|%s(o!|zo)4N%!roIE!H!@TnGCTEOWt4VA?&+ z%NsW(W18wrtB?LPM!&>RW*3r^i%2lJ`T0v)d)-bUm7%pt(h|#IW~R1}KOdy!2OUXb zMHodDw)Ku0>T6=my28gv9`85wXgoFNq90F(8KKT}jypm{u(AeQZ~!_|sG10xtmk`* z$WRVV82<4k3i0${M$Nji7sto7{9fM!%3IoChOW8kf_-Tnj%49EX9G^Gi@@Y$>`dc7 z^-1&57onqo-+BZ?^!+J$8a>V)Y}p{N#I;Fawzt$C!*v~Xyfketu}8Mt3*9=K&_mf} zbRbrpxXrqFB-gkvsswJ^e6m^!Jeu8YFCoe~=b2=}nV2%OGoFe(IshD#=61PVa#{|9 zHR&>?q*f10XPV$E^S0@yX4X}=v!gN(xEZnQU8K=-;!6;fj#g^?$6(HK#K%Oya>xaK z_LgLaG_z>Ki|DS$$-DMgEuq817kNe({=+~`@5_67%=y;=^-1{pKYPkXe>i8Vv1`%m zIh0fl#whE>ZtkwSrcld=GM2`1&|J+!5E-4c8|qoQDyIO-8eDULE7`(?n9b{FXLfk6 z$~S5>nY-&|R=dVno6}u8p88WO^GMC4KDw=or<}8HO~IgLer_CdIhp~mk8)F>l(W2# zQ!KN*eh4Q4Nr1Ud0OJCXkA35SvH#x43+hei!^U}`b(pcc`@f@)llwAzCTq?q1B3d8 zdvGua;GYPO=j-63NtI!|4iEoL_xSbu4TTf?Mdx7d{2e?{WI$hTud22(prD(hVl+-^ zsd2>7?UWkAoP!^gQw4%#p!C(t;p;XT=ilatE{cA2gRwWCs%zfIXNZarpNT(S8zWapv-m+ z5qQ^`PqLoX_sgv<`Sh8ZXsfB=?Y+oO(gzRRwZ$?7 zuoSyuXI#tRVImR=kIvw_)>1oMY!zn?_79Q$ zcg5GE`*F)?rrh)qD&vpobRNpj@2~bspXZN9AKed3L$%V&i;2g|=_KVwEbJ^nbp^tX z4*g(nCSK;ywP2SUfx*m6hePfju$iV7QxkVuM;&e_Al?2}B+hkaTQ4=>l@*S5$aeEn zOu#?$NHZ;~ARwpCP^*7D`Iu%o6EUloKHL73_WJNu!GxQ4nLdAYh3Dn%&B(^}p25q? zDtT_MsHGQEkT5?BpAE`_J7%FPs`m*piazMgSobLU-HOhMnWpC8Kdagik&38lr8<_+R30(^`Kf%xe+){35n6V zrY176ky)ZpI(-aI7VWh7-TE=d<1v0X@LE_0r^O@Xr8lZW!XDDNOx4U5!lr(WLEseQ zD{CT!2yCeHK%lJkMg?%x9GOS16#2P!*gRI5(~Q&FFa^n*Sf#uJVBgU%N@nU}x+S!< z0#}cmu0hy%7iSkCCvQ>ui(@9z6Ji298F0@=0sPF4g7n@*{{RLWg$oTkQsE<@-6sBW z0!4ZJbNaVO!W$8)rm(_59FmDO$mU|b%l&(9kg+8%nuTz&W+1Xk?FzW0TIM(>;g?jQmRy_{t$Y<(e)lD*3iL9kc*ELadSWDpN1)nK_^V8roH?(s_1+6A)J&sA&z6p6A>}0&FJ^-?}6QnNPMy&)x3QH%z6){$Y zp1|p-7hBK1t}Tc;;$c$(A`h|%+*XcmT8eipA39s$r@V|Z1}&?Q4Jr>M4t$g_0g~*? zL55N~0&-u%Bm}aqB$KU*-$@ATXsnOS$N-<3nk_8qK~b&lK07ZHQ?kS_8D}%~q>Xzm z`1==4m-JGHfM$`8imqC8_X`0($GEUGV{v%r93EtuWugA^7%RX-Ivwf zqrc~P9z-^rOfDq>XD_S6O#vA_kh~q>3~qzOpdd?j^*2CcHPj-4DLQ89UT_gZYMjaA zEf#M{Wq0(mwaK8+4U{8#fN5bD%zbclj%6XBA(scIq{XE1C=QVuuvX8spflM}Yp_F% zDm{qBqgHc@UEsdB=DZ(|wfC`>C?%t~dxfPCzNEGm8K0yqY*_BQA5a~k8*Q!IYUq82Z-a%M!&BcSFV(8)@k#o+|BWHr}SIc%nQqN3(o^S0%ezTJ|3m+l6 znabR~=o9qM_akI#y@ZFuhLxLwok$IjTqYV=U&Fv&k1DqL!S?=pCUiI~pkBJ&4Na7w zD52ygTIq`Tgqdh7-w*a;#w)m>_IP^3xUmXL68aTZ)Itp>g}E#XGS}VL^Gf}!q90rf za_YM3`EzpTnm_)QJL*|T|AZD8sxsx%!qJya7t{%eJ(Q}zK<#c~SZpfEj@KnYG%ej8lFH;2!oil< z-8g|yhf3BpG#8g~@bC~(s~6HF>M&~t+z1Hh%m><<7L=jYUU=rd;}G{c@n4^yn=Jp7 zLi#CNTEk1_iDNWUP@=J#y>v-$p8JnlV{K4V+kY2eiAYP!tKOo#s5M&$0)K22_?@GFEDglXni`sp@9rhJQXS9KhZYY_?Vn*hO{;l6EqU<+F zxR!