From b3227046e30ed5a32c2150fc501391a3587fafd4 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 19 May 2016 12:11:02 -0700 Subject: [PATCH 1/7] update notes --- windows/plan/deploy-windows-10-in-a-school.md | 52 +++++++++---------- 1 file changed, 25 insertions(+), 27 deletions(-) diff --git a/windows/plan/deploy-windows-10-in-a-school.md b/windows/plan/deploy-windows-10-in-a-school.md index 53a866f3b8..f1ba01d1a5 100644 --- a/windows/plan/deploy-windows-10-in-a-school.md +++ b/windows/plan/deploy-windows-10-in-a-school.md @@ -49,8 +49,7 @@ This school configuration has the following characteristics: - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - You install the Windows Assessment and Deployment Kit (Windows ADK) on the admin device. - You install the 64-bit version of the Microsoft Deployment Toolkit (MDT) 2013 Update 2 on the admin device. - - **Note**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. +>**Note:**  In this guide, all references to MDT refer to the 64-bit version of MDT 2013 Update 2. - The devices use Azure AD in Office 365 Education for identity management. - If you have on-premises AD DS, you can [integrate Azure AD with on-premises AD DS](http://azure.microsoft.com/en-us/documentation/articles/active-directory-aadconnect/). - Use [Intune](http://technet.microsoft.com/library/jj676587.aspx), [compliance settings in Office 365](https://support.office.com/en-us/article/Manage-mobile-devices-in-Office-365-dd892318-bc44-4eb1-af00-9db5430be3cd?ui=en-US&rs=en-US&ad=US), or [Group Policy](http://technet.microsoft.com/en-us/library/cc725828%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396) in AD DS to manage devices. @@ -140,7 +139,7 @@ Next, install MDT. MDT uses the Windows ADK to help you manage and perform Windo You can use MDT to deploy 32-bit or 64-bit versions of Windows 10. Install the 64-bit version of MDT to support deployment of 32-bit and 64-bit operating systems. -**Note**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. +>**Note:**  If you install the 32-bit version of MDT, you can install only 32-bit versions of Windows 10. Ensure that you download and install the 64-bit version of MDT so that you can install 64-bit and 32 bit versions of the operating system. For more information about installing MDT on the admin device, see [Installing a New Instance of MDT](https://technet.microsoft.com/en-us/library/dn759415.aspx#InstallingaNewInstanceofMDT). @@ -225,13 +224,13 @@ You will use the Office 365 Education license plan information you record in Tab To create a new Office 365 Education subscription for use in the classroom, use your educational institution’s email account. There are no costs to you or to students for signing up for Office 365 Education subscriptions. -**Note**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). +>**Note:**  If you already have an Office 365 Education subscription, you can use that subscription and continue to the next section, [Add domains and subdomains](#add-domains-and-subdomains). #### To create a new Office 365 subscription 1. In Microsoft Edge or Internet Explorer, type `https://portal.office.com/start?sku=faculty` in the address bar. - **Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following: + >**Note**  If you have already used your current sign-in account to create a new Office 365 subscription, you will be prompted to sign in. If you want to create a new Office 365 subscription, start an In-Private Window in one of the following:
- Microsoft Edge by opening the Microsoft Edge app, either pressing Ctrl+Shift+P or clicking or tapping **More actions**, and then clicking or tapping **New InPrivate window**. - Internet Explorer 11 by opening Internet Explorer 11, either pressing Ctrl+Shift+P or clicking or tapping **Settings**, clicking or tapping **Safety**, and then clicking or tapping **InPrivate Browsing**. @@ -256,7 +255,7 @@ Now that you have created your new Office 365 Education subscription, add the do To make it easier for faculty and students to join your Office 365 Education subscription (or *tenant*), allow them to automatically sign up to your tenant (*automatic tenant join*). In automatic tenant join, when a faculty member or student signs up for Office 365, Office 365 automatically adds (joins) the user to your Office 365 tenant. -**Note**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. +>**Note:**  By default, automatic tenant join is enabled in Office 365 Education, with the exception of certain areas in Europe, the Middle East, and Africa. These countries require opt-in steps to add new users to existing Office 365 tenants. Check your country requirements to determine the automatic tenant join default configuration. Also, if you use Azure AD Connect, then automatic tenant join is disabled. Office 365 uses the domain portion of the user’s email address to know which Office 365 tenant to join. For example, if a faculty member or student provides an email address of user@contoso.edu, then Office 365 automatically performs one of the following tasks: @@ -265,7 +264,7 @@ Office 365 uses the domain portion of the user’s email address to know which O You will always want faculty and students to join the Office 365 tenant that you created. Ensure that you perform the steps in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) and [Add domains and subdomains](#add-domains-and-subdomains) sections before allowing other faculty and students to join Office 365. -**Note**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. +>**Note:**  You cannot merge multiple tenants, so any faculty or students who create their own tenant will need to abandon their existing tenant and join yours. All new Office 365 Education subscriptions have automatic tenant join enabled by default, but you can enable or disable automatic tenant join by using the Windows PowerShell commands in Table 3. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -277,13 +276,13 @@ All new Office 365 Education subscriptions have automatic tenant join enabled by | Enable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $true`| | Disable |`Set-MsolCompanySettings -AllowEmailVerifiedUsers $false`|

-**Note**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. +>**Note:**  If your institution has AD DS, then disable automatic tenant join. Instead, use Azure AD integration with AD DS to add users to your Office 365 tenant. ### Disable automatic licensing To reduce your administrative effort, automatically assign Office 365 Education or Office 365 Education Plus licenses to faculty and students when they sign up (automatic licensing). Automatic licensing also enables Office 365 Education or Office 365 Education Plus features that do not require administrative approval. -**Note**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. +>**Note:**  By default, automatic licensing is enabled in Office 365 Education. If you want to use automatic licensing, then skip this section and go to the next section. Although all new Office 365 Education subscriptions have automatic licensing enabled by default, you can enable or disable it for your Office 365 tenant by using the Windows PowerShell commands in Table 4. For more information about how to run these commands, see [How can I prevent students from joining my existing Office 365 tenant](https://support.office.com/en-us/article/Office-365-Education-Self-Sign-up-Technical-FAQ-7fb1b2f9-94c2-4cbb-b01e-a6eca34261d6?ui=en-US&rs=en-US&ad=US#BKMK_PreventJoins). @@ -336,7 +335,7 @@ Now that you have an Office 365 subscription, you need to determine how you will In this method, you have an on-premises AD DS domain. As shown in Figure 4, the Azure AD Connector tool automatically synchronizes AD DS with Azure AD. When you add or change any user accounts in AD DS, the Azure AD Connector tool automatically updates Azure AD. -**Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). +>**Note:**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](https://technet.microsoft.com/en-us/library/dn510997.aspx?f=255&MSPPError=-2147217396). ![fig 4](images/deploy-win-10-school-figure4.png) @@ -365,7 +364,7 @@ In this section, you selected the method for creating user accounts in your Offi You can integrate your on-premises AD DS domain with Azure AD to provide identity management for your Office 365 tenant. With this integration, you can synchronize the users, security groups, and distribution lists in your AD DS domain with Azure AD with the Azure AD Connect tool. Users will be able to sign in to Office 365 automatically by using their email account and the same password they use to sign in to AD DS. -**Note**  If your institution does not have an on-premises AD DS domain, you can skip this section. +>**Note:**  If your institution does not have an on-premises AD DS domain, you can skip this section. ### Select synchronization model @@ -426,7 +425,7 @@ In this section, you selected your synchronization model, deployed Azure AD Conn You can bulk-import user and group accounts into your on-premises AD DS domain. Bulk-importing accounts helps reduce the time and effort needed to create users compared to creating the accounts manually in the Office 365 Admin portal. First, you select the appropriate method for bulk-importing user accounts into AD DS. Next, you create the .csv file that contains the user accounts. Finally, you use the selected method to import the .csv file into AD DS. -**Note**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. +>**Note:**  If your institution doesn’t have an on-premises AD DS domain, you can skip this section. ### Select the bulk import method @@ -456,7 +455,7 @@ After you have selected your user and group account bulk import method, you’re With the bulk-import source file finished, you’re ready to import the user and group accounts into AD DS. The steps for importing the file are slightly different for each method. -**Note**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. +>**Note:**  Bulk-import your group accounts first, and then import your user accounts. Importing in this order allows you to specify group membership when you import your user accounts. For more information about how to import user accounts into AD DS by using: @@ -482,7 +481,7 @@ The bulk-add process assigns the same Office 365 Education license plan to all u For more information about how to bulk-add users to Office 365, see [Add several users at the same time to Office 365](https://support.office.com/en-us/article/Add-several-users-at-the-same-time-to-Office-365-Admin-Help-1f5767ed-e717-4f24-969c-6ea9d412ca88?ui=en-US&rs=en-US&ad=US). -**Note**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. +>**Note:**  If you encountered errors during bulk add, resolve them before you continue the bulk-add process. You can view the log file to see which users caused the errors, and then modify the .csv file to correct the problems. Click **Back** to retry the verification process. The email accounts are assigned temporary passwords upon creation. You must communicate these temporary passwords to your users before they can sign in to Office 365. @@ -490,13 +489,13 @@ The email accounts are assigned temporary passwords upon creation. You must comm Assign SharePoint Online resource permissions to Office 365 security groups, not individual user accounts. For example, create one security group for faculty members and another for students. Then, you can assign unique SharePoint Online resource permissions to faculty members and a different set of permissions to students. Add or remove users from the security groups to grant or revoke access to SharePoint Online resources. -**Note**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +>**Note:**  If your institution has AD DS, don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. For information about creating security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). You can add and remove users from security groups at any time. -**Note**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. +>**Note:**  Office 365 evaluates group membership when users sign in. If you change group membership for a user, that user may need to sign out, and then sign in again for the change to take effect. ### Create email distribution groups @@ -504,7 +503,7 @@ Microsoft Exchange Online uses an email distribution group as a single email rec You can create email distribution groups based on job role (such as teachers, administration, or students) or specific interests (such as robotics, drama club, or soccer team). You can create any number of distribution groups, and users can be members of more than one group. -**Note**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. +>**Note:**  Office 365 can take some time to complete the Exchange Online creation process. You will have to wait until Office 365 completes the Exchange Online creation process before you can perform the following steps. For information about how to create security groups, see [Create and manage Office 365 groups in Admin Center Preview](https://support.office.com/en-us/article/Create-and-manage-Office-365-groups-in-Admin-Center-Preview-93df5bd4-74c4-45e8-9625-56db92865a6e?ui=en-US&rs=en-US&ad=US). @@ -542,7 +541,8 @@ To create and configure your Windows Store for Business portal, simply use the a #### To create and configure a Windows Store for Business portal 1. In Microsoft Edge or Internet Explorer, type `http://microsoft.com/business-store` in the address bar. -2. On the **Windows Store for Business** page, click **Sign in with an organizational account**.

**Note**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. +2. On the **Windows Store for Business** page, click **Sign in with an organizational account**. +>**Note:**  If your institution has AD DS, then don’t create security accounts in Office 365. Instead, create the security groups in AD DS, and then use Azure AD integration to synchronize the security groups with your Office 365 tenant. 3. On the Windows Store for Business sign-in page, use the administrative account for the Office 365 subscription you created in the [Create a new Office 365 Education subscription](#create-a-new-office-365-education-subscription) section to sign in. 4. On the **Windows Store for Business Services Agreement** page, review the agreement, select the **I accept this agreement and certify that I have the authority to bind my organization to its terms** check box, and then click **Accept** 5. In the **Welcome to the Windows Store for Business** dialog box, click **OK**. @@ -565,7 +565,7 @@ After you create the Windows Store for Business portal, configure it by using th Now that you have created your Windows Store for Business portal, you’re ready to find, acquire, and distribute apps that you will add to your portal. You do this by using the Inventory page in Windows Store for Business. -**Note**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. +>**Note:**  Your educational institution can now use a credit card or purchase order to pay for apps in Windows Store for Business. You can deploy apps to individual users or make apps available to users through your private store. Deploying apps to individual users restricts the app to those specified users. Making apps available through your private store allows all your users. @@ -596,11 +596,11 @@ Depending on your school’s requirements, you may need any combination of the f - Upgrade institution-owned devices to Windows 10 Education. - Deploy new instances of Windows 10 Education so that new devices have a known configuration. -**Note**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. +>**Note:**  Although you can use Windows 10 Home on institution-owned devices, Microsoft recommends that you use Windows 10 Pro or Windows 10 Education, instead. Windows 10 Pro and Windows 10 Education provide support for MDM, policy-based management, and Windows Store for Business. These features are not available in Windows 10 Home. One other consideration is the mix of processor architectures you will support. If you can, support only 64-bit versions of Windows 10. If you have devices that can run only 32 bit versions of Windows 10, you will need to import both 64-bit and 32-bit versions of the Windows 10 editions listed above. -**Note**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. +>**Note:**  On devices that have minimal system resources (such as devices with only 2 GB of memory or 32 GB of storage), use 32-bit versions of Windows 10 because 64-bit versions of Windows 10 place more stress on device system resources. Finally, as a best practice, minimize the number of operating systems that you deploy and manage. If possible, standardize institution-owned devices on one Windows 10 edition (such as a 64-bit version of Windows 10 Education or Windows 10 Pro). Of course, you cannot standardize personal devices on a specific operating system version or processor architecture. @@ -738,9 +738,7 @@ In addition, you must prepare your environment for sideloading (deploying) Windo To help reduce the effort needed to deploy Microsoft Office 2016 desktop apps, use the Office Deployment Tool, as described in [Deploy Click-to-Run for Office 365 products by using the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219423.aspx?f=255&MSPPError=-2147217396).

-If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

- -**Note**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

+If you have Intune, you can deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section. This method provides granular deployment of Windows desktop apps, and you can use it for ongoing management of the apps. This is the preferred method for deploying and managing Windows desktop apps.

**Note:**  You can also deploy Windows desktop apps after you deploy Windows 10, as described in the [Deploy apps by using Intune](#deploy-apps-by-using-intune) section.

For more information about how to create an MDT application for Window desktop apps, see [Create a New Application in the Deployment Workbench](https://technet.microsoft.com/en-us/library/dn759415.aspx#CreateaNewApplicationintheDeploymentWorkbench). @@ -897,7 +895,7 @@ Microsoft has several recommended settings for educational institutions. Table 1 Use of Microsoft accounts You want faculty and students to use only Azure AD accounts for institution-owned devices. For these devices, do not use Microsoft accounts or associate a Microsoft account with the Azure AD accounts.

-**Note**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

+**Note:**  Personal devices typically use Microsoft accounts. Faculty and students can associate their Microsoft account with their Azure AD account on these devices.

**Group Policy.** Configure the [Accounts: Block Microsoft accounts](https://technet.microsoft.com/en-us/library/jj966262.aspx?f=255&MSPPError=-2147217396) Group Policy setting to use the Users can’t add Microsoft accounts setting option.

