From 3b3a7cb1378b26dc5deeb87a7e19ca179148a4c0 Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Tue, 25 Oct 2022 15:40:24 -0700 Subject: [PATCH 01/93] License update. --- .../prepare/windows-autopatch-prerequisites.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md index cac236afd3..d5f7c38027 100644 --- a/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md +++ b/windows/deployment/windows-autopatch/prepare/windows-autopatch-prerequisites.md @@ -34,7 +34,15 @@ Windows Autopatch is included with Window 10/11 Enterprise E3 or higher (user-ba | License | ID | GUID number | | ----- | ----- | ------| | [Microsoft 365 E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3 | 05e9a617-0261-4cee-bb44-138d3ef5d965 | +| [Microsoft 365 E3 (500 seats minimum_HUB)](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E3 | 0c21030a-7e60-4ec7-9a0f-0042e0e0211a | +| [Microsoft 365 E3 - Unattended License](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3_RPA1 | c2ac2ee4-9bb1-47e4-8541-d689c7e83371 | | [Microsoft 365 E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5 | 06ebc4ee-1bb5-47dd-8120-11324bc54e06 | +| [Microsoft 365 E5 (500 seats minimum)_HUB](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E5 | db684ac5-c0e7-4f92-8284-ef9ebde75d33 | +| [Microsoft 365 E5 with calling minutes](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_CALLINGMINUTES | a91fc4e0-65e5-4266-aa76-4037509c1626 | +| [Microsoft 365 E5 without audio conferencing](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_NOPSTNCONF | cd2925a3-5076-4233-8931-638a8c94f773 | +| [Microsoft 365 E5 without audio conferencing (500 seats minimum)_HUB](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | Microsoft_365_E5_without_Audio_Conferencing | 2113661c-6509-4034-98bb-9c47bd28d63c | +| [TEST - Microsoft 365 E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E3_TEST | 23a55cbc-971c-4ba2-8bae-04cd13d2f4ad | +| [TEST - Microsoft 365 E5 without audio conferencing](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | SPE_E5_NOPSTNCONF_TEST | 1362a0d9-b3c2-4112-bf1a-7a838d181c0f | | [Windows 10/11 Enterprise E3](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E3 | 6a0f6da5-0b87-4190-a6ae-9bb5a2b9546a | | [Windows 10/11 Enterprise E5](/azure/active-directory/enterprise-users/licensing-service-plan-reference) | WIN10_VDA_E5 | 488ba24a-39a9-4473-8ee5-19291e71b002 | | [Windows 10/11 Enterprise VDA](/windows/deployment/deploy-enterprise-licenses#virtual-desktop-access-vda) | E3_VDA_only | d13ef257-988a-46f3-8fce-f47484dd4550 | From 25da8c447f81b6a397eff89b336c46435744d480 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Tue, 8 Nov 2022 22:29:24 +0530 Subject: [PATCH 02/93] Update wds-boot-support.md Updated the document to represent OS deployed vs boot image version as per the table Per issue#https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10973 --- windows/deployment/wds-boot-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index dfab934f9d..8685f727fd 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -26,7 +26,7 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ## Deployment scenarios affected -The table below provides support details for specific deployment scenarios (Boot Image Version). +The table below provides support details for specific deployment scenarios (The table represents OS Deployed (vertical) and Boot Image Version(Horizontal) ). ||Windows 10|Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows 11| |--- |--- |--- |--- |--- |--- | From 89be3fd385c05e2662114425f7450d618bd2c771 Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Wed, 9 Nov 2022 11:19:44 +0530 Subject: [PATCH 03/93] Update windows/deployment/wds-boot-support.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- windows/deployment/wds-boot-support.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 8685f727fd..55b2a11be1 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -26,7 +26,7 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ## Deployment scenarios affected -The table below provides support details for specific deployment scenarios (The table represents OS Deployed (vertical) and Boot Image Version(Horizontal) ). +The table below provides support details for specific deployment scenarios. The table represents OS Deployed (vertical) and Boot Image Version (horizontal). ||Windows 10|Windows Server 2016|Windows Server 2019|Windows Server 2022|Windows 11| |--- |--- |--- |--- |--- |--- | From e2cebd1778f275daa8fad9e2e70c2253270b248b Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Fri, 11 Nov 2022 10:01:22 -0800 Subject: [PATCH 04/93] table change --- windows/deployment/do/mcc-isp-create-provision-deploy.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/do/mcc-isp-create-provision-deploy.md b/windows/deployment/do/mcc-isp-create-provision-deploy.md index 8781385544..f6afcf07ca 100644 --- a/windows/deployment/do/mcc-isp-create-provision-deploy.md +++ b/windows/deployment/do/mcc-isp-create-provision-deploy.md @@ -98,9 +98,8 @@ There are five IDs that the device provisioning script takes as input in order t |---|---| | Customer ID | The Azure subscription ID that the cache node is created in. | | Cache node ID | The unique alphanumeric ID of the cache node being provisioned. | -| Customer Key | The unique alphanumeric ID that provides secure authentication of the cache node to Delivery Optimization services. | -| Cache node name | The name of the cache node. | -| Tenant ID | The unique ID associated with the Azure account. | +| Customer key | The unique alphanumeric ID that provides secure authentication of the cache node to Delivery Optimization services. | +| Registration key | Single use device registration key used by Microsoft Delivery Optimization services. | :::image type="content" source="images/mcc-isp-deploy-cache-node-numbered.png" alt-text="Screenshot of the server provisioning tab within cache node configuration in Azure portal."::: From 3032b04c2567878417e4890ae7260557a0a4d1a5 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Tue, 22 Nov 2022 14:28:02 -0500 Subject: [PATCH 05/93] updates --- windows/security/docfx.json | 8 +- .../access-control/access-control.md | 104 +++---- .../access-control/local-accounts.md | 253 +++++++----------- .../additional-mitigations.md | 13 +- .../credential-guard-considerations.md | 16 +- .../credential-guard-how-it-works.md | 16 +- .../credential-guard-known-issues.md | 16 +- .../credential-guard-manage.md | 19 +- ...redential-guard-not-protected-scenarios.md | 17 +- .../credential-guard-protection-limits.md | 45 ++-- .../credential-guard-requirements.md | 22 +- .../credential-guard-scripts.md | 33 +-- .../credential-guard/credential-guard.md | 21 +- .../credential-guard/dg-readiness-tool.md | 20 +- 14 files changed, 210 insertions(+), 393 deletions(-) diff --git a/windows/security/docfx.json b/windows/security/docfx.json index b923e0d70f..bb2804df03 100644 --- a/windows/security/docfx.json +++ b/windows/security/docfx.json @@ -65,13 +65,15 @@ }, "fileMetadata": { "author":{ - "/identity-protection/hello-for-business/*.md": "paolomatarazzo" + "identity-protection/**/*.md": "paolomatarazzo" }, "ms.author":{ - "/identity-protection/hello-for-business/*.md": "paoloma" + "identity-protection/**/*.md": "paoloma" }, "ms.reviewer":{ - "/identity-protection/hello-for-business/*.md": "erikdau" + "identity-protection/hello-for-business/*.md": "erikdau", + "identity-protection/credential-guard/*.md": "zwhittington", + "identity-protection/access-control/*.md": "sulahiri" } }, "template": [], diff --git a/windows/security/identity-protection/access-control/access-control.md b/windows/security/identity-protection/access-control/access-control.md index f900a31aa3..deea4c3766 100644 --- a/windows/security/identity-protection/access-control/access-control.md +++ b/windows/security/identity-protection/access-control/access-control.md @@ -1,19 +1,12 @@ --- -title: Access Control Overview (Windows 10) -description: Access Control Overview +title: Access Control Overview +description: Description of the access controls in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: sulahiri -manager: aaroncz -ms.collection: - - M365-identity-device-management ms.topic: article -ms.localizationpriority: medium -ms.date: 07/18/2017 +ms.date: 11/22/2022 appliesto: - - ✅ Windows 10 - - ✅ Windows Server 2016 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- @@ -21,89 +14,66 @@ ms.technology: itpro-security This topic for the IT professional describes access control in Windows, which is the process of authorizing users, groups, and computers to access objects on the network or computer. Key concepts that make up access control are permissions, ownership of objects, inheritance of permissions, user rights, and object auditing. -## Feature description - +## Feature description Computers that are running a supported version of Windows can control the use of system and network resources through the interrelated mechanisms of authentication and authorization. After a user is authenticated, the Windows operating system uses built-in authorization and access control technologies to implement the second phase of protecting resources: determining if an authenticated user has the correct permissions to access a resource. -Shared resources are available to users and groups other than the resource’s owner, and they need to be protected from unauthorized use. In the access control model, users and groups (also referred to as security principals) are represented by unique security identifiers (SIDs). They are assigned rights and permissions that inform the operating system what each user and group can do. Each resource has an owner who grants permissions to security principals. During the access control check, these permissions are examined to determine which security principals can access the resource and how they can access it. +Shared resources are available to users and groups other than the resource's owner, and they need to be protected from unauthorized use. In the access control model, users and groups (also referred to as security principals) are represented by unique security identifiers (SIDs). They are assigned rights and permissions that inform the operating system what each user and group can do. Each resource has an owner who grants permissions to security principals. During the access control check, these permissions are examined to determine which security principals can access the resource and how they can access it. Security principals perform actions (which include Read, Write, Modify, or Full control) on objects. Objects include files, folders, printers, registry keys, and Active Directory Domain Services (AD DS) objects. Shared resources use access control lists (ACLs) to assign permissions. This enables resource managers to enforce access control in the following ways: -- Deny access to unauthorized users and groups - -- Set well-defined limits on the access that is provided to authorized users and groups +- Deny access to unauthorized users and groups +- Set well-defined limits on the access that is provided to authorized users and groups Object owners generally grant permissions to security groups rather than to individual users. Users and computers that are added to existing groups assume the permissions of that group. If an object (such as a folder) can hold other objects (such as subfolders and files), it is called a container. In a hierarchy of objects, the relationship between a container and its content is expressed by referring to the container as the parent. An object in the container is referred to as the child, and the child inherits the access control settings of the parent. Object owners often define permissions for container objects, rather than individual child objects, to ease access control management. This content set contains: -- [Dynamic Access Control Overview](dynamic-access-control.md) - -- [Security identifiers](security-identifiers.md) - -- [Security Principals](security-principals.md) - - - [Local Accounts](local-accounts.md) - - - [Active Directory Accounts](active-directory-accounts.md) - - - [Microsoft Accounts](microsoft-accounts.md) - - - [Service Accounts](service-accounts.md) - - - [Active Directory Security Groups](active-directory-security-groups.md) - -## Practical applications +- [Dynamic Access Control Overview](dynamic-access-control.md) +- [Security identifiers](security-identifiers.md) +- [Security Principals](security-principals.md) + - [Local Accounts](local-accounts.md) + - [Active Directory Accounts](active-directory-accounts.md) + - [Microsoft Accounts](microsoft-accounts.md) + - [Service Accounts](service-accounts.md) + - [Active Directory Security Groups](active-directory-security-groups.md) +## Practical applications Administrators who use the supported version of Windows can refine the application and management of access control to objects and subjects to provide the following security: -- Protect a greater number and variety of network resources from misuse. - -- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. - -- Enable users to access resources from a variety of devices in numerous locations. - -- Update users’ ability to access resources on a regular basis as an organization’s policies change or as users’ jobs change. - -- Account for a growing number of use scenarios (such as access from remote locations or from a rapidly expanding variety of devices, such as tablet computers and mobile phones). - -- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs. +- Protect a greater number and variety of network resources from misuse. +- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. +- Enable users to access resources from a variety of devices in numerous locations. +- Update users' ability to access resources on a regular basis as an organization's policies change or as users' jobs change. +- Account for a growing number of use scenarios (such as access from remote locations or from a rapidly expanding variety of devices, such as tablet computers and mobile phones). +- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs. ## Permissions - Permissions define the type of access that is granted to a user or group for an object or object property. For example, the Finance group can be granted Read and Write permissions for a file named Payroll.dat. By using the access control user interface, you can set NTFS permissions for objects such as files, Active Directory objects, registry objects, or system objects such as processes. Permissions can be granted to any user, group, or computer. It is a good practice to assign permissions to groups because it improves system performance when verifying access to an object. For any object, you can grant permissions to: -- Groups, users, and other objects with security identifiers in the domain. - -- Groups and users in that domain and any trusted domains. - -- Local groups and users on the computer where the object resides. +- Groups, users, and other objects with security identifiers in the domain. +- Groups and users in that domain and any trusted domains. +- Local groups and users on the computer where the object resides. The permissions attached to an object depend on the type of object. For example, the permissions that can be attached to a file are different from those that can be attached to a registry key. Some permissions, however, are common to most types of objects. These common permissions are: -- Read - -- Modify - -- Change owner - -- Delete +- Read +- Modify +- Change owner +- Delete When you set permissions, you specify the level of access for groups and users. For example, you can let one user read the contents of a file, let another user make changes to the file, and prevent all other users from accessing the file. You can set similar permissions on printers so that certain users can configure the printer and other users can only print. When you need to change the permissions on a file, you can run Windows Explorer, right-click the file name, and click **Properties**. On the **Security** tab, you can change permissions on the file. For more information, see [Managing Permissions](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc770962(v=ws.11)). -**Note**   -Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754178(v=ws.11)). - - +> [!NOTE] +> Another kind of permissions, called share permissions, is set on the Sharing tab of a folder's **Properties** page or by using the Shared Folder Wizard. For more information see [Share and NTFS Permissions on a File Server](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754178(v=ws.11)). ### Ownership of objects @@ -115,7 +85,6 @@ Inheritance allows administrators to easily assign and manage permissions. This ## User rights - User rights grant specific privileges and sign-in rights to users and groups in your computing environment. Administrators can assign specific rights to group accounts or to individual user accounts. These rights authorize users to perform specific actions, such as signing in to a system interactively or backing up files and directories. User rights are different from permissions because user rights apply to user accounts, and permissions are associated with objects. Although user rights can apply to individual user accounts, user rights are best administered on a group account basis. There is no support in the access control user interface to grant user rights. However, user rights assignment can be administered through **Local Security Settings**. @@ -124,15 +93,10 @@ For more information about user rights, see [User Rights Assignment](/windows/de ## Object auditing - With administrator's rights, you can audit users' successful or failed access to objects. You can select which object access to audit by using the access control user interface, but first you must enable the audit policy by selecting **Audit object access** under **Local Policies** in **Local Security Settings**. You can then view these security-related events in the Security log in Event Viewer. For more information about auditing, see [Security Auditing Overview](../../threat-protection/auditing/security-auditing-overview.md). ## See also -- For more information about access control and authorization, see [Access Control and Authorization Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/jj134043(v=ws.11)). - - - - +- For more information about access control and authorization, see [Access Control and Authorization Overview](/previous-versions/windows/it-pro/windows-8.1-and-8/jj134043(v=ws.11)). diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 6d48d39a9a..7fa46f2d3f 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,71 +1,35 @@ --- -title: Local Accounts (Windows 10) +title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.prod: windows-client -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: sulahiri -manager: aaroncz +ms.date: 22/11/2022 ms.collection: - - M365-identity-device-management - highpri ms.topic: article -ms.localizationpriority: medium -ms.date: 06/17/2022 appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Local Accounts -This reference article for IT professionals describes the default local user accounts for servers, including how to manage these built-in accounts on a member or standalone server. +This article describes the default local user accounts for Windows operating systems, and how to manage the built-in accounts on a member or standalone workstation/server. -## About local user accounts +## About local user accounts -Local user accounts are stored locally on the server. These accounts can be assigned rights and permissions on a particular server, but on that server only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users. +Local user accounts are stored locally on the device. These accounts can be assigned rights and permissions on a particular device, but on that device only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users. -This article describes the following: +## Default local user accounts -- [Default local user accounts](#sec-default-accounts) +The *default local user accounts* are built-in accounts that are created automatically when the operating system is installed. The default local user accounts can't be removed or deleted and don't provide access to network resources. - - [Administrator account](#sec-administrator) +Default local user accounts are used to manage access to the local device's resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the *Users* folder. The Users folder is located in the Local Users and Groups folder in the local *Computer Management* Microsoft Management Console (MMC). *Computer Management* is a collection of administrative tools that you can use to manage a single local or remote device. - - [Guest Account](#sec-guest) +Default local user accounts are described in the following sections. Expand each section for more information. - - [HelpAssistant account (installed by using a Remote Assistance session)](#sec-helpassistant) - - - [DefaultAccount](#defaultaccount) - -- [Default local system accounts](#sec-localsystem) - -- [How to manage local accounts](#sec-manage-accounts) - - - [Restrict and protect local accounts with administrative rights](#sec-restrict-protect-accounts) - - - [Enforce local account restrictions for remote access](#sec-enforce-account-restrictions) - - - [Deny network logon to all local Administrator accounts](#sec-deny-network-logon) - - - [Create unique passwords for local accounts with administrative rights](#sec-create-unique-passwords) - -For information about security principals, see [Security Principals](security-principals.md). - -## Default local user accounts - -The default local user accounts are built-in accounts that are created automatically when you install Windows. - -After Windows is installed, the default local user accounts can't be removed or deleted. In addition, default local user accounts don't provide access to network resources. - -Default local user accounts are used to manage access to the local server’s resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC). Computer Management is a collection of administrative tools that you can use to manage a single local or remote computer. For more information, see [How to manage local accounts](#sec-manage-accounts) later in this article. - -Default local user accounts are described in the following sections. - -### Administrator account +
+
+Administrator The default local Administrator account is a user account for the system administrator. Every computer has an Administrator account (SID S-1-5-*domain*-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation. @@ -99,7 +63,10 @@ In this case, Group Policy can be used to enable secure settings that can contro > > - Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. -### Guest account +
+
+
+Guest The Guest account is disabled by default on installation. The Guest account lets occasional or one-time users, who don't have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it's a security risk. For this reason, it's a best practice to leave the Guest account disabled, unless its use is entirely necessary. @@ -113,8 +80,11 @@ When enabling the Guest account, only grant limited rights and permissions. For In addition, the guest user in the Guest account shouldn't be able to view the event logs. After the Guest account is enabled, it's a best practice to monitor the Guest account frequently to ensure that other users can't use services and other resources. This includes resources that were unintentionally left available by a previous user. -## HelpAssistant account (installed with a Remote Assistance session) +
+
+
+HelpAssistant The HelpAssistant account is a default local account that is enabled when a Remote Assistance session is run. This account is automatically disabled when no Remote Assistance requests are pending. @@ -124,9 +94,9 @@ HelpAssistant is the primary account that is used to establish a Remote Assistan The SIDs that pertain to the default HelpAssistant account include: -- SID: S-1-5-<domain>-13, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note: In Windows Server 2008, Remote Desktop Services is called Terminal Services. +- SID: `S-1-5--13`, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note: In Windows Server 2008, Remote Desktop Services is called Terminal Services. -- SID: S-1-5-<domain>-14, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. +- SID: `S-1-5--14`, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID. For the Windows Server operating system, Remote Assistance is an optional component that isn't installed by default. You must install Remote Assistance before it can be used. @@ -145,7 +115,11 @@ For details about the HelpAssistant account attributes, see the following table. |Safe to move out of default container?|Can be moved out, but we don't recommend it.| |Safe to delegate management of this group to non-Service admins?|No| -### DefaultAccount +
+ +
+
+DefaultAccount The DefaultAccount, also known as the Default System Managed Account (DSMA), is a built-in account introduced in Windows 10 version 1607 and Windows Server 2016. The DSMA is a well-known user account type. @@ -169,10 +143,10 @@ Today, Xbox automatically signs in as Guest account and all apps run in this con All the apps are multi-user-aware and respond to events fired by user manager. The apps run as the Guest account. -Similarly, Phone auto logs in as a “DefApps” account, which is akin to the standard user account in Windows but with a few extra privileges. Brokers, some services and apps run as this account. +Similarly, Phone auto logs in as a *DefApps* account, which is akin to the standard user account in Windows but with a few extra privileges. Brokers, some services and apps run as this account. In the converged user model, the multi-user-aware apps and multi-user-aware brokers will need to run in a context different from that of the users. -For this purpose, the system creates DSMA. +For this purpose, the system creates DSMA. #### How the DefaultAccount gets created on domain controllers @@ -182,25 +156,37 @@ If the domain was created with domain controllers running an earlier version of #### Recommendations for managing the Default Account (DSMA) Microsoft doesn't recommend changing the default configuration, where the account is disabled. There's no security risk with having the account in the disabled state. Changing the default configuration could hinder future scenarios that rely on this account. +
-## Default local system accounts +## Default local system accounts -### SYSTEM -The SYSTEM account is used by the operating system and by services running under Windows. There are many services and processes in the Windows operating system that need the capability to sign in internally, such as during a Windows installation. The SYSTEM account was designed for that purpose, and Windows manages the SYSTEM account’s user rights. It's an internal account that doesn't show up in User Manager, and it can't be added to any groups. +
+
+SYSTEM + + +The *SYSTEM* account is used by the operating system and by services running under Windows. There are many services and processes in the Windows operating system that need the capability to sign in internally, such as during a Windows installation. The SYSTEM account was designed for that purpose, and Windows manages the SYSTEM account's user rights. It's an internal account that doesn't show up in User Manager, and it can't be added to any groups. On the other hand, the SYSTEM account does appear on an NTFS file system volume in File Manager in the **Permissions** portion of the **Security** menu. By default, the SYSTEM account is granted Full Control permissions to all files on an NTFS volume. Here the SYSTEM account has the same functional rights and permissions as the Administrator account. > [!NOTE] > To grant the account Administrators group file permissions does not implicitly give permission to the SYSTEM account. The SYSTEM account's permissions can be removed from a file, but we do not recommend removing them. -### NETWORK SERVICE +
+
+
+NETWORK SERVICE + The NETWORK SERVICE account is a predefined local account used by the service control manager (SCM). A service that runs in the context of the NETWORK SERVICE account presents the computer's credentials to remote servers. For more information, see [NetworkService Account](/windows/desktop/services/networkservice-account). +
+
+
+LOCAL SERVICE -### LOCAL SERVICE The LOCAL SERVICE account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network. For more information, see [LocalService Account](/windows/desktop/services/localservice-account). +
-## How to manage local user accounts - +## How to manage local user accounts The default local user accounts, and the local user accounts you create, are located in the Users folder. The Users folder is located in Local Users and Groups. For more information about creating and managing local user accounts, see [Manage Local Users](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731899(v=ws.11)). @@ -221,11 +207,11 @@ The simplest approach is to sign in to your computer with a standard user accoun The other approaches that can be used to restrict and protect user accounts with administrative rights include: -- Enforce local account restrictions for remote access. +- Enforce local account restrictions for remote access. -- Deny network logon to all local Administrator accounts. +- Deny network logon to all local Administrator accounts. -- Create unique passwords for local accounts with administrative rights. +- Create unique passwords for local accounts with administrative rights. Each of these approaches is described in the following sections. @@ -274,57 +260,57 @@ The following table shows the Group Policy and registry settings that are used t 3. In the console tree, right-click **Group Policy Objects**, and > **New**. - ![local accounts 1.](images/localaccounts-proc1-sample1.png) + ![local accounts 1.](images/localaccounts-proc1-sample1.png) 4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. - ![local accounts 2.](images/localaccounts-proc1-sample2.png) + ![local accounts 2.](images/localaccounts-proc1-sample2.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 3.](images/localaccounts-proc1-sample3.png) + ![local accounts 3.](images/localaccounts-proc1-sample3.png) 6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. + 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. - 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. + 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. - 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. + 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. 7. Ensure that the local account restrictions are applied to network interfaces by following these steps: - 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. + 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. - 2. Right-click **Registry**, and > **New** > **Registry Item**. + 2. Right-click **Registry**, and > **New** > **Registry Item**. - ![local accounts 4.](images/localaccounts-proc1-sample4.png) + ![local accounts 4.](images/localaccounts-proc1-sample4.png) - 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. + 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. - 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. + 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. - 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. + 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. - 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. + 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. - 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. + 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. - 8. In the **Value data** box, ensure that the value is set to **0**. + 8. In the **Value data** box, ensure that the value is set to **0**. - 9. Verify this configuration, and > **OK**. + 9. Verify this configuration, and > **OK**. - ![local accounts 5.](images/localaccounts-proc1-sample5.png) + ![local accounts 5.](images/localaccounts-proc1-sample5.png) 8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. + 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. + 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - ![local accounts 6.](images/localaccounts-proc1-sample6.png) + ![local accounts 6.](images/localaccounts-proc1-sample6.png) - 3. Select the GPO that you created, and > **OK**. + 3. Select the GPO that you created, and > **OK**. 9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. @@ -354,55 +340,33 @@ The following table shows the Group Policy settings that are used to deny networ #### To deny network logon to all local administrator accounts -1. Start the **Group Policy Management** Console (GPMC). +1. Start the **Group Policy Management** Console (GPMC) +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). +1. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer + ![local accounts 7.](images/localaccounts-proc2-sample1.png) +1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + ![local accounts 8.](images/localaccounts-proc2-sample2.png) +1. Configure the user rights to deny network logons for administrative local accounts as follows: +1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment** +1. Double-click **Deny access to this computer from the network** +1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** +1. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows: +1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment** +1. Double-click **Deny log on through Remote Desktop Services** +1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** +1. Link the GPO to the first **Workstations** OU as follows: + - Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path + - Right-click the **Workstations** OU, and > **Link an existing GPO** + - Select the GPO that you created, and > **OK** +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. +1. Create links to all other OUs that contain workstations. +1. Create links to all other OUs that contain servers. -2. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). + > [!NOTE] + > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. -3. In the console tree, right-click **Group Policy Objects**, and > **New**. - -4. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer. - - ![local accounts 7.](images/localaccounts-proc2-sample1.png) - -5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - - ![local accounts 8.](images/localaccounts-proc2-sample2.png) - -6. Configure the user rights to deny network logons for administrative local accounts as follows: - - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment**. - - 2. Double-click **Deny access to this computer from the network**. - - 3. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**. - -7. Configure the user rights to deny Remote Desktop (Remote Interactive) logons for administrative local accounts as follows: - - 1. Navigate to Computer Configuration\\Policies\\Windows Settings and Local Policies, and then select **User Rights Assignment**. - - 2. Double-click **Deny log on through Remote Desktop Services**. - - 3. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK**. - -8. Link the GPO to the first **Workstations** OU as follows: - - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - - 3. Select the GPO that you created, and > **OK**. - -9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. - -10. Create links to all other OUs that contain workstations. - -11. Create links to all other OUs that contain servers. - - > [!NOTE] - > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. - - -### Create unique passwords for local accounts with administrative rights +### Create unique passwords for local accounts with administrative rights Passwords should be unique per individual account. While it's true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments. @@ -410,19 +374,6 @@ Passwords that are left unchanged or changed synchronously to keep them identica Passwords can be randomized by: -- Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools. - -- Configuring [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) to accomplish this task. - -- Creating and implementing a custom script or solution to randomize local account passwords. - -## See also - - -The following resources provide additional information about technologies that are related to local accounts. - -- [Security Principals](security-principals.md) - -- [Security Identifiers](security-identifiers.md) - -- [Access Control Overview](access-control.md) +- Purchasing and implementing an enterprise tool to accomplish this task. These tools are commonly referred to as "privileged password management" tools +- Configuring [Local Administrator Password Solution (LAPS)](https://www.microsoft.com/download/details.aspx?id=46899) to accomplish this task +- Creating and implementing a custom script or solution to randomize local account passwords diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 92b3296a71..62fc73012c 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -1,16 +1,11 @@ --- title: Additional mitigations description: Advice and sample code for making your domain environment more secure and robust with Windows Defender Credential Guard. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 -ms.technology: itpro-security +ms.topic: article +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Additional mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 69d69300a1..729349823b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -1,21 +1,11 @@ --- title: Advice while using Windows Defender Credential Guard (Windows) description: Considerations and recommendations for certain scenarios when using Windows Defender Credential Guard in Windows. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/31/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 55fe9628bb..a44d84d5f4 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -1,21 +1,11 @@ --- title: How Windows Defender Credential Guard works description: Learn how Windows Defender Credential Guard uses virtualization to protect secrets, so that only privileged system software can access them. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: conceptual appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 2c5fe11327..0407517885 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -1,21 +1,11 @@ --- title: Windows Defender Credential Guard - Known issues (Windows) description: Windows Defender Credential Guard - Known issues in Windows Enterprise -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 01/26/2022 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Windows Defender Credential Guard: Known issues diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 33cab5403d..1a956703ff 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -1,25 +1,12 @@ --- title: Manage Windows Defender Credential Guard (Windows) description: Learn how to deploy and manage Windows Defender Credential Guard using Group Policy, the registry, or hardware readiness tools. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: zwhittington -manager: aaroncz -ms.collection: - - M365-identity-device-management +ms.collection: - highpri ms.topic: article -ms.custom: - - CI 120967 - - CSSTroubleshooting appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later ms.technology: itpro-security --- # Manage Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 5ff4d5dadc..ae48c7a815 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -1,22 +1,11 @@ --- title: Windows Defender Credential Guard protection limits & mitigations (Windows) description: Scenarios not protected by Windows Defender Credential Guard in Windows, and additional mitigations you can use. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits and mitigations diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 6444af7ea5..79de8e7f00 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -1,41 +1,30 @@ --- title: Windows Defender Credential Guard protection limits (Windows) description: Some ways to store credentials are not protected by Windows Defender Credential Guard in Windows. Learn more with this guide. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article ms.date: 08/17/2017 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Credential Guard protection limits Some ways to store credentials are not protected by Windows Defender Credential Guard, including: -- Software that manages credentials outside of Windows feature protection -- Local accounts and Microsoft Accounts -- Windows Defender Credential Guard doesn't protect the Active Directory database running on Windows Server 2016 domain controllers. It also doesn't protect credential input pipelines, such as Windows Server 2016 servers running Remote Desktop Gateway. If you're using a Windows Server 2016 server as a client PC, it will get the same protection as it would when running Windows 10 Enterprise. -- Key loggers -- Physical attacks -- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. -- Third-party security packages -- Digest and CredSSP credentials - - When Windows Defender Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. -- Supplied credentials for NTLM authentication aren't protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. These same credentials are vulnerable to key loggers as well.- -- Kerberos service tickets aren't protected by Credential Guard, but the Kerberos Ticket Granting Ticket (TGT) is. -- When Windows Defender Credential Guard is deployed on a VM, Windows Defender Credential Guard protects secrets from attacks inside the VM. However, it doesn't provide additional protection from privileged system attacks originating from the host. -- Windows logon cached password verifiers (commonly called "cached credentials") -don't qualify as credentials because they can't be presented to another computer for authentication, and can only be used locally to verify credentials. They're stored in the registry on the local computer and provide validation for credentials when a domain-joined computer can't connect to AD DS during user logon. These “cached logons”, or more specifically, cached domain account information, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller isn't available. +- Software that manages credentials outside of Windows feature protection +- Local accounts and Microsoft Accounts +- Windows Defender Credential Guard doesn't protect the Active Directory database running on Windows Server domain controllers. It also doesn't protect credential input pipelines, such as Windows Server running Remote Desktop Gateway. If you're using a Windows Server OS as a client PC, it will get the same protection as it would when running a Windows client OS. +- Key loggers +- Physical attacks +- Doesn't prevent an attacker with malware on the PC from using the privileges associated with any credential. We recommend using dedicated PCs for high value accounts, such as IT Pros and users with access to high value assets in your organization. +- Third-party security packages +- Digest and CredSSP credentials + - When Windows Defender Credential Guard is enabled, neither Digest nor CredSSP have access to users' logon credentials. This implies no Single Sign-On use for these protocols. +- Supplied credentials for NTLM authentication aren't protected. If a user is prompted for and enters credentials for NTLM authentication, these credentials are vulnerable to be read from LSASS memory. These same credentials are vulnerable to key loggers as well.- +- Kerberos service tickets aren't protected by Credential Guard, but the Kerberos Ticket Granting Ticket (TGT) is. +- When Windows Defender Credential Guard is deployed on a VM, Windows Defender Credential Guard protects secrets from attacks inside the VM. However, it doesn't provide additional protection from privileged system attacks originating from the host. +- Windows logon cached password verifiers (commonly called "cached credentials") +don't qualify as credentials because they can't be presented to another computer for authentication, and can only be used locally to verify credentials. They're stored in the registry on the local computer and provide validation for credentials when a domain-joined computer can't connect to AD DS during user logon. These *cached logons*, or more specifically, *cached domain account information*, can be managed using the security policy setting **Interactive logon: Number of previous logons to cache** if a domain controller isn't available. ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 2e2a82219b..6112d90366 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -1,26 +1,14 @@ --- -title: Windows Defender Credential Guard Requirements (Windows) +title: Windows Defender Credential Guard requirements description: Windows Defender Credential Guard baseline hardware, firmware, and software requirements, and additional protections for improved security. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: zwhittington -manager: aaroncz -ms.collection: - - M365-identity-device-management -ms.topic: article ms.date: 12/27/2021 +ms.topic: article appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- -# Windows Defender Credential Guard: Requirements +# Windows Defender Credential Guard requirements For Windows Defender Credential Guard to provide protection, the computers you are protecting must meet certain baseline hardware, firmware, and software requirements, which we will refer to as [Hardware and software requirements](#hardware-and-software-requirements). Additionally, Windows Defender Credential Guard blocks specific authentication capabilities, so applications that require such capabilities will break. We will refer to these requirements as [Application requirements](#application-requirements). Beyond these requirements, computers can meet additional hardware and firmware qualifications, and receive additional protections. Those computers will be more hardened against certain threats. For detailed information on baseline protections, plus protections for improved security that are associated with hardware and firmware options available in 2015, 2016, and 2017, refer to the tables in [Security Considerations](#security-considerations). diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index 8b39b99573..867ad14148 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -1,23 +1,20 @@ --- title: Scripts for Certificate Issuance Policies in Windows Defender Credential Guard (Windows) description: Obtain issuance policies from the certificate authority for Windows Defender Credential Guard on Windows. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article -ms.date: 08/17/2017 -ms.technology: itpro-security +ms.date: 11/22/2022 +ms.topic: reference +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- -# Windows Defender Credential Guard: Scripts for Certificate Authority Issuance Policies +# Windows Defender Credential Guard: scripts for certificate authority issuance policies -Here is a list of scripts mentioned in this topic. +Expand each section to see the PowerShell scripts: -## Get the available issuance policies on the certificate authority +
+
+Get the available issuance policies on the certificate authority Save this script file as get-IssuancePolicy.ps1. @@ -207,8 +204,12 @@ write-host "There are no issuance policies which are not mapped to groups" ``` > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. -  -## Link an issuance policy to a group + +