#$RA7zTSr#+D1m#wF5fu1$f1?0)rDH0HIcY#%b1^8e9+a2bOr1=hsWGj8N*}yf z_hZ=ub6}tn)=4Y-oSsH>x*$h-8(PAYem*llklTwNTt_qk!gOVx`P*?IZ&JqJl zYjn2rcMBZ7e&qAD=kI&Ro{#89t$d%{+VTHq+h;*f*VnOwg^44hqS_Aw0)W#qG8_em z&MJXs?6+z*YH>Ja3d!pplV<*wKIq(63X~J^2|!Z39v75WM(Y0?m0)yr53A-Rgk>>h zWRD$~5+=2o22tGA2Jkmb%g(Jtgyw-wMQFD2`2_X=PQmk?a@^vI7L>ELp9^iSk$bkk z@*X&%wcJ+Eal}o#md6?Oetiwb5}OV(@-d?GDPEu;$PA}FNToDuiRRwP=S17{j^BaE zASc{wY5ze0h-Wrpfh|GYO%Dzf;I{th7y0^%K}6Q#eh1^sV*VwtDvY-_# zQys2tb#WB26PlTUYIFTPFDyLhfed>V6w>BRH~ACDjK+`s#p-oF$~x_9m4Vr3or z?)eK1A{|N@?Xma8+&2z!a0X>PDU+_dRk%yZxxPCxGzH>D^{t^#Dm_W9w94)OUTiu= zZ)4zYkGjZG`Q(SovM94gIa$xo<=@Z%<04-b*bUSN@o-@PaC272!;Z*pYpM<0?0{LE zC)YMe`_{I}Jaq>juBb9Ayz6F;Tnh7&7IV*C@$llmW@?<7dwUv!+m8X&JG;W_3J`R; zob>daJwexw#t4^u7~@Jflz`%T{@-uXtk3dBzDdbx-3zXCTS)API{zDUBEjLmC-KqYE87{~kn!h5ny8&EIo)Igj5Q>^g5j$Mx zH!sBn^c51|A15siAMNaWObSU?5z)oBmVYqx(-3ECLG-~VE5D>>IRzpB%aqtR?lxba z){c#zmmToKSqMGJ;v)T;-JnVDSzc-`>v;Z;>r(-}cZ++rWr9%hv5R{Ru#;SwVObqq z29A<^%Y~?uASKMVZe=|Ajf7BY#(sI@hm1cad9Pa&ODODOatTms3UDTL{}KKWT-Ds5 ztc^j!C(Ls=%}t%X@zkQkNZwEUs~?~5qp+fwpdR=l^-C}}SMssV=le)Ut#q_C}`}h*@_To&j>*|e~vr1*B zryse^Hk@YU4d>+KfXN$E(N`Y@Ja&ldJ&-%l*Ye^fo~N620ldY!y1G3#Jw8(&4bAm| zogFk?-H?VQ-ut0Nj?DDa56!7Xj>M9Z5=Isl5kaq~j4A){SI%BAhX$a2o0t9;>ec1t zf|i!l!;cT{%EbIt!Als5qiizKo7WO#BVq#P^7X!=bXpf+-RE3XhIYkP>dA7691?e-( z&(V%a>y6Xctg2~_=Qv)Yxx6AqE&%o)O8s@ z-tLAbrse)|dE-3Rt(@eSIZbuh)2Mlt(ZV}MZh$Hd9i{Pi)PnP+vTqr!@wqfp8_~9> zN6N`ZW*aYeiJFPI$HDnB2}E{OR8&Ke0%a&2ufv~=VlC=8TV*qd($-eQ#zt6`b+)Ef ziTsk0SezAk`02D_3a#^ytXzmAc({DeTVk8<$uU-7(v$>6mEZorIqL0xsDH4h)3dHZ zMRh^BLm}cn6_L;BP|s-44i)_3i(ER|D$C*m`7Ohl#FbNi-Y#o*!uXF34f4S}Z82Tw z@W*O?@Xvg(!E06&l~{sPzaSY=OY+NVz)>gjR7+i#)LD(Zf+RN5#G-816@C9wrSx`Q zgxBQeH+oY+wG7~!x^mZo4ohfJ;ieC2xPrhDSj=&mj`6t+u1%l}OrhPs;Je)*6J&%M zczvF)$*~m=J{54o!Lt(kt-_U?rj*&5D`D{GV1#ZeZZnhe97L4Xrg`l7jQ4SIaYZaF zFoR69JunWI5p!YT(+TS4#N(_?ustPSbZ;A+(D`cOVkS8-vxyjZ(vVEM#B+Mk^7XPu z&&(h%m3j(}GRt_`Swj~cMwLy#1t?T3ky;?W1XkK_Cyi43k|!XAx{SyAgOPd+-GSqS7ou3cQEJ2vE&q;9a ziWTZG_prg>36ogc-5ebdCHx4ZaCE7UiVbB4S@XTJt1)n?Lo{}7_#?16%88E%7h~x9 zD(Mwl${;Z+0kyIqp%~N@7Z=u$Z*n3RnE{GR3JEvi)>;$4%E`$QOJvLkmR#j{%5H&| z+7h-;`5@N)wCw;!wMkN|;FS|#pV$qYZ6wiFR8$V##Kuujo<-i%_jLv|zKn#iA~hO2 zTi47R^3(H&)(+pm)eA`uKk4tJghqzp14lIeI?5!(a#5{4&>^do??VDuuEz(;5a_84 znEXrO)zT7cWYi=wVJWbFo}ZZ5xP5%?3x$<+4wPhPF0ef2BAiLn>_n`82a!Eif`r*w zCfu(ozT%vE7yv9D06s_3d^X-{k4018>amXW2NJ-#+#oKxKach)WX5tLwCEQg0umzL zaX=a_u(v{M-#PK9Dur|fk2~ z*KS33I1Hex7{%THTLs7V{HYl44OtjX0CzepeE7rH^&G&wfHOLua08)g%U4#OLDYUe z!4mk$_Sf@LWONOrvg46B1%jRux=p1E$UW5j%cymt2ruD8eUM%|;&G0EjOsUGzC$o{G( z65U4gqDXaswolISmi{IWm|I@*H&?{s##}!##T7EsQe;Vr*WngkC4&;7S$Jiaf@0Ln z0}_!_ZF>vLw=_asJlggWXE!LEhkV^h2@3q`j9+vO=*^--yWI{;9N;V4gdm~h!6gP3 zs#{t1@Av>s>}@s3QpbxVA(*8#j&GyT(e%$gNVP%3D;75m_zstfdc^% z@BLXj=Njj)Aw+-^J2NI%E84b(;?|Gv@`~&e6K!yQ1S0ckP&d33iUvJ}Kg_7aA@~fE zqfrxF%!pU6$L`^BOYBoPsicgD_`drCgXjXE?{zBYQ-&T$rf zJIsFvAPzMvZp%nFHBwqS2>4PzgZgkk>V! z80XG8b@M@&AZX6=9v+`ZA%n`(ErZGOXM|LdTrmNc)`MpcYEq5IEt<%IkiBHaFCz9~ z$+eJFH{VIFrkc!RvWd)IKouRo(0YVN=a*du`rmpvF{o-y4Uc zgq{x}fLw_=ptTP!55s@pe3Y3)(OSFKH7ECN&*K#gUyY!