**Intune.** Enable or disable the camera by using the **Allow Microsoft account**, **Allow adding non-Microsoft accounts manually**, and **Allow settings synchronization for Microsoft accounts** policy settings under the **Accounts and Synchronization** section of a **Windows 10 General Configuration** policy. @@ -1042,7 +1040,7 @@ Prior to deployment of Windows 10, ensure that you complete the tasks listed in Use the Deployment Wizard to deploy Windows 10. The LTI deployment process is almost fully automated: You provide only minimal information to the Deployment Wizard at the beginning of the process. After the wizard collects the necessary information, the remainder of the process is fully automated. -**Note**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). +>**Note:**  To fully automate the LTI deployment process, complete the steps in the “Fully Automated LTI Deployment Scenario” section in the [Microsoft Deployment Toolkit Samples Guide](https://technet.microsoft.com/en-us/library/dn781089.aspx). In most instances, deployments occur without incident. Only in rare occasions do deployments experience problems. @@ -1055,7 +1053,7 @@ In most instances, deployments occur without incident. Only in rare occasions do After you have deployed Windows 10, the devices are almost ready for use. First, you must set up the printers that each classroom will use. Typically, you connect the printers to the same network as the devices in the same classroom. If you don’t have printers in your classrooms, skip this section and proceed to the [Verify deployment](#verify-deployment) section. -**Note**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. +>**Note:**  If you’re performing an upgrade instead of a new deployment, the printers remain configured as they were in the previous version of Windows. As a result, you can skip this section and proceed to the [Verify deployment](#verify-deployment) section. #### To set up printers From 15e9cedb168240e5ed9bbc745d444d37e9ac364c Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 19 May 2016 16:18:36 -0700 Subject: [PATCH 2/7] fixing spacing issues --- ...advanced-security-audit-policy-settings.md | 48 +- ...ackup-tpm-recovery-information-to-ad-ds.md | 90 +- .../basic-audit-account-logon-events.md | 14 +- .../basic-audit-account-management.md | 262 +--- .../basic-audit-directory-service-access.md | 19 +- .../keep-secure/basic-audit-logon-events.md | 41 +- .../keep-secure/basic-audit-object-access.md | 257 +--- .../keep-secure/basic-audit-policy-change.md | 160 +-- .../keep-secure/basic-audit-privilege-use.md | 53 +- .../basic-audit-process-tracking.md | 91 +- .../keep-secure/basic-audit-system-events.md | 84 +- .../basic-security-audit-policies.md | 47 +- .../basic-security-audit-policy-settings.md | 71 +- .../keep-secure/bcd-settings-and-bitlocker.md | 1119 +++-------------- .../keep-secure/bitlocker-basic-deployment.md | 197 ++- 15 files changed, 760 insertions(+), 1793 deletions(-) diff --git a/windows/keep-secure/advanced-security-audit-policy-settings.md b/windows/keep-secure/advanced-security-audit-policy-settings.md index 5f82176445..5b5faf0b14 100644 --- a/windows/keep-secure/advanced-security-audit-policy-settings.md +++ b/windows/keep-secure/advanced-security-audit-policy-settings.md @@ -2,52 +2,74 @@ title: Advanced security audit policy settings (Windows 10) description: This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. ms.assetid: 93b28b92-796f-4036-a53b-8b9e80f9f171 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Advanced security audit policy settings + **Applies to** - Windows 10 + This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. + The security audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** can help your organization audit compliance with important business-related and security-related rules by tracking precisely defined activities, such as: + - A group administrator has modified settings or data on servers that contain finance information. - An employee within a defined group has accessed an important file. - The correct system access control list (SACL) is applied to every file and folder or registry key on a computer or file share as a verifiable safeguard against undetected access. + You can access these audit policy settings through the Local Security Policy snap-in (secpol.msc) on the local computer or by using Group Policy. + These advanced audit policy settings allow you to select only the behaviors that you want to monitor. You can exclude audit results for behaviors that are of little or no concern to you, or behaviors that create an excessive number of log entries. In addition, because security audit policies can be applied by using domain Group Policy Objects, audit policy settings can be modified, tested, and deployed to selected users and groups with relative simplicity. Audit policy settings under **Security Settings\\Advanced Audit Policy Configuration** are available in the following categories: + **Account Logon** + Configuring policy settings in this category can help you document attempts to authenticate account data on a domain controller or on a local Security Accounts Manager (SAM). Unlike Logon and Logoff policy settings and events, which track attempts to access a particular computer, settings and events in this category focus on the account database that is used. This category includes the following subcategories: + - [Audit Credential Validation](audit-credential-validation.md) - [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) - [Audit Kerberos Service Ticket Operations](audit-kerberos-service-ticket-operations.md) - [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) + **Account Management** + The security audit policy settings in this category can be used to monitor changes to user and computer accounts and groups. This category includes the following subcategories: + - [Audit Application Group Management](audit-application-group-management.md) - [Audit Computer Account Management](audit-computer-account-management.md) - [Audit Distribution Group Management](audit-distribution-group-management.md) - [Audit Other Account Management Events](audit-other-account-management-events.md) - [Audit Security Group Management](audit-security-group-management.md) - [Audit User Account Management](audit-user-account-management.md) + **Detailed Tracking** + Detailed Tracking security policy settings and audit events can be used to monitor the activities of individual applications and users on that computer, and to understand how a computer is being used. This category includes the following subcategories: + - [Audit DPAPI Activity](audit-dpapi-activity.md) - [Audit PNP activity](audit-pnp-activity.md) - [Audit Process Creation](audit-process-creation.md) - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) + **DS Access** + DS Access security audit policy settings provide a detailed audit trail of attempts to access and modify objects in Active Directory Domain Services (AD DS). These audit events are logged only on domain controllers. This category includes the following subcategories: + - [Audit Detailed Directory Service Replication](audit-detailed-directory-service-replication.md) - [Audit Directory Service Access](audit-directory-service-access.md) - [Audit Directory Service Changes](audit-directory-service-changes.md) - [Audit Directory Service Replication](audit-directory-service-replication.md) + **Logon/Logoff** + Logon/Logoff security policy settings and audit events allow you to track attempts to log on to a computer interactively or over a network. These events are particularly useful for tracking user activity and identifying potential attacks on network resources. This category includes the following subcategories: + - [Audit Account Lockout](audit-account-lockout.md) - [Audit User/Device Claims](audit-user-device-claims.md) - [Audit IPsec Extended Mode](audit-ipsec-extended-mode.md) @@ -59,10 +81,15 @@ Logon/Logoff security policy settings and audit events allow you to track attemp - [Audit Network Policy Server](audit-network-policy-server.md) - [Audit Other Logon/Logoff Events](audit-other-logonlogoff-events.md) - [Audit Special Logon](audit-special-logon.md) + **Object Access** + Object Access policy settings and audit events allow you to track attempts to access specific objects or types of objects on a network or computer. To audit attempts to access a file, directory, registry key, or any other object, you must enable the appropriate object Aaccess auditing subcategory for success and/or failure events. For example, the file system subcategory needs to be enabled to audit file operations, and the Registry subcategory needs to be enabled to audit registry accesses. + Proving that these audit policies are in effect to an external auditor is more difficult. There is no easy way to verify that the proper SACLs are set on all inherited objects. To address this issue, see [Global Object Access Auditing](#bkmk-globalobjectaccess). + This category includes the following subcategories: + - [Audit Application Generated](audit-application-generated.md) - [Audit Certification Services](audit-certification-services.md) - [Audit Detailed File Share](audit-detailed-file-share.md) @@ -77,35 +104,46 @@ This category includes the following subcategories: - [Audit Removable Storage](audit-removable-storage.md) - [Audit SAM](audit-sam.md) - [Audit Central Access Policy Staging](audit-central-access-policy-staging.md) + **Policy Change** + Policy Change audit events allow you to track changes to important security policies on a local system or network. Because policies are typically established by administrators to help secure network resources, monitoring changes or attempts to change these policies can be an important aspect of security management for a network. This category includes the following subcategories: + - [Audit Audit Policy Change](audit-audit-policy-change.md) - [Audit Authentication Policy Change](audit-authentication-policy-change.md) - [Audit Authorization Policy Change](audit-authorization-policy-change.md) - [Audit Filtering Platform Policy Change](audit-filtering-platform-policy-change.md) - [Audit MPSSVC Rule-Level Policy Change](audit-mpssvc-rule-level-policy-change.md) - [Audit Other Policy Change Events](audit-other-policy-change-events.md) + **Privilege Use** + Permissions on a network are granted for users or computers to complete defined tasks. Privilege Use security policy settings and audit events allow you to track the use of certain permissions on one or more systems. This category includes the following subcategories: + - [Audit Non-Sensitive Privilege Use](audit-non-sensitive-privilege-use.md) - [Audit Sensitive Privilege Use](audit-sensitive-privilege-use.md) - [Audit Other Privilege Use Events](audit-other-privilege-use-events.md) + **System** + System security policy settings and audit events allow you to track system-level changes to a computer that are not included in other categories and that have potential security implications. This category includes the following subcategories: + - [Audit IPsec Driver](audit-ipsec-driver.md) - [Audit Other System Events](audit-other-system-events.md) - [Audit Security State Change](audit-security-state-change.md) - [Audit Security System Extension](audit-security-system-extension.md) - [Audit System Integrity](audit-system-integrity.md) + **Global Object Access** + Global Object Access Auditing policy settings allow administrators to define computer system access control lists (SACLs) per object type for the file system or for the registry. The specified SACL is then automatically applied to every object of that type. Auditors will be able to prove that every resource in the system is protected by an audit policy by viewing the contents of the Global Object Access Auditing policy settings. For example, if auditors see a policy setting called "Track all changes made by group administrators," they know that this policy is in effect. + Resource SACLs are also useful for diagnostic scenarios. For example, setting the Global Object Access Auditing policy to log all the activity for a specific user and enabling the policy to track "Access denied" events for the file system or registry can help administrators quickly identify which object in a system is denying a user access. -**Note**   -If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy. + +> **Note:**  If a file or folder SACL and a Global Object Access Auditing policy setting (or a single registry setting SACL and a Global Object Access Auditing policy setting) are configured on a computer, the effective SACL is derived from combining the file or folder SACL and the Global Object +Access Auditing policy. This means that an audit event is generated if an activity matches the file or folder SACL or the Global Object Access Auditing policy.   This category includes the following subcategories: - [File System (Global Object Access Auditing)](file-system-global-object-access-auditing.md) - [Registry (Global Object Access Auditing)](registry-global-object-access-auditing.md) -  -  diff --git a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md index dfc256208f..5f46d91a0d 100644 --- a/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md +++ b/windows/keep-secure/backup-tpm-recovery-information-to-ad-ds.md @@ -2,90 +2,128 @@ title: Backup the TPM recovery Information to AD DS (Windows 10) description: This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. ms.assetid: 62bcec80-96a1-464e-8b3f-d177a7565ac5 -ms.pagetype: security ms.prod: W10 ms.mktglfcycl: deploy ms.sitesec: library +ms.pagetype: security author: brianlic-msft --- + # Backup the TPM recovery Information to AD DS + **Applies to** - Windows 10 + This topic for the IT professional describes how to back up a computer’s Trusted Platform Module (TPM) information to Active Directory Domain Services (AD DS) so that you can use AD DS to administer the TPM from a remote computer. + ## About administering TPM remotely + Backing up the TPM owner information for a computer allows administrators in a domain to remotely configure the TPM security hardware on the local computer. For example, administrators might want to reset the TPM to the manufacturer’s defaults when they decommission or repurpose computers, without having to be present at the computer. + You can use AD DS to store TPM owner information for use in recovery situations where the TPM owner has forgotten the password or where you must take control of the TPM. There is only one TPM owner password per computer; therefore, the hash of the TPM owner password can be stored as an attribute of the computer object in AD DS. The attribute has the common name (CN) of **ms-TPM-OwnerInformation**. -**Note**   -The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored. + +> **Note:**  The TPM owner authorization value is stored in AD DS, and it is present in a TPM owner password file as a SHA-1 hash of the TPM owner password, which is base 64–encoded. The actual owner password is not stored.   Domain controllers running Windows Server 2012 R2 or Windows Server 2012 include the required AD DS schema objects by default. However, if your domain controller is running Windows Server 2008 R2, you need to update the schema as described in [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + This topic contains procedures, some of which are dependent on Visual Basic scripts, to recover TPM information and decommission TPM on remote computers. Sample scripts are available, which you can customize to meet the requirements of your environment. + In this topic: + 1. [Check status of prerequisites](#bkmk-prereqs) 2. [Set permissions to back up password information](#bkmk-setperms) 3. [Configure Group Policy to back up TPM recovery information in AD DS](#bkmk-configuregp) 4. [Use AD DS to recover TPM information](#bkmk-useit) 5. [Sample scripts](#bkmk-adds-tpm-scripts) + ## Check status of prerequisites + Before you begin your backup, ensure that the following prerequisites are met: + 1. All domain controllers that are accessible by client computers that will be using TPM services are running Windows Server 2012 R2, Windows Server 2012, or Windows Server 2008 R2 with the updated schema. - **Tip**   - For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md). + + > **Tip:**  For more info about the schema extensions that are required for a TPM backup in Active Directory domains that are running Windows Server 2008 R2, see [AD DS schema extensions to support TPM backup](ad-ds-schema-extensions-to-support-tpm-backup.md).   2. You have domain administrator rights in the target forest, or you are using an account that has been granted appropriate permissions to extend the schema for the target forest. Members of the Enterprise Admins or Schema Admins groups are examples of accounts that have the appropriate permissions. + ## Set permissions to back up password information + This procedure uses the sample script [Add-TPMSelfWriteACE.vbs](#bkmk-add-tpmselfwriteace) to add an access control entry (ACE) so that backing up TPM recovery information is possible. A client computer cannot back up TPM owner information until this ACE is added. + This script is run on the domain controller that you will use to administer the TPM recovery information, and it operates under the following assumptions: + - You have domain administrator credentials to set permissions for the top-level domain object. - Your target domain is the same as the domain for the user account that is running the script. For example, running the script as TESTDOMAIN\\admin will extend permissions for TESTDOMAIN. - **Note**   - You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: + + > **Note:**  You might need to modify the sample script if you want to set permissions for multiple domains, but you do not have domain administrator accounts for each of those domains. Find the variable **strPathToDomain** in the script, and modify it for your target domain, for example: `LDAP://DC=testdomain,DC=nttest,DC=microsoft,DC=com`   - Your domain is configured so that permissions are inherited from the top-level domain object to targeted computer objects. - Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. + + Permissions will not take effect if any container in the hierarchy does not allow inherited permissions. By default, permissions inheritance is set in AD DS. If you are not sure whether your configuration differs from this default, you can continue with the setup steps to set the permissions. + You can then verify your configuration as described later in this topic. Or you can click the **Effective Permissions** button while viewing the properties of a computer object, then check that **Self** is approved to write the **msTPM-OwnerInformation** attribute. + **To add an ACE to allow TPM recovery information backup** + 1. Open the sample script **Add-TPMSelfWriteACE.vbs**. + The script contains a permission extension, and you must modify the value of **strPathToDomain** by using your domain name. + 2. Save your modifications to the script. 3. Type the following at a command prompt, and then press ENTER: + **cscript Add-TPMSelfWriteACE.vbs** + This script adds a single ACE to the top-level domain object. The ACE is an inheritable permission that allows the computer (SELF) to write to the **ms-TPM-OwnerInformation** attribute for computer objects in the domain. Complete the following procedure to check that the correct permissions are set and to remove TPM and BitLocker ACEs from the top-level domain, if necessary. + **Manage ACEs configured on TPM schema objects** + 1. Open the sample script **List-ACEs.vbs**. 2. Modify **List-ACEs.vbs**. + You must modify: - Value of **strPathToDomain**: Use your domain name. - Filter options: The script sets a filter to address BitLocker and TPM schema objects, so you must modify **If IsFilterActive ()** if you want to list or remove other schema objects. + 3. Save your modifications to the script. 4. Type the following at a command prompt, and then press ENTER: + **cscript List-ACEs.vbs** + With this script you can optionally remove ACEs from BitLocker and TPM schema objects on the top-level domain. + ## Configure Group Policy to back up TPM recovery information in AD DS + Use these procedures to configure the [TPM Group Policy settings](trusted-platform-module-services-group-policy-settings.md#bkmk-tpmgp-addsbu) policy setting on a local computer. In a production environment, an efficient way to do this is to create or edit a Group Policy Object (GPO) that can target client computers in the domain. + **To enable local policy setting to back up TPM recovery information to AD DS** + 1. Sign in to a domain-joined computer by using a domain account that is a member of the local Administrators group. 2. Open the Local Group Policy Editor (gpedit.msc), and in the console tree, navigate to **Computer Configuration\\Administrative Templates\\System**. 3. Click **Trusted Platform Module Services**. 4. Double-click **Turn on TPM backup to Active Directory Domain Services**. 5. Click **Enabled**, and then click **OK**. -**Important**   -When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds. +> **Important:**  When this setting is enabled, the TPM owner password cannot be set or changed unless the computer is connected to the domain and AD DS backup of the TPM recovery information succeeds.   ## Use AD DS to recover TPM information + When you need to recover the TPM owner information from AD DS and use it to manage the TPM, you need to read the **ms-TPM-OwnerInformation** object from AD DS, and then manually create a TPM owner password backup file that can be supplied when TPM owner credentials are required. + **To obtain TPM owner backup information from AD DS and create a password file** + 1. Sign in to a domain controller by using domain administrator credentials. 2. Copy the sample script file, [Get-TPMOwnerInfo.vbs](#ms-tpm-ownerinformation), to a location on your computer. 3. Open a Command Prompt window, and change the default location to the location of the sample script files you saved in the previous step. 4. At the command prompt, type **cscript Get-TPMOwnerInfo.vbs**. + The expected output is a string that is the hash of the password that you created earlier. - **Note**   - If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. + > **Note:**  If you receive the error message, "Active Directory: The directory property cannot be found in the cache," verify that you are using a domain administrator account, which is required to read the **ms-TPM-OwnerInformation** attribute. + The only exception to this requirement is that if users are the Creator Owner of computer objects that they join to the domain, they can possibly read the TPM owner information for their computer objects.   5. Open Notepad or another text editor, and copy the following code sample into the file, and replace *TpmOwnerPasswordHash* with the string that you recorded in the previous step. + ``` syntax UNNz* zgW*o3C#D+;-pktS+hg0q+atNwhR-q*a{TqEvO}#rVkLvKkFw9c4{e&tDy&wJuDo87 zr;5rEt0hvI*Q8vn6k76y-8G$iJP1=-wy-ikX%^Q4%i_VZ`pBgXbv=pjTgnu8X7pI{ zDCG$9*8MYL2u9Fgm^n301~v?~IgUGab*fwu&TJ&kpei#L%W3Li8giPwng(qXtq(^0 z2z-)E5@iw|Et6_#Sy97)bf_fFV<(`p4po*_){EhbG3EJr?y4Be ztPAn-+QrU>;?0_nyaSarqX7dn*Al{)v6}jCSOBy zBP{dg{;IxCC#zSTb+Y$!Xm?EzmGDe2ry>g4Xh7!?#Z~^IqGhE&D>>W)Mxab zm#kJ_a9&tmgs$a`vFFfaYqB{{^$m$`DeX@SBIG17TW?nQDTpcrnl~PjF&Q((gDV$n znhV{_9tIHZsgv6u7GyWH@LA z${4NqR=C>O+XM#~%{0g6HL^6MZDjGe8ELCH?QFU>U(atscd~X6cD=DunTB*7Jo6@c zZ-a|5OBvDVd6I?X!oGb?{40z?TY?!yas9=eA_m^Gm!Q|2lxdoCI&4W)hnDc$wG^$q z*Uz)~4h~Q9ezrpT{nj5;rEwi{h;r*0JlUA(Zp5~%{5+j3K|kZ;97W1VrH}eUOde6FaXF%jcREy3W*dcQe^V~arfZKc^MC4gKAT{EJsFjil;!Kk__SuQn&0Go zXgslLg=~M>hT^h4BmNP2$lJj?p>y5ha$UE&{{`FvPOs+Cw>@z=;d@V*RTyl~Y)`Lh z)v<29@ak;zHhVb6%jTL`zwPwA!u(j6&*tV|@4WG{f9QX>+r(V=bE0~i7;Rs6r@E-@ zQ0UOV6*?DQ7F`dW7u0@VTe@8Hx9V}vy_sHc4oC z*jP$g9ss;303aX;0G>Yn@nZmRWd?u~0|4Mj1pqAjpZfh000{qww3x7}$I4l{rJ@QL zeei>ci5^;ow^Dw+*+S*M2}Kr1Jhu^E7_o$*;bbW<0FNQU&Dn)|2~=nm?^x~@pSQ_tE=!_%O|A@Or>LL6f{`c*qVdRRpfAXE8d7+*sE-0Ca#Arcgm;nryPneAt=2! zd?m}+qjg3AbdWFrDU8DM89M@sHBHV$(=~@cV^yc+ePnK-z91Ay0~~dF5V5)|tSjIh$-sm*T=?u2 zYs&VfPndM!VKXf67S`J2m;M}FDS4u!=MwjD$|1mb+zO8qf>K9Y{c~W{f3X0mj^b%y z41*vMme{i{R1XM1YNk8@Q*BbSqlC_~x*M7D>-xn)Gs~{*i$$E)$CqyB>pdE4EP5l4zy_?8s>%XK zJAPV^UT4q!?r#ZUQ7n=E9uu;zp{HR7>!I+o9j+U1MSE1@6wuK3InV1VUc7B|3w5cd zSZK{8Fg@qIq2+-X{vcq}0Rg9xUUmTu?wzdrvyI11Q9NHi@k$0W)92L%t6Ri+d zDnd06s|`=s*A?_7G+~{$*#BgUI~BBC91G7*$$FM-ZExpwC_ld6a0vEN9*e-tcwwKP z=PG0WeSO4|H)?(1On;Vx7k9=%T=t=@Dw&nLd48>fH1UuV=h!RBF*w~nyhydQ+&{eB zFFjUQ5jko~me`kc8Uv;dr3J z&?>-#tuGAhs$a)vcQQ`OVjP0qpb#*w>hIV%XWMCjD9M!Uzfk1O_ zDqEMPyJY?(D}xo^t5X6u-NG-=^PjK&)=xoJjNa(KA*jn2owR+y0TA(2zLrwT3W93!s%!joA_l$%e_fc5bt}$^Ax{E0@$F>D%4sJ zWXYQr2dk9jm<2`88b5ml^LhXvMLp(Ok73h!Ywei#)%Hz5EB1`y^1A3m@=*0{y>Z$u z`HsxHxFo7xbZw0|b(b-xAFXV zXJngfTV59>1-I$t_nNVht{t+&S0Afp{r)b*NIz)>OKAL$N#p+55TCb_@Gpj6b(J(c z%8HP2cmnQS@8=dd@J1(1tPvs_R(cmYf9MokXyvJEJLp;0-axo7D7R>ReXF#_y0Dxw zI350cmj1>WP%>@227x96wY5`*mr>*?w<)n3JOOeWqi}2PYCfTxLr28NU!d;!B&Qzi z<%M)BFHrC~9I$ktY|;4y&=lN5_gURI`}*H%+@VrX+?MYb4kyPv^gx zM5`iWBEr5%Dwe)I%8LCN^Y2QQXP-==GETHa%@TbG$rso*eD>7CKhkjH<*B0l zgq&Majgh<_MVH;2?E-H>YUV3NEy0+Wm=Ub8D-I2q2>nBK>E!e}i;i!@%Q+$2OCt9D z-#IdN+K+nsdZ~$7`JxaVY&0RWVBms#1BRy!=vA~5l}lX+$9Od)!@qjt@))&wF84U) zqQFmLu0T31)r=p1Z$Me}Lxu`CYuCg=&!$<{W=$@3rM7;>vf0ayX)C}r%!t!2HepI9 zcunRvMd-sb$vLZ+$xmFInOC$@@ytST(M65L6!jI1=iR?NxA3NJzN3z6JnrBleA^)3tP3L5oQ_8?((X`}N8Q z-<#0HrOC0((=#eQaP@N~vha3Y!};gIhNgWd*L7a;`T%1#Iv_k@VI6zth<}Gh+*6J6J7Nc1Q%NR;Toox^>rVu2$QXKYeWnJxF znMoqk_M30SvK8MbREK4v8r2K%nlGKKHd;$oR(o<8kMw|L#xiwK8Tqx@wpLGt$r{TC z{Hp4@)%Em{gdAPcZvQ@s7Lv_P2t4h`VG-*jPSjty*0d)d%^k6>aT1#%143@q9VUMH zQC|pyUc_skPs&Qh-%0%Z82^&oA2*6v!*K+c(wfv_Kih(nD@AP{TN0M93Lwm(y1tB= zsjR9?e$=s!Y^;n781~4L+~Q-PJnY{cfAIn3?%wZIGeMb3ANDh8)!dkQvE0bq!>zJT zFo0*gq;-i-NFx5~Ypt^_zUy1$bW6fHw65LX->3L0Y>4oz9DaP64fV7ik5B)8@Esih z-&d8DC<0&Wg&W?in(u%2_aL$C!9SgPlh>cOWW|mZARyGnx-81U43Y%;JP5XC^Z8mA ze~8R<#0v!9(saTXR``q3XuJ?YSwwU(d*27dDV#(Bah${5T_+l%D%#(owD$|Tkb;%V z=dX8h3J%TOu(fzx&9K|dK^(#8TFMsQ1Tq<~u!&T}7$9>CasWgpgFm$Jb4 z0di53K;wH6G#X^BLbV<2iw-rdz0!gk;f1I@4LV?x8M1=BWpRoj0WFctalSvTf9CAI zohk%0A_q*EQQ+PMd;+%4d9kK&WVzlxbQ-uOSIca6S}fV+XW7S}xl6w$9eB>_vCDhc zhWpa*96K8Zee|Fj6Re4UEbKy2zK1G5`Uq@Fs(7w7xWvlAYt=QY!4S+|<}x<|QONT# z`R9E)qcm3OS%(s{{s3VM1M4@ zd(SF{Y5}r0TEe!X_2XJ#q7q~1WCHHf_umCr2%jJV4F+UQ%lW%^=dM2iq1v}}g5RJ} zw%ZjO=sOXCi_vi}Kn$K?nc@reC-^{-T$KNh#d+ZW3t0Z+Y_q&|68mun{k;uayBu;G z{*XyqI9|>4&lR9ai-e)UMQ9p{2b&P~E9{egFON(4q7_nNnHv@sUxT~kq|`$(1xbyP zfSOsj88PSwdj?mis-HK_n#%H zZ5ABjyLM4yT2T!HUq0^S&%e2`665V{G;PR27o!haadBdDYz|nK$99`nU#rOT{;hZpy`;wjYUb^>$f<)$c5Ea^8y>=7kr<=Mw;~W~!;J6lqfK}C$qMWXo zM4QPAsGix&yf4h(TP(qI^!Mm}Y5*(7zHAjdkZe=-V(U~|cGhfi({R_Y!04zZ&vFls z?2d?eTfVGaRNa`>t2x?M^_rJ&4v){e)D0}xy zxB5Onml(>g*LvwGdcpM3;QO6&9#`)QK62dD`701Pz72$}K35fWyng!l#@27NJydJM z6Be7P9)Z*rSn_3YY<`-{1QdNPFR4-{n*8_+i{F{A(DsrwmaJGN;k%xVwC4Db0*nVV z%!I$7j7wqKiw2$fZL_zS4wAOcvK-7UNi5jSj6I5&2>sIb+)q(?0aEq}CzU%a_M+kD z^|nd74fG~B?S!R>`|=c32vUXdcO%$)%YS!3g7vc}zs6KG28JY08OL(31vPtwZEQ8J^ce5-+V!t-`q5Vqe_Tx;cph zUeF9XWZKFoeHL3;Y%p>qseLu6XwE>TxaS?_>QBx}lA$^HJyj_NS%SKIU#kNdNEs}K zlxkH(5=zvC63PT~OgNuHp5ub1$X+nY^Z?R$YW{K=ax{?CH}24j5$$rTkp!`PZG=fR z*My0-oa?eA+fB$4#uS%PS{d3C8QERax0AgFBVZ@rYrIpD6BJNKK~X6}E;G|mvtfr5 z4W{lJt|GU|)Yd>BhiuVdj2s6k(w*)(v;r+UNIeHN$9=Pse&ZFt&z6TzeN@!4w(s;!6z zyIwz_MU9V{YrT(4h3*^v=GWmg_%&X~ewcdKh;6Y*gJ-45pv;hgY=10eJ#k-nSWo*4 zQer=;a@ReR4WGj-Il2l}>BAS@JE|^%i&%|a)opQZ$@_#EcBWJmw7tph3I~sBlCpGt z-8-p-J$i@NgWN;M5+H3b!Tdi26{YVRomPAancvsT&9$Ys&DC>4Qr_-FOE2Dn$1RU5 zX}}}6W}P|Hpvu6(Vym}x`b*x+>E^RZTY>!~y5u2mDQPA7ck4|Sv)#j`)T5J=vCLnl zCB&FseGjtUY)$;fTv+@&X@u?7rk76jnZKDAzuCAzqwH`-jvJ%%M4g_lF4=sOvJ2`* zs~&7HS;0q2F?8Xs=%sAJ>|_4i$70|N7~9gsjwc^6Z{Y~(zjQq;xl9zV#=hxfb=9jx zCmKD4N6ruj8Zfg>@);-pK4X}vC|P?wd;D(A63%^W&c=oe3y>3HuV8R!yXPBtw_W_e zc!3{G#=K-?luaaTtbCey$rb8>;6(TYeEQB1+v!*`O)+vK6eDWW7h{ck!V3u=t9+)yG~-F*H7Fal3F?)f*`QE9bN2w{HQj- z&M_R`MkEA2sETj741za>J&y=vtS$!+@0?&CIq~wgV}~4{9huyE5b(<&A)LgUfvM+U zlq_sy^R#dv7(;@CT_F%@Q)?t3zq&Po(Y7HCM7=5%nu*z7x7mjXGN`#Wj_aWHY;?T7 z(gk=^snxWn&-#Lk%VXX9HDp`B`V?YFwC|6#diyL*@fCdVGco-9$cHc{u=!Y5wf0t3 zz2bk$K~|nO`98lm+=%Aw4ddjRJavB51cCQ#cz9b^h*R+r(S=td@T zE{4Z>-&Y_*VGyF^i~b}!svaUtc|Vp~jq?>GaiM?(wXfo7*899%p4&cWiDHTR#W!A{ zBm;>@0dlK@_`2ef6u@v?MD_@aiu#0thFWRW?X>3-xcN?2ujl3be*Y^s>f5;5PmJ5X zw3iRal#$sCQ0A>8r0VyQ{8{TmkS=iDrUlTawxC<+JdTAP$ve|e=gb!X%R8|V*SE#O+rpfd_ zO+w|hwN%0LcTYj`CY((O!6LU<78`neTTlST3&=vbRIgR39;CrPLEk0?xA!mcyCC1> zy)8rN*$G~8#$*ebEHl^-DDeE3oN0|+$Ua^$(0%TZv^d?Vj2cm=}> zECJ!V9C|dTTnPj;E8efQq)b1HZf_J?jJdLLEhgIY>lZuXV9@Bd@i3~YQGy@=nVl}h zyA*UpPiQlY06if;8VI2atjKBa^;orXRY3WnBRJa$aO9}D3M&H}?QeeutccSt17aWm zL7A(y2#qJ8gDgbXjQk{sI<^TpU$OF^rBJK>dwUr0^YFnUjUstkdH?%nuvM^A^=oM7 z4N~OE%JW})TwCh=+8{(!Y*iseV=Pr6bm1Ue1dRftxsq@QQjU!!BT+=$AaE^(Mh&qB zN{}upUYH9i3eAieHgrgu=0ofiZgeZxQy1Rn)HeYE4?gqB8nesA`o$GCXC%o&dHDsX5H^{falgV?+7vC4WK(LP%_@rZoJjiW-{DCNX^_Gd(>HgP;-WnP;V~ zUe3>e;ExAY&OXANzlRPecJ$Ek>9VPbi1W(gu}J@1E>_DZm*G*NTS(6p9#9yJBb(Dg zb0ejslu&o0r=&datn4uvX5j?J70}m}s-W)~p9^%n-LmOf(+#Gl-?ILs7&rdS2;a~z zLlXsDYOb^GrVWQvR^Qz9xNmEWPIjsp_lFy9$z=ufe=(ucYqv>Bf&l;@5g>+$Uw25U zH6Da`{nxn7Sz3_H89+|G7G+;BBwIR{YGov(7$XTIR5iULs2n!0pxI`v8E2a|>w04X z7KSC|+UD3zmX5vY8AxW&NnSq-^|ECv*OlEaQkUEN$i}PkLRGqO&11M2e~j+lJXPCS z4}huBD;@-=3el08yDEiCFC@Q{AZQ<-I=12~Z-PR?VpmLgk($-ZcJQ4W8(jL3{QW=d zen!3t0qG3ucIbu==+0$HkUESh2tu}SsHYzX^)aLg!*lyrh0jeo$|FgsrFcl$m<_>9 z=)488m+#{1l2V*U+6ojh_@lOw#@>s6e$;6`xT*V^R>~Lf4Dp&q&)#t?eksFPuTn z%h+`S^m<;Q-f5mDj;(ihHd*q!vXhq=UqNYv`Zab#=F@TH){}U;#O*~{5K?n+oK+$Q zepd~vLc1E+wyQ&eaq6H`F?nP9h*eE5wFD)?#nmI2)%2TQYk@9U+Ad#aac3l5I3{oU zp|^Oc#h=Dbwbw3xI@`2+Z!< z=Z%F?BM9w-LsGDVQQchSZ=HM{PE*cZ8LqI65Eh1yS0JarO^Puz3_d0