+ +
+
+Link an issuance policy to a group Save the script file as set-IssuancePolicyToGroupLink.ps1. @@ -489,3 +490,5 @@ write-host $tmp -Foreground Red > [!NOTE] > If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. + +
diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 950eb3a95c..fe35c4ca75 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -1,24 +1,13 @@ --- title: Protect derived domain credentials with Windows Defender Credential Guard (Windows) description: Windows Defender Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: - - M365-identity-device-management - - highpri +ms.date: 11/22/2022 ms.topic: article -ms.date: 03/10/2022 +ms.collection: + - highpri appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Protect derived domain credentials with Windows Defender Credential Guard diff --git a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md index bfb971ef4f..b4e156aa00 100644 --- a/windows/security/identity-protection/credential-guard/dg-readiness-tool.md +++ b/windows/security/identity-protection/credential-guard/dg-readiness-tool.md @@ -1,21 +1,11 @@ --- title: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool description: Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool script -ms.prod: windows-client -ms.localizationpriority: medium -author: paolomatarazzo -ms.author: paoloma -ms.reviewer: erikdau -manager: aaroncz -ms.collection: M365-identity-device-management -ms.topic: article -appliesto: - - ✅ Windows 10 - - ✅ Windows 11 - - ✅ Windows Server 2016 - - ✅ Windows Server 2019 - - ✅ Windows Server 2022 -ms.technology: itpro-security +ms.date: 11/22/2022 +ms.topic: reference +appliesto: +- ✅ Windows 10 and later +- ✅ Windows Server 2016 and later --- # Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool From 232b954a954a867348a388d045384059564ff4d6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Tue, 22 Nov 2022 12:28:21 -0800 Subject: [PATCH 06/93] Added 22H2 Known Issues Section Bulk of 22H2 update, added a unified 22H2 SSO breakage section to the "Known Issues" page, which can be linked to by other comms. --- .../credential-guard-known-issues.md | 115 +++++++++++++----- 1 file changed, 84 insertions(+), 31 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 2c5fe11327..517b038409 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -22,45 +22,56 @@ ms.technology: itpro-security Windows Defender Credential Guard has certain application requirements. Windows Defender Credential Guard blocks specific authentication capabilities. So applications that require such capabilities won't function when it's enabled. For more information, see [Application requirements](credential-guard-requirements.md#application-requirements). -The following known issues have been fixed in the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4): +## Known Issue: Single Sign-On (SSO) for Network services breaks after upgrading to **Windows 11, version 22H2** -- Scheduled tasks with domain user-stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message: +### Affected devices: +Any device that enables Windows Defender Credential Guard may encounter this issue. As part of the Windows 11, version 22H2 update, eligible devices which had not previously explicitly disabled Windows Defender Credential Guard had it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses*, as long as they met the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements). + +\* All Pro devices which previously ran Windows Defender Credential Guard on an eligible license and later downgraded to Pro, and which still meet the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements), will receive default enablement. - ```console - Task Scheduler failed to log on '\Test'. - Failure occurred in 'LogonUserExEx'. - User Action: Ensure the credentials for the task are correctly specified. - Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect). - ``` +> [!TIP] +> To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: +> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). -- When you enable NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4625 with error 0xC0000064 on the machine itself. For example: +### Symptoms of the issue: +Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session. - ```console - Log Name: Microsoft-Windows-NTLM/Operational - Source: Microsoft-Windows-Security-Netlogon - Event ID: 8004 - Task Category: Auditing NTLM - Level: Information - Description: - Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller. - Secure Channel name: - User name: - @@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAgDA2AQQAMEAwAANAgDA1AQLAIEADBQRAADAtAANAYEA1AwQA0CA5AAOAMEAyAQLAYDAxAwQAEDAEBwMAMEAwAgMAMDACBgRA0HA - Domain name: NULL - ``` +### Why this is happening: +Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. Affected procols include: + - Kerberos unconstrained delegation (both SSO and supplied credentials are blocked) + - Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked) + - WDigest (only SSO is blocked) + - NTLM v1 (only SSO is blocked) + - MS-CHAP (only SSO is blocked) - - This event stems from a scheduled task running under local user context with the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4) or later and happens when Credential Guard is enabled. - - The username appears in an unusual format because local accounts aren't protected by Credential Guard. The task also fails to execute. - - As a workaround, run the scheduled task under a domain user or the computer's SYSTEM account. +### Options to fix the issue: -The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: +Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. -- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows machines](https://support.microsoft.com/topic/april-11-2017-kb4015217-os-build-14393-1066-and-14393-1083-b5f79067-98bd-b4ec-8b81-5d858d7dc722) +For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. - This issue can potentially lead to unexpected account lockouts. For more information, see the following support articles: +> [!TIP] +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before installing the Windows 11, version 22H2 update. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. - - [KB4015219](https://support.microsoft.com/topic/april-11-2017-kb4015219-os-build-10586-873-68b8e379-aafa-ea6c-6b29-56d19785e657) - - [KB4015221](https://support.microsoft.com/topic/april-11-2017-kb4015221-os-build-10240-17354-743f52bc-a484-d23f-71f5-b9957cbae0e6) +> [!NOTE] +> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: + > + > **Event ID 4013** (Warning) + > ``` + > id="NTLMv1BlockedByCredGuard" + > value="Attempt to use NTLMv1 failed. + > Target server: %1%nSupplied user: %2%nSupplied domain: %3%nPID of client process: %4%nName of client process: %5%nLUID of client process: %6%nUser identity of client process: %7%nDomain name of user identity of client process: %8%nMechanism OID: %9%n%nThis device does not support NTLMv1. For more information, see https://go.microsoft.com/fwlink/?linkid=856826." + > /> + > ``` + > + > **Event ID 4014** (Error) + > ``` + > id="NTLMGetCredentialKeyBlockedByCredGuard" + > value="Attempt to get credential key by call package blocked by Credential Guard.%n%nCalling Process Name: %1%nService Host Tag: %2" + > /> + > ``` ## Known issues involving third-party applications @@ -112,3 +123,45 @@ Windows Defender Credential Guard isn't supported by the following products, pro This list isn't comprehensive. Check whether your product vendor, product version, or computer system supports Windows Defender Credential Guard on systems that run Windows or specific versions of Windows. Specific computer system models may be incompatible with Windows Defender Credential Guard. Microsoft encourages third-party vendors to contribute to this page by providing relevant product support information and by adding links to their own product support statements. + +## Previous known issues that have been fixed + +The following known issues have been fixed in the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4): + +- Scheduled tasks with domain user-stored credentials fail to run when Credential Guard is enabled. The task fails and reports Event ID 104 with the following message: + + ```console + Task Scheduler failed to log on '\Test'. + Failure occurred in 'LogonUserExEx'. + User Action: Ensure the credentials for the task are correctly specified. + Additional Data: Error Value: 2147943726. 2147943726: ERROR\_LOGON\_FAILURE (The user name or password is incorrect). + ``` + +- When you enable NTLM audit on the domain controller, an Event ID 8004 with an indecipherable username format is logged. You also get a similar user name in a user logon failure event 4625 with error 0xC0000064 on the machine itself. For example: + + ```console + Log Name: Microsoft-Windows-NTLM/Operational + Source: Microsoft-Windows-Security-Netlogon + Event ID: 8004 + Task Category: Auditing NTLM + Level: Information + Description: + Domain Controller Blocked Audit: Audit NTLM authentication to this domain controller. + Secure Channel name: + User name: + @@CyBAAAAUBQYAMHArBwUAMGAoBQZAQGA1BAbAUGAyBgOAQFAhBwcAsGA6AweAgDA2AQQAMEAwAANAgDA1AQLAIEADBQRAADAtAANAYEA1AwQA0CA5AAOAMEAyAQLAYDAxAwQAEDAEBwMAMEAwAgMAMDACBgRA0HA + Domain name: NULL + ``` + + - This event stems from a scheduled task running under local user context with the [Cumulative Security Update for November 2017](https://support.microsoft.com/topic/november-27-2017-kb4051033-os-build-14393-1914-447b6b88-e75d-0a24-9ab9-5dcda687aaf4) or later and happens when Credential Guard is enabled. + - The username appears in an unusual format because local accounts aren't protected by Credential Guard. The task also fails to execute. + - As a workaround, run the scheduled task under a domain user or the computer's SYSTEM account. + +The following known issues have been fixed by servicing releases made available in the Cumulative Security Updates for April 2017: + +- [KB4015217 Windows Defender Credential Guard generates double bad password count on Active Directory domain-joined Windows machines](https://support.microsoft.com/topic/april-11-2017-kb4015217-os-build-14393-1066-and-14393-1083-b5f79067-98bd-b4ec-8b81-5d858d7dc722) + + This issue can potentially lead to unexpected account lockouts. For more information, see the following support articles: + + - [KB4015219](https://support.microsoft.com/topic/april-11-2017-kb4015219-os-build-10586-873-68b8e379-aafa-ea6c-6b29-56d19785e657) + - [KB4015221](https://support.microsoft.com/topic/april-11-2017-kb4015221-os-build-10240-17354-743f52bc-a484-d23f-71f5-b9957cbae0e6) From a0d3f024380c65878885339837e35b5054a3b174 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Wed, 23 Nov 2022 10:37:22 -0500 Subject: [PATCH 07/93] updates --- windows/security/TOC.yml | 238 +++++++++--------- .../access-control/local-accounts.md | 111 ++++---- 2 files changed, 166 insertions(+), 183 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index c364767760..d0acdd1a6d 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -45,45 +45,45 @@ href: /windows-hardware/design/device-experiences/oem-highly-secure - name: Operating system security items: - - name: Overview - href: operating-system.md - - name: System security - items: - - name: Secure the Windows boot process - href: information-protection/secure-the-windows-10-boot-process.md - - name: Trusted Boot - href: trusted-boot.md - - name: Cryptography and certificate management - href: cryptography-certificate-mgmt.md - - name: The Windows Security app - href: threat-protection/windows-defender-security-center/windows-defender-security-center.md - items: - - name: Virus & threat protection - href: threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md - - name: Account protection - href: threat-protection\windows-defender-security-center\wdsc-account-protection.md - - name: Firewall & network protection - href: threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md - - name: App & browser control - href: threat-protection\windows-defender-security-center\wdsc-app-browser-control.md - - name: Device security - href: threat-protection\windows-defender-security-center\wdsc-device-security.md - - name: Device performance & health - href: threat-protection\windows-defender-security-center\wdsc-device-performance-health.md - - name: Family options - href: threat-protection\windows-defender-security-center\wdsc-family-options.md - - name: Security policy settings - href: threat-protection/security-policy-settings/security-policy-settings.md - - name: Security auditing - href: threat-protection/auditing/security-auditing-overview.md - - name: Encryption and data protection - href: encryption-data-protection.md - items: - - name: Encrypted Hard Drive - href: information-protection/encrypted-hard-drive.md - - name: BitLocker - href: information-protection/bitlocker/bitlocker-overview.md - items: + - name: Overview + href: operating-system.md + - name: System security + items: + - name: Secure the Windows boot process + href: information-protection/secure-the-windows-10-boot-process.md + - name: Trusted Boot + href: trusted-boot.md + - name: Cryptography and certificate management + href: cryptography-certificate-mgmt.md + - name: The Windows Security app + href: threat-protection/windows-defender-security-center/windows-defender-security-center.md + items: + - name: Virus & threat protection + href: threat-protection\windows-defender-security-center\wdsc-virus-threat-protection.md + - name: Account protection + href: threat-protection\windows-defender-security-center\wdsc-account-protection.md + - name: Firewall & network protection + href: threat-protection\windows-defender-security-center\wdsc-firewall-network-protection.md + - name: App & browser control + href: threat-protection\windows-defender-security-center\wdsc-app-browser-control.md + - name: Device security + href: threat-protection\windows-defender-security-center\wdsc-device-security.md + - name: Device performance & health + href: threat-protection\windows-defender-security-center\wdsc-device-performance-health.md + - name: Family options + href: threat-protection\windows-defender-security-center\wdsc-family-options.md + - name: Security policy settings + href: threat-protection/security-policy-settings/security-policy-settings.md + - name: Security auditing + href: threat-protection/auditing/security-auditing-overview.md + - name: Encryption and data protection + href: encryption-data-protection.md + items: + - name: Encrypted Hard Drive + href: information-protection/encrypted-hard-drive.md + - name: BitLocker + href: information-protection/bitlocker/bitlocker-overview.md + items: - name: Overview of BitLocker Device Encryption in Windows href: information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md - name: BitLocker frequently asked questions (FAQ) @@ -155,21 +155,21 @@ href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md - name: Decode Measured Boot logs to track PCR changes href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md - - name: Personal Data Encryption (PDE) - items: - - name: Personal Data Encryption (PDE) overview - href: information-protection/personal-data-encryption/overview-pde.md - - name: Personal Data Encryption (PDE) frequently asked questions (FAQ) - href: information-protection/personal-data-encryption/faq-pde.yml - - name: Configure Personal Data Encryption (PDE) in Intune - href: information-protection/personal-data-encryption/configure-pde-in-intune.md - - name: Configure S/MIME for Windows - href: identity-protection/configure-s-mime.md - - name: Network security - items: - - name: VPN technical guide - href: identity-protection/vpn/vpn-guide.md - items: + - name: Personal Data Encryption (PDE) + items: + - name: Personal Data Encryption (PDE) overview + href: information-protection/personal-data-encryption/overview-pde.md + - name: Personal Data Encryption (PDE) frequently asked questions (FAQ) + href: information-protection/personal-data-encryption/faq-pde.yml + - name: Configure Personal Data Encryption (PDE) in Intune + href: information-protection/personal-data-encryption/configure-pde-in-intune.md + - name: Configure S/MIME for Windows + href: identity-protection/configure-s-mime.md + - name: Network security + items: + - name: VPN technical guide + href: identity-protection/vpn/vpn-guide.md + items: - name: VPN connection types href: identity-protection/vpn/vpn-connection-type.md - name: VPN routing decisions @@ -192,17 +192,17 @@ href: identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md - name: Optimizing Office 365 traffic with the Windows VPN client href: identity-protection/vpn/vpn-office-365-optimization.md - - name: Windows Defender Firewall - href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md - - name: Windows security baselines - href: threat-protection/windows-security-configuration-framework/windows-security-baselines.md - items: + - name: Windows Defender Firewall + href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md + - name: Windows security baselines + href: threat-protection/windows-security-configuration-framework/windows-security-baselines.md + items: - name: Security Compliance Toolkit href: threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10.md - name: Get support href: threat-protection/windows-security-configuration-framework/get-support-for-security-baselines.md - - name: Virus & threat protection - items: + - name: Virus & threat protection + items: - name: Overview href: threat-protection/index.md - name: Microsoft Defender Antivirus @@ -219,8 +219,8 @@ href: /microsoft-365/security/defender-endpoint/exploit-protection - name: Microsoft Defender for Endpoint href: /microsoft-365/security/defender-endpoint - - name: More Windows security - items: + - name: More Windows security + items: - name: Override Process Mitigation Options to help enforce app-related security policies href: threat-protection/override-mitigation-options-for-app-related-security-policies.md - name: Use Windows Event Forwarding to help with intrusion detection @@ -230,9 +230,9 @@ - name: Windows Information Protection (WIP) href: information-protection/windows-information-protection/protect-enterprise-data-using-wip.md items: - - name: Create a WIP policy using Microsoft Intune - href: information-protection/windows-information-protection/overview-create-wip-policy.md - items: + - name: Create a WIP policy using Microsoft Intune + href: information-protection/windows-information-protection/overview-create-wip-policy.md + items: - name: Create a WIP policy in Microsoft Intune href: information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md items: @@ -244,26 +244,26 @@ href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md - name: Determine the enterprise context of an app running in WIP href: information-protection/windows-information-protection/wip-app-enterprise-context.md - - name: Create a WIP policy using Microsoft Configuration Manager - href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md - items: + - name: Create a WIP policy using Microsoft Configuration Manager + href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md + items: - name: Create and deploy a WIP policy in Configuration Manager href: information-protection/windows-information-protection/create-wip-policy-using-configmgr.md - name: Create and verify an EFS Data Recovery Agent (DRA) certificate href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md - name: Determine the enterprise context of an app running in WIP href: information-protection/windows-information-protection/wip-app-enterprise-context.md - - name: Mandatory tasks and settings required to turn on WIP - href: information-protection/windows-information-protection/mandatory-settings-for-wip.md - - name: Testing scenarios for WIP - href: information-protection/windows-information-protection/testing-scenarios-for-wip.md - - name: Limitations while using WIP - href: information-protection/windows-information-protection/limitations-with-wip.md - - name: How to collect WIP audit event logs - href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md - - name: General guidance and best practices for WIP - href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md - items: + - name: Mandatory tasks and settings required to turn on WIP + href: information-protection/windows-information-protection/mandatory-settings-for-wip.md + - name: Testing scenarios for WIP + href: information-protection/windows-information-protection/testing-scenarios-for-wip.md + - name: Limitations while using WIP + href: information-protection/windows-information-protection/limitations-with-wip.md + - name: How to collect WIP audit event logs + href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md + - name: General guidance and best practices for WIP + href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md + items: - name: Enlightened apps for use with WIP href: information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md - name: Unenlightened and enlightened app behavior while using WIP @@ -272,36 +272,36 @@ href: information-protection/windows-information-protection/recommended-network-definitions-for-wip.md - name: Using Outlook Web Access with WIP href: information-protection/windows-information-protection/using-owa-with-wip.md - - name: Fine-tune WIP Learning - href: information-protection/windows-information-protection/wip-learning.md - - name: Disable WIP - href: information-protection/windows-information-protection/how-to-disable-wip.md + - name: Fine-tune WIP Learning + href: information-protection/windows-information-protection/wip-learning.md + - name: Disable WIP + href: information-protection/windows-information-protection/how-to-disable-wip.md - name: Application security items: - - name: Overview - href: apps.md - - name: Windows Defender Application Control and virtualization-based protection of code integrity - href: threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md - - name: Windows Defender Application Control - href: threat-protection\windows-defender-application-control\windows-defender-application-control.md - - name: Microsoft Defender Application Guard - href: threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md - - name: Windows Sandbox - href: threat-protection/windows-sandbox/windows-sandbox-overview.md - items: + - name: Overview + href: apps.md + - name: Windows Defender Application Control and virtualization-based protection of code integrity + href: threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md + - name: Windows Defender Application Control + href: threat-protection\windows-defender-application-control\windows-defender-application-control.md + - name: Microsoft Defender Application Guard + href: threat-protection\microsoft-defender-application-guard\md-app-guard-overview.md + - name: Windows Sandbox + href: threat-protection/windows-sandbox/windows-sandbox-overview.md + items: - name: Windows Sandbox architecture href: threat-protection/windows-sandbox/windows-sandbox-architecture.md - name: Windows Sandbox configuration href: threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md - - name: Microsoft Defender SmartScreen overview - href: threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md - items: + - name: Microsoft Defender SmartScreen overview + href: threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md + items: - name: Enhanced Phishing Protection in Microsoft Defender SmartScreen href: threat-protection\microsoft-defender-smartscreen\phishing-protection-microsoft-defender-smartscreen.md - - name: Configure S/MIME for Windows - href: identity-protection\configure-s-mime.md - - name: Windows Credential Theft Mitigation Guide Abstract - href: identity-protection\windows-credential-theft-mitigation-guide-abstract.md + - name: Configure S/MIME for Windows + href: identity-protection\configure-s-mime.md + - name: Windows Credential Theft Mitigation Guide Abstract + href: identity-protection\windows-credential-theft-mitigation-guide-abstract.md - name: User security and secured identity items: - name: Overview @@ -342,15 +342,15 @@ items: - name: Local Accounts href: identity-protection/access-control/local-accounts.md - - name: User Account Control - href: identity-protection/user-account-control/user-account-control-overview.md - items: - - name: How User Account Control works - href: identity-protection/user-account-control/how-user-account-control-works.md - - name: User Account Control security policy settings - href: identity-protection/user-account-control/user-account-control-security-policy-settings.md - - name: User Account Control Group Policy and registry key settings - href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md + - name: User Account Control + href: identity-protection/user-account-control/user-account-control-overview.md + items: + - name: How User Account Control works + href: identity-protection/user-account-control/how-user-account-control-works.md + - name: User Account Control security policy settings + href: identity-protection/user-account-control/user-account-control-security-policy-settings.md + - name: User Account Control Group Policy and registry key settings + href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md - name: Smart Cards href: identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md items: @@ -396,14 +396,14 @@ href: identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md - name: Cloud services items: - - name: Overview - href: cloud.md - - name: Mobile device management - href: /windows/client-management/mdm/ - - name: Windows 365 Cloud PCs - href: /windows-365/overview - - name: Azure Virtual Desktop - href: /azure/virtual-desktop/ + - name: Overview + href: cloud.md + - name: Mobile device management + href: /windows/client-management/mdm/ + - name: Windows 365 Cloud PCs + href: /windows-365/overview + - name: Azure Virtual Desktop + href: /azure/virtual-desktop/ - name: Security foundations items: - name: Overview diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 7fa46f2d3f..85c1d02be5 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -1,7 +1,7 @@ --- title: Local Accounts description: Learn how to secure and manage access to the resources on a standalone or member server for services or users. -ms.date: 22/11/2022 +ms.date: 11/22/2022 ms.collection: - highpri ms.topic: article @@ -222,7 +222,7 @@ Each of these approaches is described in the following sections. ### Enforce local account restrictions for remote access -The User Account Control (UAC) is a security feature in Windows that has been in use in Windows Server 2008 and in Windows Vista, and the operating systems to which the **Applies To** list refers. UAC enables you to stay in control of your computer by informing you when a program makes a change that requires administrator-level permission. UAC works by adjusting the permission level of your user account. By default, UAC is set to notify you when applications try to make changes to your computer, but you can change how often UAC notifies you. +User Account Control (UAC) is a security feature that informs you when a program makes a change that requires administrative permissions. UAC works by adjusting the permission level of your user account. By default, UAC is set to notify you when applications try to make changes to your computer, but you can change when UAC notifies you. UAC makes it possible for an account with administrative rights to be treated as a standard user non-administrator account until full rights, also called elevation, is requested and approved. For example, UAC lets an administrator enter credentials during a non-administrator's user session to perform occasional administrative tasks without having to switch users, sign out, or use the **Run as** command. @@ -254,70 +254,49 @@ The following table shows the Group Policy and registry settings that are used t #### To enforce local account restrictions for remote access -1. Start the **Group Policy Management** Console (GPMC). +1. Start the **Group Policy Management** Console (GPMC) +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) +1. In the console tree, right-click **Group Policy Objects > New** + :::image type="content" source="images/localaccounts-proc1-sample1.png" alt-text="local accounts"::: +1. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer + :::image type="content" source="images/localaccounts-proc1-sample2.png" alt-text="local accounts"::: +1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + :::image type="content" source="images/localaccounts-proc1-sample3.png" alt-text="local accounts"::: +1. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: -2. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects** where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). + - Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options** + - Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK** + - Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK** -3. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. Ensure that the local account restrictions are applied to network interfaces by following these steps: - ![local accounts 1.](images/localaccounts-proc1-sample1.png) + - Navigate to *Computer Configuration\Preferences and Windows Settings*, and > **Registry** + - Right-click **Registry**, and > **New** > **Registry Item** -4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. + :::image type="content" source="images/localaccounts-proc1-sample4.png" alt-text="local accounts"::: - ![local accounts 2.](images/localaccounts-proc1-sample2.png) + - In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace** + - Ensure that the **Hive** box is set to **HKEY_LOCAL_MACHINE** + - Select (**…**), browse to the following location for **Key Path** > **Select** for: `SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System` + - In the **Value name** area, type `LocalAccountTokenFilterPolicy` + - In the **Value type** box, from the drop-down list, select **REG_DWORD** to change the value + - In the **Value data** box, ensure that the value is set to **0** + - Verify this configuration, and > **OK** -5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. + :::image type="content" source="images/localaccounts-proc1-sample5.png" alt-text="local accounts"::: - ![local accounts 3.](images/localaccounts-proc1-sample3.png) +1. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: -6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by following these steps: + - Navigate to the `*Forest*\\*Domain*\*OU*` path + - Right-click the **Workstations > Link an existing GPO** - 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\, and > **Security Options**. + :::image type="content" source="images/localaccounts-proc1-sample6.png" alt-text="local accounts"::: - 2. Double-click **User Account Control: Run all administrators in Admin Approval Mode** > **Enabled** > **OK**. - - 3. Double-click **User Account Control: Admin Approval Mode for the Built-in Administrator account** > **Enabled** > **OK**. - -7. Ensure that the local account restrictions are applied to network interfaces by following these steps: - - 1. Navigate to Computer Configuration\\Preferences and Windows Settings, and > **Registry**. - - 2. Right-click **Registry**, and > **New** > **Registry Item**. - - ![local accounts 4.](images/localaccounts-proc1-sample4.png) - - 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. - - 4. Ensure that the **Hive** box is set to **HKEY\_LOCAL\_MACHINE**. - - 5. Select (**…**), browse to the following location for **Key Path** > **Select** for: **SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System**. - - 6. In the **Value name** area, type **LocalAccountTokenFilterPolicy**. - - 7. In the **Value type** box, from the drop-down list, select **REG\_DWORD** to change the value. - - 8. In the **Value data** box, ensure that the value is set to **0**. - - 9. Verify this configuration, and > **OK**. - - ![local accounts 5.](images/localaccounts-proc1-sample5.png) - -8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: - - 1. Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path. - - 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - - ![local accounts 6.](images/localaccounts-proc1-sample6.png) - - 3. Select the GPO that you created, and > **OK**. - -9. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. - -10. Create links to all other OUs that contain workstations. - -11. Create links to all other OUs that contain servers. + - Select the GPO that you created, and > **OK** +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy +1. Create links to all other OUs that contain workstations +1. Create links to all other OUs that contain servers ### Deny network logon to all local Administrator accounts Denying local accounts the ability to perform network logons can help prevent a local account password hash from being reused in a malicious attack. This procedure helps to prevent lateral movement by ensuring that stolen credentials for local accounts from a compromised operating system can't be used to compromise other computers that use the same credentials. @@ -325,8 +304,6 @@ Denying local accounts the ability to perform network logons can help prevent a > [!NOTE] > To perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. - - The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts. |No.|Setting|Detailed Description| @@ -341,12 +318,16 @@ The following table shows the Group Policy settings that are used to deny networ #### To deny network logon to all local administrator accounts 1. Start the **Group Policy Management** Console (GPMC) -1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO). -1. In the console tree, right-click **Group Policy Objects**, and > **New**. +1. In the console tree, expand <*Forest*>\\Domains\\<*Domain*>, and then **Group Policy Objects**, where *forest* is the name of the forest, and *domain* is the name of the domain where you want to set the Group Policy Object (GPO) +1. In the console tree, right-click **Group Policy Objects**, and > **New** 1. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it's being used to restrict the local administrative accounts from interactively signing in to the computer + ![local accounts 7.](images/localaccounts-proc2-sample1.png) + 1. In the details pane, right-click <**gpo\_name**>, and > **Edit** + ![local accounts 8.](images/localaccounts-proc2-sample2.png) + 1. Configure the user rights to deny network logons for administrative local accounts as follows: 1. Navigate to the Computer Configuration\\Windows Settings\\Security Settings\\, and > **User Rights Assignment** 1. Double-click **Deny access to this computer from the network** @@ -356,15 +337,17 @@ The following table shows the Group Policy settings that are used to deny networ 1. Double-click **Deny log on through Remote Desktop Services** 1. Select **Add User or Group**, type **Local account and member of Administrators group**, and > **OK** 1. Link the GPO to the first **Workstations** OU as follows: + - Navigate to the <*Forest*>\\Domains\\<*Domain*>\\OU path - Right-click the **Workstations** OU, and > **Link an existing GPO** - Select the GPO that you created, and > **OK** -1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy. -1. Create links to all other OUs that contain workstations. -1. Create links to all other OUs that contain servers. - > [!NOTE] - > You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. +1. Test the functionality of enterprise applications on the workstations in that first OU and resolve any issues caused by the new policy +1. Create links to all other OUs that contain workstations +1. Create links to all other OUs that contain servers + +> [!NOTE] +> You might have to create a separate GPO if the user name of the default Administrator account is different on workstations and servers. ### Create unique passwords for local accounts with administrative rights From d2d667cda31534c2d4d1645eaa2efe1aa3aa027b Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 14:38:19 -0500 Subject: [PATCH 08/93] Update windows/security/identity-protection/credential-guard/credential-guard-known-issues.md Co-authored-by: mapalko <20977663+mapalko@users.noreply.github.com> --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 517b038409..962ea3db39 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -51,7 +51,7 @@ Microsoft recommends that organizations move away from MSCHAPv2-based connection For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. > [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before installing the Windows 11, version 22H2 update. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. > [!NOTE] > MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: From 2e513a20104d0a12af300f252d1b92981d5dc879 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 14:39:56 -0500 Subject: [PATCH 09/93] Update credential-guard-known-issues.md --- .../credential-guard/credential-guard-known-issues.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 962ea3db39..d863d5b342 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -9,7 +9,7 @@ ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article -ms.date: 01/26/2022 +ms.date: 11/28/2022 appliesto: - ✅ Windows 10 - ✅ Windows 11 From 30e66f5ac86ea71a3b77182cb7b8fc9e14075af4 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Mon, 28 Nov 2022 15:19:09 -0500 Subject: [PATCH 10/93] updates --- windows/security/TOC.yml | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 8cfebcc879..250dc19e5d 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -312,12 +312,13 @@ href: identity-protection/windows-credential-theft-mitigation-guide-abstract.md - name: Enterprise Certificate Pinning href: identity-protection/enterprise-certificate-pinning.md - - name: Protect derived domain credentials with Credential Guard - href: identity-protection/credential-guard/credential-guard.md + - name: Credential Guard items: + - name: Protect derived domain credentials with Credential Guard + href: identity-protection/credential-guard/credential-guard.md - name: How Credential Guard works href: identity-protection/credential-guard/credential-guard-how-it-works.md - - name: Credential Guard Requirements + - name: Requirements href: identity-protection/credential-guard/credential-guard-requirements.md - name: Manage Credential Guard href: identity-protection/credential-guard/credential-guard-manage.md @@ -327,11 +328,11 @@ href: identity-protection/credential-guard/credential-guard-protection-limits.md - name: Considerations when using Credential Guard href: identity-protection/credential-guard/credential-guard-considerations.md - - name: "Credential Guard: Additional mitigations" + - name: Additional mitigations href: identity-protection/credential-guard/additional-mitigations.md - - name: "Credential Guard: Known issues" + - name: Known issues href: identity-protection/credential-guard/credential-guard-known-issues.md - - name: Protect Remote Desktop credentials with Remote Credential Guard + - name: Remote Credential Guard href: identity-protection/remote-credential-guard.md - name: Configuring LSA Protection href: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection?toc=/windows/security/toc.json&bc=/windows/security/breadcrumb/toc.json From ef277156076d325e285b6b68fc0e6ad9e09dd928 Mon Sep 17 00:00:00 2001 From: jsuther1974 Date: Tue, 29 Nov 2022 16:29:39 -0800 Subject: [PATCH 11/93] Update use-code-signing-to-simplify-application-control-for-classic-windows-applications.md --- ...ontrol-for-classic-windows-applications.md | 56 ++++++++----------- 1 file changed, 22 insertions(+), 34 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md index 953d9ae95e..c7b971eed4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -1,6 +1,6 @@ --- -title: Use code signing to simplify application control for classic Windows applications (Windows) -description: With embedded signing, your WDAC policies typically don't have to be updated when an app is updated. To set up this embedded signing, you can choose from various methods. +title: Use code signing for added control and protection with WDAC +description: Code signing can be used to better control win32 app authorization and add protection for your WDAC policies. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: windows-client @@ -11,14 +11,14 @@ ms.localizationpriority: medium audience: ITPro ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jogeurte ms.author: vinpa manager: aaroncz -ms.date: 05/03/2018 +ms.date: 11/29/2022 ms.technology: itpro-security --- -# Use code signing to simplify application control for classic Windows applications +# Use code signing for added control and protection with WDAC **Applies to:** @@ -29,45 +29,33 @@ ms.technology: itpro-security > [!NOTE] > Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). -This topic covers guidelines for using code signing control classic Windows apps. +## What is code signing and why is it important? -## Reviewing your applications: application signing and catalog files +Code signing provides some important benefits to application security features like Windows Defender Application Control (WDAC). First, it allows the system to cryptographically verify that a file hasn't been tampered with since it was signed and before any code is allowed to run. Second, it associates the file with a real-world identity, such as a company or an individual developer. This identity can make your WDAC policy trust decisions easier and allows for real-world consequences when code signing is abused or used maliciously. Although Windows doesn't require software developers to digitally sign their code, most major independent software vendors (ISV) do use code signing for much of their code. And metadata that a developer includes in a file's resource header (.RSRC), such as OriginalFileName or ProductName, can be combined with the file's signing certificate to limit the scope of trust decisions. For example, instead of allowing everything signed by Microsoft, you can choose to allow only files signed by Microsoft where ProductName is "Microsoft Teams". Then use other rules to authorize any other files that need to run. -Typically, Windows Defender Application Control (WDAC) policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This purpose means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a "catalog file" from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed. +Wherever possible, you should require all app binaries and scripts are code signed as part of your app acceptance criteria. And, you should ensure that internal line-of-business (LOB) app developers have access to code signing certificates controlled by your organization. -Catalog files can be useful for unsigned LOB applications that can't easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your Windows Defender Application Control policies typically don't have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of WDAC (compared to using catalog signing). +## Catalog signing -To obtain signed applications or embed signatures in your in-house applications, you can choose from various methods: +App binaries and scripts are typically either embed-signed or catalog-signed. Embedded signatures become part of the file itself and are carried with the file wherever it's copied or moved. Catalog signatures, on the other hand, are detached from the individual file(s). Instead, a separate "catalog file" is created that contains hash values for one or more files to be signed. This catalog file is then digitally signed and applied to any computer where you want the signature to exist. Any file whose hash value is included in the signed catalog inherits the signature from the catalog file. A file may have multiple signatures, including a mix of embedded and catalog signatures. -- Using the Microsoft Store publishing process. All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll up to our certificate authority (CA) or to your own. +You can use catalog files to easily add a signature to an existing application without needing access to the original source files and without any expensive repackaging. You can even use catalog files to add your own signature to an ISV app when you don't want to trust everything the ISV signs directly, themselves. Then you just deploy the signed catalog along with the app to all your managed endpoints. -- Using your own digital certificate or public key infrastructure (PKI). ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers. +> [!NOTE] Since catalogs identify the files they sign by hash, any change to the file may invalidate its signature. You will need to deploy updated catalog signatures any time the application is updated. Integrating code signing with your app development or app deployment processes is generally the best approach. Be aware of self-updating apps, as their app binaries may change without your knowledge. -- Using a non-Microsoft signing authority. ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications. +To learn how to create and manage catalog files for existing apps, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). -To use catalog signing, you can choose from the following options: +## Signed WDAC policies -- Use the Windows Defender signing portal available in the Microsoft Store for Business and Education. The portal is a Microsoft web service that you can use to sign your Classic Windows applications. +While a WDAC policy begins as an XML document, it's then converted into a binary-encoded file before deployment. This binary version of your WDAC policy can be code signed like any other application binary, offering many of the same benefits as described above for signed code. Additionally, signed policies are treated specially by WDAC and help protect against tampering or removal of a WDAC policy even by an admin user. -- Create your own catalog files, which are described in the next section. +For more information on using signed WDAC policies, see [Use signed policies to protect WDAC against tampering](/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering) -### Catalog files +## Obtain code signing certificates for your own use -Catalog files (which you can create in Windows 10 and Windows 11 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you don't want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by Windows Defender Application Control in the same way as any other signed application. +Some ways to obtain code signing certificates for your own use, include: -Catalog files are Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries' hash values are updated each time an application is updated, which requires the catalog file to be updated also. - -After you've created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files. - -> [!NOTE] -> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, Windows 2016 Server, or Windows Enterprise IoT. - -For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). - -## Windows Defender Application Control policy formats and signing - -When you generate a Windows Defender Application Control policy, you're generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 and Windows 11 Enterprise, along with restrictions on Windows 10 and Windows 11 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file. - -We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command. - -When the Windows Defender Application Control policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add more protection against administrative users changing or removing the policy. +- Purchase a code signing certificate from one of the [Microsoft Trusted Root Program participants](/security/trusted-root/participants-list.md) +- Use your own digital certificate or public key infrastructure (PKI) to issue code signing certificates +- Use Microsoft's [Azure Code Signing (ACS)](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/azure-code-signing-democratizing-trust-for-developers-and/ba-p/3604669) service +- Use the ["Device Guard signing service v2"](/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business) From 45dc209393f9eeec70119cdff6a10a4a5f75172b Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Wed, 30 Nov 2022 13:47:05 -0800 Subject: [PATCH 12/93] Windows quality update reports. --- windows/deployment/windows-autopatch/TOC.yml | 13 +++ ...utopatch-all-devices-historical-report.png | Bin 0 -> 51960 bytes .../windows-autopatch-all-devices-report.png | Bin 0 -> 116993 bytes ...tch-eligible-devices-historical-report.png | Bin 0 -> 43829 bytes ...h-ineligible-devices-historical-report.png | Bin 0 -> 39892 bytes .../windows-autopatch-summary-dashboard.png | Bin 0 -> 52748 bytes ...patch-wqu-all-devices-historical-report.md | 40 +++++++ ...indows-autopatch-wqu-all-devices-report.md | 56 +++++++++ ...