From 8d5428e1955ced860617b80210a7624c9ffcc0dc Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 27 Sep 2021 22:55:37 -0700 Subject: [PATCH 1/9] update for win 11 Updates to the documentation for Windows 11. TODO: Add section for attestation flow based on MAA. TODO: Add links to MAA documentation --- .../mdm/healthattestation-csp.md | 225 ++++++++++++++++-- 1 file changed, 211 insertions(+), 14 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index e570b9890d..c18c474d71 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -23,7 +23,204 @@ The following is a list of functions performed by the Device HealthAttestation C - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device - Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data -## Terms +## Windhows 11 Device HealthAttestation + +>Windows 11 introduces an update to the device health attestation feature bringing in support for deeper insights into windows boot security, enhancing zero trust solutions. Device health attestation on windows can be accessed via the HealthAttestation CSP which enables enterprise device managers to assess if a device is booted to a trusted and compliant state and take enterprise policy actions. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. +The attested report provides a health assessment of the boot time properties of the device to ensure that the devices are automatically secure from the first power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. + +### Terms +**TPM (Trusted Platform Module)** +

TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

+ +**DHA (Device HealthAttestation) feature** +

The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

+ +**MAA-Session (Microsoft Azure Attestaiton service based device HealthAttestation session)** +

The Microsoft Azure Attestaiton service based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

+ +**MAA-CSP (Microsoft Azure Attestaiton based Configuration Service Provider)** +

The Configuration Service Provider nodes added to Windhows 11 to integrate with Microsoft Azure Attestation Service.

+

The following list of operations is performed by MAA-CSP:

+ + +### Attestation Flow with Microsoft Azure Attestation Service + + +### Configuration Service Provider Nodes +Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. +``` +./Vendor/MSFT +HealthAttestation +----... +----TriggerAttestation +----CurrentProtocolVersion +----PreferredMaxProtocolVersion +----MaxSupportedProtocolVersion +``` + +**./Vendor/MSFT/HealthAttestation** +

The root node for the device HealthAttestation configuration service provider.

+ +**TriggerAttestation** (Required) +

Node type: EXECUTE +This node will trigger attestation flow by launching an attestation process. If a process is already running, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned. +

+ +

Templated SyncML Call:

+ + + + + VERIFYHEALTHV2 + + + + ./Vendor/MSFT/HealthAttestation/TriggerAttestation + + + + { + rpID : "rpID", serviceEndpoint : “MAA endpoint”, + nonce : “nonce”, aadToken : “aadToken”, "cv" : "CorrelationVector" + } + + + + + + + +

Data fields:

+ + +

Sample Data:

+ + + { + "rpid" : "https://www.contoso.com/attestation", + "endpoint" : "https://contoso.eus.attest.azure.net/attest/tpm?api-version=2020-10-01", + "nonce" : "5468697320697320612054657374204e6f6e6365", + "aadToken" : "dummytokenstring", + "cv" : "testonboarded" + } + + +**AttestStatus** +

Node type: GET +This node will retrieve the status(HRESULT value) stored in registry updated by the attestation process triggered in the previous step. +The status is always cleared prior to making the attest service call. +

+ +

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/AttestStatus + + + + + + + + +

Sample Data:

+ + If Successful: 0 + If Failed: A corresponding HRESULT error code + Example: 0x80072efd, WININET_E_CANNOT_CONNECT + +**GetAttestReport** +

Node type: GET +This node will retrieve the attestation report per the call made by the TriggerAttestation, if there is any, for the given MDM provider. The report is stored in a registry key in the respective MDM enrollment store. +

+ +

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetAttestReport + + + + + + + + +

Sample data:

+ + If Success: + JWT token: aaaaaaaaaaaaa.bbbbbbbbbbbbb.cccccccccc + If failed: + Previously cached report if available (the token may have already expired per the attestation policy). + OR Sync ML 404 error if not cached report available. + +**GetServiceCorrelationIDs** +

Node type: GET +This node will retrieve the service generated correlation IDs for the given MDM provider. If there are more than one correlation id, they are separated by “;” in the string. +

+

Templated SyncML Call:

+ + + + + + + + ./Device/Vendor/MSFT/HealthAttestation/GetServiceCorrelationIDs + + + + + + + + +

Sample data:

+ + If success: + GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM + If Trigger Attestation call failed and no previous data is present. The field remains empty. + Otherwise, the last service correlation id will be returned. + +### MAA CSP Intergation Steps +
    +
  1. Setup a MAA provider instance: +MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
    2. +
  2. Update the provider with an appropriate policy: +The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs +A Sample attestation policy that only checks for secureboot is here: +TODO
    3. +
  3. Call TriggerAttestation with your rpid, AAD token and the attestURI: +Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
    4. +
  4. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties: +The decoded JWT token contains information per the attestation policy. +{ "typ": "JWT", "alg": "RS256", "x5c": [ "MIIDcDCCAligAwIBAgIQOLMUhXOEQ2axV6zXp/KvnzANBgkqhkiG9w0BAQsFADA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwHhcNMjAxMTI5MTExMjUyWhcNMjIxMTI5MTEyMjUyWjA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsuOlDyU1sYAuAV53n7TrmTU180bOREgfZoTsdOyllMcsKciTUWkTO0vKDa8CFwGEHmSVTAEngDIHw1putio84HKZdcI6nPt2B74kJ/+5ut8KGMWtBm6GFWwS0TXti1rE4Os1mPpCYAsUyKxaEw4lBbEzGa5mGx0SGLdseuUIiw23S695RLVCciDaAvf+q/gBScFgZJm2ZxgkyNF7+MSvnDMU1xv5YLDQeh3j5vZlstSq+rrRbB5SVnuD4cFBjvGW5lXBLxMEjpBXI6yzFmFuw/OjZ7VClk6HSNjvvhSwJu4F1oHuJ0oAuABOtPpRK/898Ru+9qS5ZMm79775nZK75AgMBAAGjfDB6MA4GA1UdDwEB/wQEAwIFoDAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBR/8W25+uWj5sg8lEKKYy1gdCqWUTAdBgNVHQ4EFgQUf/Ftufrlo+bIPJRCimMtYHQqllEwDQYJKoZIhvcNAQELBQADggEBAJGfbRRvF3EpG6ZsOcSmWtu/1LDVZq+fGspjK/7+ImybEY/zC2CsWWpz7pT54KEGYe91q67nV5GZoSz7+O4A4A5QtMDFzOnrFVicDo5Cg2EDU4YQDN4j4DyrbttkQYiEiBFexJImrjIk4bfW2YqZjtzR7XFDsCsOAUHNY8cnnKaZCRbXrLwP/LUYAz/NVkttO4CW4U/8OZygrarfAsVrsCsx5o2mXBlaRYl5xECWfvT2YbCFuIt3gZR9sau65uMWthgyV0XAR7farxycfMEuBkyb+IVPwYW5QGFo5M8a78r/rFPdczGPlv0Qvg7zrBm775xs8O33V4nOmC1tfsxXUgw=" ], "kid": "e5j-rIjIITYTB9RQSgM-OzOWjXM" }.{ "nbf": 1629758941, "exp": 1630104841, "iat": 1629759241, "iss": "https://ulptestwin.eus.test.attest.azure.net", "jti": "e325dad03894f09b12c53f3b5eac5e36824c89ae", "ver": "1.0", "x-ms-ver": "1.0", "rp_data": "AQIDBA", "nonce": "AQIDBA", "cnf": { "jwk": { "kty": "RSA", "n": "vTCRaX0IZMsNHfJPOVyiYSCM2WABZmNo3PSVTOt9mh0vR4Mon080EGHM_V3afjKJ4NxmEZ01XeB-1TsuNM2-19_JMWZF-wiBTrBWEjcUQ84AxzukaWD1sMsH2kiqjaxXBHEUl8Hhq9SRjVEEdT-fKLOzBO070TffvRCKVxZIRI9Ry6E6K8gMEX3CH6Yk9b7clAua0MrUxd28hMxwx4hy1HyCsFSnXb_bIaqxLYjCxisc9mRx2vO6IuEqEVskSYDc-5f8u2G98ld6PuiMkAhvOOEBmaDlEksvUpnA8e9nWO98rg17pjyOms9GLvgKkSgOKbK8wQ-NuUyXutQfaN2MbQ", "e": "AQAB" } }, "x-ms-policy-hash": "BpV0Jxx6oZ2AjkgXx3Gj7JiJ1NpZWGppjdT2OTtBR4g", "AIKPresent": true, "BitlockerStatus": 1, "CodeIntegrityEnabled": true, "SafeMode": false, "SecureBootEnabled": true, "TpmVersion": 2, "VSMEnabled": true, "WinPE": false }.[Signature]
    5. +
+ +## Windhows 10 Device HealthAttestation + +### Terms **TPM (Trusted Platform Module)**

TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

@@ -173,7 +370,7 @@ The following is a list of functions performed by the Device HealthAttestation C -## CSP diagram and node descriptions +### CSP diagram and node descriptions The following shows the Device HealthAttestation configuration service provider in tree format. @@ -243,7 +440,7 @@ HealthAttestation

Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.

Value type is integer. The supported operation is Get.

-## **DHA-CSP integration steps** +### **DHA-CSP integration steps** The following list of validation and development tasks are required for integrating the Microsoft Device Health Attestation feature with a Windows Mobile device management solution (MDM): @@ -260,7 +457,7 @@ The following list of validation and development tasks are required for integrat Each step is described in detail in the following sections of this topic. -## **Step 1: Verify HTTPS access** +### **Step 1: Verify HTTPS access** Validate that both the MDM server and the device (MDM client) can access has.spserv.microsoft.com using the TCP protocol over port 443 (HTTPS). @@ -313,7 +510,7 @@ SSL-Session: ``` -## **Step 2: Assign an enterprise trusted DHA-Service** +### **Step 2: Assign an enterprise trusted DHA-Service** There are three types of DHA-Service: - Device Health Attestation – Cloud (owned and operated by Microsoft) @@ -339,7 +536,7 @@ The following example shows a sample call that instructs a managed device to com ``` -## **Step 3: Instruct client to prepare health data for verification** +### **Step 3: Instruct client to prepare health data for verification** Send a SyncML call to start collection of the DHA-Data. @@ -366,7 +563,7 @@ The following example shows a sample call that triggers collection and verificat ``` -## **Step 4: Take action based on the clients response** +### **Step 4: Take action based on the clients response** After the client receives the health attestation request, it sends a response. The following list describes the responses, along with a recommended action to take. @@ -394,7 +591,7 @@ Here is a sample alert that is issued by DHA_CSP: ``` - If the response to the status node is not 0, 1 or 3, then troubleshoot the issue. For the complete list of status codes see [Device HealthAttestation CSP status and error codes](#device-healthattestation-csp-status-and-error-codes). -## **Step 5: Instruct the client to forward health attestation data for verification** +### **Step 5: Instruct the client to forward health attestation data for verification** Create a call to the **Nonce**, **Certificate** and **CorrelationId** nodes, and pick up an encrypted payload that includes a health certificate and related data from the device. @@ -431,7 +628,7 @@ Here is an example: ``` -## **Step 6: Forward device health attestation data to DHA-service** +### **Step 6: Forward device health attestation data to DHA-service** In response to the request that was sent in the previous step, the MDM client forwards an XML formatted blob (response from ./Vendor/MSFT/HealthAttestation/Certificate node) and a call identifier called CorrelationId (response to ./Vendor/MSFT/HealthAttestation/CorrelationId node). @@ -455,14 +652,14 @@ When the MDM-Server receives the above data, it must: - DHA-OnPrem or DHA-EMC: https://FullyQualifiedDomainName-FDQN/DeviceHealthAttestation/ValidateHealthCertificate/v3 -## **Step 7: Receive response from the DHA-service** +### **Step 7: Receive response from the DHA-service** When the Microsoft Device Health Attestation Service receives a request for verification, it performs the following steps: - Decrypts the encrypted data it receives. - Validates the data it has received - Creates a report, and shares the evaluation results to the MDM server via SSL in XML format -## **Step 8: Take appropriate policy action based on evaluation results** +### **Step 8: Take appropriate policy action based on evaluation results** After the MDM server receives the verified data, the information can be used to make policy decisions by evaluating the data. Some possible actions would be: @@ -816,7 +1013,7 @@ Each of these are described in further detail in the following sections, along w

In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.

-## **Device HealthAttestation CSP status and error codes** +### **Device HealthAttestation CSP status and error codes** @@ -1027,7 +1224,7 @@ Each of these are described in further detail in the following sections, along w
-## DHA-Report V3 schema +### DHA-Report V3 schema ```xml @@ -1131,7 +1328,7 @@ Each of these are described in further detail in the following sections, along w ``` -## DHA-Report example +### DHA-Report example ```xml From 96f9551f2040fbbae5aed97ea35e89d0773c60b3 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 28 Sep 2021 09:24:45 -0700 Subject: [PATCH 2/9] Update healthattestation-csp.md edits (pass 1) --- .../mdm/healthattestation-csp.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index c18c474d71..7c0aef670f 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -8,25 +8,26 @@ ms.author: dansimp ms.topic: article ms.prod: w10 ms.technology: windows -author: manikadhiman -ms.date: 06/26/2017 +author: dansimp +ms.date: --- # Device HealthAttestation CSP -The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT managers to assess if a device is booted to a trusted and compliant state, and take enterprise policy actions. +The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT admins to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. The following is a list of functions performed by the Device HealthAttestation CSP: -- Collects device boot logs, TPM audit trails and the TPM certificate (DHA-BootData) from a managed device -- Forwards DHA-BootData to Device Health Attestation Service (DHA-Service) +- Collects device boot logs, Trusted Platform Module (TPM) audit trails and the TPM certificate (DHA-BootData) from a managed device +- Forwards DHA-BootData to a Device Health Attestation Service (DHA-Service) - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device -- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data +- Receives attestation requests (DHA-Requests) from a DHA-Enabled MDM, and replies with Device Health Attestation data (DHA-Data) -## Windhows 11 Device HealthAttestation +## Windows 11 Device health attestation ->Windows 11 introduces an update to the device health attestation feature bringing in support for deeper insights into windows boot security, enhancing zero trust solutions. Device health attestation on windows can be accessed via the HealthAttestation CSP which enables enterprise device managers to assess if a device is booted to a trusted and compliant state and take enterprise policy actions. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. -The attested report provides a health assessment of the boot time properties of the device to ensure that the devices are automatically secure from the first power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, based on whether devices prove to be healthy. +Windows 11 introduces an update to the device health attestation feature. This helps add support for deeper insights to Windows boot security, supporting a zero trust approach to device security. Device health attestation on Windows can be accessed by using the HealthAttestation CSP. This CSP helps assess if a device is booted to a trusted and compliant state and then to take appropriate action. Windows 11 introduces additional child nodes to the HealthAttestation node for the MDM providers to connect to the Microsoft Azure Attestation service which provides a simplified approach to attestation. + +The attestation report provides a health assessment of the boot-time properties of the device to ensure that the devices are automatically secure as soon as they power on. The health attestation result can then be used to allow or deny access to networks, apps, or services, depending on the health of the device. ### Terms **TPM (Trusted Platform Module)** From 66deb0fa5a5c8cf167b45489e662c016bafa38d5 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Thu, 7 Oct 2021 21:06:48 -0700 Subject: [PATCH 3/9] Update healthattestation-csp.md Added policy and response token. TODO: Add image. --- .../mdm/healthattestation-csp.md | 221 +++++++++++++++++- 1 file changed, 212 insertions(+), 9 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 7c0aef670f..dd83b691f5 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -51,6 +51,15 @@ The attestation report provides a health assessment of the boot-time properties ### Attestation Flow with Microsoft Azure Attestation Service +#add image +