-V@r)eYU^9L!D$XjhGuxu7`dnTg@@KYD@All+y|#E%NjSs!VGA&wHtZaHlqKgZDG#Yinj z%+Y;)eL26$A4RbmYzgh#XBqI^rfvLSf*SO=%y%e>{`!=gt*1VH#q{I#dCjYnqBtU1 zw|uU-Hr2hw!rW|qCDpv5`~5-%Ikd0cW`?RUaMPqNqZwmcm z!WGxstn7^M`{~9@@yycP?3fd}_eaU-N9rFZbV_(xGaMpy&okTOPg|pGrdUSCpgnS3 z_6*OXh5eRpz8Vt#Lx>U;l4hNE^6r`Gr83f&F8CJzH`0KmC1-&0Yc%4mMd(TJzVp(L)~^p4l&Ze z`dpl8xWC0b#UFPyh$i=0ySfS@NB8F8i0%l)eF&0@gzxk_;hi|{LR~L9;W0Ea6b~>_ zjLB{GPda`%caL)hN#vb11O^fUJAXrN@oOk#1*hAquL3HObbo5i>*E|VV=G3vIWFG< zaLQyrWLuuK{U$i!U25=N*LE>;l>e&Z-*^3fiyD7BD;~h{cY%s{zu_>xW-Q6ZKo$sA zD-Cl1x~??zcM+k)4Qg=0ExGAj%lX#dxpHeC0c7AKy4t38!YCgI(Czkn@!cch{f3H| z!S3L?^8{g&arSG+ax%SpD<>^IPqJRqy!KiH!r|;ZbhE>epWo^#VMAL2*8ZpgPfUxa z4}Z|zhMLduNxl1>NWUv{3f(CYy(bqoi|2I$lGn>Nb(@>1;WSznb+n0G6Mva+qUPaD z0MGQe@R$v`b3%mKD85N+--Ma-R{IoknFIm~cnD3Zsi2EBXnc&B+`co>!n0*KD zoKcq-ulZ%D_jz#m#CvQJG99=mozjBi2i;m#U&|m+P;f)V){ECaNZW-7_$CTB?yPdn zbnic(WVkh-&CKK)7uQTfL(+#P4}Vn-(#yOjs2ZrU`WFh@?O&}#6-SJGPvliNIoWr= z+{>(4+Nf){%(;MOh+28pf&(ZN^UEr?Mr5aq{#-`=Xn|AF)s?qbdAl`aQ4(K^xT~t1 z_x6eq<8Bla6BmO~rkmsC^{9I2)+ii`;XgD#;4{KUl`e7g6xuVjQITf%?Ey$fCIuzM z$QU}pt6IOsdL*MXoM;RTizA7#8^1||H#^N~Et5QpZSq@-*29j3)i_auncSo+$w;-Z zuYQEBQ8H2FyWW2jbA1!buMXuwoo{u|kV^FI4D8@d!~7D>@gYWzHooa{x8n6cG-KTt zaz~uMh0rg?zA~HYi(LE82bHZ;4`ly32yD=e0ngC#2#d(ZH(4qki}ySlm} z$!D67@rTtC7whudF8B4B3$+T%PF(D?EAa7hv^Ub+X!Jcqwp&ASER5&RYq)6-JDR$W zTLe8mR*>eaq`~KpNV1Y1zgguIcY~*8RAN!5$Bnf&EH29h(2q_<#ry;W#P;wy0>c(A zqLqlWx&>pxkk%MI{d|c~vzFWM=c~b{Sg1vDPZP zU1a%?s~ewZa>9IGzkj@x8}G9OB@KS2gx}@A89fQh&fXwO3u13%zs^~+T%CXBicLOT zvooFPRwDZb+2CZ=mUh(DI_sfj@jFk*_HBXHak+ZsGR@|CS%Ld9kM0~ZYvy#Ov0I$Z zu$>dsbn-p_bKfuM#1W0xF%q&}aO}TdB>-s(5rdW&O)sXX1fimCwD7lDdN+ zjq_{O%ecYsN+b)Q+rHaR2g&C79^)k91?lZ`k4cI!gsyFSAmea5)yi#-q)qO5fv6a6;$UIdUpXkP$>|C8h}0pk=bmRqGQM!w`hI|FuT8=sp&E)##Av z@3FpTr#*<1l%w0_cyFN1fTs{il6>PIp=HHt@&2y8>3e|hWYaO!%2Jly(<4L*|M_$N zGdwA&r;_8q-OyvZmY--Od*OjkdUT_-RpbG$fxR;5h8_(irIgt>hniJ zq8#3RC;~l^%FFnN+qDmNA68En=js(FPXO3V({s!~4SCm|dIU2z7KAT|4YxJ)lz2<0 z6o)C1-HJd=&w65DLLM*_RJ`GDP=MuEwec^TQXQrxB}0b%>d2B5e!Ym2OxyHIT9!ad z&~pOWT(+vI=D_38x&lf);*efxL%<7>sSPM|J3Kn`0=9yJ z!QaX5JXrt%O-Hlz;H!D<>SX_}(X!B6Mj+n&6W-;AF8ViNHEspbgyK9kDsZv|=ej$! zoTLY%R)bV$B}l5A9N=Wa1?_I6>kg<>*=Fk18@}#CTuN6ng87D3Z?+%ufElDQ!`(Nk zOeLfIf+vWH$=H6n$)v@RlXROuvS+Ihse8@fw?dxKer@3MMF|u(=xgz#iO-{2tee#M z25yQnq7ZV8mKzT}eH7yTM=z5;jjOwJhViBZ^}+4f`={{=G4pV3pTS{J^?#nlDMffoGi z2O%5RH(_Oo!@OY+1JF45^^@mX%??6NIrzFGNodD(7Y5k+>npE)`g_*v1vs18ym=N- zec7KhuZLXJGXE1a;>5qT9sP1YN>*n6!#RL_0=QYOjXbP?B!(%w+3*gj`kpy@2%wAt z4gs`|7(x_?jfylFGIOZ8BK%iJrZ@p@*D1gV_b)~2biZb<#j-)?;bBO_3mXZ8{F>`j zdH&CoBQHYl*OsLk6y={3m2dHd9Dh6C#Yc^OJPy>6(jAB>=14@BSJj~iNed$dM18)~ z?U%0jM63eAorVL{>77gJrJ)N+GgysWr%^|LuL+f0(`R#^Os>LKFOSU9p5dIbpk_>u*;IHVUdbDM zc{X+1-ua|!rjh>Oto^0>XQou7;i)P=yQD@efmta8bLnAX2bJUu&$q@Ae)2Qp?3xwh z4t=MfF2ltYymj-5{4o{4DB&~XW12~mWn$pd;6&!3b5ph_#O{I-pstZx=_6n>Xb%yQhPJ-z#EsdE;nvy-6}fJ-y^VE5VL3V~Vgn+6M=Z zwGXPQeOwk}gp1j~-~5ru_&8+?tDlrxaVkHu`P-bL2f>UL4p8^w_;!*3E=MHFAWBkH zK+oUx1ZOvbwiRptiS21xfM{}Fm z#jGKzaCSh|2Q^8+=$u3Nq2HE3bi-FmRJ1QdGG6FddeY8ynAfxsqsR@i__qF9K#!f{ zu~-mosUohd#&D4gJ?B0q2UfMHxKKQ$*VMs8xdm28$!sOc-fr(#VXK06QnD`kg#g*Z zHV35)*|jn$k?B0o`AR`+dH1v+>*%y`h?oD;!q%vFF$h+p{Ts;_$c|t9&Rm4DDjV>X z<@*HA%^7SJ#`>!pwlGL)bH=7Z0nbVtJsXes01^@syd`(;?BXo1!GmU6OM@{}`v${Z zT?%sg3D0Bfr~9(r@R1WsU;7kH6*FhQ18>_JxgmZ_^n*vemX(j=$b&vl2A*dPj_*%e}DW z&^ZLI6!qWLq4_R(FautXzy=y|DVKGbkg;=o^!kcVJ z9cs+;)^{bW(Qz(id-LwktwnXI?hQHCumC^stETbX*xDKaQC?en)w%0p(n(pT+c*Db zc~mrJ+}fIM z4hWd`gJGg9EWC;KW2?bE7xsllW>#BWYdHwH)z`1>ltBTV zf&vg8^pciq_@*7J5l1R`%TYaIhQst3|CE~89dXD-wyA|+2stX2hb0Y+dEY_A(G4C> zGp*bmskxYgsYIOtg$D%~;!hH>XI!gH&@HBhaY(P-`*xBt{-DteTp%Q+!;%>*4I8XxAmwO)_EoPh*V4H zV^W%~^>MC};Qbw(s}XsB$6B0Z?B$Q9pL$&!s+uP!?N5BcgJh}cVaDCifvM#yxIoYS zcpYO{S|PyDs6ic6Q=L`yjtDSB7sjD)$TJ;CH>N;vAX-?O8&9zkDK?y_MwjU{SoHtY zOdk7Bru82*!Tt}PhW8reGygZV{+IaACjSR*{-5~2`v0%^Z~lJ`o!)!I@_xX<>c8tk zd`&-xq}S-#zyM)*vf1~umhS;c%MNxPd)i1xBj?bu z7c+a+W*B|2h)-6n=>RYd<|@}zzD*`$X0Bwc%G|P5>WVQOmy@T}m)YE-YtUgc7Os^O ze*hw$I|QD&&BG*aB8l=BPdIq4FC?p<+v}tp+_ON(YhIQ@6)z*-X82wfcHY zjJ0B4rytdTqN;=M)5=k1?|(>yVOtgb$N1L--6!SJUD)UmJOyrHEp=^=|Y=2t^i?V+{>AOB#p1Z&n|zORL7`uY*H0cNX?3;DHnPU~=7OhWO!J zNtMlj1F`DrblE>EYwcNoj(2{U6En|Yv0Ky5SmgcmZ$6Idj)o18D4IE)3j$}p{|<%% zf^kD!W>w|{{}sCZl($Of+|04;5jQPLEJ?lX8lES74q&R_(KC|2)}r`+^kFbfER%#A zFw_%w)Bv=6E>$dpqAy>xYQ>MytKM}e%XStE%QpN9e2vn}n}gMW%%6AoiqDLnuTf64ai*O6`SBBq1-8;x=k200Dzo4&1~)3?ecuRdN+tDE^0N9K&VizkYzrjb8j0!DW+)Q+HZR$d=@*?EkVD{)2f z?9rhD{8*y$OZ<6MQvdKn-a+S^zd#EliN<5&dL6)hT}xa-;6nmPO%UNoAOvDLSht<9 zA#3dxcM6~(kiZsyaMK*H1GcZBL>7husMvSv2P&j`FmP)nB#3`(hij01Aq-_vHOKGH z9yP@#$w3ei3!$vYLnYaQjcO4gTbK&ad-!J_S#A+=D&>#AI}sO@yD?IOb!_?&4L=w4YOFD||jB484*9`>@HVtgIfYpqNbPj_x% zpwQh(g+H9?8rC3M-H2FQ$5!6AS=~WvwSAsKe6RV4g2@>FRedOi$GR-%g`)F1ELM2E ziD_P@jTu`}C4JJ1o&LzXAAihKoXZ&(3|x3(4jWtsxa6S!!F z=vPt@iBU1DkQ33(E%Ca$+Z-)5p6$?PCzXT1n};s}k=6r)gQnkfSw-{a;7^x=P!J~@ za7RB#X-lXa?2N=-RH(~Nq(V{hr;oYT8FPIb{9`2~&D!RlvgByI?_QOjtpRm{bt?ov zLjRisd0?PXYo)pD!Ouiy#<-lbsarR!=`1PQxO#ilp5eCS3TM;DQ9Zw=D>_wyi|lUs zuLaz@<+N#Vw9-`0P`0i*1~_pZeo zJh?A-F68~`o$|W;67|guqSI|O=KR$?p&{F$LB)2E7wW;^95YGFSYw`2=>}>InKR|9 z8XAHN1aN+Ccfkl$5ZG+K8BbwjLj*`vHI&c*0HkrS>dV2z31sgv8^Nck!ch&(0QK^Z zn!u6t`A9m6FDihC!+Blb&%!n;FPNJXHGd+oSTpP0;qw?kRV@*WvB788s5>-&y-M{I$x3PWxTht33zcP{RyudgOk*3p5A+4cA8N>`0Z!5rGn^;L%i9gAh1&IF@K z$?8aC_~sjMk40V4h@I%k`CTGJ#|obA#0Bv(7)kv93jRO;2#b!UD`w~9gl?EB88IB9 zHq{b|itbk~9a~z`&?TAdYNe}xtB9#MqbnsoSI8?797EmT7ry?jZMXBtN(3^cgOj~ zfZ!`zB;37wO>M2F)7?Xtz`{)BY>tmgb8}2>ZLOmQ_Fb)h8H~rc4Bh*e*u<$}+kdld zY_e(I{}w23*p9?k3#gQAP9^Srp3jK}15jWm+=n4*GfvO&5s=B*h7X(m{p(Z*oig$G z($tn)t^%Bp(ITa#q0L`4eT<(TR7F}r3oJkJV%=k;R6vC^y9#>{%*>83f4^2X$-=xO zR`3Ch-XEz1JhZPA0Z#na>xU8$f1k}<_nlasHkzy#FILt`b8|I|Ie_OC9&1qb3IuT6 z?lXJK%wF2OQ7wMeuI8N{0sOMT`KyDt9^|Uq^oFlzZd8Y_E5WaE!cpIi7x2S22)HfN zt!Jf`!+%Z#FOC8oI==O){B4%Lz%rcRUClX?!LRf7y&1JRd@pL2tMK+!(mmZ;Z0Aqc z79T{;Aa*yszka%4EF`&V<}v!XX}LT<`D(`Mi> z7h9E3dkuXjT6U+8->j|qow0`v^Dv@0*OeaB@pN4~>7|_Kj2XP1e}3r^Hi-_7>32Q! zJOcu;kUdkr*a7)FMndO@{5;od1J{XBJhoYkKZw@4t(k-g#sfX$;}3mb)O257ibTFT zYzh7L^v`vhT||wKj}K5aQ(Nl1v(dZXni z3(EE2ZI3nG_b5E`X^&@v@!)vS@f$9}bS7nWx?L#;u5sM}038bpqhzMf>>@&kZ+A+T zqd6&hxO8ZUzc^vdx;Q5$%4W&9_hsNUBOfBblYj_9ymT^`5oJjLc@+f*$Bwt+;RVe_ z->WPbG_t3^VSIkXVc#Gaod3S<7SW^lT22Le_aa0x_k9#y>CK})nKXfS_R4NY*GiLn z_t|WD;koK}Eof`y&KaBIUp>&AIIJ}iJ+-TkEgbgXtCUTNnLx_ohOl&x{Z_^JPKwI) zu@X^5NEkS1xub|ao{0SS_m{t|8C+Ces@_gN*f{ilvX^mKvru?#F2&3aJeqE-j%-J` z`RqEKOw7W>esM#(M0NZa?)$^0)mW9ic+E?dBG{SMTab4RDiq06q!zsTk*Z$&;kotp z#36F~Nvs+&chL$RK3KW%i78R8T8X->4Xwdy|3y$H&tr4^mkM>_<><@%=r(-+OFhlr z+aKCsk;)gfC;#lMqdEA(6L+%@2i`JQL1Zw}Nh58rvM#rBr7|@~8?yP6LzHsfl&YO* zzGt^vmPDaqsefZWvU=sm-^n?jzvk+U(#7hXOffR0ik5fX*^kw#XhexSY-aGs_0%GC z38fq>l?oT5CgVtx7E}qtd+;1#ek&8J<(%g~hiP{X-Lc!5x?=Q-=Bc|7I|oPp{SYKq z9;!#90={%`JA~!%En4D*qw~ScnK09wF8AfvhX`m&T1?mNfVmip z)#Uek_W`HC0hpf5zem4oYkN$<>F}*h@2JhoBTt#!rk4e>oZd1q!bqe*OquC??$UEJ zHM9ow_+e`4>Cmnrbu*;8_aZu5I#heN>nj`_AQ!`iyG$YCrG`GAuKQmFQqhlQzfG`p zvmY$UGLA-IYBk@p5K$RvWFw$5nW?I`>aA*-6ErMZGE?2Vvcat~ z`kOT4QFC37yf(9yE>EsXXEMw&q;~73fw||EN$iGdZXUneW^Y~ra)y7tx=;4tQ`wN} zh`J+T8{>UO`L5fL1e_~|ZrZR%9)eF_b%hR(+qd)ALZ%uEXTWP4Xat7+c#UF4EGLee zHHQnH42}(qzW!JF+Sk7~{t~9))VMX0OwTL-ZuGl0(R^8hB4yA?^LGu5-ioMjgcVCn zn49xHr|?xSh`_nte1P4$wC59p^xfESj>Z-Icd4s&wATMR9wN&AU54s+z0jsS8ZBge zpC8fze{1RuAj@^2-zq1F^N_+|A}MwecAnRlBjzvF0(YUyJMghCp4jSYH?~9R=ELC| zHdonu@6S{QTGHrR{Nq_W^O4_R4!kqnj_bve1>lQ2Aq*^xBvZ8@<+rODjxmQr4Z|t5 zn+I7yh4!KSZfD*)z~@32K-Bg`cjB&ia_mO{@~N&mk5gDW=h|yq=5jB;ilp*6eK(v6 zYv2{R+8|Wt$w5SiuHPrGP@ixZyCVYPcnCK)|Iq}k$>XBhTG07>6ZgmSPpvjCOoinD z^-Pki{!XPxUal@fCS=j0`!_c3o85v?{ToL*K_7O_=^00w5`*OlUfvR%!7d2qX~!z&ES{4_P`*_T?! zeMWz{tHzdT0fA+6jW&mzB&cFX*I}(M41t1|L46IaXn6uaE!(1JF_|+$W|oYpAKTY zT$g-K|ND*oQ5uq@tso5E8B^kD?IzQzsOmg&*8^X$2-{^o2UdTTs7m=e#t^;`<>D>5 zABjkj+|#FJNSUnZZaikrzR>k=^jo9nq2cWXEpz%9{bmkV!q~UeV4oH-n!0l0it29yd{NV`p!Hd9fiS3ey+wri|Tl{a+pVEh(tQ5cU1iIz;gaj2CC)2abw_jEU z8PH~Gc~gHwx%?Z{SZCpXAg#GGbmNm|?ciYHNJp`?v`exx zKH@KzUa)XVWZV`8CMNmjTO!vq zzFL=!pL1I))JR5ieIFHbx3-G#o!VGmO`Te2QHOEfU@KKs$m){0K_}al{4(+1*?^h# z*M={4c2iJH;rN7+s4yK^o9SuX#;7TYVp+ulBL z!16b4+LYjzHgsi1A%Rk+__2fs_ju$6OFQjY9f$)(IXCWTp_9jqQNW!x8Y&=4&zhd` zNa!&kVa&hz{+Uzj6yNE`U=;iv{vQquKTPV{#lYuIM?K2>Y0wR=PCP34$y9sBmFVr{ z?gue3sYOn<3}K6*#RLr6V6jIQOO5ouEat*~9_zGsOz8c}SISU(7U@7eS;rTuZ@aI= zO$iAY(nVi!;yF0zOisS*YUg$<_Ou7+jNGLj)}lbuc&)kpxl^~|1fXfgKk~zX;IJD z7^G46!k7tH+CD3W_pOakgBH|>k%G!vhxBE-%;fxdJL;#kR12aI2yCnu=&f{ykqVg@BJ96ew>*SjHDt`9VhLbN5H+oiRk|;U z<~)x@Iuv{7aH&?59W>8Yrc_8D>gwn!tz(tVBnOO5%A`J#d%PC&rQRCnS69cVV1p;$ zZ@bY4an=!xJy~k}&Ku2%Gh!a=Lf8c_#8rg@$B#R{{f8x{?#fj1a_H|z_oh>Xa}~fh z+Ds8zU~sOl$^nl{mI3b<&q=z@_i2c&J0Up#O>=P2SyBe^of&?5@35FS@Al*Lo@HNe z?_)Kw2&mT}hKzmhmGK%`-93npfuMgsh}oyVbr=oMnpl5-2G5S#KPhe=ZAc(?`>Vq& zV8uTw1I;b?LH~wZIi`RoKC>yK4B>oik%3ZQwa#b=vdeU z{36Yxe-IU7kSYD{^|a-il6%b<35NvUH;*cK0;fo$ebe?t3%4{`{jxWW%9gywaugQP z?T+uF#)zx$o_?N;Z0WN=jb z_mKpjIj9J~>W-MAKh-B zu%n)W&B&q(=^(cpf|(2GqAZZWOG89$PUnj?`fUyyaRP&%IA|(j7DEa%#9sXk>R`i* z{@0{+^8J?%ETjPXPBfIw-LqAWZBSz5q;;q=BNLM}W7M>EcT00~^ASHue+5C#EEMoJ zoOYcNDyR&e=C@n{J%io)>};cX@?M)B!2fdUdVQ{|*ZCm&CBwK*Ex@AkamCd-_u!=V}A0 zX?GX$4`;DiZ*K@af(<7S8B=TE-c*EKHSlWfME&Oo^($OW$D~!u_Fs#q z@%gS;y%i$$T_P9|E<^aaW4YRNrGJD`o|tN1-e>Fy$W6>17Q&WPa@4S3xhNNtU|3d~8?e;>JsdU}J>>y3BUkn*7>NTpC=vbcR|_GdP*`InUogAb zWu?{LCP6b3W{~dMCqQxIP=h(dQRQs#yNy)$`1rUBhpQ9HX7A|eIHOg6erMv5uuARW zj{KrwADO$Ly(jIknOSdN;Kf}|$gSi#8o^|AQ6V!b3xZbxbP!YTmT*iL&hzDC2|%A+N+g{sjj)hu2^suVP1r?zUQvBp?K5jbs^rN zMeWVWd(l|?oIJcBdVMedw)di6a^gZY4{=Ym_MZ%{a(E2WDqNsn!@j6i{-5t^tEwiC zYlg=-bOJ-OJ7`{2C|*RlNim%oS|1-O;q(0acb^twV$Ol4S6khy_`kY}v3vF;{P;&D zcvxz=)g))V6oak@lce6yrPT2&eqZ&8;AtsG>I7uiYe%e)j*R5(GM&zTXF9Iq?x!&F zrCY2?9Gz|UYUJXjJq|Qa6#pwG;d$v~9A`3gVJq?%HzHfQ+uwf-PclxGfa&V2Yq>OP z>_Xqr7KZj=epG)gasBHLAIl%;!oox-$r1V_0C_0?1Nji~GTJAf7;Fp^l%@RB+#pQUo|3Xo@pyQ(Bj9^3E zy43IUI4SXYy1V&VyBt}lI{06oZ%t^R^4s#t)`b!KZ~c=94s=u1X-P7BSejgx z`_+6bG{vBTB4m}k`$5iHKr_z=GAOY`jQ%^>a{xR2fcgXQVf^Fmj^?PlNx<5+%Fk=FyC0eJJDYo}H*>@P=!Xfw{{(7s2jt8Z%Yfx> zUq1ug&Fvr)V9f^<#>Cy2?HP)RB^#)r-j&WykG8N@d&Z9 zfbzGR)opv*;I?MGz&f2}vu`OZCBl+Ed)vAs+ZPvsf*s|ywj99cEA47NuT7;<&}^x! zg@aVn)5Kify4B3xtE+rVI2tK6F=e1I*+>#vuJ_T|1q+-J)exusTt>HS@**b>otzME zowH-9!}2Jm$V$`L;XmY;*H>9@(Xhr+S?B5uNjy4swA^;vt))IL_NWya3ySk}wS|{5 z?K%PPlM5c0{tfvZ7Oqn9XAf9!|I2AE@&;&8d>$?pQ3Pke?S_I)NWyIYf{7aUbHk?e5`&D-nJQh>R?!Qt!@AG&{p$3=2_Kq z4(DwUekLcwVl+JoqV)a;kgQ5ouq8S6tETxb^&}TJk`8%-(;cAdtr9kF^EH8lKn6Oi zNVN8@`SaJ`;O=4L1Za`FHsx`YQ!ICB;})pa(N6376o~>a@P)-pg47d(>9BJ4}`xPWxWeiC<|qs)zi@R zuUpS%Amp`2_`W)GN5T_E~Ag$2YLe;}7cfNS-|W&C5lQ z;pHo#Avv|ZO-9J;unh8Qd5sYVG3{=1I1A6weyR6iiQhE*QD?c#^3%L(<_G~PH=FT@ zlz4vB12i>>_pt(7=qTitc(*oKKi+M6@5?XA**OY?4H zITPzg@Hi73v2Bjushb{*3k$5!