-wqu-eligible-devices-historical-report.md | 40 +++++++ ...qu-ineligible-devices-historical-report.md | 43 +++++++ .../windows-autopatch-wqu-reports-overview.md | 110 ++++++++++++++++++ ...windows-autopatch-wqu-summary-dashboard.md | 44 +++++++ 12 files changed, 346 insertions(+) create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-eligible-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png create mode 100644 windows/deployment/windows-autopatch/media/windows-autopatch-summary-dashboard.png create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md create mode 100644 windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index f2950818eb..5d31d988ca 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -50,6 +50,19 @@ href: operate/windows-autopatch-wqu-end-user-exp.md - name: Windows quality update signals href: operate/windows-autopatch-wqu-signals.md + - name: Windows quality update reports + href: operate/windows-autopatch-wqu-reports-overview.md + items: + - name: Summary dashboard + href: operate/windows-autopatch-wqu-summary-dashboard.md + - name: All devices report + href: operate/windows-autopatch-wqu-all-devices-report.md + - name: All devices report—historical + href: operate/windows-autopatch-wqu-all-devices-historical-report.md + - name: Eligible devices report—historical + href: operate/windows-autopatch-wqu-eligible-devices-historical-report.md + - name: Ineligible devices report—historical + href: operate/windows-autopatch-wqu-ineligible-devices-historical-report.md - name: Windows feature updates href: operate/windows-autopatch-fu-overview.md items: diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-historical-report.png new file mode 100644 index 0000000000000000000000000000000000000000..4a7cf971979b2e7106d30ed6049ec842d205409f GIT binary patch literal 51960 zcmYhiWmH>T7cERn8{CR}ad+3E!QI`0OK~fdQrz7&xVu|%cXuri+}$pH-usR3{>aEU zNlv!Sz1LiG%@d+1FM$M)2M+}Wg(M{@rVIu3(H;uwg9j|&{S)GA?A!OZ4^GMwB2X3M z1PAXIpUj2jgrT6SqY$2rKEGeX*-L6UK|vw+{Cj;E_+A8pf*OvH5))Q+*FS!NNhg%> zTt}FxF+HlKc;X%GXvm|}TF|O7^@+79chyKk=Zb4x?QI(!Nr(GA$YXAZO1YozG|n@T zk`m`M{vhjls^dKl#nx#L6$`~J+V)0FZ$NG^+!_&ASG&J-JIQED+xVzrVJB4yY3F=WFCdxk>rnVD$;IAy z4>m>j_^F9yoK+XjgcE3l6Zqg?0aPp54(w)YH=w>w*3>&t~5>`0;q1hx_+c z)&2fpC%uv2mT|8LPR)b3qCTz4SJ#s~llZ2Diiohw8koJ!f|`)F z#2IA3zF}?+Bk`ATMqL2|IBh+_Z(SetxExOYjc!jr5Q)HYsWT!nGN-s0&cwu|5wwXI zNlhEHHb{Jz<2;PiOyRGj@=2PNt*7PdGUkVCd=cgr6UZEZ#fS_&!JctT5f*uv4J%A) zrMlUpZfJE7*BNX(AEsmiE9zXz@TA1ECsI9%K$ilf z!sU!JNA~ulCDTiDQ28~y+vlHoS*3zIXu~PjG$m$X zw&mxD|8L=gTI~+If4FjD>IN{97{U8n&RDR=+U;VN%o7QJ#%&6&Pcj7*Z8PrC5|l-{YFgj470qu#TfZrg&c3% zGXm9uuYq$UO}`O}j-0X!1_IGCh?|{P6I|(#xmFaJ_k`~=w!rW0VKYln78)E#EQG^wTz+k#X)i$I z!^8OCJn@*fTq`W6SYn#y2xKuvG?qP+Nb5!+!{sjRiek}&LSqea%s^2Cc?GHoUR!)* z))BE#1sGO+27_zr2R}m6FLGjLr96g5Ny3$R_zKtRCPWM9ejz6iYcCLZ`SM)PxQ>0o zm15N}_F*H`VBG==6wB|4mo5i=h`@dUeT8u$nT^G@1wZ%lDb^=kQnGOg?Ven~>S+c5bDCa3)o z#0(%`CzVE4OTHW(;$mPyvYzi(DC^A_U+O&|JJ_iY}5Az{})7{feR$2$N9uGUdureMY$4z@-Jq3+AHLuqet<(loT41(Llh(C3mxMTj^C49Ct-v# z9%n>uBJmKWk%!F7WP~T)%0C6yBe{D@c2%fQx0_aIpW%d@2_Z$iWqynoF1DG%37ENH z93I&W>B7|(`q~2ZO{$KDU6IHvmM*r)C)X(@*P60|@E<@{N2+{vB)Hh@-2(i#S}_xU zfPXFrj}vr{mIo{j`~%P^m5Cg*IRy^^r++)+y}&}hSnEO^2_nIN=o)odHQe;~xZ)nt_zH38wu?GLKj{_Yuf{N1Ab!*Og3tZ$AUEP9Ek#Ucw$LvmB&mePY=?h_ zh!N|L;P@(+O3a?cZ^Q0T%0^`TwO`!2b|ja(_-9qvf>!FTU7_ zspE2E-h{>@C@10C~_NFqsH=dxa?&#R$Lhv#^XXB?(MHp(>Brn4V&V9*h#W|;mg00*aj~CAX}U#IN3dqIqhU9$IF_j`8nT`XD?L_=l9*dD=l3!o(uLq7d5vEM(>%mNAUy< zps!>x5|zRsM}4cV=X5e6Uc-K%rni&yheEDJwjCRrOid4o<`#s}GY>*o*vr+#k2C%v zSH1>Y=~SM$2VFEck^NMO%dY_azWTMesAS@>vk}E$%nD;1We^g7#&(3ul~S^v*I(Y|E0y76%%4P8qz%~ zVaS4;tvZ;`Dlb1(Pw`uy4*&zmW?MnK_F(4WMWoR43*h;tEKk_koX3BT@cn&PnX!E> z2%NR5SH5ERO_mg5|JI86zCD800;>ih(|@wP9yY-Tczd?#mGp7NvQH)-Ph(dr7xy0@ zBeF|l0+*jA7d4{-6VR%br5qBe2PEmdKR@j=>UQE+wg=Y)3d$n8Y(A%` zaQmFn!-q*nr+R&cR&j1Ggo*LGAeENxb+PetbVV$TJeE+l!omPqwWM0vzh1+obI18t zjO&AxGpQ!hh3|fa+XXifrV-f=n!p$Urp>#q z-P`B~+3*Lfi(K*>{&n{ofpoziUy|6a2EF96YqD|VKP}CI$~}#(zX`Mrd@HJT)~WG$b+-c@R{i zLsaxL!M8R}>}tEEGA?o7zTyF2b zIE=b2{*CKCC<$^Iu%BKe1)5RJl@W~Y`d4ZgMuU`8^na-o#(h=6+c82ThG)v6AWQUr zZQv!K5KT-l2oIwg|H@SvTrne0AeaUyoe8+SW&`bAvIx#cz5H+kmzSbkf+>#|>xt(u zAKZ7#8(9Qp%<36Yp6&>Q9n=B0#{wS{=Aohn#J}OR*k8;lwLMQGaA(8^((@Lkr-!ED zaaS(Tt(E3r*EdOsf)$NX{tKqwynK8ysj0Mc{cE(Ph^saJF}2aMSad11_j#wJvf9!H zUT`tZXzlXiOsYnE{!3c={XYuqPFeoinQhXi(j0HRVnt>tNJx0|xZ12l#*gZz^ZOw0 za_mY9I((#AN(jMg`ka@(7-oX)1XeAsHXpH;9AoV2VyN8l6Btlb(vCcRMWY7wxbNqi zU%Y0bGvgo?4gCow18v5RXY^>X(sUSp8orQkdl+_#HKJpx6gt~vW)H>9OXmsCkQnbg zh-kgb+*7s@u*U#rV>c%u$E5s#*-cQhusahnRU*2z;rkQ-4C_wEAmI7=kqU)a3@Fdz zT*8tr=t_WHsoOQ~C&5g!AbGG$LD(CEprwJdy1mU`XZ0B`^ z+|?GXbUw#V8p^B=kDX}j&fy{g0^w`KUccI=c~y4}x(?`?aUf^?nHj{{?dGU#FG!2c z`>0lQ2vsH4g&b@l6OipVXO5^$UI2<~XRAGo)yL=cvOarUQZ;yfn-cdxF zQgNDyM<7@QbI{y3d58$HD(TsJ`4Js!;44I~zh1m0uRA;lB**fT5(r=$K-rpYCP!2l zVOd-cZuGfgP3ckLc6$9%z=2gX$WNKU8`%Ei4%}9a0RKQf&C14H${~3WQKw;YSK$r8 zRnpJUef1Qh3M{x3iPv!JG*!(d=fdW2k)s}=6QaVcYq|6~UTwxcY0sUMz1bS{^((SH z6_s#8k|+8WE-DcTHZlAXm?EqTHXvL7MO^c01~SL$vY912y0jz^@F0>a*P|Yn8epM) z%OAm3QdSQPjWwQ~Z*Zal{0mJgUlG%bV8g_^ryDfiG%FRgN?q8XsR9R3PyQtGLG|X4 zSh9Li1%#lGZC;U7SrtW7ERF&!ZUBpfu3|Z)YoCj&JAkDU%mlgAVdqU5_EPNv;`nS# zA4x8{7`yD|MJrTE2+{_oy%2%zSf057mtP2p!Y|lK7Y?&>Vo>v)%DouVK3lQ+tP4S{ zxlr71whQ1WTNpO*eqq_(O-rDoA*5ZI{>V?nl~aBHFd;z}Ur1zkh9{a!j@oYi`zP`9 z>sPEj<8zPVXWy?GK?YV#=92Lq`r&Xj+$goe3Z{sLKN;cM)sZ+-l&07;oNG|IF1xpL zW^qLkQAknQ{HQUcn=JS+u0<98XpXAmf9!&K=FPLPW@HYcRDjyKkM&Ei0Ygv;Ly||7MHV{dEOFqF z#`pgqvr9U%(&0YP)aE6SF9t|o^J0!9JZ)DRY7Ai8LejT!p6Xd`$h{Mhbm{Rz7GfP- zF#jD6OlGI-BILYV`Soxdj8h+WXI+6v}&>Lw@RJ67~CT$=eXyh-XR%^4=gK z%F|)6v0mTZnp9O{yCj%SGb2AxJb-!+E%?y;`gkPAnEF!URoNG?V!)+9aR*H8v?E0o zoq)P)XWd~2aWysE!_rVC<(XeUo6$Z*#r@wlM;YwLI+yzBR9Wq%d5~SXOnemBT-`Xg zUv9Mt4sFF>?@>n?Vb~pUL!D}sw3H%R4jqpLJTVR)ng_=jg!JWEJp&&VS0)1yk{EN_ zxQP?y>ZwPE#MNA4*wH(;;`U>d)Tv2*XuD-$~BQ43Mwv89hdfr=|D{PZ1CQIh+#x+7r6K zlywl~sJ);}fQvzksd}j;J3*TbeleD<#9hJw)k<69z_QT34%gUxs`fScA1rHzJK^Ba z_ep0+t#-B@rDf2tqD+EDb`yC?xg}3~9~~tE-M_1{p!+3*h5eZ(hQHpn?yzwMFX0`B z*oW3C!N8e8|1Yrw{sll&kt5D&Ytx;YYyE$)2`;nT)O7g&8w>QUm8s;)_jRqDiE#L~ zV*LN!47hGj@kPIK54B~v`aK&N(V$UKow#jT*8V*=^#4VIkz2Q+x{2&kz=0O7nVA`j zfB=J3?v!L;eIZ^Bpb0 zF4Et{aXDiJOMG?6Q(ms@gRr+h{Fjh2yZtH!$j`Pl6A+E!^(%2ChgWoPUc26bOG^9Lv= z7G(R}oSIlmIto=T4~w91HcKp| z20Gg@21=5LQiS3}09hKVGI4c<28sKV^Wt^h^e1qvPX^^C*C%yFJ!luY**E(slJWBIb2c91e72Gr&m+7W*qulh~L}5@Rrl z2~JmYA11&SF4sE)LQD`iXB4z>6wqb(m8{fvVn3iSj|%}gBFQylJH1m z6Ob3YJZ)H?ys5*|R+V<4MTO)XscWG)WV4DDC14i zD;XSSar^3xh&C3c>vbM_Jr{cfi}LcW$xT?`x>xrc_suT9?uWgZ}9U z$v=G6-jC8&1gjlH+#1L5a3n)#5CIt(h!+@0l0>&zqXUi~Vdm!yytr_vb9M%|{=u&0 zMZe}n;!VSUmkdHn4z=rUk>XfXgamnjKoh8$8579ifrN%R_Odqq)a-1y@2g;4LxV^$ zhotS^|Hk(S?=ph31Lz>d*r;Q*Poa+%ipNpdBLx@~ zzYr@7ydOpEM(x{)9zx5&h2R81P=z1#vo;FL-xo#9G_9XdG=o3bRSxzv7&2{-R5*s1 zJN2nmVBM)PzZ9Vs9`oaeZ}gN5qnt1zzRVvxp!CqO_pq_h&VLwkYN5de9i%Shy9WI9 zf!#9v)Rheb@PqgC3m6`-{V$~L>2Cv}spfk7enj>My=n@C4-St5H10x9c5f1L>MBss z10j#hVC#qP1m5J(63FAkdhu54y5twqE&?Ax!~X?EBSBf~pl$LP8M8Gz z21!aSi<6hKmHgeKQR8aOvIw#*Ho@>xz&Ool%2;SB3;OgxJH%-;R|&i8VjL=y!G6c9 z6!L5HcTbMQcMTZNry#?69&{DcrTokUPG0@oIq7;=1ZHm5y) zSiPOyJQemkHfkRO+3atdtcE%XZQMvr>4VwY1^LqtIt>V`xBVPL_Z>w!*di-#s zvWq?i^odhfmWsL#e^%9)%Pwt3vczWk%0u?Kn8&op`p~!Mz@Oc06+W&mrasd*Y>bJ- zXEdz*hBJQXId-@ZnmXyTk|4TBJ-_VHhj{r1iUhc+2E_vmh9Pnd#kSol$7OweY=?Z4 z-beO)i55JjYC;7rG#?~}{nn}anz9j7Ch*NkgzMjk2WGB6ut`10e)@mReu%OF*By0y z?IGGtc_`Lt)O~W0$Mb}dgsp`jh9H@vg-9L79pKC*kFH+fW$29|Gc_(xHRv6yoG2Pd z=|#Bc0*aWPbjyY1kc6;>V)bYGIsdmGg+zab*t(9-yNfbKr1UvUXssrd4I;w!;}rEa zem^c-vAekB7Pr8v?e-OwmJ6F5nu7K)bBgi^@^>SurkK20EY76=HvrJ#-W7#)| zy20Thw?)_iJ00#&DR2*EAAxK18Kob^%h#BfGybyXXeNhsVn)0(fO42-g6&D|wIXncAwB1lU+G=3-xW|G;K$dr6reL>panft z*wojt;H_-yGgnUt8%x)zvyv}o$CPGzmfxIBEafS7uspjR>qCx`_eDH$3Mewb7d`Hw zlHFcC?DGz~i8Iro()zkzre!|HspBEbEZe8uJb-$fcw>6nSdi)MSaDP#7AxC2DhAI7Yy47Q;V|_Q5kb$ke?oe z7?)CoKisTEog>1f$ks+oMuLu4r$lLH`gchr<2!qtaizo4!QZ;%Hk!wuTolTB7hslo zj}$j}e>Eij90Yn!%Isn}J*JjB_|>7I5k>$5gIE~iq+~E(V9|kEoq))HlkMQ=tCPr4 zjgf)B3fj(-N2a^oKxirUCG%5a#(mpnvnW(DFo@V&re$wz%qcQ~qAW!CnMNSMa3fi1 z1GKYb0krB&&aFfh#A;u2vS-(k;?q3zSy-Nm>NsI4SL*f$%Z5BeV|$O)Ta=Y{ElLs( zJITa&@Ze{>c;gTr07XR!4^#0cm!|xems#_u3`EdVq7wJ8oSh>SQ}**6ZJn{O_b9IB zr`CbraE`m@q_)K4IyjKhH}*wz=rVrTGH4HaVb$9$|`K=XE%ZfXiVOjkEun4lk zJ#}7JNt;wR2y9r_k59lf7OCj%2HcEwmxZK` zaPq$4wya-WEu5nKmzt$Ty?1c!XU2T66BESDc9S)zeUR|V_@@Khlm*U~q4kXtV&K-Xxt2Dqtt4U)3X?TE{PoBMFyaIIx_2kx@GL!S8rdyP)Rj#up6WyqI6Drrgv z46qZHQ60l_*KX8PbSASs-AZSO5!3H2<~rvaZ_LX6rNUzEYn5m zy|AFya+&eVgZoLR>D0pd;0pC44zxb6f|*68s6zxBC2<5RWlDODGD7Q@N~ zahd7M={^qoQq+huCt&-c`ge&rStyQ6R2uqXc@hkfIU7ag4BAk~6l@PNPSt7G^2JK{ zTy-fKQ;eHB1OJc{PZtahj6%o2ZK)@+qL^)oFBc*gJD6xv^>qeCk&);R(kmE+vBRn? z?L4X+_<7>6%Auy_%G;<3bgda;wKwmR}DW&ggx$+4KJFR{0A z9|ga)WkQ{V5u-xJd;wfmc8@{7w*QK zfxBBmiRN0G^Nx#-scBkAxZJ+O96@x@MCoTPGA2oS$5BVhB6N+Fh@K9ngFz!9?jsKB zRyb zRZ(OykwX^YZp&IGZ-Gfb20ay}k#Xop)^~k~@m(L9+LN1Yz#VlxE_K~*rpMN2vft{{ z#nvBmAo;W4n{9z0wkL~&e<3Y{x45Qop8i&87q6|S9`bBP0n(q2IqPv z9?OLhVRQ7($l#EE8YYPlQCu%e9PC#bc>-nj9BaLCE*R>n| zQI(Su+`tMez74kS%jo%@Ywd$CFRRc0-0dX_F2B%i65%S>BTVYBu}s=U^uO)2J4>@zeavpR3o| zjG1|w=UfJr`ybyGHai-rE>`MZ`QTo1?Y)e#u5X;m&74rm^uT z6Rm!GWG>8@M;};6UMe$#xM&ws*`!n4ugY7Vo44|@;9TnowdHgW`E)Y5Kr~U5=nnI) zsul^St#>RYiN7%w;tT&l0q}CA1&y0n3Lg@dDU}-LHs!e0uUq_{ApSLE@oQ|$f59{f zaEnZ7HmRwd9yDk3EAuBmBRWFRR_-;yHBT}jEZUe;F$c;cBXiU9#aDLEJ6dyDM$JX}ojFFM%jWVb|*XfeqekKNj9Vps+Vd(p(2A z`D!U!X-uR-S#-2hQBggxJC+p@=_Z#s7k12cEjc4a#9V`TR$Cw?YvPt}R%Oj@^=^;+ z^oL7&BBb)7-*{M*nEm3u1C ze4e+6>bj47{{b-q8})VtzkGU7oj~L_p6t%Ev($pNv-4)9^*7@ccB{V^&D`R0$;^sd z(f6##t5_k;(tV2bIqGtVj0~Rop(&U-G0}BI6d_Ard)rE!uKUiedaWb-p0l?mmo0x{ zFl2=d8nDv^vjtVOu(myShYixuB$=@&QJHZ~O>HDXmaI7N4$ejqQC?74@tiHnibXaS z5qnjwjO}edzYvCMagBN+T?5!gLD9X4)I^Oio)M|xQOr@C794muko%!xIQBZ{$tb#f z_LTMv#6%^Y(DZFbNIA$8;%R}AqvD5v%=(R%BOz$}{x``desx_zr;p}L1xD({{j-w9 zB_+cSJdHTza!8WR@%}_9SVW~*dW7ZFbfe;C>R7ZRBlfq)9a&v=Y^dfr+GTa`Na4NK9vopDagVLgU8rYXL z%JzS+#Vu^@q>bRjlN55Z3qE`6op8I}697DU9WFPK5or#BsNO{g^Jq2OO|kFnMt>-$mY? zGdXt$-{XX1!v|YIv8Vq24>{LwBXF4O6}3BK%IF=g`Vo}|)0@^qcwTIBL6zji7fI%7 z_xdIB@NccPR?i#!u-aQE9Jz)}zcqqn@i82r&GVn6aJZG6(9fR)o4@QF z(d@E@hlh(u6bxEmv;*rWixNP}v(ra%?fP_b4+Y9YEF2twrBV7eK~{ZVj_K!MZNa1_ z9yy$*09ab5ip?p5SNOv5to|-&nDfW9v#sHWT5hjv*l}{buBF@{hrbY-Jn{?)Pctli z?^msKS-QZ9BcO{uYs2xf1mzyaZO0w2D=~KfdJyu~eTW~o!a@7PV;c9*$8b>2xN>?1 z-+GVEO5@In?Mn5J0eKsbE8BE#4|s`NyS}3p6d`Lz!;(U{A8yBA$z0%u_T`Q5)_VpS z%P3XEDW{D(#~HqF1?;bjd8(uF^0u;Y@mp15(m=LdPj*Z)#VR6GIm38jfNOBgt#?{fwY1V& zp8qdK%Pr}k-|HuS_YJoU$yNG0T6qgl@Oh*{bZ+6spGoJ;f7VhF7TbPE9R!oUVf_|`ftNrGvsU`u@HD|o>o3A&w z>*c5Sq(ayXh{bwUnz!6+F&PwID{NkZ8{j3iojh{BPycUs8hh62f;h@UN zF3OnIosVE{Pr-m+ZyLZY1z_c1Lx;IN78Ca-3uR;6+Kgd~E`~^Caed90c-Z;jK*B&= zg8P~GaM=ESQ$L;0DW+nA#b&7io#Dmg8hYyY_$j9|G7`zrB~RN;mwpjF(I_JOR5L+W zrs$7B_5!k(MX8pbRQ9LOO0w2S(>L!7@S&`FxKodf5ssnKpwUN*?ng@Ka%;kqAi^># zKps-=@O+>|k;%}wDO89)&`RK5+8aC&DtB*GL4;zab1obQ&7_8N@yYfL5{jjuq3uw& z9=d-i>t3-M>Skqo|BA`+^X`Sli=yurS1E)0W(_h*9^Qp=0&bM4^|@FBQKia#2ary% zsD67QlFohu-)+6~rIk+`8e6DyKTugPVkm^BIMCMF8TG|aG&woX_JJHY*d`}8AtXrG zGuVq`W>KtcJ=ppAG~HJxIqoM^h}4}+2`+2&PBhY84mlMP4@JVHQj?7hMy^R5Gu|M5 zK#qMXM>O4BaKA{=SZjEazBj_nnrO6wf}u7^e?D868HY%@qM@-D0c`|uSfNtQ#NHjp zF#?%3|D%eD2~JvSAh5KH8+WD40k^x_!ygi)Mi!YL3(FPP9f6B9rQ^$}u_;HwHN&{slDg@7eQzcl~MS`-`A`uOZRDTkgBb`O&lGD8j;q zkgp9hRkEwb~FX1hAyM zm`|mzh1#tH#xc3RyR{(^=5+C-3D?9J8i%;(_bIuF|s%Z&Jd0XbXa#qC9zQ01<2C*y;o$#zQ1g&qfV{ zR!)8|93|@CJxP+v))8JwZV}zn{G@h%TJD4^w}Wm3gekFBQQr4(rNvqkT^1YF-68(+ znk}FZ=^w)nCvW)2w4=KJY1b(f9iu>1&g-#dqiX#$Un8yV*b_TOW0o8!KinK##VThobqgyk<%4U;qk9B7|rSG6gWh1tib z=lJ>6F_7Pe<-;08(ve$jR4@&k%#WDdbAkBr;~k)>WD_mInLNW={Fho7zBrBZ<~Nw= z8%^@pT{jJu@#G_a6d{$hF+ji`C`*_hh@O3#dzU_`=34&qfl%$H`qr*&7BJy9uSe?5 zc|NaMViL*MZ#kC2h&r-5)O{1IZqFD^6SbnF^1PNh*@SSTcz_xBL?pZ<4Szgex6 zr!93saZ9_lyi<9d#xa}TpR>3T!^xQ!P|O~&>Aw|F7*>O(s^`00oMN{eAU?_L^JbFU zWI|56nE4CE`lJ24Wv4Quw=Jq&j}Rv%TB?>obMSA|(BE){A!b1~hKMbSxn-V{_u?b- z;mxF#3$qUWv|x%2d@XH;DjmsQBRjs_b$~6HbXXsFGd$2BrK{dmXK5XT;s$# zHOuuOOg`jvobmbwB{y#S<_0;ZvJg5$PcK;=kC}!2_wBM(ovRD!Hzov)X~#(}X8({2 zC5T*s!mai#mP_eBZQ{L)dv-M?Na+)ne)FInnEW@pk+`qwJ zDF*@-lM^D^V&VT{CFbz*!SrEbN)9s!TV3+xVJDFC@nHuP<4&vU6z?l5%C0o0>{2t0 z1A(rzsX=B&sn3rNHDOq0^C`L9&8oIV|vzlNB#ga~2K#E_}{01Nr> zR`@jwE7<#9R^VNGaF3t`x}Rk>Y^7mG+@Jjja^P%-!VE}J9!s7$3({usYYBCXSL4cQ zb%U+x5Uy)%AgwIJGYvS993B=m)uZE0#aEh{4dxA9m|KoqKXnL4zRS(c#TAWn#Hpuc zpHiRu_CmSJdP3v>cF&0=?}I!@ zmA_${AH(>H#GDDwBEF^lo=%J8)c#J^s4_4TT`Ph!$u)r-odhc9`->iW83qh}1=ey& z0VJ-!V4Aq4SmXPt+mTyqY!+x%K=7={P#l;VcyMeb>U%4U$2(Ve3Hv z8e36PZ(8&d^pmYRE1s6+6|nlzpz2x%kNS7BP5E7_osPGM35N}z2g21m?7HW$w|}KN zP5ODW*|$)p#+Oo`$mXY4j^nq>JLb1#?@pF!#_7{m>X;2IQwyq>|HyD zl5w+|41(E1%uP;45gxwCw452D56%(wn_Y?T7XPkPIY8D|za(C%TsWJn+8b7h5Tae{ z-V{tVjV7QjUa1l@?}##g-;i7)b8Y4#{SeB`!cq?zqe9$S!%I3f1DqOLQvTdOd&RhW z$?^&Fx$pB)ctroNtf-l$c;|hfa31w`s!;Xz?fJ*(i{IO)fw!lDK3-IIt)BIH{P4X| z5eMGau8mi;)2ES*f$vk7jjy*TT4nV&%^cnTkXmo#yn+3S`Ubi32^R3Vlt}(_rm%It z;}i67_bODi$#*C{u1K&Gx&Ud}K zcs1Z72{_&8xsZ6{+S_<3A2Zn`&jt3suc0)cUsh%cDEDs7T993RS6E^yq-KO*X!#D6 zmes?iZ(Ev{{VjB~^;NVabW3~0+s5*T$JJHc+_KAT`#fZx)H6-Ie%v_bpLRC8)kX7K zvWG#Kmhu%<0OOJBbL$GFmJ=%`=GrtY)RMVfZ*J?YTX~-wN-`?+Q1p5# z=EW9W9>^<>9PbaEqxMPL6OceX8%BPl>_9;sV z7`t$2rqX^^rTF!%GU<%AnMu)D-T$k&R}H#RcZ9Q~A=_#-G>`@+wSdqf%>nE>9MVri z#||i+?J_duYnTgdj6shD?BwUOtMtrO;mb_}=if&@aum3l4W#}e@4t#qPrry7Noy%5 zOVJU7I-_bSg>UnFa*>}o7x0`0GQPTlFpjJ*3CU1htSS`eJw!I zJ`J~TEa+^}Yf15KRZWceY4Bn!g*<#V?x*>hcV4=dV)8>|bGeqPl zBVR$cn_lvk7MOf%##hRA!9TO5`usib@r;w~y?~osrH_;N$ih}Kil+Lo7tMdznSh2+ zftaGmZ`G661()Uu_}t7xU0P1X#wwNCe?5v32zX-VEA9OYLGACS%2plCuFr=H5D&m1 z#Ovz4$0*BDw+j${FS@1pt|YnQy=`9kgwLjm(8rSCo@EJ%>IsxcvoiB=hP``CRFigd zE6UMTcGz(2j{47q@U660?0Lx04=jg@D$D$*3}y40F0{0@g*={mxKm!9V1ewg+{c5h zs-eid-^+!4kJG*WlJA4_t1|@O%CIjxfb(LfPDfhRsHx# z?PxX&@zZRiS~ITeONYF7Cw*BsdpwpYNm2*7%GH&k{82(a4|S1MHj~ApGU-mNmU2W{ z8E94=1KgaCiKX-Ga_E?eulG(ff@;Ti?m8Z`qLnm0J*GreXA;FH#*=Uz!FzfFzb4U5 zs%r#Z2CB;{&_QG>3ETBRHZ8m{N zMMK|vEhN}xfrKrO63o*A;V~T_>Nw|ei>P7Dktt#hiX^P9=@?{`R5WDnB%$>TE{3me ztBZU-gsHr#y$k4tpG{_VAQor9z68X0jk(;G4gw@l}+Co0f8|Pb7?WZi-jHWFE3r+>UDkg1@*6uMNl^<0+aZvMaAF6 zTud3_L7R`QI#cu0kp;tEv+CGiOG`p-F*|pfBNnDOKc&C837w#8rXv_Sss~y<9=BM* zM=O}sguZr!si;I}c>y#+M`F?p0{UY=g5ohqOLIOHtURau)b;nJ%bRG*&qWWrLO4G_ z!m;=+?Cnk1!eO*_crakHt%O!0#`_Z zB~@x+Srzx%B(?dZs)k?5v`D&u6QVg2)sD0$JUlC7ZVh=5q8^2`bf}`1O5~%j6#IPq zWRfdU&Cp-VG32H})N*zye62>~&DVp4SGH-$h-ww{HAOSc?~!%RdBc~8$Y>+8e#4DYVk?s*G@hlTS~Tn`-~sh&nl=9M#%+cM$? ztp<`VA1?O=F4ee+k>IO`jE^5n3k;W}2X3H|;QN=WHM;Wnq=GQ1L4WVN8yxwQW~G7s zzq2I}53PfSK!N(^zvOefd;fBqVMw!csOD5xBg5z8&Ahv6Q&atcrM~lqza3riRN~^I zhd|6aJ3XP{wdx!?+pr}cd8!yFNE2S(bz1Z} zXC6LUMh&OmuZBH2#$n9liS&bs0#}zSSWPlAAI(X2*aKSK&bqq1e^ecv!yyi;PIt8S z1>th1Nkxp(?N|G}31et*kfL@x0qq!|vF%foGP8VNo^DAQ3gZQ%P_l6D<*O5Y!~DH) z4$j0)wFJsCvoWyps}fVc5G=OBV8^n7XMNx+=QZ$}0^AvDnkp06;);rje)R(vzB_zi zGkKBZ^^O%hdl{ss4w`Z}X#xJWo7KQD{FX8Be>i)qsJOOm3p9Zs!QI`R!X1LUTks&k z-JRg>!Gb#kso?JJ8X&j?cXxP;z0bYpzW4b)tF=|NW=-vLjNbbwoYmbMb$hKlxQ151 z`C6mz|5R>Ls%w_00wSFUTO0%mB75opl!|F2Mf+=?R-Bt0ZZ_OMP)V>8;rZC0Y4uQa z$s3t@quY~}#?%bRme-j_(l?GHK=8BG+I0CjfBbEL(lfSl%~n2@pvC916|YU*M-8%= z0KfN6Y3ViEZuwP||8*36KIjC_sj?GU zbZhuL(%B>@)B1Xmc-I9f)CVSh#B9GFv)foG)#mdZWGqIQ5ZUu4aI>ju8T9l!70mRatv55G_l$+`AH?XSJ8nP=_yc_i}rVkvZVD&+mIVZi^Fi-V#~v9ZVPY zp{>!~8JXyQ8+>+1P1M)W@$&WQC>)!G#^8^?Ich}sdxEtZD1)amp&nJR&$~b?7skJz z^f+HOU!TdnZ*#HNqk+^TX@u(OE41IW&6~Jzk)Z+fYMnJ47O8Z@F7`x5WJXPQch`wDv>fzlK)Rwp5DbwIW>yna?VQPGilShkewtu> z>iS80nU=-6H!0n~G+IO@LEoCsy^cBIOaki1Nso>IJMYH<9F3KgA1Q~3x^6C1?Keqa zvceMOMJ7d_C}!^$`jV5Z)-p|-Kb^se)8*#4_BQr;4e{$cA|<3&BF)vd*obZ3Wjm`6iwqVms>byUbf7e%7&L3O!9B1By_8E+Q`!yHlPt z_qv*(%}AK@Yde8&$`yo+g(>HO#6n?Fo1S|JRHHs{#|0XAjbCP??(K0}^nD-?T*#ziiSDvY#{C^Z*m`X$RZ>PKF09<)!jh zGc*z`bRg`*v6MhN{+izzmwgbnl7Vx);4X1~@@OH6^^b0Jp+{2v6%Vv5`zOo?J;Ofw z*}^6ik=$Ria(V6R1VrxZE#{fEQd7M?B>kl|I`Z6Z>puK9qv;?|k&;pVV7upaYIFP_ z@taL*`R;!QZjDE}BG1H6^t~GKd0BJ^oc$QvFYCbTgWJ_&QcoGJM96uDTsLi3R{W2f zUd{^P<5H+X3a38AI;&pD69V@%nWrsRO}!|QcV`cmitA<*t&o34k8FtX03P~IPh%A# z!H~GhXF?jb<|!jr>8*zFMQ+2*WHa?JtLv(44j(i~t|_fxnD$GK*7`#Vf_5vgYAYvV z)^lIO`FK_&Y+o4&w5$}6EqG^4AmD%y`+6iyz@5ny43AgMy#50A!;a3UyHdwqhgo}p zCi33fb$>b^aJcfuV;HxxIT8`hR@;%XKE8kxrSW9(MFYmiel+0MKy(VR-#cbIKL4hm z>biUY1DL2Su0CFn-)+}`g}=rckf)nM z#6JJkxm#D_6`7)B0Jx#zw^cLG8wSmJ*n8AAp&hQ&AtX#Ee#AoVdtbSINHGj}gHB)m zqB_fmr%{A`!($eFK& z>ba{2XB&c9%t=>%hc~Q{=UGaLHE~KeGodFw^3$et)Zmr`v!&YlzQNOn2^&6$(2_KO z8ql+!d;<=~vG=e&N#r>~KJNY0C{OwoKkLL^d9o=jl9+;T&0&zbEP&bL3 z`1*Et^lREONvKwgv(KE2adxt{0BMfpDgh_G0)6HkbC2M%(2hjeYDi8G-Ej&pOI&GH zc;U>)20lT^z@_Z~deW(;u5HIk88@~AW8B7IoW(N7^Ui030d!{Du5v;B$C{{tylz!w zAHvg<7CC4dTP+EE*>g5l`_NdzZgOOSZ;)oy1@^+mu4pH(2Mx-!eeQgktL+cM!u+$M;4d!>gA zBWL~GFG_eZWH@25cYbUdxQ#sUB3JhvXA8*Z!#Ap*E2$IeG!y+FnH2ucP0f*oG~?Ot z+!>l+s(rF^nz@c5L&@<*mzc3(`{HN{{qpIZ5p*nUTGP9V0W2((kI)6UFt*!=$3Oh> z6YJgD&gh>G{&3~EekibMF-40_^j~tNNCb=-7>1>F1wGJGRHs?k^Ai!`VlN_8n#6WR zJC;KBs~nmq1kMta5hv@SLPS-VdvK&vKd=ytj(wi#WV~}Qd`)ijzl2t{_a$zZgszk< ziabS5@b@~R298q!`-k0iGV=sI1y3;Kl+X!M=}lPzA{2KaEJaZHwL1>JtRG)I0n;LTXtf%k3Z#Sgq*N~TD{pku+ z+<^`rkR4dw?k@m%ZE%1sf^yGJU1B)7Q@vYv)LNy|rXPFBR1POO)tLVQfbjiwses&H zfQqn6BvA>~-W7DJT-8OSbEdIgQK2WI)ju8>o&(WN2IKeT z?%P$w8~Y7Nx;B5;l(S-pU-v>y>}AfMCj7p+A!kINlE^R-cX73!LpsNRiK-#tiCXV2 z?bbI^RzoR&g$2hU?kZ%8X<6_n5by`p9(hw3NOw0y4$+kTl(2K-s!mXiPfU+I_=%=A zKbKQg2`#-lPRcBVTv|G`hnprt@v>3QZlBB3%slw6{dSr8EHb5DkHbFjI=JywXH86@ z2b8?yLo?PCR9lNtP*kw791K4=B0bO-nWChv;os%&YhqSJM#%^7@*9(e`R6AmC&=+E zq0oQ?nZL!wdF4f@Qyd{qjai3Q>k7VS1in|1#kuT#R$ikuKJI7f2EFH3mSVdppoPyt zGogz4)wQrNNQA=5`dH%`f`Lx~WX{gFdCly^*ov8=^5T>-bUz0XYRUMn$@G@2|L&NO z6c^wjosR8tJ=;Ux3bwzlN7@JPDy6yL8Qky0PVtjaF%>=b()A>E+`ZRd^THCQI}~#x zO#4P(!Z6(LA4sjFn-HtIJ5El?2$^~HXHG47OGSm1j_y!NJu6m&mFfOZTBA1)Zqpy! z!O^i$4{@90P)9aME>y6Vj0u1h%q%Mj+uMa$X4uyxByiu)g8@MP5E-1HIr8?8=+~-=JAFth~y0EZovk zDcK1L3kSjKy_erQcB@s!h5kB3aAK(qn%QKkuYck92*Nuy^%8^pAIH*L3|$_7-Chrz z8@xREt>32rJ^-ifA*bG3BX>&^ez7&;7A7I=tgg zJenI~2t`dbh$<;Ed-~}2%}-AxC0$U*sSL!#Z5SgWWF}YV!ke7^ z4S3N4B)D=Dz{=+rpS^j12u#bByJu&ZWhNmhtDSEL{#Fn9p3Q#W=-&?qKM$1WmqRL7 znLOY9&Mj@nkVix;DJhejUxzJh;-RiG03yT7xuZ^ZE8r)|0xE=MXFo`yr}6pohx+_8 z@ts10$=qK!2$-;*gaGXy73tpoevZtZf8&HZd@H8?}P^}Bk_vlZfJh?==~KG=)O zsSZTqglaN@NH^a#tmW4pvoE=)yQQnz z-j5>&z3nsmuoGkXb$e*-*Vkaux>j|%!!NS9<^3YT zTb=C!?)SmiRelo+N8Hueb~DeeXIGRMU-i4-V+8_`_jp^ccb42Anz&eUL9!MAIicJn z$=@m71D#jMxC{H?*j;vGpeK>&$z(FZunp5mn7OE5Qd#|T*h4cO26hTL9~cLlS+CQd zTr%EuAB5YC^%pw@hye)WHO|xOH&hN9v+V;)zT2d&##8VsB2&_U*YbAuO62Pu^(ztb z%Y}pYFBf=y?-$(Gy07>}(MYWDY3`5DnUm8gLE-`tyF@P^eI*R!nA`67iJpc;2g}Wi zF_KB}t-HyEp5Oc4FU+{#%*SpOcerDy6Xy9$k^OX<*x26njpkbO2JSTHZs#+SS)#Y8 zy2Dsi7AM4|h0OW zUI>#)D7NS0g~wH_QmV3$lckJVS!baXhF|!|iD=gha$2(cF*qJx;jg`;XxB^N+f`UJ${Ub$gVF zKu#gN{K#Z>PHlY}iuFVAHqEG9R~LFQOKCe4`Imjjm}m5yBjM&!w7N)>bs3eLjWUB* zG+qo_?h0*!#dFS8_d`NfJ?4$jwH9KqjljD=`mp;P^kUbx;8WjI7C?f#xg>S(*42QOB%XC@-0u?Ld@%u z0w+QHqYok5^j?PG=%p=jS3!Z|A3B9LE9QLdHyy78ue-8qT^bLamcWwN15uTFUV#pl_yXtwPdAB;DF9sqI?Jeqy&ph4Sp4U%& zSv`HdX*ge9Rkgp{vXQTgFnm~cH9Fl;EwM8fu`uLhDmF0=c)?=M=8lkgP*z=0iOtAB zC@?X}uWU{boT$07W=ymUx+Uh0!F_l?2I$KL-b9Z+mwd;d1dDs|GKg1pKeX4^pIT3k z(-u#{=NL@UhoIBTPLs)ao)Td_A94u^$;rj(n8gFj@9JuK#Wf$d@)88g7i3vpKKP?2 zci3r;jmlW zddbjaZNt-OM_2+9k^=>t>JWh%P=S5^C9^wY(M{%R2k-Z5(*YBqb<{vmsQLWw|XtgQw!lqgw#GveEkw3r3?-=TcG`%sdUt6 zu|ofB@pKXvr(p9I%53H76ma@*LBN!GfJQ|?pRbj1E~7`pFB1XSQN1z?M;vu2dEW2} zod&X+UvMXwgtSH*D5liZp!~4;y&!LSD>4b$FqC01X`+$A30kU=kMBX8}iy3usQll z-PgOa^KB?tXl{%UT<*25L~GGj@jc&7VR{d zsGC2ytOEH!Up0-<6f7P?oi~lqt><1|c?ev2K%u|}ql5?LC=VId^XwC`30J6yf{Qz3 zGf}G)tu&B;d@*~O<@z!bzMP3R6Jpt!YZ=06gW}c-CvN>zwV{S0vMC=y_QH^@2AJC9btNB_eR0@E`wdCI1&j>*dY;tcKH0Hn z1X7pTaq2*H+~`c7FAY0AwdH%VYgK_k*ZFfETcBzJh-(B5EYs)Ml=5@(df%3Fg$c3& z<>HH_B?RYu-49qGcjJ@1lRr85Rmmb+1z!N*!;N(#X5#ctGZsxb@@iOkFwJ^NH;ii2Fi`$Z0;c>Iz2d)vNn8P01FXQa$qx`RB zB^M4i%h%*7OUb&SXtaD7Q&x~Lc3R`MW{HVq22%>V(55L7*-+!l2RKnJ2#;a=+McPrRbX*Te&E?o*ea0xf$YairCG(OCVm>fXWwP97Zfw(R3?w z)c#!kaj-~avtfTY+ah*@Wc zhu*$g(rKVZf6j#{^E5E6X?=QaOEa&s z5d-RvW}LcqRLu}A4fC+%R~O8L#7j{AtTfm_6R#ke>Hq!{7WAIluBee7I)Y=>bty0b zcF1=erSva#VeUw@Sqc?FBDvob%8Kpjue1@r!*R$-K&sJEQWX^|YZ=6*X+cFn2eLCp z1#kZ0{L_2$Uq2epU^`LWAm+=M)f_Ja4KWX2(}J4o@a0 z*)I=A-PfbBTZ8-G`49~qLt(0CpYTy98MZ}mb&SF@yArcK?Y|GarH5`0j^OG4+h3u0 z+{I&Xu`6&LBUI6^t}Y~NUQ+*UkHz{XA>I+7w@#h={DpmK-C?m%o2O;veZvxB3Qp~O zyKiyO_KgF5Lm_2w_>GgwonxxIdP|1Bk>2;M5O$3qo)U(#7}+BO{nr9ODUE&eNaF{C zmHe$Rn1_46`CfFRcNLRC%#ia33f!768&2ehFRVH!(bZFL4gi1?3BXxPFQ{LPKZG^v zSdOHIpS{Zw33RA~62wm9t@)^3f#u0c?iz|-DK-EFs0dlr$)f5DLE0UrmA!I^;qE5x zVyEg=$IX_|6)L(ZBZS#aT}(S)Fdep_kF_82dc?f-a2O1;3R-CpX$=Xfyv0hmk7T5 z-tZ#}Z7gNuF%<$5Lia|vQaekp5esc}aIm<=M;UqoB)}px#lphyeGlPpZucXaTB=!6K9I z#i(%i45lS=-B%U-;Mg)?gFW}>wDx$$v|g%$(Ggq-Xp>ajT>g{D{p%H^z4*9s34?Ox z!7@7^II&6rd-)fpmj@o`FxF*RREP_}(1C^~Bx-+c(w|FG$Bo#3ywd#^yyl zWu|VKNF}9IMG0o?(*4qes?;<*2}6A z;A)iBHG--`B-A)&^M5s>V5_nzC#ZhQYPbE4sYxP4k3Y0eTS5{z^I0q4pc#5LStFN% z4`$oNMG4ntx@-fxmPmUZv}3TnjQ6S zycOCB*aH9m$M%& zJ|M+pHwB%XypKYP$!#emfI%YYZE`C9WxPbBE9iiA+IGpA<$Ez-VzVbXoa=UeRi=|u z`%uWPuG+THVFjO%P-9QGPgX=F>EJoB-o z1O(y_i}zPxZ>Tf;e3UYjGh33w`Pp{FY8F_xQk{|YAu<5fx)WbNXr^35-xZHHlq%l5 zN`m1_K{1q;)_zHaUEv`p=*Lew)y z&VYyu85#__L8<{3`eG}I5!_$`z2l0(;n7b%I@kdlQe>F_pd7&wfGcfO|Dmlf0yP@d zhfd((yQiGFyh`IcDY~n-YqltzxSaL@*S@ zd)oHU7?+u8#?3})BJ9GH1u7oe%Fnm%%NT2nh18p2nvE~ti1lfi`f_WpowrhRy5H4gXBgl-i$$_MqIS%$J=uF^!_!4L%4JR zQYhhgjMUOsGMGz7SRqRs>;tC%wI8>_Yy1j0*P-o<83v|}jym2Ary&cD{MS;hpVOWq zaV&-^AH59=`v?pEfGP<`>0sS8LJO7P90^t>^gRn@GP;6UYi7nQYWGHzVx72Q9(iCG zIj;ch4E1I|A8})04C?fG!FC#!7&TPN68Tu~uY<#=gkgcRk1Qa7CVa+T%s zORG@zd;&o_3;4{fU~7yd?l&wkIy7+(7P zW}5>{G?gW;7D7=h>eV0BTVNgM1)-df86%0w?KsQ%(Pk~Rl;k|_4g$uCOmjOMVJlgB ziGHe_**M|D3Q1){-r++&d%1S0@7w23}x$NId!3RGa|C$&GzfOW4n)#*{r+|>o zduLZyDahYgI|aGHF&6vgqI#kNfUn8a+@gQ|xIU|w3D&jDtj2tCb2O3OzzTGUhCGgna%V?;Rg%{6KcDLH$bItPDh)d0&Yt%Wd^y6eQMfBQS{F4 zoMrfa@r$9vwWUgQTwRC15)B=@wpfjF+7QKY`)G#1BFYLp2g4UbDC#*sb79nZQsT2y zVp^-U3kU>4%STNJ1YNMwwC)F)M@2Q1N#QP3l=XjvZXVzP>eYN2Hgp$8o53*!VZ$4b z?`oLjv|Pk}Y4;^G44)J{7~y2-zkv1(r-$OQGQz1?ZJ0taeF&4JCTKnhBo*e@;p{^- z(G*;j(Zj|6(1>W2wMd|4u(KBRIQgok;;tZ#i-%`vSRZFd8CZXSS3U`F!0+ms=fDdb zlydlm-x;hJ1V{L55fG_uy-XX0PjnJw5E0)eR)jw)f-)UOcWzGJ{ z3?y^Be#OfeRcph(XQ9VjXIG;=s*<|bM|aGYwsk*MFAUBHkr$eU#Kdr7h%o~YCMcV+4*q-fv|5Ys- zQgP;JA{G^^H79EcnNWNv$ovoy!dnNCAbC&QA}0i%jz@} z?hXJQ{6JMG+Q!q4msk6>>}RHvN5xmzmT5&2)0=J!M`6VY-9KNjp}o9vIrvbW@%LdY zVEU;{a0t@_R`!D%|lR^`)9dhlu>( zRyFy$L#K3z!mQ(c!F;iaIoe}zX}qUr1Z5iSRPHD1$o*$E8ezd zA%~1OkdXr$)pXcEyl0*ang!p`yB{RkNj+aMR6Y9;cP?17nona4?9(8mQQ*T;=D=V#FpypxxGgmTQYy){5GL0&Q%#C)r@N@I4t`973>2Em6)_emQ>jt&OfSLqMzJ(mCZW8Z?S~~h;*SrzL89DL{ z@vkg-o>4Npj!a;*AH8y_JbwZ8G19e=lT`e}hj87WOyC0b<)UIfm2!3Fs2WE_WlNX^ z$Z$lSpDTMxJfiWiAY3YI&2-wZSCl)nq&FvNmW&Xh*s9OhupT`$zP+2vMWCt)XW5r| z`8`k%s&~_gD^fu#Z@`j!{SyeI(~%e|K4cHUp@Qo$!2}K)3u{Y9g~)2R4>T%itcug9 zDBIBRKi<5@{)o%GZwLLTz}PgzFC1waxur6LDprKc{Vr%*!Z*9w9eq>U$q?~lu(V=) zR%ZfO+w*z<_5lSp$nJqoEeevlzda+iL-;Gs4rlj&zcCaa6x_8Yvv>M_oE+9m)V#7n z)X54PgD!J+2x$ML6DyjZX~fjKQD_U3cV)`{S>e*D5d0_jJ&<#_he(>6e6p7asGkZ0=z#$e?mB=*JPln{SR+K{xI zoP2&u4ZLVz&y`h@B!wBy&JInqcB`W|e%A6Oo~y24gzq0IqlpUgQ5_F6fmQxGc)cyi za3$c}Mz>y{o5}8w4Ov&|DJDS z`bQX4gkUrsV7w85kJx1-FvvgU-b&i#-^tO*pV{ak6RjRpBT_KHd!zXfaQ7q z1(+>wTkD;6q6oP7Q>Wrc9J@p9#BO48E|Bd2_nkjJE8#n*D${?dTQaQIDuk&Yvg{hX z`oJ6FMLPfUOO*~_JT~|NuySkK)2t>!YCsp3p+|uwK|$!0yvJoUr9}kK!>5F9CRo(A z5Tt61u&}ZTdn^>dfU`G4XkKvy1`A=@-5Vp!DnULYR1O}r+LV!@Tzxt*EuRcn&xal~ zv)Ll+%9Xeo(td1vNv6V|=L<7X?!BOe$S=#1dH-<_d$i(dcSbl)IT01Hh7Tm~-Z3tl z(N@r*@dfL*n5B$GgLvs@B6c$ejsG}>)fSw&3u<2GY>8#5tQx&Wm<40Fx)29bU!eFI zSm~u-vn$Sv75(VbDR#}b`K8nBEBt_uZ4u6TBag7r=Je>mddo^ho0XD9`kr^3IScaR zez}A$(?~y`*$tp^`ovo-#a&I8eVFYcTCKX^yCHZa)r_n&u@ZVxx{`Vu1QOtgZue)B zQy4~xVf^A~^lnTZanEkQcXX7&bXzs9>~Ea>=oe>agyDT*z;waL#N?f7^+&m3QxK=f zh75@7rj}c(sIZdQ6W-r3C-TuUhWz10#3o27bs( zOhgivUx}Df%*fm7VI`|4w$i~*5T^$GK^Y;eCUcnNE$tX7=C7hU**%F~YdHpcP*N4c zk}~Q<2{LTwBgY+Gn)*+)3X`Hjk(xCQE%IkjzARrf7k6{%x=sVX5Wnlbr#HAFo%iK$9spDHztC5pu$ zR}7x3m2s@8Xb|vdz12wb9~(bdIG-X-D10hPGS)8pHe4WzoR-|Ysxip!XkGzLD`&;> zMTRZ%=ZQqAO{y+9;R5B}HRgKD*_ZX1@T-xzDS`3#`Y=9O2klTGeK+IHVS`Gw_~Tk0 zF+c7F>!C=ZM9y+hnl3T&ME#_^;7#qB!@4PTH(Rk))hP=GgsG3g# z_o7|BzZ+dd;(uK=r0Axl!#1G?u0+i%9Cg0t?)IE~M<2AR`~)q4?}#^2U^dWT@JQ)< zcaw;tsX!gm$Rj#aT$MSxG#+_th>zQJQY!HIVqh=~F~6!1BJ=oq8o6U5mkHqp`AcIv zvFLN4xox?KkCVX9;UCJW2H#>rtZQ9r*EjFkXqXtqrNyCG*{YS+CSljSyZ->oH2!Uw z3Ib}49GE9c&-M0fXV|(cD9TY)cma|n2~SE$SMI}BlgdSlmUggSM52i4$+;eQx*eXz zqAVWavx604wPoaadcMve%896!4&l#cyh3KWb8$zq+k{!z=AcdWnUr{LsuZG|P4&^f zX$D;yg#nM;Jod%$-j~{$yY%Ar*wBU!ir~m+X%mLNl+BbZzi;gXS)WLrraCfGy+T|2 z9iMiyec#(k*+42ay;y8C^DeV!8Qhp)p-@ZEPkBk%Eyps*q7#rEYX#h|YSW;J z@wPatYu@(~rTukhYg)joo(9t_Qnirts}Py-<-DRdjMw0uE)D8^;#7WzKk#$kUL`Er zJiS|-!P#^<{ClYaw8dvBip#OterNniw3x;4TOP#49i?_{5A;vRY(l+N8IdYPD%w}K zPkZB(@QzkND_0r$7b}AnGp@*_fHD{0Amzs4^(lx*E{p5NX?Gyv~7^7^Cne< z-N-@4tAoI6L&_HoEGerDPL``3*!8!zgwxJ^uf51cpB=oKBPlk!!v@TOw}Ty+1Gf(0 z{dwVazemR=q!Ckukn)}*aP&z~kh(UjrF*dCCYjyKmXOLu-s2B#*2dqL^`;lQk#>us zf)15tRiX(sW28CsBv@G-Gx5-WTI>%+U=3jF}RwMZ7gq5s0L% zBiO=VQk(ii@|flptcZK|BeMRpVKNfjEWZjey2k1sB? z%?A>o`YjbntdN%sc+mlFC6ty=2aih*P5hy9`#b~`fs~dvY~PNd~~nbN4w6@qAn(aVgA@Q+F}ZFI&x8ZUL4(6&<~jD2^kLa zbfkx<{CH4WXYB1(ykY9~zkqOsx4ScQuqCMfB}NRkr<{rxyJu*bUd5}XuE?f&{#Q$8 z$%$pR)j)%+Ji5M66Qm}cqkSp6tmP7&{*dq1wt*DnF>hN|uW~l@W{oy2fRi8qoP>(s zs3X~GBwsn2$SVvQ)lNOaI#T3=Y!Xg{HT ze?fMOOYfa>T^plH;Mu*nuM!&o zarFtFf}c9E-$Z%ZWg%lHLBEZHy)8em)sQQtM}hENCimn)>Cre=2fb0+h&5fX+a+)^ zO%Se{B=OupI{E`p2QmzCSyGgpVJ*c~8xK0zuu`&>2}6Ki;JqJN(4RAeYzWsxhowZ2 z!!sZ1SqKX|f0XM3|5EyalD&F&F;LP(n8K9X+C!KgcPIr zJKzV7gAON3<^bfbKmG@H!aFH*AGrc015@`?%A)5WU%s*H@0r@^kwL?)xNLKqy8Hx2 zPggX`f(9_c*Pj}tGQ8rqkBeIB>OeligtleQi>Dl=`<|+eyW zD+u*6S3pY{;W+8o#q+^4P_*WF>oEwUmRQ)>1zlf-#(NJ(i={f>nOjO<7vOc4B^Py| zfn9d7c0fYJ;-K}wfvuzv7PRAaiAP?*Fyx~hN!YJ7nBpa%(q33l_jDAqA&b`sps#V> zYHljvaD(+C4-O=*T(6Bx9N`l4drH6+qMB=yMPUEPQE}x3-Qd3wid9n_HKeGi0 zkV#tEu!e$VV%>%x2FqCxoXp;)`x`{;c?JoT3r0W)B9Bs`TWi2GaPmC~5+8j}anEel zcp4*P!L4spKy0g6NO!zA_`7A*_jN@_TlcfrD<0t;8;8_2 zW;mu>Z_^O401ZD&LKj|(5V;y*$BQJ9Lzdm|l9n}e&a2g>e=&_u?e!JJ>skLxb3>8+ zZM-0biqU|c>2Nh6)m@;8AKMIGWy6^Vb?ebcROSiM;I&+55+AkVr(}8a`>J8yQTkbx zyD@;Ii6e@qA@-NWZ;XP8k!kWW*7vCb7Pytp{RaT|nqQP#<-LCSl~%~3(Z?=g)n~Zk zg|@bB#H7OF2Tt9wsNgP-&QB6!y)=AmctxxidU9IueH9{ib$bl0p)YsRp0Fjo65H+60Yke+rBGlgG|Kj25L0b%1w}%duDhiccJ~mC)40H{He) z+of5Zh9FaZ{cX`v$qbY_n}2K6i5Pz41g{Y+Doa&kDoM8ChpcbN1C9wGZXYWr4_5rp zvtYH<(?`8&p}_rizo@}3HrS9h^HWP)zg>h~xx{ zvk4k*h!*~TR<0xhzxJdGWi-)5M<#Apxk9)AEp_3??X)p*8d}7ij@yYZFBN|8XVxAC zf{-(XY0x^$9r0YE8TYJhBt&(v@ydobp~tra71$zkPdu-Xk#cLB@qYJlfOM8&#q;-w zi9eZ1!Vj0F8-f;dIQECiU5s5FA;g<-8y#N|ENLn>r@aXT#f$tz;%Pntz0~thpy1Kn zd0O2*uBy~)rybgU;(%{=|750YD9Z&Di1C|C*tQ0#$ z`kPySXqpA?6&|A;6?tnej))*K)c|#l(*ESqjQ{zN#fN;SR0G|hvF#v@if`7I&>Mpg zPl84V3@5f-SwrZ*=K}KH1uUhlWH8Ff2LTm}jp1-(OsR!?*g!x&ep%z~zRYL1ZnW_Z zs8^Js07IaF&8PcsNKtv6q zsMcHPT8x zY~Ioe&5z@ zysgy>MPXY}9+jUL4u$+MDfEtK3zeGZepwG$>=Osu)eIDv#pG$-Yk=f8+w0-c{rZlx zKx2C&0JhjTW=FS|OaFx@Yw?zfDe0@Mae^Ldp3el4Hw^NrJFZ!ziiH6d6IJc=v@-wI zi_`Scdt8p-!JqUJ?{O#pM)0?~*$OG_Q0Eu5;Qn5bH{Y|Pc3D@Nu^& zJLuwpNj4U-`4TDCy%{{HqB=O>4!uv12wd9x_w|(U>caT|YoPx#B;B8%w$azRZbl^I z_4R1d%G6lD@>x7ODf$pk#K+5!s!}2(o3l|O{MPilROLTgRaN5sn1T)7-g;1N8b{yvT^^Z3(pLLB0h8a@vODVDSetl4XD8tEbuUHP5Drm-L@C+c z=S5ke#6`v;<@OXBTR7Y^LKDl^i*vh~x@A&AKZOkH%v-@`jcmW2(7PKeWZ7N%$~5j! zRVdAZ){fhq{C{X=Cn*0yd&L;{3R)^w>^jywuDsu0Q<6OwiGJXQ>ViX7j=yhy)G~h^ zJTlo-FE#L_Y<4_ZK*mS9>FMsH*NE?D9dVlSg!FCnCfesXg|La#tTdw4A6qQpH=t`7>`n7IWRy_WE+zQKn&!NUj%$<^aiw@54Wb+CR2{snM{& z2WM)8I0L7Ye-)qGFTkYssnRe>*K!SriDq=@aiFGYWhG%-rT|V>YWKn*iDjAPV*YAQ%A4I3F_s14!=*+OQzh z@cakwasR_4NmYdV|MtfJvKQXE=Ks%!x9)t>#js7m@A`(Upxq1$|^CnrRot;fX>{(bD9TQ87TfPW<1Ge7Q^dIeDxn}Im_!SWI z)l;>fVn`dAzzv71K*{`D-mXo|)Z2?72iGvOP9o}i9u0{r!e7|(e6$)g|tQ4TPqX!G}(JQN{I z|5FWuTv!VKzqrWdHd^m}*Zw0j>C&e2;PM;VXFY}RuK0!Vf22@D@Sn*i;|K)A-V^!&-QQj=z?_jYn0JWvTCNL-oNBz_AwOdkF4?+?-4Cw%MG z@s>#TJseSt7%r#>E@1PsnD_>Ae%&qOU!?|-Wf=YU&_orGUH&`#RkbeGLXW-Q05XuQ zh4yd%#Xs+4`X9YO690-*|B-MF%KwuKh<2rg1?tslY}j%_+G4Y&5A|xm$Z2VEy+8kD z^MwCIPFRgLodN9`bm7-`+194etmp}a#f4p^l1af`|B^o6-zUW{@(F|fmKLjLtO%2@ z`NdDxugm9$wDc(H|DmWgQNqNrIg|Uel>u_iE1;M3rh%BzwarDI4!1*|!okt=|E{2_vhUg&8~;FdgEY_E=3$<89xl}Gaa^Gkdtz^2#d=K^s+O1j@fGS2$tSofA%tg<2w+k7FKl`VYtNm@V; z^CytWXJau!(VZlQT-vM~FNyDB^wPHg_@S{Zlg)3}bE;S;It*a(TLS4~rb)(X{Lh{r zY2q_Ox=YLTOl2allDT}aW!h_jIkhskd|c(Io^fK3Y*bV;YHyM}!6TB;}@8?zTo`HoK# znb2LdtWP9g+ zVL8*6Ji}U;0@)nzL#zN^|Ly9x5LqU5&$uA6t#8sQI(IdSE{=Oj`52 z$SF06J`I%5_JzkT+F*ice2{~zLMnNlLujfOMLt=$Hh)0KWnu$wIE!RS+?bA~l&GB3 zhX~IK;=0WW$_h-1vgum6ZCh0)YYkRiL9-(v#Z_YIZL+zrG(rKV6E)Il$|1_~Fa}42 zHhLw3H!Uh_o@W-(eJ&?>Yq3D()d2>{C86%xkgM#g@v$SWGfbrPHHXXY2r1t|CU~sEt(UXVG2nlQXt8z zsm*eJ&N9@NuD4Q8@2PAV*tj0bVw?M^m=d#)k=U)>j$OoNs+dBFe|9-4`IMOCCRL(* zwR2Olfnd7vWq)|9ojhNjO0L5D>DPN z>XR^DiGBQ#uvy5pnbz^u)J4wk&1K=TtU_At#6M~?kDNT!!rC#a&m1ugJ8yE*$0# zvKdWKm<5qJvdAJ75$Yh#Y-xz2ZFr;cMxoy}X%ljUYc?ahc%W)t-+x!o=zNh8^RT?s zlsa|o-#uUZnlk$OTtDw!6tXdA2MZO?*0zv;C4z`{L`I{0GoM{U>Fh*J?Q z>fKeLT6a9P0twz|$g!W~r7!=uV0Z|ivlvMNQEQVGMvQdE@$wv{D9eG}ti zOFj;SaE=}V5J&~f5<)3~@**++d7pn`63FmjrSV?syYu10kCx_oUZ0%iX_`gvdJeG$rZ&F@jISU^ z)m4#Zm_Y&n2=wscebT08gQwQM`%p>Wg2aql#f)^tgj$8mUA5$VYB@fV-ne2;Qh}l6 zz!VQ^rKl5DASR2cCe@11MM>XpyUX|n$A!%DZi82zBI|ScXM&x!w_9(fFQjlj64ccT z&t53HhCBSs2YYMQxyJ&mD0+ny{qh9gkjQYxU_^K+MW-9 z855Yd`|NoB<)lL90AU)wV{C=~CcLsbkj(UCDB;0-`6Vx0Wwut;earvVG$<7rHotJ$5bqup{ zUy?gITKs`pHLoJ))vtnZO^y?t*ugNT{R;GKYG)6mcWj4sKM!9jJn}J!{FgON*Wrbs zoDF(W^^!H6v&)UNxCBpCW=IS}&G&NVRnjAoAuFK&dj&XucLhCwk5jv72prkX7ri3| zpbzFCs^Fh8U&!mR*supK&4+iVF50-@OrhA(E6uke?B05U|IiTmM{7YL{Pr_f+l%6fP>tU_E$(9fj&~gLN-mm&)rt`4^IPh+D6(d2qzc# z`@eK3iJOCDXDMfdiBltE-BSQ+=%KaFo8T!Fh#c6zK-Tv{fWk!LoSgV6sNx6}N= zv}i);moLKA;QdR=U;pBpG%dG+$x3Quv^&0TB~)MC)%tbn^nd+4U8zuk1L3-;oQ^Ks|}RX+k)nZE%(k z^TaH?HgU`ZK-Amwv&EU9V@rChSHDkEqZje?~ za|0TtwW5_~fZLIkfARU)($v}@oADuiA;_t(;NCBexB)U>#CPP|7*z1BvWJrLT_dK4&JWM*_5hfdu# z{Fq$SXz;DrH|x*x7tFDJ_9!h3u-P@tF$>T9DBSlv&jjQjCbt<5bo>M_d6n0+PFjlF zYYrQX?=M%tH32S)Z5PSgyb9g54)G7_Piw#}wonT6u|i8T zZQpOws|ZAM*3ZN-UVbS{A+FcIL%~Eog!N#{`yC6S05Fjbjyf2PV{IK)I=Y=E&e5bZB+#v#-ZgwE{-@n(lLere@o~|ZD zR?3k@&#CyjPdg97-@9R(ZIs$AAp;Z)v`GB|-w2GFztq%6&>U5~Prdz+F!g%unq+Oj zO#-xIocK+4rIK{HPct)Jv<7`GE?v|hs5@6F1iqBi0DWtVkd&ITGFI=oe@et7itrF%3IswJ7Tr=u?#?=02KDb)V%Sdd0HT`24hP4uqHAEkD;3-Qh#b@>Vb{Ca-Ar=1 z6lNKB#-k%GA{+T@`|ZON?iop(lO^p}Z-1+k_yht&9QE%%|p{!FkxIeB!;~h@46HXs&k_}r_8RLga zt&*CfFH3gt_sXA_1mFfuAzQS=0K9f@87`<4vzKNN$u8mPT)`zmHv6f_ zXjH6sLT5q@z4fw(@aE7+$@uIu^z%s}P1<{tItTfLp?70*+!89XMu@Yf0Pi~Kd}alb zcT}sXx#QgCMjGjSirJzFrLg(a)l%(VJv_`AOSY1SiF4x&J1Y3COj}jIGLjNAOOs;x zQT67}y(!{T23=tw*Qu9vG2ARyl z4zD_yv9-l?Wfl2kCvp+pj*@PETaqiWUO~?&wrtw%(h=8n zQkpNZi9`0^%I9i!Bnk2l76b?sMQ7`03$xtCU0XuQyhJMoaEZ2OI@C<~<2>WfLId$& zRh)0Mwp*x;FP<^=R{;t9T1*v}s@|)CIgx3Pbg9ki_-_GbF~6 z@QWc0KK;D<#)$7R7+DT$m9nu~wkigZ>XX?VB}F5Wizdrc6E2b7I2rBqQ%hm5mAK8# z!NnkZx2@m9 z{~km}Z-gAyo>cUFrFNC(^~Er(NqJW(;uigd;)(ss!Y%jD@!ZF~OOa*?m0VwQQlW_G z!po9r1675Z86T$nVkkvW*-R@2CKQRPD>bNcJ7q-L=a z^V!UiR?$ms1_-B0en-CGM+BF7tkKZ5D(&=ir8qdESCa3>D0&aZx>$$u?xBQ#q15(tOXIY(_6Ar&&I|IBrQXbf%A$ zWgLX+-A0OdG)TNEsC6}4O65#Ei*y=N4L6f-cQ3MF(NB#*C2`Y!UEXP>>)>WLrTIkU z3=MHSE0aovpB}PhgJY)Y*a=vuVn2hnpmOQVQxuiGmUjr6zq2T|N7G(rPZo)4J50}fi6#b%fco!HP_@+m5#)A1p-4Ym{pgDQadV3%JU?(o`l2$SIE><(*+xz8gS)cxcRt>PVNJH zQa6~kMA5gNyDo$l6!lufm^c#@UbWyt2L`oxnyBAA zew~{tn&f$XV}R&Jin9-b7WLhiJ;E&8BSJZCP?W6ZS*PZxgejLuOb&kHk{*qGB-qjS zMoBw=Brm=xMq-fSj=k4A_&tN~j>1^VG`lH-X-L&C5GECrS5OTYBEA4H`huIGVu8mA z;%t})B$0kwh+krN?ZrPf->7HFg^SXE-L(_Gs}Mc*z=#D#h-)6jSTaiBIDXajQ@>?P zNotfC@qtk5i`Bl{ zvxDJhXdTN#T4pGW_`BBK@m-v4NRdLi5C2EA!Rq)Wzj(1j&4^u7SS^Xj%<+gkO^o0n zuO$}d9gf_nxF6P?+nuv&OM*&Fs{6xP@mUEgU;fxZJu9kT~=SP zUYn$llUtN68r~<&>GqoyP&AsN`+iA0avjn5a93m9{V<_^&zG6MQ!@0+h7a|lZprK6DmPLI zM`gU7zC-BEn()`zG2T#qK(--=1GmQh_7CItcPNTx zg*WroaVPa%FGIo{gkG9QBZ9c3^={MX`SqVhbYTXdayML$NEj`(ND(HvC^O?HZ)QqN zALrLP`HoP96M^w#wgGdT?&MxD^T`*QCK&4Nh(4KWB$bx5&)%8TJ8mjmYX@*NI@A}e za5N}`Y^Nq`fqSD!b>rab{OXlh$El0ac#qW>J8_(0c1aH?U+M;N5G!msXbl~e0r!21 z+C^vRXzF_>-Y34+IOBar%B1fP$0_I7%k(8Yq~kt~$=Yj}{N}Fr1yUgDrIJ=(>Uv26 z`}{ah$y-k^Q4PCgx_am_vMY+O+tO#EluQV$wY)sd>JRn|lGU+Qi?NRhS+-U?kh@Us56Or>+RY;N@Wd7-&@CUM@%q%lOiqhMA9 zG}Jm1V_wI(E62((veRym!UatQ3$KzCux~UWc=Ap-s6Y`O9 z6ci6GYw0la_GiIOF>dh&xQR?I^W{P-YU8;UL&CyQzo$eqHjNn@PV}wHXoGh#NdPM3 z-_>>#lp$ng=c_$%C(BWdIJ`BE+S(Wur3t{$S_OJf+_dst)e||%?s!?P2w#cEs!*H< zL`xC%b}@5kS}Qa3>FM&aTv2e&$3Ac~=Cp$AOzO2l7fxKp+&a(pco<;SK|0~bR9H#v z7$!n!m@+|e>!ldQq$zf+YT7f=P!iK1;V-_2>5U6wbhI8CV_I}X3zDFrRx?qX)vv$~ zSowC11foXEbYqwVN<{0mp!2TW$1^{s@-Wpu);@Uj537BlLp!j6BtZXXlD}!V?sTWf z2Z9CemdV-0kD%!Q7r_YgJPFd6N-xg^v>SamO34j2t@=e(W z2j~;96S&!oYz0s@E#*{L>w%fz@I<;wh7XciVk5hfNOF$m@ykmbp4o^;RO2GlB3C@P z@4WoggoD1Q+XZlkmT+%yP#g`OXE)!SW`Cd-M#TG3nkR@`rvwU_p(I`-pYD^l`cYb` zeALRiv(s~TgQPEyc|_uI;3AEN2DSfWiID?2Xwf21oUVtGBZ96Ol)sq`bVs39bw!g* zH3GYt3zJb4Fn-5xOPq6+D9I9MZl%iHKe#$@iRqQ<{cVY+Om4^;rs;6VeFe@VI zBhDPO3hU$=qbZZ0W)gi@4!2MqVv;W}JT75VWVOg}*fudtnMtCm=oQks?PNc}1@?+o zpe{N);?Ny69zQj}l`WGxDwg-Dq@pn5n;TM|_YecoSe<@M#kwgEd~3AJRns}-FPR=n8S9i` z*BE{7rm$KGf3gCKkt`64wPGJ?U5*&%ien;r{@)Y}x6dCZ;_sI@2D17*I$nBfIw*OxUEW<}C8&vmEWCxui z(Gi++ao{KLNSt0tcn7vo`BigosQ83fBT+F5e?Q60Pg=?lTrd#J7E_8!?|0p~2`@Kf zQuBv2*3m#kz!Y^G6EJ0o#u}n&i0k-SW-1Cl{+dhVPzyNIL2rqPCzzSXFHQNrK-Rwv*q5~U)=aEj@

iBi(Tq zA+i5P?>!-kI$P%v4A^0pjLdG1l#loxm{=C1``TGJOs(j7nbwWMDR?UR*TvAn$nrKl zHsTcUZT5u!_E95yJkzmX_+#67qqc2 z)FKwq4wiybb+{5|5~O}R;-Xs7(k>!I3c`<{U^g$ao_9;wX$u>~Df%WCz285~dW#9p zO;-dd;@2KxDU;LTcg*RPJiIS*MOSm=<|rrquD{S2S_BO2PmoZsWyQy19}?%vH2llJDDtmmR-8qh*+4FIL(f8XD-ASme^_&CAoIEM0cE~^b8^}K?D4tEJ0I8!h z2u*cuFK7tNoX3XsB_yZ`?ktu_ziv2as}W<1kb>XBT$r%qfIOF;x9}n4q`M+C#h1bP z25tbVh>c76BM~FQ%}*U3?awX9VeWO81&aDMu-<3Z0ePYcGn9I)#i`1>T==+7p7}mI zl9x+y*AI0lMvma6w;tk?>yl;wTYfkv(RR5H#0u1yZ6;08tQwvIXXd8^>gSv|(h(h; z9lMN=eo1Wttl!a@u$x=#W#xEKH8+P%t|$ebo_^Usq75iIbw|^6K`8^ePfV*7(I1tF zX+3>HL-!6Y*j@R`E>S95aI?Qp^}}_RMtPn#UY)hs-J;HDrH!?a^(B023TaZ0Kiulc z%Yn5*P;J`Mfz>OZJTPj~=n+|Gmwp165_DQGQ&~qSC^5@3!+s*_?Ctl5##}gQTS>VM z*(8i#XhJC}xZx9#9El*{i?8PZ%CWXzbcynA8rf>rKzbjXQ)$u;xglR$du$6q*J&Bt z?Qz`0qm->R352eQw9K(u_9P$JstS#7a^v!b4dmNq9G)RQQX!h4biFnlYz;-QoF;WW zMg_(^bh(Nz$58KRQtwd5KKRrcQeAb8Atg%9$Kud z-4WMx)6Sor)bY6ls}z>%R#Ys3z!j^37Pt*LrN$_hEBOaNQlu13aHN!`{p4~6`BkyD z8^P@>r zUJ_&+G`&APC(w;x!VeVYq^lX?X$aV+*%p%OrLe2gqM5?44wCeNZPIlUic6TSP9Uh=rzFXHA zYk3Ata7lZ8(AS>30AJUB@O*q0Se{RiExD?85uUTZNnLjgw#8Gw)7Ok`ZxG=_8tkbU zqBeVIxp@e?fC!sDs-y@DwXF3=!d#Y-xlWyoz^$i^c0O-ytD=eC;wo+b!Yui&g#Jd@ z4aH@Bn6hio=~KcGwJV^iRk5Quvd)vRR+_qECILL(WeZ%(UxiIzrx{>cKk`wUtr#vI zJsO_6M2NqeYA+07(Y4LJmMI&T3)4s3>v2U|?Mn4yZVpaq8&^k1h=ps5-ygI{qcX19 z++OLNgRqzr5~(UO5;fPh63#$9pMxwx`PqH>t$dUfH5yA|-kl|$nL%E66=JfWV^Gh< zu#tZEhs&jlu=_emAhovu)FFFm1>yTNok$Q;l~0TICn9X5zeT9gG^|tA*hA@LE=>ER zES+*k%mg)^AvPOMt%6)|SLcq6^OxcgXC>D-MfIClS3x-J&;OLhASE#5*pRQQ|N$^6xL73Wzr=wGmhFQ=AHxUs=`?hRP+=LywoOsIV zl;!p@Ei7^|6^$L6xpd~lNyD?^Rp{NtTWq(T;>3IFo>g28CgFU2vgZ0>tn@zx`GM`q z%0=9oZZ64BJ8g2BIdl_5W=&{{WuK&8L<|)7F599nMe_(|FXoR_tqBz#@Dj(1U#Oy>+vaCFQsYVsc<|>{QXXF+GR8mBo53lu@h;DF0%m;L>J8UT{ntcR2J`q#h zl(ZWZj}Vp7N~MV>aeA>M(4z`kQL@;;G&>_`e=VcMm`N?O;d-1jHxo!N`qcJ9=TKXp zRaAxOh+xdZra1|o^EI}hPEEsE$KI_%Y4AIZRGpch@7}n`1`P)~X<IkZiZy22;y0Q8pz;(GK_4)KwHhy-dC)=vA3c_`vku3B$T5;D&3ztT*Vidz{jqWD2c`2#}gkM)TyB~9=W-Z38xdhy=z00bpLGog> zWTPyZH4j{z3J(NpLfEq;T=Qkr%l5AdGM_}@n)d#do!Ttci3>|91}>JbOsgEtF%|9{ z9U*7`mAI^#sfNe08(U#icIu{L=CfqE5)KdTI6NAbwD)USl!@+UY-hAi^qE?IGHS?c z%Kv)aWK!2Uu4GZpZ7%=3)3;MdNiU?Kf`D@1!GL+4sWUnIOp3ggroSYmu7*ZHe2r#!4EAio>^UM&;f+&_WKPShe-HV1=d$6C zFsuy-)t&Yq`p%|hCDWRvzMpJ4m9-yKW?2i1D1=mOvy-1-;^$d9cP7^+U9}|0CZ^Q= zUKX1wgCBr}lp^i5L2h9PW%^7dQkM#3!1`KYuutvU;USd*8P}sWIG4?e-N}MhHgiZ+ zLI(A5dtBVWzUG;zx(mDze%fxucnzT}l#&N%1P$d7E6>bj1BP_fl>F%S@C$VX#YO+- zYwq)%WD`afs6Fz2ULYlI+FjeGb-U)D7S@4%Q-u*&b&`7vr1*71-+uFQ~|1O_h@D^HxyWLO;jNLE$%A! zJ{u=R;=uXr<#R5ERVKRX6Ux2cA%1C6uBfZkNmdH!oGoHyI?N_fkAWR1BrO%0*9%7? z2rtONl4B-4#81Il5wRVL10#$$af8IbA6d}qZ})^wln=KK;Md!Euk}UW&>~ZkZ^^vh z+%B8LLMgb;fG<<7WlLU%dHX78LJ>0V^wQ4ZnyU^}Rub05YsF5S&F!qFK_wq7{K8K% zdr>tatY=}>+Z1cJ(CoI6a9JWI;gU{p@A-Ot!|7>S&1N2D)JQNS9ad%f^yX7=3kCMj zDnU=bb%GEdv7}HbXluW-aL2?`q^C>5rQ?Kw_$Dt{9)hG-bD|_MckMnE1<)^NKFG`? zwN4Yi@fGr?=@8i>=S;P>sZx9u8DORJZFUC;fws(eMjb+lpt+;YSvOz+e<9U@^NL+F zdFTC#MEY5BV&_0i#f%ROrrmesn3y&b%B;;D%aC<&sLgJwQ)%H-;Em~MZ-w6*NADqW z+_`8}&`69rOyw$6BfpX0KCN_?SPt3;cC1Dr3;wD22ytBH1D)v^W62`7k6+yN z%uOdyTcPrvAH-*#$r)`3gD*m|Xx^ab&cFdOxXyY{r@WA%v;B)CARCu6zT@RqsHZ5r z-qjx1^^3YcmJ$F*P|3!#d9=%7d=y_fpj zg$@(k>RYSc*c10kt34vT#VTm-TkEds2=_{}E<4EB2Uu3en}*TOhk{Yz@s6i)@pSsY zrWR~>HoDGL{9#*$J!r&J&7imdBZ?wAF)uxWIp8YklPwy;s49zcyunTP>>qCGlhRfH zR@A4MG_o7#>u+q~Efxy{O2ZubV}bX16KwBY|sQHN=V2RaBZ#_uf`k-)7hVE@f- zeaN6k1QXdz5iv2Oq0g5##Oz2nb8NMtj103Xxy3nH?$wd&rng>r{C3a?#$oj@=>oVu zB~Oqh97=r;{e4qwNUIBp9U^{@&kL+gb{;&Y-S|dw{9WfM6o=z?OtKyHc~7dw-de0L z^$^TjY+aICQeHDPO4S0BCIZ2dx}V-yhvjR$Q*d_KBeYyLyc)V~UEfHbzA9J);9!uIKkK|15KBsj z^>)7CCNJHZT`?A6I=1PU|JiXm1k*VlE?O1`mJMXLk+9G_JiT~9KfiyGd8cO3*$I54 zT?fvKPQz3y43N;6^^%Um-bA;J;w&Qg?51VOt){-ovuA;VNUs9y@N9-C(3=M z*NC%LeUT?mMZ^0ytGTBFTLIU%+_kVr#axrC`&n%Y-*RSi=eK<2z_D&Mzlw7kYei;Z zau56RA^YGf(ce&F6sxhTPz|9kFgfnM@B23qAzLzEFM2_kemayWa}c8eyX(!{4$SH0 z^VbVF;wmkJcXZesFKCB9;~DWZ3E6KR3yEN4v%^7Z($P%5so3$ZjvH?_O?ieLZTig> z{!GaYp%8W{1|r6%7z>Zz!ke20x(>t}-}Kq%X&}2lgbNPxEi|C^_N(-knvIelFAP06 zue9*^bpw688rQ7)3RJ?*2M3fG4CbOZl$3A2Ky4h?=p8lhfNwLUU*MN+cREixST+;F zA8il+07jlK?L8PSpez@f2wx{6_!sQeA)R5HBUMnzuRF?=J$nmD=|O*FaQZgje}gKZ zmgZ^uKuUbw;b+FVg}YNLt?Ye$N`?CC&uqdy0GbSb+_>*DvCVJLN+6lOTC>c}CBogD z{Jp7?czq(mvEAdIwT@T3IC8oEXEKYQW@i%gA1xC#X|&Es3Z!3=*G6@MtDATA5Y}%P zW;z`kSoB{mMeeWT29qBj)E1n#S$wPXM4^ocEhNYEM!~FwrlymE@12ouEddd7{I77j z9=xbxvO6TbCZQ;TfB515N(meCF3nZyEq*Kx@;KN;J9U$XNsy5Y$tBqN8pG2R_T zF+3LSF?et2OQ+v+_46GiMt4h6v+F|p-a8&2+>WptCMa0XOgX{@e~@TY_e@25*N7bX=0!(j_t+LD9nK`K zUZIZ^OuG8x3riVadnPX?DgZmkwxShENh`Ddxd2OleJ1X-0g_`An!E)Egkk8v{ysb3 zCw%=V*Lu!o`I00G_J|}nM!R~6!^;eS9HkEqBJ6$2eEDT%jn=-ZD((Kp%Jb4~aqs$I z*LnxG$GQWPDr+@QX{})iA!rL-aMC1mV@f5`_K|zLBOviSs~wNZ?rU$p3)7Cv&<596p9wF^%E)oyFd@Q7Op-iZ_0?7$l39s1k{Q0p2M;CkU zhyA=eyJIWx| zJi~Q(A5+G&a8Ihb;(0&5oK=}l{{YUEt*@Iu-@Uz(A9E>`T6_4xv)cT~#H4Ewvmmju zAj)vrM@oJ^vAZWZn9eIgYsM+A5)9wRBy5X9kqZ};t-^kNb!vUu6z6#x!wiKQ~ zmKssO7Q~z-Tl;wf9jo?b?x&gOTK ztTlt52)#dxAg}@XcFcO*w+1$?bzezg4!>IyWA%6HkfL;jo`E(N)zYeQqT1kW7{aCvbQ% z$~RZ*;xdf>=g|gpQVKXZS)qgf*OWoa`AnRF?Y&1G+fbvy&4<>jQ{ghtW56Br_tqCg z#0)waYY|8fsZ|gp24;6h&^9~e3&+1;=;wJrBk5$ZC6Jwfwla#Bf*zdvVP? zzD|$C8$77{1}(?ITg@au9DK#e&9D)1;d0*v%Xk1Gz&TLevgR9kdL&tP&g|t&2|Uo1 z=_wQ=>|Wzb516}l)GiX%Zn0262?IR91b1mO*$|pv8G))99yfw2FU~oEfGW>H6D;Oi z4YYYji!1Xy$(26J0Fh&yGdn!<_4<*_5R@%|m`u&9aiHNuWYn4$K}84q7oTW=lcQQ; zHSOWpq<{0xr6wbT4Y2Mb*4=#2#dJZb!?s=N%}z2S@N0(4F$&K^_YsGd*Fg+1>>Pc! z0n$p8Nk6Y2?CBeGyKeJGAD@Asv!SE;ldZ6U+94>m`rUp(xUl8nbX~ zCvJ225TpO6BiZU0?eGrlp=&|Q_xl{DU@X}$R1@{HEJ0@)J#Ux_xBY~9dFQrs|JD&< zVpe@QL6b%c!>g-CJ@3&aH-nM_OBz)r@Ce3(|LRLC*DHGInx`O72&O%sH-3lvPiVwF zbO{Z28<%O1=Oa%fy@4uX+KB2_8a$rZh?>36bQ-v%Bb8m~wr| zpiHrVSs&rvfYO(z=ydxJWchuj_1sey*jG|e>`>mWyDG}MEH-Q&*SGdAS3PGaaH2o0 zi~Ba(mZIIup+)*cY;?yRz0{a&205H)-(aF5yxy~(^dv1!8i?Iy^Qu?dL?-X6oj;U5 z?AwS;sAmMt>w3MnPXa=~k6%z)Nn1^O83XM~WST2WTG9*kMqfUMh04n-Q|+|X<4Qr~ zAIk`t4z7Px;Fx@Kqa5zNgJ3y6gu5F#LrP}|oGlOH(X{k!X~1XZbA>(g=0dGQK=_li z#j#O`$!Ia@=HFZRkq1I+Zh|TM`;W*EJw`CM`}D!z{&KCq!3QKDH5fe88@^*W zd|;oPTZ%GTlkMN%TNSWx;M<&=kBQKT%!ph zj~CVr5;^q3pDWdgnEr?kCsI+?+LJCgD?#-2(%>*{e7&iG&-VorG?d`8qCv=@wdhR{-Q<>EUUt+;CsOIV6bN#BUtlejN%W@ zoICYnNA}eSpR$+Z2_E#;{Y3!!qLPrXkKzX@*M!vHI-Tg%K(H9dU~aVjw#WBet)G7L zx1x{`c*B=C8}=MH8O(>CT}&9{#>DC7?-1U!*iyOEC(;7^Z(3?5%sU?OV~Ygdf316K zz-qiRqzh@RKvH_U&DrKeVa33;ya{m8yN2^1>Zi)mNlWz2EkS5$DD8U|35&6RCe@xS z!R_08e7HBedi!j@1VPRN}xYf?X*bcdu3ak6oy_I1DePxImTL15 zQnOo$0b<-1Us-eDm+RM{a9<_hwY9k5lE2iPpF<((&z_C zJxA3$m!hg;zoMc4?pi%Yt-RBIDS!e(m%nC4SL?bVYWF=@hI_wCwB8?DxZL!aFmCu2 z6Vlic@H8&4Nft67vAyUY0-6pcWf^WKS*pS@wC}tNksWVm{rOS zuqNhJqa-SLgAVM~y3LCQOwKx}2Tp~gJ?;>~pO3^xG^()M)jy!9!R|_DhF8h)MMQm< z>%WqV>hhP+&B~UkNQ#edXm9>1BGUJVvl3~ipx%PnX4-oKkdMx-RXBPEs6j&oxa&l| zp|!G{O7QS|eHcqhiwTFRvUwzJz1}5VXnTwXZp4(i*d1fxja9@vhObW~=DV0*i$9Q&y%V`}L6 zB!?f~kg3AP^j=a`7TVqUHM!hszg(bK*}Tht0985NP#uFa18(VFxJtd;nX3^^y7bTd z1||bgH6Z)QgWd6h=R27){G_&oZ(nV;jt6N<0c|)RvsX+WIV^v_h5=OpdHn0sbsjexQF( zVDfQjba>-Z$L*}7xMcG=PQAvM)z0o}0|@|5Qf3N?&MUhmLsP8qZ^qze`Bl2qh|2){ zm~)^Mp!f&8Y0nYwi00WY_2BO*`78Y!UQ2I3%}VEAcsA zZz|jpwensc5^}@L)&nwMw-*)C;+0P1_~t0xtx^0cUw!{M;Ex=k4vfnARo_xi?kfF0 zyJJop=#z9$wRQS8IVCWIqZgR9#WhK2?D zy7wpF!wPTR$}49;R7b3MY!I9Q8~R^38Kp8T=W?BKh>Ld1mNiGMk!Twz4|9I5=~8lt zVwp>suVaLo(p5X|Q|otSUP{#4;cKgt_B@3h0!61AM6g8@ojg8aZVOl_*VuFvJOniNPKo9ZgP52q>V5D4;p&Fr`SRM(rOSe$_>p57!`$ zY1IBI6|z^!t~D{EFGh+X77B9;DMsQc`bacBaaTH?NLnu1!Vkf^^AbQ1b@XYF+<^0% zr`W$2d%Rt;W+kk$-;;G|0|0*kA)r$+s@EXaWz_M&l*-YB;o1CLu1`zowZ-}-9Bf;o z&38<4`>>ek&@VxPkO5osRGw$6ZGWFjL}5Ok*ZtO%FQ>8+dBaAX*|>wnW^?_k!VFsa zK-IGS{vCAfjp=$hvC%qlOfc6@DFU$gXagpYbN0c!%x;JIpCx8)Bp-r(j@Dps8-_{S kNxnu5nOqQn-9A0Pf!+eQd`jjR-$DK)L}Z1_1%LYfFFCe+YybcN literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-all-devices-report.png new file mode 100644 index 0000000000000000000000000000000000000000..31350b563f8a99cf78173a5c97c9d8ee357253b7 GIT binary patch literal 116993 zcmYhi1yEaU*ENj0yL)lh;O-Pki+c!G+_hM6hf_;vwjDfwO!3aUB|^$7_7c8%<)pz8t!h0*)>13lb>{C^bVv3t!Lfe1sv9Y^RC23+f?s3;;z%E6uvst(U$7A6ddJwW?%*)19Lx`}9og#F4nl zw2>p4I{B^&>SU-ohW=LwCWm!mYyTTtvr3wO1JX%sQdyDhD8!sZ6mwX9#1->MU9gTdLWYN zL;eKbu3`-rCx}B@OQdax=90#fbHG7ufTOFZqgqV$G;>OB{yOW%D$$@^8wS(8X@To~AuheWH%E$}Ju7*=cfj23_w~2R8Hi$Ps(hceH zakW@4+`!&$#GjdbGjV$j)JPG`fj-jauO`f*!6%~lhpAk&eBZ2|WW*_X zAm+5&_>>!F^xY)uWxgs!Xpl_826@&&&!q4x>JktO4c>llS`U|?U)w_yErnY~E^sNP?L2g-TI zgtG7M1qHDscnm=j#9hQK`>3^&;fLNIaX|DqpqXSMvvD{A1rvT{--Co;P6elfPoa#@ zUk<)EX^bN{diTWCIB_g9WyvFmFc$KbQQ!JWKRF)*`4g#gk0dy;hFTr};me;c_*Eh9 z>H!@q-xX`LOrCEcJ?R0oUnMIe`;wW1ne5O`kC40xdgC)_CiQv_65yR8WX4kkBWycH zzaj%jkq16-GM-o}kj2DL+R$`!OTbiUDCNb-%uRwZr5}j&3ZIE+)OkVCz;HOoP;ys1 zb*LZ+ZjCNPYB?Rdh#mulcnQJFK;*~xJrB_Zc` zdBVHMbDZrz`sY6-OqF|xhow}32VmXY-ErA{PTNaAerF?cDFBM;aIL~UozFtM@0Makum|O&-C2Yy$7_=2cXX1iO^@-&d~pjx!Z|jn;Cjg zZ(Yid!(!G#M3+16wfR$o+DYP$Mk5S=7;bj}C3~YjmZjvplstI+bUY%{gfkV_ElM8g?HK4YB4u5O)vHRkLyFYO$?~!rK!X<>5)Z)IWrf2ZX>F<1oyIk<;*4^2*Ym21sN~P_ePS?G@VX)C)qxPCj0-bH)c6vdnVBs>$tCfI**$F81fc&or5UNAJO^g#R;w?=#2x!zxI6O zM#&$BIy|AXuq4D%HoMw4h?7~2TF+8#f|+U?U6T&Ia`Cn$<8k3;B;3oLOm{g;8+#v> zQC^iCAt@pRSFMuh(G1?TMMz^sUVVCb>~Ti9x)&UpMF0xmyGro#2FS*s1ocXD3blhD zy}yI)U0rW`$fI`+`Q=1@_0QfBMQeGihy1s>LH(LA>_ivcdyZQ=+3@}zJs}fWPFp*J zYo2#ta^H_E({w5XNvOr8%#yN-@IO>F@=I$8f0maQi^$ujjHs*YMJ2abXNq``>}vkx z%y5y@Uidd*{ssA(wbcBz$o<| zhrgDO)OG7m2W*qh98BvROzj$afh*ZueLbhpmwO)PCilb2nE0RH6GjXmT7IP{447?E zsMn(44IK3_gf_y-ubcc^hz z<1{K&`z+{N9a{~ov~Gkb{1|^612QFoz5HM}+8W52eZ~ol!P8l6aRXHis#*imVyp`L zn~wXo6XraMN{=$@h=x()ttUQ7(Oy>OyY$K zlQ?$Nq2TT$rb0fM0#&06mr3xl#iMF|$lcK(FS?;N$vh6mk@bwOG)P;zNb?EAej1F+ zscXYfQra)61`f^1FR_uRS9Tx@;rbjHXhY4K(MWHaS)! z89syJC*GTySixOd5rOEE_mbp1S%oyTzvVO(;Oe!=%{BjKEVT>u213{35J#%E#e`8j z5U6H~L^Whl2XE^Z?-z3Niba_v_suzzh#Hc|6Q3Y8vs&c?hzRD2D=Q@3G~vgyTA@Ow zVs(aMk{_5eh1`)UJ0F;j9tyW^m!>|b2amMyr@q%CTe@fMxV(tt1eAc)OQj6mh<_aE z0c!=hM5p7XznVs?u$g#8U8|>sr<0x!jxQMX9Xp&2WG)AnX$SQp-sY7Skw0Qm_AIs# zNX%?!#@{eto-=ee;>x8^>fN)BC@D{_^9ATKZ-_oiD}3kq#%}8B?go_MMab`mjgkwk zWr)kk1wo1VLw${)HehA$*<9q!BhqXhSEJx%>|x+VgcvL480%tlaZr&G-XKJZ%i?zmZ`Dunk- zi8UFVJ*jAluc{)}k?^^CT8}jpZpd%p2&e60$Am#4q5{q%>Q9Pc6!s-@=%~kyu`?`YX6o+tJ>Tw6F_wFs z6-mB&?|sw%xvkcPK~LC6-OmEk{Y*5Z@P`ZF%M&Y%5d%BfT43ln7od)tZ0Qlh?{e`| zlg50w1&-0KCSNhLP*i%Tm}`A9@NwLOlUw0Z&>M|5kk^s|8l$=_rnnx7)wugM1r3$^2dmh zDZCydo9&qa^+caYlj9Q=2DwWi6?%-#K&cJp=Mo43)>K0jd2`&RCKNnjaKVeGB&UT4QaoLZ-dmaYI zjwT$G80h?Vw#8~+M2r(J#7eu3h{);Ro_lGQP8~nsJ0|zmYEE)vWN0+TMgDx@e27=w zFtDLTe8XTEVwu<*ACh-+;$q!f{ZN?EtqBvG@ZPLSNHm^w4Q!=f*ObedV1+wS!?kCb zjsu%Zr75K@qrir6D3H9Z zhwIY&{>aefFnE-R2)RHG@ev!y^-f-~~6q?BtBzT9hA z>&d&bxMwu-I(v7rB!8<2#!{xv6mB34n@Gy3u8xqgC0$!_|2D@5tg0r`ET=h8Kp2?XcI9SjX>E-##7fZlbLaAYeEA-^?cvD< z;2k;bb&G+M#BlJWm?`Q82U#m$^tphN`_1O4Scy?7@|$drm0E@@%JcJ}aB)%Hm!sP^q-^w*mBo*g#!X+hKmd;$I-|8} za+lv9HH-m)L1A&5L%GriM5*A3!tRQcY#Qp>puih?k;l>^E=$**&-0tJfe_EjdI7G= zYUImsPc*5~<*7tjKwF&5!W8NUg?_2yh3Zd5)u0uYVmqtBX4=-vo3m%Y#SMF=pl0Ml zI*EqXLT*D7lHFP&=Z`+Rt}MBQR5GI|5)P3Y+Dujl`4&!32RCFxKEmoCxVjU;(D_YfS!LkJHJz2a#-%+Gd(vD^=3Zo#_Z)PnUh+Vrr++ zfyv<_go~haUrM&T&%vicN{u@Q2gGtbySw_r8*=-bM8Cc=kuA5PI&`+`AJjCYqgmM$ z_x)BAk2$(Ycn?qZH#Hz4J~}q8oc4U+u{i9qZ=@!}*p0J~MTcMYUe{^zz4PLMu@{5{ zyQ`zu_R^lLj3KZdsr1kVRxO~n_M*p)BA5PT8f$XZd5;9QLl^m+nwB15CW!&*W<>MG z^dcvs<>F;YqD|B7Uj9g80YPAQ2!BG%ow7<8VedWW1UZ|Mc_$|Iv`t&@G!S#X%aYT) zR6h~)R5_3rIMztbOpqv_qQZ*oGUowWc#~My6JUg)+BcG_rjXi)ksBGO!l|NMHS4BA z{NTo%Pgbj8^QZft@SPRpU{mqcBxwu-rffsBL_)QVmqIHf2|S2#mhh*&n2OC^us(g^ z)f4>^h-Ki8x@Td@#i89p8cmfLDNUc$WqV6Sf?*1@NBGT+pI1%v#~QxS(qiiZp{iw= zsHuLA^~8eqWW47)>O*?9E|8nZq*||gY%TStMKCDh$qA_!u8@I&8j>QJFR(kkzCTds z3FE9pn7mTriHDMg*5UZ|3IH7y5t1M!axyr(i1Zx=efnFreJl2-#2ro@vTy`nSO1yR zM5bW}=TR=l|Bj^p4^W`Kd3V@%WLV|u1WhLgxFZFGE&WwU(W&?uc z6}tL$!%lppXYFLCE~ObujwM*z@1Ha15|apI1cyfIidU^avq zA_eac5E!@R`M#sB!^&^wl|ub5js^|8&7m2P_;5@}iqJK!nb;XEriwLl)^g-RyeUNM z+`L4=O|`n^Rf1&Tc+?On@DLD}P=_c)5kut(Zs_!C1g*~8x2@Ym;tt}1inJY5zE@=g zSYv53{=YaK3?n^;%ftj4LzzZF3-1p&>Ieqy{Lm%)r~-I??j)I zl_$mdk(-C#v1WBnnT2D1HR$@s1K*fn)Eg6gqTAFtUangTm>JRic8Cw4%IMSoimgGa zdBDlub9UR6qb@BX$i&LVJGm0`kj(FT?VgwKj}-*LFRoyg)ddNwCK*T>d*D7G$R1do zc3li14Ge@%POe6$H`xDitkHcY4hrbr&!T7MQf!IgggvbL;Cw| zC)RvQ`5gZrieD4J68}@goJSRvM?FZaQvyi9j7-u116#{6K+jR7h+?~CeyN&|Za;E*FEk8AxKm@J3AtJJLgFi=P)9o~j z07y-0f8y6|1=SnnCQw77IoGOg`BF}0(0jy881XMLkx^K84pK@0HU}i+X-QgT4v0_W-3+-x3F~hXWe6e z(7vJ8rjnfxF4n<)N=!^mP0iV%S&mIm_|~&`F=hHi6qJ-W&t z-e!{Vd#Z6fEm;grqUydrh3}9BPk8VXlI*qugXyFd-v{e!@Z{+C9Zp8xDpH6-(bw>S z?ICs!TH?GfIlrZCNn@!fVyM$ps7Yd|(iMzc?Ed9Nj95%kcGRZT#YU_;e!-T#Nb2Nh zX>Ojd!^6*k)=4DTIFzCN@CG72aD%GGGN0e0|2P`q%$t-hh|e!5BhuVWalBjnd?IQT zJ+Nni=GK_k&`e>+X8x-azPA^)$@K*dgIqZBMe@DhG~t-Y zdn7##t|rsbW4#qEPNB&tL7cuQC1kpf#BxQ2R2if}D!F~Df5^VkU0C$jTG`slPh6x@ z%|?^3$>}|CaRH*Mmp-FK(dW!3bY&!%*nfhMCIC08{{x3L7RE!4I){m)ClW1fzSZH0)W!#KGX&Bx z1lR{XlBxCi=$c6D+1qfcPb|4PjtB^0RB7b0+LcIoKx{q5$+`IjXad>(w*Wy%k-iT6Ny}RibYrJ0HUZO+to-RNH;E+{GSy^4} zMMiWDYl1Ohyy92o=s#7n`x4kUmq@e-;E#hP2&3R{eNR+5U{$ZT<=VV?-2@*>gDn%z z?hFF0E;ieeWy~Dn4D?jvlco~=zWZ{~#AI;Q+k(2r&cI4w{NLS?N=jlIXiTWC}g?(H^%}pJsUgjhtt8`%&9e5Y#bahEx3u97>?0> z>PFjI1Cu?9Qm+DCI!qTWStktX(UDA93&~l)Y*$4s?T3L60o4dH+VWra1s0h9U&;|1 zYf|dss#(g*m4NFuu_rErSsGIZA}}MTua-@(mVJ_I_y{W;_ukRu(N?#7v{nPwPblT5 z>d&75{Mg+Ikg^m0cqc!_EsTR5+A7IY1intMa+Pc{)~K!6aF_HJd*ww0(tk&otTFZ& z&LFm#IFHh8J@WrvH=9lRO@RSBW^KgKgDt9p|HC<)L-5@ zmfd;1B7#S{K5~<}#WZc&um7Q~T!juN<$AE*H1@fJb#rmkvmp=Mb0U{A9rPkgDWk^` zS||3WSX76z8TkW@)PW-JFI;TDL-0V2_|@HRcv0xc?T z`pMjgTzx{qu`tIDe|PI`sg{~Q<|f7ztdzD|rB#1O_D^#SIq}W#wJvlvcqje_xl<(& zU2c~(mSQ#R$DTc1idLmv;O{(}?uh(PK;FYzMqP#NqB-iPIckn|TU!4>tY{&4i$0$C z@$tO8Z5nn62MyOkY-|O)D<(#6MGcX!?{g{{g}n6pch;moJ}k|KY()s>;-48AHu=%o z({CngFHANN^|Gu{WM&|5iCnI#=xpAnA+e9iSt&ox{PIh)72h9-g)oSxOr)9b@A_5V zzP;hh_VN92IUcc}2*>p&q=;^X76$n|vMu|l+m?4^GlbYv^?-6&nGODC%Rn6bu1=lJtgwHs@bp&P4zxf{?>%srp;OxB20{DB;!mf$KN zzTuG9xB5S=K2b+MzlHN4XxJ?H=a!VkXG20}8)DS>rmtxtR^PlQD=u=a=cB@+Aa}hU zWS)iV$ZDK0EXYlT%hs;$uKD%VB#*bJ($Y4B>FF7he7wO8EjYXav$?IcxcjPP{Y%OP zZxRdx^}>6YNj31n3o&J5T7a^JwmLm}zK&E9(EFM>^wTI3c5g}2sQnb09r02}l_7R) z*zdt5zwUGIy{BJs_~Wf@o$gB;Njt8p>zJsI>w6E6Ej8wB4h7RlN_#X4=GvRTo3@-< ze=~Jb*npqg=dPnV*K^(-wl{EA{}!9I`{e4c($#NT-S)2v7;F#i(P@HtE6ud2aGfNx z5vv0bwZcddA0cyK0Cg^EU3Dw>Chlmm$xP;i?-^=sISXO`S>AHjofKvZ5g?=Y(0Z;! zk)p*$ry+=$v?s7{$EHt0cA7WE`_r4Ffy!d=Jzt%bquRVlD91Z2=vv*PNhng4(>>SDRR*;w=aOyK~3`{V0h!O{AQdlu<6_Js4~BU&F#l1eTz68bRo-Eyn4_0y5tssC}U1AS>C{B14B?jC94>JyKqw}}ei%$?5F=7m~XeRG7%V%#D) z`FP>4w_y+vWs6G>`@Wfx>`2obT)X$tN){L3pkdwszt|E*%F+%zhD|QbML1m&jj5t) zEDMe)T2gD5aB^|O9R5Kg&j^~|?i+c~D)GTPL6wrGgo?7Rk6-^-f=AJ)jMa)B83Vt% ze1t+^Q8cxzgBoNMar6QV$I~nOdNET{Ky*Y1tn$U00p-W5Oi1wxg-vy1sHkF^s)$5+ zT>|!YxvdWKO`~PpHzY705D+=}`7lb%VDg5U!Y$~Ch_Qj+uJVd1Nh!44A?zbX$YVdz zOuw{Y27z$KR5>KL1VTO^iqH=*Y+k|#1J41$@0fB*%IMyyi zSy=-^C#-VxVN(W%!Kk}QR>Wy^PV^zpAHh>;$icK?O{eTQ`yW-%1%R2;{?