*Wp)-g9Uac9cpjWT0zxqc zXwLPPqmvV}8mFqMop(Bq)e_XVsr;f-Fg`xMr9F+K}nsin}FJkJ7YDH5%7-dB4Q3Yp=OC0EoO$~yK;8y2|G$5Qjf$x6$Hn^k( z#-l`AGG5P#$Kc;?ilwDpsidqA%pf8Mg-7f7s_TjdCuj7x8$xV2M}eIezeXHBk48WGCbCMzr2S3?lHn2Yg!Bkgh;e&2xUmYB*+^EIaBLT9~-x)kW>`zcAk9dLqbShLhv^myN=B@)TJ794d-_F z>L14tvv(ls3CDT08QG4SBY%` zlu|)I7w`;|>T7Ro9PEb6N=*%IXke}(Mo(!jt0^nq1^b)W@lG(g-{sc2F12q zU}6bPN-n11aTHYkE$E0uKwasSS2wTH2H)#3QOSq~b7AE&gB2NvugKISDtHK~ombjl zSNq$~5h@zb$#fQ5A;H)f$k76AAScE^*x%x>VN~)JujCVf@ca-6hMAf}BS+X4Pn8Zn z6=!InwG9~b%IlrrC`x4L%b4X@NZ%T!h&LSPqoEyoq>BLVmTx||t1I6SS}F;{5=dx? zaJuEiAWcmUD7*M(5!>8qHzJEwQf?q|7qjv{^^=g0DwpuJNkUXI>3sW7Ix~ z*KF(Gfe~S-f+XB*JiI-up;VaJg!5B~-XWZ1(X+$)9?+>JyZr>+ma1xAU(HNg$$$fq z@-NFV0ddLlrN_x9reVH^H(ENm{F1*h2MrXWpEyDpM}rF*s1>nN>Fb$6y*a4A=?R_m zii^9m_fVJHe93lfBm~VyC9hO&AW)CT9r#>Ro9#lGuOm{MCGusnF<(5Dm z_n*TyV-LV0A?L~+3rcVW`N$+S$S;&a6+!*F_Z3;1)&pGwSVgV~fK>#`j$Si23k(WE zMnMU@yK@j_jD<@2i4FIUi$h%PGq-RC%K&RR_k_o@&|47ohK3vndG2ObxPbCy%W$E` zkMUhlmvKuyW%QkP^ArEfib~Jc^n2K{_wFHF#9b1iIUFnSiOMp;WyR4#ZktxlRR=byX~B>iH+O#I>GZ{v8~qXtS~y>=Q&}C-}9+ zGKpD)Evktn6xVHMd=uifWAG>F9B7zd`0NZ2e0?e_rsX!Stt?S1*x z=>D62kwzYHJ<&arU1Aecotv5z5Xw!tOKH%AfR7I^kQpjXtHMW8S~-M*$|6wwp`avK z1@}HRBxePdwD3!ysK7Tm2hR-qDK%YPTAlUQR7B zj+Av4?(h3mzM0lJh1CuS@w}_th?wJq*FP=BA0r}hA6ClK)A z6fB&dufB0c$|76v_MAz)v^WA`{k@ouRd7yC&#J^K;_K_{rT0gbeN!u0BDRUpu6YD2 zivU`-{TU~6w0~a|H`KpGG&O-a2&{-}^>IG-$~a&Mf6iy`EK{hbXM8w(T$c*+3!@Qt z)CGSZF7ItJNb^WOr4m(~S?Z+U3@EO7O1ppL(ya=9Uh5AK8AtN)uV)AqHUr=M&fwVj zM$*G3Rp@*C^1uc+lG##L?B9Of3G~&#M9kfV>F9IureICEO_ZfR+#iIzySocW(Iu*Xxmi`^nN2`fSl@%l)4&**7e+6yrbJsm(k($9?{{lo2XEzlLJF@B zopVhjbnE_>p@m{@jyIHH&UBaR;}fVfc~T-S|Fr|SlvU047iMKk`7ea(YH~oV)WxoLJ+Fc+ zTb-B(dcz#ljBD7bM#|iA%AQ6bv)u$p&3c^?R#%yV;bMPUf;d`mTS5d)XR3EX^=R z-ol|x;VCcPy)$@OuDqR#hi~L%gSzGQ-QdPgotsP8zlQ<@r?|nFcQv3(5!ppnL~&y+ zFaaE=_K~z|Zmrr@iufXXYw)|8oHpSLKTl5RuXS+#K&k%o{+SV`W^BbAx))KY7c%Cl zIVWFIi2+mMD0NVN8NL*Z9s=5gxUs!)$dTuD#24T&Q9Lh$;pZKe2zig< zLe$8@1y+UiUnh@_&hhgh{u&ED?$0Yv70Xno9Z^+Ue1-$hv|gA z+TQs+@k%*@_2%l}{=O_Q!Q}d6U}9BKc?0IvamM!Z>2V&fc;dgH$_Kxxnp~rpi&m0H zirF&6zYqVO*m8@GnTFPO!cvvtI!4^7rhm=MWbo_nC6AP|ZUKiD`oOuD^l$OUd_+Bv z+UrW6uIU&WH;9$zH9}KDjv>|s)q6u@n13j)lH^bkI{0>x#0a{%`LkIG@a*vL3mFHp zuvW9wHE;%JekfUfOrujjp2G|zF?lYm+0*~8q2oI=L8qmrmJshi4-EYAk1TAB&mxuB zDH$9!TF#wG6B5zGEGWkw8=LU2Z6r(_+uJk29{+W2ag8HdC>pKTpwJog&bX=+Vy;4g zlLu?Ol1m@hk&2;$PC!zak8n>wVnMYXlD!2v_d+#vvH=$;cY8Qejr(>!yDKhutvq)< zff(8x9Ps>W!WmU@izy0)P$HQj7nPtz#N;m=WgcrXtHASb?3~-!fmJPZ_8X?L>Z{Y4 z>lc$jSvhbmtITkEOEJSLN;JFOeu>*3%H-htzfY%>6FFQ(6j)zc z2d3wMv;f76n-vL%r~9z4TE9Sn%i+BX8FETzQ>d|<0TVHpLKGIo*#Gw|<5jB6mz3sN7WQx1G2hAq_W( zK$6KiUUg8&6x_D=pU*ld24Qs>3YQxiL0wIRTY)8ssG2GHOV6P z>(|r42d43V#_*zO&H3pRy|O>{U9S>UYokb1`b5jaSO93<87)+B1^0PXEEJnB{vFe5 z=vHSOQZnT-xwv!Ad3ag&h@uwIZ))lUG`vtaJK@G)Bz5AO?