=ay~^lg+=5&+!FiJj@&H&5rkmgK_me789ohGnhj6 zuI_(7%X!BF^VRBYA=reAoY2!jlCYmdIy9ycf~?P0>kunByo`*e%q-~+@RS)p^_)1>d!dU>}X^kr=7O5KseqcS9pl=s2{HlC9{nX&!d z68*lNZp)RVxN{nUStH?Aqz+MhQ4o7;6{5udQ`dE4UG2+%|5nU(o8>ho{9qW%&dJWs z?hM%T(Q&^XsULW^{Zld+a1JbP{tVn%kk0k1?;m~()}|);ubb~{>@&@XBh%WwN{@NS zOj(*j4rp($`P2sy=>BrNx90}N0ouRtyT3ZTP9>L+dAhiCCc*={hq!#aynPE$3H6Dcfe+r9ed8?Wcpgo_=Tfq=MO zS8-lW8Y+Z(_W?El-X&j-%)b$PdICXNV)GSFybans<~tE!*5;jxth!g$?CR=zLreqn zdvOq8jR8a$_<0awChbr^OgBDGzc8Fo76(0nG^y=u-C&&ddx`rU(0kz`I<9o=M(!I< z0F#hd2EbMw9atjO)TrJ6x*efiPD+G_=Xp^Ww3p?%hTLDPi2fnQm30J~+ru6y-!xd$me@2f!sS#J#@E$32KtiBa9_WYiZC5s0L>8YHt=~YMdl+)k55)h>l$vm zFnPhcEQ~2?i^MhSqx)x|wPV9DlInDmQgCN^(TjjGaru@ASwyAAfWrG$psv}4sYfjC zfvbjyCGmIY+0-`>es4QfqKq4ED~ic&|kN)nXfo7_-LS5(|al1x}k2gpH>*8L17a&L1s zZ*?fU2{|T(@#?J6+S}7t-8Fw>klKtoiNET)n~>{-W6ix@;$s?{kj?S(0M^I9B3+T+ znXk2SEXj~vjRG{U#mSc3U5SIG_Hxr?;8v9dJ>B%)O~&^WxurM*x7B{D70M*L=yks zIyJ?=^4A1U+9bKJPt2=*pfx2nSOD;^eeLhCoN@E>#=_X#@7XYuWUoJ>#t*P zCg_Dq?*X14$-f=M5ZK$aV~FXYqf&+}FIjQB{)s6#lX$ebuG2o?IF%NY$^B;kU@L|o z%iGEtiy<~r9>y)*OTbJUg5l3{7#Wg4T62gYh7f6p_wI4|P!y7o{d3>Y&_V-4ETUFB z{Wv56p5MX}OALWvb=kY@9)p@Z3i-P??|9a z!bGUAudgha;&q0$dp7fiQ}-CGZ`vftU)}Su&!h41`_Jw&U1g|S=Oz|*JCeZHFdB#C z7VxHcgR*Te!de}EMQiU>9M*i1Tz!KwhZ z4WniZADnJ1q62w;2sQorbnUku1)~fAjL{Zo4R`dR)jDlKdQ~<{^?6izaFE67!=no^ zm3eu+##$pNKmeNc0^swy{B(7_TOFW6I~%`8)_gv-UV%7o81lNp26lpm-yejT;|F(K zc)QWxcR2!2N0Cis6(O3^^@fn3A)_}?gKOV@9NeL zB}FV~F%vcLXt&1%VTj07JI%&DHn?p`rPo01DmO%-i~h#V{;SgoD7HpFAnDb^3{Oz7 zRr4hObe+iCJM{hJkd?T$F8^-7F};MH32*@Al5Kgv&X;-Ltb!LE3=J!$@pU*a4lK5E zELjD=l}QxrM=3nH-K-0be4XFXNaOA=DDM+g(Mc;`*uHct6OgEy`52p~84LxWs$$mn zbs6?{di|3eOUHYb=ej&wkS|>zB#fYkFm;K0NsH2K@q0<7#};@r!))<05VK=H@OwEpSk2xv7`)yKb*U-2_DlH$3r3nHc@qjC?-_#*2ZiAk zdWk!K@$$laU*2UfJFHs1t9@??8RIrb!02ksCQRnr109>spJfqQ^8gW^&5pAyyxP;U z{dz$EMX2M`Sy0t5IV;MJjvPK(n~!{6_IEavB3nvzn;8o5-GW+0RJ|UqNi5;-%{b;n z8xbAU9v3mycTdQpOk5*nKVNTr!xK&Lno2{rP$KQDx)@INurNVpabdNzf>~E5)z#BS z`hcMKj0?^i&G3K&`VWu0ls7${vbjwAcbt}yyxp^#tp-&IPDGhuO^t>&PUfBIphP0{ zY8Ks#ExrJ5Ebh7kCH%RCZ)kzqbH2G+?EYXT=CY-(bE!Q3!bl>U9^Z)&{#M~JY*%-YQ9m;*;d5zT!9jyo<9 z3bh{w*)R~f^l*Wyh4QMj9fVMbyV9kdY%aN;aj@X^Cml$hBIJcn1yYyJb|H3D>#98l zQdW61Whu@RX*3Ew@Ja6Ln_+-Z51Odz`~_^(`C--=>p~d}%=Aa*8|y*z!p9+bh<7;% z;O0UhmTEX|Hn5h96+eMr6+()}lSUvDk}s?_VKVn(KD;bDz<>#ZQ=3o&)< zK~@2PovBSm>0K!!Q^5IVN&+-_i)XBf8Q1S#?Z zA?L+%-~T!LJ)o>#5D|iNLhG@_I`Dq1?tbS3dW60WxkJFrM=p3p;MkX_p9nX zrjO5)zBJ#cCb8z^+&v*QunxD;qo3gl6J}75I3hxZ^8VN>ImbeE9ijHkisIujR7hPJ z3kHERL7d1Z41!D`W@I{KY8RO1;KU>#Wc3TKHy4jNS#-;Fi%hKOUwEzuFfY9+#IczD zrQjv~bA;y9(gydfacCx`99@|wk3BDI67*x>Cfz^5=6gGDXZo3(RmE;)K9otUXOnsC zu1*XWzEHn*y4-D!CiW;~H64N;btkZ6{Z~_qgVshAVoB0u1`c z+WAf2GxqlIe6>$2^ZN3ap01-gR`C{_1FP)t+wFGZcf;EncMlO?N|la&&7%Fn1~24Y zJAJt*f?iT~w{JMM@h*^f*WO)l1;Yr0*;=vr-9>E+ZVlsA2nZUy{7ADm%;j{ys|+3H z&WrRJL#PRZx3mAWr{|H!za1VOudV<;`Izy}ox9NH#50w0#rb*liJN;uYLZ}LfrBGu z-D}HqV|wKTem*d>hO>Ojy>=_6s4~kEA>L@cpgd4CzuqpVmSM>Ee2p8U760LNMpOSb zc0$6BZY4hWBU_N1xX2gHRD?9nJ;R-a>I!e~J|k%VOM=3gSeA(ogb2I1K{lJbzMsED}CH^pbtXig=O^iOSmV-^&zpN0wE05KsRjx350)z4;@`f`i30GNSOEQ zcyVw;tx9vr=AT5fUK-|n9rf3iOd7?LCc>7Qspg1nL@%bD*?+uFDm&U`% z;p8#2kFZL~D^dI&LlSzQq43!I%huf7ToaDjqI;;rVp6XI{2a*3$H&LR!T)t=xU-=3 za_B7GJZ~k8Z{KdC-!k4IAj7dZV8aa(H=Q1xk`^rRjd=Ru)r|0VM<3Nq44@c(m?qN6 zZXc?<_#R%XNh@2p*-Dna$8$xzwAY0BDVX$qOp;iCO@j=0`15NHewIXHhHzB-vydoy z|2!9LZJ+z!{r!RlTI3*uHq$|6+ElC|dDUU+2UZDT@*sf*qnm;d3|$bx6mJ1A`8Mrb zc;O+2kgz-B-w$2!v~i~BpY|>w%$c0frr1>nm*8jmw-A{Hv4XW~=TCqa0Fc8JOB}JG ziVPH}&b6*nhJ?hlbsFTuY|j+`nk9?J5Cid8$$1ik`xaE@8C7kp85)IsKV11rmU%gS z1I-U-uq37RjefW+jNEW!(FfxP?P)89f5`-BZbm$K(<1Q!6a4Y3_WoBC)Ec>O)c&&3|nH!RU_U^|Flkehv<_u5(KYaQ(Ta%$9K26q7 z+b&;#&eK-AP>^b9U@cZnVo^eruzs(yJ z^Svi25zTdWx9ed7DE*Fi=Ja9##gHWHghoSevup$794|v7uV~fX?otdkRBdNkr8sN% zKm$jUaH+Ku(Nz={xjad^g{;GOqf;{SLg#+UPp>vqIUR(Ds?Y??bF)=O$)|=X+crQ1 z?IXOQxa!-#zcp-_$j~h2FZY@{cQ=a9PYVq653H|qi!ii;+sT$`{s!{T&hE_HtDf$D zFR`_TU4_*_$U*hQn`M1uU>BacatNhn>25es2rstq%?ma3NgpR=EKv2|q+LU7k}(=^6l? zH|BJOKG}0A*tL;?%zz&$zdgSkMD%$ywRwXb9L^Sk(P2>Q3&#pRRPw$BTg&T46_yD= z^wZpjPzLtGr89`SG01oFLcddT-0JPQAFT>>!m{QUaKyGg9+dqY_2iyUCqG5y!And; zKfKuLlrc8$vpsQmeFjgWzZS^ocS$C9_L7ij-x6AVn$KHxtge9SQIb{N$~NBO zUaSX!X$!%s>*F4s3iC8i*Za<0tu9eyJeds&G>JN0%L$bpX@JQ;K{fhB3^ZshCe3n< z>GLma{|ZEgtU1!Ew5I8iB>hjm7bZv;$zd$)(-Wc{uP~j5`zc*Ka5$gwC>&fg#Ja3M z2n>n%gLUR(ai1r@)viQdyAS|cx)r7^Xk4~A(Xxc6Le=)r;S5ua^Acjn>4m*q?=xtj zn1lpKfD8izg7lP%F`z}BSV_?Py?`{Fjv>`gTo6s?hn#F^LqmZC#eP&wegZ~s@Arf% zjj=ES7`U^wWdq-zg>|Za{M0hg5SD402o%I945%VQ zLWP7)m!1chW_w#WAw*M06l{>NcdO&GX;ORV-TNtfo3>9NU)pK3J&9|{mRkXA+?9um zOQr|kjjLlXN$d8w?<3i=+%HN^Z5|Mm7b>;hVI=!cx3#82locH)_gU;(4*l$4ahR1xg#>`C~9 z&_M_O-}cOLO<=;du6K2?(Bep)=xEs3oQD%iGk80I&4Xg-^6@FUz#FRTf2yjA_NbV( zl2V)9?`XiM*q9gvKT0SJSL*AT=zC3~q(LyE4gOH;HcCns zXcI3VKj!5hA=>7eZJ3*7o3lNzpV$P2*{`D#KX|gKVcvZlsD|^^)7v|=? zJPuU3ohiR$z+5oCTjzq>sb>BIkZt`4=VqszBT{txVgEH#&d);2- zVsheTXFo6>VxfP&aO^(dnV%LZ2pFn&sPo;G0`LX*Gt$2kk2DcI&JPclbp`VT^;+Nx z2?@<$9zP{?qN8739q-SXHb^IKCa1{cf1>^YhVdH6AyUvDd5|e7U75MG1=9OQ1$<6%y)UEDJ(@_G)%P8s~SJ6?aJ0-0TU zWC3)3PVYw6Cx11?wQS7AgYR+zlR%5M&kgW7An5Wrj{ViwA6ZM3z{?qa+<>!V>2cm=_F2IJ8@qRQ2e7T zXsj7HAV7=UQyk1Bb#cDW69=KtAe*ao4EF!sn6UKKb)u&>FW>L0+U>u*ygZ|!^cGo~ z<=WZVDOwt~nig|%leM{zP<5AhY*Mr zD})7F48-NOin-Vi&(??xgK#U|DF+4zc^vwjt)hLcv`p<3Vnps^0I{!iAz>t2+uY-> z?-ue`f9s*gXeM>o3me`m-vkfC!}I+5F58Q{P4pW*+G~d9w9Nrxn%bi^Us10INU>g8 zASFG(E{}K8+{Mf50Ze6GXOWX0n~fLXrQ4tYU84r^g3vKg!_ZCdrEB#n2Id{ISz6~6 z{My-h&YD0lYCM;-K6dT3USQQ@uUH=(9BhTd3o5QA?r+4ERtgE9B5J1VuK_hJ(vFe| z$HlL4fn1iq*V%5(K&8FW`>g#ev_ge=^Zw`b()>Pve~kZfPz1^~)+_rsJ5vMEV?81} z4YNK%V-6eb{LLBirI2Dqr18VMF2K=S-i}kvYT&TC?Jp-U0n+rrBO15#o(=)hcmNG@pOVPDJggOGZ<5~wp*09hN{TiPYj&(;)j#L z>AwZmc{ZBVpAE0%Y5{*e?`DtdeL{liq!P&d$gIC)w;D_`l9B1_KT8$*mKj^2^9WM0 zavLOAt#$MwtZK{8bzclgNLD*My}o%W)|`39+|1Kn+<>^00tkwj%7P12uu-u^Jk$RxW zR)dy`G)7W0jlpgU0qba0X=ABCzG+aWjg|%qOgin&$AIaoCCImKKrXykxAfWuyZabOY5lcK=>@6L;u()@2 z+$g<(DF_;5v#pL3;Ox`h&{Nd2<#I0ynD(??G96aG8GL1jaK3tWO+&wfyiXQu@)lnw z)nsky$j}Y5w4x;`W)?=e^8DBARZq!Qix^cV$N*17`LLBDaiqf8RuYssNYGtPxvOkxlhg+G|NN1J z$W*_S(UH%pPbOtSj<|-oo!iB@^3(HC^JQZc|949l$-lzr(IZRquDKK+KQnbQRcyWu zE(jV&OLRSPSHR#tec_;($v;4CF*lu?+N+=PWQs^jHO%rY(ZFtNy`Oji70xfZV?|3O z!M*ZeX_lTe%Tv(Qp2Uq;9i5(~@nmBQ=!Q8`R4onNMWtHNge zvs5D8l7&lotH7cqSX}jZKk<+%fVoDJLe*BD7KkO5ijYt+ytfW2j@(j8JZjnPw$%^s zqL(cEtAq=5@^&1{slE9vG-$u1!w+Xq%u+erjeU$13)97eu7Yd+Dp@#lhZ|^ph$;4s zT^AN?DO;j;y_J&1c~O}4L;Mr@o@|ixSJkh|fmaCu!U710)rWT*IoeT}uTK$&C@Wyr zc$v+Nc2vCRVTDWqSw`Hpmw+sXjrp97sJ#%3r0$Kbm;|U^w9dy@KYa|b%*iehqg(@D z1_)e|@i~OW++!#`+vS9$OZs_IG|RC0Eb@wt>~74#d*YXT3c-lnTBbB(e1=4NWJ&ut zS*0Wq$ag_)-Ay(xL}Cc0zO6s&Yt1~l$U{I!_o0)oj#F=)GKRk zFr2P=!;%*t9Zx0}SsY-AMYQ^6t^BI#YJ#wCIo)=`lTr+XQVPgJ7~NaPx_h4x$wLy@ zCbD0i9VtS(dpfQQn*R;IP9cyVmb&>5gBE4=osM|P_r_uBx|4pYcZ6UxPH)!sfhEKc z5{*{UDT&zq$jGT)yB|ucL9QOR7nI~77~U*>igQ_D2+KE#i`i+Wgk20FW9Bz`z{RN> zB;Z7uy2S51h(?B=;aSVh2R-bF6 z7K0J^etZPEC@uqF`?6ULv5LWtyg76d4b70Y?z`0JE+zmcR?#U|+Lc&Q$D{?if^w1& z2o+O;AqIRX?$oyF;NipPk^CvX0TH(gAf$}*gR_}~64aW0KlO`ecA>V9Ipj)WcA$fLWePqggK$~5 zQ{+QG02qikIC8NG$U%-H*z&xZp+zckZjw-fp%P43kZOMv-%nXkazvr`FKA$=9kz*& z{~FdDWao9d)J^S`5F&7>*D~21D?B_QQRBrL+CP&i1mt>o?tZaCAlCyhSb_cukmvgE zp2I~5I_(Mwum+k{MVFR(>g#R6TLs@`Q2_=x)JJEZ!@7>&?Pzd#KnRN-_xdQ^$)+l> zb~k*UO*^F~n&s6#m=XZZN7dM0wILi8{KtMh4=RCyBskj#!da>N&KIkIcC?n)O|2sI z)M0j6dZtea*e$qa1zZL|N|sRLy{-zuC3Ks=qY(JO!WLfY(op%#5|45>h51zH#N zHy;YRJ@{kv_L@sgD}9DL*u0ijGXr=Kp*#MY@m@Nn5P38?!W^pF1<>lyjx`2fuKy+j ziyMbZdd^h5yepIKq7PT<5H=9ImDP&r?qU~!#{F}(Vg?6bL&l47=B`i>L^7F5tDhtm zkWmUC?(G}v&%7!T@o0Z_d%y7cRu%MPH<}i9!l;jfwBI`1yVY<5690#S<(-@CZuf=h zkL&RyR?H;ZbcO2wV{jN&)6IP@3*|IvpNexK5Cq9mMX|R_2{=Rus(~jv|EZr*^PT2R zr0jFgbDQ!fkw24i6qY~;vl0KFsNCxpS7mSdG)99@xY1+o3mS)TAsFtW**c7I zGR%}A23xJSN?MXTuS{PX9&&zQlcQ#6+NU2d3CvK5FU<2+8rG7b^IOzn8~Sx zxg{9U<|kqVn)yr~r8aI?OOO{yJCqQ}z1hBAiJh?sn>6V7{j>fIku8rO8osoqV2Fu% z*6DQnlsSCIi5|*Q+Ik)0tD_kD2W)&BUD)^sE86+mCBhh>CyPKXkw}FbEiYs!nG2bW zJ6VxZ7acCk>;z<{Eapd((NRNRuUz+8ge<2z`_1{4j!M%RF)kwIXhSpv_?d877ALx0 zeTu#~L89pi0+1|~+UK^^b-ZXiIyWMJmzTkT)zGibG3OdTyD_7O>JZ37>`AM&(>Ss;Dvd)H3BPFS`=tFd=GL=t*R;eFlHRTy&)o2p6Qp*kKAM5L-C@Nm+ z8HAV(J}3IMV~J8FfhH;P7!~{zMP_2_ZugVIRJ)aX6V)zRk0;*wQuqgV{s;x$r=kOO z_0GCB-@dtVfOZ0Vmn`=wXJ}a#a2{9D10|JPZyQcH;Q;-#p1rW^KKRAwsK5oq&KgR? zh{PGY^iH6Yzm1EX-DY7~GPfJFM>Mmho~&$PmBfATZT}6MZ?#uLchzngld`C7Qdp|u zx-LdA+d9S9M^4B3u_maVqG&w$E&ZAkm&p>Jpui!0XnJoYme=fC%7VvZvZRob7-i88 zHyEn9;T{6~Z5HRTL^c+0Vq==Yeu0HEm*yWrhesb5{eK*w8DJ&e=$|<0J|5IJ3;+D$ zXbuYWJM* zuF@JOpn$>PwEUXybpWE>&ucBzuJn$Ne;)5DmN(seyh>98K9hHmX`YjgGwQa~1}EQl z=kKfg86=OvB1#9KprE*s^}+S`!uCKzL-Q*~_eU2g`IpwLdY#!au-*A2m0{NNx{R$* zl!QXI2Q|&msSD+F^N+-7RT-hr?VN`N$W=vXkR1*X(@@ckmj~y)@7IGe8B8&x#4&{EoBb1b+OX2L?$J{wS zqksi+_4zsPABm?=pQHEVa|Nahmo2v!tL`XUW33Id04X0y@jItnL4Q9#haS^(BHG_W z_kk^Z$veLfnv`?PNc8LTC*}>AnT99NW*-zQK(hk@MCZlBr}&Sp3cpzGDq>&<|1vP| zvYyWQML&c;izzvvHK-vb+(Iu(`Rcd;7Ml+xcu15->eJY&(h@nTITU=Z$5Z8&Ak+$F$E8J`#U4#rU zM+8f8viZ2*vj!>pUR>ZZ7||C*3Qt?>y_4r8>wGeMMn?{&t$pQ1{iH3J-g4`X8mlgv zI;wz7%=$A~JU?P%#rrW0!pQruTzR~*Tr(EtzY;_<>RG3{A`3{T*&S=Hoo)_c04D?T znLoQ6SFoW>(l<@`;*Rrf$o8e0C!U!4Is>-7^y>=5y`IE^oZ4*&nvwj?$jK#sFVu&y zcB4!86>2!xN$7lt(=ss;LBK@nfb5IYqM*Zs5{0vh9xnVP`~E@(9@%*e^WHGTBA)NOFc@C#ztjY7^-vr>?FCtGOvp`{pFQN~=QmZ%0J)ao%&15%B;@Dn zWi@S)GfQ474jqZDjC3Qek`zJk_Z|?AHd7b47_;8?wb2&$>>##0(&M-)4Nmv*O`usR z2b#3(M_O1ZnI264`R@aBo)El4MJQ%ReJq7cuSvH${wvzC{Cx8Yo;Hqti^E+}`KIJn zIAG&P@DIQHQosxM)l6l27W)3;gN%+HE_O4cpbb-On6Q4|i}|65u6LsInUsgeL=o23 z-xQ=ik63%VnypkVEsfDB_}k{DrWN1&95Hed$R;e73Z=z`g@tOFUQVU4IcNWx>hjL= zOwBC$4`sUL#Gf1^DpeAU?p_y)yQ2@q20mu#N^4%=7!u^o1m#P-H$!Z;Kr{J(Ne@TXyiMDajyXN4 zE&U+Jm*$a=4_tRlDyea-~G)aQ)_ZvTPxJsDQWwW8&8A}j39BedZJ zomIVT)fOu37fafk8yHfh!kFjfz3qq6^R>#nWA3$IOwv^M(;n>ODg8S*K6k!i3>gK1 zwf>0Lvsy|Ne|t$ju#=Cx@3jOHQ;{z0iM57!qsSu}1xpIBf>A}B!21;b8a-?K2F)_IX6RYj}uiK;5!`wZPA3*ZaMM5#2m5^>L<#!GxH2htMvonVX zU(4F@#l_U&D1Xb=KIFr`RVUy5)%`uXll7eSc>i56&C)g-0BSw8m>nPMl2q)qb$nMH zJfk(}6_{+CqYKQsmuBv!dtOTaDW!$s@!WZHssabVHxXxGzP$y+0(2&;tW1D)dYYl}7Sal`x5Sc5JNRA&y#&-hB&O*L>yEHCRQ`Q~ zoBTxq-JEX4OJ}DPfmbD_l-(4@HwT${-8Yvz2a2lo^^tt-RT75o1SNNa(?|0kRK;hK zkIWjQ8kxojVa^4czYR&5&Ghx9M=Gen<-h%3Y`q0k96|FhI*SHRfDjxK2=4BZ;O;IV z1h?Ss79hC$;<~smmf-I0?hxDpyv=vt`QPup`{tZIXU}ZUOiyojbyfYUewC6Pjd3>` zBf9@}pyqQZ-hH&LV6K7*EK>rKoBNu}l-g9->+a9p0i{REQ=kv3Ie$XO{!1OnV69DG z)0Si%c*KB4=X1_;KmeM*i;Ig;dN7B4abes-%Ch@fJtm%6VnVRpeBaY*B(+r*%?9Fu6&k2V-0%G16`sL8$$(_x9a3QT;d!1~M%MaVVLS=xFz zE8G0yoYohUf_An&X;va0m*O129=VrjKTJ;EYPQnmQ$$>Du^}>QHqD-m$Ldni*i*BQ z0LyH99)g2=w!Z;Z1dpz2VTy)ST9m%iwoHZXFfL{&nn;;Cy&9cP0t}|)Q$i)P;g5T~ z*(|8~`G_`_$a3)R))Y^jVTE9=zR*&>vI^N@prCW1_JOmagiekzK2q10L-s*tJ zC=;IRCA^RA1XkAxuAd(Jk*NMISV1?t}Wii z#wL^678z(I!Nq;fiytZfJO(h_);8AHH^*p+%BJOVCiqf^sKXFl5&%Y;FD-=h5gQQ* z={jvwz1i$RBY)W(&3reFG6bN7xXboeIqz!~*(Bdampgm{syX%?l$EQ|*YOM-by^8& z>^SXjBf>iK5@k=NlijPhlbNwhrhwr(%T`W${?|PGt=jh!=r|9?qE9$*J^lT!