Attestation flow can be broadly in three main steps: +

+The protocol implemented can be found here: Attestation Protocol +

### Configuration Service Provider Nodes Windows 11 introduces additions to the HealthAttestation CSP node to integrate with Microsoft Azure Attestaiton service. @@ -206,17 +215,211 @@ This node will retrieve the service generated correlation IDs for the given MDM ### MAA CSP Intergation Steps
    -
  1. Setup a MAA provider instance: -MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
    2. -
  2. Update the provider with an appropriate policy: -The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs -A Sample attestation policy that only checks for secureboot is here: -TODO
    3. -
  3. Call TriggerAttestation with your rpid, AAD token and the attestURI: +
  4. Setup a MAA provider instance:
    +MAA instance can be created following the steps here Quickstart: Set up Azure Attestation by using the Azure portal | Microsoft Docs.
    5. +
  5. Update the provider with an appropriate policy:
    +The MAA instance should be updated with an appropriate policy. How to author an Azure Attestation policy | Microsoft Docs +
    A Sample attestation policy: + +``` +version=1.2; + +configurationrules{ +}; + +authorizationrules { + => permit(); +}; + +issuancerules{ + +// SecureBoot enabled +c:[type == "events", issuer=="AttestationService"] => add(type = "efiConfigVariables", value = JmesPath(c.value, "Events[?EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && ProcessedData.VariableGuid == '8BE4DF61-93CA-11D2-AA0D-00E098032B8C']")); +c:[type == "efiConfigVariables", issuer=="AttestationPolicy"]=> issue(type = "secureBootEnabled", value = JsonToClaimValue(JmesPath(c.value, "[?ProcessedData.UnicodeName == 'SecureBoot'] | length(@) == `1` && @[0].ProcessedData.VariableData == 'AQ'"))); +![type=="secureBootEnabled", issuer=="AttestationPolicy"] => issue(type="secureBootEnabled", value=false); + +// Retrieve bool properties +c:[type=="events", issuer=="AttestationService"] => add(type="boolProperties", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `19` || PcrIndex == `20`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="codeIntegrityEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_CODEINTEGRITY"))); +c:[type=="codeIntegrityEnabledSet", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="codeIntegrityEnabled", issuer=="AttestationPolicy"] => issue(type="codeIntegrityEnabled", value=false); + +// Bitlocker Boot Status, The first non zero measurement or zero. +c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => issue(type="bitlockerEnabledValue", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BITLOCKER_UNLOCK | @[? Value != `0`].Value | @[0]"))); +[type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=true); +![type=="bitlockerEnabledValue"] => issue(type="bitlockerEnabled", value=false); + +// Elam Driver (windows defender) Loaded +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="elamDriverLoaded", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_LOADEDMODULE_AGGREGATION[] | [? EVENT_IMAGEVALIDATED == `true` && (equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wdboot.sys') || equals_ignore_case(EVENT_FILEPATH, '\\windows\\system32\\drivers\\wd\\wdboot.sys'))] | @ != `null`"))); +[type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=true); +![type=="elamDriverLoaded", issuer=="AttestationPolicy"] => issue(type="WindowsDefenderElamDriverLoaded", value=false); + +// Boot debugging +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="bootDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_BOOTDEBUGGING"))); +c:[type=="bootDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="bootDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="bootDebuggingDisabled", value=false); + +// Kernel Debugging +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="osKernelDebuggingEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_OSKERNELDEBUG"))); +c:[type=="osKernelDebuggingEnabledSet", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="osKernelDebuggingDisabled", issuer=="AttestationPolicy"] => issue(type="osKernelDebuggingDisabled", value=false); + +// DEP Policy +c:[type=="boolProperties", issuer=="AttestationPolicy"] => issue(type="depPolicy", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_DATAEXECUTIONPREVENTION.Value | @[-1]"))); +![type=="depPolicy"] => issue(type="depPolicy", value=0); + +// Test Signing +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="testSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_TESTSIGNING"))); +c:[type=="testSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=ContainsOnlyValue(c.value, false)); +![type=="testSigningDisabled", issuer=="AttestationPolicy"] => issue(type="testSigningDisabled", value=false); + +// Flight Signing +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="flightSigningEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_FLIGHTSIGNING"))); +c:[type=="flightSigningEnabledSet", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=ContainsOnlyValue(c.value, false)); +![type=="flightSigningNotEnabled", issuer=="AttestationPolicy"] => issue(type="flightSigningNotEnabled", value=false); + +// VSM enabled +c:[type=="events", issuer=="AttestationService"] => add(type="srtmDrtmEventPcr", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && (PcrIndex == `12` || PcrIndex == `19`)].ProcessedData.EVENT_TRUSTBOUNDARY")); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_VSM_REQUIRED"))); +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="vbsEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_MANDATORY_ENFORCEMENT"))); +c:[type=="vbsEnabledSet", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=false); +c:[type=="vbsEnabled", issuer=="AttestationPolicy"] => issue(type="vbsEnabled", value=c.value); + +// HVCI +c:[type=="srtmDrtmEventPcr", issuer=="AttestationPolicy"] => add(type="hvciEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_HVCI_POLICY | @[?String == 'HypervisorEnforcedCodeIntegrityEnable'].Value"))); +c:[type=="hvciEnabledSet", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=ContainsOnlyValue(c.value, 1)); +![type=="hvciEnabled", issuer=="AttestationPolicy"] => issue(type="hvciEnabled", value=false); + +// IOMMU +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="iommuEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_VBS_IOMMU_REQUIRED"))); +c:[type=="iommuEnabledSet", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=ContainsOnlyValue(c.value, true)); +![type=="iommuEnabled", issuer=="AttestationPolicy"] => issue(type="iommuEnabled", value=false); + +// Find the Boot Manager SVN, this is measured as part of a sequence and find the various measurements +// Find the first EV_SEPARATOR in PCR 12, 13, Or 14 +c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq")); +c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`")); +[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` "); + +// Find the first EVENT_APPLICATION_SVN. +c:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] => add(type="bootMgrSvnSeqQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12` && ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN] | @[0].EventSeq")); +c1:[type=="bootMgrSvnSeqQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="bootMgrSvnSeq", value=JmesPath(c2.value, c1.value)); +c:[type=="bootMgrSvnSeq", value!="null", issuer=="AttestationPolicy"] => add(type="bootMgrSvnQuery", value=AppendString(AppendString("Events[? EventSeq == `", c.value), "`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]")); + +// The first EVENT_APPLICATION_SVN. That value is the Boot Manager SVN +c1:[type=="bootMgrSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootMgrSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value))); + +// OS Rev List Info +c:[type=="events", issuer=="AttestationService"] => issue(type="osRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_OS_REVOCATION_LIST.RawData | @[0]"))); + +// Safe mode +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="safeModeEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_SAFEMODE"))); +c:[type=="safeModeEnabledSet", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=ContainsOnlyValue(c.value, false)); +![type=="notSafeMode", issuer=="AttestationPolicy"] => issue(type="notSafeMode", value=true); + +// Win PE +c:[type=="boolProperties", issuer=="AttestationPolicy"] => add(type="winPEEnabledSet", value=JsonToClaimValue(JmesPath(c.value, "[*].EVENT_WINPE"))); +c:[type=="winPEEnabledSet", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=ContainsOnlyValue(c.value, false)); +![type=="notWinPE", issuer=="AttestationPolicy"] => issue(type="notWinPE", value=true); + +// CI Policy +c:[type=="events", issuer=="AttestationService"] => issue(type="codeIntegrityPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_SI_POLICY[].RawData"))); + +// Secure Boot Custom Policy +c:[type=="events", issuer=="AttestationService"] => issue(type="secureBootCustomPolicy", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EFI_VARIABLE_DRIVER_CONFIG' && PcrIndex == `7` && ProcessedData.UnicodeName == 'CurrentPolicy' && ProcessedData.VariableGuid == '77FA9ABD-0359-4D32-BD60-28F4E78F784B'].ProcessedData.VariableData | @[0]"))); + +// Find the first EV_SEPARATOR in PCR 12, 13, Or 14 +c:[type=="events", issuer=="AttestationService"] => add(type="evSeparatorSeq", value=JmesPath(c.value, "Events[? EventTypeString == 'EV_SEPARATOR' && (PcrIndex == `12` || PcrIndex == `13` || PcrIndex == `14`)] | @[0].EventSeq")); +c:[type=="evSeparatorSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value=AppendString(AppendString("Events[? EventSeq < `", c.value), "`")); +[type=="evSeparatorSeq", value=="null", issuer=="AttestationPolicy"] => add(type="beforeEvSepClause", value="Events[? `true` "); // No restriction of EV_SEPARATOR in case it is not present + +//Finding the Boot App SVN +// Find the first EVENT_TRANSFER_CONTROL with value 1 or 2 in PCR 12 which is before the EV_SEPARATOR +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="bootMgrSvnSeq", value != "null", issuer=="AttestationPolicy"] => add(type="beforeEvSepAfterBootMgrSvnClause", value=AppendString(AppendString(AppendString(c1.value, "&& EventSeq >= `"), c2.value), "`")); +c:[type=="beforeEvSepAfterBootMgrSvnClause", issuer=="AttestationPolicy"] => add(type="tranferControlQuery", value=AppendString(c.value, " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`&& (ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `1` || ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_TRANSFER_CONTROL.Value == `2`)] | @[0].EventSeq")); +c1:[type=="tranferControlQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="tranferControlSeq", value=JmesPath(c2.value, c1.value)); + +// Find the first non-null EVENT_MODULE_SVN in PCR 13 after the transfer control. +c:[type=="tranferControlSeq", value!="null", issuer=="AttestationPolicy"] => add(type="afterTransferCtrlClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`")); +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="afterTransferCtrlClause", issuer=="AttestationPolicy"] => add(type="moduleQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13` && ((ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]) || (ProcessedData.EVENT_LOADEDMODULE_AGGREGATION[].EVENT_MODULE_SVN | @[0]))].EventSeq | @[0]")); +c1:[type=="moduleQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => add(type="moduleSeq", value=JmesPath(c2.value, c1.value)); + +// Find the first EVENT_APPLICATION_SVN after EV_EVENT_TAG in PCR 12. +c:[type=="moduleSeq", value!="null", issuer=="AttestationPolicy"] => add(type="applicationSvnAfterModuleClause", value=AppendString(AppendString(" && EventSeq > `", c.value), "`")); +c1:[type=="beforeEvSepClause", issuer=="AttestationPolicy"] && c2:[type=="applicationSvnAfterModuleClause", issuer=="AttestationPolicy"] => add(type="bootAppSvnQuery", value=AppendString(AppendString(c1.value, c2.value), " && EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `12`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_APPLICATION_SVN | @[0]")); +c1:[type=="bootAppSvnQuery", issuer=="AttestationPolicy"] && c2:[type=="events", issuer=="AttestationService"] => issue(type="bootAppSvn", value=JsonToClaimValue(JmesPath(c2.value, c1.value))); + +// Finding the Boot Rev List Info +c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo", value=JsonToClaimValue(JmesPath(c.value, "Events[? EventTypeString == 'EV_EVENT_TAG' && PcrIndex == `13`].ProcessedData.EVENT_TRUSTBOUNDARY.EVENT_BOOT_REVOCATION_LIST.RawData | @[0]"))); + +}; +``` +