{~_#aeessTvYJpO~ir% ziZJ(M6-7o__8M}6jz}Cub!KrjWy-{^ocx+Gn}M)7=a;bMZH~Le)|iCctibRl`YL(z z{=IHomv1_acQxaNS{#H>oF#J@Mz`l6#drI+{aXT3HUW5IXgUpixv&w5+x?L&_kI2K zzzY|gBuG{YC#N{jpoJ0MoBqzBC@l8!Uog-MAgdSb*;sO zg)dm@t!6PM3*Jt`=IR+K6}y5EkKl^+5i@Fof3E)pH|I3{9bROmN%_&O*OHNIS@x_Ro*(*&HJXD0r`Vn(RFtU=_%_-E}vp zO!_abWQh@K1$RE+#w!C{aQ#2 zs(id^EhY7DRi=WuJ$BqA_CmWIU^MFfk2duX!ZegnIo(KCw=oj`-o48*G7sh@?1h8| zfu!S_l$ig7CY__KWy0(W>Y2JdHWC68$g>Y`a;WClz5)M~S%mrn>9-Bn)xP49%qxQw zD1!0S{=TY8PNFOgpg_5esbO8?4DA~gM6jRW3oTC|`FU9VWL#1X39x2zxBnYOlPyZZ z`JrkULs8hW(sSp`9-{BXp(`Nb?MBd1qBft352CEB+x56Yx+X(b_ewQzVugQI-L-#f zhw%CaC~3#`ZD;{SjG;|*02}PHOAl=A;jGK|))WLm2lHqMYRY5Vc`idOd?4BHEC!eV zh!k4SPv&c;TmLV0gc*5_9!D7LTTT?&k#cD2>XP~w|%Gr6rqJzrNIzs;LqCYnARoo1;d9j z86K$4mx%#88O5PNT}ew@yL}=jFV7HAXX9sMVsya~UIhYlwuYCLjhPGI0Ep^?Q_Mmy zvL`^uHyBWr+5CzSLY^Dq)A)5E|(c&H%-i^Qq9HB1qb? zM%IT(QDtLzr^Mexj!8tUX?$s$;(s-Sfk*PYKc;i~$_g&=jRvJLIc!^*56aJ=tYko$JV(QEb>B*?@J2^`|g2>Cry z5u|=j>D3)6AEbWZ^MAQxsui@8{Zq~UiqhRe)+EaLy8_9R@I@ntq!Bk=uCw*Aj6bx> zUQojtcO(EZqSk+=-E&ZU{W{P;k1ciXImRFvQaMk`yWlGRhi5TC?rkHgESDZ?46E-# zlD#S$+X9$Q6B&ssq5zPAmvpk4Q&A4wisl62u}6EZgNYM1x|Z$xMN#XKY$Jye41$@S z)mb33VrmYSDaKEN^Qghfb}Xbni6?JocPDo~N+A~;%sx}sM5d6T-G<{|oj`{tiXw_u z*EWm`<>DeFz0F39*(>y4Mi@liEf?I$Txe^Z=9lWySwkj;N?LP4M@8t2Dk&-HVFuCd zsPg;V!oy%R976{RSsi0j*xUjf^mjuk*XDEGe2afPU2kTV2nn*#cRgF8mPw!|Q#_HJ5c*{Zsz}T1*FkYN;#-|3+Uv0?(l(|D($5YuT^URYuZtHaxI=IWR@~hsKymlt#ogV5yA&wy?hd866)5gd+=>@%f!_50d*;sExi6V8 zCz<5T`R={fXRkHLr5Y?QByHa~OPl1h$5o`&6cpFVOV09-FCtXhTFfk;IlVHd6;OR*3Ra>uZqI@3h=k4z8Y zVEy2gX47X9Plya9d|S zTuy)KH%-Ovp0RDVE|YLCe)smoEoeikFTH0gMbRlHVgpxqodPp)`o_`v{b+uP!Dn!} z14jE@JAzXXfKYHC>TYUXC*tnoM?55I9-@J*CEQqVvXta=WYX^eJO}I2CPRtq7I2F8 z!NXm?(AccZ_%_kE>wHwBm%PI3Pz;Un5?=RdDa}Mtikj@fiD7_F3QF`X{!ln+ny1g) zFkSuGscu1E%zrmAm?d{R4Gf7$R!5Q5(*y8k1w};;3=P4{$~I%^;^kej7uDF4A#;Vh zb#g_tFQeu}KA8P-BSP>k4!{4BMVHjV$q#^q4IOXr_nPqV@5V8cgax3-$jI7@Lm=R$ z#)(-U(!i|}fnI?zOHJx9xNz)GDUT>WW^W2b)>(Ex2gdK1eoxqA z0ss;kA0Atv?t1iRcwP4D6A4_Z9+aLpMF2qj$n|duLWVI8vG0Vv(JITc`U{B!YahQY z+?&y=7nqsRmPaOE^b*I9RyZH~IR6G`+!U$UF@ELL-@k9Y#Q+ z;%dR^vGxa25nE95ifD5)(X-x_KmlOT7TD(opBZqRHkmrXH}Ep)aeWp2R(W?Q*=hQ;jSD1A>T zW)Z?5n9e&P&LrvCez9b`!ey)fg=nC--?<+hL8DYVRm{gpUgqg|Lh=!B7SDr#o{EDJ zQ@X}dgs);wm?aRy+SMGv0&N56s1!BK_K4!bm1C#0`BEE2BsEFuU{(Gc&}eI5 zeoL>H=F zJ@|abEI`(^6sTuNCiB6E#IDD0PMp5(>i0P#5`%vBXU1{`WeIttBPd@d$`jUw@e$99 zgGT_;RpoRLQBl%Yku=Zk>`%GGneHvYvA!CA9Dos7MZM|j@Bu`q3swiFKyqd%?h=|< zLpLg;vB0J>V#}&CO+unfq-hqZ8In`=LB{MSy<~f#zv$o?KsuPr`)OH$LGcVw&F$md z!~_mzeeaK{g^thvQ%NVFn)p9q{oh~EK^YBllWJ^NPmeoB-y{V^J^*k%u&S5D!ux+y zEt>zDy)R?g1qFXgCD+#0$c_&VK-?|Z_4Q|WhWeQ~(074Ku(~P#E>3ZLdCBIRVL@iv zJer=Nz2HnaHBA7O=3|49Cp5T)_GyZznv!