{B#UT z#`pP9F0d*y1en~SB`WfFuBl%~eR;S#P-jlCXn856|CrapH6;(lB+N-?ska_O1l+jB z;y~<3Gu}#=_tl95W+BJ!AF2h~zdZGdt;E%OT)BzLkeH3YeG#;1ur)1CNT1C^21Yzf zL`qI5HYa}RYm)zBlsT6FGen=lS-c4p7L zQj*6f(V2v>tkVv{q%J^zx5BXb@w}Y6%Uxm3aMjnswJDKQ$;D>Fe@|Pt!k~??Ss`x% zZhTAqiLUtg33kHc`fz4HNFa@BT6l*rT)S;|*2TqH%v!e6LPElh4`%f{n@6;w4Nck} zr+NONl}~u#&($bNeu&QCMq&|pxREGpgmcTxqT{H8tLn5POumhn*3uN-bZUX?OxzmM z;u~bXet~yAm@FWS3^6IolI(lGsBXm_yXoW@%C*K{ViTGz%g45Nv7m39l)2{FcDFp} z&%jt~D9#oNLjzuh;GEMq8>_1CtLmz>pZK^iEb*r;waOHX-yj2HletOi@a%v*gpkv2 z7QwIC#1V~N7jt}SaIrFwq6?gyuI`CtMiEjnz7d|?o)Y~04bDG2;Gev4tC@j6#dGIs7=vIclzUS4v8|Njl+4@HR367>%Q`7CVdBS5$ z;e;xToa{N25LMg?hI;o{!lLQ^6BhSBOYT3$_~NcIgAdEBGoi8AU_GG4MFtR)_k;*; zBVMoHym@oJKeKS=?AVKxIS{tEd2*7ek+Etw{`yRG2;}DJY1fj5^5wEn+^X=3*qP($ z_n`lZH(Y6>aVhg1&o9fOa$&qTZzhOea~+Yrd1L==2L0_=%Dra7d~`hXTGS7>8l@Q2 zzr<&_Z{Dz~Y@&KYXZ&r1!2s^lR3~qY{(&W^n9CrAUhZ_XE|3&B?0UM{Z^e&+oUr zTXogOu9L=zNQ0W|A_wWxHsyuZ?XyPxb-bGNQV$hjwO*1VZn!u&#`;qp)~?AZ9_*5Ih+bTg?pvvo1X`E{4bns{YkbTk;qU3P@+bjAS{Pr48A zmNFRnz#rm_tZxYf+?H_Qu+Nc~ii{vX3#F`>{Ib3j&KiXA;l*{E0s8d9Pr!+#3H5*; zEU9fMs83v_HVHu2nHL@e`N`SP11xrLUz)Tux(NJYzH} zecI5F)+Kc#h#v1w(fVBj=apR%sV-a1N}xc!N*Q8Ifz2{lG|-}m?Fs~2NdO@alp8Jx zPhLx9hDi0fg&63Z-uZx5AGs?QD(bi(_BcSvr-}#6zaYqrPCg8bi zfe1WggaR?QO*U4l((Z76H9`5SC#%V@NQ8AXgDulW#Lc(0K z)|Za%cBIn{@_gFUYM3*|?MJ7x)oV46bD>Rc?)D>4L7}(g$?9<9bS6M&X&spaR~WwD z`p%BJ&ai;oPtlv66Lw@hNI~QAW~59>>mi}P%tIwUVzA@i^>r=-gL+~~!_)GPa_^Aj z!gpO>hF#-k#BX_%=n7q4EUsBjr)^X@wJgH;HGc)2ypz=0U2?u* zgB)C}FSA5nlb#wFIIryeZ26|$&bZf|Nph2AP*}gXibb;1GFhLQtl4%`J63T#JKM%+ zsEYke8Aw{@OL9Vdr}?Cq3D3-wGJap=U5L)e1#_J$`O4q)^ejAaPjTeHFyRNbe}24w zpZ^vc*Xag@FrJgP=@npf2%0OVn7^p2yDH`U=x$+= zy^KDaBJj{G0A|hHS^XzDz*!5&GKy0kJTuacv zdB&2kc6McWJJH>W*X0=5<;&US0J*QX0Wk(q?Q~9`0~*tq6kE+~N5{5SLoUo#;NqIC zUmOd0uqnG&w6+%Gs;%5-gDUiK!p?K@kA~7gM{>o8h(sfLunIjFwU_3HUF*Tf|CY#S ze&#dq7Bldf!ua_Bf}Cq8s7sWI2BZzD3YS~}BJnJOdWAEB^|I_n&NpLSnE;2~QvLew zMcC2}Bz@*(ls`%B+uSw2OO2Q-RlW+5MkT-3a(r=lL}zikF_!c4vc>N~ zcw+%x*|d?%_QU)A`p`F$OSWIfQ&>-qv{wd42m@JdH?7D%1Q#`WyMH-Wy%+qgWBPmi z8H!>o>HQH=Vw)Hf_`PGkL&%v7>im-`^HKL2r+5ZXqEC>Uv8vY_Vgq1g#096+aeY(f z1rC@XfGH0SfKex0L^R_63H$VG3euT_L2Zt)bM)Hv4AR+u{M(7hqb1lnC%exEJ9n95dH=lAc13Z78S~rp;7AE*X3~L^H z`>3L=xHbGlo{aeRJ9pKX6s@=7nj)!SY6HQqpCDq0l-#o}D^ivVVR*C&sy(|`J{`ZO9OwMhbv$WsUYX6jJ!F!-#Scm^-)|D4Zozaq^&|lw5 zBi+FnG{sd-`~~+$9LgEzQ$#?_g<5sXD5;2}`b~9@_+nZ;!eEmg#Hy?GqE|p~>?FRKk1FFft6Qn}@<`v$M2R zZK}7duQ`X=IEBi;FdZf2$)IV)V=1);jgI55bG{3gxi*)QD)V{9>;(ote`0!gc$`D{ z@F}{~vVQ+;;bI^%W!7L-x{+DHbBu(y3Cr&fyCkP`#)GrNClky5W**;{SYXg_wFN(Y zPuS92RHxj>(e<;1O#gjROQXz`t)9o#s_(RtpCF+_-HPk8eDIZ4q5lOZ0;>3bRH*-! zcd*p9|7EOrMKb;H_3pT_5xuY6olbWU<39fexy_m`<+o)Wf(8}RKA%<=CF1$Ec2N(N z%z#td+PvMK?U>f=M|(OthJW~uX}F9q!Z`cYZWxb=8c$10Eo&r0TpSzf8%j@+>a9F9 zJ^6<;$wDrCT0C3Zyf3S8QT#^Y+m3CB+G49}8o41SC*DbtAU9vfwzjsXxQMg;SZVm3 zvV3)zlY%PA`HFb(Jju$5x8JV+|rl;+V zU-F`Tq^-zcF9O0k>!VE13BWYcA>MSALAI^IdWUI6W+)(FRCwSi;A4_ItDB{{*Wpmc z=w~dwtZDXBcbS`&5mnb7kQ6@&%h_h_y94GnNfH1|(>|I>lo*#bRkY*>S63<-do8|ZMT)Zs`#p_CLZ;S6{3Rfd@;W@K5Nl3`la#pf_@T$mI zsd!hmEQY@00rtDdUn}k0XG{$KY@S+eP9JJcq_bHE;JMwb#@3mCdR#ZzEREhnwX-2O z+SpJ=XUJr;KF(No6?O*It!`ede`Md2H^BTdv%_#7A^V87oHT6By4inpU!foy5Qw1= z%{c8-T{9@dU}^aZkjEJl7%HX!z-IBjmt1~7%}nI4K;MZ3ctIj*Y1_6afIiwN;CEH6 zORoxe|HQe(R$1Z#{3>`KIqUi0iDZylo2V5 zg>T9#)ub(9A*-rbV3tVz7$UfLD*WAj_Wf3x$qqot+xNF|HBLInL}%IxR@b)4)u}S* zcaM*k_>O0kjwku*3czAHuGZynN~cfx_U+bKH>=%B3;jgh|R(bC4 ztI#C9f=`EAD#&`50YO(6Y}(q+xfY2A!o+Q^X9n`%>Uee_x&h*c+_rlIH(qR@KE|B* zX|Zbn;Q?c<&5h)`LfS-JJalKHzR9q>{7Q^%h1bXy!UcCqga@ErL(<^Kanxl1Kirf? zQ0H5RwE+-$sy!kQwQ(eXC!!+#*_(n&5fK>hYOIOV1aJv>8}Krg|FQwRyw>_4LAnls zMczMlMa49*GCT&DA{qvzpz>@|K3u{5{RP%QJV;FpJ?8O>o|f_qj@Cy;L>3z3=;zql z#mA!^^bMB6GnG7z<+fuFa|L%;#ihtPImF)XyOoCPvhBA_&_>>9U0n0DNANxFSOlmP z@o4sKJG-Fw7h4PIH-NY}D+oWa+kLko=QPmc)`HLG08fHexfYm@Lp6ciJW(N6ywY#R z2k>`KOECP;h+x$mTg%H4{Az0I&`ENsd1xguG$H07Vo({pPPmwEb3X~ zhP^lp($!o3RQV<+uB%50jK&Thl4;iQkp=VFLOz>}_RD>TvcQSEhz-2Py-`&3pT2Z$ zD?QUsBfFiQOC_!CpAT~Gxxw;hFQvXxQ=SVaCd$|E?l_-_d|kX-ZX;S<{7>!wLHg;5 z5|En4#%%nBi!<5ytP|^#6J3&U0Y%w#n7hU4 zEYZQv%&(Od?}ht>7cVPO&%2-^_FzU_6{15-AUc7s6AV^Qc#rGmHc_{xgl7sKW3 zyErbAMWFnoCe*jOdv@f?@oZe2d!-U8`FOSqj0>!uo}Okg+&5{RF`Wp894+?ewn05R z-o68t7kLL(+PtsbRwkiD%PUJJg8;eZk(lf44bZvU1cfq34HqF(!<50{>6UuZ?%v*B zq4lKJ=@Iu-RgrIJTbrBPmJ9Q?j9b{XKzC11TXHpUf#zV?;g)6)HJM?CGPb5+M?GV$ zWo>;N_k6PxTuE<0P1VjQIWSZ-HVN8KpJf_y$IH$?%KqKk({oTmzjZ&gJ(t+)Api{i z-fjvSUabEKO4z3C?eV>13sY2G8*~~1Qr1@L`^LAk6V*?&3TXGsi4u@6j2tF|{pb4eJ6CW9Xba;SgA zThZ_M6UPy-36xYskldz9GsS=}=Hf=&F5kxM(c}-`g{j=qnczK+V%6;0luKvg&L8trz~#X?US^e5{YOvuRQKE#PP6YKiX%pjA#gvbxqT!oPMV z?J(09TXXpYv@^Q^e%rQZ2D3mf!KyFLZCx}GnMiifP8wl5pci^A82>q1iIB!HS)x4* z<;`#yh&%0$jI@=_YZBG>-4y#ClBc+-E>Z#`JH}kRI^ZjbBqf9<$PNZ`9=gwlRITKvD>tV~MD2}c zrZ*T5jJDlV5W+e0_rKK515)@#5B+ZxazAH_j zEl>Ha^4{pmrdx_7`PIX-FFy@08!r&U7HBG_`x{QAc|6y^9tHHLqOP!_4I`A+6a)wz{I61`#|+U#6K(3WlK~beEnC zKO-V!$KrWk1sjL9LDzZo5PEj4mLb9zd?`v6Hr6gL+Os|{jXw)aB#vb<$&+P(Vw1NF zu(4%(>e4d^U({tVV%t3H_jHyES&iSJn@>WozI)3KbrbQf zjk%!lU_0*Y0ibBnrGa=4r0yOAx98UKo~9mth4z{{+_Y)z;k#cZ2LnsVE{u2=&XRCv z(}Nys5Pq_E?;7{|4^;idJvTQ$Y072rL)eEbw=IEUHS;ePzDK9}j9Mjn7$VE&x^jBU zFs`Rveo?x3P>hB~xxvhR`(i@u+Z0q~?emUIEw?d4Hm~Kvc^t>yAY0w!Sbxn`_ z$G+`u_6AF0Z3cb47*P=sQU@(nMtc@G(9xez=!~i2^cQI8guQ)Np`=Tm{Ev2;#j2Ca zhit-z0urpaTTELExrj)Z>*BC-fQQ$6Hv$iqV+;d<+T~!l;(wyu|0iP@<{I?|y~}>y zH6MeH3Fqv5h5>1_`t7*88|0{HXhZ6MeU2_ayVm-0O0F4+X=%+rUF9~oT(>8Fm}<8t z!TxSL^<%|e{qvNeA-k!emX=le4FLDx9uge9&~!jJRFb)bg~ktcT8w=+{;fGu$K#?% zG<1@s(si$@iX|PB-Ki`ai`avQVR)ezr}Nk#6IO=Ent!DCu}V38Z0zjp@8;({umvnP zCs@Dgvf_}~$;sfw*vN?S*aJwJE-==b=Y2el*guzp-+8Gu@cw%YIeNUmpPAZXBG}*F z-~WDFkKWnjt_wmKCIr?`dt;-b7+r+R)l7x$ot*F+FMX~LovryF?(gdxE3Q{owOU(f z46xT{ZH`jfZKxia=c9yi1sXnot{s)!t0Ncrt9X(hf~w zfO_mhaX*Sak@s)A^~vQTupEqP`fCM`XHys`u$4^n&TIKDAH3zU`~qlOYBr9mk_ ze(d0FE%AU179mSSlX^3iWW0t2Lv&1Ch0dADP?~slWmRx#3%{(d9Mi9)$>~BlNFCRr zQrb^vPsf)HBH!3syHtV{hAInjN@QB;yaE=QF9#b|ypS-`9JjL#l}zqcjDatf2}dm& zR)gq_z;{BeR(I6_hzSzdRM0kuIL-CU>Jro$Cr!_sKm-EjI3C-JD_H#&uTwsJ1nRrz z;rzh<_e*eL;3QVyG9<&y-4yU!+_6IifF6%}4A6A-c#Tsw$&next#a)5#@AYksU?`4_{^Is5=~U0+plLM`i^t7d_s<+*zwt9@bN@%N#Zb z@PVO^qmEOG7HR&X(Wh)HO9<}!y-#c&Dezv><*mqK@DGD)^ek#2q}TS9caNuGgn&D@ z&W%OU<9yIv5x~?laB>e^shcPR*v#UdX+%dY+S!UCst*~j2x(r{W~`=({iH)hM)2$; zCHvYI8bRfjn)~yUT@aghf1r1JBd$(PaxpOyoYx>NE<3fh3g^7Ematvt$oDK2Hl6U} zRm$u@NIfF~;K7;mR{KEkY^nBO+i!z$u2OVLx=+&Cz>}va>&;sKGB$9C#lE(4yuY6U z;}BL`NWand(LFxco@9MqcjcFGEk_Mdvj1Cs{-3DL{}zz{Uj+9bcJx08?tjO4{uj9Wf4Wfq zaWnj15uyLp`ah5TFI?*X+xq_oj>Z4a*8ec&|LMv9PwRhysQ>pX6*EV|D5UCjKD~lb zO=t(8ckMV>z$hjBUiwz``_yBveSw$J6SQQe1Kg%pD&bOPujWbSR~Q@c=T}z3S6b%7 zSBhVKm|Ss&n)&zwv!|B=kAJf;TyGzJPRNdoPKTG-uT$9_$KD?*espMVZD>fMlnx-T zQh{YdyuaFGV`n$^da@(LAX5L&3FLZq zIypPB!v;*V<%pF2)<=LvH$TL(4`L-z`c+t2D!Kcvl`^6PTZRMV`{`_;z$X{stS zFSP|BV0MDi(mDFVQTIYv;TdzA%?XGhm;}S;HiRqyT#|pL2)Q5l(s?B`(q!lhB2-0_ zAw6Aw`Yq(~B_W+P({FKDvdAUdTaz)Nq(eZB{rZH>;_5XrW3^a}$JcXz%@6)!*E^LA z6wvpz8jYOECHoi2l3a#nl1#@t^0D*aVAz1M588Q%ntcb~O(Y2!S0GsPwmo;h=2N0X zBn*~Q(v&aRIec-wWkQI|t7xwEp5fJ=4n`Z&AD~M`0-j^gctv9de}|eeYuBf8jH@0U zH4p{-f-|~-ICB48a*DRJm7o^MdO6-7`YR1(l1H0d!`vNh`%G!?X_zT+mpz*a2c}f5sqC8zL=ym=s)J!l) zPJ-qep$vpP(IN6Dn6={LzHX$9=na?6SXqJnH;7ONEPLTRFJQrl;Uf5zN|VTITDq%+!q5l zkFFR!Wq1+}dwDs8r^@7R#4x*H;5V!ASllKZs6r3SrNWuqeK)H8j4P8}OuzP1Emo~O z?#i)#3sAXpxCZ~AojJM5(mU=+l$n0{OphcU%MsF$^F+zPRIJ$>eFMdXQ)u9M(!`8!$FOYt%#UWIV@w zj-o12X4D6L^lM{6K5(4s8~6T6gn@t<7@s~FiQ8nVNz;9tNxaZ0)u;e@*Mill7vYNE zA}$dUVD9pZoFF_ErP7GPj61DumV6zXkEi#6?%G5}2cyT%*0$YBA;7Z9!=Fg$dMsyCmhq>H}~e0=Z}e$nfa`e;SvC zW;_>O)EG`b{oA;I&aI8adq3>g=&NIkn$O4xN|wP|7>fcc7534On~x3s#3|ECPbm$2eHX^ukEYjMnswE zjzQ)K2Tzzg_XO7m6+|LF!ID;_>-FH!J*{+A9nmlq7nCd)Pv)T&mIZps6f=KYkqH7& z80zIdvw@23N~0A93Q%3qs44W5LJ*KJXjDeF({%Wod5)&NuggOxl@Kuea{Wd*s+^ph zcfE0fq`Y2Wa(CQt*swZVJ78pLYR(8Ja!x;B^c$PGMv{blCNWCt&p$Uec&#lLb(13L zqOdKqTB~(a-@ecM=gU_bWjOQv&8Lg7ty=y*>XkN*N<~Kx8%RKTv*-GqE>a+3{-@ul z=^Tl^j$8A!?xr5ZU>X3`oPjCX`0G1?5A#=t7uQ&p_zaP9u-YLX9Wdk}abZDlad!(k zN|Yrg<1QDJW3udfdbmgFmJ_t708K!Fu~h3?(>}{msiW>04El={g@^4L4S9b%LBTm* zuHTRS5F6_t*9Vr^ufXi-nA*_8!@PSBIg3d2R|b1iWXqMd>DJq6cDeG@zf7(!QUf<7 zsE(;Du5CmRGDl{^FPzQsTvBw5;{)U=q)2ZY}U;D zUP>D&MPmtR@m)I9CTaJ2c2*fZTB)61#lhA0J6?r3ccr^(+2G9v5~5$KnY&k9%ON?{}`Jf3Pti^)5=u8+ES6{+JR*OU2`V6EwW zKv6;y?F)C(HekAdJ2u0E4d|yAJaJ`HQ_~mTJOGI3p+sqsE4kMcTwpgxNH5G$MGgPZ z;cJ8k_-lEWbc}hnSi3B13yJ-g= zMj7z$ONuf~=DZK`Nn{@LkV5@a1ld;<1;(q0^!_zUQQnuE9kO)MDA?TV=ojC2EtpiA zMJo4MmC${Hlk=z&C#Qx8Y)1cJ$}M}>h+N{vxiKc&bC-6U>EJXHmkf8p}gXwVN<{q zc3@2(F?u6X>Slw~J!;=DTfl*kNzU=jVY5|yESwJHH(7O(hj*2+tgTBv3ykx6geyvN zSHcpZkG-P5^Vf@=*Yb!MTUcE%k4QIB-ln$=FZ}G;tqNPCFMKUhqK?WdzE`8=6rd)g zefTG)`KzflR)|*A)8)Tz_%{E96S2(4PE;7L(MD^T?8c4v_+DigQKy{>uSZ6l)}b_O zJJx^F*wq7vAr3?;6iv|hOTi-mF?6&m`6iD8N7vSJw9PUxw_>GhajH(7A5{n0EKc7} zs-!Dvbnrf2jY4ID<+Ts3RK0zPa0Kla@ALCNU;tfo;~n+LfogH#i<`>=Ar<~SFYfkX zvAW;r)$ME2_QdF0)7A4gn#6+}oQl1?|DJ>r^35&s(hPV1K(wrH72w>li2IqpPplc; zPfn7{$86N6n2eL)vZ9L|dZFvVf4gYjePb%KgWLCm!sGg46({FszWvBCJd}&`eUF1o z#;r*HR*|ax(}^T#sB?s3+AvwVbSA|N_DALj|E~0y{R|Q{KCipJx?;q&fO7e=;J?{r zbo1O$OPuYjc+$ba&I$Q&IQ3Hk@`0%DD2KJ4!$h%?Og~nqc>6mKZ*s4lLAB0=lXZ5A z_TLu$Y6{~E1dgFucpbO%NSmdQ$kVg@O#5=8+i^iC7tWqjCJVI)vyuGTvoxYiNFkl` z-a5&V&m>mnvbVJ%d&?CpJ==R})G@H=Hj7L8NG^S1wf#)~;WkZ(di-MMhQK(kR-B_= zg=x<%It@qA*LH7rY!)Lui_vbf_3{fpzts@fC=^V8JHx*2FwP;EoOqu-`i5`v75XAm{#2_en5`2D{F~ZX@yh04 z<=I_aFR4+FL_0PHpA-M!-j+oVjfcr)>R@pPDrhxp2y6?1K_qYEMmL)q$xOS-Xz628 z8eg%OK$v2s)h78$5?DjINxZTX zbk!tSgB?(4VZMa7GKo4m^yP0$rBMOD(XX>q9g5WsBrM|r)aCRgYWrNyw-&i_?s`nQ ztSRV?f8Jmsll5Mi^LUXhwAf@rZxJzFrWt~j{} zMLcScW!#5XGK@F_-E1llpz@v~^k+Lqxvz(lrYfw03{+>qcI1ak5;>j5kE3r6>Yw)* zaZ3`W`?oF0Ujd);UP}dG*BCW8zugxzz4)u}^pY$|x#o-Ca)7RMI;A|Ct^nPEFc%e4VV^*S+ zKe--A`kxp6q=btI&|##;Xe6s&M?4Kd z?NJF!pahxAHE=~2Vsm%n2K3HyflCha9XLgSNJvqSnshf?sgFrr3SFvL38*j$l>8Z4 zg*LfFn>g(gjYceGWWmVHL}9!`iIUtFKAW_^SRs|)2Q2}cEId&l#xl4`BL^-3jIT#Q zMVml7jbW&o48aRa#8>sPqQfwOj2&*7{P1r2w`thHbmx=D-WIS(za(SWjK7F3(+=y2=dKh>&^?y**j&p zW**h_vO$d}C*BpjpRvkqdPnr-l%HL5?f3820W3Tv+@1mEvv#J33-to`A^2AT?|f+A zx&B*D;r{A=&lmix=~lB8yS@G!!($k%+igq|3dzwOD~l7b(Td@yHG?7yohU|+5}%iu z4IMS9i`zUg&wh^cdWf2KTnDgDqctTb02D*XNI2@;Is>C6kqMqP*#~%6dWS3*3+MoVhF_pX{Z`xTqAc7M zUOP(s)bkRc&{?#{l2ng1L; z%`3+g%pcRnhF(*3ONgT{J(TeIs(K1*&h55o3L+LSvyVd!k7qJ+saXw9VIY_MNo${N zD}A8|1%n{Zz{tOQ)R*Y4i8BwXWt)l7iNCeOaz(jx`qvrf1}lQZ zjaI3ZWEGJ4a@45Laj|$v7n}RcXb~qt!EBedM)fcNvy9~wPYZ<9Rh>KLvQ z6C?C=-F-t*%V*ot1ct!0md%-@SbarS=4FAay0ODCM|HE~Bk+pd+N9I?ngXpMJsdE!TFP&S+0lC zU|u0Apj6R)r)76S^9;)>CG_vs@(tI>oi5oK0Wll@`PO!;v$sb^qn4Aa9o9(*Uzzd` ztJ1^nYu*rsrpfjdxyClT27Pm_4*;OuTmW5pHo1bg`) zL@9(8@BoTP-o(7MfH-;3Gr6IHJ1!u;;d{51eZF=EjV8k4z1>g}lc9z$VtrKfN$`DY z3@DS_%6?non|x>YuG-{jxREt8S5x4%FVowiGopRAQ`N^K&m#Q4Tv$3NK+H6r&*0eW zDvV>uND}}c?