>Xy>xF(Q zajuD2c=`3^*w*>Px7I%@zv@^R+xfP)>*PGD6;;*|{O74Uod=aibhzxR&d$x*y%ivh z1db{uv%@Yh?D&|p*l{$(SG~J+J$u*GNyDamxItd(5oz%72r{sf$7tc9?VLY$9n;Y{ zN#{6Iqc3XUU&-lHT}gsLie>EPn+3ipy)fA;7^3ExlBGp=o(hwIoCRwW?xU^mI}}%z z^K3o)ZoPK3@rxG*3&wsNppY}Z#Bf6bhqBZ7`mUs1_{{99?)^)Y!Ra*KCrR3YY##y{Ixlw6&NF%#F4^QB0RYRZG})fQ=YuaE@Z*sGSiM$e~1pOLp+T_Wk&>z z8J*SQQb6WlzHZCfr8Z@Z|0RG&6X|*P)8&xR&`?s;rudC0g~=#R{RC>Yd6+?M(=W`E;Cj+P8v|;ZB{Hf^ng=mT-fU8LCJSn_KeDMZoUb(|-8k>B4)g99JA9b} ze_eq5z|G+;SU5`XYVanFGR;HL(ej&@v&Q88iGd(wa42?o*tlC<*m%219H4gCH*Ghr zcqn_BMcoKX3;j*0cZju?01(I75s!>1mrOa2nkYct}Q88Q+b{sw2GFPtdObgwju@Xda%Kan6 zJL~<0FtKhfHBR<=rI^gMnAWHX4JVEL3Hl|}`{zo8M`39h$N&VUh#22qzZ1&KoeNK> zut5~GZKUcde>0Krd|YZ%ojW!%OMRLZf>o5qlwM%x@4&?CT6E&z?uh;m9(EQ->;O zhE#lQWxLG=5Y93ec-kZTrsp6DW#+62*^2jmX=5(=pvE3Lg4Vdkn|I%h+skqK)ekYLzZmXAi&^;Qt3`tT51NV#}tqizcA zUF)w+T+N`!VWl}&PQbbe*Wd%c9W9tx;!OONk3{?oTozkxnz1N{$zXx;lXYx`gFaJr zB^OE{MW$~koxVhD%_!g9CZc9k^{Q&tj>U1bIrfflglT*aY%`zuQ_dtP`YDoA#oJK zsPE@TJJC1qdMtQ|@_c3sbA4)4{A_BS_-t-lysfmm(_cBpztIKzmHNCPcf;lmv6bL5 ztW`j)0sqx8Wp8|)Fky{wr(~EaSu0RQ2s&eqhKSi+ki0R*J_T2dBV+hz`QpyI#So*L zU`=jtorT<;Uu+z#LhsN5vctc$LSj!LEt#F;kviwEIaFD9{1ek1%)nzy7E2%UY|9*> zz#HmG6JblQcz7hqnxG%af*m#K+l-}V9#8FWd(Y#(Ay!ElVTMwzfb}8~ZX_ni)!I_S znn@YE7mdcl%3%)2!*J<{H05dU+&}VBt7-4*>TA6FmJUpa*F0B?g-|P<>u32Lyzymj znk}T7(KegZHzT+==>41i&_~bWd6BQgBjzp>rv~BMu2dtrNEt*22>t3(T19NvLLL^; zkC2S0Y4O&Wn+G~O4Gjeg3V6G2)Abc{XgDfrI;(T^yeum6yea8~PZoR*HtiSH3=qd&m0myv8MT z7Fmt<;EdCXN!o|FT)l9-T71!pHTKDRTXnw67Q-*;J%x8Q*JhtaZKV3g`t-T6<@s*+k1G5~9u z;ih_`MT8;tD8fPU8}i!>ksrDk$}}_IUGCi8W528J70VH^=g$y{*vgeF?DK+ zPlD1lk&&G}XkO|CmOXq>esWqT?&i!W{GsK8x_U&j7ja9*@sub4+?=NPEh)L{WSm&k zNL7w=b_#qHs?`Kz3(*p%ON1rDL(eJbfSG%L>e%wk`I%sHekvku$;)*%DZi$IJP;{j zV3%<@eT0iux9`^n0c+Cb91vyNyIsx})Y9+&dX-)mUC|5zm@x_4FT(KH>&65p1bu;k7X|U7}96h|n5j5Zr&nHT-?vJ;&q=thBalf~& zzbLwGBh7Wcj=ZkQ_PjoSar2&9I_C~e>+aXZ%0c7AoR^t=gs1DzxG%@lp(22VYGd!>;edi=sXArXo191h#knJjS`(T&Nj++UX?c+Vr1k_IK(Detp07B#8V+ zT=>TzCHdqIsBWU?u@Y~+F~i_awVwF(2t9I8d7yo(!bB!`iV zq9Rke-th+`&FGY@XTcxB@>pszlgkIRZWkMo}D--PO44#~!i%VgZV@NYV< z=_8e+J}j+9w?v|3ihV)z*;tQi^k@%CEQ;N}%WY>Yt?bT%IP9zms7?JQ4K`ry+3Fpf zTGR>qG4dPWy~p~1$gp|wAbRHp_UXNOWG*;N{tiZ?VIfjPE`CY=b+yLh&yfij=0}MpIkMw zH8`Rf-nDN2%@dv2>Z*RT+<$6c98?;~fo|bkow<&V4qkp_R6oA;HuQ012aW%dm;{7r zXT31FleLAXqlQ&Kmp2}CxNpxbGy>Oga4P;P5SPHNLKsyY=BS3HaLiICN-fi7Hd-49 zX!LWr0A)`fI;{(?UoEJk^m%pS>8&^QxARjXx%E@=T97CWCB?DpP91Nsg)R}pKo3BS zxc~kV%i2u+8%OX5{=LD{pBQcYI1;0#NaR;Y%$7Y?+JhGw1?aCYY@+MLD4UyRP<)Yq zn14d^CsZ>lZN=PtSWT9JG{3p z1%PSgF}I!$YdvoWT$93P~yFkLsV35~iM$bFnHdp>6ZeDEg3 zZ*j)eTdWPLeU_`Z-+YU~a+6Qc9{rg zqC{?>1wlXc64UzKz8Cdd|J4(xm+6`EB(iZX%@yMDg*QNS&97~KtJ@wYvXilPGYa2b z!~oRaxsnhy7<%c`+13lA$|)=bJmf0jWg{f$csQbhQMP{RLI3I1hbom!`_G+Dk~@x zB<-q3GNkFO5|5Pr*03+x8HVu4#n&95Vu7q$ivauV`%4WvYEEKd+SJb|Py!HP%MX9} zhjCz#fr|wqPgfhMKnDYvhYDMQy96MYZebrpYu#mP)$z}QoK<6G`(fnd8LFtT^Yh!$ zO@~DgyqAOPEeDG%fORd{zn3Sc4B`@)kX6RSAT!A2a*CIqOk?}%&5RH#2RX_{Sr=Dm zm5K&Ai*)*?k5JG^_y~qD^Em3*i;_b!~;@ z3F8ve{qtq^?cv3v58vHdBjIJMFyEcAJo;T?ke>6*b{yu>#VeM-OBhP$%MX;!$8j3J zyQe82 zEm&*l$P8eK4g~dt)n{>C{(d1Ml))v{-y0%bGfzZWq=V-lFPFeXCb#HY9vpzc!}NFx z&OfKOvA5|nw8nX|Iwu9JARWpe(bp0{H?XD#92dyj6CC5vfus*8DdfH1?OU4f9+}T* zEodEXbyT}HUsji{Elpdn+PWLw)R>qgV$27XSL>x3>Q^x|D)m_3ldL$~{A#FcW4$xf z9iFb;rFTkopw7Rmv9!HUS412Oj)oHI_}clhta;lo08jFEs^k$eJaTb@G!m-MK9-I$ zlnr$yPof}H5b#st+rQgXRjE-#qmx>Mg9cW;l5g|K@DJxm@ZY_DUamn#Ia#*d25-ul z;WDGV1cPMuZdfw_U9mGAoL&J994wclDmh#N-Tvzk!?mKXBYW++@(f(#_Inud%wODb*$C!#wX@+7u462-2aF;cXK?>LdMaw z!6f!kexcYUPb~$?Mnl(Vyyw&zxm;6KSpV!uT4MgnvL40!^KSY)%YQ8t8U5(+WXJq5 zVZKD_K9|NfR+lytj2A^=t9RO;}Us?8wg&NX*u7C-z@M zhEIPXo1<+BYr=Gp__|G(xX=5b*SdwsPJn4|0XCv3bv7rvLMx;EC&L&{1WPlO;LBk} z;OFv|WYs#?MoHc=i@R#czTZS7IFcex>WTApkOoUiAfYfvQctiNuv!p;EHYMg`D#Li`BK6)gGf?u`7vU!iQMWIl9*FSv5mEyr5pOP zxA%wX*@&xYmty;KDQQDdJ?7FWasJTAJm&P zPG`T6H8eEy<#`qI9MNd$9@0mwr!)*gDR7+3`F4woOQb#27?vNyfNo8}^Uc>zow%!d zU51@|?->4J|5-LyImQj4dV>-!EzKS11A3#kIs(>o2hx>eQE}w8I~xuun_c}RuDlwi zU%rq{>7XG%a8Bvkj`Ui&c)3GD5}f|r-sF8RB)--pbSkXFiD6rN)0*U!wF&h|m$_zV z!nUZ93;RI_$LD>sU<8ar4D$Ea#jK?gPKsRV!a`FU8_Hxd`ud1U6G^}(8>p}F$Sq+H zTnY;g4tCvL;Y9Wvq@=gqja_bP7+a+rFGSh?dp>tpQE`sW|FF*Rw5lAp**YN(o;rVp zE2(_OQ~WWiUD^r7>rY|THd^)sH~A`pRr?En;CfM`iwmVzHR9Qsl9}NYtM*K7ii)6K z4@d)@@#4^^XHviX*F|;m*{oXu)-UF$kL5U+A|NP_YXmKsfqRGNlU%z`ue#pbk5$eb z;`L#Zmf6?tvTh3x#h~9baO<&h;)eWQwQmwJN{!Zw4wsocROz{Evf1%vXi5qYUiuJ? zD0bt&75I8HanY4MeWT`|k@ye4{Wi0o`Cpb^@9Z?5qc$W@0{w$H=XOhlDWGm}JvL;| zs5>NCA2tGvleLK!K+4dALweh$l9Z;@4J}|ob{zE(E=$`{dPcYxy_Etp7{v-RsLwN}Sh#{|%O6Uz|ql;!?cp{AHIi=WOFezRz#x zRqoe>A7N>$A38wF^r*}5m*lp7-}Wmk+&8ZfC(*y}OCLv-rt0J-@Igz7A}p9VUie+b zm4)KjS5MH}p@-P9=YuaEJvTwGB(K?>FTUI7PR{mYoy%P@f1mmrcB>Mb@@{3L_x!2< zJon7w6|36+i4yC6#y@7xLqUO@zDBF5RhE8xozCb16~{5Mt*41X9|d4B5)>iOjiDcS z|7`Q@x7h4PXpQW*GvQCz`6BLz+NnD7yzqMB0r<}VK8JnT>AWLVoie^tc{1gMfsdK5PbG&1YEgj(kZD}X5cAd8Q0@5AxTen@% zv(vUAlQ`cu_n0JrlvifdOpB+{`b5F!ty^>P=;Pi8D6hIb5!H_^*~OzNQ(u-1I|v7) z+7=*#!^8JeTaw-{6B=1zdt+W^aro5weh4<(y~U(B?JQ=G&bsH;93Gf3G>!pEs-!f!ENcx*MITN{1b z(*o|#ceK>sYlwksa&kbSEA*fJ^-H!0f5pEEia(YvmWTO92Lcy!C|n2bv5s};^OSQUW<2hQaUu|^+lrX4Bd^-o^dl+_PCt_Z3t4VC99sR zoTo+H|D7R72!zv*LrL(5y$?*G!)md3GQMgCFZq2+D>b}}USP6glYs8BSLUs;Vu`3l z*rD;%-Gv2OdwnfHP2?V{rJn{UPN7JJgF%}V{n02sz$6JFLbyTUc6pkcwMCXlMT>4m z*R0rCvFMPfdBa$z_xlq$FUFTNW(CaoT48GK=?AlYaYo8(oE9^@Ky^m+?)9AOVnc=t-YqftMY?p>TPN616-?tKP&| zxpQLl5t**$R#jJ(?h{r_G{~s1kHlAFu}(-~Uo-rjuJ@-0^_FUU?$pn8e_J;np)*hb z^g0i_?0@2|j>FmWH7I1R^Dxa(Fw@P&7|SH@Y=z!@>%3ZHIEW->`xI2ZI%a_Z0&WCu zyIzEBOtMTC^312igQK%hy^>I^{IIb4zH(fJTcJ0J^*otuQ2gO|Lt0T=biVkb<`^?I z37L$sC0m^}?A|`z!Lfb!WFK#x68WACDD_>n0H;`BWDCOVtOm%_M1nKPxzohX4&E+* zqj&0ue~9Nuu*_sw;k0VFENzu=OmRhtw4E-koIE|37=NT9Gi=_OWb~gHlblY+o&p!tmScUY6q{;J@xX{FAey_oX_Y@z zJw!D1D^qY~m2iZsGNH)p_HDeVFESU7Xi!Yd!NIYN{wqM{x&7df80@J7-EKyJS_=za z>(z}+QKFXApMVMtr8lYf;^Yy9Q8%W1Xno^8dO;)Oet&M=0@ye_RyNb1V_z^P?|pOe z?d8~IeaQ=EsQPO=G3)ut4}RG7i6re{Bp_)PupKy*No)F`{tyb=blqsWf3>HCgw-LNeq%Y)DTrb2}Tc%iHm8N4!VjuguAE+plbwqw6P6}8G&YN@To zHoq=!()dDPSRO-^m(srCkyxvHj{R2oV`yY`i@(lN=C&0f4_Qz{Qe{4YaDR+U08LFX zm}eOt5j*N`VuzK^Fwe}p>rK?(zdCxKvE-jFifL5uh)LSr&of5dt|MY?Nn`+NsSo{ zbr*OgMI-_KhTMh&k%FzycnK2BYz~rYc7o&DNjnCH!mO&sVmX)uK%5cupLSR=?@ipi zh_R#aw{yiFa!&d#unL@{g;goq!%IR)C+@cYx=bmKJ6w((t3-g3?ike&OgT)#)JYIa^LJ(itrAIrdYeBGY$kFKde0E!dGb)Py*RO-tx;&qd}a}*(v zx%-T%kbSw_VbEm1nSTjTET?ykWtxO;Gi;O-XO0yG47cemgc+#y)d z#+~WB_h#1g|6aG{-gD~I-uo+niaWykhF zwZ%L=6{cEdyj~oN%D`u{`1o!4(giu1{U}wKobD+@M}CNh56JRw3>%Y{C<-UY0QYJe zrUbkL6$7~kzWMUhB-V08Exre333TU==for-x6doqhQG2D5$9~e@Gv`G($nekqNzfR zXm71J4TAB~^09{s)fhNUnX0SEl-~z6Bh2RNR3j+dRiZ5<@Gd>p$>7@p;oLS)-04T>eqVRgMDbVyVOQSyJkB6Av<`U^|)2XubT`)|M`by{zJI zapNZPb^7>-(&3Ia|6L^i?aK}6ZBl$e0ns=gFN;>Me^TLDT4i<27}2l#cb)sp8u|(r z#Ds)l$`yn2F09;}TP2E@OpG|<+xZdPVTr#;@swd9CCO7|rcL*swD;0*Zd3&^o>$Fu z`aRYg^@W?4be(nwPe8KJPj&t$C9He|y&)W532ne|>HV=A6GVt<|D`y&{U?U%shG_$&fB(p_9S=$DpanGtu`Ewz>Si zBv3`1a+a5URN>5Z--8rJCD8Ah)O~(PC_Ipb)W_fKE1Q`^v?BjdPpJP+4_(L)Y|2$K z^>P1nMCW9ey|#NL3-iz!15S$&5a9^R$ja^_)6fC6O@7m<8XCnlT2B`iIpOu&a9rZ* z$d9tq{~cb{pjF#mgHoZ(6Lo#4GwM6ggIV5j)0vQCk&_PoY&VDCt4z=W|*Gd*$1@SJeBk ze?jXr0HlPlR@A*WYa10?_o@;3VtpW-gg>x)ZmOMj*UiNm_T2gN>~uk@bd`=wp%cW(Qj8$XXPy8ugKsm3>l zn;}_p;&%3STR}?lqnB?xFOLJFeyE+wspLLN#eStO#YoLMD-V2%bgTj~P64~5SF^48 zVO#i=izyPacl<)PN-?KsfkCXZ^+#SrLCnq>!!te*t;rINuIVOAAgsMhPI;NlBXI_1gA)ugV=>`;|;O{K{xrMr`NiNueBct#%~w3=*q0-4%DFwP9mYAFP9(0+wWUmpz27H0fpMji1X~5e~$Vs zR!6-)mmWBX(#3+-ZaAM5V$=K-sWsLs-uzcstJL;-Gf25l+_~G4y)Q#Yvz+9VE@yp& zD(|0+pQdL_(ZW<+Zc+T6W6{jiEkg$BMlrWv7<%p+Gcaaq%zl;vwx2*n$3K$I`Ezha zB=bX6CIg`os4q(D%&t!$;ZROD|-DsZ}o!NW~8u6Y04NsS-2P`y6z+ z8`--Se5-yzE&AIX!}#g%GWeE>%?P+A%L_bB+L_jaCYZkHw|?Ihr#lmm(qrA}ck+k3 z+uVnjz6@x^8uWq4_|;aIJZ-X!Bsv_L*b^l|7~9qfoBuIst-31w!>e5o9Ke~s83>pQ z#swWjk_NAxVc$DcAo#s;2F4E-6Sw6EcV)nAWC7Onspl?&hbu;hB?Vz1aOJ8CdO?sP zcdNApz7j0CDeiPvzXpv*kS=q@sQhs$JC*zDmzq>(Ra}}28V{j+o~BqOf4UzCAJ)kS z#Gv*@JH727tc1ASYUU4E_da?cE8v9hLktS_sO&kd_s2$AUu^jsa7UYlvO8N1gY%y! zDkcwE8_-k{&5M?N=UP7Z4l8%Ri@aa8YX>o=z1nMks=D41cRju~N}N7WCU!?SGsG$i zMBoNKalY=96W6T}Jvn~)w}GuEf~{<)EGPhGBT-lb@~F-JjW#}4a|&ghFTpKFYev2o zk@1(ZeOYOkj~Ch^v7^SDC@Os4y(ux0f!2B$vJGRM$xQ(e=k9^UI9V0`96r!X;a$q!g@yI@SMy}abNm_ zPF}#}Lx!F!B{ssoF5riXgJ?__Nw{qjlJWB%uFKB~{S{+fT?rjeyWJP?4rlD<=!yUV%e1kLGCu^zhnVVH>CT!P9NyZp@9CkfnaS={N+2Ay5V$- z=}7tLOz#7F-iizSyEn^4`%9Y(Z;Q#}lRtsamOVg{;jI4xH!yf6@NPX*bM?CB^!xDi zXkb*n=p6&m6HZ%njqU57BNa1y9|+%8;mAwTXMovP`Ad8FT9FsJ_rrycAmi6FwXUmi z�EZ9VUDWa<=q*vt4!UhR>#EAS4rLZpw_hR#X52inV}4-(B72Gucyxa6QAxLS{9 z6_}QY`AG%#sTd!Vn^H$4)d3{MGI#n)jvGHCFGu+Ig1Qmgo0JVemjztxsv zFLc^QB4R!(Yo!gRN@9jtq?x}4+gUL1$=~k-gllqrq{rB81rzXkbyUAE#-E(^<&jw+ zHD54tK8Aq~8MS}L$0At`kDEYB&ZK@R%MRteM%BmRcZVA@50*0{d+z3qK+k=3=`L;X zwzCg!&nuYe(43i{n#^_py}{YJlW2)Svumtv7+e^eLH6auHDJj!O)6-yAd)u|eKOI2 z5q@PHftMP<18}ZX0PhXCn9dcsK{tBXd`-TDBu{e>pq)^(eRmfq2@u!xg)aH4 ziCcA^F2Fg_|HD*B8IlEkhGMUI)<1P;ub4wF4Ho=?tEw$bdGU8Z(l*w20^&Z64=$7t zN6ogNd$6j@`Eg~b*_=2_I|Zxrd1uP_^;6>8Uli|@N;W#0s}+^NsO0pG7{<%4SE`f!c%IM7vwNGz-9BmB?j+#r-T`fUaU=aMokz|-B6j0%N2EHh-i z_xn~2i+QDlk)z=~7%U?43U21sRrhzR@MDgGw{N=fr zwim8UWTZ1_L-+UMGO(e62oTOg`Wz3gzo|0}evRyVAJkv&M9y4v34IN2rVBW@$(Q^# zgB%^ir&lq(zmc^7rjCRSsZ(d4R?68JiCJs2Y9itj*fOdbX~WH#u!1}9Y&;?%;L^De zSd1C}<=~hEkKDx@36dr4R6_Xr+5GVkjU;jl18{Hntm}7*6qqPE{9~ZX_{4-0^;|$~ zxwd~U#TuM?3euoeF05}S=A4JQ_2S;$JGsF-JC{_DrIn!>nN{^buuNMltE>b^ok+iQ z>7z|=EB5&x^c#~WO%`_V(TTi;!;vTdVR)jxqzHI_tKDC1O{7#F*Wurcl$2F2>M6vN zP5c2CCj^!A_!)>P z(k}IqRSuVW8+0Y=(JL6hS+yjm4U<3=tMH?tBK-}f0h2sn%6Q}yE;h_1H+waJNFX40 zz8=drF;_}kmU225$mR64fAS1D0`6IL;G)PH-aqx-zX|*>h0ixIG_`USv;Z-bjdkFC zISr_Ht}RC$)OReOub!S;1EQwCw-W{e;2|$wysyJscM*o`F2nP8L_a|JI~g-QL9JVU zD8|nlw4mj{7y7OibK2XB%6$&O*&vno^N;?M>;O|^cG>}u#;BUQfg&lp_3Xw*jDlth zYr3Ynk5O<|zh^FUdz8p`cxELfJVMN(;u-+10;8&icI^0?)}w@<1T?s_qJ+p-I+F+$ zYvlL!cT9fN`Em1e65=C9aYnOQ00bxH!Yp0d@g)g*x>WX$9O=s>_@Y7AbB3dHi<(xUrwid?n9FQ zJl|S?5jM<`(DlUC1L~Fqa_ZNA6zA_%ih3j0tT3eS8FhjFpnd`NPfm|J2ZwDmst8BZ<^{m|J`nZg2)68|X>a%G0%+Hb zzF|0>2VhP)Ft2p)qX<3Sf_+0aya7*@v}#-Pod=V1xk0|E&>N&==`Bd7ibevD0wV8O zwc?INbVTeGNd7ieLXkCjBDbFIyXCY238i^Hke3&tQIe4lV26wG zuwdsF@XgTs?I1%{dohgi_NBfwZx8{%|M+J+5Y?Yk4|rhN(3s7zfcWc(1~l)cvR5w~7{|NihbxPAHh8*jG^&4j zHt^1C)PKs_oxo`cmb-d`jNh(Zz{k3-yAd~U%NG$md;MCP@0iYkem{Z)TaQruo(NU? zQa)LjpFeJF`xD8=mc|CwiNxoWJRja|BcXi zq--tp;DE^t#5f2EOBj2_8~CPO_BS)gtPLjreTdds&&J=9l-Ba`j8-&yyvC)DXZKsj zOe403>SV&+0dC$XSSq16+G@cpogo?oyJ!@@zOx*BkaxYW5%PK5(=o)xUNz>6Lb5t`sRUtJ?T@D`|zIrQ>4i;6wljvSaoLrgF zV+5=7BsvOwtLsIJSE??n`a1Ab*tp`hgDxM7S`Z0s;9!nvEAYH~|3~k9$#_2iEY)9} z$3}ws^51!;n-4pLPL(eQ0>S6&LEhd6^RCWQW}%NW4J!Dp;HBL`MPufc%MB>TFYwA! zTqNHf86Pha0~2ubisTPYx5d=_S;OmKpQLC>p8po+lobwBH4-jo5Ig#DKFe9z2UC z%UhB-$_1ury~Jb@UBjvfoG zI8NGx9d%1iSb|FD```2iWn~hQ=ETZGf^mNjJ+C`SJH3d*PpqH~Gzd3(LA6PI-VB!# zI?;Q-TCBk*^heaVEv)%^vV`t8NRf|W*8SmSqd_l{XMsGQCkLG_el?(eX5WR^)<~Z4 z%iP>*Y(+A7nW}(aSZL()G(lrH)n{8Trj3a8RO}Of0Nwf-OE$-cb@zvFhr{ zc@$`)KSzDVnY~tG(0oeIUu4Q==?d+A`Lk`Ji7PQ{-XGj*JX}eI)7t$E*>iuux&!Wn z^qs|0Dv%QU8v6o_ALp0pri_PMd!M+4S{(wX1Bm*`@`p$OW^l*;bMs4~4M?TV*RRxa z7OuI10r0pJcHoRvkel^PQQIR|#rQ?DqKcnwRBKNKNgVR3*LD#V}yQ@cek~5E7lN~T!Z)>r~L}T&$gYrbI0Y{9F z)0Dj-+?iM-I3>vlrl1!oA@C~qsQ(!0^oq=)^2wzYL3ZmK6l>2lV%nSWUTppg^5&&c z+l`e*++X}Ne`~_6RbMPaL&GxqZn=Z_YbBxJeP2&tPxN?zm*Bzbw_Fwm8Cg5bg!Aph zm>AnsW1+-zr;A_)QH02U*sypoDP-vx2kmi(YVNul1M2--C_&&{(P*IU^4>O2rORi> zVOu6e;|i;&XTjOcg;?EaXh})R+QGV{cTa?nYdhQY6_eKh#9g2iPwb?T$>% z7RWDK{z&UBz0rpx7<*X;>$rqaT)a!MUY=bs#7@1jj^Fv5{&-<0*RyoJ99DXt9B9{l zTp>&{+0gb2Bn~rp8BDS(J!82E`!ncY_r7274C{d=!lM^BK?>7vZaFL;3frCGT zU%duwW(SE^I_zxYYbbeB#kgKLlCwfks=pjtm=SHf(QK`>KzW?MMIA~5B!3+NaPE26 z-S$g2Jdw_nYwL2;a_0E}2$VR9l*bPerE`Nv5B>H$NTi>%Qb@ESPfHY4tHLYl4*igH zI?Og!EY-iWtt4ufg>PFWa)ZRv;eWT1;?Kj7?=uJ}yaV7R?1I!W*(nrw+JiWKg(13CI=lCz1)wuECTrm&RyW zh#VqZZvjS0?fDe7iDzI~9wqLB>wuy1*tEJfSHl(LRZYleX&9_=>0J@PT#zcxetA{W z$GZvqSAarQ?%E`*jsp*0uCh*fT*sN`F$&F4vOb}?GL1%N4w!>8G4<&|znRb922I#$ zz21NQ)cdIz_n6-Ydr(8;*sgMD5G^25B;r~UUW?O)u`}v=TqaCoS@gx>4%>YuUZ;ek zQHE3*rP%svt&(;3j<@Ceu~S<`EN_moSgDp+$#1eWL+OYupiei#oHrx{E8`1>lo`9J zE_bLAT;zm;CLWMGE-qE1T%`|2tdeiZThaj^h# zCieI7k`4xC@Te8Af!#^Df((&j^px7m=cyqkV@lQ1kp$7&f8~J^ES1{JSm!cOwT#dX zBAz$u#;aA_;;&Bd4%czms2RKYNssqcMx3tsyZUhAriMaOR_^ zQhO3N{YI_ykW0qy)m$;IYB_9g;%}lep?WZ(7hmI8ZSFZy`2AQZx=#?I1@(yF)U~UE zsM?f1N1EXW5YEMLNGl`Uwb5NWzPB1Gnwv?DgvFRSc|~yy3*llQ$Y+URcu6c?%A7EP zT3>&Rn6-++wY7izkV80wk+J$KAJ^*X14u}gA5i1m;I>raCmw9DuChcBIl(-u><(Dv&}-ip zfj(i(n&PtDlga!xo<21`BXRfQ>L|X~yu0NDb~$V^X{nQ&0)hwgNzDhr!F4ASYN$|o z*!X_G__KfUthUy=11i`SlqdfvSih($^S+}_zt^IHb?Tk1T7ORPMFpYWZNN3h25Vb6 zP8%eWT|vO_F#X_Gh5w7@aRvvVQiIF~nE#sJ!gFe@s_Vh9d#%p+3-Rw-jr~7xP@j1j{7GErb625hY)gAc!OX*5-U}|Qh4QAE5b>nBm9aESa<-<$#|Ks0mApJW< zYqjtpa7PbDvNAn_zJC4GNkc>j&;>SkxS8+DwduzDFip-3o;j0e=1=zhqG5fMyTT4I zUJdYuAySayS@@4b=buTZ+qDvO4Q~HXMOS~#!ObUZ+*ug3@@v?L`tXp86)(nQ{A`u; zIdON($ldD!Nk;1E^RIepXPS}{pw{tDUA74aA=raF66Xz&4=2)SbQ`c=dYPixID~Xm zVyoOS;mKjrTCvySJL6wF;axxaAB15eRf`dvtZY{e!G*9#^r4$?=+S6mIxg*{Q2P*_G$Pz@okd8ydo%&-fiTP&dTiVr z!NEWyu4YeQClDc?J41DGEo_0B`q;)%%vYP1C3$uMuPUUv?GEz9=*S9^<%j&BV=F?M z$l&!~f~q;oC<>L(|7dM5!m6eRzuT|BiSv9R)4fVh+Y^&T}a zAI+96zYYJ3T=cuNexI^}QR+u--~RVsT74*4y6rX%1#PD2on_DNtyGaL$k29?kapSo z;c=haq;5FF<1ir zViBQ$oaPR8FfBy2jZ^g-exr$k7YlV!>JGz-ff3cdi)nkAyTE6BENKdyBIb7KfvXOs zB)NkDv$csVrYZqu929|}6nYB|gFm10s*Mu253yce~z?9tQoz*l{RTB{yg1$l{#?7*xtY_=vB?nCcoWSchwXdb)2&_XD?T=@BA7b zDWkEteMLC(b66wW;P*_j-~Y~(97Jdsuu^)VqPPh5@(s*QAxy5n26Z04w9jgZB6 zCWJ)`D(hQ*oJ7Q>E8ST9PT0;-lUY{x!HJ{dSpvlLLm22H9OXZbPdEGMPvBX73+O;m;o?MoK{x*5`753KLCV}bEO}l zkztb^Jv>ZHEmxM>W5@F#P((&C_3=d1nCFj6R54d88XRcCySV}UlH)ran|XZXvtam9 zr9+qUxY`P-`C_#;HF`o37F}-KtX)?4i2(O?fJU9!YXHA zrxamkTJO!<4Obb2xS!JT|#DwB_CX%w0Vw=su z52X~LFT5qjD~XpIgoW%e6hCqX*HQun1ck$+=@HDRYT{&=Es&@nm2i%ajTE(Tm*m7? zHmxQn{$yrN$5-EuCTsE->Lg8&rO~rjt-KdWZ8wdQ39!?N%8eM zGB6N*ab!Ak=GEcKy}|6MA~0vF@AsJyEG%q+L1zDCu2j_N<1t^VE%iL_T*&|M=teI3 z&_tA+)D3xxzrhg(84JjS=+^jz&3_D3e){?psw#;S?x;8fWCDPy&qCBsaA%rv6$=Mj zQ7#VHSxeYmhycdN0LzPEC?)-83F4{5u3!~CMMZy3jV zrac1Eh*OeWNN?|e)k-V_926Njy!iM;lk}m#1G$h^u`vD4@H7DH1+49pG4U8DQkg8g z)Jc;V=(8$!oIPE7WEo*t-_BW1wh(U)l$*ofE+n>WEv)Iop77PQ+O0E1j0GV}c`-!5w0qjQs?(Z3dJq-~T|K%Vu`FA-v>!5NU*ha9XPL3%AsA*3 z)Ip5aRL9%LNrWCtM0gKE)2hVxRMCNFJ-+EPYk{xMQ_esFc}v)UuyE!RWWfNFFuPR; z&#)ULyG8_v6DeefUL=_m1Z5|541tl6i+V>1(c#gty<;?TamW~t9IN914XnJeg7D1~ z3XDq}t6zM6Km%OoKBUNX);MMbRnv)@s_#iCgD38NWxV7>Q_MD`iD4!sb`5;(8!TZ1 z7^a1iZ0J}u`^CoV(laukD{(L?W}L!uaGW7(;Y(C~Xlx#!jxU*)*<^2Fu# z?|>Hq7BC%Y1v;3`uDL!FhJ18naMhtTM{DKWQ#{Sd@AZCe*LfrDbc5js7VA<~*BtwQ z=~XXznxpkw3~-ANS(EYAC%9nF~yucWjD3y#I6A!_Ea z1P?Hlo;NGlLo__Z-pW*Ug~N?paifl`jHlm(3t_*7i-23x6<L7EE~Q3-Knv z3^hBBlPS}bx49EI#^s(pai9I$gtbNSTTj>>Rv71JBiM8YkHMQ0H%pi~2B4OaiDaiu z>9?5|AESX>$#u`eiS^k(Sn7P30D}?!6LkSM{x|4s1T5aH&v6hNs zY?~Ij&8)QIYFZq*mX?4`4amfX%y`H4gF!aX{(rXAHDVKb0`Q29`VW_%eSKN~KjLH` z3Rv*>jC<_TasPJJG#?v@P5!EiJ!Jh%?A@^%hLDC?j}CTh5#AJGmI-Kt6^$nDtqiMk zwQ`#mbiy=aOY`~N;wh)50!urg3=OMozS@N>oD2<_2;N_8MPp{zs(F_}ozkwcTa6Guq?;GlRq9lv^jG+R4red*|C?{k*?MVQu z!UhBwN4#bqxl(I#Kr~ri3gTv7gfvWv4BVWknBxsc|8W(VD}2(0#S;l7f5PSC>%-13 z7|A||UQ%jRpq@;chEws4`jGYrTC$qpoWfn6|1b?}D-{oO4?oJvQ`UNTZy}$ z(wH=kL-t*sO;j*=F4{$o8fms1*OZIUw5dM)rWV(tRsR2y_4qDe?6<<@3r7#{O}6YK zS4;*|w_uAGgH3{_BrIDdUElp6df80LlJmKC(4fO~i|s=oa#Ya~8;Y}EpVIIkL&h+8 z`h%y8P{LgUkVeC{|A^utBCZFC_WD4z!=3OU#X4k(;?U&$K{pFneG+dWfHvHg4Y+Zf zoH<8#iu>QG(octsDNqjk18(@C!Quf?KRWWSXX}KtM}vOB`j7Q3#MLK7#*LY~Copw| zU2KmQ|CW-NVx9-%Hn=*_CvB7Wnlck|Ea$OpAXhihZfx3ApC)3-X&Z@G0BqyFbMYtr z-(9sI0Ea1VR54?ZGcjVtR71`g+nn~bN}v13@N1(bbr!^(K7`#P`|+J7t?$y}ll_GI z@Knm;32dlQoozpp+y;}uoaGt*?QZ86&)2rCZ`h>eZhNvGs6rI4o(6#iJ9ig^Ai*?G zB0L)Als3@Xx;`S`$iQDD7{@!4Lzjj=^(Y_HvB69&adiXLJ1ZbpgV~ALQKYcD7(TD7($3p@!H;Q z&i}C-L5lon!gajk$$wL?hxyI}Re6)S)A0S1Mep*mVf)+Z*uWGRw*~bwrG;b$>D>K- zZE)VYV?B~LkbkzY`yY};<8|c|GN>Fz=!$V~fnyDjPtmX)ceauub$FT8wcc#XCL-&n z8Iwr-Tl{1Set8p~mwE?Jmr)Byt?;OX?^>OYCJ65SlzZdBR^t#9tKbm~S$CNq-D?s}xb}<3kFqXLj zETG=PqWqQ-G{n>~8bf4cr8<6P+BD`#!AVb*AHs~{;EkD3=Lyy1f=^k5%n^-KrJ{is z`&Td}yujIqb& z*`JKkEy_;l7>%pGr51MBeyPKpKQg{`?KcvB-)jrru=)5x9dJI}rK3-Z zy3aU7dkD&i^icH%+lCmUT0gNbD~;>ztso*i?YGwFTpJx~K~5jlBcw3l6eGs9c$j&s zBd7UbAT_%23wjHn9O81#PLz_Vv6z4x$;l`9#~uQTQ#V4`D3Bd1alT(Z*uP~F-W8f9Vl-maQ(-{s<`k0tNQYcG;hM+G* z6a3IcB8(9=DWg$I#^aHY4p&(qV&3R=SmCf#;_P#(%TcLcvz882^iv4e$q#qc&35Zh zgh~m({V+@46Ar!yeWmm85nuT)22qp_zAYC%)<~MBqmb&?Bn=c3kD&Sq^rVb%$w{{; zr*Jfw4Xam;W7{0_mm2>TR+uXmQSJco*gaNt&V_psUke~2P;v9e6+c?gdaLg(?ewSI zWBpx+E+etsrWpz%8d>ZaprCfa&AQ2L~XFfV7!JJ84!#W~!M%>`^XrQP5Q%m&5qizbOsGU2)W=XG& z%YM9(s3)p7NYIH9#QJayI=2;kKda-RT`|(d#liGbVcw}t_`7Y4L}d5u?&E*l49B*M znj{A*&^GOB+KNGs#^;$<$}Hr%@9XIqVXIzh7>M2r7?Wznl(s@w|rUv!Dh~>~2PZL8wwfQTSuf zK6)?g3#=6V-0=xD7;*QBVgjr(vc{wY1o~tbwbG-iqyjQDKs%pP_C@=BbvWaMRbTQsgGk3Py8XQ$*P?elPE4zc7> z9~M`tsGXgHPO1W%_^6~Qsf8`S%<*m+1AokO4awxpXEvs6fF7iS3`~dYsG6=(#NM?) zoU$TP#P{I^%A`r@<4fHmPh>FUJ5}zsLE0WDUJrN}-F#Lbds2Z}%cx2%1Yl=>)8?sB@jsLnLYo7vB zsR5Lfl&Va&7%EiXH^lntJ95N1gkdqBuvHRvkHaZ`^JZ3c`10v*WN0Fn42!o>~c^n;GT_Ghyp$5j)!UZ-CC?IeVP3eh;c2=-tq*5|-@`L-S zWV7c>ihFQM6)Fm7AoxTCAagduVP*jD%P7zry&IK-TaK*CD$;BwF@;8$va9y+a57NG zzp0#U=z`AuNnY=B0N;aG;7 zHXx5^pT)#_-gwIKeJFw70SE6cb~a}P5sgJW6=5&#X<{bGG9c@d`MN~c>KVW@K3DYy zfm1WgL#Nw*&i^nyr+*Jy3Wz3Cq^!eE(W-SCe?II$y)!=sZ`nko9t{xb*tQXZj@N=Z z2_e#oB*uwVdvtYKyPegWWJ}J^9E1{nIyt)_2XZH-rCBmj57w!zRo7Hg;9SoQ7DeO^ z%-W#n80m_0?EtiL*fOgm)(8|)`!`MJ=5gmB6>(_IKv=_cNch6efGor@3*;WMVl^)1 zZx-SG_9eAc+`k1d(=!@w$>2|3gEP>t*i{On!ZSyyO4>wu(Qs;O)&zO z{*tAzQsj2I?EZ_(?6f_AE!B$1^*F6|V;hp1#*a`URAmQsN2{XPv#OJ%a6#97pA)z~Z{53Hh2WJVe8us~V{6TbPuZC_vw!e-WF zMc9IESkzE~I`iP|Z}jIE*?KnKQ2vTh^;OIMH5h%$rXaE(`-MKfjCD)AB`{0N+bkIx zvlNUIy2qMT(rPfQn{Ir2!wie%XLyy2O0X6B<*3s?)id2Jc^rd%b%O(+mnh!r#Rbi&EH+Z~3sj%}O54-sWAzV2EBU z>}Rge8v#P4S9>#&Oe>srA^8CE5sqcju!$0BYd0hUTYYi@f?+oLjsAY}{)n9E<1oL5 z$OP=7c3(W=FAjL5gp?j4A@m?*8XDQTt<{k6YYN4gX;WK2Xvx7Msvx<=6u_mugM`B{ zwfcxT9uYRMv=vSrfF~(Ah)0kUmLrurVJhaNEoyb7Nu?;HIu-lbQbnA*G;Hx_n70+c zU-A)oQ4Vv1;~`Nm%Oa zalGT@e+yFINDz2tYM6`j*hVI|sp#~*+hn|{0{p1PK>B^S`DEZl?m+uw_m1Z|HzMS; z!hnOYj$!lUh^_2f(&TjC*%jiQH4xPjg~uM5xAF)tydz3yWjpHhl>WYR$0&2Cu0!6@ zK9|=pgV_4+!lx=pu+j~`WR)u7ZEeE>ddc;EPoPK4!h9{yJO$JBm3!@@`DiTueBplC zs9-x}yKCL;bec6O{G|;mFhCXV=>;DOmt353Ssx^|NcG<2PGF4BQ>eBtmN_K{fp(UgiR?*Z8am9tV5m4B}AHMP=ru1*@k{9#!QPK2f< zEiUfVqV8f;=5DAmI~#EgOKR9r+Ru+^h0X7fdYyVMJuM{6izvr7_EM5F=mhHmJ0=U? znQc>z7)JYMkzYl4twuZ53^(I~BUlvUnhUymV433&j!*0*K7SP?V9_dw9ylk-l9GL+ zcK7500*eSK)I`hOctQ{56}FneZO?9Pwz;NU*8kM-L_}Tyh1IG$t@bgSphYtuG_I6S zRP#-d+0su#)CD5H z_pnbYPnp+sViIqjNVY^}(c|lK6&$p2n(# zU4)&6siAjOr%jOhe{&};NS2b6i^J+oC*=o5EJhJWk$P*BJU%-fPPf1uCKwV2r2eXz zp~2rk%v3eS0c5`M@w~rxb5cc#<7`!vHFiZvI}xNDQVq5ICf@%^4HM5AdNv;K+YbJ% z>%9bGYl<>48fV0iimR7~9MPl5=o-e++T01NQpES`(VDio9yWRk zGUO5iO;*Gfx*jSKq){X$gHVTBlvBO`?_xV8(77gX)2)vA z0fDNX+nKXwoLX6A;L$hDSkQV#xz!(UM&69z(MLHL*-?!X%Y+?<`i2;=7F#TJ5V>c1 z;B~RO-Y_c?E&N@lWPZ5?Q+DJfC>-s5MWvbO#W806v#61(yIN>UOSbS)gSY{cDM+viRiFUMNPvE|uK$dolGx!wV#f+EN z#i*k%&4Gbg^5z81Q%;l8)9jcC8P-3NF)^0S_SvfOrh#%zmI{uF}de!DYpYAtOSiAfm;P#7`m%WJ%OUM^tmQ zX5@m`syRn}^oO9z@=cuvvLRU}4aZyV+}<`_&DKK>40Px_XM@M1Xd|#HMQ%b?E>J3J zSU1MKx+hj0q@rL=W${4xc~Tx)BJv4~PpTvo7;_<~Y*G&Kry!exhgK~h`2f}-r09iL z8dxC`(P9};DC*fV9mK7Gf>?-1W@AV0W~N3F^}FP8N=k#fD2U6ZY&lb4D}T5F3ogm? zLpG0{-2|I0HXb4FAgS5HncKIWhc=)_y{`*}6vZIj4=`y=l0tHTQSKmOTrtF`VUo@w z?zK^Ob8-XqC8;y~UcP)3EM7Z&7KZgbDgPcS6~{$>nQM3*tuz!R^omUCfami! ztc0*~O28bn%m~;>mmE5$eE_mjdf# z2JU;)bS2ua+mSHiIntq7*DQ)J0dj{{rUlMfZ1U785&<$4^{-#VmtEm!PA4ZPUl>w& zsN((+2h)kHTtVNGL7*R8@dCB9+BYjlN%1Q`|{CHmKK zVxsB#^m;SPD56H!*?{1&aVK7E=-|^_A>^C&yk#4XG{BdVzU&1{yRlf^qh&TOt;P`C7f~h6FJ$W8FN=pqhAa5G`$_4(&(4q(Gg^!HFPGM zuqI@A%C;^{W=b=*IN8H~O-WkTtMWJcW#{HfnVT1>Vl;Z4Yf&601RK4Z<|CyP4dUfz zhif%PMMr-=u4buQktx!|q5l|g4>a;Ira4)aAC}bIwc9Q12^87)TWWr?fz?TRjMXedW#$NV`k-*ACp~Kv42YoR0AWA zzX7xoe{I8I>Yo|bET6J2FI?gp^ld^qY4x!$keKg%j#EDn;#i6Od#w&0cU4$l1UFc; zf9zN$W9-BlaZF7K%8ptVXen#M-KDb33xnOvBNL7CoQA02|YiujX~n6A1?O8WuJ3e3;r;)(*!eGPkaq_dWyW2^;F z`)p1{^*BC18QAF~a{$lmy6BsQFV3=nJ-5GiRp5<=Bz4zR)70ci-pTCyb4vvqIpX@g zC?j{%5tkv*Y9gT+vyy8|VPf>JE5ZB;MpKi!gb;Ul!jepr*Ii+EJro7tFGCtKcy!LV z3en)NpUCz0h=cB%YZdayx2+NqkPSucNar4R;Hiz03U){W>)CTUhQX-gFC7s)P29f= zx~pN$lVN@~w&PMWx@~T5hJ3QbX7DZNP;;X-tD9v?Hiw5s&9PKkGRcIjBuU?l!9A2pqh>dw0a{IRz+zZslf0?Wn2yJN45 ze?~RZEDz&DsLw_Z0M>Vh8;RZF5uC}&YK!U#b{>b)(0Z?QE35gSp`aj;LQHlDV)nK| zok5v{6$CePvq{DH!j^Ij;ZT2@Qop~B6*3NP#IPs)gg>p@s&0h{{^rbWNqt*dqtW!U zx+4M$@y;Lv_72$5@=1+@t=X``aR65nm${5k1ZWrHdK(PGWlY~&%`{0bRcxyhvLwa# z;!@Gh01}ZF9;rmnsrh*Ntj%q%MnQ~cBy5=)(9!pYd1Dp%JCyzO`tmdk=s1G-t>$xV z@Azoo+4P%Noy6Td{kl4FzV!N4nycwS;__bIGD0a_Y&n$3mnC{y_2`eJnUyn^O? zxsb}FnY-C1C}HAb;#>;xRL;_&aSmUn6L$e|^!hIU-b-dte=7Ip=45BhqLjS)h6aJ# z=n;&fTaT<}&5`HX_4V-V63?ck-{y6d3Xef&=NG`lbhW1D+quqmq#wdiHf3L>h&Nk@ zG0_=JmttnN>X|Ne@GUNJ(lbb<>^8t-6FF~R;}g`{b1;f33JKDhl~nPoG(V_L_RWcY z82S%L_1jhmMjTVx_}OP(cVjX)bK{Ya3_^Ej=ygaR+h0c5)J1O1aUY)(QbVNJxtQO{ zu`X)-AGY2qtgSX$7scJ(-Jw`<*WfP2-QC^YAyA5Yad#*V#fy7!cXvPeyVl<4;+$N} zi_9eR$$Y+i8Sfac{PCd26ltXl+(7&x#^v^?Ml3dEpzDhGm%vuVuSNQ)E@hPZ==ikY zutC&|v{ktal&LCDnrpE9-2`d2{-Y0_gS(|L&5OX&gleB(5g;DCc)*j_NFrmH!Ie$8%~f%WrsXFEB1fy6|psP)5hC@+Z zl|3Xt=*T>Y;zFA4sERnL9mNk<-k={2*ifyw7lKD1zMF+UBfD<~)^A;3-;TO2LO5^ve!0Tb39gG{ z>KTp1gce1P1@(fK5^!WUmK1S&9>60HJ7sC@CYeN6&Yg)Jx$|FnmPC@fdsLAYE0N!} z;aU=frS-^`O1Rt0z+Jrj$OJ)&iE~Kx@|OJKA~`Mm!lN^5tklK6{o)w)qLSJjE>H$d zN?lHGr@a4jWu!lELwKS#be{worfU`S-eNsWnmPIxDh}ps!9>Kvsr-s^WO2cPbj+~Y%P9@BCwG_3zVerW; zbIe9c$XP@4y-N2!JgAwkCyd3&#w8|AU)YHU3d7f*=wz?hcUikU6o-swkZeRbU*CWEmO8`4=%pp@=F4EG;b^<;G#Z z8huHV&rj`+ft3kr@|-V<`E5BE&cLBsytJ_-lL|nb)aQxJ93qHgt@pU0nlxaDq{RyL zSD|RSSX^qIL-fVtq%xSwVU#K@%M<#Qsq#%f!bdi;;upZ}KH;D?lQE?ViT&Ec^TrJs zFo?8IFGwk<9^K5H%-R$7Ba>bB(m{Rh{qdfwpzVl81N^EuU zL3!cJEK{|W;!E)jY5I#Ok0&g~Am?o*MLk>&tr<7o(j3uVHt=(l?|1cIhB(HDw*&MFEkCA%#p%r5-K7X| zeyYyT@L$SXGd7Ha)Ug&b%6>n7o6!pHy58j?^^y@sO3w#3{I!@@2TGq=kTTo_i%)%Y zi?=5}X9ta^dTQdK+KV{SFMB7yGQg5EMf+cn*p?1EnK?9{by@r zT~i!1Vdif(C3b7c(2xwzW|o z>gv7fk*X^zLn9_T2vKz?2!d8|Mfvat`?JHkVGfN-aIPP~i zGSuate9YHXJu0=2YJj8IQ6(;>^Vyn$2e^B8?vt7^S`uV<7{AQV6VVYW_s2JJVlr5l{cz+Nni%-Hn@ zN&Pz0UJ=SKVC*X{lX~>TxS5tZ9o?kL*tj_q-Q`L$3s)sLdrX#Warm$dHheLBqmx6k zc7f&yeeHx3-`RJ|Sf_UFZ+1HkVCLRhBf2fQq`u19#euZ9Tv;+AeHM=6sZq3;A;s=3 zC$P57895;R-Fa{tRFr5dTn_L?hkRgUgf4{YPbXHO@t>-3WXSczNu!Y1*{JqLcxj)m zgnoGnS#O-5wPqGrYhpWpq=xNrAbnO>kIa|Dq~FG#_&qM;&hYK5t^1yyp6rhUjH1E? z)K{VlmMRL8KqZSXM8^O$=6Y84tggaTihOzg;g6Mu2C!Eu&hvJ%c|>+wjp5!k}ysb;hKMR$#bO zZL#-TN6&(W&x;Oc<)=(Dx!`ld+!qrMiAsb-Z#SMbLFMXh1 zI>OV95+X$G%hv#s`V6bKo7yH2BCC7iRY?~&Mn!h^>+Ey+W$XWBcbs9UD|uOfDbR@O){zPSw9#1Ye~V zV20mJo)opW^I{ZE^uzvn1;=%2?FGexl430*MsT_|{@H6IIFtNNb?wwsf?Ro}ZQghD z6beT8=|L>L%mN+`j5P zHpEcEPI}dQXWKjW06Qc27|_eGgX$ObsSn}n+2AsEnz|agsVva?H5)k;7^9fMzQ#cr*o%dTspor#@hrq9b2 z(48Ehz=$;gO=EQ#r<-MCj{7*W4DO=HG)}|IWYGt+5&x&wM^KS2eZBncZ^}4UjV3+j*|v5ZO`G7y z_;G!9OuzgEO&0RUUQFFZ)u>fi%3Ia23k`IvA|n&5dpm``KF*nhWFa|ThQ_Dzq@ohv zLAY44q)iTTd!-0=!{&LIrfq)YNero`$}k3-ne=aVuNAocJghE@jW35Sz+Z42kfkF;ypALD&zz&4AKWWZc`<}>3z6kZ>%g<-)V&=555Tn4-UY?)rV7Vq)V(Lz-Ysn0s1Kh`~h?0&~ey=s?3&<9YXuY(*FybWS zPqNXJMlCl54vLzf89<;bOkMzml9(G0x$dw19!sb)8CdJ8+_i7u)C+;`!=%H|?Siu-pAfromVJxys5?0}a6^vK}g9R=%&GN2Bjn zuKyp(pVGxQ#Ta5S(;ZUdSQkqyctp#GnJc`S9Y6$*aCN>|sMYiP4s>&0ViNA1dbn&& zT84O(h#VNzYcL`MVIoaf6h%egm>JsD-|grjG*4J`)o6$Yc*M}LC8rl6z5qG-m#?%NTNyy7znkv^cJqNf=3g`%ql zU?zMKvMYlV0<e87J0uh^jb_0>|gaBCQ@X=QDQ#!fdr5CsD0I6w;VrjHm@co z;n$dH#rDD_7)Dz%fTis9{KV2~GhxIIZQ8Vsz2G_Pl9VqT-_O04`<`dWDMpdrP#E<- zz&agJ*Bl5H-AlC`1K=ZsS(2gqA=C%!h!@x=K2*AD;0pltP_0ua&`8w2o0cC+ZobIAl(F~e1pwSveETfJp z|BKOGUz3-ESP``q#K|lJ?VQ zs7~soqs3Xm*|EDl*xQv(f%-@F2|n&YG<{kH%0ZFrN3*NwaKF&@yfK)Ba1_bp0v_7e z@FrS<(pl!IXQV zy+)zVkz>EDg2%4}cR041ebBq5;|%-=%F}U!%@V*S6~J)A`%EI1iU(qGKYKT#4ffOD zRt*Dt$J2y+hi`?h9((X)LR|B7Bhy$6wk9Uo-X6r4A%xD(x_^%^1%@vWi^P*S($hw7 zo%76UUnO$0ICnn6MAklTB~q)%1JF=?;Y%={E-r<)3_m}JcQTq{C^qnwrsZ*f2sG2y zOGyQN3&a;&uYvClP6kPEnT{F?lpL`w(jesIOPPZ@Z4407y58 zx#xOW_&boTN%}nu)Uz**ng}_7413&^BSS^zu1;%`KF%|qYBZ}QpcbZdI6SA-*Xwq- zm35j-w;FxvSF_RCexm&*$9dZ&b%bjlZ=Lz0p*s=MT%q&b}*3wRJtO zFut2zeU+puKX5m9MvMmcm?2)$N@ntr=Z@i#z0v_&*xj_B8Azq9S_%kTdK+ET{ugcv zyo$5+Jc2@D`^zCYfzKrT!@jJ#@m}?>nQxVcUYW)%r$&u=m7OJ`eB^*w;)x5iN@wgE zzm%XaiJ>`=V~2*$0P$TH9pfLJHC(ic)@C4Dyn+8CDiLXRvSHj+I0b@002f6W{j7Fe ziENamTHUe2^f~@Wmb2X=rWP?yDqs{8eaiX^Pa(-wZR3R)O5cK@0`u+a{gH>SZue~u zZu4_jmyh_EwkR|}c1i0Yrf%5UuUz~A<>6`|i}+_sfLEDP&-1n;509`UE3l}$u8fI% z>IWAjUn2URubNrKo@6Vr;@9WzE}6w@gb1?*6N^sIh>FLq1^D(g`kpYMijm43!F~l% zF2!XH0ba*QasgNQOOX_P--=d5lD7mekSIuy2k;Xp@e~Wc;A1yEN&%**dAO z;GsIdTV@1D_fOeo?F$fRFw0)!nanTsdBFt+I!j0mN2wMi1ayn}2gWEfD9}zJtY6bV zxY3N^+-abK}f^xc7l4J(Nfrzk0gc?Bj39*PtBwQ6z5UwwvCEdlf=%Xzd)kjx8yIL2;yIQ z4s;(qo=6XCb0d7~(FIhplsE3cp?{}79yDu&DjUTzsmGd%?!9pDo7%aDDiev+s&rG} zAc5+#e$Y;OSGH}LacG@?Y4G+8Q!EOdu!tWtsoBU3^Rf@~-$5A!mTpmbZ*p{18;u~N zif)UP{64_k`5OvX8*pSG!2KJEsD;=J9d3eI2+Cl8V3eLJ@LVK_?I zmX*bb^dfj;hYC5S&VVNVeNv49J2dtUAL&qqS%ZGSdhZws3DzHrE=w`;n}XDa-4N8B zfdq!kd=@7kh5^+*jkJ0Db{0ry zwoO?ku(D93m3n+-o7&Gr0I$*`v68@5vq*@w_r;8^N;QglB+tMx9i~Bcm;=F(OhkOq zJJWGXt8#oFF7-m>i=<3_H+Beq#`%csOR-%xAD#RWXyRkz=eTHKOcQ^yx196~p1 zN4|G1*<&h;ezKHTb3{IJ5E-%KjONWF-A?c-eFlMWYE%739szmyYU8;t>%*SHP*he}>GURJX+ve}_Kl9L8 zTXyPwKRP?tuClRvHp^U@z0W;NgR01r&*xFQMs)RVJ&zGb%Y9@LZL%)aUmTt%2X?|w zcyExjml_XlNfX9nde6H&eZCn!ybccP_G06}#Cyvs*sfQIZ^1 z8Wzc--YsT**-VfZAIG`M{61R(;)VFG3Xug)lw$6K!Hw!DxyN6j1Y)))`F_F9(|3Lw zeN?@8zHOY1pXDW7tk<_KP_dmeUcULb-`8Y5Y~*$S(<07A*% zl&iInH=ev?DQeVfyBOZ{G3a40QGULhKcl7d)lCIzH}xZDT{-C8KbkadSK<`!;V3u6 zy$qkWZbBMlb;%CLE-98wEQ=j$Yb045?dz(n^;Kx;uDzy9QO`&77M7Ad9|E5ZKX6kS zHHIGl&l&*B1`t@^-2=gXMcS(8Qu=?%Qs$UFvi)hs9{qWj_kjuGXM=V<%O8f2PP4&< zTg`>o)qXjWW^Wt2AIq0h1p<#Rw)?^s-ove=R~PTsN;}7!E*H3TVgy0HKX2$AxAr(I zv;X;(g5K zH=E(|GqJ8;oBA^5Jvt*78RrR-EAb2+jA;UvT)D>Y5|sJlDDtBiD%CCXC@op1avThj z9GT+gy=ImM&8mRrjb4-Y?#&ItR>G<@SEe6w%`hS!=j)H79-h<5@9!Yu-0zEIebI(h zX|Wh-IGkt34j9r4h_3E#lRQVt?afQFWVW`=1xEhh!(HlA#;s)cwpI71@!u_V4wcly z*N_99T3_aCXbYahOxw1;n#Dsy%eM5^@^~~*I!risb^lWDKws*#VE;H~-YXSrIQ{04 z=iqt1LHcH$70zt#$*}r*YnTfwld?fC9q?QijT?(Stj3P3SGI0TF^4KMq~+zvrJEER zD0`E2CZuup2<(1cb5roA;BPmNTvs|3*O$z|0Q!1n2XcSUS+RRaA#QB2y&QE6GFo4# z(O%TOYdSKR8L+`+*nj=uBYIAP+w~^0Bp~(6xI-du^eH+Q_#lnmj@`w`ch1{-DQG{e ze%CSWLHp^k)HCw)EGbR@y`jc_(D{c)>>uU@6rYFaGr)d(!<_nv5-yTI3!RS= z+*k?M;N!ROlV!ro*eQ7cNMW(Djf$ox(&%HWRmA2&xt-R$P55OGsgR#g#36=)XGpNWu zd!aE$LVetelrE8DAqA{RgIyJBBKfUd>zA0KfGhsa{kVxuiQ&Tp~JV+sD zI*fE$?%Feq2F^=%sfv0|4@;}wt7oOlQ~65bIUC+sZtb@x;XPOsDRx&D=-L;h)0KNU zP@LM|SPNx_kK2W>?*=Wn0PydMRzdUO3H6w)!M5P9vBWr8h|ex+#S8RHC+SM1>By^P z*J~afp%#sjA7pvzwkO@8GjBC8dC^vWC!<8e&Lgv8MS6g8<)NUhy8{Y|mSqS+4bK|1+`8zyunMuZ2f zbt1&AB*;Z5TAC?>Z+Q9q=j3x(*tSwCP8Xj*Fc^q`!#)ECvKPqa;x_(&68s=|EhLZ9!S}g0-lCQ&N93v&Yvky zNrW_Q@EeE(v+erI+NEUJPS7vYkussldiIERb;EaJUb_kXjVuIEEs<3PN~4sd&Iz`GMR`JCW=NJOr~qXToCbozJ!6ZX6P z_I4VJ%kz~F9T}iPhdpzF29q(J8l16<7(BpXS_T1T1Y>P2nVVNp1>SFf~a>UgM`H}ueX4|kZpE*a8)gvD5uYw zqyK=T&+i1loFU4b(|vMK_ z;_NXQ;PcM?me>;*DpBnJ*u)~YD+*ic>j?kL6JF7chl}5-s<}_4)%BK zZCd2jD#X;H2H+0=*SMKr_0Z~&8zj(Z&x#LZFVq3{Oi-8UKnJ++tXvu&T5bU z@GFt(0lbfJDWr#gbSF!gTR}9D`9ul#&Q_%O6BXuwP1szc_!$XNpOHHyR8?G{5qm=}nPz%|qB_kiv#q7~<{hCz$l#6wR7=RXXUj1ti)o zvQdkq@jVTLxf!ec4ONd0|DPtJXFXI_N!b;Al*w3a$|I3R0tw{dZQrNFJpJHO`VwW^ zL*NC=kG+Bru$S$of0AVa8NRcXq%GPmqTTTsJHMdAqY=Rh)-?(xQ!Sges+7IMz04l9 z{7P4ZVfY#mdC2isLA?xVHI!Tv7ZrOGIamRbgd6(Dz3X(+aA7iZVYt@_YFa}6*_v!Y zA{v&(F*!|A+6!za+$>c z@tzBmf<=l?2T5!=+QF?*c7ng&FUi^;hj|o15vzq%LCm-}=Pgw}or92kTVJ=NJX2zzAX$ z62bV}4bvw~D#3|N@bC(XG|zN)T;R_RV#QlP1MPB+1j3;16ZWK#; zXnR3rDp=0*a~0F-yS*_sWuX5JmuHsqj;Ux#i{<@plZ;N6ki;TQoDJZ?qL@-UoP&uv zhl7ULvkvK;QU78-`a5*lx4E=|P1-@DXEk0-NP+iW1qXvJ)%JT9L?JjSQPYHC8m7BR zkZ36&$q&GvFU~}=)2?!p9@|?R_Pn!XaPh`x4R!$>qlIi+)#a38cD=5!(`?f+6j`h< zw}U#xX9%y7?Qj*wX0RQ$Szxe`%W&-JJ-890zObLy#Y?1N5PeWz9EkU^YJL?SoqML1 zk+kX2GF`SV(yKO=Eb?m4Ko{YJJEOv01jz#C_79T5qWqpLRaht1Crz5mQG$Xdk~N4mTaK(SL?OWh&)#H zvCX^1Svpn-(a!E?&Qa%o75g-Yfp;+%oQ`vXRCvQS1upq0w5ES>8Upr=X*Vlc{hM{f ztBp^aboZjcxo{g$%!3U&5`2o{kKLkIVcD0CIc83jzT!;wJVnbXiqRMG24X~ZhR~(^A9X;|vwd-Rq^r$j45U(Cb9ZFM_UN&Sp zm06nJ5I(oa<=S$c;>F?IwWRH(fCKg+!XviQ&`kUmN$mwlhZK!4q^Yq0jl9~874qYn?@z?o{|JBWrxyR zL@tHJ{FrXwy@G4=!SPD+k?_r4*b76-C>`tH^OkZo7`(Y{Y{ABW$@30M?M3#ZW(@)f z?PS(c2b@>!y+?$5Re@ZJOHK8MXs#a1Bc4Zq_+42gOcygkJJHma0=*IPDb)(k6&Bt0 zG)~vp6^Y|xb%t=9bBVOP*LmpJ=OmB9k&kR;N2LXfjQiB8(-ON_zj3~Y~=x1rR{sAO90aTDU;nqbHKeKM6n}DEC4wK-v93+dcn;TpED>ANEQG z!MmLqIobeOpsTRJr|Hrrsqg3NRIM*YxVw)Q%kx{Kj}XtpWy`kO)N8(<*TsOZo$%*f zcf;z^a%7MH*sA&w#t^DfNpyf5XJQ_lK=zrS8DJ+ccX2$1jif0pC7ro66X{m2<0do^tj} z?O(lp12qHAvtb`Uj^8hYKKGtpr%-F38)MfD{|78U_xh(3i2q-dX|=z}_-Lf?U*Xk6 zul~O%bM~nI--|iGN4y< zb#wumv%jfKSWJ9P#=S)y5Uv7 z@&36(&*7v08^hTR22&o!-^|;O{dE^T?-NO9lJ?4by>8hqCgbLq2h`qk$>4}dYV|%a^!@3_NZ# zFf(gPUu)mX!XH~G$RZy2%VRo>|(!xS%BQEWLC^`7n&(8=y6 z@SXcK{ zg}q(TD=yS#J~(pMrTcMXDC0u{pXQ>Fo6WG%mR`+D@<)AyRK}gQ{P)WO&MSGaJWzlL zwNQs~PFtJNppB|+g$ZyKE_MZ5geRZIU^n8|{EGVV1&<+R=lHq<%)>22;fq z%Q^sZUk@Z!&f^MdVbAUL@{WG?3PZZLPiQI7W1;}Y0RtJEP_?mcslT)1|9pORX-2M| zEmTaHu0a9#yLsgcFt12v zFP55J0k6g=qzBUoOV#OF|4OH7d4+dqG6TPKn4f_L27d8Mk*Cq>*RI?FxQZtLu&%4 z{edx0@0STs0^(MAy}w{TC{4{@9+#n_gb0&*Gn2%s(9ofFMAofNNLw&^az4rb_BaqQ z#;WxHZcE*=06!NUjslIm;}ezAD4tDV@8l~!GHtA*fGe%zH_||?l7~og^VpZQwCr0M z`te2t>-e~JHqf9S=A-|G<& z<3DB^DI%M_<3ae}E*<8L)xgG@-98Gx5uSVB4;_t61ka$(#5W5U~%}8evV0spW8_AdB=R)^G2q-7w ziL22P%L>GbgxF5oZ-0UShl%{#{~C+sV2Tpu$y0q^Zef^3*a0%0I|$QtnDWcnaJ-)A z3dQjA4N)|6P&ATz?8Z+f);!rLVHE1QcRV3Ns1J&9P<&EOS@%vlNIXqmMuiX;g6Lqh zylewAWFgyRnfC~w zJa!B?Lw(z9qT*2DCI;r(XqRIq^?d;~!>ymUQorYTsq;0*dAr{~42_*Kx8Z2fqM_)f zu`D9vx14Z=RrA%FNxGWw6j2O!JHGj{uIQD0AE)~k!y&DRz$>^UFKOOi$6tkI@*sHn zx{mrumOfs%bW|WrWF(Zf<|)RFheY6no^*arVsv<)$V$lM)S(Jh=7Z;9xO0x$!Ag+r zgn8BJca3uhLzo(dS`U_o8|(C^5e_5lG!X^vZqnJpbyv@_@A`w}%>h$Yi7Iu`YB_Z2 zBHtxy*XolxKp>Ta4Js!Y5M!hsf*XiTC93@Oy8?(VmKaU8?+DS0V%&m%WpapZaG5z` z%e<^-kOMkC>C~y@$S?J)`iAAx1LxYzA;?=;$1+-)N5KQFs}v<;-FECP$xlUV&gdKuX6-p0LQj zHGJ&2<)GpA?$B7n4vz%y5(dB8{39k=@OUXHDjba>A9#i^dtEvB9Wt$ut&9xghBD<# zp=zo%x6kW63_?cs7(~+KA&~w@t~``;w3#sFNQT_^hXBM;uWbK$YAuGsjSGzVRG{%X zznLF4ZAarLAW_{4Nj7V$~n->teA+vLyh^%aRI5wlhwk^iSn#7Xi5GO3qP+dd=sj zn^8K|QKFM(6r9F$j+KQ22+4$Rxd>d6kOXm5Prj1WVl_+8Rbs&NvI3nk@>Ch)Ct&$1 zizvG}jaqE%3S5R8*0Bk6h91E^&1!?iq6lTyFnNY>^m9OPpg8);w|ed-Ldn13%B=E& zKL7$40498?`oEfrNBJ6}92m5Qp3~=^BfIoXy2xWzDB6FMX1sp>XhmA->Eg0?q=_Fj zQSfI2R5P&atK;kb3MD7#j5K>_?|j;Iss0Zr1Rl`9$PAE|bCZCa-teKcQyR5uG-?1D z2k032RJN?ON9~4JPij=&MfC=?3nnuYg1z7G#XN^(gMuaMd)gquD!zc25 zn-%WT$rW;{7WP6d2N6?1EPWFs>aNtfUq2_413EtSRnuksfA1zYJ0q@GkrO{BJ)L=; z9)vx;pU9fr+CegH%YPU6zXi&K^=S@X?6{9FVEsj>{-9cwAX*~ zTfC)Dp4WZS_tJoFGB^Buh$o#2A8FmAWW(#vdYt&~p7{vhCk17`dwjOeBga?r%AMTb zLuz5&RxnU+ya}JkoF;cObr1_48=qWi%g2I=^a^F;Y2T({>Qj9;=|8~?ABIy^JI(3s zk>z5?|3R@znmSA?)(~-dBl^-+`$NLgg{a%W+fS*`@LPkX#@YBfTY>IP^~hO-$5sU2 zYX}!$QBLkf*!e;7!)*OHWSDAU(S&Wlt^V)W*Yhz=%khY!c$ew0-wF0h7HR|+(E2N- zdADz-c5&1HK`~*>-hbfae-H{4a<8E3Gbb1=FD=~S_kk=L#TqF1O-AS#j1Ftwm0n@g z8oK~pQY2(?TZ);l+V78rNdGfMazUuz-fxU=av}RetFZgAqioRzPXX8N5ZS@OTVDM^ka(;eGmKleu?^w0o$-psI*fZB1V zPYy}R9R1}?pE`v@BWh%|5Y3zZkhxHn(VAmrn{Wg1`@su@Lc*X~L-ha)X6=4@i;jK5 zipOE{*#|}e5RJhG_v{?`<($0a9skw5$U_X7I$I*}_aW*G&8MB`!bZh<`8rn~e@^+j z(t2N%{o7;sy(=)zx>Q5FR(J?|SoCk1M;?OkMzijVX``O;8otn|mrmvRgVtc)&yCBcl+Rk0rLv_{hU`E4sd^pzu+J(UJ);gh z_>REP*G-As{aZ_FA;*DVQGR0%Cf1k!IYEp}i;T@`dLCJ0(8r$ zE(+_khn;yB-ZoV3d8&&r^PH|Hp$;9@9&;W##3%TRhN?#smTkX)OhhT3D$jY8`pS_H z<=j-S!%=)5Jh@k|VEQM7EA_m1Nc9_UZr|=2ss0Aff}^u>_`B)>u$B>3+%eEfNcxC~FPZY`Ug6bg>gC+9(Z3kNf!<7%0H=Z_V9tJ1xQa z5IJ?ckNmu4&6sj}d%#=q!XA}?E1A1AYFgQLT1Fqm(Xc5AsDx`A1W#LyG!uZzT8*WE zrQJfVTvi89RD)&|;Qt#boT(vyk5#r=zJ26}%fCt7dk%+g)q?Jx+eaLWk^iHBpI-$Z zNpVU^L;b~sIZ~$!sb>?paT_a=U$~brrt(hUb_I`X7oSNJR_p^!wH^(r)I!T1oT^9^ zPeIBleD|ytk%`VP;VY$I4eLz?Pxb|v7&B_ZqmuE#=3Eix??!X?P1e^1vz7v7`re=X z5$jGcp%YM*!cpq12;(bk*}-%G*A;^g=V0`p95`4bR(|F3Z|JDu>PRJ80`YD%!K%y& zaI0sYQs^A~^{+RiUcL?yp}S`-t3X-W=ao3Sg18`-FtPRsuW978Db&V+7}FeMM4mh_ zg(3f=L=PkObYLNSbV{Tt5YAdb}!qx=8Wjw|ca%Gax6@AeT^-K?@|o z)qS`jGz7_+d`JqBFD5?&l0BfQx(rbaI*p~oD7Q`|J5 zB`^vT65DtLId22zv;dqB0v^QQ{>d{PYCsI)Nsi?qq1}_|RFO*?r6>*=bDh>bK0trG zOfc_^LQsIi{-Jd=YD$Oqa>1L*i?HM*aNBmmcWS5%eI9{m9SkeVadcuTkGkVKBfW48 zCBtY7U!etB!PQ%V)f#+)wN8nPhzuMelM%?6%5N!GYHB3y;%){EJoNM*mm||!axGT_ zc&bZzxK~$5wL$LZogb@+ZDmcesRDgKY$1ppaRPkspqE|B<#iIXuh7dYmj;Q*uP~Gz zs7l+ML}J4}xyyP^=?YL3!#wrN^k?u*yps@R`_;<_v}|1tR&BQG9|lAuB-^i`c~;*J z8&U)q6A|P13}NRBpm1ST1190~_VbP9sg=|Ngo=Q%zkp+ha60;49f3hTAGe#JtXUNX z8g*aL#k4%LVlFvd0Fzx?wBl!oEfl9%>4AauE^@srkLO29{wN(Ij{;WBar? zZv9?W4D;vtORFWwzI)!|7fHJD2A3lfNxIqD8_UgibWDZEDBP+WVm&D&ig9Dr00lE z072idK$&k~T{+;{=s`9%k|hedIKJ2<1EInWI$l0{4(tItG0yf3T2Y*Td2av)Dp?i82_Ty&@-njV=Qk%IfNd2#M4zgd``NOtsfdw)`nD3{nI z&;QEf5xQdH@4EX`q60VOo*aD}h4W1bI-n?aG626>6~!YG+R}$IXS_4U`Z?R0ji}#v zT4gD->{ZQ;L>I61_UfSGC}H?&*5K~1`yM;*U8Er2KKk!7@RN@)*<$Q?^XUW51rzvi zKlt$lu8)(7Rq-|aem_1bu518T4q@%mQ9_IfTKB-F3PB$L%2G*th;1X~MW9k^h z2$~@X?70&~ns8)zcm3z6`3uJtVBJLqhz^OQ*XoM<2S}0I*yEOn069YFZBeGo(670w8#DUD_Vlh$2nb1L;04Q}e zB!-7DuzLyRMdX1xa|a4Sr%k{~i$KGZ0eO$$S2?Lpz7eY$3QuVBe(UPIV+w40oU|%YOpiGbM9n z9Xc$xZuYfMH0Q(a*d|!9R#ch!D*<^M5ejvy%#A^U(SY1Wm2#TkqexHeN{B}#IrN^TP$!CDA33`x zWah)K^DgFga7Q|+IKhsX>ze4#Zt^SV%2Ws}-d*Y?Z?g_wYXN%*-gxjQ6vrWB4jAbC zCPlX_yc38}u`_TOAjOWOf^|x>9Dc z^@?U)jB@=&rz&PMg)tCmmMb@o%^b+7$$l8v<8VPg-IBw-%#?Yvnrp_|kIpt`aCQY#I;hv~v+3h97yKc#R&+ z;l8eu&K^9>oO7rX@Mw?I_>pyz3ow&?+w*ADHj(B<^Tu7RQ*if=hd*~}To~F3K2LS8 zxyed0!~K=yzWV0Zlko7E{NHfr?Z>|f)X{0tX6+9UfsrykAP2;#l->vJkvOB9=YQuw z%*dMsY@qXX-6pZ`)AP46rJC0e^Vf*2-5xMli4g?&=Kud7AWysyAkeI@0$@mAUao0B@sItv`aeT7 z;$C~oPD8_SW|n{rJ9V>z>VlqjL>+z&V57NIJjF*#x}B%&7)s&F&ATEe{Qtw$IYu|4 zKx@0kOl_pL?M`jmwx+giyHmGQyPewY)V6Kg`f|>>_gnXGva<3cSu5H5eV=D5wP?^f zxVV%RL`tUymI%#~ujDtpgm6oOte353dz87>jv&ad95icGUrsJ3-Yt@3|QUS2u8wX zRL1Olxz)cYx229lCJSo{leEwIik(xes8Y8V@{3{0o5_$R^|4iW-OZ#M@LO}e88zq_ zuqJM}BTo7ufKRkVeI~;}5ZBO*cATpv<7KSj&1rAY^014h@f{)ICMpWwXO{Aes5s@j zqBr=w)3hIx@r-|5z8=ZdOMB+qlpcT4n97p{r%bCcOsS+Mj8(9`1shLnk)b9oa*-TEPL}JypBCYZ6xvbrV_+iYS%+@%5Ht{zjqyK#jzwA~SvQ3V8 zW7*}g`ln<7#1AAvQzXR_CeWw%*mi)-RupdbAy$S86)<+iq>y0!bc*><1}yXUWe~Sgj9|0wiPRCRPCo#ZBnp{ zCO*nDytfHxMxYddWwdM9D}#Tei?&7CjuzXzUW7LG07vq zj~a22uf@4i0aJ1W6Q1ZlU@cj2YI9d1c2M^VVNHZI%d3wh)m6HFj6UQo4V1EoR4E*3 zEK<7p+*bYdrYSwg|CB(oO~bwsNk4kB1i{eIn+}(0-`C_=-z2Od`C>h#zFaiwBGe$r z)_{3%=S*7d89y`SMUc%64VZj7fB5j3isK|Kt|91SQ_T zQ4n94`KfAgpEz9m(WQV?*v{%Zm7vzoP8>lRIe`$!hv{O7mvn+Pg0^;5*JD&?AI-n( z&dbuaGLDS+YH&wtFIlT52|P8F+k?tLtyhI6J^a@g<^>$!6k&NRPLx)HfMCm#uVA}Z zM=Q9ph)s3GA|dj<6r?bvBD4bKVnR%q>iHy}i!NJ|z%)UA7cPlxrrvot zs&9pjW2cr_W4dU;^55TE1=%IOSRW3)|0axEw@~!Q4m1uMv)uQpF?&Y=2#oIe}wMCdPoEIO_kBP7=;TF6%2d*Ix&v>3~ z1g1D|g{}fitW*c0=ktbg~+WC0#@1E04&H%=bDFukkLe#6kIzmFX& zVS-1&zHXRbFZ>@h&)r|Q;2nGn1&2$VZpeQd@VxBw=L`m6h|g5;={bLTW}V{+nj;#t zeZH(EFbMYh;tsXj2wOwq5rtq&JFoPA=b={!aC4`*AR5I2;JZ20`pa6W9SG zC~+@}=Qj?&A#Lgn#sI;dpCLI=1G|qTIPk_-z}lpbC>PTSa&ea5qKdnE+OQPTtRv=& z624p^_E9@`a37V88aN;uU~sh$V0S}e8a+##R2sz*s?ri%HVug|_#ANi>d8zq=j7u4 z8)erWHi7O1tUQtqn$h)kA@%{C&O=K)&#|vW$PPpj*jqo`A%D1(amtXNmXr6sITf90 zLeIE^K-D0IQBX|dLjJ)n_1Z#lUN&IEPGD%>oVw*z)`It{%>p#UV5p2Fl~E3*#0evubBw@H|1?y z5eXmxVE!tMl~5Kcs{B&@Ln9hE1cO3Epx5CIX;&Q=^?=saK!OGDDFWu2bquiAhUetr zDA@dXUVGm9Z&CYC-ZN9Ky2FfP;OH4X-9S0x<&v#!@Dv=6;IvJ)%k!fbcpmE)>0f$s zSVxpvl#zZN*uI{E z4&9h~-xS){1l#At{Ds=SJPGi{zpo*7pvGu)$Zx|_SeVJRuCYME4g2un z&YPqJsG%O1Al5nGj1#%Sg{9M@C(L#7a#I+K8CvvJ62J`d>Fb) zW8>v%`;|XK-7lWEdo!!a_$!Z}pLpvsfr86*hSPE2a4OZCm*ZDl$@MBNV9crIorrbK z=a03EyCp-PbLiQ7mh2#MLM711W_wypm@O;Wo-$#Id-W=Zu@KOxEz@i!%0p zG1yRO&=c-tQE@4)?My^2P)qnd;zFH+Ben;MV^bodETwW?BCw=xo${w^(ZZ-nr@WC& z_EtBHuuWL6l8tA74m5Iw_BDwA(!rN1@xcykR#eZ9p@#ANQMIiS|D{H&0%=(qDw(S7 zgZ{OU$n+H~MMkPqHFcbzd5MO48Z9!VZFF(^r_(!y)A%w+J)aXdMNOjo>HhZ_+!%Hj zn5(VJhp*&DX5dnkK8^BF*+Me1TLH`#?6!A99&TQLS3JhA?5I?3`Lx z@=({VBAU!+)Ut4)&;C`V1mDiVM{=WGqpnMsO|&a(B6;xo+n|1%{1C&R_5PRIrg+p|ywe$hEpBIkY4grzoDWPXcx@^9TruMk{X-www82QDn z4f}x|Hd^^P@UFybvN25_eHux4&GaWyI2p^lsxaAEVx)th7c=&>V##Ip-FSaRJXHdoN&Ut(9@gw?G=GX*Zs&`@zh$gd`MF! zj&BAA1bE`nweHos2|!fMuXU?w?pD8Ezj;azdA%}?z)SghuI)of`!~E_XuhY-YnA8G zSwT(BL7!7SwzxzLo$15JQ|{V`*Bgm05rdRTe=ozF>(cY%9y|Kl2Il6`9rxnD@xL{Q zT>7!{*ajp&&u2sZkGr`^AEN^zpZljcfbx*v&O72*Ne&RZbDLWCeIBvP)tT3IZ$)!C zziZxGiY(ufkM;Q-%g=N4l9t>2R&tPo@9X#U_Bi%-MUd?Ex@?zQwEp8QhwuHP-B{aec0TN(e}P?7SeJ>|7C~zHMEd^iSm$!u(r^ECJyZ zJge{2_&9z2MAUy3NcEnV8j>lzb+uLM^&KYRc*nXTu)UYZ0wO6nAMs&7pq8kDf@kaN`bFIPyL@ zys>SxsJ`~t*#!fbX<7YX$*A2(d2f1smtXuwP3W?eGd2NsV1qt)f|KM6jqC?ecq0MH zRNee$1+8B*_IU-r@UoPKJ1=DlM~>?fXB{|9{zjV?QMgHIT<_WQd>h?vn^b4nY+Z_A zrg1-1ifIjzk&D!R^a!;fhBqQ2R>aj_(+<)+;$1$wIQ%5m7@}7d^->x(;~c3}9d1+o zdyu)m&c=0B!o0!4)yra0s+5(RI;q!(pBHkq5_6c;sFbbUCii}$sVXtCc<$$CxsnGx zskNNSx10r(Gi*~QPyXungfCfca5mouIq(pnNM2s0?yb24t3Z3!NCVP{m0t$3y6qny zubx3CM)^ut>oq?;p5M&LVwe7K^q4gDxbq%7Z(1&@K#e)76rPuE{-Tfwg zx?@8fMEtYJWNpMmnYvxBHC}m7A6S2x!c>JJ%y-TAcV~_{7=TopW2%wOTe&Qd+brdP zYB_XjpZG?7fN|JQbi2Z9Rv}$kw!~7$sg&_&RDe~#TBYTeXW>W5Z~D1^ch&z>f2{W5_6hYaWU~ zZ2%t{f(}QzUy{^c^Ag zh;6c-ZA{|<46ob?!hrop@0K8Y#^1a0E@DpOujt3#h9bs_oacHu4ROZV0R}bUM&w}p zy~64BIIv-cEXNMc?n1t`B-u4v|KyMls=b)Pb+h@Esz|P02AoXD`zptru_~^~P8Ht~ z!Z5jT1}3~Cf(L>ucmp(gN@lmR&o8#^<;C&M3GlM}@Fcc2-YpY?)8aMa%qpOP6l01sG3vUR&6@9~rLFr>HNMuo7-$&q=zx7FQ$X4f^OjkBy=ku=rRYqcIQ z;0Pv8SPW4=>eY(p>D}HC)ZOhF)xQKRG(Iqf?sEDx2!~V$#ew19mMGAwF%}TUg@MDZ zRMU7GT%AA_8YcO#iW;sAOr8-KuxoJYNpe<+X~enKeHqCY&DNj6KaX|$1Z@c82|?tK z#DnLn0AO(vJ=^6#(h2Rug{HXIDqYVnItSPKN$$hsNxJvlrvo0|0SOktVwZG!S((cv zVEgCxo;EEVpHI6~KL`?K;1V@=vhwCVje0-z^>(+DbMY`b_?COm@JPnVp#iom>$H4n z*$9!C+)41+pGcXOc$-4t3tF+UgUFvZ6Z|UWyd0qI115hHHX@u#5La}d>_{J0BS2ko zfH#4qz~8ayE-%nWZzv1Oz+!#`P`@m?TM%K%8g*v$9=IU?&F;aRC`A()yFv4?`*z`r zNfd_;HHNL%=^b*X%pmis-0{2v4bhiDkrA%2pu`JlUfdUIchA?SzN)a*c2LoIAfMT$)*5Nl5m&C;HeRfSJX?oTqAUZ z21KJ3IMwHc60}<;8^pQf_@U1@1>Uob;j(473lyqUhhHwpq-&)(t+xNvP63N^q;Mg6 znNfht$DUID|3HGINEbTHuxNLbGkX_sZCH)%rTe2MeHc(x03is{L}IDUSBc*z12*9b zlrnocAya1p(LMBNuzh=og<55^(;_FLgF8P4P;dDjDdTRtTD$3vau`gcJiOz!EFf z`SitVcti`8gvPIwB;&q^P?PslVMKkmQIj@Fgng7wH2^ZcgnjlpiTgoPc$zpdLao6w7Qsf$P`MQTFOD&p6Cz~&v7}1Jk36hchK&#fa;-H> z)}^eO)Y0dTla&IutSrT*CkjEf7=O>D`k0T4srRv`$ zNSEpLHHxU(hzT%^nYd+%R4i+mBVb&Vvm7-`-ceu_F;zV_m48n}B9NIf$sCcO!1nLl z8gt?pbz$YN;wk8pE+mF(wU+w#_$;O#i7_iP9?v6RL(d#bga)(|bO|LkMSf)8uTd%^ zWLB{Y@nIU3C68L6#;?$>CT;rfNq0RU<)v|US=K=(^JgqX-nmboiN<>;)HGQ(SI=0Y zSsM2r|1mB90UI_EYE==nU?hk;J>X6)omYI!3T>e#4HF`KEPJTYAk$`S8b+RISduQ> zs@5OO{xt>jTJg{KwA&7~e~46i)}s>r*+Zfa3FYJcHgV9;DgRUNx`y^L&4r3tV69tT zK}%D-tXpI#)pf&8BA&Zq@0}j%?p14X>U#O%aozf*Vlvrslm;DCd$K*=+FgcE+DVjg z|5q64lgd+Po63}8LaRr;4vE2e&is$dMe^bKAkRTv-6DR1YVGAsV{JYFPpjB$EsSp2 z*=0`tD!K8~oy42t*W1yE#^^)l15_G{>iZ?v()+u4Wwtw9+flo8Y}p^#*C(p_tz4mf zX>5uCh9_exW12l@j_O3U@;TfxDlsA`&VXH}z z9S~8yJbKVT9vc=t5XOCEO=`Kf@G5k0vJtxng&SK0=>DyzJ9*--uS2CxqKR3JCU57m z6q4mt_P?J&#D5!<`roMr ze4k!cW*hAM#c)2DJR^x~A)|rQ*PmP9^aUlL&`s#_PiUsEk4*NmZmP3-UAOm-r=-i~ zKPFBd+9{>`-VU@8fRI^m)mB4O@a-1%M)uC21@VC z{G;_fK}eI`-hZjz_y1u;IdSd=yvto1hbRA>m_+Xw{B{-7)2&j~As(5XwsEQLYG1l| zV1w%Tvg!Kk%-bs+a0zaLCi9N@uLp`HH|;g zR7Na0b!3-`wZ?}KrT>Ft%#A@Gw{16rneqMd(H+peqksEm!07F#pXm8H)RsDw)<8An z2g80x@n`#4XMNz|S8TDy1Ta~-K%jsfV#1oL&6;F9eyG!+RW*xwag4yu?be`O?n3s+ z4_P?03`S01!h`1utvnNMGr~<9`$_s)6Yv}FseRg(tCWMFb_UYaffdWX65~7$pFNXq zYkh8FLF^=0t^Lhb{K%`VZEW(!!S%KBuar*ZqSaE)`QTfbVhj0Kb<^v9R{^gdJAg7L zYjP`Wc7;}5-nIGuM+6JitE+tpL1^+7r0Gv$&+u0R&SOKNPS)J0%k&>FkMCa2E_Fi9 zb6zD=U22JJB_y}T6$^u*-oUCd;P%aex!+6{yNEBvFu7;Fz?fpbT&uUdf{oL(1a4`DLCw|$G2Y3Ibo01^1 z5!9w1TSXGdiXlUPY;@);@-`RKj$bejNM6Qbm4-vz}55tDa#2xcOyAQFP zx7*cm^AAcZ2^VKRj(de^qlF1IvTyk04nr&wf@%XYLD?6*JM|>mm3ca&{boF2lV(Hl z{^pJ8`D)b#b9l8=x0GmiFfTsT3WaNie=C~JkC6dXj667fzE+|9+d-T5p+H35h$&2` zEZVFyS|~plJLT7J5heodc&U^+EElAQhATN4AhciV+D6U!d%;S$nL|Nn*=k{aLm=4MS|x@?7+BvYL;(WB{ZKn+v)8tZ*LFigbuZ)4 zB6!?NC~7ujolV5UH{y)Q!uZ&o?R~VE-up{K{Zz9g{Alx`@FGV_vj$34YCu16Vg$^& z+}c#%7O#3+0br@Zw23axvkT~jiIL%p(W;7-Dhq}fnzd!@+pq00;Z(Z8#(jW7f5B>a zfIKYZmivit`vN#zJ~)egl4>a6;Q5QCqLGHvR=J)Dcya0Vr1#O87o5MZ;ClT z!o^UB>tYUY4)!k}OoA#Sj*5yva)v%rQt8BCG&$YAj-YcgEsQLzI`XzKUTblZha@; z71Q4AeI0|1iXvSLA<`D4@Q}iWEQL6ehF)(mVw4i6h6%^KT08WdkMEa<)l)pBf9yT| zw*g9}ns*O}YxW9PF2pm7gM2gwrwud9!kwti`b0;jPH}Ajlcy}0b^E=i2f<8sesR%j z$w9QoVeoVf2Ms2`DN*zX_vH~wH85W#-|;D#K|aV9)eLy}P9L!2e3UhwW~9wKt-Zm? z%^5UlAzHN|#Ec=tYf*g5YIt-F!l37k801S(fj0jdQ*kvtp!|t9zE3}@1MfLx#{~xUFp5!)x=G~CdXax64)WjCsU0R zEuNvhf`fM~vOHe6xj*b8k#{0sJB|EIIJ zbqLXqH>P>ZC#>*;1R{wGt(@yo-G8tvM1odM;gi*Wrgkgz@>&71lh^$YuWN&UaO4JG z?!g=)mtvVW!ShoQ1q2iE&EByEdMpB+=Szss^8s%X{^uw5uiF|338IIlow9_#E7tSW;e$%YjhPapvsT50 z@p1hFk4LD28l2>wV7Yri9F#}~{Nk%N?DLtH5I;Oug8+m24&+b~Q_Ixmuqq7}s#3!! zybD&Ue}zD?WR5tw*@%%N3X&NL<_ZfhA4v@C9nSl&CGzeiP#TpWO;6n&bTFJ1f)AZ* z1Jwxd7P%6g7kBdk7uB#gD#@Nau@a0y&ZOab&G}ha-?Llq@JN*YnC=LnSM30Z9=|qc zV9$M5DfgIcJi#9~bMj_hKB!jzcMmBua?is$icjIa19PiF86yKq1eQ#Q9_3$W&naPw zE!sFE5cgy=2lE_g_zaE=5%Es41JeCwP#iX0ss@uxTK0(4X@<9VPy;?ZCCYrUWP^@e zFzucth<2wLOv2}WQWjN*8dsuaT~4*P&=I3UBzqtaZq7m^u(y31rfB^*W4VtUMWH|{ zaMv!w$faZN(FX%%WPxH3L70+>2Rxqq8)kg+$t9dz39TLk44)$=A<0LYOt#RHt!1Y2 zVWvR*u)zOyLy**>bmEW&%Z1(ZC#VQ4Yqr|=0A;YG6#!nW-QO#+((?RGqlEC+l%EAJ zbQ?zNc0GHK*L>_PD^2dS5lVI9SB!AYHvsmapof^kbQ;ClQWI*n6b~Z6EfFB9SDs<| z!lmDkolv_ppXL09%Oe^ZoHcW!{m9$n*97@6>iS|iL?r@v^u5>z=q+upEj7Ad8r*AZ zl7A_b2aPzHM)c7(kzM$>Xd&qFPqFk1!@qmjf9H_F-Z@QGKm;Jj8^DdJKh8`M9|h78 zG@?6z=euo`Vg(ZGabsp-NE7WL3x{vg=WK-;$M1$|>QrtwlHZQ81MM|gF*{o6p8tDL(3tBDS zkruD=1#6kwr?bpZo$Nr#!{`EaAE?KfEHrP58u!+bYyRdXAzobn6?|U&Br(PT)?6`n zHs5{&M7wXdC&|*~h+{FXj$8?4$u|wuX*MaBTe0sK)Sv`FvinH&?B}1=KTl`Kj<-#d z2V%5XN>5aa?ddX5Fz&jHnbFr0#ktOKd?V$kBc%{e-D&@RZJR+jk!!z?H06y#rDaO% zNbEGGVM?cz)GS)m%{5yo=zWZF*Dbt)?I8!Ox>qmGxBxpuE7qQ=xRnQ<5wX?P?l`0} zP9CkjCe!MYFQz{H4T;YX#lYe4_rC!5%R{<> ztdDojBr11M~CtE82&{G?PO=qEW$m8^1Cj5sjN!FY&v2qM7_~Q079U!A}`qQiJw3q0V^W zd<7zqJ(s1l(o|^+msfxznD=diPJZRQ zTRkub=;==o4|_`1l^FGtO2>k+?#?Jpv@N5P+UXR}oSQ zyFETB$7c?A(e9o3DY^g6!gxJTME;${%oWSOGR9i}?C^b+0eg`)-#i}Ep4ITaL~?vb zI~e|*wsN7in<8reF;V_cH_f ze|_w{GqYw&h=r_dG=I61w#Q!f3)w8zx8Ki+KfeAl_IyJVS1qiFl5V_H@#*SNur}ut zBf$NMJ;#p{^FcMOtatn&d4G zQ|LW;Jfhv&;=JdOt?LW)S+!D27$sGKE2;?~jUKaL zRiR2tEyRYZLVgkJ^OrD-hvY7TG72CxDuZ~L24Y7wO8FZ)`n$J>7-yOU?9G^R%>>y* zSG~T8Xgp~UwrLeyP}DK&Dn-g`5*m0w-$=S~b)m;bZI|S5NIkU zMA4G;s0>cyB+Q3iuIB;H5=8Zjf(9h*#yveEg=+%j~Bvi2kEJ$ zUhg}ZbM4T#d7n% zyH}(z8ypZL+yOy1>;sDg{}qKzK*Sjc_g#AJZ3Fx9f@g|@Y>&`Dt<$4-{7;Sh05yY(DL>VuG>zxyHg$~$Dk>Q9kW);=`RgElG zD*LUZC^_#rqK9Mx>*3AGGrMzdLICWZrAbxyXgIP%85i$&tffJ#G`+L1F>V2{Dd#%%N0nJ7Ypc4LogS@#} zeb^iofXaa$ipj(89hDTMj3tZT^1~J4oEva1kqV6%{RaK)_jU9Y{B?B2u>H`UaL1H-uBkE9=f1Utm%%%KZ0 znOSLMxCtoqWy%KA(Ynj|aKHDxD|gYHI0}?-sBFeCV*A&?@M#G^her(NR(IfxeXK>j zyL!-+h>dy9qB=p0NyIAIpDO_B;L z;o(1c?h-9q=xV?AmRy$_JoIYhm{?oqA*Gz(sNGx&0FEpKc#AXV6DLo`|8}nVXG|kWZCGd5< zXqL5j&k!=4x)nlalkoK6+ruA%npio?Aq)WiWuc0ta#pJS>i9gQ9BDs37OmbY*$x#8 zPBuS2mexOJCqDEZNrfpbCd9E3rpa+vh&d(`UO^4SDMM#>qz3@85LxahDe{zwLfN9i zxaiKe!DDoCrb_VyQjKe<{%LGH&UJo~X=^b?H2;Z{pcz|nyI0m?TJt+Dr4taraCr9Y zput`d;|IEcS^CE(1Vh8O7<2RIof?MxW(}1{@~BTZ!*5Y*sDX34B4s)%k_Tj?-MNGG zNC>sTNTvju7T2`qZ`7(06i9;935o&SRfEFbcm4dec8-MT4t)o8y(omkPHWeWPw-C>u_oJl(hTaiyXcxnBH_qp{JMVq{g4K!w&E!$^x)B*Wig3X) z$#rZoAD63>3VrmB#HMpgFl_=}44}pBYo7y4vmNLLDC(qh|b|Ic?JH8qJhvRAG$X8&;+!>Z3b? zCAD`_Z#W*cA_pE^?%e2Sy`Xrlo1BMykrL;s*Z0f?NCrF}f|ziKr%xLZ@a5sb9e7b> zsf43wwX7>_N<_;=;|PJ_F$cb&s9Tb4C$@kuwS;aWg1?^-lwkV6LF!HtiyO3?ymSqg^Ul&`sx5v_n5RsFI zO7_4-qZE2&7ec~2rKEG16;+g4dw>#Aly{c|50Wr@Qs~rG$cjb&_=;lrf@*PSX|5wq zVn!Sx;QhS#PN^^^VI^LrI()?l*QQf#WQK@Km>F3#XG!vM&a5QNv&{d}LQZdF`+Xn8 z?;}AjdnR~K8832zJT#jdfokgQ?F~lJ)h5{?NKsx-+K~6-f7}bXaNEQ7XA9r@eKCU! z36fUOqHf^&FG2cmAnqKXPeg*H7z>#(B!=wNoY=4ulb<|UNRlR)wpqTnqIh;TNkJ-E zN+q9sTixKR_M^(%F)yZB^l8m1&`dPh^oU+r9P#&AxR{nMCseOC6bqXE*>r-fzMvwO zq-WQtW>Q9o3{R3UY3M?v2}`eV#Fk=(m*S{NhR(20S|o|;l9O4O)|lWTxukA&+B9c* zttU%1{qYHsB82=PmXt>qBve&|!lz$pR(@smfN^^8&2s}k^nSb{ggUgJD6&%CjZw{d zM(qyLGX|=SmoL-rSQ6OgzM_|9s2=l5j)ZiXdhwR+nG=r~Wlf^W+rYP{<=96a$#Dp= zstY%2l%00!%r?u8Q`lx%V+8=ibI8Rq;Qc5RjmTvUdd`D)sbJ? zc(F7?4xKODl_8au+O!x}QrAYUV(nt!M0;9v4V}r&o^g3TrMHAlp1PGwG|7n$)E8K( zxTheVy9p9l*tZ8+w_5c3$)H$?Ph>&E_RMP7pwvawFKIp!pOw?`^Q+lYU6(gTKa{yk zr1YX*`f9UyX0T;as&SOM=PC71RMe_WJIS`#ms9O|i&m#8F)5Wz4@}t3`o4RxdiJ;T z@YA)e(=KEti%?5?$e?D4G3Cfm`bpmdcY33cr{NecE!E6B;p_bJZAEw|B>hZh@ZFye zL#VME-qVFPvorXyDz+D_L-q2yS(0WJ;NP&652aS%`erx-Jdz$uqOFReElA66^(c%L zxhWmE$>~-TtWWRQM~i-GF)LN1ZkODt{&a=yD{d)>$xzal4n?U`r&}#TbNLEx^Jz?{ z;+g%~Jah3!Wij;9;_um^)YaF2GBAE8)F9f(t`2QNA9*ktUm=z1Cn~OL_iB*Dl5%@e zx)FBWMK2U^D$AbDxhkt50r?28Lf`H-Qu}t5ps~q{PhbO$jXDX8g;=xKhsRHPm6XbR6Yk3-P7~7hSZ%VV3FEgr zn#=#m^A|hWH?8~0C8aIu5_lx%h=C2k5C7-Ga)aF<#Vow3vXT>wfvy1xo)l*RR`eU9rnsC%Uj@{{RPP49x&yNkXwO=Tt-!-pt->tz)W>^aNTLd)s zAY)ixosN@4Z<>eCNo)k3S^h)6(0fJ@N@i-qPHaNQqToF@5O5wa7AvID>3=U-=4n+F zD3lv?t%`wlx3&p1=!n`e?y@{rekxp)X2_9SG?iPhTOU6_W4XR{JcTihb^&y4)rNng zz(56+HgdOg7~w8ivs%eIL!-(J`ZSpXGvxrY=8`7UW?b25a^rhXyl8W`go>KQW7k!z zTd$f8rJr~)uch;A=T|i2&mO$`Kc~oawB*7p8k=`i+l*m#nZ-I4#9LKN{9LxODR{m} ze@nOPsVg3v!nJ=O4;F&H{fU^^Xaiq~p!oQRA_g*7PC}iN*7WqSS_khJlVs@Rp%+P2 zN7-hGg_AI2FK7(|C>v_p1HW+Kp)FW(t<2Z0xI{B~iFQbF-f4Jnc_!%T>2pJSyW7_D zRBH?wf7!Y@*TtDYFGct}vfCp<>*Vau3VEYcj`J_&Y*iB*J6uuM|d7vq=Bn!$cOmC&Zz9Ox>F&&8Y32SbnkJ+MiX2rEO@_5FFfwuJF>4~A4C{DQ;FzLTM(z-|pVoHZLU&j_5?}@|@$V1H zw#pJ_Hg^x!@ctGs1$W44WDB-bnYC0x0Zv>v*)*2%apfLLVBFU^S9pXeF@!k{glTh? z4YAqx=+}-zfBf>FIqW$(p*nv>JwL})9i?f$q2rAR1RI#U0r7p~a-9Ss9lXMffRHqw z6ZY4gdMpDs$Yh1sx1SK5dg%5`&W@qR+3-h4+*okz%)Vf*QLqPcaZ(16-qc|2vc!&l zyx9vE6J#g=%%GWAoqT`)wGey8Kn2bScjnQvei$e)dmf?dE93bbk43LGiZ;$Wv9E-UZoZ}p~U!zYn&TfdsszCkFChj1IX|pJ2%Vr z#XK)o%uL|`OebtoBS5zW245lWW*&4I>l)s-K4W+RKj+~7JCZCwH_=v>eI+x*Cp=u~ zv3U@4EM8(n|Mwb(Z(;qQB}?+P;zjyWByu36b%nEKtZxY&C%}Y z9+*oqooH!6rFQ(?6%A!>!eW+k%n?V%=|!RlYH@S7cZ zH;pR}ib&5X4x*lAy$gzl*Z4IK^i zeu8#=jCF5YTw#fk^fsLU20PQ9Z)zCwcpCb>9V5TqzCOQp2pFD_5uoFNu8&D`OC(*+ z0;8L?Nf;$MMvcJXPz%;GQ&KQXXI%NciBpT|0MQchWbc-*L+$tM3tp~GGb%>ZWV@~c z6|Iq40*WxNT7dTTV{Z4rQ%(0!>kiyj=Q}=s2X~mDd1$YvT#z4B(oS;Z8bZ*DnCOqc zj!Ho_^MdW#13N(R)e!#&>L&g<>aeB(dzSH*)lkAfgavEh)#t07`^_G1V3BbPn4!)L z2oUn=5~2c1)^tV6<9C;F?4Ngo<>cWqAJEirV+dnH2JnDLt&-r-_f1l$k7`Hu*r}(R ziLKAje&O~}fm=JE+a!4eCWqK8zIkZD3i(6^KU*z(kSlD*VAvQNVpR7}sonY|$j~eZ z9=uB#&~JY0F=N&sNSp}_WAZ;~4eLL-HzWO`O(LY4^@JKV#S629bDEUFjLlILHEhg| zW7L9AO4FoF?}r;;`8_s}MM7iiI1v$3bPnW{kx+Mv?g-opy)JU9%n~jUiTAf zO}M!|;2Q?uDria_U7D>S1NkzgmRzL#)hyW<@fxY1y@0B9LDKVl_&mAk?A}Yb0{*sK zve%FQ)~&oDqkeNcARYy`XrSVgM%n%u731VCe9ERK#-u!bj$b8R5a(p`D@$JPvhRtP{dm&-(I)Cs99q5u|i~c z=kz5gC7c=0Q10@kN{A$b(xg#iJy;*dE`QPhC2~(E&8o2@N<>wOh$Sdg5IzX#svAdj z#5pzP0RJFYa9yH&_gy-IZy7md(?Mu4uh_rKHL+V>2B$K?1@zu#0qRszg}@ z#3T7u<#-21D+qhYsj%3n@P-v91!HxB-Kz4<`Gaxh0Uiph1za$&9&5Lb@>>Wq_XR99 zgt;MRKnCf#Jo>bC1HUIKBp7NP46%)P0-@rjiR5C0#j?2Zs4uKEMkK3Q15>X})X|s2 z&KHXWO7$4pK;D`N;c*~GhM-Il#b~~O@23_s)3CE;Zme+4oM2QrC!xBnCzZBC1xg{--%Kb$>dt2MMzb1;#?^OwfpW+9Kd?U20U3^cou#6W`7rLbTLLa^fm+wPh$;IyRdGUk`I2o;PRnWXMs` zCAEv`$bO8}%p448RiSqr{;(^Gx@R4p$|k`J}P6b;?yVX$^T>PErZ(Z z*Qj5h6e~_C?oKIM+}+*X-Q5XN+@0d?6fZ78iWA(mxCD1Sd7i!Bv)?&$zT6+~WF|A2 zUNZn4hjI-B-%EMCJpNj6= z^C3zYtigxWG?gn{!=&kS^4g|PCRu4V{^wHG0@^2EZFL-L7o*bmzXp_k!|ci*c*_YW zKIO|OQML^cti$UG|Icny?tjoj{MRr4#?B#R`zz{Wfx-p|BQdqM#_sy7%;Up3sK^h+ zergoZd3AmXrn$a>gsnbC&B^{p4SnpDrm^{7XW2^{`M(ds|3BZ~|5u7Z!bx%^4vY)* z$L*)uiTaA4mUE~>oPBFpv4?+2BX0SUOzU~1O-h%J>!0lT29;MWGg=X?$u`sfcav!*jRdwd4s82vtDJyeFLu>God{j^F_(B*IYkFldKGx7=3zB+hqgn=Tz`OH8X@Url-C*!K)heZOBnkK~OS)EqtfLU5J8^EK@ekSb!1EQvgo2WgVG3Bhb+&$^21trd9 zW~>rKm7IR=;q{VC-$hyW_m=;u&uDqv8BY01$;%0!vXh79-kXP>`U)aX#GYnvNPZ~0 zaZ+3-s;AJn#)AtX+uH>`3i4haB_0;B@5y>R8K^iil&;EQ&W^;in{`xaxeeJ2Zc9yS)5Zt3S1Xv~F;j>-Q(~ zKz>M6uCx*CoXfyr+_>$k2K%AyK|`DiJ%{N|$NZYqP#QKe{P*sExG#QB1g&2w3!y2K z@KQ$yPn>(*9K?%Qg_@H>K_19i{U1B}BmHUyg>fzxLdW)lR|&+1&%^To_8t^&Pi)0l z0;ewzUnD|^QZ=#;Hu?7vr_82;HoSi9wD3^w;LVNUWw<-29ix1&6xXUzfaN1@^@C1v z#S;r5+m$g-O{!cUrog=_s0k)9puqFk(Q*u)AP)-Ix!{g*@(FhG?mYd9^91WGLY|;N z^URnWIAJBxttUZ;Ey}7PLWVb3u@SLg6}RmL)iD<4#sP9J@3WgC>*HC7(&nN-A;(U%B+RBcOr~c1x0+Ig20EH$0;1S< zGr<<}Ao>N|)_tpbokjX=c!F$vNFy7i3%8cMFBdN}IiVcJEr26M9?JFDV2qpl8qL9Sk^;qmO-tz zf^G977RY7u`;#c9(NE16L~0Ylo!N$fd4$|h0b4lurPF{HVjN@1;G1w_>Iro~_|*`J z?q=zeidvKKjg&aPZ|{x*8z<*fqG%l$NTt9}P}mjuAhK(V^Y}YqQw(-^{L|oP>2>+uvPEJqU9J=A~xx2CBD&cP(~s@fIpm?JW47@5K9CcasjEr37gUjIY<^YnU~NwBkbxeYbkw@k_mtNdX0 z^9nhN9rjy3S`A047IREdqbQd>kJ*^`4+>=%Gm<1>cvR#sejUEZ$!CNWa$!haVjsYN zJej)1o0ZFES~u~U{2Qsczu3+bLKl4U34vznc_vUmReW6j6y6WpvW?KeWZKpwt+R1AgGe~p~! z#;v2;DPT>4i4W}qJ`Q|T>v=f)Xs714-{lGm4m$X>b;v?*fqQNI@t0r7q!b1`ujE5Z&kMoE={W`Z zO}}U^m%F#I%WPuw(8d0<QHMjm!VLK_qP24qihX?X4=2atpRZ6|tb-Gs;Fc%hv88`sO>BfG2+%5-<|B z;G&l2Nd!h9iM{Nc5cxenQ3b`K3FqO}dKmUuu@p!tflD@OK)GMDT32T|xMi_3w zH~+>6m1>mECel$z!%v$wlIq&5cd`3)Q#!V1g;MTO$9dEQ%a!KO%tyw$tCsQhu>>>0 zk3KfYM5bOmZF9CJ7;QcrI*CK9aM#>7{u(Lzmscy-?E}Par+Ht+>Kki}UO^ z`(X+PKf~p4XN?2`o-g5B359v?q0Nq7s=t^*NGRpcw-I4_DI~l^2K?YmY91MdUNx5c^N$3S*%vEv2uOQun zrP34n0hSPh#N>v!+6U{U9=AQYY=>j?vub_DkFniAaYs}CF6N|yobR}hl};F>AU#b) zGGVV7Z~OO3K4-28$Vxm>sA6`!Xqv!;apZ`gtH{=(ohJ)% z9Qrn!!P!~ATHSfdAZrv$TC8F5^)I+Y z#OiBb2xK5nf-o*J>{R{wMjQH7l;TKo_?$EY8Auc}<2r8F#pg3x!W#b*!Ag;Vb}?5$CU4mc zs!;*HNFo>Q9f1 z>UBo|sHb^E+hU56!8?a&9T;&>hY4nM9b}N08FHAa9wSd3oM}YaUqVM7yPZ$yVrb-wM=Sh zC=@8E>qNzD$%8(>g%+?Rvco99peVti*o^a^ap`${QczGpM6XnITXU@Y`5V0m$f$Wl z%3I^)g4{=j7Q{YuXqN}I9`*&L>oD)^?;{MC9%$MsZGH@D_L1N)+u+7mes`5ftz5D1 zjTE}WY_*m5{b!P#=|YwH$_7VNC_@z0Z|+_3;1@jkfo%u_<;YKyKpv(E_Qfr2wuvGU z0++fAGE+!I=3{NdmM=xTl1O=l*!