    6. +
  6. Call TriggerAttestation with your rpid, AAD token and the attestURI:
    Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs
    7. -
  7. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties: +
  8. Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
    The decoded JWT token contains information per the attestation policy. -{ "typ": "JWT", "alg": "RS256", "x5c": [ "MIIDcDCCAligAwIBAgIQOLMUhXOEQ2axV6zXp/KvnzANBgkqhkiG9w0BAQsFADA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwHhcNMjAxMTI5MTExMjUyWhcNMjIxMTI5MTEyMjUyWjA1MTMwMQYDVQQDEypBdHRlc3RhdGlvblNlcnZpY2UtTG9jYWxUZXN0LVJlcG9ydFNpZ25pbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsuOlDyU1sYAuAV53n7TrmTU180bOREgfZoTsdOyllMcsKciTUWkTO0vKDa8CFwGEHmSVTAEngDIHw1putio84HKZdcI6nPt2B74kJ/+5ut8KGMWtBm6GFWwS0TXti1rE4Os1mPpCYAsUyKxaEw4lBbEzGa5mGx0SGLdseuUIiw23S695RLVCciDaAvf+q/gBScFgZJm2ZxgkyNF7+MSvnDMU1xv5YLDQeh3j5vZlstSq+rrRbB5SVnuD4cFBjvGW5lXBLxMEjpBXI6yzFmFuw/OjZ7VClk6HSNjvvhSwJu4F1oHuJ0oAuABOtPpRK/898Ru+9qS5ZMm79775nZK75AgMBAAGjfDB6MA4GA1UdDwEB/wQEAwIFoDAJBgNVHRMEAjAAMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAfBgNVHSMEGDAWgBR/8W25+uWj5sg8lEKKYy1gdCqWUTAdBgNVHQ4EFgQUf/Ftufrlo+bIPJRCimMtYHQqllEwDQYJKoZIhvcNAQELBQADggEBAJGfbRRvF3EpG6ZsOcSmWtu/1LDVZq+fGspjK/7+ImybEY/zC2CsWWpz7pT54KEGYe91q67nV5GZoSz7+O4A4A5QtMDFzOnrFVicDo5Cg2EDU4YQDN4j4DyrbttkQYiEiBFexJImrjIk4bfW2YqZjtzR7XFDsCsOAUHNY8cnnKaZCRbXrLwP/LUYAz/NVkttO4CW4U/8OZygrarfAsVrsCsx5o2mXBlaRYl5xECWfvT2YbCFuIt3gZR9sau65uMWthgyV0XAR7farxycfMEuBkyb+IVPwYW5QGFo5M8a78r/rFPdczGPlv0Qvg7zrBm775xs8O33V4nOmC1tfsxXUgw=" ], "kid": "e5j-rIjIITYTB9RQSgM-OzOWjXM" }.{ "nbf": 1629758941, "exp": 1630104841, "iat": 1629759241, "iss": "https://ulptestwin.eus.test.attest.azure.net", "jti": "e325dad03894f09b12c53f3b5eac5e36824c89ae", "ver": "1.0", "x-ms-ver": "1.0", "rp_data": "AQIDBA", "nonce": "AQIDBA", "cnf": { "jwk": { "kty": "RSA", "n": "vTCRaX0IZMsNHfJPOVyiYSCM2WABZmNo3PSVTOt9mh0vR4Mon080EGHM_V3afjKJ4NxmEZ01XeB-1TsuNM2-19_JMWZF-wiBTrBWEjcUQ84AxzukaWD1sMsH2kiqjaxXBHEUl8Hhq9SRjVEEdT-fKLOzBO070TffvRCKVxZIRI9Ry6E6K8gMEX3CH6Yk9b7clAua0MrUxd28hMxwx4hy1HyCsFSnXb_bIaqxLYjCxisc9mRx2vO6IuEqEVskSYDc-5f8u2G98ld6PuiMkAhvOOEBmaDlEksvUpnA8e9nWO98rg17pjyOms9GLvgKkSgOKbK8wQ-NuUyXutQfaN2MbQ", "e": "AQAB" } }, "x-ms-policy-hash": "BpV0Jxx6oZ2AjkgXx3Gj7JiJ1NpZWGppjdT2OTtBR4g", "AIKPresent": true, "BitlockerStatus": 1, "CodeIntegrityEnabled": true, "SafeMode": false, "SecureBootEnabled": true, "TpmVersion": 2, "VSMEnabled": true, "WinPE": false }.[Signature]
    9. +
    + + + { + "typ": "JWT", + "alg": "RS256", + "x5c": [ + "MIIE.....=", + "MIIG.....=", + "MIIF.....=" + ], + "kid": "8FUer20z6wzf1rod044wOAFdjsg" + }.{ + "nbf": 1633664812, + "exp": 1634010712, + "iat": 1633665112, + "iss": "https://contosopolicy.eus.attest.azure.net", + "jti": "2b63663acbcafefa004d20969991c0b1f063c9be", + "ver": "1.0", + "x-ms-ver": "1.0", + "rp_data": "AQIDBA", + "nonce": "AQIDBA", + "cnf": { + "jwk": { + "kty": "RSA", + "n": "yZGC3-1rFZBt6n6vRHjRjvrOYlH69TftIQWOXiEHz__viQ_Z3qxWVa4TfrUxiQyDQnxJ8-f8tBRmlunMdFDIQWhnew_rc3-UYMUPNcTQ0IkrLBDG6qDjFFeEAMbn8gqr0rRWu_Qt7Cb_Cq1upoEBkv0RXk8yR6JXmFIvLuSdewGs-xCWlHhd5w3n1rVk0hjtRk9ZErlbPXt74E5l-ZZQUIyeYEZ1FmbivOIL-2f6NnKJ-cR4cdhEU8i9CH1YV0r578ry89nGvBJ5u4_3Ib9Ragdmxm259npH53hpnwf0I6V-_ZhGPyF6LBVUG_7x4CyxuHCU20uI0vXKXJNlbj1wsQ", + "e": "AQAB" + } + }, + "x-ms-policy-hash": "GiGQCTOylCohHt4rd3pEppD9arh5mXC3ifF1m1hONh0", + "WindowsDefenderElamDriverLoaded": true, + "bitlockerEnabled": true, + "bitlockerEnabledValue": 4, + "bootAppSvn": 1, + "bootDebuggingDisabled": true, + "bootMgrSvn": 1, + "bootRevListInfo": "gHWqR2F-1wEgAAAACwBxrZXHbaiuTuO0PSaJ7WQMF8yz37Z2ATgSNTTlRkwcTw", + "codeIntegrityEnabled": true, + "codeIntegrityPolicy": [ + "AAABAAAAAQBWAAsAIAAAAHsAOABmAGIANAA4ADYANQBlAC0AZQA5ADAAYgAtADQANAA0AGYALQBiADUAYgA1AC0AZQAyAGEAYQA1ADEAZAA4ADkAMABmAGQAfQAuAEMASQBQAAAAVnW86ERqAg5n9QT1UKFr-bOP2AlNtBaaHXjZODnNLlk", + "AAAAAAAACgBWAAsAIAAAAHsAYgBjADQAYgBmADYAZAA3AC0AYwBjADYAMAAtADQAMABmADAALQA4ADYANAA0AC0AMQBlADYANAA5ADEANgBmADgAMQA4ADMAfQAuAEMASQBQAAAAQ7vOXuAbBRIMglSSg7g_LHNeHoR4GrY-M-2W5MNvf0o", + "AAAAAAAACgBWAAsAIAAAAHsAYgAzADEAOAA5ADkAOQBhAC0AYgAxADMAZQAtADQANAA3ADUALQBiAGMAZgBkAC0AMQBiADEANgBlADMAMABlADYAMAAzADAAfQAuAEMASQBQAAAALTmwU3eadNtg0GyAyKIAkYed127RJCSgmfFmO1jN_aI", + "AAAAAAAACgBWAAsAIAAAAHsAZgBlADgAMgBkADUAOAA5AC0ANwA3AGQAMQAtADQAYwA3ADYALQA5AGEANABhAC0AZQA0ADUANQA0ADYAOAA4ADkANAAxAGIAfQAuAEMASQBQAAAA8HGUwA85gHN_ThItTYtu6sw657gVuOb4fOhYl-YJRoc", + "AACRVwAACgAmAAsAIAAAAEQAcgBpAHYAZQByAFMAaQBQAG8AbABpAGMAeQAuAHAANwBiAAAAYcVuY0HdW4Iqr5B-6Sl85kwIXRG9bqr43pVhkirg4qM" + ], + "depPolicy": 0, + "flightSigningNotEnabled": false, + "hvciEnabled": true, + "iommuEnabled": true, + "notSafeMode": true, + "notWinPE": true, + "osKernelDebuggingDisabled": true, + "osRevListInfo": "gHLuW2F-1wEgAAAACwDLyDTUQILjdz_RfNlShVgNYT9EghL7ceMReWg9TuwdKA", + "secureBootEnabled": true, + "testSigningDisabled": true, + "vbsEnabled": true + }.[Signature] + +
## Windhows 10 Device HealthAttestation From dd4fca93b1a3a64149dab14802e44d757e1ec500 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 15:18:42 -0700 Subject: [PATCH 4/9] Add files via upload adding maa flow image --- .../mdm/images/maa-attestation-flow.png | Bin 0 -> 81911 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/client-management/mdm/images/maa-attestation-flow.png diff --git a/windows/client-management/mdm/images/maa-attestation-flow.png b/windows/client-management/mdm/images/maa-attestation-flow.png new file mode 100644 index 0000000000000000000000000000000000000000..5bd288d0aeb9a5ae32344d19f58903e61da0db4f GIT binary patch literal 81911 zcmc$`2UL^W)-D{&wqZft0)l|pP^uzLs=(eBkYb^ih#(LkM1;_rTLBdTw@8r)$dO(W zY9NFJ1OzDoqyn#5@m#yt=5au73Mi z7Fwjxt@cjEBS-h4u9{Ngd-9?*UtllZZoL)!=no<m*R;^uKq#b8Fdc_m%|Ry5C~U>US@So)PLg9x1&^ zO4D1gT@6T1KAD-QZ@g>oN{*HW^&a>x1NSeJRj3D%=f;b_jR<4Ie|KOmcGuEH z!xJd7Q=wmm;rqsnCdZOKmGZsx+&XDyGklYY!@?cPhSl9SCJGGPg_-EWPKl>tvrCoX zWr;dYd>5SWbk!A|A`O##yCi&DYvH1Zt0;{$KhkkKx#*i+m&Vbg;mZ+2yH9UOVkuNX zJ1EHOiGVNpKba#ZO$Hr#V-Ps7P9tCqM;$G;m_Vn(ra{Ig<;p#Igl_;k|1Yyqnv zGs#;QDHBamIMs9b?1tghsg*P!#({}cINbC?gzLmBN^ycJT$OGwFtop|dfZ2%5P7ZS z{Oupg_X{Qq7lr!BuP;VWt7PsPygOx+RX%$ug}L~c`VYYo|6G4MJ({@OhW)!ty9*jo zGVlN{>URPtY|h_qFjBZEy!&-tnT?F(^bUo%`r1zn{0!r&`?hBr&eS~dO+g;#`#!3G zmD~>0C3vlb(aj!`);9b13JOat9&!;-6L!I^*j|zq?%}z(Azy|1Bl5c^bWy6y{jR$0 zEwhTIT?WgQPw2ay+S#+*5NeaL(FYfefk7s9{D z=>Vg0{`HB{v@bA0*9p2Xx!ou5PYB7CveUD8-}wKs&wGF zw6T`|UxVzwn=HG6Wb>W1 z;o^sHCJQIlU6~BQkcNBS(FA=Bxwp z7Iq@>HTl-@uZqhdqJ=L->AruP^sypK+t(HnV34PTdi)XX*iGWr3tC67-dr2!sJ7;Z*(-s!6=B;7KAtM) z`VNf$8*o=Tvx{)3SMDS8>)*R3ijoem4bq&Z??FFandnkD7xvvv6;1-2-8F$Kn7g?F zZPG&jd+h!1+~WTR&~r(Z65VS8byahHlZ?8^!#Yk-&m|D|h!d&^@7py`ZG}lgJ#QM0 zKOUA+OrSIs!cCdV+$BGNOYD}1FBKb!xKIcmq{EndkoUVjJUQ59K$L;0AjZ4gMo>CV zrk+}qBkBwX0X01CHAVKmJ6uIIR@(OB4{zq!Z;>$H{K4B{U`4C6>{O&KfD4ck&>)lt zRg=cfXAi*z)Mjzdmb8q@lK8e<`30NrFrQ|EWiK!Q*mQuElSe}ViZ0;k(H4I8%nuLR zKx$AT9slYoVacla2bz{u(jvMp`^mteaC_Spf-T5QpW^cp+}fwvC_T6gKVJ62)wX=c zcQ@hyxnzQ>GBpfi+UpA!Ws3>-cn`HTWi2^Uh$ihm4adLQNLcd!6HSrZspnW}nrz?| zC`zTLnxE|P&d9{Ib(|Y%4A{u}+=~Jh2_n-OX9mu5EB)ViaP}jokmh532 zFr;}ZHhhU%z^ax>0BPY>Jxld`-i48B$PZG%b*yx+jw5s-KBCJ&T?JLwJWf2|U2((Xs}@A`oDYYH6yVK|P%7L{jztmPMi^Z#{_{Wp`@9kL+X zySMEA@WZFsY%Xw4dq%}8X+s0*CLatiNjslkr!dnjt{z+mDN=fe?$gCyhYxA(mxIW4 z!t1zmQ53#eP7t~Ku(gNaLdel|Fw)$S+FF6FK2WOWLjQ}V_Z{ipMBWrvQ7E+#dZV=t z?VK62y&qOgBZQt5=%ksBGo0dDPaSzz;*V+Xp}xG)6Pb!$2WAc-J1vgSFK@&} ze_m&lL!WO2O?=bWEX?kyHDwny;Pv&TFeY-;+;eJ!bryphak6|pA?$VKF$)eqWN4pm zNbx>iXg`5r{6yKcJl23+YWe*>s{cCorCaZyx^ZMD7JgHC(kmA(G9k1!ligc$k2vWq zlq=pV(l7rj&VF3UJZ@G+Q}a8NWG6jx48PT~^}}hp?=7I}wP84?lTObVcu@bCczd~S z?t2zEm|fu@czADICgBIkJpB5!`othgx{DYE0kx?Q^X*kCpRS4_}?|69sn zuvxRt+F}N4UW_Z>>yB7(0t^k8o0U2SZLM6#9Ny zNukT37hYd(t~DE9dG$Bxs@%5c-ziN=4kuvVcbIi^ue-5R4+>a~9oWbfaN){1zyWj| zO&2=UVlF?wDbm5{@Ro4B{5@>VjXr$i4f=ayE&oj!`+q;k{+r3vGryG> z;3I4<{#s6mmLmQ&_mSNmc(cU{l}b)9z>OsM-fG95B&`CeQA3M5*6XBpz_XU#%M8s} z$ZkSw#gN|h&r0#4be(LUbP6nR@`d>-5a-0i*-s|f&F}b@%eMew?wIqv<;gOZr2!H0Q%;1#fWVb$TBl6vUyb*7O)2} zLJK9+6a9t7sgiurZqIWy%w|X3HH0tUtPm++(qz!G6|&7@M||t%5hsynCqJxasQ?u% zj%*q*V8EY=T@Y{CtX?I;a=|jL#Yt$b6*Y6!#Lk?ZK*V^3?)lw<#3jB!hhO1%7r55P zI@{EuP6HN(+`c|?qTK0_W>Zk-M5<9aTsmB!>h5zMMmbMrL?UuD12zAG(JZ(mNOYJ|4${#oIw zHHFH4SBTw=VsY4eAvfg@Iu>gmC5x^P`}N%VM1QP*Il%M4W}5s5G(szOb%OGi=j)Qq zs2#aOemM5!?&@_Or*&0a6x^A+7Gf{H5Ahr4uS0yhvZhoBm(h_s;lrBvb(8ImTvyBO zi?6xvkk@;Z<$B-0zOBLWF|a|H#u!`nh*PT*=M*OecCaHDvc+CDCoI1D$5Q*hFI8-_ z^JDXUc@fd83%i|@y#9-j$DDlZK?45#u5P18>bLo~f7-AV&yjVp%8zjecQTGDdaiLl zE{k>FIeTK=7j|cTU;Kwh6tGE(?+(z_0H>l-a-8&7(Xn^=> zcD&869BNLD`u@>X4&U{U%zidh)L#Y7?nWXP{(#*6oAb_EtXskoCvtAxe+(%lbHdq>aV@N5b zMIJc@Is3=2>g0M`&|GA3HR3^(>;yYD1B6bjNz5Y!OGJQ3+9D3`T{WhL#Lv@(sF{2< z#U#~U)Izzlv8d!Y{M4oRSf||3-H|kQ=A0o{6oKIG3()?{QOtDT!j8QuJk|bb`cs1kGBvE z?i|?202ev_;WJ_}t?FYY>+o~qA2a8Cw$T_fgSj8M6P#MGjvZR2CSSYs@Z4(2ByTJ` zig1@qbT6PsWqQT+Xy(L-+%G?fWAns#l2c5gLgo3zE=GN zyF4o2;|>xMwT47SQr`m(AV1raXUDKVunvHUpti=C35cAv*Bk$SPP~A%u;g0SfLvVJ zu?D^nAc{~<*u$|!?DrB2GNb!54uB$2a2@LbbROT@;rx69JOCmt^ZXlDK_FaJFd?_> z?;AxBvB#e{6%8r;!JU0)=s%{Z`4x%SgFVq0^Lidvx_f=utmA7c15DxeuVx1ls{X8J z&?fcYm~Z#9Ut${!wrB;y%q)`Lqr!nb zR4yQ;%{X=r)n)pZo56}!eUE3yk5A9a!B!+sZy0GquD!Z2;SJwYwb?@Z3j06zu>Zs< z1lRK=*r(O}PrUd)nuA>^)CkRbpbJdDZ;zJ$B`;ouj$8{);4Z(N`?n;_cA}U)S#MKw zH&Xt^Oa9k0?QitiMuksJH7HC@1Nr*v?F3&B;pBV%%DOY@fX z9NKHYyWo*YW#(k9>9FU>PF+*E_!Ul@EzQS&j^&U)e2y2I2hR4{blq4fuDrKoDV|mH zRt6tGV5!!7@@WBF;m(A^YBx_v_3|RX)i+-J2d-|UWVtM zRzP|;K&)3&tkG*;#2Zp_6oph&Aam5$oHx^u(sRQ7JWo`Zf#r?NQDmA7_hfgF8f9W6 z2cEu*Y&u|K{c)U%B$zc7Ow!u5Pj|tQ(?qjtwBKD@w+CF<@c?477n2@S7^UiP4mB` zYCtp)|48@Sv<67|S#r(lC>uF`Z{)*!&F|&T_IUUh4a7crif9f}ol_r(>5C1)Tpr%S z)#yW*XiZ|_)7qJ;%RS1cd55L1Ovlo2j!LRpgJt_#T=8Kr7VpZD3~mZtxE@DK(S7cA zjZwEaG37SBubqQF+e$wdth%MyHZ`!b@Bka^b_Z3XY!elBvidpSpw96~z{u*QaCD2) zqU^R4iDnOT?kyf_sABGnWDuYeil_Srcz$OoL{~~IyWcW^(FDWWLtI+qEz;(xJ;v&v zJkZ7uyG!Pa6%JdS%f5M5a0R~gV)Q?A>5Q?@bXIG#Bz>Ei+`!o*{j{Txi%1O0;~I{B zR2y2=NFJuv;`4YeLPnnVkI()jO0qzt&S*nxKm% zIx3NM{_4IonHy+t3j{P*vR&!feD>l`q0q#Ocug7{GM1C$JFG%NKk)Fzpz}*S@Tl^f zd$GS=C3Mu^wojB1xSXc;5#w^9VQ6Y1)rKaB*vI^ODMo8Ro-sK2>nk)MYoDK#&#t2N)GqhSgfM3p&1A7V z9Xdi6EG9h0ElWM()EWH*?u>(zO1yK_V&z+M{gX6@!_e)uHyjMZV#qGRkV{5X#Q8&{Y#2CR)T==gm0k*Ejn>2?{b3G~cS)^_cR$uHj9Ckk7VnxrG@$j6WQ;JlD_w|ASwRJY ziU!g%D4{tVKJiA0_G4~*kTQfNJ*ge6#E&^9;P&qaiN6@&`GlamrpwKLDkEN zqy1!Fa@s2pI*ZZ~Zv5E1n2z-8R#d$>Ged~j^B=ij=AtCxHPS2p+?XgaJ*Lovbl$0J zB($#BKh{7_6ZHgf-zMEnPJP&65B|`^+v`gvsmySu+*9(Kp3WY$ahlk$0#T*pg6=d@ zTgHIPrROriBrd{(kY|9OyKLT_+G=Irtt&iyj<)od6Z&tjLX)nN>e-$wwKSWO!=kr@ zX|2~N#m2pgabIWW)$b}-7ehrSnaL5zXUuAccACrKqWXVPY5a>bQ>Yo@Dmq zKBAMVrk^ooh!z-&$8+sQgwD%6$Khl5t|g8-bl3}IcVtV9w`x)rZ4S-t@eh-Ue_P$+oPi0oz_+UXYMERA^nvB>@tBsy zf|gEMv<>s=+nupfPB8C^_GIN7^?Bv{pX$IVa4iwKP zh-91Y0e3xhIHh$q zx0;w}V*G)zS4MCmcs@qKyiANno%c!;>-T(L!;gVQIf%tOM5$y~xj4%7-Z4qNM6fsy z+4jc|mP)ZJg>hx{gmxM9qdZ8}A&3rSUeo-gJCr?jN8u85Yuth{`D$0S8=X>J;Vjn1 z>-N^UTQAqCQ7dYp8m?d*E~XIY?&GI^H|}N;D{u76k{p&J@=q&f4#q$M)&?PJ9w^&=V^Grp#uipEuB>)T%oETm4HqM;2~WrFn_OCOev&K>!_vDt-v5M=cBDM9L5AQ+RX;A(+od5M?Mjn-)LTzf2zyVu2j+)M+e7< zK_6Fza5wdptO0hAN|To%Vh4UE-g|fvv4NWS3(@*M2PNR81$;?M761y#w7LnY)OlXmJN|T)Ik0 zqB8_Uq9I#4g>RjQ4QEA+etFHduYM6(ze8s4fDD#{nJEbEc*>M(1)>{Fs^rbkzwn}T zVJ?U)1KObkrc;=ZMX*I&f=+cPFsK4t&|!=(6&iPC1bsOS9Bhig|1HwQF|Jj%%lq?