(IfuwK6A9&RLj;=hR+1aqNhTzih6&(K%z(M1EIczh84GexE$q2rU$o z7g+UN>OpB=bgK}1^>j}7APE9eK+#OAKCgSS|={+b;<8CA?AzpgmJ$wxSY0+5BLQ=GQ`e9^Cl*lw({?M+N;{m~{gahsXH%QNw(E}kkLQk0h#FbDVEcV;=vpQ~u*seL=WeGKTHS zubxcUQ4tXW^B|W5$@fbY2=POVzIE=0n}P(`aUmGIFx~9+!`PU|s{o}LQhb8%a-7~r z745s&1tHI-b4H5+sT*=snFC+h%>j`TTvSeNVY2WK_{3ag&&gT&GC8^U=!7LIB{bxI zU{(UT05!U4%E(`)>@~Z;abp|9_o-^_2TE9`y+jEp?;|-=~A;%VDi?wf|msSoO^oH(5U4P=B>j zRjIE+pZ~FLA9^885+RXS%M)~WorSUr`W36+5`+|V9r<{0f9@aH3mH_~uhC|3ksmCt zJ_*gBo1U3r6cQS*((X$UH*Rq`XxmlU=!<|)!!$HdyRonvE)EnHY-_i-?yef~H1#-e zS@}5i^$qT?*^OQ6lU?j;25khV?x*Q?aSAiQF4WB+{0@moIPAGo3A$}v$o>Bc7?oW!WgkF_la#7XQv{~=5-?T z%HB9t;3-Ck!vg`oSUE7$T0Q(D#RjHl?wbM&Aw8xSdJ>TNG{)4}8OxE9)aQJMpqX-T zRf&RKqbts8ir|THt#{~dBL_lrTsLFrzah+HhoNKz#q@LdDf1!M1gl&g)8U?%HV-3( z5Vr3e^;u1qI(348U%3K!KZZve}1N_++|?ex!^%Q4eYlGlxjCH-p7q&#^L41EUm4b#uC zDfN6n5KL~KaH0A)f2Q&98!oKw!2He6k$#kK<3E&R&u*E{a8oN_Ci+})y(}Les&t?~ zvZ}*3A&kEc20D$%J0A^W0`aRo~-lN{_DLZtoIx>Ep$0?R$okqa}o&u zvSR(ORYm@j%ykBa0!*-P0YJ(0deT3;{aL#zTRW&-s-y1f?uq zFTuB$=!N1k_ETX`9fpSyJ}2<>%#x?p{q5p)PU|XU{%zxQ$4zkwFWa|HTIp#1+tZ#P z!oLy+RTrK4K&ABF;1KM%yg|3MJ>z*!z3@#d*t~Br-6b~IZlDuj@i9X$hr800d=qrt z-$wuQCOX2(-YHi1NpXpciNK}dx_aUG<0lLpfKq#odsxfMpQ9eGxCECED`H82Pc9n- z#ui#+HJLr7gs0YRsV>vjCWWAg!uzGUo~LV``qFN*is=1D)vgw-2*kix3wuC5GYLqm z;ro=XOmCK+N&repy|&pvlh$piP_U`CUizSkDPnV2zMvZM8#9~O90OpU4H74vBAXcb zK+z2JAKsdzDpEQ7tT|lm&YSKfjjd*j5>Al|H{0%Kma#G+ff?G{O;(4|f-xl)H!Z7; z)~6khJe7LFbTunGQaGkw6&d3DHonH8o{mH+#q4w$~s(4}cjw zs*HF4b~!)H%6(GPx0-jpi8@$e-~mJmGYuQQZ<)mUBNE|~b(`Aja$((Y6as#^G+a2_ z*`_Y96j_d&O=k*iN3-n=)oF{8n3g^CP0dH)?vYD&1{u?H1<^qwm*&z_v6{NhSMRi6$(chkk#YX+rscR7Pg(8$vfKRh}z!1WPAtFm?Yy`r?CzHUvg=O zTO%W^^kcG4Ki$a(6JZproF)6iHHnf2v2vuiiM5Zm{48sRFHlc=q|hQ8m=r+*jH6Ga z*vK9Q$aEZ;olkj_oovm3x2O`K%58&~5Ftb3FQZ5%rTuOLg^XQZaz5u-=6!X~(bjkZ zJncN+v2d`^VS3b4-w<+)b>Qmd=FuiqWcZrfw;0vuEG{B>uB?NitgE1J)z>0UOag9w zoygIvytPN^vNx`;QkCkTU=_8XZBvDM4sB^ZP0zbGPZb%GmCe@u`a;(0r_lmtx{P6P zG%l z(I2fyK@B!1`HU8b9%}|X5Z?VJYe;XFI333t4#?B!Nt8=VP5DenkYsaE>w5R-59LR{ z8#j_)terK)qmesav)H%#y*lehm6O6@|7qE&eyF+2s4$zkm4VS@H4sPFdF=pR+j3!= zhQAG$c*+Bj`9{!#m$&KpfsUV>!|ONtK~Cnxrm-XT@cIap3N`Z9dgGQM>Er_o0|lT{7b|-=~pp1ECr}1r?TjHdn<|{ffq<_(DS^d(Y6v zn)mHuRX9-J!pL}*do*~9_7n-)b$Gqk#OyE&asZJ$xU9gUbExE;BVnP2kC$$Nv5}b^ z@;U+G_d`_FnQO;4ABB7{^N~c>dVz8sbYXXDR#w*YU$s}cjabNB{)DtH-~W!S^d!KT zFhS$_;*}c|SnVaNvvp2?z!V=fsDe}P>#tY1X7GHZWR2N~nCCg*-0JK|?Z>r%x5%O5 zZc)!HkDV*s-Q7Kz$9^E({Y70(Z;uOx4*O5dQlAbu>}NEaoeX^T48DHdTlmma`i!%UQWugb&Lz6%s7yIskRnHu9ym ztBO|hp#`*dwQi*Hk)jZl9|RR$vlTA#3vX)gbFR|uZGYUt3o_iRA~sUIAwooC+y~|*ABjp|6$nSDX&5a04U%t zu-aj^Vd^210%vV%KL6G?ShsiPX>j!85DMD~qUoBS@~h63@K90G>si>${ zTe1y4JW_#Sn`vB3$VljklpO5vdfa_T%NjvHI5vH#!F$lJ33poI zzEVdnROnzHDt{YKRz_NKFPEZe)NJeh8RsZezoQk;txM`8Cjdy^$58xDT1l{KoG1eS zUX?rQ2c*ANCE!;K1=$1TS>{ZKu75%axP z_o^UZyq>=|YeZ)d0pBB`-gx21>Cg=Eo{(yhd}i##eDRm%a(!l-qL9pBTheLv(l8W^ zPN(kG&x`4JnEM_&C*!_Poz+j;#GLz>JQ-ZztKDIv6*eoHw4A5$c}78}JK59Zq&0nx z;y%7uq!dh0E#C0;%fm*XP={pIdHqNiw1UFFV(#l4tGJ^I^E|CfPlTwiDy#XkziD$#|0prLrLm&7dALO?ewlLdgMLXuouCW+%-EGypshq14WiX+&%Z6E{- z5E3LfAvnR^Ex5Zw2<|#K10ex|yUXD2?j*t88Qk67Gn);PTfa}JYNPT<%B6Uv_x?e}n}m}FKalpx_qy(gZlPrrQ{vwVA=Xs;vxB~ueu zYyJf_k)LYVP$gk4NLJ}~68S$p<}YXCydni^{pQ~i(`4fNri1}t$^37G{CK%jblBtc zXuz)A_H#y8TuR;DO~GDhon3CP3e;o=M^^3k1ZPzZTOKVA!Pm;-hjYNXY?V4FpoDO zU1lF(v)LtGg9;vGvC|GM)f8l7g=^xinh06uFI&?Y}dCo4mQf4o-AOEgf? zKlEoPKeuU?2zYz@czpYxawN6^O{u)xdj1zx&-;SX$Hg5auUd>Gy_u_x zHfi40RmzK{P)rB|ixWEP1)E7>7p01iDn^lp&d=dFKH0gRtPOPH(Y=d6&MXtB05v*X ze}&(VIA!z+kx5>s3TDb9lez`2`hmgpd^PVBatq5IJK=4@@j0|bjnRnhy6-^LvY*?? zHIDffzn{4-WYFIcV4(R1{RB&VDv{%3?;eRC-MP5)E}%NvX{AwmDppjC3`{F zq%!u^+!-gdZcj12Usf0~=0t<*Yh6I_YS8mM8LSlDPfHzdd(v3Mga4gQDL9M=v)I^+ zA4sf>wpJHUeIDl-+oSZUdygKeRW&FX@Zarr?Oddn%`-NtEQ~z`f!6}P<-7@LSiSF%@rz1!-= zU3q;O70CeJOh=g{ictCq;ql(UPD>*@aWkLx#OXUo_T>aTwIF2Ft;%`{G&-rn0Ypu3 zwMc67T--h8M-Wr#kH$Tox20uY{>`>?^%jKKuXy(b#)Sl8S?310QM=l&4Z)^c+Fap7 zp#}$NKM1xPS0X`1?FZ~R*DL~StL$qQV<&A>&hNaI$v zlWTGbLQbrp#go^Pb>XCCt?k(jW%RIHu)u92FM>^jV7%ZccAf_|sAlSnY9vnRfo2+Z zZu;I_eS3_)#Ia)hW9W(M-B)8-`+pZ&#c5>Ek{hqwqGW17uW{PGxKohlQ|yRkKm?-j zAlhSj?J)vDw$EDn9qVzqtJg`4?f+)p-wX{b5XAv3tX7C4kS}2mT7HS2s@HsA|G__J zQ~OM{EdAEIy~bxYQ?(zR?-lJZA1nPp2JAm{Y?>;5yRWqx zfIa-ryq{Ybl%741NT#Le;!$70uQ5dz6;%|OtTXw(N6sx~@>P)ufb4vX>FZ!rv7mva zv5AILEJ(qj-xQ^@Ota)9gw|2ri{S^X;wi@?g!u`nrZ)tD&&6T7PGoqoZR9XPOkPCb)r<)UCdO zsI^(cMkVVR(C`_{oXJl*;8~vwc^ASX`NFyNSC;4^|R5z>hOs zelU-eXGkSGH=efQxwXWK9`H;wT_hP)8^*7@d^$QI8+)5YKR~m8mGWI6uwt}i1#M~z zsler=>3V%HIsJ7-<4h%*)XMNN7LTV}bqt-({!aUDRjm>3oEN+fhQRgtdM++pOAWz* zN#wWGyWvOS82nyiPnYE9{I$xc6`i>S`%`HYaf1)LLKdA*ffrS`-MJCzJ9I$?`9^=C=VT#dH90g0^BE1K%ZA;3+O8{v+Y zJ9n-4%X{tYX2sr)^55&Bv2D%ejUJ{RFNKby;#a0Ay{Y#Pmja)&3n3DLZ?rs~oDq9m zB8l4g_7*$jLm#< zGh7gAT3N->zOt5?NlRMF8_tDn#_daKo{R^n5K@)35fjhT9(#Tlz515o7FxC!p4h25 z*oIJG0QR(K^bJD8K@Sk$p+4=@&{Ucl#Ch@zo7YqF4OdS*N}X!E=^3Oh01-9cn;C=J zlE*om9-px(<2znyA_b^ee`CR*9O6PxE<2v7`5=c|pEUw+gW?rptJAtfYiafo=HK6~0BWq`trK9?rO zhvv%^`IDsCSr0qON0h%ObDb?6lh0`@ zh0vCd?bj&G1|wVyEd3%rO;@2ll?H3u6{Q}O{kH~=$2}$Ut?Y1v)pb5%9f3B9zs=-h zMmkCuyi=_Y_AD11W@hY2)+lKC8=t&Ge80**1!^Y+x=wpM@Uy(MJkL!hOP>V%`FV-8Fl1ByUhbe7L~^W&%Wk@;k$NaG{W-e02{ zY2E%Hs9mAra&+gNelKILjpX5w7x@ltKy@YI?)B|Hr=00>eTl}z(~_nkv>wIDx>d!) zWtXPS=>RM~9^{l~^hI-J$0!b7`63b-(T$Xm2l!N+F{s zEYPPquLI|1=sevG_H!Q+mXv6FQA>|MCFb$a($;+!5lmy6&TCIk($b4bVOkCF_`r#s z8W7;=!|%#)fCQfTF&6pMRV^LV?rdk8!0+YYAu_m=wJlOLiVj_#BTM4H3l3>++RrS% zsl+-Os=JFN)y#15akkTo`k}s%XFs?Hz>2A}642lPrwl`;+Ow-|Wb1!TcZko6+b)w9 zT{utU!-uoZPX~&G<+clRuHkl?D`oW{HZL@^0GYF^<}nmehUwp$KT4xnDSv#0CBPA6 zM6BASZwaDQ-)#HxzOg1T^tK+1Jm>7TecB=WK%_!7QgquY@9b2=&5$xTksMZhK2Y3) z9uQB+y$hbDmmL?dws~%37cF5Y-?P_UQ+m*W_F<|JGZpe zF%KJuM>IMhv5w@2$R=(a*zS@^hMtSl(GLEb$dmu8Z$&BaU!9Vpluz%hi)&Uw(~k5n zxpi_MOHijwcFe4hZW~eP=urtfsE}(02g1FH!!6{pD;p1G5zTO&>(Ys4V*)GGsADW> z^hsJOE9K_7-a7X_r7$%Ao3gIO9-U*)Md23?Y)_vX>4B0WuA3vbi*3#FXPpV?) z;F+$I_fCH!!eFfzC7es{!LMK`?V-QnF6#dXA5sb87&o6NEM+o`9q?ePthrz|Re^-; z6QEhMsl*NIr#HzZ$dUEE=zZ>IWaPxSw$ss3(HYn3KMx^_?wXjCiTp$6geoH>G*5T0 zWMs8(la(X;DIUKYa`Dx}40UT`4ep(h>(&n4aR2ax6)X>8%vwA^Urf+Zo=YJ~=XUDG z`CZ8Xc28c`)XVip>iOLP>KJc}b zNHdh7R@+V#=e-msZL#RwwFO})aBJ}J54^1XGAhsP?}J|Av(=||peqqL>Wi12&i#`CdogakiWR;LEBD4On zeKODDa|vCd(`BJ*%rSJQ|1^HVXU~AU$h$iTzp~Wwimf2%rV%Us37O4 z+^)}Jqp`YyOMH~9J?fkNxNWabP>%4{x5#s~GRivZi2p-(q`lb}TR~2?zs<9@8>`oA zJD+}(O?0*=G8)|!2nXz0@yck0HB|qD2(v|DiZ%1ORZq4qxw1%Pdq3&^2U3jI!EBs zfd_o8PNk`|`TN^@`lip)v+Xurm%oF+#D^C6iWMyWxVFLQlZf2lDzo3eqpWS`o5s;d zmj;enk7jEfLgAkSKOW6PLXoSL@)kX$Qk}L;8U^2L*pwNt*Ek0yrauwK@jzE-TI>{) zPTl}|#6HJ6hEFApOOow`<io*n5z5RX&%IVc82?#aYLawup7bp0FDZkTKbR+HK z5k(}=wJ+ox3u=J&gnUdSPxu9vfB9W;K}SB!2wlQ>&dstnyS|jPr)or8Pa%%xAa(uV zt#A8)WhLp;>?X;-KGmHi80IFQ5QcKRNqTHf;qJN9Hk_^d(3ZT~W}oOVf5|Cu;(B4D z67NX~b-3*@j!oOLPe6xg8|o)3R*b_NH+;4#L3`_4wm%$MiL^hQ{Mg! z`-h$S2up^*zWggf3xxL{SwD5>XTVMWGcmDU{T!v~OZ!?^H#Ibe<)xoJruycAYVK@l z@n1_DnjZ#dyp;4DG_iJ=o=#m<`<_9=maydS85pCz4WF&_KP*gn{HYryHiVF1rrt4Y@a2bA6Ob5hNY-? zrZ%)y-T~O%nz&8uFje=Bg?fvQXNA0Ku#WiF)mEGBt(~1+1Y_Gb2u?q&2uyB;r7B(Q zsdnRf3w7UX{o}#J$fec7;`H$FbhqW|HCJ{ZhUcdE&JOSSot<5|YZ>p6yIL7Mpz`R{ z>mX~+#nq6Hfwkc)gE!42ubx^Bb}7tBO-(JSdx%=Wc^dLr<<;gr85A(D1eV^b3k4=4r9C+nZnoGmo#d)yiR+Qe~U zOE$8mIKV07>zw!-LSn0exWVTKmR~3l7?CKb(Mo3v*Vc;0tZJs1oC=1HB4*+H|eVq>_D%aatMFasX5LhG2uGzsZhke;Kga zru*=*%o;yEW>^Ulr3*fqH2gFllm~!;3I+6Fxt0e9qqF_25>_1|uNbRNfQ%k<^aEd` zyAq^Yj7yHH{pD@%YvAso3E{QkkWP(r+S$M=##BNgA{q|>cs%^@3?r<`c^E_?Oo8~M z)gS=EcP_#9w}-JzT$Kt#8D6h(DO+#W;r-4>_C?k@Jr_eye4W283^Hh#d+W&~0edC1 zK7kCS=`$uL{_9nEA#9%kpqSC+n6>un!m<%(MZQECdiy=u0?dC);}&XM_`7wHlBRe4 zt!p}0zZn2XF~X6Lqpx@8a~s%Nj?6HcZWxFC0Hv)`e4cL(1KArFcd24ON)q^K?oE&Z zC0Ew$gVVo0Et2j8>(74RG*@hYi2*}uB0+teMzf>&I_m^&gI~;~^|BHZ0ATTkGe|eG zGuJnja8^f;F>!Euy%L`t9vN1%)zGO)w@jo9|Ce8<XeKlB98$G{)=22i?jz+SOV_x?R$I+(zau3D4dSxAgY39G;IsB}{6XmU%rNw2e+ z`#L{tO8>4J5Z0%yJmIwKuQnZA$89l_b3FFdd2Q%s{$eYoEW5?t+wCP}bHRUr!~UpD zDQ!G1L@G}@QXzQ9+>rHYKZJ{KBeH`=4gM|Dbp$@!0YL9GQ*A2CmmiV$-gN;K_*u8! zM%veID2haP1>13UYPu%qCj&JTthfKovS^2&`pp2qP8uYwY;O-udy zT-EXH+KPu?Xuj#*E^u7B4me>rSf5{ibFy7);n$7a=0vB)Vu-v}h{+b?W6ZBZJ+(bN zp5|^09cf7n<}vMugji%TFc5^)iIOjD9W8iOhOwe=b72q}V;!y>ZtPK;s*|!_65TSk z-m{TUa{dmd^>FH_{7l(YZ0hH>(Z?r0@3PJB`qTu^@1*L zIZJ&Db1HRmg+Mu{6#W^wx@?pqnmZY4vY^dZ9NXY2frH3*}#VD=A*d zAQi{8!A^ZKf80m4ztiJBty5yXJ)pI2qN38vfg!0+9hTDZ6op?v?_e|{rNvP+yYpN- z+`18be`m(A+7_0&C&2S(xdh4FLXKk2?@RjP6+bjL>oNTK1HNWSEWvm2FVB+|&>#1{ z{hP}=mRB74rf#DCxPC`FORjjRwers0ibLFdN?`u&L>+VwQ$>b0PFasc-+=a=3^oCk z?!zOtZcEXQNAtXTq()tx73YhJOt_j}iW68^t0cII2{8g@lESWt;ZmH>qD3|M8;51T8rSeK3sk?MxXk)s1-o~C0L5$U9i`&SGAXS zB`1ulM1{?3^w(E3ctBW0MVJ{b7YbFpbR}_rHV%+dDNs3>>?R-X5a2{sqW9b8x$|Dm zI&CV`9d1+Z`NqZGXu(c^F2Zi}l^2}`2Y?eUYVu4t;^nD=1BkqJ7XmPURg%F0Z;sNA z(&JDOrOg9fN!AT~%hu}ctTmqZ#L)ft4{SZd<2!twerKrMq%#?ySG|hrGc9i?Mo4$u zcwzDS5Gy;-rHvErreWf$K-D|ClrZv5BSF)f1SGB!!w}8$`kbN08Lb=AE74E4X~Dxw zu+L(da>?|mwU2d0`j*jvm%zglwlfXCgQ%dam_=NP^<(>xR1{E^R1Zu+|M>mM-olCV zhIM>yODfnoHp;(XX()8GRI_sm4-YS?O2D8oO@<(WKRU4rR_Z)>_E{G@3q__-57K=e zyK!d8sriuCZ3;sF#4oIG05^7cOLhO5H#u5!g1e52PkYtkBs++j=~D8ZW8+GR;OnlI z$7@fI?}^Z}f%fPlD(xl1m^y*1(u?+uNl_kAEUi0vLqUrCmBUyB2xhEZD9ze(yWkE8R;7|LTY(<=m`QrwIq=u0Bw_(lwJr(u7igs)?M*FtQ%!e)6xVN44ys z0lRioF4X6!E@&sPFYvNwAMI7nB z4KOMn&ZCH+J1*sR-&-A_?SXhZ`R>SYTy*p!+z*>0C5?fjI5i7e1;J(*(RK1N4c#Rs@)*3Gb`V82MqE9dTZW-Bn3nHk{3$OPy( zIF;7b9SkL+!UQ262U$jj`G~xAvJ*57(kG{@7M@Wt`YCkw!^TV8gb4mt}_2c!GJ#wCYxMfv*4pS=pe$ zu|f`P5#uqMCbeuO7=lb!H%RQ$GzB8eD-@aR6Mu&YbL_bJ891Y?V&MIOI#DW3xX?}` z*7nvI(Xm|@C0Pm;4wP5nBkK;yF7rF@GFcku=jFy==>3U8_TLuX(a~xpQvMA!YN_%F^e}CLDIAVAaV|oowt8KIU^ZV>Un%({E6K!MG&qgV~UC{ZtTP( z7ea2?)ll=%f?Wp2$H74n-o3``H}#hNbvPOF7>$V&4l_3qZaNtU9r{?Z3&Gg#8_`ek zQtGe@6JE{KUUGJ;m~3_{^sx`<6lU};t5epeHnJPHg32_qNz9 zQqJ5Rj@8I;z!RE z-<)?p9dV;83m!f0s}r6iYIDj0v64$ed}W7=+laj-)vX z)~cU2Jx?$tF6%Ie(5+}1%q1mBzgor>>VyY=gSXOPm5uf0$kOVjR}tbUVv4g7dyU;k zU(W~0*kE9*pA#%z0N;-%T{7hG+%N0cHCzS5{UpQbCu#02e}BFPe#1+xyq(#(n|Xv1 z&t6U9mY%*z?*UiQ{`xvQ4}w&?<}(4pb92GqNySL;yz@bla_S1}Awwe!09|ag%s_a& zb!Wm&dhh`j#o0ZP0DJ%KI)_`3m>t}50vz<)a^ro6dN{Lme;mSdQpY>O3HvkzZShwa zC+;A=wzH&Znp|>fe@XuN?CKgJVan1=deZ=-2Ae^(d_Auu7wr^d;^f=TOa+IE|K~NZ zfAkY~qa^Tz*ZF}`_<10LSTP#-y8n%)Pmb{?>_!Xad{PoJ4o1JNOWZGPVgqDhIZQaN z^Fkb%d#dymfIbz<*R{1yZKpFEP>_fO0GKL5WQcirEZ@KC&c_<#ev4u8Ax@17QOsPm z*`o%opnSLv0fqxh|CJLNA3DZF?CiVn3@d5xdYKiHnT}o3HQ0+Fz_T5^t3Jp#)bmk$ zhrOZS;<_w?11GBisx_bXX>7IHxcm06=ew*XsL~h~Nj_iK>|PpDQ4zN1F*}-i z%Lcs7*PpN6JE#6}J-E@%e*g#L1RE5naTQSUdJ~e4MLS2>u<0hYh|9HN#FxNVxp-ouT0P zb-t{92`3|8w3-|X3|2aZPnOuu&sicLWhiTZQh8jW!ePT0PPS_UGM)d9V!QbCujwsB z3Z&`{Z#W`CMuv`8j+}xcFwl0{?+2F<#2VVw@_QnKGaT1vM`#89iuMwfWsX-G^1#ML ze%j&x{qflWW^T_2vL)Ydo3t-eF#}vEO_$2 zUBJA?V4;*gRDl0y;9qES-m=$mU#y-Z#)A=(F-OvQoVWFgm&kT{f9x1W!G|j3^yhv1 z{soSmH+({h5*0nD*9hnyA2(K0kL&*~QZQ*rhJ`F;o57i`;3rH`j!XBwKXZI9-c%d? zJB*GCSWhkZSKapZUh)C61BUmX!<+$W8FF6UZnrl(;h+e=WtX|O?99dQ_Hkn{%g}q& z+MpP2O}Q2M&1@rJys-SyyGTnKi~TiiTZiq`(0lDyeg>yWOR_y@SL_s_2G{)H=S}nz z>{mbK^tZ0B$?