_FPnr8lx2GI2m&c`Pl94y(k&I2t>x3LGIg%Ben|oTJZ2W0Ba?f2Df+ur#+&Q(HotQzLI6%*|OmS36?0cz^A}Xcy z|5I=i|2Nk%W3u~}lcI%uR z4@@Fozx1z*z`jmW6AHyqxykoW#qoWvV3#M-Bd!W*T6avH=;{2WMqGr$>Ef0s=l&P_ zqmGz;#{uUNeMM9E>&-Z)F?ID*S}N&i{lHGz7lL@@`dybMq=zs87Go!lKvwz^ z=(R!U=Q`tw=CLnPib`|-1O~lt^s1A(qS4<2xH?pv>ls`wm0B|}2&4rH{PFpMRRrff z4Dla`mPlE8GB1PryyyU!zlY0 zKiRYWM?g5ET)5=7i2Jv9htxd}3La9AMz1uZ?|dg5{DaFI@N!FfCUUQ+=C{Zv66Qlt zMFN#Q{319kcsmIdO*T!g*yVbAFj|$u)U`H3LWxg@6BAarZ+%tXk74{45t+KcHWB@m zyW$fq5-NgUx0U>3Tvi|mLTIpG=$ILH7>Sw%j5I$=wmh+ewWgIG)76z`6X>$GQqqc& zTwx;rY-qvA{4*2wSkU`5Riz8qq@n6nCybH<;nds81N+(v+v0_cbBh%;tRfYnFTpxSW!RB&d!H*`IA7#40j6akPf3p z8A(zgu-R1@QAPd&0T{I@i@p7M7K^E-ag=|5J>GmNctdsyxV8@Xi~JXpy9i6>QVfu& zB*gmcctpCBQ&b$HD=cFS zR*_{-sn6;?} zPfGn6b1}Zk(fKdBc(6%`YjY?XV!cbuo3PMi*%xDWM$X zquI|_SlT4)j&TxqO821gZHm$L4k`w3WQyJ0&c_%cYGQVXr%F5gegl;?UcQK+Ke(61=CnpBeQ z5?iomK>q->P7Vuur8Ty0fJF}=g>z9G*&!Byps0xP^7~Uq$}$M?_=bj3MC*3oLvNft*{x!`jbpA(368wRM3K+8~k$Zf;W=EK8ng3xR2z;MX`zjpmjVGV-`ZJ!hbB zs@!PmWF^BiMc9iUK3d&QP5^POAEi2*SL5AXc(}U|UwikCDRJ0Dh9rV;&yegnVp9zQ zpNe{x2*L~z6E(iPX@d*VEhK+@W=2ZM2Dh82j4nY-);)CZ@%Y#E+;{N^RWKiy=3YuR z34$^?J9?8PktlYGB*AJ-vf2<~#Ur+qRWvKc&2|ALh?<$S%C(8H{-=boD-#Wz@s1s9 zh}vGLyngS-G?F-`06!ETT#p{9_MCG^AX3aNv6%8M9h#ZcCahV83N^dbgIp~s`M|jI zbSj{MtVO=a;{GXDDu`iK__^3)=M3CIAcGAfD44bX~`C2iR4cYp)|D5Q| zyk48|eIrNOXtnXhOlV2C@RZY!L5m6wOY1TaH4~vz{be)sKcaCJZBmcXi3n@FN+?t^ zY4o63x;4L=U%1gfG4z9%U{7f~%5xx%L_Lx~z3}~4Og4wYx;jyF`)sAlp&v6i4^pY3 z`nBt+E~=el0U}TZ?uXNVKk>Iuft&@rg|ba3sY;baI0PLcx`eJXhX z-R)fhg85RV2|^y4AopG+}xG_GB1 zi}=dkfCvF!5H)qSeVPCd4B=Td2Pbz#HJIam4zaw&XqV!%q8O^G31wcf&?F`nI++0C zed}CAWIeSQ?=dQCP%7h1H`8>(6DrWO4iOkx5<=T0v4KwPd?SPXe6WXAiP)>i zAaQ0?F(Y(6e|g+Bt}7(Ci@Y6{_NaMs>e%-sW|pLJ)nuGgcY3d&DmF|&+S7pE1g7uv zsan@B0GOiQCtwT{vCNgDIZ?tYQ5d~-8haN6fus?cg91$7vF)GbNQbbaXM{1THef+3 zVB&s#KEH_E8G^)x4V^v?7cTRLl186amLNK`2y7J$3@ogpu&frnHWrS-C8{fH;f2bo z(~p)1R8279Bb#+t15u zI5wVEEqN;zkQw!WBG9L03#Tw5TWK7Rh@bRV*5h^$Gh=E@KJ3N(YrKU1)r#o34NS%X zqd%z{gz^fEw~qeTd)?jRK#?pQfi(?BDJi&rqzDDY8+r?PY!qzq@#s{p)c1c^@Voy% z$j;hPLj!k30IBfi=7x-cwv>vAiTL3mcKn;>r?R7e@3nWTP5Zw>zu8TXPTzuwnK{P( z)Egl))2_;FWPIi!y)5Xx+#jvyp`Rr;*TV}xB4?5W^^e3QpHGKRFLklU9+~pUxcuAx zK5nI5=ivSK+2pGA>7dWR+gmPl^mtrVwV~WfbsgxlRknFC9&@hXG|HcHVt2IXsvi`X zwITaw&m;E!FoT^e>(!$P*4&jTlg;^SmSmPL@Jx<99Om{;X#OF9lFo&}fhwQKfy688XxvAB}Sug>3hE@*Mzgar)jLOvUkWQs@0 zQ(ifn+j?SE$o&M88XjzizVQeNZyrqw39k*Vo{03#cEGb?&Ssp)2=gCa@A_X2v0LAA ze+$ekeQkAj;pIDo^}Bs>dE|>5yraI0#K|&xJ+G8?C+|u|$P{M{Zh^;jg`@ZWy7q_U zE&o4ERcCuaudU|fjH!IG!_0%{@48-Fg}pXMuSEjpVAX33J*|wkI9~5gi!DKDqIoGl z>qMeB18b(F2|vujClYT?xS}TPNYS6ocp_iCJiH=+XuPYX9&X*->IJb9p(u+9VJRls zarqP9*9rO%f{{6!4e~!t;Nh3N)gjC|?oD7?~5Yzc?