})-` zKGt^gb_D{Iq;?Y9J13nR3oD4ICtWt}bYvtlbbt}-5V#ivF)G?5R51L|a`!cg_PoKc zkdq>L)Ea91z9xZDQs=ci;O3HTFf8nZ(x-UBg=v#>ruhsVMT{|}ptY8A7tUQ(^KrDa zMnPFF4jV2ryQlqHx6|_u{B>dGj(%*MfMExtNdZ%=oxe~ua2HqIk8`_ko&q}}dMndm zH4L++H{E_5_*17@OUI`*>(ibRu?lT`b#9AO|9d%}VH5fgYB0#AI|YR*fDLTxdDf$& zG-T!=F|5QD-g7OA4?D?da}0f043Dzf1@HHZyCrIj373vL;@)G1e&RMzL$6#?Pss6O zXm=1ojQ2FztqYQZFg}yU)}A^otKYg zyb2$n&+)qb%h@8)oqipvoJ&&H~DunWXiYCB(g^0^BiqRgY{P!HpF7 zX5}K%Z2H|E7W9TH_^MXH6_wFC9c4X}HJGAUEuYsw8t^twhwQluo9M$3jV}e9cmp=y zzkLSAP73YXB?c`{(kVSkW{>%hp-hfLf>ujjT$9d8{0?UYYw(;7G5Q0g>V++%@_A^4 z`PZ&aVg!oB*u}IfOepphjcY8s?jx4HSPj<*geU6e%Y3zVa_$24Hr1X*>-RHWbQNVw zW@ZQysq@d0MXyTsWSCootE`vA_*A<9cjV59#F@#(#iMk(YS`4~l#|>QT2ET*oW_!3 zQY(Yz%Hrz^vNx-lFEr>MXt*B=aD)yLd`9GVJMB*VM?0`w&z>#h&5Or4=fw<8RiWN)vI538^w3^+oQr&WSpwlzVerE1!t zqo{qc@CDLoa-NZ^!So0NC5;#pQ}6Yf&|I9LXZ+r!!ON!y?VPsILia0qWz{hNJw3Uk z{=T1#zYsLPxYOS$1@HocewP;eZljHq9{Z$gPm34uOBQESdh5WbD+`samO9|-68fI` zp+#7m!drwwq}CKYr?sWEvH*aJ#5IaK33i;b=n|8AsCXe9TrX5`5AFBMcD?Ug)o%sskn6piCYIMI?nHJl z9{$J?3QF?!J1o}olrC1mBJ0yN)h4)H|8(rE;whCNy||~$xlx6$Ynl5y(0iz6Q)Ca$ zA!NwKaDzBBpwF1rWoM?IT4{FAMBco7Ywz(~532EE(i3VzBE|R`t?jf*huicvh~SyM zV3&92Y9!&WbB7?h+cP8QZOn`0_m+3JE9J@Pel@xH-DeRof+&O(sQJ5n)$XL4Z z%q_rBpAT5o-`93)NzFCKWB(yjhr>}?cfT8ftApUYq-WgpXKFvox}8+WV{JZgwD)qy zbZ2_C@1r^qx>8|l?WE)*v58!qMZzTSBm3kCY)_+jHWcr2p6v38jTR3}dqZ1>K4~gp zbg0yxEPpGeUe8k4lkoFe2{-`<&L){#QC1dgv3hNzJhzmKv75nX8`zn8^oxx%MY~(f zs!Hx~{>-b)0={QG-D6p_Bt%h-X@U!d)a+FA8Zr4gkKM59;CnZ@=d*#s$4<0)SBb}x z-kObkWoUd8$LmenG3nK#)=L&ptIz@R+&MuY&!L2ntQtX#dA`hEkY>FIjcTRgSuN;S zZY^Qy2z?+4A2e1G;kRVT&c&QMy=&xr!$ZweuMCH{M75>ikq)C?m!`7a)&kU z5}czuRB1$-+>v3gh_mq;!U_anJFEpMOwNL8Q-kAl=+se45Hsny=v0J8PMQ>$1Q)~c zGFME8fv{e_(og5eSqS-RHpKC}n=tjVhoU-E&}XUDy9Vwm_ZD0TJeRkFxdX0|U{J$f z#r%+=;zyv+QzaU*a{=FfJaaioUU@QEy4aB6iN3pA>9>z~ZGb32ll_mnLD z?9;V;mJHf({sP@h+CX&DBv{q<&_t0wwctV!d@{ER4yuWHQiq7c-3#M3v?GhM0+(4v zEtFs~NI2k&nLU1^6-s=}Let>0PF75>_NKcOg``6GNv8yTN;mMfM;U@zF%G_PJYb59 zjEPide;A#TZQPuNNb?XRQG#R~g~wZUD4ywtnFC=(fo^nABad+ly2lnn6-gauZ}}!n z`VGW}Gtjgl7H3hDR9VTrtWe*|gnT=!tTD5u=5V!xaJ<9UgIJl&YAj49i*}2<2^T?x zG{0c?v5m$+I}2&r7i20dcbL|X@{2R*K!qT)XUQW*liD?6EL6`4xM6k&mdf@QKLh77 zy}0fVp=4|iqmzVt%q(ajF|Kn@r0P?h8vTU_w)bS|TLmuD8<2u@P+m#I8{%mhXw;tP?Uf|Weu5$MRFEJBM*C@{sDW((Q9ref0v@z^3}m(LlItDv z$`|jRrwv^~cJPJd7UZfUGstq9ts=A-mPMsOzpr&9RwAxJQe|1pHy>?m#|=uhlYmK@ zZJR8mF!lf{Nz`vACp(*FP7dH6sRp0p6`jEt=F7m{cdOY&bQI~gH)$(6mu2-2q+_6p zleyLxmXAK8I_?1nM?ByA=Iyd_?<(rawN~~gwPDH%a!vI+rayw*;p*k+ypomIm^m4P zf+Lc<*sT?NJu)6OS83L(F{xm!3{?Z=Ph8e@rC~8&MP*y(z-7y_9;0i(ZWP(s-vT_( zV?Dime;k!4e*>V+s`w)p=z;wew_~7MZkl(F-(q66+Qyus{pGA%YQM9BdBkFFb&Vo< zV6280dtgE`(?eNtgim^Q!nMp&n|ID!@c69(6J%cayhnvf-czP*V`8Muu!>{I92F4i z`N@(3#i2{E=?@|e!t~dVb`7NP>ncwAfG^%v=I)8FyhLiWOy@`hZHx znW+=Fkj!tIW>XXW-fXD7v#32+&c53)Evw%uq28MqK~%F^5%Xt0>%z{ znep?_HbH!yO&*(zuI~Pw{aUeSzM7Ags2~H%w#qvaeIk{@M1hKgO>Z!(z3R0+E~DN3 z-%3z?v`|nOi0KpNtRsI)>cGHsJai8yY%zWGx^8w`N!9M z0zW6`_VZ1J`a+^gzInGyT=KD&hlE_(ku`7>PZVF>D{Pi?Zf?;IM9o+pf#|Ggsrac% zh)Dj^W1! z%f_GBYKJ~ozPC)ySb=vXZbVW7l9RStGuRe^-SmXDqay4LEIZyiWRV{mmIr^@!)I@^ zUf$RbEB|?`g}s~gpKU?cbPkO$oFD(sc2WP|?KZLtj(wvX=rzKwtO>`&;=o(l4H-;Xl@C;u}8{LkkIXYZH~aC$2lQpA63jsJ8~ z4FW0uD`rnFINjy^m_NQnXYIrsu(N-|&-+%Z3r_g43BZ2etombv`xi`Lf5`ez!cnza zRu>blF*f;qUmpw*@Y@fhWDm%3N4Bal(yd0w?Z;_IFwOt@F$MOZ8^=omQhJTL-8KdhKYZ?$Y6@$)%aEL1rTvnbWO&;0&Bx82k+DTafy~<(et)-U3T47(IwK zSGt&?zHo>pJK;BLC2-T%QR;X0;1Gz?wa0s;O^U4M4jT?5ygmhWYexq{ynM7qlxf(P z%hPs=Q^9W+>XtvMFJMJ?MVcCL&GxF?==AQ&3}KF!6z5DdhU{XF7r)6_Ax=MKPAC@@ zufz`?WD3gTJw7kHJY@>*zyxA3^%DdnlIWua&%$4Fi9}@8M$cx~8WMf(qGwdArw2)V z*lR1OJ%P&H#J&=Q%9&T7gkrz6wAnE3?bZdr?drkXI|5S^D_cL(rUnyCBSd{=9<@eu z&-yW6^e-zmojFpQON{-IIF?`YN3?IADcSp5SYWhN}9p$cIBx2` zQn2uC{POpx)~S8^O_JkfbA|6;ncBN7yT!~I5oZSYIL>1<_j0TX8({hUB&5;SYD|LP zLTA*7L&xtT{?2#N_q(1}H1uG^1bn{XA}(j>#+F==kr!z5s^}PKAJ*Z|jyG5O)_gaR zP?TM(KZ~i4^tT*{YH5Ev5vOwgg7xa?kRWi_f-8D5eIz>kkigz7!$DE1g+aGJIX@+A z_UrMo?WyrnNEb#{`tf#-5T+AUzth`xet9fceZkktG^I&r{r<)P%ilM^mg9tvJEKx? zyT$Uwb>??Z8QWrSmfo|<`otSw{r+w}mwC|J5c zYOg_jpnGb0^v^%_88oebx;@J5c28F0Yb6uqGLO%_AJs>~kf>DuyGnAtf98Sq4*RwH zxRC4&HHcQWSW&oe-&xvlp&GEnxm{T(!}<8J{8Rf3FF!qBlr8acZ#d!%L0Bm{UhL%B zFDp-NoW>fm)39s`q)iV(cj+E1%K*OmEv^anAX^iYs?DECyfdYT)K9$6v_nr(tEaph zwWGLJhX}Czg)%l1_LyoqkiTe_`5P1O*K3{H>%a0WeIUIrtIi<2%d2#;zqYa+L`~PF z=|Soa|1(F8?blWk^l|OL*YlpBrFcQ(2uc6DcP)oZn-b)g!eMG-N879%4sB)#cZewM zSuXgbAj_OSSR|0(OLxAWpq6%af?N9t+9ICH>?sVKYRokod|^GZdTtfMb17fQ4PBtP zH@EU8fKqB1eZtUF=;vCV^Y#^*;!fIMeXDq(Bcx z%Tr$n1B=Czztk7*TFLTp00s=z53GCFzEG!~XfRmUH*8fX>u;Lbb$NOaubvPIv~FS4 z=}*l(wbuYD3Xj?(Un|{E#(R8A4B=qv6481%;jN9CyS(SJ8>9W1 zb=~pl-%iX2iAQQd%RDDU<;=?F0ujYdL$5HNIOpdLck&tz zG8;Tu+pw-$gLRr}dDXKL=^bAt0bRxc?Z9mh?ekX^zePtX-=$SrGAU3G46?M=2%i7EL(5$z9Uy5kW)S!D7DbhVi7>D^_=%k$L@j0Qw zr?Rv)ER}pHeg_mKNi|^-3eLP*z108$sl4`>bfZY9Xjt4~IvG*s)8G6sJfS9>w3n*P zssM_2dAcvS-SCTOjp1NDUe@u|vK-%iDF0XCXV9|2@(|#~y#*@J_$`McA8mSrWiCLbLrj51s2tF zR7qL;2r*y5XJ$4K_yGtvglU4LV5dBvf#i62<=$zk(dm`1cY*U&Tt+3BcCQeIJHpN% zK~NML3M+UmuBUb1VEWFyYd@H5d!ltMC~kMIA0ZCJ}ma>o?k#J1QEo zUC;+^In;ItS7!)fVWL>U&{HRmc2Y>`kaCnHYkt&hFopcPjg#lcFMXp2y_T+zHN_|y z5R!^lzC_|ibb}^DblukO?km5saYDbmoI{s}CK)>UzWdVWe~sf$e75a1eiTc9)*e_# z%_8Yz9mTq5GOVMuC~UXB%#jQg6n}|OOf6n{kjj{sBjB zXq$>0YWp~P#geL=IX$Q<2=a2mSkPY9=Z=x{HQ1N;`v$6@vYu&+^Dhg>Q!Hei(-dMc zW7OxFW>M@Lc%*i&Y%$fYYh~YDb9UL#)zO12(ZN^0iQDDd<@Oy>2`qV?IPrcus!lqnI?Yu8w`XwUptr5Js7Z)2?*_HClG{H_F=R z*6Zh*Doag@l3(Dnis!JvzFK?a71N`2jw~+&v1dhH25Av}Be|I_k%O7L2E(BSo!&JZ zwi;tIE`JxsDrtm(bd3i3f!$0UbC(6%@gx{-T>FcyuW?|Mj zM;C6GWWH))eN!;Ff)(wBiRx2nEHWR_9@E_9QU>L!P^1x6O%RzS~sCY7Y<5pAUn{k)~bwv3Vx z%VPs%ZV^>~nB`EIZA0G~=CG~+8ekli@*F>sXKe?8M7&5b?TvJafbaGLskyk9C_l;A8~HfJgsFaO%hDgTzo4S#9q@=#Dk zJV%7(CZGs~ofu_bHiR`CxO0&CF1yt>j7!shvj53(sxHT=uJ(i2UNb_{Sr>aGdd8vl zxtLVGzo(Gl0&6;iIiamsV?5d?oKwG@U9A{Mi2?cl5C&^hS{+g8*mn+Q%t?&KmvzuP zSzkW-EO1Do<=@X58DZl+qAAJQ(7tJl=zTije z%R}q+x;a}8eE}80%_eXBE^=#ZMK4u5Xba@_2joFBa{bCYJL7BbQGd+(;P+eSv=cmW zDK|f4`?xO0(XMuvlrRIp_~y`!Ju?##eLTmk0;ialKn>)1CwkND6o`k8Lv>{_ySGEi zIZ;|3^i|(_ll>_*;q7WeN=j0ou*s~}_nBvbpUVij@r;1SQE?APL&+GW8|HD6zV23* zO@p=fb|+4%FVOpr_ay*YK8kEcO8^dcE*`afQR)Z;qG2boYIXKKVn-vs&A5QOFZ4W# z>SLGb!k-MM4k)|cMNdr+bI(yxT=Lk==xYFhM%72Y=^spWWd$?!AeAI{_-aq%qs`S%lLd*#pg88?h?*Oi5Cg`SbW|orbe!OBl~^it zcrUm!>0`*}5{q~u`v$oZDLyIotyck_XzKMIc?+}6W4*-+a)di@q7Ut6k=yd`^l4jF zky4+rjEWVnKc$XneW(^s&NLhraaYBMK$ynBu7$MmuO&<4!zU{@0gU%LybcjD5ueHx zwtl+)pyOZfP1c-zk@%}_L$y-7<=*~{QCf)F$a8CdG;KUH#!lXSg(AQtp z;&hq#;a%V^IY*TW2VE$eb1AoLKjz;&Qmorr7untPwc_hgi#OD~(_PEtO=m{DEYflI z32kyIKG*uRM*}DzBSd$dcUK*HI6~IW-$nH&C_r(vjP9AI)~7-4PF&aluni%)IxhG3 zvQ6oj6B)a;lYf=|fbWAR6ojX4drA`78j2CU z0@V)M1i8IGw&@#XWsDso(<0)pop$FAkn?Vt?9eG$4dbu<-e~rU?F)<+N340|NwGeI zE|RYR(y$6LKokj>7@qdtw*?}mK7AMj+iLbKFV*s`P%xzUQn1fXmOHW8-y&dTPFftC zrtP2JKip^jH^xW$@U|Q9;^j=qBc$kk%C@6+qsX=_0X)Nl(NfXNl;ukCKf0>Se+l*# zuI8Tr;?6`D`{zA>22RxL1f9%FJnPa2*dtaLPPia*(a``z+yP?rd`iu&%y8|Xzf!7q z4U)6#49C4kZ`qPRolgzZ2PjT8G3@p=U^h#)pat167tZF8&4w6Aq3j8QmYS;y8W4jQDl8XMIA3yaF@N*wl6w0C?_g-rzx-q(mY9to=Y&Zq81A5_XRM&J+u6VMb z09A@*#aHwa-OJ8wlTQf4rF|vJP5x}oBXoEhBtT;IsT2VZxVJYEGLi*uBf8CaamSzw z9RoKuSJ)hiZ{ACF@kOHZln!qzk!5GN_f-u&FtSPhYAlZWEOeq&O?`c&uGLfs?{#Fi z&2oK4YRJP{ikGG%o5F_bgJr+e14qm3b^~n3-2w&5>quaQvXbHnbO^_JcMH8vcdF<6 zEpuX$0v?|M@nJTJj^pRr!FNhesk+qP4XlfM8#u-Pc7Z@OF;6>U5rOgX)JD%R*|TBm6`qRb6IIfFHD+InlY%a^ah%$>Vr6o%GpkX2 ze5JQUJel@F=yqerkXC|xW@Y%keS)T{Kx;(n$5CvC@zKa{k)Kv{ZDlmpXQ94uadvRw z)r7^3ZhzYyiIv0z8Dzm?(q2^s)og(>#{3xcn}=6+yfQLr@vkS9?GzOO6F?rbu~a-z z!b%}gZ()!#78-}Lm<*y37m}<&r?qYM5i|i0qPXPeN}}!r5G_PH)r(Of_i&2X@; zwU)E_pw)u%FuE>!!mGb+vW+H@t=_B@D@yg$Ph5Ix9dr3nIICALX88dUHv&CO(%)N# z)x!-&g0NQcpSs5w0U&PcNFpX!bXYks3Mi$32U*KD3xFIW8;j{SRt)R0!j0?;JEWEQ zLIaSTyfwX*$4;c81=GQuhk5lUt&oX%b08bs(7+b#de`MJ;G$!xxi5P5W#=x%%bAaH;Do^*i1;wb?j$UEB=qKV02J5%W4y96G zi}6FiZM3ToHxS$32O}AB&-FxdJ(kJT0)gq+ooA~pwY32c>Z^*WCoEv;@KGr36-e!D z282Hay+AxC$7+-_lbdd^-nj|Fwf1<)@&maF(BXPDP_~YVB_6ElTednGH z&t_=_1rQI5zV!dr-@hCIBi~gWoh2h&0+eyd+Bj1FPZBrS=CUF-$3l`aV(n7D>pGw;m z=?$z;JxrQlHL!ad9>k@^J>&^b2D>Lma~t!!FBKR@=qr&_p3b-f`_wtqk}>Hs5?t-l zYKjIOzWYexeOhuL!9DI~=L#YJRQRogkHO)8_`j>_8_n<;oIM*%E~R}w_~OiF$ZqL1 z)jsE|*Iuc@1#X#3`ppb>NSz2ON$ANQ%XiO)>imzW{C1SC05{a7c)2hFf%Uk#=6Z@w zL5U8a%pMV)_MYY|>MpR<7|)cv>h@7CKhcf&zsUOTxF)af|5$5jU9?rf1yrq~fMB(X z%vh~OML`8*Cn_Q$OIAW4Lu-*L3ND61hzpRF$leKph%yoZA+iz~A&>w8LJ~sO?>>qB zwBOh7AMy2q=RWtIectEX^T@MSNIOOVD5dfMU^=(55yxI;a1{SXvpnXM-*H@RG-{^q z5CAov`&2e>xSs?3x5<}{cqUOMFlV$Jqp6VZnUS9W6U-X^?73^~U0Sq1+_N|G@fk-_ z6-GSHo5oF+@|9MuBgW>SRhc!PrKd%Dyxd~fTb3$`t1bhriETExJ$j5?`?5mtdz6tC zmWk>uY|E^-OQ8T>081?W^tS#43K;_D&1wbuAJ1?l=yUJt@Q zmDkCB6`J86+B(o3ZwQj((U$Vy?Z;IIiUMF)uWeS3N?d!MFU(ZU4c%-2DP~cJ5%$eA zV7u)8)T_^Lg`Ll5kabbB-D!DdIo`}I0B_7U0@#)*yjCRg%rZMxWfBcMP>2VSA|D5m z(|1|G=B>Ki)E6ZW&w+G~nsw5m5}1Ig3uq929nwTeZ@NcY?27TrXM6%mjgXb$-l1&w zqv*BYx{ex?qT4?XUY>WGoGugtu!gn{sA2g0g=;U~pX>!dhIIy8_;k8t&Z2R#_FsvI z9b*J2564tXed;nffVakd%GW#c~54o7mctJ3k?LXiDgi){M+YoW{{U}+`=LF}uw z?pXsWqMBK7%X5r{nRD^Jm(Jj3PIo$x#%C$A+*bE%C2>|A7R?ZS6aK$w?Js?N=^Na33UEvvA72$i1 zJ?a0Oi$`q~fL=;YN=si@z4|u4I#^=QMFItU;Y%FP&MDN(ssAJqrO#d)3ig?;`n!O&-=FJdPzU`04CVjaufqciAW%2 zP;t=y#y7CBF9!2_4`N>b-0k;1IfKq#j%k)>ydUH}d_b-{U*gj=+|6n3Q`Z4N8tBC4 zyYr!Xfa~Zn_=DTaVIR!DFmDxA8`QGGJUzB2oiTg7-^<&3yCSSZ&+QFJc3tvjIg49H zr&o)8%9R4%;YOU{TL4SGe+7f#HfaQV_lB^{JX6zFtkuqk$MU8h`i?z_(7JJ8o_94V zwpJ4Bc;-k9yF9O{D_0ydGU7&!@ZSA1tghzE*&jtp$0yC+FW{I4@@ODMSPAcD$DaFB zb$8c-h_V`3?EwbS^1f0T;xzbv(*Bmr;SR@MZ~}}AN_G9R{bC~|OE{O4=G5@ABEupw zKl(6rmUf?9cXu88boAtFgm?Y^2ipoa z%ENNHOTITMKv;&ptlEb(-8OJ-Q%T`T{OiZq@o?_(jZr^gdk^*s{yZc4tDq@wi}X=U zQ+Nz3WBGTmU1neG$_1aNSYJanTEPRw%ne~lE#MsAd#0GFyrLMSUx1)Xe#?vQ09pmW;jcuYi=;P(#Pf5SoW=eDm7Lf6&P*kz|R`+xc)Rsx?6`(Y|W&p&7*IzJ%P{R_|+D&zm5l1-I&{ zG4)N?vK7IXT+AL>djT<#<3ZYYz)>>|@5VcT63sf5v(ndFHi|mlAL@$qG^%`I{OYg3 zcPD5u7xvZB#jAP8fW2{O9{Nw;YrQ#nv1+dUI4aa{3jRyv{;k-+i>sB-4 z0jlcCwO8#JUpk!%A?SlK`6Qc1laeE~2S3|9X3HL3SPQ#K{=%&{JUQ#o;BZ}MeP%_n zt_1!HSpSd*WLWXr@R;sc!<=HJX%2I1EG`@12C5SvD?i}+MM%&8illNvcRW3<4pwRl z-PRwi`pWt|h{yNp>WJAX;_Bz_HsL%sP>Tth*ekG{{|kC=!k72fRkc-A3@9AvM z?8*g5#Z1n1#xdww7iLoO9i3*hP3iSSZ9+Xz5!Vq3YXe@*r-^$V%a9>PZttI>!hM?-DSfqn~sA&6cW zA8>NzN@#(f75PkCcVQhAUYloz0CRsHek4 z+B^lG^#lzWkNhI1=R`sfX;4g(ZSO^B!QTCkL}8t22v8<)_V{}>)cOE2SR+Du#F9$^ z*2o1=Yu;nniO>EOFb+V1mPlLpy02hQG}*!dQmuc}>ufTpMzH2T&b2g|6DI%6TiQwa z&VXW-K^qrs2=7#(@=rcq+meFE2DY4l*M!=S^X|mXCT$2a_uiMB=M@GeIzEFfj`laA z-?*Jy@CKOo+*yyStC`{368{p^C>y{5wgrS|n%S0%Wm_gC$2@95)o&7gVx0E#z#>?$ z#^twOH}{fc8s6bZ(yh+q-wpxxCtQ&{j`Rk>J?6wyc{xb5Jk1ya#T0*OOo+GpC$wy9 z?4xP`Ak!33hf4B^3BqS6{RUklS5#1HoNgZaIb+!}SqLHW9DC=M*hhT`&-6-P;PmEfeZ4I7iy)_rqp7kNmb?=R>rCB|uY<$^;My8RZqf!8AQL#gx zuQN#2r*UsT7WV8i+&MB{lJN?_d;X;}8GAr-@T~U}ceR+{7`39c+&DZ_HS_1qKw7}T z+FZ~ju%dDtZ3sx@p&?PkCM*^`e@Rd(?YQ$iwxf-*qqV;%|CNf&J+4<^ivbm;@BL1K zF`p3uCP>6O+r6770m5n%$#a{3{3qo<>s>LWM28;irzADy*Se_&--eUW zZFcl^7`|PK;+-d&h@0#~nX+fg5=~`2C(}?nWug;SDY)5^+#pK%caw)`C#sWGV|~H< zWu;8)$Qr+`hq9|6XdXwE^Fh|)nF3NvkYfYLCAASzA8?jTZk>D--T3CIRwuscMHdts z2fa%n{5-xAc2`3PlM0gj(`*VglG_vVXvGWkPLQ{XTk&Vqt0((p4o!}J{$@|YD{$7|#tP!g`C4(orgoGK_ zT*m>F)8+ZyCLm6T9?adDnP^Mk9pMQcRRGK^3KR^n{8&(mTlHWH2FuoryT;8VB-YHX zVNQ4`>3~p#g~#444&8Y2%FBwlL~2!)vLPfdL$b_(Z0jR)b-JF~=v5!^M0elFF;{Q5 zewDQH$O{~?LSB}5XGaG=~shZzgovb*t@kg^8(R}){ygb5W zZI@q&s`%rsEJM+2iYw!#Lipav+?BL1GJhc-7{F;gi_)d5HVunLUSW^wg+Y$@9YXoXtP9WIH+k0`F*Mm7Wu9b{8y<+kyquq*4;+42V`W`ER_6fi=Z zR04}~Ehk8C@I#)4nADi(ym?JFv0J@@H|y=57^l=ovX*^G^({+Qq9#|8jMY{&#r4Kle;*4P!>JP7rqB{e>ZVE}Lz z@ks?Nw=-$?h7$Nf&Jk$4KAy+m8}ZyL(oY#+jP_wcGXU!JKohOW)Ih^I9wWMKIx@Yl$=G|@+Qr@dBfUFE4(nB=ZKr_ zw=JgmB;LpKSl@{vb^`rEsEU72=3|o{Fo+nT!gn0(@4a;(wgu(jDQ;uf2I?AD; z%QG!R*D>9NxX}72fpkvVg;vlpU1l7z>YPufm<8ZN%n;!^JE=g^*b2-)iii>T!LSy;fV+l z=SrvjbY0>%y_j-ZLyZU(EijO7IJSY;NyWG-G+5NTp_AL=zEjo&%rRlVby9}Oy1J8n zZu=KXx?+!wPA}BgQ)vdEoVX3RJAF-#xx0GwhHps4MdmEr*5*|kB7`=R-eZ`@R`o2) ztuzyx=Lfq=d$IMMJpyuD2-(1j>d%~|AgTeYA7n0Gdl^D^vQG@8uRqhY#`Zkc1g=PU zVf?@2c=A#CRz96}DQh5Zo%A@FmU(ckoXW^Rwuz+UykKKhW_+GN)w(2nd0~n|xYyi7 zRr(75{`6PNGb3YX&1$ajj$C%rV+w(yFh`rMKoAZ~)IbC~YlFBJ!^{aUapl~VGMwV0 zA-#Yq(590Vtnre&Q6G%|njG9QGd(lv-;|QMZ_-1Y&BRAYX-AV+pB)2Pm#Poy+Bvc; zZ#Ww2+X6^e`+v5bTWK4lM`c)IQz8Z#oreY+&kXLjovsADXMLJ{@To7*BzW0r1M z`-dyHg^Tp)mk~=|Sr+^e&aq-cExyNrS#H&Y6WQOfyK4Novv7OubDqr7(rAew!?jkK zXqK;YaLnpLX(h@_AgvYVFr9b7A6#BAT%}y5dxou?nTvdP8hB{c zoFhI^YX2Zp%WV#7qfQ4o^IjnRd!>&E`ivC(c3>8FX}+ptJ=(h=**m(8&Y_injfZ3{ zDRAf6&|(mgEhMk~vYB4{%rg1=!