@arC1wv%R-`U@T4v*98mnfQM;p>DzI}oxI)f1G zoa!Cd-E>wvH8y_Z-B?a3OG?m@1S!Fy^4vwbVKj!OjlYegDH?njB0s36EPR$(psaSP zUnwWd8oSLjI7e=lNtEb#Q%D@k_9-&Zw8amDNc3+yZwpzFqG>xdw?mD_NMh*m^`v?l z;lA(b>9#S?`U}mmp>xT(@_Dy}cPmy{a{79D+e!XY=ieW@h6GOY=fPF(MmT%{Jqn^5 z9wYY_MK!F%H@@GH7NL@r^N445*L6Qd)_v2)f^d0?tPD!ZRihv@Vy@99RgjtQzg3 zAA{XbrXv)cMr_S%40~pUqM=-6c06B=Vzc>rM7L;dN9WF~J#%(Cm!xv2wgb?beXvdp zwLI^sq`c~-6J18+-5Yl;CWf zcr5+t&g4ir65FmI^EP445>|0kXQiW@<-S^CcW`7>V*H}y=w9EwR(`ZMox%!orF!ZS zdm=%FKlEsKgXMZlYN%S=^QRHiRlHwv^Y2oY#eb@nomvsiRJ(8BwuIZi^Q(_&$qN& zd4glLkviux`dpfIm3zB|D3DmXyoIazR}MEhxGsU?xuUOe2a7_o#}FGz%dAaR4Cj1O z@tlqQt#!$-n}=-hIc5sZa0_I-uV@xqqDNmKqpSNh{jeA3vy|$U@5Gz#l!YEcYVPEW z@CoYBYI9-=B%vENXcAVh1CY!SBBDJ(G5^+7-I09jVe)mL6r}lee(~OR<^8`13B`gp zp2(yZc0y{nec~oQNtN54=a*+I-{!RgQ1PZOFS~^&&X{2;&z|ShdDofi4CwjgXz>x0 z560c}e?%C8D-L%A?Y{V`@Lgh@A9pjE%e+OG0z0aPN&>Iqi?5%KG8|2H0%CrH{ho#o z7XMt?me$sTAr!)Lr}sx9EfZd<`7|5mXqo=jSMfw1&D(H2*T_#WYk4P}iJ<%XrEbdq z!?`eyu|Jyy^w9n?eY{w@yS{5d13{Y1lIhWoJq$r;C(mck@I!(O_dV-*07C)3^SA7H zq8=ua4h+MJcHkkIPCv0Cud8Q&J*7N#a9W$#J*mW=X7XCrakW}7*9)=;o^s; zLjYTEsryYqKFP13#6 zSFRqn&pvA(GIWp$B2zg{oHz8oK1uwI?~>e&^3vNMrn&*vq8uMkYcF-B5M>c8hxWG{ z0y^VXLz^3vZgkvZvwib`LQ*Rp@A%q>`%jo-o*hD)$?c%^gS=S}j1$qM&{|E;4!*s| zD>=m67c7&|fEvTSHkBc?JpU1&jrhgzPxJGQ=U;{d?6SynsfS7gb5#c1tjol(-|-7u z-!W98^UnXA23+1KMqWw%Otm@{q)42PCwdp5Y!`jS0zShg-5Kb09-JJAv0A7&;`KZ` zuO7?aDvxAm7n!;H9%|2|3AWglr4YA0`_{hiUYEt)tCoSi>{qGm+evo7THTAPCRr^z zK9*nS-F1C$oHA7oyK7Sn%BnZ+=N3@y<9k}DR!jK86F^#}fNM0dL6p&lKfn0a{82MKi8EPG3K zq38G$CeTM_cltWDc^E;4RXP$3nQDohRNsS&EfWvos41{DL`CA%u27ny+;4Q%n|%Bs zOxWKokhEW<9AnW;Z#fH9;CZs3OdF=mJfF!?=gP|4XDfb^KF}rdkSqOeFp_$mo+~nZ zIj7Be$|9s(YchF6ti(_^?f^HrEUl_UCZ};9_txgyu8MUErI!^?ltN3zOf#L*q(G}y z9BscbY@c(?FxFRtuNB_Eju@ntvJ-EJKHL`z;oJuR+ln#X0qFN<)NGXR$5$7dJve~)D zR%}%Hevz+gqZV{S+zjU;RWX#iQop5$n8jEzCA!%1Q4I?-6v(nh$Ve1Pf!9oj`JSun z*i0%7=Vq9@B@&jt@wo#;sZLZxDGymcFzNPPas4Q>KxO~JYyTNy5Wwnj;NE=k@-se^ zqu~m04@{tdZW%&cf9vVpMx$rmkEK$7X_6s>%VI)mnGN+@f&$P-n=!;B?}!#RSVM%2 z@p~_XX7X!h02xwR9dV~?etO>Z=cJ{hZkdRSXDuA$95;JSp|viY8gO`Xip$XtjT)z5 z?Cj;_H30JEy?C~B^6Hl=`C7i0gb==7*VgZJEiiOI!^O80^frgw@ijki)95>-1tR_q zb?bL%zMw$R*iMLnXN+kGhH?ByxDdoRv(P}(xbnp)*PJ-0inxePl(M71SMR8GS4ee$ zVU-<1jRIPT4Psb`|7l(pvyOwnvGDqu9yt*j(9D_s!vA;Ar$!)5)dYOcW@vdhh-V&X zaR(grcw2lwe-C?B>>ZMc&! ze~LblHz;oQ)&G?6OzCGgDX3ed_gs`CUEKD2f3ackB#9^=anQ(a@8lT)VG?}9Pviy` z!8JF0zaZv5AZbh)P3IdfYF21i`3u{dk6K~(sCVCRIxnq;%!O+AB-(96S#+x&8eMz` z7l)2Cad7Trf>IJC7X6(}4;dV_Ra5Q<7_z;qg711m>SrmA&{JGM3XV zefWi)@rga9N*a(QDWslWo3y$2pk)3~A|jAPC;<*ZiMx%c8^rlqj^&mw#Q%A9cCb6@nX~ASwf9 z;{{=7nZOG{M~@hvEx0B*M<0S$5Mz}c%oO9>qG0=jjzDEpJk`14U()+)CngwIzAC?a z&;>)G3a=J1X42DI3IPTU@vp&aYY0&=S@=Zxu`!C}p?~^Tea;qmL!cAL#a}~NC|oAf zc)LFwrMiws4o!eb7*5#5)Y6Y+*&AY25XRDVqXDS?`?0G`H%9Usj0>lS$6ehRhqj!? z0t-s|#CZKW@GaUu1DUaPT;t{9RW=*5H@pv;a%qwpC4g_c#1prVfaT`7`Z-$v^gItZ z7!dW`e|VQC6ELEy#`aO`4(-zA;M+K{AR!?ZFR*;*T;0*S8?L>(T`Wu?#cbZ`kdW(T z)s}E(xsGSp6yEXD0tA~iFCS8MW`69YP`9+!^qS6XN@jJ{x&v-0dIdm3RKkR^w8;9q3-WLbT+WY47+v0wT<~RVPK_u3-fKRw4xZ#I|$xztNj^>s1_0P8dbFk%svc^*vK7m-#!+yTbY^ zrywGCba4cy+wcWHC|QsKaPsHBVp8j(->rmyvXYUjm1ZncAf(5fipf5@+mlfKrWv^`l~mKp!T2 z58>4~J)a^}iy=~{Q66rxviP(@j4<|Y_7dM5NtJwFw&_^7B@&kZvovl_K|a;d_NNdk zRl4u^RK={;YBnfymF_p~{-0eDeO^B5MTK~E6*NSu9DPX~vrxw;IXZzrzN{FcCatod z{P>P%KgdF;(U@F+)Ms8?>ZO?1gy@os!&3%~+H&yeFW>6DkP?+5476Y;EI#~Xz%~#r z6$z2DbV*2|=fi7uK^>7x^IzT4;!JRKQ!l=|cMAz9i-Y~xrBhLu0IIT#3v;Cpr&qxk z@usUi%esNXQOj&;ZR-?@bC=n-`JSSQi@ai`7KI>g^8HDD4vEU_Xk4CXOt`e$Je#wTs&W|qDr&Z0-x<0;jZ9jXB{6}=u3T{GyB*zBN{>r{_QJf=7Rr;^2 zIevx;9@U1S%C7#^a$fR6G#L>U(^a+Z(q8!4aEy*+`9@)LmihwQ#HJ}y#;DGk3q2x< zdFh5jq105mloAL2w^4i)J;pM^>@w+=Rvr0iV);WQ52b?H#j;8Hh+pOG)5Qgf<|?BI z2d-2Mf|yee%Tu?RccyYevt{~H6o%#GAm{NUG}~PkXsV>0>z_S7!a1i~%e!ZXzpMWvB%)dD**9^` zvG`(y>}crn8G9;4w)0<t~*xQ}Gpd#8Gd3BNgia;3-_K2QE4Q?22k5Jd=&UEUl); z$LunuGOToUs-iz9a@?Ykj$%Al?jLaeC=jJsKSJ4?WmJ6bfh`xw#Qz*q&s+UI}E$7 zH~7Kyx;DID`!a$>y?o;-UDuWUEuciO!P<^Pf2wR0uHkF*@9SUu*hHxyu@k`-Z_iV4pXmZorTgdFTu|cX&m(63YASeq2nwtNYL)vnGg(f zeD1r_+2cA6KIemb(|X=`e_gU9dGiP4+&-hlKVG!n=XJfm@OQnRzTTeA?02HYKi|4< zUhhAn)q1|))^1k4Z{+m%ki3LV)oyOS)(B<^+O39d0N(0dbICWsvzg~J=l(t1fY+y2 z&#XmHZL4d|!$q){)mxWGwV?0&>r*3&|HJz04lxyAN}=Ex{C?39Z?F@25&qiteE)h9 zpL1XQpl`_0^cXXKetvh$Z!ggEysY2u8tXaqvT%7Hzx?uQ|7Im95b_T~Qs{*aiUzB$ zjjgEu558^nKbMy_2FQvR{x1mH>4eYnzc(STDhmRhv)#tK&+i_Z3CsVk(Go~ z)-B4l?DaYZTQ2OX+F4_Jg`?7J`qirHdWHu1X-xUE1XrAyRvsLWk-w%-hVORiiB0by zzFh36(9ThJbw*7{e4H6qeom`dN8e57RJLm3@~}Xy+Nl2N;f!b`j7i$P4C}3?*7FGh zhiQ7e7tl8}EF3hYQWrhqF#hWzAljzZYsIR1K2!t^*Y9r7+#Lfb3Z2f6x9AAJv;*GD z%Q-gI8R|1mmupU)C~|oo7sXGZ{85R_SLs(NA@){OeY^W8oIRD#)+_eQwJkrpF6U)k zrzpg@Cq$z?+m?$JT*1Ixx`vB&D=zXYwzLV%T> z>?lA2676+`8pqFq^`nX`I95<>dokd6X5W+Ri#q!d%2OioLEFfE&e_HKdOn7Gr*@UecYS3E4XgQ4KFQs(ARYgl-?j=Q>U3#`o{*DQ;sq@G#_@`Hdl3Im zxg$D2Ah1KEcPDU&KuKcCZhG76;B%W7c7+(i{%kt)3fQSbKf(-&{>ZQ+H+-I2`?V_~ z^pzgbp(aH#vzInc7P#F+o;gDC8A+g$P_E14qpvT7H8DZ(1A-h_Qi$h72oZ)a8UgnB zWH4BydV=RyDNd0JS)=WIa(d)tRMZibVih=tT2Xswpl}|o?n7nXvOv_^O+HiP z-6ARS#n&c%}&ftMOpY9@5OwD*KHJHH7wLd-qotfsa{V1NF$^!kHq- zg~ONkL~^5e^W-b?sj_p<>ednKu}Mm@PCgBU2taI+wDmQ@@mc;+{PM}M1033m6=s1gc zmx7Ph4Lg0nDfa8}k zXN_p=5s*axldPJZowt4CMPQMP+GeM~J@V!zoNoY(oR`+VB_~u+&U?(fsyr2E4=+x+ zG)_oUD8neS<05hxFf~@QSzrC)M`a=y4TK$?XRLHn`Dyhz;8?V6gW8Fx&xj|S4Of+$ z=A7vw%QkoEIjbrto&}rp$1*8aqAA<%BUuSgh^AV_>!H%Wb(&nNg7(t zJg36HDATlM$;#Q<_8AyX=CgAZa+qHxH~sj8!n!H(5P=S?Kv@XP*3RZvhzCy692gf| zHAG|~)C_mBEC#Efn-V}4tv3GQ6WEnD^XcY?@ZXSo-9KOc;G=wj7l+Z4q4cE7A@=4_Jw zGenl-O0v%veGd2e313~S`M8#SQEP|7G6ECiK2ikBdvZmn0FY_04G2}66C^Wsx_UZd zU5ljWC37(6M%JS`;(vTh;XMARMdU%hK%D!2!AXCWII7^tnhk7vhhqZxg(g$5P2SyI z0A9}D;oq)Kv7y^OIp>K_zN(czWbtp zw%I$pwKM#;Hxc-e2BlaY@WXPGzyIen>T4F(1H%T*r!7ij`?>S|HAi3_Add5W2QOgR zCz1{3x1mAL08_1klb=(R={odHJAXDY7&r(uDAo20^Kkr0e2EPionG6nXXB6I+n(Wt z2LK0kv^8>ZX~%iU0-ijj*)ZS%)zQE~v`jE)jD)=ODaumr!A8F{{hu;&t-!O$cwHx#Kdc#mqqLuwm)0k$d8PFaP+k}nakrwG&U?S#s$ z`W)&SwK}yFlD;`(yNQvK2od&&Od7O5M3(~n?4(4S1)Hi0VIj&BcsaJ zBfbd}MSl7~X##QSAXoYb(+x>|MHh)gB8)~aXTc}9k%SG^Ze{R+*&z+86HT4fQD~>V zl86yo6Nm39wtE0v> zD)y3-JB}z-p%;=Jz;r|A@IqYcBO4VZe>+QjUi=3DW3HabD8}uETf?=+BTBEU93RvG z>#l(FJSjwL$Y3n4KmHJWq2#DKr%Mt-nmiImd%z>6YsTujfoB9sb)Li**;Z2%6<5k* zBg-67RODhBb%>v@5%Zp&R)Hk9M2Qu0o$Bw$=pvG^hX_N?E-mZ<4qFKoqzcdg!%@H04m6^@v>@6eA~4ii`ih1yD(6Fe_uHto4F*p+Kpjqyw>0C%yY#T6R1*X{dwD0m=FJ0Dw0%Gg8 zI@e1st$u8KNhnbQX!vr&0MU*RdJqeFIu``3Ueu^E%oXJqeBnLZ<9GHHcRx6?v{q|+`Wo9 zX87EbxCv$j(3Y5v%GQ)pD#<8T$^+8h!gy9}Tc!$f<;z1%pK$1W7xyjy;tY6d(5oX` zMT;wn$D8xFS6kYCmw?uB;%wJ+bs!1&eweV@at)V?X!|0UFPt06kg9E|Zl1gFwJ%FP7j ze*z8dpSp9>H%us+5W09Z&f3}yFr3c0QmTGdL)PUTx_E=Cy2qgY^-{;D67#O8Y^KHJ zo^y|10x(IxZ`*SW&0o5^+lBH>n_H6$4Om}l%{*zIe;>`R>j&N+>3GCk;Vysk8DZ&J zb;J{8S0HS>b(kSY?bY-!Ti36y9Q8}Yxu&Xh?hsY~<;~k|lRH;6!S#L@SBQ3S$v=_q z+FYgHmHTbZVF$%Nz*g1al(FU+@J#f0Ii&+vV&5Zq^%}MFw95AIU|m#1GSj@0%AGmB zIg)*9M0_WywLS^<6Yy8_d7yjp65LESyG^geYIczavtnaDX3H<~UYyN7`7{ta^`C%9 zK8)(X#d6&4b{1Bgw`E(W2aNP(}E>L&&t9c)^B>ZdX}9 zYPJP|Ul1(}as24Wcf#pNWO%C-nFueK^6yp5Kiwk^u37|d4rZ;U!bWVA&71xdv81UO zR0xWdq=c+nC{fi?riK;MMwFRIi3MLYIv&a4D?m_-Vj4m7pMpuHg~`45B#OwwLQu&K za0nd)Kk~%PhESy7^Otxvh#NF)SgIhV){c`X7OdO#nlzH*x)hFI>P#ESE;o1$gX-P- zcaX{PMlh@<6XG7XP$gM1Vzzc1rP>(V9LR`!e*#}G*OV61E0aPd_JuvU27dVCqevd! za+ke;g?r?~1$R3w6F-$a=o*O4Xy47F#jl3r0zekdg)4`30IXCMa{TK?H0NRp)Gsr`?USN_nK0PRsvy6mqt!|mQc0U zkl&0%k$P#I=akLd^f79A*4z#>C{c~5C^v~jdX=TvfyrSujgNA@PH@i+Hdjk0^**^0 zw%&};p$g?E;i?W(`M@aRibX~KG(k5L_T8M-N)3<%nM~D|3=fqI7om@)yB|l@dzP?i ztmN)N8eS{P;g^zJ*p~bk^#-r>^+=ug?)t^BRh)3mt0wo8i^mV;sG1q5aD?&9Fb0=I z&R#D`t1Q7{%z;j{!FGI+37o|b~5P7majuol4r6k900qVIOj?JQZKDcXa_ zpPv%NkSvlBD^A-nrMprJ81~dfd@6ph6dGQ*qE=3%J-z*l$3X|Y5kXd+2+Rs-?#w#t zTrJ1>o7`b1Yabftk^6y$+tJj@-z>L_jRuqG%>D{^VR4^2&k%B8VKNd01YBZnzFy#O z8=+d4!Pko+toqg(e-f+nqSRToPIGc=iq!<=ZI|V38Xepc_}wq&Ik|WQ@9f~fI-~x0 zfw1MXxdb@Lh)Z3#?CV{lq2U zd6sO5HB5zWj;5k1I8ABQ`pTO zzjw}42k_3#ICRy-aNGJ&mf?mFz~(^jeCz$S=LPh@1OTAMgQ7DYzfJ1F;A1WM+!4LK zrT6q7DUxfB^d4~Zdpis)6cF3P6b%W57+{6#))w$?lyv6q{7`rma|~MD3l7hJDI?*k zbzo9300ZrP+EZ~UooJa6nDgvR?@zN|*|#4z1A51Bn4HQRxAo3hL{P6oQPfZKzEl+fXBG}){Bb<5lg{pD&w1vM)yw_FB6Ogc3o8Y z&SZxzf49tVzI1%tR)dBciZmmy|$-MFaPi-w@4J(V|BJyK?-W z((u7cU_`|!|7%6OgTJ(HN8TJfr(6#ZW0xk3)Kde|2RPRwU0pj4* z?XU^_z~mq|dVCdgWZ9oEeimpSE}AzC7-$flXi08HZha8<82mp7XQvCuSaL}gWT=-A z=iH1P@DSbI|2`B{X)RWidcb=?KWsZnmb+mW$bvKt-YZvf&NsjR10VQsna(GYTE5}q zgWNS3r^FLi%>;Xrh)NAl)P4^eB!!#km2${0YosDfMi4qi5(cyiN`@laV%^?)$mkRP zZfI8^wUwAJgg>chrH7TlKpd{2uXGA+Wm3!{*tMr@}yPyMVO zwZ}Uy;rBjfOWA<8`^j8=_H1hlN)SUyJErVncDc0iquZ)}G2Ty|2|~|gqAy(p#tcZLevW zasIUZ4KX}=LPuqL5yjm$)SDL6n^*!X=?Q9kD46_ytcMw>rQ!Ty2^QHHj$oh@P$@#mBgBb7zK*3Xr32{?C(j{j@pxJ^ zlt8E&*XSh+xsIJlGp-UR1tCFv^CFQ zTb)~|cn`8+X#^ipn=~LwwF?7Cy84%O2RtdOE;9x$>oUJsIzn*-`35)P7b+DJnbzT_ z5J1CXI|RFB8Iwpn<$Q?q&h$_So-UK;%$~)3`N>yU&-HSXtfKPOu+oH?cv@i4nVY0Q zYqS@yOt3@{f^$X|B8TO&ZY2zeiw*%0NsVz&5GTFizKVwDhcD)$CYF#8%i+KRSiEu= z&Az&S*JW?jQwT^m%U6YThlZ`^hc7!t3Gu{l^kJ$r>sX*H4X414@@N#Rc8NQr?*~$REhq2s^g{M%v$kg4 z?vjiL__93y$S!Uy%QiK%a}YAXz=Ihjw5UX0VCR{j4^m0riU!M+Dj)DsBV?OKB7=Sw zu3A@|K8onm+a=}KtrFyab>&Yuar}Gc zKDg=vR;M71I=k!0?;=sDCz4HE9--3M$Zxr^3RNi!b7&46Px=4_lNp)53{TPS%VyKy zJr811#mVXubEZXCj%(LS;>Af!J2*m}%~B-NRQw`Sr=gDiG!AE)Qts#t2jM3YtKjsb zvgPvo25J2Y6t0a|qYt$ys#q9q#;d`hts)=_Xc`DG7`Hs0?op%udG9+c{VH{=M3?iI zZ*gwtojWIgEfp7QPED5k*e=wRxnNR8P!>0K7vq}n)j*Zs<%>1A`2<-E>(K4FJXI#; z9@AyclrGbeYklyfMG`sgxKeM~>4`n?4CNQ&zS|$ymE$kR&G=vDwh3>4Pe57MCq!YP zd@e>dED4J)i?K%-FCmx7dQHI$)t%Vc=&Rd>B?hb81*4}*8K48)uhdER%%q=xoSebig)zEAAU0mM*NotVd z_}q#|-E*!z7N&5UGzm8PQ4fx4^g0EqR*ctR7{~f6!X53V{PFOhO=%ieY`JEvMfwxF ziEfx(I)nVf&_~%1PG|#$F7W>nWS+j8psN>QX$fFDy_!V`r^1Rg-{rUj;alHGq7O>T z;9@rVOTD~Ea8$ia{%P%?G{+_>vV-(T2R%Tv7x@!t{}!?5O>d{RcV!8XDJYuTqqd(% z+EWzoS9Y2C2&xrO&D)$A>Yjaw-vcP_bQZ+>d!_^2$Dcyb1fLP!k0Ica|Lny+2PQ+S zMQ^e%Xqm?Td+7=M&xVaVUP&;l@_+XM@&Deht_k{IVlwI<#R!pe@w0<2L1Q32uBT>c z%$ql2eTH-`#`m^IwV&ON*Mk+~>+!C%-=9R1PEX!xBN3!h(f@(p6fyk+HADw+1a`EE zRB4NsE%uuTNH*(eKNyWt(sjlID#x7*fd5 zV5yC&kMGOERDDI}wNF9XLmRapsWNDcv!adT7;0CcE1Y&9Cy*yi|5l4eu0KvwuEF)C z29@5c7A@ST^|!lnFsn(GzQjx%LC_L)|B9e2S_T_8GkV%BBabxRm34h^vsLRy(q5O^RYs z?L8`l^iSNa0M;Qq6sgy;D$!C%sUndc+Z>@&s>Op|ftXhtfv>>7HFeGT&Zs%FNqY$Ez0+y1umOj~Fc-pCkG~Pl1V$k(Yd$ z>r~>CU%@UI?e%fa;d8xb-G|pB#AjPk>a6~wO94Lvn!lH{Q6)%y0e5WK!h!iho&iy< zn<(L{u}-9LwS%$rMCP@dk|{d{ylj0A_2qU85J;+|C48MvvCkm1g2H&Y>WI%eV-yS1 z9qMN9A!489G|=Ujs`f5_B4uAB?kO?nN|(S4qu?Z(;x^)tF~7jzc7*|SXWbBL?KN^Z zO~E>~3{#EJWq`6Qcb zeSPTck{I>QaC_GZKG6wx&;$cKoswT3h&385xD`Hs3`BH?wA2B*e& z%{oS4UzfQ%iE&sTSL{D^V@eC^3-8Lp7VnXZIG|M@pu*fB<>=?R`Utf_Mg@B;gZPky zT;GAms0F%k%cla`+dC_ga9$o<6lz@egC^mhlG-BjH%*C%TjTPtCW3|z%3+GAkR&Vy zlFznVrct9VhMWbr<`a#6r15lZ@4gF}o*nrim+SYGLeY=tE-wcR-pX-+L0=`S+juIMK{rkJM`=D*?Q}yYr0MO?&e$NHmTfMuj;Xc#2M9yctZzTi2n+`D+BA z`?|(16v5XRSm&P+pDfbRfKsqCwm1;=I@^xhAB$`TjSlqSRv$=tY;hg_STy;X~#ZJH_W`J=iP-#|kH{xYRy zbg~OX3Dx*NUZ`;VtvNg|FSGG>JB&9pk`H^2Xk6SIVI$j`BmO&=u)>P?@G360C)^5X z2HSX{vyj9#u5^(~4NDS(vEws)z{^`3eMoBLv$M@_6HiAHi)h496MP4rWT)TN4Nh6{ z8-F3m>fWG8R2HkyL8m~lDVE$9c#(SM1{e6o4Y4UPaX#LV$UfEkR#yI8lR)z3A*Q&<(73md z_!s~feQx;oW&mk+gzjw*@IsI?gpt#Mquc@w58v_d__%5024^&rBT~ydu-YPMYG^6; z!_>5KIv@QrA8NZWSt9Up)&AvmIeygW*yA3-z@1rZd=oXWgOV2Q5!Z>Z*TwG7Y7bw3 zbWJ+fj-P<_~@)4{>KOQhQ7WyaRyapO16dEU&dX+W!cE|X3%LD*! zOk>!kx#HfGEs`TDsJ`k`NXROd4_9E)!c zdPYZ|7UQ2vy%mnzX`|~3pQNNIE^q|olq20@{k!Fs?(_KJ?!G$ZQQz;rr3ZK%#U}#= zUokNCwNGJ)Sf0ABrALx~O*jdv7d*AS%+!QuNpm4S3%kBggR)hJPx@1yRHd3C3%O6o zd(}Mu`DtR)`IlfnumE*BL(Rl1o9*_|Ekv95lP`Jvh8wi+RJ_LjL)Tjd#kH>8+CT`w z-D%u4Sa6p{g1b8e65QQgg9U;FclY2HJh)5a4vl*wU$3>_{k^B^)cHGGYX0b&{oMB$ z;~Jf%&+@G)^qX>dTHh!J1N-H2>5z7qiL4nD<0wfs)%at<4rh@k)BC!NEi`J?FkP(CY0{Clr1!8j54<( zMeIlrN(k7-7$@T6ZBF9KyY58g|J^4Wz|gmN3>8pD!^1C2kliYw_yN(wED*e?uH8R{ znFJ!xVoJ4$_Iz#X^PB=wV2TOoOVOoDFvqtM{}Lu zlMEMQN8)&DewLQ%7ojNxMd7MBw~X#fRqIGmrqP&OmDlr#0Hf!D-5r47;3& zL))cVW3okN!@JIio}C?9*pI#$i^`_#`eq}C6)B$?!(!=Y5W}crlj@IaHqO7ySr(fz zmkHVwSfM1UAUef=D@#8h985HUoGOts?ZFN1ko_QF)cl*Q}n+lPR>eD)i{ANk^JUv({i->c0SSr(Yc%o>v%_xFb6= zMlJo1&_&xJ6=|%x2==fQ_Jwn`L>(L{JgGQkNboSSo50X!kG+Svgp6}1pl|EPj#)Xh zaLMuGY@&t+!ae8JJn{kWz{%cx*5~C8Te>iAyWqf~8o60j6p8kynx)2YL|&CS2~t}~;e7YBh1;gbwz0iBibr1T*mQw@l|2W<1PvmiV3CYC zrliv}A^8|gsS(P1+#y7J!f9l3o0G?5IrIn@h7(YR;Rvo*st6Vmcj9Co%bGz9?=R&Y zZM^k@Yh}N>84%AQ&^?|Ag<;E7x_Y`9D+7$CCh6s?Q{)kO-k^z}Oeb!lD~68f2Ojd@qFhowsYRCj&P;ydz>tbVDRvitiOw}zzL*o5PYS94FPk`+vxob}W zHvw1(b^anEo>>KVZ~7`Tj&XKNj@BMNs8tm}p16t7G-_w8rZiN)u`S|w(ZZtY%EQ?y z#M~4u8ZRQHev)<>ZG(ZGCy$RiT-zyflSimai_w=6zCf&9Bt|dKUu-|CPWt;Qg4yn3ZSdKU3 z)53$k<$s1K^uSd@&;JZ?(2;Ft@;{fq{j25uiyAG6_}9erHzz_?V~^X(*Gz($;UQS7&s&ezd)tOu=i&je%MUN;oy!){SO;n=0)Tjtr7Tys zc6HmOb5nMJXoj;zJ&C%zoHE^sp?0^lc2+y%5aeF*?@rNphUWA~#@0bm@+n`T0Z(o% z{?)+(k%O216rB9Aq@d1Ol8#l%7D|rd`q?MdzYME%axotn@73fa$|X8Vz8QeNwF5*m zW2cYYIokED&R$`JC6co1U5-;ub&Q>!>FWzFuCS?(!M=6BPKtb$+9`BlemQGmEl-Q& zb*5xrZ(jqYT<;OKVfM5B?3@g$8J#6R7n&Z!<1ox-Oo zz}3(CxV2a4xhE?h#aIwD4Tn906j~3@1xWhPjE$#^6*QYtrmb_`Ypx^}QZas(Ba;L{4J_|Z(BR*y$!c#Ngf3DR-<6B+K`))&( z8P!)FfD$qQ*RUKcl~);Rwp7+@QCn_%clch z6ylSeI0UQq3Y&C;(j+hK)IKN1lx}6rpEi#ied@7BUQ&JRWX}O@^@Ayy4VG`spP7r@ zXI6N^1E>}&;*((i#GXkB7`a_IzvHl7RI%k&VN07M{DJbGM%^Ygrgpj*u+h9#ftl^i zPo;a>UaC>SP^cCeYF6s;1iwYC1GakD(fwmC*Vv9qLnswK&XYb&xl;SJDp-dCCSoK= zg`s@(G4&*SHAa-J4GI9}#|x#!)bygHJ*po&2?kk62_;Ifkp>Oz0J&2`2DWp_s@02x zq%%Cq%U7h@Ry6sg)ooUEThM?jc|jQ^7Ja?0(7PMaKneJLMHcv`%Qrq#M-S==35Nd;^c5=@Ihb!m`QpeJ|Q8AJPoN9 zP*B7xZ}NDb6<5#kb%AWVibCjC;}X_>>rli{soQRN4{iQd;OOPgc!VwVgQ?P8>yNCZ zEpJ|4|3179-u)(#g3G!9NdibpRoJ*HBfNFc*vSJDta+djNP!nhO(jM$y3Mg4 zhkwDcQvFjT6V}#;6x3>WJB0eH-4vQO*q&0V=fY$~r_-uLir$1rP|M#Q0U#Spl{Jy~ z!--N##d7|98d$#H}1fzu<n@A=^C9X{#@pzX_v^26i2GM}(${}}Jb%d2@tC}qb{;lka$ zEvDe5r4}btpDM)!Q*1%4H7UE)8ep|AG^eW1JU|0VQVi%CH{Q% zvT^aej50cgCDi+{*!fLPCHe9pag_HvW1*>t;LzoXx~H%z%fY*>qlCK704ZS<3b79i zsf19#jkjyGDzD|;Gok3~%lVSOPkjFi>GR9Sw{Vx_1k+>lLS_X$-SlOQkBGFA8oe?vl8LqM3`q1F~u|KIQSUij>uZGSnlykM?=ws)7=Ao z;!lJ)?)M3*yKc}%Oz^YFZTJv8fNxsYL_~Ce-_K7Swj&_^-xFagjM5plT%WRNTqkHp zvOZm!_E&HkR;3`JG>=vIq)f!&eV$l~C~@3$r5dau8Szy5DDj!2AQ4y%lL*%5=piBD z9&_wR)Xho4ar0Z&v^OO|*qCWgqIiM|Rp^;Tv^aGTZf_FEIi9OPH+9}wkd-?he~A!_ zR-IM@TROP9SiU%YjLxJ4+mj!Gry?xcGVo{(xqAq;VK!uT2gkEhRe{c2b8CCo5#xXd z5C9_dhRq_@Kb`Ztjl z+mUtTJnb0%ANCf%1}c3qF@|F&KfYh<#}CBL#GJj4EGaG@KukL?W^ zw+Q9M1V$!y5iGapv3@<3KKA`Pxq;55M};0Gnfl3gec0fMVqUg~Hf&UC!iL;|QTb z6>VAqE722IDT*}?nMECy zE{bQfISB8|GT)&mWahR8j@;y=(f=pdMat(z_EC52BioN-ujhf|VBc1wnEH$YBer~r zi+bI2+HWIz9bFbr4!kFX3IsX|^wupa-#-DEjlMN?P>7Pre55hC4OTLl`c?osG8=Ip zH6N*{Nc9Ho{l0}r-hGRF&8=C$a&061JFiozd-!BF@rpAXOLurz^!r7n%FtTPG<=7H z7?3&MCe}pf*raBuLIe42v18A3tnn8cO>eLHsu!=#cG84HgT5nJ%ex~`W$`PLrfjsjX2sJN#+@SMUUO8mQlVszg5 z?SzZ!6rH}@K;2Nj_oA%|7&8>5P>bMdn&jRocc+OS}=ka9C-L_~a##RuU}ZF!*lxKu$~wW|FjcU#Wy zOx%r4**tbu5ao)eOPN`;mz}F^dCh*Cxs1mC#=M)z?sCCU0TQJ|<^ z#7!!PI!HTpD6-~v`mFZFZIZKpQ&yf_yHIMA-Sb(Jh!|5+BLnm7I@4YulNxy8k^pOy+KU+DzbT_M3AR{N+KqQv*yS zf98t6erUk#(27jKfB%YSb3T} zoYpQ-ZoHJc*&;7?Xm#jT?#|He>W2L6cA@RD!WK1RaJCd9|PvGvS+x4rq`1+f133i^`JPM))mu^P}~9DVM4KlgZ+RsME% zcl`=UsBJ@kyBdFb0dL%IfJnO&Vrd`kea=?T0^BS2^!`^t?9j)T{2%=gI+Ut+z<&F8 z#*ifcKWMI?e<#)ddjL&?;cKOB^D1Vov7|o=x8VKjT-RgUyvfl*p2W6~()3#gUp_!3 zF7Vv4WZRr}`F&d%6@^_|<#Oi2n9m3@o1n1eN%Qf>*COXCKXkd~ZzB}ldTd@*7+lI_ z`jhpN_Y+FYx)BtD8od2XL&NB^B(GhkV(N^E_SMVrw@p%q=L$hzOZ4b3vD)^VEIgQ$ z9|PyW=c_IjC71Kr$hh?qNlU*3IShZ`g6F#@p#v!hWiNzIbalXD!J?9y1`m? zB2GYa-OFg2E&2mJ6pf4VCkJKI9%|SdE>dCA<{(D>9x1bRA3AlSFm(jd%h~HnESTYpFAz?m4rMa(e zg)!2h=9CW|=#4AFxXAp4$)@lHrn}2E5>!xQMU~peKlzNYNH^Z6liT=zS@(S>FO#a4 zL&V9OvH~%LVZ1rY6o9Dw#Y_`+KrX0~ib(E4Ab)PLG-c)@ zLUI@%84=jWpgkrl%|9`~#P$QHa69R*iyaIbTd~HkNG3nG91EqfRu;Idh%L`(tW{wE z>imxv_m(*E?gD?&OqTpCmfS3;zpadtD2|$VELW|D;zw**lJ$!{Mw2rVtOMqNJW9V2 z#?HviUD~U!-rqq)h_I{`%BlWmyP@;Dr$c8Y{&`f*6$++D(CWT$>>%n z0-`G|zIXVY1GtG7@0kJ*wohD$=MA zr$rB!B+C|FH;&VW=GP@0Kh5Tnr2bwbN6c4YD*LmiWQOK%!;|SY z$4qNcVfPm(T$m(x^BVYP>i=I)T*xlG^mFNe$+EJ@w>JmS*AU2Ac({~W-aeeZ!l*^D z17L$cA?vac1rCtVnbc8|@P%>VZc72Tnu#_q-ka3^c5<$*80~kJNf=sgA$boVv+Xr& zGCx@g>~HYPB7K94U=DogHz!P3rx1hr#*0(?i$77GK;S$e0g1bp31oj!kJ2qgFD}q=$z|^GRKI16q4;tSqNu z&yS#?Q%bSQQch#oG+4-xkEfq!^dbbp{;PBQvc}2&j`G-JbNdUNY5zs)v9AAL9dqhqtG~+^n&Coku-NW`EG^tocL<)`!*hrF_&g za97Xz9kb^eo79feTpM+)fY%|M(;o(c5}5;NpX7UY#%tAMXrwKapD+ljr6D6YD(Heh zD-i>>QhbSi^xDQ@Y#+ZD##$oVtz@tm%w;zS3%fCe%y&e9LP$?@e)UV}<0)HmkSk&e zd(4W^Vma!V6!w}{U#q1~qpVdB;`=oQOJ@e`LdakIr33{guZCpU z#z_Jxo>U;6{7?1>4&tiw>Q6CP9nY7vLK74rPwZqpj`tC% zCV_)Dv_Zis4dv`f{A;U&t5tRYJBKas9goBjHu6ty-=Na+FZ8-ineYz$$Pc}}B1WfY zy;e<^x3I1IijMrt1TnA&u4nok zKg7=iSIvepdE4QAcz||fcmtmz)CJr*xHazBgIYb%D8N6=vu5~QKNQHki$>@~?{H5` zQcSy~Wyyy*{&L9mdA4Ky(zpI?|yqq|ES%3J)kx`dgTo6gO~OWdH$KVgUWDlp2Qh zuIDgxi6OBeG1AM5-5ldM>m}wgLLoIIDk9CIMs(xsp7R*P>&061l#5OX-S3Q(ZzQpl6ZGZ=>N*rr`I zA}uKOBcW8DibTd$R`k$j!AD1xoHaHs=; zQas@y+hhtYCayO~spM=9%|2)Und?8N+<;J~$?X!{HsbdsQLmnXHUWWJRZ%~LfJfR` zU$`+N|8V@Qa@hJT?#6L5zD`JRjTOF=SHAIsb~{afx6BnE?N%gaYxi=EEDiN0`3N)4 z8LQV38|+WsAg6EH9Z$Iy#jr+`Fl-Mo#mf(t&}Qatb%dk3PU?l zF;}cOlTPrNRZ}|8fVlvuoBGK#EHvd1N!?2OcWXKoCL+b47p@;Gfy>-EEEK8$wFC+H z=>o+9({?^p;Ndc9YLwC!eO0s^f6HhzKqZoTRNZ_IGlV5nsw(ve|4P;lCcb5tfh3Ey zC?B|cMMc9aZ4nZK@tNk*6p912+C!LDKaOGPy$tEWzanVIM0xufmb@skt5i=7Mv|t= zSh}sG3fTb@o2k;6%`blwe+A4O0HgA2&e+=lEP-r zkM<4QEqf0PlLksNCFci&$B)f^)#(Z`?NG-g@{$njzBo)AxvO|K!Y;d{S1qmnT zp`2Iqh~Q&qzRPmQkJ49j5`qP2A{KTh&i9Ro=A=Iq*og%UF(v^0xO0$oy$ey~^>Ec+ zpag+ZZqsedeG11tHsq-x>_yJFa@p7VJM83*!RMyXj{0e$zt zgYoUno}G!dJEGMb#-qjI7zakSS3us4lf&^9ZBQ3PFXW#@-uC1>$MZ#{7cz&#*DoF$ z4kD{lkbCHG%HTO$zj{xy(&6v1_F)6mMNxKcZ@jUX>~XO6>y6T(>*;|5`r>QVj{iW* z(E1)4DBz{;p4|VnZgRo({sm-CM&cmbNfU6IUNU(iVsCx@__8QL?$ez&?h)-E3i*EK z`-Z3cas@)@gq*z`cqHJdor_-SS-YI>>_PD|Nl&MDx8eSN6SG@rc19JG^A#nanuJTk zHpuI%$NkY+%gHxT*A{Q)w}4acZjrmY)Td`tPsx7|khp>Bs-RB=R8g_qP(joozWe>l zf^Etmv8c#;;HQ5#PsBY)Nk0tO{|{Eo*h#zNzaRd8(PHW~H}r9zif;Vh_c+Y%?Llmh z6QV4pPfBnV3j)6UiPYQOcG=bYM_{%7&rR6E$n1c?+|YH4qgS0&gR1u9B>pw+j~I@O zTV&_fO8EwkE=6kRft~0hZoO=gj8A07c6pNSf%{Vf8D*u660T8cex@fV_>e z0?^qSNaa4>zFG^alrfEu4ILqbD4{$WY-xKv6kjtI`o^fVPY-+tx9UyQ>Qt#5Wa06; z{QPLvv)h?iSuvg-u!y(M-tmIGmL;Yb z>dPKw$KdT*gv~$q|AJBo<`{hpNA(Jf{+M0n#Tu&)&d%w|`L}myJIiBNDS3fqU^n@q zxJJ7*0@D?WzjlrbwzcM-#V^0E-qS3PEHb5GCeW5*v}p2{ayL*Ww1Xb+t)q6~9Br+blWSl-AA z6xV-t%M|&YAVC+wVV64W%_c*lOg{B>K_xdJ2~^tePdcE6BxyvStz^n=bn+PcD)l_z z%Tv@@ywTmI!B`z$01dmmQp^22aR+=jLl#LxbC39N>4^-SMT&2Z{~nEtg# zhs_y^GvSP>-i@rVGTFN<5qJl%qBa;*UlI~pI1N@Rk?gSveSF4sSU=uGqh&W1j<vZH@0%83<3zYX|4%&$p*I2TS z7~7H7xLO;ao?BKwj7P221=s$pM3i!FAqX(w&YyJ?WO39}C`EG!>2>%{laRaHz&+b6 ztxoh;)T*%y&y3wz$^b!sB;uxz{d4FLZxXH=F9}s{xQ~q2`xr7 z!Hh2Ey1;yw38SL>-)EgKjEAHnCYAN-AZ&K)z(F8nF7g_T12~DR%@&rV$&{(m3KhhZ zV3(r6a_`MyGVyRoK%a?>^dlE2AwUm6tugMDpxX}xc?N6iTcsb0Wo8d0J~VBd_n7jl z?%5RHl?^yXcX#_nkvAu7!U6#!@6lQe{%+GHI&B(whp? z{Jw0f^YM(o-ob(6VjgWG>sx@i8sIZHqu|ug%2|xjp8U0SGZ*7u@_wi_ZS-qUoEWdX z`t7`X z6JqSXS<(=z*D`0|-H+6xg0vzgXyCML53Ptd+ zvba-EoZ26f+oz~?NT0nU|Ew-I>u+my%Ts_{?iW7pz#~H2CDg3nV5zr z4xRmERM#Sivqk-w^SWCru5_X>eIn;1-05A0Q{BVV+Otl zg=t9h2U24eup*ZWCJ=o=1si2fOp0am4^E1{gmxODD52k9p0<;3I!Z%vg>PCdKUTp|CK?L5as(Oam5X|e@eBgO6ntD z%!mzgdCj4Sdv+@E*=Q8~iLmfY8}hMFz?jw{HU)N4Msf1-lLi0ssT`8^Ejp`hJhp`U#4HipBQYJwWR7>?jTuLedDEUKd%#YqL()`n@f!@U zhJ-sRoig?*1tm^U=@gv&@Y^ zBsKfqO_VUSh33d+{><#rFvIvjOI4`wP=zkw28`((a{6E|LdxWLa>bXJItm*{*Kz6* zYKQ6#sFnZ88lMx_D=U!LEqrp6NaJPSl3}e{v${to;hr*RR2ijG+Hk+Vw7?a zk-Tl)wGVaf#6+JrPc6IMwM;?4WQynD(T6 zrapA(10JL)>@&U-LEwOw*&8f?KZABZPk$%qGQn+-xk}lllyzt2sqo?hqc=(Itm8a8 z#A`L6tD!db*U=y(^Rw*>A8R8_OCc9LzPDQ-e6fhKz4ji}lxLU(z zdc=h@Yf;yILSNw=buQ2aLj9A^5#OU!G1iO_zT9x_u-P?``{xh@StEx@;A1`2xpqY_ z-fa&mlyPW6EklE-i`&#h&;JsIk~9r}mK-lFMe3jH^n!tn*ayw4Mzf76D;hDVPjcn(y^rSbWOoNcqk zstoKl)hrTsxQTD(+Z0=)ha-j)hC>cRYyVcw7>=g=tuqL?q_3n-=Fg6g&{0FLK#h!E zE{3GTMUel(mB!SI%BLRVV89f6k|E%p8kGEjRfOxeD2&L-4;4qwvI^$^OQ{!wDK&&jWv_QSv4s~yT@V^k z?A41_zbV_Fg9*`$3FO1zm;2oS9bR%Ilz#~-*DzUxLrs^n|IO!pdIjJ|0}CEgSk^JZV&yO%?2xEH^V3R};XMKU9JIV;m z*crZ;=+9V9INcHWPLVx?*=d2$xZ^9-J%Cr-`DQI&bD7u zk)J}a*tAe83$tgVR*o25TQ?z>I$*sNkbT24yvv=-!0QNlr{bH%!OlLQES6n&lr1;r zwpyzR0#>r}Sx%*Cf1P9N4ueZL0lD7q1KpV~dFSjWA7h6`m6pcY=H3tPU=4niIW3WM z|Da4iYi#M6=01XMnzw8*;V(zBkgMeH!hBkzepxCTjAP5)T?KYm{?W zR9Zf3rxE=9x?FFQ5N6?DSkvOL`-XAoT(_I0Xus#xv2Y+r)5a1d714j`)9NdeBKYg= zWbzHrw%swpCb0bSObKFGelY>^W5z6}+}T79WM?lq$3e_*9wM95yhX?Y+U0zCT@_dP z$P`oTAkA|7uJQbqs(;Rt?tIt;+Z-UQ%fvMOy}|xglJzd$l)A7|9%cRCTD!Fbs|Ipd z(r$V?iifWUqIoi|*oLA-mkuLO=?LDa5;)SH(H`wCVKG{-jZUWpGo{)fPv+3w+sDmG z1V`SqfAEs40S!hGt9BumbHRG8Az%5?62OG`nP~VGXsz;wNGqkQf&Hg}(8|IdaQNz; z1RtRqe~J7&aoadTJ}mi-0QFUBGj{QiSb;yvL7Vz1DOtWsB}EQm&t5|Bd0j6Ka=wuR z#ZFwGWfL^67OFwjCvvnITa0z@X~M%l{S))lh{aS`G<1A#;Ja9JI&yE0L%zlY)!{uA z@lBtthnZ|q`|g9XH=3s*&u?FGqyBKFfRdCbimb?jdHVuYhcfU+r#q=u11woU;0}?> zJT{fchZ}?sGp$0lR-~2Hwes&T+j%khOOA91ttMnD79}&Ur@vl#WUy*{wRF|{)F`O< zC)kFj6YC+H?svb_!6Lv zBjG^E5=xME5g0685Pc+vtx&8liNT6dRWiV_Jyfjj&zdMi6XeP&H!{hE+Fuu|m1Ij_Nym0rn`rFKlBl2>-m83wk5hb5JNy52*C{)A^n}Z8dU%?Ka52`to$xl4rmT{;5ytlebC2-}t@Td4vIUELjK5#sY$r!gM2*-)Y`eG~Gbh|2>$Pm@2ku=$ z5HCvM=^BXk8`Mt$hp9=C>WELaQ$(?@0Q{w!A-+b4Q>AGC)&d3}-^$SX2>&)b-n=uG ze;RsCvw!bv>$@+I8dL6Hn>Vf~4jA_rr$aflFIE_j&ZKpo*lqo+r(G|wZDIhrX33UY zfPT$=X{n}^gh-*9E?gPhlR40|qNokU`%Niq&2Hq&4*M#AJptP>81rPTF9-OiLl)OcYsMF;eJNTv-y)W&zJD)`i2B>2rB^4F?hFXTpEJ^8_{g63U&|##}Y*~TEqfv zP`XG9cqI3nkkxUWx8vGeItntvcJKjtKJH*V97P=P@rwis6229hzDgcl!P%sxNK{a& z5BE4151oC4*nUAB^UAqyi{tf)nEH8&7;0X=Z_|e@l^V!>%DE#I5K0aWs&#lf#R{*K zoWFt{8o#~Dn1`IHRjh`AEQ>;Tsb{^jD6SJITB&j6Xc3i^Fh7^DKNQcd8x|PH_h8C% z4VRW?EHz2M7bCv?U}o68F5TyH)HR!{xFs6bKoB2lOVJX*l3>6OTeOzp*&pf}k@#t4 z;_e)7Z4k_5r0+1W6+=p+exqLpc=v=9(t-mxjC1sSX8(2CXWwYz0YOZ)`tm}JA!dxc zY0#Qpd|v4J#9+-9LS_|Qt0NKzhgP8eB@{#=#blA2XMm#lqbIL# zxI;s>ZwI6Is|%;RBgJM@#giS>GJk;Zj-Dw(J}>u}wfL%N)%fvRj;vuX=Dns1HxA0C zV;aTRlh|ox%q|s7f$VqdE`rWSG@O746`By+Hkj`Izlg)A*~?+BYR8G_(>9A+6jS`X zI+$oaCb_fxg8YLcy(BvC{|X$2ZWFmJ{;}sDIP2wk-lD-drf~dH&`jLcDv1NKM%Xq%+Yt;Y-h@FW zOI3Af?tsfDHKvhs6e_G5ibJ{Ed8*-I*3G=x`wyFRguF!K zzURSY(Y`2*h_WsFqy2LShv9VtG2j{bn*#I5Z|l>tv6O za@aoj^^AC)QfsD!ElP}Ev^+b}0f+HUu7eC4B;xGb(tO8~9BJZA*nvt85;dZIdyPoU zy*eyJVKD+ezMjM8UP5k*VE6t$e%`ic*%Gd)9J2m_#h}0suhxXj!R0kT-bHKtSw}BF zM7sQ1)oxcG1gWD^HntzA6w4mLu8g;IcoO(?5x7ItzvQR^W}AoXo4ZmUT9_xq{sx;L zTX5=orNG#8pH@7gz`q<%ytc@zA+Y5r_nPuj_KUeb^4YJ8VuDQgOR2;*@e2*lZz6PJ zZFq4~CaopjuNU~IQz5^{I#WS2}A=IlL2Q4cIo_#L0#KDj@hTF728n)mR59KM* ztAhS8)t{kOU<9pSCCY=;O$&BBIcALC@_;99(lNT^kFIcKwyzV{cX-jUG~oqEdalRw zcQ7GFANEGuTxIx;rK;2p&RZ_iu^nnEq=r{GM;tr*Y&j(oOe(clu`qAhPgR`|MT(U9 zg9F*9cadR@D|n%HeTgtXy^kN-fsARAA=BfbFjQ$H`NHYtx552eFn(~A&PRS#Q)BZ0 zD7Bh2UbOCM`G=yyYAa`9x#gN6XO+H^i1FnBwe_S&-RTnP3-e$M)#OdM9x&f!Bkh^miJOczia;bGvKsC$ zliK;xnbr%y=%T{cqlqu_XJf9lq@#YVbXVGvA>Nlw5$Dm~-zWb}A2uhV4j>M89CUDr>gGAlzJoI7#v?4xK1!UF4-fTW6)1i3x4+<<#ZUJ=(S-kZTY z2|@VDl*l(IA=BFaG;j1%pWelh`Q@bW8BD>h8?YUrWR}kOBYUQn9E|JFG9 zl-8(U1q>5+huiaxac_?>%M&9P%s(&72a>SO`>cQkf(){|ycATj4j!2es;p2?hejh> z1mEpp02?7Es|iQH$^b^E`Rr%5H|fIMBi`1qkYz>ffD%xGJPwK$Y0LN zYQMhWoQDj)89i37jh;Z9pBwj{*gRJQ8#eOMtlP(+X9Ut$08Gn7Da%0R|KdhO6VBgp zqV>E4JwGO>?6o%jm-AnFd2s2cQVjcB^n24M$NwF8{=uSthr)fGk}AOjxW7K;k>J_M z&WUetvj{3KF~?f9!bO3Mq%K3bwImKiqwD&t7^J$F-OSz$;|P+@JAN7P2MO? zzGO$PWT|>cHu2(3-y=Z#`}`-DN!S|mzF0*PSWREib-Sw5P-OpLr?Y4=sXvAb#BpLD z;U3fkS|4>`~`+i;)8Bfk-hUA7lThY}5a#efjCcSAiiGi z&rC{*0b_y`RVc6l2uc&%1CGysU5NOI8MsJ3=-AftNi?ld44crvn1wwnmXTbI&3tY z7lt1szw@id`ITD8 z8ib@LU5oq&Hn>;kFJ_sXhQn#ri-NL1n`;u*zjS^p zn=sBP&{Th%HD{4pNaS1OpjoM=JR-ugwd;qDJ~SYR4!J10Tuv_+oHM;Z;7rswcaQOp zOeppW&EhRy2vo9X>2KbK<#Cbi9F9{;Oz^FdeYk-HM1TlX;A=6_`5~4h9Q{ZtK2}J<(9<|3x$RX-A_4r2-T}oN6HNsY{CAvA!OhBfm^3 z>$)=T`MA$2Za{pQi}LD7NG5mYV;{H3(}gU`s<0-(i~|CDSp44ecQNy{44v z`4G56No#Og%mv6=)u?WRA`0!_$q4E*1zECKhl2J(M~*|MzYc7z8iwZ2*Pw`zMHWuj zGm(XZzDi7Cg*rjtKhXO){$5LA7Iq!tnYb2d#_*`?zQ_L1Uc*=;QplytjbI+zE`3-Q zb18*N7eeZ=(KUEBjnq8}#q0MG#r2a!QUH**vRqhG1uOA!uzz0t!yBo~(bfJQ*dZyV z6}oX|;uDM7h>V)y%_p?pA2p4TIUD0z9XsF|UOL@R!71J9-Vb)!3iMlD6$v?0hn ziDJ1O1B~ZwoKcKz3VjxKm!}P1H7%X-cshmEyn|{BGy4&k|1$X;%^DMU#uPgS-%<2j8hxtXIdmo zg(U$YdO`tlZfsx@#n28~9`9?t%nuCd|F5dI3~F=#zIcnfQ{3I%-MzRKC~n2w-6`(w zP^@^-;4a0A6WrZB$jv$DH}`+WG0h|JbQoFUZ0h0&b!sxR|*`N1_GVt=ylI| z7{c=--f{P5z`<@?kv-jmtfC?VE7#;qB&6|Eu``#Q5p&1@Pero(m-!63ZzCFRs zJyqGhTJ`QG5%h)b*(P&=Rt+}BYgdQB5J)TdxIuQ@Alf=JD6e9a3NfTo$Hzk%@p`zO zhW2IGLSoI2+Il+rL=s6%AMcy^>5t7!pE9jI#qt{U*3DCHY$IZ9tzPV^UPTLNT&}y^ zmLLJq4waDjo@b-mul7^!B!LCUoo_QBx~8BNe&<*HG0M|6=y2H#=r6)5(c*tZ>=xEX z_iD%r5rUVt5in8f)a8>*zn+dvAsJ2?iD;&{S?8?_bVu-}v+E+vRPb5U4t5CPurNWjaW zi@i_NfiL*^Vwed7kp6Oc4sfWgC`pM}`;Pd%HR(~*yU5V@a{ITLesk464s4ePCSV%J z_d%PIaD-4=eWsdZ8^xhK!)o!bUrgF{7557@rT>zGZz0mT!G1*sGK1R^LVE+z(l#c* zZT9TM$;j=(U;44Axeml+m?-3#EM{D1J5HC(hI8fkUirYP0eb)2%8g(LBLLJR)xS6B zI3G7XN-{bfM(alaUQ0*C{)EDlPmNGN1R9DBw4`@fQ?lK=a2S{ms2`Z!%bYb?k~obX zR;pUJkVG}ZxQ7HyC%-rDE)X<=;rz|O&}_z$A_bWePZ8a?(NQzgg+EfRR|P#gLKM#g z)HFJXHG1HJNCyM2_oE#fGdB0HX6Cb9bj)*D9ahDn4IS>BoQ3*m_3eNVZGtA#4}uZ3 zVOxo26hT4tci*;%Z4i-UsF+9>v=~%>QR~};tc4-H`pdBmH(zlvop#ehZy!2RX$#!lf(7S zpK5ENL~90%5qpQ9recM(_G{S5TPTX^FEpw>)zi23Ma_g8EfbJsC`a!8y^9UKRBq$1 z3moi;lZL&e(&x6A!p%4?_i0C0Nl$Pl;OXwmLAI;Dx(_bm2)@*)dempcc@s~vFukUD zJB}Ytx_6DiLhjn*^JxSLl*?@@>Jxkg@#G3tf!EBU68oL^KzC?<*?aAeoSBi$l8GTX z;S&`qPCQl?r)HueRVF$R|F>@@(m7g;+G=&J>_!Hr+*u~0L2Zd&diQVW3Rdj3&`~0f zQf%i3_>zAE-b^AnnBPMKTGY$XP>Tdp$K|205q|?42g3sZ%0aqR@TrKRjZ8a5|JW!- z3qIiQ^93+w{GSjgf2=@r3OoU*LdZwP@`BTTrI81zQv1rO-^d2&EY6MUWsgWf>JB+o z@!ZsXBE_g(Fs)pKW`54H({1bS*t4a_4lG*K9201!{(SlEJ0<~jyE`-0NR^R2Uu@B* zmc<-p%@-ei#X!|^ux*OI;N&H>Ml^KZlJcQUHgVDZu|eLH)s?}8zubO>%fDIASc$eR zNn;jYq2Vt|((VXDodl#Gp5^r0p+C7o13djGbI^SI=RA-8kRaH%Ep zyzE~o8iS&yO+yFMX+0SF)4P>(>K*E5t&rlab>XRK>2u$ac-*8#U6yt?T#*9l{_Wat zA#!EFBt_=G>yzyN4hez(t1&f;Oh&=KfbaXuqWO2&(Bk)v!$ivbN^WJ zzzPouL&I8dLppQnF=Ops-`SO}iF4En%>09sc?EiR8sGd{w0T;he`&&zUqcM}{GPuk zno_$`U`if&?N+-{m*W)*CfuD{5{F((og?O;!s)8^9_-Q&cVU2hC(Y9F9+q1t+jVe{ zJXdWzYtLGUZ#FANG?2ZxOVst09D$7TYV8y9k&gVt

Jo@&kJ;)5y@U ziodhHl)bZ!JN>Wtjax5&%Co_rnR6bk=D10rv7V*WB~n2-yatpwmBEpScUhxz=qYhg=wqkmQPP;>N1 zL-Kzk@uOKcFcTmso+IwgiE&J0(Ls8ltc1Mf`->(_HEGRRwi>N;>>^U~jaZdu>CJHJ z@UBu)i6+NJz*e6bprWNvs;mPRmd9A$YRwrkm5-3DK||@R2Rpbg<1Nu5iV@J{4cj}B zgJ{z~HO5n(+}jTZ;#&WiJw*w7*A4nFTl&tgtBF))cIi^jL1qyqdT@d%XnMO=rh_xHalBY<~81M5d=3X%idPxP%tKXqM5C**secTy_nQwNFaxZIDWReIjmLQ0~+6ZUxer&hwa+#yYu0__cR;;2l! zt{8cSH1{`|`Onf6#Ig;#5;S=-%fu1ePtddxoZx`6UQ5oZOP?;5h+Ar?B#wtT96V;8 zFte{x{Mt!g$;yS2{w(DBHPySW$<=IWU`1b6BuA!e7GU3}Ljl<&K^9@!9Ey3*$;git znjBLfQ@x-{&EgTB5+$8tt!||aZBO16-eE1?i>tXn7~;VDM*!)yDnto0T;WzNq>UcR zsx^;iZ!KtX4+z84NZ6tIhfWwpaS9;2gGLhOP@9<0;dG%=si}TUx4&c-&aFp=o+0 z|5FiK@;6H5Cp(81?iZ)ZLUraeVH>Tco z9(?YDI7@z7JRF+E$SawRmI9v}jiQl`7<(RmMnwqfgy#2oLwJ9gQ;GV_I7<6%R1*NL zjPI4J-RW}=3Blmdt{psaInvbg_L;T7^;fLSSpnYmqwI17Mcf+W>&;6ufos7;^jx0N z)uWXiE3mQE7cpl*fec3y47AV10On3To4NW12D>v<({-9!%VyyYUQFc>~iY#vq(?i_SAF5w41t3v*mzW0d zK6q~QJ6ZPvdtReRjb5X6o3LJAZ>)p@y+bs{4;$Xm1=dO8(L9Y?ox9oxNKL};9Gp!0L^0+4DrXB~{kR z7=3!)ytA!gEPhc9xu6WCoJarDL|DT;bg#13|KAlf+W}MA>(W2O^43D z-+95*>5{<^{z=`&Gk^MME}Qr@ZQb2YK0loyyd2!~-Q7?Rc4EvQx8ANmL+v9&BL7m% z!i&e(JVkMUw)Rb-7d22uI9uoQX^-&}L2xV%x;BTOc!ofox`TE$e5seroSJfWGZq5? zb$YJR|FMniO~W|dSQi6rI6^#oC7sf1u+>x!(SHNB6WD#ev~S(|Zrwb?i=0%|yX9a2 z2Be`*kOmH~$;2cHqGgWRgzAr#;9-PfDM~GK!Z9rIcDKvL_m&EWY{K=ZCwTzyz3}~h zBzVlwg)7JqDp2btq!5tmJwT{HHpIGFL{Z8@RiPhJLXa^75Urv=OajBSL&ai8yy4IK zJC&DrgBDCe^GC3Ah_yZ!avN4wFk+$Xp538aHqm9m$+zDgxRYl`kz-yD7`qp#+ne&7 zP#ke!z51X>k8B?mhvW{$(YweEf%Fnn0D` zrA3%E*UHRUf@9$6bQu_7F2NG%Q}!um{Zoo4a$s+`7*`12q1|=dT5t+8=-vjuOada! z4PwKU7IK@cSRp{EUUj;77MlVAR<{xyoE||0a^wMOnLJH+!&$Z_xR9!*i4pM-a)eVP zlao%zkSEIZZlf`*xN$lq0$i`X@JvV;$149JS!~kv9yd~E#`ak>?z*WYXtsn+R3nZ1 zhKQFClbo2upBsI#lJkWc_ZV6>?3so@vJkVNqh1&u6}Cp)^iapri_jywF%8qCQL1kyoTg z!FhhCHgS*?6~0w$G^t}lhc)V58Tn54@wexx(_ucF8g|7bgpZUW)jMM%PQ4`ZxIz+S zXXzAxiuHuG=mwiyiY=4}HvZu{YQnN zp7JG*wTnv!&R7C7edfUvLy&J9s=^$p1c8k|E!oaY*?feO%7V1UG`q6nXB|A*h>&N0 z-Y~JSXf1lOa}5|0zHRGj5hZfN-adC=YxnSq)d96^F|nP0`E(B3c#CgwQzT}pCA}Oy zfKIM|t}O<%`kkjAq(F?9VG4AKh%ckpyeA^^NYpL)TFuM&t<#F7Zj#g!bMWSQKyfyw zhm3dVPM7oDJ^OXAgt`MzcUa=!{C^`*S$s1qxSic~l*e)Vs!!g0D-iqVpmk|=Ch-uN zRtaI+fid_iJVL%H0$286NT_0v_(8_n`3s`F>L-V{%JC30f zLT^J#TY!`Yeg6-0<}c;a_(h%32FjL-2I@;--{DVn?(h!%v7bp38A}O3M;81}?Adhg zJfXmu5~V2DqBFTlCX>qf8T-e1y-A-?2$X$GH^9N|>EF+xgNVaT>^~}niux-qTc22T^3n+;~D&`Peh6;-wTJ^t-1FX`vstiFIdh&pwksFii7?$-*bfM)e^ z5z68Hq3`ygYXTN0Py@#(HNoxw5s;Go=JH`yNX_Tud6n;kV+!MMKMFg5`qB@vY;XXH(4G8|ZPQYN@qgb04j{$N$ah z3gqFp90}TF>|R;~)rl@nj|`ID?GqjZf)l2%{M+B=LHAadBgd`7r)KZR(_5e*B@qzw z%kuUAL>SLNvHw$GdQ!oC1zh6;yw*PxjvV;n1K)u*4t{5Fjj&t)Jp!h-F$;L;Cz?~|={|+ys`V_^*v*=u_$wgI(f&(glk3=RIRn;1 z_-Zuc7~|$F_sCQ7?%?Uz)OsA-g!_KBP0_=`k2>BlAxDRVZ;WAQHhR~OxG`yN+r;Zv zucw>3`~Cx`6P;sIoq$rDmd${c#P0R19K{xkzRlEA77N;4Vs*h(Uc~W-(b{!cao#1O zOMdNELCnAe7K>L0BT@O}F4c zbJQTgEY$?j+ousJ)6jz$N6LlCOHBKS<+_P4V_A-wQfQl6y%@l*aSxUxM@})#zIwrME~~Rn$}b{<*{79NTLw(-DXHhMZ98yM5jEjbY`Of+QyBf5Xwl z-ob18(MlXY?7E{!63`+$o%GhMd8wDaBA685v$PU=L?Z25%H}m@B5%33VZ>8mAV8zT z4{F-PDg(lO_~FXe!w-zZ6xd@bM5EO%UB^X*h2lWWnKd}zY~kiIfFV6t2kt$8q})Ox z$3*Bo|4p96Or9~_kEI9>z$7bRr6jg68bJ8v(6?FmO*X^dA^mR@HN~hUC)+9$JoJE5 z)-SpinG?QZ*gaE`Qbes%j_+YR?D2UB0R^P{1_U@cXy@dguYJPo`b#*{6uldrxMG#s ze|#?wk)nu~Xn>ELi<~mf3#`$%0HSE8_3w+UqucGLAhZdKBM+OUT}ZtEZCceF7iZ47 zW-eNilJ}C6kkw~D6=w-i^udP&CypCldc3Gra%(DNk|aFx*T^-Yl{i3M8-JSIu>W{B z&sLGO%gH*AFIu+&`<#ltR#)T(KrZIgnt1mm|U}y!XqYleC6&V13O{*PmjiZOcmlvI%~x2XtCH#ZtkDm#hruibo!~ zR?{Byc35*|GjKtwklHwA zQkUbBE8F@teA8BzFH3@oASCC#c;!1qMtt>aNtSu8i5 z3b@%q(gpp3xBoS3fnh!<1p^VgZ&-LWEV)_APOmgKg}V)>aet6D?S`(8<^u-suK^ulT$rfD`5)zB9|rI|sLHqZNc#*k<~@5m}(u z+YN4KfNzv02TH;OA}hq$`!&ADhRDFw17U8ay%P|H%?n|;f=`{ATt4xzemRj|Tb0>j z>()C_$-xf zUb()oQcX+( zzjM3Rp86^)`a-BSxBQ*3?+^6qh=t#wX5^(>_B zGWa5`ZPu?s@NG<9w>C)1j_46JlwL~tw5LL)izZx0;TL=G9(hoa(;GYI@A{c^DsYjY zWg!2^_5+CrTC20y)sIV~zGJsuQp6G&Hm(aC;~xi!lhn>_o*`D#0fUS0Bo-WUTULGi z;)z4&l6*w{8>c#{+xB>sz#^{$?W%6fZ?%aoUP;U?NsQ`KaWuK-jl|nj+P5tCZW%9y zp=o_eT>1U6TTBi&m6&D_<1J$jgVkU_;^YJt5i!Zu{jHI)a~P?`%`z%P)8zM}IUaIg z08w-UX^1ujpc2|3-R%8~N!v>m=6%|6HiX=#4l#mBnb1Bb#Gz8s2-Wmp3#b*Ph(32@ zRE@nn!v!-0FMH%)c!g!A;!>FG(BDUrO?V$-Epw0T>gPmn1Dz1gy z^<2WhxT@u)oULm(r+`kVgvsFbRuEeDpx(d7wn$rhsK2COa0K=_Av4g41BY=#o)bR} zY|G61h8d^!#*K<9Z!=1o&5$%Fk=av@)kDsQ&EW)t7Pg5pn z?1%wG?(e0>P827luE757EQEa<;sphmxnp#aas=fVwX_rgUj6NsEMtWF0%)fqWBAHM zLXnUV^{zM>{;~_XhynJaM?=$(JLF>tX|3OM7A1TFoc-qr8YZXEw#uE}x5CI5pCq7z zH^k8I1xnNaIfc8}+5-rt$3z`*OcaJt$|%~>l;>pm!N*R~;Kyi+x(L{~njp%`TcI<-m9gj^?{ zg@OVR+pnK$3kl<$umws8SxPW)*2xWf0u;p#g8~jS&2Zj3jQ7x}ygQTA#-Wu3Aw5Xr z3mkWKJ&|M1iRwHy&||YI9ZC4`l-h;0!|+q3pbT@5{j^!!Rc|v zMSfAaz+aZR0=axVoIB-b=VQ4AIS5geSg9)uOMac>#-+nN;5PYb*Cf*&_N+%JL{#jP zCwt`dWk0+4ua#}t%;0@LF7a`E37Q=787nJ5LWLs`y#MNPlzRJ-{lEyK3-%4137wDx z;TPYg1FkmdzG0@8mxaKF?kF|HKJ)rFUBgzJz!U5J{KHCevYH-m~7s5+Mb%?Cm?za4N?p#e|GX-vRyeI%seA{QERf zQbpjMI4~^{3cR@4Ke`)gNH{fphio9h0C6Sxk4ycZmZTHR9Jf86~$c{W5g(0S@W*inr z+wQj&D%;yqAMu`bV*ml3idCla0rJaXMH&)b9Ib9``iYtodxmVos_OmODp-eo?N)dE zMcg;}`D7onN-Lf{!QQ3QHxvVGTmHE#5(kb^azzJ2k*v|{wf5CiMO4Bsu3H)C(oQO{ zwk%w~#(L)m)dn>6KT^Bt5o6yRh0gco+X^0^sz$k##&t_7)>C?5@?=!x18I;IMLFRFS5BVN!d;9EnZR%k%Zi)z{1SkokD^ZW0PG+3!T@j2_iL)kweFy;c23cXSd&!nMweocC82-ykvP7j) z&gQO{C0iOIQ%v;DbDR%xvv!6Ld+}t6FrLb0O^iSMf8vFx#2eSQYl25bm$f`53!kUy z$r_ARrpAC#nA8uV^$O>9dzugRN(bCLha){6)2mNkeW|G4K6;05a?yAg*2tY1NGVr- z7rq5#&h!^mY9-xNhZHO6Jf03ZxI?6I+9v1Bsj zW<=iZvVeQkDC@oJP9y1PiTKJ*lF*c^+$AUe3MQuK5Rk ztWA18ihgjvJ+PAs8u@#GUPRVK-``IK9Y5R0_xP?I&aB_Q8+6+z&YWBI$o7bQ&|iZd z0%I>whKThF07am~j}7i{p3Okv?ze4Us!e~n(_P-X)62~{kgX`o#thgwl>Wrxe+F`l zaTH{@n|&lDOaStJd>X6F+1!{p$j+H24f*$6nEuma1H=N@J=8;-F1SSsdZoW^oq+=z zka)b`QmqESlONQ-s#uiX{|DgbC)x)7I*^VA?h)|)Z}|^)R56Jwqqsl9$bI59C?!+P8Z%Lv=$h zv%SgO@IgrYmR9Rc4trC>)G}jXa{%CGV%hB#{H8|d^COZH9 zKg8`FQ_k?Hjt{7-Q^1tB3Gu6qT5$`0wk!Q>YyS6p8ka_65z;pn+)-K$>)!(46uHqf zn@bw&x5tnr+ak?c<7YYbDEOM?3ooXiAl~@>WHASBNtz@nU$(vz(_o*j2$|*xKb{1S zo=BJWFqxFMQC!uU)|tfL&}E1?Rj>0f3PZW$Va#8fV!|Oi-dGwda}{)E!7u=Ok0nth zy~zl=&m0w+NO(pDCVdUeu6B`gWvk7rCt&VF-5l{K9%3t@yLlrFQ#vCPoEg^-Ev@?^ zPCWnqm5stBJEx5s2I**q5tj){d8`rzJ9&mwnvQ0cgI$Q>CVYk=j+=b}fqMZ^(vTfB zAc5D_C%jUVi!NRBC1OM(`7cd|a59*ZQC_f1tOoxKp5N@WSeQ=<{Q zM;xE*P6nv8#@JK_=~+qn7w0Q9r`RCe4-fOM6>i!TtChcz-dRulWuRWT-zQqJ!*qWs z@ac**XjkZw>{+d($e1o!Iwwn0FlN)!!O!{vUdDxaV8v?**3lr&gi-IVuf^sYNKH6lcAY zA^f|-^~;BtNSijdmMp|X6jL0R35W0uhm@$?=k=WRhaL}Y>lxb}H%GJ!G3etqB$5I`o(x>=3?x}cPxK$!A`l)0 zu-^=RB~q)RfRk_GG@NoXO@8MOOnW;o+tud-=K1VMFH8e3spC;wFp8Da@r}VuuUG+T zBB1cqODDtk+m#i1HyR|U1PX;LI>;<035={m^jsVyH><;|4r00e?i+(SLyPtK1XHAN zbqsP`i|hF)^LR3=m66$N5;tvJJCD}!f)=V7qyped-KP)|-hIKKrci&Pi`+hIwmzx# z`-mPF?&#^#J}>ylb?C^UAcc=>Xz4(%G1EsS9+=%@lKyCH%gviO7g(~iFgTw;#DQ7# zN^7F%AW1FpBo41EDaf(Jf)?HzmUg!+j}6K+JOO*?Z`!LIqNXCGkStirzdUjY|F97i zkR_q^eOVV4=8p{SUfSmvNEtPAZ;)a+DPDhIPn7R16cwi-85w(ra7jBjuY0}zSN&l1 z4$F=nfk%CCD&!r&xFIvHAEmx->QYI(3){J>>0`A9xYUiymyZqpN#wW;IvUp;~{;OBR zx^QvSEYKD%@a?o`d+SUp4Zw-Hb*UDZQ0Aw?5sWJu@DFkU&)c3CVtwRhNEq*%QL$Ja zJne0i6((B&zEcacf3#^kQQtwm@kfwHTpsE6^Ry^duYi+> zUl3^zhy>LWnRNQk)1f*57(90<#UP${AvEPv69~wkK7CUd?6DW6Wo&H?>s8&#Tqg3e60~sH`s0 z@X9s6KV*0z=cnyNAX^#5uMUUCPNB^IB0y_c#L7VBlAIgo1WoST^je4nUmPLRTJgAn z-hdu&|9xMS51BQyDE2cv+r6DrC+1_4&8gV@99kvgGtd=uV&O} zG{ESM#gN(34nZ=EK#F{_-e_|1$jjR>1U3?tgY*595Hoej)Y*=K<8n@03fzQ3xgmL4 zcul-FxozV*(O4=Fdb-4eI(P7_8F@i@QQ4fa6nB1|Q$AuoA1c8;wkeKOMu4|q-MR_SH?nFyEe0t3)>+DFM5?a=!h=A7`Ri9pno6}aO`tH zrapRc6*2HgrF=IOjL;Q`1Fw)Sm0lN$KmVps_A8=&4fltZ zBy->!0w@8F?aERFwH|N@LAdqUDLB<){xu7enuh(5EW&b%p9g?1mFMXwPoUAr3>2hf zrJiR;{pG-u^VvZw@1(Y)^((V#Ub|FjMkLcFUXwF!mISKW2>|W{nzJU-oF{b7oIuha z)nBMMpe>4Eg<4jA79{zb@$-q%09TPq(kOGWx>AhS)Rd5q|?;YW@sq^6R;Uub%>z+F@ zg^{^aQ*;YyseWQJWB-9^__5*WNTs2_94E^es23lkz^-*ACXY)8fm& z?j5xz{c40qq~-fQP(_=%2EWX9xHf*Z;Fouk~+-*P7pjdp1v>@Ch~Q#O1LmZS$GZ?HV}!c zNk^nx%FZZo)(j=Tn?SeLXtcLp;4{W0o052^>X~L#oDFg-&i{D z68)CL_7Xf_z@1N*1Qqpv<#_l-eE3i#Qso;f%o=lQohmiezjXo0E1iYy)I<4!1$p7i zod5b|OK0SftY`vBBT&Uj@`W37KqrW}NI}TXfVsR4ZBj=^P z_tq;i*x0u2@KG!=^%HN_xq3yaY_ZoZpk3d_IYPM$!u^-oGHKyDvFW^HiF#$>+^H## z(WH36t!A}0d-qxz56Q#q>0^=ld(JsatzYGJZGi(o@>zo&51CEV{m;)%TWdOx?<{7; zvz~(f*1PO4=Q!)2U1Ez)fHm9v;AO&!7W{&IAX~9ZImlC>pHsw)XKv=y{pdCGq?X=5 z92rj1&G$UPL*s^}YgX>#PoXc12WqQ+Uc#Jjds8|)K}9CK>;&!zRMn%hQ8-WOB@YlU zLAD}w{K%~XFJ5Pa{FcKD&Z%|1)TeX(+vKxdJo`6SBWc7KrVU~S8ZxRXN1Lm58J(Wkd&TEnImEMoNKXl)5sBY=w+lU0TSpafopb2$;;r#04l^@EUhf>OQ)< zGvA+_`sFje2Ejz8)G=6PD<=>&3vd8kF&j7XRF0U0Q?0iyd86uDRcVN{~5b89yl zu0&BgQ?B7fDp=BHJOTaYl{*m5bF-WtEbJ{3f)I}2XYJa%t1}DoG8B`W$PLPvC4LET0?N9;vH$pc@&g&Jh zf*@qfIc+lRHhm~4@aVEIn}eY-74(#hU(Oj^xG_DcLY5=*+l+*QA>XvCT|JAuL=Z45 z_jR+O@naep6ta+0r3jd_4VWyUwr^Q}?Tw)}aeXaqk%Q7a8$>vbCN6J)Mwmy$Ok(Tw zupw>W`#Vp9v_HH*se_bVOR-lLFn=I+7#!vY!hVVl41Xc2zW(G~1voxoJPjmGU6K&` z`0pEMwnlz`PCS(2Xhi{~mz?41~=QMK}8d}F5N8b49=^yC*11{3PnzI#2DqjVX^X7_@T+WE!*psaGhPA zlNU@&6hTA@Z}qI`4J_tx+x7S-m|?2c@oerI-%<-1;-Yl&51Nt-1zsa5(b8<6#=#IH z4KdbFmzj#dAo+W48u!M~CNwlRNCpZT^N{wpJfhYWbO)PE{|LSJe5#X8xGEo+-hS{w zXYc9HAAqtV3wc!efL39O&|`&xB*^IHjC|X}Rx|*y~R|h;geTfRc-Ub$uj8JAB;VDPlH?)s$} zLXZ%+T-vd|{%z!8n2^t!jnBD5&Bm>$#kGExOr4Hy*$WWe^Y&Kf^>#sQz;)cHZ;iR* zw9|Vc#&$GP9Vpyaedy@qR1fD##vlN^jA+7FS7zNgMod1YV&W=V3Fv~W;|+;k>_ffh zw9NsUgGityFk%6cRKLhI3Av%qMwUfa2YTKw**7|iTiyboR7gHpm0GqGMB=LFs0L)P zhID%o%if*L!Wt9)IPGAQfJBtP->mtz>1n~YInX1T(NPa->Wvj<$Ebf~{S;{rGGIwC zl?k51ENi&lVT>!4XgQS(AGW8)kY>sXnzoZ=I2iz$#Y9zXaS>7AJpPs9jx{Sm(Vt$j zPW~K`61HP46g1fueg6&0&H*j{adWox74LG%b4W585Q6RGIa>GG>DA`v*P32go4l?p zS|t2bWsR$3i1twSQZt?>C=uv>lf56*^EPL?8o@b(xfA=rBm1S(6skvS^_x;zmU@Vj zV)3!Ce4W8*m`+5ZzZ2tT&mwQ|ReHDYwxTRK6%53Mh(eZjBQhkj!NiSo>Y~9WFi>O) z3&ZuV!((CMn0h;pv8YJI*j}OSL=^0RT;q~g0u)3!+M+OJEQq%FbwWDZJ3DS3zV+yl zX?cA!;(0KdEpm^-dGF`Pz;>qB`bve?cHs^3@XDMAEIDR+cVYpoHqzMv6jieP{K=Qn z6g5mU;QTXCZ3(5B!m4-k47y|_aW;GW)$pum0KC(Eu zGYMioMcxzz-c<~(|AsLsB$gO*UdfT;u zzNCyn9pt`>44SXv9Xv7S%V@hvFzXxWRyI)D+558AJD67>xz0-pxd+^b_N_X*YGy1yn%uXiLs? znbdNNQbWkt0IERnaeYL6@=s^>A0B~W^vzvj9O0^W*y~9$_ZubGG@;7AVpx})6_Y#) z$6U$fCT(jX<_Z>jJM-z4ACJ(KZt<(+&5+FQZOuNL*(3WG$8ghSS0VLrE=1C$6prCe%m*84 zqWcEdrB2{g65yKXy#&2uzq;HmpqM2>r7U4yRR%DLw(t?yQgu3TASX>@OD zS6j*xec~r39YQ`qQA%HHGqEMxfubnwUfaXA&J*rN#l~kD0A)N-abvFs7sm=KRq^Y~ zIZLV>WPm4LsA6ylDrhIot5P+j%K3L9j6fX0-*!lu>koQ$Z@lwmm;Hv zLLY11%8w(1e6O}l8%j+^Zkw1T%1t4uE1$VwJhPMehbd{G8Q_;1kg`k0A4C)yV6=52B6)W98)_=-Q z=Vzl&m0UFRDwU8(N$df+I8V8@k4{WE_t5c&Q1vxqJixyj7Y+Z8x6!>E4U^keQ zsOz0Lmd_f4BhuYaQXoBv*j4yq=@%2Ui*OV~6X%Utv2XJwOdu8V0w+Me*Ev{0wmUf) zEkoyN-s&+Nc|+~7a+-=-C*9QVTO%-MWH4vsF>Ye#ToE!pNd@|9>EoGm!-0@JpB3C4 z#2Ha;IYjg)rv6v2m_5{~IA+T=yEFAMVoY(Ie@WGQ*Cn12wIu$n9Tuls`ZasVcv3ue z-Gr+bhi+}eHr7NKBGy%-fXS)Lebx!}|DGwalheSoQ477cV7r}@y}Oe=L5*>UJEGp} zAB+nb@5z;4q*hIqM{mr6=*W^kQ>IQ&_anqjfSLZkdj8sIIeK^tPNXmw z&nabYJVMdbwliHio;)oL0zm@Lc|OlWzInh*lYF447~zG9Qf>6Vo~>}cUJalxewy(y$+D674qp55gswY`+#XI}A50R;|5s!B&o}#ucJ}tsyk4y)s*`4pzPM^- zPTmJ*S6F;nH@9}pdSHNy8g7iMyFgw=?22D)@{5*LQ&!b!N9ljHr<24DV;jXdC9lDh zGX2H<3$bmsKzR?Y-+G*FW*|7NHZZj_kILT7d2W+i@Ou7xVyUtw?c6!!QI_j+@V-;3)*7Ey-08m?(S0Dr8j-v@5+z+ zBO@bcjB`%*+RNr#b4RJG%AunGP~N9>_Cr0XgMDbO%xF{s3&&TY#0ZaJdBx>aM{6>bkA^E>IO8qo9I^ZK^a{Y zITTb}QMA|wn=Qg$Icu)<)@V;*Anbz*+pA7+V%gRNJ|hPh3W|4ArDib*|1;wL?%8lN^qRf|DnkP5CPuk!#i4c zpgQZnCE|Vub6u&no}lMI;iN3qvQGj~HM&2pX}CVCDRh;D(_+N|o`$FOh3*S+(HexV zLX`~G{M){1Wb=%F)2y?WgfSZ!BPCUksy3)>eM!rXYC+a>3HD28w&nP80Ea;m&wO`= zMzz~W#2abVdi9p{=a_@}haohC!J-FsiGhk!w}Ov*6JcA%icX^;F%F(5PCS%(b4pLy z3r3DTyPhOfiEykr=L5Fr$QMRL=m-l3ZT|(V8k7Bown921)CN?H3jrdG|H(?D8z(XD z`Z^v{MNH8;D_K90w8@EJQX64X^PVIBqR@3Tf^(UaV5=Hl_Ds8Oh{mrKWsi`66G&I8 zvnw}Hg!pM%(*2_^y0qua*t_-Zx?#ji2@80j$1@x#aick}_(zww!@=pcI7CO!(*`^rt*!dq!`$ClvYQOM>+Hw`DxQkq1 zXqgq8C1)HLJ~u*tH<+8t`jTz6GvxH!aCw^hkI=2wqJ=YvH*6cD0i+IQ-c3sB`|L8= zZpgGm8Tb54TUQEU=!S0{%r|7R>V3GBz~~wGC#b9vX9g0HhMCp_v`xqZjqPaEVOb$D z{7VUAvW0fW@X=MM%%}UoZZWm!S#t!G+}mMOob-12Cn@2w^^%3nTi#&w+%-}9X@UqB z;U4wno?4^qgL*7HGOB|G?4@RTAM6~gJ?j?b<&I6+1CcA&RhB9A{-b7aeZsc{{D;z4vRR2Pr@LTNrs+!~($TYC8a zmQIf30`cOnxR!b;!_E;5%`m{MiTlrmFb7%@#uZ%!?2-J8&ix$Yqiz+ZOE{eW-3;Mq za?T3E-5c9>?>emqSt~}^zQqYN?r+_ zBKeRp9OriPtKDui)KiwZ`^vni63Y?sgKSS|A|Mz|1JqXR&O%1cZL1$m+eS{o=L=$( z<^SKO7@7}O5HL?=4P2ydOW$9G2tD_8Gq!&d`MT!9+U`gniy(?dQ`e2uF^3eV_&x;s zE@ts;s3_3$@zn+v=9E2e6ioM(!>jKD#Nq|-MtTylav zDoUT#$lR9T-C|h*d%D&tL)VuVE(-Li1{;YFcu^4*3HPrjs)z*IzM20OH#&>BpsUuC z^ckXa*GHt+^$>mkKkX!6TzcZwC~~@HeQBlO*tL?)%2=2s6eN+4q5;skh2XhHRUYm6 z{Q4rizT(t_qa&cECcM6W+t7+$5wdF8vpH^U|xjr z!(ZK?I;zU)(1~o`ZA3<({{GBjZ=mQJbb8>;TnQrHky zQPR_rwAj37kXP&eO&#GZNQ(%_!DicsJTQ4s!|!uiJDbj{l8X7^<7(Pk1N~gA_l;Au zll0O*b(^~-J*7jgdl~xa=om#2{n-#Rnvj*_F}6DH)}%bln1QL9k>e8uP2e|9onAzg zipyuUrq=RsX4+tz7m`|Jw>oFO6g~}t2Q&OB<;rZDEw#2O&$Y>Y|-Gs5k>AQVC0;d?G%8Ve7 zR&3-44!(-7jK;WobP)0KjQ;aM2LDZ6;;;Z!wCfuQUc2wdlzD{u4Jf`H1g!XB3%7qT zQkpR6Dt15K&TOB0tpok6=(Y6W3DO7(ax_eVcD-BvM4H1I%Hw66Q`5m@2J4cRpCVQ! z9A*pKN(uSA?CnJ{Mwn*Q+r;@<5Gwx;xvyU?PD$_F|etg(qd;jkS9HBp|_P?yigiVGJ20~5%d@Q=?I zXj$v&gu#J?t6040nVF&5#r^7bm`BHU8uK%;Y>yQO#KB-Mq!+SNhQSGG2RB4zf<(uP zZ3v_!4lR4V0`kM?Z1bkFO=EcuzQGksM>R+KlLh+l$mJxjK;(EhO17W}ij^vPe`0dl zr0`_K$|xz?^)+bXmfz*^#3x(Gh4jI~sJux#hsn*rJWN-4$ zN=jo1pH$2RFlH2xu7N>)bLm4W?1R!*jBj1V3fYuK{HF5Y>}}fM8zY9xmLm`=J)l<5 z)I;1;D*mGc+=q~wr=y7&ocw=y+LGqw9GlD5mae#n-6Zqk-H_6bTcEl zJzb3V?4v<=BKhU8jFCc+vaxeG!Z57TU0&TTRdOP*7PxOzkET4d&A4Ry%WmG-ok5FX zRIxiThH+3{EX2W}X=~@AaG^DT{$sUq?*;BYRNWv-(~7;IvIXO5Z8fGnnDk_!0hJp- zmTd_?HBR0=Qr#JnJP>a(zXmVg;`v_K%U%v6L;Q>Sj8>wC%jibO{AXE$jMl_>ruOHp z5drCvqa6OV{+kM^6Yn#0Sm>H~|H52ua)hMr(2$Dw<1xh{e4-^@@Y>)QPi$HCI>5^| z7WX|?V#Iucih(<9=73Mm4<{}ub6$gtUGFqQSiP-|g%1wTWG@#(n!jbnoTSt>rzeGj zQ?BYA2p_{sIYd|Dq!BT|zuk~pex$kZF~S2HP|{S%rSvW7Zk-n6j|F$rXX8Qa#BEci zTy}n*`NegF+7Tp{t2`)NnuGFA-EK}D5z#+gxytGJc$^E=89XZosnUSq$wrJXXBk7mb9o!6$hgn5k(&#+4*8Kd&!7H_O z1%2}6T)FiLaleEPuY>T{spq#R!rmzF7l*tz`#w{1m%gz`{iIG}=Fo&-@bmmnn=n)q zEU7*G-d@}jZa!IcBd2K{s1M|0Iz9q%Si9`bfS!+9_SI(v(I8qBo=%H#EA1@yi;d_^ zA!Kl+?-@%mHo|n)B{dWTf7+20%#DG6P+=OZt%ZkIfqdE{9RO|XfeG>a=-av^xnFJt z4ONFEeDrvITm61H-4SRt-k242;i!NmT zSu_HEKsCRz4!$&jOj<91&^2jddnVQWVfcRQ2le3Kc+Z7s#7@h*j=F^}_gIS2t_*nw z(3Q%s^ZT+6#yGd+Vi7&rXwOIdPSg>~f5u-BO%^ure|nqZ%!hs}i!(5MK3FE?f~9v% zimlfIXc?!NSoq?iUTkcv{9kwe3cHQoa;=1E40=|h_=SCZ_&bFuAOhP-E#+|!WBcvn zakD$``_oF+!3jp7mmG;=Ox+|WM`UiJezvd|IiVUwf15ByK||Ik&=Lbry0F>xm1sO$ zEG*d^sP7BpfUbwl#7dhT6m;Jqvej?Jj&6ctK9DgC%lAZWmpY#;xX|qDNT|_q ziHjm5Vv++L>@fEZO%Hys)7CZO0@D!rPKm0F6hr#0fi`oWPQ=~O(8&VS)tDL8_Er#zjN79NkkR+315+$M4{Slf@H%#YRSf4UhH6tC;5I7H>a3LXlyy*FR%4L zbNo-!@R7)2HZ})<%+Pf^DOXz*x=*(5{GYZa3#8?lDc;hvR>FGa1GMIl@+t>jW zeT7bpbAQIbQg6#&BzStJ9;(EJEcS~B_zo$H%2^-+hEj~{O8emtWaV-#=a!E1r?*HE zQs)mMk)tr80zp?0+||Gx@oT$_aWwPv+*h`Zk@Gnc7x=>BUI&bXO6(n?UQhB#b{z); zE9r2z6R+~CurAvQrfor71{*g6zjwaQlf@igOSBJVp(27B7A@4ihqWNBq=c6(N55-N z&&Umr+d^K!K;_XV^G}J-n^M;VV5HskbI^ftLk4z%0)VVKUcjZ9c6rd^(br`#0ag5N7nU5NCQNf%PbG zG#yPnEB1Qv9dG4?{;0XNsl$ehL-_J;E0jR>kCIXZ1i5sY(Jv=@_sF3}=a=1f44=Dd z%>-Re(y=j7bN&SUO9ci&+f^09L4Yn+$Z<4W%>Ev3Lic}6$Y{rYIIOs~xF%~xCCa-A|fd-X>yckCG~Y^ z#AuJ9ySs-(VTL3oYXp#vQ>;YdY~w@t0FYB;GGeU}0Z(fVr0x(tar(`zrixFUqT&CG z^LopkL;?8Y3Aa=>rdWuG%Qc0a#Dcc8wmiuk0+s0*THvNO!WYriGDdbuS6@2U7}uf5 z*-2j^6x6zJNd~cX^B*U5jU>XWa4f>`tsN^QKY6_WSp9h*^~6+5DA$PDHIu!ur+1PHWwhbbbc^2SN$#0gB!Mv9)^csDfwBHFSNg}L6;jliAO!-(D4%_ZnSrme6-^?emZ4CZE zl`ppkS{aC<)J=WU)DHp0y%*yr`9HR91F6s>All5C%bbnk36;`AdAS+W$TV?@pg%#l zr!y>;u?g`erlu%$k9x|gDpJMTAYb77*-^AuI^1htc)AothSce6Jvo<@bdB|G}?OOY^uOTpYS_*%H~A{=S_QC2WEivxt%1 z?_}7dG+xhFigMw)PFkF}A?XE@q1B_q9~#@txcMU&0VfyE(RF%=$d>>2gLe4f>1ohr zef8P@4CvW!{Ab3+SXjZ(<*fOiRV}$|2pFM6F>xzO4;OBDo zl(RP)ZU3-b1ARQ=nbTy6yJ>RJ{(tZ9?-D#wB^m{wl?!oj7WeM#;L*|171irk^6=a? zx8RnH+1B;g*L2xN5$7zNpr{JiFbZ)ruhxvCno=bGP8T``Mj(`?CrbL4Tx;)wxDQ_d z0-U04i=A)0yg3QF{^3zHH;QJ^hRj&j$Yys6=pFvc(7}O?q?Z+@kdV;i+FCpms-ZhL z={=aD5*ugg|1l&`R{RLS4COBfic-$jE)43n?y1n0Q=+ykDdiL{kC^3%IUI6PwzC$b z?LnIy8<$f1Sk7zy){NJ^d~Dis67fgSaW*=rhdi!&mFD2C=k%f?1Jk49hsOT?K30@W zjWTv2lwpq$H=|oN^clo5S_3kN*)?4aryNFGRc4|xL5KiymmC5s5t{|rXc!o#CMIu^ zlarmBMV$35HL{bVQ%<;2w7yeQKQSHQYo>!w$5KC8JJ`tBD7?Rn{;963E`L0BaAXaX zHsbtAvOGDr6r6cvyOV}jSn`vUm31|pcgb93#rCS6_&N}64rN$*$A*p25Y zrjSN7Sv6tbCq$6P!sd-Hh=XWw(02362gG?e)GIV7u{=4u8fVOOCok|W%oIzSdfWM< zF^lJL%m_xr?Ash)0yh3rt4{^hDsWArMB*6#rOv!}b2D9nWRA+m5gO3E(5l~j*EiRN zS!l94I%(NwGjjcAuI_J!bjCM(itXfwMrAxD5tatD(n%?#HEg-6N)5X=x2>EHRy?%k z=JFe=(1;&e7}&=o6ty|^vq+q8rUXeveQ*|u=QXr+!x+$}AAa8Yg8Y1( zxSSj$1bAz3EfafXuZaOY0ETIeHN%&dv}d$=z=glzIyx$?%l?F}p2Sf^{70mzy|uI5 zAoV2V=~v(~FD3%~2{E;PCoOF*6pp|tDhi*riZWY|69Rz{5fe*l8XyY!wQ=&=1qW)! z-1ZCA*Ym-$2w+S!#C+6}LzGV$Scr*>3pqGAl9lsA)XzMIPEJPtUL)t>=a(+#9^`ZT z&&!?y!h{@Sw&cs<=MhDn!?io-45bKj+^pmrM-r`0d5^f01*g zU;;~BjGUFJx>eJ3DgZzmJb5*taW%adYDi2E1KZH9=ZL5A7JfmQhMQ2f`By_cHFw*{ zvC$7`8Y~zYq|l6@TbD=-Z1)v|ggcGn7a{?T#S)K+0!yJtZ3m=3kq1-GxTRxgh0u3x zqH}IdKMLVBxozLQ4b)W@N_W5reG7W$566T{NI;N=b?#@vr-zLk@niI))~H~eLP~&0 zlH(w#J3oBQq~O`*f2sC?#-%MNnb)Nzx3H!_d=7)UwzaN1&cQTb_sUj7zbPD9+TAXF za%|g)yn`KH4r83cD2dmJEy=q$GxALa*Z&G5W{(g;d;|FI2_^O4-V*Ie{v$$@7lltv zm7BBl^*VX~3>d+PxZ+~kmbgCC8eJBGV`HWJSYgX7CRVzHI;MWIK`iT zx>J4qXn|FnOsS6OOjxF>{`*VN1fjh~#0SV{c6L zz*OA8XF2A9)f4@k`P6no=swwv=MLHvN9V71X%LJM<4#9EX-?ppqCt@Jfo1bd&Jx{l zv&$;rw{MHk^W3jg=ZA;AKxUs6dwszOl03%FEjJFL6rd^#F|39}M3BIm+}J4cGHzdH zefo-nT!L!N%KN}*X0&y{1%@2Yy%$5IfzHFEOa+2tz3{PJ!Yv*R(9qS3AAl6+`#g zm3oTo;&-RmbKvu=ri>sDIte!B0 zXFY3c-2kr4dhgpoPFMGyppMuwsn0Z6vO2`kQ(JYxk%Pz#x9K>}F8+#x0k*hAjX^E% zMDeYd_un$ob2EcnJfp`w5Z;gFa4hBQaDjER6S@fFKekw#@DOuQT!4H{khTN1e;JH% zSo0h>oCW6&LqS~7F&?UHBtva#;G-{xz$9kO>icrZn1WX}26}p|oIGiFwl^`*4_3X- z>WghT#Y^ZaBdy`#<JJs<@!5|Fm798 zV(y+^B`d0E&^F0ikhIBGN)B%XuO4Ru;?>(h`yfwFL`_&$=ueEL z3=jw0(C`3wM+r#$11T(jJm(nusu$Ge=Bk5B+iIM}Owet4Leb_v~K{ zGVWCHA)*P1uB>&Huy{a`v<(MTlO)o4adWJA0IA2mFBRF?q5l$rck@`+P^Lg@V%6Yw z5lNO(daL)CUOOcCp#6g*ild;#_cFbh*(yPq(y)6zE0MKmN6|UU`Bfr;i%hi*H(~Yc ztgxkM(`$6*Z-%q);`&fJ12WMf2t44;%F3!C_v*qzei2Z;>G-u0HnfCmF!(3N`<4dl zGaG3SS-})V^ta@Qz^7K|l5RronkO2jTEXvnKq@cq!J!?5CnK^uk?s1%t1to0*ys~} ztNzmD3N!{e4mn0CYrPBEtU&w6j(?kGa`M61S?O^o8fn;mT$R%X0pUJ$c`o$in30Ht zL`pk=Idh|~&Zy!foG!}Va&BG%QiCp}VZT1?AF1Ge7Iw?#t0U2;WaFm_9|LE@M zoE(*$L#plYm&RHeUJilUiN$l9`+!c}z#yvs2!*GSuQ0z7ldcpsaG9qy)7GV<9ec4a z?BL8^O3sTN5d9Nsq!Y1Kt86&JDx+zJsSjZO=E{pKt%y$`Wqi$}UHH2M1tKlVFvbS- z{Ybau=a)}(Bx7WRZVNb`T$}rPbcAE5_B$AXi$Wz%#rl{CEW$qM@8J2JfUwBN&d#9# z5uwf5gR9+Sw5clS>dDaBro^qf3W%Fg9X#iFt!%@&?`fJ}8m6p`i!xQ4n319CVyp3S z=Ii6I>Gf?BxUm3vm6er)^1Eaj^goKBVI551QW3^Pm z;4^);qwg=y<;hjf=+|4<>)4y*!AV_li&FdI z3cDS@oUa~D{z06p^O~xlx@9M*kc$}dQW?78V?N;`#F&MJl^TFfO&axq^qP9(s*41P zN|DYskn(M5U#vnZAg9CV(!-4g5V~p_I&k>G%|12x8SxMSK;yPmvK?0F<{pwGH+f70 z*(!0yBz3>?5Y9%@c%bQ25+~R>q{=}5gr?N+CQ^jHZ0Pjsii3EGf3^T z^jI6!hm4S2Z2GQrRXW1chj$=_Lv+)#Le`JNrwQ`|`tIu9@e{Lh-q%l@CT`=|mXuD; z|Mkm4Kv{XLiwuPtFD~i8FD7*Js?}WO(+5&nt$H;y*^Qfro#Ugv z_rqr2wh%l$I8E&R-?Al~0n-myYJBjS zvq&C_E@QvB#N9}t_g35gS4~V{$k}0yrT!$Zu`pmIXdD?)CV+@n}nB4FQEy?szJL) z=d1}|B*1*E4!Ldi*%KNM zx>7bR2jyF%%IqlqX}y(z3aN7bzCdG83&@<$(e)6 zg+&|@@m@p^{!j#sTlef=2MWNk+@<6PUnDRa1 z@)1GnyJZ2m_MIScAHz5+P{lzI<>zsJ4(~7}r8WsTLWP7_AjFFt2J!^sw3oi!nHA5# zC1lgtcR1XAG(D=ALKa`y)K&RrT}nH=X3y7SioK1pMxCL;S?T}Vj40~6_QeCaVs?V{ z$N;Y~?B9)cz+3) zhZJ|b9gF;W8p1R-b4qc|(Ju99=8X61s&+eev#HkK z7`NTj6u*7e&KoVa27ow0_t&G2o0?*W94@bZ?nb|g?Vg@>;wIp#ot;H-OdWZb-w{5x z)hCFIANj8!zRYD6-WP^wTF><&Ts16KZ~(4oeJy{Mc_4Z%@r&J z+NDpc=50T%p)OWf9$0zQ(%Z*c+^?t#-q)>?QJ_7-eK6Koj~3rZBNM`*w3W?qCnso= z{>>MU@KST-+KPSsWRmYz=W`(PozUXUq!Nfu(udzsegnkye|@72gty0_Z)a;GT@WV9 zlQi?Ofzz&o^Y!&M1hJ8ZCrr6b-kH=cm@jM@h6a|7B8B!iYc|i?4oLa05WvO^usOP) zje$KIiwwl|oBbDWRYxnBUar|CCa91?`w{y^wvixDNH~Q3v&Od5MEN=KREs72UI3r< ztY*5l-3LpPL1sqDKn-LB1mDCw?XUgcRh3oZ3p)y7`heWgiGe5lqeE4Gavw9agmxh* zB`%#irOqhUzs?ghug5`*&msH=-t0{0gCh{{9sH^Ci{0TzyLzKYvA>0^+xK$jb31&L z!)M~u+t-+3#CR?`XY}LJRS6s7q}knPXSw-i>-%nnW`D0vamzB}$NCs;dqRUyB6`OJ zoYiRdnDC`*BK3JWo9hpJ7%jCUfl`-lDKwTLSXV#Cr{mW5qh?8C9wZ?JH`D&&`htWm z{?LjK{USoPiszT8>{R7tTH~hRs0l|dr7s3xtMXavqE2pZk?RlUJfq;>Ki`T%lCd;@ zM0Gb<9h|9;wu0vD3i#7ObRjgB5*N*)lXkr3{-HkglBKgf5>E+n3E-+9apYB6u3Ub? z#4Lr1K@~k84=T-l%S7tA!I~kc7+m7E=(`bH_ra9!M6_vgM5El&G&zf>O#I6b@$rl0 zhuLJ@q{*s`T0+^1G04j?$Q;HPh9-c%K!jl>CFegY?`QZtz^wv=#EUKJ*NxjfeM$$! zpGJ~&_0y&O0^autM-X?QlefJ$LQfr3WtVuIWft(b#p#~~TGQdlkI2ia$RWCNRc#(* zj7%=Br1Ws1B#nQl{)sF~Rw)p;Bl6g~z;V#}e!u~2+6+Wcy%u|6 z<&vL@Y?r1x43tl2SNz+Vt+ibV5ME>8+q@#=@xG2G$Wxo!Lj6&9ze0=tdYujUtdxY`FbhCQA?7Z4jd5f@5yIt3`w{$T5@0bPpZ+{gz8|w=X z#pCMnpXd8l9s)B*J^R*KJkH0v$Hq}pf9K7Wk1b7MYODEV4rlNl-Ns#jci+IgrV2AB zPf-_3234WPHDFe85JjCc7VBY@rxadKw!Ih2E4Z!al zgPme!)R*w(o;v%tGeQIgd9TyjLU1|Z_~u|up@82Z(>R%MaN&UJ_EIrwb8c>sPTpU9 z)nbC4eUCyedSU~wGkRP%z*FNhf*(e1{}3d?Wow7hF#me(evCxGWv_xqW1nHXD#ze_ zFP_ZX?g`^$u?5v&-5Zr&EvFwEuza3HhFHKY$gwv2H9*)aDX}$p=c@FV)jGEMo=(ya zD%?X3lleLRiyk+p4PPMK(vmQz2w!mBJomTHA48R_RKd+);vBL#>(f6#15I?cJkc=J zlnCz9giTv*xM&!Co{@|x`x$XOk2;yRDhmHSadUjQZFb4Cd*e-h0S)F^#}!T^Y)ULG z+_?R)|GBqe1xJ}FA~88HEOtvOTj)2Yn%EQ0BYgvs;LXC#QuR4sY6Q`V?+E+n-rv-v z=fkLKgV`) zY;jlLfM$^c=~Sl3Z4ZLy(hg1Uy79OZ4gPpOA?FgKddVxQj**~eO3X_<@}27z4W2DX zX;=_0ug^b+ITRxi(1_XdNaqk(z>FJ5Djf-b&E=cnYidZ!fzRY_)bpC@pp})%4 zJ^EBsYVkp|NosCfHbkr_M>u-^^Lq453JU`r`new&LzR<^n-zU+m2q#-3%$DWeB|Mw zi(!j5Y>>{aVU(1hY5qZTYTCv5j4fq$u8`vt1%pf!wK$Xfu^rAwj8OFi(l=vRMsGE# ztr<)mal84vIHDysP~-8$#&d%)4G(^Qn!{>MK_mg3@@aoq6DwmSSH9()Y$5GigZK^c z7!TZRmzF)NZas&YrB4!@`*6cF?kg}>%Mp;)tSz=)8z5Wmml3_xHoGi_v4n@9dN79l z4CTZR{AAnR?MbidE^uy{h%L^@vw2}Jnmbs((Sd+y%*4HARsT9xE+k^$*jJ;^oIAp~ z+47Njt*UYJScmt1)ob9Q#SWoe!=}3_+4ABPkJ|Vr$2NV2{xgea!n*qXt1t6fdE-`R zPI@z!V)X@I+*VH;0^Pi9RHG>Alw}IMRiX z^rB+@LRxsj<}V12F2-VSq7?3|W|Pf7$mNrs05!CkYNLlal{SY#@9`jJ9DqTVFtBrG zL%OyNRt{=`5Ir(`$0MDsFd~O2XLJ-XCtD6OUpaPW261eBtVHGP@b;kx;2IOdR9_gi z!4?6g;vyo?`>I{qheW*micQ<&hKd9YF|d+L^XF}w$}meB?mKcf3uHq%-J$6p7$_hm z3uCWku%duwRl16_N7aDPFwiA=?Y_>RN;v5-`$i0arpgZ&P?S~F3JNQ+AzHsf0y@ld zg*g`1!xD+%W!f5YnuYnej3J z&0dY;bA;cI&S-jCLx`WEe|fD!el872zVE2qzE2ZQxhGsso%;5&)@F7;u$*!azx1ls z6t_(=f>S7E=l6+QdF`NLAt>eBa<5XE{2)WjehGGv&B>cqLt z=-hYp(xWqhrblL(GXd?cOYK6sz;7Nw)!Koi*+VxvDTue5V$E8y>b-ITCb*#-bElA8 zpUQlty<6V@pT^fme8qC3H$`vDlCP+-z-kyH=4KBKjTxr|D6&|Mf!jLW?Bs>g$sCX# zAYQ~*5p?XbebymMCr8xGKNP#7hFn)SrMKBI3pR@>UZA_AoC`bDKg|DCtKv_vNmc2M zh}gnL(->2X^f`)|#&+FtY@lOq1ahxqE^@5J2~V&5-8z=tH?}o&v6UXjZCuD=nX{V1 znq1%4(0netHstF!B-~?uNT1ko@eLe}U*{5Na$;DY{~rne@N0#~*^^|&Jvn1;xu)%7 zf?A%&_76Ogq)btwbUIwQWi#C6<)L;#a|1zWp;}`|;fshnygSq?ZG?3h5~V{9t_$Jt z-KvXZ4p+y@p^y=AQ6{V$xOGt|+;N|3y=S>C;IVkz+EY4=)W^n_Q{KMGr<-3N?220k zFRbr$H3G7-+pZ+72UtgL8Y`RF#MWDXukEMa7(o7{HEJ(Aw?f`0vupQnsv}v}Dg5Tc zo7P%2s4QwRUMg?Qa9q9JwBR^6^sOCykb}7!(H_JV(lz8MM=lKLKe>m9YI^S!YdjBO zbN|jFmGEsMH1;}aNKU`2X)8pRE>sj;4h~a}&r%*AY{sEZ#&tzw*R$KNhv_LoG^!(1 z`BCfosG1m4x6?nu428_uS-fZsCTR@2G>HhC>pQ2}s#}$$n=lR6F7J;tMJn7*PN^cw zQ&QgbXj^QhSQ_lA{16V-7sa1>nYsM`S=tuFyHXNuk0eS)%o8X143-RGSZJdph&pPm zv{I4eHO~z2oa``tfA`dIKTSO?@2K9rUr&W~JyP}jUQn;h!B)~pniW7o!ueDELuvEd z2io^#4i(Z$2J{Gitx$OveZUfQb}oGBr@q#w6iRMpGIY_xU!y-K7uSMv*CgvT+jIW} zUb{CGbQHqlGQk58!zcBPqW0oFclOLTY;6gA9}zf&z+czQADyc$&OUnC{cjcxBB!xi z>UzlLJ5c6pPjTu$bDZCzXcvrhB4bLH#%7R{!$Nz{$tUvlIaYZGFO^cblPEPqkAa05 zQhY*HM3Xmg6Kra3X-O?ktD@SF>iP;mu@M#Sz$*^RkRMT&-0s4Q5U7cvDbv@?eBXms9&Fc zOJ=v_M$|sL>v8WDhVpPHmoYNSDp-gLwISx89Lm|bal0xqX(W9iOXG4?H=d4d?Dy5; zohc08^5AI#x4FHG?l!J(;59X|2LN*b9-np@hS_Btjma|_5$bvP!7VN5pJrzVRYv5z z%!I=S!l5hB@Y~Ao2*n=(T6s?Z@RtYT&?(oiw45eWrxl#eQsBDabe&&b{o#NxWJomV+T9B#XXvIB zrqBg(MM6(hrZyst!KNo{xRvGf_|}IcJr&TmZL86GFDxvL=}>)QP1RUd+WvH$yuNEm zSEC~7W!W?75aneowY*E2Wf?z#97_OMW#y!`<&c(Wx}Y{pT~O+ld@=a<-pYHY^BIHu z0ayQZNZjI|v19rkO&+JeM2kOce+l30yqmxd+&SxNy1QQ`5dhW8s2Fyc$xSkci#y9x z)5gXwur1|A85e-1LrxqNH^EJ1^V^9o4xZ5R8AiX9Xzv;r9W}>7z_u0TE|c&HdaPB{ zFcrev$X0TM)1jAh*-WLZtjy|rg$%jR?=M~+>@s3g9XRuUOgJC>`#OJ*_~nX1;cw9Y zaRT_m#EBO~|D%al>i#c(6R>=CK6ib&URfn+#z#)3iOnXOlFsDUuOf7kWo~dej>EhQ zsxK-1QC5KafTihGiP6~!3uYsh_V~`fI$z}DAMP%^Y#zM+9s!