${3#ak;)p1tyCC7I zJup3pU=aIQ=&+m6ME=3|tAdA{3j%Wsf|Bw5)3TkJHML~GN7(LBT@C|c6pU16cu89D zCkE`R3wU7*-%bC*keve`k*9mrYogaxYpBNE&_+euMRMVLBQO6Btm(1mtY3B)IkNN7;bG4~buxd(OpTzGiR3rj?~wWzKvDZbpyLyKr|O^UMm@oGRG z7lQp0`Dy$6L9&)ce5(=MONoLEiT%#DsIMM!hN*85ZV{#u5s%p^K|G^1YrrG2GpM)_ zc-mEm&^ZKXQVSKC=rVCarXM5Oak4`BG6p5}OrkHBl6t;YeBNqY(U!H5L@v)5|z zTUbPn(+&+4BO8~6uL%LtulB+_@Uhi3VN;rs!sc%Q@jN@Yxru73IB;BYO~RUJ-ol1( zr9E2C&;T0`?2HWLrZN~;-u;tF*YGlF;HWK>{DD_f6OX!q;ID2N?7h`RVMlKjxqin+ zB+t9%)(J8BAYNWAb&~=~;!%SwiR0`v=q@f*wYzN}dv8`%rYIpA2_V8-9Xq537ltXr<``Smsa!0Y7V#fHfTyDqq7=SEn4-_o7Fc+XC)S-@k9PTPZA z>}5khj+oNe!aF+s`F$gv&|p73MH-$}V>3WPDw+43b^>_86q#5C4@dVgIjsX)AmE#C zAtcj!D3acgT`21eo~4Lv`^yn<-XCI%%uD#Fh~+LV?c!ud!ZhIxqA@fHet^}TH@-){ z<#0>xmr*CWdG^K5UZ?5~kXlxi8%N9NXKnu^?Dsy(W*i+-R|hNBSq96`FUKhACS~Ew zia;`Xu%=o>JxcM2aH{&pzwQH4?mQ=14FD1ogVsHfysn>3&BzN+QQpmXo+IViORAJt zjB{C>(4Q;jRHe7DhWr8YSV(UQd%Iy;b`{+mT5~hr_xiud{!CmPnun*S>j37z-mbqv z0|CPor5i<9Z$y8n;6^~TAgJ-thJ#e-5o*&;78Y8iK8h{yERZU+j>xA9;QG@cX zf4LvN#KG6=Ya~7kLdz$6rDF?hL*GItscx^H^&A9gL)*ZpSaVYg`j8lHMj}iM(mHIz zI8(>n_%N~MSZ(|m? zVC^CzYkplnA8C(ir=+=VU0^-HDj2YAt}P8rhx zCtP)>pvp4}IdvrfoJ9+c1w%-S35N{W0AZEQ1zXm_&lY`PCa4nFZS-4A&e{)~j4u1Y zfAZu75S~%hsNGT2jx2Q=iYar6TYuT3n8CplznALh{jq0LBgCGtZ+3Z zj`-+EPaz-7)AhfRmo{$NS3%|1_% zqtzP>T~ynngW~O8QQ2h(b>Z*;PdC|*o|LFG6O}%4QnbzyimZ zq$@Mt<%ZkMY7!v0gOKsnJ_Ny0hlvE52CNV&UtGBGt3@#pGik;FSPCv^OvS2`;fd{gB0~5^T7s|4L zPZ2{g2b0`pAsPF4IX;2x@CncY5U|0w>GA6OH`L3uJZO8U!7)%O~p6SxY**T;s zmIU26uc(X>Y#b=0#44?x%o5g=&3ubHROl$@h<*o2_{^eH*T8K=W9Zu45fgdZ#!%S4 zm;)<~tXrQ{Y>ZNCjIzVpJ1fcu6D&-G&vy^vUPY@H+jU9jmsGJAPL)C8fo%*G3|*WZ zWPFK7r@m_#Osp-KInFUHsYCs=8ZgO^QBMeQ;c*GcuBTl3f@^?U&C%!`5vj?RsA`RE zdI#ggS$ak9eI4rhvS8e4@2S>P71J0`Gg*QDTqTwsMXj+=HAC1g&sHPZ7|9ios+dC6 z6xt>y)C}ioMyDVrr0k*;D77Q~N-`QaVng`Q4R_!z+SC2u2(>*BhZXpFc2?+o96C7{ zc;Ln6o_j+V*2|rgmNBw7*9?ZJgGvU6a0m#(8XMJQWS}<0DIzUe{;oj~u!cckU|>$@ znE9>``8}Oyma(y*&(EOpM%;`;Wxdi{B(xH0js$9H z_pl>9XEyegPA;+($O>Jj{1qo5bw@iznU&*w(nGzcw0SMEs7CSZ@F?@=cModB$8^kc zl*Q>J=qqK?CP_hKD=x9VO-d3DcIeZ>!Nbn+xF=JnxJFZq33xfy{G8&eVX;TVLctI= zlBc5}v6*B3#F>s{N{6wDkT%+|0~aJ-x(r58xNvW8QbG}~UW!sy&!~l+6`>U(h8~0S zp`|CVY{}7PCIJHPTeQ&JHWWGY{-BgsbnVHjRV03@P~hp0zPpv4FKv-?Bl+&Z64?3( z^tCxnv4?vj;YFj}ya~cnggBA)4pn$`_Q!Grgrfb@H9E6esMT{BG(L>z>MP4w`SH|S z?c{L$kUV)M;n%*gCGz@g6UAL!?;OWwB+y=0rc6_xM^IGQP&zS*9JUL}LhCk)EybkT zJ-iSA?doNvf6#z`YEpA42NyFF9WzwMbR17|;L(~rTaxq2-s|a^NGe*ff~|EqX6Hi^ zL+Q{nq9#2iQBmlY7}@Pd&nBq-ng`9CiQ~E$qUBgg8X)1siZxNu&1SijwKNl-*Hy-l zyr4jrorHdd2Z6PFAuy8%^LKmw_}*^?@YpZ;R6u9<=}%HnaWfiuHteEUV1zEZyTY;` zs+lq#SyxAJ(jSN79)1AUN4)bv&W^8fAKX~hJGbsPDw!&W0gq&l_eJb*xsfJz?$~B( z&?-+3vxvPgW~T;_yX1+%(ON=$IZk*hlnFIuiJodNV@J>ZH0-s6iHT`$V{>9LHPh1k zwW~E$$(q^b^hDw!pCrIOpAF;J@IpuSL%R-#9Nv&KB6$MUxCHWg=~ygNxjbdi^G%D1 z=kLvaLC($}$W zH@CJ9GbQw-?d!62bSd8E*rC@+)y>3PNPJtW=_~8O<@N|UFZZHykn;BdFTb5imZS}> z8Dnz-cU|;guL!