(9?N3zNgYmwB0wvkw{|Oct1@hhxHwU^)d|py|^w z4fGj<7eK*c0>|Dq_N#yFn8~@2>cI&nqBx+3z$yvoDetWBG7-@o(>-x2KLcejKhr~? z>R-}@R(4nBfT0b5d-%S+Rw)W*`M|3{m$1t)9b(>Wrb?Nf^E~HVq?bD728~npRbPD} zOx=$WVE3+pRp)vP%_lvSAAn#{P@cu?AVqAZs3a29yJHpP-sl$vPTh}f42liQSX>xi!Nzp1KQ&?rEL9CJ zT-_u#2)34B(t_QT-5$7TvZFhbKR^pd0R4{Xt#XOYZs#tnM%C71^18S{lf+J%uqs>U z?C0B1!#-#o(dww@RnP%^;r)Ojcj#CHJFEG=)s1(F_|Z(q%F!FeO~5!~Wm(=WDmf4t zT8hr!C?_U95F^5oY~XwIUB)usM+ojMo!F4` zlGIdb?DNH$$n0qegGrx?CD(kNQ4#-T99wbT1)W4G@N;9nqWbe~ z*$^Sn(AHT!f&(Ol{r4?wCz-UMn8^k~_;*a7F#oS20s$a4bL5-=07H>pAga=4V-y9D z4bxNtTA%l1BSPGi8-VUx6^-BUEw`3C2S&fz|LxY2DMt=9>Xb-9vLU=aIFS#g55`gY zdPUU%J>*^z;n&KNMGoOEg(VZEvCTWd>K-5#SNVcSHoyx&0|IaXBZ2bXr5ObBW?f3D z4AiV?zhsbDmS<9_7r~}DUD7l}@`Mg-?Phggkg64;d>89T!bMwd{eELfl^ED4w#bU> z!d6u-%d3RfRy7;@1J*pR=6B0@E9WK7J;trMJf&?J3(N}eazKH$Q7@} zH~QzS%ysOyymtnDGn%|Y`1$dM=xVwJ!C3XHYAESR z6M3LizJU2c<+zVZ;&qM?iFDr zwaF?}*!#t;>;IazBxfHV@WPFQE@f~v1oR|qS8<@8As>ONIsCzn#bDZyI$*LvwUIem z9Su}Wexf4aq(aH?0;2$8<8v#4zdO`5M81M(kgi~#QbKyZptkX{JKQX!uFxH1K3ghB z7F}F%K5D>?@fa8`M8B#IK*du~<~=MOZ@<8U)m>G)`vZyIF%7exryHoI#$P`el;se3 z54bLb1&B^u37xd!C44$g*LLG+)%f8q?6KIRh|Aun*>BD#2XloRy=1* z9)Soz)gD{S4&QiLXn=Gc_>t%MS4Xa74LR=$E|#BIdi|R8Z6utgQK5u7A@LX2Jc8Th9&*1RePBPn0{fcnt z6#y8al6Qsk7Y>f6G?h)o1czOM9U!Rz!Y56=vCKi)-<@9_iVPJUB2?xs7_#Thx&-}% z?Kd-G_#_n@?m`P?&jsG~mUrCxXz?e(4!@I^LKR={g3I74oY<#M#z`~u%O%xH{qj^ZEv_%<{yEHK zGcRYH?9NVGTZl0Sqi`|sTQHZAnT!<>SM=zA86&7J+`)%InOzP zhE-gvR_9k-789tv3v?mom&azRK{s;P(XdolowYj9JCInql)_dPhM&G(pXo8^Q$v%t z5yKbUrYo0TlNzo>kSuALh!9o9^!j(Ee=(t^7kVkwC7cL)Q{D>AYw?Gk%AXI%&h|kW zBe>%re+^ZrKp!Bt8MLT@b{-iE+z|rSE^?yeb7hL?PjFXluXJ{@6jQs^!Wnip;|sYx zVwr;Zd5f-o65_>W5kIrsIguse{Cp4*g_O}lT+vuj?#D{gu4pd!YUZ`q!pCSmY`sgG zJvRsxRqLP{T`tzwu^<>usZhmix`YR<2RWPOyo{`8aG+T~C(`qn3ZuR~;j{=AtpQ_g zP?L9BLMp|;(D(!Ax*8F;Ft3!Hp+(Lf_;G`F!XdQMUqqXbwtuuRYmDX^(ofVT`0>91 zz|($kezUbL0!-(^&Q4mDCAf_R^;53=O*~w#@3`W5b%E=NjnP+rMJn^ABcedT_eq>O zOZwnb&+it=?BLF|Tmx#-o5t(hG(+(jc$vT^CmeYhgj70t5O$hZ?ri%5NJ`v6u^bqf z$Ls$*gxl(Pj?Ak4=_P-Kd5S4i^vw0fI!GTevjl1_ZS@d_Q%*Fb-F&6It?aO zVy=XXMkFDQLxZn%GwPIGY51Q-Zpp_0?avhzo@BiOT_mR|2Pf2^i_IsW*wdz<4!X-u z<2imA6pf1vXxPIdfolBsAD5Zwo3j;NABWwIz!`6}H*7+2?2SP@f){@*{CL(fz$Ta% zC91Di%DTBNw1>;JVXfExIUp`t(NzwA^yYOu!(d}yM)Yy}r++c)cJ+aJQ3a@Qhd~Vm zet|X_>mB?G!sBJ&at~5z@cskrK*|@A2Q~1`5G5~oHy)A5N(G#F{MqM5u2uF*SHd`j zl^Pw`00DWQ3i=9Vw?QpJ&H?=sHiQI&t;$@ewzFES3lHYH{1Hl z^pMDqpa{rm+BX5tlzgiYi{Sv=I93=hQ<-8@B0csKGm~{e?_qGu9Kqqn5}4)B8pU6Q zPzB(k7-_m3w09FVl6N4IXHPk5^Y)zS;NDjsZ-YuE4qU{U@;jk-VnufG$5?<8-&u34 z^1>0=lg0m|F0GrSYO}jPkDif@Tx-i|+TRLo;u#1uhM`ux==L{*AFot-+XRF9#I2i; zs+(pz1xG-EboUpP|Bj+6ol?XJer^{GxhkjpPA7(@f+Whs#dS?H#m)02R+$b(=3ntp zqBl9iU7+L0@NHNofdnd>7rq#W?J^Y;(&n|b=J8nbQoTC7=0u4fy zKsXNY*~NLYNHdBLcOs*)%j(d=r#94}g#70^W=Pp=%J83a~~u zadAye5}KLFEv^&@f%b-$6qeO}c8uUbRwz>G}Xl)r7II_%asi1X+Ur5-YBwMye3wGhMR7E66`W4qu7Cb+Z@{|RtSQ`jGwb9HN%DA7F;Ere)%l1ptuJH+u96q@KWk*v^`gjrd*5+k;&im zF}^LYymJb%I08M(TW~?fjAgufF_lcf&cCL=jUYrVSfFjq(^kMvK2a;yjUANo2yzUA z;p+mPmY|h=SJL{{a`qlTvun9!6fCEAK>?5vf}1nCg=tX3Eqvgbs5rfE1MJBG3z3njG|9K2tOk#V^pGvdcolvibXrq8ieyv_(PZ#SKji1vT4{! zu^nw}`p~&kdYonEvjutO@aVVA_gpU&FM{pXoXL$nyKrM?0b`O75ecoeRie!PvN1w7 zd80HjZDqfRd+OA{PKHecfjd$vVmDu01iSDMYLxx3iz7;=Ur(fN$&2peR>k2>`$zZv zfmv~~?Wl26Fh==QR{yNZ)4{EJ*pcCeW1@YFVX%GMq3>QkIj3mmwsMO&fgru6NSW4S0=v56KfF*7!d#(E_u&Pu4MD*^ zU{hVSmqlYwL#(5i+0VecspECtBx@Y|o~vIm>}qB9zpT)Y8kuzO>a%6ma=HIJyOW?w za)kSeKG`7g^VeRzOqi`XB#GRYRcV>F1lDT9fo$xr$1$~;;j%dL`&<^l$fyR(G@Jey zzMw=a*k%@2n4~`rN0wt-u36cBp*DDP*1vDYa~E@=6Q{>;Szkzvqj*@MW?c2E%uI5h zzhF==b3S2uMqs;`8Zy74azIm+2MGYBkMemzB$A9sSOYlzyylyiW_O<9rPr+BYu9w0 zqF&izNG>2ul+>2P;n0?M{<~%2GJ*UWoh?@&eIr9+up*ePPg}TmRX(B5EaTZkE0{vBoA3@5k;_eZDh@Dzj(~xcZt{rYaM7T3?Z5 zKYwP~%+!mL_)vNYb8z1Wi|f2jLw!mI8XhtoN0{B^XnjSz#7`uch@Ng|Psu;_(X9I4 z?z6+J*i|85g}0=n7gZ_k9IfOh-Oi*4Gr88EEc}BMIEVu&UpT<59dFd8O`S-yJVnR0 zV3U|TLTY?m&n#kOIjXuy5%?ih&A$G!GCw{>t%IzWHQ$VJKPv3-Gt#)JWi7nzX2{y% zL}Ybz;4f(#VWSD^uT`$^rqr-v24?#?SrTQ~nI(*5N4z-EiaSuM6WnS2JJ?=&=a~dN zH@UQ0x!EZ9xx9F>K-oW@XQv_shQU&;G^+54&z>8KL#nb)5Vw1BOKMmIg}o(Bs1z0- zi`pj_v2D65dDlow%l!~VlQnIF7_2p*-Z2MvcLF;lU3eBca{nO-8c~UwYwLLd+lAH~ zc^4-#-T5p{Dy0(=H^zFEZ_15lU|xpL@(SUt+m>9d z1R@F22Vm@~xhX7>z=|;Er+q;*Jy#`pULK*Oc_P*YH&`DAC##v`O>-8bl}DY=*hxoA z`{1)gV>`rSNZ`P)A%o|HkkD0@vs;KXRUED5^3b?2g`n^w8mQU?%b7UVvzl+#vT|fo zG2)wfe8NT`{)njQj3x)9&Flh19pirtMHN9~V`kR+;#(&Iqy6jfi&D`RhV|S5 z==|vo610PdMfACSJ7BGAG_p4lg~3f_IjrW0hATNZ+I^SCPVS%8+R*boDCOw1wQYv^ z4$7ij%gD)31k7)Z>==bFkQ^ZWlM=rNU)6bmw`fFAAq?R673W4(VMi&pJ<^*hVeb_p z_ZPs0i|N#`KD1f>fOPyNAf-Xj$iunEp|I3L{~G6BP9?*_y!M&!CPRMe%sR(JiS+{g z3XZ!MdK}ACqH!YQ?rwvGX0?bZ+67)#;uVnOn*WcDrTvP*4aLn-(KRBp%C&+l1e$js z+yP-DZvQpc(kQRR-SP@Eo8eYD`7!V`EOo>G#HwU`kV#5AMgt@MJ@>_J9kd?Jl@ToS zZf7^C1Y_M-yt#Y(=*Vvw!^4=)i(ttWh7^5IRY$n~@)lm$7iL(@8WbH}bT;^l)o$1Q-)QG)(uPmZc#%pMCelQdl_fxf+>uWn@a^+PJUsW*0scK+5)oOOS=%3tpeXk{)u8w00**nS^c&Zq|c_$aHR?jU#5ohlgrY zF!Z__uAkJ!!Hy5coyI7p{==};*{bN3?D<>tY`DbGJ=WTSFrO{?i*GJaZ@|hmkyyg1 zBO2Uk=7nY8>4%69&UCX={?Fc-ppj;Xo_{bST@*)I$qZrvZN5YgU?$Yaw+5iCe}vxK z{)dByx9TLMC|~G!9OG?Pt{BXOUdgnXXE#KqNdUVa3%zBDfta3NJxDmSN1xJn1n?6t z0L|z>snHBNR+tsXz_viV!^p1~TESQSZ6RkWLrEkDUOJc$zYf!$5 zMl)pf@L)wgK8!jx9b;)&P(aw9wi-5iLt{;|YRD-_i`fNmfZLGG;LArsaOjF)AtVps zh+@H53!)0u6!)yCD&5SM`+ClbLV*A0`R?Kx2g(XswEI$NVH$D(GZCWPoOi!TaL;LiquP>c5xZpB7Z!`DKsv+`6@a_k6H;VLx|IuS`fQgoul{lTgZ66J2=!tB`N=yK8-ECzN|j-K8Ic=)EyG; z2Zr%vi@$NX;&c4UeudvDpd@e$`2p^l0KVYef0Segh0iV1_Im8{ei%J)o%TKX0mP4p zx6SQANHnmK5CQ!3sPH>ARMY>QAJC5ku2|8Ej4*Q33jUP}2Vi3_b>!qV;fFL{EG#2t zUP*s%%;)<4hmQ}LqVOJ@kaxKwGqR*Ugu$2BHS-qsGAtuNM3Exgt0kDMIX^j;2wBE| z`QMTi=X6wW6d*dq6p!T7_~B1e(6LF<0>V1-0~2(a_p9$oO*=vW?LUSBA0x3SkKfOn;V)e@yoV`;nHiOClrow?o-IEFNvF)48$tA#lU)#zgTZi20LPI z{_n1za+dewIQPGnekLW*YHVlYT>k>Q^9zU$in;>y6_cjl?0|tq?++3LvFF+X(DcOq55wj2H%7hlq;JA z?~FJz(n&TP?xl;dZkMJ(VOqikaAupDut-I&pQ{|lWLN`DdeP-$2c3B8-xFiqoy8o@ zN>k76AkMOsG29yvJ1hyLcUk4WU>)!D=+AWB^pfa_L&&wOK_tHLp_b@$CQ<1HMYDPu zhZD$`rYSwW#5Nh;DKSA&599PJ_vSrp;+hjA%!bH&nRK$TPJ^)gF0utsuWG*!r;Ldk zeqF6H(NIrxvr}SVvE@JEW0|O?O?Lg6Kxo15XrxaWC%dg%Sv7L9)b$48H393$ebXg^<0qRJ!i(PjpF_(RpX*6EjM3v} zXw!B=dwi=!u<+7#=cPv;W#40Z7CY%*t@D?$MLXGHpA!;q9FDxp)u+mHIB9~x;>t@&qP)fNIQbjwR`$dh(wSSLAHjCqR>WfZZcw97GKQBK4JW_p=ioHySlt!F|Jxs4s zy|YkF)C~}HfMLiWjIriqWOnMmNz;~Blkzt6!KH@J+r0)JVgS%ZL?-EG7krh&Ak(1ul`%bP2`q)!9cIA)HtwLRdZZh5- zg?LtzJl;mPr3s?@q|0Q`vwy1182}t`BkQ=%29b(qi_wHB7vm=J#p3_vu0MRjv=13~ z1f*2^avPVO^WVOEMGxi_mNg2Z;h}(H^)jvriaGO*72Lv?FB0w_n|i=Zz|DX3F1OtS z9c8at3vRzFTegpIQ5L(5xZTS1G@@m08&r?lbGhx;QI27X00ml_}%);66sXbm8}Xs*9*wi%(ve z?Om{fyw$503A2q*M&}!(xaZ^=fqOp|(?emloG@1=Wc8dGWGjnyppiqES{(NQKBhJ6~T$ zq*zA@kbi8AEUy`>8z9AWH3!8(aMd~up+A%@(_!f(UEN`|?>?eE9WN1;TogSH;mbeW z$+kaqRJNy=(RrVk5}2M=+st343+&-O*an9I!WVf)G)Om)wI=B*=Cu3Tq`x0Dvy73wl{}WJw^GtT>yf_kv;FuK<4?;{q>00O+3lgJ z&L~6&S1qe2QI{9D*6ukIB9oYTR}UXL_1l0k_z%B*4@h(!|Ao7@lql}E#rK)@%A1<( zioZEZL+&^F!SEguUQ{j2uwx~;s(P@>q#UGIKeA(tIS2C-8r&g+~E6wCVedHb&P7a(aRX$K>%mryLgj% zJ^8S!S2d~~*yOv+tUt89Udy~=Jo#5%^9HO}#3tt&$dvcKFAz zXXLJA{py(jt?gt|B#2Q!$fIxTBWWi*Zd(Z(JE*3S&nw|jtie+I*Cr2)K(&u5Eb4ve ze`RE`>y0M=kK?YOd+thT49aM6D{;;$7g5=a;>gVJ`309)nG+pJ4g7Hk=ubN z*a2;gYF`i1-H8_g^Nlw*`bPMB=Fm$ZH^D8J!Dh8=Lmi{i{~+qsBG)Mg^+Mcx9}=5k z;hecrA2te#G6`Kz7ihzlzQSH_0-nda7hco@Dx>O<;OudfSIIOjG377sACqo9ry~`U ze#Ky~(-PG*dN6dof5%JyXROJHd}8%Csm9p?c-UKG$gWxd6exZiFRcPbM0~3YLQ%C~ z&Ke`~OAl(Wp0?uFYlffSv1r`<+J-szN?u>R&)(dLil1!_gn`wUIukEs@2cyM>gt^g zptyMx=3BJk-|KWLX8&9)!HXd*BYUb^)YD_K=;~4pv$g><@i9Ay7A1Us>bF!wBVD_7 zSq!%p{^yM*94B}f%iMa4RqP@U!R_mIs_`9QG?JV36=oA{K3%Kfd=)YS4Fdh6Ag_?o z0afm{>A+qd(Qv9{awxX+$xkLfZ(nP-HjA;pg+IR$3t40Njfsy-F4cCPNvs)tm?V}R^QE1BUK~-v z!_V@V&1nPzmlJPzA=~soK<&lJPp-tOun`(g#+x*V0!FFfbk(s8%orq0{KWJ!)tGUy z`(oH$b<}aT73EbkZ!lamee-wU;qCQv>-ygD<7Ejo%ASdbOD+|-PQuF+NdZkPRixGw zNabJTZA)SqlF6!>qX1d+-WLEn3)9F@aY4$?U{>h+Q7yDr(TDFI+-k5dx>vYmWv5{h zv%T=LZKjZXcTzV*Ib9YHW-y|fzbc`R%Mvo8Ks_L2r(Okr6%qwtIbMngvdt zSQa*CRonymJk$VX-PaQ}QNj%<#Qi_qnlRWA{?I#!_p^ZaU4cVFQw9i{@D^4si#&jE zZlT!vbH+}vt57llT=1cmur8@Ra@Hko%AT^6Fn?QNN89W9HJG=fw*JTK%HnkqMZ@>o zXu50SnjSPa{<8YhaZ>0*=AcE2Z&Twk5QI|`hXJ+EW*t^6Yu-q{8DgcD_;(zfW! zs>P=6SSdYT*I?zcH+M$1`nVkcBLx}TTlmAOpPofzB+csfnR;M@p!L%`#nfRb#obDL z-LODErVpLZQog3ZqZmG_`RVKD7TFx3&ZTQv0W6+t=*S|>5vW*MHEqAA3GBo78tQyV zh}R)(+WtN1;T^_bhcB#>rqN`1`MZ7B%N20BcU1c0cj7xQW-Tq7W+y5x49X`yex3TA zTEYDC^{o_Ld3Nk8&AdWSN6S~r*C(_D__?0ADeV^Sx!IaISpl=#zyc#mVEV;t!PaYl z|L=MuS+mPfh@$z*u$%KQRxf>*B}|Zb-|fmeetnC8W@PPf;sr94SR@)cVb5 z(X@-~Q<9^wwVN~t{ghy@ix1;w#uLevKO6sK=CStZN(3&93-?ApKE8i^|L;xNIUCJh zJ{KCdXe)S4X!HV*K>3Qz;j%3 z-j27;sav`9=slyJM|eVX1j1MPv^<@KnQ`Xu zBhDs?yOA}8txyKdMHE&kKlta_As#4_R={qjs(oQr9XM|J;mjfKgF93fzWvW51rrq& z=uqNp5mNr>Rm~4SJZiF5eZUb{F}vX?UUU0(DuvIVA$mx!v;b$BUF~x+nX3ZT8DyyCO zoBNK_tw7=Gg@z364D=sdDIDYNHum@5C3_kBMt=Cg{}6;@HX)ZO?`Taa`+>Jg1R3~TJ>-G5$?|ky zsi!quI9P4Unkxd^l?ORnkM=zJ18Mv!^I-(ycdq>}NQIMYtZ(Aq@A60E>6n+oHE~md zn(5Cri8vvTXyCXd-#kpY0~{R<0Z8UD{u)?nm}b?}R%YJwg)gH_F2=D5J7Ymiw8`4> zmNY>%L#iLL`~8B>?BO^Ap0#j#ag&`3K>-XOC{{6>kW^HY0SQ1YTMQ{=B&wO$UQ7*8 z-P_rN%!Jk521pkeK=ja3c#FeLkL;=UJ+;XFIEV?#mi_UdTs0-tdmKKZO)uaVzz@x&Zo`Ctn8QmIYF_5J;~HWEgX8)`Ey))i>^wU z-=b?Z06bXZtB)J^HS;gt$*p09jvtIdtS;u?YD}7V_!SJ6dQ8KMMSkAYY2)hCi+Z+L znFUkp&LGSKR&yd3YPs#w=@FCkYHqSF;V8-yfD*?wwZ+z}#io5FB|v=HH{;)%r0mo; z+x`5{@DJN5X}^L!`q{bpocXT)z-hgQ%tdJa*Hlp`7o^L z?l7%yeyCz>$V>pF;VdaE3O2@=SHdUvr6zo+-S{`^?-XCTf1QRXR3vmcdhqmLQdI0)+tZ zW6#Kn@{ENNZ&#CkeVwFOfXRp#rk~8`Kd^#Fg+ohd*@gvFkoXt5Z)ff##QXw?bA_Fl zE?L2N=K!Y3Ud_=kcU`gUR^uv071kfeTw_l}^xRuI0jAAE1u5^M?6Cjuk=T6FyP+n)?D4o_rzPMcaThh=^&gYeFbreL zSVwhHl4MT|?unFk%+&8OI+!>5tdD)Si?V$9aSZ;Kews_M;#ur)(;iEDV>*u0@pNJ} zU{C4}jX0dErnoKiysR_XcIWK?NayL@LM_G;KD-+<@2KB;*^M_pmaTje-a~{B^x$S% z>T#Z1$LC#kkkQ_S^Kb`TLylvM1DGdx^$`HT!H;!i+*`T?4glCp|Gw3Fo?aDLSUmY> zELe4)cDf=3XUFZZ!WV`236MR~T06l*+e*b^^9WO#(9bd;g|vE#k$bdJObi?^)#bjshz>0Si(*|5%tU-2P8r(Hs|@_yK?PC1Bx9SkC_ z>vT2}1mYhoggeuGo9`#sN7OV!D6gtNk~6#K|2(%l#x!~+g@o(sP#L8VPp$scnWU!+ zsFjoM?YgtppSzbm=hCxD3$)-YQM;a!55QF*U&(SC!x_}*oKE8nq*G@dkCugOj2mzT z&y63gygYLs$J|-7%jzRIMS-Sxm~6@CoiOXgi8?aRE%G?BF!0{W6g;Q<96rdFAqW@QQ(2?qiMv z4H8Y^LV4g+jk0Zb#6Gdlg4QBGEmlO14y^13wtblSkvS$-yZ0yzY@p+k;{R-Qg5s<m;?p%arzysBMOWFg^ebw3A=x4BG1vSKW3mqHuPud!+?}T-4Y5M z{or8{fQ*SY%&%o8tsT$7rQ|s9%vrLUdsi7&fD$3>n9145(DsFq7wpa&;g3sDzgU?e z#wIGWhW_RUq_E0VRhh0AtHDgnvs0SK413U%$(glGQ{-A5@^2_a)hCNRN#!Arhifq5 ze%!4v}^0CZ-QR|>1l zgC19>OOsC!0b7{I#4>>B!dn2&w+w)&Xg>QQG8GkRkb9gNr|pcmcM6jkQE z3%NwxEi^Y^PhBGX-V;7BtNIkv@EwDJ`URYIiJGcU^2{TspA9Cf@#CsKKqTZ;H6E~K zTw(*DpiL&xeaR(6KVhBR!B-)!f}$%}=>wC>PZ0-?v{$6= zV{_C6QzT4!}C0Q+WE;fjB)J6U^f`~#qn?GLLf&e4G# z4IfP#eiqex|CSiCqJ2M%E^r(Lv~yB8xVy?hCQoh#OK89w*r6VDXR_**;08xa!mh}4 z+8RUl<^|HCo(i9b^#5840a`Q6zwG!1zU&pAcmn%GOJ9*UAXyzu?J4R$(5W+jHR8-o zXl6#JYR-JX8+MI_Ng}{ih}D(h-5_1XF`M}PTeSt%!BXEIa6c7x_JBq(eu$yCTc1g@*kr1#}=`GqUd_ z>CoR;k1knFp>fRi=Oyb(m1bWY12J&>nJJ$>IL|ONNEYqiovB6XDO&PabTI9Eh!X;} zx4>yV>R`_59a`ILf03u|MU?AnFiyA@m`ld~%YzDbLwXHG{TMAGiw?#sSza>7ms!_# z0M%_Dz!>9x9JV*yybRdeJkbBo>|!TiB-;HLO3cY9aI+tX#8EK)$jO~sh^oOac=gE~ z!@ZUUnId!$3kdOfNOi3aUtV-HU7?0W7r3NbPv+OhWDQH1Sdb{UCX21*OtFPYGkve* zx>A6)Vn4%{wm3H1TQp6c?JuM83d=as^&q&N1e2bzGH?#=B$~;HUf&dKotQOeR=Mvu zNyUNc&Dwx|fCFwu9Ym1!(z?IVBpg_3DdV(i4+tIX=(Tc-1IJPpuQ2AJE{oh|jfVx! zD7ey6L_`}6pyYJBE;I!~Sw4Q)t7#h||=Syu)G z`NUZ9jkMg!658Nla9~-f*m));nPQUxMa3;R`SnSAcB5@z1Jv983`et-(s&C#j6)am zrLUvM>%z+!Kz!Brh(pt!GdpRx3>nAbBgdlm*43F5D&#G6(t7*7X>;D%1s6e40S$Pr zpb@i9Mzqp`Hbjd~7$CgOEW^)tDi)T#x6eHfIxBVMW8HZU!gXRqkFN&SB^% z_f+DV0cdb}Ooi3vsl>;2TGfFO8ZMF1=J4NtJ z;<%8$Um0my>W61WsRc`Qpz*$ng=iBZZaiEB9l4^g2))=s0$Gy+S5<$&76n(RNLg3_ zbh!hbAwgFb1F(glON}RREP^Yadx-AfQp^bs7U*{YL{D(_za!LVL9^?^3QI4xzvo9* z4WX)txBG&8txoGIsU)uwaCn77TO5h;*u7OrI5v3p0HC@0N>z|0$CsooU6}flSRu>F zO>)78HB0?)!<+ECai44Nr8tA#N;^qm?`#}RolUQ}d23mR_ z4ONA%&_%n!lNrUh`Y!^6w(r<^p+<~fnZOr1toZ7}gusxvy|rbupHc0|6LoLpOcSRV ze|lcO|2-ucPD;bGgk>;Pot+8ZlL^vaPWKey7Sg6!+Dg{W?zAgO>7;9r;0Sr5YT&*w*t5S zyea_lBA=C#umd${tu*-;!CiU^or$uXQAcHma}LGa#>LhSp4dS1wzz~|2bN=ARo;UP zT8K^7owpavYm;sA#nz{$-y<|c8ND4MC>#%gws3rS!n}8YdC)0G+KHs2?pIu5vG1ou2M4n9diX>W8KXHYH|Knd^-V^l5lC zo_x=f(cPU)X|7~KSVV|YoN$~gJr^Gq!Jp+F);#@4DQ-x+FMPVcW;`vCs^AwR3TWz) zH+U~Lq%g;yS8B+lcETw>#mnSJwu;y7=JnAg2C)VG1zhN8QIcsam+lp_I>sAed;#v_ za=6KoyIL44zNsKQ#QqXrZvgXR`(xK)ZhQA=j>qPe<2ZNT3{Qbavu4H==5)DEUw?0C zp?F+2MKL~7(yJ|DS;?Pv2tPOe3_QW;x%>EHdVOP9#E$Vwro2IKt({r=MDBEPdL5%p z7(cWLRmDx~e+E$c#w?6uy5%e@eN^FB(G*Jc98N;=qDp?dE3o@0fT>*a=-Tys2tjrOl9 zLqqFC9cRtKmUZ*#oZw(^>)BPJAX$aXu|Q|R=96A_6|HGj{^1N^*&|Dx&>bp?