&pEz8>hD-DT3Z4wB7nq-3h9(Hz7 ze~}#Nybn=}d}V#bAWphz3P{26St?o&VW{pjr1$4O0u9l}^qB^%T+e^`+WDOPB?kKC zIl_D+Fad2PqmAErsw~l^Mz>Ln89=1P|#jU(8oH<;8+>; zLpE}5_p(HB$yA?&ZA;XU$;k<5VMU^-ubtDh()dVfc5Ihc?m;o$Q5iJ@%sV#EH8*zL zaUiRFsQObVbfm#G8NF47(84yd-(RC+qmsVhb^16~YeW*rPCHxj9~PR{EM-JBV8@l9aAZV%I-@dj zFL2-rN@X{but0_5K%;gIpR1HBhq3-}2EZ|N)e$xcgw1r>s!661(4`WcMRtaWzLtk$!sTbN=3O$@rxqiNe$Ce{2x!3U@k|BjrMTWl+krMUp%&-Ip{mMoY z1LR24Fwm7Gd{ExSiUaQMT!NJe`n1sQa7HjBUT9rEOzTF5<`a?j_KvbhZAS9YD4||O ze)O5p$lcrD1L2A0AGUU^kMcJ{Ur`l9!`9(i@4p zkIC#4?!3DGMbn3G6F>1Zdu31Xd zDvWgXvR|OljZhW-sP+?<6s`FrVq$6)6H`}G_!rUi%#R>t&aaz^8fBJr(3P35&%yo- z2;m%x{O`)kQVlG=@wLJB{Yi6T8fG%oB^QR#4r9m`dAH zW@9sOKS+aMAjG*aAN+HVfTp;3+t-%Mc4P#^L$uB482CMnP-E#4Pu1d8EEt>hErzgb z6<%T7xPeu=q@^}nZIauh*1F>Q7wSxXfW{~Fu*Z)~X|-H<`@7)wT9nxvm0yCQ7g}fN zO0AzwY_1c&9v}r{h+f7-fBXLFD|m+G`X-^Ev<+^|gSTvOMA}Dzm`kyIQcxtiSQstI zyE+n2r{~e{FNPao(&pVGR9*dR(y-}{4o^W4UnVp=S5&X~SD~)e{=tHvjFfC5%m$o~U3-#}?dGYsgHkQ#b(DzFX z9lfB;B_=KHz5IMI`TMjgP^}#HddR=tjsXU-WSk~ivAI!7p3B_E3l&dgYkGn!0-0-{ z9MZYk3i8Oi8<=&zC4P_I3Pv-ZR^g)MM=ZW>X%|5C!S`?vDapbiPP+yxnw!%UwpP4} zQyKfUU|OxI6W_83OJ>4JE^wW9O@E1Pc;9zzy$x?`RX5ZMK8YUDyr+x z$3{gFUq{2m2@fu~*Hg1546}%n@utrH(yO?@;}`Gg`c(fHZQu3pH?(XF>}u3cEjQ}* zyi#V_vT|ow;X;U#SbVS`DXMjVrh=;0Nqv#28wIj0Zd%Z z9XVsxHny_TK5RdkufAzOC6+HYE>_xH-CI}OpQ-A-ZcGxZ{F;C4JDr{ zsn-@QsD2k_7FGWGp9(xP zS_NPMiv4l&ftDh3!;V079~%V*_F*b%op><#ZHi7RxX}si=98@Z^tdElhDgpL93e6I zpKRb5b{0?k_4#j@R%-@IFEf4K1bp3Mq%#c_gur_JU?tmsjF+Dm`*+SA)b@T!{0sqB`&xcay23Xy8NMH zr&5cdN~jl8dx(B_@L03BiQZS$680eIvpRUX^;jS>F(J1b=ytW`FVnIv4Bu+Hu_V-H zK^*0ZH}ZbCP-4eNEKu}cqf9}@kG2wRs7gX5h6q3`xtL#8x>zZ;FLPF+_rIf;xCaIrd<4xgS$H&Ls{mIc)W_JLYaW3sfPk>QdN;yey-y zsO&tfB<&*(0pOd$Ef#N23u{T60L`;VxL=MvsFsk}{AJLoow%J{WW+3B3gBf{wrLOI zR?xkpY*EX{O~%oDdAD8P+&0KM@xMeW+(g`rA5uJ*#mQ9|@zLxn)I3qszOQk4H$`7H z4VS!0j<0quQIFeT^nw^q#FhAX5G%_;a(qQ%B*B0_+yH&WkR}xRstOZVqxjvON?S?_ zR3)h*On zv16RB$E?b!g4KNX+4}E7goy>R6hf}c37t2(DDkvssIdaifsUfEK+Dj`%nFBpx})SR zPydbi*?%O&40aiI>~3Z`?lMVVS5%Uip!iqGPb$)tCPKpG>4GWod!6HQ^#6;tw~UHw zZMsD_A%O(9;F3UaYuq6~fZ!V38h3XM9y|nh3zA^LA-KCV?kGg0m!?=AO225djJ%Z7-m+1imWS&j;SwO_Xq@7!B zoaCg;?druvdb=mT3bVaOVoUf7Hy3QA$Ln9_dvAGlUD?t)-F%0i;q6SMl8-n)?^x}J zJt(%oU3nyMx3NREZYt!Bq<42`3d=RsYy0A2-4j~>3vpWRuzkAa;uHVve&y9%B57B+ z7Fz56nSn_aqUX{*>cgGy1Ff#x(et~rUlq`dPWk5B7hb!LdYvPg*8~~Y*CX~UxnKW~ zBXk@j;Hfv>g=!E?&0k24-g4McMG`I^G}%c9V6^S%l&zHso}xOThO>;XF)+S4IAij< zDKE>lG{8M|6ejlCR=etV^%dc=q%S4)g4es-QcePSU^?u;x|y3pY#*;axozP=wBw`5 z1W%=%=+9xD&(SYF&0D~4BP$9fBr4jS;|t!;GUvFfONhUFzkQEHdOKDNDr~Mz$KhO4 zg`d_)jvDbjw6!nE(k)HY<@0ZOnAldB<+*q-ZQa!x#GE%ahc&k=ecV65ymq^MgV224 zga>}bB+4-pVe1QXoN;H>*eWSvMa_IXTVC;!n}jDZF_A@GIKd*|CgYvw1^)^o?T|KO zmhUQfSYx*5En%$@P0OBg@VbVybon7`I5ah{unOMJO2m9pj~cA9bh{kFgVm4Rqv|d? z;`$x)H~xgXJNZFIp4+I`4HVb~Z|*HUT5T;!z0(-)_&>ywlEw=UYp@IyfK- zo&srmJJ-f;_tf$$B~1lu9GC+%jb1OK zePHtn(0wyHxpuDR^XFqomMoSaFwp%)T|L+OBG-f=uw&+acjUNfd-?4EVQwuip58-y zZk_HD0lGVA0c5xOw%*77vB>SNPw)MY>H+7D4|o|@?Rx9IlS-Z84}QOD5YS#C1iZXC z_{dX^sOP&jZ5N2AC>^{FVfI0uG-7%I9_RMCxbK1OmMR|y8kUWcJ$JQ$uWeU1eI@vq zJhEaXZnfWmFWp=3grVni=V?Zm7V~y08IJ$HQ|)YZ?Wowm4&jUr?3-Ay-^1fk)cuHXVB`ZTbq#L6Q3dg-| zHGC0BIIQE>Tx-xa!%NQvx9fuC?tyuE1HnV;9xb}#>N2kvJ#2>6>^at1Ll%;5vA6;v zLd7Ia;1%+6mi~*TJ9eL|qUo%fp8no^k}mn?Q?W+ZD_#+ZF#|JGtJrk;xc4>;`hj_r zud1iTa_XoPqjMAfXpLyulR!@IWsn-$deO2wA<4P{)hqI>ws4^bG@t8!-I*p88<5J5eC4%BJ^oPJZ?vSjh+#ww!S<^wL|4O?zQNf$>JQJlCHXHW zYGJ#>xyRzrR2|S-m!221$%=?$63Jfs`0_m+sqb3D6>MC7^?>9yJE@+BbnQ<2Ia=y# zQoUmD6^}111D*o7>`&~e_NN}8#!#|hHahBufh=@A0+(D3ThUQ){Jb$W0xJh+xfAcI zOOJ`ZU4yn=7bP!Oo%S%tj$p*idmyEbR`PoG>OzgQYeaV;jQ0K~5y@(KAuRkzAk6iG zItDIm(HrNy>q?NIj-m&BedoxV2yw)u*G|}bi_&Y;wk0rZ=@mC40{et&b|DD8VaWr| z_rdfLnY#3Kmqjd;N>e!@1ZejqZz%>SbJ!w(Jt*KC%wR#nM=eId4ju?Gb_zc7In#PH z_;DSI&*954AGr)7{Zeb+d{}-&7IG&p+vkpq_aHa6q$H>-TQhP&Enx&_<)WF&6AO#$ z5}a{z#hc>z{YAoM!@kG~-%UlmivIkK$?=!3$;hMIJggWo`tOIi?YL?-^8JVs_8RoA zFn!L7rnBvzZ~WHb3(oxJH}Auqjj# zJ1CseJy$4m2{G6t14S#gkBR%%&-+&OISq8+YoR?|@LGll!$cpJg6^*f3F??Ot*ku1 zqAbWa2bk(DA{Y3QGOeQkq*J?xF-j+N`W?R1+>?`W_YZk6)bZ^d7z;il=~a`B+kK8# z?#p2E3W>@jF>oH64Edqaib`&i+c}<4r&`PTI}2VLf=<`Bft9zqZ{aVMQAX;F6-L>E zwljU6l^t?FQ~NR&x(nN@^K(R`)gvXEOW9M<)r_d@xmYcif27QCcc$jYv>&9TyR^~f zc6>%_UY|6P1SQP3Y(LU+9>UK~OZ&F$7cNth1QXRBfLx1xSZ7mTI87D=9403wP)jTX zpU(Al#_-H@S#;aR|2Te}FjpvGF_atj+ifjY4L9FpXSd)`VS5(|^|NR%UivFGG=Z07 z!s4~l?^zBLD0t$Q(+(Mv9k*cJGuju`_J|juY5k&}dD~mH@g&xEZI%mt$!ud;)q`aD zW^3KZE(~^u-t6a!mJx3KChS|(T6s^i-$hKdsEa-%0MGXrKf_~3NBxMO00?OC%(8K)?;tog^6_tt_ih=#RbQ9Amt7F%vy?sN%Qc|qH zgS*#5my;(EnAqi~Uo5iM@?XBo@G`$eg`d_-jV|+oA@}|y>OApB@6u5Fn&N>uGpr)X$6#USvYm{HGqG^I)K{ueFsSw=V&70O>N9r!N+1r%i|Lv#82es~u zkF6yfb_GkGXv~QP-r{r%^tGdRxd#u9^T5zYA#K0U+XNJ zX-ulx8&nx%dnTq#!RVhA4mk0jvVK$(B-1ATuwsizj}I=+k>YM78nN{-g}-EKe&`Ih z3))u9ut&(eZLb}j;iBXk(TaE5>a$(px*dM|(VgU=xNXN#O;Pu2Xh4Wu&Mz9gf)Tye z>IwF$aaXNRx?%K*-xO7K1H#6%*=uXwa&2oJ_ywa^KMGt{r1c(|cqI%GCbAV*c5HoL%}47{=E}pZ&er+yiKFAy zPIu}G-7r1eC`TL2eAtu>{?*J6M5y1s#>WJU_C!&HG^aXlkGzRKnVKG#omL<$%`eFP znS*2OlwMWM3AxtGa(mI6Z&~s^2REB<>H}~j;lBf#v`}0S(d6fjKZKBuTo5SoSW0{u zOkFQ7-~;Xa;t zkKKF?EjYf(h&`4_1Z{Jy4TdT^QS7x(ju*gE6MZ60eXi;EXT33wnj2n}HD4ew#qhXq zpR2(Rhh4wMW`^r%Ewztidc%cW9JI2HJUr`r@rg(do{Y^-sB1P&=(A99&&eA3nEX*^ zf#B_@s_2pSBbSxV3$^1(TftCT%fG^f`A)`}va;%)$8W~Fo#$;I519G}liZ@M^g`g> zHaDk#IbJgD^VA{QK5V`It~b!V>OBt|*K7W47$R>lP&8tAo4sx~&STR#wtuQlc*|^r zYmkn=>&U#umU&G)CY^$j5l;Si0_Sz;s3(5!4MniLkq6X^%zC+CQ@EiQYR6p?LeX(!Cdtze z`B-TUNuf(q2>YIw0(Up{dMovbOPw+Ix3IYZX7F}K6Sv38%gtNsG=5K%Af6q!t)3D6 z`I>{7lN)Kbhw9qt#+*j%_EzIfyqtKHv^N{<m8)++yrDbj-f2yb$LXBOJCIo ziS;s-#lm0mcI{1l>Tyc~dR68f&!3ZCpZW&T=apx;)^A^|Mn87=c47EWsZ-}8XA!A@uZ=FXJ z%Dmurldat9Y+O7h-4Dv1LWK0vcKZ`NGAQV8Pj5K1<)z6*KYdv!M$xYS7B*L*M9k-c zf9-6|WdS)11le^BEq9ckE$0#07jt$O5_S&=-IF$--;=FU{+{*O4n10zl8axcVJ8z8 zHK(evbtmd05Hqu~5b2MvEHpFg8GVlzmChZRvMZ%B8MhA5y?Xl?KIqy|F}~1yp_0L=N6)nwGE4?K~*!NiH@mkkfZliB;M_s<2TIaUA;C*IP`XaWe zWTw`*sJQQE&K@WICX&ub9)7Ono#vRB5w2=>Q^m_4eSIHC1|-ZiSiZ$FWmnbstz~qC z8scTM*({86YAYZNEZ-)+Bo!hazsVT97SXsm9x8;DqjBs%%@}so0gt!Uo z&!T?2&9&D!8;RsX_k?Ka`~fVH8u{@rS@3qx2Z`CMoktU!o;%y33Z4r+AV1uc+v@L4 zxgMW{Gp}^v>4{jI3g!3Qz=n%j5(0ciUZin1ZOeKc6h*IBPw(7(ziVlDMA^@n*|Qw2 zJ{c$TA`tRi|4WBUk%o^5)_uyn!f~VP16!wt#h3YFPlxRqmh~s%_7#dvyT3!(p@uPS>w~*a*;dE%<5nQ9njJv>ab0dVlLXDYEa2sFq%*W6LaBCEpZ{76<2NBFW%i`}*bRNsog zm<(LvxdswXbYfxYk&pZN!D2MLdv;0fwKm>(1;f-}Cyz-x@_~V0T4xG0!N#d{e!>O8 zZENpUYTO+S1qtH?-lV&*saSCE8(^5gerpv4s1^m$3kSeb8H9iIi8mN{TrUr#o3D`3|FUjo}--YlvJl9Qc*3|QV5r3OXyPnlIMd@Aq@f=NDK;`>}5 zmErcXoLJ0Ml(JNNpb63^R)st;(kQjeOprKXg@2$+z?2jnoSmU+U}d1Gi+&pO*QPTe zsqaglOd>%@{?}oND){j|6_7^p30Q`sB;T2YKsMHjtOm19;iYIt?g?>_U*#TEjMK%t zi^IjpbbwQ*!)iajH1BtjK^nL9ZdGg92MeC994^Eg4ZA{_*>Ep`(P-*a-??Wf_06t` z@USzEYHhEdm-U>aHn-20=EM^2_xV-jj&_sFe{BZzdwHqAMJ~OY7I49yh$~Q_A)l`e zz3?^A9N80zOsX0l$B6N$2*gAD>tPt|@^ z8vP8FU>C#cSWp&WGScOb(CJ~K5VWQT@|vfA0b+Hk?+}ivW8KR`>!r=j@uani@qU_3 zQx)`)zjCZ3hy7GxQ1keKw3u?(k?(1|f-6c2q-oo?G(SV#-PtTwcbW-6 zNu&O9VJcLZVbOq)vA{4=bxY*_-Ht8+cd6qa-GMFL3LDh4(XeFff%uV3_QguILLg-f z{9S%^MomkKY_pA)WDj)VwuwHK{L^yrbey25CE#W;PJmcQ*Cc4 zjV#ib68B$SfY31=xc;N#pTic8)uIW3h?K}_#Sz}c%93Nns03}D7rBv%Pum8siY*qp zcMzay>p!p_Gfoz&L72uwy>H|exPu8l9QLEeC?q6g0{U-TzC)@XGVeZ=3jQ+hLW6%U zr)xRC2v*QjFv@MyZqSPg)Zt|(CmmV`4~KP8&d{?e8?Z}C((y@BJ_~aN5KQ9mHt>!@ zmY#KuV(@z0f~(YfQ3SL_!+-rN8qnS9zR!uzz`39KYyAh9I)lt{tp$(pSfVGtyu|}o zF%w=&jG2xw1u`)cl|#=%GsOJwkmS_Tn0dlC~_ z6AkIw8@E)Qe`N}Qq|wRwk3#S9lw-4dl!xz1K`n*KtI^>F$D3yaX|@v`J1%X786sjD zuTD;o6w{Q#4yTwVrl;Su{37NE>gpY640|G!N;e0O`D@3islMUiL5%&Waed=lEj+jX zAC_lhk-;DQNT{-|K7tbEBEP=&8OfUvyBHU9H6vAli9S1imZGJ8wp&ezm4PRx-5+#ViBC0(yv9-nhpPP`Wl3U|l*!z5 zo?HFR68A-5iKk6?AeD`|b1J>!)c<8F@6^jPKoSUfL;x3Uf1Z`*8HB{O~szp@g+`U^8lH zK_AcYS6CfOfD4;91WbORfzJTW*eIt#b=RJADU(?M8~0Z?KLm-FD#^lN8myX%3`~q*b1+Y7wEB&<|3nb^Reo702{6=$u>3iFhHHzZ_X69|&*j|F)bjqC+j zP{4DIP5YO$xWAZpJ?xsgtT9+FSLXIT#6ctF_RpWvy}E;Y?gh97r?)%pijA<;5-6EM z&W}=ryiXj^y~FpWBcS}a4(Ki!T*4Ma$%~}L>q3pD*h&tV=k*?v#in84d*K0iAsS9$O0XkoNq)x-d+D2%H+jjb5VM%dE zw!r*x`q9JZ!6nN5mK()^}>gDwpKotFy{m8@zbw?&7m z#Nt)xSmekQAxtS7VG*0^xqzG-KQ16QLvi0u35XaHnwIKFNV?OeSPUq9jgJ^N9bVJ6 z;I*(UQqWP3I{B$|Jy%^>k0pVA)HNH&kCPWGJkT#}qf0=CM5pN1^cRn5<=0rX&tto+ z6A4CdOX^7Wi|^#7Iw8%vkrW zCT}VWw{?Q`g=*$JB9NJ|v1dXNGet#Jaz$eP({$AdOiQ_6_LD8 zqK3Z~Vy6oM*@};?;R(MT;#8*Eh;;qOi^b(k=;jc+F>K4l84L=GUJ(FFDmwEro1o7> z!;o0(IPl3bTQ{-!?CvZ$RiiM@<{;W?en?^SW%$B0SV3|;ffZv8gM)?H#6)cq?C}JQ z)Ta3m$Q(c!VV|gRdV?R;sr{4qjE?o_TsUQglhyAH9kiTLu> z57f_Ur;#&95X*Y7k3Osb-8->h(ptVLVd21ff%4&3IJhsL8+oB0?B(Zab=t@BGf6Qw z%Q+}%!)Dj*mAz_Z!Kfp;}E*aYm-vznd>>;r!RKt0R1}oy9L39 zz%d2`I43lHdSdhjgAap&&4`_;)~ty;^ZDWtA@`sECZV_g2C55YJd!zTKh^OnK?_CM zJfu|r##0qQ=WGnfo(a4}%$d|TSR7cEalNw6@b7kSV+$|AI=gQM;)Ph-x7n0unaBhQ zPBJXWvC#WdOu-4e;A1Eo@T@v@&-L|1VW62>{bWSKCL#Dh4A~J*62#=1x^89U6Yss3 zq-SINB8S9OD>2;p%cSM%Mv7D{X-4Sc+JqlcV?)UpLsn0=X-GMEn00`&73!L$E_o#P zAHfU>ey8QQMH75W#)*FBTqIf^f*3q@5=+vmBVTrU@_SKl0bY+AaE*Fjl?Iqo>w65A zz{e7V*WKL`SsdyhHqI9%E~}4=bSP3`AY@%h$jkCSGeshx{Z;r^_CdpFG zm^H-8KnKs>nV6`+ylpZbOMVl<*S^c|1emqO(S8YuT@yY)jt2$E@l+h7E=IwHW7|f} z!?tBBxkn59#tp!gbf`cWp$G!>gm5K>JILA%Z z+Nq0Tk;b=bE?U$FCh_y_Xbo)tKZ*xc8;WVQbr6aGMw6DdcAR7UQVGE8qhVxu z+#%oENRk@xi%HhFqszti{Wcb0TUDsYZ|y$~ zrtaAA?=k+MXNin7hNKv$<>z0lG!eJ)?Jb?Cm<}FY#ka4ijwC#klXWip{H$ZK_8VtB z-%U5jxr7i2UR?JMND7GBlW(l654=Iz@iN;m^{xgn2rZo$3=l`3|Ku`6ukoz zkdeb#(=X!zg0I0M;-V&eL2a@EWcKsVQmT3t0w)+_YV6DrG>0D#XezDjZmkz<;AkMZ z4Zl6EMWj=h;tHa;C-lm5!>E=b5y`Pm?TCQ1!Ld(Q<&-(TME&%su$WE)JNb9JKUN&x zR#pW!S&(scA#I7U&L`S$%1Vm!qhG!muzEYA;zRek-<#6+)6*+xs`_=ONU2Pye=!jBM%ov+t!Uaca2`HJix$oV2 zc#XZs5DGy%mda#pyIFbrrbD-h>ZTt zTnF^(t&mUVU9uHh$y}l3D`^`RBjwZ}$RCs4+sYUxo?|ogloJ^?wZ72l3 z)_~nqUUeOFr!g^$_)y< zRYxy@Zqqkgi&M&1Go9@D`8~ASey==^t!XW@mYvg!t&u&_@kvQL@FjUzk!-o26?}?* zsKGs>>0Z4ISs5dOW+#tL6lSL>=sTIcmoqF>l{Jvzi8zdrM2U{jxB3-uA{Y!&d|_fj z#qu$;sm-qO9lptF`NeAsZPG*%xM+AeR;QeV0cyR>Z`q-?c=_TNXE@TV$~mHb>UiVE z_1f<=!*qYju>yU@KcLPYhMrzRZ^4}gCNkeK!zny-q(ZCGjsB7aS+2Cnp4M0wPJ-FG!zk_4zhZ>PF!=PZU_!e9D6it?X4 zJ__)k_}+86R6Wv$|w6O9SRu_i=UFY-4~s8XGZ-AQ?y%N1Gi z(_>@vH3i2Gxl*N)qOw*1vT5wsxHz=fMf5;xs3o(oq&I~?@%Gx?HF7TlorI$_hi3n{ zf|6=z)n4Dn-wFOFyR0|`o5I;i?d@aa#5a=e#cSOTrA9lWYFn)=r3TA3s=nT7;n~;#S;Vi? z2f0mS38iE!d=W%6BS6L$N+~~Hi39=uPU;=3fdwx;wuNNRTK+pofJU5R?bCKenvh4& zCWYJejHlhGDMZzkgQJP@>OyN|h41K&c-do}n#SxW7V1#ew9I$_^j&^8AcQmjqGU3_ zm{od6&x=6QI^o26Fty?(-+s;~1?cD5}FXEb8Uj^bcp^(f?m zpqh{Zo6XKM0QOBkX$TlpVN+@D9628_u?XZvg#3>rYAbm6r|KA{Ofc_Vwea_HW8PQM zYpFMCXw~R8YE=_LlBHPKqH>e*VDZa$_{>kzPPC2j^?+FWy>1=6V12}3*Om>gxcr$q zDkAaA;AiUQQB+YBCpEvhiuSGL!SwFx8r{QwW1%;zmpm95E%ni6%Qba%A9hNI8m<_| zbdyp$MDDV}otTPpioxbKa6Tb;ZLLFU*=u#u1JZVUCHQYEp%8!Pi0C~q&(xowf?5dHLP#D#ImAm*% z?>KfkRO(E%={%mLgJ0&CpY$6}J2GNeAbrM3x**q?D#f$2IMT2{TN(_sc73+C9s813 z=;9(E^`T$Cclt5}%a*oss;W%j{a3X*1mY4jrZ9@p@L*LY6jn9`cMLdRk=i$YiI}pC zM$*4`M_&4xev->F)XuDHF46Jj0|hW9K{9CP6qus1|H>ym#{h+Kj%iqfzrJh&|4S;+ z^`{f?1_SniH-}32EFraEggoP;-p0UgMHvtJTjZeRbk5|S$T+1EU_on zn=^9le}!IoXc8Kw;L_S-<8qmUNjuSftZnHL3dA>u7U(t{dbxEB;mru4ofE|=HPMQ5 zI&ql@jrK0gf|p~Lzvy@Hze%w{`-EPoNsX1W?a+{VUn9C*U%6=KpCbqTs8e?$DL5@% zv$Va#m$!MWzGG--!qrW@y+0Y%sv5c6w9E__Gp~CymczdM-O%eHk8EX#%@c~B%v$>K z6sX(tU-ZXb?JO-TX!dc7?xYXa`x|N`9yhsWb|m_q;#?GDw6RFZe|P6U#nR=jc#(O1 z?s~kmN%4_xK*Yfv4T+F`!(Nxa8FiaBQ(!&7jOZ}lBHz*HXbimH;)5U?paUh|li2>) z5-r!2}(8)Z8Mq{cv`eXt*u0 z&D6j7Ed3GP^)97?Tk6-GlxuveUkLhQYN|Pqa&OV9)Xc!I&iyOHRty zZmlFK@J*mF&h(W>w~K%Q0`JA{q3U7P$Qth|c`2xGjbo)mRbs+mk(Lqsd1_q_hMnhJ za2$z&dQosrNStHou|2sC%~WZXMQ0jv8aj{`U~D<+en8Wxp+_ffp9ozJ`gusTFUu43 zc+)YmM(wGayBs*nmoZ*4$f1}b+h03xDII|7rRARYYn z@o!lBsw)g{#4Ft1)C-2FvB-;RY(Chs z&oR%P+a>*29kGl+c*j{4<6xJbz^$woES?PP+iy<%m21V(p{49$tLG|H=mBe~$qhpS zif=FvH+S@xHTJyiE^%_2wA*F7@ZGh13;F3An?ngUrhdDa+MeF`_mj-cekE~JOO^$8 zblY?l7SeVRYmE+f0vlWjvE@6tsWNkP^zbdctkHy4NcBu@#`sKLwFWK1X)$R``@x^P<$+-Yuzhw$^KQZL|R!~f@XZ+ ze4;J%xOcSLm3t(m>`=`fJ}8ecyjido&ish6?6tRzvyDZNT6E%xxp_Ja%Emt#`H)i ziJHDPA7zUktVwMYzU%Gp1bHK!m~M^0P(yl-aWj(r>?+Mo_%EPTHV;M>@e&4j@Ji5I zyfS*Ry6)lv!=Ibw4L!jI=t65VXDe*u&@y_l&r$Mu+m79I$e!7mMO+*K{G2W?fBs>MLI_N zHF|=cuMKyG{1Z z2fbUuhiEmR029S?6sU^&txDD%FwHPf&B$m*D7o``3*$$y*%9`z@JSn+<%IBu%VrEP z#5=n9z=?}@LoWdZUg=RKch%`nV7HHc8V3wkDqGkpQx@sLW96;e+j7rQ9I0noDMuxY zSDv-K84EkHKVBnXcY#FK))Gag8<}|gwtLI=dS0GXSlIbRiK`O#;;&mzMJ2re*JzRt z;`VUA5fMiv!8$-T0&3Qg9lmYHdrmiZ>jA+;KY9m9Zbx}<%Vn1~1+86X*QcV0s!^x# z@qgNsJRjw|E9^$A0Z6Aboos@GoaY|}kFASWlM9?q+MTu;#&hC@F-E5-0H}_fL zbvR5ld*)<81~}Fv0;3k^<)9`w@mzxbP;(~*&Gmj-p5d&QTncsgSM`-ecwwuG^}Y-w zQqh8!=rkMlChO*3Kor(wWSJ40YIzBJ1`TaS?Z-)2?s<7;2m9a5&73MnzjZ1FCQeNl zh?is&ebWv8QLQ;qTSLyljJF<(JvywUO@|$$>*_1?t%7xQ320Xz8{-*ZH}^!`bp32& zLhr7l__zZ4P1{m5qQlS=Pu?O>ei9iH&Z_XEn$;_5_+C7DlqZb!;DGE6>X@li_^>r) z3HWz;*m}5kmmqm_XabuG?!m!gQkH|Rj;dy)+?HhAX3E`|D?yw`Z=c0Ersxkz2u_`d*a`NUvo7d0U6n(8E))Th7df?_W z&F2Q5#%=U~3J_4$95i_;b$j0)>k`*FAoM6PtwO7jtGJ(V+3<9Qr*k;DT6#Dmv$%DMAFGqF-?~3QGgK|ZBe>y=I&!YRe$m$PWF$HpVTb3@4fg5Csw_E}}|`3s$nd(m8I z)^hMo$}@F--NMOr(9juVd5nfGb#8QS0xoqC*_ZnZ8f#2|w}6uX>S*=m=P8S~u_b;% zGOnV=EK-h@iaM$v^Glzpjh|*EDfBqDg9b~0KszhCAILu$kSrGVbW`nw%wmzP%t*;s zxD1X)dKjrla_O=BRT1g)yrgOoA$|Bgf@zu$|2jN*s=;kv>K*qY26T(QV{O%7W%CDZ zyo~h1SG9{!S{MFob!`^6%GcsyTvD(gjjv!Q?YC@QncvTXt})HKY&H<;iE}~VxcnXQ z(t^g90aWb;y*OV|N3T8%IuU#~2>xNKPh;~t&|Py@oQsB4QK#vi71dmdMu6qGvM$tF z`RX}i*YB5j^BhJgAL?f0;{w>}4J5G~FE3Eh`h*KNIm^){d3YFYoyLv2jhbl&KNwS@ zXb2_uznWv3>Z*B7i(|+_L8uqa$mlQw&!XZVB{SYHXh4fHwt}(v@rO+3O+QQE>cI}t zXMdp5l4j_ROPKRZmo9N~n<)WXdHjUfl$~Xqav(6l0$fVtW#uJOI&g|B&8r8-KrZTH=}F@Wza9jtLvrf*`s-@=x-3~L^E%kg2&BeY1^J-G8B!4l9b zBv$?^@367#s!n@xnvw@UaB@QLI*5SWp1+(aq6qW>iKR$Ny90-*UoGu6#cu4cuGc;I z#3Ws#Glkk{V-@n*UpM)(@VnoomxT=`aHGRMJEfq^R^JgPtECRTZ4t5;K#h#ZX=;$r zl{V1v!dtUdD;hWaLh2L)N27W&v(I7msw@1s3sPSB=$n(DxmWlkh8I1@iI z7#Lka1P|xd*Z6{5ajxbK8AduObKJV<*oSV-zR-&%ewS#Fvjui zhW_3fYT)!<0y=5)q_Q&$N+klP-76;{lr(%HS`i_K9GK0=;YJM0({_NRV{e$gBSjEg zFY&Y(Z^0`fx_lm8jb4U^_#~O{O+672ZV-3OC-I{HOcO?l#sB+G+O6jA#XiCFYVsO; zrbH!}s3d%P&+;>(2k3I0CI0f`@q_1Z(jYKrO!+&CTnClLj+VcNr8_)X^%J6 zbfyKm(nEBX*FlDM`Y+kW$1C6}!hK#&veEG*dvlYTHhF6RG8jHmcNYtD*q_eSWk>oX z#BBt}Do#KwCEX(Ifl(K@DADp@MZ&tPGgV~AstCT{n_^d9f;Y13TW?VuTlC=*-vh}q z%;qH{NGQ(BD|3Qx@-=ISatxvdDz~jSu&3J#?@TT8LZt5&;*GRFO0~@nsIjo~i)Twi zNytPW^~uB~LO`7PfeuDk6rvRPM2ZF$R`~FX>1Kttt!KrKL;8SF=mOtUWO45n)DPJ5 z*PGx;o=hiHyt4d{6x6|QF$+tm*r(zFvVTW!Uy-ow>6=}8B89K9;rsM>U%d`^>FA0; z*)_+Os=@X0e zE&tbJKtvQ&RndVR4tBbL4k^liefWu>f(iUa{}NbU0&xAea1{tlI{mlQ_H^_)4Dr)S zi*5(kcI?^rG2L+95FaBNt?M0Hk33Ob1{YiZz6RON+RXf@1A6?jJ3oJPYAh`3LN3XA z*bUH!11fzjr0~ppQa(QMABrh)U{)VWQuCB>b$txa^cjA6}@@4Kn z44%P|r(w7MVTXUGv4DXK|K;-hYil4EE)Kxtzjq7;7(Us&=(%ys#{Uf~ewpM{7mG~h0?90J6} zUOqy=6we4Mr%7H8B4*cxW~B$#DT#ltcmG@|z4{ zSQ?=;KmYaOfex?-^&Be*{iOd13^0k#b0hv6vLBux3-BNjlLrOyk2}oR+YG2QtjqiM zcenxh`xxiHtA?Ws3&ip!BLImIcsig|MBU!?eAMs#N{wXpQSsNbR$Uo0GPEGfZ`kt^ z7}=YDyQDU#ZnHJO6@GYHUw{zCz`y|6NBY|_U(5C?FSAN_{VLM(uwmFi08(CEL5-c$KQeMgv;RJy#ta+)kIi$gQpTyom^bn z3>>=+|6sY}-P2HH0EKuLe4|qfq1j8q5wbD{ZokMl0CLiyTIc_~48T-p=ZFKT@|Z`g zXjy?mD`L70E>!?2RqP9&Omvf20*?U9)xRxzKh4so5=FqugjDF{)nO3#v2X@|1hC|9%hz^m@+UR8@6G#{e7GlcNT}My@SmbaZ)p zq-oF&wR`7p#~q`w{o)_J2icuMK*gN&{7i^4Cdekv9y7(9gG0>!fvhJ0qScL#Px@sq zk)ENTWdAHCer@~-PG-v@?o{omV`u@ZAz(C!kK|!q0 zk7Buy2Bp?*zb=cA`2+vO!}m@$Xa*vl1p`67yniE3@-CkR<<#!KjrtekJE|WoM4^3q zUFe%(FytT+F2ORqOhBoMH12S79s$_Dng0fKt;aJcF!ScgkcC~bvuuMM@PAyA^*>T< zf(*cQ|E~f0Kewo-pl@qi1eD5PH&-%BB%3rzw8?^t>-OB~kE=UG`?ESwwAqPUX9}?l z;gQbhgB5jjqxw(iWGqo&_!;KG@Qxa zVjL#y9-n(4PonVnTTFiff$i73#A!^3`325NN=4b@gITo=h!lpgu!H|$aDZvn)g{J5 zaDS@|IE`Ic9gR0pj-%q0w=Qp#V|v}w5?^`eGyY#8%u_hbL{)$n`#yYgQA$ReEc62g zWr-KACNtAh*hI59UyBNawDM052~c#Fd0@y;PfSSIIJy70UsH~ z`>)gF{=apaq{IVl7zuc|YnHBXT{>t%YxI^HXvJhc)SdQ;6p*Vq%>=yZqvU#GBzS3Q zSas?G3u9OVaa5<8YI$P>WdMOR8eRgwE`!B+5*evPRrU)%9SID%k#GsXWc9BAjNJ61 z5Z`ApOSJDj&Pe2{Um$kkQ^7uS51h#dmbr?)Qr6sCRM~b;lJYVNg@ejvds~dr`Q-(}S74`O8-dD|n9Ughqdx}he76anUyw+AFMJkr zLik}%Yopx1iqQ!e&dEsfWs03#Nj2c3Fs)aMJNi;VhUk?xD|wviJ4U>i1p}$uXZ%9$ zm~F9mw0e|ZjJ7Dg#Y7+HS+X`imgtnPBjrKL%S>7?_i9(Yw~Pa0*=%fb+3)8slzn_@ zM<~5GNZ#_QLY3(J5#?IXC&@;AY~MON}F7 zthG9RdTXNr&S`p+I;+O_Hf@In^PQe=kO&?my)?*2Wf}|8@7gwlmuLpUEWyULA?*h9 z3Fh@67RqtW8opoqd3NRLV{sg~BykBYoIWV%3A97TA`&1WP2S9{;}*3|Yzt0)~Q(z}2(14xrzgiwx@KtOu$AiZ}Gqy$2d-bI1}DqZQJ zgGetTJt6cC3B7aUIS=={|G<6vmSLa-mVBk(QN$; z!i=h%k#`fu+1Z(PPrFysLwAe(D zfQ)>Y!mXxKJa2^y=IrJ4!54Lp(3@DF0y#zz1J5)X-uOHPH9%^9oTCE$%_C|yH7*{d z^)alpq0^!x?q>@f{w#LQl*JCD4Mbmj?9BLiGXD@vuxMGP*iNs;HT}7#*+bI8=naSG z{q5hI>ILYz27;3+2{C5^NxTD^rugdifXrPG-}Z4W$vb>dDhAv37(F2m2P_|qoJ~l3 z-0q1xHAN?Ezlh>3JPHLKTD@l>Ua6svxsdpqeX*@MZjFC7b%?GHc1!Z^Aq0DdBSfcX zxZIz%iPsM@{xSusyD%c2c5O8s_L*c8T2Zn8C@eE0NLxaKr6Ocix4yvDe zvP1^}6N(bX&+v=5-1q=~RX&8_9IQlf%5v-xJNi`Mp_awZe8Vbt<#abi>)^L;g17!> zKi^=Fo5im=d?Qrx;c({TaSwU;$SU=Rq?GuLs z>T*aNRl?|s-ZTnq^O}!?dfaVFHeZBOC^S38@Q@Wz(vp`PQL9X1+F6R%ObDPhOzlsc zg(HKLIxoIdbsW8OppfyquMq$IjdRpOviu`j#O7*Z$}%yKFB9otQEU@(|F*$jw=LDW zkLw*Ep$0l}czgK5Xpr6cpGs5JY`4_?=i&19g15N^uQ&ijBA~?g~eN5 z*Wmn0=!)%j|EH9=4Ex-nZBuW2dP-qlP?l)K;O$4zX=^h&1t+nnS<;7}*-WuVus%-p zY5;Crf4O!Aq(x*nK^T@8xlAXYsakVQs(J#KX5_joQ`wB4h_nlSNhKp<*I)wnr2N$V z#HlIAY_Y4l^~=W4#fvwgT&7a6VVRD-oeCsRE(8R;`QgO-`|(zvCOR>MkYkVhBJt;& z%IJr%pEsmcHU@^ZbDugX7r*fgX5@N%k}e;JRbLT=#%66re6)}o;~QZpgX3>1RJ_04 zuVf2AQ^{!EsL74>A7T-8QS4ttt@VKR5!No$$Wkn43C4OA{ijN)m#jHp@0B?1nC8n# zy8gVVMnXs)v~f#m<;7FQ!EEGu+z+JeD&K8 z4CQ_!9mPxif{}Q@Y2wp@e7*&jGc_%qs`XZ4LRxz5sRkUGDy~SqX7H_>JyaFOVE8n|pb(zvrp#a?oOr}6 zi@sf*Mqh6R20dvKsH#(nNx>3SWPjm3R!p8=zXA{O;9Z#jKvhrq#cL^>5Jqn;qc3ZQ z$sN|Cm-{yD{wD}yumf5uCo2tTiZ|$i)$2|TENU86^-x@? z6xW)SI#w~vct7m4aj-igGAbSw90L9=TClX+@bGZw3MS;qY=!;irt0LHSC_RI7Vmep zg5bkk4fCyT=l1E-JE5D0fJ`#o53D6{B3YLU>Sq2?pMrpHtMm0@^yQ6ngX_~8_YN|P zry7GDchks%XjQO)Ic}+RqLet(NwB92w8$%)@4zE3Msk9Z8wZRG=jU z!6KRJ?+Ls#q39PvmHJsP6c(x9q<+=3^tM-popw5YQ<$9)oomz7 zW2$K7q=xqP@X0mf1g0I$hFCPuXyS{*It*Rc;bOHMnW7mes^{|6FUbleA1%uW-F}P1 zr!m2LIxMyQza9vk;YlKoWkrpy4mEoZaJ{78+q7m)RV}dWXPf}~eS@DTWM$)D7Mowrs6jdbQTX<^WgTMkn6n88xe1XVqY4a9>d*ykUKoD_lp>dX{-}e_O%dpEVLzE!kr@Y%hDvMJ#1(VzsqPwL(1~HJi}(()Qd8vN;{|-}2D{ zZGf^P>84SC#w#>n``%4U`};KQ@Ds;!0MIv-ICtBm_xT~sk2s5G!^0KkF{_dJ5C4eJU=H<$$h=LM~-jY6x4ytxnI92H66SR zRmTsxMWGoH3OQ8eF*K_Md=anG7n3rL)1iAsh}E~6=|k(eUZQcX_4O()_|{jhZf=jA zqP~xon%b{`c7z+27iQDSoP=On*A6|FHIO@UNlP(9)V?=V@p;(k@QX5c7vRcgbw@{6 zU<+Nii8`_Ajlb2+;}ovHv18fpx(stGcQV;ygKT=&W-am(fr_$_}v?bcQ2x>Rrb zZVJ*_3C3p+L4F<_XN#Z%5wKm+ZqE8DmMltU6=HYTbc>%p_I=(%gJ(H)8u9 z8x}r*WPR`ekwq=u^CkDSl4}jd_VyzNos^+G1tlQvpyoZn%{i=@uNBp2qy0c<+8w>B zgO}~+^b3#f7pkVeV3sOyd%8mLkc0gl_+gLV!UhJ`@=fLb|Nc6=m-e&L4~#*7*t;2HIxjuH_>g>!Aij;*1XI)ZY{W_qYabe^o+Z+_ML?bWV9)7Q_%?$I3)aR7~N9^u(>QG2H*44M=oh^F)kn2G~-)+k9(As&41B+^%~7g z1l8(dY?e-&jDtYj#Ifl%p|m4oGGj#?E82h75K<(wFU$xw)8ikQl1u;4aT&0`sLKVRBchpI}4X;3=GzJRbK*EnCo{3+2q_^;1a>EKt7qFNkI z&S;51K3e6{c(8T|Ma&53+?3R`(J%=%A$%T+aNHIASbNUo;#Z?VMdR;IhI60wr_>+Q z*$3jjq?dORxb%VVZf>8rTacMd5tn<^ z*V`=3Kcz)~2wJr~s5F!C6~))A&?Hbk7@<#5Qc`MQB+gg+X@a_Sn{dbMufM=5=ki5b zdXR^PVr^Gr1?-fO4nA<0-!q`#8U*zfbahc}bU@{SwfHQ<`eR z>oJ|$K+PbTArJP7$=(|)-|kiEva?>(3Z7Gm}?z0^{WCmu||25y^Z z2>6nmg1c`_Av9Ge&&?Ly`SG%7;5|>q(!7Ui#NRJ~Yo|ek;8nZ__wCH{6X0zKLnuEM z%VqveB>Kdr?So0J(sv2egIOr8Z&NTBSRVecOwQnK@?tptU?zWeY6G%o`(&|mxv8xO z_wvfa_5c)u9`WL{z=*Yt%Hg=bOiy}`KRYjus_1oxY#5+g&yd~t2d#<81{J`TUdiii z3;Q294&rrIJ3p&1BZr>@?pCzG+By+45Lh$fYP6reLdErgBM43GZq7z@r#^Fs-4eyO{lm(OW!V zL#>SSo^-%2h8sOgYhiU`u=D=px10oC<)ZT>!l@^-YT9PSKMy?{t1g7O#jg(Qvs%-3 z_Ph-Xxmepcznpi+Y$Wao+I5957i~R<^=>nSojeyYj&LsH`F9zBGLCT?kX- z!~>u4Kp?*$n-Saz2r&Y<`F zer!r-*tJh)NP5Tuy-_5-8<_3gQgjzw+3>FSjm$-lZ3x^AaQRN?$wXq7!*GZ0=xFa{ zRePtwPP>ZRQsACNel`T+NQKQbScjkeR{lajGNbyT;8sd(HRlx%o-(i3rod9umt@r7 zo+N?Fjl_o_C!yVlbm3_} zDpEi!5r5+60KYlga>_LUcDXbC1btNGyRc)jhw1A1jXrh(sI$9-(T081<=p)=5ckqq zpb%XWdqD!nLFvhP!{TCcmzwMZ8`)HAJApT?fNEZ7ndLxt4o0Zl;6)a(saBPNO#DiV zR+i%Rxfff9_CD(d;E1vAl{c^Kg;q}%wDq6r-OMlWm1%^a; zD7fQ5)%iq{FDQ^y-+dxpw#?q-vyz;n6Swt=JPyk=UhX6Bv=Ud`qhez(G!Bg#fp%-3ooV5~V1MamDKcnz#uo@}fGCUdfTeCkkmw(QysHAiz zfK3Vu18kEc>(Fc=J9hKXBiVeww~q0f7Qw)-aI5_Zt+98i;4g74rQOC?o4j#3hRn^@0lU zj!tK-uhhgI^c`b89=G)hQGaMZ^nUsx;&JR!S8K}93{}MA1snDS86Iu3NF)cOD~_B# z_gD-)vqEGduworO%^8E}tMD6Uzrym!K4emFm0T=7YY=&|+$Di|b_1Qmv)oE1ypd07 zK!?%zWZmTrSz}2~cJ>LPe;4Hy$)TY2cnYhK!@AE=uD#x>*YHG;@Ok}XCb?7 zjr13}F@+Qs(n1hQRc~;>Hi>}Q*BCdZqh%F-k1qra0vXGttbV98GJVt^gY}h09t)0O z{hkAb{;idnwm=SKNGMAt{E9FE#LA$4i0NRxWd`WGM$Yf4I5=~zkK{*XWrfDGgukY0 z2jvefCNF!h@w6C5Acf4i-Bw?b+_C_~%7d^ohv7I-q;U+{VjwXY@{F7`|LaR(mUjqi zMO|Hv5t>!&k+fvX^@ZN*pswXSP*LkG4(U28&}d6pRJ8s{CyuI;62s5`(n`F~W6(E3 ze%Bzn`5mFVrZ49qgZHDbYGc7R6fF53@>5}j^4CL&k1;%9=i3|_`PZT&;zsEk!V2O@ zb3w+V%rKmWgKf4>4R#1jw-2*&Hvc}9hgD#-!tZA0*^{ah0=)+dS>xtL!<0&>|Zl#fgPn4q>+>ruE0l|@@S`EQFbVy-OKPNZADtS7;I zgG+Z!m(F>lO^g1*FC6aPE``lGW2^7}MQD_tj8Ldp{MWgdEOXz0LGJ8x)KgOz&%yiM zlR9y&_^0g7eWa5O4DZ)9_2MA^bYro;@CO|K`gQi()1~m9c+EoI?F z_pgr;cS~`l4n^giZ#9H*^8OGd``=?}c+k@8%q4TobEwAHyAd>QxCk+KzxNVatZ&zBfX3u4TDtUXoJLFIZwf8dxID5XIm&n5-^C0WF z99-Lsi;rj_eFJrqtooh?7qoBteSXNJIVc@U#Fz^}@22CU*9RV<@r$eJeI3OOvF2x1 zB0J*;tV*WoWh=8L7}SF^tFv)0C0TvGz(6i@^JBSV5E;qI=YXZHe#4qe>2r3c@xqDC z+IkzUDK3{;j4UYqbyDL#V)M;5WA#SI5&%~~RN~_Tr5J-&hn?Hc<)%?oB3awp;3ts^ z7OYaP1$1b9OYw#!MD*xNztNG^F3W54JV*@K#1Ah|EEHPKN?KfpD3j4rQu?I)w^UhV zX(YO~KRiGq*NeVu7r$e1xw_Ql3vp#J54IC1k$*uMoRs+_XXMHLxXqtF^&0evvZ0_> zdhM$;%tc8dxq8W1z%9XtT(JjD%5{zcveCW78&>^?)YG$pbpB&W>M!FEYAUw}r~ z2*oR5g#0Aamf7d3>Z&O#KvkgPiNOuHwrNRx%|#XIe#sPY=Rh=ZDqyP=edTnNW!Q*% z!DrD%^4(rTcRl$99TOzF_1tz=hA+tBkyHX#NSzl2GT?}x&+J;NL{<)$weo_-t$iUc zQ$-KVvMwXSJUSe9|GT|hbQ5tFOn*AiZuFxvRp(`{TE0~1W6rE?3dU}DYjX^jEo*ZS zfFJl9H>5g5h=wnO`FmlY4%JWUvb}1+;I^8UWk2j9U?ou;y?i9n+Z;mLSgEqdhu z9>_}vDUAhe;e^fPM4QR)ssw6MvSW(6CUyi@&TA+IeFMo)gTX=T4{PgPdyx+$9Yy9U z^HA=Nl`3w?SBO>U{S**N2=DC@Lb-DcBolH+66oB?DW z$fuLF40;b+AxL23*xYFey)_53C&{>!4Kp}>{& z$To8-S{CK0DgIw_0S~3pZki=S4rA^Pbp-ltb(&U`p2=EAvSM**3>KH#%HV=hk4jW% zIE_f$^s%Hv)*ywXEqQ?511NK#fgh|cH{cDZ2G88#8u8O99n4a zDw~7dbV)v$f1r4&jCn=5DMskO`w8F(?peEVpQdTpVGmN}W1(e*?iYoa6Wx(%oj&l_ T_-+HdhyA=#1}Rl4T1NgKSVKH3 literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png b/windows/deployment/windows-autopatch/media/windows-autopatch-ineligible-devices-historical-report.png new file mode 100644 index 0000000000000000000000000000000000000000..2aeacfd0d51eacde83709d6ab6e56755c5be01d2 GIT binary patch literal 39892 zcmYJaWmp?s7cSgF3lyhVa4TNi-GfW8;w3_d(T?ymNmf&a^gtvxbPo7d_a)1?2m7u2AD&x zXMFIV&sy(Rp_76?O}d`3M1ApGbtGc}31ZTKdY~kTA6||eX_!eZmm93R*1N;a2(7u( zbbEGe8rLtJa*GljIq@OQD~V}opSu_lyBLQJy^*wpJ8Qml8M5MnnUi$umjoQ3>nq`g z>Ao5ALxt9~=5{~ZVD*Fq3YzotWN=3WF8}X~cVF-t{QSJ}@bE;Gl+XhL1Ie!_;tQA| zRSTc}a;}1gzY_~i!GghHA;sv=HdZi>h@eg9>#5dG5~xzB6ybO9lkj|<)IbD1!$dOd^FrZ7z2-E2vMJCg2Ow7 z^TXXRkK<8+CeA@&n)Uo)SV?%FMRcysOd9!xm&ODSf;zC0eK|ON(}O=W*`XPm{KOqY z6Lr~*lj<9JJ14%uV-Gf_vY_~hQMUC_W>G&j z(r&qih($InmhcO68R=R}tku;OieVy702n}#rVE|$o6%ae1QQ({U7<*Ml2W;fH_n@- zL62(xhS;n-@W>rGHqr^izA3&@i2b7}wPA5ra3d2hj*QSv0o)ZXB#{4gO~T)rB}L|3 z;o0Y4!C4u((Ymb5zX^shR*ilf$o!`~(``>a4ZokfL76 z)7ODN6IPFeZhRp$P<&*tYs{p~$*cQ)F)1&ZXN=@dKYho=BxhJAy3tqbKp9cPd62kL zh-<&06^K4Jz*;xiWND8I6i8wff$NGb2b-b#L(@-RKPiYj(GuKFS~n`tU2WMEAOvcZ z_8&TA$KJLT3d|I&bg@Jcs}VAGn!xpcbJPk+{q#_YdmULJn>?z$9A+cUZp5g$~`|PA0HA6PLwV& z@yOWd$W-0O>8K==C}$8cO13qxS1*_Ymkon5sgzw76}pMBNm=NcOK*QRkWmjV8_fJ6 z#|jzQ7NDOWbZz1&Ll$P>6&8y^XRsPpQ*OtbPLanSbXY~q-RDk4&N3$lBMJVJlh(;T z{z}uYRvYtRn(JhruI}{AvY-D_H{nt3x>86%0n|**)cMTe3mOn^aQBMa9z@k zKMcNSmx-nNL#+{zhFsH9G&}cOwwz{I=g0_MJ3)FJzge-l(mtuuj9EB|)DvSvL7seC zHimp6D}%oh&sK&>k4q$(&lfY%VqbQVBkicqMFwNy2TA!g4P;k|Qn`JH8U8*pnS~ko z`K(9K)oR~taWWY_qIpD3GTlF;-&}|i)H^U25Cl*I_BkoFnbeGnvtRJ2=|OLFfD~T_ zZj>^*kh%e43bzZll>8TJ<0Lv>SfsoP5SE{-srM~gptY3myiT$rF0Y-8-WoTzM-(jg z80&W-F!UGDS>&a;si{;*!had6ESD7$p%U+&d~IDX+={@gTy4;OijAfUXqIncD>QB( zK71*QM+Cd2M_$@aH;rzXh=0Q+j`VB8jP6;3xwnN9v?BM)uk}4I05~{2*+LaHI?C6M zF&*ei*s`ts47`N(26iokk>98hWyKJNc(&H0^q~9xS1%0wy{{V5AkC?T1PUACdjaQt z%_{ey?(oO`MBa)~{|5bkd=^=?F( zl1C=%SlC#op|bi8hPd8>AF7g?w^CDrC6Dq=JgW{4FztH`jf@!i_-udPEOqne>znyw zB0=RFduBCr->(c0kByK@JtPh%_xN-9`3U(HSaQHQqwek*=30{2t{s@qq+o#>8uH}B63|cW$cRTm zySloZ<^rOX6N18$5^-5~vH)@5#M)H&>R&Xqlg>{Tvgq~k-l3mg0Efo`Hj{~JHddtk zJn*5HOzi9-b+_#M7U|u|OZREOn)+I>o7*R6F|o=3OAcMYp(W5+oj~|*L&-opoQm4) zTTaZPlZIW4vH3wPQ20JKiSp|3E^v-94Pl(dB}zp(z<_;N=3!!LA%vunrs~@$6pl`t zz_;2%*`DE86xrI^$_CP4@{*irlq{+?0G81q28E9@w`b0jOsjM~LQBNZ`nY(SNbEvFlmm3EK!*JlZ8 zxV~S1saIH={g@>D(UEu+GhoWlduk_2YT3sFo1zyJaBR_DcXF0(Km8%0kJ7(nurduB6qSOPN9Yr%I94D0k0Y*l4Jwab&25_!YagiAdxm}l$lpRlA z`nyy>)TCv75)&&U+?(=q!!k1McXrscD=u!slvqcf)qI=d`BxH*#rucsu#iALn88zC0VDUb}t5P)^=lCFvW3KuIbktvMz&d zjQvt`VS5$w!4k6xwHd$Dc+2aW+sxL#SU<{jfY!hGhOhe|CA0pTL+#E;rm0R=440wB z6LU)PFx#whX}rPDf4J{`K3><&Y%L$e^wSh~<|+oD_n~B0m0^?ufoOn$Z_g@8O%XXA5S+0crg955;E4ite2K5trSRhYij^j}zmfqM`!o zi@>&cpd3ouLUi9icGuw@nJJ>+Tl-XQcjQ)IX2ctZ_02{WDykBH4$vn~**W3f9du6H z2i&Fr;KYiC$P<6)awoHK4KBvdwvekm`pw}3r9$IlufSo2UtspzGaj!Jj;n(vNKW2g zL~;34Q5AbK`qQTm@@_9n{Y9p-Ojw6d+pTO)2Qzb!%VROE1~&rJa4hYUaN~mm@gHUc za%o(Fx9R*C+T8w>e=k*1hl;!=GR00u%s5@{i7h7@A>0GoI?Z9W3G_Ktjf6c9zZe^R zf8W)w&v*Dz6&AjSwWzDg7YkdAZ~|XDH+xQxeJTpXBCGFAawYfEG>`Y_U)!(+4m`B~ zDfXVPR2-gmiR1I(XibAQLVI&i!fT$5ikCW`ZzPgE;cKwJWt2-B6V>Szd)_T`glz7UnCDb-u&`JkZ#&yL z)~*j1p<}Gcre?Dy#A9uYZ*&ZJvHf1;>_Lxq0Y1;dMw9GBuNEU`Mu>2yd9aI_Mm03B z1e%-KlAEQ>wtKE|KQiVXI?mkW@D5gj->H@GATmx|MpCa4Q2H`@Umrco3?Xc#@?HvD zZux3pq}^Wj2gc8w8DGHqQ(r`MlG6#D7NsvpRm(rV*X3BC26m=ag%fhk7!q=I@p@|k z;AqMsGNDkaLnu4B;gkWJ9+q6}@+>i#!e_UYCD-u;;mwtkTpik{3OHc2Ia}b_AcTOl zw4hq~_~T8@Htbufk3M~;7oaK6=-${$fZXm|^4_I5DyZs+QB>n|w;~&%oVFiXoe5f) zQNr*fL!R5Mwc1?Jno%+WSRtJ?uupZZVHO7YQbU6ZDk~p$oLW9X##W&XDmSrz^#A(i zTaVO*%M+$=;dD8WvEiahQfykRu%r;0!^1CX@x)nkNpiea3w>tkiC|P=1a|QF$i+dw zKJ8D-Df|$t31aBsQ2iNzf|BYzL%;yUYOnw{6*e;#$?1$E0F3E7U18;kQNLsnZy`pc zwg%Du7~OL5_>8a0!c3pu*=WXPTvFT_9FvgAz69BsCe#`&i^2^|rI>PjShPRR3Bl(X@ENGyz>9>rZz$d9@KwSy}S@Kc)Y;K5%EV@mvN-Wx)QJE zcQcv{OmbYL{6lc6BF`g?NivFGQe`N*=H~%!f1gTr_k!R4{-91~ zxx)`ofw}C+#gPj#mZ0#R|>q_+Fn55tT}?#8m97gYd{IS zJL&W$qXez7z<(djq`!mmxY=|7^iX#F#nR%;5P~uJIyXkpck13Z&cYdz9?y-x+=?D3 zpW0U_j8v-!NRT7yB(LC6)h{71t$HmAYm_S5ajQs5MJg`S&YcxvepRjH+4VZ31mez)t=s-TWNUjE*x ziXIz^vpijdb_0ync3sBJf?Tz9{Bxv#rsW|ki(sfKHmD3)o zU@TqS8iZD^)T9C=^o@JpT6Ln`y}djJ_5p54c0!~sqYkz^-8&s`#2mE5g%LL(h|7zKp_l^;q#lPDM(TChy;DC$5<%_xCI4J3Sr^G zd2CYJF#tPU8JXgJw~0{1o->;!)RYK3!*@Ov;H;)vqG#JSW2wsEog<)3_(SWo+iGHL z$rL=LZidqksE?e}I?@2SWko&~2wJ?&66LEXi;Njw^C#;Y=W=;lyZk4d1T=cS?^X8o z$gW*G5C#}a5nR+2r^XPLM#=x^17NU!aJYE1z8EX(y#M~QzG*X@MAW@$X3q1^q5`xy zvZkF<*6*P#4vmDSMG4qlL&N^-X0%|N7lwa7yZ{%En0n8&VXz_Mumsm4~FqL04DE$dg0>vn2+W3rvU)y-9%j9d4GMG@jMTd@fZ2J2)`47FSV+^1J<8=ADa~x=0niRkc60>Qp#2d@Hqb)lbuW&MsC{vs!3~~ z+}9yucrkncgpYsF8PTD-eHdFfE8Bi-Ey%(Yv6`-PZSR_Opphp}gxGnJi zvSoM3QhSv1Rh0U{L~&(($ro3babI%bl)Dmz8l@Dh0*gk;#L&%5hkF zecsRwHb)f9f3AMp9+57(E-6UmA5T9>Q!xwzg{*Ndt8GB)QGr7Vqk3ymF%8OEp|kn8 z7<&d1+A@fy=5STs`u{C+BSXBqFy>2JVMpzp{IZYtr-ecqaBcC^agjUK}T^LPS_~=fhq`|IZu@S!~{G z&R2>P`m#SBwUv&6>Ww;+G#BQ;|Nr`*VsHJPp8sEV;6q&ArNeyU{C{V(VdSo1_pDvX zxBh4i3D{Ez_=Y@MTGsFV#U=j!X4jhY$B;4*ji`A8Iig1nWcdAQyn{d`>dR5Xq!fShh`B|P_ar; z=4=YFQvdkEObDo!&|z^^udX|=H@nDKg+?Z0#?*Jn(p#q_VAa6CL)UKv2sUS*rz(Xb z>($iO>8w}321%{E3@ar<*7#tIzvBuqV)P2@@na$&V1z8Mw8^{fvo;xqo`t+b_tms97>Gy%0JYfm~BpH~z?7Q^%TBQjJ0p zimnHF-q|%_*%v}g1%!H-I(+2Irw-%NOH^m#d?Cf?dI11%z5C9@?M$V(bpog4dgDq3zdqea+YpuJd+Z}q zGr$T+7y?CG6C`nzulHZD%zGZxXS>H^m zHX%l#`F!fPge7qt_%CrL%0s_r&b}Sr-crFW3FJqZW~Olgzt>lf>zf-PE~bweeZi7D zREs=3?{`o*JkzU*8Tz&c3!(-c?x3^+d9V1$fVjF6tO5F#0^(g}Z5|R?*Gi$4xrnVa zOH%Y#jJVj$*0RrRGcyV%;pa~+nl4mj{{CWNi~93xo4s)#1yZ9LyKy_97V!?pS7t&_ z>tK{QYO*u`K((IO8C7Dc6JM4@4@Ef_YxwsCAxPVv0&gj{UhfjbM8s-HqdFfl+= zongd~y*-noT`&JRx24q5)K8||tMABLh~uMg4^$f^Rh$pEmc#JyNDSCPsDg#$E283G z97cX7$pf?u5ZSpi!MHJoLP>aHx{f8*fAv?=@stq~9L>p$MmWI-m-M|TkBWMsU(nP( z84m9!b_VuQOs}j4Jt7{R?Syh7cU2l(^Yo)KJZSOc~r4rj&E7lDBz8;Q$i0yr1^^NBw^UHQ%baGb4eVsf%x)qfw?aQu>C&G25~ z0Z1LPQ)p=fdHTrHR4c}*c3B>i;WkOoz8cL2`=YINg2WP+(rsx&K#;_&Z%jO8yv47w zU+bcQ&7`*K|BYKUtEt%cdZ#(h(2xc@hQbD%1Ka{^NW z38z6(D)d@r%fbq4Hq5QhC!yaI80uH26+q-GEjb0&ug1Trx*`c!Rz0b#%}TIKzd zqn>^Rfk&7C;us{bfgPZ$O9T*4JFvcD+0leq^DdzRb1Hv>*(R$}Mkr>vB@rtqE>*TG z1gD`<_qq%=-E@9{_(ORy^A3s*)!!GMF(q>8UB?wBSBdiGnLH4Qu)$3TAiZ~vhxPR6 z4!#@GhPb$m%MFfC&G-s2n{u$wZ%igtQ_<0hsEd&oR^ z5BtEg*4|tX zv*kG+2@oZgf-KGu89F77;zug5=vTg7{!HWq`5j+5CxivuyJZaPN4231?lJC2+B6$@ z(DjHpw7H z!$y2VOx3ayUkHM(wV||uO}n3EqkX-RWAR8c@?F96lB5#{$+6SW7K1?1kvV}VIfX6p zGFnWuPKh>mR##{6F^YY&vS~VG(4!FQG!p}mn zhQm^2;$IO?KV!Qrqery?eT4>HLCnXHd2};XW=f62Ai4YKWit6jzk^jkcz{ZU{(F%! zy!wYHzEX^Ch1K)2so`@j822bG7^Yg(b?P~G9aZXSvBT`#e=0RZr=XPiOmzE{r) zIxVAsKRw;1q*r^?TbdZHIE*lgf?V&3yQz5&=P#2gomJB{|#^JuzLzGOZrVJ0c z8du}xo4MVKdMUDuSf`z;7wS&Rlx5UtwE(K1xeG2mH<8jrA**?6kAauD-KTUxxKP__ z#w0pBltgMd+O)_I`TC$HIea(;Ucv%|EQpls``hcAVWYu<4=ZFa-S~WJcGE{ai7Y0Vmxi zIkdF^?}7@A{pAs)uHiEqK!ZqY(4aVjSQb9)^F!WQPbg5>e=#1|AK1*q$sRGf$bQX! zC-}}QMD)?&ZAvEi#zX6Rfy}KGe$a$rC@7g_MIW`bEflEijVsKARb82%L05SJgBNW8 zsS+}fIOFccoNv>Z0vOAnwTdakp+uHjhM z5M%ihBF#9y;@3NCIgLG&UEPE%_NyMUp~_!e%rl|zGaz(tEXPXOUu{0HJiv5XRYlLZ z5|*6nSAz{ZG?D?vBkWSY+H_XPu$Z(N-ym(M^+6|>^4xS*emNRlT32HF0`68$h+<~d z1c>|Ah50K*QHPHptFGEeyT30#>uh`$qX1F3{Y<~fpoM4Wn@l|HO^mtM`M91uAtFQKA_WS1LqM9f;QrveoaadO=(;T5q zeiVc9QDgf0`ja;)e*Y-e@a$GP%;{)!y?oATU%P)7*n}SdPfScR>$*~@MmNsGmzbQ? zb8H7#9FV+5q*Yj&^plK3=FfmN&HGBx`cWedo+f#bz~E~s(0E$INkmC4F^yzO*K5Hv zpv$svy8+&`mJqoJnPf!XG;`uG&r-7#E9W{%qnkwPPbt>ipbIz!AG|5bPhU|$;VvvY z?X79Ko^O=DaiO>xy#Y~J-6ybgqH3$;giR3>ch2>m(e;ZO&b*&qn;nO~$;Il(#5QE6 z!3{@~^F?NU;57gHq2;6E@9n#ZTNe}8f{ampV!xm{l;)ub30C1fYZx6zRGkF>(MY0= zan@2AB;4Y`{pARuvKa-fl%-F>&zKKxdpE=XsF2}NRk3#rQ2#udx1QXd<&V_7ohr?{ z`;8VX;Fdi)dx?C9wY!(F8}k+BSBQ)k&$>7(d-%fxSBNbzkmdru7NkiCjNnpjC)Z9eE7v;S8!nR{HE#D!5n9V9;r%*a$ znl*PsUTrOp6CS;Q?rs%~VMg=5@oZXTV< zlSUjIxY89|IrLq^#s%pc?ta|*+E*$0?NUi1cJLo6)C|QWhkT4=gvcFNIBY)PQ?63k zMMv3g=4nx0x~2u)YoELFDGc^9(qwqWAx5Z{_)M4wNLKg)jl6oyz0+3@%h;dbS!ytA zUBNaS>NaQ`$>~HHGj=AE{XEAK8t0$U8UT<0;=2>q&=@CjOIx@zTT#NJ1zq zK9xNd)hLG2m(R?W72r~z!IUzI8g3#1x(j%jE`9Dr&vYoARn_CA2tiFUdoM!u(&S7~ zlI>?kWdFJVN)g@>ZqAH1_NB~yCl}ve`q>W%-4I^^tDjZpr2y#{TJpy1#o;zE9wZyXSDFV3%{H zJg;z+U(YxL^a;3o;=hG>RNz`-z6_zn-6u3#7M%Tzd5z?WFU$7?f?s>eXXeTZUVC7r zo)5ktHOXFB%lkVsCm~iYl^)SdME@x6I;gDB`g?qL`Ae?(qsUkIMHs1R%nnI z8H9@f&cA?anYBeHN}BHLc?W+g>frTGodkn* zkJO^R41ARht5K8lJ<6H;3d(8DRf7(<`7hy8-rxlQMXZ#;?hY9(2a5K}NrOE(-c0QX z01po+>&~LAL6$@`7JnLHKnLxZJryeMLDoga5I$*Vu78btFw^jQzytrxj?>UayZaLm zd?ZG)_*Q{_rAISKCOY(nZ1LvkDbf}LrXGFULBe?zs0g_sHP^!oDM|~AV6?8<$H+E-%!(^b5;+YR1fgN;fre#5A01gS zZ%%R_9hD}P0WlKe;`v>^a5&L3Tds`ckv-sQ$vcr$F2tHyy{DzK%+m6x;cz1Q1c{7{ zaz5<*?5Xpq+C3X*v~a&X5GRbQYvyz^iJLs@J3=%Sr+V+v+w$p?-VM=7#HW9E<=`2T zREP*lg5>QYzDr^BBo;t-=`*TZKwOs%Dmx)OHHD>CJ|ibxo6CsDSS1EtogazJ9ST^5 z#r(pimHT~L!p!>n>HHQ912ve!nwoG866P}NOQ08$IL0|lI%DS|yjSUCF?X^WaxuzA z!W&#pU>03r6@IFRWl!4l!!$!)dS$~DoHp8ajS41Kw0uiAn00O5J;tFYZUuGKz~~lp zt>z@8*6?&$)6ejsSL6JgeuL4xT1`>VDU_C{rkBhLQ?sEHS^Qdm?GU#9kZ83*pqSm6 z+uk|uWGJTndN&-R12bJ2JS|NCT_H|wwrMx1iKu=8_Z4OU&@PPx=0;UUM$m|Pl8Bsk zyGx4mgxsh4b7r3e(d; z##ey1xR>a6)oTok#&ZV~+v|%E=IeDXj3-1Z{LN0({|%xRE|3pd8>rjF<3PG+C}6!` z@r}7JIFns(=2CUz81i~c*nD2mr+NNT_T(ONHbzzcCINn}@WnMRvEE`BJKCf$t7R=q zpnCPJHG{f2Z16^>5RZ)&>xcM@bOa_~L=wTI!FRo5vqV`t9gFCqD)kXY&0)KUgQj}* zeez!9lAcesrugVIY*1NFCKJUM{9e(0q*9yRd&bb*{kc=< z{#JYF_XY%U3Y1AV0bxr^dL8Fi_0%SijJ5x`R#YfoVC2@}h)gPf0|Mok zPFI|*k@e}O$@cbg=c=|VWSJiQczrgD@!_cPe9{Yb%$nXduF#m7#v@i4IyNX z?W-^#Zfii@lP46nuoZxLS{$FA@V?F0(BgE)Fp^8}tkMsJuoZm5d{}6(W; z#ApJ}T$Cneh*_BtL=f=#)ZOye%&F?GjdEP9y23&rd&tj^c|U%G)Q}(MQJMcR|CW5> zu{LM$cw8<4Bs1z#Y!U7lJJbwxJLG@T4-;w!P$0LSW?FNiZH;{ZMP3^pfgSJ|o0RaoMW>JnlQfEqmjI za4=GVNgH{NhZb2H&c&8Q3ek@MD5`i^NcC9Y%Z`J&86?M!F{tI0n0~UxiPR68jr}=r zg{Ea{TO?vQ5E^5x%7NkX*GH`r2$>P5mzg`E*6DS&GFIoB7AZ8P)RU_8oQsJs(z5b5 zAFrj5tSq5IdkQCBImA21tj1ab0t412SMKqpwa|?Ta99{(W>yi}NgBa#T1r$n%T#a8 z#PICKVnE;>QG56i_W9wF)p}lnPFGgi*+wf0fBO^BY40l^Pvu>^$AGyC+fC+ruh{mF zTH^I8vb{~}mdjrDmg_~c`P)fbC(khuK9>{5TseN%?McN}kU> zMrxoYjn^J(j@fc^{O=0YJ1Y~jgh3|c@|DcN$&$c$Z>#w+ir@Kg#5EpPGOm^!h_bp8 zkRvX?F+K4T%VCw(REDC%(W>RZnp4yaJ2ytucU95q`=uH$Im__)6#~1uazQwn)({Zt zdaLMx-x<}#lQoW)_iP9VkmOJWG%WRs#dh};M5}%wt7&0qh<)j_09n98-(mI0Uc9|h z6X+D#Z79@Za|8_J&MaO?g+mL_)~*kbV$0b*oeTLAR3t2(Pa&e~6x(l@Hp4DS;XCE@ zhC^HEJm2RNzHRe;{+nvj0UM6|{2Y%XzcYVOk6wY5bdJXy=&F&*x%9qMK#te_T<+H| zj#TQxibLKX`-IA-KK@G#+$35l`+SXgmg5?c-)0^iij{MJ_V zmsUPVpi$mv5vAR`$zw{5Br7}eTh@5pS_AY$JEC`#-g6o<3Dkpo5-nOfgkJR2 zc$e#VWb+TsT5vc>6eSmcl7McG?fW*A;tQj`nfrPJr`NOAnEU!>%5w&O<;|Z_uXH1C zqu!E_d=Z|1m4e^wl*0x1S%cqVI)lct+gv65JtdC_o!t@N+!DTeN?kk?okebWdj1T4 z6Fd^de-oH&%WCj^3o5)T?68Vjh`DXmNS>9h2$MP}lb!V@iy`B03+2{ViaKwi!c7yV zLVb5|EbBXgPpAwOdIBCG=hdwM-}q2PgZd$Qq?w(&2h`wFdEDr}&B~=*>@-&Wr7}_X$+pi__V%&?DB=#m-IAo{U7a<;IFQT6Co1$s)yUZ1iQp~WH_#T)A$ymSh>wAGo>&t-#g0iqLW-; z@;g3w$6ICdfl7)n6u{$Hg#2GuFz=^#XM)knB@_XBiSGUt3ECs=NLVNm8~)`IT(cPt z5G`Q`Tl#hHBW8zwsOXcvB2;X#Oby)CuF)|k>kN*0_4 z?HzMS@StT(;JD#2#TNCNvD3=Mt-^qM5R)ry&U_{s#9ps zEfX!;rrO!JrtI*LOigOcjTV?UT~j1*OJ=bY}>uwT!w>a%M6S1)Hw0|q^L!} zmh6X`ixaaGA*1D%g}sy%_B#?O zo0t~w^DoSPYAWG}vhT4fDjQNB)RtO2k(znG6f;!Flhg|>O?yWWaHs}GMI3-kAy+Kc zWLLPju#{kx$Sh6{l(`C{jpYIK24`A4l^c6wQ%j(&I0JmSQO@}wn=%K-rpqjnR>3_@ z35|lz98^qCK%{>A^Lt-$A%sul=-bHuJQ2OJ$b2KCexqeq)};5o?by!GE%ei2+~)<9 z!}lCZu#j^_${@vOV^|a!_JuDgLVgC}U6F#^JW$&^B=hL!1Rw#c${g|5av1)yh=6!t}I}f*LGx$Gl z4lJL4Ma#82278>owV3qV(z|G)NUMwz9Hw=Xh=4;taeaN8U6zL?m8XcS(|=IekvS)6 zKlxpisW%rID+Z0b40(%;uaHEElHYsr1gprCs=5chWCo^W1o_<`QQ5^B>UMzfB?S6@ zgo%;VFq{OnaPvtb(DfMQ{mK^09yqDr{ zpCX@6-@azNPQ3O0&wRRpJa(;hlD(ax9k1As|M; z&h(lCN9LcynC)+B)BK@_vJU+Tb0gJ(7KcC0fLS2o(MtHeu?B&h<3hl5xBjBv^CjWl zmG#9nhJqhnkGy%7>d1+8(jrd54QFHoM@6-W%RSLD&tslA91zb8#O1XD8KeL0jtk(W)z5qBE%W`J zYAVa0>CCU5ef4v}jC{U$ixBrX^Xwt>6rK`zrTo8tg7O0Ark!KBA9S{I!a!yjs@l-Wx-fQm4RQ7x4ZXtZ6hq5Ij! z`}bxpIF*(&##Je~H(@0yA~&9>Z*Yg!lL4jr`3{;U<&urk*Dic_>msN{i|@4CB`c4S zw)PVL+ui$RcbYxY2<)}?s?Mc@rUX^_v&&zSD`pSAL3JZ}tUD{YEzKAiZGor!k&g75 z7ENw1X+x*emp23FcNJTW36MY6%n^H2*2@}%XDdxCD~?3smyR~CqdNm@^|dbe0}oGg z7pVxGKkdXO59fX{9}liMW@H#7-Zw2Bogs=Jsq$K>TDCo2K1~IuN^{0Z?};uakd|XU zH7b?#b?8-{{tPTn6U=afoB$EC{bT{Gc@y5d);!!4soxTEvGUNhV;mAoJNp}RU99xJ z1?(6a9ZXTk#^l-SB{2$4GKaW2-S^n>Vi=O3QIs!%H;*hUu&3^=s^pIK^)b4ZTQXSFB>GNjzD@m>**acMz2-?OUpkP% z9|}3QUcu=*G*Oea%_TOGT9jLK;Q#w((Bk-tb(GK<^lRvjr)|($aw_t7n>Xq%>BN#X z{nAfnqV6VjDQRY__{kJFN{_y&D)SZ7Cl}O_sm9bRipkpV7L$LYpU@6MDq<$3l+ZjL zs=B8z=T2&R>m%hQgDY)=52E9(5~eR%S0nYlp_qi!#HymnyCpvp2&`Qxx@OPyG(=Eh{W40j>_IQ#X+0t@AY8h`1l(ANT3@@ced^1**7H;24ElzW7aI#&=3ZE z5$MUUgHJGP`HhtOSEV|G6yn0W(Go=J}YVp2*?}AAa63B05OVwC zOsKhKuqX-bv*8{%k#~zpeTkp^jx70{ub&kBB?nJ_9>3?{>PbS#iAsJM8SlFT-m}5@ z=W07%50`jZProSE<8nZ{N8?9^))^nhq=^M}Zfqr`SUYZ%0oJcWXSM3wFloSMyEKO3 zzOj$m4T<@7M+eI|NI+34LL%)oz2xq#%6AI!L8?iYPf1( ze!K&9hM@>a*fmm@v4hkDCl7jCosZqw+QYIgz))WeyzU1s!mG}j#1c{0#Yza|?N{Km zwx9OyM8h@!qG%biNrfVSR_5U``KV?z=&oImF#a&@BT*E_*~p9&DO?2BR21ONu+0E| zP`y{Vx4JUr1WP*T`nyNT=d`yAE9+L8j92*KtlB2D@VL1BV{>6mBg$TVQ)K7Yj;^t zl@$rAd+;@-Br7Os`<|AAWFl&(_+3FDRqxIa4Ldv5?1EMT%muc66N{cotq7gL=B7!- zX||c1{G#|%60jOSDGN#F=3aZSr*uTvZAEn^)ftSbrl!Kmtbgw!^Yk5}zCym2VGTi< z-RLFlViu)-i7H}d+9dPDT%_dAhh*->iPdr8x%Ce&uH1~Af^!BIWX13_Adq56Z-7he zTwRW1CQ3{WK|jNHK{;#8LF%>UWSVgS)}Z7|US*XZO8ENcuwB85$$mKM(9!`gn2}ok zhJ64-EWX0bz5b+B_>hwD({QZV*;#!(H&iL+>zVMA!hHQ0T4lz=8sm~Oe?5b*HY1!a zF3A&1E8gXghSw8pOB1WXqmQc73A5Sxe-LLzMvRNgh0WvzT!0vbnOju-e}fkX@mVJu zO%DiwKdgB8u52bW);^SV_~S5t-&8x@lc2cqc;4`A3ut>4#%kHXk)a8gm=%1Gcu4q} zh=h~p2{8b;yAv1}nPflZApmDSxo~STadJnLN6_1`|H!g3h)t)|Fdj&}sjtf_qe1uI zQK2d{eSc2;V>0g1I8T0W!>Wu4mb;;0PD$G4(TRwP#pj+Wcv`+KP18l{F~p0n0?ZnB z#rUnbtuG=C9<<`PUyNpt#5uJ0Ze+`hEoek!ZOPJ}G`8cENdXbx>fS?;Ons(3&ZNuu z%Sa9oTX3QhbK!-38-<$*eAQKo+chJd@Z0`~qL>C=K^YW$yr~yE)m2#c=M%Y#ePOPE z;fxA-gStY%5eI!%es~ z5GjUrd0DYOoR`wzbkF-j?b8P>Dlgt@Pmh=Y5Nv2gxOctYk$)X>i7E;n?yM#xG zO49V1ux2wLyB3f5|7d&bpg7a5(RT<55S-v{!QBZOJV@~165PFk4jLdxqrrk}Lx2!0 zKya7Foj`DRYuq_6GqdO0d!JKv>)unhD*uG)YI&Yz?~>mFzF6FHQTD2B&!B{%JOA-4 z(&t1s47y<5LK-t;-QQu~2kb#VwQ?ixk1R(kHjRec!_+faN9x2)6$V%yo^swjsnk&8 zc6Q|*px!>y|sR7?zz%CS~J`#$2qZrsjiI!)~E^$uDSc z2?Fsib^j)193JW_xivLtR+zGUweC5JvBet?$tWF6S3sPi^g{}uyhqIz*W&LN6sk{k zxl>^8J3&>|Q0_N#m6)Batz2VNxhF&T~tPh)7A0v*K9RQe#t4I8ig!4hZ4)s-vO>-L>1SSz3)k!^{0z{=_%qj*+D?xL>!9G0)6~0m?6wBjM&ihZ>>4 z6dh6MU?&mHS>m4GGn~I^D8XLu4Kv}LT|Q~x^re)Eu$B75|5||fa<*)(U7RlzGU~@W zrl@P7fswL{##r=SR$2Ge^|kP4U;dymL&V|?B^@dJA5NCkSwr$F8VIPpB0uAqs>dQ+ zNXfm;J`kWXIhBnyx$~UR95XrW(|S$cYJ46=8+`A{R=+)G%);1q#bUKB6Jg}Vdg^K< z!|~z{nv8n2bbh&&ve)FKAG=`^67Ry zkYbCn0t(l_!w{maaG$JU4|T`6X(?F)i)P{HQPQJAa)KHa=KaDvWHXlowsfHnC=471 z?ZLZKs^EzGkDFFYTJree3aF~;Mq%Gd)wtcC6*5zI#ATsD2Yt2Y>ju9A&p|o*n@2I? z7nCki39UFQ<8MIBk=FL8ZSS!uvM4o9k^L+!DKsjQdB50G;Yq)I5xY@9qh^zq^83|* z3T%lmOV#G)z3M4cZZo%rFvCy^|HI1a>vm%> zHu_WS9A6lt1J?}Dz-*WL>w_@pwhyL=tpyH}H31 zd*RH}!7wuVP&ozdu%9t9R@l&8iM)56+XanLV?S5iTwY4MXprIPiM`#VV*NEPCY>%; zPmv2^>ttjb=iwQ%8mKO}+*ZA7S@`5N6~-$rcSR$HkHpy00cxhj%c`ZPP2h*itIVnJ zBz#G+sVCUJ#=Coy>fq5szgDi#MnsvJaJ+DcHXl4q zt!;3EQ{Vix6Fw3V6sAZf_qj9?Wj+G#+jY=?iGp}x<(~!__M;Zg!YD=U2#PLvS?G@{HTk(x+3p=r(+gxkDX^Bdu{uUnhz}Izlpg^_!38JwxU`?h8 zRs5QW6mvl*v;`Dpfr$z_YCo?ATslmW!I#9sZa(JEycF@FOkf#WB%uEovTpiYYgh3A zN>qFG+Xl$*a|*tcvbH5atK^Er1krK`1I?SqT;C>4JaldJJ}unq?=pW*Nr9YaQg>R4 z`$2!C2BZ~$ur8`;c~+5_cW0L{e4d=?Y4JFtxvBOe$NKIfh4XUAF%?aL) zbu5No_C{I)&JpF?3~J0``<9z#l2$V>^0k0hs+ks%k#_dfl8jfPB}XBR&Mv%sSJBJD z+LhN9Zs8CD)GkzY)j#U%))8qHRy<>u3He}5o2E^oEI-F%t2^Ot1%ys=Nu_oFnuU7-2))$L9`mWjt(T5FA!yBgz;3;!cg z5%@Ipa;L`cr_DMgeGl=J=W))uMhrf7xy?S}9oz)t=hdSbRWVWu1$Z)Uv#VVuA zvl%Yf3?Fn_8RZZQ$HL4EWw^vpf@1`^r*lECGTHU-pf zkL9v&by3>m15cB*y<@*~K>%*nt?dcNYQv(>lf}zlHAh`?EgwBE(m!=jIx*Gj>JGMU zTZn?!wZ+?TW5lBwnr~%%E*OThy_G7r-_Gr;6l!e;D+q7}M!+tXD~2EF7KFgh@3)?? zt~!AC^EZz=4*ju=uWvVx?y~MsGiXU{ylX6;P&S^k)FWlJ;u_y^H^b+%a(`H;>cKb% zg4|RP8P@0>s?{scChkaT)A+i^eALeAMDEs9j;6A%oWR#z8JrCTT;#{E^Cvq9(K|{> zyQjo1Ho?d1Q%QZTt z;lP8AVgt~2E>sqQRw;P4Tns*iA41(UF+wFE#y&S(x2Ihf%PJrzct!bKYh4JV;R$1t z$J4Bvc4$x0woIp4w=l;oit*L`_~&i$1-m_oy7AWSZXx(QjIzr~Oc3=Duj##cX0F|F z*=OBRI6Mg?_D4TP`YeaSnv`I9l+u8wUkF7V!IxeHpF?;{m)jv(h`=eA5esENUO?qE z8K^|Yd4B*wWL|g#cINw*UJ@MhcFN&g!T@XgY@fkElm53b1f z=V-<S7!rEoe&bTimk z;smi-fYT$_tK%GP+E4^m==b=d`+QBw$X5_Dm7N$hufTI@`>^KFX2u+8e>T#?an3&Js-$4Xo~ zZ#L%h?iaBSyx&;L!h3F{?#%3RyQVqJ0mSi4e8}z?0YX}vX1?UQ6r)=2PJ6kmEgpjv zZ74NXO1^j|L~+wS%voAV_r+d04rz#0VToWPuQYeSi_Yj~eHH9G{2WYEQ|!;m&fc20 z54&hSb0=$2Luly_oXWgr&-8M0qUn5s%D$I0WV4#hUlD1NjJ*74vgf4HUd4|GW2O;G zd8jl7+j67dEqu$8rqrY?!a=;lnZNlp4nF?v0L&+fO@vey#4Oh__=gwx-_dttI1Z?U z9u1v{x5fBZ>VFfa8Nr%dfy+^L#iGGqGzDM1DsnHd&iCSwj;IbT!A|FOrrqfuyA4Kk zT22%9c|rT_k}|<2jYQ>PNgsTEM|<>XHA~G*BbRQeNxX=iHH^RoE2TUyfJan@r?RlW zB@#w)C-Nt+v3UXGd$IB-Q_(G$1fyYmuku%IsW}xa-?w5^ibw~=btt3zxfG7A+F}2}p6vWE7EM+a^AgHB1(x zM$RNmz%*xVCc&sR<-%Y!}t^koX#?%KjU8>hvdj>vZQ@Y(tTSg+G#j$r`QfdH z9rc)(xTOW~aN@W0)pR80V#N+9(FnR1qxO~*|M(Pe^Md5&?HFao&<2S?lNb40ho-Qh zu*Me|g$v5b{g%K8WEXmh;OOeZu?ABl3_aidx5@WtPUlJUB_O0jQ*O0L>C{+!Kr))~ zV8;1ltC*#2)qJTGZ%W|=mv+9V)`dKH{cP;&1*?iS>t36nq1j4(#Hc&H);tir^2u)N z@t9x@IUq75ZE%o#Auhf|6v$RGh-XLiJ6XGc@1->?p)1ku@sIO;Koh9^K|MuZ);l|u zTsUPjp_VzqH8lF+i>xbEoIIgn@!S;O)knZhCEO)~F#Mkr{@BH({`g(Pds~khQGf}3 zjjr22){Qh$tSINH_V zsYpalJtHzKIxq2OiKEcm#X7DOHqz`p%V-4ESM0|#Uv9*0DWunag z?VFvdtnAnP%EM+M(x%F%2iKz)M_o=Ml>N`+c_}NDmIxO=kj-Kmyasz=#!C$ff^La^ zI2yDyn-z@A8ARyUIA+J4vyjH;RF*uS;&IHbD*aE=L~S7AO;IpxC~af& zJRI#rO;t7WzD+F>9gCXdhPltyE+6N~j2H6As3v5u(TA5$AUnG@VJJl|To}JbajBlh(DNy1_@a{E++3`FpdU%>5V!uO%*i5Odt0 z&R(wf3&*muIF$9ZL9_0j9NTstIYsmgH-;%r0b-VO*VD@)Vex^c1-~;A72#F)~=Lbb%BZ$t1N+(|KG5|xG@Kl5f3 z7rfsQKgKWtKVVK5^m{tRkp&waPa2uik%PIQ$0%vzne7R)Oc8z8;5wb8hwsm0ibb){Q<{-3ty2LIbf|G4fd~s;OA6RL|9c zqK=;0L`aACMRsF74&Ad?J%cQ-?JoXEfCe!RGzZ-72%UmPDtN2M?-mty-PGhSQnxSugGuB(kwH~B zJKs(qEPX&x(DR;EIa4Gmt?mPejbOAXCFsj9OeIGALUy*V-nn>e81B}EPLGXYu8tNt zIXTbqgM+syh;(-`O_HmCPNz+(aaV)w*3GojOZg<6x3UbT6ar7EIo4=tx9s*i@+70b z)?4ycLz*7z1$0Z@S~0LQcj7kAB5pl8Jt= zMnb!bU5seC-b)%SbBi-clRDqVf321| ztzD#CRY?|0W%tKU&efbo3M2aQZ~adnkccfD)Hlna8Se!Bd5~9W=fS&CQ%AQvDl1po zenFx)p3CG4Q_hjhZt@&!@YwZ?Uv*8&wxlK(yZfAe; zhfgHo?}c_c>{NW?Bd>PLFU@q)F->O6{5~Cuo{{+Q`|w0&~)UP`Rg%F-;a2DiauueB`e?v)XE z`<>6xy)bxlu;ys_08!9+%h2BY!H{ghA3eCnaiwn452C#Q#&T-BeqrS2F5FE|VTu>& z4e%`1TXFSXcNW9k79Y6%&Ug2n-wvAa+r!HI@890uCT2KaZwGUjcNbMMaB-Kmo~?Sr zcN9668N?sxJPzif1s3N*E^3@$_Z{AF0&>_rVyFuX1EKe#5Am?rjh)X?8|Lk))i6z2 zRq(+5b^KWC{wpS8!BGU)ALH=C#po%&^LIX*gk^2Avt;01Vv+NC<97VauDt|8%KHs@ zpWRTEj;)MtpOKJ(NET~r2dQUGwPH5|97huz{_+>w$e_JLGtzldSPVtSkY~+mNs{qb z!U`X<=@SaS`w2I}*B2Ko!(vgm+K#5FuUdBQU&Tb{;yQ$P*fr(3KTFeydDv1(ePIsCUH zrakH7mFCIzb`WllZ(>$MRqj*oUpL1b`kmNKyYDfZp5E%G$K*gFmv2s6>%nlLou3PFB7@>rKpr~F2z7j`U3)+xF5=u%+(m;(b94}WB!TT^|T*Z9T>5>s2andY=zOo z*!St(DlGr%V}BTy(Far&pOc$uwe6EkZbKQ-> z1uo0)6?*NmH)53Dk{)oKYML(M{-UOI;Wd*XmfY4g(BLIEG+AkWdTyfWMky84WuBaL z=gn%}LN}73thV&kta~`(L5Zkt}~_ z*s!xr5OaNwJByTel?@9NbrK7OWnJ8-*20-PhW!K=vUBWJpSAv;Rxf}R9P9P_VbY@REp3r6doqBnflMnCtdrTifc zIq~AoIa~F-Ke4#oHZ};Ir|py2REzhHEluQDUY}a*x^cQCF@E^vsrHK>yR1NPy>q=% zuKaLG!k{@dVC+_35PT%qL{*cswjr}O>y1*<P)l~P}S56u`|CM%4&!_UXk1b zI{`4T*@`by4~(a$7)yOo`Xi)Ho8t*nVFk@sn_y+lvSdAJeG7U~Qn5}huZ5DG)eAL%2UAeqR981=SeC&|3U(2)U1!lr(z?z+{$H zHM}PFA`3Bbx@Cd(2G3d+Io#9tF1&EE7ug$dIy!0x>5&#tyO@8F!@3x`1* zpkI0k)eld-^lwd=%SjUiKWs_e?r5u+9gbG2rmVWhJgsh&WkG^ z{TUXXMi{-Ut1#tp4V~rCmhXS&HqP}p*zhTh6JNV)(3BGs2vFznY?6YjXz|ro& zlbu+~RmW^ZW2+uBe)d&Hkm#dCf!xa%fgP(M^OoI9OPm9sJ%9k9G~&x1A0?5`R;deIiI%5GOp3{C3KS?~aX&ZvbN!or4SHr=qB z-#_KAgk(C2J-uVE6=Cn`mgOq?)nPtjnlRL)PMuU5pbEO%RsC&%)7S(}9PmcI%>g$L zkGku=bH*)eyd*R7b0B3-^WscvR3Y5V*6tlunhNiwE=?q6l#|Q;HH&@h{hpTy2NJTJ zw;3lA_LlGC|6puk?ZA8(j$edlP~tQtW&jg1ItA3G+JPEi9dryU#5mwGw;CYru_d6$Ni1YxxH|{XtF)OVfrt=OeHbUumMrYGSO~4 zF~WLl*n91e#r+Rf>k+#pWeGVDuirPS`rUZsWe|345ErW$g5$m@t=LmCC)0Bm_BY@x zE%vc}y75_WA%;%+<=24-m|Td@GD9;SZ$MAN8@BxOr)dzQz&=&KZvsS)++;ZJ!>zm{q|v)2v}mH+n?#jk|$=d%lFYwzspI(N5wP+e&&`` zqpcG^V`O2?y+X3_8Tt{a-s7!5GBf#cAeW|U0x!3`icAK7kTX62H)xS#anX|S-#K%( zwM#BJ!|ywwgL=2}85CJIqpORA#qdRrV(07`l&oPis6xPx;}>{qgwQ2Pgc%Y&RekNK z#&*{Pt9AJxGb@74)ze8kMwT8~HJj(`27TS1x=}bBTIQ%6JpQ?%AHeUJSB@lhm|iUI zPIJHoL*GI&44EgG202ri()-^olc_S{6Ooe#*-9b;&E3^rFI<0veQIA`F<#5bs;U}= z;GjasZK;!3Oe$t-=33AHBvSwr_>tc)KQZ@8SVl)i5WP_3<}{yvLP2<&+3Ce?LQx}U z3t=WU-`f7x=g@V!_zgE0onOP@ z7P4|e9vjD7eKC%&xfOw&;NJCKcm22jeBzwplNu!~o+lkztS${2|MTbZRtTnVQ{G3| z^DJRe^xr|@{|Fq=rOoMt!0q4|ii;E>rALocOGxLM3pFY-N`tvgc@*1J4;PGCX>rQ} z?aHVPdl%vB{h+e--J%;V=gM)lr-%});VE6u0G@lNrPlKn!I+PWF)6>VIs?zl{5&2R z@osLrlmdV1R$2_eL7ozp{7 z=AVxCH1d8vyZC_JaIxPu%46lcwM4PE;D(*y%RMkKWMV0VRIMJp7wHCG1vnw%yaD$I zj-b<169X}%--6^xYC#n)_*ZqWKvQcgiP}ao@7%=eh4r{t>rK^EvP(;G6cP#a63N{8 z@U6FrKK8GMD&(|w;oiVEZiL^L3%y|ab9#k71DJ@H7OnXVgD9sVFOqt!ybH#y_9D#e z{k0-MCj=HTx+M3Sz)PY%v_xRGD^~kG9Tt~s03<1MYKk%Vs;djBg4ER2KmAyFVlZ5* z+})0u=!(9cA8c)ZC@rH*9d2`Te5_!;*e9uGLQKMJ1P(< zR~W>-Uu+H=wzf$jJ8!IUt!Y&~L94W8uM044ITCR+-&mfnSm%%pX7SB&2oW!=^2 z9q|aMD+}>-^U`U;8H!PS=QC=-r)2DzEdejMKgd+I+!iOPj?aYeDNZpCiSYj9H`Q^7 zM_MrUv!|2+W<;*)Y=EVGkkNvWP0W8IsnBurw@ zfFU3Hh7~gmFYgN&!(#l8XcOXW8fq^vMDC9H86zo}hI(T?_I|_p*%y1dV>Jpmd8b1W z4;#ZMZ;vhTHY`>zmqmNndSqm~pEceLrA_-^vJR06fAsV`2wbp_U-@(K27Qw*x3l_o z+APE<2xHN1a_JhXfREUb5S0@SI4>_J2s=Jk=5xFPjvz1izIIn{{O`0Lg-wjE1LMCJhK-W@Z$pcz-R z36Us1N|I|L;-C$Im!A(>TJ-E~$^O>v7EG{9J2@jJwVnWU;QI^30bSfaB1#^QXiM~wGHo0cduT(14ms43|^(&{n6?)<{U{J7t`F$y)eMvM5` z@PUp|BgI>uG#9>FDuOL@FRhRS0C*FCB6x?t6h0hZ8{1Kdwrc49Lk`*&=S z9Mk>{N%;+EBaO^gLTNQ$-!oLv>Ys=pZmboOQ`O0!$W?gf<(E3g{6CviCWV|a)srTJ za6;usQgYrF!9M?Dt=_|fay$)^c>1JSx`~HN@5x)-*@n3VFfAgtSguK6GAi!NlK7D2 zWBKr5hMf`!Q`d4%ZN3`$izu8gI}M|U-id#NuhZE3_=@{9iA*ppb-{23BHi9Fqa^+Vlp+iRaFMBGyySf z!5|7>aK-dIXCW_VO34_fwx9o8RS}=-=wMP`CMdoRvcgdX47_u{@aLvR_57~3S zfl7XV_YEwLq>S#_1&pbs8D5+;ngZM;AOwGYLO)@1wnCRr=s#}L){DSqPrxE+KJkf* zdpCiRjaAyj?^S)n&B*wCzd&Nz^iOBYgrq4f^TW{YT7yx_sxDb)5Wo)TY8{y&fb-uWO(4;n zE)lA#@fbOePoO}i$M4uWAPZC|4e84JdWW7<{$hsuqAPhqckD8CPv{N6 z2_|5+BYp3Na#HK6dbh6E-#R!vY-VY>(M-3JlJQpA$*#H_7&xoW43~w5b(t2IDk_MK zKLVHL&YttV4w1E}T1i}yxD6%sz4S^W*!L3tDsA(nA1w&C_=$)@ali8`4y@oB0Ap9)@cFHyVQmaF5t_R>!NZlS|oFw8;D zUykp`55-XfgP8kFg*Ci&Xe|}uWMWs(!1veplS&C|R=Gcl5b+a!h95sM-@woPS-O#f zkq$P)$7;M8C$m8~L8}@JB#IPk7U^AiQqo{Y3P3aUD1#-bdpk>hvKI*}E{phaAU*cM zQA4*G_b9AP2WJMxdDwdcHQSStfgsjUhub+9q=+uQPS@dDX#Ypn?|0F~C8&+F&@S9{ zTI)1k)4t81DYGtXW6G4DvY?-*xnHZu*4MiV?F!`_9dW|lxO+G)Xn_QrMO{84$52NR z&nDp4B5u>k*0d(F8;bGg+0Gc5IHV*@o_|w}=&5>_ldAOI>@7myxBgh|#mLMMOwca@ zs^Y?@Q;wEW1p=*`?(fa5@ob}F(bLfo4d2$LBnJ1j`>d^5EO`yRH8&CuP2Ev2sQU~_ z({{}H8K*=;-1lw80CeG=Q(Zv1zt6_0OFm{bv;Nhg?pHPD+{zPHOWFZhHgi`x(2hJ~ zLcF=q4OJ2oHi{fB0>FUzl~q*4q@<$4uyGJ`+wFS0aB+|Nu#M~=w0Lu1fetDU55D599+D{Tvx;dvNk8Ov3Ci4E_;-tBmFFzGt+CXu zLg|eADXmci#JNTSz#fN#O%U8V__Jkc}Sy-ZO;kH?b^i2XL`vpDkxz)nqvKmSublrYtH&PWV!mwukl7}9jccnm8mf$fX zyJe!E!wx)$I8|M+aI6;%=7j(`JcXjp&O8M#eR6F^D$1hS^@_FeC7c^7cJMJd!iCnC_!T#jf9)bP3IL%g#oQA=Z8< zL?eliQ1Itw$H+Hkr5tC>UspG%%IGzbfxRii%L04@{S@TxC%Svb>uv0Q83P)u?lWdy zEDwpCG=mDPrg_$UPwT+32D}(SiW_yWq;rXWX#>}AsWoUq3q%A*1Ao1&=K`l%@;dV6 z3WTyCs_GLCIcX}1PIsBvE9FY^^M(2RL2rE}$ zcYx-LSM}C*YR1?8>}>w>MT26?!IBB4%V$w#PH*1G4n|#<7Lj}(-tLdN?G^OC?v~3Hu z`kz~=b#4&{-&onRRhgH*Ry-~ zyxt3$b7UdBJrF&;(G>&ZOw^j`n~bgpm+U)|%Ug=b(+LT&nF#fn=Ehp=6oInUf!`6< zx%<09Le6XqSg>Kk_D>6`Z-_fMi%A64UNEdVf7Z?YV6t*Rro6kFu;nKW;-b;ZDE;YI zw=$plQtvyx!nSnLO2+bm9DsJH5Fx`{tf7fTY0u$&f*>B4L-oYmp7xXzuU}@0l?Fh; zp?^P>TPhMQTW%3Odq>tMqKGxhBADuqW3`QN+2onkL3w}aHtk`FHH0_U8v7khFwq~Q zENdos@oK^9XkuY1|H|xD5}*Rc!jKm5h8_5Hol>2Q&{^b$MtRMM+OQkf>Gp~LaV3Z8 z)Ff`z;5(*LZ+Vd(Pb0BF@vH5mN1{NdOStiiE;qql5wVAr3%IzocqsSq@>4c(*_&5V z+m~%O97~=p4^!ZqJ)?A%f!1YxLg)G=p#{NeQvcU5_$oQa3g|vj+9%27XyeuGEAk6M z<13tCQI0N-FIiN+yZgYh#8=)<>5-d|Y2>c6y|x-SviP;WNYf!kI$Pvsug%QGP`?~g zlX1cr%dr$$<(nkI`{9;T-`n5u#@!OJMiuG5A_V;_Zrf zjptZGK5U}u0wO#RWZU0&hvjnC*k4YeEKF)oifs5|+u&|ArsX4fQuGqu`eH?T#Mn;` zGB3gh$T@uAULfB$>@<8kbC+S;MEIMXz(%thS#?g@zJ zoQg%0gD~S}({n(#J4^hxL!RP6+A;pGZ^E*qD$4c=G1ZKGDHgxF`F!QfWH7yIOS3wv z;qW8O`fyGv_`0Rbo$(jMZu@4otLf;2y>OFU-xMtTYCseDy|rU|srC6Q8?S}1vw0!+^!`3ZEFx>q zM=e~cp3u7Cj@ar*Jku}m_yT#1E20sI=U&X6wykxFvbF7S$$R}j#e~L%zOZ1MBYh)?{z?gjJSECCxYTnl>>?P~NkLR?l zeuR(|$3&L=ewMU=S)$Zv@3oym802bCL~G`1&6I9hNJ;KMzICwOrsIjWLz+4|HyJu~ zF9Cj%Bi#qkGACQ-i&Q)WOTglec8OmcJ{=U`1Th9T7hoQ@0cuFmqu$9h=rM4sK~j(=?RoFrQ(c^saO7KULVGHkh1z z$(Dx4ZA&+K_LHWiLJ}3Ku(xXT!UlW!IE{H^dXXXqh8-g(?{t@#5yj|O3@J$Z0&$SO zmM&6o^i9z;rBaxuN4G7sW@eVz!qiFLnbu9qCNQo~ zB&l9A`se#-D&AmUrA_HXe{Czx_eolzg^0T*W?&>>;c3$tnq~-Ue*i`1CUDgm$iSEt zKDv@90~p6frV_EL=u46H3EtrTyrWB2FP= zye^KUH^N_zrPos8jw`B~FfGW>)bAIXwW`#6btoKoM2c#g(#M1g$)I+{Yo&IIWZEu@ z)d~Eu_iJaI@-4*;X-xihoZkqxqnv2l!^{Y#iWn{MTo_hKa!$h=Uu+6y9>RGcyAo?9 zZz>s^6e*yB^lIGnKXJD8o1+9hbwQXi3v3fF0rUEW6688x#u(fH2)kl3cc*;IHt9AQo( z-FsZJBRK)$b>Q$FBNVAmumy!GA&F|y?)Y>ydD@( zQgoT~%Y|%0b;KG@(eX@hi??d5C-6DoY5APvFN?ScySRi|NW2Cmib;~1m6f^x6f5OB1?c=t^Q}hXIqk$WZjCmBM;}F zzXTTAv5;tRp~q8{2PjfMR&nysfFuBY6R_o3@-Z7APY4v9l)T!I*n=OdPx0(PH75Bq z5W@iVF?m66_#RmKy8Vo_7HhNXQ|a0J58tHxZ=`2*>aLd2feL0canT3cuUDma{_+F?X$+ zn1be3J%OT93}gaRk!H5Gz!M7(!Z#eQw5aU(_w5A3N0JBZ#k4KXU-KDeRi8U)%u8615DI5{Oz!MXZc4w)6D`g3a%p*>WA$Umd_hcjHP*WuFi=oJ?=H3zmH;KP<18;bhft2uW zBB!{Cw1fK<(v7#Ot`THtL4qB)e9Mldwmss%Lo)- zHrq;CqN5JmpRLlV8*O{KtiO=t(JeW;g$*4H)mKu0r=MRR0a1D^0K39p`(Vq^XaE_G z95Apg!}Q1s-hKT( z9Lp~&LFebK0I*@h;nOF1Tw}Dy932=F`00F)(oCv`4Dhu#;y>>Gr$9TiX#RgW?ElgR zhsc0c%WGiu$L+r#b6Q4b;QYaBswFupB56*dc2Fecx4-1(ZxtgoS^7$g5Q!P{nxC5{ zDtKmcG@!ZJuU6z<8s$-Q9v4ylOLOMh=U7D?2|@9;kv%Z3iK(ESKHF2wNP0;i>-b%K zE|%l(R|2{al8NI~CE1VsNjV=yR63}Q>Xw25oj!uMwW`ZJWZ}J}ed5t$LWx3wFWL8) zm_E}6_)ZvrxB)CEWmc?U$+$0As2K_?JRxA*=x)>GoY1eli4?ix#UTJE>3e7*_@LH+ z9V|kzeUY&nKV1Hw*U>AnMJe5n9Nnx@9Q^mon^9H?poHDknSB5H9NCG-n(o!hC18Wd zzf1NUYU2M7YSG!sHbjekM2&~qx_d^Ajox)*`J#A*8Zef>$p58UIZ>R>)G^QY_eGOG z$Cw%9OL|%fAR&h?Gd#kq|5JBPgfR+BZ6!Rt1wzcZ(N8^ca=()qHU$|x0cPex+Q_fC z|1y_=Xr7#$jMXELYQ97XT0jAE7!iXZ?^}^0em{lwDq&4c)&M(PzlXk~!qy=O6J#zGyjU>M^f=F8jd@JBQ{@v==;xqpxPybgI>A#f(7(7YF&3Hhzh6Ua zHZrZ0*@&{zdrhwBp&?*)7rkv2?c3ru54u zJtAtj67V*5t$*A04~%$TRKc_+UbxXT3Qipw8aUe}f+SH2_ zH;4XTP8|q)=H`^pjbaFwKU1>TAbT_*ie+KBxt;tUPS?68qB)a265|w*WFkI%{KBGd z!N08K|98hc*xmlQ-$FGqS|Wd30-E|-+lo-uqVF%aAqQIPpOhe?_k9$%N7sBBx%K;2 z0`K{?Ni~G)xglN)?syd|HhSy2t76OF*P!LsVoaiJSM4r8IPCTgGvqh(qj>jrReI#@LDT;lws?#W-zAy(K}mcxH*3(jAW>vJ%t_kXxzcuInP4!6?vqcr@N zDfzGH^S`A2zb@dvY}li?*QGFa?aQ`q2Fz2RFH2Hkx3=F((mVxXwd;<5g=SSaNRIR* zAqM=IS0gA$va)LWx&bpgLR*o){&(kW(6jscp%sPR9F>v&ovMm*c5xHHly`L|2Esqm zXP#^Qe+9{pq2~W;@4CX8>b7kF1yL{*fgnvmdJQ5PsZxS;Py|GZfYM7MO@a`LN)IB^ zrAku*7!fJb1Og}lLI(*of^?(_Qtys`JNLV<_k7=ZIC zFh@m1b#vP0ARf;?DKG_h1IAs<{Dv;L=COw4uespb2q?WFqvR zR*l^N_=B<4)zzaL9cT(l(2AZpsVyA~z;6^K43*GOHcctNCDiy-a=+O;5&~ZKR{Ce( z_3uI8ypZ(BCsT-;DPR9Q138YWBS8Runf`%a;N+}aukc#DseeNIJ|h!gtK*+ji%6i@wh$ z^k&SD5#}d!oY}s*%(Gc!wubAM4Uc~}B@=Ee^K8y+LoZW~iiQT;&d1BI(b-sn zm9so=7Tyv`RgSOZHLM+<&#;wG*EoycI#)VH85T&RBA1FwI9P0N1iAy)W_kVI;VrR> zIbSk8RXK8DoXEk>ZfXTQF@2YUUEg*{zU$#(pyTyuWVT+Y#phfpU3^36K$Dw%WG$P2 z?bn*lqQs%*X6=@W!8%|&^V{FtO$2BucLm#~gj3uvFpZJ4|0p-l&Xx+0%;3LiOz2x3 zNp&U|1rdlQ-=d4oC@BaOT+A{z6UjBXrXzk}osyN%E2_h)fnsN8&zI{WbZO^nmX}{l zNh(;g-?`9R`&K5aszBp)yM*0~`s(V3pCinLW<>M7l6pmZ71e)<&s@@1N!{%AFFc6e z>@=>igX(b2RJMD?TZ?AgNFxu0R4G4q<`@lPx&B=R$#X$4CClbnDF@Eum)vdHE$w*H z_PX2!v|wLD+KPtd(M4~}+`BkF4l6TiBx%|@GZmx#U79^TX(cRmzQ{W>7m7qr@bCe6 z%>m%`=KLkZDVehsMsK!$1k@3W+j3HjJ}qxGJM^o+G6l4_kH^BbrZ#1qVu`PBoq(&P zK6+ptoAT16iQ^<7-O^}>Y$U&Jp8DBDrf<_vtU}+& zc-^5yJB<({krUx#C)s9RCH0bj0(v1&b8fkcs0ioWaL&$5d2Frq%MGViGH4rh_#>!R zf`6{UUITi5z{e|Pi|FEG^roL!Bm`xnZ`N?m%3D-d_gB#FsCeNKjXxGU7<|`BjJdl_ z_uZkr1pA#gHe!VQ3BG3wiIJ$6)^S>I+P-h?=Gn8_s?a}XX5V9fs;lVwxJCB7t;`b` zyMrzyfLY38!R&Io)JIN0hvn@s>1~=m(M9h^&sv&3dyO!