|ni`o=en|I1`N||@B!`3I~Fl{$do2Jj(UE!7IxU}H1lIB3NZ|v7f zNr?JC*8cd!uf{zyW!V6!{Lj0enkrVewudIxP@Bzh)s`Lw`Cy@23)a?@*2lHRHLHRz zEP>_CUJovQUeHuoZHEidz>2$HvvX2-WJ~y!SI+&5%vhhtRKq{?0`kZ%)x||gZLUqr zi0bLFx^A>)+oXn`elPT+7s$w2L<5wd0%~WkWmGDz+A0^jaM1I=Uk^#ewsswNYN}Rk z#GaFDK5A~R*WO|&-*It3Y8zKO%|6R%67p5`G(%VVL&O92{%+J@Jv-3QtAymY&|6jz z%^!P!b|YAdz`u)3@8VnJp)xy*i=4<8HXb7qR8RudR9#&mA0OO}ugUkG&I)(BSuIcS zpL0|l9i7JR8>vbKncs$55JnU0RUh4NGooeLQk0A*akGLQA(1zBGJ+?PyG`7KxNd4j z+%$^!6Fho2$SXVGwK>h4NnGi}0mH`k$$izgEYtm(z|f{cPJ~rq>biT`4Ji*!08x~@ zl2dJAeJ3uwdjUa{AIY`~^+~oN*wBhjXjEKIU)2UxYSJ1D=nsO|LK3!iEM#}urYtB_ zYORs=ZNOJ%Ya7+3sG<}cbe8iuF0rWFRy~2asY_k)S41%m)e)R6Lt@5=>S`v3aJR9VrBoIQLb zc9m?gcO`neU-zsVVCZF6@Z(QBQ;BDTo(i)de^_F(ZH^TVNjs3gSx$ws&@>-dT6zPC zoV!Q0H}bxZMvs*1`IjUXcOwxVfOnbRR}*Y$hDWl-a3{3dli^=E!7ioXivnjv4qZ1) z7;NUb{9w^zif-Hlbrw40n13AYKg0Aj5*83J0^5ERAyaru*nGj>rwgf%#65`vM?NdHCJk2f`&>Tey@B>f^Y*2R>xX|T= z(3Q3K`1Oe{KEML!WEaIt-HN({A6?k!)X!Iw+kvut@G6^f_4Xv`PqOdlM{`l8t zU>$mRYAjQ{?3$jip@f$u87-W4b+}NoP{U`vE2=eFEIvuZ)y)h)KkltVY(wDC>^huT zido~Lj;#4H=CZKuOT1q2DRogZ@~h)g@@m%JOhIr$!OH*)tGh{;#N zhm+rCS=2X9SeqEUonp(L--=vUCGs2Sw6wIa(-#uj?x}};{D)?;E;&6Vzpo$rBZole zw}9O9_1Ret?Or^|H_8FS7n9_*r@vB4^97s&S&6;9%}FEG#-!unb6ZK*Z^B6_>vJ#+ zvR0iC@Q{i!iWl^N6keyIvWEL?L5J<$WOrzGZ~)I;Hg=sD4{6KighNHCV+Oj6I0l_6;kF^FIuP z#3kg)f!^ZXp`>T^HuzgBT)QXtEB4#4_92Jd!N3oq6!+=ngw+Ga?bZ zGy86>T%%w7+ZpSaBi5!nu2;h>AGiPbn5I1NME4tD;0OIh+Wz8+?0q>dy>p3d(KhCS z5gQf`;i?_ky>@91H5moA(@*ZuH%7M48v~QoUA2OODP9JU4Az>F64{7W1N0gi&{2BLVp;dPL z&)kUx@|+jF?Wj%U;BcxU^z0x$wfS@^wtg}!eB+cOFx+O5y&Y zQ5X`)b~HM+)RqXv&t}yUM~qVG6_FIGXMKb7=}5G-`mveQDyOo^3gNnxN zy_jw#`E3f*tVpHvIT01L3JYY!x`RJAdU#*_zoKR)Kc8Z1N?y|1#S9JB>PYQTNowWf z9UNzAs`IMlaX+m10{A2s0t!*H}cCo1Z5+fEx zk)grKmCAALHHv-=x|Rc`^a`XgoDk{W3^#HmEiCe&t4=Sl(6;B>e9o1!3t?|29aAeH z#=Oc3IC#eCUlkfMkV7FknsNE`B%$Qn9U+F5d!Qh=0V+N?OFb8n%H7&wd4NPk@q7FT zLcWD~xp;Yn2`e)?qS)-$0B4d& z8Y`Kj+c5mL#k+e)iCJOP=*uGu!-uCD7rOzX=jcX~N0%shSE@8~%OppbJV9r%vrWbA zu{4}*e3;_?oUvVIIpO1jXwxm9@SNdPy!nT<$Maohh@@Aja^pt)1yYgibNaIl{0d{x zaztTOg^5;IS3#Z0!l6K2qE%smdD^O6;mdJANVo~>;~&}o_N`fdl$X=Dc65|9G+^D6 zUmSF`(ePU#-Fq5WHvILeU0=F1y5yFtO`%iY=4f+^Xv$zPh(g9bI}eLr7sHqNGdRHj z#OzR37vhZTW|Z6HZw>8g!|JYx!f~)i`~h`cCiI<;|AtnVmnVOFErE^Fv1?2eKQ%*R zWQxFR@1Lb7Xa4K~ukgU+5>qGbSdQuwDTr$j&G%3@R#9)5= zo?4>|nY0OwY^qkBS1c~G7M(WoN$T4o7O0t>^ZHJ?f_w4sX^4|4>7bdsZ`lhQab)N_ znCKmA3$T7t(n0E-Z!QG;`7kwCi)LyGEuYU^K#0Dmr3RS8)Xm}P64K^RjOp!9wY)6h zb;aTrw}4HsGR5l5C6vb=dKT!8-|FQqG|R6BuwZ52LC2(u6-i8={E$BUEO|nXJ|dgv->C0{#?E@mBfJ2Jf58N$tYXA;EcQjDHw~9c+>nWE#8Iq|Y;g;`&_= zh8Yjpk}zW^$u}1V$AxP_PREm>*O+AomqKZ0FN)Lc!W$Xo+H(j+K((o*H)hCvE%op> zjEJp9x`u4vk1QlSIIy7{@)K=qQA1A1d>y)bxIPCFB9+7fLMrW9!yC`0E?