>sBH7 zvxICy>*@oNW`v0XhnJ1ev~gk0ILM~4&j%>$V^p-A78EeN_a$-jEd3!fgB8!ITzo;X z0#0oqSBMe%XeBe6IZdPcn>V*%oVr7atz~s>NlCPn_tcA6@+EhiNvnOgLd}))=34ap zUSIB+=Lz$})W`g_p$?3PD`gQ(7rQ>%s%D%ZF}ujD<$8vHIIp1haiFQ)vVWYY04ADL zmNic)74()~^_-VI$HIVD3;2H&0KJW`95_4Sz&RB%Fs$RQc#SOVKGLsld}AuNyt6b@ z0arPGlvog%*O1qzA9nw?P@76yfLaHQ3mu^|r;u8@da%05s=YR$jHo}<>$vw$?~rGd z(C{^aiEg^>CEok=!#I_BmSA~-;{&@os-8xn^L}H^UN7zQE>D1G&B`}FUulu_ouCLU zrcW^a>lU-9%sR$f$8!I;#y0yHe@4r=sSw$IVUkGY!GM?zeO0Ln5{Uf zl*=c^VYSglG@U?(sNcTj&;f zoKqCm+qJzbcBE|7@Whe%6A1*Z#eVP>>djR$;H@yI@-TIOEGL!2OSWIDc>jpL!29)& z1q@@Qg|_&EuIRd!*4JlBEXSYM;T=@q9GzHwCB{0cb<*ETdr3oW$DOXB)0?mNZ7B_^ zvD0-I^e$*}%5>fuQJ6-tsb3$Hoo(xpu=#l(ej=;I-DSr(MZR8b^q8pO@V+co*TC?C zSHUryip#aSdb0b{qtn^uDAddStLq^YUz~b(BP=eiE{=cprkkFU9^sTZG1Z(jeN>C; zxYs`plcu}>eH|+`abjU>g6wK2u`Z6BtBJYR40O|s&{652h2Kv+-SqgmWdUKE?=i=> z_+y&Utr&tFUcEU<)=RAr&ueW|L)VFt<#ZP$+lLYv=CLY;%dHT49qx3I&({!=rm3|w z``ifm#e|Q=p#nj8LM(o>$G-1S+z(Gz6a!C2?)DAkpxNo%(LVlD`YvwYOpok|v&#cE zx}$1`m7NyyvgysENeW&eFTMEMdsiQx9^O7)&#ah;U`{`@UETaV=De>1D}KFE-!sO= zC(_B$dHwg}_Fgs*rR0z1WaefHbUJUNvGSfcP@_UA#hxp3>XKfUBbSZ!Y?Nrtv)!Dk z9Rw2Y81eX(i!?$CzH!c}Bb3B}ve@{(KORui2R+)Or%5K#ZPl7x~FQ>PbQW zjokoOhI!3*RND^!QPk{PvWPx0qVSS%ETNgS`FXi209kaNc^%JXLUpzkWQ#hsPSl)z z*3s*W3!*}Uteoa+T&R6adCus(tq(0{?X~j)d)pQH^eH(@#SV)FLD*V{2a-9O;GQJ5 zGmi+PuaQ}~x`Yzq52p^fi}h!{zq?s?S14(`aHXa>rG4i(!?N}AhV5A<`ZW5&c&#Y} zd>1|%{SJm~^{{Dpdd9XSbUI(2sx%@UkvyZ;HfvmXR6kq>35ArUV)?lsQx{JE&AAww zm#M3_WOCUSLc;PcFNa8%lhV~=l;;DUIwc~xOU1p(C=P!LEhS?+Ftt z!JFlSRrlQ|);G)%(7q1NEn-yjD_`uE@qD$eRgyM;?oL+s1%WBVe~! z%41y_uK(C@UZT8H#1PNR@z@njBW#U6oekEDls}tIsomjcJYRs!RJ?a20W`bXs}5_E zQ=X_}N*2(e!7S$6Wc8@_XOWX4AyJ_>Dd@bhgOeh2x@6a#F2@#T zYg{tH#bjuI{a$O{kbykG-cYnmoyRLNs$SnDeom#Wj`~Q)U}a(dVu3$EQ4-LA=^jyu zMRcGR>(zdx!W#3ujjSq1Kc8z)(ma2QjLNN?Sc0FA`RG(yPE<9;8*KYCDw0wLtFPAOo^pl$HUJ8{N>XL7ShBHk{AZ z-*oGOo}S)gb4jzx)}*ER(|Uq|FYO);pN=_`8f`fwj;l>5Iu5nfNTa7aOac$M@Hzv6 zF5#J8Xbz)DBu85oqPhIJR-YJHIJH3;yZHy>B-ltGI+)Z znN#T!K$R4|l}0cTMg`k5E#2mSC#n@bvf|==cb}zBHzX$Eg|&3AlrV=mv~A1-tCO01 z4=s3_RX1352c0LFmGHPk*SG1*b++U`8ft46t38}1fdk!WerHQ{$C&h`2rV8ktY{k5 zpkgYN@WcAp2#9$yN*o#7)|EGOl?v?2{fsnY?COEHubaQ7$aUBHHtj(92!?xGfjqcs z(4X`7=#PXnh02k4#A#H;20Y)GN)0B~Hs(GULG<#r>emN)nnVjdtYe60GMC)P+sZNp z1-d!QXB(ffxM?}BC|Ui4uuzH>*J9SFOYsOxP``jQ`n*J>QUNDA?{rjPyctW~g$Zd@ zCqzN24u3S*nWaU>X(q7Bsq@k2YI7*V_gfd<*Jn5%i+U@g>J%$T!;upw3WFmO_u>!p^v3YBTLcex{L~;bvMwjXJpz{b?xjd8v z<_^KyeD|3)EW&KGx!QuUXp5vB79=rptE@|Pj1F83Gl^{2g6k$SB11`xBi-2w^C#-- zMM(WhT5Y@0aVw?i%o7aY2ZEQss=06qRhopJBvJF`%UCP{v};21Tz8>e)PPN!x6D(8 z{!8iCT(x`gV+CV*J=6ILEfu5ElX;xLOM*?go?uM*7nsO19a}*k-A323960M4clk0& zXkj7ma?OP-tLgX(L#E%y8Z@IY0F0Y=wvUtL?FJ$-qY6jU-Fw`5Ztx|_@6xAaJi#ss z%Zx~KKF{)vJyN|dLMTp9m~0cX`FV53gx_UTigC>QxhkPMU4??>n{&-Q==t8G$E_aV z_qoK)$nW-39Kwv7z&sxU^E|(`%zUm6p@POiqme19VSW>|-=3QIvqoo!A3|D$`QJUg zF$haj=B3R`CoA+57xVj-QgxnhIT@_Y3v%{M=W86jLwNxsEN$kD;EGY0y*MD4aI~R* zhsUW{hx%YJ6>T7t}jKcLQit)U->D$ai+x=np>*B2+Sj z)M7j~ftk+(??j-U*koOeehf1uj>zJBf72s2owKiPIN`;9k&{9k{&93ezEDb~s$Ey_ ztX9PYCY&=wf%9j(DCR6_H9HrJX*kGJlk;krr_nXi>STkoE469bhHihprn$q6a=J5T zX}+X&fy6cZ@JM56nU{Xj_|Ya(lR{lvXRn`r5=bJ1CQCy-y*Z!vUYWmMSI_Mt2S!d} z9ZOS{VMuw#h*XN3j2`f0dW8+4?|N3$5TvCX!B}-{^(DyH;6DLyi#2lfzq8JO2>oAP zy!c0e*paBV`o503cAz|mh{1d z-1`9-C{dB2W$~IkN%0dqp>ntQp%nukC!QNz_+D;2Fpk(+CjSul4)yZs#pA)yl6%88 zbOUGxH5jUl-Mwi@yC&5hRN)C(Jq3sjC3ZaR;_+RLiSXLcOHLQ?Rn?&Y=A7AHSeh@B ze-wO$dTAF*<^<&}*3Ul$%LzaY?J}hvL{iwQ1uSU;pjJ~SNQY`BKQySJ1d=bF;@knP zEmdu<_bx*87a*?Y4}cXzi)y=94=Uvq3rIL#vjY;0KHLy2LEqhrO8jumNrG*>*d63^v&> zSMu;iIb+9b;hu)S_Wl!UmHRgH$5Cuz*1=xlDrglYGRUC>Nztn#Z{R;Sz3?j{96TNg z5*{y@_AB3e&~T_ZKQP^?P4n>AwmO77d@tpeYe>X9Wiuc)FBD#6vsDWLl6@=O0T6t6 z;B&I5JNhf-?U=v<&=-p!WEIjf)O-izh;_&UyYGd>43*_5@P-1^5OS(0HAA7h+x`XU z1~+miL~6Aya6C#GId`o05IkwJdAm*kBs5+d*97L~slv|){Vu<`m$FwA*K6}BCRS&C_ zg51V96w=ZO6x2X&LvDxw${<}9LQY5!-7vD?cU@!~c-)W=H!k%Ks=(fUj)to@Ajd%S z44v}u3#;H~v3z8YUI_~stf~Q4>{KZtOaj^67`MoS94Uc;yOrAvt7VOB1Y4UF7Xcgj zJVuU_bpcm`qIt+|Yu3SV2j9rU28`rYHUZszV~l*-l2+8@9V7$WqZ4knYFfBb0E%#9 za0@>8r>!0~IQwS0NKINxC#>bCP3sbF*ucn5{Z-Q!YVa$$?*2$Wk(*F8{1Bh9Z&kB+ zUIxoY9yVcd9pJhg`ogC;89vbQS`5+##Xc#GwR6F*u-p)V?0wHcT_SAe2Z+KW$t@kQ zN+?Cd3wfVJqW%T1_67w?^G^`3n>1C;LWI060IXw z;V*o?gMnk=_Nm*S&N0ivW<0eHcAQwGWQqK0v3w2e6z<>PC>dqjk^2$+Fu#fVD%zVuo+kluwO0IV4Fp%eD2^5xP6O0*smyEq`CrP ztrVC5dDy*E1bPQ}#e;LrK5`V%0Gr1gen;8(1Tud`cbmS>(>o zT@rzh3R!d`26l#kV=mF-0HHFOYxgJ|aRI!Id*&1j*0j61f8gR?2M{ z=VG<6z8c1WT~?;`VWTBJQZ__z^vgX6X+GLVKXG9E5x4{fK|(4_9jA05 zU=24Q!1AesTa|pe1S8AG82-5VU|=@Ff)=)LN7w6rVzR0#q{IstOKesi1=P-pJFE*c zHEIuhq96J2^5S>DQ;#G?zSim%5C9z$w{1OCS+X3GqzTE7(p)nXrNu zKf|>TeU^3!{)}K1*#okuK-{bWpGT_l1Qcw~J%aSo8s^$~GsFVcaLC6i>Nv%$KCyw} zAf^j9KK=^=hbj#?JQ}2t>c;Sa9I?{R#1&}-x87w1S4Ozor|XeFW67qN?KuND+!}%q zazz=#PdN}_)dC(v9sct*A`W5ZszKlY zctl271i)=0B!p~cTEvEZ8a9xfX&=HB7$a3&Frrwgvfc8_V5<&fp75y9umkBAa^Bhk zix4h*gBOQ@lTFB1J<3OG!E4OyF@JTb0o#XgH%->!Y~#ull|oB2ee||bKXiI z&-iPD^!HR-YctP$^HD(}JR^wIrg11Hf-{DvLfDZ2RZ^&VMBtk021#_hAf5l+F7Kcz zXp;`)^8r@V5D0dBY4M7(+(P$JFkOk?fVjEgrgjkY0&i~R`Qe@LpoTJb;7TM1-T@Ns zXd~f)a<%|p0gJDHNK|5*SFZE@h&^Wn;Gxr>gQRNT)$4GJW{B_)1WZ81?1K#`RBGZ9 zryZP+qT(O6KyjeYwmK?KreVY$%K3eSTG3BtVCSLS_gKS%(4Q&rl%a1xg|rUXR352? zU5dKOa~UopLyHqfd=md$9%vp3q?aICqVDL}z-5dU9=|}`YI`oMg~E3Vbmj`8 zxNrW542whVffcj+!C}HzKtqQ-D6>Tcj!G?nXxPt|`ts*JUhtIZ7clk=gHvE&Vj#4~ z3k?4aGKdW$e@p~N5PVFhhJE2_D$3%TKh%oPJdyyTG;U8nsH+BLBDIhhs%ro6D`<2m z7#?IHks6_2F7-a;0DWR7 zD$u2d24MY&PBxu_FT@OJpY^YL3)Doc4}Pio<1>z-npOyRL6b30W`NUPA)8TzvtM7SPYYJ`4~B91^Gd@H7%RwNB)82iF|5n21SvVvcM8cEnqX5s%uY_g4`OTW|HT!52mG4g z4pF=M#Tb{qXrA!p^3vzg8MNV(gQTV4^1o0yb-P3#BO@cqLhU{0HP(Ahhx68g^d8KW>b&4b&gJ@AM2)ZuRY#K-uTS+! zjC%*e%H-)xbwvJ*tIyjRn_c)W@sIUU24ylNZ!uWcsz};F^!?-q7fdAR+g-8?hphAt ziDfd&yU;;UKC!US8MxH0+;7?k7q7=dg8CjOnXN6)uSoJx#DB0hoWgKV zfb%A(Q|4(!EA62C&*v|f&1VEYDc|0mR>!!%+@xY{Cf}U#gpsJ!Z06XQ=C09ZgQ{!w zlJ0fv6^8mzw=%EXSNd>Z-G%LsHI#}TdgpHMJ|f>&;})qNttWU=MbH>4o?W;g;H7c1 zOSjDNBga{&xx-r23o-pp%f*2T$9~Qa$&ML`@_$6+xKSc)7d-t;TE3IOWtXR2`P^CW z@Er!uMF0l$Xllj(fzU&{kK4+RN|ovd5+d4;|T`R}UgL52IAyZz^>flGDDvBlft<>>r3 zm*xVK?2nbq>hSg6ZJ~^}WQ=L2v{;ubpAJqRabXMD>%Z#uY8i+?rHlV2M5J$DSb>y?SjPiDS?m3iB{56D*#;>QzMO3g>l)xSO~;eS|PuFCWCY{0^z zoKGR8zkX9dAE)D?lJ&Y1eLs$GT?_f0lRqG=akkX^ zV2xj3&69%d7Sk182V0~fnZF0V+1fIN(M}QP3kL12lq`RBNH>gG;uT5}^9I~GkUxp6PJpexJ@>V-)oy}hs;GPcxUuRnO)nV{9Pycb zl@mV3=YXf!21GDRmVrp{Y#Ad>{W``hsJV0$JBes}P#-7&?gx0OPUt1J9}iCwSp+g{TyLQW*yy?_T&?t}g?jjiSMff8UUIF3wss?KroOYTZ6 z+hr#J{qU7`dAdSr_bG+Q7-@yHY@GBM(!FxzZ3=j%N;td2ZP>+)lHUqJB%Xkz2^uj2zArCD9V55-ZhI(wM1GR> zsXs~1sp+;0;D%A3k_6}DTKeS^VTs#Bj$Clp}g%N@tTt{YyY(*gL4h5qR>Kik z1KeKn-)VgPFpSBnhNDWh$G~i^Luv|T&NjMpTtJGJ6ZuLg+MKQ(5E z@U#~N3yN_g!>zU2)M+d6I{Vb@dmJATY^lX8UY7Lo_YgrWe|12~NG0z{=xK78Ef)7W z{w3f=cVtwy*7=`QW>4X*4gSN*Tog5DsL`wbloSteP8B8Q{GXb;$RJ7rSem^ga7q}7 zkUOJMZa!oL`0d47%59_~$_cd=xd>9az(ffCT)nDOmZVKjE!RjBvS8KupIUgp*sci} z_tPRn7DO=tOn3KWKRrSEJH75oLdp250-YtOd`Xf_UD5g!B&x$&`T%P9q3`hLhfQPC zql&aTw*y8*;Qr_9*172#M$_C!(0Qm6Zd{3Fv3&H?dfmb0d_QqMlB_IyV=enN_C_1l zjrungE9gr(#bq8e*7UbemK#(`soK#xH#t8u1Wk)kd5HTNuj@83Y~zB2{KtO(Clr0^ zV|(0o&q-*PDNhr2Bx5T2oMo>F->r_eKh}8y8arPro!sPgB1);IJY4%5ih#{#_67vX zHW>=QP|BbLCK)eBKk%5tYWY9ZqXEfKeTsDuTTiDH=N+#-`@HWz^zo4P0^z9}xFJ6o zGA?5${~cglzN`WJRck@Dv5Px6KZH@nck@z1<>y`lKAJOD7L*@m>Pbx`NPIS_n4>>h zw8#|-W#>eg0B39)T5TCv?MrB*ekJ*#~5qH5(y9hram4tTv^w86P*D zsr};{zIN`{#KJ~8EB;gV?o*6_uSCu_sGy1e;ud3fLrm0ae7%z=KZWtpfKB}E#X$*l zUDNx24*&AzTNRjs*Ob)ik<~u4Ic4E5|3V1HnF95L)%qC4CH>)$X9P9`dwM zn1}GghI%$8tv18jU;Bo$?BCOMNT@fur+u!3?lCbSB}wjw?vq3*oL{L*+DDuDb2PNP z7rTku3!L{gzu%@D_c}y9F1P}#nbaiRI9OfyHLtVW$X7i79XD&}Of5~!E_>+LOlGv< zCC8RPLn!0qkNZ=&X)_k-;brBs>Xn3Zpp|;vPKKp(ofsqBrjPH%OgHJ%$X}ja{Cw^B z_l*%iLv4Ps-*Tl%1S?}#0ksgy#s3Guel~gZ)ex35Jw3Gg;fOP#Ecf(esnr; zG4jQs>4n%r%G?Y%EBkQ~EMB4Fg9p|{0uGs(cK3-U^{>k&-u{(LPi!8hr+}yV^Oh3Z zNU|#(?92$C9RkclDDI35fYO;y!!tXILbk>9*Gw_lV64Z=Vk`Q$~ z2#M!5o_eP)4ju#@CFGb$_op9;63{}I^C=n15%p(JQ~BS{bo+gBE|QnvDk&$7)>@xE zXuV9Un=2&L^)q&p1BKAg)+*|kUpznP1TagYY@_d|F{{%1t8;`{cT?)yw1mPF=}gI- zEjTpiTJ4npCv+17#lJ1Tf3AR*G)V%liQ5bB35xj)tP2O0UzXCAKhly%h>BF%SAZx)jkx&a;~8=)7@ZP#+4UDZvB?2Eh7iyk>|3DC5=2) z_h*)rruZ|6th9rWNK9bG#EjU<f$+0 zQ=L#suav(0T$EPFzZ7;i9@OG3=Q~G{3vZbwbh~Lveop!92D+~f;%mMs^y+d&EqM=g zn+D3~09)pH>SK~7eIF*yMu&#iO(ZWWF4hJH;{e4!HG%8Zmn#Jp#8}qzlx)wOvr~y*m^_$|jPxk|BphD<^)jXBwPBYrhgly6?0* z2IT&q6a_b2uZTG{L!JLD5zAT7N=YA;iaR}LC`nfE9ho`RolzZ^PPy@Atlb60m5ZXd z*IMdlCsYAyE?Z?D%cGA#dN!1gdl zEl71CkODUTrra~+$@*xG=ssD9gvE4Ps>8t3`$J|tp6RQQ{mOln-XfCKhD&N)xTq&_ zYl$EQC=6~y`$gqj?z-F5ul+|k#4zy*Bk$CJy04@5iSRZaY>rPL(0KHK74XyUMZMvy z#5I!(#{MX!WD&|wZEzm-*H}H%rmQ$BZ+1}7PEHxV-&K!G(H77E+K9}Nhv!q4l1nH) z8f6}P8nY;^6@pz%ho;MLo{8UviE9nFzek5>i|jcId*<-euBG_oh1UEBk0RRf6a zhD#Ia{SWz%pkc`3`veXNLGTd%Bo5t{g5>tz3L_zMv?&G4Sw#KtCz&#<|2gvtJ_jKC z4iLdNlH)f?BV`!XVZ7P`*6=iR@Ivgnmb1~oaXX@pIe9eNNBUW{EHO7TUDUk5(!XMg7ll?gM+{S|ecgPVQ)7oOX<^XJA?BrJN*f z@}MzT{(#mlbcWsiQ?%^BP)6SgO~n6dS||d1OheYdrF;s6WCJPR7HdQjd2$U11}L9xoHKUv;m{^Byi}V4L8)ygTUt{ z34|nB6+Y6ZdE0s@mVV_GFGpf&#mxA8-V?URzgEkLM+t{kN!MXd%}v)q@lq5NiT#E{ zAtfT$wXCa!jGZw4$XbH2HX@+u;-T#aPxH^+()_Tp_>?;s`do=^9XR(#- zjJpNuQH_~jr$Px2tdN=f;BomxS`s@=fhvABSIZ66+{b@gf8e@~B=%Q(&f9$3ItRLs z+ezpCZT5dA2$`}WIX0W3pa#V_5;%e&d{4W}3RjcHhc7@2TVP2_Eyf;->@Ae-ZNh7l zHuf43RQI!WLO5*_3GaE7B`X!G?+!(fvTgYUn;zDFPR{-ck`V6*gD3e*}938N2mb~2LY?~*sUcEw?nRX9KKX-D_o2b(9Qj4@#H=#wRbmN>^F}LoO=6in51e{>V(%~de;=iOfCLVm znywND&)H|pjebZ^zE(Nk?uB;)V8sJBxW_7+9a#&1XqojNY0j0xu*9k9mk;T>R-R|Q z(p4e17B|__K?;Z;k`P|Y?|nerXrDxU(0>izl2T$~N``}TNFo{Zuzfowj&zmYdtt{#~NK)@~k*nJVezt5ZGpO88kbNw3)Sg|H_51}mqSFJ7=4FeXcIrv3x7PGt3` z(nE!!_IUAv*;2Y~w}QU(<}VSZ8R`bPKhL@b5ZnXe?Rv1xY;`EArkTrX^SD{9Dz#yev&<#&+@3GN#~6J zg%_bk%<~6okHQ4|(#%Eq^9nK4Q8oqP70dbl9HJWz%touQ*B#8KdK|qLF>wPQ4L_$X znt-i`XvS72{=sbS>19d^$%Y3^uke983GmZh3J-e=Lb|0-1z z+_&>>%P=!k->BJ=BA#s0(x?32#sp`|)f{TZJ}|G9J={%#q|HRHg7qg7MWH*DLj1I# zeJ`8t08Jgfy#x(e?GtHm80J@L(hZo(aUufalz~@6BNBw``YLx+(lw(`IM(35p5N`jGY*b8WI;8||+Fh0O0BQ#?cl|ABBh$(lD~bdD1< zH2Wu=@k6?L_!0#geOPtvFa<3Qe{-t}>guO#r7@LNGOkebQ<1|>1zZ1m4Mq>+rc0>p zAF~Q}UoU-4f_3J9h;;`8GDlhOqm4AZjlm^VO%W2W(u}9z9sr9$^lD?4hW=)g{>bL3DYju+BE-76z%zShA4w=EP9c2{3LziPae>%yF zPR4tG9S{FznH_4Loq4;TNJ;)fvle4#_P1>R(_X<}=eTPVsn|@_fR~!JYL<$T{{zJp znLn3O&JLV@G!&8Wj1T)29=~jUvKN29;WBzy-O#0{F(m3rGk8EsioSu&KkrHnulD!F zR2g0GoO$8>q9S!Het*XEqKf?$*+=73DLZ#3P{x1zar?cqC)%9THJiWRlYMvpal`H3 z8-{0G>Y3T|#_*o0*s;eAE`}ZS#~MGK`RUC5F_Q}yPOy};Vn#1pmnnvmMn$E2&#OdmgK%@dp01|6opzcw2Q!&f4Hd|j>H3w!R~LrPVv;5aFWLZ1S#ih(&%W^gs!o?X~*a zVN#S2m-WrB|3Ojf-VY~@sAXFCk{9m_@X0@6wSwSRn4=<#Ah8?BVNn`^YHsDM4dloA zqCp+fle)=qF!Phm3)grjrg|2 zEt|-?tQM&R<+6m;kP_JOP6S0#K03uZ`BLmw8Va{9P30`Rh(=Cupq7u!Hs zuXPrzpt?_%^;6Bcli6Aw1zXZmq{@ic%xJ5al5+ZFNlwbczZ%%mc>`JXU0=M|g|u-4 zJ0-^(w&e*p4;_q^+w!`c?7)tK@-!tr22V~(;NR=XX>VN8^VqVn!Qe%!ssYvAARR~8 z`9e3UTMaiDc6CoRV>Kb?xe1P>Y7Si-8$r(yP ztX>=UZ`Vr;#MPw&2XAO+LbX~wo{_%MsHNl!d*v2s>$DW7p5s9s1zATrA6|3~kiz^G z4qKwZyWSJGV%mXHO$x$zz7Sk@q z`9poK*v2sWW}m+_kMAK$8Bk|a-1Rf<4*kt@_S}IVqQJvejMDA+3iz_uHnhA=}$p26`C3FaGYAa~q2{`MHanz(JO7!R)Y26W;9JjJ4Y*0N76nNz>x zngP}GLKrdpw?}rVmee%s-0q=jwco9IBzL#X*gw+o#xYdG3ViALk6D*@mCG7Xb1<|X zL`28z%|12pQc(VekhLMz^P=FVhPX=u_i|xLanOn^N;h?UU3u808(S7md7b3S&A=&T za$Va60K+YLBklW4hRo3-O({AH+WSI9K4@I>i5a&#=|@o-i!<|mvGD+3w5nTUYWK_W zKbR+Rp4GoG^q_)Op?jvkE9ES=p*$=7J*7C(%=cfLzS{;DRo-CSb|TxdI@#IsO>v=4 z&|#>&Mvmoy!@2gMob9A6&;5$j?x8=_9`DV4iW?(k=@d!RubMRH?X;&Jw<^*_>~|f< zKb93*WmABQK%MmZfTox7bYbr_>RX?szRjQ??UWw7f9vXXT0dO+*_O?vgDO6lsC8)u z6U^uo=4r|5-|Q*Rx>}@HuFCuWe#fk~{bl_mJc_;*P%a*<5HW*0TQ|%@=JE74Xw^kwas6fn0n_B6pz5U9AEI=mFa(R6$Mw z=W@5u?bAv>eqV5=WHx|#B|7X8%JbKQ_Lx?b!FZ+ixKGX+5$2xhsKsPo zEuGyg{CmxqT{H(!ZAO)nqsJ)U+N2iqaq-1&=s}1m3l1kzu+G&Zp?^YK8_?%%7Q)E| z&KuzSlTfG|+rBH%xq33Zwg&DHYV4OY*OJ?Bq)x}ei5m2|LRopTS>4 zJl7?X+D&bf2T7qiq}p7)VLL*E(uxMqms9-&BQe!wMsXt-<&V8AbPuTNb-E?I(EP(b(`V9~P%` zH5?2KP@(^;|28|VOr5+_tj@>BtPXw~E>-yP)iaW(?ZwoI)-i4KZnBpj-%mq93eWR< zZ=^1l`}y4-bhVv@9$W$bEI8D^b2K1IzOTU?5Jgumrjk*+4*Ii@o~~vz-;Q?7TbjQ8GMvD@1_`Y7#Wa3Ncn$om;dbX z2CjEAF5yTf14vWw1%rMJ$xA^_pnHqbX7pK?lpo2Y+)v|lmB#k}%?7VkG`$nu>QU#n zHFNhqw~HgD%s+qaym?Y43+@jp@<&8VX>)^>>m%Wm8t2J%Q_c3>8AZoe2u_jYiV{1R z$-oU?h?2RZ0ndJY7ZbJGXkDM-AUnx)GrLC#bivtWOta=`_SF@mQyAg5^FjQ-CN@A!lAl0;D`G*$K7 zX}wzxQ|3-RoHYy0A6+Z?hVGLc!!Jo(zS3El@&}7NUZxR7j3wDOB_A<&wjf0@6ctwX zz6+cx(R=A^k&{OIIO#Vmt^P#GIRY(~&G4=fT40D=3M&^gFV8cA8PSIq@?Cz%yO|gH zb9ZYUk6)&(6!9*uH=Ig%BSr8GN2>1|GL?N=UT|3w$8x8BokvZ4kH&dDV-n*k-8K607rEy}N@ z(_D8m7am_Uyu~_xa=v>yVXl^S087z~U^Q1-m92O=Do~Ewnax$u(8204E#};?iDJ$o zTH=Re%=ZPq^QeBIUt7J2%x!A-m=#nZdh8fF#m>w9n5kQ#tk(U91@!ZVDGvry-iQ$6 z?GyU{g=79V{Wujp@i6QxE=gJlxxWL&C1iWcc@Y7gZdBhDS`> z{M%IBws?8elYcatx$|uD!wx=a7*KEW=ndE$q&=6td70W z$#7h})rRog_TlXZhsnb;i(b@%$v@J4Da?zn{3q>g;72U zD95VT3ZgozWqBo8MKzB;sq8QB&I_BF<@o`mD$F4Et+)UT#a=3#SwrS%RpuT-q& zhD(zSygV}urL*MBZc!T2CEBb??n?