++%0t}v%7id6J#;Av7za! zH+z0@g%2Hl=2ijZCmH`VVc(|KT_&H-3?io_qK{84eBh*lwl3WLeFKjYjXi|(MZDC+R(Sa2>A-z7NFz1GLhnKzJ6s;lQ( zpVC6*#M)Y_Sl&U8@5jgOk))b5X0i3y(^u=LXzSS5Khwv=SD&G6pLuJmrcC9J20zuh z4}owu4G)XFxc3YmuEm@dB{cmj#r$P>bGE9#I+sb4xyvP^_BP@`Pb8)Q4v}z>^%mP? zIBkE=n?bh51HOk6SvvOgKI^@cYLOAj${L?v6k*Fuiv{h4R_>RNNF1=wb~==6cPz=V zZTqbUalls-R3R5BmW)oe19E?Iw$smBB}axu0iw8}-B-!|$|9sU^v0$)_|siERe6nV zXHUMfi;L$AUG)@Tm~o&QaiH?9(_6mSF#$-Pt6N?JpRd^!=2JkRqWaUYUNQ+dNOq-n zVViiMGMgZBIxg#489yL7O^HwXrwT5_Q;e`}q9mxl>OSCa(K}*wfkMqa)W1 zk8^PHWDOk$TY08wv-Q7dvygo#TTM;g3^&u&D4Q4Q(Uz=qlCR1P}aONaEX%lJNwX%u5ParGp~sjX=OL zvr+n1q#&ho7T{hKlm$c%hpv)hj~2O(82Ky}`8z)@^A79zJ`N4i;I{=7WY5nb@4l_1 zvr(QUmPM5O`fc;^S@`rWaIKcW(M4CbbC_Sc{S8* z0|P};;@5n9I6Y>Pa`>fL^~3Dv_>ywUb2wx36N}ujn(q3{U*5PH$J=0fL;2ei#Uu!x zb-Rkce-#$|=a6Joy2Fv=AU@BGG2u?b_FHo$x2~8_qOG}krU8T6^>jHQ5Hgtb(@n=1QIhsHJ zwU_}bcZA@MS=u!-R;^|pH18}Q_`QfL9+;Mz8Ny|`lmn3wBz=t2EH)~N)Q1Rq0!N1z>#B2y#GF|kjz9f|;3zhmf`@IL1t+0y{ zTO*Pt+IHv@><6)_$oX$;$Qhr@EyC^@GuFx^`ZKE^PKqPu+608w%i>t~D;ilfu(G?nKwFld{N! zJ~Vf268MNn|riK-TZSr!++8H6`)Y0ElZA38H#Jl#Czj;r_Aj^R-fI^0?*obhrQ zb4M=s(<8~)fL#BPT!_!gx8a&SRsYh!RZNx3!cJAtVADDj)My5*;6$r56l>mlhQq-9 zn5F9-tOd$1hSSg3?I^EAap>lJM0%kW%h0|ZoYd!iN3Uur&53gtYuR>ag*=!^ATKPg z#(c8zgY4|i)~VY(WCX?NQA^=G1tycEGkG`+M5#T{Sf^v8+p)o;9}0IANp~B^yzzMC zvNRXfBHpO+!YcJm-R!5))-E%?)qKd_Z|V4x?p5s99 zckF7LCp&@ns_fir&2szcybimKy)4cC;puN>y&6%Ztn@<*kw zic>j~Te0{cVm)FklTx^Cc&5j>*|b;JUz1+`(KsqD4TeeQi0mePqJ_sG*W@~8-SL_xIxbZ zsFG8HX+RGyOtP>dK&lvE%G9Sp?eW37dcfCUEQm<@E1+{))KX9?I?y*DEC@}4g1PDc z+xWi*`;TxEVRL3gU|=0oW;2wHc3}$w+36MlfsQ`riZ7@KuEk!$4A3p8ce_APnZXL5 zXlY8N7Y+_^=n2Q3cZ=jAdF%GWLyPwn75J_Ug;)9ccmjdoW-fj<*Bps2Yv|$BOkqQ# z?KS%c-r!crgHB`R(z`AdvJ1yZ^gm~kZRD*RQQo{Hj*cWLjBrxJ8BIDrAK%t@_dD!n z38_%WE^gr9wcNJk_3PJ55rtVnS8Hl&zFZ#0Fjk?EpUSLb8KvdhXmojFtpdPF-3s}2 zbxKP+i*AoCavD%_0PyS{PpE{q%aBz&U@s0;13Y#f)zPY$6ece|Tuy%2GcbDSsMS>QByB2qsKyeGM#odY%+^x8~Q{3H3p%hB{rG4+c-;b=U zbJikfGka$CBXgqFROB&GNm1Xtd4us@K}O@v8(7yjZ(zKU5utY&euE;QUoajT@_;wB zGvsH`3wRqTWvMrB8WPcdnIS;0QCt=DJ>I;*9Q^x%8Fi_!eDh|y=)H`TmXFEhE0Pbx zYT5~k&dufOV$+A4_WWxXYd>F`vT2ZuY7V5TlB4>Q;BaCYjWR#s*RH>|7sjVKailq-Jt76u6Y`-RPqt}vr<2HUok zS}fec!f%n=t-qSUa%4g*h7E`8>(SG`#A#WvCb76s4?n(dVp!I$bwTyg^o@qpFx?Bvxz3{PqV;^yr1_FbUm-){ zTX{-IHhRK@=BdCT*Z4w#NmR*BDqc9Ldi65)?Mw3ea3lAzGynf zKY{52_LCODSE5tr`KDg+8~U#`n`DjnGraw)HWReDF31nA|Dw?Gx(Dl=k*r7O(As+? zh&WSFDMe9(%ThR|5GY($(Kxi3USt8T&TEMnmVr^ssiXb7ImTowaz5yf|E;aSi7;( z{$@(9DEJ+M(RUU*?@v9eO={H`xDh%2jj;c%L#e$iIF@&^3|E2az`G{tz***h(j&%* zW>=wxVSi(voiLV~B$0M-rDR@datmbyf&9NeHB4rOH=@On=Pw9fzZyMwXONrSLYop- zl=L2zHUaVJMgUi+Yc*$M`snC^iv9pL;qO|=XCPw?un7j+3(>?{I#_`VRf9o+6LDC- z`lIMH8K1&vK7T@y88DN|WJq~$M&;fnMaz_?h+@~QGPxl&v^5Uhti(OT?5&w3;lD}T zq1jHoyT9Z#0iQidHpD5K>EkyNkw~t5!1*D1*TrORZ!?r&*a-2$IRhJFYGs8`U0oe| zZz1vN%@X*PIfHc-pZCZ; zBtXJCb>h(867EcoxYtx`Y_jY?@57J65fHoO;%#lm?!!wmJ3jcAgPCB}E(*h~%4~1$ zY+r@CxtSDv&w9wYmrzc6P2obe? zRDm}V?uvHwfy2;{>&mN{vC# za_Ay|bapD%sHE+6mfu*%)Y}rL>Cj=P(PidpXbiXnGS2ko(0pE`pAguy+^=r(24a7h zD0LHi_&ynRTvboXe|kd|GTjm=)wf(lkjhFFFg5@2h=&9nL>W1>OSn*VR7_p`SYp6Y zq{e1!yH!n~kx6nUt?P}|m1w~kRtV=Zv-@nMx93ANXWe4S89k)uR=HR z`{a6J{Ck;=>I~k-|I8B3WaB8hL=@$G1}c-bprT%W<$qc-``cBkXah^;*O52fU2qoYYi5}q@=j8gFDf%GhFHePaY)n0U6h#{>Q}mekBNq2P~9+ zyEIW+0zSEfo-HlKE2YAje41BDOm}L7!*o*>vJCFY&|n6$wFmHrJ}X)2fJB@v(g3D z#H1V@o%?J)6+xPia2ry4nAgCr79wEuA|KR-T~ceth=%s!;L(G@{UPi)0nwE_ff}~B zy{vM|;k%~1r12vKOQkWnm7*2Wq_@r=!hZJSVZWyj4OVK$xa7s?KLbg33nk9qxuGY< z(PB?h=OLSc%+V>F*oEA_p#u}@Z}lVAdujx}?zW!Y4M}6|TfSg_s-)LiutKjVB4owu ziPj5_?m_|1uv6#Pp^o+t;-h6;SId>qu#Nk8b3qeeQ$H!VB!a`9+@s0n)4HYk?D>?+ z^|p}+VuHRn!C-|zxC^LO+6-%dsgX+J^1<{Sv8*_SypTWlkd_d6#Flg9ykT2j`xYC1R3-P=gZr z(KA6B9f-ND>zf5_3LS05?*%t~w`+WOkF?A(VLo@$yx4Wj4LpJ|ze6a=g#%-vTi#^% zd|te4KN%%bw{6vM<|-2Q$q#7dB_=Dt8;HYb$pg=y$=Ys3v@Xiuo>$kI=@f$<%_30v z*watSXwukr{pDHH4_Sb5@r|DEQrVmgnnN|5UY-9C@&*nT(2l~|4VNx=VENmB^4 zkFP@UF0QrKd1_X9_dzhxT;Hl4o9D_vt6F=HvV@A|Rs578a^dgk=wTy8n-Ec!_s);d zB+-V+D~JQf)sio{pD1Raoe)PRXPPX;?%lx96bQ{&EYPj&t=9*uCjC7cnTxLY>^F;- zF#aE3k;ZFv`v^31GJOPMD~UYTOwB(hA+C7kR2X0CclG&Py#00Ep*ueqzFB0!4t!F$ zi>3PgZd+^%Jbp)mj`6U2L{uQR8b>-Djx~z;F19@A2XTJTnKpeU;XJ$Y!8*~0(LF(| zJx@cVg*5im9zwC#my8BNOLO7f5d~GUZJ&GM-2N+}>JGpaDN#oJHZh<9Y>NUC&3-9te9q z(x(dEWYMpF`6w$0%)_y2W9e%)PGF7lFrPpKhYOmh5mDEw5?$MPohq$MAF0!3mbmzY zfuqkWY3T94(9USb@D0_U{8zU#=({U zgd*Th17LSKT>D{fRcA#XSeqW0bmRKQu{L?1k;BoNM% zQPn>0QSMe_fuH3_dNqo`_2tHQQ}TCx7_(%28O(eA0pPfpJEBUcccjgPLW&A zQlpi0PlHOF2S>Ueto9Yb$-gmk#aAO_iXwbPqE0CPuqU*5OLJ%z9!(S7^|?@j*YSuF zvU-gAxM4vQ`2mM8K$c5eOMuX?O$%GH{E=hpcoagMV+MDiY9cK;W}k!g#k~j6k!5au zKBPaHn_T=m(il2OL00qh`bt&;&$tN<7jz@Tz3D}I@=Um^7MnHa4`&^OsGf+HSDv`P zbcX2zVnkeu(Jx~CPX0okmq+1qemBa+Qy#u!AwSxYa!N)%u$O@;1z9aV`6b-k;$2w% zz$SNc2t8hk7`cbjIoc@j2DeTriHZznie9I3gg(|H9T{7oT9~kY%@Pt_TnN=+L?u8( z+ovR($rYLz+QjzloRzL>k!1bQC(Ib<*VU!hp#xN9H{Ufv6PfkiwKQakoAF|c!!S2> z#m&~XFBOZNxfa*Ur5vJ#0ji?!#|v%;Z{uug_PPBnYiZ8wC5QJtTztYD*tbnK51@m| zKqKwGtJXG_O=qSJ)xKrL96gcz;XbDRaJ`pa3K~ zGLsrr4!l-gX^RbFL}va9mMaZkzm}sv9L}lxMHwWtFoEBJ`1=%8|6)0mm?n#}goroM zf{3SxEf z!%-PbfOuP`3&qt z4;v1#ha`k6B_`C~>uFS)wRWiOteF=yylHwro8W|PbTW4cezP&#*Sh*kDs`RP}PhMT%5H&uJzQv3*TAUH|nTVZB6X=~GVxra&Odj?N~V+p*QCLZoP` ze7LUDN6Qo2Gpz-|)v0aun;E12WO$AxIGf7{qu&$}9VTD{7mJ2JybCA|-bnOh3oeN? zk({luXFAH0w%A2PEXxeu*x(=YQ!ddVto_l-96;u{L~Wcc_h$^>Jfp?mBtFVGHn~#Y z@`o$a!2b{!0@#FbgBV0@UI)}R`t{mq23Sq(n#pzC zT0B@a$Y=QJKnvHM@2F+nMhTBV;c#vUp@=eFb%Q>T8ImP$Nlj2wQ8k z1E{Wwkyc{xccG4(^@6{PPjUBuE+z4Q`HW8$V1`LLYl!FiFZ8ZLFAYk4!^vi_DtlfB zcGIYs`Z{+aO}aouF_)wRdOS}WM(a=$&XLhkZhn4*$U&I$MU*c)i7hSsP>rA;D|g*7 zLV-RM+D~b@)hrPcN9o!LX)@@v@>lFy5tQ?cKYaK?{luDr}x=KF`sD=u+2r`q}?6Px2YVJt+F)g2^y1``+%hP%PIq8BT=3^Gk(&3j zzr9VAq3EDpXU}&=fUX1Qa51i!Wm&KdzGP0%D}9ddI_DpiCZCBvE)KTXXPX|1@t=++ z!dLP!VHmlwynniy;4@hr=d$Ie&WszhYeFe%ssP7_uf=lqGKbHdpPk_hkqrY%2|G2* zRZxE7$A`dEptPi?6Lvp-bvV7b866l1O;Vw~rbZL`Pulbu(Bm6(;`5 zg81FORjWw1eBjeoD6v=3GaR5g8^{>8Y)>#?lME-~-l*7rRau={%&X==*0P{Z0+n@y zL`$7;eNyF$;}`6xVooIic5ObL1abfSj5b;#c%wzzj8vKO3*u4XAciew7W2f~4IE4tD}x|y3ei7u+Y6&P*5A<3q%wZd$%c z0$`5+sSbPHU6;77^x_MyNWjeH7U>3-5RIbF-R3qD?GWpPPlYA6sD~Wko55;Y2)Jf6 zkJ#lrhlG|t1eR|ee8Em%6T@*xN>jK#KNzYHT`}xV9Pz*gQpF61*7tNE$i(Cz;|r*7 zEF;UhDO9(-j?T^hM#_Rf*oz1fYB%`zOyd8OJ!p&=cQt^0Su_hj0417$@?~kLlp(iQ zuP~){K_a|UdWv=!*VfiXB$B6s?WG*#a(EFRSInD~C=}LDeOReQgh2B%v4jCd5*MWP zW7wmE-;onWeyhAcnCj;*P^>1iVdPr_aB|i=bvzj(NN(ifo+MW`phZKjQVRevuqv(# zcdv}{FNy+i#L7%zl?+E%iUgVRW5$Qj!N^16yNW#fz0kW{>@TzbovMQ$PmHi#H!OA* zT%Y1ImvX@X_7H)`3` z05F7z>kF+HfU~;3JFNfl6iN5p2-)fRIc~9l+6B2+={2EhTc~kjFzY3MtjW89Q)DRQg{QoP1M?J_;%$#7CFTS<^9Hd+&2y-@BP zG9&{uwq$)8Zw;Dy*GcVSR?Dzkv7CI3)u_?Xp7Ok6yHs5v=sd%wn;ow1!u2ry@2Fy* zDor8Ij6#zSyG1m<<#hubERXq%7tBq+4~>W`W>ae;j`wm%a4TU*vqPogAzf|t%bUfDtOqL%(EIspA@m-I203pHDiUY&!Yj|FktcDfW3nXL@q~?3rT^yI$zVB|4 z=z!mUnzo3pJ)jn;vC!cba|Z*TEMov@HV?rd-cPsDjefy^Mq^Cnr@{-_$+n>tM%oJ< zHlFz#w9$2Lf%@?U0RhqqZC2(q){13&HYc=m1@eJ)tG#p8gp-kFWsFpR`IP zoYr{p@el`)=4zH&Gbw-4dwgX1wI4GH>K0!7_GxI4$WlN8g?CpPA4x3N-Ic||N%-~c zGh#u=>bfp-HOm(UY~x zw%Tl{-kl7sPzBq0dPI>wEO~fx)NWF+p>YPKwyu9#)@U=x*n%`O`|IDPG9)i- z{-M@Si>9zo?(Rmorf6sh;m?CNK6xozSl{K!!A9|^uQC|^HXvqwESog(dCoywPv4+# z={q^$5N?s|s=0t^+Wvi2CbeeGfMaW)Ge2Dxr?F;VnvyUu-t)lUP!K4WG8gK&aA78R zVb=V${<;~(PA3PW)=M;9CYG2iA8b+*GI%B3;C>YFA5Q7&CxCU{Xf+(W_S{hFQ;)@q z7EH9EC<<1!jYoTW%^+1m(|EQ5(OiAv*|-?^_RSYFSRKuRi`W!U+vx#zhBs7z-^wJu zlrprD_&Sq2qVR!8CC^UQdsI00=8AxE{(J7b&_|CG*H$O&E2pbW^0T4w1DD<5oiD-Z zD>Q55pebea29XHtStCDklS-{%Jw6Ukmssl&w@Z9c6yC&Wj*kia=PFEH4g2wH z0Jh68OFK#)Fe&aGt+lmvq26+zSzBLADV{8yZs`)fcp$}Fyof>&<2rBF(@T=1F}5srhSh*zP_}7isyp$J)Dt4p z=8p|@9fzz}geXGfM1DMuJpJo!_c|SbzEWK7Lrrc=Jax-8Uk(!K5U28W9$)?SjjcyK z*IaKZ(hD7CeDL)VBA(u`hFzCK_DCClypv0vCeimYwS>(UzHlIix>7RBM zkE75Z+p-a(P~f^Mmv?8V>e#A;3MoK;(+{ns!fri4$bQCb=+kJ$gHtvnnA;GCcLsJ} zl*8mNBp4JPGosyPE<3@;a}7&?-L#UVwA;NKhZT3@izi~li(=%t^)n(SqZ&Ot{Jfi+ zmix5u32|36Po@8cEFQ1;6n%iLH;<<|aL(YQR=zKp49$H>De#uLoA6|0-W1k3W-FGH zlkxVGP;`dwc5hE}Y9IGU)NOR4gMUwcGMa}Kti;+&5(|^k#eh8H_6CT@fAMFCU>eOV zd~exsTo0(!Kmo+lzJ(s!?z`=MjS1767O!<3Tj(Ha0xS*0n@-ef6;IOvNH_mz1B=;jF-alKi`{@qp{*8W8zT#p4UaWTe(ae_G%R#waB=TQdu z6b)Y>7JhSgw=hZN=V$_jw31RR^*M7YVRTX05^7sUFkL?sNQI}%;g>wU ztT=3{&tX%mPMtF(k7~NmWhcPKLc+Oix*$Or*mFl~A{unuBD$rSIY)sX2-W-$LzQhl z=^iE;^$(IodL*O4*4okUYuqt^8)x?KM>fgF*jGA%6{1I_A+~~LBgHj0To4jE7btCT zT>>k}aVw8AUlNw4^x2Vm)tLm=7;Zt~)gezW1 zk5~^41^s*=!|2iybGo%neLFMQQXc~XfN9VOE44}&U>X=oCFa#c%PhzWH>i`&x)A&i z7I(D+`sN+Aq=pz;Ga61?lcMJ|#>$b=-xn=M*9c36#0{x<Dc-;U+}$A>^3;9v)X#S^ml_(}RU1Y_Prnav{( z8IU1wkatJV#7qVXY&7G^x*n&Hf+MiZ`cHE@~P_~xT6H4oq$tZ z!TA52y|il7c2C*}N0tb5S<5wU`;dcVVxb#`-;Tz&N9onhw5cx0O8-K4Edv!P`F^vL z#`o{V4(>+}o?DHiH(z6De2%d0=;=~(Av%D)UMXsA0Gn7~s!lazM1Mn!OGX{ar&Vlm z!jUg(i5aGiIhp{kp-gibk!5sX7S-M;cEreqi9Y#!;q^uA|YrF5Xo@y9Pv>ey6XdI#?sXFpeP8 z)zFBOho+4}@=LBVpn*2j$VQSjMV2umOp0#w`x4*g1q_Y30&TJ!M~d|%@e(dSkd#$1 zExTUgA1y?RR)RNz`mk^CTxV5AZo_JY0+*>qRsHs#+`P$qVu%&9h@rZ_qd?a#BRy_( z-xX-^<_B8X&(+mcgdp2ym5*H);!*!r#AP^2j_0a8#-G2bO9*hn$*QL+j+O$lbC{di zp)3~Lu|=J5^L|aVs)XM!wE`-0nt^;N5le9I4`_kt%KdvLgM^9R6Mx$(+z0}U{K1BM zCGoE!VoFNPgWe_@|8m~Ax;F6bvWHo2ikuo}8FoTAf=v$`92}q-!F^2$)1QfvG5i7Q z717|rb*xd}H5p=4@crE!8hv}@gPqMv(qb@%5H9~z7uqeinLIwOI&llBf{ym-jkC13 z3sIZ^85^mvqY9af$KvTF$;f3l^5iEw1zmKmGpEba!RTpr@$`RIEK)2qT=^(MRCulu zmv;v@3BGq7yyE`9J`+*ByB=&P#a5f{cjVdoezq9e($% zN_~HAg|fRYuR{Iui?eKOGOrcwA#z?n|E`zR3SCy)CHt{7RJ{)#15~#(Ih^$wpWsoC z8nGE?F0krf#85x<#rlYa`PT-!cMREJdHijTeQwdgte@=~0r)$o-*;6%c3GJ6YP$K*Rf7iVAHMnoshrjUj5a z3FwA@8*ZdWx%)VAyQNryD}4llCh=f4HKV6goLv~PRhgSCye=)hZR2_k_E;W3K3T2g z&iQaifE*KTo@mTDQorg2rCqTDxqO;_h?jkp0}r1JBXy0xO7Ps)(P&*(ehWmFlcU@G z8`({Z(*gUdtr1CV$b^%l$-2ADS*a0WC6JJ;+ac*+m2P}ef+z35E-HL%aU{r6UK(31o|=i&BuGu)z9${=cWK77escly zv@3_Di=s~uQ~fH_4R^NK6Ka!mZX73q1qNJ_WoXLUj@0l@)G&iNT>XTz2`LzGP|611)($Uq9bDw?}lu zm(ID7Rst4+P8EvL*t%{QT`trwfe0sts(VICXo!9<+`^)XDK5RCf(1c1aPPKG3o`rq z*5FN^2N#8Qwqowi-Zztr51j{L$j^d`Uj0QyI#u@l{g`|=W_FjQBVEte-lMm+75?$( z#H13PJjX7YK-g5a@UXDxdhm?wiC8wyA0FNPi^@(QP~kxy)6Y)Mo}-5XEzSRnF=X?~ z8M>Q3VyN?%^g7F=dee*wr947g7hGpLG#TS&ZTf{tlV%O;4J;{uGBr9~7CHjge(R+{ zyOutuCIDNqSweL4QI@{X%I4guS0*mI8ORxSzk|jT}I)R};%duPP|AhH@F7$U<~XQB)q*VBHQKwDn5-{4SCbfkiehdTy} z_876%2MDZ-d!>TT33C6WH@dE|BadjTnZAtB!uW^CV?6m=i$X8uj|Hl_?v5swmggWOhW zud7kinB>8>#<&uAI?o&$eW;@Oo^hWCXo`KLfkS|*HcR=~Vy}&jf$>;4Yv~T4_QRzf zXm5*0#KQvWE!o@Fcg6y_ESrS2*26mcWpvZ7axBb4LpLK=*fTS8Lno=s&Ir{Ml6Lx;WT+R@ukapCL9@G&eyuahK}VhIGXScKvXOCR;TK(@D;$O2?uNl~)4qKl#V_ZGmhvmy&v-8yXxZHG`hFO*lfE8;Bui1Eu{ zgUVnqieQ#ebQ6#oDNAxf?iG;H0@6lX{)U_W85rdUd-*j3$9hLLXjOPBD$P-X^*bt# zTqG0sJMM_yd42dyW{+%)df_duiga#1vG|Vn-{jlg+;<|ejKg}0F!t#(B(dsvi!)$9 z2;-#waX>kkP?~5tEQb&i5ihd`JhS4~R)f`XyaBL(g#W@=1VLtrqHb zR{KGuS6lDY#_4T^w-S87ZRgNRn7NvQ9zSNy8qq>xA;cv8j3Vf(rRSbh-}IP_wA; z!&kyf5qdqY7VUw4OnmCie*AReja{1Uxt;)}ACXEVRRAGNpz>;n(n64Rej zl1q-B34G5L1K&Fa$k0oLpqyCtf$wb+4;39Dtu~>^bo~MdW0{CHodG zxU?Y*6k%LlKC-kpc*4@;9Jhw&4HyxnvjY1n4>+fXAa8bwdmLu~=FG<&`!a38Z$9MdM%yTUw-MF{Vf zsxhodQX-@=T<#wXPnx!rUpfgfx5ClLf<+9YoQ%D%Uz@HMHP$1nGj#?LGN!<=YM>nJ z=lwKCIjg{8#YGWKK;&pbu|7v!Jx!h=P_r;s@2cvHv!!%zK`B*4DKbR{#lo?G(arB* z(H*zitVh}KKpghbixq_n^YHj2>FJ;AiTOeg9D0^v5+&l|H886$$uscnTPbAv+7NSO zv3lm|J-;|$F#5dG3eAsqJEO=_Bk&|7jgC3F8~I_tB0@UlAr&H zo*o!ks1pTTe@_*v2`#DdGNn2nI%UKYXh9dawm60&Ep|O$n zDY(f1LQFt>{WKZC|b&n-0cogt@eaGdz(4E?sTg7 zm#VeXb#Td%bXlzMV`QzZie^}pN)9q6w4aGL>hDXgUC-T#I=`;Foq3>K;O7>+mNe%L z41^Or8|CC+I5sMBEd4JS8R=7}N6e6jZ~;Z!CKlZ8fB6l;q4EnveJ#;+-GDGRMq;9H z#57BWI{EnMVe9hp@(%dQ%SR@u6tyZ;sOv#yW>kvMW$g;T-=EA%S1+S-YuSlm3BM5s zU1qAC?C%#-e^nTIczi^K+78T#G6$EJHPo=)ZKpjsP=~H0QV<2zS1m6X=FpKUxTllE>br$3=eQr<0NP~gj7b!BQ~ELJ!`Za#l}pCZ=+_i% zlcP#p4Lm$NGIMkBCz4N#8^_3kp&nxZEMJ)Nx$rH##xlyIW;S@ zoAb%V8=O=;#I3v)fs5ulzy9pryhV;BZ`XA}Q^NPPEWj?8T;D^2MTs4>grPKS9Ijv3RPgd4i1bJ$d%Yv-4Ld zY9vzL9siB6xz!jHIIo+!#Qt%p+>J=6t@;f~egH!9k_x~45XHzMeN>n3O&53GtG^!) zHDrhsKHr_DQWlW8?So}wcST*ieHM(y;7S1zX=zrO?1U8rs1;g>Pp~xM0S>^VPWS>d zfk-^WR~8*FM6GiSd>-yhWjUc5M!h(>HDi_2Wga%pD6^%UUH9yUs#Sn6=U^283riSL zz}Ac_TVI%Bi3Q`A2^G*6jn!c^#t0S*&-XtD?u=E7?TU|de^KsZt5@6I-6c}jIPI`9iV{TQ*KStvr7ae>iKo?D{l zO@}+?{a_FADOKNLJG}WkuFi2pA^%!^r&vhJ$qc~RGt|5JKRE3N-D8KCHex(Z0B{MJ zy#zpdWNh*q)CwK_70VhRJ3+cLx?z*Kcxy|CKp#tlU?fZsq5=u^U4Ap0jpq)ARZ&I8 z%s~+7LUFhtWKJW^gy_^v9CGRBGV7irKdlt0JAmIj;s;2&cn|D14iM>u1u4V*oPd`j z{H!+aS;IlZCMRqed!JOTRj&t!{4DKipwmz#&}YprS@wx8RpBO=;J;lDn?ZnC#kUps zfFHZUO#etspCDv813&aA^f>|fS5XBvgeJLLC;_rw+TpiuRL+x;A*ui^=8dmwk{o%V zg1C{a+MyDH>3cuAOdsLZYn)f5dcUB8#j3m5h7cLXY>0nevFcVcTP`|& zRM-0#(Lv!gsG$Uyd)C9hAHkk6bU$@XpR<^eB7_usL&BTRg}&F;@3PKZJQzonNy6Iv zI1DSZb*L4Tox5V*3o1a}hmHn(kf-a5v7 z3_Ef?LuTj;qtFqo^Td1ov-B$)saJo6c^Y*q0F0 z|FdrUOW9q4^;0}Bg55fOw0N$X4*K660H+$@`I3ZwN=1t;J1MA!hpiq$ey72Q;C`v3 zPB=!wNg{m9P}01zq7#>xh=xOODuh(Ykbu@61`BTXjl`j9Wkx3g@Ax`&9~}G(!@WSe z5F$tKJ4BU>1k(Y0`8LMT8*k#@QKaeh`OSFbAQ-Ei*+)*3q3=C- zrf5+6or{AypRc_z~sRshnG!7b98=@hm2M zE2CNuKe|v|iR+zUBEnr2^=0SR&GtBuOB`#wu02fy|y!YeWlIDHnr#f!W}omZtCny zs>yqwnN1AdK87F8Klyh~$hm`|;|?LR)*r9{H8!-gv#F>Ugr^lG3NG!Tu~tcFoG5e>$jYAA$u+_liUqRX+JZgE|iC`jpCyY}FC2 z#u@rKnac+ur}_h%6uTvR7bix$QXMI;)eg;A{1$X$4BUbjyCy`@-`Wx*$B3jiF+N*> zO_%;;x^k|i_0Y#&DaJm+`G7`>18F$htDE5*CIhbd#n9{CK=kkErXWxFD~fkM4{5q{ z^KO_uKvS>B1iE~nBvTfVLG*{9BjkuqQ7%62@PzsIxgzewdF-QlCY%v3NL*ZE{o!Ak zJAET|QDpW6tGRgALNtxxgh1T{2PIoVqFmv%9+zu_0h#&4{pvdMh8Ns%s_}cLIr8%h zE747(iRR{J2&LY)TYpuhNDqGKL7`07uQOAoroi;WYhQ`>gnEW&YZhwH1jY<;RSq*D zIr&(xP+v9~!lh;Tco@VbP3Yo8$z+XffmU%b<+JA43pHv=3?{hx$<1kn!xg=xU72vv zpEDJ#VY5&M6!=2D+OQ%BDE5Bjsqo%hr)P)nSW!ma7gJ2GcC))~uT;4L+z6 zsU*w*s<5T&_)VSd$+x6m_0sF=J@n1IY%>+I!upS;7&1nxG@_$_+9_n5P^Z7=8eL&R z@|$<-q==1W<;q^Fi6cCC9Xz!ajw~IPWsA;O@8GESP?xS-E!1PV^8c12sfp+0RIIa; z?@t}4xj``*r(Uh2=3?|q#eJNs#sSEtTji*$lm2M)a#g0oZZ>TtPmRC+zUcZu`A~zT zMtD=f>K;HE-?U-r<>>6}+$Pz0-a0zHy#7N2=dy9}KYSSBstl81rlTmM9>t4;XJdZc z_)D}Onzuzhuvl&A`~BAlY(5%l@E%czoFH|^%9b(52>(EYZ&nCEd!+9y42HF)+9hDi z_b^#L#G3b-nMU&iM96()w`S(P@Q9F4(cB2lEF_*H>^dX#NnFY0+y;AI1`XZJp&L}P z9jRa+Gjs~LMKuNVD4$epRt92HGASfHf9qIER;5_3btg54BRvCs(|uP2P#cm+Jh^W* z#*ri9S8a+2n=%@kpNc(%h_Qr?!z5GF90R6vlBG%g?e=|7eL{?kGYhI}oXdpagzC)N8$hfz8Ub78g z1e>zG^*kbM)W^SP0AcFG!MeELPgl|>}+G}GaTP9IEuNHx8}Z#tv4VBlx* zOY0j;ua0AGIcVO3QPt}zH=h$lksGN z&YR9sqWsITz4PMqqAwwp9DSRxdYSXz)z&m2R!8@tOA`0IJhUP(4Q zCFtmmLWwY_F0r3Ht~h-bm0NXmWQ0pXf-`)+7#Y1>wP0kD^Gh7B%?vW2mPDueZ7_)H zfSQEJ^@csofMCb(Soi7X&tbuSkk8Jagg<+)e?I+PNBdUj<4)l1hkc1Z89^8i60d*W zP(25kU8Mb?^vNS(cM0#AxCH-6hy3x74DvjA>t^F2)u(=8NJAnY6`fuewe=MAXn6Ob z%=k&y0`nKAv`%xT|Jqb34l;cBtsZ_rh{1Nna(pqDn$c2eDFcmdj}{B`jjfIwryba~ z78FMTW|c)1*b_N*YuM}R#8>2??=HV-exD}(k^ePc@LP4W-R)rHN~c-krQnwH_p3zM zH>%&9YtQ$8kXrL!=yqkTo4eH?@!9|26n=F2w=}4L!iXc!g*$B4LMD;lwwr;b^9yL% zUq=YZY-yS?{QoOf8ip9*&W{1*H}_Iq#V zH`RX&CTx~??)wuG^kDM`_dMvEOZ`KCPy|HxH_WXFo>AQV8p!ZY-)fT z=a1=U5h}8}xC_R*^Tcen;h&V@?fMPaf)#C0$|8snra_g?Ls4)SV@3Xg=H*hSHDQI1 zraKc1A-a!Z)Tp?0kMiR!By8uDc!v8m|K+*vR{qb=FB{I_gOR@p-Io7)_9yDkk1wxG zYQJ><;6F75g+pwz)}G;b4YrX>2-}(LUcbQb)j3MgU%S?34oOaW(k75A8?0F!O4nos zm9Ifbe!V5kDoXZ#u2Ngg9)l~}vp(ygJ{vig8%RlpZq=7&bgCTft6v+G4;q zJ%ch&LP&VbEh-#!H~yY&X4cf#6A>2-U(HB%zRc21h?h>pkffMSvr0yjTwMq~Lb&;m z?>@m_m`O|#GI?seJ03;iX3vh8F$c?81Wy-6DppG~wtYZ5h%fzGad5U+x6k?IS?bqt zn|R2VUo+*kgW>^c&0*FBBOd~OaJ15Q`TkyBbcrwyG-(@q_`Pj&o3T@V?^}N2!7Gj> zI^r!cnSPmDmmQ=Qw^csyU~kft<95})RrScU^MWt_XIXXdIixH2CJ5Q~g;SE~Z(JR0 zR=$-xzTUi%pZ(V{s@PqX9Y!R37Q+n}9|>F==mWO}zy;_m+->RMEJ;#v=CRlH`jZxR zb}$D(dSzv0K)L?N<^=8WFs<$9*rcjdY;GxmtpG}2#wsmR{$u$_E&-7^a2kO^se46Q zHFL)Ot>2WMP8IjID8leJ9zuL~;0%XklTaeTI_k3=BDWZKj4-IX_c!H~%B*COj)h8V z44??P+z4s?7pfL6H=$PbDIP?!kt;f+*SV(tfUSD%j$UKRJF%p$1kYoE02r-j-1Dji zff`D-N#kYS;_K5P23Wj5*+TEQU_)isp0(NB;++hxYZiNv#zXHaOb4E8XWhn6zUF~2 zy1KW$ojp}VPh`_gPdYp(i55U)M@>hiUfpOT33O2XW4+CRX7u{!u(M}xDc!!DD z%wvc1ho;z#uDDWTjafg(uGy1;p8^?er@|h7-czG&9ViDvo(#pJ=;J)LGjOcp>^mQY`cL$3?!oA^EE~L-4D3uycOx|R5 z8w@gHuASWqqyD$>-N@l#WAx^?KATC^53a&B_4??pHGVj;5qqwk*vL=y)@}XH&}vbZ zfpgH)c4!dmhhM8fzBYZs(M7@-k7!+upvd?;*90r~!l6Dhu3pax>OTWq+#2rdXpX(i ztW8N{J?`s$;VxkSA!n~#TzjYYNZ8gFfscb|bw5p)&h||1sdt$Qf>hw)0yC!`FWiy+ z>FgZ&xM=hH&l>KTwQ4zmx^D|cM{0HE!rl`I%nJJe1|44~W;J>h1%FJ3ykf@mT*9Ar z6B|mFYHgbY)g@Qddo>d%xQtc?bfuyp@SWd$drjen>C|0c=uW9eB8m{+^wm-%Xg78s z0-O>okfgG1770drG(k}TLl(H0I|}d~h@^=;iU;tv&y5zEa8c1K zgi6va*y{D)*@k?z9{;J^0Mc-!yyUQa6?~e? z5vRH_gedB4VY5k+23b8WYoNgAVT9ledLGx6Qi6E_dW9zBtXff$vQV8jJw>(QUCWTjYvqJl7u&{hn5T{N}$D z7gU@_7ZYIJ#N=nYrpD{yep+#wJ5@%OrHu-QP2w1**0$9rK|`0L(9z%S9QB^Qxz(Z9 z)f+wA`y#pXi%1Ppj>F|=#!ZZ)_<7gTJV=EvOuGY7B^Hi@v00i%VrBEf)zH{=?X44r zb2%Pm5O&%#26>wvmg(XhjAN$+og?C_LuS?`*r+sY@ydoX07XVx9Mm)3--adLM!+)7 zvU0Ft!MCIQ?aS*s^FJ3sLlON0LxH3oi<3$98FZXoE>qULes8%OcRYwWa;S8wF)<^v zwj^-c*U-{c{vT6U6&1%8Y=gVIySqCC*I*&I6Wrb19YV0+79hC0yK8V8Ji#Hr;IDJ< zUGKdQK87`G_4Mh}b#_(lz02`E`{1ig_)@_~Hp#jlSi4V*+`6EHD8tXko<0M!T?n0b ziSKUYsbf&^ku6qM?++~5)DJ(QaAR^*p87WNFXii~y&pKY%1x~tKsF}5U<4j} z_6QY%FW@BJXv@#y*}8xFe#et%nL;KawA|jhAK&^=JW9B7Lg~0-O1k>ryWBgY#+=as z1u)Gws@nvMj&8WGnf$NMj@_YeFXuf$Dbe9^Y;gzC&T;p7GL~=DnyaB7YOp|dwsg2@ zY2p0Uid^b(%F`yDHzt}#p06(_@sk>t7{V)o2@ks$18a`(xk=L6Q8dS~m_PcfYu=-DNcl9?}S>m!M9K?Zl z(r%p(w2zS^&b!a>$|PbD1-TT&HfMb&vUvmW9ZPlnRRuf54t&$@x9oMcc+FE4xX7L! zW~P47XZErj8?K15iP^!6*qGM>fPmy62Deq6GvViZWU>^ms{&~>(UrQ0w?8phT*K(R zF$7+nh7|LV(k9vl1~_5FEI5cTcDz|TbP4^o2M!C7dB>bBF!d!?U@yN6VM=Hpk9*DcJ)G!ia?JEOJez)3_k*D5-i~O#xBGY6#UA8 zkIn0~sSMQYGf;HzeBBDQJA?B&NC&^~g(~%K(%2m$!VLC{Li?X+fBI37GG@$iVq($b z-LQ#@^t5iwo{7Px5q5n+`>-tpg9-G#~k5D9p@nffz5;5ury4ljX(X>H>YoV9grL*Vip|7N<>rcD)uDecI&U zcmpG*bzTDQ(*p&VsUH}i!6_1-KF|ikUy5p+COhGP;vIgsjogmxF!bwZ`l!JBZ%Ax2 z531vqD`+3-r1Z!wyRgH9iNRmYjOt%s14dWKh`-USE-ZwOjmc9mLUqBUY`2CkVFHvS z-wA1md#zd@eW7wKvk?QtDum5NxQ+pfmLMiAEZ~2UqK+jRQmlawt*x=k`w@U3TMh5` z?N9%PZY1&Eml~yB>v$oCWwe~V@F&X~gI0%hNyu|_ET_d(9~9o-IM@>x-IxA!KuH{z zbSY}Un+>qUD0^zmh>|=&*`uQ5d-WQQ@4=`7Z6ga@dRDP^@}6L|tN7cpif5pppqLmN zzjJBRM|a!X+Y3o{qEhob-w+UQRr?x|kbqjSp1Kv}iBzn&S*_ArCw6yA!N@GY_th4m zmC`r)@~N|bKi2PR4NbtN4hiP@5+ogk44a zIu*)lz4B=L7F5x&txt`O?PG#jeyaTYCj+j_X+T@OyF-y07VY$0F$2hVeeFGO4tBuJ zpN?WndFJHRHf7@J96(N#@Z6*Gj6wXV<0^YH*s>V4v-@|53rm=`o23LK(~(PCnDN~o zNy=nN#g0u>ph?IK7^I-v#EyggxKrl*$p>tJIID2LS*eVtAxQOPb|~KEeA2SWL-(l@ zt1LW(R;_a#*kYXyg6tv6RECc)1K{f}&pocZ7iLoLM;w0tx*QQ!^>LXwpM5m&n!i!+ zrcoSefwD{pS<0Es;br^p+;cjif#Jxl}A-#_!w}yhtY+ zbFuY?-gu(5^yc8g1EIxGJnMe_$#0M89x?CeL9!HmW@Ep)yaK+}rztEm7}f8{_8!!b z_ry%gHUR^yw zbUi-!h$&B)&YmAzm3rqCL#N7yD%hS$6W>7a^GdCYh|bwwXZPTzng9aNz}Fk_)P-S? zy9nji?az?1f#?~ zqB^H3xB5`ptx=%Rwy%9Zc5c1l?*`3=JV`aOg~?W$F;mwf?~xOtreWg_s=B&{gB4i& zFygwhVs$usx`Y{1!a07x_$v+RtIn#IU^u4UxkXC!h(2xT@9D~)f>>gIczcL29ZO7; zU&J>%zb6&BmUFDHNgjVBBaHr_@XPF=GHv_#*W{Q#N}Wkz?KLG=d+%T)p> zy!x`MYuA~b!A#uj3!9;qZm_lA?_9@T%vOGgVtu*%y?sUSr0g5&8%XSxBUfOpEv4ZD z4c4HU*emDj>f7_o)#Ax!NKggr6nIYSd^j=S7Q6lFadv$js(j6D!E(rzzlBf>p1*$3 zT&D2c=AhdAgPLbkXXs~u^!A=IlPi*ZV^voEgi1$PQMp3W6~nlQkXXjt7r2npsFw0$h|86|r;U zwR8KpT6gAD=L$$+#;Nf`Y?V!Z_xMl6yB`TYpHybgAjNJ%wy*{1v&Ql?JJJ&et()SA zVl_<im+0~7+I-B+VG z!i$5B7Y7I}Yj(BV=v~=+e@HR^(@*>1b$_zF4wttFN_)VPQuTaubQ|W7)rLyDnQ+~) zzALwAhbd5X zuI4U0R`R)Y)R?tECX@~i9tf@}4M~be`J9|}MYE>XZpah$(sFq5{az#`Ua)kDIlW+2 zJPX{kTK2ZE%qxn<=DbiVY1D(?jI@VGwd}kxt8*0DqU*uaxz16vIwG-5^w`%Bct2SUDu6vmE@BzjY&|C`NWBsWnrXR2gybNsmXOQw;FU72DLKT?F9rCW69oIEIHN z@K28i=E2n8X(OHL&zNCL@m2&BIXHXZ=bqtpmFxM=w&deb5|Q>uN;qK_6}YfU`Myh= z^~fVbtTT2y-^*StM7{-0R>O)nm=fl_?#Mb7`g+j8@W1vKwcayrOP>5H0zc!O_a({E z6g$?#JyoE+;om>+h*Q_g69=4@f-fUQBZ@57!{zYi_P6%Dwop8fTGwQ7DY6JXUpAjE zEk?jFfi?y;VzG(-e;TxJi#^mGAn~9#?wA)p_a>0}y^ubGuO$0<>-d*q(EN{6j2jS75?7;jUp^%-Rwr4L+nXJes0+rR_uApbC!=vQj}z}?dpm7qgx93tV~o89C)s;az?to1MJ=uhYLpsi|C76 z%nHsO!l_IeI!@1QfLLY48IC6yaiwt~jN4^h8F3SZ!^RjbA&3y#_b%lpLdzIz*EDpM z0!ripWR)gbxfDc|25P80T*X|dOC5Z?dIAmY1~IP4lCY>Yk1jp6DKo2L{t}^avyRCX zG`eT?K;p@(j4sM(#}Q`OSzyP&NcrLZm0hqbyss|~$|D&$V;8U1>^r*e>kTXW=1*Fr7K~F4 zsku(*J6g8ltifLUcm`WB+wMiRqSzb0Df9doX*5D7djBcPeL82+eo@gMJPIco-3&_2 z!QR=JP}x;9dW6k=8*l~pcNz7^eO^ZrMQANj5e`axd6~gbpy3!JO%ns(d0urn211d& zcA)JXB?==s+C2s9R(v%!+fG%g{=EJ2b07w%!J2kuJ98pB7V`Y2%<*t%iFr3P@QI=k zIm$!fU8t<#;E33>HM2l-j^NVc9*<N5nrnujuGmu_4b1I1*i|rroh3-e>D^k>7R{S=}mP7E(y4KY!TR@B})x;>BFnEsdeArdiC%m(DIqWF!nI{1JasjF^dKMOa zu2TVN%rO5JGAPUZ9QLyLRot<;K(%Z9L$jJJZOl{NMiU&$)`k^HYN-|Vf z0%_V1xk@lY6S?YbN|1(mWNrEc0M(f?ncb!28+!#~u0jKxt$fCf zTCBMy?ZBNPc|Ym+suF35M6N#`#%Dwt3VrN&*CKcVZ`#f>B(BV9L^M21!eC=ntA_~= z2<3)IhFys|eZ2mUsV)Sd26I<|=0I$W_O$Y|NGkz?2yv#!`CTcSQr`rNkvZl8Mj^uz zb)3%mg|K)H${06Rw#sGOQ!b9HU8G30b%Mxy<+ijS*JEn%+_G5W%;x=lMv8%-G2a{u z+FsGc8#|V8tPn%*FFdjlf1_8{1mXakysjtGxY%2XN7|0pNU|pZ(VO@@ifjgeKVN@A z9-ZWfamEw&9s&haibAUA>?U8;V9a zM&VtlqAl=U?KuzAEec(*j-2~!y1n_jd*=di#G!DR+~ZG{a6e_}b$r+T04aJm*O8BQ zpvGD{>vD=C{PG+NIBy|OCb-{8_ZT^^Xk(C3VYc~mR>LTSoSpIMoW zGZTA5ljZv`?uuh>PDQdogDO03Xj)hPs!0PrNc#rV9${|qq1WF0@^oN(9oK2>tghl} zN6VV0eD!6N5@L4H9#>;C#50m@=Nr-mBaxKvC@np!jFwl%D-c@s zIm0A-0@2A{jz_MBS0S)HB82pnXTJ}5W(4`Zer98AqYii)sM!h4dxm_Z#bsYz4(SlP zHF@5_OO*W1gV2TeO9N8=u4URnV=wq(D-zBBdcsLMbJjfY@^gc~*J1gH^KtwDKAt?t zGLY%Gqz`mWJ_OyeS&KL~FI;(Q*ut*HB-LqrU(jcV^ZZqCQ*^PleUJD(kVY(yrFs6;E`9v9RnBi(ip33w z7(U$|edPIojvIy=>y8%B<#plL^FKr;z!|o=xJuUf2>XzzJ#0EP_LbW?cMtxv*o>1Nh<+=LbkV8ozA=86{nqB?=2kxw*caS zn!pF7&VYS%QvYlD>~lhy1Hmo0Yc#P?p!7GR1>XvE`;dTAfJ(mlPVN zS6I+s>iLJqRri;Lo@aRO1b5C2H{xqIN9NYQ9DP|0VcE|HuJeKj-h zb~qK`>v!ipZ|Pol52aVv1yu{kEru-VgVQ zyQyYXqlP2Y*qBZvB1*kyN~UEvU-%#Usr~}k{$lX>l}*;^5YUKm!A5Ak*z!a(6cvhU zoQb&zykhNq3nd#`?tbO*JFiyRVFPl|OUuAlJn+v8!}eLq)#9h)1#oQ7D|_P>cQfzr z3=;m(f@lHybc@SgsGi{)6|soOfE)H)Gd9#x<>vbI=H;v3AiT@p1ItIShnZDe_J7tBWzH{x%%3Qwve)a|Tq`i>)8F+f$@ ziyrqkUBCm+a|1wj(DpxBDZ_OJj{#hQXSBeO0hX5}W;O&-gabmVA5Dy!L$3H)x)OC6 zeMCLLX?Be*0K?BVRWtvlGof1s~=4!i*^AN<6LZdHq@L>EBZkjqL6Y z5Pmoz+q;icDSDaGS{-H$!_tX6tdrc6wgUfx`H1j$S*8-{!@s_KhFXcyuQl7Fx0e7JnAf-2I z50vdrL3c4;`?vI2M7mm?5vP+A@a48YI$IupV&<5r-^;nm?sAVW4g&?G6p9F4!tQ9D z8Nc`LhtB886!0n=*=Nd(=!g{AO8`5-Th26s&{V{tEi>HFkawrjb4S=#+gd!c`$A72 zUqOH|f@i#ACvMvlnfN~0+eKNqn-GIiZ;2$hFI_Z-Ozcn0rKzblX&;^F9|+;QevC=w z#9h4YZZxB(zR=4dd2&0`;w*!rBQ%h(Z!eie$bE3$OLp|Pg<}VAEV0*z7k-aN;)FWe zJNk}TB$t09ZRpMpIOX?viA>+LV0+v@TxuSDZMKSdv!*BFnO$Ucl#CqLIEmH}7`aFg097z$=krQQKWUgj_(K3AEf3bn(0^ z5B-r^qM3bhJ2>4?EG7Z4Wjsbx0gZ^g5}@V?N7lV+KL05d>ziA!=YQNFyWHpM8Ax_L zaz4fJNPPZH(dd~w(tyU5{PLuQK7Pt(b$aS}_N!SL|AVH99?xdD*b~~DrWb*(VKN}N zBD{&6h@zd3@~W(S6@}hiH&b}A!0G-ombja&HG^1f1=v^)D#mK->%TWz$ME~}5|~iK z#lf_YvBOTp&czYk*5(~|*R+?b5{SLs`Gx?}b*%GsNcL_aZowba)P{^lC8ley_aLNS6AQ^Z|O` zX$vA9p1J$d#8(_0QCHD(=YfCpOu$~M+~i^qy&GW zk@ovHU{n2Dy<8*2%vg~0r_dB>Z)2V|GwxD3sUR9=ET6=nGsOLt1nbA{iLePHzo(Dd ziO_0OmY3s>0TK6a2TzwJHGVMnn@=!)yD53Sj=BC&;(1szV%M(EyU~*U%u+t@L~pb5 z_HKZh_IcOEgx9YrO=_2QG@2Ue=`>-Zl1kmGeXXSAEk=7($a zyqkVG$wY@P?}%pRxQM8oOEi?(V6XbyJ_=SO!@LJ8Ya(&>8;p7;G^^t~+y(^oyCi*6 zv`+-S47!*#y*3;sZdT}s&D-59PVwx#n|ULLkIO5=(>(Ih&cA25!2L((rbixVq&~Ya zE1gr$URkx)`&J^Zh$%>zQmfm+2jK#vZXSb>q|B3Sy%#qFcHHkvbxi`bz8B1$u+Ibx z_;leGmUB$9l{<;V>xNqzitoPNLoCLxn}*OIm`Y5XV6kPx-oiU9#^BrdVi~pHyS6@^ zv+dCJfLXAIWB2GbJ)m?m_{lP{>$U^28Gm8oYH378cAX082d@tpD(Sq)TB z11a8b#^#A$!tV9Uy5O&JPzd)*s=`|-|)XUO~@2~VWOoNQ5{u!c)H21RA5F+)tH z!(hsBS3hf`%R6|mtsv88d>~X({_vhP-NeKJ*QX(MQ`QwfSLgk?;5U)wPSHOo@%^CU zB~9bzQkXoix9wflyQhci^z(ruu_pq*gLS~7rF=-~h+^YrD$kUqdGi~t2jSJkMF6lU zrx?wiDM&ib0Lv?3plaP}6^BD!fB%=G5VNw}7s|^)XDi9ZdvPL{L}R)XS8# zK#rI&93L|ib51p>YhT{DxqatWn_O#rRfLx<%!Asba`AXYgf}5mfWyU?ANt72;S(!7 zf8QHXJclt_QC^l=>++yfHcdF%49wL{fx8?F1vV!_vAVUmoLX@>-DH}@E-E{~f!eZUo(i_#v8MBX^ES4$P?XxI?s2PA| zcuM&7!9UpadU{gAzP67(ZzQqj#y$I25C08!RunudVeu)1db=I7GUfizJmiyEH5Y=i zVf0kIpx>!iY@q-%Gi%?$YEQ?F4|>1vS)~zLd^}=50*$FPR0k~HMVFu8u;>#c_4TLy zdwbTRla@EN?Js6WRg52{b?s778tZa~%hGSOafa*VYbM$*Z^M4rcr+QXp|rs9lw)Rv z$8Os1&uv?C^)->ALudC|pwL!fQr^8h_CLk`Iw8QiO3N|BTk$_I+AuT>+FW-an&e(B zstfihd6!}cHTO)MM&lx-p5BaZ|8ruth7;68FT?I}i@?*-mTUW}DJEO4FCO-iLmikZ z#Yq^VOA+aH)FLmT&zy|dMLYBI=nFn;h*aAYkZSrGIrX{UXJ=fVZ*kL}<5%6e85^=) zhvsBonOgm$1&m4Bq~VN6^PA=Be!xCIT(%<2hBAGXBWuScK{8fehUX3wk~00$0R4iJ zhDrZ>eXzIh4XX*ll=L83rt`nNZ#p0xI z^#YKyTOdEtjtWj^hiQ8sgi)bJ-rTh{BJq%hieZLNV+Hk}MQ$8KuHs2C$~UO);XU^y z^A|=#bq z1+-33Q%O^Ji0S<5hfe$#BG?5qDyXeQokOt$ZOQr^(ZSzs($x_(<|kL`Gh(PPI_S5) z$x#0CsnY3YsQxz5Vy3lzf8Drw^q~CzEG~h*jCiZQg%*=5-O4ROYgLP|;Xjf$Kz*6x z1TdFn%yvgvD@SUWT|3qTAQLuzSZU#0`bYwkAIcV+4d5%+tJrmOMpI+TG+GwMOCW7- zIYauAb~3)ezO(#@!M`k0W^af18W)3Y)vYF*`cpF02?;1UVWsSY4rM|~is)MvowX+~ zeL7FQP$-Ut1>OPo^_Ta31YCL<+fm*Ep+N78?k;P@OndU?*Oq#qbG)=fd@Q&P(WQwt z^aZ|7=lz*(Ns%Uw$Wm%<=-AkGS5!3^p+@0)b9M#w-} zu)1xKI_<#tHD@ECre=B2W%1H+u$85b$LZtu$=-MAJ zSQ72HvFh-S+dN5kL+Cz)x$uD5&<8|A z?0-WK`{+xdYZ&b3jeVw6*_2~D6lFzPD9u3I(ZS9m8h_qUm7({gz$@N~=O6KylYlm^#_0=;l>D?X-D9bgDRR%!kSLR7{ggdIWQiB?f-J7 zjmd_%tW==de^`qk{+mRZN#B+fA4P@&`9ryS_>4V9Nb!U@XTi|)S#5(4N-a=u)YZk_ zwe|^t02K4BE4S{MZumr}k@Ne5>nMIh{|YCJ0ne5qhXrgb=ihRWJ={Z=mPm%eJ?#n5 zSW*uf67bg_LgFatlgtdRk7T-cMv-Bmgh><0Pe&hEA8e`Ux;Sa&%7_KtXaeo`%hIzi zcn7S3V*{akqYU|{A_nPb9`YiO&;iqJWvG z8(=RxQs`RDJx)hA=tinR7TveGY}^9u=TQM#n8wnT0&d*+X1;LkLihc8Ymcg>Bpl+{ zdYAb29r~2v<~f&-^c~Uhun%08=ySQReuVoEK# z06x0Zt#Yc#PLw7x{RvW-2g$XCv%1vha!GT%O;KvL_^A{{y-Z;0w%e@Ph{CQ>7M=g)e!SKx&R zs6dnQw!K{ih-cv7f@ak=cUObFF9mFNct(0>z zyRm~LsioYQpQh?;HJWwU!cQrKWn^xX!Blm!o5fR)o)@wcU2)?VG&_Xx5j&4Xs`T)R zfG>an9;WkuZ!)u%TfrCe6a{u|L!wL9-*cq%AHfbV4F-tZfU7aU z4Jo(7O;M-OrNg68w^3tA_i*{9&-km^GWpz2AC6n{R>IDs*{n&u8-29^!F|t=D?muG zXX$Ds^R&`nx@rEuUCihN(Gm$<%dd`_lt{O)bj{q$K_Wq)u?`?0G$n5zT-Hp5VL3fsnwZMWxQp# z;-0m24{0!JnvUXWfr1Ui&^_RU^_>RkZ^I+oDnTEbv9H^)>oTjBV<-J^n;o-Y=jV=U z8^XcAmC>w$VT#4XcZcOCfn}bKp~y**EK=<^<(8hiOa87qg14Z;M)nB8#2Rd%1L=SUNO;Wa z3Ebk8c4qV8KTbnyfP}vs#F{Pscp%1{BR}P3>Iac8ZHjy8qvE>}wr-G0g;-ave+Xf} zf$;R#ZRGG8#CKm^lj{ zu#u$R4^AZ!>a7<4ya_wRD3m*a60aUEMcZ?O@bAmgiTB^j0?kV}iaQa7{UgL{eKXwW z18bI!(@yzCvM|32l`AR+C`QMA8drtRb3 zB?27wG)%5q(K%-W9{S@lzT9)csoAGCs(4PJ)Th9fr+UUn;lK?Rn zeoshXY~SBbg?bxu#R5#~*1MxMK|G%e%5Xcx`XO(*&zzG}Q)W6pq(_f}w~s=%@<*C4NNDd~T3HBco~njIa| zHvBd;t4fBOo_dPkp#4QIU&B_l+`hNRAyS{U54=x(IHZt)EGVb*u+^u8sgQJnTe*`QX#e&W%kGrXb8$Q*`OXVcFo<~7N4;D++=CR0f@Z1KVj7TGUd~s@&Mx?p`uiIkpPu)rj_9~G zd%Pbrbn{u)b1FRG?y!WLn_ELrIi8o}`0MgA02tr@rSFU^c)3Z$s-WmzZFFMPdHK;< zW~nm=nO|`>3gRq5256H2x)Z}np(S*L$Z#i3kQ}77M_kZ0RLcUSS`EBl8$u_`g*xFa z-BD2w-@*LgUA;n;U!kaDH8YO=t0tI#&o305x(owAEiqLijIl3MA2ZBvJc zU4>3nPiR{ekfUM5zx4q<8R(;nHx`GfQ$|d;N37kprhuHbF!kt*CAGCPLO=f`m$Fx@ z-3|u!WJUPqOodIWon~eI)2dXm*2>F|B^#Yw0?aE!$_)rW-=fzCEC}F&ex5F=@a!}k zt)_=v@k;%rB-Xsa5Ds?;d(DP`@)zfDx@K)7cRZ*&K(3f6BMZ;O#)8x)lNiZt0iO(i z*lUDaLs9p1+0c`&zDZ41c(^-7gAf>o5H2AeMW)A$t5&W7Oo&|Z{AsKy8HB)EG!|oO zEyO9)rh&aXBN(q)>HQ+nx#H6lqM!RyjTOOt@dTTwnR!vCptZ5-2fCPttF0ovqQRlN z2Xc&g*3^M&6_2Xfk@(ZcXWj8qpC3(+sogL9*+jjE7Er57gl+vEo>oPg80Q01C>~-B zJs-19hb!uQn^cW^5Soj(5$qTIH+DGU1hUr={~P*9jXRQ3+J0HF|iAV-uAgNy*VQ?X3R*E{k zZsuAP42xx*E{P`i&k=?y_+NODDFQ4nk%2nOUseOM?~S?Rzz1HU(0tnN*OBq@5$xx2!%cuR^{?(RE6a}_`S0WYYpnXN z$;Qxcz3}!s&uWeb%Q}OX$;vC z{tGkWkXrSi2;tI|Xfcps+2DC~=RL8b?IM2`u9oc62B&e$6#ill9-m`vvx5z%3@7-3 z2&y5BS3G)f_!9d?4nEn-#&Q>-hyj(4Pn9KIt%@(qb(Mv%g>@ZB$+J&NG`FQn>R#?c zm&W`*-&~-1`xktAypd2;aFp?~{%!!NX!VFzdbKj-V%8yQ;qDRls66yX>};lJh}iGn z(*&?Vy%1+M?0zT)|tXe>|QVrihNkj9=vVm>h9PFeGR;c3PE1pNgEU(y`f1qGUu zr?O;ayVDJ2+6$&m38&f$<`<{0jyYnL=KALol**y;S?Td8Ji^)sMQw{)@0IQ)CxQk$ z0}N)0uhsoom8Lm5k6gHARy`WdLxI8947x*M)562VxpW2|Myvc?+P;H)#S7eP(GQy z6^ER5P$@7X8Odf1rfAOgICM6|7^!8BkavY`NMMdYw$8?qrSL4S>up}wDzwsx9w4r% z!#Gd2f@^<3;NB z_rY$J2Nj+3Ovi_JCz{u3A1iNuU_6b`C<&6O3ia}U98t;cBgZn>3l*_4H?6Sr1C+A( zDJgpyM%kfu*5dHbn@ejk?|($O(MIRyqK+0bCB;Z9K?4J%Mv>DFEjW0EAxorU#Ay$U zU1+{%<_oz#5=*&$JpM%zw1BlKfbjzDjR;XQ9%>F|Kgp6fY!#ZRl$F0h;Ou=jJq?{@>;R4;TL`^$s9mfelH(%Fd ztu)!yiawB^fFP*3e3gp-81EgYy~1Jeki!Kc*7yhf;yLNb(NV%j3;?5jrP?$k;!|ms z@qYRd8m42_X`m7*jpDdiOBHeqVlhxWt6S48eyEx@W8Hw~CFIet;W4q(t5V06FgVC4 zNs*^cVff5&s@XDhy|c@%kr<$*DdyK6*D5A>kKGbNat|^|-~2)#8tS z{&p$KXggY_MU@E+#`rbXqbVQ=xppm{WR)%Ps{OFfSKpTSvGSf-OSY~)_;L7-znOo1 zI*oAF`x>98{z#!dMkzBD54Mg2WAyrk`Gd(!FJVRg;O_!K)3yjzBjN4$2|v?oYR#>o z2%41*s(&Fm8uK6j2Pt`f=qRCif3c8@x-Mw{)Y+-cVi)6$O5PHUqGnvtXPr#A z-_!Rb17LZZ4-&4 znbP)#e-OA{uRR6Eb$(43&e56>$NYBe+)d6g(KjiTKs3WZ5P@5ZyP1U__RByKU}*P# z`x1Y;C0jgDi*6s0WjLaJj<36StGD%IzipjJ?4Qj#TCIt{@wG*7?3+GIVqC7gmSPV{ ze8WF+cni`2E7}YHGUMfa-kcjtI{k#p&OJ;PZ2v{6C8= z7X2?uM?E_H4;K}ki;S;NSZPwP{=7biE~334nz-%uwnuD`QA}N%=8bf{T-~tB*I-2C z!j6^+eVHaCl5l+AB@>02P@b88GJ@)t&=(MmFaTNZoBDf4VQ+?|=DdEH{ zz;`J@oR8+`ET?`-P?s>|#0}f*N^oNC>#q5VE>khu&6lG9)72N@CK$?$o8Kp?GC#bA8j7Yrvx}l7Yza zf;0`sWb7g#yyC_kGOdI$6Y>Q%-#X6UC@l&L7`cy2Wy(+v$7mvzs7H*w0!-^E3gQps znQ_K`rqC%3NZO|TteCNsHU^=}1>tjL5&F$hcdm4E3qtWY$=FcXE)`91!CoGv9sqhx zl9#D#YlT z4X3^@1mBJ1s>T|Az#qAu&QI%Iw@*WD5|$b;%sA7mtnsbmZi8-Gi&2R0AHxRSSM@n~ z_8wdp=vNhelSgvU&n6XHpFs;%M!NTT2Qo%?=z#I5z%nNl4|eSx{r-jhH}|DiMi7$h zj$2jV0TSi@J<>^^95m}aA?B}*X;J`sdxZa+jA$|9I-4rT*Lc?KmSXYx1+GAsvvs9R zglPyQ^0XlJSz%@gg(gJH2tYXs$FEg$hdi%;^`L}WJV7a*XTVmVF?quDI7>qfV{?N! ztk%;#R#0Hb7Y4LJeNJn6;&L%`TE6`*Bx$zsTeXDC{4%e;^0gW*npRp45p*1L@Mr%VH#1K~q zLM`cQ(tqY;PMkFTWc!|-cyI-b9U)r^s$bdBZRj`Ukf78H7ee0_0D3roljRnu|L~$h zUDR@^1~|)X0^EU%Bf3yMTyN=XL7jXhK(32D&^x#sV;KJ6O(O$mVXUb*E7}%Rkja4m zGd3f`Fj&1a?$Z#YjL;!P9)A8puDdqw=dVBs{GLu2+DiO$BT8~Yc0 z5h2)e4U};G82LHKLyIBpoUCxU>cRG9xT|NxMZyyrmXB}bu`-SVhCSDWWwM2cX~nwp)DM~g{MTtaQ!m!i{BnUFs5gj*Vz$*PE`@yXH6pOhvR zkBP`4e%cH_ej{4@gtKwtu)?hzCL&(E(hZx1rRMQ$$_j;3AzPm>vx4)Ul`L{P-;7cj zqGAm-eGWcz>75Zhe8*6Pdn^gif%oVj(aixSAzt))(9EOV+K3td1Ajd%3Gtl%L9BmE z-QM5nGDj+zf*C9!fvQpTe6>8XURK%H33@Ku+WHWD>&5Uo*Jw9fs=umLE!8pX+ZXCq)HfnBH3VmDM;h}d0D#-(CnI4cDj}65 zs+eNsq=z=!e~%F9zqRokkN1gOAqR~>?~)({V*T~_nI?h%i{Cp~cKDak!qFM=Vpq`H zHCl!k+t8d>&MsjoB?y~z9pG8g)*IBatnutS6gAn?JV#;-r-RLl45e3&B>BH>$OHSt zlkx9G^m{i27h_>6g-%uVSX3*tlE>1MCg{jD%h_AX!ZfS<>G=;4=HL4!+}y{MW8ko#)BI#agB{&c7~%E!<}_6)*D38ye5KzC^36ZsMy@ou23k|TYyNB^k1xvN)I^3fB!go z7%NO1wp3eQFgpjcQfQ!%2YW@ zlvxv0L^l$ht&p(;kv4##BUKE5;#{nsz?mB!PEQIY{qrdjU2yUC$s6clod2PVczx-s zx(Voilgw$nKLw7pNGSu7_(X(5au?oi&CTMC^r1>LL-Wtj5sz>jqP^Eo9UN`sG7$)z zv4-&tIl!=3;vn7npuTR1Y`b4!Zl7Y?#u(%dd^BPim}9@sE^!4B%yDwp({1Ullr9I$3tEjv&{_ z#NA6pwtP=N)Kx#&@l@%?Ta=>G4icy%<-(E@60?QajJ&Loy5&SuJBc_MhR{_IX{XCE z^y8BZJI`#WnXI9N>^3!aEYq=_Kte;QiUc*LnU^1=z2%ItsROFyW*5GVqx7~a+FB&t zoM$(R{h7VjSt=j-GMN&@f9)sr|29jB3&Lv<+?*VIurYK%9$Ib_PX;pVF^dKCfVdQ; z8d%s+n}ya35`%))hLbQ%vnDdLB-35Db;Gujlr0XHira<-vLFMUi)VOVpB1lS9W8PS zw#$%7iiEy+LEBRZ)s*3oZ9DpLB-;OBuj(l{zxY_5ddFj{@(&LbKL(1#A8`;tokxcK)YMO(UC#u zM-qVSo{gknWg*tk)ebTDAUgT?n03OCpbpQH+P6)~o} zeRW~rzl4FYMS~SnjXAMi$JANJ++{Z^OB0yfpy59N50Dj#sdd`q1gjaotbP)#h*=>W zuzC;1K6f^>w#9uH!5tYvFaMQCn9p7S?dcbH(r{#2-7kSl=F(+@W@`=tuH65kxxg1- zy^~NN>QoEte2wfczTGrztK|VRj&PM40mHD$B@vzPK<3e zyVL~sI4(#QJjACcPRWr;oT;ovw8_B&D$StO>MySz+btBcCFv>UL`dYADf}c0WJ3R# z&7bv#a4HpR7v(6ZjY9AvXcJ94IZ~ml8Bn3PfSEr5YBmy;Z=me>QUU}rMQT!ki{n#{ z9|UH!D?+8YqqQ4c=8+wi&zoBssy6V=y8)h11vYcqP0GUzfe z)ei%NgSX}H1KbpDrdKeKSG2021uvjXNd^uUxRX5b0r87)L5$lDfgcmJ*qX!}%+C~Y z@wC*9EDQ*KO%cl{QiPJ4B-4E8J_XF$DFlgxu&NbMw3P_yQm`X6pH^!kVXG1T2HdtZ zcLTovx6YoA>s*`Um#fCF)f%uY^yzZ!Gosj5*&1vbnLaFHF)zjMDRbUikk+5~$L+m;D<6}8Q&T%^?ZmLJDaI(v$L|kYByf-_xR09_)Of$4fJ>%+HPWOw6Ij_k z^;+dLJQBF2=3q5NqU*uF^Gxt!2_wb55 zdL)ABoTSKb=ext zFoh^G#3+{ax7MLL4ls(`KT!b4$vAXiegU)tgbDuy!i*|=*P>=R^D~NdzCex1&a-~G z#Aw98-~45O1bv8QX$at1WY5^n%6wUuyKk4H%~VloYL3Iez-whMXl?(CO5St;kGknO z<}=mVif=@GIT}Qxb!w$qYQ!<0B$IW{($NR`O~xj9j&_2{ArV^$zX|MNM7RXGUN5U%+Be>x50Ck3Xe+bWt@Atm1zHe zS&Q8FW$d-xJ}EUDT%UQAvzf`5laR{d);%r+;iq+6KM@ONcCz2}2OmfmPoS5kzLx7K z@*}pfG2`Uq4~C;Kk;n|avEoan-jiD1pd@@jo@~PMy%7={`b;B%-S8zZPSa3?7k_m2 z{)vWm0<^LEN#MX}kRx@mf*?bFzsh%H%ygW__ZZinfW$@+X$})`yrUaK{$M|Xadi3w zH&X~HMLT44l!uHWBS_QC&*S~T=(`AbkNXx5MTz`Z4g6Qx2`u{Db6F;xuZNEtM>9H( zj9{Fd(%O~XVliVO{$>3AH4Nb1Qnga(&6N`CXe9ba_6i}u{V-v7!8AX=;@dPdZvrC+ zm{YZIZEbDcdB8&Zwy_ngs_>x_hRf7oF3OUUr2&aZ+vdbR$BMbR=w6fIwf zq{~DU@9B&)5Y;q36p04DuN52nqoF)wm&!Gs*0Kr|`kJT_`WoDSTJkY?M3RwH`-cEs zLn_pt3`p~T_l{322F~b-1eBfY4v&szrG{ll#$l&G5v~&jBgaCy#KdC!SE(6dm5fwa z<+5Y@hPP-@J#HpumO7AE2tGBieqBR}jO37LrR!~o7NZouLT&UA=Hlayd;y5F3p6yD z^_8%2O|SAtmXQyB)5if85sJ$b1sBrl;Ku?RMxi+ zO+S#J@n}Swb)?`<#3pu$0uq5zJa=OIrm9%?S6lDQ9&l0kohlleedf8}tmC2n5XF^UtWO+25kCQ5B2tqIY zo=Bn@WOY$~ZP?C2a3+%=lXr8AQ!^}BYWxo&(s-j zv<27R%gZL_8mvkqie;)>OJS?1FyJe9Lh?PE@rfK!R29fIx@&_W_?Oy-Prbozi|pWB zgaphaLx4Ka_(P!XNFVkVKhF@~LZxoXQc~bE$uWhDytN!F0bt}M$4MzG6c1&k2plm6 zkWKfeJp_y^f%;b27A}8w(SUWwC#Cf`>ayd~O#%vd_(f4%TZ$?>!{Zqx!AUau(L7(9pENE}W{w z6>CFoHv@re4r$Gq#c5}R}uGhW2l{b`-k9oP}tA7nlY_fV^Y zm&xdy%pu=RoVt)h`}_QEzl^D`-LT&GGQPHx`CNCAD2{M^{##a3>0SQvk{;vGk{C(c z&{E>FOfe#X#5XHqI=WZ{;2_ZPk);1S43zz@TuOttLbkUJPEKEU7f;AS43bB1T-%@h z`>@DhkpkQq(#470wZIn!{`*UG;IAvg-mIwRu-jX4c}GvUg&&!RZaW98>W2<&G~o=G zY&Mmu$t8H}J!sD)hY9uOvT7%@ zpO4LJe{Ds~l&6h>lQ;~3p~oiD&(_4T@K75(qe0t&Bksu}?L|{& z2ZAa`fJHiPeOH+1g*n!CO(k~Il>~I-wRJ8HAvJqd#Ps2{_O|$5Q|az{Mahk2t`05V zk)V~ke6Om4wLFhGoKn9yOyy|nQ1`t=#B1{jb#4fhEQs#Y^Nw!2fi17Y_r;ve3IyEl zi83Gd@!XELFmR)B4=<0LL_F>Bnm8^ToV@}#9uCoN?_acaw7`@P&vJF@y=+B1FUi{O zM$GI{a>7fzn1_3j+)5ab*D=7o#9y)ah}b9XJw-VMMUyd8is8VRSdmZ}$oTfy(dh(4 z#Qhx6-yU6tscjn@v(kIHUZp>nUK4ZW{z@0b# zzao5f_V8ef2vU?{>I8Ttpelx77aTdv9~ zh5WWN(Ei_*n&q)^!c;CtIx!w9fm2^sy$|g98YoWL7xY>OW6qM%p4q*;{jO7+gY;#{S#s$b*e51+$1a zM>KU9d;_9Dch49#U8^m{9;&$vidOxkoOVV4%y?V`rhCyE&u6z6Z78j59Lfbf28L8b zlzq`S#1|=w-?jU51zkUc_F*aZLY#%Ep0%)_xHQro^Hz9`Z0wv}pT)=6MTgvh1Pl>@ zVC58_s^W}}vfpA6TCMfkdEPERPr6pP`2FCEB5vOV1&k<6Emik7X z91Pi^Ihp~{uU7CC<^mg0Jq?J-vh?6(!87FYIZz$WsfYU3$L_oNzVzRTpU!O(EPO3} z%tZ%pUkojy&9NaS$Yq}%z5igHvU5wHh1OlkF-K_U0 z74XfmpJQW%-93cU&xx<^Qn~Yf5?i8x*$uy>xw>{2%~)hFH;7)-cf;Qcn$Huq?f6r+dclokK=tp&jXSKOZw)0dfKJ?`)2|N2)x{P7&e2NS? zxL~(q^mOe_x7l}t{Wca@A5;lv#h>|pX>W1wzf~6ZYSlg(7rqK@Xzlgl?@H@}<5!-& zS@Drrdd7Lom?{EKKH~)m{%J3_faWsMWw2*2+c3%v5v)E5uzku)YR1`*>oY=%9(;RP zUxFS4?aw3N{PU4B^(^#K)KHVGXo$!$g{X2s0FnL0r=x_}4rZv&(`Y3;hx{p85*&0v zq930}XhDaN-Jc!id>ytkYvyL8)a5iiZxMQ+_(>JC&9zV1c?`5Q77Z6&y1PBr!8Fz7 zN-GYH_z|Huas`}Qr=hZe=tQV>FiIo<(o4kiJ0F<%IRp= zcrs!jq=(Z~4!8y6$By|F1S*xX7{6bjIqeY&N^tQQyi@HDjO{~cT8@yfEp(>(Vav-! z`8x5Uf?1cPZ9eAQ-mys*${!Opn~miu8rsdRzxg7_`o-hsa>Ym!vC({`w+fG^@VTfC z;bP>$}IlMyBD88`y(d*2JXxKgj*I+K>;UL2kdAW^n@gkbFn>Qbi} zZZ0Kpn%4+Sq^-dx%PZVggwxG$D<%E7}m6cnv7@ED++ieze zT)nl`T=5l}ha-dxaZi63aJR`_?5|%fy`p>?2_>>3bJp@bz4cYNC-P6l@w6u&HK^8F zA*C~OLBq$WS23@iu&&Xc$PAr|2U}q#d+& zULCy>@w_79xZoQP|G0P12AZdvw&Gnm?F7dBeoc$^zPWlxxP6KEVhaN4W+OT^d{}w% z9ICr#3NGqlrWoPR0n>b%5TLyA@H(3xJG`~0;c%s1JJ=WRo*`9B;HE}SW1z%r5T4em zI5|aV1sRqSmY+-(TpTLnxn>F0WQ&@j6&dry;nYXKMXE{r4li4_M&~H~Vr@bYFOZH$ zA@-##s#Z8@K@^vrn%!oJom=y{k>w+-UtN^PXP&S#c2mGx{nDol)fi_F9hZEBKC znKHZ-l10f<4CEaq`)@6Z)!2#N5c(FvnWhzmqB1~*rlmo#Gq`m_{?a1R35v|YZgkPN zCYbQIy4$t6X|LKXTK$G--u!C*n98T(O2(xkW?tK2$eXJ{JnxhuO-CXHPL*ZGml5-2 zs$C~YQGJ`BOq(7FNgc?UizR*Ib@{H)YVKgkJm|l&X=m*;e)%IIzG#Ly#_Z?YHs7xHvQC3vQdpHJ9(i; z{;D4ajlR+X`92@4IafBvP(Z&T%4)y!^U{Ode~x|11hLC!%dbg&`)0$4Nt_LisqFr2 zOXtCi`rnmbjQI0}|o)mgA4 zi2@v}7WViFKK~pyG$54lamnQcUBP1iw2hAVJI$ys^@)q2x7Cx0 zJ7+Ps81X%DlP%_-pBobS;O8}d zi?8G1b{l)Lo%{LA8)wz2`x2UUj;=2r7F7nr=2PKIg$HQt<>;$64NXEmqw-<#b&k@g zz~vKk>&9q*5XPM_?S?(Ky_w(6NI7BpXnE6wEXQM*GxY5wBJapSlB<2Dx)@VWY}sk=HjZ zo>q174IFY}vbNDmPTKO&TH=2n?(%4O)2I_>;z;&7KUqnZ47*7_sn{HkL1UOfffRC# z_)c*8$b(B#C`Fn%QL09Rcqo$dvrbe=Sw-6G#L=+gJQ9YSGTSy-iiVF+Y6MMBO`%yN z+%gL8@1P|gxE^rPz3QDd_3GeTemd} zqE7}vPz000Qd28GgL2%ceQb{CQG>}}_+ighPtX!+npNpS%*VrW)lsECedsn)LJnk~ zZNWF@PC|FrVbmF5ak!C3Aux{^lN2Ef99olAl{XMd4c2i5CUgPQiZEhcMsx)tAw#$> z1F2QN*tEhn#yTB;$nmcDae<_0$$|#{NEf|rN`Hku$M6XI+S+w;=NqAU%s0HL*)x0k zoS)>}ZOcBVC>cMm;(_-MTRyw^RGw%7nFE*BC-!%2!Bx@|XRD~Ao|ECh7)cx%XUaKK zloBA~5pV(?2VegACEFMIf$So`v6A-~w3ACYXGQEa_-6T%zdO0mArHgcgmB^qf~509 zuj+&EP6$PoMg4ackV~flW@pq?sH33^W=-eE;d6toS^N~Y>)lqm>DFtXU2$QVaT^JN zL}=BrRR6vNH--OIC-!0y2}2VO8jM0?EV$jhc|0v+WqT7ZOL#`Y(<1~8kES!eU(&q^ zj7WcO4G~cpe$pp9h5XXNKsLb7ItOjS@9){d(-90fW9g zZQLShMAIq+u^1$hDwL!iA+;)mG&Pn{rBQv}`EF`wB7|}*-6Pnn73o_;PAn$$uq&9` zrJ)@8$Bu)u_Vtsl{p#Fl^QAKPn`GsXdc__UtC}~XdHQv8u}XcbFHKi4&_GxyAdKJ@ z$EG*m`267L>}_Zyxuhxj1V+q_PVBYnA-~0jrMoQYZ`Tf%PidI{V2kK8d%D2gx@f1I-|KdkjS1u2cW$An= z!-kn@OM8}Quxeh&_gM=E53em{0S|QWJUXxhe-K@xWVZ>F_r0TG${CWyqJ71SIwH5f zQIz!d)^_BS4~<>X?e0>o9^E@NdtH+~_vAR7dJ%JYy9LS}xO7?68a?Avvuk-ivqSvrjNmv} zr1vD%R&RRf+4M3sW>c@@N1i)P#Wq1YkE#W$vWcR^mG5&Zg+J}`waY6A$oVxHbv|>p z+St+G03RrQI+pxNFKynI7wj#sbB=~>m1?TLOl; zUpYbAN+=Z~fcV)kbaB4dVDiW?i229UeBE{)EDSn+1wj7IAVgQBzZ+LTP{#$M)64g3 zH~wQTuo?WAonkELq_W70ilaHom%z0S0(U*jHJP)gwwINzEK1Z_s(Ws{r>u>xqL=o} zs<=WX1!oZhy%;y%PcE8bEiP@jV1kXc9+Nb*I{)~#EpCx-H)ckH)VXi_AzJL+vm-7k(p*Xw257X6k@ zUnC^mRq)>OT{oal>rv{sV@Dgl)0~@sf%cbrqFrazP z`aL<*`Z0Husa>dK0a9ikE^IRL1VZH%&HA>3thx4GH-sz5OLoEYnrO)w?oy0?1&_6{ z<+-9vQ-Z8<(J&)XP=e>N|3#Af=4jHZwr;)P2di77-OP2`lY?;zHM`Al@%k!!0(|j+ zRe{Dugx=gZ$7-{h)?Uq@f+>U4KWCO}3AIK@2PO7C>DEO!<^}zF|85u<_v$X1Fs+#I zVR&;8q;+SD1~()RhT@-@BCT(awC^12uXuc{!garPpo3jrhc?lFi0ZK-k62k)m+B;x z%w3RZdIuYzkr2p`8l{mDS%G!!1&#jko3h7^KSv%rQ|f-}kk;%K9@s^gyyud(t;m^{ z*}fjbQod@=t9l)i8tHK;FwD8-d??WJJ%v(0R4hR01k<)6ZN{qWq)Tcx(1KN6WI@5_ zgRxVPM+?1Jrr9AXl#Jt&oZdL~arby5&Sa1r@m~3^(I7rR?gvknS0xX9<(%F$rn4ZI zr^#_A%CZvp4Z)?DKg%!^NGafkW+-*6;?R+tbp8Q-iffkUrj}x)kkMo%Jo3z*%Isk5 z2FFKZxWCMqBO#bAjc{Z#u5$10;+n-qrEC-G>bM7|`Mh}RkW@Gpu1_D~%o;7v7^=_f z|FvFR$EVqIw{kCrQqF~T<0E?|QD+TNfDl1IBhi=@pO!wuM$Mva_VNLk{8%z~f>x&} z;=(Rkw>ZqDE~XfQu8@r!pN$IgZ-s%{K`vU z{>A#*2Bl;S`Ew5lJA3p5wat+J<&62XRpIng4V7vD#d!t%3o<*AJD0|SjCK>|2x)GxF;}GVa1^vD z0$TDUMh1OlTdd@sR-0P5aeWV8;C%Wu5YXO*{G;2xf5{yWhp2MWY4hg(R5EPvk@{3N zGicE^V4R=ksKxd<`E`MUXR)&Ya={R+!#pRl$-PC>h%42AnNE&6Hfjg%Ve+&zFZ2gf znFtE=pR}<}g(Ql~47lY-Vbm?{gd_+Ft6hi}feFt9h*F6rq!K4x-bDcbV5=6I zHo1TpO=HzB% zG*_3No2eS+G)%%1*=M9!U=%59#45ffc7T2*X1b0*kp1M-cEAsp&!Ebd#}_AsV$0wX zQXFCBJln97i8E(VF|#gJIst9B=oy{4$QJd*80o=qcA*(&e__qfmgXY*DT#P^?xpBe zcdT4mL|ysy_(8(mB&wOCV4zsGFFuT0$Ayz6hJ65wV5ynTsf7TZNRTPkqD0CL zBb?JlK!_ooK9Q<#0r0Fr@-F-Bd7W>2m7Q2%$5+YHuGQiGf??|uw_p42gX62zIT zcKphzf7?dr#jsKrqqJKif4|2cP$k;)!NYM^9o>vg+#&~ty)f5DY{3c^5* z9c-bli~&`q|N9qT)lOf!o{Qb9zovLth2wF14LAZ?BPeS!fSB^AS?A@~_ z=U1zAX=8_(yqm6UNZlOWg39rf4Q4)o&fT*F7yDY)v9?N3=?xvour-@SL<2gUQHy(m zq&^_^Gi4FOs-?VkzO1yizH9-}<3!(mpa zUTm(-_oi5NeEWQyb<@GeE66-Q2yPkX@~)(KO4d%K!;!lyYhL#5TgbG2P_ZS#wligV z2bp(838i$)ylt3})u786YM@=y&r8*~J;cO)XoA+?G_h;c%kB|X!F0P1jmWB>GLj4? z-}$*{RtgT}f?#bH|B|vj2#n?kN%F9*bAU?|>^P2(ga5zooQkUt>vD zX>*AT929F4`1d@T(xSX>B@L5?T0GFktpO8$RhSbKu7EbZyH!vXVDBt9+($(e?#??e zTCs~cG({0VfLvopk>`OF0n~m>QPPjJhuc2bijmXCM?yY+=w1w!DVJl{%$XtFNf}LO z+~9T{0VU}#*Th7Z(do4+X7;nrYI#>+HX3(EDbYtQqfT%ki2yrqzH8luzAK}OH^71QV$gWDYfJvTY> ztZ^R_xcp3~RPe$9eU7hs@`^fK^9*cMjBR+9Lc9g8wx&roRICnlYfYRB_ z%Ed_&d_epmhW+uGetU2 z%#;tk%t*^yuP~LVMS~|TyQ*M%p&z~dVap=KlNs4ld*IBlwbNaqF&E`GMXD>rhF6zx zE?uuPKHWW$-rPRDFb`_|%|k?CVMDF%b5XBL9BR=^ROO7;cJaG&r`z+Hw%$9mi;9yq z?2&WOls4Ig*bR=@Ll@Gn*s}i|Jox?;!$q0T?MOmolXUFJ@BuyM{(i>oXqQQMx5aOI zUpnVklXoys?g_eW%20A$Emv|NGG9G#{+K4ybU8TPuJ>o>a?k-qxiAb#4=e09HhhT) z&G45|ocbtg^e)a;@VID&?rQh@zPR$RwjX*OZ!-eg$mS9Lr9d|Xm+CcEw@x!e5AY%O z`=ygL!nAH7wQLcR+{gl6}BHVN3!?xMrz;@msQN4b^RSW5LWY znmZwqVib=S{=r04g%mmpII7Sdf8%0@8lK@I4K@ffIALb(wd@_kE-u8Hge5?i16Nt; zXk;=8dW!vB6Pt5;%-+pDWUTcT(TsHSd&b`S=^D023%+g)%9yL3A&?YLO+UF)!bj`7 z;S>--cUyD=2Mzo_?=;|%vf~7=I76S)|2R03fDGedp7%qhfuzRBn9;R_8+02 zu?g;5?;UCpO$$HMI^7)KVqb9qra;YQiOz&OGSqK0dVy8=L*oObc11jKOC@98&=>8x zKR3chzSD&>E*{;t&QgmL;Nz9xJ|EU(W0j@i)kL!Xf)x~qKo+TK9!ZiQygsiU3aWgm z9U;EaGl*Ug29EC15jp;7FoJy;RTVaNtCQ^HUA+S_wlY$MVe$4l(H~3Ehtnl_yRC_W z?WN4SD~o=BRy&{QH3|btP!YtsXa8+(Ynj;tS=PjmIon{{3y_)FW@u3L_=iaQP#XKpWSSVc6+BrG#x)4X z-M-!vbv+oV!u-kHZr%^2058%xHEZs4eW4W0)fA>&ZEP6CfhB)nm?6}SQb4FhqGh7j zSwy;NQCcq{?x0+RO&D|mw`$U5539? z`V4j6w9`zr7VNdJYlGuV=!@ZROPXM6O}Rgx?Ief8H_oetso)K)znv;tae9;19{! zb zN)cUmqUK7`4kdi;2CblD)2@ylLEw(y)MPeY^JcNNoaYsETS8J^C{IpDxt|RgVE_iKjKXz zT!YOwzn@)ji7y?XR<1Ol{!M_&2jEI5uT0!L#~%5Xxuw{r0Q${te?(Zug#Qr4hyDrF zR#L(1cIQY*U%w+aN2f2E($Ud}WumpIqJr+5rW>dqUR>-vs&q=qrdcB8j1(E(m2{hF z`~05Mp$E^S05OWFe#Ag9JxiB8mvt#dAurU{&hJY-6}GL=x6*`40go&6i-Sej+?rJR ze9!xq$RTa=^!(k?+#F|QZMIOMaKTv}_Mg9`A~oGrQ*}%{bJ55`ao+&NT{E?naXvqu}XRUb5m{E5qq>}^LXL6B%QGgb7o%cFS;CK^$eFn378`D_%{LVcp_w%5CV?yyPeb_&-GzKWt};plkKX$o-S54v?rj z^ZRCT^)m{`6iUk|5{5~C$6r;;G&$Z=5)InYRTGkRQ_v!9+2X}6bIu+&kvFoMWUn_B zF4%gsajz8K3sPyZ05ds>RG2@%VcpE0u>^V{dpy1szL>xDr>FV6!$)$0;gJirT;tIy z*2|u;V7`;VeZJ5@Yn%!|VF1!DVteAye{yh^ot$TS#O0>{7Vq5~cG8xHo2nC|otAl$ zkgGQ;>pF1q-|w*EfRh9Dzd2lpl&vrX)DL9Oc84z>u`;7QO-AbdFJnEMNBj(t@{j-f zNyy`uG5`l0P>!ujQR`+Zv$0Ii_V?O_PvPq z1Kjp)N7{_YuDx?Qg4bY(54IFLn^KG`kQm}Ckh~coU765waB0K~?1_YCM*`C4fyhjx z!6v#V$9Lar#D~k98@I+PwA96rp|7MQ zUEpDUQT9l+;=E>FV z`2naL{MoDE?4Pn=(jCWWTa; zDoswuk~9SL>~ua2r%f5k)ffgpb!y+Kp?hD5Igm<6c-FZWlciZow~Lkg)-FqzCHoC) z=$It&wj#w=x$yD z!ra-PUrAc=c5UDph&`nRMYaFI?pWvTB6TtP!L|l8hm>lDOzm}KsG-4TkdkyFHi3rv zmgm6@pvt%WxWyyvYa#dj;aQC94o{EP;8@8z4%!TB0zNe`b+m%|KhBTQRFA~HS}=aB z3(gNFzR2dz>i8!Qg!<1@n#OZMbx9*lpL#8!FRZD#=KIe9NoIPd@q*m!W=~HrafLKd zq6hWN32vt(*Xwea@E1QG%7A$j^6rbjs*=a@&1-~{ z6*t%Jv0HR$2pw4F+e>?5=DfH&>;<~L8bC2{d7K%bplt5ilsuB8QT91m={Z?c$l8&j z{4#R!6d%c&PusE#e;kxIw!>Mh$C$TMV>q*4DDehTv74YS5r;Q;<`Eos85zTHoBF>b zUy}w~&<2|u7zv;uMgS2Z5I{_`v;{p<=P{O-e4UmSJ1Q=eJdKt{0KJ&2SKUHWKG!g8 zXz%$ku=`D)LT&%&WI(uBlZN!@U0b}`{$isl^6c)#e|G?no9Ds*FOU)JZ(%n9t*6Qj zKDcU^+p&wpsu#I5>I^3x{GoZJYr|Zw_};8So4LRSV@|&NLZ3fHpMQNB@NuX5ch0-K zgn)XQ%**EIxhi<2OX%rpugIyuDFcQTnz;$eUDjL>Ek+idU~D;~II!jj>KApBuem7N z@5{#joO6B|{hl_)MHMrCaNdKrMmgevldXZBd$g0?h(1Tp5J;VaKtnJ<`B@}h`hVV$ zQ*sy$`%Moywj)_~EDeMD6Z|%+awR^2A0IeVIDjApNqr63aDuuzpvO<5v@D`FT_Nfg z;KMu_X4%w`J0;z2@r{3wYeWidjgI0Ux*IrL+viVaPi`-iCB}{zv}l6$hPw=2&=Q=9H|G$Cs>U+$P269I%DVm&|0M7^fb1etM$`1Tcg9=SL{6xdwGSUg|H7CRwEx)>| zfX>R%^OcI7BSUqpzzM%tkVNM5CsiXrIYm^Y-W5-?6qTZw6t(IDIwfp~E)^zHqgP0z z&zlY*JJ01=E%JGkA^lZ61d1#Q?w)Z{;>L~vIG89_saK^;O$Gm8(z-%AS2IX_MY3f| zwjo)HE+t^nBxJ-;qC%tdeV)HHoxkEa0iVkB`dPLL2Ud1O*4tt*)9;?Qy>UFg@ZwrrT;L%<@SXzv_HQtMt9QU=fwWGEzKj+r6K)$jfm;EVq?ij-e}DVGf^n$-|G^KoP8#fH z=0B~-A{hqnwvQ=J<|u&yXi;i}$De|(zLuY&Bn>20G@_~%Kbu}V_h^CEXh`$xU5|2V zMO;y`e2}2s`P6TL1(;7`?#bemy1XKX8?ez8Y4h1n?HGtqM3~5K;h=5R%6$3g+((#) z^{IyP&yGiwX>qVx9b_=frd8)Y8jxyFHr#5Ls+1GO4sUR#vvoUJr&4uI(wR?NJdK6P?hXvBwcrnts=G zF!-o1L@aJyL{FEEPEdp{VoPI9LaLC+%n-<~&5xBc$NJ?Xla`HYB{06%C#dTsJrWoh zg8%g`xpbi9R}L)s0-$|M3^r;m!5i0OLI+HJ^MjP)cUV)eD^YDrV{dATmXtk#+VUVC zk!gzoH5Eq8D-mpxrwg{ih7;&?6-15=*x`mAU_A*9kr=}wW@%gOq{(oe2)r6cj7?b{ zR$Xx~1}Z>@N0$&um-rIGSj)xYQ@^;@5R&^6{BbwfcRtqWUUzEnP+$aI4!SkUc>I4( zKo%@?61BK1vTO1k<#C4NidZG{B-Nzci9ECzHTd3SZ(1!?bs;aWL#7siLV6=C zASM8MYaXQ5UpT+s>Ba9iW!vdL%IuTSH9JYsErO(YBR8Je8qibJwb~FXTOe7YEWg-_ z;sT?ZyxKia1kVRpx2KQlby_z_(C@TzbSMA7dx516rMjp{5uF*uXg%RKDgM7f6 z9d3wWiX@Y80(CfI3DgI=3aTt3VCQ-E^QpSVXrFvvfW43?I+_$`GR}7$uP8#WuTm;0 zDF<%WM|TjW>`KL4LayT+lp@`OBs&(*Y?IW!elb)IBGAMM(fYUu~C|nC}7D@ZhVsnx+Nn(B*jdE|KqouNF3pej858#yQb#-!kDu?)n(>>ol@!S62)LL1->4d! z6g30^9lLO4GTBV^u5*2c8gJZGkxZ7)yowA#Qq1RZ&`Z!8*q7@*-QhExWXhiu{2f6q zyN>U1#(P}Df{kXBKtS#cGs+uTFy`*Ct|b~ON$5M7Qxp^x)?-avZI3Z8KvOY(UVtJh(Iz!?FKxtRo=-(>8e;rzG&8*M+3~$}nH1olEc?Pl zM$|DiuaK?VLv}r^o_I{|XA8m3>Od8njMwLaH6EdK4!h@||B-%Wa+ed!*Rs(8Ku+vY zz?9wY?Y4nmC$5|@n0Vv6boN*h5O)QHEqp}vcrhY2%*rN%lOd0Jj?~}0p8%8cuj&l{ zZw&swa1eJe@oN>inxiz5gC4GImUdi&wjqBeQxbj243@Jd&gpemQ*dhw6&~8wDe5wL zk3{si{e^tSx0a?B7VgZ~i7bkG90+jBi8;eE?XbpHU4sVAurXLDBTG5d`(*rHkySW# zB(d1wVJoyPnYLVk*fqgs$K__(Huct5jLJYHg;~9U{r5XXIC0^icI8y)*lwYCyFG79 zx&->1+CRLCTXh6Ns6z@HdgUyHL$qU~`bx&+CsKiUXbPyo^ch}VR|wFz`L-xhn*o*) zTifFnlrah6COvD_GkQcG{aR_*%&5B=yfG=0 zfMr0rn{Mzhg#vWZG6dox>XHTwaDM6#S<7Y=$(Q4t+Z(rv;@qX_+W)w=tBMAjc+xh8 zmVQJzJ-I0`ou>aFkF>bWlxBF%qr#9pXehefXq68;#|4<%P$u^8_wU=KmE>Z4x0G z+rxYWm+KBa&MO|V4&L88KiB!}e^esW@z4HhBY-SkkX05bft%^;C$6-#3<*0Y+O3)n zeb=t1(JX=eW`qv2*s?)^w)MLPmn{w(Sc0s-Atv;wfgn2AR8&L+)>e!UUeqXZZvXa4 z5@)^6czWszC)vu$^$KRaLn2p%5_uMBC}!A`byTK%hnqhn*M_JXU9TKX09oSDk2c(WBwg~95Z zK{~zxJgEq{O|l|#U_Vn9Kp;-fLdD8tuN5VNsNTZdWi9~YAnVol5eAx~0D=ji9Ofyf zi=UbD%-vi2>+WEtKiVg~6x^HJx!}|*<;skV9Ws4W^nxqBUj=6a9la9g7vf0qH#c#u zEoUvpgya4`8~Yn5BdHbouZ7UfS7g{|g`bD&Ezf%zdvl_}ze*YY)Cm1*K|oEfEfk0C z+viwM0tH4p0okU-4(kQNNx8Kn^oS!xYdyjSFN8%~()ShVBc`P51IVSe%7Veac6jZd zWdweOWGGi?_vnwy6s5^kxa2L+#Do|&l?Mfpa3vqkdhGr0F|&N?Y+a;&VSru8jUQ3!2g@Q{63GL6%eiiX~*O`9CVr+f9G~>5;({dZhsL zocwLi6FH9fb~@7g7^CQj>i<8K7B|&?EJk$yoAYD7R17 z7t>o(x)Li(tgMo?sMeAc^km&2r!^F zY>eFlq#mzBfaGV;UTyM-EH^Bc3#^zoM4uBU5VHQ%f#L$qoKH(3({j-TtL2_-=9LP2 zYRK}Y9REA%XIiqp<8r)CVUD@}bMn(KdLA<+kxmnSjH-@M^KpMw_Lx=U=%eou*|CiS z@;{gNnb%%WoPsbfRVydeWLF$-R7z{Qo5ijN4?na!GQs2s=6^iZAD}VK>Gb+3 z$4nr}{O)=bWET{>_peC%`#U90Tx5{JsfT`DvH=%G)>LM$24Uy>F$k!-!`iizFtXF4 z3PLhwC`Ls`joH3)P8&CnqcPlR>D>9XikAAEj^tI&6nW@HL%0NExMLCWWD#YGWQ4v@ z7-1j^e*rPRFS1ZPA-nREs%^!eP8dmdh>|x5qoaKGL)q2b78TT3%}Pka{LjCob9pS{ zvYJvELNT8Qa{Y+rRJeK-)S}c498w#8WWo=|lS~3>F4`pF8gEwmFKD0ICn?Clok${3 z9r$z?M*+qa^7pL+beX+h)>xEIAii!36>b$V>O6`fi70Ng9@I!Em?xogU=-iyZpJt8 zT{`hQ_n$1}!II^{qicSPCjPocfg>CKM;lDoYR}7lIo?hZlt3GECK8fu16(dZ&()sl zrdv8({&^|_{M_!ZzS3xsG|{3M5qhig^aofJS`k|~A7S?Y%zxg)d+-0VRUH<*b5KF( zCvXp@-W)O69H&3WoJ5+V*cUn7*`sItjj!zE&F0@0hL#VCtqay&b;{nj*!pRq=%>7t z$GMi**2R@G?Z4mrtYw@32{Y&bLxldb43l*e)?U51e*480*Cyyc7wA@f@UddT`Y9JA z{Q|w8Kip10; zpJ4P(S&UP8?*5-Oz=eh4;3k0dnXkUzl{WpoQKWhM;9bA^?x#hHMy^|91cFR|`R!iV zI$_n*SI8WvhJBnb z)39GHW#d(`+gtZl+O_QAuhc5tS@rs`8^=v6NOQ%?#NMRIzRBes|VV!+jB?qdEWXK@VG(ybGL%JT?as`lIA;U6qKWn z+k)2~%?2&&6|n#oQ7t)2csgmLijljlLpL-|tOxFko>9L1Zr)0X1qBXE)j~ znJ3+wTea6N%WU@IpEY*7_U%gp%>uOD?D(_l_S=8PZnjP(k|2RZGnF6d|Lrfw=59Ky SW4w?72s~Z=T-G@yGywo=u<@z@ literal 0 HcmV?d00001 diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md new file mode 100644 index 0000000000..1ff0c69942 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -0,0 +1,40 @@ +--- +title: All devices report—historical +description: Provides a visual representation of the update status trend for all devices over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# All devices report—historical + +The historical All devices report provides a visual representation of the update status trend for all devices over the last 90 days. + +**To view the historical All devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **All devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: + +> [!TIP] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md new file mode 100644 index 0000000000..dd3286efc7 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md @@ -0,0 +1,56 @@ +--- +title: All devices report +description: Provides a per device view of the current update status for all Windows Autopatch enrolled devices. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# All devices report + +The All devices report provides a per device view of the current update status for all Windows Autopatch enrolled devices. + +**To view the All devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **All devices report**. + +:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-report.png"::: + +> [!NOTE] +> The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. + +## Report information + +The following information is available in the All devices report: + +| Column name | Description | +| ----- | ----- | +| Device name | The name of the device. | +| Azure Active Directory (AD) device ID | The current Azure AD recorded device ID for the device. | +| Serial number | The current Intune recorded serial number for the device. | +| Deployment ring | The currently assigned Windows Autopatch deployment ring for the device. | +| Update status | The current update status for the device (see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses)). | +| Update sub status | The current update sub status for the device (see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses)) | +| OS version | The current version of Windows installed on the device. | +| OS revision | The current revision of Windows installed on the device. | +| Intune last check in time | The last time the device checked in to Intune. | + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Search | Use to search by device name, Azure AD device ID or serial number | +| Sort | Select the **column headings** to sort the report data in ascending and descending order. | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate report**. | diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md new file mode 100644 index 0000000000..31970aad9f --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md @@ -0,0 +1,40 @@ +--- +title: Eligible devices report—historical +description: Provides a visual representation of the update status trend for all eligible devices to receive quality updates over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Eligible devices report—historical + +The historical Eligible devices report provides a visual representation of the update status trend for all eligible devices to receive quality updates over the last 90 days. + +**To view the historical Eligible devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **Eligible devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: + +> [!NOTE] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md new file mode 100644 index 0000000000..a0d5691f1c --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md @@ -0,0 +1,43 @@ +--- +title: Ineligible devices report—historical +description: Provides a visual representation of why devices have been ineligible to receive quality updates over the last 90 days. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Ineligible devices report—historical + +The historical Ineligible devices report provides a visual representation of why devices have been ineligible to receive quality updates over the last 90 days. + +> [!NOTE] +> Devices must have at least six hours of usage, with at least two hours being continuous. You may see an increase in the number of ineligible devices when the widget refreshes every second Tuesday of each month. + +**To view the historical Ineligible devices report:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. +1. Select the **Reports** tab. +1. Select **Ineligible devices report—historical**. + +:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: + +> [!NOTE] +> This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. + +## Report options + +The following options are available: + +| Option | Description | +| ----- | ----- | +| Export | Select **Export devices** at the top of the page to export data from this report into a CSV file. | +| Filter | Select either the **Update status** or **Deployment rings** filters at the top of the report to filter the results. Then, select **Generate trend**. | + +For a description of the displayed device status trends, see [Windows quality update statuses](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md new file mode 100644 index 0000000000..91b8c2d547 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -0,0 +1,110 @@ +--- +title: Windows quality update reports +description: This article details the types of reports available and info about update device eligibility, device update health, device update trends in Windows Autopatch +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Windows quality update reports + +The Windows quality update reports provide you information about: + +- Quality update device eligibility +- Device update health +- Device update trends + +Together, these reports provide insight into the quality update state and compliance of Windows devices that are enrolled into Windows Autopatch. + +The report types are organized into the following focus areas: + +| Focus area | Description | +| ----- | ----- | +| Operational detail |