$!QS~~)>!1bo*i$0@U?W!ZkBvY?aRi34vT{{k7A>_*-6YQV=Sr6}3 zS09T0S4{cmzqRmxEqDKmnd0q#nYum#08uCA6MCP_M78Ws(7S+bXDkupSr5c{3+Yhj z>f$|ly+gUV4}DnwVYKiq#Vp}-!Lya)o07eG==fE#vdHrwQ?i6DtIA18kNWZ7EG{K; zHvMJ%Ag0(Epv1Gm=C4;|u;utIr*BRNl7C*_16p^;B_bBD#*gbbPJYCgMg8S|A%1U@ z8{$NR%_8ZTY#P7nr_NU0hNH2(;dw8dcQF+71}CA+>ve{e)-#!v(m^ZH6w)zUJNd6? z5l4Jf3to?T^Rvtk*L7~4_v96pL|}4|ePA%QkK<%)uu!#++!h-_fdlrh-&k&uvTwWM zNXJlU-#OT5y*EqU>YlhaqCw?!0aktW$$8&;>w_D{z3h5l+6EWYn>1Efy|B=rA;(uI>3;vad@73DjiJ!f z@$gW$LZ7w`1P5I9lK8M(U;LF5yS3SeY)oRZ=nabxJYVT3x-WTp7(JY&p z)?{&I>` zy~lBjpL*y?(cKCmtVS^pzyD%&+mHH0h!^ivNYI)d8#07ZbVy$^@P3(PnT02y z$7WA6y)&}*hXe~Qg10Cly;(v>2{l?uWG#pE@<9cKo_^mX#n8$~In)|4-iCJW);_N> zzgVL1e*2rE%mH1A_KJ6g+Ao;6gUNnHfofD!2;^4F&5z&Y)!24TEX85q-{;Zzo$KVhTpz7 z$oDAKArLvq5@;qQ1%#E-^USW(n=M_U@JSS4?-cU-1#zAnm1+_AnGWR-86{q#WQAr= z>)b@ua~$12YB^hC_4{=aLB|Q&lZw)-F-s5&sI%Us9F- zo9x?-4D2xe^3P8Hj}iWF?(csRf&Z`3es=!{y5ssd)cC|M2}_CW%r+vPGHClwoa_dO z(>CSi6@;%fP-oc#uX8Ywi)+&h8CAnpnqu{_+VD06oh0@*=-N+*;22>A z*6_ne-Dazoze5x!kTx1D8cTjv2tc|q>J}RE*9%jSMmi;-&dY%}eb1rLBHo$FwmW>5>lzW5b@_^Xm|e2gkp-8nuzd&=Dze^T&Bvud~0)416a8 zPw3F?tL5E{)b|~X9(4u2qYS|?I64>g$n5E#T>YnzdK8CAgv=OBiQcqt^$|8SHgj@# zWKUg!&yO)-i3q{DV&*20fo=lRuuR*q-|0a39-<` zIy8dT{pT9<(eeuGm2a~nxhg`Ts-fB;eN zVUhadJ_jW-0VSSVLgBPkolaR1=~2?Z4Oy|=Dd?kX{_Ur6Z2so^;?jk4?PCD=%6YeI z26@jy9h!TC+2(`_nIDaX1HMANp3+YD^8^A%f_z6R((D&-9V#{faLo&i_%X3FgqexIplhin3&OKGQC)5_kfY zycpj))~TBsQRD^XxA!a9i|wabAIsd|%-2`DxqcIEj@o7R0ND?AA_QWDseWNd5ghYV zQb#>_+%TZn5nSXL1<99aOrA`^Cw4}^7exVp+C!m%Ea8Uk5twdyZY~tB{>We)`U729 z1;D<#lM#u=_P*<7dXqR;{PJNWrHRd8fPh?fpc>!H{h;Tj9Fjqiq~jU5;_U|ygiKjD zh&>nXMi9TQYiMP)z9WQj;pjl^o#rloJe9ie$=hjqJ3mE3VJuRLz1ueKo7D&R0Sr_H z(28b5bU+DYd-fMe$7dsOwr`nKr|w*V5%DXZyQ|bpd>!?&HQ*;F!0ZMM%2b~u2DR-d zn3bnDl|MHb58SV%PDiV9+3NAoIB$3T5Cwp%I+Ul8JBE~rxn}KAu;5TET0M-g$FFot z438y&6h(TW?r62liDN81$NaiKS&-J?6_DA=n!hr=ila)-kaBahAorfMh59`J2!1AR zmTEnJo+Ez7iR3(y!G;I04Pk8Ie?UutO16u;yFq>%SD8X{_ACaGt(Tp>t-O{`>7St0 z$&u;cCsMkT3Zll-v%XKzdmeb8@Mj+Bq_a33DvSt;p*8G)kZ;PrHBOO|P5`cw_wM0cuH(*v(OIdHk&# z0OHAn3c{?nzRf$_C7QSU8h%t^0m<>F@Hq>O%Ber^gA!tL_vTKQ%B~3U(q7hmq6v2M z%iHC{+u6sbv2(rYuw&RYR67##T~xF(3~8bD)hxCj;5CwN$n&(&UD&{~)MEELit1Z! zqcph6F7>j5xIO6I#jTP3-5jXAnjOiCY{anr!#^{uFL9SQD1Cfk4IL$IN#Jt1m=jdc z8iu(8_=s7gpZ>))?@Kyw{>x7I-woXVunGR#91Sxyf+8hY?`u^_LwkGjuN%6z=JQaerX;-wGTm*+fnU3;EoFfp(Fp=csx1~Hl4)ha8>nR@7kZ^>C%>HJ(H z?Vi5W8Y}Gg5gqAh(@>FWm;&F$>WpNaOV zZviDY&+FN7dN$s8eL1I$gyhyAu+4K=<1TIN0Nzms$!|D-Of{0>7oXUQ%Zol6EKE7t zfPO@x?{aXy%QwDchgd!$Jtu|$T=gQhnGLCiS94d3@Neizr_sU`TU=jGSwJP%3N{J+ zWg9)GUZXP~5CDr9jrv_?OKsfV9ThHn_2m!K-uG{h@C#IED^UzcxBR<$m79EuXf_P5Z z9jtvjI-arHo140CkpS%tA_(bQ^L`pxv6g#`8wj?p@NG(^lu|L{U0Vdz=x06bdo2wG zpKup=P6pg9OT4+_id2mwt;q1LIBamp9Ue_ct!hn|-ql!65j%r5NvOEq9x1=mlQAuj z6}>3fYO>rN(>I5-z7Z)mRmyeJDsQ$X#Ev3)VUBy3k>MSOKj|7{gELr;H1jbS)W_MD+CbR_rPEyb6E` zcIhm&+|E@k1bjR@3(_zWzGEn|p1dfoMbP&^f7!mRKW9*MPt#6J9b~R`o3@_)a_?== zmVU4hA>il$vL>odGFllBF?f0eS&EgUlAYuv8LiolJ9tTHd2-eDHAd^G-dA-M7nNvl z4CfeIQ+r(Pi9u_;+m;CV+$Uk;1ve~PmImTh8Y}{pP0C^{OVl)(+xu;CJ@GhH9Tn%7 zPS#S(zpb&#Q&S#mEBQGJ!f;lN#*~IG(cgR)1V5T^Om~fDu{0Cjc{ZCEdaL>A62YRS zyIfzmZ03y4yA=b9EZy+D7B9v_=OOXFj>DDunChBT53o1*YBr^Shb#YJD&zB4H{%bKatIP_z|FwkhoYvBmIm#A36%YwkTk{uw)b}wI2*z(DaN2vFD?1E*Dwr6T1s5YdngB9vdJd~Rxi>)OI1PH3tyCQPjKl^bUm>Eqctq9@7c-_eN zxVr>LDU{{f4n2yRo*>XbR!&P5~OlBaLCuWtg4_%nqww%<*%z zON&L8f6j<#tY$4JKO3Efgvc%U3X89F=^HQK;$;-)l|g+fMzqk+Pomj~?8&_KX)b6-5Y&F(}eTaUH)v1Y4)= z2p3h9_3w(Z9TV~L%uQ2&dTOuXN(!NR&-{3PP4b2{MeY6gVw3_P94@tdrKC5>HjY4Y z?UP(J^?cFha29XJK;FaMK1*n+K-)bnN}LzA&QqH@@u2EbK$#wqzPFi=00UbnsZ&2t zMI^Z^Hm72Fx|rHSJe;WMKj8xE)En+@I@LB^(_WR{qM9#d7z#GcQd&jC%s!L324+C6 z%qJX;P@xXjY-~++=}lnu?Zn{z>b>QU6*qzwqk4#*nr6u)^9)(R(STQr1|#xmEI0Q7 zf;z**t$jy5cbJlI6m(i$HVzg8>YAP=11b$2yn7>9#xwqKlGMLe37DdCxNf$5c8Skz z)+iiXm96XWk*GRqJS8(9o#lj+BSi9%mcc54W+3sUuw>4S7?*;a#Y7d|wFyH)VqE4+ zXI%>m0;sqI&6;(+%w*X-wZZwltMXnwKTkuh8+9VlT11XB8h(J7%N3RQB>9|S1sI@o zxAl3Y_kPJxMWW#3{rQZAzhN}PgXj2Fw!^=GCE95E-Wvx)^S!)JL&J%e+Es4fehR$r z=_Z}Qhc;cA$x6OgH_Q0!F#Htz@inM7h&$3}X6sK70#e3d1mVh@s^wOeexhn7L8aYF zqbui|Bo`AVd+(qb!cwAeoV~k!S8F>6ss*{deT|*B!>^+BaE+@2)C+0J6Gf*^UCqnR z-(a(G$eV{`aaaU-@CHc>@&6-mEX1#pqhi_j;z%XU*BscRe^(wgQ5Z*e#l)ymr1Z3e zG@A7vim+eZ->S4eNB2#=Jl(Xhk5lS^DkFl_;2I~dyp#Jldgyy?H z;EhrSznH=I$4BE5bIm+0B==dPUC?)smQh$*Q!I>?FXWa~R}>7%>#hFz>XziisD92> zD4_lKLuet0L+Itl>16eq@(+xyGk1O%0ZiGj>En(5dly3(Iq-e?VF#F@sF+m2X0r9B z9-A?;K;Nq@H0LO4atoFsYWlmxv2Vc`+dIj~FEG-RcM&|qgd(EuVJ=s>{5Koq7WR$*be-_`1$1+}2|KZD`%&2Nm*ruXq|Hu8yyI zz;aCX40)fgcCS-dG!?o6bp})v8JA*dra8u=HK+uiu-mwds;MjXr^~CJG-*8FTup69 zH$fZp5}4#0dFlHOL65hTJFiHF4=wBL?RS2b@^Mm5eUZJ|Q%PhT$7jq5Y~YLvT`}Yr z`#;TnXEYpt*!Ca@f>fgO*IPu7E)mg5^b##Z@2f_v7DSXJYSblIHF~en%SJDY)q7oa zEsOPR{_lC)dCv2Ee9wD-oHOUlZ{~N-%stnAl`vHKx_ye!WTp5Kr{&P-E^C_UtdRFG zZ|2u3iM7^xvd&n@BaMX*+nzqur?qk?37BZgZ2p`Wp-eNN*$)V3J?w-wM-!+BF# z(5|Bu+6FUFqBI;G?qnoA0N*3N;~}u3mFyAW`ePdh^uf%CDc;92ilY3I16-+OkWZ}! zzuE8sZZwr%m%EIY$xL@7M0&mu0b@$U!}@fwv(Ng8f#0n+*npH(j@Y(G?qVUt0Q0#o zvhUGm0OXZ89&QfpacTH{bs}bzTW|pYvOZS&K0msOw+*cZ?Sb(wYKjVkmO{izqCV0o&gaHJWPu6^3;wKy*@+0UU(w{ZM5;5YyI7H5=!zVSE?~OwZ#TpPW75c?w^nDr~;o|9C!S5!m;&qLD50! zbcK_mH2i`|L_Qx@%po8{<>6UQ{yIUWX-G|C}5BvtN06 zaU`aXvjpS^!NecXk^=RO&>m?j;O;|9nn|D4fqJMkFld;Z{a}g-47Yp*h6kHCMyDPM z2`h(aeu=8vb78FTN+(AvAu1+RBi|0$fMu=jza@%_<685GO#R0Qa@lHK-r!L5w$#BF z`%_!_p@&$NAmv?=C!vM+V2=Q40MKT;Cu|fw%+Kj0mi#0x5V>Z?e-A(7+#}8gG$WL# zo<}7HE&}_zPaD5Bc+H|yMc$?kv#fm1m&~2Zquu#a)Wwh}O6|UCp*BGf4dL}8oG;61 z-3z?(+p05%`hZFyiMB!zx3@2}XR0!1d^?*;{7-kA zZ;m22KJ+HZD|8`4w%PM_zQ5(B!L3T`V*yvZH717l%We6cvHAA)Oe>rhyKZ{&_=LaN zf+j@7lWae31wJU6^RpJ}yOrirr>$ie8JzsB3%Hy)`jUl(L0kFTP7 zzqY~RX~Ygj5gNw@Be_ZmymVRT$c0c!(!|-?{c9B3S$0{{4-rzE1bjOi-w_sIqs=n< zME-bmDog_~N&{VQI|`RE^7Ewtsm;`IGcIXN*fbuX+bV3pLt8+^l3n%Vo ztybij9su7SNe6z*KXtkH4oV1&MPE`bhJxyz5_8B8#o!(TDc_5~AMvZAefg_pY)V>L zlmj~tz-%~oma{=DEH~$GZgGHUH=_h}^U9dml2XuHbJ1k4kIwtB2qU3d#n)Mb>kLhP z1a-gmZIX`;x1{zzx3+4q%}_EXc^KC?z3(H+dU@a~H?ZE|Ls6bhpev1N-862ve>=m* zIRZ^8Y>6%RFJ2p+A@Er+z=xM_R&QrQ&_;TgQk+r8C)$9`pnIV?cL4dgL^o`ON>esC z=~mFQqY3OKQ_*uoF1nhVksc@ra6i(n@v^?8qEZhUfaiOgVY4_4e?>gm+EONX{iwP5 ztYjkBG#{`cl3!mE*ko9^4>8SKn(-xPm@g*D^!z(>!}diVQ**X4G-*sUIo7vG+?Fk+rMfPd zIgTj({O*qulE9)lO=^B0=rG8|$G~d`F%ke@A%#gKUx3{$GJ~Sn-|8 zPtIgotq*SCOuD*@k&E@$HptDe32gOxulc)7?_Ji%B8?dNwEQL|(TxWt zdWnyy7xb`&k=x^#cFSMAd%l^e7-WZ&EAh=bWj7%ID1Cp2P6XSxIx!(0VKpmBq^@2< zw9|Q}kGuzS#a&~;dyJPI>)gFw}Hby(um=HMP2|DQ!Gxo_ld(EZ%E@F+)sRT|=Yg0it`* zaSQo^5crHNi}bb^7iJL^MNMW7T|q-B-xEAU(oru9+g;-pHsKg$BH=sSW)zxFdCJ;} z`w3c<*Y7zoPKjzMEG=##C-@zJP_37R`58`z$0?X@0l>~$-g1j91-Mq=e5zx+IP>@_8h4WPxMb}j4E?BZp3IlQ8CbU57=-uT3pnKP^6Nk7jklI zz}Y!%7uQ{M6E@@dbKs0fJT|ZqjmNr{YuQ#NjecWos+YGytt=+_`sT0I#F-Kt7H^L~ z@?z~Vw&iT*9{MgGl{Oxq~S1s2PbR~DT;LOwoa7&Y(ys1^{^6_%HRf7?2}Z)SHD<7+=EpXd{K zR(&)%q~J>^zDS)2H3-kFugQMz+;LSAb@1_ipmJcP@W+Miuvl0G`3D$D&5AX6z^)a$ z-~ik7x1x4c)7h?&PwYIJsRDUX+qOVrER^wp+v8s)CY+eZB&F(} zF@sFAohwHf^oz&}UaJ>1fvW-P7sq|AxkZ{dB-n`*Ko$$QufEdwyp8b&jpgQ)=G1kO zqt=1?GC3Hn@J?T9L+`;F`JCTJ)z2hAJ)}X|QP{0BIE!D$*qwGGsm1d z)osxuNzi&JDKXj9Aca5bqWZjj-HsPti-peRJ zRM048v9}zm)k$4##T8siEoAeiOd<-0+~-S?&*l2?E_F|v(M4S&q*4b&ES|KZ?$wKf+< z=-Wqz_n8c;A6vc-a4E3vTv{HUqi$7+w7?5$b~~xQ7r7YS!rOmisJU8GD}H5^n9S(9 zTUE7qO-xgYQYrahdnsn+;m!Dix(m?G&e?w;QSC zt<8+x$PIr@76-qxZ|Q-yG-pVnns+{ot0_*tGW*4~;t;8B(01gYX_dCU#bc&R7B(qF zqyw3su4*o=C{#ts@@q}7{aymi3Jbx@{7g7>@kMMBW=XlDe%&-Un#<_07XB=7%$0{CJ!;>Y>UD>LuJACnK$P~nLbggww ziDC>W_$={Ze|f5Ze5K4R!w=>$y0$#!*;wj&Q?-5JqxHw0Lz3PSVFTm6H?o}&{&T1I zrC_<|#HOdI=hamh8TC*`Jw%~peoT!nXaXqzAwK~*;HHBA7_k+hmrxgLw+;|LCQ%Ho zRonE7q82b~_C1UX}+^M<_H9k;Y?U}NZIuIW0 z43cXuEG*3ye9R}Kzzgc#ZqhWbcU$h*K2b@WXvhwiAN8!BRt?Uwl=TYZwr4VoE&~Od zHH{KPYoq_nU`}^AMRH%|jn;UM!BhkErVMp|u#O43{8S=l=3WxqI_)V?$bUu~{E`&F zi7|qDtnoxNCw!y21RdXTsi+RwpXYOMHvO=&Eu>uYq3l;C4~nHpu67kZI-fbgExyS^ zyoPz*(p;w?KF*@+pTK#Ynj31faVq_yflvA5yxd^lf3mYWCtkDWP=P}@DIxlBxhozO z=`+>Ur-Cjo)(~U{beVmx3-c*-KZK)?M_KedQq(o@<*UlGiipt=k{x*6*4gsIOn-=* zW7-CPdS-gd?BQ(8`4G~oanvfm)@Q2C{pd~SZ-j)>*;^1qtc&SyL}=+hHP^G}P&3T7 zl>#|CgA6nI-t_$7KugN6p+Pk*+FFy1Wf>CLC@W5cgTsUS<8-wBX7o}JD#4~Q{!ICQ zgIA;mB%WDgB7Zhw9<;h&Zd3A9GH-O;%mdlvCMs{qK_bbve8!nT56^OMH z^1PX>g~K)PkaM#b#g3kYzx>*mpHB{0Ozo;ZpDyIic(E|R-9&M6>GOC(0je?L)ade& zI=#{TL)!ao2h!V%{r=);FTxHF^()j_a`IOSa&BUNIG$htQM9k+*`S5Qonne3dj|Pa zr-7ipx-e}3Xml&x# zWU-I|%}~aar-8_VzD}_4Fh9!U5h8C}E;$WMRqN0SMlcSoTwv&2q68-mvxiRqY+^&md}i14l= zu8!L4>G7|_KM0g%GmPq`1wBxuTxvFJvr6CnHvPRwf8C9LmC0aW+SYE15BzD!)ceT) zgzvnT$gY)jszv2=6{v1uI`+KT8&Nz^&Qj{h9MH7GXZH7FJF|OL^`m~7RV#r0{GCbK zHyVd8cC%g^HNC3b$GCxS~VyzU40f^8nTQlV0Lb^~qZnL#DC|GIjNP=0^&P?WGikJie>-%4ys@Ly@b zRz&|_rw{DTVTRFPg8cvG0+QYK29gOHuA&{lz72h^zSoMw5oMt0*Ch zT_4l>z?YznVUD|th&pS8Rtj4TgNQS{Vc7k1 zF=KE~Hbc-#$2%|1a{k@M*ffxHfPL%kF}NbErKSvZ*(4->k$p zl2L=Xcz_~L0%;a#IvP{gomeyZf}Bu9GA%#9b4pNfYCZ0_k+veWXK8EuWJ}JZacTT| zH{{zI?13zrg7n(qXD~Amqzg-6iy(XvtgPXVx?|{&m)f5Ndx_tW+9URKB0E(3Eo(wN zF7h^5)_|Sb{)Z%aaUm|{?v67B&R$(xZH<&lEltHBs%ZD&Lm(!vI3M;C#}d`&5xEsr zN;Rdz?_8TPja)b@4Ib-V{E#i^(|&!DJ!?#P=>Qi+Jomn z!L2eX)MG>O?d=O#5AdzED&H%ANt|R{uP!;p@Vm(I?>sd%yuP?!toZ*(i@R1X$g!BY zo-FI|p5i%Vex-ZtR*%NAvd-`L%*~=BIMwII9maE_bZCG9SXDhu2GvsP-b{- z;3q85%n6)#ZFS-jcBTZ1kGsz*s)l@~-8Wb0C4;!Y+CRht`f(8^u2bHr>Gbr0hv@`3 zcT_4a z&|}B(w|x8~q9JX#xP^Co6+uifC3OQe^mc797^m6915}Z*CljK(6()tY*472x zTpuJC6cEjev9y^L74G}@g+rb?fNIA^rl;%Ov^c9=V2kPIJDY+h1SDCi84vEQJGrzS z*U-zm`-5*-6eto#vyYM6l$f5sH4#(rxxiH57SMGahLz-Su7kQq$B@_mNu6&om2~MB z6vGvVn9tXA4{4Q1sa{w4ADAUp`&r?+U)c1*MR!jvL=^9ngn&$W)2m~}Y^Vw38)izX zBk=e=A{9GxKPW*m3=H3yGl<0IEkRlcx`uE z(e*i3n$;p}R|S^Mc{IS98W!3Kb%9>i?619D6tdhBZ;scPtROg`m5fWYmGLv^+#bzS z4B&Vlrb)ly?l?a=*2sz0&1A`--vu?X1=} zS$eFp6`!xOm(X44Yi7Up>QE>yR4Ut5&m7_NrFIzw9l@xnMoI7z?;-0~N1Gol1Aqwa zuVsU?TR6Q&a4{MCWe&RD1yf%Mo)#y*(FYC%Mi`i_H*YO9o4O>z9dz-P(mk?tAuO)l|xv++Qc3(uKV^ zU1#lRq>X7PyO;e&?Y*|&YPV@lf!;uahNqv`y9&(7M>f%0-NMVF=^Z3l)*dORAVzja z_J6{|zRMaFP^qx*^a$dwtaMJ3A4M}qu8g}IvWu8$HuqsEX z)yQdd^;V2eZGt*SJa=0WsUWOFUMWYPj9pt}_3?9|=M3>s+rDl(%TGANe>}w^T~fVO znz7u?=EoE+G`1o-ww|Lo+s+JHqyzLC}*_a4UD@;sG9FFCi`LLGrM1z!y z6&>R*p1*#YhC7_d4v)?7J1kAN4pE=+)zdCsa}Y(HbUWw@xz8J*v*hD=6tD9>jTKmX zbZ^2)aUt#=?^osYJR;vtJqv*tb0@d6}5E~14J9u^1+SV0t@P|8Xc?*dg+tutw z+Yw9ZHb48Y{OY9N1RC?jg-Fq!{o+gH7w=H;{OnF< z3|>SS-nw|!xXVU5^TzhFU_OYKSB>!(o$R_pFGvaD4w~}v*=<`1zP)t?7PPuDr;J@l zH8wIz0eiZkMF-CyQ6rOd)$Tm|*fD#5h`zpltE`aM2F+x1&VvJ#H$(MunAu24A}b-Q zRF7|A;0T*teKjhyL0pO04NU3?GpSy#{( z9)E21Xudc2&#u6>ar-I`r!Y-%5Oze^@izBm-Ry4wmu?Dy4%NS9=l-@15Ed**d#jxEC5`oC~Cee IePI#u9}3TXfdBvi literal 0 HcmV?d00001 diff --git a/devices/surface/index.md b/devices/surface/index.md index 2cbeff64cf..2a2598a5cd 100644 --- a/devices/surface/index.md +++ b/devices/surface/index.md @@ -62,18 +62,22 @@ For more information on planning for, deploying, and managing Surface devices in