~jkMcSN@ta7FOOS`XlD&GOX1l@zi|+mXd1KKg zo|k(H7|KeMI;hy)lk!>STTi()j=lA2>8#OueRe7g&W+o}sme6^g}dur!>Ie#=FSiGNq9A01Vea+apn4TO z<4<#^-@Xx#E;2MDR{VE^Uz(z|Hv>ZWcz6t ztSZ=G)ZM(WllEr{%X090wbF~qS@rbe!@FffjtGmESgy8MjWhUuv0KU=5CQhdEp#{N zp_p*od6G67pF7w5?)C0IDEKo!F8|s`8z0xqaz}^9QuE%sY{%yASibHQCtJAcQ5IAo z-t^9%VQ*K0bN*ycHGzTwhTO7>4 zE_dAZZ21Jyw!DPw#2(3>`ECHCQ_A5oP3Az@a(u#-lUkWBnXL4U&gFi`J{CZ-qB4u!awLVd+MaT{1QA<^L(G@8~Q;w!(P z1LUUm1>oAeC&~RX*jr_Dw^Du}g?xyLc|Z1X(W*b0|2`$c%1Kj80HDh9-Ar!(e9csp z+4MS=D%k`{tDb=c1)!Q>S(7`uYv1ti9i0A-KgJ}#u9z#)U9uf>U4EysQHwcx9^<&T z@MKedS&8+Ccvr-Wr9O{p&#Cy7E2R#T(Ps;n7K?)8?&5VbO-5DnhdcZ(p}o0EY7(Ok z%k|!(j2!~6{6aT%1jmKkz86Ie2;qF zD3brctqZ}eeI{d9jWv~R=vpcpnRg-jE1UJ|~Z$8l1O7oBucnY|Rq@oE4FJXu$-9ea$z`H}^72h><ZPRQTRpn<>>P zS;NLehy z%lTF7?B*Y5bY=<{Hvx{=f~gOrhYtTC&d0nvaex|{zIC4m`6|#PmlG|^=hrfExglfj z4#-ch8b9X++@fk+&5$i@o2+r?BZJm(L16cFN~z#+rL+Uu)Y7-jf91!e7+{8>Zxg{11CN7L}up(7oOeI&j9>{f}!W zx#c^e*9Th?j=9{|s-5ZWSz)E<@Egqsy=Cw$H&N0|6hwmRMb55cag8-ZtmfL)+&BQN zBPU*_nZNp6*3UzxhB0*WqUeTRb^eZHAP12@wesiXYDUontFzHy4r6#t89d9htSQS>Mu7lqJRRs1+Y=H-I#8{X%p z-lgO%&h_Th=?W#I8T*-ouc)0)I$>!Qg+Lwg@pt$V2|VR@j$6IEdu48IC^w948(BJe z$H6I1Y;Hp3j$+N=8RE!xd}?WnXiI?5Z3?SAc#i)&te#Wfistgdt=#_H*~u`~JCxq^ z)Wz3z!UL0o=m1Ky&8?<)95U*e0!VIs%1tp@D)1e?U|QlJZ*!goR^)bhM})Kpg`}$_ zHCuS&7gKapsViP_)(CH5@hmpT#-MLcA>9Zw$p|rYW$NL(Cuf5%<~DgvCcY5eJ!iLP%WQ-2WM{XENtQx-A!ebgk12eH_|fky$<3}O zuJT^(WbXmt<6A&Hd~`LesXV!@ImbK5doE+D(tH0{>GS~%qcNW`vhGFS*?zvl$%wNR z)7`TC$M3E#S}ZvWI+$!SqTfV23ik5gVJmvCR z%X(+L`QPMqNA?=_D=Mr$@+-`?Np4+e3Z%>g?xF2_e4n9a9?Mgky=lUjqdjJnG${Ae zu<`t?8!?H|rZTX);FH5^&0wkPO-`S8SB~rvthQ(+pCDI5{nZio z)IrLlAHY)%PZ%&S#GNtjnHLhyhXZjI>xCh(P=ryc)>W$!PL5Wz$(h1 z(1Ur~HQje4^W%NlPD8(CmEexBzLT*NvSj<>w2zf-{Szvw0CAv z%yaQ6vbsXnW{nmbn~@tDGlIm5>ei0uAJZP6{S9nt#>*(E#g)@s1}hk010{FGx+cA2 zX#}S-?g=(RdKW>AgEhc{Ls(m+Ox(uqT8(r4NOg$rVoUi!!3z!FSx36lGpTn=JAY9g zW-W<=Gn>X|&ioj}nVd)PMmgR#{LVgZ7-y2$M=hUNB0KHc0wd*qnlq;qzl}KNuwyMd z{YveC5?~+Mu6jO(i`x)i&Tc)G%a6TQm!W(r4FEF;un328d#~tOiw1%Nm$I;!kgVYP zK(I-(=o5g?#miMaa|LKbGY zh7^(&UAK|94d-2oM4j53on)`+fXwIXs#2MGwLY;zH^sJcx&b{Eh z(y@NT#*5lj&b1dmva>SiJ+HW6h>*5tkds6>)VE)}OXMGDRf}O6IBgm#!8hX5 zoDTJ0ZJ&X>^RGe&kS*EUVeef6$wc^eRGb>53boGXkAb+${%P$k6SRP)?v;C;RA$@W zjuX0Q_5FRc!N&TKfozQJ@9{!SyMINjBt+_pfeyzf%KboJbqHQO#T-@iC@aCZ2XRi} z?MpfZ)_4Ovq%vm6vi;?1WiTv+`HYBjpNUOAobAJgtRtv_uuc3o{$LQYbI@L&HCq(M zn&Nd%scZZXCU3|y;hGA@YQ>0i6pBu|Ekz4N1=AjzHfw4y#{(_#{OF6+ApeLj_H|kQ% zl{zg`t$x>45U%596E~qG>jP_9Lpz(~m2#dlCf*WW9^NgAhUrl)MfKKyX6@4fe-s%f za=8S9EOj8(UVYd;4|{Ct{g5uH>UL#62=TUQ5QKxTCkkmW94c{Dn?S3uA7m2WHI1e- zh*!j#@te~tmS+tlkog2#GPSp;w`U!)D+!TNW{-*D?DF!*U{xD;m|P8hl ze;M}UVreaN>XNN?;cd5beNa*PPj{>&RN0E8-FpNoREF*%oBioTy*{uyleXrtRa=xB zB2cVF)xUb)%4YU;th5C(r0MzWcanmnc@GHgl%X9PwwPD9($gQQ;zT3Q4G177?V*JuYbX&??)f8U_foGdMb;9k>5CQE!_K<&d?6;w0z~J zGFh9{wNJkbgS-@i7{#u%NQ+YuWUI-suGjvF-;skf|0<+y#|IepzfIH;8${q&hP$ac z+UUiBF|!6Tvb013LYG&|ZAp{ngPu5@gc3A`^lG=)5hHEiy?$lq3sm($vGk!s!^fCX z$(lhtM&a~tT~DG)K=U#c@%5I%4aljt1YI%lCsRG`hvwx2TNRm1u{JKZ@^~+wLDKvFUtaJUB z{X~5~L7|WSC{A}zia;gY^U(fQrO0UJ zWe;!`=5<^MW!dAM(yUvZCUw+NO<|t|hx6sD6Kz+oIJO}Dl(@;3nH+g5NjcQ9wB~u+ z=hP+TbhR%83m^Ws1IfyauAP1QwBGp8D}46CGebw5Q}NO^d4+Yd*Ll#!w6(OZIH%E~ z95&*o?i2HjhY3Do?S+x-vZ_>%A;LEI08~phU%1EHqd;8WM6{+;D~D2lLB6W?h!gv3 z_I>QUdEzlqagCi>3$Mrb<@{6Z_~m2gH-3hVUx19|(;Y6*kp`$f%W$u4DHYl`|AGNM zTkmjm!3cT4(5#VckBJqJRo#sQzZcFxV&ewXo!2Gx8`bu)YL@Ce=!#dTKOef&W7147#LdS~I z?O$XPZ}1zp;aS{%8qRlOaN}8`ACKt5X+H`Dk}5;M%Iw{kx7G>jR%~i^Uih_Qr}qhW zmj8#zdg@nfRG?PglVO>WHnCs;q!=<1q3wo>_GMD=m<0(l187`_-D@2!Z17%PhUZ_C|14OdMrw5PNsNuPJVw#gZ+R5R93 z=a)eEFNX=6Ur85gf;GikwgP9^pfCFhKmPmvN5t7<?qG6bQ4FZ!My==V4ZmVRw*;(+JiubwvR8RxO zZ=yqTlVLbMp~n|ks;m4H``42^)`BeY2h9chm%mSB%jmrQE4kq`)8=0I)|rOx*i{)R zxi)=12;VXIikqKk%(lJ+g(rmSjOS$21CRzt?!7*!+BzmcQ&@w~lrjTrrRP`)XAS&B zq&uyJCu#zPdarha6G_{%lHP%#y1t@x%fVN*IWVZGMxf#Lb05QZ6wp!ZU1ecHhD8J* zSgC0F;|L6Rue;vu5pkb?=9zE7HrgORgiT>E*?)adGxm*yLo=m>s1A zg+;mdioYXatBtRW|1-O=#`m52_;{>SeNN`HZYxt6Pjsc?th=``sNb2xgYr*xwzYBm zSyM>F%NJAZNs-ighuO@#3ihotRP^ED_)b7AP}+m=iCoiVf=MFUe2*A|vly>EY}^>~ z^nM|2vejzu7n}&U?=E;&h<IXLF|)dPL$`_7Lm>O4 z>k+kAqd|tHL$%~C>jJKclh>^(C?)0eQ@9ce12LyqcwMj{v|}q%VlCg#Ni7RCoXTx{ z;4Xez#t+YmCNEIj(-}-U3aqa++XZOHtCIE8BLBbnz=|rMREP9hMhCo-J_|8ynZbKD zynjFi+KU`AIzg)ntsTF3wV2d!eSC5whvz+D6-Xd!Z**c@jE%O^DGWC|oM*v!Bi*i= z{yi>cn0L;0P67!tnP@2N9uvHJJDFLwkQFF7Wo3GbbtM{g=pKmwc61m(VXBo!w$h?# zn=>p_L&N-V%x)|BGB&sl+o^3(1MhtwI)G9Y9pi4F7-ByT&25_|W~Ui*x`k)bGYclb z=U9gA2e?5EsXb!-gATA;q#^b74A53-u!q98$&YL7PW(Pz->}{7X%OAj4#sJPC1O>X zyh}vOEN@nYBv$;yrNE1I*Jq?V?!vbd5JfaIKg`kV)-Fz;_iWtPx_ySIDQ%HkahOA% zX1jp@d*UrHqt@YCkYsH!gwGHub>M0h>AyOsO1kKBzF)R(I_x6D-}*fIc`Ev$^agPC z7yeO?n;c5=IB8Dc+e=_&UzYWn7|Z(>J(5G-5DE`jepB!d2VBC3=xZA54@1RB=PJ5% zW?H;9=j7ud_h!+Pz}jar*jUvv7E)vUJ7Z(9*@OEzi(R0f%0Olf77m@TJB2vsbWKR* zzTLGA#<5ZRwU`eI%eO3>oG-&4i&7VKex3%&c&im$_eHs=Z0EdRP3y#?DMY!|8E?os zgDjNYoT^we7mRmYtJcW$DT71NB_lQgl4NH7gR4w=XSwMvWZsi1)&*Jfk0X{s8%S|S zgvw+mZt5RVI9Uc~TRH)W*@K>!EG+ENO}MMKBxLtc!$^9GlRXZa0$$BQ*;QyYja?a zhnOw03E=;?yOSGe>u#5yYSiAVQmk|VlZ2)#HI!QoF)U03XV)p60vTeota1Pn{L?VPJJx$CKxKQB*k~>MY0h^Yv_jZmOl8! z$c7Pnu46h#eMVMt82cK9UW@9;%FLt*i;q(rMpy%cP)JxjLD5iym;T^Rkrc=!ch~r? zEOlMcz6mKdvk{w;wxf-Hxsm{bxr{szSAT-3J{v8XAuz4XXCI2dJf)x*l2FUFkIIT4 zcv{l{+fa{fj(eMg6?*u6@IG00)6xZ>u=}xkEL!u)FsBf zQxtpyi|uoG&OZ>jj;L%f$;?kqj7&PETha2o9?S=;d55G$RnzhEzF=dc&BIK&NTx;@ zJ-FBXaY~v2XOAUg)~2btrJe?P8}awsGa-`j(eX_5F#mLBZ3}<@jp(L+)LU8t+HDSS ze}PkA3|TJuQokCe9eya)3#(YmpYW&8+A9aAk~g8;JWB%(`ocDun7dCiO|ovLfKRJ` z8XeB`8UA+^TA2!=X3l@GgMjyGkIpVpAH=ct+F=_(=(eS%6NnUO5n`KHLH#C@=8W9Q z+QU&BG<&9NnuIrlJdeB7d3o|4~T$xxtQ_|~RW(>X}Ub3Cs@;zdz@XJcf-exrSF~%|CT3#um|IMuzOM(GMLye<pKNw?^M3}@-Ci?_3EuHD$*L{m&6mUA+h@=wCb5>Zv=%>191ZZ0fFv>UN0P|S z7G?<$Ll~ycr^5ovPTXMLEIOS52qp26?TkDZWAfc@<9ju@jU1&7(_zGL6e{h-sq)}`rY>R<>fz=(1w9NYHMSe%l(&W35%ONlwlDe0T{5rTLNtKDn z7&qHjcM^QP(>p!i#yKAoS0nLTi4kdgM5qYZX7^mscx!l~ zcR_52^8K?k?KRO_Rce7L5NAMVAdJcU>d(owvGOuS!|+9_TCBYq+%O-goOnYFowtnp z_T%)+gF{cY;v#03(SSrWJ|37^*&PfBI>)%r+yKv8mt~7Fd(mT|=gB-a5kj%n{ zYd8};WOiNWV+8db=C=-TBy~JXj{ddPK-E!<4jXY(%j@Aof%QbgNNwl7UvlX9-*gq+eX#v(E( zt8@x%>F|c0swUCtDs9&6UM}hV17SK$^48j}A>L=A&5l!6R!HNtM%E8!rh-pL?wk{Y z@Fv+_ehb{zZFL}LO6-TrmB1^Ct2!q_iUHrx4(D3FgSaCj>ERm^l!}R}cvnP~yU&NH zD1o)Nj!4`Vir7Xf-oaC`7WoIK6z?TZ;H3csV=pU(z7S-r!Fx8xxw)x^T6pdw=&fnA zp=Bc@Qf=5KFPjsU!25>~#gMxMf+6|?weI9t0idx~vEmVr!uJ|kl$g5Cu>5@5wf2Fv zmm{8Z=$qfwc#Gz>=d|*YlJAE%n_|%)QjfxAFJEyJRu3@7E2VolqexR+$u6=~S6x%suEZDdG-8PFdL4j2YY?I8Dv-3Z%x{} zA+}?Vx#|HmpI!7oh*S4EY_t1rFw?Z?^vI&zLA%Jq0`eQ%Nhe4lVe=T{FGaN3iJPY(G-e&?k&^nJaFF zRQk2BtuG@IJV(~@I}N;(-Vwh4X|GpZYejG0Jb;vkIhdQfR;daJ#7${_fP8@H20AWZ z2yA~N-u(w#W@6;cU4R!`A@2hHOhvGwOG2&_fE$~OPMlAwHGNeSoEUj4wiaNgVKYZM z?a5ZHAfc<#dXl`)rVq6!z2nnDR*$O})JIBAW|VCan3%Zn-DR>7R|5{19Z-Om%OA~( z|Db>9FZXnCShrEY1@!Gm>e5n$AY@EXmw^C|K`$vW=~xcIi-%rHS|v24x<0{*;TR^9 z^`1$(<@W-a@7Je;Yu*~-g3ib6zjVDclxvEgZrh=y43VvPF9xhBAvD0rC4ZQxi0B>J z{GXh(3Y(1El7sN;lg4vH>^O*fp}-~Q?A398_sdZl^f_uuH-C1o_pWvi_kHV*$i3|v zj06^4$l)5vs#`6^C+7aW8Kt_i5AOLW&Z)fY8<->zNr&t(A+_{LHY&PXa!=)};Xh>b z#-VVFKlh0FvCp5VO?-RBdN*vytXXh^dC=r)Yk)Wf2HM9Dohu~u+xdi-CSLzoQ09I) zSf5TA$dp925Geu7Jb|XZ7N3mS;|*f=fi4!2qdKxwV{GYY5|uDnZD?7Y+V|+vF*n&` z2FJtl>6cej`-G_)4y;tNL(BPBdpB0*E7@pm2aJiQmfxH=f_`%4pBDWQ23PA7WuuFo zw@@nTN~{LBndbR*>IYSv|{jd!hhP0D3)kcj&fc0`_ z4=^+jn74o0`}oy<)kYPqg^uqe2O*1RrW0~=5Q^}^wZZ70ksF@NYAm)v9%AJ(MPR=4 zV}K#;f@|r5dN7aRVy|A_tCzjGthj7n#%bL~1Rhhk@V<_Wnr)lS4toeTgbl|x%VfCc zW8oQPlT+n{_v;2{sM9~+0 zS9vQ|7brnXcp=w0puA2~u3_Qzumsq{`In3Xdw{OG>JWU4P^a#8A_eGF=vHj&3VP0c z<=4^W=_Wk>nywe-u+L}S;~SFiw8ke^wWHYSqS1d(dTsSR;z!U@*3G`L(A=Xe#cInJ zSo_tCF&6RSm8;>)YuUCduNi5@X8ijSjNcqT=gOHRu!Vts*GI9(YZ>)s;xUsD+^ zCK;#M<6o8kHaLW&>r@kq(UCN{8r0h(^>DHuueA9lJrlHJ6z*m63VbngA}LuCmypEJ zrytFabqQ!F3fo$@{lYSyU)@taO?M1X4k)aw*h;17`MWuLnthx~AYW2B`@j!rAm{@^^DxA3k<>wp>cq>?HHsE7LsTSw1Zv z<2j@3DdQ-Ef@O2cqY(pSc2qS+`A6 zLf4vZpm+&U@=pZn=!sR-WZn!`t@K7Rkej?F6=m5rWTLa3{`~0|gqaw~7KNskZRcQ! zKRr4E9_h%T1O$@^M7#2B%p1X*JZ(fCdl=w)0^DIr@v?b(>ALtCQc>j({LEyfx@q9< zh%L-*Q73*pq|VJ|+dj7dI1GQr!(+Z@sw?1*lxw0!sPg(g@E9M3z@X# z#L&sFnkU(g0l|X+ijoR#9yMh0O2N)cTJJW|bY@s?kmPM3es#CzPg!X-;U#t~y1!&_ z&CTDv!`n1WnqiZqWq1R zQo$@DMmW%5J>t9eCr$FfH1vg(!iG@WkLBr|%8wf*rh-=`xjBPzVBpasp5SJ&4{HR- zxB3Rbkr(-4n>fUiiv3X{M?jqp!@?&F%h(eNQdGw^3ah2qEY-vKc~cZWe?1}vM)`L{ zGiOp1z_)O3oUsVNoD10chsqRpXHe4y(s6M<&-)O^GP@pDA4so_1we^MU;}-{vSfj} z0Eu<-O8k>F|Ln6r%tw~Vuk8^TQJApVqK?)Drav%yL-IV#p3h@BtHAbklQ-olfy^+p7K)h!^fPaJcb6Uz+5{G-? zcEz##;9m=#Zt-OkvEH6!J+*W0Lz;D{`>qJY^waJFwzv+M#V~MBZN`XPmD3p<93N?1 z^v{p2hBeIU2S8u1E~`33c3#5nZI64hhOC$DNXisF`&MDeP58UicJ4I;p93`gY=$@Z zi^e`#v1XDsuEC8k%9BXsg>oJJtN|B4F>AN}A#$Y$3f@{#Z0;TPul*Zjq=^4N~`yLLj+hduYMnTZaG z;{a^elRm%xCf&zh__xDcaxfH0GB9?XQm|6JaaCYYn|~ZXTbo{0TXh{Ko{%B zi-M6kf<8QpkyNB+c(F9>iK@-D<3FogH+-( zRID~#gAS{iB+4WukOxAuSffqb#12A z#2}2~E1FrP=kd5DoL7I$*MPEJPv9Ko$f|kz$*%a4pnCOaQCRli_a;e^NmhTUa+a&o z`kF6}vG)evxsr3K6erQ%HqeCpCqHBZv{8J_iVPg2XS z;tR$zgm0b{?zWT!spNr-x91q#Z|Lby37$i#a|+OWIU)Fl;{Hg?@bUnGHoD|KdSAfZ zzc73#VGzHhL?OQO)BrrTdjPF_rYV@Vxml*IVhDKueUoV4JAGhuLnX@bQdeEU*7=gj6!r;cGxAW-uo*A z<98Zq+Po@(Vl#|1VsEvD@B}-%TrE-}QTIGnSb<`Ns<6*5r!M^FICw5#qt0LBb|QnL z8SK%q4g7X07^=?Xam=!$?Ec?Ra!`G8K zcnc|i`5L2o#ekyjVWmVSt#m2{d?$sb#>V=KV28%1@N@LjJ&J`4`+-0nuF2I!^7vuy#QGP<#wRu`P8uk%2*tMsYggo}m7E6OBlB zlT>4O)^xYkfWFcv4D-*uCO9M;z3qRjPNhws`+Ua~qPtEjv6gTE%@?wp!gjNpv>3c4 z(7ImkOMs)Z(lNQR>tcTvv7{G>b%~ePvMzfB3kk*C9HMGNGM+t?_OQOA?4Y)!!zS99 zbg}9>GAb-AS3c6zaE_W4KNq`5Re<`q`T~LbuX_Ng(76~`rlIQ_BIU|ZG}_0i!!}!) z2qrPPyt1jfHOM5iMW7Wa&Vj5ApEYGjw}EZu+%6erZ1_izBeBz4bn_S9Qwv4Rru<^a z|0uD7MKoL*ojRTz#~~fJy9K5G=HeA}7#*x={5|7z<*zMd>s1NNE9vH97e`(T*cqvB z!vzca0DN{`7IL(Eh1+wVz7{;`rpuB59!!?&I~pJTqRG8Y{fu`3*tW<<=F!!}ejq*r zg{iZd{3c*`gDi|ow7p&i)lQAh)FW0nxbJY8TpI|EJW~Se@6h~P)34I#^;ro*a47g_ z();q!T~S#4oe*%%h5277EbQPTtrLGOIM7`7R(doXn|}I{Q=N=A(nta{fBMVOD4G&|i@qLz z>~YkFl41VuHU~2(?Lm^)85a+4JQG%97@cPVlF`0&h9LJzZ}2981@`Arq|jI7aakFq zUg>0Z^9~rcckpx2s&*`J1NHzb2sVIdek)DT8$HmCLHvRam>5a$h3L{=ywXVl^ijJQ z;)DHoL`tJM=#^={9V@!q4)%S{sknaB63UXN_Y3coO#;>^eft?|maeOzNx1DiYbqs) z47phgU9dDyYKN3w6?&;TK=V_6I4qalF)wIBFT4glae`HQen9nR=PZfhD&pwqUW71Z$g|C#> zoG-?x$-On8OIF4jV?a1eJz%z%4E;soVwJ_787uspMpjk>^tBBc2JPx~ra-ginna4L zeeS0`v-ZH&cyAVug%b2mU%7B`O!)y=2a$ zBn$I@w}%$zM@au!RsHf+o@6~oHXNNC20q#4Jy&bR{o^A~$@(ODi6l$&^NFqMgA>GD zva)$a@Ud5X4(O&UpxWbxNRJt9$nb7hZ{_i)cqcF0i)q?kxBAJCvAVTOWq)##=CeO%~?cysw(`h)oFDZuao9-!+bw)7|9#IGd40Fd1{NSvZZ$+ ze_^uD+KP5SY`C~ehH`(&p!~yQ$tl$<`MTf;4wo}<^^P5k5vFD^lzkZWw7aQil=_Sy z=7G-m2HgoSIMMzr&DQI06;KN1WAq59g#%Dw)2v#te4i!zj9}y!M33idLXn!zcO>(1 zUjOqc1ZJS^gC6Rp#zj4UDm&~Z#37F{2*Ms7?iIeJe7vC`quy%9I;P%5cJ3}XBI!yQ ztjGkOs(*sFrdNB1(VI_7f=m2$B7~6n7HHrDu$?rx@3Ou9kGOLHa|hTHzN5JJZHm-* zXjoJ#Chp=er*cOj09$)@z(LJCk^58NerH(zawZJ=Xq#bg)c6pG>Ol6?NtoA?P~XDj zFwF*p+f)gSjwC@b%N&pw*v7AGIr;^Uw4_jxm1yTBE z73_J!^JtKbWVH zmEMV`D)Tp++z568R#IGDuzSz3(xAXeiy*PtL5iJC)8`~Nk0P~~^L_+ImXYog!ol|# zmdh%gC7;agPeZR@D`PH)DH8!pOX;P|*DMbE(ot0J$sOHL)z9)iK5v`eXHFj4r2o;X z8UU(@;@nY%DlOVVAohV+++=ssHfZuxZ|rF{}=LvIYmPMz63{LG4*T->Yf7vsMD*0F z%v@bQzK&-4*0$V|ZkNwzfvU6i>m$l{(8U7ZYNh2FWkv2aK^WZ83BUG_pP2vk@pu21 ztt|f$w*Ln^(v`-fOrnuI7oVGytYJ}2gOnrdNDSC0E*()ae@w{uJL_TKh6xJhjUF?$bkK_OIVgCQ$|9=Ai&!51r^LwuuKq_lx Wz5izpeyhiE Date: Mon, 11 Oct 2021 20:50:51 -0700 Subject: [PATCH 5/9] Update healthattestation-csp.md --- windows/client-management/mdm/healthattestation-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index dd83b691f5..5893a45e9a 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -51,7 +51,7 @@ The attestation report provides a health assessment of the boot-time properties ### Attestation Flow with Microsoft Azure Attestation Service -#add image +![Attestation Flow with Microsoft Azure Attestation Service](./media/maa-attestation-flow.png)