| +| Device trends |
  • [All devices report – historical](windows-autopatch-wqu-all-devices-historical-report.md): Provides the update status trend of all devices over the last 90 days.
  • [Eligible devices report – historical](windows-autopatch-wqu-eligible-devices-historical-report.md): Provides the update status trend of all eligible devices to receive quality updates over the last 90 days.
  • [Ineligible devices report – historical](windows-autopatch-wqu-ineligible-devices-historical-report.md): Provides a trending view of why ineligible devices haven’t received quality updates over the last 90 days.
| + +## Who can access the reports? + +Users with the following permissions can access the reports: + +- Global Administrator +- Intune Service Administrator +- Administrators assigned to an Intune role with read permissions + +## About data latency + +The data source for these reports is the [Windows diagnostic data](../references/windows-autopatch-privacy.md#microsoft-windows-1011-diagnostic-data). The data typically uploads from enrolled devices once per day. Then, the data is processed in batches before being made available in Windows Autopatch. The maximum end-to-end latency is approximately 24 hours. + +## Windows quality update statuses + +The following statuses are used throughout the Windows Autopatch reporting suite to describe the quality update status for devices: + +- [Healthy devices](#healthy-devices) +- [Not Up to Date (Microsoft Action)](#not-up-to-date-microsoft-action) +- [Ineligible Devices (Customer Action)](#ineligible-devices-customer-action) + +Each status has its own set of sub statuses to further describe the status. + +### Healthy devices + +Healthy Devices are devices that meet all of the following prerequisites: + +- [Prerequisites](../prepare/windows-autopatch-prerequisites.md) +- [Prerequisites for device registration](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) +- [Windows quality update device eligibility](../operate/windows-autopatch-wqu-overview.md#device-eligibility) + +> [!NOTE] +> Healthy devices will remain with the **In Progress** status for the 21-day service level objective period. Devices which are **Paused** are also considered healthy. + +| Sub status | Description | +| ----- | ----- | +| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| Paused | Devices that are currently paused due to a Windows Autopatch or customer-initiated Release Management pause. For more information, see [Pausing and resuming a release](../operate/windows-autopatch-wqu-overview.md#pausing-and-resuming-a-release). | + +### Not Up to Date (Microsoft Action) + +Not Up to Date means a device isn’t up to date when the: + +- Quality update is more than a month out of date, or the device is on last month’s quality update +- Device is more than 21 days overdue from the last release. + +> [!NOTE] +> Microsoft Action refers to the responsibility of the Windows Autopatch Service Engineering Team to carry out the appropriate action to resolve the reported device state. Windows Autopatch aims to keep at least [95% of eligible devices on the latest Windows quality update 21 days after release](../operate/windows-autopatch-wqu-overview.md#service-level-objective). + +| Sub status | Description | +| ----- | ----- | +| No Heartbeat | The Windows Update service hasn’t been able to connect to this device. The service can’t offer the update to that device. | +| Not Offered | The Windows Update service hasn’t offered the update to that device. | +| Policy Blocking Update | This device has a policy that is blocking the update, such as a deferral or pause policy. Devices are only in this state after the 21-day threshold. | +| In Progress—Stuck | This device has downloaded the update but is getting stuck in a loop during the install process. The update isn’t complete. | +| Other | This device isn't up to date and isn’t reporting back data from the client. | + +### Ineligible Devices (Customer Action) + +Customer Action refers to the responsibility of the designated customer IT administrator to carry out the appropriate action to resolve the reported device sub status. + +Within each 24-hour reporting period, devices that are ineligible are updated with one of the following sub statuses. + +| Sub status | Description | +| ----- | ----- | +| Insufficient Usage | Devices must have at least six hours of usage, with at least two hours being continuous. | +| Low Connectivity | Devices must have a steady internet connection, and access to [Windows update endpoints](../prepare/windows-autopatch-configure-network.md). | +| Out of Disk Space | Devices must have more than one GB (GigaBytes) of free storage space. | +| Not Deployed | Windows Autopatch doesn't update devices that haven't yet been deployed. | +| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Intune Sync Older Than 5 Days | Devices must have checked with Intune within the last five days. | + +## Data export + +Select **Export devices** to export data for each report type. + +> [!NOTE] +> Note You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md new file mode 100644 index 0000000000..646fe1f3c3 --- /dev/null +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md @@ -0,0 +1,44 @@ +--- +title: Summary dashboard +description: Provides a summary view of the current update status for all devices enrolled into Windows Autopatch. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: adnich +--- + +# Summary dashboard + +The Summary dashboard provides a summary view of the current update status for all devices enrolled into Windows Autopatch. + +**To view the current update status for all your enrolled devices:** + +1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. + +:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-summary-dashboard.png"::: + +> [!NOTE] +> The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. + +## Report information + +The following information is available in the Summary dashboard: + +| Column name | Description | +| ----- | ----- | +| Windows quality update status | The device update state. For more information, see [Windows quality update status](windows-autopatch-wqu-reports-overview.md#windows-quality-update-statuses). | +| Devices | The number of devices showing as applicable for the state. | + +## Report options + +The following option is available: + +| Option | Description | +| ----- | ----- | +| Refresh | The option to **Refresh** the Summary dashboard is available at the top of the page. This process will ensure that the Summary dashboard view is updated to the latest available dataset from within the last 24-hour period. | From b2460f2b3da428111685e690d80dc18bb628cb33 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:03:23 -0800 Subject: [PATCH 13/93] Update windows-autopatch-wqu-reports-overview.md --- .../operate/windows-autopatch-wqu-reports-overview.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md index 91b8c2d547..24dad31605 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -53,7 +53,7 @@ Each status has its own set of sub statuses to further describe the status. ### Healthy devices -Healthy Devices are devices that meet all of the following prerequisites: +Healthy devices are devices that meet all of the following prerequisites: - [Prerequisites](../prepare/windows-autopatch-prerequisites.md) - [Prerequisites for device registration](../deploy/windows-autopatch-register-devices.md#prerequisites-for-device-registration) @@ -98,8 +98,8 @@ Within each 24-hour reporting period, devices that are ineligible are updated wi | Low Connectivity | Devices must have a steady internet connection, and access to [Windows update endpoints](../prepare/windows-autopatch-configure-network.md). | | Out of Disk Space | Devices must have more than one GB (GigaBytes) of free storage space. | | Not Deployed | Windows Autopatch doesn't update devices that haven't yet been deployed. | -| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | -| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [Prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported on Windows Edition | Devices must be on a Windows edition supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | +| Not On Supported Windows Build | Devices must be on a Windows build supported by Windows Autopatch. For more information, see [prerequisites](../prepare/windows-autopatch-prerequisites.md). | | Intune Sync Older Than 5 Days | Devices must have checked with Intune within the last five days. | ## Data export @@ -107,4 +107,4 @@ Within each 24-hour reporting period, devices that are ineligible are updated wi Select **Export devices** to export data for each report type. > [!NOTE] -> Note You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. +> You can’t export Windows Autopatch report data using Microsoft Graph RESTful web API. From 5b8300d4e898370cd2a1e6354d7875d5610a5a4f Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:04 -0800 Subject: [PATCH 14/93] Update windows-autopatch-wqu-all-devices-historical-report.md --- .../windows-autopatch-wqu-all-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md index 1ff0c69942..aba6d03509 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -23,7 +23,7 @@ The historical All devices report provides a visual representation of the update 1. Select the **Reports** tab. 1. Select **All devices report—historical**. -:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="All devices—historical report" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: > [!TIP] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From 3b198c327013bcb0fe6823c8cfc7c36bfaf712dc Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:24 -0800 Subject: [PATCH 15/93] Update windows-autopatch-wqu-all-devices-report.md --- .../operate/windows-autopatch-wqu-all-devices-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md index dd3286efc7..5536a42c04 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-report.md @@ -23,7 +23,7 @@ The All devices report provides a per device view of the current update status f 1. Select the **Reports** tab. 1. Select **All devices report**. -:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-all-devices-report.png"::: +:::image type="content" source="../media/windows-autopatch-all-devices-report.png" alt-text="All devices report" lightbox="../media/windows-autopatch-all-devices-report.png"::: > [!NOTE] > The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. From 3f73d2107aa13c538b5784d25750be131cf9c455 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:04:46 -0800 Subject: [PATCH 16/93] Update windows-autopatch-wqu-eligible-devices-historical-report.md --- .../windows-autopatch-wqu-eligible-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md index 31970aad9f..4e4e383213 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-eligible-devices-historical-report.md @@ -23,7 +23,7 @@ The historical Eligible devices report provides a visual representation of the u 1. Select the **Reports** tab. 1. Select **Eligible devices report—historical**. -:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-eligible-devices-historical-report.png" alt-text="Eligible devices—historical report" lightbox="../media/windows-autopatch-eligible-devices-historical-report.png"::: > [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From 1f1e717b28925db5c0e1533a191aeeb26ab6b030 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:05:23 -0800 Subject: [PATCH 17/93] Update windows-autopatch-wqu-ineligible-devices-historical-report.md --- ...indows-autopatch-wqu-ineligible-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md index a0d5691f1c..733ee98e88 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-ineligible-devices-historical-report.md @@ -26,7 +26,7 @@ The historical Ineligible devices report provides a visual representation of why 1. Select the **Reports** tab. 1. Select **Ineligible devices report—historical**. -:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: +:::image type="content" source="../media/windows-autopatch-ineligible-devices-historical-report.png" alt-text="Ineligible devices—historical report" lightbox="../media/windows-autopatch-ineligible-devices-historical-report.png"::: > [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. From a2a8afbb15602aae3d6ac5678ec97cb727500840 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Wed, 30 Nov 2022 15:06:04 -0800 Subject: [PATCH 18/93] Update windows-autopatch-wqu-summary-dashboard.md --- .../operate/windows-autopatch-wqu-summary-dashboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md index 646fe1f3c3..735136be22 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-summary-dashboard.md @@ -21,7 +21,7 @@ The Summary dashboard provides a summary view of the current update status for a 1. Sign into the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). 1. Navigate to **Reports** > **Windows Autopatch** > **Windows Quality Updates**. -:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Overview of the device registration process" lightbox="../media/windows-autopatch-summary-dashboard.png"::: +:::image type="content" source="../media/windows-autopatch-summary-dashboard.png" alt-text="Summary dashboard" lightbox="../media/windows-autopatch-summary-dashboard.png"::: > [!NOTE] > The data in this report is refreshed every 24 hours. The last refreshed on date/time can be seen at the top of the page. From b16794754b98c4b20776091acea0b022ddd4ef95 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:20:40 -0800 Subject: [PATCH 19/93] added prerequisites --- windows/deployment/do/mcc-isp-signup.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index 352d4402b4..d411757f8e 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -22,9 +22,17 @@ ms.topic: article This article details the process of signing up for Microsoft Connected Cache for Internet Service Providers (public preview). +## Prerequisites + +Before you begin sign up, ensure you have the following components: +1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/en-us/offers/ms-azr-0003p/). +1. **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. +1. **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. +1. **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. + ## Resource creation and sign up process -1. Navigate to the [Azure portal](https://www.portal.azure.com). In the top search bar, search for **Microsoft Connected Cache**. +1. Navigate to the [Azure portal](https://www.portal.azure.com). Select **Create a Resource**. Then, search for **Microsoft Connected Cache**. :::image type="content" source="./images/mcc-isp-search.png" alt-text="Screenshot of the Azure portal that shows the Microsoft Connected Cache resource in Azure marketplace."::: From 7a5ef481ae0e7789c43b13c032ecd9ba8cca30a6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 16:35:21 -0800 Subject: [PATCH 20/93] Addressed a few draft comments - Moved "symptoms" above "affected devices" - Added "when CG is running" explicitly to end of "symptoms" section - Added security reasoning to "Why this is happening" section - Explicitly specified that supplied credentials are allowed for MSCHAP, NTLMv1 and WDigest - Added note about MDM management alongside GP management --- .../credential-guard-known-issues.md | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index d863d5b342..7d7195e1e0 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -24,6 +24,9 @@ Windows Defender Credential Guard has certain application requirements. Windows ## Known Issue: Single Sign-On (SSO) for Network services breaks after upgrading to **Windows 11, version 22H2** +### Symptoms of the issue: +Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session when Windows Defender Credential Guard is running. + ### Affected devices: Any device that enables Windows Defender Credential Guard may encounter this issue. As part of the Windows 11, version 22H2 update, eligible devices which had not previously explicitly disabled Windows Defender Credential Guard had it enabled by default. This affected all devices on Enterprise (E3 and E5) and Education licenses, as well as some Pro licenses*, as long as they met the [minimum hardware requirements](credential-guard-requirements.md#hardware-and-software-requirements). @@ -33,16 +36,15 @@ Any device that enables Windows Defender Credential Guard may encounter this iss > To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: > Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). -### Symptoms of the issue: -Devices that use 802.1x wireless or wired network, RDP, or VPN connections that rely on insecure protocols with password-based authentication will be unable to use SSO to login and will be forced to manually re-authenticate in every new Windows session. - ### Why this is happening: -Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. Affected procols include: +Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. These protocols are considered insecure because they can lead to password disclosure on the client and the server, which is in direct contradiction to the goals of Windows Defender Credential Guard. Affected procols include: - Kerberos unconstrained delegation (both SSO and supplied credentials are blocked) - Kerberos when PKINIT uses RSA encryption instead of Diffie-Hellman (both SSO and supplied credentials are blocked) - - WDigest (only SSO is blocked) - - NTLM v1 (only SSO is blocked) - MS-CHAP (only SSO is blocked) + - WDigest (only SSO is blocked) + - NTLM v1 (only SSO is blocked) + +Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. ### Options to fix the issue: @@ -51,7 +53,7 @@ Microsoft recommends that organizations move away from MSCHAPv2-based connection For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. > [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. > [!NOTE] > MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: From bcdc8052bb8de80b1997aecc68e90224677f4b52 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:38:55 -0800 Subject: [PATCH 21/93] Enterprise doc changes, added VMWare, endpoints --- .../do/delivery-optimization-endpoints.md | 2 +- .../deployment/do/mcc-enterprise-appendix.md | 44 +++++++++++-------- .../do/mcc-enterprise-prerequisites.md | 3 ++ 3 files changed, 29 insertions(+), 20 deletions(-) diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 8de2e95ad4..43856f97ce 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -34,4 +34,4 @@ This article lists the endpoints that need to be allowed through the firewall to | *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point | | *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Microsoft Configuration Manager Distribution Point | | *.do.dsp.mp.microsoft.com | HTTP / 80
HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Microsoft Connected Cache Managed in Azure | -| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | +| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, *.github.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 83d2df61da..400beb744f 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -12,6 +12,24 @@ ms.topic: article # Appendix +## Steps to obtain an Azure Subscription ID + + +[!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] + +### Troubleshooting + +If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). + +Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). + +## Installing on VMWare + +We have seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: + +1. Ensure that you are using ESX. In the VM settings, turn on the option **"Expose hardware assisted virtualization to the guest OS".** +1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to "Yes". + ## Diagnostics Script If you're having issues with your MCC, we included a diagnostics script. The script collects all your logs and zips them into a single file. You can then send us these logs via email for the MCC team to debug. @@ -33,17 +51,6 @@ To run this script: 1. [Email the MCC team](mailto:mccforenterprise@microsoft.com?subject=Debugging%20Help%20Needed%20for%20MCC%20for%20Enterprise) and attach this file asking for debugging support. Screenshots of the error along with any other warnings you saw will be helpful during out debugging process. -## Steps to obtain an Azure Subscription ID - - -[!INCLUDE [Get Azure subscription](includes/get-azure-subscription.md)] - -## Troubleshooting - -If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). - -Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). - ## IoT Edge runtime The Azure IoT Edge runtime enables custom and cloud logic on IoT Edge devices. @@ -58,14 +65,6 @@ communication operations. The runtime performs several functions: For more information on Azure IoT Edge, see the [Azure IoT Edge documentation](/azure/iot-edge/about-iot-edge). -## EFLOW - -- [What is Azure IoT Edge for Linux on Windows](/azure/iot-edge/iot-edge-for-linux-on-windows) -- [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) -- [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) -- EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) -- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) - ## Routing local Windows Clients to an MCC ### Get the IP address of your MCC using ifconfig @@ -115,3 +114,10 @@ To verify that the Delivery Optimization client can download content using MCC, :::image type="content" source="./images/ent-mcc-delivery-optimization-activity.png" alt-text="Screenshot of the Delivery Optimization Activity Monitor."::: +## EFLOW + +- [What is Azure IoT Edge for Linux on Windows](/azure/iot-edge/iot-edge-for-linux-on-windows) +- [Install Azure IoT Edge for Linux on Windows](/azure/iot-edge/how-to-provision-single-device-linux-on-windows-symmetric#install-iot-edge) +- [PowerShell functions for Azure IoT Edge for Linux on Windows](/azure/iot-edge/reference-iot-edge-for-linux-on-windows-functions) +- EFLOW FAQ and Support: [Support · Azure/iotedge-eflow Wiki (github.com)](https://github.com/Azure/iotedge-eflow/wiki/Support#how-can-i-apply-updates-to-eflow) +- [Now ready for Production: Linux IoT Edge Modules on Windows - YouTube](https://www.youtube.com/watch?v=pgqVCg6cxVU&ab_channel=MicrosoftIoTDevelopers) \ No newline at end of file diff --git a/windows/deployment/do/mcc-enterprise-prerequisites.md b/windows/deployment/do/mcc-enterprise-prerequisites.md index 705448742b..84faf8d670 100644 --- a/windows/deployment/do/mcc-enterprise-prerequisites.md +++ b/windows/deployment/do/mcc-enterprise-prerequisites.md @@ -26,6 +26,9 @@ ms.topic: article The resources used for the preview and in the future when this product is ready for production will be free to you, like other caching solutions. 2. **Hardware to host MCC**: The recommended configuration will serve approximately 35000 managed devices, downloading a 2 GB payload in 24-hour timeframe at a sustained rate of 6.5 Gbps. + + > [!NOTE] + > Azure VMs are not currently supported. If you'd like to install your cache node on VMWare, see the [Appendix](mcc-enterprise-appendix.md) for a few additional configurations. **EFLOW Requires Hyper-V support** - On Windows client, enable the Hyper-V feature From c771eb2abd8a28d99bd7700333284d273d7d87f0 Mon Sep 17 00:00:00 2001 From: Amy Zhou Date: Wed, 30 Nov 2022 16:46:01 -0800 Subject: [PATCH 22/93] edit github endpoint --- windows/deployment/do/delivery-optimization-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/do/delivery-optimization-endpoints.md b/windows/deployment/do/delivery-optimization-endpoints.md index 43856f97ce..49b08e601c 100644 --- a/windows/deployment/do/delivery-optimization-endpoints.md +++ b/windows/deployment/do/delivery-optimization-endpoints.md @@ -34,4 +34,4 @@ This article lists the endpoints that need to be allowed through the firewall to | *.assets1.xboxlive.com, *.assets2.xboxlive.com, *.dlassets.xboxlive.com, *.dlassets2.xboxlive.com, *.d1.xboxlive.com, *.d2.xboxlive.com, *.assets.xbox.com, *.xbl-dlassets-origin.xboxlive.com, *.assets-origin.xboxlive.com, *.xvcb1.xboxlive.com, *.xvcb2.xboxlive.com, *.xvcf1.xboxlive.com, *.xvcf2.xboxlive.com | HTTP / 80 | Xbox | | Microsoft Configuration Manager Distribution Point | | *.tlu.dl.adu.microsoft.com, *.nlu.dl.adu.microsoft.com, *.dcsfe.prod.adu.microsoft.com | HTTP / 80 | Device Update | [Complete list](/azure/iot-hub-device-update/) of endpoints for Device Update updates. | Microsoft Configuration Manager Distribution Point | | *.do.dsp.mp.microsoft.com | HTTP / 80
HTTPs / 443 | Microsoft Connected Cache -> Delivery Optimization Services communication | [Complete list](../do/waas-delivery-optimization-faq.yml) of endpoints for Delivery Optimization only. | Microsoft Connected Cache Managed in Azure | -| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, *.github.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | +| *.azure-devices.net, *.global.azure-devices-provisioning.net, *.azurecr.io, *.blob.core.windows.net, *.mcr.microsoft.com, github.com | AMQP / 5671
MQTT / 8883
HTTPs / 443 | IoT Edge / IoT Hub communication| [Complete list](/azure/iot-hub/iot-hub-devguide-protocols) of Azure IoT Hub communication protocols and ports. [Azure IoT Guide](/azure/iot-hub/iot-hub-devguide-endpoints) to understanding Azure IoT Hub endpoints. | Microsoft Connected Cache Managed in Azure | From 4ccee6c3cb1f4189af1d56b1ae226e3ef4765221 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:00:01 -0800 Subject: [PATCH 23/93] Fixed links and updated NTLM event - Fixed the broken credential-guard-manage.md links - Moved the Event Viewer events and added the event path --- .../credential-guard-known-issues.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md index 7d7195e1e0..68d5b6cc09 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-known-issues.md @@ -34,7 +34,7 @@ Any device that enables Windows Defender Credential Guard may encounter this iss > [!TIP] > To determine if your Pro device will receive default enablement when upgraded to **Windows 11, version 22H2**, do the following **before** upgrading: -> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage#disable-windows-defender-credential-guard). +> Check if the registry key `IsolatedCredentialsRootSecret` is present in `Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0`. If it is present, the device will have Windows Defender Credential Guard enabled after upgrading. Note that Windows Defender Credential Guard can be disabled after upgrade by following the [disablement instructions](credential-guard-manage.md#disable-windows-defender-credential-guard). ### Why this is happening: Applications and services are affected by this issue when they rely on insecure protocols that use password-based authentication. Windows Defender Credential Guard blocks the use of these insecure protocols by design. These protocols are considered insecure because they can lead to password disclosure on the client and the server, which is in direct contradiction to the goals of Windows Defender Credential Guard. Affected procols include: @@ -44,19 +44,10 @@ Applications and services are affected by this issue when they rely on insecure - WDigest (only SSO is blocked) - NTLM v1 (only SSO is blocked) -Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. - -### Options to fix the issue: - -Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. - -For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. - -> [!TIP] -> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. +Since only SSO is blocked for MS-CHAP, WDigest, and NTLM v1, these protocols can still be used by prompting the user to supply credentials. > [!NOTE] -> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs for the following warning and/or error: +> MS-CHAP and NTLMv1 are particularly relevant to the observed SSO breakage after the Windows 11, version 22H2 update. To confirm whether Windows Defender Credential Guard is blocking either of these protocols, check the NTLM event logs in Event Viewer at `Application and Services Logs\Microsoft\Windows\NTLM\Operational` for the following warning and/or error: > > **Event ID 4013** (Warning) > ``` @@ -75,6 +66,15 @@ For a more immediate but less secure fix, simply [disable Windows Defender Crede > /> > ``` +### Options to fix the issue: + +Microsoft recommends that organizations move away from MSCHAPv2-based connections such as PEAP-MSCHAPv2 and EAP-MSCHAPv2, to certificate-based authentication such as PEAP-TLS or EAP-TLS. Windows Defender Credential Guard will not block certificate-based authentication. + +For a more immediate but less secure fix, simply [disable Windows Defender Credential Guard](credential-guard-manage.md#disable-windows-defender-credential-guard). Note that Windows Defender Credential Guard does not have per-protocol or per-application policies, and must either be completely on or off. Disabling Windows Defender Credential Guard will leave some stored domain credentials vulnerable to theft. Windows Defender Credential Guard can be disabled after it has already been enabled, or it can be explicitly disabled prior to updating to Windows 11, version 22H2, which will prevent default enablement from occurring. + +> [!TIP] +> To _prevent_ default enablement, [use Group Policy to explicitly disable Windows Defender Credential Guard](credential-guard-manage.md#disabling-windows-defender-credential-guard-using-group-policy) before updating to Windows 11, version 22H2. If the GPO value is not configured (it typically is not configured by default), the device will receive default enablement after updating, if eligible. If the GPO value is set to "disabled", it will not be enabled after updating. This process can also be done via Mobile Device Management (MDM) policy rather than Group Policy if the devices are currently being managed by MDM. + ## Known issues involving third-party applications The following issue affects MSCHAPv2: From ff9f6bcff0512074e781ab8c53d3270a497b7a6e Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:17:09 -0800 Subject: [PATCH 24/93] Updated CredGuard root - Added default enablement announcement and link - Added link to Known Issues - Changed article author --- .../identity-protection/credential-guard/credential-guard.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard.md b/windows/security/identity-protection/credential-guard/credential-guard.md index 950eb3a95c..aa1ffc29b1 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard.md +++ b/windows/security/identity-protection/credential-guard/credential-guard.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: - M365-identity-device-management @@ -31,6 +31,9 @@ By enabling Windows Defender Credential Guard, the following features and soluti - **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system. - **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures. +> [!NOTE] +> As of Windows 11, version 22H2, Windows Defender Credential Guard has been enabled by default on all devices which meet the minimum requirements as specified in the [Default Enablement](credential-guard-manage.md#default-enablement) section. For information about known issues related to default enablement, see [Credential Guard: Known Issues](credential-guard-known-issues.md#known-issue-single-sign-on-sso-for-network-services-breaks-after-upgrading-to-windows-11-version-22h2). +   ## Related topics From 3b01ef45ad357a74a5c5a78254473186112074e6 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:21:02 -0800 Subject: [PATCH 25/93] Added link to Known Issues --- .../credential-guard/credential-guard-manage.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 33cab5403d..f7d645071d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -26,7 +26,9 @@ ms.technology: itpro-security ## Default Enablement -Starting in **Windows 11 Enterprise, version 22H2** and **Windows 11 Education, version 22H2**, compatible systems have Windows Defender Credential Guard turned on by default. This feature changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below. +Starting in **Windows 11 Enterprise, version 22H2** and **Windows 11 Education, version 22H2**, compatible systems have Windows Defender Credential Guard turned on by default. This feature changes the default state of the feature in Windows, though system administrators can still modify this enablement state. Windows Defender Credential Guard can still be manually [enabled](#enable-windows-defender-credential-guard) or [disabled](#disable-windows-defender-credential-guard) via the methods documented below. + +Known issues arising from default enablement are documented in [Windows Defender Credential Guard: Known issues](credential-guard-known-issues.md#known-issue-single-sign-on-sso-for-network-services-breaks-after-upgrading-to-windows-11-version-22h2). ### Requirements for automatic enablement From 7fe332cd9148e4206147aa2e3a37dfe793a80b1d Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:22:09 -0800 Subject: [PATCH 26/93] Updated feature owner --- .../credential-guard/credential-guard-scripts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md index 8b39b99573..11caa36d86 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-scripts.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-scripts.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From a2c8a6d9426a267b9487daf128614b05b6144686 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:23:25 -0800 Subject: [PATCH 27/93] Updated feature owner --- .../credential-guard/credential-guard-protection-limits.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md index 6444af7ea5..ef9f6a2bce 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-protection-limits.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From d188996f9d0b74e2f86ee853d55088674bf9f34a Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:24:05 -0800 Subject: [PATCH 28/93] Updated feature owner --- .../credential-guard-not-protected-scenarios.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 5ff4d5dadc..0f780be28b 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -4,7 +4,7 @@ description: Scenarios not protected by Windows Defender Credential Guard in Win ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo -ms.author: paoloma +ms.author: zwhittington ms.reviewer: erikdau manager: aaroncz ms.collection: M365-identity-device-management @@ -644,4 +644,4 @@ write-host $tmp -Foreground Red **Deep Dive into Windows Defender Credential Guard: Related videos** -[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) \ No newline at end of file +[Protecting privileged users with Windows Defender Credential Guard](https://mva.microsoft.com/en-us/training-courses/deep-dive-into-credential-guard-16651?l=JNbjYMJyC_8104300474) From b0908439e5864151bd969c2d9765636a28bb3026 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:25:03 -0800 Subject: [PATCH 29/93] Fixed mistake updating feature owner --- .../credential-guard-not-protected-scenarios.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md index 0f780be28b..51ecf3c661 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-not-protected-scenarios.md @@ -4,8 +4,8 @@ description: Scenarios not protected by Windows Defender Credential Guard in Win ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo -ms.author: zwhittington -ms.reviewer: erikdau +ms.author: paoloma +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From 9da8123b5eceda801b7ff8aeedd3cde304d4be07 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:25:44 -0800 Subject: [PATCH 30/93] Updated feature owner --- .../credential-guard/credential-guard-how-it-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 55fe9628bb..48360ee775 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article From 322dc1ed748302397ed21975237792565926501a Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:26:32 -0800 Subject: [PATCH 31/93] Updated feature owner --- .../credential-guard/credential-guard-considerations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md index 69d69300a1..b041c61076 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-considerations.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-considerations.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -97,4 +97,4 @@ When data protected with user DPAPI is unusable, then the user loses access to a **Related videos** -[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) \ No newline at end of file +[What is virtualization-based security?](https://www.linkedin.com/learning/microsoft-cybersecurity-stack-advanced-identity-and-endpoint-protection/what-is-virtualization-based-security) From ca0405658bd8c35c244506381b0a78b1d9edb2a7 Mon Sep 17 00:00:00 2001 From: zwhitt-microsoft <101152161+zwhitt-microsoft@users.noreply.github.com> Date: Wed, 30 Nov 2022 17:27:29 -0800 Subject: [PATCH 32/93] Updated feature owner --- .../credential-guard/additional-mitigations.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/credential-guard/additional-mitigations.md b/windows/security/identity-protection/credential-guard/additional-mitigations.md index 92b3296a71..3fd8405edf 100644 --- a/windows/security/identity-protection/credential-guard/additional-mitigations.md +++ b/windows/security/identity-protection/credential-guard/additional-mitigations.md @@ -5,7 +5,7 @@ ms.prod: windows-client ms.localizationpriority: medium author: paolomatarazzo ms.author: paoloma -ms.reviewer: erikdau +ms.reviewer: zwhittington manager: aaroncz ms.collection: M365-identity-device-management ms.topic: article @@ -607,4 +607,4 @@ write-host $tmp -Foreground Red ``` > [!NOTE] -> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. \ No newline at end of file +> If you're having trouble running this script, try replacing the single quote after the ConvertFrom-StringData parameter. From 8aa47d58c2c167fe21b942c17b9d1621fc472513 Mon Sep 17 00:00:00 2001 From: Tiara Quan <95256667+tiaraquan@users.noreply.github.com> Date: Thu, 1 Dec 2022 08:04:19 -0800 Subject: [PATCH 33/93] Update windows-autopatch-wqu-all-devices-historical-report.md --- .../windows-autopatch-wqu-all-devices-historical-report.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md index aba6d03509..3808dd45a7 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-all-devices-historical-report.md @@ -25,7 +25,7 @@ The historical All devices report provides a visual representation of the update :::image type="content" source="../media/windows-autopatch-all-devices-historical-report.png" alt-text="All devices—historical report" lightbox="../media/windows-autopatch-all-devices-historical-report.png"::: -> [!TIP] +> [!NOTE] > This report provides a time stamp of when the report trend was last generated and can be seen at the top of the page. ## Report options From 5eb226ad1ba351b3c087f7a7aecdd6e05661e2ce Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Thu, 1 Dec 2022 13:12:22 -0800 Subject: [PATCH 34/93] minor edits --- windows/deployment/do/mcc-enterprise-appendix.md | 12 ++++++------ windows/deployment/do/mcc-isp-signup.md | 8 ++++---- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/deployment/do/mcc-enterprise-appendix.md b/windows/deployment/do/mcc-enterprise-appendix.md index 400beb744f..ef710a3929 100644 --- a/windows/deployment/do/mcc-enterprise-appendix.md +++ b/windows/deployment/do/mcc-enterprise-appendix.md @@ -19,16 +19,16 @@ ms.topic: article ### Troubleshooting -If you're not able to sign up for a Microsoft Azure subscription with the error: **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** See [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). - -Also see [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). +If you're not able to sign up for a Microsoft Azure subscription with the **Account belongs to a directory that cannot be associated with an Azure subscription. Please sign in with a different account.** error, see the following articles: +- [Can't sign up for a Microsoft Azure subscription](/troubleshoot/azure/general/cannot-sign-up-subscription). +- [Troubleshoot issues when you sign up for a new account in the Azure portal](/azure/cost-management-billing/manage/troubleshoot-azure-sign-up). ## Installing on VMWare -We have seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: +We've seen that Microsoft Connected Cache for Enterprise and Education can be successfully installed on VMWare. To do so, there are a couple of additional configurations to be made: -1. Ensure that you are using ESX. In the VM settings, turn on the option **"Expose hardware assisted virtualization to the guest OS".** -1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to "Yes". +1. Ensure that you're using ESX. In the VM settings, turn on the option **Expose hardware assisted virtualization to the guest OS**. +1. Using the HyperV Manager, create an external switch. For the external switch to have internet connection, ensure **"Allow promiscuous mode"**, **"Allow forged transmits"**, and **"Allow MAC changes"** are all switched to **Yes**. ## Diagnostics Script diff --git a/windows/deployment/do/mcc-isp-signup.md b/windows/deployment/do/mcc-isp-signup.md index d411757f8e..291a69a7ab 100644 --- a/windows/deployment/do/mcc-isp-signup.md +++ b/windows/deployment/do/mcc-isp-signup.md @@ -25,10 +25,10 @@ This article details the process of signing up for Microsoft Connected Cache for ## Prerequisites Before you begin sign up, ensure you have the following components: -1. **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/en-us/offers/ms-azr-0003p/). -1. **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. -1. **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. -1. **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. +- **Azure Pay-As-You-Go subscription**: Microsoft Connected Cache is a completely free-of-charge service hosted in Azure. You will need to have a Pay-As-You-Go subscription in order to onboard to our service. To create a subscription, [visit this page](https://azure.microsoft.com/offers/ms-azr-0003p/). +- **Access to Azure portal**: Ensure you have the credentials needed to access your organization's Azure portal. +- **Peering DB**: Ensure your organization's [Peering DB](https://www.peeringdb.com/) page is up-to-date and active. Check that the NOC email listed is accurate, and that you have access to this email. +- **Server**: Ensure the server you wish to install Microsoft Connected Cache on is ready, and that the server is installed Ubuntu 20.04 LTS. ## Resource creation and sign up process From c0b678f43a316f5718c481b2e14dbddbe2f03fee Mon Sep 17 00:00:00 2001 From: tiaraquan Date: Thu, 1 Dec 2022 13:54:39 -0800 Subject: [PATCH 35/93] What's new article. --- windows/deployment/windows-autopatch/TOC.yml | 7 +- .../windows-autopatch-wqu-reports-overview.md | 4 +- .../windows-autopatch-whats-new-2022.md | 98 +++++++++++++++++++ 3 files changed, 106 insertions(+), 3 deletions(-) create mode 100644 windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md diff --git a/windows/deployment/windows-autopatch/TOC.yml b/windows/deployment/windows-autopatch/TOC.yml index 5d31d988ca..5d1978ac7a 100644 --- a/windows/deployment/windows-autopatch/TOC.yml +++ b/windows/deployment/windows-autopatch/TOC.yml @@ -99,4 +99,9 @@ - name: Privacy href: references/windows-autopatch-privacy.md - name: Windows Autopatch preview addendum - href: references/windows-autopatch-preview-addendum.md \ No newline at end of file + href: references/windows-autopatch-preview-addendum.md + - name: What's new + href: + items: + - name: What's new 2022 + href: whats-new/windows-autopatch-whats-new-2022.md \ No newline at end of file diff --git a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md index 24dad31605..739953b809 100644 --- a/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md +++ b/windows/deployment/windows-autopatch/operate/windows-autopatch-wqu-reports-overview.md @@ -64,8 +64,8 @@ Healthy devices are devices that meet all of the following prerequisites: | Sub status | Description | | ----- | ----- | -| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | -| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases) | +| Up to Date | Devices are up to date with the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases). | +| In Progress | Devices are currently installing the latest quality update deployed through the [Windows Autopatch release schedule](../operate/windows-autopatch-wqu-overview.md#windows-quality-update-releases). | | Paused | Devices that are currently paused due to a Windows Autopatch or customer-initiated Release Management pause. For more information, see [Pausing and resuming a release](../operate/windows-autopatch-wqu-overview.md#pausing-and-resuming-a-release). | ### Not Up to Date (Microsoft Action) diff --git a/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md new file mode 100644 index 0000000000..b4a98ff888 --- /dev/null +++ b/windows/deployment/windows-autopatch/whats-new/windows-autopatch-whats-new-2022.md @@ -0,0 +1,98 @@ +--- +title: What's new +description: This article lists the new feature releases and any corresponding Message center post numbers. +ms.date: 12/01/2022 +ms.prod: windows-client +ms.technology: itpro-updates +ms.topic: how-to +ms.localizationpriority: medium +author: tiaraquan +ms.author: tiaraquan +manager: dougeby +msreviewer: hathind +--- + +# What's new + +This article lists new and updated feature releases, and service releases, with their corresponding Message center post numbers (if applicable). + +Minor corrections such as typos, style, or formatting issues aren't listed. + +## December 2022 + +### December feature release + +| Article | Description | +| ----- | ----- | +| [What's new](../whats-new/windows-autopatch-whats-new-2022.md) | Added the What's new article | + +## November 2022 + +### November feature releases + +| Article | Description | +| ----- | ----- | +| [Privacy](../references/windows-autopatch-privacy.md) | Updated data center locations