Explore the available options to manage firmware and driver updates for Surface devices.

+

[Manage Surface UEFI settings](manage-surface-uefi-settings.md)

+

Use Surface UEFI settings to enable or disable devices, configure security settings, and adjust Surface device boot settings.

+ +

[Surface Data Eraser](microsoft-surface-data-eraser.md)

Find out how the Microsoft Surface Data Eraser tool can help you securely wipe data from your Surface devices.

- +

[Surface Deployment Accelerator](microsoft-surface-deployment-accelerator.md)

See how Microsoft Surface Deployment Accelerator provides a quick and simple deployment mechanism for organizations to reimage Surface devices.

- +

[Surface Diagnostic Toolkit](surface-diagnostic-toolkit.md)

Find out how you can use the Microsoft Surface Diagnostic Toolkit to test the hardware of your Surface device.

- +

[Surface Dock Updater](surface-dock-updater.md)

Get a detailed walkthrough of Microsoft Surface Dock Updater.

diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md new file mode 100644 index 0000000000..e18dfc07a7 --- /dev/null +++ b/devices/surface/manage-surface-uefi-settings.md @@ -0,0 +1,138 @@ +--- +title: Manage Surface UEFI settings (Surface) +description: Use Surface UEFI settings to enable or disable devices or components, configure security settings, and adjust Surface device boot settings. +keywords: firmware, security, features, configure, hardware +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: devices, surface +author: miladCA +--- + +#Manage Surface UEFI settings + +Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. + +>**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface devices do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. + +You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. + +##PC information + +On the **PC Information** page, detailed information about your Surface device is provided: + +- **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). +- **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. + +- **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. +- **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/en-us/download/details.aspx?id=44076). + +You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC Information** page (as shown in Figure 1): + +- System UEFI + +- SAM Controller + +- Intel Management Engine + +- System Embedded Controller + +- Touch Firmware + +*Figure 1. System information and firmware version information* + +![figure 1](images/manage-surface-uefi-figure-1.png) + +You can find up-to-date information about the latest firmware version for your Surface device in the [Surface Update History](https://www.microsoft.com/surface/en-us/support/install-update-activate/surface-update-history) for your device. + +##Security + +On the **Security** page of Surface UEFI settings, you can set a password to protect UEFI settings. This password must be entered when you boot the Surface device to UEFI. The password can contain the following characters (as shown in Figure 2): + +- Uppercase letters: A-Z + +- Lowercase letters: a-z + +- Numbers: 1-0 + +- Special characters: !@#$%^&*()?<>{}[]-_=+|.,;:’`” + +The password must be at least 6 characters and is case sensitive. + +*Figure 2. Add a password to protect Surface UEFI settings* + +![figure 2](images/manage-surface-uefi-fig2.png) + +On the **Security** page you can also change the configuration of Secure Boot on your Surface device. Secure Boot technology prevents unauthorized boot code from booting on your Surface device, which protects against bootkit and rootkit-type malware infections. You can disable Secure Boot to allow your Surface device to boot third-party operating systems or bootable media. You can also configure Secure Boot to work with third-party certificates, as shown in Figure 3. Read more about [Secure Boot](https://msdn.microsoft.com/windows/hardware/commercialize/manufacture/desktop/secure-boot-overview) in the TechNet Library. + +*Figure 3. Configure Secure Boot* + +![figure 3](images/manage-surface-uefi-fig3.png) + +You can also enable or disable the Trusted Platform Module (TPM) device on the **Security** page, as shown in Figure 4. The TPM is used to authenticate encryption for your device’s data with BitLocker. Read more about [BitLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview) in the TechNet Library. + +*Figure 4. Configure Surface UEFI security settings* + +![figure 4](images/manage-surface-uefi-fig4.png) + +##Devices + +On the **Devices** page you can enable or disable specific devices and components of your Surface device. Devices that you can enable or disable on this page include: + +- Docking and USB Ports + +- MicroSD or SD Card Slot + +- Rear Camera + +- Front Camera + +- Infrared (IR) Camera + +- Wi-Fi and Bluetooth + +- Onboard Audio (Speakers and Microphone) + +Each device is listed with a slider that you can set into the **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. + +*Figure 5. Enable and disable specific devices* + +![figure 5](images/manage-surface-uefi-fig5.png) + +##Boot configuration + +On the **Boot Configuration** page, you can change the order of your boot devices and/or enable or disable boot of the following devices: + +- Windows Boot Manager + +- USB Storage + +- PXE Network + +- Internal Storage + +You can boot from a specific device immediately, or you can swipe left on that device’s entry in the list using the touchscreen. You can also boot immediately to a USB device or USB Ethernet adapter when the Surface device is powered off by pressing the **Volume Down** button and the **Power** button simultaneously. + +For the specified boot order to take effect, you must set the **Enable Alternate Boot Sequence** option to **On**, as shown in Figure 6. + +*Figure 6. Configure the boot order for your Surface device* + +![figure 6](images/manage-surface-uefi-fig6.png) + +You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE Network Boot** option, for example when performing a Windows deployment using PXE where the PXE server is configured for IPv4 only. + +##About + +The **About** page displays regulatory information, such as compliance with FCC Rules, as shown in Figure 7. + +*Figure 7. Regulatory information is displayed on the **About** page* + +![figure 7](images/manage-surface-uefi-fig7.png) + +##Exit + +Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. + +*Figure 8. Click **Restart Now** to exit Surface UEFI and restart the device* + +![figure 8](images/manage-surface-uefi-fig8.png) From 6918bf38767bbdca6d9b64185508c5c9c440ed9a Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Thu, 19 May 2016 18:44:49 -0700 Subject: [PATCH 4/7] fix typos --- devices/surface/manage-surface-uefi-settings.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index e18dfc07a7..20a0aa3322 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -19,7 +19,7 @@ You can enter the Surface UEFI settings on your Surface device by pressing the * ##PC information -On the **PC Information** page, detailed information about your Surface device is provided: +On the **PC information** page, detailed information about your Surface device is provided: - **Model** – Your Surface device’s model will be displayed here, such as Surface Book or Surface Pro 4. The exact configuration of your device is not shown, (such as processor, disk size, or memory size). - **UUID** – This Universally Unique Identification number is specific to your device and is used to identify the device during deployment or management. @@ -27,7 +27,7 @@ On the **PC Information** page, detailed information about your Surface device i - **Serial Number** – This number is used to identify this specific Surface device for asset tagging and support scenarios. - **Asset Tag** – The asset tag is assigned to the Surface device with the [Asset Tag Tool](https://www.microsoft.com/en-us/download/details.aspx?id=44076). -You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC Information** page (as shown in Figure 1): +You will also find detailed information about the firmware of your Surface device. Surface devices have several internal components that each run different versions of firmware. The firmware version of each of the following devices is displayed on the **PC information** page (as shown in Figure 1): - System UEFI @@ -93,7 +93,7 @@ On the **Devices** page you can enable or disable specific devices and component - Onboard Audio (Speakers and Microphone) -Each device is listed with a slider that you can set into the **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. +Each device is listed with a slider button that you can move to **On** (enabled) or **Off** (disabled) position, as shown in Figure 5. *Figure 5. Enable and disable specific devices* @@ -123,9 +123,9 @@ You can also turn on and off IPv6 support for PXE with the **Enable IPv6 for PXE ##About -The **About** page displays regulatory information, such as compliance with FCC Rules, as shown in Figure 7. +The **About** page displays regulatory information, such as compliance with FCC rules, as shown in Figure 7. -*Figure 7. Regulatory information is displayed on the **About** page* +*Figure 7. Regulatory information is displayed on the About page* ![figure 7](images/manage-surface-uefi-fig7.png) @@ -133,6 +133,6 @@ The **About** page displays regulatory information, such as compliance with FCC Use the **Restart Now** button on the **Exit** page to exit UEFI settings, as shown in Figure 8. -*Figure 8. Click **Restart Now** to exit Surface UEFI and restart the device* +*Figure 8. Click Restart Now to exit Surface UEFI and restart the device* ![figure 8](images/manage-surface-uefi-fig8.png) From 548b5e37598bfa2c298af414499113817d6e5fb3 Mon Sep 17 00:00:00 2001 From: Jan Backstrom Date: Fri, 20 May 2016 08:45:49 -0700 Subject: [PATCH 5/7] fix wording --- devices/surface/manage-surface-uefi-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface/manage-surface-uefi-settings.md b/devices/surface/manage-surface-uefi-settings.md index 20a0aa3322..44428903c1 100644 --- a/devices/surface/manage-surface-uefi-settings.md +++ b/devices/surface/manage-surface-uefi-settings.md @@ -13,7 +13,7 @@ author: miladCA Current and future generations of Surface devices, including Surface Pro 4 and Surface Book, use a unique UEFI firmware engineered by Microsoft specifically for these devices. This firmware allows for significantly greater control of the device’s operation over firmware versions in earlier generation Surface devices, including the support for touch, mouse, and keyboard operation. By using the Surface UEFI settings you can easily enable or disable internal devices or components, configure security to protect UEFI settings from being changed, and adjust the Surface device boot settings. ->**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface devices do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. +>**Note:**  Surface Pro 3, Surface 3, Surface Pro 2, Surface 2, Surface Pro, and Surface do not use the Surface UEFI and instead use firmware provided by third-party manufacturers, such as AMI. You can enter the Surface UEFI settings on your Surface device by pressing the **Volume Up** button and the **Power** button simultaneously. Hold the **Volume Up** button until the Surface logo is displayed, which indicates that the device has begun to boot. From 0cc22ca5c21a8781f711729bea6878b3fef498ad Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 20 May 2016 09:04:28 -0700 Subject: [PATCH 6/7] removing offline maps UI step --- ...-devices-to-stop-data-flow-to-microsoft.md | 27 +++++-------------- 1 file changed, 7 insertions(+), 20 deletions(-) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index bfc720cc35..8e22953d44 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -285,8 +285,7 @@ When you enable the **Don't search the web or display web results in Search** Gr - For **Remote port**, choose **All ports**. -**Note** -If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. +> **Note:** If your organization tests network traffic, you should not use Fiddler to test Windows Firewall settings. You should use a network traffic analyzer, such as WireShark or Message Analyzer. ### 1.2 Cortana MDM policies @@ -321,8 +320,7 @@ Starting with Windows 10, fonts that are included in Windows but that are not st To turn off font streaming, create a REG\_DWORD registry setting called **DisableFontProviders** in **HKEY\_LOCAL\_MACHINE\\System\\CurrentControlSet\\Services\\FontCache\\Parameters**, with a value of 1. -**Note** -This may change in future versions of Windows. +> **Note:** This may change in future versions of Windows. ### 5. Insider Preview builds @@ -408,8 +406,7 @@ Use either Group Policy or MDM policies to manage settings for Microsoft Edge. F Find the Microsoft Edge Group Policy objects under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge**. -**Note** -The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. +> **Note:** The Microsoft Edge Group Policy names were changed in Windows 10, version 1511. The table below reflects those changes. | Policy | Description | |------------------------------------------------------|-----------------------------------------------------------------------------------------------------| @@ -453,10 +450,6 @@ You can turn off NCSI through Group Policy: You can turn off the ability to download and update offline maps. -- In the UI: **Settings** > **System** > **Offline maps** > **Automatically update maps** - - -or- - - Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Maps** > **Turn off Automatic Download and Update of Map Data** ### 12. OneDrive @@ -617,10 +610,7 @@ Use Settings > Privacy to configure some settings that may be important to yo To turn off **Let apps use my advertising ID for experiences across apps (turning this off will reset your ID)**: -**Note** -When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - - +> **Note:** When you turn this feature off in the UI, it turns off the advertising ID, not just resets it. - Turn off the feature in the UI. @@ -660,8 +650,7 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Window To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: -**Note** -If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. +> **Note: ** If the telemetry level is set to either **Basic** or **Security**, this is turned off automatically. @@ -793,8 +782,7 @@ To turn off **Choose apps that can use your microphone**: In the **Speech, Inking, & Typing** area, you can let Windows and Cortana better understand your employee's voice and written input by sampling their voice and writing, and by comparing verbal and written input to contact names and calendar entrees. -**Note** -For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. +> **Note:** For more info on how to disable Cortana in your enterprise, see [Cortana](#bkmk-cortana) in this article. @@ -987,8 +975,7 @@ To change the level of diagnostic and usage data sent when you **Send your devic - To change from **Enhanced**, use the drop-down list in the UI. The other levels are **Basic** and **Full**. - **Note** - You can't use the UI to change the telemetry level to **Security**. + > **Note:** You can't use the UI to change the telemetry level to **Security**. From 4507a7a8d43566f66115545f99e108f8c1d95fe4 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Fri, 20 May 2016 09:11:40 -0700 Subject: [PATCH 7/7] Bug# 7594483 --- ...igure-windows-10-devices-to-stop-data-flow-to-microsoft.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md index 8e22953d44..7b24cfdfbe 100644 --- a/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md +++ b/windows/manage/configure-windows-10-devices-to-stop-data-flow-to-microsoft.md @@ -1094,6 +1094,10 @@ You can opt of the Microsoft Antimalware Protection Service. -or- - Use the registry to set the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows Defender\\Spynet\\SpyNetReporting** to 0 (zero). + + -and- + + From an elevated Windows PowerShell prompt, run **set-mppreference -Mapsreporting 0** You can stop sending file samples back to Microsoft.