-DlKhD7E z)=3>;*y0O-0ln%KK-e#9gSF*dt1c|-h}AwMZ9$sVB(PD_Q;E(S zRwjp(69;#_^5{9+=pz_zBA3;l?qI?9NmbVyQAQ{U`@?JuelT;^D1Py*Dy3JD?}?pq zR8bTA{JycN*?!FEnbgU~>fFH$DPdxlkrQu|Q{(N+Q_Hm~=zps}`2_{;R*g`Jt|gw< zEHN$?Y!m?Gyx5vZzcVZgh-fnDe&CDDm=iQtE|> zS|?8_#hiPnaVgpQXb;h+4)uh~OtETiBk|7N&0+^TF*cQk>wI3-vhLxiKl)O89;e9n zXvcQA>I=?OmYrmbWz1HEqd5%2mC;lKTS-wT@Iw06i8G6w)dD_J>`PHCO-AtdQloVI zbSn1G@!&0i%&}PN#ojaRyb|#rl&CBwbi9^JUd6feLB5uj&EMo)UB%!`lnEG_&uAK| zC_U-uDi6iB`yx}%%@>yr1|L$0n|sRG?nmZmHE2^#HacscnQp_)clYfuWUD)h`!G^t zN!5We+r`Q-xVLe0f-`=ODA_S1S;FgdqW63A2EHFneOgJYY!fzr?MH6=9i%T)4~6&2 zn*p{A6JzelwH@hw~qVTOFgnjfJ2L<3TpSw6Pj6LnD`KD?$qkPTy0TGlEn zD%0YxDe5Utmp-+Ku)(>ElpEdyJJN3XN#Z32u|QsdX)63~P7r+N_Qc-C!9QP-DmJ5^hWX;x8V@)-+y-UrC z2^H@^B=o9_>W8^3>me7BcnNz8AY)(L)weFwdmoH73VJmyEjg_V0ltq0$*D^NhkWx| zVYSWQxADC)KJdAGY-OWq2n^ki-4z9{egP}C#Y3Hu=jP`JwcmW5oScGg*Es(n5;aAy z7ry9sQ=+fQ+^Uonamwf(31(LZ6Rn4&N)f?B&2w?b*j8CIbG-|VL;+25gx4+Mgro_3H{W8j@9^YrwhjMMI!CBq6NkQMQ} z#>S$2C!w%Hk+JW5r$j!HePD05!)yUomCTr|n0lKW_5FJ_Zcp&zZOe_kcv^nSf})VLbvpxv zdVcJ1OxuFM?gSbsT8~pYYk6&gy6v=kwWom}I)Lzo`8UL&i;r(zxB-IY+);SMDQX^U+$ml~>#nub zqN=Dcw_ZVde|d<-F2bV(h`*JlSTnaZ2AM{NU5YKzKMzgU+`7XZ^O*+}&vM-(mb|iL zN_=O;tYPNmm`yiL4o>=IC~dLC$)WvALN1tHgYGhVoFdiOS5k;FVwm;*J)@jyJr7J$ ztD`y?bxWHRIVBs-?*rAaoqj2D?oa^|D61ADD${rVIR5nI`NZK1mXt9;r{!WQ?3qk& z3#Z4Tve_wq_)D=LOTgr2W=S}k{O~)yASZK|W*(R;Ir07<2)=q<;EVNJsI?atq^Mdg zt6OV)rVo%;A|gnr&qJ(FW-DWM@7d&0P}UwMGkla}YF|&@MQ5VQvgge8zv;{`E*(b& z1wlVQl9aTXq*x6(4-W*letpA@H*}W|8dYfwG^u||kr@`Ey*r{35%X2SvHP{K3(^{J4tld^?8%s)dP4BTfo|*6nRqd`Iiu-^W^Rh^K?9%aSV8R6 z_)c)_>5G|z8_W1Y?-2T44{sCdt%6OJzlmvQ%wzwvaF3!-eGu7Z6t6r4z(SFh$e7mH)MyA7B2ijcsZJ${5zP2tHCb zNfZ)0#0c=dbkXp=g*Q8#FR@6oCg-x?$(T4hT0Soc$zLo6zu?TQ?V<4J*!A6G=%D|5 zfWmjk=RPur7p|03tB|i}V`{osG*&f@j9!9}PY>@1}5cFPF zC7F$7I3}9NP~y8dF6`)|i=lCR*o%OTtzfa!%d^cVkuO?8+Y;KXyiNfwc#rXL6TetO z22BWX@DGumJ2G(a=|ii_x!22A=5p~Q+{__8w=JDemOiI*lXh3EaAqXRSPxL5;K~@*vTcss@ZTJ8V8{~ z$IyuI#SHGbSI(xMA~QEwhmU#V5BIC@AfTB6Q0K#nJg;CK99dodWD*(~v0T3yV&Rx1 zV^O9MuuRq6?1aKL_v9lUp1Bxj$!Sqfd_eJPnz(Mnq5hIE;V16k8DCgc4MTpc#6u+S z@=MyY^wWW~r5PAc4bJbIoEl$qWay;yiGJ7M&H(Z(As8gSfQ*C$mt|MgKgEqEYYW@> zI3r;fLJ^UFI<9&jQR0gZ&IIEegTm^{m=4mXOdTs>9iwEl2qG6EXfo(0g$kkvic%#A!UUnAZTkMDb}-&D z-A|4CGUTL3{1h5T)uj&a{#mQGj<0{67Le8~q&*_P1El8l@Eyo+Y-$USNo$=}bks-K zkpde2Hj5A~6|xP_gMzvjkqFmQl}-aglZcT<_(b_{+a9f7V`-bPAs^ctU8YCh%*4-a zYmdF@ca9Iji*uM{R`muV4h|mvBvE1a4Cv%0y@s=`8p@gNPG}qo6_cH(82vq8aWAjN zGpjO_X|7N7z9bo3Ql1)lPwpHOo?tEdsa%X2hQf6|0}YHWpd2aKJci4B-R3FdM`Y-! zAJx$Ye|~ti*A;=IwhP zgyviRYB~!cIfKTPcEtUg14L!7O0J_jX#O3#FfgWk3Nn&fwhWNfExab#5}V1TBvKK444=eR!=(!b6*rG*xKP$xxS9b3YROy4{V zQPJoIXRzBH4apf&ClvnP+=c=h8bVT;k)QxjwyS_da~TP3l`+&yO)kiiuQ|0C`?GeG z2bQJ{llZW-F}ugqg=rHrGMlTfo`C^a+6^Wiz0S;rG&=M&=m{_k4djwAXe2WF5@-uy zmH0bDL1JN4Xigu}