Attestation flow can be broadly in three main steps:

  • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
    • From d37e40168e91c6923ea297c6b0712d60e9b51299 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 21:50:17 -0700 Subject: [PATCH 6/9] Update healthattestation-csp.md --- .../mdm/healthattestation-csp.md | 31 +++++++++++++++++-- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 5893a45e9a..f84f0fae96 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -49,9 +49,17 @@ The attestation report provides a health assessment of the boot-time properties
  • Receives a signed report from the Azure Attestation Service instance and stores it in a local cache on the device.
+**MAA endpoint** +Microsoft Azure attestation service is an azure resource, and every intance of the service gets admin configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. + +**JWT (JSON Web Token)** +JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair. + ### Attestation Flow with Microsoft Azure Attestation Service -![Attestation Flow with Microsoft Azure Attestation Service](./media/maa-attestation-flow.png) +![Attestation Flow with Microsoft Azure Attestation Service](./images/maa-attestation-flow.png) + +

Attestation flow can be broadly in three main steps:

  • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
    • @@ -67,12 +75,24 @@ Windows 11 introduces additions to the HealthAttestation CSP node to integrate w ./Vendor/MSFT HealthAttestation ----... -----TriggerAttestation +----TriggerAttestation | +----AttestStatus | Added in Windows 11 +----GetAttestReport | +----GetServiceCorrelationIDs | +----VerifyHealth +----Status +----ForceRetrieve +----Certificate +----Nonce +----CorrelationID +----HASEndpoint +----TpmReadyStatus ----CurrentProtocolVersion ----PreferredMaxProtocolVersion ----MaxSupportedProtocolVersion ``` + **./Vendor/MSFT/HealthAttestation**

    The root node for the device HealthAttestation configuration service provider.

    @@ -360,7 +380,7 @@ c:[type=="events", issuer=="AttestationService"] => issue(type="bootRevListInfo"
  • Call TriggerAttestation with your rpid, AAD token and the attestURI:
    Use the Attestation URL generated in step 1, and append the appropriate api version you want to hit. More information about the api version can be found here Attestation - Attest Tpm - REST API (Azure Azure Attestation) | Microsoft Docs

  • Call GetAttestReport and decode and parse the report to ensure the attested report contains the required properties:
    -The decoded JWT token contains information per the attestation policy. +GetAttestReport return the signed attestation token as a JWT.The JWT can be decoded to parse the information per the attestation policy.
    @@ -422,6 +442,11 @@ The decoded JWT token contains information per the attestation policy.
    • +### Learn More +

    +More information about TPM attestation can be found here. Microsoft Azure Attestation +

    + ## Windhows 10 Device HealthAttestation ### Terms From f6321598c11184393b90ee8f57c0551ef1d4e8dc Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 21:52:09 -0700 Subject: [PATCH 7/9] Update healthattestation-ddf.md --- .../mdm/healthattestation-ddf.md | 571 +++++++++++++----- 1 file changed, 404 insertions(+), 167 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-ddf.md b/windows/client-management/mdm/healthattestation-ddf.md index d7209b1cf2..651900e2d8 100644 --- a/windows/client-management/mdm/healthattestation-ddf.md +++ b/windows/client-management/mdm/healthattestation-ddf.md @@ -22,193 +22,430 @@ Looking for the DDF XML files? See [CSP DDF files download](configuration-servic The XML below is the current version for this CSP. ```xml - -]> - - 1.2 - + + + + + 1.2 + $(runtime.windows)\system32\hascsp.dll + + {9DCCCE22-C057-424E-B8D1-67935988B174} + HealthAttestation ./Vendor/MSFT - - - - - - - - - - - - - - com.microsoft/1.2/MDM/HealthAttestation - + + + + The root node for the device HealthAttestation configuration service provider. + + + + + + + + + + + com.microsoft/1.4/MDM/HealthAttestation + + + 10.0.10586 + 1.0 + + + + + - VerifyHealth - - - - - - - - - - - - - - + VerifyHealth + + + + + Notifies the device to prepare a device health verification request. + + + + + + + + + + + text/plain + + + - Status - - - - - - - - - - - - - - - text/plain - - + Status + + + + + Provides the current status of the device health request. For the complete list of status see https://docs.microsoft.com/en-us/windows/client-management/mdm/healthattestation-csp#device-healthattestation-csp-status-and-error-codes + + + + + + + + + + + text/plain + + - ForceRetrieve - - - - - - False - - - - - - - - - - - text/plain - - + ForceRetrieve + + + + + + False + Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service. + + + + + + + + + + + text/plain + + + + false + False + + + true + True + + + - Certificate - - - - - - - - - - - - - - - - - + Certificate + + + + + Instructs the DHA-CSP to forward DHA-Data to the MDM server. + + + + + + + + + + + text/plain + + - Nonce - - - - - - \0 - - - - - - - - - - - text/plain - - + Nonce + + + + + + \0 + Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server. The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes. + + + + + + + + + + + text/plain + + + + - CorrelationID - - - - - - - - - - - - - - - text/plain - - + CorrelationID + + + + + Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting. + + + + + + + + + + + text/plain + + + + - HASEndpoint - - - - - - - - - - - - - text/plain - - + HASEndpoint + + + + + + has.spserv.microsoft.com. + Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service. + + + + + + + + + + + text/plain + + + + - TpmReadyStatus - - - - - - - - - - - - - - - text/plain - - + TpmReadyStatus + + + + + Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state. + + + + + + + + + + + text/plain + + + 10.0.14393 + 1.1 + + - - + + CurrentProtocolVersion + + + + + Provides the current protocol version that the client is using to communicate with the Health Attestation Service. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + PreferredMaxProtocolVersion + + + + + + 3 + Provides the maximum preferred protocol version that the client is configured to communicate over. If this is higher than the protocol versions supported by the client it will use the highest protocol version available to it. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + + + MaxSupportedProtocolVersion + + + + + Returns the maximum protocol version that this client can support. + + + + + + + + + + + text/plain + + + 10.0.16299 + 1.3 + + + + + TriggerAttestation + + + + + Notifies the device to trigger an attestation session asynchronously. + + + + + + + + + + + text/plain + + + 99.9.99999 + 1.4 + + + + + + + GetAttestReport + + + + + Retrieve attestation session report if exists. + + + + + + + + + + + + + + 99.9.99999 + 1.4 + + + + + AttestStatus + + + + + AttestStatus maintains the success or failure status code for the last attestation session. + + + + + + + + + + + text/plain + + + 99.9.99999 + 1.4 + + + + + GetServiceCorrelationIDs + + + + + Retrieve service correlation IDs if exist. + + + + + + + + + + + + + + 99.9.99999 + 1.4 + + + + + + + + ``` From 99fe9c6f5e2856d84c52a0925a5522df3146ad49 Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Mon, 11 Oct 2021 22:06:23 -0700 Subject: [PATCH 8/9] Update healthattestation-csp.md --- windows/client-management/mdm/healthattestation-csp.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index f84f0fae96..d8b7e7ed5a 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -233,6 +233,9 @@ This node will retrieve the service generated correlation IDs for the given MDM If Trigger Attestation call failed and no previous data is present. The field remains empty. Otherwise, the last service correlation id will be returned. +> **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. + + ### MAA CSP Intergation Steps
    1. Setup a MAA provider instance:
      From f1ddfcf9944b9df9045b1d0491c5916ca0a3e5ea Mon Sep 17 00:00:00 2001 From: Gitprakhar13 <45089022+Gitprakhar13@users.noreply.github.com> Date: Sun, 17 Oct 2021 11:25:32 -0700 Subject: [PATCH 9/9] Update healthattestation-csp.md Addressed comments. Ready for Signoff --- .../mdm/healthattestation-csp.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index d8b7e7ed5a..5f1347d92d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -14,7 +14,7 @@ ms.date: # Device HealthAttestation CSP -The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT admins to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. +The Device HealthAttestation configuration service provider (DHA-CSP) enables enterprise IT adminstrators to assess if a device is booted to a trusted and compliant state, and to take enterprise policy actions. The following is a list of functions performed by the Device HealthAttestation CSP: @@ -39,7 +39,7 @@ The attestation report provides a health assessment of the boot-time properties **MAA-Session (Microsoft Azure Attestaiton service based device HealthAttestation session)**

      The Microsoft Azure Attestaiton service based device HealthAttestation session (MAA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

      -**MAA-CSP (Microsoft Azure Attestaiton based Configuration Service Provider)** +**MAA-CSP Nodes (Microsoft Azure Attestaiton based Configuration Service Provider)**

      The Configuration Service Provider nodes added to Windhows 11 to integrate with Microsoft Azure Attestation Service.

      The following list of operations is performed by MAA-CSP:

        @@ -50,7 +50,7 @@ The attestation report provides a health assessment of the boot-time properties
      **MAA endpoint** -Microsoft Azure attestation service is an azure resource, and every intance of the service gets admin configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. +Microsoft Azure attestation service is an azure resource, and every intance of the service gets adminintrator configured URL. The URI generated is unique in nature and for the puposes of device health attestation is known as the MAA endpoint. **JWT (JSON Web Token)** JSON Web Token (JWT) is an open standard RFC7519 method for securely transmitting information between parties as a JavaScript Object Notation (JSON) object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret or a public/private key pair. @@ -62,8 +62,8 @@ JSON Web Token (JWT) is an open standard RFC7519 method for securely transmittin

      Attestation flow can be broadly in three main steps:

        -
      • An instancne of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
        • -
      • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrived.
        • +
      • An instance of the Azure Attestation service is setup with an appropriate attestation policy. The attestation policy allows the MDM provider to attest to particular events in the boot as well security features.
        • +
      • The MDM provider triggers a call to the attestation service, the device then performs an attestation check keeping the report ready to be retrieved.
      • The MDM provider after verifying the token is coming from the attestation service it can parse the attestation token to reflect on the attested state of the device.
      The protocol implemented can be found here: Attestation Protocol @@ -98,7 +98,7 @@ HealthAttestation **TriggerAttestation** (Required)

      Node type: EXECUTE -This node will trigger attestation flow by launching an attestation process. If a process is already running, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned. +This node will trigger attestation flow by launching an attestation process. If the attestation process is launched successfully, this node will return code 202 indicating the request is received and being processed. Otherwise, an error will be returned.

      Templated SyncML Call:

      @@ -231,7 +231,8 @@ This node will retrieve the service generated correlation IDs for the given MDM If success: GUID returned by the attestation service: 1k9+vQOn00S8ZK33;CMc969r1JEuHwDpM If Trigger Attestation call failed and no previous data is present. The field remains empty. - Otherwise, the last service correlation id will be returned. + Otherwise, the last service correlation id will be returned. In a successful attestation there are two + calls between client and MAA and for each call the GUID is separated by semicolon. > **_Note:_** MAA CSP nodes are available on arm64 but is not currently supported. @@ -450,7 +451,7 @@ GetAttestReport return the signed attestation token as a JWT.The JWT can be deco More information about TPM attestation can be found here. Microsoft Azure Attestation

      -## Windhows 10 Device HealthAttestation +## Windows 10 Device HealthAttestation ### Terms